[PULL 06/46] target/ppc: Retain hflags_nmsr only for migration

[David Gibson]

From: Richard Henderson 

We have eliminated all normal uses of hflags_nmsr.  We need
not even compute it except when we want to migrate.  Rename
the field to emphasize this.

Remove the fixme comment for migrating access_type.  This value
is only ever used with the current executing instruction, and
is never live when the cpu is halted for migration.

Signed-off-by: Richard Henderson 
Message-Id: <20210315184615.1985590-6-richard.hender...@linaro.org>
Reviewed-by: Cédric Le Goater 
Signed-off-by: David Gibson 
---
 target/ppc/cpu.h | 4 ++--
 target/ppc/helper_regs.c | 2 --
 target/ppc/machine.c | 9 ++---
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 061d2eed1b..79c4033a42 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1105,8 +1105,8 @@ struct CPUPPCState {
 #endif
 
 /* These resources are used only in QEMU core */
-target_ulong hflags;  /* hflags is MSR & HFLAGS_MASK */
-target_ulong hflags_nmsr; /* specific hflags, not coming from MSR */
+target_ulong hflags;
+target_ulong hflags_compat_nmsr; /* for migration compatibility */
 int immu_idx; /* precomputed MMU index to speed up insn accesses */
 int dmmu_idx; /* precomputed MMU index to speed up data accesses */
 
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index 95b9aca61f..a87e354ca2 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -104,8 +104,6 @@ void hreg_compute_hflags(CPUPPCState *env)
  */
 uint32_t le = extract32(env->spr[SPR_HID0], 3, 1);
 env->hflags |= le << MSR_LE;
-/* Retain for backward compatibility with migration. */
-env->hflags_nmsr = le << MSR_LE;
 }
 }
 
diff --git a/target/ppc/machine.c b/target/ppc/machine.c
index f6eeda9642..1f7a353c78 100644
--- a/target/ppc/machine.c
+++ b/target/ppc/machine.c
@@ -310,6 +310,10 @@ static int cpu_pre_save(void *opaque)
 }
 }
 
+/* Retain migration compatibility for pre 6.0 for 601 machines. */
+env->hflags_compat_nmsr = (env->flags & POWERPC_FLAG_HID0_LE
+   ? env->hflags & MSR_LE : 0);
+
 return 0;
 }
 
@@ -829,9 +833,8 @@ const VMStateDescription vmstate_ppc_cpu = {
 /* Supervisor mode architected state */
 VMSTATE_UINTTL(env.msr, PowerPCCPU),
 
-/* Internal state */
-VMSTATE_UINTTL(env.hflags_nmsr, PowerPCCPU),
-/* FIXME: access_type? */
+/* Backward compatible internal state */
+VMSTATE_UINTTL(env.hflags_compat_nmsr, PowerPCCPU),
 
 /* Sanity checking */
 VMSTATE_UINTTL_TEST(mig_msr_mask, PowerPCCPU, cpu_pre_2_8_migration),
-- 
2.31.1

[PULL 08/46] hw/ppc/pnv_core: Update hflags after setting msr

[David Gibson]

From: Richard Henderson 

Signed-off-by: Richard Henderson 
Message-Id: <20210315184615.1985590-15-richard.hender...@linaro.org>
Signed-off-by: David Gibson 
---
 hw/ppc/pnv_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index bd2bf2e044..8c2a15a0fb 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -29,6 +29,7 @@
 #include "hw/ppc/pnv_xscom.h"
 #include "hw/ppc/xics.h"
 #include "hw/qdev-properties.h"
+#include "helper_regs.h"
 
 static const char *pnv_core_cpu_typename(PnvCore *pc)
 {
@@ -55,8 +56,8 @@ static void pnv_core_cpu_reset(PnvCore *pc, PowerPCCPU *cpu)
 env->gpr[3] = PNV_FDT_ADDR;
 env->nip = 0x10;
 env->msr |= MSR_HVB; /* Hypervisor mode */
-
 env->spr[SPR_HRMOR] = pc->hrmor;
+hreg_compute_hflags(env);
 
 pcc->intc_reset(pc->chip, cpu);
 }
-- 
2.31.1

[PULL 00/46] ppc-for-6.1 queue 20210504

[David Gibson]

The following changes since commit 15106f7dc3290ff3254611f265849a314a93eb0e:

  Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-hex-20210502' into 
staging (2021-05-02 16:23:05 +0100)

are available in the Git repository at:

  https://gitlab.com/dgibson/qemu.git tags/ppc-for-6.1-20210504

for you to fetch changes up to 4bb32cd7b1e42c46d274b727c8be8e45b4df3814:

  hw/ppc/pnv_psi: Use device_cold_reset() instead of device_legacy_reset() 
(2021-05-04 13:12:59 +1000)


ppc patch queue 2021-05-04

Here's the first ppc pull request for qemu-6.1.  It has a wide variety
of stuff accumulated during the 6.0 freeze.  Highlights are:

 * Multi-phase reset cleanups for PAPR
 * Preliminary cleanups towards allowing !CONFIG_TCG for the ppc target
 * Cleanup of AIL logic and extension to POWER10
 * Further improvements to handling of hot unplug failures on PAPR
 * Allow much larger numbers of CPU on pseries
 * Support for the H_SCM_HEALTH hypercall
 * Add support for the Pegasos II board
 * Substantial cleanup to hflag handling
 * Assorted minor fixes and cleanups


Alexey Kardashevskiy (1):
  spapr: Rename RTAS_MAX_ADDR to FDT_MAX_ADDR

BALATON Zoltan (6):
  vt82c686: QOM-ify superio related functionality
  vt82c686: Add VT8231_SUPERIO based on VIA_SUPERIO
  vt82c686: Introduce abstract TYPE_VIA_ISA and base vt82c686b_isa on it
  vt82c686: Add emulation of VT8231 south bridge
  hw/pci-host: Add emulation of Marvell MV64361 PPC system controller
  hw/ppc: Add emulation of Genesi/bPlan Pegasos II

Bin Meng (3):
  roms/Makefile: Update ppce500 u-boot build directory name
  roms/u-boot: Bump ppce500 u-boot to v2021.04 to fix broken pci support
  docs/system: ppc: Add documentation for ppce500 machine

Bruno Larsen (billionai) (3):
  target/ppc: code motion from translate_init.c.inc to gdbstub.c
  target/ppc: move opcode table logic to translate.c
  target/ppc: removed VSCR from SPR registration

Daniel Henrique Barboza (3):
  spapr.c: do not use MachineClass::max_cpus to limit CPUs
  spapr.h: increase FDT_MAX_SIZE
  spapr_drc.c: handle hotunplug errors in drc_unisolate_logical()

Nicholas Piggin (4):
  target/ppc: Fix POWER9 radix guest HV interrupt AIL behaviour
  target/ppc: POWER10 supports scv
  target/ppc: rework AIL logic in interrupt delivery
  target/ppc: Add POWER10 exception model

Peter Maydell (3):
  hw/intc/spapr_xive: Use device_cold_reset() instead of 
device_legacy_reset()
  hw/ppc/spapr_vio: Reset TCE table object with device_cold_reset()
  hw/ppc/pnv_psi: Use device_cold_reset() instead of device_legacy_reset()

Philippe Mathieu-Daudé (1):
  hw/ppc/mac_newworld: Restrict RAM to 2 GiB

Ravi Bangoria (1):
  ppc: Rename current DAWR macros and variables

Richard Henderson (20):
  target/ppc: Move helper_regs.h functions out-of-line
  target/ppc: Move 601 hflags adjustment to hreg_compute_hflags
  target/ppc: Properly sync cpu state with new msr in cpu_load_old
  target/ppc: Do not call hreg_compute_mem_idx after ppc_store_msr
  target/ppc: Retain hflags_nmsr only for migration
  target/ppc: Fix comment for MSR_FE{0,1}
  hw/ppc/pnv_core: Update hflags after setting msr
  hw/ppc/spapr_rtas: Update hflags after setting msr
  target/ppc: Extract post_load_update_msr
  target/ppc: Disconnect hflags from MSR
  target/ppc: Reduce env->hflags to uint32_t
  target/ppc: Put dbcr0 single-step bits into hflags
  target/ppc: Create helper_scv
  target/ppc: Put LPCR[GTSE] in hflags
  target/ppc: Remove MSR_SA and MSR_AP from hflags
  target/ppc: Remove env->immu_idx and env->dmmu_idx
  linux-user/ppc: Fix msr updates for signal handling
  target/ppc: Validate hflags with CONFIG_DEBUG_TCG
  target/ppc: Clean up _spr_register et al
  target/ppc: Reduce the size of ppc_spr_t

Vaibhav Jain (1):
  ppc/spapr: Add support for implement support for H_SCM_HEALTH

 MAINTAINERS |  10 +
 default-configs/devices/ppc-softmmu.mak |   2 +
 docs/system/ppc/ppce500.rst | 156 ++
 docs/system/target-ppc.rst  |   1 +
 hw/intc/spapr_xive.c|   2 +-
 hw/isa/vt82c686.c   | 422 +++---
 hw/pci-host/Kconfig |   4 +
 hw/pci-host/meson.build |   2 +
 hw/pci-host/mv64361.c   | 951 
 hw/pci-host/mv643xx.h   | 918 ++
 hw/pci-host/trace-events|   6 +
 hw/ppc/Kconfig  |   9 +
 hw/ppc/mac_newworld.c   |   4 +
 hw/ppc/meson.build  |   2 +
 hw/ppc/pegasos2.c   | 144 +
 hw/ppc/pnv_core.c   |   3 +-

[PULL 07/46] target/ppc: Fix comment for MSR_FE{0,1}

[David Gibson]

From: Richard Henderson 

As per hreg_compute_hflags:

  We 'forget' FE0 & FE1: we'll never generate imprecise exceptions

remove the hflags marker from the respective comments.

Signed-off-by: Richard Henderson 
Message-Id: <20210315184615.1985590-7-richard.hender...@linaro.org>
Reviewed-by: Cédric Le Goater 
Signed-off-by: David Gibson 
---
 target/ppc/cpu.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 79c4033a42..fd13489dce 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -322,13 +322,13 @@ typedef struct ppc_v3_pate_t {
 #define MSR_PR   14 /* Problem state  hflags */
 #define MSR_FP   13 /* Floating point available   hflags */
 #define MSR_ME   12 /* Machine check interrupt enable*/
-#define MSR_FE0  11 /* Floating point exception mode 0hflags */
+#define MSR_FE0  11 /* Floating point exception mode 0   */
 #define MSR_SE   10 /* Single-step trace enable x hflags */
 #define MSR_DWE  10 /* Debug wait enable on 405 x*/
 #define MSR_UBLE 10 /* User BTB lock enable on e500 x*/
 #define MSR_BE   9  /* Branch trace enable  x hflags */
 #define MSR_DE   9  /* Debug interrupts enable on embedded PowerPC  x*/
-#define MSR_FE1  8  /* Floating point exception mode 1hflags */
+#define MSR_FE1  8  /* Floating point exception mode 1   */
 #define MSR_AL   7  /* AL bit on POWER   */
 #define MSR_EP   6  /* Exception prefix on 601   */
 #define MSR_IR   5  /* Instruction relocate  */
-- 
2.31.1

[PULL 04/46] target/ppc: Properly sync cpu state with new msr in cpu_load_old

[David Gibson]

From: Richard Henderson 

Match cpu_post_load in using ppc_store_msr to set all of
the cpu state implied by the value of msr.  Do not restore
hflags or hflags_nmsr, as we recompute them in ppc_store_msr.

Signed-off-by: Richard Henderson 
Message-Id: <20210315184615.1985590-4-richard.hender...@linaro.org>
Reviewed-by: Cédric Le Goater 
Signed-off-by: David Gibson 
---
 target/ppc/machine.c | 13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/ppc/machine.c b/target/ppc/machine.c
index 283db1d28a..87d7bffb86 100644
--- a/target/ppc/machine.c
+++ b/target/ppc/machine.c
@@ -21,6 +21,7 @@ static int cpu_load_old(QEMUFile *f, void *opaque, int 
version_id)
 int32_t slb_nr;
 #endif
 target_ulong xer;
+target_ulong msr;
 
 for (i = 0; i < 32; i++) {
 qemu_get_betls(f, >gpr[i]);
@@ -111,11 +112,19 @@ static int cpu_load_old(QEMUFile *f, void *opaque, int 
version_id)
 qemu_get_betls(f, >ivpr_mask);
 qemu_get_betls(f, >hreset_vector);
 qemu_get_betls(f, >nip);
-qemu_get_betls(f, >hflags);
-qemu_get_betls(f, >hflags_nmsr);
+qemu_get_sbetl(f); /* Discard unused hflags */
+qemu_get_sbetl(f); /* Discard unused hflags_nmsr */
 qemu_get_sbe32(f); /* Discard unused mmu_idx */
 qemu_get_sbe32(f); /* Discard unused power_mode */
 
+/*
+ * Invalidate all supported msr bits except MSR_TGPR/MSR_HVB
+ * before restoring.  Note that this recomputes hflags and mem_idx.
+ */
+msr = env->msr;
+env->msr ^= env->msr_mask & ~((1ULL << MSR_TGPR) | MSR_HVB);
+ppc_store_msr(env, msr);
+
 /* Recompute mmu indices */
 hreg_compute_mem_idx(env);
 
-- 
2.31.1

[PULL 03/46] target/ppc: Move 601 hflags adjustment to hreg_compute_hflags

[David Gibson]

From: Richard Henderson 

Keep all hflags computation in one place, as this will be
especially important later.

Introduce a new POWERPC_FLAG_HID0_LE bit to indicate when
LE should be taken from HID0.  This appears to be set if
and only if POWERPC_FLAG_RTC_CLK is set, but we're not
short of bits and having both names will avoid confusion.

Note that this was the only user of hflags_nmsr, so we can
perform a straight assignment rather than mask and set.

Signed-off-by: Richard Henderson 
Message-Id: <20210315184615.1985590-3-richard.hender...@linaro.org>
Reviewed-by: Cédric Le Goater 
Signed-off-by: David Gibson 
---
 target/ppc/cpu.h|  2 ++
 target/ppc/helper_regs.c| 13 +++--
 target/ppc/misc_helper.c|  8 +++-
 target/ppc/translate_init.c.inc |  4 ++--
 4 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index e73416da68..061d2eed1b 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -581,6 +581,8 @@ enum {
 POWERPC_FLAG_TM   = 0x0010,
 /* Has SCV (ISA 3.00)*/
 POWERPC_FLAG_SCV  = 0x0020,
+/* Has HID0 for LE bit (601) */
+POWERPC_FLAG_HID0_LE  = 0x0040,
 };
 
 /*/
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index 5e18232b84..95b9aca61f 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -96,8 +96,17 @@ void hreg_compute_hflags(CPUPPCState *env)
 hflags_mask |= (1ULL << MSR_CM) | (1ULL << MSR_SF) | MSR_HVB;
 hreg_compute_mem_idx(env);
 env->hflags = env->msr & hflags_mask;
-/* Merge with hflags coming from other registers */
-env->hflags |= env->hflags_nmsr;
+
+if (env->flags & POWERPC_FLAG_HID0_LE) {
+/*
+ * Note that MSR_LE is not set in env->msr_mask for this cpu,
+ * and so will never be set in msr or hflags at this point.
+ */
+uint32_t le = extract32(env->spr[SPR_HID0], 3, 1);
+env->hflags |= le << MSR_LE;
+/* Retain for backward compatibility with migration. */
+env->hflags_nmsr = le << MSR_LE;
+}
 }
 
 void cpu_interrupt_exittb(CPUState *cs)
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index 5d6e0de396..63e3147eb4 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -194,16 +194,14 @@ void helper_store_hid0_601(CPUPPCState *env, target_ulong 
val)
 target_ulong hid0;
 
 hid0 = env->spr[SPR_HID0];
+env->spr[SPR_HID0] = (uint32_t)val;
+
 if ((val ^ hid0) & 0x0008) {
 /* Change current endianness */
-env->hflags &= ~(1 << MSR_LE);
-env->hflags_nmsr &= ~(1 << MSR_LE);
-env->hflags_nmsr |= (1 << MSR_LE) & (((val >> 3) & 1) << MSR_LE);
-env->hflags |= env->hflags_nmsr;
+hreg_compute_hflags(env);
 qemu_log("%s: set endianness to %c => " TARGET_FMT_lx "\n", __func__,
  val & 0x8 ? 'l' : 'b', env->hflags);
 }
-env->spr[SPR_HID0] = (uint32_t)val;
 }
 
 void helper_store_403_pbr(CPUPPCState *env, uint32_t num, target_ulong value)
diff --git a/target/ppc/translate_init.c.inc b/target/ppc/translate_init.c.inc
index c03a7c4f52..049d76cfd1 100644
--- a/target/ppc/translate_init.c.inc
+++ b/target/ppc/translate_init.c.inc
@@ -5441,7 +5441,7 @@ POWERPC_FAMILY(601)(ObjectClass *oc, void *data)
 pcc->excp_model = POWERPC_EXCP_601;
 pcc->bus_model = PPC_FLAGS_INPUT_6xx;
 pcc->bfd_mach = bfd_mach_ppc_601;
-pcc->flags = POWERPC_FLAG_SE | POWERPC_FLAG_RTC_CLK;
+pcc->flags = POWERPC_FLAG_SE | POWERPC_FLAG_RTC_CLK | POWERPC_FLAG_HID0_LE;
 }
 
 #define POWERPC_MSRR_601v(0x1040ULL)
@@ -5485,7 +5485,7 @@ POWERPC_FAMILY(601v)(ObjectClass *oc, void *data)
 #endif
 pcc->bus_model = PPC_FLAGS_INPUT_6xx;
 pcc->bfd_mach = bfd_mach_ppc_601;
-pcc->flags = POWERPC_FLAG_SE | POWERPC_FLAG_RTC_CLK;
+pcc->flags = POWERPC_FLAG_SE | POWERPC_FLAG_RTC_CLK | POWERPC_FLAG_HID0_LE;
 }
 
 static void init_proc_602(CPUPPCState *env)
-- 
2.31.1

[PULL 01/46] hw/ppc/mac_newworld: Restrict RAM to 2 GiB

[David Gibson]

From: Philippe Mathieu-Daudé 

On Mac99 and newer machines, the Uninorth PCI host bridge maps
the PCI hole region at 2GiB, so the RAM area beside 2GiB is not
accessible by the CPU. Restrict the memory to 2GiB to avoid
problems such the one reported in the buglink.

Buglink: https://bugs.launchpad.net/qemu/+bug/1922391
Reported-by: Håvard Eidnes 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20210406084842.2859664-1-f4...@amsat.org>
Reviewed-by: BALATON Zoltan 
Signed-off-by: David Gibson 
---
 hw/ppc/mac_newworld.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 2175962846..d88b38e925 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -157,6 +157,10 @@ static void ppc_core99_init(MachineState *machine)
 }
 
 /* allocate RAM */
+if (machine->ram_size > 2 * GiB) {
+error_report("RAM size more than 2 GiB is not supported");
+exit(1);
+}
 memory_region_add_subregion(get_system_memory(), 0, machine->ram);
 
 /* allocate and load firmware ROM */
-- 
2.31.1

Re: [PATCH v4 0/3] nvdimm: Enable sync-dax property for nvdimm

[Pankaj Gupta]

> > The proposal that "sync-dax=unsafe" for non-PPC architectures, is a
> > fundamental misrepresentation of how this is supposed to work. Rather
> > than make "sync-dax" a first class citizen of the device-description
> > interface I'm proposing that you make this a separate device-type.
> > This also solves the problem that "sync-dax" with an implicit
> > architecture backend assumption is not precise, but a new "non-nvdimm"
> > device type would make it explicit what the host is advertising to the
> > guest.
> >
>
> Currently, users can use a virtualized nvdimm support in Qemu to share
> host page cache to the guest via the below command
>
> -object memory-backend-file,id=memnvdimm1,mem-path=file_name_in_host_fs
> -device nvdimm,memdev=memnvdimm1
>
> Such usage can results in wrong application behavior because there is no
> hint to the application/guest OS that a cpu cache flush is not
> sufficient to ensure persistence.
>
> I understand that virio-pmem is suggested as an alternative for that.
> But why not fix virtualized nvdimm if platforms can express the details.
>
> ie, can ACPI indicate to the guest OS that the device need a flush
> mechanism to ensure persistence in the above case?
>
> What this patch series did was to express that property via a device
> tree node and guest driver enables a hypercall based flush mechanism to
> ensure persistence.

Would VIRTIO (entirely asynchronous, no trap at host side) based
mechanism is better
than hyper-call based? Registering memory can be done any way. We
implemented virtio-pmem
flush mechanisms with below considerations:

- Proper semantic for guest flush requests.
- Efficient mechanism for performance pov.

I am just asking myself if we have platform agnostic mechanism already
there, maybe
we can extend it to suit our needs? Maybe I am missing some points here.

> >> On PPC, the default is "sync-dax=writeback" - so the ND_REGION_ASYNC
> >>
> >> is set for the region and the guest makes hcalls to issue fsync on the 
> >> host.
> >>
> >>
> >> Are you suggesting me to keep it "unsafe" as default for all architectures
> >>
> >> including PPC and a user can set it to "writeback" if desired.
> >
> > No, I am suggesting that "sync-dax" is insufficient to convey this
> > property. This behavior warrants its own device type, not an ambiguous
> > property of the memory-backend-file with implicit architecture
> > assumptions attached.
> >
>
> Why is it insufficient?  Is it because other architectures don't have an
> ability express this detail to guest OS? Isn't that an arch limitations?

Re: [PATCH 2/3] tests/qtest/rtc-test: Remove pointless NULL check

[Thomas Huth]

On 03/05/2021 18.55, Peter Maydell wrote:

In rtc-test.c we know that s is non-NULL because qtest_start()
will return a non-NULL value, and we assume this when we
pass s to qtest_irq_intercept_in(). So we can drop the
initial assignment of NULL and the "if (s)" condition at
the end of the function.

Fixes: Coverity CID 1432353
Signed-off-by: Peter Maydell 
---
  tests/qtest/rtc-test.c | 6 ++
  1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/rtc-test.c b/tests/qtest/rtc-test.c
index 402ce2c6090..8126ab1bdb8 100644
--- a/tests/qtest/rtc-test.c
+++ b/tests/qtest/rtc-test.c
@@ -686,7 +686,7 @@ static void periodic_timer(void)
  
  int main(int argc, char **argv)

  {
-QTestState *s = NULL;
+QTestState *s;
  int ret;
  
  g_test_init(, , NULL);

@@ -712,9 +712,7 @@ int main(int argc, char **argv)
  
  ret = g_test_run();
  
-if (s) {

-qtest_quit(s);
-}
+qtest_quit(s);
  
  return ret;

  }



Reviewed-by: Thomas Huth 

Re: [PATCH v4 0/3] nvdimm: Enable sync-dax property for nvdimm

[Aneesh Kumar K.V]

On 5/4/21 1:11 AM, Dan Williams wrote:

On Mon, May 3, 2021 at 7:06 AM Shivaprasad G Bhat  wrote:





.



The proposal that "sync-dax=unsafe" for non-PPC architectures, is a
fundamental misrepresentation of how this is supposed to work. Rather
than make "sync-dax" a first class citizen of the device-description
interface I'm proposing that you make this a separate device-type.
This also solves the problem that "sync-dax" with an implicit
architecture backend assumption is not precise, but a new "non-nvdimm"
device type would make it explicit what the host is advertising to the
guest.



Currently, users can use a virtualized nvdimm support in Qemu to share 
host page cache to the guest via the below command


-object memory-backend-file,id=memnvdimm1,mem-path=file_name_in_host_fs
-device nvdimm,memdev=memnvdimm1

Such usage can results in wrong application behavior because there is no 
hint to the application/guest OS that a cpu cache flush is not 
sufficient to ensure persistence.


I understand that virio-pmem is suggested as an alternative for that. 
But why not fix virtualized nvdimm if platforms can express the details.


ie, can ACPI indicate to the guest OS that the device need a flush 
mechanism to ensure persistence in the above case?


What this patch series did was to express that property via a device 
tree node and guest driver enables a hypercall based flush mechanism to 
ensure persistence.







On PPC, the default is "sync-dax=writeback" - so the ND_REGION_ASYNC

is set for the region and the guest makes hcalls to issue fsync on the host.


Are you suggesting me to keep it "unsafe" as default for all architectures

including PPC and a user can set it to "writeback" if desired.


No, I am suggesting that "sync-dax" is insufficient to convey this
property. This behavior warrants its own device type, not an ambiguous
property of the memory-backend-file with implicit architecture
assumptions attached.



Why is it insufficient?  Is it because other architectures don't have an 
ability express this detail to guest OS? Isn't that an arch limitations?


-aneesh

Re: [PATCH v1 1/1] docs/system: Move the RISC-V -bios information to removed

[Bin Meng]

On Tue, May 4, 2021 at 6:34 AM Alistair Francis
 wrote:
>
> QEMU 5.1 changed the behaviour of the default boot for the RISC-V virt
> and sifive_u machines. This patch moves that change from the
> deprecated.rst file to the removed-features.rst file and the
> target-riscv.rst.
>
> Signed-off-by: Alistair Francis 
> ---
>  docs/system/deprecated.rst   | 19 ---
>  docs/system/removed-features.rst |  5 +
>  docs/system/target-riscv.rst | 13 -
>  3 files changed, 17 insertions(+), 20 deletions(-)
>

Reviewed-by: Bin Meng 

Re: [PATCH v4 1/3] spapr: nvdimm: Forward declare and move the definitions

[David Gibson]

On Mon, May 03, 2021 at 01:23:47PM -0500, Eric Blake wrote:
> On 4/28/21 10:48 PM, Shivaprasad G Bhat wrote:
> > The subsequent patches add definitions which tend to
> > get the compilation to cyclic dependency. So, prepare
> > with forward declarations, move the defitions and clean up.
> 
> definitions
> 
> > 
> > Signed-off-by: Shivaprasad G Bhat 
> > ---
> >  hw/ppc/spapr_nvdimm.c |   12 
> >  include/hw/ppc/spapr_nvdimm.h |   14 ++
> >  2 files changed, 14 insertions(+), 12 deletions(-)
> > 
> > diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
> > index b46c36917c..8cf3fb2ffb 100644
> > --- a/hw/ppc/spapr_nvdimm.c
> > +++ b/hw/ppc/spapr_nvdimm.c
> > @@ -31,6 +31,18 @@
> >  #include "qemu/range.h"
> >  #include "hw/ppc/spapr_numa.h"
> >  
> > +/*
> > + * The nvdimm size should be aligned to SCM block size.
> > + * The SCM block size should be aligned to SPAPR_MEMORY_BLOCK_SIZE
> > + * inorder to have SCM regions not to overlap with dimm memory regions.
> 
> And while at it, even though it is code motion...

It looks like the patch no longer applies clear to ppc-for-6.1, so can
you rebase and fix up Eric's nitpicks at the same time?

> 
> > + * The SCM devices can have variable block sizes. For now, fixing the
> > + * block size to the minimum value.
> > + */
> > +#define SPAPR_MINIMUM_SCM_BLOCK_SIZE SPAPR_MEMORY_BLOCK_SIZE
> 
> > +++ b/include/hw/ppc/spapr_nvdimm.h
> > @@ -11,19 +11,9 @@
> >  #define HW_SPAPR_NVDIMM_H
> >  
> >  #include "hw/mem/nvdimm.h"
> > -#include "hw/ppc/spapr.h"
> >  
> > -/*
> > - * The nvdimm size should be aligned to SCM block size.
> > - * The SCM block size should be aligned to SPAPR_MEMORY_BLOCK_SIZE
> > - * inorder to have SCM regions not to overlap with dimm memory regions.
> 
> ... this should be "in order"
> 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [PATCH 10/22] qapi/parser: Fix typing of token membership tests

[John Snow]

On 4/27/21 3:00 AM, Markus Armbruster wrote:

John Snow  writes:


On 4/25/21 3:59 AM, Markus Armbruster wrote:

John Snow  writes:


When the token can be None, we can't use 'x in "abc"' style membership
tests to group types of tokens together, because 'None in "abc"' is a
TypeError.

Easy enough to fix, if not a little ugly.

Signed-off-by: John Snow 
---
   scripts/qapi/parser.py | 5 +++--
   1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
index 7f3c009f64b..16fd36f8391 100644
--- a/scripts/qapi/parser.py
+++ b/scripts/qapi/parser.py
@@ -272,7 +272,7 @@ def get_values(self):
   if self.tok == ']':
   self.accept()
   return expr
-if self.tok not in "{['tf":
+if self.tok is None or self.tok not in "{['tf":
   raise QAPIParseError(
   self, "expected '{', '[', ']', string, or boolean")
   while True:
@@ -294,7 +294,8 @@ def get_expr(self, nested):
   elif self.tok == '[':
   self.accept()
   expr = self.get_values()
-elif self.tok in "'tf":
+elif self.tok and self.tok in "'tf":
+assert isinstance(self.val, (str, bool))
   expr = self.val
   self.accept()
   else:


How can self.tok be None?

I suspect this is an artifact of PATCH 04.  Before, self.tok is
initialized to the first token, then set to subsequent tokens (all str)
in turn.  After, it's initialized to None, then set to tokens in turn.



Actually, it's set to None to represent EOF. See here:

  elif self.tok == '\n':
if self.cursor == len(self.src):
  self.tok = None
  return


Alright, then this is actually a bug fix:

 $ echo -n "{'key': " | python3 scripts/qapi-gen.py /dev/stdin
 Traceback (most recent call last):
   File "scripts/qapi-gen.py", line 19, in 
 sys.exit(main.main())
   File "/work/armbru/qemu/scripts/qapi/main.py", line 93, in main
 generate(args.schema,
   File "/work/armbru/qemu/scripts/qapi/main.py", line 50, in generate
 schema = QAPISchema(schema_file)
   File "/work/armbru/qemu/scripts/qapi/schema.py", line 852, in __init__
 parser = QAPISchemaParser(fname)
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 59, in __init__
 self._parse()
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 81, in _parse
 expr = self.get_expr(False)
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 293, in get_expr
 expr = self.get_members()
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 260, in get_members
 expr[key] = self.get_expr(True)
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 297, in get_expr
 elif self.tok in "'tf":
 TypeError: 'in ' requires string as left operand, not NoneType

Likewise, the other hunk:

 $ echo -n "{'key': [" | python3 scripts/qapi-gen.py /dev/stdin
 Traceback (most recent call last):
   File "scripts/qapi-gen.py", line 19, in 
 sys.exit(main.main())
   File "/work/armbru/qemu/scripts/qapi/main.py", line 89, in main
 generate(args.schema,
   File "/work/armbru/qemu/scripts/qapi/main.py", line 51, in generate
 schema = QAPISchema(schema_file)
   File "/work/armbru/qemu/scripts/qapi/schema.py", line 860, in __init__
 parser = QAPISchemaParser(fname)
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 71, in __init__
 expr = self.get_expr(False)
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 270, in get_expr
 expr = self.get_members()
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 238, in get_members
 expr[key] = self.get_expr(True)
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 273, in get_expr
 expr = self.get_values()
   File "/work/armbru/qemu/scripts/qapi/parser.py", line 253, in get_values
 if self.tok not in "{['tf":
 TypeError: 'in ' requires string as left operand, not NoneType

Please add test cases.  I recommend adding them in a separate patch, so
this one's diff shows clearly what's being fixed.



Can't, again: because it's a crash, the test runner explodes.

Two choices, because I won't finish respinning this tonight:

(1) Amend the test runner to print generic exceptions using str(err), 
without the stack trace -- so we can check for crashes using the diffs 
-- again in its own commit.


(2) Just squish the tests and error messages into this commit like I did 
for the other crash fix I checked in.


I'd normally leap for #1, but you seem to have some affinity for 
allowing unpredictable things to explode very violently, so I am not sure.


--js

Re: [RESEND PATCH 05/32] vl: Add "sgx-epc" option to expose SGX EPC sections to guest

[Sean Christopherson]

On Mon, May 03, 2021, Paolo Bonzini wrote:
> On 30/04/21 08:24, Yang Zhong wrote:
> > +void pc_machine_init_sgx_epc(PCMachineState *pcms)
> > +{
> > +SGXEPCState *sgx_epc;
> > +X86MachineState *x86ms = X86_MACHINE(pcms);
> > +
> > +sgx_epc = g_malloc0(sizeof(*sgx_epc));
> > +pcms->sgx_epc = sgx_epc;
> > +
> > +sgx_epc->base = 0x1ULL + x86ms->above_4g_mem_size;
> > +
> > +memory_region_init(_epc->mr, OBJECT(pcms), "sgx-epc", UINT64_MAX);
> > +memory_region_add_subregion(get_system_memory(), sgx_epc->base,
> > +_epc->mr);
> > +
> > +qemu_opts_foreach(qemu_find_opts("sgx-epc"), sgx_epc_init_func, NULL,
> > +  _fatal);
> > +
> > +if ((sgx_epc->base + sgx_epc->size) < sgx_epc->base) {
> > +error_report("Size of all 'sgx-epc' =0x%"PRIu64" causes EPC to 
> > wrap",
> > + sgx_epc->size);
> > +exit(EXIT_FAILURE);
> 
> Or perhaps even drop completely the options and just do "-device
> sgx-epc,backend=epc1"?

Is there a way to process "-device sgx-epc..." before vCPUs are realized?  The
ordering problem was the only reason I added a dedicated option.

>From the changelog:

  Because SGX EPC is enumerated through CPUID, EPC "devices" need to be
  realized prior to realizing the vCPUs themselves, i.e. long before
  generic devices are parsed and realized.

  So even though EPC sections could be realized through the generic
  -devices command, they need to be created much earlier for them to
  actually be usable by the guest.

Re: [PATCH 1/3] hw/intc/spapr_xive: Use device_cold_reset() instead of device_legacy_reset()

[David Gibson]

On Mon, May 03, 2021 at 04:18:47PM +0100, Peter Maydell wrote:
> The h_int_reset() function resets the XIVE interrupt controller via
> device_legacy_reset().  We know that the interrupt controller does
> not have a qbus of its own, so the new device_cold_reset() function
> (which resets both the device and its child buses) is equivalent here
> to device_legacy_reset() and we can just switch to the new API.
> 
> Signed-off-by: Peter Maydell 

Applied to ppc-for-6.1.

> ---
>  hw/intc/spapr_xive.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
> index 801bc193416..89cfa018f59 100644
> --- a/hw/intc/spapr_xive.c
> +++ b/hw/intc/spapr_xive.c
> @@ -1798,7 +1798,7 @@ static target_ulong h_int_reset(PowerPCCPU *cpu,
>  return H_PARAMETER;
>  }
>  
> -device_legacy_reset(DEVICE(xive));
> +device_cold_reset(DEVICE(xive));
>  
>  if (spapr_xive_in_kernel(xive)) {
>  Error *local_err = NULL;

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [PATCH v3 2/7] target/ppc: Isolated SPR read/write callbacks

[David Gibson]

On Mon, May 03, 2021 at 05:15:38PM -0300, Bruno Piazera Larsen wrote:
> 
> On 03/05/2021 01:54, David Gibson wrote:
> > On Fri, Apr 30, 2021 at 04:35:28PM -0300, Bruno Larsen (billionai) wrote:
> > > Moved all SPR read/write callback, and some related functions, to a
> > > new file specific for it. These callbacks are TCG only, so separating
> > > them is required to support the build flag disable-tcg.
> > > 
> > > Making the spr_noaccess function not static, and moving the define to
> > > internal.h is required, otherwise the project doesn't build
> > > 
> > > Signed-off-by: Bruno Larsen (billionai) 
> > > ---
> > >   target/ppc/internal.h   |3 +
> > >   target/ppc/spr_tcg.c.inc| 1052 +++
> > >   target/ppc/translate.c  |   47 +-
> > >   target/ppc/translate_init.c.inc |  981 
> > >   4 files changed, 1056 insertions(+), 1027 deletions(-)
> > >   create mode 100644 target/ppc/spr_tcg.c.inc
> > Hmm.  So, I'm still pretty ambivalent about the creation of
> > spr_tcg.c.inc.  The separation between it and translate.c just seems
> > rather arbitrary to me.
> > 
> > Yes, translate.c is overly huge, but I'm not sure going from
> > overly-huge to overly-huger really makes anything worse, and would
> > avoid some of the dancing around to handle the new file.
> > 
> > So for now, I'm inclined to suggest just moving the spr callbacks from
> > translate_init.c.inc to translate.c.  And some day, I hope someone has
> > time to split up translate.c based on CPU family, which I think is a
> > more useful way to make it less huge.
> 
> Ok. I agree that the improved is pretty minor, I was just thinking it was
> probably better than nothing... I'll work on that tomorrow and will have a
> new version.
> 
> When I do, should I put the many e-mail IDs that hold required patches as
> "Based-on" tags, or should I just say ppc-for-6.1? I'm still a bit lost when
> dealing with patchew and these things...

You can just say it's against ppc-for-6.1 in the cover letter.  Since
it's an explicitly ppc specific patchset, and the main audience is me
there's no need to get too complicated.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [PATCH 3/3] hw/ppc/pnv_psi: Use device_cold_reset() instead of device_legacy_reset()

[David Gibson]

On Mon, May 03, 2021 at 04:18:49PM +0100, Peter Maydell wrote:
> The pnv_psi.c code uses device_legacy_reset() for two purposes:
>  * to reset itself from its qemu_register_reset() handler
>  * to reset a XiveSource object it has
> 
> Neither it nor the XiveSource have any qbuses, so the new
> device_cold_reset() function (which resets both the device and its
> child buses) is equivalent here to device_legacy_reset() and we can
> just switch to the new API.
> 
> Signed-off-by: Peter Maydell 

Applied to ppc-for-6.1.

> ---
>  hw/ppc/pnv_psi.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
> index 3e868c8c8da..292b373f93f 100644
> --- a/hw/ppc/pnv_psi.c
> +++ b/hw/ppc/pnv_psi.c
> @@ -466,7 +466,7 @@ static void pnv_psi_reset(DeviceState *dev)
>  
>  static void pnv_psi_reset_handler(void *dev)
>  {
> -device_legacy_reset(DEVICE(dev));
> +device_cold_reset(DEVICE(dev));
>  }
>  
>  static void pnv_psi_realize(DeviceState *dev, Error **errp)
> @@ -710,7 +710,7 @@ static void pnv_psi_p9_mmio_write(void *opaque, hwaddr 
> addr,
>  break;
>  case PSIHB9_INTERRUPT_CONTROL:
>  if (val & PSIHB9_IRQ_RESET) {
> -device_legacy_reset(DEVICE(>source));
> +device_cold_reset(DEVICE(>source));
>  }
>  psi->regs[reg] = val;
>  break;

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [PATCH 2/3] hw/ppc/spapr_vio: Reset TCE table object with device_cold_reset()

[David Gibson]

On Mon, May 03, 2021 at 04:18:48PM +0100, Peter Maydell wrote:
> The spapr_vio_quiesce_one() function resets the TCE table object
> (TYPE_SPAPR_TCE_TABLE) via device_legacy_reset().  We know that
> objects of that type do not have a qbus of their own, so the new
> device_cold_reset() function (which resets both the device and its
> child buses) is equivalent here to device_legacy_reset() and we can
> just switch to the new API.
> 
> Signed-off-by: Peter Maydell 

Applied to ppc-for-6.1.

Actually, I strongly suspect we could just change rtas_quiesce() to
cold reset the entire VIO bus, but we can look at that as a followup
after checking  bit more closely.

> ---
>  hw/ppc/spapr_vio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
> index ef06e0362c8..b59452bcd62 100644
> --- a/hw/ppc/spapr_vio.c
> +++ b/hw/ppc/spapr_vio.c
> @@ -310,7 +310,7 @@ int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq)
>  static void spapr_vio_quiesce_one(SpaprVioDevice *dev)
>  {
>  if (dev->tcet) {
> -device_legacy_reset(DEVICE(dev->tcet));
> +device_cold_reset(DEVICE(dev->tcet));
>  }
>  free_crq(dev);
>  }

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [PATCH] target/ppc/spapr: Update H_GET_CPU_CHARACTERISTICS bits

[David Gibson]

On Mon, May 03, 2021 at 10:58:33PM +1000, Nicholas Piggin wrote:
> There are several new bits added to the hcall which reflect new issues
> found and new hardware mitigations.
> 
> This adds the link stack flush behaviour, link stack flush accelerated
> instruction capability, and several L1D flush type behaviours (which are
> now being specified as negative in order to simplify patched kernel
> compatibility with older firmware).

So, to clarify here, the bits your adding aren't advertising any new
behaviour on qemu/KVM's part, they're just new ways of advertising the
same behaviour?

> 
> Signed-off-by: Nicholas Piggin 
> ---
>  hw/ppc/spapr_hcall.c   | 5 +
>  include/hw/ppc/spapr.h | 6 ++
>  2 files changed, 11 insertions(+)
> 
> diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
> index 7275d0bba1..f656620232 100644
> --- a/hw/ppc/spapr_hcall.c
> +++ b/hw/ppc/spapr_hcall.c
> @@ -1878,6 +1878,9 @@ static target_ulong 
> h_get_cpu_characteristics(PowerPCCPU *cpu,
>  behaviour |= H_CPU_BEHAV_L1D_FLUSH_PR;
>  break;
>  case SPAPR_CAP_FIXED:
> +behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY;
> +behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_UACCESS;
> +behaviour |= H_CPU_BEHAV_NO_STF_BARRIER;
>  break;
>  default: /* broken */
>  assert(safe_cache == SPAPR_CAP_BROKEN);
> @@ -1909,9 +1912,11 @@ static target_ulong 
> h_get_cpu_characteristics(PowerPCCPU *cpu,
>  break;
>  case SPAPR_CAP_WORKAROUND:
>  behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
> +behaviour |= H_CPU_BEHAV_FLUSH_LINK_STACK;
>  if (count_cache_flush_assist) {
>  characteristics |= H_CPU_CHAR_BCCTR_FLUSH_ASSIST;
>  }
> +/* Should have a way to enable BCCTR_LINK_FLUSH_ASSIST */

Do we need a new spapr capability for this link flush thing?

>  break;
>  default: /* broken */
>  assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
> diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
> index 7f40a158f4..883ac1db3c 100644
> --- a/include/hw/ppc/spapr.h
> +++ b/include/hw/ppc/spapr.h
> @@ -395,10 +395,16 @@ struct SpaprMachineState {
>  #define H_CPU_CHAR_THR_RECONF_TRIG  PPC_BIT(6)
>  #define H_CPU_CHAR_CACHE_COUNT_DIS  PPC_BIT(7)
>  #define H_CPU_CHAR_BCCTR_FLUSH_ASSIST   PPC_BIT(9)
> +#define H_CPU_CHAR_BCCTR_LINK_FLUSH_ASSIST  PPC_BIT(11)
> +
>  #define H_CPU_BEHAV_FAVOUR_SECURITY PPC_BIT(0)
>  #define H_CPU_BEHAV_L1D_FLUSH_PRPPC_BIT(1)
>  #define H_CPU_BEHAV_BNDS_CHK_SPEC_BAR   PPC_BIT(2)
>  #define H_CPU_BEHAV_FLUSH_COUNT_CACHE   PPC_BIT(5)
> +#define H_CPU_BEHAV_FLUSH_LINK_STACKPPC_BIT(6)
> +#define H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY  PPC_BIT(7)
> +#define H_CPU_BEHAV_NO_L1D_FLUSH_UACCESSPPC_BIT(8)
> +#define H_CPU_BEHAV_NO_STF_BARRIER  PPC_BIT(9)
>  
>  /* Each control block has to be on a 4K boundary */
>  #define H_CB_ALIGNMENT 4096

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [PATCH v2] Document qemu-img options data_file and data_file_raw

[Connor Kuehl]

On 4/30/21 9:45 AM, Max Reitz wrote:
>> +  ``data_file_raw``
>> +If this option is set to ``on``, QEMU will always keep the external
>> +data file consistent as a standalone read-only raw image. It does
>> +this by forwarding updates through to the raw image in addition to
>> +updating the image metadata. If set to ``off``, QEMU will only
>> +update the image metadata without forwarding the changes through
>> +to the raw image. The default value is ``off``.
> 
> Hm, what updates and what changes?  I mean, the first part makes sense (the 
> “It does this by...”), but the second part doesn’t.  qemu will still forward 
> most writes to the data file.  (Not all, but most.)
> 
> (Also, nit pick: With data_file_raw=off, the data file is not a raw image.  
> (You still call it that in the penultimate sentence.))
> When you write data to a qcow2 file with data_file, the data also goes to the 
> data_file, most of the time.  The exception is when it can be handled with a 
> metadata update, i.e. when it's a zero write or discard.
> 
> In addition, such updates (i.e. zero writes, I presume) not happening to the 
> data file are usually a minor problem.  The real problem is that without 
> data_file_raw, data clusters can be allocated anywhere in the data file, 
> whereas with data_file_raw, they are allocated at their respective guest 
> offset (i.e. the host offset always equals the guest offset).
> 
> I personally would have been fine with the first sentence, but if we want 
> more of an explanation...  Perhaps:
> 
> < 
> If this option is set to ``on``, QEMU will always keep the external data file 
> consistent as a standalone read-only raw image.
> 
> It does this by effectively forwarding all write accesses that happen to the 
> qcow2 file to the raw data file, including their offsets. Therefore, data 
> that is visible on the qcow2 node (i.e., to the guest) at some offset is 
> visible at the same offset in the raw data file.
> 
> If this option is ``off``, QEMU will use the data file just to store data in 
> an effectively arbitrary manner.  The file’s content will not make sense 
> without the accompanying qcow2 metadata.  Where data is written will have no 
> relation to its offset as seen by the guest, and some writes (specifically 
> zero writes) may not be forwarded to the data file at all, but will only be 
> handled by modifying qcow2 metadata.
> 
> In short: With data_file_raw, the data file reads as a valid raw VM image 
> file.  Without it, its content can only be interpreted by reading the 
> accompanying qcow2 metadata.
> 
> Note that this option only makes the data file valid as a read-only raw 
> image.  You should not write to it, as this may effectively corrupt the qcow2 
> metadata (for example, dirty bitmaps may become out of sync).
> 
> EOF
> 
> This got longer than I wanted it to be.  Hm.  Anyway, what do you think?

I found it very helpful. I'll incorporate your explanation into the next
revision.

I'm wondering what the most appropriate trailer would be for the next
revision?

Suggested-by: Max [..]
Co-developed-by: Max [..]

Let me know if you have a strong preference, otherwise I'll go with
Suggested-by:

Thank you,

Connor

Re: [qemu-web PATCH] Update website to point to the new bug tracker at GitLab instead of Launchpad

[John Snow]

On 5/3/21 6:30 AM, Thomas Huth wrote:

We've started migrating the bug tickets from Launchpad to GitLab, so
it does not make too much sense anymore that users open new tickets
in the old system. Let's direct them now to the GitLab tracker instead.

Signed-off-by: Thomas Huth 


Reviewed-by: John Snow 

Thanks!


---
  contribute.md  | 3 ++-
  contribute/report-a-bug.md | 5 -
  support.md | 2 +-
  3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/contribute.md b/contribute.md
index d7e295f..cbb476d 100644
--- a/contribute.md
+++ b/contribute.md
@@ -3,7 +3,8 @@ title: Contribute to QEMU!
  permalink: /contribute/
  ---
  
-* Report a bug in our bugtracker: [https://bugs.launchpad.net/qemu/](https://bugs.launchpad.net/qemu/)

+* Report a bug in our bugtracker:
+  
See also [How to report a bug](report-a-bug/) or [How to report a security 
bug](security-process/)
  
  * Clone ([or browse](https://gitlab.com/qemu-project/qemu)) the git repository: `git clone https://gitlab.com/qemu-project/qemu.git`

diff --git a/contribute/report-a-bug.md b/contribute/report-a-bug.md
index 1cc42e7..922f699 100644
--- a/contribute/report-a-bug.md
+++ b/contribute/report-a-bug.md
@@ -3,7 +3,10 @@ title: Reporting a bug
  permalink: /contribute/report-a-bug/
  ---
  
-Bugs can be filed at our [bug tracker](https://bugs.launchpad.net/qemu/), which is hosted on Launchpad. If you've got a problem with how your Linux distribution packages QEMU, use the bug tracker from your distro instead.

+Bugs can be filed at our
+[bug tracker](https://gitlab.com/qemu-project/qemu/-/issues), which is hosted
+on GitLab. Note: If you've got a problem with how your Linux distribution
+packages QEMU, please use the bug tracker from your distro instead.
  
  When submitting a bug report, please try to do the following:
  
diff --git a/support.md b/support.md

index 252351c..b622362 100644
--- a/support.md
+++ b/support.md
@@ -41,5 +41,5 @@ response. If you can't leave IRC open and wait you may be 
better
  served by a mailing list.
  
  * If you think you have found a bug you can report it on [our bug

-  tracker](https://bugs.launchpad.net/qemu/).
+  tracker](https://gitlab.com/qemu-project/qemu/-/issues).
  Please see our guide on [how to report a bug](/contribute/report-a-bug/)

[PATCH 6/7] tests/acceptance: Move wait_for_console_pattern to ConsoleMixIn

[Wainer dos Santos Moschetta]

This moved wait_for_console_pattern() to ConsoleMixIn.

By far this change required the most adaptations on tests.

Notice that:

 1) Some tests from boot_linux_console.py were using the 
wait_for_console_pattern()
from the avocado_qemu package rather than the overloaded method on the
LinuxKernelTest class, and that explains the explict calls to
ConsoleMixIn.wait_for_console_pattern().

Likewise in boot_xen.py file.

 2) In virtiofs_submounts.py, wait_for_console_pattern() was imported but not 
used.

Signed-off-by: Wainer dos Santos Moschetta 
---
 tests/acceptance/avocado_qemu/__init__.py| 23 +---
 tests/acceptance/boot_linux_console.py   | 14 ++--
 tests/acceptance/boot_xen.py |  5 +++--
 tests/acceptance/linux_ssh_mips_malta.py |  8 +++
 tests/acceptance/machine_arm_canona1100.py   |  6 ++---
 tests/acceptance/machine_arm_integratorcp.py |  8 +++
 tests/acceptance/machine_arm_n8x0.py |  6 ++---
 tests/acceptance/machine_microblaze.py   |  8 +++
 tests/acceptance/machine_mips_loongson3v.py  |  6 ++---
 tests/acceptance/machine_mips_malta.py   |  6 ++---
 tests/acceptance/machine_ppc.py  | 10 -
 tests/acceptance/machine_rx_gdbsim.py|  7 +++---
 tests/acceptance/machine_s390_ccw_virtio.py  |  7 +++---
 tests/acceptance/machine_sparc64_sun4u.py|  6 ++---
 tests/acceptance/machine_sparc_leon3.py  |  8 +++
 tests/acceptance/multiprocess.py |  5 ++---
 tests/acceptance/ppc_prep_40p.py | 16 +++---
 tests/acceptance/virtio-gpu.py   |  4 +---
 tests/acceptance/virtiofs_submounts.py   |  1 -
 19 files changed, 73 insertions(+), 81 deletions(-)

diff --git a/tests/acceptance/avocado_qemu/__init__.py 
b/tests/acceptance/avocado_qemu/__init__.py
index 4a0129c0eb..b21f9ea3ff 100644
--- a/tests/acceptance/avocado_qemu/__init__.py
+++ b/tests/acceptance/avocado_qemu/__init__.py
@@ -101,19 +101,6 @@ def _console_interaction(test, success_message, 
failure_message,
 (failure_message, success_message)
 test.fail(fail)
 
-def wait_for_console_pattern(test, success_message, failure_message=None,
- vm=None):
-"""
-Waits for messages to appear on the console, while logging the content
-
-:param test: an Avocado test containing a VM that will have its console
- read and probed for a success or failure message
-:type test: :class:`avocado_qemu.Test`
-:param success_message: if this message appears, test succeeds
-:param failure_message: if this message appears, test fails
-"""
-_console_interaction(test, success_message, failure_message, None, vm=vm)
-
 class ConsoleMixIn():
 """Contains utilities for interacting with a guest via Console."""
 
@@ -163,6 +150,16 @@ def interrupt_interactive_console_until_pattern(self, 
success_message,
 _console_interaction(self, success_message, failure_message,
  interrupt_string, True)
 
+def wait_for_console_pattern(self, success_message, failure_message=None,
+ vm=None):
+"""
+Waits for messages to appear on the console, while logging the content
+
+:param success_message: if this message appears, test succeeds
+:param failure_message: if this message appears, test fails
+"""
+_console_interaction(self, success_message, failure_message, None, 
vm=vm)
+
 class Test(avocado.Test):
 def _get_unique_tag_val(self, tag_name):
 """
diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 50e0a3fe79..e8d7a127fe 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -17,7 +17,6 @@
 from avocado import skipUnless
 from avocado_qemu import Test
 from avocado_qemu import ConsoleMixIn
-from avocado_qemu import wait_for_console_pattern
 from avocado.utils import process
 from avocado.utils import archive
 from avocado.utils.path import find_command, CmdNotFoundError
@@ -48,7 +47,7 @@ class LinuxKernelTest(Test, ConsoleMixIn):
 KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
 
 def wait_for_console_pattern(self, success_message, vm=None):
-wait_for_console_pattern(self, success_message,
+super().wait_for_console_pattern(success_message,
  failure_message='Kernel panic - not syncing',
  vm=vm)
 
@@ -262,7 +261,7 @@ def test_mips64el_malta_5KEc_cpio(self):
  '-append', kernel_command_line,
  '-no-reboot')
 self.vm.launch()
-wait_for_console_pattern(self, 'Boot successful.')
+ConsoleMixIn.wait_for_console_pattern(self, 'Boot successful.')
 
 self.exec_command_and_wait_for_pattern('cat /proc/cpuinfo',
   

[PATCH 7/7] tests/acceptance: Move _console_interaction to ConsoleMixIn

[Wainer dos Santos Moschetta]

This moved the last remaining _console_interaction() to ConsoleMixIn.

None tests call it directly, so only the other methods in ConsoleMixIn
needed to be adapted.

Signed-off-by: Wainer dos Santos Moschetta 
---
 tests/acceptance/avocado_qemu/__init__.py | 57 +++
 1 file changed, 28 insertions(+), 29 deletions(-)

diff --git a/tests/acceptance/avocado_qemu/__init__.py 
b/tests/acceptance/avocado_qemu/__init__.py
index b21f9ea3ff..a6de3fe11a 100644
--- a/tests/acceptance/avocado_qemu/__init__.py
+++ b/tests/acceptance/avocado_qemu/__init__.py
@@ -76,34 +76,33 @@ def pick_default_qemu_bin(arch=None):
 if is_readable_executable_file(qemu_bin_from_bld_dir_path):
 return qemu_bin_from_bld_dir_path
 
-
-def _console_interaction(test, success_message, failure_message,
- send_string, keep_sending=False, vm=None):
-assert not keep_sending or send_string
-if vm is None:
-vm = test.vm
-console = vm.console_socket.makefile()
-console_logger = logging.getLogger('console')
-while True:
-if send_string:
-vm.console_socket.sendall(send_string.encode())
-if not keep_sending:
-send_string = None # send only once
-msg = console.readline().strip()
-if not msg:
-continue
-console_logger.debug(msg)
-if success_message is None or success_message in msg:
-break
-if failure_message and failure_message in msg:
-console.close()
-fail = 'Failure message found in console: "%s". Expected: "%s"' % \
-(failure_message, success_message)
-test.fail(fail)
-
 class ConsoleMixIn():
 """Contains utilities for interacting with a guest via Console."""
 
+def _console_interaction(self, success_message, failure_message,
+ send_string, keep_sending=False, vm=None):
+assert not keep_sending or send_string
+if vm is None:
+vm = self.vm
+console = vm.console_socket.makefile()
+console_logger = logging.getLogger('console')
+while True:
+if send_string:
+vm.console_socket.sendall(send_string.encode())
+if not keep_sending:
+send_string = None # send only once
+msg = console.readline().strip()
+if not msg:
+continue
+console_logger.debug(msg)
+if success_message is None or success_message in msg:
+break
+if failure_message and failure_message in msg:
+console.close()
+fail = 'Failure message found in console: "%s". Expected: 
"%s"' % \
+(failure_message, success_message)
+self.fail(fail)
+
 def exec_command(self, command):
 """
 Send a command to a console (appending CRLF characters), while logging
@@ -112,7 +111,7 @@ def exec_command(self, command):
 :param command: the command to send
 :type command: str
 """
-_console_interaction(self, None, None, command + '\r')
+self._console_interaction(None, None, command + '\r')
 
 def exec_command_and_wait_for_pattern(self, command,
   success_message, 
failure_message=None):
@@ -125,7 +124,7 @@ def exec_command_and_wait_for_pattern(self, command,
 :param success_message: if this message appears, test succeeds
 :param failure_message: if this message appears, test fails
 """
-_console_interaction(self, success_message, failure_message, command + 
'\r')
+self._console_interaction(success_message, failure_message, command + 
'\r')
 
 def interrupt_interactive_console_until_pattern(self, success_message,
 failure_message=None,
@@ -147,7 +146,7 @@ def interrupt_interactive_console_until_pattern(self, 
success_message,
 :param interrupt_string: a string to send to the console before trying
 to read a new line
 """
-_console_interaction(self, success_message, failure_message,
+self._console_interaction(success_message, failure_message,
  interrupt_string, True)
 
 def wait_for_console_pattern(self, success_message, failure_message=None,
@@ -158,7 +157,7 @@ def wait_for_console_pattern(self, success_message, 
failure_message=None,
 :param success_message: if this message appears, test succeeds
 :param failure_message: if this message appears, test fails
 """
-_console_interaction(self, success_message, failure_message, None, 
vm=vm)
+self._console_interaction(success_message, failure_message, None, 
vm=vm)
 
 class Test(avocado.Test):
 def _get_unique_tag_val(self, tag_name):
-- 
2.29.2

[PATCH 3/7] tests/acceptance: Move exec_command_and_wait_for_pattern to ConsoleMixIn

[Wainer dos Santos Moschetta]

It was the time of exec_command_and_wait_for_pattern() to find a new
home at ConsoleMixIn. This time various tests needed to be adapted.

Signed-off-by: Wainer dos Santos Moschetta 
---
 tests/acceptance/avocado_qemu/__init__.py   |  29 +++---
 tests/acceptance/boot_linux_console.py  | 107 ++--
 tests/acceptance/machine_rx_gdbsim.py   |   8 +-
 tests/acceptance/machine_s390_ccw_virtio.py |  72 ++---
 tests/acceptance/multiprocess.py|   3 +-
 tests/acceptance/virtio-gpu.py  |  12 +--
 6 files changed, 111 insertions(+), 120 deletions(-)

diff --git a/tests/acceptance/avocado_qemu/__init__.py 
b/tests/acceptance/avocado_qemu/__init__.py
index 4d3b869765..4a0129c0eb 100644
--- a/tests/acceptance/avocado_qemu/__init__.py
+++ b/tests/acceptance/avocado_qemu/__init__.py
@@ -114,22 +114,6 @@ def wait_for_console_pattern(test, success_message, 
failure_message=None,
 """
 _console_interaction(test, success_message, failure_message, None, vm=vm)
 
-def exec_command_and_wait_for_pattern(test, command,
-  success_message, failure_message=None):
-"""
-Send a command to a console (appending CRLF characters), then wait
-for success_message to appear on the console, while logging the.
-content. Mark the test as failed if failure_message is found instead.
-
-:param test: an Avocado test containing a VM that will have its console
- read and probed for a success or failure message
-:type test: :class:`avocado_qemu.Test`
-:param command: the command to send
-:param success_message: if this message appears, test succeeds
-:param failure_message: if this message appears, test fails
-"""
-_console_interaction(test, success_message, failure_message, command + 
'\r')
-
 class ConsoleMixIn():
 """Contains utilities for interacting with a guest via Console."""
 
@@ -143,6 +127,19 @@ def exec_command(self, command):
 """
 _console_interaction(self, None, None, command + '\r')
 
+def exec_command_and_wait_for_pattern(self, command,
+  success_message, 
failure_message=None):
+"""
+Send a command to a console (appending CRLF characters), then wait
+for success_message to appear on the console, while logging the.
+content. Mark the test as failed if failure_message is found instead.
+
+:param command: the command to send
+:param success_message: if this message appears, test succeeds
+:param failure_message: if this message appears, test fails
+"""
+_console_interaction(self, success_message, failure_message, command + 
'\r')
+
 def interrupt_interactive_console_until_pattern(self, success_message,
 failure_message=None,
 interrupt_string='\r'):
diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 10317b232b..50e0a3fe79 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -16,7 +16,6 @@
 from avocado import skip
 from avocado import skipUnless
 from avocado_qemu import Test
-from avocado_qemu import exec_command_and_wait_for_pattern
 from avocado_qemu import ConsoleMixIn
 from avocado_qemu import wait_for_console_pattern
 from avocado.utils import process
@@ -223,12 +222,12 @@ def test_mips_malta_cpio(self):
 self.vm.launch()
 self.wait_for_console_pattern('Boot successful.')
 
-exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
-'BogoMIPS')
-exec_command_and_wait_for_pattern(self, 'uname -a',
-'Debian')
-exec_command_and_wait_for_pattern(self, 'reboot',
-'reboot: Restarting system')
+self.exec_command_and_wait_for_pattern('cat /proc/cpuinfo',
+   'BogoMIPS')
+self.exec_command_and_wait_for_pattern('uname -a',
+   'Debian')
+self.exec_command_and_wait_for_pattern('reboot',
+   'reboot: Restarting system')
 # Wait for VM to shut down gracefully
 self.vm.wait()
 
@@ -265,12 +264,12 @@ def test_mips64el_malta_5KEc_cpio(self):
 self.vm.launch()
 wait_for_console_pattern(self, 'Boot successful.')
 
-exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
-'MIPS 5KE')
-exec_command_and_wait_for_pattern(self, 'uname -a',
-'3.19.3.mtoman.20150408')
-exec_command_and_wait_for_pattern(self, 'reboot',
-'reboot: 

[PATCH 0/7] tests/acceptance: Introducing the ConsoleMixIn

[Wainer dos Santos Moschetta]

The avocado_qemu package provides the following methods to interact with the
guest via console, which are mainly used on the acceptance boot tests:

 exec_command(), exec_command_and_wait_for_pattern(), 
wait_for_console_pattern(),
 interrupt_interactive_console_until_pattern()

Those methods are loosely defined in avocado_qemu/__init__.py. Because that 
file is expected to
grow, I thought that for the sake of keeping it organized it would be better to 
logically group
them. So in this series I create the ConsoleMixIn class to be the new home for 
the console
methods. An alternative approach could be to create a separated package, 
however because
they are just a few methods at the moment, I prefered not to break avocado_qemu 
into smaller pieces.

As the "MixIn" in the name implies, the class is meant to be used as a mixin on 
the test class. Here
I am following an idea introduced by Cleber in [1].

This series was tested on CI 
(https://gitlab.com/wainersm/qemu/-/pipelines/296412039)

[1] http://next.patchew.org/QEMU/20210412044644.55083-1-cr...@redhat.com/

Wainer dos Santos Moschetta (7):
  tests/acceptance: Introduce the ConsoleMixIn class
  tests/acceptance: Move exec_command to ConsoleMixIn
  tests/acceptance: Move exec_command_and_wait_for_pattern to
ConsoleMixIn
  tests/acceptance: Sun4uMachine: Remove dependency to LinuxKernelTest
  tests/acceptance: replay_kernel: Remove unused
wait_for_console_pattern
  tests/acceptance: Move wait_for_console_pattern to ConsoleMixIn
  tests/acceptance: Move _console_interaction to ConsoleMixIn

 tests/acceptance/avocado_qemu/__init__.py| 161 +--
 tests/acceptance/boot_linux_console.py   | 133 ---
 tests/acceptance/boot_xen.py |   5 +-
 tests/acceptance/linux_ssh_mips_malta.py |   8 +-
 tests/acceptance/machine_arm_canona1100.py   |   6 +-
 tests/acceptance/machine_arm_integratorcp.py |   8 +-
 tests/acceptance/machine_arm_n8x0.py |   6 +-
 tests/acceptance/machine_microblaze.py   |   8 +-
 tests/acceptance/machine_mips_loongson3v.py  |   6 +-
 tests/acceptance/machine_mips_malta.py   |   6 +-
 tests/acceptance/machine_ppc.py  |  10 +-
 tests/acceptance/machine_rx_gdbsim.py|  15 +-
 tests/acceptance/machine_s390_ccw_virtio.py  |  79 +
 tests/acceptance/machine_sparc64_sun4u.py|  13 +-
 tests/acceptance/machine_sparc_leon3.py  |   8 +-
 tests/acceptance/multiprocess.py |  14 +-
 tests/acceptance/ppc_prep_40p.py |  16 +-
 tests/acceptance/replay_kernel.py|   1 -
 tests/acceptance/virtio-gpu.py   |  16 +-
 tests/acceptance/virtiofs_submounts.py   |   1 -
 20 files changed, 249 insertions(+), 271 deletions(-)

-- 
2.29.2

[PATCH 1/7] tests/acceptance: Introduce the ConsoleMixIn class

[Wainer dos Santos Moschetta]

This created the ConsoleMixIn class to wrap the methods related with console
interaction with the guest that currently are loose in the avocado_qemu
package. It should be used as a mixin on the test classes.

At this point only the interrupt_interactive_console_until_pattern() was moved
to ConsoleMixIn. This method is only used in boot_linux_console.py tests, so
there was needed to adapt them.

Signed-off-by: Wainer dos Santos Moschetta 
---
 tests/acceptance/avocado_qemu/__init__.py | 52 +++
 tests/acceptance/boot_linux_console.py| 10 ++---
 2 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/tests/acceptance/avocado_qemu/__init__.py 
b/tests/acceptance/avocado_qemu/__init__.py
index 83b1741ec8..6f4e0edfa3 100644
--- a/tests/acceptance/avocado_qemu/__init__.py
+++ b/tests/acceptance/avocado_qemu/__init__.py
@@ -101,32 +101,6 @@ def _console_interaction(test, success_message, 
failure_message,
 (failure_message, success_message)
 test.fail(fail)
 
-def interrupt_interactive_console_until_pattern(test, success_message,
-failure_message=None,
-interrupt_string='\r'):
-"""
-Keep sending a string to interrupt a console prompt, while logging the
-console output. Typical use case is to break a boot loader prompt, such:
-
-Press a key within 5 seconds to interrupt boot process.
-5
-4
-3
-2
-1
-Booting default image...
-
-:param test: an Avocado test containing a VM that will have its console
- read and probed for a success or failure message
-:type test: :class:`avocado_qemu.Test`
-:param success_message: if this message appears, test succeeds
-:param failure_message: if this message appears, test fails
-:param interrupt_string: a string to send to the console before trying
- to read a new line
-"""
-_console_interaction(test, success_message, failure_message,
- interrupt_string, True)
-
 def wait_for_console_pattern(test, success_message, failure_message=None,
  vm=None):
 """
@@ -168,6 +142,32 @@ def exec_command_and_wait_for_pattern(test, command,
 """
 _console_interaction(test, success_message, failure_message, command + 
'\r')
 
+class ConsoleMixIn():
+"""Contains utilities for interacting with a guest via Console."""
+
+def interrupt_interactive_console_until_pattern(self, success_message,
+failure_message=None,
+interrupt_string='\r'):
+"""
+Keep sending a string to interrupt a console prompt, while logging the
+console output. Typical use case is to break a boot loader prompt, 
such:
+
+Press a key within 5 seconds to interrupt boot process.
+5
+4
+3
+2
+1
+Booting default image...
+
+:param success_message: if this message appears, test succeeds
+:param failure_message: if this message appears, test fails
+:param interrupt_string: a string to send to the console before trying
+to read a new line
+"""
+_console_interaction(self, success_message, failure_message,
+ interrupt_string, True)
+
 class Test(avocado.Test):
 def _get_unique_tag_val(self, tag_name):
 """
diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 1ca32ecf25..10317b232b 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -17,7 +17,7 @@
 from avocado import skipUnless
 from avocado_qemu import Test
 from avocado_qemu import exec_command_and_wait_for_pattern
-from avocado_qemu import interrupt_interactive_console_until_pattern
+from avocado_qemu import ConsoleMixIn
 from avocado_qemu import wait_for_console_pattern
 from avocado.utils import process
 from avocado.utils import archive
@@ -45,7 +45,7 @@ def image_pow2ceil_expand(path):
 with open(path, 'ab+') as fd:
 fd.truncate(size_aligned)
 
-class LinuxKernelTest(Test):
+class LinuxKernelTest(Test, ConsoleMixIn):
 KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
 
 def wait_for_console_pattern(self, success_message, vm=None):
@@ -626,8 +626,8 @@ def test_arm_quanta_gsj(self):
 self.wait_for_console_pattern('>Device: Poleg BMC NPCM730')
 self.wait_for_console_pattern('>Skip DDR init.')
 self.wait_for_console_pattern('U-Boot ')
-interrupt_interactive_console_until_pattern(
-self, 'Hit any key to stop autoboot:', 'U-Boot>')
+self.interrupt_interactive_console_until_pattern(
+'Hit any key to stop autoboot:', 

Re: [PATCH v3 26/30] target/ppc: Implement PNOP

[Philippe Mathieu-Daudé]

On 4/30/21 3:15 AM, Richard Henderson wrote:
> Signed-off-by: Richard Henderson 
> ---
>  target/ppc/insn32.decode   |  2 ++
>  target/ppc/insn64.decode   | 11 +++
>  target/ppc/translate/fixedpoint-impl.c.inc |  5 +
>  3 files changed, 18 insertions(+)
> 
> diff --git a/target/ppc/insn32.decode b/target/ppc/insn32.decode
> index 52d9b355d4..2ed25c7e67 100644
> --- a/target/ppc/insn32.decode
> +++ b/target/ppc/insn32.decode
> @@ -17,6 +17,8 @@
>  # License along with this library; if not, see 
> .
>  #
>  
> +
> +

> +static bool trans_NOP(DisasContext *ctx, arg_NOP *a)

Matter of taste, I'd rather use 'arg_empty'.

> +{
> +return true;
> +}
> 

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v3 02/30] decodetree: More use of f-strings

[Philippe Mathieu-Daudé]

On 4/30/21 3:15 AM, Richard Henderson wrote:
> Signed-off-by: Richard Henderson 
> ---
>  scripts/decodetree.py | 50 ---
>  1 file changed, 23 insertions(+), 27 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v3 01/30] decodetree: Introduce whex and whexC helpers

[Philippe Mathieu-Daudé]

On 4/30/21 3:15 AM, Richard Henderson wrote:
> Form a hex constant of the appropriate insnwidth.
> Begin using f-strings on changed lines.
> 
> Signed-off-by: Richard Henderson 
> ---
>  scripts/decodetree.py | 66 +--
>  1 file changed, 38 insertions(+), 28 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

[PATCH 5/7] tests/acceptance: replay_kernel: Remove unused wait_for_console_pattern

[Wainer dos Santos Moschetta]

The ReplayKernelBase class uses the wait_for_console_pattern from its
parent LinuxKernelTest class, thus it doesn't need to import that method
from avocado_qemu.

Signed-off-by: Wainer dos Santos Moschetta 
---
 tests/acceptance/replay_kernel.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/acceptance/replay_kernel.py 
b/tests/acceptance/replay_kernel.py
index 71facdaa75..6d4e202723 100644
--- a/tests/acceptance/replay_kernel.py
+++ b/tests/acceptance/replay_kernel.py
@@ -17,7 +17,6 @@
 from avocado import skip
 from avocado import skipIf
 from avocado import skipUnless
-from avocado_qemu import wait_for_console_pattern
 from avocado.utils import archive
 from avocado.utils import process
 from boot_linux_console import LinuxKernelTest
-- 
2.29.2

[PULL 42/42] target/riscv: Fix the RV64H decode comment

[Alistair Francis]

BugLink: https://gitlab.com/qemu-project/qemu/-/issues/47
Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Message-id: 
024ce841221c1d15c74b253512428c4baca7e4ba.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/insn32.decode | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index fecf0f15d5..8901ba1e1b 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -288,7 +288,7 @@ hsv_w   0110101  .  . 100 0 1110011 @r2_s
 hfence_gvma 0110001  .  . 000 0 1110011 @hfence_gvma
 hfence_vvma 0010001  .  . 000 0 1110011 @hfence_vvma
 
-# *** RV32H Base Instruction Set ***
+# *** RV64H Base Instruction Set ***
 hlv_wu0110100  1   . 100 . 1110011 @r2
 hlv_d 0110110  0   . 100 . 1110011 @r2
 hsv_d 0110111  .   . 100 0 1110011 @r2_s
-- 
2.31.1

[PATCH 2/7] tests/acceptance: Move exec_command to ConsoleMixIn

[Wainer dos Santos Moschetta]

This moved exec_command() to ConsoleMixIn class.

Only the multiprocess.py file were touched by that change, so its tests
were adapted.

Signed-off-by: Wainer dos Santos Moschetta 
---
 tests/acceptance/avocado_qemu/__init__.py | 22 ++
 tests/acceptance/multiprocess.py  |  6 +++---
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/tests/acceptance/avocado_qemu/__init__.py 
b/tests/acceptance/avocado_qemu/__init__.py
index 6f4e0edfa3..4d3b869765 100644
--- a/tests/acceptance/avocado_qemu/__init__.py
+++ b/tests/acceptance/avocado_qemu/__init__.py
@@ -114,18 +114,6 @@ def wait_for_console_pattern(test, success_message, 
failure_message=None,
 """
 _console_interaction(test, success_message, failure_message, None, vm=vm)
 
-def exec_command(test, command):
-"""
-Send a command to a console (appending CRLF characters), while logging
-the content.
-
-:param test: an Avocado test containing a VM.
-:type test: :class:`avocado_qemu.Test`
-:param command: the command to send
-:type command: str
-"""
-_console_interaction(test, None, None, command + '\r')
-
 def exec_command_and_wait_for_pattern(test, command,
   success_message, failure_message=None):
 """
@@ -145,6 +133,16 @@ def exec_command_and_wait_for_pattern(test, command,
 class ConsoleMixIn():
 """Contains utilities for interacting with a guest via Console."""
 
+def exec_command(self, command):
+"""
+Send a command to a console (appending CRLF characters), while logging
+the content.
+
+:param command: the command to send
+:type command: str
+"""
+_console_interaction(self, None, None, command + '\r')
+
 def interrupt_interactive_console_until_pattern(self, success_message,
 failure_message=None,
 interrupt_string='\r'):
diff --git a/tests/acceptance/multiprocess.py b/tests/acceptance/multiprocess.py
index 96627f022a..41d3e51164 100644
--- a/tests/acceptance/multiprocess.py
+++ b/tests/acceptance/multiprocess.py
@@ -9,10 +9,10 @@
 
 from avocado_qemu import Test
 from avocado_qemu import wait_for_console_pattern
-from avocado_qemu import exec_command
+from avocado_qemu import ConsoleMixIn
 from avocado_qemu import exec_command_and_wait_for_pattern
 
-class Multiprocess(Test):
+class Multiprocess(Test, ConsoleMixIn):
 """
 :avocado: tags=multiprocess
 """
@@ -59,7 +59,7 @@ def do_test(self, kernel_url, initrd_url, kernel_command_line,
 self.vm.launch()
 wait_for_console_pattern(self, 'as init process',
  'Kernel panic - not syncing')
-exec_command(self, 'mount -t sysfs sysfs /sys')
+self.exec_command('mount -t sysfs sysfs /sys')
 exec_command_and_wait_for_pattern(self,
   'cat /sys/bus/pci/devices/*/uevent',
   'PCI_ID=1000:0012')
-- 
2.29.2

[PULL 41/42] target/riscv: Consolidate RV32/64 16-bit instructions

[Alistair Francis]

This patch removes the insn16-32.decode and insn16-64.decode decode
files and consolidates the instructions into the general RISC-V
insn16.decode decode tree.

This means that all of the instructions are avaliable in both the 32-bit
and 64-bit builds. This also means that we run a check to ensure we are
running a 64-bit softmmu before we execute the 64-bit only instructions.
This allows us to include the 32-bit instructions in the 64-bit build,
while also ensuring that 32-bit only software can not execute the
instructions.

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Message-id: 
01e2b0efeae311adc7ebf133c2cde6a7a37224d7.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/insn16-32.decode   | 28 ---
 target/riscv/insn16-64.decode   | 36 -
 target/riscv/insn16.decode  | 30 +
 target/riscv/insn_trans/trans_rvi.c.inc |  6 +
 target/riscv/meson.build| 11 +++-
 5 files changed, 39 insertions(+), 72 deletions(-)
 delete mode 100644 target/riscv/insn16-32.decode
 delete mode 100644 target/riscv/insn16-64.decode

diff --git a/target/riscv/insn16-32.decode b/target/riscv/insn16-32.decode
deleted file mode 100644
index 0819b17028..00
--- a/target/riscv/insn16-32.decode
+++ /dev/null
@@ -1,28 +0,0 @@
-#
-# RISC-V translation routines for the RVXI Base Integer Instruction Set.
-#
-# Copyright (c) 2018 Peer Adelt, peer.ad...@hni.uni-paderborn.de
-#Bastian Koppelmann, kbast...@mail.uni-paderborn.de
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2 or later, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program.  If not, see .
-
-# *** RV32C Standard Extension (Quadrant 0) ***
-flw   011  ... ... .. ... 00 @cl_w
-fsw   111  ... ... .. ... 00 @cs_w
-
-# *** RV32C Standard Extension (Quadrant 1) ***
-jal   001 ... 01 @cjrd=1  # C.JAL
-
-# *** RV32C Standard Extension (Quadrant 2) ***
-flw   011 .  .  . 10 @c_lwsp
-fsw   111 .  .  . 10 @c_swsp
diff --git a/target/riscv/insn16-64.decode b/target/riscv/insn16-64.decode
deleted file mode 100644
index 672e1e916f..00
--- a/target/riscv/insn16-64.decode
+++ /dev/null
@@ -1,36 +0,0 @@
-#
-# RISC-V translation routines for the RVXI Base Integer Instruction Set.
-#
-# Copyright (c) 2018 Peer Adelt, peer.ad...@hni.uni-paderborn.de
-#Bastian Koppelmann, kbast...@mail.uni-paderborn.de
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2 or later, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program.  If not, see .
-
-# *** RV64C Standard Extension (Quadrant 0) ***
-ld011  ... ... .. ... 00 @cl_d
-sd111  ... ... .. ... 00 @cs_d
-
-# *** RV64C Standard Extension (Quadrant 1) ***
-{
-  illegal 001 -  0  - 01 # c.addiw, RES rd=0
-  addiw   001 .  .  . 01 @ci
-}
-subw  100 1 11 ... 00 ... 01 @cs_2
-addw  100 1 11 ... 01 ... 01 @cs_2
-
-# *** RV64C Standard Extension (Quadrant 2) ***
-{
-  illegal 011 -  0  - 10 # c.ldsp, RES rd=0
-  ld  011 .  .  . 10 @c_ldsp
-}
-sd111 .  .  . 10 @c_sdsp
diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
index 1cb93876fe..2e9212663c 100644
--- a/target/riscv/insn16.decode
+++ b/target/riscv/insn16.decode
@@ -92,6 +92,16 @@ lw010  ... ... .. ... 00 @cl_w
 fsd   101  ... ... .. ... 00 @cs_d
 sw110  ... ... .. ... 00 @cs_w
 
+# *** RV32C and RV64C specific Standard Extension (Quadrant 0) ***
+{
+  ld  011  ... ... .. ... 00 @cl_d
+  flw 011  ... ... .. ... 00 @cl_w
+}
+{
+  sd  111  ... ... .. ... 00 @cs_d
+  fsw 111  ... ... .. ... 00 @cs_w
+}
+
 # *** RV32/64C Standard Extension (Quadrant 1) ***
 addi  000 .  .  . 01 @ci
 addi  010 .  .  . 01 @c_li
@@ 

Re: [PATCH v3 20/30] target/ppc: Mark helper_raise_exception* as noreturn

[Philippe Mathieu-Daudé]

On 4/30/21 3:15 AM, Richard Henderson wrote:
> Signed-off-by: Richard Henderson 
> ---
>  target/ppc/helper.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v3 22/30] target/ppc: Introduce macros to check isa extensions

[Philippe Mathieu-Daudé]

On 4/30/21 3:15 AM, Richard Henderson wrote:
> These will be used by the decodetree trans_* functions
> to early-exit when the instruction set is not enabled.
> 
> Signed-off-by: Richard Henderson 
> ---
>  target/ppc/translate.c | 26 ++
>  1 file changed, 26 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé 

Re: Let's remove some deprecated stuff

[Alistair Francis]

On Tue, May 4, 2021 at 1:13 AM Paolo Bonzini  wrote:
>
> On 03/05/21 09:12, Alistair Francis wrote:
> >> deprecated.rst is mainly thought for the things that only have been marked
> >> as deprecated, but not changed yet. Once it's done, the items normally get
> >> moved to docs/system/removed-features.rst instead.
> > Too easy, I'll move it there instead.
>
> Can you move the description to docs/system/target-riscv.rst?  The
> switch from ``bios none`` to ``-bios default`` in 5.1 can be placed in a
> footnote if desirable, but the documentation of ``-bios`` is worth
> keeping in a more prominent place.

Good idea. I have sent a patch that adds a line to
`docs/system/removed-features.rst` and the rest of the information is
in the RISC-V documentation.

https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg00789.html

Alistair

>
> Paolo
>

[PULL 39/42] target/riscv: Remove an unused CASE_OP_32_64 macro

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
4853459564af35a6690120c74ad892f60cec35ff.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/translate.c | 6 --
 1 file changed, 6 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index a596f80f20..a1f794ffda 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -67,12 +67,6 @@ typedef struct DisasContext {
 CPUState *cs;
 } DisasContext;
 
-#ifdef TARGET_RISCV64
-#define CASE_OP_32_64(X) case X: case glue(X, W)
-#else
-#define CASE_OP_32_64(X) case X
-#endif
-
 static inline bool has_ext(DisasContext *ctx, uint32_t ext)
 {
 return ctx->misa & ext;
-- 
2.31.1

[PATCH v1 1/1] docs/system: Move the RISC-V -bios information to removed

[Alistair Francis]

QEMU 5.1 changed the behaviour of the default boot for the RISC-V virt
and sifive_u machines. This patch moves that change from the
deprecated.rst file to the removed-features.rst file and the
target-riscv.rst.

Signed-off-by: Alistair Francis 
---
 docs/system/deprecated.rst   | 19 ---
 docs/system/removed-features.rst |  5 +
 docs/system/target-riscv.rst | 13 -
 3 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 80cae86252..dd83c95211 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -52,25 +52,6 @@ pcspk-audiodev=``.
 ``tty`` and ``parport`` are aliases that will be removed. Instead, the
 actual backend names ``serial`` and ``parallel`` should be used.
 
-RISC-V ``-bios`` (since 5.1)
-
-
-QEMU 4.1 introduced support for the -bios option in QEMU for RISC-V for the
-RISC-V virt machine and sifive_u machine. QEMU 4.1 had no changes to the
-default behaviour to avoid breakages.
-
-QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios 
default``.
-
-QEMU 5.1 has three options:
- 1. ``-bios default`` - This is the current default behavior if no -bios option
-  is included. This option will load the default OpenSBI firmware 
automatically.
-  The firmware is included with the QEMU release and no user interaction is
-  required. All a user needs to do is specify the kernel they want to boot
-  with the -kernel option
- 2. ``-bios none`` - QEMU will not automatically load any firmware. It is up
-  to the user to load all the images they need.
- 3. ``-bios `` - Tells QEMU to load the specified file as the firmwrae.
-
 Short-form boolean options (since 6.0)
 ''
 
diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
index 29e90601a5..747a763b37 100644
--- a/docs/system/removed-features.rst
+++ b/docs/system/removed-features.rst
@@ -126,6 +126,11 @@ devices.  Drives the board doesn't pick up can no longer 
be used with
 This option was undocumented and not used in the field.
 Use `-device usb-ccid`` instead.
 
+RISC-V firmware not booted by default (removed in 5.1)
+''
+
+QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios default``
+for the RISC-V ``virt`` machine and ``sifive_u`` machine.
 
 QEMU Machine Protocol (QMP) commands
 
diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index 8d5946fbbb..0001c55fca 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -69,5 +69,16 @@ undocumented; you can get a complete list by running
riscv/microchip-icicle-kit
riscv/sifive_u
 
-RISC-V CPU features
+RISC-V CPU firmware
 ---
+
+When using the ``sifive_u`` or ``virt`` machine there are three different
+firmware boot options:
+ 1. ``-bios default`` - This is the default behaviour if no -bios option
+  is included. This option will load the default OpenSBI firmware 
automatically.
+  The firmware is included with the QEMU release and no user interaction is
+  required. All a user needs to do is specify the kernel they want to boot
+  with the -kernel option
+ 2. ``-bios none`` - QEMU will not automatically load any firmware. It is up
+  to the user to load all the images they need.
+ 3. ``-bios `` - Tells QEMU to load the specified file as the firmware.
-- 
2.31.1

[PULL 34/42] target/riscv: Remove the hardcoded SSTATUS_SD macro

[Alistair Francis]

This also ensures that the SD bit is not writable.

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
9ea842309f0fd7adff172790f5b5fc058b40f2f1.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/cpu_bits.h | 6 --
 target/riscv/csr.c  | 9 -
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 24d89939a0..3a0e79e545 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -403,12 +403,6 @@
 #define SSTATUS32_SD0x8000
 #define SSTATUS64_SD0x8000ULL
 
-#if defined(TARGET_RISCV32)
-#define SSTATUS_SD SSTATUS32_SD
-#elif defined(TARGET_RISCV64)
-#define SSTATUS_SD SSTATUS64_SD
-#endif
-
 /* hstatus CSR bits */
 #define HSTATUS_VSBE 0x0020
 #define HSTATUS_GVA  0x0040
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 97ceff718f..41951a0a84 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -459,7 +459,7 @@ static const target_ulong delegable_excps =
 (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT));
 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
 SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
-SSTATUS_SUM | SSTATUS_MXR | SSTATUS_SD;
+SSTATUS_SUM | SSTATUS_MXR;
 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
 static const target_ulong hip_writable_mask = MIP_VSSIP;
 static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | 
MIP_VSEIP;
@@ -788,6 +788,13 @@ static RISCVException read_sstatus(CPURISCVState *env, int 
csrno,
target_ulong *val)
 {
 target_ulong mask = (sstatus_v1_10_mask);
+
+if (riscv_cpu_is_32bit(env)) {
+mask |= SSTATUS32_SD;
+} else {
+mask |= SSTATUS64_SD;
+}
+
 *val = env->mstatus & mask;
 return RISCV_EXCP_NONE;
 }
-- 
2.31.1

[PULL 33/42] target/riscv: Remove the hardcoded RVXLEN macro

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
a07bc0c6dc4958681b4f93cbc5d0acc31ed3344a.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/cpu.h | 6 --
 target/riscv/cpu.c | 6 +-
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index add734bbbd..7e879fb9ca 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -54,12 +54,6 @@
 #define RV32 ((target_ulong)1 << (TARGET_LONG_BITS - 2))
 #define RV64 ((target_ulong)2 << (TARGET_LONG_BITS - 2))
 
-#if defined(TARGET_RISCV32)
-#define RVXLEN RV32
-#elif defined(TARGET_RISCV64)
-#define RVXLEN RV64
-#endif
-
 #define RV(x) ((target_ulong)1 << (x - 'A'))
 
 #define RVI RV('I')
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 04ac03f8c9..3191fd0082 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -147,7 +147,11 @@ static void set_resetvec(CPURISCVState *env, target_ulong 
resetvec)
 static void riscv_any_cpu_init(Object *obj)
 {
 CPURISCVState *env = _CPU(obj)->env;
-set_misa(env, RVXLEN | RVI | RVM | RVA | RVF | RVD | RVC | RVU);
+#if defined(TARGET_RISCV32)
+set_misa(env, RV32 | RVI | RVM | RVA | RVF | RVD | RVC | RVU);
+#elif defined(TARGET_RISCV64)
+set_misa(env, RV64 | RVI | RVM | RVA | RVF | RVD | RVC | RVU);
+#endif
 set_priv_version(env, PRIV_VERSION_1_11_0);
 }
 
-- 
2.31.1

Re: [RFC PATCH v2 0/2] hw/ppc: code motion to compile without TCG

[Fabiano Rosas]

"Lucas Mateus Castro (alqotel)"  writes:

> After the feedback from v1 I reworked the patch with suggested ideas and
> this version has less duplicated code and is overall simpler.
>
> This patch series is still a WIP, there are still 2 main problems I am
> trying to solve, I'll mention them in their respective patches.
>
> The aim of these patches is to progress toward enabling disable-tcg on
> PPC by solving errors in hw/ppc with that option.
>
> As a WIP comments are welcome.
>
> Lucas Mateus Castro (alqotel) (2):
>   target/ppc: Moved functions out of mmu-hash64
>   hw/ppc: Moved TCG code to spapr_hcall_tcg
>
>  hw/ppc/meson.build   |   3 +
>  hw/ppc/spapr.c   |   1 +
>  hw/ppc/spapr_caps.c  |   1 +
>  hw/ppc/spapr_cpu_core.c  |   1 +
>  hw/ppc/spapr_hcall.c | 301 ++
>  hw/ppc/spapr_hcall_tcg.c | 343 +++
>  hw/ppc/spapr_rtas.c  |   1 +
>  target/ppc/meson.build   |   1 +
>  target/ppc/mmu-hash64.c  |  81 +
>  target/ppc/mmu-hash64.h  |   6 -
>  target/ppc/mmu-misc.c|  86 ++
>  target/ppc/mmu-misc.h|  22 +++
>  12 files changed, 478 insertions(+), 369 deletions(-)
>  create mode 100644 hw/ppc/spapr_hcall_tcg.c
>  create mode 100644 target/ppc/mmu-misc.c
>  create mode 100644 target/ppc/mmu-misc.h

This is the list of hypercalls registered with spapr_register_hypercall
and whether they are implemented by KVM HV, KVM PR or none. I also list
whether the KVM hcall uses the QEMU implementation as a fallback. Maybe
it will be helpful to this discussion.

(This is from just looking at the code, so take it with a grain of salt)

H_ADD_LOGICAL_LAN_BUFFER  - not impl. by KVM
H_CHANGE_LOGICAL_LAN_MAC  - not impl. by KVM
H_ENABLE_CRQ  - not impl. by KVM
H_FREE_CRQ- not impl. by KVM
H_FREE_LOGICAL_LAN- not impl. by KVM
H_GET_CPU_CHARACTERISTICS - not impl. by KVM
H_GET_TERM_CHAR   - not impl. by KVM
H_HOME_NODE_ASSOCIATIVITY - not impl. by KVM
H_INT_ESB - not impl. by KVM
H_INT_GET_QUEUE_INFO  - not impl. by KVM
H_INT_GET_SOURCE_CONFIG   - not impl. by KVM
H_INT_GET_SOURCE_INFO - not impl. by KVM
H_INT_RESET   - not impl. by KVM
H_INT_SET_QUEUE_CONFIG- not impl. by KVM
H_INT_SET_SOURCE_CONFIG   - not impl. by KVM
H_INT_SYNC- not impl. by KVM
H_JOIN- not impl. by KVM
H_LOGICAL_CACHE_LOAD  - not impl. by KVM
H_LOGICAL_CACHE_STORE - not impl. by KVM
H_LOGICAL_DCBF- not impl. by KVM
H_LOGICAL_ICBI- not impl. by KVM
H_MULTICAST_CTRL  - not impl. by KVM
H_PUT_TERM_CHAR   - not impl. by KVM
H_REGISTER_LOGICAL_LAN- not impl. by KVM
H_REGISTER_PROC_TBL   - not impl. by KVM
H_REG_CRQ - not impl. by KVM
H_RESIZE_HPT_COMMIT   - not impl. by KVM
H_RESIZE_HPT_PREPARE  - not impl. by KVM
H_SCM_BIND_MEM- not impl. by KVM
H_SCM_READ_METADATA   - not impl. by KVM
H_SCM_UNBIND_ALL  - not impl. by KVM
H_SCM_WRITE_METADATA  - not impl. by KVM
H_SEND_CRQ- not impl. by KVM
H_SEND_LOGICAL_LAN- not impl. by KVM
H_SET_SPRG0   - not impl. by KVM
H_SIGNAL_SYS_RESET- not impl. by KVM
H_VIO_SIGNAL  - not impl. by KVM

H_CAS - not impl. by KVM | called by SLOF only
H_LOGICAL_MEMOP   - not impl. by KVM | called by SLOF only
H_TPM_COMM- not impl. by KVM | called by UV only
H_UPDATE_DT   - not impl. by KVM | called by SLOF only

H_INT_GET_OS_REPORTING_LINE - not impl. by KVM | not called by linux/SLOF/UV
H_INT_GET_QUEUE_CONFIG  - not impl. by KVM | not called by linux/SLOF/UV
H_INT_SET_OS_REPORTING_LINE - not impl. by KVM | not called by linux/SLOF/UV
H_SCM_UNBIND_MEM- not impl. by KVM | not called by linux/SLOF/UV

H_GET_TCE  - HV | not impl. by PR | QEMU fallback
H_SET_MODE - HV | not impl. by PR | QEMU fallback
H_CONFER   - HV | not impl. by PR
H_PAGE_INIT- HV | not impl. by PR
H_PROD - HV | not impl. by PR
H_RANDOM   - HV | not impl. by PR
H_READ - HV | not impl. by PR
H_REGISTER_VPA - HV | not impl. by PR
H_SET_DABR - HV | not impl. by PR
H_SET_XDABR- HV | not impl. by PR

H_CPPR - HV | PR | QEMU fallback
H_EOI  - HV | PR | QEMU fallback
H_IPI  - HV | PR | QEMU fallback
H_IPOLL- HV | PR | QEMU fallback
H_LOGICAL_CI_LOAD  - HV | PR | QEMU fallback
H_LOGICAL_CI_STORE - HV | PR | QEMU fallback
H_PUT_TCE  - HV | PR | QEMU fallback
H_PUT_TCE_INDIRECT - HV | PR | QEMU fallback
H_RTAS - HV | PR | QEMU fallback
H_STUFF_TCE- HV | PR | QEMU fallback
H_XIRR - HV | PR | QEMU fallback
H_XIRR_X   - HV | PR | QEMU fallback

H_BULK_REMOVE  - HV | PR
H_CEDE - HV | PR
H_ENTER- HV | PR
H_PROTECT  - HV | PR
H_REMOVE   - 

[PATCH 4/7] tests/acceptance: Sun4uMachine: Remove dependency to LinuxKernelTest

[Wainer dos Santos Moschetta]

The Sun4uMachine class inherit from LinuxKernelTest to effectively only use
the KERNEL_COMMON_COMMAND_LINE attribute. This change remove that unneeded
dependency, making Sun4uMachine self-content.

I took the occasion to delint the code: the unused os import was
removed, imports were reordered, and the module has a docstring now.

Signed-off-by: Wainer dos Santos Moschetta 
---
 tests/acceptance/machine_sparc64_sun4u.py | 11 +--
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/tests/acceptance/machine_sparc64_sun4u.py 
b/tests/acceptance/machine_sparc64_sun4u.py
index 458165500e..c7ad474bdc 100644
--- a/tests/acceptance/machine_sparc64_sun4u.py
+++ b/tests/acceptance/machine_sparc64_sun4u.py
@@ -1,4 +1,4 @@
-# Functional test that boots a Linux kernel and checks the console
+"""Functional test that boots a Linux kernel and checks the console"""
 #
 # Copyright (c) 2020 Red Hat, Inc.
 #
@@ -8,16 +8,15 @@
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later. See the COPYING file in the top-level directory.
 
-import os
-
-from avocado_qemu import wait_for_console_pattern
 from avocado.utils import archive
-from boot_linux_console import LinuxKernelTest
+from avocado_qemu import Test
+from avocado_qemu import wait_for_console_pattern
 
-class Sun4uMachine(LinuxKernelTest):
+class Sun4uMachine(Test):
 """Boots the Linux kernel and checks that the console is operational"""
 
 timeout = 90
+KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
 
 def test_sparc64_sun4u(self):
 """
-- 
2.29.2

[PULL 32/42] target/riscv: fix a typo with interrupt names

[Alistair Francis]

From: Emmanuel Blot 

Interrupt names have been swapped in 205377f8 and do not follow
IRQ_*_EXT definition order.

Signed-off-by: Emmanuel Blot 
Reviewed-by: Alistair Francis 
Message-id: 20210421133236.11323-1-emmanuel.b...@sifive.com
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 4bf6a00636..04ac03f8c9 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -88,8 +88,8 @@ const char * const riscv_intr_names[] = {
 "vs_timer",
 "m_timer",
 "u_external",
+"s_external",
 "vs_external",
-"h_external",
 "m_external",
 "reserved",
 "reserved",
-- 
2.31.1

[PULL 40/42] target/riscv: Consolidate RV32/64 32-bit instructions

[Alistair Francis]

This patch removes the insn32-64.decode decode file and consolidates the
instructions into the general RISC-V insn32.decode decode tree.

This means that all of the instructions are avaliable in both the 32-bit
and 64-bit builds. This also means that we run a check to ensure we are
running a 64-bit softmmu before we execute the 64-bit only instructions.
This allows us to include the 32-bit instructions in the 64-bit build,
while also ensuring that 32-bit only software can not execute the
instructions.

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Message-id: 
db709360e2be47d2f9c6483ab973fe4791aefa77.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/helper.h   | 18 +++--
 target/riscv/insn32-64.decode   | 88 -
 target/riscv/insn32.decode  | 67 ++-
 target/riscv/fpu_helper.c   | 16 ++---
 target/riscv/translate.c|  9 ++-
 target/riscv/vector_helper.c|  4 --
 target/riscv/insn_trans/trans_rva.c.inc | 14 +++-
 target/riscv/insn_trans/trans_rvd.c.inc | 17 -
 target/riscv/insn_trans/trans_rvf.c.inc |  6 +-
 target/riscv/insn_trans/trans_rvh.c.inc |  8 ++-
 target/riscv/insn_trans/trans_rvi.c.inc | 16 +++--
 target/riscv/insn_trans/trans_rvm.c.inc | 12 +++-
 target/riscv/insn_trans/trans_rvv.c.inc | 39 +--
 target/riscv/meson.build|  2 +-
 14 files changed, 166 insertions(+), 150 deletions(-)
 delete mode 100644 target/riscv/insn32-64.decode

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index e3f3f41e89..c7267593c3 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -27,12 +27,12 @@ DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, 
i64)
 DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
-DEF_HELPER_FLAGS_2(fcvt_l_s, TCG_CALL_NO_RWG, i64, env, i64)
-DEF_HELPER_FLAGS_2(fcvt_lu_s, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_l_s, TCG_CALL_NO_RWG, tl, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_lu_s, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_w, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
-DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, i64)
-DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
+DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_1(fclass_s, TCG_CALL_NO_RWG_SE, tl, i64)
 
 /* Floating Point - Double Precision */
@@ -50,12 +50,12 @@ DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, 
i64)
 DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
-DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, i64, env, i64)
-DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_d_w, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
-DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, i64)
-DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
+DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 
 /* Special functions */
@@ -241,7 +241,6 @@ DEF_HELPER_5(vlhuff_v_w, void, ptr, ptr, tl, env, i32)
 DEF_HELPER_5(vlhuff_v_d, void, ptr, ptr, tl, env, i32)
 DEF_HELPER_5(vlwuff_v_w, void, ptr, ptr, tl, env, i32)
 DEF_HELPER_5(vlwuff_v_d, void, ptr, ptr, tl, env, i32)
-#ifdef TARGET_RISCV64
 DEF_HELPER_6(vamoswapw_v_d, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vamoswapd_v_d, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vamoaddw_v_d,  void, ptr, ptr, tl, ptr, env, i32)
@@ -260,7 +259,6 @@ DEF_HELPER_6(vamominuw_v_d, void, ptr, ptr, tl, ptr, env, 
i32)
 DEF_HELPER_6(vamominud_v_d, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vamomaxuw_v_d, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vamomaxud_v_d, void, ptr, ptr, tl, ptr, env, i32)
-#endif
 DEF_HELPER_6(vamoswapw_v_w, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vamoaddw_v_w,  void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vamoxorw_v_w,  void, ptr, ptr, tl, ptr, env, i32)
diff --git a/target/riscv/insn32-64.decode b/target/riscv/insn32-64.decode
deleted file mode 100644
index 8157dee8b7..00
--- a/target/riscv/insn32-64.decode
+++ /dev/null
@@ -1,88 +0,0 @@
-#
-# RISC-V translation routines for the RV Instruction Set.
-#
-# Copyright (c) 2018 Peer Adelt, peer.ad...@hni.uni-paderborn.de
-#Bastian Koppelmann, kbast...@mail.uni-paderborn.de
-#
-# This program 

[PULL 36/42] target/riscv: Remove the hardcoded MSTATUS_SD macro

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Message-id: 
fcc125d96da941b56c817c9dd6068dc36478fc53.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/cpu_bits.h  | 10 --
 target/riscv/csr.c   | 12 ++--
 target/riscv/translate.c | 19 +--
 3 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index d738e2fdbd..6e30b312f0 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -368,16 +368,6 @@
 #define MXL_RV642
 #define MXL_RV128   3
 
-#if defined(TARGET_RISCV32)
-#define MSTATUS_SD MSTATUS32_SD
-#define MISA_MXL MISA32_MXL
-#define MXL_VAL MXL_RV32
-#elif defined(TARGET_RISCV64)
-#define MSTATUS_SD MSTATUS64_SD
-#define MISA_MXL MISA64_MXL
-#define MXL_VAL MXL_RV64
-#endif
-
 /* sstatus CSR bits */
 #define SSTATUS_UIE 0x0001
 #define SSTATUS_SIE 0x0002
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 41951a0a84..e955753441 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -538,7 +538,11 @@ static RISCVException write_mstatus(CPURISCVState *env, 
int csrno,
 
 dirty = ((mstatus & MSTATUS_FS) == MSTATUS_FS) |
 ((mstatus & MSTATUS_XS) == MSTATUS_XS);
-mstatus = set_field(mstatus, MSTATUS_SD, dirty);
+if (riscv_cpu_is_32bit(env)) {
+mstatus = set_field(mstatus, MSTATUS32_SD, dirty);
+} else {
+mstatus = set_field(mstatus, MSTATUS64_SD, dirty);
+}
 env->mstatus = mstatus;
 
 return RISCV_EXCP_NONE;
@@ -614,7 +618,11 @@ static RISCVException write_misa(CPURISCVState *env, int 
csrno,
 }
 
 /* misa.MXL writes are not supported by QEMU */
-val = (env->misa & MISA_MXL) | (val & ~MISA_MXL);
+if (riscv_cpu_is_32bit(env)) {
+val = (env->misa & MISA32_MXL) | (val & ~MISA32_MXL);
+} else {
+val = (env->misa & MISA64_MXL) | (val & ~MISA64_MXL);
+}
 
 /* flush translation cache */
 if (val != env->misa) {
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 26eccc5eb1..a596f80f20 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -78,6 +78,17 @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
 return ctx->misa & ext;
 }
 
+#ifdef TARGET_RISCV32
+# define is_32bit(ctx)  true
+#elif defined(CONFIG_USER_ONLY)
+# define is_32bit(ctx)  false
+#else
+static inline bool is_32bit(DisasContext *ctx)
+{
+return (ctx->misa & RV32) == RV32;
+}
+#endif
+
 /*
  * RISC-V requires NaN-boxing of narrower width floating point values.
  * This applies when a 32-bit value is assigned to a 64-bit FP register.
@@ -369,6 +380,8 @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong 
imm)
 static void mark_fs_dirty(DisasContext *ctx)
 {
 TCGv tmp;
+target_ulong sd;
+
 if (ctx->mstatus_fs == MSTATUS_FS) {
 return;
 }
@@ -376,13 +389,15 @@ static void mark_fs_dirty(DisasContext *ctx)
 ctx->mstatus_fs = MSTATUS_FS;
 
 tmp = tcg_temp_new();
+sd = is_32bit(ctx) ? MSTATUS32_SD : MSTATUS64_SD;
+
 tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
-tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS | MSTATUS_SD);
+tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS | sd);
 tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
 
 if (ctx->virt_enabled) {
 tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
-tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS | MSTATUS_SD);
+tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS | sd);
 tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus_hs));
 }
 tcg_temp_free(tmp);
-- 
2.31.1

[PULL 30/42] hw/riscv: Fix OT IBEX reset vector

[Alistair Francis]

From: Alexander Wagner 

The IBEX documentation [1] specifies the reset vector to be "the most
significant 3 bytes of the boot address and the reset value (0x80) as
the least significant byte".

[1] 
https://github.com/lowRISC/ibex/blob/master/doc/03_reference/exception_interrupts.rst

Signed-off-by: Alexander Wagner 
Reviewed-by: Alistair Francis 
Message-id: 20210420080008.119798-1-alexander.wag...@ulal.de
Signed-off-by: Alistair Francis 
---
 hw/riscv/opentitan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index 30dca1ee91..ddc36fc8eb 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -120,7 +120,7 @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, 
Error **errp)
 _abort);
 object_property_set_int(OBJECT(>cpus), "num-harts", ms->smp.cpus,
 _abort);
-object_property_set_int(OBJECT(>cpus), "resetvec", 0x8090, 
_abort);
+object_property_set_int(OBJECT(>cpus), "resetvec", 0x8080, 
_abort);
 sysbus_realize(SYS_BUS_DEVICE(>cpus), _abort);
 
 /* Boot ROM */
-- 
2.31.1

[PULL 35/42] target/riscv: Remove the hardcoded HGATP_MODE macro

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
665f624bfdc2e3ca64265004b07de7489c77a766.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/cpu_bits.h   | 11 ---
 target/riscv/cpu_helper.c | 24 +++-
 2 files changed, 15 insertions(+), 20 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 3a0e79e545..d738e2fdbd 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -195,17 +195,6 @@
 #define CSR_HTIMEDELTA  0x605
 #define CSR_HTIMEDELTAH 0x615
 
-#if defined(TARGET_RISCV32)
-#define HGATP_MODE   SATP32_MODE
-#define HGATP_VMID   SATP32_ASID
-#define HGATP_PPNSATP32_PPN
-#endif
-#if defined(TARGET_RISCV64)
-#define HGATP_MODE   SATP64_MODE
-#define HGATP_VMID   SATP64_ASID
-#define HGATP_PPNSATP64_PPN
-#endif
-
 /* Virtual CSRs */
 #define CSR_VSSTATUS0x200
 #define CSR_VSIE0x204
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 1018c0036d..d9defbdd34 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -413,8 +413,13 @@ static int get_physical_address(CPURISCVState *env, hwaddr 
*physical,
 }
 widened = 0;
 } else {
-base = (hwaddr)get_field(env->hgatp, HGATP_PPN) << PGSHIFT;
-vm = get_field(env->hgatp, HGATP_MODE);
+if (riscv_cpu_is_32bit(env)) {
+base = (hwaddr)get_field(env->hgatp, SATP32_PPN) << PGSHIFT;
+vm = get_field(env->hgatp, SATP32_MODE);
+} else {
+base = (hwaddr)get_field(env->hgatp, SATP64_PPN) << PGSHIFT;
+vm = get_field(env->hgatp, SATP64_MODE);
+}
 widened = 2;
 }
 /* status.SUM will be ignored if execute on background */
@@ -618,16 +623,17 @@ static void raise_mmu_exception(CPURISCVState *env, 
target_ulong address,
 bool first_stage, bool two_stage)
 {
 CPUState *cs = env_cpu(env);
-int page_fault_exceptions;
+int page_fault_exceptions, vm;
+
 if (first_stage) {
-page_fault_exceptions =
-get_field(env->satp, SATP_MODE) != VM_1_10_MBARE &&
-!pmp_violation;
+vm = get_field(env->satp, SATP_MODE);
+} else if (riscv_cpu_is_32bit(env)) {
+vm = get_field(env->hgatp, SATP32_MODE);
 } else {
-page_fault_exceptions =
-get_field(env->hgatp, HGATP_MODE) != VM_1_10_MBARE &&
-!pmp_violation;
+vm = get_field(env->hgatp, SATP64_MODE);
 }
+page_fault_exceptions = vm != VM_1_10_MBARE && !pmp_violation;
+
 switch (access_type) {
 case MMU_INST_FETCH:
 if (riscv_cpu_virt_enabled(env) && !first_stage) {
-- 
2.31.1

[PULL 29/42] target/riscv: fix exception index on instruction access fault

[Alistair Francis]

From: Emmanuel Blot 

When no MMU is used and the guest code attempts to fetch an instruction
from an invalid memory location, the exception index defaults to a data
load access fault, rather an instruction access fault.

Signed-off-by: Emmanuel Blot 
Reviewed-by: Alistair Francis 
Message-id: fb9ea197-b018-4879-ab0f-922c2047a...@sifive.com
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu_helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 659ca8a173..1018c0036d 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -694,8 +694,10 @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr 
physaddr,
 
 if (access_type == MMU_DATA_STORE) {
 cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
-} else {
+} else if (access_type == MMU_DATA_LOAD) {
 cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
+} else {
+cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
 }
 
 env->badaddr = addr;
-- 
2.31.1

[PULL 28/42] target/riscv: fix vrgather macro index variable type bug

[Alistair Francis]

From: Frank Chang 

ETYPE may be type of uint64_t, thus index variable has to be declared as
type of uint64_t, too. Otherwise the value read from vs1 register may be
truncated to type of uint32_t.

Signed-off-by: Frank Chang 
Reviewed-by: Richard Henderson 
Message-id: 20210419060302.14075-1-frank.ch...@sifive.com
Signed-off-by: Alistair Francis 
---
 target/riscv/vector_helper.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 356cef8a09..4651a1e224 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -4796,7 +4796,8 @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void 
*vs2,   \
 uint32_t vlmax = env_archcpu(env)->cfg.vlen / mlen;   \
 uint32_t vm = vext_vm(desc);  \
 uint32_t vl = env->vl;\
-uint32_t index, i;\
+uint64_t index;   \
+uint32_t i;   \
   \
 for (i = 0; i < vl; i++) {\
 if (!vm && !vext_elem_mask(v0, mlen, i)) {\
@@ -4826,7 +4827,8 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, 
void *vs2, \
 uint32_t vlmax = env_archcpu(env)->cfg.vlen / mlen;   \
 uint32_t vm = vext_vm(desc);  \
 uint32_t vl = env->vl;\
-uint32_t index = s1, i;   \
+uint64_t index = s1;  \
+uint32_t i;   \
   \
 for (i = 0; i < vl; i++) {\
 if (!vm && !vext_elem_mask(v0, mlen, i)) {\
-- 
2.31.1

[PULL 31/42] fpu/softfloat: set invalid excp flag for RISC-V muladd instructions

[Alistair Francis]

From: Frank Chang 

In IEEE 754-2008 spec:
  Invalid operation exception is signaled when doing:
  fusedMultiplyAdd(0, Inf, c) or fusedMultiplyAdd(Inf, 0, c)
  unless c is a quiet NaN; if c is a quiet NaN then it is
  implementation defined whether the invalid operation exception
  is signaled.

In RISC-V Unprivileged ISA spec:
  The fused multiply-add instructions must set the invalid
  operation exception flag when the multiplicands are Inf and
  zero, even when the addend is a quiet NaN.

This commit set invalid operation execption flag for RISC-V when
multiplicands of muladd instructions are Inf and zero.

Signed-off-by: Frank Chang 
Reviewed-by: Richard Henderson 
Message-id: 20210420013150.21992-1-frank.ch...@sifive.com
Signed-off-by: Alistair Francis 
---
 fpu/softfloat-specialize.c.inc | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index 9ea318f3e2..78f699d6f8 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -627,6 +627,12 @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass 
b_cls, FloatClass c_cls,
 } else {
 return 1;
 }
+#elif defined(TARGET_RISCV)
+/* For RISC-V, InvalidOp is set when multiplicands are Inf and zero */
+if (infzero) {
+float_raise(float_flag_invalid, status);
+}
+return 3; /* default NaN */
 #elif defined(TARGET_XTENSA)
 /*
  * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
-- 
2.31.1

[PULL 26/42] target/riscv/pmp: Remove outdated comment

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
10387eec21d2f17c499a78fdba85280cab4dd27f.1618812899.git.alistair.fran...@wdc.com
---
 target/riscv/pmp.c | 4 
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index e1f5776316..78203291de 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -19,10 +19,6 @@
  * this program.  If not, see .
  */
 
-/*
- * PMP (Physical Memory Protection) is as-of-yet unused and needs testing.
- */
-
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qapi/error.h"
-- 
2.31.1

[PULL 38/42] target/riscv: Remove the unused HSTATUS_WPRI macro

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
e095b57af0d419c8ed822958f04dfc732d7beb7e.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/cpu_bits.h | 6 --
 1 file changed, 6 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index d98f3bc8bc..52640e6856 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -396,12 +396,6 @@
 #define HSTATUS32_WPRI   0xFF8FF87E
 #define HSTATUS64_WPRI   0xFF8FF87EULL
 
-#if defined(TARGET_RISCV32)
-#define HSTATUS_WPRI HSTATUS32_WPRI
-#elif defined(TARGET_RISCV64)
-#define HSTATUS_WPRI HSTATUS64_WPRI
-#endif
-
 #define HCOUNTEREN_CY(1 << 0)
 #define HCOUNTEREN_TM(1 << 1)
 #define HCOUNTEREN_IR(1 << 2)
-- 
2.31.1

[PULL 27/42] target/riscv: Add ePMP support for the Ibex CPU

[Alistair Francis]

The physical Ibex CPU has ePMP support and it's enabled for the
OpenTitan machine so let's enable ePMP support for the Ibex CPU in QEMU.

Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
d426baabab0c9361ed2e989dbe416e417a551fd1.1618812899.git.alistair.fran...@wdc.com
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 66787d019c..4bf6a00636 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -202,6 +202,7 @@ static void rv32_ibex_cpu_init(Object *obj)
 set_misa(env, RV32 | RVI | RVM | RVC | RVU);
 set_priv_version(env, PRIV_VERSION_1_10_0);
 qdev_prop_set_bit(DEVICE(obj), "mmu", false);
+qdev_prop_set_bit(DEVICE(obj), "x-epmp", true);
 }
 
 static void rv32_imafcu_nommu_cpu_init(Object *obj)
-- 
2.31.1

[PULL 19/42] docs: Add documentation for shakti_c machine

[Alistair Francis]

From: Vijai Kumar K 

Add documentation for Shakti C reference platform.

Signed-off-by: Vijai Kumar K 
Reviewed-by: Alistair Francis 
Message-id: 20210412174248.8668-1-vi...@behindbytes.com
Signed-off-by: Alistair Francis 
---
 docs/system/riscv/shakti-c.rst | 82 ++
 1 file changed, 82 insertions(+)
 create mode 100644 docs/system/riscv/shakti-c.rst

diff --git a/docs/system/riscv/shakti-c.rst b/docs/system/riscv/shakti-c.rst
new file mode 100644
index 00..a6035d42b0
--- /dev/null
+++ b/docs/system/riscv/shakti-c.rst
@@ -0,0 +1,82 @@
+Shakti C Reference Platform (``shakti_c``)
+==
+
+Shakti C Reference Platform is a reference platform based on arty a7 100t
+for the Shakti SoC.
+
+Shakti SoC is a SoC based on the Shakti C-class processor core. Shakti C
+is a 64bit RV64GCSUN processor core.
+
+For more details on Shakti SoC, please see:
+https://gitlab.com/shaktiproject/cores/shakti-soc/-/blob/master/fpga/boards/artya7-100t/c-class/README.rst
+
+For more info on the Shakti C-class core, please see:
+https://c-class.readthedocs.io/en/latest/
+
+Supported devices
+-
+
+The ``shakti_c`` machine supports the following devices:
+
+ * 1 C-class core
+ * Core Level Interruptor (CLINT)
+ * Platform-Level Interrupt Controller (PLIC)
+ * 1 UART
+
+Boot options
+
+
+The ``shakti_c`` machine can start using the standard -bios
+functionality for loading the baremetal application or opensbi.
+
+Boot the machine
+
+
+Shakti SDK
+~~
+Shakti SDK can be used to generate the baremetal example UART applications.
+
+.. code-block:: bash
+
+   $ git clone https://gitlab.com/behindbytes/shakti-sdk.git
+   $ cd shakti-sdk
+   $ make software PROGRAM=loopback TARGET=artix7_100t
+
+Binary would be generated in:
+  software/examples/uart_applns/loopback/output/loopback.shakti
+
+You could also download the precompiled example applicatons using below
+commands.
+
+.. code-block:: bash
+
+   $ wget -c 
https://gitlab.com/behindbytes/shakti-binaries/-/raw/master/sdk/shakti_sdk_qemu.zip
+   $ unzip shakti_sdk_qemu.zip
+
+Then we can run the UART example using:
+
+.. code-block:: bash
+
+   $ qemu-system-riscv64 -M shakti_c -nographic \
+  -bios path/to/shakti_sdk_qemu/loopback.shakti
+
+OpenSBI
+~~~
+We can also run OpenSBI with Test Payload.
+
+.. code-block:: bash
+
+   $ git clone https://github.com/riscv/opensbi.git -b v0.9
+   $ cd opensbi
+   $ wget -c 
https://gitlab.com/behindbytes/shakti-binaries/-/raw/master/dts/shakti.dtb
+   $ export CROSS_COMPILE=riscv64-unknown-elf-
+   $ export FW_FDT_PATH=./shakti.dtb
+   $ make PLATFORM=generic
+
+fw_payload.elf would be generated in 
build/platform/generic/firmware/fw_payload.elf.
+Boot it using the below qemu command.
+
+.. code-block:: bash
+
+   $ qemu-system-riscv64 -M shakti_c -nographic \
+  -bios path/to/fw_payload.elf
-- 
2.31.1

[PULL 25/42] target/riscv: Add a config option for ePMP

[Alistair Francis]

From: Hou Weiying 

Add a config option to enable experimental support for ePMP. This
is disabled by default and can be enabled with 'x-epmp=true'.

Signed-off-by: Hongzheng-Li 
Signed-off-by: Hou Weiying 
Signed-off-by: Myriad-Dreamin 
Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
a22ccdaf9314078bc735d3b323f966623f8af020.1618812899.git.alistair.fran...@wdc.com
Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
---
 target/riscv/cpu.h |  1 +
 target/riscv/cpu.c | 10 ++
 2 files changed, 11 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 83b315e0b2..add734bbbd 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -304,6 +304,7 @@ struct RISCVCPU {
 uint16_t elen;
 bool mmu;
 bool pmp;
+bool epmp;
 uint64_t resetvec;
 } cfg;
 };
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index e530df9385..66787d019c 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -412,6 +412,14 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 
 if (cpu->cfg.pmp) {
 set_feature(env, RISCV_FEATURE_PMP);
+
+/*
+ * Enhanced PMP should only be available
+ * on harts with PMP support
+ */
+if (cpu->cfg.epmp) {
+set_feature(env, RISCV_FEATURE_EPMP);
+}
 }
 
 set_resetvec(env, cpu->cfg.resetvec);
@@ -554,6 +562,8 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
 DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
 DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
+DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
+
 DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
 DEFINE_PROP_END_OF_LIST(),
 };
-- 
2.31.1

[PULL 37/42] target/riscv: Remove the hardcoded SATP_MODE macro

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Message-id: 
6b701769d6621f45ba1739334198e36a64fe04df.1619234854.git.alistair.fran...@wdc.com
---
 target/riscv/cpu_bits.h   | 11 ---
 target/riscv/cpu_helper.c | 32 
 target/riscv/csr.c| 19 +++
 target/riscv/monitor.c| 22 +-
 4 files changed, 56 insertions(+), 28 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 6e30b312f0..d98f3bc8bc 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -432,17 +432,6 @@
 #define SATP64_ASID 0x0000ULL
 #define SATP64_PPN  0x0FFFULL
 
-#if defined(TARGET_RISCV32)
-#define SATP_MODE   SATP32_MODE
-#define SATP_ASID   SATP32_ASID
-#define SATP_PPNSATP32_PPN
-#endif
-#if defined(TARGET_RISCV64)
-#define SATP_MODE   SATP64_MODE
-#define SATP_ASID   SATP64_ASID
-#define SATP_PPNSATP64_PPN
-#endif
-
 /* VM modes (mstatus.vm) privileged ISA 1.9.1 */
 #define VM_1_09_MBARE   0
 #define VM_1_09_MBB 1
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index d9defbdd34..968cb8046f 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -405,11 +405,21 @@ static int get_physical_address(CPURISCVState *env, 
hwaddr *physical,
 
 if (first_stage == true) {
 if (use_background) {
-base = (hwaddr)get_field(env->vsatp, SATP_PPN) << PGSHIFT;
-vm = get_field(env->vsatp, SATP_MODE);
+if (riscv_cpu_is_32bit(env)) {
+base = (hwaddr)get_field(env->vsatp, SATP32_PPN) << PGSHIFT;
+vm = get_field(env->vsatp, SATP32_MODE);
+} else {
+base = (hwaddr)get_field(env->vsatp, SATP64_PPN) << PGSHIFT;
+vm = get_field(env->vsatp, SATP64_MODE);
+}
 } else {
-base = (hwaddr)get_field(env->satp, SATP_PPN) << PGSHIFT;
-vm = get_field(env->satp, SATP_MODE);
+if (riscv_cpu_is_32bit(env)) {
+base = (hwaddr)get_field(env->satp, SATP32_PPN) << PGSHIFT;
+vm = get_field(env->satp, SATP32_MODE);
+} else {
+base = (hwaddr)get_field(env->satp, SATP64_PPN) << PGSHIFT;
+vm = get_field(env->satp, SATP64_MODE);
+}
 }
 widened = 0;
 } else {
@@ -624,14 +634,20 @@ static void raise_mmu_exception(CPURISCVState *env, 
target_ulong address,
 {
 CPUState *cs = env_cpu(env);
 int page_fault_exceptions, vm;
+uint64_t stap_mode;
+
+if (riscv_cpu_is_32bit(env)) {
+stap_mode = SATP32_MODE;
+} else {
+stap_mode = SATP64_MODE;
+}
 
 if (first_stage) {
-vm = get_field(env->satp, SATP_MODE);
-} else if (riscv_cpu_is_32bit(env)) {
-vm = get_field(env->hgatp, SATP32_MODE);
+vm = get_field(env->satp, stap_mode);
 } else {
-vm = get_field(env->hgatp, SATP64_MODE);
+vm = get_field(env->hgatp, stap_mode);
 }
+
 page_fault_exceptions = vm != VM_1_10_MBARE && !pmp_violation;
 
 switch (access_type) {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index e955753441..fe5628fea6 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -997,16 +997,27 @@ static RISCVException read_satp(CPURISCVState *env, int 
csrno,
 static RISCVException write_satp(CPURISCVState *env, int csrno,
  target_ulong val)
 {
+int vm, mask, asid;
+
 if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
 return RISCV_EXCP_NONE;
 }
-if (validate_vm(env, get_field(val, SATP_MODE)) &&
-((val ^ env->satp) & (SATP_MODE | SATP_ASID | SATP_PPN)))
-{
+
+if (riscv_cpu_is_32bit(env)) {
+vm = validate_vm(env, get_field(val, SATP32_MODE));
+mask = (val ^ env->satp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
+asid = (val ^ env->satp) & SATP32_ASID;
+} else {
+vm = validate_vm(env, get_field(val, SATP64_MODE));
+mask = (val ^ env->satp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
+asid = (val ^ env->satp) & SATP64_ASID;
+}
+
+if (vm && mask) {
 if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
 return RISCV_EXCP_ILLEGAL_INST;
 } else {
-if ((val ^ env->satp) & SATP_ASID) {
+if (asid) {
 tlb_flush(env_cpu(env));
 }
 env->satp = val;
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index e51188f919..f7e6ea72b3 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -150,9 +150,14 @@ static void mem_info_svxx(Monitor *mon, CPUArchState *env)
 target_ulong last_size;
 int last_attr;
 
-base = (hwaddr)get_field(env->satp, SATP_PPN) << PGSHIFT;
+if (riscv_cpu_is_32bit(env)) {
+base = 

[PULL 24/42] target/riscv: Implementation of enhanced PMP (ePMP)

[Alistair Francis]

From: Hou Weiying 

This commit adds support for ePMP v0.9.1.

The ePMP spec can be found in:
https://docs.google.com/document/d/1Mh_aiHYxemL0umN3GTTw8vsbmzHZ_nxZXgjgOUzbvc8

Signed-off-by: Hongzheng-Li 
Signed-off-by: Hou Weiying 
Signed-off-by: Myriad-Dreamin 
Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
fef23b885f9649a4d54e7c98b168bdec5d297bb1.1618812899.git.alistair.fran...@wdc.com
[ Changes by AF:
 - Rebase on master
 - Update to latest spec
 - Use a switch case to handle ePMP MML permissions
 - Fix a few bugs
]
Signed-off-by: Alistair Francis 
---
 target/riscv/pmp.c | 154 ++---
 1 file changed, 146 insertions(+), 8 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index e35988eec2..e1f5776316 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -90,11 +90,42 @@ static inline uint8_t pmp_read_cfg(CPURISCVState *env, 
uint32_t pmp_index)
 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 {
 if (pmp_index < MAX_RISCV_PMPS) {
-if (!pmp_is_locked(env, pmp_index)) {
-env->pmp_state.pmp[pmp_index].cfg_reg = val;
-pmp_update_rule(env, pmp_index);
+bool locked = true;
+
+if (riscv_feature(env, RISCV_FEATURE_EPMP)) {
+/* mseccfg.RLB is set */
+if (MSECCFG_RLB_ISSET(env)) {
+locked = false;
+}
+
+/* mseccfg.MML is not set */
+if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) {
+locked = false;
+}
+
+/* mseccfg.MML is set */
+if (MSECCFG_MML_ISSET(env)) {
+/* not adding execute bit */
+if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
+locked = false;
+}
+/* shared region and not adding X bit */
+if ((val & PMP_LOCK) != PMP_LOCK &&
+(val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
+locked = false;
+}
+}
 } else {
+if (!pmp_is_locked(env, pmp_index)) {
+locked = false;
+}
+}
+
+if (locked) {
 qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
+} else {
+env->pmp_state.pmp[pmp_index].cfg_reg = val;
+pmp_update_rule(env, pmp_index);
 }
 } else {
 qemu_log_mask(LOG_GUEST_ERROR,
@@ -217,6 +248,32 @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, 
target_ulong addr,
 {
 bool ret;
 
+if (riscv_feature(env, RISCV_FEATURE_EPMP)) {
+if (MSECCFG_MMWP_ISSET(env)) {
+/*
+ * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set
+ * so we default to deny all, even for M-mode.
+ */
+*allowed_privs = 0;
+return false;
+} else if (MSECCFG_MML_ISSET(env)) {
+/*
+ * The Machine Mode Lockdown (mseccfg.MML) bit is set
+ * so we can only execute code in M-mode with an applicable
+ * rule. Other modes are disabled.
+ */
+if (mode == PRV_M && !(privs & PMP_EXEC)) {
+ret = true;
+*allowed_privs = PMP_READ | PMP_WRITE;
+} else {
+ret = false;
+*allowed_privs = 0;
+}
+
+return ret;
+}
+}
+
 if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
 /*
  * Privileged spec v1.10 states if HW doesn't implement any PMP entry
@@ -294,13 +351,94 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong 
addr,
 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 
 /*
- * If the PMP entry is not off and the address is in range, do the priv
- * check
+ * Convert the PMP permissions to match the truth table in the
+ * ePMP spec.
  */
+const uint8_t epmp_operation =
+((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) |
+((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) |
+(env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) |
+((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2);
+
 if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
-*allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
-if ((mode != PRV_M) || pmp_is_locked(env, i)) {
-*allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
+/*
+ * If the PMP entry is not off and the address is in range,
+ * do the priv check
+ */
+if (!MSECCFG_MML_ISSET(env)) {
+/*
+ * If mseccfg.MML Bit is not set, do pmp priv check
+ * This will always apply to regular PMP.
+ */
+*allowed_privs = PMP_READ 

[PULL 13/42] target/riscv: Use RISCVException enum for CSR access

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
302b208f40373557fa11b351b5c9f43039ca8ea3.1617290165.git.alistair.fran...@wdc.com
---
 target/riscv/cpu.h   | 11 +++
 target/riscv/csr.c   | 37 ++---
 target/riscv/gdbstub.c   |  8 
 target/riscv/op_helper.c | 18 +-
 4 files changed, 38 insertions(+), 36 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index a7b8876ea0..842d3ab810 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -454,10 +454,13 @@ static inline void cpu_get_tb_cpu_state(CPURISCVState 
*env, target_ulong *pc,
 *pflags = flags;
 }
 
-int riscv_csrrw(CPURISCVState *env, int csrno, target_ulong *ret_value,
-target_ulong new_value, target_ulong write_mask);
-int riscv_csrrw_debug(CPURISCVState *env, int csrno, target_ulong *ret_value,
-  target_ulong new_value, target_ulong write_mask);
+RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
+   target_ulong *ret_value,
+   target_ulong new_value, target_ulong write_mask);
+RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
+ target_ulong *ret_value,
+ target_ulong new_value,
+ target_ulong write_mask);
 
 static inline void riscv_csr_write(CPURISCVState *env, int csrno,
target_ulong val)
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index f67eaf4042..f0a74f0eb8 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -1382,10 +1382,11 @@ static RISCVException write_pmpaddr(CPURISCVState *env, 
int csrno,
  * csrrc  <->  riscv_csrrw(env, csrno, ret_value, 0, value);
  */
 
-int riscv_csrrw(CPURISCVState *env, int csrno, target_ulong *ret_value,
-target_ulong new_value, target_ulong write_mask)
+RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
+   target_ulong *ret_value,
+   target_ulong new_value, target_ulong write_mask)
 {
-int ret;
+RISCVException ret;
 target_ulong old_value;
 RISCVCPU *cpu = env_archcpu(env);
 
@@ -1407,41 +1408,37 @@ int riscv_csrrw(CPURISCVState *env, int csrno, 
target_ulong *ret_value,
 
 if ((write_mask && read_only) ||
 (!env->debugger && (effective_priv < get_field(csrno, 0x300 {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 #endif
 
 /* ensure the CSR extension is enabled. */
 if (!cpu->cfg.ext_icsr) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 
 /* check predicate */
 if (!csr_ops[csrno].predicate) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 ret = csr_ops[csrno].predicate(env, csrno);
 if (ret != RISCV_EXCP_NONE) {
-return -ret;
+return ret;
 }
 
 /* execute combined read/write operation if it exists */
 if (csr_ops[csrno].op) {
-ret = csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
-if (ret != RISCV_EXCP_NONE) {
-return -ret;
-}
-return 0;
+return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
 }
 
 /* if no accessor exists then return failure */
 if (!csr_ops[csrno].read) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 /* read old value */
 ret = csr_ops[csrno].read(env, csrno, _value);
 if (ret != RISCV_EXCP_NONE) {
-return -ret;
+return ret;
 }
 
 /* write value if writable and write mask set, otherwise drop writes */
@@ -1450,7 +1447,7 @@ int riscv_csrrw(CPURISCVState *env, int csrno, 
target_ulong *ret_value,
 if (csr_ops[csrno].write) {
 ret = csr_ops[csrno].write(env, csrno, new_value);
 if (ret != RISCV_EXCP_NONE) {
-return -ret;
+return ret;
 }
 }
 }
@@ -1460,17 +1457,19 @@ int riscv_csrrw(CPURISCVState *env, int csrno, 
target_ulong *ret_value,
 *ret_value = old_value;
 }
 
-return 0;
+return RISCV_EXCP_NONE;
 }
 
 /*
  * Debugger support.  If not in user mode, set env->debugger before the
  * riscv_csrrw call and clear it after the call.
  */
-int riscv_csrrw_debug(CPURISCVState *env, int csrno, target_ulong *ret_value,
-target_ulong new_value, target_ulong write_mask)
+RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
+ target_ulong *ret_value,
+ target_ulong new_value,
+ target_ulong write_mask)
 {
-int ret;
+RISCVException ret;
 #if !defined(CONFIG_USER_ONLY)
 env->debugger = true;
 #endif
diff 

[PULL 20/42] target/riscv: Fix the PMP is locked check when using TOR

[Alistair Francis]

The RISC-V spec says:
if PMP entry i is locked and pmpicfg.A is set to TOR, writes to
pmpaddri-1 are ignored.

The current QEMU code ignores accesses to pmpaddri-1 and pmpcfgi-1 which
is incorrect.

Update the pmp_is_locked() function to not check the supporting fields
and instead enforce the lock functionality in the pmpaddr write operation.

Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
2831241458163f445a89bd59c59990247265b0c6.1618812899.git.alistair.fran...@wdc.com
---
 target/riscv/pmp.c | 26 --
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index cff020122a..a3b253bb15 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -59,16 +59,6 @@ static inline int pmp_is_locked(CPURISCVState *env, uint32_t 
pmp_index)
 return 0;
 }
 
-/* In TOR mode, need to check the lock bit of the next pmp
- * (if there is a next)
- */
-const uint8_t a_field =
-pmp_get_a_field(env->pmp_state.pmp[pmp_index + 1].cfg_reg);
-if ((env->pmp_state.pmp[pmp_index + 1u].cfg_reg & PMP_LOCK) &&
- (PMP_AMATCH_TOR == a_field)) {
-return 1;
-}
-
 return 0;
 }
 
@@ -380,7 +370,23 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t 
addr_index,
 target_ulong val)
 {
 trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
+
 if (addr_index < MAX_RISCV_PMPS) {
+/*
+ * In TOR mode, need to check the lock bit of the next pmp
+ * (if there is a next).
+ */
+if (addr_index + 1 < MAX_RISCV_PMPS) {
+uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
+
+if (pmp_cfg & PMP_LOCK &&
+PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg)) {
+qemu_log_mask(LOG_GUEST_ERROR,
+  "ignoring pmpaddr write - pmpcfg + 1 locked\n");
+return;
+}
+}
+
 if (!pmp_is_locked(env, addr_index)) {
 env->pmp_state.pmp[addr_index].addr_reg = val;
 pmp_update_rule(env, addr_index);
-- 
2.31.1

[PULL 22/42] target/riscv: Add the ePMP feature

[Alistair Francis]

The spec is avaliable at:
https://docs.google.com/document/d/1Mh_aiHYxemL0umN3GTTw8vsbmzHZ_nxZXgjgOUzbvc8

Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
28c8855c80b0388a08c3ae009f5467e2b3960ce0.1618812899.git.alistair.fran...@wdc.com
---
 target/riscv/cpu.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 842d3ab810..13a08b86f6 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -81,6 +81,7 @@
 enum {
 RISCV_FEATURE_MMU,
 RISCV_FEATURE_PMP,
+RISCV_FEATURE_EPMP,
 RISCV_FEATURE_MISA
 };
 
-- 
2.31.1

[PULL 18/42] target/riscv: Fixup saturate subtract function

[Alistair Francis]

From: LIU Zhiwei 

The overflow predication ((a - b) ^ a) & (a ^ b) & INT64_MIN is right.
However, when the predication is ture and a is 0, it should return maximum.

Signed-off-by: LIU Zhiwei 
Reviewed-by: Richard Henderson 
Reviewed-by: Alistair Francis 
Message-id: 20210212150256.885-4-zhiwei_...@c-sky.com
Signed-off-by: Alistair Francis 
---
 target/riscv/vector_helper.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index a156573d28..356cef8a09 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -2451,7 +2451,7 @@ static inline int8_t ssub8(CPURISCVState *env, int vxrm, 
int8_t a, int8_t b)
 {
 int8_t res = a - b;
 if ((res ^ a) & (a ^ b) & INT8_MIN) {
-res = a > 0 ? INT8_MAX : INT8_MIN;
+res = a >= 0 ? INT8_MAX : INT8_MIN;
 env->vxsat = 0x1;
 }
 return res;
@@ -2461,7 +2461,7 @@ static inline int16_t ssub16(CPURISCVState *env, int 
vxrm, int16_t a, int16_t b)
 {
 int16_t res = a - b;
 if ((res ^ a) & (a ^ b) & INT16_MIN) {
-res = a > 0 ? INT16_MAX : INT16_MIN;
+res = a >= 0 ? INT16_MAX : INT16_MIN;
 env->vxsat = 0x1;
 }
 return res;
@@ -2471,7 +2471,7 @@ static inline int32_t ssub32(CPURISCVState *env, int 
vxrm, int32_t a, int32_t b)
 {
 int32_t res = a - b;
 if ((res ^ a) & (a ^ b) & INT32_MIN) {
-res = a > 0 ? INT32_MAX : INT32_MIN;
+res = a >= 0 ? INT32_MAX : INT32_MIN;
 env->vxsat = 0x1;
 }
 return res;
@@ -2481,7 +2481,7 @@ static inline int64_t ssub64(CPURISCVState *env, int 
vxrm, int64_t a, int64_t b)
 {
 int64_t res = a - b;
 if ((res ^ a) & (a ^ b) & INT64_MIN) {
-res = a > 0 ? INT64_MAX : INT64_MIN;
+res = a >= 0 ? INT64_MAX : INT64_MIN;
 env->vxsat = 0x1;
 }
 return res;
-- 
2.31.1

[PULL 16/42] hw/riscv: Enable VIRTIO_VGA for RISC-V virt machine

[Alistair Francis]

imply VIRTIO_VGA for the virt machine, this fixes the following error
when specifying `-vga virtio` as a command line argument:

qemu-system-riscv64: Virtio VGA not available

Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
7ac26fafee8bd59d2a0640f3233f8ad1ab270e1e.1617367317.git.alistair.fran...@wdc.com
---
 hw/riscv/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index a0225716b5..86957ec7b0 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -32,6 +32,7 @@ config SHAKTI_C
 config RISCV_VIRT
 bool
 imply PCI_DEVICES
+imply VIRTIO_VGA
 imply TEST_DEVICES
 select GOLDFISH_RTC
 select MSI_NONBROKEN
-- 
2.31.1

[PULL 10/42] target/riscv: Use the RISCVException enum for CSR predicates

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
187261fa671c3a77cf5aa482adb2a558c02a7cad.1617290165.git.alistair.fran...@wdc.com
---
 target/riscv/cpu.h |  3 +-
 target/riscv/csr.c | 80 +-
 2 files changed, 46 insertions(+), 37 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 8079da8fa8..1dd42a6bc1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -472,7 +472,8 @@ static inline target_ulong riscv_csr_read(CPURISCVState 
*env, int csrno)
 return val;
 }
 
-typedef int (*riscv_csr_predicate_fn)(CPURISCVState *env, int csrno);
+typedef RISCVException (*riscv_csr_predicate_fn)(CPURISCVState *env,
+ int csrno);
 typedef int (*riscv_csr_read_fn)(CPURISCVState *env, int csrno,
 target_ulong *ret_value);
 typedef int (*riscv_csr_write_fn)(CPURISCVState *env, int csrno,
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index de7427d8f8..1938bdca7d 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -35,29 +35,29 @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
 }
 
 /* Predicates */
-static int fs(CPURISCVState *env, int csrno)
+static RISCVException fs(CPURISCVState *env, int csrno)
 {
 #if !defined(CONFIG_USER_ONLY)
 /* loose check condition for fcsr in vector extension */
 if ((csrno == CSR_FCSR) && (env->misa & RVV)) {
-return 0;
+return RISCV_EXCP_NONE;
 }
 if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 #endif
-return 0;
+return RISCV_EXCP_NONE;
 }
 
-static int vs(CPURISCVState *env, int csrno)
+static RISCVException vs(CPURISCVState *env, int csrno)
 {
 if (env->misa & RVV) {
-return 0;
+return RISCV_EXCP_NONE;
 }
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 
-static int ctr(CPURISCVState *env, int csrno)
+static RISCVException ctr(CPURISCVState *env, int csrno)
 {
 #if !defined(CONFIG_USER_ONLY)
 CPUState *cs = env_cpu(env);
@@ -65,7 +65,7 @@ static int ctr(CPURISCVState *env, int csrno)
 
 if (!cpu->cfg.ext_counters) {
 /* The Counters extensions is not enabled */
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 
 if (riscv_cpu_virt_enabled(env)) {
@@ -73,25 +73,25 @@ static int ctr(CPURISCVState *env, int csrno)
 case CSR_CYCLE:
 if (!get_field(env->hcounteren, HCOUNTEREN_CY) &&
 get_field(env->mcounteren, HCOUNTEREN_CY)) {
-return -RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
 case CSR_TIME:
 if (!get_field(env->hcounteren, HCOUNTEREN_TM) &&
 get_field(env->mcounteren, HCOUNTEREN_TM)) {
-return -RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
 case CSR_INSTRET:
 if (!get_field(env->hcounteren, HCOUNTEREN_IR) &&
 get_field(env->mcounteren, HCOUNTEREN_IR)) {
-return -RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
 case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
 if (!get_field(env->hcounteren, 1 << (csrno - CSR_HPMCOUNTER3)) &&
 get_field(env->mcounteren, 1 << (csrno - CSR_HPMCOUNTER3))) {
-return -RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
 }
@@ -100,93 +100,101 @@ static int ctr(CPURISCVState *env, int csrno)
 case CSR_CYCLEH:
 if (!get_field(env->hcounteren, HCOUNTEREN_CY) &&
 get_field(env->mcounteren, HCOUNTEREN_CY)) {
-return -RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
 case CSR_TIMEH:
 if (!get_field(env->hcounteren, HCOUNTEREN_TM) &&
 get_field(env->mcounteren, HCOUNTEREN_TM)) {
-return -RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
 case CSR_INSTRETH:
 if (!get_field(env->hcounteren, HCOUNTEREN_IR) &&
 get_field(env->mcounteren, HCOUNTEREN_IR)) {
-return -RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
 case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
 if (!get_field(env->hcounteren, 1 << (csrno - 

[PULL 23/42] target/riscv: Add ePMP CSR access functions

[Alistair Francis]

From: Hou Weiying 

Signed-off-by: Hongzheng-Li 
Signed-off-by: Hou Weiying 
Signed-off-by: Myriad-Dreamin 
Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
270762cb2507fba6a9eeb99a774cf49f7da9cc32.1618812899.git.alistair.fran...@wdc.com
[ Changes by AF:
 - Rebase on master
 - Fix build errors
 - Fix some style issues
]
Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
---
 target/riscv/cpu.h|  1 +
 target/riscv/pmp.h| 14 ++
 target/riscv/csr.c| 24 
 target/riscv/pmp.c| 34 ++
 target/riscv/trace-events |  3 +++
 5 files changed, 76 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 13a08b86f6..83b315e0b2 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -230,6 +230,7 @@ struct CPURISCVState {
 
 /* physical memory protection */
 pmp_table_t pmp_state;
+target_ulong mseccfg;
 
 /* machine specific rdtime callback */
 uint64_t (*rdtime_fn)(uint32_t);
diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index b82a30f0d5..a9a0b363a7 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -36,6 +36,12 @@ typedef enum {
 PMP_AMATCH_NAPOT /* Naturally aligned power-of-two region */
 } pmp_am_t;
 
+typedef enum {
+MSECCFG_MML  = 1 << 0,
+MSECCFG_MMWP = 1 << 1,
+MSECCFG_RLB  = 1 << 2
+} mseccfg_field_t;
+
 typedef struct {
 target_ulong addr_reg;
 uint8_t  cfg_reg;
@@ -55,6 +61,10 @@ typedef struct {
 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 target_ulong val);
 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index);
+
+void mseccfg_csr_write(CPURISCVState *env, target_ulong val);
+target_ulong mseccfg_csr_read(CPURISCVState *env);
+
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
@@ -68,4 +78,8 @@ void pmp_update_rule_nums(CPURISCVState *env);
 uint32_t pmp_get_num_rules(CPURISCVState *env);
 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);
 
+#define MSECCFG_MML_ISSET(env) get_field(env->mseccfg, MSECCFG_MML)
+#define MSECCFG_MMWP_ISSET(env) get_field(env->mseccfg, MSECCFG_MMWP)
+#define MSECCFG_RLB_ISSET(env) get_field(env->mseccfg, MSECCFG_RLB)
+
 #endif
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index f0a74f0eb8..97ceff718f 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -200,6 +200,15 @@ static RISCVException pmp(CPURISCVState *env, int csrno)
 
 return RISCV_EXCP_ILLEGAL_INST;
 }
+
+static RISCVException epmp(CPURISCVState *env, int csrno)
+{
+if (env->priv == PRV_M && riscv_feature(env, RISCV_FEATURE_EPMP)) {
+return RISCV_EXCP_NONE;
+}
+
+return RISCV_EXCP_ILLEGAL_INST;
+}
 #endif
 
 /* User Floating-Point CSRs */
@@ -1343,6 +1352,20 @@ static RISCVException write_mtinst(CPURISCVState *env, 
int csrno,
 }
 
 /* Physical Memory Protection */
+static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
+   target_ulong *val)
+{
+*val = mseccfg_csr_read(env);
+return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
+ target_ulong val)
+{
+mseccfg_csr_write(env, val);
+return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
   target_ulong *val)
 {
@@ -1581,6 +1604,7 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 [CSR_MTINST]  = { "mtinst",  hmode,   read_mtinst,  
write_mtinst  },
 
 /* Physical Memory Protection */
+[CSR_MSECCFG]= { "mseccfg",  epmp, read_mseccfg, write_mseccfg },
 [CSR_PMPCFG0]= { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
 [CSR_PMPCFG1]= { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
 [CSR_PMPCFG2]= { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index a3b253bb15..e35988eec2 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -419,6 +419,40 @@ target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t 
addr_index)
 return val;
 }
 
+/*
+ * Handle a write to a mseccfg CSR
+ */
+void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
+{
+int i;
+
+trace_mseccfg_csr_write(env->mhartid, val);
+
+/* RLB cannot be enabled if it's already 0 and if any regions are locked */
+if (!MSECCFG_RLB_ISSET(env)) {
+for (i = 0; i < MAX_RISCV_PMPS; i++) {
+if (pmp_is_locked(env, i)) {
+val &= ~MSECCFG_RLB;
+break;
+}
+}
+}
+
+/* Sticky bits */
+val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
+
+env->mseccfg = val;
+}
+
+/*
+ * Handle a read from a mseccfg CSR
+ */
+target_ulong mseccfg_csr_read(CPURISCVState *env)
+{
+trace_mseccfg_csr_read(env->mhartid, env->mseccfg);

[PULL 17/42] riscv: don't look at SUM when accessing memory from a debugger context

[Alistair Francis]

From: Jade Fink 

Previously the qemu monitor and gdbstub looked at SUM and refused to
perform accesses to user memory if it is off, which was an impediment to
debugging.

Signed-off-by: Jade Fink 
Reviewed-by: Alistair Francis 
Message-id: 20210406113109.1031033-1-q...@jade.fyi
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu_helper.c | 20 
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 99cc388db9..659ca8a173 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -342,12 +342,14 @@ static int get_physical_address_pmp(CPURISCVState *env, 
int *prot,
  * @first_stage: Are we in first stage translation?
  *   Second stage is used for hypervisor guest translation
  * @two_stage: Are we going to perform two stage translation
+ * @is_debug: Is this access from a debugger or the monitor?
  */
 static int get_physical_address(CPURISCVState *env, hwaddr *physical,
 int *prot, target_ulong addr,
 target_ulong *fault_pte_addr,
 int access_type, int mmu_idx,
-bool first_stage, bool two_stage)
+bool first_stage, bool two_stage,
+bool is_debug)
 {
 /* NOTE: the env->pc value visible here will not be
  * correct, but the value visible to the exception handler
@@ -416,7 +418,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr 
*physical,
 widened = 2;
 }
 /* status.SUM will be ignored if execute on background */
-sum = get_field(env->mstatus, MSTATUS_SUM) || use_background;
+sum = get_field(env->mstatus, MSTATUS_SUM) || use_background || is_debug;
 switch (vm) {
 case VM_1_10_SV32:
   levels = 2; ptidxbits = 10; ptesize = 4; break;
@@ -475,7 +477,8 @@ restart:
 /* Do the second stage translation on the base PTE address. */
 int vbase_ret = get_physical_address(env, , _prot,
  base, NULL, MMU_DATA_LOAD,
- mmu_idx, false, true);
+ mmu_idx, false, true,
+ is_debug);
 
 if (vbase_ret != TRANSLATE_SUCCESS) {
 if (fault_pte_addr) {
@@ -666,13 +669,13 @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr 
addr)
 int mmu_idx = cpu_mmu_index(>env, false);
 
 if (get_physical_address(env, _addr, , addr, NULL, 0, mmu_idx,
- true, riscv_cpu_virt_enabled(env))) {
+ true, riscv_cpu_virt_enabled(env), true)) {
 return -1;
 }
 
 if (riscv_cpu_virt_enabled(env)) {
 if (get_physical_address(env, _addr, , phys_addr, NULL,
- 0, mmu_idx, false, true)) {
+ 0, mmu_idx, false, true, true)) {
 return -1;
 }
 }
@@ -768,7 +771,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int 
size,
 /* Two stage lookup */
 ret = get_physical_address(env, , , address,
>guest_phys_fault_addr, access_type,
-   mmu_idx, true, true);
+   mmu_idx, true, true, false);
 
 /*
  * A G-stage exception may be triggered during two state lookup.
@@ -790,7 +793,8 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int 
size,
 im_address = pa;
 
 ret = get_physical_address(env, , , im_address, NULL,
-   access_type, mmu_idx, false, true);
+   access_type, mmu_idx, false, true,
+   false);
 
 qemu_log_mask(CPU_LOG_MMU,
 "%s 2nd-stage address=%" VADDR_PRIx " ret %d physical "
@@ -825,7 +829,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int 
size,
 } else {
 /* Single stage lookup */
 ret = get_physical_address(env, , , address, NULL,
-   access_type, mmu_idx, true, false);
+   access_type, mmu_idx, true, false, false);
 
 qemu_log_mask(CPU_LOG_MMU,
   "%s address=%" VADDR_PRIx " ret %d physical "
-- 
2.31.1

[PULL 15/42] hw/opentitan: Update the interrupt layout

[Alistair Francis]

Update the OpenTitan interrupt layout to match the latest OpenTitan
bitstreams. This involves changing the Ibex PLIC memory layout and the
UART interrupts.

Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
e92b696f1809c9fa4410da2e9f23c414db5a6960.1617202791.git.alistair.fran...@wdc.com
---
 include/hw/riscv/opentitan.h | 16 
 hw/intc/ibex_plic.c  | 20 ++--
 hw/riscv/opentitan.c |  8 
 3 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
index a5ea3a5e4e..aab9bc9245 100644
--- a/include/hw/riscv/opentitan.h
+++ b/include/hw/riscv/opentitan.h
@@ -82,14 +82,14 @@ enum {
 };
 
 enum {
-IBEX_UART_RX_PARITY_ERR_IRQ = 0x28,
-IBEX_UART_RX_TIMEOUT_IRQ = 0x27,
-IBEX_UART_RX_BREAK_ERR_IRQ = 0x26,
-IBEX_UART_RX_FRAME_ERR_IRQ = 0x25,
-IBEX_UART_RX_OVERFLOW_IRQ = 0x24,
-IBEX_UART_TX_EMPTY_IRQ = 0x23,
-IBEX_UART_RX_WATERMARK_IRQ = 0x22,
-IBEX_UART_TX_WATERMARK_IRQ = 0x21,
+IBEX_UART0_RX_PARITY_ERR_IRQ = 8,
+IBEX_UART0_RX_TIMEOUT_IRQ = 7,
+IBEX_UART0_RX_BREAK_ERR_IRQ = 6,
+IBEX_UART0_RX_FRAME_ERR_IRQ = 5,
+IBEX_UART0_RX_OVERFLOW_IRQ = 4,
+IBEX_UART0_TX_EMPTY_IRQ = 3,
+IBEX_UART0_RX_WATERMARK_IRQ = 2,
+IBEX_UART0_TX_WATERMARK_IRQ = 1,
 };
 
 #endif
diff --git a/hw/intc/ibex_plic.c b/hw/intc/ibex_plic.c
index c1b72fcab0..edf76e4f61 100644
--- a/hw/intc/ibex_plic.c
+++ b/hw/intc/ibex_plic.c
@@ -225,23 +225,23 @@ static void ibex_plic_irq_request(void *opaque, int irq, 
int level)
 
 static Property ibex_plic_properties[] = {
 DEFINE_PROP_UINT32("num-cpus", IbexPlicState, num_cpus, 1),
-DEFINE_PROP_UINT32("num-sources", IbexPlicState, num_sources, 80),
+DEFINE_PROP_UINT32("num-sources", IbexPlicState, num_sources, 176),
 
 DEFINE_PROP_UINT32("pending-base", IbexPlicState, pending_base, 0),
-DEFINE_PROP_UINT32("pending-num", IbexPlicState, pending_num, 3),
+DEFINE_PROP_UINT32("pending-num", IbexPlicState, pending_num, 6),
 
-DEFINE_PROP_UINT32("source-base", IbexPlicState, source_base, 0x0c),
-DEFINE_PROP_UINT32("source-num", IbexPlicState, source_num, 3),
+DEFINE_PROP_UINT32("source-base", IbexPlicState, source_base, 0x18),
+DEFINE_PROP_UINT32("source-num", IbexPlicState, source_num, 6),
 
-DEFINE_PROP_UINT32("priority-base", IbexPlicState, priority_base, 0x18),
-DEFINE_PROP_UINT32("priority-num", IbexPlicState, priority_num, 80),
+DEFINE_PROP_UINT32("priority-base", IbexPlicState, priority_base, 0x30),
+DEFINE_PROP_UINT32("priority-num", IbexPlicState, priority_num, 177),
 
-DEFINE_PROP_UINT32("enable-base", IbexPlicState, enable_base, 0x200),
-DEFINE_PROP_UINT32("enable-num", IbexPlicState, enable_num, 3),
+DEFINE_PROP_UINT32("enable-base", IbexPlicState, enable_base, 0x300),
+DEFINE_PROP_UINT32("enable-num", IbexPlicState, enable_num, 6),
 
-DEFINE_PROP_UINT32("threshold-base", IbexPlicState, threshold_base, 0x20c),
+DEFINE_PROP_UINT32("threshold-base", IbexPlicState, threshold_base, 0x318),
 
-DEFINE_PROP_UINT32("claim-base", IbexPlicState, claim_base, 0x210),
+DEFINE_PROP_UINT32("claim-base", IbexPlicState, claim_base, 0x31c),
 DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index e168bffe69..30dca1ee91 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -149,16 +149,16 @@ static void lowrisc_ibex_soc_realize(DeviceState 
*dev_soc, Error **errp)
 sysbus_mmio_map(SYS_BUS_DEVICE(>uart), 0, memmap[IBEX_DEV_UART].base);
 sysbus_connect_irq(SYS_BUS_DEVICE(>uart),
0, qdev_get_gpio_in(DEVICE(>plic),
-   IBEX_UART_TX_WATERMARK_IRQ));
+   IBEX_UART0_TX_WATERMARK_IRQ));
 sysbus_connect_irq(SYS_BUS_DEVICE(>uart),
1, qdev_get_gpio_in(DEVICE(>plic),
-   IBEX_UART_RX_WATERMARK_IRQ));
+   IBEX_UART0_RX_WATERMARK_IRQ));
 sysbus_connect_irq(SYS_BUS_DEVICE(>uart),
2, qdev_get_gpio_in(DEVICE(>plic),
-   IBEX_UART_TX_EMPTY_IRQ));
+   IBEX_UART0_TX_EMPTY_IRQ));
 sysbus_connect_irq(SYS_BUS_DEVICE(>uart),
3, qdev_get_gpio_in(DEVICE(>plic),
-   IBEX_UART_RX_OVERFLOW_IRQ));
+   IBEX_UART0_RX_OVERFLOW_IRQ));
 
 create_unimplemented_device("riscv.lowrisc.ibex.gpio",
 memmap[IBEX_DEV_GPIO].base, memmap[IBEX_DEV_GPIO].size);
-- 
2.31.1

[PULL 07/42] hw/char: Add Shakti UART emulation

[Alistair Francis]

From: Vijai Kumar K 

This is the initial implementation of Shakti UART.

Signed-off-by: Vijai Kumar K 
Reviewed-by: Alistair Francis 
Message-id: 20210401181457.73039-4-vi...@behindbytes.com
Signed-off-by: Alistair Francis 
---
 include/hw/char/shakti_uart.h |  74 ++
 hw/char/shakti_uart.c | 185 ++
 MAINTAINERS   |   2 +
 hw/char/meson.build   |   1 +
 hw/char/trace-events  |   4 +
 5 files changed, 266 insertions(+)
 create mode 100644 include/hw/char/shakti_uart.h
 create mode 100644 hw/char/shakti_uart.c

diff --git a/include/hw/char/shakti_uart.h b/include/hw/char/shakti_uart.h
new file mode 100644
index 00..526c408233
--- /dev/null
+++ b/include/hw/char/shakti_uart.h
@@ -0,0 +1,74 @@
+/*
+ * SHAKTI UART
+ *
+ * Copyright (c) 2021 Vijai Kumar K 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_SHAKTI_UART_H
+#define HW_SHAKTI_UART_H
+
+#include "hw/sysbus.h"
+#include "chardev/char-fe.h"
+
+#define SHAKTI_UART_BAUD0x00
+#define SHAKTI_UART_TX  0x04
+#define SHAKTI_UART_RX  0x08
+#define SHAKTI_UART_STATUS  0x0C
+#define SHAKTI_UART_DELAY   0x10
+#define SHAKTI_UART_CONTROL 0x14
+#define SHAKTI_UART_INT_EN  0x18
+#define SHAKTI_UART_IQ_CYCLES   0x1C
+#define SHAKTI_UART_RX_THRES0x20
+
+#define SHAKTI_UART_STATUS_TX_EMPTY (1 << 0)
+#define SHAKTI_UART_STATUS_TX_FULL  (1 << 1)
+#define SHAKTI_UART_STATUS_RX_NOT_EMPTY (1 << 2)
+#define SHAKTI_UART_STATUS_RX_FULL  (1 << 3)
+/* 9600 8N1 is the default setting */
+/* Reg value = (5000 Hz)/(16 * 9600)*/
+#define SHAKTI_UART_BAUD_DEFAULT0x0145
+#define SHAKTI_UART_CONTROL_DEFAULT 0x0100
+
+#define TYPE_SHAKTI_UART "shakti-uart"
+#define SHAKTI_UART(obj) \
+OBJECT_CHECK(ShaktiUartState, (obj), TYPE_SHAKTI_UART)
+
+typedef struct {
+/*  */
+SysBusDevice parent_obj;
+
+/*  */
+MemoryRegion mmio;
+
+uint32_t uart_baud;
+uint32_t uart_tx;
+uint32_t uart_rx;
+uint32_t uart_status;
+uint32_t uart_delay;
+uint32_t uart_control;
+uint32_t uart_interrupt;
+uint32_t uart_iq_cycles;
+uint32_t uart_rx_threshold;
+
+CharBackend chr;
+} ShaktiUartState;
+
+#endif /* HW_SHAKTI_UART_H */
diff --git a/hw/char/shakti_uart.c b/hw/char/shakti_uart.c
new file mode 100644
index 00..6870821325
--- /dev/null
+++ b/hw/char/shakti_uart.c
@@ -0,0 +1,185 @@
+/*
+ * SHAKTI UART
+ *
+ * Copyright (c) 2021 Vijai Kumar K 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/char/shakti_uart.h"
+#include "hw/qdev-properties.h"
+#include "hw/qdev-properties-system.h"
+#include "qemu/log.h"
+
+static uint64_t shakti_uart_read(void *opaque, hwaddr addr, unsigned size)
+{
+ShaktiUartState *s = opaque;
+
+switch (addr) {
+case SHAKTI_UART_BAUD:
+

[PULL 21/42] target/riscv: Define ePMP mseccfg

[Alistair Francis]

From: Hou Weiying 

Use address 0x390 and 0x391 for the ePMP CSRs.

Signed-off-by: Hongzheng-Li 
Signed-off-by: Hou Weiying 
Signed-off-by: Myriad-Dreamin 
Reviewed-by: Alistair Francis 
Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-id: 
63245b559f477a9ce6d4f930136d2d7fd7f99c78.1618812899.git.alistair.fran...@wdc.com
[ Changes by AF:
 - Tidy up commit message
]
Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
---
 target/riscv/cpu_bits.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 8549d77b4f..24d89939a0 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -220,6 +220,9 @@
 #define CSR_MTINST  0x34a
 #define CSR_MTVAL2  0x34b
 
+/* Enhanced Physical Memory Protection (ePMP) */
+#define CSR_MSECCFG 0x390
+#define CSR_MSECCFGH0x391
 /* Physical Memory Protection */
 #define CSR_PMPCFG0 0x3a0
 #define CSR_PMPCFG1 0x3a1
-- 
2.31.1

[PULL 14/42] MAINTAINERS: Update the RISC-V CPU Maintainers

[Alistair Francis]

Update the RISC-V maintainers by removing Sagar and Bastian who haven't
been involved recently.

Also add Bin who has been helping with reviews.

Signed-off-by: Alistair Francis 
Acked-by: Bin Meng 
Acked-by: Bastian Koppelmann 
Reviewed-by: Philippe Mathieu-Daudé 
Message-id: 
6564ba829c40ad9aa7d28f43be69d8eb5cf4b56b.1617749142.git.alistair.fran...@wdc.com
---
 MAINTAINERS | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 93830817f1..6086322886 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -295,9 +295,8 @@ F: tests/acceptance/machine_ppc.py
 
 RISC-V TCG CPUs
 M: Palmer Dabbelt 
-M: Alistair Francis 
-M: Sagar Karandikar 
-M: Bastian Koppelmann 
+M: Alistair Francis 
+M: Bin Meng 
 L: qemu-ri...@nongnu.org
 S: Supported
 F: target/riscv/
-- 
2.31.1

[PULL 11/42] target/riscv: Fix 32-bit HS mode access permissions

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
cb1ef2061547dc9028ce3cf4f6622588f9c09149.1617290165.git.alistair.fran...@wdc.com
---
 target/riscv/csr.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 1938bdca7d..6a39c4aa96 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -181,7 +181,11 @@ static RISCVException hmode(CPURISCVState *env, int csrno)
 static RISCVException hmode32(CPURISCVState *env, int csrno)
 {
 if (!riscv_cpu_is_32bit(env)) {
-return RISCV_EXCP_NONE;
+if (riscv_cpu_virt_enabled(env)) {
+return RISCV_EXCP_ILLEGAL_INST;
+} else {
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+}
 }
 
 return hmode(env, csrno);
-- 
2.31.1

[PULL 06/42] riscv: Add initial support for Shakti C machine

[Alistair Francis]

From: Vijai Kumar K 

Add support for emulating Shakti reference platform based on C-class
running on arty-100T board.

https://gitlab.com/shaktiproject/cores/shakti-soc/-/blob/master/README.rst

Signed-off-by: Vijai Kumar K 
Reviewed-by: Alistair Francis 
Message-id: 20210401181457.73039-3-vi...@behindbytes.com
Signed-off-by: Alistair Francis 
---
 default-configs/devices/riscv64-softmmu.mak |   1 +
 include/hw/riscv/shakti_c.h |  73 +
 hw/riscv/shakti_c.c | 170 
 MAINTAINERS |   7 +
 hw/riscv/Kconfig|  10 ++
 hw/riscv/meson.build|   1 +
 6 files changed, 262 insertions(+)
 create mode 100644 include/hw/riscv/shakti_c.h
 create mode 100644 hw/riscv/shakti_c.c

diff --git a/default-configs/devices/riscv64-softmmu.mak 
b/default-configs/devices/riscv64-softmmu.mak
index d5eec75f05..bc69301fa4 100644
--- a/default-configs/devices/riscv64-softmmu.mak
+++ b/default-configs/devices/riscv64-softmmu.mak
@@ -13,3 +13,4 @@ CONFIG_SIFIVE_E=y
 CONFIG_SIFIVE_U=y
 CONFIG_RISCV_VIRT=y
 CONFIG_MICROCHIP_PFSOC=y
+CONFIG_SHAKTI_C=y
diff --git a/include/hw/riscv/shakti_c.h b/include/hw/riscv/shakti_c.h
new file mode 100644
index 00..8ffc2b0213
--- /dev/null
+++ b/include/hw/riscv/shakti_c.h
@@ -0,0 +1,73 @@
+/*
+ * Shakti C-class SoC emulation
+ *
+ * Copyright (c) 2021 Vijai Kumar K 
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#ifndef HW_SHAKTI_H
+#define HW_SHAKTI_H
+
+#include "hw/riscv/riscv_hart.h"
+#include "hw/boards.h"
+
+#define TYPE_RISCV_SHAKTI_SOC "riscv.shakti.cclass.soc"
+#define RISCV_SHAKTI_SOC(obj) \
+OBJECT_CHECK(ShaktiCSoCState, (obj), TYPE_RISCV_SHAKTI_SOC)
+
+typedef struct ShaktiCSoCState {
+/*< private >*/
+DeviceState parent_obj;
+
+/*< public >*/
+RISCVHartArrayState cpus;
+DeviceState *plic;
+MemoryRegion rom;
+
+} ShaktiCSoCState;
+
+#define TYPE_RISCV_SHAKTI_MACHINE MACHINE_TYPE_NAME("shakti_c")
+#define RISCV_SHAKTI_MACHINE(obj) \
+OBJECT_CHECK(ShaktiCMachineState, (obj), TYPE_RISCV_SHAKTI_MACHINE)
+typedef struct ShaktiCMachineState {
+/*< private >*/
+MachineState parent_obj;
+
+/*< public >*/
+ShaktiCSoCState soc;
+} ShaktiCMachineState;
+
+enum {
+SHAKTI_C_ROM,
+SHAKTI_C_RAM,
+SHAKTI_C_UART,
+SHAKTI_C_GPIO,
+SHAKTI_C_PLIC,
+SHAKTI_C_CLINT,
+SHAKTI_C_I2C,
+};
+
+#define SHAKTI_C_PLIC_HART_CONFIG "MS"
+/* Including Interrupt ID 0 (no interrupt)*/
+#define SHAKTI_C_PLIC_NUM_SOURCES 28
+/* Excluding Priority 0 */
+#define SHAKTI_C_PLIC_NUM_PRIORITIES 2
+#define SHAKTI_C_PLIC_PRIORITY_BASE 0x04
+#define SHAKTI_C_PLIC_PENDING_BASE 0x1000
+#define SHAKTI_C_PLIC_ENABLE_BASE 0x2000
+#define SHAKTI_C_PLIC_ENABLE_STRIDE 0x80
+#define SHAKTI_C_PLIC_CONTEXT_BASE 0x20
+#define SHAKTI_C_PLIC_CONTEXT_STRIDE 0x1000
+
+#endif
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
new file mode 100644
index 00..c8205d3f22
--- /dev/null
+++ b/hw/riscv/shakti_c.c
@@ -0,0 +1,170 @@
+/*
+ * Shakti C-class SoC emulation
+ *
+ * Copyright (c) 2021 Vijai Kumar K 
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "hw/boards.h"
+#include "hw/riscv/shakti_c.h"
+#include "qapi/error.h"
+#include "hw/intc/sifive_plic.h"
+#include "hw/intc/sifive_clint.h"
+#include "sysemu/sysemu.h"
+#include "hw/qdev-properties.h"
+#include "exec/address-spaces.h"
+#include "hw/riscv/boot.h"
+
+
+static const struct MemmapEntry {
+hwaddr base;
+hwaddr size;
+} shakti_c_memmap[] = {
+[SHAKTI_C_ROM]   =  {  0x1000,  0x2000   },
+[SHAKTI_C_RAM]   =  {  0x8000,  0x0  },
+[SHAKTI_C_UART]  =  {  0x00011300,  0x00040  },
+[SHAKTI_C_GPIO]  =  {  0x020d,  0x00100  },
+[SHAKTI_C_PLIC]  =  {  

[PULL 12/42] target/riscv: Use the RISCVException enum for CSR operations

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Richard Henderson 
Reviewed-by: Bin Meng 
Message-id: 
8566c4c271723f27f3ae8fc2429f906a459f17ce.1617290165.git.alistair.fran...@wdc.com
---
 target/riscv/cpu.h |  14 +-
 target/riscv/csr.c | 629 +++--
 2 files changed, 382 insertions(+), 261 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 1dd42a6bc1..a7b8876ea0 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -474,12 +474,14 @@ static inline target_ulong riscv_csr_read(CPURISCVState 
*env, int csrno)
 
 typedef RISCVException (*riscv_csr_predicate_fn)(CPURISCVState *env,
  int csrno);
-typedef int (*riscv_csr_read_fn)(CPURISCVState *env, int csrno,
-target_ulong *ret_value);
-typedef int (*riscv_csr_write_fn)(CPURISCVState *env, int csrno,
-target_ulong new_value);
-typedef int (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
-target_ulong *ret_value, target_ulong new_value, target_ulong write_mask);
+typedef RISCVException (*riscv_csr_read_fn)(CPURISCVState *env, int csrno,
+target_ulong *ret_value);
+typedef RISCVException (*riscv_csr_write_fn)(CPURISCVState *env, int csrno,
+ target_ulong new_value);
+typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
+  target_ulong *ret_value,
+  target_ulong new_value,
+  target_ulong write_mask);
 
 typedef struct {
 const char *name;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 6a39c4aa96..f67eaf4042 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -203,57 +203,62 @@ static RISCVException pmp(CPURISCVState *env, int csrno)
 #endif
 
 /* User Floating-Point CSRs */
-static int read_fflags(CPURISCVState *env, int csrno, target_ulong *val)
+static RISCVException read_fflags(CPURISCVState *env, int csrno,
+  target_ulong *val)
 {
 #if !defined(CONFIG_USER_ONLY)
 if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 #endif
 *val = riscv_cpu_get_fflags(env);
-return 0;
+return RISCV_EXCP_NONE;
 }
 
-static int write_fflags(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_fflags(CPURISCVState *env, int csrno,
+   target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
 if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 env->mstatus |= MSTATUS_FS;
 #endif
 riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
-return 0;
+return RISCV_EXCP_NONE;
 }
 
-static int read_frm(CPURISCVState *env, int csrno, target_ulong *val)
+static RISCVException read_frm(CPURISCVState *env, int csrno,
+   target_ulong *val)
 {
 #if !defined(CONFIG_USER_ONLY)
 if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 #endif
 *val = env->frm;
-return 0;
+return RISCV_EXCP_NONE;
 }
 
-static int write_frm(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_frm(CPURISCVState *env, int csrno,
+target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
 if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 env->mstatus |= MSTATUS_FS;
 #endif
 env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
-return 0;
+return RISCV_EXCP_NONE;
 }
 
-static int read_fcsr(CPURISCVState *env, int csrno, target_ulong *val)
+static RISCVException read_fcsr(CPURISCVState *env, int csrno,
+target_ulong *val)
 {
 #if !defined(CONFIG_USER_ONLY)
 if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 #endif
 *val = (riscv_cpu_get_fflags(env) << FSR_AEXC_SHIFT)
@@ -262,14 +267,15 @@ static int read_fcsr(CPURISCVState *env, int csrno, 
target_ulong *val)
 *val |= (env->vxrm << FSR_VXRM_SHIFT)
 | (env->vxsat << FSR_VXSAT_SHIFT);
 }
-return 0;
+return RISCV_EXCP_NONE;
 }
 
-static int write_fcsr(CPURISCVState *env, int csrno, target_ulong val)
+static RISCVException write_fcsr(CPURISCVState *env, int csrno,
+ target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
 if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
-return -RISCV_EXCP_ILLEGAL_INST;
+return RISCV_EXCP_ILLEGAL_INST;
 }
 env->mstatus |= MSTATUS_FS;
 #endif
@@ -279,59 +285,68 

[PULL 03/42] target/riscv: Align the data type of reset vector address

[Alistair Francis]

From: Dylan Jhong 

Use target_ulong to instead of uint64_t on reset vector address
to adapt on both 32/64 machine.

Signed-off-by: Dylan Jhong 
Signed-off-by: Ruinland ChuanTzu Tsai 
Reviewed-by: Bin Meng 
Reviewed-by: Alistair Francis 
Message-id: 20210329034801.22667-1-dy...@andestech.com
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 86e7dbeb20..047d6344fe 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -137,7 +137,7 @@ static void set_feature(CPURISCVState *env, int feature)
 env->features |= (1ULL << feature);
 }
 
-static void set_resetvec(CPURISCVState *env, int resetvec)
+static void set_resetvec(CPURISCVState *env, target_ulong resetvec)
 {
 #ifndef CONFIG_USER_ONLY
 env->resetvec = resetvec;
-- 
2.31.1

[PULL 09/42] target/riscv: Convert the RISC-V exceptions to an enum

[Alistair Francis]

Signed-off-by: Alistair Francis 
Reviewed-by: Bin Meng 
Reviewed-by: Richard Henderson 
Message-id: 
f191dcf08bf413a822e743a7c7f824d68879a527.1617290165.git.alistair.fran...@wdc.com
---
 target/riscv/cpu_bits.h   | 44 ---
 target/riscv/cpu.c|  2 +-
 target/riscv/cpu_helper.c |  4 ++--
 3 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index b42dd4f8d8..8549d77b4f 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -504,27 +504,29 @@
 #define DEFAULT_RSTVEC  0x1000
 
 /* Exception causes */
-#define EXCP_NONE-1 /* sentinel value */
-#define RISCV_EXCP_INST_ADDR_MIS 0x0
-#define RISCV_EXCP_INST_ACCESS_FAULT 0x1
-#define RISCV_EXCP_ILLEGAL_INST  0x2
-#define RISCV_EXCP_BREAKPOINT0x3
-#define RISCV_EXCP_LOAD_ADDR_MIS 0x4
-#define RISCV_EXCP_LOAD_ACCESS_FAULT 0x5
-#define RISCV_EXCP_STORE_AMO_ADDR_MIS0x6
-#define RISCV_EXCP_STORE_AMO_ACCESS_FAULT0x7
-#define RISCV_EXCP_U_ECALL   0x8
-#define RISCV_EXCP_S_ECALL  0x9
-#define RISCV_EXCP_VS_ECALL  0xa
-#define RISCV_EXCP_M_ECALL   0xb
-#define RISCV_EXCP_INST_PAGE_FAULT   0xc /* since: priv-1.10.0 */
-#define RISCV_EXCP_LOAD_PAGE_FAULT   0xd /* since: priv-1.10.0 */
-#define RISCV_EXCP_STORE_PAGE_FAULT  0xf /* since: priv-1.10.0 */
-#define RISCV_EXCP_SEMIHOST  0x10
-#define RISCV_EXCP_INST_GUEST_PAGE_FAULT 0x14
-#define RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT   0x15
-#define RISCV_EXCP_VIRT_INSTRUCTION_FAULT0x16
-#define RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT  0x17
+typedef enum RISCVException {
+RISCV_EXCP_NONE = -1, /* sentinel value */
+RISCV_EXCP_INST_ADDR_MIS = 0x0,
+RISCV_EXCP_INST_ACCESS_FAULT = 0x1,
+RISCV_EXCP_ILLEGAL_INST = 0x2,
+RISCV_EXCP_BREAKPOINT = 0x3,
+RISCV_EXCP_LOAD_ADDR_MIS = 0x4,
+RISCV_EXCP_LOAD_ACCESS_FAULT = 0x5,
+RISCV_EXCP_STORE_AMO_ADDR_MIS = 0x6,
+RISCV_EXCP_STORE_AMO_ACCESS_FAULT = 0x7,
+RISCV_EXCP_U_ECALL = 0x8,
+RISCV_EXCP_S_ECALL = 0x9,
+RISCV_EXCP_VS_ECALL = 0xa,
+RISCV_EXCP_M_ECALL = 0xb,
+RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
+RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
+RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
+RISCV_EXCP_SEMIHOST = 0x10,
+RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
+RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT = 0x15,
+RISCV_EXCP_VIRT_INSTRUCTION_FAULT = 0x16,
+RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT = 0x17,
+} RISCVException;
 
 #define RISCV_EXCP_INT_FLAG0x8000
 #define RISCV_EXCP_INT_MASK0x7fff
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6842626c69..e530df9385 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -358,7 +358,7 @@ static void riscv_cpu_reset(DeviceState *dev)
 env->pc = env->resetvec;
 env->two_stage_lookup = false;
 #endif
-cs->exception_index = EXCP_NONE;
+cs->exception_index = RISCV_EXCP_NONE;
 env->load_res = -1;
 set_default_nan_mode(1, >fp_status);
 }
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 503c2559f8..99cc388db9 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -72,7 +72,7 @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
 if (irqs) {
 return ctz64(irqs); /* since non-zero */
 } else {
-return EXCP_NONE; /* indicates no pending interrupt */
+return RISCV_EXCP_NONE; /* indicates no pending interrupt */
 }
 }
 #endif
@@ -1069,5 +1069,5 @@ void riscv_cpu_do_interrupt(CPUState *cs)
 
 env->two_stage_lookup = false;
 #endif
-cs->exception_index = EXCP_NONE; /* mark handled to qemu */
+cs->exception_index = RISCV_EXCP_NONE; /* mark handled to qemu */
 }
-- 
2.31.1

[PULL 08/42] hw/riscv: Connect Shakti UART to Shakti platform

[Alistair Francis]

From: Vijai Kumar K 

Connect one shakti uart to the shakti_c machine.

Signed-off-by: Vijai Kumar K 
Reviewed-by: Alistair Francis 
Message-id: 20210401181457.73039-5-vi...@behindbytes.com
Signed-off-by: Alistair Francis 
---
 include/hw/riscv/shakti_c.h | 2 ++
 hw/riscv/shakti_c.c | 8 
 2 files changed, 10 insertions(+)

diff --git a/include/hw/riscv/shakti_c.h b/include/hw/riscv/shakti_c.h
index 8ffc2b0213..50a2b79086 100644
--- a/include/hw/riscv/shakti_c.h
+++ b/include/hw/riscv/shakti_c.h
@@ -21,6 +21,7 @@
 
 #include "hw/riscv/riscv_hart.h"
 #include "hw/boards.h"
+#include "hw/char/shakti_uart.h"
 
 #define TYPE_RISCV_SHAKTI_SOC "riscv.shakti.cclass.soc"
 #define RISCV_SHAKTI_SOC(obj) \
@@ -33,6 +34,7 @@ typedef struct ShaktiCSoCState {
 /*< public >*/
 RISCVHartArrayState cpus;
 DeviceState *plic;
+ShaktiUartState uart;
 MemoryRegion rom;
 
 } ShaktiCSoCState;
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
index c8205d3f22..e207fa83dd 100644
--- a/hw/riscv/shakti_c.c
+++ b/hw/riscv/shakti_c.c
@@ -125,6 +125,13 @@ static void shakti_c_soc_state_realize(DeviceState *dev, 
Error **errp)
 SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
 SIFIVE_CLINT_TIMEBASE_FREQ, false);
 
+qdev_prop_set_chr(DEVICE(&(sss->uart)), "chardev", serial_hd(0));
+if (!sysbus_realize(SYS_BUS_DEVICE(>uart), errp)) {
+return;
+}
+sysbus_mmio_map(SYS_BUS_DEVICE(>uart), 0,
+shakti_c_memmap[SHAKTI_C_UART].base);
+
 /* ROM */
 memory_region_init_rom(>rom, OBJECT(dev), "riscv.shakti.c.rom",
shakti_c_memmap[SHAKTI_C_ROM].size, _fatal);
@@ -143,6 +150,7 @@ static void shakti_c_soc_instance_init(Object *obj)
 ShaktiCSoCState *sss = RISCV_SHAKTI_SOC(obj);
 
 object_initialize_child(obj, "cpus", >cpus, TYPE_RISCV_HART_ARRAY);
+object_initialize_child(obj, "uart", >uart, TYPE_SHAKTI_UART);
 
 /*
  * CPU type is fixed and we are not supporting passing from commandline 
yet.
-- 
2.31.1

[PULL 01/42] target/riscv: Remove privilege v1.9 specific CSR related code

[Alistair Francis]

From: Atish Patra 

Qemu doesn't support RISC-V privilege specification v1.9. Remove the
remaining v1.9 specific references from the implementation.

Signed-off-by: Atish Patra 
Reviewed-by: Alistair Francis 
Message-Id: <20210319194534.2082397-2-atish.pa...@wdc.com>
[Changes by AF:
 - Rebase on latest patches
 - Bump the vmstate_riscv_cpu version_id and minimum_version_id
 ]
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu.h|  4 +---
 target/riscv/cpu_bits.h   | 23 -
 target/riscv/cpu.c|  2 +-
 target/riscv/cpu_helper.c | 12 +--
 target/riscv/csr.c| 42 ++-
 target/riscv/machine.c|  8 +++-
 target/riscv/translate.c  |  4 ++--
 7 files changed, 23 insertions(+), 72 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 0a33d387ba..311b1db875 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -163,10 +163,8 @@ struct CPURISCVState {
 target_ulong mie;
 target_ulong mideleg;
 
-target_ulong sptbr;  /* until: priv-1.9.1 */
 target_ulong satp;   /* since: priv-1.10.0 */
-target_ulong sbadaddr;
-target_ulong mbadaddr;
+target_ulong stval;
 target_ulong medeleg;
 
 target_ulong stvec;
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index caf4599207..b42dd4f8d8 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -153,12 +153,6 @@
 /* 32-bit only */
 #define CSR_MSTATUSH0x310
 
-/* Legacy Counter Setup (priv v1.9.1) */
-/* Update to #define CSR_MCOUNTINHIBIT 0x320 for 1.11.0 */
-#define CSR_MUCOUNTEREN 0x320
-#define CSR_MSCOUNTEREN 0x321
-#define CSR_MHCOUNTEREN 0x322
-
 /* Machine Trap Handling */
 #define CSR_MSCRATCH0x340
 #define CSR_MEPC0x341
@@ -166,9 +160,6 @@
 #define CSR_MTVAL   0x343
 #define CSR_MIP 0x344
 
-/* Legacy Machine Trap Handling (priv v1.9.1) */
-#define CSR_MBADADDR0x343
-
 /* Supervisor Trap Setup */
 #define CSR_SSTATUS 0x100
 #define CSR_SEDELEG 0x102
@@ -184,9 +175,6 @@
 #define CSR_STVAL   0x143
 #define CSR_SIP 0x144
 
-/* Legacy Supervisor Trap Handling (priv v1.9.1) */
-#define CSR_SBADADDR0x143
-
 /* Supervisor Protection and Translation */
 #define CSR_SPTBR   0x180
 #define CSR_SATP0x180
@@ -354,14 +342,6 @@
 #define CSR_MHPMCOUNTER30H  0xb9e
 #define CSR_MHPMCOUNTER31H  0xb9f
 
-/* Legacy Machine Protection and Translation (priv v1.9.1) */
-#define CSR_MBASE   0x380
-#define CSR_MBOUND  0x381
-#define CSR_MIBASE  0x382
-#define CSR_MIBOUND 0x383
-#define CSR_MDBASE  0x384
-#define CSR_MDBOUND 0x385
-
 /* mstatus CSR bits */
 #define MSTATUS_UIE 0x0001
 #define MSTATUS_SIE 0x0002
@@ -375,10 +355,8 @@
 #define MSTATUS_FS  0x6000
 #define MSTATUS_XS  0x00018000
 #define MSTATUS_MPRV0x0002
-#define MSTATUS_PUM 0x0004 /* until: priv-1.9.1 */
 #define MSTATUS_SUM 0x0004 /* since: priv-1.10 */
 #define MSTATUS_MXR 0x0008
-#define MSTATUS_VM  0x1F00 /* until: priv-1.9.1 */
 #define MSTATUS_TVM 0x0010 /* since: priv-1.10 */
 #define MSTATUS_TW  0x0020 /* since: priv-1.10 */
 #define MSTATUS_TSR 0x0040 /* since: priv-1.10 */
@@ -416,7 +394,6 @@
 #define SSTATUS_SPP 0x0100
 #define SSTATUS_FS  0x6000
 #define SSTATUS_XS  0x00018000
-#define SSTATUS_PUM 0x0004 /* until: priv-1.9.1 */
 #define SSTATUS_SUM 0x0004 /* since: priv-1.10 */
 #define SSTATUS_MXR 0x0008
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 7d6ed80f6b..86e7dbeb20 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -282,7 +282,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int 
flags)
 qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vscause ", env->vscause);
 }
 qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval ", env->mtval);
-qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "stval ", env->sbadaddr);
+qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "stval ", env->stval);
 if (riscv_has_ext(env, RVH)) {
 qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "htval ", env->htval);
 qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval2 ", env->mtval2);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 21c54ef561..503c2559f8 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -136,8 +136,8 @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
 env->vscause = env->scause;
 env->scause = env->scause_hs;
 
-env->vstval = env->sbadaddr;
-env->sbadaddr = env->stval_hs;
+env->vstval = env->stval;
+env->stval = env->stval_hs;
 
 env->vsatp = env->satp;
 env->satp = env->satp_hs;
@@ -159,8 +159,8 @@ 

[PULL 02/42] docs/system/generic-loader.rst: Fix style

[Alistair Francis]

From: Axel Heider 

Fix style to have a proper description of the parameter 'force-raw'.

Signed-off-by: Axel Heider 
Reviewed-by: Alistair Francis 
Message-id: a7e50a64-1c7c-2d41-96d3-d8a417a65...@gmx.de
Signed-off-by: Alistair Francis 
---
 docs/system/generic-loader.rst | 9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/system/generic-loader.rst b/docs/system/generic-loader.rst
index 6bf8a4eb48..531ddbc8e3 100644
--- a/docs/system/generic-loader.rst
+++ b/docs/system/generic-loader.rst
@@ -92,9 +92,12 @@ shown below:
   specified in the executable format header. This option should only
   be used for the boot image. This will also cause the image to be
   written to the specified CPU's address space. If not specified, the
-  default is CPU 0.  - Setting force-raw=on forces the file
-  to be treated as a raw image. This can be used to load supported
-  executable formats as if they were raw.
+  default is CPU 0.
+
+
+  Setting 'force-raw=on' forces the file to be treated as a raw image.
+  This can be used to load supported executable formats as if they
+  were raw.
 
 All values are parsed using the standard QemuOpts parsing. This allows the user
 to specify any values in any format supported. By default the values
-- 
2.31.1

[PULL 05/42] target/riscv: Add Shakti C class CPU

[Alistair Francis]

From: Vijai Kumar K 

C-Class is a member of the SHAKTI family of processors from IIT-M.

It is an extremely configurable and commercial-grade 5-stage in-order
core supporting the standard RV64GCSUN ISA extensions.

Signed-off-by: Vijai Kumar K 
Reviewed-by: Alistair Francis 
Message-id: 20210401181457.73039-2-vi...@behindbytes.com
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu.h | 1 +
 target/riscv/cpu.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 311b1db875..8079da8fa8 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -38,6 +38,7 @@
 #define TYPE_RISCV_CPU_BASE32   RISCV_CPU_TYPE_NAME("rv32")
 #define TYPE_RISCV_CPU_BASE64   RISCV_CPU_TYPE_NAME("rv64")
 #define TYPE_RISCV_CPU_IBEX RISCV_CPU_TYPE_NAME("lowrisc-ibex")
+#define TYPE_RISCV_CPU_SHAKTI_C RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31   RISCV_CPU_TYPE_NAME("sifive-e31")
 #define TYPE_RISCV_CPU_SIFIVE_E34   RISCV_CPU_TYPE_NAME("sifive-e34")
 #define TYPE_RISCV_CPU_SIFIVE_E51   RISCV_CPU_TYPE_NAME("sifive-e51")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 047d6344fe..6842626c69 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -708,6 +708,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 DEFINE_CPU(TYPE_RISCV_CPU_BASE64,   rv64_base_cpu_init),
 DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,   rv64_sifive_e_cpu_init),
 DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,   rv64_sifive_u_cpu_init),
+DEFINE_CPU(TYPE_RISCV_CPU_SHAKTI_C, rv64_sifive_u_cpu_init),
 #endif
 };
 
-- 
2.31.1

[PULL 04/42] hw/riscv: sifive_e: Add 'const' to sifive_e_memmap[]

[Alistair Francis]

From: Bin Meng 

This was accidentally dropped before. Add it back.

Fixes: 732612856a8 ("hw/riscv: Drop 'struct MemmapEntry'")
Reported-by: Emmanuel Blot 
Signed-off-by: Bin Meng 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Alistair Francis 
Message-id: 20210331103612.654261-1-bmeng...@gmail.com
Signed-off-by: Alistair Francis 
---
 hw/riscv/sifive_e.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index f939bcf9ea..82096b3e5a 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -50,7 +50,7 @@
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
-static MemMapEntry sifive_e_memmap[] = {
+static const MemMapEntry sifive_e_memmap[] = {
 [SIFIVE_E_DEV_DEBUG] ={0x0, 0x1000 },
 [SIFIVE_E_DEV_MROM] = { 0x1000, 0x2000 },
 [SIFIVE_E_DEV_OTP] =  {0x2, 0x2000 },
-- 
2.31.1

Re: [PATCH v6 18/26] tcg/tci: Implement andc, orc, eqv, nand, nor

[Philippe Mathieu-Daudé]

On 5/3/21 1:57 AM, Richard Henderson wrote:
> These were already present in tcg-target.c.inc,
> but not in the interpreter.
> 
> Signed-off-by: Richard Henderson 
> ---
>  tcg/tci/tcg-target.h | 20 ++--
>  tcg/tci.c| 40 
>  2 files changed, 50 insertions(+), 10 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

[PULL 00/42] riscv-to-apply queue

[Alistair Francis]

The following changes since commit 15106f7dc3290ff3254611f265849a314a93eb0e:

  Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-hex-20210502' into 
staging (2021-05-02 16:23:05 +0100)

are available in the Git repository at:

  g...@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210504-2

for you to fetch changes up to 7a98eab3a704139020bdad35bfae0356d2a31fa0:

  target/riscv: Fix the RV64H decode comment (2021-05-04 08:03:43 +1000)


A large collection of RISC-V fixes, improvements and features

 - Clenaup some left over v1.9 code
 - Documentation improvements
 - Support for the shakti_c machine
 - Internal cleanup of the CSR accesses
 - Updates to the OpenTitan platform
 - Support for the virtio-vga
 - Fix for the saturate subtract in vector extensions
 - Experimental support for the ePMP spec
 - A range of other internal code cleanups and bug fixes


Alexander Wagner (1):
  hw/riscv: Fix OT IBEX reset vector

Alistair Francis (22):
  target/riscv: Convert the RISC-V exceptions to an enum
  target/riscv: Use the RISCVException enum for CSR predicates
  target/riscv: Fix 32-bit HS mode access permissions
  target/riscv: Use the RISCVException enum for CSR operations
  target/riscv: Use RISCVException enum for CSR access
  MAINTAINERS: Update the RISC-V CPU Maintainers
  hw/opentitan: Update the interrupt layout
  hw/riscv: Enable VIRTIO_VGA for RISC-V virt machine
  target/riscv: Fix the PMP is locked check when using TOR
  target/riscv: Add the ePMP feature
  target/riscv/pmp: Remove outdated comment
  target/riscv: Add ePMP support for the Ibex CPU
  target/riscv: Remove the hardcoded RVXLEN macro
  target/riscv: Remove the hardcoded SSTATUS_SD macro
  target/riscv: Remove the hardcoded HGATP_MODE macro
  target/riscv: Remove the hardcoded MSTATUS_SD macro
  target/riscv: Remove the hardcoded SATP_MODE macro
  target/riscv: Remove the unused HSTATUS_WPRI macro
  target/riscv: Remove an unused CASE_OP_32_64 macro
  target/riscv: Consolidate RV32/64 32-bit instructions
  target/riscv: Consolidate RV32/64 16-bit instructions
  target/riscv: Fix the RV64H decode comment

Atish Patra (1):
  target/riscv: Remove privilege v1.9 specific CSR related code

Axel Heider (1):
  docs/system/generic-loader.rst: Fix style

Bin Meng (1):
  hw/riscv: sifive_e: Add 'const' to sifive_e_memmap[]

Dylan Jhong (1):
  target/riscv: Align the data type of reset vector address

Emmanuel Blot (2):
  target/riscv: fix exception index on instruction access fault
  target/riscv: fix a typo with interrupt names

Frank Chang (2):
  target/riscv: fix vrgather macro index variable type bug
  fpu/softfloat: set invalid excp flag for RISC-V muladd instructions

Hou Weiying (4):
  target/riscv: Define ePMP mseccfg
  target/riscv: Add ePMP CSR access functions
  target/riscv: Implementation of enhanced PMP (ePMP)
  target/riscv: Add a config option for ePMP

Jade Fink (1):
  riscv: don't look at SUM when accessing memory from a debugger context

LIU Zhiwei (1):
  target/riscv: Fixup saturate subtract function

Vijai Kumar K (5):
  target/riscv: Add Shakti C class CPU
  riscv: Add initial support for Shakti C machine
  hw/char: Add Shakti UART emulation
  hw/riscv: Connect Shakti UART to Shakti platform
  docs: Add documentation for shakti_c machine

 docs/system/generic-loader.rst  |   9 +-
 docs/system/riscv/shakti-c.rst  |  82 +++
 default-configs/devices/riscv64-softmmu.mak |   1 +
 include/hw/char/shakti_uart.h   |  74 +++
 include/hw/riscv/opentitan.h|  16 +-
 include/hw/riscv/shakti_c.h |  75 +++
 target/riscv/cpu.h  |  42 +-
 target/riscv/cpu_bits.h | 114 +---
 target/riscv/helper.h   |  18 +-
 target/riscv/pmp.h  |  14 +
 target/riscv/insn16-32.decode   |  28 -
 target/riscv/insn16-64.decode   |  36 --
 target/riscv/insn16.decode  |  30 +
 target/riscv/insn32-64.decode   |  88 ---
 target/riscv/insn32.decode  |  67 ++-
 hw/char/shakti_uart.c   | 185 +++
 hw/intc/ibex_plic.c |  20 +-
 hw/riscv/opentitan.c|  10 +-
 hw/riscv/shakti_c.c | 178 ++
 hw/riscv/sifive_e.c |   2 +-
 target/riscv/cpu.c  |  26 +-
 target/riscv/cpu_helper.c   |  88 ++-
 target/riscv/csr.c  | 824 +---
 target/riscv/fpu_helper.c   |  16 +-
 target/riscv/gdbstub.c  |   8 +-
 

Re: [PATCH v6 20/26] tcg/tci: Implement clz, ctz, ctpop

[Philippe Mathieu-Daudé]

On 5/3/21 1:57 AM, Richard Henderson wrote:
> Signed-off-by: Richard Henderson 
> ---
>  tcg/tci/tcg-target.h | 12 +--
>  tcg/tci.c| 44 
>  tcg/tci/tcg-target.c.inc |  9 
>  3 files changed, 59 insertions(+), 6 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v6 19/26] tcg/tci: Implement extract, sextract

[Philippe Mathieu-Daudé]

On 5/3/21 1:57 AM, Richard Henderson wrote:
> Signed-off-by: Richard Henderson 
> ---
>  tcg/tci/tcg-target.h |  8 
>  tcg/tci.c| 42 
>  tcg/tci/tcg-target.c.inc | 32 ++
>  3 files changed, 78 insertions(+), 4 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v6 14/26] tcg/tci: Remove tci_write_reg

[Philippe Mathieu-Daudé]

On 5/3/21 1:57 AM, Richard Henderson wrote:
> Inline it into its one caller, tci_write_reg64.
> Drop the asserts that are redundant with tcg_read_r.
> 
> Signed-off-by: Richard Henderson 
> ---
>  tcg/tci.c | 13 ++---
>  1 file changed, 2 insertions(+), 11 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v6 07/26] tcg: Add tcg_call_func

[Philippe Mathieu-Daudé]

Hi Richard,

On 5/3/21 1:57 AM, Richard Henderson wrote:
> Signed-off-by: Richard Henderson 
> ---
>  tcg/internal.h | 5 +
>  tcg/tcg.c  | 5 ++---
>  2 files changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/tcg/internal.h b/tcg/internal.h
> index c2d5e9c42f..cd128e2a83 100644
> --- a/tcg/internal.h
> +++ b/tcg/internal.h
> @@ -32,6 +32,11 @@ typedef struct TCGHelperInfo {
>  unsigned typemask;
>  } TCGHelperInfo;
>  
> +static inline void *tcg_call_func(TCGOp *op)
> +{
> +return (void *)(uintptr_t)op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op)];

Why not return tcg_insn_unit* type?

> +}
> +
>  static inline const TCGHelperInfo *tcg_call_info(TCGOp *op)
>  {
>  return (void *)(uintptr_t)op->args[TCGOP_CALLO(op) + TCGOP_CALLI(op) + 
> 1];
> diff --git a/tcg/tcg.c b/tcg/tcg.c
> index d42fa6c956..1e5e165bff 100644
> --- a/tcg/tcg.c
> +++ b/tcg/tcg.c
> @@ -2310,7 +2310,7 @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
>  }
>  } else if (c == INDEX_op_call) {
>  const TCGHelperInfo *info = tcg_call_info(op);
> -void *func;
> +void *func = tcg_call_func(op);
>  
>  /* variable number of arguments */
>  nb_oargs = TCGOP_CALLO(op);
> @@ -2324,7 +2324,6 @@ static void tcg_dump_ops(TCGContext *s, bool have_prefs)
>   * Note that plugins have a template function for the info,
>   * but the actual function pointer comes from the plugin.
>   */
> -func = (void *)(uintptr_t)op->args[nb_oargs + nb_iargs];
>  if (func == info->func) {
>  col += qemu_log("%s", info->name);
>  } else {
> @@ -4346,7 +4345,7 @@ static void tcg_reg_alloc_call(TCGContext *s, TCGOp *op)
>  int allocate_args;
>  TCGRegSet allocated_regs;
>  
> -func_addr = (tcg_insn_unit *)(intptr_t)op->args[nb_oargs + nb_iargs];
> +func_addr = tcg_call_func(op);
>  flags = tcg_call_flags(op);
>  
>  nb_regs = ARRAY_SIZE(tcg_target_call_iarg_regs);
> 

Re: [PATCH 2/2] qemu-img: Require -F with -b backing image

[Eric Blake]

On 5/3/21 4:36 PM, Eric Blake wrote:
> Back in commit d9f059aa6c (qemu-img: Deprecate use of -b without -F),
> we deprecated the ability to create a file with a backing image that
> requires qemu to perform format probing.  Qemu can still probe older
> files for backwards compatibility, but it is time to finish off the
> ability to create such images, due to the potential security risk they
> present.  Update a couple of iotests affected by the change.
> 
> Signed-off-by: Eric Blake 
> ---
>  docs/system/deprecated.rst   | 20 -
>  docs/system/removed-features.rst | 19 
>  block.c  | 37 ++--
>  qemu-img.c   |  6 --
>  tests/qemu-iotests/114   | 18 
>  tests/qemu-iotests/114.out   | 11 --
>  tests/qemu-iotests/301   |  4 +---
>  tests/qemu-iotests/301.out   | 16 ++
>  8 files changed, 50 insertions(+), 81 deletions(-)

I'll need a followup to fix iotest failures in 40 and 41 (apparently
they weren't passing backing formats, but I did not catch them in my
original cleanup of iotests back in commit b66ff2c298)

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v6 03/26] accel/tcg/plugin-gen: Drop inline markers

[Philippe Mathieu-Daudé]

On 5/3/21 1:57 AM, Richard Henderson wrote:
> Let the compiler decide on inlining.
> 
> Signed-off-by: Richard Henderson 
> ---
>  accel/tcg/plugin-gen.c | 12 +---
>  1 file changed, 5 insertions(+), 7 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v6 02/26] tcg: Add tcg_call_flags

[Philippe Mathieu-Daudé]

On 5/3/21 1:57 AM, Richard Henderson wrote:
> We're going to change how to look up the call flags from a TCGop,
> so extract it as a helper.
> 
> Signed-off-by: Richard Henderson 
> ---
>  tcg/internal.h | 33 +
>  tcg/optimize.c |  3 ++-
>  tcg/tcg.c  | 15 +++
>  3 files changed, 42 insertions(+), 9 deletions(-)
>  create mode 100644 tcg/internal.h

Reviewed-by: Philippe Mathieu-Daudé 

[PATCH 2/2] qemu-img: Require -F with -b backing image

[Eric Blake]

Back in commit d9f059aa6c (qemu-img: Deprecate use of -b without -F),
we deprecated the ability to create a file with a backing image that
requires qemu to perform format probing.  Qemu can still probe older
files for backwards compatibility, but it is time to finish off the
ability to create such images, due to the potential security risk they
present.  Update a couple of iotests affected by the change.

Signed-off-by: Eric Blake 
---
 docs/system/deprecated.rst   | 20 -
 docs/system/removed-features.rst | 19 
 block.c  | 37 ++--
 qemu-img.c   |  6 --
 tests/qemu-iotests/114   | 18 
 tests/qemu-iotests/114.out   | 11 --
 tests/qemu-iotests/301   |  4 +---
 tests/qemu-iotests/301.out   | 16 ++
 8 files changed, 50 insertions(+), 81 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 9ec1a9d0e03e..aa6f7d84e583 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -315,26 +315,6 @@ this CPU is also deprecated.
 Related binaries
 

-qemu-img backing file without format (since 5.1)
-
-
-The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
-convert`` to create or modify an image that depends on a backing file
-now recommends that an explicit backing format be provided.  This is
-for safety: if QEMU probes a different format than what you thought,
-the data presented to the guest will be corrupt; similarly, presenting
-a raw image to a guest allows a potential security exploit if a future
-probe sees a non-raw image based on guest writes.
-
-To avoid the warning message, or even future refusal to create an
-unsafe image, you must pass ``-o backing_fmt=`` (or the shorthand
-``-F`` during create) to specify the intended backing format.  You may
-use ``qemu-img rebase -u`` to retroactively add a backing format to an
-existing image.  However, be aware that there are already potential
-security risks to blindly using ``qemu-img info`` to probe the format
-of an untrusted backing image, when deciding what format to add into
-an existing image.
-
 Backwards compatibility
 ---

diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
index 28b5df757d35..1928d8a483c0 100644
--- a/docs/system/removed-features.rst
+++ b/docs/system/removed-features.rst
@@ -466,6 +466,25 @@ backing chain should be performed with ``qemu-img rebase 
-u`` either
 before or after the remaining changes being performed by amend, as
 appropriate.

+qemu-img backing file without format (removed in 6.1)
+'
+
+The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
+convert`` to create or modify an image that depends on a backing file
+now requires that an explicit backing format be provided.  This is
+for safety: if QEMU probes a different format than what you thought,
+the data presented to the guest will be corrupt; similarly, presenting
+a raw image to a guest allows a potential security exploit if a future
+probe sees a non-raw image based on guest writes.
+
+To avoid creating unsafe backing chains, you must pass ``-o
+backing_fmt=`` (or the shorthand ``-F`` during create) to specify the
+intended backing format.  You may use ``qemu-img rebase -u`` to
+retroactively add a backing format to an existing image.  However, be
+aware that there are already potential security risks to blindly using
+``qemu-img info`` to probe the format of an untrusted backing image,
+when deciding what format to add into an existing image.
+
 Block devices
 -

diff --git a/block.c b/block.c
index 874c22c43e3d..931e37a8499b 100644
--- a/block.c
+++ b/block.c
@@ -5033,7 +5033,7 @@ int coroutine_fn bdrv_co_check(BlockDriverState *bs,
  * -ENOTSUP - format driver doesn't support changing the backing file
  */
 int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
- const char *backing_fmt, bool warn)
+ const char *backing_fmt, bool require)
 {
 BlockDriver *drv = bs->drv;
 int ret;
@@ -5047,10 +5047,8 @@ int bdrv_change_backing_file(BlockDriverState *bs, const 
char *backing_file,
 return -EINVAL;
 }

-if (warn && backing_file && !backing_fmt) {
-warn_report("Deprecated use of backing file without explicit "
-"backing format, use of this image requires "
-"potentially unsafe format probing");
+if (require && backing_file && !backing_fmt) {
+return -EINVAL;
 }

 if (drv->bdrv_change_backing_file != NULL) {
@@ -6556,24 +6554,11 @@ void bdrv_img_create(const char *filename, const char 
*fmt,
 goto out;
 } else {
 if (!backing_fmt) {
-

[PATCH 0/2] Remove deprecated qemu-img backing file without format

[Eric Blake]

We've gone enough release cycles without noticeable pushback on our
intentions, so time to make it harder to create images that can form a
security hole due to a need for format probing rather than an explicit
format.

Eric Blake (2):
  qcow2: Prohibit backing file changes in 'qemu-img amend'
  qemu-img: Require -F with -b backing image

 docs/system/deprecated.rst   | 32 ---
 docs/system/removed-features.rst | 31 ++
 block.c  | 37 ++--
 block/qcow2.c| 13 ---
 qemu-img.c   |  6 --
 tests/qemu-iotests/061   |  3 +++
 tests/qemu-iotests/061.out   |  3 ++-
 tests/qemu-iotests/082.out   |  6 --
 tests/qemu-iotests/114   | 18 
 tests/qemu-iotests/114.out   | 11 --
 tests/qemu-iotests/301   |  4 +---
 tests/qemu-iotests/301.out   | 16 ++
 12 files changed, 75 insertions(+), 105 deletions(-)

-- 
2.31.1

[PATCH 1/2] qcow2: Prohibit backing file changes in 'qemu-img amend'

[Eric Blake]

This was deprecated back in bc5ee6da7 (qcow2: Deprecate use of
qemu-img amend to change backing file), and no one in the meantime has
given any reasons why it should be supported.  Time to make change
attempts a hard error (but for convenience, specifying the _same_
backing chain is not forbidden).  Update a couple of iotests to match.

Signed-off-by: Eric Blake 
---
 docs/system/deprecated.rst   | 12 
 docs/system/removed-features.rst | 12 
 block/qcow2.c| 13 -
 tests/qemu-iotests/061   |  3 +++
 tests/qemu-iotests/061.out   |  3 ++-
 tests/qemu-iotests/082.out   |  6 --
 6 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 80cae862528a..9ec1a9d0e03e 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -315,18 +315,6 @@ this CPU is also deprecated.
 Related binaries
 

-qemu-img amend to adjust backing file (since 5.1)
-'
-
-The use of ``qemu-img amend`` to modify the name or format of a qcow2
-backing image is deprecated; this functionality was never fully
-documented or tested, and interferes with other amend operations that
-need access to the original backing image (such as deciding whether a
-v3 zero cluster may be left unallocated when converting to a v2
-image).  Rather, any changes to the backing chain should be performed
-with ``qemu-img rebase -u`` either before or after the remaining
-changes being performed by amend, as appropriate.
-
 qemu-img backing file without format (since 5.1)
 

diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
index 29e90601a51a..28b5df757d35 100644
--- a/docs/system/removed-features.rst
+++ b/docs/system/removed-features.rst
@@ -454,6 +454,18 @@ topologies described with -smp include all possible cpus, 
i.e.
 The ``enforce-config-section`` property was replaced by the
 ``-global migration.send-configuration={on|off}`` option.

+qemu-img amend to adjust backing file (removed in 6.1)
+''
+
+The use of ``qemu-img amend`` to modify the name or format of a qcow2
+backing image was never fully documented or tested, and interferes
+with other amend operations that need access to the original backing
+image (such as deciding whether a v3 zero cluster may be left
+unallocated when converting to a v2 image).  Any changes to the
+backing chain should be performed with ``qemu-img rebase -u`` either
+before or after the remaining changes being performed by amend, as
+appropriate.
+
 Block devices
 -

diff --git a/block/qcow2.c b/block/qcow2.c
index 9727ae8fe341..898c4fc4464c 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -5620,15 +5620,10 @@ static int qcow2_amend_options(BlockDriverState *bs, 
QemuOpts *opts,
 if (backing_file || backing_format) {
 if (g_strcmp0(backing_file, s->image_backing_file) ||
 g_strcmp0(backing_format, s->image_backing_format)) {
-warn_report("Deprecated use of amend to alter the backing file; "
-"use qemu-img rebase instead");
-}
-ret = qcow2_change_backing_file(bs,
-backing_file ?: s->image_backing_file,
-backing_format ?: s->image_backing_format);
-if (ret < 0) {
-error_setg_errno(errp, -ret, "Failed to change the backing file");
-return ret;
+error_setg(errp, "Cannot amend the backing file");
+error_append_hint(errp,
+  "You can use 'qemu-img rebase' instead.\n");
+return -EINVAL;
 }
 }

diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061
index e26d94a0df31..9507c223bda4 100755
--- a/tests/qemu-iotests/061
+++ b/tests/qemu-iotests/061
@@ -167,6 +167,9 @@ _make_test_img -o "compat=1.1" 64M
 TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
 $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
 $QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IMG amend -o "backing_file=$TEST_IMG.base,backing_fmt=qcow2" \
+ "$TEST_IMG" && echo "unexpected pass"
+$QEMU_IMG rebase -u -b "$TEST_IMG.base" -F qcow2 "$TEST_IMG"
 $QEMU_IMG amend -o "backing_file=$TEST_IMG.base,backing_fmt=qcow2" "$TEST_IMG"
 $QEMU_IO -c "read -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io
 _check_test_img
diff --git a/tests/qemu-iotests/061.out b/tests/qemu-iotests/061.out
index ee30da266514..7ecbd4dea875 100644
--- a/tests/qemu-iotests/061.out
+++ b/tests/qemu-iotests/061.out
@@ -370,7 +370,8 @@ wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 read 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-qemu-img: warning: Deprecated use of amend to 

Re: Ethernet-over-usb with linux guest using USB Device Controller ?

[Doug Evans]

On Tue, Apr 27, 2021 at 12:31 AM Gerd Hoffmann  wrote:

>   Hi,
>
> > Questions: Is this support in QEMU and if so got any pointers to source
> for
> > existing examples?
> > If not, any guidance on how to proceed?
>
> qemu has only usb host controller emulation, not any usb device
> controller emulation.  So you are entering new territory and there are
> no existing code exsamples, sorry.
>


Thanks. Any suggestions on how you would do it? Even just high level design
points would be helpful.

As far as implementation goes:
1) Is there a "libusb" kinda thing for devices?
  [any sort of utility library that takes the device's point of view]
2) Would it make sense to use the usbredir protocol for speaking USB over
sockets?
  [where in this case QEMU is the device and not the host]
  ref: https://www.spice-space.org/usbredir.html
3) Would it make sense to use the parts that one can from the usbredir
library?
  [ibid]

[PATCH v6 12/12] qtest: Do not restrict bios-tables-test to Aarch64 hosts anymore

[Philippe Mathieu-Daudé]

Since commit 82bf7ae84ce ("target/arm: Remove KVM support for
32-bit Arm hosts") we can remove the comment / check added in
commit ab6b6a4 and directly run the bios-tables-test.

Reviewed-by: Eric Blake 
Reviewed-by: Alex Bennée 
Tested-by: Alex Bennée 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/meson.build | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 0c767389217..46de073d155 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -175,14 +175,13 @@
'boot-serial-test',
'hexloader-test']
 
-# TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test 
unconditional
 qtests_aarch64 = \
-  (cpu != 'arm' ? ['bios-tables-test'] : []) + 
 \
   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? 
['tpm-tis-device-test'] : []) +\
   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? 
['tpm-tis-device-swtpm-test'] : []) +  \
   ['arm-cpu-features',
'numa-test',
'boot-serial-test',
+   'bios-tables-test',
'xlnx-can-test',
'migration-test']
 
-- 
2.26.3

Re: [PATCH v6 11/12] qtest/bios-tables-test: Make test build-independent from accelerator

[Eric Blake]

On 5/3/21 4:10 PM, Philippe Mathieu-Daudé wrote:
> Now than we can probe if the TCG accelerator is available

that

> at runtime with a QMP command, do it once at the beginning
> and only register the tests we can run.
> We can then replace the #ifdef'ry by an assertion.
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
> v5 had:
> Reviewed-by: Eric Blake 
> Reviewed-by: Alex Bennée 
> 
> v6 is simplified and keeps the same logic, however since
> it is different, I'm not keeping the R-b tags.
> ---
>  tests/qtest/bios-tables-test.c | 14 ++
>  1 file changed, 6 insertions(+), 8 deletions(-)
> 

Reviewed-by: Eric Blake 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

[PATCH v6 08/12] qtest/migration-test: Skip tests if KVM not builtin on s390x/ppc64

[Philippe Mathieu-Daudé]

We might have a s390x/ppc64 QEMU binary built without the KVM
accelerator (configured with --disable-kvm).
Checking for /dev/kvm accessibility isn't enough, also check for the
accelerator in the binary.

Reviewed-by: David Gibson 
Reviewed-by: Greg Kurz 
Reviewed-by: Cornelia Huck 
Reviewed-by: Alex Bennée 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/migration-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index 3a711bb4929..c32a2aa30a2 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -1408,7 +1408,7 @@ int main(int argc, char **argv)
  */
 if (g_str_equal(qtest_get_arch(), "ppc64") &&
 (access("/sys/module/kvm_hv", F_OK) ||
- access("/dev/kvm", R_OK | W_OK))) {
+ access("/dev/kvm", R_OK | W_OK) || !qtest_has_accel("kvm"))) {
 g_test_message("Skipping test: kvm_hv not available");
 return g_test_run();
 }
@@ -1419,7 +1419,7 @@ int main(int argc, char **argv)
  */
 if (g_str_equal(qtest_get_arch(), "s390x")) {
 #if defined(HOST_S390X)
-if (access("/dev/kvm", R_OK | W_OK)) {
+if (access("/dev/kvm", R_OK | W_OK) || !qtest_has_accel("kvm")) {
 g_test_message("Skipping test: kvm not available");
 return g_test_run();
 }
-- 
2.26.3

[PATCH v6 10/12] qtest/bios-tables-test: Rename TCG specific tests

[Philippe Mathieu-Daudé]

Some tests require TCG, but don't have '_tcg' in their name,
while others do. Unify the test names by adding 'tcg' to the
TCG specific tests.

Reported-by: Igor Mammedov 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/bios-tables-test.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index ce498b3ff48..ad877baeb1b 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -1255,7 +1255,7 @@ static void test_acpi_microvm_rtc(void)
 free_test_data();
 }
 
-static void test_acpi_microvm_pcie(void)
+static void test_acpi_microvm_pcie_tcg(void)
 {
 test_data data;
 
@@ -1475,7 +1475,7 @@ static void test_acpi_oem_fields_microvm(void)
 g_free(args);
 }
 
-static void test_acpi_oem_fields_virt(void)
+static void test_acpi_oem_fields_virt_tcg(void)
 {
 test_data data = {
 .machine = "virt",
@@ -1555,14 +1555,14 @@ int main(int argc, char *argv[])
 qtest_add_func("acpi/microvm/ioapic2", test_acpi_microvm_ioapic2);
 qtest_add_func("acpi/microvm/oem-fields", 
test_acpi_oem_fields_microvm);
 if (strcmp(arch, "x86_64") == 0) {
-qtest_add_func("acpi/microvm/pcie", test_acpi_microvm_pcie);
+qtest_add_func("acpi/microvm/pcie", test_acpi_microvm_pcie_tcg);
 }
 } else if (strcmp(arch, "aarch64") == 0) {
 qtest_add_func("acpi/virt", test_acpi_virt_tcg);
 qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
 qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
 qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
-qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
+qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt_tcg);
 }
 ret = g_test_run();
 boot_sector_cleanup(disk);
-- 
2.26.3

[PATCH v6 09/12] qtest/bios-tables-test: Rename tests not TCG specific

[Philippe Mathieu-Daudé]

Various tests don't require TCG, but have '_tcg' in their name.
As this is misleading, remove 'tcg' from their name.

Reported-by: Igor Mammedov 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/bios-tables-test.c | 142 -
 1 file changed, 71 insertions(+), 71 deletions(-)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 156d4174aa3..ce498b3ff48 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -753,7 +753,7 @@ static uint8_t base_required_struct_types[] = {
 0, 1, 3, 4, 16, 17, 19, 32, 127
 };
 
-static void test_acpi_piix4_tcg(void)
+static void test_acpi_piix4(void)
 {
 test_data data;
 
@@ -768,7 +768,7 @@ static void test_acpi_piix4_tcg(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_bridge(void)
+static void test_acpi_piix4_bridge(void)
 {
 test_data data;
 
@@ -824,7 +824,7 @@ static void test_acpi_piix4_no_acpi_pci_hotplug(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg(void)
+static void test_acpi_q35(void)
 {
 test_data data;
 
@@ -841,7 +841,7 @@ static void test_acpi_q35_tcg(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_bridge(void)
+static void test_acpi_q35_bridge(void)
 {
 test_data data;
 
@@ -855,7 +855,7 @@ static void test_acpi_q35_tcg_bridge(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_mmio64(void)
+static void test_acpi_q35_mmio64(void)
 {
 test_data data = {
 .machine = MACHINE_Q35,
@@ -872,7 +872,7 @@ static void test_acpi_q35_tcg_mmio64(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_cphp(void)
+static void test_acpi_piix4_cphp(void)
 {
 test_data data;
 
@@ -888,7 +888,7 @@ static void test_acpi_piix4_tcg_cphp(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_cphp(void)
+static void test_acpi_q35_cphp(void)
 {
 test_data data;
 
@@ -908,7 +908,7 @@ static uint8_t ipmi_required_struct_types[] = {
 0, 1, 3, 4, 16, 17, 19, 32, 38, 127
 };
 
-static void test_acpi_q35_tcg_ipmi(void)
+static void test_acpi_q35_ipmi(void)
 {
 test_data data;
 
@@ -923,7 +923,7 @@ static void test_acpi_q35_tcg_ipmi(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_ipmi(void)
+static void test_acpi_piix4_ipmi(void)
 {
 test_data data;
 
@@ -941,7 +941,7 @@ static void test_acpi_piix4_tcg_ipmi(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_memhp(void)
+static void test_acpi_q35_memhp(void)
 {
 test_data data;
 
@@ -957,7 +957,7 @@ static void test_acpi_q35_tcg_memhp(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_memhp(void)
+static void test_acpi_piix4_memhp(void)
 {
 test_data data;
 
@@ -973,7 +973,7 @@ static void test_acpi_piix4_tcg_memhp(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_nosmm(void)
+static void test_acpi_piix4_nosmm(void)
 {
 test_data data;
 
@@ -984,7 +984,7 @@ static void test_acpi_piix4_tcg_nosmm(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_smm_compat(void)
+static void test_acpi_piix4_smm_compat(void)
 {
 test_data data;
 
@@ -995,7 +995,7 @@ static void test_acpi_piix4_tcg_smm_compat(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_smm_compat_nosmm(void)
+static void test_acpi_piix4_smm_compat_nosmm(void)
 {
 test_data data;
 
@@ -1006,7 +1006,7 @@ static void test_acpi_piix4_tcg_smm_compat_nosmm(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_nohpet(void)
+static void test_acpi_piix4_nohpet(void)
 {
 test_data data;
 
@@ -1017,7 +1017,7 @@ static void test_acpi_piix4_tcg_nohpet(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_numamem(void)
+static void test_acpi_q35_numamem(void)
 {
 test_data data;
 
@@ -1029,7 +1029,7 @@ static void test_acpi_q35_tcg_numamem(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_nosmm(void)
+static void test_acpi_q35_nosmm(void)
 {
 test_data data;
 
@@ -1040,7 +1040,7 @@ static void test_acpi_q35_tcg_nosmm(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_smm_compat(void)
+static void test_acpi_q35_smm_compat(void)
 {
 test_data data;
 
@@ -1051,7 +1051,7 @@ static void test_acpi_q35_tcg_smm_compat(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_smm_compat_nosmm(void)
+static void test_acpi_q35_smm_compat_nosmm(void)
 {
 test_data data;
 
@@ -1062,7 +1062,7 @@ static void test_acpi_q35_tcg_smm_compat_nosmm(void)
 free_test_data();
 }
 
-static void test_acpi_q35_tcg_nohpet(void)
+static void test_acpi_q35_nohpet(void)
 {
 test_data data;
 
@@ -1073,7 +1073,7 @@ static void test_acpi_q35_tcg_nohpet(void)
 free_test_data();
 }
 
-static void test_acpi_piix4_tcg_numamem(void)
+static void test_acpi_piix4_numamem(void)
 {
 test_data data;
 
@@ -1087,11 +1087,11 @@ static void test_acpi_piix4_tcg_numamem(void)
 
 uint64_t tpm_tis_base_addr;
 

[PATCH v6 06/12] qtest/arm-cpu-features: Remove TCG fallback to KVM specific tests

[Philippe Mathieu-Daudé]

sve_tests_sve_off_kvm() and test_query_cpu_model_expansion_kvm()
tests are now only being run if KVM is available. Drop the TCG
fallback.

Suggested-by: Andrew Jones 
Reviewed-by: Andrew Jones 
Reviewed-by: Alex Bennée 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/arm-cpu-features.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index 66300c3bc20..b1d406542f7 100644
--- a/tests/qtest/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
@@ -21,7 +21,7 @@
 #define SVE_MAX_VQ 16
 
 #define MACHINE "-machine virt,gic-version=max -accel tcg "
-#define MACHINE_KVM "-machine virt,gic-version=max -accel kvm -accel tcg "
+#define MACHINE_KVM "-machine virt,gic-version=max -accel kvm "
 #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
 "  'arguments': { 'type': 'full', "
 #define QUERY_TAIL  "}}"
-- 
2.26.3

[PATCH v6 05/12] qtest/arm-cpu-features: Restrict sve_tests_sve_off_kvm test to KVM

[Philippe Mathieu-Daudé]

The sve_tests_sve_off_kvm() test is KVM specific.
Only run it if KVM is available.

Suggested-by: Andrew Jones 
Reviewed-by: Andrew Jones 
Reviewed-by: Alex Bennée 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/arm-cpu-features.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index 7f4b2521277..66300c3bc20 100644
--- a/tests/qtest/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
@@ -604,6 +604,8 @@ int main(int argc, char **argv)
 if (g_str_equal(qtest_get_arch(), "aarch64") && qtest_has_accel("kvm")) {
 qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
 NULL, test_query_cpu_model_expansion_kvm);
+qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
+NULL, sve_tests_sve_off_kvm);
 }
 
 if (g_str_equal(qtest_get_arch(), "aarch64")) {
@@ -611,8 +613,6 @@ int main(int argc, char **argv)
 NULL, sve_tests_sve_max_vq_8);
 qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
 NULL, sve_tests_sve_off);
-qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
-NULL, sve_tests_sve_off_kvm);
 }
 
 return g_test_run();
-- 
2.26.3

[PATCH v6 07/12] qtest/arm-cpu-features: Use generic qtest_has_accel() to check for TCG

[Philippe Mathieu-Daudé]

Now than we can probe if the TCG accelerator is available
at runtime with a QMP command, only run these tests if TCG
is built into the QEMU binary.

Suggested-by: Andrew Jones 
Reviewed-by: Andrew Jones 
Reviewed-by: Alex Bennée 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/arm-cpu-features.c | 16 +---
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index b1d406542f7..0d9145dd168 100644
--- a/tests/qtest/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
@@ -20,7 +20,7 @@
  */
 #define SVE_MAX_VQ 16
 
-#define MACHINE "-machine virt,gic-version=max -accel tcg "
+#define MACHINE_TCG "-machine virt,gic-version=max -accel tcg "
 #define MACHINE_KVM "-machine virt,gic-version=max -accel kvm "
 #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
 "  'arguments': { 'type': 'full', "
@@ -337,7 +337,7 @@ static void sve_tests_sve_max_vq_8(const void *data)
 {
 QTestState *qts;
 
-qts = qtest_init(MACHINE "-cpu max,sve-max-vq=8");
+qts = qtest_init(MACHINE_TCG "-cpu max,sve-max-vq=8");
 
 assert_sve_vls(qts, "max", BIT_ULL(8) - 1, NULL);
 
@@ -372,7 +372,7 @@ static void sve_tests_sve_off(const void *data)
 {
 QTestState *qts;
 
-qts = qtest_init(MACHINE "-cpu max,sve=off");
+qts = qtest_init(MACHINE_TCG "-cpu max,sve=off");
 
 /* SVE is off, so the map should be empty. */
 assert_sve_vls(qts, "max", 0, NULL);
@@ -428,7 +428,7 @@ static void test_query_cpu_model_expansion(const void *data)
 {
 QTestState *qts;
 
-qts = qtest_init(MACHINE "-cpu max");
+qts = qtest_init(MACHINE_TCG "-cpu max");
 
 /* Test common query-cpu-model-expansion input validation */
 assert_type_full(qts);
@@ -593,8 +593,10 @@ int main(int argc, char **argv)
 {
 g_test_init(, , NULL);
 
-qtest_add_data_func("/arm/query-cpu-model-expansion",
-NULL, test_query_cpu_model_expansion);
+if (qtest_has_accel("tcg")) {
+qtest_add_data_func("/arm/query-cpu-model-expansion",
+NULL, test_query_cpu_model_expansion);
+}
 
 /*
  * For now we only run KVM specific tests with AArch64 QEMU in
@@ -608,7 +610,7 @@ int main(int argc, char **argv)
 NULL, sve_tests_sve_off_kvm);
 }
 
-if (g_str_equal(qtest_get_arch(), "aarch64")) {
+if (g_str_equal(qtest_get_arch(), "aarch64") && qtest_has_accel("tcg")) {
 qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
 NULL, sve_tests_sve_max_vq_8);
 qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
-- 
2.26.3