Series comparison

-[PULL 00/24] target-arm queue
+[PULL 00/15] target-arm queue
-A big pullreq by number of patches, but most of them are just docs
+Some arm patches before softfreeze. These are all bug fixes.
 updates or MAINTAINERS file fixes. The actual code changes are pretty
 minimal bugfixes.
-thanks
 -- PMM
-The following changes since commit 8cc30eb1400fc01f2b139cdd3dc524f8b84dbe07:
+The following changes since commit 0ebf76aae58324b8f7bf6af798696687f5f4c2a9:
-  Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20201122' into staging (2020-11-22 15:02:52 +0000)
+  Merge tag 'nvme-next-pull-request' of git://git.infradead.org/qemu-nvme into staging (2022-07-15 15:38:13 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201123
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220718
-for you to fetch changes up to c6ff78563ad2971f289168c7cae6ecb0b4359516:
+for you to fetch changes up to 004c8a8bc569c8b18fca6fc90ffe3223daaf17b7:
-  docs/system/pr-manager.rst: Fix minor docs nits (2020-11-23 11:10:04 +0000)
+  Align Raspberry Pi DMA interrupts with Linux DTS (2022-07-18 13:25:13 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * incorporate 'orphan' rST docs into manuals
+ * hw/intc/armv7m_nvic: ICPRn must not unpend an IRQ that is being held high
- * linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpoints
+ * target/arm: Fill in VL for tbflags when SME enabled and SVE disabled
- * target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0
+ * target/arm: Fix aarch64_sve_change_el for SME
- * document raspi boards and tosa
+ * linux-user/aarch64: Do not clear PROT_MTE on mprotect
- * docs/system: Deprecate raspi2/raspi3 machine aliases
+ * target/arm: Honour VTCR_EL2 bits in Secure EL2
- * docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs
+ * hw/adc: Fix CONV bit in NPCM7XX ADC CON register
- * MAINTAINERS: add lines for docs files for Arm boards
+ * hw/adc: Make adci[*] R/W in NPCM7XX ADC
- * hw/intc: fix heap-buffer-overflow in rxicu_realize()
+ * target/arm: Don't set syndrome ISS for loads and stores with writeback
- * hw/arm: Fix bad print format specifiers
+ * Align Raspberry Pi DMA interrupts with Linux DTS
  * target/arm: fix stage 2 page-walks in 32-bit emulation
 ----------------------------------------------------------------
-AlexChen (1):
+Andrey Makarov (1):
-      hw/arm: Fix bad print format specifiers
+      Align Raspberry Pi DMA interrupts with Linux DTS
-Chen Qun (1):
+Hao Wu (2):
-      hw/intc: fix heap-buffer-overflow in rxicu_realize()
+      hw/adc: Fix CONV bit in NPCM7XX ADC CON register
       hw/adc: Make adci[*] R/W in NPCM7XX ADC
-Peter Maydell (11):
+Peter Maydell (9):
-      target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0
+      hw/intc/armv7m_nvic: ICPRn must not unpend an IRQ that is being held high
-      linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpoints
+      target/arm: Define and use new regime_tcr_value() function
-      docs: Move virtio-net-failover.rst into the system manual
+      target/arm: Calculate mask/base_mask in get_level1_table_address()
-      docs: Move cpu-hotplug.rst into the system manual
+      target/arm: Fold regime_tcr() and regime_tcr_value() together
-      docs: Move virtio-pmem.rst into the system manual
+      target/arm: Fix big-endian host handling of VTCR
-      docs/system/virtio-pmem.rst: Fix minor style issues
+      target/arm: Store VTCR_EL2, VSTCR_EL2 registers as uint64_t
-      docs: Split out 'pc' machine model docs into their own file
+      target/arm: Store TCR_EL* registers as uint64_t
-      docs: Move microvm.rst into the system manual
+      target/arm: Honour VTCR_EL2 bits in Secure EL2
-      docs: Move pr-manager.rst into the system manual
+      target/arm: Don't set syndrome ISS for loads and stores with writeback
       docs: Split qemu-pr-helper documentation into tools manual
       docs/system/pr-manager.rst: Fix minor docs nits
-Philippe Mathieu-Daudé (10):
+Richard Henderson (3):
-      MAINTAINERS: Cover system/arm/cpu-features.rst with ARM TCG CPUs
+      target/arm: Fill in VL for tbflags when SME enabled and SVE disabled
-      MAINTAINERS: Cover system/arm/aspeed.rst with ASPEED BMC machines
+      target/arm: Fix aarch64_sve_change_el for SME
-      MAINTAINERS: Cover system/arm/nuvoton.rst with Nuvoton NPCM7xx
+      linux-user/aarch64: Do not clear PROT_MTE on mprotect
       MAINTAINERS: Fix system/arm/orangepi.rst path
       MAINTAINERS: Cover system/arm/sbsa.rst with SBSA-REF machine
       MAINTAINERS: Cover system/arm/sx1.rst with OMAP machines
       docs/system: Deprecate raspi2/raspi3 machine aliases
       docs/system/arm: Document the various raspi boards
       docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs
       docs/system/arm: Document the Sharp Zaurus SL-6000
-Rémi Denis-Courmont (1):
+ include/hw/arm/bcm2835_peripherals.h |   2 +
-      target/arm: fix stage 2 page-walks in 32-bit emulation
+ target/arm/cpu.h                     |  38 ++++++++---
+ target/arm/internals.h               |  34 +++++++---
- docs/meson.build                          |  1 +
+ accel/tcg/translate-all.c            |  13 +++-
- docs/system/arm/aspeed.rst                |  1 +
+ hw/adc/npcm7xx_adc.c                 |   4 +-
- docs/system/arm/raspi.rst                 | 43 +++++++++++++++
+ hw/arm/bcm2835_peripherals.c         |  26 ++++++-
- docs/system/arm/xscale.rst                | 20 ++++---
+ hw/intc/armv7m_nvic.c                |   9 ++-
- docs/{ => system}/cpu-hotplug.rst         |  0
+ target/arm/cpu.c                     |   2 +-
- docs/system/deprecated.rst                |  7 +++
+ target/arm/debug_helper.c            |   2 +-
- docs/{ => system/i386}/microvm.rst        |  5 +-
+ target/arm/helper.c                  | 128 ++++++++++++++++-------------------
- docs/system/i386/pc.rst                   |  7 +++
+ target/arm/ptw.c                     |  38 ++++++-----
- docs/system/index.rst                     |  4 ++
+ target/arm/tlb_helper.c              |   2 +-
- docs/{ => system}/pr-manager.rst          | 44 +++------------
+ target/arm/translate-a64.c           |   4 +-
- docs/system/target-arm.rst                |  1 +
+ tests/qtest/bcm2835-dma-test.c       | 118 ++++++++++++++++++++++++++++++++
- docs/system/target-i386.rst               | 19 +++++--
+ tests/qtest/npcm7xx_adc-test.c       |   2 +-
- docs/{ => system}/virtio-net-failover.rst |  0
+ tests/qtest/meson.build              |   3 +-
- docs/system/virtio-pmem.rst               | 76 ++++++++++++++++++++++++++
+files changed, 306 insertions(+), 119 deletions(-)
- docs/tools/conf.py                        |  2 +
+ create mode 100644 tests/qtest/bcm2835-dma-test.c
  docs/tools/index.rst                      |  1 +
  docs/tools/qemu-pr-helper.rst             | 90 +++++++++++++++++++++++++++++++
  docs/virtio-pmem.rst                      | 76 --------------------------
  hw/arm/pxa2xx.c                           |  2 +-
  hw/arm/spitz.c                            |  2 +-
  hw/arm/tosa.c                             |  2 +-
  hw/intc/rx_icu.c                          | 18 +++----
  linux-user/arm/cpu_loop.c                 | 28 ++++++++++
  target/arm/arm-semi.c                     | 12 +++--
  target/arm/helper.c                       |  4 +-
  MAINTAINERS                               |  8 ++-
 files changed, 326 insertions(+), 147 deletions(-)
  create mode 100644 docs/system/arm/raspi.rst
  rename docs/{ => system}/cpu-hotplug.rst (100%)
  rename docs/{ => system/i386}/microvm.rst (98%)
  create mode 100644 docs/system/i386/pc.rst
  rename docs/{ => system}/pr-manager.rst (68%)
  rename docs/{ => system}/virtio-net-failover.rst (100%)
  create mode 100644 docs/system/virtio-pmem.rst
  create mode 100644 docs/tools/qemu-pr-helper.rst
  delete mode 100644 docs/virtio-pmem.rst

-[PULL 24/24] docs/system/pr-manager.rst: Fix minor docs nits
+[PULL 01/15] hw/intc/armv7m_nvic: ICPRn must not unpend an IRQ that is being held high
-Fix a couple of nits in pr-manager.rst:
+In the M-profile Arm ARM, rule R_CVJS defines when an interrupt should
- * the title marker for the top level heading is overlength
+be set to the Pending state:
- * stray capital 'R' in the middle of a sentence
+ A) when the input line is high and the interrupt is not Active
  B) when the input line transitions from low to high and the interrupt
     is Active
 (Note that the first of these is an ongoing condition, and the
 second is a point-in-time event.)
+This can be rephrased as:
+when the line goes from low to high, set Pending
+when Active goes from 1 to 0, if line is high then set Pending
+ignore attempts to clear Pending when the line is high
+   and Active is 0
+where 1 covers both B and one of the "transition into condition A"
+cases, 2 deals with the other "transition into condition A"
+possibility, and 3 is "don't drop Pending if we're already in
+condition A".  Transitions out of condition A don't affect Pending
+state.
+We handle case 1 in set_irq_level(). For an interrupt (as opposed
+to other kinds of exception) the only place where we clear Active
+is in armv7m_nvic_complete_irq(), where we handle case 2 by
+checking for whether we need to re-pend the exception. For case 3,
+the only places where we clear Pending state on an interrupt are in
+armv7m_nvic_acknowledge_irq() (where we are setting Active so it
+doesn't count) and for writes to NVIC_ICPRn.
+It is the "write to NVIC_ICPRn" case that we missed: we must ignore
+this if the input line is high and the interrupt is not Active.
+(This required behaviour is differently and perhaps more clearly
+stated in the v7M Arm ARM, which has pseudocode in section B3.4.1
+that implies it.)
+Reported-by: Igor Kotrasiński <i.kotrasinsk@samsung.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20220628154724.3297442-1-peter.maydell@linaro.org
 ---
- docs/system/pr-manager.rst | 6 +++---
+ hw/intc/armv7m_nvic.c | 9 ++++++++-
-file changed, 3 insertions(+), 3 deletions(-)
+file changed, 8 insertions(+), 1 deletion(-)
-diff --git a/docs/system/pr-manager.rst b/docs/system/pr-manager.rst
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/pr-manager.rst
+--- a/hw/intc/armv7m_nvic.c
-+++ b/docs/system/pr-manager.rst
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
--======================================
+         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
-+===============================
- Persistent reservation managers
+         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
--======================================
++            /*
-+===============================
++             * Note that if the input line is still held high and the interrupt
++             * is not active then rule R_CVJS requires that the Pending state
--SCSI persistent Reservations allow restricting access to block devices
++             * remains set; in that case we mustn't let it be cleared.
-+SCSI persistent reservations allow restricting access to block devices
++             */
- to specific initiators in a shared storage setup.  When implementing
+             if (value & (1 << i) &&
- clustering of virtual machines, it is a common requirement for virtual
+-                (attrs.secure || s->itns[startvec + i])) {
- machines to send persistent reservation SCSI commands.  However,
++                (attrs.secure || s->itns[startvec + i]) &&
 +                !(setval == 0 && s->vectors[startvec + i].level &&
 +                  !s->vectors[startvec + i].active)) {
                  s->vectors[startvec + i].pending = setval;
              }
          }
 --
-.20.1
+.25.1

-[PULL 05/24] MAINTAINERS: Cover system/arm/aspeed.rst with ASPEED BMC machines
+[PULL 02/15] target/arm: Fill in VL for tbflags when SME enabled and SVE disabled
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+When PSTATE.SM, VL = SVL even if SVE is disabled.
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+This is visible in kselftest ssve-test.
-Message-id: 20201120154545.2504625-3-f4bug@amsat.org
 Reported-by: Mark Brown <broonie@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220713045848.217364-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 1 +
+ target/arm/helper.c | 10 ++++++++--
-file changed, 1 insertion(+)
+file changed, 8 insertions(+), 2 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/target/arm/helper.c
-+++ b/MAINTAINERS
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ F: include/hw/*/*aspeed*
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
- F: include/hw/misc/pca9552*.h
+     }
- F: hw/net/ftgmac100.c
+     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
- F: include/hw/net/ftgmac100.h
+         int sme_el = sme_exception_el(env, el);
-+F: docs/system/arm/aspeed.rst
++        bool sm = FIELD_EX64(env->svcr, SVCR, SM);
- NRF51
+         DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
- M: Joel Stanley <joel@jms.id.au>
+         if (sme_el == 0) {
              /* Similarly, do not compute SVL if SME is disabled. */
 -            DP_TBFLAG_A64(flags, SVL, sve_vqm1_for_el_sm(env, el, true));
 +            int svl = sve_vqm1_for_el_sm(env, el, true);
 +            DP_TBFLAG_A64(flags, SVL, svl);
 +            if (sm) {
 +                /* If SVE is disabled, we will not have set VL above. */
 +                DP_TBFLAG_A64(flags, VL, svl);
 +            }
          }
 -        if (FIELD_EX64(env->svcr, SVCR, SM)) {
 +        if (sm) {
              DP_TBFLAG_A64(flags, PSTATE_SM, 1);
              DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el));
          }
 --
-.20.1
+.25.1

-[PULL 01/24] target/arm: fix stage 2 page-walks in 32-bit emulation
+[PULL 03/15] target/arm: Fix aarch64_sve_change_el for SME
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Using a target unsigned long would limit the Input Address to a LPAE
+We were only checking for SVE disabled and not taking into
-page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay
+account PSTATE.SM to check SME disabled, which resulted in
-for stage 1 or on AArch64, but it is insufficient for stage 2 on
+vectors being incorrectly truncated.
 AArch32. In that later case, the Input Address can have up to 40 bits.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220713045848.217364-3-richard.henderson@linaro.org
-Message-id: 20201118150414.18360-1-remi@remlab.net
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 4 ++--
+ target/arm/helper.c | 31 +++++++++++++++++++++++++------
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 25 insertions(+), 6 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
+     }
- #ifndef CONFIG_USER_ONLY
+ }
--static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
++static uint32_t sve_vqm1_for_el_sm_ena(CPUARMState *env, int el, bool sm)
-+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
++{
-                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
++    int exc_el;
-                                bool s1_is_el0,
++
-                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
++    if (sm) {
-@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
++        exc_el = sme_exception_el(env, el);
-  * @fi: set to fault info if the translation fails
++    } else {
-  * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
++        exc_el = sve_exception_el(env, el);
 +    }
 +    if (exc_el) {
 +        return 0; /* disabled */
 +    }
 +    return sve_vqm1_for_el_sm(env, el, sm);
 +}
 +
  /*
   * Notice a change in SVE vector size when changing EL.
   */
--static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
-+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+ {
-                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
+     ARMCPU *cpu = env_archcpu(env);
-                                bool s1_is_el0,
+     int old_len, new_len;
-                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
+-    bool old_a64, new_a64;
 +    bool old_a64, new_a64, sm;
      /* Nothing to do if no SVE.  */
      if (!cpu_isar_feature(aa64_sve, cpu)) {
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
       * invoke ResetSVEState when taking an exception from, or
       * returning to, AArch32 state when PSTATE.SM is enabled.
       */
 -    if (old_a64 != new_a64 && FIELD_EX64(env->svcr, SVCR, SM)) {
 +    sm = FIELD_EX64(env->svcr, SVCR, SM);
 +    if (old_a64 != new_a64 && sm) {
          arm_reset_sve_state(env);
          return;
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
       * we already have the correct register contents when encountering the
       * vq0->vq0 transition between EL0->EL1.
       */
 -    old_len = (old_a64 && !sve_exception_el(env, old_el)
 -               ? sve_vqm1_for_el(env, old_el) : 0);
 -    new_len = (new_a64 && !sve_exception_el(env, new_el)
 -               ? sve_vqm1_for_el(env, new_el) : 0);
 +    old_len = new_len = 0;
 +    if (old_a64) {
 +        old_len = sve_vqm1_for_el_sm_ena(env, old_el, sm);
 +    }
 +    if (new_a64) {
 +        new_len = sve_vqm1_for_el_sm_ena(env, new_el, sm);
 +    }
      /* When changing vector length, clear inaccessible state.  */
      if (new_len < old_len) {
 --
-.20.1
+.25.1

-[PULL 02/24] hw/arm: Fix bad print format specifiers
+Deleted patch
-From: AlexChen <alex.chen@huawei.com>
-We should use printf format specifier "%u" instead of "%i" for
-argument of type "unsigned int".
-Reported-by: Euler Robot <euler.robot@huawei.com>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
-Message-id: 5F9FD78B.8000300@huawei.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/pxa2xx.c | 2 +-
- hw/arm/spitz.c  | 2 +-
- hw/arm/tosa.c   | 2 +-
-files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/pxa2xx.c
-+++ b/hw/arm/pxa2xx.c
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_ssp_write(void *opaque, hwaddr addr,
-         if (value & SSCR0_MOD)
-             printf("%s: Attempt to use network mode\n", __func__);
-         if (s->enable && SSCR0_DSS(value) < 4)
--            printf("%s: Wrong data size: %i bits\n", __func__,
-+            printf("%s: Wrong data size: %u bits\n", __func__,
-                             SSCR0_DSS(value));
-         if (!(value & SSCR0_SSE)) {
-             s->sssr = 0;
-diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/spitz.c
-+++ b/hw/arm/spitz.c
-@@ -XXX,XX +XXX,XX @@ struct SpitzLCDTG {
- static void spitz_bl_update(SpitzLCDTG *s)
- {
-     if (s->bl_power && s->bl_intensity)
--        zaurus_printf("LCD Backlight now at %i/63\n", s->bl_intensity);
-+        zaurus_printf("LCD Backlight now at %u/63\n", s->bl_intensity);
-     else
-         zaurus_printf("LCD Backlight now off\n");
- }
-diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/tosa.c
-+++ b/hw/arm/tosa.c
-@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
- static uint32_t tosa_ssp_tansfer(SSISlave *dev, uint32_t value)
- {
--    fprintf(stderr, "TG: %d %02x\n", value >> 5, value & 0x1f);
-+    fprintf(stderr, "TG: %u %02x\n", value >> 5, value & 0x1f);
-     return 0;
- }
---
-.20.1

-[PULL 04/24] MAINTAINERS: Cover system/arm/cpu-features.rst with ARM TCG CPUs
+[PULL 04/15] linux-user/aarch64: Do not clear PROT_MTE on mprotect
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The documentation for PROT_MTE says that it cannot be cleared
-Message-id: 20201120154545.2504625-2-f4bug@amsat.org
+by mprotect.  Further, the implementation of the VM_ARCH_CLEAR bit,
 contains PROT_BTI confiming that bit should be cleared.
 Introduce PAGE_TARGET_STICKY to allow target/arch/cpu.h to control
 which bits may be reset during page_set_flags.  This is sort of the
 opposite of VM_ARCH_CLEAR, but works better with qemu's PAGE_* bits
 that are separate from PROT_* bits.
 Reported-by: Vitaly Buka <vitalybuka@google.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220711031420.17820-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 1 +
+ target/arm/cpu.h          |  7 +++++--
-file changed, 1 insertion(+)
+ accel/tcg/translate-all.c | 13 +++++++++++--
 files changed, 16 insertions(+), 4 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/target/arm/cpu.h
-+++ b/MAINTAINERS
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ F: disas/arm.c
+@@ -XXX,XX +XXX,XX @@ static inline MemTxAttrs *typecheck_memtxattrs(MemTxAttrs *x)
- F: disas/arm-a64.cc
- F: disas/libvixl/
+ /*
- F: docs/system/target-arm.rst
+  * AArch64 usage of the PAGE_TARGET_* bits for linux-user.
-+F: docs/system/arm/cpu-features.rst
++ * Note that with the Linux kernel, PROT_MTE may not be cleared by mprotect
++ * mprotect but PROT_BTI may be cleared.  C.f. the kernel's VM_ARCH_CLEAR.
- ARM SMMU
+  */
- M: Eric Auger <eric.auger@redhat.com>
+-#define PAGE_BTI  PAGE_TARGET_1
 -#define PAGE_MTE  PAGE_TARGET_2
 +#define PAGE_BTI            PAGE_TARGET_1
 +#define PAGE_MTE            PAGE_TARGET_2
 +#define PAGE_TARGET_STICKY  PAGE_MTE
  #ifdef TARGET_TAGGED_ADDRESSES
  /**
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ int page_get_flags(target_ulong address)
      return p->flags;
  }
 +/*
 + * Allow the target to decide if PAGE_TARGET_[12] may be reset.
 + * By default, they are not kept.
 + */
 +#ifndef PAGE_TARGET_STICKY
 +#define PAGE_TARGET_STICKY  0
 +#endif
 +#define PAGE_STICKY  (PAGE_ANON | PAGE_TARGET_STICKY)
 +
  /* Modify the flags of a page and invalidate the code if necessary.
     The flag PAGE_WRITE_ORG is positioned automatically depending
     on PAGE_WRITE.  The mmap_lock should already be held.  */
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
              p->target_data = NULL;
              p->flags = flags;
          } else {
 -            /* Using mprotect on a page does not change MAP_ANON. */
 -            p->flags = (p->flags & PAGE_ANON) | flags;
 +            /* Using mprotect on a page does not change sticky bits. */
 +            p->flags = (p->flags & PAGE_STICKY) | flags;
          }
      }
  }
 --
-.20.1
+.25.1

-[PULL 15/24] linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpoints
+[PULL 05/15] target/arm: Define and use new regime_tcr_value() function
-The Linux kernel doesn't use the official bkpt insn for breakpoints;
+The regime_tcr() function returns a pointer to a struct TCR
-instead it uses three instructions in the guaranteed-to-UNDEF space,
+corresponding to the TCR controlling a translation regime.  The
-and generates SIGTRAP for these rather than the SIGILL that most
+struct TCR has the raw value of the register, plus two fields mask
-UNDEF insns generate:
+and base_mask which are used as a small optimization in the case of
 -bit short-descriptor lookups.  Almost all callers of regime_tcr()
 only want the raw register value.  Define and use a new
 regime_tcr_value() function which returns only the raw 64-bit
 register value.
-https://elixir.bootlin.com/linux/v5.9.8/source/arch/arm/kernel/ptrace.c#L197
+This is a preliminary to removing the 32-bit short descriptor
+optimization -- it only saves a handful of bit operations, which is
-Make QEMU treat these insns specially too.  The main benefit of this
+tiny compared to the overhead of doing a page table walk at all, and
-is that if you're running a debugger on a guest program that runs
+the TCR struct is awkward and makes fixing
-into a GCC __builtin_trap() or LLVM "trap because execution should
+https://gitlab.com/qemu-project/qemu/-/issues/1103 unnecessarily
-never reach here" then you'll get the expected signal rather than a
+difficult.
 SIGILL.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201117155634.6924-1-peter.maydell@linaro.org
+Message-id: 20220714132303.1287193-2-peter.maydell@linaro.org
 ---
- linux-user/arm/cpu_loop.c | 28 ++++++++++++++++++++++++++++
+ target/arm/internals.h  | 6 ++++++
-file changed, 28 insertions(+)
+ target/arm/helper.c     | 6 +++---
  target/arm/ptw.c        | 8 ++++----
  target/arm/tlb_helper.c | 2 +-
 files changed, 14 insertions(+), 8 deletions(-)
-diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/cpu_loop.c
+--- a/target/arm/internals.h
-+++ b/linux-user/arm/cpu_loop.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ do_kernel_trap(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
-     return 0;
+     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
  }
-+static bool insn_is_linux_bkpt(uint32_t opcode, bool is_thumb)
++/* Return the raw value of the TCR controlling this translation regime */
 +static inline uint64_t regime_tcr_value(CPUARMState *env, ARMMMUIdx mmu_idx)
 +{
-+    /*
++    return regime_tcr(env, mmu_idx)->raw_tcr;
 +     * Return true if this insn is one of the three magic UDF insns
 +     * which the kernel treats as breakpoint insns.
 +     */
 +    if (!is_thumb) {
 +        return (opcode & 0x0fffffff) == 0x07f001f0;
 +    } else {
 +        /*
 +         * Note that we get the two halves of the 32-bit T32 insn
 +         * in the opposite order to the value the kernel uses in
 +         * its undef_hook struct.
 +         */
 +        return ((opcode & 0xffff) == 0xde01) || (opcode == 0xa000f7f0);
 +    }
 +}
 +
- void cpu_loop(CPUARMState *env)
+ /**
   * arm_num_brps: Return number of implemented breakpoints.
   * Note that the ID register BRPS field is "number of bps - 1",
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
  static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
                                uint64_t addr)
  {
-     CPUState *cs = env_cpu(env);
+-    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
++    uint64_t tcr = regime_tcr_value(env, mmu_idx);
-                 /* FIXME - what to do if get_user() fails? */
+     int tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
-                 get_user_code_u32(opcode, env->regs[15], env);
+     int select = extract64(addr, 55, 1);
-+                /*
+@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
-+                 * The Linux kernel treats some UDF patterns specially
+ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-+                 * to use as breakpoints (instead of the architectural
+                                    ARMMMUIdx mmu_idx, bool data)
-+                 * bkpt insn). These should trigger a SIGTRAP rather
+ {
-+                 * than SIGILL.
+-    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
-+                 */
++    uint64_t tcr = regime_tcr_value(env, mmu_idx);
-+                if (insn_is_linux_bkpt(opcode, env->thumb)) {
+     bool epd, hpd, using16k, using64k, tsz_oob, ds;
-+                    goto excp_debug;
+     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
-+                }
+     ARMCPU *cpu = env_archcpu(env);
-+
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
-                 rc = EmulateAll(opcode, &ts->fpa, env);
+ {
-                 if (rc == 0) { /* illegal instruction */
+     CPUARMTBFlags flags = {};
-                     info.si_signo = TARGET_SIGILL;
+     ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
 -    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
 +    uint64_t tcr = regime_tcr_value(env, mmu_idx);
      uint64_t sctlr;
      int tbii, tbid;
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
  static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
                                            ARMMMUIdx mmu_idx)
  {
 -    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
 +    uint64_t tcr = regime_tcr_value(env, mmu_idx);
      uint32_t el = regime_el(env, mmu_idx);
      int select, tsz;
      bool epd, hpd;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
      uint32_t attrs;
      int32_t stride;
      int addrsize, inputsize, outputsize;
 -    TCR *tcr = regime_tcr(env, mmu_idx);
 +    uint64_t tcr = regime_tcr_value(env, mmu_idx);
      int ap, ns, xn, pxn;
      uint32_t el = regime_el(env, mmu_idx);
      uint64_t descaddrmask;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
           * For stage 2 translations the starting level is specified by the
           * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
           */
 -        uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
 -        uint32_t sl2 = extract64(tcr->raw_tcr, 33, 1);
 +        uint32_t sl0 = extract32(tcr, 6, 2);
 +        uint32_t sl2 = extract64(tcr, 33, 1);
          uint32_t startlevel;
          bool ok;
 diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tlb_helper.c
 +++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
          return true;
      }
      if (arm_feature(env, ARM_FEATURE_LPAE)
 -        && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
 +        && (regime_tcr_value(env, mmu_idx) & TTBCR_EAE)) {
          return true;
      }
      return false;
 --
-.20.1
+.25.1

-[PULL 23/24] docs: Split qemu-pr-helper documentation into tools manual
+[PULL 06/15] target/arm: Calculate mask/base_mask in get_level1_table_address()
-Split the documentation of the qemu-pr-helper binary into the tools
+In get_level1_table_address(), instead of using precalculated values
-manual, and give it a manpage like our other standalone executables.
+of mask and base_mask from the TCR struct, calculate them directly
 (in the same way we currently do in vmsa_ttbcr_raw_write() to
 populate the TCR struct fields).
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220714132303.1287193-3-peter.maydell@linaro.org
 ---
- docs/meson.build              |  1 +
+ target/arm/ptw.c | 14 +++++++++-----
- docs/system/pr-manager.rst    | 38 ++-------------
+file changed, 9 insertions(+), 5 deletions(-)
  docs/tools/conf.py            |  2 +
  docs/tools/index.rst          |  1 +
  docs/tools/qemu-pr-helper.rst | 90 +++++++++++++++++++++++++++++++++++
 files changed, 99 insertions(+), 33 deletions(-)
  create mode 100644 docs/tools/qemu-pr-helper.rst
-diff --git a/docs/meson.build b/docs/meson.build
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/meson.build
+--- a/target/arm/ptw.c
-+++ b/docs/meson.build
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ if build_docs
+@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
-     'tools': {
+                                      uint32_t *table, uint32_t address)
-         'qemu-img.1': (have_tools ? 'man1' : ''),
+ {
-         'qemu-nbd.8': (have_tools ? 'man8' : ''),
+     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
-+        'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
+-    TCR *tcr = regime_tcr(env, mmu_idx);
-         'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
++    uint64_t tcr = regime_tcr_value(env, mmu_idx);
-         'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
++    int maskshift = extract32(tcr, 0, 3);
-         'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
++    uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
-diff --git a/docs/system/pr-manager.rst b/docs/system/pr-manager.rst
++    uint32_t base_mask;
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/pr-manager.rst
+-    if (address & tcr->mask) {
-+++ b/docs/system/pr-manager.rst
+-        if (tcr->raw_tcr & TTBCR_PD1) {
-@@ -XXX,XX +XXX,XX @@ Alternatively, using ``-blockdev``::
++    if (address & mask) {
-           -blockdev node-name=hd,driver=raw,file.driver=host_device,file.filename=/dev/sdb,file.pr-manager=helper0
++        if (tcr & TTBCR_PD1) {
-           -device scsi-block,drive=hd
+             /* Translation table walk disabled for TTBR1 */
+             return false;
------------------------------------
+         }
--Invoking :program:`qemu-pr-helper`
+         *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
------------------------------------
+     } else {
--
+-        if (tcr->raw_tcr & TTBCR_PD0) {
--QEMU provides an implementation of the persistent reservation helper,
++        if (tcr & TTBCR_PD0) {
--called :program:`qemu-pr-helper`.  The helper should be started as a
+             /* Translation table walk disabled for TTBR0 */
--system service and supports the following option:
+             return false;
--
+         }
---d, --daemon              run in the background
+-        *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
---q, --quiet               decrease verbosity
++        base_mask = ~((uint32_t)0x3fffu >> maskshift);
---v, --verbose             increase verbosity
++        *table = regime_ttbr(env, mmu_idx, 0) & base_mask;
---f, --pidfile=path        PID file when running as a daemon
+     }
---k, --socket=path         path to the socket
+     *table |= (address >> 18) & 0x3ffc;
---T, --trace=trace-opts    tracing options
+     return true;
 -
 -By default, the socket and PID file are placed in the runtime state
 -directory, for example :file:`/var/run/qemu-pr-helper.sock` and
 -:file:`/var/run/qemu-pr-helper.pid`.  The PID file is not created
 -unless :option:`-d` is passed too.
 -
 -:program:`qemu-pr-helper` can also use the systemd socket activation
 -protocol.  In this case, the systemd socket unit should specify a
 -Unix stream socket, like this::
 -
 -    [Socket]
 -    ListenStream=/var/run/qemu-pr-helper.sock
 -
 -After connecting to the socket, :program:`qemu-pr-helper`` can optionally drop
 -root privileges, except for those capabilities that are needed for
 -its operation.  To do this, add the following options:
 -
 --u, --user=user           user to drop privileges to
 --g, --group=group         group to drop privileges to
 +You will also need to ensure that the helper program
 +:command:`qemu-pr-helper` is running, and that it has been
 +set up to use the same socket filename as your QEMU commandline
 +specifies. See the qemu-pr-helper documentation or manpage for
 +further details.
  ---------------------------------------------
  Multipath devices and persistent reservations
 diff --git a/docs/tools/conf.py b/docs/tools/conf.py
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/tools/conf.py
 +++ b/docs/tools/conf.py
@@ -XXX,XX +XXX,XX @@ man_pages = [
       ['Fabrice Bellard'], 1),
      ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
       ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
 +    ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
 +     [], 8),
      ('qemu-trace-stap', 'qemu-trace-stap', u'QEMU SystemTap trace tool',
       [], 1),
      ('virtfs-proxy-helper', 'virtfs-proxy-helper',
 diff --git a/docs/tools/index.rst b/docs/tools/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/tools/index.rst
 +++ b/docs/tools/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
     qemu-img
     qemu-nbd
 +   qemu-pr-helper
     qemu-trace-stap
     virtfs-proxy-helper
     virtiofsd
 diff --git a/docs/tools/qemu-pr-helper.rst b/docs/tools/qemu-pr-helper.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/tools/qemu-pr-helper.rst
@@ -XXX,XX +XXX,XX @@
 +QEMU persistent reservation helper
 +==================================
 +
 +Synopsis
 +--------
 +
 +**qemu-pr-helper** [*OPTION*]
 +
 +Description
 +-----------
 +
 +Implements the persistent reservation helper for QEMU.
 +
 +SCSI persistent reservations allow restricting access to block devices
 +to specific initiators in a shared storage setup.  When implementing
 +clustering of virtual machines, it is a common requirement for virtual
 +machines to send persistent reservation SCSI commands.  However,
 +the operating system restricts sending these commands to unprivileged
 +programs because incorrect usage can disrupt regular operation of the
 +storage fabric. QEMU's SCSI passthrough devices ``scsi-block``
 +and ``scsi-generic`` support passing guest persistent reservation
 +requests to a privileged external helper program. :program:`qemu-pr-helper`
 +is that external helper; it creates a socket which QEMU can
 +connect to to communicate with it.
 +
 +If you want to run VMs in a setup like this, this helper should be
 +started as a system service, and you should read the QEMU manual
 +section on "persistent reservation managers" to find out how to
 +configure QEMU to connect to the socket created by
 +:program:`qemu-pr-helper`.
 +
 +After connecting to the socket, :program:`qemu-pr-helper` can
 +optionally drop root privileges, except for those capabilities that
 +are needed for its operation.
 +
 +:program:`qemu-pr-helper` can also use the systemd socket activation
 +protocol.  In this case, the systemd socket unit should specify a
 +Unix stream socket, like this::
 +
 +    [Socket]
 +    ListenStream=/var/run/qemu-pr-helper.sock
 +
 +Options
 +-------
 +
 +.. program:: qemu-pr-helper
 +
 +.. option:: -d, --daemon
 +
 +  run in the background (and create a PID file)
 +
 +.. option:: -q, --quiet
 +
 +  decrease verbosity
 +
 +.. option:: -v, --verbose
 +
 +  increase verbosity
 +
 +.. option:: -f, --pidfile=PATH
 +
 +  PID file when running as a daemon. By default the PID file
 +  is created in the system runtime state directory, for example
 +  :file:`/var/run/qemu-pr-helper.pid`.
 +
 +.. option:: -k, --socket=PATH
 +
 +  path to the socket. By default the socket is created in
 +  the system runtime state directory, for example
 +  :file:`/var/run/qemu-pr-helper.sock`.
 +
 +.. option:: -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]
 +
 +  .. include:: ../qemu-option-trace.rst.inc
 +
 +.. option:: -u, --user=USER
 +
 +  user to drop privileges to
 +
 +.. option:: -g, --group=GROUP
 +
 +  group to drop privileges to
 +
 +.. option:: -h, --help
 +
 +  Display a help message and exit.
 +
 +.. option:: -V, --version
 +
 +  Display version information and exit.
 --
-.20.1
+.25.1

-[PULL 22/24] docs: Move pr-manager.rst into the system manual
+[PULL 07/15] target/arm: Fold regime_tcr() and regime_tcr_value() together
-Move the pr-manager documentation into the system manual.
+The only caller of regime_tcr() is now regime_tcr_value(); fold the
-Some of it (the documentation of the pr-manager-helper tool)
+two together, and use the shorter and more natural 'regime_tcr'
-should be in tools, but we will split it up after moving it.
+name for the new function.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220714132303.1287193-4-peter.maydell@linaro.org
 ---
- docs/system/index.rst            | 1 +
+ target/arm/internals.h  | 16 +++++-----------
- docs/{ => system}/pr-manager.rst | 0
+ target/arm/helper.c     |  6 +++---
-files changed, 1 insertion(+)
+ target/arm/ptw.c        |  6 +++---
- rename docs/{ => system}/pr-manager.rst (100%)
+ target/arm/tlb_helper.c |  2 +-
 files changed, 12 insertions(+), 18 deletions(-)
-diff --git a/docs/system/index.rst b/docs/system/index.rst
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/index.rst
+--- a/target/arm/internals.h
-+++ b/docs/system/index.rst
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ Contents:
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
-    managed-startup
+     return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
-    cpu-hotplug
+ }
-    virtio-pmem
-+   pr-manager
+-/* Return the TCR controlling this translation regime */
-    targets
+-static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
-    security
++/* Return the value of the TCR controlling this translation regime */
-    deprecated
++static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
-diff --git a/docs/pr-manager.rst b/docs/system/pr-manager.rst
+ {
-similarity index 100%
+     if (mmu_idx == ARMMMUIdx_Stage2) {
-rename from docs/pr-manager.rst
+-        return &env->cp15.vtcr_el2;
-rename to docs/system/pr-manager.rst
++        return env->cp15.vtcr_el2.raw_tcr;
      }
      if (mmu_idx == ARMMMUIdx_Stage2_S) {
          /*
           * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
           * those are not currently used by QEMU, so just return VSTCR_EL2.
           */
 -        return &env->cp15.vstcr_el2;
 +        return env->cp15.vstcr_el2.raw_tcr;
      }
 -    return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
 -}
 -
 -/* Return the raw value of the TCR controlling this translation regime */
 -static inline uint64_t regime_tcr_value(CPUARMState *env, ARMMMUIdx mmu_idx)
 -{
 -    return regime_tcr(env, mmu_idx)->raw_tcr;
 +    return env->cp15.tcr_el[regime_el(env, mmu_idx)].raw_tcr;
  }
  /**
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
  static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
                                uint64_t addr)
  {
 -    uint64_t tcr = regime_tcr_value(env, mmu_idx);
 +    uint64_t tcr = regime_tcr(env, mmu_idx);
      int tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
      int select = extract64(addr, 55, 1);
@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
  ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                     ARMMMUIdx mmu_idx, bool data)
  {
 -    uint64_t tcr = regime_tcr_value(env, mmu_idx);
 +    uint64_t tcr = regime_tcr(env, mmu_idx);
      bool epd, hpd, using16k, using64k, tsz_oob, ds;
      int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
      ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
  {
      CPUARMTBFlags flags = {};
      ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
 -    uint64_t tcr = regime_tcr_value(env, mmu_idx);
 +    uint64_t tcr = regime_tcr(env, mmu_idx);
      uint64_t sctlr;
      int tbii, tbid;
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
                                       uint32_t *table, uint32_t address)
  {
      /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
 -    uint64_t tcr = regime_tcr_value(env, mmu_idx);
 +    uint64_t tcr = regime_tcr(env, mmu_idx);
      int maskshift = extract32(tcr, 0, 3);
      uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
      uint32_t base_mask;
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
  static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
                                            ARMMMUIdx mmu_idx)
  {
 -    uint64_t tcr = regime_tcr_value(env, mmu_idx);
 +    uint64_t tcr = regime_tcr(env, mmu_idx);
      uint32_t el = regime_el(env, mmu_idx);
      int select, tsz;
      bool epd, hpd;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
      uint32_t attrs;
      int32_t stride;
      int addrsize, inputsize, outputsize;
 -    uint64_t tcr = regime_tcr_value(env, mmu_idx);
 +    uint64_t tcr = regime_tcr(env, mmu_idx);
      int ap, ns, xn, pxn;
      uint32_t el = regime_el(env, mmu_idx);
      uint64_t descaddrmask;
 diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tlb_helper.c
 +++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
          return true;
      }
      if (arm_feature(env, ARM_FEATURE_LPAE)
 -        && (regime_tcr_value(env, mmu_idx) & TTBCR_EAE)) {
 +        && (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
          return true;
      }
      return false;
 --
-.20.1
+.25.1

-[PULL 21/24] docs: Move microvm.rst into the system manual
+[PULL 08/15] target/arm: Fix big-endian host handling of VTCR
-Now that target-i386.rst has a place to list documentation of
+We have a bug in our handling of accesses to the AArch32 VTCR
-machines other than the 'pc' machine, we have a place we can
+register on big-endian hosts: we were not adjusting the part of the
-move the microvm documentation to.
+uint64_t field within TCR that the generated code would access.  That
 can be done with offsetoflow32(), by using an ARM_CP_STATE_BOTH cpreg
 struct, or by defining a full set of read/write/reset functions --
 the various other TCR cpreg structs used one or another of those
 strategies, but for VTCR we did not, so on a big-endian host VTCR
 accesses would touch the wrong half of the register.
 Use offsetoflow32() in the VTCR register struct.  This works even
 though the field in the CPU struct is currently a struct TCR, because
 the first field in that struct is the uint64_t raw_tcr.
 None of the other TCR registers have this bug -- either they are
 AArch64 only, or else they define resetfn, writefn, etc, and
 expect to be passed the full struct pointer.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220714132303.1287193-5-peter.maydell@linaro.org
 ---
- docs/{ => system/i386}/microvm.rst | 5 ++---
+ target/arm/helper.c | 2 +-
- docs/system/target-i386.rst        | 1 +
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 3 insertions(+), 3 deletions(-)
  rename docs/{ => system/i386}/microvm.rst (98%)
-diff --git a/docs/microvm.rst b/docs/system/i386/microvm.rst
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 similarity index 98%
 rename from docs/microvm.rst
 rename to docs/system/i386/microvm.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/microvm.rst
+--- a/target/arm/helper.c
-+++ b/docs/system/i386/microvm.rst
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
--====================
+       .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
--microvm Machine Type
+       .type = ARM_CP_ALIAS,
--====================
+       .access = PL2_RW, .accessfn = access_el3_aa32ns,
-+'microvm' virtual platform (``microvm``)
+-      .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
-+========================================
++      .fieldoffset = offsetoflow32(CPUARMState, cp15.vtcr_el2) },
+     { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
- ``microvm`` is a machine type inspired by ``Firecracker`` and
+       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
- constructed after its machine model.
+       .access = PL2_RW,
 diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/target-i386.rst
 +++ b/docs/system/target-i386.rst
@@ -XXX,XX +XXX,XX @@ Board-specific documentation
  .. toctree::
     :maxdepth: 1
 +   i386/microvm
     i386/pc
  .. include:: cpu-models-x86.rst.inc
 --
-.20.1
+.25.1

-[PULL 20/24] docs: Split out 'pc' machine model docs into their own file
+[PULL 09/15] target/arm: Store VTCR_EL2, VSTCR_EL2 registers as uint64_t
-Currently target-i386.rst includes the documentation of the 'pc'
+Change the representation of the VSTCR_EL2 and VTCR_EL2 registers in
-machine model inline. Split it out into its own file, in a
+the CPU state struct from struct TCR to uint64_t.
 similar way to target-i386.rst; this gives us a place to put
 documentation of other i386 machine models, such as 'microvm'.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220714132303.1287193-6-peter.maydell@linaro.org
 ---
- docs/system/i386/pc.rst     |  7 +++++++
+ target/arm/cpu.h       |  4 ++--
- docs/system/target-i386.rst | 18 +++++++++++++-----
+ target/arm/internals.h |  4 ++--
-files changed, 20 insertions(+), 5 deletions(-)
+ target/arm/helper.c    |  4 +---
- create mode 100644 docs/system/i386/pc.rst
+ target/arm/ptw.c       | 14 +++++++-------
 files changed, 12 insertions(+), 14 deletions(-)
-diff --git a/docs/system/i386/pc.rst b/docs/system/i386/pc.rst
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/i386/pc.rst
@@ -XXX,XX +XXX,XX @@
 +i440fx PC (``pc-i440fx``, ``pc``)
 +=================================
 +
 +Peripherals
 +~~~~~~~~~~~
 +
 +.. include:: ../target-i386-desc.rst.inc
 diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/target-i386.rst
+--- a/target/arm/cpu.h
-+++ b/docs/system/target-i386.rst
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- .. _QEMU-PC-System-emulator:
+         uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
+         /* MMU translation table base control. */
--x86 (PC) System emulator
+         TCR tcr_el[4];
--------------------------
+-        TCR vtcr_el2; /* Virtualization Translation Control.  */
-+x86 System emulator
+-        TCR vstcr_el2; /* Secure Virtualization Translation Control. */
-+-------------------
++        uint64_t vtcr_el2; /* Virtualization Translation Control.  */
++        uint64_t vstcr_el2; /* Secure Virtualization Translation Control. */
- .. _pcsys_005fdevices:
+         uint32_t c2_data; /* MPU data cacheable bits.  */
+         uint32_t c2_insn; /* MPU instruction cacheable bits.  */
--Peripherals
+         union { /* MMU domain access control register
--~~~~~~~~~~~
+diff --git a/target/arm/internals.h b/target/arm/internals.h
-+Board-specific documentation
+index XXXXXXX..XXXXXXX 100644
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
--.. include:: target-i386-desc.rst.inc
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
-+..
+ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
-+   This table of contents should be kept sorted alphabetically
+ {
-+   by the title text of each file, which isn't the same ordering
+     if (mmu_idx == ARMMMUIdx_Stage2) {
-+   as an alphabetical sort by filename.
+-        return env->cp15.vtcr_el2.raw_tcr;
-+
++        return env->cp15.vtcr_el2;
-+.. toctree::
+     }
-+   :maxdepth: 1
+     if (mmu_idx == ARMMMUIdx_Stage2_S) {
-+
+         /*
-+   i386/pc
+          * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
+          * those are not currently used by QEMU, so just return VSTCR_EL2.
- .. include:: cpu-models-x86.rst.inc
+          */
+-        return env->cp15.vstcr_el2.raw_tcr;
 +        return env->cp15.vstcr_el2;
      }
      return env->cp15.tcr_el[regime_el(env, mmu_idx)].raw_tcr;
  }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
      { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
        .access = PL2_RW,
 -      /* no .writefn needed as this can't cause an ASID change;
 -       * no .raw_writefn or .resetfn needed as we never use mask/base_mask
 -       */
 +      /* no .writefn needed as this can't cause an ASID change */
        .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
      { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
        .cp = 15, .opc1 = 6, .crm = 2,
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
          if (arm_is_secure_below_el3(env)) {
              /* Check if page table walk is to secure or non-secure PA space. */
              if (*is_secure) {
 -                *is_secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
 +                *is_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
              } else {
 -                *is_secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
 +                *is_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
              }
          } else {
              assert(!*is_secure);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
              ipa_secure = attrs->secure;
              if (arm_is_secure_below_el3(env)) {
                  if (ipa_secure) {
 -                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
 +                    attrs->secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
                  } else {
 -                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
 +                    attrs->secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
                  }
              } else {
                  assert(!ipa_secure);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
              if (arm_is_secure_below_el3(env)) {
                  if (ipa_secure) {
                      attrs->secure =
 -                        !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
 +                        !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW));
                  } else {
                      attrs->secure =
 -                        !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
 -                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
 +                        !((env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))
 +                        || (env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)));
                  }
              }
              return 0;
 --
-.20.1
+.25.1

-[PULL 19/24] docs/system/virtio-pmem.rst: Fix minor style issues
+[PULL 10/15] target/arm: Store TCR_EL* registers as uint64_t
-The virtio-pmem documentation has some minor style issues we hadn't
+Change the representation of the TCR_EL* registers in the CPU state
-noticed since we weren't rendering it in our docs:
+struct from struct TCR to uint64_t.  This allows us to drop the
+custom vmsa_ttbcr_raw_write() function, moving the "enforce RES0"
- * Sphinx doesn't complain about overlong title-underlining the
+checks to their more usual location in the writefn
-   way it complains about too-short underlining, but it looks odd;
+vmsa_ttbcr_write().  We also don't need the resetfn any more.
    make the underlines of section headers the right length
  * Indent of paragraphs makes them render as blockquotes;
    remove the indent so they just render as normal text
  * Leading 'o' isn't rst markup, so it just renders as a literal
    "o"; reformat as a subsection heading instead
  * "QEMU" in the document title and section headings are a bit
    odd and unnecessary since this is the QEMU manual; delete
    or rephrase them
  * There's no need to specify what QEMU version the device first
    appeared in.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Pankaj Gupta <pankaj.gupta@cloud.ionos.com>
+Message-id: 20220714132303.1287193-7-peter.maydell@linaro.org
 ---
- docs/system/virtio-pmem.rst | 60 ++++++++++++++++++-------------------
+ target/arm/cpu.h          |  8 +----
-file changed, 30 insertions(+), 30 deletions(-)
+ target/arm/internals.h    |  6 ++--
  target/arm/cpu.c          |  2 +-
  target/arm/debug_helper.c |  2 +-
  target/arm/helper.c       | 75 +++++++++++----------------------------
  target/arm/ptw.c          |  2 +-
 files changed, 27 insertions(+), 68 deletions(-)
-diff --git a/docs/system/virtio-pmem.rst b/docs/system/virtio-pmem.rst
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/virtio-pmem.rst
+--- a/target/arm/cpu.h
-+++ b/docs/system/virtio-pmem.rst
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
+ #define GTIMER_HYPVIRT  4
--========================
+ #define NUM_GTIMERS     5
--QEMU virtio pmem
--========================
+-typedef struct {
-+===========
+-    uint64_t raw_tcr;
-+virtio pmem
+-    uint32_t mask;
-+===========
+-    uint32_t base_mask;
+-} TCR;
-- This document explains the setup and usage of the virtio pmem device
+-
-- which is available since QEMU v4.1.0.
+ #define VTCR_NSW (1u << 29)
--
+ #define VTCR_NSA (1u << 30)
-- The virtio pmem device is a paravirtualized persistent memory device
+ #define VSTCR_SW VTCR_NSW
-- on regular (i.e non-NVDIMM) storage.
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-+This document explains the setup and usage of the virtio pmem device.
+         uint64_t vttbr_el2; /* Virtualization Translation Table Base.  */
-+The virtio pmem device is a paravirtualized persistent memory device
+         uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
-+on regular (i.e non-NVDIMM) storage.
+         /* MMU translation table base control. */
+-        TCR tcr_el[4];
- Usecase
++        uint64_t tcr_el[4];
----------
+         uint64_t vtcr_el2; /* Virtualization Translation Control.  */
-+-------
+         uint64_t vstcr_el2; /* Secure Virtualization Translation Control. */
+         uint32_t c2_data; /* MPU data cacheable bits.  */
--  Virtio pmem allows to bypass the guest page cache and directly use
+diff --git a/target/arm/internals.h b/target/arm/internals.h
--  host page cache. This reduces guest memory footprint as the host can
+index XXXXXXX..XXXXXXX 100644
--  make efficient memory reclaim decisions under memory pressure.
+--- a/target/arm/internals.h
-+Virtio pmem allows to bypass the guest page cache and directly use
++++ b/target/arm/internals.h
-+host page cache. This reduces guest memory footprint as the host can
+@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu);
-+make efficient memory reclaim decisions under memory pressure.
+  */
+ static inline bool extended_addresses_enabled(CPUARMState *env)
--o How does virtio-pmem compare to the nvdimm emulation supported by QEMU?
+ {
-+How does virtio-pmem compare to the nvdimm emulation?
+-    TCR *tcr = &env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
-+-----------------------------------------------------
++    uint64_t tcr = env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
+     return arm_el_is_aa64(env, 1) ||
--  NVDIMM emulation on regular (i.e. non-NVDIMM) host storage does not
+-           (arm_feature(env, ARM_FEATURE_LPAE) && (tcr->raw_tcr & TTBCR_EAE));
--  persist the guest writes as there are no defined semantics in the device
++           (arm_feature(env, ARM_FEATURE_LPAE) && (tcr & TTBCR_EAE));
--  specification. The virtio pmem device provides guest write persistence
+ }
--  on non-NVDIMM host storage.
-+NVDIMM emulation on regular (i.e. non-NVDIMM) host storage does not
+ /* Update a QEMU watchpoint based on the information the guest has set in the
-+persist the guest writes as there are no defined semantics in the device
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
-+specification. The virtio pmem device provides guest write persistence
+          */
-+on non-NVDIMM host storage.
+         return env->cp15.vstcr_el2;
+     }
- virtio pmem usage
+-    return env->cp15.tcr_el[regime_el(env, mmu_idx)].raw_tcr;
- -----------------
++    return env->cp15.tcr_el[regime_el(env, mmu_idx)];
+ }
--  A virtio pmem device backed by a memory-backend-file can be created on
--  the QEMU command line as in the following example::
+ /**
-+A virtio pmem device backed by a memory-backend-file can be created on
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-+the QEMU command line as in the following example::
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
-     -object memory-backend-file,id=mem1,share,mem-path=./virtio_pmem.img,size=4G
++++ b/target/arm/cpu.c
-     -device virtio-pmem-pci,memdev=mem1,id=nv1
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+          * Enable TBI0 but not TBI1.
--  where:
+          * Note that this must match useronly_clean_ptr.
-+where:
+          */
+-        env->cp15.tcr_el[1].raw_tcr = 5 | (1ULL << 37);
-   - "object memory-backend-file,id=mem1,share,mem-path=<image>, size=<image size>"
++        env->cp15.tcr_el[1] = 5 | (1ULL << 37);
-     creates a backend file with the specified size.
-@@ -XXX,XX +XXX,XX @@ virtio pmem usage
+         /* Enable MTE */
-   - "device virtio-pmem-pci,id=nvdimm1,memdev=mem1" creates a virtio pmem
+         if (cpu_isar_feature(aa64_mte, cpu)) {
-     pci device whose storage is provided by above memory backend device.
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
--  Multiple virtio pmem devices can be created if multiple pairs of "-object"
+--- a/target/arm/debug_helper.c
--  and "-device" are provided.
++++ b/target/arm/debug_helper.c
-+Multiple virtio pmem devices can be created if multiple pairs of "-object"
+@@ -XXX,XX +XXX,XX @@ static uint32_t arm_debug_exception_fsr(CPUARMState *env)
-+and "-device" are provided.
+         using_lpae = true;
+     } else {
- Hotplug
+         if (arm_feature(env, ARM_FEATURE_LPAE) &&
- -------
+-            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
-@@ -XXX,XX +XXX,XX @@ the guest::
++            (env->cp15.tcr_el[target_el] & TTBCR_EAE)) {
- Guest Data Persistence
+             using_lpae = true;
- ----------------------
+         }
+     }
-- Guest data persistence on non-NVDIMM requires guest userspace applications
+diff --git a/target/arm/helper.c b/target/arm/helper.c
-- to perform fsync/msync. This is different from a real nvdimm backend where
+index XXXXXXX..XXXXXXX 100644
-- no additional fsync/msync is required. This is to persist guest writes in
+--- a/target/arm/helper.c
-- host backing file which otherwise remains in host page cache and there is
++++ b/target/arm/helper.c
-- risk of losing the data in case of power failure.
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
-+Guest data persistence on non-NVDIMM requires guest userspace applications
+       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
-+to perform fsync/msync. This is different from a real nvdimm backend where
+ };
-+no additional fsync/msync is required. This is to persist guest writes in
-+host backing file which otherwise remains in host page cache and there is
+-static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+risk of losing the data in case of power failure.
+-                                 uint64_t value)
++static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- With virtio pmem device, MAP_SYNC mmap flag is not supported. This provides
++                             uint64_t value)
-- a hint to application to perform fsync for write persistence.
+ {
-+With virtio pmem device, MAP_SYNC mmap flag is not supported. This provides
+-    TCR *tcr = raw_ptr(env, ri);
-+a hint to application to perform fsync for write persistence.
+-    int maskshift = extract32(value, 0, 3);
++    ARMCPU *cpu = env_archcpu(env);
- Limitations
--------------
+     if (!arm_feature(env, ARM_FEATURE_V8)) {
-+-----------
+         if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
-+
+-            /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
- - Real nvdimm device backend is not supported.
+-             * using Long-desciptor translation table format */
- - virtio pmem hotunplug is not supported.
++            /*
- - ACPI NVDIMM features like regions/namespaces are not supported.
++             * Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
 +             * using Long-descriptor translation table format
 +             */
              value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
          } else if (arm_feature(env, ARM_FEATURE_EL3)) {
 -            /* In an implementation that includes the Security Extensions
 +            /*
 +             * In an implementation that includes the Security Extensions
               * TTBCR has additional fields PD0 [4] and PD1 [5] for
               * Short-descriptor translation table format.
               */
@@ -XXX,XX +XXX,XX @@ static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
          }
      }
 -    /* Update the masks corresponding to the TCR bank being written
 -     * Note that we always calculate mask and base_mask, but
 -     * they are only used for short-descriptor tables (ie if EAE is 0);
 -     * for long-descriptor tables the TCR fields are used differently
 -     * and the mask and base_mask values are meaningless.
 -     */
 -    tcr->raw_tcr = value;
 -    tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
 -    tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
 -}
 -
 -static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                             uint64_t value)
 -{
 -    ARMCPU *cpu = env_archcpu(env);
 -    TCR *tcr = raw_ptr(env, ri);
 -
      if (arm_feature(env, ARM_FEATURE_LPAE)) {
          /* With LPAE the TTBCR could result in a change of ASID
           * via the TTBCR.A1 bit, so do a TLB flush.
           */
          tlb_flush(CPU(cpu));
      }
 -    /* Preserve the high half of TCR_EL1, set via TTBCR2.  */
 -    value = deposit64(tcr->raw_tcr, 0, 32, value);
 -    vmsa_ttbcr_raw_write(env, ri, value);
 -}
 -
 -static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
 -{
 -    TCR *tcr = raw_ptr(env, ri);
 -
 -    /* Reset both the TCR as well as the masks corresponding to the bank of
 -     * the TCR being reset.
 -     */
 -    tcr->raw_tcr = 0;
 -    tcr->mask = 0;
 -    tcr->base_mask = 0xffffc000u;
 +    raw_write(env, ri, value);
  }
  static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                 uint64_t value)
  {
      ARMCPU *cpu = env_archcpu(env);
 -    TCR *tcr = raw_ptr(env, ri);
      /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
      tlb_flush(CPU(cpu));
 -    tcr->raw_tcr = value;
 +    raw_write(env, ri, value);
  }
  static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
        .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
        .access = PL1_RW, .accessfn = access_tvm_trvm,
        .writefn = vmsa_tcr_el12_write,
 -      .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
 +      .raw_writefn = raw_write,
 +      .resetvalue = 0,
        .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
      { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
        .access = PL1_RW, .accessfn = access_tvm_trvm,
        .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
 -      .raw_writefn = vmsa_ttbcr_raw_write,
 -      /* No offsetoflow32 -- pass the entire TCR to writefn/raw_writefn. */
 -      .bank_fieldoffsets = { offsetof(CPUARMState, cp15.tcr_el[3]),
 -                             offsetof(CPUARMState, cp15.tcr_el[1])} },
 +      .raw_writefn = raw_write,
 +      .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
 +                             offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
  };
  /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ttbcr2_reginfo = {
      .access = PL1_RW, .accessfn = access_tvm_trvm,
      .type = ARM_CP_ALIAS,
      .bank_fieldoffsets = {
 -        offsetofhigh32(CPUARMState, cp15.tcr_el[3].raw_tcr),
 -        offsetofhigh32(CPUARMState, cp15.tcr_el[1].raw_tcr),
 +        offsetofhigh32(CPUARMState, cp15.tcr_el[3]),
 +        offsetofhigh32(CPUARMState, cp15.tcr_el[1]),
      },
  };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
      { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
        .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
        .access = PL2_RW, .writefn = vmsa_tcr_el12_write,
 -      /* no .raw_writefn or .resetfn needed as we never use mask/base_mask */
        .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
      { .name = "VTCR", .state = ARM_CP_STATE_AA32,
        .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
      { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
        .access = PL3_RW,
 -      /* no .writefn needed as this can't cause an ASID change;
 -       * we must provide a .raw_writefn and .resetfn because we handle
 -       * reset and migration for the AArch32 TTBCR(S), which might be
 -       * using mask and base_mask.
 -       */
 -      .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write,
 +      /* no .writefn needed as this can't cause an ASID change */
 +      .resetvalue = 0,
        .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
      { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
        .type = ARM_CP_ALIAS,
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
              int r_el = regime_el(env, mmu_idx);
              if (arm_el_is_aa64(env, r_el)) {
                  int pamax = arm_pamax(env_archcpu(env));
 -                uint64_t tcr = env->cp15.tcr_el[r_el].raw_tcr;
 +                uint64_t tcr = env->cp15.tcr_el[r_el];
                  int addrtop, tbi;
                  tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
 --
-.20.1
+.25.1

-[PULL 03/24] hw/intc: fix heap-buffer-overflow in rxicu_realize()
+[PULL 11/15] target/arm: Honour VTCR_EL2 bits in Secure EL2
-From: Chen Qun <kuhn.chenqun@huawei.com>
+In regime_tcr() we return the appropriate TCR register for the
 translation regime.  For Secure EL2, we return the VSTCR_EL2 value,
 but in this translation regime some fields that control behaviour are
 in VTCR_EL2.  When this code was originally written (as the comment
 notes), QEMU didn't care about any of those fields, but we have since
 added support for features such as LPA2 which do need the values from
 those fields.
-When 'j = icu->nr_sense – 1', the 'j < icu->nr_sense' condition is true,
+Synthesize a TCR value by merging in the relevant VTCR_EL2 fields to
-then 'j = icu->nr_sense', the'icu->init_sense[j]' has out-of-bounds access.
+the VSTCR_EL2 value.
-The asan showed stack:
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1103
-ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000004d7d at pc 0x55852cd26a76 bp 0x7ffe39f26200 sp 0x7ffe39f261f0
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-READ of size 1 at 0x604000004d7d thread T0
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-    #0 0x55852cd26a75 in rxicu_realize ../hw/intc/rx_icu.c:311
+Message-id: 20220714132303.1287193-8-peter.maydell@linaro.org
-    #1 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886
+---
-    #2 0x55852cd4a32f in property_set_bool ../qom/object.c:2251
+ target/arm/cpu.h       | 19 +++++++++++++++++++
-    #3 0x55852cd4f9bb in object_property_set ../qom/object.c:1398
+ target/arm/internals.h | 22 +++++++++++++++++++---
-    #4 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28
+files changed, 38 insertions(+), 3 deletions(-)
     #5 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465
     #6 0x55852cbf0b27 in register_icu ../hw/rx/rx62n.c:156
     #7 0x55852cbf12a6 in rx62n_realize ../hw/rx/rx62n.c:261
     #8 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886
     #9 0x55852cd4a32f in property_set_bool ../qom/object.c:2251
     #10 0x55852cd4f9bb in object_property_set ../qom/object.c:1398
     #11 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28
     #12 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465
     #13 0x55852cbf1a85 in rx_gdbsim_init ../hw/rx/rx-gdbsim.c:109
     #14 0x55852cd22de0 in qemu_init ../softmmu/vl.c:4380
     #15 0x55852ca57088 in main ../softmmu/main.c:49
     #16 0x7feefafa5d42 in __libc_start_main (/lib64/libc.so.6+0x26d42)
-Add the 'ice->src[i].sense' initialize to the default value, and then
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 process init_sense array to identify which irqs should be level-triggered.
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Reported-by: Euler Robot <euler.robot@huawei.com>
 Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20201111141733.2358800-1-kuhn.chenqun@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/intc/rx_icu.c | 18 ++++++++----------
 file changed, 8 insertions(+), 10 deletions(-)
 diff --git a/hw/intc/rx_icu.c b/hw/intc/rx_icu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/rx_icu.c
+--- a/target/arm/cpu.h
-+++ b/hw/intc/rx_icu.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps icu_ops = {
+@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
- static void rxicu_realize(DeviceState *dev, Error **errp)
+ #define TTBCR_SH1    (1U << 28)
  #define TTBCR_EAE    (1U << 31)
 +FIELD(VTCR, T0SZ, 0, 6)
 +FIELD(VTCR, SL0, 6, 2)
 +FIELD(VTCR, IRGN0, 8, 2)
 +FIELD(VTCR, ORGN0, 10, 2)
 +FIELD(VTCR, SH0, 12, 2)
 +FIELD(VTCR, TG0, 14, 2)
 +FIELD(VTCR, PS, 16, 3)
 +FIELD(VTCR, VS, 19, 1)
 +FIELD(VTCR, HA, 21, 1)
 +FIELD(VTCR, HD, 22, 1)
 +FIELD(VTCR, HWU59, 25, 1)
 +FIELD(VTCR, HWU60, 26, 1)
 +FIELD(VTCR, HWU61, 27, 1)
 +FIELD(VTCR, HWU62, 28, 1)
 +FIELD(VTCR, NSW, 29, 1)
 +FIELD(VTCR, NSA, 30, 1)
 +FIELD(VTCR, DS, 32, 1)
 +FIELD(VTCR, SL2, 33, 1)
 +
  /* Bit definitions for ARMv8 SPSR (PSTATE) format.
   * Only these are valid when in AArch64 mode; in
   * AArch32 mode SPSRs are basically CPSR-format.
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
      return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
  }
 +/*
 + * These are the fields in VTCR_EL2 which affect both the Secure stage 2
 + * and the Non-Secure stage 2 translation regimes (and hence which are
 + * not present in VSTCR_EL2).
 + */
 +#define VTCR_SHARED_FIELD_MASK \
 +    (R_VTCR_IRGN0_MASK | R_VTCR_ORGN0_MASK | R_VTCR_SH0_MASK | \
 +     R_VTCR_PS_MASK | R_VTCR_VS_MASK | R_VTCR_HA_MASK | R_VTCR_HD_MASK | \
 +     R_VTCR_DS_MASK)
 +
  /* Return the value of the TCR controlling this translation regime */
  static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
  {
-     RXICUState *icu = RX_ICU(dev);
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
 -    int i, j;
 +    int i;
      if (icu->init_sense == NULL) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "rx_icu: trigger-level property must be set.");
          return;
      }
--    for (i = j = 0; i < NR_IRQS; i++) {
+     if (mmu_idx == ARMMMUIdx_Stage2_S) {
--        if (icu->init_sense[j] == i) {
+         /*
--            icu->src[i].sense = TRG_LEVEL;
+-         * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
--            if (j < icu->nr_sense) {
+-         * those are not currently used by QEMU, so just return VSTCR_EL2.
--                j++;
++         * Secure stage 2 shares fields from VTCR_EL2. We merge those
--            }
++         * in with the VSTCR_EL2 value to synthesize a single VTCR_EL2 format
--        } else {
++         * value so the callers don't need to special case this.
--            icu->src[i].sense = TRG_PEDGE;
++         *
--        }
++         * If a future architecture change defines bits in VSTCR_EL2 that
-+
++         * overlap with these VTCR_EL2 fields we may need to revisit this.
-+    for (i = 0; i < NR_IRQS; i++) {
+          */
-+        icu->src[i].sense = TRG_PEDGE;
+-        return env->cp15.vstcr_el2;
-+    }
++        uint64_t v = env->cp15.vstcr_el2 & ~VTCR_SHARED_FIELD_MASK;
-+    for (i = 0; i < icu->nr_sense; i++) {
++        v |= env->cp15.vtcr_el2 & VTCR_SHARED_FIELD_MASK;
-+        uint8_t irqno = icu->init_sense[i];
++        return v;
 +        icu->src[irqno].sense = TRG_LEVEL;
      }
-     icu->req_irq = -1;
+     return env->cp15.tcr_el[regime_el(env, mmu_idx)];
  }
 --
-.20.1
+.25.1

-[PULL 06/24] MAINTAINERS: Cover system/arm/nuvoton.rst with Nuvoton NPCM7xx
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201120154545.2504625-4-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- MAINTAINERS | 1 +
-file changed, 1 insertion(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: include/hw/*/npcm7xx*
- F: tests/qtest/npcm7xx*
- F: pc-bios/npcm7xx_bootrom.bin
- F: roms/vbootrom
-+F: docs/system/arm/nuvoton.rst
- nSeries
- M: Andrzej Zaborowski <balrogg@gmail.com>
---
-.20.1

-[PULL 13/24] docs/system/arm: Document the Sharp Zaurus SL-6000
+[PULL 12/15] hw/adc: Fix CONV bit in NPCM7XX ADC CON register
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Hao Wu <wuhaotsh@google.com>
-List the 'tosa' machine with the XScale-based PDAs models.
+The correct bit for the CONV bit in NPCM7XX ADC is bit 13. This patch
 fixes that in the module, and also lower the IRQ when the guest
 is done handling an interrupt event from the ADC module.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
-Message-id: 20201120173953.2539469-5-f4bug@amsat.org
+Reviewed-by: Patrick Venture<venture@google.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220714182836.89602-4-wuhaotsh@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/xscale.rst | 20 +++++++++++++-------
+ hw/adc/npcm7xx_adc.c           | 2 +-
-file changed, 13 insertions(+), 7 deletions(-)
+ tests/qtest/npcm7xx_adc-test.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/docs/system/arm/xscale.rst b/docs/system/arm/xscale.rst
+diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/xscale.rst
+--- a/hw/adc/npcm7xx_adc.c
-+++ b/docs/system/arm/xscale.rst
++++ b/hw/adc/npcm7xx_adc.c
@@ -XXX,XX +XXX,XX @@ REG32(NPCM7XX_ADC_DATA, 0x4)
  #define NPCM7XX_ADC_CON_INT     BIT(18)
  #define NPCM7XX_ADC_CON_EN      BIT(17)
  #define NPCM7XX_ADC_CON_RST     BIT(16)
 -#define NPCM7XX_ADC_CON_CONV    BIT(14)
 +#define NPCM7XX_ADC_CON_CONV    BIT(13)
  #define NPCM7XX_ADC_CON_DIV(rv) extract32(rv, 1, 8)
  #define NPCM7XX_ADC_MAX_RESULT      1023
 diff --git a/tests/qtest/npcm7xx_adc-test.c b/tests/qtest/npcm7xx_adc-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/npcm7xx_adc-test.c
 +++ b/tests/qtest/npcm7xx_adc-test.c
 @@ -XXX,XX +XXX,XX @@
--Sharp XScale-based PDA models (``akita``, ``borzoi``, ``spitz``, ``terrier``)
+ #define CON_INT     BIT(18)
--=============================================================================
+ #define CON_EN      BIT(17)
-+Sharp XScale-based PDA models (``akita``, ``borzoi``, ``spitz``, ``terrier``, ``tosa``)
+ #define CON_RST     BIT(16)
-+=======================================================================================
+-#define CON_CONV    BIT(14)
++#define CON_CONV    BIT(13)
--The XScale-based clamshell PDA models (\"Spitz\", \"Akita\", \"Borzoi\"
+ #define CON_DIV(rv) extract32(rv, 1, 8)
--and \"Terrier\") emulation includes the following peripherals:
-+The Sharp Zaurus are PDAs based on XScale, able to run Linux ('SL series').
+ #define FST_RDST    BIT(1)
 --  Intel PXA270 System-on-chip (ARMv5TE core)
 +The SL-6000 (\"Tosa\"), released in 2005, uses a PXA255 System-on-chip.
 --  NAND Flash memory
 +The SL-C3000 (\"Spitz\"), SL-C1000 (\"Akita\"), SL-C3100 (\"Borzoi\") and
 +SL-C3200 (\"Terrier\") use a PXA270.
 +
 +The clamshell PDA models emulation includes the following peripherals:
 +
 +-  Intel PXA255/PXA270 System-on-chip (ARMv5TE core)
 +
 +-  NAND Flash memory - not in \"Tosa\"
  -  IBM/Hitachi DSCM microdrive in a PXA PCMCIA slot - not in \"Akita\"
 --  On-chip OHCI USB controller
 +-  On-chip OHCI USB controller - not in \"Tosa\"
  -  On-chip LCD controller
 --
-.20.1
+.25.1

-[PULL 07/24] MAINTAINERS: Fix system/arm/orangepi.rst path
+[PULL 13/15] hw/adc: Make adci[*] R/W in NPCM7XX ADC
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Hao Wu <wuhaotsh@google.com>
-Fixes: 0553ef42571 ("docs: add Orange Pi PC document")
+Our sensor test requires both reading and writing from a sensor's
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+QOM property. So we need to make the input of ADC module R/W instead
-Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>
+of write only for that to work.
-Message-id: 20201120154545.2504625-5-f4bug@amsat.org
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Reviewed-by: Titus Rwantare <titusr@google.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220714182836.89602-5-wuhaotsh@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 2 +-
+ hw/adc/npcm7xx_adc.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/adc/npcm7xx_adc.c
-+++ b/MAINTAINERS
++++ b/hw/adc/npcm7xx_adc.c
-@@ -XXX,XX +XXX,XX @@ S: Maintained
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_adc_init(Object *obj)
- F: hw/*/allwinner-h3*
- F: include/hw/*/allwinner-h3*
+     for (i = 0; i < NPCM7XX_ADC_NUM_INPUTS; ++i) {
- F: hw/arm/orangepi.c
+         object_property_add_uint32_ptr(obj, "adci[*]",
--F: docs/system/orangepi.rst
+-                &s->adci[i], OBJ_PROP_FLAG_WRITE);
-+F: docs/system/arm/orangepi.rst
++                &s->adci[i], OBJ_PROP_FLAG_READWRITE);
+     }
- ARM PrimeCell and CMSDK devices
+     object_property_add_uint32_ptr(obj, "vref",
- M: Peter Maydell <peter.maydell@linaro.org>
+             &s->vref, OBJ_PROP_FLAG_WRITE);
 --
-.20.1
+.25.1

-[PULL 08/24] MAINTAINERS: Cover system/arm/sbsa.rst with SBSA-REF machine
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201120154545.2504625-6-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- MAINTAINERS | 1 +
-file changed, 1 insertion(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ R: Leif Lindholm <leif@nuviainc.com>
- L: qemu-arm@nongnu.org
- S: Maintained
- F: hw/arm/sbsa-ref.c
-+F: docs/system/arm/sbsa.rst
- Sharp SL-5500 (Collie) PDA
- M: Peter Maydell <peter.maydell@linaro.org>
---
-.20.1

-[PULL 09/24] MAINTAINERS: Cover system/arm/sx1.rst with OMAP machines
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201120154545.2504625-7-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- MAINTAINERS | 1 +
-file changed, 1 insertion(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
- S: Maintained
- F: hw/*/omap*
- F: include/hw/arm/omap.h
-+F: docs/system/arm/sx1.rst
- IPack
- M: Alberto Garcia <berto@igalia.com>
---
-.20.1

-[PULL 10/24] docs/system: Deprecate raspi2/raspi3 machine aliases
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Since commit aa35ec2213b ("hw/arm/raspi: Use more specific
-machine names") the raspi2/raspi3 machines have been renamed
-as raspi2b/raspi3b.
-Note, rather than the raspi3b, the raspi3ap introduced in
-commit 5be94252d34 ("hw/arm/raspi: Add the Raspberry Pi 3
-model A+") is a closer match to what QEMU models, but only
-provides 512 MB of RAM.
-As more Raspberry Pi 2/3 models are emulated, in order
-to avoid confusion, deprecate the raspi2/raspi3 machine
-aliases.
-ACKed-by: Peter Krempa <pkrempa@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201120173953.2539469-2-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/deprecated.rst | 7 +++++++
-file changed, 7 insertions(+)
-diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/deprecated.rst
-+++ b/docs/system/deprecated.rst
-@@ -XXX,XX +XXX,XX @@ This machine has been renamed ``fuloong2e``.
- These machine types are very old and likely can not be used for live migration
- from old QEMU versions anymore. A newer machine type should be used instead.
-+Raspberry Pi ``raspi2`` and ``raspi3`` machines (since 5.2)
-+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
-+
-+The Raspberry Pi machines come in various models (A, A+, B, B+). To be able
-+to distinguish which model QEMU is implementing, the ``raspi2`` and ``raspi3``
-+machines have been renamed ``raspi2b`` and ``raspi3b``.
-+
- Device options
- --------------
---
-.20.1

-[PULL 18/24] docs: Move virtio-pmem.rst into the system manual
+[PULL 14/15] target/arm: Don't set syndrome ISS for loads and stores with writeback
+The architecture requires that for faults on loads and stores which
+do writeback, the syndrome information does not have the ISS
+instruction syndrome information (i.e. ISV is 0).  We got this wrong
+for the load and store instructions covered by disas_ldst_reg_imm9().
+Calculate iss_valid correctly so that if the insn is a writeback one
+it is false.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1057
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220715123323.1550983-1-peter.maydell@linaro.org
 ---
- docs/system/index.rst             | 1 +
+ target/arm/translate-a64.c | 4 +++-
- docs/{ => system}/virtio-pmem.rst | 0
+file changed, 3 insertions(+), 1 deletion(-)
 files changed, 1 insertion(+)
  rename docs/{ => system}/virtio-pmem.rst (100%)
-diff --git a/docs/system/index.rst b/docs/system/index.rst
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/index.rst
+--- a/target/arm/translate-a64.c
-+++ b/docs/system/index.rst
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ Contents:
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
-    gdb
+     bool is_store = false;
-    managed-startup
+     bool is_extended = false;
-    cpu-hotplug
+     bool is_unpriv = (idx == 2);
-+   virtio-pmem
+-    bool iss_valid = !is_vector;
-    targets
++    bool iss_valid;
-    security
+     bool post_index;
-    deprecated
+     bool writeback;
-diff --git a/docs/virtio-pmem.rst b/docs/system/virtio-pmem.rst
+     int memidx;
-similarity index 100%
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
-rename from docs/virtio-pmem.rst
+         g_assert_not_reached();
-rename to docs/system/virtio-pmem.rst
+     }
 +    iss_valid = !is_vector && !writeback;
 +
      if (rn == 31) {
          gen_check_sp_alignment(s);
      }
 --
-.20.1
+.25.1

-[PULL 11/24] docs/system/arm: Document the various raspi boards
+[PULL 15/15] Align Raspberry Pi DMA interrupts with Linux DTS
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Andrey Makarov <ph.makarov@gmail.com>
-Document the following Raspberry Pi models:
+There is nothing in the specs on DMA engine interrupt lines: it should have
+been in the "BCM2835 ARM Peripherals" datasheet but the appropriate
- - raspi0               Raspberry Pi Zero (revision 1.2)
+"ARM peripherals interrupt table" (p.113) is nearly empty.
- - raspi1ap             Raspberry Pi A+ (revision 1.1)
- - raspi2b              Raspberry Pi 2B (revision 1.1)
+All Raspberry Pi models 1-3 (based on bcm2835) have
- - raspi3ap             Raspberry Pi 3A+ (revision 1.0)
+Linux device tree (arch/arm/boot/dts/bcm2835-common.dtsi +25):
- - raspi3b              Raspberry Pi 3B (revision 1.2)
+    /* dma channel 11-14 share one irq */
 This information is repeated in the driver code
 (drivers/dma/bcm2835-dma.c +1344):
     /*
      * in case of channel >= 11
      * use the 11th interrupt and that is shared
      */
 In this patch channels 0--10 and 11--14 are handled separately.
 Signed-off-by: Andrey Makarov <andrey.makarov@auriga.com>
 Message-id: 20220716113210.349153-1-andrey.makarov@auriga.com
 [PMM: fixed checkpatch nits]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201120173953.2539469-3-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/raspi.rst  | 43 ++++++++++++++++++++++++++++++++++++++
+ include/hw/arm/bcm2835_peripherals.h |   2 +
- docs/system/target-arm.rst |  1 +
+ hw/arm/bcm2835_peripherals.c         |  26 +++++-
- MAINTAINERS                |  1 +
+ tests/qtest/bcm2835-dma-test.c       | 118 +++++++++++++++++++++++++++
-files changed, 45 insertions(+)
+ tests/qtest/meson.build              |   3 +-
- create mode 100644 docs/system/arm/raspi.rst
+files changed, 147 insertions(+), 2 deletions(-)
+ create mode 100644 tests/qtest/bcm2835-dma-test.c
-diff --git a/docs/system/arm/raspi.rst b/docs/system/arm/raspi.rst
 diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/bcm2835_peripherals.h
 +++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/char/bcm2835_aux.h"
  #include "hw/display/bcm2835_fb.h"
  #include "hw/dma/bcm2835_dma.h"
 +#include "hw/or-irq.h"
  #include "hw/intc/bcm2835_ic.h"
  #include "hw/misc/bcm2835_property.h"
  #include "hw/misc/bcm2835_rng.h"
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
      BCM2835AuxState aux;
      BCM2835FBState fb;
      BCM2835DMAState dma;
 +    qemu_or_irq orgated_dma_irq;
      BCM2835ICState ic;
      BCM2835PropertyState property;
      BCM2835RngState rng;
 diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2835_peripherals.c
 +++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@
  /* Capabilities for SD controller: no DMA, high-speed, default clocks etc. */
  #define BCM2835_SDHC_CAPAREG 0x52134b4
 +/*
 + * According to Linux driver & DTS, dma channels 0--10 have separate IRQ,
 + * while channels 11--14 share one IRQ:
 + */
 +#define SEPARATE_DMA_IRQ_MAX 10
 +#define ORGATED_DMA_IRQ_COUNT 4
 +
  static void create_unimp(BCM2835PeripheralState *ps,
                           UnimplementedDeviceState *uds,
                           const char *name, hwaddr ofs, hwaddr size)
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
      /* DMA Channels */
      object_initialize_child(obj, "dma", &s->dma, TYPE_BCM2835_DMA);
 +    object_initialize_child(obj, "orgated-dma-irq",
 +                            &s->orgated_dma_irq, TYPE_OR_IRQ);
 +    object_property_set_int(OBJECT(&s->orgated_dma_irq), "num-lines",
 +                            ORGATED_DMA_IRQ_COUNT, &error_abort);
 +
      object_property_add_const_link(OBJECT(&s->dma), "dma-mr",
                                     OBJECT(&s->gpu_bus_mr));
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
      memory_region_add_subregion(&s->peri_mr, DMA15_OFFSET,
                  sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dma), 1));
 -    for (n = 0; n <= 12; n++) {
 +    for (n = 0; n <= SEPARATE_DMA_IRQ_MAX; n++) {
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma), n,
                             qdev_get_gpio_in_named(DEVICE(&s->ic),
                                                    BCM2835_IC_GPU_IRQ,
                                                    INTERRUPT_DMA0 + n));
      }
 +    if (!qdev_realize(DEVICE(&s->orgated_dma_irq), NULL, errp)) {
 +        return;
 +    }
 +    for (n = 0; n < ORGATED_DMA_IRQ_COUNT; n++) {
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma),
 +                           SEPARATE_DMA_IRQ_MAX + 1 + n,
 +                           qdev_get_gpio_in(DEVICE(&s->orgated_dma_irq), n));
 +    }
 +    qdev_connect_gpio_out(DEVICE(&s->orgated_dma_irq), 0,
 +                          qdev_get_gpio_in_named(DEVICE(&s->ic),
 +                              BCM2835_IC_GPU_IRQ,
 +                              INTERRUPT_DMA0 + SEPARATE_DMA_IRQ_MAX + 1));
      /* THERMAL */
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->thermal), errp)) {
 diff --git a/tests/qtest/bcm2835-dma-test.c b/tests/qtest/bcm2835-dma-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/docs/system/arm/raspi.rst
++++ b/tests/qtest/bcm2835-dma-test.c
 @@ -XXX,XX +XXX,XX @@
-+Raspberry Pi boards (``raspi0``, ``raspi1ap``, ``raspi2b``, ``raspi3ap``, ``raspi3b``)
++/*
-+======================================================================================
++ * QTest testcase for BCM283x DMA engine (on Raspberry Pi 3)
-+
++ * and its interrupts coming to Interrupt Controller.
-+
++ *
-+QEMU provides models of the following Raspberry Pi boards:
++ * Copyright (c) 2022 Auriga LLC
-+
++ *
-+``raspi0`` and ``raspi1ap``
++ * SPDX-License-Identifier: GPL-2.0-or-later
-+  ARM1176JZF-S core, 512 MiB of RAM
++ */
-+``raspi2b``
++
-+  Cortex-A7 (4 cores), 1 GiB of RAM
++#include "qemu/osdep.h"
-+``raspi3ap``
++#include "libqtest-single.h"
-+  Cortex-A53 (4 cores), 512 MiB of RAM
++
-+``raspi3b``
++/* Offsets in raspi3b platform: */
-+  Cortex-A53 (4 cores), 1 GiB of RAM
++#define RASPI3_DMA_BASE 0x3f007000
-+
++#define RASPI3_IC_BASE  0x3f00b200
 +
-+Implemented devices
++/* Used register/fields definitions */
-+-------------------
++
-+
++/* DMA engine registers: */
-+ * ARM1176JZF-S, Cortex-A7 or Cortex-A53 CPU
++#define BCM2708_DMA_CS         0
-+ * Interrupt controller
++#define BCM2708_DMA_ACTIVE     (1 << 0)
-+ * DMA controller
++#define BCM2708_DMA_INT        (1 << 2)
-+ * Clock and reset controller (CPRMAN)
++
-+ * System Timer
++#define BCM2708_DMA_ADDR       0x04
-+ * GPIO controller
++
-+ * Serial ports (BCM2835 AUX - 16550 based - and PL011)
++#define BCM2708_DMA_INT_STATUS 0xfe0
-+ * Random Number Generator (RNG)
++
-+ * Frame Buffer
++/* DMA Trasfer Info fields: */
-+ * USB host (USBH)
++#define BCM2708_DMA_INT_EN     (1 << 0)
-+ * GPIO controller
++#define BCM2708_DMA_D_INC      (1 << 4)
-+ * SD/MMC host controller
++#define BCM2708_DMA_S_INC      (1 << 8)
-+ * SoC thermal sensor
++
-+ * USB2 host controller (DWC2 and MPHI)
++/* Interrupt controller registers: */
-+ * MailBox controller (MBOX)
++#define IRQ_PENDING_BASIC      0x00
-+ * VideoCore firmware (property)
++#define IRQ_GPU_PENDING1_AGGR  (1 << 8)
-+
++#define IRQ_PENDING_1          0x04
-+
++#define IRQ_ENABLE_1           0x10
-+Missing devices
++
-+---------------
++/* Data for the test: */
-+
++#define SCB_ADDR   256
-+ * Peripheral SPI controller (SPI)
++#define S_ADDR     32
-+ * Analog to Digital Converter (ADC)
++#define D_ADDR     64
-+ * Pulse Width Modulation (PWM)
++#define TXFR_LEN   32
-diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
++const uint32_t check_data = 0x12345678;
 +
 +static void bcm2835_dma_test_interrupt(int dma_c, int irq_line)
 +{
 +    uint64_t dma_base = RASPI3_DMA_BASE + dma_c * 0x100;
 +    int gpu_irq_line = 16 + irq_line;
 +
 +    /* Check that interrupts are silent by default: */
 +    writel(RASPI3_IC_BASE + IRQ_ENABLE_1, 1 << gpu_irq_line);
 +    int isr = readl(dma_base + BCM2708_DMA_INT_STATUS);
 +    g_assert_cmpint(isr, ==, 0);
 +    uint32_t reg0 = readl(dma_base + BCM2708_DMA_CS);
 +    g_assert_cmpint(reg0, ==, 0);
 +    uint32_t ic_pending = readl(RASPI3_IC_BASE + IRQ_PENDING_BASIC);
 +    g_assert_cmpint(ic_pending, ==, 0);
 +    uint32_t gpu_pending1 = readl(RASPI3_IC_BASE + IRQ_PENDING_1);
 +    g_assert_cmpint(gpu_pending1, ==, 0);
 +
 +    /* Prepare Control Block: */
 +    writel(SCB_ADDR + 0, BCM2708_DMA_S_INC | BCM2708_DMA_D_INC |
 +                         BCM2708_DMA_INT_EN); /* transfer info */
 +    writel(SCB_ADDR + 4, S_ADDR);             /* source address */
 +    writel(SCB_ADDR + 8, D_ADDR);             /* destination address */
 +    writel(SCB_ADDR + 12, TXFR_LEN);          /* transfer length */
 +    writel(dma_base + BCM2708_DMA_ADDR, SCB_ADDR);
 +
 +    writel(S_ADDR, check_data);
 +    for (int word = S_ADDR + 4; word < S_ADDR + TXFR_LEN; word += 4) {
 +        writel(word, ~check_data);
 +    }
 +    /* Perform the transfer: */
 +    writel(dma_base + BCM2708_DMA_CS, BCM2708_DMA_ACTIVE);
 +
 +    /* Check that destination == source: */
 +    uint32_t data = readl(D_ADDR);
 +    g_assert_cmpint(data, ==, check_data);
 +    for (int word = D_ADDR + 4; word < D_ADDR + TXFR_LEN; word += 4) {
 +        data = readl(word);
 +        g_assert_cmpint(data, ==, ~check_data);
 +    }
 +
 +    /* Check that interrupt status is set both in DMA and IC controllers: */
 +    isr = readl(RASPI3_DMA_BASE + BCM2708_DMA_INT_STATUS);
 +    g_assert_cmpint(isr, ==, 1 << dma_c);
 +
 +    ic_pending = readl(RASPI3_IC_BASE + IRQ_PENDING_BASIC);
 +    g_assert_cmpint(ic_pending, ==, IRQ_GPU_PENDING1_AGGR);
 +
 +    gpu_pending1 = readl(RASPI3_IC_BASE + IRQ_PENDING_1);
 +    g_assert_cmpint(gpu_pending1, ==, 1 << gpu_irq_line);
 +
 +    /* Clean up, clear interrupt: */
 +    writel(dma_base + BCM2708_DMA_CS, BCM2708_DMA_INT);
 +}
 +
 +static void bcm2835_dma_test_interrupts(void)
 +{
 +    /* DMA engines 0--10 have separate IRQ lines, 11--14 - only one: */
 +    bcm2835_dma_test_interrupt(0,  0);
 +    bcm2835_dma_test_interrupt(10, 10);
 +    bcm2835_dma_test_interrupt(11, 11);
 +    bcm2835_dma_test_interrupt(14, 11);
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    int ret;
 +    g_test_init(&argc, &argv, NULL);
 +    qtest_add_func("/bcm2835/dma/test_interrupts",
 +                   bcm2835_dma_test_interrupts);
 +    qtest_start("-machine raspi3b");
 +    ret = g_test_run();
 +    qtest_end();
 +    return ret;
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/target-arm.rst
+--- a/tests/qtest/meson.build
-+++ b/docs/system/target-arm.rst
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
+@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
-    arm/nuvoton
+   ['arm-cpu-features',
-    arm/orangepi
+    'numa-test',
-    arm/palm
+    'boot-serial-test',
-+   arm/raspi
+-   'migration-test']
-    arm/xscale
++   'migration-test',
-    arm/collie
++   'bcm2835-dma-test']
-    arm/sx1
-diff --git a/MAINTAINERS b/MAINTAINERS
+ qtests_s390x = \
-index XXXXXXX..XXXXXXX 100644
+   (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +                 \
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/raspi_platform.h
  F: hw/*/bcm283*
  F: include/hw/arm/raspi*
  F: include/hw/*/bcm283*
 +F: docs/system/arm/raspi.rst
  Real View
  M: Peter Maydell <peter.maydell@linaro.org>
 --
-.20.1
+.25.1

-[PULL 12/24] docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Document the 3 front LEDs modeled on the OpenPOWER Witherspoon BMC
-(see commit 7cfbde5ea1c "hw/arm/aspeed: Add the 3 front LEDs drived
-by the PCA9552 #1").
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201120173953.2539469-4-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/aspeed.rst | 1 +
-file changed, 1 insertion(+)
-diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/aspeed.rst
-+++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ Supported devices
-  * GPIO Controller (Master only)
-  * UART
-  * Ethernet controllers
-+ * Front LEDs (PCA9552 on I2C bus)
- Missing devices
---
-.20.1

-[PULL 14/24] target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0
+Deleted patch
-The semihosting SYS_HEAPINFO call is supposed to return an array
-of four guest addresses:
- * base of heap memory
- * limit of heap memory
- * base of stack memory
- * limit of stack memory
-Some semihosting programs (including those compiled to use the
-'newlib' embedded C library) use this call to work out where they
-should initialize themselves to.
-QEMU's implementation when in system emulation mode is very
-simplistic: we say that the heap starts halfway into RAM and
-continues to the end of RAM, and the stack starts at the top of RAM
-and works down to the bottom.  Unfortunately the code assumes that
-the base address of RAM is at address 0, so on boards like 'virt'
-where this is not true the addresses returned will all be wrong and
-the guest application will usually crash.
-Conveniently since all Arm boards call arm_load_kernel() we have the
-base address of the main RAM block in the arm_boot_info struct which
-is accessible via the CPU object.  Use this to return sensible values
-from SYS_HEAPINFO.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20201119092346.32356-1-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 12 ++++++++----
-file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@
- #else
- #include "exec/gdbstub.h"
- #include "qemu/cutils.h"
-+#include "hw/arm/boot.h"
- #endif
- #define TARGET_SYS_OPEN        0x01
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             int i;
- #ifdef CONFIG_USER_ONLY
-             TaskState *ts = cs->opaque;
-+#else
-+            const struct arm_boot_info *info = env->boot_info;
-+            target_ulong rambase = info->loader_start;
- #endif
-             GET_ARG(0);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
- #else
-             limit = ram_size;
-             /* TODO: Make this use the limit of the loaded application.  */
--            retvals[0] = limit / 2;
--            retvals[1] = limit;
--            retvals[2] = limit; /* Stack base */
--            retvals[3] = 0; /* Stack limit.  */
-+            retvals[0] = rambase + limit / 2;
-+            retvals[1] = rambase + limit;
-+            retvals[2] = rambase + limit; /* Stack base */
-+            retvals[3] = rambase; /* Stack limit.  */
- #endif
-             for (i = 0; i < ARRAY_SIZE(retvals); i++) {
---
-.20.1

-[PULL 16/24] docs: Move virtio-net-failover.rst into the system manual
+Deleted patch
-The virtio-net-failover documentation is currently orphan and
-not included in any manual; move it into the system manual,
-immediately following the general network emulation section.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- docs/system/index.rst                     | 1 +
- docs/{ => system}/virtio-net-failover.rst | 0
-files changed, 1 insertion(+)
- rename docs/{ => system}/virtio-net-failover.rst (100%)
-diff --git a/docs/system/index.rst b/docs/system/index.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/index.rst
-+++ b/docs/system/index.rst
-@@ -XXX,XX +XXX,XX @@ Contents:
-    monitor
-    images
-    net
-+   virtio-net-failover
-    usb
-    ivshmem
-    linuxboot
-diff --git a/docs/virtio-net-failover.rst b/docs/system/virtio-net-failover.rst
-similarity index 100%
-rename from docs/virtio-net-failover.rst
-rename to docs/system/virtio-net-failover.rst
---
-.20.1

-[PULL 17/24] docs: Move cpu-hotplug.rst into the system manual
+Deleted patch
-The cpu-hotplug.rst documentation is currently orphan and not
-included in any manual; move it into the system manual.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- docs/{ => system}/cpu-hotplug.rst | 0
- docs/system/index.rst             | 1 +
-files changed, 1 insertion(+)
- rename docs/{ => system}/cpu-hotplug.rst (100%)
-diff --git a/docs/cpu-hotplug.rst b/docs/system/cpu-hotplug.rst
-similarity index 100%
-rename from docs/cpu-hotplug.rst
-rename to docs/system/cpu-hotplug.rst
-diff --git a/docs/system/index.rst b/docs/system/index.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/index.rst
-+++ b/docs/system/index.rst
-@@ -XXX,XX +XXX,XX @@ Contents:
-    tls
-    gdb
-    managed-startup
-+   cpu-hotplug
-    targets
-    security
-    deprecated
---
-.20.1

A big pullreq by number of patches, but most of them are just docs
updates or MAINTAINERS file fixes. The actual code changes are pretty
minimal bugfixes.

thanks
-- PMM

The following changes since commit 8cc30eb1400fc01f2b139cdd3dc524f8b84dbe07:

Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20201122' into staging (2020-11-22 15:02:52 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201123

for you to fetch changes up to c6ff78563ad2971f289168c7cae6ecb0b4359516:

docs/system/pr-manager.rst: Fix minor docs nits (2020-11-23 11:10:04 +0000)

----------------------------------------------------------------
target-arm queue:
 * incorporate 'orphan' rST docs into manuals
 * linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpoints
 * target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0
 * document raspi boards and tosa
 * docs/system: Deprecate raspi2/raspi3 machine aliases
 * docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs
 * MAINTAINERS: add lines for docs files for Arm boards
 * hw/intc: fix heap-buffer-overflow in rxicu_realize()
 * hw/arm: Fix bad print format specifiers
 * target/arm: fix stage 2 page-walks in 32-bit emulation

----------------------------------------------------------------
AlexChen (1):
      hw/arm: Fix bad print format specifiers

Chen Qun (1):
      hw/intc: fix heap-buffer-overflow in rxicu_realize()

Peter Maydell (11):
      target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0
      linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpoints
      docs: Move virtio-net-failover.rst into the system manual
      docs: Move cpu-hotplug.rst into the system manual
      docs: Move virtio-pmem.rst into the system manual
      docs/system/virtio-pmem.rst: Fix minor style issues
      docs: Split out 'pc' machine model docs into their own file
      docs: Move microvm.rst into the system manual
      docs: Move pr-manager.rst into the system manual
      docs: Split qemu-pr-helper documentation into tools manual
      docs/system/pr-manager.rst: Fix minor docs nits

Philippe Mathieu-Daudé (10):
      MAINTAINERS: Cover system/arm/cpu-features.rst with ARM TCG CPUs
      MAINTAINERS: Cover system/arm/aspeed.rst with ASPEED BMC machines
      MAINTAINERS: Cover system/arm/nuvoton.rst with Nuvoton NPCM7xx
      MAINTAINERS: Fix system/arm/orangepi.rst path
      MAINTAINERS: Cover system/arm/sbsa.rst with SBSA-REF machine
      MAINTAINERS: Cover system/arm/sx1.rst with OMAP machines
      docs/system: Deprecate raspi2/raspi3 machine aliases
      docs/system/arm: Document the various raspi boards
      docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs
      docs/system/arm: Document the Sharp Zaurus SL-6000

Rémi Denis-Courmont (1):
      target/arm: fix stage 2 page-walks in 32-bit emulation

docs/meson.build                          |  1 +
 docs/system/arm/aspeed.rst                |  1 +
 docs/system/arm/raspi.rst                 | 43 +++++++++++++++
 docs/system/arm/xscale.rst                | 20 ++++---
 docs/{ => system}/cpu-hotplug.rst         |  0
 docs/system/deprecated.rst                |  7 +++
 docs/{ => system/i386}/microvm.rst        |  5 +-
 docs/system/i386/pc.rst                   |  7 +++
 docs/system/index.rst                     |  4 ++
 docs/{ => system}/pr-manager.rst          | 44 +++------------
 docs/system/target-arm.rst                |  1 +
 docs/system/target-i386.rst               | 19 +++++--
 docs/{ => system}/virtio-net-failover.rst |  0
 docs/system/virtio-pmem.rst               | 76 ++++++++++++++++++++++++++
 docs/tools/conf.py                        |  2 +
 docs/tools/index.rst                      |  1 +
 docs/tools/qemu-pr-helper.rst             | 90 +++++++++++++++++++++++++++++++
 docs/virtio-pmem.rst                      | 76 --------------------------
 hw/arm/pxa2xx.c                           |  2 +-
 hw/arm/spitz.c                            |  2 +-
 hw/arm/tosa.c                             |  2 +-
 hw/intc/rx_icu.c                          | 18 +++----
 linux-user/arm/cpu_loop.c                 | 28 ++++++++++
 target/arm/arm-semi.c                     | 12 +++--
 target/arm/helper.c                       |  4 +-
 MAINTAINERS                               |  8 ++-
 26 files changed, 326 insertions(+), 147 deletions(-)
 create mode 100644 docs/system/arm/raspi.rst
 rename docs/{ => system}/cpu-hotplug.rst (100%)
 rename docs/{ => system/i386}/microvm.rst (98%)
 create mode 100644 docs/system/i386/pc.rst
 rename docs/{ => system}/pr-manager.rst (68%)
 rename docs/{ => system}/virtio-net-failover.rst (100%)
 create mode 100644 docs/system/virtio-pmem.rst
 create mode 100644 docs/tools/qemu-pr-helper.rst
 delete mode 100644 docs/virtio-pmem.rst

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Using a target unsigned long would limit the Input Address to a LPAE
page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay
for stage 1 or on AArch64, but it is insufficient for stage 2 on
AArch32. In that later case, the Input Address can have up to 40 bits.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201118150414.18360-1-remi@remlab.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 
 #ifndef CONFIG_USER_ONLY
 
-static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                bool s1_is_el0,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
  * @fi: set to fault info if the translation fails
  * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
  */
-static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                bool s1_is_el0,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
-- 
2.20.1

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%i" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 5F9FD78B.8000300@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/pxa2xx.c | 2 +-
 hw/arm/spitz.c  | 2 +-
 hw/arm/tosa.c   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_ssp_write(void *opaque, hwaddr addr,
         if (value & SSCR0_MOD)
             printf("%s: Attempt to use network mode\n", __func__);
         if (s->enable && SSCR0_DSS(value) < 4)
-            printf("%s: Wrong data size: %i bits\n", __func__,
+            printf("%s: Wrong data size: %u bits\n", __func__,
                             SSCR0_DSS(value));
         if (!(value & SSCR0_SSE)) {
             s->sssr = 0;
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@ struct SpitzLCDTG {
 static void spitz_bl_update(SpitzLCDTG *s)
 {
     if (s->bl_power && s->bl_intensity)
-        zaurus_printf("LCD Backlight now at %i/63\n", s->bl_intensity);
+        zaurus_printf("LCD Backlight now at %u/63\n", s->bl_intensity);
     else
         zaurus_printf("LCD Backlight now off\n");
 }
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
 
 static uint32_t tosa_ssp_tansfer(SSISlave *dev, uint32_t value)
 {
-    fprintf(stderr, "TG: %d %02x\n", value >> 5, value & 0x1f);
+    fprintf(stderr, "TG: %u %02x\n", value >> 5, value & 0x1f);
     return 0;
 }
 
-- 
2.20.1

From: Chen Qun <kuhn.chenqun@huawei.com>

When 'j = icu->nr_sense – 1', the 'j < icu->nr_sense' condition is true,
then 'j = icu->nr_sense', the'icu->init_sense[j]' has out-of-bounds access.

The asan showed stack:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000004d7d at pc 0x55852cd26a76 bp 0x7ffe39f26200 sp 0x7ffe39f261f0
READ of size 1 at 0x604000004d7d thread T0
    #0 0x55852cd26a75 in rxicu_realize ../hw/intc/rx_icu.c:311
    #1 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886
    #2 0x55852cd4a32f in property_set_bool ../qom/object.c:2251
    #3 0x55852cd4f9bb in object_property_set ../qom/object.c:1398
    #4 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28
    #5 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465
    #6 0x55852cbf0b27 in register_icu ../hw/rx/rx62n.c:156
    #7 0x55852cbf12a6 in rx62n_realize ../hw/rx/rx62n.c:261
    #8 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886
    #9 0x55852cd4a32f in property_set_bool ../qom/object.c:2251
    #10 0x55852cd4f9bb in object_property_set ../qom/object.c:1398
    #11 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28
    #12 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465
    #13 0x55852cbf1a85 in rx_gdbsim_init ../hw/rx/rx-gdbsim.c:109
    #14 0x55852cd22de0 in qemu_init ../softmmu/vl.c:4380
    #15 0x55852ca57088 in main ../softmmu/main.c:49
    #16 0x7feefafa5d42 in __libc_start_main (/lib64/libc.so.6+0x26d42)

Add the 'ice->src[i].sense' initialize to the default value, and then
process init_sense array to identify which irqs should be level-triggered.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20201111141733.2358800-1-kuhn.chenqun@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/rx_icu.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/intc/rx_icu.c b/hw/intc/rx_icu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/rx_icu.c
+++ b/hw/intc/rx_icu.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps icu_ops = {
 static void rxicu_realize(DeviceState *dev, Error **errp)
 {
     RXICUState *icu = RX_ICU(dev);
-    int i, j;
+    int i;
 
     if (icu->init_sense == NULL) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "rx_icu: trigger-level property must be set.");
         return;
     }
-    for (i = j = 0; i < NR_IRQS; i++) {
-        if (icu->init_sense[j] == i) {
-            icu->src[i].sense = TRG_LEVEL;
-            if (j < icu->nr_sense) {
-                j++;
-            }
-        } else {
-            icu->src[i].sense = TRG_PEDGE;
-        }
+
+    for (i = 0; i < NR_IRQS; i++) {
+        icu->src[i].sense = TRG_PEDGE;
+    }
+    for (i = 0; i < icu->nr_sense; i++) {
+        uint8_t irqno = icu->init_sense[i];
+        icu->src[irqno].sense = TRG_LEVEL;
     }
     icu->req_irq = -1;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Since commit aa35ec2213b ("hw/arm/raspi: Use more specific
machine names") the raspi2/raspi3 machines have been renamed
as raspi2b/raspi3b.

Note, rather than the raspi3b, the raspi3ap introduced in
commit 5be94252d34 ("hw/arm/raspi: Add the Raspberry Pi 3
model A+") is a closer match to what QEMU models, but only
provides 512 MB of RAM.

As more Raspberry Pi 2/3 models are emulated, in order
to avoid confusion, deprecate the raspi2/raspi3 machine
aliases.

ACKed-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201120173953.2539469-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/deprecated.rst | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -XXX,XX +XXX,XX @@ This machine has been renamed ``fuloong2e``.
 These machine types are very old and likely can not be used for live migration
 from old QEMU versions anymore. A newer machine type should be used instead.
 
+Raspberry Pi ``raspi2`` and ``raspi3`` machines (since 5.2)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The Raspberry Pi machines come in various models (A, A+, B, B+). To be able
+to distinguish which model QEMU is implementing, the ``raspi2`` and ``raspi3``
+machines have been renamed ``raspi2b`` and ``raspi3b``.
+
 Device options
 --------------
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Document the following Raspberry Pi models:

- raspi0               Raspberry Pi Zero (revision 1.2)
 - raspi1ap             Raspberry Pi A+ (revision 1.1)
 - raspi2b              Raspberry Pi 2B (revision 1.1)
 - raspi3ap             Raspberry Pi 3A+ (revision 1.0)
 - raspi3b              Raspberry Pi 3B (revision 1.2)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201120173953.2539469-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/raspi.rst  | 43 ++++++++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 MAINTAINERS                |  1 +
 3 files changed, 45 insertions(+)
 create mode 100644 docs/system/arm/raspi.rst

diff --git a/docs/system/arm/raspi.rst b/docs/system/arm/raspi.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/raspi.rst
@@ -XXX,XX +XXX,XX @@
+Raspberry Pi boards (``raspi0``, ``raspi1ap``, ``raspi2b``, ``raspi3ap``, ``raspi3b``)
+======================================================================================
+
+
+QEMU provides models of the following Raspberry Pi boards:
+
+``raspi0`` and ``raspi1ap``
+  ARM1176JZF-S core, 512 MiB of RAM
+``raspi2b``
+  Cortex-A7 (4 cores), 1 GiB of RAM
+``raspi3ap``
+  Cortex-A53 (4 cores), 512 MiB of RAM
+``raspi3b``
+  Cortex-A53 (4 cores), 1 GiB of RAM
+
+
+Implemented devices
+-------------------
+
+ * ARM1176JZF-S, Cortex-A7 or Cortex-A53 CPU
+ * Interrupt controller
+ * DMA controller
+ * Clock and reset controller (CPRMAN)
+ * System Timer
+ * GPIO controller
+ * Serial ports (BCM2835 AUX - 16550 based - and PL011)
+ * Random Number Generator (RNG)
+ * Frame Buffer
+ * USB host (USBH)
+ * GPIO controller
+ * SD/MMC host controller
+ * SoC thermal sensor
+ * USB2 host controller (DWC2 and MPHI)
+ * MailBox controller (MBOX)
+ * VideoCore firmware (property)
+
+
+Missing devices
+---------------
+
+ * Peripheral SPI controller (SPI)
+ * Analog to Digital Converter (ADC)
+ * Pulse Width Modulation (PWM)
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/nuvoton
    arm/orangepi
    arm/palm
+   arm/raspi
    arm/xscale
    arm/collie
    arm/sx1
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/raspi_platform.h
 F: hw/*/bcm283*
 F: include/hw/arm/raspi*
 F: include/hw/*/bcm283*
+F: docs/system/arm/raspi.rst
 
 Real View
 M: Peter Maydell <peter.maydell@linaro.org>
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

List the 'tosa' machine with the XScale-based PDAs models.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201120173953.2539469-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/xscale.rst | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/docs/system/arm/xscale.rst b/docs/system/arm/xscale.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/xscale.rst
+++ b/docs/system/arm/xscale.rst
@@ -XXX,XX +XXX,XX @@
-Sharp XScale-based PDA models (``akita``, ``borzoi``, ``spitz``, ``terrier``)
-=============================================================================
+Sharp XScale-based PDA models (``akita``, ``borzoi``, ``spitz``, ``terrier``, ``tosa``)
+=======================================================================================
 
-The XScale-based clamshell PDA models (\"Spitz\", \"Akita\", \"Borzoi\"
-and \"Terrier\") emulation includes the following peripherals:
+The Sharp Zaurus are PDAs based on XScale, able to run Linux ('SL series').
 
--  Intel PXA270 System-on-chip (ARMv5TE core)
+The SL-6000 (\"Tosa\"), released in 2005, uses a PXA255 System-on-chip.
 
--  NAND Flash memory
+The SL-C3000 (\"Spitz\"), SL-C1000 (\"Akita\"), SL-C3100 (\"Borzoi\") and
+SL-C3200 (\"Terrier\") use a PXA270.
+
+The clamshell PDA models emulation includes the following peripherals:
+
+-  Intel PXA255/PXA270 System-on-chip (ARMv5TE core)
+
+-  NAND Flash memory - not in \"Tosa\"
 
 -  IBM/Hitachi DSCM microdrive in a PXA PCMCIA slot - not in \"Akita\"
 
--  On-chip OHCI USB controller
+-  On-chip OHCI USB controller - not in \"Tosa\"
 
 -  On-chip LCD controller
 
-- 
2.20.1

The semihosting SYS_HEAPINFO call is supposed to return an array
of four guest addresses:
 * base of heap memory
 * limit of heap memory
 * base of stack memory
 * limit of stack memory

Some semihosting programs (including those compiled to use the
'newlib' embedded C library) use this call to work out where they
should initialize themselves to.

QEMU's implementation when in system emulation mode is very
simplistic: we say that the heap starts halfway into RAM and
continues to the end of RAM, and the stack starts at the top of RAM
and works down to the bottom.  Unfortunately the code assumes that
the base address of RAM is at address 0, so on boards like 'virt'
where this is not true the addresses returned will all be wrong and
the guest application will usually crash.

Conveniently since all Arm boards call arm_load_kernel() we have the
base address of the main RAM block in the arm_boot_info struct which
is accessible via the CPU object.  Use this to return sensible values
from SYS_HEAPINFO.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201119092346.32356-1-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "exec/gdbstub.h"
 #include "qemu/cutils.h"
+#include "hw/arm/boot.h"
 #endif
 
 #define TARGET_SYS_OPEN        0x01
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             int i;
 #ifdef CONFIG_USER_ONLY
             TaskState *ts = cs->opaque;
+#else
+            const struct arm_boot_info *info = env->boot_info;
+            target_ulong rambase = info->loader_start;
 #endif
 
             GET_ARG(0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
 #else
             limit = ram_size;
             /* TODO: Make this use the limit of the loaded application.  */
-            retvals[0] = limit / 2;
-            retvals[1] = limit;
-            retvals[2] = limit; /* Stack base */
-            retvals[3] = 0; /* Stack limit.  */
+            retvals[0] = rambase + limit / 2;
+            retvals[1] = rambase + limit;
+            retvals[2] = rambase + limit; /* Stack base */
+            retvals[3] = rambase; /* Stack limit.  */
 #endif
 
             for (i = 0; i < ARRAY_SIZE(retvals); i++) {
-- 
2.20.1

The Linux kernel doesn't use the official bkpt insn for breakpoints;
instead it uses three instructions in the guaranteed-to-UNDEF space,
and generates SIGTRAP for these rather than the SIGILL that most
UNDEF insns generate:

https://elixir.bootlin.com/linux/v5.9.8/source/arch/arm/kernel/ptrace.c#L197

Make QEMU treat these insns specially too.  The main benefit of this
is that if you're running a debugger on a guest program that runs
into a GCC __builtin_trap() or LLVM "trap because execution should
never reach here" then you'll get the expected signal rather than a
SIGILL.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201117155634.6924-1-peter.maydell@linaro.org
---
 linux-user/arm/cpu_loop.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ do_kernel_trap(CPUARMState *env)
     return 0;
 }
 
+static bool insn_is_linux_bkpt(uint32_t opcode, bool is_thumb)
+{
+    /*
+     * Return true if this insn is one of the three magic UDF insns
+     * which the kernel treats as breakpoint insns.
+     */
+    if (!is_thumb) {
+        return (opcode & 0x0fffffff) == 0x07f001f0;
+    } else {
+        /*
+         * Note that we get the two halves of the 32-bit T32 insn
+         * in the opposite order to the value the kernel uses in
+         * its undef_hook struct.
+         */
+        return ((opcode & 0xffff) == 0xde01) || (opcode == 0xa000f7f0);
+    }
+}
+
 void cpu_loop(CPUARMState *env)
 {
     CPUState *cs = env_cpu(env);
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
                 /* FIXME - what to do if get_user() fails? */
                 get_user_code_u32(opcode, env->regs[15], env);
 
+                /*
+                 * The Linux kernel treats some UDF patterns specially
+                 * to use as breakpoints (instead of the architectural
+                 * bkpt insn). These should trigger a SIGTRAP rather
+                 * than SIGILL.
+                 */
+                if (insn_is_linux_bkpt(opcode, env->thumb)) {
+                    goto excp_debug;
+                }
+
                 rc = EmulateAll(opcode, &ts->fpa, env);
                 if (rc == 0) { /* illegal instruction */
                     info.si_signo = TARGET_SIGILL;
-- 
2.20.1

The virtio-pmem documentation has some minor style issues we hadn't
noticed since we weren't rendering it in our docs:

* Sphinx doesn't complain about overlong title-underlining the
   way it complains about too-short underlining, but it looks odd;
   make the underlines of section headers the right length

* Indent of paragraphs makes them render as blockquotes;
   remove the indent so they just render as normal text

* Leading 'o' isn't rst markup, so it just renders as a literal
   "o"; reformat as a subsection heading instead

* "QEMU" in the document title and section headings are a bit
   odd and unnecessary since this is the QEMU manual; delete
   or rephrase them

* There's no need to specify what QEMU version the device first
   appeared in.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Pankaj Gupta <pankaj.gupta@cloud.ionos.com>
---
 docs/system/virtio-pmem.rst | 60 ++++++++++++++++++-------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/docs/system/virtio-pmem.rst b/docs/system/virtio-pmem.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/virtio-pmem.rst
+++ b/docs/system/virtio-pmem.rst
@@ -XXX,XX +XXX,XX @@
 
-========================
-QEMU virtio pmem
-========================
+===========
+virtio pmem
+===========
 
- This document explains the setup and usage of the virtio pmem device
- which is available since QEMU v4.1.0.
-
- The virtio pmem device is a paravirtualized persistent memory device
- on regular (i.e non-NVDIMM) storage.
+This document explains the setup and usage of the virtio pmem device.
+The virtio pmem device is a paravirtualized persistent memory device
+on regular (i.e non-NVDIMM) storage.
 
 Usecase
---------
+-------
 
-  Virtio pmem allows to bypass the guest page cache and directly use
-  host page cache. This reduces guest memory footprint as the host can
-  make efficient memory reclaim decisions under memory pressure.
+Virtio pmem allows to bypass the guest page cache and directly use
+host page cache. This reduces guest memory footprint as the host can
+make efficient memory reclaim decisions under memory pressure.
 
-o How does virtio-pmem compare to the nvdimm emulation supported by QEMU?
+How does virtio-pmem compare to the nvdimm emulation?
+-----------------------------------------------------
 
-  NVDIMM emulation on regular (i.e. non-NVDIMM) host storage does not
-  persist the guest writes as there are no defined semantics in the device
-  specification. The virtio pmem device provides guest write persistence
-  on non-NVDIMM host storage.
+NVDIMM emulation on regular (i.e. non-NVDIMM) host storage does not
+persist the guest writes as there are no defined semantics in the device
+specification. The virtio pmem device provides guest write persistence
+on non-NVDIMM host storage.
 
 virtio pmem usage
 -----------------
 
-  A virtio pmem device backed by a memory-backend-file can be created on
-  the QEMU command line as in the following example::
+A virtio pmem device backed by a memory-backend-file can be created on
+the QEMU command line as in the following example::
 
     -object memory-backend-file,id=mem1,share,mem-path=./virtio_pmem.img,size=4G
     -device virtio-pmem-pci,memdev=mem1,id=nv1
 
-  where:
+where:
 
   - "object memory-backend-file,id=mem1,share,mem-path=<image>, size=<image size>"
     creates a backend file with the specified size.
@@ -XXX,XX +XXX,XX @@ virtio pmem usage
   - "device virtio-pmem-pci,id=nvdimm1,memdev=mem1" creates a virtio pmem
     pci device whose storage is provided by above memory backend device.
 
-  Multiple virtio pmem devices can be created if multiple pairs of "-object"
-  and "-device" are provided.
+Multiple virtio pmem devices can be created if multiple pairs of "-object"
+and "-device" are provided.
 
 Hotplug
 -------
@@ -XXX,XX +XXX,XX @@ the guest::
 Guest Data Persistence
 ----------------------
 
- Guest data persistence on non-NVDIMM requires guest userspace applications
- to perform fsync/msync. This is different from a real nvdimm backend where
- no additional fsync/msync is required. This is to persist guest writes in
- host backing file which otherwise remains in host page cache and there is
- risk of losing the data in case of power failure.
+Guest data persistence on non-NVDIMM requires guest userspace applications
+to perform fsync/msync. This is different from a real nvdimm backend where
+no additional fsync/msync is required. This is to persist guest writes in
+host backing file which otherwise remains in host page cache and there is
+risk of losing the data in case of power failure.
 
- With virtio pmem device, MAP_SYNC mmap flag is not supported. This provides
- a hint to application to perform fsync for write persistence.
+With virtio pmem device, MAP_SYNC mmap flag is not supported. This provides
+a hint to application to perform fsync for write persistence.
 
 Limitations
-------------
+-----------
+
 - Real nvdimm device backend is not supported.
 - virtio pmem hotunplug is not supported.
 - ACPI NVDIMM features like regions/namespaces are not supported.
-- 
2.20.1

Currently target-i386.rst includes the documentation of the 'pc'
machine model inline. Split it out into its own file, in a
similar way to target-i386.rst; this gives us a place to put
documentation of other i386 machine models, such as 'microvm'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/system/i386/pc.rst     |  7 +++++++
 docs/system/target-i386.rst | 18 +++++++++++++-----
 2 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 docs/system/i386/pc.rst

diff --git a/docs/system/i386/pc.rst b/docs/system/i386/pc.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/i386/pc.rst
@@ -XXX,XX +XXX,XX @@
+i440fx PC (``pc-i440fx``, ``pc``)
+=================================
+
+Peripherals
+~~~~~~~~~~~
+
+.. include:: ../target-i386-desc.rst.inc
diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-i386.rst
+++ b/docs/system/target-i386.rst
@@ -XXX,XX +XXX,XX @@
 .. _QEMU-PC-System-emulator:
 
-x86 (PC) System emulator
-------------------------
+x86 System emulator
+-------------------
 
 .. _pcsys_005fdevices:
 
-Peripherals
-~~~~~~~~~~~
+Board-specific documentation
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. include:: target-i386-desc.rst.inc
+..
+   This table of contents should be kept sorted alphabetically
+   by the title text of each file, which isn't the same ordering
+   as an alphabetical sort by filename.
+
+.. toctree::
+   :maxdepth: 1
+
+   i386/pc
 
 .. include:: cpu-models-x86.rst.inc
 
-- 
2.20.1

Now that target-i386.rst has a place to list documentation of
machines other than the 'pc' machine, we have a place we can
move the microvm documentation to.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/{ => system/i386}/microvm.rst | 5 ++---
 docs/system/target-i386.rst        | 1 +
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename docs/{ => system/i386}/microvm.rst (98%)

diff --git a/docs/microvm.rst b/docs/system/i386/microvm.rst
similarity index 98%
rename from docs/microvm.rst
rename to docs/system/i386/microvm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/microvm.rst
+++ b/docs/system/i386/microvm.rst
@@ -XXX,XX +XXX,XX @@
-====================
-microvm Machine Type
-====================
+'microvm' virtual platform (``microvm``)
+========================================
 
 ``microvm`` is a machine type inspired by ``Firecracker`` and
 constructed after its machine model.
diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-i386.rst
+++ b/docs/system/target-i386.rst
@@ -XXX,XX +XXX,XX @@ Board-specific documentation
 .. toctree::
    :maxdepth: 1
 
+   i386/microvm
    i386/pc
 
 .. include:: cpu-models-x86.rst.inc
-- 
2.20.1

Split the documentation of the qemu-pr-helper binary into the tools
manual, and give it a manpage like our other standalone executables.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/meson.build              |  1 +
 docs/system/pr-manager.rst    | 38 ++-------------
 docs/tools/conf.py            |  2 +
 docs/tools/index.rst          |  1 +
 docs/tools/qemu-pr-helper.rst | 90 +++++++++++++++++++++++++++++++++++
 5 files changed, 99 insertions(+), 33 deletions(-)
 create mode 100644 docs/tools/qemu-pr-helper.rst

diff --git a/docs/meson.build b/docs/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/docs/meson.build
+++ b/docs/meson.build
@@ -XXX,XX +XXX,XX @@ if build_docs
     'tools': {
         'qemu-img.1': (have_tools ? 'man1' : ''),
         'qemu-nbd.8': (have_tools ? 'man8' : ''),
+        'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
         'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
         'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
         'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
diff --git a/docs/system/pr-manager.rst b/docs/system/pr-manager.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/pr-manager.rst
+++ b/docs/system/pr-manager.rst
@@ -XXX,XX +XXX,XX @@ Alternatively, using ``-blockdev``::
           -blockdev node-name=hd,driver=raw,file.driver=host_device,file.filename=/dev/sdb,file.pr-manager=helper0
           -device scsi-block,drive=hd
 
-----------------------------------
-Invoking :program:`qemu-pr-helper`
-----------------------------------
-
-QEMU provides an implementation of the persistent reservation helper,
-called :program:`qemu-pr-helper`.  The helper should be started as a
-system service and supports the following option:
-
--d, --daemon              run in the background
--q, --quiet               decrease verbosity
--v, --verbose             increase verbosity
--f, --pidfile=path        PID file when running as a daemon
--k, --socket=path         path to the socket
--T, --trace=trace-opts    tracing options
-
-By default, the socket and PID file are placed in the runtime state
-directory, for example :file:`/var/run/qemu-pr-helper.sock` and
-:file:`/var/run/qemu-pr-helper.pid`.  The PID file is not created
-unless :option:`-d` is passed too.
-
-:program:`qemu-pr-helper` can also use the systemd socket activation
-protocol.  In this case, the systemd socket unit should specify a
-Unix stream socket, like this::
-
-    [Socket]
-    ListenStream=/var/run/qemu-pr-helper.sock
-
-After connecting to the socket, :program:`qemu-pr-helper`` can optionally drop
-root privileges, except for those capabilities that are needed for
-its operation.  To do this, add the following options:
-
--u, --user=user           user to drop privileges to
--g, --group=group         group to drop privileges to
+You will also need to ensure that the helper program
+:command:`qemu-pr-helper` is running, and that it has been
+set up to use the same socket filename as your QEMU commandline
+specifies. See the qemu-pr-helper documentation or manpage for
+further details.
 
 ---------------------------------------------
 Multipath devices and persistent reservations
diff --git a/docs/tools/conf.py b/docs/tools/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/tools/conf.py
+++ b/docs/tools/conf.py
@@ -XXX,XX +XXX,XX @@ man_pages = [
      ['Fabrice Bellard'], 1),
     ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
      ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
+    ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
+     [], 8),
     ('qemu-trace-stap', 'qemu-trace-stap', u'QEMU SystemTap trace tool',
      [], 1),
     ('virtfs-proxy-helper', 'virtfs-proxy-helper',
diff --git a/docs/tools/index.rst b/docs/tools/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/tools/index.rst
+++ b/docs/tools/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
 
    qemu-img
    qemu-nbd
+   qemu-pr-helper
    qemu-trace-stap
    virtfs-proxy-helper
    virtiofsd
diff --git a/docs/tools/qemu-pr-helper.rst b/docs/tools/qemu-pr-helper.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/tools/qemu-pr-helper.rst
@@ -XXX,XX +XXX,XX @@
+QEMU persistent reservation helper
+==================================
+
+Synopsis
+--------
+
+**qemu-pr-helper** [*OPTION*]
+
+Description
+-----------
+
+Implements the persistent reservation helper for QEMU.
+
+SCSI persistent reservations allow restricting access to block devices
+to specific initiators in a shared storage setup.  When implementing
+clustering of virtual machines, it is a common requirement for virtual
+machines to send persistent reservation SCSI commands.  However,
+the operating system restricts sending these commands to unprivileged
+programs because incorrect usage can disrupt regular operation of the
+storage fabric. QEMU's SCSI passthrough devices ``scsi-block``
+and ``scsi-generic`` support passing guest persistent reservation
+requests to a privileged external helper program. :program:`qemu-pr-helper`
+is that external helper; it creates a socket which QEMU can
+connect to to communicate with it.
+
+If you want to run VMs in a setup like this, this helper should be
+started as a system service, and you should read the QEMU manual
+section on "persistent reservation managers" to find out how to
+configure QEMU to connect to the socket created by
+:program:`qemu-pr-helper`.
+
+After connecting to the socket, :program:`qemu-pr-helper` can
+optionally drop root privileges, except for those capabilities that
+are needed for its operation.
+
+:program:`qemu-pr-helper` can also use the systemd socket activation
+protocol.  In this case, the systemd socket unit should specify a
+Unix stream socket, like this::
+
+    [Socket]
+    ListenStream=/var/run/qemu-pr-helper.sock
+
+Options
+-------
+
+.. program:: qemu-pr-helper
+
+.. option:: -d, --daemon
+
+  run in the background (and create a PID file)
+
+.. option:: -q, --quiet
+
+  decrease verbosity
+
+.. option:: -v, --verbose
+
+  increase verbosity
+
+.. option:: -f, --pidfile=PATH
+
+  PID file when running as a daemon. By default the PID file
+  is created in the system runtime state directory, for example
+  :file:`/var/run/qemu-pr-helper.pid`.
+
+.. option:: -k, --socket=PATH
+
+  path to the socket. By default the socket is created in
+  the system runtime state directory, for example
+  :file:`/var/run/qemu-pr-helper.sock`.
+
+.. option:: -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]
+
+  .. include:: ../qemu-option-trace.rst.inc
+
+.. option:: -u, --user=USER
+
+  user to drop privileges to
+
+.. option:: -g, --group=GROUP
+
+  group to drop privileges to
+
+.. option:: -h, --help
+
+  Display a help message and exit.
+
+.. option:: -V, --version
+
+  Display version information and exit.
-- 
2.20.1

Fix a couple of nits in pr-manager.rst:
 * the title marker for the top level heading is overlength
 * stray capital 'R' in the middle of a sentence

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/system/pr-manager.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/system/pr-manager.rst b/docs/system/pr-manager.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/pr-manager.rst
+++ b/docs/system/pr-manager.rst
@@ -XXX,XX +XXX,XX @@
-======================================
+===============================
 Persistent reservation managers
-======================================
+===============================
 
-SCSI persistent Reservations allow restricting access to block devices
+SCSI persistent reservations allow restricting access to block devices
 to specific initiators in a shared storage setup.  When implementing
 clustering of virtual machines, it is a common requirement for virtual
 machines to send persistent reservation SCSI commands.  However,
-- 
2.20.1

Some arm patches before softfreeze. These are all bug fixes.

-- PMM

The following changes since commit 0ebf76aae58324b8f7bf6af798696687f5f4c2a9:

Merge tag 'nvme-next-pull-request' of git://git.infradead.org/qemu-nvme into staging (2022-07-15 15:38:13 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220718

for you to fetch changes up to 004c8a8bc569c8b18fca6fc90ffe3223daaf17b7:

Align Raspberry Pi DMA interrupts with Linux DTS (2022-07-18 13:25:13 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/intc/armv7m_nvic: ICPRn must not unpend an IRQ that is being held high
 * target/arm: Fill in VL for tbflags when SME enabled and SVE disabled
 * target/arm: Fix aarch64_sve_change_el for SME
 * linux-user/aarch64: Do not clear PROT_MTE on mprotect
 * target/arm: Honour VTCR_EL2 bits in Secure EL2
 * hw/adc: Fix CONV bit in NPCM7XX ADC CON register
 * hw/adc: Make adci[*] R/W in NPCM7XX ADC
 * target/arm: Don't set syndrome ISS for loads and stores with writeback
 * Align Raspberry Pi DMA interrupts with Linux DTS

----------------------------------------------------------------
Andrey Makarov (1):
      Align Raspberry Pi DMA interrupts with Linux DTS

Hao Wu (2):
      hw/adc: Fix CONV bit in NPCM7XX ADC CON register
      hw/adc: Make adci[*] R/W in NPCM7XX ADC

Peter Maydell (9):
      hw/intc/armv7m_nvic: ICPRn must not unpend an IRQ that is being held high
      target/arm: Define and use new regime_tcr_value() function
      target/arm: Calculate mask/base_mask in get_level1_table_address()
      target/arm: Fold regime_tcr() and regime_tcr_value() together
      target/arm: Fix big-endian host handling of VTCR
      target/arm: Store VTCR_EL2, VSTCR_EL2 registers as uint64_t
      target/arm: Store TCR_EL* registers as uint64_t
      target/arm: Honour VTCR_EL2 bits in Secure EL2
      target/arm: Don't set syndrome ISS for loads and stores with writeback

Richard Henderson (3):
      target/arm: Fill in VL for tbflags when SME enabled and SVE disabled
      target/arm: Fix aarch64_sve_change_el for SME
      linux-user/aarch64: Do not clear PROT_MTE on mprotect

In the M-profile Arm ARM, rule R_CVJS defines when an interrupt should
be set to the Pending state:
 A) when the input line is high and the interrupt is not Active
 B) when the input line transitions from low to high and the interrupt
    is Active
(Note that the first of these is an ongoing condition, and the
second is a point-in-time event.)

This can be rephrased as:
 1 when the line goes from low to high, set Pending
 2 when Active goes from 1 to 0, if line is high then set Pending
 3 ignore attempts to clear Pending when the line is high
   and Active is 0

where 1 covers both B and one of the "transition into condition A"
cases, 2 deals with the other "transition into condition A"
possibility, and 3 is "don't drop Pending if we're already in
condition A".  Transitions out of condition A don't affect Pending
state.

We handle case 1 in set_irq_level(). For an interrupt (as opposed
to other kinds of exception) the only place where we clear Active
is in armv7m_nvic_complete_irq(), where we handle case 2 by
checking for whether we need to re-pend the exception. For case 3,
the only places where we clear Pending state on an interrupt are in
armv7m_nvic_acknowledge_irq() (where we are setting Active so it
doesn't count) and for writes to NVIC_ICPRn.

It is the "write to NVIC_ICPRn" case that we missed: we must ignore
this if the input line is high and the interrupt is not Active.
(This required behaviour is differently and perhaps more clearly
stated in the v7M Arm ARM, which has pseudocode in section B3.4.1
that implies it.)

Reported-by: Igor Kotrasiński <i.kotrasinsk@samsung.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220628154724.3297442-1-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
 
         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
+            /*
+             * Note that if the input line is still held high and the interrupt
+             * is not active then rule R_CVJS requires that the Pending state
+             * remains set; in that case we mustn't let it be cleared.
+             */
             if (value & (1 << i) &&
-                (attrs.secure || s->itns[startvec + i])) {
+                (attrs.secure || s->itns[startvec + i]) &&
+                !(setval == 0 && s->vectors[startvec + i].level &&
+                  !s->vectors[startvec + i].active)) {
                 s->vectors[startvec + i].pending = setval;
             }
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When PSTATE.SM, VL = SVL even if SVE is disabled.
This is visible in kselftest ssve-test.

Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220713045848.217364-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
     }
     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
         int sme_el = sme_exception_el(env, el);
+        bool sm = FIELD_EX64(env->svcr, SVCR, SM);
 
         DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
         if (sme_el == 0) {
             /* Similarly, do not compute SVL if SME is disabled. */
-            DP_TBFLAG_A64(flags, SVL, sve_vqm1_for_el_sm(env, el, true));
+            int svl = sve_vqm1_for_el_sm(env, el, true);
+            DP_TBFLAG_A64(flags, SVL, svl);
+            if (sm) {
+                /* If SVE is disabled, we will not have set VL above. */
+                DP_TBFLAG_A64(flags, VL, svl);
+            }
         }
-        if (FIELD_EX64(env->svcr, SVCR, SM)) {
+        if (sm) {
             DP_TBFLAG_A64(flags, PSTATE_SM, 1);
             DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el));
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We were only checking for SVE disabled and not taking into
account PSTATE.SM to check SME disabled, which resulted in
vectors being incorrectly truncated.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220713045848.217364-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
     }
 }
 
+static uint32_t sve_vqm1_for_el_sm_ena(CPUARMState *env, int el, bool sm)
+{
+    int exc_el;
+
+    if (sm) {
+        exc_el = sme_exception_el(env, el);
+    } else {
+        exc_el = sve_exception_el(env, el);
+    }
+    if (exc_el) {
+        return 0; /* disabled */
+    }
+    return sve_vqm1_for_el_sm(env, el, sm);
+}
+
 /*
  * Notice a change in SVE vector size when changing EL.
  */
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
 {
     ARMCPU *cpu = env_archcpu(env);
     int old_len, new_len;
-    bool old_a64, new_a64;
+    bool old_a64, new_a64, sm;
 
     /* Nothing to do if no SVE.  */
     if (!cpu_isar_feature(aa64_sve, cpu)) {
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
      * invoke ResetSVEState when taking an exception from, or
      * returning to, AArch32 state when PSTATE.SM is enabled.
      */
-    if (old_a64 != new_a64 && FIELD_EX64(env->svcr, SVCR, SM)) {
+    sm = FIELD_EX64(env->svcr, SVCR, SM);
+    if (old_a64 != new_a64 && sm) {
         arm_reset_sve_state(env);
         return;
     }
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
      * we already have the correct register contents when encountering the
      * vq0->vq0 transition between EL0->EL1.
      */
-    old_len = (old_a64 && !sve_exception_el(env, old_el)
-               ? sve_vqm1_for_el(env, old_el) : 0);
-    new_len = (new_a64 && !sve_exception_el(env, new_el)
-               ? sve_vqm1_for_el(env, new_el) : 0);
+    old_len = new_len = 0;
+    if (old_a64) {
+        old_len = sve_vqm1_for_el_sm_ena(env, old_el, sm);
+    }
+    if (new_a64) {
+        new_len = sve_vqm1_for_el_sm_ena(env, new_el, sm);
+    }
 
     /* When changing vector length, clear inaccessible state.  */
     if (new_len < old_len) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The documentation for PROT_MTE says that it cannot be cleared
by mprotect.  Further, the implementation of the VM_ARCH_CLEAR bit,
contains PROT_BTI confiming that bit should be cleared.

Introduce PAGE_TARGET_STICKY to allow target/arch/cpu.h to control
which bits may be reset during page_set_flags.  This is sort of the
opposite of VM_ARCH_CLEAR, but works better with qemu's PAGE_* bits
that are separate from PROT_* bits.

Reported-by: Vitaly Buka <vitalybuka@google.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220711031420.17820-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          |  7 +++++--
 accel/tcg/translate-all.c | 13 +++++++++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline MemTxAttrs *typecheck_memtxattrs(MemTxAttrs *x)
 
 /*
  * AArch64 usage of the PAGE_TARGET_* bits for linux-user.
+ * Note that with the Linux kernel, PROT_MTE may not be cleared by mprotect
+ * mprotect but PROT_BTI may be cleared.  C.f. the kernel's VM_ARCH_CLEAR.
  */
-#define PAGE_BTI  PAGE_TARGET_1
-#define PAGE_MTE  PAGE_TARGET_2
+#define PAGE_BTI            PAGE_TARGET_1
+#define PAGE_MTE            PAGE_TARGET_2
+#define PAGE_TARGET_STICKY  PAGE_MTE
 
 #ifdef TARGET_TAGGED_ADDRESSES
 /**
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ int page_get_flags(target_ulong address)
     return p->flags;
 }
 
+/*
+ * Allow the target to decide if PAGE_TARGET_[12] may be reset.
+ * By default, they are not kept.
+ */
+#ifndef PAGE_TARGET_STICKY
+#define PAGE_TARGET_STICKY  0
+#endif
+#define PAGE_STICKY  (PAGE_ANON | PAGE_TARGET_STICKY)
+
 /* Modify the flags of a page and invalidate the code if necessary.
    The flag PAGE_WRITE_ORG is positioned automatically depending
    on PAGE_WRITE.  The mmap_lock should already be held.  */
@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
             p->target_data = NULL;
             p->flags = flags;
         } else {
-            /* Using mprotect on a page does not change MAP_ANON. */
-            p->flags = (p->flags & PAGE_ANON) | flags;
+            /* Using mprotect on a page does not change sticky bits. */
+            p->flags = (p->flags & PAGE_STICKY) | flags;
         }
     }
 }
-- 
2.25.1

The regime_tcr() function returns a pointer to a struct TCR
corresponding to the TCR controlling a translation regime.  The
struct TCR has the raw value of the register, plus two fields mask
and base_mask which are used as a small optimization in the case of
32-bit short-descriptor lookups.  Almost all callers of regime_tcr()
only want the raw register value.  Define and use a new
regime_tcr_value() function which returns only the raw 64-bit
register value.

This is a preliminary to removing the 32-bit short descriptor
optimization -- it only saves a handful of bit operations, which is
tiny compared to the overhead of doing a page table walk at all, and
the TCR struct is awkward and makes fixing
https://gitlab.com/qemu-project/qemu/-/issues/1103 unnecessarily
difficult.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220714132303.1287193-2-peter.maydell@linaro.org
---
 target/arm/internals.h  | 6 ++++++
 target/arm/helper.c     | 6 +++---
 target/arm/ptw.c        | 8 ++++----
 target/arm/tlb_helper.c | 2 +-
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
+/* Return the raw value of the TCR controlling this translation regime */
+static inline uint64_t regime_tcr_value(CPUARMState *env, ARMMMUIdx mmu_idx)
+{
+    return regime_tcr(env, mmu_idx)->raw_tcr;
+}
+
 /**
  * arm_num_brps: Return number of implemented breakpoints.
  * Note that the ID register BRPS field is "number of bps - 1",
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
 static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
                               uint64_t addr)
 {
-    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+    uint64_t tcr = regime_tcr_value(env, mmu_idx);
     int tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
     int select = extract64(addr, 55, 1);
 
@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
-    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+    uint64_t tcr = regime_tcr_value(env, mmu_idx);
     bool epd, hpd, using16k, using64k, tsz_oob, ds;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
 {
     CPUARMTBFlags flags = {};
     ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
-    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+    uint64_t tcr = regime_tcr_value(env, mmu_idx);
     uint64_t sctlr;
     int tbii, tbid;
 
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
                                           ARMMMUIdx mmu_idx)
 {
-    uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+    uint64_t tcr = regime_tcr_value(env, mmu_idx);
     uint32_t el = regime_el(env, mmu_idx);
     int select, tsz;
     bool epd, hpd;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
     uint32_t attrs;
     int32_t stride;
     int addrsize, inputsize, outputsize;
-    TCR *tcr = regime_tcr(env, mmu_idx);
+    uint64_t tcr = regime_tcr_value(env, mmu_idx);
     int ap, ns, xn, pxn;
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          * For stage 2 translations the starting level is specified by the
          * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
          */
-        uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
-        uint32_t sl2 = extract64(tcr->raw_tcr, 33, 1);
+        uint32_t sl0 = extract32(tcr, 6, 2);
+        uint32_t sl2 = extract64(tcr, 33, 1);
         uint32_t startlevel;
         bool ok;
 
diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
         return true;
     }
     if (arm_feature(env, ARM_FEATURE_LPAE)
-        && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
+        && (regime_tcr_value(env, mmu_idx) & TTBCR_EAE)) {
         return true;
     }
     return false;
-- 
2.25.1

In get_level1_table_address(), instead of using precalculated values
of mask and base_mask from the TCR struct, calculate them directly
(in the same way we currently do in vmsa_ttbcr_raw_write() to
populate the TCR struct fields).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220714132303.1287193-3-peter.maydell@linaro.org
---
 target/arm/ptw.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
                                      uint32_t *table, uint32_t address)
 {
     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
-    TCR *tcr = regime_tcr(env, mmu_idx);
+    uint64_t tcr = regime_tcr_value(env, mmu_idx);
+    int maskshift = extract32(tcr, 0, 3);
+    uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
+    uint32_t base_mask;
 
-    if (address & tcr->mask) {
-        if (tcr->raw_tcr & TTBCR_PD1) {
+    if (address & mask) {
+        if (tcr & TTBCR_PD1) {
             /* Translation table walk disabled for TTBR1 */
             return false;
         }
         *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
     } else {
-        if (tcr->raw_tcr & TTBCR_PD0) {
+        if (tcr & TTBCR_PD0) {
             /* Translation table walk disabled for TTBR0 */
             return false;
         }
-        *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
+        base_mask = ~((uint32_t)0x3fffu >> maskshift);
+        *table = regime_ttbr(env, mmu_idx, 0) & base_mask;
     }
     *table |= (address >> 18) & 0x3ffc;
     return true;
-- 
2.25.1

The only caller of regime_tcr() is now regime_tcr_value(); fold the
two together, and use the shorter and more natural 'regime_tcr'
name for the new function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220714132303.1287193-4-peter.maydell@linaro.org
---
 target/arm/internals.h  | 16 +++++-----------
 target/arm/helper.c     |  6 +++---
 target/arm/ptw.c        |  6 +++---
 target/arm/tlb_helper.c |  2 +-
 4 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
 }
 
-/* Return the TCR controlling this translation regime */
-static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
+/* Return the value of the TCR controlling this translation regime */
+static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     if (mmu_idx == ARMMMUIdx_Stage2) {
-        return &env->cp15.vtcr_el2;
+        return env->cp15.vtcr_el2.raw_tcr;
     }
     if (mmu_idx == ARMMMUIdx_Stage2_S) {
         /*
          * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
          * those are not currently used by QEMU, so just return VSTCR_EL2.
          */
-        return &env->cp15.vstcr_el2;
+        return env->cp15.vstcr_el2.raw_tcr;
     }
-    return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
-}
-
-/* Return the raw value of the TCR controlling this translation regime */
-static inline uint64_t regime_tcr_value(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
-    return regime_tcr(env, mmu_idx)->raw_tcr;
+    return env->cp15.tcr_el[regime_el(env, mmu_idx)].raw_tcr;
 }
 
 /**
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
 static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
                               uint64_t addr)
 {
-    uint64_t tcr = regime_tcr_value(env, mmu_idx);
+    uint64_t tcr = regime_tcr(env, mmu_idx);
     int tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
     int select = extract64(addr, 55, 1);
 
@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
-    uint64_t tcr = regime_tcr_value(env, mmu_idx);
+    uint64_t tcr = regime_tcr(env, mmu_idx);
     bool epd, hpd, using16k, using64k, tsz_oob, ds;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
 {
     CPUARMTBFlags flags = {};
     ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
-    uint64_t tcr = regime_tcr_value(env, mmu_idx);
+    uint64_t tcr = regime_tcr(env, mmu_idx);
     uint64_t sctlr;
     int tbii, tbid;
 
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
                                      uint32_t *table, uint32_t address)
 {
     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
-    uint64_t tcr = regime_tcr_value(env, mmu_idx);
+    uint64_t tcr = regime_tcr(env, mmu_idx);
     int maskshift = extract32(tcr, 0, 3);
     uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
     uint32_t base_mask;
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
                                           ARMMMUIdx mmu_idx)
 {
-    uint64_t tcr = regime_tcr_value(env, mmu_idx);
+    uint64_t tcr = regime_tcr(env, mmu_idx);
     uint32_t el = regime_el(env, mmu_idx);
     int select, tsz;
     bool epd, hpd;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
     uint32_t attrs;
     int32_t stride;
     int addrsize, inputsize, outputsize;
-    uint64_t tcr = regime_tcr_value(env, mmu_idx);
+    uint64_t tcr = regime_tcr(env, mmu_idx);
     int ap, ns, xn, pxn;
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
         return true;
     }
     if (arm_feature(env, ARM_FEATURE_LPAE)
-        && (regime_tcr_value(env, mmu_idx) & TTBCR_EAE)) {
+        && (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
         return true;
     }
     return false;
-- 
2.25.1

We have a bug in our handling of accesses to the AArch32 VTCR
register on big-endian hosts: we were not adjusting the part of the
uint64_t field within TCR that the generated code would access.  That
can be done with offsetoflow32(), by using an ARM_CP_STATE_BOTH cpreg
struct, or by defining a full set of read/write/reset functions --
the various other TCR cpreg structs used one or another of those
strategies, but for VTCR we did not, so on a big-endian host VTCR
accesses would touch the wrong half of the register.

Use offsetoflow32() in the VTCR register struct.  This works even
though the field in the CPU struct is currently a struct TCR, because
the first field in that struct is the uint64_t raw_tcr.

None of the other TCR registers have this bug -- either they are
AArch64 only, or else they define resetfn, writefn, etc, and
expect to be passed the full struct pointer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220714132303.1287193-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
       .type = ARM_CP_ALIAS,
       .access = PL2_RW, .accessfn = access_el3_aa32ns,
-      .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.vtcr_el2) },
     { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
       .access = PL2_RW,
-- 
2.25.1

Change the representation of the VSTCR_EL2 and VTCR_EL2 registers in
the CPU state struct from struct TCR to uint64_t.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220714132303.1287193-6-peter.maydell@linaro.org
---
 target/arm/cpu.h       |  4 ++--
 target/arm/internals.h |  4 ++--
 target/arm/helper.c    |  4 +---
 target/arm/ptw.c       | 14 +++++++-------
 4 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
         /* MMU translation table base control. */
         TCR tcr_el[4];
-        TCR vtcr_el2; /* Virtualization Translation Control.  */
-        TCR vstcr_el2; /* Secure Virtualization Translation Control. */
+        uint64_t vtcr_el2; /* Virtualization Translation Control.  */
+        uint64_t vstcr_el2; /* Secure Virtualization Translation Control. */
         uint32_t c2_data; /* MPU data cacheable bits.  */
         uint32_t c2_insn; /* MPU instruction cacheable bits.  */
         union { /* MMU domain access control register
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     if (mmu_idx == ARMMMUIdx_Stage2) {
-        return env->cp15.vtcr_el2.raw_tcr;
+        return env->cp15.vtcr_el2;
     }
     if (mmu_idx == ARMMMUIdx_Stage2_S) {
         /*
          * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
          * those are not currently used by QEMU, so just return VSTCR_EL2.
          */
-        return env->cp15.vstcr_el2.raw_tcr;
+        return env->cp15.vstcr_el2;
     }
     return env->cp15.tcr_el[regime_el(env, mmu_idx)].raw_tcr;
 }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
       .access = PL2_RW,
-      /* no .writefn needed as this can't cause an ASID change;
-       * no .raw_writefn or .resetfn needed as we never use mask/base_mask
-       */
+      /* no .writefn needed as this can't cause an ASID change */
       .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
     { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
       .cp = 15, .opc1 = 6, .crm = 2,
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         if (arm_is_secure_below_el3(env)) {
             /* Check if page table walk is to secure or non-secure PA space. */
             if (*is_secure) {
-                *is_secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+                *is_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
             } else {
-                *is_secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
+                *is_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
             }
         } else {
             assert(!*is_secure);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             ipa_secure = attrs->secure;
             if (arm_is_secure_below_el3(env)) {
                 if (ipa_secure) {
-                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+                    attrs->secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
                 } else {
-                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
+                    attrs->secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
                 }
             } else {
                 assert(!ipa_secure);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             if (arm_is_secure_below_el3(env)) {
                 if (ipa_secure) {
                     attrs->secure =
-                        !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
+                        !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW));
                 } else {
                     attrs->secure =
-                        !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
-                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
+                        !((env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))
+                        || (env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)));
                 }
             }
             return 0;
-- 
2.25.1

Change the representation of the TCR_EL* registers in the CPU state
struct from struct TCR to uint64_t.  This allows us to drop the
custom vmsa_ttbcr_raw_write() function, moving the "enforce RES0"
checks to their more usual location in the writefn
vmsa_ttbcr_write().  We also don't need the resetfn any more.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220714132303.1287193-7-peter.maydell@linaro.org
---
 target/arm/cpu.h          |  8 +----
 target/arm/internals.h    |  6 ++--
 target/arm/cpu.c          |  2 +-
 target/arm/debug_helper.c |  2 +-
 target/arm/helper.c       | 75 +++++++++++----------------------------
 target/arm/ptw.c          |  2 +-
 6 files changed, 27 insertions(+), 68 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
 #define GTIMER_HYPVIRT  4
 #define NUM_GTIMERS     5
 
-typedef struct {
-    uint64_t raw_tcr;
-    uint32_t mask;
-    uint32_t base_mask;
-} TCR;
-
 #define VTCR_NSW (1u << 29)
 #define VTCR_NSA (1u << 30)
 #define VSTCR_SW VTCR_NSW
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t vttbr_el2; /* Virtualization Translation Table Base.  */
         uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
         /* MMU translation table base control. */
-        TCR tcr_el[4];
+        uint64_t tcr_el[4];
         uint64_t vtcr_el2; /* Virtualization Translation Control.  */
         uint64_t vstcr_el2; /* Secure Virtualization Translation Control. */
         uint32_t c2_data; /* MPU data cacheable bits.  */
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu);
  */
 static inline bool extended_addresses_enabled(CPUARMState *env)
 {
-    TCR *tcr = &env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
+    uint64_t tcr = env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
     return arm_el_is_aa64(env, 1) ||
-           (arm_feature(env, ARM_FEATURE_LPAE) && (tcr->raw_tcr & TTBCR_EAE));
+           (arm_feature(env, ARM_FEATURE_LPAE) && (tcr & TTBCR_EAE));
 }
 
 /* Update a QEMU watchpoint based on the information the guest has set in the
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
          */
         return env->cp15.vstcr_el2;
     }
-    return env->cp15.tcr_el[regime_el(env, mmu_idx)].raw_tcr;
+    return env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
 /**
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
          * Enable TBI0 but not TBI1.
          * Note that this must match useronly_clean_ptr.
          */
-        env->cp15.tcr_el[1].raw_tcr = 5 | (1ULL << 37);
+        env->cp15.tcr_el[1] = 5 | (1ULL << 37);
 
         /* Enable MTE */
         if (cpu_isar_feature(aa64_mte, cpu)) {
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_debug_exception_fsr(CPUARMState *env)
         using_lpae = true;
     } else {
         if (arm_feature(env, ARM_FEATURE_LPAE) &&
-            (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
+            (env->cp15.tcr_el[target_el] & TTBCR_EAE)) {
             using_lpae = true;
         }
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
 };
 
-static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                                 uint64_t value)
+static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
 {
-    TCR *tcr = raw_ptr(env, ri);
-    int maskshift = extract32(value, 0, 3);
+    ARMCPU *cpu = env_archcpu(env);
 
     if (!arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
-            /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
-             * using Long-desciptor translation table format */
+            /*
+             * Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
+             * using Long-descriptor translation table format
+             */
             value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
         } else if (arm_feature(env, ARM_FEATURE_EL3)) {
-            /* In an implementation that includes the Security Extensions
+            /*
+             * In an implementation that includes the Security Extensions
              * TTBCR has additional fields PD0 [4] and PD1 [5] for
              * Short-descriptor translation table format.
              */
@@ -XXX,XX +XXX,XX @@ static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
         }
     }
 
-    /* Update the masks corresponding to the TCR bank being written
-     * Note that we always calculate mask and base_mask, but
-     * they are only used for short-descriptor tables (ie if EAE is 0);
-     * for long-descriptor tables the TCR fields are used differently
-     * and the mask and base_mask values are meaningless.
-     */
-    tcr->raw_tcr = value;
-    tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
-    tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
-}
-
-static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                             uint64_t value)
-{
-    ARMCPU *cpu = env_archcpu(env);
-    TCR *tcr = raw_ptr(env, ri);
-
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         /* With LPAE the TTBCR could result in a change of ASID
          * via the TTBCR.A1 bit, so do a TLB flush.
          */
         tlb_flush(CPU(cpu));
     }
-    /* Preserve the high half of TCR_EL1, set via TTBCR2.  */
-    value = deposit64(tcr->raw_tcr, 0, 32, value);
-    vmsa_ttbcr_raw_write(env, ri, value);
-}
-
-static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    TCR *tcr = raw_ptr(env, ri);
-
-    /* Reset both the TCR as well as the masks corresponding to the bank of
-     * the TCR being reset.
-     */
-    tcr->raw_tcr = 0;
-    tcr->mask = 0;
-    tcr->base_mask = 0xffffc000u;
+    raw_write(env, ri, value);
 }
 
 static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                uint64_t value)
 {
     ARMCPU *cpu = env_archcpu(env);
-    TCR *tcr = raw_ptr(env, ri);
 
     /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
     tlb_flush(CPU(cpu));
-    tcr->raw_tcr = value;
+    raw_write(env, ri, value);
 }
 
 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .writefn = vmsa_tcr_el12_write,
-      .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
+      .raw_writefn = raw_write,
+      .resetvalue = 0,
       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
     { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
-      .raw_writefn = vmsa_ttbcr_raw_write,
-      /* No offsetoflow32 -- pass the entire TCR to writefn/raw_writefn. */
-      .bank_fieldoffsets = { offsetof(CPUARMState, cp15.tcr_el[3]),
-                             offsetof(CPUARMState, cp15.tcr_el[1])} },
+      .raw_writefn = raw_write,
+      .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
+                             offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
 };
 
 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo ttbcr2_reginfo = {
     .access = PL1_RW, .accessfn = access_tvm_trvm,
     .type = ARM_CP_ALIAS,
     .bank_fieldoffsets = {
-        offsetofhigh32(CPUARMState, cp15.tcr_el[3].raw_tcr),
-        offsetofhigh32(CPUARMState, cp15.tcr_el[1].raw_tcr),
+        offsetofhigh32(CPUARMState, cp15.tcr_el[3]),
+        offsetofhigh32(CPUARMState, cp15.tcr_el[1]),
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
       .access = PL2_RW, .writefn = vmsa_tcr_el12_write,
-      /* no .raw_writefn or .resetfn needed as we never use mask/base_mask */
       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
     { .name = "VTCR", .state = ARM_CP_STATE_AA32,
       .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
     { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
       .access = PL3_RW,
-      /* no .writefn needed as this can't cause an ASID change;
-       * we must provide a .raw_writefn and .resetfn because we handle
-       * reset and migration for the AArch32 TTBCR(S), which might be
-       * using mask and base_mask.
-       */
-      .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write,
+      /* no .writefn needed as this can't cause an ASID change */
+      .resetvalue = 0,
       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
     { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             int r_el = regime_el(env, mmu_idx);
             if (arm_el_is_aa64(env, r_el)) {
                 int pamax = arm_pamax(env_archcpu(env));
-                uint64_t tcr = env->cp15.tcr_el[r_el].raw_tcr;
+                uint64_t tcr = env->cp15.tcr_el[r_el];
                 int addrtop, tbi;
 
                 tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
-- 
2.25.1

In regime_tcr() we return the appropriate TCR register for the
translation regime.  For Secure EL2, we return the VSTCR_EL2 value,
but in this translation regime some fields that control behaviour are
in VTCR_EL2.  When this code was originally written (as the comment
notes), QEMU didn't care about any of those fields, but we have since
added support for features such as LPA2 which do need the values from
those fields.

Synthesize a TCR value by merging in the relevant VTCR_EL2 fields to
the VSTCR_EL2 value.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1103
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220714132303.1287193-8-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 19 +++++++++++++++++++
 target/arm/internals.h | 22 +++++++++++++++++++---
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define TTBCR_SH1    (1U << 28)
 #define TTBCR_EAE    (1U << 31)
 
+FIELD(VTCR, T0SZ, 0, 6)
+FIELD(VTCR, SL0, 6, 2)
+FIELD(VTCR, IRGN0, 8, 2)
+FIELD(VTCR, ORGN0, 10, 2)
+FIELD(VTCR, SH0, 12, 2)
+FIELD(VTCR, TG0, 14, 2)
+FIELD(VTCR, PS, 16, 3)
+FIELD(VTCR, VS, 19, 1)
+FIELD(VTCR, HA, 21, 1)
+FIELD(VTCR, HD, 22, 1)
+FIELD(VTCR, HWU59, 25, 1)
+FIELD(VTCR, HWU60, 26, 1)
+FIELD(VTCR, HWU61, 27, 1)
+FIELD(VTCR, HWU62, 28, 1)
+FIELD(VTCR, NSW, 29, 1)
+FIELD(VTCR, NSA, 30, 1)
+FIELD(VTCR, DS, 32, 1)
+FIELD(VTCR, SL2, 33, 1)
+
 /* Bit definitions for ARMv8 SPSR (PSTATE) format.
  * Only these are valid when in AArch64 mode; in
  * AArch32 mode SPSRs are basically CPSR-format.
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
 }
 
+/*
+ * These are the fields in VTCR_EL2 which affect both the Secure stage 2
+ * and the Non-Secure stage 2 translation regimes (and hence which are
+ * not present in VSTCR_EL2).
+ */
+#define VTCR_SHARED_FIELD_MASK \
+    (R_VTCR_IRGN0_MASK | R_VTCR_ORGN0_MASK | R_VTCR_SH0_MASK | \
+     R_VTCR_PS_MASK | R_VTCR_VS_MASK | R_VTCR_HA_MASK | R_VTCR_HD_MASK | \
+     R_VTCR_DS_MASK)
+
 /* Return the value of the TCR controlling this translation regime */
 static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     }
     if (mmu_idx == ARMMMUIdx_Stage2_S) {
         /*
-         * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
-         * those are not currently used by QEMU, so just return VSTCR_EL2.
+         * Secure stage 2 shares fields from VTCR_EL2. We merge those
+         * in with the VSTCR_EL2 value to synthesize a single VTCR_EL2 format
+         * value so the callers don't need to special case this.
+         *
+         * If a future architecture change defines bits in VSTCR_EL2 that
+         * overlap with these VTCR_EL2 fields we may need to revisit this.
          */
-        return env->cp15.vstcr_el2;
+        uint64_t v = env->cp15.vstcr_el2 & ~VTCR_SHARED_FIELD_MASK;
+        v |= env->cp15.vtcr_el2 & VTCR_SHARED_FIELD_MASK;
+        return v;
     }
     return env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
-- 
2.25.1

From: Hao Wu <wuhaotsh@google.com>

The correct bit for the CONV bit in NPCM7XX ADC is bit 13. This patch
fixes that in the module, and also lower the IRQ when the guest
is done handling an interrupt event from the ADC module.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Patrick Venture<venture@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220714182836.89602-4-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/adc/npcm7xx_adc.c           | 2 +-
 tests/qtest/npcm7xx_adc-test.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/adc/npcm7xx_adc.c
+++ b/hw/adc/npcm7xx_adc.c
@@ -XXX,XX +XXX,XX @@ REG32(NPCM7XX_ADC_DATA, 0x4)
 #define NPCM7XX_ADC_CON_INT     BIT(18)
 #define NPCM7XX_ADC_CON_EN      BIT(17)
 #define NPCM7XX_ADC_CON_RST     BIT(16)
-#define NPCM7XX_ADC_CON_CONV    BIT(14)
+#define NPCM7XX_ADC_CON_CONV    BIT(13)
 #define NPCM7XX_ADC_CON_DIV(rv) extract32(rv, 1, 8)
 
 #define NPCM7XX_ADC_MAX_RESULT      1023
diff --git a/tests/qtest/npcm7xx_adc-test.c b/tests/qtest/npcm7xx_adc-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_adc-test.c
+++ b/tests/qtest/npcm7xx_adc-test.c
@@ -XXX,XX +XXX,XX @@
 #define CON_INT     BIT(18)
 #define CON_EN      BIT(17)
 #define CON_RST     BIT(16)
-#define CON_CONV    BIT(14)
+#define CON_CONV    BIT(13)
 #define CON_DIV(rv) extract32(rv, 1, 8)
 
 #define FST_RDST    BIT(1)
-- 
2.25.1

From: Hao Wu <wuhaotsh@google.com>

Our sensor test requires both reading and writing from a sensor's
QOM property. So we need to make the input of ADC module R/W instead
of write only for that to work.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220714182836.89602-5-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/adc/npcm7xx_adc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/adc/npcm7xx_adc.c
+++ b/hw/adc/npcm7xx_adc.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_adc_init(Object *obj)
 
     for (i = 0; i < NPCM7XX_ADC_NUM_INPUTS; ++i) {
         object_property_add_uint32_ptr(obj, "adci[*]",
-                &s->adci[i], OBJ_PROP_FLAG_WRITE);
+                &s->adci[i], OBJ_PROP_FLAG_READWRITE);
     }
     object_property_add_uint32_ptr(obj, "vref",
             &s->vref, OBJ_PROP_FLAG_WRITE);
-- 
2.25.1

The architecture requires that for faults on loads and stores which
do writeback, the syndrome information does not have the ISS
instruction syndrome information (i.e. ISV is 0).  We got this wrong
for the load and store instructions covered by disas_ldst_reg_imm9().
Calculate iss_valid correctly so that if the insn is a writeback one
it is false.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1057
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220715123323.1550983-1-peter.maydell@linaro.org
---
 target/arm/translate-a64.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
     bool is_store = false;
     bool is_extended = false;
     bool is_unpriv = (idx == 2);
-    bool iss_valid = !is_vector;
+    bool iss_valid;
     bool post_index;
     bool writeback;
     int memidx;
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
         g_assert_not_reached();
     }
 
+    iss_valid = !is_vector && !writeback;
+
     if (rn == 31) {
         gen_check_sp_alignment(s);
     }
-- 
2.25.1

From: Andrey Makarov <ph.makarov@gmail.com>

There is nothing in the specs on DMA engine interrupt lines: it should have
been in the "BCM2835 ARM Peripherals" datasheet but the appropriate
"ARM peripherals interrupt table" (p.113) is nearly empty.

All Raspberry Pi models 1-3 (based on bcm2835) have
Linux device tree (arch/arm/boot/dts/bcm2835-common.dtsi +25):

/* dma channel 11-14 share one irq */

This information is repeated in the driver code
(drivers/dma/bcm2835-dma.c +1344):

/*
     * in case of channel >= 11
     * use the 11th interrupt and that is shared
     */

In this patch channels 0--10 and 11--14 are handled separately.

Signed-off-by: Andrey Makarov <andrey.makarov@auriga.com>
Message-id: 20220716113210.349153-1-andrey.makarov@auriga.com
[PMM: fixed checkpatch nits]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2835_peripherals.h |   2 +
 hw/arm/bcm2835_peripherals.c         |  26 +++++-
 tests/qtest/bcm2835-dma-test.c       | 118 +++++++++++++++++++++++++++
 tests/qtest/meson.build              |   3 +-
 4 files changed, 147 insertions(+), 2 deletions(-)
 create mode 100644 tests/qtest/bcm2835-dma-test.c

diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/bcm2835_aux.h"
 #include "hw/display/bcm2835_fb.h"
 #include "hw/dma/bcm2835_dma.h"
+#include "hw/or-irq.h"
 #include "hw/intc/bcm2835_ic.h"
 #include "hw/misc/bcm2835_property.h"
 #include "hw/misc/bcm2835_rng.h"
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
     BCM2835AuxState aux;
     BCM2835FBState fb;
     BCM2835DMAState dma;
+    qemu_or_irq orgated_dma_irq;
     BCM2835ICState ic;
     BCM2835PropertyState property;
     BCM2835RngState rng;
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@
 /* Capabilities for SD controller: no DMA, high-speed, default clocks etc. */
 #define BCM2835_SDHC_CAPAREG 0x52134b4
 
+/*
+ * According to Linux driver & DTS, dma channels 0--10 have separate IRQ,
+ * while channels 11--14 share one IRQ:
+ */
+#define SEPARATE_DMA_IRQ_MAX 10
+#define ORGATED_DMA_IRQ_COUNT 4
+
 static void create_unimp(BCM2835PeripheralState *ps,
                          UnimplementedDeviceState *uds,
                          const char *name, hwaddr ofs, hwaddr size)
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
     /* DMA Channels */
     object_initialize_child(obj, "dma", &s->dma, TYPE_BCM2835_DMA);
 
+    object_initialize_child(obj, "orgated-dma-irq",
+                            &s->orgated_dma_irq, TYPE_OR_IRQ);
+    object_property_set_int(OBJECT(&s->orgated_dma_irq), "num-lines",
+                            ORGATED_DMA_IRQ_COUNT, &error_abort);
+
     object_property_add_const_link(OBJECT(&s->dma), "dma-mr",
                                    OBJECT(&s->gpu_bus_mr));
 
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(&s->peri_mr, DMA15_OFFSET,
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dma), 1));
 
-    for (n = 0; n <= 12; n++) {
+    for (n = 0; n <= SEPARATE_DMA_IRQ_MAX; n++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma), n,
                            qdev_get_gpio_in_named(DEVICE(&s->ic),
                                                   BCM2835_IC_GPU_IRQ,
                                                   INTERRUPT_DMA0 + n));
     }
+    if (!qdev_realize(DEVICE(&s->orgated_dma_irq), NULL, errp)) {
+        return;
+    }
+    for (n = 0; n < ORGATED_DMA_IRQ_COUNT; n++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma),
+                           SEPARATE_DMA_IRQ_MAX + 1 + n,
+                           qdev_get_gpio_in(DEVICE(&s->orgated_dma_irq), n));
+    }
+    qdev_connect_gpio_out(DEVICE(&s->orgated_dma_irq), 0,
+                          qdev_get_gpio_in_named(DEVICE(&s->ic),
+                              BCM2835_IC_GPU_IRQ,
+                              INTERRUPT_DMA0 + SEPARATE_DMA_IRQ_MAX + 1));
 
     /* THERMAL */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->thermal), errp)) {
diff --git a/tests/qtest/bcm2835-dma-test.c b/tests/qtest/bcm2835-dma-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/bcm2835-dma-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for BCM283x DMA engine (on Raspberry Pi 3)
+ * and its interrupts coming to Interrupt Controller.
+ *
+ * Copyright (c) 2022 Auriga LLC
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/* Offsets in raspi3b platform: */
+#define RASPI3_DMA_BASE 0x3f007000
+#define RASPI3_IC_BASE  0x3f00b200
+
+/* Used register/fields definitions */
+
+/* DMA engine registers: */
+#define BCM2708_DMA_CS         0
+#define BCM2708_DMA_ACTIVE     (1 << 0)
+#define BCM2708_DMA_INT        (1 << 2)
+
+#define BCM2708_DMA_ADDR       0x04
+
+#define BCM2708_DMA_INT_STATUS 0xfe0
+
+/* DMA Trasfer Info fields: */
+#define BCM2708_DMA_INT_EN     (1 << 0)
+#define BCM2708_DMA_D_INC      (1 << 4)
+#define BCM2708_DMA_S_INC      (1 << 8)
+
+/* Interrupt controller registers: */
+#define IRQ_PENDING_BASIC      0x00
+#define IRQ_GPU_PENDING1_AGGR  (1 << 8)
+#define IRQ_PENDING_1          0x04
+#define IRQ_ENABLE_1           0x10
+
+/* Data for the test: */
+#define SCB_ADDR   256
+#define S_ADDR     32
+#define D_ADDR     64
+#define TXFR_LEN   32
+const uint32_t check_data = 0x12345678;
+
+static void bcm2835_dma_test_interrupt(int dma_c, int irq_line)
+{
+    uint64_t dma_base = RASPI3_DMA_BASE + dma_c * 0x100;
+    int gpu_irq_line = 16 + irq_line;
+
+    /* Check that interrupts are silent by default: */
+    writel(RASPI3_IC_BASE + IRQ_ENABLE_1, 1 << gpu_irq_line);
+    int isr = readl(dma_base + BCM2708_DMA_INT_STATUS);
+    g_assert_cmpint(isr, ==, 0);
+    uint32_t reg0 = readl(dma_base + BCM2708_DMA_CS);
+    g_assert_cmpint(reg0, ==, 0);
+    uint32_t ic_pending = readl(RASPI3_IC_BASE + IRQ_PENDING_BASIC);
+    g_assert_cmpint(ic_pending, ==, 0);
+    uint32_t gpu_pending1 = readl(RASPI3_IC_BASE + IRQ_PENDING_1);
+    g_assert_cmpint(gpu_pending1, ==, 0);
+
+    /* Prepare Control Block: */
+    writel(SCB_ADDR + 0, BCM2708_DMA_S_INC | BCM2708_DMA_D_INC |
+                         BCM2708_DMA_INT_EN); /* transfer info */
+    writel(SCB_ADDR + 4, S_ADDR);             /* source address */
+    writel(SCB_ADDR + 8, D_ADDR);             /* destination address */
+    writel(SCB_ADDR + 12, TXFR_LEN);          /* transfer length */
+    writel(dma_base + BCM2708_DMA_ADDR, SCB_ADDR);
+
+    writel(S_ADDR, check_data);
+    for (int word = S_ADDR + 4; word < S_ADDR + TXFR_LEN; word += 4) {
+        writel(word, ~check_data);
+    }
+    /* Perform the transfer: */
+    writel(dma_base + BCM2708_DMA_CS, BCM2708_DMA_ACTIVE);
+
+    /* Check that destination == source: */
+    uint32_t data = readl(D_ADDR);
+    g_assert_cmpint(data, ==, check_data);
+    for (int word = D_ADDR + 4; word < D_ADDR + TXFR_LEN; word += 4) {
+        data = readl(word);
+        g_assert_cmpint(data, ==, ~check_data);
+    }
+
+    /* Check that interrupt status is set both in DMA and IC controllers: */
+    isr = readl(RASPI3_DMA_BASE + BCM2708_DMA_INT_STATUS);
+    g_assert_cmpint(isr, ==, 1 << dma_c);
+
+    ic_pending = readl(RASPI3_IC_BASE + IRQ_PENDING_BASIC);
+    g_assert_cmpint(ic_pending, ==, IRQ_GPU_PENDING1_AGGR);
+
+    gpu_pending1 = readl(RASPI3_IC_BASE + IRQ_PENDING_1);
+    g_assert_cmpint(gpu_pending1, ==, 1 << gpu_irq_line);
+
+    /* Clean up, clear interrupt: */
+    writel(dma_base + BCM2708_DMA_CS, BCM2708_DMA_INT);
+}
+
+static void bcm2835_dma_test_interrupts(void)
+{
+    /* DMA engines 0--10 have separate IRQ lines, 11--14 - only one: */
+    bcm2835_dma_test_interrupt(0,  0);
+    bcm2835_dma_test_interrupt(10, 10);
+    bcm2835_dma_test_interrupt(11, 11);
+    bcm2835_dma_test_interrupt(14, 11);
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/bcm2835/dma/test_interrupts",
+                   bcm2835_dma_test_interrupts);
+    qtest_start("-machine raspi3b");
+    ret = g_test_run();
+    qtest_end();
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
-   'migration-test']
+   'migration-test',
+   'bcm2835-dma-test']
 
 qtests_s390x = \
   (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +                 \
-- 
2.25.1