Series comparison

-[PULL 00/20] target-arm queue
+[PULL 00/25] target-arm queue
-The following changes since commit b7c359c748a2e3ccb97a184b9739feb2cd48de2f:
+target-arm queue, mostly SME preliminaries.
-  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-01-23 14:38:43 +0000)
+In the unlikely event we don't land the rest of SME before freeze
 for 7.1 we can revert the docs/property changes included here.
 -- PMM
 The following changes since commit 097ccbbbaf2681df1e65542e5b7d2b2d0c66e2bc:
   Merge tag 'qemu-sparc-20220626' of https://github.com/mcayland/qemu into staging (2022-06-27 05:21:05 +0530)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200123
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220627
-for you to fetch changes up to 53c75ad8e72dc3a5102de7ed21e4990969cb0a19:
+for you to fetch changes up to 59e1b8a22ea9f947d038ccac784de1020f266e14:
-  hw/arm/exynos4210: Connect serial port DMA busy signals with pl330 (2020-01-23 15:22:42 +0000)
+  target/arm: Check V7VE as well as LPAE in arm_pamax (2022-06-27 11:18:17 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * fix bug in PAuth emulation
+ * sphinx: change default language to 'en'
- * add PMU to Cortex-R5, Cortex-R5F
+ * Diagnose attempts to emulate EL3 in hvf as well as kvm
- * qemu-nbd: Convert documentation to rST
+ * More SME groundwork patches
- * qemu-block-drivers: Convert documentation to rST
+ * virt: Fix calculation of physical address space size
- * Fix Exynos4210 UART DMA support
+   for v7VE CPUs (eg cortex-a15)
  * Various minor code cleanups
 ----------------------------------------------------------------
-Andrew Jones (1):
+Alexander Graf (2):
-      target/arm/arch_dump: Add SVE notes
+      accel: Introduce current_accel_name()
       target/arm: Catch invalid kvm state also for hvf
-Clement Deschamps (1):
+Martin Liška (1):
-      target/arm: add PMU feature to cortex-r5 and cortex-r5f
+      sphinx: change default language to 'en'
-Guenter Roeck (8):
+Richard Henderson (22):
-      dma/pl330: Convert to support tracing
+      target/arm: Implement TPIDR2_EL0
-      hw/core/or-irq: Increase limit of or-lines to 48
+      target/arm: Add SMEEXC_EL to TB flags
-      hw/arm/exynos4210: Fix DMA initialization
+      target/arm: Add syn_smetrap
-      hw/char/exynos4210_uart: Convert to support tracing
+      target/arm: Add ARM_CP_SME
-      hw/char/exynos4210_uart: Implement post_load function
+      target/arm: Add SVCR
-      hw/char/exynos4210_uart: Implement Rx FIFO level triggers and timeouts
+      target/arm: Add SMCR_ELx
-      hw/char/exynos4210_uart: Add receive DMA support
+      target/arm: Add SMIDR_EL1, SMPRI_EL1, SMPRIMAP_EL2
-      hw/arm/exynos4210: Connect serial port DMA busy signals with pl330
+      target/arm: Add PSTATE.{SM,ZA} to TB flags
       target/arm: Add the SME ZA storage to CPUARMState
       target/arm: Implement SMSTART, SMSTOP
       target/arm: Move error for sve%d property to arm_cpu_sve_finalize
       target/arm: Create ARMVQMap
       target/arm: Generalize cpu_arm_{get,set}_vq
       target/arm: Generalize cpu_arm_{get, set}_default_vec_len
       target/arm: Move arm_cpu_*_finalize to internals.h
       target/arm: Unexport aarch64_add_*_properties
       target/arm: Add cpu properties for SME
       target/arm: Introduce sve_vqm1_for_el_sm
       target/arm: Add SVL to TB flags
       target/arm: Move pred_{full, gvec}_reg_{offset, size} to translate-a64.h
       target/arm: Extend arm_pamax to more than aarch64
       target/arm: Check V7VE as well as LPAE in arm_pamax
-Keqian Zhu (2):
+ docs/conf.py                     |   2 +-
-      hw/acpi: Remove extra indent in ACPI GED hotplug cb
+ docs/system/arm/cpu-features.rst |  56 ++++++++++
-      hw/arm: Use helper function to trigger hotplug handler plug
+ include/qemu/accel.h             |   1 +
  target/arm/cpregs.h              |   5 +
  target/arm/cpu.h                 | 103 ++++++++++++++-----
  target/arm/helper-sme.h          |  21 ++++
  target/arm/helper.h              |   1 +
  target/arm/internals.h           |   4 +
  target/arm/syndrome.h            |  14 +++
  target/arm/translate-a64.h       |  38 +++++++
  target/arm/translate.h           |   6 ++
  accel/accel-common.c             |   8 ++
  hw/arm/virt.c                    |  10 +-
  softmmu/vl.c                     |   3 +-
  target/arm/cpu.c                 |  32 ++++--
  target/arm/cpu64.c               | 205 ++++++++++++++++++++++++++++---------
  target/arm/helper.c              | 213 +++++++++++++++++++++++++++++++++++++--
  target/arm/kvm64.c               |   2 +-
  target/arm/machine.c             |  34 +++++++
  target/arm/ptw.c                 |  26 +++--
  target/arm/sme_helper.c          |  61 +++++++++++
  target/arm/translate-a64.c       |  46 +++++++++
  target/arm/translate-sve.c       |  36 -------
  target/arm/meson.build           |   1 +
 files changed, 782 insertions(+), 146 deletions(-)
  create mode 100644 target/arm/helper-sme.h
  create mode 100644 target/arm/sme_helper.c
-Peter Maydell (3):
-      qemu-nbd: Convert invocation documentation to rST
-      docs: Create stub system manual
-      qemu-block-drivers: Convert to rST
-Philippe Mathieu-Daudé (1):
-      hw/misc/stm32f4xx_syscfg: Fix copy/paste error
-Richard Henderson (3):
-      tests/tcg/aarch64: Fix compilation parameters for pauth-%
-      tests/tcg/aarch64: Add pauth-3
-      tests/tcg/aarch64: Add pauth-4
-Vincent Dehors (1):
-      target/arm: Fix PAuth sbox functions
- Makefile                                  |  37 +-
- tests/tcg/aarch64/Makefile.softmmu-target |   5 +-
- tests/tcg/aarch64/Makefile.target         |   3 +-
- include/elf.h                             |   1 +
- include/hw/arm/exynos4210.h               |   4 +
- include/hw/or-irq.h                       |   2 +-
- target/arm/cpu.h                          |  25 +
- hw/acpi/generic_event_device.c            |   2 +-
- hw/arm/exynos4210.c                       |  77 ++-
- hw/arm/virt.c                             |   6 +-
- hw/char/exynos4210_uart.c                 | 245 +++++---
- hw/dma/pl330.c                            |  88 +--
- hw/misc/stm32f4xx_syscfg.c                |   2 +-
- target/arm/arch_dump.c                    | 124 +++-
- target/arm/cpu.c                          |   1 +
- target/arm/kvm64.c                        |  24 -
- target/arm/pauth_helper.c                 |   4 +-
- tests/tcg/aarch64/pauth-1.c               |   2 -
- tests/tcg/aarch64/pauth-2.c               |   2 -
- tests/tcg/aarch64/pauth-4.c               |  25 +
- tests/tcg/aarch64/system/pauth-3.c        |  40 ++
- MAINTAINERS                               |   1 +
- docs/index.html.in                        |   1 +
- docs/interop/conf.py                      |   4 +-
- docs/interop/index.rst                    |   1 +
- docs/interop/qemu-nbd.rst                 | 263 ++++++++
- docs/interop/qemu-option-trace.rst.inc    |  30 +
- docs/qemu-block-drivers.texi              | 889 ---------------------------
- docs/system/conf.py                       |  22 +
- docs/system/index.rst                     |  17 +
- docs/system/qemu-block-drivers.rst        | 985 ++++++++++++++++++++++++++++++
- hw/char/trace-events                      |  20 +
- hw/dma/trace-events                       |  24 +
- qemu-doc.texi                             |  18 -
- qemu-nbd.texi                             | 214 -------
- qemu-option-trace.texi                    |   4 +
- qemu-options.hx                           |   2 +-
-files changed, 1897 insertions(+), 1317 deletions(-)
- create mode 100644 tests/tcg/aarch64/pauth-4.c
- create mode 100644 tests/tcg/aarch64/system/pauth-3.c
- create mode 100644 docs/interop/qemu-nbd.rst
- create mode 100644 docs/interop/qemu-option-trace.rst.inc
- delete mode 100644 docs/qemu-block-drivers.texi
- create mode 100644 docs/system/conf.py
- create mode 100644 docs/system/index.rst
- create mode 100644 docs/system/qemu-block-drivers.rst
- delete mode 100644 qemu-nbd.texi

-[PULL 06/20] hw/acpi: Remove extra indent in ACPI GED hotplug cb
+[PULL 01/25] sphinx: change default language to 'en'
-From: Keqian Zhu <zhukeqian1@huawei.com>
+From: Martin Liška <mliska@suse.cz>
-There is extra indent in ACPI GED hotplug cb that should be
+Fixes the following Sphinx warning (treated as error) starting
-deleted.
+with 5.0 release:
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
+Warning, treated as error:
-Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Invalid configuration value found: 'language = None'. Update your configuration to a valid langauge code. Falling back to 'en' (English).
-Message-id: 20200120012755.44581-2-zhukeqian1@huawei.com
 Signed-off-by: Martin Liska <mliska@suse.cz>
 Message-id: e91e51ee-48ac-437e-6467-98b56ee40042@suse.cz
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/acpi/generic_event_device.c | 2 +-
+ docs/conf.py | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
+diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/acpi/generic_event_device.c
+--- a/docs/conf.py
-+++ b/hw/acpi/generic_event_device.c
++++ b/docs/conf.py
-@@ -XXX,XX +XXX,XX @@ static void acpi_ged_device_plug_cb(HotplugHandler *hotplug_dev,
+@@ -XXX,XX +XXX,XX @@
-     AcpiGedState *s = ACPI_GED(hotplug_dev);
+ #
+ # This is also used if you do content translation via gettext catalogs.
-     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
+ # Usually you set "language" from the command line for these cases.
--            acpi_memory_plug_cb(hotplug_dev, &s->memhp_state, dev, errp);
+-language = None
-+        acpi_memory_plug_cb(hotplug_dev, &s->memhp_state, dev, errp);
++language = 'en'
-     } else {
-         error_setg(errp, "virt: device plug request for unsupported device"
+ # List of patterns, relative to source directory, that match files and
-                    " type: %s", object_get_typename(OBJECT(dev)));
+ # directories to ignore when looking for source files.
 --
-.20.1
+.25.1

-New patch
+[PULL 02/25] accel: Introduce current_accel_name()
+From: Alexander Graf <agraf@csgraf.de>
+We need to fetch the name of the current accelerator in flexible error
+messages more going forward. Let's create a helper that gives it to us
+without casting in the target code.
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620192242.70573-1-agraf@csgraf.de
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/qemu/accel.h | 1 +
+ accel/accel-common.c | 8 ++++++++
+ softmmu/vl.c         | 3 +--
+files changed, 10 insertions(+), 2 deletions(-)
+diff --git a/include/qemu/accel.h b/include/qemu/accel.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/accel.h
++++ b/include/qemu/accel.h
+@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
+ AccelClass *accel_find(const char *opt_name);
+ AccelState *current_accel(void);
++const char *current_accel_name(void);
+ void accel_init_interfaces(AccelClass *ac);
+diff --git a/accel/accel-common.c b/accel/accel-common.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/accel-common.c
++++ b/accel/accel-common.c
+@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
+     return ac;
+ }
++/* Return the name of the current accelerator */
++const char *current_accel_name(void)
++{
++    AccelClass *ac = ACCEL_GET_CLASS(current_accel());
++
++    return ac->name;
++}
++
+ static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+ {
+     CPUClass *cc = CPU_CLASS(klass);
+diff --git a/softmmu/vl.c b/softmmu/vl.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/vl.c
++++ b/softmmu/vl.c
+@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
+     }
+     if (init_failed && !qtest_chrdev) {
+-        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
+-        error_report("falling back to %s", ac->name);
++        error_report("falling back to %s", current_accel_name());
+     }
+     if (icount_enabled() && !tcg_enabled()) {
+--
+.25.1

-[PULL 01/20] target/arm: add PMU feature to cortex-r5 and cortex-r5f
+[PULL 03/25] target/arm: Catch invalid kvm state also for hvf
-From: Clement Deschamps <clement.deschamps@greensocs.com>
+From: Alexander Graf <agraf@csgraf.de>
-The PMU is not optional on cortex-r5 and cortex-r5f (see
+Some features such as running in EL3 or running M profile code are
-the "Features" chapter of the Technical Reference Manual).
+incompatible with virtualization as QEMU implements it today. To prevent
 users from picking invalid configurations on other virt solutions like
 Hvf, let's run the same checks there too.
-Signed-off-by: Clement Deschamps <clement.deschamps@greensocs.com>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1073
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
-Message-id: 20200114105918.2366370-1-clement.deschamps@greensocs.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220620192242.70573-2-agraf@csgraf.de
 [PMM: Allow qtest accelerator too; tweak comment]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c | 1 +
+ target/arm/cpu.c | 16 ++++++++++++----
-file changed, 1 insertion(+)
+file changed, 12 insertions(+), 4 deletions(-)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@
-     set_feature(&cpu->env, ARM_FEATURE_V7);
+ #include "hw/boards.h"
-     set_feature(&cpu->env, ARM_FEATURE_V7MP);
+ #endif
-     set_feature(&cpu->env, ARM_FEATURE_PMSA);
+ #include "sysemu/tcg.h"
-+    set_feature(&cpu->env, ARM_FEATURE_PMU);
++#include "sysemu/qtest.h"
-     cpu->midr = 0x411fc153; /* r1p3 */
+ #include "sysemu/hw_accel.h"
-     cpu->id_pfr0 = 0x0131;
+ #include "kvm_arm.h"
-     cpu->id_pfr1 = 0x001;
+ #include "disas/capstone.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          }
      }
 -    if (kvm_enabled()) {
 +    if (!tcg_enabled() && !qtest_enabled()) {
          /*
 +         * We assume that no accelerator except TCG (and the "not really an
 +         * accelerator" qtest) can handle these features, because Arm hardware
 +         * virtualization can't virtualize them.
 +         *
           * Catch all the cases which might cause us to create more than one
           * address space for the CPU (otherwise we will assert() later in
           * cpu_address_space_init()).
           */
          if (arm_feature(env, ARM_FEATURE_M)) {
              error_setg(errp,
 -                       "Cannot enable KVM when using an M-profile guest CPU");
 +                       "Cannot enable %s when using an M-profile guest CPU",
 +                       current_accel_name());
              return;
          }
          if (cpu->has_el3) {
              error_setg(errp,
 -                       "Cannot enable KVM when guest CPU has EL3 enabled");
 +                       "Cannot enable %s when guest CPU has EL3 enabled",
 +                       current_accel_name());
              return;
          }
          if (cpu->tag_memory) {
              error_setg(errp,
 -                       "Cannot enable KVM when guest CPUs has MTE enabled");
 +                       "Cannot enable %s when guest CPUs has MTE enabled",
 +                       current_accel_name());
              return;
          }
      }
 --
-.20.1
+.25.1

-New patch
+[PULL 04/25] target/arm: Implement TPIDR2_EL0
+From: Richard Henderson <richard.henderson@linaro.org>
+This register is part of SME, but isn't closely related to the
+rest of the extension.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-2-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h    |  1 +
+ target/arm/helper.c | 32 ++++++++++++++++++++++++++++++++
+files changed, 33 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+             };
+             uint64_t tpidr_el[4];
+         };
++        uint64_t tpidr2_el0;
+         /* The secure banks of these registers don't map anywhere */
+         uint64_t tpidrurw_s;
+         uint64_t tpidrprw_s;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_reginfo[] = {
+       .writefn = zcr_write, .raw_writefn = raw_write },
+ };
++#ifdef TARGET_AARCH64
++static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
++                                    bool isread)
++{
++    int el = arm_current_el(env);
++
++    if (el == 0) {
++        uint64_t sctlr = arm_sctlr(env, el);
++        if (!(sctlr & SCTLR_EnTP2)) {
++            return CP_ACCESS_TRAP;
++        }
++    }
++    /* TODO: FEAT_FGT */
++    if (el < 3
++        && arm_feature(env, ARM_FEATURE_EL3)
++        && !(env->cp15.scr_el3 & SCR_ENTP2)) {
++        return CP_ACCESS_TRAP_EL3;
++    }
++    return CP_ACCESS_OK;
++}
++
++static const ARMCPRegInfo sme_reginfo[] = {
++    { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
++      .access = PL0_RW, .accessfn = access_tpidr2,
++      .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
++};
++#endif /* TARGET_AARCH64 */
++
+ void hw_watchpoint_update(ARMCPU *cpu, int n)
+ {
+     CPUARMState *env = &cpu->env;
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+     }
+ #ifdef TARGET_AARCH64
++    if (cpu_isar_feature(aa64_sme, cpu)) {
++        define_arm_cp_regs(cpu, sme_reginfo);
++    }
+     if (cpu_isar_feature(aa64_pauth, cpu)) {
+         define_arm_cp_regs(cpu, pauth_reginfo);
+     }
+--
+.25.1

-[PULL 16/20] hw/char/exynos4210_uart: Convert to support tracing
+[PULL 05/25] target/arm: Add SMEEXC_EL to TB flags
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-Replace debug code with tracing to aid debugging.
+This is CheckSMEAccess, which is the basis for a set of
 related tests for various SME cpregs and instructions.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200123052540.6132-5-linux@roeck-us.net
+Message-id: 20220620175235.60881-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/exynos4210_uart.c | 96 ++++++++++++---------------------------
+ target/arm/cpu.h           |  2 ++
- hw/char/trace-events      | 17 +++++++
+ target/arm/translate.h     |  1 +
-files changed, 47 insertions(+), 66 deletions(-)
+ target/arm/helper.c        | 52 ++++++++++++++++++++++++++++++++++++++
  target/arm/translate-a64.c |  1 +
 files changed, 56 insertions(+)
-diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/exynos4210_uart.c
+--- a/target/arm/cpu.h
-+++ b/hw/char/exynos4210_uart.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env);
- #include "hw/irq.h"
- #include "hw/qdev-properties.h"
+ int fp_exception_el(CPUARMState *env, int cur_el);
+ int sve_exception_el(CPUARMState *env, int cur_el);
--#undef DEBUG_UART
++int sme_exception_el(CPUARMState *env, int cur_el);
--#undef DEBUG_UART_EXTEND
--#undef DEBUG_IRQ
+ /**
--#undef DEBUG_Rx_DATA
+  * sve_vqm1_for_el:
--#undef DEBUG_Tx_DATA
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, ATA, 15, 1)
--
+ FIELD(TBFLAG_A64, TCMA, 16, 2)
--#define DEBUG_UART            0
+ FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
--#define DEBUG_UART_EXTEND     0
+ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
--#define DEBUG_IRQ             0
++FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
 -#define DEBUG_Rx_DATA         0
 -#define DEBUG_Tx_DATA         0
 -
 -#if DEBUG_UART
 -#define  PRINT_DEBUG(fmt, args...)  \
 -        do { \
 -            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
 -        } while (0)
 -
 -#if DEBUG_UART_EXTEND
 -#define  PRINT_DEBUG_EXTEND(fmt, args...) \
 -        do { \
 -            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
 -        } while (0)
 -#else
 -#define  PRINT_DEBUG_EXTEND(fmt, args...) \
 -        do {} while (0)
 -#endif /* EXTEND */
 -
 -#else
 -#define  PRINT_DEBUG(fmt, args...)  \
 -        do {} while (0)
 -#define  PRINT_DEBUG_EXTEND(fmt, args...) \
 -        do {} while (0)
 -#endif
 -
 -#define  PRINT_ERROR(fmt, args...) \
 -        do { \
 -            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
 -        } while (0)
 +#include "trace.h"
  /*
-  *  Offsets for UART registers relative to SFR base address
+  * Helpers for using the above.
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210UartState {
+diff --git a/target/arm/translate.h b/target/arm/translate.h
- } Exynos4210UartState;
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
--#if DEBUG_UART
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
--/* Used only for debugging inside PRINT_DEBUG_... macros */
+     bool ns;        /* Use non-secure CPREG bank on access */
-+/* Used only for tracing */
+     int fp_excp_el; /* FP exception EL or 0 if enabled */
- static const char *exynos4210_uart_regname(hwaddr  offset)
+     int sve_excp_el; /* SVE exception EL or 0 if enabled */
- {
++    int sme_excp_el; /* SME exception EL or 0 if enabled */
+     int vl;          /* current vector length in bytes */
-@@ -XXX,XX +XXX,XX @@ static const char *exynos4210_uart_regname(hwaddr  offset)
+     bool vfp_enabled; /* FP enabled via FPSCR.EN */
+     int vec_len;
-     return NULL;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
- }
+index XXXXXXX..XXXXXXX 100644
--#endif
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
  static void fifo_store(Exynos4210UartFIFO *q, uint8_t ch)
@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState
          break;
      default:
          level = 0;
 -        PRINT_ERROR("Wrong UART channel number: %d\n", s->channel);
 +        trace_exynos_uart_channel_error(s->channel);
      }
      return level;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
      if (s->reg[I_(UINTP)]) {
          qemu_irq_raise(s->irq);
 -
 -#if DEBUG_IRQ
 -        fprintf(stderr, "UART%d: IRQ has been raised: %08x\n",
 -                s->channel, s->reg[I_(UINTP)]);
 -#endif
 -
 +        trace_exynos_uart_irq_raised(s->channel, s->reg[I_(UINTP)]);
      } else {
          qemu_irq_lower(s->irq);
 +        trace_exynos_uart_irq_lowered(s->channel);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_parameters(Exynos4210UartState *s)
      qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
 -    PRINT_DEBUG("UART%d: speed: %d, parity: %c, data: %d, stop: %d\n",
 +    trace_exynos_uart_update_params(
                  s->channel, speed, parity, data_bits, stop_bits);
  }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
      Exynos4210UartState *s = (Exynos4210UartState *)opaque;
      uint8_t ch;
 -    PRINT_DEBUG_EXTEND("UART%d: <0x%04x> %s <- 0x%08llx\n", s->channel,
 -        offset, exynos4210_uart_regname(offset), (long long unsigned int)val);
 +    trace_exynos_uart_write(s->channel, offset,
 +                            exynos4210_uart_regname(offset), val);
      switch (offset) {
      case ULCON:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
          if (val & UFCON_Rx_FIFO_RESET) {
              fifo_reset(&s->rx);
              s->reg[I_(UFCON)] &= ~UFCON_Rx_FIFO_RESET;
 -            PRINT_DEBUG("UART%d: Rx FIFO Reset\n", s->channel);
 +            trace_exynos_uart_rx_fifo_reset(s->channel);
          }
          if (val & UFCON_Tx_FIFO_RESET) {
              fifo_reset(&s->tx);
              s->reg[I_(UFCON)] &= ~UFCON_Tx_FIFO_RESET;
 -            PRINT_DEBUG("UART%d: Tx FIFO Reset\n", s->channel);
 +            trace_exynos_uart_tx_fifo_reset(s->channel);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
              /* XXX this blocks entire thread. Rewrite to use
               * qemu_chr_fe_write and background I/O callbacks */
              qemu_chr_fe_write_all(&s->chr, &ch, 1);
 -#if DEBUG_Tx_DATA
 -            fprintf(stderr, "%c", ch);
 -#endif
 +            trace_exynos_uart_tx(s->channel, ch);
              s->reg[I_(UTRSTAT)] |= UTRSTAT_TRANSMITTER_EMPTY |
                      UTRSTAT_Tx_BUFFER_EMPTY;
              s->reg[I_(UINTSP)]  |= UINTSP_TXD;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
      case UINTP:
          s->reg[I_(UINTP)] &= ~val;
          s->reg[I_(UINTSP)] &= ~val;
 -        PRINT_DEBUG("UART%d: UINTP [%04x] have been cleared: %08x\n",
 -                    s->channel, offset, s->reg[I_(UINTP)]);
 +        trace_exynos_uart_intclr(s->channel, s->reg[I_(UINTP)]);
          exynos4210_uart_update_irq(s);
          break;
      case UTRSTAT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
      case UFSTAT:
      case UMSTAT:
      case URXH:
 -        PRINT_DEBUG("UART%d: Trying to write into RO register: %s [%04x]\n",
 +        trace_exynos_uart_ro_write(
                      s->channel, exynos4210_uart_regname(offset), offset);
          break;
      case UINTSP:
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
      case UERSTAT: /* Read Only */
          res = s->reg[I_(UERSTAT)];
          s->reg[I_(UERSTAT)] = 0;
 +        trace_exynos_uart_read(s->channel, offset,
 +                               exynos4210_uart_regname(offset), res);
          return res;
      case UFSTAT: /* Read Only */
          s->reg[I_(UFSTAT)] = fifo_elements_number(&s->rx) & 0xff;
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
              s->reg[I_(UFSTAT)] |= UFSTAT_Rx_FIFO_FULL;
              s->reg[I_(UFSTAT)] &= ~0xff;
          }
 +        trace_exynos_uart_read(s->channel, offset,
 +                               exynos4210_uart_regname(offset),
 +                               s->reg[I_(UFSTAT)]);
          return s->reg[I_(UFSTAT)];
      case URXH:
          if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) {
              if (fifo_elements_number(&s->rx)) {
                  res = fifo_retrieve(&s->rx);
 -#if DEBUG_Rx_DATA
 -                fprintf(stderr, "%c", res);
 -#endif
 +                trace_exynos_uart_rx(s->channel, res);
                  if (!fifo_elements_number(&s->rx)) {
                      s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY;
                  } else {
                      s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
                  }
              } else {
 +                trace_exynos_uart_rx_error(s->channel);
                  s->reg[I_(UINTSP)] |= UINTSP_ERROR;
                  exynos4210_uart_update_irq(s);
                  res = 0;
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
              s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY;
              res = s->reg[I_(URXH)];
          }
 +        trace_exynos_uart_read(s->channel, offset,
 +                               exynos4210_uart_regname(offset), res);
          return res;
      case UTXH:
 -        PRINT_DEBUG("UART%d: Trying to read from WO register: %s [%04x]\n",
 -                    s->channel, exynos4210_uart_regname(offset), offset);
 +        trace_exynos_uart_wo_read(s->channel, exynos4210_uart_regname(offset),
 +                                  offset);
          break;
      default:
 +        trace_exynos_uart_read(s->channel, offset,
 +                               exynos4210_uart_regname(offset),
 +                               s->reg[I_(offset)]);
          return s->reg[I_(offset)];
      }
 +    trace_exynos_uart_read(s->channel, offset, exynos4210_uart_regname(offset),
 +                           0);
      return 0;
  }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_reset(DeviceState *dev)
++/*
-     fifo_reset(&s->rx);
++ * Return the exception level to which exceptions should be taken for SME.
-     fifo_reset(&s->tx);
++ * C.f. the ARM pseudocode function CheckSMEAccess.
++ */
--    PRINT_DEBUG("UART%d: Rx FIFO size: %d\n", s->channel, s->rx.size);
++int sme_exception_el(CPUARMState *env, int el)
-+    trace_exynos_uart_rxsize(s->channel, s->rx.size);
++{
- }
++#ifndef CONFIG_USER_ONLY
++    if (el <= 1 && !el_is_in_host(env, el)) {
- static const VMStateDescription vmstate_exynos4210_uart_fifo = {
++        switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) {
-diff --git a/hw/char/trace-events b/hw/char/trace-events
++        case 1:
 +            if (el != 0) {
 +                break;
 +            }
 +            /* fall through */
 +        case 0:
 +        case 2:
 +            return 1;
 +        }
 +    }
 +
 +    if (el <= 2 && arm_is_el2_enabled(env)) {
 +        /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
 +        if (env->cp15.hcr_el2 & HCR_E2H) {
 +            switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) {
 +            case 1:
 +                if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) {
 +                    break;
 +                }
 +                /* fall through */
 +            case 0:
 +            case 2:
 +                return 2;
 +            }
 +        } else {
 +            if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) {
 +                return 2;
 +            }
 +        }
 +    }
 +
 +    /* CPTR_EL3.  Since ESM is negative we must check for EL3.  */
 +    if (arm_feature(env, ARM_FEATURE_EL3)
 +        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
 +        return 3;
 +    }
 +#endif
 +    return 0;
 +}
 +
  /*
   * Given that SVE is enabled, return the vector length for EL.
   */
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
          }
          DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
      }
 +    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
 +        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
 +    }
      sctlr = regime_sctlr(env, stage1);
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/trace-events
+--- a/target/arm/translate-a64.c
-+++ b/hw/char/trace-events
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
- # nrf51_uart.c
+     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
- nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
+     dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
- nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
+     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
-+
++    dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
-+# exynos4210_uart.c
+     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
-+exynos_uart_irq_raised(uint32_t channel, uint32_t reg) "UART%d: IRQ raised: 0x%08"PRIx32
+     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
-+exynos_uart_irq_lowered(uint32_t channel) "UART%d: IRQ lowered"
+     dc->bt = EX_TBFLAG_A64(tb_flags, BT);
 +exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d"
 +exynos_uart_write(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s <- 0x%" PRIx64
 +exynos_uart_read(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s -> 0x%" PRIx64
 +exynos_uart_rx_fifo_reset(uint32_t channel) "UART%d: Rx FIFO Reset"
 +exynos_uart_tx_fifo_reset(uint32_t channel) "UART%d: Tx FIFO Reset"
 +exynos_uart_tx(uint32_t channel, uint8_t ch) "UART%d: Tx 0x%02"PRIx32
 +exynos_uart_intclr(uint32_t channel, uint32_t reg) "UART%d: interrupts cleared: 0x%08"PRIx32
 +exynos_uart_ro_write(uint32_t channel, const char *name, uint32_t reg) "UART%d: Trying to write into RO register: %s [0x%04"PRIx32"]"
 +exynos_uart_rx(uint32_t channel, uint8_t ch) "UART%d: Rx 0x%02"PRIx32
 +exynos_uart_rx_error(uint32_t channel) "UART%d: Rx error"
 +exynos_uart_wo_read(uint32_t channel, const char *name, uint32_t reg) "UART%d: Trying to read from WO register: %s [0x%04"PRIx32"]"
 +exynos_uart_rxsize(uint32_t channel, uint32_t size) "UART%d: Rx FIFO size: %d"
 +exynos_uart_channel_error(uint32_t channel) "Wrong UART channel number: %d"
 --
-.20.1
+.25.1

-New patch
+[PULL 06/25] target/arm: Add syn_smetrap
+From: Richard Henderson <richard.henderson@linaro.org>
+This will be used for raising various traps for SME.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/syndrome.h | 14 ++++++++++++++
+file changed, 14 insertions(+)
+diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/syndrome.h
++++ b/target/arm/syndrome.h
+@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
+     EC_AA64_SMC               = 0x17,
+     EC_SYSTEMREGISTERTRAP     = 0x18,
+     EC_SVEACCESSTRAP          = 0x19,
++    EC_SMETRAP                = 0x1d,
+     EC_INSNABORT              = 0x20,
+     EC_INSNABORT_SAME_EL      = 0x21,
+     EC_PCALIGNMENT            = 0x22,
+@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
+     EC_AA64_BKPT              = 0x3c,
+ };
++typedef enum {
++    SME_ET_AccessTrap,
++    SME_ET_Streaming,
++    SME_ET_NotStreaming,
++    SME_ET_InactiveZA,
++} SMEExceptionType;
++
+ #define ARM_EL_EC_SHIFT 26
+ #define ARM_EL_IL_SHIFT 25
+ #define ARM_EL_ISV_SHIFT 24
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_sve_access_trap(void)
+     return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
+ }
++static inline uint32_t syn_smetrap(SMEExceptionType etype, bool is_16bit)
++{
++    return (EC_SMETRAP << ARM_EL_EC_SHIFT)
++        | (is_16bit ? 0 : ARM_EL_IL) | etype;
++}
++
+ static inline uint32_t syn_pactrap(void)
+ {
+     return EC_PACTRAP << ARM_EL_EC_SHIFT;
+--
+.25.1

-[PULL 19/20] hw/char/exynos4210_uart: Add receive DMA support
+[PULL 07/25] target/arm: Add ARM_CP_SME
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-To support receive DMA, we need to inform the DMA controller if receive data
+This will be used for controlling access to SME cpregs.
 is available. Otherwise the DMA controller keeps requesting data, causing
 receive errors.
 Implement this using an interrupt line. The instantiating code then needs
 to connect the interrupt with the matching DMA controller GPIO pin.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200123052540.6132-8-linux@roeck-us.net
+Message-id: 20220620175235.60881-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/exynos4210_uart.c | 24 ++++++++++++++++++++++++
+ target/arm/cpregs.h        |  5 +++++
- hw/char/trace-events      |  2 ++
+ target/arm/translate-a64.c | 18 ++++++++++++++++++
-files changed, 26 insertions(+)
+files changed, 23 insertions(+)
-diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/exynos4210_uart.c
+--- a/target/arm/cpregs.h
-+++ b/hw/char/exynos4210_uart.c
++++ b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210UartState {
+@@ -XXX,XX +XXX,XX @@ enum {
+     ARM_CP_EL3_NO_EL2_UNDEF      = 1 << 16,
-     CharBackend       chr;
+     ARM_CP_EL3_NO_EL2_KEEP       = 1 << 17,
-     qemu_irq          irq;
+     ARM_CP_EL3_NO_EL2_C_NZ       = 1 << 18,
-+    qemu_irq          dmairq;
++    /*
++     * Flag: Access check for this sysreg is constrained by the
-     uint32_t channel;
++     * ARM pseudocode function CheckSMEAccess().
++     */
-@@ -XXX,XX +XXX,XX @@ exynos4210_uart_Rx_FIFO_trigger_level(const Exynos4210UartState *s)
++    ARM_CP_SME                   = 1 << 19,
-     return exynos4210_uart_FIFO_trigger_level(s->channel, reg);
+ };
  /*
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
      return fp_access_check(s);
  }
 +/*
-+ * Update Rx DMA busy signal if Rx DMA is enabled. For simplicity,
++ * Check that SME access is enabled, raise an exception if not.
-+ * mark DMA as busy if DMA is enabled and the receive buffer is empty.
++ * Note that this function corresponds to CheckSMEAccess and is
 + * only used directly for cpregs.
 + */
-+static void exynos4210_uart_update_dmabusy(Exynos4210UartState *s)
++static bool sme_access_check(DisasContext *s)
 +{
-+    bool rx_dma_enabled = (s->reg[I_(UCON)] & 0x03) == 0x02;
++    if (s->sme_excp_el) {
-+    uint32_t count = fifo_elements_number(&s->rx);
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
-+
++                              syn_smetrap(SME_ET_AccessTrap, false),
-+    if (rx_dma_enabled && !count) {
++                              s->sme_excp_el);
-+        qemu_irq_raise(s->dmairq);
++        return false;
 +        trace_exynos_uart_dmabusy(s->channel);
 +    } else {
 +        qemu_irq_lower(s->dmairq);
 +        trace_exynos_uart_dmaready(s->channel);
 +    }
++    return true;
 +}
 +
- static void exynos4210_uart_update_irq(Exynos4210UartState *s)
+ /*
- {
+  * This utility function is for doing register extension with an
-     /*
+  * optional shift. You will likely want to pass a temporary for the
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
+@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
-         count = fifo_elements_number(&s->rx);
+         return;
-         if ((count && !(s->reg[I_(UCON)] & 0x80)) ||
+     } else if ((ri->type & ARM_CP_SVE) && !sve_access_check(s)) {
-             count >= exynos4210_uart_Rx_FIFO_trigger_level(s)) {
+         return;
-+            exynos4210_uart_update_dmabusy(s);
++    } else if ((ri->type & ARM_CP_SME) && !sme_access_check(s)) {
-             s->reg[I_(UINTSP)] |= UINTSP_RXD;
++        return;
              timer_del(s->fifo_timeout_timer);
          }
      } else if (s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY) {
 +        exynos4210_uart_update_dmabusy(s);
          s->reg[I_(UINTSP)] |= UINTSP_RXD;
      }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_timeout_int(void *opaque)
+     if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
          (s->reg[I_(UCON)] & (1 << 11))) {
          s->reg[I_(UINTSP)] |= UINTSP_RXD;
          s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_TIMEOUT;
 +        exynos4210_uart_update_dmabusy(s);
          exynos4210_uart_update_irq(s);
      }
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
              s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY;
              res = s->reg[I_(URXH)];
          }
 +        exynos4210_uart_update_dmabusy(s);
          trace_exynos_uart_read(s->channel, offset,
                                 exynos4210_uart_regname(offset), res);
          return res;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_init(Object *obj)
      sysbus_init_mmio(dev, &s->iomem);
      sysbus_init_irq(dev, &s->irq);
 +    sysbus_init_irq(dev, &s->dmairq);
  }
  static void exynos4210_uart_realize(DeviceState *dev, Error **errp)
 diff --git a/hw/char/trace-events b/hw/char/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/trace-events
 +++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64
  nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
  # exynos4210_uart.c
 +exynos_uart_dmabusy(uint32_t channel) "UART%d: DMA busy (Rx buffer empty)"
 +exynos_uart_dmaready(uint32_t channel) "UART%d: DMA ready"
  exynos_uart_irq_raised(uint32_t channel, uint32_t reg) "UART%d: IRQ raised: 0x%08"PRIx32
  exynos_uart_irq_lowered(uint32_t channel) "UART%d: IRQ lowered"
  exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop, uint64_t wordtime) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d wordtime: %"PRId64"ns"
 --
-.20.1
+.25.1

-New patch
+[PULL 08/25] target/arm: Add SVCR
+From: Richard Henderson <richard.henderson@linaro.org>
+This cpreg is used to access two new bits of PSTATE
+that are not visible via any other mechanism.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-6-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h    |  6 ++++++
+ target/arm/helper.c | 13 +++++++++++++
+files changed, 19 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+      *  nRW (also known as M[4]) is kept, inverted, in env->aarch64
+      *  DAIF (exception masks) are kept in env->daif
+      *  BTYPE is kept in env->btype
++     *  SM and ZA are kept in env->svcr
+      *  all other bits are stored in their correct places in env->pstate
+      */
+     uint32_t pstate;
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+     uint32_t condexec_bits; /* IT bits.  cpsr[15:10,26:25].  */
+     uint32_t btype;  /* BTI branch type.  spsr[11:10].  */
+     uint64_t daif; /* exception masks, in the bits they are in PSTATE */
++    uint64_t svcr; /* PSTATE.{SM,ZA} in the bits they are in SVCR */
+     uint64_t elr_el[4]; /* AArch64 exception link regs  */
+     uint64_t sp_el[4]; /* AArch64 banked stack pointers */
+@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
+ #define PSTATE_MODE_EL1t 4
+ #define PSTATE_MODE_EL0t 0
++/* PSTATE bits that are accessed via SVCR and not stored in SPSR_ELx. */
++FIELD(SVCR, SM, 0, 1)
++FIELD(SVCR, ZA, 1, 1)
++
+ /* Write a new value to v7m.exception, thus transitioning into or out
+  * of Handler mode; this may result in a change of active stack pointer.
+  */
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
+     return CP_ACCESS_OK;
+ }
++static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
++                       uint64_t value)
++{
++    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
++    /* TODO: Side effects. */
++    env->svcr = value;
++}
++
+ static const ARMCPRegInfo sme_reginfo[] = {
+     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
+       .access = PL0_RW, .accessfn = access_tpidr2,
+       .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
++    { .name = "SVCR", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2,
++      .access = PL0_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, svcr),
++      .writefn = svcr_write, .raw_writefn = raw_write },
+ };
+ #endif /* TARGET_AARCH64 */
+--
+.25.1

-[PULL 04/20] tests/tcg/aarch64: Add pauth-3
+[PULL 09/25] target/arm: Add SMCR_ELx
 From: Richard Henderson <richard.henderson@linaro.org>
-This is the test vector from the QARMA paper, run through PACGA.
+These cpregs control the streaming vector length and whether the
 full a64 instruction set is allowed while in streaming mode.
-Suggested-by: Vincent Dehors <vincent.dehors@smile.fr>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200116230809.19078-4-richard.henderson@linaro.org
+Message-id: 20220620175235.60881-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/tcg/aarch64/Makefile.softmmu-target |  5 ++-
+ target/arm/cpu.h    |  8 ++++++--
- tests/tcg/aarch64/system/pauth-3.c        | 40 +++++++++++++++++++++++
+ target/arm/helper.c | 41 +++++++++++++++++++++++++++++++++++++++++
-files changed, 44 insertions(+), 1 deletion(-)
+files changed, 47 insertions(+), 2 deletions(-)
  create mode 100644 tests/tcg/aarch64/system/pauth-3.c
-diff --git a/tests/tcg/aarch64/Makefile.softmmu-target b/tests/tcg/aarch64/Makefile.softmmu-target
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/aarch64/Makefile.softmmu-target
+--- a/target/arm/cpu.h
-+++ b/tests/tcg/aarch64/Makefile.softmmu-target
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ run-memory-replay: memory-replay run-memory-record
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-              $(QEMU_OPTS) memory, \
+         float_status standard_fp_status;
-       "$< on $(TARGET_NAME)")
+         float_status standard_fp_status_f16;
--EXTRA_TESTS+=memory-record memory-replay
+-        /* ZCR_EL[1-3] */
-+run-pauth-3: pauth-3
+-        uint64_t zcr_el[4];
-+pauth-3: CFLAGS += -march=armv8.3-a
++        uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
 +        uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
      } vfp;
      uint64_t exclusive_addr;
      uint64_t exclusive_val;
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
  FIELD(SVCR, SM, 0, 1)
  FIELD(SVCR, ZA, 1, 1)
 +/* Fields for SMCR_ELx. */
 +FIELD(SMCR, LEN, 0, 4)
 +FIELD(SMCR, FA64, 31, 1)
 +
-+EXTRA_TESTS+=memory-record memory-replay pauth-3
+ /* Write a new value to v7m.exception, thus transitioning into or out
-diff --git a/tests/tcg/aarch64/system/pauth-3.c b/tests/tcg/aarch64/system/pauth-3.c
+  * of Handler mode; this may result in a change of active stack pointer.
-new file mode 100644
+  */
-index XXXXXXX..XXXXXXX
+diff --git a/target/arm/helper.c b/target/arm/helper.c
---- /dev/null
+index XXXXXXX..XXXXXXX 100644
-+++ b/tests/tcg/aarch64/system/pauth-3.c
+--- a/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
++++ b/target/arm/helper.c
-+#include <inttypes.h>
+@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
-+#include <minilib.h>
+          */
          { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
            "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
 +        { K(3, 0,  1, 2, 6), K(3, 4,  1, 2, 6), K(3, 5, 1, 2, 6),
 +          "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme },
          { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
            "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
@@ -XXX,XX +XXX,XX @@ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
      env->svcr = value;
  }
 +static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                       uint64_t value)
 +{
 +    int cur_el = arm_current_el(env);
 +    int old_len = sve_vqm1_for_el(env, cur_el);
 +    int new_len;
 +
-+int main()
++    QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1);
-+{
++    value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK;
 +    raw_write(env, ri, value);
 +
 +    /*
-+     * Test vector from QARMA paper (https://eprint.iacr.org/2016/444.pdf)
++     * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage
-+     * to verify one computation of the pauth_computepac() function,
++     * when SVL is widened (old values kept, or zeros).  Choose to keep the
-+     * which uses sbox2.
++     * current values for simplicity.  But for QEMU internals, we must still
-+     *
++     * apply the narrower SVL to the Zregs and Pregs -- see the comment
-+     * Use PACGA, because it returns the most bits from ComputePAC.
++     * above aarch64_sve_narrow_vq.
 +     * We still only get the most significant 32-bits of the result.
 +     */
-+
++    new_len = sve_vqm1_for_el(env, cur_el);
-+    static const uint64_t d[5] = {
++    if (new_len < old_len) {
-+        0xfb623599da6e8127ull,
++        aarch64_sve_narrow_vq(env, new_len + 1);
 +        0x477d469dec0b8762ull,
 +        0x84be85ce9804e94bull,
 +        0xec2802d4e0a488e9ull,
 +        0xc003b93999b33765ull & 0xffffffff00000000ull
 +    };
 +    uint64_t r;
 +
 +    asm("msr apgakeyhi_el1, %[w0]\n\t"
 +        "msr apgakeylo_el1, %[k0]\n\t"
 +        "pacga %[r], %[P], %[T]"
 +        : [r] "=r"(r)
 +        : [P] "r" (d[0]),
 +          [T] "r" (d[1]),
 +          [w0] "r" (d[2]),
 +          [k0] "r" (d[3]));
 +
 +    if (r == d[4]) {
 +        ml_printf("OK\n");
 +        return 0;
 +    } else {
 +        ml_printf("FAIL: %lx != %lx\n", r, d[4]);
 +        return 1;
 +    }
 +}
++
+ static const ARMCPRegInfo sme_reginfo[] = {
+     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
+       .access = PL0_RW, .type = ARM_CP_SME,
+       .fieldoffset = offsetof(CPUARMState, svcr),
+       .writefn = svcr_write, .raw_writefn = raw_write },
++    { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6,
++      .access = PL1_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]),
++      .writefn = smcr_write, .raw_writefn = raw_write },
++    { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6,
++      .access = PL2_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]),
++      .writefn = smcr_write, .raw_writefn = raw_write },
++    { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6,
++      .access = PL3_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
++      .writefn = smcr_write, .raw_writefn = raw_write },
+ };
+ #endif /* TARGET_AARCH64 */
 --
-.20.1
+.25.1

-[PULL 15/20] hw/arm/exynos4210: Fix DMA initialization
+[PULL 10/25] target/arm: Add SMIDR_EL1, SMPRI_EL1, SMPRIMAP_EL2
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-First parameter to exynos4210_get_irq() is not the SPI port number,
+Implement the streaming mode identification register, and the
-but the interrupt group number. Interrupt groups are 20 for mdma
+two streaming priority registers.  For QEMU, they are all RES0.
 and 21 for pdma. Interrupts are not inverted. Controllers support 32
 events (pdma) or 31 events (mdma). Events must all be routed to a single
 interrupt line. Set other parameters as documented in Exynos4210 datasheet,
 section 8 (DMA controller).
-Fixes: 59520dc65e ("hw/arm/exynos4210: Add DMA support for the Exynos4210")
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200123052540.6132-4-linux@roeck-us.net
+Message-id: 20220620175235.60881-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/exynos4210.h |  4 +++
+ target/arm/helper.c | 33 +++++++++++++++++++++++++++++++++
- hw/arm/exynos4210.c         | 51 +++++++++++++++++++++++++++++++------
+file changed, 33 insertions(+)
 files changed, 47 insertions(+), 8 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/helper.c
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
- #ifndef EXYNOS4210_H
+     return CP_ACCESS_OK;
  #define EXYNOS4210_H
 +#include "hw/or-irq.h"
  #include "hw/sysbus.h"
  #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@
  #define EXYNOS4210_I2C_NUMBER               9
 +#define EXYNOS4210_NUM_DMA      3
 +
  typedef struct Exynos4210Irq {
      qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
      qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
      MemoryRegion boot_secondary;
      MemoryRegion bootreg_mem;
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 +    qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
  } Exynos4210State;
  #define TYPE_EXYNOS4210_SOC "exynos4210"
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
      return (0x9 << ARM_AFF1_SHIFT) | cpu;
  }
--static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
++static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
-+static void pl330_create(uint32_t base, qemu_or_irq *orgate, qemu_irq irq,
++                                 bool isread)
-+                         int nreq, int nevents, int width)
++{
- {
++    /* TODO: FEAT_FGT for SMPRI_EL1 but not SMPRIMAP_EL2 */
-     SysBusDevice *busdev;
++    if (arm_current_el(env) < 3
-     DeviceState *dev;
++        && arm_feature(env, ARM_FEATURE_EL3)
-+    int i;
++        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
++        return CP_ACCESS_TRAP_EL3;
      dev = qdev_create(NULL, "pl330");
 +    qdev_prop_set_uint8(dev, "num_events", nevents);
 +    qdev_prop_set_uint8(dev, "num_chnls",  8);
      qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
 +
 +    qdev_prop_set_uint8(dev, "wr_cap", 4);
 +    qdev_prop_set_uint8(dev, "wr_q_dep", 8);
 +    qdev_prop_set_uint8(dev, "rd_cap", 4);
 +    qdev_prop_set_uint8(dev, "rd_q_dep", 8);
 +    qdev_prop_set_uint8(dev, "data_width", width);
 +    qdev_prop_set_uint16(dev, "data_buffer_dep", width);
      qdev_init_nofail(dev);
      busdev = SYS_BUS_DEVICE(dev);
      sysbus_mmio_map(busdev, 0, base);
 -    sysbus_connect_irq(busdev, 0, irq);
 +
 +    object_property_set_int(OBJECT(orgate), nevents + 1, "num-lines",
 +                            &error_abort);
 +    object_property_set_bool(OBJECT(orgate), true, "realized", &error_abort);
 +
 +    for (i = 0; i < nevents + 1; i++) {
 +        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(DEVICE(orgate), i));
 +    }
-+    qdev_connect_gpio_out(DEVICE(orgate), 0, irq);
++    return CP_ACCESS_OK;
  }
  static void exynos4210_realize(DeviceState *socdev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
              s->irq_table[exynos4210_get_irq(28, 3)]);
      /*** DMA controllers ***/
 -    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
 -                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
 -    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
 -                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
 -    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
 -                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 +    pl330_create(EXYNOS4210_PL330_BASE0_ADDR, &s->pl330_irq_orgate[0],
 +                 s->irq_table[exynos4210_get_irq(21, 0)], 32, 32, 32);
 +    pl330_create(EXYNOS4210_PL330_BASE1_ADDR, &s->pl330_irq_orgate[1],
 +                 s->irq_table[exynos4210_get_irq(21, 1)], 32, 32, 32);
 +    pl330_create(EXYNOS4210_PL330_BASE2_ADDR, &s->pl330_irq_orgate[2],
 +                 s->irq_table[exynos4210_get_irq(20, 1)], 1, 31, 64);
 +}
 +
-+static void exynos4210_init(Object *obj)
+ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+{
+                        uint64_t value)
-+    Exynos4210State *s = EXYNOS4210_SOC(obj);
+ {
-+    int i;
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
-+
+       .access = PL3_RW, .type = ARM_CP_SME,
-+    for (i = 0; i < ARRAY_SIZE(s->pl330_irq_orgate); i++) {
+       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
-+        char *name = g_strdup_printf("pl330-irq-orgate%d", i);
+       .writefn = smcr_write, .raw_writefn = raw_write },
-+        qemu_or_irq *orgate = &s->pl330_irq_orgate[i];
++    { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64,
-+
++      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6,
-+        object_initialize_child(obj, name, orgate, sizeof(*orgate),
++      .access = PL1_R, .accessfn = access_aa64_tid1,
-+                                TYPE_OR_IRQ, &error_abort, NULL);
++      /*
-+        g_free(name);
++       * IMPLEMENTOR = 0 (software)
-+    }
++       * REVISION    = 0 (implementation defined)
- }
++       * SMPS        = 0 (no streaming execution priority in QEMU)
++       * AFFINITY    = 0 (streaming sve mode not shared with other PEs)
- static void exynos4210_class_init(ObjectClass *klass, void *data)
++       */
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_info = {
++      .type = ARM_CP_CONST, .resetvalue = 0, },
-     .name = TYPE_EXYNOS4210_SOC,
++    /*
-     .parent = TYPE_SYS_BUS_DEVICE,
++     * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0.
-     .instance_size = sizeof(Exynos4210State),
++     */
-+    .instance_init = exynos4210_init,
++    { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64,
-     .class_init = exynos4210_class_init,
++      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4,
 +      .access = PL1_RW, .accessfn = access_esm,
 +      .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5,
 +      .access = PL2_RW, .accessfn = access_esm,
 +      .type = ARM_CP_CONST, .resetvalue = 0 },
  };
+ #endif /* TARGET_AARCH64 */
 --
-.20.1
+.25.1

-New patch
+[PULL 11/25] target/arm: Add PSTATE.{SM,ZA} to TB flags
+From: Richard Henderson <richard.henderson@linaro.org>
+These are required to determine if various insns
+are allowed to issue.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-9-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h           | 2 ++
+ target/arm/translate.h     | 4 ++++
+ target/arm/helper.c        | 4 ++++
+ target/arm/translate-a64.c | 2 ++
+files changed, 12 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, TCMA, 16, 2)
+ FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
+ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
+ FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
++FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
++FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
+ /*
+  * Helpers for using the above.
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     bool align_mem;
+     /* True if PSTATE.IL is set */
+     bool pstate_il;
++    /* True if PSTATE.SM is set. */
++    bool pstate_sm;
++    /* True if PSTATE.ZA is set. */
++    bool pstate_za;
+     /* True if MVE insns are definitely not predicated by VPR or LTPSIZE */
+     bool mve_no_pred;
+     /*
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+     }
+     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+         DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
++        if (FIELD_EX64(env->svcr, SVCR, SM)) {
++            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
++        }
++        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
+     }
+     sctlr = regime_sctlr(env, stage1);
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->ata = EX_TBFLAG_A64(tb_flags, ATA);
+     dc->mte_active[0] = EX_TBFLAG_A64(tb_flags, MTE_ACTIVE);
+     dc->mte_active[1] = EX_TBFLAG_A64(tb_flags, MTE0_ACTIVE);
++    dc->pstate_sm = EX_TBFLAG_A64(tb_flags, PSTATE_SM);
++    dc->pstate_za = EX_TBFLAG_A64(tb_flags, PSTATE_ZA);
+     dc->vec_len = 0;
+     dc->vec_stride = 0;
+     dc->cp_regs = arm_cpu->cp_regs;
+--
+.25.1

-[PULL 10/20] qemu-block-drivers: Convert to rST
+[PULL 12/25] target/arm: Add the SME ZA storage to CPUARMState
-The qemu-block-drivers documentation is currently in
+From: Richard Henderson <richard.henderson@linaro.org>
 docs/qemu-block-drivers.texi in Texinfo format, which we present
 to the user as:
  * a qemu-block-drivers manpage
  * a section of the main qemu-doc HTML documentation
-Convert the documentation to rST format, and present it to
+Place this late in the resettable section of the structure,
-the user as:
+to keep the most common element offsets from being > 64k.
  * a qemu-block-drivers manpage
  * part of the system/ Sphinx manual
-This follows the same pattern we've done for qemu-ga and qemu-nbd.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220620175235.60881-10-richard.henderson@linaro.org
 [PMM: expanded comment on zarray[] format]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h     | 22 ++++++++++++++++++++++
  target/arm/machine.c | 34 ++++++++++++++++++++++++++++++++++
 files changed, 56 insertions(+)
-We have to drop a cross-reference from the documentation of the
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 -cdrom option back to the qemu-block-drivers documentation, since
 they're no longer within the same texinfo document.
 As noted in a comment, the manpage output is slightly compromised
 due to limitations in Sphinx. In an ideal world, the HTML output
 would have the various headings like 'Disk image file formats'
 as top-level section headings (which then appear in the overall
 system manual's table-of-contents), and it would not have the
 section headings which make sense only for the manpage like
 'synopsis', 'description', and 'see also'. Unfortunately, the
 mechanism Sphinx provides for restricting pieces of documentation
 is limited to the point of being flawed: the 'only::' directive
 is implemented as a filter that is applied at a very late stage
 in the document processing pipeline, rather than as an early
 equivalent of an #ifdef. This means that Sphinx's process of
 identifying which section heading markup styles are which levels
 of heading gets confused if the 'only::' directive contains
 section headings which would affect the heading-level of a
 later heading. I have opted to prioritise making the HTML format
 look better, with the compromise being that in the manpage
 the 'Disk image file formats' &c headings are top-level headings
 rather than being sub-headings under the traditional 'Description'
 top-level section title.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: 20200116141511.16849-4-peter.maydell@linaro.org
 ---
  Makefile                           |  11 +-
  docs/qemu-block-drivers.texi       | 889 --------------------------
  docs/system/conf.py                |   7 +
  docs/system/index.rst              |   1 +
  docs/system/qemu-block-drivers.rst | 985 +++++++++++++++++++++++++++++
  qemu-doc.texi                      |  12 -
  qemu-options.hx                    |   2 +-
 files changed, 1000 insertions(+), 907 deletions(-)
  delete mode 100644 docs/qemu-block-drivers.texi
  create mode 100644 docs/system/qemu-block-drivers.rst
 diff --git a/Makefile b/Makefile
 index XXXXXXX..XXXXXXX 100644
---- a/Makefile
+--- a/target/arm/cpu.h
-+++ b/Makefile
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ ifdef BUILD_DOCS
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1
+     } keys;
- DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-nbd.8
- DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-ga.8
+     uint64_t scxtnum_el[4];
 +DOCS+=$(MANUAL_BUILDDIR)/system/qemu-block-drivers.7
  DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
  DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
 -DOCS+=docs/qemu-block-drivers.7
  DOCS+=docs/qemu-cpu-models.7
  DOCS+=$(MANUAL_BUILDDIR)/index.html
  ifdef CONFIG_VIRTFS
@@ -XXX,XX +XXX,XX @@ distclean: clean
      rm -f docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
      rm -f docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
      rm -f docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
 -    rm -f docs/qemu-block-drivers.7
      rm -f docs/qemu-cpu-models.7
      rm -rf .doctrees
      $(call clean-manual,devel)
@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_POSIX
      $(INSTALL_DATA) qemu.1 "$(DESTDIR)$(mandir)/man1"
      $(INSTALL_DIR) "$(DESTDIR)$(mandir)/man7"
      $(INSTALL_DATA) docs/interop/qemu-qmp-ref.7 "$(DESTDIR)$(mandir)/man7"
 -    $(INSTALL_DATA) docs/qemu-block-drivers.7 "$(DESTDIR)$(mandir)/man7"
 +    $(INSTALL_DATA) $(MANUAL_BUILDDIR)/system/qemu-block-drivers.7 "$(DESTDIR)$(mandir)/man7"
      $(INSTALL_DATA) docs/qemu-cpu-models.7 "$(DESTDIR)$(mandir)/man7"
  ifeq ($(CONFIG_TOOLS),y)
      $(INSTALL_DATA) qemu-img.1 "$(DESTDIR)$(mandir)/man1"
@@ -XXX,XX +XXX,XX @@ $(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
  $(MANUAL_BUILDDIR)/interop/qemu-nbd.8: $(call manual-deps,interop)
      $(call build-manual,interop,man)
 +$(MANUAL_BUILDDIR)/system/qemu-block-drivers.7: $(call manual-deps,system)
 +    $(call build-manual,system,man)
 +
- $(MANUAL_BUILDDIR)/index.html: $(SRC_PATH)/docs/index.html.in qemu-version.h
++    /*
-     @mkdir -p "$(MANUAL_BUILDDIR)"
++     * SME ZA storage -- 256 x 256 byte array, with bytes in host word order,
-     $(call quiet-command, sed "s|@@VERSION@@|${VERSION}|g" $< >$@, \
++     * as we do with vfp.zregs[].  This corresponds to the architectural ZA
-@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
++     * array, where ZA[N] is in the least-significant bytes of env->zarray[N].
- qemu.1: qemu-option-trace.texi
++     * When SVL is less than the architectural maximum, the accessible
- qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
++     * storage is restricted, such that if the SVL is X bytes the guest can
- fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
++     * see only the bottom X elements of zarray[], and only the least
--docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
++     * significant X bytes of each element of the array. (In other words,
- docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
++     * the observable part is always square.)
- scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
++     *
++     * The ZA storage can also be considered as a set of square tiles of
-@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
++     * elements of different sizes. The mapping from tiles to the ZA array
-     qemu-img.texi qemu-options.texi \
++     * is architecturally defined, such that for tiles of elements of esz
-     qemu-tech.texi qemu-option-trace.texi \
++     * bytes, the Nth row (or "horizontal slice") of tile T is in
-     qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
++     * ZA[T + N * esz]. Note that this means that each tile is not contiguous
--    qemu-monitor-info.texi docs/qemu-block-drivers.texi \
++     * in the ZA storage, because its rows are striped through the ZA array.
-+    qemu-monitor-info.texi \
++     *
-     docs/qemu-cpu-models.texi docs/security.texi
++     * Because this is so large, keep this toward the end of the reset area,
++     * to keep the offsets into the rest of the structure smaller.
- docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
++     */
-diff --git a/docs/qemu-block-drivers.texi b/docs/qemu-block-drivers.texi
++    ARMVectorReg zarray[ARM_MAX_VQ * 16];
-deleted file mode 100644
+ #endif
-index XXXXXXX..XXXXXXX
---- a/docs/qemu-block-drivers.texi
+ #if defined(CONFIG_USER_ONLY)
-+++ /dev/null
+diff --git a/target/arm/machine.c b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@
 -@c man begin SYNOPSIS
 -QEMU block driver reference manual
 -@c man end
 -
 -@set qemu_system qemu-system-x86_64
 -
 -@c man begin DESCRIPTION
 -
 -@node disk_images_formats
 -@subsection Disk image file formats
 -
 -QEMU supports many image file formats that can be used with VMs as well as with
 -any of the tools (like @code{qemu-img}). This includes the preferred formats
 -raw and qcow2 as well as formats that are supported for compatibility with
 -older QEMU versions or other hypervisors.
 -
 -Depending on the image format, different options can be passed to
 -@code{qemu-img create} and @code{qemu-img convert} using the @code{-o} option.
 -This section describes each format and the options that are supported for it.
 -
 -@table @option
 -@item raw
 -
 -Raw disk image format. This format has the advantage of
 -being simple and easily exportable to all other emulators. If your
 -file system supports @emph{holes} (for example in ext2 or ext3 on
 -Linux or NTFS on Windows), then only the written sectors will reserve
 -space. Use @code{qemu-img info} to know the real size used by the
 -image or @code{ls -ls} on Unix/Linux.
 -
 -Supported options:
 -@table @code
 -@item preallocation
 -Preallocation mode (allowed values: @code{off}, @code{falloc}, @code{full}).
 -@code{falloc} mode preallocates space for image by calling posix_fallocate().
 -@code{full} mode preallocates space for image by writing data to underlying
 -storage.  This data may or may not be zero, depending on the storage location.
 -@end table
 -
 -@item qcow2
 -QEMU image format, the most versatile format. Use it to have smaller
 -images (useful if your filesystem does not supports holes, for example
 -on Windows), zlib based compression and support of multiple VM
 -snapshots.
 -
 -Supported options:
 -@table @code
 -@item compat
 -Determines the qcow2 version to use. @code{compat=0.10} uses the
 -traditional image format that can be read by any QEMU since 0.10.
 -@code{compat=1.1} enables image format extensions that only QEMU 1.1 and
 -newer understand (this is the default). Amongst others, this includes
 -zero clusters, which allow efficient copy-on-read for sparse images.
 -
 -@item backing_file
 -File name of a base image (see @option{create} subcommand)
 -@item backing_fmt
 -Image format of the base image
 -@item encryption
 -This option is deprecated and equivalent to @code{encrypt.format=aes}
 -
 -@item encrypt.format
 -
 -If this is set to @code{luks}, it requests that the qcow2 payload (not
 -qcow2 header) be encrypted using the LUKS format. The passphrase to
 -use to unlock the LUKS key slot is given by the @code{encrypt.key-secret}
 -parameter. LUKS encryption parameters can be tuned with the other
 -@code{encrypt.*} parameters.
 -
 -If this is set to @code{aes}, the image is encrypted with 128-bit AES-CBC.
 -The encryption key is given by the @code{encrypt.key-secret} parameter.
 -This encryption format is considered to be flawed by modern cryptography
 -standards, suffering from a number of design problems:
 -
 -@itemize @minus
 -@item The AES-CBC cipher is used with predictable initialization vectors based
 -on the sector number. This makes it vulnerable to chosen plaintext attacks
 -which can reveal the existence of encrypted data.
 -@item The user passphrase is directly used as the encryption key. A poorly
 -chosen or short passphrase will compromise the security of the encryption.
 -@item In the event of the passphrase being compromised there is no way to
 -change the passphrase to protect data in any qcow images. The files must
 -be cloned, using a different encryption passphrase in the new file. The
 -original file must then be securely erased using a program like shred,
 -though even this is ineffective with many modern storage technologies.
 -@end itemize
 -
 -The use of this is no longer supported in system emulators. Support only
 -remains in the command line utilities, for the purposes of data liberation
 -and interoperability with old versions of QEMU. The @code{luks} format
 -should be used instead.
 -
 -@item encrypt.key-secret
 -
 -Provides the ID of a @code{secret} object that contains the passphrase
 -(@code{encrypt.format=luks}) or encryption key (@code{encrypt.format=aes}).
 -
 -@item encrypt.cipher-alg
 -
 -Name of the cipher algorithm and key length. Currently defaults
 -to @code{aes-256}. Only used when @code{encrypt.format=luks}.
 -
 -@item encrypt.cipher-mode
 -
 -Name of the encryption mode to use. Currently defaults to @code{xts}.
 -Only used when @code{encrypt.format=luks}.
 -
 -@item encrypt.ivgen-alg
 -
 -Name of the initialization vector generator algorithm. Currently defaults
 -to @code{plain64}. Only used when @code{encrypt.format=luks}.
 -
 -@item encrypt.ivgen-hash-alg
 -
 -Name of the hash algorithm to use with the initialization vector generator
 -(if required). Defaults to @code{sha256}. Only used when @code{encrypt.format=luks}.
 -
 -@item encrypt.hash-alg
 -
 -Name of the hash algorithm to use for PBKDF algorithm
 -Defaults to @code{sha256}. Only used when @code{encrypt.format=luks}.
 -
 -@item encrypt.iter-time
 -
 -Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
 -Defaults to @code{2000}. Only used when @code{encrypt.format=luks}.
 -
 -@item cluster_size
 -Changes the qcow2 cluster size (must be between 512 and 2M). Smaller cluster
 -sizes can improve the image file size whereas larger cluster sizes generally
 -provide better performance.
 -
 -@item preallocation
 -Preallocation mode (allowed values: @code{off}, @code{metadata}, @code{falloc},
 -@code{full}). An image with preallocated metadata is initially larger but can
 -improve performance when the image needs to grow. @code{falloc} and @code{full}
 -preallocations are like the same options of @code{raw} format, but sets up
 -metadata also.
 -
 -@item lazy_refcounts
 -If this option is set to @code{on}, reference count updates are postponed with
 -the goal of avoiding metadata I/O and improving performance. This is
 -particularly interesting with @option{cache=writethrough} which doesn't batch
 -metadata updates. The tradeoff is that after a host crash, the reference count
 -tables must be rebuilt, i.e. on the next open an (automatic) @code{qemu-img
 -check -r all} is required, which may take some time.
 -
 -This option can only be enabled if @code{compat=1.1} is specified.
 -
 -@item nocow
 -If this option is set to @code{on}, it will turn off COW of the file. It's only
 -valid on btrfs, no effect on other file systems.
 -
 -Btrfs has low performance when hosting a VM image file, even more when the guest
 -on the VM also using btrfs as file system. Turning off COW is a way to mitigate
 -this bad performance. Generally there are two ways to turn off COW on btrfs:
 -a) Disable it by mounting with nodatacow, then all newly created files will be
 -NOCOW. b) For an empty file, add the NOCOW file attribute. That's what this option
 -does.
 -
 -Note: this option is only valid to new or empty files. If there is an existing
 -file which is COW and has data blocks already, it couldn't be changed to NOCOW
 -by setting @code{nocow=on}. One can issue @code{lsattr filename} to check if
 -the NOCOW flag is set or not (Capital 'C' is NOCOW flag).
 -
 -@end table
 -
 -@item qed
 -Old QEMU image format with support for backing files and compact image files
 -(when your filesystem or transport medium does not support holes).
 -
 -When converting QED images to qcow2, you might want to consider using the
 -@code{lazy_refcounts=on} option to get a more QED-like behaviour.
 -
 -Supported options:
 -@table @code
 -@item backing_file
 -File name of a base image (see @option{create} subcommand).
 -@item backing_fmt
 -Image file format of backing file (optional).  Useful if the format cannot be
 -autodetected because it has no header, like some vhd/vpc files.
 -@item cluster_size
 -Changes the cluster size (must be power-of-2 between 4K and 64K). Smaller
 -cluster sizes can improve the image file size whereas larger cluster sizes
 -generally provide better performance.
 -@item table_size
 -Changes the number of clusters per L1/L2 table (must be power-of-2 between 1
 -and 16).  There is normally no need to change this value but this option can be
 -used for performance benchmarking.
 -@end table
 -
 -@item qcow
 -Old QEMU image format with support for backing files, compact image files,
 -encryption and compression.
 -
 -Supported options:
 -@table @code
 -@item backing_file
 -File name of a base image (see @option{create} subcommand)
 -@item encryption
 -This option is deprecated and equivalent to @code{encrypt.format=aes}
 -
 -@item encrypt.format
 -If this is set to @code{aes}, the image is encrypted with 128-bit AES-CBC.
 -The encryption key is given by the @code{encrypt.key-secret} parameter.
 -This encryption format is considered to be flawed by modern cryptography
 -standards, suffering from a number of design problems enumerated previously
 -against the @code{qcow2} image format.
 -
 -The use of this is no longer supported in system emulators. Support only
 -remains in the command line utilities, for the purposes of data liberation
 -and interoperability with old versions of QEMU.
 -
 -Users requiring native encryption should use the @code{qcow2} format
 -instead with @code{encrypt.format=luks}.
 -
 -@item encrypt.key-secret
 -
 -Provides the ID of a @code{secret} object that contains the encryption
 -key (@code{encrypt.format=aes}).
 -
 -@end table
 -
 -@item luks
 -
 -LUKS v1 encryption format, compatible with Linux dm-crypt/cryptsetup
 -
 -Supported options:
 -@table @code
 -
 -@item key-secret
 -
 -Provides the ID of a @code{secret} object that contains the passphrase.
 -
 -@item cipher-alg
 -
 -Name of the cipher algorithm and key length. Currently defaults
 -to @code{aes-256}.
 -
 -@item cipher-mode
 -
 -Name of the encryption mode to use. Currently defaults to @code{xts}.
 -
 -@item ivgen-alg
 -
 -Name of the initialization vector generator algorithm. Currently defaults
 -to @code{plain64}.
 -
 -@item ivgen-hash-alg
 -
 -Name of the hash algorithm to use with the initialization vector generator
 -(if required). Defaults to @code{sha256}.
 -
 -@item hash-alg
 -
 -Name of the hash algorithm to use for PBKDF algorithm
 -Defaults to @code{sha256}.
 -
 -@item iter-time
 -
 -Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
 -Defaults to @code{2000}.
 -
 -@end table
 -
 -@item vdi
 -VirtualBox 1.1 compatible image format.
 -Supported options:
 -@table @code
 -@item static
 -If this option is set to @code{on}, the image is created with metadata
 -preallocation.
 -@end table
 -
 -@item vmdk
 -VMware 3 and 4 compatible image format.
 -
 -Supported options:
 -@table @code
 -@item backing_file
 -File name of a base image (see @option{create} subcommand).
 -@item compat6
 -Create a VMDK version 6 image (instead of version 4)
 -@item hwversion
 -Specify vmdk virtual hardware version. Compat6 flag cannot be enabled
 -if hwversion is specified.
 -@item subformat
 -Specifies which VMDK subformat to use. Valid options are
 -@code{monolithicSparse} (default),
 -@code{monolithicFlat},
 -@code{twoGbMaxExtentSparse},
 -@code{twoGbMaxExtentFlat} and
 -@code{streamOptimized}.
 -@end table
 -
 -@item vpc
 -VirtualPC compatible image format (VHD).
 -Supported options:
 -@table @code
 -@item subformat
 -Specifies which VHD subformat to use. Valid options are
 -@code{dynamic} (default) and @code{fixed}.
 -@end table
 -
 -@item VHDX
 -Hyper-V compatible image format (VHDX).
 -Supported options:
 -@table @code
 -@item subformat
 -Specifies which VHDX subformat to use. Valid options are
 -@code{dynamic} (default) and @code{fixed}.
 -@item block_state_zero
 -Force use of payload blocks of type 'ZERO'.  Can be set to @code{on} (default)
 -or @code{off}.  When set to @code{off}, new blocks will be created as
 -@code{PAYLOAD_BLOCK_NOT_PRESENT}, which means parsers are free to return
 -arbitrary data for those blocks.  Do not set to @code{off} when using
 -@code{qemu-img convert} with @code{subformat=dynamic}.
 -@item block_size
 -Block size; min 1 MB, max 256 MB.  0 means auto-calculate based on image size.
 -@item log_size
 -Log size; min 1 MB.
 -@end table
 -@end table
 -
 -@subsubsection Read-only formats
 -More disk image file formats are supported in a read-only mode.
 -@table @option
 -@item bochs
 -Bochs images of @code{growing} type.
 -@item cloop
 -Linux Compressed Loop image, useful only to reuse directly compressed
 -CD-ROM images present for example in the Knoppix CD-ROMs.
 -@item dmg
 -Apple disk image.
 -@item parallels
 -Parallels disk image format.
 -@end table
 -
 -
 -@node host_drives
 -@subsection Using host drives
 -
 -In addition to disk image files, QEMU can directly access host
 -devices. We describe here the usage for QEMU version >= 0.8.3.
 -
 -@subsubsection Linux
 -
 -On Linux, you can directly use the host device filename instead of a
 -disk image filename provided you have enough privileges to access
 -it. For example, use @file{/dev/cdrom} to access to the CDROM.
 -
 -@table @code
 -@item CD
 -You can specify a CDROM device even if no CDROM is loaded. QEMU has
 -specific code to detect CDROM insertion or removal. CDROM ejection by
 -the guest OS is supported. Currently only data CDs are supported.
 -@item Floppy
 -You can specify a floppy device even if no floppy is loaded. Floppy
 -removal is currently not detected accurately (if you change floppy
 -without doing floppy access while the floppy is not loaded, the guest
 -OS will think that the same floppy is loaded).
 -Use of the host's floppy device is deprecated, and support for it will
 -be removed in a future release.
 -@item Hard disks
 -Hard disks can be used. Normally you must specify the whole disk
 -(@file{/dev/hdb} instead of @file{/dev/hdb1}) so that the guest OS can
 -see it as a partitioned disk. WARNING: unless you know what you do, it
 -is better to only make READ-ONLY accesses to the hard disk otherwise
 -you may corrupt your host data (use the @option{-snapshot} command
 -line option or modify the device permissions accordingly).
 -@end table
 -
 -@subsubsection Windows
 -
 -@table @code
 -@item CD
 -The preferred syntax is the drive letter (e.g. @file{d:}). The
 -alternate syntax @file{\\.\d:} is supported. @file{/dev/cdrom} is
 -supported as an alias to the first CDROM drive.
 -
 -Currently there is no specific code to handle removable media, so it
 -is better to use the @code{change} or @code{eject} monitor commands to
 -change or eject media.
 -@item Hard disks
 -Hard disks can be used with the syntax: @file{\\.\PhysicalDrive@var{N}}
 -where @var{N} is the drive number (0 is the first hard disk).
 -
 -WARNING: unless you know what you do, it is better to only make
 -READ-ONLY accesses to the hard disk otherwise you may corrupt your
 -host data (use the @option{-snapshot} command line so that the
 -modifications are written in a temporary file).
 -@end table
 -
 -
 -@subsubsection Mac OS X
 -
 -@file{/dev/cdrom} is an alias to the first CDROM.
 -
 -Currently there is no specific code to handle removable media, so it
 -is better to use the @code{change} or @code{eject} monitor commands to
 -change or eject media.
 -
 -@node disk_images_fat_images
 -@subsection Virtual FAT disk images
 -
 -QEMU can automatically create a virtual FAT disk image from a
 -directory tree. In order to use it, just type:
 -
 -@example
 -@value{qemu_system} linux.img -hdb fat:/my_directory
 -@end example
 -
 -Then you access access to all the files in the @file{/my_directory}
 -directory without having to copy them in a disk image or to export
 -them via SAMBA or NFS. The default access is @emph{read-only}.
 -
 -Floppies can be emulated with the @code{:floppy:} option:
 -
 -@example
 -@value{qemu_system} linux.img -fda fat:floppy:/my_directory
 -@end example
 -
 -A read/write support is available for testing (beta stage) with the
 -@code{:rw:} option:
 -
 -@example
 -@value{qemu_system} linux.img -fda fat:floppy:rw:/my_directory
 -@end example
 -
 -What you should @emph{never} do:
 -@itemize
 -@item use non-ASCII filenames ;
 -@item use "-snapshot" together with ":rw:" ;
 -@item expect it to work when loadvm'ing ;
 -@item write to the FAT directory on the host system while accessing it with the guest system.
 -@end itemize
 -
 -@node disk_images_nbd
 -@subsection NBD access
 -
 -QEMU can access directly to block device exported using the Network Block Device
 -protocol.
 -
 -@example
 -@value{qemu_system} linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
 -@end example
 -
 -If the NBD server is located on the same host, you can use an unix socket instead
 -of an inet socket:
 -
 -@example
 -@value{qemu_system} linux.img -hdb nbd+unix://?socket=/tmp/my_socket
 -@end example
 -
 -In this case, the block device must be exported using qemu-nbd:
 -
 -@example
 -qemu-nbd --socket=/tmp/my_socket my_disk.qcow2
 -@end example
 -
 -The use of qemu-nbd allows sharing of a disk between several guests:
 -@example
 -qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
 -@end example
 -
 -@noindent
 -and then you can use it with two guests:
 -@example
 -@value{qemu_system} linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
 -@value{qemu_system} linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
 -@end example
 -
 -If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
 -own embedded NBD server), you must specify an export name in the URI:
 -@example
 -@value{qemu_system} -cdrom nbd://localhost/debian-500-ppc-netinst
 -@value{qemu_system} -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
 -@end example
 -
 -The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
 -also available.  Here are some example of the older syntax:
 -@example
 -@value{qemu_system} linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
 -@value{qemu_system} linux2.img -hdb nbd:unix:/tmp/my_socket
 -@value{qemu_system} -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
 -@end example
 -
 -@node disk_images_sheepdog
 -@subsection Sheepdog disk images
 -
 -Sheepdog is a distributed storage system for QEMU.  It provides highly
 -available block level storage volumes that can be attached to
 -QEMU-based virtual machines.
 -
 -You can create a Sheepdog disk image with the command:
 -@example
 -qemu-img create sheepdog:///@var{image} @var{size}
 -@end example
 -where @var{image} is the Sheepdog image name and @var{size} is its
 -size.
 -
 -To import the existing @var{filename} to Sheepdog, you can use a
 -convert command.
 -@example
 -qemu-img convert @var{filename} sheepdog:///@var{image}
 -@end example
 -
 -You can boot from the Sheepdog disk image with the command:
 -@example
 -@value{qemu_system} sheepdog:///@var{image}
 -@end example
 -
 -You can also create a snapshot of the Sheepdog image like qcow2.
 -@example
 -qemu-img snapshot -c @var{tag} sheepdog:///@var{image}
 -@end example
 -where @var{tag} is a tag name of the newly created snapshot.
 -
 -To boot from the Sheepdog snapshot, specify the tag name of the
 -snapshot.
 -@example
 -@value{qemu_system} sheepdog:///@var{image}#@var{tag}
 -@end example
 -
 -You can create a cloned image from the existing snapshot.
 -@example
 -qemu-img create -b sheepdog:///@var{base}#@var{tag} sheepdog:///@var{image}
 -@end example
 -where @var{base} is an image name of the source snapshot and @var{tag}
 -is its tag name.
 -
 -You can use an unix socket instead of an inet socket:
 -
 -@example
 -@value{qemu_system} sheepdog+unix:///@var{image}?socket=@var{path}
 -@end example
 -
 -If the Sheepdog daemon doesn't run on the local host, you need to
 -specify one of the Sheepdog servers to connect to.
 -@example
 -qemu-img create sheepdog://@var{hostname}:@var{port}/@var{image} @var{size}
 -@value{qemu_system} sheepdog://@var{hostname}:@var{port}/@var{image}
 -@end example
 -
 -@node disk_images_iscsi
 -@subsection iSCSI LUNs
 -
 -iSCSI is a popular protocol used to access SCSI devices across a computer
 -network.
 -
 -There are two different ways iSCSI devices can be used by QEMU.
 -
 -The first method is to mount the iSCSI LUN on the host, and make it appear as
 -any other ordinary SCSI device on the host and then to access this device as a
 -/dev/sd device from QEMU. How to do this differs between host OSes.
 -
 -The second method involves using the iSCSI initiator that is built into
 -QEMU. This provides a mechanism that works the same way regardless of which
 -host OS you are running QEMU on. This section will describe this second method
 -of using iSCSI together with QEMU.
 -
 -In QEMU, iSCSI devices are described using special iSCSI URLs
 -
 -@example
 -URL syntax:
 -iscsi://[<username>[%<password>]@@]<host>[:<port>]/<target-iqn-name>/<lun>
 -@end example
 -
 -Username and password are optional and only used if your target is set up
 -using CHAP authentication for access control.
 -Alternatively the username and password can also be set via environment
 -variables to have these not show up in the process list
 -
 -@example
 -export LIBISCSI_CHAP_USERNAME=<username>
 -export LIBISCSI_CHAP_PASSWORD=<password>
 -iscsi://<host>/<target-iqn-name>/<lun>
 -@end example
 -
 -Various session related parameters can be set via special options, either
 -in a configuration file provided via '-readconfig' or directly on the
 -command line.
 -
 -If the initiator-name is not specified qemu will use a default name
 -of 'iqn.2008-11.org.linux-kvm[:<uuid>'] where <uuid> is the UUID of the
 -virtual machine. If the UUID is not specified qemu will use
 -'iqn.2008-11.org.linux-kvm[:<name>'] where <name> is the name of the
 -virtual machine.
 -
 -@example
 -Setting a specific initiator name to use when logging in to the target
 --iscsi initiator-name=iqn.qemu.test:my-initiator
 -@end example
 -
 -@example
 -Controlling which type of header digest to negotiate with the target
 --iscsi header-digest=CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
 -@end example
 -
 -These can also be set via a configuration file
 -@example
 -[iscsi]
 -  user = "CHAP username"
 -  password = "CHAP password"
 -  initiator-name = "iqn.qemu.test:my-initiator"
 -  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
 -  header-digest = "CRC32C"
 -@end example
 -
 -
 -Setting the target name allows different options for different targets
 -@example
 -[iscsi "iqn.target.name"]
 -  user = "CHAP username"
 -  password = "CHAP password"
 -  initiator-name = "iqn.qemu.test:my-initiator"
 -  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
 -  header-digest = "CRC32C"
 -@end example
 -
 -
 -Howto use a configuration file to set iSCSI configuration options:
 -@example
 -cat >iscsi.conf <<EOF
 -[iscsi]
 -  user = "me"
 -  password = "my password"
 -  initiator-name = "iqn.qemu.test:my-initiator"
 -  header-digest = "CRC32C"
 -EOF
 -
 -@value{qemu_system} -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
 -    -readconfig iscsi.conf
 -@end example
 -
 -
 -How to set up a simple iSCSI target on loopback and access it via QEMU:
 -@example
 -This example shows how to set up an iSCSI target with one CDROM and one DISK
 -using the Linux STGT software target. This target is available on Red Hat based
 -systems as the package 'scsi-target-utils'.
 -
 -tgtd --iscsi portal=127.0.0.1:3260
 -tgtadm --lld iscsi --op new --mode target --tid 1 -T iqn.qemu.test
 -tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 1 \
 -    -b /IMAGES/disk.img --device-type=disk
 -tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \
 -    -b /IMAGES/cd.iso --device-type=cd
 -tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL
 -
 -@value{qemu_system} -iscsi initiator-name=iqn.qemu.test:my-initiator \
 -    -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
 -    -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
 -@end example
 -
 -@node disk_images_gluster
 -@subsection GlusterFS disk images
 -
 -GlusterFS is a user space distributed file system.
 -
 -You can boot from the GlusterFS disk image with the command:
 -@example
 -URI:
 -@value{qemu_system} -drive file=gluster[+@var{type}]://[@var{host}[:@var{port}]]/@var{volume}/@var{path}
 -                               [?socket=...][,file.debug=9][,file.logfile=...]
 -
 -JSON:
 -@value{qemu_system} 'json:@{"driver":"qcow2",
 -                           "file":@{"driver":"gluster",
 -                                    "volume":"testvol","path":"a.img","debug":9,"logfile":"...",
 -                                    "server":[@{"type":"tcp","host":"...","port":"..."@},
 -                                              @{"type":"unix","socket":"..."@}]@}@}'
 -@end example
 -
 -@var{gluster} is the protocol.
 -
 -@var{type} specifies the transport type used to connect to gluster
 -management daemon (glusterd). Valid transport types are
 -tcp and unix. In the URI form, if a transport type isn't specified,
 -then tcp type is assumed.
 -
 -@var{host} specifies the server where the volume file specification for
 -the given volume resides. This can be either a hostname or an ipv4 address.
 -If transport type is unix, then @var{host} field should not be specified.
 -Instead @var{socket} field needs to be populated with the path to unix domain
 -socket.
 -
 -@var{port} is the port number on which glusterd is listening. This is optional
 -and if not specified, it defaults to port 24007. If the transport type is unix,
 -then @var{port} should not be specified.
 -
 -@var{volume} is the name of the gluster volume which contains the disk image.
 -
 -@var{path} is the path to the actual disk image that resides on gluster volume.
 -
 -@var{debug} is the logging level of the gluster protocol driver. Debug levels
 -are 0-9, with 9 being the most verbose, and 0 representing no debugging output.
 -The default level is 4. The current logging levels defined in the gluster source
 -are 0 - None, 1 - Emergency, 2 - Alert, 3 - Critical, 4 - Error, 5 - Warning,
 -6 - Notice, 7 - Info, 8 - Debug, 9 - Trace
 -
 -@var{logfile} is a commandline option to mention log file path which helps in
 -logging to the specified file and also help in persisting the gfapi logs. The
 -default is stderr.
 -
 -
 -
 -
 -You can create a GlusterFS disk image with the command:
 -@example
 -qemu-img create gluster://@var{host}/@var{volume}/@var{path} @var{size}
 -@end example
 -
 -Examples
 -@example
 -@value{qemu_system} -drive file=gluster://1.2.3.4/testvol/a.img
 -@value{qemu_system} -drive file=gluster+tcp://1.2.3.4/testvol/a.img
 -@value{qemu_system} -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
 -@value{qemu_system} -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
 -@value{qemu_system} -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
 -@value{qemu_system} -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
 -@value{qemu_system} -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
 -@value{qemu_system} -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
 -@value{qemu_system} -drive file=gluster://1.2.3.4/testvol/a.img,file.debug=9,file.logfile=/var/log/qemu-gluster.log
 -@value{qemu_system} 'json:@{"driver":"qcow2",
 -                           "file":@{"driver":"gluster",
 -                                    "volume":"testvol","path":"a.img",
 -                                    "debug":9,"logfile":"/var/log/qemu-gluster.log",
 -                                    "server":[@{"type":"tcp","host":"1.2.3.4","port":24007@},
 -                                              @{"type":"unix","socket":"/var/run/glusterd.socket"@}]@}@}'
 -@value{qemu_system} -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
 -                                       file.debug=9,file.logfile=/var/log/qemu-gluster.log,
 -                                       file.server.0.type=tcp,file.server.0.host=1.2.3.4,file.server.0.port=24007,
 -                                       file.server.1.type=unix,file.server.1.socket=/var/run/glusterd.socket
 -@end example
 -
 -@node disk_images_ssh
 -@subsection Secure Shell (ssh) disk images
 -
 -You can access disk images located on a remote ssh server
 -by using the ssh protocol:
 -
 -@example
 -@value{qemu_system} -drive file=ssh://[@var{user}@@]@var{server}[:@var{port}]/@var{path}[?host_key_check=@var{host_key_check}]
 -@end example
 -
 -Alternative syntax using properties:
 -
 -@example
 -@value{qemu_system} -drive file.driver=ssh[,file.user=@var{user}],file.host=@var{server}[,file.port=@var{port}],file.path=@var{path}[,file.host_key_check=@var{host_key_check}]
 -@end example
 -
 -@var{ssh} is the protocol.
 -
 -@var{user} is the remote user.  If not specified, then the local
 -username is tried.
 -
 -@var{server} specifies the remote ssh server.  Any ssh server can be
 -used, but it must implement the sftp-server protocol.  Most Unix/Linux
 -systems should work without requiring any extra configuration.
 -
 -@var{port} is the port number on which sshd is listening.  By default
 -the standard ssh port (22) is used.
 -
 -@var{path} is the path to the disk image.
 -
 -The optional @var{host_key_check} parameter controls how the remote
 -host's key is checked.  The default is @code{yes} which means to use
 -the local @file{.ssh/known_hosts} file.  Setting this to @code{no}
 -turns off known-hosts checking.  Or you can check that the host key
 -matches a specific fingerprint:
 -@code{host_key_check=md5:78:45:8e:14:57:4f:d5:45:83:0a:0e:f3:49:82:c9:c8}
 -(@code{sha1:} can also be used as a prefix, but note that OpenSSH
 -tools only use MD5 to print fingerprints).
 -
 -Currently authentication must be done using ssh-agent.  Other
 -authentication methods may be supported in future.
 -
 -Note: Many ssh servers do not support an @code{fsync}-style operation.
 -The ssh driver cannot guarantee that disk flush requests are
 -obeyed, and this causes a risk of disk corruption if the remote
 -server or network goes down during writes.  The driver will
 -print a warning when @code{fsync} is not supported:
 -
 -warning: ssh server @code{ssh.example.com:22} does not support fsync
 -
 -With sufficiently new versions of libssh and OpenSSH, @code{fsync} is
 -supported.
 -
 -@node disk_images_nvme
 -@subsection NVMe disk images
 -
 -NVM Express (NVMe) storage controllers can be accessed directly by a userspace
 -driver in QEMU.  This bypasses the host kernel file system and block layers
 -while retaining QEMU block layer functionalities, such as block jobs, I/O
 -throttling, image formats, etc.  Disk I/O performance is typically higher than
 -with @code{-drive file=/dev/sda} using either thread pool or linux-aio.
 -
 -The controller will be exclusively used by the QEMU process once started. To be
 -able to share storage between multiple VMs and other applications on the host,
 -please use the file based protocols.
 -
 -Before starting QEMU, bind the host NVMe controller to the host vfio-pci
 -driver.  For example:
 -
 -@example
 -# modprobe vfio-pci
 -# lspci -n -s 0000:06:0d.0
 -06:0d.0 0401: 1102:0002 (rev 08)
 -# echo 0000:06:0d.0 > /sys/bus/pci/devices/0000:06:0d.0/driver/unbind
 -# echo 1102 0002 > /sys/bus/pci/drivers/vfio-pci/new_id
 -
 -# @value{qemu_system} -drive file=nvme://@var{host}:@var{bus}:@var{slot}.@var{func}/@var{namespace}
 -@end example
 -
 -Alternative syntax using properties:
 -
 -@example
 -@value{qemu_system} -drive file.driver=nvme,file.device=@var{host}:@var{bus}:@var{slot}.@var{func},file.namespace=@var{namespace}
 -@end example
 -
 -@var{host}:@var{bus}:@var{slot}.@var{func} is the NVMe controller's PCI device
 -address on the host.
 -
 -@var{namespace} is the NVMe namespace number, starting from 1.
 -
 -@node disk_image_locking
 -@subsection Disk image file locking
 -
 -By default, QEMU tries to protect image files from unexpected concurrent
 -access, as long as it's supported by the block protocol driver and host
 -operating system. If multiple QEMU processes (including QEMU emulators and
 -utilities) try to open the same image with conflicting accessing modes, all but
 -the first one will get an error.
 -
 -This feature is currently supported by the file protocol on Linux with the Open
 -File Descriptor (OFD) locking API, and can be configured to fall back to POSIX
 -locking if the POSIX host doesn't support Linux OFD locking.
 -
 -To explicitly enable image locking, specify "locking=on" in the file protocol
 -driver options. If OFD locking is not possible, a warning will be printed and
 -the POSIX locking API will be used. In this case there is a risk that the lock
 -will get silently lost when doing hot plugging and block jobs, due to the
 -shortcomings of the POSIX locking API.
 -
 -QEMU transparently handles lock handover during shared storage migration.  For
 -shared virtual disk images between multiple VMs, the "share-rw" device option
 -should be used.
 -
 -By default, the guest has exclusive write access to its disk image. If the
 -guest can safely share the disk image with other writers the @code{-device
 -...,share-rw=on} parameter can be used.  This is only safe if the guest is
 -running software, such as a cluster file system, that coordinates disk accesses
 -to avoid corruption.
 -
 -Note that share-rw=on only declares the guest's ability to share the disk.
 -Some QEMU features, such as image file formats, require exclusive write access
 -to the disk image and this is unaffected by the share-rw=on option.
 -
 -Alternatively, locking can be fully disabled by "locking=off" block device
 -option. In the command line, the option is usually in the form of
 -"file.locking=off" as the protocol driver is normally placed as a "file" child
 -under a format driver. For example:
 -
 -@code{-blockdev driver=qcow2,file.filename=/path/to/image,file.locking=off,file.driver=file}
 -
 -To check if image locking is active, check the output of the "lslocks" command
 -on host and see if there are locks held by the QEMU process on the image file.
 -More than one byte could be locked by the QEMU instance, each byte of which
 -reflects a particular permission that is acquired or protected by the running
 -block driver.
 -
 -@c man end
 -
 -@ignore
 -
 -@setfilename qemu-block-drivers
 -@settitle QEMU block drivers reference
 -
 -@c man begin SEEALSO
 -The HTML documentation of QEMU for more precise information and Linux
 -user mode emulator invocation.
 -@c man end
 -
 -@c man begin AUTHOR
 -Fabrice Bellard and the QEMU Project developers
 -@c man end
 -
 -@end ignore
 diff --git a/docs/system/conf.py b/docs/system/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/conf.py
+--- a/target/arm/machine.c
-+++ b/docs/system/conf.py
++++ b/target/arm/machine.c
-@@ -XXX,XX +XXX,XX @@ exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sve = {
- # This slightly misuses the 'description', but is the best way to get
+         VMSTATE_END_OF_LIST()
- # the manual title to appear in the sidebar.
+     }
- html_theme_options['description'] = u'System Emulation User''s Guide'
+ };
 +# One entry per manual page. List of tuples
 +# (source start file, name, description, authors, manual section).
 +man_pages = [
 +    ('qemu-block-drivers', 'qemu-block-drivers',
 +     u'QEMU block drivers reference',
 +     ['Fabrice Bellard and the QEMU Project developers'], 7)
 +]
 diff --git a/docs/system/index.rst b/docs/system/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/index.rst
 +++ b/docs/system/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
  .. toctree::
     :maxdepth: 2
 +   qemu-block-drivers
 diff --git a/docs/system/qemu-block-drivers.rst b/docs/system/qemu-block-drivers.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/qemu-block-drivers.rst
@@ -XXX,XX +XXX,XX @@
 +QEMU block drivers reference
 +============================
 +
-+.. |qemu_system| replace:: qemu-system-x86_64
++static const VMStateDescription vmstate_vreg = {
 +    .name = "vreg",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT64_ARRAY(d, ARMVectorReg, ARM_MAX_VQ * 2),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+..
++static bool za_needed(void *opaque)
-+   We put the 'Synopsis' and 'See also' sections into the manpage, but not
++{
-+   the HTML. This makes the HTML docs read better and means the ToC in
++    ARMCPU *cpu = opaque;
 +   the index has a more useful set of entries. Ideally, the section
 +   headings 'Disk image file formats' would be top-level headings for
 +   the HTML, but sub-headings of the conventional manpage 'Description'
 +   header for the manpage. Unfortunately, due to deficiencies in
 +   the Sphinx 'only' directive, this isn't possible: they must be headers
 +   at the same level as 'Synopsis' and 'See also', otherwise Sphinx's
 +   identification of which header underline style is which gets confused.
 +
-+.. only:: man
++    /*
 +     * When ZA storage is disabled, its contents are discarded.
 +     * It will be zeroed when ZA storage is re-enabled.
 +     */
 +    return FIELD_EX64(cpu->env.svcr, SVCR, ZA);
 +}
 +
-+  Synopsis
++static const VMStateDescription vmstate_za = {
-+  --------
++    .name = "cpu/sme",
-+
++    .version_id = 1,
-+  QEMU block driver reference manual
++    .minimum_version_id = 1,
-+
++    .needed = za_needed,
-+Disk image file formats
++    .fields = (VMStateField[]) {
-+-----------------------
++        VMSTATE_STRUCT_ARRAY(env.zarray, ARMCPU, ARM_MAX_VQ * 16, 0,
-+
++                             vmstate_vreg, ARMVectorReg),
-+QEMU supports many image file formats that can be used with VMs as well as with
++        VMSTATE_END_OF_LIST()
-+any of the tools (like ``qemu-img``). This includes the preferred formats
++    }
-+raw and qcow2 as well as formats that are supported for compatibility with
++};
-+older QEMU versions or other hypervisors.
+ #endif /* AARCH64 */
-+
-+Depending on the image format, different options can be passed to
+ static bool serror_needed(void *opaque)
-+``qemu-img create`` and ``qemu-img convert`` using the ``-o`` option.
+@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
-+This section describes each format and the options that are supported for it.
+         &vmstate_m_security,
-+
+ #ifdef TARGET_AARCH64
-+.. program:: image-formats
+         &vmstate_sve,
-+.. option:: raw
++        &vmstate_za,
-+
+ #endif
-+  Raw disk image format. This format has the advantage of
+         &vmstate_serror,
-+  being simple and easily exportable to all other emulators. If your
+         &vmstate_irq_line_state,
 +  file system supports *holes* (for example in ext2 or ext3 on
 +  Linux or NTFS on Windows), then only the written sectors will reserve
 +  space. Use ``qemu-img info`` to know the real size used by the
 +  image or ``ls -ls`` on Unix/Linux.
 +
 +  Supported options:
 +
 +  .. program:: raw
 +  .. option:: preallocation
 +
 +    Preallocation mode (allowed values: ``off``, ``falloc``,
 +    ``full``). ``falloc`` mode preallocates space for image by
 +    calling ``posix_fallocate()``. ``full`` mode preallocates space
 +    for image by writing data to underlying storage. This data may or
 +    may not be zero, depending on the storage location.
 +
 +.. program:: image-formats
 +.. option:: qcow2
 +
 +  QEMU image format, the most versatile format. Use it to have smaller
 +  images (useful if your filesystem does not supports holes, for example
 +  on Windows), zlib based compression and support of multiple VM
 +  snapshots.
 +
 +  Supported options:
 +
 +  .. program:: qcow2
 +  .. option:: compat
 +
 +    Determines the qcow2 version to use. ``compat=0.10`` uses the
 +    traditional image format that can be read by any QEMU since 0.10.
 +    ``compat=1.1`` enables image format extensions that only QEMU 1.1 and
 +    newer understand (this is the default). Amongst others, this includes
 +    zero clusters, which allow efficient copy-on-read for sparse images.
 +
 +  .. option:: backing_file
 +
 +    File name of a base image (see ``create`` subcommand)
 +
 +  .. option:: backing_fmt
 +
 +    Image format of the base image
 +
 +  .. option:: encryption
 +
 +    This option is deprecated and equivalent to ``encrypt.format=aes``
 +
 +  .. option:: encrypt.format
 +
 +    If this is set to ``luks``, it requests that the qcow2 payload (not
 +    qcow2 header) be encrypted using the LUKS format. The passphrase to
 +    use to unlock the LUKS key slot is given by the ``encrypt.key-secret``
 +    parameter. LUKS encryption parameters can be tuned with the other
 +    ``encrypt.*`` parameters.
 +
 +    If this is set to ``aes``, the image is encrypted with 128-bit AES-CBC.
 +    The encryption key is given by the ``encrypt.key-secret`` parameter.
 +    This encryption format is considered to be flawed by modern cryptography
 +    standards, suffering from a number of design problems:
 +
 +    - The AES-CBC cipher is used with predictable initialization vectors based
 +      on the sector number. This makes it vulnerable to chosen plaintext attacks
 +      which can reveal the existence of encrypted data.
 +    - The user passphrase is directly used as the encryption key. A poorly
 +      chosen or short passphrase will compromise the security of the encryption.
 +    - In the event of the passphrase being compromised there is no way to
 +      change the passphrase to protect data in any qcow images. The files must
 +      be cloned, using a different encryption passphrase in the new file. The
 +      original file must then be securely erased using a program like shred,
 +      though even this is ineffective with many modern storage technologies.
 +
 +    The use of this is no longer supported in system emulators. Support only
 +    remains in the command line utilities, for the purposes of data liberation
 +    and interoperability with old versions of QEMU. The ``luks`` format
 +    should be used instead.
 +
 +  .. option:: encrypt.key-secret
 +
 +    Provides the ID of a ``secret`` object that contains the passphrase
 +    (``encrypt.format=luks``) or encryption key (``encrypt.format=aes``).
 +
 +  .. option:: encrypt.cipher-alg
 +
 +    Name of the cipher algorithm and key length. Currently defaults
 +    to ``aes-256``. Only used when ``encrypt.format=luks``.
 +
 +  .. option:: encrypt.cipher-mode
 +
 +    Name of the encryption mode to use. Currently defaults to ``xts``.
 +    Only used when ``encrypt.format=luks``.
 +
 +  .. option:: encrypt.ivgen-alg
 +
 +    Name of the initialization vector generator algorithm. Currently defaults
 +    to ``plain64``. Only used when ``encrypt.format=luks``.
 +
 +  .. option:: encrypt.ivgen-hash-alg
 +
 +    Name of the hash algorithm to use with the initialization vector generator
 +    (if required). Defaults to ``sha256``. Only used when ``encrypt.format=luks``.
 +
 +  .. option:: encrypt.hash-alg
 +
 +    Name of the hash algorithm to use for PBKDF algorithm
 +    Defaults to ``sha256``. Only used when ``encrypt.format=luks``.
 +
 +  .. option:: encrypt.iter-time
 +
 +    Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
 +    Defaults to ``2000``. Only used when ``encrypt.format=luks``.
 +
 +  .. option:: cluster_size
 +
 +    Changes the qcow2 cluster size (must be between 512 and 2M). Smaller cluster
 +    sizes can improve the image file size whereas larger cluster sizes generally
 +    provide better performance.
 +
 +  .. option:: preallocation
 +
 +    Preallocation mode (allowed values: ``off``, ``metadata``, ``falloc``,
 +    ``full``). An image with preallocated metadata is initially larger but can
 +    improve performance when the image needs to grow. ``falloc`` and ``full``
 +    preallocations are like the same options of ``raw`` format, but sets up
 +    metadata also.
 +
 +  .. option:: lazy_refcounts
 +
 +    If this option is set to ``on``, reference count updates are postponed with
 +    the goal of avoiding metadata I/O and improving performance. This is
 +    particularly interesting with :option:`cache=writethrough` which doesn't batch
 +    metadata updates. The tradeoff is that after a host crash, the reference count
 +    tables must be rebuilt, i.e. on the next open an (automatic) ``qemu-img
 +    check -r all`` is required, which may take some time.
 +
 +    This option can only be enabled if ``compat=1.1`` is specified.
 +
 +  .. option:: nocow
 +
 +    If this option is set to ``on``, it will turn off COW of the file. It's only
 +    valid on btrfs, no effect on other file systems.
 +
 +    Btrfs has low performance when hosting a VM image file, even more
 +    when the guest on the VM also using btrfs as file system. Turning off
 +    COW is a way to mitigate this bad performance. Generally there are two
 +    ways to turn off COW on btrfs:
 +
 +    - Disable it by mounting with nodatacow, then all newly created files
 +      will be NOCOW.
 +    - For an empty file, add the NOCOW file attribute. That's what this
 +      option does.
 +
 +    Note: this option is only valid to new or empty files. If there is
 +    an existing file which is COW and has data blocks already, it couldn't
 +    be changed to NOCOW by setting ``nocow=on``. One can issue ``lsattr
 +    filename`` to check if the NOCOW flag is set or not (Capital 'C' is
 +    NOCOW flag).
 +
 +.. program:: image-formats
 +.. option:: qed
 +
 +   Old QEMU image format with support for backing files and compact image files
 +   (when your filesystem or transport medium does not support holes).
 +
 +   When converting QED images to qcow2, you might want to consider using the
 +   ``lazy_refcounts=on`` option to get a more QED-like behaviour.
 +
 +   Supported options:
 +
 +   .. program:: qed
 +   .. option:: backing_file
 +
 +      File name of a base image (see ``create`` subcommand).
 +
 +   .. option:: backing_fmt
 +
 +     Image file format of backing file (optional).  Useful if the format cannot be
 +     autodetected because it has no header, like some vhd/vpc files.
 +
 +   .. option:: cluster_size
 +
 +     Changes the cluster size (must be power-of-2 between 4K and 64K). Smaller
 +     cluster sizes can improve the image file size whereas larger cluster sizes
 +     generally provide better performance.
 +
 +   .. option:: table_size
 +
 +     Changes the number of clusters per L1/L2 table (must be
 +     power-of-2 between 1 and 16).  There is normally no need to
 +     change this value but this option can between used for
 +     performance benchmarking.
 +
 +.. program:: image-formats
 +.. option:: qcow
 +
 +  Old QEMU image format with support for backing files, compact image files,
 +  encryption and compression.
 +
 +  Supported options:
 +
 +   .. program:: qcow
 +   .. option:: backing_file
 +
 +     File name of a base image (see ``create`` subcommand)
 +
 +   .. option:: encryption
 +
 +     This option is deprecated and equivalent to ``encrypt.format=aes``
 +
 +   .. option:: encrypt.format
 +
 +     If this is set to ``aes``, the image is encrypted with 128-bit AES-CBC.
 +     The encryption key is given by the ``encrypt.key-secret`` parameter.
 +     This encryption format is considered to be flawed by modern cryptography
 +     standards, suffering from a number of design problems enumerated previously
 +     against the ``qcow2`` image format.
 +
 +     The use of this is no longer supported in system emulators. Support only
 +     remains in the command line utilities, for the purposes of data liberation
 +     and interoperability with old versions of QEMU.
 +
 +     Users requiring native encryption should use the ``qcow2`` format
 +     instead with ``encrypt.format=luks``.
 +
 +   .. option:: encrypt.key-secret
 +
 +     Provides the ID of a ``secret`` object that contains the encryption
 +     key (``encrypt.format=aes``).
 +
 +.. program:: image-formats
 +.. option:: luks
 +
 +  LUKS v1 encryption format, compatible with Linux dm-crypt/cryptsetup
 +
 +  Supported options:
 +
 +  .. program:: luks
 +  .. option:: key-secret
 +
 +    Provides the ID of a ``secret`` object that contains the passphrase.
 +
 +  .. option:: cipher-alg
 +
 +    Name of the cipher algorithm and key length. Currently defaults
 +    to ``aes-256``.
 +
 +  .. option:: cipher-mode
 +
 +    Name of the encryption mode to use. Currently defaults to ``xts``.
 +
 +  .. option:: ivgen-alg
 +
 +    Name of the initialization vector generator algorithm. Currently defaults
 +    to ``plain64``.
 +
 +  .. option:: ivgen-hash-alg
 +
 +    Name of the hash algorithm to use with the initialization vector generator
 +    (if required). Defaults to ``sha256``.
 +
 +  .. option:: hash-alg
 +
 +    Name of the hash algorithm to use for PBKDF algorithm
 +    Defaults to ``sha256``.
 +
 +  .. option:: iter-time
 +
 +    Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
 +    Defaults to ``2000``.
 +
 +.. program:: image-formats
 +.. option:: vdi
 +
 +  VirtualBox 1.1 compatible image format.
 +
 +  Supported options:
 +
 +  .. program:: vdi
 +  .. option:: static
 +
 +    If this option is set to ``on``, the image is created with metadata
 +    preallocation.
 +
 +.. program:: image-formats
 +.. option:: vmdk
 +
 +  VMware 3 and 4 compatible image format.
 +
 +  Supported options:
 +
 +  .. program: vmdk
 +  .. option:: backing_file
 +
 +    File name of a base image (see ``create`` subcommand).
 +
 +  .. option:: compat6
 +
 +    Create a VMDK version 6 image (instead of version 4)
 +
 +  .. option:: hwversion
 +
 +    Specify vmdk virtual hardware version. Compat6 flag cannot be enabled
 +    if hwversion is specified.
 +
 +  .. option:: subformat
 +
 +    Specifies which VMDK subformat to use. Valid options are
 +    ``monolithicSparse`` (default),
 +    ``monolithicFlat``,
 +    ``twoGbMaxExtentSparse``,
 +    ``twoGbMaxExtentFlat`` and
 +    ``streamOptimized``.
 +
 +.. program:: image-formats
 +.. option:: vpc
 +
 +  VirtualPC compatible image format (VHD).
 +
 +  Supported options:
 +
 +  .. program:: vpc
 +  .. option:: subformat
 +
 +    Specifies which VHD subformat to use. Valid options are
 +    ``dynamic`` (default) and ``fixed``.
 +
 +.. program:: image-formats
 +.. option:: VHDX
 +
 +  Hyper-V compatible image format (VHDX).
 +
 +  Supported options:
 +
 +  .. program:: VHDX
 +  .. option:: subformat
 +
 +    Specifies which VHDX subformat to use. Valid options are
 +    ``dynamic`` (default) and ``fixed``.
 +
 +    .. option:: block_state_zero
 +
 +      Force use of payload blocks of type 'ZERO'.  Can be set to ``on`` (default)
 +      or ``off``.  When set to ``off``, new blocks will be created as
 +      ``PAYLOAD_BLOCK_NOT_PRESENT``, which means parsers are free to return
 +      arbitrary data for those blocks.  Do not set to ``off`` when using
 +      ``qemu-img convert`` with ``subformat=dynamic``.
 +
 +    .. option:: block_size
 +
 +      Block size; min 1 MB, max 256 MB.  0 means auto-calculate based on
 +      image size.
 +
 +    .. option:: log_size
 +
 +      Log size; min 1 MB.
 +
 +Read-only formats
 +-----------------
 +
 +More disk image file formats are supported in a read-only mode.
 +
 +.. program:: image-formats
 +.. option:: bochs
 +
 +  Bochs images of ``growing`` type.
 +
 +.. program:: image-formats
 +.. option:: cloop
 +
 +  Linux Compressed Loop image, useful only to reuse directly compressed
 +  CD-ROM images present for example in the Knoppix CD-ROMs.
 +
 +.. program:: image-formats
 +.. option:: dmg
 +
 +  Apple disk image.
 +
 +.. program:: image-formats
 +.. option:: parallels
 +
 +  Parallels disk image format.
 +
 +Using host drives
 +-----------------
 +
 +In addition to disk image files, QEMU can directly access host
 +devices. We describe here the usage for QEMU version >= 0.8.3.
 +
 +Linux
 +'''''
 +
 +On Linux, you can directly use the host device filename instead of a
 +disk image filename provided you have enough privileges to access
 +it. For example, use ``/dev/cdrom`` to access to the CDROM.
 +
 +CD
 +  You can specify a CDROM device even if no CDROM is loaded. QEMU has
 +  specific code to detect CDROM insertion or removal. CDROM ejection by
 +  the guest OS is supported. Currently only data CDs are supported.
 +
 +Floppy
 +  You can specify a floppy device even if no floppy is loaded. Floppy
 +  removal is currently not detected accurately (if you change floppy
 +  without doing floppy access while the floppy is not loaded, the guest
 +  OS will think that the same floppy is loaded).
 +  Use of the host's floppy device is deprecated, and support for it will
 +  be removed in a future release.
 +
 +Hard disks
 +  Hard disks can be used. Normally you must specify the whole disk
 +  (``/dev/hdb`` instead of ``/dev/hdb1``) so that the guest OS can
 +  see it as a partitioned disk. WARNING: unless you know what you do, it
 +  is better to only make READ-ONLY accesses to the hard disk otherwise
 +  you may corrupt your host data (use the ``-snapshot`` command
 +  line option or modify the device permissions accordingly).
 +
 +Windows
 +'''''''
 +
 +CD
 +  The preferred syntax is the drive letter (e.g. ``d:``). The
 +  alternate syntax ``\\.\d:`` is supported. ``/dev/cdrom`` is
 +  supported as an alias to the first CDROM drive.
 +
 +  Currently there is no specific code to handle removable media, so it
 +  is better to use the ``change`` or ``eject`` monitor commands to
 +  change or eject media.
 +
 +Hard disks
 +  Hard disks can be used with the syntax: ``\\.\PhysicalDriveN``
 +  where *N* is the drive number (0 is the first hard disk).
 +
 +  WARNING: unless you know what you do, it is better to only make
 +  READ-ONLY accesses to the hard disk otherwise you may corrupt your
 +  host data (use the ``-snapshot`` command line so that the
 +  modifications are written in a temporary file).
 +
 +Mac OS X
 +''''''''
 +
 +``/dev/cdrom`` is an alias to the first CDROM.
 +
 +Currently there is no specific code to handle removable media, so it
 +is better to use the ``change`` or ``eject`` monitor commands to
 +change or eject media.
 +
 +Virtual FAT disk images
 +-----------------------
 +
 +QEMU can automatically create a virtual FAT disk image from a
 +directory tree. In order to use it, just type:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| linux.img -hdb fat:/my_directory
 +
 +Then you access access to all the files in the ``/my_directory``
 +directory without having to copy them in a disk image or to export
 +them via SAMBA or NFS. The default access is *read-only*.
 +
 +Floppies can be emulated with the ``:floppy:`` option:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| linux.img -fda fat:floppy:/my_directory
 +
 +A read/write support is available for testing (beta stage) with the
 +``:rw:`` option:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| linux.img -fda fat:floppy:rw:/my_directory
 +
 +What you should *never* do:
 +
 +- use non-ASCII filenames
 +- use "-snapshot" together with ":rw:"
 +- expect it to work when loadvm'ing
 +- write to the FAT directory on the host system while accessing it with the guest system
 +
 +NBD access
 +----------
 +
 +QEMU can access directly to block device exported using the Network Block Device
 +protocol.
 +
 +.. parsed-literal::
 +
 +  |qemu_system| linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
 +
 +If the NBD server is located on the same host, you can use an unix socket instead
 +of an inet socket:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| linux.img -hdb nbd+unix://?socket=/tmp/my_socket
 +
 +In this case, the block device must be exported using qemu-nbd:
 +
 +.. parsed-literal::
 +
 +  qemu-nbd --socket=/tmp/my_socket my_disk.qcow2
 +
 +The use of qemu-nbd allows sharing of a disk between several guests:
 +
 +.. parsed-literal::
 +
 +  qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
 +
 +and then you can use it with two guests:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
 +  |qemu_system| linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
 +
 +If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
 +own embedded NBD server), you must specify an export name in the URI:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| -cdrom nbd://localhost/debian-500-ppc-netinst
 +  |qemu_system| -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
 +
 +The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
 +also available.  Here are some example of the older syntax:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
 +  |qemu_system| linux2.img -hdb nbd:unix:/tmp/my_socket
 +  |qemu_system| -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
 +
 +
 +
 +Sheepdog disk images
 +--------------------
 +
 +Sheepdog is a distributed storage system for QEMU.  It provides highly
 +available block level storage volumes that can be attached to
 +QEMU-based virtual machines.
 +
 +You can create a Sheepdog disk image with the command:
 +
 +.. parsed-literal::
 +
 +  qemu-img create sheepdog:///IMAGE SIZE
 +
 +where *IMAGE* is the Sheepdog image name and *SIZE* is its
 +size.
 +
 +To import the existing *FILENAME* to Sheepdog, you can use a
 +convert command.
 +
 +.. parsed-literal::
 +
 +  qemu-img convert FILENAME sheepdog:///IMAGE
 +
 +You can boot from the Sheepdog disk image with the command:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| sheepdog:///IMAGE
 +
 +You can also create a snapshot of the Sheepdog image like qcow2.
 +
 +.. parsed-literal::
 +
 +  qemu-img snapshot -c TAG sheepdog:///IMAGE
 +
 +where *TAG* is a tag name of the newly created snapshot.
 +
 +To boot from the Sheepdog snapshot, specify the tag name of the
 +snapshot.
 +
 +.. parsed-literal::
 +
 +  |qemu_system| sheepdog:///IMAGE#TAG
 +
 +You can create a cloned image from the existing snapshot.
 +
 +.. parsed-literal::
 +
 +  qemu-img create -b sheepdog:///BASE#TAG sheepdog:///IMAGE
 +
 +where *BASE* is an image name of the source snapshot and *TAG*
 +is its tag name.
 +
 +You can use an unix socket instead of an inet socket:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| sheepdog+unix:///IMAGE?socket=PATH
 +
 +If the Sheepdog daemon doesn't run on the local host, you need to
 +specify one of the Sheepdog servers to connect to.
 +
 +.. parsed-literal::
 +
 +  qemu-img create sheepdog://HOSTNAME:PORT/IMAGE SIZE
 +  |qemu_system| sheepdog://HOSTNAME:PORT/IMAGE
 +
 +iSCSI LUNs
 +----------
 +
 +iSCSI is a popular protocol used to access SCSI devices across a computer
 +network.
 +
 +There are two different ways iSCSI devices can be used by QEMU.
 +
 +The first method is to mount the iSCSI LUN on the host, and make it appear as
 +any other ordinary SCSI device on the host and then to access this device as a
 +/dev/sd device from QEMU. How to do this differs between host OSes.
 +
 +The second method involves using the iSCSI initiator that is built into
 +QEMU. This provides a mechanism that works the same way regardless of which
 +host OS you are running QEMU on. This section will describe this second method
 +of using iSCSI together with QEMU.
 +
 +In QEMU, iSCSI devices are described using special iSCSI URLs. URL syntax:
 +
 +::
 +
 +  iscsi://[<username>[%<password>]@]<host>[:<port>]/<target-iqn-name>/<lun>
 +
 +Username and password are optional and only used if your target is set up
 +using CHAP authentication for access control.
 +Alternatively the username and password can also be set via environment
 +variables to have these not show up in the process list:
 +
 +::
 +
 +  export LIBISCSI_CHAP_USERNAME=<username>
 +  export LIBISCSI_CHAP_PASSWORD=<password>
 +  iscsi://<host>/<target-iqn-name>/<lun>
 +
 +Various session related parameters can be set via special options, either
 +in a configuration file provided via '-readconfig' or directly on the
 +command line.
 +
 +If the initiator-name is not specified qemu will use a default name
 +of 'iqn.2008-11.org.linux-kvm[:<uuid>'] where <uuid> is the UUID of the
 +virtual machine. If the UUID is not specified qemu will use
 +'iqn.2008-11.org.linux-kvm[:<name>'] where <name> is the name of the
 +virtual machine.
 +
 +Setting a specific initiator name to use when logging in to the target:
 +
 +::
 +
 +  -iscsi initiator-name=iqn.qemu.test:my-initiator
 +
 +Controlling which type of header digest to negotiate with the target:
 +
 +::
 +
 +  -iscsi header-digest=CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
 +
 +These can also be set via a configuration file:
 +
 +::
 +
 +  [iscsi]
 +    user = "CHAP username"
 +    password = "CHAP password"
 +    initiator-name = "iqn.qemu.test:my-initiator"
 +    # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
 +    header-digest = "CRC32C"
 +
 +Setting the target name allows different options for different targets:
 +
 +::
 +
 +  [iscsi "iqn.target.name"]
 +    user = "CHAP username"
 +    password = "CHAP password"
 +    initiator-name = "iqn.qemu.test:my-initiator"
 +    # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
 +    header-digest = "CRC32C"
 +
 +How to use a configuration file to set iSCSI configuration options:
 +
 +.. parsed-literal::
 +
 +  cat >iscsi.conf <<EOF
 +  [iscsi]
 +    user = "me"
 +    password = "my password"
 +    initiator-name = "iqn.qemu.test:my-initiator"
 +    header-digest = "CRC32C"
 +  EOF
 +
 +  |qemu_system| -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \\
 +    -readconfig iscsi.conf
 +
 +How to set up a simple iSCSI target on loopback and access it via QEMU:
 +this example shows how to set up an iSCSI target with one CDROM and one DISK
 +using the Linux STGT software target. This target is available on Red Hat based
 +systems as the package 'scsi-target-utils'.
 +
 +.. parsed-literal::
 +
 +  tgtd --iscsi portal=127.0.0.1:3260
 +  tgtadm --lld iscsi --op new --mode target --tid 1 -T iqn.qemu.test
 +  tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 1 \\
 +      -b /IMAGES/disk.img --device-type=disk
 +  tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \\
 +      -b /IMAGES/cd.iso --device-type=cd
 +  tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL
 +
 +  |qemu_system| -iscsi initiator-name=iqn.qemu.test:my-initiator \\
 +    -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \\
 +    -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
 +
 +GlusterFS disk images
 +---------------------
 +
 +GlusterFS is a user space distributed file system.
 +
 +You can boot from the GlusterFS disk image with the command:
 +
 +URI:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| -drive file=gluster[+TYPE]://[HOST}[:PORT]]/VOLUME/PATH
 +                               [?socket=...][,file.debug=9][,file.logfile=...]
 +
 +JSON:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| 'json:{"driver":"qcow2",
 +                           "file":{"driver":"gluster",
 +                                    "volume":"testvol","path":"a.img","debug":9,"logfile":"...",
 +                                    "server":[{"type":"tcp","host":"...","port":"..."},
 +                                              {"type":"unix","socket":"..."}]}}'
 +
 +*gluster* is the protocol.
 +
 +*TYPE* specifies the transport type used to connect to gluster
 +management daemon (glusterd). Valid transport types are
 +tcp and unix. In the URI form, if a transport type isn't specified,
 +then tcp type is assumed.
 +
 +*HOST* specifies the server where the volume file specification for
 +the given volume resides. This can be either a hostname or an ipv4 address.
 +If transport type is unix, then *HOST* field should not be specified.
 +Instead *socket* field needs to be populated with the path to unix domain
 +socket.
 +
 +*PORT* is the port number on which glusterd is listening. This is optional
 +and if not specified, it defaults to port 24007. If the transport type is unix,
 +then *PORT* should not be specified.
 +
 +*VOLUME* is the name of the gluster volume which contains the disk image.
 +
 +*PATH* is the path to the actual disk image that resides on gluster volume.
 +
 +*debug* is the logging level of the gluster protocol driver. Debug levels
 +are 0-9, with 9 being the most verbose, and 0 representing no debugging output.
 +The default level is 4. The current logging levels defined in the gluster source
 +are 0 - None, 1 - Emergency, 2 - Alert, 3 - Critical, 4 - Error, 5 - Warning,
 +6 - Notice, 7 - Info, 8 - Debug, 9 - Trace
 +
 +*logfile* is a commandline option to mention log file path which helps in
 +logging to the specified file and also help in persisting the gfapi logs. The
 +default is stderr.
 +
 +You can create a GlusterFS disk image with the command:
 +
 +.. parsed-literal::
 +
 +  qemu-img create gluster://HOST/VOLUME/PATH SIZE
 +
 +Examples
 +
 +.. parsed-literal::
 +
 +  |qemu_system| -drive file=gluster://1.2.3.4/testvol/a.img
 +  |qemu_system| -drive file=gluster+tcp://1.2.3.4/testvol/a.img
 +  |qemu_system| -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
 +  |qemu_system| -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
 +  |qemu_system| -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
 +  |qemu_system| -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
 +  |qemu_system| -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
 +  |qemu_system| -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
 +  |qemu_system| -drive file=gluster://1.2.3.4/testvol/a.img,file.debug=9,file.logfile=/var/log/qemu-gluster.log
 +  |qemu_system| 'json:{"driver":"qcow2",
 +                           "file":{"driver":"gluster",
 +                                    "volume":"testvol","path":"a.img",
 +                                    "debug":9,"logfile":"/var/log/qemu-gluster.log",
 +                                    "server":[{"type":"tcp","host":"1.2.3.4","port":24007},
 +                                              {"type":"unix","socket":"/var/run/glusterd.socket"}]}}'
 +  |qemu_system| -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
 +                                       file.debug=9,file.logfile=/var/log/qemu-gluster.log,
 +                                       file.server.0.type=tcp,file.server.0.host=1.2.3.4,file.server.0.port=24007,
 +                                       file.server.1.type=unix,file.server.1.socket=/var/run/glusterd.socket
 +
 +Secure Shell (ssh) disk images
 +------------------------------
 +
 +You can access disk images located on a remote ssh server
 +by using the ssh protocol:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| -drive file=ssh://[USER@]SERVER[:PORT]/PATH[?host_key_check=HOST_KEY_CHECK]
 +
 +Alternative syntax using properties:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| -drive file.driver=ssh[,file.user=USER],file.host=SERVER[,file.port=PORT],file.path=PATH[,file.host_key_check=HOST_KEY_CHECK]
 +
 +*ssh* is the protocol.
 +
 +*USER* is the remote user.  If not specified, then the local
 +username is tried.
 +
 +*SERVER* specifies the remote ssh server.  Any ssh server can be
 +used, but it must implement the sftp-server protocol.  Most Unix/Linux
 +systems should work without requiring any extra configuration.
 +
 +*PORT* is the port number on which sshd is listening.  By default
 +the standard ssh port (22) is used.
 +
 +*PATH* is the path to the disk image.
 +
 +The optional *HOST_KEY_CHECK* parameter controls how the remote
 +host's key is checked.  The default is ``yes`` which means to use
 +the local ``.ssh/known_hosts`` file.  Setting this to ``no``
 +turns off known-hosts checking.  Or you can check that the host key
 +matches a specific fingerprint:
 +``host_key_check=md5:78:45:8e:14:57:4f:d5:45:83:0a:0e:f3:49:82:c9:c8``
 +(``sha1:`` can also be used as a prefix, but note that OpenSSH
 +tools only use MD5 to print fingerprints).
 +
 +Currently authentication must be done using ssh-agent.  Other
 +authentication methods may be supported in future.
 +
 +Note: Many ssh servers do not support an ``fsync``-style operation.
 +The ssh driver cannot guarantee that disk flush requests are
 +obeyed, and this causes a risk of disk corruption if the remote
 +server or network goes down during writes.  The driver will
 +print a warning when ``fsync`` is not supported:
 +
 +::
 +
 +  warning: ssh server ssh.example.com:22 does not support fsync
 +
 +With sufficiently new versions of libssh and OpenSSH, ``fsync`` is
 +supported.
 +
 +NVMe disk images
 +----------------
 +
 +NVM Express (NVMe) storage controllers can be accessed directly by a userspace
 +driver in QEMU.  This bypasses the host kernel file system and block layers
 +while retaining QEMU block layer functionalities, such as block jobs, I/O
 +throttling, image formats, etc.  Disk I/O performance is typically higher than
 +with ``-drive file=/dev/sda`` using either thread pool or linux-aio.
 +
 +The controller will be exclusively used by the QEMU process once started. To be
 +able to share storage between multiple VMs and other applications on the host,
 +please use the file based protocols.
 +
 +Before starting QEMU, bind the host NVMe controller to the host vfio-pci
 +driver.  For example:
 +
 +.. parsed-literal::
 +
 +  # modprobe vfio-pci
 +  # lspci -n -s 0000:06:0d.0
 +  06:0d.0 0401: 1102:0002 (rev 08)
 +  # echo 0000:06:0d.0 > /sys/bus/pci/devices/0000:06:0d.0/driver/unbind
 +  # echo 1102 0002 > /sys/bus/pci/drivers/vfio-pci/new_id
 +
 +  # |qemu_system| -drive file=nvme://HOST:BUS:SLOT.FUNC/NAMESPACE
 +
 +Alternative syntax using properties:
 +
 +.. parsed-literal::
 +
 +  |qemu_system| -drive file.driver=nvme,file.device=HOST:BUS:SLOT.FUNC,file.namespace=NAMESPACE
 +
 +*HOST*:*BUS*:*SLOT*.\ *FUNC* is the NVMe controller's PCI device
 +address on the host.
 +
 +*NAMESPACE* is the NVMe namespace number, starting from 1.
 +
 +Disk image file locking
 +-----------------------
 +
 +By default, QEMU tries to protect image files from unexpected concurrent
 +access, as long as it's supported by the block protocol driver and host
 +operating system. If multiple QEMU processes (including QEMU emulators and
 +utilities) try to open the same image with conflicting accessing modes, all but
 +the first one will get an error.
 +
 +This feature is currently supported by the file protocol on Linux with the Open
 +File Descriptor (OFD) locking API, and can be configured to fall back to POSIX
 +locking if the POSIX host doesn't support Linux OFD locking.
 +
 +To explicitly enable image locking, specify "locking=on" in the file protocol
 +driver options. If OFD locking is not possible, a warning will be printed and
 +the POSIX locking API will be used. In this case there is a risk that the lock
 +will get silently lost when doing hot plugging and block jobs, due to the
 +shortcomings of the POSIX locking API.
 +
 +QEMU transparently handles lock handover during shared storage migration.  For
 +shared virtual disk images between multiple VMs, the "share-rw" device option
 +should be used.
 +
 +By default, the guest has exclusive write access to its disk image. If the
 +guest can safely share the disk image with other writers the
 +``-device ...,share-rw=on`` parameter can be used.  This is only safe if
 +the guest is running software, such as a cluster file system, that
 +coordinates disk accesses to avoid corruption.
 +
 +Note that share-rw=on only declares the guest's ability to share the disk.
 +Some QEMU features, such as image file formats, require exclusive write access
 +to the disk image and this is unaffected by the share-rw=on option.
 +
 +Alternatively, locking can be fully disabled by "locking=off" block device
 +option. In the command line, the option is usually in the form of
 +"file.locking=off" as the protocol driver is normally placed as a "file" child
 +under a format driver. For example:
 +
 +::
 +
 +  -blockdev driver=qcow2,file.filename=/path/to/image,file.locking=off,file.driver=file
 +
 +To check if image locking is active, check the output of the "lslocks" command
 +on host and see if there are locks held by the QEMU process on the image file.
 +More than one byte could be locked by the QEMU instance, each byte of which
 +reflects a particular permission that is acquired or protected by the running
 +block driver.
 +
 +.. only:: man
 +
 +  See also
 +  --------
 +
 +  The HTML documentation of QEMU for more precise information and Linux
 +  user mode emulator invocation.
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-doc.texi
 +++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ encrypted disk images.
  * disk_images_snapshot_mode:: Snapshot mode
  * vm_snapshots::              VM snapshots
  * qemu_img_invocation::       qemu-img Invocation
 -* disk_images_formats::       Disk image file formats
 -* host_drives::               Using host drives
 -* disk_images_fat_images::    Virtual FAT disk images
 -* disk_images_nbd::           NBD access
 -* disk_images_sheepdog::      Sheepdog disk images
 -* disk_images_iscsi::         iSCSI LUNs
 -* disk_images_gluster::       GlusterFS disk images
 -* disk_images_ssh::           Secure Shell (ssh) disk images
 -* disk_images_nvme::          NVMe userspace driver
 -* disk_image_locking::        Disk image file locking
  @end menu
  @node disk_images_quickstart
@@ -XXX,XX +XXX,XX @@ state is not saved or restored properly (in particular USB).
  @include qemu-img.texi
 -@include docs/qemu-block-drivers.texi
 -
  @node pcsys_network
  @section Network emulation
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ STEXI
  @findex -cdrom
  Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and
  @option{-cdrom} at the same time). You can use the host CD-ROM by
 -using @file{/dev/cdrom} as filename (@pxref{host_drives}).
 +using @file{/dev/cdrom} as filename.
  ETEXI
  DEF("blockdev", HAS_ARG, QEMU_OPTION_blockdev,
 --
-.20.1
+.25.1

-[PULL 08/20] qemu-nbd: Convert invocation documentation to rST
+[PULL 13/25] target/arm: Implement SMSTART, SMSTOP
-The qemu-nbd documentation is currently in qemu-nbd.texi in Texinfo
+From: Richard Henderson <richard.henderson@linaro.org>
 format, which we present to the user as:
  * a qemu-nbd manpage
  * a section of the main qemu-doc HTML documentation
-Convert the documentation to rST format, and present it to the user as:
+These two instructions are aliases of MSR (immediate).
- * a qemu-nbd manpage
+Use the two helpers to properly implement svcr_write.
  * part of the interop/ Sphinx manual
-This follows the same pattern as commit 27a296fce982 did for the
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-qemu-ga manpage.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220620175235.60881-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h           |  1 +
  target/arm/helper-sme.h    | 21 +++++++++++++
  target/arm/helper.h        |  1 +
  target/arm/helper.c        |  6 ++--
  target/arm/sme_helper.c    | 61 ++++++++++++++++++++++++++++++++++++++
  target/arm/translate-a64.c | 24 +++++++++++++++
  target/arm/meson.build     |  1 +
 files changed, 112 insertions(+), 3 deletions(-)
  create mode 100644 target/arm/helper-sme.h
  create mode 100644 target/arm/sme_helper.c
-All the content of the old manpage is retained, except that I have
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-dropped the "This is free software; see the source for copying
+index XXXXXXX..XXXXXXX 100644
-conditions.  There is NO warranty..." text that was in the old AUTHOR
+--- a/target/arm/cpu.h
-section; Sphinx's manpage builder doesn't expect that much text in
++++ b/target/arm/cpu.h
-the AUTHOR section, and since none of our other manpages have it it
+@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
-seems easiest to delete it rather than try to figure out where else
+                            int new_el, bool el0_a64);
-in the manpage to put it.
+ void aarch64_add_sve_properties(Object *obj);
+ void aarch64_add_pauth_properties(Object *obj);
-The only other textual change is that I have had to give the
++void arm_reset_sve_state(CPUARMState *env);
---nocache option its own description ("Equivalent to --cache=none")
-because Sphinx doesn't have an equivalent of using item/itemx
+ /*
-to share a description between two options.
+  * SVE registers are encoded in KVM's memory in an endianness-invariant format.
+diff --git a/target/arm/helper-sme.h b/target/arm/helper-sme.h
 Some minor aspects of the formatting have changed, to suit what is
 easiest for Sphinx to output. (The most notable is that Sphinx
 option section option syntax doesn't support '--option foo=bar'
 with bar underlined rather than bold, so we have to switch to
 '--option foo=BAR' instead.)
 The contents of qemu-option-trace.texi are now duplicated in
 docs/interop/qemu-option-trace.rst.inc, until such time as we complete
 the conversion of the other files which use it; since it has had only
 changes in 3 years, this shouldn't be too awkward a burden.
 (We use .rst.inc because if this file fragment has a .rst extension
 then Sphinx complains about not seeing it in a toctree.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: 20200116141511.16849-2-peter.maydell@linaro.org
 ---
  Makefile                               |  16 +-
  MAINTAINERS                            |   1 +
  docs/interop/conf.py                   |   4 +-
  docs/interop/index.rst                 |   1 +
  docs/interop/qemu-nbd.rst              | 263 +++++++++++++++++++++++++
  docs/interop/qemu-option-trace.rst.inc |  30 +++
  qemu-doc.texi                          |   6 -
  qemu-nbd.texi                          | 214 --------------------
  qemu-option-trace.texi                 |   4 +
 files changed, 313 insertions(+), 226 deletions(-)
  create mode 100644 docs/interop/qemu-nbd.rst
  create mode 100644 docs/interop/qemu-option-trace.rst.inc
  delete mode 100644 qemu-nbd.texi
 diff --git a/Makefile b/Makefile
 index XXXXXXX..XXXXXXX 100644
 --- a/Makefile
 +++ b/Makefile
@@ -XXX,XX +XXX,XX @@ MANUAL_BUILDDIR := docs
  endif
  ifdef BUILD_DOCS
 -DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 $(MANUAL_BUILDDIR)/interop/qemu-ga.8
 +DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1
 +DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-nbd.8
 +DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-ga.8
  DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
  DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
  DOCS+=docs/qemu-block-drivers.7
@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_POSIX
  ifeq ($(CONFIG_TOOLS),y)
      $(INSTALL_DATA) qemu-img.1 "$(DESTDIR)$(mandir)/man1"
      $(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
 -    $(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
 +    $(INSTALL_DATA) $(MANUAL_BUILDDIR)/interop/qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
  endif
  ifdef CONFIG_TRACE_SYSTEMTAP
      $(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
@@ -XXX,XX +XXX,XX @@ sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index
  # a single doctree: https://github.com/sphinx-doc/sphinx/issues/2946
  build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" sphinx-build $(if $(V),,-q) -W -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
  # We assume all RST files in the manual's directory are used in it
 -manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
 +manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) \
 +              $(wildcard $(SRC_PATH)/docs/$1/*.rst.inc) \
 +              $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
  $(MANUAL_BUILDDIR)/devel/index.html: $(call manual-deps,devel)
      $(call build-manual,devel,html)
@@ -XXX,XX +XXX,XX @@ $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
  $(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
      $(call build-manual,interop,man)
 +$(MANUAL_BUILDDIR)/interop/qemu-nbd.8: $(call manual-deps,interop)
 +    $(call build-manual,interop,man)
 +
  $(MANUAL_BUILDDIR)/index.html: $(SRC_PATH)/docs/index.html.in qemu-version.h
      @mkdir -p "$(MANUAL_BUILDDIR)"
      $(call quiet-command, sed "s|@@VERSION@@|${VERSION}|g" $< >$@, \
@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
  qemu.1: qemu-option-trace.texi
  qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
  fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
 -qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
  docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
  docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
  scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
@@ -XXX,XX +XXX,XX @@ pdf: qemu-doc.pdf docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
  txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
  qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 -    qemu-img.texi qemu-nbd.texi qemu-options.texi \
 +    qemu-img.texi qemu-options.texi \
      qemu-tech.texi qemu-option-trace.texi \
      qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
      qemu-monitor-info.texi docs/qemu-block-drivers.texi \
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/block/nbd*
  F: qemu-nbd.*
  F: blockdev-nbd.c
  F: docs/interop/nbd.txt
 +F: docs/interop/qemu-nbd.rst
  T: git https://repo.or.cz/qemu/ericb.git nbd
  NFS
 diff --git a/docs/interop/conf.py b/docs/interop/conf.py
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/conf.py
 +++ b/docs/interop/conf.py
@@ -XXX,XX +XXX,XX @@ html_theme_options['description'] = u'System Emulation Management and Interopera
  # (source start file, name, description, authors, manual section).
  man_pages = [
      ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
 -     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8)
 +     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
 +    ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
 +     ['Anthony Liguori <anthony@codemonkey.ws>'], 8)
  ]
 diff --git a/docs/interop/index.rst b/docs/interop/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/index.rst
 +++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
     live-block-operations
     pr-helper
     qemu-ga
 +   qemu-nbd
     vhost-user
     vhost-user-gpu
 diff --git a/docs/interop/qemu-nbd.rst b/docs/interop/qemu-nbd.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/docs/interop/qemu-nbd.rst
++++ b/target/arm/helper-sme.h
 @@ -XXX,XX +XXX,XX @@
-+QEMU Disk Network Block Device Server
++/*
-+=====================================
++ *  AArch64 SME specific helper definitions
-+
++ *
-+Synopsis
++ *  Copyright (c) 2022 Linaro, Ltd
-+--------
++ *
-+
++ * This library is free software; you can redistribute it and/or
-+**qemu-nbd** [*OPTION*]... *filename*
++ * modify it under the terms of the GNU Lesser General Public
-+
++ * License as published by the Free Software Foundation; either
-+**qemu-nbd** -L [*OPTION*]...
++ * version 2.1 of the License, or (at your option) any later version.
-+
++ *
-+**qemu-nbd** -d *dev*
++ * This library is distributed in the hope that it will be useful,
-+
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+Description
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+-----------
++ * Lesser General Public License for more details.
-+
++ *
-+Export a QEMU disk image using the NBD protocol.
++ * You should have received a copy of the GNU Lesser General Public
-+
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
-+Other uses:
++ */
 +
-+- Bind a /dev/nbdX block device to a QEMU server (on Linux).
++DEF_HELPER_FLAGS_2(set_pstate_sm, TCG_CALL_NO_RWG, void, env, i32)
-+- As a client to query exports of a remote NBD server.
++DEF_HELPER_FLAGS_2(set_pstate_za, TCG_CALL_NO_RWG, void, env, i32)
-+
+diff --git a/target/arm/helper.h b/target/arm/helper.h
-+Options
+index XXXXXXX..XXXXXXX 100644
-+-------
+--- a/target/arm/helper.h
-+
++++ b/target/arm/helper.h
-+.. program:: qemu-nbd
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_bfmlal_idx, TCG_CALL_NO_RWG,
-+
+ #ifdef TARGET_AARCH64
-+*filename* is a disk image filename, or a set of block
+ #include "helper-a64.h"
-+driver options if ``--image-opts`` is specified.
+ #include "helper-sve.h"
-+
++#include "helper-sme.h"
-+*dev* is an NBD device.
+ #endif
-+
-+.. option:: --object type,id=ID,...props...
+ #include "helper-mve.h"
-+
+diff --git a/target/arm/helper.c b/target/arm/helper.c
-+  Define a new instance of the *type* object class identified by *ID*.
+index XXXXXXX..XXXXXXX 100644
-+  See the :manpage:`qemu(1)` manual page for full details of the properties
+--- a/target/arm/helper.c
-+  supported. The common object types that it makes sense to define are the
++++ b/target/arm/helper.c
-+  ``secret`` object, which is used to supply passwords and/or encryption
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
-+  keys, and the ``tls-creds`` object, which is used to supply TLS
+ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+  credentials for the qemu-nbd server or client.
+                        uint64_t value)
-+
+ {
-+.. option:: -p, --port=PORT
+-    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
-+
+-    /* TODO: Side effects. */
-+  TCP port to listen on as a server, or connect to as a client
+-    env->svcr = value;
-+  (default ``10809``).
++    helper_set_pstate_sm(env, FIELD_EX64(value, SVCR, SM));
-+
++    helper_set_pstate_za(env, FIELD_EX64(value, SVCR, ZA));
-+.. option:: -o, --offset=OFFSET
++    arm_rebuild_hflags(env);
-+
+ }
-+  The offset into the image.
-+
+ static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+.. option:: -b, --bind=IFACE
+diff --git a/target/arm/sme_helper.c b/target/arm/sme_helper.c
 +
 +  The interface to bind to as a server, or connect to as a client
 +  (default ``0.0.0.0``).
 +
 +.. option:: -k, --socket=PATH
 +
 +  Use a unix socket with path *PATH*.
 +
 +.. option:: --image-opts
 +
 +  Treat *filename* as a set of image options, instead of a plain
 +  filename. If this flag is specified, the ``-f`` flag should
 +  not be used, instead the :option:`format=` option should be set.
 +
 +.. option:: -f, --format=FMT
 +
 +  Force the use of the block driver for format *FMT* instead of
 +  auto-detecting.
 +
 +.. option:: -r, --read-only
 +
 +  Export the disk as read-only.
 +
 +.. option:: -P, --partition=NUM
 +
 +  Deprecated: Only expose MBR partition *NUM*.  Understands physical
 +  partitions 1-4 and logical partition 5. New code should instead use
 +  :option:`--image-opts` with the raw driver wrapping a subset of the
 +  original image.
 +
 +.. option:: -B, --bitmap=NAME
 +
 +  If *filename* has a qcow2 persistent bitmap *NAME*, expose
 +  that bitmap via the ``qemu:dirty-bitmap:NAME`` context
 +  accessible through NBD_OPT_SET_META_CONTEXT.
 +
 +.. option:: -s, --snapshot
 +
 +  Use *filename* as an external snapshot, create a temporary
 +  file with ``backing_file=``\ *filename*, redirect the write to
 +  the temporary one.
 +
 +.. option:: -l, --load-snapshot=SNAPSHOT_PARAM
 +
 +  Load an internal snapshot inside *filename* and export it
 +  as an read-only device, SNAPSHOT_PARAM format is
 +  ``snapshot.id=[ID],snapshot.name=[NAME]`` or ``[ID_OR_NAME]``
 +
 +.. option:: --cache=CACHE
 +
 +  The cache mode to be used with the file.  See the documentation of
 +  the emulator's ``-drive cache=...`` option for allowed values.
 +
 +.. option:: -n, --nocache
 +
 +  Equivalent to :option:`--cache=none`.
 +
 +.. option:: --aio=AIO
 +
 +  Set the asynchronous I/O mode between ``threads`` (the default)
 +  and ``native`` (Linux only).
 +
 +.. option:: --discard=DISCARD
 +
 +  Control whether ``discard`` (also known as ``trim`` or ``unmap``)
 +  requests are ignored or passed to the filesystem. *DISCARD* is one of
 +  ``ignore`` (or ``off``), ``unmap`` (or ``on``).  The default is
 +  ``ignore``.
 +
 +.. option:: --detect-zeroes=DETECT_ZEROES
 +
 +  Control the automatic conversion of plain zero writes by the OS to
 +  driver-specific optimized zero write commands.  *DETECT_ZEROES* is one of
 +  ``off``, ``on``, or ``unmap``.  ``unmap``
 +  converts a zero write to an unmap operation and can only be used if
 +  *DISCARD* is set to ``unmap``.  The default is ``off``.
 +
 +.. option:: -c, --connect=DEV
 +
 +  Connect *filename* to NBD device *DEV* (Linux only).
 +
 +.. option:: -d, --disconnect
 +
 +  Disconnect the device *DEV* (Linux only).
 +
 +.. option:: -e, --shared=NUM
 +
 +  Allow up to *NUM* clients to share the device (default
 +  ``1``). Safe for readers, but for now, consistency is not
 +  guaranteed between multiple writers.
 +
 +.. option:: -t, --persistent
 +
 +  Don't exit on the last connection.
 +
 +.. option:: -x, --export-name=NAME
 +
 +  Set the NBD volume export name (default of a zero-length string).
 +
 +.. option:: -D, --description=DESCRIPTION
 +
 +  Set the NBD volume export description, as a human-readable
 +  string.
 +
 +.. option:: -L, --list
 +
 +  Connect as a client and list all details about the exports exposed by
 +  a remote NBD server.  This enables list mode, and is incompatible
 +  with options that change behavior related to a specific export (such as
 +  :option:`--export-name`, :option:`--offset`, ...).
 +
 +.. option:: --tls-creds=ID
 +
 +  Enable mandatory TLS encryption for the server by setting the ID
 +  of the TLS credentials object previously created with the --object
 +  option; or provide the credentials needed for connecting as a client
 +  in list mode.
 +
 +.. option:: --fork
 +
 +  Fork off the server process and exit the parent once the server is running.
 +
 +.. option:: --pid-file=PATH
 +
 +  Store the server's process ID in the given file.
 +
 +.. option:: --tls-authz=ID
 +
 +  Specify the ID of a qauthz object previously created with the
 +  :option:`--object` option. This will be used to authorize connecting users
 +  against their x509 distinguished name.
 +
 +.. option:: -v, --verbose
 +
 +  Display extra debugging information.
 +
 +.. option:: -h, --help
 +
 +  Display this help and exit.
 +
 +.. option:: -V, --version
 +
 +  Display version information and exit.
 +
 +.. option:: -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]
 +
 +  .. include:: qemu-option-trace.rst.inc
 +
 +Examples
 +--------
 +
 +Start a server listening on port 10809 that exposes only the
 +guest-visible contents of a qcow2 file, with no TLS encryption, and
 +with the default export name (an empty string). The command is
 +one-shot, and will block until the first successful client
 +disconnects:
 +
 +::
 +
 +  qemu-nbd -f qcow2 file.qcow2
 +
 +Start a long-running server listening with encryption on port 10810,
 +and whitelist clients with a specific X.509 certificate to connect to
 +a 1 megabyte subset of a raw file, using the export name 'subset':
 +
 +::
 +
 +  qemu-nbd \
 +    --object tls-creds-x509,id=tls0,endpoint=server,dir=/path/to/qemutls \
 +    --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
 +              O=Example Org,,L=London,,ST=London,,C=GB' \
 +    --tls-creds tls0 --tls-authz auth0 \
 +    -t -x subset -p 10810 \
 +    --image-opts driver=raw,offset=1M,size=1M,file.driver=file,file.filename=file.raw
 +
 +Serve a read-only copy of just the first MBR partition of a guest
 +image over a Unix socket with as many as 5 simultaneous readers, with
 +a persistent process forked as a daemon:
 +
 +::
 +
 +  qemu-nbd --fork --persistent --shared=5 --socket=/path/to/sock \
 +    --partition=1 --read-only --format=qcow2 file.qcow2
 +
 +Expose the guest-visible contents of a qcow2 file via a block device
 +/dev/nbd0 (and possibly creating /dev/nbd0p1 and friends for
 +partitions found within), then disconnect the device when done.
 +Access to bind qemu-nbd to an /dev/nbd device generally requires root
 +privileges, and may also require the execution of ``modprobe nbd``
 +to enable the kernel NBD client module.  *CAUTION*: Do not use
 +this method to mount filesystems from an untrusted guest image - a
 +malicious guest may have prepared the image to attempt to trigger
 +kernel bugs in partition probing or file system mounting.
 +
 +::
 +
 +  qemu-nbd -c /dev/nbd0 -f qcow2 file.qcow2
 +  qemu-nbd -d /dev/nbd0
 +
 +Query a remote server to see details about what export(s) it is
 +serving on port 10809, and authenticating via PSK:
 +
 +::
 +
 +  qemu-nbd \
 +    --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=eblake,endpoint=client \
 +    --tls-creds tls0 -L -b remote.example.com
 +
 +See also
 +--------
 +
 +:manpage:`qemu(1)`, :manpage:`qemu-img(1)`
 diff --git a/docs/interop/qemu-option-trace.rst.inc b/docs/interop/qemu-option-trace.rst.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/docs/interop/qemu-option-trace.rst.inc
++++ b/target/arm/sme_helper.c
 @@ -XXX,XX +XXX,XX @@
-+..
++/*
-+  The contents of this file must be kept in sync with qemu-option-trace.texi
++ * ARM SME Operations
-+  until all the users of the texi file have been converted to rst and
++ *
-+  the texi file can be removed.
++ * Copyright (c) 2022 Linaro, Ltd.
-+
++ *
-+Specify tracing options.
++ * This library is free software; you can redistribute it and/or
-+
++ * modify it under the terms of the GNU Lesser General Public
-+.. option:: [enable=]PATTERN
++ * License as published by the Free Software Foundation; either
-+
++ * version 2.1 of the License, or (at your option) any later version.
-+  Immediately enable events matching *PATTERN*
++ *
-+  (either event name or a globbing pattern).  This option is only
++ * This library is distributed in the hope that it will be useful,
-+  available if QEMU has been compiled with the ``simple``, ``log``
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+  or ``ftrace`` tracing backend.  To specify multiple events or patterns,
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+  specify the :option:`-trace` option multiple times.
++ * Lesser General Public License for more details.
-+
++ *
-+  Use :option:`-trace help` to print a list of names of trace points.
++ * You should have received a copy of the GNU Lesser General Public
-+
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
-+.. option:: events=FILE
++ */
 +
-+  Immediately enable events listed in *FILE*.
++#include "qemu/osdep.h"
-+  The file must contain one event name (as listed in the ``trace-events-all``
++#include "cpu.h"
-+  file) per line; globbing patterns are accepted too.  This option is only
++#include "internals.h"
-+  available if QEMU has been compiled with the ``simple``, ``log`` or
++#include "exec/helper-proto.h"
-+  ``ftrace`` tracing backend.
++
-+
++/* ResetSVEState */
-+.. option:: file=FILE
++void arm_reset_sve_state(CPUARMState *env)
-+
++{
-+  Log output traces to *FILE*.
++    memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
-+  This option is only available if QEMU has been compiled with
++    /* Recall that FFR is stored as pregs[16]. */
-+  the ``simple`` tracing backend.
++    memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
-diff --git a/qemu-doc.texi b/qemu-doc.texi
++    vfp_set_fpcr(env, 0x0800009f);
-index XXXXXXX..XXXXXXX 100644
++}
---- a/qemu-doc.texi
++
-+++ b/qemu-doc.texi
++void helper_set_pstate_sm(CPUARMState *env, uint32_t i)
-@@ -XXX,XX +XXX,XX @@ encrypted disk images.
++{
- * disk_images_snapshot_mode:: Snapshot mode
++    if (i == FIELD_EX64(env->svcr, SVCR, SM)) {
- * vm_snapshots::              VM snapshots
++        return;
- * qemu_img_invocation::       qemu-img Invocation
++    }
--* qemu_nbd_invocation::       qemu-nbd Invocation
++    env->svcr ^= R_SVCR_SM_MASK;
- * disk_images_formats::       Disk image file formats
++    arm_reset_sve_state(env);
- * host_drives::               Using host drives
++}
- * disk_images_fat_images::    Virtual FAT disk images
++
-@@ -XXX,XX +XXX,XX @@ state is not saved or restored properly (in particular USB).
++void helper_set_pstate_za(CPUARMState *env, uint32_t i)
++{
- @include qemu-img.texi
++    if (i == FIELD_EX64(env->svcr, SVCR, ZA)) {
++        return;
--@node qemu_nbd_invocation
++    }
--@subsection @code{qemu-nbd} Invocation
++    env->svcr ^= R_SVCR_ZA_MASK;
--
++
--@include qemu-nbd.texi
++    /*
--
++     * ResetSMEState.
- @include docs/qemu-block-drivers.texi
++     *
++     * SetPSTATE_ZA zeros on enable and disable.  We can zero this only
- @node pcsys_network
++     * on enable: while disabled, the storage is inaccessible and the
-diff --git a/qemu-nbd.texi b/qemu-nbd.texi
++     * value does not matter.  We're not saving the storage in vmstate
-deleted file mode 100644
++     * when disabled either.
-index XXXXXXX..XXXXXXX
++     */
---- a/qemu-nbd.texi
++    if (i) {
-+++ /dev/null
++        memset(env->zarray, 0, sizeof(env->zarray));
-@@ -XXX,XX +XXX,XX @@
++    }
--@example
++}
--@c man begin SYNOPSIS
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
--@command{qemu-nbd} [OPTION]... @var{filename}
+index XXXXXXX..XXXXXXX 100644
--
+--- a/target/arm/translate-a64.c
--@command{qemu-nbd} @option{-L} [OPTION]...
++++ b/target/arm/translate-a64.c
--
+@@ -XXX,XX +XXX,XX @@ static void handle_msr_i(DisasContext *s, uint32_t insn,
--@command{qemu-nbd} @option{-d} @var{dev}
+         }
--@c man end
+         break;
--@end example
--
++    case 0x1b: /* SVCR* */
--@c man begin DESCRIPTION
++        if (!dc_isar_feature(aa64_sme, s) || crm < 2 || crm > 7) {
--
++            goto do_unallocated;
--Export a QEMU disk image using the NBD protocol.
++        }
--
++        if (sme_access_check(s)) {
--Other uses:
++            bool i = crm & 1;
--@itemize
++            bool changed = false;
--@item
++
--Bind a /dev/nbdX block device to a QEMU server (on Linux).
++            if ((crm & 2) && i != s->pstate_sm) {
--@item
++                gen_helper_set_pstate_sm(cpu_env, tcg_constant_i32(i));
--As a client to query exports of a remote NBD server.
++                changed = true;
--@end itemize
++            }
--
++            if ((crm & 4) && i != s->pstate_za) {
--@c man end
++                gen_helper_set_pstate_za(cpu_env, tcg_constant_i32(i));
--
++                changed = true;
--@c man begin OPTIONS
++            }
--@var{filename} is a disk image filename, or a set of block
++            if (changed) {
--driver options if @option{--image-opts} is specified.
++                gen_rebuild_hflags(s);
--
++            } else {
--@var{dev} is an NBD device.
++                s->base.is_jmp = DISAS_NEXT;
--
++            }
--@table @option
++        }
--@item --object type,id=@var{id},...props...
++        break;
--Define a new instance of the @var{type} object class identified by @var{id}.
++
--See the @code{qemu(1)} manual page for full details of the properties
+     default:
--supported. The common object types that it makes sense to define are the
+     do_unallocated:
--@code{secret} object, which is used to supply passwords and/or encryption
+         unallocated_encoding(s);
--keys, and the @code{tls-creds} object, which is used to supply TLS
+diff --git a/target/arm/meson.build b/target/arm/meson.build
--credentials for the qemu-nbd server or client.
+index XXXXXXX..XXXXXXX 100644
--@item -p, --port=@var{port}
+--- a/target/arm/meson.build
--The TCP port to listen on as a server, or connect to as a client
++++ b/target/arm/meson.build
--(default @samp{10809}).
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
--@item -o, --offset=@var{offset}
+   'mte_helper.c',
--The offset into the image.
+   'pauth_helper.c',
--@item -b, --bind=@var{iface}
+   'sve_helper.c',
--The interface to bind to as a server, or connect to as a client
++  'sme_helper.c',
--(default @samp{0.0.0.0}).
+   'translate-a64.c',
--@item -k, --socket=@var{path}
+   'translate-sve.c',
--Use a unix socket with path @var{path}.
+ ))
 -@item --image-opts
 -Treat @var{filename} as a set of image options, instead of a plain
 -filename. If this flag is specified, the @var{-f} flag should
 -not be used, instead the '@code{format=}' option should be set.
 -@item -f, --format=@var{fmt}
 -Force the use of the block driver for format @var{fmt} instead of
 -auto-detecting.
 -@item -r, --read-only
 -Export the disk as read-only.
 -@item -P, --partition=@var{num}
 -Deprecated: Only expose MBR partition @var{num}.  Understands physical
 -partitions 1-4 and logical partition 5. New code should instead use
 -@option{--image-opts} with the raw driver wrapping a subset of the
 -original image.
 -@item -B, --bitmap=@var{name}
 -If @var{filename} has a qcow2 persistent bitmap @var{name}, expose
 -that bitmap via the ``qemu:dirty-bitmap:@var{name}'' context
 -accessible through NBD_OPT_SET_META_CONTEXT.
 -@item -s, --snapshot
 -Use @var{filename} as an external snapshot, create a temporary
 -file with backing_file=@var{filename}, redirect the write to
 -the temporary one.
 -@item -l, --load-snapshot=@var{snapshot_param}
 -Load an internal snapshot inside @var{filename} and export it
 -as an read-only device, @var{snapshot_param} format is
 -'snapshot.id=[ID],snapshot.name=[NAME]' or '[ID_OR_NAME]'
 -@item -n, --nocache
 -@itemx --cache=@var{cache}
 -The cache mode to be used with the file.  See the documentation of
 -the emulator's @code{-drive cache=...} option for allowed values.
 -@item --aio=@var{aio}
 -Set the asynchronous I/O mode between @samp{threads} (the default)
 -and @samp{native} (Linux only).
 -@item --discard=@var{discard}
 -Control whether @dfn{discard} (also known as @dfn{trim} or @dfn{unmap})
 -requests are ignored or passed to the filesystem.  @var{discard} is one of
 -@samp{ignore} (or @samp{off}), @samp{unmap} (or @samp{on}).  The default is
 -@samp{ignore}.
 -@item --detect-zeroes=@var{detect-zeroes}
 -Control the automatic conversion of plain zero writes by the OS to
 -driver-specific optimized zero write commands.  @var{detect-zeroes} is one of
 -@samp{off}, @samp{on} or @samp{unmap}.  @samp{unmap}
 -converts a zero write to an unmap operation and can only be used if
 -@var{discard} is set to @samp{unmap}.  The default is @samp{off}.
 -@item -c, --connect=@var{dev}
 -Connect @var{filename} to NBD device @var{dev} (Linux only).
 -@item -d, --disconnect
 -Disconnect the device @var{dev} (Linux only).
 -@item -e, --shared=@var{num}
 -Allow up to @var{num} clients to share the device (default
 -@samp{1}). Safe for readers, but for now, consistency is not
 -guaranteed between multiple writers.
 -@item -t, --persistent
 -Don't exit on the last connection.
 -@item -x, --export-name=@var{name}
 -Set the NBD volume export name (default of a zero-length string).
 -@item -D, --description=@var{description}
 -Set the NBD volume export description, as a human-readable
 -string.
 -@item -L, --list
 -Connect as a client and list all details about the exports exposed by
 -a remote NBD server.  This enables list mode, and is incompatible
 -with options that change behavior related to a specific export (such as
 -@option{--export-name}, @option{--offset}, ...).
 -@item --tls-creds=ID
 -Enable mandatory TLS encryption for the server by setting the ID
 -of the TLS credentials object previously created with the --object
 -option; or provide the credentials needed for connecting as a client
 -in list mode.
 -@item --fork
 -Fork off the server process and exit the parent once the server is running.
 -@item --pid-file=PATH
 -Store the server's process ID in the given file.
 -@item --tls-authz=ID
 -Specify the ID of a qauthz object previously created with the
 ---object option. This will be used to authorize connecting users
 -against their x509 distinguished name.
 -@item -v, --verbose
 -Display extra debugging information.
 -@item -h, --help
 -Display this help and exit.
 -@item -V, --version
 -Display version information and exit.
 -@item -T, --trace [[enable=]@var{pattern}][,events=@var{file}][,file=@var{file}]
 -@findex --trace
 -@include qemu-option-trace.texi
 -@end table
 -
 -@c man end
 -
 -@c man begin EXAMPLES
 -Start a server listening on port 10809 that exposes only the
 -guest-visible contents of a qcow2 file, with no TLS encryption, and
 -with the default export name (an empty string). The command is
 -one-shot, and will block until the first successful client
 -disconnects:
 -
 -@example
 -qemu-nbd -f qcow2 file.qcow2
 -@end example
 -
 -Start a long-running server listening with encryption on port 10810,
 -and whitelist clients with a specific X.509 certificate to connect to
 -a 1 megabyte subset of a raw file, using the export name 'subset':
 -
 -@example
 -qemu-nbd \
 -  --object tls-creds-x509,id=tls0,endpoint=server,dir=/path/to/qemutls \
 -  --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
 -            O=Example Org,,L=London,,ST=London,,C=GB' \
 -  --tls-creds tls0 --tls-authz auth0 \
 -  -t -x subset -p 10810 \
 -  --image-opts driver=raw,offset=1M,size=1M,file.driver=file,file.filename=file.raw
 -@end example
 -
 -Serve a read-only copy of just the first MBR partition of a guest
 -image over a Unix socket with as many as 5 simultaneous readers, with
 -a persistent process forked as a daemon:
 -
 -@example
 -qemu-nbd --fork --persistent --shared=5 --socket=/path/to/sock \
 -  --partition=1 --read-only --format=qcow2 file.qcow2
 -@end example
 -
 -Expose the guest-visible contents of a qcow2 file via a block device
 -/dev/nbd0 (and possibly creating /dev/nbd0p1 and friends for
 -partitions found within), then disconnect the device when done.
 -Access to bind qemu-nbd to an /dev/nbd device generally requires root
 -privileges, and may also require the execution of @code{modprobe nbd}
 -to enable the kernel NBD client module.  @emph{CAUTION}: Do not use
 -this method to mount filesystems from an untrusted guest image - a
 -malicious guest may have prepared the image to attempt to trigger
 -kernel bugs in partition probing or file system mounting.
 -
 -@example
 -qemu-nbd -c /dev/nbd0 -f qcow2 file.qcow2
 -qemu-nbd -d /dev/nbd0
 -@end example
 -
 -Query a remote server to see details about what export(s) it is
 -serving on port 10809, and authenticating via PSK:
 -
 -@example
 -qemu-nbd \
 -  --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=eblake,endpoint=client \
 -  --tls-creds tls0 -L -b remote.example.com
 -@end example
 -
 -@c man end
 -
 -@ignore
 -
 -@setfilename qemu-nbd
 -@settitle QEMU Disk Network Block Device Server
 -
 -@c man begin AUTHOR
 -Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>.
 -This is free software; see the source for copying conditions.  There is NO
 -warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 -@c man end
 -
 -@c man begin SEEALSO
 -qemu(1), qemu-img(1)
 -@c man end
 -
 -@end ignore
 diff --git a/qemu-option-trace.texi b/qemu-option-trace.texi
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-option-trace.texi
 +++ b/qemu-option-trace.texi
@@ -XXX,XX +XXX,XX @@
 +@c The contents of this file must be kept in sync with qemu-option-trace.rst.inc
 +@c until all the users of the texi file have been converted to rst and
 +@c the texi file can be removed.
 +
  Specify tracing options.
  @table @option
 --
-.20.1
+.25.1

-[PULL 09/20] docs: Create stub system manual
+[PULL 14/25] target/arm: Move error for sve%d property to arm_cpu_sve_finalize
-We want a user-facing manual which contains system emulation
+From: Richard Henderson <richard.henderson@linaro.org>
 documentation. Create an empty one which we can populate.
+Keep all of the error messages together.  This does mean that
+when setting many sve length properties we'll only generate
+one error, but we only really need one.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20200116141511.16849-3-peter.maydell@linaro.org
 ---
- Makefile              | 10 +++++++++-
+ target/arm/cpu64.c | 15 +++++++--------
- docs/index.html.in    |  1 +
+file changed, 7 insertions(+), 8 deletions(-)
  docs/system/conf.py   | 15 +++++++++++++++
  docs/system/index.rst | 16 ++++++++++++++++
 files changed, 41 insertions(+), 1 deletion(-)
  create mode 100644 docs/system/conf.py
  create mode 100644 docs/system/index.rst
-diff --git a/Makefile b/Makefile
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/Makefile
+--- a/target/arm/cpu64.c
-+++ b/Makefile
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ distclean: clean
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
-     $(call clean-manual,devel)
+                                   "using only sve<N> properties.\n");
-     $(call clean-manual,interop)
+             } else {
-     $(call clean-manual,specs)
+                 error_setg(errp, "cannot enable sve%d", vq * 128);
-+    $(call clean-manual,system)
+-                error_append_hint(errp, "This CPU does not support "
-     for d in $(TARGET_DIRS); do \
+-                                  "the vector length %d-bits.\n", vq * 128);
-     rm -rf $$d || exit 1 ; \
++                if (vq_supported) {
-         done
++                    error_append_hint(errp, "This CPU does not support "
-@@ -XXX,XX +XXX,XX @@ endef
++                                      "the vector length %d-bits.\n", vq * 128);
- install-sphinxdocs: sphinxdocs
++                } else {
-     $(call install-manual,interop)
++                    error_append_hint(errp, "SVE not supported by KVM "
-     $(call install-manual,specs)
++                                      "on this host\n");
-+    $(call install-manual,system)
++                }
+             }
- install-doc: $(DOCS) install-sphinxdocs
+             return;
-     $(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)"
+         } else {
-@@ -XXX,XX +XXX,XX @@ docs/version.texi: $(SRC_PATH)/VERSION config-host.mak
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
- # and handles "don't rebuild things unless necessary" itself.
+         return;
- # The '.doctrees' files are cached information to speed this up.
+     }
- .PHONY: sphinxdocs
--sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index.html $(MANUAL_BUILDDIR)/specs/index.html
+-    if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
-+sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html \
+-        error_setg(errp, "cannot enable %s", name);
-+            $(MANUAL_BUILDDIR)/interop/index.html \
+-        error_append_hint(errp, "SVE not supported by KVM on this host\n");
-+            $(MANUAL_BUILDDIR)/specs/index.html \
+-        return;
-+            $(MANUAL_BUILDDIR)/system/index.html
+-    }
+-
- # Canned command to build a single manual
+     cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
- # Arguments: $1 = manual name, $2 = Sphinx builder ('html' or 'man')
+     cpu->sve_vq_init |= 1 << (vq - 1);
-@@ -XXX,XX +XXX,XX @@ $(MANUAL_BUILDDIR)/interop/index.html: $(call manual-deps,interop)
+ }
  $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
      $(call build-manual,specs,html)
 +$(MANUAL_BUILDDIR)/system/index.html: $(call manual-deps,system)
 +    $(call build-manual,system,html)
 +
  $(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
      $(call build-manual,interop,man)
 diff --git a/docs/index.html.in b/docs/index.html.in
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/index.html.in
 +++ b/docs/index.html.in
@@ -XXX,XX +XXX,XX @@
              <li><a href="qemu-ga-ref.html">Guest Agent Protocol Reference</a></li>
              <li><a href="interop/index.html">System Emulation Management and Interoperability Guide</a></li>
              <li><a href="specs/index.html">System Emulation Guest Hardware Specifications</a></li>
 +            <li><a href="system/index.html">System Emulation User's Guide</a></li>
          </ul>
      </body>
  </html>
 diff --git a/docs/system/conf.py b/docs/system/conf.py
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/conf.py
@@ -XXX,XX +XXX,XX @@
 +# -*- coding: utf-8 -*-
 +#
 +# QEMU documentation build configuration file for the 'system' manual.
 +#
 +# This includes the top level conf file and then makes any necessary tweaks.
 +import sys
 +import os
 +
 +qemu_docdir = os.path.abspath("..")
 +parent_config = os.path.join(qemu_docdir, "conf.py")
 +exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 +
 +# This slightly misuses the 'description', but is the best way to get
 +# the manual title to appear in the sidebar.
 +html_theme_options['description'] = u'System Emulation User''s Guide'
 diff --git a/docs/system/index.rst b/docs/system/index.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/index.rst
@@ -XXX,XX +XXX,XX @@
 +.. This is the top level page for the 'system' manual.
 +
 +
 +QEMU System Emulation User's Guide
 +==================================
 +
 +This manual is the overall guide for users using QEMU
 +for full system emulation (as opposed to user-mode emulation).
 +This includes working with hypervisors such as KVM, Xen, Hax
 +or Hypervisor.Framework.
 +
 +Contents:
 +
 +.. toctree::
 +   :maxdepth: 2
 +
 --
-.20.1
+.25.1

-[PULL 11/20] target/arm/arch_dump: Add SVE notes
+[PULL 15/25] target/arm: Create ARMVQMap
-From: Andrew Jones <drjones@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-When dumping a guest with dump-guest-memory also dump the SVE
+Pull the three sve_vq_* values into a structure.
-registers if they are in use.
+This will be reused for SME.
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200120101832.18781-1-drjones@redhat.com
+Message-id: 20220620175235.60881-13-richard.henderson@linaro.org
 [PMM: fixed checkpatch nits]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/elf.h          |   1 +
+ target/arm/cpu.h    | 29 ++++++++++++++---------------
- target/arm/cpu.h       |  25 +++++++++
+ target/arm/cpu64.c  | 22 +++++++++++-----------
- target/arm/arch_dump.c | 124 ++++++++++++++++++++++++++++++++++++++++-
+ target/arm/helper.c |  2 +-
- target/arm/kvm64.c     |  24 --------
+ target/arm/kvm64.c  |  2 +-
-files changed, 148 insertions(+), 26 deletions(-)
+files changed, 27 insertions(+), 28 deletions(-)
-diff --git a/include/elf.h b/include/elf.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/elf.h
-+++ b/include/elf.h
-@@ -XXX,XX +XXX,XX @@ typedef struct elf64_shdr {
- #define NT_ARM_HW_BREAK 0x402           /* ARM hardware breakpoint registers */
- #define NT_ARM_HW_WATCH 0x403           /* ARM hardware watchpoint registers */
- #define NT_ARM_SYSTEM_CALL      0x404   /* ARM system call number */
-+#define NT_ARM_SVE      0x405           /* ARM Scalable Vector Extension regs */
- /*
-  * Physical entry point into the kernel.
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMPSCIState {
- void aarch64_sve_change_el(CPUARMState *env, int old_el,
-                            int new_el, bool el0_a64);
+ typedef struct ARMISARegisters ARMISARegisters;
- void aarch64_add_sve_properties(Object *obj);
 +/*
 + * In map, each set bit is a supported vector length of (bit-number + 1) * 16
 + * bytes, i.e. each bit number + 1 is the vector length in quadwords.
 + *
 + * While processing properties during initialization, corresponding init bits
 + * are set for bits in sve_vq_map that have been set by properties.
 + *
 + * Bits set in supported represent valid vector lengths for the CPU type.
 + */
 +typedef struct {
 +    uint32_t map, init, supported;
 +} ARMVQMap;
 +
-+/*
+ /**
-+ * SVE registers are encoded in KVM's memory in an endianness-invariant format.
+  * ARMCPU:
-+ * The byte at offset i from the start of the in-memory representation contains
+  * @env: #CPUARMState
-+ * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
-+ * lowest offsets are stored in the lowest memory addresses, then that nearly
+     uint32_t sve_default_vq;
-+ * matches QEMU's representation, which is to use an array of host-endian
+ #endif
-+ * uint64_t's, where the lower offsets are at the lower indices. To complete
-+ * the translation we just need to byte swap the uint64_t's on big-endian hosts.
+-    /*
-+ */
+-     * In sve_vq_map each set bit is a supported vector length of
-+static inline uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
+-     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
-+{
+-     * length in quadwords.
-+#ifdef HOST_WORDS_BIGENDIAN
+-     *
-+    int i;
+-     * While processing properties during initialization, corresponding
-+
+-     * sve_vq_init bits are set for bits in sve_vq_map that have been
-+    for (i = 0; i < nr; ++i) {
+-     * set by properties.
-+        dst[i] = bswap64(src[i]);
+-     *
-+    }
+-     * Bits set in sve_vq_supported represent valid vector lengths for
-+
+-     * the CPU type.
-+    return dst;
+-     */
-+#else
+-    uint32_t sve_vq_map;
-+    return src;
+-    uint32_t sve_vq_init;
-+#endif
+-    uint32_t sve_vq_supported;
-+}
++    ARMVQMap sve_vq;
-+
- #else
+     /* Generic timer counter frequency, in Hz */
- static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
+     uint64_t gt_cntfrq_hz;
- static inline void aarch64_sve_change_el(CPUARMState *env, int o,
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arch_dump.c
+--- a/target/arm/cpu64.c
-+++ b/target/arm/arch_dump.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ struct aarch64_user_vfp_state {
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
+      * any of the above.  Finally, if SVE is not disabled, then at least one
- QEMU_BUILD_BUG_ON(sizeof(struct aarch64_user_vfp_state) != 528);
+      * vector length must be enabled.
+      */
-+/* struct user_sve_header from arch/arm64/include/uapi/asm/ptrace.h */
+-    uint32_t vq_map = cpu->sve_vq_map;
-+struct aarch64_user_sve_header {
+-    uint32_t vq_init = cpu->sve_vq_init;
-+    uint32_t size;
++    uint32_t vq_map = cpu->sve_vq.map;
-+    uint32_t max_size;
++    uint32_t vq_init = cpu->sve_vq.init;
-+    uint16_t vl;
+     uint32_t vq_supported;
-+    uint16_t max_vl;
+     uint32_t vq_mask = 0;
-+    uint16_t flags;
+     uint32_t tmp, vq, max_vq = 0;
-+    uint16_t reserved;
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
-+} QEMU_PACKED;
+      */
-+
+     if (kvm_enabled()) {
- struct aarch64_note {
+         if (kvm_arm_sve_supported()) {
-     Elf64_Nhdr hdr;
+-            cpu->sve_vq_supported = kvm_arm_sve_get_vls(CPU(cpu));
-     char name[8]; /* align_up(sizeof("CORE"), 4) */
+-            vq_supported = cpu->sve_vq_supported;
-     union {
++            cpu->sve_vq.supported = kvm_arm_sve_get_vls(CPU(cpu));
-         struct aarch64_elf_prstatus prstatus;
++            vq_supported = cpu->sve_vq.supported;
-         struct aarch64_user_vfp_state vfp;
+         } else {
-+        struct aarch64_user_sve_header sve;
+             assert(!cpu_isar_feature(aa64_sve, cpu));
-     };
+             vq_supported = 0;
- } QEMU_PACKED;
+         }
+     } else {
-@@ -XXX,XX +XXX,XX @@ struct aarch64_note {
+-        vq_supported = cpu->sve_vq_supported;
-             (AARCH64_NOTE_HEADER_SIZE + sizeof(struct aarch64_elf_prstatus))
++        vq_supported = cpu->sve_vq.supported;
- #define AARCH64_PRFPREG_NOTE_SIZE \
+     }
-             (AARCH64_NOTE_HEADER_SIZE + sizeof(struct aarch64_user_vfp_state))
-+#define AARCH64_SVE_NOTE_SIZE(env) \
+     /*
-+            (AARCH64_NOTE_HEADER_SIZE + sve_size(env))
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
- static void aarch64_note_init(struct aarch64_note *note, DumpState *s,
+     /* From now on sve_max_vq is the actual maximum supported length. */
-                               const char *name, Elf64_Word namesz,
+     cpu->sve_max_vq = max_vq;
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+-    cpu->sve_vq_map = vq_map;
-     return 0;
++    cpu->sve_vq.map = vq_map;
  }
-+#ifdef TARGET_AARCH64
+ static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
-+static off_t sve_zreg_offset(uint32_t vq, int n)
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
-+{
+     if (!cpu_isar_feature(aa64_sve, cpu)) {
-+    off_t off = sizeof(struct aarch64_user_sve_header);
+         value = false;
-+    return ROUND_UP(off, 16) + vq * 16 * n;
+     } else {
-+}
+-        value = extract32(cpu->sve_vq_map, vq - 1, 1);
-+
++        value = extract32(cpu->sve_vq.map, vq - 1, 1);
 +static off_t sve_preg_offset(uint32_t vq, int n)
 +{
 +    return sve_zreg_offset(vq, 32) + vq * 16 / 8 * n;
 +}
 +
 +static off_t sve_fpsr_offset(uint32_t vq)
 +{
 +    off_t off = sve_preg_offset(vq, 17);
 +    return ROUND_UP(off, 16);
 +}
 +
 +static off_t sve_fpcr_offset(uint32_t vq)
 +{
 +    return sve_fpsr_offset(vq) + sizeof(uint32_t);
 +}
 +
 +static uint32_t sve_current_vq(CPUARMState *env)
 +{
 +    return sve_zcr_len_for_el(env, arm_current_el(env)) + 1;
 +}
 +
 +static size_t sve_size_vq(uint32_t vq)
 +{
 +    off_t off = sve_fpcr_offset(vq) + sizeof(uint32_t);
 +    return ROUND_UP(off, 16);
 +}
 +
 +static size_t sve_size(CPUARMState *env)
 +{
 +    return sve_size_vq(sve_current_vq(env));
 +}
 +
 +static int aarch64_write_elf64_sve(WriteCoreDumpFunction f,
 +                                   CPUARMState *env, int cpuid,
 +                                   DumpState *s)
 +{
 +    struct aarch64_note *note;
 +    ARMCPU *cpu = env_archcpu(env);
 +    uint32_t vq = sve_current_vq(env);
 +    uint64_t tmp[ARM_MAX_VQ * 2], *r;
 +    uint32_t fpr;
 +    uint8_t *buf;
 +    int ret, i;
 +
 +    note = g_malloc0(AARCH64_SVE_NOTE_SIZE(env));
 +    buf = (uint8_t *)&note->sve;
 +
 +    aarch64_note_init(note, s, "LINUX", 6, NT_ARM_SVE, sve_size_vq(vq));
 +
 +    note->sve.size = cpu_to_dump32(s, sve_size_vq(vq));
 +    note->sve.max_size = cpu_to_dump32(s, sve_size_vq(cpu->sve_max_vq));
 +    note->sve.vl = cpu_to_dump16(s, vq * 16);
 +    note->sve.max_vl = cpu_to_dump16(s, cpu->sve_max_vq * 16);
 +    note->sve.flags = cpu_to_dump16(s, 1);
 +
 +    for (i = 0; i < 32; ++i) {
 +        r = sve_bswap64(tmp, &env->vfp.zregs[i].d[0], vq * 2);
 +        memcpy(&buf[sve_zreg_offset(vq, i)], r, vq * 16);
 +    }
 +
 +    for (i = 0; i < 17; ++i) {
 +        r = sve_bswap64(tmp, r = &env->vfp.pregs[i].p[0],
 +                        DIV_ROUND_UP(vq * 2, 8));
 +        memcpy(&buf[sve_preg_offset(vq, i)], r, vq * 16 / 8);
 +    }
 +
 +    fpr = cpu_to_dump32(s, vfp_get_fpsr(env));
 +    memcpy(&buf[sve_fpsr_offset(vq)], &fpr, sizeof(uint32_t));
 +
 +    fpr = cpu_to_dump32(s, vfp_get_fpcr(env));
 +    memcpy(&buf[sve_fpcr_offset(vq)], &fpr, sizeof(uint32_t));
 +
 +    ret = f(note, AARCH64_SVE_NOTE_SIZE(env), s);
 +    g_free(note);
 +
 +    if (ret < 0) {
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +#endif
 +
  int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
                               int cpuid, void *opaque)
  {
      struct aarch64_note note;
 -    CPUARMState *env = &ARM_CPU(cs)->env;
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
      DumpState *s = opaque;
      uint64_t pstate, sp;
      int ret, i;
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
          return -1;
      }
+     visit_type_bool(v, name, &value, errp);
 -    return aarch64_write_elf64_prfpreg(f, env, cpuid, s);
 +    ret = aarch64_write_elf64_prfpreg(f, env, cpuid, s);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +#ifdef TARGET_AARCH64
 +    if (cpu_isar_feature(aa64_sve, cpu)) {
 +        ret = aarch64_write_elf64_sve(f, env, cpuid, s);
 +    }
 +#endif
 +
 +    return ret;
  }
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
- /* struct pt_regs from arch/arm/include/asm/ptrace.h */
+         return;
-@@ -XXX,XX +XXX,XX @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
+     }
-     if (class == ELFCLASS64) {
-         note_size = AARCH64_PRSTATUS_NOTE_SIZE;
+-    cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
-         note_size += AARCH64_PRFPREG_NOTE_SIZE;
+-    cpu->sve_vq_init |= 1 << (vq - 1);
-+#ifdef TARGET_AARCH64
++    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
-+        if (cpu_isar_feature(aa64_sve, cpu)) {
++    cpu->sve_vq.init |= 1 << (vq - 1);
-+            note_size += AARCH64_SVE_NOTE_SIZE(env);
+ }
-+        }
-+#endif
+ static bool cpu_arm_get_sve(Object *obj, Error **errp)
-     } else {
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-         note_size = ARM_PRSTATUS_NOTE_SIZE;
+     cpu->dcz_blocksize = 7; /*  512 bytes */
-         if (arm_feature(env, ARM_FEATURE_VFP)) {
+ #endif
 -    cpu->sve_vq_supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
 +    cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
      aarch64_add_pauth_properties(obj);
      aarch64_add_sve_properties(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
      /* The A64FX supports only 128, 256 and 512 bit vector lengths */
      aarch64_add_sve_properties(obj);
 -    cpu->sve_vq_supported = (1 << 0)  /* 128bit */
 +    cpu->sve_vq.supported = (1 << 0)  /* 128bit */
                            | (1 << 1)  /* 256bit */
                            | (1 << 3); /* 512bit */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
          len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
      }
 -    len = 31 - clz32(cpu->sve_vq_map & MAKE_64BIT_MASK(0, len + 1));
 +    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
      return len;
  }
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_fpsimd(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ uint32_t kvm_arm_sve_get_vls(CPUState *cs)
-     return 0;
+ static int kvm_arm_sve_set_vls(CPUState *cs)
- }
+ {
+     ARMCPU *cpu = ARM_CPU(cs);
--/*
+-    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq_map };
-- * SVE registers are encoded in KVM's memory in an endianness-invariant format.
++    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
-- * The byte at offset i from the start of the in-memory representation contains
+     struct kvm_one_reg reg = {
-- * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
+         .id = KVM_REG_ARM64_SVE_VLS,
-- * lowest offsets are stored in the lowest memory addresses, then that nearly
+         .addr = (uint64_t)&vls[0],
 - * matches QEMU's representation, which is to use an array of host-endian
 - * uint64_t's, where the lower offsets are at the lower indices. To complete
 - * the translation we just need to byte swap the uint64_t's on big-endian hosts.
 - */
 -static uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
 -{
 -#ifdef HOST_WORDS_BIGENDIAN
 -    int i;
 -
 -    for (i = 0; i < nr; ++i) {
 -        dst[i] = bswap64(src[i]);
 -    }
 -
 -    return dst;
 -#else
 -    return src;
 -#endif
 -}
 -
  /*
   * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
   * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
 --
-.20.1
+.25.1

-[PULL 20/20] hw/arm/exynos4210: Connect serial port DMA busy signals with pl330
+[PULL 16/25] target/arm: Generalize cpu_arm_{get,set}_vq
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-The Exynos4210 serial driver uses an interrupt line to signal if receive
+Rename from cpu_arm_{get,set}_sve_vq, and take the
-data is available. Connect that interrupt with the DMA controller's
+ARMVQMap as the opaque parameter.
 'peripheral busy' gpio pin to stop the DMA if there is no more receive
 data available. Without this patch, receive DMA runs wild and fills the
 entire receive DMA buffer with invalid data.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200123052540.6132-9-linux@roeck-us.net
+Message-id: 20220620175235.60881-14-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/exynos4210.c | 42 +++++++++++++++++++++++++++++-------------
+ target/arm/cpu64.c | 29 +++++++++++++++--------------
-file changed, 29 insertions(+), 13 deletions(-)
+file changed, 15 insertions(+), 14 deletions(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/target/arm/cpu64.c
-+++ b/hw/arm/exynos4210.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
+@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
      return (0x9 << ARM_AFF1_SHIFT) | cpu;
  }
--static void pl330_create(uint32_t base, qemu_or_irq *orgate, qemu_irq irq,
+ /*
--                         int nreq, int nevents, int width)
+- * Note that cpu_arm_get/set_sve_vq cannot use the simpler
-+static DeviceState *pl330_create(uint32_t base, qemu_or_irq *orgate,
+- * object_property_add_bool interface because they make use
-+                                 qemu_irq irq, int nreq, int nevents, int width)
+- * of the contents of "name" to determine which bit on which
 - * to operate.
 + * Note that cpu_arm_{get,set}_vq cannot use the simpler
 + * object_property_add_bool interface because they make use of the
 + * contents of "name" to determine which bit on which to operate.
   */
 -static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
 -                               void *opaque, Error **errp)
 +static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
 +                           void *opaque, Error **errp)
  {
-     SysBusDevice *busdev;
+     ARMCPU *cpu = ARM_CPU(obj);
-     DeviceState *dev;
++    ARMVQMap *vq_map = opaque;
-@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_or_irq *orgate, qemu_irq irq,
+     uint32_t vq = atoi(&name[3]) / 128;
-         sysbus_connect_irq(busdev, i, qdev_get_gpio_in(DEVICE(orgate), i));
+     bool value;
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
      if (!cpu_isar_feature(aa64_sve, cpu)) {
          value = false;
      } else {
 -        value = extract32(cpu->sve_vq.map, vq - 1, 1);
 +        value = extract32(vq_map->map, vq - 1, 1);
      }
-     qdev_connect_gpio_out(DEVICE(orgate), 0, irq);
+     visit_type_bool(v, name, &value, errp);
 +    return dev;
  }
- static void exynos4210_realize(DeviceState *socdev, Error **errp)
+-static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+-                               void *opaque, Error **errp)
-     MemoryRegion *system_mem = get_system_memory();
++static void cpu_arm_set_vq(Object *obj, Visitor *v, const char *name,
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
++                           void *opaque, Error **errp)
-     SysBusDevice *busdev;
+ {
--    DeviceState *dev;
+-    ARMCPU *cpu = ARM_CPU(obj);
-+    DeviceState *dev, *uart[4], *pl330[3];
++    ARMVQMap *vq_map = opaque;
-     int i, n;
+     uint32_t vq = atoi(&name[3]) / 128;
+     bool value;
-     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
+         return;
+     }
-     /*** UARTs ***/
--    exynos4210_uart_create(EXYNOS4210_UART0_BASE_ADDR,
+-    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
-+    uart[0] = exynos4210_uart_create(EXYNOS4210_UART0_BASE_ADDR,
+-    cpu->sve_vq.init |= 1 << (vq - 1);
-                            EXYNOS4210_UART0_FIFO_SIZE, 0, serial_hd(0),
++    vq_map->map = deposit32(vq_map->map, vq - 1, 1, value);
-                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 0)]);
++    vq_map->init |= 1 << (vq - 1);
 -    exynos4210_uart_create(EXYNOS4210_UART1_BASE_ADDR,
 +    uart[1] = exynos4210_uart_create(EXYNOS4210_UART1_BASE_ADDR,
                             EXYNOS4210_UART1_FIFO_SIZE, 1, serial_hd(1),
                    s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 1)]);
 -    exynos4210_uart_create(EXYNOS4210_UART2_BASE_ADDR,
 +    uart[2] = exynos4210_uart_create(EXYNOS4210_UART2_BASE_ADDR,
                             EXYNOS4210_UART2_FIFO_SIZE, 2, serial_hd(2),
                    s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 2)]);
 -    exynos4210_uart_create(EXYNOS4210_UART3_BASE_ADDR,
 +    uart[3] = exynos4210_uart_create(EXYNOS4210_UART3_BASE_ADDR,
                             EXYNOS4210_UART3_FIFO_SIZE, 3, serial_hd(3),
                    s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 3)]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
              s->irq_table[exynos4210_get_irq(28, 3)]);
      /*** DMA controllers ***/
 -    pl330_create(EXYNOS4210_PL330_BASE0_ADDR, &s->pl330_irq_orgate[0],
 -                 s->irq_table[exynos4210_get_irq(21, 0)], 32, 32, 32);
 -    pl330_create(EXYNOS4210_PL330_BASE1_ADDR, &s->pl330_irq_orgate[1],
 -                 s->irq_table[exynos4210_get_irq(21, 1)], 32, 32, 32);
 -    pl330_create(EXYNOS4210_PL330_BASE2_ADDR, &s->pl330_irq_orgate[2],
 -                 s->irq_table[exynos4210_get_irq(20, 1)], 1, 31, 64);
 +    pl330[0] = pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
 +                            &s->pl330_irq_orgate[0],
 +                            s->irq_table[exynos4210_get_irq(21, 0)],
 +                            32, 32, 32);
 +    pl330[1] = pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
 +                            &s->pl330_irq_orgate[1],
 +                            s->irq_table[exynos4210_get_irq(21, 1)],
 +                            32, 32, 32);
 +    pl330[2] = pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
 +                            &s->pl330_irq_orgate[2],
 +                            s->irq_table[exynos4210_get_irq(20, 1)],
 +                            1, 31, 64);
 +
 +    sysbus_connect_irq(SYS_BUS_DEVICE(uart[0]), 1,
 +                       qdev_get_gpio_in(pl330[0], 15));
 +    sysbus_connect_irq(SYS_BUS_DEVICE(uart[1]), 1,
 +                       qdev_get_gpio_in(pl330[1], 15));
 +    sysbus_connect_irq(SYS_BUS_DEVICE(uart[2]), 1,
 +                       qdev_get_gpio_in(pl330[0], 17));
 +    sysbus_connect_irq(SYS_BUS_DEVICE(uart[3]), 1,
 +                       qdev_get_gpio_in(pl330[1], 17));
  }
- static void exynos4210_init(Object *obj)
+ static bool cpu_arm_get_sve(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
  void aarch64_add_sve_properties(Object *obj)
  {
 +    ARMCPU *cpu = ARM_CPU(obj);
      uint32_t vq;
      object_property_add_bool(obj, "sve", cpu_arm_get_sve, cpu_arm_set_sve);
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
      for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
          char name[8];
          sprintf(name, "sve%d", vq * 128);
 -        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 -                            cpu_arm_set_sve_vq, NULL, NULL);
 +        object_property_add(obj, name, "bool", cpu_arm_get_vq,
 +                            cpu_arm_set_vq, NULL, &cpu->sve_vq);
      }
  #ifdef CONFIG_USER_ONLY
 --
-.20.1
+.25.1

-[PULL 14/20] hw/core/or-irq: Increase limit of or-lines to 48
+[PULL 17/25] target/arm: Generalize cpu_arm_{get, set}_default_vec_len
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-Exynos DMA requires up to 33 interrupt lines (32 event interrupts
+Rename from cpu_arm_{get,set}_sve_default_vec_len,
-plus abort interrupt), which all need to be wired together. Increase
+and take the pointer to default_vq from opaque.
 the maximum number of or-irq lines to 48 to support this configuration.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200123052540.6132-3-linux@roeck-us.net
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220620175235.60881-15-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/or-irq.h | 2 +-
+ target/arm/cpu64.c | 27 ++++++++++++++-------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 14 insertions(+), 13 deletions(-)
-diff --git a/include/hw/or-irq.h b/include/hw/or-irq.h
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/or-irq.h
+--- a/target/arm/cpu64.c
-+++ b/include/hw/or-irq.h
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
- /* This can safely be increased if necessary without breaking
-  * migration compatibility (as long as it remains greater than 15).
+ #ifdef CONFIG_USER_ONLY
-  */
+ /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
--#define MAX_OR_LINES      32
+-static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
-+#define MAX_OR_LINES      48
+-                                            const char *name, void *opaque,
+-                                            Error **errp)
- typedef struct OrIRQState qemu_or_irq;
++static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
 +                                        const char *name, void *opaque,
 +                                        Error **errp)
  {
 -    ARMCPU *cpu = ARM_CPU(obj);
 +    uint32_t *ptr_default_vq = opaque;
      int32_t default_len, default_vq, remainder;
      if (!visit_type_int32(v, name, &default_len, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
      /* Undocumented, but the kernel allows -1 to indicate "maximum". */
      if (default_len == -1) {
 -        cpu->sve_default_vq = ARM_MAX_VQ;
 +        *ptr_default_vq = ARM_MAX_VQ;
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
          return;
      }
 -    cpu->sve_default_vq = default_vq;
 +    *ptr_default_vq = default_vq;
  }
 -static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
 -                                            const char *name, void *opaque,
 -                                            Error **errp)
 +static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
 +                                        const char *name, void *opaque,
 +                                        Error **errp)
  {
 -    ARMCPU *cpu = ARM_CPU(obj);
 -    int32_t value = cpu->sve_default_vq * 16;
 +    uint32_t *ptr_default_vq = opaque;
 +    int32_t value = *ptr_default_vq * 16;
      visit_type_int32(v, name, &value, errp);
  }
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
  #ifdef CONFIG_USER_ONLY
      /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
      object_property_add(obj, "sve-default-vector-length", "int32",
 -                        cpu_arm_get_sve_default_vec_len,
 -                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
 +                        cpu_arm_get_default_vec_len,
 +                        cpu_arm_set_default_vec_len, NULL,
 +                        &cpu->sve_default_vq);
  #endif
  }
 --
-.20.1
+.25.1

-[PULL 13/20] dma/pl330: Convert to support tracing
+[PULL 18/25] target/arm: Move arm_cpu_*_finalize to internals.h
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-Replace debug logging code with tracing.
+Drop the aa32-only inline fallbacks,
 and just use a couple of ifdefs.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200123052540.6132-2-linux@roeck-us.net
+Message-id: 20220620175235.60881-16-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/pl330.c      | 88 ++++++++++++++++++++++++---------------------
+ target/arm/cpu.h       | 6 ------
- hw/dma/trace-events | 24 +++++++++++++
+ target/arm/internals.h | 3 +++
-files changed, 72 insertions(+), 40 deletions(-)
+ target/arm/cpu.c       | 2 ++
 files changed, 5 insertions(+), 6 deletions(-)
-diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/pl330.c
+--- a/target/arm/cpu.h
-+++ b/hw/dma/pl330.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct {
- #include "sysemu/dma.h"
- #include "qemu/log.h"
+ #ifdef TARGET_AARCH64
- #include "qemu/module.h"
+ # define ARM_MAX_VQ    16
-+#include "trace.h"
+-void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+-void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
- #ifndef PL330_ERR_DEBUG
+-void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
- #define PL330_ERR_DEBUG 0
+ #else
  # define ARM_MAX_VQ    1
 -static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
 -static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
 -static inline void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp) { }
  #endif
--#define DB_PRINT_L(lvl, fmt, args...) do {\
+ typedef struct ARMVectorReg {
--    if (PL330_ERR_DEBUG >= lvl) {\
+diff --git a/target/arm/internals.h b/target/arm/internals.h
--        fprintf(stderr, "PL330: %s:" fmt, __func__, ## args);\
+index XXXXXXX..XXXXXXX 100644
--    } \
+--- a/target/arm/internals.h
--} while (0)
++++ b/target/arm/internals.h
--
+@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
--#define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
+ int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
--
+ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
- #define PL330_PERIPH_NUM            32
+ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
- #define PL330_MAX_BURST_LEN         128
++void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
- #define PL330_INSN_MAXSIZE          6
++void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
-@@ -XXX,XX +XXX,XX @@ typedef struct PL330InsnDesc {
++void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
-     void (*exec)(PL330Chan *, uint8_t opcode, uint8_t *args, int len);
+ #endif
- } PL330InsnDesc;
+ #ifdef CONFIG_USER_ONLY
-+static void pl330_hexdump(uint8_t *buf, size_t size)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-+{
+index XXXXXXX..XXXXXXX 100644
-+    unsigned int b, i, len;
+--- a/target/arm/cpu.c
-+    char tmpbuf[80];
++++ b/target/arm/cpu.c
-+
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
 +    for (b = 0; b < size; b += 16) {
 +        len = size - b;
 +        if (len > 16) {
 +            len = 16;
 +        }
 +        tmpbuf[0] = '\0';
 +        for (i = 0; i < len; i++) {
 +            if ((i % 4) == 0) {
 +                strcat(tmpbuf, " ");
 +            }
 +            sprintf(tmpbuf + strlen(tmpbuf), " %02x", buf[b + i]);
 +        }
 +        trace_pl330_hexdump(b, tmpbuf);
 +    }
 +}
  /* MFIFO Implementation
   *
@@ -XXX,XX +XXX,XX @@ static inline void pl330_queue_remove_tagged(PL330Queue *s, uint8_t tag)
  static inline void pl330_fault(PL330Chan *ch, uint32_t flags)
  {
--    DB_PRINT("ch: %p, flags: %" PRIx32 "\n", ch, flags);
+     Error *local_err = NULL;
-+    trace_pl330_fault(ch, flags);
-     ch->fault_type |= flags;
++#ifdef TARGET_AARCH64
-     if (ch->state == pl330_chan_fault) {
+     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-         return;
+         arm_cpu_sve_finalize(cpu, &local_err);
-@@ -XXX,XX +XXX,XX @@ static inline void pl330_fault(PL330Chan *ch, uint32_t flags)
+         if (local_err != NULL) {
-     ch->state = pl330_chan_fault;
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
      ch->parent->num_faulting++;
      if (ch->parent->num_faulting == 1) {
 -        DB_PRINT("abort interrupt raised\n");
 +        trace_pl330_fault_abort();
          qemu_irq_raise(ch->parent->irq_abort);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmaend(PL330Chan *ch, uint8_t opcode,
              return;
          }
      }
--    DB_PRINT("DMA ending!\n");
++#endif
-+    trace_pl330_dmaend();
-     pl330_fifo_tagged_remove(&s->fifo, ch->tag);
+     if (kvm_enabled()) {
-     pl330_queue_remove_tagged(&s->read_queue, ch->tag);
+         kvm_arm_steal_time_finalize(cpu, &local_err);
      pl330_queue_remove_tagged(&s->write_queue, ch->tag);
@@ -XXX,XX +XXX,XX @@ static void pl330_dmago(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
      uint32_t pc;
      PL330Chan *s;
 -    DB_PRINT("\n");
 +    trace_pl330_dmago();
      if (!ch->is_manager) {
          pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
@@ -XXX,XX +XXX,XX @@ static void pl330_dmald(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
      ch->stall = pl330_queue_put_insn(&ch->parent->read_queue, ch->src,
                                      size, num, inc, 0, ch->tag);
      if (!ch->stall) {
 -        DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
 -                 " num:%" PRId32 " %c\n",
 -                 ch->tag, ch->src, size, num, inc ? 'Y' : 'N');
 +        trace_pl330_dmald(ch->tag, ch->src, size, num, inc ? 'Y' : 'N');
          ch->src += inc ? size * num - (ch->src & (size - 1)) : 0;
      }
  }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmakill(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
          ch->fault_type = 0;
          ch->parent->num_faulting--;
          if (ch->parent->num_faulting == 0) {
 -            DB_PRINT("abort interrupt lowered\n");
 +            trace_pl330_dmakill();
              qemu_irq_lower(ch->parent->irq_abort);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmalpend(PL330Chan *ch, uint8_t opcode,
      uint8_t bs = opcode & 3;
      uint8_t lc = (opcode & 4) >> 2;
 +    trace_pl330_dmalpend(nf, bs, lc, ch->lc[lc], ch->request_flag);
 +
      if (bs == 2) {
          pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
          return;
@@ -XXX,XX +XXX,XX @@ static void pl330_dmalpend(PL330Chan *ch, uint8_t opcode,
          if (nf) {
              ch->lc[lc]--;
          }
 -        DB_PRINT("loop reiteration\n");
 +        trace_pl330_dmalpiter();
          ch->pc -= args[0];
          ch->pc -= len + 1;
          /* "ch->pc -= args[0] + len + 1" is incorrect when args[0] == 256 */
      } else {
 -        DB_PRINT("loop fallthrough\n");
 +        trace_pl330_dmalpfallthrough();
      }
  }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmasev(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
      }
      if (ch->parent->inten & (1 << ev_id)) {
          ch->parent->int_status |= (1 << ev_id);
 -        DB_PRINT("event interrupt raised %" PRId8 "\n", ev_id);
 +        trace_pl330_dmasev_evirq(ev_id);
          qemu_irq_raise(ch->parent->irq[ev_id]);
      }
 -    DB_PRINT("event raised %" PRId8 "\n", ev_id);
 +    trace_pl330_dmasev_event(ev_id);
      ch->parent->ev_status |= (1 << ev_id);
  }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmast(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
      ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
                                      size, num, inc, 0, ch->tag);
      if (!ch->stall) {
 -        DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
 -                 " num:%" PRId32 " %c\n",
 -                 ch->tag, ch->dst, size, num, inc ? 'Y' : 'N');
 +        trace_pl330_dmast(ch->tag, ch->dst, size, num, inc ? 'Y' : 'N');
          ch->dst += inc ? size * num - (ch->dst & (size - 1)) : 0;
      }
  }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmawfe(PL330Chan *ch, uint8_t opcode,
              }
          }
          ch->parent->ev_status &= ~(1 << ev_id);
 -        DB_PRINT("event lowered %" PRIx8 "\n", ev_id);
 +        trace_pl330_dmawfe(ev_id);
      } else {
          ch->stall = 1;
      }
@@ -XXX,XX +XXX,XX @@ static int pl330_chan_exec(PL330Chan *ch)
      ch->stall = 0;
      insn = pl330_fetch_insn(ch);
      if (!insn) {
 -        DB_PRINT("pl330 undefined instruction\n");
 +        trace_pl330_chan_exec_undef();
          pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static int pl330_exec_cycle(PL330Chan *channel)
          int len = q->len - (q->addr & (q->len - 1));
          dma_memory_read(&address_space_memory, q->addr, buf, len);
 -        if (PL330_ERR_DEBUG > 1) {
 -            DB_PRINT("PL330 read from memory @%08" PRIx32 " (size = %08x):\n",
 -                      q->addr, len);
 -            qemu_hexdump((char *)buf, stderr, "", len);
 +        trace_pl330_exec_cycle(q->addr, len);
 +        if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP)) {
 +            pl330_hexdump(buf, len);
          }
          fifo_res = pl330_fifo_push(&s->fifo, buf, len, q->tag);
          if (fifo_res == PL330_FIFO_OK) {
@@ -XXX,XX +XXX,XX @@ static int pl330_exec_cycle(PL330Chan *channel)
          }
          if (fifo_res == PL330_FIFO_OK || q->z) {
              dma_memory_write(&address_space_memory, q->addr, buf, len);
 -            if (PL330_ERR_DEBUG > 1) {
 -                DB_PRINT("PL330 read from memory @%08" PRIx32
 -                         " (size = %08x):\n", q->addr, len);
 -                qemu_hexdump((char *)buf, stderr, "", len);
 +            trace_pl330_exec_cycle(q->addr, len);
 +            if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP)) {
 +                pl330_hexdump(buf, len);
              }
              if (q->inc) {
                  q->addr += len;
@@ -XXX,XX +XXX,XX @@ static int pl330_exec_channel(PL330Chan *channel)
  static inline void pl330_exec(PL330State *s)
  {
 -    DB_PRINT("\n");
      int i, insr_exec;
 +    trace_pl330_exec();
      do {
          insr_exec = pl330_exec_channel(&s->manager);
@@ -XXX,XX +XXX,XX @@ static void pl330_debug_exec(PL330State *s)
      args[2] = (s->dbg[1] >>  8) & 0xff;
      args[3] = (s->dbg[1] >> 16) & 0xff;
      args[4] = (s->dbg[1] >> 24) & 0xff;
 -    DB_PRINT("chan id: %" PRIx8 "\n", chan_id);
 +    trace_pl330_debug_exec(chan_id);
      if (s->dbg[0] & 1) {
          ch = &s->chan[chan_id];
      } else {
@@ -XXX,XX +XXX,XX @@ static void pl330_debug_exec(PL330State *s)
          ch->fault_type |= PL330_FAULT_DBG_INSTR;
      }
      if (ch->stall) {
 +        trace_pl330_debug_exec_stall();
          qemu_log_mask(LOG_UNIMP, "pl330: stall of debug instruction not "
                        "implemented\n");
      }
@@ -XXX,XX +XXX,XX @@ static void pl330_iomem_write(void *opaque, hwaddr offset,
      PL330State *s = (PL330State *) opaque;
      int i;
 -    DB_PRINT("addr: %08x data: %08x\n", (unsigned)offset, (unsigned)value);
 +    trace_pl330_iomem_write((unsigned)offset, (unsigned)value);
      switch (offset) {
      case PL330_REG_INTEN:
@@ -XXX,XX +XXX,XX @@ static void pl330_iomem_write(void *opaque, hwaddr offset,
      case PL330_REG_INTCLR:
          for (i = 0; i < s->num_events; i++) {
              if (s->int_status & s->inten & value & (1 << i)) {
 -                DB_PRINT("event interrupt lowered %d\n", i);
 +                trace_pl330_iomem_write_clr(i);
                  qemu_irq_lower(s->irq[i]);
              }
          }
@@ -XXX,XX +XXX,XX @@ static void pl330_iomem_write(void *opaque, hwaddr offset,
          }
          break;
      case PL330_REG_DBGINST0:
 -        DB_PRINT("s->dbg[0] = %08x\n", (unsigned)value);
          s->dbg[0] = value;
          break;
      case PL330_REG_DBGINST1:
 -        DB_PRINT("s->dbg[1] = %08x\n", (unsigned)value);
          s->dbg[1] = value;
          break;
      default:
@@ -XXX,XX +XXX,XX @@ static uint64_t pl330_iomem_read(void *opaque, hwaddr offset,
          unsigned size)
  {
      uint32_t ret = pl330_iomem_read_imp(opaque, offset);
 -    DB_PRINT("addr: %08" HWADDR_PRIx " data: %08" PRIx32 "\n", offset, ret);
 +    trace_pl330_iomem_read((uint32_t)offset, ret);
      return ret;
  }
 diff --git a/hw/dma/trace-events b/hw/dma/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/dma/trace-events
 +++ b/hw/dma/trace-events
@@ -XXX,XX +XXX,XX @@ sparc32_dma_enable_lower(void) "Lower DMA enable"
  # i8257.c
  i8257_unregistered_dma(int nchan, int dma_pos, int dma_len) "unregistered DMA channel used nchan=%d dma_pos=%d dma_len=%d"
 +
 +# pl330.c
 +pl330_fault(void *ptr, uint32_t flags) "ch: %p, flags: 0x%"PRIx32
 +pl330_fault_abort(void) "abort interrupt raised"
 +pl330_dmaend(void) "DMA ending"
 +pl330_dmago(void) "DMA run"
 +pl330_dmald(uint32_t chan, uint32_t addr, uint32_t size, uint32_t num, uint32_t ch) "channel:%"PRId8" address:0x%08"PRIx32" size:0x%"PRIx32" num:%"PRId32"%c"
 +pl330_dmakill(void) "abort interrupt lowered"
 +pl330_dmalpend(uint8_t nf, uint8_t bs, uint8_t lc, uint8_t ch, uint8_t flag) "nf=0x%02x bs=0x%02x lc=0x%02x ch=0x%02x flag=0x%02x"
 +pl330_dmalpiter(void) "loop reiteration"
 +pl330_dmalpfallthrough(void) "loop fallthrough"
 +pl330_dmasev_evirq(uint8_t ev_id) "event interrupt raised %"PRId8
 +pl330_dmasev_event(uint8_t ev_id) "event raised %"PRId8
 +pl330_dmast(uint32_t chn, uint32_t addr, uint32_t sz, uint32_t num, uint32_t c) "channel:%"PRId8" address:0x%08"PRIx32" size:0x%"PRIx32" num:%"PRId32" %c"
 +pl330_dmawfe(uint8_t ev_id) "event lowered 0x%"PRIx8
 +pl330_chan_exec_undef(void) "undefined instruction"
 +pl330_exec_cycle(uint32_t addr, uint32_t size) "PL330 read from memory @0x%08"PRIx32" (size = 0x%08"PRIx32")"
 +pl330_hexdump(uint32_t offset, char *str) " 0x%04"PRIx32":%s"
 +pl330_exec(void) "pl330_exec"
 +pl330_debug_exec(uint8_t ch) "chan id: 0x%"PRIx8
 +pl330_debug_exec_stall(void) "stall of debug instruction not implemented"
 +pl330_iomem_write(uint32_t offset, uint32_t value) "addr: 0x%08"PRIx32" data: 0x%08"PRIx32
 +pl330_iomem_write_clr(int i) "event interrupt lowered %d"
 +pl330_iomem_read(uint32_t addr, uint32_t data) "addr: 0x%08"PRIx32" data: 0x%08"PRIx32
 --
-.20.1
+.25.1

-[PULL 12/20] hw/misc/stm32f4xx_syscfg: Fix copy/paste error
+[PULL 19/25] target/arm: Unexport aarch64_add_*_properties
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Missed in 870c034da0b, hopefully reported by Coverity.
+These functions are not used outside cpu64.c,
 so make them static.
-Fixes: Coverity CID 1412793 (Incorrect expression)
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20220620175235.60881-17-richard.henderson@linaro.org
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20200121213853.9601-1-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/stm32f4xx_syscfg.c | 2 +-
+ target/arm/cpu.h   | 3 ---
-file changed, 1 insertion(+), 1 deletion(-)
+ target/arm/cpu64.c | 4 ++--
 files changed, 2 insertions(+), 5 deletions(-)
-diff --git a/hw/misc/stm32f4xx_syscfg.c b/hw/misc/stm32f4xx_syscfg.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/stm32f4xx_syscfg.c
+--- a/target/arm/cpu.h
-+++ b/hw/misc/stm32f4xx_syscfg.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void stm32f4xx_syscfg_set_irq(void *opaque, int irq, int level)
+@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-     STM32F4xxSyscfgState *s = opaque;
+ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
-     int icrreg = irq / 4;
+ void aarch64_sve_change_el(CPUARMState *env, int old_el,
-     int startbit = (irq & 3) * 4;
+                            int new_el, bool el0_a64);
--    uint8_t config = config = irq / 16;
+-void aarch64_add_sve_properties(Object *obj);
-+    uint8_t config = irq / 16;
+-void aarch64_add_pauth_properties(Object *obj);
+ void arm_reset_sve_state(CPUARMState *env);
-     trace_stm32f4xx_syscfg_set_irq(irq / 16, irq % 16, level);
  /*
@@ -XXX,XX +XXX,XX @@ static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
  static inline void aarch64_sve_change_el(CPUARMState *env, int o,
                                           int n, bool a)
  { }
 -static inline void aarch64_add_sve_properties(Object *obj) { }
  #endif
  void aarch64_sync_32_to_64(CPUARMState *env);
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
  }
  #endif
 -void aarch64_add_sve_properties(Object *obj)
 +static void aarch64_add_sve_properties(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
      uint32_t vq;
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pauth_property =
  static Property arm_cpu_pauth_impdef_property =
      DEFINE_PROP_BOOL("pauth-impdef", ARMCPU, prop_pauth_impdef, false);
 -void aarch64_add_pauth_properties(Object *obj)
 +static void aarch64_add_pauth_properties(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
 --
-.20.1
+.25.1

-[PULL 03/20] tests/tcg/aarch64: Fix compilation parameters for pauth-%
+[PULL 20/25] target/arm: Add cpu properties for SME
 From: Richard Henderson <richard.henderson@linaro.org>
-We were incorrectly requiring ARMv8.4 support for the pauth
+Mirror the properties for SVE.  The main difference is
-tests, but Pointer Authentication is an ARMv8.3 extension.
+that any arbitrary set of powers of 2 may be supported,
-Further, hiding the required architecture within asm() is
+and not the stricter constraints that apply to SVE.
 not correct.
-Correct the architecture version requested, and specify it
+Include a property to control FEAT_SME_FA64, as failing
-in the cflags of the (cross-) compiler rather than in the asm.
+to restrict the runtime to the proper subset of insns
 could be a major point for bugs.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200116230809.19078-3-richard.henderson@linaro.org
+Message-id: 20220620175235.60881-18-richard.henderson@linaro.org
 [PMM: tweaked commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/tcg/aarch64/Makefile.target | 1 +
+ docs/system/arm/cpu-features.rst |  56 +++++++++++++++
- tests/tcg/aarch64/pauth-1.c       | 2 --
+ target/arm/cpu.h                 |   2 +
- tests/tcg/aarch64/pauth-2.c       | 2 --
+ target/arm/internals.h           |   1 +
-files changed, 1 insertion(+), 4 deletions(-)
+ target/arm/cpu.c                 |  14 +++-
  target/arm/cpu64.c               | 114 +++++++++++++++++++++++++++++--
 files changed, 180 insertions(+), 7 deletions(-)
-diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/aarch64/Makefile.target
+--- a/docs/system/arm/cpu-features.rst
-+++ b/tests/tcg/aarch64/Makefile.target
++++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
+@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
- # Pauth Tests
+ lengths is to explicitly enable each desired length.  Therefore only
- AARCH64_TESTS += pauth-1 pauth-2
+ example's (1), (4), and (6) exhibit recommended uses of the properties.
- run-pauth-%: QEMU_OPTS += -cpu max
-+pauth-%: CFLAGS += -march=armv8.3-a
++SME CPU Property Examples
++-------------------------
- # Semihosting smoke test for linux-user
++
- AARCH64_TESTS += semihosting
++  1) Disable SME::
-diff --git a/tests/tcg/aarch64/pauth-1.c b/tests/tcg/aarch64/pauth-1.c
++
-index XXXXXXX..XXXXXXX 100644
++     $ qemu-system-aarch64 -M virt -cpu max,sme=off
---- a/tests/tcg/aarch64/pauth-1.c
++
-+++ b/tests/tcg/aarch64/pauth-1.c
++  2) Implicitly enable all vector lengths for the ``max`` CPU type::
-@@ -XXX,XX +XXX,XX @@
++
- #include <sys/prctl.h>
++     $ qemu-system-aarch64 -M virt -cpu max
- #include <stdio.h>
++
++  3) Only enable the 256-bit vector length::
--asm(".arch armv8.4-a");
++
--
++     $ qemu-system-aarch64 -M virt -cpu max,sme256=on
- #ifndef PR_PAC_RESET_KEYS
++
- #define PR_PAC_RESET_KEYS  54
++  3) Enable the 256-bit and 1024-bit vector lengths::
- #define PR_PAC_APDAKEY     (1 << 2)
++
-diff --git a/tests/tcg/aarch64/pauth-2.c b/tests/tcg/aarch64/pauth-2.c
++     $ qemu-system-aarch64 -M virt -cpu max,sme256=on,sme1024=on
-index XXXXXXX..XXXXXXX 100644
++
---- a/tests/tcg/aarch64/pauth-2.c
++  4) Disable the 512-bit vector length.  This results in all the other
-+++ b/tests/tcg/aarch64/pauth-2.c
++     lengths supported by ``max`` defaulting to enabled
-@@ -XXX,XX +XXX,XX @@
++     (128, 256, 1024 and 2048)::
- #include <stdint.h>
++
- #include <assert.h>
++     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
++
--asm(".arch armv8.4-a");
+ SVE User-mode Default Vector Length Property
--
+ --------------------------------------------
- void do_test(uint64_t value)
@@ -XXX,XX +XXX,XX @@ length supported by QEMU is 256.
  If this property is set to ``-1`` then the default vector length
  is set to the maximum possible length.
 +
 +SME CPU Properties
 +==================
 +
 +The SME CPU properties are much like the SVE properties: ``sme`` is
 +used to enable or disable the entire SME feature, and ``sme<N>`` is
 +used to enable or disable specific vector lengths.  Finally,
 +``sme_fa64`` is used to enable or disable ``FEAT_SME_FA64``, which
 +allows execution of the "full a64" instruction set while Streaming
 +SVE mode is enabled.
 +
 +SME is not supported by KVM at this time.
 +
 +At least one vector length must be enabled when ``sme`` is enabled,
 +and all vector lengths must be powers of 2.  The maximum vector
 +length supported by qemu is 2048 bits.  Otherwise, there are no
 +additional constraints on the set of vector lengths supported by SME.
 +
 +SME User-mode Default Vector Length Property
 +--------------------------------------------
 +
 +For qemu-aarch64, the cpu propery ``sme-default-vector-length=N`` is
 +defined to mirror the Linux kernel parameter file
 +``/proc/sys/abi/sme_default_vector_length``.  The default length, ``N``,
 +is in units of bytes and must be between 16 and 8192.
 +If not specified, the default vector length is 32.
 +
 +As with ``sve-default-vector-length``, if the default length is larger
 +than the maximum vector length enabled, the actual vector length will
 +be reduced.  If this property is set to ``-1`` then the default vector
 +length is set to the maximum possible length.
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
  #ifdef CONFIG_USER_ONLY
      /* Used to set the default vector length at process start. */
      uint32_t sve_default_vq;
 +    uint32_t sme_default_vq;
  #endif
      ARMVQMap sve_vq;
 +    ARMVQMap sme_vq;
      /* Generic timer counter frequency, in Hz */
      uint64_t gt_cntfrq_hz;
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
  int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
  int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
  void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
 +void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
  void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
  void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
  #endif
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
  #ifdef CONFIG_USER_ONLY
  # ifdef TARGET_AARCH64
      /*
 -     * The linux kernel defaults to 512-bit vectors, when sve is supported.
 -     * See documentation for /proc/sys/abi/sve_default_vector_length, and
 -     * our corresponding sve-default-vector-length cpu property.
 +     * The linux kernel defaults to 512-bit for SVE, and 256-bit for SME.
 +     * These values were chosen to fit within the default signal frame.
 +     * See documentation for /proc/sys/abi/{sve,sme}_default_vector_length,
 +     * and our corresponding cpu property.
       */
      cpu->sve_default_vq = 4;
 +    cpu->sme_default_vq = 2;
  # endif
  #else
      /* Our inbound IRQ and FIQ lines */
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
              return;
          }
 +        arm_cpu_sme_finalize(cpu, &local_err);
 +        if (local_err != NULL) {
 +            error_propagate(errp, local_err);
 +            return;
 +        }
 +
          arm_cpu_pauth_finalize(cpu, &local_err);
          if (local_err != NULL) {
              error_propagate(errp, local_err);
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
      ARMCPU *cpu = ARM_CPU(obj);
      ARMVQMap *vq_map = opaque;
      uint32_t vq = atoi(&name[3]) / 128;
 +    bool sve = vq_map == &cpu->sve_vq;
      bool value;
 -    /* All vector lengths are disabled when SVE is off. */
 -    if (!cpu_isar_feature(aa64_sve, cpu)) {
 +    /* All vector lengths are disabled when feature is off. */
 +    if (sve
 +        ? !cpu_isar_feature(aa64_sve, cpu)
 +        : !cpu_isar_feature(aa64_sme, cpu)) {
          value = false;
      } else {
          value = extract32(vq_map->map, vq - 1, 1);
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
      cpu->isar.id_aa64pfr0 = t;
  }
 +void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
 +{
 +    uint32_t vq_map = cpu->sme_vq.map;
 +    uint32_t vq_init = cpu->sme_vq.init;
 +    uint32_t vq_supported = cpu->sme_vq.supported;
 +    uint32_t vq;
 +
 +    if (vq_map == 0) {
 +        if (!cpu_isar_feature(aa64_sme, cpu)) {
 +            cpu->isar.id_aa64smfr0 = 0;
 +            return;
 +        }
 +
 +        /* TODO: KVM will require limitations via SMCR_EL2. */
 +        vq_map = vq_supported & ~vq_init;
 +
 +        if (vq_map == 0) {
 +            vq = ctz32(vq_supported) + 1;
 +            error_setg(errp, "cannot disable sme%d", vq * 128);
 +            error_append_hint(errp, "All SME vector lengths are disabled.\n");
 +            error_append_hint(errp, "With SME enabled, at least one "
 +                              "vector length must be enabled.\n");
 +            return;
 +        }
 +    } else {
 +        if (!cpu_isar_feature(aa64_sme, cpu)) {
 +            vq = 32 - clz32(vq_map);
 +            error_setg(errp, "cannot enable sme%d", vq * 128);
 +            error_append_hint(errp, "SME must be enabled to enable "
 +                              "vector lengths.\n");
 +            error_append_hint(errp, "Add sme=on to the CPU property list.\n");
 +            return;
 +        }
 +        /* TODO: KVM will require limitations via SMCR_EL2. */
 +    }
 +
 +    cpu->sme_vq.map = vq_map;
 +}
 +
 +static bool cpu_arm_get_sme(Object *obj, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    return cpu_isar_feature(aa64_sme, cpu);
 +}
 +
 +static void cpu_arm_set_sme(Object *obj, bool value, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    uint64_t t;
 +
 +    t = cpu->isar.id_aa64pfr1;
 +    t = FIELD_DP64(t, ID_AA64PFR1, SME, value);
 +    cpu->isar.id_aa64pfr1 = t;
 +}
 +
 +static bool cpu_arm_get_sme_fa64(Object *obj, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    return cpu_isar_feature(aa64_sme, cpu) &&
 +           cpu_isar_feature(aa64_sme_fa64, cpu);
 +}
 +
 +static void cpu_arm_set_sme_fa64(Object *obj, bool value, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    uint64_t t;
 +
 +    t = cpu->isar.id_aa64smfr0;
 +    t = FIELD_DP64(t, ID_AA64SMFR0, FA64, value);
 +    cpu->isar.id_aa64smfr0 = t;
 +}
 +
  #ifdef CONFIG_USER_ONLY
 -/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
 +/* Mirror linux /proc/sys/abi/{sve,sme}_default_vector_length. */
  static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
                                          const char *name, void *opaque,
                                          Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
       * and is the maximum architectural width of ZCR_ELx.LEN.
       */
      if (remainder || default_vq < 1 || default_vq > 512) {
 -        error_setg(errp, "cannot set sve-default-vector-length");
 +        ARMCPU *cpu = ARM_CPU(obj);
 +        const char *which =
 +            (ptr_default_vq == &cpu->sve_default_vq ? "sve" : "sme");
 +
 +        error_setg(errp, "cannot set %s-default-vector-length", which);
          if (remainder) {
              error_append_hint(errp, "Vector length not a multiple of 16\n");
          } else if (default_vq < 1) {
@@ -XXX,XX +XXX,XX @@ static void aarch64_add_sve_properties(Object *obj)
  #endif
  }
 +static void aarch64_add_sme_properties(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    uint32_t vq;
 +
 +    object_property_add_bool(obj, "sme", cpu_arm_get_sme, cpu_arm_set_sme);
 +    object_property_add_bool(obj, "sme_fa64", cpu_arm_get_sme_fa64,
 +                             cpu_arm_set_sme_fa64);
 +
 +    for (vq = 1; vq <= ARM_MAX_VQ; vq <<= 1) {
 +        char name[8];
 +        sprintf(name, "sme%d", vq * 128);
 +        object_property_add(obj, name, "bool", cpu_arm_get_vq,
 +                            cpu_arm_set_vq, NULL, &cpu->sme_vq);
 +    }
 +
 +#ifdef CONFIG_USER_ONLY
 +    /* Mirror linux /proc/sys/abi/sme_default_vector_length. */
 +    object_property_add(obj, "sme-default-vector-length", "int32",
 +                        cpu_arm_get_default_vec_len,
 +                        cpu_arm_set_default_vec_len, NULL,
 +                        &cpu->sme_default_vq);
 +#endif
 +}
 +
  void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
  {
-     uint64_t salt1, salt2;
+     int arch_val = 0, impdef_val = 0;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
  #endif
      cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
 +    cpu->sme_vq.supported = SVE_VQ_POW2_MAP;
      aarch64_add_pauth_properties(obj);
      aarch64_add_sve_properties(obj);
 +    aarch64_add_sme_properties(obj);
      object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                          cpu_max_set_sve_max_vq, NULL, NULL);
      qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 --
-.20.1
+.25.1

-[PULL 05/20] tests/tcg/aarch64: Add pauth-4
+[PULL 21/25] target/arm: Introduce sve_vqm1_for_el_sm
 From: Richard Henderson <richard.henderson@linaro.org>
-Perform the set of operations and test described in LP 1859713.
+When Streaming SVE mode is enabled, the size is taken from
 SMCR_ELx instead of ZCR_ELx.  The format is shared, but the
 set of vector lengths is not.  Further, Streaming SVE does
 not require any particular length to be supported.
-Suggested-by: Adrien GRASSEIN <adrien.grassein@smile.fr>
+Adjust sve_vqm1_for_el to pass the current value of PSTATE.SM
 to the new function.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200116230809.19078-5-richard.henderson@linaro.org
+Message-id: 20220620175235.60881-19-richard.henderson@linaro.org
 [PMM: fixed hard-coded tabs]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/tcg/aarch64/Makefile.target |  2 +-
+ target/arm/cpu.h    |  9 +++++++--
- tests/tcg/aarch64/pauth-4.c       | 25 +++++++++++++++++++++++++
+ target/arm/helper.c | 32 +++++++++++++++++++++++++-------
-files changed, 26 insertions(+), 1 deletion(-)
+files changed, 32 insertions(+), 9 deletions(-)
  create mode 100644 tests/tcg/aarch64/pauth-4.c
-diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/aarch64/Makefile.target
+--- a/target/arm/cpu.h
-+++ b/tests/tcg/aarch64/Makefile.target
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
+@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int cur_el);
-     $(call diff-out,$<,$(AARCH64_SRC)/fcvt.ref)
+ int sme_exception_el(CPUARMState *env, int cur_el);
- # Pauth Tests
+ /**
--AARCH64_TESTS += pauth-1 pauth-2
+- * sve_vqm1_for_el:
-+AARCH64_TESTS += pauth-1 pauth-2 pauth-4
++ * sve_vqm1_for_el_sm:
- run-pauth-%: QEMU_OPTS += -cpu max
+  * @env: CPUARMState
- pauth-%: CFLAGS += -march=armv8.3-a
+  * @el: exception level
++ * @sm: streaming mode
-diff --git a/tests/tcg/aarch64/pauth-4.c b/tests/tcg/aarch64/pauth-4.c
+  *
-new file mode 100644
+- * Compute the current SVE vector length for @el, in units of
-index XXXXXXX..XXXXXXX
++ * Compute the current vector length for @el & @sm, in units of
---- /dev/null
+  * Quadwords Minus 1 -- the same scale used for ZCR_ELx.LEN.
-+++ b/tests/tcg/aarch64/pauth-4.c
++ * If @sm, compute for SVL, otherwise NVL.
-@@ -XXX,XX +XXX,XX @@
+  */
-+#include <stdint.h>
++uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm);
 +#include <assert.h>
 +
-+int main()
++/* Likewise, but using @sm = PSTATE.SM. */
  uint32_t sve_vqm1_for_el(CPUARMState *env, int el);
  static inline bool is_a64(CPUARMState *env)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sme_exception_el(CPUARMState *env, int el)
  /*
   * Given that SVE is enabled, return the vector length for EL.
   */
 -uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
 +uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm)
  {
      ARMCPU *cpu = env_archcpu(env);
 -    uint32_t len = cpu->sve_max_vq - 1;
 +    uint64_t *cr = env->vfp.zcr_el;
 +    uint32_t map = cpu->sve_vq.map;
 +    uint32_t len = ARM_MAX_VQ - 1;
 +
 +    if (sm) {
 +        cr = env->vfp.smcr_el;
 +        map = cpu->sme_vq.map;
 +    }
      if (el <= 1 && !el_is_in_host(env, el)) {
 -        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
 +        len = MIN(len, 0xf & (uint32_t)cr[1]);
      }
      if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) {
 -        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
 +        len = MIN(len, 0xf & (uint32_t)cr[2]);
      }
      if (arm_feature(env, ARM_FEATURE_EL3)) {
 -        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
 +        len = MIN(len, 0xf & (uint32_t)cr[3]);
      }
 -    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
 -    return len;
 +    map &= MAKE_64BIT_MASK(0, len + 1);
 +    if (map != 0) {
 +        return 31 - clz32(map);
 +    }
 +
 +    /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */
 +    assert(sm);
 +    return ctz32(cpu->sme_vq.map);
 +}
 +
 +uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
 +{
-+  uintptr_t x, y;
++    return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM));
-+
+ }
-+  asm("mov %0, lr\n\t"
-+      "pacia %0, sp\n\t"        /* sigill if pauth not supported */
+ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +      "eor %0, %0, #4\n\t"      /* corrupt single bit */
 +      "mov %1, %0\n\t"
 +      "autia %1, sp\n\t"        /* validate corrupted pointer */
 +      "xpaci %0\n\t"            /* strip pac from corrupted pointer */
 +      : "=r"(x), "=r"(y));
 +
 +  /*
 +   * Once stripped, the corrupted pointer is of the form 0x0000...wxyz.
 +   * We expect the autia to indicate failure, producing a pointer of the
 +   * form 0x000e....wxyz.  Use xpaci and != for the test, rather than
 +   * extracting explicit bits from the top, because the location of the
 +   * error code "e" depends on the configuration of virtual memory.
 +   */
 +  assert(x != y);
 +  return 0;
 +}
 --
-.20.1
+.25.1

-[PULL 17/20] hw/char/exynos4210_uart: Implement post_load function
+[PULL 22/25] target/arm: Add SVL to TB flags
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-After restoring a VM, serial parameters need to be updated to reflect
+We need SVL separate from VL for RDSVL et al, as well as
-restored register values. Implement a post_load function to handle this
+ZA storage loads and stores, which do not require PSTATE.SM.
 situation.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200123052540.6132-6-linux@roeck-us.net
+Message-id: 20220620175235.60881-20-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/exynos4210_uart.c | 10 ++++++++++
+ target/arm/cpu.h           | 12 ++++++++++++
-file changed, 10 insertions(+)
+ target/arm/translate.h     |  1 +
  target/arm/helper.c        |  8 +++++++-
  target/arm/translate-a64.c |  1 +
 files changed, 21 insertions(+), 1 deletion(-)
-diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/exynos4210_uart.c
+--- a/target/arm/cpu.h
-+++ b/hw/char/exynos4210_uart.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
-     trace_exynos_uart_rxsize(s->channel, s->rx.size);
+ FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
  FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
  FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
 +FIELD(TBFLAG_A64, SVL, 24, 4)
  /*
   * Helpers for using the above.
@@ -XXX,XX +XXX,XX @@ static inline int sve_vq(CPUARMState *env)
      return EX_TBFLAG_A64(env->hflags, VL) + 1;
  }
-+static int exynos4210_uart_post_load(void *opaque, int version_id)
++/**
 + * sme_vq
 + * @env: the cpu context
 + *
 + * Return the SVL cached within env->hflags, in units of quadwords.
 + */
 +static inline int sme_vq(CPUARMState *env)
 +{
-+    Exynos4210UartState *s = (Exynos4210UartState *)opaque;
++    return EX_TBFLAG_A64(env->hflags, SVL) + 1;
 +
 +    exynos4210_uart_update_parameters(s);
 +
 +    return 0;
 +}
 +
- static const VMStateDescription vmstate_exynos4210_uart_fifo = {
+ static inline bool bswap_code(bool sctlr_b)
-     .name = "exynos4210.uart.fifo",
+ {
-     .version_id = 1,
+ #ifdef CONFIG_USER_ONLY
-     .minimum_version_id = 1,
+diff --git a/target/arm/translate.h b/target/arm/translate.h
-+    .post_load = exynos4210_uart_post_load,
+index XXXXXXX..XXXXXXX 100644
-     .fields = (VMStateField[]) {
+--- a/target/arm/translate.h
-         VMSTATE_UINT32(sp, Exynos4210UartFIFO),
++++ b/target/arm/translate.h
-         VMSTATE_UINT32(rp, Exynos4210UartFIFO),
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      int sve_excp_el; /* SVE exception EL or 0 if enabled */
      int sme_excp_el; /* SME exception EL or 0 if enabled */
      int vl;          /* current vector length in bytes */
 +    int svl;         /* current streaming vector length in bytes */
      bool vfp_enabled; /* FP enabled via FPSCR.EN */
      int vec_len;
      int vec_stride;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
          DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
      }
      if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
 -        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
 +        int sme_el = sme_exception_el(env, el);
 +
 +        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
 +        if (sme_el == 0) {
 +            /* Similarly, do not compute SVL if SME is disabled. */
 +            DP_TBFLAG_A64(flags, SVL, sve_vqm1_for_el_sm(env, el, true));
 +        }
          if (FIELD_EX64(env->svcr, SVCR, SM)) {
              DP_TBFLAG_A64(flags, PSTATE_SM, 1);
          }
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
      dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
      dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
      dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
 +    dc->svl = (EX_TBFLAG_A64(tb_flags, SVL) + 1) * 16;
      dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
      dc->bt = EX_TBFLAG_A64(tb_flags, BT);
      dc->btype = EX_TBFLAG_A64(tb_flags, BTYPE);
 --
-.20.1
+.25.1

-[PULL 18/20] hw/char/exynos4210_uart: Implement Rx FIFO level triggers and timeouts
+[PULL 23/25] target/arm: Move pred_{full, gvec}_reg_{offset, size} to translate-a64.h
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-The driver already implements a receive FIFO, but it does not
+We will need these functions in translate-sme.c.
 handle receive FIFO trigger levels and timeout. Implement the
 missing functionality.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200123052540.6132-7-linux@roeck-us.net
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220620175235.60881-21-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/exynos4210_uart.c | 117 ++++++++++++++++++++++++++++++--------
+ target/arm/translate-a64.h | 38 ++++++++++++++++++++++++++++++++++++++
- hw/char/trace-events      |   3 +-
+ target/arm/translate-sve.c | 36 ------------------------------------
-files changed, 94 insertions(+), 26 deletions(-)
+files changed, 38 insertions(+), 36 deletions(-)
-diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
+diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/exynos4210_uart.c
+--- a/target/arm/translate-a64.h
-+++ b/hw/char/exynos4210_uart.c
++++ b/target/arm/translate-a64.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_size(DisasContext *s)
- #include "migration/vmstate.h"
+     return s->vl;
  #include "qemu/error-report.h"
  #include "qemu/module.h"
 +#include "qemu/timer.h"
  #include "chardev/char-fe.h"
  #include "chardev/char-serial.h"
@@ -XXX,XX +XXX,XX @@ static const Exynos4210UartReg exynos4210_uart_regs[] = {
  #define ULCON_STOP_BIT_SHIFT  1
  /* UART Tx/Rx Status */
 +#define UTRSTAT_Rx_TIMEOUT              0x8
  #define UTRSTAT_TRANSMITTER_EMPTY       0x4
  #define UTRSTAT_Tx_BUFFER_EMPTY         0x2
  #define UTRSTAT_Rx_BUFFER_DATA_READY    0x1
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210UartState {
      Exynos4210UartFIFO   rx;
      Exynos4210UartFIFO   tx;
 +    QEMUTimer *fifo_timeout_timer;
 +    uint64_t wordtime;        /* word time in ns */
 +
      CharBackend       chr;
      qemu_irq          irq;
@@ -XXX,XX +XXX,XX @@ static void fifo_reset(Exynos4210UartFIFO *q)
      q->rp = 0;
  }
--static uint32_t exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState *s)
++/*
-+static uint32_t exynos4210_uart_FIFO_trigger_level(uint32_t channel,
++ * Return the offset info CPUARMState of the predicate vector register Pn.
-+                                                   uint32_t reg)
++ * Note for this purpose, FFR is P16.
- {
++ */
--    uint32_t level = 0;
++static inline int pred_full_reg_offset(DisasContext *s, int regno)
 -    uint32_t reg;
 +    uint32_t level;
 -    reg = (s->reg[I_(UFCON)] & UFCON_Tx_FIFO_TRIGGER_LEVEL) >>
 -            UFCON_Tx_FIFO_TRIGGER_LEVEL_SHIFT;
 -
 -    switch (s->channel) {
 +    switch (channel) {
      case 0:
          level = reg * 32;
          break;
@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState
          break;
      default:
          level = 0;
 -        trace_exynos_uart_channel_error(s->channel);
 +        trace_exynos_uart_channel_error(channel);
 +        break;
      }
 -
      return level;
  }
 +static uint32_t
 +exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState *s)
 +{
-+    uint32_t reg;
++    return offsetof(CPUARMState, vfp.pregs[regno]);
 +
 +    reg = (s->reg[I_(UFCON)] & UFCON_Tx_FIFO_TRIGGER_LEVEL) >>
 +            UFCON_Tx_FIFO_TRIGGER_LEVEL_SHIFT;
 +
 +    return exynos4210_uart_FIFO_trigger_level(s->channel, reg);
 +}
 +
-+static uint32_t
++/* Return the byte size of the whole predicate register, VL / 64.  */
-+exynos4210_uart_Rx_FIFO_trigger_level(const Exynos4210UartState *s)
++static inline int pred_full_reg_size(DisasContext *s)
 +{
-+    uint32_t reg;
++    return s->vl >> 3;
 +
 +    reg = ((s->reg[I_(UFCON)] & UFCON_Rx_FIFO_TRIGGER_LEVEL) >>
 +            UFCON_Rx_FIFO_TRIGGER_LEVEL_SHIFT) + 1;
 +
 +    return exynos4210_uart_FIFO_trigger_level(s->channel, reg);
 +}
 +
- static void exynos4210_uart_update_irq(Exynos4210UartState *s)
++/*
- {
++ * Round up the size of a register to a size allowed by
-     /*
++ * the tcg vector infrastructure.  Any operation which uses this
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
++ * size may assume that the bits above pred_full_reg_size are zero,
-      * transmit FIFO is smaller than the trigger level.
++ * and must leave them the same way.
-      */
++ *
-     if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) {
++ * Note that this is not needed for the vector registers as they
--
++ * are always properly sized for tcg vectors.
-         uint32_t count = (s->reg[I_(UFSTAT)] & UFSTAT_Tx_FIFO_COUNT) >>
++ */
-                 UFSTAT_Tx_FIFO_COUNT_SHIFT;
++static inline int size_for_gvec(int size)
          if (count <= exynos4210_uart_Tx_FIFO_trigger_level(s)) {
              s->reg[I_(UINTSP)] |= UINTSP_TXD;
          }
 +
 +        /*
 +         * Rx interrupt if trigger level is reached or if rx timeout
 +         * interrupt is disabled and there is data in the receive buffer
 +         */
 +        count = fifo_elements_number(&s->rx);
 +        if ((count && !(s->reg[I_(UCON)] & 0x80)) ||
 +            count >= exynos4210_uart_Rx_FIFO_trigger_level(s)) {
 +            s->reg[I_(UINTSP)] |= UINTSP_RXD;
 +            timer_del(s->fifo_timeout_timer);
 +        }
 +    } else if (s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY) {
 +        s->reg[I_(UINTSP)] |= UINTSP_RXD;
      }
      s->reg[I_(UINTP)] = s->reg[I_(UINTSP)] & ~s->reg[I_(UINTM)];
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
      }
  }
 +static void exynos4210_uart_timeout_int(void *opaque)
 +{
-+    Exynos4210UartState *s = opaque;
++    if (size <= 8) {
-+
++        return 8;
-+    trace_exynos_uart_rx_timeout(s->channel, s->reg[I_(UTRSTAT)],
++    } else {
-+                                 s->reg[I_(UINTSP)]);
++        return QEMU_ALIGN_UP(size, 16);
 +
 +    if ((s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY) ||
 +        (s->reg[I_(UCON)] & (1 << 11))) {
 +        s->reg[I_(UINTSP)] |= UINTSP_RXD;
 +        s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_TIMEOUT;
 +        exynos4210_uart_update_irq(s);
 +    }
 +}
 +
- static void exynos4210_uart_update_parameters(Exynos4210UartState *s)
++static inline int pred_gvec_reg_size(DisasContext *s)
- {
++{
-     int speed, parity, data_bits, stop_bits;
++    return size_for_gvec(pred_full_reg_size(s));
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_parameters(Exynos4210UartState *s)
      ssp.data_bits = data_bits;
      ssp.stop_bits = stop_bits;
 +    s->wordtime = NANOSECONDS_PER_SECOND * (data_bits + stop_bits + 1) / speed;
 +
      qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
      trace_exynos_uart_update_params(
 -                s->channel, speed, parity, data_bits, stop_bits);
 +                s->channel, speed, parity, data_bits, stop_bits, s->wordtime);
 +}
 +
-+static void exynos4210_uart_rx_timeout_set(Exynos4210UartState *s)
+ bool disas_sve(DisasContext *, uint32_t);
-+{
-+    if (s->reg[I_(UCON)] & 0x80) {
+ void gen_gvec_rax1(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
-+        uint32_t timeout = ((s->reg[I_(UCON)] >> 12) & 0x0f) * s->wordtime;
+diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-+
+index XXXXXXX..XXXXXXX 100644
-+        timer_mod(s->fifo_timeout_timer,
+--- a/target/arm/translate-sve.c
-+                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout);
++++ b/target/arm/translate-sve.c
-+    } else {
+@@ -XXX,XX +XXX,XX @@ static inline int msz_dtype(DisasContext *s, int msz)
-+        timer_del(s->fifo_timeout_timer);
+  * Implement all of the translator functions referenced by the decoder.
-+    }
+  */
- }
+-/* Return the offset info CPUARMState of the predicate vector register Pn.
- static void exynos4210_uart_write(void *opaque, hwaddr offset,
+- * Note for this purpose, FFR is P16.
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
+- */
-         exynos4210_uart_update_irq(s);
+-static inline int pred_full_reg_offset(DisasContext *s, int regno)
-         break;
+-{
-     case UTRSTAT:
+-    return offsetof(CPUARMState, vfp.pregs[regno]);
-+        if (val & UTRSTAT_Rx_TIMEOUT) {
+-}
 +            s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_TIMEOUT;
 +        }
 +        break;
      case UERSTAT:
      case UFSTAT:
      case UMSTAT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
          break;
      }
  }
 +
  static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
                                    unsigned size)
  {
@@ -XXX,XX +XXX,XX @@ static int exynos4210_uart_can_receive(void *opaque)
      return fifo_empty_elements_number(&s->rx);
  }
 -
- static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size)
+-/* Return the byte size of the whole predicate register, VL / 64.  */
- {
+-static inline int pred_full_reg_size(DisasContext *s)
-     Exynos4210UartState *s = (Exynos4210UartState *)opaque;
+-{
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size)
+-    return s->vl >> 3;
+-}
-     if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) {
+-
-         if (fifo_empty_elements_number(&s->rx) < size) {
+-/* Round up the size of a register to a size allowed by
--            for (i = 0; i < fifo_empty_elements_number(&s->rx); i++) {
+- * the tcg vector infrastructure.  Any operation which uses this
--                fifo_store(&s->rx, buf[i]);
+- * size may assume that the bits above pred_full_reg_size are zero,
--            }
+- * and must leave them the same way.
-+            size = fifo_empty_elements_number(&s->rx);
+- *
-             s->reg[I_(UINTSP)] |= UINTSP_ERROR;
+- * Note that this is not needed for the vector registers as they
--            s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
+- * are always properly sized for tcg vectors.
--        } else {
+- */
--            for (i = 0; i < size; i++) {
+-static int size_for_gvec(int size)
--                fifo_store(&s->rx, buf[i]);
+-{
--            }
+-    if (size <= 8) {
--            s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
+-        return 8;
-         }
+-    } else {
--        /* XXX: Around here we maybe should check Rx trigger level */
+-        return QEMU_ALIGN_UP(size, 16);
--        s->reg[I_(UINTSP)] |= UINTSP_RXD;
+-    }
-+        for (i = 0; i < size; i++) {
+-}
-+            fifo_store(&s->rx, buf[i]);
+-
-+        }
+-static int pred_gvec_reg_size(DisasContext *s)
-+        exynos4210_uart_rx_timeout_set(s);
+-{
-     } else {
+-    return size_for_gvec(pred_full_reg_size(s));
-         s->reg[I_(URXH)] = buf[0];
+-}
--        s->reg[I_(UINTSP)] |= UINTSP_RXD;
+-
--        s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
+ /* Invoke an out-of-line helper on 2 Zregs. */
-     }
+ static bool gen_gvec_ool_zz(DisasContext *s, gen_helper_gvec_2 *fn,
-+    s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
+                             int rd, int rn, int data)
      exynos4210_uart_update_irq(s);
  }
@@ -XXX,XX +XXX,XX @@ static int exynos4210_uart_post_load(void *opaque, int version_id)
      Exynos4210UartState *s = (Exynos4210UartState *)opaque;
      exynos4210_uart_update_parameters(s);
 +    exynos4210_uart_rx_timeout_set(s);
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_init(Object *obj)
      SysBusDevice *dev = SYS_BUS_DEVICE(obj);
      Exynos4210UartState *s = EXYNOS4210_UART(dev);
 +    s->fifo_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 +                                         exynos4210_uart_timeout_int, s);
 +    s->wordtime = NANOSECONDS_PER_SECOND * 10 / 9600;
 +
      /* memory mapping */
      memory_region_init_io(&s->iomem, obj, &exynos4210_uart_ops, s,
                            "exynos4210.uart", EXYNOS4210_UART_REGS_MEM_SIZE);
 diff --git a/hw/char/trace-events b/hw/char/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/trace-events
 +++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PR
  # exynos4210_uart.c
  exynos_uart_irq_raised(uint32_t channel, uint32_t reg) "UART%d: IRQ raised: 0x%08"PRIx32
  exynos_uart_irq_lowered(uint32_t channel) "UART%d: IRQ lowered"
 -exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d"
 +exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop, uint64_t wordtime) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d wordtime: %"PRId64"ns"
  exynos_uart_write(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s <- 0x%" PRIx64
  exynos_uart_read(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s -> 0x%" PRIx64
  exynos_uart_rx_fifo_reset(uint32_t channel) "UART%d: Rx FIFO Reset"
@@ -XXX,XX +XXX,XX @@ exynos_uart_rx_error(uint32_t channel) "UART%d: Rx error"
  exynos_uart_wo_read(uint32_t channel, const char *name, uint32_t reg) "UART%d: Trying to read from WO register: %s [0x%04"PRIx32"]"
  exynos_uart_rxsize(uint32_t channel, uint32_t size) "UART%d: Rx FIFO size: %d"
  exynos_uart_channel_error(uint32_t channel) "Wrong UART channel number: %d"
 +exynos_uart_rx_timeout(uint32_t channel, uint32_t stat, uint32_t intsp) "UART%d: Rx timeout stat=0x%x intsp=0x%x"
 --
-.20.1
+.25.1

-[PULL 07/20] hw/arm: Use helper function to trigger hotplug handler plug
+[PULL 24/25] target/arm: Extend arm_pamax to more than aarch64
-From: Keqian Zhu <zhukeqian1@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-We can use existing helper function to trigger hotplug handler
+Move the code from hw/arm/virt.c that is supposed
-plug, which makes code clearer.
+to handle v7 into the one function.
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Reported-by: He Zhe <zhe.he@windriver.com>
-Message-id: 20200120012755.44581-3-zhukeqian1@huawei.com
+Message-id: 20220619001541.131672-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 6 +++---
+ hw/arm/virt.c    | 10 +---------
-file changed, 3 insertions(+), 3 deletions(-)
+ target/arm/ptw.c | 24 ++++++++++++++++--------
 files changed, 17 insertions(+), 17 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_memory_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
- static void virt_memory_plug(HotplugHandler *hotplug_dev,
+         cpuobj = object_new(possible_cpus->cpus[0].type);
-                              DeviceState *dev, Error **errp)
+         armcpu = ARM_CPU(cpuobj);
 -        if (object_property_get_bool(cpuobj, "aarch64", NULL)) {
 -            pa_bits = arm_pamax(armcpu);
 -        } else if (arm_feature(&armcpu->env, ARM_FEATURE_LPAE)) {
 -            /* v7 with LPAE */
 -            pa_bits = 40;
 -        } else {
 -            /* Anything else */
 -            pa_bits = 32;
 -        }
 +        pa_bits = arm_pamax(armcpu);
          object_unref(cpuobj);
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t pamax_map[] = {
  /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
  unsigned int arm_pamax(ARMCPU *cpu)
  {
--    HotplugHandlerClass *hhc;
+-    unsigned int parange =
-     VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
+-        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
-     Error *local_err = NULL;
++    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
++        unsigned int parange =
-@@ -XXX,XX +XXX,XX @@ static void virt_memory_plug(HotplugHandler *hotplug_dev,
++            FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
-         goto out;
-     }
+-    /*
+-     * id_aa64mmfr0 is a read-only register so values outside of the
--    hhc = HOTPLUG_HANDLER_GET_CLASS(vms->acpi_dev);
+-     * supported mappings can be considered an implementation error.
--    hhc->plug(HOTPLUG_HANDLER(vms->acpi_dev), dev, &error_abort);
+-     */
-+    hotplug_handler_plug(HOTPLUG_HANDLER(vms->acpi_dev),
+-    assert(parange < ARRAY_SIZE(pamax_map));
-+                         dev, &error_abort);
+-    return pamax_map[parange];
-+
++        /*
- out:
++         * id_aa64mmfr0 is a read-only register so values outside of the
-     error_propagate(errp, local_err);
++         * supported mappings can be considered an implementation error.
 +         */
 +        assert(parange < ARRAY_SIZE(pamax_map));
 +        return pamax_map[parange];
 +    }
 +    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
 +        /* v7 with LPAE */
 +        return 40;
 +    }
 +    /* Anything else */
 +    return 32;
  }
+ /*
 --
-.20.1
+.25.1

-[PULL 02/20] target/arm: Fix PAuth sbox functions
+[PULL 25/25] target/arm: Check V7VE as well as LPAE in arm_pamax
-From: Vincent Dehors <vincent.dehors@smile.fr>
+From: Richard Henderson <richard.henderson@linaro.org>
-In the PAC computation, sbox was applied over wrong bits.
+In machvirt_init we create a cpu but do not fully initialize it.
-As this is a 4-bit sbox, bit index should be incremented by 4 instead of 16.
+Thus the propagation of V7VE to LPAE has not been done, and we
 compute the wrong value for some v7 cpus, e.g. cortex-a15.
-Test vector from QARMA paper (https://eprint.iacr.org/2016/444.pdf) was
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1078
-used to verify one computation of the pauth_computepac() function which
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-uses sbox2.
+Reported-by: He Zhe <zhe.he@windriver.com>
+Message-id: 20220619001541.131672-3-richard.henderson@linaro.org
 Launchpad: https://bugs.launchpad.net/bugs/1859713
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Vincent DEHORS <vincent.dehors@smile.fr>
 Signed-off-by: Adrien GRASSEIN <adrien.grassein@smile.fr>
 Message-id: 20200116230809.19078-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/pauth_helper.c | 4 ++--
+ target/arm/ptw.c | 8 +++++++-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 7 insertions(+), 1 deletion(-)
-diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/pauth_helper.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/pauth_helper.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t pac_sub(uint64_t i)
+@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu)
-     uint64_t o = 0;
+         assert(parange < ARRAY_SIZE(pamax_map));
-     int b;
+         return pamax_map[parange];
 -    for (b = 0; b < 64; b += 16) {
 +    for (b = 0; b < 64; b += 4) {
          o |= (uint64_t)sub[(i >> b) & 0xf] << b;
      }
-     return o;
+-    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
-@@ -XXX,XX +XXX,XX @@ static uint64_t pac_inv_sub(uint64_t i)
++
-     uint64_t o = 0;
++    /*
-     int b;
++     * In machvirt_init, we call arm_pamax on a cpu that is not fully
++     * initialized, so we can't rely on the propagation done in realize.
--    for (b = 0; b < 64; b += 16) {
++     */
-+    for (b = 0; b < 64; b += 4) {
++    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) ||
-         o |= (uint64_t)inv_sub[(i >> b) & 0xf] << b;
++        arm_feature(&cpu->env, ARM_FEATURE_V7VE)) {
          /* v7 with LPAE */
          return 40;
      }
-     return o;
 --
-.20.1
+.25.1

The following changes since commit b7c359c748a2e3ccb97a184b9739feb2cd48de2f:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-01-23 14:38:43 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200123

for you to fetch changes up to 53c75ad8e72dc3a5102de7ed21e4990969cb0a19:

hw/arm/exynos4210: Connect serial port DMA busy signals with pl330 (2020-01-23 15:22:42 +0000)

----------------------------------------------------------------
target-arm queue:
 * fix bug in PAuth emulation
 * add PMU to Cortex-R5, Cortex-R5F
 * qemu-nbd: Convert documentation to rST
 * qemu-block-drivers: Convert documentation to rST
 * Fix Exynos4210 UART DMA support
 * Various minor code cleanups

----------------------------------------------------------------
Andrew Jones (1):
      target/arm/arch_dump: Add SVE notes

Clement Deschamps (1):
      target/arm: add PMU feature to cortex-r5 and cortex-r5f

Guenter Roeck (8):
      dma/pl330: Convert to support tracing
      hw/core/or-irq: Increase limit of or-lines to 48
      hw/arm/exynos4210: Fix DMA initialization
      hw/char/exynos4210_uart: Convert to support tracing
      hw/char/exynos4210_uart: Implement post_load function
      hw/char/exynos4210_uart: Implement Rx FIFO level triggers and timeouts
      hw/char/exynos4210_uart: Add receive DMA support
      hw/arm/exynos4210: Connect serial port DMA busy signals with pl330

Keqian Zhu (2):
      hw/acpi: Remove extra indent in ACPI GED hotplug cb
      hw/arm: Use helper function to trigger hotplug handler plug

Peter Maydell (3):
      qemu-nbd: Convert invocation documentation to rST
      docs: Create stub system manual
      qemu-block-drivers: Convert to rST

Philippe Mathieu-Daudé (1):
      hw/misc/stm32f4xx_syscfg: Fix copy/paste error

Richard Henderson (3):
      tests/tcg/aarch64: Fix compilation parameters for pauth-%
      tests/tcg/aarch64: Add pauth-3
      tests/tcg/aarch64: Add pauth-4

Vincent Dehors (1):
      target/arm: Fix PAuth sbox functions

Makefile                                  |  37 +-
 tests/tcg/aarch64/Makefile.softmmu-target |   5 +-
 tests/tcg/aarch64/Makefile.target         |   3 +-
 include/elf.h                             |   1 +
 include/hw/arm/exynos4210.h               |   4 +
 include/hw/or-irq.h                       |   2 +-
 target/arm/cpu.h                          |  25 +
 hw/acpi/generic_event_device.c            |   2 +-
 hw/arm/exynos4210.c                       |  77 ++-
 hw/arm/virt.c                             |   6 +-
 hw/char/exynos4210_uart.c                 | 245 +++++---
 hw/dma/pl330.c                            |  88 +--
 hw/misc/stm32f4xx_syscfg.c                |   2 +-
 target/arm/arch_dump.c                    | 124 +++-
 target/arm/cpu.c                          |   1 +
 target/arm/kvm64.c                        |  24 -
 target/arm/pauth_helper.c                 |   4 +-
 tests/tcg/aarch64/pauth-1.c               |   2 -
 tests/tcg/aarch64/pauth-2.c               |   2 -
 tests/tcg/aarch64/pauth-4.c               |  25 +
 tests/tcg/aarch64/system/pauth-3.c        |  40 ++
 MAINTAINERS                               |   1 +
 docs/index.html.in                        |   1 +
 docs/interop/conf.py                      |   4 +-
 docs/interop/index.rst                    |   1 +
 docs/interop/qemu-nbd.rst                 | 263 ++++++++
 docs/interop/qemu-option-trace.rst.inc    |  30 +
 docs/qemu-block-drivers.texi              | 889 ---------------------------
 docs/system/conf.py                       |  22 +
 docs/system/index.rst                     |  17 +
 docs/system/qemu-block-drivers.rst        | 985 ++++++++++++++++++++++++++++++
 hw/char/trace-events                      |  20 +
 hw/dma/trace-events                       |  24 +
 qemu-doc.texi                             |  18 -
 qemu-nbd.texi                             | 214 -------
 qemu-option-trace.texi                    |   4 +
 qemu-options.hx                           |   2 +-
 37 files changed, 1897 insertions(+), 1317 deletions(-)
 create mode 100644 tests/tcg/aarch64/pauth-4.c
 create mode 100644 tests/tcg/aarch64/system/pauth-3.c
 create mode 100644 docs/interop/qemu-nbd.rst
 create mode 100644 docs/interop/qemu-option-trace.rst.inc
 delete mode 100644 docs/qemu-block-drivers.texi
 create mode 100644 docs/system/conf.py
 create mode 100644 docs/system/index.rst
 create mode 100644 docs/system/qemu-block-drivers.rst
 delete mode 100644 qemu-nbd.texi

From: Vincent Dehors <vincent.dehors@smile.fr>

In the PAC computation, sbox was applied over wrong bits.
As this is a 4-bit sbox, bit index should be incremented by 4 instead of 16.

Test vector from QARMA paper (https://eprint.iacr.org/2016/444.pdf) was
used to verify one computation of the pauth_computepac() function which
uses sbox2.

Launchpad: https://bugs.launchpad.net/bugs/1859713
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Vincent DEHORS <vincent.dehors@smile.fr>
Signed-off-by: Adrien GRASSEIN <adrien.grassein@smile.fr>
Message-id: 20200116230809.19078-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/pauth_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/pauth_helper.c
+++ b/target/arm/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pac_sub(uint64_t i)
     uint64_t o = 0;
     int b;
 
-    for (b = 0; b < 64; b += 16) {
+    for (b = 0; b < 64; b += 4) {
         o |= (uint64_t)sub[(i >> b) & 0xf] << b;
     }
     return o;
@@ -XXX,XX +XXX,XX @@ static uint64_t pac_inv_sub(uint64_t i)
     uint64_t o = 0;
     int b;
 
-    for (b = 0; b < 64; b += 16) {
+    for (b = 0; b < 64; b += 4) {
         o |= (uint64_t)inv_sub[(i >> b) & 0xf] << b;
     }
     return o;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We were incorrectly requiring ARMv8.4 support for the pauth
tests, but Pointer Authentication is an ARMv8.3 extension.
Further, hiding the required architecture within asm() is
not correct.

Correct the architecture version requested, and specify it
in the cflags of the (cross-) compiler rather than in the asm.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200116230809.19078-3-richard.henderson@linaro.org
[PMM: tweaked commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.target | 1 +
 tests/tcg/aarch64/pauth-1.c       | 2 --
 tests/tcg/aarch64/pauth-2.c       | 2 --
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 # Pauth Tests
 AARCH64_TESTS += pauth-1 pauth-2
 run-pauth-%: QEMU_OPTS += -cpu max
+pauth-%: CFLAGS += -march=armv8.3-a
 
 # Semihosting smoke test for linux-user
 AARCH64_TESTS += semihosting
diff --git a/tests/tcg/aarch64/pauth-1.c b/tests/tcg/aarch64/pauth-1.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/pauth-1.c
+++ b/tests/tcg/aarch64/pauth-1.c
@@ -XXX,XX +XXX,XX @@
 #include <sys/prctl.h>
 #include <stdio.h>
 
-asm(".arch armv8.4-a");
-
 #ifndef PR_PAC_RESET_KEYS
 #define PR_PAC_RESET_KEYS  54
 #define PR_PAC_APDAKEY     (1 << 2)
diff --git a/tests/tcg/aarch64/pauth-2.c b/tests/tcg/aarch64/pauth-2.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/pauth-2.c
+++ b/tests/tcg/aarch64/pauth-2.c
@@ -XXX,XX +XXX,XX @@
 #include <stdint.h>
 #include <assert.h>
 
-asm(".arch armv8.4-a");
-
 void do_test(uint64_t value)
 {
     uint64_t salt1, salt2;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

This is the test vector from the QARMA paper, run through PACGA.

Suggested-by: Vincent Dehors <vincent.dehors@smile.fr>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200116230809.19078-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.softmmu-target |  5 ++-
 tests/tcg/aarch64/system/pauth-3.c        | 40 +++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/aarch64/system/pauth-3.c

diff --git a/tests/tcg/aarch64/Makefile.softmmu-target b/tests/tcg/aarch64/Makefile.softmmu-target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.softmmu-target
+++ b/tests/tcg/aarch64/Makefile.softmmu-target
@@ -XXX,XX +XXX,XX @@ run-memory-replay: memory-replay run-memory-record
 	   	  $(QEMU_OPTS) memory, \
 	  "$< on $(TARGET_NAME)")
 
-EXTRA_TESTS+=memory-record memory-replay
+run-pauth-3: pauth-3
+pauth-3: CFLAGS += -march=armv8.3-a
+
+EXTRA_TESTS+=memory-record memory-replay pauth-3
diff --git a/tests/tcg/aarch64/system/pauth-3.c b/tests/tcg/aarch64/system/pauth-3.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/system/pauth-3.c
@@ -XXX,XX +XXX,XX @@
+#include <inttypes.h>
+#include <minilib.h>
+
+int main()
+{
+    /*
+     * Test vector from QARMA paper (https://eprint.iacr.org/2016/444.pdf)
+     * to verify one computation of the pauth_computepac() function,
+     * which uses sbox2.
+     *
+     * Use PACGA, because it returns the most bits from ComputePAC.
+     * We still only get the most significant 32-bits of the result.
+     */
+
+    static const uint64_t d[5] = {
+        0xfb623599da6e8127ull,
+        0x477d469dec0b8762ull,
+        0x84be85ce9804e94bull,
+        0xec2802d4e0a488e9ull,
+        0xc003b93999b33765ull & 0xffffffff00000000ull
+    };
+    uint64_t r;
+
+    asm("msr apgakeyhi_el1, %[w0]\n\t"
+        "msr apgakeylo_el1, %[k0]\n\t"
+        "pacga %[r], %[P], %[T]"
+        : [r] "=r"(r)
+        : [P] "r" (d[0]),
+          [T] "r" (d[1]),
+          [w0] "r" (d[2]),
+          [k0] "r" (d[3]));
+
+    if (r == d[4]) {
+        ml_printf("OK\n");
+        return 0;
+    } else {
+        ml_printf("FAIL: %lx != %lx\n", r, d[4]);
+        return 1;
+    }
+}
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Perform the set of operations and test described in LP 1859713.

Suggested-by: Adrien GRASSEIN <adrien.grassein@smile.fr>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200116230809.19078-5-richard.henderson@linaro.org
[PMM: fixed hard-coded tabs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.target |  2 +-
 tests/tcg/aarch64/pauth-4.c       | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/aarch64/pauth-4.c

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 	$(call diff-out,$<,$(AARCH64_SRC)/fcvt.ref)
 
 # Pauth Tests
-AARCH64_TESTS += pauth-1 pauth-2
+AARCH64_TESTS += pauth-1 pauth-2 pauth-4
 run-pauth-%: QEMU_OPTS += -cpu max
 pauth-%: CFLAGS += -march=armv8.3-a
 
diff --git a/tests/tcg/aarch64/pauth-4.c b/tests/tcg/aarch64/pauth-4.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/pauth-4.c
@@ -XXX,XX +XXX,XX @@
+#include <stdint.h>
+#include <assert.h>
+
+int main()
+{
+  uintptr_t x, y;
+
+  asm("mov %0, lr\n\t"
+      "pacia %0, sp\n\t"        /* sigill if pauth not supported */
+      "eor %0, %0, #4\n\t"      /* corrupt single bit */
+      "mov %1, %0\n\t"
+      "autia %1, sp\n\t"        /* validate corrupted pointer */
+      "xpaci %0\n\t"            /* strip pac from corrupted pointer */
+      : "=r"(x), "=r"(y));
+
+  /*
+   * Once stripped, the corrupted pointer is of the form 0x0000...wxyz.
+   * We expect the autia to indicate failure, producing a pointer of the
+   * form 0x000e....wxyz.  Use xpaci and != for the test, rather than
+   * extracting explicit bits from the top, because the location of the
+   * error code "e" depends on the configuration of virtual memory.
+   */
+  assert(x != y);
+  return 0;
+}
-- 
2.20.1

From: Keqian Zhu <zhukeqian1@huawei.com>

There is extra indent in ACPI GED hotplug cb that should be
deleted.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Message-id: 20200120012755.44581-2-zhukeqian1@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/acpi/generic_event_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -XXX,XX +XXX,XX @@ static void acpi_ged_device_plug_cb(HotplugHandler *hotplug_dev,
     AcpiGedState *s = ACPI_GED(hotplug_dev);
 
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
-            acpi_memory_plug_cb(hotplug_dev, &s->memhp_state, dev, errp);
+        acpi_memory_plug_cb(hotplug_dev, &s->memhp_state, dev, errp);
     } else {
         error_setg(errp, "virt: device plug request for unsupported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
-- 
2.20.1

From: Keqian Zhu <zhukeqian1@huawei.com>

We can use existing helper function to trigger hotplug handler
plug, which makes code clearer.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Message-id: 20200120012755.44581-3-zhukeqian1@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_memory_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
 static void virt_memory_plug(HotplugHandler *hotplug_dev,
                              DeviceState *dev, Error **errp)
 {
-    HotplugHandlerClass *hhc;
     VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
     Error *local_err = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void virt_memory_plug(HotplugHandler *hotplug_dev,
         goto out;
     }
 
-    hhc = HOTPLUG_HANDLER_GET_CLASS(vms->acpi_dev);
-    hhc->plug(HOTPLUG_HANDLER(vms->acpi_dev), dev, &error_abort);
+    hotplug_handler_plug(HOTPLUG_HANDLER(vms->acpi_dev),
+                         dev, &error_abort);
+
 out:
     error_propagate(errp, local_err);
 }
-- 
2.20.1

The qemu-nbd documentation is currently in qemu-nbd.texi in Texinfo
format, which we present to the user as:
 * a qemu-nbd manpage
 * a section of the main qemu-doc HTML documentation

Convert the documentation to rST format, and present it to the user as:
 * a qemu-nbd manpage
 * part of the interop/ Sphinx manual

This follows the same pattern as commit 27a296fce982 did for the
qemu-ga manpage.

All the content of the old manpage is retained, except that I have
dropped the "This is free software; see the source for copying
conditions.  There is NO warranty..." text that was in the old AUTHOR
section; Sphinx's manpage builder doesn't expect that much text in
the AUTHOR section, and since none of our other manpages have it it
seems easiest to delete it rather than try to figure out where else
in the manpage to put it.

The only other textual change is that I have had to give the
--nocache option its own description ("Equivalent to --cache=none")
because Sphinx doesn't have an equivalent of using item/itemx
to share a description between two options.

Some minor aspects of the formatting have changed, to suit what is
easiest for Sphinx to output. (The most notable is that Sphinx
option section option syntax doesn't support '--option foo=bar'
with bar underlined rather than bold, so we have to switch to
'--option foo=BAR' instead.)

The contents of qemu-option-trace.texi are now duplicated in
docs/interop/qemu-option-trace.rst.inc, until such time as we complete
the conversion of the other files which use it; since it has had only
3 changes in 3 years, this shouldn't be too awkward a burden.
(We use .rst.inc because if this file fragment has a .rst extension
then Sphinx complains about not seeing it in a toctree.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200116141511.16849-2-peter.maydell@linaro.org
---
 Makefile                               |  16 +-
 MAINTAINERS                            |   1 +
 docs/interop/conf.py                   |   4 +-
 docs/interop/index.rst                 |   1 +
 docs/interop/qemu-nbd.rst              | 263 +++++++++++++++++++++++++
 docs/interop/qemu-option-trace.rst.inc |  30 +++
 qemu-doc.texi                          |   6 -
 qemu-nbd.texi                          | 214 --------------------
 qemu-option-trace.texi                 |   4 +
 9 files changed, 313 insertions(+), 226 deletions(-)
 create mode 100644 docs/interop/qemu-nbd.rst
 create mode 100644 docs/interop/qemu-option-trace.rst.inc
 delete mode 100644 qemu-nbd.texi

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ MANUAL_BUILDDIR := docs
 endif
 
 ifdef BUILD_DOCS
-DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 $(MANUAL_BUILDDIR)/interop/qemu-ga.8
+DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1
+DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-nbd.8
+DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-ga.8
 DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
 DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
 DOCS+=docs/qemu-block-drivers.7
@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_POSIX
 ifeq ($(CONFIG_TOOLS),y)
 	$(INSTALL_DATA) qemu-img.1 "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
-	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
+	$(INSTALL_DATA) $(MANUAL_BUILDDIR)/interop/qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
 endif
 ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
@@ -XXX,XX +XXX,XX @@ sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index
 # a single doctree: https://github.com/sphinx-doc/sphinx/issues/2946
 build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" sphinx-build $(if $(V),,-q) -W -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
 # We assume all RST files in the manual's directory are used in it
-manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
+manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) \
+              $(wildcard $(SRC_PATH)/docs/$1/*.rst.inc) \
+              $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
 
 $(MANUAL_BUILDDIR)/devel/index.html: $(call manual-deps,devel)
 	$(call build-manual,devel,html)
@@ -XXX,XX +XXX,XX @@ $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
 $(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
 	$(call build-manual,interop,man)
 
+$(MANUAL_BUILDDIR)/interop/qemu-nbd.8: $(call manual-deps,interop)
+	$(call build-manual,interop,man)
+
 $(MANUAL_BUILDDIR)/index.html: $(SRC_PATH)/docs/index.html.in qemu-version.h
 	@mkdir -p "$(MANUAL_BUILDDIR)"
 	$(call quiet-command, sed "s|@@VERSION@@|${VERSION}|g" $< >$@, \
@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
 qemu.1: qemu-option-trace.texi
 qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
 fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
-qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
 docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
 docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
 scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
@@ -XXX,XX +XXX,XX @@ pdf: qemu-doc.pdf docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
 txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
 
 qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
-	qemu-img.texi qemu-nbd.texi qemu-options.texi \
+	qemu-img.texi qemu-options.texi \
 	qemu-tech.texi qemu-option-trace.texi \
 	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
 	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/block/nbd*
 F: qemu-nbd.*
 F: blockdev-nbd.c
 F: docs/interop/nbd.txt
+F: docs/interop/qemu-nbd.rst
 T: git https://repo.or.cz/qemu/ericb.git nbd
 
 NFS
diff --git a/docs/interop/conf.py b/docs/interop/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/conf.py
+++ b/docs/interop/conf.py
@@ -XXX,XX +XXX,XX @@ html_theme_options['description'] = u'System Emulation Management and Interopera
 # (source start file, name, description, authors, manual section).
 man_pages = [
     ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
-     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8)
+     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
+    ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
+     ['Anthony Liguori <anthony@codemonkey.ws>'], 8)
 ]
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    live-block-operations
    pr-helper
    qemu-ga
+   qemu-nbd
    vhost-user
    vhost-user-gpu
diff --git a/docs/interop/qemu-nbd.rst b/docs/interop/qemu-nbd.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/qemu-nbd.rst
@@ -XXX,XX +XXX,XX @@
+QEMU Disk Network Block Device Server
+=====================================
+
+Synopsis
+--------
+
+**qemu-nbd** [*OPTION*]... *filename*
+
+**qemu-nbd** -L [*OPTION*]...
+
+**qemu-nbd** -d *dev*
+
+Description
+-----------
+
+Export a QEMU disk image using the NBD protocol.
+
+Other uses:
+
+- Bind a /dev/nbdX block device to a QEMU server (on Linux).
+- As a client to query exports of a remote NBD server.
+
+Options
+-------
+
+.. program:: qemu-nbd
+
+*filename* is a disk image filename, or a set of block
+driver options if ``--image-opts`` is specified.
+
+*dev* is an NBD device.
+
+.. option:: --object type,id=ID,...props...
+
+  Define a new instance of the *type* object class identified by *ID*.
+  See the :manpage:`qemu(1)` manual page for full details of the properties
+  supported. The common object types that it makes sense to define are the
+  ``secret`` object, which is used to supply passwords and/or encryption
+  keys, and the ``tls-creds`` object, which is used to supply TLS
+  credentials for the qemu-nbd server or client.
+
+.. option:: -p, --port=PORT
+
+  TCP port to listen on as a server, or connect to as a client
+  (default ``10809``).
+
+.. option:: -o, --offset=OFFSET
+
+  The offset into the image.
+
+.. option:: -b, --bind=IFACE
+
+  The interface to bind to as a server, or connect to as a client
+  (default ``0.0.0.0``).
+
+.. option:: -k, --socket=PATH
+
+  Use a unix socket with path *PATH*.
+
+.. option:: --image-opts
+
+  Treat *filename* as a set of image options, instead of a plain
+  filename. If this flag is specified, the ``-f`` flag should
+  not be used, instead the :option:`format=` option should be set.
+
+.. option:: -f, --format=FMT
+
+  Force the use of the block driver for format *FMT* instead of
+  auto-detecting.
+
+.. option:: -r, --read-only
+
+  Export the disk as read-only.
+
+.. option:: -P, --partition=NUM
+
+  Deprecated: Only expose MBR partition *NUM*.  Understands physical
+  partitions 1-4 and logical partition 5. New code should instead use
+  :option:`--image-opts` with the raw driver wrapping a subset of the
+  original image.
+
+.. option:: -B, --bitmap=NAME
+
+  If *filename* has a qcow2 persistent bitmap *NAME*, expose
+  that bitmap via the ``qemu:dirty-bitmap:NAME`` context
+  accessible through NBD_OPT_SET_META_CONTEXT.
+
+.. option:: -s, --snapshot
+
+  Use *filename* as an external snapshot, create a temporary
+  file with ``backing_file=``\ *filename*, redirect the write to
+  the temporary one.
+
+.. option:: -l, --load-snapshot=SNAPSHOT_PARAM
+
+  Load an internal snapshot inside *filename* and export it
+  as an read-only device, SNAPSHOT_PARAM format is
+  ``snapshot.id=[ID],snapshot.name=[NAME]`` or ``[ID_OR_NAME]``
+
+.. option:: --cache=CACHE
+
+  The cache mode to be used with the file.  See the documentation of
+  the emulator's ``-drive cache=...`` option for allowed values.
+
+.. option:: -n, --nocache
+
+  Equivalent to :option:`--cache=none`.
+
+.. option:: --aio=AIO
+
+  Set the asynchronous I/O mode between ``threads`` (the default)
+  and ``native`` (Linux only).
+
+.. option:: --discard=DISCARD
+
+  Control whether ``discard`` (also known as ``trim`` or ``unmap``)
+  requests are ignored or passed to the filesystem. *DISCARD* is one of
+  ``ignore`` (or ``off``), ``unmap`` (or ``on``).  The default is
+  ``ignore``.
+
+.. option:: --detect-zeroes=DETECT_ZEROES
+
+  Control the automatic conversion of plain zero writes by the OS to
+  driver-specific optimized zero write commands.  *DETECT_ZEROES* is one of
+  ``off``, ``on``, or ``unmap``.  ``unmap``
+  converts a zero write to an unmap operation and can only be used if
+  *DISCARD* is set to ``unmap``.  The default is ``off``.
+
+.. option:: -c, --connect=DEV
+
+  Connect *filename* to NBD device *DEV* (Linux only).
+
+.. option:: -d, --disconnect
+
+  Disconnect the device *DEV* (Linux only).
+
+.. option:: -e, --shared=NUM
+
+  Allow up to *NUM* clients to share the device (default
+  ``1``). Safe for readers, but for now, consistency is not
+  guaranteed between multiple writers.
+
+.. option:: -t, --persistent
+
+  Don't exit on the last connection.
+
+.. option:: -x, --export-name=NAME
+
+  Set the NBD volume export name (default of a zero-length string).
+
+.. option:: -D, --description=DESCRIPTION
+
+  Set the NBD volume export description, as a human-readable
+  string.
+
+.. option:: -L, --list
+
+  Connect as a client and list all details about the exports exposed by
+  a remote NBD server.  This enables list mode, and is incompatible
+  with options that change behavior related to a specific export (such as
+  :option:`--export-name`, :option:`--offset`, ...).
+
+.. option:: --tls-creds=ID
+
+  Enable mandatory TLS encryption for the server by setting the ID
+  of the TLS credentials object previously created with the --object
+  option; or provide the credentials needed for connecting as a client
+  in list mode.
+
+.. option:: --fork
+
+  Fork off the server process and exit the parent once the server is running.
+
+.. option:: --pid-file=PATH
+
+  Store the server's process ID in the given file.
+
+.. option:: --tls-authz=ID
+
+  Specify the ID of a qauthz object previously created with the
+  :option:`--object` option. This will be used to authorize connecting users
+  against their x509 distinguished name.
+
+.. option:: -v, --verbose
+
+  Display extra debugging information.
+
+.. option:: -h, --help
+
+  Display this help and exit.
+
+.. option:: -V, --version
+
+  Display version information and exit.
+
+.. option:: -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]
+
+  .. include:: qemu-option-trace.rst.inc
+
+Examples
+--------
+
+Start a server listening on port 10809 that exposes only the
+guest-visible contents of a qcow2 file, with no TLS encryption, and
+with the default export name (an empty string). The command is
+one-shot, and will block until the first successful client
+disconnects:
+
+::
+
+  qemu-nbd -f qcow2 file.qcow2
+
+Start a long-running server listening with encryption on port 10810,
+and whitelist clients with a specific X.509 certificate to connect to
+a 1 megabyte subset of a raw file, using the export name 'subset':
+
+::
+
+  qemu-nbd \
+    --object tls-creds-x509,id=tls0,endpoint=server,dir=/path/to/qemutls \
+    --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
+              O=Example Org,,L=London,,ST=London,,C=GB' \
+    --tls-creds tls0 --tls-authz auth0 \
+    -t -x subset -p 10810 \
+    --image-opts driver=raw,offset=1M,size=1M,file.driver=file,file.filename=file.raw
+
+Serve a read-only copy of just the first MBR partition of a guest
+image over a Unix socket with as many as 5 simultaneous readers, with
+a persistent process forked as a daemon:
+
+::
+
+  qemu-nbd --fork --persistent --shared=5 --socket=/path/to/sock \
+    --partition=1 --read-only --format=qcow2 file.qcow2
+
+Expose the guest-visible contents of a qcow2 file via a block device
+/dev/nbd0 (and possibly creating /dev/nbd0p1 and friends for
+partitions found within), then disconnect the device when done.
+Access to bind qemu-nbd to an /dev/nbd device generally requires root
+privileges, and may also require the execution of ``modprobe nbd``
+to enable the kernel NBD client module.  *CAUTION*: Do not use
+this method to mount filesystems from an untrusted guest image - a
+malicious guest may have prepared the image to attempt to trigger
+kernel bugs in partition probing or file system mounting.
+
+::
+
+  qemu-nbd -c /dev/nbd0 -f qcow2 file.qcow2
+  qemu-nbd -d /dev/nbd0
+
+Query a remote server to see details about what export(s) it is
+serving on port 10809, and authenticating via PSK:
+
+::
+
+  qemu-nbd \
+    --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=eblake,endpoint=client \
+    --tls-creds tls0 -L -b remote.example.com
+
+See also
+--------
+
+:manpage:`qemu(1)`, :manpage:`qemu-img(1)`
diff --git a/docs/interop/qemu-option-trace.rst.inc b/docs/interop/qemu-option-trace.rst.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/qemu-option-trace.rst.inc
@@ -XXX,XX +XXX,XX @@
+..
+  The contents of this file must be kept in sync with qemu-option-trace.texi
+  until all the users of the texi file have been converted to rst and
+  the texi file can be removed.
+
+Specify tracing options.
+
+.. option:: [enable=]PATTERN
+
+  Immediately enable events matching *PATTERN*
+  (either event name or a globbing pattern).  This option is only
+  available if QEMU has been compiled with the ``simple``, ``log``
+  or ``ftrace`` tracing backend.  To specify multiple events or patterns,
+  specify the :option:`-trace` option multiple times.
+
+  Use :option:`-trace help` to print a list of names of trace points.
+
+.. option:: events=FILE
+
+  Immediately enable events listed in *FILE*.
+  The file must contain one event name (as listed in the ``trace-events-all``
+  file) per line; globbing patterns are accepted too.  This option is only
+  available if QEMU has been compiled with the ``simple``, ``log`` or
+  ``ftrace`` tracing backend.
+
+.. option:: file=FILE
+
+  Log output traces to *FILE*.
+  This option is only available if QEMU has been compiled with
+  the ``simple`` tracing backend.
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ encrypted disk images.
 * disk_images_snapshot_mode:: Snapshot mode
 * vm_snapshots::              VM snapshots
 * qemu_img_invocation::       qemu-img Invocation
-* qemu_nbd_invocation::       qemu-nbd Invocation
 * disk_images_formats::       Disk image file formats
 * host_drives::               Using host drives
 * disk_images_fat_images::    Virtual FAT disk images
@@ -XXX,XX +XXX,XX @@ state is not saved or restored properly (in particular USB).
 
 @include qemu-img.texi
 
-@node qemu_nbd_invocation
-@subsection @code{qemu-nbd} Invocation
-
-@include qemu-nbd.texi
-
 @include docs/qemu-block-drivers.texi
 
 @node pcsys_network
diff --git a/qemu-nbd.texi b/qemu-nbd.texi
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/qemu-nbd.texi
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-@example
-@c man begin SYNOPSIS
-@command{qemu-nbd} [OPTION]... @var{filename}
-
-@command{qemu-nbd} @option{-L} [OPTION]...
-
-@command{qemu-nbd} @option{-d} @var{dev}
-@c man end
-@end example
-
-@c man begin DESCRIPTION
-
-Export a QEMU disk image using the NBD protocol.
-
-Other uses:
-@itemize
-@item
-Bind a /dev/nbdX block device to a QEMU server (on Linux).
-@item
-As a client to query exports of a remote NBD server.
-@end itemize
-
-@c man end
-
-@c man begin OPTIONS
-@var{filename} is a disk image filename, or a set of block
-driver options if @option{--image-opts} is specified.
-
-@var{dev} is an NBD device.
-
-@table @option
-@item --object type,id=@var{id},...props...
-Define a new instance of the @var{type} object class identified by @var{id}.
-See the @code{qemu(1)} manual page for full details of the properties
-supported. The common object types that it makes sense to define are the
-@code{secret} object, which is used to supply passwords and/or encryption
-keys, and the @code{tls-creds} object, which is used to supply TLS
-credentials for the qemu-nbd server or client.
-@item -p, --port=@var{port}
-The TCP port to listen on as a server, or connect to as a client
-(default @samp{10809}).
-@item -o, --offset=@var{offset}
-The offset into the image.
-@item -b, --bind=@var{iface}
-The interface to bind to as a server, or connect to as a client
-(default @samp{0.0.0.0}).
-@item -k, --socket=@var{path}
-Use a unix socket with path @var{path}.
-@item --image-opts
-Treat @var{filename} as a set of image options, instead of a plain
-filename. If this flag is specified, the @var{-f} flag should
-not be used, instead the '@code{format=}' option should be set.
-@item -f, --format=@var{fmt}
-Force the use of the block driver for format @var{fmt} instead of
-auto-detecting.
-@item -r, --read-only
-Export the disk as read-only.
-@item -P, --partition=@var{num}
-Deprecated: Only expose MBR partition @var{num}.  Understands physical
-partitions 1-4 and logical partition 5. New code should instead use
-@option{--image-opts} with the raw driver wrapping a subset of the
-original image.
-@item -B, --bitmap=@var{name}
-If @var{filename} has a qcow2 persistent bitmap @var{name}, expose
-that bitmap via the ``qemu:dirty-bitmap:@var{name}'' context
-accessible through NBD_OPT_SET_META_CONTEXT.
-@item -s, --snapshot
-Use @var{filename} as an external snapshot, create a temporary
-file with backing_file=@var{filename}, redirect the write to
-the temporary one.
-@item -l, --load-snapshot=@var{snapshot_param}
-Load an internal snapshot inside @var{filename} and export it
-as an read-only device, @var{snapshot_param} format is
-'snapshot.id=[ID],snapshot.name=[NAME]' or '[ID_OR_NAME]'
-@item -n, --nocache
-@itemx --cache=@var{cache}
-The cache mode to be used with the file.  See the documentation of
-the emulator's @code{-drive cache=...} option for allowed values.
-@item --aio=@var{aio}
-Set the asynchronous I/O mode between @samp{threads} (the default)
-and @samp{native} (Linux only).
-@item --discard=@var{discard}
-Control whether @dfn{discard} (also known as @dfn{trim} or @dfn{unmap})
-requests are ignored or passed to the filesystem.  @var{discard} is one of
-@samp{ignore} (or @samp{off}), @samp{unmap} (or @samp{on}).  The default is
-@samp{ignore}.
-@item --detect-zeroes=@var{detect-zeroes}
-Control the automatic conversion of plain zero writes by the OS to
-driver-specific optimized zero write commands.  @var{detect-zeroes} is one of
-@samp{off}, @samp{on} or @samp{unmap}.  @samp{unmap}
-converts a zero write to an unmap operation and can only be used if
-@var{discard} is set to @samp{unmap}.  The default is @samp{off}.
-@item -c, --connect=@var{dev}
-Connect @var{filename} to NBD device @var{dev} (Linux only).
-@item -d, --disconnect
-Disconnect the device @var{dev} (Linux only).
-@item -e, --shared=@var{num}
-Allow up to @var{num} clients to share the device (default
-@samp{1}). Safe for readers, but for now, consistency is not
-guaranteed between multiple writers.
-@item -t, --persistent
-Don't exit on the last connection.
-@item -x, --export-name=@var{name}
-Set the NBD volume export name (default of a zero-length string).
-@item -D, --description=@var{description}
-Set the NBD volume export description, as a human-readable
-string.
-@item -L, --list
-Connect as a client and list all details about the exports exposed by
-a remote NBD server.  This enables list mode, and is incompatible
-with options that change behavior related to a specific export (such as
-@option{--export-name}, @option{--offset}, ...).
-@item --tls-creds=ID
-Enable mandatory TLS encryption for the server by setting the ID
-of the TLS credentials object previously created with the --object
-option; or provide the credentials needed for connecting as a client
-in list mode.
-@item --fork
-Fork off the server process and exit the parent once the server is running.
-@item --pid-file=PATH
-Store the server's process ID in the given file.
-@item --tls-authz=ID
-Specify the ID of a qauthz object previously created with the
---object option. This will be used to authorize connecting users
-against their x509 distinguished name.
-@item -v, --verbose
-Display extra debugging information.
-@item -h, --help
-Display this help and exit.
-@item -V, --version
-Display version information and exit.
-@item -T, --trace [[enable=]@var{pattern}][,events=@var{file}][,file=@var{file}]
-@findex --trace
-@include qemu-option-trace.texi
-@end table
-
-@c man end
-
-@c man begin EXAMPLES
-Start a server listening on port 10809 that exposes only the
-guest-visible contents of a qcow2 file, with no TLS encryption, and
-with the default export name (an empty string). The command is
-one-shot, and will block until the first successful client
-disconnects:
-
-@example
-qemu-nbd -f qcow2 file.qcow2
-@end example
-
-Start a long-running server listening with encryption on port 10810,
-and whitelist clients with a specific X.509 certificate to connect to
-a 1 megabyte subset of a raw file, using the export name 'subset':
-
-@example
-qemu-nbd \
-  --object tls-creds-x509,id=tls0,endpoint=server,dir=/path/to/qemutls \
-  --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
-            O=Example Org,,L=London,,ST=London,,C=GB' \
-  --tls-creds tls0 --tls-authz auth0 \
-  -t -x subset -p 10810 \
-  --image-opts driver=raw,offset=1M,size=1M,file.driver=file,file.filename=file.raw
-@end example
-
-Serve a read-only copy of just the first MBR partition of a guest
-image over a Unix socket with as many as 5 simultaneous readers, with
-a persistent process forked as a daemon:
-
-@example
-qemu-nbd --fork --persistent --shared=5 --socket=/path/to/sock \
-  --partition=1 --read-only --format=qcow2 file.qcow2
-@end example
-
-Expose the guest-visible contents of a qcow2 file via a block device
-/dev/nbd0 (and possibly creating /dev/nbd0p1 and friends for
-partitions found within), then disconnect the device when done.
-Access to bind qemu-nbd to an /dev/nbd device generally requires root
-privileges, and may also require the execution of @code{modprobe nbd}
-to enable the kernel NBD client module.  @emph{CAUTION}: Do not use
-this method to mount filesystems from an untrusted guest image - a
-malicious guest may have prepared the image to attempt to trigger
-kernel bugs in partition probing or file system mounting.
-
-@example
-qemu-nbd -c /dev/nbd0 -f qcow2 file.qcow2
-qemu-nbd -d /dev/nbd0
-@end example
-
-Query a remote server to see details about what export(s) it is
-serving on port 10809, and authenticating via PSK:
-
-@example
-qemu-nbd \
-  --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=eblake,endpoint=client \
-  --tls-creds tls0 -L -b remote.example.com
-@end example
-
-@c man end
-
-@ignore
-
-@setfilename qemu-nbd
-@settitle QEMU Disk Network Block Device Server
-
-@c man begin AUTHOR
-Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>.
-This is free software; see the source for copying conditions.  There is NO
-warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-@c man end
-
-@c man begin SEEALSO
-qemu(1), qemu-img(1)
-@c man end
-
-@end ignore
diff --git a/qemu-option-trace.texi b/qemu-option-trace.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-option-trace.texi
+++ b/qemu-option-trace.texi
@@ -XXX,XX +XXX,XX @@
+@c The contents of this file must be kept in sync with qemu-option-trace.rst.inc
+@c until all the users of the texi file have been converted to rst and
+@c the texi file can be removed.
+
 Specify tracing options.
 
 @table @option
-- 
2.20.1

We want a user-facing manual which contains system emulation
documentation. Create an empty one which we can populate.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200116141511.16849-3-peter.maydell@linaro.org
---
 Makefile              | 10 +++++++++-
 docs/index.html.in    |  1 +
 docs/system/conf.py   | 15 +++++++++++++++
 docs/system/index.rst | 16 ++++++++++++++++
 4 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 docs/system/conf.py
 create mode 100644 docs/system/index.rst

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ distclean: clean
 	$(call clean-manual,devel)
 	$(call clean-manual,interop)
 	$(call clean-manual,specs)
+	$(call clean-manual,system)
 	for d in $(TARGET_DIRS); do \
 	rm -rf $$d || exit 1 ; \
         done
@@ -XXX,XX +XXX,XX @@ endef
 install-sphinxdocs: sphinxdocs
 	$(call install-manual,interop)
 	$(call install-manual,specs)
+	$(call install-manual,system)
 
 install-doc: $(DOCS) install-sphinxdocs
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)"
@@ -XXX,XX +XXX,XX @@ docs/version.texi: $(SRC_PATH)/VERSION config-host.mak
 # and handles "don't rebuild things unless necessary" itself.
 # The '.doctrees' files are cached information to speed this up.
 .PHONY: sphinxdocs
-sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index.html $(MANUAL_BUILDDIR)/specs/index.html
+sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html \
+            $(MANUAL_BUILDDIR)/interop/index.html \
+            $(MANUAL_BUILDDIR)/specs/index.html \
+            $(MANUAL_BUILDDIR)/system/index.html
 
 # Canned command to build a single manual
 # Arguments: $1 = manual name, $2 = Sphinx builder ('html' or 'man')
@@ -XXX,XX +XXX,XX @@ $(MANUAL_BUILDDIR)/interop/index.html: $(call manual-deps,interop)
 $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
 	$(call build-manual,specs,html)
 
+$(MANUAL_BUILDDIR)/system/index.html: $(call manual-deps,system)
+	$(call build-manual,system,html)
+
 $(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
 	$(call build-manual,interop,man)
 
diff --git a/docs/index.html.in b/docs/index.html.in
index XXXXXXX..XXXXXXX 100644
--- a/docs/index.html.in
+++ b/docs/index.html.in
@@ -XXX,XX +XXX,XX @@
             <li><a href="qemu-ga-ref.html">Guest Agent Protocol Reference</a></li>
             <li><a href="interop/index.html">System Emulation Management and Interoperability Guide</a></li>
             <li><a href="specs/index.html">System Emulation Guest Hardware Specifications</a></li>
+            <li><a href="system/index.html">System Emulation User's Guide</a></li>
         </ul>
     </body>
 </html>
diff --git a/docs/system/conf.py b/docs/system/conf.py
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/conf.py
@@ -XXX,XX +XXX,XX @@
+# -*- coding: utf-8 -*-
+#
+# QEMU documentation build configuration file for the 'system' manual.
+#
+# This includes the top level conf file and then makes any necessary tweaks.
+import sys
+import os
+
+qemu_docdir = os.path.abspath("..")
+parent_config = os.path.join(qemu_docdir, "conf.py")
+exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
+
+# This slightly misuses the 'description', but is the best way to get
+# the manual title to appear in the sidebar.
+html_theme_options['description'] = u'System Emulation User''s Guide'
diff --git a/docs/system/index.rst b/docs/system/index.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/index.rst
@@ -XXX,XX +XXX,XX @@
+.. This is the top level page for the 'system' manual.
+
+
+QEMU System Emulation User's Guide
+==================================
+
+This manual is the overall guide for users using QEMU
+for full system emulation (as opposed to user-mode emulation).
+This includes working with hypervisors such as KVM, Xen, Hax
+or Hypervisor.Framework.
+
+Contents:
+
+.. toctree::
+   :maxdepth: 2
+
-- 
2.20.1

The qemu-block-drivers documentation is currently in
docs/qemu-block-drivers.texi in Texinfo format, which we present
to the user as:
 * a qemu-block-drivers manpage
 * a section of the main qemu-doc HTML documentation

Convert the documentation to rST format, and present it to
the user as:
 * a qemu-block-drivers manpage
 * part of the system/ Sphinx manual

This follows the same pattern we've done for qemu-ga and qemu-nbd.

We have to drop a cross-reference from the documentation of the
-cdrom option back to the qemu-block-drivers documentation, since
they're no longer within the same texinfo document.

As noted in a comment, the manpage output is slightly compromised
due to limitations in Sphinx. In an ideal world, the HTML output
would have the various headings like 'Disk image file formats'
as top-level section headings (which then appear in the overall
system manual's table-of-contents), and it would not have the
section headings which make sense only for the manpage like
'synopsis', 'description', and 'see also'. Unfortunately, the
mechanism Sphinx provides for restricting pieces of documentation
is limited to the point of being flawed: the 'only::' directive
is implemented as a filter that is applied at a very late stage
in the document processing pipeline, rather than as an early
equivalent of an #ifdef. This means that Sphinx's process of
identifying which section heading markup styles are which levels
of heading gets confused if the 'only::' directive contains
section headings which would affect the heading-level of a
later heading. I have opted to prioritise making the HTML format
look better, with the compromise being that in the manpage
the 'Disk image file formats' &c headings are top-level headings
rather than being sub-headings under the traditional 'Description'
top-level section title.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200116141511.16849-4-peter.maydell@linaro.org
---
 Makefile                           |  11 +-
 docs/qemu-block-drivers.texi       | 889 --------------------------
 docs/system/conf.py                |   7 +
 docs/system/index.rst              |   1 +
 docs/system/qemu-block-drivers.rst | 985 +++++++++++++++++++++++++++++
 qemu-doc.texi                      |  12 -
 qemu-options.hx                    |   2 +-
 7 files changed, 1000 insertions(+), 907 deletions(-)
 delete mode 100644 docs/qemu-block-drivers.texi
 create mode 100644 docs/system/qemu-block-drivers.rst

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ ifdef BUILD_DOCS
 DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1
 DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-nbd.8
 DOCS+=$(MANUAL_BUILDDIR)/interop/qemu-ga.8
+DOCS+=$(MANUAL_BUILDDIR)/system/qemu-block-drivers.7
 DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
 DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
-DOCS+=docs/qemu-block-drivers.7
 DOCS+=docs/qemu-cpu-models.7
 DOCS+=$(MANUAL_BUILDDIR)/index.html
 ifdef CONFIG_VIRTFS
@@ -XXX,XX +XXX,XX @@ distclean: clean
 	rm -f docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
 	rm -f docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
 	rm -f docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
-	rm -f docs/qemu-block-drivers.7
 	rm -f docs/qemu-cpu-models.7
 	rm -rf .doctrees
 	$(call clean-manual,devel)
@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_POSIX
 	$(INSTALL_DATA) qemu.1 "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man7"
 	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.7 "$(DESTDIR)$(mandir)/man7"
-	$(INSTALL_DATA) docs/qemu-block-drivers.7 "$(DESTDIR)$(mandir)/man7"
+	$(INSTALL_DATA) $(MANUAL_BUILDDIR)/system/qemu-block-drivers.7 "$(DESTDIR)$(mandir)/man7"
 	$(INSTALL_DATA) docs/qemu-cpu-models.7 "$(DESTDIR)$(mandir)/man7"
 ifeq ($(CONFIG_TOOLS),y)
 	$(INSTALL_DATA) qemu-img.1 "$(DESTDIR)$(mandir)/man1"
@@ -XXX,XX +XXX,XX @@ $(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
 $(MANUAL_BUILDDIR)/interop/qemu-nbd.8: $(call manual-deps,interop)
 	$(call build-manual,interop,man)
 
+$(MANUAL_BUILDDIR)/system/qemu-block-drivers.7: $(call manual-deps,system)
+	$(call build-manual,system,man)
+
 $(MANUAL_BUILDDIR)/index.html: $(SRC_PATH)/docs/index.html.in qemu-version.h
 	@mkdir -p "$(MANUAL_BUILDDIR)"
 	$(call quiet-command, sed "s|@@VERSION@@|${VERSION}|g" $< >$@, \
@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
 qemu.1: qemu-option-trace.texi
 qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
 fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
-docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
 docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
 scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
 
@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-options.texi \
 	qemu-tech.texi qemu-option-trace.texi \
 	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
-	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
+	qemu-monitor-info.texi \
 	docs/qemu-cpu-models.texi docs/security.texi
 
 docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
diff --git a/docs/qemu-block-drivers.texi b/docs/qemu-block-drivers.texi
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/qemu-block-drivers.texi
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-@c man begin SYNOPSIS
-QEMU block driver reference manual
-@c man end
-
-@set qemu_system qemu-system-x86_64
-
-@c man begin DESCRIPTION
-
-@node disk_images_formats
-@subsection Disk image file formats
-
-QEMU supports many image file formats that can be used with VMs as well as with
-any of the tools (like @code{qemu-img}). This includes the preferred formats
-raw and qcow2 as well as formats that are supported for compatibility with
-older QEMU versions or other hypervisors.
-
-Depending on the image format, different options can be passed to
-@code{qemu-img create} and @code{qemu-img convert} using the @code{-o} option.
-This section describes each format and the options that are supported for it.
-
-@table @option
-@item raw
-
-Raw disk image format. This format has the advantage of
-being simple and easily exportable to all other emulators. If your
-file system supports @emph{holes} (for example in ext2 or ext3 on
-Linux or NTFS on Windows), then only the written sectors will reserve
-space. Use @code{qemu-img info} to know the real size used by the
-image or @code{ls -ls} on Unix/Linux.
-
-Supported options:
-@table @code
-@item preallocation
-Preallocation mode (allowed values: @code{off}, @code{falloc}, @code{full}).
-@code{falloc} mode preallocates space for image by calling posix_fallocate().
-@code{full} mode preallocates space for image by writing data to underlying
-storage.  This data may or may not be zero, depending on the storage location.
-@end table
-
-@item qcow2
-QEMU image format, the most versatile format. Use it to have smaller
-images (useful if your filesystem does not supports holes, for example
-on Windows), zlib based compression and support of multiple VM
-snapshots.
-
-Supported options:
-@table @code
-@item compat
-Determines the qcow2 version to use. @code{compat=0.10} uses the
-traditional image format that can be read by any QEMU since 0.10.
-@code{compat=1.1} enables image format extensions that only QEMU 1.1 and
-newer understand (this is the default). Amongst others, this includes
-zero clusters, which allow efficient copy-on-read for sparse images.
-
-@item backing_file
-File name of a base image (see @option{create} subcommand)
-@item backing_fmt
-Image format of the base image
-@item encryption
-This option is deprecated and equivalent to @code{encrypt.format=aes}
-
-@item encrypt.format
-
-If this is set to @code{luks}, it requests that the qcow2 payload (not
-qcow2 header) be encrypted using the LUKS format. The passphrase to
-use to unlock the LUKS key slot is given by the @code{encrypt.key-secret}
-parameter. LUKS encryption parameters can be tuned with the other
-@code{encrypt.*} parameters.
-
-If this is set to @code{aes}, the image is encrypted with 128-bit AES-CBC.
-The encryption key is given by the @code{encrypt.key-secret} parameter.
-This encryption format is considered to be flawed by modern cryptography
-standards, suffering from a number of design problems:
-
-@itemize @minus
-@item The AES-CBC cipher is used with predictable initialization vectors based
-on the sector number. This makes it vulnerable to chosen plaintext attacks
-which can reveal the existence of encrypted data.
-@item The user passphrase is directly used as the encryption key. A poorly
-chosen or short passphrase will compromise the security of the encryption.
-@item In the event of the passphrase being compromised there is no way to
-change the passphrase to protect data in any qcow images. The files must
-be cloned, using a different encryption passphrase in the new file. The
-original file must then be securely erased using a program like shred,
-though even this is ineffective with many modern storage technologies.
-@end itemize
-
-The use of this is no longer supported in system emulators. Support only
-remains in the command line utilities, for the purposes of data liberation
-and interoperability with old versions of QEMU. The @code{luks} format
-should be used instead.
-
-@item encrypt.key-secret
-
-Provides the ID of a @code{secret} object that contains the passphrase
-(@code{encrypt.format=luks}) or encryption key (@code{encrypt.format=aes}).
-
-@item encrypt.cipher-alg
-
-Name of the cipher algorithm and key length. Currently defaults
-to @code{aes-256}. Only used when @code{encrypt.format=luks}.
-
-@item encrypt.cipher-mode
-
-Name of the encryption mode to use. Currently defaults to @code{xts}.
-Only used when @code{encrypt.format=luks}.
-
-@item encrypt.ivgen-alg
-
-Name of the initialization vector generator algorithm. Currently defaults
-to @code{plain64}. Only used when @code{encrypt.format=luks}.
-
-@item encrypt.ivgen-hash-alg
-
-Name of the hash algorithm to use with the initialization vector generator
-(if required). Defaults to @code{sha256}. Only used when @code{encrypt.format=luks}.
-
-@item encrypt.hash-alg
-
-Name of the hash algorithm to use for PBKDF algorithm
-Defaults to @code{sha256}. Only used when @code{encrypt.format=luks}.
-
-@item encrypt.iter-time
-
-Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
-Defaults to @code{2000}. Only used when @code{encrypt.format=luks}.
-
-@item cluster_size
-Changes the qcow2 cluster size (must be between 512 and 2M). Smaller cluster
-sizes can improve the image file size whereas larger cluster sizes generally
-provide better performance.
-
-@item preallocation
-Preallocation mode (allowed values: @code{off}, @code{metadata}, @code{falloc},
-@code{full}). An image with preallocated metadata is initially larger but can
-improve performance when the image needs to grow. @code{falloc} and @code{full}
-preallocations are like the same options of @code{raw} format, but sets up
-metadata also.
-
-@item lazy_refcounts
-If this option is set to @code{on}, reference count updates are postponed with
-the goal of avoiding metadata I/O and improving performance. This is
-particularly interesting with @option{cache=writethrough} which doesn't batch
-metadata updates. The tradeoff is that after a host crash, the reference count
-tables must be rebuilt, i.e. on the next open an (automatic) @code{qemu-img
-check -r all} is required, which may take some time.
-
-This option can only be enabled if @code{compat=1.1} is specified.
-
-@item nocow
-If this option is set to @code{on}, it will turn off COW of the file. It's only
-valid on btrfs, no effect on other file systems.
-
-Btrfs has low performance when hosting a VM image file, even more when the guest
-on the VM also using btrfs as file system. Turning off COW is a way to mitigate
-this bad performance. Generally there are two ways to turn off COW on btrfs:
-a) Disable it by mounting with nodatacow, then all newly created files will be
-NOCOW. b) For an empty file, add the NOCOW file attribute. That's what this option
-does.
-
-Note: this option is only valid to new or empty files. If there is an existing
-file which is COW and has data blocks already, it couldn't be changed to NOCOW
-by setting @code{nocow=on}. One can issue @code{lsattr filename} to check if
-the NOCOW flag is set or not (Capital 'C' is NOCOW flag).
-
-@end table
-
-@item qed
-Old QEMU image format with support for backing files and compact image files
-(when your filesystem or transport medium does not support holes).
-
-When converting QED images to qcow2, you might want to consider using the
-@code{lazy_refcounts=on} option to get a more QED-like behaviour.
-
-Supported options:
-@table @code
-@item backing_file
-File name of a base image (see @option{create} subcommand).
-@item backing_fmt
-Image file format of backing file (optional).  Useful if the format cannot be
-autodetected because it has no header, like some vhd/vpc files.
-@item cluster_size
-Changes the cluster size (must be power-of-2 between 4K and 64K). Smaller
-cluster sizes can improve the image file size whereas larger cluster sizes
-generally provide better performance.
-@item table_size
-Changes the number of clusters per L1/L2 table (must be power-of-2 between 1
-and 16).  There is normally no need to change this value but this option can be
-used for performance benchmarking.
-@end table
-
-@item qcow
-Old QEMU image format with support for backing files, compact image files,
-encryption and compression.
-
-Supported options:
-@table @code
-@item backing_file
-File name of a base image (see @option{create} subcommand)
-@item encryption
-This option is deprecated and equivalent to @code{encrypt.format=aes}
-
-@item encrypt.format
-If this is set to @code{aes}, the image is encrypted with 128-bit AES-CBC.
-The encryption key is given by the @code{encrypt.key-secret} parameter.
-This encryption format is considered to be flawed by modern cryptography
-standards, suffering from a number of design problems enumerated previously
-against the @code{qcow2} image format.
-
-The use of this is no longer supported in system emulators. Support only
-remains in the command line utilities, for the purposes of data liberation
-and interoperability with old versions of QEMU.
-
-Users requiring native encryption should use the @code{qcow2} format
-instead with @code{encrypt.format=luks}.
-
-@item encrypt.key-secret
-
-Provides the ID of a @code{secret} object that contains the encryption
-key (@code{encrypt.format=aes}).
-
-@end table
-
-@item luks
-
-LUKS v1 encryption format, compatible with Linux dm-crypt/cryptsetup
-
-Supported options:
-@table @code
-
-@item key-secret
-
-Provides the ID of a @code{secret} object that contains the passphrase.
-
-@item cipher-alg
-
-Name of the cipher algorithm and key length. Currently defaults
-to @code{aes-256}.
-
-@item cipher-mode
-
-Name of the encryption mode to use. Currently defaults to @code{xts}.
-
-@item ivgen-alg
-
-Name of the initialization vector generator algorithm. Currently defaults
-to @code{plain64}.
-
-@item ivgen-hash-alg
-
-Name of the hash algorithm to use with the initialization vector generator
-(if required). Defaults to @code{sha256}.
-
-@item hash-alg
-
-Name of the hash algorithm to use for PBKDF algorithm
-Defaults to @code{sha256}.
-
-@item iter-time
-
-Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
-Defaults to @code{2000}.
-
-@end table
-
-@item vdi
-VirtualBox 1.1 compatible image format.
-Supported options:
-@table @code
-@item static
-If this option is set to @code{on}, the image is created with metadata
-preallocation.
-@end table
-
-@item vmdk
-VMware 3 and 4 compatible image format.
-
-Supported options:
-@table @code
-@item backing_file
-File name of a base image (see @option{create} subcommand).
-@item compat6
-Create a VMDK version 6 image (instead of version 4)
-@item hwversion
-Specify vmdk virtual hardware version. Compat6 flag cannot be enabled
-if hwversion is specified.
-@item subformat
-Specifies which VMDK subformat to use. Valid options are
-@code{monolithicSparse} (default),
-@code{monolithicFlat},
-@code{twoGbMaxExtentSparse},
-@code{twoGbMaxExtentFlat} and
-@code{streamOptimized}.
-@end table
-
-@item vpc
-VirtualPC compatible image format (VHD).
-Supported options:
-@table @code
-@item subformat
-Specifies which VHD subformat to use. Valid options are
-@code{dynamic} (default) and @code{fixed}.
-@end table
-
-@item VHDX
-Hyper-V compatible image format (VHDX).
-Supported options:
-@table @code
-@item subformat
-Specifies which VHDX subformat to use. Valid options are
-@code{dynamic} (default) and @code{fixed}.
-@item block_state_zero
-Force use of payload blocks of type 'ZERO'.  Can be set to @code{on} (default)
-or @code{off}.  When set to @code{off}, new blocks will be created as
-@code{PAYLOAD_BLOCK_NOT_PRESENT}, which means parsers are free to return
-arbitrary data for those blocks.  Do not set to @code{off} when using
-@code{qemu-img convert} with @code{subformat=dynamic}.
-@item block_size
-Block size; min 1 MB, max 256 MB.  0 means auto-calculate based on image size.
-@item log_size
-Log size; min 1 MB.
-@end table
-@end table
-
-@subsubsection Read-only formats
-More disk image file formats are supported in a read-only mode.
-@table @option
-@item bochs
-Bochs images of @code{growing} type.
-@item cloop
-Linux Compressed Loop image, useful only to reuse directly compressed
-CD-ROM images present for example in the Knoppix CD-ROMs.
-@item dmg
-Apple disk image.
-@item parallels
-Parallels disk image format.
-@end table
-
-
-@node host_drives
-@subsection Using host drives
-
-In addition to disk image files, QEMU can directly access host
-devices. We describe here the usage for QEMU version >= 0.8.3.
-
-@subsubsection Linux
-
-On Linux, you can directly use the host device filename instead of a
-disk image filename provided you have enough privileges to access
-it. For example, use @file{/dev/cdrom} to access to the CDROM.
-
-@table @code
-@item CD
-You can specify a CDROM device even if no CDROM is loaded. QEMU has
-specific code to detect CDROM insertion or removal. CDROM ejection by
-the guest OS is supported. Currently only data CDs are supported.
-@item Floppy
-You can specify a floppy device even if no floppy is loaded. Floppy
-removal is currently not detected accurately (if you change floppy
-without doing floppy access while the floppy is not loaded, the guest
-OS will think that the same floppy is loaded).
-Use of the host's floppy device is deprecated, and support for it will
-be removed in a future release.
-@item Hard disks
-Hard disks can be used. Normally you must specify the whole disk
-(@file{/dev/hdb} instead of @file{/dev/hdb1}) so that the guest OS can
-see it as a partitioned disk. WARNING: unless you know what you do, it
-is better to only make READ-ONLY accesses to the hard disk otherwise
-you may corrupt your host data (use the @option{-snapshot} command
-line option or modify the device permissions accordingly).
-@end table
-
-@subsubsection Windows
-
-@table @code
-@item CD
-The preferred syntax is the drive letter (e.g. @file{d:}). The
-alternate syntax @file{\\.\d:} is supported. @file{/dev/cdrom} is
-supported as an alias to the first CDROM drive.
-
-Currently there is no specific code to handle removable media, so it
-is better to use the @code{change} or @code{eject} monitor commands to
-change or eject media.
-@item Hard disks
-Hard disks can be used with the syntax: @file{\\.\PhysicalDrive@var{N}}
-where @var{N} is the drive number (0 is the first hard disk).
-
-WARNING: unless you know what you do, it is better to only make
-READ-ONLY accesses to the hard disk otherwise you may corrupt your
-host data (use the @option{-snapshot} command line so that the
-modifications are written in a temporary file).
-@end table
-
-
-@subsubsection Mac OS X
-
-@file{/dev/cdrom} is an alias to the first CDROM.
-
-Currently there is no specific code to handle removable media, so it
-is better to use the @code{change} or @code{eject} monitor commands to
-change or eject media.
-
-@node disk_images_fat_images
-@subsection Virtual FAT disk images
-
-QEMU can automatically create a virtual FAT disk image from a
-directory tree. In order to use it, just type:
-
-@example
-@value{qemu_system} linux.img -hdb fat:/my_directory
-@end example
-
-Then you access access to all the files in the @file{/my_directory}
-directory without having to copy them in a disk image or to export
-them via SAMBA or NFS. The default access is @emph{read-only}.
-
-Floppies can be emulated with the @code{:floppy:} option:
-
-@example
-@value{qemu_system} linux.img -fda fat:floppy:/my_directory
-@end example
-
-A read/write support is available for testing (beta stage) with the
-@code{:rw:} option:
-
-@example
-@value{qemu_system} linux.img -fda fat:floppy:rw:/my_directory
-@end example
-
-What you should @emph{never} do:
-@itemize
-@item use non-ASCII filenames ;
-@item use "-snapshot" together with ":rw:" ;
-@item expect it to work when loadvm'ing ;
-@item write to the FAT directory on the host system while accessing it with the guest system.
-@end itemize
-
-@node disk_images_nbd
-@subsection NBD access
-
-QEMU can access directly to block device exported using the Network Block Device
-protocol.
-
-@example
-@value{qemu_system} linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
-@end example
-
-If the NBD server is located on the same host, you can use an unix socket instead
-of an inet socket:
-
-@example
-@value{qemu_system} linux.img -hdb nbd+unix://?socket=/tmp/my_socket
-@end example
-
-In this case, the block device must be exported using qemu-nbd:
-
-@example
-qemu-nbd --socket=/tmp/my_socket my_disk.qcow2
-@end example
-
-The use of qemu-nbd allows sharing of a disk between several guests:
-@example
-qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
-@end example
-
-@noindent
-and then you can use it with two guests:
-@example
-@value{qemu_system} linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
-@value{qemu_system} linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
-@end example
-
-If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
-own embedded NBD server), you must specify an export name in the URI:
-@example
-@value{qemu_system} -cdrom nbd://localhost/debian-500-ppc-netinst
-@value{qemu_system} -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
-@end example
-
-The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
-also available.  Here are some example of the older syntax:
-@example
-@value{qemu_system} linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
-@value{qemu_system} linux2.img -hdb nbd:unix:/tmp/my_socket
-@value{qemu_system} -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
-@end example
-
-@node disk_images_sheepdog
-@subsection Sheepdog disk images
-
-Sheepdog is a distributed storage system for QEMU.  It provides highly
-available block level storage volumes that can be attached to
-QEMU-based virtual machines.
-
-You can create a Sheepdog disk image with the command:
-@example
-qemu-img create sheepdog:///@var{image} @var{size}
-@end example
-where @var{image} is the Sheepdog image name and @var{size} is its
-size.
-
-To import the existing @var{filename} to Sheepdog, you can use a
-convert command.
-@example
-qemu-img convert @var{filename} sheepdog:///@var{image}
-@end example
-
-You can boot from the Sheepdog disk image with the command:
-@example
-@value{qemu_system} sheepdog:///@var{image}
-@end example
-
-You can also create a snapshot of the Sheepdog image like qcow2.
-@example
-qemu-img snapshot -c @var{tag} sheepdog:///@var{image}
-@end example
-where @var{tag} is a tag name of the newly created snapshot.
-
-To boot from the Sheepdog snapshot, specify the tag name of the
-snapshot.
-@example
-@value{qemu_system} sheepdog:///@var{image}#@var{tag}
-@end example
-
-You can create a cloned image from the existing snapshot.
-@example
-qemu-img create -b sheepdog:///@var{base}#@var{tag} sheepdog:///@var{image}
-@end example
-where @var{base} is an image name of the source snapshot and @var{tag}
-is its tag name.
-
-You can use an unix socket instead of an inet socket:
-
-@example
-@value{qemu_system} sheepdog+unix:///@var{image}?socket=@var{path}
-@end example
-
-If the Sheepdog daemon doesn't run on the local host, you need to
-specify one of the Sheepdog servers to connect to.
-@example
-qemu-img create sheepdog://@var{hostname}:@var{port}/@var{image} @var{size}
-@value{qemu_system} sheepdog://@var{hostname}:@var{port}/@var{image}
-@end example
-
-@node disk_images_iscsi
-@subsection iSCSI LUNs
-
-iSCSI is a popular protocol used to access SCSI devices across a computer
-network.
-
-There are two different ways iSCSI devices can be used by QEMU.
-
-The first method is to mount the iSCSI LUN on the host, and make it appear as
-any other ordinary SCSI device on the host and then to access this device as a
-/dev/sd device from QEMU. How to do this differs between host OSes.
-
-The second method involves using the iSCSI initiator that is built into
-QEMU. This provides a mechanism that works the same way regardless of which
-host OS you are running QEMU on. This section will describe this second method
-of using iSCSI together with QEMU.
-
-In QEMU, iSCSI devices are described using special iSCSI URLs
-
-@example
-URL syntax:
-iscsi://[<username>[%<password>]@@]<host>[:<port>]/<target-iqn-name>/<lun>
-@end example
-
-Username and password are optional and only used if your target is set up
-using CHAP authentication for access control.
-Alternatively the username and password can also be set via environment
-variables to have these not show up in the process list
-
-@example
-export LIBISCSI_CHAP_USERNAME=<username>
-export LIBISCSI_CHAP_PASSWORD=<password>
-iscsi://<host>/<target-iqn-name>/<lun>
-@end example
-
-Various session related parameters can be set via special options, either
-in a configuration file provided via '-readconfig' or directly on the
-command line.
-
-If the initiator-name is not specified qemu will use a default name
-of 'iqn.2008-11.org.linux-kvm[:<uuid>'] where <uuid> is the UUID of the
-virtual machine. If the UUID is not specified qemu will use
-'iqn.2008-11.org.linux-kvm[:<name>'] where <name> is the name of the
-virtual machine.
-
-@example
-Setting a specific initiator name to use when logging in to the target
--iscsi initiator-name=iqn.qemu.test:my-initiator
-@end example
-
-@example
-Controlling which type of header digest to negotiate with the target
--iscsi header-digest=CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
-@end example
-
-These can also be set via a configuration file
-@example
-[iscsi]
-  user = "CHAP username"
-  password = "CHAP password"
-  initiator-name = "iqn.qemu.test:my-initiator"
-  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
-  header-digest = "CRC32C"
-@end example
-
-
-Setting the target name allows different options for different targets
-@example
-[iscsi "iqn.target.name"]
-  user = "CHAP username"
-  password = "CHAP password"
-  initiator-name = "iqn.qemu.test:my-initiator"
-  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
-  header-digest = "CRC32C"
-@end example
-
-
-Howto use a configuration file to set iSCSI configuration options:
-@example
-cat >iscsi.conf <<EOF
-[iscsi]
-  user = "me"
-  password = "my password"
-  initiator-name = "iqn.qemu.test:my-initiator"
-  header-digest = "CRC32C"
-EOF
-
-@value{qemu_system} -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
-    -readconfig iscsi.conf
-@end example
-
-
-How to set up a simple iSCSI target on loopback and access it via QEMU:
-@example
-This example shows how to set up an iSCSI target with one CDROM and one DISK
-using the Linux STGT software target. This target is available on Red Hat based
-systems as the package 'scsi-target-utils'.
-
-tgtd --iscsi portal=127.0.0.1:3260
-tgtadm --lld iscsi --op new --mode target --tid 1 -T iqn.qemu.test
-tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 1 \
-    -b /IMAGES/disk.img --device-type=disk
-tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \
-    -b /IMAGES/cd.iso --device-type=cd
-tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL
-
-@value{qemu_system} -iscsi initiator-name=iqn.qemu.test:my-initiator \
-    -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
-    -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
-@end example
-
-@node disk_images_gluster
-@subsection GlusterFS disk images
-
-GlusterFS is a user space distributed file system.
-
-You can boot from the GlusterFS disk image with the command:
-@example
-URI:
-@value{qemu_system} -drive file=gluster[+@var{type}]://[@var{host}[:@var{port}]]/@var{volume}/@var{path}
-                               [?socket=...][,file.debug=9][,file.logfile=...]
-
-JSON:
-@value{qemu_system} 'json:@{"driver":"qcow2",
-                           "file":@{"driver":"gluster",
-                                    "volume":"testvol","path":"a.img","debug":9,"logfile":"...",
-                                    "server":[@{"type":"tcp","host":"...","port":"..."@},
-                                              @{"type":"unix","socket":"..."@}]@}@}'
-@end example
-
-@var{gluster} is the protocol.
-
-@var{type} specifies the transport type used to connect to gluster
-management daemon (glusterd). Valid transport types are
-tcp and unix. In the URI form, if a transport type isn't specified,
-then tcp type is assumed.
-
-@var{host} specifies the server where the volume file specification for
-the given volume resides. This can be either a hostname or an ipv4 address.
-If transport type is unix, then @var{host} field should not be specified.
-Instead @var{socket} field needs to be populated with the path to unix domain
-socket.
-
-@var{port} is the port number on which glusterd is listening. This is optional
-and if not specified, it defaults to port 24007. If the transport type is unix,
-then @var{port} should not be specified.
-
-@var{volume} is the name of the gluster volume which contains the disk image.
-
-@var{path} is the path to the actual disk image that resides on gluster volume.
-
-@var{debug} is the logging level of the gluster protocol driver. Debug levels
-are 0-9, with 9 being the most verbose, and 0 representing no debugging output.
-The default level is 4. The current logging levels defined in the gluster source
-are 0 - None, 1 - Emergency, 2 - Alert, 3 - Critical, 4 - Error, 5 - Warning,
-6 - Notice, 7 - Info, 8 - Debug, 9 - Trace
-
-@var{logfile} is a commandline option to mention log file path which helps in
-logging to the specified file and also help in persisting the gfapi logs. The
-default is stderr.
-
-
-
-
-You can create a GlusterFS disk image with the command:
-@example
-qemu-img create gluster://@var{host}/@var{volume}/@var{path} @var{size}
-@end example
-
-Examples
-@example
-@value{qemu_system} -drive file=gluster://1.2.3.4/testvol/a.img
-@value{qemu_system} -drive file=gluster+tcp://1.2.3.4/testvol/a.img
-@value{qemu_system} -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
-@value{qemu_system} -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
-@value{qemu_system} -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
-@value{qemu_system} -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
-@value{qemu_system} -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
-@value{qemu_system} -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
-@value{qemu_system} -drive file=gluster://1.2.3.4/testvol/a.img,file.debug=9,file.logfile=/var/log/qemu-gluster.log
-@value{qemu_system} 'json:@{"driver":"qcow2",
-                           "file":@{"driver":"gluster",
-                                    "volume":"testvol","path":"a.img",
-                                    "debug":9,"logfile":"/var/log/qemu-gluster.log",
-                                    "server":[@{"type":"tcp","host":"1.2.3.4","port":24007@},
-                                              @{"type":"unix","socket":"/var/run/glusterd.socket"@}]@}@}'
-@value{qemu_system} -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
-                                       file.debug=9,file.logfile=/var/log/qemu-gluster.log,
-                                       file.server.0.type=tcp,file.server.0.host=1.2.3.4,file.server.0.port=24007,
-                                       file.server.1.type=unix,file.server.1.socket=/var/run/glusterd.socket
-@end example
-
-@node disk_images_ssh
-@subsection Secure Shell (ssh) disk images
-
-You can access disk images located on a remote ssh server
-by using the ssh protocol:
-
-@example
-@value{qemu_system} -drive file=ssh://[@var{user}@@]@var{server}[:@var{port}]/@var{path}[?host_key_check=@var{host_key_check}]
-@end example
-
-Alternative syntax using properties:
-
-@example
-@value{qemu_system} -drive file.driver=ssh[,file.user=@var{user}],file.host=@var{server}[,file.port=@var{port}],file.path=@var{path}[,file.host_key_check=@var{host_key_check}]
-@end example
-
-@var{ssh} is the protocol.
-
-@var{user} is the remote user.  If not specified, then the local
-username is tried.
-
-@var{server} specifies the remote ssh server.  Any ssh server can be
-used, but it must implement the sftp-server protocol.  Most Unix/Linux
-systems should work without requiring any extra configuration.
-
-@var{port} is the port number on which sshd is listening.  By default
-the standard ssh port (22) is used.
-
-@var{path} is the path to the disk image.
-
-The optional @var{host_key_check} parameter controls how the remote
-host's key is checked.  The default is @code{yes} which means to use
-the local @file{.ssh/known_hosts} file.  Setting this to @code{no}
-turns off known-hosts checking.  Or you can check that the host key
-matches a specific fingerprint:
-@code{host_key_check=md5:78:45:8e:14:57:4f:d5:45:83:0a:0e:f3:49:82:c9:c8}
-(@code{sha1:} can also be used as a prefix, but note that OpenSSH
-tools only use MD5 to print fingerprints).
-
-Currently authentication must be done using ssh-agent.  Other
-authentication methods may be supported in future.
-
-Note: Many ssh servers do not support an @code{fsync}-style operation.
-The ssh driver cannot guarantee that disk flush requests are
-obeyed, and this causes a risk of disk corruption if the remote
-server or network goes down during writes.  The driver will
-print a warning when @code{fsync} is not supported:
-
-warning: ssh server @code{ssh.example.com:22} does not support fsync
-
-With sufficiently new versions of libssh and OpenSSH, @code{fsync} is
-supported.
-
-@node disk_images_nvme
-@subsection NVMe disk images
-
-NVM Express (NVMe) storage controllers can be accessed directly by a userspace
-driver in QEMU.  This bypasses the host kernel file system and block layers
-while retaining QEMU block layer functionalities, such as block jobs, I/O
-throttling, image formats, etc.  Disk I/O performance is typically higher than
-with @code{-drive file=/dev/sda} using either thread pool or linux-aio.
-
-The controller will be exclusively used by the QEMU process once started. To be
-able to share storage between multiple VMs and other applications on the host,
-please use the file based protocols.
-
-Before starting QEMU, bind the host NVMe controller to the host vfio-pci
-driver.  For example:
-
-@example
-# modprobe vfio-pci
-# lspci -n -s 0000:06:0d.0
-06:0d.0 0401: 1102:0002 (rev 08)
-# echo 0000:06:0d.0 > /sys/bus/pci/devices/0000:06:0d.0/driver/unbind
-# echo 1102 0002 > /sys/bus/pci/drivers/vfio-pci/new_id
-
-# @value{qemu_system} -drive file=nvme://@var{host}:@var{bus}:@var{slot}.@var{func}/@var{namespace}
-@end example
-
-Alternative syntax using properties:
-
-@example
-@value{qemu_system} -drive file.driver=nvme,file.device=@var{host}:@var{bus}:@var{slot}.@var{func},file.namespace=@var{namespace}
-@end example
-
-@var{host}:@var{bus}:@var{slot}.@var{func} is the NVMe controller's PCI device
-address on the host.
-
-@var{namespace} is the NVMe namespace number, starting from 1.
-
-@node disk_image_locking
-@subsection Disk image file locking
-
-By default, QEMU tries to protect image files from unexpected concurrent
-access, as long as it's supported by the block protocol driver and host
-operating system. If multiple QEMU processes (including QEMU emulators and
-utilities) try to open the same image with conflicting accessing modes, all but
-the first one will get an error.
-
-This feature is currently supported by the file protocol on Linux with the Open
-File Descriptor (OFD) locking API, and can be configured to fall back to POSIX
-locking if the POSIX host doesn't support Linux OFD locking.
-
-To explicitly enable image locking, specify "locking=on" in the file protocol
-driver options. If OFD locking is not possible, a warning will be printed and
-the POSIX locking API will be used. In this case there is a risk that the lock
-will get silently lost when doing hot plugging and block jobs, due to the
-shortcomings of the POSIX locking API.
-
-QEMU transparently handles lock handover during shared storage migration.  For
-shared virtual disk images between multiple VMs, the "share-rw" device option
-should be used.
-
-By default, the guest has exclusive write access to its disk image. If the
-guest can safely share the disk image with other writers the @code{-device
-...,share-rw=on} parameter can be used.  This is only safe if the guest is
-running software, such as a cluster file system, that coordinates disk accesses
-to avoid corruption.
-
-Note that share-rw=on only declares the guest's ability to share the disk.
-Some QEMU features, such as image file formats, require exclusive write access
-to the disk image and this is unaffected by the share-rw=on option.
-
-Alternatively, locking can be fully disabled by "locking=off" block device
-option. In the command line, the option is usually in the form of
-"file.locking=off" as the protocol driver is normally placed as a "file" child
-under a format driver. For example:
-
-@code{-blockdev driver=qcow2,file.filename=/path/to/image,file.locking=off,file.driver=file}
-
-To check if image locking is active, check the output of the "lslocks" command
-on host and see if there are locks held by the QEMU process on the image file.
-More than one byte could be locked by the QEMU instance, each byte of which
-reflects a particular permission that is acquired or protected by the running
-block driver.
-
-@c man end
-
-@ignore
-
-@setfilename qemu-block-drivers
-@settitle QEMU block drivers reference
-
-@c man begin SEEALSO
-The HTML documentation of QEMU for more precise information and Linux
-user mode emulator invocation.
-@c man end
-
-@c man begin AUTHOR
-Fabrice Bellard and the QEMU Project developers
-@c man end
-
-@end ignore
diff --git a/docs/system/conf.py b/docs/system/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/conf.py
+++ b/docs/system/conf.py
@@ -XXX,XX +XXX,XX @@ exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 # This slightly misuses the 'description', but is the best way to get
 # the manual title to appear in the sidebar.
 html_theme_options['description'] = u'System Emulation User''s Guide'
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    ('qemu-block-drivers', 'qemu-block-drivers',
+     u'QEMU block drivers reference',
+     ['Fabrice Bellard and the QEMU Project developers'], 7)
+]
diff --git a/docs/system/index.rst b/docs/system/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/index.rst
+++ b/docs/system/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
 .. toctree::
    :maxdepth: 2
 
+   qemu-block-drivers
diff --git a/docs/system/qemu-block-drivers.rst b/docs/system/qemu-block-drivers.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/qemu-block-drivers.rst
@@ -XXX,XX +XXX,XX @@
+QEMU block drivers reference
+============================
+
+.. |qemu_system| replace:: qemu-system-x86_64
+
+..
+   We put the 'Synopsis' and 'See also' sections into the manpage, but not
+   the HTML. This makes the HTML docs read better and means the ToC in
+   the index has a more useful set of entries. Ideally, the section
+   headings 'Disk image file formats' would be top-level headings for
+   the HTML, but sub-headings of the conventional manpage 'Description'
+   header for the manpage. Unfortunately, due to deficiencies in
+   the Sphinx 'only' directive, this isn't possible: they must be headers
+   at the same level as 'Synopsis' and 'See also', otherwise Sphinx's
+   identification of which header underline style is which gets confused.
+
+.. only:: man
+
+  Synopsis
+  --------
+
+  QEMU block driver reference manual
+
+Disk image file formats
+-----------------------
+
+QEMU supports many image file formats that can be used with VMs as well as with
+any of the tools (like ``qemu-img``). This includes the preferred formats
+raw and qcow2 as well as formats that are supported for compatibility with
+older QEMU versions or other hypervisors.
+
+Depending on the image format, different options can be passed to
+``qemu-img create`` and ``qemu-img convert`` using the ``-o`` option.
+This section describes each format and the options that are supported for it.
+
+.. program:: image-formats
+.. option:: raw
+
+  Raw disk image format. This format has the advantage of
+  being simple and easily exportable to all other emulators. If your
+  file system supports *holes* (for example in ext2 or ext3 on
+  Linux or NTFS on Windows), then only the written sectors will reserve
+  space. Use ``qemu-img info`` to know the real size used by the
+  image or ``ls -ls`` on Unix/Linux.
+
+  Supported options:
+
+  .. program:: raw
+  .. option:: preallocation
+
+    Preallocation mode (allowed values: ``off``, ``falloc``,
+    ``full``). ``falloc`` mode preallocates space for image by
+    calling ``posix_fallocate()``. ``full`` mode preallocates space
+    for image by writing data to underlying storage. This data may or
+    may not be zero, depending on the storage location.
+
+.. program:: image-formats
+.. option:: qcow2
+
+  QEMU image format, the most versatile format. Use it to have smaller
+  images (useful if your filesystem does not supports holes, for example
+  on Windows), zlib based compression and support of multiple VM
+  snapshots.
+
+  Supported options:
+
+  .. program:: qcow2
+  .. option:: compat
+
+    Determines the qcow2 version to use. ``compat=0.10`` uses the
+    traditional image format that can be read by any QEMU since 0.10.
+    ``compat=1.1`` enables image format extensions that only QEMU 1.1 and
+    newer understand (this is the default). Amongst others, this includes
+    zero clusters, which allow efficient copy-on-read for sparse images.
+
+  .. option:: backing_file
+
+    File name of a base image (see ``create`` subcommand)
+
+  .. option:: backing_fmt
+
+    Image format of the base image
+
+  .. option:: encryption
+
+    This option is deprecated and equivalent to ``encrypt.format=aes``
+
+  .. option:: encrypt.format
+
+    If this is set to ``luks``, it requests that the qcow2 payload (not
+    qcow2 header) be encrypted using the LUKS format. The passphrase to
+    use to unlock the LUKS key slot is given by the ``encrypt.key-secret``
+    parameter. LUKS encryption parameters can be tuned with the other
+    ``encrypt.*`` parameters.
+
+    If this is set to ``aes``, the image is encrypted with 128-bit AES-CBC.
+    The encryption key is given by the ``encrypt.key-secret`` parameter.
+    This encryption format is considered to be flawed by modern cryptography
+    standards, suffering from a number of design problems:
+
+    - The AES-CBC cipher is used with predictable initialization vectors based
+      on the sector number. This makes it vulnerable to chosen plaintext attacks
+      which can reveal the existence of encrypted data.
+    - The user passphrase is directly used as the encryption key. A poorly
+      chosen or short passphrase will compromise the security of the encryption.
+    - In the event of the passphrase being compromised there is no way to
+      change the passphrase to protect data in any qcow images. The files must
+      be cloned, using a different encryption passphrase in the new file. The
+      original file must then be securely erased using a program like shred,
+      though even this is ineffective with many modern storage technologies.
+
+    The use of this is no longer supported in system emulators. Support only
+    remains in the command line utilities, for the purposes of data liberation
+    and interoperability with old versions of QEMU. The ``luks`` format
+    should be used instead.
+
+  .. option:: encrypt.key-secret
+
+    Provides the ID of a ``secret`` object that contains the passphrase
+    (``encrypt.format=luks``) or encryption key (``encrypt.format=aes``).
+
+  .. option:: encrypt.cipher-alg
+
+    Name of the cipher algorithm and key length. Currently defaults
+    to ``aes-256``. Only used when ``encrypt.format=luks``.
+
+  .. option:: encrypt.cipher-mode
+
+    Name of the encryption mode to use. Currently defaults to ``xts``.
+    Only used when ``encrypt.format=luks``.
+
+  .. option:: encrypt.ivgen-alg
+
+    Name of the initialization vector generator algorithm. Currently defaults
+    to ``plain64``. Only used when ``encrypt.format=luks``.
+
+  .. option:: encrypt.ivgen-hash-alg
+
+    Name of the hash algorithm to use with the initialization vector generator
+    (if required). Defaults to ``sha256``. Only used when ``encrypt.format=luks``.
+
+  .. option:: encrypt.hash-alg
+
+    Name of the hash algorithm to use for PBKDF algorithm
+    Defaults to ``sha256``. Only used when ``encrypt.format=luks``.
+
+  .. option:: encrypt.iter-time
+
+    Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
+    Defaults to ``2000``. Only used when ``encrypt.format=luks``.
+
+  .. option:: cluster_size
+
+    Changes the qcow2 cluster size (must be between 512 and 2M). Smaller cluster
+    sizes can improve the image file size whereas larger cluster sizes generally
+    provide better performance.
+
+  .. option:: preallocation
+
+    Preallocation mode (allowed values: ``off``, ``metadata``, ``falloc``,
+    ``full``). An image with preallocated metadata is initially larger but can
+    improve performance when the image needs to grow. ``falloc`` and ``full``
+    preallocations are like the same options of ``raw`` format, but sets up
+    metadata also.
+
+  .. option:: lazy_refcounts
+
+    If this option is set to ``on``, reference count updates are postponed with
+    the goal of avoiding metadata I/O and improving performance. This is
+    particularly interesting with :option:`cache=writethrough` which doesn't batch
+    metadata updates. The tradeoff is that after a host crash, the reference count
+    tables must be rebuilt, i.e. on the next open an (automatic) ``qemu-img
+    check -r all`` is required, which may take some time.
+
+    This option can only be enabled if ``compat=1.1`` is specified.
+
+  .. option:: nocow
+
+    If this option is set to ``on``, it will turn off COW of the file. It's only
+    valid on btrfs, no effect on other file systems.
+
+    Btrfs has low performance when hosting a VM image file, even more
+    when the guest on the VM also using btrfs as file system. Turning off
+    COW is a way to mitigate this bad performance. Generally there are two
+    ways to turn off COW on btrfs:
+
+    - Disable it by mounting with nodatacow, then all newly created files
+      will be NOCOW.
+    - For an empty file, add the NOCOW file attribute. That's what this
+      option does.
+
+    Note: this option is only valid to new or empty files. If there is
+    an existing file which is COW and has data blocks already, it couldn't
+    be changed to NOCOW by setting ``nocow=on``. One can issue ``lsattr
+    filename`` to check if the NOCOW flag is set or not (Capital 'C' is
+    NOCOW flag).
+
+.. program:: image-formats
+.. option:: qed
+
+   Old QEMU image format with support for backing files and compact image files
+   (when your filesystem or transport medium does not support holes).
+
+   When converting QED images to qcow2, you might want to consider using the
+   ``lazy_refcounts=on`` option to get a more QED-like behaviour.
+
+   Supported options:
+
+   .. program:: qed
+   .. option:: backing_file
+
+      File name of a base image (see ``create`` subcommand).
+
+   .. option:: backing_fmt
+
+     Image file format of backing file (optional).  Useful if the format cannot be
+     autodetected because it has no header, like some vhd/vpc files.
+
+   .. option:: cluster_size
+
+     Changes the cluster size (must be power-of-2 between 4K and 64K). Smaller
+     cluster sizes can improve the image file size whereas larger cluster sizes
+     generally provide better performance.
+
+   .. option:: table_size
+
+     Changes the number of clusters per L1/L2 table (must be
+     power-of-2 between 1 and 16).  There is normally no need to
+     change this value but this option can between used for
+     performance benchmarking.
+
+.. program:: image-formats
+.. option:: qcow
+
+  Old QEMU image format with support for backing files, compact image files,
+  encryption and compression.
+
+  Supported options:
+
+   .. program:: qcow
+   .. option:: backing_file
+
+     File name of a base image (see ``create`` subcommand)
+
+   .. option:: encryption
+
+     This option is deprecated and equivalent to ``encrypt.format=aes``
+
+   .. option:: encrypt.format
+
+     If this is set to ``aes``, the image is encrypted with 128-bit AES-CBC.
+     The encryption key is given by the ``encrypt.key-secret`` parameter.
+     This encryption format is considered to be flawed by modern cryptography
+     standards, suffering from a number of design problems enumerated previously
+     against the ``qcow2`` image format.
+
+     The use of this is no longer supported in system emulators. Support only
+     remains in the command line utilities, for the purposes of data liberation
+     and interoperability with old versions of QEMU.
+
+     Users requiring native encryption should use the ``qcow2`` format
+     instead with ``encrypt.format=luks``.
+
+   .. option:: encrypt.key-secret
+
+     Provides the ID of a ``secret`` object that contains the encryption
+     key (``encrypt.format=aes``).
+
+.. program:: image-formats
+.. option:: luks
+
+  LUKS v1 encryption format, compatible with Linux dm-crypt/cryptsetup
+
+  Supported options:
+
+  .. program:: luks
+  .. option:: key-secret
+
+    Provides the ID of a ``secret`` object that contains the passphrase.
+
+  .. option:: cipher-alg
+
+    Name of the cipher algorithm and key length. Currently defaults
+    to ``aes-256``.
+
+  .. option:: cipher-mode
+
+    Name of the encryption mode to use. Currently defaults to ``xts``.
+
+  .. option:: ivgen-alg
+
+    Name of the initialization vector generator algorithm. Currently defaults
+    to ``plain64``.
+
+  .. option:: ivgen-hash-alg
+
+    Name of the hash algorithm to use with the initialization vector generator
+    (if required). Defaults to ``sha256``.
+
+  .. option:: hash-alg
+
+    Name of the hash algorithm to use for PBKDF algorithm
+    Defaults to ``sha256``.
+
+  .. option:: iter-time
+
+    Amount of time, in milliseconds, to use for PBKDF algorithm per key slot.
+    Defaults to ``2000``.
+
+.. program:: image-formats
+.. option:: vdi
+
+  VirtualBox 1.1 compatible image format.
+
+  Supported options:
+
+  .. program:: vdi
+  .. option:: static
+
+    If this option is set to ``on``, the image is created with metadata
+    preallocation.
+
+.. program:: image-formats
+.. option:: vmdk
+
+  VMware 3 and 4 compatible image format.
+
+  Supported options:
+
+  .. program: vmdk
+  .. option:: backing_file
+
+    File name of a base image (see ``create`` subcommand).
+
+  .. option:: compat6
+
+    Create a VMDK version 6 image (instead of version 4)
+
+  .. option:: hwversion
+
+    Specify vmdk virtual hardware version. Compat6 flag cannot be enabled
+    if hwversion is specified.
+
+  .. option:: subformat
+
+    Specifies which VMDK subformat to use. Valid options are
+    ``monolithicSparse`` (default),
+    ``monolithicFlat``,
+    ``twoGbMaxExtentSparse``,
+    ``twoGbMaxExtentFlat`` and
+    ``streamOptimized``.
+
+.. program:: image-formats
+.. option:: vpc
+
+  VirtualPC compatible image format (VHD).
+
+  Supported options:
+
+  .. program:: vpc
+  .. option:: subformat
+
+    Specifies which VHD subformat to use. Valid options are
+    ``dynamic`` (default) and ``fixed``.
+
+.. program:: image-formats
+.. option:: VHDX
+
+  Hyper-V compatible image format (VHDX).
+
+  Supported options:
+
+  .. program:: VHDX
+  .. option:: subformat
+
+    Specifies which VHDX subformat to use. Valid options are
+    ``dynamic`` (default) and ``fixed``.
+
+    .. option:: block_state_zero
+
+      Force use of payload blocks of type 'ZERO'.  Can be set to ``on`` (default)
+      or ``off``.  When set to ``off``, new blocks will be created as
+      ``PAYLOAD_BLOCK_NOT_PRESENT``, which means parsers are free to return
+      arbitrary data for those blocks.  Do not set to ``off`` when using
+      ``qemu-img convert`` with ``subformat=dynamic``.
+
+    .. option:: block_size
+
+      Block size; min 1 MB, max 256 MB.  0 means auto-calculate based on
+      image size.
+
+    .. option:: log_size
+
+      Log size; min 1 MB.
+
+Read-only formats
+-----------------
+
+More disk image file formats are supported in a read-only mode.
+
+.. program:: image-formats
+.. option:: bochs
+
+  Bochs images of ``growing`` type.
+
+.. program:: image-formats
+.. option:: cloop
+
+  Linux Compressed Loop image, useful only to reuse directly compressed
+  CD-ROM images present for example in the Knoppix CD-ROMs.
+
+.. program:: image-formats
+.. option:: dmg
+
+  Apple disk image.
+
+.. program:: image-formats
+.. option:: parallels
+
+  Parallels disk image format.
+
+Using host drives
+-----------------
+
+In addition to disk image files, QEMU can directly access host
+devices. We describe here the usage for QEMU version >= 0.8.3.
+
+Linux
+'''''
+
+On Linux, you can directly use the host device filename instead of a
+disk image filename provided you have enough privileges to access
+it. For example, use ``/dev/cdrom`` to access to the CDROM.
+
+CD
+  You can specify a CDROM device even if no CDROM is loaded. QEMU has
+  specific code to detect CDROM insertion or removal. CDROM ejection by
+  the guest OS is supported. Currently only data CDs are supported.
+
+Floppy
+  You can specify a floppy device even if no floppy is loaded. Floppy
+  removal is currently not detected accurately (if you change floppy
+  without doing floppy access while the floppy is not loaded, the guest
+  OS will think that the same floppy is loaded).
+  Use of the host's floppy device is deprecated, and support for it will
+  be removed in a future release.
+
+Hard disks
+  Hard disks can be used. Normally you must specify the whole disk
+  (``/dev/hdb`` instead of ``/dev/hdb1``) so that the guest OS can
+  see it as a partitioned disk. WARNING: unless you know what you do, it
+  is better to only make READ-ONLY accesses to the hard disk otherwise
+  you may corrupt your host data (use the ``-snapshot`` command
+  line option or modify the device permissions accordingly).
+
+Windows
+'''''''
+
+CD
+  The preferred syntax is the drive letter (e.g. ``d:``). The
+  alternate syntax ``\\.\d:`` is supported. ``/dev/cdrom`` is
+  supported as an alias to the first CDROM drive.
+
+  Currently there is no specific code to handle removable media, so it
+  is better to use the ``change`` or ``eject`` monitor commands to
+  change or eject media.
+
+Hard disks
+  Hard disks can be used with the syntax: ``\\.\PhysicalDriveN``
+  where *N* is the drive number (0 is the first hard disk).
+
+  WARNING: unless you know what you do, it is better to only make
+  READ-ONLY accesses to the hard disk otherwise you may corrupt your
+  host data (use the ``-snapshot`` command line so that the
+  modifications are written in a temporary file).
+
+Mac OS X
+''''''''
+
+``/dev/cdrom`` is an alias to the first CDROM.
+
+Currently there is no specific code to handle removable media, so it
+is better to use the ``change`` or ``eject`` monitor commands to
+change or eject media.
+
+Virtual FAT disk images
+-----------------------
+
+QEMU can automatically create a virtual FAT disk image from a
+directory tree. In order to use it, just type:
+
+.. parsed-literal::
+
+  |qemu_system| linux.img -hdb fat:/my_directory
+
+Then you access access to all the files in the ``/my_directory``
+directory without having to copy them in a disk image or to export
+them via SAMBA or NFS. The default access is *read-only*.
+
+Floppies can be emulated with the ``:floppy:`` option:
+
+.. parsed-literal::
+
+  |qemu_system| linux.img -fda fat:floppy:/my_directory
+
+A read/write support is available for testing (beta stage) with the
+``:rw:`` option:
+
+.. parsed-literal::
+
+  |qemu_system| linux.img -fda fat:floppy:rw:/my_directory
+
+What you should *never* do:
+
+- use non-ASCII filenames
+- use "-snapshot" together with ":rw:"
+- expect it to work when loadvm'ing
+- write to the FAT directory on the host system while accessing it with the guest system
+
+NBD access
+----------
+
+QEMU can access directly to block device exported using the Network Block Device
+protocol.
+
+.. parsed-literal::
+
+  |qemu_system| linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
+
+If the NBD server is located on the same host, you can use an unix socket instead
+of an inet socket:
+
+.. parsed-literal::
+
+  |qemu_system| linux.img -hdb nbd+unix://?socket=/tmp/my_socket
+
+In this case, the block device must be exported using qemu-nbd:
+
+.. parsed-literal::
+
+  qemu-nbd --socket=/tmp/my_socket my_disk.qcow2
+
+The use of qemu-nbd allows sharing of a disk between several guests:
+
+.. parsed-literal::
+
+  qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
+
+and then you can use it with two guests:
+
+.. parsed-literal::
+
+  |qemu_system| linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
+  |qemu_system| linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
+
+If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
+own embedded NBD server), you must specify an export name in the URI:
+
+.. parsed-literal::
+
+  |qemu_system| -cdrom nbd://localhost/debian-500-ppc-netinst
+  |qemu_system| -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
+
+The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
+also available.  Here are some example of the older syntax:
+
+.. parsed-literal::
+
+  |qemu_system| linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
+  |qemu_system| linux2.img -hdb nbd:unix:/tmp/my_socket
+  |qemu_system| -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
+
+
+
+Sheepdog disk images
+--------------------
+
+Sheepdog is a distributed storage system for QEMU.  It provides highly
+available block level storage volumes that can be attached to
+QEMU-based virtual machines.
+
+You can create a Sheepdog disk image with the command:
+
+.. parsed-literal::
+
+  qemu-img create sheepdog:///IMAGE SIZE
+
+where *IMAGE* is the Sheepdog image name and *SIZE* is its
+size.
+
+To import the existing *FILENAME* to Sheepdog, you can use a
+convert command.
+
+.. parsed-literal::
+
+  qemu-img convert FILENAME sheepdog:///IMAGE
+
+You can boot from the Sheepdog disk image with the command:
+
+.. parsed-literal::
+
+  |qemu_system| sheepdog:///IMAGE
+
+You can also create a snapshot of the Sheepdog image like qcow2.
+
+.. parsed-literal::
+
+  qemu-img snapshot -c TAG sheepdog:///IMAGE
+
+where *TAG* is a tag name of the newly created snapshot.
+
+To boot from the Sheepdog snapshot, specify the tag name of the
+snapshot.
+
+.. parsed-literal::
+
+  |qemu_system| sheepdog:///IMAGE#TAG
+
+You can create a cloned image from the existing snapshot.
+
+.. parsed-literal::
+
+  qemu-img create -b sheepdog:///BASE#TAG sheepdog:///IMAGE
+
+where *BASE* is an image name of the source snapshot and *TAG*
+is its tag name.
+
+You can use an unix socket instead of an inet socket:
+
+.. parsed-literal::
+
+  |qemu_system| sheepdog+unix:///IMAGE?socket=PATH
+
+If the Sheepdog daemon doesn't run on the local host, you need to
+specify one of the Sheepdog servers to connect to.
+
+.. parsed-literal::
+
+  qemu-img create sheepdog://HOSTNAME:PORT/IMAGE SIZE
+  |qemu_system| sheepdog://HOSTNAME:PORT/IMAGE
+
+iSCSI LUNs
+----------
+
+iSCSI is a popular protocol used to access SCSI devices across a computer
+network.
+
+There are two different ways iSCSI devices can be used by QEMU.
+
+The first method is to mount the iSCSI LUN on the host, and make it appear as
+any other ordinary SCSI device on the host and then to access this device as a
+/dev/sd device from QEMU. How to do this differs between host OSes.
+
+The second method involves using the iSCSI initiator that is built into
+QEMU. This provides a mechanism that works the same way regardless of which
+host OS you are running QEMU on. This section will describe this second method
+of using iSCSI together with QEMU.
+
+In QEMU, iSCSI devices are described using special iSCSI URLs. URL syntax:
+
+::
+
+  iscsi://[<username>[%<password>]@]<host>[:<port>]/<target-iqn-name>/<lun>
+
+Username and password are optional and only used if your target is set up
+using CHAP authentication for access control.
+Alternatively the username and password can also be set via environment
+variables to have these not show up in the process list:
+
+::
+
+  export LIBISCSI_CHAP_USERNAME=<username>
+  export LIBISCSI_CHAP_PASSWORD=<password>
+  iscsi://<host>/<target-iqn-name>/<lun>
+
+Various session related parameters can be set via special options, either
+in a configuration file provided via '-readconfig' or directly on the
+command line.
+
+If the initiator-name is not specified qemu will use a default name
+of 'iqn.2008-11.org.linux-kvm[:<uuid>'] where <uuid> is the UUID of the
+virtual machine. If the UUID is not specified qemu will use
+'iqn.2008-11.org.linux-kvm[:<name>'] where <name> is the name of the
+virtual machine.
+
+Setting a specific initiator name to use when logging in to the target:
+
+::
+
+  -iscsi initiator-name=iqn.qemu.test:my-initiator
+
+Controlling which type of header digest to negotiate with the target:
+
+::
+
+  -iscsi header-digest=CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
+
+These can also be set via a configuration file:
+
+::
+
+  [iscsi]
+    user = "CHAP username"
+    password = "CHAP password"
+    initiator-name = "iqn.qemu.test:my-initiator"
+    # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
+    header-digest = "CRC32C"
+
+Setting the target name allows different options for different targets:
+
+::
+
+  [iscsi "iqn.target.name"]
+    user = "CHAP username"
+    password = "CHAP password"
+    initiator-name = "iqn.qemu.test:my-initiator"
+    # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
+    header-digest = "CRC32C"
+
+How to use a configuration file to set iSCSI configuration options:
+
+.. parsed-literal::
+
+  cat >iscsi.conf <<EOF
+  [iscsi]
+    user = "me"
+    password = "my password"
+    initiator-name = "iqn.qemu.test:my-initiator"
+    header-digest = "CRC32C"
+  EOF
+
+  |qemu_system| -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \\
+    -readconfig iscsi.conf
+
+How to set up a simple iSCSI target on loopback and access it via QEMU:
+this example shows how to set up an iSCSI target with one CDROM and one DISK
+using the Linux STGT software target. This target is available on Red Hat based
+systems as the package 'scsi-target-utils'.
+
+.. parsed-literal::
+
+  tgtd --iscsi portal=127.0.0.1:3260
+  tgtadm --lld iscsi --op new --mode target --tid 1 -T iqn.qemu.test
+  tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 1 \\
+      -b /IMAGES/disk.img --device-type=disk
+  tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \\
+      -b /IMAGES/cd.iso --device-type=cd
+  tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL
+
+  |qemu_system| -iscsi initiator-name=iqn.qemu.test:my-initiator \\
+    -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \\
+    -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
+
+GlusterFS disk images
+---------------------
+
+GlusterFS is a user space distributed file system.
+
+You can boot from the GlusterFS disk image with the command:
+
+URI:
+
+.. parsed-literal::
+
+  |qemu_system| -drive file=gluster[+TYPE]://[HOST}[:PORT]]/VOLUME/PATH
+                               [?socket=...][,file.debug=9][,file.logfile=...]
+
+JSON:
+
+.. parsed-literal::
+
+  |qemu_system| 'json:{"driver":"qcow2",
+                           "file":{"driver":"gluster",
+                                    "volume":"testvol","path":"a.img","debug":9,"logfile":"...",
+                                    "server":[{"type":"tcp","host":"...","port":"..."},
+                                              {"type":"unix","socket":"..."}]}}'
+
+*gluster* is the protocol.
+
+*TYPE* specifies the transport type used to connect to gluster
+management daemon (glusterd). Valid transport types are
+tcp and unix. In the URI form, if a transport type isn't specified,
+then tcp type is assumed.
+
+*HOST* specifies the server where the volume file specification for
+the given volume resides. This can be either a hostname or an ipv4 address.
+If transport type is unix, then *HOST* field should not be specified.
+Instead *socket* field needs to be populated with the path to unix domain
+socket.
+
+*PORT* is the port number on which glusterd is listening. This is optional
+and if not specified, it defaults to port 24007. If the transport type is unix,
+then *PORT* should not be specified.
+
+*VOLUME* is the name of the gluster volume which contains the disk image.
+
+*PATH* is the path to the actual disk image that resides on gluster volume.
+
+*debug* is the logging level of the gluster protocol driver. Debug levels
+are 0-9, with 9 being the most verbose, and 0 representing no debugging output.
+The default level is 4. The current logging levels defined in the gluster source
+are 0 - None, 1 - Emergency, 2 - Alert, 3 - Critical, 4 - Error, 5 - Warning,
+6 - Notice, 7 - Info, 8 - Debug, 9 - Trace
+
+*logfile* is a commandline option to mention log file path which helps in
+logging to the specified file and also help in persisting the gfapi logs. The
+default is stderr.
+
+You can create a GlusterFS disk image with the command:
+
+.. parsed-literal::
+
+  qemu-img create gluster://HOST/VOLUME/PATH SIZE
+
+Examples
+
+.. parsed-literal::
+
+  |qemu_system| -drive file=gluster://1.2.3.4/testvol/a.img
+  |qemu_system| -drive file=gluster+tcp://1.2.3.4/testvol/a.img
+  |qemu_system| -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
+  |qemu_system| -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
+  |qemu_system| -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
+  |qemu_system| -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
+  |qemu_system| -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
+  |qemu_system| -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
+  |qemu_system| -drive file=gluster://1.2.3.4/testvol/a.img,file.debug=9,file.logfile=/var/log/qemu-gluster.log
+  |qemu_system| 'json:{"driver":"qcow2",
+                           "file":{"driver":"gluster",
+                                    "volume":"testvol","path":"a.img",
+                                    "debug":9,"logfile":"/var/log/qemu-gluster.log",
+                                    "server":[{"type":"tcp","host":"1.2.3.4","port":24007},
+                                              {"type":"unix","socket":"/var/run/glusterd.socket"}]}}'
+  |qemu_system| -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
+                                       file.debug=9,file.logfile=/var/log/qemu-gluster.log,
+                                       file.server.0.type=tcp,file.server.0.host=1.2.3.4,file.server.0.port=24007,
+                                       file.server.1.type=unix,file.server.1.socket=/var/run/glusterd.socket
+
+Secure Shell (ssh) disk images
+------------------------------
+
+You can access disk images located on a remote ssh server
+by using the ssh protocol:
+
+.. parsed-literal::
+
+  |qemu_system| -drive file=ssh://[USER@]SERVER[:PORT]/PATH[?host_key_check=HOST_KEY_CHECK]
+
+Alternative syntax using properties:
+
+.. parsed-literal::
+
+  |qemu_system| -drive file.driver=ssh[,file.user=USER],file.host=SERVER[,file.port=PORT],file.path=PATH[,file.host_key_check=HOST_KEY_CHECK]
+
+*ssh* is the protocol.
+
+*USER* is the remote user.  If not specified, then the local
+username is tried.
+
+*SERVER* specifies the remote ssh server.  Any ssh server can be
+used, but it must implement the sftp-server protocol.  Most Unix/Linux
+systems should work without requiring any extra configuration.
+
+*PORT* is the port number on which sshd is listening.  By default
+the standard ssh port (22) is used.
+
+*PATH* is the path to the disk image.
+
+The optional *HOST_KEY_CHECK* parameter controls how the remote
+host's key is checked.  The default is ``yes`` which means to use
+the local ``.ssh/known_hosts`` file.  Setting this to ``no``
+turns off known-hosts checking.  Or you can check that the host key
+matches a specific fingerprint:
+``host_key_check=md5:78:45:8e:14:57:4f:d5:45:83:0a:0e:f3:49:82:c9:c8``
+(``sha1:`` can also be used as a prefix, but note that OpenSSH
+tools only use MD5 to print fingerprints).
+
+Currently authentication must be done using ssh-agent.  Other
+authentication methods may be supported in future.
+
+Note: Many ssh servers do not support an ``fsync``-style operation.
+The ssh driver cannot guarantee that disk flush requests are
+obeyed, and this causes a risk of disk corruption if the remote
+server or network goes down during writes.  The driver will
+print a warning when ``fsync`` is not supported:
+
+::
+
+  warning: ssh server ssh.example.com:22 does not support fsync
+
+With sufficiently new versions of libssh and OpenSSH, ``fsync`` is
+supported.
+
+NVMe disk images
+----------------
+
+NVM Express (NVMe) storage controllers can be accessed directly by a userspace
+driver in QEMU.  This bypasses the host kernel file system and block layers
+while retaining QEMU block layer functionalities, such as block jobs, I/O
+throttling, image formats, etc.  Disk I/O performance is typically higher than
+with ``-drive file=/dev/sda`` using either thread pool or linux-aio.
+
+The controller will be exclusively used by the QEMU process once started. To be
+able to share storage between multiple VMs and other applications on the host,
+please use the file based protocols.
+
+Before starting QEMU, bind the host NVMe controller to the host vfio-pci
+driver.  For example:
+
+.. parsed-literal::
+
+  # modprobe vfio-pci
+  # lspci -n -s 0000:06:0d.0
+  06:0d.0 0401: 1102:0002 (rev 08)
+  # echo 0000:06:0d.0 > /sys/bus/pci/devices/0000:06:0d.0/driver/unbind
+  # echo 1102 0002 > /sys/bus/pci/drivers/vfio-pci/new_id
+
+  # |qemu_system| -drive file=nvme://HOST:BUS:SLOT.FUNC/NAMESPACE
+
+Alternative syntax using properties:
+
+.. parsed-literal::
+
+  |qemu_system| -drive file.driver=nvme,file.device=HOST:BUS:SLOT.FUNC,file.namespace=NAMESPACE
+
+*HOST*:*BUS*:*SLOT*.\ *FUNC* is the NVMe controller's PCI device
+address on the host.
+
+*NAMESPACE* is the NVMe namespace number, starting from 1.
+
+Disk image file locking
+-----------------------
+
+By default, QEMU tries to protect image files from unexpected concurrent
+access, as long as it's supported by the block protocol driver and host
+operating system. If multiple QEMU processes (including QEMU emulators and
+utilities) try to open the same image with conflicting accessing modes, all but
+the first one will get an error.
+
+This feature is currently supported by the file protocol on Linux with the Open
+File Descriptor (OFD) locking API, and can be configured to fall back to POSIX
+locking if the POSIX host doesn't support Linux OFD locking.
+
+To explicitly enable image locking, specify "locking=on" in the file protocol
+driver options. If OFD locking is not possible, a warning will be printed and
+the POSIX locking API will be used. In this case there is a risk that the lock
+will get silently lost when doing hot plugging and block jobs, due to the
+shortcomings of the POSIX locking API.
+
+QEMU transparently handles lock handover during shared storage migration.  For
+shared virtual disk images between multiple VMs, the "share-rw" device option
+should be used.
+
+By default, the guest has exclusive write access to its disk image. If the
+guest can safely share the disk image with other writers the
+``-device ...,share-rw=on`` parameter can be used.  This is only safe if
+the guest is running software, such as a cluster file system, that
+coordinates disk accesses to avoid corruption.
+
+Note that share-rw=on only declares the guest's ability to share the disk.
+Some QEMU features, such as image file formats, require exclusive write access
+to the disk image and this is unaffected by the share-rw=on option.
+
+Alternatively, locking can be fully disabled by "locking=off" block device
+option. In the command line, the option is usually in the form of
+"file.locking=off" as the protocol driver is normally placed as a "file" child
+under a format driver. For example:
+
+::
+
+  -blockdev driver=qcow2,file.filename=/path/to/image,file.locking=off,file.driver=file
+
+To check if image locking is active, check the output of the "lslocks" command
+on host and see if there are locks held by the QEMU process on the image file.
+More than one byte could be locked by the QEMU instance, each byte of which
+reflects a particular permission that is acquired or protected by the running
+block driver.
+
+.. only:: man
+
+  See also
+  --------
+
+  The HTML documentation of QEMU for more precise information and Linux
+  user mode emulator invocation.
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ encrypted disk images.
 * disk_images_snapshot_mode:: Snapshot mode
 * vm_snapshots::              VM snapshots
 * qemu_img_invocation::       qemu-img Invocation
-* disk_images_formats::       Disk image file formats
-* host_drives::               Using host drives
-* disk_images_fat_images::    Virtual FAT disk images
-* disk_images_nbd::           NBD access
-* disk_images_sheepdog::      Sheepdog disk images
-* disk_images_iscsi::         iSCSI LUNs
-* disk_images_gluster::       GlusterFS disk images
-* disk_images_ssh::           Secure Shell (ssh) disk images
-* disk_images_nvme::          NVMe userspace driver
-* disk_image_locking::        Disk image file locking
 @end menu
 
 @node disk_images_quickstart
@@ -XXX,XX +XXX,XX @@ state is not saved or restored properly (in particular USB).
 
 @include qemu-img.texi
 
-@include docs/qemu-block-drivers.texi
-
 @node pcsys_network
 @section Network emulation
 
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ STEXI
 @findex -cdrom
 Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and
 @option{-cdrom} at the same time). You can use the host CD-ROM by
-using @file{/dev/cdrom} as filename (@pxref{host_drives}).
+using @file{/dev/cdrom} as filename.
 ETEXI
 
 DEF("blockdev", HAS_ARG, QEMU_OPTION_blockdev,
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

When dumping a guest with dump-guest-memory also dump the SVE
registers if they are in use.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200120101832.18781-1-drjones@redhat.com
[PMM: fixed checkpatch nits]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/elf.h          |   1 +
 target/arm/cpu.h       |  25 +++++++++
 target/arm/arch_dump.c | 124 ++++++++++++++++++++++++++++++++++++++++-
 target/arm/kvm64.c     |  24 --------
 4 files changed, 148 insertions(+), 26 deletions(-)

diff --git a/include/elf.h b/include/elf.h
index XXXXXXX..XXXXXXX 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -XXX,XX +XXX,XX @@ typedef struct elf64_shdr {
 #define NT_ARM_HW_BREAK 0x402           /* ARM hardware breakpoint registers */
 #define NT_ARM_HW_WATCH 0x403           /* ARM hardware watchpoint registers */
 #define NT_ARM_SYSTEM_CALL      0x404   /* ARM system call number */
+#define NT_ARM_SVE      0x405           /* ARM Scalable Vector Extension regs */
 
 /*
  * Physical entry point into the kernel.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
 void aarch64_sve_change_el(CPUARMState *env, int old_el,
                            int new_el, bool el0_a64);
 void aarch64_add_sve_properties(Object *obj);
+
+/*
+ * SVE registers are encoded in KVM's memory in an endianness-invariant format.
+ * The byte at offset i from the start of the in-memory representation contains
+ * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
+ * lowest offsets are stored in the lowest memory addresses, then that nearly
+ * matches QEMU's representation, which is to use an array of host-endian
+ * uint64_t's, where the lower offsets are at the lower indices. To complete
+ * the translation we just need to byte swap the uint64_t's on big-endian hosts.
+ */
+static inline uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
+{
+#ifdef HOST_WORDS_BIGENDIAN
+    int i;
+
+    for (i = 0; i < nr; ++i) {
+        dst[i] = bswap64(src[i]);
+    }
+
+    return dst;
+#else
+    return src;
+#endif
+}
+
 #else
 static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
 static inline void aarch64_sve_change_el(CPUARMState *env, int o,
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ struct aarch64_user_vfp_state {
 
 QEMU_BUILD_BUG_ON(sizeof(struct aarch64_user_vfp_state) != 528);
 
+/* struct user_sve_header from arch/arm64/include/uapi/asm/ptrace.h */
+struct aarch64_user_sve_header {
+    uint32_t size;
+    uint32_t max_size;
+    uint16_t vl;
+    uint16_t max_vl;
+    uint16_t flags;
+    uint16_t reserved;
+} QEMU_PACKED;
+
 struct aarch64_note {
     Elf64_Nhdr hdr;
     char name[8]; /* align_up(sizeof("CORE"), 4) */
     union {
         struct aarch64_elf_prstatus prstatus;
         struct aarch64_user_vfp_state vfp;
+        struct aarch64_user_sve_header sve;
     };
 } QEMU_PACKED;
 
@@ -XXX,XX +XXX,XX @@ struct aarch64_note {
             (AARCH64_NOTE_HEADER_SIZE + sizeof(struct aarch64_elf_prstatus))
 #define AARCH64_PRFPREG_NOTE_SIZE \
             (AARCH64_NOTE_HEADER_SIZE + sizeof(struct aarch64_user_vfp_state))
+#define AARCH64_SVE_NOTE_SIZE(env) \
+            (AARCH64_NOTE_HEADER_SIZE + sve_size(env))
 
 static void aarch64_note_init(struct aarch64_note *note, DumpState *s,
                               const char *name, Elf64_Word namesz,
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
     return 0;
 }
 
+#ifdef TARGET_AARCH64
+static off_t sve_zreg_offset(uint32_t vq, int n)
+{
+    off_t off = sizeof(struct aarch64_user_sve_header);
+    return ROUND_UP(off, 16) + vq * 16 * n;
+}
+
+static off_t sve_preg_offset(uint32_t vq, int n)
+{
+    return sve_zreg_offset(vq, 32) + vq * 16 / 8 * n;
+}
+
+static off_t sve_fpsr_offset(uint32_t vq)
+{
+    off_t off = sve_preg_offset(vq, 17);
+    return ROUND_UP(off, 16);
+}
+
+static off_t sve_fpcr_offset(uint32_t vq)
+{
+    return sve_fpsr_offset(vq) + sizeof(uint32_t);
+}
+
+static uint32_t sve_current_vq(CPUARMState *env)
+{
+    return sve_zcr_len_for_el(env, arm_current_el(env)) + 1;
+}
+
+static size_t sve_size_vq(uint32_t vq)
+{
+    off_t off = sve_fpcr_offset(vq) + sizeof(uint32_t);
+    return ROUND_UP(off, 16);
+}
+
+static size_t sve_size(CPUARMState *env)
+{
+    return sve_size_vq(sve_current_vq(env));
+}
+
+static int aarch64_write_elf64_sve(WriteCoreDumpFunction f,
+                                   CPUARMState *env, int cpuid,
+                                   DumpState *s)
+{
+    struct aarch64_note *note;
+    ARMCPU *cpu = env_archcpu(env);
+    uint32_t vq = sve_current_vq(env);
+    uint64_t tmp[ARM_MAX_VQ * 2], *r;
+    uint32_t fpr;
+    uint8_t *buf;
+    int ret, i;
+
+    note = g_malloc0(AARCH64_SVE_NOTE_SIZE(env));
+    buf = (uint8_t *)&note->sve;
+
+    aarch64_note_init(note, s, "LINUX", 6, NT_ARM_SVE, sve_size_vq(vq));
+
+    note->sve.size = cpu_to_dump32(s, sve_size_vq(vq));
+    note->sve.max_size = cpu_to_dump32(s, sve_size_vq(cpu->sve_max_vq));
+    note->sve.vl = cpu_to_dump16(s, vq * 16);
+    note->sve.max_vl = cpu_to_dump16(s, cpu->sve_max_vq * 16);
+    note->sve.flags = cpu_to_dump16(s, 1);
+
+    for (i = 0; i < 32; ++i) {
+        r = sve_bswap64(tmp, &env->vfp.zregs[i].d[0], vq * 2);
+        memcpy(&buf[sve_zreg_offset(vq, i)], r, vq * 16);
+    }
+
+    for (i = 0; i < 17; ++i) {
+        r = sve_bswap64(tmp, r = &env->vfp.pregs[i].p[0],
+                        DIV_ROUND_UP(vq * 2, 8));
+        memcpy(&buf[sve_preg_offset(vq, i)], r, vq * 16 / 8);
+    }
+
+    fpr = cpu_to_dump32(s, vfp_get_fpsr(env));
+    memcpy(&buf[sve_fpsr_offset(vq)], &fpr, sizeof(uint32_t));
+
+    fpr = cpu_to_dump32(s, vfp_get_fpcr(env));
+    memcpy(&buf[sve_fpcr_offset(vq)], &fpr, sizeof(uint32_t));
+
+    ret = f(note, AARCH64_SVE_NOTE_SIZE(env), s);
+    g_free(note);
+
+    if (ret < 0) {
+        return -1;
+    }
+
+    return 0;
+}
+#endif
+
 int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
                              int cpuid, void *opaque)
 {
     struct aarch64_note note;
-    CPUARMState *env = &ARM_CPU(cs)->env;
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
     DumpState *s = opaque;
     uint64_t pstate, sp;
     int ret, i;
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
         return -1;
     }
 
-    return aarch64_write_elf64_prfpreg(f, env, cpuid, s);
+    ret = aarch64_write_elf64_prfpreg(f, env, cpuid, s);
+    if (ret) {
+        return ret;
+    }
+
+#ifdef TARGET_AARCH64
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = aarch64_write_elf64_sve(f, env, cpuid, s);
+    }
+#endif
+
+    return ret;
 }
 
 /* struct pt_regs from arch/arm/include/asm/ptrace.h */
@@ -XXX,XX +XXX,XX @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
     if (class == ELFCLASS64) {
         note_size = AARCH64_PRSTATUS_NOTE_SIZE;
         note_size += AARCH64_PRFPREG_NOTE_SIZE;
+#ifdef TARGET_AARCH64
+        if (cpu_isar_feature(aa64_sve, cpu)) {
+            note_size += AARCH64_SVE_NOTE_SIZE(env);
+        }
+#endif
     } else {
         note_size = ARM_PRSTATUS_NOTE_SIZE;
         if (arm_feature(env, ARM_FEATURE_VFP)) {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_fpsimd(CPUState *cs)
     return 0;
 }
 
-/*
- * SVE registers are encoded in KVM's memory in an endianness-invariant format.
- * The byte at offset i from the start of the in-memory representation contains
- * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
- * lowest offsets are stored in the lowest memory addresses, then that nearly
- * matches QEMU's representation, which is to use an array of host-endian
- * uint64_t's, where the lower offsets are at the lower indices. To complete
- * the translation we just need to byte swap the uint64_t's on big-endian hosts.
- */
-static uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
-{
-#ifdef HOST_WORDS_BIGENDIAN
-    int i;
-
-    for (i = 0; i < nr; ++i) {
-        dst[i] = bswap64(src[i]);
-    }
-
-    return dst;
-#else
-    return src;
-#endif
-}
-
 /*
  * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
  * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Missed in 870c034da0b, hopefully reported by Coverity.

Fixes: Coverity CID 1412793 (Incorrect expression)
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200121213853.9601-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/stm32f4xx_syscfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/stm32f4xx_syscfg.c b/hw/misc/stm32f4xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f4xx_syscfg.c
+++ b/hw/misc/stm32f4xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f4xx_syscfg_set_irq(void *opaque, int irq, int level)
     STM32F4xxSyscfgState *s = opaque;
     int icrreg = irq / 4;
     int startbit = (irq & 3) * 4;
-    uint8_t config = config = irq / 16;
+    uint8_t config = irq / 16;
 
     trace_stm32f4xx_syscfg_set_irq(irq / 16, irq % 16, level);
 
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Replace debug logging code with tracing.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200123052540.6132-2-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/pl330.c      | 88 ++++++++++++++++++++++++---------------------
 hw/dma/trace-events | 24 +++++++++++++
 2 files changed, 72 insertions(+), 40 deletions(-)

diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl330.c
+++ b/hw/dma/pl330.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/dma.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
+#include "trace.h"
 
 #ifndef PL330_ERR_DEBUG
 #define PL330_ERR_DEBUG 0
 #endif
 
-#define DB_PRINT_L(lvl, fmt, args...) do {\
-    if (PL330_ERR_DEBUG >= lvl) {\
-        fprintf(stderr, "PL330: %s:" fmt, __func__, ## args);\
-    } \
-} while (0)
-
-#define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
-
 #define PL330_PERIPH_NUM            32
 #define PL330_MAX_BURST_LEN         128
 #define PL330_INSN_MAXSIZE          6
@@ -XXX,XX +XXX,XX @@ typedef struct PL330InsnDesc {
     void (*exec)(PL330Chan *, uint8_t opcode, uint8_t *args, int len);
 } PL330InsnDesc;
 
+static void pl330_hexdump(uint8_t *buf, size_t size)
+{
+    unsigned int b, i, len;
+    char tmpbuf[80];
+
+    for (b = 0; b < size; b += 16) {
+        len = size - b;
+        if (len > 16) {
+            len = 16;
+        }
+        tmpbuf[0] = '\0';
+        for (i = 0; i < len; i++) {
+            if ((i % 4) == 0) {
+                strcat(tmpbuf, " ");
+            }
+            sprintf(tmpbuf + strlen(tmpbuf), " %02x", buf[b + i]);
+        }
+        trace_pl330_hexdump(b, tmpbuf);
+    }
+}
 
 /* MFIFO Implementation
  *
@@ -XXX,XX +XXX,XX @@ static inline void pl330_queue_remove_tagged(PL330Queue *s, uint8_t tag)
 
 static inline void pl330_fault(PL330Chan *ch, uint32_t flags)
 {
-    DB_PRINT("ch: %p, flags: %" PRIx32 "\n", ch, flags);
+    trace_pl330_fault(ch, flags);
     ch->fault_type |= flags;
     if (ch->state == pl330_chan_fault) {
         return;
@@ -XXX,XX +XXX,XX @@ static inline void pl330_fault(PL330Chan *ch, uint32_t flags)
     ch->state = pl330_chan_fault;
     ch->parent->num_faulting++;
     if (ch->parent->num_faulting == 1) {
-        DB_PRINT("abort interrupt raised\n");
+        trace_pl330_fault_abort();
         qemu_irq_raise(ch->parent->irq_abort);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmaend(PL330Chan *ch, uint8_t opcode,
             return;
         }
     }
-    DB_PRINT("DMA ending!\n");
+    trace_pl330_dmaend();
     pl330_fifo_tagged_remove(&s->fifo, ch->tag);
     pl330_queue_remove_tagged(&s->read_queue, ch->tag);
     pl330_queue_remove_tagged(&s->write_queue, ch->tag);
@@ -XXX,XX +XXX,XX @@ static void pl330_dmago(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
     uint32_t pc;
     PL330Chan *s;
 
-    DB_PRINT("\n");
+    trace_pl330_dmago();
 
     if (!ch->is_manager) {
         pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
@@ -XXX,XX +XXX,XX @@ static void pl330_dmald(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
     ch->stall = pl330_queue_put_insn(&ch->parent->read_queue, ch->src,
                                     size, num, inc, 0, ch->tag);
     if (!ch->stall) {
-        DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
-                 " num:%" PRId32 " %c\n",
-                 ch->tag, ch->src, size, num, inc ? 'Y' : 'N');
+        trace_pl330_dmald(ch->tag, ch->src, size, num, inc ? 'Y' : 'N');
         ch->src += inc ? size * num - (ch->src & (size - 1)) : 0;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmakill(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
         ch->fault_type = 0;
         ch->parent->num_faulting--;
         if (ch->parent->num_faulting == 0) {
-            DB_PRINT("abort interrupt lowered\n");
+            trace_pl330_dmakill();
             qemu_irq_lower(ch->parent->irq_abort);
         }
     }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmalpend(PL330Chan *ch, uint8_t opcode,
     uint8_t bs = opcode & 3;
     uint8_t lc = (opcode & 4) >> 2;
 
+    trace_pl330_dmalpend(nf, bs, lc, ch->lc[lc], ch->request_flag);
+
     if (bs == 2) {
         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
         return;
@@ -XXX,XX +XXX,XX @@ static void pl330_dmalpend(PL330Chan *ch, uint8_t opcode,
         if (nf) {
             ch->lc[lc]--;
         }
-        DB_PRINT("loop reiteration\n");
+        trace_pl330_dmalpiter();
         ch->pc -= args[0];
         ch->pc -= len + 1;
         /* "ch->pc -= args[0] + len + 1" is incorrect when args[0] == 256 */
     } else {
-        DB_PRINT("loop fallthrough\n");
+        trace_pl330_dmalpfallthrough();
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void pl330_dmasev(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
     }
     if (ch->parent->inten & (1 << ev_id)) {
         ch->parent->int_status |= (1 << ev_id);
-        DB_PRINT("event interrupt raised %" PRId8 "\n", ev_id);
+        trace_pl330_dmasev_evirq(ev_id);
         qemu_irq_raise(ch->parent->irq[ev_id]);
     }
-    DB_PRINT("event raised %" PRId8 "\n", ev_id);
+    trace_pl330_dmasev_event(ev_id);
     ch->parent->ev_status |= (1 << ev_id);
 }
 
@@ -XXX,XX +XXX,XX @@ static void pl330_dmast(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
     ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
                                     size, num, inc, 0, ch->tag);
     if (!ch->stall) {
-        DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
-                 " num:%" PRId32 " %c\n",
-                 ch->tag, ch->dst, size, num, inc ? 'Y' : 'N');
+        trace_pl330_dmast(ch->tag, ch->dst, size, num, inc ? 'Y' : 'N');
         ch->dst += inc ? size * num - (ch->dst & (size - 1)) : 0;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void pl330_dmawfe(PL330Chan *ch, uint8_t opcode,
             }
         }
         ch->parent->ev_status &= ~(1 << ev_id);
-        DB_PRINT("event lowered %" PRIx8 "\n", ev_id);
+        trace_pl330_dmawfe(ev_id);
     } else {
         ch->stall = 1;
     }
@@ -XXX,XX +XXX,XX @@ static int pl330_chan_exec(PL330Chan *ch)
     ch->stall = 0;
     insn = pl330_fetch_insn(ch);
     if (!insn) {
-        DB_PRINT("pl330 undefined instruction\n");
+        trace_pl330_chan_exec_undef();
         pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static int pl330_exec_cycle(PL330Chan *channel)
         int len = q->len - (q->addr & (q->len - 1));
 
         dma_memory_read(&address_space_memory, q->addr, buf, len);
-        if (PL330_ERR_DEBUG > 1) {
-            DB_PRINT("PL330 read from memory @%08" PRIx32 " (size = %08x):\n",
-                      q->addr, len);
-            qemu_hexdump((char *)buf, stderr, "", len);
+        trace_pl330_exec_cycle(q->addr, len);
+        if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP)) {
+            pl330_hexdump(buf, len);
         }
         fifo_res = pl330_fifo_push(&s->fifo, buf, len, q->tag);
         if (fifo_res == PL330_FIFO_OK) {
@@ -XXX,XX +XXX,XX @@ static int pl330_exec_cycle(PL330Chan *channel)
         }
         if (fifo_res == PL330_FIFO_OK || q->z) {
             dma_memory_write(&address_space_memory, q->addr, buf, len);
-            if (PL330_ERR_DEBUG > 1) {
-                DB_PRINT("PL330 read from memory @%08" PRIx32
-                         " (size = %08x):\n", q->addr, len);
-                qemu_hexdump((char *)buf, stderr, "", len);
+            trace_pl330_exec_cycle(q->addr, len);
+            if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP)) {
+                pl330_hexdump(buf, len);
             }
             if (q->inc) {
                 q->addr += len;
@@ -XXX,XX +XXX,XX @@ static int pl330_exec_channel(PL330Chan *channel)
 
 static inline void pl330_exec(PL330State *s)
 {
-    DB_PRINT("\n");
     int i, insr_exec;
+    trace_pl330_exec();
     do {
         insr_exec = pl330_exec_channel(&s->manager);
 
@@ -XXX,XX +XXX,XX @@ static void pl330_debug_exec(PL330State *s)
     args[2] = (s->dbg[1] >>  8) & 0xff;
     args[3] = (s->dbg[1] >> 16) & 0xff;
     args[4] = (s->dbg[1] >> 24) & 0xff;
-    DB_PRINT("chan id: %" PRIx8 "\n", chan_id);
+    trace_pl330_debug_exec(chan_id);
     if (s->dbg[0] & 1) {
         ch = &s->chan[chan_id];
     } else {
@@ -XXX,XX +XXX,XX @@ static void pl330_debug_exec(PL330State *s)
         ch->fault_type |= PL330_FAULT_DBG_INSTR;
     }
     if (ch->stall) {
+        trace_pl330_debug_exec_stall();
         qemu_log_mask(LOG_UNIMP, "pl330: stall of debug instruction not "
                       "implemented\n");
     }
@@ -XXX,XX +XXX,XX @@ static void pl330_iomem_write(void *opaque, hwaddr offset,
     PL330State *s = (PL330State *) opaque;
     int i;
 
-    DB_PRINT("addr: %08x data: %08x\n", (unsigned)offset, (unsigned)value);
+    trace_pl330_iomem_write((unsigned)offset, (unsigned)value);
 
     switch (offset) {
     case PL330_REG_INTEN:
@@ -XXX,XX +XXX,XX @@ static void pl330_iomem_write(void *opaque, hwaddr offset,
     case PL330_REG_INTCLR:
         for (i = 0; i < s->num_events; i++) {
             if (s->int_status & s->inten & value & (1 << i)) {
-                DB_PRINT("event interrupt lowered %d\n", i);
+                trace_pl330_iomem_write_clr(i);
                 qemu_irq_lower(s->irq[i]);
             }
         }
@@ -XXX,XX +XXX,XX @@ static void pl330_iomem_write(void *opaque, hwaddr offset,
         }
         break;
     case PL330_REG_DBGINST0:
-        DB_PRINT("s->dbg[0] = %08x\n", (unsigned)value);
         s->dbg[0] = value;
         break;
     case PL330_REG_DBGINST1:
-        DB_PRINT("s->dbg[1] = %08x\n", (unsigned)value);
         s->dbg[1] = value;
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static uint64_t pl330_iomem_read(void *opaque, hwaddr offset,
         unsigned size)
 {
     uint32_t ret = pl330_iomem_read_imp(opaque, offset);
-    DB_PRINT("addr: %08" HWADDR_PRIx " data: %08" PRIx32 "\n", offset, ret);
+    trace_pl330_iomem_read((uint32_t)offset, ret);
     return ret;
 }
 
diff --git a/hw/dma/trace-events b/hw/dma/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/trace-events
+++ b/hw/dma/trace-events
@@ -XXX,XX +XXX,XX @@ sparc32_dma_enable_lower(void) "Lower DMA enable"
 
 # i8257.c
 i8257_unregistered_dma(int nchan, int dma_pos, int dma_len) "unregistered DMA channel used nchan=%d dma_pos=%d dma_len=%d"
+
+# pl330.c
+pl330_fault(void *ptr, uint32_t flags) "ch: %p, flags: 0x%"PRIx32
+pl330_fault_abort(void) "abort interrupt raised"
+pl330_dmaend(void) "DMA ending"
+pl330_dmago(void) "DMA run"
+pl330_dmald(uint32_t chan, uint32_t addr, uint32_t size, uint32_t num, uint32_t ch) "channel:%"PRId8" address:0x%08"PRIx32" size:0x%"PRIx32" num:%"PRId32"%c"
+pl330_dmakill(void) "abort interrupt lowered"
+pl330_dmalpend(uint8_t nf, uint8_t bs, uint8_t lc, uint8_t ch, uint8_t flag) "nf=0x%02x bs=0x%02x lc=0x%02x ch=0x%02x flag=0x%02x"
+pl330_dmalpiter(void) "loop reiteration"
+pl330_dmalpfallthrough(void) "loop fallthrough"
+pl330_dmasev_evirq(uint8_t ev_id) "event interrupt raised %"PRId8
+pl330_dmasev_event(uint8_t ev_id) "event raised %"PRId8
+pl330_dmast(uint32_t chn, uint32_t addr, uint32_t sz, uint32_t num, uint32_t c) "channel:%"PRId8" address:0x%08"PRIx32" size:0x%"PRIx32" num:%"PRId32" %c"
+pl330_dmawfe(uint8_t ev_id) "event lowered 0x%"PRIx8
+pl330_chan_exec_undef(void) "undefined instruction"
+pl330_exec_cycle(uint32_t addr, uint32_t size) "PL330 read from memory @0x%08"PRIx32" (size = 0x%08"PRIx32")"
+pl330_hexdump(uint32_t offset, char *str) " 0x%04"PRIx32":%s"
+pl330_exec(void) "pl330_exec"
+pl330_debug_exec(uint8_t ch) "chan id: 0x%"PRIx8
+pl330_debug_exec_stall(void) "stall of debug instruction not implemented"
+pl330_iomem_write(uint32_t offset, uint32_t value) "addr: 0x%08"PRIx32" data: 0x%08"PRIx32
+pl330_iomem_write_clr(int i) "event interrupt lowered %d"
+pl330_iomem_read(uint32_t addr, uint32_t data) "addr: 0x%08"PRIx32" data: 0x%08"PRIx32
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

First parameter to exynos4210_get_irq() is not the SPI port number,
but the interrupt group number. Interrupt groups are 20 for mdma
and 21 for pdma. Interrupts are not inverted. Controllers support 32
events (pdma) or 31 events (mdma). Events must all be routed to a single
interrupt line. Set other parameters as documented in Exynos4210 datasheet,
section 8 (DMA controller).

Fixes: 59520dc65e ("hw/arm/exynos4210: Add DMA support for the Exynos4210")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200123052540.6132-4-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  4 +++
 hw/arm/exynos4210.c         | 51 +++++++++++++++++++++++++++++++------
 2 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #ifndef EXYNOS4210_H
 #define EXYNOS4210_H
 
+#include "hw/or-irq.h"
 #include "hw/sysbus.h"
 #include "target/arm/cpu-qom.h"
 
@@ -XXX,XX +XXX,XX @@
 
 #define EXYNOS4210_I2C_NUMBER               9
 
+#define EXYNOS4210_NUM_DMA      3
+
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     MemoryRegion boot_secondary;
     MemoryRegion bootreg_mem;
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
+    qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
 } Exynos4210State;
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
-static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+static void pl330_create(uint32_t base, qemu_or_irq *orgate, qemu_irq irq,
+                         int nreq, int nevents, int width)
 {
     SysBusDevice *busdev;
     DeviceState *dev;
+    int i;
 
     dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_events", nevents);
+    qdev_prop_set_uint8(dev, "num_chnls",  8);
     qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+
+    qdev_prop_set_uint8(dev, "wr_cap", 4);
+    qdev_prop_set_uint8(dev, "wr_q_dep", 8);
+    qdev_prop_set_uint8(dev, "rd_cap", 4);
+    qdev_prop_set_uint8(dev, "rd_q_dep", 8);
+    qdev_prop_set_uint8(dev, "data_width", width);
+    qdev_prop_set_uint16(dev, "data_buffer_dep", width);
     qdev_init_nofail(dev);
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, base);
-    sysbus_connect_irq(busdev, 0, irq);
+
+    object_property_set_int(OBJECT(orgate), nevents + 1, "num-lines",
+                            &error_abort);
+    object_property_set_bool(OBJECT(orgate), true, "realized", &error_abort);
+
+    for (i = 0; i < nevents + 1; i++) {
+        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(DEVICE(orgate), i));
+    }
+    qdev_connect_gpio_out(DEVICE(orgate), 0, irq);
 }
 
 static void exynos4210_realize(DeviceState *socdev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
     /*** DMA controllers ***/
-    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
-                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
-    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
-                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
-    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
-                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR, &s->pl330_irq_orgate[0],
+                 s->irq_table[exynos4210_get_irq(21, 0)], 32, 32, 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR, &s->pl330_irq_orgate[1],
+                 s->irq_table[exynos4210_get_irq(21, 1)], 32, 32, 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR, &s->pl330_irq_orgate[2],
+                 s->irq_table[exynos4210_get_irq(20, 1)], 1, 31, 64);
+}
+
+static void exynos4210_init(Object *obj)
+{
+    Exynos4210State *s = EXYNOS4210_SOC(obj);
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->pl330_irq_orgate); i++) {
+        char *name = g_strdup_printf("pl330-irq-orgate%d", i);
+        qemu_or_irq *orgate = &s->pl330_irq_orgate[i];
+
+        object_initialize_child(obj, name, orgate, sizeof(*orgate),
+                                TYPE_OR_IRQ, &error_abort, NULL);
+        g_free(name);
+    }
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_info = {
     .name = TYPE_EXYNOS4210_SOC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210State),
+    .instance_init = exynos4210_init,
     .class_init = exynos4210_class_init,
 };
 
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Replace debug code with tracing to aid debugging.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200123052540.6132-5-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/exynos4210_uart.c | 96 ++++++++++++---------------------------
 hw/char/trace-events      | 17 +++++++
 2 files changed, 47 insertions(+), 66 deletions(-)

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 
-#undef DEBUG_UART
-#undef DEBUG_UART_EXTEND
-#undef DEBUG_IRQ
-#undef DEBUG_Rx_DATA
-#undef DEBUG_Tx_DATA
-
-#define DEBUG_UART            0
-#define DEBUG_UART_EXTEND     0
-#define DEBUG_IRQ             0
-#define DEBUG_Rx_DATA         0
-#define DEBUG_Tx_DATA         0
-
-#if DEBUG_UART
-#define  PRINT_DEBUG(fmt, args...)  \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-
-#if DEBUG_UART_EXTEND
-#define  PRINT_DEBUG_EXTEND(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-#define  PRINT_DEBUG_EXTEND(fmt, args...) \
-        do {} while (0)
-#endif /* EXTEND */
-
-#else
-#define  PRINT_DEBUG(fmt, args...)  \
-        do {} while (0)
-#define  PRINT_DEBUG_EXTEND(fmt, args...) \
-        do {} while (0)
-#endif
-
-#define  PRINT_ERROR(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
+#include "trace.h"
 
 /*
  *  Offsets for UART registers relative to SFR base address
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210UartState {
 } Exynos4210UartState;
 
 
-#if DEBUG_UART
-/* Used only for debugging inside PRINT_DEBUG_... macros */
+/* Used only for tracing */
 static const char *exynos4210_uart_regname(hwaddr  offset)
 {
 
@@ -XXX,XX +XXX,XX @@ static const char *exynos4210_uart_regname(hwaddr  offset)
 
     return NULL;
 }
-#endif
 
 
 static void fifo_store(Exynos4210UartFIFO *q, uint8_t ch)
@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState
         break;
     default:
         level = 0;
-        PRINT_ERROR("Wrong UART channel number: %d\n", s->channel);
+        trace_exynos_uart_channel_error(s->channel);
     }
 
     return level;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
 
     if (s->reg[I_(UINTP)]) {
         qemu_irq_raise(s->irq);
-
-#if DEBUG_IRQ
-        fprintf(stderr, "UART%d: IRQ has been raised: %08x\n",
-                s->channel, s->reg[I_(UINTP)]);
-#endif
-
+        trace_exynos_uart_irq_raised(s->channel, s->reg[I_(UINTP)]);
     } else {
         qemu_irq_lower(s->irq);
+        trace_exynos_uart_irq_lowered(s->channel);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_parameters(Exynos4210UartState *s)
 
     qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
 
-    PRINT_DEBUG("UART%d: speed: %d, parity: %c, data: %d, stop: %d\n",
+    trace_exynos_uart_update_params(
                 s->channel, speed, parity, data_bits, stop_bits);
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
     Exynos4210UartState *s = (Exynos4210UartState *)opaque;
     uint8_t ch;
 
-    PRINT_DEBUG_EXTEND("UART%d: <0x%04x> %s <- 0x%08llx\n", s->channel,
-        offset, exynos4210_uart_regname(offset), (long long unsigned int)val);
+    trace_exynos_uart_write(s->channel, offset,
+                            exynos4210_uart_regname(offset), val);
 
     switch (offset) {
     case ULCON:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
         if (val & UFCON_Rx_FIFO_RESET) {
             fifo_reset(&s->rx);
             s->reg[I_(UFCON)] &= ~UFCON_Rx_FIFO_RESET;
-            PRINT_DEBUG("UART%d: Rx FIFO Reset\n", s->channel);
+            trace_exynos_uart_rx_fifo_reset(s->channel);
         }
         if (val & UFCON_Tx_FIFO_RESET) {
             fifo_reset(&s->tx);
             s->reg[I_(UFCON)] &= ~UFCON_Tx_FIFO_RESET;
-            PRINT_DEBUG("UART%d: Tx FIFO Reset\n", s->channel);
+            trace_exynos_uart_tx_fifo_reset(s->channel);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
             /* XXX this blocks entire thread. Rewrite to use
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
-#if DEBUG_Tx_DATA
-            fprintf(stderr, "%c", ch);
-#endif
+            trace_exynos_uart_tx(s->channel, ch);
             s->reg[I_(UTRSTAT)] |= UTRSTAT_TRANSMITTER_EMPTY |
                     UTRSTAT_Tx_BUFFER_EMPTY;
             s->reg[I_(UINTSP)]  |= UINTSP_TXD;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
     case UINTP:
         s->reg[I_(UINTP)] &= ~val;
         s->reg[I_(UINTSP)] &= ~val;
-        PRINT_DEBUG("UART%d: UINTP [%04x] have been cleared: %08x\n",
-                    s->channel, offset, s->reg[I_(UINTP)]);
+        trace_exynos_uart_intclr(s->channel, s->reg[I_(UINTP)]);
         exynos4210_uart_update_irq(s);
         break;
     case UTRSTAT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
     case UFSTAT:
     case UMSTAT:
     case URXH:
-        PRINT_DEBUG("UART%d: Trying to write into RO register: %s [%04x]\n",
+        trace_exynos_uart_ro_write(
                     s->channel, exynos4210_uart_regname(offset), offset);
         break;
     case UINTSP:
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
     case UERSTAT: /* Read Only */
         res = s->reg[I_(UERSTAT)];
         s->reg[I_(UERSTAT)] = 0;
+        trace_exynos_uart_read(s->channel, offset,
+                               exynos4210_uart_regname(offset), res);
         return res;
     case UFSTAT: /* Read Only */
         s->reg[I_(UFSTAT)] = fifo_elements_number(&s->rx) & 0xff;
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
             s->reg[I_(UFSTAT)] |= UFSTAT_Rx_FIFO_FULL;
             s->reg[I_(UFSTAT)] &= ~0xff;
         }
+        trace_exynos_uart_read(s->channel, offset,
+                               exynos4210_uart_regname(offset),
+                               s->reg[I_(UFSTAT)]);
         return s->reg[I_(UFSTAT)];
     case URXH:
         if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) {
             if (fifo_elements_number(&s->rx)) {
                 res = fifo_retrieve(&s->rx);
-#if DEBUG_Rx_DATA
-                fprintf(stderr, "%c", res);
-#endif
+                trace_exynos_uart_rx(s->channel, res);
                 if (!fifo_elements_number(&s->rx)) {
                     s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY;
                 } else {
                     s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
                 }
             } else {
+                trace_exynos_uart_rx_error(s->channel);
                 s->reg[I_(UINTSP)] |= UINTSP_ERROR;
                 exynos4210_uart_update_irq(s);
                 res = 0;
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
             s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY;
             res = s->reg[I_(URXH)];
         }
+        trace_exynos_uart_read(s->channel, offset,
+                               exynos4210_uart_regname(offset), res);
         return res;
     case UTXH:
-        PRINT_DEBUG("UART%d: Trying to read from WO register: %s [%04x]\n",
-                    s->channel, exynos4210_uart_regname(offset), offset);
+        trace_exynos_uart_wo_read(s->channel, exynos4210_uart_regname(offset),
+                                  offset);
         break;
     default:
+        trace_exynos_uart_read(s->channel, offset,
+                               exynos4210_uart_regname(offset),
+                               s->reg[I_(offset)]);
         return s->reg[I_(offset)];
     }
 
+    trace_exynos_uart_read(s->channel, offset, exynos4210_uart_regname(offset),
+                           0);
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_reset(DeviceState *dev)
     fifo_reset(&s->rx);
     fifo_reset(&s->tx);
 
-    PRINT_DEBUG("UART%d: Rx FIFO size: %d\n", s->channel, s->rx.size);
+    trace_exynos_uart_rxsize(s->channel, s->rx.size);
 }
 
 static const VMStateDescription vmstate_exynos4210_uart_fifo = {
diff --git a/hw/char/trace-events b/hw/char/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
 # nrf51_uart.c
 nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
 nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
+
+# exynos4210_uart.c
+exynos_uart_irq_raised(uint32_t channel, uint32_t reg) "UART%d: IRQ raised: 0x%08"PRIx32
+exynos_uart_irq_lowered(uint32_t channel) "UART%d: IRQ lowered"
+exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d"
+exynos_uart_write(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s <- 0x%" PRIx64
+exynos_uart_read(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s -> 0x%" PRIx64
+exynos_uart_rx_fifo_reset(uint32_t channel) "UART%d: Rx FIFO Reset"
+exynos_uart_tx_fifo_reset(uint32_t channel) "UART%d: Tx FIFO Reset"
+exynos_uart_tx(uint32_t channel, uint8_t ch) "UART%d: Tx 0x%02"PRIx32
+exynos_uart_intclr(uint32_t channel, uint32_t reg) "UART%d: interrupts cleared: 0x%08"PRIx32
+exynos_uart_ro_write(uint32_t channel, const char *name, uint32_t reg) "UART%d: Trying to write into RO register: %s [0x%04"PRIx32"]"
+exynos_uart_rx(uint32_t channel, uint8_t ch) "UART%d: Rx 0x%02"PRIx32
+exynos_uart_rx_error(uint32_t channel) "UART%d: Rx error"
+exynos_uart_wo_read(uint32_t channel, const char *name, uint32_t reg) "UART%d: Trying to read from WO register: %s [0x%04"PRIx32"]"
+exynos_uart_rxsize(uint32_t channel, uint32_t size) "UART%d: Rx FIFO size: %d"
+exynos_uart_channel_error(uint32_t channel) "Wrong UART channel number: %d"
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

After restoring a VM, serial parameters need to be updated to reflect
restored register values. Implement a post_load function to handle this
situation.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200123052540.6132-6-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/exynos4210_uart.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_reset(DeviceState *dev)
     trace_exynos_uart_rxsize(s->channel, s->rx.size);
 }
 
+static int exynos4210_uart_post_load(void *opaque, int version_id)
+{
+    Exynos4210UartState *s = (Exynos4210UartState *)opaque;
+
+    exynos4210_uart_update_parameters(s);
+
+    return 0;
+}
+
 static const VMStateDescription vmstate_exynos4210_uart_fifo = {
     .name = "exynos4210.uart.fifo",
     .version_id = 1,
     .minimum_version_id = 1,
+    .post_load = exynos4210_uart_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(sp, Exynos4210UartFIFO),
         VMSTATE_UINT32(rp, Exynos4210UartFIFO),
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

The driver already implements a receive FIFO, but it does not
handle receive FIFO trigger levels and timeout. Implement the
missing functionality.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200123052540.6132-7-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/exynos4210_uart.c | 117 ++++++++++++++++++++++++++++++--------
 hw/char/trace-events      |   3 +-
 2 files changed, 94 insertions(+), 26 deletions(-)

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "qemu/error-report.h"
 #include "qemu/module.h"
+#include "qemu/timer.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 
@@ -XXX,XX +XXX,XX @@ static const Exynos4210UartReg exynos4210_uart_regs[] = {
 #define ULCON_STOP_BIT_SHIFT  1
 
 /* UART Tx/Rx Status */
+#define UTRSTAT_Rx_TIMEOUT              0x8
 #define UTRSTAT_TRANSMITTER_EMPTY       0x4
 #define UTRSTAT_Tx_BUFFER_EMPTY         0x2
 #define UTRSTAT_Rx_BUFFER_DATA_READY    0x1
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210UartState {
     Exynos4210UartFIFO   rx;
     Exynos4210UartFIFO   tx;
 
+    QEMUTimer *fifo_timeout_timer;
+    uint64_t wordtime;        /* word time in ns */
+
     CharBackend       chr;
     qemu_irq          irq;
 
@@ -XXX,XX +XXX,XX @@ static void fifo_reset(Exynos4210UartFIFO *q)
     q->rp = 0;
 }
 
-static uint32_t exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState *s)
+static uint32_t exynos4210_uart_FIFO_trigger_level(uint32_t channel,
+                                                   uint32_t reg)
 {
-    uint32_t level = 0;
-    uint32_t reg;
+    uint32_t level;
 
-    reg = (s->reg[I_(UFCON)] & UFCON_Tx_FIFO_TRIGGER_LEVEL) >>
-            UFCON_Tx_FIFO_TRIGGER_LEVEL_SHIFT;
-
-    switch (s->channel) {
+    switch (channel) {
     case 0:
         level = reg * 32;
         break;
@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState
         break;
     default:
         level = 0;
-        trace_exynos_uart_channel_error(s->channel);
+        trace_exynos_uart_channel_error(channel);
+        break;
     }
-
     return level;
 }
 
+static uint32_t
+exynos4210_uart_Tx_FIFO_trigger_level(const Exynos4210UartState *s)
+{
+    uint32_t reg;
+
+    reg = (s->reg[I_(UFCON)] & UFCON_Tx_FIFO_TRIGGER_LEVEL) >>
+            UFCON_Tx_FIFO_TRIGGER_LEVEL_SHIFT;
+
+    return exynos4210_uart_FIFO_trigger_level(s->channel, reg);
+}
+
+static uint32_t
+exynos4210_uart_Rx_FIFO_trigger_level(const Exynos4210UartState *s)
+{
+    uint32_t reg;
+
+    reg = ((s->reg[I_(UFCON)] & UFCON_Rx_FIFO_TRIGGER_LEVEL) >>
+            UFCON_Rx_FIFO_TRIGGER_LEVEL_SHIFT) + 1;
+
+    return exynos4210_uart_FIFO_trigger_level(s->channel, reg);
+}
+
 static void exynos4210_uart_update_irq(Exynos4210UartState *s)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
      * transmit FIFO is smaller than the trigger level.
      */
     if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) {
-
         uint32_t count = (s->reg[I_(UFSTAT)] & UFSTAT_Tx_FIFO_COUNT) >>
                 UFSTAT_Tx_FIFO_COUNT_SHIFT;
 
         if (count <= exynos4210_uart_Tx_FIFO_trigger_level(s)) {
             s->reg[I_(UINTSP)] |= UINTSP_TXD;
         }
+
+        /*
+         * Rx interrupt if trigger level is reached or if rx timeout
+         * interrupt is disabled and there is data in the receive buffer
+         */
+        count = fifo_elements_number(&s->rx);
+        if ((count && !(s->reg[I_(UCON)] & 0x80)) ||
+            count >= exynos4210_uart_Rx_FIFO_trigger_level(s)) {
+            s->reg[I_(UINTSP)] |= UINTSP_RXD;
+            timer_del(s->fifo_timeout_timer);
+        }
+    } else if (s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY) {
+        s->reg[I_(UINTSP)] |= UINTSP_RXD;
     }
 
     s->reg[I_(UINTP)] = s->reg[I_(UINTSP)] & ~s->reg[I_(UINTM)];
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
     }
 }
 
+static void exynos4210_uart_timeout_int(void *opaque)
+{
+    Exynos4210UartState *s = opaque;
+
+    trace_exynos_uart_rx_timeout(s->channel, s->reg[I_(UTRSTAT)],
+                                 s->reg[I_(UINTSP)]);
+
+    if ((s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY) ||
+        (s->reg[I_(UCON)] & (1 << 11))) {
+        s->reg[I_(UINTSP)] |= UINTSP_RXD;
+        s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_TIMEOUT;
+        exynos4210_uart_update_irq(s);
+    }
+}
+
 static void exynos4210_uart_update_parameters(Exynos4210UartState *s)
 {
     int speed, parity, data_bits, stop_bits;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_parameters(Exynos4210UartState *s)
     ssp.data_bits = data_bits;
     ssp.stop_bits = stop_bits;
 
+    s->wordtime = NANOSECONDS_PER_SECOND * (data_bits + stop_bits + 1) / speed;
+
     qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
 
     trace_exynos_uart_update_params(
-                s->channel, speed, parity, data_bits, stop_bits);
+                s->channel, speed, parity, data_bits, stop_bits, s->wordtime);
+}
+
+static void exynos4210_uart_rx_timeout_set(Exynos4210UartState *s)
+{
+    if (s->reg[I_(UCON)] & 0x80) {
+        uint32_t timeout = ((s->reg[I_(UCON)] >> 12) & 0x0f) * s->wordtime;
+
+        timer_mod(s->fifo_timeout_timer,
+                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout);
+    } else {
+        timer_del(s->fifo_timeout_timer);
+    }
 }
 
 static void exynos4210_uart_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
         exynos4210_uart_update_irq(s);
         break;
     case UTRSTAT:
+        if (val & UTRSTAT_Rx_TIMEOUT) {
+            s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_TIMEOUT;
+        }
+        break;
     case UERSTAT:
     case UFSTAT:
     case UMSTAT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_write(void *opaque, hwaddr offset,
         break;
     }
 }
+
 static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
                                   unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static int exynos4210_uart_can_receive(void *opaque)
     return fifo_empty_elements_number(&s->rx);
 }
 
-
 static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size)
 {
     Exynos4210UartState *s = (Exynos4210UartState *)opaque;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size)
 
     if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) {
         if (fifo_empty_elements_number(&s->rx) < size) {
-            for (i = 0; i < fifo_empty_elements_number(&s->rx); i++) {
-                fifo_store(&s->rx, buf[i]);
-            }
+            size = fifo_empty_elements_number(&s->rx);
             s->reg[I_(UINTSP)] |= UINTSP_ERROR;
-            s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
-        } else {
-            for (i = 0; i < size; i++) {
-                fifo_store(&s->rx, buf[i]);
-            }
-            s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
         }
-        /* XXX: Around here we maybe should check Rx trigger level */
-        s->reg[I_(UINTSP)] |= UINTSP_RXD;
+        for (i = 0; i < size; i++) {
+            fifo_store(&s->rx, buf[i]);
+        }
+        exynos4210_uart_rx_timeout_set(s);
     } else {
         s->reg[I_(URXH)] = buf[0];
-        s->reg[I_(UINTSP)] |= UINTSP_RXD;
-        s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
     }
+    s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_BUFFER_DATA_READY;
 
     exynos4210_uart_update_irq(s);
 }
@@ -XXX,XX +XXX,XX @@ static int exynos4210_uart_post_load(void *opaque, int version_id)
     Exynos4210UartState *s = (Exynos4210UartState *)opaque;
 
     exynos4210_uart_update_parameters(s);
+    exynos4210_uart_rx_timeout_set(s);
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_init(Object *obj)
     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
     Exynos4210UartState *s = EXYNOS4210_UART(dev);
 
+    s->fifo_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                         exynos4210_uart_timeout_int, s);
+    s->wordtime = NANOSECONDS_PER_SECOND * 10 / 9600;
+
     /* memory mapping */
     memory_region_init_io(&s->iomem, obj, &exynos4210_uart_ops, s,
                           "exynos4210.uart", EXYNOS4210_UART_REGS_MEM_SIZE);
diff --git a/hw/char/trace-events b/hw/char/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PR
 # exynos4210_uart.c
 exynos_uart_irq_raised(uint32_t channel, uint32_t reg) "UART%d: IRQ raised: 0x%08"PRIx32
 exynos_uart_irq_lowered(uint32_t channel) "UART%d: IRQ lowered"
-exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d"
+exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop, uint64_t wordtime) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d wordtime: %"PRId64"ns"
 exynos_uart_write(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s <- 0x%" PRIx64
 exynos_uart_read(uint32_t channel, uint32_t offset, const char *name, uint64_t val) "UART%d: <0x%04x> %s -> 0x%" PRIx64
 exynos_uart_rx_fifo_reset(uint32_t channel) "UART%d: Rx FIFO Reset"
@@ -XXX,XX +XXX,XX @@ exynos_uart_rx_error(uint32_t channel) "UART%d: Rx error"
 exynos_uart_wo_read(uint32_t channel, const char *name, uint32_t reg) "UART%d: Trying to read from WO register: %s [0x%04"PRIx32"]"
 exynos_uart_rxsize(uint32_t channel, uint32_t size) "UART%d: Rx FIFO size: %d"
 exynos_uart_channel_error(uint32_t channel) "Wrong UART channel number: %d"
+exynos_uart_rx_timeout(uint32_t channel, uint32_t stat, uint32_t intsp) "UART%d: Rx timeout stat=0x%x intsp=0x%x"
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

To support receive DMA, we need to inform the DMA controller if receive data
is available. Otherwise the DMA controller keeps requesting data, causing
receive errors.

Implement this using an interrupt line. The instantiating code then needs
to connect the interrupt with the matching DMA controller GPIO pin.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200123052540.6132-8-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/exynos4210_uart.c | 24 ++++++++++++++++++++++++
 hw/char/trace-events      |  2 ++
 2 files changed, 26 insertions(+)

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210UartState {
 
     CharBackend       chr;
     qemu_irq          irq;
+    qemu_irq          dmairq;
 
     uint32_t channel;
 
@@ -XXX,XX +XXX,XX @@ exynos4210_uart_Rx_FIFO_trigger_level(const Exynos4210UartState *s)
     return exynos4210_uart_FIFO_trigger_level(s->channel, reg);
 }
 
+/*
+ * Update Rx DMA busy signal if Rx DMA is enabled. For simplicity,
+ * mark DMA as busy if DMA is enabled and the receive buffer is empty.
+ */
+static void exynos4210_uart_update_dmabusy(Exynos4210UartState *s)
+{
+    bool rx_dma_enabled = (s->reg[I_(UCON)] & 0x03) == 0x02;
+    uint32_t count = fifo_elements_number(&s->rx);
+
+    if (rx_dma_enabled && !count) {
+        qemu_irq_raise(s->dmairq);
+        trace_exynos_uart_dmabusy(s->channel);
+    } else {
+        qemu_irq_lower(s->dmairq);
+        trace_exynos_uart_dmaready(s->channel);
+    }
+}
+
 static void exynos4210_uart_update_irq(Exynos4210UartState *s)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_update_irq(Exynos4210UartState *s)
         count = fifo_elements_number(&s->rx);
         if ((count && !(s->reg[I_(UCON)] & 0x80)) ||
             count >= exynos4210_uart_Rx_FIFO_trigger_level(s)) {
+            exynos4210_uart_update_dmabusy(s);
             s->reg[I_(UINTSP)] |= UINTSP_RXD;
             timer_del(s->fifo_timeout_timer);
         }
     } else if (s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY) {
+        exynos4210_uart_update_dmabusy(s);
         s->reg[I_(UINTSP)] |= UINTSP_RXD;
     }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_timeout_int(void *opaque)
         (s->reg[I_(UCON)] & (1 << 11))) {
         s->reg[I_(UINTSP)] |= UINTSP_RXD;
         s->reg[I_(UTRSTAT)] |= UTRSTAT_Rx_TIMEOUT;
+        exynos4210_uart_update_dmabusy(s);
         exynos4210_uart_update_irq(s);
     }
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,
             s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY;
             res = s->reg[I_(URXH)];
         }
+        exynos4210_uart_update_dmabusy(s);
         trace_exynos_uart_read(s->channel, offset,
                                exynos4210_uart_regname(offset), res);
         return res;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_uart_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 
     sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(dev, &s->dmairq);
 }
 
 static void exynos4210_uart_realize(DeviceState *dev, Error **errp)
diff --git a/hw/char/trace-events b/hw/char/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64
 nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
 
 # exynos4210_uart.c
+exynos_uart_dmabusy(uint32_t channel) "UART%d: DMA busy (Rx buffer empty)"
+exynos_uart_dmaready(uint32_t channel) "UART%d: DMA ready"
 exynos_uart_irq_raised(uint32_t channel, uint32_t reg) "UART%d: IRQ raised: 0x%08"PRIx32
 exynos_uart_irq_lowered(uint32_t channel) "UART%d: IRQ lowered"
 exynos_uart_update_params(uint32_t channel, int speed, uint8_t parity, int data, int stop, uint64_t wordtime) "UART%d: speed: %d, parity: %c, data bits: %d, stop bits: %d wordtime: %"PRId64"ns"
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

The Exynos4210 serial driver uses an interrupt line to signal if receive
data is available. Connect that interrupt with the DMA controller's
'peripheral busy' gpio pin to stop the DMA if there is no more receive
data available. Without this patch, receive DMA runs wild and fills the
entire receive DMA buffer with invalid data.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200123052540.6132-9-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 42 +++++++++++++++++++++++++++++-------------
 1 file changed, 29 insertions(+), 13 deletions(-)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
-static void pl330_create(uint32_t base, qemu_or_irq *orgate, qemu_irq irq,
-                         int nreq, int nevents, int width)
+static DeviceState *pl330_create(uint32_t base, qemu_or_irq *orgate,
+                                 qemu_irq irq, int nreq, int nevents, int width)
 {
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_or_irq *orgate, qemu_irq irq,
         sysbus_connect_irq(busdev, i, qdev_get_gpio_in(DEVICE(orgate), i));
     }
     qdev_connect_gpio_out(DEVICE(orgate), 0, irq);
+    return dev;
 }
 
 static void exynos4210_realize(DeviceState *socdev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
-    DeviceState *dev;
+    DeviceState *dev, *uart[4], *pl330[3];
     int i, n;
 
     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
 
 
     /*** UARTs ***/
-    exynos4210_uart_create(EXYNOS4210_UART0_BASE_ADDR,
+    uart[0] = exynos4210_uart_create(EXYNOS4210_UART0_BASE_ADDR,
                            EXYNOS4210_UART0_FIFO_SIZE, 0, serial_hd(0),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 0)]);
 
-    exynos4210_uart_create(EXYNOS4210_UART1_BASE_ADDR,
+    uart[1] = exynos4210_uart_create(EXYNOS4210_UART1_BASE_ADDR,
                            EXYNOS4210_UART1_FIFO_SIZE, 1, serial_hd(1),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 1)]);
 
-    exynos4210_uart_create(EXYNOS4210_UART2_BASE_ADDR,
+    uart[2] = exynos4210_uart_create(EXYNOS4210_UART2_BASE_ADDR,
                            EXYNOS4210_UART2_FIFO_SIZE, 2, serial_hd(2),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 2)]);
 
-    exynos4210_uart_create(EXYNOS4210_UART3_BASE_ADDR,
+    uart[3] = exynos4210_uart_create(EXYNOS4210_UART3_BASE_ADDR,
                            EXYNOS4210_UART3_FIFO_SIZE, 3, serial_hd(3),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 3)]);
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
     /*** DMA controllers ***/
-    pl330_create(EXYNOS4210_PL330_BASE0_ADDR, &s->pl330_irq_orgate[0],
-                 s->irq_table[exynos4210_get_irq(21, 0)], 32, 32, 32);
-    pl330_create(EXYNOS4210_PL330_BASE1_ADDR, &s->pl330_irq_orgate[1],
-                 s->irq_table[exynos4210_get_irq(21, 1)], 32, 32, 32);
-    pl330_create(EXYNOS4210_PL330_BASE2_ADDR, &s->pl330_irq_orgate[2],
-                 s->irq_table[exynos4210_get_irq(20, 1)], 1, 31, 64);
+    pl330[0] = pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                            &s->pl330_irq_orgate[0],
+                            s->irq_table[exynos4210_get_irq(21, 0)],
+                            32, 32, 32);
+    pl330[1] = pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                            &s->pl330_irq_orgate[1],
+                            s->irq_table[exynos4210_get_irq(21, 1)],
+                            32, 32, 32);
+    pl330[2] = pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                            &s->pl330_irq_orgate[2],
+                            s->irq_table[exynos4210_get_irq(20, 1)],
+                            1, 31, 64);
+
+    sysbus_connect_irq(SYS_BUS_DEVICE(uart[0]), 1,
+                       qdev_get_gpio_in(pl330[0], 15));
+    sysbus_connect_irq(SYS_BUS_DEVICE(uart[1]), 1,
+                       qdev_get_gpio_in(pl330[1], 15));
+    sysbus_connect_irq(SYS_BUS_DEVICE(uart[2]), 1,
+                       qdev_get_gpio_in(pl330[0], 17));
+    sysbus_connect_irq(SYS_BUS_DEVICE(uart[3]), 1,
+                       qdev_get_gpio_in(pl330[1], 17));
 }
 
 static void exynos4210_init(Object *obj)
-- 
2.20.1

target-arm queue, mostly SME preliminaries.

In the unlikely event we don't land the rest of SME before freeze
for 7.1 we can revert the docs/property changes included here.

-- PMM

The following changes since commit 097ccbbbaf2681df1e65542e5b7d2b2d0c66e2bc:

Merge tag 'qemu-sparc-20220626' of https://github.com/mcayland/qemu into staging (2022-06-27 05:21:05 +0530)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220627

for you to fetch changes up to 59e1b8a22ea9f947d038ccac784de1020f266e14:

target/arm: Check V7VE as well as LPAE in arm_pamax (2022-06-27 11:18:17 +0100)

----------------------------------------------------------------
target-arm queue:
 * sphinx: change default language to 'en'
 * Diagnose attempts to emulate EL3 in hvf as well as kvm
 * More SME groundwork patches
 * virt: Fix calculation of physical address space size
   for v7VE CPUs (eg cortex-a15)

----------------------------------------------------------------
Alexander Graf (2):
      accel: Introduce current_accel_name()
      target/arm: Catch invalid kvm state also for hvf

Martin Liška (1):
      sphinx: change default language to 'en'

Richard Henderson (22):
      target/arm: Implement TPIDR2_EL0
      target/arm: Add SMEEXC_EL to TB flags
      target/arm: Add syn_smetrap
      target/arm: Add ARM_CP_SME
      target/arm: Add SVCR
      target/arm: Add SMCR_ELx
      target/arm: Add SMIDR_EL1, SMPRI_EL1, SMPRIMAP_EL2
      target/arm: Add PSTATE.{SM,ZA} to TB flags
      target/arm: Add the SME ZA storage to CPUARMState
      target/arm: Implement SMSTART, SMSTOP
      target/arm: Move error for sve%d property to arm_cpu_sve_finalize
      target/arm: Create ARMVQMap
      target/arm: Generalize cpu_arm_{get,set}_vq
      target/arm: Generalize cpu_arm_{get, set}_default_vec_len
      target/arm: Move arm_cpu_*_finalize to internals.h
      target/arm: Unexport aarch64_add_*_properties
      target/arm: Add cpu properties for SME
      target/arm: Introduce sve_vqm1_for_el_sm
      target/arm: Add SVL to TB flags
      target/arm: Move pred_{full, gvec}_reg_{offset, size} to translate-a64.h
      target/arm: Extend arm_pamax to more than aarch64
      target/arm: Check V7VE as well as LPAE in arm_pamax

From: Martin Liška <mliska@suse.cz>

Fixes the following Sphinx warning (treated as error) starting
with 5.0 release:

Warning, treated as error:
Invalid configuration value found: 'language = None'. Update your configuration to a valid langauge code. Falling back to 'en' (English).

Signed-off-by: Martin Liska <mliska@suse.cz>
Message-id: e91e51ee-48ac-437e-6467-98b56ee40042@suse.cz
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = 'en'
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
-- 
2.25.1

From: Alexander Graf <agraf@csgraf.de>

We need to fetch the name of the current accelerator in flexible error
messages more going forward. Let's create a helper that gives it to us
without casting in the target code.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620192242.70573-1-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/accel.h | 1 +
 accel/accel-common.c | 8 ++++++++
 softmmu/vl.c         | 3 +--
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
 
 AccelClass *accel_find(const char *opt_name);
 AccelState *current_accel(void);
+const char *current_accel_name(void);
 
 void accel_init_interfaces(AccelClass *ac);
 
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+/* Return the name of the current accelerator */
+const char *current_accel_name(void)
+{
+    AccelClass *ac = ACCEL_GET_CLASS(current_accel());
+
+    return ac->name;
+}
+
 static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
 {
     CPUClass *cc = CPU_CLASS(klass);
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
     }
 
     if (init_failed && !qtest_chrdev) {
-        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
-        error_report("falling back to %s", ac->name);
+        error_report("falling back to %s", current_accel_name());
     }
 
     if (icount_enabled() && !tcg_enabled()) {
-- 
2.25.1

From: Alexander Graf <agraf@csgraf.de>

Some features such as running in EL3 or running M profile code are
incompatible with virtualization as QEMU implements it today. To prevent
users from picking invalid configurations on other virt solutions like
Hvf, let's run the same checks there too.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1073
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620192242.70573-2-agraf@csgraf.de
[PMM: Allow qtest accelerator too; tweak comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "sysemu/tcg.h"
+#include "sysemu/qtest.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
 #include "disas/capstone.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         }
     }
 
-    if (kvm_enabled()) {
+    if (!tcg_enabled() && !qtest_enabled()) {
         /*
+         * We assume that no accelerator except TCG (and the "not really an
+         * accelerator" qtest) can handle these features, because Arm hardware
+         * virtualization can't virtualize them.
+         *
          * Catch all the cases which might cause us to create more than one
          * address space for the CPU (otherwise we will assert() later in
          * cpu_address_space_init()).
          */
         if (arm_feature(env, ARM_FEATURE_M)) {
             error_setg(errp,
-                       "Cannot enable KVM when using an M-profile guest CPU");
+                       "Cannot enable %s when using an M-profile guest CPU",
+                       current_accel_name());
             return;
         }
         if (cpu->has_el3) {
             error_setg(errp,
-                       "Cannot enable KVM when guest CPU has EL3 enabled");
+                       "Cannot enable %s when guest CPU has EL3 enabled",
+                       current_accel_name());
             return;
         }
         if (cpu->tag_memory) {
             error_setg(errp,
-                       "Cannot enable KVM when guest CPUs has MTE enabled");
+                       "Cannot enable %s when guest CPUs has MTE enabled",
+                       current_accel_name());
             return;
         }
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This register is part of SME, but isn't closely related to the
rest of the extension.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  1 +
 target/arm/helper.c | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
             };
             uint64_t tpidr_el[4];
         };
+        uint64_t tpidr2_el0;
         /* The secure banks of these registers don't map anywhere */
         uint64_t tpidrurw_s;
         uint64_t tpidrprw_s;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_reginfo[] = {
       .writefn = zcr_write, .raw_writefn = raw_write },
 };
 
+#ifdef TARGET_AARCH64
+static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
+                                    bool isread)
+{
+    int el = arm_current_el(env);
+
+    if (el == 0) {
+        uint64_t sctlr = arm_sctlr(env, el);
+        if (!(sctlr & SCTLR_EnTP2)) {
+            return CP_ACCESS_TRAP;
+        }
+    }
+    /* TODO: FEAT_FGT */
+    if (el < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_ENTP2)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static const ARMCPRegInfo sme_reginfo[] = {
+    { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
+      .access = PL0_RW, .accessfn = access_tpidr2,
+      .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
+};
+#endif /* TARGET_AARCH64 */
+
 void hw_watchpoint_update(ARMCPU *cpu, int n)
 {
     CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
 #ifdef TARGET_AARCH64
+    if (cpu_isar_feature(aa64_sme, cpu)) {
+        define_arm_cp_regs(cpu, sme_reginfo);
+    }
     if (cpu_isar_feature(aa64_pauth, cpu)) {
         define_arm_cp_regs(cpu, pauth_reginfo);
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This is CheckSMEAccess, which is the basis for a set of
related tests for various SME cpregs and instructions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  2 ++
 target/arm/translate.h     |  1 +
 target/arm/helper.c        | 52 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-a64.c |  1 +
 4 files changed, 56 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env);
 
 int fp_exception_el(CPUARMState *env, int cur_el);
 int sve_exception_el(CPUARMState *env, int cur_el);
+int sme_exception_el(CPUARMState *env, int cur_el);
 
 /**
  * sve_vqm1_for_el:
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, ATA, 15, 1)
 FIELD(TBFLAG_A64, TCMA, 16, 2)
 FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
 FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
+FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
 
 /*
  * Helpers for using the above.
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool ns;        /* Use non-secure CPREG bank on access */
     int fp_excp_el; /* FP exception EL or 0 if enabled */
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
+    int sme_excp_el; /* SME exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
     bool vfp_enabled; /* FP enabled via FPSCR.EN */
     int vec_len;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
+/*
+ * Return the exception level to which exceptions should be taken for SME.
+ * C.f. the ARM pseudocode function CheckSMEAccess.
+ */
+int sme_exception_el(CPUARMState *env, int el)
+{
+#ifndef CONFIG_USER_ONLY
+    if (el <= 1 && !el_is_in_host(env, el)) {
+        switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) {
+        case 1:
+            if (el != 0) {
+                break;
+            }
+            /* fall through */
+        case 0:
+        case 2:
+            return 1;
+        }
+    }
+
+    if (el <= 2 && arm_is_el2_enabled(env)) {
+        /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
+        if (env->cp15.hcr_el2 & HCR_E2H) {
+            switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) {
+            case 1:
+                if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) {
+                    break;
+                }
+                /* fall through */
+            case 0:
+            case 2:
+                return 2;
+            }
+        } else {
+            if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) {
+                return 2;
+            }
+        }
+    }
+
+    /* CPTR_EL3.  Since ESM is negative we must check for EL3.  */
+    if (arm_feature(env, ARM_FEATURE_EL3)
+        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
+        return 3;
+    }
+#endif
+    return 0;
+}
+
 /*
  * Given that SVE is enabled, return the vector length for EL.
  */
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         }
         DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
     }
+    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
+    }
 
     sctlr = regime_sctlr(env, stage1);
 
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
     dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
+    dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
     dc->bt = EX_TBFLAG_A64(tb_flags, BT);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This will be used for raising various traps for SME.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
     EC_AA64_SMC               = 0x17,
     EC_SYSTEMREGISTERTRAP     = 0x18,
     EC_SVEACCESSTRAP          = 0x19,
+    EC_SMETRAP                = 0x1d,
     EC_INSNABORT              = 0x20,
     EC_INSNABORT_SAME_EL      = 0x21,
     EC_PCALIGNMENT            = 0x22,
@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
     EC_AA64_BKPT              = 0x3c,
 };
 
+typedef enum {
+    SME_ET_AccessTrap,
+    SME_ET_Streaming,
+    SME_ET_NotStreaming,
+    SME_ET_InactiveZA,
+} SMEExceptionType;
+
 #define ARM_EL_EC_SHIFT 26
 #define ARM_EL_IL_SHIFT 25
 #define ARM_EL_ISV_SHIFT 24
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_sve_access_trap(void)
     return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
 }
 
+static inline uint32_t syn_smetrap(SMEExceptionType etype, bool is_16bit)
+{
+    return (EC_SMETRAP << ARM_EL_EC_SHIFT)
+        | (is_16bit ? 0 : ARM_EL_IL) | etype;
+}
+
 static inline uint32_t syn_pactrap(void)
 {
     return EC_PACTRAP << ARM_EL_EC_SHIFT;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This will be used for controlling access to SME cpregs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h        |  5 +++++
 target/arm/translate-a64.c | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ enum {
     ARM_CP_EL3_NO_EL2_UNDEF      = 1 << 16,
     ARM_CP_EL3_NO_EL2_KEEP       = 1 << 17,
     ARM_CP_EL3_NO_EL2_C_NZ       = 1 << 18,
+    /*
+     * Flag: Access check for this sysreg is constrained by the
+     * ARM pseudocode function CheckSMEAccess().
+     */
+    ARM_CP_SME                   = 1 << 19,
 };
 
 /*
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
     return fp_access_check(s);
 }
 
+/*
+ * Check that SME access is enabled, raise an exception if not.
+ * Note that this function corresponds to CheckSMEAccess and is
+ * only used directly for cpregs.
+ */
+static bool sme_access_check(DisasContext *s)
+{
+    if (s->sme_excp_el) {
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_smetrap(SME_ET_AccessTrap, false),
+                              s->sme_excp_el);
+        return false;
+    }
+    return true;
+}
+
 /*
  * This utility function is for doing register extension with an
  * optional shift. You will likely want to pass a temporary for the
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
         return;
     } else if ((ri->type & ARM_CP_SVE) && !sve_access_check(s)) {
         return;
+    } else if ((ri->type & ARM_CP_SME) && !sme_access_check(s)) {
+        return;
     }
 
     if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This cpreg is used to access two new bits of PSTATE
that are not visible via any other mechanism.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  6 ++++++
 target/arm/helper.c | 13 +++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
      *  nRW (also known as M[4]) is kept, inverted, in env->aarch64
      *  DAIF (exception masks) are kept in env->daif
      *  BTYPE is kept in env->btype
+     *  SM and ZA are kept in env->svcr
      *  all other bits are stored in their correct places in env->pstate
      */
     uint32_t pstate;
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     uint32_t condexec_bits; /* IT bits.  cpsr[15:10,26:25].  */
     uint32_t btype;  /* BTI branch type.  spsr[11:10].  */
     uint64_t daif; /* exception masks, in the bits they are in PSTATE */
+    uint64_t svcr; /* PSTATE.{SM,ZA} in the bits they are in SVCR */
 
     uint64_t elr_el[4]; /* AArch64 exception link regs  */
     uint64_t sp_el[4]; /* AArch64 banked stack pointers */
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define PSTATE_MODE_EL1t 4
 #define PSTATE_MODE_EL0t 0
 
+/* PSTATE bits that are accessed via SVCR and not stored in SPSR_ELx. */
+FIELD(SVCR, SM, 0, 1)
+FIELD(SVCR, ZA, 1, 1)
+
 /* Write a new value to v7m.exception, thus transitioning into or out
  * of Handler mode; this may result in a change of active stack pointer.
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                       uint64_t value)
+{
+    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
+    /* TODO: Side effects. */
+    env->svcr = value;
+}
+
 static const ARMCPRegInfo sme_reginfo[] = {
     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
       .access = PL0_RW, .accessfn = access_tpidr2,
       .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
+    { .name = "SVCR", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2,
+      .access = PL0_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, svcr),
+      .writefn = svcr_write, .raw_writefn = raw_write },
 };
 #endif /* TARGET_AARCH64 */
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These cpregs control the streaming vector length and whether the
full a64 instruction set is allowed while in streaming mode.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  8 ++++++--
 target/arm/helper.c | 41 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
 
-        /* ZCR_EL[1-3] */
-        uint64_t zcr_el[4];
+        uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
+        uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
     } vfp;
     uint64_t exclusive_addr;
     uint64_t exclusive_val;
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 FIELD(SVCR, SM, 0, 1)
 FIELD(SVCR, ZA, 1, 1)
 
+/* Fields for SMCR_ELx. */
+FIELD(SMCR, LEN, 0, 4)
+FIELD(SMCR, FA64, 31, 1)
+
 /* Write a new value to v7m.exception, thus transitioning into or out
  * of Handler mode; this may result in a change of active stack pointer.
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
          */
         { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
           "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
+        { K(3, 0,  1, 2, 6), K(3, 4,  1, 2, 6), K(3, 5, 1, 2, 6),
+          "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme },
 
         { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
           "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
@@ -XXX,XX +XXX,XX @@ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     env->svcr = value;
 }
 
+static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                       uint64_t value)
+{
+    int cur_el = arm_current_el(env);
+    int old_len = sve_vqm1_for_el(env, cur_el);
+    int new_len;
+
+    QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1);
+    value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK;
+    raw_write(env, ri, value);
+
+    /*
+     * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage
+     * when SVL is widened (old values kept, or zeros).  Choose to keep the
+     * current values for simplicity.  But for QEMU internals, we must still
+     * apply the narrower SVL to the Zregs and Pregs -- see the comment
+     * above aarch64_sve_narrow_vq.
+     */
+    new_len = sve_vqm1_for_el(env, cur_el);
+    if (new_len < old_len) {
+        aarch64_sve_narrow_vq(env, new_len + 1);
+    }
+}
+
 static const ARMCPRegInfo sme_reginfo[] = {
     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
       .access = PL0_RW, .type = ARM_CP_SME,
       .fieldoffset = offsetof(CPUARMState, svcr),
       .writefn = svcr_write, .raw_writefn = raw_write },
+    { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6,
+      .access = PL1_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]),
+      .writefn = smcr_write, .raw_writefn = raw_write },
+    { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6,
+      .access = PL2_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]),
+      .writefn = smcr_write, .raw_writefn = raw_write },
+    { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6,
+      .access = PL3_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
+      .writefn = smcr_write, .raw_writefn = raw_write },
 };
 #endif /* TARGET_AARCH64 */
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Implement the streaming mode identification register, and the
two streaming priority registers.  For QEMU, they are all RES0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
+                                 bool isread)
+{
+    /* TODO: FEAT_FGT for SMPRI_EL1 but not SMPRIMAP_EL2 */
+    if (arm_current_el(env) < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                        uint64_t value)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
       .access = PL3_RW, .type = ARM_CP_SME,
       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
       .writefn = smcr_write, .raw_writefn = raw_write },
+    { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6,
+      .access = PL1_R, .accessfn = access_aa64_tid1,
+      /*
+       * IMPLEMENTOR = 0 (software)
+       * REVISION    = 0 (implementation defined)
+       * SMPS        = 0 (no streaming execution priority in QEMU)
+       * AFFINITY    = 0 (streaming sve mode not shared with other PEs)
+       */
+      .type = ARM_CP_CONST, .resetvalue = 0, },
+    /*
+     * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0.
+     */
+    { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4,
+      .access = PL1_RW, .accessfn = access_esm,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5,
+      .access = PL2_RW, .accessfn = access_esm,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
 };
 #endif /* TARGET_AARCH64 */
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These are required to determine if various insns
are allowed to issue.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 2 ++
 target/arm/translate.h     | 4 ++++
 target/arm/helper.c        | 4 ++++
 target/arm/translate-a64.c | 2 ++
 4 files changed, 12 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, TCMA, 16, 2)
 FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
 FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
 FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
+FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
+FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
 
 /*
  * Helpers for using the above.
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool align_mem;
     /* True if PSTATE.IL is set */
     bool pstate_il;
+    /* True if PSTATE.SM is set. */
+    bool pstate_sm;
+    /* True if PSTATE.ZA is set. */
+    bool pstate_za;
     /* True if MVE insns are definitely not predicated by VPR or LTPSIZE */
     bool mve_no_pred;
     /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
     }
     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
         DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
+        if (FIELD_EX64(env->svcr, SVCR, SM)) {
+            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
+        }
+        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
     }
 
     sctlr = regime_sctlr(env, stage1);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->ata = EX_TBFLAG_A64(tb_flags, ATA);
     dc->mte_active[0] = EX_TBFLAG_A64(tb_flags, MTE_ACTIVE);
     dc->mte_active[1] = EX_TBFLAG_A64(tb_flags, MTE0_ACTIVE);
+    dc->pstate_sm = EX_TBFLAG_A64(tb_flags, PSTATE_SM);
+    dc->pstate_za = EX_TBFLAG_A64(tb_flags, PSTATE_ZA);
     dc->vec_len = 0;
     dc->vec_stride = 0;
     dc->cp_regs = arm_cpu->cp_regs;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Place this late in the resettable section of the structure,
to keep the most common element offsets from being > 64k.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-10-richard.henderson@linaro.org
[PMM: expanded comment on zarray[] format]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 22 ++++++++++++++++++++++
 target/arm/machine.c | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     } keys;
 
     uint64_t scxtnum_el[4];
+
+    /*
+     * SME ZA storage -- 256 x 256 byte array, with bytes in host word order,
+     * as we do with vfp.zregs[].  This corresponds to the architectural ZA
+     * array, where ZA[N] is in the least-significant bytes of env->zarray[N].
+     * When SVL is less than the architectural maximum, the accessible
+     * storage is restricted, such that if the SVL is X bytes the guest can
+     * see only the bottom X elements of zarray[], and only the least
+     * significant X bytes of each element of the array. (In other words,
+     * the observable part is always square.)
+     *
+     * The ZA storage can also be considered as a set of square tiles of
+     * elements of different sizes. The mapping from tiles to the ZA array
+     * is architecturally defined, such that for tiles of elements of esz
+     * bytes, the Nth row (or "horizontal slice") of tile T is in
+     * ZA[T + N * esz]. Note that this means that each tile is not contiguous
+     * in the ZA storage, because its rows are striped through the ZA array.
+     *
+     * Because this is so large, keep this toward the end of the reset area,
+     * to keep the offsets into the rest of the structure smaller.
+     */
+    ARMVectorReg zarray[ARM_MAX_VQ * 16];
 #endif
 
 #if defined(CONFIG_USER_ONLY)
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sve = {
         VMSTATE_END_OF_LIST()
     }
 };
+
+static const VMStateDescription vmstate_vreg = {
+    .name = "vreg",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64_ARRAY(d, ARMVectorReg, ARM_MAX_VQ * 2),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static bool za_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+
+    /*
+     * When ZA storage is disabled, its contents are discarded.
+     * It will be zeroed when ZA storage is re-enabled.
+     */
+    return FIELD_EX64(cpu->env.svcr, SVCR, ZA);
+}
+
+static const VMStateDescription vmstate_za = {
+    .name = "cpu/sme",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = za_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_STRUCT_ARRAY(env.zarray, ARMCPU, ARM_MAX_VQ * 16, 0,
+                             vmstate_vreg, ARMVectorReg),
+        VMSTATE_END_OF_LIST()
+    }
+};
 #endif /* AARCH64 */
 
 static bool serror_needed(void *opaque)
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_m_security,
 #ifdef TARGET_AARCH64
         &vmstate_sve,
+        &vmstate_za,
 #endif
         &vmstate_serror,
         &vmstate_irq_line_state,
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These two instructions are aliases of MSR (immediate).
Use the two helpers to properly implement svcr_write.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  1 +
 target/arm/helper-sme.h    | 21 +++++++++++++
 target/arm/helper.h        |  1 +
 target/arm/helper.c        |  6 ++--
 target/arm/sme_helper.c    | 61 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-a64.c | 24 +++++++++++++++
 target/arm/meson.build     |  1 +
 7 files changed, 112 insertions(+), 3 deletions(-)
 create mode 100644 target/arm/helper-sme.h
 create mode 100644 target/arm/sme_helper.c

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
                            int new_el, bool el0_a64);
 void aarch64_add_sve_properties(Object *obj);
 void aarch64_add_pauth_properties(Object *obj);
+void arm_reset_sve_state(CPUARMState *env);
 
 /*
  * SVE registers are encoded in KVM's memory in an endianness-invariant format.
diff --git a/target/arm/helper-sme.h b/target/arm/helper-sme.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/helper-sme.h
@@ -XXX,XX +XXX,XX @@
+/*
+ *  AArch64 SME specific helper definitions
+ *
+ *  Copyright (c) 2022 Linaro, Ltd
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+DEF_HELPER_FLAGS_2(set_pstate_sm, TCG_CALL_NO_RWG, void, env, i32)
+DEF_HELPER_FLAGS_2(set_pstate_za, TCG_CALL_NO_RWG, void, env, i32)
diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_bfmlal_idx, TCG_CALL_NO_RWG,
 #ifdef TARGET_AARCH64
 #include "helper-a64.h"
 #include "helper-sve.h"
+#include "helper-sme.h"
 #endif
 
 #include "helper-mve.h"
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                        uint64_t value)
 {
-    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
-    /* TODO: Side effects. */
-    env->svcr = value;
+    helper_set_pstate_sm(env, FIELD_EX64(value, SVCR, SM));
+    helper_set_pstate_za(env, FIELD_EX64(value, SVCR, ZA));
+    arm_rebuild_hflags(env);
 }
 
 static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
diff --git a/target/arm/sme_helper.c b/target/arm/sme_helper.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/sme_helper.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SME Operations
+ *
+ * Copyright (c) 2022 Linaro, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "internals.h"
+#include "exec/helper-proto.h"
+
+/* ResetSVEState */
+void arm_reset_sve_state(CPUARMState *env)
+{
+    memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
+    /* Recall that FFR is stored as pregs[16]. */
+    memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
+    vfp_set_fpcr(env, 0x0800009f);
+}
+
+void helper_set_pstate_sm(CPUARMState *env, uint32_t i)
+{
+    if (i == FIELD_EX64(env->svcr, SVCR, SM)) {
+        return;
+    }
+    env->svcr ^= R_SVCR_SM_MASK;
+    arm_reset_sve_state(env);
+}
+
+void helper_set_pstate_za(CPUARMState *env, uint32_t i)
+{
+    if (i == FIELD_EX64(env->svcr, SVCR, ZA)) {
+        return;
+    }
+    env->svcr ^= R_SVCR_ZA_MASK;
+
+    /*
+     * ResetSMEState.
+     *
+     * SetPSTATE_ZA zeros on enable and disable.  We can zero this only
+     * on enable: while disabled, the storage is inaccessible and the
+     * value does not matter.  We're not saving the storage in vmstate
+     * when disabled either.
+     */
+    if (i) {
+        memset(env->zarray, 0, sizeof(env->zarray));
+    }
+}
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_msr_i(DisasContext *s, uint32_t insn,
         }
         break;
 
+    case 0x1b: /* SVCR* */
+        if (!dc_isar_feature(aa64_sme, s) || crm < 2 || crm > 7) {
+            goto do_unallocated;
+        }
+        if (sme_access_check(s)) {
+            bool i = crm & 1;
+            bool changed = false;
+
+            if ((crm & 2) && i != s->pstate_sm) {
+                gen_helper_set_pstate_sm(cpu_env, tcg_constant_i32(i));
+                changed = true;
+            }
+            if ((crm & 4) && i != s->pstate_za) {
+                gen_helper_set_pstate_za(cpu_env, tcg_constant_i32(i));
+                changed = true;
+            }
+            if (changed) {
+                gen_rebuild_hflags(s);
+            } else {
+                s->base.is_jmp = DISAS_NEXT;
+            }
+        }
+        break;
+
     default:
     do_unallocated:
         unallocated_encoding(s);
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'mte_helper.c',
   'pauth_helper.c',
   'sve_helper.c',
+  'sme_helper.c',
   'translate-a64.c',
   'translate-sve.c',
 ))
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Keep all of the error messages together.  This does mean that
when setting many sve length properties we'll only generate
one error, but we only really need one.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
                                   "using only sve<N> properties.\n");
             } else {
                 error_setg(errp, "cannot enable sve%d", vq * 128);
-                error_append_hint(errp, "This CPU does not support "
-                                  "the vector length %d-bits.\n", vq * 128);
+                if (vq_supported) {
+                    error_append_hint(errp, "This CPU does not support "
+                                      "the vector length %d-bits.\n", vq * 128);
+                } else {
+                    error_append_hint(errp, "SVE not supported by KVM "
+                                      "on this host\n");
+                }
             }
             return;
         } else {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
-        error_setg(errp, "cannot enable %s", name);
-        error_append_hint(errp, "SVE not supported by KVM on this host\n");
-        return;
-    }
-
     cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
     cpu->sve_vq_init |= 1 << (vq - 1);
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Pull the three sve_vq_* values into a structure.
This will be reused for SME.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 29 ++++++++++++++---------------
 target/arm/cpu64.c  | 22 +++++++++++-----------
 target/arm/helper.c |  2 +-
 target/arm/kvm64.c  |  2 +-
 4 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMPSCIState {
 
 typedef struct ARMISARegisters ARMISARegisters;
 
+/*
+ * In map, each set bit is a supported vector length of (bit-number + 1) * 16
+ * bytes, i.e. each bit number + 1 is the vector length in quadwords.
+ *
+ * While processing properties during initialization, corresponding init bits
+ * are set for bits in sve_vq_map that have been set by properties.
+ *
+ * Bits set in supported represent valid vector lengths for the CPU type.
+ */
+typedef struct {
+    uint32_t map, init, supported;
+} ARMVQMap;
+
 /**
  * ARMCPU:
  * @env: #CPUARMState
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     uint32_t sve_default_vq;
 #endif
 
-    /*
-     * In sve_vq_map each set bit is a supported vector length of
-     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
-     * length in quadwords.
-     *
-     * While processing properties during initialization, corresponding
-     * sve_vq_init bits are set for bits in sve_vq_map that have been
-     * set by properties.
-     *
-     * Bits set in sve_vq_supported represent valid vector lengths for
-     * the CPU type.
-     */
-    uint32_t sve_vq_map;
-    uint32_t sve_vq_init;
-    uint32_t sve_vq_supported;
+    ARMVQMap sve_vq;
 
     /* Generic timer counter frequency, in Hz */
     uint64_t gt_cntfrq_hz;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      * any of the above.  Finally, if SVE is not disabled, then at least one
      * vector length must be enabled.
      */
-    uint32_t vq_map = cpu->sve_vq_map;
-    uint32_t vq_init = cpu->sve_vq_init;
+    uint32_t vq_map = cpu->sve_vq.map;
+    uint32_t vq_init = cpu->sve_vq.init;
     uint32_t vq_supported;
     uint32_t vq_mask = 0;
     uint32_t tmp, vq, max_vq = 0;
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      */
     if (kvm_enabled()) {
         if (kvm_arm_sve_supported()) {
-            cpu->sve_vq_supported = kvm_arm_sve_get_vls(CPU(cpu));
-            vq_supported = cpu->sve_vq_supported;
+            cpu->sve_vq.supported = kvm_arm_sve_get_vls(CPU(cpu));
+            vq_supported = cpu->sve_vq.supported;
         } else {
             assert(!cpu_isar_feature(aa64_sve, cpu));
             vq_supported = 0;
         }
     } else {
-        vq_supported = cpu->sve_vq_supported;
+        vq_supported = cpu->sve_vq.supported;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 
     /* From now on sve_max_vq is the actual maximum supported length. */
     cpu->sve_max_vq = max_vq;
-    cpu->sve_vq_map = vq_map;
+    cpu->sve_vq.map = vq_map;
 }
 
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
     if (!cpu_isar_feature(aa64_sve, cpu)) {
         value = false;
     } else {
-        value = extract32(cpu->sve_vq_map, vq - 1, 1);
+        value = extract32(cpu->sve_vq.map, vq - 1, 1);
     }
     visit_type_bool(v, name, &value, errp);
 }
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
-    cpu->sve_vq_init |= 1 << (vq - 1);
+    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
+    cpu->sve_vq.init |= 1 << (vq - 1);
 }
 
 static bool cpu_arm_get_sve(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
 
-    cpu->sve_vq_supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
+    cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
 
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
 
     /* The A64FX supports only 128, 256 and 512 bit vector lengths */
     aarch64_add_sve_properties(obj);
-    cpu->sve_vq_supported = (1 << 0)  /* 128bit */
+    cpu->sve_vq.supported = (1 << 0)  /* 128bit */
                           | (1 << 1)  /* 256bit */
                           | (1 << 3); /* 512bit */
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
         len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
 
-    len = 31 - clz32(cpu->sve_vq_map & MAKE_64BIT_MASK(0, len + 1));
+    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
     return len;
 }
 
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ uint32_t kvm_arm_sve_get_vls(CPUState *cs)
 static int kvm_arm_sve_set_vls(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
-    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq_map };
+    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
     struct kvm_one_reg reg = {
         .id = KVM_REG_ARM64_SVE_VLS,
         .addr = (uint64_t)&vls[0],
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from cpu_arm_{get,set}_sve_vq, and take the
ARMVQMap as the opaque parameter.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
 }
 
 /*
- * Note that cpu_arm_get/set_sve_vq cannot use the simpler
- * object_property_add_bool interface because they make use
- * of the contents of "name" to determine which bit on which
- * to operate.
+ * Note that cpu_arm_{get,set}_vq cannot use the simpler
+ * object_property_add_bool interface because they make use of the
+ * contents of "name" to determine which bit on which to operate.
  */
-static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMVQMap *vq_map = opaque;
     uint32_t vq = atoi(&name[3]) / 128;
     bool value;
 
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
     if (!cpu_isar_feature(aa64_sve, cpu)) {
         value = false;
     } else {
-        value = extract32(cpu->sve_vq.map, vq - 1, 1);
+        value = extract32(vq_map->map, vq - 1, 1);
     }
     visit_type_bool(v, name, &value, errp);
 }
 
-static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_arm_set_vq(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
 {
-    ARMCPU *cpu = ARM_CPU(obj);
+    ARMVQMap *vq_map = opaque;
     uint32_t vq = atoi(&name[3]) / 128;
     bool value;
 
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
-    cpu->sve_vq.init |= 1 << (vq - 1);
+    vq_map->map = deposit32(vq_map->map, vq - 1, 1, value);
+    vq_map->init |= 1 << (vq - 1);
 }
 
 static bool cpu_arm_get_sve(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
 
 void aarch64_add_sve_properties(Object *obj)
 {
+    ARMCPU *cpu = ARM_CPU(obj);
     uint32_t vq;
 
     object_property_add_bool(obj, "sve", cpu_arm_get_sve, cpu_arm_set_sve);
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
     for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
         char name[8];
         sprintf(name, "sve%d", vq * 128);
-        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
-                            cpu_arm_set_sve_vq, NULL, NULL);
+        object_property_add(obj, name, "bool", cpu_arm_get_vq,
+                            cpu_arm_set_vq, NULL, &cpu->sve_vq);
     }
 
 #ifdef CONFIG_USER_ONLY
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from cpu_arm_{get,set}_sve_default_vec_len,
and take the pointer to default_vq from opaque.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
 
 #ifdef CONFIG_USER_ONLY
 /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
-static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
-                                            const char *name, void *opaque,
-                                            Error **errp)
+static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
+                                        const char *name, void *opaque,
+                                        Error **errp)
 {
-    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t *ptr_default_vq = opaque;
     int32_t default_len, default_vq, remainder;
 
     if (!visit_type_int32(v, name, &default_len, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
 
     /* Undocumented, but the kernel allows -1 to indicate "maximum". */
     if (default_len == -1) {
-        cpu->sve_default_vq = ARM_MAX_VQ;
+        *ptr_default_vq = ARM_MAX_VQ;
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
         return;
     }
 
-    cpu->sve_default_vq = default_vq;
+    *ptr_default_vq = default_vq;
 }
 
-static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
-                                            const char *name, void *opaque,
-                                            Error **errp)
+static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
+                                        const char *name, void *opaque,
+                                        Error **errp)
 {
-    ARMCPU *cpu = ARM_CPU(obj);
-    int32_t value = cpu->sve_default_vq * 16;
+    uint32_t *ptr_default_vq = opaque;
+    int32_t value = *ptr_default_vq * 16;
 
     visit_type_int32(v, name, &value, errp);
 }
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
 #ifdef CONFIG_USER_ONLY
     /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
     object_property_add(obj, "sve-default-vector-length", "int32",
-                        cpu_arm_get_sve_default_vec_len,
-                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
+                        cpu_arm_get_default_vec_len,
+                        cpu_arm_set_default_vec_len, NULL,
+                        &cpu->sve_default_vq);
 #endif
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Drop the aa32-only inline fallbacks,
and just use a couple of ifdefs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       | 6 ------
 target/arm/internals.h | 3 +++
 target/arm/cpu.c       | 2 ++
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 #ifdef TARGET_AARCH64
 # define ARM_MAX_VQ    16
-void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
-void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
-void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #else
 # define ARM_MAX_VQ    1
-static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
-static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
-static inline void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp) { }
 #endif
 
 typedef struct ARMVectorReg {
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
 int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
+void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #endif
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
 {
     Error *local_err = NULL;
 
+#ifdef TARGET_AARCH64
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         arm_cpu_sve_finalize(cpu, &local_err);
         if (local_err != NULL) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             return;
         }
     }
+#endif
 
     if (kvm_enabled()) {
         kvm_arm_steal_time_finalize(cpu, &local_err);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These functions are not used outside cpu64.c,
so make them static.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h   | 3 ---
 target/arm/cpu64.c | 4 ++--
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
 void aarch64_sve_change_el(CPUARMState *env, int old_el,
                            int new_el, bool el0_a64);
-void aarch64_add_sve_properties(Object *obj);
-void aarch64_add_pauth_properties(Object *obj);
 void arm_reset_sve_state(CPUARMState *env);
 
 /*
@@ -XXX,XX +XXX,XX @@ static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
 static inline void aarch64_sve_change_el(CPUARMState *env, int o,
                                          int n, bool a)
 { }
-static inline void aarch64_add_sve_properties(Object *obj) { }
 #endif
 
 void aarch64_sync_32_to_64(CPUARMState *env);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
 }
 #endif
 
-void aarch64_add_sve_properties(Object *obj)
+static void aarch64_add_sve_properties(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pauth_property =
 static Property arm_cpu_pauth_impdef_property =
     DEFINE_PROP_BOOL("pauth-impdef", ARMCPU, prop_pauth_impdef, false);
 
-void aarch64_add_pauth_properties(Object *obj)
+static void aarch64_add_pauth_properties(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Mirror the properties for SVE.  The main difference is
that any arbitrary set of powers of 2 may be supported,
and not the stricter constraints that apply to SVE.

Include a property to control FEAT_SME_FA64, as failing
to restrict the runtime to the proper subset of insns
could be a major point for bugs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220620175235.60881-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst |  56 +++++++++++++++
 target/arm/cpu.h                 |   2 +
 target/arm/internals.h           |   1 +
 target/arm/cpu.c                 |  14 +++-
 target/arm/cpu64.c               | 114 +++++++++++++++++++++++++++++--
 5 files changed, 180 insertions(+), 7 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
 example's (1), (4), and (6) exhibit recommended uses of the properties.
 
+SME CPU Property Examples
+-------------------------
+
+  1) Disable SME::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sme=off
+
+  2) Implicitly enable all vector lengths for the ``max`` CPU type::
+
+     $ qemu-system-aarch64 -M virt -cpu max
+
+  3) Only enable the 256-bit vector length::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sme256=on
+
+  3) Enable the 256-bit and 1024-bit vector lengths::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sme256=on,sme1024=on
+
+  4) Disable the 512-bit vector length.  This results in all the other
+     lengths supported by ``max`` defaulting to enabled
+     (128, 256, 1024 and 2048)::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
+
 SVE User-mode Default Vector Length Property
 --------------------------------------------
 
@@ -XXX,XX +XXX,XX @@ length supported by QEMU is 256.
 
 If this property is set to ``-1`` then the default vector length
 is set to the maximum possible length.
+
+SME CPU Properties
+==================
+
+The SME CPU properties are much like the SVE properties: ``sme`` is
+used to enable or disable the entire SME feature, and ``sme<N>`` is
+used to enable or disable specific vector lengths.  Finally,
+``sme_fa64`` is used to enable or disable ``FEAT_SME_FA64``, which
+allows execution of the "full a64" instruction set while Streaming
+SVE mode is enabled.
+
+SME is not supported by KVM at this time.
+
+At least one vector length must be enabled when ``sme`` is enabled,
+and all vector lengths must be powers of 2.  The maximum vector
+length supported by qemu is 2048 bits.  Otherwise, there are no
+additional constraints on the set of vector lengths supported by SME.
+
+SME User-mode Default Vector Length Property
+--------------------------------------------
+
+For qemu-aarch64, the cpu propery ``sme-default-vector-length=N`` is
+defined to mirror the Linux kernel parameter file
+``/proc/sys/abi/sme_default_vector_length``.  The default length, ``N``,
+is in units of bytes and must be between 16 and 8192.
+If not specified, the default vector length is 32.
+
+As with ``sve-default-vector-length``, if the default length is larger
+than the maximum vector length enabled, the actual vector length will
+be reduced.  If this property is set to ``-1`` then the default vector
+length is set to the maximum possible length.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 #ifdef CONFIG_USER_ONLY
     /* Used to set the default vector length at process start. */
     uint32_t sve_default_vq;
+    uint32_t sme_default_vq;
 #endif
 
     ARMVQMap sve_vq;
+    ARMVQMap sme_vq;
 
     /* Generic timer counter frequency, in Hz */
     uint64_t gt_cntfrq_hz;
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
 #ifdef CONFIG_USER_ONLY
 # ifdef TARGET_AARCH64
     /*
-     * The linux kernel defaults to 512-bit vectors, when sve is supported.
-     * See documentation for /proc/sys/abi/sve_default_vector_length, and
-     * our corresponding sve-default-vector-length cpu property.
+     * The linux kernel defaults to 512-bit for SVE, and 256-bit for SME.
+     * These values were chosen to fit within the default signal frame.
+     * See documentation for /proc/sys/abi/{sve,sme}_default_vector_length,
+     * and our corresponding cpu property.
      */
     cpu->sve_default_vq = 4;
+    cpu->sme_default_vq = 2;
 # endif
 #else
     /* Our inbound IRQ and FIQ lines */
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             return;
         }
 
+        arm_cpu_sme_finalize(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+
         arm_cpu_pauth_finalize(cpu, &local_err);
         if (local_err != NULL) {
             error_propagate(errp, local_err);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
     ARMCPU *cpu = ARM_CPU(obj);
     ARMVQMap *vq_map = opaque;
     uint32_t vq = atoi(&name[3]) / 128;
+    bool sve = vq_map == &cpu->sve_vq;
     bool value;
 
-    /* All vector lengths are disabled when SVE is off. */
-    if (!cpu_isar_feature(aa64_sve, cpu)) {
+    /* All vector lengths are disabled when feature is off. */
+    if (sve
+        ? !cpu_isar_feature(aa64_sve, cpu)
+        : !cpu_isar_feature(aa64_sme, cpu)) {
         value = false;
     } else {
         value = extract32(vq_map->map, vq - 1, 1);
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
     cpu->isar.id_aa64pfr0 = t;
 }
 
+void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
+{
+    uint32_t vq_map = cpu->sme_vq.map;
+    uint32_t vq_init = cpu->sme_vq.init;
+    uint32_t vq_supported = cpu->sme_vq.supported;
+    uint32_t vq;
+
+    if (vq_map == 0) {
+        if (!cpu_isar_feature(aa64_sme, cpu)) {
+            cpu->isar.id_aa64smfr0 = 0;
+            return;
+        }
+
+        /* TODO: KVM will require limitations via SMCR_EL2. */
+        vq_map = vq_supported & ~vq_init;
+
+        if (vq_map == 0) {
+            vq = ctz32(vq_supported) + 1;
+            error_setg(errp, "cannot disable sme%d", vq * 128);
+            error_append_hint(errp, "All SME vector lengths are disabled.\n");
+            error_append_hint(errp, "With SME enabled, at least one "
+                              "vector length must be enabled.\n");
+            return;
+        }
+    } else {
+        if (!cpu_isar_feature(aa64_sme, cpu)) {
+            vq = 32 - clz32(vq_map);
+            error_setg(errp, "cannot enable sme%d", vq * 128);
+            error_append_hint(errp, "SME must be enabled to enable "
+                              "vector lengths.\n");
+            error_append_hint(errp, "Add sme=on to the CPU property list.\n");
+            return;
+        }
+        /* TODO: KVM will require limitations via SMCR_EL2. */
+    }
+
+    cpu->sme_vq.map = vq_map;
+}
+
+static bool cpu_arm_get_sme(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    return cpu_isar_feature(aa64_sme, cpu);
+}
+
+static void cpu_arm_set_sme(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint64_t t;
+
+    t = cpu->isar.id_aa64pfr1;
+    t = FIELD_DP64(t, ID_AA64PFR1, SME, value);
+    cpu->isar.id_aa64pfr1 = t;
+}
+
+static bool cpu_arm_get_sme_fa64(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    return cpu_isar_feature(aa64_sme, cpu) &&
+           cpu_isar_feature(aa64_sme_fa64, cpu);
+}
+
+static void cpu_arm_set_sme_fa64(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint64_t t;
+
+    t = cpu->isar.id_aa64smfr0;
+    t = FIELD_DP64(t, ID_AA64SMFR0, FA64, value);
+    cpu->isar.id_aa64smfr0 = t;
+}
+
 #ifdef CONFIG_USER_ONLY
-/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+/* Mirror linux /proc/sys/abi/{sve,sme}_default_vector_length. */
 static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
                                         const char *name, void *opaque,
                                         Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
      * and is the maximum architectural width of ZCR_ELx.LEN.
      */
     if (remainder || default_vq < 1 || default_vq > 512) {
-        error_setg(errp, "cannot set sve-default-vector-length");
+        ARMCPU *cpu = ARM_CPU(obj);
+        const char *which =
+            (ptr_default_vq == &cpu->sve_default_vq ? "sve" : "sme");
+
+        error_setg(errp, "cannot set %s-default-vector-length", which);
         if (remainder) {
             error_append_hint(errp, "Vector length not a multiple of 16\n");
         } else if (default_vq < 1) {
@@ -XXX,XX +XXX,XX @@ static void aarch64_add_sve_properties(Object *obj)
 #endif
 }
 
+static void aarch64_add_sme_properties(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq;
+
+    object_property_add_bool(obj, "sme", cpu_arm_get_sme, cpu_arm_set_sme);
+    object_property_add_bool(obj, "sme_fa64", cpu_arm_get_sme_fa64,
+                             cpu_arm_set_sme_fa64);
+
+    for (vq = 1; vq <= ARM_MAX_VQ; vq <<= 1) {
+        char name[8];
+        sprintf(name, "sme%d", vq * 128);
+        object_property_add(obj, name, "bool", cpu_arm_get_vq,
+                            cpu_arm_set_vq, NULL, &cpu->sme_vq);
+    }
+
+#ifdef CONFIG_USER_ONLY
+    /* Mirror linux /proc/sys/abi/sme_default_vector_length. */
+    object_property_add(obj, "sme-default-vector-length", "int32",
+                        cpu_arm_get_default_vec_len,
+                        cpu_arm_set_default_vec_len, NULL,
+                        &cpu->sme_default_vq);
+#endif
+}
+
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
 {
     int arch_val = 0, impdef_val = 0;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 #endif
 
     cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
+    cpu->sme_vq.supported = SVE_VQ_POW2_MAP;
 
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
+    aarch64_add_sme_properties(obj);
     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                         cpu_max_set_sve_max_vq, NULL, NULL);
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When Streaming SVE mode is enabled, the size is taken from
SMCR_ELx instead of ZCR_ELx.  The format is shared, but the
set of vector lengths is not.  Further, Streaming SVE does
not require any particular length to be supported.

Adjust sve_vqm1_for_el to pass the current value of PSTATE.SM
to the new function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  9 +++++++--
 target/arm/helper.c | 32 +++++++++++++++++++++++++-------
 2 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int cur_el);
 int sme_exception_el(CPUARMState *env, int cur_el);
 
 /**
- * sve_vqm1_for_el:
+ * sve_vqm1_for_el_sm:
  * @env: CPUARMState
  * @el: exception level
+ * @sm: streaming mode
  *
- * Compute the current SVE vector length for @el, in units of
+ * Compute the current vector length for @el & @sm, in units of
  * Quadwords Minus 1 -- the same scale used for ZCR_ELx.LEN.
+ * If @sm, compute for SVL, otherwise NVL.
  */
+uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm);
+
+/* Likewise, but using @sm = PSTATE.SM. */
 uint32_t sve_vqm1_for_el(CPUARMState *env, int el);
 
 static inline bool is_a64(CPUARMState *env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sme_exception_el(CPUARMState *env, int el)
 /*
  * Given that SVE is enabled, return the vector length for EL.
  */
-uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
+uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm)
 {
     ARMCPU *cpu = env_archcpu(env);
-    uint32_t len = cpu->sve_max_vq - 1;
+    uint64_t *cr = env->vfp.zcr_el;
+    uint32_t map = cpu->sve_vq.map;
+    uint32_t len = ARM_MAX_VQ - 1;
+
+    if (sm) {
+        cr = env->vfp.smcr_el;
+        map = cpu->sme_vq.map;
+    }
 
     if (el <= 1 && !el_is_in_host(env, el)) {
-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
+        len = MIN(len, 0xf & (uint32_t)cr[1]);
     }
     if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
+        len = MIN(len, 0xf & (uint32_t)cr[2]);
     }
     if (arm_feature(env, ARM_FEATURE_EL3)) {
-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
+        len = MIN(len, 0xf & (uint32_t)cr[3]);
     }
 
-    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
-    return len;
+    map &= MAKE_64BIT_MASK(0, len + 1);
+    if (map != 0) {
+        return 31 - clz32(map);
+    }
+
+    /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */
+    assert(sm);
+    return ctz32(cpu->sme_vq.map);
+}
+
+uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
+{
+    return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM));
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We need SVL separate from VL for RDSVL et al, as well as
ZA storage loads and stores, which do not require PSTATE.SM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 12 ++++++++++++
 target/arm/translate.h     |  1 +
 target/arm/helper.c        |  8 +++++++-
 target/arm/translate-a64.c |  1 +
 4 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
 FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
 FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
 FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
+FIELD(TBFLAG_A64, SVL, 24, 4)
 
 /*
  * Helpers for using the above.
@@ -XXX,XX +XXX,XX @@ static inline int sve_vq(CPUARMState *env)
     return EX_TBFLAG_A64(env->hflags, VL) + 1;
 }
 
+/**
+ * sme_vq
+ * @env: the cpu context
+ *
+ * Return the SVL cached within env->hflags, in units of quadwords.
+ */
+static inline int sme_vq(CPUARMState *env)
+{
+    return EX_TBFLAG_A64(env->hflags, SVL) + 1;
+}
+
 static inline bool bswap_code(bool sctlr_b)
 {
 #ifdef CONFIG_USER_ONLY
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
     int sme_excp_el; /* SME exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
+    int svl;         /* current streaming vector length in bytes */
     bool vfp_enabled; /* FP enabled via FPSCR.EN */
     int vec_len;
     int vec_stride;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
     }
     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
-        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
+        int sme_el = sme_exception_el(env, el);
+
+        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
+        if (sme_el == 0) {
+            /* Similarly, do not compute SVL if SME is disabled. */
+            DP_TBFLAG_A64(flags, SVL, sve_vqm1_for_el_sm(env, el, true));
+        }
         if (FIELD_EX64(env->svcr, SVCR, SM)) {
             DP_TBFLAG_A64(flags, PSTATE_SM, 1);
         }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
     dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
+    dc->svl = (EX_TBFLAG_A64(tb_flags, SVL) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
     dc->bt = EX_TBFLAG_A64(tb_flags, BT);
     dc->btype = EX_TBFLAG_A64(tb_flags, BTYPE);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We will need these functions in translate-sme.c.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.h | 38 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-sve.c | 36 ------------------------------------
 2 files changed, 38 insertions(+), 36 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_size(DisasContext *s)
     return s->vl;
 }
 
+/*
+ * Return the offset info CPUARMState of the predicate vector register Pn.
+ * Note for this purpose, FFR is P16.
+ */
+static inline int pred_full_reg_offset(DisasContext *s, int regno)
+{
+    return offsetof(CPUARMState, vfp.pregs[regno]);
+}
+
+/* Return the byte size of the whole predicate register, VL / 64.  */
+static inline int pred_full_reg_size(DisasContext *s)
+{
+    return s->vl >> 3;
+}
+
+/*
+ * Round up the size of a register to a size allowed by
+ * the tcg vector infrastructure.  Any operation which uses this
+ * size may assume that the bits above pred_full_reg_size are zero,
+ * and must leave them the same way.
+ *
+ * Note that this is not needed for the vector registers as they
+ * are always properly sized for tcg vectors.
+ */
+static inline int size_for_gvec(int size)
+{
+    if (size <= 8) {
+        return 8;
+    } else {
+        return QEMU_ALIGN_UP(size, 16);
+    }
+}
+
+static inline int pred_gvec_reg_size(DisasContext *s)
+{
+    return size_for_gvec(pred_full_reg_size(s));
+}
+
 bool disas_sve(DisasContext *, uint32_t);
 
 void gen_gvec_rax1(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static inline int msz_dtype(DisasContext *s, int msz)
  * Implement all of the translator functions referenced by the decoder.
  */
 
-/* Return the offset info CPUARMState of the predicate vector register Pn.
- * Note for this purpose, FFR is P16.
- */
-static inline int pred_full_reg_offset(DisasContext *s, int regno)
-{
-    return offsetof(CPUARMState, vfp.pregs[regno]);
-}
-
-/* Return the byte size of the whole predicate register, VL / 64.  */
-static inline int pred_full_reg_size(DisasContext *s)
-{
-    return s->vl >> 3;
-}
-
-/* Round up the size of a register to a size allowed by
- * the tcg vector infrastructure.  Any operation which uses this
- * size may assume that the bits above pred_full_reg_size are zero,
- * and must leave them the same way.
- *
- * Note that this is not needed for the vector registers as they
- * are always properly sized for tcg vectors.
- */
-static int size_for_gvec(int size)
-{
-    if (size <= 8) {
-        return 8;
-    } else {
-        return QEMU_ALIGN_UP(size, 16);
-    }
-}
-
-static int pred_gvec_reg_size(DisasContext *s)
-{
-    return size_for_gvec(pred_full_reg_size(s));
-}
-
 /* Invoke an out-of-line helper on 2 Zregs. */
 static bool gen_gvec_ool_zz(DisasContext *s, gen_helper_gvec_2 *fn,
                             int rd, int rn, int data)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the code from hw/arm/virt.c that is supposed
to handle v7 into the one function.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Message-id: 20220619001541.131672-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c    | 10 +---------
 target/arm/ptw.c | 24 ++++++++++++++++--------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         cpuobj = object_new(possible_cpus->cpus[0].type);
         armcpu = ARM_CPU(cpuobj);
 
-        if (object_property_get_bool(cpuobj, "aarch64", NULL)) {
-            pa_bits = arm_pamax(armcpu);
-        } else if (arm_feature(&armcpu->env, ARM_FEATURE_LPAE)) {
-            /* v7 with LPAE */
-            pa_bits = 40;
-        } else {
-            /* Anything else */
-            pa_bits = 32;
-        }
+        pa_bits = arm_pamax(armcpu);
 
         object_unref(cpuobj);
 
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t pamax_map[] = {
 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
 unsigned int arm_pamax(ARMCPU *cpu)
 {
-    unsigned int parange =
-        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        unsigned int parange =
+            FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
 
-    /*
-     * id_aa64mmfr0 is a read-only register so values outside of the
-     * supported mappings can be considered an implementation error.
-     */
-    assert(parange < ARRAY_SIZE(pamax_map));
-    return pamax_map[parange];
+        /*
+         * id_aa64mmfr0 is a read-only register so values outside of the
+         * supported mappings can be considered an implementation error.
+         */
+        assert(parange < ARRAY_SIZE(pamax_map));
+        return pamax_map[parange];
+    }
+    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
+        /* v7 with LPAE */
+        return 40;
+    }
+    /* Anything else */
+    return 32;
 }
 
 /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

In machvirt_init we create a cpu but do not fully initialize it.
Thus the propagation of V7VE to LPAE has not been done, and we
compute the wrong value for some v7 cpus, e.g. cortex-a15.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1078
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Message-id: 20220619001541.131672-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu)
         assert(parange < ARRAY_SIZE(pamax_map));
         return pamax_map[parange];
     }
-    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
+
+    /*
+     * In machvirt_init, we call arm_pamax on a cpu that is not fully
+     * initialized, so we can't rely on the propagation done in realize.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) ||
+        arm_feature(&cpu->env, ARM_FEATURE_V7VE)) {
         /* v7 with LPAE */
         return 40;
     }
-- 
2.25.1