Re: [PATCH v2 2/5] target/ppc: powerpc_excp: Add excp_vectors bounds check

[Cédric Le Goater]

On 12/29/21 17:57, Fabiano Rosas wrote:

The next patch will start accessing the excp_vectors array earlier in
the function, so add a bounds check as first thing here.

This converts the empty return on POWERPC_EXCP_NONE to an error. This
exception number never reaches this function and if it does it
probably means something else went wrong up the line.

Signed-off-by: Fabiano Rosas 


Reviewed-by: Cédric Le Goater 

Thanks,

C.


---
  target/ppc/excp_helper.c | 7 ---
  1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 8b9c6bc5a8..9a03e4b896 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -300,6 +300,10 @@ static inline void powerpc_excp(PowerPCCPU *cpu, int 
excp_model, int excp)
  target_ulong msr, new_msr, vector;
  int srr0, srr1, lev = -1;
  
+if (excp <= POWERPC_EXCP_NONE || excp >= POWERPC_EXCP_NB) {

+cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
+}
+
  qemu_log_mask(CPU_LOG_INT, "Raise exception at " TARGET_FMT_lx
" => %08x (%02x)\n", env->nip, excp, env->error_code);
  
@@ -353,9 +357,6 @@ static inline void powerpc_excp(PowerPCCPU *cpu, int excp_model, int excp)

  #endif
  
  switch (excp) {

-case POWERPC_EXCP_NONE:
-/* Should never happen */
-return;
  case POWERPC_EXCP_CRITICAL:/* Critical input 
*/
  switch (excp_model) {
  case POWERPC_EXCP_40x:

[PATCH] target/ppc: Check effective address validity

[Cédric Le Goater]

For Radix translation, the EA range is 64-bits. when EA(2:11) are
nonzero, a segment interrupt should occur.

Signed-off-by: Cédric Le Goater 
---
 target/ppc/mmu-radix64.h | 1 +
 target/ppc/mmu-radix64.c | 5 +
 2 files changed, 6 insertions(+)

diff --git a/target/ppc/mmu-radix64.h b/target/ppc/mmu-radix64.h
index b70357cf345c..4c768aa5cc74 100644
--- a/target/ppc/mmu-radix64.h
+++ b/target/ppc/mmu-radix64.h
@@ -5,6 +5,7 @@
 
 /* Radix Quadrants */
 #define R_EADDR_MASK0x3FFF
+#define R_EADDR_VALID_MASK  0xC00F
 #define R_EADDR_QUADRANT0xC000
 #define R_EADDR_QUADRANT0   0x
 #define R_EADDR_QUADRANT1   0x4000
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index d10ae001d7c9..040c055bff65 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -32,6 +32,11 @@ static bool ppc_radix64_get_fully_qualified_addr(const 
CPUPPCState *env,
  vaddr eaddr,
  uint64_t *lpid, uint64_t *pid)
 {
+/* When EA(2:11) are nonzero, raise a segment interrupt */
+if (eaddr & ~R_EADDR_VALID_MASK) {
+return false;
+}
+
 if (msr_hv) { /* MSR[HV] -> Hypervisor/bare metal */
 switch (eaddr & R_EADDR_QUADRANT) {
 case R_EADDR_QUADRANT0:
-- 
2.31.1

Re: [PATCH 2/3] hw/sysbus: Restrict sysbus_get_connected_irq() to sysbus-internal.h

[wangyanan (Y)]

On 2021/12/30 6:52, Philippe Mathieu-Daudé wrote:

sysbus_get_connected_irq() and sysbus_is_irq_connected() are only
used by platform-bus.c; restrict them to hw/core/ by adding a local
"sysbus-internal.h" header.

Signed-off-by: Philippe Mathieu-Daudé 
---
  hw/core/sysbus-internal.h | 16 
  include/hw/sysbus.h   |  2 --
  hw/core/platform-bus.c|  2 +-
  hw/core/sysbus.c  |  1 +
  4 files changed, 18 insertions(+), 3 deletions(-)
  create mode 100644 hw/core/sysbus-internal.h

Reviewed-by: Yanan Wang 

Thanks,
Yanan

diff --git a/hw/core/sysbus-internal.h b/hw/core/sysbus-internal.h
new file mode 100644
index 000..991b3e3159c
--- /dev/null
+++ b/hw/core/sysbus-internal.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * SysBus internal helpers
+ *
+ * Copyright (c) 2021 QEMU contributors
+ */
+#ifndef HW_CORE_SYSBUS_INTERNAL_H
+#define HW_CORE_SYSBUS_INTERNAL_H
+
+#include "hw/sysbus.h"
+
+/* Following functions are only used by the platform-bus subsystem */
+qemu_irq sysbus_get_connected_irq(SysBusDevice *dev, int n);
+bool sysbus_is_irq_connected(SysBusDevice *dev, int n);
+
+#endif /* HW_CORE_SYSBUS_INTERNAL_H */
diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 3564b7b6a22..24645ee7996 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -77,8 +77,6 @@ void sysbus_init_ioports(SysBusDevice *dev, uint32_t ioport, 
uint32_t size);
  bool sysbus_has_irq(SysBusDevice *dev, int n);
  bool sysbus_has_mmio(SysBusDevice *dev, unsigned int n);
  void sysbus_connect_irq(SysBusDevice *dev, int n, qemu_irq irq);
-bool sysbus_is_irq_connected(SysBusDevice *dev, int n);
-qemu_irq sysbus_get_connected_irq(SysBusDevice *dev, int n);
  void sysbus_mmio_map(SysBusDevice *dev, int n, hwaddr addr);
  void sysbus_mmio_map_overlap(SysBusDevice *dev, int n, hwaddr addr,
   int priority);
diff --git a/hw/core/platform-bus.c b/hw/core/platform-bus.c
index b8487b26b67..016fb71eba1 100644
--- a/hw/core/platform-bus.c
+++ b/hw/core/platform-bus.c
@@ -25,7 +25,7 @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "qemu/module.h"
-
+#include "sysbus-internal.h"
  
  /*

   * Returns the PlatformBus IRQ number for a SysBusDevice irq number or -1 if
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index 0e6773c8df7..dcd7beda184 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -24,6 +24,7 @@
  #include "monitor/monitor.h"
  #include "exec/address-spaces.h"
  #include "qdev-internal.h"
+#include "sysbus-internal.h"
  
  static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent);

  static char *sysbus_get_fw_dev_path(DeviceState *dev);

Re: [PATCH 1/3] hw/qdev: Restrict qdev_get_gpio_out_connector() to qdev-internal.h

[wangyanan (Y)]

Hi,

On 2021/12/30 6:52, Philippe Mathieu-Daudé wrote:

qdev_get_gpio_out_connector() is called by sysbus_get_connected_irq()
which is only used by platform-bus.c; restrict it to hw/core/ by
adding a local "qdev-internal.h" header.

Signed-off-by: Philippe Mathieu-Daudé 
---
  hw/core/qdev-internal.h | 15 +++
  include/hw/qdev-core.h  | 18 --
  hw/core/gpio.c  |  1 +
  hw/core/sysbus.c|  1 +
  4 files changed, 17 insertions(+), 18 deletions(-)
  create mode 100644 hw/core/qdev-internal.h

diff --git a/hw/core/qdev-internal.h b/hw/core/qdev-internal.h
new file mode 100644
index 000..6ec17d0ea70
--- /dev/null
+++ b/hw/core/qdev-internal.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * qdev internal helpers
+ *
+ * Copyright (c) 2009-2021 QEMU contributors
+ */
+#ifndef HW_CORE_QDEV_INTERNAL_H
+#define HW_CORE_QDEV_INTERNAL_H
+
+#include "hw/qdev-core.h"
+
+/* Following functions are only used by the platform-bus subsystem */

Could it be better to also keep the original function comment here?

+qemu_irq qdev_get_gpio_out_connector(DeviceState *dev, const char *name, int 
n);
+
+#endif /* HW_CORE_QDEV_INTERNAL_H */
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index d19c9417520..655899654bb 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -532,24 +532,6 @@ void qdev_connect_gpio_out(DeviceState *dev, int n, 
qemu_irq pin);
  void qdev_connect_gpio_out_named(DeviceState *dev, const char *name, int n,
   qemu_irq input_pin);
  
-/**

- * qdev_get_gpio_out_connector: Get the qemu_irq connected to an output GPIO
- * @dev: Device whose output GPIO we are interested in
- * @name: Name of the output GPIO array
- * @n: Number of the output GPIO line within that array
- *
- * Returns whatever qemu_irq is currently connected to the specified
- * output GPIO line of @dev. This will be NULL if the output GPIO line
- * has never been wired up to the anything.  Note that the qemu_irq
- * returned does not belong to @dev -- it will be the input GPIO or
- * IRQ of whichever device the board code has connected up to @dev's
- * output GPIO.
- *
- * You probably don't need to use this function -- it is used only
- * by the platform-bus subsystem.
- */
-qemu_irq qdev_get_gpio_out_connector(DeviceState *dev, const char *name, int 
n);
-
  /**
   * qdev_intercept_gpio_out: Intercept an existing GPIO connection
   * @dev: Device to intercept the outbound GPIO line from
diff --git a/hw/core/gpio.c b/hw/core/gpio.c
index 80d07a6ec99..513ccbd1062 100644
--- a/hw/core/gpio.c
+++ b/hw/core/gpio.c
@@ -21,6 +21,7 @@
  #include "hw/qdev-core.h"
  #include "hw/irq.h"
  #include "qapi/error.h"
+#include "qdev-internal.h"
  
  static NamedGPIOList *qdev_get_named_gpio_list(DeviceState *dev,

 const char *name)
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index 05c1da3d311..0e6773c8df7 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -23,6 +23,7 @@
  #include "hw/sysbus.h"
  #include "monitor/monitor.h"
  #include "exec/address-spaces.h"
+#include "qdev-internal.h"
  
  static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent);

  static char *sysbus_get_fw_dev_path(DeviceState *dev);

Otherwise, the tweak looks reasonable:
Reviewed-by: Yanan Wang 

Thanks,
Yanan

Re: [PATCH v2 1/6] target/riscv: add cfg properties for zfinx, zdinx and zhinx{min}

[Bin Meng]

On Fri, Dec 31, 2021 at 11:26 AM Weiwei Li  wrote:
>
> From: liweiwei 

You missed here, "From" should match "SoB" name

>
> Co-authored-by: ardxwe 
> Signed-off-by: Weiwei Li 
> Signed-off-by: Junqiang Wang 
> Reviewed-by: Richard Henderson 
> ---
>  target/riscv/cpu.c   | 12 
>  target/riscv/cpu.h   |  4 
>  target/riscv/translate.c |  8 
>  3 files changed, 24 insertions(+)
>
> diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> index 6ef3314bce..d9ea005724 100644
> --- a/target/riscv/cpu.c
> +++ b/target/riscv/cpu.c
> @@ -491,6 +491,11 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
> **errp)
>  cpu->cfg.ext_d = true;
>  }
>
> +if (cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinx ||
> +cpu->cfg.ext_zhinxmin) {
> +cpu->cfg.ext_zfinx = true;
> +}
> +
>  /* Set the ISA extensions, checks should have happened above */
>  if (cpu->cfg.ext_i) {
>  ext |= RVI;
> @@ -565,6 +570,13 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
> **errp)
>  if (cpu->cfg.ext_j) {
>  ext |= RVJ;
>  }
> +if (cpu->cfg.ext_zfinx && ((ext & (RVF | RVD)) || cpu->cfg.ext_zfh ||
> +   cpu->cfg.ext_zfhmin)) {
> +error_setg(errp,
> +"'Zfinx' cannot be supported together with 'F', 'D', 
> 'Zfh',"
> +" 'Zfhmin'");
> +return;
> +}
>
>  set_misa(env, env->misa_mxl, ext);
>  }
> diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> index dc10f27093..6fba31c5cd 100644
> --- a/target/riscv/cpu.h
> +++ b/target/riscv/cpu.h
> @@ -315,8 +315,12 @@ struct RISCVCPU {
>  bool ext_counters;
>  bool ext_ifencei;
>  bool ext_icsr;
> +bool ext_zdinx;
>  bool ext_zfh;
>  bool ext_zfhmin;
> +bool ext_zfinx;
> +bool ext_zhinx;
> +bool ext_zhinxmin;
>
>  char *priv_spec;
>  char *user_spec;
> diff --git a/target/riscv/translate.c b/target/riscv/translate.c
> index 5df6c0d800..8b1cdacf50 100644
> --- a/target/riscv/translate.c
> +++ b/target/riscv/translate.c
> @@ -76,8 +76,12 @@ typedef struct DisasContext {
>  RISCVMXL ol;
>  bool virt_enabled;
>  bool ext_ifencei;
> +bool ext_zdinx;
>  bool ext_zfh;
>  bool ext_zfhmin;
> +bool ext_zfinx;
> +bool ext_zhinx;
> +bool ext_zhinxmin;
>  bool hlsx;
>  /* vector extension */
>  bool vill;
> @@ -703,8 +707,12 @@ static void riscv_tr_init_disas_context(DisasContextBase 
> *dcbase, CPUState *cs)
>  ctx->misa_ext = env->misa_ext;
>  ctx->frm = -1;  /* unknown rounding mode */
>  ctx->ext_ifencei = cpu->cfg.ext_ifencei;
> +ctx->ext_zdinx = cpu->cfg.ext_zdinx;
>  ctx->ext_zfh = cpu->cfg.ext_zfh;
>  ctx->ext_zfhmin = cpu->cfg.ext_zfhmin;
> +ctx->ext_zfinx = cpu->cfg.ext_zfinx;
> +ctx->ext_zhinx = cpu->cfg.ext_zhinx;
> +ctx->ext_zhinxmin = cpu->cfg.ext_zhinxmin;
>  ctx->vlen = cpu->cfg.vlen;
>  ctx->elen = cpu->cfg.elen;
>  ctx->mstatus_hs_fs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_FS);
> --

Regards,
Bin

[PATCH 2/3] migration/migration.c: Avoid COLO boot in postcopy migration

[Zhang Chen]

COLO dose not support postcopy migration and remove the Fixme.

Signed-off-by: Zhang Chen 
---
 migration/migration.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 2afa77da03..3fac9c67ca 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3230,7 +3230,11 @@ static void migration_completion(MigrationState *s)
 goto fail_invalidate;
 }
 
-if (!migrate_colo_enabled()) {
+if (migrate_colo_enabled() && s->state == MIGRATION_STATUS_ACTIVE) {
+/* COLO dose not support postcopy */
+migrate_set_state(&s->state, MIGRATION_STATUS_ACTIVE,
+  MIGRATION_STATUS_COLO);
+} else {
 migrate_set_state(&s->state, current_active_state,
   MIGRATION_STATUS_COMPLETED);
 }
@@ -3621,10 +3625,6 @@ static void migration_iteration_finish(MigrationState *s)
  "COLO enabled", __func__);
 }
 migrate_start_colo_process(s);
-/*
- * Fixme: we will run VM in COLO no matter its old running state.
- * After exited COLO, we will keep running.
- */
  /* Fallthrough */
 case MIGRATION_STATUS_ACTIVE:
 /*
-- 
2.25.1

[PATCH 3/3] migration/migration.c: Remove the MIGRATION_STATUS_ACTIVE when migration finished

[Zhang Chen]

The MIGRATION_STATUS_ACTIVE indicates that migration is running.
Remove it to be handled by the default operation,
It should be part of the unknown ending states.

Signed-off-by: Zhang Chen 
---
 migration/migration.c | 6 --
 1 file changed, 6 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 3fac9c67ca..21e1498f46 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3625,12 +3625,6 @@ static void migration_iteration_finish(MigrationState *s)
  "COLO enabled", __func__);
 }
 migrate_start_colo_process(s);
- /* Fallthrough */
-case MIGRATION_STATUS_ACTIVE:
-/*
- * We should really assert here, but since it's during
- * migration, let's try to reduce the usage of assertions.
- */
 s->vm_was_running = true;
 /* Fallthrough */
 case MIGRATION_STATUS_FAILED:
-- 
2.25.1

RE: [PATCH] MAINTAINERS: email address change

[Zhang, Chen]

> -Original Message-
> From: Li Zhijian 
> Sent: Friday, December 31, 2021 1:09 PM
> To: th...@redhat.com; peter.mayd...@linaro.org; f4...@amsat.org
> Cc: qemu-devel@nongnu.org; Zhang, Chen ; Li
> Zhijian 
> Subject: [PATCH] MAINTAINERS: email address change
> 
> Fujitsu's mail service has migrated to O365 months ago, the
> lizhij...@cn.fujitsu.com address will stop working on 2022-06-01, change it to
> my new email address lizhij...@fujitsu.com.
> 
> Signed-off-by: Li Zhijian 

Acked-by: Zhang Chen 

Thanks
Chen

> ---
>  MAINTAINERS | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 50435b8d2f5..e5cda5886d4 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -2943,7 +2943,7 @@ F: docs/COLO-FT.txt
> 
>  COLO Proxy
>  M: Zhang Chen 
> -M: Li Zhijian 
> +M: Li Zhijian 
>  S: Supported
>  F: docs/colo-proxy.txt
>  F: net/colo*
> --
> 2.33.0
> 
> 

[PATCH 1/3] migration/migration.c: Add missed default error handler for migration state

[Zhang Chen]

In the migration_completion() no other status is expected, for
example MIGRATION_STATUS_CANCELLING, MIGRATION_STATUS_CANCELLED, etc.

Signed-off-by: Zhang Chen 
---
 migration/migration.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/migration.c b/migration/migration.c
index 0652165610..2afa77da03 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3205,7 +3205,7 @@ static void migration_completion(MigrationState *s)
 qemu_mutex_unlock_iothread();
 
 trace_migration_completion_postcopy_end_after_complete();
-} else if (s->state == MIGRATION_STATUS_CANCELLING) {
+} else {
 goto fail;
 }
 
-- 
2.25.1

[PATCH 0/3] Some minor fixes for migration states

[Zhang Chen]

This series solved some fixme and comments in code.
Please see the details in each patch commit message.

Zhang Chen (3):
  migration/migration.c: Add missed default error handler for migration
state
  migration/migration.c: Avoid COLO boot in postcopy migration
  migration/migration.c: Remove the MIGRATION_STATUS_ACTIVE when
migration finished

 migration/migration.c | 18 ++
 1 file changed, 6 insertions(+), 12 deletions(-)

-- 
2.25.1

[PATCH] meson: Unify mips and mips64 in host_arch

[Richard Henderson]

Fixes the build on a mips64 host.  Prior to the break, we identified
the arch via the __mips__ define; afterward we use meson's
host_machine.cpu_family().  Restore the previous combination.

Fixes: 823eb013452e ("configure, meson: move ARCH to meson.build")
Reported-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 meson.build | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meson.build b/meson.build
index 886f0a9343..53065e96ec 100644
--- a/meson.build
+++ b/meson.build
@@ -74,6 +74,8 @@ if cpu not in supported_cpus
   host_arch = 'unknown'
 elif cpu == 'x86'
   host_arch = 'i386'
+elif cpu == 'mips64'
+  host_arch = 'mips'
 else
   host_arch = cpu
 endif
-- 
2.25.1

Re: [PULL 00/22] Memory API patches for 2021-12-31

[Richard Henderson]

On 12/30/21 4:55 PM, Philippe Mathieu-Daudé wrote:

The following changes since commit d5a9f352896fe43183ef01072b374e89a3488315:

   Merge tag 'pull-jobs-2021-12-29' of 
https://src.openvz.org/scm/~vsementsov/qemu into staging (2021-12-29 14:33:23 
-0800)

are available in the Git repository at:

   https://github.com/philmd/qemu.git tags/memory-api-20211231

for you to fetch changes up to 4a63054bce23982b99f4d3c65528e47e614086b2:

   pci: Let ld*_pci_dma() propagate MemTxResult (2021-12-31 01:05:27 +0100)


Memory API patches

Have various functions from the Memory API:
- take a MemTxAttrs argument,
- propagate a MemTxResult.

Some patches trigger "WARNING: line over 80 characters",
and a pair "ERROR: spaces required around that '*' (ctx:WxV)",
both false positives.


Philippe Mathieu-Daudé (22):
   hw/scsi/megasas: Use uint32_t for reply queue head/tail values
   dma: Let dma_memory_valid() take MemTxAttrs argument
   dma: Let dma_memory_set() take MemTxAttrs argument
   dma: Let dma_memory_rw_relaxed() take MemTxAttrs argument
   dma: Let dma_memory_rw() take MemTxAttrs argument
   dma: Let dma_memory_read/write() take MemTxAttrs argument
   dma: Let dma_memory_map() take MemTxAttrs argument
   dma: Have dma_buf_rw() take a void pointer
   dma: Have dma_buf_read() / dma_buf_write() take a void pointer
   pci: Let pci_dma_rw() take MemTxAttrs argument
   dma: Let dma_buf_rw() take MemTxAttrs argument
   dma: Let dma_buf_write() take MemTxAttrs argument
   dma: Let dma_buf_read() take MemTxAttrs argument
   dma: Let dma_buf_rw() propagate MemTxResult
   dma: Let st*_dma() take MemTxAttrs argument
   dma: Let ld*_dma() take MemTxAttrs argument
   dma: Let st*_dma() propagate MemTxResult
   dma: Let ld*_dma() propagate MemTxResult
   pci: Let st*_pci_dma() take MemTxAttrs argument
   pci: Let ld*_pci_dma() take MemTxAttrs argument
   pci: Let st*_pci_dma() propagate MemTxResult
   pci: Let ld*_pci_dma() propagate MemTxResult

  include/hw/pci/pci.h  | 38 +--
  include/hw/ppc/spapr_vio.h| 30 
  include/sysemu/dma.h  | 88 ---
  hw/arm/musicpal.c | 13 +++---
  hw/arm/smmu-common.c  |  3 +-
  hw/arm/smmuv3.c   | 14 --
  hw/audio/intel-hda.c  | 13 --
  hw/core/generic-loader.c  |  3 +-
  hw/display/virtio-gpu.c   | 10 ++--
  hw/dma/pl330.c| 12 +++--
  hw/dma/sparc32_dma.c  | 16 ---
  hw/dma/xlnx-zynq-devcfg.c |  6 ++-
  hw/dma/xlnx_dpdma.c   | 10 ++--
  hw/hyperv/vmbus.c |  8 ++--
  hw/i386/amd_iommu.c   | 16 ---
  hw/i386/intel_iommu.c | 28 ++-
  hw/ide/ahci.c | 18 ---
  hw/ide/macio.c|  2 +-
  hw/intc/pnv_xive.c|  7 +--
  hw/intc/spapr_xive.c  |  3 +-
  hw/intc/xive.c|  7 +--
  hw/misc/bcm2835_property.c|  3 +-
  hw/misc/macio/mac_dbdma.c | 10 ++--
  hw/net/allwinner-sun8i-emac.c | 18 ---
  hw/net/eepro100.c | 49 +++
  hw/net/ftgmac100.c| 25 ++
  hw/net/imx_fec.c  | 32 -
  hw/net/npcm7xx_emc.c  | 20 
  hw/net/tulip.c| 36 +++---
  hw/nvme/ctrl.c|  5 +-
  hw/nvram/fw_cfg.c | 16 ---
  hw/pci-host/pnv_phb3.c|  5 +-
  hw/pci-host/pnv_phb3_msi.c|  9 ++--
  hw/pci-host/pnv_phb4.c|  5 +-
  hw/scsi/esp-pci.c |  2 +-
  hw/scsi/megasas.c | 64 ++---
  hw/scsi/mptsas.c  | 16 +--
  hw/scsi/scsi-bus.c|  4 +-
  hw/scsi/vmw_pvscsi.c  | 20 +---
  hw/sd/allwinner-sdhost.c  | 14 +++---
  hw/sd/sdhci.c | 35 --
  hw/usb/hcd-dwc2.c |  8 ++--
  hw/usb/hcd-ehci.c |  6 ++-
  hw/usb/hcd-ohci.c | 28 ++-
  hw/usb/hcd-xhci.c | 26 +++
  hw/usb/libhw.c|  3 +-
  hw/virtio/virtio.c|  6 ++-
  softmmu/dma-helpers.c | 40 ++--
  hw/scsi/trace-events  |  8 ++--
  49 files changed, 526 insertions(+), 332 deletions(-)


Applied, thanks.

r~

[PATCH] MAINTAINERS: email address change

[Li Zhijian]

Fujitsu's mail service has migrated to O365 months ago, the
lizhij...@cn.fujitsu.com address will stop working on 2022-06-01,
change it to my new email address lizhij...@fujitsu.com.

Signed-off-by: Li Zhijian 
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 50435b8d2f5..e5cda5886d4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2943,7 +2943,7 @@ F: docs/COLO-FT.txt
 
 COLO Proxy
 M: Zhang Chen 
-M: Li Zhijian 
+M: Li Zhijian 
 S: Supported
 F: docs/colo-proxy.txt
 F: net/colo*
-- 
2.33.0

Re: [PATCH v8 0/7] Add vmnet.framework based network backend

[Vladislav Yaroshchuk]

ping
https://patchew.org/QEMU/20211211104413.50524-1-yaroshchuk2...@gmail.com/


сб, 11 дек. 2021 г. в 13:44, Vladislav Yaroshchuk :

> macOS provides networking API for VMs called 'vmnet.framework':
> https://developer.apple.com/documentation/vmnet
>
> We can provide its support as the new QEMU network backends which
> represent three different vmnet.framework interface usage modes:
>
>   * `vmnet-shared`:
> allows the guest to communicate with other guests in shared mode and
> also with external network (Internet) via NAT. Has (macOS-provided)
> DHCP server; subnet mask and IP range can be configured;
>
>   * `vmnet-host`:
> allows the guest to communicate with other guests in host mode.
> By default has enabled DHCP as `vmnet-shared`, but providing
> network unique id (uuid) can make `vmnet-host` interfaces isolated
> from each other and also disables DHCP.
>
>   * `vmnet-bridged`:
> bridges the guest with a physical network interface.
>
> This backends cannot work on macOS Catalina 10.15 cause we use
> vmnet.framework API provided only with macOS 11 and newer. Seems
> that it is not a problem, because QEMU guarantees to work on two most
> recent versions of macOS which now are Big Sur (11) and Monterey (12).
>
> Also, we have one inconvenient restriction: vmnet.framework interfaces
> can create only privileged user:
> `$ sudo qemu-system-x86_64 -nic vmnet-shared`
>
> Attempt of `vmnet-*` netdev creation being unprivileged user fails with
> vmnet's 'general failure'.
>
> This happens because vmnet.framework requires `com.apple.vm.networking`
> entitlement which is: "restricted to developers of virtualization software.
> To request this entitlement, contact your Apple representative." as Apple
> documentation says:
>
> https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_vm_networking
>
> One more note: we still have quite useful but not supported
> 'vmnet.framework' features as creating port forwarding rules, IPv6
> NAT prefix specifying and so on.
>
> Nevertheless, new backends work fine and tested within `qemu-system-x86-64`
> on macOS Bir Sur 11.5.2 host with such nic models:
>   * e1000-82545em
>   * virtio-net-pci
>   * vmxnet3
>
> The guests were:
>   * macOS 10.15.7
>   * Ubuntu Bionic (server cloudimg)
>
>
> This series partially reuses patches by Phillip Tennen:
> https://patchew.org/QEMU/20210218134947.1860-1-phillip.en...@gmail.com/
> So I included them signed-off line into one of the commit messages and
> also here.
>
> v1 -> v2:
>  Since v1 minor typos were fixed, patches rebased onto latest master,
>  redundant changes removed (small commits squashed)
> v2 -> v3:
>  - QAPI style fixes
>  - Typos fixes in comments
>  - `#include`'s updated to be in sync with recent master
> v3 -> v4:
>  - Support vmnet interfaces isolation feature
>  - Support vmnet-host network uuid setting feature
>  - Refactored sources a bit
> v4 -> v5:
>  - Missed 6.2 boat, now 7.0 candidate
>  - Fix qapi netdev descriptions and styles
>(@subnetmask -> @subnet-mask)
>  - Support vmnet-shared IPv6 prefix setting feature
> v5 -> v6
>  - provide detailed commit messages for commits of
>many changes
>  - rename properties @dhcpstart and @dhcpend to
>@start-address and @end-address
>  - improve qapi documentation about isolation
>features (@isolated, @net-uuid)
> v6 -> v7:
>  - update MAINTAINERS list
> v7 -> v8
>  - QAPI code style fixes
>
>
> Vladislav Yaroshchuk (7):
>   net/vmnet: add vmnet dependency and customizable option
>   net/vmnet: add vmnet backends to qapi/net
>   net/vmnet: implement shared mode (vmnet-shared)
>   net/vmnet: implement host mode (vmnet-host)
>   net/vmnet: implement bridged mode (vmnet-bridged)
>   net/vmnet: update qemu-options.hx
>   net/vmnet: update MAINTAINERS list
>
>  MAINTAINERS   |   5 +
>  meson.build   |   4 +
>  meson_options.txt |   2 +
>  net/clients.h |  11 ++
>  net/meson.build   |   7 +
>  net/net.c |  10 ++
>  net/vmnet-bridged.m   | 111 
>  net/vmnet-common.m| 330 ++
>  net/vmnet-host.c  | 105 +++
>  net/vmnet-shared.c|  92 ++
>  net/vmnet_int.h   |  48 +
>  qapi/net.json | 129 -
>  qemu-options.hx   |  25 +++
>  scripts/meson-buildoptions.sh |   3 +
>  14 files changed, 880 insertions(+), 2 deletions(-)
>  create mode 100644 net/vmnet-bridged.m
>  create mode 100644 net/vmnet-common.m
>  create mode 100644 net/vmnet-host.c
>  create mode 100644 net/vmnet-shared.c
>  create mode 100644 net/vmnet_int.h
>
> --
> 2.23.0
>
>

[PATCH v2 4/6] target/riscv: add support for zdinx

[Weiwei Li]

From: liweiwei 

  -- update extension check REQUIRE_ZDINX_OR_D
  -- update double float point register read/write

Co-authored-by: ardxwe 
Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/insn_trans/trans_rvd.c.inc | 319 ++--
 target/riscv/translate.c|  58 +
 2 files changed, 299 insertions(+), 78 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvd.c.inc 
b/target/riscv/insn_trans/trans_rvd.c.inc
index 64fb0046f7..d752c8ad9e 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -18,6 +18,19 @@
  * this program.  If not, see .
  */
 
+#define REQUIRE_ZDINX_OR_D(ctx) do { \
+if (!ctx->ext_zdinx) { \
+REQUIRE_EXT(ctx, RVD); \
+} \
+} while (0)
+
+#define REQUIRE_EVEN(ctx, reg) do { \
+if (ctx->ext_zdinx && (get_xl(ctx) == MXL_RV32) && \
+(reg & 0x1)) { \
+return false; \
+} \
+} while (0)
+
 static bool trans_fld(DisasContext *ctx, arg_fld *a)
 {
 TCGv addr;
@@ -62,10 +75,20 @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
 static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
 {
 REQUIRE_FPU;
-REQUIRE_EXT(ctx, RVD);
+REQUIRE_ZDINX_OR_D(ctx);
+REQUIRE_EVEN(ctx, a->rd);
+REQUIRE_EVEN(ctx, a->rs1);
+REQUIRE_EVEN(ctx, a->rs2);
+REQUIRE_EVEN(ctx, a->rs3);
+
+TCGv_i64 dest = dest_fpr(ctx, a->rd);
+TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
 gen_set_rm(ctx, a->rm);
-gen_helper_fmadd_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-   cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+gen_helper_fmadd_d(dest, cpu_env, src1, src2, src3);
+gen_set_fpr_d(ctx, a->rd, dest);
 mark_fs_dirty(ctx);
 return true;
 }
@@ -73,10 +96,20 @@ static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
 static bool trans_fmsub_d(DisasContext *ctx, arg_fmsub_d *a)
 {
 REQUIRE_FPU;
-REQUIRE_EXT(ctx, RVD);
+REQUIRE_ZDINX_OR_D(ctx);
+REQUIRE_EVEN(ctx, a->rd);
+REQUIRE_EVEN(ctx, a->rs1);
+REQUIRE_EVEN(ctx, a->rs2);
+REQUIRE_EVEN(ctx, a->rs3);
+
+TCGv_i64 dest = dest_fpr(ctx, a->rd);
+TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
 gen_set_rm(ctx, a->rm);
-gen_helper_fmsub_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-   cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+gen_helper_fmsub_d(dest, cpu_env, src1, src2, src3);
+gen_set_fpr_d(ctx, a->rd, dest);
 mark_fs_dirty(ctx);
 return true;
 }
@@ -84,10 +117,20 @@ static bool trans_fmsub_d(DisasContext *ctx, arg_fmsub_d 
*a)
 static bool trans_fnmsub_d(DisasContext *ctx, arg_fnmsub_d *a)
 {
 REQUIRE_FPU;
-REQUIRE_EXT(ctx, RVD);
+REQUIRE_ZDINX_OR_D(ctx);
+REQUIRE_EVEN(ctx, a->rd);
+REQUIRE_EVEN(ctx, a->rs1);
+REQUIRE_EVEN(ctx, a->rs2);
+REQUIRE_EVEN(ctx, a->rs3);
+
+TCGv_i64 dest = dest_fpr(ctx, a->rd);
+TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
 gen_set_rm(ctx, a->rm);
-gen_helper_fnmsub_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+gen_helper_fnmsub_d(dest, cpu_env, src1, src2, src3);
+gen_set_fpr_d(ctx, a->rd, dest);
 mark_fs_dirty(ctx);
 return true;
 }
@@ -95,10 +138,20 @@ static bool trans_fnmsub_d(DisasContext *ctx, arg_fnmsub_d 
*a)
 static bool trans_fnmadd_d(DisasContext *ctx, arg_fnmadd_d *a)
 {
 REQUIRE_FPU;
-REQUIRE_EXT(ctx, RVD);
+REQUIRE_ZDINX_OR_D(ctx);
+REQUIRE_EVEN(ctx, a->rd);
+REQUIRE_EVEN(ctx, a->rs1);
+REQUIRE_EVEN(ctx, a->rs2);
+REQUIRE_EVEN(ctx, a->rs3);
+
+TCGv_i64 dest = dest_fpr(ctx, a->rd);
+TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
 gen_set_rm(ctx, a->rm);
-gen_helper_fnmadd_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+gen_helper_fnmadd_d(dest, cpu_env, src1, src2, src3);
+gen_set_fpr_d(ctx, a->rd, dest);
 mark_fs_dirty(ctx);
 return true;
 }
@@ -106,12 +159,18 @@ static bool trans_fnmadd_d(DisasContext *ctx, 
arg_fnmadd_d *a)
 static bool trans_fadd_d(DisasContext *ctx, arg_fadd_d *a)
 {
 REQUIRE_FPU;
-REQUIRE_EXT(ctx, RVD);
+REQUIRE_ZDINX_OR_D(ctx);
+REQUIRE_EVEN(ctx, a->rd);
+REQUIRE_EVEN(ctx, a->rs1);
+REQUIRE_EVEN(ctx, a->rs2);
 
-gen_set_rm(ctx, a->rm);
-gen_helper_fadd_d(cpu_fpr[a->rd], cpu_env,
-  cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+TCGv_i64 dest = dest_fpr(ctx, a->rd);
+TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
+gen_set_rm(ctx, a->rm

[PATCH v2 6/6] target/riscv: expose zfinx, zdinx, zhinx{min} properties

[Weiwei Li]

From: liweiwei 

Co-authored-by: ardxwe 
Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Richard Henderson 
---
 target/riscv/cpu.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index cc7da446f1..3dd07759e1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -661,6 +661,10 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_BOOL("zbb", RISCVCPU, cfg.ext_zbb, true),
 DEFINE_PROP_BOOL("zbc", RISCVCPU, cfg.ext_zbc, true),
 DEFINE_PROP_BOOL("zbs", RISCVCPU, cfg.ext_zbs, true),
+DEFINE_PROP_BOOL("Zdinx", RISCVCPU, cfg.ext_zdinx, false),
+DEFINE_PROP_BOOL("Zfinx", RISCVCPU, cfg.ext_zfinx, false),
+DEFINE_PROP_BOOL("Zhinx", RISCVCPU, cfg.ext_zhinx, false),
+DEFINE_PROP_BOOL("Zhinxmin", RISCVCPU, cfg.ext_zhinxmin, false),
 DEFINE_PROP_BOOL("x-h", RISCVCPU, cfg.ext_h, false),
 DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
 /* ePMP 0.9.3 */
-- 
2.17.1

[PATCH v2 5/6] target/riscv: add support for zhinx/zhinxmin

[Weiwei Li]

From: liweiwei 

  - update extension check REQUIRE_ZHINX_OR_ZFH and 
REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN
  - update half float point register read/write
  - disable nanbox_h check

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/fpu_helper.c |  89 +++---
 target/riscv/helper.h |   2 +-
 target/riscv/insn_trans/trans_rvzfh.c.inc | 332 +++---
 target/riscv/internals.h  |  16 +-
 4 files changed, 296 insertions(+), 143 deletions(-)

diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index 63ca703459..5699c9517f 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -89,10 +89,11 @@ void helper_set_rod_rounding_mode(CPURISCVState *env)
 static uint64_t do_fmadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
uint64_t rs3, int flags)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
-float16 frs3 = check_nanbox_h(rs3);
-return nanbox_h(float16_muladd(frs1, frs2, frs3, flags, &env->fp_status));
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
+float16 frs3 = check_nanbox_h(env, rs3);
+return nanbox_h(env, float16_muladd(frs1, frs2, frs3, flags,
+&env->fp_status));
 }
 
 static uint64_t do_fmadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
@@ -417,146 +418,146 @@ target_ulong helper_fclass_d(uint64_t frs1)
 
 uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
-return nanbox_h(float16_add(frs1, frs2, &env->fp_status));
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
+return nanbox_h(env, float16_add(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsub_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
-return nanbox_h(float16_sub(frs1, frs2, &env->fp_status));
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
+return nanbox_h(env, float16_sub(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmul_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
-return nanbox_h(float16_mul(frs1, frs2, &env->fp_status));
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
+return nanbox_h(env, float16_mul(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fdiv_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
-return nanbox_h(float16_div(frs1, frs2, &env->fp_status));
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
+return nanbox_h(env, float16_div(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
-return nanbox_h(env->priv_ver < PRIV_VERSION_1_11_0 ?
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
+return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
 float16_minnum(frs1, frs2, &env->fp_status) :
 float16_minimum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
-return nanbox_h(env->priv_ver < PRIV_VERSION_1_11_0 ?
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
+return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
 float16_maxnum(frs1, frs2, &env->fp_status) :
 float16_maximum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
 {
-float16 frs1 = check_nanbox_h(rs1);
-return nanbox_h(float16_sqrt(frs1, &env->fp_status));
+float16 frs1 = check_nanbox_h(env, rs1);
+return nanbox_h(env, float16_sqrt(frs1, &env->fp_status));
 }
 
 target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
 return float16_le(frs1, frs2, &env->fp_status);
 }
 
 target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float16 frs1 = check_nanbox_h(rs1);
-float16 frs2 = check_nanbox_h(rs2);
+float16 frs1 = check_nanbox_h(env, rs1);
+float16 frs2 = check_nanbox_h(env, rs2);
 return float16_lt(frs1, frs2, &env->fp_sta

[PATCH v2 2/6] target/riscv: hardwire mstatus.FS to zero when enable zfinx

[Weiwei Li]

From: liweiwei 

Co-authored-by: ardxwe 
Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/cpu.c|  4 
 target/riscv/cpu_helper.c |  6 +-
 target/riscv/csr.c| 24 +++-
 target/riscv/translate.c  |  5 +
 4 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index d9ea005724..cc7da446f1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -363,6 +363,10 @@ static void riscv_cpu_reset(DeviceState *dev)
 env->misa_mxl = env->misa_mxl_max;
 env->priv = PRV_M;
 env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
+/* hardwire mstatus.FS to zero when enable zfinx */
+if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+env->mstatus &= ~MSTATUS_FS;
+}
 if (env->misa_mxl > MXL_RV32) {
 /*
  * The reset status of SXL/UXL is undefined, but mstatus is WARL
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 10f3baba53..a71edee44c 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -222,9 +222,13 @@ bool riscv_cpu_vector_enabled(CPURISCVState *env)
 
 void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
 {
-uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM | MSTATUS_FS |
+uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM|
 MSTATUS_SPP | MSTATUS_SPIE | MSTATUS_SIE |
 MSTATUS64_UXL | MSTATUS_VS;
+/* hardwire mstatus.FS to zero when enable zfinx */
+if (!RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+mstatus_mask |= MSTATUS_FS;
+}
 bool current_virt = riscv_cpu_virt_enabled(env);
 
 g_assert(riscv_has_ext(env, RVH));
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 146447eac5..de20206b73 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -38,7 +38,8 @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
 static RISCVException fs(CPURISCVState *env, int csrno)
 {
 #if !defined(CONFIG_USER_ONLY)
-if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
+if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
+!RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
 return RISCV_EXCP_ILLEGAL_INST;
 }
 #endif
@@ -234,7 +235,10 @@ static RISCVException write_fflags(CPURISCVState *env, int 
csrno,
target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
-env->mstatus |= MSTATUS_FS;
+/* hardwire mstatus.FS to zero when enable zfinx */
+if (!RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+env->mstatus |= MSTATUS_FS;
+}
 #endif
 riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
 return RISCV_EXCP_NONE;
@@ -251,7 +255,10 @@ static RISCVException write_frm(CPURISCVState *env, int 
csrno,
 target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
-env->mstatus |= MSTATUS_FS;
+/* hardwire mstatus.FS to zero when enable zfinx */
+if (!RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+env->mstatus |= MSTATUS_FS;
+}
 #endif
 env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
 return RISCV_EXCP_NONE;
@@ -269,7 +276,10 @@ static RISCVException write_fcsr(CPURISCVState *env, int 
csrno,
  target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
-env->mstatus |= MSTATUS_FS;
+/* hardwire mstatus.FS to zero when enable zfinx */
+if (!RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+env->mstatus |= MSTATUS_FS;
+}
 #endif
 env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
 riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
@@ -562,9 +572,13 @@ static RISCVException write_mstatus(CPURISCVState *env, 
int csrno,
 tlb_flush(env_cpu(env));
 }
 mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
-MSTATUS_SPP | MSTATUS_FS | MSTATUS_MPRV | MSTATUS_SUM |
+MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
 MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
 MSTATUS_TW | MSTATUS_VS;
+/* hardwire mstatus.FS to zero when enable zfinx */
+if (!RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+mask |= MSTATUS_FS;
+}
 
 if (riscv_cpu_mxl(env) != MXL_RV32) {
 /*
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 8b1cdacf50..17bf20a799 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -342,6 +342,11 @@ static void mark_fs_dirty(DisasContext *ctx)
 {
 TCGv tmp;
 
+/* hardwire mstatus.FS to zero when enable zfinx */
+if (ctx->ext_zfinx) {
+return;
+}
+
 if (ctx->mstatus_fs != MSTATUS_FS) {
 /* Remember the state change for the rest of the TB. */
 ctx->mstatus_fs = MSTATUS_FS;
-- 
2.17.1

[PATCH v2 0/6] support subsets of Float-Point in Integer Registers extensions

[Weiwei Li]

This patchset implements RISC-V Float-Point in Integer Registers 
extensions(Version 1.0.0-rc), which includes Zfinx, Zdinx, Zhinx and Zhinxmin 
extension. 

Specification:
https://github.com/riscv/riscv-zfinx/blob/main/zfinx-1.0.0-rc.pdf

The port is available here:
https://github.com/plctlab/plct-qemu/tree/plct-zfinx-upstream-v2

To test this implementation, specify cpu argument with 'Zfinx 
=true,Zdinx=true,Zhinx=true,Zhinxmin=true' with 
'g=false,f=false,d=false,Zfh=false,Zfhmin=false'
This implementation can pass gcc tests, ci result can be found in 
https://ci.rvperf.org/job/plct-qemu-zfinx-upstream/

v2:
* hardwire mstatus.FS to zero when enable zfinx
* do register-pair check at the begin of translation
* optimize partial implemention as suggested 

liweiwei (6):
  target/riscv: add cfg properties for zfinx, zdinx and zhinx{min}
  target/riscv: hardwire mstatus.FS to zero when enable zfinx
  target/riscv: add support for zfinx
  target/riscv: add support for zdinx
  target/riscv: add support for zhinx/zhinxmin
  target/riscv: expose zfinx, zdinx, zhinx{min} properties

 target/riscv/cpu.c|  20 ++
 target/riscv/cpu.h|   4 +
 target/riscv/cpu_helper.c |   6 +-
 target/riscv/csr.c|  24 +-
 target/riscv/fpu_helper.c | 178 ++--
 target/riscv/helper.h |   4 +-
 target/riscv/insn_trans/trans_rvd.c.inc   | 319 -
 target/riscv/insn_trans/trans_rvf.c.inc   | 314 +---
 target/riscv/insn_trans/trans_rvzfh.c.inc | 332 +++---
 target/riscv/internals.h  |  32 ++-
 target/riscv/translate.c  | 161 +++
 11 files changed, 1023 insertions(+), 371 deletions(-)

-- 
2.17.1

[PATCH v2 1/6] target/riscv: add cfg properties for zfinx, zdinx and zhinx{min}

[Weiwei Li]

From: liweiwei 

Co-authored-by: ardxwe 
Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Richard Henderson 
---
 target/riscv/cpu.c   | 12 
 target/riscv/cpu.h   |  4 
 target/riscv/translate.c |  8 
 3 files changed, 24 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6ef3314bce..d9ea005724 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -491,6 +491,11 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 cpu->cfg.ext_d = true;
 }
 
+if (cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinx ||
+cpu->cfg.ext_zhinxmin) {
+cpu->cfg.ext_zfinx = true;
+}
+
 /* Set the ISA extensions, checks should have happened above */
 if (cpu->cfg.ext_i) {
 ext |= RVI;
@@ -565,6 +570,13 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 if (cpu->cfg.ext_j) {
 ext |= RVJ;
 }
+if (cpu->cfg.ext_zfinx && ((ext & (RVF | RVD)) || cpu->cfg.ext_zfh ||
+   cpu->cfg.ext_zfhmin)) {
+error_setg(errp,
+"'Zfinx' cannot be supported together with 'F', 'D', 
'Zfh',"
+" 'Zfhmin'");
+return;
+}
 
 set_misa(env, env->misa_mxl, ext);
 }
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index dc10f27093..6fba31c5cd 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -315,8 +315,12 @@ struct RISCVCPU {
 bool ext_counters;
 bool ext_ifencei;
 bool ext_icsr;
+bool ext_zdinx;
 bool ext_zfh;
 bool ext_zfhmin;
+bool ext_zfinx;
+bool ext_zhinx;
+bool ext_zhinxmin;
 
 char *priv_spec;
 char *user_spec;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 5df6c0d800..8b1cdacf50 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -76,8 +76,12 @@ typedef struct DisasContext {
 RISCVMXL ol;
 bool virt_enabled;
 bool ext_ifencei;
+bool ext_zdinx;
 bool ext_zfh;
 bool ext_zfhmin;
+bool ext_zfinx;
+bool ext_zhinx;
+bool ext_zhinxmin;
 bool hlsx;
 /* vector extension */
 bool vill;
@@ -703,8 +707,12 @@ static void riscv_tr_init_disas_context(DisasContextBase 
*dcbase, CPUState *cs)
 ctx->misa_ext = env->misa_ext;
 ctx->frm = -1;  /* unknown rounding mode */
 ctx->ext_ifencei = cpu->cfg.ext_ifencei;
+ctx->ext_zdinx = cpu->cfg.ext_zdinx;
 ctx->ext_zfh = cpu->cfg.ext_zfh;
 ctx->ext_zfhmin = cpu->cfg.ext_zfhmin;
+ctx->ext_zfinx = cpu->cfg.ext_zfinx;
+ctx->ext_zhinx = cpu->cfg.ext_zhinx;
+ctx->ext_zhinxmin = cpu->cfg.ext_zhinxmin;
 ctx->vlen = cpu->cfg.vlen;
 ctx->elen = cpu->cfg.elen;
 ctx->mstatus_hs_fs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_FS);
-- 
2.17.1

[PATCH v2 3/6] target/riscv: add support for zfinx

[Weiwei Li]

From: liweiwei 

  - update extension check REQUIRE_ZFINX_OR_F
  - update single float point register read/write
  - disable nanbox_s check

Co-authored-by: ardxwe 
Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/fpu_helper.c   |  89 +++
 target/riscv/helper.h   |   2 +-
 target/riscv/insn_trans/trans_rvf.c.inc | 314 
 target/riscv/internals.h|  16 +-
 target/riscv/translate.c|  90 +++
 5 files changed, 367 insertions(+), 144 deletions(-)

diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index 4a5982d594..63ca703459 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -98,10 +98,11 @@ static uint64_t do_fmadd_h(CPURISCVState *env, uint64_t 
rs1, uint64_t rs2,
 static uint64_t do_fmadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
uint64_t rs3, int flags)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
-float32 frs3 = check_nanbox_s(rs3);
-return nanbox_s(float32_muladd(frs1, frs2, frs3, flags, &env->fp_status));
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+float32 frs3 = check_nanbox_s(env, rs3);
+return nanbox_s(env, float32_muladd(frs1, frs2, frs3, flags,
+&env->fp_status));
 }
 
 uint64_t helper_fmadd_s(CPURISCVState *env, uint64_t frs1, uint64_t frs2,
@@ -183,124 +184,124 @@ uint64_t helper_fnmadd_h(CPURISCVState *env, uint64_t 
frs1, uint64_t frs2,
 
 uint64_t helper_fadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
-return nanbox_s(float32_add(frs1, frs2, &env->fp_status));
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+return nanbox_s(env, float32_add(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsub_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
-return nanbox_s(float32_sub(frs1, frs2, &env->fp_status));
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+return nanbox_s(env, float32_sub(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmul_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
-return nanbox_s(float32_mul(frs1, frs2, &env->fp_status));
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+return nanbox_s(env, float32_mul(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fdiv_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
-return nanbox_s(float32_div(frs1, frs2, &env->fp_status));
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+return nanbox_s(env, float32_div(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
-return nanbox_s(env->priv_ver < PRIV_VERSION_1_11_0 ?
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
 float32_minnum(frs1, frs2, &env->fp_status) :
 float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
-return nanbox_s(env->priv_ver < PRIV_VERSION_1_11_0 ?
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
 float32_maxnum(frs1, frs2, &env->fp_status) :
 float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
 {
-float32 frs1 = check_nanbox_s(rs1);
-return nanbox_s(float32_sqrt(frs1, &env->fp_status));
+float32 frs1 = check_nanbox_s(env, rs1);
+return nanbox_s(env, float32_sqrt(frs1, &env->fp_status));
 }
 
 target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
 return float32_le(frs1, frs2, &env->fp_status);
 }
 
 target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-float32 frs1 = check_nanbox_s(rs1);
-float32 frs2 = check_nanbox_s(rs2);
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 f

Re: [PATCH v3 kvm/queue 04/16] KVM: Extend the memslot to support fd-based private memory

[Chao Peng]

On Thu, Dec 23, 2021 at 05:35:37PM +, Sean Christopherson wrote:
> On Thu, Dec 23, 2021, Chao Peng wrote:
> 
> > +   struct file *file;
> 
> Please use more descriptive names, shaving characters is not at all priority.
> 
> > +   u64 ofs;
> 
> I believe this should be loff_t.
> 
>   struct file *private_file;
>   struct loff_t private_offset;
> 
> >  };
> >  
> > +static inline bool kvm_slot_is_private(const struct kvm_memory_slot *slot)
> > +{
> > +   if (slot && (slot->flags & KVM_MEM_PRIVATE))
> > +   return true;
> > +   return false;
> 
>   return slot && (slot->flags & KVM_MEM_PRIVATE);
> 
> > +}
> > +
> >  static inline bool kvm_slot_dirty_track_enabled(const struct 
> > kvm_memory_slot *slot)
> >  {
> > return slot->flags & KVM_MEM_LOG_DIRTY_PAGES;
> > diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
> > index 1daa45268de2..41434322fa23 100644
> > --- a/include/uapi/linux/kvm.h
> > +++ b/include/uapi/linux/kvm.h
> > @@ -103,6 +103,17 @@ struct kvm_userspace_memory_region {
> > __u64 userspace_addr; /* start of the userspace allocated memory */
> >  };
> >  
> > +struct kvm_userspace_memory_region_ext {
> > +   __u32 slot;
> > +   __u32 flags;
> > +   __u64 guest_phys_addr;
> > +   __u64 memory_size; /* bytes */
> > +   __u64 userspace_addr; /* hva */
> 
> Would it make sense to embed "struct kvm_userspace_memory_region"?
> 
> > +   __u64 ofs; /* offset into fd */
> > +   __u32 fd;
> 
> Again, use descriptive names, then comments like "offset into fd" are 
> unnecessary.
> 
>   __u64 private_offset;
>   __u32 private_fd;

My original thought is the same fields might be used for shared memslot
as well in future (e.g. there may be another KVM_MEM_* bit can reuse the
same fields for shared slot) so non private-specific name may sound
better. But definitely I have no objection and can use private_* names
for next version unless there is other objection.

Thanks,
Chao
> 
> > +   __u32 padding[5];
> > +};
> > +
> >  /*
> >   * The bit 0 ~ bit 15 of kvm_memory_region::flags are visible for 
> > userspace,
> >   * other bits are reserved for kvm internal use which are defined in
> > @@ -110,6 +121,7 @@ struct kvm_userspace_memory_region {
> >   */
> >  #define KVM_MEM_LOG_DIRTY_PAGES(1UL << 0)
> >  #define KVM_MEM_READONLY   (1UL << 1)
> > +#define KVM_MEM_PRIVATE(1UL << 2)
> >  
> >  /* for KVM_IRQ_LINE */
> >  struct kvm_irq_level {
> > -- 
> > 2.17.1
> > 

Re: [PATCH v3 kvm/queue 03/16] mm/memfd: Introduce MEMFD_OPS

[Chao Peng]

On Fri, Dec 24, 2021 at 11:53:15AM +0800, Robert Hoo wrote:
> On Thu, 2021-12-23 at 20:29 +0800, Chao Peng wrote:
> > From: "Kirill A. Shutemov" 
> >  
> > +static void notify_fallocate(struct inode *inode, pgoff_t start,
> > pgoff_t end)
> > +{
> > +#ifdef CONFIG_MEMFD_OPS
> > +   struct shmem_inode_info *info = SHMEM_I(inode);
> > +   const struct memfd_falloc_notifier *notifier;
> > +   void *owner;
> > +   bool ret;
> > +
> > +   if (!info->falloc_notifier)
> > +   return;
> > +
> > +   spin_lock(&info->lock);
> > +   notifier = info->falloc_notifier;
> > +   if (!notifier) {
> > +   spin_unlock(&info->lock);
> > +   return;
> > +   }
> > +
> > +   owner = info->owner;
> > +   ret = notifier->get_owner(owner);
> > +   spin_unlock(&info->lock);
> > +   if (!ret)
> > +   return;
> > +
> > +   notifier->fallocate(inode, owner, start, end);
> 
> I see notifier->fallocate(), i.e. memfd_fallocate(), discards
> kvm_memfd_fallocate_range()'s return value. Should it be checked?

I think we can ignore it, just like how current mmu_notifier does,
the return value of __kvm_handle_hva_range is discarded in
kvm_mmu_notifier_invalidate_range_start(). Even when KVM side failed,
it's not fatal, it should not block the operation in the primary MMU.

Thanks,
Chao
> 
> > +   notifier->put_owner(owner);
> > +#endif
> > +}
> > +

Re: [PATCH v3 kvm/queue 11/16] KVM: Add kvm_map_gfn_range

[Chao Peng]

On Fri, Dec 24, 2021 at 12:13:51PM +0800, Chao Peng wrote:
> On Thu, Dec 23, 2021 at 06:06:19PM +, Sean Christopherson wrote:
> > On Thu, Dec 23, 2021, Chao Peng wrote:
> > > This new function establishes the mapping in KVM page tables for a
> > > given gfn range. It can be used in the memory fallocate callback for
> > > memfd based memory to establish the mapping for KVM secondary MMU when
> > > the pages are allocated in the memory backend.
> > 
> > NAK, under no circumstance should KVM install SPTEs in response to 
> > allocating
> > memory in a file.   The correct thing to do is to invalidate the gfn range
> > associated with the newly mapped range, i.e. wipe out any shared SPTEs 
> > associated
> > with the memslot.
> 
> Right, thanks.

BTW, I think the current fallocate() callback is just useless as long as
we don't want to install KVM SPTEs in response to allocating memory in a
file. The invalidation of the shared SPTEs should be notified through 
mmu_notifier of the shared memory backend, not memfd_notifier of the
private memory backend.

Thanks,
Chao

Re: [PATCH v3 1/7] target/riscv: rvk: add cfg properties for zbk* and zk*

[liweiwei]

在 2021/12/31 上午10:04, Bin Meng 写道:

On Thu, Dec 30, 2021 at 10:32 PM liweiwei  wrote:

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 

nits: looks like the best practice of the name is:

Weiwei Li and Junqiang Wang


Thanks for your comment.  I'll update this later.

Acked-by: Alistair Francis 
---
  target/riscv/cpu.c | 23 +++
  target/riscv/cpu.h | 13 +
  2 files changed, 36 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6ef3314bce..961c5f4334 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -491,6 +491,29 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
  cpu->cfg.ext_d = true;
  }

+if (cpu->cfg.ext_zk) {
+cpu->cfg.ext_zkn = true;
+cpu->cfg.ext_zkr = true;
+cpu->cfg.ext_zkt = true;
+}
+
+if (cpu->cfg.ext_zkn) {
+cpu->cfg.ext_zbkb = true;
+cpu->cfg.ext_zbkc = true;
+cpu->cfg.ext_zbkx = true;
+cpu->cfg.ext_zkne = true;
+cpu->cfg.ext_zknd = true;
+cpu->cfg.ext_zknh = true;
+}
+
+if (cpu->cfg.ext_zks) {
+cpu->cfg.ext_zbkb = true;
+cpu->cfg.ext_zbkc = true;
+cpu->cfg.ext_zbkx = true;
+cpu->cfg.ext_zksed = true;
+cpu->cfg.ext_zksh = true;
+}
+
  /* Set the ISA extensions, checks should have happened above */
  if (cpu->cfg.ext_i) {
  ext |= RVI;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index dc10f27093..edca7118ff 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -311,7 +311,20 @@ struct RISCVCPU {
  bool ext_zba;
  bool ext_zbb;
  bool ext_zbc;
+bool ext_zbkb;
+bool ext_zbkc;
+bool ext_zbkx;
  bool ext_zbs;
+bool ext_zk;
+bool ext_zkn;
+bool ext_zknd;
+bool ext_zkne;
+bool ext_zknh;
+bool ext_zkr;
+bool ext_zks;
+bool ext_zksed;
+bool ext_zksh;
+bool ext_zkt;
  bool ext_counters;
  bool ext_ifencei;
  bool ext_icsr;
--

Regards,
Bin

Re: [PATCH v3 kvm/queue 05/16] KVM: Maintain ofs_tree for fast memslot lookup by file offset

[Chao Peng]

On Tue, Dec 28, 2021 at 09:48:08PM +, Sean Christopherson wrote:
> On Fri, Dec 24, 2021, Chao Peng wrote:
> > On Thu, Dec 23, 2021 at 06:02:33PM +, Sean Christopherson wrote:
> > > On Thu, Dec 23, 2021, Chao Peng wrote:
> > > 
> > > In other words, there needs to be a 1:1 gfn:file+offset mapping.  Since 
> > > userspace
> > > likely wants to allocate a single file for guest private memory and map 
> > > it into
> > > multiple discontiguous slots, e.g. to skip the PCI hole, the best idea 
> > > off the top
> > > of my head would be to register the notifier on a per-slot basis, not a 
> > > per-VM
> > > basis.  It would require a 'struct kvm *' in 'struct kvm_memory_slot', 
> > > but that's
> > > not a huge deal.
> > > 
> > > That way, KVM's notifier callback already knows the memslot and can 
> > > compute overlap
> > > between the memslot and the range by reversing the math done by 
> > > kvm_memfd_get_pfn().
> > > Then, armed with the gfn and slot, invalidation is just a matter of 
> > > constructing
> > > a struct kvm_gfn_range and invoking kvm_unmap_gfn_range().
> > 
> > KVM is easy but the kernel bits would be difficulty, it has to maintain
> > fd+offset to memslot mapping because one fd can have multiple memslots,
> > it need decide which memslot needs to be notified.
> 
> No, the kernel side maintains an opaque pointer like it does today,

But the opaque pointer will now become memslot, isn't it? That said,
kernel side should maintain a list of opaque pointer (memslot) instead
of one for each fd (inode) since a fd to memslot mapping is 1:M now.

>KVM handles
> reverse engineering the memslot to get the offset and whatever else it needs.
> notify_fallocate() and other callbacks are unchanged, though they probably can
> drop the inode.
> 
> E.g. likely with bad math and handwaving on the overlap detection:
> 
> int kvm_private_fd_fallocate_range(void *owner, pgoff_t start, pgoff_t end)
> {
>   struct kvm_memory_slot *slot = owner;
>   struct kvm_gfn_range gfn_range = {
>   .slot  = slot,
>   .start = (start - slot->private_offset) >> PAGE_SHIFT,
>   .end   = (end - slot->private_offset) >> PAGE_SHIFT,
>   .may_block = true,
>   };
> 
>   if (!has_overlap(slot, start, end))
>   return 0;
> 
>   gfn_range.end = min(gfn_range.end, slot->base_gfn + slot->npages);
> 
>   kvm_unmap_gfn_range(slot->kvm, &gfn_range);
>   return 0;
> }

I understand this KVM side handling, but again one fd can have multiple
memslots. How shmem decides to notify which memslot from a list of
memslots when it invokes the notify_fallocate()? Or just notify all
the possible memslots then let KVM to check? 

Thanks,
Chao

Re: [PATCH v3 1/7] target/riscv: rvk: add cfg properties for zbk* and zk*

[Bin Meng]

On Thu, Dec 30, 2021 at 10:32 PM liweiwei  wrote:
>
> Signed-off-by: liweiwei 
> Signed-off-by: wangjunqiang 

nits: looks like the best practice of the name is:

Weiwei Li and Junqiang Wang

> Acked-by: Alistair Francis 
> ---
>  target/riscv/cpu.c | 23 +++
>  target/riscv/cpu.h | 13 +
>  2 files changed, 36 insertions(+)
>
> diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> index 6ef3314bce..961c5f4334 100644
> --- a/target/riscv/cpu.c
> +++ b/target/riscv/cpu.c
> @@ -491,6 +491,29 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
> **errp)
>  cpu->cfg.ext_d = true;
>  }
>
> +if (cpu->cfg.ext_zk) {
> +cpu->cfg.ext_zkn = true;
> +cpu->cfg.ext_zkr = true;
> +cpu->cfg.ext_zkt = true;
> +}
> +
> +if (cpu->cfg.ext_zkn) {
> +cpu->cfg.ext_zbkb = true;
> +cpu->cfg.ext_zbkc = true;
> +cpu->cfg.ext_zbkx = true;
> +cpu->cfg.ext_zkne = true;
> +cpu->cfg.ext_zknd = true;
> +cpu->cfg.ext_zknh = true;
> +}
> +
> +if (cpu->cfg.ext_zks) {
> +cpu->cfg.ext_zbkb = true;
> +cpu->cfg.ext_zbkc = true;
> +cpu->cfg.ext_zbkx = true;
> +cpu->cfg.ext_zksed = true;
> +cpu->cfg.ext_zksh = true;
> +}
> +
>  /* Set the ISA extensions, checks should have happened above */
>  if (cpu->cfg.ext_i) {
>  ext |= RVI;
> diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> index dc10f27093..edca7118ff 100644
> --- a/target/riscv/cpu.h
> +++ b/target/riscv/cpu.h
> @@ -311,7 +311,20 @@ struct RISCVCPU {
>  bool ext_zba;
>  bool ext_zbb;
>  bool ext_zbc;
> +bool ext_zbkb;
> +bool ext_zbkc;
> +bool ext_zbkx;
>  bool ext_zbs;
> +bool ext_zk;
> +bool ext_zkn;
> +bool ext_zknd;
> +bool ext_zkne;
> +bool ext_zknh;
> +bool ext_zkr;
> +bool ext_zks;
> +bool ext_zksed;
> +bool ext_zksh;
> +bool ext_zkt;
>  bool ext_counters;
>  bool ext_ifencei;
>  bool ext_icsr;
> --

Regards,
Bin

[PULL 20/22] pci: Let ld*_pci_dma() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling ld*_pci_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Richard Henderson 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-22-phi...@redhat.com>
---
 include/hw/pci/pci.h |  6 +++---
 hw/audio/intel-hda.c |  2 +-
 hw/net/eepro100.c| 19 +--
 hw/net/tulip.c   | 18 ++
 hw/scsi/megasas.c| 16 ++--
 hw/scsi/mptsas.c | 10 ++
 hw/scsi/vmw_pvscsi.c |  3 ++-
 hw/usb/hcd-xhci.c|  1 +
 8 files changed, 46 insertions(+), 29 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 9f51ef2c3c2..7a46c1fa226 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -852,11 +852,11 @@ static inline MemTxResult pci_dma_write(PCIDevice *dev, 
dma_addr_t addr,
 
 #define PCI_DMA_DEFINE_LDST(_l, _s, _bits)  \
 static inline uint##_bits##_t ld##_l##_pci_dma(PCIDevice *dev,  \
-   dma_addr_t addr) \
+   dma_addr_t addr, \
+   MemTxAttrs attrs) \
 {   \
 uint##_bits##_t val; \
-ld##_l##_dma(pci_get_address_space(dev), addr, &val, \
- MEMTXATTRS_UNSPECIFIED); \
+ld##_l##_dma(pci_get_address_space(dev), addr, &val, attrs); \
 return val; \
 }   \
 static inline void st##_s##_pci_dma(PCIDevice *dev, \
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 3309ae0ea18..e34b7ab0e92 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -335,7 +335,7 @@ static void intel_hda_corb_run(IntelHDAState *d)
 
 rp = (d->corb_rp + 1) & 0xff;
 addr = intel_hda_addr(d->corb_lbase, d->corb_ubase);
-verb = ldl_le_pci_dma(&d->pci, addr + 4*rp);
+verb = ldl_le_pci_dma(&d->pci, addr + 4 * rp, MEMTXATTRS_UNSPECIFIED);
 d->corb_rp = rp;
 
 dprint(d, 2, "%s: [rp 0x%x] verb 0x%08x\n", __func__, rp, verb);
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index 83c4431b1ad..eb82e9cb118 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -737,6 +737,7 @@ static void read_cb(EEPRO100State *s)
 
 static void tx_command(EEPRO100State *s)
 {
+const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
 uint32_t tbd_array = s->tx.tbd_array_addr;
 uint16_t tcb_bytes = s->tx.tcb_bytes & 0x3fff;
 /* Sends larger than MAX_ETH_FRAME_SIZE are allowed, up to 2600 bytes. */
@@ -772,11 +773,14 @@ static void tx_command(EEPRO100State *s)
 /* Extended Flexible TCB. */
 for (; tbd_count < 2; tbd_count++) {
 uint32_t tx_buffer_address = ldl_le_pci_dma(&s->dev,
-tbd_address);
+tbd_address,
+attrs);
 uint16_t tx_buffer_size = lduw_le_pci_dma(&s->dev,
-  tbd_address + 4);
+  tbd_address + 4,
+  attrs);
 uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev,
-tbd_address + 6);
+tbd_address + 6,
+attrs);
 tbd_address += 8;
 TRACE(RXTX, logout
 ("TBD (extended flexible mode): buffer address 0x%08x, 
size 0x%04x\n",
@@ -792,9 +796,12 @@ static void tx_command(EEPRO100State *s)
 }
 tbd_address = tbd_array;
 for (; tbd_count < s->tx.tbd_count; tbd_count++) {
-uint32_t tx_buffer_address = ldl_le_pci_dma(&s->dev, tbd_address);
-uint16_t tx_buffer_size = lduw_le_pci_dma(&s->dev, tbd_address + 
4);
-uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev, tbd_address + 6);
+uint32_t tx_buffer_address = ldl_le_pci_dma(&s->dev, tbd_address,
+attrs);
+uint16_t tx_buffer_size = lduw_le_pci_dma(&s->dev, tbd_address + 4,
+  attrs);
+uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev, tbd_address + 6,
+attrs);
 tbd_address += 8;
 TRACE(RXTX, logout
 ("TBD (flexible mode): buffer address 0x%08x, size 0x%04x\n",
diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index 1f2c79dd58b..c76e4868f73 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -7

[PULL 19/22] pci: Let st*_pci_dma() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling st*_pci_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Richard Henderson 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-21-phi...@redhat.com>
---
 include/hw/pci/pci.h | 11 ++-
 hw/audio/intel-hda.c | 10 ++
 hw/net/eepro100.c| 29 ++---
 hw/net/tulip.c   | 18 ++
 hw/scsi/megasas.c| 15 ++-
 hw/scsi/vmw_pvscsi.c |  3 ++-
 6 files changed, 52 insertions(+), 34 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 8c5f2ed5054..9f51ef2c3c2 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -859,11 +859,12 @@ static inline MemTxResult pci_dma_write(PCIDevice *dev, 
dma_addr_t addr,
  MEMTXATTRS_UNSPECIFIED); \
 return val; \
 }   \
-static inline void st##_s##_pci_dma(PCIDevice *dev, \
-dma_addr_t addr, uint##_bits##_t val) \
-{   \
-st##_s##_dma(pci_get_address_space(dev), addr, val, \
- MEMTXATTRS_UNSPECIFIED); \
+static inline void st##_s##_pci_dma(PCIDevice *dev, \
+dma_addr_t addr, \
+uint##_bits##_t val, \
+MemTxAttrs attrs) \
+{ \
+st##_s##_dma(pci_get_address_space(dev), addr, val, attrs); \
 }
 
 PCI_DMA_DEFINE_LDST(ub, b, 8);
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index fb3d34a4a0c..3309ae0ea18 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -345,6 +345,7 @@ static void intel_hda_corb_run(IntelHDAState *d)
 
 static void intel_hda_response(HDACodecDevice *dev, bool solicited, uint32_t 
response)
 {
+const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
 HDACodecBus *bus = HDA_BUS(dev->qdev.parent_bus);
 IntelHDAState *d = container_of(bus, IntelHDAState, codecs);
 hwaddr addr;
@@ -367,8 +368,8 @@ static void intel_hda_response(HDACodecDevice *dev, bool 
solicited, uint32_t res
 ex = (solicited ? 0 : (1 << 4)) | dev->cad;
 wp = (d->rirb_wp + 1) & 0xff;
 addr = intel_hda_addr(d->rirb_lbase, d->rirb_ubase);
-stl_le_pci_dma(&d->pci, addr + 8*wp, response);
-stl_le_pci_dma(&d->pci, addr + 8*wp + 4, ex);
+stl_le_pci_dma(&d->pci, addr + 8 * wp, response, attrs);
+stl_le_pci_dma(&d->pci, addr + 8 * wp + 4, ex, attrs);
 d->rirb_wp = wp;
 
 dprint(d, 2, "%s: [wp 0x%x] response 0x%x, extra 0x%x\n",
@@ -394,6 +395,7 @@ static void intel_hda_response(HDACodecDevice *dev, bool 
solicited, uint32_t res
 static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
uint8_t *buf, uint32_t len)
 {
+const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
 HDACodecBus *bus = HDA_BUS(dev->qdev.parent_bus);
 IntelHDAState *d = container_of(bus, IntelHDAState, codecs);
 hwaddr addr;
@@ -428,7 +430,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t 
stnr, bool output,
st->be, st->bp, st->bpl[st->be].len, copy);
 
 pci_dma_rw(&d->pci, st->bpl[st->be].addr + st->bp, buf, copy, !output,
-   MEMTXATTRS_UNSPECIFIED);
+   attrs);
 st->lpib += copy;
 st->bp += copy;
 buf += copy;
@@ -451,7 +453,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t 
stnr, bool output,
 if (d->dp_lbase & 0x01) {
 s = st - d->st;
 addr = intel_hda_addr(d->dp_lbase & ~0x01, d->dp_ubase);
-stl_le_pci_dma(&d->pci, addr + 8*s, st->lpib);
+stl_le_pci_dma(&d->pci, addr + 8 * s, st->lpib, attrs);
 }
 dprint(d, 3, "dma: --\n");
 
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index 16e95ef9cc9..83c4431b1ad 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -700,6 +700,8 @@ static void set_ru_state(EEPRO100State * s, ru_state_t 
state)
 
 static void dump_statistics(EEPRO100State * s)
 {
+const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+
 /* Dump statistical data. Most data is never changed by the emulation
  * and always 0, so we first just copy the whole block and then those
  * values which really matter.
@@ -707,16 +709,18 @@ static void dump_statistics(EEPRO100State * s)
  */
 pci_dma_write(&s->dev, s->statsaddr, &s->statistics, s->stats_size);
 stl_le_pci_dma(&s->dev, s->statsaddr + 0,
-   s->statistics.tx_good_frames);
+   s->statistics.tx_good_frames, attrs);
 stl_le_pci_dma(&s->dev, s->statsaddr + 36,
-   s->statistics.rx_good_frames);
+   s->statistics.rx_good_frames, attrs);
 stl_le_pci_dma(&s->dev, s->statsaddr + 48,
-   s->statistics.rx_r

[PULL 18/22] dma: Let ld*_dma() propagate MemTxResult

[Philippe Mathieu-Daudé]

dma_memory_read() returns a MemTxResult type. Do not discard
it, return it to the caller.

Update the few callers.

Reviewed-by: Richard Henderson 
Reviewed-by: Cédric Le Goater 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-19-phi...@redhat.com>
---
 include/hw/pci/pci.h   |  6 --
 include/hw/ppc/spapr_vio.h |  6 +-
 include/sysemu/dma.h   | 25 -
 hw/intc/pnv_xive.c |  8 
 hw/usb/hcd-xhci.c  |  7 ---
 5 files changed, 29 insertions(+), 23 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 0613308b1b6..8c5f2ed5054 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -854,8 +854,10 @@ static inline MemTxResult pci_dma_write(PCIDevice *dev, 
dma_addr_t addr,
 static inline uint##_bits##_t ld##_l##_pci_dma(PCIDevice *dev,  \
dma_addr_t addr) \
 {   \
-return ld##_l##_dma(pci_get_address_space(dev), addr,   \
-MEMTXATTRS_UNSPECIFIED);\
+uint##_bits##_t val; \
+ld##_l##_dma(pci_get_address_space(dev), addr, &val, \
+ MEMTXATTRS_UNSPECIFIED); \
+return val; \
 }   \
 static inline void st##_s##_pci_dma(PCIDevice *dev, \
 dma_addr_t addr, uint##_bits##_t val) \
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index d2ec9b0637f..7eae1a48478 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -127,7 +127,11 @@ static inline int spapr_vio_dma_set(SpaprVioDevice *dev, 
uint64_t taddr,
 #define vio_stq(_dev, _addr, _val) \
 (stq_be_dma(&(_dev)->as, (_addr), (_val), MEMTXATTRS_UNSPECIFIED))
 #define vio_ldq(_dev, _addr) \
-(ldq_be_dma(&(_dev)->as, (_addr), MEMTXATTRS_UNSPECIFIED))
+({ \
+uint64_t _val; \
+ldq_be_dma(&(_dev)->as, (_addr), &_val, MEMTXATTRS_UNSPECIFIED); \
+_val; \
+})
 
 int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq);
 
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 895044d747f..b3faef41b2f 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -240,14 +240,15 @@ static inline void dma_memory_unmap(AddressSpace *as,
 }
 
 #define DEFINE_LDST_DMA(_lname, _sname, _bits, _end) \
-static inline uint##_bits##_t ld##_lname##_##_end##_dma(AddressSpace *as, \
-dma_addr_t addr, \
-MemTxAttrs attrs) \
-{   \
-uint##_bits##_t val;\
-dma_memory_read(as, addr, &val, (_bits) / 8, attrs); \
-return _end##_bits##_to_cpu(val);   \
-}   \
+static inline MemTxResult ld##_lname##_##_end##_dma(AddressSpace *as, \
+dma_addr_t addr, \
+uint##_bits##_t *pval, 
\
+MemTxAttrs attrs) \
+{ \
+MemTxResult res = dma_memory_read(as, addr, pval, (_bits) / 8, attrs); 
\
+_end##_bits##_to_cpus(pval); \
+return res; \
+} \
 static inline MemTxResult st##_sname##_##_end##_dma(AddressSpace *as, \
 dma_addr_t addr, \
 uint##_bits##_t val, \
@@ -257,12 +258,10 @@ static inline void dma_memory_unmap(AddressSpace *as,
 return dma_memory_write(as, addr, &val, (_bits) / 8, attrs); \
 }
 
-static inline uint8_t ldub_dma(AddressSpace *as, dma_addr_t addr, MemTxAttrs 
attrs)
+static inline MemTxResult ldub_dma(AddressSpace *as, dma_addr_t addr,
+   uint8_t *val, MemTxAttrs attrs)
 {
-uint8_t val;
-
-dma_memory_read(as, addr, &val, 1, attrs);
-return val;
+return dma_memory_read(as, addr, val, 1, attrs);
 }
 
 static inline MemTxResult stb_dma(AddressSpace *as, dma_addr_t addr,
diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index d9249bbc0c1..bb207514f2d 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -172,7 +172,7 @@ static uint64_t pnv_xive_vst_addr_indirect(PnvXive *xive, 
uint32_t type,
 
 /* Get the page size of the indirect table. */
 vsd_addr = vsd & VSD_ADDRESS_MASK;
-vsd = ldq_be_dma(&address_space_memory, vsd_addr, MEMTXATTRS_UNSPECIFIED);
+ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
 
 if (!(vsd & VSD_ADDRESS_MA

[PULL 17/22] dma: Let st*_dma() propagate MemTxResult

[Philippe Mathieu-Daudé]

dma_memory_write() returns a MemTxResult type. Do not discard
it, return it to the caller.

Reviewed-by: Richard Henderson 
Reviewed-by: Cédric Le Goater 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-18-phi...@redhat.com>
---
 include/sysemu/dma.h | 20 ++--
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index d1635f55870..895044d747f 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -248,13 +248,13 @@ static inline void dma_memory_unmap(AddressSpace *as,
 dma_memory_read(as, addr, &val, (_bits) / 8, attrs); \
 return _end##_bits##_to_cpu(val);   \
 }   \
-static inline void st##_sname##_##_end##_dma(AddressSpace *as,  \
- dma_addr_t addr,   \
- uint##_bits##_t val,   \
- MemTxAttrs attrs)  \
-{   \
-val = cpu_to_##_end##_bits(val);\
-dma_memory_write(as, addr, &val, (_bits) / 8, attrs);   \
+static inline MemTxResult st##_sname##_##_end##_dma(AddressSpace *as, \
+dma_addr_t addr, \
+uint##_bits##_t val, \
+MemTxAttrs attrs) \
+{ \
+val = cpu_to_##_end##_bits(val); \
+return dma_memory_write(as, addr, &val, (_bits) / 8, attrs); \
 }
 
 static inline uint8_t ldub_dma(AddressSpace *as, dma_addr_t addr, MemTxAttrs 
attrs)
@@ -265,10 +265,10 @@ static inline uint8_t ldub_dma(AddressSpace *as, 
dma_addr_t addr, MemTxAttrs att
 return val;
 }
 
-static inline void stb_dma(AddressSpace *as, dma_addr_t addr,
-   uint8_t val, MemTxAttrs attrs)
+static inline MemTxResult stb_dma(AddressSpace *as, dma_addr_t addr,
+  uint8_t val, MemTxAttrs attrs)
 {
-dma_memory_write(as, addr, &val, 1, attrs);
+return dma_memory_write(as, addr, &val, 1, attrs);
 }
 
 DEFINE_LDST_DMA(uw, w, 16, le);
-- 
2.33.1

[PULL 09/22] dma: Have dma_buf_read() / dma_buf_write() take a void pointer

[Philippe Mathieu-Daudé]

DMA operations are run on any kind of buffer, not arrays of
uint8_t. Convert dma_buf_read/dma_buf_write functions to take
a void pointer argument and save us pointless casts to uint8_t *.

Remove this pointless casts in the megasas device model.

Reviewed-by: Klaus Jensen 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-9-phi...@redhat.com>
---
 include/sysemu/dma.h  |  4 ++--
 hw/scsi/megasas.c | 22 +++---
 softmmu/dma-helpers.c |  4 ++--
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 97ff6f29f8c..0d5b836013d 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -302,8 +302,8 @@ BlockAIOCB *dma_blk_read(BlockBackend *blk,
 BlockAIOCB *dma_blk_write(BlockBackend *blk,
   QEMUSGList *sg, uint64_t offset, uint32_t align,
   BlockCompletionFunc *cb, void *opaque);
-uint64_t dma_buf_read(uint8_t *ptr, int32_t len, QEMUSGList *sg);
-uint64_t dma_buf_write(uint8_t *ptr, int32_t len, QEMUSGList *sg);
+uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg);
+uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg);
 
 void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
 QEMUSGList *sg, enum BlockAcctType type);
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 14ec6d68bbf..2dae33f6755 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -848,7 +848,7 @@ static int megasas_ctrl_get_info(MegasasState *s, 
MegasasCmd *cmd)
MFI_INFO_PDMIX_SATA |
MFI_INFO_PDMIX_LD);
 
-cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
 return MFI_STAT_OK;
 }
 
@@ -878,7 +878,7 @@ static int megasas_mfc_get_defaults(MegasasState *s, 
MegasasCmd *cmd)
 info.disable_preboot_cli = 1;
 info.cluster_disable = 1;
 
-cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
 return MFI_STAT_OK;
 }
 
@@ -899,7 +899,7 @@ static int megasas_dcmd_get_bios_info(MegasasState *s, 
MegasasCmd *cmd)
 info.expose_all_drives = 1;
 }
 
-cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
 return MFI_STAT_OK;
 }
 
@@ -910,7 +910,7 @@ static int megasas_dcmd_get_fw_time(MegasasState *s, 
MegasasCmd *cmd)
 
 fw_time = cpu_to_le64(megasas_fw_time());
 
-cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&fw_time, dcmd_size, &cmd->qsg);
 return MFI_STAT_OK;
 }
 
@@ -937,7 +937,7 @@ static int megasas_event_info(MegasasState *s, MegasasCmd 
*cmd)
 info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
 info.boot_seq_num = cpu_to_le32(s->boot_event);
 
-cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
 return MFI_STAT_OK;
 }
 
@@ -1006,7 +1006,7 @@ static int megasas_dcmd_pd_get_list(MegasasState *s, 
MegasasCmd *cmd)
 info.size = cpu_to_le32(offset);
 info.count = cpu_to_le32(num_pd_disks);
 
-cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, offset, &cmd->qsg);
 return MFI_STAT_OK;
 }
 
@@ -1172,7 +1172,7 @@ static int megasas_dcmd_ld_get_list(MegasasState *s, 
MegasasCmd *cmd)
 info.ld_count = cpu_to_le32(num_ld_disks);
 trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
 
-resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
+resid = dma_buf_read(&info, dcmd_size, &cmd->qsg);
 cmd->iov_size = dcmd_size - resid;
 return MFI_STAT_OK;
 }
@@ -1221,7 +1221,7 @@ static int megasas_dcmd_ld_list_query(MegasasState *s, 
MegasasCmd *cmd)
 info.size = dcmd_size;
 trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
 
-resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
+resid = dma_buf_read(&info, dcmd_size, &cmd->qsg);
 cmd->iov_size = dcmd_size - resid;
 return MFI_STAT_OK;
 }
@@ -1390,7 +1390,7 @@ static int megasas_dcmd_cfg_read(MegasasState *s, 
MegasasCmd *cmd)
 ld_offset += sizeof(struct mfi_ld_config);
 }
 
-cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(data, info->size, &cmd->qsg);
 return MFI_STAT_OK;
 }
 
@@ -1420,7 +1420,7 @@ static int megasas_dcmd_get_properties(MegasasState *s, 
MegasasCmd *cmd)
 info.ecc_bucket_leak_rate = cpu_to_le16(1440);
 info.expose_encl_devices = 1;
 
-cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
 return M

[PULL 22/22] pci: Let ld*_pci_dma() propagate MemTxResult

[Philippe Mathieu-Daudé]

ld*_dma() returns a MemTxResult type. Do not discard
it, return it to the caller.

Update the few callers.

Reviewed-by: Richard Henderson 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-24-phi...@redhat.com>
---
 include/hw/pci/pci.h | 17 -
 hw/audio/intel-hda.c |  2 +-
 hw/net/eepro100.c| 25 ++---
 hw/net/tulip.c   | 16 
 hw/scsi/megasas.c| 21 -
 hw/scsi/mptsas.c | 16 +++-
 hw/scsi/vmw_pvscsi.c | 16 ++--
 7 files changed, 60 insertions(+), 53 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index c90cecc85c0..5b36334a28a 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -850,15 +850,14 @@ static inline MemTxResult pci_dma_write(PCIDevice *dev, 
dma_addr_t addr,
   DMA_DIRECTION_FROM_DEVICE, MEMTXATTRS_UNSPECIFIED);
 }
 
-#define PCI_DMA_DEFINE_LDST(_l, _s, _bits)  \
-static inline uint##_bits##_t ld##_l##_pci_dma(PCIDevice *dev,  \
-   dma_addr_t addr, \
-   MemTxAttrs attrs) \
-{   \
-uint##_bits##_t val; \
-ld##_l##_dma(pci_get_address_space(dev), addr, &val, attrs); \
-return val; \
-}   \
+#define PCI_DMA_DEFINE_LDST(_l, _s, _bits) \
+static inline MemTxResult ld##_l##_pci_dma(PCIDevice *dev, \
+   dma_addr_t addr, \
+   uint##_bits##_t *val, \
+   MemTxAttrs attrs) \
+{ \
+return ld##_l##_dma(pci_get_address_space(dev), addr, val, attrs); \
+} \
 static inline MemTxResult st##_s##_pci_dma(PCIDevice *dev, \
dma_addr_t addr, \
uint##_bits##_t val, \
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index e34b7ab0e92..2b55d521503 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -335,7 +335,7 @@ static void intel_hda_corb_run(IntelHDAState *d)
 
 rp = (d->corb_rp + 1) & 0xff;
 addr = intel_hda_addr(d->corb_lbase, d->corb_ubase);
-verb = ldl_le_pci_dma(&d->pci, addr + 4 * rp, MEMTXATTRS_UNSPECIFIED);
+ldl_le_pci_dma(&d->pci, addr + 4 * rp, &verb, MEMTXATTRS_UNSPECIFIED);
 d->corb_rp = rp;
 
 dprint(d, 2, "%s: [rp 0x%x] verb 0x%08x\n", __func__, rp, verb);
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index eb82e9cb118..679f52f80f1 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -769,18 +769,16 @@ static void tx_command(EEPRO100State *s)
 } else {
 /* Flexible mode. */
 uint8_t tbd_count = 0;
+uint32_t tx_buffer_address;
+uint16_t tx_buffer_size;
+uint16_t tx_buffer_el;
+
 if (s->has_extended_tcb_support && !(s->configuration[6] & BIT(4))) {
 /* Extended Flexible TCB. */
 for (; tbd_count < 2; tbd_count++) {
-uint32_t tx_buffer_address = ldl_le_pci_dma(&s->dev,
-tbd_address,
-attrs);
-uint16_t tx_buffer_size = lduw_le_pci_dma(&s->dev,
-  tbd_address + 4,
-  attrs);
-uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev,
-tbd_address + 6,
-attrs);
+ldl_le_pci_dma(&s->dev, tbd_address, &tx_buffer_address, 
attrs);
+lduw_le_pci_dma(&s->dev, tbd_address + 4, &tx_buffer_size, 
attrs);
+lduw_le_pci_dma(&s->dev, tbd_address + 6, &tx_buffer_el, 
attrs);
 tbd_address += 8;
 TRACE(RXTX, logout
 ("TBD (extended flexible mode): buffer address 0x%08x, 
size 0x%04x\n",
@@ -796,12 +794,9 @@ static void tx_command(EEPRO100State *s)
 }
 tbd_address = tbd_array;
 for (; tbd_count < s->tx.tbd_count; tbd_count++) {
-uint32_t tx_buffer_address = ldl_le_pci_dma(&s->dev, tbd_address,
-attrs);
-uint16_t tx_buffer_size = lduw_le_pci_dma(&s->dev, tbd_address + 4,
-  attrs);
-uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev, tbd_address + 6,
-attrs);
+ldl_le_pci_dma(&s->dev, tbd_address, &tx_buffer_address, attrs);
+lduw_le_pci_dma(&

[PULL 16/22] dma: Let ld*_dma() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling ld*_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Richard Henderson 
Reviewed-by: Cédric Le Goater 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-17-phi...@redhat.com>
---
 include/hw/pci/pci.h   |  3 ++-
 include/hw/ppc/spapr_vio.h |  3 ++-
 include/sysemu/dma.h   | 11 ++-
 hw/intc/pnv_xive.c |  7 ---
 hw/usb/hcd-xhci.c  |  6 +++---
 5 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index d07e9707b48..0613308b1b6 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -854,7 +854,8 @@ static inline MemTxResult pci_dma_write(PCIDevice *dev, 
dma_addr_t addr,
 static inline uint##_bits##_t ld##_l##_pci_dma(PCIDevice *dev,  \
dma_addr_t addr) \
 {   \
-return ld##_l##_dma(pci_get_address_space(dev), addr);  \
+return ld##_l##_dma(pci_get_address_space(dev), addr,   \
+MEMTXATTRS_UNSPECIFIED);\
 }   \
 static inline void st##_s##_pci_dma(PCIDevice *dev, \
 dma_addr_t addr, uint##_bits##_t val) \
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index e87f8e6f596..d2ec9b0637f 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -126,7 +126,8 @@ static inline int spapr_vio_dma_set(SpaprVioDevice *dev, 
uint64_t taddr,
 (stl_be_dma(&(_dev)->as, (_addr), (_val), MEMTXATTRS_UNSPECIFIED))
 #define vio_stq(_dev, _addr, _val) \
 (stq_be_dma(&(_dev)->as, (_addr), (_val), MEMTXATTRS_UNSPECIFIED))
-#define vio_ldq(_dev, _addr) (ldq_be_dma(&(_dev)->as, (_addr)))
+#define vio_ldq(_dev, _addr) \
+(ldq_be_dma(&(_dev)->as, (_addr), MEMTXATTRS_UNSPECIFIED))
 
 int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq);
 
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 009dd3ca960..d1635f55870 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -241,10 +241,11 @@ static inline void dma_memory_unmap(AddressSpace *as,
 
 #define DEFINE_LDST_DMA(_lname, _sname, _bits, _end) \
 static inline uint##_bits##_t ld##_lname##_##_end##_dma(AddressSpace *as, \
-dma_addr_t addr) \
+dma_addr_t addr, \
+MemTxAttrs attrs) \
 {   \
 uint##_bits##_t val;\
-dma_memory_read(as, addr, &val, (_bits) / 8, MEMTXATTRS_UNSPECIFIED); \
+dma_memory_read(as, addr, &val, (_bits) / 8, attrs); \
 return _end##_bits##_to_cpu(val);   \
 }   \
 static inline void st##_sname##_##_end##_dma(AddressSpace *as,  \
@@ -253,14 +254,14 @@ static inline void dma_memory_unmap(AddressSpace *as,
  MemTxAttrs attrs)  \
 {   \
 val = cpu_to_##_end##_bits(val);\
-dma_memory_write(as, addr, &val, (_bits) / 8, attrs); \
+dma_memory_write(as, addr, &val, (_bits) / 8, attrs);   \
 }
 
-static inline uint8_t ldub_dma(AddressSpace *as, dma_addr_t addr)
+static inline uint8_t ldub_dma(AddressSpace *as, dma_addr_t addr, MemTxAttrs 
attrs)
 {
 uint8_t val;
 
-dma_memory_read(as, addr, &val, 1, MEMTXATTRS_UNSPECIFIED);
+dma_memory_read(as, addr, &val, 1, attrs);
 return val;
 }
 
diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index ad43483612e..d9249bbc0c1 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -172,7 +172,7 @@ static uint64_t pnv_xive_vst_addr_indirect(PnvXive *xive, 
uint32_t type,
 
 /* Get the page size of the indirect table. */
 vsd_addr = vsd & VSD_ADDRESS_MASK;
-vsd = ldq_be_dma(&address_space_memory, vsd_addr);
+vsd = ldq_be_dma(&address_space_memory, vsd_addr, MEMTXATTRS_UNSPECIFIED);
 
 if (!(vsd & VSD_ADDRESS_MASK)) {
 #ifdef XIVE_DEBUG
@@ -195,7 +195,8 @@ static uint64_t pnv_xive_vst_addr_indirect(PnvXive *xive, 
uint32_t type,
 /* Load the VSD we are looking for, if not already done */
 if (vsd_idx) {
 vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
-vsd = ldq_be_dma(&address_space_memory, vsd_addr);
+vsd = ldq_be_dma(&address_space_memory, vsd_addr,
+ MEMTXATTRS_UNSPECIFIED);
 
 if (!(vsd & VSD_AD

[PULL 21/22] pci: Let st*_pci_dma() propagate MemTxResult

[Philippe Mathieu-Daudé]

st*_dma() returns a MemTxResult type. Do not discard
it, return it to the caller.

Reviewed-by: Richard Henderson 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-23-phi...@redhat.com>
---
 include/hw/pci/pci.h | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 7a46c1fa226..c90cecc85c0 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -859,12 +859,12 @@ static inline MemTxResult pci_dma_write(PCIDevice *dev, 
dma_addr_t addr,
 ld##_l##_dma(pci_get_address_space(dev), addr, &val, attrs); \
 return val; \
 }   \
-static inline void st##_s##_pci_dma(PCIDevice *dev, \
-dma_addr_t addr, \
-uint##_bits##_t val, \
-MemTxAttrs attrs) \
+static inline MemTxResult st##_s##_pci_dma(PCIDevice *dev, \
+   dma_addr_t addr, \
+   uint##_bits##_t val, \
+   MemTxAttrs attrs) \
 { \
-st##_s##_dma(pci_get_address_space(dev), addr, val, attrs); \
+return st##_s##_dma(pci_get_address_space(dev), addr, val, attrs); \
 }
 
 PCI_DMA_DEFINE_LDST(ub, b, 8);
-- 
2.33.1

[PULL 06/22] dma: Let dma_memory_read/write() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling
dma_memory_read() or dma_memory_write().

Patch created mechanically using spatch with this script:

  @@
  expression E1, E2, E3, E4;
  @@
  (
  - dma_memory_read(E1, E2, E3, E4)
  + dma_memory_read(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED)
  |
  - dma_memory_write(E1, E2, E3, E4)
  + dma_memory_write(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED)
  )

Reviewed-by: Richard Henderson 
Reviewed-by: Li Qiang 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Philippe Mathieu-Daudé 
Acked-by: Stefan Hajnoczi 
Message-Id: <20211223115554.3155328-6-phi...@redhat.com>
---
 include/hw/ppc/spapr_vio.h|  6 --
 include/sysemu/dma.h  | 20 
 hw/arm/musicpal.c | 13 +++--
 hw/arm/smmu-common.c  |  3 ++-
 hw/arm/smmuv3.c   | 14 +-
 hw/core/generic-loader.c  |  3 ++-
 hw/dma/pl330.c| 12 
 hw/dma/sparc32_dma.c  | 16 ++--
 hw/dma/xlnx-zynq-devcfg.c |  6 --
 hw/dma/xlnx_dpdma.c   | 10 ++
 hw/i386/amd_iommu.c   | 16 +---
 hw/i386/intel_iommu.c | 28 +---
 hw/ide/macio.c|  2 +-
 hw/intc/xive.c|  7 ---
 hw/misc/bcm2835_property.c|  3 ++-
 hw/misc/macio/mac_dbdma.c | 10 ++
 hw/net/allwinner-sun8i-emac.c | 18 --
 hw/net/ftgmac100.c| 25 -
 hw/net/imx_fec.c  | 32 
 hw/net/npcm7xx_emc.c  | 20 
 hw/nvram/fw_cfg.c |  9 ++---
 hw/pci-host/pnv_phb3.c|  5 +++--
 hw/pci-host/pnv_phb3_msi.c|  9 ++---
 hw/pci-host/pnv_phb4.c|  5 +++--
 hw/sd/allwinner-sdhost.c  | 14 --
 hw/sd/sdhci.c | 35 ++-
 hw/usb/hcd-dwc2.c |  8 
 hw/usb/hcd-ehci.c |  6 --
 hw/usb/hcd-ohci.c | 18 +++---
 hw/usb/hcd-xhci.c | 18 +++---
 30 files changed, 241 insertions(+), 150 deletions(-)

diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index c90e74a67dd..5d2ea8e6656 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -97,14 +97,16 @@ static inline bool spapr_vio_dma_valid(SpaprVioDevice *dev, 
uint64_t taddr,
 static inline int spapr_vio_dma_read(SpaprVioDevice *dev, uint64_t taddr,
  void *buf, uint32_t size)
 {
-return (dma_memory_read(&dev->as, taddr, buf, size) != 0) ?
+return (dma_memory_read(&dev->as, taddr,
+buf, size, MEMTXATTRS_UNSPECIFIED) != 0) ?
 H_DEST_PARM : H_SUCCESS;
 }
 
 static inline int spapr_vio_dma_write(SpaprVioDevice *dev, uint64_t taddr,
   const void *buf, uint32_t size)
 {
-return (dma_memory_write(&dev->as, taddr, buf, size) != 0) ?
+return (dma_memory_write(&dev->as, taddr,
+ buf, size, MEMTXATTRS_UNSPECIFIED) != 0) ?
 H_DEST_PARM : H_SUCCESS;
 }
 
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index e8ad42226f6..522682bf386 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -143,12 +143,14 @@ static inline MemTxResult dma_memory_rw(AddressSpace *as, 
dma_addr_t addr,
  * @addr: address within that address space
  * @buf: buffer with the data transferred
  * @len: length of the data transferred
+ * @attrs: memory transaction attributes
  */
 static inline MemTxResult dma_memory_read(AddressSpace *as, dma_addr_t addr,
-  void *buf, dma_addr_t len)
+  void *buf, dma_addr_t len,
+  MemTxAttrs attrs)
 {
 return dma_memory_rw(as, addr, buf, len,
- DMA_DIRECTION_TO_DEVICE, MEMTXATTRS_UNSPECIFIED);
+ DMA_DIRECTION_TO_DEVICE, attrs);
 }
 
 /**
@@ -162,12 +164,14 @@ static inline MemTxResult dma_memory_read(AddressSpace 
*as, dma_addr_t addr,
  * @addr: address within that address space
  * @buf: buffer with the data transferred
  * @len: the number of bytes to write
+ * @attrs: memory transaction attributes
  */
 static inline MemTxResult dma_memory_write(AddressSpace *as, dma_addr_t addr,
-   const void *buf, dma_addr_t len)
+   const void *buf, dma_addr_t len,
+   MemTxAttrs attrs)
 {
 return dma_memory_rw(as, addr, (void *)buf, len,
- DMA_DIRECTION_FROM_DEVICE, MEMTXATTRS_UNSPECIFIED);
+ DMA_DIRECTION_FROM_DEVICE, attrs);
 }
 
 /**
@@ -239,7 +243,7 @@ static inline void dma_memory_unmap(AddressSpace *as,
 dma_addr_t

[PULL 11/22] dma: Let dma_buf_rw() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling dma_buf_rw().

Keep the default MEMTXATTRS_UNSPECIFIED in the 2 callers.

Reviewed-by: Klaus Jensen 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-11-phi...@redhat.com>
---
 softmmu/dma-helpers.c | 11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index 7f37548394e..fa81d2b386c 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -295,7 +295,7 @@ BlockAIOCB *dma_blk_write(BlockBackend *blk,
 
 
 static uint64_t dma_buf_rw(void *buf, int32_t len, QEMUSGList *sg,
-   DMADirection dir)
+   DMADirection dir, MemTxAttrs attrs)
 {
 uint8_t *ptr = buf;
 uint64_t resid;
@@ -307,8 +307,7 @@ static uint64_t dma_buf_rw(void *buf, int32_t len, 
QEMUSGList *sg,
 while (len > 0) {
 ScatterGatherEntry entry = sg->sg[sg_cur_index++];
 int32_t xfer = MIN(len, entry.len);
-dma_memory_rw(sg->as, entry.base, ptr, xfer, dir,
-  MEMTXATTRS_UNSPECIFIED);
+dma_memory_rw(sg->as, entry.base, ptr, xfer, dir, attrs);
 ptr += xfer;
 len -= xfer;
 resid -= xfer;
@@ -319,12 +318,14 @@ static uint64_t dma_buf_rw(void *buf, int32_t len, 
QEMUSGList *sg,
 
 uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg)
 {
-return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_FROM_DEVICE);
+return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_FROM_DEVICE,
+  MEMTXATTRS_UNSPECIFIED);
 }
 
 uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg)
 {
-return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_TO_DEVICE);
+return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_TO_DEVICE,
+  MEMTXATTRS_UNSPECIFIED);
 }
 
 void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
-- 
2.33.1

[PULL 13/22] dma: Let dma_buf_read() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling
dma_buf_read().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Klaus Jensen 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-13-phi...@redhat.com>
---
 include/sysemu/dma.h  |  2 +-
 hw/ide/ahci.c |  4 ++--
 hw/nvme/ctrl.c|  2 +-
 hw/scsi/megasas.c | 24 
 hw/scsi/scsi-bus.c|  2 +-
 softmmu/dma-helpers.c |  5 ++---
 6 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index e3dd74a9c4f..fd8f16003dd 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -302,7 +302,7 @@ BlockAIOCB *dma_blk_read(BlockBackend *blk,
 BlockAIOCB *dma_blk_write(BlockBackend *blk,
   QEMUSGList *sg, uint64_t offset, uint32_t align,
   BlockCompletionFunc *cb, void *opaque);
-uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg);
+uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
attrs);
 uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
attrs);
 
 void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 079d2977f23..205dfdc6622 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1386,7 +1386,7 @@ static void ahci_pio_transfer(const IDEDMA *dma)
 if (is_write) {
 dma_buf_write(s->data_ptr, size, &s->sg, attrs);
 } else {
-dma_buf_read(s->data_ptr, size, &s->sg);
+dma_buf_read(s->data_ptr, size, &s->sg, attrs);
 }
 }
 
@@ -1479,7 +1479,7 @@ static int ahci_dma_rw_buf(const IDEDMA *dma, bool 
is_write)
 }
 
 if (is_write) {
-dma_buf_read(p, l, &s->sg);
+dma_buf_read(p, l, &s->sg, MEMTXATTRS_UNSPECIFIED);
 } else {
 dma_buf_write(p, l, &s->sg, MEMTXATTRS_UNSPECIFIED);
 }
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index e1a531d5d6c..462f79a1f60 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -1152,7 +1152,7 @@ static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, uint8_t 
*ptr, uint32_t len,
 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
 residual = dma_buf_write(ptr, len, &sg->qsg, attrs);
 } else {
-residual = dma_buf_read(ptr, len, &sg->qsg);
+residual = dma_buf_read(ptr, len, &sg->qsg, attrs);
 }
 
 if (unlikely(residual)) {
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 79fd14c5a33..091a350e055 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -848,7 +848,7 @@ static int megasas_ctrl_get_info(MegasasState *s, 
MegasasCmd *cmd)
MFI_INFO_PDMIX_SATA |
MFI_INFO_PDMIX_LD);
 
-cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, 
MEMTXATTRS_UNSPECIFIED);
 return MFI_STAT_OK;
 }
 
@@ -878,7 +878,7 @@ static int megasas_mfc_get_defaults(MegasasState *s, 
MegasasCmd *cmd)
 info.disable_preboot_cli = 1;
 info.cluster_disable = 1;
 
-cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, 
MEMTXATTRS_UNSPECIFIED);
 return MFI_STAT_OK;
 }
 
@@ -899,7 +899,7 @@ static int megasas_dcmd_get_bios_info(MegasasState *s, 
MegasasCmd *cmd)
 info.expose_all_drives = 1;
 }
 
-cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, 
MEMTXATTRS_UNSPECIFIED);
 return MFI_STAT_OK;
 }
 
@@ -910,7 +910,7 @@ static int megasas_dcmd_get_fw_time(MegasasState *s, 
MegasasCmd *cmd)
 
 fw_time = cpu_to_le64(megasas_fw_time());
 
-cmd->iov_size -= dma_buf_read(&fw_time, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&fw_time, dcmd_size, &cmd->qsg, 
MEMTXATTRS_UNSPECIFIED);
 return MFI_STAT_OK;
 }
 
@@ -937,7 +937,7 @@ static int megasas_event_info(MegasasState *s, MegasasCmd 
*cmd)
 info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
 info.boot_seq_num = cpu_to_le32(s->boot_event);
 
-cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, 
MEMTXATTRS_UNSPECIFIED);
 return MFI_STAT_OK;
 }
 
@@ -1006,7 +1006,7 @@ static int megasas_dcmd_pd_get_list(MegasasState *s, 
MegasasCmd *cmd)
 info.size = cpu_to_le32(offset);
 info.count = cpu_to_le32(num_pd_disks);
 
-cmd->iov_size -= dma_buf_read(&info, offset, &cmd->qsg);
+cmd->iov_size -= dma_buf_read(&info, offset, &cmd->qsg, 
MEMTXATTRS_UNSPECIFIED);
 return MFI_STAT_OK;
 }
 
@@ -1100,7 +1100,7 @@ static int megasas_pd_get_info_submit(SCSIDevice *sdev, 
int lun,
 info->connected_port_bitmap = 0x1;
 info->device_speed = 1;
 info->link_speed = 1;
-resid = dma_buf_read(cmd->iov_buf, dcmd_size, 

[PULL 15/22] dma: Let st*_dma() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling st*_dma().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Richard Henderson 
Reviewed-by: Cédric Le Goater 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-16-phi...@redhat.com>
---
 include/hw/pci/pci.h   |  3 ++-
 include/hw/ppc/spapr_vio.h | 12 
 include/sysemu/dma.h   | 10 ++
 hw/nvram/fw_cfg.c  |  4 ++--
 4 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index a751ab5a75d..d07e9707b48 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -859,7 +859,8 @@ static inline MemTxResult pci_dma_write(PCIDevice *dev, 
dma_addr_t addr,
 static inline void st##_s##_pci_dma(PCIDevice *dev, \
 dma_addr_t addr, uint##_bits##_t val) \
 {   \
-st##_s##_dma(pci_get_address_space(dev), addr, val);\
+st##_s##_dma(pci_get_address_space(dev), addr, val, \
+ MEMTXATTRS_UNSPECIFIED); \
 }
 
 PCI_DMA_DEFINE_LDST(ub, b, 8);
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index 5d2ea8e6656..e87f8e6f596 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -118,10 +118,14 @@ static inline int spapr_vio_dma_set(SpaprVioDevice *dev, 
uint64_t taddr,
 H_DEST_PARM : H_SUCCESS;
 }
 
-#define vio_stb(_dev, _addr, _val) (stb_dma(&(_dev)->as, (_addr), (_val)))
-#define vio_sth(_dev, _addr, _val) (stw_be_dma(&(_dev)->as, (_addr), (_val)))
-#define vio_stl(_dev, _addr, _val) (stl_be_dma(&(_dev)->as, (_addr), (_val)))
-#define vio_stq(_dev, _addr, _val) (stq_be_dma(&(_dev)->as, (_addr), (_val)))
+#define vio_stb(_dev, _addr, _val) \
+(stb_dma(&(_dev)->as, (_addr), (_val), MEMTXATTRS_UNSPECIFIED))
+#define vio_sth(_dev, _addr, _val) \
+(stw_be_dma(&(_dev)->as, (_addr), (_val), MEMTXATTRS_UNSPECIFIED))
+#define vio_stl(_dev, _addr, _val) \
+(stl_be_dma(&(_dev)->as, (_addr), (_val), MEMTXATTRS_UNSPECIFIED))
+#define vio_stq(_dev, _addr, _val) \
+(stq_be_dma(&(_dev)->as, (_addr), (_val), MEMTXATTRS_UNSPECIFIED))
 #define vio_ldq(_dev, _addr) (ldq_be_dma(&(_dev)->as, (_addr)))
 
 int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq);
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index fd8f16003dd..009dd3ca960 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -249,10 +249,11 @@ static inline void dma_memory_unmap(AddressSpace *as,
 }   \
 static inline void st##_sname##_##_end##_dma(AddressSpace *as,  \
  dma_addr_t addr,   \
- uint##_bits##_t val)   \
+ uint##_bits##_t val,   \
+ MemTxAttrs attrs)  \
 {   \
 val = cpu_to_##_end##_bits(val);\
-dma_memory_write(as, addr, &val, (_bits) / 8, MEMTXATTRS_UNSPECIFIED); 
\
+dma_memory_write(as, addr, &val, (_bits) / 8, attrs); \
 }
 
 static inline uint8_t ldub_dma(AddressSpace *as, dma_addr_t addr)
@@ -263,9 +264,10 @@ static inline uint8_t ldub_dma(AddressSpace *as, 
dma_addr_t addr)
 return val;
 }
 
-static inline void stb_dma(AddressSpace *as, dma_addr_t addr, uint8_t val)
+static inline void stb_dma(AddressSpace *as, dma_addr_t addr,
+   uint8_t val, MemTxAttrs attrs)
 {
-dma_memory_write(as, addr, &val, 1, MEMTXATTRS_UNSPECIFIED);
+dma_memory_write(as, addr, &val, 1, attrs);
 }
 
 DEFINE_LDST_DMA(uw, w, 16, le);
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index 9b91b15cb08..e5f3c981841 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -360,7 +360,7 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
 if (dma_memory_read(s->dma_as, dma_addr,
 &dma, sizeof(dma), MEMTXATTRS_UNSPECIFIED)) {
 stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
-   FW_CFG_DMA_CTL_ERROR);
+   FW_CFG_DMA_CTL_ERROR, MEMTXATTRS_UNSPECIFIED);
 return;
 }
 
@@ -446,7 +446,7 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
 }
 
 stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
-dma.control);
+dma.control, MEMTXATTRS_UNSPECIFIED);
 
 trace_fw_cfg_read(s, 0);
 }
-- 
2.33.1

[PULL 10/22] pci: Let pci_dma_rw() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling pci_dma_rw().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Klaus Jensen 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-10-phi...@redhat.com>
---
 include/hw/pci/pci.h | 10 ++
 hw/audio/intel-hda.c |  3 ++-
 hw/scsi/esp-pci.c|  2 +-
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 1acefc2a4c3..a751ab5a75d 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -806,10 +806,10 @@ static inline AddressSpace 
*pci_get_address_space(PCIDevice *dev)
  */
 static inline MemTxResult pci_dma_rw(PCIDevice *dev, dma_addr_t addr,
  void *buf, dma_addr_t len,
- DMADirection dir)
+ DMADirection dir, MemTxAttrs attrs)
 {
 return dma_memory_rw(pci_get_address_space(dev), addr, buf, len,
- dir, MEMTXATTRS_UNSPECIFIED);
+ dir, attrs);
 }
 
 /**
@@ -827,7 +827,8 @@ static inline MemTxResult pci_dma_rw(PCIDevice *dev, 
dma_addr_t addr,
 static inline MemTxResult pci_dma_read(PCIDevice *dev, dma_addr_t addr,
void *buf, dma_addr_t len)
 {
-return pci_dma_rw(dev, addr, buf, len, DMA_DIRECTION_TO_DEVICE);
+return pci_dma_rw(dev, addr, buf, len,
+  DMA_DIRECTION_TO_DEVICE, MEMTXATTRS_UNSPECIFIED);
 }
 
 /**
@@ -845,7 +846,8 @@ static inline MemTxResult pci_dma_read(PCIDevice *dev, 
dma_addr_t addr,
 static inline MemTxResult pci_dma_write(PCIDevice *dev, dma_addr_t addr,
 const void *buf, dma_addr_t len)
 {
-return pci_dma_rw(dev, addr, (void *) buf, len, DMA_DIRECTION_FROM_DEVICE);
+return pci_dma_rw(dev, addr, (void *) buf, len,
+  DMA_DIRECTION_FROM_DEVICE, MEMTXATTRS_UNSPECIFIED);
 }
 
 #define PCI_DMA_DEFINE_LDST(_l, _s, _bits)  \
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 8ce9df64e3e..fb3d34a4a0c 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -427,7 +427,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t 
stnr, bool output,
 dprint(d, 3, "dma: entry %d, pos %d/%d, copy %d\n",
st->be, st->bp, st->bpl[st->be].len, copy);
 
-pci_dma_rw(&d->pci, st->bpl[st->be].addr + st->bp, buf, copy, !output);
+pci_dma_rw(&d->pci, st->bpl[st->be].addr + st->bp, buf, copy, !output,
+   MEMTXATTRS_UNSPECIFIED);
 st->lpib += copy;
 st->bp += copy;
 buf += copy;
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index dac054aeed4..1792f84cea6 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -280,7 +280,7 @@ static void esp_pci_dma_memory_rw(PCIESPState *pci, uint8_t 
*buf, int len,
 len = pci->dma_regs[DMA_WBC];
 }
 
-pci_dma_rw(PCI_DEVICE(pci), addr, buf, len, dir);
+pci_dma_rw(PCI_DEVICE(pci), addr, buf, len, dir, MEMTXATTRS_UNSPECIFIED);
 
 /* update status registers */
 pci->dma_regs[DMA_WBC] -= len;
-- 
2.33.1

[PULL 12/22] dma: Let dma_buf_write() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling
dma_buf_write().

Keep the default MEMTXATTRS_UNSPECIFIED in the few callers.

Reviewed-by: Klaus Jensen 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-12-phi...@redhat.com>
---
 include/sysemu/dma.h  | 2 +-
 hw/ide/ahci.c | 6 --
 hw/nvme/ctrl.c| 3 ++-
 hw/scsi/megasas.c | 2 +-
 hw/scsi/scsi-bus.c| 2 +-
 softmmu/dma-helpers.c | 5 ++---
 6 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 0d5b836013d..e3dd74a9c4f 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -303,7 +303,7 @@ BlockAIOCB *dma_blk_write(BlockBackend *blk,
   QEMUSGList *sg, uint64_t offset, uint32_t align,
   BlockCompletionFunc *cb, void *opaque);
 uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg);
-uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg);
+uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
attrs);
 
 void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
 QEMUSGList *sg, enum BlockAcctType type);
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 8e77ddb660f..079d2977f23 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1381,8 +1381,10 @@ static void ahci_pio_transfer(const IDEDMA *dma)
 has_sglist ? "" : "o");
 
 if (has_sglist && size) {
+const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+
 if (is_write) {
-dma_buf_write(s->data_ptr, size, &s->sg);
+dma_buf_write(s->data_ptr, size, &s->sg, attrs);
 } else {
 dma_buf_read(s->data_ptr, size, &s->sg);
 }
@@ -1479,7 +1481,7 @@ static int ahci_dma_rw_buf(const IDEDMA *dma, bool 
is_write)
 if (is_write) {
 dma_buf_read(p, l, &s->sg);
 } else {
-dma_buf_write(p, l, &s->sg);
+dma_buf_write(p, l, &s->sg, MEMTXATTRS_UNSPECIFIED);
 }
 
 /* free sglist, update byte count */
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 5f573c417b3..e1a531d5d6c 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -1146,10 +1146,11 @@ static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, 
uint8_t *ptr, uint32_t len,
 assert(sg->flags & NVME_SG_ALLOC);
 
 if (sg->flags & NVME_SG_DMA) {
+const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
 uint64_t residual;
 
 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
-residual = dma_buf_write(ptr, len, &sg->qsg);
+residual = dma_buf_write(ptr, len, &sg->qsg, attrs);
 } else {
 residual = dma_buf_read(ptr, len, &sg->qsg);
 }
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 2dae33f6755..79fd14c5a33 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -1465,7 +1465,7 @@ static int megasas_dcmd_set_properties(MegasasState *s, 
MegasasCmd *cmd)
 dcmd_size);
 return MFI_STAT_INVALID_PARAMETER;
 }
-dma_buf_write(&info, dcmd_size, &cmd->qsg);
+dma_buf_write(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
 trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
 return MFI_STAT_OK;
 }
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index 77325d8cc7a..64a506a3975 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -1423,7 +1423,7 @@ void scsi_req_data(SCSIRequest *req, int len)
 if (req->cmd.mode == SCSI_XFER_FROM_DEV) {
 req->resid = dma_buf_read(buf, len, req->sg);
 } else {
-req->resid = dma_buf_write(buf, len, req->sg);
+req->resid = dma_buf_write(buf, len, req->sg, MEMTXATTRS_UNSPECIFIED);
 }
 scsi_req_continue(req);
 }
diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index fa81d2b386c..2f1a241b81a 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -322,10 +322,9 @@ uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList 
*sg)
   MEMTXATTRS_UNSPECIFIED);
 }
 
-uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg)
+uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
attrs)
 {
-return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_TO_DEVICE,
-  MEMTXATTRS_UNSPECIFIED);
+return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_TO_DEVICE, attrs);
 }
 
 void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
-- 
2.33.1

[PULL 05/22] dma: Let dma_memory_rw() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling
dma_memory_rw().

Reviewed-by: Richard Henderson 
Reviewed-by: Li Qiang 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Philippe Mathieu-Daudé 
Acked-by: Stefan Hajnoczi 
Message-Id: <20211223115554.3155328-5-phi...@redhat.com>
---
 include/hw/pci/pci.h  |  3 ++-
 include/sysemu/dma.h  | 11 ++-
 hw/intc/spapr_xive.c  |  3 ++-
 hw/usb/hcd-ohci.c | 10 ++
 softmmu/dma-helpers.c |  3 ++-
 5 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index e7cdf2d5ec5..4383f1c95e0 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -808,7 +808,8 @@ static inline MemTxResult pci_dma_rw(PCIDevice *dev, 
dma_addr_t addr,
  void *buf, dma_addr_t len,
  DMADirection dir)
 {
-return dma_memory_rw(pci_get_address_space(dev), addr, buf, len, dir);
+return dma_memory_rw(pci_get_address_space(dev), addr, buf, len,
+ dir, MEMTXATTRS_UNSPECIFIED);
 }
 
 /**
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 3be803cf3ff..e8ad42226f6 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -121,15 +121,15 @@ static inline MemTxResult 
dma_memory_write_relaxed(AddressSpace *as,
  * @buf: buffer with the data transferred
  * @len: the number of bytes to read or write
  * @dir: indicates the transfer direction
+ * @attrs: memory transaction attributes
  */
 static inline MemTxResult dma_memory_rw(AddressSpace *as, dma_addr_t addr,
 void *buf, dma_addr_t len,
-DMADirection dir)
+DMADirection dir, MemTxAttrs attrs)
 {
 dma_barrier(as, dir);
 
-return dma_memory_rw_relaxed(as, addr, buf, len, dir,
- MEMTXATTRS_UNSPECIFIED);
+return dma_memory_rw_relaxed(as, addr, buf, len, dir, attrs);
 }
 
 /**
@@ -147,7 +147,8 @@ static inline MemTxResult dma_memory_rw(AddressSpace *as, 
dma_addr_t addr,
 static inline MemTxResult dma_memory_read(AddressSpace *as, dma_addr_t addr,
   void *buf, dma_addr_t len)
 {
-return dma_memory_rw(as, addr, buf, len, DMA_DIRECTION_TO_DEVICE);
+return dma_memory_rw(as, addr, buf, len,
+ DMA_DIRECTION_TO_DEVICE, MEMTXATTRS_UNSPECIFIED);
 }
 
 /**
@@ -166,7 +167,7 @@ static inline MemTxResult dma_memory_write(AddressSpace 
*as, dma_addr_t addr,
const void *buf, dma_addr_t len)
 {
 return dma_memory_rw(as, addr, (void *)buf, len,
- DMA_DIRECTION_FROM_DEVICE);
+ DMA_DIRECTION_FROM_DEVICE, MEMTXATTRS_UNSPECIFIED);
 }
 
 /**
diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index 4ec659b93e1..eae95c716f1 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -1684,7 +1684,8 @@ static target_ulong h_int_esb(PowerPCCPU *cpu,
 mmio_addr = xive->vc_base + xive_source_esb_mgmt(xsrc, lisn) + offset;
 
 if (dma_memory_rw(&address_space_memory, mmio_addr, &data, 8,
-  (flags & SPAPR_XIVE_ESB_STORE))) {
+  (flags & SPAPR_XIVE_ESB_STORE),
+  MEMTXATTRS_UNSPECIFIED)) {
 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to access ESB @0x%"
   HWADDR_PRIx "\n", mmio_addr);
 return H_HARDWARE;
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 1cf2816772c..56e2315c734 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -586,7 +586,8 @@ static int ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
 if (n > len)
 n = len;
 
-if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
+if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
+  n, dir, MEMTXATTRS_UNSPECIFIED)) {
 return -1;
 }
 if (n == len) {
@@ -595,7 +596,7 @@ static int ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
 ptr = td->be & ~0xfffu;
 buf += n;
 if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
-  len - n, dir)) {
+  len - n, dir, MEMTXATTRS_UNSPECIFIED)) {
 return -1;
 }
 return 0;
@@ -613,7 +614,8 @@ static int ohci_copy_iso_td(OHCIState *ohci,
 if (n > len)
 n = len;
 
-if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
+if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
+  n, dir, MEMTXATTRS_UNSPECIFIED)) {
 return -1;
 }
 if (n == len) {
@@ -622,7 +624,7 @@ static int ohci_copy_iso_td(OHCIState *ohci,
 ptr = end_addr & ~0xfffu;
 buf += n;
 if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
-  len - n, dir)) {
+  len - n, dir

[PULL 14/22] dma: Let dma_buf_rw() propagate MemTxResult

[Philippe Mathieu-Daudé]

dma_memory_rw() returns a MemTxResult type. Do not discard
it, return it to the caller.

Since dma_buf_rw() was previously returning the QEMUSGList
size not consumed, add an extra argument where this size
can be stored.

Update the 2 callers.

Reviewed-by: Klaus Jensen 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-14-phi...@redhat.com>
---
 softmmu/dma-helpers.c | 25 +++--
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index a391773c296..b0be1564797 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -294,12 +294,14 @@ BlockAIOCB *dma_blk_write(BlockBackend *blk,
 }
 
 
-static uint64_t dma_buf_rw(void *buf, int32_t len, QEMUSGList *sg,
-   DMADirection dir, MemTxAttrs attrs)
+static MemTxResult dma_buf_rw(void *buf, int32_t len, uint64_t *residp,
+  QEMUSGList *sg, DMADirection dir,
+  MemTxAttrs attrs)
 {
 uint8_t *ptr = buf;
 uint64_t resid;
 int sg_cur_index;
+MemTxResult res = MEMTX_OK;
 
 resid = sg->size;
 sg_cur_index = 0;
@@ -307,23 +309,34 @@ static uint64_t dma_buf_rw(void *buf, int32_t len, 
QEMUSGList *sg,
 while (len > 0) {
 ScatterGatherEntry entry = sg->sg[sg_cur_index++];
 int32_t xfer = MIN(len, entry.len);
-dma_memory_rw(sg->as, entry.base, ptr, xfer, dir, attrs);
+res |= dma_memory_rw(sg->as, entry.base, ptr, xfer, dir, attrs);
 ptr += xfer;
 len -= xfer;
 resid -= xfer;
 }
 
-return resid;
+if (residp) {
+*residp = resid;
+}
+return res;
 }
 
 uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs attrs)
 {
-return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_FROM_DEVICE, attrs);
+uint64_t resid;
+
+dma_buf_rw(ptr, len, &resid, sg, DMA_DIRECTION_FROM_DEVICE, attrs);
+
+return resid;
 }
 
 uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
attrs)
 {
-return dma_buf_rw(ptr, len, sg, DMA_DIRECTION_TO_DEVICE, attrs);
+uint64_t resid;
+
+dma_buf_rw(ptr, len, &resid, sg, DMA_DIRECTION_TO_DEVICE, attrs);
+
+return resid;
 }
 
 void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,
-- 
2.33.1

[PULL 08/22] dma: Have dma_buf_rw() take a void pointer

[Philippe Mathieu-Daudé]

DMA operations are run on any kind of buffer, not arrays of
uint8_t. Convert dma_buf_rw() to take a void pointer argument
to save us pointless casts to uint8_t *.

Reviewed-by: Klaus Jensen 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-8-phi...@redhat.com>
---
 softmmu/dma-helpers.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index 3c06a2feddd..09e29997ee5 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -294,9 +294,10 @@ BlockAIOCB *dma_blk_write(BlockBackend *blk,
 }
 
 
-static uint64_t dma_buf_rw(uint8_t *ptr, int32_t len, QEMUSGList *sg,
+static uint64_t dma_buf_rw(void *buf, int32_t len, QEMUSGList *sg,
DMADirection dir)
 {
+uint8_t *ptr = buf;
 uint64_t resid;
 int sg_cur_index;
 
-- 
2.33.1

[PULL 04/22] dma: Let dma_memory_rw_relaxed() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

We will add the MemTxAttrs argument to dma_memory_rw() in
the next commit. Since dma_memory_rw_relaxed() is only used
by dma_memory_rw(), modify it first in a separate commit to
keep the next commit easier to review.

Reviewed-by: Richard Henderson 
Reviewed-by: Li Qiang 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Philippe Mathieu-Daudé 
Acked-by: Stefan Hajnoczi 
Message-Id: <20211223115554.3155328-4-phi...@redhat.com>
---
 include/sysemu/dma.h | 15 ++-
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index d23516f020a..3be803cf3ff 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -83,9 +83,10 @@ static inline bool dma_memory_valid(AddressSpace *as,
 static inline MemTxResult dma_memory_rw_relaxed(AddressSpace *as,
 dma_addr_t addr,
 void *buf, dma_addr_t len,
-DMADirection dir)
+DMADirection dir,
+MemTxAttrs attrs)
 {
-return address_space_rw(as, addr, MEMTXATTRS_UNSPECIFIED,
+return address_space_rw(as, addr, attrs,
 buf, len, dir == DMA_DIRECTION_FROM_DEVICE);
 }
 
@@ -93,7 +94,9 @@ static inline MemTxResult 
dma_memory_read_relaxed(AddressSpace *as,
   dma_addr_t addr,
   void *buf, dma_addr_t len)
 {
-return dma_memory_rw_relaxed(as, addr, buf, len, DMA_DIRECTION_TO_DEVICE);
+return dma_memory_rw_relaxed(as, addr, buf, len,
+ DMA_DIRECTION_TO_DEVICE,
+ MEMTXATTRS_UNSPECIFIED);
 }
 
 static inline MemTxResult dma_memory_write_relaxed(AddressSpace *as,
@@ -102,7 +105,8 @@ static inline MemTxResult 
dma_memory_write_relaxed(AddressSpace *as,
dma_addr_t len)
 {
 return dma_memory_rw_relaxed(as, addr, (void *)buf, len,
- DMA_DIRECTION_FROM_DEVICE);
+ DMA_DIRECTION_FROM_DEVICE,
+ MEMTXATTRS_UNSPECIFIED);
 }
 
 /**
@@ -124,7 +128,8 @@ static inline MemTxResult dma_memory_rw(AddressSpace *as, 
dma_addr_t addr,
 {
 dma_barrier(as, dir);
 
-return dma_memory_rw_relaxed(as, addr, buf, len, dir);
+return dma_memory_rw_relaxed(as, addr, buf, len, dir,
+ MEMTXATTRS_UNSPECIFIED);
 }
 
 /**
-- 
2.33.1

[PULL 03/22] dma: Let dma_memory_set() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling
dma_memory_set().

Reviewed-by: Richard Henderson 
Reviewed-by: Li Qiang 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Philippe Mathieu-Daudé 
Acked-by: Stefan Hajnoczi 
Message-Id: <20211223115554.3155328-3-phi...@redhat.com>
---
 include/hw/ppc/spapr_vio.h | 3 ++-
 include/sysemu/dma.h   | 3 ++-
 hw/nvram/fw_cfg.c  | 3 ++-
 softmmu/dma-helpers.c  | 5 ++---
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index 4c45f1579fa..c90e74a67dd 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -111,7 +111,8 @@ static inline int spapr_vio_dma_write(SpaprVioDevice *dev, 
uint64_t taddr,
 static inline int spapr_vio_dma_set(SpaprVioDevice *dev, uint64_t taddr,
 uint8_t c, uint32_t size)
 {
-return (dma_memory_set(&dev->as, taddr, c, size) != 0) ?
+return (dma_memory_set(&dev->as, taddr,
+   c, size, MEMTXATTRS_UNSPECIFIED) != 0) ?
 H_DEST_PARM : H_SUCCESS;
 }
 
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 296f3b57c9c..d23516f020a 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -175,9 +175,10 @@ static inline MemTxResult dma_memory_write(AddressSpace 
*as, dma_addr_t addr,
  * @addr: address within that address space
  * @c: constant byte to fill the memory
  * @len: the number of bytes to fill with the constant byte
+ * @attrs: memory transaction attributes
  */
 MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t addr,
-   uint8_t c, dma_addr_t len);
+   uint8_t c, dma_addr_t len, MemTxAttrs attrs);
 
 /**
  * address_space_map: Map a physical memory region into a host virtual address.
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index c06b30de112..f7803fe3c30 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -399,7 +399,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
  * tested before.
  */
 if (read) {
-if (dma_memory_set(s->dma_as, dma.address, 0, len)) {
+if (dma_memory_set(s->dma_as, dma.address, 0, len,
+   MEMTXATTRS_UNSPECIFIED)) {
 dma.control |= FW_CFG_DMA_CTL_ERROR;
 }
 }
diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index 7d766a5e89a..1f07217ad4a 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -19,7 +19,7 @@
 /* #define DEBUG_IOMMU */
 
 MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t addr,
-   uint8_t c, dma_addr_t len)
+   uint8_t c, dma_addr_t len, MemTxAttrs attrs)
 {
 dma_barrier(as, DMA_DIRECTION_FROM_DEVICE);
 
@@ -31,8 +31,7 @@ MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t addr,
 memset(fillbuf, c, FILLBUF_SIZE);
 while (len > 0) {
 l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE;
-error |= address_space_write(as, addr, MEMTXATTRS_UNSPECIFIED,
- fillbuf, l);
+error |= address_space_write(as, addr, attrs, fillbuf, l);
 len -= l;
 addr += l;
 }
-- 
2.33.1

[PULL 02/22] dma: Let dma_memory_valid() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling
dma_memory_valid().

Reviewed-by: Richard Henderson 
Reviewed-by: Li Qiang 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Philippe Mathieu-Daudé 
Acked-by: Stefan Hajnoczi 
Message-Id: <20211223115554.3155328-2-phi...@redhat.com>
---
 include/hw/ppc/spapr_vio.h | 2 +-
 include/sysemu/dma.h   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index 4bea87f39cc..4c45f1579fa 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -91,7 +91,7 @@ static inline void spapr_vio_irq_pulse(SpaprVioDevice *dev)
 static inline bool spapr_vio_dma_valid(SpaprVioDevice *dev, uint64_t taddr,
uint32_t size, DMADirection dir)
 {
-return dma_memory_valid(&dev->as, taddr, size, dir);
+return dma_memory_valid(&dev->as, taddr, size, dir, 
MEMTXATTRS_UNSPECIFIED);
 }
 
 static inline int spapr_vio_dma_read(SpaprVioDevice *dev, uint64_t taddr,
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 3201e7901db..296f3b57c9c 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -73,11 +73,11 @@ static inline void dma_barrier(AddressSpace *as, 
DMADirection dir)
  * dma_memory_{read,write}() and check for errors */
 static inline bool dma_memory_valid(AddressSpace *as,
 dma_addr_t addr, dma_addr_t len,
-DMADirection dir)
+DMADirection dir, MemTxAttrs attrs)
 {
 return address_space_access_valid(as, addr, len,
   dir == DMA_DIRECTION_FROM_DEVICE,
-  MEMTXATTRS_UNSPECIFIED);
+  attrs);
 }
 
 static inline MemTxResult dma_memory_rw_relaxed(AddressSpace *as,
-- 
2.33.1

[PULL 01/22] hw/scsi/megasas: Use uint32_t for reply queue head/tail values

[Philippe Mathieu-Daudé]

While the reply queue values fit in 16-bit, they are accessed
as 32-bit:

  661:s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa);
  662:s->reply_queue_head %= MEGASAS_MAX_FRAMES;
  663:s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
  664:s->reply_queue_tail %= MEGASAS_MAX_FRAMES;

Having:

  41:#define MEGASAS_MAX_FRAMES 2048 /* Firmware limit at 65535 */

In order to update the ld/st*_pci_dma() API to pass the address
of the value to access, it is simpler to have the head/tail declared
as 32-bit values. Replace the uint16_t by uint32_t, wasting 4 bytes in
the MegasasState structure.

Acked-by: Richard Henderson 
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20211223115554.3155328-20-phi...@redhat.com>
---
 hw/scsi/megasas.c| 4 ++--
 hw/scsi/trace-events | 8 
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 8f357841004..14ec6d68bbf 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -109,8 +109,8 @@ struct MegasasState {
 uint64_t reply_queue_pa;
 void *reply_queue;
 uint16_t reply_queue_len;
-uint16_t reply_queue_head;
-uint16_t reply_queue_tail;
+uint32_t reply_queue_head;
+uint32_t reply_queue_tail;
 uint64_t consumer_pa;
 uint64_t producer_pa;
 
diff --git a/hw/scsi/trace-events b/hw/scsi/trace-events
index 92d5b40f892..ae8551f2797 100644
--- a/hw/scsi/trace-events
+++ b/hw/scsi/trace-events
@@ -42,18 +42,18 @@ mptsas_config_sas_phy(void *dev, int address, int port, int 
phy_handle, int dev_
 
 # megasas.c
 megasas_init_firmware(uint64_t pa) "pa 0x%" PRIx64 " "
-megasas_init_queue(uint64_t queue_pa, int queue_len, uint64_t head, uint64_t 
tail, uint32_t flags) "queue at 0x%" PRIx64 " len %d head 0x%" PRIx64 " tail 
0x%" PRIx64 " flags 0x%x"
+megasas_init_queue(uint64_t queue_pa, int queue_len, uint32_t head, uint32_t 
tail, uint32_t flags) "queue at 0x%" PRIx64 " len %d head 0x%" PRIx32 " tail 
0x%" PRIx32 " flags 0x%x"
 megasas_initq_map_failed(int frame) "scmd %d: failed to map queue"
 megasas_initq_mapped(uint64_t pa) "queue already mapped at 0x%" PRIx64
 megasas_initq_mismatch(int queue_len, int fw_cmds) "queue size %d max fw cmds 
%d"
 megasas_qf_mapped(unsigned int index) "skip mapped frame 0x%x"
 megasas_qf_new(unsigned int index, uint64_t frame) "frame 0x%x addr 0x%" PRIx64
 megasas_qf_busy(unsigned long pa) "all frames busy for frame 0x%lx"
-megasas_qf_enqueue(unsigned int index, unsigned int count, uint64_t context, 
unsigned int head, unsigned int tail, int busy) "frame 0x%x count %d context 
0x%" PRIx64 " head 0x%x tail 0x%x busy %d"
-megasas_qf_update(unsigned int head, unsigned int tail, unsigned int busy) 
"head 0x%x tail 0x%x busy %d"
+megasas_qf_enqueue(unsigned int index, unsigned int count, uint64_t context, 
uint32_t head, uint32_t tail, unsigned int busy) "frame 0x%x count %d context 
0x%" PRIx64 " head 0x%" PRIx32 " tail 0x%" PRIx32 " busy %u"
+megasas_qf_update(uint32_t head, uint32_t tail, unsigned int busy) "head 0x%" 
PRIx32 " tail 0x%" PRIx32 " busy %u"
 megasas_qf_map_failed(int cmd, unsigned long frame) "scmd %d: frame %lu"
 megasas_qf_complete_noirq(uint64_t context) "context 0x%" PRIx64 " "
-megasas_qf_complete(uint64_t context, unsigned int head, unsigned int tail, 
int busy) "context 0x%" PRIx64 " head 0x%x tail 0x%x busy %d"
+megasas_qf_complete(uint64_t context, uint32_t head, uint32_t tail, int busy) 
"context 0x%" PRIx64 " head 0x%" PRIx32 " tail 0x%" PRIx32 " busy %u"
 megasas_frame_busy(uint64_t addr) "frame 0x%" PRIx64 " busy"
 megasas_unhandled_frame_cmd(int cmd, uint8_t frame_cmd) "scmd %d: MFI cmd 0x%x"
 megasas_handle_scsi(const char *frame, int bus, int dev, int lun, void *sdev, 
unsigned long size) "%s dev %x/%x/%x sdev %p xfer %lu"
-- 
2.33.1

[PULL 00/22] Memory API patches for 2021-12-31

[Philippe Mathieu-Daudé]

The following changes since commit d5a9f352896fe43183ef01072b374e89a3488315:

  Merge tag 'pull-jobs-2021-12-29' of 
https://src.openvz.org/scm/~vsementsov/qemu into staging (2021-12-29 14:33:23 
-0800)

are available in the Git repository at:

  https://github.com/philmd/qemu.git tags/memory-api-20211231

for you to fetch changes up to 4a63054bce23982b99f4d3c65528e47e614086b2:

  pci: Let ld*_pci_dma() propagate MemTxResult (2021-12-31 01:05:27 +0100)


Memory API patches

Have various functions from the Memory API:
- take a MemTxAttrs argument,
- propagate a MemTxResult.

Some patches trigger "WARNING: line over 80 characters",
and a pair "ERROR: spaces required around that '*' (ctx:WxV)",
both false positives.


Philippe Mathieu-Daudé (22):
  hw/scsi/megasas: Use uint32_t for reply queue head/tail values
  dma: Let dma_memory_valid() take MemTxAttrs argument
  dma: Let dma_memory_set() take MemTxAttrs argument
  dma: Let dma_memory_rw_relaxed() take MemTxAttrs argument
  dma: Let dma_memory_rw() take MemTxAttrs argument
  dma: Let dma_memory_read/write() take MemTxAttrs argument
  dma: Let dma_memory_map() take MemTxAttrs argument
  dma: Have dma_buf_rw() take a void pointer
  dma: Have dma_buf_read() / dma_buf_write() take a void pointer
  pci: Let pci_dma_rw() take MemTxAttrs argument
  dma: Let dma_buf_rw() take MemTxAttrs argument
  dma: Let dma_buf_write() take MemTxAttrs argument
  dma: Let dma_buf_read() take MemTxAttrs argument
  dma: Let dma_buf_rw() propagate MemTxResult
  dma: Let st*_dma() take MemTxAttrs argument
  dma: Let ld*_dma() take MemTxAttrs argument
  dma: Let st*_dma() propagate MemTxResult
  dma: Let ld*_dma() propagate MemTxResult
  pci: Let st*_pci_dma() take MemTxAttrs argument
  pci: Let ld*_pci_dma() take MemTxAttrs argument
  pci: Let st*_pci_dma() propagate MemTxResult
  pci: Let ld*_pci_dma() propagate MemTxResult

 include/hw/pci/pci.h  | 38 +--
 include/hw/ppc/spapr_vio.h| 30 
 include/sysemu/dma.h  | 88 ---
 hw/arm/musicpal.c | 13 +++---
 hw/arm/smmu-common.c  |  3 +-
 hw/arm/smmuv3.c   | 14 --
 hw/audio/intel-hda.c  | 13 --
 hw/core/generic-loader.c  |  3 +-
 hw/display/virtio-gpu.c   | 10 ++--
 hw/dma/pl330.c| 12 +++--
 hw/dma/sparc32_dma.c  | 16 ---
 hw/dma/xlnx-zynq-devcfg.c |  6 ++-
 hw/dma/xlnx_dpdma.c   | 10 ++--
 hw/hyperv/vmbus.c |  8 ++--
 hw/i386/amd_iommu.c   | 16 ---
 hw/i386/intel_iommu.c | 28 ++-
 hw/ide/ahci.c | 18 ---
 hw/ide/macio.c|  2 +-
 hw/intc/pnv_xive.c|  7 +--
 hw/intc/spapr_xive.c  |  3 +-
 hw/intc/xive.c|  7 +--
 hw/misc/bcm2835_property.c|  3 +-
 hw/misc/macio/mac_dbdma.c | 10 ++--
 hw/net/allwinner-sun8i-emac.c | 18 ---
 hw/net/eepro100.c | 49 +++
 hw/net/ftgmac100.c| 25 ++
 hw/net/imx_fec.c  | 32 -
 hw/net/npcm7xx_emc.c  | 20 
 hw/net/tulip.c| 36 +++---
 hw/nvme/ctrl.c|  5 +-
 hw/nvram/fw_cfg.c | 16 ---
 hw/pci-host/pnv_phb3.c|  5 +-
 hw/pci-host/pnv_phb3_msi.c|  9 ++--
 hw/pci-host/pnv_phb4.c|  5 +-
 hw/scsi/esp-pci.c |  2 +-
 hw/scsi/megasas.c | 64 ++---
 hw/scsi/mptsas.c  | 16 +--
 hw/scsi/scsi-bus.c|  4 +-
 hw/scsi/vmw_pvscsi.c  | 20 +---
 hw/sd/allwinner-sdhost.c  | 14 +++---
 hw/sd/sdhci.c | 35 --
 hw/usb/hcd-dwc2.c |  8 ++--
 hw/usb/hcd-ehci.c |  6 ++-
 hw/usb/hcd-ohci.c | 28 ++-
 hw/usb/hcd-xhci.c | 26 +++
 hw/usb/libhw.c|  3 +-
 hw/virtio/virtio.c|  6 ++-
 softmmu/dma-helpers.c | 40 ++--
 hw/scsi/trace-events  |  8 ++--
 49 files changed, 526 insertions(+), 332 deletions(-)

-- 
2.33.1

[PULL 07/22] dma: Let dma_memory_map() take MemTxAttrs argument

[Philippe Mathieu-Daudé]

Let devices specify transaction attributes when calling
dma_memory_map().

Patch created mechanically using spatch with this script:

  @@
  expression E1, E2, E3, E4;
  @@
  - dma_memory_map(E1, E2, E3, E4)
  + dma_memory_map(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED)

Reviewed-by: Richard Henderson 
Reviewed-by: Li Qiang 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Philippe Mathieu-Daudé 
Acked-by: Stefan Hajnoczi 
Message-Id: <20211223115554.3155328-7-phi...@redhat.com>
---
 include/hw/pci/pci.h|  3 ++-
 include/sysemu/dma.h|  5 +++--
 hw/display/virtio-gpu.c | 10 ++
 hw/hyperv/vmbus.c   |  8 +---
 hw/ide/ahci.c   |  8 +---
 hw/usb/libhw.c  |  3 ++-
 hw/virtio/virtio.c  |  6 --
 softmmu/dma-helpers.c   |  3 ++-
 8 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 4383f1c95e0..1acefc2a4c3 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -875,7 +875,8 @@ static inline void *pci_dma_map(PCIDevice *dev, dma_addr_t 
addr,
 {
 void *buf;
 
-buf = dma_memory_map(pci_get_address_space(dev), addr, plen, dir);
+buf = dma_memory_map(pci_get_address_space(dev), addr, plen, dir,
+ MEMTXATTRS_UNSPECIFIED);
 return buf;
 }
 
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index 522682bf386..97ff6f29f8c 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -202,16 +202,17 @@ MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t 
addr,
  * @addr: address within that address space
  * @len: pointer to length of buffer; updated on return
  * @dir: indicates the transfer direction
+ * @attrs: memory attributes
  */
 static inline void *dma_memory_map(AddressSpace *as,
dma_addr_t addr, dma_addr_t *len,
-   DMADirection dir)
+   DMADirection dir, MemTxAttrs attrs)
 {
 hwaddr xlen = *len;
 void *p;
 
 p = address_space_map(as, addr, &xlen, dir == DMA_DIRECTION_FROM_DEVICE,
-  MEMTXATTRS_UNSPECIFIED);
+  attrs);
 *len = xlen;
 return p;
 }
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index d78b9700c7d..c6dc818988c 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -814,8 +814,9 @@ int virtio_gpu_create_mapping_iov(VirtIOGPU *g,
 
 do {
 len = l;
-map = dma_memory_map(VIRTIO_DEVICE(g)->dma_as,
- a, &len, DMA_DIRECTION_TO_DEVICE);
+map = dma_memory_map(VIRTIO_DEVICE(g)->dma_as, a, &len,
+ DMA_DIRECTION_TO_DEVICE,
+ MEMTXATTRS_UNSPECIFIED);
 if (!map) {
 qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to map MMIO memory 
for"
   " element %d\n", __func__, e);
@@ -1252,8 +1253,9 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, 
size_t size,
 for (i = 0; i < res->iov_cnt; i++) {
 hwaddr len = res->iov[i].iov_len;
 res->iov[i].iov_base =
-dma_memory_map(VIRTIO_DEVICE(g)->dma_as,
-   res->addrs[i], &len, DMA_DIRECTION_TO_DEVICE);
+dma_memory_map(VIRTIO_DEVICE(g)->dma_as, res->addrs[i], &len,
+   DMA_DIRECTION_TO_DEVICE,
+   MEMTXATTRS_UNSPECIFIED);
 
 if (!res->iov[i].iov_base || len != res->iov[i].iov_len) {
 /* Clean up the half-a-mapping we just created... */
diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index dbce3b35fba..8aad29f1bb2 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -373,7 +373,8 @@ static ssize_t gpadl_iter_io(GpadlIter *iter, void *buf, 
uint32_t len)
 
 maddr = (iter->gpadl->gfns[idx] << TARGET_PAGE_BITS) | off_in_page;
 
-iter->map = dma_memory_map(iter->as, maddr, &mlen, iter->dir);
+iter->map = dma_memory_map(iter->as, maddr, &mlen, iter->dir,
+   MEMTXATTRS_UNSPECIFIED);
 if (mlen != pgleft) {
 dma_memory_unmap(iter->as, iter->map, mlen, iter->dir, 0);
 iter->map = NULL;
@@ -490,7 +491,8 @@ int vmbus_map_sgl(VMBusChanReq *req, DMADirection dir, 
struct iovec *iov,
 goto err;
 }
 
-iov[ret_cnt].iov_base = dma_memory_map(sgl->as, a, &l, dir);
+iov[ret_cnt].iov_base = dma_memory_map(sgl->as, a, &l, dir,
+   MEMTXATTRS_UNSPECIFIED);
 if (!l) {
 ret = -EFAULT;
 goto err;
@@ -566,7 +568,7 @@ static vmbus_ring_buffer 
*ringbuf_map_hdr(VMBusRingBufCommon *ringbuf)
 dma_addr_t mlen = sizeof(*rb);
 
 rb = dma_memory_map(ringbuf->as, ringbuf->rb_addr, &mlen,
-DM

[PATCH v2] MAINTAINERS: Change philmd's email address

[Philippe Mathieu-Daudé]

The phi...@redhat.com email address will stop working on
2022-01-01, change it to my personal email address.

Update .mailmap in case anyone wants to send me an email
because of some past commit I authored.

Reviewed-by: Richard Henderson 
Signed-off-by: Philippe Mathieu-Daudé 
---
v2: Fixed .mailmap (Richard)
---
 .gitlab-ci.d/edk2/Dockerfile |  2 +-
 .mailmap |  1 +
 MAINTAINERS  | 18 +-
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/.gitlab-ci.d/edk2/Dockerfile b/.gitlab-ci.d/edk2/Dockerfile
index b4584d1cf64..13029310f6d 100644
--- a/.gitlab-ci.d/edk2/Dockerfile
+++ b/.gitlab-ci.d/edk2/Dockerfile
@@ -3,7 +3,7 @@
 #
 FROM ubuntu:16.04
 
-MAINTAINER Philippe Mathieu-Daudé 
+MAINTAINER Philippe Mathieu-Daudé 
 
 # Install packages required to build EDK2
 RUN apt update \
diff --git a/.mailmap b/.mailmap
index c45d1c53014..5113f55b3a0 100644
--- a/.mailmap
+++ b/.mailmap
@@ -63,6 +63,7 @@ Paul Burton  
 Paul Burton  
 Paul Burton  
 Paul Burton  
+Philippe Mathieu-Daudé  
 Stefan Brankovic  
 Yongbok Kim  
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 54565368054..c64c2be9bd5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1630,7 +1630,7 @@ F: pc-bios/bios-microvm.bin
 Machine core
 M: Eduardo Habkost 
 M: Marcel Apfelbaum 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 S: Supported
 F: cpu.c
 F: hw/core/cpu.c
@@ -1810,7 +1810,7 @@ F: docs/virtio-net-failover.rst
 T: git https://github.com/jasowang/qemu.git net
 
 Parallel NOR Flash devices
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 T: git https://gitlab.com/philmd/qemu.git pflash-next
 S: Maintained
 F: hw/block/pflash_cfi*.c
@@ -2226,7 +2226,7 @@ F: hw/isa/piix4.c
 F: include/hw/southbridge/piix.h
 
 Firmware configuration (fw_cfg)
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 R: Gerd Hoffmann 
 S: Supported
 F: docs/specs/fw_cfg.txt
@@ -2524,7 +2524,7 @@ F: scripts/coccinelle/errp-guard.cocci
 
 GDB stub
 M: Alex Bennée 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 S: Maintained
 F: gdbstub*
 F: include/exec/gdbstub.h
@@ -2535,7 +2535,7 @@ Memory API
 M: Paolo Bonzini 
 M: Peter Xu 
 M: David Hildenbrand 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 S: Supported
 F: include/exec/ioport.h
 F: include/exec/memop.h
@@ -3029,14 +3029,14 @@ F: include/hw/i2c/smbus_slave.h
 F: include/hw/i2c/smbus_eeprom.h
 
 Firmware schema specifications
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 R: Daniel P. Berrange 
 R: Kashyap Chamarthy 
 S: Maintained
 F: docs/interop/firmware.json
 
 EDK2 Firmware
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 R: Gerd Hoffmann 
 S: Supported
 F: hw/i386/*ovmf*
@@ -3274,7 +3274,7 @@ F: block/null.c
 NVMe Block Driver
 M: Stefan Hajnoczi 
 R: Fam Zheng 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 L: qemu-bl...@nongnu.org
 S: Supported
 F: block/nvme*
@@ -3517,7 +3517,7 @@ F: tests/tcg/Makefile.include
 Integration Testing with the Avocado framework
 W: https://trello.com/b/6Qi1pxVn/avocado-qemu
 R: Cleber Rosa 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 R: Wainer dos Santos Moschetta 
 R: Beraldo Leal 
 S: Odd Fixes
-- 
2.33.1

Re: [PATCH] tests/tcg: Unconditionally use 90 second timeout

[Philippe Mathieu-Daudé]

On 12/31/21 00:54, Richard Henderson wrote:
> The cross-i386-tci test has timeouts because we're no longer
> actually applying the timeout that we desired.  Hack around it.
> 
> Fixes: 23a77b2d18b8 ("build-system: clean up TCG/TCI configury")
> Signed-off-by: Richard Henderson 
> ---
>  tests/tcg/Makefile.target | 12 +---
>  1 file changed, 5 insertions(+), 7 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v2 00/23] hw: Have DMA APIs take MemTxAttrs arg & propagate MemTxResult (full)

[Philippe Mathieu-Daudé]

On 12/30/21 17:07, Philippe Mathieu-Daudé wrote:
> On 12/23/21 12:55, Philippe Mathieu-Daudé wrote:
>> Hi Peter and Paolo.
>>
>> This series contains all the uncontroversary patches from
>> the "improve DMA situations, avoid re-entrancy issues"
>> earlier series. The rest will be discussed on top.
>>
>> The only operations added are:
>> - take MemTxAttrs argument
>> - propagate MemTxResult
> 
> Series queued.

Patch 14 "dma: Let dma_buf_read/dma_buf_write propagate MemTxResult"
fails on 32-bit host (when passing &size_t). Dropped it from the queue.

Re: [PATCH v2 14/23] dma: Let dma_buf_read() / dma_buf_write() propagate MemTxResult

[Philippe Mathieu-Daudé]

On 12/23/21 12:55, Philippe Mathieu-Daudé wrote:
> Since the previous commit, dma_buf_rw() returns a MemTxResult
> type. Do not discard it, return it to the caller.
> 
> Since both dma_buf_read/dma_buf_write functions were previously
> returning the QEMUSGList size not consumed, add an extra argument
> where the unconsummed size can be stored.
> 
> Update the few callers.
> 
> Reviewed-by: Klaus Jensen 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  include/sysemu/dma.h  |  6 --
>  hw/ide/ahci.c |  8 
>  hw/nvme/ctrl.c|  4 ++--
>  hw/scsi/megasas.c | 48 ++-
>  hw/scsi/scsi-bus.c|  4 ++--
>  softmmu/dma-helpers.c | 18 ++--
>  6 files changed, 52 insertions(+), 36 deletions(-)
> 
> diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
> index fd8f16003dd..d11c1d794f9 100644
> --- a/include/sysemu/dma.h
> +++ b/include/sysemu/dma.h
> @@ -302,8 +302,10 @@ BlockAIOCB *dma_blk_read(BlockBackend *blk,
>  BlockAIOCB *dma_blk_write(BlockBackend *blk,
>QEMUSGList *sg, uint64_t offset, uint32_t align,
>BlockCompletionFunc *cb, void *opaque);
> -uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
> attrs);
> -uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
> attrs);
> +MemTxResult dma_buf_read(void *ptr, int32_t len, uint64_t *residp,
> + QEMUSGList *sg, MemTxAttrs attrs);
> +MemTxResult dma_buf_write(void *ptr, int32_t len, uint64_t *residp,
> +  QEMUSGList *sg, MemTxAttrs attrs);
>  

This fails on 32-bit host when passing a size_t variable as residp
argument. I'll work a "clean" fix later. Meanwhile discarding this
patch.

> diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
> index b0be1564797..498303157e9 100644
> --- a/softmmu/dma-helpers.c
> +++ b/softmmu/dma-helpers.c
> @@ -321,22 +321,16 @@ static MemTxResult dma_buf_rw(void *buf, int32_t len, 
> uint64_t *residp,
>  return res;
>  }
>  
> -uint64_t dma_buf_read(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
> attrs)
> +MemTxResult dma_buf_read(void *ptr, int32_t len, uint64_t *residp,
> + QEMUSGList *sg, MemTxAttrs attrs)
>  {
> -uint64_t resid;
> -
> -dma_buf_rw(ptr, len, &resid, sg, DMA_DIRECTION_FROM_DEVICE, attrs);
> -
> -return resid;
> +return dma_buf_rw(ptr, len, residp, sg, DMA_DIRECTION_FROM_DEVICE, 
> attrs);
>  }
>  
> -uint64_t dma_buf_write(void *ptr, int32_t len, QEMUSGList *sg, MemTxAttrs 
> attrs)
> +MemTxResult dma_buf_write(void *ptr, int32_t len, uint64_t *residp,
> +  QEMUSGList *sg, MemTxAttrs attrs)
>  {
> -uint64_t resid;
> -
> -dma_buf_rw(ptr, len, &resid, sg, DMA_DIRECTION_TO_DEVICE, attrs);
> -
> -return resid;
> +return dma_buf_rw(ptr, len, residp, sg, DMA_DIRECTION_TO_DEVICE, attrs);
>  }
>  
>  void dma_acct_start(BlockBackend *blk, BlockAcctCookie *cookie,

[PATCH] tests/tcg: Unconditionally use 90 second timeout

[Richard Henderson]

The cross-i386-tci test has timeouts because we're no longer
actually applying the timeout that we desired.  Hack around it.

Fixes: 23a77b2d18b8 ("build-system: clean up TCG/TCI configury")
Signed-off-by: Richard Henderson 
---
 tests/tcg/Makefile.target | 12 +---
 1 file changed, 5 insertions(+), 7 deletions(-)
---

This fixes the persistant timeouts that we've been seeing in
gitlab for the cross-i386-tci target.

---

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 63cf1b2573..0f8645f782 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -82,13 +82,12 @@ QEMU_OPTS=
 
 
 # If TCG debugging, or TCI is enabled things are a lot slower
-ifneq ($(CONFIG_TCG_INTERPRETER),)
+# ??? Makefile no longer has any indication that TCI is enabled,
+# but for the record:
+#   15soriginal default
+#   60swith --enable-debug
+#   90swith --enable-tcg-interpreter
 TIMEOUT=90
-else ifneq ($(CONFIG_DEBUG_TCG),)
-TIMEOUT=60
-else
-TIMEOUT=15
-endif
 
 ifdef CONFIG_USER_ONLY
 # The order we include is important. We include multiarch first and
@@ -144,7 +143,6 @@ PLUGINS=$(patsubst %.c, lib%.so, $(notdir $(wildcard 
$(PLUGIN_SRC)/*.c)))
 $(foreach p,$(PLUGINS), \
$(foreach t,$(TESTS),\
$(eval run-plugin-$(t)-with-$(p): $t $p) \
-   $(eval run-plugin-$(t)-with-$(p): TIMEOUT=60) \
$(eval RUN_TESTS+=run-plugin-$(t)-with-$(p
 endif
 
-- 
2.25.1

Re: [PATCH] MAINTAINERS: Change philmd's email address

[Philippe Mathieu-Daudé]

On 12/30/21 23:00, Richard Henderson wrote:
> On 12/30/21 6:58 AM, Philippe Mathieu-Daudé wrote:
>> +Philippe Mathieu-Daudé  
> 
> Actually, it looks like the mailmap is backward.

Doh of course >_<

Thanks for catching it.

Re: [PATCH 1/4] acpi: fix QEMU crash when started with SLIC table

[Alexander Tsoy]

В Пн, 27/12/2021 в 14:31 -0500, Igor Mammedov пишет:
> if QEMU is started with used provided SLIC table blob,
> 
>   -acpitable sig=SLIC,oem_id='CRASH
> ',oem_table_id="ME",oem_rev=2210,asl_compiler_id="",asl_compiler_re
> v=,data=/dev/null
> it will assert with:
> 
>   hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed:
> (len <= maxlen)
> 
> and following backtrace:
> 
>   ...
>   build_append_padded_str (array=0x56afe320, str=0x56afdb2e
> "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
>   acpi_table_begin (desc=0x7fffd1b0, array=0x56afe320) at
> hw/acpi/aml-build.c:1727
>   build_fadt (tbl=0x56afe320, linker=0x57ca3830,
> f=0x7fffd318, oem_id=0x56afdb2e "CRASH ME",
> oem_table_id=0x56afdb34 "ME") at hw/acpi/aml-build.c:2064
>   ...
> 
> which happens due to acpi_table_begin() expecting NULL terminated
> oem_id and oem_table_id strings, which is normally the case, but
> in case of user provided SLIC table, oem_id points to table's blob
> directly and as result oem_id became longer than expected.
> 
> Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
> return NULL terminated strings.
> 
> PS:
> After [1] refactoring, oem_id semantics became inconsistent, where
> NULL terminated string was coming from machine and old way pointer
> into byte array coming from -acpitable option. That used to work
> since build_header() wasn't expecting NULL terminated string and
> blindly copied the 1st 6 bytes only.
> 
> However commit [2] broke that by replacing build_header() with
> acpi_table_begin(), which was expecting NULL terminated string
> and was checking oem_id size.
> 
> 1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be
> changed")
> 2)
> Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use
> acpi_table_begin()/acpi_table_end() instead of build_header()")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
> Signed-off-by: Igor Mammedov 
> ---
>  hw/acpi/core.c   | 4 ++--
>  hw/i386/acpi-build.c | 2 ++
>  2 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/acpi/core.c b/hw/acpi/core.c
> index 1e004d0078..3e811bf03c 100644
> --- a/hw/acpi/core.c
> +++ b/hw/acpi/core.c
> @@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
>  struct acpi_table_header *hdr = (void *)(u - sizeof(hdr-
> >_length));
>  
>  if (memcmp(hdr->sig, "SLIC", 4) == 0) {
> -    oem->id = hdr->oem_id;
> -    oem->table_id = hdr->oem_table_id;
> +    oem->id = g_strndup(hdr->oem_id, 6);
> +    oem->table_id = g_strndup(hdr->oem_table_id, 8);
>  return 0;
>  }
>  }
> diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
> index 8383b83ee3..0234fe7588 100644
> --- a/hw/i386/acpi-build.c
> +++ b/hw/i386/acpi-build.c
> @@ -2723,6 +2723,8 @@ void acpi_build(AcpiBuildTables *tables,
> MachineState *machine)
>  
>  /* Cleanup memory that's no longer used. */
>  g_array_free(table_offsets, true);
> +    g_free(slic_oem.id);
> +    g_free(slic_oem.table_id);
>  }
>  
>  static void acpi_ram_update(MemoryRegion *mr, GArray *data)

Tested-by: Alexander Tsoy 

Re: [PATCH 0/3] Reorg ppc64 pmu insn counting

[Daniel Henrique Barboza]

On 12/23/21 18:19, Richard Henderson wrote:

On 12/23/21 12:36 PM, Daniel Henrique Barboza wrote:

This reorg is breaking PMU-EBB tests, unfortunately. These tests are run from 
the kernel
tree [1] and I test them inside a pSeries TCG guest. You'll need to apply 
patches 9 and
10 of [2] beforehand (they apply cleanly in current master) because they aren't 
upstream
yet and EBB needs it.

The tests that are breaking consistently with this reorg are:

back_to_back_ebbs_test.c
cpu_event_pinned_vs_ebb_test.c
cycles_test.c
task_event_pinned_vs_ebb_test.c


In which case perhaps drop my first patch for now, and instead simply replicate 
your tcg algorithm in c exactly -- using none of the helpers that currently 
exist.

We can improve the code, and the use of pmc_get_event from 
hreg_compute_hregs_value second.



While attempting to do that I figured what was off with this series and ended up
fixing it.

It's now working with the event-based branch interrupt tests and Avocado seems 
happy
as well. It took some small adjustments/fixes in patches 1/2 and an extra patch 
of mine
tuning the existing logic after the reorg.


I'll clean it up and re-send it next week/year.


Thanks


Daniel







r~

Re: [PATCH v2 2/5] target/ppc: powerpc_excp: Add excp_vectors bounds check

[Richard Henderson]

On 12/29/21 8:57 AM, Fabiano Rosas wrote:

The next patch will start accessing the excp_vectors array earlier in
the function, so add a bounds check as first thing here.

This converts the empty return on POWERPC_EXCP_NONE to an error. This
exception number never reaches this function and if it does it
probably means something else went wrong up the line.

Signed-off-by: Fabiano Rosas 


Reviewed-by: Richard Henderson 


r~

Re: [PATCH v2 3/5] target/ppc: powerpc_excp: Set vector earlier

[Richard Henderson]

On 12/29/21 8:57 AM, Fabiano Rosas wrote:

None of the interrupt setup code touches 'vector', so we can move it
earlier in the function. This will allow us to later move the System
Call Vectored setup that is on the top level into the
POWERPC_EXCP_SYSCALL_VECTORED code block.

This patch also moves the verification for when 'excp' does not have
an address associated with it. We now bail a little earlier when that
is the case. This should not cause any visible effects.

Signed-off-by: Fabiano Rosas
Reviewed-by: Cédric Le Goater
---
  target/ppc/excp_helper.c | 16 
  1 file changed, 8 insertions(+), 8 deletions(-)


Reviewed-by: Richard Henderson 

r~

Re: [PATCH] MAINTAINERS: Change philmd's email address

[Richard Henderson]

On 12/30/21 6:58 AM, Philippe Mathieu-Daudé wrote:

+Philippe Mathieu-Daudé  


Actually, it looks like the mailmap is backward.


r~

Re: [PATCH] MAINTAINERS: Change philmd's email address

[Richard Henderson]

On 12/30/21 6:58 AM, Philippe Mathieu-Daudé wrote:

thephi...@redhat.com  email address will stop working on
2022-01-01, change it to my personal email address.

Update .mailmap in case anyone wants to send me an email
because of some past commit I authored.

Signed-off-by: Philippe Mathieu-Daudé
---
  .gitlab-ci.d/edk2/Dockerfile |  2 +-
  .mailmap |  1 +
  MAINTAINERS  | 18 +-
  3 files changed, 11 insertions(+), 10 deletions(-)


Reviewed-by: Richard Henderson 

r~

Re: [PATCH v10 2/3] cpu-throttle: implement virtual CPU throttle

[Hyman Huang]

在 2021/12/24 13:12, Peter Xu 写道:

On Tue, Dec 14, 2021 at 07:07:33PM +0800, huang...@chinatelecom.cn wrote:

From: Hyman Huang(黄勇) 

Setup a negative feedback system when vCPU thread
handling KVM_EXIT_DIRTY_RING_FULL exit by introducing
throttle_us_per_full field in struct CPUState. Sleep
throttle_us_per_full microseconds to throttle vCPU
if dirtylimit is enabled.

Start a thread to track current dirty page rates and
tune the throttle_us_per_full dynamically untill current
dirty page rate reach the quota.

Introduce the util function in the header for dirtylimit
implementation.

Signed-off-by: Hyman Huang(黄勇) 
---
  accel/kvm/kvm-all.c   |  11 ++
  include/hw/core/cpu.h |   6 +
  include/sysemu/cpu-throttle.h |  77 +
  include/sysemu/kvm.h  |   2 +
  qapi/migration.json   |  19 +++
  softmmu/cpu-throttle.c| 371 ++
  softmmu/trace-events  |   6 +
  7 files changed, 492 insertions(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index eecd803..cba5fed 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -45,6 +45,7 @@
  #include "qemu/guest-random.h"
  #include "sysemu/hw_accel.h"
  #include "kvm-cpus.h"
+#include "sysemu/cpu-throttle.h"
  
  #include "hw/boards.h"
  
@@ -2303,6 +2304,11 @@ bool kvm_dirty_ring_enabled(void)

  return kvm_state->kvm_dirty_ring_size ? true : false;
  }
  
+uint32_t kvm_dirty_ring_size(void)

+{
+return kvm_state->kvm_dirty_ring_size;
+}
+
  static int kvm_init(MachineState *ms)
  {
  MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -2933,6 +2939,11 @@ int kvm_cpu_exec(CPUState *cpu)
  qemu_mutex_lock_iothread();
  kvm_dirty_ring_reap(kvm_state);
  qemu_mutex_unlock_iothread();
+if (dirtylimit_in_service() &&
+dirtylimit_is_enabled(cpu->cpu_index) &&
+cpu->throttle_us_per_full) {
+usleep(cpu->throttle_us_per_full);
+}


Looks good, but perhaps put it into a dirty limit exported helper?


  ret = 0;
  break;
  case KVM_EXIT_SYSTEM_EVENT:
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index e948e81..be80fe2 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -411,6 +411,12 @@ struct CPUState {
   */
  bool throttle_thread_scheduled;
  
+/*

+ * Sleep throttle_us_per_full microseconds once dirty ring is full
+ * when dirty page limit is enabled.
+ */
+int64_t throttle_us_per_full;
+
  bool ignore_memory_transaction_failures;
  
  struct hax_vcpu_state *hax_vcpu;

diff --git a/include/sysemu/cpu-throttle.h b/include/sysemu/cpu-throttle.h
index d65bdef..d4973a5 100644
--- a/include/sysemu/cpu-throttle.h
+++ b/include/sysemu/cpu-throttle.h
@@ -65,4 +65,81 @@ bool cpu_throttle_active(void);
   */
  int cpu_throttle_get_percentage(void);
  
+/**

+ * dirtylimit_is_enabled
+ *
+ * Returns: %true if dirty page rate limit on specified virtual CPU is enabled,
+ *  %false otherwise.
+ */
+bool dirtylimit_is_enabled(int cpu_index);
+
+/**
+ * dirtylimit_in_service
+ *
+ * Returns: %true if dirty page rate limit thread is running, %false otherwise.
+ */
+bool dirtylimit_in_service(void);
+
+/**
+ * dirtylimit_stop
+ *
+ * stop dirty page rate limit thread.
+ */
+void dirtylimit_stop(void);
+
+/**
+ * dirtylimit_is_vcpu_index_valid
+ *
+ * Returns: %true if cpu index valid, %false otherwise.
+ */
+bool dirtylimit_is_vcpu_index_valid(int cpu_index);
+
+/**
+ * dirtylimit_state_init
+ *
+ * initialize golobal state for dirty page rate limit.
+ */
+void dirtylimit_state_init(int max_cpus);
+
+/**
+ * dirtylimit_state_finalize
+ *
+ * finalize golobal state for dirty page rate limit.
+ */
+void dirtylimit_state_finalize(void);
+
+/**
+ * dirtylimit_vcpu
+ *
+ * setup dirty page rate limit on specified virtual CPU with quota.
+ */
+void dirtylimit_vcpu(int cpu_index, uint64_t quota);
+
+/**
+ * dirtylimit_all
+ *
+ * setup dirty page rate limit on all virtual CPU with quota.
+ */
+void dirtylimit_all(uint64_t quota);
+
+/**
+ * dirtylimit_query_all
+ *
+ * Returns: dirty page limit information of all virtual CPU enabled.
+ */
+struct DirtyLimitInfoList *dirtylimit_query_all(void);
+
+/**
+ * dirtylimit_cancel_vcpu
+ *
+ * cancel dirtylimit for the specified virtual CPU.
+ */
+void dirtylimit_cancel_vcpu(int cpu_index);
+
+/**
+ * dirtylimit_cancel_all
+ *
+ * cancel dirtylimit for all virtual CPU enabled.
+ */
+void dirtylimit_cancel_all(void);
  #endif /* SYSEMU_CPU_THROTTLE_H */
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 7b22aeb..e5a9a28 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -548,4 +548,6 @@ bool kvm_cpu_check_are_resettable(void);
  bool kvm_arch_cpu_check_are_resettable(void);
  
  bool kvm_dirty_ring_enabled(void);

+
+uint32_t kvm_dirty_ring_size(void);
  #endif
diff --git a/qapi/migration.json b/qapi/migration.json

Re: [PATCH 2/3] qsd: Add --daemonize

[Vladimir Sementsov-Ogievskiy]

22.12.2021 14:41, Hanna Reitz wrote:

This option does basically the same as --fork does for qemu-nbd:


Can we share the code?

Before this patch we already have --fork code-path of qemu-nbd and -daemonize 
code-path of QEMU.. Now we have one more. Did you consider improving and 
sharing the old code instead?


- We fork off a child process
- The child process is daemonized (closing its stdin and stdout)
- stderr of the child is routed through the parent, so the parent can
   see errors and adjust its exit code accordingly
- Once the child closes its end of this stderr pipe (done right after
   creating the PID file), the parent exits

It is not named --fork, because --fork was probably a name that few
programs but qemu-nbd ever used.  qemu (the system emulator) itself uses
-daemonize, too.  (Besides, QSD's interface is not compatible to
qemu-nbd anyway; compare --pidfile vs. --pid-file.)

Signed-off-by: Hanna Reitz



--
Best regards,
Vladimir

[PATCH] migration: Don't return for postcopy_send_discard_bm_ram()

[Philippe Mathieu-Daudé]

postcopy_send_discard_bm_ram() always return zero. Since it can't
fail, simplify and do not return anything.

Signed-off-by: Philippe Mathieu-Daudé 
---
Based-on: <20211224065000.97572-1-pet...@redhat.com>
---
 migration/ram.c | 6 +-
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/migration/ram.c b/migration/ram.c
index 5234d1ece11..e241ce98461 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -2433,14 +2433,12 @@ void 
ram_postcopy_migrated_memory_release(MigrationState *ms)
 /**
  * postcopy_send_discard_bm_ram: discard a RAMBlock
  *
- * Returns zero on success
- *
  * Callback from postcopy_each_ram_send_discard for each RAMBlock
  *
  * @ms: current migration state
  * @block: RAMBlock to discard
  */
-static int postcopy_send_discard_bm_ram(MigrationState *ms, RAMBlock *block)
+static void postcopy_send_discard_bm_ram(MigrationState *ms, RAMBlock *block)
 {
 unsigned long end = block->used_length >> TARGET_PAGE_BITS;
 unsigned long current;
@@ -2464,8 +2462,6 @@ static int postcopy_send_discard_bm_ram(MigrationState 
*ms, RAMBlock *block)
 postcopy_discard_send_range(ms, one, discard_length);
 current = one + discard_length;
 }
-
-return 0;
 }
 
 static void postcopy_chunk_hostpages_pass(MigrationState *ms, RAMBlock *block);
-- 
2.33.1

Re: [PATCH v2 00/23] hw: Have DMA APIs take MemTxAttrs arg & propagate MemTxResult (full)

[Philippe Mathieu-Daudé]

On 12/23/21 12:55, Philippe Mathieu-Daudé wrote:
> Hi Peter and Paolo.
> 
> This series contains all the uncontroversary patches from
> the "improve DMA situations, avoid re-entrancy issues"
> earlier series. The rest will be discussed on top.
> 
> The only operations added are:
> - take MemTxAttrs argument
> - propagate MemTxResult

Series queued.

Re: [PATCH v3 5/8] migration: Drop return code for disgard ram process

[Philippe Mathieu-Daudé]

On 12/24/21 07:49, Peter Xu wrote:
> It will just never fail.  Drop those return values where they're constantly
> zeros.
> 
> A tiny touch-up on the tracepoint so trace_ram_postcopy_send_discard_bitmap()
> is called after the logic itself (which sounds more reasonable).
> 
> Reviewed-by: Dr. David Alan Gilbert 
> Signed-off-by: Peter Xu 
> ---
>  migration/migration.c |  5 +
>  migration/ram.c   | 20 +---
>  migration/ram.h   |  2 +-
>  3 files changed, 7 insertions(+), 20 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH 1/3] qsd: Add pre-init argument parsing pass

[Vladimir Sementsov-Ogievskiy]

22.12.2021 14:41, Hanna Reitz wrote:

We want to add a --daemonize argument to QSD's command line.  This will
require forking the process before we do any complex initialization
steps, like setting up the block layer or QMP.  Therefore, we must scan
the command line for it long before our current process_options() call.

Instead of adding custom new code to do so, just reuse process_options()
and give it a @pre_init_pass argument to distinguish the two passes.  I
believe there are some other switches but --daemonize that deserve
parsing in the first pass:

- --help and --version are supposed to only print some text and then
   immediately exit (so any initialization we do would be for naught).
   This changes behavior, because now "--blockdev inv-drv --help" will
   print a help text instead of complaining about the --blockdev
   argument.
   Note that this is similar in behavior to other tools, though: "--help"
   is generally immediately acted upon when finding it in the argument
   list, potentially before other arguments (even ones before it) are
   acted on.  For example, "ls /does-not-exist --help" prints a help text
   and does not complain about ENOENT.

- --pidfile does not need initialization, and is already exempted from
   the sequential order that process_options() claims to strictly follow
   (the PID file is only created after all arguments are processed, not
   at the time the --pidfile argument appears), so it makes sense to
   include it in the same category as --daemonize.

- Invalid arguments should always be reported as soon as possible.  (The
   same caveat with --help applies: That means that "--blockdev inv-drv
   --inv-arg" will now complain about --inv-arg, not inv-drv.)

Note that we could decide to check only for --daemonize in the first
pass, and defer --help, --version, and checking for invalid arguments to
the second one, thus largely keeping our current behavior.  However,
this would break "--help --daemonize": The child would print the help
text to stdout, which is redirected to /dev/null, and so the text would
disappear.  We would need to have the text be printed to stderr instead,
and this would then make the parent process exit with EXIT_FAILURE,
which is probably not what we want for --help.

This patch does make some references to --daemonize without having
implemented it yet, but that will happen in the next patch.

Signed-off-by: Hanna Reitz 


Reviewed-by: Vladimir Sementsov-Ogievskiy 


---
  storage-daemon/qemu-storage-daemon.c | 37 ++--
  1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/storage-daemon/qemu-storage-daemon.c 
b/storage-daemon/qemu-storage-daemon.c
index 52cf17e8ac..42a52d3b1c 100644
--- a/storage-daemon/qemu-storage-daemon.c
+++ b/storage-daemon/qemu-storage-daemon.c
@@ -164,7 +164,23 @@ static int getopt_set_loc(int argc, char **argv, const 
char *optstring,
  return c;
  }
  
-static void process_options(int argc, char *argv[])

+/**
+ * Process QSD command-line arguments.
+ *
+ * This is done in two passes:
+ *
+ * First (@pre_init_pass is true), we do a pass where all global
+ * arguments pertaining to the QSD process (like --help or --daemonize)
+ * are processed.  This pass is done before most of the QEMU-specific
+ * initialization steps (e.g. initializing the block layer or QMP), and
+ * so must only process arguments that are not really QEMU-specific.
+ *
+ * Second (@pre_init_pass is false), we (sequentially) process all
+ * QEMU/QSD-specific arguments.  Many of these arguments are effectively
+ * translated to QMP commands (like --blockdev for blockdev-add, or
+ * --export for block-export-add).
+ */
+static void process_options(int argc, char *argv[], bool pre_init_pass)
  {
  int c;
  
@@ -187,7 +203,22 @@ static void process_options(int argc, char *argv[])

   * they are given on the command lines. This means that things must be


So, --pidfile already breaks a bit this comment. Still would be good to adjust 
it now..

may be, s/options/QEMU-specific options/ or something like this.


   * defined first before they can be referenced in another option.
   */
+optind = 1;
  while ((c = getopt_set_loc(argc, argv, "-hT:V", long_options)) != -1) {
+bool handle_option_pre_init;
+
+/* Should this argument be processed in the pre-init pass? */
+handle_option_pre_init =
+c == '?' ||
+c == 'h' ||
+c == 'V' ||
+c == OPTION_PIDFILE;
+
+/* Process every option only in its respective pass */
+if (pre_init_pass != handle_option_pre_init) {
+continue;
+}
+
  switch (c) {
  case '?':
  exit(EXIT_FAILURE);
@@ -321,6 +352,8 @@ int main(int argc, char *argv[])
  qemu_init_exec_dir(argv[0]);
  os_setup_signal_handling();
  
+process_options(argc, argv, true);

+
  module_call_init(MODULE_INIT_QOM);
  module_call_init(MODULE_INIT_TRACE);

Re: [PATCH v3 6/8] migration: Dump sub-cmd name in loadvm_process_command tp

[Philippe Mathieu-Daudé]

On 12/24/21 07:49, Peter Xu wrote:
> It'll be easier to read the name rather than index of sub-cmd when debugging.
> 
> Signed-off-by: Peter Xu 
> ---
>  migration/savevm.c | 3 ++-
>  migration/trace-events | 2 +-
>  2 files changed, 3 insertions(+), 2 deletions(-)

> diff --git a/migration/trace-events b/migration/trace-events
> index b48d873b8a..d63a5915f5 100644
> --- a/migration/trace-events
> +++ b/migration/trace-events
> @@ -22,7 +22,7 @@ loadvm_postcopy_handle_resume(void) ""
>  loadvm_postcopy_ram_handle_discard(void) ""
>  loadvm_postcopy_ram_handle_discard_end(void) ""
>  loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) 
> "%s: %ud"
> -loadvm_process_command(uint16_t com, uint16_t len) "com=0x%x len=%d"
> +loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"

Also: len=%u

Otherwise:
Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v3 8/8] migration: Tracepoint change in postcopy-run bottom half

[Philippe Mathieu-Daudé]

On 12/24/21 07:50, Peter Xu wrote:
> Remove the old two tracepoints and they're even near each other:
> 
> trace_loadvm_postcopy_handle_run_cpu_sync()
> trace_loadvm_postcopy_handle_run_vmstart()
> 
> Add trace_loadvm_postcopy_handle_run_bh() with a finer granule trace.
> 
> Signed-off-by: Peter Xu 
> ---
>  migration/savevm.c | 12 +---
>  migration/trace-events |  3 +--
>  2 files changed, 10 insertions(+), 5 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v3 7/8] migration: Finer grained tracepoints for POSTCOPY_LISTEN

[Philippe Mathieu-Daudé]

On 12/24/21 07:49, Peter Xu wrote:
> The enablement of postcopy listening has a few steps, add a few tracepoints to
> be there ready for some basic measurements for them.
> 
> Signed-off-by: Peter Xu 
> ---
>  migration/savevm.c | 9 -
>  migration/trace-events | 2 +-
>  2 files changed, 9 insertions(+), 2 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v3 1/8] migration: Drop dead code of ram_debug_dump_bitmap()

[Philippe Mathieu-Daudé]

On 12/24/21 07:49, Peter Xu wrote:
> I planned to add "#ifdef DEBUG_POSTCOPY" around the function too because
> otherwise it'll be compiled into qemu binary even if it'll never be used.  
> Then
> I found that maybe it's easier to just drop it for good..
> 
> Reviewed-by: Dr. David Alan Gilbert 
> Signed-off-by: Peter Xu 
> ---
>  migration/ram.c | 39 ---
>  migration/ram.h |  2 --
>  2 files changed, 41 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH v3 2/8] migration: Don't return for postcopy_chunk_hostpages()

[Philippe Mathieu-Daudé]

On 12/24/21 07:49, Peter Xu wrote:
> It always return zero, because it just can't go wrong so far.  Simplify the
> code with no functional change.
> 
> Reviewed-by: Dr. David Alan Gilbert 
> Signed-off-by: Peter Xu 
> ---
>  migration/ram.c | 11 ++-
>  1 file changed, 2 insertions(+), 9 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH] gitlab-ci: Always upload artifacts by default

[Philippe Mathieu-Daudé]

On 12/30/21 00:33, Philippe Mathieu-Daudé wrote:
> GitLab defaults [1] to upload artifacts only when the job succeeds,
> which is not helpful to troubleshoot failing tests. Switch to
> always upload artifacts by default for QEMU jobs, by setting the
> 'artifacts:when' keyword in the global default section [2].
> 
> [1] https://docs.gitlab.com/ee/ci/yaml/index.html#artifactswhen
> [2] https://docs.gitlab.com/ee/ci/yaml/index.html#default
> 
> Reported-by: Richard Henderson 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  .gitlab-ci.d/qemu-project.yml | 4 
>  1 file changed, 4 insertions(+)
> 
> diff --git a/.gitlab-ci.d/qemu-project.yml b/.gitlab-ci.d/qemu-project.yml
> index 871262fe0e8..24137c14dc4 100644
> --- a/.gitlab-ci.d/qemu-project.yml
> +++ b/.gitlab-ci.d/qemu-project.yml
> @@ -1,6 +1,10 @@
>  # This file contains the set of jobs run by the QEMU project:
>  # https://gitlab.com/qemu-project/qemu/-/pipelines
>  
> +default:
> +  artifacts:
> +when: always

Hmm this doesn't work as expected... Please disregard this patch.

Re: [PATCH v3 3/7] crypto include/crypto target/arm: move sm4_sbox to crypto

[liweiwei]

Thanks for your review.

在 2021/12/30 下午10:46, Philippe Mathieu-Daudé 写道:

Hi,

On 12/30/21 15:30, liweiwei wrote:

- share it between target/arm and target/riscv

"Share sm4_sbox between ARM and RISCV targets."?

Yes. sm4 related instruction in scalar crypto extension will use sm4_sbox.

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
---
  crypto/meson.build |  1 +
  crypto/sm4.c   | 48 ++
  include/crypto/sm4.h   |  6 +
  meson  |  2 +-
  target/arm/crypto_helper.c | 36 +---
  5 files changed, 57 insertions(+), 36 deletions(-)
diff --git a/crypto/sm4.c b/crypto/sm4.c
new file mode 100644
index 00..1cdcb8a620
--- /dev/null
+++ b/crypto/sm4.c
+uint8_t const sm4_sbox[] = {

Please explicit the [256] array size.


diff --git a/meson b/meson
index 12f9f04ba0..b25d94e7c7 16
--- a/meson
+++ b/meson
@@ -1 +1 @@
-Subproject commit 12f9f04ba0decfda425dbbf9a501084c153a2d18
+Subproject commit b25d94e7c77fda05a7fdfe8afe562cf9760d69da

Unrelated change...

Sorry for this change. I'll fix it later.


Otherwise (without the submodule change):
Reviewed-by: Philippe Mathieu-Daudé 

Thanks,

Phil.

[PATCH] MAINTAINERS: Change philmd's email address

[Philippe Mathieu-Daudé]

The phi...@redhat.com email address will stop working on
2022-01-01, change it to my personal email address.

Update .mailmap in case anyone wants to send me an email
because of some past commit I authored.

Signed-off-by: Philippe Mathieu-Daudé 
---
 .gitlab-ci.d/edk2/Dockerfile |  2 +-
 .mailmap |  1 +
 MAINTAINERS  | 18 +-
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/.gitlab-ci.d/edk2/Dockerfile b/.gitlab-ci.d/edk2/Dockerfile
index b4584d1cf64..13029310f6d 100644
--- a/.gitlab-ci.d/edk2/Dockerfile
+++ b/.gitlab-ci.d/edk2/Dockerfile
@@ -3,7 +3,7 @@
 #
 FROM ubuntu:16.04
 
-MAINTAINER Philippe Mathieu-Daudé 
+MAINTAINER Philippe Mathieu-Daudé 
 
 # Install packages required to build EDK2
 RUN apt update \
diff --git a/.mailmap b/.mailmap
index c45d1c53014..e7cdf2d02f3 100644
--- a/.mailmap
+++ b/.mailmap
@@ -63,6 +63,7 @@ Paul Burton  
 Paul Burton  
 Paul Burton  
 Paul Burton  
+Philippe Mathieu-Daudé  
 Stefan Brankovic  
 Yongbok Kim  
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 54565368054..c64c2be9bd5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1630,7 +1630,7 @@ F: pc-bios/bios-microvm.bin
 Machine core
 M: Eduardo Habkost 
 M: Marcel Apfelbaum 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 S: Supported
 F: cpu.c
 F: hw/core/cpu.c
@@ -1810,7 +1810,7 @@ F: docs/virtio-net-failover.rst
 T: git https://github.com/jasowang/qemu.git net
 
 Parallel NOR Flash devices
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 T: git https://gitlab.com/philmd/qemu.git pflash-next
 S: Maintained
 F: hw/block/pflash_cfi*.c
@@ -2226,7 +2226,7 @@ F: hw/isa/piix4.c
 F: include/hw/southbridge/piix.h
 
 Firmware configuration (fw_cfg)
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 R: Gerd Hoffmann 
 S: Supported
 F: docs/specs/fw_cfg.txt
@@ -2524,7 +2524,7 @@ F: scripts/coccinelle/errp-guard.cocci
 
 GDB stub
 M: Alex Bennée 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 S: Maintained
 F: gdbstub*
 F: include/exec/gdbstub.h
@@ -2535,7 +2535,7 @@ Memory API
 M: Paolo Bonzini 
 M: Peter Xu 
 M: David Hildenbrand 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 S: Supported
 F: include/exec/ioport.h
 F: include/exec/memop.h
@@ -3029,14 +3029,14 @@ F: include/hw/i2c/smbus_slave.h
 F: include/hw/i2c/smbus_eeprom.h
 
 Firmware schema specifications
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 R: Daniel P. Berrange 
 R: Kashyap Chamarthy 
 S: Maintained
 F: docs/interop/firmware.json
 
 EDK2 Firmware
-M: Philippe Mathieu-Daudé 
+M: Philippe Mathieu-Daudé 
 R: Gerd Hoffmann 
 S: Supported
 F: hw/i386/*ovmf*
@@ -3274,7 +3274,7 @@ F: block/null.c
 NVMe Block Driver
 M: Stefan Hajnoczi 
 R: Fam Zheng 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 L: qemu-bl...@nongnu.org
 S: Supported
 F: block/nvme*
@@ -3517,7 +3517,7 @@ F: tests/tcg/Makefile.include
 Integration Testing with the Avocado framework
 W: https://trello.com/b/6Qi1pxVn/avocado-qemu
 R: Cleber Rosa 
-R: Philippe Mathieu-Daudé 
+R: Philippe Mathieu-Daudé 
 R: Wainer dos Santos Moschetta 
 R: Beraldo Leal 
 S: Odd Fixes
-- 
2.33.1

Re: [PATCH v3 3/7] crypto include/crypto target/arm: move sm4_sbox to crypto

[Philippe Mathieu-Daudé]

Hi,

On 12/30/21 15:30, liweiwei wrote:
>- share it between target/arm and target/riscv

"Share sm4_sbox between ARM and RISCV targets."?

> 
> Signed-off-by: liweiwei 
> Signed-off-by: wangjunqiang 
> ---
>  crypto/meson.build |  1 +
>  crypto/sm4.c   | 48 ++
>  include/crypto/sm4.h   |  6 +
>  meson  |  2 +-
>  target/arm/crypto_helper.c | 36 +---
>  5 files changed, 57 insertions(+), 36 deletions(-)

> diff --git a/crypto/sm4.c b/crypto/sm4.c
> new file mode 100644
> index 00..1cdcb8a620
> --- /dev/null
> +++ b/crypto/sm4.c

> +uint8_t const sm4_sbox[] = {

Please explicit the [256] array size.

> diff --git a/meson b/meson
> index 12f9f04ba0..b25d94e7c7 16
> --- a/meson
> +++ b/meson
> @@ -1 +1 @@
> -Subproject commit 12f9f04ba0decfda425dbbf9a501084c153a2d18
> +Subproject commit b25d94e7c77fda05a7fdfe8afe562cf9760d69da

Unrelated change...

Otherwise (without the submodule change):
Reviewed-by: Philippe Mathieu-Daudé 

Thanks,

Phil.

[PATCH v3 4/7] target/riscv: rvk: add implementation of instructions for Zk*

[liweiwei]

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
---
 target/riscv/crypto_helper.c| 446 ++
 target/riscv/helper.h   |  43 +++
 target/riscv/insn32.decode  |  42 +++
 target/riscv/insn_trans/trans_rvk.c.inc | 467 
 target/riscv/meson.build|   1 +
 target/riscv/translate.c|   1 +
 6 files changed, 1000 insertions(+)
 create mode 100644 target/riscv/crypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvk.c.inc

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
new file mode 100644
index 00..344eea4287
--- /dev/null
+++ b/target/riscv/crypto_helper.c
@@ -0,0 +1,446 @@
+/*
+ * RISC-V Crypto Emulation Helpers for QEMU.
+ *
+ * Copyright (c) 2021 Ruibo Lu, luruibo2...@163.com
+ * Copyright (c) 2021 Zewen Ye, lust...@foxmail.com
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "exec/exec-all.h"
+#include "exec/helper-proto.h"
+#include "crypto/aes.h"
+#include "crypto/sm4.h"
+
+#define AES_XTIME(a) \
+((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
+
+#define AES_GFMUL(a, b) (( \
+(((b) & 0x1) ?  (a)   : 0) ^ \
+(((b) & 0x2) ? AES_XTIME(a)   : 0) ^ \
+(((b) & 0x4) ?   AES_XTIME(AES_XTIME(a))  : 0) ^ \
+(((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
+
+#define BY(X, I) ((X >> (8 * I)) & 0xFF)
+
+#define AES_SHIFROWS_LO(RS1, RS2) ( \
+(((RS1 >> 24) & 0xFF) << 56) | \
+(((RS2 >> 48) & 0xFF) << 48) | \
+(((RS2 >>  8) & 0xFF) << 40) | \
+(((RS1 >> 32) & 0xFF) << 32) | \
+(((RS2 >> 56) & 0xFF) << 24) | \
+(((RS2 >> 16) & 0xFF) << 16) | \
+(((RS1 >> 40) & 0xFF) <<  8) | \
+(((RS1 >>  0) & 0xFF) <<  0))
+
+#define AES_INVSHIFROWS_LO(RS1, RS2) ( \
+(((RS2 >> 24) & 0xFF) << 56) | \
+(((RS2 >> 48) & 0xFF) << 48) | \
+(((RS1 >>  8) & 0xFF) << 40) | \
+(((RS1 >> 32) & 0xFF) << 32) | \
+(((RS1 >> 56) & 0xFF) << 24) | \
+(((RS2 >> 16) & 0xFF) << 16) | \
+(((RS2 >> 40) & 0xFF) <<  8) | \
+(((RS1 >>  0) & 0xFF) <<  0))
+
+#define AES_MIXBYTE(COL, B0, B1, B2, B3) ( \
+  BY(COL, B3) ^ \
+  BY(COL, B2) ^ \
+AES_GFMUL(BY(COL, B1), 3) ^ \
+AES_GFMUL(BY(COL, B0), 2)   \
+)
+
+#define AES_MIXCOLUMN(COL) ( \
+AES_MIXBYTE(COL, 3, 0, 1, 2) << 24 | \
+AES_MIXBYTE(COL, 2, 3, 0, 1) << 16 | \
+AES_MIXBYTE(COL, 1, 2, 3, 0) <<  8 | \
+AES_MIXBYTE(COL, 0, 1, 2, 3) <<  0   \
+)
+
+#define AES_INVMIXBYTE(COL, B0, B1, B2, B3) ( \
+AES_GFMUL(BY(COL, B3), 0x9) ^ \
+AES_GFMUL(BY(COL, B2), 0xd) ^ \
+AES_GFMUL(BY(COL, B1), 0xb) ^ \
+AES_GFMUL(BY(COL, B0), 0xe)   \
+)
+
+#define AES_INVMIXCOLUMN(COL) ( \
+AES_INVMIXBYTE(COL, 3, 0, 1, 2) << 24 | \
+AES_INVMIXBYTE(COL, 2, 3, 0, 1) << 16 | \
+AES_INVMIXBYTE(COL, 1, 2, 3, 0) <<  8 | \
+AES_INVMIXBYTE(COL, 0, 1, 2, 3) <<  0   \
+)
+
+static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
+{
+uint32_t u;
+if (fwd) {
+u = (AES_GFMUL(x, 3) << 24) |
+  (x << 16) |
+  (x <<  8) |
+(AES_GFMUL(x, 2) <<  0);
+} else {
+u = (AES_GFMUL(x, 0xb) << 24) |
+(AES_GFMUL(x, 0xd) << 16) |
+(AES_GFMUL(x, 0x9) <<  8) |
+(AES_GFMUL(x, 0xe) <<  0);
+}
+return u;
+}
+
+#define XLEN (8 * sizeof(target_ulong))
+#define zext32(x) ((uint64_t)(uint32_t)(x))
+#define sext_xlen(x) (target_ulong)(int32_t)(x)
+
+static inline target_ulong aes32_operation(target_ulong bs, target_ulong rs1,
+   target_ulong rs2, bool enc,
+   bool mix)
+{
+uint8_t shamt = bs << 3;
+uint8_t si = rs2 >> shamt;
+uint8_t so;
+uint32_t mixed;
+if (enc) {
+so = AES_sbox[si];
+if (mix) {
+mixed = aes_mixcolumn_byte(so, true);
+} else {
+mixed = so;
+}
+
+} else {
+so = AES_isbox[si];
+if (mix) {
+mixed = aes_mixcolumn_byte(so, false);
+} else {
+mixed = so;
+}
+}
+mixed = (mixed << shamt) | (mixed >> (32 - shamt));
+target_ulong res = rs1 ^ mixed;
+return sext_xlen(res);
+}
+
+target_ulong HELPE

[PATCH v3 6/7] disas/riscv.c: rvk: add disas support for Zbk* and Zk* instructions

[liweiwei]

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
---
 disas/riscv.c | 171 +-
 1 file changed, 170 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index 793ad14c27..eb1d36d1e5 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -156,6 +156,8 @@ typedef enum {
 rv_codec_css_swsp,
 rv_codec_css_sdsp,
 rv_codec_css_sqsp,
+rv_codec_k_bs,
+rv_codec_k_rnum,
 } rv_codec;
 
 typedef enum {
@@ -521,6 +523,43 @@ typedef enum {
 rv_op_bclr = 359,
 rv_op_binv = 360,
 rv_op_bext = 361,
+rv_op_aes32esmi = 362,
+rv_op_aes32esi = 363,
+rv_op_aes32dsmi = 364,
+rv_op_aes32dsi = 365,
+rv_op_aes64ks1i = 366,
+rv_op_aes64ks2 = 367,
+rv_op_aes64im = 368,
+rv_op_aes64esm = 369,
+rv_op_aes64es = 370,
+rv_op_aes64dsm = 371,
+rv_op_aes64ds = 372,
+rv_op_sha256sig0 = 373,
+rv_op_sha256sig1 = 374,
+rv_op_sha256sum0 = 375,
+rv_op_sha256sum1 = 376,
+rv_op_sha512sig0 = 377,
+rv_op_sha512sig1 = 378,
+rv_op_sha512sum0 = 379,
+rv_op_sha512sum1 = 380,
+rv_op_sha512sum0r = 381,
+rv_op_sha512sum1r = 382,
+rv_op_sha512sig0l = 383,
+rv_op_sha512sig0h = 384,
+rv_op_sha512sig1l = 385,
+rv_op_sha512sig1h = 386,
+rv_op_sm3p0 = 387,
+rv_op_sm3p1 = 388,
+rv_op_sm4ed = 389,
+rv_op_sm4ks = 390,
+rv_op_brev8 = 391,
+rv_op_pack = 392,
+rv_op_packh = 393,
+rv_op_packw = 394,
+rv_op_unzip = 395,
+rv_op_zip = 396,
+rv_op_xperm4 = 397,
+rv_op_xperm8 = 398,
 } rv_op;
 
 /* structures */
@@ -540,6 +579,8 @@ typedef struct {
 uint8_t   succ;
 uint8_t   aq;
 uint8_t   rl;
+uint8_t   bs;
+uint8_t   rnum;
 } rv_decode;
 
 typedef struct {
@@ -615,6 +656,8 @@ static const char rv_freg_name_sym[32][5] = {
 #define rv_fmt_rd_rs2 "O\t0,2"
 #define rv_fmt_rs1_offset "O\t1,o"
 #define rv_fmt_rs2_offset "O\t2,o"
+#define rv_fmt_rs1_rs2_bs "O\t1,2,b"
+#define rv_fmt_rd_rs1_rnum"O\t0,1,n"
 
 /* pseudo-instruction constraints */
 
@@ -766,6 +809,7 @@ static const rv_comp_data rvcp_csrrw[] = {
 { rv_op_illegal, NULL }
 };
 
+
 static const rv_comp_data rvcp_csrrs[] = {
 { rv_op_rdcycle, rvcc_rdcycle },
 { rv_op_rdtime, rvcc_rdtime },
@@ -1203,10 +1247,46 @@ const rv_opcode_data opcode_data[] = {
 { "bclr", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 { "binv", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 { "bext", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "aes32esmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+{ "aes32esi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+{ "aes32dsmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+{ "aes32dsi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+{ "aes64ks1i", rv_codec_k_rnum,  rv_fmt_rd_rs1_rnum, NULL, 0, 0, 0 },
+{ "aes64ks2", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "aes64im", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+{ "aes64esm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "aes64es", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "aes64dsm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "aes64ds", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha256sig0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+{ "sha256sig1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+{ "sha256sum0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+{ "sha256sum1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+{ "sha512sig0", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sig1", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sum0", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sum1", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sum0r", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sum1r", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sig0l", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sig0h", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sig1l", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sha512sig1h", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "sm3p0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+{ "sm3p1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+{ "sm4ed", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+{ "sm4ks", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+{ "brev8", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+{ "pack", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "packh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "packw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "unzip", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+{ "zip", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+{ "xperm4", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+{ "xperm8", rv_c

[PATCH v3 2/7] target/riscv: rvk: add implementation of instructions for Zbk*

[liweiwei]

   - reuse partial instructions of Zbb/Zbc extensions
   - add brev8, packh, unzip, zip, etc.

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
---
 target/riscv/bitmanip_helper.c  |  74 ++
 target/riscv/helper.h   |   5 +
 target/riscv/insn32.decode  |  52 ++
 target/riscv/insn_trans/trans_rvb.c.inc | 127 +---
 target/riscv/translate.c|   7 ++
 5 files changed, 234 insertions(+), 31 deletions(-)

diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
index f1b5e5549f..dc3dcf685a 100644
--- a/target/riscv/bitmanip_helper.c
+++ b/target/riscv/bitmanip_helper.c
@@ -49,3 +49,77 @@ target_ulong HELPER(clmulr)(target_ulong rs1, target_ulong 
rs2)
 
 return result;
 }
+
+static inline target_ulong do_swap(target_ulong x, uint64_t mask, int shift)
+{
+return ((x & mask) << shift) | ((x & ~mask) >> shift);
+}
+
+target_ulong HELPER(brev8)(target_ulong rs1)
+{
+target_ulong x = rs1;
+x = do_swap(x, 0xull, 1);
+x = do_swap(x, 0xull, 2);
+x = do_swap(x, 0x0f0f0f0f0f0f0f0full, 4);
+return x;
+}
+
+static inline target_ulong do_xperm(target_ulong rs1, target_ulong rs2,
+uint32_t sz_log2)
+{
+target_ulong r = 0;
+target_ulong sz = 1LL << sz_log2;
+target_ulong mask = (1LL << sz) - 1;
+for (int i = 0; i < TARGET_LONG_BITS; i += sz) {
+target_ulong pos = ((rs2 >> i) & mask) << sz_log2;
+if (pos < sizeof(target_ulong) * 8) {
+r |= ((rs1 >> pos) & mask) << i;
+}
+}
+return r;
+}
+
+target_ulong HELPER(xperm4)(target_ulong rs1, target_ulong rs2)
+{
+return do_xperm(rs1, rs2, 2);
+}
+
+target_ulong HELPER(xperm8)(target_ulong rs1, target_ulong rs2)
+{
+return do_xperm(rs1, rs2, 3);
+}
+
+static const uint64_t shuf_masks[] = {
+dup_const(MO_8, 0x44),
+dup_const(MO_8, 0x30),
+dup_const(MO_16, 0x0f00),
+dup_const(MO_32, 0xff)
+};
+
+static inline target_ulong do_shuf_stage(target_ulong src, uint64_t maskL,
+ uint64_t maskR, int shift)
+{
+target_ulong x = src & ~(maskL | maskR);
+x |= ((src << shift) & maskL) | ((src >> shift) & maskR);
+return x;
+}
+
+target_ulong HELPER(unzip)(target_ulong rs1)
+{
+target_ulong x = rs1;
+x = do_shuf_stage(x, shuf_masks[0], shuf_masks[0] >> 1, 1);
+x = do_shuf_stage(x, shuf_masks[1], shuf_masks[1] >> 2, 2);
+x = do_shuf_stage(x, shuf_masks[2], shuf_masks[2] >> 4, 4);
+x = do_shuf_stage(x, shuf_masks[3], shuf_masks[3] >> 8, 8);
+return x;
+}
+
+target_ulong HELPER(zip)(target_ulong rs1)
+{
+target_ulong x = rs1;
+x = do_shuf_stage(x, shuf_masks[3], shuf_masks[3] >> 8, 8);
+x = do_shuf_stage(x, shuf_masks[2], shuf_masks[2] >> 4, 4);
+x = do_shuf_stage(x, shuf_masks[1], shuf_masks[1] >> 2, 2);
+x = do_shuf_stage(x, shuf_masks[0], shuf_masks[0] >> 1, 1);
+return x;
+}
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index c15497e4a1..5cf1b41e3d 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -66,6 +66,11 @@ DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 /* Bitmanip */
 DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
 DEF_HELPER_FLAGS_2(clmulr, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(xperm4, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(xperm8, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_1(brev8, TCG_CALL_NO_RWG_SE, tl, tl)
+DEF_HELPER_FLAGS_1(unzip, TCG_CALL_NO_RWG_SE, tl, tl)
+DEF_HELPER_FLAGS_1(zip, TCG_CALL_NO_RWG_SE, tl, tl)
 
 /* Floating Point - Half Precision */
 DEF_HELPER_FLAGS_3(fadd_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index 8617307b29..82bddbc934 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -692,8 +692,22 @@ sh2add_uw  001 .. 100 . 0111011 @r
 sh3add_uw  001 .. 110 . 0111011 @r
 slli_uw1  001 . 0011011 @sh
 
-# *** RV32 Zbb Standard Extension ***
+# *** RV32 Zbb/Zbkb Standard Extension ***
 andn   010 .. 111 . 0110011 @r
+rol011 .. 001 . 0110011 @r
+ror011 .. 101 . 0110011 @r
+rori   01100  101 . 0010011 @sh
+# The encoding for rev8 differs between RV32 and RV64.
+# rev8_32 denotes the RV32 variant.
+rev8_32011010 011000 . 101 . 0010011 @r2
+# The encoding for zext.h differs between RV32 and RV64.
+# zext_h_32 denotes the RV32 variant.
+{
+  zext_h_32  100 0 . 100 . 0110011 @r2
+  pack   100 . . 100 . 0110011 @r
+}
+xnor   010 .. 100 . 0110011 @r
+# *** RV32 extra Zbb Standard Extension ***
 clz011000 00 . 001 . 0010011 @r2
 cpop   011000 10 . 001 . 0010011 @r2
 ctz

[PATCH v3 3/7] crypto include/crypto target/arm: move sm4_sbox to crypto

[liweiwei]

   - share it between target/arm and target/riscv

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
---
 crypto/meson.build |  1 +
 crypto/sm4.c   | 48 ++
 include/crypto/sm4.h   |  6 +
 meson  |  2 +-
 target/arm/crypto_helper.c | 36 +---
 5 files changed, 57 insertions(+), 36 deletions(-)
 create mode 100644 crypto/sm4.c
 create mode 100644 include/crypto/sm4.h

diff --git a/crypto/meson.build b/crypto/meson.build
index 95a6a83504..f659fc9035 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -38,6 +38,7 @@ crypto_ss.add(when: 'CONFIG_SECRET_KEYRING', if_true: 
files('secret_keyring.c'))
 crypto_ss.add(when: 'CONFIG_AF_ALG', if_true: files('afalg.c', 
'cipher-afalg.c', 'hash-afalg.c'))
 crypto_ss.add(when: gnutls, if_true: files('tls-cipher-suites.c'))
 
+util_ss.add(files('sm4.c'))
 util_ss.add(files('aes.c'))
 util_ss.add(files('init.c'))
 if gnutls.found()
diff --git a/crypto/sm4.c b/crypto/sm4.c
new file mode 100644
index 00..1cdcb8a620
--- /dev/null
+++ b/crypto/sm4.c
@@ -0,0 +1,48 @@
+/*
+ * QEMU crypto sm4 support
+ *
+ * Copyright (C) 2013 - 2018 Linaro Ltd 
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ */
+#include "qemu/osdep.h"
+#include "crypto/sm4.h"
+
+uint8_t const sm4_sbox[] = {
+0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7,
+0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
+0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3,
+0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
+0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a,
+0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
+0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95,
+0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
+0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba,
+0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
+0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b,
+0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
+0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2,
+0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
+0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52,
+0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
+0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5,
+0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
+0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55,
+0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
+0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60,
+0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
+0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f,
+0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
+0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f,
+0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
+0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd,
+0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
+0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e,
+0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
+0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20,
+0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
+};
+
diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
new file mode 100644
index 00..9bd3ebc62e
--- /dev/null
+++ b/include/crypto/sm4.h
@@ -0,0 +1,6 @@
+#ifndef QEMU_SM4_H
+#define QEMU_SM4_H
+
+extern const uint8_t sm4_sbox[256];
+
+#endif
diff --git a/meson b/meson
index 12f9f04ba0..b25d94e7c7 16
--- a/meson
+++ b/meson
@@ -1 +1 @@
-Subproject commit 12f9f04ba0decfda425dbbf9a501084c153a2d18
+Subproject commit b25d94e7c77fda05a7fdfe8afe562cf9760d69da
diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
index 28a84c2dbd..390020672a 100644
--- a/target/arm/crypto_helper.c
+++ b/target/arm/crypto_helper.c
@@ -15,6 +15,7 @@
 #include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "crypto/aes.h"
+#include "crypto/sm4.h"
 #include "vec_internal.h"
 
 union CRYPTO_STATE {
@@ -694,41 +695,6 @@ DO_SM3TT(crypto_sm3tt2b, 3)
 
 #undef DO_SM3TT
 
-static uint8_t const sm4_sbox[] = {
-0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7,
-0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
-0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3,
-0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
-0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a,
-0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
-0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95,
-0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
-0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba,
-0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
-0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b,
-0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
-0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2,
-0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
-0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52

[PATCH v3 1/7] target/riscv: rvk: add cfg properties for zbk* and zk*

[liweiwei]

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
Acked-by: Alistair Francis 
---
 target/riscv/cpu.c | 23 +++
 target/riscv/cpu.h | 13 +
 2 files changed, 36 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6ef3314bce..961c5f4334 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -491,6 +491,29 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 cpu->cfg.ext_d = true;
 }
 
+if (cpu->cfg.ext_zk) {
+cpu->cfg.ext_zkn = true;
+cpu->cfg.ext_zkr = true;
+cpu->cfg.ext_zkt = true;
+}
+
+if (cpu->cfg.ext_zkn) {
+cpu->cfg.ext_zbkb = true;
+cpu->cfg.ext_zbkc = true;
+cpu->cfg.ext_zbkx = true;
+cpu->cfg.ext_zkne = true;
+cpu->cfg.ext_zknd = true;
+cpu->cfg.ext_zknh = true;
+}
+
+if (cpu->cfg.ext_zks) {
+cpu->cfg.ext_zbkb = true;
+cpu->cfg.ext_zbkc = true;
+cpu->cfg.ext_zbkx = true;
+cpu->cfg.ext_zksed = true;
+cpu->cfg.ext_zksh = true;
+}
+
 /* Set the ISA extensions, checks should have happened above */
 if (cpu->cfg.ext_i) {
 ext |= RVI;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index dc10f27093..edca7118ff 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -311,7 +311,20 @@ struct RISCVCPU {
 bool ext_zba;
 bool ext_zbb;
 bool ext_zbc;
+bool ext_zbkb;
+bool ext_zbkc;
+bool ext_zbkx;
 bool ext_zbs;
+bool ext_zk;
+bool ext_zkn;
+bool ext_zknd;
+bool ext_zkne;
+bool ext_zknh;
+bool ext_zkr;
+bool ext_zks;
+bool ext_zksed;
+bool ext_zksh;
+bool ext_zkt;
 bool ext_counters;
 bool ext_ifencei;
 bool ext_icsr;
-- 
2.17.1

[PATCH v3 7/7] target/riscv: rvk: expose zbk* and zk* properties

[liweiwei]

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
---
 target/riscv/cpu.c | 13 +
 1 file changed, 13 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 961c5f4334..6575ec8cfa 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -668,6 +668,19 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_BOOL("zbb", RISCVCPU, cfg.ext_zbb, true),
 DEFINE_PROP_BOOL("zbc", RISCVCPU, cfg.ext_zbc, true),
 DEFINE_PROP_BOOL("zbs", RISCVCPU, cfg.ext_zbs, true),
+DEFINE_PROP_BOOL("x-zbkb", RISCVCPU, cfg.ext_zbkb, false),
+DEFINE_PROP_BOOL("x-zbkc", RISCVCPU, cfg.ext_zbkc, false),
+DEFINE_PROP_BOOL("x-zbkx", RISCVCPU, cfg.ext_zbkx, false),
+DEFINE_PROP_BOOL("x-zk", RISCVCPU, cfg.ext_zk, false),
+DEFINE_PROP_BOOL("x-zkn", RISCVCPU, cfg.ext_zkn, false),
+DEFINE_PROP_BOOL("x-zknd", RISCVCPU, cfg.ext_zknd, false),
+DEFINE_PROP_BOOL("x-zkne", RISCVCPU, cfg.ext_zkne, false),
+DEFINE_PROP_BOOL("x-zknh", RISCVCPU, cfg.ext_zknh, false),
+DEFINE_PROP_BOOL("x-zkr", RISCVCPU, cfg.ext_zkr, false),
+DEFINE_PROP_BOOL("x-zks", RISCVCPU, cfg.ext_zks, false),
+DEFINE_PROP_BOOL("x-zksed", RISCVCPU, cfg.ext_zksed, false),
+DEFINE_PROP_BOOL("x-zksh", RISCVCPU, cfg.ext_zksh, false),
+DEFINE_PROP_BOOL("x-zkt", RISCVCPU, cfg.ext_zkt, false),
 DEFINE_PROP_BOOL("x-h", RISCVCPU, cfg.ext_h, false),
 DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
 /* ePMP 0.9.3 */
-- 
2.17.1

[PATCH v3 0/7] support subsets of scalar crypto extension

[liweiwei]

This patchset implements RISC-V K-extension v1.0.0.rc6 version instructions. 
Partial instructions are reused from B-extension.

Specification:
https://github.com/riscv/riscv-crypto

The port is available here:
https://github.com/plctlab/plct-qemu/tree/plct-k-upstream-v3

To test rvk implementation,  specify cpu argument with 'x-zks=true,x-zkn=true'  
or 
"x-zbkb=true,x-zbkc=true,x-zbkx=true,x-zknd=true,x-zkne=true,x-zknh=true,x-zksed=true,x-zksh=true,x-zkr=true"
 to enable  K-extension support.  This implementation can pass the ACT tests 
for K with our extended act support for qemu (available at 
https://github.com/plctlab/plct-qemu/tree/plct-k-upstream-v3-with-act)

v3:
* add extension check for SEED csr access

v2:
* optimize implementation for brev8, xperm, zip, unzip
* use aes related sbox array from crypto/aes.h
* move sm4_sbox to crypto/sm4.c, and share it with target/arm

liweiwei (7):
  target/riscv: rvk: add cfg properties for zbk* and zk*
  target/riscv: rvk: add implementation of instructions for Zbk*
  crypto include/crypto target/arm: move sm4_sbox to crypto
  target/riscv: rvk: add implementation of instructions for Zk*
  target/riscv: rvk: add CSR support for Zkr
  disas/riscv.c: rvk: add disas support for Zbk* and Zk* instructions
  target/riscv: rvk: expose zbk* and zk* properties

 crypto/meson.build  |   1 +
 crypto/sm4.c|  48 +++
 disas/riscv.c   | 171 -
 include/crypto/sm4.h|   6 +
 meson   |   2 +-
 target/arm/crypto_helper.c  |  36 +-
 target/riscv/bitmanip_helper.c  |  74 
 target/riscv/cpu.c  |  36 ++
 target/riscv/cpu.h  |  13 +
 target/riscv/cpu_bits.h |   9 +
 target/riscv/crypto_helper.c| 446 ++
 target/riscv/csr.c  |  73 
 target/riscv/helper.h   |  48 +++
 target/riscv/insn32.decode  |  94 -
 target/riscv/insn_trans/trans_rvb.c.inc | 127 ++-
 target/riscv/insn_trans/trans_rvk.c.inc | 467 
 target/riscv/meson.build|   1 +
 target/riscv/pmp.h  |   8 +-
 target/riscv/translate.c|   8 +
 19 files changed, 1597 insertions(+), 71 deletions(-)
 create mode 100644 crypto/sm4.c
 create mode 100644 include/crypto/sm4.h
 create mode 100644 target/riscv/crypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvk.c.inc

-- 
2.17.1

[PATCH v3 5/7] target/riscv: rvk: add CSR support for Zkr

[liweiwei]

   - add SEED CSR
   - add USEED, SSEED fields for MSECCFG CSR

Signed-off-by: liweiwei 
Signed-off-by: wangjunqiang 
---
 target/riscv/cpu_bits.h |  9 +
 target/riscv/csr.c  | 73 +
 target/riscv/pmp.h  |  8 +++--
 3 files changed, 87 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 1e31f4d35f..cf4a59dda0 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -374,6 +374,9 @@
 #define CSR_VSPMMASK0x2c1
 #define CSR_VSPMBASE0x2c2
 
+/* Crypto Extension */
+#define CSR_SEED   0x015
+
 /* mstatus CSR bits */
 #define MSTATUS_UIE 0x0001
 #define MSTATUS_SIE 0x0002
@@ -625,4 +628,10 @@ typedef enum RISCVException {
 #define UMTE_U_PM_INSN  U_PM_INSN
 #define UMTE_MASK (UMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | UMTE_U_PM_INSN)
 
+/* seed CSR bits */
+#define SEED_OPST(0b11 << 30)
+#define SEED_OPST_BIST   (0b00 << 30)
+#define SEED_OPST_WAIT   (0b01 << 30)
+#define SEED_OPST_ES16   (0b10 << 30)
+#define SEED_OPST_DEAD   (0b11 << 30)
 #endif
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 146447eac5..44f8afe616 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -22,6 +22,8 @@
 #include "cpu.h"
 #include "qemu/main-loop.h"
 #include "exec/exec-all.h"
+#include "qemu/guest-random.h"
+#include "qapi/error.h"
 
 /* CSR function table public API */
 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
@@ -222,6 +224,37 @@ static RISCVException epmp(CPURISCVState *env, int csrno)
 }
 #endif
 
+/* Predicates */
+static RISCVException seed(CPURISCVState *env, int csrno)
+{
+RISCVCPU *cpu = env_archcpu(env);
+if (!cpu->cfg.ext_zkr)
+return RISCV_EXCP_ILLEGAL_INST;
+#if !defined(CONFIG_USER_ONLY)
+if (riscv_has_ext(env, RVS) && riscv_has_ext(env, RVH)) {
+/* Hypervisor extension is supported */
+if (riscv_cpu_virt_enabled(env) && (env->priv != PRV_M)) {
+if (env->mseccfg & MSECCFG_SSEED) {
+return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+} else {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+}
+}
+if (env->priv == PRV_M) {
+return RISCV_EXCP_NONE;
+} else if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
+return RISCV_EXCP_NONE;
+} else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
+return RISCV_EXCP_NONE;
+} else {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+#else
+return RISCV_EXCP_NONE;
+#endif
+}
+
 /* User Floating-Point CSRs */
 static RISCVException read_fflags(CPURISCVState *env, int csrno,
   target_ulong *val)
@@ -1728,6 +1761,39 @@ static RISCVException write_upmbase(CPURISCVState *env, 
int csrno,
 
 #endif
 
+/* Crypto Extension */
+static int read_seed(CPURISCVState *env, int csrno, target_ulong *val)
+{
+*val = 0;
+uint32_t return_status =  SEED_OPST_ES16;
+*val = (*val) | return_status;
+if (return_status == SEED_OPST_ES16) {
+uint16_t random_number;
+Error *err = NULL;
+if (qemu_guest_getrandom(&random_number, sizeof(random_number),
+ &err) < 0) {
+qemu_log_mask(LOG_UNIMP, "Seed: Crypto failure: %s",
+  error_get_pretty(err));
+error_free(err);
+return -1;
+}
+*val = (*val) | random_number;
+} else if (return_status == SEED_OPST_BIST) {
+/* Do nothing */
+} else if (return_status == SEED_OPST_WAIT) {
+/* Do nothing */
+} else if (return_status == SEED_OPST_DEAD) {
+/* Do nothing */
+}
+return 0;
+}
+
+static RISCVException write_seed(CPURISCVState *env, int csrno,
+target_ulong val)
+{
+return RISCV_EXCP_NONE;
+}
+
 /*
  * riscv_csrrw - read and/or update control and status register
  *
@@ -1769,6 +1835,10 @@ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
+if (!write_mask && (csrno == CSR_SEED)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
 /* ensure the CSR extension is enabled. */
 if (!cpu->cfg.ext_icsr) {
 return RISCV_EXCP_ILLEGAL_INST;
@@ -1864,6 +1934,9 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 [CSR_TIME]  = { "time",  ctr,   read_time  },
 [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
 
+/* Crypto Extension */
+[CSR_SEED] = { "seed", seed, read_seed, write_seed},
+
 #if !defined(CONFIG_USER_ONLY)
 /* Machine Timers and Counters */
 [CSR_MCYCLE]= { "mcycle",any,   read_instret  },
diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index a9a0b363a7..83135849bb 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -37,9 +37,11 @@ typedef enum {
 } pmp_a

[PATCH v6 08/23] target/riscv: Allow AIA device emulation to set ireg rmw callback

[Anup Patel]

From: Anup Patel 

The AIA device emulation (such as AIA IMSIC) should be able to set
(or provide) AIA ireg read-modify-write callback for each privilege
level of a RISC-V HART.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
---
 target/riscv/cpu.h| 23 +++
 target/riscv/cpu_helper.c | 14 ++
 2 files changed, 37 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index d0c1725eaf..02f3ef2c3c 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -242,6 +242,22 @@ struct CPURISCVState {
 uint64_t (*rdtime_fn)(uint32_t);
 uint32_t rdtime_fn_arg;
 
+/* machine specific AIA ireg read-modify-write callback */
+#define AIA_MAKE_IREG(__isel, __priv, __virt, __vgein, __xlen) \
+__xlen) & 0xff) << 24) | \
+ (((__vgein) & 0x3f) << 20) | \
+ (((__virt) & 0x1) << 18) | \
+ (((__priv) & 0x3) << 16) | \
+ (__isel & 0x))
+#define AIA_IREG_ISEL(__ireg)  ((__ireg) & 0x)
+#define AIA_IREG_PRIV(__ireg)  (((__ireg) >> 16) & 0x3)
+#define AIA_IREG_VIRT(__ireg)  (((__ireg) >> 18) & 0x1)
+#define AIA_IREG_VGEIN(__ireg) (((__ireg) >> 20) & 0x3f)
+#define AIA_IREG_XLEN(__ireg)  (((__ireg) >> 24) & 0xff)
+int (*aia_ireg_rmw_fn[4])(void *arg, target_ulong reg,
+target_ulong *val, target_ulong new_val, target_ulong write_mask);
+void *aia_ireg_rmw_fn_arg[4];
+
 /* True if in debugger mode.  */
 bool debugger;
 
@@ -397,6 +413,13 @@ uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t 
mask, uint32_t value);
 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
 void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
  uint32_t arg);
+void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
+   int (*rmw_fn)(void *arg,
+ target_ulong reg,
+ target_ulong *val,
+ target_ulong new_val,
+ target_ulong write_mask),
+   void *rmw_fn_arg);
 #endif
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
 
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 43d6311e49..f94a36fa89 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -395,6 +395,20 @@ void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t 
(*fn)(uint32_t),
 env->rdtime_fn_arg = arg;
 }
 
+void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
+   int (*rmw_fn)(void *arg,
+ target_ulong reg,
+ target_ulong *val,
+ target_ulong new_val,
+ target_ulong write_mask),
+   void *rmw_fn_arg)
+{
+if (priv <= PRV_M) {
+env->aia_ireg_rmw_fn[priv] = rmw_fn;
+env->aia_ireg_rmw_fn_arg[priv] = rmw_fn_arg;
+}
+}
+
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
 {
 if (newpriv > PRV_M) {
-- 
2.25.1

[PATCH v6 23/23] hw/riscv: virt: Increase maximum number of allowed CPUs

[Anup Patel]

From: Anup Patel 

To facilitate software development of RISC-V systems with large number
of HARTs, we increase the maximum number of allowed CPUs to 512 (2^9).

We also add a detailed source level comments about limit defines which
impact the physical address space utilization.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
---
 hw/riscv/virt.c | 10 ++
 include/hw/riscv/virt.h |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 7579f7b41f..86b03736eb 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -44,6 +44,16 @@
 #include "hw/pci-host/gpex.h"
 #include "hw/display/ramfb.h"
 
+/*
+ * The virt machine physical address space used by some of the devices
+ * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
+ * number of CPUs, and number of IMSIC guest files.
+ *
+ * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
+ * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
+ * of virt machine physical address space.
+ */
+
 #define VIRT_IMSIC_GROUP_MAX_SIZE  (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
 #if VIRT_IMSIC_GROUP_MAX_SIZE < \
 IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index e12e8ddcae..62d8e9c6d0 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -24,7 +24,7 @@
 #include "hw/block/flash.h"
 #include "qom/object.h"
 
-#define VIRT_CPUS_MAX_BITS 3
+#define VIRT_CPUS_MAX_BITS 9
 #define VIRT_CPUS_MAX  (1 << VIRT_CPUS_MAX_BITS)
 #define VIRT_SOCKETS_MAX_BITS  2
 #define VIRT_SOCKETS_MAX   (1 << VIRT_SOCKETS_MAX_BITS)
-- 
2.25.1

[PATCH v6 20/23] hw/intc: Add RISC-V AIA IMSIC device emulation

[Anup Patel]

From: Anup Patel 

The RISC-V AIA (Advanced Interrupt Architecture) defines a new
interrupt controller for MSIs (message signal interrupts) called
IMSIC (Incoming Message Signal Interrupt Controller). The IMSIC
is per-HART device and also suppport virtualizaiton of MSIs using
dedicated VS-level guest interrupt files.

This patch adds device emulation for RISC-V AIA IMSIC which
supports M-level, S-level, and VS-level MSIs.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
---
 hw/intc/Kconfig   |   3 +
 hw/intc/meson.build   |   1 +
 hw/intc/riscv_imsic.c | 447 ++
 include/hw/intc/riscv_imsic.h |  68 ++
 4 files changed, 519 insertions(+)
 create mode 100644 hw/intc/riscv_imsic.c
 create mode 100644 include/hw/intc/riscv_imsic.h

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index 528e77b4a6..ec8d4cec29 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -73,6 +73,9 @@ config RISCV_ACLINT
 config RISCV_APLIC
 bool
 
+config RISCV_IMSIC
+bool
+
 config SIFIVE_PLIC
 bool
 
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 7466024402..5caa337654 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -51,6 +51,7 @@ specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: 
files('s390_flic_kvm.c'))
 specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
 specific_ss.add(when: 'CONFIG_RISCV_ACLINT', if_true: files('riscv_aclint.c'))
 specific_ss.add(when: 'CONFIG_RISCV_APLIC', if_true: files('riscv_aplic.c'))
+specific_ss.add(when: 'CONFIG_RISCV_IMSIC', if_true: files('riscv_imsic.c'))
 specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
 specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
 specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
new file mode 100644
index 00..753fa11a9c
--- /dev/null
+++ b/hw/intc/riscv_imsic.c
@@ -0,0 +1,447 @@
+/*
+ * RISC-V IMSIC (Incoming Message Signaled Interrupt Controller)
+ *
+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/error-report.h"
+#include "qemu/bswap.h"
+#include "exec/address-spaces.h"
+#include "hw/sysbus.h"
+#include "hw/pci/msi.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "hw/intc/riscv_imsic.h"
+#include "hw/irq.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/cpu_bits.h"
+#include "sysemu/sysemu.h"
+#include "migration/vmstate.h"
+
+#define IMSIC_MMIO_PAGE_LE 0x00
+#define IMSIC_MMIO_PAGE_BE 0x04
+
+#define IMSIC_MIN_ID   ((IMSIC_EIPx_BITS * 2) - 1)
+#define IMSIC_MAX_ID   (IMSIC_TOPEI_IID_MASK)
+
+#define IMSIC_EISTATE_PENDING  (1U << 0)
+#define IMSIC_EISTATE_ENABLED  (1U << 1)
+#define IMSIC_EISTATE_ENPEND   (IMSIC_EISTATE_ENABLED | \
+IMSIC_EISTATE_PENDING)
+
+static uint32_t riscv_imsic_topei(RISCVIMSICState *imsic, uint32_t page)
+{
+uint32_t i, max_irq, base;
+
+base = page * imsic->num_irqs;
+max_irq = (imsic->num_irqs < imsic->eithreshold[page]) ?
+  imsic->num_irqs : imsic->eithreshold[page];
+for (i = 1; i < max_irq; i++) {
+if ((imsic->eistate[base + i] & IMSIC_EISTATE_ENPEND) ==
+IMSIC_EISTATE_ENPEND) {
+return (i << IMSIC_TOPEI_IID_SHIFT) | i;
+}
+}
+
+return 0;
+}
+
+static void riscv_imsic_update(RISCVIMSICState *imsic, uint32_t page)
+{
+if (imsic->eidelivery[page] && riscv_imsic_topei(imsic, page)) {
+qemu_irq_raise(imsic->external_irqs[page]);
+} else {
+qemu_irq_lower(imsic->external_irqs[page]);
+}
+}
+
+static int riscv_imsic_eidelivery_rmw(RISCVIMSICState *imsic, uint32_t page,
+  target_ulong *val,
+  target_ulong new_val,
+  target_ulong wr_mask)
+{
+target_ulong old_val = imsic->eidelivery[page];
+
+if (val) {
+*val = old_val;
+}
+
+wr_mask &= 0x1;
+imsic->eidelivery[page] = (old_val & ~wr_mask) | (new_val & wr_mask);
+
+riscv_imsic_update(imsic, page);
+return 0;
+}
+
+stati

[PATCH v6 22/23] docs/system: riscv: Document AIA options for virt machine

[Anup Patel]

From: Anup Patel 

We have two new machine options "aia" and "aia-guests" available
for the RISC-V virt machine so let's document these options.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
---
 docs/system/riscv/virt.rst | 16 
 1 file changed, 16 insertions(+)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index fa016584bf..373645513a 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -63,6 +63,22 @@ The following machine-specific options are supported:
   When this option is "on", ACLINT devices will be emulated instead of
   SiFive CLINT. When not specified, this option is assumed to be "off".
 
+- aia=[none|aplic|aplic-imsic]
+
+  This option allows selecting interrupt controller defined by the AIA
+  (advanced interrupt architecture) specification. The "aia=aplic" selects
+  APLIC (advanced platform level interrupt controller) to handle wired
+  interrupts whereas the "aia=aplic-imsic" selects APLIC and IMSIC (incoming
+  message signaled interrupt controller) to handle both wired interrupts and
+  MSIs. When not specified, this option is assumed to be "none" which selects
+  SiFive PLIC to handle wired interrupts.
+
+- aia-guests=nnn
+
+  The number of per-HART VS-level AIA IMSIC pages to be emulated for a guest
+  having AIA IMSIC (i.e. "aia=aplic-imsic" selected). When not specified,
+  the default number of per-HART VS-level AIA IMSIC pages is 0.
+
 Running Linux kernel
 
 
-- 
2.25.1

[PATCH v6 21/23] hw/riscv: virt: Add optional AIA IMSIC support to virt machine

[Anup Patel]

From: Anup Patel 

We extend virt machine to emulate both AIA IMSIC and AIA APLIC
devices only when "aia=aplic-imsic" parameter is passed along
with machine name in the QEMU command-line. The AIA IMSIC is
only a per-HART MSI controller so we use AIA APLIC in MSI-mode
to forward all wired interrupts as MSIs to the AIA IMSIC.

We also provide "aia-guests=" parameter which can be used
to specify number of VS-level AIA IMSIC Guests MMIO pages for
each HART.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
---
 hw/riscv/Kconfig|   1 +
 hw/riscv/virt.c | 434 
 include/hw/riscv/virt.h |  18 +-
 3 files changed, 369 insertions(+), 84 deletions(-)

diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index c30bb7cb6c..91bb9d21c4 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -43,6 +43,7 @@ config RISCV_VIRT
 select SERIAL
 select RISCV_ACLINT
 select RISCV_APLIC
+select RISCV_IMSIC
 select SIFIVE_PLIC
 select SIFIVE_TEST
 select VIRTIO_MMIO
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 45d85d274f..7579f7b41f 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -34,6 +34,7 @@
 #include "hw/riscv/numa.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
+#include "hw/intc/riscv_imsic.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_test.h"
 #include "chardev/char.h"
@@ -43,6 +44,18 @@
 #include "hw/pci-host/gpex.h"
 #include "hw/display/ramfb.h"
 
+#define VIRT_IMSIC_GROUP_MAX_SIZE  (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
+#if VIRT_IMSIC_GROUP_MAX_SIZE < \
+IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
+#error "Can't accomodate single IMSIC group in address space"
+#endif
+
+#define VIRT_IMSIC_MAX_SIZE(VIRT_SOCKETS_MAX * \
+VIRT_IMSIC_GROUP_MAX_SIZE)
+#if 0x400 < VIRT_IMSIC_MAX_SIZE
+#error "Can't accomodate all IMSIC groups in address space"
+#endif
+
 static const MemMapEntry virt_memmap[] = {
 [VIRT_DEBUG] =   {0x0, 0x100 },
 [VIRT_MROM] ={ 0x1000,0xf000 },
@@ -58,6 +71,8 @@ static const MemMapEntry virt_memmap[] = {
 [VIRT_VIRTIO] =  { 0x10001000,0x1000 },
 [VIRT_FW_CFG] =  { 0x1010,  0x18 },
 [VIRT_FLASH] =   { 0x2000, 0x400 },
+[VIRT_IMSIC_M] = { 0x2400, VIRT_IMSIC_MAX_SIZE },
+[VIRT_IMSIC_S] = { 0x2800, VIRT_IMSIC_MAX_SIZE },
 [VIRT_PCIE_ECAM] =   { 0x3000,0x1000 },
 [VIRT_PCIE_MMIO] =   { 0x4000,0x4000 },
 [VIRT_DRAM] ={ 0x8000,   0x0 },
@@ -309,7 +324,7 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
 {
 int cpu;
 char *name;
-unsigned long addr;
+unsigned long addr, size;
 uint32_t aclint_cells_size;
 uint32_t *aclint_mswi_cells;
 uint32_t *aclint_sswi_cells;
@@ -330,29 +345,38 @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
 }
 aclint_cells_size = s->soc[socket].num_harts * sizeof(uint32_t) * 2;
 
-addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
-name = g_strdup_printf("/soc/mswi@%lx", addr);
-qemu_fdt_add_subnode(mc->fdt, name);
-qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-mswi");
-qemu_fdt_setprop_cells(mc->fdt, name, "reg",
-0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
-qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
-aclint_mswi_cells, aclint_cells_size);
-qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
-qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
-riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
-g_free(name);
+if (s->aia_type != VIRT_AIA_TYPE_APLIC_IMSIC) {
+addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
+name = g_strdup_printf("/soc/mswi@%lx", addr);
+qemu_fdt_add_subnode(mc->fdt, name);
+qemu_fdt_setprop_string(mc->fdt, name, "compatible",
+"riscv,aclint-mswi");
+qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
+qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
+aclint_mswi_cells, aclint_cells_size);
+qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
+qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
+riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
+g_free(name);
+}
 
-addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
-(memmap[VIRT_CLINT].size * socket);
+if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+addr = memmap[VIRT_CLINT].base +
+   (RISCV_ACLINT_DEFAULT_MTIMER_SIZE * socket);
+size = RISCV_ACLINT_DEFAULT_MTIMER_SIZE;
+} else {
+addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
+(memmap[VIRT_CLINT].size * 

[PATCH v6 16/23] hw/riscv: virt: Use AIA INTC compatible string when available

[Anup Patel]

From: Anup Patel 

We should use the AIA INTC compatible string in the CPU INTC
DT nodes when the CPUs support AIA feature. This will allow
Linux INTC driver to use AIA local interrupt CSRs.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
---
 hw/riscv/virt.c | 13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 3af074148e..720641b1dd 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -211,8 +211,17 @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int 
socket,
 qemu_fdt_add_subnode(mc->fdt, intc_name);
 qemu_fdt_setprop_cell(mc->fdt, intc_name, "phandle",
 intc_phandles[cpu]);
-qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
-"riscv,cpu-intc");
+if (riscv_feature(&s->soc[socket].harts[cpu].env,
+  RISCV_FEATURE_AIA)) {
+static const char * const compat[2] = {
+"riscv,cpu-intc-aia", "riscv,cpu-intc"
+};
+qemu_fdt_setprop_string_array(mc->fdt, intc_name, "compatible",
+  (char **)&compat, ARRAY_SIZE(compat));
+} else {
+qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
+"riscv,cpu-intc");
+}
 qemu_fdt_setprop(mc->fdt, intc_name, "interrupt-controller", NULL, 0);
 qemu_fdt_setprop_cell(mc->fdt, intc_name, "#interrupt-cells", 1);
 
-- 
2.25.1

[PATCH v6 17/23] target/riscv: Allow users to force enable AIA CSRs in HART

[Anup Patel]

From: Anup Patel 

We add "x-aia" command-line option for RISC-V HART using which
allows users to force enable CPU AIA CSRs without changing the
interrupt controller available in RISC-V machine.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
---
 target/riscv/cpu.c | 5 +
 target/riscv/cpu.h | 1 +
 2 files changed, 6 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 9ad26035e1..1ae9e15b27 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -463,6 +463,10 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 }
 }
 
+if (cpu->cfg.aia) {
+riscv_set_feature(env, RISCV_FEATURE_AIA);
+}
+
 set_resetvec(env, cpu->cfg.resetvec);
 
 /* Validate that MISA_MXL is set properly. */
@@ -691,6 +695,7 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
 /* ePMP 0.9.3 */
 DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
+DEFINE_PROP_BOOL("x-aia", RISCVCPU, cfg.aia, false),
 
 DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
 DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 82272f99fd..0b24c4324b 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -362,6 +362,7 @@ struct RISCVCPU {
 bool mmu;
 bool pmp;
 bool epmp;
+bool aia;
 uint64_t resetvec;
 } cfg;
 };
-- 
2.25.1

[PATCH v6 12/23] target/riscv: Implement AIA interrupt filtering CSRs

[Anup Patel]

From: Anup Patel 

The AIA specificaiton adds interrupt filtering support for M-mode
and HS-mode. Using AIA interrupt filtering M-mode and H-mode can
take local interrupt 13 or above and selectively inject same local
interrupt to lower privilege modes.

At the moment, we don't have any local interrupts above 12 so we
add dummy implementation (i.e. read zero and ignore write) of AIA
interrupt filtering CSRs.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
---
 target/riscv/csr.c | 23 +++
 1 file changed, 23 insertions(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index decb0376fc..55e747fbf7 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -154,6 +154,15 @@ static RISCVException any32(CPURISCVState *env, int csrno)
 
 }
 
+static int aia_any(CPURISCVState *env, int csrno)
+{
+if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+return any(env, csrno);
+}
+
 static int aia_any32(CPURISCVState *env, int csrno)
 {
 if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
@@ -553,6 +562,12 @@ static RISCVException read_zero(CPURISCVState *env, int 
csrno,
 return RISCV_EXCP_NONE;
 }
 
+static RISCVException write_ignore(CPURISCVState *env, int csrno,
+   target_ulong val)
+{
+return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
target_ulong *val)
 {
@@ -2374,9 +2389,15 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 [CSR_MTVAL]= { "mtval",any,  read_mtval,write_mtval},
 [CSR_MIP]  = { "mip",  any,  NULL,NULL, rmw_mip},
 
+/* Virtual Interrupts for Supervisor Level (AIA) */
+[CSR_MVIEN]  = { "mvien", aia_any, read_zero, write_ignore },
+[CSR_MVIP]   = { "mvip",  aia_any, read_zero, write_ignore },
+
 /* Machine-Level High-Half CSRs (AIA) */
 [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
 [CSR_MIEH] = { "mieh", aia_any32, NULL, NULL, rmw_mieh },
+[CSR_MVIENH]   = { "mvienh",   aia_any32, read_zero,  write_ignore },
+[CSR_MVIPH]= { "mviph",aia_any32, read_zero,  write_ignore },
 [CSR_MIPH] = { "miph", aia_any32, NULL, NULL, rmw_miph },
 
 /* Supervisor Trap Setup */
@@ -2428,12 +2449,14 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 [CSR_MTINST]  = { "mtinst",  hmode,   read_mtinst,  
write_mtinst  },
 
 /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
+[CSR_HVIEN]   = { "hvien",   aia_hmode, read_zero, write_ignore },
 [CSR_HVICTL]  = { "hvictl",  aia_hmode, read_hvictl, write_hvictl 
},
 [CSR_HVIPRIO1]= { "hviprio1",aia_hmode, read_hviprio1,   
write_hviprio1 },
 [CSR_HVIPRIO2]= { "hviprio2",aia_hmode, read_hviprio2,   
write_hviprio2 },
 
 /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
 [CSR_HIDELEGH]= { "hidelegh",aia_hmode32, NULL, NULL, rmw_hidelegh 
},
+[CSR_HVIENH]  = { "hvienh",  aia_hmode32, read_zero, write_ignore 
},
 [CSR_HVIPH]   = { "hviph",   aia_hmode32, NULL, NULL, rmw_hviph },
 [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h, 
write_hviprio1h },
 [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h, 
write_hviprio2h },
-- 
2.25.1

[PATCH v6 19/23] hw/riscv: virt: Add optional AIA APLIC support to virt machine

[Anup Patel]

From: Anup Patel 

We extend virt machine to emulate AIA APLIC devices only when
"aia=aplic" parameter is passed along with machine name in QEMU
command-line. When "aia=none" or not specified then we fallback
to original PLIC device emulation.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
---
 hw/riscv/Kconfig|   1 +
 hw/riscv/virt.c | 293 
 include/hw/riscv/virt.h |  26 +++-
 3 files changed, 260 insertions(+), 60 deletions(-)

diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index d2d869aaad..c30bb7cb6c 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -42,6 +42,7 @@ config RISCV_VIRT
 select PFLASH_CFI01
 select SERIAL
 select RISCV_ACLINT
+select RISCV_APLIC
 select SIFIVE_PLIC
 select SIFIVE_TEST
 select VIRTIO_MMIO
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 720641b1dd..45d85d274f 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -33,6 +33,7 @@
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
 #include "hw/intc/riscv_aclint.h"
+#include "hw/intc/riscv_aplic.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_test.h"
 #include "chardev/char.h"
@@ -51,6 +52,8 @@ static const MemMapEntry virt_memmap[] = {
 [VIRT_ACLINT_SSWI] = {  0x2F0,0x4000 },
 [VIRT_PCIE_PIO] ={  0x300,   0x1 },
 [VIRT_PLIC] ={  0xc00, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
+[VIRT_APLIC_M] = {  0xc00, APLIC_SIZE(VIRT_CPUS_MAX) },
+[VIRT_APLIC_S] = {  0xd00, APLIC_SIZE(VIRT_CPUS_MAX) },
 [VIRT_UART0] =   { 0x1000, 0x100 },
 [VIRT_VIRTIO] =  { 0x10001000,0x1000 },
 [VIRT_FW_CFG] =  { 0x1010,  0x18 },
@@ -132,12 +135,13 @@ static void virt_flash_map(RISCVVirtState *s,
 sysmem);
 }
 
-static void create_pcie_irq_map(void *fdt, char *nodename,
-uint32_t plic_phandle)
+static void create_pcie_irq_map(RISCVVirtState *s, void *fdt, char *nodename,
+uint32_t irqchip_phandle)
 {
 int pin, dev;
-uint32_t
-full_irq_map[GPEX_NUM_IRQS * GPEX_NUM_IRQS * FDT_INT_MAP_WIDTH] = {};
+uint32_t irq_map_stride = 0;
+uint32_t full_irq_map[GPEX_NUM_IRQS * GPEX_NUM_IRQS *
+  FDT_MAX_INT_MAP_WIDTH] = {};
 uint32_t *irq_map = full_irq_map;
 
 /* This code creates a standard swizzle of interrupts such that
@@ -155,23 +159,31 @@ static void create_pcie_irq_map(void *fdt, char *nodename,
 int irq_nr = PCIE_IRQ + ((pin + PCI_SLOT(devfn)) % GPEX_NUM_IRQS);
 int i = 0;
 
+/* Fill PCI address cells */
 irq_map[i] = cpu_to_be32(devfn << 8);
-
 i += FDT_PCI_ADDR_CELLS;
-irq_map[i] = cpu_to_be32(pin + 1);
 
+/* Fill PCI Interrupt cells */
+irq_map[i] = cpu_to_be32(pin + 1);
 i += FDT_PCI_INT_CELLS;
-irq_map[i++] = cpu_to_be32(plic_phandle);
 
-i += FDT_PLIC_ADDR_CELLS;
-irq_map[i] = cpu_to_be32(irq_nr);
-
-irq_map += FDT_INT_MAP_WIDTH;
+/* Fill interrupt controller phandle and cells */
+irq_map[i++] = cpu_to_be32(irqchip_phandle);
+irq_map[i++] = cpu_to_be32(irq_nr);
+if (s->aia_type != VIRT_AIA_TYPE_NONE) {
+irq_map[i++] = cpu_to_be32(0x4);
+}
+
+if (!irq_map_stride) {
+irq_map_stride = i;
+}
+irq_map += irq_map_stride;
 }
 }
 
-qemu_fdt_setprop(fdt, nodename, "interrupt-map",
- full_irq_map, sizeof(full_irq_map));
+qemu_fdt_setprop(fdt, nodename, "interrupt-map", full_irq_map,
+ GPEX_NUM_IRQS * GPEX_NUM_IRQS *
+ irq_map_stride * sizeof(uint32_t));
 
 qemu_fdt_setprop_cells(fdt, nodename, "interrupt-map-mask",
0x1800, 0, 0, 0x7);
@@ -394,8 +406,6 @@ static void create_fdt_socket_plic(RISCVVirtState *s,
 plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
 plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
 qemu_fdt_add_subnode(mc->fdt, plic_name);
-qemu_fdt_setprop_cell(mc->fdt, plic_name,
-"#address-cells", FDT_PLIC_ADDR_CELLS);
 qemu_fdt_setprop_cell(mc->fdt, plic_name,
 "#interrupt-cells", FDT_PLIC_INT_CELLS);
 qemu_fdt_setprop_string_array(mc->fdt, plic_name, "compatible",
@@ -415,6 +425,76 @@ static void create_fdt_socket_plic(RISCVVirtState *s,
 g_free(plic_cells);
 }
 
+static void create_fdt_socket_aia(RISCVVirtState *s,
+  const MemMapEntry *memmap, int socket,
+  uint32_t *phandle, uint32_t *intc_phandles,
+  uint32_t *aplic_phandles)
+{
+int cpu;
+char *aplic_name;
+uint32_t *aplic_cells;
+unsigned l

[PATCH v6 18/23] hw/intc: Add RISC-V AIA APLIC device emulation

[Anup Patel]

From: Anup Patel 

The RISC-V AIA (Advanced Interrupt Architecture) defines a new
interrupt controller for wired interrupts called APLIC (Advanced
Platform Level Interrupt Controller). The APLIC is capabable of
forwarding wired interupts to RISC-V HARTs directly or as MSIs
(Message Signaled Interupts).

This patch adds device emulation for RISC-V AIA APLIC.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
---
 hw/intc/Kconfig   |   3 +
 hw/intc/meson.build   |   1 +
 hw/intc/riscv_aplic.c | 970 ++
 include/hw/intc/riscv_aplic.h |  79 +++
 4 files changed, 1053 insertions(+)
 create mode 100644 hw/intc/riscv_aplic.c
 create mode 100644 include/hw/intc/riscv_aplic.h

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index 010ded7eae..528e77b4a6 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -70,6 +70,9 @@ config LOONGSON_LIOINTC
 config RISCV_ACLINT
 bool
 
+config RISCV_APLIC
+bool
+
 config SIFIVE_PLIC
 bool
 
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 70080bc161..7466024402 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -50,6 +50,7 @@ specific_ss.add(when: 'CONFIG_S390_FLIC', if_true: 
files('s390_flic.c'))
 specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: 
files('s390_flic_kvm.c'))
 specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
 specific_ss.add(when: 'CONFIG_RISCV_ACLINT', if_true: files('riscv_aclint.c'))
+specific_ss.add(when: 'CONFIG_RISCV_APLIC', if_true: files('riscv_aplic.c'))
 specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
 specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
 specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
new file mode 100644
index 00..f4b8828dac
--- /dev/null
+++ b/hw/intc/riscv_aplic.c
@@ -0,0 +1,970 @@
+/*
+ * RISC-V APLIC (Advanced Platform Level Interrupt Controller)
+ *
+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/error-report.h"
+#include "qemu/bswap.h"
+#include "exec/address-spaces.h"
+#include "hw/sysbus.h"
+#include "hw/pci/msi.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "hw/intc/riscv_aplic.h"
+#include "hw/irq.h"
+#include "target/riscv/cpu.h"
+#include "sysemu/sysemu.h"
+#include "migration/vmstate.h"
+
+#define APLIC_MAX_IDC  (1UL << 14)
+#define APLIC_MAX_SOURCE   1024
+#define APLIC_MIN_IPRIO_BITS   1
+#define APLIC_MAX_IPRIO_BITS   8
+#define APLIC_MAX_CHILDREN 1024
+
+#define APLIC_DOMAINCFG0x
+#define APLIC_DOMAINCFG_IE (1 << 8)
+#define APLIC_DOMAINCFG_DM (1 << 2)
+#define APLIC_DOMAINCFG_BE (1 << 0)
+
+#define APLIC_SOURCECFG_BASE   0x0004
+#define APLIC_SOURCECFG_D  (1 << 10)
+#define APLIC_SOURCECFG_CHILDIDX_MASK  0x03ff
+#define APLIC_SOURCECFG_SM_MASK0x0007
+#define APLIC_SOURCECFG_SM_INACTIVE0x0
+#define APLIC_SOURCECFG_SM_DETACH  0x1
+#define APLIC_SOURCECFG_SM_EDGE_RISE   0x4
+#define APLIC_SOURCECFG_SM_EDGE_FALL   0x5
+#define APLIC_SOURCECFG_SM_LEVEL_HIGH  0x6
+#define APLIC_SOURCECFG_SM_LEVEL_LOW   0x7
+
+#define APLIC_MMSICFGADDR  0x1bc0
+#define APLIC_MMSICFGADDRH 0x1bc4
+#define APLIC_SMSICFGADDR  0x1bc8
+#define APLIC_SMSICFGADDRH 0x1bcc
+
+#define APLIC_xMSICFGADDRH_L   (1UL << 31)
+#define APLIC_xMSICFGADDRH_HHXS_MASK   0x1f
+#define APLIC_xMSICFGADDRH_HHXS_SHIFT  24
+#define APLIC_xMSICFGADDRH_LHXS_MASK   0x7
+#define APLIC_xMSICFGADDRH_LHXS_SHIFT  20
+#define APLIC_xMSICFGADDRH_HHXW_MASK   0x7
+#define APLIC_xMSICFGADDRH_HHXW_SHIFT  16
+#define APLIC_xMSICFGADDRH_LHXW_MASK   0xf
+#define APLIC_xMSICFGADDRH_LHXW_SHIFT  12
+#define APLIC_xMSICFGADDRH_BAPPN_MASK  0xfff
+
+#define APLIC_xMSICFGADDR_PPN_SHIFT12
+
+#define APLIC_xMSICFGADDR_PPN_HART(__lhxs) \
+((1UL << (__lhxs)) - 1)
+
+#define APLIC_xMSICFGADDR_PPN_LHX_MASK(__lhxw) \
+((1UL << (__lhxw)) - 1)
+#define APLIC_xMSICFGADDR_PPN_LHX_SHIFT(__lhxs) \
+((__lhxs))
+#define APLIC_xMSICFGADDR_PPN_LHX(__lhxw, __lhxs) \
+(APLIC_xMSICFGADDR

[PATCH v6 10/23] target/riscv: Implement AIA CSRs for 64 local interrupts on RV32

[Anup Patel]

From: Anup Patel 

The AIA specification adds new CSRs for RV32 so that RISC-V hart can
support 64 local interrupts on both RV32 and RV64.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
---
 target/riscv/cpu.h|  14 +-
 target/riscv/cpu_helper.c |  10 +-
 target/riscv/csr.c| 560 +++---
 target/riscv/machine.c|  10 +-
 4 files changed, 474 insertions(+), 120 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 140fabfdf9..72d03aa126 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -162,12 +162,12 @@ struct CPURISCVState {
  */
 uint64_t mstatus;
 
-target_ulong mip;
+uint64_t mip;
 
-uint32_t miclaim;
+uint64_t miclaim;
 
-target_ulong mie;
-target_ulong mideleg;
+uint64_t mie;
+uint64_t mideleg;
 
 target_ulong satp;   /* since: priv-1.10.0 */
 target_ulong stval;
@@ -189,7 +189,7 @@ struct CPURISCVState {
 /* Hypervisor CSRs */
 target_ulong hstatus;
 target_ulong hedeleg;
-target_ulong hideleg;
+uint64_t hideleg;
 target_ulong hcounteren;
 target_ulong htval;
 target_ulong htinst;
@@ -420,8 +420,8 @@ void riscv_cpu_list(void);
 #ifndef CONFIG_USER_ONLY
 bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request);
 void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
-int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint32_t interrupts);
-uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value);
+int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
+uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value);
 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
 void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
  uint32_t arg);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index e3532de4cf..e97d51fbd0 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -534,7 +534,7 @@ bool riscv_cpu_two_stage_lookup(int mmu_idx)
 return mmu_idx & TB_FLAGS_PRIV_HYP_ACCESS_MASK;
 }
 
-int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint32_t interrupts)
+int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts)
 {
 CPURISCVState *env = &cpu->env;
 if (env->miclaim & interrupts) {
@@ -545,11 +545,11 @@ int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint32_t 
interrupts)
 }
 }
 
-uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value)
+uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
 {
 CPURISCVState *env = &cpu->env;
 CPUState *cs = CPU(cpu);
-uint32_t gein, vsgein = 0, old = env->mip;
+uint64_t gein, vsgein = 0, old = env->mip;
 bool locked = false;
 
 if (riscv_cpu_virt_enabled(env)) {
@@ -1252,7 +1252,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
  */
 bool async = !!(cs->exception_index & RISCV_EXCP_INT_FLAG);
 target_ulong cause = cs->exception_index & RISCV_EXCP_INT_MASK;
-target_ulong deleg = async ? env->mideleg : env->medeleg;
+uint64_t deleg = async ? env->mideleg : env->medeleg;
 bool write_tval = false;
 target_ulong tval = 0;
 target_ulong htval = 0;
@@ -1317,7 +1317,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
 cause < TARGET_LONG_BITS && ((deleg >> cause) & 1)) {
 /* handle the trap in S-mode */
 if (riscv_has_ext(env, RVH)) {
-target_ulong hdeleg = async ? env->hideleg : env->hedeleg;
+uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
 
 if (env->two_stage_lookup && write_tval) {
 /*
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 50424a8344..06db5ab1a8 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -154,6 +154,15 @@ static RISCVException any32(CPURISCVState *env, int csrno)
 
 }
 
+static int aia_any32(CPURISCVState *env, int csrno)
+{
+if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+return any32(env, csrno);
+}
+
 static RISCVException smode(CPURISCVState *env, int csrno)
 {
 if (riscv_has_ext(env, RVS)) {
@@ -163,6 +172,24 @@ static RISCVException smode(CPURISCVState *env, int csrno)
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
+static int smode32(CPURISCVState *env, int csrno)
+{
+if (riscv_cpu_mxl(env) != MXL_RV32) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+return smode(env, csrno);
+}
+
+static int aia_smode32(CPURISCVState *env, int csrno)
+{
+if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+return smode32(env, csrno);
+}
+
 static RISCVException hmode(CPURISCVState *env, int csrno)
 {
 if (riscv_has_ext(env, RVS) &&
@@ -203,6 +230,15 @@ static RISCVException pointer_masking(CPURISCVState *env, 
int csrno)
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
+static int aia

[PATCH v6 05/23] target/riscv: Allow setting CPU feature from machine/device emulation

[Anup Patel]

From: Anup Patel 

The machine or device emulation should be able to force set certain
CPU features because:
1) We can have certain CPU features which are in-general optional
   but implemented by RISC-V CPUs on the machine.
2) We can have devices which require a certain CPU feature. For example,
   AIA IMSIC devices expect AIA CSRs implemented by RISC-V CPUs.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Bin Meng 
Reviewed-by: Alistair Francis 
---
 target/riscv/cpu.c | 11 +++
 target/riscv/cpu.h |  5 +
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index f4dbc766c2..9f1a4d1088 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -124,11 +124,6 @@ static void set_vext_version(CPURISCVState *env, int 
vext_ver)
 env->vext_ver = vext_ver;
 }
 
-static void set_feature(CPURISCVState *env, int feature)
-{
-env->features |= (1ULL << feature);
-}
-
 static void set_resetvec(CPURISCVState *env, target_ulong resetvec)
 {
 #ifndef CONFIG_USER_ONLY
@@ -434,18 +429,18 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 }
 
 if (cpu->cfg.mmu) {
-set_feature(env, RISCV_FEATURE_MMU);
+riscv_set_feature(env, RISCV_FEATURE_MMU);
 }
 
 if (cpu->cfg.pmp) {
-set_feature(env, RISCV_FEATURE_PMP);
+riscv_set_feature(env, RISCV_FEATURE_PMP);
 
 /*
  * Enhanced PMP should only be available
  * on harts with PMP support
  */
 if (cpu->cfg.epmp) {
-set_feature(env, RISCV_FEATURE_EPMP);
+riscv_set_feature(env, RISCV_FEATURE_EPMP);
 }
 }
 
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 6895ac138c..1bdd03731f 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -344,6 +344,11 @@ static inline bool riscv_feature(CPURISCVState *env, int 
feature)
 return env->features & (1ULL << feature);
 }
 
+static inline void riscv_set_feature(CPURISCVState *env, int feature)
+{
+env->features |= (1ULL << feature);
+}
+
 #include "cpu_user.h"
 
 extern const char * const riscv_int_regnames[];
-- 
2.25.1

[PATCH v6 15/23] target/riscv: Implement AIA IMSIC interface CSRs

[Anup Patel]

From: Anup Patel 

The AIA specification defines IMSIC interface CSRs for easy access
to the per-HART IMSIC registers without using indirect xiselect and
xireg CSRs. This patch implements the AIA IMSIC interface CSRs.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
---
 target/riscv/csr.c | 202 +
 1 file changed, 202 insertions(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 488877e89c..89e74f848d 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -906,6 +906,16 @@ static int aia_xlate_vs_csrno(CPURISCVState *env, int 
csrno)
 return CSR_VSISELECT;
 case CSR_SIREG:
 return CSR_VSIREG;
+case CSR_SSETEIPNUM:
+return CSR_VSSETEIPNUM;
+case CSR_SCLREIPNUM:
+return CSR_VSCLREIPNUM;
+case CSR_SSETEIENUM:
+return CSR_VSSETEIENUM;
+case CSR_SCLREIENUM:
+return CSR_VSCLREIENUM;
+case CSR_STOPEI:
+return CSR_VSTOPEI;
 default:
 return csrno;
 };
@@ -1058,6 +1068,177 @@ done:
 return RISCV_EXCP_NONE;
 }
 
+static int rmw_xsetclreinum(CPURISCVState *env, int csrno, target_ulong *val,
+target_ulong new_val, target_ulong wr_mask)
+{
+int ret = -EINVAL;
+bool set, pend, virt;
+target_ulong priv, isel, vgein, xlen, nval, wmask;
+
+/* Translate CSR number for VS-mode */
+csrno = aia_xlate_vs_csrno(env, csrno);
+
+/* Decode register details from CSR number */
+virt = set = pend = false;
+switch (csrno) {
+case CSR_MSETEIPNUM:
+priv = PRV_M;
+set = true;
+break;
+case CSR_MCLREIPNUM:
+priv = PRV_M;
+pend = true;
+break;
+case CSR_MSETEIENUM:
+priv = PRV_M;
+set = true;
+break;
+case CSR_MCLREIENUM:
+priv = PRV_M;
+break;
+case CSR_SSETEIPNUM:
+priv = PRV_S;
+set = true;
+pend = true;
+break;
+case CSR_SCLREIPNUM:
+priv = PRV_S;
+pend = true;
+break;
+case CSR_SSETEIENUM:
+priv = PRV_S;
+set = true;
+break;
+case CSR_SCLREIENUM:
+priv = PRV_S;
+break;
+case CSR_VSSETEIPNUM:
+priv = PRV_S;
+virt = true;
+set = true;
+pend = true;
+break;
+case CSR_VSCLREIPNUM:
+priv = PRV_S;
+virt = true;
+pend = true;
+break;
+case CSR_VSSETEIENUM:
+priv = PRV_S;
+virt = true;
+set = true;
+break;
+case CSR_VSCLREIENUM:
+priv = PRV_S;
+virt = true;
+break;
+default:
+ goto done;
+};
+
+/* IMSIC CSRs only available when machine implements IMSIC. */
+if (!env->aia_ireg_rmw_fn[priv]) {
+goto done;
+}
+
+/* Find the selected guest interrupt file */
+vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
+
+/* Selected guest interrupt file should be valid */
+if (virt && (!vgein || env->geilen < vgein)) {
+goto done;
+}
+
+/* Set/Clear CSRs always read zero */
+if (val) {
+*val = 0;
+}
+
+if (wr_mask) {
+/* Get interrupt number */
+new_val &= wr_mask;
+
+/* Find target interrupt pending/enable register */
+xlen = riscv_cpu_mxl_bits(env);
+isel = (new_val / xlen);
+isel *= (xlen / IMSIC_EIPx_BITS);
+isel += (pend) ? ISELECT_IMSIC_EIP0 : ISELECT_IMSIC_EIE0;
+
+/* Find the interrupt bit to be set/clear */
+wmask = ((target_ulong)1) << (new_val % xlen);
+nval = (set) ? wmask : 0;
+
+/* Call machine specific IMSIC register emulation */
+ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
+ AIA_MAKE_IREG(isel, priv, virt,
+   vgein, xlen),
+ NULL, nval, wmask);
+} else {
+ret = 0;
+}
+
+done:
+if (ret) {
+return (riscv_cpu_virt_enabled(env) && virt) ?
+   RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+}
+return RISCV_EXCP_NONE;
+}
+
+static int rmw_xtopei(CPURISCVState *env, int csrno, target_ulong *val,
+  target_ulong new_val, target_ulong wr_mask)
+{
+bool virt;
+int ret = -EINVAL;
+target_ulong priv, vgein;
+
+/* Translate CSR number for VS-mode */
+csrno = aia_xlate_vs_csrno(env, csrno);
+
+/* Decode register details from CSR number */
+virt = false;
+switch (csrno) {
+case CSR_MTOPEI:
+priv = PRV_M;
+break;
+case CSR_STOPEI:
+priv = PRV_S;
+break;
+case CSR_VSTOPEI:
+priv = PRV_S;
+virt = true;
+break;
+default:
+goto done;
+};
+
+/* IMSIC CSRs only available when machine implements IMSIC. */
+if (!env->aia_ireg_rmw_fn[priv]) {
+   

[PATCH v6 14/23] target/riscv: Implement AIA xiselect and xireg CSRs

[Anup Patel]

From: Anup Patel 

The AIA specification defines [m|s|vs]iselect and [m|s|vs]ireg CSRs
which allow indirect access to interrupt priority arrays and per-HART
IMSIC registers. This patch implements AIA xiselect and xireg CSRs.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
---
 target/riscv/cpu.h |   7 ++
 target/riscv/csr.c | 175 +
 target/riscv/machine.c |   3 +
 3 files changed, 185 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 721727c577..82272f99fd 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -186,6 +186,10 @@ struct CPURISCVState {
 uint8_t miprio[64];
 uint8_t siprio[64];
 
+/* AIA CSRs */
+target_ulong miselect;
+target_ulong siselect;
+
 /* Hypervisor CSRs */
 target_ulong hstatus;
 target_ulong hedeleg;
@@ -215,6 +219,9 @@ struct CPURISCVState {
 target_ulong vstval;
 target_ulong vsatp;
 
+/* AIA VS-mode CSRs */
+target_ulong vsiselect;
+
 target_ulong mtval2;
 target_ulong mtinst;
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 5a27c3bfbb..488877e89c 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -895,6 +895,169 @@ static int read_mtopi(CPURISCVState *env, int csrno, 
target_ulong *val)
 return RISCV_EXCP_NONE;
 }
 
+static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
+{
+if (!riscv_cpu_virt_enabled(env)) {
+return csrno;
+}
+
+switch (csrno) {
+case CSR_SISELECT:
+return CSR_VSISELECT;
+case CSR_SIREG:
+return CSR_VSIREG;
+default:
+return csrno;
+};
+}
+
+static int rmw_xiselect(CPURISCVState *env, int csrno, target_ulong *val,
+target_ulong new_val, target_ulong wr_mask)
+{
+target_ulong *iselect;
+
+/* Translate CSR number for VS-mode */
+csrno = aia_xlate_vs_csrno(env, csrno);
+
+/* Find the iselect CSR based on CSR number */
+switch (csrno) {
+case CSR_MISELECT:
+iselect = &env->miselect;
+break;
+case CSR_SISELECT:
+iselect = &env->siselect;
+break;
+case CSR_VSISELECT:
+iselect = &env->vsiselect;
+break;
+default:
+ return RISCV_EXCP_ILLEGAL_INST;
+};
+
+if (val) {
+*val = *iselect;
+}
+
+wr_mask &= ISELECT_MASK;
+if (wr_mask) {
+*iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
+}
+
+return RISCV_EXCP_NONE;
+}
+
+static int rmw_iprio(target_ulong xlen,
+ target_ulong iselect, uint8_t *iprio,
+ target_ulong *val, target_ulong new_val,
+ target_ulong wr_mask, int ext_irq_no)
+{
+int i, firq, nirqs;
+target_ulong old_val;
+
+if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
+return -EINVAL;
+}
+if (xlen != 32 && iselect & 0x1) {
+return -EINVAL;
+}
+
+nirqs = 4 * (xlen / 32);
+firq = ((iselect - ISELECT_IPRIO0) / (xlen / 32)) * (nirqs);
+
+old_val = 0;
+for (i = 0; i < nirqs; i++) {
+old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
+}
+
+if (val) {
+*val = old_val;
+}
+
+if (wr_mask) {
+new_val = (old_val & ~wr_mask) | (new_val & wr_mask);
+for (i = 0; i < nirqs; i++) {
+/*
+ * M-level and S-level external IRQ priority always read-only
+ * zero. This means default priority order is always preferred
+ * for M-level and S-level external IRQs.
+ */
+if ((firq + i) == ext_irq_no) {
+continue;
+}
+iprio[firq + i] = (new_val >> (IPRIO_IRQ_BITS * i)) & 0xff;
+}
+}
+
+return 0;
+}
+
+static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
+ target_ulong new_val, target_ulong wr_mask)
+{
+bool virt;
+uint8_t *iprio;
+int ret = -EINVAL;
+target_ulong priv, isel, vgein;
+
+/* Translate CSR number for VS-mode */
+csrno = aia_xlate_vs_csrno(env, csrno);
+
+/* Decode register details from CSR number */
+virt = false;
+switch (csrno) {
+case CSR_MIREG:
+iprio = env->miprio;
+isel = env->miselect;
+priv = PRV_M;
+break;
+case CSR_SIREG:
+iprio = env->siprio;
+isel = env->siselect;
+priv = PRV_S;
+break;
+case CSR_VSIREG:
+iprio = env->hviprio;
+isel = env->vsiselect;
+priv = PRV_S;
+virt = true;
+break;
+default:
+ goto done;
+};
+
+/* Find the selected guest interrupt file */
+vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
+
+if (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) {
+/* Local interrupt priority registers not available for VS-mode */
+if (!virt) {
+ret = rmw_iprio(riscv_cpu_mxl_bits(env),
+ 

[PATCH v6 07/23] target/riscv: Add defines for AIA CSRs

[Anup Patel]

From: Anup Patel 

The RISC-V AIA specification extends RISC-V local interrupts and
introduces new CSRs. This patch adds defines for the new AIA CSRs.

Signed-off-by: Anup Patel 
Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
---
 target/riscv/cpu_bits.h | 127 
 1 file changed, 127 insertions(+)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index f32159a19d..841c289c5d 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -168,6 +168,31 @@
 #define CSR_MTVAL   0x343
 #define CSR_MIP 0x344
 
+/* Machine-Level Window to Indirectly Accessed Registers (AIA) */
+#define CSR_MISELECT0x350
+#define CSR_MIREG   0x351
+
+/* Machine-Level Interrupts (AIA) */
+#define CSR_MTOPI   0xfb0
+
+/* Machine-Level IMSIC Interface (AIA) */
+#define CSR_MSETEIPNUM  0x358
+#define CSR_MCLREIPNUM  0x359
+#define CSR_MSETEIENUM  0x35a
+#define CSR_MCLREIENUM  0x35b
+#define CSR_MTOPEI  0x35c
+
+/* Virtual Interrupts for Supervisor Level (AIA) */
+#define CSR_MVIEN   0x308
+#define CSR_MVIP0x309
+
+/* Machine-Level High-Half CSRs (AIA) */
+#define CSR_MIDELEGH0x313
+#define CSR_MIEH0x314
+#define CSR_MVIENH  0x318
+#define CSR_MVIPH   0x319
+#define CSR_MIPH0x354
+
 /* Supervisor Trap Setup */
 #define CSR_SSTATUS 0x100
 #define CSR_SEDELEG 0x102
@@ -187,6 +212,24 @@
 #define CSR_SPTBR   0x180
 #define CSR_SATP0x180
 
+/* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
+#define CSR_SISELECT0x150
+#define CSR_SIREG   0x151
+
+/* Supervisor-Level Interrupts (AIA) */
+#define CSR_STOPI   0xdb0
+
+/* Supervisor-Level IMSIC Interface (AIA) */
+#define CSR_SSETEIPNUM  0x158
+#define CSR_SCLREIPNUM  0x159
+#define CSR_SSETEIENUM  0x15a
+#define CSR_SCLREIENUM  0x15b
+#define CSR_STOPEI  0x15c
+
+/* Supervisor-Level High-Half CSRs (AIA) */
+#define CSR_SIEH0x114
+#define CSR_SIPH0x154
+
 /* Hpervisor CSRs */
 #define CSR_HSTATUS 0x600
 #define CSR_HEDELEG 0x602
@@ -217,6 +260,35 @@
 #define CSR_MTINST  0x34a
 #define CSR_MTVAL2  0x34b
 
+/* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
+#define CSR_HVIEN   0x608
+#define CSR_HVICTL  0x609
+#define CSR_HVIPRIO10x646
+#define CSR_HVIPRIO20x647
+
+/* VS-Level Window to Indirectly Accessed Registers (H-extension with AIA) */
+#define CSR_VSISELECT   0x250
+#define CSR_VSIREG  0x251
+
+/* VS-Level Interrupts (H-extension with AIA) */
+#define CSR_VSTOPI  0xeb0
+
+/* VS-Level IMSIC Interface (H-extension with AIA) */
+#define CSR_VSSETEIPNUM 0x258
+#define CSR_VSCLREIPNUM 0x259
+#define CSR_VSSETEIENUM 0x25a
+#define CSR_VSCLREIENUM 0x25b
+#define CSR_VSTOPEI 0x25c
+
+/* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
+#define CSR_HIDELEGH0x613
+#define CSR_HVIENH  0x618
+#define CSR_HVIPH   0x655
+#define CSR_HVIPRIO1H   0x656
+#define CSR_HVIPRIO2H   0x657
+#define CSR_VSIEH   0x214
+#define CSR_VSIPH   0x254
+
 /* Enhanced Physical Memory Protection (ePMP) */
 #define CSR_MSECCFG 0x747
 #define CSR_MSECCFGH0x757
@@ -629,4 +701,59 @@ typedef enum RISCVException {
 #define UMTE_U_PM_INSN  U_PM_INSN
 #define UMTE_MASK (UMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | UMTE_U_PM_INSN)
 
+/* MISELECT, SISELECT, and VSISELECT bits (AIA) */
+#define ISELECT_IPRIO0 0x30
+#define ISELECT_IPRIO150x3f
+#define ISELECT_IMSIC_EIDELIVERY   0x70
+#define ISELECT_IMSIC_EITHRESHOLD  0x72
+#define ISELECT_IMSIC_EIP0 0x80
+#define ISELECT_IMSIC_EIP630xbf
+#define ISELECT_IMSIC_EIE0 0xc0
+#define ISELECT_IMSIC_EIE630xff
+#define ISELECT_IMSIC_FIRSTISELECT_IMSIC_EIDELIVERY
+#define ISELECT_IMSIC_LAST ISELECT_IMSIC_EIE63
+#define ISELECT_MASK   0x1ff
+
+/* Dummy [M|S|VS]ISELECT value for emulating [M|S|VS]TOPEI CSRs */
+#define ISELECT_IMSIC_TOPEI(ISELECT_MASK + 1)
+
+/* IMSIC bits (AIA) */
+#define IMSIC_TOPEI_IID_SHIFT  16
+#define IMSIC_TOPEI_IID_MASK   0x7ff
+#define IMSIC_TOPEI_IPRIO_MASK 0x7ff
+#define IMSIC_EIPx_BITS32
+#define IMSIC_EIEx_BITS32
+
+/* MTOPI and STOPI bits (AIA) */
+#define TOPI_IID_SHIFT 16
+#define TOPI_IID_MASK  0xfff
+#define TOPI_IPRIO_MASK0xff
+
+/* Interrupt priority bits (AIA) */
+#define IPRIO_IRQ_BITS 8
+#define IPRIO_MMAXIPRIO255
+#define IPRIO_DEFAULT_MMAXIPRIO15
+