ppc/pnv: Fix PNV I2C invalid status after reset

The PNV I2C Controller was clearing the status register
after a reset without repopulating the "upper threshold
for I2C ports", "Command Complete" and the SCL/SDA input
level fields.

Fixed this for resets caused by a system reset as well
as from writing to the "Immediate Reset" register.

Fixes: 263b81ee15af ("ppc/pnv: Add an I2C controller model")
Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>

ppc/pnv: PNV I2C engines assigned incorrect XSCOM addresses

The PNV I2C engines for power9 and power10 were being assigned a base
XSCOM address that was off by one I2C engine's address range such
that engine 0 had engine 1's address and so on.  The xscom address
assignment was being based on the device tree engine numbering, which
starts at 1.  Rather than changing the device tree numbering to start
with 0, the addressing was changed to be based on the existing device
tree numbers minus one.

Fixes: 1ceda19c28a1 ("ppc/pnv: Connect PNV I2C controller to powernv10)
Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>

target/ppc: Fix bugs in VSX_CVT_FP_TO_INT and VSX_CVT_FP_TO_INT2 macros

The patch below fixes a bug in the VSX_CVT_FP_TO_INT and VSX_CVT_FP_TO_INT2
macros in target/ppc/fpu_helper.c where a non-NaN floating point value from the
source vector is incorrectly converted to 0, 0x80000000, or 0x8000000000000000
instead of the expected value if a preceding source floating point value from
the same source vector was a NaN.

The bug in the VSX_CVT_FP_TO_INT and VSX_CVT_FP_TO_INT2 macros in
target/ppc/fpu_helper.c was introduced with commit c3f24257e3c0.

This patch also adds a new vsx_f2i_nan test in tests/tcg/ppc64 that checks that
the VSX xvcvspsxws, xvcvspuxws, xvcvspsxds, xvcvspuxds, xvcvdpsxws, xvcvdpuxws,
xvcvdpsxds, and xvcvdpuxds instructions correctly convert non-NaN floating point
values to integer values if the source vector contains NaN floating point values.

Fixes: c3f24257e3c0 ("target/ppc: Clear fpstatus flags on helpers missing it")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1941
Signed-off-by: John Platts <john_platts@hotmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>

ppc/pnv: Fix potential overflow in I2C model

Coverity warns that "i2c_bus_busy(i2c->busses[i]) << i" might overflow
because the expression is evaluated using 32-bit arithmetic and then
used in a context expecting a uint64_t.

While we are at it, introduce a PNV_I2C_MAX_BUSSES constant and check
the number of busses at realize time.

Fixes: Coverity CID 1523918
Cc: Glenn Miles <milesg@linux.vnet.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Glenn Miles <milesg@linux.vnet.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>

tcg/loongarch64: Fix tcg_out_mov() Aborted

On LoongArch host,  we got an Aborted from tcg_out_mov().

qemu-x86_64 configure with '--enable-debug'.

> (gdb) b /home1/gaosong/code/qemu/tcg/loongarch64/tcg-target.c.inc:312
> Breakpoint 1 at 0x2576f0: file /home1/gaosong/code/qemu/tcg/loongarch64/tcg-target.c.inc, line 312.
> (gdb) run hello
[...]
> Thread 1 "qemu-x86_64" hit Breakpoint 1, tcg_out_mov (s=0xaaaae91760 <tcg_init_ctx>, type=TCG_TYPE_V128, ret=TCG_REG_V2,
>     arg=TCG_REG_V0) at /home1/gaosong/code/qemu/tcg/loongarch64/tcg-target.c.inc:312
> 312           g_assert_not_reached();
> (gdb) bt
> #0  tcg_out_mov (s=0xaaaae91760 <tcg_init_ctx>, type=TCG_TYPE_V128, ret=TCG_REG_V2, arg=TCG_REG_V0)
>     at /home1/gaosong/code/qemu/tcg/loongarch64/tcg-target.c.inc:312
> #1  0x000000aaaad0fee0 in tcg_reg_alloc_mov (s=0xaaaae91760 <tcg_init_ctx>, op=0xaaaaf67c20) at ../tcg/tcg.c:4632
> #2  0x000000aaaad142f4 in tcg_gen_code (s=0xaaaae91760 <tcg_init_ctx>, tb=0xffe8030340 <code_gen_buffer+197328>,
>     pc_start=4346094) at ../tcg/tcg.c:6135
[...]
> (gdb) c
> Continuing.
> **
> ERROR:/home1/gaosong/code/qemu/tcg/loongarch64/tcg-target.c.inc:312:tcg_out_mov: code should not be reached
> Bail out! ERROR:/home1/gaosong/code/qemu/tcg/loongarch64/tcg-target.c.inc:312:tcg_out_mov: code should not be reached
>
> Thread 1 "qemu-x86_64" received signal SIGABRT, Aborted.
> 0x000000fff7b1c390 in raise () from /lib64/libc.so.6
> (gdb) q

Fixes: 16288ded94 ("tcg/loongarch64: Lower basic tcg vec ops to LSX")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20231120065916.374045-1-gaosong@loongson.cn>

hw/arm/fsl-imx: Do not ignore Error argument

Both i.MX25 and i.MX6 SoC models ignore the Error argument when
setting the PHY number. Pick &error_abort which is the error
used by the i.MX7 SoC (see commit 1f7197deb0 "ability to change
the FEC PHY on i.MX7 processor").

Fixes: 74c1330582 ("ability to change the FEC PHY on i.MX25 processor")
Fixes: a9c167a3c4 ("ability to change the FEC PHY on i.MX6 processor")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20231120115116.76858-1-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/stm32f100: Report error when incorrect CPU is used

The 'stm32vldiscovery' machine ignores the CPU type requested by
the command line. This might confuse users, since the following
will create a machine with a Cortex-M3 CPU:

  $ qemu-system-aarch64 -M stm32vldiscovery -cpu neoverse-n1

Set the MachineClass::valid_cpu_types field (introduced in commit
c9cf636d48 "machine: Add a valid_cpu_types property").
Remove the now unused MachineClass::default_cpu_type field.

We now get:

  $ qemu-system-aarch64 -M stm32vldiscovery -cpu neoverse-n1
  qemu-system-aarch64: Invalid CPU type: neoverse-n1-arm-cpu
  The valid types are: cortex-m3-arm-cpu

Since the SoC family can only use Cortex-M3 CPUs, hard-code the
CPU type name at the SoC level, removing the QOM property
entirely.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Message-id: 20231117071704.35040-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/stm32f205: Report error when incorrect CPU is used

The 'netduino2' machine ignores the CPU type requested by the
command line. This might confuse users, since the following will
create a machine with a Cortex-M3 CPU:

  $ qemu-system-arm -M netduino2 -cpu cortex-a9

Set the MachineClass::valid_cpu_types field (introduced in commit
c9cf636d48 "machine: Add a valid_cpu_types property").
Remove the now unused MachineClass::default_cpu_type field.

We now get:

  $ qemu-system-arm -M netduino2 -cpu cortex-a9
  qemu-system-arm: Invalid CPU type: cortex-a9-arm-cpu
  The valid types are: cortex-m3-arm-cpu

Since the SoC family can only use Cortex-M3 CPUs, hard-code the
CPU type name at the SoC level, removing the QOM property
entirely.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Message-id: 20231117071704.35040-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/stm32f405: Report error when incorrect CPU is used

Both 'netduinoplus2' and 'olimex-stm32-h405' machines ignore the
CPU type requested by the command line. This might confuse users,
since the following will create a machine with a Cortex-M4 CPU:

  $ qemu-system-aarch64 -M netduinoplus2 -cpu cortex-r5f

Set the MachineClass::valid_cpu_types field (introduced in commit
c9cf636d48 "machine: Add a valid_cpu_types property").
Remove the now unused MachineClass::default_cpu_type field.

We now get:

  $ qemu-system-aarch64 -M netduinoplus2 -cpu cortex-r5f
  qemu-system-aarch64: Invalid CPU type: cortex-r5f-arm-cpu
  The valid types are: cortex-m4-arm-cpu

Since the SoC family can only use Cortex-M4 CPUs, hard-code the
CPU type name at the SoC level, removing the QOM property
entirely.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Message-id: 20231117071704.35040-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/core/machine: Constify MachineClass::valid_cpu_types[]

Constify MachineClass::valid_cpu_types[i], as suggested by Richard
Henderson.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20231117071704.35040-2-philmd@linaro.org
[PMD: Constify HPPA machines,
      restrict valid_cpu_types to machine_class_init() handlers]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Fix SME FMOPA (16-bit), BFMOPA

Perform the loop increment unconditionally, not nested
within the predication.

Cc: qemu-stable@nongnu.org
Fixes: 3916841ac75 ("target/arm: Implement FMOPA, FMOPS (widening)")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1985
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20231117193135.1180657-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/intc/arm_gicv3: ICC_PMR_EL1 high bits should be RAZ

The ICC_PMR_ELx and ICV_PMR_ELx bit masks returned from
ic{c,v}_fullprio_mask should technically also remove any
bit above 7 as these are marked reserved (read 0) and should
therefore should not be written as anything other than 0.

This was noted during a run of a proprietary test system and
discused on the mailing list [1] and initially thought not to
be an issue due to RES0 being technically allowed to be
written to and read back as long as the implementation does
not use the RES0 bits. It is very possible that the values
are used in comparison without masking, as pointed out by
Peter in [2], if (cs->hppi.prio >= cs->icc_pmr_el1) may well
do the wrong thing.

Masking these values in ic{c,v}_fullprio_mask() should fix
this and prevent any future problems with playing with the
values.

[1]: https://lists.nongnu.org/archive/html/qemu-arm/2023-11/msg00607.html
[2]: https://lists.nongnu.org/archive/html/qemu-arm/2023-11/msg00737.html

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Message-id: 20231116172818.792364-1-ben.dooks@codethink.co.uk
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: enable FEAT_RNG on Neoverse-N2

I noticed that Neoverse-V1 has FEAT_RNG enabled so let enable it also on
Neoverse-N2.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20231114103443.1652308-1-marcin.juszkiewicz@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag '20231119-xtensa-1' of https://github.com/OSLL/qemu-xtensa into staging

target/xtensa fixes for v8.2:

- fix signal delivery in FDPIC

# -----BEGIN PGP SIGNATURE-----
#
# iQJHBAABCgAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAmVaXU4THGpjbXZia2Jj
# QGdtYWlsLmNvbQAKCRBR+cyR+D+gRF13EACXNP0MPn2iWqxLPvxW9mDXaQu9cSlJ
# BcAlHKbi21CDdqLYpyMoenRONtHMDKjEhR4Atv+DRhc2qQYKNogLgCM1PtGkb6+z
# rNS6HBaUFsAKovS03JGcBDDYWS97bfN1AQRrrEzCV+SKq5Gq8Tr23LSgFHred0hS
# OlGmb7/S+uMh1Uo+rqLKFvSkcWLyaPxOhw1BoaNWdifSotfRwK++PZUvv7slQk+/
# J2ePbjU/ZTBTmumn0tg8BP66UHmGQ+TcvGOdD0m6qlQoq5XaqAYgNb6/Cm16xIPJ
# GQtmB1m74Dl1cQGYXlg3YFGluOJGidkT6In6dYzOEzjvOg9Rku+9bdCxIyRgQK7g
# gXcQJaEdpBiex3c21XWhMfjpM1pQruRgIQ3xqYETBMKXXqvbgYdUT09JpuaoTUkP
# oTymnBVL+9hyrlhPWXzn8M6IPUlyT7Hmnb0uVmHfTi8UNBhiGBRSN4x3CMDNi9oL
# ziE3xKgEkii9WEY+qSCodLMvLJBzShpKTjmUhfJMYdK07uVzazhGhmtQ8qSi3Rm7
# 6hDfnnBwrnX/CBE1IMca280Aax3TMf8Sn1pJqsTHwlNFb3O5vcixRajJw7xNprkP
# 5CcS+G2fRK7JIb18FI2aBf7DXD4kfasF8UAaiyQfkmD1/LITSGiDKfKFvaqjA7Ln
# wVrNbrGvDRvdEw==
# =sZPo
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun 19 Nov 2023 14:09:02 EST
# gpg:                using RSA key 2B67854B98E5327DCDEB17D851F9CC91F83FA044
# gpg:                issuer "jcmvbkbc@gmail.com"
# gpg: Good signature from "Max Filippov <filippov@cadence.com>" [unknown]
# gpg:                 aka "Max Filippov <max.filippov@cogentembedded.com>" [unknown]
# gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 2B67 854B 98E5 327D CDEB  17D8 51F9 CC91 F83F A044

* tag '20231119-xtensa-1' of https://github.com/OSLL/qemu-xtensa:
  linux-user: xtensa: fix signal delivery in FDPIC

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'hppa64-fixes-pull-request' of https://github.com/hdeller/qemu-hppa into staging

HPPA64-PATCHES-for-8.2

Two patches for 8.2.

The SHRPD patch fixes a real translation bug which then allows to boot
the 64-bit Linux kernels of the Debian-11 and Debian-12 installation CDs.

The second patch adds the instruction byte sequence to the
assembly log. This is not an actual bug fix, but it's important since
it helps a lot when trying to fix qemu translation bugs on hppa.

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCZVfHPwAKCRD3ErUQojoP
# X3TrAQD2SfFsTWIYqTamh1ZHmydaJRL1xhXmPMqXgXFkDmiyhQD/VeyIyWEGj5Oe
# x70WR8HrtkadsUddgSGzFRChaVb0/wI=
# =Sapq
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 17 Nov 2023 15:04:15 EST
# gpg:                using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg:                 aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D  25F8 3E5F 3D04 A7A2 4603
#      Subkey fingerprint: BCE9 123E 1AD2 9F07 C049  BBDE F712 B510 A23A 0F5F

* tag 'hppa64-fixes-pull-request' of https://github.com/hdeller/qemu-hppa:
  disas/hppa: Show hexcode of instruction along with disassembly
  target/hppa: Fix 64-bit SHRPD instruction

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-error-2023-11-17' of https://repo.or.cz/qemu/armbru into staging

Error reporting patches for 2023-11-17

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmVXLq8SHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTBIsP/3vTjS2QJ2JdjgZV7ARGyfAxsPbG4TS2
# JHqFsF37vY5u+gYjcBJsmDY8YBpYWQFkOYJ8RJtCdedOnW2gML88vc3XKcUrUc7T
# ebN8KnpA8mx5nr0SMGD+/w72xZl917lGFhXRqazvS2i0dbJvuAsacoo300oIZncx
# 5480GiJpNc/QBUdU9ywFWwQOVzJynn32e1OFWLmbL2xH+kcgMbgWgrEMQUb0D99+
# J9PjKCJxVlJFKEjph7iLCahID5V1gjJTzp3iESOWbO7BTFuKJZ8E510oXd1ng86c
# JLOEcu4vhC4JNvMx5R31nVz4LXfQD8Hf1pSVL64gTybVq3bEMhv/wLUuG/AcPIuL
# t1GxRhGqY2yXbnP3GfP9xNhFps0uLmJF7g5Q/ao2sEwOiPmGmNKcK7xV6OkYJdIr
# isbb+bot19NN+B7r1ZWkb7BEhM99PtHZtsrmnPZ7T19CX/cy2k0D0W78nqJE0AJU
# sBhwuntou+DvBbLB3KD33OcE0UI93IxICaqR56q4lwydYOQ4p8VCTRI1aoDrZpPx
# Q+kMs+sy3q7CGMKEScnb+HeA8KuvKFGqw3XKJwYQsTITRd+NdWnQ7dKAC2J2sRvO
# DRGhUEmOiaDv3HdmToV3owfLsH9raK6Oh8KYjxiOoiJ1Tb0+sZvxayemQ97mRVuJ
# r+yle/BX1ODY
# =7QAS
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 17 Nov 2023 04:13:19 EST
# gpg:                using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg:                issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* tag 'pull-error-2023-11-17' of https://repo.or.cz/qemu/armbru:
  target/i386/cpu: Improve error message for property "vendor"
  balloon: Fix a misleading error message
  net: Fix a misleading error message
  ui/qmp-cmds: Improve two error messages
  qga: Improve guest-exec-status error message
  hmp: Improve sync-profile error message
  spapr/pci: Correct "does not support hotplugging error messages

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-request-2023-11-16' of https://gitlab.com/thuth/qemu into staging

* Fix the avocado tests for running with Python 3.12
* Add some asset hashes to silence warnings
* Fix the broken reverse_debugging test

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmVWWRARHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbWOnQ/8DdnPGlXrOl+4QzRaJQovmmS04OZuiWtB
# TpOd/cWQMsKKX7YGq9uAuLBa7zYXyHZLmOLcSYYKYzcFnxX155TgtXDqZXJb7k8D
# 9rGtF8vgGokT3VmsWW6w5LNa1Pg5FPd56+l8Kus7iqpHbxPzMybP/HFGcuCdeMW9
# kFaLCvtP7LAPM9k8z6Nw9vbQ5aUx2J9fwSgWhoMYmVO72A7HUZ0KA+lti/3xvhKy
# zcYJ4PxFaSK4SQwG8yfhmwqCw3QjeH+Se8gxvqR6nmKW9wCA3FdmUFaQPQQF6bq+
# AEUPBJpa+eZA38tA9rts6VSVGgrg5IA9rPYFc8ZIYn6dMgkAqR7snvcphyUAijJ9
# oqS72BJkw6KZ+52QyZ4O2zG4lkgi/uHp0qhmAr/FHDLkmetTjyQ4vA5dm76V5B2G
# EAPzNZct0RluD0hk2qIKXRC4FN4HFaEAL4EpDjCuymTArsEhSf9I8IEMu9V4CVHs
# Jp2c/0EZNCcTeqc7xr+lO+JFMd1kbB2N9yApFrbQpaIsZQkSF/oNtFZ8h8n/DhNJ
# Ojp9hSUkb37eBZuRA5wsDAo9WI1ADV1n7Ku7ao9aJ84iozcAvOjk2T+NXkeKJEdW
# br8RCqpm0yiB9W7X9WUa5uQd69pdKX4ILW1ekdrG02CuxbIE42Jx5WYdzUrXDUIz
# hzD/QPF3TsI=
# =IcSd
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 16 Nov 2023 13:01:52 EST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2023-11-16' of https://gitlab.com/thuth/qemu:
  tests/avocado: Enable reverse_debugging.py tests in gitlab CI
  tests/avocado: reverse_debugging drain console to prevent hang
  tests/avocado/mem-addr-space-check: Replace assertEquals() for Python 3.12
  tests/avocado/replay_kernel: Mark the test_x86_64_pc as flaky
  tests/avocado: Make fetch_asset() unconditionally require a crypto hash
  tests/avocado/multiprocess: Add asset hashes to silence warnings
  tests/avocado/intel_iommu: Add asset hashes to avoid warnings
  tests/avocado/virtio-gpu: Fix test_vhost_user_vga_virgl for edid support
  tests/avocado: Replace assertRegexpMatches() for Python 3.12 compatibility
  tests/avocado: Replace assertEquals() for Python 3.12 compatibility

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging

trivial patches for 2023-11-16

# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmVVxz4PHG1qdEB0bHMu
# bXNrLnJ1AAoJEHAbT2saaT5ZI+cH+wexpGPHmmWHaA0moo+1MZPC3pbEvOXq184b
# oeGRUidq89380DzsxkIxrDn98KisKnIX3oGZ56Q394Ntg7J2xyFN/KsvQhzpElSb
# 01Ws90NVoHIXoXZKNIOFZXkqOLCB+kwqZ1PFiYwALEJkEPBfpV40dTWuyCnxh1D8
# lKHtk5bLKzDbTmDYYfnZ7zkP6CLMhRH7A7evdb/4+W+phbqTHeKbSgq8QhNvVX8n
# 38yzPTQPlMyXHw7Psio62N7wz86wEiGkYELud1nPPlA902paM5FHMdjYBohm/ZCM
# 4E12gzMg4SgwBIsWoyE/1tUAjyJXeChocxOVLFqDXXaiYgomAh0=
# =x0bq
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 16 Nov 2023 02:39:42 EST
# gpg:                using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59
# gpg:                issuer "mjt@tls.msk.ru"
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [full]
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>" [full]
# gpg:                 aka "Michael Tokarev <mjt@debian.org>" [full]
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931  4B22 701B 4F6B 1A69 3E59

* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu: (27 commits)
  util/range.c: spelling fix: inbetween
  util/filemonitor-inotify.c: spelling fix: kenel
  tests/qtest/ufs-test.c: spelling fix: tranfer
  tests/qtest/migration-test.c: spelling fix: bandwith
  target/riscv/cpu.h: spelling fix: separatly
  include/hw/virtio/vhost.h: spelling fix: sate
  include/hw/hyperv/dynmem-proto.h: spelling fix: nunber, atleast
  include/block/ufs.h: spelling fix: setted
  hw/net/cadence_gem.c: spelling fixes: Octects
  hw/mem/memory-device.c: spelling fix: ontaining
  contrib/vhost-user-gpu/virgl.c: spelling fix: mesage
  migration/rdma.c: spelling fix: asume
  target/hppa: spelling fixes: Indicies, Truely
  target/arm/tcg: spelling fixes: alse, addreses
  docs/system/arm/emulation.rst: spelling fix: Enhacements
  docs/devel/migration.rst: spelling fixes: doen't, diferent, responsability, recomend
  docs/about/deprecated.rst: spelling fix: becase
  gdbstub: spelling fix: respectivelly
  hw/cxl: spelling fixes: limitaions, potentialy, intialized
  linux-user: spelling fixes: othe, necesary
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

linux-user: xtensa: fix signal delivery in FDPIC

In FDPIC signal handlers are passed around as FD pointers. Actual code
address and GOT pointer must be fetched from memory by the QEMU code
that implements kernel signal delivery functionality. This change is
equivalent to the following kernel change:
9c2cc74fb31e ("xtensa: fix signal delivery to FDPIC process")

Cc: qemu-stable@nongnu.org
Fixes: d2796be69d7c ("linux-user: add support for xtensa FDPIC")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

disas/hppa: Show hexcode of instruction along with disassembly

On hppa many instructions can be expressed by different bytecodes.
To be able to debug qemu translation bugs it's therefore necessary to see the
currently executed byte codes without the need to lookup the sequence without
the full executable.
With this patch the instruction byte code is shown beside the disassembly.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Fix 64-bit SHRPD instruction

When shifting the two joined 64-bit registers right, shift the upper
64-bit register to the left and the lower 64-bit register to the right
before merging them with OR.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

target/i386/cpu: Improve error message for property "vendor"

Improve

    $ qemu-system-x86_64 -device max-x86_64-cpu,vendor=me
    qemu-system-x86_64: -device max-x86_64-cpu,vendor=me: Property '.vendor' doesn't take value 'me'

to

    qemu-system-x86_64: -device max-x86_64-cpu,vendor=0123456789abc: value of property 'vendor' must consist of exactly 12 characters

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20231031111059.3407803-8-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[Typo corrected]

balloon: Fix a misleading error message

The error message

    {"execute": "balloon", "arguments":{"value": -1}}
    {"error": {"class": "GenericError", "desc": "Parameter 'target' expects a size"}}

points to 'target' instead of 'value'.  Fix:

    {"error": {"class": "GenericError", "desc": "Parameter 'value' expects a size"}}

Root cause: qmp_balloon()'s parameter is named @target.  Rename it to
@value to match the QAPI schema.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20231031111059.3407803-7-armbru@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>

net: Fix a misleading error message

The error message

    $ qemu-system-x86_64 -netdev user,id=net0,ipv6-net=fec0::0/
    qemu-system-x86_64: -netdev user,id=net0,ipv6-net=fec0::0/: Parameter 'ipv6-prefixlen' expects a number

points to ipv6-prefixlen instead of ipv6-net.  Fix:

    qemu-system-x86_64: -netdev user,id=net0,ipv6-net=fec0::0/: parameter 'ipv6-net' expects a number after '/'

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20231031111059.3407803-6-armbru@redhat.com>

ui/qmp-cmds: Improve two error messages

set_password with "protocol": "vnc" supports only "connected": "keep".
Any other value is rejected with

    Invalid parameter 'connected'

Improve this to

    parameter 'connected' must be 'keep' when 'protocol' is 'vnc'

client_migrate_info requires "port" or "tls-port".  When both are
missing, it fails with

    Parameter 'port/tls-port' is missing

Improve this to

    parameter 'port' or 'tls-port' is required

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20231031111059.3407803-5-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

qga: Improve guest-exec-status error message

When the PID passed to guest-exec-status does not exist, we report

    "Invalid parameter 'pid'"

Improve this to

    "PID 1234 does not exist"

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20231031111059.3407803-4-armbru@redhat.com>
Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hmp: Improve sync-profile error message

Improve

    (qemu) sync-profile of
    Error: Invalid parameter 'of'

to

    Error: invalid parameter 'of', expecting 'on', 'off', or 'reset'

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20231031111059.3407803-3-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>

spapr/pci: Correct "does not support hotplugging error messages

When dynamic-reconfiguration is off, hot plug / unplug can fail with
"Bus 'spapr-pci-host-bridge' does not support hotplugging".
spapr-pci-host-bridge is a device, not a bus.  Report the name of the
bus it provides instead: 'pci.0'.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20231031111059.3407803-2-armbru@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>

tests/avocado: Enable reverse_debugging.py tests in gitlab CI

Let's try enable reverse_debugging.py in gitlab CI.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20231116115354.228678-3-npiggin@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado: reverse_debugging drain console to prevent hang

Like replay_linux.py, reverse_debugging.py starts the vm with console
set but does not interact with it (e.g., with wait_for_console_pattern).
In this situation, the console should have a drainer attached so the
socket does not fill. replay_linux.py has a drainer, but it is missing
from reverse_debugging.py.

Per analysis in Link: this can cause the console socket/pipe to fill and
QEMU get stuck in qemu_chr_write_buffer, leading to strange test case
failures (ppc64 fails because it prints a lot to console in early bios).
Attaching a drainer prevents this.

Note, this commit does not fix bugs introduced by the commits referenced
in the first two Fixes: tags, but together those commits conspire to
irritate the problem and cause test case failure, which this commit
fixes.

Link: https://lore.kernel.org/qemu-devel/ZVT-bY9YOr69QTPX@redhat.com/
Fixes: 1d4796cd0083 ("python/machine: use socketpair() for console connections")
Fixes: 761a13b23946 ("tests/avocado: ppc64 reverse debugging tests for pseries and powernv")
Fixes: be52eca30978 ("tests/acceptance: add reverse debugging test")
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20231116115354.228678-1-npiggin@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado/mem-addr-space-check: Replace assertEquals() for Python 3.12

assertEquals() has been removed in Python 3.12 and should be replaced by
assertEqual(). See: https://docs.python.org/3.12/whatsnew/3.12.html#id3

Message-ID: <20231116061956.14676-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Ani Sinha <anisinha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado/replay_kernel: Mark the test_x86_64_pc as flaky

It's failing very often, so don't run this by default anymore
until it gets fixed.

Message-ID: <20231114153019.295131-1-thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado: Make fetch_asset() unconditionally require a crypto hash

In a perfect world we'd have reproducible tests,
but then we'd be sure we run the same binaries.
If a binary artifact isn't hashed, we have no idea
what we are running. Therefore enforce hashing for
all our artifacts.

With this change, unhashed artifacts produce:

  $ avocado run tests/avocado/multiprocess.py
   (1/2) tests/avocado/multiprocess.py:Multiprocess.test_multiprocess_x86_64:
   ERROR: QemuBaseTest.fetch_asset() missing 1 required positional argument: 'asset_hash' (0.19 s)

Inspired-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20231115205149.90765-1-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado/multiprocess: Add asset hashes to silence warnings

The multiprocess test is currently succeeding with an annoying warning:

 (1/2) tests/avocado/multiprocess.py:Multiprocess.test_multiprocess_x86_64:
       WARN: Test passed but there were warnings during execution. Check
       the log for details

In the log, you can find an entry like:

 WARNI| No hash provided. Cannot check the asset file integrity.

Add the proper asset hashes to avoid those warnings.

Message-ID: <20231115145852.494052-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado/intel_iommu: Add asset hashes to avoid warnings

The intel_iommu test is currently succeeding with annoying warnings.
Add the proper asset hashes to avoid those.

Message-ID: <20231114143531.291820-1-thuth@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado/virtio-gpu: Fix test_vhost_user_vga_virgl for edid support

The "edid" feature has been added to vhost-user-gpu in commit
c06444261e20 ("contrib/vhost-user-gpu: implement get_edid feature"),
so waiting for "features: +virgl -edid" in the test does not work
anymore, it's "+edid" instead of "-edid" now!

While we're at it, move the expected string to the preceeding
exec_command_and_wait_for_pattern() instead (since waiting for
empty string here does not make too much sense).

Message-ID: <20231114203456.319093-1-thuth@redhat.com>
Reviewed-by: Antonio Caggiano <quic_acaggian@quicinc.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado: Replace assertRegexpMatches() for Python 3.12 compatibility

assertRegexpMatches() has been removed in Python 3.12 and should be replaced by
assertRegex(). See: https://docs.python.org/3.12/whatsnew/3.12.html#id3

Inspired-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231114144832.71612-1-philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/avocado: Replace assertEquals() for Python 3.12 compatibility

assertEquals() has been removed in Python 3.12 and should be replaced by
assertEqual(). See: https://docs.python.org/3.12/whatsnew/3.12.html#id3

Message-ID: <20231114134326.287242-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

Merge tag 'pull-tcg-20231114' of https://gitlab.com/rth7680/qemu into staging

accel/tcg: Forward probe size on to notdirty_write
accel/tcg: Remove CF_LAST_IO
target/sparc: Fix RETURN

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmVTyVodHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV91UAf/Sf304RJutaNX+85s
# 2HP31heScIsrrziDvPhZJG+gD3/Xeq9aDRCNqw7C/MhIHadarJcghTVqPuTMZ8Eg
# j3FqvSr6e+6A6VGNdg2d5CKasIYhRMHqCy94g/0fVWtnV9n/2cJPS6zIWGlxl2dT
# tJ9AK9IbkLo9b7jifUztTsllhzU8rMvxYznxr6dynJ/3V10gtcAIsc41BeHoLzob
# e8wZtuwNUtgiHBGhfEnpspK+oJaPKo2Qy1zPdBiuLadUhl066JdXeOKN9XgCuRyR
# 024dOqVwZ+UBQhcmUdJuOjAnsnJJUx29TKtmOOoTugrq+mE1xybSBiiih6EELQlj
# AYq6jg==
# =D4Wj
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 14 Nov 2023 14:24:10 EST
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* tag 'pull-tcg-20231114' of https://gitlab.com/rth7680/qemu:
  target/sparc: Fix RETURN
  accel/tcg: Forward probe size on to notdirty_write
  accel/tcg: Remove CF_LAST_IO

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

util/range.c: spelling fix: inbetween

Fixes: b439595a08d7 "range: Introduce range_inverse_array()"
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

util/filemonitor-inotify.c: spelling fix: kenel

Fixes: 2e12dd405c66 "util/filemonitor-inotify: qemu_file_monitor_watch(): assert no overflow"
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

tests/qtest/ufs-test.c: spelling fix: tranfer

Fixes: 631c872614ac "tests/qtest: Introduce tests for UFS"
Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

tests/qtest/migration-test.c: spelling fix: bandwith

Fixes: 17257b90be4f "tests: Add migration dirty-limit capability test"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

target/riscv/cpu.h: spelling fix: separatly

Fixes: 40336d5b1d4c "target/riscv: Add HS-mode virtual interrupt and IRQ filtering support."
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

include/hw/virtio/vhost.h: spelling fix: sate

Fixes: 4a00d5d7f4b6 "vhost: Add high-level state save/load functions"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

include/hw/hyperv/dynmem-proto.h: spelling fix: nunber, atleast

Fixes: 4f80cd2f033e "Add Hyper-V Dynamic Memory Protocol definitions"
Acked-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

include/block/ufs.h: spelling fix: setted

Fixes: bc4e68d362ec "hw/ufs: Initial commit for emulated Universal-Flash-Storage"
Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

hw/net/cadence_gem.c: spelling fixes: Octects

Fixes: c755c943aa2e "hw/net/cadence_gem: use REG32 macro for register definitions"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Luc Michel <luc.michel@amd.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

hw/mem/memory-device.c: spelling fix: ontaining

Fixes: 6c1b28e9e405 "memory-device: Support empty memory devices"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

contrib/vhost-user-gpu/virgl.c: spelling fix: mesage

Fixes: e3c82fe04f31 "contrib/vhost-user-gpu: add support for sending dmabuf modifiers"
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

migration/rdma.c: spelling fix: asume

Fixes: 67c31c9c1af1 "migration: Don't abuse qemu_file transferred for RDMA"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

target/hppa: spelling fixes: Indicies, Truely

Fixes: bb67ec32a0bb "target/hppa: Include PSW_P in tb flags and mmu index"
Fixes: d7553f3591bb "target/hppa: Populate an interval tree with valid tlb entries"
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

target/arm/tcg: spelling fixes: alse, addreses

Fixes: 179e9a3baccc "target/arm: Define new TB flag for ATA0"
Fixes: 5d7b37b5f675 "target/arm: Implement the CPY* instructions"
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

docs/system/arm/emulation.rst: spelling fix: Enhacements

Fixes: c7c807f6dd6d "target/arm: Implement FEAT_Pauth2"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

docs/devel/migration.rst: spelling fixes: doen't, diferent, responsability, recomend

Fixes: 593c28c02c81 "migration/doc: How to migrate when hosts have different features"
Fixes: 1aefe2ca1423 "migration/doc: Add documentation for backwards compatiblity"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

docs/about/deprecated.rst: spelling fix: becase

Fixes: 864128df465a "migration: Deprecate old compression method"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

gdbstub: spelling fix: respectivelly

Fixes: 761e3c10881b "gdbstub: fixes cases where wrong threads were reported to GDB on SIGINT"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

hw/cxl: spelling fixes: limitaions, potentialy, intialized

Fixes: 388d6b574e28 "hw/cxl: Use switch statements for read and write of cachemem registers"
Fixes: 3314efd276ad "hw/cxl/mbox: Add Physical Switch Identify command."
Fixes: 004e3a93b814 "hw/cxl: Add tunneled command support to mailbox for switch cci."
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

linux-user: spelling fixes: othe, necesary

Fixes: e34136d93059 "linux-user/ppc: Add vdso"
Fixes: 86f04735ac20 "linux-user: Fix brk() to release pages"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

bsd-user: spelling fixes: necesary, agrument, undocummented

Fixes: a99d74034754 "bsd-user: Implement do_obreak function"
Fixes: 8632729060bf "bsd-user: Implement freebsd_exec_common, used in implementing execve/fexecve."
Fixes: bf14f13d8be8 "bsd-user: Implement stat related syscalls"
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

qapi/migration.json: spelling: transfering

Fixes: 074dbce5fcce "migration: New migrate and migrate-incoming argument 'channels'"
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

hw/audio/virtio-snd.c: spelling: initalize

Fixes: eb9ad377bb94 "virtio-sound: handle control messages and streams"
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

qapi/pragma.json: Improve the comment about the lists of QAPI rule exceptions

Let's use more inclusive language here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

tests/data/qobject/qdict.txt: Avoid non-inclusive words

qdict.txt only consists of more or less random test data. We
can simply drop the lines with the problematic words here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

MAINTAINERS: Add tests/decode/ to the "Overall TCG CPUs" section

The tests/decode/ folder belongs to scripts/decodetree.py, so
it should be listed in the same section as the script.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

hw/watchdog/wdt_aspeed: Remove unused 'hw/misc/aspeed_scu.h' header

Aspeed watchdog doesn't use anything from the System Control Unit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

target/sparc: Fix RETURN

Perform window restore before pc update. Required in order
to recognize any window underflow trap with the current pc.

Fixes: 86b82fe021f4 ("target/sparc: Move JMPL, RETT, RETURN to decodetree")
Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

accel/tcg: Forward probe size on to notdirty_write

Without this, we just dirty a single byte, and so if the caller writes
more than one byte to the host memory then we won't have invalidated any
translation blocks that start after the first byte and overlap those
writes. In particular, AArch64's DC ZVA implementation uses probe_access
(via probe_write), and so we don't invalidate the entire block, only the
TB overlapping the first byte (and, in the unusual case an unaligned VA
is given to the instruction, we also probe that specific address in
order to get the right VA reported on an exception, so will invalidate a
TB overlapping that address too). Since our IC IVAU implementation is a
no-op for system emulation that relies on the softmmu already having
detected self-modifying code via this mechanism, this means we have
observably wrong behaviour when jumping to code that has been DC ZVA'ed.
In practice this is an unusual thing for software to do, as in reality
the OS will DC ZVA the page and the application will go and write actual
instructions to it that aren't UDF #0, but you can write a test that
clearly shows the faulty behaviour.

For functions other than probe_access it's not clear what size to use
when 0 is passed in. Arguably a size of 0 shouldn't dirty at all, since
if you want to actually write then you should pass in a real size, but I
have conservatively kept the implementation as dirtying the first byte
in that case so as to avoid breaking any assumptions about that
behaviour.

Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com>
Message-Id: <20231104031232.3246614-1-jrtc27@jrtc27.com>
[rth: Move the dirtysize computation next to notdirty_write.]
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

accel/tcg: Remove CF_LAST_IO

In cpu_exec_step_atomic, we did not set CF_LAST_IO, which lead
to a loop with cpu_io_recompile.

But since 18a536f1f8 ("Always require can_do_io") we no longer
need a flag to indicate when the last insn should have can_do_io set,
so remove the flag entirely.

Reported-by: Clément Chigot <chigot@adacore.com>
Tested-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Claudio Fontana <cfontana@suse.de>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1961
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Update version for v8.2.0-rc0 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-request-2023-11-14' of https://gitlab.com/thuth/qemu into staging

* Fix s390x PV dumps in case of errors

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmVTXR4RHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbUzBg//ZDrzcInE59jo6zuEJiDYdqkauxiJWqdm
# PF3AaemZdww/SZ94960BLCPLm/53L4qeNHl9F4HMoCCqfqp6gUVouc0Rh5kd8/Bn
# 0+ND4Ni20LgKrr/10M8frVreujYhWEtILWA3Ef3HkMWGt45RB8mMwpYwmIZh6DHv
# B45xZaiOWzXNtroGSEBO52MuWzAlbBi68iVCS8xJ/q5xOe0s6julS4EwGo8P6R0c
# VZKlGM8KVndPPiRmG4NSyqpg91fp2p0Zo4Ol6GMSMsljvLB4aSIu0lDMR2FjreIv
# Fjmz78CZbNmgh/7edH1+vj+P083kEGwD7j1WHq4gbFONFdP8Gp0NQjhj/Zl4HsQh
# aCwVMuSdQmg7KEvn1wXc29kL9rBsG/5t5mSPkAzvM/kDahchtltpRxFYgcTGLhNs
# lT4cBjXSmyL2bCc1lX4sEw3/0RZE2GTRtuvP3caJWMZAAxYuE18LstWalPV5ttqe
# p7Xg/XRjOYlM2FGIMI9L5KR4mNKzWduvxnU/3o7qHUOEtWe9mICzCwC8UilLYbjd
# sGRJ5KRYN2nIzqTm0K50rrXPop9zVUHRSl37/9bV9+z6mFAh6Tg4+gIdQPayTo0S
# omRpMUMxmKkKSk1lTFWRr59sxTI+S5ANbRLeApxJsxXGCvoOzAn4nE7fxEpmTR2e
# ocddl9Wg4+w=
# =sFZX
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 14 Nov 2023 06:42:22 EST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2023-11-14' of https://gitlab.com/thuth/qemu:
  target/s390x/arch_dump: Add arch cleanup function for PV dumps
  dump: Add arch cleanup function
  target/s390x/dump: Remove unneeded dump info function pointer init

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging

# -----BEGIN PGP SIGNATURE-----
# Version: GnuPG v1
#
# iQEcBAABAgAGBQJlUt3jAAoJEO8Ells5jWIRX30H/iATyz+77w3Zd2rVfOpyHLhM
# lgvhTwVCltsWdZSZLu6zrLYh419NNcAOyb9/Ci7hKR+x4OmWbP6pme772LRH2Mhz
# zWzVoMXJeW1unjGvBcA8eAIsu3PUKoHLQ1J2dNwHheupMb2LkrWMaEMj10605aZ9
# WnjCFRIiejq4s2JGhofDTa0GCHcFmq2/Nzghb6MMzdPa99QTFnPmYRdIg2bGWd4L
# PmoueuiA/zoDZjx+Y1nC2IzXRq7SvFIAyz91J/zaUtZLD+7QKV/bP+JACTnyzhOY
# coUZnVzFc7q0Gv9wjw2oTNQo5CgKDyw7aDUB8oWsQLR1UvqEICbMhhz29YCWhok=
# =10qX
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Nov 2023 21:39:31 EST
# gpg:                using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [full]
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* tag 'net-pull-request' of https://github.com/jasowang/qemu:
  igb: Add Function Level Reset to PF and VF
  igb: Add a VF reset handler

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'misc-fixes-20231113' of https://github.com/philmd/qemu into staging

Misc fixes for 8.2

- Missing Kconfig dependency in hw/mips (Marc-André)
- Typo in VMWare model (Alexandra)
- New avocado test for x86 processors addressing (Ani)
- Fix SyntaxWarnings in avocado (Thomas)
- Update virtio-fs mailing list address in MAINTAINERS (Stefan)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmVSaAwACgkQ4+MsLN6t
# wN7L9RAAvlX5MKJe6d3+gYV8NciEYFQGWzgSjtc0IzRenYf1wvxXubFnmeTJ3kfF
# VOugAmeQUx5xvD0iPNrYCFn5fb1ZIFDuES25TsUSN38GCfo1/1+pG+wBWPJRwnQg
# LhRHLSzwJOiUSzOEWrVW/4f2TUM1svUM7WKAWB1AbO2Dd3BKzb25/AEdgYWCeQKV
# xrBFUH/owNCnWHxIFfLEO8Gt2WGkCLgblvLpeu5Mzds/5JcAi1Fb9lgpvvYxB1Jk
# Jgb2ic4Lp6+aTxYxS/+EbQcZciM1M7XXVN57xsQZEcave5CQ9fN8dMbTy3GJxEfJ
# OqWzLbwxybQCDA2f2Kd0HEv+U828ZD6/8HDfFk1JmZjE8UJ9vsvdnhQDDJOn5VJu
# INyupPsgaG86jaQavzAQJ7Cehe4SdEX0B11mdPfujooy4FvO79O8AzlMM2YG8ARn
# YydUzc1RnzE9l67RuEPvqiw1htpjJwV32v7nNZzsoBpqHG5OXAAD732OYnu/30a0
# U73tApRwPDUX3kiS8kUvXLq4/2NxFbX5VDx1bcJPTsweGplr59tPzMRpRxKQGhwa
# WEsjjqnDNEjYVzTMVfFRQlvDUkcr5Rrgd51Q3MDbm6inCf2JofT4m7UmvFVmOW3p
# w7IAbiguwyxC+Us9AkPTh03FYlzT2B+3XhKbAxcYJZ5/oH1O3x8=
# =SFhl
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Nov 2023 13:16:44 EST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'misc-fixes-20231113' of https://github.com/philmd/qemu:
  MAINTAINERS: update virtio-fs mailing list address
  tests/avocado/machine_s390_ccw_virtio.py: Fix SyntaxWarnings from python 3.12
  tests/avocado: add test to exercise processor address space memory bound checks
  hw/display/vmware_vga: fix probably typo
  hw/mips: LOONGSON3V depends on UNIMP device

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-target-arm-20231113' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
 * hw/arm/virt: fix GIC maintenance IRQ registration
 * target/arm: HVC at EL3 should go to EL3, not EL2
 * target/arm: Correct MTE tag checking for reverse-copy MOPS
 * target/arm/tcg: enable PMU feature for Cortex-A8 and A9

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmVSYL0ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3iLND/99dZKHgNJx1k7aeGX8t4lU
# MTU0AsFndpx/WjWbviyfrO17B0FIi6kwhggDk2cXrXF26eBFcx5ruJ6sw9R1ZvsV
# y6Z1rhjd+skj3PMxGMU/I0XeR3TXJNo2eLAeKyPy4W75+5I0zT4PMEPJ05WylVTs
# RXuAhlyCXX9uTT2ILtGRiThpRrgnzGE3DU2Ry32s0+qjYq5U89J0+0kYPg6VFg29
# Lfj4zCwVu3/xX7Me+b84bTDxlQD4LSGdibscd0aCiMyamzfLl/naoDLvFIia/Q7h
# 4epcw3Bu+3nTicg70i9k6iNP4nDXPO9V2dbopJVd9wcgPBXicyoDrLA8CQdp+04v
# /vHT9+IZ4pFUcUp1+A9s6CcSMDeYOSPrQsd96HwaTtw/RjpxhLKC6EEpswpr5d4q
# SBU5I6lUe47HuwLxPpqucwNk/o4/9PZKBDSI1SUKoLPVyOvSS0sxJlTdQCyHCgmU
# ogjnFnw9J16X/GOWzS3tUD+9GS8s7WqJHyFl0t5ngvvamFTdquPFSFXQfZMTwAU1
# vVSam4oi51ON2sVjkR7Pn7BrTBE1QnsudB8Sc9If/LGhFSuNUKlj13+pWrGMty+n
# q9fFS5MuNlvVehX3mr+i4PA6WWYCZ0wHzTvXtYxKkyu1CZi53r9H1pZPwb6URjUt
# ceyJngaQH5dgtkVgCNSoRQ==
# =4D8I
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Nov 2023 12:45:33 EST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20231113' of https://git.linaro.org/people/pmaydell/qemu-arm:
  target/arm/tcg: enable PMU feature for Cortex-A8 and A9
  target/arm: Correct MTE tag checking for reverse-copy MOPS
  target/arm: HVC at EL3 should go to EL3, not EL2
  hw/arm/virt: fix GIC maintenance IRQ registration

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-pa-20231113' of https://gitlab.com/rth7680/qemu into staging

target/hppa: Mask reserved PSW bits in expand_sm_imm
target/hppa: Fix calculation of CR_IIASQ back register
target/hppa: Fix possible overflow in TLB size calculation
target/hppa: Fix probe instruction
target/hppa: Split MMU_PHYS_IDX to MMU_ABS_IDX, MMU_ABS_W_IDX
target/hppa: Reduce TARGET_PHYS_ADDR_SPACE_BITS to 40
hw/pci-host/astro: Translate 32-bit pci onto 40-bit runway bus
hw/hppa: Update SeaBIOS-hppa to version 12

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmVSXR4dHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV87qwf+MkEuvMiwqx9YB2qa
# Yhn4m4H1DrQcqGJ2egGuiYrS45JCAUZUcXnmBxL//w3AW7hoeoZwmuFSj+I3EOhI
# y6ykMjMAe8d0VpWEvdkRh7SAWPBKvCJiAclkNyZkYhhagXryiFxqo9tL6nNQQEyz
# HaYzrDwqL+Qgh7/ahkA9XdVLdeTsMtXoLm1cCXpY+TL0MiQonBa1mc17vbyWN8hs
# qWQFBtik0lBIuEN0cB0bUgvV1oH9B8KVUYKbx/RhQORQAiU/O2SaSZ0fxU+F8ynB
# xIyQH6aik0pzgwSo25T/AMxxgUoDydvLDyLCu/R85eNmdgvOj+n4XGIiNEJKEltT
# 1OwGSQ==
# =Qcsh
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Nov 2023 12:30:06 EST
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* tag 'pull-pa-20231113' of https://gitlab.com/rth7680/qemu:
  hw/hppa: Require at least SeaBIOS-hppa version 12
  target/hppa: Update to SeaBIOS-hppa from version 10 to 12
  hw/hppa: Move software power button address to page zero
  hw/pci-host/astro: Fix boot for C3700 machine
  target/hppa: Reduce TARGET_PHYS_ADDR_SPACE_BITS to 40
  target/hppa: Replace MMU_PHYS_IDX with MMU_ABS_IDX, MMU_ABS_W_IDX
  target/hppa: Introduce MMU_IDX_MMU_DISABLED
  target/hppa: Fix possible overflow in TLB size calculation
  target/hppa: Fix calculation of CR_IIASQ back register
  target/hppa: Use PRIV_P_TO_MMU_IDX in helper_probe
  target/hppa: Use only low 2 immediate bits for PROBEI
  target/hppa: Mask reserved PSW bits in expand_sm_imm

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

target/s390x/arch_dump: Add arch cleanup function for PV dumps

PV dumps block vcpu runs until dump end is reached. If there's an
error between PV dump init and PV dump end the vm will never be able
to run again. One example of such an error is insufficient disk space
for the dump file.

Let's add a cleanup function that tries to do a dump end. The dump
completion data is discarded but there's no point in writing it to a
file anyway if there's a possibility that other PV dump data is
missing.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20231109120443.185979-4-frankja@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

dump: Add arch cleanup function

Some architectures (s390x) need to cleanup after a failed dump to be
able to continue to run the vm. Add a cleanup function pointer and
call it if it's set.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20231109120443.185979-3-frankja@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

target/s390x/dump: Remove unneeded dump info function pointer init

dump_state_prepare() now sets the function pointers to NULL so we only
need to touch them if we're going to use them.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20231109120443.185979-2-frankja@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

MAINTAINERS: update virtio-fs mailing list address

The old virtio-fs mailing list address is no longer in use. Switch to
the new mailing list address.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: German Maglione <gmaglione@redhat.com>
Cc: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: German Maglione <gmaglione@redhat.com>
Message-ID: <20231111004920.148348-1-stefanha@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

tests/avocado/machine_s390_ccw_virtio.py: Fix SyntaxWarnings from python 3.12

Python 3.12 now warns about backslashes in strings that aren't used
for escaping a special character from Python. Silence the warning
by using raw strings here instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231113140721.46903-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/hppa: Require at least SeaBIOS-hppa version 12

The new SeaBIOS-hppa version 12 includes the necessary fixes to
support emulated PA2.0 CPUs and which allows starting 64-bit Linux
kernels in the guest.
To boot a 64-bit machine use the "-machine C3700" qemu option.

Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Update to SeaBIOS-hppa from version 10 to 12

SEABIOS_HPPA_VERSION 12 contains those fixes and enhancements:
    - Reduce debug level
    - Update README file for PA-RISC
    - Fix debug name of CPU_HPA_xx if xx >= 10
    - Disable device indexing

SEABIOS_HPPA_VERSION 11 contains those fixes and enhancements
(mostly to enable support for 64-bit Linux kernel):
    - Fixed 64-bit CPU detection via "mfctl,w" instruction
    - Implement PDC_PSW for 64-bit CPUs
    - Added PAT PDC functions:
        - PDC_PAT_CELL
        - PDC_PAT_CHASSIS_LOG
        - PDC_PAT_PD_GET_ADDR_MAP
        - PDC_PAT_CPU
    - Fix return value of PDC_CACHE_RET_SPID space-id bits
    - Introduce new default software IDs for the machines
    - Fix CPU and FPU model numbers
    - Fix 64-bit SMP rendezvous
    - Fix Linux 64-bit kernel crash in STI due to usage of unsigned
      32-bit "next_font" pointer in sti header files
    - Fix graphics output to LASI artist card on PA2.0 machines
    - More USB OHCI endianess fixes
    - Fixes which make ODE run on B160L
    - Fixes which make ODE detect Astro Runway port and CPUs
    - Implement "firmware unlocking" via PDC_MODEL/PDC_MODEL_CAPABILITIES call
    - Add subfunction 2 for PDC_MODEL_VERSIONS

Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

hw/hppa: Move software power button address to page zero

Something appears to be off between the 64-bit CPU, the 32-bit PDC
(SeaBIOS-hppa firmware), and the 64-bit kernel in addressing the
power button address in high-mapped firmware memory.

Use a 32-bit value at PAGE0->pad0[4] instead.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

hw/pci-host/astro: Fix boot for C3700 machine

Apply the "32-bit PCI addressing on 40-bit Runway" as the default
iommu transformation.  This allows PCI devices to dma PDC memory.

Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Reduce TARGET_PHYS_ADDR_SPACE_BITS to 40

This is the value that is supported by both PA-8500 and Astro.
If we support a larger address space than expected, we trip up
software that did not fill in all of the page table bits,
expecting them to be ignored.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Replace MMU_PHYS_IDX with MMU_ABS_IDX, MMU_ABS_W_IDX

Align the language with pa2.0, separating absolute and physical.
The translation from absolute to physical depends on PSW.W, and
we prefer not to flush between changes, therefore use 2 mmu_idx.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Introduce MMU_IDX_MMU_DISABLED

Reduce the number of direct checks against MMU_PHYS_IDX.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Fix possible overflow in TLB size calculation

Coverty found that the shift of TARGET_PAGE_SIZE (32-bit type) might
overflow.  Fix it by casting TARGET_PAGE_SIZE to a 64-bit type before
doing the shift (CID 1523902 and CID 1523908).

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Message-Id: <ZU6F/H8CZr3q4pP/@p100>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Fix calculation of CR_IIASQ back register

Need to use iasq_b and iaoq_b to determine back register of CR_IIASQ.
This fixes random faults when booting up Linux user space.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Use PRIV_P_TO_MMU_IDX in helper_probe

Direct privilege level to mmu_idx mapping has been
false for some time.  Provide the correct value to
hppa_get_physical_address.

Fixes: fa824d99f9b ("target/hppa: Switch to use MMU indices 11-15")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/hppa: Use only low 2 immediate bits for PROBEI

During the conversion to decodetree, the 2-bit mask was lost.

Fixes: deee69a19fd ("target/hppa: Convert memory management insns")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/arm/tcg: enable PMU feature for Cortex-A8 and A9

According to the technical reference manual, the Cortex-A9
has a Perfomance Unit Monitor (PMU):
https://developer.arm.com/documentation/100511/0401/performance-monitoring-unit/about-the-performance-monitoring-unit
The Cortex-A8 does also.

We already already define the PMU registers when emulating the
Cortex-A8 and Cortex-A9, because we put them in v7_cp_reginfo[]
rather than guarding them behind ARM_FEATURE_PMU.  So the only thing
that setting the feature bit changes is that the registers actually
do something.

Enable ARM_FEATURE_PMU for Cortex-A8 and Cortex-A9, to avoid
this anomaly.

(The A8 and A9 PMU predates the standardisation of ID_DFR0.PerfMon,
so the field there is 0, but the PMU is still present.)

Signed-off-by: Nikita Ostrenkov <n.ostrenkov@gmail.com>
Message-id: 20231112165658.2335-1-n.ostrenkov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: tweaked commit message; also enable PMU for A8]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests/avocado: add test to exercise processor address space memory bound checks

QEMU has validations to make sure that a VM is not started with more memory
(static and hotpluggable memory) than what the guest processor can address
directly with its addressing bits. This change adds a test to make sure QEMU
fails to start with a specific error message when an attempt is made to
start a VM with more memory than what the processor can directly address.
The test also checks for passing cases when the address space of the processor
is capable of addressing all memory. Boundary cases are tested.

CC: imammedo@redhat.com
CC: David Hildenbrand <david@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Message-ID: <20231109045601.33349-1-anisinha@redhat.com>
Message-ID: <D5D8D419-76BA-4FB0-9BAC-4F7470A052FC@redhat.com>
[PMD: Use SPDX tag]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/display/vmware_vga: fix probably typo

When calling trace_vmware_verify_rect_greater_than_bound() replace
"y" with "h" and y with h

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 02218aedb1 ("hw/display/vmware_vga: replace fprintf calls with trace events")
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20231110174104.13280-1-adiupina@astralinux.ru>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/mips: LOONGSON3V depends on UNIMP device

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: qemu-stable@nongnu.org
Fixes: c76b409fef ("hw/mips: Add Loongson-3 machine support")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231107140615.3034763-1-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

target/arm: Correct MTE tag checking for reverse-copy MOPS

When we are doing a FEAT_MOPS copy that must be performed backwards,
we call mte_mops_probe_rev(), passing it the address of the last byte
in the region we are probing.  However, allocation_tag_mem_probe()
wants the address of the first byte to get the tag memory for.
Because we passed it (ptr, size) we could incorrectly trip the
allocation_tag_mem_probe() check for "does this access run across to
the following page", and if that following page happened not to be
valid then we would assert.

We know we will always be only dealing with a single page because the
code that calls mte_mops_probe_rev() ensures that.  We could make
mte_mops_probe_rev() pass 'ptr - (size - 1)' to
allocation_tag_mem_probe(), but then we would have to adjust the
returned 'mem' pointer to get back to the tag RAM for the last byte
of the region.  It's simpler to just pass in a size of 1 byte,
because we know that allocation_tag_mem_probe() in pure-probe
single-page mode doesn't care about the size.

Fixes: 69c51dc3723b ("target/arm: Implement MTE tag-checking functions for FEAT_MOPS copies")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20231110162546.2192512-1-peter.maydell@linaro.org

target/arm: HVC at EL3 should go to EL3, not EL2

AArch64 permits code at EL3 to use the HVC instruction; however the
exception we take should go to EL3, not down to EL2 (see the pseudocode
AArch64.CallHypervisor()). Fix the target EL.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Message-id: 20231109151917.1925107-1-peter.maydell@linaro.org

hw/arm/virt: fix GIC maintenance IRQ registration

Since commit 9036e917f8 ("{include/}hw/arm: refactor virt PPI logic"),
GIC maintenance IRQ registration fails on arm64:

[    0.979743] kvm [1]: Cannot register interrupt 9

That commit re-defined VIRTUAL_PMU_IRQ to be a INTID but missed a case
where the maintenance IRQ is actually referred by its PPI index. Just
like commit fa68ecb330db ("hw/arm/virt: fix PMU IRQ registration"), use
INITID_TO_PPI(). A search of "GIC_FDT_IRQ_TYPE_PPI" indicates that there
shouldn't be more similar issues.

Fixes: 9036e917f8 ("{include/}hw/arm: refactor virt PPI logic")
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20231110090557.3219206-2-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-request-2023-11-13' of https://gitlab.com/thuth/qemu into staging

* Fix compilation with Clang 17 on s390x hosts
* Two small s390x PCI fixes
* Update MAINTAINERS file with more entries
* Fix NetBSD VM test
* Clean up some bad wordings

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmVSAoIRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbVXBg//VVZS5CXEfOFV91I1kqQnLCvgwmuAyqEg
# PI2/HBxuhzeBx+F1t7uR0n15tUPi1zkFFBOpyBDBubvWcp4vGvFwLQoiBCUvNzBA
# +b1vMySP+K0OO1X5yT3cFHXF9q0o0V5WADwemf5RglIPjlTOIiz9qhD4EYqd2QHC
# EUd9Y45DP4Y0V5raHLjY990f/zr3PuSAB6MASFTUnKdgGkRqonLWdLDdIZNDrZuL
# oGwx1ALXgBOMV3yNyQx9jZBT24git/ai1vd9AU/d3JRKDPsd+4vC39+PTI9NH4h6
# oQglvo399f64cir1f1JJ3MN4ZtwXZpwUkjeTMcR9XZxk7GibU7P2arG5M3TERdmE
# VLqylYsnbJojWOeCH+TViJapRhg1CzUveVlQofr7GHvf2N3oy3BrKaV715gauEyW
# zpjbhSPpIQu9WFXt8+tSquqbvpAP/VlLrOV73D4LzJ7WdTa9CHmSek8D0zoRQDZR
# 8OixrgoBKS+pmBDmTve5gFsIKhZIz9CrmaAKKYdskC8blENxCng8LOFp7sg2PK3M
# U0lWYoDS7qZ85761Bl+QaBdFocdahQqkO/LUQuhoSt2OvA1EGAz2FdVSKkmPDdSS
# P/homr4hOXIqJFSsZj0YNUTIXsXwLBvKjvcJPAWYgbXZhim0LtPQTQO3+ignwGyu
# RXjaVkvkf/s=
# =+2rp
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Nov 2023 06:03:30 EST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2023-11-13' of https://gitlab.com/thuth/qemu:
  hw/audio/es1370: Clean up comment
  tests/tsan: Rename the file with the entries that should be ignored
  test-resv-mem: Fix CID 1523911
  tests/vm/netbsd: Use Python v3.11
  MAINTAINERS: Add a general architecture section for x86
  MAINTAINERS: Extend the Stellaris section
  MAINTAINERS: Add hw/display/sii9022.c to the Versatile Express section
  MAINTAINERS: Add hw/input/ads7846.c to the PXA2XX section
  MAINTAINERS: Add include/hw/input/pl050.h to the PrimeCell/CMSDK section
  s390x/pci: only limit DMA aperture if vfio DMA limit reported
  s390x/pci: bypass vfio DMA counting when using cdev
  host/include/generic/host/atomic128: Fix compilation problem with Clang 17

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-qapi-2023-11-13' of https://repo.or.cz/qemu/armbru into staging

QAPI patches patches for 2023-11-13

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmVR7j4SHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTmT0P/imN9c6xnkx8Kff0iEaT88N8YUHEu5gt
# ECiQtfpbU8y8itIrWpuXWk7HUC1Jp397vKgUhmmr5Im32vx1waUGz/zxdBiitw0a
# 2McXfD6Lbz3LN+q002Vq0QjP3tMeoc8DoP/CagmdXniGrxyJSs/oIsUAdqZnymug
# ZREYRUlbrgJ8XA06n9qIaCGpiihBLl2XBbx4SV9JWle/9vKpII9EBrWNXTcCkde3
# W6gHEKgGAKa1NGYMJtOncanpnzVP0qoLmb3jmiR9tpj3YBB/5LP9l4O11DTC+PQ5
# nn+OmtmjuKE2a2C79Y8VCbRPR6MPSDDbuWwu7Q+A7vXi/1gnkMeXH+A6jE0d3y+p
# PWKqBK65U+yS0IwiUGpMpcGo2WtZiBLzp3ragt+gzi3gV5GvEvPv0uvcEd66in95
# +M2RoVhkbi+e03mF+vDldvbwBYPwlNdgAX/ly7SR76YZybSMK0Jkp7yfvxN35LJc
# kgCo0CY9kAYYUgPUJMiPhaxSfRVk738Qex7QCvFwDiZE8l4XEwoT1PRO0fs8G5aI
# /Yz7hhjkaLw+i+k/tCVCVe+hOgMxxVUz/gZzV4+yrfQNxz41v4WqCfE8a+m6RROo
# TaceVJPKqsyoJ2zmS+CpEPFWkWXEQSQ14yu2wdF8wMyKEWDS4yhRG78rnYC2/ZhC
# zullCL7QfFbf
# =bGOD
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Nov 2023 04:37:02 EST
# gpg:                using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg:                issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* tag 'pull-qapi-2023-11-13' of https://repo.or.cz/qemu/armbru:
  tests/qapi-schema: Tidy up pylint warnings and advice
  sphinx/qapidoc: Tidy up pylint warning raise-missing-from
  qapi: Fix QAPISchemaEntity.__repr__()

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>