Series comparison

-[PULL 00/16] target-arm queue
+[PULL 0/8] target-arm queue
-Patches for rc1: nothing major, just some minor bugfixes and
+The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce:
 code cleanups.
--- PMM
+  Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000)
 The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
   Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321
-for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
+for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255:
-  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
+  target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/Kconfig: ARM_V7M depends on PTIMER
+ * contrib/elf2dmp: Support Windows Server 2022
- * Minor coding style fixes
+ * hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
- * docs: add some notes on the sbsa-ref machine
+ * target/arm: Add Neoverse-N1 IMPDEF registers
- * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+ * hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
- * target/arm: Fix neon VTBL/VTBX for len > 1
+ * docs/system/arm/cpu-features.rst: Fix formatting
- * hw/arm/armsse: Correct expansion MPC interrupt lines
+ * target/arm: Don't advertise aarch64-pauth.xml to gdb
  * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Alex Bennée (1):
+Chen Baozi (1):
-      docs: add some notes on the sbsa-ref machine
+      target/arm: Add Neoverse-N1 registers
-AlexChen (1):
+Guenter Roeck (1):
-      ssi: Fix bad printf format specifiers
+      hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
-Andrew Jones (1):
+Peter Maydell (3):
-      hw/arm/Kconfig: ARM_V7M depends on PTIMER
+      hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
       docs/system/arm/cpu-features.rst: Fix formatting
       target/arm: Don't advertise aarch64-pauth.xml to gdb
-Havard Skinnemoen (1):
+Viktor Prutyanov (3):
-      tests/qtest/npcm7xx_rng-test: count runs properly
+      contrib/elf2dmp: fix code style
       contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
       contrib/elf2dmp: add PE name check and Windows Server 2022 support
-Peter Maydell (2):
+ docs/system/arm/cpu-features.rst |  68 ++++++++++-------------
-      hw/arm/nseries: Check return value from load_image_targphys()
+ contrib/elf2dmp/pe.h             | 115 ++++++++++++++++++++++-----------------
-      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+ contrib/elf2dmp/addrspace.c      |   1 +
+ contrib/elf2dmp/main.c           | 108 ++++++++++++++++++++++++------------
-Philippe Mathieu-Daudé (6):
+ hw/char/cadence_uart.c           |   6 +-
-      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+ hw/usb/imx-usb-phy.c             |  19 ++++++-
-      hw/arm/armsse: Correct expansion MPC interrupt lines
+ target/arm/cpu64.c               |  69 +++++++++++++++++++++++
-      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+ target/arm/gdbstub.c             |   7 +++
-      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+files changed, 267 insertions(+), 126 deletions(-)
       hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
       hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 Richard Henderson (1):
       target/arm: Fix neon VTBL/VTBX for len > 1
 Xinhao Zhang (3):
       target/arm: add spaces around operator
       target/arm: Don't use '#' flag of printf format
       target/arm: add space before the open parenthesis '('
  docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
  docs/system/target-arm.rst         |  1 +
  include/hw/misc/stm32f2xx_syscfg.h |  2 --
  target/arm/helper.h                |  2 +-
  hw/arm/armsse.c                    |  3 +-
  hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
  hw/arm/nseries.c                   | 26 ++++++++----------
  hw/arm/stm32f205_soc.c             |  1 -
  hw/misc/stm32f2xx_syscfg.c         |  2 --
  hw/ssi/imx_spi.c                   |  2 +-
  hw/ssi/xilinx_spi.c                |  2 +-
  target/arm/arch_dump.c             |  8 +++---
  target/arm/arm-semi.c              |  8 +++---
  target/arm/helper.c                |  2 +-
  target/arm/op_helper.c             | 23 +++++++++-------
  target/arm/translate-a64.c         |  4 +--
  target/arm/translate.c             |  2 +-
  tests/qtest/npcm7xx_rng-test.c     |  2 +-
  hw/arm/Kconfig                     |  3 +-
  target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
 files changed, 123 insertions(+), 98 deletions(-)
  create mode 100644 docs/system/arm/sbsa.rst

-[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
+Deleted patch
-From: Andrew Jones <drjones@redhat.com>
-commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
-changed armv7m_systick to build on ptimers. Make sure we have ptimers
-in the build when building armv7m_systick.
-Signed-off-by: Andrew Jones <drjones@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20201104103343.30392-1-drjones@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/Kconfig | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config ZYNQ
- config ARM_V7M
-     bool
-+    select PTIMER
- config ALLWINNER_A10
-     bool
---
-.20.1

-[PULL 02/16] ssi: Fix bad printf format specifiers
+Deleted patch
-From: AlexChen <alex.chen@huawei.com>
-We should use printf format specifier "%u" instead of "%d" for
-argument of type "unsigned int".
-Reported-by: Euler Robot <euler.robot@huawei.com>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 5FA280F5.8060902@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/ssi/imx_spi.c    | 2 +-
- hw/ssi/xilinx_spi.c | 2 +-
-files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/imx_spi.c
-+++ b/hw/ssi/imx_spi.c
-@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
-     case ECSPI_MSGDATA:
-         return  "ECSPI_MSGDATA";
-     default:
--        sprintf(unknown, "%d ?", reg);
-+        sprintf(unknown, "%u ?", reg);
-         return unknown;
-     }
- }
-diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spi.c
-+++ b/hw/ssi/xilinx_spi.c
-@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
-        irq chain unless things really changed.  */
-     if (pending != s->irqline) {
-         s->irqline = pending;
--        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
-+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
-                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
-         qemu_set_irq(s->irq, pending);
-     }
---
-.20.1

-[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+[PULL 1/8] target/arm: Add Neoverse-N1 registers
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Chen Baozi <chenbaozi@phytium.com.cn>
-omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
+Add implementation defined registers for neoverse-n1 which
-OMAP2 chip support") takes care of creating the 3 UARTs.
+would be accessed by TF-A. Since there is no DSU in Qemu,
 CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition.
-Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
+Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
 extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
 Fortunately we don't need to fix this, because commit 6da68df7f9b
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
+Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/nseries.c | 11 -----------
+ target/arm/cpu64.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++
-file changed, 11 deletions(-)
+file changed, 69 insertions(+)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/target/arm/cpu64.c
-+++ b/hw/arm/nseries.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
+@@ -XXX,XX +XXX,XX @@
-     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
+ #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "cpu.h"
 +#include "cpregs.h"
  #include "qemu/module.h"
  #include "sysemu/kvm.h"
  #include "sysemu/hvf.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
      /* TODO:  Add A64FX specific HPC extension registers */
  }
--static void n8x0_uart_setup(struct n800_s *s)
++static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
--{
++    { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64,
--    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
++      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0,
--    /*
++      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
++    { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64,
--     * here, but this code has been removed with the bluetooth backend.
++      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0,
--     */
++      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    omap_uart_attach(s->mpu->uart[BT_UART], radio);
++    { .name = "ATCR_EL3", .state = ARM_CP_STATE_AA64,
--}
++      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 7, .opc2 = 0,
--
++      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
- static void n8x0_usb_setup(struct n800_s *s)
++    { .name = "ATCR_EL12", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 5, .crn = 15, .crm = 7, .opc2 = 0,
 +      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "AVTCR_EL2", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 1,
 +      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    /*
 +     * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU
 +     * (and in particular its system registers).
 +     */
 +    { .name = "CPUCFR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 0, .opc2 = 0,
 +      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 },
 +    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 },
 +    { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPMR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 3,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPOR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 2,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPSELR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 0,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +};
 +
 +static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
 +{
 +    define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
 +}
 +
  static void aarch64_neoverse_n1_initfn(Object *obj)
  {
-     SysBusDevice *dev;
+     ARMCPU *cpu = ARM_CPU(obj);
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
-     n8x0_spi_setup(s);
-     n8x0_dss_setup(s);
+     /* From D5.1 AArch64 PMU register summary */
-     n8x0_cbus_setup(s);
+     cpu->isar.reset_pmcr_el0 = 0x410c3000;
--    n8x0_uart_setup(s);
++
-     if (machine_usb(machine)) {
++    define_neoverse_n1_cp_reginfo(cpu);
-         n8x0_usb_setup(s);
+ }
-     }
  static void aarch64_host_initfn(Object *obj)
 --
-.20.1
+.34.1

-[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+[PULL 2/8] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
-Checks for UNDEF cases should go before the "is VFP enabled?" access
+The cadence UART attempts to avoid allowing the guest to set invalid
-check, except in special cases. Move a stray UNDEF check in the VTBL
+baud rate register values in the uart_write() function.  However it
-trans function up above the access check.
+does the "mask to the size of the register field" and "check for
 invalid values" in the wrong order, which means that a malicious
 guest can get a bogus value into the register by setting also some
 high bits in the value, and cause QEMU to crash by division-by-zero.
+Do the mask before the bounds check instead of afterwards.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
+Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested-by: Qiang Liu <cyruscyliu@gmail.com>
 Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
 ---
- target/arm/translate-neon.c.inc | 8 ++++----
+ hw/char/cadence_uart.c | 6 ++++--
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-neon.c.inc
+--- a/hw/char/cadence_uart.c
-+++ b/target/arm/translate-neon.c.inc
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
-         return false;
+         }
-     }
+         break;
+     case R_BRGR: /* Baud rate generator */
--    if (!vfp_access_check(s)) {
++        value &= 0xffff;
--        return true;
+         if (value >= 0x01) {
--    }
+-            s->r[offset] = value & 0xFFFF;
--
++            s->r[offset] = value;
-     if ((a->vn + a->len + 1) > 32) {
+         }
-         /*
+         break;
-          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
+     case R_BDIV:    /* Baud rate divider */
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
++        value &= 0xff;
-         return false;
+         if (value >= 0x04) {
-     }
+-            s->r[offset] = value & 0xFF;
++            s->r[offset] = value;
-+    if (!vfp_access_check(s)) {
+         }
-+        return true;
+         break;
-+    }
+     default:
 +
      desc = tcg_const_i32((a->vn << 2) | a->len);
      def = tcg_temp_new_i64();
      if (a->op) {
 --
-.20.1
+.34.1

-[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
+[PULL 3/8] contrib/elf2dmp: fix code style
-From: Havard Skinnemoen <hskinnemoen@google.com>
+From: Viktor Prutyanov <viktor@daynix.com>
-The number of runs is equal to the number of 0-1 and 1-0 transitions,
+Originally elf2dmp were added with some code style issues,
-plus one. Currently, it's counting the number of times these transitions
+especially in pe.h header, and some were introduced by
-do _not_ happen, plus one.
+d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now.
-Source:
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
-https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
+Reviewed-by: Annie Li <annie.li@oracle.com>
-section 2.3.4 point (3).
+Message-id: 20230222211246.883679-2-viktor@daynix.com
 Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/npcm7xx_rng-test.c | 2 +-
+ contrib/elf2dmp/pe.h        | 100 ++++++++++++++++++------------------
-file changed, 1 insertion(+), 1 deletion(-)
+ contrib/elf2dmp/addrspace.c |   1 +
  contrib/elf2dmp/main.c      |   9 ++--
 files changed, 57 insertions(+), 53 deletions(-)
-diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
+diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/npcm7xx_rng-test.c
+--- a/contrib/elf2dmp/pe.h
-+++ b/tests/qtest/npcm7xx_rng-test.c
++++ b/contrib/elf2dmp/pe.h
-@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
+@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DOS_HEADER {
-     pi = (double)nr_ones / nr_bits;
+ } __attribute__ ((packed)) IMAGE_DOS_HEADER;
-     for (k = 0; k < nr_bits - 1; k++) {
+ typedef struct IMAGE_FILE_HEADER {
--        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+-  uint16_t  Machine;
-+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
+-  uint16_t  NumberOfSections;
 -  uint32_t  TimeDateStamp;
 -  uint32_t  PointerToSymbolTable;
 -  uint32_t  NumberOfSymbols;
 -  uint16_t  SizeOfOptionalHeader;
 -  uint16_t  Characteristics;
 +    uint16_t  Machine;
 +    uint16_t  NumberOfSections;
 +    uint32_t  TimeDateStamp;
 +    uint32_t  PointerToSymbolTable;
 +    uint32_t  NumberOfSymbols;
 +    uint16_t  SizeOfOptionalHeader;
 +    uint16_t  Characteristics;
  } __attribute__ ((packed)) IMAGE_FILE_HEADER;
  typedef struct IMAGE_DATA_DIRECTORY {
 -  uint32_t VirtualAddress;
 -  uint32_t Size;
 +    uint32_t VirtualAddress;
 +    uint32_t Size;
  } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY;
  #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
  typedef struct IMAGE_OPTIONAL_HEADER64 {
 -  uint16_t  Magic; /* 0x20b */
 -  uint8_t   MajorLinkerVersion;
 -  uint8_t   MinorLinkerVersion;
 -  uint32_t  SizeOfCode;
 -  uint32_t  SizeOfInitializedData;
 -  uint32_t  SizeOfUninitializedData;
 -  uint32_t  AddressOfEntryPoint;
 -  uint32_t  BaseOfCode;
 -  uint64_t  ImageBase;
 -  uint32_t  SectionAlignment;
 -  uint32_t  FileAlignment;
 -  uint16_t  MajorOperatingSystemVersion;
 -  uint16_t  MinorOperatingSystemVersion;
 -  uint16_t  MajorImageVersion;
 -  uint16_t  MinorImageVersion;
 -  uint16_t  MajorSubsystemVersion;
 -  uint16_t  MinorSubsystemVersion;
 -  uint32_t  Win32VersionValue;
 -  uint32_t  SizeOfImage;
 -  uint32_t  SizeOfHeaders;
 -  uint32_t  CheckSum;
 -  uint16_t  Subsystem;
 -  uint16_t  DllCharacteristics;
 -  uint64_t  SizeOfStackReserve;
 -  uint64_t  SizeOfStackCommit;
 -  uint64_t  SizeOfHeapReserve;
 -  uint64_t  SizeOfHeapCommit;
 -  uint32_t  LoaderFlags;
 -  uint32_t  NumberOfRvaAndSizes;
 -  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 +    uint16_t  Magic; /* 0x20b */
 +    uint8_t   MajorLinkerVersion;
 +    uint8_t   MinorLinkerVersion;
 +    uint32_t  SizeOfCode;
 +    uint32_t  SizeOfInitializedData;
 +    uint32_t  SizeOfUninitializedData;
 +    uint32_t  AddressOfEntryPoint;
 +    uint32_t  BaseOfCode;
 +    uint64_t  ImageBase;
 +    uint32_t  SectionAlignment;
 +    uint32_t  FileAlignment;
 +    uint16_t  MajorOperatingSystemVersion;
 +    uint16_t  MinorOperatingSystemVersion;
 +    uint16_t  MajorImageVersion;
 +    uint16_t  MinorImageVersion;
 +    uint16_t  MajorSubsystemVersion;
 +    uint16_t  MinorSubsystemVersion;
 +    uint32_t  Win32VersionValue;
 +    uint32_t  SizeOfImage;
 +    uint32_t  SizeOfHeaders;
 +    uint32_t  CheckSum;
 +    uint16_t  Subsystem;
 +    uint16_t  DllCharacteristics;
 +    uint64_t  SizeOfStackReserve;
 +    uint64_t  SizeOfStackCommit;
 +    uint64_t  SizeOfHeapReserve;
 +    uint64_t  SizeOfHeapCommit;
 +    uint32_t  LoaderFlags;
 +    uint32_t  NumberOfRvaAndSizes;
 +    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64;
  typedef struct IMAGE_NT_HEADERS64 {
 -  uint32_t Signature;
 -  IMAGE_FILE_HEADER FileHeader;
 -  IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 +    uint32_t Signature;
 +    IMAGE_FILE_HEADER FileHeader;
 +    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
  } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
  typedef struct IMAGE_DEBUG_DIRECTORY {
 -  uint32_t Characteristics;
 -  uint32_t TimeDateStamp;
 -  uint16_t MajorVersion;
 -  uint16_t MinorVersion;
 -  uint32_t Type;
 -  uint32_t SizeOfData;
 -  uint32_t AddressOfRawData;
 -  uint32_t PointerToRawData;
 +    uint32_t Characteristics;
 +    uint32_t TimeDateStamp;
 +    uint16_t MajorVersion;
 +    uint16_t MinorVersion;
 +    uint32_t Type;
 +    uint32_t SizeOfData;
 +    uint32_t AddressOfRawData;
 +    uint32_t PointerToRawData;
  } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY;
  #define IMAGE_DEBUG_TYPE_CODEVIEW   2
 diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/addrspace.c
 +++ b/contrib/elf2dmp/addrspace.c
@@ -XXX,XX +XXX,XX @@
  static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
  {
      size_t i;
 +
      for (i = 0; i < ps->block_nr; i++) {
          if (ps->block[i].paddr <= pa &&
                  pa <= ps->block[i].paddr + ps->block[i].size) {
 diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/main.c
 +++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
      };
      for (i = 0; i < ps->block_nr; i++) {
 -        h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
 +        h.PhysicalMemoryBlock.NumberOfPages +=
 +                ps->block[i].size / ELF2DMP_PAGE_SIZE;
          h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
              .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
              .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
          };
      }
-     vn_obs += 1;
+-    h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
 +    h.RequiredDumpSpace +=
 +            h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
      *hdr = h;
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
  static int fill_context(KDDEBUGGER_DATA64 *kdbg,
          struct va_space *vs, QEMU_Elf *qe)
  {
 -        int i;
 +    int i;
 +
      for (i = 0; i < qe->state_nr; i++) {
          uint64_t Prcb;
          uint64_t Context;
 --
-.20.1
+.34.1

-[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
+[PULL 4/8] contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Viktor Prutyanov <viktor@daynix.com>
-The helper function did not get updated when we reorganized
+Move out PE directory search functionality to be reused not only
-the vector register file for SVE.  Since then, the neon dregs
+for Debug Directory processing but for arbitrary PE directory.
 are non-sequential and cannot be simply indexed.
-At the same time, make the helper function operate on 64-bit
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
-quantities so that we do not have to call it twice.
+Reviewed-by: Annie Li <annie.li@oracle.com>
+Message-id: 20230222211246.883679-3-viktor@daynix.com
 Fixes: c39c2b9043e
 Reported-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 [PMM: use aa32_vfp_dreg() rather than opencoding]
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h             |  2 +-
+ contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++-----------------
- target/arm/op_helper.c          | 23 +++++++++--------
+file changed, 42 insertions(+), 29 deletions(-)
  target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/contrib/elf2dmp/main.c
-+++ b/target/arm/helper.h
++++ b/contrib/elf2dmp/main.c
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
+@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
- DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
+     return 0;
  DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
  DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
 -DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
 +DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
  DEF_HELPER_3(shl_cc, i32, env, i32, i32)
  DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
      cpu_loop_exit_restore(cs, ra);
  }
--uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
++static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
--                          uint32_t maxindex)
++        void *entry, size_t size, struct va_space *vs)
-+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
++{
-+                          uint64_t ireg, uint64_t def)
++    const char e_magic[2] = "MZ";
 +    const char Signature[4] = "PE\0\0";
 +    IMAGE_DOS_HEADER *dos_hdr = start_addr;
 +    IMAGE_NT_HEADERS64 nt_hdrs;
 +    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
 +    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
 +    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
 +
 +    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 +
 +    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 +        return 1;
 +    }
 +
 +    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 +                &nt_hdrs, sizeof(nt_hdrs), 0)) {
 +        return 1;
 +    }
 +
 +    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 +            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 +        return 1;
 +    }
 +
 +    if (va_space_rw(vs,
 +                base + data_dir[idx].VirtualAddress,
 +                entry, size, 0)) {
 +        return 1;
 +    }
 +
 +    printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
 +            (uint32_t)data_dir[idx].VirtualAddress);
 +
 +    return 0;
 +}
 +
  static int write_dump(struct pa_space *ps,
          WinDumpHeader64 *hdr, const char *name)
  {
--    uint32_t val, shift;
+@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
--    uint64_t *table = vn;
+ static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
-+    uint64_t tmp, val = 0;
+         char *hash, struct va_space *vs)
-+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+ {
-+    uint32_t base_reg = desc >> 2;
+-    const char e_magic[2] = "MZ";
-+    uint32_t shift, index, reg;
+-    const char Signature[4] = "PE\0\0";
+     const char sign_rsds[4] = "RSDS";
--    val = 0;
+-    IMAGE_DOS_HEADER *dos_hdr = start_addr;
--    for (shift = 0; shift < 32; shift += 8) {
+-    IMAGE_NT_HEADERS64 nt_hdrs;
--        uint32_t index = (ireg >> shift) & 0xff;
+-    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
-+    for (shift = 0; shift < 64; shift += 8) {
+-    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
-+        index = (ireg >> shift) & 0xff;
+-    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
-         if (index < maxindex) {
+     IMAGE_DEBUG_DIRECTORY debug_dir;
--            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
+     OMFSignatureRSDS rsds;
--            val |= tmp << shift;
+     char *pdb_name;
-+            reg = base_reg + (index >> 3);
+     size_t pdb_name_sz;
-+            tmp = *aa32_vfp_dreg(env, reg);
+     size_t i;
-+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
-         } else {
+-    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
--            val |= def & (0xff << shift);
+-
-+            tmp = def & (0xffull << shift);
+-    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
-         }
+-        return 1;
-+        val |= tmp;
+-    }
 -
 -    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 -                &nt_hdrs, sizeof(nt_hdrs), 0)) {
 -        return 1;
 -    }
 -
 -    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 -            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 -        return 1;
 -    }
 -
 -    printf("Debug Directory RVA = 0x%08"PRIx32"\n",
 -            (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
 -
 -    if (va_space_rw(vs,
 -                base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
 -                &debug_dir, sizeof(debug_dir), 0)) {
 +    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
 +                &debug_dir, sizeof(debug_dir), vs)) {
 +        eprintf("Failed to get Debug Directory\n");
          return 1;
      }
-     return val;
- }
-diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-neon.c.inc
-+++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
- static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
- {
--    int n;
--    TCGv_i32 tmp, tmp2, tmp3, tmp4;
--    TCGv_ptr ptr1;
-+    TCGv_i64 val, def;
-+    TCGv_i32 desc;
-     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-         return false;
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-         return true;
-     }
--    n = a->len + 1;
--    if ((a->vn + n) > 32) {
-+    if ((a->vn + a->len + 1) > 32) {
-         /*
-          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
-          * helper function running off the end of the register file.
-          */
-         return false;
-     }
--    n <<= 3;
--    tmp = tcg_temp_new_i32();
--    if (a->op) {
--        read_neon_element32(tmp, a->vd, 0, MO_32);
--    } else {
--        tcg_gen_movi_i32(tmp, 0);
--    }
--    tmp2 = tcg_temp_new_i32();
--    read_neon_element32(tmp2, a->vm, 0, MO_32);
--    ptr1 = vfp_reg_ptr(true, a->vn);
--    tmp4 = tcg_const_i32(n);
--    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
-+    desc = tcg_const_i32((a->vn << 2) | a->len);
-+    def = tcg_temp_new_i64();
-     if (a->op) {
--        read_neon_element32(tmp, a->vd, 1, MO_32);
-+        read_neon_element64(def, a->vd, 0, MO_64);
-     } else {
--        tcg_gen_movi_i32(tmp, 0);
-+        tcg_gen_movi_i64(def, 0);
-     }
--    tmp3 = tcg_temp_new_i32();
--    read_neon_element32(tmp3, a->vm, 1, MO_32);
--    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
--    tcg_temp_free_i32(tmp);
--    tcg_temp_free_i32(tmp4);
--    tcg_temp_free_ptr(ptr1);
-+    val = tcg_temp_new_i64();
-+    read_neon_element64(val, a->vm, 0, MO_64);
--    write_neon_element32(tmp2, a->vd, 0, MO_32);
--    write_neon_element32(tmp3, a->vd, 1, MO_32);
--    tcg_temp_free_i32(tmp2);
--    tcg_temp_free_i32(tmp3);
-+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
-+    write_neon_element64(val, a->vd, 0, MO_64);
-+
-+    tcg_temp_free_i64(def);
-+    tcg_temp_free_i64(val);
-+    tcg_temp_free_i32(desc);
-     return true;
- }
 --
-.20.1
+.34.1

-[PULL 03/16] target/arm: add spaces around operator
+[PULL 5/8] contrib/elf2dmp: add PE name check and Windows Server 2022 support
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Viktor Prutyanov <viktor@daynix.com>
-Fix code style. Operator needs spaces both sides.
+Since its inception elf2dmp has checked MZ signatures within an
 address space above IDT[0] interrupt vector and took first PE image
 found as Windows Kernel.
 But in Windows Server 2022 memory dump this address space range is
 full of invalid PE fragments and the tool must check that PE image
 is 'ntoskrnl.exe' actually.
 So, introduce additional validation by checking image name from
 Export Directory against 'ntoskrnl.exe'.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
-Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
+Reviewed-by: Annie Li <annie.li@oracle.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20230222211246.883679-4-viktor@daynix.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/arch_dump.c | 8 ++++----
+ contrib/elf2dmp/pe.h   | 15 +++++++++++++++
- target/arm/arm-semi.c  | 8 ++++----
+ contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++--
- target/arm/helper.c    | 2 +-
+files changed, 41 insertions(+), 2 deletions(-)
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arch_dump.c
+--- a/contrib/elf2dmp/pe.h
-+++ b/target/arm/arch_dump.c
++++ b/contrib/elf2dmp/pe.h
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 {
+     IMAGE_OPTIONAL_HEADER64 OptionalHeader;
-     for (i = 0; i < 32; ++i) {
+ } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
-         uint64_t *q = aa64_vfp_qreg(env, i);
--        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
++typedef struct IMAGE_EXPORT_DIRECTORY {
--        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++    uint32_t    Characteristics;
-+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++    uint32_t    TimeDateStamp;
-+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
++    uint16_t    MajorVersion;
-     }
++    uint16_t    MinorVersion;
++    uint32_t    Name;
-     if (s->dump_info.d_endian == ELFDATA2MSB) {
++    uint32_t    Base;
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
++    uint32_t    NumberOfFunctions;
-          */
++    uint32_t    NumberOfNames;
-         for (i = 0; i < 32; ++i) {
++    uint32_t    AddressOfFunctions;
-             uint64_t tmp = note.vfp.vregs[2*i];
++    uint32_t    AddressOfNames;
--            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
++    uint32_t    AddressOfNameOrdinals;
--            note.vfp.vregs[2*i+1] = tmp;
++} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;
-+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
++
-+            note.vfp.vregs[2 * i + 1] = tmp;
+ typedef struct IMAGE_DEBUG_DIRECTORY {
      uint32_t Characteristics;
      uint32_t TimeDateStamp;
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY {
  #define IMAGE_DEBUG_TYPE_CODEVIEW   2
  #endif
 +#define IMAGE_FILE_EXPORT_DIRECTORY 0
  #define IMAGE_FILE_DEBUG_DIRECTORY  6
  typedef struct guid_t {
 diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/main.c
 +++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@
  #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
  #define PDB_NAME    "ntkrnlmp.pdb"
 +#define PE_NAME     "ntoskrnl.exe"
  #define INITIAL_MXCSR   0x1f80
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
      return fclose(dmp_file);
  }
 +static bool pe_check_export_name(uint64_t base, void *start_addr,
 +        struct va_space *vs)
 +{
 +    IMAGE_EXPORT_DIRECTORY export_dir;
 +    const char *pe_name;
 +
 +    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY,
 +                &export_dir, sizeof(export_dir), vs)) {
 +        return false;
 +    }
 +
 +    pe_name = va_space_resolve(vs, base + export_dir.Name);
 +    if (!pe_name) {
 +        return false;
 +    }
 +
 +    return !strcmp(pe_name, PE_NAME);
 +}
 +
  static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
          char *hash, struct va_space *vs)
  {
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
      uint64_t KdDebuggerDataBlock;
      KDDEBUGGER_DATA64 *kdbg;
      uint64_t KdVersionBlock;
 +    bool kernel_found = false;
      if (argc != 3) {
          eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
          }
          if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
 -            break;
 +            if (pe_check_export_name(KernBase, nt_start_addr, &vs)) {
 +                kernel_found = true;
 +                break;
 +            }
          }
      }
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+-    if (!nt_start_addr) {
-index XXXXXXX..XXXXXXX 100644
++    if (!kernel_found) {
---- a/target/arm/arm-semi.c
+         eprintf("Failed to find NT kernel image\n");
-+++ b/target/arm/arm-semi.c
+         err = 1;
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         goto out_ps;
          if (use_gdb_syscalls()) {
              arm_semi_open_guestfd = guestfd;
              ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
 -                                  (int)arg2+1, gdb_open_modeflags[arg1]);
 +                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
          } else {
              ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
              if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
 -                                  arg0, (int)arg1+1);
 +                                  arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(3);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
 -                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
 +                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
          } else {
              char *s2;
              s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
      uint32_t sum;
      sum = do_usad(a, b);
      sum += do_usad(a >> 8, b >> 8);
 -    sum += do_usad(a >> 16, b >>16);
 +    sum += do_usad(a >> 16, b >> 16);
      sum += do_usad(a >> 24, b >> 24);
      return sum;
  }
 --
-.20.1
+.34.1

-[PULL 04/16] target/arm: Don't use '#' flag of printf format
+[PULL 6/8] hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Guenter Roeck <linux@roeck-us.net>
-Fix code style. Don't use '#' flag of printf format ('%#') in
+The i.MX USB Phy driver does not check register ranges, resulting in out of
-format strings, use '0x' prefix instead
+bounds accesses if an attempt is made to access non-existing PHY registers.
 Add range check and conditionally report bad accesses to fix the problem.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+While at it, also conditionally log attempted writes to non-existing or
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
+read-only registers.
-Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
 Reported-by: Qiang Liu <cyruscyliu@gmail.com>
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Tested-by: Qiang Liu <cyruscyliu@gmail.com>
 Message-id: 20230316234926.208874-1-linux@roeck-us.net
 Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
 Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 4 ++--
+ hw/usb/imx-usb-phy.c | 19 +++++++++++++++++--
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 17 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/usb/imx-usb-phy.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/usb/imx-usb-phy.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@
-                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
+ #include "qemu/osdep.h"
-                 break;
+ #include "hw/usb/imx-usb-phy.h"
-             default:
+ #include "migration/vmstate.h"
--                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
++#include "qemu/log.h"
-+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
+ #include "qemu/module.h"
-                         __func__, insn, fpopcode, s->pc_curr);
-                 g_assert_not_reached();
+ static const VMStateDescription vmstate_imx_usbphy = {
-             }
+@@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
+         value = s->usbphy[index - 3];
      case 0x7f: /* FSQRT (vector) */
          break;
      default:
--        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+-        value = s->usbphy[index];
-+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
++        if (index < USBPHY_MAX) {
-         g_assert_not_reached();
++            value = s->usbphy[index];
 +        } else {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: Read from non-existing USB PHY register 0x%"
 +                          HWADDR_PRIx "\n",
 +                          __func__, offset);
 +            value = 0;
 +        }
          break;
      }
+     return (uint64_t)value;
@@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
          s->usbphy[index - 3] ^= value;
          break;
      default:
 -        /* Other registers are read-only */
 +        /* Other registers are read-only or do not exist */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Write to %s USB PHY register 0x%"
 +                      HWADDR_PRIx "\n",
 +                      __func__,
 +                      index >= USBPHY_MAX ? "non-existing" : "read-only",
 +                      offset);
          break;
      }
  }
 --
-.20.1
+.34.1

-[PULL 05/16] target/arm: add space before the open parenthesis '('
+Deleted patch
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Fix code style. Space required before the open parenthesis '('.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-             - Hardware watchpoints.
-            Hardware breakpoints have already been handled and skip this code.
-          */
--        switch(dc->base.is_jmp) {
-+        switch (dc->base.is_jmp) {
-         case DISAS_NEXT:
-         case DISAS_TOO_MANY:
-             gen_goto_tb(dc, 1, dc->base.pc_next);
---
-.20.1

-[PULL 06/16] docs: add some notes on the sbsa-ref machine
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-We should at least document what this machine is about.
-Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
-Cc: Leif Lindholm <leif@nuviainc.com>
-Cc: Shashi Mallela <shashi.mallela@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-[PMM: fixed filename mismatch]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
- docs/system/target-arm.rst |  1 +
-files changed, 33 insertions(+)
- create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@
-+Arm Server Base System Architecture Reference board (``sbsa-ref``)
-+==================================================================
-+
-+While the `virt` board is a generic board platform that doesn't match
-+any real hardware the `sbsa-ref` board intends to look like real
-+hardware. The `Server Base System Architecture
-+<https://developer.arm.com/documentation/den0029/latest>` defines a
-+minimum base line of hardware support and importantly how the firmware
-+reports that to any operating system. It is a static system that
-+reports a very minimal DT to the firmware for non-discoverable
-+information about components affected by the qemu command line (i.e.
-+cpus and memory). As a result it must have a firmware specifically
-+built to expect a certain hardware layout (as you would in a real
-+machine).
-+
-+It is intended to be a machine for developing firmware and testing
-+standards compliance with operating systems.
-+
-+Supported devices
-+"""""""""""""""""
-+
-+The sbsa-ref board supports:
-+
-+  - A configurable number of AArch64 CPUs
-+  - GIC version 3
-+  - System bus AHCI controller
-+  - System bus EHCI controller
-+  - CDROM and hard disc on AHCI bus
-+  - E1000E ethernet card on PCIe bus
-+  - VGA display adaptor on PCIe bus
-+  - A generic SBSA watchdog device
-+
-diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/target-arm.rst
-+++ b/docs/system/target-arm.rst
-@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
-    arm/mps2
-    arm/musca
-    arm/realview
-+   arm/sbsa
-    arm/versatile
-    arm/vexpress
-    arm/aspeed
---
-.20.1

-[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-When using a Cortex-A15, the Virt machine does not use any
-MPCore peripherals. Remove the dependency.
-Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20201107114852.271922-1-philmd@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/Kconfig | 1 -
-file changed, 1 deletion(-)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-     imply VFIO_PLATFORM
-     imply VFIO_XGMAC
-     imply TPM_TIS_SYSBUS
--    select A15MPCORE
-     select ACPI
-     select ARM_SMMUV3
-     select GPIO_KEY
---
-.20.1

-[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We can use one MPC per SRAM bank, but we currently only wire the
-IRQ from the first expansion MPC to the IRQ splitter. Fix that.
-Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-2-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/armsse.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armsse.c
-+++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-                                         qdev_get_gpio_in(dev_splitter, 0));
-             qdev_connect_gpio_out(dev_splitter, 0,
-                                   qdev_get_gpio_in_named(dev_secctl,
--                                                         "mpc_status", 0));
-+                                                         "mpc_status",
-+                                                         i - IOTS_NUM_EXP_MPC));
-         }
-         qdev_connect_gpio_out(dev_splitter, 1,
---
-.20.1

-[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The system configuration controller (SYSCFG) doesn't have
-any output IRQ (and the INTC input #71 belongs to the UART6).
-Remove the invalid code.
-Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-3-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/misc/stm32f2xx_syscfg.h | 2 --
- hw/arm/stm32f205_soc.c             | 1 -
- hw/misc/stm32f2xx_syscfg.c         | 2 --
-files changed, 5 deletions(-)
-diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
-     uint32_t syscfg_exticr3;
-     uint32_t syscfg_exticr4;
-     uint32_t syscfg_cmpcr;
--
--    qemu_irq irq;
- };
- #endif /* HW_STM32F2XX_SYSCFG_H */
-diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/stm32f205_soc.c
-+++ b/hw/arm/stm32f205_soc.c
-@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
-     }
-     busdev = SYS_BUS_DEVICE(dev);
-     sysbus_mmio_map(busdev, 0, 0x40013800);
--    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
-     /* Attach UART (uses USART registers) and USART controllers */
-     for (i = 0; i < STM_NUM_USARTS; i++) {
-diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/stm32f2xx_syscfg.c
-+++ b/hw/misc/stm32f2xx_syscfg.c
-@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
- {
-     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
--    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
--
-     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
-                           TYPE_STM32F2XX_SYSCFG, 0x400);
-     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
---
-.20.1

-[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The MusicPal board code connects both of the IRQ outputs of the UART
-to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-to the same input is not valid as it produces subtly wrong behaviour
-(for instance if both the IRQ lines are high, and then one goes
-low, the INTC input will see this as a high-to-low transition
-even though the second IRQ line should still be holding it high).
-This kind of wiring needs an explicitly created OR gate; add one.
-Inspired-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-5-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/musicpal.c | 17 +++++++++++++----
- hw/arm/Kconfig    |  1 +
-files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
-+++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@
- #include "ui/console.h"
- #include "hw/i2c/i2c.h"
- #include "hw/irq.h"
-+#include "hw/or-irq.h"
- #include "hw/audio/wm8750.h"
- #include "sysemu/block-backend.h"
- #include "sysemu/runstate.h"
-@@ -XXX,XX +XXX,XX @@
- #define MP_TIMER4_IRQ           7
- #define MP_EHCI_IRQ             8
- #define MP_ETH_IRQ              9
--#define MP_UART1_IRQ            11
--#define MP_UART2_IRQ            11
-+#define MP_UART_SHARED_IRQ      11
- #define MP_GPIO_IRQ             12
- #define MP_RTC_IRQ              28
- #define MP_AUDIO_IRQ            30
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-     ARMCPU *cpu;
-     qemu_irq pic[32];
-     DeviceState *dev;
-+    DeviceState *uart_orgate;
-     DeviceState *i2c_dev;
-     DeviceState *lcd_dev;
-     DeviceState *key_dev;
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                           pic[MP_TIMER4_IRQ], NULL);
--    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
-+    /* Logically OR both UART IRQs together */
-+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+
-+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+                   qdev_get_gpio_in(uart_orgate, 0),
-                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
--    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
-+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
-+                   qdev_get_gpio_in(uart_orgate, 1),
-                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
-     /* Register flash */
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config MUSCA
- config MUSICPAL
-     bool
-+    select OR_IRQ
-     select BITBANG_I2C
-     select MARVELL_88W8618
-     select PTIMER
---
-.20.1

-[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
+[PULL 7/8] docs/system/arm/cpu-features.rst: Fix formatting
-The nseries machines have a codepath that allows them to load a
+The markup for the Arm CPU feature documentation is incorrect,
-secondary bootloader.  This code wasn't checking that the
+and results in the HTML not rendering correctly -- the first
-load_image_targphys() succeeded.  Check the return value and report
+line of each description is rendered in boldface as if it
-the error to the user.
+were part of the option name.
-While we're in the vicinity, fix the comment style of the
+Reformat to match the styling used in cpu-models-x86.rst.inc.
 comment documenting what this image load is doing.
-Fixes: Coverity CID 1192904
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org
-Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
 ---
- hw/arm/nseries.c | 15 +++++++++++----
+ docs/system/arm/cpu-features.rst | 68 ++++++++++++++------------------
-file changed, 11 insertions(+), 4 deletions(-)
+file changed, 30 insertions(+), 38 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/docs/system/arm/cpu-features.rst
-+++ b/hw/arm/nseries.c
++++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ are named with the prefix "kvm-".  KVM VCPU features may be probed,
-         /* No, wait, better start at the ROM.  */
+ enabled, and disabled in the same way as other CPU features.  Below is
-         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
+ the list of KVM VCPU features and their descriptions.
--        /* This is intended for loading the `secondary.bin' program from
+-  kvm-no-adjvtime          By default kvm-no-adjvtime is disabled.  This
-+        /*
+-                           means that by default the virtual time
-+         * This is intended for loading the `secondary.bin' program from
+-                           adjustment is enabled (vtime is not *not*
-          * Nokia images (the NOLO bootloader).  The entry point seems
+-                           adjusted).
-          * to be at OMAP2_Q2_BASE + 0x400000.
++``kvm-no-adjvtime``
-          *
++  By default kvm-no-adjvtime is disabled.  This means that by default
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
++  the virtual time adjustment is enabled (vtime is not *not* adjusted).
-          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
-          *
+-                           When virtual time adjustment is enabled each
-          * The code above is for loading the `zImage' file from Nokia
+-                           time the VM transitions back to running state
--         * images.  */
+-                           the VCPU's virtual counter is updated to ensure
--        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
+-                           stopped time is not counted.  This avoids time
--                            machine->ram_size - 0x400000);
+-                           jumps surprising guest OSes and applications,
-+         * images.
+-                           as long as they use the virtual counter for
-+         */
+-                           timekeeping.  However it has the side effect of
-+        if (load_image_targphys(option_rom[0].name,
+-                           the virtual and physical counters diverging.
-+                                OMAP2_Q2_BASE + 0x400000,
+-                           All timekeeping based on the virtual counter
-+                                machine->ram_size - 0x400000) < 0) {
+-                           will appear to lag behind any timekeeping that
-+            error_report("Failed to load secondary bootloader %s",
+-                           does not subtract VM stopped time.  The guest
-+                         option_rom[0].name);
+-                           may resynchronize its virtual counter with
-+            exit(EXIT_FAILURE);
+-                           other time sources as needed.
-+        }
++  When virtual time adjustment is enabled each time the VM transitions
++  back to running state the VCPU's virtual counter is updated to
-         n800_setup_nolo_tags(nolo_tags);
++  ensure stopped time is not counted.  This avoids time jumps
-         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
++  surprising guest OSes and applications, as long as they use the
 +  virtual counter for timekeeping.  However it has the side effect of
 +  the virtual and physical counters diverging.  All timekeeping based
 +  on the virtual counter will appear to lag behind any timekeeping
 +  that does not subtract VM stopped time.  The guest may resynchronize
 +  its virtual counter with other time sources as needed.
 -                           Enable kvm-no-adjvtime to disable virtual time
 -                           adjustment, also restoring the legacy (pre-5.0)
 -                           behavior.
 +  Enable kvm-no-adjvtime to disable virtual time adjustment, also
 +  restoring the legacy (pre-5.0) behavior.
 -  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
 -                           default when KVM is enabled, the feature is
 -                           supported, and the guest is 64-bit.
 +``kvm-steal-time``
 +  Since v5.2, kvm-steal-time is enabled by default when KVM is
 +  enabled, the feature is supported, and the guest is 64-bit.
 -                           When kvm-steal-time is enabled a 64-bit guest
 -                           can account for time its CPUs were not running
 -                           due to the host not scheduling the corresponding
 -                           VCPU threads.  The accounting statistics may
 -                           influence the guest scheduler behavior and/or be
 -                           exposed to the guest userspace.
 +  When kvm-steal-time is enabled a 64-bit guest can account for time
 +  its CPUs were not running due to the host not scheduling the
 +  corresponding VCPU threads.  The accounting statistics may influence
 +  the guest scheduler behavior and/or be exposed to the guest
 +  userspace.
  TCG VCPU Features
  =================
@@ -XXX,XX +XXX,XX @@ TCG VCPU Features
  TCG VCPU features are CPU features that are specific to TCG.
  Below is the list of TCG VCPU features and their descriptions.
 -  pauth-impdef             When ``FEAT_Pauth`` is enabled, either the
 -                           *impdef* (Implementation Defined) algorithm
 -                           is enabled or the *architected* QARMA algorithm
 -                           is enabled.  By default the impdef algorithm
 -                           is disabled, and QARMA is enabled.
 +``pauth-impdef``
 +  When ``FEAT_Pauth`` is enabled, either the *impdef* (Implementation
 +  Defined) algorithm is enabled or the *architected* QARMA algorithm
 +  is enabled.  By default the impdef algorithm is disabled, and QARMA
 +  is enabled.
 -                           The architected QARMA algorithm has good
 -                           cryptographic properties, but can be quite slow
 -                           to emulate.  The impdef algorithm used by QEMU
 -                           is non-cryptographic but significantly faster.
 +  The architected QARMA algorithm has good cryptographic properties,
 +  but can be quite slow to emulate.  The impdef algorithm used by QEMU
 +  is non-cryptographic but significantly faster.
  SVE CPU Properties
  ==================
 --
-.20.1
+.34.1

-[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+[PULL 8/8] target/arm: Don't advertise aarch64-pauth.xml to gdb
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Unfortunately a bug in older versions of gdb means that they will
 crash if QEMU sends them the aarch64-pauth.xml.  This bug is fixed in
 gdb commit 1ba3a3222039eb25, and there are plans to backport that to
 affected gdb release branches, but since the bug affects gdb 9
 through 12 it is very widely deployed (for instance by distros).
-We don't need to fill the full pic[] array if we only use
+It is not currently clear what the best way to deal with this is; it
-few of the interrupt lines. Directly call qdev_get_gpio_in()
+has been proposed to define a new XML feature name that old gdb will
-when necessary.
+ignore but newer gdb can handle.  Since QEMU's 8.0 release is
 imminent and at least one of our CI runners is now falling over this,
 disable the pauth XML for the moment.  We can follow up with a more
 considered fix either in time for 8.0 or else for the 8.1 release.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/musicpal.c | 25 +++++++++++++------------
+ target/arm/gdbstub.c | 7 +++++++
-file changed, 13 insertions(+), 12 deletions(-)
+file changed, 7 insertions(+)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
+--- a/target/arm/gdbstub.c
-+++ b/hw/arm/musicpal.c
++++ b/target/arm/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
- static void musicpal_init(MachineState *machine)
+                                      aarch64_gdb_set_fpu_reg,
- {
+, "aarch64-fpu.xml", 0);
-     ARMCPU *cpu;
+         }
--    qemu_irq pic[32];
++#if 0
-     DeviceState *dev;
++        /*
-+    DeviceState *pic;
++         * GDB versions 9 through 12 have a bug which means they will
-     DeviceState *uart_orgate;
++         * crash if they see this XML from QEMU; disable it for the 8.0
-     DeviceState *i2c_dev;
++         * release, pending a better solution.
-     DeviceState *lcd_dev;
++         */
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
+         if (isar_feature_aa64_pauth(&cpu->isar)) {
-                            &error_fatal);
+             gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
-     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
+                                      aarch64_gdb_set_pauth_reg,
+, "aarch64-pauth.xml", 0);
--    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+         }
-+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
++#endif
-                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
+ #endif
--    for (i = 0; i < 32; i++) {
+     } else {
--        pic[i] = qdev_get_gpio_in(dev, i);
+         if (arm_feature(env, ARM_FEATURE_NEON)) {
 -    }
 -    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
 -                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
 -                          pic[MP_TIMER4_IRQ], NULL);
 +    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
 +                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
      /* Logically OR both UART IRQs together */
      uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
      object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
      qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 -    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
 +                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
      serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                     qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               OBJECT(get_system_memory()), &error_fatal);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
 +                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
      sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
-.20.1
+.34.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1

The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce:

Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321

for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255:

target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000)

----------------------------------------------------------------
target-arm queue:
 * contrib/elf2dmp: Support Windows Server 2022
 * hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
 * target/arm: Add Neoverse-N1 IMPDEF registers
 * hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
 * docs/system/arm/cpu-features.rst: Fix formatting
 * target/arm: Don't advertise aarch64-pauth.xml to gdb

----------------------------------------------------------------
Chen Baozi (1):
      target/arm: Add Neoverse-N1 registers

Guenter Roeck (1):
      hw/usb/imx: Fix out of bounds access in imx_usbphy_read()

Peter Maydell (3):
      hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
      docs/system/arm/cpu-features.rst: Fix formatting
      target/arm: Don't advertise aarch64-pauth.xml to gdb

Viktor Prutyanov (3):
      contrib/elf2dmp: fix code style
      contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
      contrib/elf2dmp: add PE name check and Windows Server 2022 support

docs/system/arm/cpu-features.rst |  68 ++++++++++-------------
 contrib/elf2dmp/pe.h             | 115 ++++++++++++++++++++++-----------------
 contrib/elf2dmp/addrspace.c      |   1 +
 contrib/elf2dmp/main.c           | 108 ++++++++++++++++++++++++------------
 hw/char/cadence_uart.c           |   6 +-
 hw/usb/imx-usb-phy.c             |  19 ++++++-
 target/arm/cpu64.c               |  69 +++++++++++++++++++++++
 target/arm/gdbstub.c             |   7 +++
 8 files changed, 267 insertions(+), 126 deletions(-)

From: Chen Baozi <chenbaozi@phytium.com.cn>

Add implementation defined registers for neoverse-n1 which
would be accessed by TF-A. Since there is no DSU in Qemu,
CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition.

Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#include "cpregs.h"
 #include "qemu/module.h"
 #include "sysemu/kvm.h"
 #include "sysemu/hvf.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
     /* TODO:  Add A64FX specific HPC extension registers */
 }
 
+static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
+    { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL12", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 5, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "AVTCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 1,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    /*
+     * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU
+     * (and in particular its system registers).
+     */
+    { .name = "CPUCFR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 0, .opc2 = 0,
+      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 },
+    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 },
+    { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPMR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 3,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPOR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 2,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPSELR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+};
+
+static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
+{
+    define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
+}
+
 static void aarch64_neoverse_n1_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
 
     /* From D5.1 AArch64 PMU register summary */
     cpu->isar.reset_pmcr_el0 = 0x410c3000;
+
+    define_neoverse_n1_cp_reginfo(cpu);
 }
 
 static void aarch64_host_initfn(Object *obj)
-- 
2.34.1

The cadence UART attempts to avoid allowing the guest to set invalid
baud rate register values in the uart_write() function.  However it
does the "mask to the size of the register field" and "check for
invalid values" in the wrong order, which means that a malicious
guest can get a bogus value into the register by setting also some
high bits in the value, and cause QEMU to crash by division-by-zero.

Do the mask before the bounds check instead of afterwards.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
---
 hw/char/cadence_uart.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
         }
         break;
     case R_BRGR: /* Baud rate generator */
+        value &= 0xffff;
         if (value >= 0x01) {
-            s->r[offset] = value & 0xFFFF;
+            s->r[offset] = value;
         }
         break;
     case R_BDIV:    /* Baud rate divider */
+        value &= 0xff;
         if (value >= 0x04) {
-            s->r[offset] = value & 0xFF;
+            s->r[offset] = value;
         }
         break;
     default:
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Originally elf2dmp were added with some code style issues,
especially in pe.h header, and some were introduced by
2d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-2-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/pe.h        | 100 ++++++++++++++++++------------------
 contrib/elf2dmp/addrspace.c |   1 +
 contrib/elf2dmp/main.c      |   9 ++--
 3 files changed, 57 insertions(+), 53 deletions(-)

diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pe.h
+++ b/contrib/elf2dmp/pe.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DOS_HEADER {
 } __attribute__ ((packed)) IMAGE_DOS_HEADER;
 
 typedef struct IMAGE_FILE_HEADER {
-  uint16_t  Machine;
-  uint16_t  NumberOfSections;
-  uint32_t  TimeDateStamp;
-  uint32_t  PointerToSymbolTable;
-  uint32_t  NumberOfSymbols;
-  uint16_t  SizeOfOptionalHeader;
-  uint16_t  Characteristics;
+    uint16_t  Machine;
+    uint16_t  NumberOfSections;
+    uint32_t  TimeDateStamp;
+    uint32_t  PointerToSymbolTable;
+    uint32_t  NumberOfSymbols;
+    uint16_t  SizeOfOptionalHeader;
+    uint16_t  Characteristics;
 } __attribute__ ((packed)) IMAGE_FILE_HEADER;
 
 typedef struct IMAGE_DATA_DIRECTORY {
-  uint32_t VirtualAddress;
-  uint32_t Size;
+    uint32_t VirtualAddress;
+    uint32_t Size;
 } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY;
 
 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
 
 typedef struct IMAGE_OPTIONAL_HEADER64 {
-  uint16_t  Magic; /* 0x20b */
-  uint8_t   MajorLinkerVersion;
-  uint8_t   MinorLinkerVersion;
-  uint32_t  SizeOfCode;
-  uint32_t  SizeOfInitializedData;
-  uint32_t  SizeOfUninitializedData;
-  uint32_t  AddressOfEntryPoint;
-  uint32_t  BaseOfCode;
-  uint64_t  ImageBase;
-  uint32_t  SectionAlignment;
-  uint32_t  FileAlignment;
-  uint16_t  MajorOperatingSystemVersion;
-  uint16_t  MinorOperatingSystemVersion;
-  uint16_t  MajorImageVersion;
-  uint16_t  MinorImageVersion;
-  uint16_t  MajorSubsystemVersion;
-  uint16_t  MinorSubsystemVersion;
-  uint32_t  Win32VersionValue;
-  uint32_t  SizeOfImage;
-  uint32_t  SizeOfHeaders;
-  uint32_t  CheckSum;
-  uint16_t  Subsystem;
-  uint16_t  DllCharacteristics;
-  uint64_t  SizeOfStackReserve;
-  uint64_t  SizeOfStackCommit;
-  uint64_t  SizeOfHeapReserve;
-  uint64_t  SizeOfHeapCommit;
-  uint32_t  LoaderFlags;
-  uint32_t  NumberOfRvaAndSizes;
-  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+    uint16_t  Magic; /* 0x20b */
+    uint8_t   MajorLinkerVersion;
+    uint8_t   MinorLinkerVersion;
+    uint32_t  SizeOfCode;
+    uint32_t  SizeOfInitializedData;
+    uint32_t  SizeOfUninitializedData;
+    uint32_t  AddressOfEntryPoint;
+    uint32_t  BaseOfCode;
+    uint64_t  ImageBase;
+    uint32_t  SectionAlignment;
+    uint32_t  FileAlignment;
+    uint16_t  MajorOperatingSystemVersion;
+    uint16_t  MinorOperatingSystemVersion;
+    uint16_t  MajorImageVersion;
+    uint16_t  MinorImageVersion;
+    uint16_t  MajorSubsystemVersion;
+    uint16_t  MinorSubsystemVersion;
+    uint32_t  Win32VersionValue;
+    uint32_t  SizeOfImage;
+    uint32_t  SizeOfHeaders;
+    uint32_t  CheckSum;
+    uint16_t  Subsystem;
+    uint16_t  DllCharacteristics;
+    uint64_t  SizeOfStackReserve;
+    uint64_t  SizeOfStackCommit;
+    uint64_t  SizeOfHeapReserve;
+    uint64_t  SizeOfHeapCommit;
+    uint32_t  LoaderFlags;
+    uint32_t  NumberOfRvaAndSizes;
+    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64;
 
 typedef struct IMAGE_NT_HEADERS64 {
-  uint32_t Signature;
-  IMAGE_FILE_HEADER FileHeader;
-  IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+    uint32_t Signature;
+    IMAGE_FILE_HEADER FileHeader;
+    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 
 typedef struct IMAGE_DEBUG_DIRECTORY {
-  uint32_t Characteristics;
-  uint32_t TimeDateStamp;
-  uint16_t MajorVersion;
-  uint16_t MinorVersion;
-  uint32_t Type;
-  uint32_t SizeOfData;
-  uint32_t AddressOfRawData;
-  uint32_t PointerToRawData;
+    uint32_t Characteristics;
+    uint32_t TimeDateStamp;
+    uint16_t MajorVersion;
+    uint16_t MinorVersion;
+    uint32_t Type;
+    uint32_t SizeOfData;
+    uint32_t AddressOfRawData;
+    uint32_t PointerToRawData;
 } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY;
 
 #define IMAGE_DEBUG_TYPE_CODEVIEW   2
diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/addrspace.c
+++ b/contrib/elf2dmp/addrspace.c
@@ -XXX,XX +XXX,XX @@
 static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
 {
     size_t i;
+
     for (i = 0; i < ps->block_nr; i++) {
         if (ps->block[i].paddr <= pa &&
                 pa <= ps->block[i].paddr + ps->block[i].size) {
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
     };
 
     for (i = 0; i < ps->block_nr; i++) {
-        h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
+        h.PhysicalMemoryBlock.NumberOfPages +=
+                ps->block[i].size / ELF2DMP_PAGE_SIZE;
         h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
             .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
             .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
         };
     }
 
-    h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
+    h.RequiredDumpSpace +=
+            h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
 
     *hdr = h;
 
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
         struct va_space *vs, QEMU_Elf *qe)
 {
-        int i;
+    int i;
+
     for (i = 0; i < qe->state_nr; i++) {
         uint64_t Prcb;
         uint64_t Context;
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Move out PE directory search functionality to be reused not only
for Debug Directory processing but for arbitrary PE directory.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-3-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++-----------------
 1 file changed, 42 insertions(+), 29 deletions(-)

diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
     return 0;
 }
 
+static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
+        void *entry, size_t size, struct va_space *vs)
+{
+    const char e_magic[2] = "MZ";
+    const char Signature[4] = "PE\0\0";
+    IMAGE_DOS_HEADER *dos_hdr = start_addr;
+    IMAGE_NT_HEADERS64 nt_hdrs;
+    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
+    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
+    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
+
+    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
+
+    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
+        return 1;
+    }
+
+    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
+                &nt_hdrs, sizeof(nt_hdrs), 0)) {
+        return 1;
+    }
+
+    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
+            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
+        return 1;
+    }
+
+    if (va_space_rw(vs,
+                base + data_dir[idx].VirtualAddress,
+                entry, size, 0)) {
+        return 1;
+    }
+
+    printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
+            (uint32_t)data_dir[idx].VirtualAddress);
+
+    return 0;
+}
+
 static int write_dump(struct pa_space *ps,
         WinDumpHeader64 *hdr, const char *name)
 {
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
         char *hash, struct va_space *vs)
 {
-    const char e_magic[2] = "MZ";
-    const char Signature[4] = "PE\0\0";
     const char sign_rsds[4] = "RSDS";
-    IMAGE_DOS_HEADER *dos_hdr = start_addr;
-    IMAGE_NT_HEADERS64 nt_hdrs;
-    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
-    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
-    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
     IMAGE_DEBUG_DIRECTORY debug_dir;
     OMFSignatureRSDS rsds;
     char *pdb_name;
     size_t pdb_name_sz;
     size_t i;
 
-    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
-
-    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
-        return 1;
-    }
-
-    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
-                &nt_hdrs, sizeof(nt_hdrs), 0)) {
-        return 1;
-    }
-
-    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
-            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
-        return 1;
-    }
-
-    printf("Debug Directory RVA = 0x%08"PRIx32"\n",
-            (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
-
-    if (va_space_rw(vs,
-                base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
-                &debug_dir, sizeof(debug_dir), 0)) {
+    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
+                &debug_dir, sizeof(debug_dir), vs)) {
+        eprintf("Failed to get Debug Directory\n");
         return 1;
     }
 
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Since its inception elf2dmp has checked MZ signatures within an
address space above IDT[0] interrupt vector and took first PE image
found as Windows Kernel.
But in Windows Server 2022 memory dump this address space range is
full of invalid PE fragments and the tool must check that PE image
is 'ntoskrnl.exe' actually.
So, introduce additional validation by checking image name from
Export Directory against 'ntoskrnl.exe'.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-4-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/pe.h   | 15 +++++++++++++++
 contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pe.h
+++ b/contrib/elf2dmp/pe.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 {
     IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 
+typedef struct IMAGE_EXPORT_DIRECTORY {
+    uint32_t    Characteristics;
+    uint32_t    TimeDateStamp;
+    uint16_t    MajorVersion;
+    uint16_t    MinorVersion;
+    uint32_t    Name;
+    uint32_t    Base;
+    uint32_t    NumberOfFunctions;
+    uint32_t    NumberOfNames;
+    uint32_t    AddressOfFunctions;
+    uint32_t    AddressOfNames;
+    uint32_t    AddressOfNameOrdinals;
+} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;
+
 typedef struct IMAGE_DEBUG_DIRECTORY {
     uint32_t Characteristics;
     uint32_t TimeDateStamp;
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY {
 #define IMAGE_DEBUG_TYPE_CODEVIEW   2
 #endif
 
+#define IMAGE_FILE_EXPORT_DIRECTORY 0
 #define IMAGE_FILE_DEBUG_DIRECTORY  6
 
 typedef struct guid_t {
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@
 
 #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
 #define PDB_NAME    "ntkrnlmp.pdb"
+#define PE_NAME     "ntoskrnl.exe"
 
 #define INITIAL_MXCSR   0x1f80
 
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
     return fclose(dmp_file);
 }
 
+static bool pe_check_export_name(uint64_t base, void *start_addr,
+        struct va_space *vs)
+{
+    IMAGE_EXPORT_DIRECTORY export_dir;
+    const char *pe_name;
+
+    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY,
+                &export_dir, sizeof(export_dir), vs)) {
+        return false;
+    }
+
+    pe_name = va_space_resolve(vs, base + export_dir.Name);
+    if (!pe_name) {
+        return false;
+    }
+
+    return !strcmp(pe_name, PE_NAME);
+}
+
 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
         char *hash, struct va_space *vs)
 {
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
     uint64_t KdDebuggerDataBlock;
     KDDEBUGGER_DATA64 *kdbg;
     uint64_t KdVersionBlock;
+    bool kernel_found = false;
 
     if (argc != 3) {
         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
         }
 
         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
-            break;
+            if (pe_check_export_name(KernBase, nt_start_addr, &vs)) {
+                kernel_found = true;
+                break;
+            }
         }
     }
 
-    if (!nt_start_addr) {
+    if (!kernel_found) {
         eprintf("Failed to find NT kernel image\n");
         err = 1;
         goto out_ps;
-- 
2.34.1

From: Guenter Roeck <linux@roeck-us.net>

The i.MX USB Phy driver does not check register ranges, resulting in out of
bounds accesses if an attempt is made to access non-existing PHY registers.
Add range check and conditionally report bad accesses to fix the problem.

While at it, also conditionally log attempted writes to non-existing or
read-only registers.

Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230316234926.208874-1-linux@roeck-us.net
Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/imx-usb-phy.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/imx-usb-phy.c
+++ b/hw/usb/imx-usb-phy.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/usb/imx-usb-phy.h"
 #include "migration/vmstate.h"
+#include "qemu/log.h"
 #include "qemu/module.h"
 
 static const VMStateDescription vmstate_imx_usbphy = {
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
         value = s->usbphy[index - 3];
         break;
     default:
-        value = s->usbphy[index];
+        if (index < USBPHY_MAX) {
+            value = s->usbphy[index];
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Read from non-existing USB PHY register 0x%"
+                          HWADDR_PRIx "\n",
+                          __func__, offset);
+            value = 0;
+        }
         break;
     }
     return (uint64_t)value;
@@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
         s->usbphy[index - 3] ^= value;
         break;
     default:
-        /* Other registers are read-only */
+        /* Other registers are read-only or do not exist */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Write to %s USB PHY register 0x%"
+                      HWADDR_PRIx "\n",
+                      __func__,
+                      index >= USBPHY_MAX ? "non-existing" : "read-only",
+                      offset);
         break;
     }
 }
-- 
2.34.1

The markup for the Arm CPU feature documentation is incorrect,
and results in the HTML not rendering correctly -- the first
line of each description is rendered in boldface as if it
were part of the option name.

Reformat to match the styling used in cpu-models-x86.rst.inc.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
---
 docs/system/arm/cpu-features.rst | 68 ++++++++++++++------------------
 1 file changed, 30 insertions(+), 38 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ are named with the prefix "kvm-".  KVM VCPU features may be probed,
 enabled, and disabled in the same way as other CPU features.  Below is
 the list of KVM VCPU features and their descriptions.
 
-  kvm-no-adjvtime          By default kvm-no-adjvtime is disabled.  This
-                           means that by default the virtual time
-                           adjustment is enabled (vtime is not *not*
-                           adjusted).
+``kvm-no-adjvtime``
+  By default kvm-no-adjvtime is disabled.  This means that by default
+  the virtual time adjustment is enabled (vtime is not *not* adjusted).
 
-                           When virtual time adjustment is enabled each
-                           time the VM transitions back to running state
-                           the VCPU's virtual counter is updated to ensure
-                           stopped time is not counted.  This avoids time
-                           jumps surprising guest OSes and applications,
-                           as long as they use the virtual counter for
-                           timekeeping.  However it has the side effect of
-                           the virtual and physical counters diverging.
-                           All timekeeping based on the virtual counter
-                           will appear to lag behind any timekeeping that
-                           does not subtract VM stopped time.  The guest
-                           may resynchronize its virtual counter with
-                           other time sources as needed.
+  When virtual time adjustment is enabled each time the VM transitions
+  back to running state the VCPU's virtual counter is updated to
+  ensure stopped time is not counted.  This avoids time jumps
+  surprising guest OSes and applications, as long as they use the
+  virtual counter for timekeeping.  However it has the side effect of
+  the virtual and physical counters diverging.  All timekeeping based
+  on the virtual counter will appear to lag behind any timekeeping
+  that does not subtract VM stopped time.  The guest may resynchronize
+  its virtual counter with other time sources as needed.
 
-                           Enable kvm-no-adjvtime to disable virtual time
-                           adjustment, also restoring the legacy (pre-5.0)
-                           behavior.
+  Enable kvm-no-adjvtime to disable virtual time adjustment, also
+  restoring the legacy (pre-5.0) behavior.
 
-  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
-                           default when KVM is enabled, the feature is
-                           supported, and the guest is 64-bit.
+``kvm-steal-time``
+  Since v5.2, kvm-steal-time is enabled by default when KVM is
+  enabled, the feature is supported, and the guest is 64-bit.
 
-                           When kvm-steal-time is enabled a 64-bit guest
-                           can account for time its CPUs were not running
-                           due to the host not scheduling the corresponding
-                           VCPU threads.  The accounting statistics may
-                           influence the guest scheduler behavior and/or be
-                           exposed to the guest userspace.
+  When kvm-steal-time is enabled a 64-bit guest can account for time
+  its CPUs were not running due to the host not scheduling the
+  corresponding VCPU threads.  The accounting statistics may influence
+  the guest scheduler behavior and/or be exposed to the guest
+  userspace.
 
 TCG VCPU Features
 =================
@@ -XXX,XX +XXX,XX @@ TCG VCPU Features
 TCG VCPU features are CPU features that are specific to TCG.
 Below is the list of TCG VCPU features and their descriptions.
 
-  pauth-impdef             When ``FEAT_Pauth`` is enabled, either the
-                           *impdef* (Implementation Defined) algorithm
-                           is enabled or the *architected* QARMA algorithm
-                           is enabled.  By default the impdef algorithm
-                           is disabled, and QARMA is enabled.
+``pauth-impdef``
+  When ``FEAT_Pauth`` is enabled, either the *impdef* (Implementation
+  Defined) algorithm is enabled or the *architected* QARMA algorithm
+  is enabled.  By default the impdef algorithm is disabled, and QARMA
+  is enabled.
 
-                           The architected QARMA algorithm has good
-                           cryptographic properties, but can be quite slow
-                           to emulate.  The impdef algorithm used by QEMU
-                           is non-cryptographic but significantly faster.
+  The architected QARMA algorithm has good cryptographic properties,
+  but can be quite slow to emulate.  The impdef algorithm used by QEMU
+  is non-cryptographic but significantly faster.
 
 SVE CPU Properties
 ==================
-- 
2.34.1

Unfortunately a bug in older versions of gdb means that they will
crash if QEMU sends them the aarch64-pauth.xml.  This bug is fixed in
gdb commit 1ba3a3222039eb25, and there are plans to backport that to
affected gdb release branches, but since the bug affects gdb 9
through 12 it is very widely deployed (for instance by distros).

It is not currently clear what the best way to deal with this is; it
has been proposed to define a new XML feature name that old gdb will
ignore but newer gdb can handle.  Since QEMU's 8.0 release is
imminent and at least one of our CI runners is now falling over this,
disable the pauth XML for the moment.  We can follow up with a more
considered fix either in time for 8.0 or else for the 8.1 release.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                      aarch64_gdb_set_fpu_reg,
                                      34, "aarch64-fpu.xml", 0);
         }
+#if 0
+        /*
+         * GDB versions 9 through 12 have a bug which means they will
+         * crash if they see this XML from QEMU; disable it for the 8.0
+         * release, pending a better solution.
+         */
         if (isar_feature_aa64_pauth(&cpu->isar)) {
             gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
                                      aarch64_gdb_set_pauth_reg,
                                      4, "aarch64-pauth.xml", 0);
         }
+#endif
 #endif
     } else {
         if (arm_feature(env, ARM_FEATURE_NEON)) {
-- 
2.34.1