Re: [PATCH 03/14] hw/block/nvme: rename __nvme_select_ns_iocs

2021-04-19 Thread Thomas Huth

On 19/04/2021 21.27, Klaus Jensen wrote:

From: Klaus Jensen 

Get rid of the (reserved) double underscore use.

Cc: Philippe Mathieu-Daudé 
Cc: Thomas Huth 
Signed-off-by: Klaus Jensen 
---
  hw/block/nvme.c | 47 +++
  1 file changed, 23 insertions(+), 24 deletions(-)


Reviewed-by: Thomas Huth 




Re: [PATCH 02/14] hw/block/nvme: rename __nvme_advance_zone_wp

2021-04-19 Thread Thomas Huth

On 19/04/2021 21.27, Klaus Jensen wrote:

From: Klaus Jensen 

Get rid of the (reserved) double underscore use.

Cc: Philippe Mathieu-Daudé 
Cc: Thomas Huth 
Signed-off-by: Klaus Jensen 
---
  hw/block/nvme.c | 8 
  1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 002c0672b397..d1b94e36c6fb 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -1745,8 +1745,8 @@ static inline uint16_t nvme_zrm_open(NvmeNamespace *ns, 
NvmeZone *zone)
  return nvme_zrm_open_flags(ns, zone, 0);
  }
  
-static void __nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone,

-   uint32_t nlb)
+static void nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone,
+ uint32_t nlb)
  {
  zone->d.wp += nlb;
  
@@ -1766,7 +1766,7 @@ static void nvme_finalize_zoned_write(NvmeNamespace *ns, NvmeRequest *req)

  nlb = le16_to_cpu(rw->nlb) + 1;
  zone = nvme_get_zone_by_slba(ns, slba);
  
-__nvme_advance_zone_wp(ns, zone, nlb);

+nvme_advance_zone_wp(ns, zone, nlb);
  }
  
  static inline bool nvme_is_write(NvmeRequest *req)

@@ -2155,7 +2155,7 @@ out:
  uint64_t sdlba = le64_to_cpu(copy->sdlba);
  NvmeZone *zone = nvme_get_zone_by_slba(ns, sdlba);
  
-__nvme_advance_zone_wp(ns, zone, ctx->nlb);

+nvme_advance_zone_wp(ns, zone, ctx->nlb);
  }
  
  g_free(ctx->bounce);




Reviewed-by: Thomas Huth 




Re: [PATCH 01/14] hw/block/nvme: rename __nvme_zrm_open

2021-04-19 Thread Thomas Huth

On 19/04/2021 21.27, Klaus Jensen wrote:

From: Klaus Jensen 

Get rid of the (reserved) double underscore use.

Cc: Philippe Mathieu-Daudé 
Cc: Thomas Huth 
Signed-off-by: Klaus Jensen 
---
  hw/block/nvme.c | 16 ++--
  1 file changed, 10 insertions(+), 6 deletions(-)


I think it would be good to mention the change with NVME_ZRM_AUTO in the 
patch description, too.


Apart from that:
Reviewed-by: Thomas Huth 




[PATCH] migration: Deprecate redundant query-migrate result @blocked

2021-04-19 Thread Markus Armbruster
Result @blocked is true when and only when result @blocked-reasons is
present.  It's always non-empty when present.  @blocked is redundant.
It was introduced in commit 3af8554bd0 "migration: Add blocker
information", and has not been released.  This gives us a chance to
fix the interface with minimal fuss.

Unfortunately, we're already too close to the release to risk dropping
it.  Deprecate it instead.

Signed-off-by: Markus Armbruster 
---
This is alternative to "[PATCH v2] migration: Drop redundant
query-migrate result @blocked".

 qapi/migration.json | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 9bf0bc4d25..0b17cce46b 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -224,9 +224,14 @@
 #only returned if VFIO device is present, migration is supported by all
 #VFIO devices and status is 'active' or 'completed' (since 5.2)
 #
+# @blocked-reasons: A list of reasons an outgoing migration is blocked.
+#   Present and non-empty when migration is blocked.
+#   (since 6.0)
+#
 # @blocked: True if outgoing migration is blocked (since 6.0)
 #
-# @blocked-reasons: A list of reasons an outgoing migration is blocked (since 
6.0)
+# Features:
+# @deprecated: Member @blocked is deprecated.  Use @blocked-reasons instead.
 #
 # Since: 0.14
 ##
@@ -241,7 +246,7 @@
'*setup-time': 'int',
'*cpu-throttle-percentage': 'int',
'*error-desc': 'str',
-   'blocked': 'bool',
+   'blocked': { 'type': 'bool', 'features': [ 'deprecated' ] },
'*blocked-reasons': ['str'],
'*postcopy-blocktime' : 'uint32',
'*postcopy-vcpu-blocktime': ['uint32'],
-- 
2.26.3




[PATCH v2] migration: Drop redundant query-migrate result @blocked

2021-04-19 Thread Markus Armbruster
Result @blocked is true when and only when result @blocked-reasons is
present.  It's always non-empty when present.  @blocked is redundant.
It was introduced in commit 3af8554bd0 "migration: Add blocker
information", and has not been released.  This gives us a chance to
fix the interface with minimal fuss: drop @blocked.

Signed-off-by: Markus Armbruster 
---
This is alternative to "[PATCH] migration: Deprecate redundant
query-migrate result @blocked".

 qapi/migration.json   |  7 +++
 migration/migration.c | 29 +
 monitor/hmp-cmds.c|  2 +-
 3 files changed, 17 insertions(+), 21 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 9bf0bc4d25..7a5bdf9a0d 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -224,9 +224,9 @@
 #only returned if VFIO device is present, migration is supported by all
 #VFIO devices and status is 'active' or 'completed' (since 5.2)
 #
-# @blocked: True if outgoing migration is blocked (since 6.0)
-#
-# @blocked-reasons: A list of reasons an outgoing migration is blocked (since 
6.0)
+# @blocked-reasons: A list of reasons an outgoing migration is blocked.
+#   Present and non-empty when migration is blocked.
+#   (since 6.0)
 #
 # Since: 0.14
 ##
@@ -241,7 +241,6 @@
'*setup-time': 'int',
'*cpu-throttle-percentage': 'int',
'*error-desc': 'str',
-   'blocked': 'bool',
'*blocked-reasons': ['str'],
'*postcopy-blocktime' : 'uint32',
'*postcopy-vcpu-blocktime': ['uint32'],
diff --git a/migration/migration.c b/migration/migration.c
index 8ca034136b..fdadee290e 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1073,27 +1073,24 @@ static void populate_vfio_info(MigrationInfo *info)
 static void fill_source_migration_info(MigrationInfo *info)
 {
 MigrationState *s = migrate_get_current();
+GSList *cur_blocker = migration_blockers;
 
-info->blocked = migration_is_blocked(NULL);
-info->has_blocked_reasons = info->blocked;
 info->blocked_reasons = NULL;
-if (info->blocked) {
-GSList *cur_blocker = migration_blockers;
 
-/*
- * There are two types of reasons a migration might be blocked;
- * a) devices marked in VMState as non-migratable, and
- * b) Explicit migration blockers
- * We need to add both of them here.
- */
-qemu_savevm_non_migratable_list(>blocked_reasons);
+/*
+ * There are two types of reasons a migration might be blocked;
+ * a) devices marked in VMState as non-migratable, and
+ * b) Explicit migration blockers
+ * We need to add both of them here.
+ */
+qemu_savevm_non_migratable_list(>blocked_reasons);
 
-while (cur_blocker) {
-QAPI_LIST_PREPEND(info->blocked_reasons,
-  g_strdup(error_get_pretty(cur_blocker->data)));
-cur_blocker = g_slist_next(cur_blocker);
-}
+while (cur_blocker) {
+QAPI_LIST_PREPEND(info->blocked_reasons,
+  g_strdup(error_get_pretty(cur_blocker->data)));
+cur_blocker = g_slist_next(cur_blocker);
 }
+info->has_blocked_reasons = info->blocked_reasons != NULL;
 
 switch (s->state) {
 case MIGRATION_STATUS_NONE:
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index 0ad5b77477..d9bef63373 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -224,7 +224,7 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
 
 migration_global_dump(mon);
 
-if (info->blocked) {
+if (info->blocked_reasons) {
 strList *reasons = info->blocked_reasons;
 monitor_printf(mon, "Outgoing migration blocked:\n");
 while (reasons) {
-- 
2.26.3




Re: [PATCH for-6.0] migration: Drop redundant query-migrate result @blocked

2021-04-19 Thread Markus Armbruster
"Dr. David Alan Gilbert"  writes:

> * Peter Maydell (peter.mayd...@linaro.org) wrote:
>> On Mon, 19 Apr 2021 at 17:27, Markus Armbruster  wrote:
>> >
>> > Result @blocked is true when and only when result @blocked-reasons is
>> > present.  It's always non-empty when present.  @blocked is redundant;
>> > drop.
>> >
>> > Signed-off-by: Markus Armbruster 
>
> So I'm OK with it in principal and I think the code is OK, so
>
> Reviewed-by: Dr. David Alan Gilbert 
>
>> "for-6.0" needs to be accompanied by a justification of why it's
>> important to go in the release at this point...

You're right.  My bad.

> I guess the argument is that when we hit 6.0 it becomes API and removing
> the 'blocked' becomes a matter of deprecation which is a pain.

Correct.

> Hmm; I agree it's the right change, but I'm not sure I can justify it
> this late in the release.

If we decide taking it out is too late, we should at least deprecate it
in 6.0.  I'll post the patch, so you guys can pick the one you like
better.




Re: [PATCH 1/2] tests/docker: gcc-10 based images for ppc64{,le} tests

2021-04-19 Thread David Gibson
On Mon, Apr 19, 2021 at 10:33:07PM -0300, matheus.fe...@eldorado.org.br wrote:
> From: Matheus Ferst 
> 
> A newer compiler is needed to build tests for Power10 instructions. As
> done for arm64 on c729a99d2701, a new '-test-cross' image is created for
> ppc64 and ppc64le. As done on 936fda4d771f, a test for compiler support
> is added to verify that the toolchain in use has '-mpower10'.
> 
> Signed-off-by: Matheus Ferst 
> ---
>  tests/docker/Makefile.include   |  2 ++
>  .../debian-powerpc-test-cross.docker| 17 +
>  tests/tcg/configure.sh  | 12 
>  3 files changed, 27 insertions(+), 4 deletions(-)
>  create mode 100644 tests/docker/dockerfiles/debian-powerpc-test-cross.docker
> 
> diff --git a/tests/docker/Makefile.include b/tests/docker/Makefile.include
> index 9f464cb92c..f1dbcc639f 100644
> --- a/tests/docker/Makefile.include
> +++ b/tests/docker/Makefile.include
> @@ -152,10 +152,12 @@ docker-image-debian-sparc64-cross: docker-image-debian10
>  docker-image-debian-tricore-cross: docker-image-debian10
>  docker-image-debian-all-test-cross: docker-image-debian10
>  docker-image-debian-arm64-test-cross: docker-image-debian11
> +docker-image-debian-power-test-cross: docker-image-debian11
>  
>  # These images may be good enough for building tests but not for test builds
>  DOCKER_PARTIAL_IMAGES += debian-alpha-cross
>  DOCKER_PARTIAL_IMAGES += debian-arm64-test-cross
> +DOCKER_PARTIAL_IMAGES += debian-power-test-cross

You add these "power" (as opposed to "powerpc" or "ppc64" or whatever)
images here, but they don't seem to be referenced anywhere else.

>  DOCKER_PARTIAL_IMAGES += debian-hppa-cross
>  DOCKER_PARTIAL_IMAGES += debian-m68k-cross debian-mips64-cross
>  DOCKER_PARTIAL_IMAGES += debian-powerpc-cross debian-ppc64-cross
> diff --git a/tests/docker/dockerfiles/debian-powerpc-test-cross.docker 
> b/tests/docker/dockerfiles/debian-powerpc-test-cross.docker
> new file mode 100644
> index 00..36b336f709
> --- /dev/null
> +++ b/tests/docker/dockerfiles/debian-powerpc-test-cross.docker
> @@ -0,0 +1,17 @@
> +#
> +# Docker powerpc/ppc64/ppc64le cross-compiler target
> +#
> +# This docker target builds on the debian Bullseye base image.
> +#
> +FROM qemu/debian11
> +
> +RUN apt update && \
> +DEBIAN_FRONTEND=noninteractive eatmydata \
> +apt install -y --no-install-recommends \
> +gcc-powerpc-linux-gnu \
> +libc6-dev-powerpc-cross \
> +gcc-10-powerpc64-linux-gnu \
> +libc6-dev-ppc64-cross \
> +gcc-10-powerpc64le-linux-gnu \
> +libc6-dev-ppc64el-cross

I'm not really clear on what distinguishes a -cross.docker image and a
-test-cross.docker image.

> diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh
> index fa1a4261a4..a0be066499 100755
> --- a/tests/tcg/configure.sh
> +++ b/tests/tcg/configure.sh
> @@ -170,13 +170,13 @@ for target in $target_list; do
>;;
>  ppc64-*)
>container_hosts=x86_64
> -  container_image=debian-ppc64-cross
> -  container_cross_cc=powerpc64-linux-gnu-gcc
> +  container_image=debian-powerpc-test-cross
> +  container_cross_cc=powerpc64-linux-gnu-gcc-10
>;;
>  ppc64le-*)
>container_hosts=x86_64
> -  container_image=debian-ppc64el-cross
> -  container_cross_cc=powerpc64le-linux-gnu-gcc
> +  container_image=debian-powerpc-test-cross
> +  container_cross_cc=powerpc64le-linux-gnu-gcc-10

Doesn't this remove all uses of the debian-pp64-cross and
debian-ppc64el-cross images, in which case you could remove the
matching docker files and so forth too, no?

>;;
>  riscv64-*)
>container_hosts=x86_64
> @@ -280,6 +280,10 @@ for target in $target_list; do
> -mpower8-vector -o $TMPE $TMPC; then
>  echo "CROSS_CC_HAS_POWER8_VECTOR=y" >> $config_target_mak
>  fi
> +if do_compiler "$target_compiler" $target_compiler_cflags \
> +   -mpower10 -o $TMPE $TMPC; then
> +echo "CROSS_CC_HAS_POWER10=y" >> $config_target_mak
> +fi
>  ;;
>  i386-linux-user)
>  if do_compiler "$target_compiler" $target_compiler_cflags \

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature


Re: [PATCH] xen-mapcache: avoid a race on memory map while using MAP_FIXED

2021-04-19 Thread no-reply
Patchew URL: 
https://patchew.org/QEMU/1618889702-13104-1-git-send-email-igor.druzhi...@citrix.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 1618889702-13104-1-git-send-email-igor.druzhi...@citrix.com
Subject: [PATCH] xen-mapcache: avoid a race on memory map while using MAP_FIXED

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 * [new tag] 
patchew/1618889702-13104-1-git-send-email-igor.druzhi...@citrix.com -> 
patchew/1618889702-13104-1-git-send-email-igor.druzhi...@citrix.com
Switched to a new branch 'test'
3102519 xen-mapcache: avoid a race on memory map while using MAP_FIXED

=== OUTPUT BEGIN ===
ERROR: Author email address is mangled by the mailing list
#2: 
Author: Igor Druzhinin via 

total: 1 errors, 0 warnings, 21 lines checked

Commit 31025199a1b4 (xen-mapcache: avoid a race on memory map while using 
MAP_FIXED) has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/1618889702-13104-1-git-send-email-igor.druzhi...@citrix.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

[PATCH] xen-mapcache: avoid a race on memory map while using MAP_FIXED

2021-04-19 Thread Igor Druzhinin via
When we're replacing the existing mapping there is possibility of a race
on memory map with other threads doing mmap operations - the address being
unmapped/re-mapped could be occupied by another thread in between.

Linux mmap man page recommends keeping the existing mappings in place to
reserve the place and instead utilize the fact that the next mmap operation
with MAP_FIXED flag passed will implicitly destroy the existing mappings
behind the chosen address. This behavior is guaranteed by POSIX / BSD and
therefore is portable.

Note that it wouldn't make the replacement atomic for parallel accesses to
the replaced region - those might still fail with SIGBUS due to
xenforeignmemory_map not being atomic. So we're still not expecting those.

Tested-by: Anthony PERARD 
Signed-off-by: Igor Druzhinin 
---
 hw/i386/xen/xen-mapcache.c | 15 ++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/i386/xen/xen-mapcache.c b/hw/i386/xen/xen-mapcache.c
index 5b120ed..e82b7dc 100644
--- a/hw/i386/xen/xen-mapcache.c
+++ b/hw/i386/xen/xen-mapcache.c
@@ -171,7 +171,20 @@ static void xen_remap_bucket(MapCacheEntry *entry,
 if (!(entry->flags & XEN_MAPCACHE_ENTRY_DUMMY)) {
 ram_block_notify_remove(entry->vaddr_base, entry->size);
 }
-if (munmap(entry->vaddr_base, entry->size) != 0) {
+
+/*
+ * If an entry is being replaced by another mapping and we're using
+ * MAP_FIXED flag for it - there is possibility of a race for vaddr
+ * address with another thread doing an mmap call itself
+ * (see man 2 mmap). To avoid that we skip explicit unmapping here
+ * and allow the kernel to destroy the previous mappings by replacing
+ * them in mmap call later.
+ *
+ * Non-identical replacements are not allowed therefore.
+ */
+assert(!vaddr || (entry->vaddr_base == vaddr && entry->size == size));
+
+if (!vaddr && munmap(entry->vaddr_base, entry->size) != 0) {
 perror("unmap fails");
 exit(-1);
 }
-- 
2.7.4




Re: [PATCH qemu v18] spapr: Implement Open Firmware client interface

2021-04-19 Thread David Gibson

Overall, looking good.  I'm pretty much happy to take it into 6.1.  I
do have quite a few comments below, but they're basically all just
polish.

On Wed, Mar 31, 2021 at 01:53:08PM +1100, Alexey Kardashevskiy wrote:
> The PAPR platform which describes an OS environment that's presented by

Nit: remove "which" and this will become a sentence.

> a combination of a hypervisor and firmware. The features it specifies
> require collaboration between the firmware and the hypervisor.
> 
> Since the beginning, the runtime component of the firmware (RTAS) has
> been implemented as a 20 byte shim which simply forwards it to
> a hypercall implemented in qemu. The boot time firmware component is
> SLOF - but a build that's specific to qemu, and has always needed to be
> updated in sync with it. Even though we've managed to limit the amount
> of runtime communication we need between qemu and SLOF, there's some,
> and it has become increasingly awkward to handle as we've implemented
> new features.
> 
> This implements a boot time OF client interface (CI) which is
> enabled by a new "x-vof" pseries machine option (stands for "Virtual Open
> Firmware). When enabled, QEMU implements the custom H_OF_CLIENT hcall
> which implements Open Firmware Client Interface (OF CI). This allows
> using a smaller stateless firmware which does not have to manage
> the device tree.

The above is a really good description of the rationale, thanks.

> The new "vof.bin" firmware image is included with source code under
> pc-bios/. It also includes RTAS blob.
> 
> This implements a handful of CI methods just to get -kernel/-initrd
> working. In particular, this implements the device tree fetching and
> simple memory allocator - "claim" (an OF CI memory allocator) and updates
> "/memory@0/available" to report the client about available memory.
> 
> This implements changing some device tree properties which we know how
> to deal with, the rest is ignored. To allow changes, this skips
> fdt_pack() when x-vof=on as not packing the blob leaves some room for
> appending.
> 
> In absence of SLOF, this assigns phandles to device tree nodes to make
> device tree traversing work.
> 
> When x-vof=on, this adds "/chosen" every time QEMU (re)builds a tree.
> 
> This adds basic instances support which are managed by a hash map
> ihandle -> [phandle].
> 
> Before the guest started, the used memory is:
> 0..e60 - the initial firmware
> 8000..1 - stack
> 40.. - kernel
> 3ea.. - initramdisk

This memory map info would probably be more useful in a comment
somewhere in the code than in the commit message.


> This OF CI does not implement "interpret".
> 
> Unlike SLOF, this does not format uninitialized nvram. Instead, this
> includes a disk image with pre-formatted nvram.
> 
> With this basic support, this can only boot into kernel directly.
> However this is just enough for the petitboot kernel and initradmdisk to
> boot from any possible source. Note this requires reasonably recent guest
> kernel with:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=df5be5be8735
> 
> The immediate benefit is much faster booting time which especially
> crucial with fully emulated early CPU bring up environments. Also this
> may come handy when/if GRUB-in-the-userspace sees light of the day.
> 
> This separates VOF and sPAPR in a hope that VOF bits may be reused by
> other POWERPC boards which do not support pSeries.
> 
> This is coded in assumption that later on we might be adding support for
> booting from QEMU backends (blockdev is the first candidate) without
> devices/drivers in between as OF1275 does not require that and
> it is quite easy to so.
> 
> Signed-off-by: Alexey Kardashevskiy 
> ---
> 
> The example command line is:
> 
> /home/aik/pbuild/qemu-killslof-localhost-ppc64/qemu-system-ppc64 \
> -nodefaults \
> -chardev stdio,id=STDIO0,signal=off,mux=on \
> -device spapr-vty,id=svty0,reg=0x71000110,chardev=STDIO0 \
> -mon id=MON0,chardev=STDIO0,mode=readline \
> -nographic \
> -vga none \
> -enable-kvm \
> -m 8G \
> -machine 
> pseries,x-vof=on,cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken,cap-ccf-assist=off
>  \
> -kernel pbuild/kernel-le-guest/vmlinux \
> -initrd pb/rootfs.cpio.xz \
> -drive 
> id=DRIVE0,if=none,file=./p/qemu-killslof/pc-bios/vof-nvram.bin,format=raw \
> -global spapr-nvram.drive=DRIVE0 \
> -snapshot \
> -smp 8,threads=8 \
> -L /home/aik/t/qemu-ppc64-bios/ \
> -trace events=qemu_trace_events \
> -d guest_errors \
> -chardev socket,id=SOCKET0,server,nowait,path=qemu.mon.tmux26 \
> -mon chardev=SOCKET0,mode=control
> 
> ---
> Changes:
> v18:
> * fixed top addr (max address for "claim") on radix - it equals to ram_size
> and vof->top_addr was uint32_t
> * fixed "available" property which got broken in v14 but it is only visible
> to clients which care (== grub)
> * reshuffled vof_dt_memory_available() calls, added vof_init() to allow
> vof_claim() before rendering the FDT
> 
> v17:
> * mv hw/ppc/vof.h 

Re: [PATCH 13/32] linux-headers: Add placeholder for KVM_CAP_SGX_ATTRIBUTE

2021-04-19 Thread Yang Zhong
On Tue, Apr 20, 2021 at 02:08:44PM +1200, Kai Huang wrote:
> On Mon, 2021-04-19 at 18:01 +0800, Yang Zhong wrote:
> > From: Sean Christopherson 
> > 
> > KVM_CAP_SGX_ATTRIBUTE is a proposed capability for Intel SGX that can be
> > used by userspace to enable privileged attributes, e.g. access to the
> > PROVISIONKEY.
> > 
> > Signed-off-by: Sean Christopherson 
> > Signed-off-by: Yang Zhong 
> > ---
> >  linux-headers/linux/kvm.h | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
> > index 020b62a619..0961b03007 100644
> > --- a/linux-headers/linux/kvm.h
> > +++ b/linux-headers/linux/kvm.h
> > @@ -1056,6 +1056,7 @@ struct kvm_ppc_resize_hpt {
> >  #define KVM_CAP_ENFORCE_PV_FEATURE_CPUID 190
> >  #define KVM_CAP_SYS_HYPERV_CPUID 191
> >  #define KVM_CAP_DIRTY_LOG_RING 192
> > +#define KVM_CAP_SGX_ATTRIBUTE 195
> >  
> > 
> This needs to be changed to 196, since KVM SGX code has changed to 196.
>
  Justly double confirmed from the sgx code in the kvm queue branch, i will
  change this value in the next version, thanks!

  Yang  



Re: [PATCH] target/riscv: fix exception index on instruction access fault

2021-04-19 Thread Alistair Francis
On Tue, Apr 20, 2021 at 10:56 AM Alistair Francis  wrote:
>
> On Sat, Apr 17, 2021 at 12:48 AM Emmanuel Blot  
> wrote:
> >
> > When no MMU is used and the guest code attempts to fetch an instruction
> > from an invalid memory location, the exception index defaults to a data
> > load access fault, rather an instruction access fault.
> >
> > Signed-off-by: Emmanuel Blot 
>
> Reviewed-by: Alistair Francis 

Thanks!

Applied to riscv-to-apply.next

Alistair

>
> Alistair
>
> >
> > ---
> >   target/riscv/cpu_helper.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> > index 21c54ef5613..4e107b1bd23 100644
> > --- a/target/riscv/cpu_helper.c
> > +++ b/target/riscv/cpu_helper.c
> > @@ -691,8 +691,10 @@ void riscv_cpu_do_transaction_failed(CPUState *cs,
> > hwaddr physaddr,
> >
> >   if (access_type == MMU_DATA_STORE) {
> >   cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
> > -} else {
> > +} else if (access_type == MMU_DATA_LOAD) {
> >   cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
> > +} else {
> > +cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
> >   }
> >
> >   env->badaddr = addr;
> > --
> > 2.31.1
> >



Re: [PATCH RFC 0/7] RFC: Asynchronous QMP Draft

2021-04-19 Thread John Snow

On 4/19/21 10:26 PM, John Snow wrote:

On 4/15/21 5:52 AM, Stefan Hajnoczi wrote:

Yeah, it seems very nice for allowing multiple event listeners that
don't steal each other's events. I like it.

qmp.event_listener() could take a sequence of QMP event names to trigger
on. If the sequence is empty then all QMP events will be reported.


I made something like this:


# Example 1
with qmp.listener('STOP') as listener:
     await qmp.execute('stop')
     await listener.get()


# Example 2
with qmp.listener('JOB_STATUS_CHANGE') as listener:
     await qmp.execute('blockdev-create', ...)
     async for event in listener:
     if event['data']['status'] == 'concluded':
     break
     await qmp.execute('job-dismiss', ...)


# Example 3 - all events
with qmp.listener() as events:
     async for event in events:
     print(f"got '{event['event']}' event!")


# Example 4 - several events on one listener
job_events = (
     'JOB_STATUS_CHANGE', 'BLOCK_JOB_COMPLETED', 'BLOCK_JOB_CANCELLED',
     'BLOCK_JOB_ERROR', 'BLOCK_JOB_READY', 'BLOCK_JOB_PENDING'
)
with qmp.listener(job_events) as events:
     ...


There is a *post-filtering* syntax available to EventListener.get(). It 
will filter events out using a very simplistic syntax.



# Example 5 -- a short-hand form of Example 2.
with qmp.listener('JOB_STATUS_CHANGE') as job_events:
     await qmp.execute('blockdev-create', ...)
     await job_events.get(status='concluded')
     await qmp.execute('job-dismiss', ...)



A shortcoming with this interface is that it's easy to create a listener 
that hears multiple events, but it's not easy to create *several 
listeners*. I am not sure what syntax will be the nicest for this, but I 
tried by allowing the manual creation of listeners:



# Example 6
listener1 = EventListener('JOB_STATUS_CHANGE')
listener2 = EventListener(job_events)

# Note the use of listen() instead of listener()
with qmp.listen(listener1, listener2) as (ev1, ev2):
     # listeners are now active.
     ...
# listeners are now inactive.
# The context manager clears any stale events in the listener(s).


I thought this might be nicer than trying to extend the listener syntax:

with qmp.listeners(
     'JOB_STATUS_CHANGE',
     (job_events)
) as (
     listener1,
     listener2,
):
     ...

especially because it might get confusing when trying to separate "one 
listener with multiple events" vs "several listeners with one event 
each, and it makes things a little ambiguous:


with qmp.listeners('STOP') as (stop_events,):
     ...

And this isn't any prettier, and also likely to confuse:

with qmp.listeners('STOP', 'RESUME') as (stops, resumes):
     ...

because it's only so very subtly different from this:

with qmp.listeners(('STOP', 'RESUME')) as (runstate_events,):
     ...

This also doesn't begin to address one of the worst headaches of writing 
iotests where transactions are involved: accidentally eating events 
meant for other jobs.


I prototyped something where it's possible to create an EventListener 
with an optional pre-filter, but it's a little bulky:



# Example 7
listener = EventListener('JOB_STATUS_CHANGE',
  lambda e: e['data']['id'] == 'job0')

with qmp.listen(listener):
     await qmp.execute('blockdev-create', arguments={'job-id': 'job0'})
     await listener.get(status='created')
     ...


Some thoughts on this:
- Pre-filters are powerful, but involve a lot of boilerplate.
- Accepting two kinds of parameters, name(s) and filter both, makes it 
even trickier to write concise context blocks; especially with multiple 
jobs.



Here's a final example of something you may very well want to do in 
iotest code:



# Example 8

def job_filter(job_id: str) -> EventFilter:
     def filter(event: Message) -> bool:
     return event.get('data', {}).get('id') == job_id
     return filter

listener1 = EventListener('JOB_STATUS_CHANGE', job_filter('job0'))
listener2 = EventListener('JOB_STATUS_CHANGE', job_filter('job1'))

with qmp.listen(listener1, listener2) as (job0, job1):
     await asyncio.gather(
     qmp.execute('blockdev-create', arguments={'job-id': 'job0'}),
     qmp.execute('blockdev-create', arguments={'job-id': 'job1'}),
     job0.get(status='concluded'),
     job1.get(status='concluded')
     )

(Note: gather isn't required here. You could write the execute and get 
statements individually and in whichever order you wanted, as long as 
the execute statement for a given job appears prior to the corresponding 
wait!)


The difficulty I have here is extending that backwards to the "create 
listener on the fly" syntax, for the reasons stated above with making it 
ambiguous as to whether we're creating one or two listeners, etc. Trying 
to minimize boilerplate while leaving the interfaces generic and 
powerful is tough.


I'm still playing around with different options and solutions, but your 
feedback/input is welcome.


--js



Oh, though of course, the moment I sent this, I 

[Bug 1925109] [NEW] usbredirparser: bulk transfer length exceeds limits

2021-04-19 Thread hjiayz
Public bug reported:

2021-04-20T01:26:36.662244Z qemu-system-x86_64: usbredirparser: bulk transfer 
length exceeds limits 131072 > 65536
2021-04-20T01:26:36.662276Z qemu-system-x86_64: usbredirparser: error 
usbredirparser_send_* call invalid params, please report!!
2021-04-20T01:26:57.670412Z qemu-system-x86_64: usbredirparser: bulk transfer 
length exceeds limits 131072 > 65536
2021-04-20T01:26:57.670445Z qemu-system-x86_64: usbredirparser: error 
usbredirparser_send_* call invalid params, please report!!
2021-04-20T01:37:01.920613Z qemu-system-x86_64: usbredirparser: bulk transfer 
length exceeds limits 131072 > 65536
2021-04-20T01:37:01.920624Z qemu-system-x86_64: usbredirparser: error 
usbredirparser_send_* call invalid params, please report!!
host:
Linux version 5.11.15-arch1-2 (linux@archlinux) (gcc (GCC) 10.2.0, GNU ld (GNU 
Binutils) 2.36.1) #1 SMP PREEMPT Sat, 17 Apr 2021 00:22:30 +
guest:
win10 20H2
usb device:
Bus 002 Device 007: ID 0781:55ab SanDisk Corp.  SanDisk 3.2Gen1
size 250G

https://gitlab.freedesktop.org/spice/usbredir/-/blob/master/usbredirparser/usbredirparser.c#L32

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1925109

Title:
  usbredirparser: bulk transfer length exceeds limits

Status in QEMU:
  New

Bug description:
  2021-04-20T01:26:36.662244Z qemu-system-x86_64: usbredirparser: bulk transfer 
length exceeds limits 131072 > 65536
  2021-04-20T01:26:36.662276Z qemu-system-x86_64: usbredirparser: error 
usbredirparser_send_* call invalid params, please report!!
  2021-04-20T01:26:57.670412Z qemu-system-x86_64: usbredirparser: bulk transfer 
length exceeds limits 131072 > 65536
  2021-04-20T01:26:57.670445Z qemu-system-x86_64: usbredirparser: error 
usbredirparser_send_* call invalid params, please report!!
  2021-04-20T01:37:01.920613Z qemu-system-x86_64: usbredirparser: bulk transfer 
length exceeds limits 131072 > 65536
  2021-04-20T01:37:01.920624Z qemu-system-x86_64: usbredirparser: error 
usbredirparser_send_* call invalid params, please report!!
  host:
  Linux version 5.11.15-arch1-2 (linux@archlinux) (gcc (GCC) 10.2.0, GNU ld 
(GNU Binutils) 2.36.1) #1 SMP PREEMPT Sat, 17 Apr 2021 00:22:30 +
  guest:
  win10 20H2
  usb device:
  Bus 002 Device 007: ID 0781:55ab SanDisk Corp.  SanDisk 3.2Gen1
  size 250G

  
https://gitlab.freedesktop.org/spice/usbredir/-/blob/master/usbredirparser/usbredirparser.c#L32

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1925109/+subscriptions



Re: [PATCH RFC 0/7] RFC: Asynchronous QMP Draft

2021-04-19 Thread John Snow

On 4/15/21 5:52 AM, Stefan Hajnoczi wrote:

Yeah, it seems very nice for allowing multiple event listeners that
don't steal each other's events. I like it.

qmp.event_listener() could take a sequence of QMP event names to trigger
on. If the sequence is empty then all QMP events will be reported.


I made something like this:


# Example 1
with qmp.listener('STOP') as listener:
await qmp.execute('stop')
await listener.get()


# Example 2
with qmp.listener('JOB_STATUS_CHANGE') as listener:
await qmp.execute('blockdev-create', ...)
async for event in listener:
if event['data']['status'] == 'concluded':
break
await qmp.execute('job-dismiss', ...)


# Example 3 - all events
with qmp.listener() as events:
async for event in events:
print(f"got '{event['event']}' event!")


# Example 4 - several events on one listener
job_events = (
'JOB_STATUS_CHANGE', 'BLOCK_JOB_COMPLETED', 'BLOCK_JOB_CANCELLED',
'BLOCK_JOB_ERROR', 'BLOCK_JOB_READY', 'BLOCK_JOB_PENDING'
)
with qmp.listener(job_events) as events:
...


There is a *post-filtering* syntax available to EventListener.get(). It 
will filter events out using a very simplistic syntax.



# Example 5 -- a short-hand form of Example 2.
with qmp.listener('JOB_STATUS_CHANGE') as job_events:
await qmp.execute('blockdev-create', ...)
await job_events.get(status='concluded')
await qmp.execute('job-dismiss', ...)



A shortcoming with this interface is that it's easy to create a listener 
that hears multiple events, but it's not easy to create *several 
listeners*. I am not sure what syntax will be the nicest for this, but I 
tried by allowing the manual creation of listeners:



# Example 6
listener1 = EventListener('JOB_STATUS_CHANGE')
listener2 = EventListener(job_events)

# Note the use of listen() instead of listener()
with qmp.listen(listener1, listener2) as (ev1, ev2):
# listeners are now active.
...
# listeners are now inactive.
# The context manager clears any stale events in the listener(s).


I thought this might be nicer than trying to extend the listener syntax:

with qmp.listeners(
'JOB_STATUS_CHANGE',
(job_events)
) as (
listener1,
listener2,
):
...

especially because it might get confusing when trying to separate "one 
listener with multiple events" vs "several listeners with one event 
each, and it makes things a little ambiguous:


with qmp.listeners('STOP') as (stop_events,):
...

And this isn't any prettier, and also likely to confuse:

with qmp.listeners('STOP', 'RESUME') as (stops, resumes):
...

because it's only so very subtly different from this:

with qmp.listeners(('STOP', 'RESUME')) as (runstate_events,):
...

This also doesn't begin to address one of the worst headaches of writing 
iotests where transactions are involved: accidentally eating events 
meant for other jobs.


I prototyped something where it's possible to create an EventListener 
with an optional pre-filter, but it's a little bulky:



# Example 7
listener = EventListener('JOB_STATUS_CHANGE',
 lambda e: e['data']['id'] == 'job0')

with qmp.listen(listener):
await qmp.execute('blockdev-create', arguments={'job-id': 'job0'})
await listener.get(status='created')
...


Some thoughts on this:
- Pre-filters are powerful, but involve a lot of boilerplate.
- Accepting two kinds of parameters, name(s) and filter both, makes it 
even trickier to write concise context blocks; especially with multiple 
jobs.



Here's a final example of something you may very well want to do in 
iotest code:



# Example 8

def job_filter(job_id: str) -> EventFilter:
def filter(event: Message) -> bool:
return event.get('data', {}).get('id') == job_id
return filter

listener1 = EventListener('JOB_STATUS_CHANGE', job_filter('job0'))
listener2 = EventListener('JOB_STATUS_CHANGE', job_filter('job1'))

with qmp.listen(listener1, listener2) as (job0, job1):
await asyncio.gather(
qmp.execute('blockdev-create', arguments={'job-id': 'job0'}),
qmp.execute('blockdev-create', arguments={'job-id': 'job1'}),
job0.get(status='concluded'),
job1.get(status='concluded')
)

(Note: gather isn't required here. You could write the execute and get 
statements individually and in whichever order you wanted, as long as 
the execute statement for a given job appears prior to the corresponding 
wait!)


The difficulty I have here is extending that backwards to the "create 
listener on the fly" syntax, for the reasons stated above with making it 
ambiguous as to whether we're creating one or two listeners, etc. Trying 
to minimize boilerplate while leaving the interfaces generic and 
powerful is tough.


I'm still playing around with different options and solutions, but your 
feedback/input is welcome.


--js




Re: [PATCH 13/32] linux-headers: Add placeholder for KVM_CAP_SGX_ATTRIBUTE

2021-04-19 Thread Kai Huang
On Mon, 2021-04-19 at 18:01 +0800, Yang Zhong wrote:
> From: Sean Christopherson 
> 
> KVM_CAP_SGX_ATTRIBUTE is a proposed capability for Intel SGX that can be
> used by userspace to enable privileged attributes, e.g. access to the
> PROVISIONKEY.
> 
> Signed-off-by: Sean Christopherson 
> Signed-off-by: Yang Zhong 
> ---
>  linux-headers/linux/kvm.h | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
> index 020b62a619..0961b03007 100644
> --- a/linux-headers/linux/kvm.h
> +++ b/linux-headers/linux/kvm.h
> @@ -1056,6 +1056,7 @@ struct kvm_ppc_resize_hpt {
>  #define KVM_CAP_ENFORCE_PV_FEATURE_CPUID 190
>  #define KVM_CAP_SYS_HYPERV_CPUID 191
>  #define KVM_CAP_DIRTY_LOG_RING 192
> +#define KVM_CAP_SGX_ATTRIBUTE 195
>  
> 
This needs to be changed to 196, since KVM SGX code has changed to 196.





Re: [RFC PATCH 00/11] RISC-V: support clic v0.9 specification

2021-04-19 Thread LIU Zhiwei



On 2021/4/20 上午7:30, Alistair Francis wrote:

On Fri, Apr 9, 2021 at 5:56 PM LIU Zhiwei  wrote:

This patch set gives an implementation of "RISC-V Core-Local Interrupt
Controller(CLIC) Version 0.9-draft-20210217". It comes from [1], where
you can find the pdf format or the source code.

I take over the job from Michael Clark, who gave the first implementation
of clic-v0.7 specification. If there is any copyright question, please
let me know.

You need to make sure you leave all original copyright notices and SoB in place.


OK.

Is it OK that keep the original copyright notices for new files and  
your SoB in every patch,  Michael?





Features:
1. support four kinds of trigger types.
2. Preserve the CSR WARL/WPRI semantics.
3. Option to select different modes, such as M/S/U or M/U.
4. At most 4096 interrupts.
5. At most 1024 apertures.

Todo:
1. Encode the interrupt trigger information to exccode.
2. Support complete CSR mclicbase when its number is fixed.
3. Gave each aperture an independend address.

It have passed my qtest case and freertos test. Welcome to have a try
for your hardware.

It doesn't seem to be connected to any machine. How are you testing this?


There is a machine called SMARTL in my repository[1].  The qtest case 
is  tests/qtest/test-riscv32-clic.c. If it's better, I can upstream the 
machine together next version.


Zhiwei

[1]https://github.com/romanheros/qemu, branch: riscv-clic-upstream-rfc




Alistair


Any advice is welcomed. Thanks very much.

Zhiwei

[1] specification website: https://github.com/riscv/riscv-fast-interrupt.
[2] Michael Clark origin work: 
https://github.com/sifive/riscv-qemu/tree/sifive-clic.


LIU Zhiwei (11):
   target/riscv: Add CLIC CSR mintstatus
   target/riscv: Update CSR xintthresh in CLIC mode
   hw/intc: Add CLIC device
   target/riscv: Update CSR xie in CLIC mode
   target/riscv: Update CSR xip in CLIC mode
   target/riscv: Update CSR xtvec in CLIC mode
   target/riscv: Update CSR xtvt in CLIC mode
   target/riscv: Update CSR xnxti in CLIC mode
   target/riscv: Update CSR mclicbase in CLIC mode
   target/riscv: Update interrupt handling in CLIC mode
   target/riscv: Update interrupt return in CLIC mode

  default-configs/devices/riscv32-softmmu.mak |   1 +
  default-configs/devices/riscv64-softmmu.mak |   1 +
  hw/intc/Kconfig |   3 +
  hw/intc/meson.build |   1 +
  hw/intc/riscv_clic.c| 836 
  include/hw/intc/riscv_clic.h| 103 +++
  target/riscv/cpu.h  |   9 +
  target/riscv/cpu_bits.h |  32 +
  target/riscv/cpu_helper.c   | 117 ++-
  target/riscv/csr.c  | 247 +-
  target/riscv/op_helper.c|  25 +
  11 files changed, 1363 insertions(+), 12 deletions(-)
  create mode 100644 hw/intc/riscv_clic.c
  create mode 100644 include/hw/intc/riscv_clic.h

--
2.25.1






[PATCH 2/2] tests/tcg/ppc64le: tests for brh/brw/brd

2021-04-19 Thread matheus . ferst
From: Matheus Ferst 

Tests for Byte-Reverse Halfword, Word and Doubleword

Signed-off-by: Matheus Ferst 
---
 tests/tcg/ppc64/Makefile.target   |  7 +++
 tests/tcg/ppc64le/Makefile.target |  7 +++
 tests/tcg/ppc64le/byte_reverse.c  | 22 ++
 3 files changed, 36 insertions(+)
 create mode 100644 tests/tcg/ppc64le/byte_reverse.c

diff --git a/tests/tcg/ppc64/Makefile.target b/tests/tcg/ppc64/Makefile.target
index 0c6a4585fc..55c690c8ad 100644
--- a/tests/tcg/ppc64/Makefile.target
+++ b/tests/tcg/ppc64/Makefile.target
@@ -10,4 +10,11 @@ PPC64_TESTS=bcdsub
 endif
 bcdsub: CFLAGS += -mpower8-vector
 
+ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_POWER10),)
+POWER10_TESTS=byte_reverse
+RUN_POWER10_TESTS=$(patsubst %, run-%, $(POWER10_TESTS))
+$(RUN_POWER10_TESTS): QEMU_OPTS+=-cpu POWER10
+PPC64_TESTS += $(POWER10_TESTS)
+endif
+
 TESTS += $(PPC64_TESTS)
diff --git a/tests/tcg/ppc64le/Makefile.target 
b/tests/tcg/ppc64le/Makefile.target
index 1acfcff94a..517d290b1a 100644
--- a/tests/tcg/ppc64le/Makefile.target
+++ b/tests/tcg/ppc64le/Makefile.target
@@ -9,4 +9,11 @@ PPC64LE_TESTS=bcdsub
 endif
 bcdsub: CFLAGS += -mpower8-vector
 
+ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_POWER10),)
+POWER10_TESTS=byte_reverse
+RUN_POWER10_TESTS=$(patsubst %, run-%, $(POWER10_TESTS))
+$(RUN_POWER10_TESTS): QEMU_OPTS+=-cpu POWER10
+PPC64LE_TESTS += $(POWER10_TESTS)
+endif
+
 TESTS += $(PPC64LE_TESTS)
diff --git a/tests/tcg/ppc64le/byte_reverse.c b/tests/tcg/ppc64le/byte_reverse.c
new file mode 100644
index 00..553b9870ae
--- /dev/null
+++ b/tests/tcg/ppc64le/byte_reverse.c
@@ -0,0 +1,22 @@
+#include 
+#include 
+
+int main(void)
+{
+unsigned long var;
+
+var = 0xFEDCBA9876543210;
+asm("brh %0, %0" : "=r"(var));
+assert(var == 0xDCFE98BA54761032);
+
+var = 0xFEDCBA9876543210;
+asm("brw %0, %0" : "=r"(var));
+assert(var == 0x98BADCFE10325476);
+
+var = 0xFEDCBA9876543210;
+asm("brd %0, %0" : "=r"(var));
+assert(var == 0x1032547698BADCFE);
+
+return 0;
+}
+
-- 
2.25.1




[PATCH 0/2] tests/docker: tests/tcg/ppc64le: Newer toolchain to build tests for PowerISA v3.1 instructions

2021-04-19 Thread matheus . ferst
From: Matheus Ferst 

This series adds gcc-10 based images to enable the build of tests with Power10
instructions. Then, to put it to good use, a tests for the byte-reverse
instructions (implemented in 9d69cfa2faa7) is introduced.

Matheus Ferst (2):
  tests/docker: gcc-10 based images for ppc64{,le} tests
  tests/tcg/ppc64le: tests for brh/brw/brd

 tests/docker/Makefile.include |  2 ++
 .../debian-powerpc-test-cross.docker  | 17 ++
 tests/tcg/configure.sh| 12 ++
 tests/tcg/ppc64/Makefile.target   |  7 ++
 tests/tcg/ppc64le/Makefile.target |  7 ++
 tests/tcg/ppc64le/byte_reverse.c  | 22 +++
 6 files changed, 63 insertions(+), 4 deletions(-)
 create mode 100644 tests/docker/dockerfiles/debian-powerpc-test-cross.docker
 create mode 100644 tests/tcg/ppc64le/byte_reverse.c

-- 
2.25.1




[PATCH 1/2] tests/docker: gcc-10 based images for ppc64{,le} tests

2021-04-19 Thread matheus . ferst
From: Matheus Ferst 

A newer compiler is needed to build tests for Power10 instructions. As
done for arm64 on c729a99d2701, a new '-test-cross' image is created for
ppc64 and ppc64le. As done on 936fda4d771f, a test for compiler support
is added to verify that the toolchain in use has '-mpower10'.

Signed-off-by: Matheus Ferst 
---
 tests/docker/Makefile.include   |  2 ++
 .../debian-powerpc-test-cross.docker| 17 +
 tests/tcg/configure.sh  | 12 
 3 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 tests/docker/dockerfiles/debian-powerpc-test-cross.docker

diff --git a/tests/docker/Makefile.include b/tests/docker/Makefile.include
index 9f464cb92c..f1dbcc639f 100644
--- a/tests/docker/Makefile.include
+++ b/tests/docker/Makefile.include
@@ -152,10 +152,12 @@ docker-image-debian-sparc64-cross: docker-image-debian10
 docker-image-debian-tricore-cross: docker-image-debian10
 docker-image-debian-all-test-cross: docker-image-debian10
 docker-image-debian-arm64-test-cross: docker-image-debian11
+docker-image-debian-power-test-cross: docker-image-debian11
 
 # These images may be good enough for building tests but not for test builds
 DOCKER_PARTIAL_IMAGES += debian-alpha-cross
 DOCKER_PARTIAL_IMAGES += debian-arm64-test-cross
+DOCKER_PARTIAL_IMAGES += debian-power-test-cross
 DOCKER_PARTIAL_IMAGES += debian-hppa-cross
 DOCKER_PARTIAL_IMAGES += debian-m68k-cross debian-mips64-cross
 DOCKER_PARTIAL_IMAGES += debian-powerpc-cross debian-ppc64-cross
diff --git a/tests/docker/dockerfiles/debian-powerpc-test-cross.docker 
b/tests/docker/dockerfiles/debian-powerpc-test-cross.docker
new file mode 100644
index 00..36b336f709
--- /dev/null
+++ b/tests/docker/dockerfiles/debian-powerpc-test-cross.docker
@@ -0,0 +1,17 @@
+#
+# Docker powerpc/ppc64/ppc64le cross-compiler target
+#
+# This docker target builds on the debian Bullseye base image.
+#
+FROM qemu/debian11
+
+RUN apt update && \
+DEBIAN_FRONTEND=noninteractive eatmydata \
+apt install -y --no-install-recommends \
+gcc-powerpc-linux-gnu \
+libc6-dev-powerpc-cross \
+gcc-10-powerpc64-linux-gnu \
+libc6-dev-ppc64-cross \
+gcc-10-powerpc64le-linux-gnu \
+libc6-dev-ppc64el-cross
+
diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh
index fa1a4261a4..a0be066499 100755
--- a/tests/tcg/configure.sh
+++ b/tests/tcg/configure.sh
@@ -170,13 +170,13 @@ for target in $target_list; do
   ;;
 ppc64-*)
   container_hosts=x86_64
-  container_image=debian-ppc64-cross
-  container_cross_cc=powerpc64-linux-gnu-gcc
+  container_image=debian-powerpc-test-cross
+  container_cross_cc=powerpc64-linux-gnu-gcc-10
   ;;
 ppc64le-*)
   container_hosts=x86_64
-  container_image=debian-ppc64el-cross
-  container_cross_cc=powerpc64le-linux-gnu-gcc
+  container_image=debian-powerpc-test-cross
+  container_cross_cc=powerpc64le-linux-gnu-gcc-10
   ;;
 riscv64-*)
   container_hosts=x86_64
@@ -280,6 +280,10 @@ for target in $target_list; do
-mpower8-vector -o $TMPE $TMPC; then
 echo "CROSS_CC_HAS_POWER8_VECTOR=y" >> $config_target_mak
 fi
+if do_compiler "$target_compiler" $target_compiler_cflags \
+   -mpower10 -o $TMPE $TMPC; then
+echo "CROSS_CC_HAS_POWER10=y" >> $config_target_mak
+fi
 ;;
 i386-linux-user)
 if do_compiler "$target_compiler" $target_compiler_cflags \
-- 
2.25.1




Re: [PATCH 2/2] spapr.c: always pulse guest IRQ in spapr_core_unplug_request()

2021-04-19 Thread David Gibson
On Mon, Apr 12, 2021 at 04:27:43PM -0300, Daniel Henrique Barboza wrote:
> 
> 
> On 3/31/21 11:37 PM, David Gibson wrote:
> > On Wed, Mar 31, 2021 at 09:04:37PM -0300, Daniel Henrique Barboza wrote:
> > > Commit 47c8c915b162 fixed a problem where multiple spapr_drc_detach()
> > > requests were breaking QEMU. The solution was to just spapr_drc_detach()
> > > once, and use spapr_drc_unplug_requested() to filter whether we already
> > > detached it or not. The commit also tied the hotplug request to the
> > > guest in the same condition.
> > > 
> > > Turns out that there is a reliable way for a CPU hotunplug to fail. If a
> > > guest with one CPU hotplugs a CPU1, then offline CPU0s via 'echo 0 >
> > > /sys/devices/system/cpu/cpu0/online', then attempts to hotunplug CPU1,
> > > the kernel will refuse it because it's the last online CPU of the
> > > system. Given that we're pulsing the IRQ only in the first try, in a
> > > failed attempt, all other CPU1 hotunplug attempts will fail, regardless
> > > of the online state of CPU1 in the kernel, because we're simply not
> > > letting the guest know that we want to hotunplug the device.
> > > 
> > > Let's move spapr_hotplug_req_remove_by_index() back out of the "if
> > > (!spapr_drc_unplug_requested(drc))" conditional, allowing for multiple
> > > 'device_del' requests to the same CPU core to reach the guest, in case
> > > the CPU core didn't fully hotunplugged previously.
> > > 
> > > Signed-off-by: Daniel Henrique Barboza 
> > 
> > I've applied these to ppc-for-6.0, but..
> > 
> > > ---
> > >   hw/ppc/spapr.c | 11 ++-
> > >   1 file changed, 10 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> > > index 05a765fab4..e4be00b732 100644
> > > --- a/hw/ppc/spapr.c
> > > +++ b/hw/ppc/spapr.c
> > > @@ -3777,8 +3777,17 @@ void spapr_core_unplug_request(HotplugHandler 
> > > *hotplug_dev, DeviceState *dev,
> > >   if (!spapr_drc_unplug_requested(drc)) {
> > >   spapr_drc_unplug_request(drc);
> > > -spapr_hotplug_req_remove_by_index(drc);
> > >   }
> > > +
> > > +/*
> > > + * spapr_hotplug_req_remove_by_index is left unguarded, out of the
> > > + * "!spapr_drc_unplug_requested" check, to allow for multiple IRQ
> > > + * pulses removing the same CPU. Otherwise, in an failed hotunplug
> > > + * attempt (e.g. the kernel will refuse to remove the last online
> > > + * CPU), we will never attempt it again because unplug_requested
> > > + * will still be 'true' in that case.
> > > + */
> > > +spapr_hotplug_req_remove_by_index(drc);
> > 
> > I think we need similar changes for all the other unplug types (LMB,
> > PCI, PHB) - basically retries should always be allowed, and at worst
> > be a no-op, rather than generating an error like they do now.
> 
> 
> For PHBs should be straightforward. Not so sure about PCI because there is
> all the PCI function logic around the hotunplug of function 0.
> 
> As for LMBs, we block further attempts because there is no way we can tell
> if the hotunplug is being executed but it is taking some time (it is not
> uncommon for a DIMM unplug to take 20-30 seconds to complete), versus
> an error scenario.

I don't see why that prevents retries.  Can't you reissue the
index+size unplug request anyway?  The code you already have to fail
unplugs on a reconfigure should work for both the original request and
the retry, shouldn't it?


> What we do ATM is check is the pending DIMM unplug
> state exists, and if it does, assume that a hotunplug is pending. I have
> no idea what would happen if an unplug request for a LMB DRC reaches the
> kernel in the middle of an error rollback (when the kernel reconnects all
> the LMBs again) and the same DRC that was rolled back is disconnected
> again.
> 
> We would need to check not only if the pending dimm unplug state exists, but
> also if partially exists. In other words, if there are DRCs of that DIMM that
> were unplugged already. That way we can prevent to issue a removal while
> the unplug is still running.
> 
> 
> Thanks,
> 
> 
> DHB
> 
> > 
> > >   }
> > >   int spapr_core_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
> > 
> 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature


[PATCH v2] fpu/softfloat: set invalid excp flag for RISC-V muladd instructions

2021-04-19 Thread frank . chang
From: Frank Chang 

In IEEE 754-2008 spec:
  Invalid operation exception is signaled when doing:
  fusedMultiplyAdd(0, Inf, c) or fusedMultiplyAdd(Inf, 0, c)
  unless c is a quiet NaN; if c is a quiet NaN then it is
  implementation defined whether the invalid operation exception
  is signaled.

In RISC-V Unprivileged ISA spec:
  The fused multiply-add instructions must set the invalid
  operation exception flag when the multiplicands are Inf and
  zero, even when the addend is a quiet NaN.

This commit set invalid operation execption flag for RISC-V when
multiplicands of muladd instructions are Inf and zero.

Signed-off-by: Frank Chang 
---
 fpu/softfloat-specialize.c.inc | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index c2f87addb25..12f29fbfc5e 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -624,6 +624,12 @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass 
b_cls, FloatClass c_cls,
 } else {
 return 1;
 }
+#elif defined(TARGET_RISCV)
+/* For RISC-V, InvalidOp is set when multiplicands are Inf and zero */
+if (infzero) {
+float_raise(float_flag_invalid, status);
+}
+return 3; /* deafult NaN */
 #elif defined(TARGET_XTENSA)
 /*
  * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
-- 
2.17.1




Re: [PATCH 1/4] target/ppc: Code motion required to build disabling tcg

2021-04-19 Thread David Gibson
On Mon, Apr 19, 2021 at 02:40:35PM +, Bruno Piazera Larsen wrote:
> > > > * move gen_write_xer and gen_read_xer into cpu_init.c, as they're
> > > > used for some sprs, and whatever needs to be moved with it
> > >
> > > I'd leave them where they are currently. Instead what I think we should
> > > do is to find a way to not need the uea/oea/hea|read/write callbacks
> > > with KVM.
> > >
> > > Maybe extract a function from _spr_register that sets what is common for
> > > both tcg and kvm (num, name, initial_value, AFAICT). Then alter the
> > > gen_spr* functions to first create all registers and then call both
> > > configs to supplement:
> > >
> > > //tcg.c
> > > static void tcg_gen_spr_generic(CPUPPCState *env)
> > > {
> > > // these only set the callbacks
> > > spr_register(env, SPR_FOO,
> > >  SPR_NOACCESS, SPR_NOACCESS,
> > >  _read_foo, _write_foo);
> > > spr_register(env, SPR_BAR,
> > >  SPR_NOACCESS, SPR_NOACCESS,
> > >  _read_bar, _write_bar);
> > > }
> > >
> > > //kvm.c
> > > static void kvm_gen_spr_generic(CPUPPCState *env)
> > > {
> > > // these only set one_reg_id
> > > spr_register_kvm(env, SPR_FOO, KVM_REG_PPC_FOO);
> > > spr_register_kvm(env, SPR_BAR, KVM_REG_PPC_BAR);
> > > }
> >
> > I really dislike the idea above - it'd be way too easy for KVM and TCG
> > to get out of sync.  Instead make spr_register() itself a macro if
> > necessary, so it just ignores the access functions in the !TCG case.
> 
> What I was doing was to only register the spr once, and use the
> accel-specific functions to set the relevant attributes, so spr_common
> wouldn't need to where (and if) spr_read_* exists or not.
> Would this work?
> 
> Just ignoring the read and write functions means we still need
> to compile them, or at least stub them, otherwise we'd get linker
> problems.

Not if you use a macro which will simply elide the references in the
!TCG case.  Actually I think even an inline wrapper will do it, I'm
pretty sure the compiler is smart enough to optimize the references
out in that case.

> And ifdef'ing them out of the calls would be quite a
> pain to understand the code later on.
> 
> 
> 
> Bruno Piazera Larsen
> 
> Instituto de Pesquisas 
> ELDORADO
> 
> Departamento Computação Embarcada
> 
> Analista de Software Trainee
> 
> Aviso Legal - Disclaimer
> 
> 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature


Re: [PATCH] fpu/softfloat: set invalid excp flag for RISC-V muladd instructions

2021-04-19 Thread Frank Chang
On Mon, Apr 19, 2021 at 11:28 PM Richard Henderson <
richard.hender...@linaro.org> wrote:

> On 4/18/21 10:56 PM, frank.ch...@sifive.com wrote:
> > +#elif defined(TARGET_RISCV)
> > +/*
> > + * For RISC-V, InvalidOp is set when multiplicands are Inf and zero
> > + * and returns default NaN.
> > + */
> > +if (infzero) {
> > +float_raise(float_flag_invalid, status);
> > +return 3;
> > +}
> > +
> > +if (is_nan(a_cls)) {
> > +return 0;
> > +} else if (is_nan(b_cls)) {
> > +return 1;
> > +} else {
> > +return 2;
> > +}
>
> This second half of the function made me go look into the spec to make
> sure you
> had got that selection right.  But RISCV is always in default_nan mode, so
> all
> this is unused (and overridden in pick_nan_muladd).
>
> I think for avoidance of confusion, you should use
>
>  if (infzero) {
>  float_raise(float_flag_invalid, status);
>  }
>  return 3; /* default nan */
>
>
> r~
>

Sure, I'll update my patch and resend again.

Thanks
Frank Chang


[Bug 1925094] [NEW] DISCARD support for Crypto Block Devices

2021-04-19 Thread David Tomaschik
Public bug reported:

It appears that running `fstrim` or similar is useless when the VM is on
a LUKS-encrypted device using QEMU's native LUKS support.

Looking at the source, it seems that block/crypto.c lacks an
implementation for bdrv_co_pdiscard, which probably needs to delegate to
a per-crypto type discard helper.

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1925094

Title:
  DISCARD support for Crypto Block Devices

Status in QEMU:
  New

Bug description:
  It appears that running `fstrim` or similar is useless when the VM is
  on a LUKS-encrypted device using QEMU's native LUKS support.

  Looking at the source, it seems that block/crypto.c lacks an
  implementation for bdrv_co_pdiscard, which probably needs to delegate
  to a per-crypto type discard helper.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1925094/+subscriptions



Re: [RFC PATCH 03/11] hw/intc: Add CLIC device

2021-04-19 Thread LIU Zhiwei



On 2021/4/20 上午7:25, Alistair Francis wrote:

On Fri, Apr 9, 2021 at 5:56 PM LIU Zhiwei  wrote:

The Core-Local Interrupt Controller (CLIC) provides low-latency,
vectored, pre-emptive interrupts for RISC-V systems.

The CLIC also supports a new Selective Hardware Vectoring feature
that allow users to optimize each interrupt for either faster
response or smaller code size.

Signed-off-by: LIU Zhiwei 
---
  default-configs/devices/riscv32-softmmu.mak |   1 +
  default-configs/devices/riscv64-softmmu.mak |   1 +
  hw/intc/Kconfig |   3 +
  hw/intc/meson.build |   1 +
  hw/intc/riscv_clic.c| 835 
  include/hw/intc/riscv_clic.h| 103 +++
  target/riscv/cpu.h  |   2 +
  7 files changed, 946 insertions(+)
  create mode 100644 hw/intc/riscv_clic.c
  create mode 100644 include/hw/intc/riscv_clic.h

diff --git a/default-configs/devices/riscv32-softmmu.mak 
b/default-configs/devices/riscv32-softmmu.mak
index d847bd5692..1430c30588 100644
--- a/default-configs/devices/riscv32-softmmu.mak
+++ b/default-configs/devices/riscv32-softmmu.mak
@@ -5,6 +5,7 @@
  #CONFIG_PCI_DEVICES=n
  CONFIG_SEMIHOSTING=y
  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
+CONFIG_RISCV_CLIC=y

  # Boards:
  #
diff --git a/default-configs/devices/riscv64-softmmu.mak 
b/default-configs/devices/riscv64-softmmu.mak
index d5eec75f05..396800bbbd 100644
--- a/default-configs/devices/riscv64-softmmu.mak
+++ b/default-configs/devices/riscv64-softmmu.mak
@@ -5,6 +5,7 @@
  #CONFIG_PCI_DEVICES=n
  CONFIG_SEMIHOSTING=y
  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
+CONFIG_RISCV_CLIC=y

  # Boards:
  #
diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index f4694088a4..5bf492b48f 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -68,6 +68,9 @@ config SIFIVE_CLINT
  config SIFIVE_PLIC
  bool

+config RISCV_CLIC
+bool
+
  config GOLDFISH_PIC
  bool

diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 1c299039f6..2aa71b6738 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -50,6 +50,7 @@ specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: 
files('s390_flic_kvm.c'))
  specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
  specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: files('sifive_clint.c'))
  specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
+specific_ss.add(when: 'CONFIG_RISCV_CLIC', if_true: files('riscv_clic.c'))
  specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
  specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
 if_true: files('xics_kvm.c'))
diff --git a/hw/intc/riscv_clic.c b/hw/intc/riscv_clic.c
new file mode 100644
index 00..8ad534c506
--- /dev/null
+++ b/hw/intc/riscv_clic.c
@@ -0,0 +1,835 @@
+/*
+ * RISC-V CLIC(Core Local Interrupt Controller) for QEMU.
+ *
+ * Copyright (c) 2021 T-Head Semiconductor Co., Ltd. All rights reserved.

Shouldn't this maintain the original copyright?


It is OK.

As it has changed a lot from the origin version, it is just another 
device called sifive_clic  in my branch, and this is the device called 
riscv_clic.


If that is the rule, I am very glad to obey it.

Thanks for pointing it out.

Zhiwei


Alistair


+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "hw/sysbus.h"
+#include "sysemu/qtest.h"
+#include "target/riscv/cpu.h"
+#include "hw/qdev-properties.h"
+#include "hw/intc/riscv_clic.h"
+
+/*
+ * The 2-bit trig WARL field specifies the trigger type and polarity for each
+ * interrupt input. Bit 1, trig[0], is defined as "edge-triggered"
+ * (0: level-triggered, 1: edge-triggered); while bit 2, trig[1], is defined as
+ * "negative-edge" (0: positive-edge, 1: negative-edge). (Section 3.6)
+ */
+
+static inline TRIG_TYPE
+riscv_clic_get_trigger_type(RISCVCLICState *clic, size_t irq_offset)
+{
+return (clic->clicintattr[irq_offset] >> 1) & 0x3;
+}
+
+static inline bool
+riscv_clic_is_edge_triggered(RISCVCLICState *clic, size_t irq_offset)
+{
+return (clic->clicintattr[irq_offset] >> 1) & 0x1;
+}
+
+static inline bool
+riscv_clic_is_shv_interrupt(RISCVCLICState *clic, size_t irq_offset)
+{
+return (clic->clicintattr[irq_offset] & 0x1) && clic->nvbits;
+}
+
+static uint8_t

Re: [PATCH] target/riscv: fix exception index on instruction access fault

2021-04-19 Thread Alistair Francis
On Sat, Apr 17, 2021 at 12:48 AM Emmanuel Blot  wrote:
>
> When no MMU is used and the guest code attempts to fetch an instruction
> from an invalid memory location, the exception index defaults to a data
> load access fault, rather an instruction access fault.
>
> Signed-off-by: Emmanuel Blot 

Reviewed-by: Alistair Francis 

Alistair

>
> ---
>   target/riscv/cpu_helper.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> index 21c54ef5613..4e107b1bd23 100644
> --- a/target/riscv/cpu_helper.c
> +++ b/target/riscv/cpu_helper.c
> @@ -691,8 +691,10 @@ void riscv_cpu_do_transaction_failed(CPUState *cs,
> hwaddr physaddr,
>
>   if (access_type == MMU_DATA_STORE) {
>   cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
> -} else {
> +} else if (access_type == MMU_DATA_LOAD) {
>   cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
> +} else {
> +cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
>   }
>
>   env->badaddr = addr;
> --
> 2.31.1
>



Re: [RFC PATCH 01/11] target/riscv: Add CLIC CSR mintstatus

2021-04-19 Thread LIU Zhiwei



On 2021/4/20 上午7:23, Alistair Francis wrote:

On Fri, Apr 9, 2021 at 5:52 PM LIU Zhiwei  wrote:

CSR mintstatus holds the active interrupt level for each supported
privilege mode. sintstatus, and user, uintstatus, provide restricted
views of mintstatus.

Signed-off-by: LIU Zhiwei 
---
  target/riscv/cpu.h  |  2 ++
  target/riscv/cpu_bits.h | 11 +++
  target/riscv/csr.c  | 26 ++
  3 files changed, 39 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 0a33d387ba..1a44ca62c7 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -159,6 +159,7 @@ struct CPURISCVState {
  target_ulong mip;

  uint32_t miclaim;
+uint32_t mintstatus; /* clic-spec */

  target_ulong mie;
  target_ulong mideleg;
@@ -243,6 +244,7 @@ struct CPURISCVState {

  /* Fields from here on are preserved across CPU reset. */
  QEMUTimer *timer; /* Internal timer */
+void *clic;   /* clic interrupt controller */

This should be the CLIC type.


OK.

Actually there are many versions of CLIC in my branch as different 
devices. But it is better to use CLIC type for the upstream version.





  };

  OBJECT_DECLARE_TYPE(RISCVCPU, RISCVCPUClass,
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index caf4599207..c4ce6ec3d9 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -165,6 +165,7 @@
  #define CSR_MCAUSE  0x342
  #define CSR_MTVAL   0x343
  #define CSR_MIP 0x344
+#define CSR_MINTSTATUS  0x346 /* clic-spec-draft */

  /* Legacy Machine Trap Handling (priv v1.9.1) */
  #define CSR_MBADADDR0x343
@@ -183,6 +184,7 @@
  #define CSR_SCAUSE  0x142
  #define CSR_STVAL   0x143
  #define CSR_SIP 0x144
+#define CSR_SINTSTATUS  0x146 /* clic-spec-draft */

  /* Legacy Supervisor Trap Handling (priv v1.9.1) */
  #define CSR_SBADADDR0x143
@@ -585,6 +587,15 @@
  #define SIP_STIP   MIP_STIP
  #define SIP_SEIP   MIP_SEIP

+/* mintstatus */
+#define MINTSTATUS_MIL 0xff00 /* mil[7:0] */
+#define MINTSTATUS_SIL 0xff00 /* sil[7:0] */
+#define MINTSTATUS_UIL 0x00ff /* uil[7:0] */
+
+/* sintstatus */
+#define SINTSTATUS_SIL 0xff00 /* sil[7:0] */
+#define SINTSTATUS_UIL 0x00ff /* uil[7:0] */

The bit fields in the comments are out of date.


I didn't notice it.   Fix it in next version.

Thanks.

Zhiwei



Alistair


+
  /* MIE masks */
  #define MIE_SEIE   (1 << IRQ_S_EXT)
  #define MIE_UEIE   (1 << IRQ_U_EXT)
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index d2585395bf..320b18ab60 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -188,6 +188,12 @@ static int pmp(CPURISCVState *env, int csrno)
  {
  return -!riscv_feature(env, RISCV_FEATURE_PMP);
  }
+
+static int clic(CPURISCVState *env, int csrno)
+{
+return !!env->clic;
+}
+
  #endif

  /* User Floating-Point CSRs */
@@ -734,6 +740,12 @@ static int rmw_mip(CPURISCVState *env, int csrno, 
target_ulong *ret_value,
  return 0;
  }

+static int read_mintstatus(CPURISCVState *env, int csrno, target_ulong *val)
+{
+*val = env->mintstatus;
+return 0;
+}
+
  /* Supervisor Trap Setup */
  static int read_sstatus(CPURISCVState *env, int csrno, target_ulong *val)
  {
@@ -893,6 +905,13 @@ static int rmw_sip(CPURISCVState *env, int csrno, 
target_ulong *ret_value,
  return ret;
  }

+static int read_sintstatus(CPURISCVState *env, int csrno, target_ulong *val)
+{
+target_ulong mask = SINTSTATUS_SIL | SINTSTATUS_UIL;
+*val = env->mintstatus & mask;
+return 0;
+}
+
  /* Supervisor Protection and Translation */
  static int read_satp(CPURISCVState *env, int csrno, target_ulong *val)
  {
@@ -1644,5 +1663,12 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
  [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", any32,  read_zero },
  [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", any32,  read_zero },
  [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", any32,  read_zero },
+
+/* Machine Mode Core Level Interrupt Controller */
+[CSR_MINTSTATUS] = { "mintstatus", clic,  read_mintstatus },
+
+/* Supervisor Mode Core Level Interrupt Controller */
+[CSR_SINTSTATUS] = { "sintstatus", clic,  read_sintstatus },
+
  #endif /* !CONFIG_USER_ONLY */
  };
--
2.25.1






Re: target/ppc: sPAPR invalid function calls when compiling without TCG

2021-04-19 Thread David Gibson
On Mon, Apr 19, 2021 at 07:04:34PM +, Lucas Mateus Martins Araujo e Castro 
wrote:
> 
> 
> >> spapr_hcall.c:
> >> function h_enter call ppc_hash64_hpte_page_shift_noslb, 
> >> ppc_hash64_map_hptes and ppc_hash64_unmap_hptes
> >> function remove_hpte call ppc_hash64_map_hptes, ppc_hash64_unmap_hptes 
> >> and ppc_hash64_tlb_flush_hpte
> >> function h_protect call ppc_hash64_map_hptes, ppc_hash64_unmap_hptes 
> >> and ppc_hash64_tlb_flush_hpte
> >> function h_read call ppc_hash64_map_hptes and ppc_hash64_unmap_hptes
> >> function rehash_hpte call ppc_hash64_hpte_page_shift_noslb
> >> function rehash_hpt call ppc_hash64_map_hptes and 
> >> ppc_hash64_unmap_hptes
> 
> >h_enter, remove_hpte, h_protect, h_read and rehash_hpte should never
> >be called for a KVM guest (KVM will intercept the relevant hcalls
> >before they reach qemu).  I think it would make sense to split of a
> >TCG only portion of spapr_hcall.c into a new file.  You'll then
> >probably need !TCG stubs for those hypercalls, which should trip a
> >fatal error (if KVM hasn't handled the calls, there's nothing we can
> >do that will salvage the situation).
> 
> These functions are static, so I thought about turning them into non-static 
> functions and creating the prototype in
> internal.h and changing hw/ppc/meson.build to add the correct .c file but 
> hw/ppc/ doesn't have an internal.h
> 
> What is the best way to handle this static functions?

They're static because their only direct use is passing to
spapr_register_hypercall() in hypercall_register_types().  You can put
your own register types function in the new KVM-only file, with those
calls, so everything will stay static.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature


Re: [RFC PATCH 00/11] RISC-V: support clic v0.9 specification

2021-04-19 Thread Alistair Francis
On Fri, Apr 9, 2021 at 5:56 PM LIU Zhiwei  wrote:
>
> This patch set gives an implementation of "RISC-V Core-Local Interrupt
> Controller(CLIC) Version 0.9-draft-20210217". It comes from [1], where
> you can find the pdf format or the source code.
>
> I take over the job from Michael Clark, who gave the first implementation
> of clic-v0.7 specification. If there is any copyright question, please
> let me know.

You need to make sure you leave all original copyright notices and SoB in place.

>
> Features:
> 1. support four kinds of trigger types.
> 2. Preserve the CSR WARL/WPRI semantics.
> 3. Option to select different modes, such as M/S/U or M/U.
> 4. At most 4096 interrupts.
> 5. At most 1024 apertures.
>
> Todo:
> 1. Encode the interrupt trigger information to exccode.
> 2. Support complete CSR mclicbase when its number is fixed.
> 3. Gave each aperture an independend address.
>
> It have passed my qtest case and freertos test. Welcome to have a try
> for your hardware.

It doesn't seem to be connected to any machine. How are you testing this?

Alistair

>
> Any advice is welcomed. Thanks very much.
>
> Zhiwei
>
> [1] specification website: https://github.com/riscv/riscv-fast-interrupt.
> [2] Michael Clark origin work: 
> https://github.com/sifive/riscv-qemu/tree/sifive-clic.
>
>
> LIU Zhiwei (11):
>   target/riscv: Add CLIC CSR mintstatus
>   target/riscv: Update CSR xintthresh in CLIC mode
>   hw/intc: Add CLIC device
>   target/riscv: Update CSR xie in CLIC mode
>   target/riscv: Update CSR xip in CLIC mode
>   target/riscv: Update CSR xtvec in CLIC mode
>   target/riscv: Update CSR xtvt in CLIC mode
>   target/riscv: Update CSR xnxti in CLIC mode
>   target/riscv: Update CSR mclicbase in CLIC mode
>   target/riscv: Update interrupt handling in CLIC mode
>   target/riscv: Update interrupt return in CLIC mode
>
>  default-configs/devices/riscv32-softmmu.mak |   1 +
>  default-configs/devices/riscv64-softmmu.mak |   1 +
>  hw/intc/Kconfig |   3 +
>  hw/intc/meson.build |   1 +
>  hw/intc/riscv_clic.c| 836 
>  include/hw/intc/riscv_clic.h| 103 +++
>  target/riscv/cpu.h  |   9 +
>  target/riscv/cpu_bits.h |  32 +
>  target/riscv/cpu_helper.c   | 117 ++-
>  target/riscv/csr.c  | 247 +-
>  target/riscv/op_helper.c|  25 +
>  11 files changed, 1363 insertions(+), 12 deletions(-)
>  create mode 100644 hw/intc/riscv_clic.c
>  create mode 100644 include/hw/intc/riscv_clic.h
>
> --
> 2.25.1
>
>



Re: [RFC PATCH 03/11] hw/intc: Add CLIC device

2021-04-19 Thread Alistair Francis
On Fri, Apr 9, 2021 at 5:56 PM LIU Zhiwei  wrote:
>
> The Core-Local Interrupt Controller (CLIC) provides low-latency,
> vectored, pre-emptive interrupts for RISC-V systems.
>
> The CLIC also supports a new Selective Hardware Vectoring feature
> that allow users to optimize each interrupt for either faster
> response or smaller code size.
>
> Signed-off-by: LIU Zhiwei 
> ---
>  default-configs/devices/riscv32-softmmu.mak |   1 +
>  default-configs/devices/riscv64-softmmu.mak |   1 +
>  hw/intc/Kconfig |   3 +
>  hw/intc/meson.build |   1 +
>  hw/intc/riscv_clic.c| 835 
>  include/hw/intc/riscv_clic.h| 103 +++
>  target/riscv/cpu.h  |   2 +
>  7 files changed, 946 insertions(+)
>  create mode 100644 hw/intc/riscv_clic.c
>  create mode 100644 include/hw/intc/riscv_clic.h
>
> diff --git a/default-configs/devices/riscv32-softmmu.mak 
> b/default-configs/devices/riscv32-softmmu.mak
> index d847bd5692..1430c30588 100644
> --- a/default-configs/devices/riscv32-softmmu.mak
> +++ b/default-configs/devices/riscv32-softmmu.mak
> @@ -5,6 +5,7 @@
>  #CONFIG_PCI_DEVICES=n
>  CONFIG_SEMIHOSTING=y
>  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
> +CONFIG_RISCV_CLIC=y
>
>  # Boards:
>  #
> diff --git a/default-configs/devices/riscv64-softmmu.mak 
> b/default-configs/devices/riscv64-softmmu.mak
> index d5eec75f05..396800bbbd 100644
> --- a/default-configs/devices/riscv64-softmmu.mak
> +++ b/default-configs/devices/riscv64-softmmu.mak
> @@ -5,6 +5,7 @@
>  #CONFIG_PCI_DEVICES=n
>  CONFIG_SEMIHOSTING=y
>  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
> +CONFIG_RISCV_CLIC=y
>
>  # Boards:
>  #
> diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
> index f4694088a4..5bf492b48f 100644
> --- a/hw/intc/Kconfig
> +++ b/hw/intc/Kconfig
> @@ -68,6 +68,9 @@ config SIFIVE_CLINT
>  config SIFIVE_PLIC
>  bool
>
> +config RISCV_CLIC
> +bool
> +
>  config GOLDFISH_PIC
>  bool
>
> diff --git a/hw/intc/meson.build b/hw/intc/meson.build
> index 1c299039f6..2aa71b6738 100644
> --- a/hw/intc/meson.build
> +++ b/hw/intc/meson.build
> @@ -50,6 +50,7 @@ specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: 
> files('s390_flic_kvm.c'))
>  specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
>  specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: 
> files('sifive_clint.c'))
>  specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
> +specific_ss.add(when: 'CONFIG_RISCV_CLIC', if_true: files('riscv_clic.c'))
>  specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
>  specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
> if_true: files('xics_kvm.c'))
> diff --git a/hw/intc/riscv_clic.c b/hw/intc/riscv_clic.c
> new file mode 100644
> index 00..8ad534c506
> --- /dev/null
> +++ b/hw/intc/riscv_clic.c
> @@ -0,0 +1,835 @@
> +/*
> + * RISC-V CLIC(Core Local Interrupt Controller) for QEMU.
> + *
> + * Copyright (c) 2021 T-Head Semiconductor Co., Ltd. All rights reserved.

Shouldn't this maintain the original copyright?

Alistair

> + *
> + * This program is free software; you can redistribute it and/or modify it
> + * under the terms and conditions of the GNU General Public License,
> + * version 2 or later, as published by the Free Software Foundation.
> + *
> + * This program is distributed in the hope it will be useful, but WITHOUT
> + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
> + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
> + * more details.
> + *
> + * You should have received a copy of the GNU General Public License along 
> with
> + * this program.  If not, see .
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qapi/error.h"
> +#include "qemu/log.h"
> +#include "hw/sysbus.h"
> +#include "sysemu/qtest.h"
> +#include "target/riscv/cpu.h"
> +#include "hw/qdev-properties.h"
> +#include "hw/intc/riscv_clic.h"
> +
> +/*
> + * The 2-bit trig WARL field specifies the trigger type and polarity for each
> + * interrupt input. Bit 1, trig[0], is defined as "edge-triggered"
> + * (0: level-triggered, 1: edge-triggered); while bit 2, trig[1], is defined 
> as
> + * "negative-edge" (0: positive-edge, 1: negative-edge). (Section 3.6)
> + */
> +
> +static inline TRIG_TYPE
> +riscv_clic_get_trigger_type(RISCVCLICState *clic, size_t irq_offset)
> +{
> +return (clic->clicintattr[irq_offset] >> 1) & 0x3;
> +}
> +
> +static inline bool
> +riscv_clic_is_edge_triggered(RISCVCLICState *clic, size_t irq_offset)
> +{
> +return (clic->clicintattr[irq_offset] >> 1) & 0x1;
> +}
> +
> +static inline bool
> +riscv_clic_is_shv_interrupt(RISCVCLICState *clic, size_t irq_offset)
> +{
> +return (clic->clicintattr[irq_offset] & 0x1) && clic->nvbits;
> +}
> +
> +static uint8_t
> +riscv_clic_get_interrupt_level(RISCVCLICState *clic, uint8_t intctl)
> +{
> +int nlbits = clic->nlbits;
> 

Re: [RFC PATCH 01/11] target/riscv: Add CLIC CSR mintstatus

2021-04-19 Thread Alistair Francis
On Fri, Apr 9, 2021 at 5:52 PM LIU Zhiwei  wrote:
>
> CSR mintstatus holds the active interrupt level for each supported
> privilege mode. sintstatus, and user, uintstatus, provide restricted
> views of mintstatus.
>
> Signed-off-by: LIU Zhiwei 
> ---
>  target/riscv/cpu.h  |  2 ++
>  target/riscv/cpu_bits.h | 11 +++
>  target/riscv/csr.c  | 26 ++
>  3 files changed, 39 insertions(+)
>
> diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> index 0a33d387ba..1a44ca62c7 100644
> --- a/target/riscv/cpu.h
> +++ b/target/riscv/cpu.h
> @@ -159,6 +159,7 @@ struct CPURISCVState {
>  target_ulong mip;
>
>  uint32_t miclaim;
> +uint32_t mintstatus; /* clic-spec */
>
>  target_ulong mie;
>  target_ulong mideleg;
> @@ -243,6 +244,7 @@ struct CPURISCVState {
>
>  /* Fields from here on are preserved across CPU reset. */
>  QEMUTimer *timer; /* Internal timer */
> +void *clic;   /* clic interrupt controller */

This should be the CLIC type.

>  };
>
>  OBJECT_DECLARE_TYPE(RISCVCPU, RISCVCPUClass,
> diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
> index caf4599207..c4ce6ec3d9 100644
> --- a/target/riscv/cpu_bits.h
> +++ b/target/riscv/cpu_bits.h
> @@ -165,6 +165,7 @@
>  #define CSR_MCAUSE  0x342
>  #define CSR_MTVAL   0x343
>  #define CSR_MIP 0x344
> +#define CSR_MINTSTATUS  0x346 /* clic-spec-draft */
>
>  /* Legacy Machine Trap Handling (priv v1.9.1) */
>  #define CSR_MBADADDR0x343
> @@ -183,6 +184,7 @@
>  #define CSR_SCAUSE  0x142
>  #define CSR_STVAL   0x143
>  #define CSR_SIP 0x144
> +#define CSR_SINTSTATUS  0x146 /* clic-spec-draft */
>
>  /* Legacy Supervisor Trap Handling (priv v1.9.1) */
>  #define CSR_SBADADDR0x143
> @@ -585,6 +587,15 @@
>  #define SIP_STIP   MIP_STIP
>  #define SIP_SEIP   MIP_SEIP
>
> +/* mintstatus */
> +#define MINTSTATUS_MIL 0xff00 /* mil[7:0] */
> +#define MINTSTATUS_SIL 0xff00 /* sil[7:0] */
> +#define MINTSTATUS_UIL 0x00ff /* uil[7:0] */
> +
> +/* sintstatus */
> +#define SINTSTATUS_SIL 0xff00 /* sil[7:0] */
> +#define SINTSTATUS_UIL 0x00ff /* uil[7:0] */

The bit fields in the comments are out of date.

Alistair

> +
>  /* MIE masks */
>  #define MIE_SEIE   (1 << IRQ_S_EXT)
>  #define MIE_UEIE   (1 << IRQ_U_EXT)
> diff --git a/target/riscv/csr.c b/target/riscv/csr.c
> index d2585395bf..320b18ab60 100644
> --- a/target/riscv/csr.c
> +++ b/target/riscv/csr.c
> @@ -188,6 +188,12 @@ static int pmp(CPURISCVState *env, int csrno)
>  {
>  return -!riscv_feature(env, RISCV_FEATURE_PMP);
>  }
> +
> +static int clic(CPURISCVState *env, int csrno)
> +{
> +return !!env->clic;
> +}
> +
>  #endif
>
>  /* User Floating-Point CSRs */
> @@ -734,6 +740,12 @@ static int rmw_mip(CPURISCVState *env, int csrno, 
> target_ulong *ret_value,
>  return 0;
>  }
>
> +static int read_mintstatus(CPURISCVState *env, int csrno, target_ulong *val)
> +{
> +*val = env->mintstatus;
> +return 0;
> +}
> +
>  /* Supervisor Trap Setup */
>  static int read_sstatus(CPURISCVState *env, int csrno, target_ulong *val)
>  {
> @@ -893,6 +905,13 @@ static int rmw_sip(CPURISCVState *env, int csrno, 
> target_ulong *ret_value,
>  return ret;
>  }
>
> +static int read_sintstatus(CPURISCVState *env, int csrno, target_ulong *val)
> +{
> +target_ulong mask = SINTSTATUS_SIL | SINTSTATUS_UIL;
> +*val = env->mintstatus & mask;
> +return 0;
> +}
> +
>  /* Supervisor Protection and Translation */
>  static int read_satp(CPURISCVState *env, int csrno, target_ulong *val)
>  {
> @@ -1644,5 +1663,12 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
>  [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", any32,  read_zero },
>  [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", any32,  read_zero },
>  [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", any32,  read_zero },
> +
> +/* Machine Mode Core Level Interrupt Controller */
> +[CSR_MINTSTATUS] = { "mintstatus", clic,  read_mintstatus },
> +
> +/* Supervisor Mode Core Level Interrupt Controller */
> +[CSR_SINTSTATUS] = { "sintstatus", clic,  read_sintstatus },
> +
>  #endif /* !CONFIG_USER_ONLY */
>  };
> --
> 2.25.1
>
>



Re: [PATCH v4 0/8] RISC-V: Add support for ePMP v0.9.1

2021-04-19 Thread Alistair Francis
On Mon, Apr 19, 2021 at 4:16 PM Alistair Francis
 wrote:
>
> This series adds support for ePMP v0.9.1 to the QEMU RISC-V target.
>
> This is based on previous patches, but has been rebased on the latest
> master and updated for the latest spec.
>
> The spec is avaliable at: 
> https://docs.google.com/document/d/1Mh_aiHYxemL0umN3GTTw8vsbmzHZ_nxZXgjgOUzbvc8
>
> This was tested by running Tock on the OpenTitan board.
>
> This is based on the original work by:
>  Hongzheng-Li 
>  Hou Weiying 
>  Myriad-Dreamin 
>
> v4:
>  - Fix the pmpcfg write function and log
> v3:
>  - Address Bin's comments on the ePMP implementation
> v2:
>  - Rebase on the RISC-V tree
>
> Alistair Francis (4):
>   target/riscv: Fix the PMP is locked check when using TOR
>   target/riscv: Add the ePMP feature
>   target/riscv/pmp: Remove outdated comment
>   target/riscv: Add ePMP support for the Ibex CPU
>
> Hou Weiying (4):
>   target/riscv: Define ePMP mseccfg
>   target/riscv: Add ePMP CSR access functions
>   target/riscv: Implementation of enhanced PMP (ePMP)
>   target/riscv: Add a config option for ePMP

Thanks!

Applied to riscv-to-apply.next

Alistair

>
>  target/riscv/cpu.h|   3 +
>  target/riscv/cpu_bits.h   |   3 +
>  target/riscv/pmp.h|  14 +++
>  target/riscv/cpu.c|  11 ++
>  target/riscv/csr.c|  24 +
>  target/riscv/pmp.c| 218 ++
>  target/riscv/trace-events |   3 +
>  7 files changed, 254 insertions(+), 22 deletions(-)
>
> --
> 2.31.1
>



[Bug 1749393] Re: sbrk() not working under qemu-user with a PIE-compiled binary?

2021-04-19 Thread Robie Basak
There's a request for a backport of this fix to be made to Ubuntu 20.04
in duplicate bug 1924231, so I'm adding a task for that.

** Also affects: qemu (Ubuntu Focal)
   Importance: Undecided
   Status: New

** Changed in: qemu (Ubuntu Focal)
   Status: New => Confirmed

** Changed in: qemu (Ubuntu Focal)
   Status: Confirmed => Triaged

** Changed in: qemu (Ubuntu Focal)
   Importance: Undecided => Medium

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1749393

Title:
  sbrk() not working under qemu-user with a PIE-compiled binary?

Status in QEMU:
  Fix Released
Status in qemu package in Ubuntu:
  Fix Released
Status in qemu source package in Focal:
  Triaged

Bug description:
  In Debian unstable, we recently switched bash to be a PIE-compiled
  binary (for hardening). Unfortunately this resulted in bash being
  broken when run under qemu-user (for all target architectures, host
  being amd64 for me).

  $ sudo chroot /srv/chroots/sid-i386/ qemu-i386-static /bin/bash
  bash: xmalloc: .././shell.c:1709: cannot allocate 10 bytes (0 bytes allocated)

  bash has its own malloc implementation based on sbrk():
  https://git.savannah.gnu.org/cgit/bash.git/tree/lib/malloc/malloc.c

  When we disable this internal implementation and rely on glibc's
  malloc, then everything is fine. But it might be that glibc has a
  fallback when sbrk() is not working properly and it might hide the
  underlying problem in qemu-user.

  This issue has also been reported to the bash upstream author and he 
suggested that the issue might be in qemu-user so I'm opening a ticket here. 
Here's the discussion with the bash upstream author:
  https://lists.gnu.org/archive/html/bug-bash/2018-02/threads.html#00080

  You can find the problematic bash binary in that .deb file:
  
http://snapshot.debian.org/archive/debian/20180206T154716Z/pool/main/b/bash/bash_4.4.18-1_i386.deb

  The version of qemu I have been using is 2.11 (Debian package qemu-
  user-static version 1:2.11+dfsg-1) but I have had reports that the
  problem is reproducible with older versions (back to 2.8 at least).

  Here are the related Debian bug reports:
  https://bugs.debian.org/889869
  https://bugs.debian.org/865599

  It's worth noting that bash used to have this problem (when compiled as a PIE 
binary) even when run directly but then something got fixed in the kernel and 
now the problem only appears when run under qemu-user:
  https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1518483

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1749393/+subscriptions



Re: [PATCH 2/3] Acceptance Tests: move definition of distro checksums to the framework

2021-04-19 Thread Wainer dos Santos Moschetta

Hi,

On 4/19/21 3:35 PM, Cleber Rosa wrote:

On Mon, Apr 19, 2021 at 12:25:44PM -0300, Wainer dos Santos Moschetta wrote:

Hi,

On 4/14/21 7:14 PM, Cleber Rosa wrote:

Instead of having, by default, the checksum in the tests, and the
definition of tests in the framework, let's keep them together.

A central definition for distributions is available, and it should
allow other known distros to be added more easily.

No behavior change is expected here, and tests can still define
a distro_checksum value if for some reason they want to override
the known distribution information.

Signed-off-by: Cleber Rosa 
---
   tests/acceptance/avocado_qemu/__init__.py | 34 +--
   tests/acceptance/boot_linux.py|  8 --
   2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/tests/acceptance/avocado_qemu/__init__.py 
b/tests/acceptance/avocado_qemu/__init__.py
index aae1e5bbc9..97093614d9 100644
--- a/tests/acceptance/avocado_qemu/__init__.py
+++ b/tests/acceptance/avocado_qemu/__init__.py
@@ -299,6 +299,30 @@ def ssh_command(self, command):
   return stdout_lines, stderr_lines
+#: A collection of known distros and their respective image checksum
+KNOWN_DISTROS = {

Do you plan to expand that mapping to record values other than checksums?
Otherwise it could be named KNOWN_DISTROS_CHECKSUMS.


Let's just say I had an intuition about it being used for other
purposes.  Talking to Eric Auger earlier this morning, he will expand
this mapping with default kernel args distros, so that he can *add*
to the common args.

Ok



+'fedora': {
+'31': {
+'x86_64':
+{'checksum': 
'e3c1b309d9203604922d6e255c2c5d098a309c2d46215d8fc026954f3c5c27a0'},
+'aarch64':
+{'checksum': 
'1e18d9c0cf734940c4b5d5ec592facaed2af0ad0329383d5639c997fdf16fe49'},
+'ppc64':
+{'checksum': 
'7c3528b85a3df4b2306e892199a9e1e43f991c506f2cc390dc4efa2026ad2f58'},
+'s390x':
+{'checksum': 
'4caaab5a434fd4d1079149a072fdc7891e354f834d355069ca982fdcaf5a122d'},
+}
+}
+}
+
+
+def get_known_distro_checksum(distro, distro_version, arch):
+try:
+return 
KNOWN_DISTROS.get(distro).get(distro_version).get(arch).get('checksum')
+except AttributeError:
+return None
+
+

Currently we have a few loose methods on avocado_qemu/__init__.py, and I'm
about to send a series to wrap them in a mixin class. This series will
introduce more loose code on the file; so would you consider moving
KNOWN_DISTROS and get_known_distro_checksum() to the LinuxTest class, and
possibly making the latest a class method?


Some of our experience in "avocado.Test" revealed that users would:

   1) find it confusing to have so many methods in the class that are not useful
  to them

   2) would conflict with variables/attributes of their own

About #2, we end up turning a lot of variables atttributes into
properties so that errors would be explicit when users tried to
overwrite them unknowingly.

But, in the specific example of KNOWN_DISTROS and its expansion I
mentioned before, it may indeed make sense to have a Test or LinuxTest
method that test writers can use.  It'd probably need to be a bit more
generic and evolved than this current version though.

Maybe wait for Eric's input based on real world use case here?

Sure, we can wait on Eric's input.



   class LinuxTest(Test, LinuxSSHMixIn):
   """Facilitates having a cloud-image Linux based available.
@@ -348,14 +372,20 @@ def download_boot(self):
   vmimage.QEMU_IMG = qemu_img
   self.log.info('Downloading/preparing boot image')
+distro = 'fedora'
+distro_version = '31'
+known_distro_checksum = get_known_distro_checksum(distro,
+  distro_version,
+  self.arch)
+distro_checksum = self.distro_checksum or known_distro_checksum


distro_checksum may be None. In this case vmimage.get() will silently skip
the check? I suggest to log a warn message.



Yes, good point.  But, I think adding that warning to Avocado's
vmimage.get() method itself is even better.  What do you think?


I like the idea. IMHO avocado_qemu should be a thin layer upon Avocado, 
so such as kind of code should live on avocado's side.


I just opened the PR: https://github.com/avocado-framework/avocado/pull/4539

- Wainer



Thanks for the review!
- Cleber.





Re: [PATCH v5] i386/cpu_dump: support AVX512 ZMM regs dump

2021-04-19 Thread Eduardo Habkost
On Mon, Apr 19, 2021 at 04:18:25PM -0400, Eduardo Habkost wrote:
> On Fri, Apr 16, 2021 at 10:08:24AM +0800, Robert Hoo wrote:
> > Since commit fa4518741e (target-i386: Rename struct XMMReg to ZMMReg),
> > CPUX86State.xmm_regs[] has already been extended to 512bit to support
> > AVX512.
> > Also, other qemu level supports for AVX512 registers are there for
> > years.
> > But in x86_cpu_dump_state(), still only dump XMM registers no matter
> > YMM/ZMM is enabled.
> > This patch is to complement this, let it dump XMM/YMM/ZMM accordingly.
> > 
> > Signed-off-by: Robert Hoo 
> 
> Queued for 6.1, thanks!

Dequeuing, as it causes build failures on multiple configs:

https://gitlab.com/ehabkost/qemu/-/pipelines/288890306

Example:


../target/i386/cpu-dump.c: In function 'x86_cpu_dump_state':
../target/i386/cpu-dump.c:511:50: error: format '%lx' expects argument of type 
'long unsigned int', but argument 4 has type 'uint64_t' {aka 'long long 
unsigned int'} [-Werror=format=]
 qemu_fprintf(f, "Opmask%02d=%016lx%s", i, env->opmask_regs[i],
 ~^~~~
 %016llx
../target/i386/cpu-dump.c:517:47: error: format '%lx' expects argument of type 
'long unsigned int', but argument 4 has type 'uint64_t' {aka 'long long 
unsigned int'} [-Werror=format=]
 qemu_fprintf(f, "ZMM%02d=%016lx %016lx %016lx %016lx %016lx "
  ~^
  %016llx


-- 
Eduardo




Re: [for-6.1 0/4] virtio: Improve boot time of virtio-scsi-pci and virtio-blk-pci

2021-04-19 Thread Michael S. Tsirkin
On Wed, Apr 07, 2021 at 04:34:57PM +0200, Greg Kurz wrote:
> Now that virtio-scsi-pci and virtio-blk-pci map 1 virtqueue per vCPU,
> a serious slow down may be observed on setups with a big enough number
> of vCPUs.
> 
> Exemple with a pseries guest on a bi-POWER9 socket system (128 HW threads):
> 
>   virtio-scsi  virtio-blk
> 
> 1 0m20.922s   0m21.346s
> 2 0m21.230s   0m20.350s
> 4 0m21.761s   0m20.997s
> 8 0m22.770s   0m20.051s
> 160m22.038s   0m19.994s
> 320m22.928s   0m20.803s
> 640m26.583s   0m22.953s
> 128   0m41.273s   0m32.333s
> 256   2m4.727s1m16.924s
> 384   6m5.563s3m26.186s
> 
> Both perf and gprof indicate that QEMU is hogging CPUs when setting up
> the ioeventfds:
> 
>  67.88%  swapper [kernel.kallsyms]  [k] power_pmu_enable
>   9.47%  qemu-kvm[kernel.kallsyms]  [k] smp_call_function_single
>   8.64%  qemu-kvm[kernel.kallsyms]  [k] power_pmu_enable
> =>2.79%  qemu-kvmqemu-kvm   [.] memory_region_ioeventfd_before
> =>2.12%  qemu-kvmqemu-kvm   [.] 
> address_space_update_ioeventfds
>   0.56%  kworker/8:0-mm  [kernel.kallsyms]  [k] smp_call_function_single
> 
> address_space_update_ioeventfds() is called when committing an MR
> transaction, i.e. for each ioeventfd with the current code base,
> and it internally loops on all ioventfds:
> 
> static void address_space_update_ioeventfds(AddressSpace *as)
> {
> [...]
> FOR_EACH_FLAT_RANGE(fr, view) {
> for (i = 0; i < fr->mr->ioeventfd_nb; ++i) {
> 
> This means that the setup of ioeventfds for these devices has
> quadratic time complexity.
> 
> This series simply changes the device models to extend the transaction
> to all virtqueueues, like already done in the past in the generic
> code with 710fccf80d78 ("virtio: improve virtio devices initialization
> time").
> 
> Only virtio-scsi and virtio-blk are covered here, but a similar change
> might also be beneficial to other device types such as host-scsi-pci,
> vhost-user-scsi-pci and vhost-user-blk-pci.
> 
>   virtio-scsi  virtio-blk
> 
> 1 0m21.271s   0m22.076s
> 2 0m20.912s   0m19.716s
> 4 0m20.508s   0m19.310s
> 8 0m21.374s   0m20.273s
> 160m21.559s   0m21.374s
> 320m22.532s   0m21.271s
> 640m26.550s   0m22.007s
> 128   0m29.115s   0m27.446s
> 256   0m44.752s   0m41.004s
> 384   1m2.884s0m58.023s
> 
> This should fix https://bugzilla.redhat.com/show_bug.cgi?id=1927108
> which reported the issue for virtio-scsi-pci.
> 
> Changes since RFC:
> 
> As suggested by Stefan, splimplify the code by directly beginning and
> committing the memory transaction from the device model, without all
> the virtio specific proxying code and no changes needed in the memory
> subsystem.
> 
> Greg Kurz (4):
>   virtio-blk: Fix rollback path in virtio_blk_data_plane_start()
>   virtio-blk: Configure all host notifiers in a single MR transaction
>   virtio-scsi: Set host notifiers and callbacks separately
>   virtio-scsi: Configure all host notifiers in a single MR transaction
> 
>  hw/block/dataplane/virtio-blk.c | 36 +++--
>  hw/scsi/virtio-scsi-dataplane.c | 56 ++---
>  2 files changed, 72 insertions(+), 20 deletions(-)


Tagged for 6.1, thanks!

> -- 
> 2.26.3
> 




Re: [PATCH] hw/riscv: Fix OT IBEX reset vector

2021-04-19 Thread Alistair Francis
On Tue, Apr 20, 2021 at 7:26 AM Alexander Wagner
 wrote:
>
> Hi,
>
> I just wanted to check if the patch [1] is missing anything to be
> merged? If so, please let me know.

Thanks for the ping!

You have done everything correctly, I just forgot to apply the patch.

Do you mind re-sending the patch though? When re-sending the patch can
you include all of the reviewed by tags?

Alistair

>
> Regards
>
> Alex
>
>
> [1]
> https://patchew.org/QEMU/20210310221208.167990-1-alexander.wag...@ulal.de/
>
>
>



Re: [PATCH] hw/riscv: Fix OT IBEX reset vector

2021-04-19 Thread Alexander Wagner

Hi,

I just wanted to check if the patch [1] is missing anything to be 
merged? If so, please let me know.


Regards

Alex


[1] 
https://patchew.org/QEMU/20210310221208.167990-1-alexander.wag...@ulal.de/






Re: [PATCH v3] memory: Directly dispatch alias accesses on origin memory region

2021-04-19 Thread Philippe Mathieu-Daudé
On Mon, Apr 19, 2021 at 10:58 PM Philippe Mathieu-Daudé  wrote:
> On 4/19/21 10:13 PM, Mark Cave-Ayland wrote:
> > On 17/04/2021 15:02, Philippe Mathieu-Daudé wrote:
> >
> >> Since commit 2cdfcf272d ("memory: assign MemoryRegionOps to all
> >> regions"), all newly created regions are assigned with
> >> unassigned_mem_ops (which might be then overwritten).
> >>
> >> When using aliased container regions, and there is no region mapped
> >> at address 0 in the container, the memory_region_dispatch_read()
> >> and memory_region_dispatch_write() calls incorrectly return the
> >> container unassigned_mem_ops, because the alias offset is not used.
> >>
> >> The memory_region_init_alias() flow is:
> >>
> >>memory_region_init_alias()
> >>-> memory_region_init()
> >>   -> object_initialize(TYPE_MEMORY_REGION)
> >>  -> memory_region_initfn()
> >> -> mr->ops = _mem_ops;
> >>
> >> Later when accessing the alias, the memory_region_dispatch_read()
> >> flow is:
> >>
> >>memory_region_dispatch_read(offset)
> >>-> memory_region_access_valid(mr)   <- offset is ignored
> >>   -> mr->ops->valid.accepts()
> >>  -> unassigned_mem_accepts()
> >>  <- false
> >>   <- false
> >> <- MEMTX_DECODE_ERROR
> >>
> >> The caller gets a MEMTX_DECODE_ERROR while the access is OK.
> >>
> >> Fix by dispatching aliases recusirvely, accessing its origin region
> >> after adding the alias offset.
> >>
> >> Signed-off-by: Philippe Mathieu-Daudé 
> >> ---
> >> v3:
> >> - reworded, mentioning the "alias to container" case
> >> - use recursive call instead of while(), because easier when debugging
> >>therefore reset Richard R-b tag.
> >> v2:
> >> - use while()
> >> ---
> >>   softmmu/memory.c | 10 ++
> >>   1 file changed, 10 insertions(+)
> >>
> >> diff --git a/softmmu/memory.c b/softmmu/memory.c
> >> index d4493ef9e43..23bdbfac079 100644
> >> --- a/softmmu/memory.c
> >> +++ b/softmmu/memory.c
> >> @@ -1442,6 +1442,11 @@ MemTxResult
> >> memory_region_dispatch_read(MemoryRegion *mr,
> >>   unsigned size = memop_size(op);
> >>   MemTxResult r;
> >>   +if (mr->alias) {
> >> +return memory_region_dispatch_read(mr->alias,
> >> +   addr + mr->alias_offset,
> >> +   pval, op, attrs);
> >> +}
> >>   if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
> >>   *pval = unassigned_mem_read(mr, addr, size);
> >>   return MEMTX_DECODE_ERROR;
> >> @@ -1486,6 +1491,11 @@ MemTxResult
> >> memory_region_dispatch_write(MemoryRegion *mr,
> >>   {
> >>   unsigned size = memop_size(op);
> >>   +if (mr->alias) {
> >> +return memory_region_dispatch_write(mr->alias,
> >> +addr + mr->alias_offset,
> >> +data, op, attrs);
> >> +}
> >>   if (!memory_region_access_valid(mr, addr, size, true, attrs)) {
> >>   unassigned_mem_write(mr, addr, data, size);
> >>   return MEMTX_DECODE_ERROR;
> >
> > Whilst working on my q800 patches I realised that this was a similar
> > problem to the one I had with my macio.alias implementation at [1]:
> > except that in my case the unassigned_mem_ops mr->ops->valid.accepts()
> > function was being invoked on a ROM memory region instead of an alias. I
> > think this is exactly the same issue that you are attempting to fix with
> > your related patch at
> > https://lists.gnu.org/archive/html/qemu-devel/2021-04/msg03190.html
> > ("memory: Initialize MemoryRegionOps for RAM memory regions").
>
> So if 2 contributors hit similar issues, there is something wrong with
> the API. I don't see your use case or mine as forbidded by the
> documentation in "exec/memory.h".
>
> My patch might not be the proper fix, but we need to figure out how
> to avoid others to hit the same problem, as it is very hard to debug.
>
> At least an assertion and a comment.

Something like:

-- >8 --
diff --git a/softmmu/memory.c b/softmmu/memory.c
index d4493ef9e43..e031ac6e074 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -1442,6 +1442,7 @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
unsigned size = memop_size(op);
MemTxResult r;

+assert(!(mr->alias && !mr>alias_offset)); /* Use AddressSpace API
instead */
if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
*pval = unassigned_mem_read(mr, addr, size);
return MEMTX_DECODE_ERROR;

---

> > I eventually realised that I needed functions that could dispatch
> > reads/writes to both IO memory regions and ROM memory regions, and that
> > functionality is covered by the address_space_*() access functions.
> > Using the address_space_*() functions I was then able to come up with
> > the working implementation at [2] that handles accesses to both IO
> > memory regions and ROM memory regions correctly.
> >
> > The reason I 

Re: [PATCH v3 08/30] target/mips: Declare mips_cpu_set_error_pc() inlined in "internal.h"

2021-04-19 Thread Philippe Mathieu-Daudé
On 4/19/21 9:27 PM, Richard Henderson wrote:
> On 4/19/21 12:18 PM, Philippe Mathieu-Daudé wrote:
>> Rename set_pc() as mips_cpu_set_error_pc(), declare it inlined
>> and use it in cpu.c and op_helper.c.
> 
> Why "error_pc"?  The usage in mips_cpu_set_pc certainly isn't in
> response to any kind of error...

Indeed, but I couldn't find any good name. mips_cpu_set_pc() is
already taken, as is cpu_set_pc():

static void mips_cpu_set_pc(CPUState *cs, vaddr value)

mips_cpu_state_set_pc() maybe?



[PATCH v5 30/31] target/arm: Enforce alignment for aa64 vector LDn/STn (single)

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-a64.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 2a82dbbd6d..95897e63af 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -3815,6 +3815,7 @@ static void disas_ldst_single_struct(DisasContext *s, 
uint32_t insn)
 int index = is_q << 3 | S << 2 | size;
 int xs, total;
 TCGv_i64 clean_addr, tcg_rn, tcg_ebytes;
+MemOp mop;
 
 if (extract32(insn, 31, 1)) {
 unallocated_encoding(s);
@@ -3876,6 +3877,7 @@ static void disas_ldst_single_struct(DisasContext *s, 
uint32_t insn)
 
 clean_addr = gen_mte_checkN(s, tcg_rn, !is_load, is_postidx || rn != 31,
 total);
+mop = finalize_memop(s, scale);
 
 tcg_ebytes = tcg_const_i64(1 << scale);
 for (xs = 0; xs < selem; xs++) {
@@ -3883,8 +3885,7 @@ static void disas_ldst_single_struct(DisasContext *s, 
uint32_t insn)
 /* Load and replicate to all elements */
 TCGv_i64 tcg_tmp = tcg_temp_new_i64();
 
-tcg_gen_qemu_ld_i64(tcg_tmp, clean_addr,
-get_mem_index(s), s->be_data + scale);
+tcg_gen_qemu_ld_i64(tcg_tmp, clean_addr, get_mem_index(s), mop);
 tcg_gen_gvec_dup_i64(scale, vec_full_reg_offset(s, rt),
  (is_q + 1) * 8, vec_full_reg_size(s),
  tcg_tmp);
@@ -3892,9 +3893,9 @@ static void disas_ldst_single_struct(DisasContext *s, 
uint32_t insn)
 } else {
 /* Load/store one element per register */
 if (is_load) {
-do_vec_ld(s, rt, index, clean_addr, scale | s->be_data);
+do_vec_ld(s, rt, index, clean_addr, mop);
 } else {
-do_vec_st(s, rt, index, clean_addr, scale | s->be_data);
+do_vec_st(s, rt, index, clean_addr, mop);
 }
 }
 tcg_gen_add_i64(clean_addr, clean_addr, tcg_ebytes);
-- 
2.25.1




[PATCH v5 16/31] target/arm: Enforce alignment for LDA/LDAH/STL/STLH

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index 1b0951c45b..29fbbb84b2 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -6920,7 +6920,7 @@ static bool op_stl(DisasContext *s, arg_STL *a, MemOp mop)
 addr = load_reg(s, a->rn);
 tmp = load_reg(s, a->rt);
 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
-gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), mop);
+gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), mop | MO_ALIGN);
 disas_set_da_iss(s, mop, a->rt | ISSIsAcqRel | ISSIsWrite);
 
 tcg_temp_free_i32(tmp);
@@ -7076,7 +7076,7 @@ static bool op_lda(DisasContext *s, arg_LDA *a, MemOp mop)
 
 addr = load_reg(s, a->rn);
 tmp = tcg_temp_new_i32();
-gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), mop);
+gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), mop | MO_ALIGN);
 disas_set_da_iss(s, mop, a->rt | ISSIsAcqRel);
 tcg_temp_free_i32(addr);
 
-- 
2.25.1




[PATCH v5 12/31] target/arm: Merge gen_aa32_frob64 into gen_aa32_ld_i64

2021-04-19 Thread Richard Henderson
This is the only caller.  Adjust some commentary to talk
about SCTLR_B instead of the vanishing function.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c | 37 -
 1 file changed, 16 insertions(+), 21 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index d46030248a..b47a58ee9a 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -975,20 +975,17 @@ static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 
val, TCGv_i32 a32,
 gen_aa32_st_i32(s, val, a32, index, OPC);   \
 }
 
-static inline void gen_aa32_frob64(DisasContext *s, TCGv_i64 val)
-{
-/* Not needed for user-mode BE32, where we use MO_BE instead.  */
-if (!IS_USER_ONLY && s->sctlr_b) {
-tcg_gen_rotri_i64(val, val, 32);
-}
-}
-
 static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
 int index, MemOp opc)
 {
 TCGv addr = gen_aa32_addr(s, a32, opc);
 tcg_gen_qemu_ld_i64(val, addr, index, opc);
-gen_aa32_frob64(s, val);
+
+/* Not needed for user-mode BE32, where we use MO_BE instead.  */
+if (!IS_USER_ONLY && s->sctlr_b) {
+tcg_gen_rotri_i64(val, val, 32);
+}
+
 tcg_temp_free(addr);
 }
 
@@ -4987,16 +4984,13 @@ static void gen_load_exclusive(DisasContext *s, int rt, 
int rt2,
 TCGv_i32 tmp2 = tcg_temp_new_i32();
 TCGv_i64 t64 = tcg_temp_new_i64();
 
-/* For AArch32, architecturally the 32-bit word at the lowest
+/*
+ * For AArch32, architecturally the 32-bit word at the lowest
  * address is always Rt and the one at addr+4 is Rt2, even if
  * the CPU is big-endian. That means we don't want to do a
- * gen_aa32_ld_i64(), which invokes gen_aa32_frob64() as if
- * for an architecturally 64-bit access, but instead do a
- * 64-bit access using MO_BE if appropriate and then split
- * the two halves.
- * This only makes a difference for BE32 user-mode, where
- * frob64() must not flip the two halves of the 64-bit data
- * but this code must treat BE32 user-mode like BE32 system.
+ * gen_aa32_ld_i64(), which checks SCTLR_B as if for an
+ * architecturally 64-bit access, but instead do a 64-bit access
+ * using MO_BE if appropriate and then split the two halves.
  */
 TCGv taddr = gen_aa32_addr(s, addr, opc);
 
@@ -5056,14 +5050,15 @@ static void gen_store_exclusive(DisasContext *s, int 
rd, int rt, int rt2,
 TCGv_i64 n64 = tcg_temp_new_i64();
 
 t2 = load_reg(s, rt2);
-/* For AArch32, architecturally the 32-bit word at the lowest
+
+/*
+ * For AArch32, architecturally the 32-bit word at the lowest
  * address is always Rt and the one at addr+4 is Rt2, even if
  * the CPU is big-endian. Since we're going to treat this as a
  * single 64-bit BE store, we need to put the two halves in the
  * opposite order for BE to LE, so that they end up in the right
- * places.
- * We don't want gen_aa32_frob64() because that does the wrong
- * thing for BE32 usermode.
+ * places.  We don't want gen_aa32_st_i64, because that checks
+ * SCTLR_B as if for an architectural 64-bit access.
  */
 if (s->be_data == MO_BE) {
 tcg_gen_concat_i32_i64(n64, t2, t1);
-- 
2.25.1




[PATCH v5 07/31] target/arm: Use cpu_abort in assert_hflags_rebuild_correctly

2021-04-19 Thread Richard Henderson
Using cpu_abort takes care of things like unregistering a
SIGABRT handler for user-only.

Signed-off-by: Richard Henderson 
---
 target/arm/helper.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 4aa7650d3a..8275eb2e65 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -13257,11 +13257,10 @@ static inline void 
assert_hflags_rebuild_correctly(CPUARMState *env)
 CPUARMTBFlags r = rebuild_hflags_internal(env);
 
 if (unlikely(c.flags != r.flags || c.flags2 != r.flags2)) {
-fprintf(stderr, "TCG hflags mismatch "
-"(current:(0x%08x,0x" TARGET_FMT_lx ")"
-" rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n",
-c.flags, c.flags2, r.flags, r.flags2);
-abort();
+cpu_abort(env_cpu(env), "TCG hflags mismatch "
+  "(current:(0x%08x,0x" TARGET_FMT_lx ")"
+  " rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n",
+  c.flags, c.flags2, r.flags, r.flags2);
 }
 #endif
 }
-- 
2.25.1




Re: [PATCH v3] memory: Directly dispatch alias accesses on origin memory region

2021-04-19 Thread Philippe Mathieu-Daudé
Hi Mark,

On 4/19/21 10:13 PM, Mark Cave-Ayland wrote:
> On 17/04/2021 15:02, Philippe Mathieu-Daudé wrote:
> 
>> Since commit 2cdfcf272d ("memory: assign MemoryRegionOps to all
>> regions"), all newly created regions are assigned with
>> unassigned_mem_ops (which might be then overwritten).
>>
>> When using aliased container regions, and there is no region mapped
>> at address 0 in the container, the memory_region_dispatch_read()
>> and memory_region_dispatch_write() calls incorrectly return the
>> container unassigned_mem_ops, because the alias offset is not used.
>>
>> The memory_region_init_alias() flow is:
>>
>>    memory_region_init_alias()
>>    -> memory_region_init()
>>   -> object_initialize(TYPE_MEMORY_REGION)
>>  -> memory_region_initfn()
>>     -> mr->ops = _mem_ops;
>>
>> Later when accessing the alias, the memory_region_dispatch_read()
>> flow is:
>>
>>    memory_region_dispatch_read(offset)
>>    -> memory_region_access_valid(mr)   <- offset is ignored
>>   -> mr->ops->valid.accepts()
>>  -> unassigned_mem_accepts()
>>  <- false
>>   <- false
>>     <- MEMTX_DECODE_ERROR
>>
>> The caller gets a MEMTX_DECODE_ERROR while the access is OK.
>>
>> Fix by dispatching aliases recusirvely, accessing its origin region
>> after adding the alias offset.
>>
>> Signed-off-by: Philippe Mathieu-Daudé 
>> ---
>> v3:
>> - reworded, mentioning the "alias to container" case
>> - use recursive call instead of while(), because easier when debugging
>>    therefore reset Richard R-b tag.
>> v2:
>> - use while()
>> ---
>>   softmmu/memory.c | 10 ++
>>   1 file changed, 10 insertions(+)
>>
>> diff --git a/softmmu/memory.c b/softmmu/memory.c
>> index d4493ef9e43..23bdbfac079 100644
>> --- a/softmmu/memory.c
>> +++ b/softmmu/memory.c
>> @@ -1442,6 +1442,11 @@ MemTxResult
>> memory_region_dispatch_read(MemoryRegion *mr,
>>   unsigned size = memop_size(op);
>>   MemTxResult r;
>>   +    if (mr->alias) {
>> +    return memory_region_dispatch_read(mr->alias,
>> +   addr + mr->alias_offset,
>> +   pval, op, attrs);
>> +    }
>>   if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
>>   *pval = unassigned_mem_read(mr, addr, size);
>>   return MEMTX_DECODE_ERROR;
>> @@ -1486,6 +1491,11 @@ MemTxResult
>> memory_region_dispatch_write(MemoryRegion *mr,
>>   {
>>   unsigned size = memop_size(op);
>>   +    if (mr->alias) {
>> +    return memory_region_dispatch_write(mr->alias,
>> +    addr + mr->alias_offset,
>> +    data, op, attrs);
>> +    }
>>   if (!memory_region_access_valid(mr, addr, size, true, attrs)) {
>>   unassigned_mem_write(mr, addr, data, size);
>>   return MEMTX_DECODE_ERROR;
> 
> Whilst working on my q800 patches I realised that this was a similar
> problem to the one I had with my macio.alias implementation at [1]:
> except that in my case the unassigned_mem_ops mr->ops->valid.accepts()
> function was being invoked on a ROM memory region instead of an alias. I
> think this is exactly the same issue that you are attempting to fix with
> your related patch at
> https://lists.gnu.org/archive/html/qemu-devel/2021-04/msg03190.html
> ("memory: Initialize MemoryRegionOps for RAM memory regions").

So if 2 contributors hit similar issues, there is something wrong with
the API. I don't see your use case or mine as forbidded by the
documentation in "exec/memory.h".

My patch might not be the proper fix, but we need to figure out how
to avoid others to hit the same problem, as it is very hard to debug.

At least an assertion and a comment.

> I eventually realised that I needed functions that could dispatch
> reads/writes to both IO memory regions and ROM memory regions, and that
> functionality is covered by the address_space_*() access functions.
> Using the address_space_*() functions I was then able to come up with
> the working implementation at [2] that handles accesses to both IO
> memory regions and ROM memory regions correctly.
> 
> The reason I initially used the
> memory_region_dispatch_read()/memory_region_dispatch_write() functions
> was because I could see that was how the virtio devices dispatched
> accesses through the proxy. However I'm wondering now if this API can
> only be used for terminating IO memory regions, and so the alias_offset
> that you're applying above should actually be applied elsewhere instead.

I figured out the AddressSpace API make these cases simpler, but IIRC
there is some overhead, some function tries to resolve / update
something and iterate over a list. While from the MemoryRegion API we
already know which region we want to access.

I Cc'ed Peter considering him expert in this area, but don't know else
who to ask for help on this topic...

> ATB,
> 
> Mark.
> 
> [1]
> 

[PATCH v5 29/31] target/arm: Enforce alignment for aa64 vector LDn/STn (multiple)

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-a64.c | 15 +++
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index d3bda16ecd..2a82dbbd6d 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -3635,7 +3635,7 @@ static void disas_ldst_multiple_struct(DisasContext *s, 
uint32_t insn)
 bool is_postidx = extract32(insn, 23, 1);
 bool is_q = extract32(insn, 30, 1);
 TCGv_i64 clean_addr, tcg_rn, tcg_ebytes;
-MemOp endian = s->be_data;
+MemOp endian, align, mop;
 
 int total;/* total bytes */
 int elements; /* elements per vector */
@@ -3703,6 +3703,7 @@ static void disas_ldst_multiple_struct(DisasContext *s, 
uint32_t insn)
 }
 
 /* For our purposes, bytes are always little-endian.  */
+endian = s->be_data;
 if (size == 0) {
 endian = MO_LE;
 }
@@ -3721,11 +3722,17 @@ static void disas_ldst_multiple_struct(DisasContext *s, 
uint32_t insn)
  * Consecutive little-endian elements from a single register
  * can be promoted to a larger little-endian operation.
  */
+align = MO_ALIGN;
 if (selem == 1 && endian == MO_LE) {
+align = pow2_align(size);
 size = 3;
 }
-elements = (is_q ? 16 : 8) >> size;
+if (!s->align_mem) {
+align = 0;
+}
+mop = endian | size | align;
 
+elements = (is_q ? 16 : 8) >> size;
 tcg_ebytes = tcg_const_i64(1 << size);
 for (r = 0; r < rpt; r++) {
 int e;
@@ -3734,9 +3741,9 @@ static void disas_ldst_multiple_struct(DisasContext *s, 
uint32_t insn)
 for (xs = 0; xs < selem; xs++) {
 int tt = (rt + r + xs) % 32;
 if (is_store) {
-do_vec_st(s, tt, e, clean_addr, size | endian);
+do_vec_st(s, tt, e, clean_addr, mop);
 } else {
-do_vec_ld(s, tt, e, clean_addr, size | endian);
+do_vec_ld(s, tt, e, clean_addr, mop);
 }
 tcg_gen_add_i64(clean_addr, clean_addr, tcg_ebytes);
 }
-- 
2.25.1




Re: [PATCH v3 24/30] target/mips: Move helper_cache() to tcg/sysemu/special_helper.c

2021-04-19 Thread Richard Henderson

On 4/19/21 12:18 PM, Philippe Mathieu-Daudé wrote:

+#define STUB_HELPER(NAME, ...) \
+static inline void gen_helper_##NAME(__VA_ARGS__) \
+{ qemu_build_not_reached(); }


Does this really work when optimization is on?  I suspect you need additional 
cleanups before you can use qemu_build_not_reached().


In particular:

 (1) check_cp0_enabled must return a boolean, so that the
 caller can avoid emitting dead code after the
 exception is emitted.

 (2) check_cp0_enabled must be adjusted to Know that
 cp0 access is always forbidden in user-only mode.

Otherwise, I can't see how the compiler can prove that the call to 
gen_cache_operation, and thus gen_helper_cache, is unreachable.


In the meantime, you can use g_assert_not_reached() in STUB_HELPER.  With that 
changed,


Reviewed-by: Richard Henderson 


r~



[PATCH v5 24/31] target/arm: Enforce alignment for VLDn/VSTn (single)

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-neon.c.inc | 48 -
 1 file changed, 42 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index e706c37c80..a02b8369a1 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -629,6 +629,7 @@ static bool trans_VLDST_single(DisasContext *s, 
arg_VLDST_single *a)
 int nregs = a->n + 1;
 int vd = a->vd;
 TCGv_i32 addr, tmp;
+MemOp mop;
 
 if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
 return false;
@@ -678,23 +679,58 @@ static bool trans_VLDST_single(DisasContext *s, 
arg_VLDST_single *a)
 return true;
 }
 
+/* Pick up SCTLR settings */
+mop = finalize_memop(s, a->size);
+
+if (a->align) {
+MemOp align_op;
+
+switch (nregs) {
+case 1:
+/* For VLD1, use natural alignment. */
+align_op = MO_ALIGN;
+break;
+case 2:
+/* For VLD2, use double alignment. */
+align_op = pow2_align(a->size + 1);
+break;
+case 4:
+if (a->size == MO_32) {
+/*
+ * For VLD4.32, align = 1 is double alignment, align = 2 is
+ * quad alignment; align = 3 is rejected above.
+ */
+align_op = pow2_align(a->size + a->align);
+} else {
+/* For VLD4.8 and VLD.16, we want quad alignment. */
+align_op = pow2_align(a->size + 2);
+}
+break;
+default:
+/* For VLD3, the alignment field is zero and rejected above. */
+g_assert_not_reached();
+}
+
+mop = (mop & ~MO_AMASK) | align_op;
+}
+
 tmp = tcg_temp_new_i32();
 addr = tcg_temp_new_i32();
 load_reg_var(s, addr, a->rn);
-/*
- * TODO: if we implemented alignment exceptions, we should check
- * addr against the alignment encoded in a->align here.
- */
+
 for (reg = 0; reg < nregs; reg++) {
 if (a->l) {
-gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), a->size);
+gen_aa32_ld_internal_i32(s, tmp, addr, get_mem_index(s), mop);
 neon_store_element(vd, a->reg_idx, a->size, tmp);
 } else { /* Store */
 neon_load_element(tmp, vd, a->reg_idx, a->size);
-gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), a->size);
+gen_aa32_st_internal_i32(s, tmp, addr, get_mem_index(s), mop);
 }
 vd += a->stride;
 tcg_gen_addi_i32(addr, addr, 1 << a->size);
+
+/* Subsequent memory operations inherit alignment */
+mop &= ~MO_AMASK;
 }
 tcg_temp_free_i32(addr);
 tcg_temp_free_i32(tmp);
-- 
2.25.1




[PATCH v5 31/31] target/arm: Enforce alignment for sve LD1R

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index 584c4d047c..864ed669c4 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -5001,7 +5001,7 @@ static bool trans_LD1R_zpri(DisasContext *s, 
arg_rpri_load *a)
 clean_addr = gen_mte_check1(s, temp, false, true, msz);
 
 tcg_gen_qemu_ld_i64(temp, clean_addr, get_mem_index(s),
-s->be_data | dtype_mop[a->dtype]);
+finalize_memop(s, dtype_mop[a->dtype]));
 
 /* Broadcast to *all* elements.  */
 tcg_gen_gvec_dup_i64(esz, vec_full_reg_offset(s, a->rd),
-- 
2.25.1




Re: [Virtio-fs] [PATCH 2/2] virtiofsd: Add help for -o xattr-mapping

2021-04-19 Thread Vivek Goyal
On Mon, Apr 19, 2021 at 02:21:11PM -0500, Connor Kuehl wrote:
> On 4/19/21 2:07 PM, Vivek Goyal wrote:
> >> This is a helpful note, but it doesn't tell the whole story. I think
> >> it'd be helpful to add one last note to this option which is to
> >> recommend reading the virtiofsd(1) man-page for more information on
> >> xattrmap rules.
> > 
> > Is there a virtiofsd man page as well? All I see is
> > docs/tools/virtiofsd.rst.
> 
> Yes, it's generated from that file. Should be located in
> qemu/build/docs/virtiofsd.1 after building QEMU.

Ok thanks. I guess that gets build only if I pass option --enable-docs. 

Thanks
Vivek




[PATCH v5 25/31] target/arm: Use finalize_memop for aa64 gpr load/store

2021-04-19 Thread Richard Henderson
In the case of gpr load, merge the size and is_signed arguments;
otherwise, simply convert size to memop.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-a64.c | 78 --
 1 file changed, 33 insertions(+), 45 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 92a62b1a75..f2995d2b74 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -886,19 +886,19 @@ static void gen_adc_CC(int sf, TCGv_i64 dest, TCGv_i64 
t0, TCGv_i64 t1)
  * Store from GPR register to memory.
  */
 static void do_gpr_st_memidx(DisasContext *s, TCGv_i64 source,
- TCGv_i64 tcg_addr, int size, int memidx,
+ TCGv_i64 tcg_addr, MemOp memop, int memidx,
  bool iss_valid,
  unsigned int iss_srt,
  bool iss_sf, bool iss_ar)
 {
-g_assert(size <= 3);
-tcg_gen_qemu_st_i64(source, tcg_addr, memidx, s->be_data + size);
+memop = finalize_memop(s, memop);
+tcg_gen_qemu_st_i64(source, tcg_addr, memidx, memop);
 
 if (iss_valid) {
 uint32_t syn;
 
 syn = syn_data_abort_with_iss(0,
-  size,
+  (memop & MO_SIZE),
   false,
   iss_srt,
   iss_sf,
@@ -909,37 +909,28 @@ static void do_gpr_st_memidx(DisasContext *s, TCGv_i64 
source,
 }
 
 static void do_gpr_st(DisasContext *s, TCGv_i64 source,
-  TCGv_i64 tcg_addr, int size,
+  TCGv_i64 tcg_addr, MemOp memop,
   bool iss_valid,
   unsigned int iss_srt,
   bool iss_sf, bool iss_ar)
 {
-do_gpr_st_memidx(s, source, tcg_addr, size, get_mem_index(s),
+do_gpr_st_memidx(s, source, tcg_addr, memop, get_mem_index(s),
  iss_valid, iss_srt, iss_sf, iss_ar);
 }
 
 /*
  * Load from memory to GPR register
  */
-static void do_gpr_ld_memidx(DisasContext *s,
- TCGv_i64 dest, TCGv_i64 tcg_addr,
- int size, bool is_signed,
- bool extend, int memidx,
+static void do_gpr_ld_memidx(DisasContext *s, TCGv_i64 dest, TCGv_i64 tcg_addr,
+ MemOp memop, bool extend, int memidx,
  bool iss_valid, unsigned int iss_srt,
  bool iss_sf, bool iss_ar)
 {
-MemOp memop = s->be_data + size;
-
-g_assert(size <= 3);
-
-if (is_signed) {
-memop += MO_SIGN;
-}
-
+memop = finalize_memop(s, memop);
 tcg_gen_qemu_ld_i64(dest, tcg_addr, memidx, memop);
 
-if (extend && is_signed) {
-g_assert(size < 3);
+if (extend && (memop & MO_SIGN)) {
+g_assert((memop & MO_SIZE) <= MO_32);
 tcg_gen_ext32u_i64(dest, dest);
 }
 
@@ -947,8 +938,8 @@ static void do_gpr_ld_memidx(DisasContext *s,
 uint32_t syn;
 
 syn = syn_data_abort_with_iss(0,
-  size,
-  is_signed,
+  (memop & MO_SIZE),
+  (memop & MO_SIGN) != 0,
   iss_srt,
   iss_sf,
   iss_ar,
@@ -957,14 +948,12 @@ static void do_gpr_ld_memidx(DisasContext *s,
 }
 }
 
-static void do_gpr_ld(DisasContext *s,
-  TCGv_i64 dest, TCGv_i64 tcg_addr,
-  int size, bool is_signed, bool extend,
+static void do_gpr_ld(DisasContext *s, TCGv_i64 dest, TCGv_i64 tcg_addr,
+  MemOp memop, bool extend,
   bool iss_valid, unsigned int iss_srt,
   bool iss_sf, bool iss_ar)
 {
-do_gpr_ld_memidx(s, dest, tcg_addr, size, is_signed, extend,
- get_mem_index(s),
+do_gpr_ld_memidx(s, dest, tcg_addr, memop, extend, get_mem_index(s),
  iss_valid, iss_srt, iss_sf, iss_ar);
 }
 
@@ -2717,7 +2706,7 @@ static void disas_ldst_excl(DisasContext *s, uint32_t 
insn)
 }
 clean_addr = gen_mte_check1(s, cpu_reg_sp(s, rn),
 false, rn != 31, size);
-do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, false, false, true, rt,
+do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, false, true, rt,
   disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 return;
@@ -2830,8 +2819,8 @@ static void disas_ld_lit(DisasContext *s, uint32_t insn)
 /* Only unsigned 32bit loads target 32bit registers.  */
 bool iss_sf = opc != 0;
 
-do_gpr_ld(s, tcg_rt, clean_addr, 

[PATCH v5 27/31] target/arm: Enforce alignment for aa64 load-acq/store-rel

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-a64.c | 23 ++-
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index b90d6880e7..ac60dcf760 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -2699,7 +2699,8 @@ static void disas_ldst_excl(DisasContext *s, uint32_t 
insn)
 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
 clean_addr = gen_mte_check1(s, cpu_reg_sp(s, rn),
 true, rn != 31, size);
-do_gpr_st(s, cpu_reg(s, rt), clean_addr, size, true, rt,
+/* TODO: ARMv8.4-LSE SCTLR.nAA */
+do_gpr_st(s, cpu_reg(s, rt), clean_addr, size | MO_ALIGN, true, rt,
   disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
 return;
 
@@ -2716,8 +2717,9 @@ static void disas_ldst_excl(DisasContext *s, uint32_t 
insn)
 }
 clean_addr = gen_mte_check1(s, cpu_reg_sp(s, rn),
 false, rn != 31, size);
-do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, false, true, rt,
-  disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
+/* TODO: ARMv8.4-LSE SCTLR.nAA */
+do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size | MO_ALIGN, false, true,
+  rt, disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 return;
 
@@ -3505,15 +3507,18 @@ static void disas_ldst_ldapr_stlr(DisasContext *s, 
uint32_t insn)
 int size = extract32(insn, 30, 2);
 TCGv_i64 clean_addr, dirty_addr;
 bool is_store = false;
-bool is_signed = false;
 bool extend = false;
 bool iss_sf;
+MemOp mop;
 
 if (!dc_isar_feature(aa64_rcpc_8_4, s)) {
 unallocated_encoding(s);
 return;
 }
 
+/* TODO: ARMv8.4-LSE SCTLR.nAA */
+mop = size | MO_ALIGN;
+
 switch (opc) {
 case 0: /* STLURB */
 is_store = true;
@@ -3525,21 +3530,21 @@ static void disas_ldst_ldapr_stlr(DisasContext *s, 
uint32_t insn)
 unallocated_encoding(s);
 return;
 }
-is_signed = true;
+mop |= MO_SIGN;
 break;
 case 3: /* LDAPURS* 32-bit variant */
 if (size > 1) {
 unallocated_encoding(s);
 return;
 }
-is_signed = true;
+mop |= MO_SIGN;
 extend = true; /* zero-extend 32->64 after signed load */
 break;
 default:
 g_assert_not_reached();
 }
 
-iss_sf = disas_ldst_compute_iss_sf(size, is_signed, opc);
+iss_sf = disas_ldst_compute_iss_sf(size, (mop & MO_SIGN) != 0, opc);
 
 if (rn == 31) {
 gen_check_sp_alignment(s);
@@ -3552,13 +3557,13 @@ static void disas_ldst_ldapr_stlr(DisasContext *s, 
uint32_t insn)
 if (is_store) {
 /* Store-Release semantics */
 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
-do_gpr_st(s, cpu_reg(s, rt), clean_addr, size, true, rt, iss_sf, true);
+do_gpr_st(s, cpu_reg(s, rt), clean_addr, mop, true, rt, iss_sf, true);
 } else {
 /*
  * Load-AcquirePC semantics; we implement as the slightly more
  * restrictive Load-Acquire.
  */
-do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size + is_signed * MO_SIGN,
+do_gpr_ld(s, cpu_reg(s, rt), clean_addr, mop,
   extend, true, rt, iss_sf, true);
 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 }
-- 
2.25.1




Re: [PATCH v3 18/30] target/mips: Restrict cpu_mips_get_random() / update_pagemask() to TCG

2021-04-19 Thread Richard Henderson

On 4/19/21 12:18 PM, Philippe Mathieu-Daudé wrote:

Signed-off-by: Philippe Mathieu-Daudé
---
  target/mips/internal.h | 4 
  target/mips/tcg/tcg-internal.h | 9 +
  2 files changed, 9 insertions(+), 4 deletions(-)


Reviewed-by: Richard Henderson 

r~




[PATCH v5 18/31] target/arm: Enforce alignment for RFE

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index f58ac4f018..2cdf58daa1 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -8341,10 +8341,10 @@ static bool trans_RFE(DisasContext *s, arg_RFE *a)
 
 /* Load PC into tmp and CPSR into tmp2.  */
 t1 = tcg_temp_new_i32();
-gen_aa32_ld32u(s, t1, addr, get_mem_index(s));
+gen_aa32_ld_i32(s, t1, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 tcg_gen_addi_i32(addr, addr, 4);
 t2 = tcg_temp_new_i32();
-gen_aa32_ld32u(s, t2, addr, get_mem_index(s));
+gen_aa32_ld_i32(s, t2, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 
 if (a->w) {
 /* Base writeback.  */
-- 
2.25.1




[PATCH v5 28/31] target/arm: Use MemOp for size + endian in aa64 vector ld/st

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-a64.c | 20 ++--
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index ac60dcf760..d3bda16ecd 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -1146,24 +1146,24 @@ static void write_vec_element_i32(DisasContext *s, 
TCGv_i32 tcg_src,
 
 /* Store from vector register to memory */
 static void do_vec_st(DisasContext *s, int srcidx, int element,
-  TCGv_i64 tcg_addr, int size, MemOp endian)
+  TCGv_i64 tcg_addr, MemOp mop)
 {
 TCGv_i64 tcg_tmp = tcg_temp_new_i64();
 
-read_vec_element(s, tcg_tmp, srcidx, element, size);
-tcg_gen_qemu_st_i64(tcg_tmp, tcg_addr, get_mem_index(s), endian | size);
+read_vec_element(s, tcg_tmp, srcidx, element, mop & MO_SIZE);
+tcg_gen_qemu_st_i64(tcg_tmp, tcg_addr, get_mem_index(s), mop);
 
 tcg_temp_free_i64(tcg_tmp);
 }
 
 /* Load from memory to vector register */
 static void do_vec_ld(DisasContext *s, int destidx, int element,
-  TCGv_i64 tcg_addr, int size, MemOp endian)
+  TCGv_i64 tcg_addr, MemOp mop)
 {
 TCGv_i64 tcg_tmp = tcg_temp_new_i64();
 
-tcg_gen_qemu_ld_i64(tcg_tmp, tcg_addr, get_mem_index(s), endian | size);
-write_vec_element(s, tcg_tmp, destidx, element, size);
+tcg_gen_qemu_ld_i64(tcg_tmp, tcg_addr, get_mem_index(s), mop);
+write_vec_element(s, tcg_tmp, destidx, element, mop & MO_SIZE);
 
 tcg_temp_free_i64(tcg_tmp);
 }
@@ -3734,9 +3734,9 @@ static void disas_ldst_multiple_struct(DisasContext *s, 
uint32_t insn)
 for (xs = 0; xs < selem; xs++) {
 int tt = (rt + r + xs) % 32;
 if (is_store) {
-do_vec_st(s, tt, e, clean_addr, size, endian);
+do_vec_st(s, tt, e, clean_addr, size | endian);
 } else {
-do_vec_ld(s, tt, e, clean_addr, size, endian);
+do_vec_ld(s, tt, e, clean_addr, size | endian);
 }
 tcg_gen_add_i64(clean_addr, clean_addr, tcg_ebytes);
 }
@@ -3885,9 +3885,9 @@ static void disas_ldst_single_struct(DisasContext *s, 
uint32_t insn)
 } else {
 /* Load/store one element per register */
 if (is_load) {
-do_vec_ld(s, rt, index, clean_addr, scale, s->be_data);
+do_vec_ld(s, rt, index, clean_addr, scale | s->be_data);
 } else {
-do_vec_st(s, rt, index, clean_addr, scale, s->be_data);
+do_vec_st(s, rt, index, clean_addr, scale | s->be_data);
 }
 }
 tcg_gen_add_i64(clean_addr, clean_addr, tcg_ebytes);
-- 
2.25.1




[PATCH v5 10/31] target/arm: Add ALIGN_MEM to TBFLAG_ANY

2021-04-19 Thread Richard Henderson
Use this to signal when memory access alignment is required.
This value comes from the CCR register for M-profile, and
from the SCTLR register for A-profile.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   |  2 ++
 target/arm/translate.h |  2 ++
 target/arm/helper.c| 19 +--
 target/arm/translate-a64.c |  1 +
 target/arm/translate.c |  7 +++
 5 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 5e0131be1a..616b393253 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3414,6 +3414,8 @@ FIELD(TBFLAG_ANY, MMUIDX, 4, 4)
 FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
 /* For A-profile only, target EL for debug exceptions.  */
 FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
+/* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
+FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
 
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
diff --git a/target/arm/translate.h b/target/arm/translate.h
index 50c2aba066..b185c14a03 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -87,6 +87,8 @@ typedef struct DisasContext {
 bool bt;
 /* True if any CP15 access is trapped by HSTR_EL2 */
 bool hstr_active;
+/* True if memory operations require alignment */
+bool align_mem;
 /*
  * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
  *  < 0, set by the current instruction.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8275eb2e65..cb542d4300 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -13018,6 +13018,12 @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState 
*env, int fp_el,
 ARMMMUIdx mmu_idx)
 {
 CPUARMTBFlags flags = {};
+uint32_t ccr = env->v7m.ccr[env->v7m.secure];
+
+/* Without HaveMainExt, CCR.UNALIGN_TRP is RES1. */
+if (ccr & R_V7M_CCR_UNALIGN_TRP_MASK) {
+DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
+}
 
 if (arm_v7m_is_handler_mode(env)) {
 DP_TBFLAG_M32(flags, HANDLER, 1);
@@ -13030,7 +13036,7 @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState 
*env, int fp_el,
  */
 if (arm_feature(env, ARM_FEATURE_V8) &&
 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
-  (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
+  (ccr & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
 DP_TBFLAG_M32(flags, STACKCHECK, 1);
 }
 
@@ -13049,12 +13055,17 @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState 
*env, int fp_el,
 ARMMMUIdx mmu_idx)
 {
 CPUARMTBFlags flags = rebuild_hflags_aprofile(env);
+int el = arm_current_el(env);
+
+if (arm_sctlr(env, el) & SCTLR_A) {
+DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
+}
 
 if (arm_el_is_aa64(env, 1)) {
 DP_TBFLAG_A32(flags, VFPEN, 1);
 }
 
-if (arm_current_el(env) < 2 && env->cp15.hstr_el2 &&
+if (el < 2 && env->cp15.hstr_el2 &&
 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
 DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
 }
@@ -13099,6 +13110,10 @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState 
*env, int el, int fp_el,
 
 sctlr = regime_sctlr(env, stage1);
 
+if (sctlr & SCTLR_A) {
+DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
+}
+
 if (arm_cpu_data_is_big_endian_a64(el, sctlr)) {
 DP_TBFLAG_ANY(flags, BE_DATA, 1);
 }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index b32ff5..92a62b1a75 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -14697,6 +14697,7 @@ static void 
aarch64_tr_init_disas_context(DisasContextBase *dcbase,
 dc->user = (dc->current_el == 0);
 #endif
 dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
+dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
 dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
 dc->sve_len = (EX_TBFLAG_A64(tb_flags, ZCR_LEN) + 1) * 16;
 dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index 418715fe13..e918c2e1a4 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -933,8 +933,7 @@ static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, 
TCGv_i32 a32,
 {
 TCGv addr;
 
-if (arm_dc_feature(s, ARM_FEATURE_M) &&
-!arm_dc_feature(s, ARM_FEATURE_M_MAIN)) {
+if (s->align_mem) {
 opc |= MO_ALIGN;
 }
 
@@ -948,8 +947,7 @@ static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, 
TCGv_i32 a32,
 {
 TCGv addr;
 
-if (arm_dc_feature(s, ARM_FEATURE_M) &&
-!arm_dc_feature(s, ARM_FEATURE_M_MAIN)) {
+if (s->align_mem) {
 opc |= MO_ALIGN;
 }
 
@@ -8861,6 +8859,7 @@ static void arm_tr_init_disas_context(DisasContextBase 
*dcbase, CPUState *cs)
 dc->user = (dc->current_el == 0);
 #endif
 dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
+

[PATCH v5 26/31] target/arm: Use finalize_memop for aa64 fpr load/store

2021-04-19 Thread Richard Henderson
For 128-bit load/store, use 16-byte alignment.  This
requires that we perform the two operations in the
correct order so that we generate the alignment fault
before modifying memory.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-a64.c | 42 +++---
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index f2995d2b74..b90d6880e7 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -963,25 +963,33 @@ static void do_gpr_ld(DisasContext *s, TCGv_i64 dest, 
TCGv_i64 tcg_addr,
 static void do_fp_st(DisasContext *s, int srcidx, TCGv_i64 tcg_addr, int size)
 {
 /* This writes the bottom N bits of a 128 bit wide vector to memory */
-TCGv_i64 tmp = tcg_temp_new_i64();
-tcg_gen_ld_i64(tmp, cpu_env, fp_reg_offset(s, srcidx, MO_64));
+TCGv_i64 tmplo = tcg_temp_new_i64();
+MemOp mop;
+
+tcg_gen_ld_i64(tmplo, cpu_env, fp_reg_offset(s, srcidx, MO_64));
+
 if (size < 4) {
-tcg_gen_qemu_st_i64(tmp, tcg_addr, get_mem_index(s),
-s->be_data + size);
+mop = finalize_memop(s, size);
+tcg_gen_qemu_st_i64(tmplo, tcg_addr, get_mem_index(s), mop);
 } else {
 bool be = s->be_data == MO_BE;
 TCGv_i64 tcg_hiaddr = tcg_temp_new_i64();
+TCGv_i64 tmphi = tcg_temp_new_i64();
 
+tcg_gen_ld_i64(tmphi, cpu_env, fp_reg_hi_offset(s, srcidx));
+
+mop = s->be_data | MO_Q;
+tcg_gen_qemu_st_i64(be ? tmphi : tmplo, tcg_addr, get_mem_index(s),
+mop | (s->align_mem ? MO_ALIGN_16 : 0));
 tcg_gen_addi_i64(tcg_hiaddr, tcg_addr, 8);
-tcg_gen_qemu_st_i64(tmp, be ? tcg_hiaddr : tcg_addr, get_mem_index(s),
-s->be_data | MO_Q);
-tcg_gen_ld_i64(tmp, cpu_env, fp_reg_hi_offset(s, srcidx));
-tcg_gen_qemu_st_i64(tmp, be ? tcg_addr : tcg_hiaddr, get_mem_index(s),
-s->be_data | MO_Q);
+tcg_gen_qemu_st_i64(be ? tmplo : tmphi, tcg_hiaddr,
+get_mem_index(s), mop);
+
 tcg_temp_free_i64(tcg_hiaddr);
+tcg_temp_free_i64(tmphi);
 }
 
-tcg_temp_free_i64(tmp);
+tcg_temp_free_i64(tmplo);
 }
 
 /*
@@ -992,10 +1000,11 @@ static void do_fp_ld(DisasContext *s, int destidx, 
TCGv_i64 tcg_addr, int size)
 /* This always zero-extends and writes to a full 128 bit wide vector */
 TCGv_i64 tmplo = tcg_temp_new_i64();
 TCGv_i64 tmphi = NULL;
+MemOp mop;
 
 if (size < 4) {
-MemOp memop = s->be_data + size;
-tcg_gen_qemu_ld_i64(tmplo, tcg_addr, get_mem_index(s), memop);
+mop = finalize_memop(s, size);
+tcg_gen_qemu_ld_i64(tmplo, tcg_addr, get_mem_index(s), mop);
 } else {
 bool be = s->be_data == MO_BE;
 TCGv_i64 tcg_hiaddr;
@@ -1003,11 +1012,12 @@ static void do_fp_ld(DisasContext *s, int destidx, 
TCGv_i64 tcg_addr, int size)
 tmphi = tcg_temp_new_i64();
 tcg_hiaddr = tcg_temp_new_i64();
 
+mop = s->be_data | MO_Q;
+tcg_gen_qemu_ld_i64(be ? tmphi : tmplo, tcg_addr, get_mem_index(s),
+mop | (s->align_mem ? MO_ALIGN_16 : 0));
 tcg_gen_addi_i64(tcg_hiaddr, tcg_addr, 8);
-tcg_gen_qemu_ld_i64(tmplo, be ? tcg_hiaddr : tcg_addr, 
get_mem_index(s),
-s->be_data | MO_Q);
-tcg_gen_qemu_ld_i64(tmphi, be ? tcg_addr : tcg_hiaddr, 
get_mem_index(s),
-s->be_data | MO_Q);
+tcg_gen_qemu_ld_i64(be ? tmplo : tmphi, tcg_hiaddr,
+get_mem_index(s), mop);
 tcg_temp_free_i64(tcg_hiaddr);
 }
 
-- 
2.25.1




[PATCH v5 08/31] target/arm: Move TBFLAG_AM32 bits to the top

2021-04-19 Thread Richard Henderson
Now that these bits have been moved out of tb->flags,
where TBFLAG_ANY was filling from the top, move AM32
to fill from the top, and A32 and M32 to fill from the
bottom.  This means fewer changes when adding new bits.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h | 42 +-
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index a8da7c55a6..15104e1440 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3395,13 +3395,13 @@ typedef ARMCPU ArchCPU;
  *
  * The bits for 32-bit A-profile and M-profile partially overlap:
  *
- *  18 9  0
- * ++--+
- * |   TBFLAG_A32   |  |
- * +-+--+  TBFLAG_AM32 |
- * | |TBFLAG_M32|  |
- * +-+--+--+
- * 14  9  0
+ *  31 23 11 10 0
+ * +-+--++
+ * | |  |   TBFLAG_A32   |
+ * | TBFLAG_AM32 |  +-+--+
+ * | ||TBFLAG_M32|
+ * +-++--+
+ *  31 235 40
  *
  * Unless otherwise noted, these bits are cached in env->hflags.
  */
@@ -3418,44 +3418,44 @@ FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 20, 2)
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
  */
-FIELD(TBFLAG_AM32, CONDEXEC, 0, 8)  /* Not cached. */
-FIELD(TBFLAG_AM32, THUMB, 8, 1) /* Not cached. */
+FIELD(TBFLAG_AM32, CONDEXEC, 24, 8)  /* Not cached. */
+FIELD(TBFLAG_AM32, THUMB, 23, 1) /* Not cached. */
 
 /*
  * Bit usage when in AArch32 state, for A-profile only.
  */
-FIELD(TBFLAG_A32, VECLEN, 9, 3) /* Not cached. */
-FIELD(TBFLAG_A32, VECSTRIDE, 12, 2) /* Not cached. */
+FIELD(TBFLAG_A32, VECLEN, 0, 3) /* Not cached. */
+FIELD(TBFLAG_A32, VECSTRIDE, 3, 2) /* Not cached. */
 /*
  * We store the bottom two bits of the CPAR as TB flags and handle
  * checks on the other bits at runtime. This shares the same bits as
  * VECSTRIDE, which is OK as no XScale CPU has VFP.
  * Not cached, because VECLEN+VECSTRIDE are not cached.
  */
-FIELD(TBFLAG_A32, XSCALE_CPAR, 12, 2)
-FIELD(TBFLAG_A32, VFPEN, 14, 1) /* Partially cached, minus FPEXC. */
-FIELD(TBFLAG_A32, SCTLR__B, 15, 1)  /* Cannot overlap with SCTLR_B */
-FIELD(TBFLAG_A32, HSTR_ACTIVE, 16, 1)
+FIELD(TBFLAG_A32, XSCALE_CPAR, 5, 2)
+FIELD(TBFLAG_A32, VFPEN, 7, 1) /* Partially cached, minus FPEXC. */
+FIELD(TBFLAG_A32, SCTLR__B, 8, 1)  /* Cannot overlap with SCTLR_B */
+FIELD(TBFLAG_A32, HSTR_ACTIVE, 9, 1)
 /*
  * Indicates whether cp register reads and writes by guest code should access
  * the secure or nonsecure bank of banked registers; note that this is not
  * the same thing as the current security state of the processor!
  */
-FIELD(TBFLAG_A32, NS, 17, 1)
+FIELD(TBFLAG_A32, NS, 10, 1)
 
 /*
  * Bit usage when in AArch32 state, for M-profile only.
  */
 /* Handler (ie not Thread) mode */
-FIELD(TBFLAG_M32, HANDLER, 9, 1)
+FIELD(TBFLAG_M32, HANDLER, 0, 1)
 /* Whether we should generate stack-limit checks */
-FIELD(TBFLAG_M32, STACKCHECK, 10, 1)
+FIELD(TBFLAG_M32, STACKCHECK, 1, 1)
 /* Set if FPCCR.LSPACT is set */
-FIELD(TBFLAG_M32, LSPACT, 11, 1) /* Not cached. */
+FIELD(TBFLAG_M32, LSPACT, 2, 1) /* Not cached. */
 /* Set if we must create a new FP context */
-FIELD(TBFLAG_M32, NEW_FP_CTXT_NEEDED, 12, 1) /* Not cached. */
+FIELD(TBFLAG_M32, NEW_FP_CTXT_NEEDED, 3, 1) /* Not cached. */
 /* Set if FPCCR.S does not match current security state */
-FIELD(TBFLAG_M32, FPCCR_S_WRONG, 13, 1)  /* Not cached. */
+FIELD(TBFLAG_M32, FPCCR_S_WRONG, 4, 1)  /* Not cached. */
 
 /*
  * Bit usage when in AArch64 state
-- 
2.25.1




[PATCH v5 23/31] target/arm: Enforce alignment for VLDn/VSTn (multiple)

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-neon.c.inc | 27 ++-
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index 9c2b076027..e706c37c80 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -429,7 +429,7 @@ static bool trans_VLDST_multiple(DisasContext *s, 
arg_VLDST_multiple *a)
 {
 /* Neon load/store multiple structures */
 int nregs, interleave, spacing, reg, n;
-MemOp endian = s->be_data;
+MemOp mop, align, endian;
 int mmu_idx = get_mem_index(s);
 int size = a->size;
 TCGv_i64 tmp64;
@@ -473,20 +473,36 @@ static bool trans_VLDST_multiple(DisasContext *s, 
arg_VLDST_multiple *a)
 }
 
 /* For our purposes, bytes are always little-endian.  */
+endian = s->be_data;
 if (size == 0) {
 endian = MO_LE;
 }
+
+/* Enforce alignment requested by the instruction */
+if (a->align) {
+align = pow2_align(a->align + 2); /* 4 ** a->align */
+} else {
+align = s->align_mem ? MO_ALIGN : 0;
+}
+
 /*
  * Consecutive little-endian elements from a single register
  * can be promoted to a larger little-endian operation.
  */
 if (interleave == 1 && endian == MO_LE) {
+/* Retain any natural alignment. */
+if (align == MO_ALIGN) {
+align = pow2_align(size);
+}
 size = 3;
 }
+
 tmp64 = tcg_temp_new_i64();
 addr = tcg_temp_new_i32();
 tmp = tcg_const_i32(1 << size);
 load_reg_var(s, addr, a->rn);
+
+mop = endian | size | align;
 for (reg = 0; reg < nregs; reg++) {
 for (n = 0; n < 8 >> size; n++) {
 int xs;
@@ -494,15 +510,16 @@ static bool trans_VLDST_multiple(DisasContext *s, 
arg_VLDST_multiple *a)
 int tt = a->vd + reg + spacing * xs;
 
 if (a->l) {
-gen_aa32_ld_internal_i64(s, tmp64, addr, mmu_idx,
- endian | size);
+gen_aa32_ld_internal_i64(s, tmp64, addr, mmu_idx, mop);
 neon_store_element64(tt, n, size, tmp64);
 } else {
 neon_load_element64(tmp64, tt, n, size);
-gen_aa32_st_internal_i64(s, tmp64, addr, mmu_idx,
- endian | size);
+gen_aa32_st_internal_i64(s, tmp64, addr, mmu_idx, mop);
 }
 tcg_gen_add_i32(addr, addr, tmp);
+
+/* Subsequent memory operations inherit alignment */
+mop &= ~MO_AMASK;
 }
 }
 }
-- 
2.25.1




[PATCH 14/14] hw/nvme: move nvme emulation out of hw/block

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

With the introduction of the nvme-subsystem device we are really
cluttering up the hw/block directory.

As suggested by Philippe previously, move the nvme emulation to hw/nvme.

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Klaus Jensen 
---
 meson.build   |   1 +
 hw/{block => nvme}/nvme.h |   6 +-
 hw/nvme/trace.h   |   1 +
 hw/{block/nvme.c => nvme/ctrl.c}  |   0
 hw/{block/nvme-dif.c => nvme/dif.c}   |   0
 hw/{block/nvme-ns.c => nvme/ns.c} |   0
 hw/{block/nvme-subsys.c => nvme/subsys.c} |   0
 MAINTAINERS   |   2 +-
 hw/Kconfig|   1 +
 hw/block/Kconfig  |   5 -
 hw/block/meson.build  |   1 -
 hw/block/trace-events | 206 --
 hw/meson.build|   1 +
 hw/nvme/Kconfig   |   4 +
 hw/nvme/meson.build   |   1 +
 hw/nvme/trace-events  | 204 +
 16 files changed, 217 insertions(+), 216 deletions(-)
 rename hw/{block => nvme}/nvme.h (99%)
 create mode 100644 hw/nvme/trace.h
 rename hw/{block/nvme.c => nvme/ctrl.c} (100%)
 rename hw/{block/nvme-dif.c => nvme/dif.c} (100%)
 rename hw/{block/nvme-ns.c => nvme/ns.c} (100%)
 rename hw/{block/nvme-subsys.c => nvme/subsys.c} (100%)
 create mode 100644 hw/nvme/Kconfig
 create mode 100644 hw/nvme/meson.build
 create mode 100644 hw/nvme/trace-events

diff --git a/meson.build b/meson.build
index c6f4b0cf5e8a..59354cd53c97 100644
--- a/meson.build
+++ b/meson.build
@@ -1811,6 +1811,7 @@ if have_system
 'hw/misc/macio',
 'hw/net',
 'hw/net/can',
+'hw/nvme',
 'hw/nvram',
 'hw/pci',
 'hw/pci-host',
diff --git a/hw/block/nvme.h b/hw/nvme/nvme.h
similarity index 99%
rename from hw/block/nvme.h
rename to hw/nvme/nvme.h
index fb028d81d16f..81a35cda142b 100644
--- a/hw/block/nvme.h
+++ b/hw/nvme/nvme.h
@@ -15,8 +15,8 @@
  * This code is licensed under the GNU GPL v2 or later.
  */
 
-#ifndef HW_NVME_H
-#define HW_NVME_H
+#ifndef HW_NVME_INTERNAL_H
+#define HW_NVME_INTERNAL_H
 
 #include "qemu/uuid.h"
 #include "hw/pci/pci.h"
@@ -544,4 +544,4 @@ uint16_t nvme_dif_check(NvmeNamespace *ns, uint8_t *buf, 
size_t len,
 uint16_t nvme_dif_rw(NvmeCtrl *n, NvmeRequest *req);
 
 
-#endif /* HW_NVME_H */
+#endif /* HW_NVME_INTERNAL_H */
diff --git a/hw/nvme/trace.h b/hw/nvme/trace.h
new file mode 100644
index ..b398ea107f59
--- /dev/null
+++ b/hw/nvme/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-hw_nvme.h"
diff --git a/hw/block/nvme.c b/hw/nvme/ctrl.c
similarity index 100%
rename from hw/block/nvme.c
rename to hw/nvme/ctrl.c
diff --git a/hw/block/nvme-dif.c b/hw/nvme/dif.c
similarity index 100%
rename from hw/block/nvme-dif.c
rename to hw/nvme/dif.c
diff --git a/hw/block/nvme-ns.c b/hw/nvme/ns.c
similarity index 100%
rename from hw/block/nvme-ns.c
rename to hw/nvme/ns.c
diff --git a/hw/block/nvme-subsys.c b/hw/nvme/subsys.c
similarity index 100%
rename from hw/block/nvme-subsys.c
rename to hw/nvme/subsys.c
diff --git a/MAINTAINERS b/MAINTAINERS
index 36055f14c594..986e0e590de6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1972,7 +1972,7 @@ M: Keith Busch 
 M: Klaus Jensen 
 L: qemu-bl...@nongnu.org
 S: Supported
-F: hw/block/nvme*
+F: hw/nvme/*
 F: include/block/nvme.h
 F: tests/qtest/nvme-test.c
 F: docs/system/nvme.rst
diff --git a/hw/Kconfig b/hw/Kconfig
index ff40bd3f7bb7..61d0e654eb02 100644
--- a/hw/Kconfig
+++ b/hw/Kconfig
@@ -21,6 +21,7 @@ source mem/Kconfig
 source misc/Kconfig
 source net/Kconfig
 source nubus/Kconfig
+source nvme/Kconfig
 source nvram/Kconfig
 source pci-bridge/Kconfig
 source pci-host/Kconfig
diff --git a/hw/block/Kconfig b/hw/block/Kconfig
index 4fcd15216684..295441e64ab4 100644
--- a/hw/block/Kconfig
+++ b/hw/block/Kconfig
@@ -25,11 +25,6 @@ config ONENAND
 config TC58128
 bool
 
-config NVME_PCI
-bool
-default y if PCI_DEVICES
-depends on PCI
-
 config VIRTIO_BLK
 bool
 default y
diff --git a/hw/block/meson.build b/hw/block/meson.build
index 5b4a7699f98f..8b0de54db1fc 100644
--- a/hw/block/meson.build
+++ b/hw/block/meson.build
@@ -13,7 +13,6 @@ softmmu_ss.add(when: 'CONFIG_SSI_M25P80', if_true: 
files('m25p80.c'))
 softmmu_ss.add(when: 'CONFIG_SWIM', if_true: files('swim.c'))
 softmmu_ss.add(when: 'CONFIG_XEN', if_true: files('xen-block.c'))
 softmmu_ss.add(when: 'CONFIG_TC58128', if_true: files('tc58128.c'))
-softmmu_ss.add(when: 'CONFIG_NVME_PCI', if_true: files('nvme.c', 'nvme-ns.c', 
'nvme-subsys.c', 'nvme-dif.c'))
 
 specific_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c'))
 specific_ss.add(when: 'CONFIG_VHOST_USER_BLK', if_true: 
files('vhost-user-blk.c'))
diff --git a/hw/block/trace-events b/hw/block/trace-events
index fa12e3a67a75..646917d045f7 100644
--- a/hw/block/trace-events
+++ b/hw/block/trace-events

[PATCH v5 06/31] target/arm: Move mode specific TB flags to tb->cs_base

2021-04-19 Thread Richard Henderson
Now that we have all of the proper macros defined, expanding
the CPUARMTBFlags structure and populating the two TB fields
is relatively simple.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
v5: Adjust assert_hflags_rebuild_correctly.
---
 target/arm/cpu.h   | 49 --
 target/arm/translate.h |  2 +-
 target/arm/helper.c| 10 +
 3 files changed, 35 insertions(+), 26 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 79af9a7c62..a8da7c55a6 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -228,6 +228,7 @@ typedef struct ARMPACKey {
 /* See the commentary above the TBFLAG field definitions.  */
 typedef struct CPUARMTBFlags {
 uint32_t flags;
+target_ulong flags2;
 } CPUARMTBFlags;
 
 typedef struct CPUARMState {
@@ -3381,20 +3382,26 @@ typedef ARMCPU ArchCPU;
 #include "exec/cpu-all.h"
 
 /*
- * Bit usage in the TB flags field: bit 31 indicates whether we are
- * in 32 or 64 bit mode. The meaning of the other bits depends on that.
- * We put flags which are shared between 32 and 64 bit mode at the top
- * of the word, and flags which apply to only one mode at the bottom.
+ * We have more than 32-bits worth of state per TB, so we split the data
+ * between tb->flags and tb->cs_base, which is otherwise unused for ARM.
+ * We collect these two parts in CPUARMTBFlags where they are named
+ * flags and flags2 respectively.
  *
- *  31  201814  9  0
- * +--+-+-+--+--+
- * |  | |   TBFLAG_A32   |  |
- * |  | +-+--+  TBFLAG_AM32 |
- * |  TBFLAG_ANY  |   |TBFLAG_M32|  |
- * |  +---+--+--|
- * |  |TBFLAG_A64   |
- * +--+-+
- *  31  20 0
+ * The flags that are shared between all execution modes, TBFLAG_ANY,
+ * are stored in flags.  The flags that are specific to a given mode
+ * are stores in flags2.  Since cs_base is sized on the configured
+ * address size, flags2 always has 64-bits for A64, and a minimum of
+ * 32-bits for A32 and M32.
+ *
+ * The bits for 32-bit A-profile and M-profile partially overlap:
+ *
+ *  18 9  0
+ * ++--+
+ * |   TBFLAG_A32   |  |
+ * +-+--+  TBFLAG_AM32 |
+ * | |TBFLAG_M32|  |
+ * +-+--+--+
+ * 14  9  0
  *
  * Unless otherwise noted, these bits are cached in env->hflags.
  */
@@ -3472,19 +3479,19 @@ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
 #define DP_TBFLAG_ANY(DST, WHICH, VAL) \
 (DST.flags = FIELD_DP32(DST.flags, TBFLAG_ANY, WHICH, VAL))
 #define DP_TBFLAG_A64(DST, WHICH, VAL) \
-(DST.flags = FIELD_DP32(DST.flags, TBFLAG_A64, WHICH, VAL))
+(DST.flags2 = FIELD_DP32(DST.flags2, TBFLAG_A64, WHICH, VAL))
 #define DP_TBFLAG_A32(DST, WHICH, VAL) \
-(DST.flags = FIELD_DP32(DST.flags, TBFLAG_A32, WHICH, VAL))
+(DST.flags2 = FIELD_DP32(DST.flags2, TBFLAG_A32, WHICH, VAL))
 #define DP_TBFLAG_M32(DST, WHICH, VAL) \
-(DST.flags = FIELD_DP32(DST.flags, TBFLAG_M32, WHICH, VAL))
+(DST.flags2 = FIELD_DP32(DST.flags2, TBFLAG_M32, WHICH, VAL))
 #define DP_TBFLAG_AM32(DST, WHICH, VAL) \
-(DST.flags = FIELD_DP32(DST.flags, TBFLAG_AM32, WHICH, VAL))
+(DST.flags2 = FIELD_DP32(DST.flags2, TBFLAG_AM32, WHICH, VAL))
 
 #define EX_TBFLAG_ANY(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_ANY, WHICH)
-#define EX_TBFLAG_A64(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_A64, WHICH)
-#define EX_TBFLAG_A32(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_A32, WHICH)
-#define EX_TBFLAG_M32(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_M32, WHICH)
-#define EX_TBFLAG_AM32(IN, WHICH)  FIELD_EX32(IN.flags, TBFLAG_AM32, WHICH)
+#define EX_TBFLAG_A64(IN, WHICH)   FIELD_EX32(IN.flags2, TBFLAG_A64, WHICH)
+#define EX_TBFLAG_A32(IN, WHICH)   FIELD_EX32(IN.flags2, TBFLAG_A32, WHICH)
+#define EX_TBFLAG_M32(IN, WHICH)   FIELD_EX32(IN.flags2, TBFLAG_M32, WHICH)
+#define EX_TBFLAG_AM32(IN, WHICH)  FIELD_EX32(IN.flags2, TBFLAG_AM32, WHICH)
 
 /**
  * cpu_mmu_index:
diff --git a/target/arm/translate.h b/target/arm/translate.h
index f30287e554..50c2aba066 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -402,7 +402,7 @@ typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, 
TCGArg, MemOp);
  */
 static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
 {
-return (CPUARMTBFlags){ tb->flags };
+return (CPUARMTBFlags){ tb->flags, tb->cs_base };
 }
 
 /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index f564e59084..4aa7650d3a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -13256,9 +13256,11 @@ static inline void 
assert_hflags_rebuild_correctly(CPUARMState *env)
 CPUARMTBFlags c = 

[PATCH v5 22/31] target/arm: Enforce alignment for VLDn (all lanes)

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
v2: Fix alignment for n in {2, 4}.
---
 target/arm/translate.h  |  1 +
 target/arm/translate.c  | 15 +
 target/arm/translate-neon.c.inc | 37 +
 3 files changed, 44 insertions(+), 9 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index 0c60b83b3d..ccf60c96d8 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -204,6 +204,7 @@ void arm_test_cc(DisasCompare *cmp, int cc);
 void arm_free_cc(DisasCompare *cmp);
 void arm_jump_cc(DisasCompare *cmp, TCGLabel *label);
 void arm_gen_test_cc(int cc, TCGLabel *label);
+MemOp pow2_align(unsigned i);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)
diff --git a/target/arm/translate.c b/target/arm/translate.c
index 4decb2610e..0cf6da7e79 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -908,6 +908,21 @@ static inline void store_reg_from_load(DisasContext *s, 
int reg, TCGv_i32 var)
 #define IS_USER_ONLY 0
 #endif
 
+MemOp pow2_align(unsigned i)
+{
+static const MemOp mop_align[] = {
+0, MO_ALIGN_2, MO_ALIGN_4, MO_ALIGN_8, MO_ALIGN_16,
+/*
+ * FIXME: TARGET_PAGE_BITS_MIN affects TLB_FLAGS_MASK such
+ * that 256-bit alignment (MO_ALIGN_32) cannot be supported:
+ * see get_alignment_bits(). Enforce only 128-bit alignment for now.
+ */
+MO_ALIGN_16
+};
+g_assert(i < ARRAY_SIZE(mop_align));
+return mop_align[i];
+}
+
 /*
  * Abstractions of "generate code to do a guest load/store for
  * AArch32", where a vaddr is always 32 bits (and is zero
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index 18d9042130..9c2b076027 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -522,6 +522,7 @@ static bool trans_VLD_all_lanes(DisasContext *s, 
arg_VLD_all_lanes *a)
 int size = a->size;
 int nregs = a->n + 1;
 TCGv_i32 addr, tmp;
+MemOp mop, align;
 
 if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
 return false;
@@ -532,18 +533,33 @@ static bool trans_VLD_all_lanes(DisasContext *s, 
arg_VLD_all_lanes *a)
 return false;
 }
 
+align = 0;
 if (size == 3) {
 if (nregs != 4 || a->a == 0) {
 return false;
 }
 /* For VLD4 size == 3 a == 1 means 32 bits at 16 byte alignment */
-size = 2;
-}
-if (nregs == 1 && a->a == 1 && size == 0) {
-return false;
-}
-if (nregs == 3 && a->a == 1) {
-return false;
+size = MO_32;
+align = MO_ALIGN_16;
+} else if (a->a) {
+switch (nregs) {
+case 1:
+if (size == 0) {
+return false;
+}
+align = MO_ALIGN;
+break;
+case 2:
+align = pow2_align(size + 1);
+break;
+case 3:
+return false;
+case 4:
+align = pow2_align(size + 2);
+break;
+default:
+g_assert_not_reached();
+}
 }
 
 if (!vfp_access_check(s)) {
@@ -556,12 +572,12 @@ static bool trans_VLD_all_lanes(DisasContext *s, 
arg_VLD_all_lanes *a)
  */
 stride = a->t ? 2 : 1;
 vec_size = nregs == 1 ? stride * 8 : 8;
-
+mop = size | align;
 tmp = tcg_temp_new_i32();
 addr = tcg_temp_new_i32();
 load_reg_var(s, addr, a->rn);
 for (reg = 0; reg < nregs; reg++) {
-gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), size);
+gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), mop);
 if ((vd & 1) && vec_size == 16) {
 /*
  * We cannot write 16 bytes at once because the
@@ -577,6 +593,9 @@ static bool trans_VLD_all_lanes(DisasContext *s, 
arg_VLD_all_lanes *a)
 }
 tcg_gen_addi_i32(addr, addr, 1 << size);
 vd += stride;
+
+/* Subsequent memory operations inherit alignment */
+mop &= ~MO_AMASK;
 }
 tcg_temp_free_i32(tmp);
 tcg_temp_free_i32(addr);
-- 
2.25.1




Re: [PATCH v3] qapi: introduce 'query-cpu-model-cpuid' action

2021-04-19 Thread Eduardo Habkost
On Mon, Mar 29, 2021 at 03:41:34PM +0300, Vladimir Sementsov-Ogievskiy wrote:
> 29.03.2021 14:48, Daniel P. Berrangé wrote:
[...]
> > > > There's feels like there's a lot of conceptual overlap with the
> > > > query-cpu-model-expansion command. That reports in a arch independant
> > > > format, but IIUC the property data it returns can be mapped into
> > > > CPUID leaf values. Is it not possible for you to use this existing
> > > > command and maintain a mapping of property names -> CPUID leaves ?
> > > As already stated in the use-case description above, having this method
> > > around, helps us in a way that we can just take values and return them
> > > to containers. QEMU code already does a great job, generating CPUID
> > > responses, we don't want to do the same in our own code.
> > 
> > This is asking QEMU to maintain a new QAPI command which does not appear
> > to have a use case / benefit for QEMU mgmt. It isn't clear to me that
> > this should be considered in scope for QMP.
> > 
> 
> Hmm. On the other hand,
> 
> 1. The command just exports some information, like a lot of other qmp query- 
> commands, it doesn't look as something alien in the QEMU interface.
> 
> 2. We do have a use-case. Not a VM use-case, but a use-case of cpu handling 
> subsystem.
> 
> Isn't it enough?
> 
> We want to handle cpu configurations in a compatible with QEMU way. The 
> simplest thing for it is just generate needed information with help of QEMU. 
> Note, that's not the only usage of QEMU binary for not-VM-running. QEMU 
> binary may be used for different block-jobs and manipulating bitmaps in disk 
> images (yes, now we also have qemu-storage-daemon, but still).
> 
> Do you have an idea how our task could be solved an a better way?

The new command would also be useful for writing automated tests
for the x86 CPUID compatibility code.  I don't object to its
inclusion.

-- 
Eduardo




[PATCH v5 20/31] target/arm: Enforce alignment for VLDM/VSTM

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-vfp.c.inc | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index 10766f210c..f50afb23e7 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -1503,12 +1503,12 @@ static bool trans_VLDM_VSTM_sp(DisasContext *s, 
arg_VLDM_VSTM_sp *a)
 for (i = 0; i < n; i++) {
 if (a->l) {
 /* load */
-gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
+gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 vfp_store_reg32(tmp, a->vd + i);
 } else {
 /* store */
 vfp_load_reg32(tmp, a->vd + i);
-gen_aa32_st32(s, tmp, addr, get_mem_index(s));
+gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 }
 tcg_gen_addi_i32(addr, addr, offset);
 }
@@ -1586,12 +1586,12 @@ static bool trans_VLDM_VSTM_dp(DisasContext *s, 
arg_VLDM_VSTM_dp *a)
 for (i = 0; i < n; i++) {
 if (a->l) {
 /* load */
-gen_aa32_ld64(s, tmp, addr, get_mem_index(s));
+gen_aa32_ld_i64(s, tmp, addr, get_mem_index(s), MO_Q | MO_ALIGN_4);
 vfp_store_reg64(tmp, a->vd + i);
 } else {
 /* store */
 vfp_load_reg64(tmp, a->vd + i);
-gen_aa32_st64(s, tmp, addr, get_mem_index(s));
+gen_aa32_st_i64(s, tmp, addr, get_mem_index(s), MO_Q | MO_ALIGN_4);
 }
 tcg_gen_addi_i32(addr, addr, offset);
 }
-- 
2.25.1




[PATCH v5 05/31] target/arm: Introduce CPUARMTBFlags

2021-04-19 Thread Richard Henderson
In preparation for splitting tb->flags across multiple
fields, introduce a structure to hold the value(s).
So far this only migrates the one uint32_t and fixes
all of the places that require adjustment to match.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   | 26 -
 target/arm/translate.h | 11 +
 target/arm/helper.c| 48 +-
 target/arm/translate-a64.c |  2 +-
 target/arm/translate.c |  7 +++---
 5 files changed, 57 insertions(+), 37 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index b798ff8115..79af9a7c62 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -225,6 +225,10 @@ typedef struct ARMPACKey {
 } ARMPACKey;
 #endif
 
+/* See the commentary above the TBFLAG field definitions.  */
+typedef struct CPUARMTBFlags {
+uint32_t flags;
+} CPUARMTBFlags;
 
 typedef struct CPUARMState {
 /* Regs for current mode.  */
@@ -253,7 +257,7 @@ typedef struct CPUARMState {
 uint32_t aarch64; /* 1 if CPU is in aarch64 state; inverse of PSTATE.nRW */
 
 /* Cached TBFLAGS state.  See below for which bits are included.  */
-uint32_t hflags;
+CPUARMTBFlags hflags;
 
 /* Frequently accessed CPSR bits are stored separately for efficiency.
This contains all the other bits.  Use cpsr_{read,write} to access
@@ -3466,21 +3470,21 @@ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
  * Helpers for using the above.
  */
 #define DP_TBFLAG_ANY(DST, WHICH, VAL) \
-(DST = FIELD_DP32(DST, TBFLAG_ANY, WHICH, VAL))
+(DST.flags = FIELD_DP32(DST.flags, TBFLAG_ANY, WHICH, VAL))
 #define DP_TBFLAG_A64(DST, WHICH, VAL) \
-(DST = FIELD_DP32(DST, TBFLAG_A64, WHICH, VAL))
+(DST.flags = FIELD_DP32(DST.flags, TBFLAG_A64, WHICH, VAL))
 #define DP_TBFLAG_A32(DST, WHICH, VAL) \
-(DST = FIELD_DP32(DST, TBFLAG_A32, WHICH, VAL))
+(DST.flags = FIELD_DP32(DST.flags, TBFLAG_A32, WHICH, VAL))
 #define DP_TBFLAG_M32(DST, WHICH, VAL) \
-(DST = FIELD_DP32(DST, TBFLAG_M32, WHICH, VAL))
+(DST.flags = FIELD_DP32(DST.flags, TBFLAG_M32, WHICH, VAL))
 #define DP_TBFLAG_AM32(DST, WHICH, VAL) \
-(DST = FIELD_DP32(DST, TBFLAG_AM32, WHICH, VAL))
+(DST.flags = FIELD_DP32(DST.flags, TBFLAG_AM32, WHICH, VAL))
 
-#define EX_TBFLAG_ANY(IN, WHICH)   FIELD_EX32(IN, TBFLAG_ANY, WHICH)
-#define EX_TBFLAG_A64(IN, WHICH)   FIELD_EX32(IN, TBFLAG_A64, WHICH)
-#define EX_TBFLAG_A32(IN, WHICH)   FIELD_EX32(IN, TBFLAG_A32, WHICH)
-#define EX_TBFLAG_M32(IN, WHICH)   FIELD_EX32(IN, TBFLAG_M32, WHICH)
-#define EX_TBFLAG_AM32(IN, WHICH)  FIELD_EX32(IN, TBFLAG_AM32, WHICH)
+#define EX_TBFLAG_ANY(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_ANY, WHICH)
+#define EX_TBFLAG_A64(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_A64, WHICH)
+#define EX_TBFLAG_A32(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_A32, WHICH)
+#define EX_TBFLAG_M32(IN, WHICH)   FIELD_EX32(IN.flags, TBFLAG_M32, WHICH)
+#define EX_TBFLAG_AM32(IN, WHICH)  FIELD_EX32(IN.flags, TBFLAG_AM32, WHICH)
 
 /**
  * cpu_mmu_index:
diff --git a/target/arm/translate.h b/target/arm/translate.h
index 423b0e08df..f30287e554 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -394,6 +394,17 @@ typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, 
TCGv_i32);
 typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
 typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
 
+/**
+ * arm_tbflags_from_tb:
+ * @tb: the TranslationBlock
+ *
+ * Extract the flag values from @tb.
+ */
+static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+{
+return (CPUARMTBFlags){ tb->flags };
+}
+
 /*
  * Enum for argument to fpstatus_ptr().
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2769e6fd35..f564e59084 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -12984,8 +12984,9 @@ ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
 }
 #endif
 
-static uint32_t rebuild_hflags_common(CPUARMState *env, int fp_el,
-  ARMMMUIdx mmu_idx, uint32_t flags)
+static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
+   ARMMMUIdx mmu_idx,
+   CPUARMTBFlags flags)
 {
 DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el);
 DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
@@ -12996,8 +12997,9 @@ static uint32_t rebuild_hflags_common(CPUARMState *env, 
int fp_el,
 return flags;
 }
 
-static uint32_t rebuild_hflags_common_32(CPUARMState *env, int fp_el,
- ARMMMUIdx mmu_idx, uint32_t flags)
+static CPUARMTBFlags rebuild_hflags_common_32(CPUARMState *env, int fp_el,
+  ARMMMUIdx mmu_idx,
+  CPUARMTBFlags flags)
 {
 bool sctlr_b = arm_sctlr_b(env);
 
@@ -13012,10 +13014,10 @@ static uint32_t rebuild_hflags_common_32(CPUARMState 

[PATCH v5 21/31] target/arm: Enforce alignment for VLDR/VSTR

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate-vfp.c.inc | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index f50afb23e7..e20d9c7ba6 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -1364,11 +1364,11 @@ static bool trans_VLDR_VSTR_hp(DisasContext *s, 
arg_VLDR_VSTR_sp *a)
 addr = add_reg_for_lit(s, a->rn, offset);
 tmp = tcg_temp_new_i32();
 if (a->l) {
-gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
+gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), MO_UW | MO_ALIGN);
 vfp_store_reg32(tmp, a->vd);
 } else {
 vfp_load_reg32(tmp, a->vd);
-gen_aa32_st16(s, tmp, addr, get_mem_index(s));
+gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), MO_UW | MO_ALIGN);
 }
 tcg_temp_free_i32(tmp);
 tcg_temp_free_i32(addr);
@@ -1398,11 +1398,11 @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, 
arg_VLDR_VSTR_sp *a)
 addr = add_reg_for_lit(s, a->rn, offset);
 tmp = tcg_temp_new_i32();
 if (a->l) {
-gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
+gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 vfp_store_reg32(tmp, a->vd);
 } else {
 vfp_load_reg32(tmp, a->vd);
-gen_aa32_st32(s, tmp, addr, get_mem_index(s));
+gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 }
 tcg_temp_free_i32(tmp);
 tcg_temp_free_i32(addr);
@@ -1439,11 +1439,11 @@ static bool trans_VLDR_VSTR_dp(DisasContext *s, 
arg_VLDR_VSTR_dp *a)
 addr = add_reg_for_lit(s, a->rn, offset);
 tmp = tcg_temp_new_i64();
 if (a->l) {
-gen_aa32_ld64(s, tmp, addr, get_mem_index(s));
+gen_aa32_ld_i64(s, tmp, addr, get_mem_index(s), MO_Q | MO_ALIGN_4);
 vfp_store_reg64(tmp, a->vd);
 } else {
 vfp_load_reg64(tmp, a->vd);
-gen_aa32_st64(s, tmp, addr, get_mem_index(s));
+gen_aa32_st_i64(s, tmp, addr, get_mem_index(s), MO_Q | MO_ALIGN_4);
 }
 tcg_temp_free_i64(tmp);
 tcg_temp_free_i32(addr);
-- 
2.25.1




[PATCH v5 17/31] target/arm: Enforce alignment for LDM/STM

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index 29fbbb84b2..f58ac4f018 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -7868,7 +7868,7 @@ static bool op_stm(DisasContext *s, arg_ldst_block *a, 
int min_n)
 } else {
 tmp = load_reg(s, i);
 }
-gen_aa32_st32(s, tmp, addr, mem_idx);
+gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 tcg_temp_free_i32(tmp);
 
 /* No need to add after the last transfer.  */
@@ -7943,7 +7943,7 @@ static bool do_ldm(DisasContext *s, arg_ldst_block *a, 
int min_n)
 }
 
 tmp = tcg_temp_new_i32();
-gen_aa32_ld32u(s, tmp, addr, mem_idx);
+gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 if (user) {
 tmp2 = tcg_const_i32(i);
 gen_helper_set_user_reg(cpu_env, tmp2, tmp);
-- 
2.25.1




[PATCH 11/14] hw/block/nvme: remove num_namespaces member

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

The NvmeCtrl num_namespaces member is just an indirection for the
NVME_MAX_NAMESPACES constant.

Remove the indirection.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme.h |  1 -
 hw/block/nvme.c | 30 +++---
 2 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/hw/block/nvme.h b/hw/block/nvme.h
index ac3f0a886735..fb028d81d16f 100644
--- a/hw/block/nvme.h
+++ b/hw/block/nvme.h
@@ -401,7 +401,6 @@ typedef struct NvmeCtrl {
 uint16_tcqe_size;
 uint16_tsqe_size;
 uint32_treg_size;
-uint32_tnum_namespaces;
 uint32_tmax_q_ents;
 uint8_t outstanding_aers;
 uint32_tirq_status;
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 0b96936129d6..60424d9b19ea 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -382,7 +382,8 @@ static int nvme_addr_write(NvmeCtrl *n, hwaddr addr, void 
*buf, int size)
 
 static bool nvme_nsid_valid(NvmeCtrl *n, uint32_t nsid)
 {
-return nsid && (nsid == NVME_NSID_BROADCAST || nsid <= n->num_namespaces);
+return nsid &&
+(nsid == NVME_NSID_BROADCAST || nsid <= NVME_MAX_NAMESPACES);
 }
 
 static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid)
@@ -2865,7 +2866,7 @@ static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req)
 /* 1-initialize; see comment in nvme_dsm */
 *num_flushes = 1;
 
-for (int i = 1; i <= n->num_namespaces; i++) {
+for (int i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -3835,7 +3836,7 @@ static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, 
uint32_t buf_len,
 } else {
 int i;
 
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -4332,7 +4333,7 @@ static uint16_t nvme_identify_nslist(NvmeCtrl *n, 
NvmeRequest *req,
 return NVME_INVALID_NSID | NVME_DNR;
 }
 
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 if (!active) {
@@ -4380,7 +4381,7 @@ static uint16_t nvme_identify_nslist_csi(NvmeCtrl *n, 
NvmeRequest *req,
 return NVME_INVALID_FIELD | NVME_DNR;
 }
 
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 if (!active) {
@@ -4646,7 +4647,7 @@ static uint16_t nvme_get_feature(NvmeCtrl *n, NvmeRequest 
*req)
 goto out;
 case NVME_VOLATILE_WRITE_CACHE:
 result = 0;
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -4796,7 +4797,7 @@ static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest 
*req)
 break;
 case NVME_ERROR_RECOVERY:
 if (nsid == NVME_NSID_BROADCAST) {
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 
 if (!ns) {
@@ -4817,7 +4818,7 @@ static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest 
*req)
 }
 break;
 case NVME_VOLATILE_WRITE_CACHE:
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -5110,7 +5111,7 @@ static uint16_t nvme_format(NvmeCtrl *n, NvmeRequest *req)
 req->status = status;
 }
 } else {
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -5221,7 +5222,7 @@ static void nvme_ctrl_reset(NvmeCtrl *n)
 NvmeNamespace *ns;
 int i;
 
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -5263,7 +5264,7 @@ static void nvme_ctrl_shutdown(NvmeCtrl *n)
 memory_region_msync(>pmr.dev->mr, 0, n->pmr.dev->size);
 }
 
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -5278,7 +5279,7 @@ static void nvme_select_iocs(NvmeCtrl *n)
 NvmeNamespace *ns;
 int i;
 
-for (i = 1; i <= n->num_namespaces; i++) {
+for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
 ns = nvme_ns(n, i);
 if (!ns) {
 continue;
@@ -5905,7 +5906,6 @@ static void nvme_check_constraints(NvmeCtrl *n, Error 
**errp)
 
 static void nvme_init_state(NvmeCtrl *n)
 {
-n->num_namespaces = NVME_MAX_NAMESPACES;
 /* add one to max_ioqpairs to account for the admin queue pair */
  

[PATCH v5 19/31] target/arm: Enforce alignment for SRS

2021-04-19 Thread Richard Henderson
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index 2cdf58daa1..4decb2610e 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -5200,11 +5200,11 @@ static void gen_srs(DisasContext *s,
 }
 tcg_gen_addi_i32(addr, addr, offset);
 tmp = load_reg(s, 14);
-gen_aa32_st32(s, tmp, addr, get_mem_index(s));
+gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 tcg_temp_free_i32(tmp);
 tmp = load_cpu_field(spsr);
 tcg_gen_addi_i32(addr, addr, 4);
-gen_aa32_st32(s, tmp, addr, get_mem_index(s));
+gen_aa32_st_i32(s, tmp, addr, get_mem_index(s), MO_UL | MO_ALIGN);
 tcg_temp_free_i32(tmp);
 if (writeback) {
 switch (amode) {
-- 
2.25.1




[PATCH v5 15/31] target/arm: Enforce word alignment for LDRD/STRD

2021-04-19 Thread Richard Henderson
Buglink: https://bugs.launchpad.net/qemu/+bug/1905356
Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c | 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index 6171347d6d..1b0951c45b 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -6512,13 +6512,13 @@ static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr 
*a)
 addr = op_addr_rr_pre(s, a);
 
 tmp = tcg_temp_new_i32();
-gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 store_reg(s, a->rt, tmp);
 
 tcg_gen_addi_i32(addr, addr, 4);
 
 tmp = tcg_temp_new_i32();
-gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 store_reg(s, a->rt + 1, tmp);
 
 /* LDRD w/ base writeback is undefined if the registers overlap.  */
@@ -6541,13 +6541,13 @@ static bool trans_STRD_rr(DisasContext *s, arg_ldst_rr 
*a)
 addr = op_addr_rr_pre(s, a);
 
 tmp = load_reg(s, a->rt);
-gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 tcg_temp_free_i32(tmp);
 
 tcg_gen_addi_i32(addr, addr, 4);
 
 tmp = load_reg(s, a->rt + 1);
-gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 tcg_temp_free_i32(tmp);
 
 op_addr_rr_post(s, a, addr, -4);
@@ -6649,13 +6649,13 @@ static bool op_ldrd_ri(DisasContext *s, arg_ldst_ri *a, 
int rt2)
 addr = op_addr_ri_pre(s, a);
 
 tmp = tcg_temp_new_i32();
-gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 store_reg(s, a->rt, tmp);
 
 tcg_gen_addi_i32(addr, addr, 4);
 
 tmp = tcg_temp_new_i32();
-gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 store_reg(s, rt2, tmp);
 
 /* LDRD w/ base writeback is undefined if the registers overlap.  */
@@ -6688,13 +6688,13 @@ static bool op_strd_ri(DisasContext *s, arg_ldst_ri *a, 
int rt2)
 addr = op_addr_ri_pre(s, a);
 
 tmp = load_reg(s, a->rt);
-gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 tcg_temp_free_i32(tmp);
 
 tcg_gen_addi_i32(addr, addr, 4);
 
 tmp = load_reg(s, rt2);
-gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL);
+gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN);
 tcg_temp_free_i32(tmp);
 
 op_addr_ri_post(s, a, addr, -4);
-- 
2.25.1




[PATCH v5 14/31] target/arm: Adjust gen_aa32_{ld, st}_i64 for align+endianness

2021-04-19 Thread Richard Henderson
Adjust the interface to match what has been done to the
TCGv_i32 load/store functions.

This is less obvious, because at present the only user of
these functions, trans_VLDST_multiple, also wants to manipulate
the endianness to speed up loading multiple bytes.  Thus we
retain an "internal" interface which is identical to the
current gen_aa32_{ld,st}_i64 interface.

The "new" interface will gain users as we remove the legacy
interfaces, gen_aa32_ld64 and gen_aa32_st64.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c  | 78 +++--
 target/arm/translate-neon.c.inc |  6 ++-
 2 files changed, 49 insertions(+), 35 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index d37a3dfa4a..6171347d6d 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -949,6 +949,37 @@ static void gen_aa32_st_internal_i32(DisasContext *s, 
TCGv_i32 val,
 tcg_temp_free(addr);
 }
 
+static void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
+ TCGv_i32 a32, int index, MemOp opc)
+{
+TCGv addr = gen_aa32_addr(s, a32, opc);
+
+tcg_gen_qemu_ld_i64(val, addr, index, opc);
+
+/* Not needed for user-mode BE32, where we use MO_BE instead.  */
+if (!IS_USER_ONLY && s->sctlr_b && (opc & MO_SIZE) == MO_64) {
+tcg_gen_rotri_i64(val, val, 32);
+}
+tcg_temp_free(addr);
+}
+
+static void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
+ TCGv_i32 a32, int index, MemOp opc)
+{
+TCGv addr = gen_aa32_addr(s, a32, opc);
+
+/* Not needed for user-mode BE32, where we use MO_BE instead.  */
+if (!IS_USER_ONLY && s->sctlr_b && (opc & MO_SIZE) == MO_64) {
+TCGv_i64 tmp = tcg_temp_new_i64();
+tcg_gen_rotri_i64(tmp, val, 32);
+tcg_gen_qemu_st_i64(tmp, addr, index, opc);
+tcg_temp_free_i64(tmp);
+} else {
+tcg_gen_qemu_st_i64(val, addr, index, opc);
+}
+tcg_temp_free(addr);
+}
+
 static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 int index, MemOp opc)
 {
@@ -961,6 +992,18 @@ static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, 
TCGv_i32 a32,
 gen_aa32_st_internal_i32(s, val, a32, index, finalize_memop(s, opc));
 }
 
+static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+int index, MemOp opc)
+{
+gen_aa32_ld_internal_i64(s, val, a32, index, finalize_memop(s, opc));
+}
+
+static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
+int index, MemOp opc)
+{
+gen_aa32_st_internal_i64(s, val, a32, index, finalize_memop(s, opc));
+}
+
 #define DO_GEN_LD(SUFF, OPC)\
 static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val, \
  TCGv_i32 a32, int index)   \
@@ -975,47 +1018,16 @@ static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 
val, TCGv_i32 a32,
 gen_aa32_st_i32(s, val, a32, index, OPC);   \
 }
 
-static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-int index, MemOp opc)
-{
-TCGv addr = gen_aa32_addr(s, a32, opc);
-tcg_gen_qemu_ld_i64(val, addr, index, opc);
-
-/* Not needed for user-mode BE32, where we use MO_BE instead.  */
-if (!IS_USER_ONLY && s->sctlr_b && (opc & MO_SIZE) == MO_64) {
-tcg_gen_rotri_i64(val, val, 32);
-}
-
-tcg_temp_free(addr);
-}
-
 static inline void gen_aa32_ld64(DisasContext *s, TCGv_i64 val,
  TCGv_i32 a32, int index)
 {
-gen_aa32_ld_i64(s, val, a32, index, MO_Q | s->be_data);
-}
-
-static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 val, TCGv_i32 a32,
-int index, MemOp opc)
-{
-TCGv addr = gen_aa32_addr(s, a32, opc);
-
-/* Not needed for user-mode BE32, where we use MO_BE instead.  */
-if (!IS_USER_ONLY && s->sctlr_b && (opc & MO_SIZE) == MO_64) {
-TCGv_i64 tmp = tcg_temp_new_i64();
-tcg_gen_rotri_i64(tmp, val, 32);
-tcg_gen_qemu_st_i64(tmp, addr, index, opc);
-tcg_temp_free_i64(tmp);
-} else {
-tcg_gen_qemu_st_i64(val, addr, index, opc);
-}
-tcg_temp_free(addr);
+gen_aa32_ld_i64(s, val, a32, index, MO_Q);
 }
 
 static inline void gen_aa32_st64(DisasContext *s, TCGv_i64 val,
  TCGv_i32 a32, int index)
 {
-gen_aa32_st_i64(s, val, a32, index, MO_Q | s->be_data);
+gen_aa32_st_i64(s, val, a32, index, MO_Q);
 }
 
 DO_GEN_LD(8u, MO_UB)
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index c82aa1412e..18d9042130 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -494,11 +494,13 @@ static bool trans_VLDST_multiple(DisasContext *s, 

[PATCH v5 11/31] target/arm: Adjust gen_aa32_{ld, st}_i32 for align+endianness

2021-04-19 Thread Richard Henderson
Create a finalize_memop function that computes alignment and
endianness and returns the final MemOp for the operation.

Split out gen_aa32_{ld,st}_internal_i32 which bypasses any special
handling of endianness or alignment.  Adjust gen_aa32_{ld,st}_i32
so that s->be_data is not added by the callers.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.h  |  24 
 target/arm/translate.c  | 100 +---
 target/arm/translate-neon.c.inc |   9 +--
 3 files changed, 79 insertions(+), 54 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index b185c14a03..0c60b83b3d 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -459,4 +459,28 @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour 
flavour)
 return statusptr;
 }
 
+/**
+ * finalize_memop:
+ * @s: DisasContext
+ * @opc: size+sign+align of the memory operation
+ *
+ * Build the complete MemOp for a memory operation, including alignment
+ * and endianness.
+ *
+ * If (op & MO_AMASK) then the operation already contains the required
+ * alignment, e.g. for AccType_ATOMIC.  Otherwise, this an optionally
+ * unaligned operation, e.g. for AccType_NORMAL.
+ *
+ * In the latter case, there are configuration bits that require alignment,
+ * and this is applied here.  Note that there is no way to indicate that
+ * no alignment should ever be enforced; this must be handled manually.
+ */
+static inline MemOp finalize_memop(DisasContext *s, MemOp opc)
+{
+if (s->align_mem && !(opc & MO_AMASK)) {
+opc |= MO_ALIGN;
+}
+return opc | s->be_data;
+}
+
 #endif /* TARGET_ARM_TRANSLATE_H */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index e918c2e1a4..d46030248a 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -908,7 +908,8 @@ static inline void store_reg_from_load(DisasContext *s, int 
reg, TCGv_i32 var)
 #define IS_USER_ONLY 0
 #endif
 
-/* Abstractions of "generate code to do a guest load/store for
+/*
+ * Abstractions of "generate code to do a guest load/store for
  * AArch32", where a vaddr is always 32 bits (and is zero
  * extended if we're a 64 bit core) and  data is also
  * 32 bits unless specifically doing a 64 bit access.
@@ -916,7 +917,7 @@ static inline void store_reg_from_load(DisasContext *s, int 
reg, TCGv_i32 var)
  * that the address argument is TCGv_i32 rather than TCGv.
  */
 
-static inline TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
+static TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
 {
 TCGv addr = tcg_temp_new();
 tcg_gen_extu_i32_tl(addr, a32);
@@ -928,47 +929,51 @@ static inline TCGv gen_aa32_addr(DisasContext *s, 
TCGv_i32 a32, MemOp op)
 return addr;
 }
 
+/*
+ * Internal routines are used for NEON cases where the endianness
+ * and/or alignment has already been taken into account and manipulated.
+ */
+static void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
+ TCGv_i32 a32, int index, MemOp opc)
+{
+TCGv addr = gen_aa32_addr(s, a32, opc);
+tcg_gen_qemu_ld_i32(val, addr, index, opc);
+tcg_temp_free(addr);
+}
+
+static void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
+ TCGv_i32 a32, int index, MemOp opc)
+{
+TCGv addr = gen_aa32_addr(s, a32, opc);
+tcg_gen_qemu_st_i32(val, addr, index, opc);
+tcg_temp_free(addr);
+}
+
 static void gen_aa32_ld_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 int index, MemOp opc)
 {
-TCGv addr;
-
-if (s->align_mem) {
-opc |= MO_ALIGN;
-}
-
-addr = gen_aa32_addr(s, a32, opc);
-tcg_gen_qemu_ld_i32(val, addr, index, opc);
-tcg_temp_free(addr);
+gen_aa32_ld_internal_i32(s, val, a32, index, finalize_memop(s, opc));
 }
 
 static void gen_aa32_st_i32(DisasContext *s, TCGv_i32 val, TCGv_i32 a32,
 int index, MemOp opc)
 {
-TCGv addr;
+gen_aa32_st_internal_i32(s, val, a32, index, finalize_memop(s, opc));
+}
 
-if (s->align_mem) {
-opc |= MO_ALIGN;
+#define DO_GEN_LD(SUFF, OPC)\
+static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val, \
+ TCGv_i32 a32, int index)   \
+{   \
+gen_aa32_ld_i32(s, val, a32, index, OPC);   \
 }
 
-addr = gen_aa32_addr(s, a32, opc);
-tcg_gen_qemu_st_i32(val, addr, index, opc);
-tcg_temp_free(addr);
-}
-
-#define DO_GEN_LD(SUFF, OPC) \
-static inline void gen_aa32_ld##SUFF(DisasContext *s, TCGv_i32 val,  \
- TCGv_i32 a32, int index)\
-{\
-gen_aa32_ld_i32(s, val, a32, 

[PATCH v5 13/31] target/arm: Fix SCTLR_B test for TCGv_i64 load/store

2021-04-19 Thread Richard Henderson
Just because operating on a TCGv_i64 temporary does not
mean that we're performing a 64-bit operation.  Restrict
the frobbing to actual 64-bit operations.

This bug is not currently visible because all current
users of these two functions always pass MO_64.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index b47a58ee9a..d37a3dfa4a 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -982,7 +982,7 @@ static void gen_aa32_ld_i64(DisasContext *s, TCGv_i64 val, 
TCGv_i32 a32,
 tcg_gen_qemu_ld_i64(val, addr, index, opc);
 
 /* Not needed for user-mode BE32, where we use MO_BE instead.  */
-if (!IS_USER_ONLY && s->sctlr_b) {
+if (!IS_USER_ONLY && s->sctlr_b && (opc & MO_SIZE) == MO_64) {
 tcg_gen_rotri_i64(val, val, 32);
 }
 
@@ -1001,7 +1001,7 @@ static void gen_aa32_st_i64(DisasContext *s, TCGv_i64 
val, TCGv_i32 a32,
 TCGv addr = gen_aa32_addr(s, a32, opc);
 
 /* Not needed for user-mode BE32, where we use MO_BE instead.  */
-if (!IS_USER_ONLY && s->sctlr_b) {
+if (!IS_USER_ONLY && s->sctlr_b && (opc & MO_SIZE) == MO_64) {
 TCGv_i64 tmp = tcg_temp_new_i64();
 tcg_gen_rotri_i64(tmp, val, 32);
 tcg_gen_qemu_st_i64(tmp, addr, index, opc);
-- 
2.25.1




[PATCH 13/14] hw/block/nvme: move zoned constraints checks

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

Validation of the max_active and max_open zoned parameters are
independent of any other state, so move them to the early
nvme_ns_check_constraints parameter checks.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme-ns.c | 52 +-
 1 file changed, 28 insertions(+), 24 deletions(-)

diff --git a/hw/block/nvme-ns.c b/hw/block/nvme-ns.c
index 2041d8138420..861b87f22bd8 100644
--- a/hw/block/nvme-ns.c
+++ b/hw/block/nvme-ns.c
@@ -210,30 +210,6 @@ static int nvme_ns_zoned_check_calc_geometry(NvmeNamespace 
*ns, Error **errp)
 return -1;
 }
 
-if (ns->params.max_active_zones) {
-if (ns->params.max_open_zones > ns->params.max_active_zones) {
-error_setg(errp, "max_open_zones (%u) exceeds max_active_zones 
(%u)",
-   ns->params.max_open_zones, ns->params.max_active_zones);
-return -1;
-}
-
-if (!ns->params.max_open_zones) {
-ns->params.max_open_zones = ns->params.max_active_zones;
-}
-}
-
-if (ns->params.zd_extension_size) {
-if (ns->params.zd_extension_size & 0x3f) {
-error_setg(errp,
-"zone descriptor extension size must be a multiple of 64B");
-return -1;
-}
-if ((ns->params.zd_extension_size >> 6) > 0xff) {
-error_setg(errp, "zone descriptor extension size is too large");
-return -1;
-}
-}
-
 return 0;
 }
 
@@ -403,6 +379,34 @@ static int nvme_ns_check_constraints(NvmeCtrl *n, 
NvmeNamespace *ns,
 }
 }
 
+if (ns->params.zoned) {
+if (ns->params.max_active_zones) {
+if (ns->params.max_open_zones > ns->params.max_active_zones) {
+error_setg(errp, "max_open_zones (%u) exceeds "
+   "max_active_zones (%u)", ns->params.max_open_zones,
+   ns->params.max_active_zones);
+return -1;
+}
+
+if (!ns->params.max_open_zones) {
+ns->params.max_open_zones = ns->params.max_active_zones;
+}
+}
+
+if (ns->params.zd_extension_size) {
+if (ns->params.zd_extension_size & 0x3f) {
+error_setg(errp, "zone descriptor extension size must be a "
+   "multiple of 64B");
+return -1;
+}
+if ((ns->params.zd_extension_size >> 6) > 0xff) {
+error_setg(errp,
+   "zone descriptor extension size is too large");
+return -1;
+}
+}
+}
+
 return 0;
 }
 
-- 
2.31.1




Re: [PATCH RFC] migration: warn about non-migratable configurations unless '--no-migration' was specified

2021-04-19 Thread Eduardo Habkost
On Mon, Apr 19, 2021 at 07:47:34PM +0100, Dr. David Alan Gilbert wrote:
> * Daniel P. Berrangé (berra...@redhat.com) wrote:
> > On Mon, Apr 19, 2021 at 06:15:56PM +0100, Daniel P. Berrangé wrote:
> > > On Mon, Apr 19, 2021 at 06:11:47PM +0100, Dr. David Alan Gilbert wrote:
> > > > * Eduardo Habkost (ehabk...@redhat.com) wrote:
> > > > > I would make live migration policy an enum, just to make sure
> > > > > we are explicit about the requirements:
> > > > > 
> > > > > - UNKNOWN: this is the current state in QEMU 6.0, where we don't
> > > > >   really know what the user expects.
> > > > >   This can be the default on existing versioned machine types,
> > > > >   just for compatibility.
> > > > >   I suggest making this print warnings for every migration
> > > > >   blocker (like this patch does).
> > > > >   I suggest deprecating this behavior as soon as we can.
> > > > > 
> > > > > - PREFERRED: try to make the VM migratable when possible, but
> > > > >   don't print a warning or error out if migration is blocked.
> > > > >   This seems to be the behavior expected by libvirt today.
> > > > > 
> > > > > - NOT_NEEDED: live migration is not needed, and QEMU is free to
> > > > >   enable features that block live migration or change guest ABI.
> > > > >   We can probably make this the default on machine types that
> > > > >   never supported live migration.
> > > > 
> > > > I suggest you could do this by adding:
> > > >   -warn-none-migratable
> > > >   -no-warn-none-migratable
> > > > 
> > > > and then argue about defaults another time.
> > > 
> > > If we're going to add new args, lets at least future proof our
> > > approach with an extensible option that we can wire into QMP
> > > too later
> > > 
> > >   -migratable  none|preferred|required 
> > > 
> > > and letting us add extra key/value pairs to tune it if desired.
> > 
> > Having said that, we potentially don't need a dedicated arg if we
> > just make  'migratable=none|preferred|required' be a property of
> > the machine type and hook everything off that
> 
> I think my only difficulty with that is that I don't find any of those
> 3 words 'obvious'.

Any suggestions of replacements for those 3 words?

Would the descriptions below be enough to clarify their meaning
in documentation?

- NONE: live migration is not needed, and device or machine code
  is allowed to enable features that block live migration or
  change guest ABI.
  (Not implemented yet)

- PREFERRED: machine and device code should try to make the VM
  migratable when possible, but won't emit a warning or error out
  if migration is blocked.
  (Current default behavior)

- REQUIRED: live migration support is required, and adding a
  migration blocker will be an error.
  (Implemented today by --only-migratable)

-- 
Eduardo




[PATCH v5 04/31] target/arm: Add wrapper macros for accessing tbflags

2021-04-19 Thread Richard Henderson
We're about to split tbflags into two parts.  These macros
will ensure that the correct part is used with the correct
set of bits.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   | 22 +-
 target/arm/helper-a64.c|  2 +-
 target/arm/helper.c| 85 +-
 target/arm/translate-a64.c | 36 
 target/arm/translate.c | 48 ++---
 5 files changed, 101 insertions(+), 92 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 4cbf2db3e3..b798ff8115 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3462,6 +3462,26 @@ FIELD(TBFLAG_A64, TCMA, 16, 2)
 FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
 FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
 
+/*
+ * Helpers for using the above.
+ */
+#define DP_TBFLAG_ANY(DST, WHICH, VAL) \
+(DST = FIELD_DP32(DST, TBFLAG_ANY, WHICH, VAL))
+#define DP_TBFLAG_A64(DST, WHICH, VAL) \
+(DST = FIELD_DP32(DST, TBFLAG_A64, WHICH, VAL))
+#define DP_TBFLAG_A32(DST, WHICH, VAL) \
+(DST = FIELD_DP32(DST, TBFLAG_A32, WHICH, VAL))
+#define DP_TBFLAG_M32(DST, WHICH, VAL) \
+(DST = FIELD_DP32(DST, TBFLAG_M32, WHICH, VAL))
+#define DP_TBFLAG_AM32(DST, WHICH, VAL) \
+(DST = FIELD_DP32(DST, TBFLAG_AM32, WHICH, VAL))
+
+#define EX_TBFLAG_ANY(IN, WHICH)   FIELD_EX32(IN, TBFLAG_ANY, WHICH)
+#define EX_TBFLAG_A64(IN, WHICH)   FIELD_EX32(IN, TBFLAG_A64, WHICH)
+#define EX_TBFLAG_A32(IN, WHICH)   FIELD_EX32(IN, TBFLAG_A32, WHICH)
+#define EX_TBFLAG_M32(IN, WHICH)   FIELD_EX32(IN, TBFLAG_M32, WHICH)
+#define EX_TBFLAG_AM32(IN, WHICH)  FIELD_EX32(IN, TBFLAG_AM32, WHICH)
+
 /**
  * cpu_mmu_index:
  * @env: The cpu environment
@@ -3472,7 +3492,7 @@ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
  */
 static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
 {
-return FIELD_EX32(env->hflags, TBFLAG_ANY, MMUIDX);
+return EX_TBFLAG_ANY(env->hflags, MMUIDX);
 }
 
 static inline bool bswap_code(bool sctlr_b)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 061c8ff846..9cc3b066e2 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1020,7 +1020,7 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t 
new_pc)
  * the hflags rebuild, since we can pull the composite TBII field
  * from there.
  */
-tbii = FIELD_EX32(env->hflags, TBFLAG_A64, TBII);
+tbii = EX_TBFLAG_A64(env->hflags, TBII);
 if ((tbii >> extract64(new_pc, 55, 1)) & 1) {
 /* TBI is enabled. */
 int core_mmu_idx = cpu_mmu_index(env, false);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index cd8dec126f..2769e6fd35 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -12987,12 +12987,11 @@ ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
 static uint32_t rebuild_hflags_common(CPUARMState *env, int fp_el,
   ARMMMUIdx mmu_idx, uint32_t flags)
 {
-flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el);
-flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX,
-   arm_to_core_mmu_idx(mmu_idx));
+DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el);
+DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
 
 if (arm_singlestep_active(env)) {
-flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1);
+DP_TBFLAG_ANY(flags, SS_ACTIVE, 1);
 }
 return flags;
 }
@@ -13003,12 +13002,12 @@ static uint32_t rebuild_hflags_common_32(CPUARMState 
*env, int fp_el,
 bool sctlr_b = arm_sctlr_b(env);
 
 if (sctlr_b) {
-flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR__B, 1);
+DP_TBFLAG_A32(flags, SCTLR__B, 1);
 }
 if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
-flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
+DP_TBFLAG_ANY(flags, BE_DATA, 1);
 }
-flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env));
+DP_TBFLAG_A32(flags, NS, !access_secure_reg(env));
 
 return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
 }
@@ -13019,7 +13018,7 @@ static uint32_t rebuild_hflags_m32(CPUARMState *env, 
int fp_el,
 uint32_t flags = 0;
 
 if (arm_v7m_is_handler_mode(env)) {
-flags = FIELD_DP32(flags, TBFLAG_M32, HANDLER, 1);
+DP_TBFLAG_M32(flags, HANDLER, 1);
 }
 
 /*
@@ -13030,7 +13029,7 @@ static uint32_t rebuild_hflags_m32(CPUARMState *env, 
int fp_el,
 if (arm_feature(env, ARM_FEATURE_V8) &&
 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
   (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
-flags = FIELD_DP32(flags, TBFLAG_M32, STACKCHECK, 1);
+DP_TBFLAG_M32(flags, STACKCHECK, 1);
 }
 
 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
@@ -13040,8 +13039,7 @@ static uint32_t rebuild_hflags_aprofile(CPUARMState 
*env)
 {
 int flags = 0;
 
-flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL,
-   arm_debug_target_el(env));
+

[PATCH v5 09/31] target/arm: Move TBFLAG_ANY bits to the bottom

2021-04-19 Thread Richard Henderson
Now that other bits have been moved out of tb->flags,
there's no point in filling from the top.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 15104e1440..5e0131be1a 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3405,15 +3405,15 @@ typedef ARMCPU ArchCPU;
  *
  * Unless otherwise noted, these bits are cached in env->hflags.
  */
-FIELD(TBFLAG_ANY, AARCH64_STATE, 31, 1)
-FIELD(TBFLAG_ANY, SS_ACTIVE, 30, 1)
-FIELD(TBFLAG_ANY, PSTATE__SS, 29, 1)/* Not cached. */
-FIELD(TBFLAG_ANY, BE_DATA, 28, 1)
-FIELD(TBFLAG_ANY, MMUIDX, 24, 4)
+FIELD(TBFLAG_ANY, AARCH64_STATE, 0, 1)
+FIELD(TBFLAG_ANY, SS_ACTIVE, 1, 1)
+FIELD(TBFLAG_ANY, PSTATE__SS, 2, 1)  /* Not cached. */
+FIELD(TBFLAG_ANY, BE_DATA, 3, 1)
+FIELD(TBFLAG_ANY, MMUIDX, 4, 4)
 /* Target EL if we take a floating-point-disabled exception */
-FIELD(TBFLAG_ANY, FPEXC_EL, 22, 2)
+FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
 /* For A-profile only, target EL for debug exceptions.  */
-FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 20, 2)
+FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
 
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
-- 
2.25.1




Re: [PATCH v3 09/30] target/mips: Merge do_translate_address into cpu_mips_translate_address

2021-04-19 Thread Richard Henderson

On 4/19/21 12:18 PM, Philippe Mathieu-Daudé wrote:

Currently cpu_mips_translate_address() calls raise_mmu_exception(),
and do_translate_address() calls cpu_loop_exit_restore().

This API split is dangerous, we could call cpu_mips_translate_address
without returning to the main loop.

As there is only one caller, it is trivial (and safer) to merge
do_translate_address() back to cpu_mips_translate_address().

Reported-by: Richard Henderson
Suggested-by: Richard Henderson
Signed-off-by: Philippe Mathieu-Daudé
---
  target/mips/internal.h   |  2 +-
  target/mips/op_helper.c  | 20 ++--
  target/mips/tlb_helper.c | 11 ++-
  3 files changed, 9 insertions(+), 24 deletions(-)


Reviewed-by: Richard Henderson 

r~



[PATCH v5 03/31] target/arm: Rename TBFLAG_ANY, PSTATE_SS

2021-04-19 Thread Richard Henderson
We're about to rearrange the macro expansion surrounding tbflags,
and this field name will be expanded using the bit definition of
the same name, resulting in a token pasting error.

So PSTATE_SS -> PSTATE__SS in the uses, and document it.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   | 2 +-
 target/arm/helper.c| 4 ++--
 target/arm/translate-a64.c | 2 +-
 target/arm/translate.c | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 304e0a6af3..4cbf2db3e3 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3396,7 +3396,7 @@ typedef ARMCPU ArchCPU;
  */
 FIELD(TBFLAG_ANY, AARCH64_STATE, 31, 1)
 FIELD(TBFLAG_ANY, SS_ACTIVE, 30, 1)
-FIELD(TBFLAG_ANY, PSTATE_SS, 29, 1) /* Not cached. */
+FIELD(TBFLAG_ANY, PSTATE__SS, 29, 1)/* Not cached. */
 FIELD(TBFLAG_ANY, BE_DATA, 28, 1)
 FIELD(TBFLAG_ANY, MMUIDX, 24, 4)
 /* Target EL if we take a floating-point-disabled exception */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 556b9d4f0a..cd8dec126f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1,11 +1,11 @@ void cpu_get_tb_cpu_state(CPUARMState *env, 
target_ulong *pc,
  * 0x   Inactive (the TB flag for SS is always 0)
  * 10   Active-pending
  * 11   Active-not-pending
- * SS_ACTIVE is set in hflags; PSTATE_SS is computed every TB.
+ * SS_ACTIVE is set in hflags; PSTATE__SS is computed every TB.
  */
 if (FIELD_EX32(flags, TBFLAG_ANY, SS_ACTIVE) &&
 (env->pstate & PSTATE_SS)) {
-flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
+flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE__SS, 1);
 }
 
 *pflags = flags;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index f35a5e8174..64b3a5200c 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -14733,7 +14733,7 @@ static void 
aarch64_tr_init_disas_context(DisasContextBase *dcbase,
  *   end the TB
  */
 dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
-dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
+dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE__SS);
 dc->is_ldex = false;
 dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index 0b56e060a5..3c5ca9f7e5 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -8909,7 +8909,7 @@ static void arm_tr_init_disas_context(DisasContextBase 
*dcbase, CPUState *cs)
  *   end the TB
  */
 dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
-dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
+dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE__SS);
 dc->is_ldex = false;
 
 dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
-- 
2.25.1




[PATCH v5 02/31] target/arm: Rename TBFLAG_A32, SCTLR_B

2021-04-19 Thread Richard Henderson
We're about to rearrange the macro expansion surrounding tbflags,
and this field name will be expanded using the bit definition of
the same name, resulting in a token pasting error.

So SCTLR_B -> SCTLR__B in the 3 uses, and document it.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   | 2 +-
 target/arm/helper.c| 2 +-
 target/arm/translate.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 193a49ec7f..304e0a6af3 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3423,7 +3423,7 @@ FIELD(TBFLAG_A32, VECSTRIDE, 12, 2) /* Not cached. */
  */
 FIELD(TBFLAG_A32, XSCALE_CPAR, 12, 2)
 FIELD(TBFLAG_A32, VFPEN, 14, 1) /* Partially cached, minus FPEXC. */
-FIELD(TBFLAG_A32, SCTLR_B, 15, 1)
+FIELD(TBFLAG_A32, SCTLR__B, 15, 1)  /* Cannot overlap with SCTLR_B */
 FIELD(TBFLAG_A32, HSTR_ACTIVE, 16, 1)
 /*
  * Indicates whether cp register reads and writes by guest code should access
diff --git a/target/arm/helper.c b/target/arm/helper.c
index d9220be7c5..556b9d4f0a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -13003,7 +13003,7 @@ static uint32_t rebuild_hflags_common_32(CPUARMState 
*env, int fp_el,
 bool sctlr_b = arm_sctlr_b(env);
 
 if (sctlr_b) {
-flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, 1);
+flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR__B, 1);
 }
 if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index 7103da2d7a..0b56e060a5 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -8879,7 +8879,7 @@ static void arm_tr_init_disas_context(DisasContextBase 
*dcbase, CPUState *cs)
 FIELD_EX32(tb_flags, TBFLAG_ANY, BE_DATA) ? MO_BE : MO_LE;
 dc->debug_target_el =
 FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
-dc->sctlr_b = FIELD_EX32(tb_flags, TBFLAG_A32, SCTLR_B);
+dc->sctlr_b = FIELD_EX32(tb_flags, TBFLAG_A32, SCTLR__B);
 dc->hstr_active = FIELD_EX32(tb_flags, TBFLAG_A32, HSTR_ACTIVE);
 dc->ns = FIELD_EX32(tb_flags, TBFLAG_A32, NS);
 dc->vfp_enabled = FIELD_EX32(tb_flags, TBFLAG_A32, VFPEN);
-- 
2.25.1




[PATCH v5 01/31] target/arm: Fix decode of align in VLDST_single

2021-04-19 Thread Richard Henderson
The encoding of size = 2 and size = 3 had the incorrect decode
for align, overlapping the stride field.  This error was hidden
by what should have been unnecessary masking in translate.

Reviewed-by: Peter Maydell 
Signed-off-by: Richard Henderson 
---
 target/arm/neon-ls.decode   | 4 ++--
 target/arm/translate-neon.c.inc | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
index c17f5019e3..0a2a0e15db 100644
--- a/target/arm/neon-ls.decode
+++ b/target/arm/neon-ls.decode
@@ -46,7 +46,7 @@ VLD_all_lanes   0100 1 . 1 0 rn:4  11 n:2 size:2 t:1 
a:1 rm:4 \
 
 VLDST_single    0100 1 . l:1 0 rn:4  00 n:2 reg_idx:3 align:1 rm:4 \
vd=%vd_dp size=0 stride=1
-VLDST_single    0100 1 . l:1 0 rn:4  01 n:2 reg_idx:2 align:2 rm:4 \
+VLDST_single    0100 1 . l:1 0 rn:4  01 n:2 reg_idx:2 . align:1 rm:4 \
vd=%vd_dp size=1 stride=%imm1_5_p1
-VLDST_single    0100 1 . l:1 0 rn:4  10 n:2 reg_idx:1 align:3 rm:4 \
+VLDST_single    0100 1 . l:1 0 rn:4  10 n:2 reg_idx:1 . align:2 rm:4 \
vd=%vd_dp size=2 stride=%imm1_6_p1
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index f6c68e30ab..0e5828744b 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -606,7 +606,7 @@ static bool trans_VLDST_single(DisasContext *s, 
arg_VLDST_single *a)
 switch (nregs) {
 case 1:
 if (((a->align & (1 << a->size)) != 0) ||
-(a->size == 2 && ((a->align & 3) == 1 || (a->align & 3) == 2))) {
+(a->size == 2 && (a->align == 1 || a->align == 2))) {
 return false;
 }
 break;
@@ -621,7 +621,7 @@ static bool trans_VLDST_single(DisasContext *s, 
arg_VLDST_single *a)
 }
 break;
 case 4:
-if ((a->size == 2) && ((a->align & 3) == 3)) {
+if (a->size == 2 && a->align == 3) {
 return false;
 }
 break;
-- 
2.25.1




[PATCH 06/14] hw/block/nvme: remove non-shared defines from header file

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

Remove non-shared defines from the shared header.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme.h| 2 --
 hw/block/nvme-ns.c | 1 +
 hw/block/nvme.c| 1 +
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/block/nvme.h b/hw/block/nvme.h
index d9374d3e33e0..2c4e7b90fa54 100644
--- a/hw/block/nvme.h
+++ b/hw/block/nvme.h
@@ -24,8 +24,6 @@
 
 #include "block/nvme.h"
 
-#define NVME_DEFAULT_ZONE_SIZE   (128 * MiB)
-#define NVME_DEFAULT_MAX_ZA_SIZE (128 * KiB)
 #define NVME_MAX_CONTROLLERS 32
 #define NVME_MAX_NAMESPACES  256
 
diff --git a/hw/block/nvme-ns.c b/hw/block/nvme-ns.c
index aae06987e49a..35c146633223 100644
--- a/hw/block/nvme-ns.c
+++ b/hw/block/nvme-ns.c
@@ -23,6 +23,7 @@
 #include "trace.h"
 
 #define MIN_DISCARD_GRANULARITY (4 * KiB)
+#define NVME_DEFAULT_ZONE_SIZE   (128 * MiB)
 
 void nvme_ns_init_format(NvmeNamespace *ns)
 {
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index f7c5e83e6800..2c0af579e7a8 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -159,6 +159,7 @@
 #define NVME_TEMPERATURE_WARNING 0x157
 #define NVME_TEMPERATURE_CRITICAL 0x175
 #define NVME_NUM_FW_SLOTS 1
+#define NVME_DEFAULT_MAX_ZA_SIZE (128 * KiB)
 
 #define NVME_GUEST_ERR(trace, fmt, ...) \
 do { \
-- 
2.31.1




[PATCH v5 00/31] target/arm: enforce alignment

2021-04-19 Thread Richard Henderson
Based-on: 20210416183106.1516563-1-richard.hender...@linaro.org
("[PATCH v5 for-6.1 0/9] target/arm mte fixes")

Changes for v5:
  * Address review issues.
  * Use cpu_abort in assert_hflags_rebuild_correctly

The only patch lacking review is the new one:
07-target-arm-Use-cpu_abort-in-assert_hflags_rebuild.patch


r~


Richard Henderson (31):
  target/arm: Fix decode of align in VLDST_single
  target/arm: Rename TBFLAG_A32, SCTLR_B
  target/arm: Rename TBFLAG_ANY, PSTATE_SS
  target/arm: Add wrapper macros for accessing tbflags
  target/arm: Introduce CPUARMTBFlags
  target/arm: Move mode specific TB flags to tb->cs_base
  target/arm: Use cpu_abort in assert_hflags_rebuild_correctly
  target/arm: Move TBFLAG_AM32 bits to the top
  target/arm: Move TBFLAG_ANY bits to the bottom
  target/arm: Add ALIGN_MEM to TBFLAG_ANY
  target/arm: Adjust gen_aa32_{ld,st}_i32 for align+endianness
  target/arm: Merge gen_aa32_frob64 into gen_aa32_ld_i64
  target/arm: Fix SCTLR_B test for TCGv_i64 load/store
  target/arm: Adjust gen_aa32_{ld,st}_i64 for align+endianness
  target/arm: Enforce word alignment for LDRD/STRD
  target/arm: Enforce alignment for LDA/LDAH/STL/STLH
  target/arm: Enforce alignment for LDM/STM
  target/arm: Enforce alignment for RFE
  target/arm: Enforce alignment for SRS
  target/arm: Enforce alignment for VLDM/VSTM
  target/arm: Enforce alignment for VLDR/VSTR
  target/arm: Enforce alignment for VLDn (all lanes)
  target/arm: Enforce alignment for VLDn/VSTn (multiple)
  target/arm: Enforce alignment for VLDn/VSTn (single)
  target/arm: Use finalize_memop for aa64 gpr load/store
  target/arm: Use finalize_memop for aa64 fpr load/store
  target/arm: Enforce alignment for aa64 load-acq/store-rel
  target/arm: Use MemOp for size + endian in aa64 vector ld/st
  target/arm: Enforce alignment for aa64 vector LDn/STn (multiple)
  target/arm: Enforce alignment for aa64 vector LDn/STn (single)
  target/arm: Enforce alignment for sve LD1R

 target/arm/cpu.h| 105 -
 target/arm/translate.h  |  38 +
 target/arm/neon-ls.decode   |   4 +-
 target/arm/helper-a64.c |   2 +-
 target/arm/helper.c | 163 ++--
 target/arm/translate-a64.c  | 214 +-
 target/arm/translate-sve.c  |   2 +-
 target/arm/translate.c  | 258 +---
 target/arm/translate-neon.c.inc | 117 ---
 target/arm/translate-vfp.c.inc  |  20 +--
 10 files changed, 556 insertions(+), 367 deletions(-)

-- 
2.25.1




Re: [PATCH 7/8] tests/acceptance/migration.py: cancel test on s390x

2021-04-19 Thread Willian Rampazzo
On Thu, Apr 15, 2021 at 6:52 PM Cleber Rosa  wrote:
>
> Because s390x targets it can not currently migrate without a guest
> running.
>
> Future work may provide a proper guest, but for now, it's safer to
> cancel the test.
>
> Signed-off-by: Cleber Rosa 
> ---
>  tests/acceptance/migration.py | 6 ++
>  1 file changed, 6 insertions(+)
>

Reviewed-by: Willian Rampazzo 




[PATCH 09/14] hw/block/nvme: add metadata offset helper

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

Add an nvme_moff() helper.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme.h |  7 ++-
 hw/block/nvme-dif.c |  4 ++--
 hw/block/nvme-ns.c  |  2 +-
 hw/block/nvme.c | 12 ++--
 4 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/hw/block/nvme.h b/hw/block/nvme.h
index dc065e57b509..9349d1c33ad7 100644
--- a/hw/block/nvme.h
+++ b/hw/block/nvme.h
@@ -107,7 +107,7 @@ typedef struct NvmeNamespace {
 BlockConfblkconf;
 int32_t  bootindex;
 int64_t  size;
-int64_t  mdata_offset;
+int64_t  moff;
 NvmeIdNs id_ns;
 NvmeLBAF lbaf;
 size_t   lbasz;
@@ -158,6 +158,11 @@ static inline size_t nvme_m2b(NvmeNamespace *ns, uint64_t 
lba)
 return ns->lbaf.ms * lba;
 }
 
+static inline int64_t nvme_moff(NvmeNamespace *ns, uint64_t lba)
+{
+return ns->moff + nvme_m2b(ns, lba);
+}
+
 static inline bool nvme_ns_ext(NvmeNamespace *ns)
 {
 return !!NVME_ID_NS_FLBAS_EXTENDED(ns->id_ns.flbas);
diff --git a/hw/block/nvme-dif.c b/hw/block/nvme-dif.c
index c72e43195abf..88efcbe9bd60 100644
--- a/hw/block/nvme-dif.c
+++ b/hw/block/nvme-dif.c
@@ -306,7 +306,7 @@ static void nvme_dif_rw_mdata_in_cb(void *opaque, int ret)
 uint64_t slba = le64_to_cpu(rw->slba);
 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
 size_t mlen = nvme_m2b(ns, nlb);
-uint64_t offset = ns->mdata_offset + nvme_m2b(ns, slba);
+uint64_t offset = nvme_moff(ns, slba);
 BlockBackend *blk = ns->blkconf.blk;
 
 trace_pci_nvme_dif_rw_mdata_in_cb(nvme_cid(req), blk_name(blk));
@@ -335,7 +335,7 @@ static void nvme_dif_rw_mdata_out_cb(void *opaque, int ret)
 NvmeNamespace *ns = req->ns;
 NvmeRwCmd *rw = (NvmeRwCmd *)>cmd;
 uint64_t slba = le64_to_cpu(rw->slba);
-uint64_t offset = ns->mdata_offset + nvme_m2b(ns, slba);
+uint64_t offset = nvme_moff(ns, slba);
 BlockBackend *blk = ns->blkconf.blk;
 
 trace_pci_nvme_dif_rw_mdata_out_cb(nvme_cid(req), blk_name(blk));
diff --git a/hw/block/nvme-ns.c b/hw/block/nvme-ns.c
index 2224b497e4b5..84f602652354 100644
--- a/hw/block/nvme-ns.c
+++ b/hw/block/nvme-ns.c
@@ -42,7 +42,7 @@ void nvme_ns_init_format(NvmeNamespace *ns)
 id_ns->ncap = id_ns->nsze;
 id_ns->nuse = id_ns->ncap;
 
-ns->mdata_offset = (int64_t)nlbas << ns->lbaf.ds;
+ns->moff = (int64_t)nlbas << ns->lbaf.ds;
 
 npdg = ns->blkconf.discard_granularity / ns->lbasz;
 
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index fcc0fe72dc33..b0a6c1457a88 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -1827,7 +1827,7 @@ static void nvme_rw_cb(void *opaque, int ret)
 NvmeRwCmd *rw = (NvmeRwCmd *)>cmd;
 uint64_t slba = le64_to_cpu(rw->slba);
 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
-uint64_t offset = ns->mdata_offset + nvme_m2b(ns, slba);
+uint64_t offset = nvme_moff(ns, slba);
 
 if (req->cmd.opcode == NVME_CMD_WRITE_ZEROES) {
 size_t mlen = nvme_m2b(ns, nlb);
@@ -1993,7 +1993,7 @@ static void nvme_verify_mdata_in_cb(void *opaque, int ret)
 uint64_t slba = le64_to_cpu(rw->slba);
 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
 size_t mlen = nvme_m2b(ns, nlb);
-uint64_t offset = ns->mdata_offset + nvme_m2b(ns, slba);
+uint64_t offset = nvme_moff(ns, slba);
 BlockBackend *blk = ns->blkconf.blk;
 
 trace_pci_nvme_verify_mdata_in_cb(nvme_cid(req), blk_name(blk));
@@ -2096,7 +2096,7 @@ static void nvme_aio_zone_reset_cb(void *opaque, int ret)
 }
 
 if (ns->lbaf.ms) {
-int64_t offset = ns->mdata_offset + nvme_m2b(ns, zone->d.zslba);
+int64_t offset = nvme_moff(ns, zone->d.zslba);
 
 blk_aio_pwrite_zeroes(ns->blkconf.blk, offset,
   nvme_m2b(ns, ns->zone_size), BDRV_REQ_MAY_UNMAP,
@@ -2167,7 +2167,7 @@ static void nvme_copy_cb(void *opaque, int ret)
 if (ns->lbaf.ms) {
 NvmeCopyCmd *copy = (NvmeCopyCmd *)>cmd;
 uint64_t sdlba = le64_to_cpu(copy->sdlba);
-int64_t offset = ns->mdata_offset + nvme_m2b(ns, sdlba);
+int64_t offset = nvme_moff(ns, sdlba);
 
 qemu_iovec_reset(>sg.iov);
 qemu_iovec_add(>sg.iov, ctx->mbounce, nvme_m2b(ns, ctx->nlb));
@@ -2463,7 +2463,7 @@ static void nvme_compare_data_cb(void *opaque, int ret)
 uint64_t slba = le64_to_cpu(rw->slba);
 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
 size_t mlen = nvme_m2b(ns, nlb);
-uint64_t offset = ns->mdata_offset + nvme_m2b(ns, slba);
+uint64_t offset = nvme_moff(ns, slba);
 
 ctx->mdata.bounce = g_malloc(mlen);
 
@@ -2744,7 +2744,7 @@ static uint16_t nvme_copy(NvmeCtrl *n, NvmeRequest *req)
 
 if (ns->lbaf.ms) {
 len = nvme_m2b(ns, nlb);
-offset = ns->mdata_offset + nvme_m2b(ns, slba);
+offset = nvme_moff(ns, slba);
 
 in_ctx = g_new(struct nvme_copy_in_ctx, 1);
 in_ctx->req = req;
-- 
2.31.1




Re: [PATCH v5] i386/cpu_dump: support AVX512 ZMM regs dump

2021-04-19 Thread Eduardo Habkost
On Fri, Apr 16, 2021 at 10:08:24AM +0800, Robert Hoo wrote:
> Since commit fa4518741e (target-i386: Rename struct XMMReg to ZMMReg),
> CPUX86State.xmm_regs[] has already been extended to 512bit to support
> AVX512.
> Also, other qemu level supports for AVX512 registers are there for
> years.
> But in x86_cpu_dump_state(), still only dump XMM registers no matter
> YMM/ZMM is enabled.
> This patch is to complement this, let it dump XMM/YMM/ZMM accordingly.
> 
> Signed-off-by: Robert Hoo 

Queued for 6.1, thanks!

-- 
Eduardo




[PATCH 04/14] hw/block/nvme: consolidate header files

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

In preparation for moving the nvme device into its own subtree, merge
the header files into one.

Also add missing copyright notice and add list of authors with
substantial contributions.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme-dif.h|  63 ---
 hw/block/nvme-ns.h | 229 
 hw/block/nvme-subsys.h |  59 ---
 hw/block/nvme.h| 383 +
 hw/block/nvme-dif.c|   1 -
 hw/block/nvme-ns.c |   1 -
 hw/block/nvme-subsys.c |   1 -
 hw/block/nvme.c|   2 -
 8 files changed, 348 insertions(+), 391 deletions(-)
 delete mode 100644 hw/block/nvme-dif.h
 delete mode 100644 hw/block/nvme-ns.h
 delete mode 100644 hw/block/nvme-subsys.h

diff --git a/hw/block/nvme-dif.h b/hw/block/nvme-dif.h
deleted file mode 100644
index 524faffbd7a0..
--- a/hw/block/nvme-dif.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * QEMU NVM Express End-to-End Data Protection support
- *
- * Copyright (c) 2021 Samsung Electronics Co., Ltd.
- *
- * Authors:
- *   Klaus Jensen   
- *   Gollu Appalanaidu  
- */
-
-#ifndef HW_NVME_DIF_H
-#define HW_NVME_DIF_H
-
-/* from Linux kernel (crypto/crct10dif_common.c) */
-static const uint16_t t10_dif_crc_table[256] = {
-0x, 0x8BB7, 0x9CD9, 0x176E, 0xB205, 0x39B2, 0x2EDC, 0xA56B,
-0xEFBD, 0x640A, 0x7364, 0xF8D3, 0x5DB8, 0xD60F, 0xC161, 0x4AD6,
-0x54CD, 0xDF7A, 0xC814, 0x43A3, 0xE6C8, 0x6D7F, 0x7A11, 0xF1A6,
-0xBB70, 0x30C7, 0x27A9, 0xAC1E, 0x0975, 0x82C2, 0x95AC, 0x1E1B,
-0xA99A, 0x222D, 0x3543, 0xBEF4, 0x1B9F, 0x9028, 0x8746, 0x0CF1,
-0x4627, 0xCD90, 0xDAFE, 0x5149, 0xF422, 0x7F95, 0x68FB, 0xE34C,
-0xFD57, 0x76E0, 0x618E, 0xEA39, 0x4F52, 0xC4E5, 0xD38B, 0x583C,
-0x12EA, 0x995D, 0x8E33, 0x0584, 0xA0EF, 0x2B58, 0x3C36, 0xB781,
-0xD883, 0x5334, 0x445A, 0xCFED, 0x6A86, 0xE131, 0xF65F, 0x7DE8,
-0x373E, 0xBC89, 0xABE7, 0x2050, 0x853B, 0x0E8C, 0x19E2, 0x9255,
-0x8C4E, 0x07F9, 0x1097, 0x9B20, 0x3E4B, 0xB5FC, 0xA292, 0x2925,
-0x63F3, 0xE844, 0xFF2A, 0x749D, 0xD1F6, 0x5A41, 0x4D2F, 0xC698,
-0x7119, 0xFAAE, 0xEDC0, 0x6677, 0xC31C, 0x48AB, 0x5FC5, 0xD472,
-0x9EA4, 0x1513, 0x027D, 0x89CA, 0x2CA1, 0xA716, 0xB078, 0x3BCF,
-0x25D4, 0xAE63, 0xB90D, 0x32BA, 0x97D1, 0x1C66, 0x0B08, 0x80BF,
-0xCA69, 0x41DE, 0x56B0, 0xDD07, 0x786C, 0xF3DB, 0xE4B5, 0x6F02,
-0x3AB1, 0xB106, 0xA668, 0x2DDF, 0x88B4, 0x0303, 0x146D, 0x9FDA,
-0xD50C, 0x5EBB, 0x49D5, 0xC262, 0x6709, 0xECBE, 0xFBD0, 0x7067,
-0x6E7C, 0xE5CB, 0xF2A5, 0x7912, 0xDC79, 0x57CE, 0x40A0, 0xCB17,
-0x81C1, 0x0A76, 0x1D18, 0x96AF, 0x33C4, 0xB873, 0xAF1D, 0x24AA,
-0x932B, 0x189C, 0x0FF2, 0x8445, 0x212E, 0xAA99, 0xBDF7, 0x3640,
-0x7C96, 0xF721, 0xE04F, 0x6BF8, 0xCE93, 0x4524, 0x524A, 0xD9FD,
-0xC7E6, 0x4C51, 0x5B3F, 0xD088, 0x75E3, 0xFE54, 0xE93A, 0x628D,
-0x285B, 0xA3EC, 0xB482, 0x3F35, 0x9A5E, 0x11E9, 0x0687, 0x8D30,
-0xE232, 0x6985, 0x7EEB, 0xF55C, 0x5037, 0xDB80, 0xCCEE, 0x4759,
-0x0D8F, 0x8638, 0x9156, 0x1AE1, 0xBF8A, 0x343D, 0x2353, 0xA8E4,
-0xB6FF, 0x3D48, 0x2A26, 0xA191, 0x04FA, 0x8F4D, 0x9823, 0x1394,
-0x5942, 0xD2F5, 0xC59B, 0x4E2C, 0xEB47, 0x60F0, 0x779E, 0xFC29,
-0x4BA8, 0xC01F, 0xD771, 0x5CC6, 0xF9AD, 0x721A, 0x6574, 0xEEC3,
-0xA415, 0x2FA2, 0x38CC, 0xB37B, 0x1610, 0x9DA7, 0x8AC9, 0x017E,
-0x1F65, 0x94D2, 0x83BC, 0x080B, 0xAD60, 0x26D7, 0x31B9, 0xBA0E,
-0xF0D8, 0x7B6F, 0x6C01, 0xE7B6, 0x42DD, 0xC96A, 0xDE04, 0x55B3
-};
-
-uint16_t nvme_check_prinfo(NvmeNamespace *ns, uint16_t ctrl, uint64_t slba,
-   uint32_t reftag);
-uint16_t nvme_dif_mangle_mdata(NvmeNamespace *ns, uint8_t *mbuf, size_t mlen,
-   uint64_t slba);
-void nvme_dif_pract_generate_dif(NvmeNamespace *ns, uint8_t *buf, size_t len,
- uint8_t *mbuf, size_t mlen, uint16_t apptag,
- uint32_t reftag);
-uint16_t nvme_dif_check(NvmeNamespace *ns, uint8_t *buf, size_t len,
-uint8_t *mbuf, size_t mlen, uint16_t ctrl,
-uint64_t slba, uint16_t apptag,
-uint16_t appmask, uint32_t reftag);
-uint16_t nvme_dif_rw(NvmeCtrl *n, NvmeRequest *req);
-
-#endif /* HW_NVME_DIF_H */
diff --git a/hw/block/nvme-ns.h b/hw/block/nvme-ns.h
deleted file mode 100644
index fb0a41f912e7..
--- a/hw/block/nvme-ns.h
+++ /dev/null
@@ -1,229 +0,0 @@
-/*
- * QEMU NVM Express Virtual Namespace
- *
- * Copyright (c) 2019 CNEX Labs
- * Copyright (c) 2020 Samsung Electronics
- *
- * Authors:
- *  Klaus Jensen  
- *
- * This work is licensed under the terms of the GNU GPL, version 2. See the
- * COPYING file in the top-level directory.
- *
- */
-
-#ifndef NVME_NS_H
-#define NVME_NS_H
-
-#include "qemu/uuid.h"
-
-#define TYPE_NVME_NS "nvme-ns"
-#define NVME_NS(obj) \
-OBJECT_CHECK(NvmeNamespace, (obj), TYPE_NVME_NS)
-
-typedef struct NvmeZone {
-NvmeZoneDescr   d;
-uint64_t  

Re: [PATCH v3 00/30] target/mips: Re-org to allow KVM-only builds

2021-04-19 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20210419191823.1555482-1-f4...@amsat.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 20210419191823.1555482-1-f4...@amsat.org
Subject: [PATCH v3 00/30] target/mips: Re-org to allow KVM-only builds

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 - [tag update]  patchew/20210415215141.1865467-1-cr...@redhat.com -> 
patchew/20210415215141.1865467-1-cr...@redhat.com
 * [new tag] patchew/20210419191823.1555482-1-f4...@amsat.org -> 
patchew/20210419191823.1555482-1-f4...@amsat.org
Switched to a new branch 'test'
81092a5 gitlab-ci: Add KVM mips64el cross-build jobs
599f90a hw/mips: Restrict non-virtualized machines to TCG
96d3db9 target/mips: Move TCG source files under tcg/ sub directory
ac05c2e target/mips: Move CP0 helpers to sysemu/cp0.c
8a08759 target/mips: Move exception management code to exception.c
835cb9b target/mips: Move TLB management helpers to tcg/sysemu/tlb_helper.c
5ea9141 target/mips: Move helper_cache() to tcg/sysemu/special_helper.c
b5730e6 target/mips: Move Special opcodes to tcg/sysemu/special_helper.c
ad82783 target/mips: Restrict CPUMIPSTLBContext::map_address() handlers scope
d406574 target/mips: Move tlb_helper.c to tcg/sysemu/
a108f18 target/mips: Restrict mmu_init() to TCG
371bbba target/mips: Move sysemu TCG-specific code to tcg/sysemu/ subfolder
d71e8e3 target/mips: Restrict cpu_mips_get_random() / update_pagemask() to TCG
5814d8e target/mips: Move physical addressing code to sysemu/physaddr.c
f186610 target/mips: Move sysemu specific files under sysemu/ subfolder
2f45566 target/mips: Move cpu_signal_handler definition around
fe33054 target/mips: Add simple user-mode mips_cpu_tlb_fill()
2a692bf target/mips: Add simple user-mode mips_cpu_do_interrupt()
381d0ec target/mips: Introduce tcg-internal.h for TCG specific declarations
5b69add meson: Introduce meson_user_arch source set for arch-specific user-mode
c5e43b4 target/mips: Extract load/store helpers to ldst_helper.c
2c88480 target/mips: Merge do_translate_address into cpu_mips_translate_address
87fde0b target/mips: Declare mips_cpu_set_error_pc() inlined in "internal.h"
32b579e target/mips: Turn printfpr() macro into a proper function
46c2010 target/mips: Restrict mips_cpu_dump_state() to cpu.c
fbb7662 target/mips: Optimize CPU/FPU regnames[] arrays
b09a6e5f target/mips: Make CPU/FPU regnames[] arrays global
79aa8aa target/mips: Move msa_reset() to new source file
999b551 target/mips: Move IEEE rounding mode array to new source file
425f9ab target/mips: Simplify meson TCG rules

=== OUTPUT BEGIN ===
1/30 Checking commit 425f9abc6fff (target/mips: Simplify meson TCG rules)
2/30 Checking commit 999b5510ae6c (target/mips: Move IEEE rounding mode array 
to new source file)
Use of uninitialized value $acpi_testexpected in string eq at 
./scripts/checkpatch.pl line 1529.
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#31: 
new file mode 100644

total: 0 errors, 1 warnings, 39 lines checked

Patch 2/30 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
3/30 Checking commit 79aa8aa9862d (target/mips: Move msa_reset() to new source 
file)
Use of uninitialized value $acpi_testexpected in string eq at 
./scripts/checkpatch.pl line 1529.
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#37: 
new file mode 100644

total: 0 errors, 1 warnings, 70 lines checked

Patch 3/30 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
4/30 Checking commit b09a6e5f3ab3 (target/mips: Make CPU/FPU regnames[] arrays 
global)
5/30 Checking commit fbb76626dda5 (target/mips: Optimize CPU/FPU regnames[] 
arrays)
6/30 Checking commit 46c20103b401 (target/mips: Restrict mips_cpu_dump_state() 
to cpu.c)
7/30 Checking commit 32b579ebe323 (target/mips: Turn printfpr() macro into a 
proper function)
8/30 Checking commit 87fde0b3548f (target/mips: Declare mips_cpu_set_error_pc() 
inlined in "internal.h")
9/30 Checking commit 2c88480fd743 (target/mips: Merge do_translate_address into 
cpu_mips_translate_address)
10/30 Checking commit c5e43b4cb247 (target/mips: Extract load/store helpers to 
ldst_helper.c)
Use of uninitialized value $acpi_testexpected in string eq at 
./scripts/checkpatch.pl line 1529.
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#18: 
new file mode 100644

total: 0 errors, 1 warnings, 560 lines checked

Patch 10/30 has style problems, please review.  If any of 

Re: [PATCH v3] memory: Directly dispatch alias accesses on origin memory region

2021-04-19 Thread Mark Cave-Ayland

On 17/04/2021 15:02, Philippe Mathieu-Daudé wrote:


Since commit 2cdfcf272d ("memory: assign MemoryRegionOps to all
regions"), all newly created regions are assigned with
unassigned_mem_ops (which might be then overwritten).

When using aliased container regions, and there is no region mapped
at address 0 in the container, the memory_region_dispatch_read()
and memory_region_dispatch_write() calls incorrectly return the
container unassigned_mem_ops, because the alias offset is not used.

The memory_region_init_alias() flow is:

   memory_region_init_alias()
   -> memory_region_init()
  -> object_initialize(TYPE_MEMORY_REGION)
 -> memory_region_initfn()
-> mr->ops = _mem_ops;

Later when accessing the alias, the memory_region_dispatch_read()
flow is:

   memory_region_dispatch_read(offset)
   -> memory_region_access_valid(mr)   <- offset is ignored
  -> mr->ops->valid.accepts()
 -> unassigned_mem_accepts()
 <- false
  <- false
<- MEMTX_DECODE_ERROR

The caller gets a MEMTX_DECODE_ERROR while the access is OK.

Fix by dispatching aliases recusirvely, accessing its origin region
after adding the alias offset.

Signed-off-by: Philippe Mathieu-Daudé 
---
v3:
- reworded, mentioning the "alias to container" case
- use recursive call instead of while(), because easier when debugging
   therefore reset Richard R-b tag.
v2:
- use while()
---
  softmmu/memory.c | 10 ++
  1 file changed, 10 insertions(+)

diff --git a/softmmu/memory.c b/softmmu/memory.c
index d4493ef9e43..23bdbfac079 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -1442,6 +1442,11 @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
  unsigned size = memop_size(op);
  MemTxResult r;
  
+if (mr->alias) {

+return memory_region_dispatch_read(mr->alias,
+   addr + mr->alias_offset,
+   pval, op, attrs);
+}
  if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
  *pval = unassigned_mem_read(mr, addr, size);
  return MEMTX_DECODE_ERROR;
@@ -1486,6 +1491,11 @@ MemTxResult memory_region_dispatch_write(MemoryRegion 
*mr,
  {
  unsigned size = memop_size(op);
  
+if (mr->alias) {

+return memory_region_dispatch_write(mr->alias,
+addr + mr->alias_offset,
+data, op, attrs);
+}
  if (!memory_region_access_valid(mr, addr, size, true, attrs)) {
  unassigned_mem_write(mr, addr, data, size);
  return MEMTX_DECODE_ERROR;


Whilst working on my q800 patches I realised that this was a similar problem to the 
one I had with my macio.alias implementation at [1]: except that in my case the 
unassigned_mem_ops mr->ops->valid.accepts() function was being invoked on a ROM 
memory region instead of an alias. I think this is exactly the same issue that you 
are attempting to fix with your related patch at 
https://lists.gnu.org/archive/html/qemu-devel/2021-04/msg03190.html ("memory: 
Initialize MemoryRegionOps for RAM memory regions").


I eventually realised that I needed functions that could dispatch reads/writes to 
both IO memory regions and ROM memory regions, and that functionality is covered by 
the address_space_*() access functions. Using the address_space_*() functions I was 
then able to come up with the working implementation at [2] that handles accesses to 
both IO memory regions and ROM memory regions correctly.


The reason I initially used the 
memory_region_dispatch_read()/memory_region_dispatch_write() functions was because I 
could see that was how the virtio devices dispatched accesses through the proxy. 
However I'm wondering now if this API can only be used for terminating IO memory 
regions, and so the alias_offset that you're applying above should actually be 
applied elsewhere instead.



ATB,

Mark.

[1] 
https://github.com/mcayland/qemu/commit/56f8639fbecb8a8e323ce486e20cbe309e807419

[2] 
https://github.com/mcayland/qemu/commit/c1fa32da188bb2ce23faf1728228c1714672270d



[PATCH 12/14] hw/block/nvme: remove irrelevant zone resource checks

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

It is not an error to report more active/open zones supported than the
number of zones in the namespace.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme-ns.c | 13 -
 1 file changed, 13 deletions(-)

diff --git a/hw/block/nvme-ns.c b/hw/block/nvme-ns.c
index 84f602652354..2041d8138420 100644
--- a/hw/block/nvme-ns.c
+++ b/hw/block/nvme-ns.c
@@ -210,19 +210,6 @@ static int nvme_ns_zoned_check_calc_geometry(NvmeNamespace 
*ns, Error **errp)
 return -1;
 }
 
-if (ns->params.max_open_zones > ns->num_zones) {
-error_setg(errp,
-   "max_open_zones value %u exceeds the number of zones %u",
-   ns->params.max_open_zones, ns->num_zones);
-return -1;
-}
-if (ns->params.max_active_zones > ns->num_zones) {
-error_setg(errp,
-   "max_active_zones value %u exceeds the number of zones %u",
-   ns->params.max_active_zones, ns->num_zones);
-return -1;
-}
-
 if (ns->params.max_active_zones) {
 if (ns->params.max_open_zones > ns->params.max_active_zones) {
 error_setg(errp, "max_open_zones (%u) exceeds max_active_zones 
(%u)",
-- 
2.31.1




[PATCH 03/14] hw/block/nvme: rename __nvme_select_ns_iocs

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

Get rid of the (reserved) double underscore use.

Cc: Philippe Mathieu-Daudé 
Cc: Thomas Huth 
Signed-off-by: Klaus Jensen 
---
 hw/block/nvme.c | 47 +++
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index d1b94e36c6fb..f8209a92302b 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -4916,7 +4916,25 @@ static void nvme_update_dmrsl(NvmeCtrl *n)
 }
 }
 
-static void __nvme_select_ns_iocs(NvmeCtrl *n, NvmeNamespace *ns);
+static void nvme_select_iocs_ns(NvmeCtrl *n, NvmeNamespace *ns)
+{
+ns->iocs = nvme_cse_iocs_none;
+switch (ns->csi) {
+case NVME_CSI_NVM:
+if (NVME_CC_CSS(n->bar.cc) != NVME_CC_CSS_ADMIN_ONLY) {
+ns->iocs = nvme_cse_iocs_nvm;
+}
+break;
+case NVME_CSI_ZONED:
+if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_CSI) {
+ns->iocs = nvme_cse_iocs_zoned;
+} else if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_NVM) {
+ns->iocs = nvme_cse_iocs_nvm;
+}
+break;
+}
+}
+
 static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
 {
 NvmeNamespace *ns;
@@ -4967,7 +4985,7 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, 
NvmeRequest *req)
 }
 
 nvme_attach_ns(ctrl, ns);
-__nvme_select_ns_iocs(ctrl, ns);
+nvme_select_iocs_ns(ctrl, ns);
 } else {
 if (!nvme_ns(ctrl, nsid)) {
 return NVME_NS_NOT_ATTACHED | NVME_DNR;
@@ -5268,26 +5286,7 @@ static void nvme_ctrl_shutdown(NvmeCtrl *n)
 }
 }
 
-static void __nvme_select_ns_iocs(NvmeCtrl *n, NvmeNamespace *ns)
-{
-ns->iocs = nvme_cse_iocs_none;
-switch (ns->csi) {
-case NVME_CSI_NVM:
-if (NVME_CC_CSS(n->bar.cc) != NVME_CC_CSS_ADMIN_ONLY) {
-ns->iocs = nvme_cse_iocs_nvm;
-}
-break;
-case NVME_CSI_ZONED:
-if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_CSI) {
-ns->iocs = nvme_cse_iocs_zoned;
-} else if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_NVM) {
-ns->iocs = nvme_cse_iocs_nvm;
-}
-break;
-}
-}
-
-static void nvme_select_ns_iocs(NvmeCtrl *n)
+static void nvme_select_iocs(NvmeCtrl *n)
 {
 NvmeNamespace *ns;
 int i;
@@ -5298,7 +5297,7 @@ static void nvme_select_ns_iocs(NvmeCtrl *n)
 continue;
 }
 
-__nvme_select_ns_iocs(n, ns);
+nvme_select_iocs_ns(n, ns);
 }
 }
 
@@ -5400,7 +5399,7 @@ static int nvme_start_ctrl(NvmeCtrl *n)
 
 QTAILQ_INIT(>aer_queue);
 
-nvme_select_ns_iocs(n);
+nvme_select_iocs(n);
 
 return 0;
 }
-- 
2.31.1




[PATCH 08/14] hw/block/nvme: cache lba and ms sizes

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

There is no need to look up the lba size and metadata size in the LBA
Format structure everytime we want to use it. And we use it a lot.

Cache the values in the NvmeNamespace and update them if the namespace
is formatted.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme.h | 37 ---
 hw/block/nvme-dif.c | 45 ++-
 hw/block/nvme-ns.c  | 26 +
 hw/block/nvme.c | 47 ++---
 4 files changed, 56 insertions(+), 99 deletions(-)

diff --git a/hw/block/nvme.h b/hw/block/nvme.h
index d9bee7e5a05c..dc065e57b509 100644
--- a/hw/block/nvme.h
+++ b/hw/block/nvme.h
@@ -109,6 +109,8 @@ typedef struct NvmeNamespace {
 int64_t  size;
 int64_t  mdata_offset;
 NvmeIdNs id_ns;
+NvmeLBAF lbaf;
+size_t   lbasz;
 const uint32_t *iocs;
 uint8_t  csi;
 uint16_t status;
@@ -146,36 +148,14 @@ static inline uint32_t nvme_nsid(NvmeNamespace *ns)
 return 0;
 }
 
-static inline NvmeLBAF *nvme_ns_lbaf(NvmeNamespace *ns)
-{
-NvmeIdNs *id_ns = >id_ns;
-return _ns->lbaf[NVME_ID_NS_FLBAS_INDEX(id_ns->flbas)];
-}
-
-static inline uint8_t nvme_ns_lbads(NvmeNamespace *ns)
-{
-return nvme_ns_lbaf(ns)->ds;
-}
-
-/* convert an LBA to the equivalent in bytes */
 static inline size_t nvme_l2b(NvmeNamespace *ns, uint64_t lba)
 {
-return lba << nvme_ns_lbads(ns);
-}
-
-static inline size_t nvme_lsize(NvmeNamespace *ns)
-{
-return 1 << nvme_ns_lbads(ns);
-}
-
-static inline uint16_t nvme_msize(NvmeNamespace *ns)
-{
-return nvme_ns_lbaf(ns)->ms;
+return lba << ns->lbaf.ds;
 }
 
 static inline size_t nvme_m2b(NvmeNamespace *ns, uint64_t lba)
 {
-return nvme_msize(ns) * lba;
+return ns->lbaf.ms * lba;
 }
 
 static inline bool nvme_ns_ext(NvmeNamespace *ns)
@@ -183,15 +163,6 @@ static inline bool nvme_ns_ext(NvmeNamespace *ns)
 return !!NVME_ID_NS_FLBAS_EXTENDED(ns->id_ns.flbas);
 }
 
-/* calculate the number of LBAs that the namespace can accomodate */
-static inline uint64_t nvme_ns_nlbas(NvmeNamespace *ns)
-{
-if (nvme_msize(ns)) {
-return ns->size / (nvme_lsize(ns) + nvme_msize(ns));
-}
-return ns->size >> nvme_ns_lbads(ns);
-}
-
 static inline NvmeZoneState nvme_get_zone_state(NvmeZone *zone)
 {
 return zone->d.zs >> 4;
diff --git a/hw/block/nvme-dif.c b/hw/block/nvme-dif.c
index e269d275ebed..c72e43195abf 100644
--- a/hw/block/nvme-dif.c
+++ b/hw/block/nvme-dif.c
@@ -44,20 +44,18 @@ void nvme_dif_pract_generate_dif(NvmeNamespace *ns, uint8_t 
*buf, size_t len,
  uint32_t reftag)
 {
 uint8_t *end = buf + len;
-size_t lsize = nvme_lsize(ns);
-size_t msize = nvme_msize(ns);
 int16_t pil = 0;
 
 if (!(ns->id_ns.dps & NVME_ID_NS_DPS_FIRST_EIGHT)) {
-pil = nvme_msize(ns) - sizeof(NvmeDifTuple);
+pil = ns->lbaf.ms - sizeof(NvmeDifTuple);
 }
 
-trace_pci_nvme_dif_pract_generate_dif(len, lsize, lsize + pil, apptag,
-  reftag);
+trace_pci_nvme_dif_pract_generate_dif(len, ns->lbasz, ns->lbasz + pil,
+  apptag, reftag);
 
-for (; buf < end; buf += lsize, mbuf += msize) {
+for (; buf < end; buf += ns->lbasz, mbuf += ns->lbaf.ms) {
 NvmeDifTuple *dif = (NvmeDifTuple *)(mbuf + pil);
-uint16_t crc = crc_t10dif(0x0, buf, lsize);
+uint16_t crc = crc_t10dif(0x0, buf, ns->lbasz);
 
 if (pil) {
 crc = crc_t10dif(crc, mbuf, pil);
@@ -98,7 +96,7 @@ static uint16_t nvme_dif_prchk(NvmeNamespace *ns, 
NvmeDifTuple *dif,
 }
 
 if (ctrl & NVME_RW_PRINFO_PRCHK_GUARD) {
-uint16_t crc = crc_t10dif(0x0, buf, nvme_lsize(ns));
+uint16_t crc = crc_t10dif(0x0, buf, ns->lbasz);
 
 if (pil) {
 crc = crc_t10dif(crc, mbuf, pil);
@@ -137,8 +135,6 @@ uint16_t nvme_dif_check(NvmeNamespace *ns, uint8_t *buf, 
size_t len,
 uint16_t appmask, uint32_t reftag)
 {
 uint8_t *end = buf + len;
-size_t lsize = nvme_lsize(ns);
-size_t msize = nvme_msize(ns);
 int16_t pil = 0;
 uint16_t status;
 
@@ -148,12 +144,12 @@ uint16_t nvme_dif_check(NvmeNamespace *ns, uint8_t *buf, 
size_t len,
 }
 
 if (!(ns->id_ns.dps & NVME_ID_NS_DPS_FIRST_EIGHT)) {
-pil = nvme_msize(ns) - sizeof(NvmeDifTuple);
+pil = ns->lbaf.ms - sizeof(NvmeDifTuple);
 }
 
-trace_pci_nvme_dif_check(NVME_RW_PRINFO(ctrl), lsize + pil);
+trace_pci_nvme_dif_check(NVME_RW_PRINFO(ctrl), ns->lbasz + pil);
 
-for (; buf < end; buf += lsize, mbuf += msize) {
+for (; buf < end; buf += ns->lbasz, mbuf += ns->lbaf.ms) {
 NvmeDifTuple *dif = (NvmeDifTuple *)(mbuf + pil);
 
 status = nvme_dif_prchk(ns, dif, buf, mbuf, pil, ctrl, apptag,
@@ -176,20 +172,18 @@ uint16_t nvme_dif_mangle_mdata(NvmeNamespace *ns, uint8_t 

Re: [PATCH v7 0/4] Add support for FEAT_TLBIOS and FEAT_TLBIRANGE

2021-04-19 Thread Rebecca Cran

Hi Richard,


Could you review this patch series again please?

I've fixed several issues recently, and am interested to know if it's 
ready to commit or would need further changes.



--

Rebecca Cran


On 4/14/2021 2:32 PM, Rebecca Cran wrote:

ARMv8.4 adds the mandatory FEAT_TLBIOS and FEAT_TLBIRANGE.
They provides TLBI maintenance instructions that extend to the Outer
Shareable domain and that apply to a range of input addresses.

Changes from v6 to v7:

o Fixed the tlbi_aa64_rvae1_write the tlbi_aa64_rvae1is_write functions
   to pass the correct value into functions which use an ARMMMUIdx.

o Fixed comments in helper.c which referred to non-existent instructions.

Testing:

o Booted Linux 5.11 - verified the previous assert failure in qemu is
   resolved.
o Ran checkpatch.pl.

Rebecca Cran (4):
   accel/tcg: Add TLB invalidation support for ranges of addresses
   target/arm: Add support for FEAT_TLBIRANGE
   target/arm: Add support for FEAT_TLBIOS
   target/arm: set ID_AA64ISAR0.TLB to 2 for max AARCH64 CPU type

  accel/tcg/cputlb.c  | 130 ++-
  include/exec/exec-all.h |  46 +++
  target/arm/cpu.h|  10 +
  target/arm/cpu64.c  |   1 +
  target/arm/helper.c | 371 
  5 files changed, 555 insertions(+), 3 deletions(-)






[PATCH 07/14] hw/block/nvme: replace nvme_ns_status

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

The inline nvme_ns_status() helper only has a single call site. Remove
it from the header file and inline it for real.

Signed-off-by: Klaus Jensen 
---
 hw/block/nvme.h |  5 -
 hw/block/nvme.c | 15 ---
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/hw/block/nvme.h b/hw/block/nvme.h
index 2c4e7b90fa54..d9bee7e5a05c 100644
--- a/hw/block/nvme.h
+++ b/hw/block/nvme.h
@@ -137,11 +137,6 @@ typedef struct NvmeNamespace {
 } features;
 } NvmeNamespace;
 
-static inline uint16_t nvme_ns_status(NvmeNamespace *ns)
-{
-return ns->status;
-}
-
 static inline uint32_t nvme_nsid(NvmeNamespace *ns)
 {
 if (ns) {
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 2c0af579e7a8..bcef6038ae09 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -3594,8 +3594,8 @@ static uint16_t nvme_zone_mgmt_recv(NvmeCtrl *n, 
NvmeRequest *req)
 
 static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req)
 {
+NvmeNamespace *ns;
 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
-uint16_t status;
 
 trace_pci_nvme_io_cmd(nvme_cid(req), nsid, nvme_sqid(req),
   req->cmd.opcode, nvme_io_opc_str(req->cmd.opcode));
@@ -3627,21 +3627,22 @@ static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest 
*req)
 return nvme_flush(n, req);
 }
 
-req->ns = nvme_ns(n, nsid);
-if (unlikely(!req->ns)) {
+ns = nvme_ns(n, nsid);
+if (unlikely(!ns)) {
 return NVME_INVALID_FIELD | NVME_DNR;
 }
 
-if (!(req->ns->iocs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
+if (!(ns->iocs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
 trace_pci_nvme_err_invalid_opc(req->cmd.opcode);
 return NVME_INVALID_OPCODE | NVME_DNR;
 }
 
-status = nvme_ns_status(req->ns);
-if (unlikely(status)) {
-return status;
+if (ns->status) {
+return ns->status;
 }
 
+req->ns = ns;
+
 switch (req->cmd.opcode) {
 case NVME_CMD_WRITE_ZEROES:
 return nvme_write_zeroes(n, req);
-- 
2.31.1




Re: [RFC PATCH-for-6.1 0/9] hw/clock: Strengthen machine (non-qdev) clock propagation

2021-04-19 Thread Luc Michel
On 15:53 Sat 10 Apr , Philippe Mathieu-Daudé wrote:
> Hi Luc,
> 
> On 4/10/21 3:19 PM, Luc Michel wrote:
> > On 08:23 Fri 09 Apr , Philippe Mathieu-Daudé wrote:
> >> I've been debugging some odd issue with the clocks:
> >> a clock created in the machine (IOW, not a qdev clock) isn't
> >> always resetted, thus propagating its value.
> >> "not always" is the odd part. In the MPS2 board, the machine
> >> clock is propagated. Apparently because the peripherals are
> >> created directly in the machine_init() handler. When moving
> >> them out in a SoC QOM container, the clock isn't... I'm still
> >> having hard time to understand what is going on.
> > 
> > I think there is a misunderstanding on how the clock API works. If I
> > understand correctly your issue, you expect the callback of an input
> > clock connected to your constant "main oscillator" clock to be called on
> > machine reset.
> > 
> > If I'm not mistaken this is not the way the API has been designed. The
> > callback is called only when the clock period changes. A constant clock
> > does not change on reset, so the callback of child clocks should not be
> > called.
> 
> They why the children of a clock tree fed with constant clock stay with
> a clock of 0? Who is responsible of setting their clock to the constant
> value?

I think we expect the child to be set when we call clock_set_source. In
this function the child period is set to the parent one. Maybe you have
a case where clock_set_source is called before clock_set on the parent?

-- 
Luc



[PATCH 02/14] hw/block/nvme: rename __nvme_advance_zone_wp

2021-04-19 Thread Klaus Jensen
From: Klaus Jensen 

Get rid of the (reserved) double underscore use.

Cc: Philippe Mathieu-Daudé 
Cc: Thomas Huth 
Signed-off-by: Klaus Jensen 
---
 hw/block/nvme.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 002c0672b397..d1b94e36c6fb 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -1745,8 +1745,8 @@ static inline uint16_t nvme_zrm_open(NvmeNamespace *ns, 
NvmeZone *zone)
 return nvme_zrm_open_flags(ns, zone, 0);
 }
 
-static void __nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone,
-   uint32_t nlb)
+static void nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone,
+ uint32_t nlb)
 {
 zone->d.wp += nlb;
 
@@ -1766,7 +1766,7 @@ static void nvme_finalize_zoned_write(NvmeNamespace *ns, 
NvmeRequest *req)
 nlb = le16_to_cpu(rw->nlb) + 1;
 zone = nvme_get_zone_by_slba(ns, slba);
 
-__nvme_advance_zone_wp(ns, zone, nlb);
+nvme_advance_zone_wp(ns, zone, nlb);
 }
 
 static inline bool nvme_is_write(NvmeRequest *req)
@@ -2155,7 +2155,7 @@ out:
 uint64_t sdlba = le64_to_cpu(copy->sdlba);
 NvmeZone *zone = nvme_get_zone_by_slba(ns, sdlba);
 
-__nvme_advance_zone_wp(ns, zone, ctx->nlb);
+nvme_advance_zone_wp(ns, zone, ctx->nlb);
 }
 
 g_free(ctx->bounce);
-- 
2.31.1




Re: any remaining for-6.0 issues?

2021-04-19 Thread Mark Cave-Ayland

On 19/04/2021 18:02, Cornelia Huck wrote:


That patch seems to be our best candidate so far, but the intermittent
nature of the failures make it hard to pin down... I don't see anything
obviously wrong with the patch, maybe some linux-user experts have a
better idea?


FWIW, I tried reproducing the issue on some local systems (no luck),
and on code pushed out to gitlab (where it works most of the time, and
the user builds where it fails are unpredictable.)

I fear the best we can do right now is stare at the code and try to
figure out what might be wrong :(


Is there any particular reason why the unsigned long cast was removed from the front? 
Could that have an effect?



ATB,

Mark.



Re: [PATCH v3 08/30] target/mips: Declare mips_cpu_set_error_pc() inlined in "internal.h"

2021-04-19 Thread Richard Henderson

On 4/19/21 12:18 PM, Philippe Mathieu-Daudé wrote:

Rename set_pc() as mips_cpu_set_error_pc(), declare it inlined
and use it in cpu.c and op_helper.c.


Why "error_pc"?  The usage in mips_cpu_set_pc certainly isn't in response to 
any kind of error...



r~



Re: [PATCH v3 19/30] target/mips: Move sysemu TCG-specific code to tcg/sysemu/ subfolder

2021-04-19 Thread Richard Henderson

On 4/19/21 12:18 PM, Philippe Mathieu-Daudé wrote:

Move cp0_helper.c and mips-semi.c to the new tcg/sysemu/ folder,
adapting the Meson machinery.

Move the opcode definitions to tcg/sysemu_helper.h.inc.

Signed-off-by: Philippe Mathieu-Daudé
---
  target/mips/helper.h  | 166 +
  target/mips/tcg/sysemu_helper.h.inc   | 168 ++
  target/mips/{ => tcg/sysemu}/cp0_helper.c |   0
  target/mips/{ => tcg/sysemu}/mips-semi.c  |   0
  target/mips/meson.build   |   5 -
  target/mips/tcg/meson.build   |   3 +
  target/mips/tcg/sysemu/meson.build|   4 +
  7 files changed, 179 insertions(+), 167 deletions(-)
  create mode 100644 target/mips/tcg/sysemu_helper.h.inc
  rename target/mips/{ => tcg/sysemu}/cp0_helper.c (100%)
  rename target/mips/{ => tcg/sysemu}/mips-semi.c (100%)
  create mode 100644 target/mips/tcg/sysemu/meson.build


Reviewed-by: Richard Henderson 

r~




  1   2   3   4   >