Series comparison

-[PULL 00/11] target-arm queue
+[PULL 00/12] target-arm queue
-Hi; this pullreq contains some minor bug fixes, and also
+The following changes since commit 131c58469f6fb68c89b38fee6aba8bbb20c7f4bf:
 the txt-to-rST document conversions I did. The latter are not
 strictly speaking bugfixes but I think for rc2 they're OK. Let
 me know if you'd rather I respin this without them.
-thanks
+  rust: add --rust-target option for bindgen (2025-02-06 13:51:46 -0500)
 -- PMM
 The following changes since commit 0f397dcfecc9211d12c2c720c01eb32f0eaa7d23:
   Merge tag 'pull-nbd-2024-08-08' of https://repo.or.cz/qemu/ericb into staging (2024-08-09 08:40:37 +1000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240809
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250210
-for you to fetch changes up to 77100e100d76a568800e19ee20c7e9255053b84a:
+for you to fetch changes up to 27a8d899c7a100fd5aa040a8b993bb257687c393:
-  arm/virt: place power button pin number on a define (2024-08-09 17:37:56 +0100)
+  linux-user: Do not define struct sched_attr if libc headers do (2025-02-07 16:09:20 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix BTI versus CF_PCREL
+ * Deprecate pxa2xx CPUs, iwMMXt emulation, -old-param option
- * include: Fix typo in name of MAKE_IDENTFIER macro
+ * Drop unused AArch64DecodeTable typedefs
- * docs: Various txt-to-rST conversions
+ * Minor code cleanups
- * add support for PMUv3 64-bit PMCCNTR in AArch32 mode
+ * hw/net/cadence_gem:  Fix the mask/compare/disable-mask logic
- * hw/core/ptimer: fix timer zero period condition for freq > 1GHz
+ * linux-user: Do not define struct sched_attr if libc headers do
  * arm/virt: place power button pin number on a define
 ----------------------------------------------------------------
-Alex Richardson (1):
+Andrew Yuan (1):
-      target/arm: add support for PMUv3 64-bit PMCCNTR in AArch32 mode
+      hw/net/cadence_gem:  Fix the mask/compare/disable-mask logic
-Eric Blake (1):
+Khem Raj (1):
-      docs: Typo fix in live disk backup
+      linux-user: Do not define struct sched_attr if libc headers do
-Jianzhou Yue (1):
+Peter Maydell (4):
-      hw/core/ptimer: fix timer zero period condition for freq > 1GHz
+      target/arm: deprecate the pxa2xx CPUs and iwMMXt emulation
       tests/tcg/arm: Remove test-arm-iwmmxt test
       target/arm: Drop unused AArch64DecodeTable typedefs
       qemu-options: Deprecate -old-param command line option
-Mauro Carvalho Chehab (1):
+Philippe Mathieu-Daudé (6):
-      arm/virt: place power button pin number on a define
+      hw/arm/boot: Propagate vCPU to arm_load_dtb()
       hw/arm/fsl-imx6: Add local 'mpcore/gic' variables
       hw/arm/fsl-imx6ul: Add local 'mpcore/gic' variables
       hw/arm/fsl-imx7: Add local 'mpcore/gic' variables
       hw/cpu/arm: Alias 'num-cpu' property on TYPE_REALVIEW_MPCORE
       hw/cpu/arm: Declare CPU QOM types using DEFINE_TYPES() macro
-Peter Maydell (6):
+ docs/about/deprecated.rst       | 34 ++++++++++++++++++++++
-      include: Fix typo in name of MAKE_IDENTFIER macro
+ include/hw/arm/boot.h           |  4 ++-
-      docs/specs/rocker.txt: Convert to rST
+ target/arm/cpu.h                |  1 +
-      docs/interop/nbd.txt: Convert to rST
+ hw/arm/boot.c                   | 11 +++----
-      docs/interop/parallels.txt: Convert to rST
+ hw/arm/fsl-imx6.c               | 52 ++++++++++++++-------------------
-      docs/interop/prl-xml.txt: Convert to rST
+ hw/arm/fsl-imx6ul.c             | 64 +++++++++++++++++------------------------
-      docs/interop/prl-xml.rst: Fix minor grammar nits
+ hw/arm/fsl-imx7.c               | 52 +++++++++++++++------------------
  hw/arm/virt.c                   |  2 +-
  hw/cpu/a15mpcore.c              | 21 ++++++--------
  hw/cpu/a9mpcore.c               | 21 ++++++--------
  hw/cpu/arm11mpcore.c            | 21 ++++++--------
  hw/cpu/realview_mpcore.c        | 29 +++++++------------
  hw/net/cadence_gem.c            | 26 +++++++++++++----
  linux-user/syscall.c            |  4 ++-
  system/vl.c                     |  1 +
  target/arm/cpu.c                |  3 ++
  target/arm/tcg/cpu32.c          | 36 +++++++++++++++--------
  target/arm/tcg/translate-a64.c  | 11 -------
  tests/tcg/arm/Makefile.target   |  7 -----
  tests/tcg/arm/README            |  5 ----
  tests/tcg/arm/test-arm-iwmmxt.S | 49 -------------------------------
 files changed, 205 insertions(+), 249 deletions(-)
  delete mode 100644 tests/tcg/arm/test-arm-iwmmxt.S
-Richard Henderson (1):
-      target/arm: Fix BTI versus CF_PCREL
- MAINTAINERS                                   |   7 +-
- docs/interop/index.rst                        |   3 +
- docs/interop/live-block-operations.rst        |   4 +-
- docs/interop/nbd.rst                          |  89 ++++++++++++
- docs/interop/nbd.txt                          |  72 ----------
- docs/interop/{parallels.txt => parallels.rst} | 108 ++++++++-------
- docs/interop/prl-xml.rst                      | 192 ++++++++++++++++++++++++++
- docs/interop/prl-xml.txt                      | 158 ---------------------
- docs/specs/index.rst                          |   1 +
- docs/specs/{rocker.txt => rocker.rst}         | 181 ++++++++++++------------
- include/hw/arm/virt.h                         |   3 +
- include/qapi/qmp/qobject.h                    |   2 +-
- include/qemu/atomic.h                         |   2 +-
- include/qemu/compiler.h                       |   2 +-
- include/qemu/osdep.h                          |   6 +-
- target/arm/tcg/helper-a64.h                   |   3 +
- target/arm/tcg/translate.h                    |   2 -
- hw/arm/virt-acpi-build.c                      |   6 +-
- hw/arm/virt.c                                 |   7 +-
- hw/core/ptimer.c                              |   4 +-
- target/arm/helper.c                           |   6 +
- target/arm/tcg/helper-a64.c                   |  39 ++++++
- target/arm/tcg/translate-a64.c                |  64 ++-------
- tests/unit/ptimer-test.c                      |  33 +++++
-files changed, 553 insertions(+), 441 deletions(-)
- create mode 100644 docs/interop/nbd.rst
- delete mode 100644 docs/interop/nbd.txt
- rename docs/interop/{parallels.txt => parallels.rst} (72%)
- create mode 100644 docs/interop/prl-xml.rst
- delete mode 100644 docs/interop/prl-xml.txt
- rename docs/specs/{rocker.txt => rocker.rst} (91%)

-[PULL 07/11] docs/interop/prl-xml.rst: Fix minor grammar nits
+[PULL 01/12] target/arm: deprecate the pxa2xx CPUs and iwMMXt emulation
-Fix some minor grammar nits in the prl-xml documentation.
+The pxa2xx CPUs are now only useful with user-mode emulation, because
 we dropped all the machine types that used them in 9.2.  (Technically
 you could alse use "-cpu pxa270" with a board model like versatilepb
 which doesn't sanity-check the CPU type, but that has never been a
 supported config.)
 To use them (or iwMMXt emulation) with QEMU user-mode you would need
 to explicitly select them with the -cpu option or the QEMU_CPU
 environment variable.  A google search finds no examples of anybody
 doing this in the last decade; I don't believe the GCC folks are
 using QEMU to test their iwMMXt codegen either.  In fact, GCC is in
 the process of dropping support for iwMMXT entirely.
 The iwMMXt emulation is thousands of lines of code in QEMU, and
 is now the only bit of Arm insn decode which doesn't use decodetree.
 We have no way to test or validate changes to it. This code is
 just dead weight that is almost certainly not being used by anybody.
 Mark it as deprecated.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20240801170131.3977807-6-peter.maydell@linaro.org
+Message-id: 20250127112715.2936555-2-peter.maydell@linaro.org
 ---
- docs/interop/prl-xml.rst | 73 +++++++++++++++++++++-------------------
+ docs/about/deprecated.rst | 21 +++++++++++++++++++++
-file changed, 39 insertions(+), 34 deletions(-)
+ target/arm/cpu.h          |  1 +
  target/arm/cpu.c          |  3 +++
  target/arm/tcg/cpu32.c    | 36 ++++++++++++++++++++++++------------
 files changed, 49 insertions(+), 12 deletions(-)
-diff --git a/docs/interop/prl-xml.rst b/docs/interop/prl-xml.rst
+diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/interop/prl-xml.rst
+--- a/docs/about/deprecated.rst
-+++ b/docs/interop/prl-xml.rst
++++ b/docs/about/deprecated.rst
-@@ -XXX,XX +XXX,XX @@ Parallels Disk Format
+@@ -XXX,XX +XXX,XX @@ is going to be so much slower it wouldn't make sense for any serious
-    See the COPYING file in the top-level directory.
+ instrumentation. Due to implementation differences there will also be
+ anomalies in things like memory instrumentation.
- This specification contains minimal information about Parallels Disk Format,
--which is enough to proper work with QEMU. Nevertheless, Parallels Cloud Server
++linux-user mode CPUs
--and Parallels Desktop are able to add some unspecified nodes to xml and use
++--------------------
 +which is enough to properly work with QEMU. Nevertheless, Parallels Cloud Server
 +and Parallels Desktop are able to add some unspecified nodes to the xml and use
  them, but they are for internal work and don't affect functionality. Also it
 -uses auxiliary xml ``Snapshot.xml``, which allows to store optional snapshot
 -information, but it doesn't influence open/read/write functionality. QEMU and
 -other software should not use fields not covered in this document and
 -``Snapshot.xml`` file and must leave them as is.
 +uses auxiliary xml ``Snapshot.xml``, which allows storage of optional snapshot
 +information, but this doesn't influence open/read/write functionality. QEMU and
 +other software should not use fields not covered in this document or the
 +``Snapshot.xml`` file, and must leave them as is.
 -Parallels disk consists of two parts: the set of snapshots and the disk
 +A Parallels disk consists of two parts: the set of snapshots and the disk
  descriptor file, which stores information about all files and snapshots.
  Definitions
@@ -XXX,XX +XXX,XX @@ Definitions
  Snapshot
    a record of the contents captured at a particular time, capable
 -  of storing current state. A snapshot has UUID and parent UUID.
 +  of storing current state. A snapshot has a UUID and a parent UUID.
  Snapshot image
    an overlay representing the difference between this
@@ -XXX,XX +XXX,XX @@ Overlay
    an image storing the different sectors between two captured states.
  Root image
 -  snapshot image with no parent, the root of snapshot tree.
 +  a snapshot image with no parent, the root of the snapshot tree.
  Storage
    the backing storage for a subset of the virtual disk. When
    there is more than one storage in a Parallels disk then that
    is referred to as a split image. In this case every storage
 -  covers specific address space area of the disk and has its
 +  covers a specific address space area of the disk and has its
    particular root image. Split images are not considered here
    and are not supported. Each storage consists of disk
    parameters and a list of images. The list of images always
@@ -XXX,XX +XXX,XX @@ Storage
  Description file
    ``DiskDescriptor.xml`` stores information about disk parameters,
 -  snapshots, storages.
 +  snapshots, and storages.
  Top Snapshot
    The overlay between actual state and some previous snapshot.
@@ -XXX,XX +XXX,XX @@ Description file
  All information is placed in a single XML element
  ``Parallels_disk_image``.
 -The element has only one attribute ``Version``, that must be ``1.0``.
 +The element has only one attribute, ``Version``, which must be ``1.0``.
 -Schema of ``DiskDescriptor.xml``::
 +The schema of ``DiskDescriptor.xml``::
   <Parallels_disk_image Version="1.0">
      <Disk_Parameters>
@@ -XXX,XX +XXX,XX @@ The ``Disk_Parameters`` element MUST contain the following child elements:
  * ``Heads``     - number of the disk heads.
  * ``Sectors``   - number of the disk sectors per cylinder
    (sector size is 512 bytes)
 -  Limitation: Product of the ``Heads``, ``Sectors`` and ``Cylinders``
 +  Limitation: The product of the ``Heads``, ``Sectors`` and ``Cylinders``
    values MUST be equal to the value of the Disk_size parameter.
  * ``Padding``   - must be 0. Parallels Cloud Server and Parallels Desktop may
 -  use padding set to 1, however this case is not covered
 -  by this spec, QEMU and other software should not open
 +  use padding set to 1; however this case is not covered
 +  by this specification. QEMU and other software should not open
    such disks and should not create them.
  ``StorageData`` element
@@ -XXX,XX +XXX,XX @@ as shown below::
      </Storage>
   </StorageData>
 -A ``Storage`` element has following child elements:
 +A ``Storage`` element has the following child elements:
  * ``Start``     - start sector of the storage, in case of non split storage
    equals to 0.
  * ``End``       - number of sector following the last sector, in case of non
    split storage equals to ``Disk_size``.
  * ``Blocksize`` - storage cluster size, number of sectors per one cluster.
 -  Cluster size for each "Compressed" (see below) image in
 -  parallels disk must be equal to this field. Note: cluster
 -  size for Parallels Expandable Image is in ``tracks`` field of
 +  The cluster size for each "Compressed" (see below) image in
 +  a parallels disk must be equal to this field. Note: the cluster
 +  size for a Parallels Expandable Image is in the ``tracks`` field of
    its header (see :doc:`parallels`).
  * Several ``Image`` child elements.
 -Each ``Image`` element has following child elements:
 +Each ``Image`` element has the following child elements:
  * ``GUID`` - image identifier, UUID in curly brackets.
    For instance, ``{12345678-9abc-def1-2345-6789abcdef12}.``
@@ -XXX,XX +XXX,XX @@ Each ``Image`` element has following child elements:
    * ``Plain`` for raw files.
    * ``Compressed`` for expanding disks.
 -* ``File`` - path to image file. Path can be relative to
 +* ``File`` - path to image file. The path can be relative to
    ``DiskDescriptor.xml`` or absolute.
  ``Snapshots`` element
@@ -XXX,XX +XXX,XX @@ Each ``Shot`` element contains the following child elements:
  * ``GUID``       - an image GUID.
  * ``ParentGUID`` - GUID of the image of the parent snapshot.
 -The software may traverse snapshots from child to parent using ``<ParentGUID>``
 -field as reference. ``ParentGUID`` of root snapshot is
 -``{00000000-0000-0000-0000-000000000000}``. There should be only one root
 -snapshot. Top snapshot could be described via two ways: via ``TopGUID`` child
 -element of the ``Snapshots`` element or via predefined GUID
 +The software may traverse snapshots from child to parent using the
 +``<ParentGUID>`` field as reference. The ``ParentGUID`` of the root
 +snapshot is ``{00000000-0000-0000-0000-000000000000}``.
 +There should be only one root snapshot.
 +
-+The Top snapshot could be
++iwMMXt emulation and the ``pxa`` CPUs (since 10.0)
-+described via two ways: via the ``TopGUID`` child
++''''''''''''''''''''''''''''''''''''''''''''''''''
 +element of the ``Snapshots`` element, or via the predefined GUID
  ``{5fbaabe3-6958-40ff-92a7-860e329aab41}``. If ``TopGUID`` is defined,
 -predefined GUID is interpreted as usual GUID. All snapshot images
 -(except Top Snapshot) should be
 -opened read-only. There is another predefined GUID,
 +the predefined GUID is interpreted as a normal GUID. All snapshot images
 +(except the Top Snapshot) should be
 +opened read-only.
 +
-+There is another predefined GUID,
++The ``pxa`` CPU family (``pxa250``, ``pxa255``, ``pxa260``,
- ``BackupID = {704718e1-2314-44c8-9087-d78ed36b0f4e}``, which is used by
++``pxa261``, ``pxa262``, ``pxa270-a0``, ``pxa270-a1``, ``pxa270``,
--original and some third-party software for backup, QEMU and other
++``pxa270-b0``, ``pxa270-b1``, ``pxa270-c0``, ``pxa270-c5``) are no
--software may operate with images with ``GUID = BackupID`` as usual,
++longer used in system emulation, because all the machine types which
--however, it is not recommended to use this
++used these CPUs were removed in the QEMU 9.2 release. These CPUs can
--GUID for new disks. Top snapshot cannot have this GUID.
++now only be used in linux-user mode, and to do that you would have to
-+original and some third-party software for backup. QEMU and other
++explicitly select one of these CPUs with the ``-cpu`` command line
-+software may operate with images with ``GUID = BackupID`` as usual.
++option or the ``QEMU_CPU`` environment variable.
-+However, it is not recommended to use this
++
-+GUID for new disks. The Top snapshot cannot have this GUID.
++We don't believe that anybody is using the iwMMXt emulation, and we do
 +not have any tests to validate it or any real hardware or similar
 +known-good implementation to test against. GCC is in the process of
 +dropping their support for iwMMXt codegen. These CPU types are
 +therefore deprecated in QEMU, and will be removed in a future release.
 +
  System emulator CPUs
  --------------------
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
  typedef struct ARMCPUInfo {
      const char *name;
 +    const char *deprecation_note;
      void (*initfn)(Object *obj);
      void (*class_init)(ObjectClass *oc, void *data);
  } ARMCPUInfo;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
      acc->info = data;
      cc->gdb_core_xml_file = "arm-core.xml";
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
  }
  void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
      { .name = "ti925t",      .initfn = ti925t_initfn },
      { .name = "sa1100",      .initfn = sa1100_initfn },
      { .name = "sa1110",      .initfn = sa1110_initfn },
 -    { .name = "pxa250",      .initfn = pxa250_initfn },
 -    { .name = "pxa255",      .initfn = pxa255_initfn },
 -    { .name = "pxa260",      .initfn = pxa260_initfn },
 -    { .name = "pxa261",      .initfn = pxa261_initfn },
 -    { .name = "pxa262",      .initfn = pxa262_initfn },
 +    { .name = "pxa250",      .initfn = pxa250_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa255",      .initfn = pxa255_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa260",      .initfn = pxa260_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa261",      .initfn = pxa261_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa262",      .initfn = pxa262_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
      /* "pxa270" is an alias for "pxa270-a0" */
 -    { .name = "pxa270",      .initfn = pxa270a0_initfn },
 -    { .name = "pxa270-a0",   .initfn = pxa270a0_initfn },
 -    { .name = "pxa270-a1",   .initfn = pxa270a1_initfn },
 -    { .name = "pxa270-b0",   .initfn = pxa270b0_initfn },
 -    { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
 -    { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
 -    { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
 +    { .name = "pxa270",      .initfn = pxa270a0_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa270-a0",   .initfn = pxa270a0_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa270-a1",   .initfn = pxa270a1_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa270-b0",   .initfn = pxa270b0_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa270-b1",   .initfn = pxa270b1_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa270-c0",   .initfn = pxa270c0_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 +    { .name = "pxa270-c5",   .initfn = pxa270c5_initfn,
 +      .deprecation_note = "iwMMXt CPUs are no longer supported", },
  #ifndef TARGET_AARCH64
      { .name = "max",         .initfn = arm_max_initfn },
  #endif
 --
 .34.1

-[PULL 06/11] docs/interop/prl-xml.txt: Convert to rST
+[PULL 02/12] tests/tcg/arm: Remove test-arm-iwmmxt test
-Convert prl-xml.txt to rST format.
+The test-arm-iwmmmxt test isn't testing what it thinks it's testing.
 If you run it with a CPU type that supports iwMMXt then it will crash
 immediately with a SIGILL, because (even with -marm) GCC will link it
 against startup code that is in Thumb mode, and no iwMMXt CPU has
 Thumb:
 00010338 <_start>:
 :       f04f 0b00       mov.w   fp, #0
 c:       f04f 0e00       mov.w   lr, #0
 If you run it with a CPU type which does *not* support iwMMXt, which
 is what 'make check-tcg' does, then QEMU will not try to handle the
 insns as iwMMXt.  Instead the translator turns them into illegal
 instructions.  Then in the linux-user cpu_loop() code we identify
 them as FPA11 instructions inside emulate_arm_fpa11(), because the
 FPA11 happened to use the same coprocessor number as these iwMMXt
 insns.  So we execute a completely different set of FPA11 insns,
 which means we don't crash, but we will print garbage to stdout.
 Then the test binary always exits with a 0 return code, so 'make
 check-tcg' thinks the test passes.
 Modern gnueabihf toolchains assume in their startup code that the CPU
 is not so old as to not support Thumb, so there's no way to get them
 to generate a binary that actually does what the test wants.  Since
 we're deprecating iwMMXt emulation anyway, it's not worth trying to
 salvage the test case to get it to really test the iwMMXt insns.
 Delete the test entirely.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20240801170131.3977807-5-peter.maydell@linaro.org
+Message-id: 20250127112715.2936555-3-peter.maydell@linaro.org
 ---
- MAINTAINERS              |   1 +
+ tests/tcg/arm/Makefile.target   |  7 -----
- docs/interop/index.rst   |   1 +
+ tests/tcg/arm/README            |  5 ----
- docs/interop/prl-xml.rst | 187 +++++++++++++++++++++++++++++++++++++++
+ tests/tcg/arm/test-arm-iwmmxt.S | 49 ---------------------------------
- docs/interop/prl-xml.txt | 158 ---------------------------------
+files changed, 61 deletions(-)
-files changed, 189 insertions(+), 158 deletions(-)
+ delete mode 100644 tests/tcg/arm/test-arm-iwmmxt.S
  create mode 100644 docs/interop/prl-xml.rst
  delete mode 100644 docs/interop/prl-xml.txt
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/tests/tcg/arm/Makefile.target
-+++ b/MAINTAINERS
++++ b/tests/tcg/arm/Makefile.target
-@@ -XXX,XX +XXX,XX @@ S: Supported
+@@ -XXX,XX +XXX,XX @@ ARM_TESTS = hello-arm
- F: block/parallels.c
+ hello-arm: CFLAGS+=-marm -ffreestanding -fno-stack-protector
- F: block/parallels-ext.c
+ hello-arm: LDFLAGS+=-nostdlib
- F: docs/interop/parallels.rst
-+F: docs/interop/prl-xml.rst
+-# IWMXT floating point extensions
- T: git https://src.openvz.org/scm/~den/qemu.git parallels
+-ARM_TESTS += test-arm-iwmmxt
+-# Clang assembler does not support IWMXT, so use the external assembler.
- qed
+-test-arm-iwmmxt: CFLAGS += -marm -march=iwmmxt -mabi=aapcs -mfpu=fpv4-sp-d16 $(CROSS_CC_HAS_FNIA)
-diff --git a/docs/interop/index.rst b/docs/interop/index.rst
+-test-arm-iwmmxt: test-arm-iwmmxt.S
 -    $(CC) $(CFLAGS) -Wa,--noexecstack $< -o $@ $(LDFLAGS)
 -
  # Float-convert Tests
  ARM_TESTS += fcvt
  fcvt: LDFLAGS += -lm
 diff --git a/tests/tcg/arm/README b/tests/tcg/arm/README
 index XXXXXXX..XXXXXXX 100644
---- a/docs/interop/index.rst
+--- a/tests/tcg/arm/README
-+++ b/docs/interop/index.rst
++++ b/tests/tcg/arm/README
-@@ -XXX,XX +XXX,XX @@ are useful for making QEMU interoperate with other software.
+@@ -XXX,XX +XXX,XX @@ hello-arm
-    live-block-operations
+ ---------
-    nbd
-    parallels
+ A very simple inline assembly, write syscall based hello world
-+   prl-xml
+-
-    pr-helper
+-test-arm-iwmmxt
-    qmp-spec
+----------------
-    qemu-ga
+-
-diff --git a/docs/interop/prl-xml.rst b/docs/interop/prl-xml.rst
+-A simple test case for older iwmmxt extended ARMs
-new file mode 100644
+diff --git a/tests/tcg/arm/test-arm-iwmmxt.S b/tests/tcg/arm/test-arm-iwmmxt.S
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/interop/prl-xml.rst
@@ -XXX,XX +XXX,XX @@
 +Parallels Disk Format
 +=====================
 +
 +..
 +   Copyright (c) 2015-2017, Virtuozzo, Inc.
 +   Authors:
 +        2015 Denis Lunev <den@openvz.org>
 +        2015 Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 +        2016-2017 Klim Kireev <klim.kireev@virtuozzo.com>
 +        2016-2017 Edgar Kaziakhmedov <edgar.kaziakhmedov@virtuozzo.com>
 +
 +   This work is licensed under the terms of the GNU GPL, version 2 or later.
 +   See the COPYING file in the top-level directory.
 +
 +This specification contains minimal information about Parallels Disk Format,
 +which is enough to proper work with QEMU. Nevertheless, Parallels Cloud Server
 +and Parallels Desktop are able to add some unspecified nodes to xml and use
 +them, but they are for internal work and don't affect functionality. Also it
 +uses auxiliary xml ``Snapshot.xml``, which allows to store optional snapshot
 +information, but it doesn't influence open/read/write functionality. QEMU and
 +other software should not use fields not covered in this document and
 +``Snapshot.xml`` file and must leave them as is.
 +
 +Parallels disk consists of two parts: the set of snapshots and the disk
 +descriptor file, which stores information about all files and snapshots.
 +
 +Definitions
 +-----------
 +
 +Snapshot
 +  a record of the contents captured at a particular time, capable
 +  of storing current state. A snapshot has UUID and parent UUID.
 +
 +Snapshot image
 +  an overlay representing the difference between this
 +  snapshot and some earlier snapshot.
 +
 +Overlay
 +  an image storing the different sectors between two captured states.
 +
 +Root image
 +  snapshot image with no parent, the root of snapshot tree.
 +
 +Storage
 +  the backing storage for a subset of the virtual disk. When
 +  there is more than one storage in a Parallels disk then that
 +  is referred to as a split image. In this case every storage
 +  covers specific address space area of the disk and has its
 +  particular root image. Split images are not considered here
 +  and are not supported. Each storage consists of disk
 +  parameters and a list of images. The list of images always
 +  contains a root image and may also contain overlays. The
 +  root image can be an expandable Parallels image file or
 +  plain. Overlays must be expandable.
 +
 +Description file
 +  ``DiskDescriptor.xml`` stores information about disk parameters,
 +  snapshots, storages.
 +
 +Top Snapshot
 +  The overlay between actual state and some previous snapshot.
 +  It is not a snapshot in the classical sense because it
 +  serves as the active image that the guest writes to.
 +
 +Sector
 +  a 512-byte data chunk.
 +
 +Description file
 +----------------
 +
 +All information is placed in a single XML element
 +``Parallels_disk_image``.
 +The element has only one attribute ``Version``, that must be ``1.0``.
 +
 +Schema of ``DiskDescriptor.xml``::
 +
 + <Parallels_disk_image Version="1.0">
 +    <Disk_Parameters>
 +        ...
 +    </Disk_Parameters>
 +    <StorageData>
 +        ...
 +    </StorageData>
 +    <Snapshots>
 +        ...
 +    </Snapshots>
 + </Parallels_disk_image>
 +
 +``Disk_Parameters`` element
 +^^^^^^^^^^^^^^^^^^^^^^^^^^^
 +
 +The ``Disk_Parameters`` element describes the physical layout of the
 +virtual disk and some general settings.
 +
 +The ``Disk_Parameters`` element MUST contain the following child elements:
 +
 +* ``Disk_size`` - number of sectors in the disk,
 +  desired size of the disk.
 +* ``Cylinders`` - number of the disk cylinders.
 +* ``Heads``     - number of the disk heads.
 +* ``Sectors``   - number of the disk sectors per cylinder
 +  (sector size is 512 bytes)
 +  Limitation: Product of the ``Heads``, ``Sectors`` and ``Cylinders``
 +  values MUST be equal to the value of the Disk_size parameter.
 +* ``Padding``   - must be 0. Parallels Cloud Server and Parallels Desktop may
 +  use padding set to 1, however this case is not covered
 +  by this spec, QEMU and other software should not open
 +  such disks and should not create them.
 +
 +``StorageData`` element
 +^^^^^^^^^^^^^^^^^^^^^^^
 +
 +This element of the file describes the root image and all snapshot images.
 +
 +The ``StorageData`` element consists of the ``Storage`` child element,
 +as shown below::
 +
 + <StorageData>
 +    <Storage>
 +        ...
 +    </Storage>
 + </StorageData>
 +
 +A ``Storage`` element has following child elements:
 +
 +* ``Start``     - start sector of the storage, in case of non split storage
 +  equals to 0.
 +* ``End``       - number of sector following the last sector, in case of non
 +  split storage equals to ``Disk_size``.
 +* ``Blocksize`` - storage cluster size, number of sectors per one cluster.
 +  Cluster size for each "Compressed" (see below) image in
 +  parallels disk must be equal to this field. Note: cluster
 +  size for Parallels Expandable Image is in ``tracks`` field of
 +  its header (see :doc:`parallels`).
 +* Several ``Image`` child elements.
 +
 +Each ``Image`` element has following child elements:
 +
 +* ``GUID`` - image identifier, UUID in curly brackets.
 +  For instance, ``{12345678-9abc-def1-2345-6789abcdef12}.``
 +  The GUID is used by the Snapshots element to reference images
 +  (see below)
 +* ``Type`` - image type of the element. It can be:
 +
 +  * ``Plain`` for raw files.
 +  * ``Compressed`` for expanding disks.
 +
 +* ``File`` - path to image file. Path can be relative to
 +  ``DiskDescriptor.xml`` or absolute.
 +
 +``Snapshots`` element
 +^^^^^^^^^^^^^^^^^^^^^
 +
 +The ``Snapshots`` element describes the snapshot relations with the snapshot tree.
 +
 +The element contains the set of ``Shot`` child elements, as shown below::
 +
 + <Snapshots>
 +    <TopGUID> ... </TopGUID> /* Optional child element */
 +    <Shot>
 +        ...
 +    </Shot>
 +    <Shot>
 +        ...
 +    </Shot>
 +    ...
 + </Snapshots>
 +
 +Each ``Shot`` element contains the following child elements:
 +
 +* ``GUID``       - an image GUID.
 +* ``ParentGUID`` - GUID of the image of the parent snapshot.
 +
 +The software may traverse snapshots from child to parent using ``<ParentGUID>``
 +field as reference. ``ParentGUID`` of root snapshot is
 +``{00000000-0000-0000-0000-000000000000}``. There should be only one root
 +snapshot. Top snapshot could be described via two ways: via ``TopGUID`` child
 +element of the ``Snapshots`` element or via predefined GUID
 +``{5fbaabe3-6958-40ff-92a7-860e329aab41}``. If ``TopGUID`` is defined,
 +predefined GUID is interpreted as usual GUID. All snapshot images
 +(except Top Snapshot) should be
 +opened read-only. There is another predefined GUID,
 +``BackupID = {704718e1-2314-44c8-9087-d78ed36b0f4e}``, which is used by
 +original and some third-party software for backup, QEMU and other
 +software may operate with images with ``GUID = BackupID`` as usual,
 +however, it is not recommended to use this
 +GUID for new disks. Top snapshot cannot have this GUID.
 diff --git a/docs/interop/prl-xml.txt b/docs/interop/prl-xml.txt
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
---- a/docs/interop/prl-xml.txt
+--- a/tests/tcg/arm/test-arm-iwmmxt.S
 +++ /dev/null
 @@ -XXX,XX +XXX,XX @@
--= License =
+-@ Checks whether iwMMXt is functional.
 -.code    32
 -.globl    main
 -
--Copyright (c) 2015-2017, Virtuozzo, Inc.
+-main:
--Authors:
+-ldr    r0, =data0
--        2015 Denis Lunev <den@openvz.org>
+-ldr    r1, =data1
--        2015 Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+-ldr    r2, =data2
--        2016-2017 Klim Kireev <klim.kireev@virtuozzo.com>
+-#ifndef FPA
--        2016-2017 Edgar Kaziakhmedov <edgar.kaziakhmedov@virtuozzo.com>
+-wldrd    wr0, [r0, #0]
 -wldrd    wr1, [r0, #8]
 -wldrd    wr2, [r1, #0]
 -wldrd    wr3, [r1, #8]
 -wsubb    wr2, wr2, wr0
 -wsubb    wr3, wr3, wr1
 -wldrd    wr0, [r2, #0]
 -wldrd    wr1, [r2, #8]
 -waddb    wr0, wr0, wr2
 -waddb    wr1, wr1, wr3
 -wstrd    wr0, [r2, #0]
 -wstrd    wr1, [r2, #8]
 -#else
 -ldfe    f0, [r0, #0]
 -ldfe    f1, [r0, #8]
 -ldfe    f2, [r1, #0]
 -ldfe    f3, [r1, #8]
 -adfdp    f2, f2, f0
 -adfdp    f3, f3, f1
 -ldfe    f0, [r2, #0]
 -ldfe    f1, [r2, #8]
 -adfd    f0, f0, f2
 -adfd    f1, f1, f3
 -stfe    f0, [r2, #0]
 -stfe    f1, [r2, #8]
 -#endif
 -mov    r0, #1
 -mov    r1, r2
 -mov    r2, #0x11
 -swi    #0x900004
 -mov    r0, #0
 -swi    #0x900001
 -
--This work is licensed under the terms of the GNU GPL, version 2 or later.
+-.data
--See the COPYING file in the top-level directory.
+-data0:
--
+-.string    "aaaabbbbccccdddd"
--This specification contains minimal information about Parallels Disk Format,
+-data1:
--which is enough to proper work with QEMU. Nevertheless, Parallels Cloud Server
+-.string    "bbbbccccddddeeee"
--and Parallels Desktop are able to add some unspecified nodes to xml and use
+-data2:
--them, but they are for internal work and don't affect functionality. Also it
+-.string    "hvLLWs\x1fsdrs9\x1fNJ-\n"
 -uses auxiliary xml "Snapshot.xml", which allows to store optional snapshot
 -information, but it doesn't influence open/read/write functionality. QEMU and
 -other software should not use fields not covered in this document and
 -Snapshot.xml file and must leave them as is.
 -
 -= Parallels Disk Format =
 -
 -Parallels disk consists of two parts: the set of snapshots and the disk
 -descriptor file, which stores information about all files and snapshots.
 -
 -== Definitions ==
 -    Snapshot       a record of the contents captured at a particular time,
 -                   capable of storing current state. A snapshot has UUID and
 -                   parent UUID.
 -
 - Snapshot image    an overlay representing the difference between this
 -                   snapshot and some earlier snapshot.
 -
 -    Overlay        an image storing the different sectors between two captured
 -                   states.
 -
 -   Root image      snapshot image with no parent, the root of snapshot tree.
 -
 -    Storage        the backing storage for a subset of the virtual disk. When
 -                   there is more than one storage in a Parallels disk then that
 -                   is referred to as a split image. In this case every storage
 -                   covers specific address space area of the disk and has its
 -                   particular root image. Split images are not considered here
 -                   and are not supported. Each storage consists of disk
 -                   parameters and a list of images. The list of images always
 -                   contains a root image and may also contain overlays. The
 -                   root image can be an expandable Parallels image file or
 -                   plain. Overlays must be expandable.
 -
 -  Description      DiskDescriptor.xml stores information about disk parameters,
 -     file          snapshots, storages.
 -
 -     Top           The overlay between actual state and some previous snapshot.
 -   Snapshot        It is not a snapshot in the classical sense because it
 -                   serves as the active image that the guest writes to.
 -
 -    Sector         a 512-byte data chunk.
 -
 -== Description file ==
 -All information is placed in a single XML element Parallels_disk_image.
 -The element has only one attribute "Version", that must be 1.0.
 -Schema of DiskDescriptor.xml:
 -
 -<Parallels_disk_image Version="1.0">
 -    <Disk_Parameters>
 -        ...
 -    </Disk_Parameters>
 -    <StorageData>
 -        ...
 -    </StorageData>
 -    <Snapshots>
 -        ...
 -    </Snapshots>
 -</Parallels_disk_image>
 -
 -== Disk_Parameters element ==
 -The Disk_Parameters element describes the physical layout of the virtual disk
 -and some general settings.
 -
 -The Disk_Parameters element MUST contain the following child elements:
 -    * Disk_size - number of sectors in the disk,
 -                  desired size of the disk.
 -    * Cylinders - number of the disk cylinders.
 -    * Heads     - number of the disk heads.
 -    * Sectors   - number of the disk sectors per cylinder
 -                  (sector size is 512 bytes)
 -                  Limitation: Product of the Heads, Sectors and Cylinders
 -                  values MUST be equal to the value of the Disk_size parameter.
 -    * Padding   - must be 0. Parallels Cloud Server and Parallels Desktop may
 -                  use padding set to 1, however this case is not covered
 -                  by this spec, QEMU and other software should not open
 -                  such disks and should not create them.
 -
 -== StorageData element ==
 -This element of the file describes the root image and all snapshot images.
 -
 -The StorageData element consists of the Storage child element, as shown below:
 -<StorageData>
 -    <Storage>
 -        ...
 -    </Storage>
 -</StorageData>
 -
 -A Storage element has following child elements:
 -    * Start     - start sector of the storage, in case of non split storage
 -                  equals to 0.
 -    * End       - number of sector following the last sector, in case of non
 -                  split storage equals to Disk_size.
 -    * Blocksize - storage cluster size, number of sectors per one cluster.
 -                  Cluster size for each "Compressed" (see below) image in
 -                  parallels disk must be equal to this field. Note: cluster
 -                  size for Parallels Expandable Image is in 'tracks' field of
 -                  its header (see docs/interop/parallels.txt).
 -    * Several Image child elements.
 -
 -Each Image element has following child elements:
 -    * GUID - image identifier, UUID in curly brackets.
 -             For instance, {12345678-9abc-def1-2345-6789abcdef12}.
 -             The GUID is used by the Snapshots element to reference images
 -             (see below)
 -    * Type - image type of the element. It can be:
 -             "Plain" for raw files.
 -             "Compressed" for expanding disks.
 -    * File - path to image file. Path can be relative to DiskDescriptor.xml or
 -             absolute.
 -
 -== Snapshots element ==
 -The Snapshots element describes the snapshot relations with the snapshot tree.
 -
 -The element contains the set of Shot child elements, as shown below:
 -<Snapshots>
 -    <TopGUID> ... </TopGUID> /* Optional child element */
 -    <Shot>
 -        ...
 -    </Shot>
 -    <Shot>
 -        ...
 -    </Shot>
 -    ...
 -</Snapshots>
 -
 -Each Shot element contains the following child elements:
 -    * GUID       - an image GUID.
 -    * ParentGUID - GUID of the image of the parent snapshot.
 -
 -The software may traverse snapshots from child to parent using <ParentGUID>
 -field as reference. ParentGUID of root snapshot is
 -{00000000-0000-0000-0000-000000000000}. There should be only one root
 -snapshot. Top snapshot could be described via two ways: via TopGUID child
 -element of the Snapshots element or via predefined GUID
 -{5fbaabe3-6958-40ff-92a7-860e329aab41}. If TopGUID is defined, predefined GUID is
 -interpreted as usual GUID. All snapshot images (except Top Snapshot) should be
 -opened read-only. There is another predefined GUID,
 -BackupID = {704718e1-2314-44c8-9087-d78ed36b0f4e}, which is used by original and
 -some third-party software for backup, QEMU and other software may operate with
 -images with GUID = BackupID as usual, however, it is not recommended to use this
 -GUID for new disks. Top snapshot cannot have this GUID.
 --
 .34.1

-[PULL 05/11] docs/interop/parallels.txt: Convert to rST
+[PULL 03/12] target/arm: Drop unused AArch64DecodeTable typedefs
-Convert parallels.txt to rST format.
+We removed the old table-based decoder in favour of decodetree, but
 we left a couple of typedefs that are now unused; delete them.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20250128135046.4108775-1-peter.maydell@linaro.org
 Message-id: 20240801170131.3977807-4-peter.maydell@linaro.org
 ---
- MAINTAINERS                                   |   2 +-
+ target/arm/tcg/translate-a64.c | 11 -----------
- docs/interop/index.rst                        |   1 +
+file changed, 11 deletions(-)
  docs/interop/{parallels.txt => parallels.rst} | 108 ++++++++++--------
 files changed, 60 insertions(+), 51 deletions(-)
  rename docs/interop/{parallels.txt => parallels.rst} (72%)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/target/arm/tcg/translate-a64.c
-+++ b/MAINTAINERS
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ L: qemu-block@nongnu.org
+@@ -XXX,XX +XXX,XX @@ static int scale_by_log2_tag_granule(DisasContext *s, int x)
- S: Supported
+ #include "decode-sme-fa64.c.inc"
- F: block/parallels.c
+ #include "decode-a64.c.inc"
- F: block/parallels-ext.c
--F: docs/interop/parallels.txt
+-/* Table based decoder typedefs - used when the relevant bits for decode
-+F: docs/interop/parallels.rst
+- * are too awkwardly scattered across the instruction (eg SIMD).
- T: git https://src.openvz.org/scm/~den/qemu.git parallels
+- */
+-typedef void AArch64DecodeFn(DisasContext *s, uint32_t insn);
  qed
 diff --git a/docs/interop/index.rst b/docs/interop/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/index.rst
 +++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ are useful for making QEMU interoperate with other software.
     dbus-display
     live-block-operations
     nbd
 +   parallels
     pr-helper
     qmp-spec
     qemu-ga
 diff --git a/docs/interop/parallels.txt b/docs/interop/parallels.rst
 similarity index 72%
 rename from docs/interop/parallels.txt
 rename to docs/interop/parallels.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/parallels.txt
 +++ b/docs/interop/parallels.rst
@@ -XXX,XX +XXX,XX @@
 -= License =
 +Parallels Expandable Image File Format
 +======================================
 -Copyright (c) 2015 Denis Lunev
 -Copyright (c) 2015 Vladimir Sementsov-Ogievskiy
 +..
 +   Copyright (c) 2015 Denis Lunev
 +   Copyright (c) 2015 Vladimir Sementsov-Ogievskiy
 -This work is licensed under the terms of the GNU GPL, version 2 or later.
 -See the COPYING file in the top-level directory.
 +   This work is licensed under the terms of the GNU GPL, version 2 or later.
 +   See the COPYING file in the top-level directory.
 -= Parallels Expandable Image File Format =
  A Parallels expandable image file consists of three consecutive parts:
 -    * header
 -    * BAT
 -    * data area
 +
 +* header
 +* BAT
 +* data area
  All numbers in a Parallels expandable image are stored in little-endian byte
  order.
 -== Definitions ==
 +Definitions
 +-----------
 -    Sector    A 512-byte data chunk.
 +Sector
 +  A 512-byte data chunk.
 -    Cluster   A data chunk of the size specified in the image header.
 -              Currently, the default size is 1MiB (2048 sectors). In previous
 -              versions, cluster sizes of 63 sectors, 256 and 252 kilobytes were
 -              used.
 +Cluster
 +  A data chunk of the size specified in the image header.
 +  Currently, the default size is 1MiB (2048 sectors). In previous
 +  versions, cluster sizes of 63 sectors, 256 and 252 kilobytes were used.
 -    BAT       Block Allocation Table, an entity that contains information for
 -              guest-to-host I/O data address translation.
 +BAT
 +  Block Allocation Table, an entity that contains information for
 +  guest-to-host I/O data address translation.
 -
--== Header ==
+-typedef struct AArch64DecodeTable {
-+Header
+-    uint32_t pattern;
-+------
+-    uint32_t mask;
+-    AArch64DecodeFn *disas_fn;
- The header is placed at the start of an image and contains the following
+-} AArch64DecodeTable;
 -fields:
 +fields::
 -Bytes:
 + Bytes:
 - 15:    magic
                Must contain "WithoutFreeSpace" or "WithouFreSpacExt".
@@ -XXX,XX +XXX,XX @@ Bytes:
                ext_off must meet the same requirements as cluster offsets
                defined by BAT entries (see below).
 -
--== BAT ==
+ /* initialize TCG globals.  */
-+BAT
+ void a64_translate_init(void)
-+---
+ {
  BAT is placed immediately after the image header. In the file, BAT is a
  contiguous array of 32-bit unsigned little-endian integers with
 -(bat_entries * 4) bytes size.
 +``(bat_entries * 4)`` bytes size.
  Each BAT entry contains an offset from the start of the file to the
 -corresponding cluster. The offset set in clusters for "WithouFreSpacExt" images
 -and in sectors for "WithoutFreeSpace" images.
 +corresponding cluster. The offset set in clusters for ``WithouFreSpacExt``
 +images and in sectors for ``WithoutFreeSpace`` images.
  If a BAT entry is zero, the corresponding cluster is not allocated and should
  be considered as filled with zeroes.
  Cluster offsets specified by BAT entries must meet the following requirements:
 -    - the value must not be lower than data offset (provided by header.data_off
 -      or calculated as specified above),
 -    - the value must be lower than the desired file size,
 -    - the value must be unique among all BAT entries,
 -    - the result of (cluster offset - data offset) must be aligned to cluster
 -      size.
 +- the value must not be lower than data offset (provided by ``header.data_off``
 +  or calculated as specified above)
 +- the value must be lower than the desired file size
 +- the value must be unique among all BAT entries
 +- the result of ``(cluster offset - data offset)`` must be aligned to
 +  cluster size
 -== Data Area ==
 +Data Area
 +---------
 -The data area is an area from the data offset (provided by header.data_off or
 -calculated as specified above) to the end of the file. It represents a
 +The data area is an area from the data offset (provided by ``header.data_off``
 +or calculated as specified above) to the end of the file. It represents a
  contiguous array of clusters. Most of them are allocated by the BAT, some may
 -be allocated by the ext_off field in the header while other may be allocated by
 -extensions. All clusters allocated by ext_off and extensions should meet the
 -same requirements as clusters specified by BAT entries.
 +be allocated by the ``ext_off`` field in the header while other may be
 +allocated by extensions. All clusters allocated by ``ext_off`` and extensions
 +should meet the same requirements as clusters specified by BAT entries.
 -== Format Extension ==
 +Format Extension
 +----------------
  The Format Extension is an area 1 cluster in size that provides additional
  format features. This cluster is addressed by the ext_off field in the header.
 -The format of the Format Extension area is the following:
 +The format of the Format Extension area is the following::
 -  7:    magic
                Must be 0xAB234CEF23DCEA87
@@ -XXX,XX +XXX,XX @@ The format of the Format Extension area is the following:
                The MD5 checksum of the entire Header Extension cluster except
                the first 24 bytes.
 -    The above are followed by feature sections or "extensions". The last
 -    extension must be "End of features" (see below).
 +The above are followed by feature sections or "extensions". The last
 +extension must be "End of features" (see below).
 -Each feature section has the following format:
 +Each feature section has the following format::
 -  7:    magic
                The identifier of the feature:
@@ -XXX,XX +XXX,XX @@ Each feature section has the following format:
    variable:   data (data_size bytes)
 -    The above is followed by padding to the next 8 bytes boundary, then the
 -    next extension starts.
 +The above is followed by padding to the next 8 bytes boundary, then the
 +next extension starts.
 -    The last extension must be "End of features" with all the fields set to 0.
 +The last extension must be "End of features" with all the fields set to 0.
 -=== Dirty bitmaps feature ===
 +Dirty bitmaps feature
 +---------------------
  This feature provides a way of storing dirty bitmaps in the image. The fields
 -of its data area are:
 +of its data area are::
 -  7:    size
                The bitmap size, should be equal to disk size in sectors.
@@ -XXX,XX +XXX,XX @@ clusters inside the Parallels image file. The offsets of these clusters are
  saved in the L1 offset table specified by the feature extension. Each L1 table
  entry is a 64 bit integer as described below:
 -Given an offset in bytes into the bitmap data, corresponding L1 entry is
 +Given an offset in bytes into the bitmap data, corresponding L1 entry is::
      l1_table[offset / cluster_size]
@@ -XXX,XX +XXX,XX @@ are assumed to be 1.
  If an L1 table entry is not 0 or 1, it contains the corresponding cluster
  offset (in 512b sectors). Given an offset in bytes into the bitmap data the
 -offset in bytes into the image file can be obtained as follows:
 +offset in bytes into the image file can be obtained as follows::
      offset = l1_table[offset / cluster_size] * 512 + (offset % cluster_size)
 --
 .34.1

-[PULL 11/11] arm/virt: place power button pin number on a define
+[PULL 04/12] hw/arm/boot: Propagate vCPU to arm_load_dtb()
-From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Having magic numbers inside the code is not a good idea, as it
+In heterogeneous setup the first vCPU might not be
-is error-prone. So, instead, create a macro with the number
+the one expected, better pass it explicitly.
 definition.
-Link: https://lore.kernel.org/qemu-devel/CAFEAcA-PYnZ-32MRX+PgvzhnoAV80zBKMYg61j2f=oHaGfwSsg@mail.gmail.com/
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Message-id: 20250130112615.3219-2-philmd@linaro.org
 Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
 Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 Message-id: ef0e7f5fca6cd94eda415ecee670c3028c671b74.1723121692.git.mchehab+huawei@kernel.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
 Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/virt.h    | 3 +++
+ include/hw/arm/boot.h |  4 +++-
- hw/arm/virt-acpi-build.c | 6 +++---
+ hw/arm/boot.c         | 11 ++++++-----
- hw/arm/virt.c            | 7 ++++---
+ hw/arm/virt.c         |  2 +-
-files changed, 10 insertions(+), 6 deletions(-)
+files changed, 10 insertions(+), 7 deletions(-)
-diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+diff --git a/include/hw/arm/boot.h b/include/hw/arm/boot.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/virt.h
+--- a/include/hw/arm/boot.h
-+++ b/include/hw/arm/virt.h
++++ b/include/hw/arm/boot.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ AddressSpace *arm_boot_address_space(ARMCPU *cpu,
- /* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
+  * @binfo:      struct describing the boot environment
- #define PVTIME_SIZE_PER_CPU 64
+  * @addr_limit: upper limit of the available memory area at @addr
+  * @as:         address space to load image to
-+/* GPIO pins */
++ * @cpu:        ARM CPU object
-+#define GPIO_PIN_POWER_BUTTON  3
+  *
-+
+  * Load a device tree supplied by the machine or by the user  with the
- enum {
+  * '-dtb' command line option, and put it at offset @addr in target
-     VIRT_FLASH,
+@@ -XXX,XX +XXX,XX @@ AddressSpace *arm_boot_address_space(ARMCPU *cpu,
-     VIRT_MEM,
+  * Note: Must not be called unless have_dtb(binfo) is true.
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+  */
  int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
 -                 hwaddr addr_limit, AddressSpace *as, MachineState *ms);
 +                 hwaddr addr_limit, AddressSpace *as, MachineState *ms,
 +                 ARMCPU *cpu);
  /* Write a secure board setup routine with a dummy handler for SMCs */
  void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/hw/arm/boot.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_gpio(Aml *scope, const MemMapEntry *gpio_memmap,
+@@ -XXX,XX +XXX,XX @@ out:
-     aml_append(dev, aml_name_decl("_CRS", crs));
+     return ret;
+ }
-     Aml *aei = aml_resource_template();
--    /* Pin 3 for power button */
+-static void fdt_add_psci_node(void *fdt)
--    const uint32_t pin_list[1] = {3};
++static void fdt_add_psci_node(void *fdt, ARMCPU *armcpu)
-+
+ {
-+    const uint32_t pin = GPIO_PIN_POWER_BUTTON;
+     uint32_t cpu_suspend_fn;
-     aml_append(aei, aml_gpio_int(AML_CONSUMER, AML_EDGE, AML_ACTIVE_HIGH,
+     uint32_t cpu_off_fn;
--                                 AML_EXCLUSIVE, AML_PULL_UP, 0, pin_list, 1,
+     uint32_t cpu_on_fn;
-+                                 AML_EXCLUSIVE, AML_PULL_UP, 0, &pin, 1,
+     uint32_t migrate_fn;
-                                  "GPO0", NULL, 0));
+-    ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(0));
-     aml_append(dev, aml_name_decl("_AEI", aei));
+     const char *psci_method;
+     int64_t psci_conduit;
      int rc;
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
  }
  int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
 -                 hwaddr addr_limit, AddressSpace *as, MachineState *ms)
 +                 hwaddr addr_limit, AddressSpace *as, MachineState *ms,
 +                 ARMCPU *cpu)
  {
      void *fdt = NULL;
      int size, rc, n = 0;
@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
          }
      }
 -    fdt_add_psci_node(fdt);
 +    fdt_add_psci_node(fdt, cpu);
      if (binfo->modify_dtb) {
          binfo->modify_dtb(binfo, fdt);
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
       * decided whether to enable PSCI and set the psci-conduit CPU properties.
       */
      if (!info->skip_dtb_autoload && have_dtb(info)) {
 -        if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as, ms) < 0) {
 +        if (arm_load_dtb(info->dtb_start, info, info->dtb_limit,
 +                         as, ms, cpu) < 0) {
              exit(1);
          }
      }
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_powerdown_req(Notifier *n, void *opaque)
+@@ -XXX,XX +XXX,XX @@ void virt_machine_done(Notifier *notifier, void *data)
-     if (s->acpi_dev) {
+                                        vms->memmap[VIRT_PLATFORM_BUS].size,
-         acpi_send_event(s->acpi_dev, ACPI_POWER_DOWN_STATUS);
+                                        vms->irqmap[VIRT_PLATFORM_BUS]);
      } else {
 -        /* use gpio Pin 3 for power button event */
 +        /* use gpio Pin for power button event */
          qemu_set_irq(qdev_get_gpio_in(gpio_key_dev, 0), 1);
      }
- }
+-    if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as, ms) < 0) {
-@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(char *fdt, DeviceState *pl061_dev,
++    if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as, ms, cpu) < 0) {
-                              uint32_t phandle)
+         exit(1);
- {
+     }
-     gpio_key_dev = sysbus_create_simple("gpio-key", -1,
 -                                        qdev_get_gpio_in(pl061_dev, 3));
 +                                        qdev_get_gpio_in(pl061_dev,
 +                                                         GPIO_PIN_POWER_BUTTON));
      qemu_fdt_add_subnode(fdt, "/gpio-keys");
      qemu_fdt_setprop_string(fdt, "/gpio-keys", "compatible", "gpio-keys");
@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(char *fdt, DeviceState *pl061_dev,
      qemu_fdt_setprop_cell(fdt, "/gpio-keys/poweroff", "linux,code",
                            KEY_POWER);
      qemu_fdt_setprop_cells(fdt, "/gpio-keys/poweroff",
 -                           "gpios", phandle, 3, 0);
 +                           "gpios", phandle, GPIO_PIN_POWER_BUTTON, 0);
  }
  #define SECURE_GPIO_POWEROFF 0
 --
 .34.1

-[PULL 04/11] docs/interop/nbd.txt: Convert to rST
+[PULL 05/12] hw/arm/fsl-imx6: Add local 'mpcore/gic' variables
-Convert nbd.txt to rST format.
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+The A9MPCore forward the IRQs from its internal GIC.
+To make the code clearer, add the 'mpcore' and 'gic'
+variables.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20250130112615.3219-3-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20240801170131.3977807-3-peter.maydell@linaro.org
 ---
- MAINTAINERS            |  2 +-
+ hw/arm/fsl-imx6.c | 52 +++++++++++++++++++----------------------------
- docs/interop/index.rst |  1 +
+file changed, 21 insertions(+), 31 deletions(-)
  docs/interop/nbd.rst   | 89 ++++++++++++++++++++++++++++++++++++++++++
  docs/interop/nbd.txt   | 72 ----------------------------------
 files changed, 91 insertions(+), 73 deletions(-)
  create mode 100644 docs/interop/nbd.rst
  delete mode 100644 docs/interop/nbd.txt
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/arm/fsl-imx6.c
-+++ b/MAINTAINERS
++++ b/hw/arm/fsl-imx6.c
-@@ -XXX,XX +XXX,XX @@ F: nbd/
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
- F: include/block/nbd*
+     uint16_t i;
- F: qemu-nbd.*
+     qemu_irq irq;
- F: blockdev-nbd.c
+     unsigned int smp_cpus = ms->smp.cpus;
--F: docs/interop/nbd.txt
++    DeviceState *mpcore = DEVICE(&s->a9mpcore);
-+F: docs/interop/nbd.rst
++    DeviceState *gic;
- F: docs/tools/qemu-nbd.rst
- F: tests/qemu-iotests/tests/*nbd*
+     if (smp_cpus > FSL_IMX6_NUM_CPUS) {
- T: git https://repo.or.cz/qemu/ericb.git nbd
+         error_setg(errp, "%s: Only %d CPUs are supported (%d requested)",
-diff --git a/docs/interop/index.rst b/docs/interop/index.rst
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-index XXXXXXX..XXXXXXX 100644
+         }
---- a/docs/interop/index.rst
+     }
-+++ b/docs/interop/index.rst
-@@ -XXX,XX +XXX,XX @@ are useful for making QEMU interoperate with other software.
+-    object_property_set_int(OBJECT(&s->a9mpcore), "num-cpu", smp_cpus,
-    dbus-vmstate
+-                            &error_abort);
-    dbus-display
++    object_property_set_int(OBJECT(mpcore), "num-cpu", smp_cpus, &error_abort);
-    live-block-operations
-+   nbd
+-    object_property_set_int(OBJECT(&s->a9mpcore), "num-irq",
-    pr-helper
++    object_property_set_int(OBJECT(mpcore), "num-irq",
-    qmp-spec
+                             FSL_IMX6_MAX_IRQ + GIC_INTERNAL, &error_abort);
-    qemu-ga
-diff --git a/docs/interop/nbd.rst b/docs/interop/nbd.rst
+-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->a9mpcore), errp)) {
-new file mode 100644
++    if (!sysbus_realize(SYS_BUS_DEVICE(mpcore), errp)) {
-index XXXXXXX..XXXXXXX
+         return;
---- /dev/null
+     }
-+++ b/docs/interop/nbd.rst
+-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a9mpcore), 0, FSL_IMX6_A9MPCORE_ADDR);
-@@ -XXX,XX +XXX,XX @@
++    sysbus_mmio_map(SYS_BUS_DEVICE(mpcore), 0, FSL_IMX6_A9MPCORE_ADDR);
-+QEMU NBD protocol support
-+=========================
++    gic = mpcore;
-+
+     for (i = 0; i < smp_cpus; i++) {
-+QEMU supports the NBD protocol, and has an internal NBD client (see
+-        sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i,
-+``block/nbd.c``), an internal NBD server (see ``blockdev-nbd.c``), and an
++        sysbus_connect_irq(SYS_BUS_DEVICE(gic), i,
-+external NBD server tool (see ``qemu-nbd.c``). The common code is placed
+                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_IRQ));
-+in ``nbd/*``.
+-        sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i + smp_cpus,
-+
++        sysbus_connect_irq(SYS_BUS_DEVICE(gic), i + smp_cpus,
-+The NBD protocol is specified here:
+                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_FIQ));
-+https://github.com/NetworkBlockDevice/nbd/blob/master/doc/proto.md
+     }
-+
-+The following paragraphs describe some specific properties of NBD
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+protocol realization in QEMU.
-+
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->uart[i]), 0, serial_table[i].addr);
-+Metadata namespaces
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-+-------------------
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+
+-                                            serial_table[i].irq));
-+QEMU supports the ``base:allocation`` metadata context as defined in the
++                           qdev_get_gpio_in(gic, serial_table[i].irq));
-+NBD protocol specification, and also defines an additional metadata
+     }
-+namespace ``qemu``.
-+
+     s->gpt.ccm = IMX_CCM(&s->ccm);
-+``qemu`` namespace
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+------------------
-+
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpt), 0, FSL_IMX6_GPT_ADDR);
-+The ``qemu`` namespace currently contains two available metadata context
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpt), 0,
-+types.  The first is related to exposing the contents of a dirty
+-                       qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+bitmap alongside the associated disk contents.  That metadata context
+-                                        FSL_IMX6_GPT_IRQ));
-+is named with the following form::
++                       qdev_get_gpio_in(gic, FSL_IMX6_GPT_IRQ));
-+
-+    qemu:dirty-bitmap:<dirty-bitmap-export-name>
+     /* Initialize all EPIT timers */
-+
+     for (i = 0; i < FSL_IMX6_NUM_EPITS; i++) {
-+Each dirty-bitmap metadata context defines only one flag for extents
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+in reply for ``NBD_CMD_BLOCK_STATUS``:
-+
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->epit[i]), 0, epit_table[i].addr);
-+bit 0:
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->epit[i]), 0,
-+  ``NBD_STATE_DIRTY``, set when the extent is "dirty"
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+
+-                                            epit_table[i].irq));
-+The second is related to exposing the source of various extents within
++                           qdev_get_gpio_in(gic, epit_table[i].irq));
-+the image, with a single metadata context named::
+     }
-+
-+    qemu:allocation-depth
+     /* Initialize all I2C */
-+
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+In the allocation depth context, the entire 32-bit value represents a
-+depth of which layer in a thin-provisioned backing chain provided the
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c[i]), 0, i2c_table[i].addr);
-+data (0 for unallocated, 1 for the active layer, 2 for the first
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c[i]), 0,
-+backing layer, and so forth).
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+
+-                                            i2c_table[i].irq));
-+For ``NBD_OPT_LIST_META_CONTEXT`` the following queries are supported
++                           qdev_get_gpio_in(gic, i2c_table[i].irq));
-+in addition to the specific ``qemu:allocation-depth`` and
+     }
-+``qemu:dirty-bitmap:<dirty-bitmap-export-name>``:
-+
+     /* Initialize all GPIOs */
-+``qemu:``
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+  returns list of all available metadata contexts in the namespace
-+``qemu:dirty-bitmap:``
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio[i]), 0, gpio_table[i].addr);
-+  returns list of all available dirty-bitmap metadata contexts
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 0,
-+
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+Features by version
+-                                            gpio_table[i].irq_low));
-+-------------------
++                           qdev_get_gpio_in(gic, gpio_table[i].irq_low));
-+
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 1,
-+The following list documents which qemu version first implemented
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+various features (both as a server exposing the feature, and as a
+-                                            gpio_table[i].irq_high));
-+client taking advantage of the feature when present), to make it
++                           qdev_get_gpio_in(gic, gpio_table[i].irq_high));
-+easier to plan for cross-version interoperability.  Note that in
+     }
-+several cases, the initial release containing a feature may require
-+additional patches from the corresponding stable branch to fix bugs in
+     /* Initialize all SDHC */
-+the operation of that feature.
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+
+         }
-+2.6
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->esdhc[i]), 0, esdhc_table[i].addr);
-+  ``NBD_OPT_STARTTLS`` with TLS X.509 Certificates
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->esdhc[i]), 0,
-+2.8
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+  ``NBD_CMD_WRITE_ZEROES``
+-                                            esdhc_table[i].irq));
-+2.10
++                           qdev_get_gpio_in(gic, esdhc_table[i].irq));
-+  ``NBD_OPT_GO``, ``NBD_INFO_BLOCK``
+     }
-+2.11
-+  ``NBD_OPT_STRUCTURED_REPLY``
+     /* USB */
-+2.12
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+  ``NBD_CMD_BLOCK_STATUS`` for ``base:allocation``
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
-+3.0
+                         FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);
-+  ``NBD_OPT_STARTTLS`` with TLS Pre-Shared Keys (PSK),
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
-+  ``NBD_CMD_BLOCK_STATUS`` for ``qemu:dirty-bitmap:``, ``NBD_CMD_CACHE``
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-+4.2
+-                                            FSL_IMX6_USBn_IRQ[i]));
-+  ``NBD_FLAG_CAN_MULTI_CONN`` for shareable read-only exports,
++                           qdev_get_gpio_in(gic, FSL_IMX6_USBn_IRQ[i]));
-+  ``NBD_CMD_FLAG_FAST_ZERO``
+     }
-+5.2
-+  ``NBD_CMD_BLOCK_STATUS`` for ``qemu:allocation-depth``
+     /* Initialize all ECSPI */
-+7.1
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-+  ``NBD_FLAG_CAN_MULTI_CONN`` for shareable writable exports
-+8.2
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0, spi_table[i].addr);
-+  ``NBD_OPT_EXTENDED_HEADERS``, ``NBD_FLAG_BLOCK_STATUS_PAYLOAD``
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
-diff --git a/docs/interop/nbd.txt b/docs/interop/nbd.txt
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-deleted file mode 100644
+-                                            spi_table[i].irq));
-index XXXXXXX..XXXXXXX
++                           qdev_get_gpio_in(gic, spi_table[i].irq));
---- a/docs/interop/nbd.txt
+     }
-+++ /dev/null
-@@ -XXX,XX +XXX,XX @@
+     object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num,
--QEMU supports the NBD protocol, and has an internal NBD client (see
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
--block/nbd.c), an internal NBD server (see blockdev-nbd.c), and an
+     }
--external NBD server tool (see qemu-nbd.c). The common code is placed
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->eth), 0, FSL_IMX6_ENET_ADDR);
--in nbd/*.
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth), 0,
--
+-                       qdev_get_gpio_in(DEVICE(&s->a9mpcore),
--The NBD protocol is specified here:
+-                                        FSL_IMX6_ENET_MAC_IRQ));
--https://github.com/NetworkBlockDevice/nbd/blob/master/doc/proto.md
++                       qdev_get_gpio_in(gic, FSL_IMX6_ENET_MAC_IRQ));
--
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth), 1,
--The following paragraphs describe some specific properties of NBD
+-                       qdev_get_gpio_in(DEVICE(&s->a9mpcore),
--protocol realization in QEMU.
+-                                        FSL_IMX6_ENET_MAC_1588_IRQ));
--
++                       qdev_get_gpio_in(gic, FSL_IMX6_ENET_MAC_1588_IRQ));
--= Metadata namespaces =
--
+     /*
--QEMU supports the "base:allocation" metadata context as defined in the
+      * SNVS
--NBD protocol specification, and also defines an additional metadata
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
--namespace "qemu".
--
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0, FSL_IMX6_WDOGn_ADDR[i]);
--== "qemu" namespace ==
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->wdt[i]), 0,
--
+-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
--The "qemu" namespace currently contains two available metadata context
+-                                            FSL_IMX6_WDOGn_IRQ[i]));
--types.  The first is related to exposing the contents of a dirty
++                           qdev_get_gpio_in(gic, FSL_IMX6_WDOGn_IRQ[i]));
--bitmap alongside the associated disk contents.  That metadata context
+     }
--is named with the following form:
--
+     /*
 -    qemu:dirty-bitmap:<dirty-bitmap-export-name>
 -
 -Each dirty-bitmap metadata context defines only one flag for extents
 -in reply for NBD_CMD_BLOCK_STATUS:
 -
 -    bit 0: NBD_STATE_DIRTY, set when the extent is "dirty"
 -
 -The second is related to exposing the source of various extents within
 -the image, with a single metadata context named:
 -
 -    qemu:allocation-depth
 -
 -In the allocation depth context, the entire 32-bit value represents a
 -depth of which layer in a thin-provisioned backing chain provided the
 -data (0 for unallocated, 1 for the active layer, 2 for the first
 -backing layer, and so forth).
 -
 -For NBD_OPT_LIST_META_CONTEXT the following queries are supported
 -in addition to the specific "qemu:allocation-depth" and
 -"qemu:dirty-bitmap:<dirty-bitmap-export-name>":
 -
 -* "qemu:" - returns list of all available metadata contexts in the
 -            namespace.
 -* "qemu:dirty-bitmap:" - returns list of all available dirty-bitmap
 -                         metadata contexts.
 -
 -= Features by version =
 -
 -The following list documents which qemu version first implemented
 -various features (both as a server exposing the feature, and as a
 -client taking advantage of the feature when present), to make it
 -easier to plan for cross-version interoperability.  Note that in
 -several cases, the initial release containing a feature may require
 -additional patches from the corresponding stable branch to fix bugs in
 -the operation of that feature.
 -
 -* 2.6: NBD_OPT_STARTTLS with TLS X.509 Certificates
 -* 2.8: NBD_CMD_WRITE_ZEROES
 -* 2.10: NBD_OPT_GO, NBD_INFO_BLOCK
 -* 2.11: NBD_OPT_STRUCTURED_REPLY
 -* 2.12: NBD_CMD_BLOCK_STATUS for "base:allocation"
 -* 3.0: NBD_OPT_STARTTLS with TLS Pre-Shared Keys (PSK),
 -NBD_CMD_BLOCK_STATUS for "qemu:dirty-bitmap:", NBD_CMD_CACHE
 -* 4.2: NBD_FLAG_CAN_MULTI_CONN for shareable read-only exports,
 -NBD_CMD_FLAG_FAST_ZERO
 -* 5.2: NBD_CMD_BLOCK_STATUS for "qemu:allocation-depth"
 -* 7.1: NBD_FLAG_CAN_MULTI_CONN for shareable writable exports
 -* 8.2: NBD_OPT_EXTENDED_HEADERS, NBD_FLAG_BLOCK_STATUS_PAYLOAD
 --
 .34.1

-[PULL 03/11] docs/specs/rocker.txt: Convert to rST
+[PULL 06/12] hw/arm/fsl-imx6ul: Add local 'mpcore/gic' variables
-Convert the rocker.txt specification document to rST format.  We make
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 extensive use of the :: marker to introduce a literal block for all
 the tables and ASCII art, rather than trying to convert the tables to
 rST table syntax.  This produces a valid rST document without needing
 a huge diff.
+The A7MPCore forward the IRQs from its internal GIC.
+To make the code clearer, add the 'mpcore' and 'gic'
+variables. Rename 'd' variable as 'cpu'.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20250130112615.3219-4-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20240801170131.3977807-2-peter.maydell@linaro.org
 ---
- MAINTAINERS                           |   2 +-
+ hw/arm/fsl-imx6ul.c | 64 +++++++++++++++++++--------------------------
- docs/specs/index.rst                  |   1 +
+file changed, 27 insertions(+), 37 deletions(-)
  docs/specs/{rocker.txt => rocker.rst} | 181 +++++++++++++-------------
 files changed, 93 insertions(+), 91 deletions(-)
  rename docs/specs/{rocker.txt => rocker.rst} (91%)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/arm/fsl-imx6ul.c
-+++ b/MAINTAINERS
++++ b/hw/arm/fsl-imx6ul.c
-@@ -XXX,XX +XXX,XX @@ S: Maintained
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
- F: hw/net/rocker/
+ {
- F: qapi/rocker.json
+     MachineState *ms = MACHINE(qdev_get_machine());
- F: tests/rocker/
+     FslIMX6ULState *s = FSL_IMX6UL(dev);
--F: docs/specs/rocker.txt
++    DeviceState *mpcore = DEVICE(&s->a7mpcore);
-+F: docs/specs/rocker.rst
+     int i;
+     char name[NAME_SIZE];
- e1000x
+-    SysBusDevice *sbd;
- M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
+-    DeviceState *d;
-diff --git a/docs/specs/index.rst b/docs/specs/index.rst
++    DeviceState *gic;
-index XXXXXXX..XXXXXXX 100644
++    SysBusDevice *gicsbd;
---- a/docs/specs/index.rst
++    DeviceState *cpu;
-+++ b/docs/specs/index.rst
-@@ -XXX,XX +XXX,XX @@ guest hardware that is specific to QEMU.
+     if (ms->smp.cpus > 1) {
-    vmcoreinfo
+         error_setg(errp, "%s: Only a single CPU is supported (%d requested)",
-    vmgenid
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-    rapl-msr
+     /*
-+   rocker
+      * A7MPCORE
-diff --git a/docs/specs/rocker.txt b/docs/specs/rocker.rst
+      */
-similarity index 91%
+-    object_property_set_int(OBJECT(&s->a7mpcore), "num-cpu", 1, &error_abort);
-rename from docs/specs/rocker.txt
+-    object_property_set_int(OBJECT(&s->a7mpcore), "num-irq",
-rename to docs/specs/rocker.rst
++    object_property_set_int(OBJECT(mpcore), "num-cpu", 1, &error_abort);
-index XXXXXXX..XXXXXXX 100644
++    object_property_set_int(OBJECT(mpcore), "num-irq",
---- a/docs/specs/rocker.txt
+                             FSL_IMX6UL_MAX_IRQ + GIC_INTERNAL, &error_abort);
-+++ b/docs/specs/rocker.rst
+-    sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
-@@ -XXX,XX +XXX,XX @@
+-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, FSL_IMX6UL_A7MPCORE_ADDR);
- Rocker Network Switch Register Programming Guide
++    sysbus_realize(SYS_BUS_DEVICE(mpcore), &error_abort);
--Copyright (c) Scott Feldman <sfeldma@gmail.com>
++    sysbus_mmio_map(SYS_BUS_DEVICE(mpcore), 0, FSL_IMX6UL_A7MPCORE_ADDR);
--Copyright (c) Neil Horman <nhorman@tuxdriver.com>
--Version 0.11, 12/29/2014
+-    sbd = SYS_BUS_DEVICE(&s->a7mpcore);
-+************************************************
+-    d = DEVICE(&s->cpu);
 -LICENSE
 -=======
 +..
 +   Copyright (c) Scott Feldman <sfeldma@gmail.com>
 +   Copyright (c) Neil Horman <nhorman@tuxdriver.com>
 +   Version 0.11, 12/29/2014
 -This program is free software; you can redistribute it and/or modify
 -it under the terms of the GNU General Public License as published by
 -the Free Software Foundation; either version 2 of the License, or
 -(at your option) any later version.
 +   This program is free software; you can redistribute it and/or modify
 +   it under the terms of the GNU General Public License as published by
 +   the Free Software Foundation; either version 2 of the License, or
 +   (at your option) any later version.
 -This program is distributed in the hope that it will be useful,
 -but WITHOUT ANY WARRANTY; without even the implied warranty of
 -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 -GNU General Public License for more details.
 +   This program is distributed in the hope that it will be useful,
 +   but WITHOUT ANY WARRANTY; without even the implied warranty of
 +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 +   GNU General Public License for more details.
 -SECTION 1: Introduction
 -=======================
 +Introduction
 +============
  Overview
  --------
@@ -XXX,XX +XXX,XX @@ software.
  Notations and Conventions
  -------------------------
 -o In register descriptions, [n:m] indicates a range from bit n to bit m,
 -inclusive.
 -o Use of leading 0x indicates a hexadecimal number.
 -o Use of leading 0b indicates a binary number.
 -o The use of RSVD or Reserved indicates that a bit or field is reserved for
 -future use.
 -o Field width is in bytes, unless otherwise noted.
 -o Register are (R) read-only, (R/W) read/write, (W) write-only, or (COR) clear
 -on read
 -o TLV values in network-byte-order are designated with (N).
 +* In register descriptions, [n:m] indicates a range from bit n to bit m,
 +  inclusive.
 +* Use of leading 0x indicates a hexadecimal number.
 +* Use of leading 0b indicates a binary number.
 +* The use of RSVD or Reserved indicates that a bit or field is reserved for
 +  future use.
 +* Field width is in bytes, unless otherwise noted.
 +* Register are (R) read-only, (R/W) read/write, (W) write-only, or (COR) clear
 +  on read
 +* TLV values in network-byte-order are designated with (N).
 -SECTION 2: PCI Configuration Registers
 -======================================
 +PCI Configuration Registers
 +===========================
  PCI Configuration Space
  -----------------------
 -Each switch instance registers as a PCI device with PCI configuration space:
 +Each switch instance registers as a PCI device with PCI configuration space::
      offset    width    description        value
      ---------------------------------------------
@@ -XXX,XX +XXX,XX @@ Each switch instance registers as a PCI device with PCI configuration space:
 x41    1    Retry count
 x42    2    Reserved
 +        * Assigned by sub-system implementation
 -* Assigned by sub-system implementation
 -
--SECTION 3: Memory-Mapped Register Space
+-    sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(d, ARM_CPU_IRQ));
--=======================================
+-    sysbus_connect_irq(sbd, 1, qdev_get_gpio_in(d, ARM_CPU_FIQ));
-+Memory-Mapped Register Space
+-    sysbus_connect_irq(sbd, 2, qdev_get_gpio_in(d, ARM_CPU_VIRQ));
-+============================
+-    sysbus_connect_irq(sbd, 3, qdev_get_gpio_in(d, ARM_CPU_VFIQ));
++    gic = mpcore;
- There are two memory-mapped BARs.  BAR0 maps device register space and is
++    gicsbd = SYS_BUS_DEVICE(gic);
-x2000 in size.  BAR1 maps MSI-X vector and PBA tables and is also 0x2000 in
++    cpu = DEVICE(&s->cpu);
-@@ -XXX,XX +XXX,XX @@ byte registers with one 4-byte access, and 8 byte registers with either two
++    sysbus_connect_irq(gicsbd, 0, qdev_get_gpio_in(cpu, ARM_CPU_IRQ));
--byte accesses or a single 8-byte access.  In the case of two 4-byte accesses,
++    sysbus_connect_irq(gicsbd, 1, qdev_get_gpio_in(cpu, ARM_CPU_FIQ));
- access must be lower and then upper 4-bytes, in that order.
++    sysbus_connect_irq(gicsbd, 2, qdev_get_gpio_in(cpu, ARM_CPU_VIRQ));
++    sysbus_connect_irq(gicsbd, 3, qdev_get_gpio_in(cpu, ARM_CPU_VFIQ));
--BAR0 device register space is organized as follows:
-+BAR0 device register space is organized as follows::
+     /*
+      * A7MPCORE DAP
-     offset        description
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-     ------------------------------------------------------
+                         FSL_IMX6UL_GPTn_ADDR[i]);
-@@ -XXX,XX +XXX,XX @@ Reads to reserved registers read back as 0.
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpt[i]), 0,
- No fancy stuff like write-combining is enabled on any of the registers.
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+-                                            FSL_IMX6UL_GPTn_IRQ[i]));
--BAR1 MSI-X register space is organized as follows:
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_GPTn_IRQ[i]));
-+BAR1 MSI-X register space is organized as follows::
+     }
-     offset        description
+     /*
-     ------------------------------------------------------
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ BAR1 MSI-X register space is organized as follows:
+                         FSL_IMX6UL_EPITn_ADDR[i]);
-x1000-0x1fff    MSI-X PBA table
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->epit[i]), 0,
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
--SECTION 4: Interrupts, DMA, and Endianness
+-                                            FSL_IMX6UL_EPITn_IRQ[i]));
--==========================================
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_EPITn_IRQ[i]));
-+Interrupts, DMA, and Endianness
+     }
-+===============================
+     /*
- PCI Interrupts
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
- --------------
+                         FSL_IMX6UL_GPIOn_ADDR[i]);
-@@ -XXX,XX +XXX,XX @@ PCI Interrupts
- The device supports only MSI-X interrupts.  BAR1 memory-mapped region contains
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 0,
- the MSI-X vector and PBA tables, with support for up to 256 MSI-X vectors.
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+-                                            FSL_IMX6UL_GPIOn_LOW_IRQ[i]));
--The vector assignment is:
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_GPIOn_LOW_IRQ[i]));
-+The vector assignment is::
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 1,
-     vector        description
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-     -----------------------------------------------------
+-                                            FSL_IMX6UL_GPIOn_HIGH_IRQ[i]));
-@@ -XXX,XX +XXX,XX @@ The vector assignment is:
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_GPIOn_HIGH_IRQ[i]));
-               Tx vector is even
+     }
-               Rx vector is odd
+     /*
--A MSI-X vector table entry is 16 bytes:
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-+A MSI-X vector table entry is 16 bytes::
+                         FSL_IMX6UL_SPIn_ADDR[i]);
-     field        offset    width    description
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
-     -------------------------------------------------------------
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-@@ -XXX,XX +XXX,XX @@ ring, and hardware will set this bit when the descriptor is complete.
+-                                            FSL_IMX6UL_SPIn_IRQ[i]));
- Descriptor ring sizes must be a power of 2 and range from 2 to 64K entries.
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_SPIn_IRQ[i]));
- Descriptor rings' base address must be 8-byte aligned.  Descriptors must be
+     }
- packed within ring.  Each descriptor in each ring must also be aligned on an 8
--byte boundary.  Each descriptor ring will have these registers:
+     /*
-+byte boundary.  Each descriptor ring will have these registers::
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c[i]), 0, FSL_IMX6UL_I2Cn_ADDR[i]);
-     DMA_DESC_xxx_BASE_ADDR, offset 0x1000 + (x * 32), 64-bit, (R/W)
-     DMA_DESC_xxx_SIZE, offset 0x1008 + (x * 32), 32-bit, (R/W)
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c[i]), 0,
-@@ -XXX,XX +XXX,XX @@ byte boundary.  Each descriptor ring will have these registers:
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-     DMA_DESC_xxx_CREDITS, offset 0x1018 + (x * 32), 32-bit, (R/W)
+-                                            FSL_IMX6UL_I2Cn_IRQ[i]));
-     DMA_DESC_xxx_RSVD1, offset 0x101c + (x * 32), 32-bit, (R/W)
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_I2Cn_IRQ[i]));
+     }
--Where x is descriptor ring index:
-+Where x is descriptor ring index::
+     /*
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-     index        ring
+                         FSL_IMX6UL_UARTn_ADDR[i]);
-     --------------------
-@@ -XXX,XX +XXX,XX @@ written past TAIL.  To do so would wrap the ring.  An empty ring is when HEAD
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
- == TAIL.  A full ring is when HEAD is one position behind TAIL.  Both HEAD and
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
- TAIL increment and modulo wrap at the ring size.
+-                                            FSL_IMX6UL_UARTn_IRQ[i]));
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_UARTn_IRQ[i]));
--CTRL register bits:
+     }
-+CTRL register bits::
+     /*
-     bit    name        description
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-     ------------------------------------------------------------------------
+                         FSL_IMX6UL_ENETn_ADDR[i]);
-     [0]    CTRL_RESET    Reset the descriptor ring
-     [1:31]    Reserved
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 0,
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
--All descriptor types share some common fields:
+-                                            FSL_IMX6UL_ENETn_IRQ[i]));
-+All descriptor types share some common fields::
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_ENETn_IRQ[i]));
-     field            width    description
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 1,
-     -------------------------------------------------------------------
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-@@ -XXX,XX +XXX,XX @@ filled in by the switch.  Likewise, the switch will ignore unknown fields
+-                                            FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
- filled in by software.
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
+     }
- Descriptor payload buffer is 8-byte aligned and TLVs are 8-byte aligned.  The
--value within a TLV is also 8-byte aligned.  The (packed, 8 byte) TLV header is:
+     /*
-+value within a TLV is also 8-byte aligned.  The (packed, 8 byte) TLV header is::
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
-     field    width    description
+                         FSL_IMX6UL_USB02_USBn_ADDR[i]);
-     -----------------------------
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
-@@ -XXX,XX +XXX,XX @@ The alignment requirements for descriptors and TLVs are to avoid unaligned
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
- access exceptions in software.  Note that the payload for each TLV is also
+-                                            FSL_IMX6UL_USBn_IRQ[i]));
-byte aligned.
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_USBn_IRQ[i]));
+     }
--Figure 1 shows an example descriptor buffer with two TLVs.
-+Figure 1 shows an example descriptor buffer with two TLVs::
+     /*
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-                   <------- 8 bytes ------->
+                         FSL_IMX6UL_USDHCn_ADDR[i]);
-@@ -XXX,XX +XXX,XX @@ network packet data.  All non-network-packet TLV multi-byte values will be LE.
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usdhc[i]), 0,
- TLV values in network-byte-order are designated with (N).
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+-                                            FSL_IMX6UL_USDHCn_IRQ[i]));
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_USDHCn_IRQ[i]));
--SECTION 5: Test Registers
+     }
--=========================
-+Test Registers
+     /*
-+==============
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
- Rocker has several test registers to support troubleshooting register access,
+                         FSL_IMX6UL_WDOGn_ADDR[i]);
--interrupt generation, and DMA operations:
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-+interrupt generation, and DMA operations::
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+-                                            FSL_IMX6UL_WDOGn_IRQ[i]));
-     TEST_REG, offset 0x0010, 32-bit (R/W)
++                           qdev_get_gpio_in(gic, FSL_IMX6UL_WDOGn_IRQ[i]));
-     TEST_REG64, offset 0x0018, 64-bit (R/W)
+     }
-@@ -XXX,XX +XXX,XX @@ for that vector.
+     /*
  To test basic DMA operations, allocate a DMA-able host buffer and put the
  buffer address into TEST_DMA_ADDR and size into TEST_DMA_SIZE.  Then, write to
 -TEST_DMA_CTRL to manipulate the buffer contents.  TEST_DMA_CTRL operations are:
 +TEST_DMA_CTRL to manipulate the buffer contents.  TEST_DMA_CTRL operations are::
      operation        value    description
      -----------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ issue exists.  In particular, buffers that start on odd-8-byte boundary and/or
  span multiple PAGE sizes should be tested.
 -SECTION 6: Ports
 -================
 +Ports
 +=====
  Physical and Logical Ports
  ------------------------------------
  The switch supports up to 62 physical (front-panel) ports.  Register
 -PORT_PHYS_COUNT returns the actual number of physical ports available:
 +PORT_PHYS_COUNT returns the actual number of physical ports available::
      PORT_PHYS_COUNT, offset 0x0304, 32-bit, (R)
@@ -XXX,XX +XXX,XX @@ Front-panel ports and logical tunnel ports are mapped into a single 32-bit port
  space.  A special CPU port is assigned port 0.  The front-panel ports are
  mapped to ports 1-62.  A special loopback port is assigned port 63.  Logical
  tunnel ports are assigned ports 0x0001000-0x0001ffff.
 -To summarize the port assignments:
 +To summarize the port assignments::
      port            mapping
      -------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ set/get the mode for front-panel ports, see port settings, below.
  Port Settings
  -------------
 -Link status for all front-panel ports is available via PORT_PHYS_LINK_STATUS:
 +Link status for all front-panel ports is available via PORT_PHYS_LINK_STATUS::
      PORT_PHYS_LINK_STATUS, offset 0x0310, 64-bit, (R)
      Value is port bitmap.  Bits 0 and 63 always read 0.  Bits 1-62
      read 1 for link UP and 0 for link DOWN for respective front-panel ports.
 -Other properties for front-panel ports are available via DMA CMD descriptors:
 +Other properties for front-panel ports are available via DMA CMD descriptors::
      Get PORT_SETTINGS descriptor:
@@ -XXX,XX +XXX,XX @@ Port Enable
  -----------
  Front-panel ports are initially disabled, which means port ingress and egress
 -packets will be dropped.  To enable or disable a port, use PORT_PHYS_ENABLE:
 +packets will be dropped.  To enable or disable a port, use PORT_PHYS_ENABLE::
      PORT_PHYS_ENABLE: offset 0x0318, 64-bit, (R/W)
@@ -XXX,XX +XXX,XX @@ packets will be dropped.  To enable or disable a port, use PORT_PHYS_ENABLE:
      Default is 0.
 -SECTION 7: Switch Control
 -=========================
 +Switch Control
 +==============
  This section covers switch-wide register settings.
  Control
  -------
 -This register is used for low level control of the switch.
 +This register is used for low level control of the switch::
      CONTROL: offset 0x0300, 32-bit, (W)
@@ -XXX,XX +XXX,XX @@ Switch ID
  ---------
  The switch has a SWITCH_ID to be used by software to uniquely identify the
 -switch:
 +switch::
      SWITCH_ID: offset 0x0320, 64-bit, (R)
      Value is opaque to switch software and no special encoding is implied.
 -SECTION 8: Events
 -=================
 +Events
 +======
  Non-I/O asynchronous events from the device are notified to the host using the
 -event ring.  The TLV structure for events is:
 +event ring.  The TLV structure for events is::
      field        width    description
      ---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ event ring.  The TLV structure for events is:
  Link Changed Event
  ------------------
 -When link status changes on a physical port, this event is generated.
 +When link status changes on a physical port, this event is generated::
      field        width    description
      ---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ driver should install to the device the MAC/VLAN on the port into the bridge
  table.  Once installed, the MAC/VLAN is known on the port and this event will
  no longer be generated.
 +::
 +
      field        width    description
      ---------------------------------------------------
      INFO        <nest>
@@ -XXX,XX +XXX,XX @@ no longer be generated.
        VLAN        2    VLAN ID
 -SECTION 9: CPU Packet Processing
 -================================
 +CPU Packet Processing
 +=====================
  Ingress packets directed to the host CPU for further processing are delivered
  in the DMA RX ring.  Likewise, host CPU originating packets destined to egress
@@ -XXX,XX +XXX,XX @@ software that Tx is complete and software resources (e.g. skb) backing packet
  can be released.
  Figure 2 shows an example 3-fragment packet queued with one Tx descriptor.  A
 -TLV is used for each packet fragment.
 +TLV is used for each packet fragment::
                                                 pkt frag 1
                                                 +–––––––+  +–+
@@ -XXX,XX +XXX,XX @@ TLV is used for each packet fragment.
                  fig 2.
 -The TLVs for Tx descriptor buffer are:
 +The TLVs for Tx descriptor buffer are::
      field            width    description
      ---------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ The TLVs for Tx descriptor buffer are:
          TX_FRAG_ADDR    8    DMA address of packet fragment
          TX_FRAG_LEN        2    Packet fragment length
 -Possible status return codes in descriptor on completion are:
 +Possible status return codes in descriptor on completion are::
      DESC_COMP_ERR    reason
      --------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ worst-case packet size.  A single Rx descriptor will contain the entire Rx
  packet data in one RX_FRAG.  Other Rx TLVs describe and hardware offloads
  performed on the packet, such as checksum validation.
 -The TLVs for Rx descriptor buffer are:
 +The TLVs for Rx descriptor buffer are::
      field        width    description
      ---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ The TLVs for Rx descriptor buffer are:
  Offload forward RX_FLAG indicates the device has already forwarded the packet
  so the host CPU should not also forward the packet.
 -Possible status return codes in descriptor on completion are:
 +Possible status return codes in descriptor on completion are::
      DESC_COMP_ERR    reason
      --------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Possible status return codes in descriptor on completion are:
              packet data TLV and other TLVs.
 -SECTION 10: OF-DPA Mode
 -======================
 +OF-DPA Mode
 +===========
  OF-DPA mode allows the switch to offload flow packet processing functions to
  hardware.  An OpenFlow controller would communicate with an OpenFlow agent
  installed on the switch.  The OpenFlow agent would (directly or indirectly)
  communicate with the Rocker switch driver, which in turn would program switch
 -hardware with flow functionality, as defined in OF-DPA.  The block diagram is:
 +hardware with flow functionality, as defined in OF-DPA.  The block diagram is::
          +–––––––––––––––----–––+
          |        OF            |
@@ -XXX,XX +XXX,XX @@ OF-DPA Flow Table Interface
  There are commands to add, modify, delete, and get stats of flow table entries.
  The commands are issued using the DMA CMD descriptor ring.  The following
 -commands are defined:
 +commands are defined::
      CMD_ADD:        add an entry to flow table
      CMD_MOD:        modify an entry in flow table
      CMD_DEL:        delete an entry from flow table
      CMD_GET_STATS:        get stats for flow entry
 -TLVs for add and modify commands are:
 +TLVs for add and modify commands are::
      field            width    description
      ----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for add and modify commands are:
  Additional TLVs based on flow table ID:
 -Table ID 0: ingress port
 +Table ID 0: ingress port::
      field            width    description
      ----------------------------------------------------
      OF_DPA_IN_PPORT        4    ingress physical port number
      OF_DPA_GOTO_TBL        2    goto table ID; zero to drop
 -Table ID 10: vlan
 +Table ID 10: vlan::
      field            width    description
      ----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 10: vlan
      OF_DPA_GOTO_TBL        2    goto table ID; zero to drop
      OF_DPA_NEW_VLAN_ID    2 (N)    new vlan ID
 -Table ID 20: termination mac
 +Table ID 20: termination mac::
      field            width    description
      ----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 20: termination mac
      OF_DPA_OUT_PPORT    2    if specified, must be
                      controller, set zero otherwise
 -Table ID 30: unicast routing
 +Table ID 30: unicast routing::
      field            width    description
      ----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 30: unicast routing
      OF_DPA_GROUP_ID        4    data for GROUP action must
                      be an L3 Unicast group entry
 -Table ID 40: multicast routing
 +Table ID 40: multicast routing::
      field            width    description
      ----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 40: multicast routing
      OF_DPA_GROUP_ID        4    data for GROUP action must
                      be an L3 multicast group entry
 -Table ID 50: bridging
 +Table ID 50: bridging::
      field            width    description
      ----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 50: bridging
                      restricted to CONTROLLER,
                      set to 0 otherwise
 -Table ID 60: acl policy
 +Table ID 60: acl policy::
      field            width    description
      ----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 60: acl policy
                      dropped (all other instructions
                      ignored)
 -TLVs for flow delete and get stats command are:
 +TLVs for flow delete and get stats command are::
      field            width    description
      ---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for flow delete and get stats command are:
      OF_DPA_COOKIE        8    Cookie
  On completion of get stats command, the descriptor buffer is written back with
 -the following TLVs:
 +the following TLVs::
      field            width    description
      ---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ the following TLVs:
      OF_DPA_STAT_RX_PKTS    8    Received packets
      OF_DPA_STAT_TX_PKTS    8    Transmit packets
 -Possible status return codes in descriptor on completion are:
 +Possible status return codes in descriptor on completion are::
      DESC_COMP_ERR    command            reason
      --------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Group Table Interface
  There are commands to add, modify, delete, and get stats of group table
  entries.  The commands are issued using the DMA CMD descriptor ring.  The
 -following commands are defined:
 +following commands are defined::
      CMD_ADD:        add an entry to group table
      CMD_MOD:        modify an entry in group table
      CMD_DEL:        delete an entry from group table
      CMD_GET_STATS:        get stats for group entry
 -TLVs for add and modify commands are:
 +TLVs for add and modify commands are::
      field            width    description
      -----------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for add and modify commands are:
        FLOW_SRC_MAC        6    (types 1, 2, 5)
        FLOW_DST_MAC        6    (types 1, 2)
 -TLVs for flow delete and get stats command are:
 +TLVs for flow delete and get stats command are::
      field            width    description
      -----------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for flow delete and get stats command are:
      FLOW_GROUP_ID        2    Flow group ID
  On completion of get stats command, the descriptor buffer is written back with
 -the following TLVs:
 +the following TLVs::
      field            width    description
      ---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ the following TLVs:
      FLOW_STAT_REF_COUNT    4    Flow reference count
      FLOW_STAT_BUCKET_COUNT    4    Flow bucket count
 -Possible status return codes in descriptor on completion are:
 +Possible status return codes in descriptor on completion are::
      DESC_COMP_ERR    command            reason
      --------------------------------------------------------------------
 --
 .34.1

-[PULL 08/11] docs: Typo fix in live disk backup
+[PULL 07/12] hw/arm/fsl-imx7: Add local 'mpcore/gic' variables
-From: Eric Blake <eblake@redhat.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Add in the missing space in the section header.
+The A7MPCore forward the IRQs from its internal GIC.
 To make the code clearer, add the 'mpcore' and 'gic'
 variables.
-Fixes: 1084159b31 ("qapi: deprecate drive-backup", v6.2.0)
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250130112615.3219-5-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/interop/live-block-operations.rst | 4 ++--
+ hw/arm/fsl-imx7.c | 52 +++++++++++++++++++++--------------------------
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 23 insertions(+), 29 deletions(-)
-diff --git a/docs/interop/live-block-operations.rst b/docs/interop/live-block-operations.rst
+diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/interop/live-block-operations.rst
+--- a/hw/arm/fsl-imx7.c
-+++ b/docs/interop/live-block-operations.rst
++++ b/hw/arm/fsl-imx7.c
-@@ -XXX,XX +XXX,XX @@ Shutdown the guest, by issuing the ``quit`` QMP command::
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
  {
      MachineState *ms = MACHINE(qdev_get_machine());
      FslIMX7State *s = FSL_IMX7(dev);
 -    Object *o;
 +    DeviceState *mpcore = DEVICE(&s->a7mpcore);
 +    DeviceState *gic;
      int i;
      qemu_irq irq;
      char name[NAME_SIZE];
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
       * CPUs
       */
      for (i = 0; i < smp_cpus; i++) {
 -        o = OBJECT(&s->cpu[i]);
 +        Object *o = OBJECT(&s->cpu[i]);
          /* On uniprocessor, the CBAR is set to 0 */
          if (smp_cpus > 1) {
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
      /*
       * A7MPCORE
       */
 -    object_property_set_int(OBJECT(&s->a7mpcore), "num-cpu", smp_cpus,
 -                            &error_abort);
 -    object_property_set_int(OBJECT(&s->a7mpcore), "num-irq",
 +    object_property_set_int(OBJECT(mpcore), "num-cpu", smp_cpus, &error_abort);
 +    object_property_set_int(OBJECT(mpcore), "num-irq",
                              FSL_IMX7_MAX_IRQ + GIC_INTERNAL, &error_abort);
 +    sysbus_realize(SYS_BUS_DEVICE(mpcore), &error_abort);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(mpcore), 0, FSL_IMX7_A7MPCORE_ADDR);
 -    sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, FSL_IMX7_A7MPCORE_ADDR);
 -
 +    gic = mpcore;
      for (i = 0; i < smp_cpus; i++) {
 -        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
 +        SysBusDevice *sbd = SYS_BUS_DEVICE(gic);
          DeviceState  *d   = DEVICE(qemu_get_cpu(i));
          irq = qdev_get_gpio_in(d, ARM_CPU_IRQ);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_realize(SYS_BUS_DEVICE(&s->gpt[i]), &error_abort);
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpt[i]), 0, FSL_IMX7_GPTn_ADDR[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpt[i]), 0,
 -                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 -                                            FSL_IMX7_GPTn_IRQ[i]));
 +                           qdev_get_gpio_in(gic, FSL_IMX7_GPTn_IRQ[i]));
      }
+     /*
--Live disk backup --- ``blockdev-backup`` and the deprecated``drive-backup``
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
-----------------------------------------------------------------------------
+                         FSL_IMX7_GPIOn_ADDR[i]);
-+Live disk backup --- ``blockdev-backup`` and the deprecated ``drive-backup``
-+----------------------------------------------------------------------------
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 0,
+-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
- The ``blockdev-backup`` (and the deprecated ``drive-backup``) allows
+-                                            FSL_IMX7_GPIOn_LOW_IRQ[i]));
- you to create a point-in-time snapshot.
++                           qdev_get_gpio_in(gic, FSL_IMX7_GPIOn_LOW_IRQ[i]));
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 1,
 -                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 -                                            FSL_IMX7_GPIOn_HIGH_IRQ[i]));
 +                           qdev_get_gpio_in(gic, FSL_IMX7_GPIOn_HIGH_IRQ[i]));
      }
      /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
                          FSL_IMX7_SPIn_ADDR[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
 -                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 -                                            FSL_IMX7_SPIn_IRQ[i]));
 +                           qdev_get_gpio_in(gic, FSL_IMX7_SPIn_IRQ[i]));
      }
      /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c[i]), 0, FSL_IMX7_I2Cn_ADDR[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c[i]), 0,
 -                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 -                                            FSL_IMX7_I2Cn_IRQ[i]));
 +                           qdev_get_gpio_in(gic, FSL_IMX7_I2Cn_IRQ[i]));
      }
      /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->uart[i]), 0, FSL_IMX7_UARTn_ADDR[i]);
 -        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_UARTn_IRQ[i]);
 +        irq = qdev_get_gpio_in(gic, FSL_IMX7_UARTn_IRQ[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0, irq);
      }
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->eth[i]), 0, FSL_IMX7_ENETn_ADDR[i]);
 -        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_ENET_IRQ(i, 0));
 +        irq = qdev_get_gpio_in(gic, FSL_IMX7_ENET_IRQ(i, 0));
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 0, irq);
 -        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_ENET_IRQ(i, 3));
 +        irq = qdev_get_gpio_in(gic, FSL_IMX7_ENET_IRQ(i, 3));
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 1, irq);
      }
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->usdhc[i]), 0,
                          FSL_IMX7_USDHCn_ADDR[i]);
 -        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_USDHCn_IRQ[i]);
 +        irq = qdev_get_gpio_in(gic, FSL_IMX7_USDHCn_IRQ[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->usdhc[i]), 0, irq);
      }
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0, FSL_IMX7_WDOGn_ADDR[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->wdt[i]), 0,
 -                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 -                                            FSL_IMX7_WDOGn_IRQ[i]));
 +                           qdev_get_gpio_in(gic, FSL_IMX7_WDOGn_IRQ[i]));
      }
      /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
      irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
      qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
 -    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
 +    irq = qdev_get_gpio_in(gic, FSL_IMX7_PCI_INTA_IRQ);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
 -    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
 +    irq = qdev_get_gpio_in(gic, FSL_IMX7_PCI_INTB_IRQ);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
 -    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
 +    irq = qdev_get_gpio_in(gic, FSL_IMX7_PCI_INTC_IRQ);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
      irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
                          FSL_IMX7_USBn_ADDR[i]);
 -        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_USBn_IRQ[i]);
 +        irq = qdev_get_gpio_in(gic, FSL_IMX7_USBn_IRQ[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0, irq);
          snprintf(name, NAME_SIZE, "usbmisc%d", i);
 --
 .34.1

-[PULL 01/11] target/arm: Fix BTI versus CF_PCREL
+[PULL 08/12] hw/cpu/arm: Alias 'num-cpu' property on TYPE_REALVIEW_MPCORE
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-With pcrel, we cannot check the guarded page bit at translation
+No need to duplicate and forward the 'num-cpu' property from
-time, as different mappings of the same physical page may or may
+TYPE_ARM11MPCORE_PRIV to TYPE_REALVIEW_MPCORE, alias it with
-not have the GP bit set.
+QOM object_property_add_alias().
-Instead, add a couple of helpers to check the page at runtime,
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-after all other filters that might obviate the need for the check.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20250130112615.3219-6-philmd@linaro.org
 The set_btype_for_br call must be moved after the gen_a64_set_pc
 call to ensure the current pc can still be computed.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240802003028.795476-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/tcg/helper-a64.h    |  3 ++
+ hw/cpu/realview_mpcore.c | 8 +-------
- target/arm/tcg/translate.h     |  2 --
+file changed, 1 insertion(+), 7 deletions(-)
  target/arm/tcg/helper-a64.c    | 39 +++++++++++++++++++++
  target/arm/tcg/translate-a64.c | 64 ++++++++--------------------------
 files changed, 56 insertions(+), 52 deletions(-)
-diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
+diff --git a/hw/cpu/realview_mpcore.c b/hw/cpu/realview_mpcore.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tcg/helper-a64.h
+--- a/hw/cpu/realview_mpcore.c
-+++ b/target/arm/tcg/helper-a64.h
++++ b/hw/cpu/realview_mpcore.c
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(cpyfp, void, env, i32, i32, i32)
+@@ -XXX,XX +XXX,XX @@
- DEF_HELPER_4(cpyfm, void, env, i32, i32, i32)
+ #include "hw/cpu/arm11mpcore.h"
- DEF_HELPER_4(cpyfe, void, env, i32, i32, i32)
+ #include "hw/intc/realview_gic.h"
+ #include "hw/irq.h"
-+DEF_HELPER_FLAGS_1(guarded_page_check, TCG_CALL_NO_WG, void, env)
+-#include "hw/qdev-properties.h"
-+DEF_HELPER_FLAGS_2(guarded_page_br, TCG_CALL_NO_RWG, void, env, tl)
+ #include "qom/object.h"
-+
- DEF_HELPER_FLAGS_5(gvec_fdiv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+ #define TYPE_REALVIEW_MPCORE_RIRQ "realview_mpcore"
- DEF_HELPER_FLAGS_5(gvec_fdiv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+@@ -XXX,XX +XXX,XX @@ static void realview_mpcore_realize(DeviceState *dev, Error **errp)
- DEF_HELPER_FLAGS_5(gvec_fdiv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
+     int n;
-diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+     int i;
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tcg/translate.h
+-    qdev_prop_set_uint32(priv, "num-cpu", s->num_cpu);
-+++ b/target/arm/tcg/translate.h
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->priv), errp)) {
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+         return;
-     uint8_t dcz_blocksize;
+     }
-     /* A copy of cpu->gm_blocksize. */
+@@ -XXX,XX +XXX,XX @@ static void mpcore_rirq_init(Object *obj)
-     uint8_t gm_blocksize;
+     int i;
--    /* True if this page is guarded.  */
--    bool guarded_page;
+     object_initialize_child(obj, "a11priv", &s->priv, TYPE_ARM11MPCORE_PRIV);
-     /* True if the current insn_start has been updated. */
++    object_property_add_alias(obj, "num-cpu", OBJECT(&s->priv), "num-cpu");
-     bool insn_start_updated;
+     privbusdev = SYS_BUS_DEVICE(&s->priv);
-     /* Bottom two bits of XScale c15_cpar coprocessor access control reg */
+     sysbus_init_mmio(sbd, sysbus_mmio_get_region(privbusdev, 0));
-diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void mpcore_rirq_init(Object *obj)
 --- a/target/arm/tcg/helper-a64.c
 +++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ void HELPER(cpyfe)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc,
  {
      do_cpye(env, syndrome, wdesc, rdesc, false, GETPC());
  }
 +
 +static bool is_guarded_page(CPUARMState *env, target_ulong addr, uintptr_t ra)
 +{
 +#ifdef CONFIG_USER_ONLY
 +    return page_get_flags(addr) & PAGE_BTI;
 +#else
 +    CPUTLBEntryFull *full;
 +    void *host;
 +    int mmu_idx = cpu_mmu_index(env_cpu(env), true);
 +    int flags = probe_access_full(env, addr, 0, MMU_INST_FETCH, mmu_idx,
 +                                  false, &host, &full, ra);
 +
 +    assert(!(flags & TLB_INVALID_MASK));
 +    return full->extra.arm.guarded;
 +#endif
 +}
 +
 +void HELPER(guarded_page_check)(CPUARMState *env)
 +{
 +    /*
 +     * We have already verified that bti is enabled, and that the
 +     * instruction at PC is not ok for BTYPE.  This is always at
 +     * the beginning of a block, so PC is always up-to-date and
 +     * no unwind is required.
 +     */
 +    if (is_guarded_page(env, env->pc, 0)) {
 +        raise_exception(env, EXCP_UDEF, syn_btitrap(env->btype),
 +                        exception_target_el(env));
 +    }
 +}
 +
 +void HELPER(guarded_page_br)(CPUARMState *env, target_ulong pc)
 +{
 +    /*
 +     * We have already checked for branch via x16 and x17.
 +     * What remains for choosing BTYPE is checking for a guarded page.
 +     */
 +    env->btype = is_guarded_page(env, pc, GETPC()) ? 3 : 1;
 +}
 diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-a64.c
 +++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void set_btype_for_br(DisasContext *s, int rn)
  {
      if (dc_isar_feature(aa64_bti, s)) {
          /* BR to {x16,x17} or !guard -> 1, else 3.  */
 -        set_btype(s, rn == 16 || rn == 17 || !s->guarded_page ? 1 : 3);
 +        if (rn == 16 || rn == 17) {
 +            set_btype(s, 1);
 +        } else {
 +            TCGv_i64 pc = tcg_temp_new_i64();
 +            gen_pc_plus_diff(s, pc, 0);
 +            gen_helper_guarded_page_br(tcg_env, pc);
 +            s->btype = -1;
 +        }
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void set_btype_for_blr(DisasContext *s)
+-static const Property mpcore_rirq_properties[] = {
+-    DEFINE_PROP_UINT32("num-cpu", mpcore_rirq_state, num_cpu, 1),
- static bool trans_BR(DisasContext *s, arg_r *a)
+-};
 -
  static void mpcore_rirq_class_init(ObjectClass *klass, void *data)
  {
--    gen_a64_set_pc(s, cpu_reg(s, a->rn));
+     DeviceClass *dc = DEVICE_CLASS(klass);
-     set_btype_for_br(s, a->rn);
-+    gen_a64_set_pc(s, cpu_reg(s, a->rn));
+     dc->realize = realview_mpcore_realize;
-     s->base.is_jmp = DISAS_JUMP;
+-    device_class_set_props(dc, mpcore_rirq_properties);
      return true;
  }
-@@ -XXX,XX +XXX,XX @@ static bool trans_BRAZ(DisasContext *s, arg_braz *a)
-     }
+ static const TypeInfo mpcore_rirq_info = {
      dst = auth_branch_target(s, cpu_reg(s, a->rn), tcg_constant_i64(0), !a->m);
 -    gen_a64_set_pc(s, dst);
      set_btype_for_br(s, a->rn);
 +    gen_a64_set_pc(s, dst);
      s->base.is_jmp = DISAS_JUMP;
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_FAIL(DisasContext *s, arg_OK *a)
      return true;
  }
 -/**
 - * is_guarded_page:
 - * @env: The cpu environment
 - * @s: The DisasContext
 - *
 - * Return true if the page is guarded.
 - */
 -static bool is_guarded_page(CPUARMState *env, DisasContext *s)
 -{
 -    uint64_t addr = s->base.pc_first;
 -#ifdef CONFIG_USER_ONLY
 -    return page_get_flags(addr) & PAGE_BTI;
 -#else
 -    CPUTLBEntryFull *full;
 -    void *host;
 -    int mmu_idx = arm_to_core_mmu_idx(s->mmu_idx);
 -    int flags;
 -
 -    /*
 -     * We test this immediately after reading an insn, which means
 -     * that the TLB entry must be present and valid, and thus this
 -     * access will never raise an exception.
 -     */
 -    flags = probe_access_full(env, addr, 0, MMU_INST_FETCH, mmu_idx,
 -                              false, &host, &full, 0);
 -    assert(!(flags & TLB_INVALID_MASK));
 -
 -    return full->extra.arm.guarded;
 -#endif
 -}
 -
  /**
   * btype_destination_ok:
   * @insn: The instruction at the branch destination
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      if (dc_isar_feature(aa64_bti, s)) {
          if (s->base.num_insns == 1) {
 -            /*
 -             * At the first insn of the TB, compute s->guarded_page.
 -             * We delayed computing this until successfully reading
 -             * the first insn of the TB, above.  This (mostly) ensures
 -             * that the softmmu tlb entry has been populated, and the
 -             * page table GP bit is available.
 -             *
 -             * Note that we need to compute this even if btype == 0,
 -             * because this value is used for BR instructions later
 -             * where ENV is not available.
 -             */
 -            s->guarded_page = is_guarded_page(env, s);
 -
              /* First insn can have btype set to non-zero.  */
              tcg_debug_assert(s->btype >= 0);
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
               * priority -- below debugging exceptions but above most
               * everything else.  This allows us to handle this now
               * instead of waiting until the insn is otherwise decoded.
 +             *
 +             * We can check all but the guarded page check here;
 +             * defer the latter to a helper.
               */
              if (s->btype != 0
 -                && s->guarded_page
                  && !btype_destination_ok(insn, s->bt, s->btype)) {
 -                gen_exception_insn(s, 0, EXCP_UDEF, syn_btitrap(s->btype));
 -                return;
 +                gen_helper_guarded_page_check(tcg_env);
              }
          } else {
              /* Not the first insn: btype must be 0.  */
 --
 .34.1

-[PULL 10/11] hw/core/ptimer: fix timer zero period condition for freq > 1GHz
+[PULL 09/12] hw/cpu/arm: Declare CPU QOM types using DEFINE_TYPES() macro
-From: Jianzhou Yue <JianZhou.Yue@verisilicon.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The real period is zero when both period and period_frac are zero.
+When multiple QOM types are registered in the same file,
-Check the method ptimer_set_freq, if freq is larger than 1000 MHz,
+it is simpler to use the the DEFINE_TYPES() macro. In
-the period is zero, but the period_frac is not, in this case, the
+particular because type array declared with such macro
-ptimer will work but the current code incorrectly recognizes that
+are easier to review.
 the ptimer is disabled.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2306
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: JianZhou Yue <JianZhou.Yue@verisilicon.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 3DA024AEA8B57545AF1B3CAA37077D0FB75E82C8@SHASXM03.verisilicon.com
+Message-id: 20250130112615.3219-7-philmd@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/core/ptimer.c         |  4 ++--
+ hw/cpu/a15mpcore.c       | 21 +++++++++------------
- tests/unit/ptimer-test.c | 33 +++++++++++++++++++++++++++++++++
+ hw/cpu/a9mpcore.c        | 21 +++++++++------------
-files changed, 35 insertions(+), 2 deletions(-)
+ hw/cpu/arm11mpcore.c     | 21 +++++++++------------
  hw/cpu/realview_mpcore.c | 21 +++++++++------------
 files changed, 36 insertions(+), 48 deletions(-)
-diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
+diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/ptimer.c
+--- a/hw/cpu/a15mpcore.c
-+++ b/hw/core/ptimer.c
++++ b/hw/cpu/a15mpcore.c
-@@ -XXX,XX +XXX,XX @@ static void ptimer_reload(ptimer_state *s, int delta_adjust)
+@@ -XXX,XX +XXX,XX @@ static void a15mp_priv_class_init(ObjectClass *klass, void *data)
-         delta = s->delta = s->limit;
+     /* We currently have no saveable state */
-     }
+ }
--    if (s->period == 0) {
+-static const TypeInfo a15mp_priv_info = {
-+    if (s->period == 0 && s->period_frac == 0) {
+-    .name  = TYPE_A15MPCORE_PRIV,
-         if (!qtest_enabled()) {
+-    .parent = TYPE_SYS_BUS_DEVICE,
-             fprintf(stderr, "Timer with period zero, disabling\n");
+-    .instance_size  = sizeof(A15MPPrivState),
-         }
+-    .instance_init = a15mp_priv_initfn,
-@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
+-    .class_init = a15mp_priv_class_init,
++static const TypeInfo a15mp_types[] = {
-     assert(s->in_transaction);
++    {
++        .name           = TYPE_A15MPCORE_PRIV,
--    if (was_disabled && s->period == 0) {
++        .parent         = TYPE_SYS_BUS_DEVICE,
-+    if (was_disabled && s->period == 0 && s->period_frac == 0) {
++        .instance_size  = sizeof(A15MPPrivState),
-         if (!qtest_enabled()) {
++        .instance_init  = a15mp_priv_initfn,
-             fprintf(stderr, "Timer with period zero, disabling\n");
++        .class_init     = a15mp_priv_class_init,
-         }
++    },
-diff --git a/tests/unit/ptimer-test.c b/tests/unit/ptimer-test.c
+ };
 -static void a15mp_register_types(void)
 -{
 -    type_register_static(&a15mp_priv_info);
 -}
 -
 -type_init(a15mp_register_types)
 +DEFINE_TYPES(a15mp_types)
 diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/unit/ptimer-test.c
+--- a/hw/cpu/a9mpcore.c
-+++ b/tests/unit/ptimer-test.c
++++ b/hw/cpu/a9mpcore.c
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
+@@ -XXX,XX +XXX,XX @@ static void a9mp_priv_class_init(ObjectClass *klass, void *data)
-     ptimer_free(ptimer);
+     device_class_set_props(dc, a9mp_priv_properties);
  }
-+static void check_freq_more_than_1000M(gconstpointer arg)
+-static const TypeInfo a9mp_priv_info = {
-+{
+-    .name          = TYPE_A9MPCORE_PRIV,
-+    const uint8_t *policy = arg;
+-    .parent        = TYPE_SYS_BUS_DEVICE,
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
+-    .instance_size = sizeof(A9MPPrivState),
-+    bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
+-    .instance_init = a9mp_priv_initfn,
-+
+-    .class_init    = a9mp_priv_class_init,
-+    triggered = false;
++static const TypeInfo a9mp_types[] = {
-+
++    {
-+    ptimer_transaction_begin(ptimer);
++        .name           = TYPE_A9MPCORE_PRIV,
-+    ptimer_set_freq(ptimer, 2000000000);
++        .parent         = TYPE_SYS_BUS_DEVICE,
-+    ptimer_set_limit(ptimer, 8, 1);
++        .instance_size  =  sizeof(A9MPPrivState),
-+    ptimer_run(ptimer, 1);
++        .instance_init  = a9mp_priv_initfn,
-+    ptimer_transaction_commit(ptimer);
++        .class_init     = a9mp_priv_class_init,
-+
++    },
-+    qemu_clock_step(3);
+ };
-+
-+    g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 3 : 2);
+-static void a9mp_register_types(void)
-+    g_assert_false(triggered);
+-{
-+
+-    type_register_static(&a9mp_priv_info);
-+    qemu_clock_step(1);
+-}
-+
+-
-+    g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
+-type_init(a9mp_register_types)
-+    g_assert_true(triggered);
++DEFINE_TYPES(a9mp_types)
-+
+diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
-+    ptimer_free(ptimer);
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/hw/cpu/arm11mpcore.c
-+
++++ b/hw/cpu/arm11mpcore.c
- static void add_ptimer_tests(uint8_t policy)
+@@ -XXX,XX +XXX,XX @@ static void mpcore_priv_class_init(ObjectClass *klass, void *data)
- {
+     device_class_set_props(dc, mpcore_priv_properties);
      char policy_name[256] = "";
@@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy)
                                policy_name),
          g_memdup2(&policy, 1), check_oneshot_with_load_0, g_free);
      g_free(tmp);
 +
 +    g_test_add_data_func_full(
 +        tmp = g_strdup_printf("/ptimer/freq_more_than_1000M policy=%s",
 +                              policy_name),
 +        g_memdup2(&policy, 1), check_freq_more_than_1000M, g_free);
 +    g_free(tmp);
  }
- static void add_all_ptimer_policies_comb_tests(void)
+-static const TypeInfo mpcore_priv_info = {
 -    .name          = TYPE_ARM11MPCORE_PRIV,
 -    .parent        = TYPE_SYS_BUS_DEVICE,
 -    .instance_size = sizeof(ARM11MPCorePriveState),
 -    .instance_init = mpcore_priv_initfn,
 -    .class_init    = mpcore_priv_class_init,
 +static const TypeInfo arm11mp_types[] = {
 +    {
 +        .name           = TYPE_ARM11MPCORE_PRIV,
 +        .parent         = TYPE_SYS_BUS_DEVICE,
 +        .instance_size  = sizeof(ARM11MPCorePriveState),
 +        .instance_init  = mpcore_priv_initfn,
 +        .class_init     = mpcore_priv_class_init,
 +    },
  };
 -static void arm11mpcore_register_types(void)
 -{
 -    type_register_static(&mpcore_priv_info);
 -}
 -
 -type_init(arm11mpcore_register_types)
 +DEFINE_TYPES(arm11mp_types)
 diff --git a/hw/cpu/realview_mpcore.c b/hw/cpu/realview_mpcore.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/cpu/realview_mpcore.c
 +++ b/hw/cpu/realview_mpcore.c
@@ -XXX,XX +XXX,XX @@ static void mpcore_rirq_class_init(ObjectClass *klass, void *data)
      dc->realize = realview_mpcore_realize;
  }
 -static const TypeInfo mpcore_rirq_info = {
 -    .name          = TYPE_REALVIEW_MPCORE_RIRQ,
 -    .parent        = TYPE_SYS_BUS_DEVICE,
 -    .instance_size = sizeof(mpcore_rirq_state),
 -    .instance_init = mpcore_rirq_init,
 -    .class_init    = mpcore_rirq_class_init,
 +static const TypeInfo realview_mpcore_types[] = {
 +    {
 +        .name           = TYPE_REALVIEW_MPCORE_RIRQ,
 +        .parent         = TYPE_SYS_BUS_DEVICE,
 +        .instance_size  = sizeof(mpcore_rirq_state),
 +        .instance_init  = mpcore_rirq_init,
 +        .class_init     = mpcore_rirq_class_init,
 +    },
  };
 -static void realview_mpcore_register_types(void)
 -{
 -    type_register_static(&mpcore_rirq_info);
 -}
 -
 -type_init(realview_mpcore_register_types)
 +DEFINE_TYPES(realview_mpcore_types)
 --
 .34.1

-New patch
+[PULL 10/12] hw/net/cadence_gem: Fix the mask/compare/disable-mask logic
+From: Andrew Yuan <andrew.yuan@jaguarmicro.com>
+Our current handling of the mask/compare logic in the Cadence
+GEM ethernet device is wrong:
+ (1) we load the same byte twice from rx_buf when
+     creating the compare value
+ (2) we ignore the DISABLE_MASK flag
+The "Cadence IP for Gigabit Ethernet MAC Part Number: IP7014 IP Rev:
+R1p12 - Doc Rev: 1.3 User Guide" states that if the DISABLE_MASK bit
+in type2_compare_x_word_1 is set, the mask_value field in
+type2_compare_x_word_0 is used as an additional 2 byte Compare Value.
+Correct these bugs:
+ * in the !disable_mask codepath, use lduw_le_p() so we
+   correctly load a 16-bit value for comparison
+ * in the disable_mask codepath, we load a full 4-byte value
+   from rx_buf for the comparison, set the compare value to
+   the whole of the cr0 register (i.e. the concatenation of
+   the mask and compare fields), and set mask to 0xffffffff
+   to force a 32-bit comparison
+Signed-off-by: Andrew Yuan <andrew.yuan@jaguarmicro.com>
+Message-id: 20241219061658.805-1-andrew.yuan@jaguarmicro.com
+Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+[PMM: Expand commit message and comment]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/net/cadence_gem.c | 26 +++++++++++++++++++++-----
+file changed, 21 insertions(+), 5 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
+         /* Compare A, B, C */
+         for (j = 0; j < 3; j++) {
+-            uint32_t cr0, cr1, mask, compare;
+-            uint16_t rx_cmp;
++            uint32_t cr0, cr1, mask, compare, disable_mask;
++            uint32_t rx_cmp;
+             int offset;
+             int cr_idx = extract32(reg, R_SCREENING_TYPE2_REG0_COMPARE_A_SHIFT + j * 6,
+                                    R_SCREENING_TYPE2_REG0_COMPARE_A_LENGTH);
+@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
+                 break;
+             }
+-            rx_cmp = rxbuf_ptr[offset] << 8 | rxbuf_ptr[offset];
+-            mask = FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, MASK_VALUE);
+-            compare = FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, COMPARE_VALUE);
++            disable_mask =
++                FIELD_EX32(cr1, TYPE2_COMPARE_0_WORD_1, DISABLE_MASK);
++            if (disable_mask) {
++                /*
++                 * If disable_mask is set, mask_value is used as an
++                 * additional 2 byte Compare Value; that is equivalent
++                 * to using the whole cr0 register as the comparison value.
++                 * Load 32 bits of data from rx_buf, and set mask to
++                 * all-ones so we compare all 32 bits.
++                 */
++                rx_cmp = ldl_le_p(rxbuf_ptr + offset);
++                mask = 0xFFFFFFFF;
++                compare = cr0;
++            } else {
++                rx_cmp = lduw_le_p(rxbuf_ptr + offset);
++                mask = FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, MASK_VALUE);
++                compare =
++                    FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, COMPARE_VALUE);
++            }
+             if ((rx_cmp & mask) == (compare & mask)) {
+                 matched = true;
+--
+.34.1

-[PULL 02/11] include: Fix typo in name of MAKE_IDENTFIER macro
+[PULL 11/12] qemu-options: Deprecate -old-param command line option
-In commit bb71846325e23 we added some macro magic to avoid
+The '-old-param' command line option is specific to Arm targets; it
-variable-shadowing when using some of our more complicated
+is very briefly documented as "old param mode".  What this option
-macros. One of the internal components of this is a macro
+actually does is change the behaviour when directly booting a guest
-named MAKE_IDENTFIER. Fix the typo in its name: it should
+kernel, so that command line arguments are passed to the kernel using
-be MAKE_IDENTIFIER.
+the extremely old "param_struct" ABI, rather than the newer ATAGS or
 even newer DTB mechanisms.
-Commit created with
+This support was added back in 2007 to support an old vendor kernel
- sed -i -e 's/MAKE_IDENTFIER/MAKE_IDENTIFIER/g' include/qemu/*.h include/qapi/qmp/qobject.h
+on the akita/terrier board types:
  https://mail.gnu.org/archive/html/qemu-devel/2007-07/msg00344.html
 Even then, it was an out-of-date mechanism from the kernel's
 point of view -- the kernel has had a comment since 2001 marking
 it as deprecated. As of mid-2024, the kernel only retained
 param_struct support for the RiscPC and Footbridge platforms:
  https://lore.kernel.org/linux-arm-kernel/2831c5a6-cfbf-4fe0-b51c-0396e5b0aeb7@app.fastmail.com/
 None of the board types QEMU supports need param_struct support;
 mark this option as deprecated.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20250127123113.2947620-1-peter.maydell@linaro.org
 Message-id: 20240801102516.3843780-1-peter.maydell@linaro.org
 ---
- include/qapi/qmp/qobject.h | 2 +-
+ docs/about/deprecated.rst | 13 +++++++++++++
- include/qemu/atomic.h      | 2 +-
+ system/vl.c               |  1 +
- include/qemu/compiler.h    | 2 +-
+files changed, 14 insertions(+)
  include/qemu/osdep.h       | 6 +++---
 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/include/qapi/qmp/qobject.h b/include/qapi/qmp/qobject.h
+diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
 index XXXXXXX..XXXXXXX 100644
---- a/include/qapi/qmp/qobject.h
+--- a/docs/about/deprecated.rst
-+++ b/include/qapi/qmp/qobject.h
++++ b/docs/about/deprecated.rst
-@@ -XXX,XX +XXX,XX @@ struct QObject {
+@@ -XXX,XX +XXX,XX @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
-     typeof(obj) _obj = (obj);                                   \
+ marked deprecated since 9.0, users have to ensure that all the topology members
-     _obj ? container_of(&_obj->base, QObject, base) : NULL;     \
+ described with -smp are supported by the target machine.
- })
--#define QOBJECT(obj) QOBJECT_INTERNAL((obj), MAKE_IDENTFIER(_obj))
++``-old-param`` option for booting Arm kernels via param_struct (since 10.0)
-+#define QOBJECT(obj) QOBJECT_INTERNAL((obj), MAKE_IDENTIFIER(_obj))
++'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
++
- /* Required for qobject_to() */
++The ``-old-param`` command line option is specific to Arm targets:
- #define QTYPE_CAST_TO_QNull     QTYPE_QNULL
++it is used when directly booting a guest kernel to pass it the
-diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
++command line and other information via the old ``param_struct`` ABI,
 +rather than the newer ATAGS or DTB mechanisms. This option was only
 +ever needed to support ancient kernels on some old board types
 +like the ``akita`` or ``terrier``; it has been deprecated in the
 +kernel since 2001. None of the board types QEMU supports need
 +``param_struct`` support, so this option has been deprecated and will
 +be removed in a future QEMU version.
 +
  User-mode emulator command line arguments
  -----------------------------------------
 diff --git a/system/vl.c b/system/vl.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/atomic.h
+--- a/system/vl.c
-+++ b/include/qemu/atomic.h
++++ b/system/vl.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
-     _val;                                               \
+                 nb_prom_envs++;
-     })
+                 break;
- #define qatomic_rcu_read(ptr) \
+             case QEMU_OPTION_old_param:
--    qatomic_rcu_read_internal((ptr), MAKE_IDENTFIER(_val))
++                warn_report("-old-param is deprecated");
-+    qatomic_rcu_read_internal((ptr), MAKE_IDENTIFIER(_val))
+                 old_param = 1;
+                 break;
- #define qatomic_rcu_set(ptr, i) do {                   \
+             case QEMU_OPTION_rtc:
      qemu_build_assert(sizeof(*ptr) <= ATOMIC_REG_SIZE); \
 diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/compiler.h
 +++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
  #endif
  /* Expands into an identifier stemN, where N is another number each time */
 -#define MAKE_IDENTFIER(stem) glue(stem, __COUNTER__)
 +#define MAKE_IDENTIFIER(stem) glue(stem, __COUNTER__)
  #ifndef likely
  #define likely(x)   __builtin_expect(!!(x), 1)
 diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/osdep.h
 +++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ void QEMU_ERROR("code path is reachable")
      })
  #undef MIN
  #define MIN(a, b) \
 -    MIN_INTERNAL((a), (b), MAKE_IDENTFIER(_a), MAKE_IDENTFIER(_b))
 +    MIN_INTERNAL((a), (b), MAKE_IDENTIFIER(_a), MAKE_IDENTIFIER(_b))
  #define MAX_INTERNAL(a, b, _a, _b)                      \
      ({                                                  \
@@ -XXX,XX +XXX,XX @@ void QEMU_ERROR("code path is reachable")
      })
  #undef MAX
  #define MAX(a, b) \
 -    MAX_INTERNAL((a), (b), MAKE_IDENTFIER(_a), MAKE_IDENTFIER(_b))
 +    MAX_INTERNAL((a), (b), MAKE_IDENTIFIER(_a), MAKE_IDENTIFIER(_b))
  #ifdef __COVERITY__
  # define MIN_CONST(a, b) ((a) < (b) ? (a) : (b))
@@ -XXX,XX +XXX,XX @@ void QEMU_ERROR("code path is reachable")
          _a == 0 ? _b : (_b == 0 || _b > _a) ? _a : _b;  \
      })
  #define MIN_NON_ZERO(a, b) \
 -    MIN_NON_ZERO_INTERNAL((a), (b), MAKE_IDENTFIER(_a), MAKE_IDENTFIER(_b))
 +    MIN_NON_ZERO_INTERNAL((a), (b), MAKE_IDENTIFIER(_a), MAKE_IDENTIFIER(_b))
  /*
   * Round number down to multiple. Safe when m is not a power of 2 (see
 --
 .34.1

-[PULL 09/11] target/arm: add support for PMUv3 64-bit PMCCNTR in AArch32 mode
+[PULL 12/12] linux-user: Do not define struct sched_attr if libc headers do
-From: Alex Richardson <alexrichardson@google.com>
+From: Khem Raj <raj.khem@gmail.com>
-In the PMUv3, a new AArch32 64-bit (MCRR/MRRC) accessor for the
+glibc 2.41+ has added [1] definitions for sched_setattr and
-PMCCNTR was added. In QEMU we forgot to implement this, so only
+sched_getattr functions and struct sched_attr.  Therefore, it needs
-provide the 32-bit accessor. Since we have a 64-bit PMCCNTR
+to be checked for here as well before defining sched_attr, to avoid
-sysreg for AArch64, adding the 64-bit AArch32 version is easy.
+a compilation failure.
-We add the PMCCNTR to the v8_cp_reginfo because PMUv3 was added
+Define sched_attr conditionally only when SCHED_ATTR_SIZE_VER0 is
-in the ARMv8 architecture. This is consistent with how we
+not defined.
 handle the existing PMCCNTR support, where we always implement
 it for all v7 CPUs. This is arguably something we should
 clean up so it is gated on ARM_FEATURE_PMU and/or an ID
 register check for the relevant PMU version, but we should
 do that as its own tidyup rather than being inconsistent between
 this PMCCNTR accessor and the others.
-See https://developer.arm.com/documentation/ddi0601/2024-06/AArch32-Registers/PMCCNTR--Performance-Monitors-Cycle-Count-Register?lang=en
+[1] https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=21571ca0d70302909cf72707b2a7736cf12190a0;hp=298bc488fdc047da37482f4003023cb9adef78f8
-Signed-off-by: Alex Richardson <alexrichardson@google.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Message-id: 20240801220328.941866-1-alexrichardson@google.com
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2799
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 6 ++++++
+ linux-user/syscall.c | 4 +++-
-file changed, 6 insertions(+)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/linux-user/syscall.c
-+++ b/target/arm/helper.c
++++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
-       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
+ #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
-       .writefn = sdcr_write,
+ _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
-       .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
+           unsigned long *, user_mask_ptr);
-+    { .name = "PMCCNTR", .state = ARM_CP_STATE_AA32,
+-/* sched_attr is not defined in glibc */
-+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_64BIT,
++/* sched_attr is not defined in glibc < 2.41 */
-+      .cp = 15, .crm = 9, .opc1 = 0,
++#ifndef SCHED_ATTR_SIZE_VER0
-+      .access = PL0_RW, .resetvalue = 0, .fgt = FGT_PMCCNTR_EL0,
+ struct sched_attr {
-+      .readfn = pmccntr_read, .writefn = pmccntr_write,
+     uint32_t size;
-+      .accessfn = pmreg_access_ccntr },
+     uint32_t sched_policy;
@@ -XXX,XX +XXX,XX @@ struct sched_attr {
      uint32_t sched_util_min;
      uint32_t sched_util_max;
  };
++#endif
- /* These are present only when EL1 supports AArch32 */
+ #define __NR_sys_sched_getattr __NR_sched_getattr
  _syscall4(int, sys_sched_getattr, pid_t, pid, struct sched_attr *, attr,
            unsigned int, size, unsigned int, flags);
 --
 .34.1

Hi; this pullreq contains some minor bug fixes, and also
the txt-to-rST document conversions I did. The latter are not
strictly speaking bugfixes but I think for rc2 they're OK. Let
me know if you'd rather I respin this without them.

thanks
-- PMM

The following changes since commit 0f397dcfecc9211d12c2c720c01eb32f0eaa7d23:

Merge tag 'pull-nbd-2024-08-08' of https://repo.or.cz/qemu/ericb into staging (2024-08-09 08:40:37 +1000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240809

for you to fetch changes up to 77100e100d76a568800e19ee20c7e9255053b84a:

arm/virt: place power button pin number on a define (2024-08-09 17:37:56 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix BTI versus CF_PCREL
 * include: Fix typo in name of MAKE_IDENTFIER macro
 * docs: Various txt-to-rST conversions
 * add support for PMUv3 64-bit PMCCNTR in AArch32 mode
 * hw/core/ptimer: fix timer zero period condition for freq > 1GHz
 * arm/virt: place power button pin number on a define

----------------------------------------------------------------
Alex Richardson (1):
      target/arm: add support for PMUv3 64-bit PMCCNTR in AArch32 mode

Eric Blake (1):
      docs: Typo fix in live disk backup

Jianzhou Yue (1):
      hw/core/ptimer: fix timer zero period condition for freq > 1GHz

Mauro Carvalho Chehab (1):
      arm/virt: place power button pin number on a define

Peter Maydell (6):
      include: Fix typo in name of MAKE_IDENTFIER macro
      docs/specs/rocker.txt: Convert to rST
      docs/interop/nbd.txt: Convert to rST
      docs/interop/parallels.txt: Convert to rST
      docs/interop/prl-xml.txt: Convert to rST
      docs/interop/prl-xml.rst: Fix minor grammar nits

Richard Henderson (1):
      target/arm: Fix BTI versus CF_PCREL

MAINTAINERS                                   |   7 +-
 docs/interop/index.rst                        |   3 +
 docs/interop/live-block-operations.rst        |   4 +-
 docs/interop/nbd.rst                          |  89 ++++++++++++
 docs/interop/nbd.txt                          |  72 ----------
 docs/interop/{parallels.txt => parallels.rst} | 108 ++++++++-------
 docs/interop/prl-xml.rst                      | 192 ++++++++++++++++++++++++++
 docs/interop/prl-xml.txt                      | 158 ---------------------
 docs/specs/index.rst                          |   1 +
 docs/specs/{rocker.txt => rocker.rst}         | 181 ++++++++++++------------
 include/hw/arm/virt.h                         |   3 +
 include/qapi/qmp/qobject.h                    |   2 +-
 include/qemu/atomic.h                         |   2 +-
 include/qemu/compiler.h                       |   2 +-
 include/qemu/osdep.h                          |   6 +-
 target/arm/tcg/helper-a64.h                   |   3 +
 target/arm/tcg/translate.h                    |   2 -
 hw/arm/virt-acpi-build.c                      |   6 +-
 hw/arm/virt.c                                 |   7 +-
 hw/core/ptimer.c                              |   4 +-
 target/arm/helper.c                           |   6 +
 target/arm/tcg/helper-a64.c                   |  39 ++++++
 target/arm/tcg/translate-a64.c                |  64 ++-------
 tests/unit/ptimer-test.c                      |  33 +++++
 24 files changed, 553 insertions(+), 441 deletions(-)
 create mode 100644 docs/interop/nbd.rst
 delete mode 100644 docs/interop/nbd.txt
 rename docs/interop/{parallels.txt => parallels.rst} (72%)
 create mode 100644 docs/interop/prl-xml.rst
 delete mode 100644 docs/interop/prl-xml.txt
 rename docs/specs/{rocker.txt => rocker.rst} (91%)

From: Richard Henderson <richard.henderson@linaro.org>

With pcrel, we cannot check the guarded page bit at translation
time, as different mappings of the same physical page may or may
not have the GP bit set.

Instead, add a couple of helpers to check the page at runtime,
after all other filters that might obviate the need for the check.

The set_btype_for_br call must be moved after the gen_a64_set_pc
call to ensure the current pc can still be computed.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240802003028.795476-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-a64.h    |  3 ++
 target/arm/tcg/translate.h     |  2 --
 target/arm/tcg/helper-a64.c    | 39 +++++++++++++++++++++
 target/arm/tcg/translate-a64.c | 64 ++++++++--------------------------
 4 files changed, 56 insertions(+), 52 deletions(-)

diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.h
+++ b/target/arm/tcg/helper-a64.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(cpyfp, void, env, i32, i32, i32)
 DEF_HELPER_4(cpyfm, void, env, i32, i32, i32)
 DEF_HELPER_4(cpyfe, void, env, i32, i32, i32)
 
+DEF_HELPER_FLAGS_1(guarded_page_check, TCG_CALL_NO_WG, void, env)
+DEF_HELPER_FLAGS_2(guarded_page_br, TCG_CALL_NO_RWG, void, env, tl)
+
 DEF_HELPER_FLAGS_5(gvec_fdiv_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(gvec_fdiv_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(gvec_fdiv_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     uint8_t dcz_blocksize;
     /* A copy of cpu->gm_blocksize. */
     uint8_t gm_blocksize;
-    /* True if this page is guarded.  */
-    bool guarded_page;
     /* True if the current insn_start has been updated. */
     bool insn_start_updated;
     /* Bottom two bits of XScale c15_cpar coprocessor access control reg */
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ void HELPER(cpyfe)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc,
 {
     do_cpye(env, syndrome, wdesc, rdesc, false, GETPC());
 }
+
+static bool is_guarded_page(CPUARMState *env, target_ulong addr, uintptr_t ra)
+{
+#ifdef CONFIG_USER_ONLY
+    return page_get_flags(addr) & PAGE_BTI;
+#else
+    CPUTLBEntryFull *full;
+    void *host;
+    int mmu_idx = cpu_mmu_index(env_cpu(env), true);
+    int flags = probe_access_full(env, addr, 0, MMU_INST_FETCH, mmu_idx,
+                                  false, &host, &full, ra);
+
+    assert(!(flags & TLB_INVALID_MASK));
+    return full->extra.arm.guarded;
+#endif
+}
+
+void HELPER(guarded_page_check)(CPUARMState *env)
+{
+    /*
+     * We have already verified that bti is enabled, and that the
+     * instruction at PC is not ok for BTYPE.  This is always at
+     * the beginning of a block, so PC is always up-to-date and
+     * no unwind is required.
+     */
+    if (is_guarded_page(env, env->pc, 0)) {
+        raise_exception(env, EXCP_UDEF, syn_btitrap(env->btype),
+                        exception_target_el(env));
+    }
+}
+
+void HELPER(guarded_page_br)(CPUARMState *env, target_ulong pc)
+{
+    /*
+     * We have already checked for branch via x16 and x17.
+     * What remains for choosing BTYPE is checking for a guarded page.
+     */
+    env->btype = is_guarded_page(env, pc, GETPC()) ? 3 : 1;
+}
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void set_btype_for_br(DisasContext *s, int rn)
 {
     if (dc_isar_feature(aa64_bti, s)) {
         /* BR to {x16,x17} or !guard -> 1, else 3.  */
-        set_btype(s, rn == 16 || rn == 17 || !s->guarded_page ? 1 : 3);
+        if (rn == 16 || rn == 17) {
+            set_btype(s, 1);
+        } else {
+            TCGv_i64 pc = tcg_temp_new_i64();
+            gen_pc_plus_diff(s, pc, 0);
+            gen_helper_guarded_page_br(tcg_env, pc);
+            s->btype = -1;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void set_btype_for_blr(DisasContext *s)
 
 static bool trans_BR(DisasContext *s, arg_r *a)
 {
-    gen_a64_set_pc(s, cpu_reg(s, a->rn));
     set_btype_for_br(s, a->rn);
+    gen_a64_set_pc(s, cpu_reg(s, a->rn));
     s->base.is_jmp = DISAS_JUMP;
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_BRAZ(DisasContext *s, arg_braz *a)
     }
 
     dst = auth_branch_target(s, cpu_reg(s, a->rn), tcg_constant_i64(0), !a->m);
-    gen_a64_set_pc(s, dst);
     set_btype_for_br(s, a->rn);
+    gen_a64_set_pc(s, dst);
     s->base.is_jmp = DISAS_JUMP;
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_FAIL(DisasContext *s, arg_OK *a)
     return true;
 }
 
-/**
- * is_guarded_page:
- * @env: The cpu environment
- * @s: The DisasContext
- *
- * Return true if the page is guarded.
- */
-static bool is_guarded_page(CPUARMState *env, DisasContext *s)
-{
-    uint64_t addr = s->base.pc_first;
-#ifdef CONFIG_USER_ONLY
-    return page_get_flags(addr) & PAGE_BTI;
-#else
-    CPUTLBEntryFull *full;
-    void *host;
-    int mmu_idx = arm_to_core_mmu_idx(s->mmu_idx);
-    int flags;
-
-    /*
-     * We test this immediately after reading an insn, which means
-     * that the TLB entry must be present and valid, and thus this
-     * access will never raise an exception.
-     */
-    flags = probe_access_full(env, addr, 0, MMU_INST_FETCH, mmu_idx,
-                              false, &host, &full, 0);
-    assert(!(flags & TLB_INVALID_MASK));
-
-    return full->extra.arm.guarded;
-#endif
-}
-
 /**
  * btype_destination_ok:
  * @insn: The instruction at the branch destination
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 
     if (dc_isar_feature(aa64_bti, s)) {
         if (s->base.num_insns == 1) {
-            /*
-             * At the first insn of the TB, compute s->guarded_page.
-             * We delayed computing this until successfully reading
-             * the first insn of the TB, above.  This (mostly) ensures
-             * that the softmmu tlb entry has been populated, and the
-             * page table GP bit is available.
-             *
-             * Note that we need to compute this even if btype == 0,
-             * because this value is used for BR instructions later
-             * where ENV is not available.
-             */
-            s->guarded_page = is_guarded_page(env, s);
-
             /* First insn can have btype set to non-zero.  */
             tcg_debug_assert(s->btype >= 0);
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
              * priority -- below debugging exceptions but above most
              * everything else.  This allows us to handle this now
              * instead of waiting until the insn is otherwise decoded.
+             *
+             * We can check all but the guarded page check here;
+             * defer the latter to a helper.
              */
             if (s->btype != 0
-                && s->guarded_page
                 && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn(s, 0, EXCP_UDEF, syn_btitrap(s->btype));
-                return;
+                gen_helper_guarded_page_check(tcg_env);
             }
         } else {
             /* Not the first insn: btype must be 0.  */
-- 
2.34.1

In commit bb71846325e23 we added some macro magic to avoid
variable-shadowing when using some of our more complicated
macros. One of the internal components of this is a macro
named MAKE_IDENTFIER. Fix the typo in its name: it should
be MAKE_IDENTIFIER.

Commit created with
 sed -i -e 's/MAKE_IDENTFIER/MAKE_IDENTIFIER/g' include/qemu/*.h include/qapi/qmp/qobject.h

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240801102516.3843780-1-peter.maydell@linaro.org
---
 include/qapi/qmp/qobject.h | 2 +-
 include/qemu/atomic.h      | 2 +-
 include/qemu/compiler.h    | 2 +-
 include/qemu/osdep.h       | 6 +++---
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/qapi/qmp/qobject.h b/include/qapi/qmp/qobject.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qapi/qmp/qobject.h
+++ b/include/qapi/qmp/qobject.h
@@ -XXX,XX +XXX,XX @@ struct QObject {
     typeof(obj) _obj = (obj);                                   \
     _obj ? container_of(&_obj->base, QObject, base) : NULL;     \
 })
-#define QOBJECT(obj) QOBJECT_INTERNAL((obj), MAKE_IDENTFIER(_obj))
+#define QOBJECT(obj) QOBJECT_INTERNAL((obj), MAKE_IDENTIFIER(_obj))
 
 /* Required for qobject_to() */
 #define QTYPE_CAST_TO_QNull     QTYPE_QNULL
diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -XXX,XX +XXX,XX @@
     _val;                                               \
     })
 #define qatomic_rcu_read(ptr) \
-    qatomic_rcu_read_internal((ptr), MAKE_IDENTFIER(_val))
+    qatomic_rcu_read_internal((ptr), MAKE_IDENTIFIER(_val))
 
 #define qatomic_rcu_set(ptr, i) do {                   \
     qemu_build_assert(sizeof(*ptr) <= ATOMIC_REG_SIZE); \
diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 #endif
 
 /* Expands into an identifier stemN, where N is another number each time */
-#define MAKE_IDENTFIER(stem) glue(stem, __COUNTER__)
+#define MAKE_IDENTIFIER(stem) glue(stem, __COUNTER__)
 
 #ifndef likely
 #define likely(x)   __builtin_expect(!!(x), 1)
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ void QEMU_ERROR("code path is reachable")
     })
 #undef MIN
 #define MIN(a, b) \
-    MIN_INTERNAL((a), (b), MAKE_IDENTFIER(_a), MAKE_IDENTFIER(_b))
+    MIN_INTERNAL((a), (b), MAKE_IDENTIFIER(_a), MAKE_IDENTIFIER(_b))
 
 #define MAX_INTERNAL(a, b, _a, _b)                      \
     ({                                                  \
@@ -XXX,XX +XXX,XX @@ void QEMU_ERROR("code path is reachable")
     })
 #undef MAX
 #define MAX(a, b) \
-    MAX_INTERNAL((a), (b), MAKE_IDENTFIER(_a), MAKE_IDENTFIER(_b))
+    MAX_INTERNAL((a), (b), MAKE_IDENTIFIER(_a), MAKE_IDENTIFIER(_b))
 
 #ifdef __COVERITY__
 # define MIN_CONST(a, b) ((a) < (b) ? (a) : (b))
@@ -XXX,XX +XXX,XX @@ void QEMU_ERROR("code path is reachable")
         _a == 0 ? _b : (_b == 0 || _b > _a) ? _a : _b;  \
     })
 #define MIN_NON_ZERO(a, b) \
-    MIN_NON_ZERO_INTERNAL((a), (b), MAKE_IDENTFIER(_a), MAKE_IDENTFIER(_b))
+    MIN_NON_ZERO_INTERNAL((a), (b), MAKE_IDENTIFIER(_a), MAKE_IDENTIFIER(_b))
 
 /*
  * Round number down to multiple. Safe when m is not a power of 2 (see
-- 
2.34.1

Convert the rocker.txt specification document to rST format.  We make
extensive use of the :: marker to introduce a literal block for all
the tables and ASCII art, rather than trying to convert the tables to
rST table syntax.  This produces a valid rST document without needing
a huge diff.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240801170131.3977807-2-peter.maydell@linaro.org
---
 MAINTAINERS                           |   2 +-
 docs/specs/index.rst                  |   1 +
 docs/specs/{rocker.txt => rocker.rst} | 181 +++++++++++++-------------
 3 files changed, 93 insertions(+), 91 deletions(-)
 rename docs/specs/{rocker.txt => rocker.rst} (91%)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/net/rocker/
 F: qapi/rocker.json
 F: tests/rocker/
-F: docs/specs/rocker.txt
+F: docs/specs/rocker.rst
 
 e1000x
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
diff --git a/docs/specs/index.rst b/docs/specs/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/index.rst
+++ b/docs/specs/index.rst
@@ -XXX,XX +XXX,XX @@ guest hardware that is specific to QEMU.
    vmcoreinfo
    vmgenid
    rapl-msr
+   rocker
diff --git a/docs/specs/rocker.txt b/docs/specs/rocker.rst
similarity index 91%
rename from docs/specs/rocker.txt
rename to docs/specs/rocker.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/rocker.txt
+++ b/docs/specs/rocker.rst
@@ -XXX,XX +XXX,XX @@
 Rocker Network Switch Register Programming Guide
-Copyright (c) Scott Feldman <sfeldma@gmail.com>
-Copyright (c) Neil Horman <nhorman@tuxdriver.com>
-Version 0.11, 12/29/2014
+************************************************
 
-LICENSE
-=======
+..
+   Copyright (c) Scott Feldman <sfeldma@gmail.com>
+   Copyright (c) Neil Horman <nhorman@tuxdriver.com>
+   Version 0.11, 12/29/2014
 
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 2 of the License, or
-(at your option) any later version.
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
 
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-GNU General Public License for more details.
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+   GNU General Public License for more details.
 
-SECTION 1: Introduction
-=======================
+Introduction
+============
 
 Overview
 --------
@@ -XXX,XX +XXX,XX @@ software.
 Notations and Conventions
 -------------------------
 
-o In register descriptions, [n:m] indicates a range from bit n to bit m,
-inclusive.
-o Use of leading 0x indicates a hexadecimal number.
-o Use of leading 0b indicates a binary number.
-o The use of RSVD or Reserved indicates that a bit or field is reserved for
-future use.
-o Field width is in bytes, unless otherwise noted.
-o Register are (R) read-only, (R/W) read/write, (W) write-only, or (COR) clear
-on read
-o TLV values in network-byte-order are designated with (N).
+* In register descriptions, [n:m] indicates a range from bit n to bit m,
+  inclusive.
+* Use of leading 0x indicates a hexadecimal number.
+* Use of leading 0b indicates a binary number.
+* The use of RSVD or Reserved indicates that a bit or field is reserved for
+  future use.
+* Field width is in bytes, unless otherwise noted.
+* Register are (R) read-only, (R/W) read/write, (W) write-only, or (COR) clear
+  on read
+* TLV values in network-byte-order are designated with (N).
 
 
-SECTION 2: PCI Configuration Registers
-======================================
+PCI Configuration Registers
+===========================
 
 PCI Configuration Space
 -----------------------
 
-Each switch instance registers as a PCI device with PCI configuration space:
+Each switch instance registers as a PCI device with PCI configuration space::
 
 	offset	width	description		value
 	---------------------------------------------
@@ -XXX,XX +XXX,XX @@ Each switch instance registers as a PCI device with PCI configuration space:
 	0x41	1	Retry count
 	0x42	2	Reserved
 
+        * Assigned by sub-system implementation
 
-* Assigned by sub-system implementation
-
-SECTION 3: Memory-Mapped Register Space
-=======================================
+Memory-Mapped Register Space
+============================
 
 There are two memory-mapped BARs.  BAR0 maps device register space and is
 0x2000 in size.  BAR1 maps MSI-X vector and PBA tables and is also 0x2000 in
@@ -XXX,XX +XXX,XX @@ byte registers with one 4-byte access, and 8 byte registers with either two
 4-byte accesses or a single 8-byte access.  In the case of two 4-byte accesses,
 access must be lower and then upper 4-bytes, in that order.
 
-BAR0 device register space is organized as follows:
+BAR0 device register space is organized as follows::
 
 	offset		description
 	------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Reads to reserved registers read back as 0.
 
 No fancy stuff like write-combining is enabled on any of the registers.
 
-BAR1 MSI-X register space is organized as follows:
+BAR1 MSI-X register space is organized as follows::
 
 	offset		description
 	------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ BAR1 MSI-X register space is organized as follows:
 	0x1000-0x1fff	MSI-X PBA table
 
 
-SECTION 4: Interrupts, DMA, and Endianness
-==========================================
+Interrupts, DMA, and Endianness
+===============================
 
 PCI Interrupts
 --------------
@@ -XXX,XX +XXX,XX @@ PCI Interrupts
 The device supports only MSI-X interrupts.  BAR1 memory-mapped region contains
 the MSI-X vector and PBA tables, with support for up to 256 MSI-X vectors.
 
-The vector assignment is:
+The vector assignment is::
 
 	vector		description
 	-----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ The vector assignment is:
 			  Tx vector is even
 			  Rx vector is odd
 
-A MSI-X vector table entry is 16 bytes:
+A MSI-X vector table entry is 16 bytes::
 
 	field		offset	width	description
 	-------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ ring, and hardware will set this bit when the descriptor is complete.
 Descriptor ring sizes must be a power of 2 and range from 2 to 64K entries.
 Descriptor rings' base address must be 8-byte aligned.  Descriptors must be
 packed within ring.  Each descriptor in each ring must also be aligned on an 8
-byte boundary.  Each descriptor ring will have these registers:
+byte boundary.  Each descriptor ring will have these registers::
 
 	DMA_DESC_xxx_BASE_ADDR, offset 0x1000 + (x * 32), 64-bit, (R/W)
 	DMA_DESC_xxx_SIZE, offset 0x1008 + (x * 32), 32-bit, (R/W)
@@ -XXX,XX +XXX,XX @@ byte boundary.  Each descriptor ring will have these registers:
 	DMA_DESC_xxx_CREDITS, offset 0x1018 + (x * 32), 32-bit, (R/W)
 	DMA_DESC_xxx_RSVD1, offset 0x101c + (x * 32), 32-bit, (R/W)
 
-Where x is descriptor ring index:
+Where x is descriptor ring index::
 
 	index		ring
 	--------------------
@@ -XXX,XX +XXX,XX @@ written past TAIL.  To do so would wrap the ring.  An empty ring is when HEAD
 == TAIL.  A full ring is when HEAD is one position behind TAIL.  Both HEAD and
 TAIL increment and modulo wrap at the ring size.
 
-CTRL register bits:
+CTRL register bits::
 
 	bit	name		description
 	------------------------------------------------------------------------
 	[0]	CTRL_RESET	Reset the descriptor ring
 	[1:31]	Reserved
 
-All descriptor types share some common fields:
+All descriptor types share some common fields::
 
 	field			width	description
 	-------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ filled in by the switch.  Likewise, the switch will ignore unknown fields
 filled in by software.
 
 Descriptor payload buffer is 8-byte aligned and TLVs are 8-byte aligned.  The
-value within a TLV is also 8-byte aligned.  The (packed, 8 byte) TLV header is:
+value within a TLV is also 8-byte aligned.  The (packed, 8 byte) TLV header is::
 
 	field	width	description
 	-----------------------------
@@ -XXX,XX +XXX,XX @@ The alignment requirements for descriptors and TLVs are to avoid unaligned
 access exceptions in software.  Note that the payload for each TLV is also
 8 byte aligned.
 
-Figure 1 shows an example descriptor buffer with two TLVs.
+Figure 1 shows an example descriptor buffer with two TLVs::
 
                   <------- 8 bytes ------->
 
@@ -XXX,XX +XXX,XX @@ network packet data.  All non-network-packet TLV multi-byte values will be LE.
 TLV values in network-byte-order are designated with (N).
 
 
-SECTION 5: Test Registers
-=========================
+Test Registers
+==============
 
 Rocker has several test registers to support troubleshooting register access,
-interrupt generation, and DMA operations:
+interrupt generation, and DMA operations::
 
 	TEST_REG, offset 0x0010, 32-bit (R/W)
 	TEST_REG64, offset 0x0018, 64-bit (R/W)
@@ -XXX,XX +XXX,XX @@ for that vector.
 
 To test basic DMA operations, allocate a DMA-able host buffer and put the
 buffer address into TEST_DMA_ADDR and size into TEST_DMA_SIZE.  Then, write to
-TEST_DMA_CTRL to manipulate the buffer contents.  TEST_DMA_CTRL operations are:
+TEST_DMA_CTRL to manipulate the buffer contents.  TEST_DMA_CTRL operations are::
 
 	operation		value	description
 	-----------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ issue exists.  In particular, buffers that start on odd-8-byte boundary and/or
 span multiple PAGE sizes should be tested.
 
 
-SECTION 6: Ports
-================
+Ports
+=====
 
 Physical and Logical Ports
 ------------------------------------
 
 The switch supports up to 62 physical (front-panel) ports.  Register
-PORT_PHYS_COUNT returns the actual number of physical ports available:
+PORT_PHYS_COUNT returns the actual number of physical ports available::
 
 	PORT_PHYS_COUNT, offset 0x0304, 32-bit, (R)
 
@@ -XXX,XX +XXX,XX @@ Front-panel ports and logical tunnel ports are mapped into a single 32-bit port
 space.  A special CPU port is assigned port 0.  The front-panel ports are
 mapped to ports 1-62.  A special loopback port is assigned port 63.  Logical
 tunnel ports are assigned ports 0x0001000-0x0001ffff.
-To summarize the port assignments:
+To summarize the port assignments::
 
 	port			mapping
 	-------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ set/get the mode for front-panel ports, see port settings, below.
 Port Settings
 -------------
 
-Link status for all front-panel ports is available via PORT_PHYS_LINK_STATUS:
+Link status for all front-panel ports is available via PORT_PHYS_LINK_STATUS::
 
 	PORT_PHYS_LINK_STATUS, offset 0x0310, 64-bit, (R)
 
 	Value is port bitmap.  Bits 0 and 63 always read 0.  Bits 1-62
 	read 1 for link UP and 0 for link DOWN for respective front-panel ports.
 
-Other properties for front-panel ports are available via DMA CMD descriptors:
+Other properties for front-panel ports are available via DMA CMD descriptors::
 
 	Get PORT_SETTINGS descriptor:
 
@@ -XXX,XX +XXX,XX @@ Port Enable
 -----------
 
 Front-panel ports are initially disabled, which means port ingress and egress
-packets will be dropped.  To enable or disable a port, use PORT_PHYS_ENABLE:
+packets will be dropped.  To enable or disable a port, use PORT_PHYS_ENABLE::
 
 	PORT_PHYS_ENABLE: offset 0x0318, 64-bit, (R/W)
 
@@ -XXX,XX +XXX,XX @@ packets will be dropped.  To enable or disable a port, use PORT_PHYS_ENABLE:
 	Default is 0.
 
 
-SECTION 7: Switch Control
-=========================
+Switch Control
+==============
 
 This section covers switch-wide register settings.
 
 Control
 -------
 
-This register is used for low level control of the switch.
+This register is used for low level control of the switch::
 
 	CONTROL: offset 0x0300, 32-bit, (W)
 
@@ -XXX,XX +XXX,XX @@ Switch ID
 ---------
 
 The switch has a SWITCH_ID to be used by software to uniquely identify the
-switch:
+switch::
 
 	SWITCH_ID: offset 0x0320, 64-bit, (R)
 
 	Value is opaque to switch software and no special encoding is implied.
 
 
-SECTION 8: Events
-=================
+Events
+======
 
 Non-I/O asynchronous events from the device are notified to the host using the
-event ring.  The TLV structure for events is:
+event ring.  The TLV structure for events is::
 
 	field		width	description
 	---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ event ring.  The TLV structure for events is:
 Link Changed Event
 ------------------
 
-When link status changes on a physical port, this event is generated.
+When link status changes on a physical port, this event is generated::
 
 	field		width	description
 	---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ driver should install to the device the MAC/VLAN on the port into the bridge
 table.  Once installed, the MAC/VLAN is known on the port and this event will
 no longer be generated.
 
+::
+
 	field		width	description
 	---------------------------------------------------
 	INFO		<nest>
@@ -XXX,XX +XXX,XX @@ no longer be generated.
 	  VLAN		2	VLAN ID
 
 
-SECTION 9: CPU Packet Processing
-================================
+CPU Packet Processing
+=====================
 
 Ingress packets directed to the host CPU for further processing are delivered
 in the DMA RX ring.  Likewise, host CPU originating packets destined to egress
@@ -XXX,XX +XXX,XX @@ software that Tx is complete and software resources (e.g. skb) backing packet
 can be released.
 
 Figure 2 shows an example 3-fragment packet queued with one Tx descriptor.  A
-TLV is used for each packet fragment.
+TLV is used for each packet fragment::
 
 	                                           pkt frag 1
 	                                           +–––––––+  +–+
@@ -XXX,XX +XXX,XX @@ TLV is used for each packet fragment.
 
 				fig 2.
 
-The TLVs for Tx descriptor buffer are:
+The TLVs for Tx descriptor buffer are::
 
 	field			width	description
 	---------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ The TLVs for Tx descriptor buffer are:
 	    TX_FRAG_ADDR	8	DMA address of packet fragment
 	    TX_FRAG_LEN		2	Packet fragment length
 
-Possible status return codes in descriptor on completion are:
+Possible status return codes in descriptor on completion are::
 
 	DESC_COMP_ERR	reason
 	--------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ worst-case packet size.  A single Rx descriptor will contain the entire Rx
 packet data in one RX_FRAG.  Other Rx TLVs describe and hardware offloads
 performed on the packet, such as checksum validation.
 
-The TLVs for Rx descriptor buffer are:
+The TLVs for Rx descriptor buffer are::
 
 	field		width	description
 	---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ The TLVs for Rx descriptor buffer are:
 Offload forward RX_FLAG indicates the device has already forwarded the packet
 so the host CPU should not also forward the packet.
 
-Possible status return codes in descriptor on completion are:
+Possible status return codes in descriptor on completion are::
 
 	DESC_COMP_ERR	reason
 	--------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Possible status return codes in descriptor on completion are:
 			packet data TLV and other TLVs.
 
 
-SECTION 10: OF-DPA Mode
-======================
+OF-DPA Mode
+===========
 
 OF-DPA mode allows the switch to offload flow packet processing functions to
 hardware.  An OpenFlow controller would communicate with an OpenFlow agent
 installed on the switch.  The OpenFlow agent would (directly or indirectly)
 communicate with the Rocker switch driver, which in turn would program switch
-hardware with flow functionality, as defined in OF-DPA.  The block diagram is:
+hardware with flow functionality, as defined in OF-DPA.  The block diagram is::
 
 		+–––––––––––––––----–––+
 		|        OF            |
@@ -XXX,XX +XXX,XX @@ OF-DPA Flow Table Interface
 
 There are commands to add, modify, delete, and get stats of flow table entries.
 The commands are issued using the DMA CMD descriptor ring.  The following
-commands are defined:
+commands are defined::
 
 	CMD_ADD:		add an entry to flow table
 	CMD_MOD:		modify an entry in flow table
 	CMD_DEL:		delete an entry from flow table
 	CMD_GET_STATS:		get stats for flow entry
 
-TLVs for add and modify commands are:
+TLVs for add and modify commands are::
 
 	field			width	description
 	----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for add and modify commands are:
 
 Additional TLVs based on flow table ID:
 
-Table ID 0: ingress port
+Table ID 0: ingress port::
 
 	field			width	description
 	----------------------------------------------------
 	OF_DPA_IN_PPORT		4	ingress physical port number
 	OF_DPA_GOTO_TBL		2	goto table ID; zero to drop
 
-Table ID 10: vlan
+Table ID 10: vlan::
 
 	field			width	description
 	----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 10: vlan
 	OF_DPA_GOTO_TBL		2	goto table ID; zero to drop
 	OF_DPA_NEW_VLAN_ID	2 (N)	new vlan ID
 
-Table ID 20: termination mac
+Table ID 20: termination mac::
 
 	field			width	description
 	----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 20: termination mac
 	OF_DPA_OUT_PPORT	2	if specified, must be
 					controller, set zero otherwise
 
-Table ID 30: unicast routing
+Table ID 30: unicast routing::
 
 	field			width	description
 	----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 30: unicast routing
 	OF_DPA_GROUP_ID		4	data for GROUP action must
 					be an L3 Unicast group entry
 
-Table ID 40: multicast routing
+Table ID 40: multicast routing::
 
 	field			width	description
 	----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 40: multicast routing
 	OF_DPA_GROUP_ID		4	data for GROUP action must
 					be an L3 multicast group entry
 
-Table ID 50: bridging
+Table ID 50: bridging::
 
 	field			width	description
 	----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 50: bridging
 					restricted to CONTROLLER,
 					set to 0 otherwise
 
-Table ID 60: acl policy
+Table ID 60: acl policy::
 
 	field			width	description
 	----------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Table ID 60: acl policy
 					dropped (all other instructions
 					ignored)
 
-TLVs for flow delete and get stats command are:
+TLVs for flow delete and get stats command are::
 
 	field			width	description
 	---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for flow delete and get stats command are:
 	OF_DPA_COOKIE		8	Cookie
 
 On completion of get stats command, the descriptor buffer is written back with
-the following TLVs:
+the following TLVs::
 
 	field			width	description
 	---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ the following TLVs:
 	OF_DPA_STAT_RX_PKTS	8	Received packets
 	OF_DPA_STAT_TX_PKTS	8	Transmit packets
 
-Possible status return codes in descriptor on completion are:
+Possible status return codes in descriptor on completion are::
 
 	DESC_COMP_ERR	command			reason
 	--------------------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ Group Table Interface
 
 There are commands to add, modify, delete, and get stats of group table
 entries.  The commands are issued using the DMA CMD descriptor ring.  The
-following commands are defined:
+following commands are defined::
 
 	CMD_ADD:		add an entry to group table
 	CMD_MOD:		modify an entry in group table
 	CMD_DEL:		delete an entry from group table
 	CMD_GET_STATS:		get stats for group entry
 
-TLVs for add and modify commands are:
+TLVs for add and modify commands are::
 
 	field			width	description
 	-----------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for add and modify commands are:
 	  FLOW_SRC_MAC		6	(types 1, 2, 5)
 	  FLOW_DST_MAC		6	(types 1, 2)
 
-TLVs for flow delete and get stats command are:
+TLVs for flow delete and get stats command are::
 
 	field			width	description
 	-----------------------------------------------------------
@@ -XXX,XX +XXX,XX @@ TLVs for flow delete and get stats command are:
 	FLOW_GROUP_ID		2	Flow group ID
 
 On completion of get stats command, the descriptor buffer is written back with
-the following TLVs:
+the following TLVs::
 
 	field			width	description
 	---------------------------------------------------
@@ -XXX,XX +XXX,XX @@ the following TLVs:
 	FLOW_STAT_REF_COUNT	4	Flow reference count
 	FLOW_STAT_BUCKET_COUNT	4	Flow bucket count
 
-Possible status return codes in descriptor on completion are:
+Possible status return codes in descriptor on completion are::
 
 	DESC_COMP_ERR	command			reason
 	--------------------------------------------------------------------
-- 
2.34.1

Convert nbd.txt to rST format.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20240801170131.3977807-3-peter.maydell@linaro.org
---
 MAINTAINERS            |  2 +-
 docs/interop/index.rst |  1 +
 docs/interop/nbd.rst   | 89 ++++++++++++++++++++++++++++++++++++++++++
 docs/interop/nbd.txt   | 72 ----------------------------------
 4 files changed, 91 insertions(+), 73 deletions(-)
 create mode 100644 docs/interop/nbd.rst
 delete mode 100644 docs/interop/nbd.txt

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: nbd/
 F: include/block/nbd*
 F: qemu-nbd.*
 F: blockdev-nbd.c
-F: docs/interop/nbd.txt
+F: docs/interop/nbd.rst
 F: docs/tools/qemu-nbd.rst
 F: tests/qemu-iotests/tests/*nbd*
 T: git https://repo.or.cz/qemu/ericb.git nbd
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ are useful for making QEMU interoperate with other software.
    dbus-vmstate
    dbus-display
    live-block-operations
+   nbd
    pr-helper
    qmp-spec
    qemu-ga
diff --git a/docs/interop/nbd.rst b/docs/interop/nbd.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/nbd.rst
@@ -XXX,XX +XXX,XX @@
+QEMU NBD protocol support
+=========================
+
+QEMU supports the NBD protocol, and has an internal NBD client (see
+``block/nbd.c``), an internal NBD server (see ``blockdev-nbd.c``), and an
+external NBD server tool (see ``qemu-nbd.c``). The common code is placed
+in ``nbd/*``.
+
+The NBD protocol is specified here:
+https://github.com/NetworkBlockDevice/nbd/blob/master/doc/proto.md
+
+The following paragraphs describe some specific properties of NBD
+protocol realization in QEMU.
+
+Metadata namespaces
+-------------------
+
+QEMU supports the ``base:allocation`` metadata context as defined in the
+NBD protocol specification, and also defines an additional metadata
+namespace ``qemu``.
+
+``qemu`` namespace
+------------------
+
+The ``qemu`` namespace currently contains two available metadata context
+types.  The first is related to exposing the contents of a dirty
+bitmap alongside the associated disk contents.  That metadata context
+is named with the following form::
+
+    qemu:dirty-bitmap:<dirty-bitmap-export-name>
+
+Each dirty-bitmap metadata context defines only one flag for extents
+in reply for ``NBD_CMD_BLOCK_STATUS``:
+
+bit 0:
+  ``NBD_STATE_DIRTY``, set when the extent is "dirty"
+
+The second is related to exposing the source of various extents within
+the image, with a single metadata context named::
+
+    qemu:allocation-depth
+
+In the allocation depth context, the entire 32-bit value represents a
+depth of which layer in a thin-provisioned backing chain provided the
+data (0 for unallocated, 1 for the active layer, 2 for the first
+backing layer, and so forth).
+
+For ``NBD_OPT_LIST_META_CONTEXT`` the following queries are supported
+in addition to the specific ``qemu:allocation-depth`` and
+``qemu:dirty-bitmap:<dirty-bitmap-export-name>``:
+
+``qemu:``
+  returns list of all available metadata contexts in the namespace
+``qemu:dirty-bitmap:``
+  returns list of all available dirty-bitmap metadata contexts
+
+Features by version
+-------------------
+
+The following list documents which qemu version first implemented
+various features (both as a server exposing the feature, and as a
+client taking advantage of the feature when present), to make it
+easier to plan for cross-version interoperability.  Note that in
+several cases, the initial release containing a feature may require
+additional patches from the corresponding stable branch to fix bugs in
+the operation of that feature.
+
+2.6
+  ``NBD_OPT_STARTTLS`` with TLS X.509 Certificates
+2.8
+  ``NBD_CMD_WRITE_ZEROES``
+2.10
+  ``NBD_OPT_GO``, ``NBD_INFO_BLOCK``
+2.11
+  ``NBD_OPT_STRUCTURED_REPLY``
+2.12
+  ``NBD_CMD_BLOCK_STATUS`` for ``base:allocation``
+3.0
+  ``NBD_OPT_STARTTLS`` with TLS Pre-Shared Keys (PSK),
+  ``NBD_CMD_BLOCK_STATUS`` for ``qemu:dirty-bitmap:``, ``NBD_CMD_CACHE``
+4.2
+  ``NBD_FLAG_CAN_MULTI_CONN`` for shareable read-only exports,
+  ``NBD_CMD_FLAG_FAST_ZERO``
+5.2
+  ``NBD_CMD_BLOCK_STATUS`` for ``qemu:allocation-depth``
+7.1
+  ``NBD_FLAG_CAN_MULTI_CONN`` for shareable writable exports
+8.2
+  ``NBD_OPT_EXTENDED_HEADERS``, ``NBD_FLAG_BLOCK_STATUS_PAYLOAD``
diff --git a/docs/interop/nbd.txt b/docs/interop/nbd.txt
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/interop/nbd.txt
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-QEMU supports the NBD protocol, and has an internal NBD client (see
-block/nbd.c), an internal NBD server (see blockdev-nbd.c), and an
-external NBD server tool (see qemu-nbd.c). The common code is placed
-in nbd/*.
-
-The NBD protocol is specified here:
-https://github.com/NetworkBlockDevice/nbd/blob/master/doc/proto.md
-
-The following paragraphs describe some specific properties of NBD
-protocol realization in QEMU.
-
-= Metadata namespaces =
-
-QEMU supports the "base:allocation" metadata context as defined in the
-NBD protocol specification, and also defines an additional metadata
-namespace "qemu".
-
-== "qemu" namespace ==
-
-The "qemu" namespace currently contains two available metadata context
-types.  The first is related to exposing the contents of a dirty
-bitmap alongside the associated disk contents.  That metadata context
-is named with the following form:
-
-    qemu:dirty-bitmap:<dirty-bitmap-export-name>
-
-Each dirty-bitmap metadata context defines only one flag for extents
-in reply for NBD_CMD_BLOCK_STATUS:
-
-    bit 0: NBD_STATE_DIRTY, set when the extent is "dirty"
-
-The second is related to exposing the source of various extents within
-the image, with a single metadata context named:
-
-    qemu:allocation-depth
-
-In the allocation depth context, the entire 32-bit value represents a
-depth of which layer in a thin-provisioned backing chain provided the
-data (0 for unallocated, 1 for the active layer, 2 for the first
-backing layer, and so forth).
-
-For NBD_OPT_LIST_META_CONTEXT the following queries are supported
-in addition to the specific "qemu:allocation-depth" and
-"qemu:dirty-bitmap:<dirty-bitmap-export-name>":
-
-* "qemu:" - returns list of all available metadata contexts in the
-            namespace.
-* "qemu:dirty-bitmap:" - returns list of all available dirty-bitmap
-                         metadata contexts.
-
-= Features by version =
-
-The following list documents which qemu version first implemented
-various features (both as a server exposing the feature, and as a
-client taking advantage of the feature when present), to make it
-easier to plan for cross-version interoperability.  Note that in
-several cases, the initial release containing a feature may require
-additional patches from the corresponding stable branch to fix bugs in
-the operation of that feature.
-
-* 2.6: NBD_OPT_STARTTLS with TLS X.509 Certificates
-* 2.8: NBD_CMD_WRITE_ZEROES
-* 2.10: NBD_OPT_GO, NBD_INFO_BLOCK
-* 2.11: NBD_OPT_STRUCTURED_REPLY
-* 2.12: NBD_CMD_BLOCK_STATUS for "base:allocation"
-* 3.0: NBD_OPT_STARTTLS with TLS Pre-Shared Keys (PSK),
-NBD_CMD_BLOCK_STATUS for "qemu:dirty-bitmap:", NBD_CMD_CACHE
-* 4.2: NBD_FLAG_CAN_MULTI_CONN for shareable read-only exports,
-NBD_CMD_FLAG_FAST_ZERO
-* 5.2: NBD_CMD_BLOCK_STATUS for "qemu:allocation-depth"
-* 7.1: NBD_FLAG_CAN_MULTI_CONN for shareable writable exports
-* 8.2: NBD_OPT_EXTENDED_HEADERS, NBD_FLAG_BLOCK_STATUS_PAYLOAD
-- 
2.34.1

Convert parallels.txt to rST format.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20240801170131.3977807-4-peter.maydell@linaro.org
---
 MAINTAINERS                                   |   2 +-
 docs/interop/index.rst                        |   1 +
 docs/interop/{parallels.txt => parallels.rst} | 108 ++++++++++--------
 3 files changed, 60 insertions(+), 51 deletions(-)
 rename docs/interop/{parallels.txt => parallels.rst} (72%)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-block@nongnu.org
 S: Supported
 F: block/parallels.c
 F: block/parallels-ext.c
-F: docs/interop/parallels.txt
+F: docs/interop/parallels.rst
 T: git https://src.openvz.org/scm/~den/qemu.git parallels
 
 qed
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ are useful for making QEMU interoperate with other software.
    dbus-display
    live-block-operations
    nbd
+   parallels
    pr-helper
    qmp-spec
    qemu-ga
diff --git a/docs/interop/parallels.txt b/docs/interop/parallels.rst
similarity index 72%
rename from docs/interop/parallels.txt
rename to docs/interop/parallels.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/parallels.txt
+++ b/docs/interop/parallels.rst
@@ -XXX,XX +XXX,XX @@
-= License =
+Parallels Expandable Image File Format
+======================================
 
-Copyright (c) 2015 Denis Lunev
-Copyright (c) 2015 Vladimir Sementsov-Ogievskiy
+..
+   Copyright (c) 2015 Denis Lunev
+   Copyright (c) 2015 Vladimir Sementsov-Ogievskiy
 
-This work is licensed under the terms of the GNU GPL, version 2 or later.
-See the COPYING file in the top-level directory.
+   This work is licensed under the terms of the GNU GPL, version 2 or later.
+   See the COPYING file in the top-level directory.
 
-= Parallels Expandable Image File Format =
 
 A Parallels expandable image file consists of three consecutive parts:
-    * header
-    * BAT
-    * data area
+
+* header
+* BAT
+* data area
 
 All numbers in a Parallels expandable image are stored in little-endian byte
 order.
 
 
-== Definitions ==
+Definitions
+-----------
 
-    Sector    A 512-byte data chunk.
+Sector
+  A 512-byte data chunk.
 
-    Cluster   A data chunk of the size specified in the image header.
-              Currently, the default size is 1MiB (2048 sectors). In previous
-              versions, cluster sizes of 63 sectors, 256 and 252 kilobytes were
-              used.
+Cluster
+  A data chunk of the size specified in the image header.
+  Currently, the default size is 1MiB (2048 sectors). In previous
+  versions, cluster sizes of 63 sectors, 256 and 252 kilobytes were used.
 
-    BAT       Block Allocation Table, an entity that contains information for
-              guest-to-host I/O data address translation.
+BAT
+  Block Allocation Table, an entity that contains information for
+  guest-to-host I/O data address translation.
 
-
-== Header ==
+Header
+------
 
 The header is placed at the start of an image and contains the following
-fields:
+fields::
 
-Bytes:
+ Bytes:
    0 - 15:    magic
               Must contain "WithoutFreeSpace" or "WithouFreSpacExt".
 
@@ -XXX,XX +XXX,XX @@ Bytes:
               ext_off must meet the same requirements as cluster offsets
               defined by BAT entries (see below).
 
-
-== BAT ==
+BAT
+---
 
 BAT is placed immediately after the image header. In the file, BAT is a
 contiguous array of 32-bit unsigned little-endian integers with
-(bat_entries * 4) bytes size.
+``(bat_entries * 4)`` bytes size.
 
 Each BAT entry contains an offset from the start of the file to the
-corresponding cluster. The offset set in clusters for "WithouFreSpacExt" images
-and in sectors for "WithoutFreeSpace" images.
+corresponding cluster. The offset set in clusters for ``WithouFreSpacExt``
+images and in sectors for ``WithoutFreeSpace`` images.
 
 If a BAT entry is zero, the corresponding cluster is not allocated and should
 be considered as filled with zeroes.
 
 Cluster offsets specified by BAT entries must meet the following requirements:
-    - the value must not be lower than data offset (provided by header.data_off
-      or calculated as specified above),
-    - the value must be lower than the desired file size,
-    - the value must be unique among all BAT entries,
-    - the result of (cluster offset - data offset) must be aligned to cluster
-      size.
 
+- the value must not be lower than data offset (provided by ``header.data_off``
+  or calculated as specified above)
+- the value must be lower than the desired file size
+- the value must be unique among all BAT entries
+- the result of ``(cluster offset - data offset)`` must be aligned to
+  cluster size
 
-== Data Area ==
+Data Area
+---------
 
-The data area is an area from the data offset (provided by header.data_off or
-calculated as specified above) to the end of the file. It represents a
+The data area is an area from the data offset (provided by ``header.data_off``
+or calculated as specified above) to the end of the file. It represents a
 contiguous array of clusters. Most of them are allocated by the BAT, some may
-be allocated by the ext_off field in the header while other may be allocated by
-extensions. All clusters allocated by ext_off and extensions should meet the
-same requirements as clusters specified by BAT entries.
+be allocated by the ``ext_off`` field in the header while other may be
+allocated by extensions. All clusters allocated by ``ext_off`` and extensions
+should meet the same requirements as clusters specified by BAT entries.
 
 
-== Format Extension ==
+Format Extension
+----------------
 
 The Format Extension is an area 1 cluster in size that provides additional
 format features. This cluster is addressed by the ext_off field in the header.
-The format of the Format Extension area is the following:
+The format of the Format Extension area is the following::
 
    0 -  7:    magic
               Must be 0xAB234CEF23DCEA87
@@ -XXX,XX +XXX,XX @@ The format of the Format Extension area is the following:
               The MD5 checksum of the entire Header Extension cluster except
               the first 24 bytes.
 
-    The above are followed by feature sections or "extensions". The last
-    extension must be "End of features" (see below).
+The above are followed by feature sections or "extensions". The last
+extension must be "End of features" (see below).
 
-Each feature section has the following format:
+Each feature section has the following format::
 
    0 -  7:    magic
               The identifier of the feature:
@@ -XXX,XX +XXX,XX @@ Each feature section has the following format:
 
   variable:   data (data_size bytes)
 
-    The above is followed by padding to the next 8 bytes boundary, then the
-    next extension starts.
+The above is followed by padding to the next 8 bytes boundary, then the
+next extension starts.
 
-    The last extension must be "End of features" with all the fields set to 0.
+The last extension must be "End of features" with all the fields set to 0.
 
 
-=== Dirty bitmaps feature ===
+Dirty bitmaps feature
+---------------------
 
 This feature provides a way of storing dirty bitmaps in the image. The fields
-of its data area are:
+of its data area are::
 
    0 -  7:    size
               The bitmap size, should be equal to disk size in sectors.
@@ -XXX,XX +XXX,XX @@ clusters inside the Parallels image file. The offsets of these clusters are
 saved in the L1 offset table specified by the feature extension. Each L1 table
 entry is a 64 bit integer as described below:
 
-Given an offset in bytes into the bitmap data, corresponding L1 entry is
+Given an offset in bytes into the bitmap data, corresponding L1 entry is::
 
     l1_table[offset / cluster_size]
 
@@ -XXX,XX +XXX,XX @@ are assumed to be 1.
 
 If an L1 table entry is not 0 or 1, it contains the corresponding cluster
 offset (in 512b sectors). Given an offset in bytes into the bitmap data the
-offset in bytes into the image file can be obtained as follows:
+offset in bytes into the image file can be obtained as follows::
 
     offset = l1_table[offset / cluster_size] * 512 + (offset % cluster_size)
-- 
2.34.1

Convert prl-xml.txt to rST format.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20240801170131.3977807-5-peter.maydell@linaro.org
---
 MAINTAINERS              |   1 +
 docs/interop/index.rst   |   1 +
 docs/interop/prl-xml.rst | 187 +++++++++++++++++++++++++++++++++++++++
 docs/interop/prl-xml.txt | 158 ---------------------------------
 4 files changed, 189 insertions(+), 158 deletions(-)
 create mode 100644 docs/interop/prl-xml.rst
 delete mode 100644 docs/interop/prl-xml.txt

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Supported
 F: block/parallels.c
 F: block/parallels-ext.c
 F: docs/interop/parallels.rst
+F: docs/interop/prl-xml.rst
 T: git https://src.openvz.org/scm/~den/qemu.git parallels
 
 qed
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ are useful for making QEMU interoperate with other software.
    live-block-operations
    nbd
    parallels
+   prl-xml
    pr-helper
    qmp-spec
    qemu-ga
diff --git a/docs/interop/prl-xml.rst b/docs/interop/prl-xml.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/prl-xml.rst
@@ -XXX,XX +XXX,XX @@
+Parallels Disk Format
+=====================
+
+..
+   Copyright (c) 2015-2017, Virtuozzo, Inc.
+   Authors:
+        2015 Denis Lunev <den@openvz.org>
+        2015 Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+        2016-2017 Klim Kireev <klim.kireev@virtuozzo.com>
+        2016-2017 Edgar Kaziakhmedov <edgar.kaziakhmedov@virtuozzo.com>
+
+   This work is licensed under the terms of the GNU GPL, version 2 or later.
+   See the COPYING file in the top-level directory.
+
+This specification contains minimal information about Parallels Disk Format,
+which is enough to proper work with QEMU. Nevertheless, Parallels Cloud Server
+and Parallels Desktop are able to add some unspecified nodes to xml and use
+them, but they are for internal work and don't affect functionality. Also it
+uses auxiliary xml ``Snapshot.xml``, which allows to store optional snapshot
+information, but it doesn't influence open/read/write functionality. QEMU and
+other software should not use fields not covered in this document and
+``Snapshot.xml`` file and must leave them as is.
+
+Parallels disk consists of two parts: the set of snapshots and the disk
+descriptor file, which stores information about all files and snapshots.
+
+Definitions
+-----------
+
+Snapshot
+  a record of the contents captured at a particular time, capable
+  of storing current state. A snapshot has UUID and parent UUID.
+
+Snapshot image
+  an overlay representing the difference between this
+  snapshot and some earlier snapshot.
+
+Overlay
+  an image storing the different sectors between two captured states.
+
+Root image
+  snapshot image with no parent, the root of snapshot tree.
+
+Storage
+  the backing storage for a subset of the virtual disk. When
+  there is more than one storage in a Parallels disk then that
+  is referred to as a split image. In this case every storage
+  covers specific address space area of the disk and has its
+  particular root image. Split images are not considered here
+  and are not supported. Each storage consists of disk
+  parameters and a list of images. The list of images always
+  contains a root image and may also contain overlays. The
+  root image can be an expandable Parallels image file or
+  plain. Overlays must be expandable.
+
+Description file
+  ``DiskDescriptor.xml`` stores information about disk parameters,
+  snapshots, storages.
+
+Top Snapshot
+  The overlay between actual state and some previous snapshot.
+  It is not a snapshot in the classical sense because it
+  serves as the active image that the guest writes to.
+
+Sector
+  a 512-byte data chunk.
+
+Description file
+----------------
+
+All information is placed in a single XML element
+``Parallels_disk_image``.
+The element has only one attribute ``Version``, that must be ``1.0``.
+
+Schema of ``DiskDescriptor.xml``::
+
+ <Parallels_disk_image Version="1.0">
+    <Disk_Parameters>
+        ...
+    </Disk_Parameters>
+    <StorageData>
+        ...
+    </StorageData>
+    <Snapshots>
+        ...
+    </Snapshots>
+ </Parallels_disk_image>
+
+``Disk_Parameters`` element
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The ``Disk_Parameters`` element describes the physical layout of the
+virtual disk and some general settings.
+
+The ``Disk_Parameters`` element MUST contain the following child elements:
+
+* ``Disk_size`` - number of sectors in the disk,
+  desired size of the disk.
+* ``Cylinders`` - number of the disk cylinders.
+* ``Heads``     - number of the disk heads.
+* ``Sectors``   - number of the disk sectors per cylinder
+  (sector size is 512 bytes)
+  Limitation: Product of the ``Heads``, ``Sectors`` and ``Cylinders``
+  values MUST be equal to the value of the Disk_size parameter.
+* ``Padding``   - must be 0. Parallels Cloud Server and Parallels Desktop may
+  use padding set to 1, however this case is not covered
+  by this spec, QEMU and other software should not open
+  such disks and should not create them.
+
+``StorageData`` element
+^^^^^^^^^^^^^^^^^^^^^^^
+
+This element of the file describes the root image and all snapshot images.
+
+The ``StorageData`` element consists of the ``Storage`` child element,
+as shown below::
+
+ <StorageData>
+    <Storage>
+        ...
+    </Storage>
+ </StorageData>
+
+A ``Storage`` element has following child elements:
+
+* ``Start``     - start sector of the storage, in case of non split storage
+  equals to 0.
+* ``End``       - number of sector following the last sector, in case of non
+  split storage equals to ``Disk_size``.
+* ``Blocksize`` - storage cluster size, number of sectors per one cluster.
+  Cluster size for each "Compressed" (see below) image in
+  parallels disk must be equal to this field. Note: cluster
+  size for Parallels Expandable Image is in ``tracks`` field of
+  its header (see :doc:`parallels`).
+* Several ``Image`` child elements.
+
+Each ``Image`` element has following child elements:
+
+* ``GUID`` - image identifier, UUID in curly brackets.
+  For instance, ``{12345678-9abc-def1-2345-6789abcdef12}.``
+  The GUID is used by the Snapshots element to reference images
+  (see below)
+* ``Type`` - image type of the element. It can be:
+
+  * ``Plain`` for raw files.
+  * ``Compressed`` for expanding disks.
+
+* ``File`` - path to image file. Path can be relative to
+  ``DiskDescriptor.xml`` or absolute.
+
+``Snapshots`` element
+^^^^^^^^^^^^^^^^^^^^^
+
+The ``Snapshots`` element describes the snapshot relations with the snapshot tree.
+
+The element contains the set of ``Shot`` child elements, as shown below::
+
+ <Snapshots>
+    <TopGUID> ... </TopGUID> /* Optional child element */
+    <Shot>
+        ...
+    </Shot>
+    <Shot>
+        ...
+    </Shot>
+    ...
+ </Snapshots>
+
+Each ``Shot`` element contains the following child elements:
+
+* ``GUID``       - an image GUID.
+* ``ParentGUID`` - GUID of the image of the parent snapshot.
+
+The software may traverse snapshots from child to parent using ``<ParentGUID>``
+field as reference. ``ParentGUID`` of root snapshot is
+``{00000000-0000-0000-0000-000000000000}``. There should be only one root
+snapshot. Top snapshot could be described via two ways: via ``TopGUID`` child
+element of the ``Snapshots`` element or via predefined GUID
+``{5fbaabe3-6958-40ff-92a7-860e329aab41}``. If ``TopGUID`` is defined,
+predefined GUID is interpreted as usual GUID. All snapshot images
+(except Top Snapshot) should be
+opened read-only. There is another predefined GUID,
+``BackupID = {704718e1-2314-44c8-9087-d78ed36b0f4e}``, which is used by
+original and some third-party software for backup, QEMU and other
+software may operate with images with ``GUID = BackupID`` as usual,
+however, it is not recommended to use this
+GUID for new disks. Top snapshot cannot have this GUID.
diff --git a/docs/interop/prl-xml.txt b/docs/interop/prl-xml.txt
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/interop/prl-xml.txt
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-= License =
-
-Copyright (c) 2015-2017, Virtuozzo, Inc.
-Authors:
-        2015 Denis Lunev <den@openvz.org>
-        2015 Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-        2016-2017 Klim Kireev <klim.kireev@virtuozzo.com>
-        2016-2017 Edgar Kaziakhmedov <edgar.kaziakhmedov@virtuozzo.com>
-
-This work is licensed under the terms of the GNU GPL, version 2 or later.
-See the COPYING file in the top-level directory.
-
-This specification contains minimal information about Parallels Disk Format,
-which is enough to proper work with QEMU. Nevertheless, Parallels Cloud Server
-and Parallels Desktop are able to add some unspecified nodes to xml and use
-them, but they are for internal work and don't affect functionality. Also it
-uses auxiliary xml "Snapshot.xml", which allows to store optional snapshot
-information, but it doesn't influence open/read/write functionality. QEMU and
-other software should not use fields not covered in this document and
-Snapshot.xml file and must leave them as is.
-
-= Parallels Disk Format =
-
-Parallels disk consists of two parts: the set of snapshots and the disk
-descriptor file, which stores information about all files and snapshots.
-
-== Definitions ==
-    Snapshot       a record of the contents captured at a particular time,
-                   capable of storing current state. A snapshot has UUID and
-                   parent UUID.
-
- Snapshot image    an overlay representing the difference between this
-                   snapshot and some earlier snapshot.
-
-    Overlay        an image storing the different sectors between two captured
-                   states.
-
-   Root image      snapshot image with no parent, the root of snapshot tree.
-
-    Storage        the backing storage for a subset of the virtual disk. When
-                   there is more than one storage in a Parallels disk then that
-                   is referred to as a split image. In this case every storage
-                   covers specific address space area of the disk and has its
-                   particular root image. Split images are not considered here
-                   and are not supported. Each storage consists of disk
-                   parameters and a list of images. The list of images always
-                   contains a root image and may also contain overlays. The
-                   root image can be an expandable Parallels image file or
-                   plain. Overlays must be expandable.
-
-  Description      DiskDescriptor.xml stores information about disk parameters,
-     file          snapshots, storages.
-
-     Top           The overlay between actual state and some previous snapshot.
-   Snapshot        It is not a snapshot in the classical sense because it
-                   serves as the active image that the guest writes to.
-
-    Sector         a 512-byte data chunk.
-
-== Description file ==
-All information is placed in a single XML element Parallels_disk_image.
-The element has only one attribute "Version", that must be 1.0.
-Schema of DiskDescriptor.xml:
-
-<Parallels_disk_image Version="1.0">
-    <Disk_Parameters>
-        ...
-    </Disk_Parameters>
-    <StorageData>
-        ...
-    </StorageData>
-    <Snapshots>
-        ...
-    </Snapshots>
-</Parallels_disk_image>
-
-== Disk_Parameters element ==
-The Disk_Parameters element describes the physical layout of the virtual disk
-and some general settings.
-
-The Disk_Parameters element MUST contain the following child elements:
-    * Disk_size - number of sectors in the disk,
-                  desired size of the disk.
-    * Cylinders - number of the disk cylinders.
-    * Heads     - number of the disk heads.
-    * Sectors   - number of the disk sectors per cylinder
-                  (sector size is 512 bytes)
-                  Limitation: Product of the Heads, Sectors and Cylinders
-                  values MUST be equal to the value of the Disk_size parameter.
-    * Padding   - must be 0. Parallels Cloud Server and Parallels Desktop may
-                  use padding set to 1, however this case is not covered
-                  by this spec, QEMU and other software should not open
-                  such disks and should not create them.
-
-== StorageData element ==
-This element of the file describes the root image and all snapshot images.
-
-The StorageData element consists of the Storage child element, as shown below:
-<StorageData>
-    <Storage>
-        ...
-    </Storage>
-</StorageData>
-
-A Storage element has following child elements:
-    * Start     - start sector of the storage, in case of non split storage
-                  equals to 0.
-    * End       - number of sector following the last sector, in case of non
-                  split storage equals to Disk_size.
-    * Blocksize - storage cluster size, number of sectors per one cluster.
-                  Cluster size for each "Compressed" (see below) image in
-                  parallels disk must be equal to this field. Note: cluster
-                  size for Parallels Expandable Image is in 'tracks' field of
-                  its header (see docs/interop/parallels.txt).
-    * Several Image child elements.
-
-Each Image element has following child elements:
-    * GUID - image identifier, UUID in curly brackets.
-             For instance, {12345678-9abc-def1-2345-6789abcdef12}.
-             The GUID is used by the Snapshots element to reference images
-             (see below)
-    * Type - image type of the element. It can be:
-             "Plain" for raw files.
-             "Compressed" for expanding disks.
-    * File - path to image file. Path can be relative to DiskDescriptor.xml or
-             absolute.
-
-== Snapshots element ==
-The Snapshots element describes the snapshot relations with the snapshot tree.
-
-The element contains the set of Shot child elements, as shown below:
-<Snapshots>
-    <TopGUID> ... </TopGUID> /* Optional child element */
-    <Shot>
-        ...
-    </Shot>
-    <Shot>
-        ...
-    </Shot>
-    ...
-</Snapshots>
-
-Each Shot element contains the following child elements:
-    * GUID       - an image GUID.
-    * ParentGUID - GUID of the image of the parent snapshot.
-
-The software may traverse snapshots from child to parent using <ParentGUID>
-field as reference. ParentGUID of root snapshot is
-{00000000-0000-0000-0000-000000000000}. There should be only one root
-snapshot. Top snapshot could be described via two ways: via TopGUID child
-element of the Snapshots element or via predefined GUID
-{5fbaabe3-6958-40ff-92a7-860e329aab41}. If TopGUID is defined, predefined GUID is
-interpreted as usual GUID. All snapshot images (except Top Snapshot) should be
-opened read-only. There is another predefined GUID,
-BackupID = {704718e1-2314-44c8-9087-d78ed36b0f4e}, which is used by original and
-some third-party software for backup, QEMU and other software may operate with
-images with GUID = BackupID as usual, however, it is not recommended to use this
-GUID for new disks. Top snapshot cannot have this GUID.
-- 
2.34.1

Fix some minor grammar nits in the prl-xml documentation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20240801170131.3977807-6-peter.maydell@linaro.org
---
 docs/interop/prl-xml.rst | 73 +++++++++++++++++++++-------------------
 1 file changed, 39 insertions(+), 34 deletions(-)

diff --git a/docs/interop/prl-xml.rst b/docs/interop/prl-xml.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/prl-xml.rst
+++ b/docs/interop/prl-xml.rst
@@ -XXX,XX +XXX,XX @@ Parallels Disk Format
    See the COPYING file in the top-level directory.
 
 This specification contains minimal information about Parallels Disk Format,
-which is enough to proper work with QEMU. Nevertheless, Parallels Cloud Server
-and Parallels Desktop are able to add some unspecified nodes to xml and use
+which is enough to properly work with QEMU. Nevertheless, Parallels Cloud Server
+and Parallels Desktop are able to add some unspecified nodes to the xml and use
 them, but they are for internal work and don't affect functionality. Also it
-uses auxiliary xml ``Snapshot.xml``, which allows to store optional snapshot
-information, but it doesn't influence open/read/write functionality. QEMU and
-other software should not use fields not covered in this document and
-``Snapshot.xml`` file and must leave them as is.
+uses auxiliary xml ``Snapshot.xml``, which allows storage of optional snapshot
+information, but this doesn't influence open/read/write functionality. QEMU and
+other software should not use fields not covered in this document or the
+``Snapshot.xml`` file, and must leave them as is.
 
-Parallels disk consists of two parts: the set of snapshots and the disk
+A Parallels disk consists of two parts: the set of snapshots and the disk
 descriptor file, which stores information about all files and snapshots.
 
 Definitions
@@ -XXX,XX +XXX,XX @@ Definitions
 
 Snapshot
   a record of the contents captured at a particular time, capable
-  of storing current state. A snapshot has UUID and parent UUID.
+  of storing current state. A snapshot has a UUID and a parent UUID.
 
 Snapshot image
   an overlay representing the difference between this
@@ -XXX,XX +XXX,XX @@ Overlay
   an image storing the different sectors between two captured states.
 
 Root image
-  snapshot image with no parent, the root of snapshot tree.
+  a snapshot image with no parent, the root of the snapshot tree.
 
 Storage
   the backing storage for a subset of the virtual disk. When
   there is more than one storage in a Parallels disk then that
   is referred to as a split image. In this case every storage
-  covers specific address space area of the disk and has its
+  covers a specific address space area of the disk and has its
   particular root image. Split images are not considered here
   and are not supported. Each storage consists of disk
   parameters and a list of images. The list of images always
@@ -XXX,XX +XXX,XX @@ Storage
 
 Description file
   ``DiskDescriptor.xml`` stores information about disk parameters,
-  snapshots, storages.
+  snapshots, and storages.
 
 Top Snapshot
   The overlay between actual state and some previous snapshot.
@@ -XXX,XX +XXX,XX @@ Description file
 
 All information is placed in a single XML element
 ``Parallels_disk_image``.
-The element has only one attribute ``Version``, that must be ``1.0``.
+The element has only one attribute, ``Version``, which must be ``1.0``.
 
-Schema of ``DiskDescriptor.xml``::
+The schema of ``DiskDescriptor.xml``::
 
  <Parallels_disk_image Version="1.0">
     <Disk_Parameters>
@@ -XXX,XX +XXX,XX @@ The ``Disk_Parameters`` element MUST contain the following child elements:
 * ``Heads``     - number of the disk heads.
 * ``Sectors``   - number of the disk sectors per cylinder
   (sector size is 512 bytes)
-  Limitation: Product of the ``Heads``, ``Sectors`` and ``Cylinders``
+  Limitation: The product of the ``Heads``, ``Sectors`` and ``Cylinders``
   values MUST be equal to the value of the Disk_size parameter.
 * ``Padding``   - must be 0. Parallels Cloud Server and Parallels Desktop may
-  use padding set to 1, however this case is not covered
-  by this spec, QEMU and other software should not open
+  use padding set to 1; however this case is not covered
+  by this specification. QEMU and other software should not open
   such disks and should not create them.
 
 ``StorageData`` element
@@ -XXX,XX +XXX,XX @@ as shown below::
     </Storage>
  </StorageData>
 
-A ``Storage`` element has following child elements:
+A ``Storage`` element has the following child elements:
 
 * ``Start``     - start sector of the storage, in case of non split storage
   equals to 0.
 * ``End``       - number of sector following the last sector, in case of non
   split storage equals to ``Disk_size``.
 * ``Blocksize`` - storage cluster size, number of sectors per one cluster.
-  Cluster size for each "Compressed" (see below) image in
-  parallels disk must be equal to this field. Note: cluster
-  size for Parallels Expandable Image is in ``tracks`` field of
+  The cluster size for each "Compressed" (see below) image in
+  a parallels disk must be equal to this field. Note: the cluster
+  size for a Parallels Expandable Image is in the ``tracks`` field of
   its header (see :doc:`parallels`).
 * Several ``Image`` child elements.
 
-Each ``Image`` element has following child elements:
+Each ``Image`` element has the following child elements:
 
 * ``GUID`` - image identifier, UUID in curly brackets.
   For instance, ``{12345678-9abc-def1-2345-6789abcdef12}.``
@@ -XXX,XX +XXX,XX @@ Each ``Image`` element has following child elements:
   * ``Plain`` for raw files.
   * ``Compressed`` for expanding disks.
 
-* ``File`` - path to image file. Path can be relative to
+* ``File`` - path to image file. The path can be relative to
   ``DiskDescriptor.xml`` or absolute.
 
 ``Snapshots`` element
@@ -XXX,XX +XXX,XX @@ Each ``Shot`` element contains the following child elements:
 * ``GUID``       - an image GUID.
 * ``ParentGUID`` - GUID of the image of the parent snapshot.
 
-The software may traverse snapshots from child to parent using ``<ParentGUID>``
-field as reference. ``ParentGUID`` of root snapshot is
-``{00000000-0000-0000-0000-000000000000}``. There should be only one root
-snapshot. Top snapshot could be described via two ways: via ``TopGUID`` child
-element of the ``Snapshots`` element or via predefined GUID
+The software may traverse snapshots from child to parent using the
+``<ParentGUID>`` field as reference. The ``ParentGUID`` of the root
+snapshot is ``{00000000-0000-0000-0000-000000000000}``.
+There should be only one root snapshot.
+
+The Top snapshot could be
+described via two ways: via the ``TopGUID`` child
+element of the ``Snapshots`` element, or via the predefined GUID
 ``{5fbaabe3-6958-40ff-92a7-860e329aab41}``. If ``TopGUID`` is defined,
-predefined GUID is interpreted as usual GUID. All snapshot images
-(except Top Snapshot) should be
-opened read-only. There is another predefined GUID,
+the predefined GUID is interpreted as a normal GUID. All snapshot images
+(except the Top Snapshot) should be
+opened read-only.
+
+There is another predefined GUID,
 ``BackupID = {704718e1-2314-44c8-9087-d78ed36b0f4e}``, which is used by
-original and some third-party software for backup, QEMU and other
-software may operate with images with ``GUID = BackupID`` as usual,
-however, it is not recommended to use this
-GUID for new disks. Top snapshot cannot have this GUID.
+original and some third-party software for backup. QEMU and other
+software may operate with images with ``GUID = BackupID`` as usual.
+However, it is not recommended to use this
+GUID for new disks. The Top snapshot cannot have this GUID.
-- 
2.34.1

From: Eric Blake <eblake@redhat.com>

Add in the missing space in the section header.

Fixes: 1084159b31 ("qapi: deprecate drive-backup", v6.2.0)
Signed-off-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/interop/live-block-operations.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/interop/live-block-operations.rst b/docs/interop/live-block-operations.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/live-block-operations.rst
+++ b/docs/interop/live-block-operations.rst
@@ -XXX,XX +XXX,XX @@ Shutdown the guest, by issuing the ``quit`` QMP command::
     }
 
 
-Live disk backup --- ``blockdev-backup`` and the deprecated``drive-backup``
----------------------------------------------------------------------------
+Live disk backup --- ``blockdev-backup`` and the deprecated ``drive-backup``
+----------------------------------------------------------------------------
 
 The ``blockdev-backup`` (and the deprecated ``drive-backup``) allows
 you to create a point-in-time snapshot.
-- 
2.34.1

From: Alex Richardson <alexrichardson@google.com>

In the PMUv3, a new AArch32 64-bit (MCRR/MRRC) accessor for the
PMCCNTR was added. In QEMU we forgot to implement this, so only
provide the 32-bit accessor. Since we have a 64-bit PMCCNTR
sysreg for AArch64, adding the 64-bit AArch32 version is easy.

We add the PMCCNTR to the v8_cp_reginfo because PMUv3 was added
in the ARMv8 architecture. This is consistent with how we
handle the existing PMCCNTR support, where we always implement
it for all v7 CPUs. This is arguably something we should
clean up so it is gated on ARM_FEATURE_PMU and/or an ID
register check for the relevant PMU version, but we should
do that as its own tidyup rather than being inconsistent between
this PMCCNTR accessor and the others.

See https://developer.arm.com/documentation/ddi0601/2024-06/AArch32-Registers/PMCCNTR--Performance-Monitors-Cycle-Count-Register?lang=en

Signed-off-by: Alex Richardson <alexrichardson@google.com>
Message-id: 20240801220328.941866-1-alexrichardson@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
       .writefn = sdcr_write,
       .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
+    { .name = "PMCCNTR", .state = ARM_CP_STATE_AA32,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_64BIT,
+      .cp = 15, .crm = 9, .opc1 = 0,
+      .access = PL0_RW, .resetvalue = 0, .fgt = FGT_PMCCNTR_EL0,
+      .readfn = pmccntr_read, .writefn = pmccntr_write,
+      .accessfn = pmreg_access_ccntr },
 };
 
 /* These are present only when EL1 supports AArch32 */
-- 
2.34.1

From: Jianzhou Yue <JianZhou.Yue@verisilicon.com>

The real period is zero when both period and period_frac are zero.
Check the method ptimer_set_freq, if freq is larger than 1000 MHz,
the period is zero, but the period_frac is not, in this case, the
ptimer will work but the current code incorrectly recognizes that
the ptimer is disabled.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2306
Signed-off-by: JianZhou Yue <JianZhou.Yue@verisilicon.com>
Message-id: 3DA024AEA8B57545AF1B3CAA37077D0FB75E82C8@SHASXM03.verisilicon.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/core/ptimer.c         |  4 ++--
 tests/unit/ptimer-test.c | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@ static void ptimer_reload(ptimer_state *s, int delta_adjust)
         delta = s->delta = s->limit;
     }
 
-    if (s->period == 0) {
+    if (s->period == 0 && s->period_frac == 0) {
         if (!qtest_enabled()) {
             fprintf(stderr, "Timer with period zero, disabling\n");
         }
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
 
     assert(s->in_transaction);
 
-    if (was_disabled && s->period == 0) {
+    if (was_disabled && s->period == 0 && s->period_frac == 0) {
         if (!qtest_enabled()) {
             fprintf(stderr, "Timer with period zero, disabling\n");
         }
diff --git a/tests/unit/ptimer-test.c b/tests/unit/ptimer-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/ptimer-test.c
+++ b/tests/unit/ptimer-test.c
@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
     ptimer_free(ptimer);
 }
 
+static void check_freq_more_than_1000M(gconstpointer arg)
+{
+    const uint8_t *policy = arg;
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
+    bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
+
+    triggered = false;
+
+    ptimer_transaction_begin(ptimer);
+    ptimer_set_freq(ptimer, 2000000000);
+    ptimer_set_limit(ptimer, 8, 1);
+    ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
+
+    qemu_clock_step(3);
+
+    g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 3 : 2);
+    g_assert_false(triggered);
+
+    qemu_clock_step(1);
+
+    g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
+    g_assert_true(triggered);
+
+    ptimer_free(ptimer);
+}
+
 static void add_ptimer_tests(uint8_t policy)
 {
     char policy_name[256] = "";
@@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy)
                               policy_name),
         g_memdup2(&policy, 1), check_oneshot_with_load_0, g_free);
     g_free(tmp);
+
+    g_test_add_data_func_full(
+        tmp = g_strdup_printf("/ptimer/freq_more_than_1000M policy=%s",
+                              policy_name),
+        g_memdup2(&policy, 1), check_freq_more_than_1000M, g_free);
+    g_free(tmp);
 }
 
 static void add_all_ptimer_policies_comb_tests(void)
-- 
2.34.1

From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Having magic numbers inside the code is not a good idea, as it
is error-prone. So, instead, create a macro with the number
definition.

Link: https://lore.kernel.org/qemu-devel/CAFEAcA-PYnZ-32MRX+PgvzhnoAV80zBKMYg61j2f=oHaGfwSsg@mail.gmail.com/

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: ef0e7f5fca6cd94eda415ecee670c3028c671b74.1723121692.git.mchehab+huawei@kernel.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h    | 3 +++
 hw/arm/virt-acpi-build.c | 6 +++---
 hw/arm/virt.c            | 7 ++++---
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 /* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
 #define PVTIME_SIZE_PER_CPU 64
 
+/* GPIO pins */
+#define GPIO_PIN_POWER_BUTTON  3
+
 enum {
     VIRT_FLASH,
     VIRT_MEM,
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ static void acpi_dsdt_add_gpio(Aml *scope, const MemMapEntry *gpio_memmap,
     aml_append(dev, aml_name_decl("_CRS", crs));
 
     Aml *aei = aml_resource_template();
-    /* Pin 3 for power button */
-    const uint32_t pin_list[1] = {3};
+
+    const uint32_t pin = GPIO_PIN_POWER_BUTTON;
     aml_append(aei, aml_gpio_int(AML_CONSUMER, AML_EDGE, AML_ACTIVE_HIGH,
-                                 AML_EXCLUSIVE, AML_PULL_UP, 0, pin_list, 1,
+                                 AML_EXCLUSIVE, AML_PULL_UP, 0, &pin, 1,
                                  "GPO0", NULL, 0));
     aml_append(dev, aml_name_decl("_AEI", aei));
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_powerdown_req(Notifier *n, void *opaque)
     if (s->acpi_dev) {
         acpi_send_event(s->acpi_dev, ACPI_POWER_DOWN_STATUS);
     } else {
-        /* use gpio Pin 3 for power button event */
+        /* use gpio Pin for power button event */
         qemu_set_irq(qdev_get_gpio_in(gpio_key_dev, 0), 1);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(char *fdt, DeviceState *pl061_dev,
                              uint32_t phandle)
 {
     gpio_key_dev = sysbus_create_simple("gpio-key", -1,
-                                        qdev_get_gpio_in(pl061_dev, 3));
+                                        qdev_get_gpio_in(pl061_dev,
+                                                         GPIO_PIN_POWER_BUTTON));
 
     qemu_fdt_add_subnode(fdt, "/gpio-keys");
     qemu_fdt_setprop_string(fdt, "/gpio-keys", "compatible", "gpio-keys");
@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(char *fdt, DeviceState *pl061_dev,
     qemu_fdt_setprop_cell(fdt, "/gpio-keys/poweroff", "linux,code",
                           KEY_POWER);
     qemu_fdt_setprop_cells(fdt, "/gpio-keys/poweroff",
-                           "gpios", phandle, 3, 0);
+                           "gpios", phandle, GPIO_PIN_POWER_BUTTON, 0);
 }
 
 #define SECURE_GPIO_POWEROFF 0
-- 
2.34.1

The following changes since commit 131c58469f6fb68c89b38fee6aba8bbb20c7f4bf:

rust: add --rust-target option for bindgen (2025-02-06 13:51:46 -0500)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250210

for you to fetch changes up to 27a8d899c7a100fd5aa040a8b993bb257687c393:

linux-user: Do not define struct sched_attr if libc headers do (2025-02-07 16:09:20 +0000)

----------------------------------------------------------------
target-arm queue:
 * Deprecate pxa2xx CPUs, iwMMXt emulation, -old-param option
 * Drop unused AArch64DecodeTable typedefs
 * Minor code cleanups
 * hw/net/cadence_gem:  Fix the mask/compare/disable-mask logic
 * linux-user: Do not define struct sched_attr if libc headers do

----------------------------------------------------------------
Andrew Yuan (1):
      hw/net/cadence_gem:  Fix the mask/compare/disable-mask logic

Khem Raj (1):
      linux-user: Do not define struct sched_attr if libc headers do

Peter Maydell (4):
      target/arm: deprecate the pxa2xx CPUs and iwMMXt emulation
      tests/tcg/arm: Remove test-arm-iwmmxt test
      target/arm: Drop unused AArch64DecodeTable typedefs
      qemu-options: Deprecate -old-param command line option

Philippe Mathieu-Daudé (6):
      hw/arm/boot: Propagate vCPU to arm_load_dtb()
      hw/arm/fsl-imx6: Add local 'mpcore/gic' variables
      hw/arm/fsl-imx6ul: Add local 'mpcore/gic' variables
      hw/arm/fsl-imx7: Add local 'mpcore/gic' variables
      hw/cpu/arm: Alias 'num-cpu' property on TYPE_REALVIEW_MPCORE
      hw/cpu/arm: Declare CPU QOM types using DEFINE_TYPES() macro

docs/about/deprecated.rst       | 34 ++++++++++++++++++++++
 include/hw/arm/boot.h           |  4 ++-
 target/arm/cpu.h                |  1 +
 hw/arm/boot.c                   | 11 +++----
 hw/arm/fsl-imx6.c               | 52 ++++++++++++++-------------------
 hw/arm/fsl-imx6ul.c             | 64 +++++++++++++++++------------------------
 hw/arm/fsl-imx7.c               | 52 +++++++++++++++------------------
 hw/arm/virt.c                   |  2 +-
 hw/cpu/a15mpcore.c              | 21 ++++++--------
 hw/cpu/a9mpcore.c               | 21 ++++++--------
 hw/cpu/arm11mpcore.c            | 21 ++++++--------
 hw/cpu/realview_mpcore.c        | 29 +++++++------------
 hw/net/cadence_gem.c            | 26 +++++++++++++----
 linux-user/syscall.c            |  4 ++-
 system/vl.c                     |  1 +
 target/arm/cpu.c                |  3 ++
 target/arm/tcg/cpu32.c          | 36 +++++++++++++++--------
 target/arm/tcg/translate-a64.c  | 11 -------
 tests/tcg/arm/Makefile.target   |  7 -----
 tests/tcg/arm/README            |  5 ----
 tests/tcg/arm/test-arm-iwmmxt.S | 49 -------------------------------
 21 files changed, 205 insertions(+), 249 deletions(-)
 delete mode 100644 tests/tcg/arm/test-arm-iwmmxt.S

The pxa2xx CPUs are now only useful with user-mode emulation, because
we dropped all the machine types that used them in 9.2.  (Technically
you could alse use "-cpu pxa270" with a board model like versatilepb
which doesn't sanity-check the CPU type, but that has never been a
supported config.)

To use them (or iwMMXt emulation) with QEMU user-mode you would need
to explicitly select them with the -cpu option or the QEMU_CPU
environment variable.  A google search finds no examples of anybody
doing this in the last decade; I don't believe the GCC folks are
using QEMU to test their iwMMXt codegen either.  In fact, GCC is in
the process of dropping support for iwMMXT entirely.

The iwMMXt emulation is thousands of lines of code in QEMU, and
is now the only bit of Arm insn decode which doesn't use decodetree.
We have no way to test or validate changes to it. This code is
just dead weight that is almost certainly not being used by anybody.
Mark it as deprecated.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250127112715.2936555-2-peter.maydell@linaro.org
---
 docs/about/deprecated.rst | 21 +++++++++++++++++++++
 target/arm/cpu.h          |  1 +
 target/arm/cpu.c          |  3 +++
 target/arm/tcg/cpu32.c    | 36 ++++++++++++++++++++++++------------
 4 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -XXX,XX +XXX,XX @@ is going to be so much slower it wouldn't make sense for any serious
 instrumentation. Due to implementation differences there will also be
 anomalies in things like memory instrumentation.
 
+linux-user mode CPUs
+--------------------
+
+iwMMXt emulation and the ``pxa`` CPUs (since 10.0)
+''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``pxa`` CPU family (``pxa250``, ``pxa255``, ``pxa260``,
+``pxa261``, ``pxa262``, ``pxa270-a0``, ``pxa270-a1``, ``pxa270``,
+``pxa270-b0``, ``pxa270-b1``, ``pxa270-c0``, ``pxa270-c5``) are no
+longer used in system emulation, because all the machine types which
+used these CPUs were removed in the QEMU 9.2 release. These CPUs can
+now only be used in linux-user mode, and to do that you would have to
+explicitly select one of these CPUs with the ``-cpu`` command line
+option or the ``QEMU_CPU`` environment variable.
+
+We don't believe that anybody is using the iwMMXt emulation, and we do
+not have any tests to validate it or any real hardware or similar
+known-good implementation to test against. GCC is in the process of
+dropping their support for iwMMXt codegen. These CPU types are
+therefore deprecated in QEMU, and will be removed in a future release.
+
 System emulator CPUs
 --------------------
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 
 typedef struct ARMCPUInfo {
     const char *name;
+    const char *deprecation_note;
     void (*initfn)(Object *obj);
     void (*class_init)(ObjectClass *oc, void *data);
 } ARMCPUInfo;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
 
     acc->info = data;
     cc->gdb_core_xml_file = "arm-core.xml";
+    if (acc->info->deprecation_note) {
+        cc->deprecation_note = acc->info->deprecation_note;
+    }
 }
 
 void arm_cpu_register(const ARMCPUInfo *info)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "ti925t",      .initfn = ti925t_initfn },
     { .name = "sa1100",      .initfn = sa1100_initfn },
     { .name = "sa1110",      .initfn = sa1110_initfn },
-    { .name = "pxa250",      .initfn = pxa250_initfn },
-    { .name = "pxa255",      .initfn = pxa255_initfn },
-    { .name = "pxa260",      .initfn = pxa260_initfn },
-    { .name = "pxa261",      .initfn = pxa261_initfn },
-    { .name = "pxa262",      .initfn = pxa262_initfn },
+    { .name = "pxa250",      .initfn = pxa250_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa255",      .initfn = pxa255_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa260",      .initfn = pxa260_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa261",      .initfn = pxa261_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa262",      .initfn = pxa262_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
     /* "pxa270" is an alias for "pxa270-a0" */
-    { .name = "pxa270",      .initfn = pxa270a0_initfn },
-    { .name = "pxa270-a0",   .initfn = pxa270a0_initfn },
-    { .name = "pxa270-a1",   .initfn = pxa270a1_initfn },
-    { .name = "pxa270-b0",   .initfn = pxa270b0_initfn },
-    { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
-    { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
-    { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
+    { .name = "pxa270",      .initfn = pxa270a0_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa270-a0",   .initfn = pxa270a0_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa270-a1",   .initfn = pxa270a1_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa270-b0",   .initfn = pxa270b0_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa270-b1",   .initfn = pxa270b1_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa270-c0",   .initfn = pxa270c0_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
+    { .name = "pxa270-c5",   .initfn = pxa270c5_initfn,
+      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 #ifndef TARGET_AARCH64
     { .name = "max",         .initfn = arm_max_initfn },
 #endif
-- 
2.34.1

The test-arm-iwmmmxt test isn't testing what it thinks it's testing.

If you run it with a CPU type that supports iwMMXt then it will crash
immediately with a SIGILL, because (even with -marm) GCC will link it
against startup code that is in Thumb mode, and no iwMMXt CPU has
Thumb:

00010338 <_start>:
   10338:       f04f 0b00       mov.w   fp, #0
   1033c:       f04f 0e00       mov.w   lr, #0

If you run it with a CPU type which does *not* support iwMMXt, which
is what 'make check-tcg' does, then QEMU will not try to handle the
insns as iwMMXt.  Instead the translator turns them into illegal
instructions.  Then in the linux-user cpu_loop() code we identify
them as FPA11 instructions inside emulate_arm_fpa11(), because the
FPA11 happened to use the same coprocessor number as these iwMMXt
insns.  So we execute a completely different set of FPA11 insns,
which means we don't crash, but we will print garbage to stdout.
Then the test binary always exits with a 0 return code, so 'make
check-tcg' thinks the test passes.

Modern gnueabihf toolchains assume in their startup code that the CPU
is not so old as to not support Thumb, so there's no way to get them
to generate a binary that actually does what the test wants.  Since
we're deprecating iwMMXt emulation anyway, it's not worth trying to
salvage the test case to get it to really test the iwMMXt insns.

Delete the test entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250127112715.2936555-3-peter.maydell@linaro.org
---
 tests/tcg/arm/Makefile.target   |  7 -----
 tests/tcg/arm/README            |  5 ----
 tests/tcg/arm/test-arm-iwmmxt.S | 49 ---------------------------------
 3 files changed, 61 deletions(-)
 delete mode 100644 tests/tcg/arm/test-arm-iwmmxt.S

diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/arm/Makefile.target
+++ b/tests/tcg/arm/Makefile.target
@@ -XXX,XX +XXX,XX @@ ARM_TESTS = hello-arm
 hello-arm: CFLAGS+=-marm -ffreestanding -fno-stack-protector
 hello-arm: LDFLAGS+=-nostdlib
 
-# IWMXT floating point extensions
-ARM_TESTS += test-arm-iwmmxt
-# Clang assembler does not support IWMXT, so use the external assembler.
-test-arm-iwmmxt: CFLAGS += -marm -march=iwmmxt -mabi=aapcs -mfpu=fpv4-sp-d16 $(CROSS_CC_HAS_FNIA)
-test-arm-iwmmxt: test-arm-iwmmxt.S
-	$(CC) $(CFLAGS) -Wa,--noexecstack $< -o $@ $(LDFLAGS)
-
 # Float-convert Tests
 ARM_TESTS += fcvt
 fcvt: LDFLAGS += -lm
diff --git a/tests/tcg/arm/README b/tests/tcg/arm/README
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/arm/README
+++ b/tests/tcg/arm/README
@@ -XXX,XX +XXX,XX @@ hello-arm
 ---------
 
 A very simple inline assembly, write syscall based hello world
-
-test-arm-iwmmxt
----------------
-
-A simple test case for older iwmmxt extended ARMs
diff --git a/tests/tcg/arm/test-arm-iwmmxt.S b/tests/tcg/arm/test-arm-iwmmxt.S
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/tests/tcg/arm/test-arm-iwmmxt.S
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-@ Checks whether iwMMXt is functional.
-.code	32
-.globl	main
-
-main:
-ldr	r0, =data0
-ldr	r1, =data1
-ldr	r2, =data2
-#ifndef FPA
-wldrd	wr0, [r0, #0]
-wldrd	wr1, [r0, #8]
-wldrd	wr2, [r1, #0]
-wldrd	wr3, [r1, #8]
-wsubb	wr2, wr2, wr0
-wsubb	wr3, wr3, wr1
-wldrd	wr0, [r2, #0]
-wldrd	wr1, [r2, #8]
-waddb	wr0, wr0, wr2
-waddb	wr1, wr1, wr3
-wstrd	wr0, [r2, #0]
-wstrd	wr1, [r2, #8]
-#else
-ldfe	f0, [r0, #0]
-ldfe	f1, [r0, #8]
-ldfe	f2, [r1, #0]
-ldfe	f3, [r1, #8]
-adfdp	f2, f2, f0
-adfdp	f3, f3, f1
-ldfe	f0, [r2, #0]
-ldfe	f1, [r2, #8]
-adfd	f0, f0, f2
-adfd	f1, f1, f3
-stfe	f0, [r2, #0]
-stfe	f1, [r2, #8]
-#endif
-mov	r0, #1
-mov	r1, r2
-mov	r2, #0x11
-swi	#0x900004
-mov	r0, #0
-swi	#0x900001
-
-.data
-data0:
-.string	"aaaabbbbccccdddd"
-data1:
-.string	"bbbbccccddddeeee"
-data2:
-.string	"hvLLWs\x1fsdrs9\x1fNJ-\n"
-- 
2.34.1

We removed the old table-based decoder in favour of decodetree, but
we left a couple of typedefs that are now unused; delete them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250128135046.4108775-1-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static int scale_by_log2_tag_granule(DisasContext *s, int x)
 #include "decode-sme-fa64.c.inc"
 #include "decode-a64.c.inc"
 
-/* Table based decoder typedefs - used when the relevant bits for decode
- * are too awkwardly scattered across the instruction (eg SIMD).
- */
-typedef void AArch64DecodeFn(DisasContext *s, uint32_t insn);
-
-typedef struct AArch64DecodeTable {
-    uint32_t pattern;
-    uint32_t mask;
-    AArch64DecodeFn *disas_fn;
-} AArch64DecodeTable;
-
 /* initialize TCG globals.  */
 void a64_translate_init(void)
 {
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

In heterogeneous setup the first vCPU might not be
the one expected, better pass it explicitly.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20250130112615.3219-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/boot.h |  4 +++-
 hw/arm/boot.c         | 11 ++++++-----
 hw/arm/virt.c         |  2 +-
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/include/hw/arm/boot.h b/include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/boot.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@ AddressSpace *arm_boot_address_space(ARMCPU *cpu,
  * @binfo:      struct describing the boot environment
  * @addr_limit: upper limit of the available memory area at @addr
  * @as:         address space to load image to
+ * @cpu:        ARM CPU object
  *
  * Load a device tree supplied by the machine or by the user  with the
  * '-dtb' command line option, and put it at offset @addr in target
@@ -XXX,XX +XXX,XX @@ AddressSpace *arm_boot_address_space(ARMCPU *cpu,
  * Note: Must not be called unless have_dtb(binfo) is true.
  */
 int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
-                 hwaddr addr_limit, AddressSpace *as, MachineState *ms);
+                 hwaddr addr_limit, AddressSpace *as, MachineState *ms,
+                 ARMCPU *cpu);
 
 /* Write a secure board setup routine with a dummy handler for SMCs */
 void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ out:
     return ret;
 }
 
-static void fdt_add_psci_node(void *fdt)
+static void fdt_add_psci_node(void *fdt, ARMCPU *armcpu)
 {
     uint32_t cpu_suspend_fn;
     uint32_t cpu_off_fn;
     uint32_t cpu_on_fn;
     uint32_t migrate_fn;
-    ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(0));
     const char *psci_method;
     int64_t psci_conduit;
     int rc;
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
 }
 
 int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
-                 hwaddr addr_limit, AddressSpace *as, MachineState *ms)
+                 hwaddr addr_limit, AddressSpace *as, MachineState *ms,
+                 ARMCPU *cpu)
 {
     void *fdt = NULL;
     int size, rc, n = 0;
@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
         }
     }
 
-    fdt_add_psci_node(fdt);
+    fdt_add_psci_node(fdt, cpu);
 
     if (binfo->modify_dtb) {
         binfo->modify_dtb(binfo, fdt);
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
      * decided whether to enable PSCI and set the psci-conduit CPU properties.
      */
     if (!info->skip_dtb_autoload && have_dtb(info)) {
-        if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as, ms) < 0) {
+        if (arm_load_dtb(info->dtb_start, info, info->dtb_limit,
+                         as, ms, cpu) < 0) {
             exit(1);
         }
     }
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ void virt_machine_done(Notifier *notifier, void *data)
                                        vms->memmap[VIRT_PLATFORM_BUS].size,
                                        vms->irqmap[VIRT_PLATFORM_BUS]);
     }
-    if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as, ms) < 0) {
+    if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as, ms, cpu) < 0) {
         exit(1);
     }
 
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The A9MPCore forward the IRQs from its internal GIC.
To make the code clearer, add the 'mpcore' and 'gic'
variables.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250130112615.3219-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6.c | 52 +++++++++++++++++++----------------------------
 1 file changed, 21 insertions(+), 31 deletions(-)

diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
     uint16_t i;
     qemu_irq irq;
     unsigned int smp_cpus = ms->smp.cpus;
+    DeviceState *mpcore = DEVICE(&s->a9mpcore);
+    DeviceState *gic;
 
     if (smp_cpus > FSL_IMX6_NUM_CPUS) {
         error_setg(errp, "%s: Only %d CPUs are supported (%d requested)",
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    object_property_set_int(OBJECT(&s->a9mpcore), "num-cpu", smp_cpus,
-                            &error_abort);
+    object_property_set_int(OBJECT(mpcore), "num-cpu", smp_cpus, &error_abort);
 
-    object_property_set_int(OBJECT(&s->a9mpcore), "num-irq",
+    object_property_set_int(OBJECT(mpcore), "num-irq",
                             FSL_IMX6_MAX_IRQ + GIC_INTERNAL, &error_abort);
 
-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->a9mpcore), errp)) {
+    if (!sysbus_realize(SYS_BUS_DEVICE(mpcore), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a9mpcore), 0, FSL_IMX6_A9MPCORE_ADDR);
+    sysbus_mmio_map(SYS_BUS_DEVICE(mpcore), 0, FSL_IMX6_A9MPCORE_ADDR);
 
+    gic = mpcore;
     for (i = 0; i < smp_cpus; i++) {
-        sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i,
+        sysbus_connect_irq(SYS_BUS_DEVICE(gic), i,
                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_IRQ));
-        sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i + smp_cpus,
+        sysbus_connect_irq(SYS_BUS_DEVICE(gic), i + smp_cpus,
                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_FIQ));
     }
 
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->uart[i]), 0, serial_table[i].addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            serial_table[i].irq));
+                           qdev_get_gpio_in(gic, serial_table[i].irq));
     }
 
     s->gpt.ccm = IMX_CCM(&s->ccm);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
 
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpt), 0, FSL_IMX6_GPT_ADDR);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpt), 0,
-                       qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                        FSL_IMX6_GPT_IRQ));
+                       qdev_get_gpio_in(gic, FSL_IMX6_GPT_IRQ));
 
     /* Initialize all EPIT timers */
     for (i = 0; i < FSL_IMX6_NUM_EPITS; i++) {
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->epit[i]), 0, epit_table[i].addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->epit[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            epit_table[i].irq));
+                           qdev_get_gpio_in(gic, epit_table[i].irq));
     }
 
     /* Initialize all I2C */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c[i]), 0, i2c_table[i].addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            i2c_table[i].irq));
+                           qdev_get_gpio_in(gic, i2c_table[i].irq));
     }
 
     /* Initialize all GPIOs */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio[i]), 0, gpio_table[i].addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            gpio_table[i].irq_low));
+                           qdev_get_gpio_in(gic, gpio_table[i].irq_low));
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 1,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            gpio_table[i].irq_high));
+                           qdev_get_gpio_in(gic, gpio_table[i].irq_high));
     }
 
     /* Initialize all SDHC */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
         }
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->esdhc[i]), 0, esdhc_table[i].addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->esdhc[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            esdhc_table[i].irq));
+                           qdev_get_gpio_in(gic, esdhc_table[i].irq));
     }
 
     /* USB */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
                         FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            FSL_IMX6_USBn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6_USBn_IRQ[i]));
     }
 
     /* Initialize all ECSPI */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0, spi_table[i].addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            spi_table[i].irq));
+                           qdev_get_gpio_in(gic, spi_table[i].irq));
     }
 
     object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num,
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->eth), 0, FSL_IMX6_ENET_ADDR);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth), 0,
-                       qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                        FSL_IMX6_ENET_MAC_IRQ));
+                       qdev_get_gpio_in(gic, FSL_IMX6_ENET_MAC_IRQ));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth), 1,
-                       qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                        FSL_IMX6_ENET_MAC_1588_IRQ));
+                       qdev_get_gpio_in(gic, FSL_IMX6_ENET_MAC_1588_IRQ));
 
     /*
      * SNVS
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0, FSL_IMX6_WDOGn_ADDR[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-                                            FSL_IMX6_WDOGn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6_WDOGn_IRQ[i]));
     }
 
     /*
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The A7MPCore forward the IRQs from its internal GIC.
To make the code clearer, add the 'mpcore' and 'gic'
variables. Rename 'd' variable as 'cpu'.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250130112615.3219-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6ul.c | 64 +++++++++++++++++++--------------------------
 1 file changed, 27 insertions(+), 37 deletions(-)

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
     FslIMX6ULState *s = FSL_IMX6UL(dev);
+    DeviceState *mpcore = DEVICE(&s->a7mpcore);
     int i;
     char name[NAME_SIZE];
-    SysBusDevice *sbd;
-    DeviceState *d;
+    DeviceState *gic;
+    SysBusDevice *gicsbd;
+    DeviceState *cpu;
 
     if (ms->smp.cpus > 1) {
         error_setg(errp, "%s: Only a single CPU is supported (%d requested)",
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     /*
      * A7MPCORE
      */
-    object_property_set_int(OBJECT(&s->a7mpcore), "num-cpu", 1, &error_abort);
-    object_property_set_int(OBJECT(&s->a7mpcore), "num-irq",
+    object_property_set_int(OBJECT(mpcore), "num-cpu", 1, &error_abort);
+    object_property_set_int(OBJECT(mpcore), "num-irq",
                             FSL_IMX6UL_MAX_IRQ + GIC_INTERNAL, &error_abort);
-    sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, FSL_IMX6UL_A7MPCORE_ADDR);
+    sysbus_realize(SYS_BUS_DEVICE(mpcore), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(mpcore), 0, FSL_IMX6UL_A7MPCORE_ADDR);
 
-    sbd = SYS_BUS_DEVICE(&s->a7mpcore);
-    d = DEVICE(&s->cpu);
-
-    sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(d, ARM_CPU_IRQ));
-    sysbus_connect_irq(sbd, 1, qdev_get_gpio_in(d, ARM_CPU_FIQ));
-    sysbus_connect_irq(sbd, 2, qdev_get_gpio_in(d, ARM_CPU_VIRQ));
-    sysbus_connect_irq(sbd, 3, qdev_get_gpio_in(d, ARM_CPU_VFIQ));
+    gic = mpcore;
+    gicsbd = SYS_BUS_DEVICE(gic);
+    cpu = DEVICE(&s->cpu);
+    sysbus_connect_irq(gicsbd, 0, qdev_get_gpio_in(cpu, ARM_CPU_IRQ));
+    sysbus_connect_irq(gicsbd, 1, qdev_get_gpio_in(cpu, ARM_CPU_FIQ));
+    sysbus_connect_irq(gicsbd, 2, qdev_get_gpio_in(cpu, ARM_CPU_VIRQ));
+    sysbus_connect_irq(gicsbd, 3, qdev_get_gpio_in(cpu, ARM_CPU_VFIQ));
 
     /*
      * A7MPCORE DAP
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                         FSL_IMX6UL_GPTn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpt[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_GPTn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_GPTn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                         FSL_IMX6UL_EPITn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->epit[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_EPITn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_EPITn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                         FSL_IMX6UL_GPIOn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_GPIOn_LOW_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_GPIOn_LOW_IRQ[i]));
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 1,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_GPIOn_HIGH_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_GPIOn_HIGH_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                         FSL_IMX6UL_SPIn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_SPIn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_SPIn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c[i]), 0, FSL_IMX6UL_I2Cn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_I2Cn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_I2Cn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                         FSL_IMX6UL_UARTn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_UARTn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_UARTn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                         FSL_IMX6UL_ENETn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_ENETn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_ENETn_IRQ[i]));
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 1,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
                         FSL_IMX6UL_USB02_USBn_ADDR[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_USBn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_USBn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                         FSL_IMX6UL_USDHCn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usdhc[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_USDHCn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_USDHCn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
                         FSL_IMX6UL_WDOGn_ADDR[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX6UL_WDOGn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX6UL_WDOGn_IRQ[i]));
     }
 
     /*
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The A7MPCore forward the IRQs from its internal GIC.
To make the code clearer, add the 'mpcore' and 'gic'
variables.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250130112615.3219-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx7.c | 52 +++++++++++++++++++++--------------------------
 1 file changed, 23 insertions(+), 29 deletions(-)

diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
     FslIMX7State *s = FSL_IMX7(dev);
-    Object *o;
+    DeviceState *mpcore = DEVICE(&s->a7mpcore);
+    DeviceState *gic;
     int i;
     qemu_irq irq;
     char name[NAME_SIZE];
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
      * CPUs
      */
     for (i = 0; i < smp_cpus; i++) {
-        o = OBJECT(&s->cpu[i]);
+        Object *o = OBJECT(&s->cpu[i]);
 
         /* On uniprocessor, the CBAR is set to 0 */
         if (smp_cpus > 1) {
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     /*
      * A7MPCORE
      */
-    object_property_set_int(OBJECT(&s->a7mpcore), "num-cpu", smp_cpus,
-                            &error_abort);
-    object_property_set_int(OBJECT(&s->a7mpcore), "num-irq",
+    object_property_set_int(OBJECT(mpcore), "num-cpu", smp_cpus, &error_abort);
+    object_property_set_int(OBJECT(mpcore), "num-irq",
                             FSL_IMX7_MAX_IRQ + GIC_INTERNAL, &error_abort);
+    sysbus_realize(SYS_BUS_DEVICE(mpcore), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(mpcore), 0, FSL_IMX7_A7MPCORE_ADDR);
 
-    sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, FSL_IMX7_A7MPCORE_ADDR);
-
+    gic = mpcore;
     for (i = 0; i < smp_cpus; i++) {
-        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
+        SysBusDevice *sbd = SYS_BUS_DEVICE(gic);
         DeviceState  *d   = DEVICE(qemu_get_cpu(i));
 
         irq = qdev_get_gpio_in(d, ARM_CPU_IRQ);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
         sysbus_realize(SYS_BUS_DEVICE(&s->gpt[i]), &error_abort);
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpt[i]), 0, FSL_IMX7_GPTn_ADDR[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpt[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX7_GPTn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX7_GPTn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
                         FSL_IMX7_GPIOn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX7_GPIOn_LOW_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX7_GPIOn_LOW_IRQ[i]));
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio[i]), 1,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX7_GPIOn_HIGH_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX7_GPIOn_HIGH_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
                         FSL_IMX7_SPIn_ADDR[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX7_SPIn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX7_SPIn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c[i]), 0, FSL_IMX7_I2Cn_ADDR[i]);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX7_I2Cn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX7_I2Cn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->uart[i]), 0, FSL_IMX7_UARTn_ADDR[i]);
 
-        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_UARTn_IRQ[i]);
+        irq = qdev_get_gpio_in(gic, FSL_IMX7_UARTn_IRQ[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0, irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->eth[i]), 0, FSL_IMX7_ENETn_ADDR[i]);
 
-        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_ENET_IRQ(i, 0));
+        irq = qdev_get_gpio_in(gic, FSL_IMX7_ENET_IRQ(i, 0));
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 0, irq);
-        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_ENET_IRQ(i, 3));
+        irq = qdev_get_gpio_in(gic, FSL_IMX7_ENET_IRQ(i, 3));
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->eth[i]), 1, irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usdhc[i]), 0,
                         FSL_IMX7_USDHCn_ADDR[i]);
 
-        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_USDHCn_IRQ[i]);
+        irq = qdev_get_gpio_in(gic, FSL_IMX7_USDHCn_IRQ[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usdhc[i]), 0, irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0, FSL_IMX7_WDOGn_ADDR[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                            FSL_IMX7_WDOGn_IRQ[i]));
+                           qdev_get_gpio_in(gic, FSL_IMX7_WDOGn_IRQ[i]));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
     qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
 
-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
+    irq = qdev_get_gpio_in(gic, FSL_IMX7_PCI_INTA_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
+    irq = qdev_get_gpio_in(gic, FSL_IMX7_PCI_INTB_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
+    irq = qdev_get_gpio_in(gic, FSL_IMX7_PCI_INTC_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
                         FSL_IMX7_USBn_ADDR[i]);
 
-        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_USBn_IRQ[i]);
+        irq = qdev_get_gpio_in(gic, FSL_IMX7_USBn_IRQ[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0, irq);
 
         snprintf(name, NAME_SIZE, "usbmisc%d", i);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

No need to duplicate and forward the 'num-cpu' property from
TYPE_ARM11MPCORE_PRIV to TYPE_REALVIEW_MPCORE, alias it with
QOM object_property_add_alias().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20250130112615.3219-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/cpu/realview_mpcore.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/hw/cpu/realview_mpcore.c b/hw/cpu/realview_mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/realview_mpcore.c
+++ b/hw/cpu/realview_mpcore.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/cpu/arm11mpcore.h"
 #include "hw/intc/realview_gic.h"
 #include "hw/irq.h"
-#include "hw/qdev-properties.h"
 #include "qom/object.h"
 
 #define TYPE_REALVIEW_MPCORE_RIRQ "realview_mpcore"
@@ -XXX,XX +XXX,XX @@ static void realview_mpcore_realize(DeviceState *dev, Error **errp)
     int n;
     int i;
 
-    qdev_prop_set_uint32(priv, "num-cpu", s->num_cpu);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->priv), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void mpcore_rirq_init(Object *obj)
     int i;
 
     object_initialize_child(obj, "a11priv", &s->priv, TYPE_ARM11MPCORE_PRIV);
+    object_property_add_alias(obj, "num-cpu", OBJECT(&s->priv), "num-cpu");
     privbusdev = SYS_BUS_DEVICE(&s->priv);
     sysbus_init_mmio(sbd, sysbus_mmio_get_region(privbusdev, 0));
 
@@ -XXX,XX +XXX,XX @@ static void mpcore_rirq_init(Object *obj)
     }
 }
 
-static const Property mpcore_rirq_properties[] = {
-    DEFINE_PROP_UINT32("num-cpu", mpcore_rirq_state, num_cpu, 1),
-};
-
 static void mpcore_rirq_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = realview_mpcore_realize;
-    device_class_set_props(dc, mpcore_rirq_properties);
 }
 
 static const TypeInfo mpcore_rirq_info = {
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

When multiple QOM types are registered in the same file,
it is simpler to use the the DEFINE_TYPES() macro. In
particular because type array declared with such macro
are easier to review.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20250130112615.3219-7-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/cpu/a15mpcore.c       | 21 +++++++++------------
 hw/cpu/a9mpcore.c        | 21 +++++++++------------
 hw/cpu/arm11mpcore.c     | 21 +++++++++------------
 hw/cpu/realview_mpcore.c | 21 +++++++++------------
 4 files changed, 36 insertions(+), 48 deletions(-)

diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -XXX,XX +XXX,XX @@ static void a15mp_priv_class_init(ObjectClass *klass, void *data)
     /* We currently have no saveable state */
 }
 
-static const TypeInfo a15mp_priv_info = {
-    .name  = TYPE_A15MPCORE_PRIV,
-    .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size  = sizeof(A15MPPrivState),
-    .instance_init = a15mp_priv_initfn,
-    .class_init = a15mp_priv_class_init,
+static const TypeInfo a15mp_types[] = {
+    {
+        .name           = TYPE_A15MPCORE_PRIV,
+        .parent         = TYPE_SYS_BUS_DEVICE,
+        .instance_size  = sizeof(A15MPPrivState),
+        .instance_init  = a15mp_priv_initfn,
+        .class_init     = a15mp_priv_class_init,
+    },
 };
 
-static void a15mp_register_types(void)
-{
-    type_register_static(&a15mp_priv_info);
-}
-
-type_init(a15mp_register_types)
+DEFINE_TYPES(a15mp_types)
diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -XXX,XX +XXX,XX @@ static void a9mp_priv_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, a9mp_priv_properties);
 }
 
-static const TypeInfo a9mp_priv_info = {
-    .name          = TYPE_A9MPCORE_PRIV,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(A9MPPrivState),
-    .instance_init = a9mp_priv_initfn,
-    .class_init    = a9mp_priv_class_init,
+static const TypeInfo a9mp_types[] = {
+    {
+        .name           = TYPE_A9MPCORE_PRIV,
+        .parent         = TYPE_SYS_BUS_DEVICE,
+        .instance_size  =  sizeof(A9MPPrivState),
+        .instance_init  = a9mp_priv_initfn,
+        .class_init     = a9mp_priv_class_init,
+    },
 };
 
-static void a9mp_register_types(void)
-{
-    type_register_static(&a9mp_priv_info);
-}
-
-type_init(a9mp_register_types)
+DEFINE_TYPES(a9mp_types)
diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -XXX,XX +XXX,XX @@ static void mpcore_priv_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, mpcore_priv_properties);
 }
 
-static const TypeInfo mpcore_priv_info = {
-    .name          = TYPE_ARM11MPCORE_PRIV,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(ARM11MPCorePriveState),
-    .instance_init = mpcore_priv_initfn,
-    .class_init    = mpcore_priv_class_init,
+static const TypeInfo arm11mp_types[] = {
+    {
+        .name           = TYPE_ARM11MPCORE_PRIV,
+        .parent         = TYPE_SYS_BUS_DEVICE,
+        .instance_size  = sizeof(ARM11MPCorePriveState),
+        .instance_init  = mpcore_priv_initfn,
+        .class_init     = mpcore_priv_class_init,
+    },
 };
 
-static void arm11mpcore_register_types(void)
-{
-    type_register_static(&mpcore_priv_info);
-}
-
-type_init(arm11mpcore_register_types)
+DEFINE_TYPES(arm11mp_types)
diff --git a/hw/cpu/realview_mpcore.c b/hw/cpu/realview_mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/realview_mpcore.c
+++ b/hw/cpu/realview_mpcore.c
@@ -XXX,XX +XXX,XX @@ static void mpcore_rirq_class_init(ObjectClass *klass, void *data)
     dc->realize = realview_mpcore_realize;
 }
 
-static const TypeInfo mpcore_rirq_info = {
-    .name          = TYPE_REALVIEW_MPCORE_RIRQ,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(mpcore_rirq_state),
-    .instance_init = mpcore_rirq_init,
-    .class_init    = mpcore_rirq_class_init,
+static const TypeInfo realview_mpcore_types[] = {
+    {
+        .name           = TYPE_REALVIEW_MPCORE_RIRQ,
+        .parent         = TYPE_SYS_BUS_DEVICE,
+        .instance_size  = sizeof(mpcore_rirq_state),
+        .instance_init  = mpcore_rirq_init,
+        .class_init     = mpcore_rirq_class_init,
+    },
 };
 
-static void realview_mpcore_register_types(void)
-{
-    type_register_static(&mpcore_rirq_info);
-}
-
-type_init(realview_mpcore_register_types)
+DEFINE_TYPES(realview_mpcore_types)
-- 
2.34.1

From: Andrew Yuan <andrew.yuan@jaguarmicro.com>

Our current handling of the mask/compare logic in the Cadence
GEM ethernet device is wrong:
 (1) we load the same byte twice from rx_buf when
     creating the compare value
 (2) we ignore the DISABLE_MASK flag

The "Cadence IP for Gigabit Ethernet MAC Part Number: IP7014 IP Rev:
R1p12 - Doc Rev: 1.3 User Guide" states that if the DISABLE_MASK bit
in type2_compare_x_word_1 is set, the mask_value field in
type2_compare_x_word_0 is used as an additional 2 byte Compare Value.

Correct these bugs:
 * in the !disable_mask codepath, use lduw_le_p() so we
   correctly load a 16-bit value for comparison
 * in the disable_mask codepath, we load a full 4-byte value
   from rx_buf for the comparison, set the compare value to
   the whole of the cr0 register (i.e. the concatenation of
   the mask and compare fields), and set mask to 0xffffffff
   to force a 32-bit comparison

Signed-off-by: Andrew Yuan <andrew.yuan@jaguarmicro.com>
Message-id: 20241219061658.805-1-andrew.yuan@jaguarmicro.com
Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[PMM: Expand commit message and comment]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/cadence_gem.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
 
         /* Compare A, B, C */
         for (j = 0; j < 3; j++) {
-            uint32_t cr0, cr1, mask, compare;
-            uint16_t rx_cmp;
+            uint32_t cr0, cr1, mask, compare, disable_mask;
+            uint32_t rx_cmp;
             int offset;
             int cr_idx = extract32(reg, R_SCREENING_TYPE2_REG0_COMPARE_A_SHIFT + j * 6,
                                    R_SCREENING_TYPE2_REG0_COMPARE_A_LENGTH);
@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
                 break;
             }
 
-            rx_cmp = rxbuf_ptr[offset] << 8 | rxbuf_ptr[offset];
-            mask = FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, MASK_VALUE);
-            compare = FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, COMPARE_VALUE);
+            disable_mask =
+                FIELD_EX32(cr1, TYPE2_COMPARE_0_WORD_1, DISABLE_MASK);
+            if (disable_mask) {
+                /*
+                 * If disable_mask is set, mask_value is used as an
+                 * additional 2 byte Compare Value; that is equivalent
+                 * to using the whole cr0 register as the comparison value.
+                 * Load 32 bits of data from rx_buf, and set mask to
+                 * all-ones so we compare all 32 bits.
+                 */
+                rx_cmp = ldl_le_p(rxbuf_ptr + offset);
+                mask = 0xFFFFFFFF;
+                compare = cr0;
+            } else {
+                rx_cmp = lduw_le_p(rxbuf_ptr + offset);
+                mask = FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, MASK_VALUE);
+                compare =
+                    FIELD_EX32(cr0, TYPE2_COMPARE_0_WORD_0, COMPARE_VALUE);
+            }
 
             if ((rx_cmp & mask) == (compare & mask)) {
                 matched = true;
-- 
2.34.1

The '-old-param' command line option is specific to Arm targets; it
is very briefly documented as "old param mode".  What this option
actually does is change the behaviour when directly booting a guest
kernel, so that command line arguments are passed to the kernel using
the extremely old "param_struct" ABI, rather than the newer ATAGS or
even newer DTB mechanisms.

This support was added back in 2007 to support an old vendor kernel
on the akita/terrier board types:
 https://mail.gnu.org/archive/html/qemu-devel/2007-07/msg00344.html
Even then, it was an out-of-date mechanism from the kernel's
point of view -- the kernel has had a comment since 2001 marking
it as deprecated. As of mid-2024, the kernel only retained
param_struct support for the RiscPC and Footbridge platforms:
 https://lore.kernel.org/linux-arm-kernel/2831c5a6-cfbf-4fe0-b51c-0396e5b0aeb7@app.fastmail.com/

None of the board types QEMU supports need param_struct support;
mark this option as deprecated.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250127123113.2947620-1-peter.maydell@linaro.org
---
 docs/about/deprecated.rst | 13 +++++++++++++
 system/vl.c               |  1 +
 2 files changed, 14 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -XXX,XX +XXX,XX @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
 marked deprecated since 9.0, users have to ensure that all the topology members
 described with -smp are supported by the target machine.
 
+``-old-param`` option for booting Arm kernels via param_struct (since 10.0)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``-old-param`` command line option is specific to Arm targets:
+it is used when directly booting a guest kernel to pass it the
+command line and other information via the old ``param_struct`` ABI,
+rather than the newer ATAGS or DTB mechanisms. This option was only
+ever needed to support ancient kernels on some old board types
+like the ``akita`` or ``terrier``; it has been deprecated in the
+kernel since 2001. None of the board types QEMU supports need
+``param_struct`` support, so this option has been deprecated and will
+be removed in a future QEMU version.
+
 User-mode emulator command line arguments
 -----------------------------------------
 
diff --git a/system/vl.c b/system/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
                 nb_prom_envs++;
                 break;
             case QEMU_OPTION_old_param:
+                warn_report("-old-param is deprecated");
                 old_param = 1;
                 break;
             case QEMU_OPTION_rtc:
-- 
2.34.1

From: Khem Raj <raj.khem@gmail.com>

glibc 2.41+ has added [1] definitions for sched_setattr and
sched_getattr functions and struct sched_attr.  Therefore, it needs
to be checked for here as well before defining sched_attr, to avoid
a compilation failure.

Define sched_attr conditionally only when SCHED_ATTR_SIZE_VER0 is
not defined.

[1] https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=21571ca0d70302909cf72707b2a7736cf12190a0;hp=298bc488fdc047da37482f4003023cb9adef78f8

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2799
Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/syscall.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
           unsigned long *, user_mask_ptr);
-/* sched_attr is not defined in glibc */
+/* sched_attr is not defined in glibc < 2.41 */
+#ifndef SCHED_ATTR_SIZE_VER0
 struct sched_attr {
     uint32_t size;
     uint32_t sched_policy;
@@ -XXX,XX +XXX,XX @@ struct sched_attr {
     uint32_t sched_util_min;
     uint32_t sched_util_max;
 };
+#endif
 #define __NR_sys_sched_getattr __NR_sched_getattr
 _syscall4(int, sys_sched_getattr, pid_t, pid, struct sched_attr *, attr,
           unsigned int, size, unsigned int, flags);
-- 
2.34.1