Series comparison

-[PULL 00/14] target-arm queue
+[PULL 0/8] target-arm queue
-arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
+The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce:
 patches, which are somewhere between a bugfix and a new feature.
-thanks
+  Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000)
 -- PMM
 The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:
   Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321
-for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:
+for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255:
-  hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)
+  target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/smmuv3: Check 31st bit to see if CD is valid
+ * contrib/elf2dmp: Support Windows Server 2022
- * qemu-options.hx: Fix formatting of -machine memory-backend option
+ * hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
- * hw: aspeed_gpio: Fix memory size
+ * target/arm: Add Neoverse-N1 IMPDEF registers
- * hw/arm/nseries: Display hexadecimal value with '0x' prefix
+ * hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
- * Add sve-default-vector-length cpu property
+ * docs/system/arm/cpu-features.rst: Fix formatting
- * docs: Update path that mentions deprecated.rst
+ * target/arm: Don't advertise aarch64-pauth.xml to gdb
  * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
  * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
  * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
  * target/arm: Report M-profile alignment faults correctly to the guest
  * target/arm: Add missing 'return's after calling v7m_exception_taken()
  * target/arm: Enforce that M-profile SP low 2 bits are always zero
 ----------------------------------------------------------------
-Joe Komlodi (1):
+Chen Baozi (1):
-      hw/arm/smmuv3: Check 31st bit to see if CD is valid
+      target/arm: Add Neoverse-N1 registers
-Joel Stanley (1):
+Guenter Roeck (1):
-      hw: aspeed_gpio: Fix memory size
+      hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
-Mao Zhongyi (1):
+Peter Maydell (3):
-      docs: Update path that mentions deprecated.rst
+      hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
       docs/system/arm/cpu-features.rst: Fix formatting
       target/arm: Don't advertise aarch64-pauth.xml to gdb
-Peter Maydell (7):
+Viktor Prutyanov (3):
-      qemu-options.hx: Fix formatting of -machine memory-backend option
+      contrib/elf2dmp: fix code style
-      target/arm: Enforce that M-profile SP low 2 bits are always zero
+      contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
-      target/arm: Add missing 'return's after calling v7m_exception_taken()
+      contrib/elf2dmp: add PE name check and Windows Server 2022 support
       target/arm: Report M-profile alignment faults correctly to the guest
       hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
       hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
       hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
-Philippe Mathieu-Daudé (1):
+ docs/system/arm/cpu-features.rst |  68 ++++++++++-------------
-      hw/arm/nseries: Display hexadecimal value with '0x' prefix
+ contrib/elf2dmp/pe.h             | 115 ++++++++++++++++++++++-----------------
+ contrib/elf2dmp/addrspace.c      |   1 +
-Richard Henderson (3):
+ contrib/elf2dmp/main.c           | 108 ++++++++++++++++++++++++------------
-      target/arm: Correctly bound length in sve_zcr_get_valid_len
+ hw/char/cadence_uart.c           |   6 +-
-      target/arm: Export aarch64_sve_zcr_get_valid_len
+ hw/usb/imx-usb-phy.c             |  19 ++++++-
-      target/arm: Add sve-default-vector-length cpu property
+ target/arm/cpu64.c               |  69 +++++++++++++++++++++++
+ target/arm/gdbstub.c             |   7 +++
- docs/system/arm/cpu-features.rst | 15 ++++++++++
+files changed, 267 insertions(+), 126 deletions(-)
  configure                        |  2 +-
  hw/arm/smmuv3-internal.h         |  2 +-
  target/arm/cpu.h                 |  5 ++++
  target/arm/internals.h           | 10 +++++++
  hw/arm/nseries.c                 |  2 +-
  hw/gpio/aspeed_gpio.c            |  3 +-
  hw/intc/armv7m_nvic.c            | 40 +++++++++++++++++++--------
  target/arm/cpu.c                 | 14 ++++++++--
  target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++++++++++
  target/arm/gdbstub.c             |  4 +++
  target/arm/helper.c              |  8 ++++--
  target/arm/m_helper.c            | 24 ++++++++++++----
  target/arm/translate.c           |  3 ++
  target/i386/cpu.c                |  2 +-
  MAINTAINERS                      |  2 +-
  qemu-options.hx                  | 30 +++++++++++---------
 files changed, 183 insertions(+), 43 deletions(-)

-[PULL 12/14] target/arm: Add sve-default-vector-length cpu property
+[PULL 1/8] target/arm: Add Neoverse-N1 registers
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Chen Baozi <chenbaozi@phytium.com.cn>
-Mirror the behavour of /proc/sys/abi/sve_default_vector_length
+Add implementation defined registers for neoverse-n1 which
-under the real linux kernel.  We have no way of passing along
+would be accessed by TF-A. Since there is no DSU in Qemu,
-a real default across exec like the kernel can, but this is a
+CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition.
 decent way of adjusting the startup vector length of a process.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
+Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
+Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-[PMM: tweaked docs formatting, document -1 special-case,
+Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn
  added fixup patch from RTH mentioning QEMU's maximum veclen.]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/cpu-features.rst | 15 ++++++++
+ target/arm/cpu64.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++
- target/arm/cpu.h                 |  5 +++
+file changed, 69 insertions(+)
  target/arm/cpu.c                 | 14 ++++++--
  target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 files changed, 92 insertions(+), 2 deletions(-)
-diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/cpu-features.rst
-+++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
- lengths is to explicitly enable each desired length.  Therefore only
- example's (1), (4), and (6) exhibit recommended uses of the properties.
-+SVE User-mode Default Vector Length Property
-+--------------------------------------------
-+
-+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
-+defined to mirror the Linux kernel parameter file
-+``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
-+is in units of bytes and must be between 16 and 8192.
-+If not specified, the default vector length is 64.
-+
-+If the default length is larger than the maximum vector length enabled,
-+the actual vector length will be reduced.  Note that the maximum vector
-+length supported by QEMU is 256.
-+
-+If this property is set to ``-1`` then the default vector length
-+is set to the maximum possible length.
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-     /* Used to set the maximum vector length the cpu will support.  */
-     uint32_t sve_max_vq;
-+#ifdef CONFIG_USER_ONLY
-+    /* Used to set the default vector length at process start. */
-+    uint32_t sve_default_vq;
-+#endif
-+
-     /*
-      * In sve_vq_map each set bit is a supported vector length of
-      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
-         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
-         /* with reasonable vector length */
-         if (cpu_isar_feature(aa64_sve, cpu)) {
--            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
-+            env->vfp.zcr_el[1] =
-+                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
-         }
-         /*
-          * Enable TBI0 but not TBI1.
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
-     QLIST_INIT(&cpu->pre_el_change_hooks);
-     QLIST_INIT(&cpu->el_change_hooks);
--#ifndef CONFIG_USER_ONLY
-+#ifdef CONFIG_USER_ONLY
-+# ifdef TARGET_AARCH64
-+    /*
-+     * The linux kernel defaults to 512-bit vectors, when sve is supported.
-+     * See documentation for /proc/sys/abi/sve_default_vector_length, and
-+     * our corresponding sve-default-vector-length cpu property.
-+     */
-+    cpu->sve_default_vq = 4;
-+# endif
-+#else
-     /* Our inbound IRQ and FIQ lines */
-     if (kvm_enabled()) {
-         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
+@@ -XXX,XX +XXX,XX @@
-     cpu->isar.id_aa64pfr0 = t;
+ #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "cpu.h"
 +#include "cpregs.h"
  #include "qemu/module.h"
  #include "sysemu/kvm.h"
  #include "sysemu/hvf.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
      /* TODO:  Add A64FX specific HPC extension registers */
  }
-+#ifdef CONFIG_USER_ONLY
++static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
-+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
++    { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64,
-+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
++      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0,
-+                                            const char *name, void *opaque,
++      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-+                                            Error **errp)
++    { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0,
 +      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ATCR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 7, .opc2 = 0,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ATCR_EL12", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 5, .crn = 15, .crm = 7, .opc2 = 0,
 +      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "AVTCR_EL2", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 1,
 +      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    /*
 +     * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU
 +     * (and in particular its system registers).
 +     */
 +    { .name = "CPUCFR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 0, .opc2 = 0,
 +      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 },
 +    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 },
 +    { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPMR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 3,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPOR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 2,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPSELR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 0,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +};
 +
 +static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
 +{
-+    ARMCPU *cpu = ARM_CPU(obj);
++    define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
 +    int32_t default_len, default_vq, remainder;
 +
 +    if (!visit_type_int32(v, name, &default_len, errp)) {
 +        return;
 +    }
 +
 +    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
 +    if (default_len == -1) {
 +        cpu->sve_default_vq = ARM_MAX_VQ;
 +        return;
 +    }
 +
 +    default_vq = default_len / 16;
 +    remainder = default_len % 16;
 +
 +    /*
 +     * Note that the 512 max comes from include/uapi/asm/sve_context.h
 +     * and is the maximum architectural width of ZCR_ELx.LEN.
 +     */
 +    if (remainder || default_vq < 1 || default_vq > 512) {
 +        error_setg(errp, "cannot set sve-default-vector-length");
 +        if (remainder) {
 +            error_append_hint(errp, "Vector length not a multiple of 16\n");
 +        } else if (default_vq < 1) {
 +            error_append_hint(errp, "Vector length smaller than 16\n");
 +        } else {
 +            error_append_hint(errp, "Vector length larger than %d\n",
 +                              512 * 16);
 +        }
 +        return;
 +    }
 +
 +    cpu->sve_default_vq = default_vq;
 +}
 +
-+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+ static void aarch64_neoverse_n1_initfn(Object *obj)
-+                                            const char *name, void *opaque,
+ {
-+                                            Error **errp)
+     ARMCPU *cpu = ARM_CPU(obj);
-+{
+@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
-+    ARMCPU *cpu = ARM_CPU(obj);
-+    int32_t value = cpu->sve_default_vq * 16;
+     /* From D5.1 AArch64 PMU register summary */
      cpu->isar.reset_pmcr_el0 = 0x410c3000;
 +
-+    visit_type_int32(v, name, &value, errp);
++    define_neoverse_n1_cp_reginfo(cpu);
 +}
 +#endif
 +
  void aarch64_add_sve_properties(Object *obj)
  {
      uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
          object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                              cpu_arm_set_sve_vq, NULL, NULL);
      }
 +
 +#ifdef CONFIG_USER_ONLY
 +    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
 +    object_property_add(obj, "sve-default-vector-length", "int32",
 +                        cpu_arm_get_sve_default_vec_len,
 +                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
 +#endif
  }
- void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
+ static void aarch64_host_initfn(Object *obj)
 --
-.20.1
+.34.1

-[PULL 14/14] hw: aspeed_gpio: Fix memory size
+[PULL 2/8] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
-From: Joel Stanley <joel@jms.id.au>
+The cadence UART attempts to avoid allowing the guest to set invalid
 baud rate register values in the uart_write() function.  However it
 does the "mask to the size of the register field" and "check for
 invalid values" in the wrong order, which means that a malicious
 guest can get a bogus value into the register by setting also some
 high bits in the value, and cause QEMU to crash by division-by-zero.
-The macro used to calculate the maximum memory size of the MMIO region
+Do the mask before the bounds check instead of afterwards.
 had a mistake, causing all GPIO models to create a mapping of 0x9D8.
 The intent was to have it be 0x9D8 - 0x800.
-This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
-region set aside for the GPIO controller.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested-by: Qiang Liu <cyruscyliu@gmail.com>
 Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
 ---
  hw/char/cadence_uart.c | 6 ++++--
 file changed, 4 insertions(+), 2 deletions(-)
-On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 regions would overlap. Worse was the 1.8V controller would map over the
 top of the following peripheral, which happens to be the RTC.
 The mmio region used by each device is a maximum of 2KB, so avoid the
 calculations and hard code this as the maximum.
 Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20210713065854.134634-2-joel@jms.id.au
 [PMM: fix autocorrect error in commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/gpio/aspeed_gpio.c | 3 +--
 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/aspeed_gpio.c
+--- a/hw/char/cadence_uart.c
-+++ b/hw/gpio/aspeed_gpio.c
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
- #define GPIO_1_8V_MEM_SIZE            0x9D8
+         }
- #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
+         break;
-                                       GPIO_1_8V_REG_OFFSET) >> 2)
+     case R_BRGR: /* Baud rate generator */
--#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
++        value &= 0xffff;
+         if (value >= 0x01) {
- static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
+-            s->r[offset] = value & 0xFFFF;
- {
++            s->r[offset] = value;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
+         }
-     }
+         break;
+     case R_BDIV:    /* Baud rate divider */
-     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
++        value &= 0xff;
--            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
+         if (value >= 0x04) {
-+            TYPE_ASPEED_GPIO, 0x800);
+-            s->r[offset] = value & 0xFF;
++            s->r[offset] = value;
-     sysbus_init_mmio(sbd, &s->iomem);
+         }
- }
+         break;
      default:
 --
-.20.1
+.34.1

-[PULL 13/14] hw/arm/nseries: Display hexadecimal value with '0x' prefix
+[PULL 3/8] contrib/elf2dmp: fix code style
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Viktor Prutyanov <viktor@daynix.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Originally elf2dmp were added with some code style issues,
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+especially in pe.h header, and some were introduced by
-Message-id: 20210726150953.1218690-1-f4bug@amsat.org
+d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now.
 Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
 Reviewed-by: Annie Li <annie.li@oracle.com>
 Message-id: 20230222211246.883679-2-viktor@daynix.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/nseries.c | 2 +-
+ contrib/elf2dmp/pe.h        | 100 ++++++++++++++++++------------------
-file changed, 1 insertion(+), 1 deletion(-)
+ contrib/elf2dmp/addrspace.c |   1 +
  contrib/elf2dmp/main.c      |   9 ++--
 files changed, 57 insertions(+), 53 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/contrib/elf2dmp/pe.h
-+++ b/hw/arm/nseries.c
++++ b/contrib/elf2dmp/pe.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len)
+@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DOS_HEADER {
-     default:
+ } __attribute__ ((packed)) IMAGE_DOS_HEADER;
-     bad_cmd:
-         qemu_log_mask(LOG_GUEST_ERROR,
+ typedef struct IMAGE_FILE_HEADER {
--                      "%s: unknown command %02x\n", __func__, s->cmd);
+-  uint16_t  Machine;
-+                      "%s: unknown command 0x%02x\n", __func__, s->cmd);
+-  uint16_t  NumberOfSections;
-         break;
+-  uint32_t  TimeDateStamp;
 -  uint32_t  PointerToSymbolTable;
 -  uint32_t  NumberOfSymbols;
 -  uint16_t  SizeOfOptionalHeader;
 -  uint16_t  Characteristics;
 +    uint16_t  Machine;
 +    uint16_t  NumberOfSections;
 +    uint32_t  TimeDateStamp;
 +    uint32_t  PointerToSymbolTable;
 +    uint32_t  NumberOfSymbols;
 +    uint16_t  SizeOfOptionalHeader;
 +    uint16_t  Characteristics;
  } __attribute__ ((packed)) IMAGE_FILE_HEADER;
  typedef struct IMAGE_DATA_DIRECTORY {
 -  uint32_t VirtualAddress;
 -  uint32_t Size;
 +    uint32_t VirtualAddress;
 +    uint32_t Size;
  } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY;
  #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
  typedef struct IMAGE_OPTIONAL_HEADER64 {
 -  uint16_t  Magic; /* 0x20b */
 -  uint8_t   MajorLinkerVersion;
 -  uint8_t   MinorLinkerVersion;
 -  uint32_t  SizeOfCode;
 -  uint32_t  SizeOfInitializedData;
 -  uint32_t  SizeOfUninitializedData;
 -  uint32_t  AddressOfEntryPoint;
 -  uint32_t  BaseOfCode;
 -  uint64_t  ImageBase;
 -  uint32_t  SectionAlignment;
 -  uint32_t  FileAlignment;
 -  uint16_t  MajorOperatingSystemVersion;
 -  uint16_t  MinorOperatingSystemVersion;
 -  uint16_t  MajorImageVersion;
 -  uint16_t  MinorImageVersion;
 -  uint16_t  MajorSubsystemVersion;
 -  uint16_t  MinorSubsystemVersion;
 -  uint32_t  Win32VersionValue;
 -  uint32_t  SizeOfImage;
 -  uint32_t  SizeOfHeaders;
 -  uint32_t  CheckSum;
 -  uint16_t  Subsystem;
 -  uint16_t  DllCharacteristics;
 -  uint64_t  SizeOfStackReserve;
 -  uint64_t  SizeOfStackCommit;
 -  uint64_t  SizeOfHeapReserve;
 -  uint64_t  SizeOfHeapCommit;
 -  uint32_t  LoaderFlags;
 -  uint32_t  NumberOfRvaAndSizes;
 -  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 +    uint16_t  Magic; /* 0x20b */
 +    uint8_t   MajorLinkerVersion;
 +    uint8_t   MinorLinkerVersion;
 +    uint32_t  SizeOfCode;
 +    uint32_t  SizeOfInitializedData;
 +    uint32_t  SizeOfUninitializedData;
 +    uint32_t  AddressOfEntryPoint;
 +    uint32_t  BaseOfCode;
 +    uint64_t  ImageBase;
 +    uint32_t  SectionAlignment;
 +    uint32_t  FileAlignment;
 +    uint16_t  MajorOperatingSystemVersion;
 +    uint16_t  MinorOperatingSystemVersion;
 +    uint16_t  MajorImageVersion;
 +    uint16_t  MinorImageVersion;
 +    uint16_t  MajorSubsystemVersion;
 +    uint16_t  MinorSubsystemVersion;
 +    uint32_t  Win32VersionValue;
 +    uint32_t  SizeOfImage;
 +    uint32_t  SizeOfHeaders;
 +    uint32_t  CheckSum;
 +    uint16_t  Subsystem;
 +    uint16_t  DllCharacteristics;
 +    uint64_t  SizeOfStackReserve;
 +    uint64_t  SizeOfStackCommit;
 +    uint64_t  SizeOfHeapReserve;
 +    uint64_t  SizeOfHeapCommit;
 +    uint32_t  LoaderFlags;
 +    uint32_t  NumberOfRvaAndSizes;
 +    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64;
  typedef struct IMAGE_NT_HEADERS64 {
 -  uint32_t Signature;
 -  IMAGE_FILE_HEADER FileHeader;
 -  IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 +    uint32_t Signature;
 +    IMAGE_FILE_HEADER FileHeader;
 +    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
  } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
  typedef struct IMAGE_DEBUG_DIRECTORY {
 -  uint32_t Characteristics;
 -  uint32_t TimeDateStamp;
 -  uint16_t MajorVersion;
 -  uint16_t MinorVersion;
 -  uint32_t Type;
 -  uint32_t SizeOfData;
 -  uint32_t AddressOfRawData;
 -  uint32_t PointerToRawData;
 +    uint32_t Characteristics;
 +    uint32_t TimeDateStamp;
 +    uint16_t MajorVersion;
 +    uint16_t MinorVersion;
 +    uint32_t Type;
 +    uint32_t SizeOfData;
 +    uint32_t AddressOfRawData;
 +    uint32_t PointerToRawData;
  } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY;
  #define IMAGE_DEBUG_TYPE_CODEVIEW   2
 diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/addrspace.c
 +++ b/contrib/elf2dmp/addrspace.c
@@ -XXX,XX +XXX,XX @@
  static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
  {
      size_t i;
 +
      for (i = 0; i < ps->block_nr; i++) {
          if (ps->block[i].paddr <= pa &&
                  pa <= ps->block[i].paddr + ps->block[i].size) {
 diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/main.c
 +++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
      };
      for (i = 0; i < ps->block_nr; i++) {
 -        h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
 +        h.PhysicalMemoryBlock.NumberOfPages +=
 +                ps->block[i].size / ELF2DMP_PAGE_SIZE;
          h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
              .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
              .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
          };
      }
+-    h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
++    h.RequiredDumpSpace +=
++            h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
+     *hdr = h;
+@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
+ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
+         struct va_space *vs, QEMU_Elf *qe)
+ {
+-        int i;
++    int i;
++
+     for (i = 0; i < qe->state_nr; i++) {
+         uint64_t Prcb;
+         uint64_t Context;
 --
-.20.1
+.34.1

-[PULL 11/14] target/arm: Export aarch64_sve_zcr_get_valid_len
+[PULL 4/8] contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Viktor Prutyanov <viktor@daynix.com>
-Rename from sve_zcr_get_valid_len and make accessible
+Move out PE directory search functionality to be reused not only
-from outside of helper.c.
+for Debug Directory processing but for arbitrary PE directory.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Annie Li <annie.li@oracle.com>
-Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
+Message-id: 20230222211246.883679-3-viktor@daynix.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 10 ++++++++++
+ contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++-----------------
- target/arm/helper.c    |  4 ++--
+file changed, 42 insertions(+), 29 deletions(-)
 files changed, 12 insertions(+), 2 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/contrib/elf2dmp/main.c
-+++ b/target/arm/internals.h
++++ b/contrib/elf2dmp/main.c
-@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
+@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
  void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
  #endif /* CONFIG_TCG */
 +/**
 + * aarch64_sve_zcr_get_valid_len:
 + * @cpu: cpu context
 + * @start_len: maximum len to consider
 + *
 + * Return the maximum supported sve vector length <= @start_len.
 + * Note that both @start_len and the return value are in units
 + * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
 + */
 +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
  enum arm_fprounding {
      FPROUNDING_TIEEVEN,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
      return 0;
  }
--static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
++static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
-+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
++        void *entry, size_t size, struct va_space *vs)
 +{
 +    const char e_magic[2] = "MZ";
 +    const char Signature[4] = "PE\0\0";
 +    IMAGE_DOS_HEADER *dos_hdr = start_addr;
 +    IMAGE_NT_HEADERS64 nt_hdrs;
 +    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
 +    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
 +    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
 +
 +    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 +
 +    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 +        return 1;
 +    }
 +
 +    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 +                &nt_hdrs, sizeof(nt_hdrs), 0)) {
 +        return 1;
 +    }
 +
 +    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 +            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 +        return 1;
 +    }
 +
 +    if (va_space_rw(vs,
 +                base + data_dir[idx].VirtualAddress,
 +                entry, size, 0)) {
 +        return 1;
 +    }
 +
 +    printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
 +            (uint32_t)data_dir[idx].VirtualAddress);
 +
 +    return 0;
 +}
 +
  static int write_dump(struct pa_space *ps,
          WinDumpHeader64 *hdr, const char *name)
  {
-     uint32_t end_len;
+@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
+ static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
-@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
+         char *hash, struct va_space *vs)
-         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
+ {
 -    const char e_magic[2] = "MZ";
 -    const char Signature[4] = "PE\0\0";
      const char sign_rsds[4] = "RSDS";
 -    IMAGE_DOS_HEADER *dos_hdr = start_addr;
 -    IMAGE_NT_HEADERS64 nt_hdrs;
 -    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
 -    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
 -    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
      IMAGE_DEBUG_DIRECTORY debug_dir;
      OMFSignatureRSDS rsds;
      char *pdb_name;
      size_t pdb_name_sz;
      size_t i;
 -    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 -
 -    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 -        return 1;
 -    }
 -
 -    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 -                &nt_hdrs, sizeof(nt_hdrs), 0)) {
 -        return 1;
 -    }
 -
 -    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 -            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 -        return 1;
 -    }
 -
 -    printf("Debug Directory RVA = 0x%08"PRIx32"\n",
 -            (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
 -
 -    if (va_space_rw(vs,
 -                base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
 -                &debug_dir, sizeof(debug_dir), 0)) {
 +    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
 +                &debug_dir, sizeof(debug_dir), vs)) {
 +        eprintf("Failed to get Debug Directory\n");
          return 1;
      }
--    return sve_zcr_get_valid_len(cpu, zcr_len);
-+    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
- }
- static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 --
-.20.1
+.34.1

-[PULL 08/14] hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
+[PULL 5/8] contrib/elf2dmp: add PE name check and Windows Server 2022 support
-In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
+From: Viktor Prutyanov <viktor@daynix.com>
 the register is accessed NonSecure and the highest priority pending
 enabled exception (that would be returned in the VECTPENDING field)
 targets Secure, then the VECTPENDING field must read 1 rather than
 the exception number of the pending exception. Implement this.
+Since its inception elf2dmp has checked MZ signatures within an
+address space above IDT[0] interrupt vector and took first PE image
+found as Windows Kernel.
+But in Windows Server 2022 memory dump this address space range is
+full of invalid PE fragments and the tool must check that PE image
+is 'ntoskrnl.exe' actually.
+So, introduce additional validation by checking image name from
+Export Directory against 'ntoskrnl.exe'.
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
+Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Reviewed-by: Annie Li <annie.li@oracle.com>
+Message-id: 20230222211246.883679-4-viktor@daynix.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
+ contrib/elf2dmp/pe.h   | 15 +++++++++++++++
-file changed, 24 insertions(+), 7 deletions(-)
+ contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++--
 files changed, 41 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/contrib/elf2dmp/pe.h
-+++ b/hw/intc/armv7m_nvic.c
++++ b/contrib/elf2dmp/pe.h
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
+@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 {
-     nvic_irq_update(s);
+     IMAGE_OPTIONAL_HEADER64 OptionalHeader;
  } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 +typedef struct IMAGE_EXPORT_DIRECTORY {
 +    uint32_t    Characteristics;
 +    uint32_t    TimeDateStamp;
 +    uint16_t    MajorVersion;
 +    uint16_t    MinorVersion;
 +    uint32_t    Name;
 +    uint32_t    Base;
 +    uint32_t    NumberOfFunctions;
 +    uint32_t    NumberOfNames;
 +    uint32_t    AddressOfFunctions;
 +    uint32_t    AddressOfNames;
 +    uint32_t    AddressOfNameOrdinals;
 +} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;
 +
  typedef struct IMAGE_DEBUG_DIRECTORY {
      uint32_t Characteristics;
      uint32_t TimeDateStamp;
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY {
  #define IMAGE_DEBUG_TYPE_CODEVIEW   2
  #endif
 +#define IMAGE_FILE_EXPORT_DIRECTORY 0
  #define IMAGE_FILE_DEBUG_DIRECTORY  6
  typedef struct guid_t {
 diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/main.c
 +++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@
  #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
  #define PDB_NAME    "ntkrnlmp.pdb"
 +#define PE_NAME     "ntoskrnl.exe"
  #define INITIAL_MXCSR   0x1f80
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
      return fclose(dmp_file);
  }
-+static bool vectpending_targets_secure(NVICState *s)
++static bool pe_check_export_name(uint64_t base, void *start_addr,
 +        struct va_space *vs)
 +{
-+    /* Return true if s->vectpending targets Secure state */
++    IMAGE_EXPORT_DIRECTORY export_dir;
-+    if (s->vectpending_is_s_banked) {
++    const char *pe_name;
-+        return true;
++
 +    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY,
 +                &export_dir, sizeof(export_dir), vs)) {
 +        return false;
 +    }
-+    return !exc_is_banked(s->vectpending) &&
++
-+        exc_targets_secure(s, s->vectpending);
++    pe_name = va_space_resolve(vs, base + export_dir.Name);
 +    if (!pe_name) {
 +        return false;
 +    }
 +
 +    return !strcmp(pe_name, PE_NAME);
 +}
 +
- void armv7m_nvic_get_pending_irq_info(void *opaque,
+ static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
-                                       int *pirq, bool *ptargets_secure)
+         char *hash, struct va_space *vs)
  {
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
+     uint64_t KdDebuggerDataBlock;
-     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
+     KDDEBUGGER_DATA64 *kdbg;
+     uint64_t KdVersionBlock;
--    if (s->vectpending_is_s_banked) {
++    bool kernel_found = false;
--        targets_secure = true;
--    } else {
+     if (argc != 3) {
--        targets_secure = !exc_is_banked(pending) &&
+         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
--            exc_targets_secure(s, pending);
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
--    }
+         }
-+    targets_secure = vectpending_targets_secure(s);
+         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
-     trace_nvic_get_pending_irq_info(pending, targets_secure);
+-            break;
++            if (pe_check_export_name(KernBase, nt_start_addr, &vs)) {
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
++                kernel_found = true;
-         /* VECTACTIVE */
++                break;
          val = cpu->env.v7m.exception;
          /* VECTPENDING */
 -        val |= (s->vectpending & 0x1ff) << 12;
 +        if (s->vectpending) {
 +            /*
 +             * From v8.1M VECTPENDING must read as 1 if accessed as
 +             * NonSecure and the highest priority pending and enabled
 +             * exception targets Secure.
 +             */
 +            int vp = s->vectpending;
 +            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
 +                vectpending_targets_secure(s)) {
 +                vp = 1;
 +            }
-+            val |= (vp & 0x1ff) << 12;
+         }
-+        }
+     }
-         /* ISRPENDING - set if any external IRQ is pending */
-         if (nvic_isrpending(s)) {
+-    if (!nt_start_addr) {
-             val |= (1 << 22);
++    if (!kernel_found) {
          eprintf("Failed to find NT kernel image\n");
          err = 1;
          goto out_ps;
 --
-.20.1
+.34.1

-[PULL 01/14] hw/arm/smmuv3: Check 31st bit to see if CD is valid
+[PULL 6/8] hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
-From: Joe Komlodi <joe.komlodi@xilinx.com>
+From: Guenter Roeck <linux@roeck-us.net>
-The bit to see if a CD is valid is the last bit of the first word of the CD.
+The i.MX USB Phy driver does not check register ranges, resulting in out of
 bounds accesses if an attempt is made to access non-existing PHY registers.
 Add range check and conditionally report bad accesses to fix the problem.
-Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
+While at it, also conditionally log attempted writes to non-existing or
-Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com
+read-only registers.
 Reported-by: Qiang Liu <cyruscyliu@gmail.com>
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Tested-by: Qiang Liu <cyruscyliu@gmail.com>
 Message-id: 20230316234926.208874-1-linux@roeck-us.net
 Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
 Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 2 +-
+ hw/usb/imx-usb-phy.c | 19 +++++++++++++++++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 17 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/hw/usb/imx-usb-phy.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/hw/usb/imx-usb-phy.c
-@@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste)
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
- /* CD fields */
+ #include "hw/usb/imx-usb-phy.h"
+ #include "migration/vmstate.h"
--#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
++#include "qemu/log.h"
-+#define CD_VALID(x)   extract32((x)->word[0], 31, 1)
+ #include "qemu/module.h"
- #define CD_ASID(x)    extract32((x)->word[1], 16, 16)
- #define CD_TTB(x, sel)                                      \
+ static const VMStateDescription vmstate_imx_usbphy = {
-     ({                                                      \
+@@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
          value = s->usbphy[index - 3];
          break;
      default:
 -        value = s->usbphy[index];
 +        if (index < USBPHY_MAX) {
 +            value = s->usbphy[index];
 +        } else {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: Read from non-existing USB PHY register 0x%"
 +                          HWADDR_PRIx "\n",
 +                          __func__, offset);
 +            value = 0;
 +        }
          break;
      }
      return (uint64_t)value;
@@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
          s->usbphy[index - 3] ^= value;
          break;
      default:
 -        /* Other registers are read-only */
 +        /* Other registers are read-only or do not exist */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Write to %s USB PHY register 0x%"
 +                      HWADDR_PRIx "\n",
 +                      __func__,
 +                      index >= USBPHY_MAX ? "non-existing" : "read-only",
 +                      offset);
          break;
      }
  }
 --
-.20.1
+.34.1

-[PULL 02/14] qemu-options.hx: Fix formatting of -machine memory-backend option
+Deleted patch
-The documentation of the -machine memory-backend has some minor
-formatting errors:
- * Misindentation of the initial line meant that the whole option
-   section is incorrectly indented in the HTML output compared to
-   the other -machine options
- * The examples weren't indented, which meant that they were formatted
-   as plain run-on text including outputting the "::" as text.
- * The a) b) list has no rst-format markup so it is rendered as
-   a single run-on paragraph
-Fix the formatting.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
----
- qemu-options.hx | 30 +++++++++++++++++-------------
-file changed, 17 insertions(+), 13 deletions(-)
-diff --git a/qemu-options.hx b/qemu-options.hx
-index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -XXX,XX +XXX,XX @@ SRST
-         Enables or disables ACPI Heterogeneous Memory Attribute Table
-         (HMAT) support. The default is off.
--     ``memory-backend='id'``
-+    ``memory-backend='id'``
-         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
-         Allows to use a memory backend as main RAM.
-         For example:
-         ::
--        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
--        -machine memory-backend=pc.ram
--        -m 512M
-+
-+            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
-+            -machine memory-backend=pc.ram
-+            -m 512M
-         Migration compatibility note:
--        a) as backend id one shall use value of 'default-ram-id', advertised by
--        machine type (available via ``query-machines`` QMP command), if migration
--        to/from old QEMU (<5.0) is expected.
--        b) for machine types 4.0 and older, user shall
--        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
--        if migration to/from old QEMU (<5.0) is expected.
-+
-+        * as backend id one shall use value of 'default-ram-id', advertised by
-+          machine type (available via ``query-machines`` QMP command), if migration
-+          to/from old QEMU (<5.0) is expected.
-+        * for machine types 4.0 and older, user shall
-+          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
-+          if migration to/from old QEMU (<5.0) is expected.
-+
-         For example:
-         ::
--        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
--        -machine memory-backend=pc.ram
--        -m 512M
-+
-+            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
-+            -machine memory-backend=pc.ram
-+            -m 512M
- ERST
- HXCOMM Deprecated by -machine
---
-.20.1

-[PULL 10/14] target/arm: Correctly bound length in sve_zcr_get_valid_len
+[PULL 7/8] docs/system/arm/cpu-features.rst: Fix formatting
-From: Richard Henderson <richard.henderson@linaro.org>
+The markup for the Arm CPU feature documentation is incorrect,
 and results in the HTML not rendering correctly -- the first
 line of each description is rendered in boldface as if it
 were part of the option name.
-Currently, our only caller is sve_zcr_len_for_el, which has
+Reformat to match the styling used in cpu-models-x86.rst.inc.
 already masked the length extracted from ZCR_ELx, so the
 masking done here is a nop.  But we will shortly have uses
 from other locations, where the length will be unmasked.
-Saturate the length to ARM_MAX_VQ instead of truncating to
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479
-the low 4 bits.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org
 Reviewed-by: Cornelia Huck <cohuck@redhat.com>
 ---
  docs/system/arm/cpu-features.rst | 68 ++++++++++++++------------------
 file changed, 30 insertions(+), 38 deletions(-)
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 4 +++-
 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/docs/system/arm/cpu-features.rst
-+++ b/target/arm/helper.c
++++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+@@ -XXX,XX +XXX,XX @@ are named with the prefix "kvm-".  KVM VCPU features may be probed,
- {
+ enabled, and disabled in the same way as other CPU features.  Below is
-     uint32_t end_len;
+ the list of KVM VCPU features and their descriptions.
--    end_len = start_len &= 0xf;
+-  kvm-no-adjvtime          By default kvm-no-adjvtime is disabled.  This
-+    start_len = MIN(start_len, ARM_MAX_VQ - 1);
+-                           means that by default the virtual time
-+    end_len = start_len;
+-                           adjustment is enabled (vtime is not *not*
-+
+-                           adjusted).
-     if (!test_bit(start_len, cpu->sve_vq_map)) {
++``kvm-no-adjvtime``
-         end_len = find_last_bit(cpu->sve_vq_map, start_len);
++  By default kvm-no-adjvtime is disabled.  This means that by default
-         assert(end_len < start_len);
++  the virtual time adjustment is enabled (vtime is not *not* adjusted).
 -                           When virtual time adjustment is enabled each
 -                           time the VM transitions back to running state
 -                           the VCPU's virtual counter is updated to ensure
 -                           stopped time is not counted.  This avoids time
 -                           jumps surprising guest OSes and applications,
 -                           as long as they use the virtual counter for
 -                           timekeeping.  However it has the side effect of
 -                           the virtual and physical counters diverging.
 -                           All timekeeping based on the virtual counter
 -                           will appear to lag behind any timekeeping that
 -                           does not subtract VM stopped time.  The guest
 -                           may resynchronize its virtual counter with
 -                           other time sources as needed.
 +  When virtual time adjustment is enabled each time the VM transitions
 +  back to running state the VCPU's virtual counter is updated to
 +  ensure stopped time is not counted.  This avoids time jumps
 +  surprising guest OSes and applications, as long as they use the
 +  virtual counter for timekeeping.  However it has the side effect of
 +  the virtual and physical counters diverging.  All timekeeping based
 +  on the virtual counter will appear to lag behind any timekeeping
 +  that does not subtract VM stopped time.  The guest may resynchronize
 +  its virtual counter with other time sources as needed.
 -                           Enable kvm-no-adjvtime to disable virtual time
 -                           adjustment, also restoring the legacy (pre-5.0)
 -                           behavior.
 +  Enable kvm-no-adjvtime to disable virtual time adjustment, also
 +  restoring the legacy (pre-5.0) behavior.
 -  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
 -                           default when KVM is enabled, the feature is
 -                           supported, and the guest is 64-bit.
 +``kvm-steal-time``
 +  Since v5.2, kvm-steal-time is enabled by default when KVM is
 +  enabled, the feature is supported, and the guest is 64-bit.
 -                           When kvm-steal-time is enabled a 64-bit guest
 -                           can account for time its CPUs were not running
 -                           due to the host not scheduling the corresponding
 -                           VCPU threads.  The accounting statistics may
 -                           influence the guest scheduler behavior and/or be
 -                           exposed to the guest userspace.
 +  When kvm-steal-time is enabled a 64-bit guest can account for time
 +  its CPUs were not running due to the host not scheduling the
 +  corresponding VCPU threads.  The accounting statistics may influence
 +  the guest scheduler behavior and/or be exposed to the guest
 +  userspace.
  TCG VCPU Features
  =================
@@ -XXX,XX +XXX,XX @@ TCG VCPU Features
  TCG VCPU features are CPU features that are specific to TCG.
  Below is the list of TCG VCPU features and their descriptions.
 -  pauth-impdef             When ``FEAT_Pauth`` is enabled, either the
 -                           *impdef* (Implementation Defined) algorithm
 -                           is enabled or the *architected* QARMA algorithm
 -                           is enabled.  By default the impdef algorithm
 -                           is disabled, and QARMA is enabled.
 +``pauth-impdef``
 +  When ``FEAT_Pauth`` is enabled, either the *impdef* (Implementation
 +  Defined) algorithm is enabled or the *architected* QARMA algorithm
 +  is enabled.  By default the impdef algorithm is disabled, and QARMA
 +  is enabled.
 -                           The architected QARMA algorithm has good
 -                           cryptographic properties, but can be quite slow
 -                           to emulate.  The impdef algorithm used by QEMU
 -                           is non-cryptographic but significantly faster.
 +  The architected QARMA algorithm has good cryptographic properties,
 +  but can be quite slow to emulate.  The impdef algorithm used by QEMU
 +  is non-cryptographic but significantly faster.
  SVE CPU Properties
  ==================
 --
-.20.1
+.34.1

-[PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always zero
+[PULL 8/8] target/arm: Don't advertise aarch64-pauth.xml to gdb
-For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
+Unfortunately a bug in older versions of gdb means that they will
-RES0H, which is to say that they must be hardwired to zero so that
+crash if QEMU sends them the aarch64-pauth.xml.  This bug is fixed in
-guest attempts to write non-zero values to them are ignored.
+gdb commit 1ba3a3222039eb25, and there are plans to backport that to
 affected gdb release branches, but since the bug affects gdb 9
 through 12 it is very widely deployed (for instance by distros).
-Implement this behaviour by masking out the low bits:
+It is not currently clear what the best way to deal with this is; it
- * for writes to r13 by the gdbstub
+has been proposed to define a new XML feature name that old gdb will
- * for writes to any of the various flavours of SP via MSR
+ignore but newer gdb can handle.  Since QEMU's 8.0 release is
- * for writes to r13 via store_reg() in generated code
+imminent and at least one of our CI runners is now falling over this,
+disable the pauth XML for the moment.  We can follow up with a more
-Note that all the direct uses of cpu_R[] in translate.c are in places
+considered fix either in time for 8.0 or else for the 8.1 release.
 where the register is definitely not r13 (usually because that has
 been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
 UNDEF).
 All the other writes to regs[13] in C code are either:
  * A-profile only code
  * writes of values we can guarantee to be aligned, such as
    - writes of previous-SP-value plus or minus a 4-aligned constant
    - writes of the value in an SP limit register (which we already
      enforce to be aligned)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
 ---
- target/arm/gdbstub.c   |  4 ++++
+ target/arm/gdbstub.c | 7 +++++++
- target/arm/m_helper.c  | 14 ++++++++------
+file changed, 7 insertions(+)
  target/arm/translate.c |  3 +++
 files changed, 15 insertions(+), 6 deletions(-)
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
+                                      aarch64_gdb_set_fpu_reg,
-     if (n < 16) {
+, "aarch64-fpu.xml", 0);
          /* Core integer register.  */
 +        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
 +            /* M profile SP low bits are always 0 */
 +            tmp &= ~3;
 +        }
          env->regs[n] = tmp;
          return 4;
      }
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
              if (!env->v7m.secure) {
                  return;
              }
 -            env->v7m.other_ss_msp = val;
 +            env->v7m.other_ss_msp = val & ~3;
              return;
          case 0x89: /* PSP_NS */
              if (!env->v7m.secure) {
                  return;
              }
 -            env->v7m.other_ss_psp = val;
 +            env->v7m.other_ss_psp = val & ~3;
              return;
          case 0x8a: /* MSPLIM_NS */
              if (!env->v7m.secure) {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
              limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
 +            val &= ~0x3;
 +
              if (val < limit) {
                  raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
              }
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
          break;
      case 8: /* MSP */
          if (v7m_using_psp(env)) {
 -            env->v7m.other_sp = val;
 +            env->v7m.other_sp = val & ~3;
          } else {
 -            env->regs[13] = val;
 +            env->regs[13] = val & ~3;
          }
-         break;
++#if 0
-     case 9: /* PSP */
++        /*
-         if (v7m_using_psp(env)) {
++         * GDB versions 9 through 12 have a bug which means they will
--            env->regs[13] = val;
++         * crash if they see this XML from QEMU; disable it for the 8.0
-+            env->regs[13] = val & ~3;
++         * release, pending a better solution.
-         } else {
++         */
--            env->v7m.other_sp = val;
+         if (isar_feature_aa64_pauth(&cpu->isar)) {
-+            env->v7m.other_sp = val & ~3;
+             gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
                                       aarch64_gdb_set_pauth_reg,
 , "aarch64-pauth.xml", 0);
          }
-         break;
++#endif
-     case 10: /* MSPLIM */
+ #endif
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+     } else {
-index XXXXXXX..XXXXXXX 100644
+         if (arm_feature(env, ARM_FEATURE_NEON)) {
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
           */
          tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
          s->base.is_jmp = DISAS_JUMP;
 +    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
 +        /* For M-profile SP bits [1:0] are always zero */
 +        tcg_gen_andi_i32(var, var, ~3);
      }
      tcg_gen_mov_i32(cpu_R[reg], var);
      tcg_temp_free_i32(var);
 --
-.20.1
+.34.1

-[PULL 04/14] target/arm: Add missing 'return's after calling v7m_exception_taken()
+Deleted patch
-In do_v7m_exception_exit(), we perform various checks as part of
-performing the exception return.  If one of these checks fails, the
-architecture requires that we take an appropriate exception on the
-existing stackframe.  We implement this by calling
-v7m_exception_taken() to set up to take the new exception, and then
-immediately returning from do_v7m_exception_exit() without proceeding
-any further with the unstack-and-exception-return process.
-In a couple of checks that are new in v8.1M, we forgot the "return"
-statement, with the effect that if bad code in the guest tripped over
-these checks we would set up to take a UsageFault exception but then
-blunder on trying to also unstack and return from the original
-exception, with the probable result that the guest would crash.
-Add the missing return statements.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
----
- target/arm/m_helper.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
-+++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-                         "stackframe: NSACR prevents clearing FPU registers\n");
-                     v7m_exception_taken(cpu, excret, true, false);
-+                    return;
-                 } else if (!cpacr_pass) {
-                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
-                                             exc_secure);
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-                         "stackframe: CPACR prevents clearing FPU registers\n");
-                     v7m_exception_taken(cpu, excret, true, false);
-+                    return;
-                 }
-             }
-             /* Clear s0..s15, FPSCR and VPR */
---
-.20.1

-[PULL 05/14] target/arm: Report M-profile alignment faults correctly to the guest
+Deleted patch
-For M-profile, we weren't reporting alignment faults triggered by the
-generic TCG code correctly to the guest.  These get passed into
-arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
-style exception.fsr value of 1.  We didn't check for this, and so
-they fell through into the default of "assume this is an MPU fault"
-and were reported to the guest as a data access violation MPU fault.
-Report these alignment faults as UsageFaults which set the UNALIGNED
-bit in the UFSR.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
----
- target/arm/m_helper.c | 8 ++++++++
-file changed, 8 insertions(+)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
-+++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
-         break;
-     case EXCP_UNALIGNED:
-+        /* Unaligned faults reported by M-profile aware code */
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
-         break;
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-             }
-             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
-             break;
-+        case 0x1: /* Alignment fault reported by generic code */
-+            qemu_log_mask(CPU_LOG_INT,
-+                          "...really UsageFault with UFSR.UNALIGNED\n");
-+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
-+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
-+                                    env->v7m.secure);
-+            break;
-         default:
-             /*
-              * All other FSR values are either MPU faults or "can't happen
---
-.20.1

-[PULL 06/14] hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
+Deleted patch
-The ISCR.ISRPENDING bit is set when an external interrupt is pending.
-This is true whether that external interrupt is enabled or not.
-This means that we can't use 's->vectpending == 0' as a shortcut to
-"ISRPENDING is zero", because s->vectpending indicates only the
-highest priority pending enabled interrupt.
-Remove the incorrect optimization so that if there is no pending
-enabled interrupt we fall through to scanning through the whole
-interrupt array.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 9 ++++-----
-file changed, 4 insertions(+), 5 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
- {
-     int irq;
--    /* We can shortcut if the highest priority pending interrupt
--     * happens to be external or if there is nothing pending.
-+    /*
-+     * We can shortcut if the highest priority pending interrupt
-+     * happens to be external; if not we need to check the whole
-+     * vectors[] array.
-      */
-     if (s->vectpending > NVIC_FIRST_IRQ) {
-         return true;
-     }
--    if (s->vectpending == 0) {
--        return false;
--    }
-     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
-         if (s->vectors[irq].pending) {
---
-.20.1

-[PULL 07/14] hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
+Deleted patch
-The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
-the register.  We were incorrectly masking it to 8 bits, so it would
-report the wrong value if the pending exception was greater than 256.
-Fix the bug.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-         /* VECTACTIVE */
-         val = cpu->env.v7m.exception;
-         /* VECTPENDING */
--        val |= (s->vectpending & 0xff) << 12;
-+        val |= (s->vectpending & 0x1ff) << 12;
-         /* ISRPENDING - set if any external IRQ is pending */
-         if (nvic_isrpending(s)) {
-             val |= (1 << 22);
---
-.20.1

-[PULL 09/14] docs: Update path that mentions deprecated.rst
+Deleted patch
-From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
-Missed in commit f3478392 "docs: Move deprecation, build
-and license info out of system/"
-Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure         | 2 +-
- target/i386/cpu.c | 2 +-
- MAINTAINERS       | 2 +-
-files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ fi
- if test -n "${deprecated_features}"; then
-     echo "Warning, deprecated features enabled."
--    echo "Please see docs/system/deprecated.rst"
-+    echo "Please see docs/about/deprecated.rst"
-     echo "  features: ${deprecated_features}"
- fi
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
-  * none", but this is just for compatibility while libvirt isn't
-  * adapted to resolve CPU model versions before creating VMs.
-  * See "Runnability guarantee of CPU models" at
-- * docs/system/deprecated.rst.
-+ * docs/about/deprecated.rst.
-  */
- X86CPUVersion default_cpu_version = 1;
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
- Incompatible changes
- R: libvir-list@redhat.com
--F: docs/system/deprecated.rst
-+F: docs/about/deprecated.rst
- Build System
- ------------
---
-.20.1

arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
patches, which are somewhere between a bugfix and a new feature.

thanks
-- PMM

The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727

for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:

hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/smmuv3: Check 31st bit to see if CD is valid
 * qemu-options.hx: Fix formatting of -machine memory-backend option
 * hw: aspeed_gpio: Fix memory size
 * hw/arm/nseries: Display hexadecimal value with '0x' prefix
 * Add sve-default-vector-length cpu property
 * docs: Update path that mentions deprecated.rst
 * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
 * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
 * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
 * target/arm: Report M-profile alignment faults correctly to the guest
 * target/arm: Add missing 'return's after calling v7m_exception_taken()
 * target/arm: Enforce that M-profile SP low 2 bits are always zero

----------------------------------------------------------------
Joe Komlodi (1):
      hw/arm/smmuv3: Check 31st bit to see if CD is valid

Joel Stanley (1):
      hw: aspeed_gpio: Fix memory size

Mao Zhongyi (1):
      docs: Update path that mentions deprecated.rst

Peter Maydell (7):
      qemu-options.hx: Fix formatting of -machine memory-backend option
      target/arm: Enforce that M-profile SP low 2 bits are always zero
      target/arm: Add missing 'return's after calling v7m_exception_taken()
      target/arm: Report M-profile alignment faults correctly to the guest
      hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
      hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
      hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS

Philippe Mathieu-Daudé (1):
      hw/arm/nseries: Display hexadecimal value with '0x' prefix

Richard Henderson (3):
      target/arm: Correctly bound length in sve_zcr_get_valid_len
      target/arm: Export aarch64_sve_zcr_get_valid_len
      target/arm: Add sve-default-vector-length cpu property

The documentation of the -machine memory-backend has some minor
formatting errors:
 * Misindentation of the initial line meant that the whole option
   section is incorrectly indented in the HTML output compared to
   the other -machine options
 * The examples weren't indented, which meant that they were formatted
   as plain run-on text including outputting the "::" as text.
 * The a) b) list has no rst-format markup so it is rendered as
   a single run-on paragraph

Fix the formatting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
---
 qemu-options.hx | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
         Enables or disables ACPI Heterogeneous Memory Attribute Table
         (HMAT) support. The default is off.
 
-     ``memory-backend='id'``
+    ``memory-backend='id'``
         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
         Allows to use a memory backend as main RAM.
 
         For example:
         ::
-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
+            -machine memory-backend=pc.ram
+            -m 512M
 
         Migration compatibility note:
-        a) as backend id one shall use value of 'default-ram-id', advertised by
-        machine type (available via ``query-machines`` QMP command), if migration
-        to/from old QEMU (<5.0) is expected.
-        b) for machine types 4.0 and older, user shall
-        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
-        if migration to/from old QEMU (<5.0) is expected.
+
+        * as backend id one shall use value of 'default-ram-id', advertised by
+          machine type (available via ``query-machines`` QMP command), if migration
+          to/from old QEMU (<5.0) is expected.
+        * for machine types 4.0 and older, user shall
+          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
+          if migration to/from old QEMU (<5.0) is expected.
+
         For example:
         ::
-        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
+            -machine memory-backend=pc.ram
+            -m 512M
 ERST
 
 HXCOMM Deprecated by -machine
-- 
2.20.1

For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
RES0H, which is to say that they must be hardwired to zero so that
guest attempts to write non-zero values to them are ignored.

Implement this behaviour by masking out the low bits:
 * for writes to r13 by the gdbstub
 * for writes to any of the various flavours of SP via MSR
 * for writes to r13 via store_reg() in generated code

Note that all the direct uses of cpu_R[] in translate.c are in places
where the register is definitely not r13 (usually because that has
been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
UNDEF).

All the other writes to regs[13] in C code are either:
 * A-profile only code
 * writes of values we can guarantee to be aligned, such as
   - writes of previous-SP-value plus or minus a 4-aligned constant
   - writes of the value in an SP limit register (which we already
     enforce to be aligned)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
---
 target/arm/gdbstub.c   |  4 ++++
 target/arm/m_helper.c  | 14 ++++++++------
 target/arm/translate.c |  3 +++
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 
     if (n < 16) {
         /* Core integer register.  */
+        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
+            /* M profile SP low bits are always 0 */
+            tmp &= ~3;
+        }
         env->regs[n] = tmp;
         return 4;
     }
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_msp = val;
+            env->v7m.other_ss_msp = val & ~3;
             return;
         case 0x89: /* PSP_NS */
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_psp = val;
+            env->v7m.other_ss_psp = val & ~3;
             return;
         case 0x8a: /* MSPLIM_NS */
             if (!env->v7m.secure) {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
 
             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
 
+            val &= ~0x3;
+
             if (val < limit) {
                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
             }
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         break;
     case 8: /* MSP */
         if (v7m_using_psp(env)) {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         } else {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         }
         break;
     case 9: /* PSP */
         if (v7m_using_psp(env)) {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         } else {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         }
         break;
     case 10: /* MSPLIM */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
          */
         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
         s->base.is_jmp = DISAS_JUMP;
+    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
+        /* For M-profile SP bits [1:0] are always zero */
+        tcg_gen_andi_i32(var, var, ~3);
     }
     tcg_gen_mov_i32(cpu_R[reg], var);
     tcg_temp_free_i32(var);
-- 
2.20.1

In do_v7m_exception_exit(), we perform various checks as part of
performing the exception return.  If one of these checks fails, the
architecture requires that we take an appropriate exception on the
existing stackframe.  We implement this by calling
v7m_exception_taken() to set up to take the new exception, and then
immediately returning from do_v7m_exception_exit() without proceeding
any further with the unstack-and-exception-return process.

In a couple of checks that are new in v8.1M, we forgot the "return"
statement, with the effect that if bad code in the guest tripped over
these checks we would set up to take a UsageFault exception but then
blunder on trying to also unstack and return from the original
exception, with the probable result that the guest would crash.

Add the missing return statements.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: NSACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 } else if (!cpacr_pass) {
                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                             exc_secure);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: CPACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 }
             }
             /* Clear s0..s15, FPSCR and VPR */
-- 
2.20.1

For M-profile, we weren't reporting alignment faults triggered by the
generic TCG code correctly to the guest.  These get passed into
arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
style exception.fsr value of 1.  We didn't check for this, and so
they fell through into the default of "assume this is an MPU fault"
and were reported to the guest as a data access violation MPU fault.

Report these alignment faults as UsageFaults which set the UNALIGNED
bit in the UFSR.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
         break;
     case EXCP_UNALIGNED:
+        /* Unaligned faults reported by M-profile aware code */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
         break;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
             }
             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
             break;
+        case 0x1: /* Alignment fault reported by generic code */
+            qemu_log_mask(CPU_LOG_INT,
+                          "...really UsageFault with UFSR.UNALIGNED\n");
+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                    env->v7m.secure);
+            break;
         default:
             /*
              * All other FSR values are either MPU faults or "can't happen
-- 
2.20.1

The ISCR.ISRPENDING bit is set when an external interrupt is pending.
This is true whether that external interrupt is enabled or not.
This means that we can't use 's->vectpending == 0' as a shortcut to
"ISRPENDING is zero", because s->vectpending indicates only the
highest priority pending enabled interrupt.

Remove the incorrect optimization so that if there is no pending
enabled interrupt we fall through to scanning through the whole
interrupt array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
 {
     int irq;
 
-    /* We can shortcut if the highest priority pending interrupt
-     * happens to be external or if there is nothing pending.
+    /*
+     * We can shortcut if the highest priority pending interrupt
+     * happens to be external; if not we need to check the whole
+     * vectors[] array.
      */
     if (s->vectpending > NVIC_FIRST_IRQ) {
         return true;
     }
-    if (s->vectpending == 0) {
-        return false;
-    }
 
     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
         if (s->vectors[irq].pending) {
-- 
2.20.1

The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
the register.  We were incorrectly masking it to 8 bits, so it would
report the wrong value if the pending exception was greater than 256.
Fix the bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0xff) << 12;
+        val |= (s->vectpending & 0x1ff) << 12;
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
the register is accessed NonSecure and the highest priority pending
enabled exception (that would be returned in the VECTPENDING field)
targets Secure, then the VECTPENDING field must read 1 rather than
the exception number of the pending exception. Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     nvic_irq_update(s);
 }
 
+static bool vectpending_targets_secure(NVICState *s)
+{
+    /* Return true if s->vectpending targets Secure state */
+    if (s->vectpending_is_s_banked) {
+        return true;
+    }
+    return !exc_is_banked(s->vectpending) &&
+        exc_targets_secure(s, s->vectpending);
+}
+
 void armv7m_nvic_get_pending_irq_info(void *opaque,
                                       int *pirq, bool *ptargets_secure)
 {
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
 
     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
 
-    if (s->vectpending_is_s_banked) {
-        targets_secure = true;
-    } else {
-        targets_secure = !exc_is_banked(pending) &&
-            exc_targets_secure(s, pending);
-    }
+    targets_secure = vectpending_targets_secure(s);
 
     trace_nvic_get_pending_irq_info(pending, targets_secure);
 
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0x1ff) << 12;
+        if (s->vectpending) {
+            /*
+             * From v8.1M VECTPENDING must read as 1 if accessed as
+             * NonSecure and the highest priority pending and enabled
+             * exception targets Secure.
+             */
+            int vp = s->vectpending;
+            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
+                vectpending_targets_secure(s)) {
+                vp = 1;
+            }
+            val |= (vp & 0x1ff) << 12;
+        }
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>

Missed in commit f3478392 "docs: Move deprecation, build
and license info out of system/"

Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure         | 2 +-
 target/i386/cpu.c | 2 +-
 MAINTAINERS       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 
 if test -n "${deprecated_features}"; then
     echo "Warning, deprecated features enabled."
-    echo "Please see docs/system/deprecated.rst"
+    echo "Please see docs/about/deprecated.rst"
     echo "  features: ${deprecated_features}"
 fi
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
  * none", but this is just for compatibility while libvirt isn't
  * adapted to resolve CPU model versions before creating VMs.
  * See "Runnability guarantee of CPU models" at
- * docs/system/deprecated.rst.
+ * docs/about/deprecated.rst.
  */
 X86CPUVersion default_cpu_version = 1;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
 
 Incompatible changes
 R: libvir-list@redhat.com
-F: docs/system/deprecated.rst
+F: docs/about/deprecated.rst
 
 Build System
 ------------
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Currently, our only caller is sve_zcr_len_for_el, which has
already masked the length extracted from ZCR_ELx, so the
masking done here is a nop.  But we will shortly have uses
from other locations, where the length will be unmasked.

Saturate the length to ARM_MAX_VQ instead of truncating to
the low 4 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
-    end_len = start_len &= 0xf;
+    start_len = MIN(start_len, ARM_MAX_VQ - 1);
+    end_len = start_len;
+
     if (!test_bit(start_len, cpu->sve_vq_map)) {
         end_len = find_last_bit(cpu->sve_vq_map, start_len);
         assert(end_len < start_len);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from sve_zcr_get_valid_len and make accessible
from outside of helper.c.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
 void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 #endif /* CONFIG_TCG */
 
+/**
+ * aarch64_sve_zcr_get_valid_len:
+ * @cpu: cpu context
+ * @start_len: maximum len to consider
+ *
+ * Return the maximum supported sve vector length <= @start_len.
+ * Note that both @start_len and the return value are in units
+ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
+ */
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
 
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
-static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
 
-    return sve_zcr_get_valid_len(cpu, zcr_len);
+    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Mirror the behavour of /proc/sys/abi/sve_default_vector_length
under the real linux kernel.  We have no way of passing along
a real default across exec like the kernel can, but this is a
decent way of adjusting the startup vector length of a process.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
[PMM: tweaked docs formatting, document -1 special-case,
 added fixup patch from RTH mentioning QEMU's maximum veclen.]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 15 ++++++++
 target/arm/cpu.h                 |  5 +++
 target/arm/cpu.c                 | 14 ++++++--
 target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 4 files changed, 92 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
 example's (1), (4), and (6) exhibit recommended uses of the properties.
 
+SVE User-mode Default Vector Length Property
+--------------------------------------------
+
+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
+defined to mirror the Linux kernel parameter file
+``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
+is in units of bytes and must be between 16 and 8192.
+If not specified, the default vector length is 64.
+
+If the default length is larger than the maximum vector length enabled,
+the actual vector length will be reduced.  Note that the maximum vector
+length supported by QEMU is 256.
+
+If this property is set to ``-1`` then the default vector length
+is set to the maximum possible length.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
 
+#ifdef CONFIG_USER_ONLY
+    /* Used to set the default vector length at process start. */
+    uint32_t sve_default_vq;
+#endif
+
     /*
      * In sve_vq_map each set bit is a supported vector length of
      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
         /* with reasonable vector length */
         if (cpu_isar_feature(aa64_sve, cpu)) {
-            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
+            env->vfp.zcr_el[1] =
+                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
         }
         /*
          * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
 
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_USER_ONLY
+# ifdef TARGET_AARCH64
+    /*
+     * The linux kernel defaults to 512-bit vectors, when sve is supported.
+     * See documentation for /proc/sys/abi/sve_default_vector_length, and
+     * our corresponding sve-default-vector-length cpu property.
+     */
+    cpu->sve_default_vq = 4;
+# endif
+#else
     /* Our inbound IRQ and FIQ lines */
     if (kvm_enabled()) {
         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
     cpu->isar.id_aa64pfr0 = t;
 }
 
+#ifdef CONFIG_USER_ONLY
+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t default_len, default_vq, remainder;
+
+    if (!visit_type_int32(v, name, &default_len, errp)) {
+        return;
+    }
+
+    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
+    if (default_len == -1) {
+        cpu->sve_default_vq = ARM_MAX_VQ;
+        return;
+    }
+
+    default_vq = default_len / 16;
+    remainder = default_len % 16;
+
+    /*
+     * Note that the 512 max comes from include/uapi/asm/sve_context.h
+     * and is the maximum architectural width of ZCR_ELx.LEN.
+     */
+    if (remainder || default_vq < 1 || default_vq > 512) {
+        error_setg(errp, "cannot set sve-default-vector-length");
+        if (remainder) {
+            error_append_hint(errp, "Vector length not a multiple of 16\n");
+        } else if (default_vq < 1) {
+            error_append_hint(errp, "Vector length smaller than 16\n");
+        } else {
+            error_append_hint(errp, "Vector length larger than %d\n",
+                              512 * 16);
+        }
+        return;
+    }
+
+    cpu->sve_default_vq = default_vq;
+}
+
+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t value = cpu->sve_default_vq * 16;
+
+    visit_type_int32(v, name, &value, errp);
+}
+#endif
+
 void aarch64_add_sve_properties(Object *obj)
 {
     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
         object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                             cpu_arm_set_sve_vq, NULL, NULL);
     }
+
+#ifdef CONFIG_USER_ONLY
+    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+    object_property_add(obj, "sve-default-vector-length", "int32",
+                        cpu_arm_get_sve_default_vec_len,
+                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
+#endif
 }
 
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The macro used to calculate the maximum memory size of the MMIO region
had a mistake, causing all GPIO models to create a mapping of 0x9D8.
The intent was to have it be 0x9D8 - 0x800.

This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
region set aside for the GPIO controller.

On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
regions would overlap. Worse was the 1.8V controller would map over the
top of the following peripheral, which happens to be the RTC.

The mmio region used by each device is a maximum of 2KB, so avoid the
calculations and hard code this as the maximum.

Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20210713065854.134634-2-joel@jms.id.au
[PMM: fix autocorrect error in commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/aspeed_gpio.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 #define GPIO_1_8V_MEM_SIZE            0x9D8
 #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
                                       GPIO_1_8V_REG_OFFSET) >> 2)
-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
 
 static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
+            TYPE_ASPEED_GPIO, 0x800);
 
     sysbus_init_mmio(sbd, &s->iomem);
 }
-- 
2.20.1

The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce:

Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321

for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255:

target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000)

----------------------------------------------------------------
target-arm queue:
 * contrib/elf2dmp: Support Windows Server 2022
 * hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
 * target/arm: Add Neoverse-N1 IMPDEF registers
 * hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
 * docs/system/arm/cpu-features.rst: Fix formatting
 * target/arm: Don't advertise aarch64-pauth.xml to gdb

----------------------------------------------------------------
Chen Baozi (1):
      target/arm: Add Neoverse-N1 registers

Guenter Roeck (1):
      hw/usb/imx: Fix out of bounds access in imx_usbphy_read()

Peter Maydell (3):
      hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
      docs/system/arm/cpu-features.rst: Fix formatting
      target/arm: Don't advertise aarch64-pauth.xml to gdb

Viktor Prutyanov (3):
      contrib/elf2dmp: fix code style
      contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
      contrib/elf2dmp: add PE name check and Windows Server 2022 support

docs/system/arm/cpu-features.rst |  68 ++++++++++-------------
 contrib/elf2dmp/pe.h             | 115 ++++++++++++++++++++++-----------------
 contrib/elf2dmp/addrspace.c      |   1 +
 contrib/elf2dmp/main.c           | 108 ++++++++++++++++++++++++------------
 hw/char/cadence_uart.c           |   6 +-
 hw/usb/imx-usb-phy.c             |  19 ++++++-
 target/arm/cpu64.c               |  69 +++++++++++++++++++++++
 target/arm/gdbstub.c             |   7 +++
 8 files changed, 267 insertions(+), 126 deletions(-)

From: Chen Baozi <chenbaozi@phytium.com.cn>

Add implementation defined registers for neoverse-n1 which
would be accessed by TF-A. Since there is no DSU in Qemu,
CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition.

Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#include "cpregs.h"
 #include "qemu/module.h"
 #include "sysemu/kvm.h"
 #include "sysemu/hvf.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
     /* TODO:  Add A64FX specific HPC extension registers */
 }
 
+static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
+    { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL12", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 5, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "AVTCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 1,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    /*
+     * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU
+     * (and in particular its system registers).
+     */
+    { .name = "CPUCFR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 0, .opc2 = 0,
+      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 },
+    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 },
+    { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPMR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 3,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPOR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 2,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPSELR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+};
+
+static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
+{
+    define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
+}
+
 static void aarch64_neoverse_n1_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
 
     /* From D5.1 AArch64 PMU register summary */
     cpu->isar.reset_pmcr_el0 = 0x410c3000;
+
+    define_neoverse_n1_cp_reginfo(cpu);
 }
 
 static void aarch64_host_initfn(Object *obj)
-- 
2.34.1

The cadence UART attempts to avoid allowing the guest to set invalid
baud rate register values in the uart_write() function.  However it
does the "mask to the size of the register field" and "check for
invalid values" in the wrong order, which means that a malicious
guest can get a bogus value into the register by setting also some
high bits in the value, and cause QEMU to crash by division-by-zero.

Do the mask before the bounds check instead of afterwards.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
---
 hw/char/cadence_uart.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
         }
         break;
     case R_BRGR: /* Baud rate generator */
+        value &= 0xffff;
         if (value >= 0x01) {
-            s->r[offset] = value & 0xFFFF;
+            s->r[offset] = value;
         }
         break;
     case R_BDIV:    /* Baud rate divider */
+        value &= 0xff;
         if (value >= 0x04) {
-            s->r[offset] = value & 0xFF;
+            s->r[offset] = value;
         }
         break;
     default:
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Originally elf2dmp were added with some code style issues,
especially in pe.h header, and some were introduced by
2d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-2-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/pe.h        | 100 ++++++++++++++++++------------------
 contrib/elf2dmp/addrspace.c |   1 +
 contrib/elf2dmp/main.c      |   9 ++--
 3 files changed, 57 insertions(+), 53 deletions(-)

diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pe.h
+++ b/contrib/elf2dmp/pe.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DOS_HEADER {
 } __attribute__ ((packed)) IMAGE_DOS_HEADER;
 
 typedef struct IMAGE_FILE_HEADER {
-  uint16_t  Machine;
-  uint16_t  NumberOfSections;
-  uint32_t  TimeDateStamp;
-  uint32_t  PointerToSymbolTable;
-  uint32_t  NumberOfSymbols;
-  uint16_t  SizeOfOptionalHeader;
-  uint16_t  Characteristics;
+    uint16_t  Machine;
+    uint16_t  NumberOfSections;
+    uint32_t  TimeDateStamp;
+    uint32_t  PointerToSymbolTable;
+    uint32_t  NumberOfSymbols;
+    uint16_t  SizeOfOptionalHeader;
+    uint16_t  Characteristics;
 } __attribute__ ((packed)) IMAGE_FILE_HEADER;
 
 typedef struct IMAGE_DATA_DIRECTORY {
-  uint32_t VirtualAddress;
-  uint32_t Size;
+    uint32_t VirtualAddress;
+    uint32_t Size;
 } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY;
 
 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
 
 typedef struct IMAGE_OPTIONAL_HEADER64 {
-  uint16_t  Magic; /* 0x20b */
-  uint8_t   MajorLinkerVersion;
-  uint8_t   MinorLinkerVersion;
-  uint32_t  SizeOfCode;
-  uint32_t  SizeOfInitializedData;
-  uint32_t  SizeOfUninitializedData;
-  uint32_t  AddressOfEntryPoint;
-  uint32_t  BaseOfCode;
-  uint64_t  ImageBase;
-  uint32_t  SectionAlignment;
-  uint32_t  FileAlignment;
-  uint16_t  MajorOperatingSystemVersion;
-  uint16_t  MinorOperatingSystemVersion;
-  uint16_t  MajorImageVersion;
-  uint16_t  MinorImageVersion;
-  uint16_t  MajorSubsystemVersion;
-  uint16_t  MinorSubsystemVersion;
-  uint32_t  Win32VersionValue;
-  uint32_t  SizeOfImage;
-  uint32_t  SizeOfHeaders;
-  uint32_t  CheckSum;
-  uint16_t  Subsystem;
-  uint16_t  DllCharacteristics;
-  uint64_t  SizeOfStackReserve;
-  uint64_t  SizeOfStackCommit;
-  uint64_t  SizeOfHeapReserve;
-  uint64_t  SizeOfHeapCommit;
-  uint32_t  LoaderFlags;
-  uint32_t  NumberOfRvaAndSizes;
-  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+    uint16_t  Magic; /* 0x20b */
+    uint8_t   MajorLinkerVersion;
+    uint8_t   MinorLinkerVersion;
+    uint32_t  SizeOfCode;
+    uint32_t  SizeOfInitializedData;
+    uint32_t  SizeOfUninitializedData;
+    uint32_t  AddressOfEntryPoint;
+    uint32_t  BaseOfCode;
+    uint64_t  ImageBase;
+    uint32_t  SectionAlignment;
+    uint32_t  FileAlignment;
+    uint16_t  MajorOperatingSystemVersion;
+    uint16_t  MinorOperatingSystemVersion;
+    uint16_t  MajorImageVersion;
+    uint16_t  MinorImageVersion;
+    uint16_t  MajorSubsystemVersion;
+    uint16_t  MinorSubsystemVersion;
+    uint32_t  Win32VersionValue;
+    uint32_t  SizeOfImage;
+    uint32_t  SizeOfHeaders;
+    uint32_t  CheckSum;
+    uint16_t  Subsystem;
+    uint16_t  DllCharacteristics;
+    uint64_t  SizeOfStackReserve;
+    uint64_t  SizeOfStackCommit;
+    uint64_t  SizeOfHeapReserve;
+    uint64_t  SizeOfHeapCommit;
+    uint32_t  LoaderFlags;
+    uint32_t  NumberOfRvaAndSizes;
+    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64;
 
 typedef struct IMAGE_NT_HEADERS64 {
-  uint32_t Signature;
-  IMAGE_FILE_HEADER FileHeader;
-  IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+    uint32_t Signature;
+    IMAGE_FILE_HEADER FileHeader;
+    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 
 typedef struct IMAGE_DEBUG_DIRECTORY {
-  uint32_t Characteristics;
-  uint32_t TimeDateStamp;
-  uint16_t MajorVersion;
-  uint16_t MinorVersion;
-  uint32_t Type;
-  uint32_t SizeOfData;
-  uint32_t AddressOfRawData;
-  uint32_t PointerToRawData;
+    uint32_t Characteristics;
+    uint32_t TimeDateStamp;
+    uint16_t MajorVersion;
+    uint16_t MinorVersion;
+    uint32_t Type;
+    uint32_t SizeOfData;
+    uint32_t AddressOfRawData;
+    uint32_t PointerToRawData;
 } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY;
 
 #define IMAGE_DEBUG_TYPE_CODEVIEW   2
diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/addrspace.c
+++ b/contrib/elf2dmp/addrspace.c
@@ -XXX,XX +XXX,XX @@
 static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
 {
     size_t i;
+
     for (i = 0; i < ps->block_nr; i++) {
         if (ps->block[i].paddr <= pa &&
                 pa <= ps->block[i].paddr + ps->block[i].size) {
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
     };
 
     for (i = 0; i < ps->block_nr; i++) {
-        h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
+        h.PhysicalMemoryBlock.NumberOfPages +=
+                ps->block[i].size / ELF2DMP_PAGE_SIZE;
         h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
             .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
             .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
         };
     }
 
-    h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
+    h.RequiredDumpSpace +=
+            h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
 
     *hdr = h;
 
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
         struct va_space *vs, QEMU_Elf *qe)
 {
-        int i;
+    int i;
+
     for (i = 0; i < qe->state_nr; i++) {
         uint64_t Prcb;
         uint64_t Context;
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Move out PE directory search functionality to be reused not only
for Debug Directory processing but for arbitrary PE directory.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-3-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++-----------------
 1 file changed, 42 insertions(+), 29 deletions(-)

diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
     return 0;
 }
 
+static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
+        void *entry, size_t size, struct va_space *vs)
+{
+    const char e_magic[2] = "MZ";
+    const char Signature[4] = "PE\0\0";
+    IMAGE_DOS_HEADER *dos_hdr = start_addr;
+    IMAGE_NT_HEADERS64 nt_hdrs;
+    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
+    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
+    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
+
+    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
+
+    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
+        return 1;
+    }
+
+    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
+                &nt_hdrs, sizeof(nt_hdrs), 0)) {
+        return 1;
+    }
+
+    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
+            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
+        return 1;
+    }
+
+    if (va_space_rw(vs,
+                base + data_dir[idx].VirtualAddress,
+                entry, size, 0)) {
+        return 1;
+    }
+
+    printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
+            (uint32_t)data_dir[idx].VirtualAddress);
+
+    return 0;
+}
+
 static int write_dump(struct pa_space *ps,
         WinDumpHeader64 *hdr, const char *name)
 {
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
         char *hash, struct va_space *vs)
 {
-    const char e_magic[2] = "MZ";
-    const char Signature[4] = "PE\0\0";
     const char sign_rsds[4] = "RSDS";
-    IMAGE_DOS_HEADER *dos_hdr = start_addr;
-    IMAGE_NT_HEADERS64 nt_hdrs;
-    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
-    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
-    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
     IMAGE_DEBUG_DIRECTORY debug_dir;
     OMFSignatureRSDS rsds;
     char *pdb_name;
     size_t pdb_name_sz;
     size_t i;
 
-    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
-
-    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
-        return 1;
-    }
-
-    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
-                &nt_hdrs, sizeof(nt_hdrs), 0)) {
-        return 1;
-    }
-
-    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
-            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
-        return 1;
-    }
-
-    printf("Debug Directory RVA = 0x%08"PRIx32"\n",
-            (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
-
-    if (va_space_rw(vs,
-                base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
-                &debug_dir, sizeof(debug_dir), 0)) {
+    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
+                &debug_dir, sizeof(debug_dir), vs)) {
+        eprintf("Failed to get Debug Directory\n");
         return 1;
     }
 
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Since its inception elf2dmp has checked MZ signatures within an
address space above IDT[0] interrupt vector and took first PE image
found as Windows Kernel.
But in Windows Server 2022 memory dump this address space range is
full of invalid PE fragments and the tool must check that PE image
is 'ntoskrnl.exe' actually.
So, introduce additional validation by checking image name from
Export Directory against 'ntoskrnl.exe'.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-4-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/pe.h   | 15 +++++++++++++++
 contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pe.h
+++ b/contrib/elf2dmp/pe.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 {
     IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 
+typedef struct IMAGE_EXPORT_DIRECTORY {
+    uint32_t    Characteristics;
+    uint32_t    TimeDateStamp;
+    uint16_t    MajorVersion;
+    uint16_t    MinorVersion;
+    uint32_t    Name;
+    uint32_t    Base;
+    uint32_t    NumberOfFunctions;
+    uint32_t    NumberOfNames;
+    uint32_t    AddressOfFunctions;
+    uint32_t    AddressOfNames;
+    uint32_t    AddressOfNameOrdinals;
+} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;
+
 typedef struct IMAGE_DEBUG_DIRECTORY {
     uint32_t Characteristics;
     uint32_t TimeDateStamp;
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY {
 #define IMAGE_DEBUG_TYPE_CODEVIEW   2
 #endif
 
+#define IMAGE_FILE_EXPORT_DIRECTORY 0
 #define IMAGE_FILE_DEBUG_DIRECTORY  6
 
 typedef struct guid_t {
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@
 
 #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
 #define PDB_NAME    "ntkrnlmp.pdb"
+#define PE_NAME     "ntoskrnl.exe"
 
 #define INITIAL_MXCSR   0x1f80
 
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
     return fclose(dmp_file);
 }
 
+static bool pe_check_export_name(uint64_t base, void *start_addr,
+        struct va_space *vs)
+{
+    IMAGE_EXPORT_DIRECTORY export_dir;
+    const char *pe_name;
+
+    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY,
+                &export_dir, sizeof(export_dir), vs)) {
+        return false;
+    }
+
+    pe_name = va_space_resolve(vs, base + export_dir.Name);
+    if (!pe_name) {
+        return false;
+    }
+
+    return !strcmp(pe_name, PE_NAME);
+}
+
 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
         char *hash, struct va_space *vs)
 {
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
     uint64_t KdDebuggerDataBlock;
     KDDEBUGGER_DATA64 *kdbg;
     uint64_t KdVersionBlock;
+    bool kernel_found = false;
 
     if (argc != 3) {
         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
         }
 
         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
-            break;
+            if (pe_check_export_name(KernBase, nt_start_addr, &vs)) {
+                kernel_found = true;
+                break;
+            }
         }
     }
 
-    if (!nt_start_addr) {
+    if (!kernel_found) {
         eprintf("Failed to find NT kernel image\n");
         err = 1;
         goto out_ps;
-- 
2.34.1

From: Guenter Roeck <linux@roeck-us.net>

The i.MX USB Phy driver does not check register ranges, resulting in out of
bounds accesses if an attempt is made to access non-existing PHY registers.
Add range check and conditionally report bad accesses to fix the problem.

While at it, also conditionally log attempted writes to non-existing or
read-only registers.

Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230316234926.208874-1-linux@roeck-us.net
Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/imx-usb-phy.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/imx-usb-phy.c
+++ b/hw/usb/imx-usb-phy.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/usb/imx-usb-phy.h"
 #include "migration/vmstate.h"
+#include "qemu/log.h"
 #include "qemu/module.h"
 
 static const VMStateDescription vmstate_imx_usbphy = {
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
         value = s->usbphy[index - 3];
         break;
     default:
-        value = s->usbphy[index];
+        if (index < USBPHY_MAX) {
+            value = s->usbphy[index];
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Read from non-existing USB PHY register 0x%"
+                          HWADDR_PRIx "\n",
+                          __func__, offset);
+            value = 0;
+        }
         break;
     }
     return (uint64_t)value;
@@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
         s->usbphy[index - 3] ^= value;
         break;
     default:
-        /* Other registers are read-only */
+        /* Other registers are read-only or do not exist */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Write to %s USB PHY register 0x%"
+                      HWADDR_PRIx "\n",
+                      __func__,
+                      index >= USBPHY_MAX ? "non-existing" : "read-only",
+                      offset);
         break;
     }
 }
-- 
2.34.1

The markup for the Arm CPU feature documentation is incorrect,
and results in the HTML not rendering correctly -- the first
line of each description is rendered in boldface as if it
were part of the option name.

Reformat to match the styling used in cpu-models-x86.rst.inc.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
---
 docs/system/arm/cpu-features.rst | 68 ++++++++++++++------------------
 1 file changed, 30 insertions(+), 38 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ are named with the prefix "kvm-".  KVM VCPU features may be probed,
 enabled, and disabled in the same way as other CPU features.  Below is
 the list of KVM VCPU features and their descriptions.
 
-  kvm-no-adjvtime          By default kvm-no-adjvtime is disabled.  This
-                           means that by default the virtual time
-                           adjustment is enabled (vtime is not *not*
-                           adjusted).
+``kvm-no-adjvtime``
+  By default kvm-no-adjvtime is disabled.  This means that by default
+  the virtual time adjustment is enabled (vtime is not *not* adjusted).
 
-                           When virtual time adjustment is enabled each
-                           time the VM transitions back to running state
-                           the VCPU's virtual counter is updated to ensure
-                           stopped time is not counted.  This avoids time
-                           jumps surprising guest OSes and applications,
-                           as long as they use the virtual counter for
-                           timekeeping.  However it has the side effect of
-                           the virtual and physical counters diverging.
-                           All timekeeping based on the virtual counter
-                           will appear to lag behind any timekeeping that
-                           does not subtract VM stopped time.  The guest
-                           may resynchronize its virtual counter with
-                           other time sources as needed.
+  When virtual time adjustment is enabled each time the VM transitions
+  back to running state the VCPU's virtual counter is updated to
+  ensure stopped time is not counted.  This avoids time jumps
+  surprising guest OSes and applications, as long as they use the
+  virtual counter for timekeeping.  However it has the side effect of
+  the virtual and physical counters diverging.  All timekeeping based
+  on the virtual counter will appear to lag behind any timekeeping
+  that does not subtract VM stopped time.  The guest may resynchronize
+  its virtual counter with other time sources as needed.
 
-                           Enable kvm-no-adjvtime to disable virtual time
-                           adjustment, also restoring the legacy (pre-5.0)
-                           behavior.
+  Enable kvm-no-adjvtime to disable virtual time adjustment, also
+  restoring the legacy (pre-5.0) behavior.
 
-  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
-                           default when KVM is enabled, the feature is
-                           supported, and the guest is 64-bit.
+``kvm-steal-time``
+  Since v5.2, kvm-steal-time is enabled by default when KVM is
+  enabled, the feature is supported, and the guest is 64-bit.
 
-                           When kvm-steal-time is enabled a 64-bit guest
-                           can account for time its CPUs were not running
-                           due to the host not scheduling the corresponding
-                           VCPU threads.  The accounting statistics may
-                           influence the guest scheduler behavior and/or be
-                           exposed to the guest userspace.
+  When kvm-steal-time is enabled a 64-bit guest can account for time
+  its CPUs were not running due to the host not scheduling the
+  corresponding VCPU threads.  The accounting statistics may influence
+  the guest scheduler behavior and/or be exposed to the guest
+  userspace.
 
 TCG VCPU Features
 =================
@@ -XXX,XX +XXX,XX @@ TCG VCPU Features
 TCG VCPU features are CPU features that are specific to TCG.
 Below is the list of TCG VCPU features and their descriptions.
 
-  pauth-impdef             When ``FEAT_Pauth`` is enabled, either the
-                           *impdef* (Implementation Defined) algorithm
-                           is enabled or the *architected* QARMA algorithm
-                           is enabled.  By default the impdef algorithm
-                           is disabled, and QARMA is enabled.
+``pauth-impdef``
+  When ``FEAT_Pauth`` is enabled, either the *impdef* (Implementation
+  Defined) algorithm is enabled or the *architected* QARMA algorithm
+  is enabled.  By default the impdef algorithm is disabled, and QARMA
+  is enabled.
 
-                           The architected QARMA algorithm has good
-                           cryptographic properties, but can be quite slow
-                           to emulate.  The impdef algorithm used by QEMU
-                           is non-cryptographic but significantly faster.
+  The architected QARMA algorithm has good cryptographic properties,
+  but can be quite slow to emulate.  The impdef algorithm used by QEMU
+  is non-cryptographic but significantly faster.
 
 SVE CPU Properties
 ==================
-- 
2.34.1

Unfortunately a bug in older versions of gdb means that they will
crash if QEMU sends them the aarch64-pauth.xml.  This bug is fixed in
gdb commit 1ba3a3222039eb25, and there are plans to backport that to
affected gdb release branches, but since the bug affects gdb 9
through 12 it is very widely deployed (for instance by distros).

It is not currently clear what the best way to deal with this is; it
has been proposed to define a new XML feature name that old gdb will
ignore but newer gdb can handle.  Since QEMU's 8.0 release is
imminent and at least one of our CI runners is now falling over this,
disable the pauth XML for the moment.  We can follow up with a more
considered fix either in time for 8.0 or else for the 8.1 release.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                      aarch64_gdb_set_fpu_reg,
                                      34, "aarch64-fpu.xml", 0);
         }
+#if 0
+        /*
+         * GDB versions 9 through 12 have a bug which means they will
+         * crash if they see this XML from QEMU; disable it for the 8.0
+         * release, pending a better solution.
+         */
         if (isar_feature_aa64_pauth(&cpu->isar)) {
             gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
                                      aarch64_gdb_set_pauth_reg,
                                      4, "aarch64-pauth.xml", 0);
         }
+#endif
 #endif
     } else {
         if (arm_feature(env, ARM_FEATURE_NEON)) {
-- 
2.34.1