Hi; here's an arm pullreq; various miscellaneous new features
and bug fixes.

thanks
-- PMM

The following changes since commit 6a9fa5ef3230a7d51e0d953a59ee9ef10af705b8:

  Merge tag 'pull-tcg-20250905' of https://gitlab.com/rth7680/qemu into staging (2025-09-05 09:51:27 +0200)

are available in the Git repository at:

  https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20250916

for you to fetch changes up to aaf042299acf83919862c7d7dd5fc36acf4e0671:

  hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response (2025-09-16 17:32:06 +0100)

----------------------------------------------------------------
target-arm queue:
 * tests, scripts: Don't import print_function from __future__
 * Implement FEAT_ATS1A
 * Remove deprecated pxa CPU family
 * arm/kvm: report registers we failed to set
 * Expose SME registers to GDB via gdbstub
 * linux-user/aarch64: Generate ESR signal records
 * hw/arm/raspi4b: remove redundant check in raspi_add_memory_node
 * hw/arm/virt: Allow user-creatable SMMUv3 dev instantiation
 * system: drop the -old-param option

----------------------------------------------------------------
Cornelia Huck (1):
      arm/kvm: report registers we failed to set

Nicolin Chen (1):
      hw/arm/virt: Add an SMMU_IO_LEN macro

Osama Abdelkader (1):
      hw/arm/raspi4b: remove redundant check in raspi_add_memory_node

Peter Maydell (7):
      tests, scripts: Don't import print_function from __future__
      target/arm: Remove deprecated pxa CPU family
      target/arm: Remove XScale and iWMMXt translate.c code
      target/arm: Remove iwmmxt helper functions
      target/arm: Drop ARM_FEATURE_XSCALE handling
      target/arm: Drop ARM_FEATURE_IWMMXT handling
      system: drop the -old-param option

Richard Henderson (12):
      linux-user/aarch64: Split out signal_for_exception
      linux-user/aarch64: Check syndrome for EXCP_UDEF
      linux-user/aarch64: Generate ESR signal records
      target/arm: Add prot_check parameter to pmsav8_mpu_lookup
      target/arm: Add in_prot_check to S1Translate
      target/arm: Skip permission check from arm_cpu_get_phys_page_attrs_debug
      target/arm: Introduce get_phys_addr_for_at
      target/arm: Skip AF and DB updates for AccessType_AT
      target/arm: Add prot_check parameter to do_ats_write
      target/arm: Fill in HFG[RWI]TR_EL2 bits for Arm v9.5
      target/arm: Remove outdated comment for ZCR_EL12
      target/arm: Implement FEAT_ATS1A

Shameer Kolothum (10):
      hw/arm/smmu-common: Check SMMU has PCIe Root Complex association
      hw/arm/virt-acpi-build: Re-arrange SMMUv3 IORT build
      hw/arm/virt-acpi-build: Update IORT for multiple smmuv3 devices
      hw/arm/virt: Factor out common SMMUV3 dt bindings code
      hw/pci: Introduce pci_setup_iommu_per_bus() for per-bus IOMMU ops retrieval
      hw/arm/virt: Allow user-creatable SMMUv3 dev instantiation
      qemu-options.hx: Document the arm-smmuv3 device
      bios-tables-test: Allow for smmuv3 test data.
      qtest/bios-tables-test: Add tests for legacy smmuv3 and smmuv3 device
      qtest/bios-tables-test: Update tables for smmuv3 tests

Stéphane Graber (1):
      hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response

Vacha Bhavsar (3):
      target/arm: Increase MAX_PACKET_LENGTH for SME ZA remote gdb debugging
      target/arm: Added support for SME register exposure to GDB
      target/arm: Added test case for SME register exposure to GDB

 docs/about/deprecated.rst                          |   34 -
 docs/about/removed-features.rst                    |   26 +
 docs/system/arm/emulation.rst                      |    1 +
 configure                                          |    6 +
 bsd-user/arm/target_arch_elf.h                     |    1 -
 gdbstub/internals.h                                |   22 +-
 include/hw/arm/smmu-common.h                       |    1 +
 include/hw/arm/virt.h                              |    1 +
 include/hw/pci/pci.h                               |    2 +
 include/hw/pci/pci_bridge.h                        |    1 +
 include/hw/pci/pci_bus.h                           |    1 +
 include/system/system.h                            |    1 -
 target/arm/cpregs.h                                |   29 +-
 target/arm/cpu-features.h                          |    5 +
 target/arm/cpu.h                                   |   30 +-
 target/arm/internals.h                             |   26 +-
 target/arm/tcg/helper.h                            |   95 --
 target/arm/tcg/translate.h                         |    2 -
 hw/arm/boot.c                                      |   81 +-
 hw/arm/raspi4b.c                                   |   22 +-
 hw/arm/smmu-common.c                               |   37 +-
 hw/arm/smmuv3.c                                    |    2 +
 hw/arm/virt-acpi-build.c                           |  201 ++-
 hw/arm/virt.c                                      |  111 +-
 hw/core/sysbus-fdt.c                               |    3 +
 hw/pci-bridge/pci_expander_bridge.c                |    1 -
 hw/pci/pci.c                                       |   31 +
 hw/usb/dev-network.c                               |    2 +-
 linux-user/aarch64/cpu_loop.c                      |  162 ++-
 linux-user/aarch64/signal.c                        |   34 +-
 linux-user/arm/elfload.c                           |    1 -
 linux-user/arm/signal.c                            |   67 -
 system/globals.c                                   |    1 -
 system/vl.c                                        |    4 -
 target/arm/cpu.c                                   |   21 -
 target/arm/gdbstub.c                               |   10 +-
 target/arm/gdbstub64.c                             |  119 ++
 target/arm/helper.c                                |   59 -
 target/arm/kvm.c                                   |   86 ++
 target/arm/machine.c                               |   21 -
 target/arm/ptw.c                                   |   71 +-
 target/arm/tcg/cpregs-at.c                         |   69 +-
 target/arm/tcg/cpu32.c                             |  163 ---
 target/arm/tcg/cpu64.c                             |    1 +
 target/arm/tcg/hflags.c                            |   13 +-
 target/arm/tcg/iwmmxt_helper.c                     |  672 ----------
 target/arm/tcg/m_helper.c                          |    4 +-
 target/arm/tcg/op_helper.c                         |    6 -
 target/arm/tcg/translate.c                         | 1324 +-------------------
 tests/qtest/bios-tables-test.c                     |   86 ++
 qemu-options.hx                                    |   14 +-
 scripts/userfaultfd-wrlat.py                       |    1 -
 target/arm/tcg/meson.build                         |    2 -
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev       |  Bin 0 -> 10230 bytes
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy    |  Bin 0 -> 10230 bytes
 tests/data/acpi/aarch64/virt/IORT.smmuv3-dev       |  Bin 0 -> 364 bytes
 tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy    |  Bin 0 -> 276 bytes
 tests/guest-debug/test_gdbstub.py                  |    1 -
 tests/tcg/aarch64/Makefile.target                  |   29 +
 tests/tcg/aarch64/gdbstub/test-mte.py              |    1 -
 tests/tcg/aarch64/gdbstub/test-sme.py              |  117 ++
 tests/tcg/aarch64/gdbstub/test-sve-ioctl.py        |    1 -
 tests/tcg/aarch64/gdbstub/test-sve.py              |    1 -
 tests/tcg/multiarch/gdbstub/interrupt.py           |    1 -
 tests/tcg/multiarch/gdbstub/memory.py              |    1 -
 tests/tcg/multiarch/gdbstub/sha1.py                |    1 -
 tests/tcg/multiarch/gdbstub/test-proc-mappings.py  |    1 -
 .../tcg/multiarch/gdbstub/test-qxfer-auxv-read.py  |    1 -
 .../multiarch/gdbstub/test-qxfer-siginfo-read.py   |    1 -
 .../multiarch/gdbstub/test-thread-breakpoint.py    |    1 -
 tests/tcg/s390x/gdbstub/test-signals-s390x.py      |    1 -
 tests/tcg/s390x/gdbstub/test-svc.py                |    1 -
 72 files changed, 1151 insertions(+), 2794 deletions(-)
 delete mode 100644 target/arm/tcg/iwmmxt_helper.c
 create mode 100644 tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev
 create mode 100644 tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy
 create mode 100644 tests/data/acpi/aarch64/virt/IORT.smmuv3-dev
 create mode 100644 tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy
 create mode 100644 tests/tcg/aarch64/gdbstub/test-sme.py

On 9/16/25 11:05, Peter Maydell wrote:
> Hi; here's an arm pullreq; various miscellaneous new features
> and bug fixes.
> 
> thanks
> -- PMM
> 
> The following changes since commit 6a9fa5ef3230a7d51e0d953a59ee9ef10af705b8:
> 
>    Merge tag 'pull-tcg-20250905' of https://gitlab.com/rth7680/qemu into staging (2025-09-05 09:51:27 +0200)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20250916
> 
> for you to fetch changes up to aaf042299acf83919862c7d7dd5fc36acf4e0671:
> 
>    hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response (2025-09-16 17:32:06 +0100)
> 
> ----------------------------------------------------------------
> target-arm queue:
>   * tests, scripts: Don't import print_function from __future__
>   * Implement FEAT_ATS1A
>   * Remove deprecated pxa CPU family
>   * arm/kvm: report registers we failed to set
>   * Expose SME registers to GDB via gdbstub
>   * linux-user/aarch64: Generate ESR signal records
>   * hw/arm/raspi4b: remove redundant check in raspi_add_memory_node
>   * hw/arm/virt: Allow user-creatable SMMUv3 dev instantiation
>   * system: drop the -old-param option

I don't understand why, but this causes failure on s390x host for hppa guest:

https://gitlab.com/qemu-project/qemu/-/jobs/11379271029

...
# Testing device 'elroy-pcihost'
Broken pipe
../alt/tests/qtest/libqtest.c:208: kill_qemu() detected QEMU death from signal 11 
(Segmentation fault) (core dumped)
Aborted (core dumped)

Even more bizzarely, the failure bisects to

Author: Nicolin Chen <nicolinc@nvidia.com>
Date:   Fri Aug 29 09:25:27 2025 +0100

     hw/arm/virt: Add an SMMU_IO_LEN macro

     This is useful as the subsequent support for new SMMUv3 dev will also
     use the same.

which makes no sense at all.  But it's repeatable, so...


r~

On 9/16/25 18:43, Richard Henderson wrote:
> On 9/16/25 11:05, Peter Maydell wrote:
>> Hi; here's an arm pullreq; various miscellaneous new features
>> and bug fixes.
>>
>> thanks
>> -- PMM
>>
>> The following changes since commit 6a9fa5ef3230a7d51e0d953a59ee9ef10af705b8:
>>
>>    Merge tag 'pull-tcg-20250905' of https://gitlab.com/rth7680/qemu into staging 
>> (2025-09-05 09:51:27 +0200)
>>
>> are available in the Git repository at:
>>
>>    https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20250916
>>
>> for you to fetch changes up to aaf042299acf83919862c7d7dd5fc36acf4e0671:
>>
>>    hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response (2025-09-16 
>> 17:32:06 +0100)
>>
>> ----------------------------------------------------------------
>> target-arm queue:
>>   * tests, scripts: Don't import print_function from __future__
>>   * Implement FEAT_ATS1A
>>   * Remove deprecated pxa CPU family
>>   * arm/kvm: report registers we failed to set
>>   * Expose SME registers to GDB via gdbstub
>>   * linux-user/aarch64: Generate ESR signal records
>>   * hw/arm/raspi4b: remove redundant check in raspi_add_memory_node
>>   * hw/arm/virt: Allow user-creatable SMMUv3 dev instantiation
>>   * system: drop the -old-param option
> 
> I don't understand why, but this causes failure on s390x host for hppa guest:
> 
> https://gitlab.com/qemu-project/qemu/-/jobs/11379271029
> 
> ...
> # Testing device 'elroy-pcihost'
> Broken pipe
> ../alt/tests/qtest/libqtest.c:208: kill_qemu() detected QEMU death from signal 11 
> (Segmentation fault) (core dumped)
> Aborted (core dumped)
> 
> Even more bizzarely, the failure bisects to
> 
> Author: Nicolin Chen <nicolinc@nvidia.com>
> Date:   Fri Aug 29 09:25:27 2025 +0100
> 
>      hw/arm/virt: Add an SMMU_IO_LEN macro
> 
>      This is useful as the subsequent support for new SMMUv3 dev will also
>      use the same.
> 
> which makes no sense at all.  But it's repeatable, so...

Ho hum.  It appears to be flaky.  I now see it without this patch set at all:

https://gitlab.com/qemu-project/qemu/-/jobs/11391070227


r~

On Wed, 17 Sept 2025 at 18:51, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 9/16/25 18:43, Richard Henderson wrote:
> > I don't understand why, but this causes failure on s390x host for hppa guest:
> >
> > https://gitlab.com/qemu-project/qemu/-/jobs/11379271029
> >
> > ...
> > # Testing device 'elroy-pcihost'
> > Broken pipe
> > ../alt/tests/qtest/libqtest.c:208: kill_qemu() detected QEMU death from signal 11
> > (Segmentation fault) (core dumped)
> > Aborted (core dumped)
> >
> > Even more bizzarely, the failure bisects to
> >
> > Author: Nicolin Chen <nicolinc@nvidia.com>
> > Date:   Fri Aug 29 09:25:27 2025 +0100
> >
> >      hw/arm/virt: Add an SMMU_IO_LEN macro
> >
> >      This is useful as the subsequent support for new SMMUv3 dev will also
> >      use the same.
> >
> > which makes no sense at all.  But it's repeatable, so...
>
> Ho hum.  It appears to be flaky.  I now see it without this patch set at all:
>
> https://gitlab.com/qemu-project/qemu/-/jobs/11391070227

asan reports a heap-use-after-free in the dino PCI controller
when running the device-introspect-test, which may be relevant.
The subtest the segfault happens on is half a dozen or so
devices after the dino-pci one, so it's plausible that heap
corruption leads to the subsequent crash.

I'll investigate the use-after-free...


==1771223==ERROR: AddressSanitizer: heap-use-after-free on address
0x527000018f80 at pc 0x5b4b9d3369b5 bp 0x7ffd01929980 sp
0x7ffd01929978
WRITE of size 8 at 0x527000018f80 thread T0
    #0 0x5b4b9d3369b4 in pci_host_bus_register
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:608:5
    #1 0x5b4b9d321566 in pci_root_bus_internal_init
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:677:5
    #2 0x5b4b9d3215e0 in pci_root_bus_new
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:706:5
    #3 0x5b4b9d321fe5 in pci_register_root_bus
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:751:11
    #4 0x5b4b9d390521 in dino_pcihost_init
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci-host/dino.c:473:16

-- PMM

On Thu, 18 Sept 2025 at 10:41, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Wed, 17 Sept 2025 at 18:51, Richard Henderson
> <richard.henderson@linaro.org> wrote:
> >
> > On 9/16/25 18:43, Richard Henderson wrote:
> > > I don't understand why, but this causes failure on s390x host for hppa guest:
> > >
> > > https://gitlab.com/qemu-project/qemu/-/jobs/11379271029
> > >
> > > ...
> > > # Testing device 'elroy-pcihost'
> > > Broken pipe
> > > ../alt/tests/qtest/libqtest.c:208: kill_qemu() detected QEMU death from signal 11
> > > (Segmentation fault) (core dumped)
> > > Aborted (core dumped)
> > >
> > > Even more bizzarely, the failure bisects to
> > >
> > > Author: Nicolin Chen <nicolinc@nvidia.com>
> > > Date:   Fri Aug 29 09:25:27 2025 +0100
> > >
> > >      hw/arm/virt: Add an SMMU_IO_LEN macro
> > >
> > >      This is useful as the subsequent support for new SMMUv3 dev will also
> > >      use the same.
> > >
> > > which makes no sense at all.  But it's repeatable, so...
> >
> > Ho hum.  It appears to be flaky.  I now see it without this patch set at all:
> >
> > https://gitlab.com/qemu-project/qemu/-/jobs/11391070227
>
> asan reports a heap-use-after-free in the dino PCI controller
> when running the device-introspect-test, which may be relevant.
> The subtest the segfault happens on is half a dozen or so
> devices after the dino-pci one, so it's plausible that heap
> corruption leads to the subsequent crash.

...and fixing that one shows that the elroy-pcihost device
has the identical bug, so even more likely to be the culprit.

-- PMM

On 9/16/25 11:05, Peter Maydell wrote:
> Hi; here's an arm pullreq; various miscellaneous new features
> and bug fixes.
> 
> thanks
> -- PMM
> 
> The following changes since commit 6a9fa5ef3230a7d51e0d953a59ee9ef10af705b8:
> 
>    Merge tag 'pull-tcg-20250905' ofhttps://gitlab.com/rth7680/qemu into staging (2025-09-05 09:51:27 +0200)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20250916
> 
> for you to fetch changes up to aaf042299acf83919862c7d7dd5fc36acf4e0671:
> 
>    hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response (2025-09-16 17:32:06 +0100)
> 
> ----------------------------------------------------------------
> target-arm queue:
>   * tests, scripts: Don't import print_function from __future__
>   * Implement FEAT_ATS1A
>   * Remove deprecated pxa CPU family
>   * arm/kvm: report registers we failed to set
>   * Expose SME registers to GDB via gdbstub
>   * linux-user/aarch64: Generate ESR signal records
>   * hw/arm/raspi4b: remove redundant check in raspi_add_memory_node
>   * hw/arm/virt: Allow user-creatable SMMUv3 dev instantiation
>   * system: drop the -old-param option


Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/10.2 as appropriate.

r~