Re: [PULL 0/5] 9p queue 2022-12-23

[Peter Maydell]

On Fri, 23 Dec 2022 at 11:12, Christian Schoenebeck
 wrote:
>
> The following changes since commit 222059a0fccf4af3be776fe35a5ea2d6a68f9a0b:
>
>   Merge tag 'pull-ppc-20221221' of https://gitlab.com/danielhb/qemu into 
> staging (2022-12-21 18:08:09 +)
>
> are available in the Git repository at:
>
>   https://github.com/cschoenebeck/qemu.git tags/pull-9p-20221223
>
> for you to fetch changes up to 6ca60cd7a388a776d72739e5a404e65c19460511:
>
>   hw/9pfs: Replace the direct call to xxxat() APIs with a wrapper (2022-12-23 
> 11:48:13 +0100)
>
> 
> 9pfs: Windows host prep, cleanup
>
> * Next preparatory patches for upcoming Windows host support.
>
> * Cleanup patches.
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/8.0
for any user-visible changes.

-- PMM

Re: [PATCH] meson: allow disablind the installation of keymaps

[Carlos Santos]

On Wed, Jan 4, 2023 at 12:15 PM Philippe Mathieu-Daudé
 wrote:
>
> On 4/1/23 15:49, Carlos Santos wrote:
> > On Mon, Jan 2, 2023 at 1:19 PM  wrote:
> >>
> >> From: Carlos Santos 
> >>
> >> There are situatuions in which the keyboard maps are not necessary (e.g.
> >> when building only tools or linux-user emulator). Add an option to avoid
> >> installing them, as already possible to do with firmware blobs.
> >>
> >> Signed-off-by: Carlos Santos 
> >> ---
> >>   configure | 2 ++
> >>   meson_options.txt | 2 ++
> >>   pc-bios/keymaps/meson.build   | 6 --
> >>   scripts/meson-buildoptions.sh | 4 
> >>   4 files changed, 12 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/configure b/configure
> >> index 789a4f6cc9..c6ed6a23d0 100755
> >> --- a/configure
> >> +++ b/configure
> >> @@ -889,6 +889,8 @@ for opt do
> >> ;;
> >> --disable-blobs) meson_option_parse --disable-install-blobs ""
> >> ;;
> >> +  --disable-keymaps) meson_option_parse --disable-install-keymaps ""
> >> +  ;;
> >> --enable-vfio-user-server) vfio_user_server="enabled"
> >> ;;
> >> --disable-vfio-user-server) vfio_user_server="disabled"
> >> diff --git a/meson_options.txt b/meson_options.txt
> >> index 559a571b6b..be27137e98 100644
> >> --- a/meson_options.txt
> >> +++ b/meson_options.txt
> >> @@ -48,6 +48,8 @@ option('module_upgrades', type : 'boolean', value : 
> >> false,
> >>  description: 'try to load modules from alternate paths for 
> >> upgrades')
> >>   option('install_blobs', type : 'boolean', value : true,
> >>  description: 'install provided firmware blobs')
> >> +option('install_keymaps', type : 'boolean', value : true,
> >> +   description: 'install provided keyboard maps')
> >>   option('sparse', type : 'feature', value : 'auto',
> >>  description: 'sparse checker')
> >>   option('guest_agent', type : 'feature', value : 'auto',
> >> diff --git a/pc-bios/keymaps/meson.build b/pc-bios/keymaps/meson.build
> >> index 06c75e646b..7d80c23005 100644
> >> --- a/pc-bios/keymaps/meson.build
> >> +++ b/pc-bios/keymaps/meson.build
> >> @@ -47,7 +47,7 @@ if native_qemu_keymap.found()
> >>  build_by_default: true,
> >>  output: km,
> >>  command: [native_qemu_keymap, '-f', '@OUTPUT@', 
> >> args.split()],
> >> -   install: true,
> >> +   install: get_option('install_keymaps'),
> >>  install_dir: qemu_datadir / 'keymaps')
> >> endforeach
> >>
> >> @@ -56,4 +56,6 @@ else
> >> install_data(keymaps.keys(), install_dir: qemu_datadir / 'keymaps')
> >>   endif
> >>
> >> -install_data(['sl', 'sv'], install_dir: qemu_datadir / 'keymaps')
> >> +if get_option('install_keymaps')
> >> +  install_data(['sl', 'sv'], install_dir: qemu_datadir / 'keymaps')
> >> +endif
> >> diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
> >> index aa6e30ea91..f17d9c196e 100644
> >> --- a/scripts/meson-buildoptions.sh
> >> +++ b/scripts/meson-buildoptions.sh
> >> @@ -11,6 +11,8 @@ meson_options_help() {
> >> printf "%s\n" '  --datadir=VALUE  Data file directory [share]'
> >> printf "%s\n" '  --disable-coroutine-pool coroutine freelist (better 
> >> performance)'
> >> printf "%s\n" '  --disable-install-blobs  install provided firmware 
> >> blobs'
> >> +  printf "%s\n" '  --disable-install-keymaps'
> >> +  printf "%s\n" '   install provided keyboard 
> >> maps'
> >> printf "%s\n" '  --docdir=VALUE   Base directory for 
> >> documentation installation'
> >> printf "%s\n" '   (can be empty) [share/doc]'
> >> printf "%s\n" '  --enable-block-drv-whitelist-in-tools'
> >> @@ -291,6 +293,8 @@ _meson_option_parse() {
> >>   --includedir=*) quote_sh "-Dincludedir=$2" ;;
> >>   --enable-install-blobs) printf "%s" -Dinstall_blobs=true ;;
> >>   --disable-install-blobs) printf "%s" -Dinstall_blobs=false ;;
> >> +--enable-install-keymaps) printf "%s" -Dinstall_keymaps=true ;;
> >> +--disable-install-keymaps) printf "%s" -Dinstall_keymaps=false ;;
> >>   --interp-prefix=*) quote_sh "-Dinterp_prefix=$2" ;;
> >>   --enable-jack) printf "%s" -Djack=enabled ;;
> >>   --disable-jack) printf "%s" -Djack=disabled ;;
> >> --
> >> 2.31.1
> >>
> >
> > Thinking a bit more about this patch, I think the correct approach
> > would be to install blobs and keymaps depending on have_system:
> >
> >  [...]
> >  install: have_system,
> >  [...]
> >
> > And use the same approach for trace-events-all, in trace/meson.build:
> >
> >  [...]
> >  install: have_linux_user or have_bsd_user or have_system,
> >  [...]
> >
> > This would prevent installing useless data.
>
> Yes, similar to:
> https://lore.kernel.org/qemu-devel/20210323155132.238193-1-f4...@amsat.org/
>

Apparently it was reviewed and ack-ed but never ap

Re: [PATCH 0/6] Resolve TYPE_PIIX3_XEN_DEVICE

[Chuck Zmudzinski]

On 1/4/23 11:12 AM, Bernhard Beschow wrote:
> 
> 
> Am 4. Januar 2023 13:11:16 UTC schrieb Chuck Zmudzinski :
>>On 1/4/2023 7:13 AM, Bernhard Beschow wrote:
>>> Am 4. Januar 2023 08:18:59 UTC schrieb Chuck Zmudzinski :
>>> >On 1/3/2023 8:38 AM, Bernhard Beschow wrote:
>>> >>
>>> >>
>>> >> On Tue, Jan 3, 2023 at 2:17 PM Philippe Mathieu-Daudé 
>>> >>  wrote:
>>> >>
>>> >> Hi Chuck,
>>> >>
>>> >> On 3/1/23 04:15, Chuck Zmudzinski wrote:
>>> >> > On 1/2/23 4:34 PM, Bernhard Beschow wrote:
>>> >> >> This series first renders TYPE_PIIX3_XEN_DEVICE redundant and 
>>> >> finally removes
>>> >> >> it. The motivation is to 1/ decouple PIIX from Xen and 2/ to make 
>>> >> Xen in the PC
>>> >> >> machine agnostic to the precise southbridge being used. 2/ will 
>>> >> become
>>> >> >> particularily interesting once PIIX4 becomes usable in the PC 
>>> >> machine, avoiding
>>> >> >> the "Frankenstein" use of PIIX4_ACPI in PIIX3.
>>> >> >>
>>> >> >> Testing done:
>>> >> >> None, because I don't know how to conduct this properly :(
>>> >> >>
>>> >> >> Based-on: <20221221170003.2929-1-shen...@gmail.com>
>>> >> >>            "[PATCH v4 00/30] Consolidate PIIX south bridges"
>>> >>
>>> >> This series is based on a previous series:
>>> >> 
>>> >> https://lore.kernel.org/qemu-devel/20221221170003.2929-1-shen...@gmail.com/
>>> >> (which itself also is).
>>> >>
>>> >> >> Bernhard Beschow (6):
>>> >> >>    include/hw/xen/xen: Make xen_piix3_set_irq() generic and 
>>> >> rename it
>>> >> >>    hw/isa/piix: Reuse piix3_realize() in piix3_xen_realize()
>>> >> >>    hw/isa/piix: Wire up Xen PCI IRQ handling outside of PIIX3
>>> >> >>    hw/isa/piix: Avoid Xen-specific variant of piix_write_config()
>>> >> >>    hw/isa/piix: Resolve redundant k->config_write assignments
>>> >> >>    hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE
>>> >> >>
>>> >> >>   hw/i386/pc_piix.c             | 34 --
>>> >> >>   hw/i386/xen/xen-hvm.c         |  9 +++--
>>> >> >>   hw/isa/piix.c                 | 66 
>>> >> +--
>>> >> >
>>> >> > This file does not exist on the Qemu master branch.
>>> >> > But hw/isa/piix3.c and hw/isa/piix4.c do exist.
>>> >> >
>>> >> > I tried renaming it from piix.c to piix3.c in the patch, but
>>> >> > the patch set still does not apply cleanly on my tree.
>>> >> >
>>> >> > Is this patch set re-based against something other than
>>> >> > the current master Qemu branch?
>>> >> >
>>> >> > I have a system that is suitable for testing this patch set, but
>>> >> > I need guidance on how to apply it to the Qemu source tree.
>>> >>
>>> >> You can ask Bernhard to publish a branch with the full work,
>>> >>
>>> >>
>>> >> Hi Chuck,
>>> >>
>>> >> ... or just visit 
>>> >> https://patchew.org/QEMU/20230102213504.14646-1-shen...@gmail.com/ . 
>>> >> There you'll find a git tag with a complete history and all instructions!
>>> >>
>>> >> Thanks for giving my series a test ride!
>>> >>
>>> >> Best regards,
>>> >> Bernhard
>>> >>
>>> >> or apply each series locally. I use the b4 tool for that:
>>> >> https://b4.docs.kernel.org/en/latest/installing.html
>>> >>
>>> >> i.e.:
>>> >>
>>> >> $ git checkout -b shentey_work
>>> >> $ b4 am 20221120150550.63059-1-shen...@gmail.com
>>> >> $ git am
>>> >> 
>>> >> ./v2_20221120_shentey_decouple_intx_to_lnkx_routing_from_south_bridges.mbx
>>> >> $ b4 am 20221221170003.2929-1-shen...@gmail.com
>>> >> $ git am
>>> >> 
>>> >> ./v4_20221221_shentey_this_series_consolidates_the_implementations_of_the_piix3_and_piix4_south.mbx
>>> >> $ b4 am 20230102213504.14646-1-shen...@gmail.com
>>> >> $ git am ./20230102_shentey_resolve_type_piix3_xen_device.mbx
>>> >>
>>> >> Now the branch 'shentey_work' contains all the patches and you can 
>>> >> test.
>>> >>
>>> >> Regards,
>>> >>
>>> >> Phil.
>>> >>
>>> >
>>> >Hi Phil and Bernard,
>>> >
>>> >I tried applying these 3 patch series on top of the current qemu
>>> >master branch.
>>> >
>>> >Unfortunately, I saw a regression, so I can't give a tested-by tag yet.
>>>
>>> Hi Chuck,
>>>
>>> Thanks for your valuable test report! I think the culprit may be commit 
>>> https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg00102.html 
>>> where now 128 PIRQs are considered rather than four. I'll revisit my series 
>>> and will prepare a v2 in the next days. I think there is no need for 
>>> further testing v1.
>>>
>>> Thanks,
>>> Bernhard
>>
>>Hi Bernhard,
>>
>>Thanks for letting me know I do not need to test v1 further. I agree the
>>symptoms are that it is an IRQ problem - it looks like IRQs associated with
>>the emulated usb tablet device are not making it to the guest with the
>>patched v1 piix device on xen.
> 
> All PCI IRQs were routed to PCI slot 0. This should be fixed in v2 now.
> 
>>I will be loo

Re: [PATCH v4 12/30] hw/core: Introduce proxy-pic

[Mark Cave-Ayland]

On 04/01/2023 16:35, Philippe Mathieu-Daudé wrote:


On 4/1/23 17:01, Bernhard Beschow wrote:

Am 4. Januar 2023 14:37:29 UTC schrieb "Philippe Mathieu-Daudé" 
:

On 21/12/22 17:59, Bernhard Beschow wrote:

Having a proxy PIC allows for ISA PICs to be created and wired up in
southbridges. This is especially useful for PIIX3 for two reasons:
First, the southbridge doesn't need to care about the virtualization
technology used (KVM, TCG, Xen) due to in-IRQs (where devices get
attached) and out-IRQs (which will trigger the IRQs of the respective
virtzalization technology) are separated. Second, since the in-IRQs are


Typo "virtualization".


populated with fully initialized qemu_irq's, they can already be wired
up inside PIIX3.

Signed-off-by: Bernhard Beschow 
Reviewed-by: Michael S. Tsirkin 
Message-Id: <20221022150508.26830-15-shen...@gmail.com>
---
   MAINTAINERS |  2 ++
   hw/core/Kconfig |  3 ++
   hw/core/meson.build |  1 +
   hw/core/proxy-pic.c | 70 +
   include/hw/core/proxy-pic.h | 54 
   5 files changed, 130 insertions(+)
   create mode 100644 hw/core/proxy-pic.c
   create mode 100644 include/hw/core/proxy-pic.h


Please enable scripts/git.orderfile.


Will do.


diff --git a/include/hw/core/proxy-pic.h b/include/hw/core/proxy-pic.h
new file mode 100644
index 00..0eb40c478a
--- /dev/null
+++ b/include/hw/core/proxy-pic.h
@@ -0,0 +1,54 @@
+/*
+ * Proxy interrupt controller device.
+ *
+ * Copyright (c) 2022 Bernhard Beschow 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.


This is the MIT license right? Do you mind adding a SPDX tag along?


I based my implementation on TYPE_SPLIT_IRQ as you suggested before and thus 
preserved the license.



* SPDX-License-Identifier: MIT


Or just replace the wall of text with this line? This should suffice, no?


IIUC (IANAL) I can only suggest you to add a SPDX tag to the license you
chose, not ask you to remove the text; but since you ask/propose, the
tag suffices indeed. I suggest the tag use because it is clearer than
trying to match the full (often copy/pasted with typos) license text.


+ */
+
+#ifndef HW_PROXY_PIC_H
+#define HW_PROXY_PIC_H
+
+#include "hw/qdev-core.h"
+#include "qom/object.h"
+#include "hw/irq.h"
+
+#define TYPE_PROXY_PIC "proxy-pic"
+OBJECT_DECLARE_SIMPLE_TYPE(ProxyPICState, PROXY_PIC)
+
+#define MAX_PROXY_PIC_LINES 16
+
+/**
+ * This is a simple device which has 16 pairs of GPIO input and output lines.
+ * Any change on an input line is forwarded to the respective output.
+ *
+ * QEMU interface:
+ *  + 16 unnamed GPIO inputs: the input lines
+ *  + 16 unnamed GPIO outputs: the output lines
+ */


Why restrict to 16 and not use a class property and allocate
on the heap? See TYPE_SPLIT_IRQ for example.


TYPE_SPLIT_IRQ doesn't allocate on the heap and instead has a hardcoded limit of 
MAX_SPLIT_LINES which equals 16 ;)


I was unsure on when to free the memory and how to dispose the elements so I went 
with this solution for simplicity. I'll look for inspitation in other device models 
and respin.


Oh indeed. Well this model as is is OK, but it could be more useful
if able to proxy any range of IRQs.

I have the feeling we are cycling around this IRQ proxy:

22ec3283ef ("irq: introduce qemu_irq_proxy()")
078778c5a5 ("piix4: Add an i8259 Interrupt Controller as specified in 
datasheet")
fc531e7cab ("Revert "irq: introduce qemu_irq_proxy()"")

What is our problem? IRQ lines connect 2 devices in a fixed direction.
Current model expects one edge to be wired to a device before wiring
the other device, so device composition with IRQs in middle is
impossible? If so, this doesn't scale with dynamic machine creation.

Maybe the IRQ wiring should be another machine phase, after all
devices are instantiated?

Your approach is to create the 'IRQ proxy' first, like drawing the
wires on a board, then plug th

ARM: ptw.c:S1_ptw_translate

[Sid Manning]

ptw.c:S1_ptw_translate

After migrating to v7.2.0, an issue was found where we were not getting the 
correct virtual address from a load insn.  Reading the address used in the load 
insn from the debugger resulted in the execution of the insn getting the 
correct value but simply stepping over the insn did not.

This is the instruction:
ldr   x0, [x1, #24]

The debug path varies based on the regime and if regime is NOT stage two 
out_phys is set to addr if the regime is stage 2 then out_phys is set to 
s2.f.phys_addr.  In the non-debug path out_phys is always set to 
full->phys_addr.

I got around this by only using full->phys_addr if regime_is_stage2 was true:

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 3745ac9723..87bc6754a6 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -266,7 +266,12 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate 
*ptw,
 if (unlikely(flags & TLB_INVALID_MASK)) {
 goto fail;
 }
-ptw->out_phys = full->phys_addr;
+
+if (regime_is_stage2(s2_mmu_idx)) {
+ptw->out_phys = full->phys_addr;
+} else {
+ptw->out_phys = addr;
+}
 ptw->out_rw = full->prot & PAGE_WRITE;
 pte_attrs = full->pte_attrs;
 pte_secure = full->attrs.secure;

This change got me the answer I wanted but I'm not familiar enough with the 
code to know if this is correct or not.

Re: [PATCH v3 1/6] migration: Allow immutable device state to be migrated early (i.e., before RAM)

[Peter Xu]

On Thu, Dec 22, 2022 at 12:02:10PM +0100, David Hildenbrand wrote:
> Migrating device state before we start iterating is currently impossible.
> Introduce and use qemu_savevm_state_start_precopy(), and use
> a new special migration priority -- MIG_PRI_POST_SETUP -- to decide whether
> state will be saved in qemu_savevm_state_start_precopy() or in
> qemu_savevm_state_complete_precopy_*().

Can something like this be done in qemu_savevm_state_setup()?

Thanks,

-- 
Peter Xu

Re: [PATCH v2 1/4] target/m68k: pass quotient directly into make_quotient()

[Richard Henderson]

On 1/4/23 05:45, Mark Cave-Ayland wrote:

Signed-off-by: Mark Cave-Ayland
Reviewed-by: Laurent Vivier
---
  target/m68k/fpu_helper.c | 20 +++-
  1 file changed, 11 insertions(+), 9 deletions(-)


Reviewed-by: Richard Henderson 

r~

Re: [PATCH v2 2/4] target/m68k: pass sign directly into make_quotient()

[Richard Henderson]

On 1/4/23 05:45, Mark Cave-Ayland wrote:

This enables the quotient parameter to be changed from int32_t to uint32_t and
also allows the extra sign logic in make_quotient() to be removed.

Signed-off-by: Mark Cave-Ayland
---
  target/m68k/fpu_helper.c | 23 +--
  1 file changed, 13 insertions(+), 10 deletions(-)


Reviewed-by: Richard Henderson 

r~

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Chuck Zmudzinski]

On 1/4/23 10:35 AM, Philippe Mathieu-Daudé wrote:
> +Markus/Thomas
> 
> On 4/1/23 15:44, Bernhard Beschow wrote:
>> During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
>> TYPE_PIIX3_DEVICE. Remove this redundancy.
>> 
>> Signed-off-by: Bernhard Beschow 
>> ---
>>   hw/i386/pc_piix.c |  4 +---
>>   hw/isa/piix.c | 20 
>>   include/hw/southbridge/piix.h |  1 -
>>   3 files changed, 1 insertion(+), 24 deletions(-)
>> 
>> diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
>> index 5738d9cdca..6b8de3d59d 100644
>> --- a/hw/i386/pc_piix.c
>> +++ b/hw/i386/pc_piix.c
>> @@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
>>   if (pcmc->pci_enabled) {
>>   DeviceState *dev;
>>   PCIDevice *pci_dev;
>> -const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
>> - : TYPE_PIIX3_DEVICE;
>>   int i;
>>   
>>   pci_bus = i440fx_init(pci_type,
>> @@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
>>  : pci_slot_get_pirq);
>>   pcms->bus = pci_bus;
>>   
>> -pci_dev = pci_new_multifunction(-1, true, type);
>> +pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
>>   object_property_set_bool(OBJECT(pci_dev), "has-usb",
>>machine_usb(machine), &error_abort);
>>   object_property_set_bool(OBJECT(pci_dev), "has-acpi",
>> diff --git a/hw/isa/piix.c b/hw/isa/piix.c
>> index 98e9b12661..e4587352c9 100644
>> --- a/hw/isa/piix.c
>> +++ b/hw/isa/piix.c
>> @@ -33,7 +33,6 @@
>>   #include "hw/qdev-properties.h"
>>   #include "hw/ide/piix.h"
>>   #include "hw/isa/isa.h"
>> -#include "hw/xen/xen.h"
>>   #include "sysemu/runstate.h"
>>   #include "migration/vmstate.h"
>>   #include "hw/acpi/acpi_aml_interface.h"
>> @@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
>>   .class_init= piix3_class_init,
>>   };
>>   
>> -static void piix3_xen_class_init(ObjectClass *klass, void *data)
>> -{
>> -DeviceClass *dc = DEVICE_CLASS(klass);
>> -PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>> -
>> -k->realize = piix3_realize;
>> -/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
>> -k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
>> -dc->vmsd = &vmstate_piix3;
> 
> IIUC, since this device is user-creatable, we can't simply remove it
> without going thru the deprecation process. Alternatively we could
> add a type alias:
> 
> -- >8 --
> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
> index 4b0ef65780..d94f7ea369 100644
> --- a/softmmu/qdev-monitor.c
> +++ b/softmmu/qdev-monitor.c
> @@ -64,6 +64,7 @@ typedef struct QDevAlias
> QEMU_ARCH_LOONGARCH)
>   #define QEMU_ARCH_VIRTIO_CCW (QEMU_ARCH_S390X)
>   #define QEMU_ARCH_VIRTIO_MMIO (QEMU_ARCH_M68K)
> +#define QEMU_ARCH_XEN (QEMU_ARCH_ARM | QEMU_ARCH_I386)
> 
>   /* Please keep this table sorted by typename. */
>   static const QDevAlias qdev_alias_table[] = {
> @@ -111,6 +112,7 @@ static const QDevAlias qdev_alias_table[] = {
>   { "virtio-tablet-device", "virtio-tablet", QEMU_ARCH_VIRTIO_MMIO },
>   { "virtio-tablet-ccw", "virtio-tablet", QEMU_ARCH_VIRTIO_CCW },
>   { "virtio-tablet-pci", "virtio-tablet", QEMU_ARCH_VIRTIO_PCI },
> +{ "PIIX3", "PIIX3-xen", QEMU_ARCH_XEN },

Hi Bernhard,

Can you comment if this should be:

+{ "PIIX", "PIIX3-xen", QEMU_ARCH_XEN },

instead? IIUC, the patch series also removed PIIX3 and PIIX4 and
replaced them with PIIX. Or am I not understanding correctly?

Best regards,

Chuck


>   { }
>   };
> ---
> 
> But I'm not sure due to this comment from commit ee46d8a503
> (2011-12-22 15:24:20 -0600):
> 
> 47) /*
> 48)  * Aliases were a bad idea from the start.  Let's keep them
> 49)  * from spreading further.
> 50)  */
> 
> Maybe using qdev_alias_table[] during device deprecation is
> acceptable?
> 
>> -}
>> -
>> -static const TypeInfo piix3_xen_info = {
>> -.name  = TYPE_PIIX3_XEN_DEVICE,
>> -.parent= TYPE_PIIX_PCI_DEVICE,
>> -.instance_init = piix3_init,
>> -.class_init= piix3_xen_class_init,
>> -};
>> -
>>   static void piix4_realize(PCIDevice *dev, Error **errp)
>>   {
>>   ERRP_GUARD();
>> @@ -534,7 +515,6 @@ static void piix3_register_types(void)
>>   {
>>   type_register_static(&piix_pci_type_info);
>>   type_register_static(&piix3_info);
>> -type_register_static(&piix3_xen_info);
>>   type_register_static(&piix4_info);
>>   }
>>   
>> diff --git a/include/hw/southbridge/piix.h b/include/hw/southbridge/piix.h
>> index 65ad8569da..b1fc94a742 100644
>> --- a/include/hw/southbridge/piix.h
>> +++ b/include/hw/southbridge/piix.h
>> @@ -77,7 +77,6 @@ struct PIIXState {
>>   OBJECT_DECLARE_SIMPLE_TYPE(PIIXState, PIIX_PCI_DEVICE)
>>   
>>   #define TYPE_PIIX3_DEVICE "PIIX3"
>> -#define TYPE_PIIX3_XEN_DEVICE "PIIX3-xen"
>>

Re: [PATCH v2 3/4] target/m68k: fix FPSR quotient byte for fmod instruction

[Richard Henderson]

On 1/4/23 05:45, Mark Cave-Ayland wrote:

The FPSR quotient byte should be set to the value of the quotient and not the
result. Switch from using floatx80_mod() to floatx80_modrem() which returns
the quotient as a uint64_t which can be used for the quotient byte.

Signed-off-by: Mark Cave-Ayland
Reviewed-by: Laurent Vivier
---
  target/m68k/fpu_helper.c | 9 -
  1 file changed, 4 insertions(+), 5 deletions(-)


Reviewed-by: Richard Henderson 

r~

Re: [PATCH v2 4/4] target/m68k: fix FPSR quotient byte for frem instruction

[Richard Henderson]

On 1/4/23 05:45, Mark Cave-Ayland wrote:

The FPSR quotient byte should be set to the value of the quotient and not the
result. Manually calculate the quotient in the frem helper in round to nearest
even mode (note this is different from the quotient calculated internally for
fmod), and use it to set the quotient byte accordingly.

Signed-off-by: Mark Cave-Ayland 
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1314
Reviewed-by: Laurent Vivier 
---
  target/m68k/fpu_helper.c | 14 +++---
  1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index 5fd094a33c..56f7400140 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -538,17 +538,25 @@ void HELPER(fmod)(CPUM68KState *env, FPReg *res, FPReg 
*val0, FPReg *val1)
  
  void HELPER(frem)(CPUM68KState *env, FPReg *res, FPReg *val0, FPReg *val1)

  {
+float_status fp_status;
+FPReg fp_quot;
  uint32_t quotient;
  int sign;
  
+/* Calculate quotient directly using round to nearest mode */

+set_float_rounding_mode(float_round_nearest_even, &fp_status);
+set_floatx80_rounding_precision(
+get_floatx80_rounding_precision(&env->fp_status), &fp_status);
+fp_quot.d = floatx80_div(val1->d, val0->d, &fp_status);
+
  res->d = floatx80_rem(val1->d, val0->d, &env->fp_status);
  
-if (floatx80_is_any_nan(res->d)) {

+if (floatx80_is_any_nan(fp_quot.d)) {


I think you should leave this line unchanged, and move the div afterward.
I also think you should completely initialize the local fp_status = { }.

With that,
Reviewed-by: Richard Henderson 

r~

Re: [PATCH v2 5/8] hw/cxl/events: Wire up get/clear event mailbox commands

[Jonathan Cameron via]

On Wed, 21 Dec 2022 20:24:35 -0800
Ira Weiny  wrote:

> CXL testing is benefited from an artificial event log injection
> mechanism.
> 
> Add an event log infrastructure to insert, get, and clear events from
> the various logs available on a device.
> 
> Replace the stubbed out CXL Get/Clear Event mailbox commands with
> commands that operate on the new infrastructure.
> 
> Signed-off-by: Ira Weiny 

Hi Ira,

The ability to see the ret_code definitions relied on a patch that will
go upstream long after this one. I've dragged that down before this in
my tree, but the naming ret_code is neither compliant with QEMU naming
rules, nor specific enough given that definition is in a header.
Hence I'll also rename it as CXLRetCode.

I'll have a new tree up with that in place in a few days.
I'll carry your patches on that tree, with appropriate changes.

Jonathan

Re: [PATCH 0/4] Qemu SEV reduced-phys-bits fixes

[Tom Lendacky]

On 9/30/22 10:14, Tom Lendacky wrote:

This patch series fixes up and tries to remove some confusion around the
SEV reduced-phys-bits parameter.

Based on the "AMD64 Architecture Programmer's Manual Volume 2: System
Programming", section "15.34.6 Page Table Support" [1], a guest should
only ever see a maximum of 1 bit of physical address space reduction.

- Update the documentation, to change the default value from 5 to 1.
- Update the validation of the parameter to ensure the parameter value
   is within the range of the CPUID field that it is reported in. To allow
   for backwards compatibility, especially to support the previously
   documented value of 5, allow the full range of values from 1 to 63
   (0 was never allowed).
- Update the setting of CPUID 0x801F_EBX to limit the values to the
   field width that they are setting as an additional safeguard.

[1] https://www.amd.com/system/files/TechDocs/24593.pdf


Ping, any concerns with this series?

Thanks,
Tom



Tom Lendacky (4):
   qapi, i386/sev: Change the reduced-phys-bits value from 5 to 1
   qemu-options.hx: Update the reduced-phys-bits documentation
   i386/sev: Update checks and information related to reduced-phys-bits
   i386/cpu: Update how the EBX register of CPUID 0x801F is set

  qapi/misc-target.json |  2 +-
  qemu-options.hx   |  4 ++--
  target/i386/cpu.c |  4 ++--
  target/i386/sev.c | 17 ++---
  4 files changed, 19 insertions(+), 8 deletions(-)

Re: [PATCH 0/6] hw/mips/gt64xxx_pci: Fix endianness swap on big-endian hosts

[Richard Henderson]

On 1/4/23 05:39, Philippe Mathieu-Daudé wrote:

Philippe Mathieu-Daudé (6):
   hw/pci/pci_host: Trace config accesses on unexisting functions
   hw/mips/malta: Split FPGA LEDs/ASCII display updates
   hw/mips/malta: Trace FPGA LEDs/ASCII display updates
   hw/mips/gt64xxx_pci: Accumulate address space changes
   hw/mips/gt64xxx_pci: Endian-swap using PCI_HOST_BRIDGE MemoryRegionOps
   tests/avocado: Add tests booting YAMON ROM on MIPS Malta machines


Reviewed-by: Richard Henderson 

r~

Re: ARM: ptw.c:S1_ptw_translate

[Philippe Mathieu-Daudé]

Cc'ing Richard & qemu-arm list.

On 4/1/23 17:55, Sid Manning wrote:

ptw.c:S1_ptw_translate

After migrating to v7.2.0, an issue was found where we were not getting 
the correct virtual address from a load insn.  Reading the address used 
in the load insn from the debugger resulted in the execution of the insn 
getting the correct value but simply stepping over the insn did not.


This is the instruction:

ldr   x0, [x1, #24]

The debug path varies based on the regime and if regime is NOT stage two 
out_phys is set to addr if the regime is stage 2 then out_phys is set to 
s2.f.phys_addr.  In the non-debug path out_phys is always set to 
full->phys_addr.


I got around this by only using full->phys_addr if regime_is_stage2 was 
true:


diff --git a/target/arm/ptw.c b/target/arm/ptw.c

index 3745ac9723..87bc6754a6 100644

--- a/target/arm/ptw.c

+++ b/target/arm/ptw.c

@@ -266,7 +266,12 @@ static bool S1_ptw_translate(CPUARMState *env, 
S1Translate *ptw,


  if (unlikely(flags & TLB_INVALID_MASK)) {

  goto fail;

  }

-    ptw->out_phys = full->phys_addr;

+

+    if (regime_is_stage2(s2_mmu_idx)) {

+    ptw->out_phys = full->phys_addr;

+    } else {

+    ptw->out_phys = addr;

+    }

  ptw->out_rw = full->prot & PAGE_WRITE;

  pte_attrs = full->pte_attrs;

  pte_secure = full->attrs.secure;

This change got me the answer I wanted but I’m not familiar enough with 
the code to know if this is correct or not.

Re: [PATCH v4] tests/qtest: netdev: test stream and dgram backends

[Thomas Huth]

On 03/01/2023 12.00, Laurent Vivier wrote:

Signed-off-by: Laurent Vivier 
Acked-by: Michael S. Tsirkin 
---

Notes:
 v4:
   - rework EXPECT_STATE()
   - use g_dir_make_tmp()
 
 v3:

 - Add "-M none" to avoid error:
   "No machine specified, and there is no default"
 
 v2:

 - Fix ipv6 free port allocation
 - Check for IPv4, IPv6, AF_UNIX
 - Use g_mkdtemp() rather than g_file_open_tmp()
 - Use socketpair() in test_stream_fd()
 
 v1: compared to v14 of "qapi: net: add unix socket type support to netdev backend":

 - use IP addresses 127.0.0.1 and ::1 rather than localhost

  tests/qtest/meson.build |   2 +
  tests/qtest/netdev-socket.c | 434 
  2 files changed, 436 insertions(+)
  create mode 100644 tests/qtest/netdev-socket.c


FYI, the test also does not work on FreeBSD. It hangs on both, FreeBSD 12 
and 13:


 https://cirrus-ci.com/task/5024964768694272?logs=build#L6937

 https://cirrus-ci.com/task/5379344567107584?logs=build#L6938

  Thomas

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Philippe Mathieu-Daudé]

On 4/1/23 18:54, Chuck Zmudzinski wrote:

On 1/4/23 10:35 AM, Philippe Mathieu-Daudé wrote:

+Markus/Thomas

On 4/1/23 15:44, Bernhard Beschow wrote:

During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
TYPE_PIIX3_DEVICE. Remove this redundancy.

Signed-off-by: Bernhard Beschow 
---
   hw/i386/pc_piix.c |  4 +---
   hw/isa/piix.c | 20 
   include/hw/southbridge/piix.h |  1 -
   3 files changed, 1 insertion(+), 24 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 5738d9cdca..6b8de3d59d 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
   if (pcmc->pci_enabled) {
   DeviceState *dev;
   PCIDevice *pci_dev;
-const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
- : TYPE_PIIX3_DEVICE;
   int i;
   
   pci_bus = i440fx_init(pci_type,

@@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
  : pci_slot_get_pirq);
   pcms->bus = pci_bus;
   
-pci_dev = pci_new_multifunction(-1, true, type);

+pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
   object_property_set_bool(OBJECT(pci_dev), "has-usb",
machine_usb(machine), &error_abort);
   object_property_set_bool(OBJECT(pci_dev), "has-acpi",
diff --git a/hw/isa/piix.c b/hw/isa/piix.c
index 98e9b12661..e4587352c9 100644
--- a/hw/isa/piix.c
+++ b/hw/isa/piix.c
@@ -33,7 +33,6 @@
   #include "hw/qdev-properties.h"
   #include "hw/ide/piix.h"
   #include "hw/isa/isa.h"
-#include "hw/xen/xen.h"
   #include "sysemu/runstate.h"
   #include "migration/vmstate.h"
   #include "hw/acpi/acpi_aml_interface.h"
@@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
   .class_init= piix3_class_init,
   };
   
-static void piix3_xen_class_init(ObjectClass *klass, void *data)

-{
-DeviceClass *dc = DEVICE_CLASS(klass);
-PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
-
-k->realize = piix3_realize;
-/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
-k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
-dc->vmsd = &vmstate_piix3;


IIUC, since this device is user-creatable, we can't simply remove it
without going thru the deprecation process. Alternatively we could
add a type alias:

-- >8 --
diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
index 4b0ef65780..d94f7ea369 100644
--- a/softmmu/qdev-monitor.c
+++ b/softmmu/qdev-monitor.c
@@ -64,6 +64,7 @@ typedef struct QDevAlias
 QEMU_ARCH_LOONGARCH)
   #define QEMU_ARCH_VIRTIO_CCW (QEMU_ARCH_S390X)
   #define QEMU_ARCH_VIRTIO_MMIO (QEMU_ARCH_M68K)
+#define QEMU_ARCH_XEN (QEMU_ARCH_ARM | QEMU_ARCH_I386)

   /* Please keep this table sorted by typename. */
   static const QDevAlias qdev_alias_table[] = {
@@ -111,6 +112,7 @@ static const QDevAlias qdev_alias_table[] = {
   { "virtio-tablet-device", "virtio-tablet", QEMU_ARCH_VIRTIO_MMIO },
   { "virtio-tablet-ccw", "virtio-tablet", QEMU_ARCH_VIRTIO_CCW },
   { "virtio-tablet-pci", "virtio-tablet", QEMU_ARCH_VIRTIO_PCI },
+{ "PIIX3", "PIIX3-xen", QEMU_ARCH_XEN },


Hi Bernhard,

Can you comment if this should be:

+{ "PIIX", "PIIX3-xen", QEMU_ARCH_XEN },

instead? IIUC, the patch series also removed PIIX3 and PIIX4 and
replaced them with PIIX. Or am I not understanding correctly?


There is a confusion in QEMU between PCI bridges, the first PCI
function they implement, and the other PCI functions.

Here TYPE_PIIX3_DEVICE means for "PCI function part of the PIIX
south bridge chipset, which expose a PCI-to-ISA bridge". A better
name could be TYPE_PIIX3_ISA_PCI_DEVICE. Unfortunately this
device is named "PIIX3" with no indication of ISA bridge.

Re: [PULL v2 0/6] testing updates

[Peter Maydell]

On Fri, 23 Dec 2022 at 17:21, Alex Bennée  wrote:
>
> The following changes since commit 222059a0fccf4af3be776fe35a5ea2d6a68f9a0b:
>
>   Merge tag 'pull-ppc-20221221' of https://gitlab.com/danielhb/qemu into 
> staging (2022-12-21 18:08:09 +)
>
> are available in the Git repository at:
>
>   https://gitlab.com/stsquad/qemu.git tags/pull-testing-next-231222-1
>
> for you to fetch changes up to 3b4f911921e4233df0ba78d4acd2077da0b144ef:
>
>   gitlab-ci: Disable docs and GUIs for the build-tci and build-tcg-disabled 
> jobs (2022-12-23 15:17:13 +)
>
> 
> testing updates:
>
>   - fix minor shell-ism that can break check-tcg
>   - turn off verbose logging on custom runners
>   - make configure echo call in CI
>   - fix unused variable in linux-test
>   - add binary compiler docker image for hexagon
>   - disable doc and gui builds for tci and disable-tcg builds
>

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/8.0
for any user-visible changes.

-- PMM

[PATCH] target/arm: Fix sve_probe_page

[Richard Henderson]

Don't dereference CPUTLBEntryFull until we verify that
the page is valid.  Move the other user-only info field
updates after the valid check to match.

Cc: qemu-sta...@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1412
Signed-off-by: Richard Henderson 
---
 target/arm/sve_helper.c | 14 +-
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index 1afeadf9c8..521fc9b969 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -5354,15 +5354,10 @@ bool sve_probe_page(SVEHostPage *info, bool nofault, 
CPUARMState *env,
 #ifdef CONFIG_USER_ONLY
 flags = probe_access_flags(env, addr, access_type, mmu_idx, nofault,
&info->host, retaddr);
-memset(&info->attrs, 0, sizeof(info->attrs));
-/* Require both ANON and MTE; see allocation_tag_mem(). */
-info->tagged = (flags & PAGE_ANON) && (flags & PAGE_MTE);
 #else
 CPUTLBEntryFull *full;
 flags = probe_access_full(env, addr, access_type, mmu_idx, nofault,
   &info->host, &full, retaddr);
-info->attrs = full->attrs;
-info->tagged = full->pte_attrs == 0xf0;
 #endif
 info->flags = flags;
 
@@ -5371,6 +5366,15 @@ bool sve_probe_page(SVEHostPage *info, bool nofault, 
CPUARMState *env,
 return false;
 }
 
+#ifdef CONFIG_USER_ONLY
+memset(&info->attrs, 0, sizeof(info->attrs));
+/* Require both ANON and MTE; see allocation_tag_mem(). */
+info->tagged = (flags & PAGE_ANON) && (flags & PAGE_MTE);
+#else
+info->attrs = full->attrs;
+info->tagged = full->pte_attrs == 0xf0;
+#endif
+
 /* Ensure that info->host[] is relative to addr, not addr + mem_off. */
 info->host -= mem_off;
 return true;
-- 
2.34.1

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Chuck Zmudzinski]

On 1/4/23 1:48 PM, Philippe Mathieu-Daudé wrote:
> On 4/1/23 18:54, Chuck Zmudzinski wrote:
>> On 1/4/23 10:35 AM, Philippe Mathieu-Daudé wrote:
>>> +Markus/Thomas
>>>
>>> On 4/1/23 15:44, Bernhard Beschow wrote:
 During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
 TYPE_PIIX3_DEVICE. Remove this redundancy.

 Signed-off-by: Bernhard Beschow 
 ---
hw/i386/pc_piix.c |  4 +---
hw/isa/piix.c | 20 
include/hw/southbridge/piix.h |  1 -
3 files changed, 1 insertion(+), 24 deletions(-)

 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 5738d9cdca..6b8de3d59d 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
 @@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
if (pcmc->pci_enabled) {
DeviceState *dev;
PCIDevice *pci_dev;
 -const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
 - : TYPE_PIIX3_DEVICE;
int i;

pci_bus = i440fx_init(pci_type,
 @@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
   : pci_slot_get_pirq);
pcms->bus = pci_bus;

 -pci_dev = pci_new_multifunction(-1, true, type);
 +pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
object_property_set_bool(OBJECT(pci_dev), "has-usb",
 machine_usb(machine), &error_abort);
object_property_set_bool(OBJECT(pci_dev), "has-acpi",
 diff --git a/hw/isa/piix.c b/hw/isa/piix.c
 index 98e9b12661..e4587352c9 100644
 --- a/hw/isa/piix.c
 +++ b/hw/isa/piix.c
 @@ -33,7 +33,6 @@
#include "hw/qdev-properties.h"
#include "hw/ide/piix.h"
#include "hw/isa/isa.h"
 -#include "hw/xen/xen.h"
#include "sysemu/runstate.h"
#include "migration/vmstate.h"
#include "hw/acpi/acpi_aml_interface.h"
 @@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
.class_init= piix3_class_init,
};

 -static void piix3_xen_class_init(ObjectClass *klass, void *data)
 -{
 -DeviceClass *dc = DEVICE_CLASS(klass);
 -PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 -
 -k->realize = piix3_realize;
 -/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
 -k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
 -dc->vmsd = &vmstate_piix3;
>>>
>>> IIUC, since this device is user-creatable, we can't simply remove it
>>> without going thru the deprecation process. Alternatively we could
>>> add a type alias:
>>>
>>> -- >8 --
>>> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
>>> index 4b0ef65780..d94f7ea369 100644
>>> --- a/softmmu/qdev-monitor.c
>>> +++ b/softmmu/qdev-monitor.c
>>> @@ -64,6 +64,7 @@ typedef struct QDevAlias
>>>  QEMU_ARCH_LOONGARCH)
>>>#define QEMU_ARCH_VIRTIO_CCW (QEMU_ARCH_S390X)
>>>#define QEMU_ARCH_VIRTIO_MMIO (QEMU_ARCH_M68K)
>>> +#define QEMU_ARCH_XEN (QEMU_ARCH_ARM | QEMU_ARCH_I386)
>>>
>>>/* Please keep this table sorted by typename. */
>>>static const QDevAlias qdev_alias_table[] = {
>>> @@ -111,6 +112,7 @@ static const QDevAlias qdev_alias_table[] = {
>>>{ "virtio-tablet-device", "virtio-tablet", QEMU_ARCH_VIRTIO_MMIO },
>>>{ "virtio-tablet-ccw", "virtio-tablet", QEMU_ARCH_VIRTIO_CCW },
>>>{ "virtio-tablet-pci", "virtio-tablet", QEMU_ARCH_VIRTIO_PCI },
>>> +{ "PIIX3", "PIIX3-xen", QEMU_ARCH_XEN },
>> 
>> Hi Bernhard,
>> 
>> Can you comment if this should be:
>> 
>> +{ "PIIX", "PIIX3-xen", QEMU_ARCH_XEN },
>> 
>> instead? IIUC, the patch series also removed PIIX3 and PIIX4 and
>> replaced them with PIIX. Or am I not understanding correctly?
> 
> There is a confusion in QEMU between PCI bridges, the first PCI
> function they implement, and the other PCI functions.
> 
> Here TYPE_PIIX3_DEVICE means for "PCI function part of the PIIX
> south bridge chipset, which expose a PCI-to-ISA bridge". A better
> name could be TYPE_PIIX3_ISA_PCI_DEVICE. Unfortunately this
> device is named "PIIX3" with no indication of ISA bridge.


Thanks, you are right, I see the PIIX3 device still exists after
this patch set is applied.

chuckz@debian:~/sources-sid/qemu/qemu-7.50+dfsg/hw/i386$ grep -r PIIX3 *
pc_piix.c:pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);

I also understand there is the PCI-to-ISA bridge at 00:01.0 on the PCI bus:

chuckz@debian:~$ lspci
00:00.0 Host bridge: Intel Corporation 440FX - 82441FX PMC [Natoma] (rev 02)
00:01.0 ISA bridge: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II]
00:01.1 IDE interface: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II]
00:01.2 USB controller: Intel Corporation 82371SB PIIX3 USB [Nato

Re: [PATCH] target/arm: Fix sve_probe_page

[Philippe Mathieu-Daudé]

On 4/1/23 20:00, Richard Henderson wrote:

Don't dereference CPUTLBEntryFull until we verify that
the page is valid.  Move the other user-only info field
updates after the valid check to match.


Easy one :)

Reviewed-by: Philippe Mathieu-Daudé 


Cc: qemu-sta...@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1412
Signed-off-by: Richard Henderson 
---
  target/arm/sve_helper.c | 14 +-
  1 file changed, 9 insertions(+), 5 deletions(-)

Re: [PATCH v4 06/30] hw/i386/pc_piix: Associate pci_map_irq_fn as soon as PCI bus is created

[Bernhard Beschow]

Am 21. Dezember 2022 16:59:39 UTC schrieb Bernhard Beschow :
>Observe that the pci_map_irq_fn's don't depend on the south bridge
>instance. So associate them immediately when the PCI bus is created to
>keep things logically together.
>
>Signed-off-by: Bernhard Beschow 

This patch was new in v4 and therefore still lacks review. It could be squashed 
into https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg03312.html for 
a cleaner history.

Best regards,
Bernhard
>---
> hw/i386/pc_piix.c | 7 +++
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
>diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
>index e4bb8994da..bfa7cb513b 100644
>--- a/hw/i386/pc_piix.c
>+++ b/hw/i386/pc_piix.c
>@@ -229,6 +229,9 @@ static void pc_init1(MachineState *machine,
>   x86ms->below_4g_mem_size,
>   x86ms->above_4g_mem_size,
>   pci_memory, ram_memory);
>+pci_bus_map_irqs(pci_bus,
>+ xen_enabled() ? xen_pci_slot_get_pirq
>+   : pci_slot_get_pirq);
> pcms->bus = pci_bus;
> 
> pci_dev = pci_create_simple_multifunction(pci_bus, -1, true, type);
>@@ -236,10 +239,6 @@ static void pc_init1(MachineState *machine,
> piix3->pic = x86ms->gsi;
> piix3_devfn = piix3->dev.devfn;
> isa_bus = ISA_BUS(qdev_get_child_bus(DEVICE(piix3), "isa.0"));
>-
>-pci_bus_map_irqs(pci_bus,
>- xen_enabled() ? xen_pci_slot_get_pirq
>-   : pci_slot_get_pirq);
> } else {
> pci_bus = NULL;
> isa_bus = isa_bus_new(NULL, get_system_memory(), system_io,

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Bernhard Beschow]

Am 4. Januar 2023 16:42:43 UTC schrieb Chuck Zmudzinski :
>On 1/4/23 9:44 AM, Bernhard Beschow wrote:
>> During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
>> TYPE_PIIX3_DEVICE. Remove this redundancy.
>> 
>> Signed-off-by: Bernhard Beschow 
>> ---
>>  hw/i386/pc_piix.c |  4 +---
>>  hw/isa/piix.c | 20 
>>  include/hw/southbridge/piix.h |  1 -
>>  3 files changed, 1 insertion(+), 24 deletions(-)
>> 
>> diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
>> index 5738d9cdca..6b8de3d59d 100644
>> --- a/hw/i386/pc_piix.c
>> +++ b/hw/i386/pc_piix.c
>> @@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
>>  if (pcmc->pci_enabled) {
>>  DeviceState *dev;
>>  PCIDevice *pci_dev;
>> -const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
>> - : TYPE_PIIX3_DEVICE;
>>  int i;
>>  
>>  pci_bus = i440fx_init(pci_type,
>> @@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
>> : pci_slot_get_pirq);
>>  pcms->bus = pci_bus;
>>  
>> -pci_dev = pci_new_multifunction(-1, true, type);
>> +pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
>>  object_property_set_bool(OBJECT(pci_dev), "has-usb",
>>   machine_usb(machine), &error_abort);
>>  object_property_set_bool(OBJECT(pci_dev), "has-acpi",
>> diff --git a/hw/isa/piix.c b/hw/isa/piix.c
>> index 98e9b12661..e4587352c9 100644
>> --- a/hw/isa/piix.c
>> +++ b/hw/isa/piix.c
>> @@ -33,7 +33,6 @@
>>  #include "hw/qdev-properties.h"
>>  #include "hw/ide/piix.h"
>>  #include "hw/isa/isa.h"
>> -#include "hw/xen/xen.h"
>>  #include "sysemu/runstate.h"
>>  #include "migration/vmstate.h"
>>  #include "hw/acpi/acpi_aml_interface.h"
>> @@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
>>  .class_init= piix3_class_init,
>>  };
>>  
>> -static void piix3_xen_class_init(ObjectClass *klass, void *data)
>> -{
>> -DeviceClass *dc = DEVICE_CLASS(klass);
>> -PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>> -
>> -k->realize = piix3_realize;
>> -/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
>> -k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
>> -dc->vmsd = &vmstate_piix3;
>> -}
>> -
>> -static const TypeInfo piix3_xen_info = {
>> -.name  = TYPE_PIIX3_XEN_DEVICE,
>> -.parent= TYPE_PIIX_PCI_DEVICE,
>> -.instance_init = piix3_init,
>> -.class_init= piix3_xen_class_init,
>> -};
>> -
>>  static void piix4_realize(PCIDevice *dev, Error **errp)
>>  {
>>  ERRP_GUARD();
>> @@ -534,7 +515,6 @@ static void piix3_register_types(void)
>>  {
>>  type_register_static(&piix_pci_type_info);
>>  type_register_static(&piix3_info);
>> -type_register_static(&piix3_xen_info);
>>  type_register_static(&piix4_info);
>>  }
>>  
>> diff --git a/include/hw/southbridge/piix.h b/include/hw/southbridge/piix.h
>> index 65ad8569da..b1fc94a742 100644
>> --- a/include/hw/southbridge/piix.h
>> +++ b/include/hw/southbridge/piix.h
>> @@ -77,7 +77,6 @@ struct PIIXState {
>>  OBJECT_DECLARE_SIMPLE_TYPE(PIIXState, PIIX_PCI_DEVICE)
>>  
>>  #define TYPE_PIIX3_DEVICE "PIIX3"
>> -#define TYPE_PIIX3_XEN_DEVICE "PIIX3-xen"
>>  #define TYPE_PIIX4_PCI_DEVICE "piix4-isa"
>>  
>>  #endif
>
>
>This fixes the regression with the emulated usb tablet device that I reported 
>in v1 here:
>
>https://lore.kernel.org/qemu-devel/aed4f2c1-83f7-163a-fb44-f28437666...@aol.com/
>
>I tested this patch again with all the prerequisites and now with v2 there are 
>no regressions.

Good news!

>Tested-by: Chuck Zmudzinski 

Thanks for the test ride and the Tested-by medal ;)

Best regards,
Bernhard

Re: [PATCH 3/6] tools/virtiofsd: add G_GNUC_PRINTF for logging functions

[Dr. David Alan Gilbert]

* Daniel P. Berrangé (berra...@redhat.com) wrote:
> Signed-off-by: Daniel P. Berrangé 

Yes, although I'm a little surprised this hasn't thrown up any warnings.


Reviewed-by: Dr. David Alan Gilbert 

> ---
>  tools/virtiofsd/fuse_log.c   | 1 +
>  tools/virtiofsd/fuse_log.h   | 6 --
>  tools/virtiofsd/passthrough_ll.c | 1 +
>  3 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/virtiofsd/fuse_log.c b/tools/virtiofsd/fuse_log.c
> index 745d88cd2a..2de3f48ee7 100644
> --- a/tools/virtiofsd/fuse_log.c
> +++ b/tools/virtiofsd/fuse_log.c
> @@ -12,6 +12,7 @@
>  #include "fuse_log.h"
>  
>  
> +G_GNUC_PRINTF(2, 0)
>  static void default_log_func(__attribute__((unused)) enum fuse_log_level 
> level,
>   const char *fmt, va_list ap)
>  {
> diff --git a/tools/virtiofsd/fuse_log.h b/tools/virtiofsd/fuse_log.h
> index 8d7091bd4d..e5c2967ab9 100644
> --- a/tools/virtiofsd/fuse_log.h
> +++ b/tools/virtiofsd/fuse_log.h
> @@ -45,7 +45,8 @@ enum fuse_log_level {
>   * @param ap format string arguments
>   */
>  typedef void (*fuse_log_func_t)(enum fuse_log_level level, const char *fmt,
> -va_list ap);
> +va_list ap)
> +G_GNUC_PRINTF(2, 0);
>  
>  /**
>   * Install a custom log handler function.
> @@ -68,6 +69,7 @@ void fuse_set_log_func(fuse_log_func_t func);
>   * @param level severity level (FUSE_LOG_ERR, FUSE_LOG_DEBUG, etc)
>   * @param fmt sprintf-style format string including newline
>   */
> -void fuse_log(enum fuse_log_level level, const char *fmt, ...);
> +void fuse_log(enum fuse_log_level level, const char *fmt, ...)
> +G_GNUC_PRINTF(2, 3);
>  
>  #endif /* FUSE_LOG_H_ */
> diff --git a/tools/virtiofsd/passthrough_ll.c 
> b/tools/virtiofsd/passthrough_ll.c
> index 20f0f41f99..40ea2ed27f 100644
> --- a/tools/virtiofsd/passthrough_ll.c
> +++ b/tools/virtiofsd/passthrough_ll.c
> @@ -4182,6 +4182,7 @@ static void setup_nofile_rlimit(unsigned long 
> rlimit_nofile)
>  }
>  }
>  
> +G_GNUC_PRINTF(2, 0)
>  static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
>  {
>  g_autofree char *localfmt = NULL;
> -- 
> 2.38.1
> 
-- 
Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK

[PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[Stefan Hajnoczi]

scsi_device_purge_requests() is called from I/O code by virtio-scsi TMF
emulation code. It must not call Global State APIs like blk_drain()
because that results in an assertion failure.

blk_drain() is a Global State API because it uses bdrv_unref(). Actually
ref/unref is unnecessary in device emulation code because the drive=
qdev property holds the reference.

Introduce blk_drain_noref(), a variant of blk_drain() that is
IO_OR_GS_CODE() and doesn't take a reference to the BlockBackend.

This fixes the following virtio-scsi IOThread assertion failure when
hot-plugging scsi-hd devices:

  qemu-kvm: ../block/block-backend.c:1780: void blk_drain(BlockBackend *): 
Assertion `qemu_in_main_thread()' failed.

  #0  0x7f4b6a0a154c __pthread_kill_implementation (libc.so.6>
  #1  0x7f4b6a054d46 raise (libc.so.6 + 0x54d46)
  #2  0x7f4b6a0287f3 abort (libc.so.6 + 0x287f3)
  #3  0x7f4b6a02871b __assert_fail_base.cold (libc.so.6 + 0x2>
  #4  0x7f4b6a04dce6 __assert_fail (libc.so.6 + 0x4dce6)
  #5  0x55c811253ac0 blk_drain (qemu-kvm + 0x808ac0)
  #6  0x55c810ecb951 scsi_device_purge_requests (qemu-kvm + 0>
 ^^
  #7  0x55c810ed6ab8 scsi_disk_reset (qemu-kvm + 0x48bab8)
  #8  0x55c8111dc908 resettable_phase_hold (qemu-kvm + 0x7919>
  #9  0x55c8111db7f0 device_cold_reset (qemu-kvm + 0x7907f0)
  #10 0x55c8110bb1a6 virtio_scsi_handle_ctrl (qemu-kvm + 0x67>
  #11 0x55c8110d458f virtio_queue_host_notifier_read (qemu-kv>
  #12 0x55c811404a73 aio_dispatch_handler (qemu-kvm + 0x9b9a7>
  #13 0x55c811405743 aio_poll (qemu-kvm + 0x9ba743)
  #14 0x55c81121d532 iothread_run (qemu-kvm + 0x7d2532)
  #15 0x55c81140926a qemu_thread_start (qemu-kvm + 0x9be26a)
  #16 0x7f4b6a09f802 start_thread (libc.so.6 + 0x9f802)
  #17 0x7f4b6a03f450 __clone3 (libc.so.6 + 0x3f450)

Reported-by: Qing Wang 
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2155748
Cc: Paolo Bonzini 
Cc: Kevin Wolf 
Cc: Emanuele Giuseppe Esposito 
Signed-off-by: Stefan Hajnoczi 
---
 include/sysemu/block-backend-io.h |  1 +
 block/block-backend.c | 23 +++
 hw/scsi/scsi-bus.c|  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/include/sysemu/block-backend-io.h 
b/include/sysemu/block-backend-io.h
index 7ec6d978d4..f73db1f77c 100644
--- a/include/sysemu/block-backend-io.h
+++ b/include/sysemu/block-backend-io.h
@@ -73,6 +73,7 @@ void blk_iostatus_set_err(BlockBackend *blk, int error);
 int blk_get_max_iov(BlockBackend *blk);
 int blk_get_max_hw_iov(BlockBackend *blk);
 
+void blk_drain_noref(BlockBackend *blk);
 void blk_io_plug(BlockBackend *blk);
 void blk_io_unplug(BlockBackend *blk);
 AioContext *blk_get_aio_context(BlockBackend *blk);
diff --git a/block/block-backend.c b/block/block-backend.c
index ba7bf1d6bc..20914bae7b 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -1815,6 +1815,29 @@ void blk_drain(BlockBackend *blk)
 }
 }
 
+/*
+ * Same as blk_drain() but the caller must hold a reference to blk. May be
+ * called from Global State or I/O API code. Device emulation can call this
+ * because the qdev drive= property holds the reference.
+ */
+void blk_drain_noref(BlockBackend *blk)
+{
+BlockDriverState *bs = blk_bs(blk);
+IO_OR_GS_CODE();
+
+if (bs) {
+bdrv_drained_begin(bs);
+}
+
+/* We may have -ENOMEDIUM completions in flight */
+AIO_WAIT_WHILE(blk_get_aio_context(blk),
+   qatomic_mb_read(&blk->in_flight) > 0);
+
+if (bs) {
+bdrv_drained_end(bs);
+}
+}
+
 void blk_drain_all(void)
 {
 BlockBackend *blk = NULL;
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index ceceafb2cd..110fd85106 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -1663,7 +1663,7 @@ void scsi_device_purge_requests(SCSIDevice *sdev, 
SCSISense sense)
 req = QTAILQ_FIRST(&sdev->requests);
 scsi_req_cancel_async(req, NULL);
 }
-blk_drain(sdev->conf.blk);
+blk_drain_noref(sdev->conf.blk);
 aio_context_release(blk_get_aio_context(sdev->conf.blk));
 scsi_device_set_ua(sdev, sense);
 }
-- 
2.39.0

[PATCH] hw/core: Introduce proxy-pic

[Bernhard Beschow]

Having a proxy PIC allows for ISA PICs to be created and wired up in
southbridges. This is especially useful for PIIX3 for two reasons:
First, the southbridge doesn't need to care about the virtualization
technology used (KVM, TCG, Xen) due to in-IRQs (where devices get
attached) and out-IRQs (which will trigger the IRQs of the respective
virtualization technology) are separated. Second, since the in-IRQs are
populated with fully initialized qemu_irq's, they can already be wired
up inside PIIX3.

Signed-off-by: Bernhard Beschow 
Reviewed-by: Michael S. Tsirkin 
Message-Id: <20221022150508.26830-15-shen...@gmail.com>
---
Changes since v4:
* Change license to GPL-2.0-or-later and use SPDX-License-Identifier
* Fix typo in commit message
---
 include/hw/core/proxy-pic.h | 38 ++
 hw/core/proxy-pic.c | 54 +
 MAINTAINERS |  2 ++
 hw/core/Kconfig |  3 +++
 hw/core/meson.build |  1 +
 5 files changed, 98 insertions(+)
 create mode 100644 include/hw/core/proxy-pic.h
 create mode 100644 hw/core/proxy-pic.c

diff --git a/include/hw/core/proxy-pic.h b/include/hw/core/proxy-pic.h
new file mode 100644
index 00..32bc7936bd
--- /dev/null
+++ b/include/hw/core/proxy-pic.h
@@ -0,0 +1,38 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Proxy interrupt controller device.
+ *
+ * Copyright (c) 2022 Bernhard Beschow 
+ */
+
+#ifndef HW_PROXY_PIC_H
+#define HW_PROXY_PIC_H
+
+#include "hw/qdev-core.h"
+#include "qom/object.h"
+#include "hw/irq.h"
+
+#define TYPE_PROXY_PIC "proxy-pic"
+OBJECT_DECLARE_SIMPLE_TYPE(ProxyPICState, PROXY_PIC)
+
+#define MAX_PROXY_PIC_LINES 16
+
+/**
+ * This is a simple device which has 16 pairs of GPIO input and output lines.
+ * Any change on an input line is forwarded to the respective output.
+ *
+ * QEMU interface:
+ *  + 16 unnamed GPIO inputs: the input lines
+ *  + 16 unnamed GPIO outputs: the output lines
+ */
+struct ProxyPICState {
+/*< private >*/
+struct DeviceState parent_obj;
+/*< public >*/
+
+qemu_irq in_irqs[MAX_PROXY_PIC_LINES];
+qemu_irq out_irqs[MAX_PROXY_PIC_LINES];
+};
+
+#endif /* HW_PROXY_PIC_H */
diff --git a/hw/core/proxy-pic.c b/hw/core/proxy-pic.c
new file mode 100644
index 00..40fd70b9e2
--- /dev/null
+++ b/hw/core/proxy-pic.c
@@ -0,0 +1,54 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Proxy interrupt controller device.
+ *
+ * Copyright (c) 2022 Bernhard Beschow 
+ */
+
+#include "qemu/osdep.h"
+#include "hw/core/proxy-pic.h"
+
+static void proxy_pic_set_irq(void *opaque, int irq, int level)
+{
+ProxyPICState *s = opaque;
+
+qemu_set_irq(s->out_irqs[irq], level);
+}
+
+static void proxy_pic_realize(DeviceState *dev, Error **errp)
+{
+ProxyPICState *s = PROXY_PIC(dev);
+
+qdev_init_gpio_in(DEVICE(s), proxy_pic_set_irq, MAX_PROXY_PIC_LINES);
+qdev_init_gpio_out(DEVICE(s), s->out_irqs, MAX_PROXY_PIC_LINES);
+
+for (int i = 0; i < MAX_PROXY_PIC_LINES; ++i) {
+s->in_irqs[i] = qdev_get_gpio_in(DEVICE(s), i);
+}
+}
+
+static void proxy_pic_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+
+/* No state to reset or migrate */
+dc->realize = proxy_pic_realize;
+
+/* Reason: Needs to be wired up to work */
+dc->user_creatable = false;
+}
+
+static const TypeInfo proxy_pic_info = {
+.name  = TYPE_PROXY_PIC,
+.parent= TYPE_DEVICE,
+.instance_size = sizeof(ProxyPICState),
+.class_init = proxy_pic_class_init,
+};
+
+static void split_irq_register_types(void)
+{
+type_register_static(&proxy_pic_info);
+}
+
+type_init(split_irq_register_types)
diff --git a/MAINTAINERS b/MAINTAINERS
index 7a40d4d865..295a76bfbd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1674,6 +1674,7 @@ S: Supported
 F: hw/char/debugcon.c
 F: hw/char/parallel*
 F: hw/char/serial*
+F: hw/core/proxy-pic.c
 F: hw/dma/i8257*
 F: hw/i2c/pm_smbus.c
 F: hw/input/pckbd.c
@@ -1690,6 +1691,7 @@ F: hw/watchdog/wdt_ib700.c
 F: hw/watchdog/wdt_i6300esb.c
 F: include/hw/display/vga.h
 F: include/hw/char/parallel.h
+F: include/hw/core/proxy-pic.h
 F: include/hw/dma/i8257.h
 F: include/hw/i2c/pm_smbus.h
 F: include/hw/input/i8042.h
diff --git a/hw/core/Kconfig b/hw/core/Kconfig
index 9397503656..a7224f4ca0 100644
--- a/hw/core/Kconfig
+++ b/hw/core/Kconfig
@@ -22,6 +22,9 @@ config OR_IRQ
 config PLATFORM_BUS
 bool
 
+config PROXY_PIC
+bool
+
 config REGISTER
 bool
 
diff --git a/hw/core/meson.build b/hw/core/meson.build
index 7a4d02b6c0..e86aef6ec3 100644
--- a/hw/core/meson.build
+++ b/hw/core/meson.build
@@ -30,6 +30,7 @@ softmmu_ss.add(when: ['CONFIG_GUEST_LOADER', fdt], if_true: 
files('guest-loader.
 softmmu_ss.add(when: 'CONFIG_OR_IRQ', if_true: files('or-irq.c'))
 softmmu_ss.add(when: 'CONFIG_PLATFORM_BUS', if_true: files('platform-bus.c'))
 softmmu_ss.add(when: 'CONFIG_PTIMER', if_true: files('ptimer.c'))
+softmmu_ss.add(wh

Re: [PATCH v4] tests/qtest: netdev: test stream and dgram backends

[Laurent Vivier]

On 1/4/23 19:37, Thomas Huth wrote:

On 03/01/2023 12.00, Laurent Vivier wrote:

Signed-off-by: Laurent Vivier 
Acked-by: Michael S. Tsirkin 
---

Notes:
 v4:
   - rework EXPECT_STATE()
   - use g_dir_make_tmp()
 v3:
 - Add "-M none" to avoid error:
   "No machine specified, and there is no default"
 v2:
 - Fix ipv6 free port allocation
 - Check for IPv4, IPv6, AF_UNIX
 - Use g_mkdtemp() rather than g_file_open_tmp()
 - Use socketpair() in test_stream_fd()
 v1: compared to v14 of "qapi: net: add unix socket type support to netdev 
backend":
 - use IP addresses 127.0.0.1 and ::1 rather than localhost

  tests/qtest/meson.build |   2 +
  tests/qtest/netdev-socket.c | 434 
  2 files changed, 436 insertions(+)
  create mode 100644 tests/qtest/netdev-socket.c


FYI, the test also does not work on FreeBSD. It hangs on both, FreeBSD 12 and 
13:

  https://cirrus-ci.com/task/5024964768694272?logs=build#L6937

  https://cirrus-ci.com/task/5379344567107584?logs=build#L6938


Thanks.

Are you sure it's this test?

The "/netdev/stream/inet/ipv6" seems to be the last one of the series (if I compare with 
previous machines) and it is OK in the logs.


I don't understand where it can hang as we have an internal 5 seconds timeout (in 
EXPECT_STATE()).


And I don't understand why we have only /netdev/stream tests and no 
/netdev/dgram tests.

Is it possible to have more details?

Laurent

Re: [PATCH v4 12/30] hw/core: Introduce proxy-pic

[Bernhard Beschow]

Am 4. Januar 2023 16:35:57 UTC schrieb "Philippe Mathieu-Daudé" 
:
>On 4/1/23 17:01, Bernhard Beschow wrote:
>> Am 4. Januar 2023 14:37:29 UTC schrieb "Philippe Mathieu-Daudé" 
>> :
>>> On 21/12/22 17:59, Bernhard Beschow wrote:
 Having a proxy PIC allows for ISA PICs to be created and wired up in
 southbridges. This is especially useful for PIIX3 for two reasons:
 First, the southbridge doesn't need to care about the virtualization
 technology used (KVM, TCG, Xen) due to in-IRQs (where devices get
 attached) and out-IRQs (which will trigger the IRQs of the respective
 virtzalization technology) are separated. Second, since the in-IRQs are
>
>Typo "virtualization".

Fixed...

 populated with fully initialized qemu_irq's, they can already be wired
 up inside PIIX3.
 
 Signed-off-by: Bernhard Beschow 
 Reviewed-by: Michael S. Tsirkin 
 Message-Id: <20221022150508.26830-15-shen...@gmail.com>
 ---
MAINTAINERS |  2 ++
hw/core/Kconfig |  3 ++
hw/core/meson.build |  1 +
hw/core/proxy-pic.c | 70 +
include/hw/core/proxy-pic.h | 54 
5 files changed, 130 insertions(+)
create mode 100644 hw/core/proxy-pic.c
create mode 100644 include/hw/core/proxy-pic.h
>>> 
>>> Please enable scripts/git.orderfile.
>> 
>> Will do.
>> 
 diff --git a/include/hw/core/proxy-pic.h b/include/hw/core/proxy-pic.h
 new file mode 100644
 index 00..0eb40c478a
 --- /dev/null
 +++ b/include/hw/core/proxy-pic.h
 @@ -0,0 +1,54 @@
 +/*
 + * Proxy interrupt controller device.
 + *
 + * Copyright (c) 2022 Bernhard Beschow 
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining 
 a copy
 + * of this software and associated documentation files (the "Software"), 
 to deal
 + * in the Software without restriction, including without limitation the 
 rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or 
 sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be 
 included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
 EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 
 MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR 
 OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 
 ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 
 IN
 + * THE SOFTWARE.
>>> 
>>> This is the MIT license right? Do you mind adding a SPDX tag along?
>> 
>> I based my implementation on TYPE_SPLIT_IRQ as you suggested before and thus 
>> preserved the license.
>> 
>>> * SPDX-License-Identifier: MIT
>> 
>> Or just replace the wall of text with this line? This should suffice, no?
>
>IIUC (IANAL) I can only suggest you to add a SPDX tag to the license you
>chose, not ask you to remove the text; but since you ask/propose, the
>tag suffices indeed. I suggest the tag use because it is clearer than
>trying to match the full (often copy/pasted with typos) license text.

Changed...

 + */
 +
 +#ifndef HW_PROXY_PIC_H
 +#define HW_PROXY_PIC_H
 +
 +#include "hw/qdev-core.h"
 +#include "qom/object.h"
 +#include "hw/irq.h"
 +
 +#define TYPE_PROXY_PIC "proxy-pic"
 +OBJECT_DECLARE_SIMPLE_TYPE(ProxyPICState, PROXY_PIC)
 +
 +#define MAX_PROXY_PIC_LINES 16
 +
 +/**
 + * This is a simple device which has 16 pairs of GPIO input and output 
 lines.
 + * Any change on an input line is forwarded to the respective output.
 + *
 + * QEMU interface:
 + *  + 16 unnamed GPIO inputs: the input lines
 + *  + 16 unnamed GPIO outputs: the output lines
 + */
>>> 
>>> Why restrict to 16 and not use a class property and allocate
>>> on the heap? See TYPE_SPLIT_IRQ for example.
>> 
>> TYPE_SPLIT_IRQ doesn't allocate on the heap and instead has a hardcoded 
>> limit of MAX_SPLIT_LINES which equals 16 ;)
>> 
>> I was unsure on when to free the memory and how to dispose the elements so I 
>> went with this solution for simplicity. I'll look for inspitation in other 
>> device models and respin.
>
>Oh indeed. Well this model as is is OK, but it could be more useful
>if able to proxy any range of IRQs.

I've responded with a new, single patch to this patch. Is that okay or shall I 
respin the whole series? Is anything missing? IIUC we can make the proxy-pic 
dynamic i

Re: [PATCH v4 12/30] hw/core: Introduce proxy-pic

[Philippe Mathieu-Daudé]

On 4/1/23 21:12, Bernhard Beschow wrote:



Am 4. Januar 2023 16:35:57 UTC schrieb "Philippe Mathieu-Daudé" 
:

On 4/1/23 17:01, Bernhard Beschow wrote:

Am 4. Januar 2023 14:37:29 UTC schrieb "Philippe Mathieu-Daudé" 
:

On 21/12/22 17:59, Bernhard Beschow wrote:

Having a proxy PIC allows for ISA PICs to be created and wired up in
southbridges. This is especially useful for PIIX3 for two reasons:
First, the southbridge doesn't need to care about the virtualization
technology used (KVM, TCG, Xen) due to in-IRQs (where devices get
attached) and out-IRQs (which will trigger the IRQs of the respective
virtzalization technology) are separated. Second, since the in-IRQs are


Typo "virtualization".


Fixed...




Why restrict to 16 and not use a class property and allocate
on the heap? See TYPE_SPLIT_IRQ for example.


TYPE_SPLIT_IRQ doesn't allocate on the heap and instead has a hardcoded limit 
of MAX_SPLIT_LINES which equals 16 ;)

I was unsure on when to free the memory and how to dispose the elements so I 
went with this solution for simplicity. I'll look for inspitation in other 
device models and respin.


Oh indeed. Well this model as is is OK, but it could be more useful
if able to proxy any range of IRQs.


I've responded with a new, single patch to this patch. Is that okay or shall I 
respin the whole series? Is anything missing? IIUC we can make the proxy-pic 
dynamic in a follow-up?


I think we are good :) If you can point me to a branch with all your 
patches, I could verify everything is properly applied locally.



I have the feeling we are cycling around this IRQ proxy:

22ec3283ef ("irq: introduce qemu_irq_proxy()")
078778c5a5 ("piix4: Add an i8259 Interrupt Controller as specified in 
datasheet")
fc531e7cab ("Revert "irq: introduce qemu_irq_proxy()"")

What is our problem? IRQ lines connect 2 devices in a fixed direction.
Current model expects one edge to be wired to a device before wiring
the other device, so device composition with IRQs in middle is
impossible? If so, this doesn't scale with dynamic machine creation.


My PIIX consolidation series and even more so my effort to make the VT82xx 
south bridges work with the PC machine are indeed bottom-up explorations of 
dynamic/flexible machine creation.


Yeah (I have been there too...). Also Mark Cave-Ayland confirmed
elsewhere in this thread that yourv effort points toward the right
direction :)

Regards,

Phil.

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Bernhard Beschow]

Am 4. Januar 2023 19:29:35 UTC schrieb Chuck Zmudzinski :
>On 1/4/23 1:48 PM, Philippe Mathieu-Daudé wrote:
>> On 4/1/23 18:54, Chuck Zmudzinski wrote:
>>> On 1/4/23 10:35 AM, Philippe Mathieu-Daudé wrote:
 +Markus/Thomas

 On 4/1/23 15:44, Bernhard Beschow wrote:
> During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
> TYPE_PIIX3_DEVICE. Remove this redundancy.
>
> Signed-off-by: Bernhard Beschow 
> ---
>hw/i386/pc_piix.c |  4 +---
>hw/isa/piix.c | 20 
>include/hw/southbridge/piix.h |  1 -
>3 files changed, 1 insertion(+), 24 deletions(-)
>
> diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
> index 5738d9cdca..6b8de3d59d 100644
> --- a/hw/i386/pc_piix.c
> +++ b/hw/i386/pc_piix.c
> @@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
>if (pcmc->pci_enabled) {
>DeviceState *dev;
>PCIDevice *pci_dev;
> -const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
> - : TYPE_PIIX3_DEVICE;
>int i;
>
>pci_bus = i440fx_init(pci_type,
> @@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
>   : pci_slot_get_pirq);
>pcms->bus = pci_bus;
>
> -pci_dev = pci_new_multifunction(-1, true, type);
> +pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
>object_property_set_bool(OBJECT(pci_dev), "has-usb",
> machine_usb(machine), &error_abort);
>object_property_set_bool(OBJECT(pci_dev), "has-acpi",
> diff --git a/hw/isa/piix.c b/hw/isa/piix.c
> index 98e9b12661..e4587352c9 100644
> --- a/hw/isa/piix.c
> +++ b/hw/isa/piix.c
> @@ -33,7 +33,6 @@
>#include "hw/qdev-properties.h"
>#include "hw/ide/piix.h"
>#include "hw/isa/isa.h"
> -#include "hw/xen/xen.h"
>#include "sysemu/runstate.h"
>#include "migration/vmstate.h"
>#include "hw/acpi/acpi_aml_interface.h"
> @@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
>.class_init= piix3_class_init,
>};
>
> -static void piix3_xen_class_init(ObjectClass *klass, void *data)
> -{
> -DeviceClass *dc = DEVICE_CLASS(klass);
> -PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
> -
> -k->realize = piix3_realize;
> -/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
> -k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
> -dc->vmsd = &vmstate_piix3;

 IIUC, since this device is user-creatable, we can't simply remove it
 without going thru the deprecation process. Alternatively we could
 add a type alias:

 -- >8 --
 diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
 index 4b0ef65780..d94f7ea369 100644
 --- a/softmmu/qdev-monitor.c
 +++ b/softmmu/qdev-monitor.c
 @@ -64,6 +64,7 @@ typedef struct QDevAlias
  QEMU_ARCH_LOONGARCH)
#define QEMU_ARCH_VIRTIO_CCW (QEMU_ARCH_S390X)
#define QEMU_ARCH_VIRTIO_MMIO (QEMU_ARCH_M68K)
 +#define QEMU_ARCH_XEN (QEMU_ARCH_ARM | QEMU_ARCH_I386)

/* Please keep this table sorted by typename. */
static const QDevAlias qdev_alias_table[] = {
 @@ -111,6 +112,7 @@ static const QDevAlias qdev_alias_table[] = {
{ "virtio-tablet-device", "virtio-tablet", QEMU_ARCH_VIRTIO_MMIO },
{ "virtio-tablet-ccw", "virtio-tablet", QEMU_ARCH_VIRTIO_CCW },
{ "virtio-tablet-pci", "virtio-tablet", QEMU_ARCH_VIRTIO_PCI },
 +{ "PIIX3", "PIIX3-xen", QEMU_ARCH_XEN },
>>> 
>>> Hi Bernhard,
>>> 
>>> Can you comment if this should be:
>>> 
>>> +{ "PIIX", "PIIX3-xen", QEMU_ARCH_XEN },
>>> 
>>> instead? IIUC, the patch series also removed PIIX3 and PIIX4 and
>>> replaced them with PIIX. Or am I not understanding correctly?
>> 
>> There is a confusion in QEMU between PCI bridges, the first PCI
>> function they implement, and the other PCI functions.
>> 
>> Here TYPE_PIIX3_DEVICE means for "PCI function part of the PIIX
>> south bridge chipset, which expose a PCI-to-ISA bridge". A better
>> name could be TYPE_PIIX3_ISA_PCI_DEVICE. Unfortunately this
>> device is named "PIIX3" with no indication of ISA bridge.
>
>
>Thanks, you are right, I see the PIIX3 device still exists after
>this patch set is applied.
>
>chuckz@debian:~/sources-sid/qemu/qemu-7.50+dfsg/hw/i386$ grep -r PIIX3 *
>pc_piix.c:pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
>
>I also understand there is the PCI-to-ISA bridge at 00:01.0 on the PCI bus:
>
>chuckz@debian:~$ lspci
>00:00.0 Host bridge: Intel Corporation 440FX - 82441FX PMC [Natoma] (rev 02)
>00:01.0 ISA bridge: Intel Corporation 823

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Bernhard Beschow]

Am 4. Januar 2023 17:54:16 UTC schrieb Chuck Zmudzinski :
>On 1/4/23 10:35 AM, Philippe Mathieu-Daudé wrote:
>> +Markus/Thomas
>> 
>> On 4/1/23 15:44, Bernhard Beschow wrote:
>>> During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
>>> TYPE_PIIX3_DEVICE. Remove this redundancy.
>>> 
>>> Signed-off-by: Bernhard Beschow 
>>> ---
>>>   hw/i386/pc_piix.c |  4 +---
>>>   hw/isa/piix.c | 20 
>>>   include/hw/southbridge/piix.h |  1 -
>>>   3 files changed, 1 insertion(+), 24 deletions(-)
>>> 
>>> diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
>>> index 5738d9cdca..6b8de3d59d 100644
>>> --- a/hw/i386/pc_piix.c
>>> +++ b/hw/i386/pc_piix.c
>>> @@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
>>>   if (pcmc->pci_enabled) {
>>>   DeviceState *dev;
>>>   PCIDevice *pci_dev;
>>> -const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
>>> - : TYPE_PIIX3_DEVICE;
>>>   int i;
>>>   
>>>   pci_bus = i440fx_init(pci_type,
>>> @@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
>>>  : pci_slot_get_pirq);
>>>   pcms->bus = pci_bus;
>>>   
>>> -pci_dev = pci_new_multifunction(-1, true, type);
>>> +pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
>>>   object_property_set_bool(OBJECT(pci_dev), "has-usb",
>>>machine_usb(machine), &error_abort);
>>>   object_property_set_bool(OBJECT(pci_dev), "has-acpi",
>>> diff --git a/hw/isa/piix.c b/hw/isa/piix.c
>>> index 98e9b12661..e4587352c9 100644
>>> --- a/hw/isa/piix.c
>>> +++ b/hw/isa/piix.c
>>> @@ -33,7 +33,6 @@
>>>   #include "hw/qdev-properties.h"
>>>   #include "hw/ide/piix.h"
>>>   #include "hw/isa/isa.h"
>>> -#include "hw/xen/xen.h"
>>>   #include "sysemu/runstate.h"
>>>   #include "migration/vmstate.h"
>>>   #include "hw/acpi/acpi_aml_interface.h"
>>> @@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
>>>   .class_init= piix3_class_init,
>>>   };
>>>   
>>> -static void piix3_xen_class_init(ObjectClass *klass, void *data)
>>> -{
>>> -DeviceClass *dc = DEVICE_CLASS(klass);
>>> -PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>>> -
>>> -k->realize = piix3_realize;
>>> -/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
>>> -k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
>>> -dc->vmsd = &vmstate_piix3;
>> 
>> IIUC, since this device is user-creatable, we can't simply remove it
>> without going thru the deprecation process. Alternatively we could
>> add a type alias:
>> 
>> -- >8 --
>> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
>> index 4b0ef65780..d94f7ea369 100644
>> --- a/softmmu/qdev-monitor.c
>> +++ b/softmmu/qdev-monitor.c
>> @@ -64,6 +64,7 @@ typedef struct QDevAlias
>> QEMU_ARCH_LOONGARCH)
>>   #define QEMU_ARCH_VIRTIO_CCW (QEMU_ARCH_S390X)
>>   #define QEMU_ARCH_VIRTIO_MMIO (QEMU_ARCH_M68K)
>> +#define QEMU_ARCH_XEN (QEMU_ARCH_ARM | QEMU_ARCH_I386)
>> 
>>   /* Please keep this table sorted by typename. */
>>   static const QDevAlias qdev_alias_table[] = {
>> @@ -111,6 +112,7 @@ static const QDevAlias qdev_alias_table[] = {
>>   { "virtio-tablet-device", "virtio-tablet", QEMU_ARCH_VIRTIO_MMIO },
>>   { "virtio-tablet-ccw", "virtio-tablet", QEMU_ARCH_VIRTIO_CCW },
>>   { "virtio-tablet-pci", "virtio-tablet", QEMU_ARCH_VIRTIO_PCI },
>> +{ "PIIX3", "PIIX3-xen", QEMU_ARCH_XEN },
>
>Hi Bernhard,
>
>Can you comment if this should be:
>
>+{ "PIIX", "PIIX3-xen", QEMU_ARCH_XEN },
>
>instead? IIUC, the patch series also removed PIIX3 and PIIX4 and
>replaced them with PIIX. Or am I not understanding correctly?

PIIX3 is correct. The PIIX consolidation is just about sharing code between the 
PIIX3 and PIIX4 south bridges and should not cause any user or guest observable 
differences.

Best regards,
Bernhard

>
>Best regards,
>
>Chuck
>
>
>>   { }
>>   };
>> ---
>> 
>> But I'm not sure due to this comment from commit ee46d8a503
>> (2011-12-22 15:24:20 -0600):
>> 
>> 47) /*
>> 48)  * Aliases were a bad idea from the start.  Let's keep them
>> 49)  * from spreading further.
>> 50)  */
>> 
>> Maybe using qdev_alias_table[] during device deprecation is
>> acceptable?
>> 
>>> -}
>>> -
>>> -static const TypeInfo piix3_xen_info = {
>>> -.name  = TYPE_PIIX3_XEN_DEVICE,
>>> -.parent= TYPE_PIIX_PCI_DEVICE,
>>> -.instance_init = piix3_init,
>>> -.class_init= piix3_xen_class_init,
>>> -};
>>> -
>>>   static void piix4_realize(PCIDevice *dev, Error **errp)
>>>   {
>>>   ERRP_GUARD();
>>> @@ -534,7 +515,6 @@ static void piix3_register_types(void)
>>>   {
>>>   type_register_static(&piix_pci_type_info);
>>>   type_register_static(&piix3_info);
>>> -type_register_static(&piix3_xen_info);
>>>   type_register_static(&piix4_info);
>>>   }

Re: [PATCH v6] xen/pt: reserve PCI slot 2 for Intel igd-passthru

[Chuck Zmudzinski]

On 1/3/23 10:14 AM, Alex Williamson wrote:

> 
> It's necessary to configure the assigned IGD at slot 2 to make it
> functional, yes, but I don't really understand this notion of
> "reserving" slot 2.  If something occupies address 00:02.0 in the
> config, it's the user's or management tool's responsibility to move it
> to make this configuration functional.  Why does QEMU need to play a
> part in reserving this bus address.  IGD devices are not generally
> hot-pluggable either, so it doesn't seem we need to reserve an address
> in case an IGD device is added dynamically later.

The capability to reserve a bus address for a quirky device need not
be limited to the case of hotplugged or dynamically added devices. The
igd is a quirky device, and its presence in an emulated system like
qemu requires special handling. The slot_reserved_mask member of PCIBus
is also well-suited to the case of quirky device like Intel the igd that
needs to be at slot 2. Just because it is not dynamically added later
does not change the fact that it needs special handling at its initial
configuration when the guest is being created.

>  

Here's the problem that answers Michael's question why this patch is
specific to xen:

---snip---
#ifdef CONFIG_XEN

...

static void pc_xen_hvm_init(MachineState *machine)
{
PCMachineState *pcms = PC_MACHINE(machine);

if (!xen_enabled()) {
error_report("xenfv machine requires the xen accelerator");
exit(1);
}

pc_xen_hvm_init_pci(machine);
pci_create_simple(pcms->bus, -1, "xen-platform");
}
#endif
---snip---

This code is from hw/i386/pc_piix.c. Note the call to
pci_create_simple to create the xen platform pci device,
which has -1 as the second argument. That -1 tells
pci_create_simple to autoconfigure the pci bdf address.

It is *hard-coded* that way. That means no toolstack or
management tool can change it. And what is hard-coded here
is that the xen platform device will occupy slot 2, preventing
the Intel igd or any other device from occupying slot 2.

So, even if xen developers wanted to create a version of the
libxl that is flexible enough to allow the xen platform device
to be at a different slot, they could not without patching
qemu to at least change that -1 to an initialization variable
that can be read from a qemu command line option that libxl
could configure.

So, why not just accept this patch as the best way to deal
with a xen-specific problem and fix it in a way that uses
the xen/libxl philosophy of autoconfiguring things as much as
possible except in cases of quirky devices like the Intel igd
in which case the existing slot_reserved_mask member of PCIBus
is very useful to accommodate the quirky igd device?

IMHO, trying to impose the kvm/libvirt philosophy of having
a very configurable toolstack on the xen/xenlight philosophy
of autoconfiguring things that can be autoconfigured and
using higher-level configuration options like igd-passthrough=on
to tweak how autoconfiguration is done in a way that is compatible
with quirky devices like the Intel igd is like trying to put
a square peg into a round hole. Actually, qemu with its qom is
able to accommodate both approaches to the design of a toolstack,
and each vendor or project that depends on qemu should be free to
use the approach it prefers.

Just my two cents, FWIW.

Kind regards,

Chuck

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Chuck Zmudzinski]

On 1/4/23 3:44 PM, Bernhard Beschow wrote:
> 
> 
> Am 4. Januar 2023 17:54:16 UTC schrieb Chuck Zmudzinski :
>>On 1/4/23 10:35 AM, Philippe Mathieu-Daudé wrote:
>>> +Markus/Thomas
>>> 
>>> On 4/1/23 15:44, Bernhard Beschow wrote:
 During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
 TYPE_PIIX3_DEVICE. Remove this redundancy.
 
 Signed-off-by: Bernhard Beschow 
 ---
   hw/i386/pc_piix.c |  4 +---
   hw/isa/piix.c | 20 
   include/hw/southbridge/piix.h |  1 -
   3 files changed, 1 insertion(+), 24 deletions(-)
 
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 5738d9cdca..6b8de3d59d 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
 @@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
   if (pcmc->pci_enabled) {
   DeviceState *dev;
   PCIDevice *pci_dev;
 -const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
 - : TYPE_PIIX3_DEVICE;
   int i;
   
   pci_bus = i440fx_init(pci_type,
 @@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
  : pci_slot_get_pirq);
   pcms->bus = pci_bus;
   
 -pci_dev = pci_new_multifunction(-1, true, type);
 +pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
   object_property_set_bool(OBJECT(pci_dev), "has-usb",
machine_usb(machine), &error_abort);
   object_property_set_bool(OBJECT(pci_dev), "has-acpi",
 diff --git a/hw/isa/piix.c b/hw/isa/piix.c
 index 98e9b12661..e4587352c9 100644
 --- a/hw/isa/piix.c
 +++ b/hw/isa/piix.c
 @@ -33,7 +33,6 @@
   #include "hw/qdev-properties.h"
   #include "hw/ide/piix.h"
   #include "hw/isa/isa.h"
 -#include "hw/xen/xen.h"
   #include "sysemu/runstate.h"
   #include "migration/vmstate.h"
   #include "hw/acpi/acpi_aml_interface.h"
 @@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
   .class_init= piix3_class_init,
   };
   
 -static void piix3_xen_class_init(ObjectClass *klass, void *data)
 -{
 -DeviceClass *dc = DEVICE_CLASS(klass);
 -PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 -
 -k->realize = piix3_realize;
 -/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
 -k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
 -dc->vmsd = &vmstate_piix3;
>>> 
>>> IIUC, since this device is user-creatable, we can't simply remove it
>>> without going thru the deprecation process. Alternatively we could
>>> add a type alias:
>>> 
>>> -- >8 --
>>> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
>>> index 4b0ef65780..d94f7ea369 100644
>>> --- a/softmmu/qdev-monitor.c
>>> +++ b/softmmu/qdev-monitor.c
>>> @@ -64,6 +64,7 @@ typedef struct QDevAlias
>>> QEMU_ARCH_LOONGARCH)
>>>   #define QEMU_ARCH_VIRTIO_CCW (QEMU_ARCH_S390X)
>>>   #define QEMU_ARCH_VIRTIO_MMIO (QEMU_ARCH_M68K)
>>> +#define QEMU_ARCH_XEN (QEMU_ARCH_ARM | QEMU_ARCH_I386)
>>> 
>>>   /* Please keep this table sorted by typename. */
>>>   static const QDevAlias qdev_alias_table[] = {
>>> @@ -111,6 +112,7 @@ static const QDevAlias qdev_alias_table[] = {
>>>   { "virtio-tablet-device", "virtio-tablet", QEMU_ARCH_VIRTIO_MMIO },
>>>   { "virtio-tablet-ccw", "virtio-tablet", QEMU_ARCH_VIRTIO_CCW },
>>>   { "virtio-tablet-pci", "virtio-tablet", QEMU_ARCH_VIRTIO_PCI },
>>> +{ "PIIX3", "PIIX3-xen", QEMU_ARCH_XEN },
>>
>>Hi Bernhard,
>>
>>Can you comment if this should be:
>>
>>+{ "PIIX", "PIIX3-xen", QEMU_ARCH_XEN },
>>
>>instead? IIUC, the patch series also removed PIIX3 and PIIX4 and
>>replaced them with PIIX. Or am I not understanding correctly?
> 
> PIIX3 is correct. The PIIX consolidation is just about sharing code between 
> the PIIX3 and PIIX4 south bridges and should not cause any user or guest 
> observable differences.

I realize that now. I see the PIIX3 device still exists after applying the 
patch set.
Thanks,

Chuck

Re: [PATCH v2 6/6] hw/isa/piix: Resolve redundant TYPE_PIIX3_XEN_DEVICE

[Chuck Zmudzinski]

On 1/4/23 3:31 PM, Bernhard Beschow wrote:
> 
> 
> Am 4. Januar 2023 19:29:35 UTC schrieb Chuck Zmudzinski :
>>On 1/4/23 1:48 PM, Philippe Mathieu-Daudé wrote:
>>> On 4/1/23 18:54, Chuck Zmudzinski wrote:
 On 1/4/23 10:35 AM, Philippe Mathieu-Daudé wrote:
> +Markus/Thomas
>
> On 4/1/23 15:44, Bernhard Beschow wrote:
>> During the last patches, TYPE_PIIX3_XEN_DEVICE turned into a clone of
>> TYPE_PIIX3_DEVICE. Remove this redundancy.
>>
>> Signed-off-by: Bernhard Beschow 
>> ---
>>hw/i386/pc_piix.c |  4 +---
>>hw/isa/piix.c | 20 
>>include/hw/southbridge/piix.h |  1 -
>>3 files changed, 1 insertion(+), 24 deletions(-)
>>
>> diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
>> index 5738d9cdca..6b8de3d59d 100644
>> --- a/hw/i386/pc_piix.c
>> +++ b/hw/i386/pc_piix.c
>> @@ -235,8 +235,6 @@ static void pc_init1(MachineState *machine,
>>if (pcmc->pci_enabled) {
>>DeviceState *dev;
>>PCIDevice *pci_dev;
>> -const char *type = xen_enabled() ? TYPE_PIIX3_XEN_DEVICE
>> - : TYPE_PIIX3_DEVICE;
>>int i;
>>
>>pci_bus = i440fx_init(pci_type,
>> @@ -250,7 +248,7 @@ static void pc_init1(MachineState *machine,
>>   : pci_slot_get_pirq);
>>pcms->bus = pci_bus;
>>
>> -pci_dev = pci_new_multifunction(-1, true, type);
>> +pci_dev = pci_new_multifunction(-1, true, TYPE_PIIX3_DEVICE);
>>object_property_set_bool(OBJECT(pci_dev), "has-usb",
>> machine_usb(machine), &error_abort);
>>object_property_set_bool(OBJECT(pci_dev), "has-acpi",
>> diff --git a/hw/isa/piix.c b/hw/isa/piix.c
>> index 98e9b12661..e4587352c9 100644
>> --- a/hw/isa/piix.c
>> +++ b/hw/isa/piix.c
>> @@ -33,7 +33,6 @@
>>#include "hw/qdev-properties.h"
>>#include "hw/ide/piix.h"
>>#include "hw/isa/isa.h"
>> -#include "hw/xen/xen.h"
>>#include "sysemu/runstate.h"
>>#include "migration/vmstate.h"
>>#include "hw/acpi/acpi_aml_interface.h"
>> @@ -465,24 +464,6 @@ static const TypeInfo piix3_info = {
>>.class_init= piix3_class_init,
>>};
>>
>> -static void piix3_xen_class_init(ObjectClass *klass, void *data)
>> -{
>> -DeviceClass *dc = DEVICE_CLASS(klass);
>> -PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>> -
>> -k->realize = piix3_realize;
>> -/* 82371SB PIIX3 PCI-to-ISA bridge (Step A1) */
>> -k->device_id = PCI_DEVICE_ID_INTEL_82371SB_0;
>> -dc->vmsd = &vmstate_piix3;
>
> IIUC, since this device is user-creatable, we can't simply remove it
> without going thru the deprecation process. Alternatively we could
> add a type alias:
>
> -- >8 --
> diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
> index 4b0ef65780..d94f7ea369 100644
> --- a/softmmu/qdev-monitor.c
> +++ b/softmmu/qdev-monitor.c
> @@ -64,6 +64,7 @@ typedef struct QDevAlias
>  QEMU_ARCH_LOONGARCH)
>#define QEMU_ARCH_VIRTIO_CCW (QEMU_ARCH_S390X)
>#define QEMU_ARCH_VIRTIO_MMIO (QEMU_ARCH_M68K)
> +#define QEMU_ARCH_XEN (QEMU_ARCH_ARM | QEMU_ARCH_I386)
>
>/* Please keep this table sorted by typename. */
>static const QDevAlias qdev_alias_table[] = {
> @@ -111,6 +112,7 @@ static const QDevAlias qdev_alias_table[] = {
>{ "virtio-tablet-device", "virtio-tablet", QEMU_ARCH_VIRTIO_MMIO },
>{ "virtio-tablet-ccw", "virtio-tablet", QEMU_ARCH_VIRTIO_CCW },
>{ "virtio-tablet-pci", "virtio-tablet", QEMU_ARCH_VIRTIO_PCI },
> +{ "PIIX3", "PIIX3-xen", QEMU_ARCH_XEN },
 
 Hi Bernhard,
 
 Can you comment if this should be:
 
 +{ "PIIX", "PIIX3-xen", QEMU_ARCH_XEN },
 
 instead? IIUC, the patch series also removed PIIX3 and PIIX4 and
 replaced them with PIIX. Or am I not understanding correctly?
>>> 
>>> There is a confusion in QEMU between PCI bridges, the first PCI
>>> function they implement, and the other PCI functions.
>>> 
>>> Here TYPE_PIIX3_DEVICE means for "PCI function part of the PIIX
>>> south bridge chipset, which expose a PCI-to-ISA bridge". A better
>>> name could be TYPE_PIIX3_ISA_PCI_DEVICE. Unfortunately this
>>> device is named "PIIX3" with no indication of ISA bridge.
>>
>>
>>Thanks, you are right, I see the PIIX3 device still exists after
>>this patch set is applied.
>>
>>chuckz@debian:~/sources-sid/qemu/qemu-7.50+dfsg/hw/i386$ grep -r PIIX3 *
>>pc_piix.c:pci_dev = pci_new_multifunction(-1, true, 
>>TYPE_PIIX3_DEVICE);
>>
>>I also understand there is the PCI-to-ISA bridge at 00:01.0

Re: [PATCH v4 12/30] hw/core: Introduce proxy-pic

[Bernhard Beschow]

Am 4. Januar 2023 20:31:15 UTC schrieb "Philippe Mathieu-Daudé" 
:
>On 4/1/23 21:12, Bernhard Beschow wrote:
>> 
>> 
>> Am 4. Januar 2023 16:35:57 UTC schrieb "Philippe Mathieu-Daudé" 
>> :
>>> On 4/1/23 17:01, Bernhard Beschow wrote:
 Am 4. Januar 2023 14:37:29 UTC schrieb "Philippe Mathieu-Daudé" 
 :
> On 21/12/22 17:59, Bernhard Beschow wrote:
>> Having a proxy PIC allows for ISA PICs to be created and wired up in
>> southbridges. This is especially useful for PIIX3 for two reasons:
>> First, the southbridge doesn't need to care about the virtualization
>> technology used (KVM, TCG, Xen) due to in-IRQs (where devices get
>> attached) and out-IRQs (which will trigger the IRQs of the respective
>> virtzalization technology) are separated. Second, since the in-IRQs are
>>> 
>>> Typo "virtualization".
>> 
>> Fixed...
>
>
> Why restrict to 16 and not use a class property and allocate
> on the heap? See TYPE_SPLIT_IRQ for example.
 
 TYPE_SPLIT_IRQ doesn't allocate on the heap and instead has a hardcoded 
 limit of MAX_SPLIT_LINES which equals 16 ;)
 
 I was unsure on when to free the memory and how to dispose the elements so 
 I went with this solution for simplicity. I'll look for inspitation in 
 other device models and respin.
>>> 
>>> Oh indeed. Well this model as is is OK, but it could be more useful
>>> if able to proxy any range of IRQs.
>> 
>> I've responded with a new, single patch to this patch. Is that okay or shall 
>> I respin the whole series? Is anything missing? IIUC we can make the 
>> proxy-pic dynamic in a follow-up?
>
>I think we are good :) If you can point me to a branch with all your patches, 
>I could verify everything is properly applied locally.

Sure, here we go: https://github.com/shentok/qemu/commits/piix-consolidate

Thanks for your help and for picking up this beast ;)

>
>>> I have the feeling we are cycling around this IRQ proxy:
>>> 
>>> 22ec3283ef ("irq: introduce qemu_irq_proxy()")
>>> 078778c5a5 ("piix4: Add an i8259 Interrupt Controller as specified in 
>>> datasheet")
>>> fc531e7cab ("Revert "irq: introduce qemu_irq_proxy()"")
>>> 
>>> What is our problem? IRQ lines connect 2 devices in a fixed direction.
>>> Current model expects one edge to be wired to a device before wiring
>>> the other device, so device composition with IRQs in middle is
>>> impossible? If so, this doesn't scale with dynamic machine creation.
>> 
>> My PIIX consolidation series and even more so my effort to make the VT82xx 
>> south bridges work with the PC machine are indeed bottom-up explorations of 
>> dynamic/flexible machine creation.
>
>Yeah (I have been there too...).

I've seen it. Eventually I'll also pick up your work of eliminating the isabus 
global...

Best regards,
Bernhard

> Also Mark Cave-Ayland confirmed
>elsewhere in this thread that yourv effort points toward the right
>direction :)
>
>Regards,
>
>Phil.

[PULL 5/5] python: add 3.11 to supported list

[John Snow]

Signed-off-by: John Snow 
Reviewed-by: Wilfred Mallawa 
Message-id: 20221203005234.620788-4-js...@redhat.com
Signed-off-by: John Snow 
---
 python/setup.cfg | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/python/setup.cfg b/python/setup.cfg
index c0d7bab168e..56418157065 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -19,6 +19,7 @@ classifiers =
 Programming Language :: Python :: 3.8
 Programming Language :: Python :: 3.9
 Programming Language :: Python :: 3.10
+Programming Language :: Python :: 3.11
 Typing :: Typed
 
 [options]
@@ -159,7 +160,7 @@ multi_line_output=3
 # of python available on your system to run this test.
 
 [tox:tox]
-envlist = py36, py37, py38, py39, py310
+envlist = py36, py37, py38, py39, py310, py311
 skip_missing_interpreters = true
 
 [testenv]
-- 
2.39.0

[PULL 3/5] Python: fix flake8 config

[John Snow]

Newer flake8 versions are a bit pickier about the config file, and my
in-line comment confuses the parser. Fix it.

Signed-off-by: John Snow 
Reviewed-by: Wilfred Mallawa 
Message-id: 20221203005234.620788-2-js...@redhat.com
Signed-off-by: John Snow 
---
 python/setup.cfg | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/python/setup.cfg b/python/setup.cfg
index c2c61c75190..c0d7bab168e 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -71,7 +71,8 @@ console_scripts =
 qmp-tui = qemu.qmp.qmp_tui:main [tui]
 
 [flake8]
-extend-ignore = E722  # Prefer pylint's bare-except checks to flake8's
+# Prefer pylint's bare-except checks to flake8's
+extend-ignore = E722
 exclude = __pycache__,
 
 [mypy]
-- 
2.39.0

[PULL 4/5] iotests/check: Fix typing for sys.exit() value

[John Snow]

Signed-off-by: John Snow 
Reviewed-by: Wilfred Mallawa 
Message-id: 20221203005234.620788-3-js...@redhat.com
Signed-off-by: John Snow 
---
 tests/qemu-iotests/check | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/check b/tests/qemu-iotests/check
index 75de1b4691e..9bdda1394e7 100755
--- a/tests/qemu-iotests/check
+++ b/tests/qemu-iotests/check
@@ -159,7 +159,7 @@ if __name__ == '__main__':
 if not tests:
 raise ValueError('No tests selected')
 except ValueError as e:
-sys.exit(e)
+sys.exit(str(e))
 
 if args.dry_run:
 print('\n'.join(tests))
-- 
2.39.0

[PULL 1/5] python/machine: Add debug logging to key state changes

[John Snow]

When key decisions are made about the lifetime of the VM process being
managed, there's no log entry. Juxtaposed with the very verbose runstate
change logging of the QMP module, machine seems a bit too introverted
now.

Season the machine.py module with logging statements to taste to help
make a tastier soup.

Signed-off-by: John Snow 
---
 python/qemu/machine/machine.py | 25 +
 1 file changed, 25 insertions(+)

diff --git a/python/qemu/machine/machine.py b/python/qemu/machine/machine.py
index 37191f433b2..6f1374a7550 100644
--- a/python/qemu/machine/machine.py
+++ b/python/qemu/machine/machine.py
@@ -373,6 +373,7 @@ def _post_shutdown(self) -> None:
 Called to cleanup the VM instance after the process has exited.
 May also be called after a failed launch.
 """
+LOG.debug("Cleaning up after VM process")
 try:
 self._close_qmp_connection()
 except Exception as err:  # pylint: disable=broad-except
@@ -497,6 +498,7 @@ def _early_cleanup(self) -> None:
 # for QEMU to exit, while QEMU is waiting for the socket to
 # become writable.
 if self._console_socket is not None:
+LOG.debug("Closing console socket")
 self._console_socket.close()
 self._console_socket = None
 
@@ -507,6 +509,7 @@ def _hard_shutdown(self) -> None:
 :raise subprocess.Timeout: When timeout is exceeds 60 seconds
 waiting for the QEMU process to terminate.
 """
+LOG.debug("Performing hard shutdown")
 self._early_cleanup()
 self._subp.kill()
 self._subp.wait(timeout=60)
@@ -523,8 +526,18 @@ def _soft_shutdown(self, timeout: Optional[int]) -> None:
 :raise subprocess.TimeoutExpired: When timeout is exceeded waiting for
 the QEMU process to terminate.
 """
+LOG.debug("Attempting graceful termination")
+
 self._early_cleanup()
 
+if self._quit_issued:
+LOG.debug(
+"Anticipating QEMU termination due to prior 'quit' command, "
+"or explicit call to wait()"
+)
+else:
+LOG.debug("Politely asking QEMU to terminate")
+
 if self._qmp_connection:
 try:
 if not self._quit_issued:
@@ -536,6 +549,10 @@ def _soft_shutdown(self, timeout: Optional[int]) -> None:
 self._close_qmp_connection()
 
 # May raise subprocess.TimeoutExpired
+LOG.debug(
+"Waiting (timeout=%s) for QEMU process (pid=%s) to terminate",
+timeout, self._subp.pid
+)
 self._subp.wait(timeout=timeout)
 
 def _do_shutdown(self, timeout: Optional[int]) -> None:
@@ -553,6 +570,10 @@ def _do_shutdown(self, timeout: Optional[int]) -> None:
 try:
 self._soft_shutdown(timeout)
 except Exception as exc:
+if isinstance(exc, subprocess.TimeoutExpired):
+LOG.debug("Timed out waiting for QEMU process to exit")
+LOG.debug("Graceful shutdown failed", exc_info=True)
+LOG.debug("Falling back to hard shutdown")
 self._hard_shutdown()
 raise AbnormalShutdown("Could not perform graceful shutdown") \
 from exc
@@ -575,6 +596,10 @@ def shutdown(self,
 if not self._launched:
 return
 
+LOG.debug("Shutting down VM appliance; timeout=%s", timeout)
+if hard:
+LOG.debug("Caller requests immediate termination of QEMU process.")
+
 try:
 if hard:
 self._user_killed = True
-- 
2.39.0

[PULL 0/5] Python patches

[John Snow]

The following changes since commit ecc9a58835f8d4ea4e3ed36832032a71ee08fbb2:

  Merge tag 'pull-9p-20221223' of https://github.com/cschoenebeck/qemu into 
staging (2023-01-04 14:53:59 +)

are available in the Git repository at:

  https://gitlab.com/jsnow/qemu.git tags/python-pull-request

for you to fetch changes up to 519f3cfce07a067971ff39d4a989b77e7100a947:

  python: add 3.11 to supported list (2023-01-04 13:46:05 -0500)


Python patch roundup

Mostly CI fixes and some small debugging improvements.



John Snow (5):
  python/machine: Add debug logging to key state changes
  python/machine: Handle termination cases without QMP
  Python: fix flake8 config
  iotests/check: Fix typing for sys.exit() value
  python: add 3.11 to supported list

 python/qemu/machine/machine.py | 31 +++
 python/setup.cfg   |  6 --
 tests/qemu-iotests/check   |  2 +-
 3 files changed, 36 insertions(+), 3 deletions(-)

-- 
2.39.0

[PULL 2/5] python/machine: Handle termination cases without QMP

[John Snow]

If we request a shutdown of a VM without a QMP console, we'll just hang
waiting. Not ideal.

Add in code that attempts graceful termination in these cases.  Tested
lightly; it appears to work and I doubt we rely on this case anywhere,
but it's a corner you're allowed to wedge yourself in, so it should be
handled.

Signed-off-by: John Snow 
---
 python/qemu/machine/machine.py | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/python/qemu/machine/machine.py b/python/qemu/machine/machine.py
index 6f1374a7550..748a0d807c9 100644
--- a/python/qemu/machine/machine.py
+++ b/python/qemu/machine/machine.py
@@ -547,6 +547,12 @@ def _soft_shutdown(self, timeout: Optional[int]) -> None:
 finally:
 # Regardless, we want to quiesce the connection.
 self._close_qmp_connection()
+elif not self._quit_issued:
+LOG.debug(
+"Not anticipating QEMU quit and no QMP connection present, "
+"issuing SIGTERM"
+)
+self._subp.terminate()
 
 # May raise subprocess.TimeoutExpired
 LOG.debug(
-- 
2.39.0

[PATCH] hw/timer/ibex: fix register addresses

[Andrew Zoghby]

Change the register addresses to match
https://docs.opentitan.org/hw/ip/rv_timer/doc/#register-table.

Signed-off-by: Andrew Zoghby 
---
 hw/timer/ibex_timer.c | 21 ++---
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
index d8b8e4e1f6..a8a23b22d7 100644
--- a/hw/timer/ibex_timer.c
+++ b/hw/timer/ibex_timer.c
@@ -38,20 +38,19 @@ REG32(ALERT_TEST, 0x00)
 FIELD(ALERT_TEST, FATAL_FAULT, 0, 1)
 REG32(CTRL, 0x04)
 FIELD(CTRL, ACTIVE, 0, 1)
-REG32(CFG0, 0x100)
-FIELD(CFG0, PRESCALE, 0, 12)
-FIELD(CFG0, STEP, 16, 8)
-REG32(LOWER0, 0x104)
-REG32(UPPER0, 0x108)
-REG32(COMPARE_LOWER0, 0x10C)
-REG32(COMPARE_UPPER0, 0x110)
-REG32(INTR_ENABLE, 0x114)
+REG32(INTR_ENABLE, 0x100)
 FIELD(INTR_ENABLE, IE_0, 0, 1)
-REG32(INTR_STATE, 0x118)
+REG32(INTR_STATE, 0x104)
 FIELD(INTR_STATE, IS_0, 0, 1)
-REG32(INTR_TEST, 0x11C)
+REG32(INTR_TEST, 0x108)
 FIELD(INTR_TEST, T_0, 0, 1)
-
+REG32(CFG0, 0x10c)
+FIELD(CFG0, PRESCALE, 0, 12)
+FIELD(CFG0, STEP, 16, 8)
+REG32(LOWER0, 0x110)
+REG32(UPPER0, 0x114)
+REG32(COMPARE_LOWER0, 0x118)
+REG32(COMPARE_UPPER0, 0x11c)
 static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
 {
 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-- 
2.34.1

Re: [PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[Paolo Bonzini]

blk_root_drained_end is not thread-safe too. I started looking at that with
https://www.mail-archive.com/qemu-devel@nongnu.org/msg925670.html; that's
certainly a prerequisite for this patch to be a full fix, but I have not
checked if it's enough because I don't have the QEMU sources at hand right
now.

Paolo

Il mer 4 gen 2023, 20:56 Stefan Hajnoczi  ha scritto:

> scsi_device_purge_requests() is called from I/O code by virtio-scsi TMF
> emulation code. It must not call Global State APIs like blk_drain()
> because that results in an assertion failure.
>
> blk_drain() is a Global State API because it uses bdrv_unref(). Actually
> ref/unref is unnecessary in device emulation code because the drive=
> qdev property holds the reference.
>
> Introduce blk_drain_noref(), a variant of blk_drain() that is
> IO_OR_GS_CODE() and doesn't take a reference to the BlockBackend.
>
> This fixes the following virtio-scsi IOThread assertion failure when
> hot-plugging scsi-hd devices:
>
>   qemu-kvm: ../block/block-backend.c:1780: void blk_drain(BlockBackend *):
> Assertion `qemu_in_main_thread()' failed.
>
>   #0  0x7f4b6a0a154c __pthread_kill_implementation (libc.so.6>
>   #1  0x7f4b6a054d46 raise (libc.so.6 + 0x54d46)
>   #2  0x7f4b6a0287f3 abort (libc.so.6 + 0x287f3)
>   #3  0x7f4b6a02871b __assert_fail_base.cold (libc.so.6 + 0x2>
>   #4  0x7f4b6a04dce6 __assert_fail (libc.so.6 + 0x4dce6)
>   #5  0x55c811253ac0 blk_drain (qemu-kvm + 0x808ac0)
>   #6  0x55c810ecb951 scsi_device_purge_requests (qemu-kvm + 0>
>  ^^
>   #7  0x55c810ed6ab8 scsi_disk_reset (qemu-kvm + 0x48bab8)
>   #8  0x55c8111dc908 resettable_phase_hold (qemu-kvm + 0x7919>
>   #9  0x55c8111db7f0 device_cold_reset (qemu-kvm + 0x7907f0)
>   #10 0x55c8110bb1a6 virtio_scsi_handle_ctrl (qemu-kvm + 0x67>
>   #11 0x55c8110d458f virtio_queue_host_notifier_read (qemu-kv>
>   #12 0x55c811404a73 aio_dispatch_handler (qemu-kvm + 0x9b9a7>
>   #13 0x55c811405743 aio_poll (qemu-kvm + 0x9ba743)
>   #14 0x55c81121d532 iothread_run (qemu-kvm + 0x7d2532)
>   #15 0x55c81140926a qemu_thread_start (qemu-kvm + 0x9be26a)
>   #16 0x7f4b6a09f802 start_thread (libc.so.6 + 0x9f802)
>   #17 0x7f4b6a03f450 __clone3 (libc.so.6 + 0x3f450)
>
> Reported-by: Qing Wang 
> Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2155748
> Cc: Paolo Bonzini 
> Cc: Kevin Wolf 
> Cc: Emanuele Giuseppe Esposito 
> Signed-off-by: Stefan Hajnoczi 
> ---
>  include/sysemu/block-backend-io.h |  1 +
>  block/block-backend.c | 23 +++
>  hw/scsi/scsi-bus.c|  2 +-
>  3 files changed, 25 insertions(+), 1 deletion(-)
>
> diff --git a/include/sysemu/block-backend-io.h
> b/include/sysemu/block-backend-io.h
> index 7ec6d978d4..f73db1f77c 100644
> --- a/include/sysemu/block-backend-io.h
> +++ b/include/sysemu/block-backend-io.h
> @@ -73,6 +73,7 @@ void blk_iostatus_set_err(BlockBackend *blk, int error);
>  int blk_get_max_iov(BlockBackend *blk);
>  int blk_get_max_hw_iov(BlockBackend *blk);
>
> +void blk_drain_noref(BlockBackend *blk);
>  void blk_io_plug(BlockBackend *blk);
>  void blk_io_unplug(BlockBackend *blk);
>  AioContext *blk_get_aio_context(BlockBackend *blk);
> diff --git a/block/block-backend.c b/block/block-backend.c
> index ba7bf1d6bc..20914bae7b 100644
> --- a/block/block-backend.c
> +++ b/block/block-backend.c
> @@ -1815,6 +1815,29 @@ void blk_drain(BlockBackend *blk)
>  }
>  }
>
> +/*
> + * Same as blk_drain() but the caller must hold a reference to blk. May be
> + * called from Global State or I/O API code. Device emulation can call
> this
> + * because the qdev drive= property holds the reference.
> + */
> +void blk_drain_noref(BlockBackend *blk)
> +{
> +BlockDriverState *bs = blk_bs(blk);
> +IO_OR_GS_CODE();
> +
> +if (bs) {
> +bdrv_drained_begin(bs);
> +}
> +
> +/* We may have -ENOMEDIUM completions in flight */
> +AIO_WAIT_WHILE(blk_get_aio_context(blk),
> +   qatomic_mb_read(&blk->in_flight) > 0);
> +
> +if (bs) {
> +bdrv_drained_end(bs);
> +}
> +}
> +
>  void blk_drain_all(void)
>  {
>  BlockBackend *blk = NULL;
> diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
> index ceceafb2cd..110fd85106 100644
> --- a/hw/scsi/scsi-bus.c
> +++ b/hw/scsi/scsi-bus.c
> @@ -1663,7 +1663,7 @@ void scsi_device_purge_requests(SCSIDevice *sdev,
> SCSISense sense)
>  req = QTAILQ_FIRST(&sdev->requests);
>  scsi_req_cancel_async(req, NULL);
>  }
> -blk_drain(sdev->conf.blk);
> +blk_drain_noref(sdev->conf.blk);
>  aio_context_release(blk_get_aio_context(sdev->conf.blk));
>  scsi_device_set_ua(sdev, sense);
>  }
> --
> 2.39.0
>
>

RE: [PATCH v2] Hexagon (target/hexagon) implement mutability mask for GPRs

[Taylor Simpson]

> -Original Message-
> From: Marco Liebel 
> Sent: Wednesday, January 4, 2023 2:28 AM
> To: Taylor Simpson ; Marco Liebel (QUIC)
> ; qemu-devel@nongnu.org
> Cc: Brian Cain 
> Subject: RE: [PATCH v2] Hexagon (target/hexagon) implement mutability
> mask for GPRs
> 
> > -Original Message-
> > From: Taylor Simpson 
> > Sent: Mittwoch, 21. Dezember 2022 21:06
> > To: Marco Liebel ; Marco Liebel (QUIC)
> > ; qemu-devel@nongnu.org
> > Cc: Brian Cain 
> > Subject: RE: [PATCH v2] Hexagon (target/hexagon) implement mutability
> > mask for GPRs
> >
> >
> >
> > > -Original Message-
> > > From: Marco Liebel 
> > > Sent: Wednesday, December 21, 2022 1:34 PM
> > > To: Taylor Simpson ; Marco Liebel (QUIC)
> > > ; qemu-devel@nongnu.org
> > > Cc: Brian Cain 
> > > Subject: RE: [PATCH v2] Hexagon (target/hexagon) implement
> > > mutability mask for GPRs
> > >
> > > > > +#define WRITE_REG_IN_PACKET(reg_name, output, input) \
> > > > > +asm volatile("{ " reg_name " = %1 }\n\t" \
> > > >
> > > > This is no different from the WRITE_REG above.  Instructions on a
> > > > line with no curly braces are a single packet.
> > > >
> > >
> > > Understood. The feedback on Brian's patch said to write tests that
> > > do transfers in a packet. Should I write some? (Just not in the way
> > > I did it above)
> >
> > Put some more instructions in the packet with the assignment.  I
> > recommend a read from the same register and verify you get the old value.
> >
> 
> Reading and writing a control register in a single packet isn't possible,
> because CR instructions can only be executed in slot 3. I was thinking to put 
> a
> nop inside the packet, just so the packet gets generated. Or is there
> something else that's useful, other than reading the previous value?

You are right.  Let's move forward without any packet tests.  Sorry for the 
confusion.

Taylor

[RFC PATCH 02/27] target/arm: Fix checkpatch space errors in helper.c

[Fabiano Rosas]

Fix the following:

ERROR: spaces required around that '|' (ctx:VxV)
ERROR: space required before the open parenthesis '('
ERROR: spaces required around that '+' (ctx:VxB)
ERROR: space prohibited between function name and open parenthesis '('

(the last two still have some occurrences in macros which I left
behind because it might impact readability)

Reviewed-by: Claudio Fontana 
Reviewed-by: Cornelia Huck 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 42 +-
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 6703936a28..18e4680912 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -205,7 +205,7 @@ static void add_cpreg_to_list(gpointer key, gpointer opaque)
 uint32_t regidx = (uintptr_t)key;
 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 
-if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
+if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) {
 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
 /* The value array need not be initialized at this point */
 cpu->cpreg_array_len++;
@@ -219,7 +219,7 @@ static void count_cpreg(gpointer key, gpointer opaque)
 
 ri = g_hash_table_lookup(cpu->cp_regs, key);
 
-if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
+if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) {
 cpu->cpreg_array_len++;
 }
 }
@@ -2350,11 +2350,11 @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
   .resetfn = arm_cp_reset_ignore },
 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
   .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
-  .access = PL0_R|PL1_W,
+  .access = PL0_R | PL1_W,
   .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
   .resetvalue = 0},
 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
-  .access = PL0_R|PL1_W,
+  .access = PL0_R | PL1_W,
   .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
  offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
   .resetfn = arm_cp_reset_ignore },
@@ -4099,17 +4099,17 @@ static const ARMCPRegInfo cache_block_ops_cp_reginfo[] 
= {
   .resetvalue = 0 },
 /* The cache ops themselves: these all NOP for QEMU */
 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
-  .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
+  .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
-  .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
+  .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
-  .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
+  .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
-  .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
+  .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
-  .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
+  .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
-  .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
+  .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
 };
 
 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
@@ -8392,7 +8392,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 ARMCPRegInfo cbar = {
 .name = "CBAR",
 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
-.access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
+.access = PL1_R | PL3_W, .resetvalue = cpu->reset_cbar,
 .fieldoffset = offsetof(CPUARMState,
 cp15.c15_config_base_address)
 };
@@ -9359,11 +9359,11 @@ static void switch_mode(CPUARMState *env, int mode)
 return;
 
 if (old_mode == ARM_CPU_MODE_FIQ) {
-memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
-memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
+memcpy(env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
+memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
 } else if (mode == ARM_CPU_MODE_FIQ) {
-memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
-memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
+memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
+memcpy(env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
 }
 
 i = bank_number(old_mode);
@@ -10867,7 +10867,7 @@ static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
 RESULT(sum, n, 16); \
 if (sum >= 0) \
 ge |= 3 << (n * 2); \
-} while(0)
+} while (0)
 
 #define SARITH8(a, b, n, op) do { \
 int32_t sum; 

[RFC PATCH 00/27] target/arm: Allow CONFIG_TCG=n builds

[Fabiano Rosas]

This series makes the necessary changes to allow the use of
--disable-tcg for arm.

I have included the other two already reviewed series to facilitate
the merge. Patch 12 is the first from this series proper.

I could use some help with the last two patches which deal with the
fact that ptw.c needs CPUTLBEntryFull and probe_access_full which are
_currently_ only compiled with CONFIG_TCG=y.

The 3 cpregs patches were split from the larger commit[1] from the
original series. We're still left with one huge patch, but it is only
code movement, it can be checked with:

diff -u <(sed -n 's/^-//p' patch) <(sed -n 's/^\+//p' patch)

1- [RFC v14 14/80] target/arm: split cpregs from tcg/helper.c
   https://lore.kernel.org/r/20210416162824.25131-15-cfont...@suse.de

Claudio Fontana (12):
  target/arm: cleanup cpu includes
  target/arm: rename handle_semihosting to tcg_handle_semihosting
  target/arm: wrap psci call with tcg_enabled
  target/arm: wrap call to aarch64_sve_change_el in tcg_enabled()
  target/arm: only perform TCG cpu and machine inits if TCG enabled
  target/arm: move translate modules to tcg/
  target/arm: move helpers to tcg/
  target/arm: only build psci for TCG
  target/arm: make further preparation for the exception code to move
  tests: do not run test-hmp on all machines for ARM KVM-only
  tests: do not run qom-test on all machines for ARM KVM-only
  tests: device-introspect-test: cope with ARM TCG-only devices

Fabiano Rosas (15):
  target/arm: Fix checkpatch comment style warnings in helper.c
  target/arm: Fix checkpatch space errors in helper.c
  target/arm: Fix checkpatch brace errors in helper.c
  target/arm: Remove unused includes from m_helper.c
  target/arm: Remove unused includes from helper.c
  target/arm: Move PC alignment check
  target/arm: Add tcg/meson.build
  target/arm: Move regime_using_lpae_format into internal.h
  target/arm: Extract cpustate list manipulation to a file
  target/arm: Move cpregs code out of cpu.h
  target/arm: Move common cpregs code into a separate file
  target/arm: Move cpregs definitions into tcg/cpregs.c
  target/arm: Move hflags code into the tcg directory
  cpu-defs.h: Expose CPUTLBEntryFull to non-TCG code
  target/arm: don't access TCG code when debugging with KVM

 MAINTAINERS |1 +
 hw/arm/boot.c   |5 +-
 include/exec/cpu-defs.h |6 +
 target/arm/arm-powerctl.c   |8 +-
 target/arm/cpregs.c |  482 ++
 target/arm/cpregs.h |  103 +
 target/arm/cpu.c|   33 +-
 target/arm/cpu.h|   91 -
 target/arm/cpu64.c  |6 -
 target/arm/cpustate-list.c  |  148 +
 target/arm/helper.c | 9132 +--
 target/arm/internals.h  |   20 +-
 target/arm/kvm.c|   18 +-
 target/arm/kvm_arm.h|3 +-
 target/arm/machine.c|   58 +-
 target/arm/meson.build  |   49 +-
 target/arm/ptw.c|4 +
 target/arm/tcg-stubs.c  |   37 +
 target/arm/{ => tcg}/a32-uncond.decode  |0
 target/arm/{ => tcg}/a32.decode |0
 target/arm/tcg/cpregs.c | 8088 
 target/arm/{ => tcg}/crypto_helper.c|0
 target/arm/{ => tcg}/debug_helper.c |0
 target/arm/{ => tcg}/helper-a64.c   |0
 target/arm/tcg/hflags.c |  344 +
 target/arm/{ => tcg}/iwmmxt_helper.c|0
 target/arm/{ => tcg}/m-nocp.decode  |0
 target/arm/{ => tcg}/m_helper.c |   16 -
 target/arm/tcg/meson.build  |   52 +
 target/arm/{ => tcg}/mte_helper.c   |0
 target/arm/{ => tcg}/mve.decode |0
 target/arm/{ => tcg}/mve_helper.c   |0
 target/arm/{ => tcg}/neon-dp.decode |0
 target/arm/{ => tcg}/neon-ls.decode |0
 target/arm/{ => tcg}/neon-shared.decode |0
 target/arm/{ => tcg}/neon_helper.c  |0
 target/arm/{ => tcg}/op_helper.c|1 +
 target/arm/{ => tcg}/pauth_helper.c |0
 target/arm/{ => tcg}/psci.c |0
 target/arm/{ => tcg}/sme-fa64.decode|0
 target/arm/{ => tcg}/sme.decode |0
 target/arm/{ => tcg}/sme_helper.c   |0
 target/arm/{ => tcg}/sve.decode |0
 target/arm/{ => tcg}/sve_helper.c   |0
 target/arm/{ => tcg}/t16.decode |0
 target/arm/{ => tcg}/t32.decode |0
 target/arm/{ => tcg}/tlb_helper.c   |   14 -
 target/arm/{ => tcg}/translate-a64.c|1 +
 target/arm/{ => tcg}/translate-a64.h|0
 target/arm/{ => tcg}/translate-m-nocp.c |0
 target/arm/{ => tcg}/translate-mve.c|0
 target/arm/{ => tcg}/translate-neon.c   |0
 target/arm/{ => tcg}/translate-sme.c|0
 target/arm/{ => tcg}/translate-sve.c|0
 target/arm/{ => tcg}/translate-vfp.c|

[RFC PATCH 08/27] target/arm: wrap psci call with tcg_enabled

[Fabiano Rosas]

From: Claudio Fontana 

for "all" builds (tcg + kvm), we want to avoid doing
the psci check if tcg is built-in, but not enabled.

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 89c07a88ea..2bb302e5d2 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -22,6 +22,7 @@
 #include "hw/irq.h"
 #include "sysemu/cpu-timers.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "qapi/qapi-commands-machine-target.h"
 #include "qapi/error.h"
 #include "qemu/guest-random.h"
@@ -10438,7 +10439,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
   env->exception.syndrome);
 }
 
-if (arm_is_psci_call(cpu, cs->exception_index)) {
+if (tcg_enabled() && arm_is_psci_call(cpu, cs->exception_index)) {
 arm_handle_psci_call(cpu);
 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
 return;
-- 
2.35.3

[RFC PATCH 19/27] target/arm: Move common cpregs code into a separate file

[Fabiano Rosas]

Code moved verbatim.

Signed-off-by: Fabiano Rosas 
---
Extracted from:
https://lore.kernel.org/r/20210416162824.25131-15-cfont...@suse.de
[RFC v14 14/80] target/arm: split cpregs from tcg/helper.c
---
 target/arm/cpregs.c| 482 +
 target/arm/helper.c| 472 
 target/arm/meson.build |   1 +
 3 files changed, 483 insertions(+), 472 deletions(-)
 create mode 100644 target/arm/cpregs.c

diff --git a/target/arm/cpregs.c b/target/arm/cpregs.c
new file mode 100644
index 00..f275d9f065
--- /dev/null
+++ b/target/arm/cpregs.c
@@ -0,0 +1,482 @@
+/*
+ * ARM CP registers - common functionality
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "cpregs.h"
+
+static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
+{
+   /*
+* Return true if the regdef would cause an assertion if you called
+* read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
+* program bug for it not to have the NO_RAW flag).
+* NB that returning false here doesn't necessarily mean that calling
+* read/write_raw_cp_reg() is safe, because we can't distinguish "has
+* read/write access functions which are safe for raw use" from "has
+* read/write access functions which have side effects but has forgotten
+* to provide raw access functions".
+* The tests here line up with the conditions in read/write_raw_cp_reg()
+* and assertions in raw_read()/raw_write().
+*/
+if ((ri->type & ARM_CP_CONST) ||
+ri->fieldoffset ||
+((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
+return false;
+}
+return true;
+}
+
+/*
+ * Private utility function for define_one_arm_cp_reg_with_opaque():
+ * add a single reginfo struct to the hash table.
+ */
+static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
+   void *opaque, CPState state,
+   CPSecureState secstate,
+   int crm, int opc1, int opc2,
+   const char *name)
+{
+CPUARMState *env = &cpu->env;
+uint32_t key;
+ARMCPRegInfo *r2;
+bool is64 = r->type & ARM_CP_64BIT;
+bool ns = secstate & ARM_CP_SECSTATE_NS;
+int cp = r->cp;
+size_t name_len;
+bool make_const;
+
+switch (state) {
+case ARM_CP_STATE_AA32:
+/* We assume it is a cp15 register if the .cp field is left unset. */
+if (cp == 0 && r->state == ARM_CP_STATE_BOTH) {
+cp = 15;
+}
+key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2);
+break;
+case ARM_CP_STATE_AA64:
+/*
+ * To allow abbreviation of ARMCPRegInfo definitions, we treat
+ * cp == 0 as equivalent to the value for "standard guest-visible
+ * sysreg".  STATE_BOTH definitions are also always "standard sysreg"
+ * in their AArch64 view (the .cp value may be non-zero for the
+ * benefit of the AArch32 view).
+ */
+if (cp == 0 || r->state == ARM_CP_STATE_BOTH) {
+cp = CP_REG_ARM64_SYSREG_CP;
+}
+key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2);
+break;
+default:
+g_assert_not_reached();
+}
+
+/* Overriding of an existing definition must be explicitly requested. */
+if (!(r->type & ARM_CP_OVERRIDE)) {
+const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
+if (oldreg) {
+assert(oldreg->type & ARM_CP_OVERRIDE);
+}
+}
+
+/*
+ * Eliminate registers that are not present because the EL is missing.
+ * Doing this here makes it easier to put all registers for a given
+ * feature into the same ARMCPRegInfo array and define them all at once.
+ */
+make_const = false;
+if (arm_feature(env, ARM_FEATURE_EL3)) {
+/*
+ * An EL2 register without EL2 but with EL3 is (usually) RES0.
+ * See rule RJFFP in section D1.1.3 of DDI0487H.a.
+ */
+int min_el = ctz32(r->access) / 2;
+if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) {
+if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) {
+return;
+}
+make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP);
+}
+} else {
+CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2)
+ ? PL2_RW : PL1_RW);
+if ((r->access & max_el) == 0) {
+return;
+}
+}
+
+/* Combine cpreg and name into one allocation. */
+name_len = strlen(name) + 1;
+r2 = g_malloc(sizeof(*r2) + name_len);
+*r2 = *r;
+r2->name = memcpy(r2 + 1, name, name_len);
+
+/*
+ * Update fields to match the instantiation, overwiting wildcards
+ * such as CP_AN

[RFC PATCH 04/27] target/arm: Remove unused includes from m_helper.c

[Fabiano Rosas]

Reviewed-by: Claudio Fontana 
Reviewed-by: Cornelia Huck 
Signed-off-by: Fabiano Rosas 
---
 target/arm/m_helper.c | 16 
 1 file changed, 16 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index 355cd4d60a..033a4d9261 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -7,30 +7,14 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/units.h"
-#include "target/arm/idau.h"
-#include "trace.h"
 #include "cpu.h"
 #include "internals.h"
-#include "exec/gdbstub.h"
 #include "exec/helper-proto.h"
-#include "qemu/host-utils.h"
 #include "qemu/main-loop.h"
 #include "qemu/bitops.h"
-#include "qemu/crc32c.h"
-#include "qemu/qemu-print.h"
 #include "qemu/log.h"
 #include "exec/exec-all.h"
-#include  /* For crc32 */
-#include "semihosting/semihost.h"
-#include "sysemu/cpus.h"
-#include "sysemu/kvm.h"
-#include "qemu/range.h"
-#include "qapi/qapi-commands-machine-target.h"
-#include "qapi/error.h"
-#include "qemu/guest-random.h"
 #ifdef CONFIG_TCG
-#include "arm_ldst.h"
 #include "exec/cpu_ldst.h"
 #include "semihosting/common-semi.h"
 #endif
-- 
2.35.3

[RFC PATCH 01/27] target/arm: Fix checkpatch comment style warnings in helper.c

[Fabiano Rosas]

Fix these:

WARNING: Block comments use a leading /* on a separate line
WARNING: Block comments use * on subsequent lines
WARNING: Block comments use a trailing */ on a separate line

Reviewed-by: Claudio Fontana 
Reviewed-by: Cornelia Huck 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 323 +---
 1 file changed, 215 insertions(+), 108 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index bac2ea62c4..6703936a28 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -83,7 +83,8 @@ uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo 
*ri)
 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
  uint64_t v)
 {
-/* Raw write of a coprocessor register (as needed for migration, etc).
+/*
+ * Raw write of a coprocessor register (as needed for migration, etc).
  * Note that constant registers are treated as write-ignored; the
  * caller should check for success by whether a readback gives the
  * value written.
@@ -101,7 +102,8 @@ static void write_raw_cp_reg(CPUARMState *env, const 
ARMCPRegInfo *ri,
 
 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
 {
-   /* Return true if the regdef would cause an assertion if you called
+   /*
+* Return true if the regdef would cause an assertion if you called
 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
 * program bug for it not to have the NO_RAW flag).
 * NB that returning false here doesn't necessarily mean that calling
@@ -184,7 +186,8 @@ bool write_list_to_cpustate(ARMCPU *cpu)
 if (ri->type & ARM_CP_NO_RAW) {
 continue;
 }
-/* Write value and confirm it reads back as written
+/*
+ * Write value and confirm it reads back as written
  * (to catch read-only registers and partially read-only
  * registers where the incoming migration value doesn't match)
  */
@@ -237,7 +240,8 @@ static gint cpreg_key_compare(gconstpointer a, 
gconstpointer b)
 
 void init_cpreg_list(ARMCPU *cpu)
 {
-/* Initialise the cpreg_tuples[] array based on the cp_regs hash.
+/*
+ * Initialise the cpreg_tuples[] array based on the cp_regs hash.
  * Note that we require cpreg_tuples[] to be sorted by key ID.
  */
 GList *keys;
@@ -279,7 +283,8 @@ static CPAccessResult access_el3_aa32ns(CPUARMState *env,
 return CP_ACCESS_OK;
 }
 
-/* Some secure-only AArch32 registers trap to EL3 if used from
+/*
+ * Some secure-only AArch32 registers trap to EL3 if used from
  * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
  * Note that an access from Secure EL1 can only happen if EL3 is AArch64.
  * We assume that the .access field is set to PL1_RW.
@@ -301,7 +306,8 @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState 
*env,
 return CP_ACCESS_TRAP_UNCATEGORIZED;
 }
 
-/* Check for traps to performance monitor registers, which are controlled
+/*
+ * Check for traps to performance monitor registers, which are controlled
  * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
  */
 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -399,7 +405,8 @@ static void fcse_write(CPUARMState *env, const ARMCPRegInfo 
*ri, uint64_t value)
 ARMCPU *cpu = env_archcpu(env);
 
 if (raw_read(env, ri) != value) {
-/* Unlike real hardware the qemu TLB uses virtual addresses,
+/*
+ * Unlike real hardware the qemu TLB uses virtual addresses,
  * not modified virtual addresses, so this causes a TLB flush.
  */
 tlb_flush(CPU(cpu));
@@ -414,7 +421,8 @@ static void contextidr_write(CPUARMState *env, const 
ARMCPRegInfo *ri,
 
 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
 && !extended_addresses_enabled(env)) {
-/* For VMSA (when not using the LPAE long descriptor page table
+/*
+ * For VMSA (when not using the LPAE long descriptor page table
  * format) this register includes the ASID, so do a TLB flush.
  * For PMSA it is purely a process ID and no action is needed.
  */
@@ -606,7 +614,8 @@ static void tlbiipas2is_hyp_write(CPUARMState *env, const 
ARMCPRegInfo *ri,
 }
 
 static const ARMCPRegInfo cp_reginfo[] = {
-/* Define the secure and non-secure FCSE identifier CP registers
+/*
+ * Define the secure and non-secure FCSE identifier CP registers
  * separately because there is no secure bank in V8 (no _EL3).  This allows
  * the secure register to be properly reset and migrated. There is also no
  * v8 EL1 version of the register so the non-secure instance stands alone.
@@ -621,7 +630,8 @@ static const ARMCPRegInfo cp_reginfo[] = {
   .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
   .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
   .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },

[RFC PATCH 13/27] target/arm: move translate modules to tcg/

[Fabiano Rosas]

From: Claudio Fontana 

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
Reviewed-by: Alex Bennée 
Signed-off-by: Fabiano Rosas 
---
I also moved translate-{m-nocp,mve,neon,vfp,sme}.c

Originally from:
https://lore.kernel.org/r/20210416162824.25131-2-cfont...@suse.de
[RFC v14 01/80] target/arm: move translate modules to tcg/
---
 target/arm/meson.build  | 26 
 target/arm/{ => tcg}/a32-uncond.decode  |  0
 target/arm/{ => tcg}/a32.decode |  0
 target/arm/{ => tcg}/m-nocp.decode  |  0
 target/arm/tcg/meson.build  | 32 +
 target/arm/{ => tcg}/mve.decode |  0
 target/arm/{ => tcg}/neon-dp.decode |  0
 target/arm/{ => tcg}/neon-ls.decode |  0
 target/arm/{ => tcg}/neon-shared.decode |  0
 target/arm/{ => tcg}/sme-fa64.decode|  0
 target/arm/{ => tcg}/sme.decode |  0
 target/arm/{ => tcg}/sve.decode |  0
 target/arm/{ => tcg}/t16.decode |  0
 target/arm/{ => tcg}/t32.decode |  0
 target/arm/{ => tcg}/translate-a64.c|  0
 target/arm/{ => tcg}/translate-a64.h|  0
 target/arm/{ => tcg}/translate-m-nocp.c |  0
 target/arm/{ => tcg}/translate-mve.c|  0
 target/arm/{ => tcg}/translate-neon.c   |  0
 target/arm/{ => tcg}/translate-sme.c|  0
 target/arm/{ => tcg}/translate-sve.c|  0
 target/arm/{ => tcg}/translate-vfp.c|  0
 target/arm/{ => tcg}/translate.c|  0
 target/arm/{ => tcg}/translate.h|  0
 target/arm/{ => tcg}/vfp-uncond.decode  |  0
 target/arm/{ => tcg}/vfp.decode |  0
 26 files changed, 32 insertions(+), 26 deletions(-)
 rename target/arm/{ => tcg}/a32-uncond.decode (100%)
 rename target/arm/{ => tcg}/a32.decode (100%)
 rename target/arm/{ => tcg}/m-nocp.decode (100%)
 rename target/arm/{ => tcg}/mve.decode (100%)
 rename target/arm/{ => tcg}/neon-dp.decode (100%)
 rename target/arm/{ => tcg}/neon-ls.decode (100%)
 rename target/arm/{ => tcg}/neon-shared.decode (100%)
 rename target/arm/{ => tcg}/sme-fa64.decode (100%)
 rename target/arm/{ => tcg}/sme.decode (100%)
 rename target/arm/{ => tcg}/sve.decode (100%)
 rename target/arm/{ => tcg}/t16.decode (100%)
 rename target/arm/{ => tcg}/t32.decode (100%)
 rename target/arm/{ => tcg}/translate-a64.c (100%)
 rename target/arm/{ => tcg}/translate-a64.h (100%)
 rename target/arm/{ => tcg}/translate-m-nocp.c (100%)
 rename target/arm/{ => tcg}/translate-mve.c (100%)
 rename target/arm/{ => tcg}/translate-neon.c (100%)
 rename target/arm/{ => tcg}/translate-sme.c (100%)
 rename target/arm/{ => tcg}/translate-sve.c (100%)
 rename target/arm/{ => tcg}/translate-vfp.c (100%)
 rename target/arm/{ => tcg}/translate.c (100%)
 rename target/arm/{ => tcg}/translate.h (100%)
 rename target/arm/{ => tcg}/vfp-uncond.decode (100%)
 rename target/arm/{ => tcg}/vfp.decode (100%)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 3225dbd693..b2904b676b 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -1,22 +1,4 @@
-gen = [
-  decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
-  decodetree.process('sme.decode', extra_args: '--decode=disas_sme'),
-  decodetree.process('sme-fa64.decode', extra_args: 
'--static-decode=disas_sme_fa64'),
-  decodetree.process('neon-shared.decode', extra_args: 
'--decode=disas_neon_shared'),
-  decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
-  decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
-  decodetree.process('vfp.decode', extra_args: '--decode=disas_vfp'),
-  decodetree.process('vfp-uncond.decode', extra_args: 
'--decode=disas_vfp_uncond'),
-  decodetree.process('m-nocp.decode', extra_args: '--decode=disas_m_nocp'),
-  decodetree.process('mve.decode', extra_args: '--decode=disas_mve'),
-  decodetree.process('a32.decode', extra_args: '--static-decode=disas_a32'),
-  decodetree.process('a32-uncond.decode', extra_args: 
'--static-decode=disas_a32_uncond'),
-  decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
-  decodetree.process('t16.decode', extra_args: ['-w', '16', 
'--static-decode=disas_t16']),
-]
-
 arm_ss = ss.source_set()
-arm_ss.add(gen)
 arm_ss.add(files(
   'cpu.c',
   'crypto_helper.c',
@@ -29,11 +11,6 @@ arm_ss.add(files(
   'neon_helper.c',
   'op_helper.c',
   'tlb_helper.c',
-  'translate.c',
-  'translate-m-nocp.c',
-  'translate-mve.c',
-  'translate-neon.c',
-  'translate-vfp.c',
   'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
@@ -50,9 +27,6 @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'pauth_helper.c',
   'sve_helper.c',
   'sme_helper.c',
-  'translate-a64.c',
-  'translate-sve.c',
-  'translate-sme.c',
 ))
 
 arm_softmmu_ss = ss.source_set()
diff --git a/target/arm/a32-uncond.decode b/target/arm/tcg/a32-uncond.decode
similarity index 100%
rename from target/arm/a32-uncond.decode
rename to target/arm/tcg/a32-uncond.decode
diff --git a/target/arm/a32.decode b/target/arm/tcg/a32.decode

[PATCH v7 3/7] mac_{old,new}world: Pass MacOS VGA NDRV in card ROM instead of fw_cfg

[BALATON Zoltan]

OpenBIOS cannot run FCode ROMs yet but it can detect NDRV in VGA card
ROM and add it to the device tree for MacOS. Pass the NDRV this way
instead of via fw_cfg. This solves the problem with OpenBIOS also
adding the NDRV to ati-vga which it does not work with. This does not
need any changes to OpenBIOS as this NDRV ROM handling is already
there but this patch also allows simplifying OpenBIOS later to remove
the fw_cfg ndrv handling from the vga FCode and also drop the
vga-ndrv? option which is not needed any more as users can disable the
ndrv with -device VGA,romfile="" (or override it with their own NDRV
or ROM). Once FCode support is implemented in OpenBIOS, the proper
FCode ROM can be set the same way so this paves the way to remove some
hacks.

Signed-off-by: BALATON Zoltan 
---
 hw/ppc/mac_newworld.c | 18 ++
 hw/ppc/mac_oldworld.c | 18 ++
 2 files changed, 12 insertions(+), 24 deletions(-)

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 460c14b5e3..60c9c27986 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -510,18 +510,6 @@ static void ppc_core99_init(MachineState *machine)
 fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_BUSFREQ, BUSFREQ);
 fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_NVRAM_ADDR, nvram_addr);
 
-/* MacOS NDRV VGA driver */
-filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, NDRV_VGA_FILENAME);
-if (filename) {
-gchar *ndrv_file;
-gsize ndrv_size;
-
-if (g_file_get_contents(filename, &ndrv_file, &ndrv_size, NULL)) {
-fw_cfg_add_file(fw_cfg, "ndrv/qemu_vga.ndrv", ndrv_file, 
ndrv_size);
-}
-g_free(filename);
-}
-
 qemu_register_boot_set(fw_cfg_boot_set, fw_cfg);
 }
 
@@ -565,6 +553,11 @@ static int core99_kvm_type(MachineState *machine, const 
char *arg)
 return 2;
 }
 
+static GlobalProperty props[] = {
+/* MacOS NDRV VGA driver */
+{ "VGA", "romfile", NDRV_VGA_FILENAME },
+};
+
 static void core99_machine_class_init(ObjectClass *oc, void *data)
 {
 MachineClass *mc = MACHINE_CLASS(oc);
@@ -585,6 +578,7 @@ static void core99_machine_class_init(ObjectClass *oc, void 
*data)
 #endif
 mc->default_ram_id = "ppc_core99.ram";
 mc->ignore_boot_device_suffixes = true;
+compat_props_add(mc->compat_props, props, G_N_ELEMENTS(props));
 fwc->get_dev_path = core99_fw_dev_path;
 }
 
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 5a7b25a4a8..6a1b1ad47a 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -344,18 +344,6 @@ static void ppc_heathrow_init(MachineState *machine)
 fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_CLOCKFREQ, CLOCKFREQ);
 fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_BUSFREQ, BUSFREQ);
 
-/* MacOS NDRV VGA driver */
-filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, NDRV_VGA_FILENAME);
-if (filename) {
-gchar *ndrv_file;
-gsize ndrv_size;
-
-if (g_file_get_contents(filename, &ndrv_file, &ndrv_size, NULL)) {
-fw_cfg_add_file(fw_cfg, "ndrv/qemu_vga.ndrv", ndrv_file, 
ndrv_size);
-}
-g_free(filename);
-}
-
 qemu_register_boot_set(fw_cfg_boot_set, fw_cfg);
 }
 
@@ -400,6 +388,11 @@ static int heathrow_kvm_type(MachineState *machine, const 
char *arg)
 return 2;
 }
 
+static GlobalProperty props[] = {
+/* MacOS NDRV VGA driver */
+{ "VGA", "romfile", NDRV_VGA_FILENAME },
+};
+
 static void heathrow_class_init(ObjectClass *oc, void *data)
 {
 MachineClass *mc = MACHINE_CLASS(oc);
@@ -420,6 +413,7 @@ static void heathrow_class_init(ObjectClass *oc, void *data)
 mc->default_display = "std";
 mc->ignore_boot_device_suffixes = true;
 mc->default_ram_id = "ppc_heathrow.ram";
+compat_props_add(mc->compat_props, props, G_N_ELEMENTS(props));
 fwc->get_dev_path = heathrow_fw_dev_path;
 }
 
-- 
2.30.6

[RFC PATCH 15/27] target/arm: move helpers to tcg/

[Fabiano Rosas]

From: Claudio Fontana 

Signed-off-by: Claudio Fontana 
Signed-off-by: Fabiano Rosas 
---
Included {sme,mve}_helper.c and left a couple of files behind that
still have non-tcg code to be removed from them:

helper.c (and op_helper.h as a dep)
vfp_helper.c

Originally from:
https://lore.kernel.org/r/20210416162824.25131-3-cfont...@suse.de
[RFC v14 02/80] target/arm: move helpers to tcg/
---
 target/arm/meson.build   | 16 ++--
 target/arm/tcg-stubs.c   | 27 +++
 target/arm/{ => tcg}/crypto_helper.c |  0
 target/arm/{ => tcg}/debug_helper.c  |  0
 target/arm/{ => tcg}/helper-a64.c|  0
 target/arm/{ => tcg}/iwmmxt_helper.c |  0
 target/arm/{ => tcg}/m_helper.c  |  0
 target/arm/tcg/meson.build   | 14 ++
 target/arm/{ => tcg}/mte_helper.c|  0
 target/arm/{ => tcg}/mve_helper.c|  0
 target/arm/{ => tcg}/neon_helper.c   |  0
 target/arm/{ => tcg}/op_helper.c |  0
 target/arm/{ => tcg}/pauth_helper.c  |  0
 target/arm/{ => tcg}/sme_helper.c|  0
 target/arm/{ => tcg}/sve_helper.c|  0
 target/arm/{ => tcg}/tlb_helper.c|  0
 target/arm/{ => tcg}/vec_helper.c|  0
 target/arm/{ => tcg}/vec_internal.h  |  0
 18 files changed, 43 insertions(+), 14 deletions(-)
 create mode 100644 target/arm/tcg-stubs.c
 rename target/arm/{ => tcg}/crypto_helper.c (100%)
 rename target/arm/{ => tcg}/debug_helper.c (100%)
 rename target/arm/{ => tcg}/helper-a64.c (100%)
 rename target/arm/{ => tcg}/iwmmxt_helper.c (100%)
 rename target/arm/{ => tcg}/m_helper.c (100%)
 rename target/arm/{ => tcg}/mte_helper.c (100%)
 rename target/arm/{ => tcg}/mve_helper.c (100%)
 rename target/arm/{ => tcg}/neon_helper.c (100%)
 rename target/arm/{ => tcg}/op_helper.c (100%)
 rename target/arm/{ => tcg}/pauth_helper.c (100%)
 rename target/arm/{ => tcg}/sme_helper.c (100%)
 rename target/arm/{ => tcg}/sve_helper.c (100%)
 rename target/arm/{ => tcg}/tlb_helper.c (100%)
 rename target/arm/{ => tcg}/vec_helper.c (100%)
 rename target/arm/{ => tcg}/vec_internal.h (100%)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index b2904b676b..0a9fd09b3d 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -1,17 +1,8 @@
 arm_ss = ss.source_set()
 arm_ss.add(files(
   'cpu.c',
-  'crypto_helper.c',
-  'debug_helper.c',
   'gdbstub.c',
   'helper.c',
-  'iwmmxt_helper.c',
-  'm_helper.c',
-  'mve_helper.c',
-  'neon_helper.c',
-  'op_helper.c',
-  'tlb_helper.c',
-  'vec_helper.c',
   'vfp_helper.c',
   'cpu_tcg.c',
 ))
@@ -22,11 +13,6 @@ arm_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c', 
'kvm64.c'), if_false: fil
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'cpu64.c',
   'gdbstub64.c',
-  'helper-a64.c',
-  'mte_helper.c',
-  'pauth_helper.c',
-  'sve_helper.c',
-  'sme_helper.c',
 ))
 
 arm_softmmu_ss = ss.source_set()
@@ -43,6 +29,8 @@ subdir('hvf')
 
 if 'CONFIG_TCG' in config_all
subdir('tcg')
+else
+arm_ss.add(files('tcg-stubs.c'))
 endif
 
 target_arch += {'arm': arm_ss}
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
new file mode 100644
index 00..a28960d88a
--- /dev/null
+++ b/target/arm/tcg-stubs.c
@@ -0,0 +1,27 @@
+/*
+ * QEMU ARM stubs for some TCG helper functions
+ *
+ * Copyright 2021 SUSE LLC
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+
+void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
+{
+g_assert_not_reached();
+}
+
+void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
+uint32_t target_el, uintptr_t ra)
+{
+g_assert_not_reached();
+}
+
+void arm_reset_sve_state(CPUARMState *env)
+{
+g_assert_not_reached();
+}
diff --git a/target/arm/crypto_helper.c b/target/arm/tcg/crypto_helper.c
similarity index 100%
rename from target/arm/crypto_helper.c
rename to target/arm/tcg/crypto_helper.c
diff --git a/target/arm/debug_helper.c b/target/arm/tcg/debug_helper.c
similarity index 100%
rename from target/arm/debug_helper.c
rename to target/arm/tcg/debug_helper.c
diff --git a/target/arm/helper-a64.c b/target/arm/tcg/helper-a64.c
similarity index 100%
rename from target/arm/helper-a64.c
rename to target/arm/tcg/helper-a64.c
diff --git a/target/arm/iwmmxt_helper.c b/target/arm/tcg/iwmmxt_helper.c
similarity index 100%
rename from target/arm/iwmmxt_helper.c
rename to target/arm/tcg/iwmmxt_helper.c
diff --git a/target/arm/m_helper.c b/target/arm/tcg/m_helper.c
similarity index 100%
rename from target/arm/m_helper.c
rename to target/arm/tcg/m_helper.c
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 044561bd4d..c27ac2939c 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -23,10 +23,24 @@ arm_ss.add(files(
   'translate-mve.c',
   'translate-neon.c',
   'translate-vfp.c',
+  'crypto_helper.c',
+  'debug_helper.c',
+  'iwmmxt_h

[RFC PATCH 17/27] target/arm: Extract cpustate list manipulation to a file

[Fabiano Rosas]

This code doesn't need to be buried in helper.c. Let's move it to its
own file to keep things cleaner.

Code moved verbatim.

Signed-off-by: Fabiano Rosas 
---
Extracted from:
https://lore.kernel.org/r/20210416162824.25131-15-cfont...@suse.de
[RFC v14 14/80] target/arm: split cpregs from tcg/helper.c
---
 target/arm/cpregs.h|   5 ++
 target/arm/cpustate-list.c | 148 +
 target/arm/helper.c| 136 --
 target/arm/meson.build |   1 +
 4 files changed, 154 insertions(+), 136 deletions(-)
 create mode 100644 target/arm/cpustate-list.c

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 7e78c2c05c..1c35574102 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -442,6 +442,11 @@ void arm_cp_write_ignore(CPUARMState *env, const 
ARMCPRegInfo *ri,
 /* CPReadFn that can be used for read-as-zero behaviour */
 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
 
+/*
+ * default raw read/write of coprocessor register field,
+ * behavior if no other function defined, and not const.
+ */
+uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri);
 /* CPWriteFn that just writes the value to ri->fieldoffset */
 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value);
 
diff --git a/target/arm/cpustate-list.c b/target/arm/cpustate-list.c
new file mode 100644
index 00..9411b25b6f
--- /dev/null
+++ b/target/arm/cpustate-list.c
@@ -0,0 +1,148 @@
+/*
+ * ARM CPUState list read/write
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "cpregs.h"
+
+uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+assert(ri->fieldoffset);
+if (cpreg_field_is_64bit(ri)) {
+return CPREG_FIELD64(env, ri);
+} else {
+return CPREG_FIELD32(env, ri);
+}
+}
+
+void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
+   uint64_t value)
+{
+assert(ri->fieldoffset);
+if (cpreg_field_is_64bit(ri)) {
+CPREG_FIELD64(env, ri) = value;
+} else {
+CPREG_FIELD32(env, ri) = value;
+}
+}
+
+const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
+{
+return g_hash_table_lookup(cpregs, (gpointer)(uintptr_t)encoded_cp);
+}
+
+uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+/* Raw read of a coprocessor register (as needed for migration, etc). */
+if (ri->type & ARM_CP_CONST) {
+return ri->resetvalue;
+} else if (ri->raw_readfn) {
+return ri->raw_readfn(env, ri);
+} else if (ri->readfn) {
+return ri->readfn(env, ri);
+} else {
+return raw_read(env, ri);
+}
+}
+
+static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t v)
+{
+/*
+ * Raw write of a coprocessor register (as needed for migration, etc).
+ * Note that constant registers are treated as write-ignored; the
+ * caller should check for success by whether a readback gives the
+ * value written.
+ */
+if (ri->type & ARM_CP_CONST) {
+return;
+} else if (ri->raw_writefn) {
+ri->raw_writefn(env, ri, v);
+} else if (ri->writefn) {
+ri->writefn(env, ri, v);
+} else {
+raw_write(env, ri, v);
+}
+}
+
+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
+{
+/* Write the coprocessor state from cpu->env to the (index,value) list. */
+int i;
+bool ok = true;
+
+for (i = 0; i < cpu->cpreg_array_len; i++) {
+uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
+const ARMCPRegInfo *ri;
+uint64_t newval;
+
+ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
+if (!ri) {
+ok = false;
+continue;
+}
+if (ri->type & ARM_CP_NO_RAW) {
+continue;
+}
+
+newval = read_raw_cp_reg(&cpu->env, ri);
+if (kvm_sync) {
+/*
+ * Only sync if the previous list->cpustate sync succeeded.
+ * Rather than tracking the success/failure state for every
+ * item in the list, we just recheck "does the raw write we must
+ * have made in write_list_to_cpustate() read back OK" here.
+ */
+uint64_t oldval = cpu->cpreg_values[i];
+
+if (oldval == newval) {
+continue;
+}
+
+write_raw_cp_reg(&cpu->env, ri, oldval);
+if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
+continue;
+}
+
+write_raw_cp_reg(&cpu->env, ri, newval);
+}
+cpu->cpreg_values[i] = newval;
+}
+return ok;
+}
+
+bool write_list_to_cpustate(ARMCPU *cpu)
+{
+int i;
+bool ok = true;
+
+for (i = 0; i < cpu->cpreg_array_len; i++) {
+uint32_t regidx = kvm_to_cpreg

[PATCH 02/20] hw/block: Use pflash_cfi01_get_blk() in pflash_cfi01_legacy_drive()

[Philippe Mathieu-Daudé]

By using pflash_cfi01_get_blk(), pflash_cfi01_legacy_drive()
doesn't require any knowledge of the PFlashCFI01 structure.
Thus we can pass a generic DeviceState pointer.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/sbsa-ref.c| 2 +-
 hw/arm/virt.c| 2 +-
 hw/block/pflash_cfi01.c  | 6 +++---
 hw/i386/pc_sysfw.c   | 2 +-
 hw/riscv/virt.c  | 2 +-
 include/hw/block/flash.h | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 65b9acba04..1d29e8ca7f 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -340,7 +340,7 @@ static bool sbsa_firmware_init(SBSAMachineState *sms,
 
 /* Map legacy -drive if=pflash to machine properties */
 for (i = 0; i < ARRAY_SIZE(sms->flash); i++) {
-pflash_cfi01_legacy_drive(sms->flash[i],
+pflash_cfi01_legacy_drive(DEVICE(sms->flash[i]),
   drive_get(IF_PFLASH, 0, i));
 }
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 954e3ca5ce..57726b0f52 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1227,7 +1227,7 @@ static bool virt_firmware_init(VirtMachineState *vms,
 
 /* Map legacy -drive if=pflash to machine properties */
 for (i = 0; i < ARRAY_SIZE(vms->flash); i++) {
-pflash_cfi01_legacy_drive(vms->flash[i],
+pflash_cfi01_legacy_drive(DEVICE(vms->flash[i]),
   drive_get(IF_PFLASH, 0, i));
 }
 
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 458c50ec45..8beba24989 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -1002,7 +1002,7 @@ MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl)
  * Else if @fl's property "drive" is already set, fatal error.
  * Else set it to the BlockBackend with @dinfo.
  */
-void pflash_cfi01_legacy_drive(PFlashCFI01 *fl, DriveInfo *dinfo)
+void pflash_cfi01_legacy_drive(DeviceState *dev, DriveInfo *dinfo)
 {
 Location loc;
 
@@ -1012,11 +1012,11 @@ void pflash_cfi01_legacy_drive(PFlashCFI01 *fl, 
DriveInfo *dinfo)
 
 loc_push_none(&loc);
 qemu_opts_loc_restore(dinfo->opts);
-if (fl->blk) {
+if (pflash_cfi01_get_blk(dev)) {
 error_report("clashes with -machine");
 exit(1);
 }
-qdev_prop_set_drive_err(DEVICE(fl), "drive", blk_by_legacy_dinfo(dinfo),
+qdev_prop_set_drive_err(dev, "drive", blk_by_legacy_dinfo(dinfo),
 &error_fatal);
 loc_pop(&loc);
 }
diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index 4b85c48ec8..c08cba6628 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -214,7 +214,7 @@ void pc_system_firmware_init(PCMachineState *pcms,
 
 /* Map legacy -drive if=pflash to machine properties */
 for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
-pflash_cfi01_legacy_drive(pcms->flash[i],
+pflash_cfi01_legacy_drive(DEVICE(pcms->flash[i]),
   drive_get(IF_PFLASH, 0, i));
 pflash_blk[i] = pflash_cfi01_get_blk(DEVICE(pcms->flash[i]));
 }
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index a5bc7353b4..400bd9329f 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1517,7 +1517,7 @@ static void virt_machine_init(MachineState *machine)
 
 for (i = 0; i < ARRAY_SIZE(s->flash); i++) {
 /* Map legacy -drive if=pflash to machine properties */
-pflash_cfi01_legacy_drive(s->flash[i],
+pflash_cfi01_legacy_drive(DEVICE(s->flash[i]),
   drive_get(IF_PFLASH, 0, i));
 }
 virt_flash_map(s, system_memory);
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 961b6e9f74..701a2c1701 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -23,7 +23,7 @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
int be);
 BlockBackend *pflash_cfi01_get_blk(DeviceState *dev);
 MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl);
-void pflash_cfi01_legacy_drive(PFlashCFI01 *dev, DriveInfo *dinfo);
+void pflash_cfi01_legacy_drive(DeviceState *dev, DriveInfo *dinfo);
 
 /* pflash_cfi02.c */
 
-- 
2.38.1

[PATCH 09/20] hw/block: Factor pflash_cfi01_create() out of pflash_cfi01_register()

[Philippe Mathieu-Daudé]

Currently pflash_cfi01_register():

 1/ creates a TYPE_PFLASH_CFI01 qdev instance
 2/ maps the first MMIO region to the system bus

The first minor issue is the implicit sysbus mapping is not
obvious (the function name could mention it), and the function
is not documented.

Another issue is we are forced to map on sysbus, thus code
wanting to simply instantiate this device are forced to open
code the qdev creation.

This is a problem in a heterogeneous system where not all cores
has access to the sysbus, or if we want to map the pflash on
different address spaces.

To clarify this API, extract the qdev creation in a new helper
named pflash_cfi01_create().

We don't document pflash_cfi01_register() because we are going
to remove it in a few commits.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/block/pflash_cfi01.c  | 34 +-
 include/hw/block/flash.h | 14 +-
 2 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 866ea596ea..6a8f9e6319 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -953,15 +953,13 @@ static void pflash_cfi01_register_types(void)
 
 type_init(pflash_cfi01_register_types)
 
-PFlashCFI01 *pflash_cfi01_register(hwaddr base,
-   const char *name,
-   hwaddr size,
-   BlockBackend *blk,
-   uint32_t sector_len,
-   int bank_width,
-   uint16_t id0, uint16_t id1,
-   uint16_t id2, uint16_t id3,
-   int be)
+DeviceState *pflash_cfi01_create(const char *name,
+ hwaddr size,
+ BlockBackend *blk, uint32_t sector_len,
+ int bank_width,
+ uint16_t id0, uint16_t id1,
+ uint16_t id2, uint16_t id3,
+ int be)
 {
 DeviceState *dev = qdev_new(TYPE_PFLASH_CFI01);
 
@@ -980,7 +978,25 @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
 qdev_prop_set_string(dev, "name", name);
 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
+return dev;
+}
+
+PFlashCFI01 *pflash_cfi01_register(hwaddr base,
+   const char *name,
+   hwaddr size,
+   BlockBackend *blk,
+   uint32_t sector_len,
+   int bank_width,
+   uint16_t id0, uint16_t id1,
+   uint16_t id2, uint16_t id3,
+   int be)
+{
+DeviceState *dev;
+
+dev = pflash_cfi01_create(name, size, blk, sector_len, bank_width,
+  id0, id1, id2, id3, be);
 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+
 return PFLASH_CFI01(dev);
 }
 
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 25affdf7a5..40ba857f69 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -11,7 +11,19 @@
 #define TYPE_PFLASH_CFI01 "cfi.pflash01"
 OBJECT_DECLARE_SIMPLE_TYPE(PFlashCFI01, PFLASH_CFI01)
 
-
+/**
+ * Create and realize a parallel NOR flash (CFI type 1) on the heap.
+ *
+ * Create the device state structure, initialize it, and drop the
+ * reference to it (the device is realized).
+ */
+DeviceState *pflash_cfi01_create(const char *name,
+ hwaddr size,
+ BlockBackend *blk, uint32_t sector_len,
+ int bank_width,
+ uint16_t id0, uint16_t id1,
+ uint16_t id2, uint16_t id3,
+ int be);
 PFlashCFI01 *pflash_cfi01_register(hwaddr base,
const char *name,
hwaddr size,
-- 
2.38.1

[PATCH v7 2/7] mac_{old,new}world: Use local variable instead of qdev_get_machine()

[BALATON Zoltan]

We already have machine in a local variable so no need to use
qdev_get_machine(), also remove now unneded line break.

Signed-off-by: BALATON Zoltan 
---
 hw/ppc/mac_newworld.c | 3 +--
 hw/ppc/mac_oldworld.c | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 601ea518f8..460c14b5e3 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -466,8 +466,7 @@ static void ppc_core99_init(MachineState *machine)
 fw_cfg = FW_CFG(dev);
 qdev_prop_set_uint32(dev, "data_width", 1);
 qdev_prop_set_bit(dev, "dma_enabled", false);
-object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
-  OBJECT(fw_cfg));
+object_property_add_child(OBJECT(machine), TYPE_FW_CFG, OBJECT(fw_cfg));
 s = SYS_BUS_DEVICE(dev);
 sysbus_realize_and_unref(s, &error_fatal);
 sysbus_mmio_map(s, 0, CFG_ADDR);
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 558c639202..5a7b25a4a8 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -303,8 +303,7 @@ static void ppc_heathrow_init(MachineState *machine)
 fw_cfg = FW_CFG(dev);
 qdev_prop_set_uint32(dev, "data_width", 1);
 qdev_prop_set_bit(dev, "dma_enabled", false);
-object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
-  OBJECT(fw_cfg));
+object_property_add_child(OBJECT(machine), TYPE_FW_CFG, OBJECT(fw_cfg));
 s = SYS_BUS_DEVICE(dev);
 sysbus_realize_and_unref(s, &error_fatal);
 sysbus_mmio_map(s, 0, CFG_ADDR);
-- 
2.30.6

[RFC PATCH 06/27] target/arm: cleanup cpu includes

[Fabiano Rosas]

From: Claudio Fontana 

Remove some unused headers.

Signed-off-by: Claudio Fontana 
Acked-by: Richard Henderson 
Reviewed-by: Claudio Fontana 
Reviewed-by: Cornelia Huck 
Signed-off-by: Fabiano Rosas 
---
 target/arm/cpu.c   | 1 -
 target/arm/cpu64.c | 6 --
 2 files changed, 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 2fa022f62b..f5381af437 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -26,7 +26,6 @@
 #include "target/arm/idau.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
-#include "qapi/visitor.h"
 #include "cpu.h"
 #ifdef CONFIG_TCG
 #include "hw/core/tcg-cpu-ops.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 2cf2ca4ce5..0e021960fb 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -21,13 +21,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
-#ifdef CONFIG_TCG
-#include "hw/core/tcg-cpu-ops.h"
-#endif /* CONFIG_TCG */
 #include "qemu/module.h"
-#if !defined(CONFIG_USER_ONLY)
-#include "hw/loader.h"
-#endif
 #include "sysemu/kvm.h"
 #include "sysemu/hvf.h"
 #include "kvm_arm.h"
-- 
2.35.3

[RFC PATCH 16/27] target/arm: only build psci for TCG

[Fabiano Rosas]

From: Claudio Fontana 

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
Reviewed-by: Alex Bennée 
Signed-off-by: Fabiano Rosas 
---
 target/arm/meson.build  | 1 -
 target/arm/tcg/meson.build  | 4 
 target/arm/{ => tcg}/psci.c | 0
 3 files changed, 4 insertions(+), 1 deletion(-)
 rename target/arm/{ => tcg}/psci.c (100%)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 0a9fd09b3d..68a87dff0a 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -21,7 +21,6 @@ arm_softmmu_ss.add(files(
   'arm-powerctl.c',
   'machine.c',
   'monitor.c',
-  'psci.c',
   'ptw.c',
 ))
 
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index c27ac2939c..47006f903c 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -44,3 +44,7 @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'sme_helper.c',
   'sve_helper.c',
 ))
+
+arm_softmmu_ss.add(files(
+  'psci.c',
+))
diff --git a/target/arm/psci.c b/target/arm/tcg/psci.c
similarity index 100%
rename from target/arm/psci.c
rename to target/arm/tcg/psci.c
-- 
2.35.3

[PATCH 04/20] hw/arm: Use generic DeviceState instead of PFlashCFI01

[Philippe Mathieu-Daudé]

Nothing here requires access to PFlashCFI01 internal fields:
use the inherited generic DeviceState.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/sbsa-ref.c | 12 ++--
 hw/arm/vexpress.c | 12 +---
 hw/arm/virt.c | 10 +-
 include/hw/arm/virt.h |  3 +--
 4 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 1d29e8ca7f..8e60e0e58d 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -91,7 +91,7 @@ struct SBSAMachineState {
 int fdt_size;
 int psci_conduit;
 DeviceState *gic;
-PFlashCFI01 *flash[2];
+DeviceState *flash[2];
 };
 
 #define TYPE_SBSA_MACHINE   MACHINE_TYPE_NAME("sbsa-ref")
@@ -264,7 +264,7 @@ static void create_fdt(SBSAMachineState *sms)
 
 #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
 
-static PFlashCFI01 *sbsa_flash_create1(SBSAMachineState *sms,
+static DeviceState *sbsa_flash_create1(SBSAMachineState *sms,
 const char *name,
 const char *alias_prop_name)
 {
@@ -286,7 +286,7 @@ static PFlashCFI01 *sbsa_flash_create1(SBSAMachineState 
*sms,
 object_property_add_child(OBJECT(sms), name, OBJECT(dev));
 object_property_add_alias(OBJECT(sms), alias_prop_name,
   OBJECT(dev), "drive");
-return PFLASH_CFI01(dev);
+return dev;
 }
 
 static void sbsa_flash_create(SBSAMachineState *sms)
@@ -295,7 +295,7 @@ static void sbsa_flash_create(SBSAMachineState *sms)
 sms->flash[1] = sbsa_flash_create1(sms, "sbsa.flash1", "pflash1");
 }
 
-static void sbsa_flash_map1(PFlashCFI01 *flash,
+static void sbsa_flash_map1(DeviceState *flash,
 hwaddr base, hwaddr size,
 MemoryRegion *sysmem)
 {
@@ -340,13 +340,13 @@ static bool sbsa_firmware_init(SBSAMachineState *sms,
 
 /* Map legacy -drive if=pflash to machine properties */
 for (i = 0; i < ARRAY_SIZE(sms->flash); i++) {
-pflash_cfi01_legacy_drive(DEVICE(sms->flash[i]),
+pflash_cfi01_legacy_drive(sms->flash[i],
   drive_get(IF_PFLASH, 0, i));
 }
 
 sbsa_flash_map(sms, sysmem, secure_sysmem);
 
-pflash_blk0 = pflash_cfi01_get_blk(DEVICE(sms->flash[0]));
+pflash_blk0 = pflash_cfi01_get_blk(sms->flash[0]);
 
 bios_name = MACHINE(sms)->firmware;
 if (bios_name) {
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index e1d1983ae6..94eeff73d9 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -508,7 +508,7 @@ static void vexpress_modify_dtb(const struct arm_boot_info 
*info, void *fdt)
 /* Open code a private version of pflash registration since we
  * need to set non-default device width for VExpress platform.
  */
-static PFlashCFI01 *ve_pflash_cfi01_register(hwaddr base, const char *name,
+static DeviceState *ve_pflash_cfi01_register(hwaddr base, const char *name,
  DriveInfo *di)
 {
 DeviceState *dev = qdev_new(TYPE_PFLASH_CFI01);
@@ -531,7 +531,7 @@ static PFlashCFI01 *ve_pflash_cfi01_register(hwaddr base, 
const char *name,
 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
-return PFLASH_CFI01(dev);
+return dev;
 }
 
 static void vexpress_common_init(MachineState *machine)
@@ -543,7 +543,6 @@ static void vexpress_common_init(MachineState *machine)
 qemu_irq pic[64];
 uint32_t sys_id;
 DriveInfo *dinfo;
-PFlashCFI01 *pflash0;
 I2CBus *i2c;
 ram_addr_t vram_size, sram_size;
 MemoryRegion *sysmem = get_system_memory();
@@ -657,16 +656,15 @@ static void vexpress_common_init(MachineState *machine)
 sysbus_create_simple("pl111", map[VE_CLCD], pic[14]);
 
 dinfo = drive_get(IF_PFLASH, 0, 0);
-pflash0 = ve_pflash_cfi01_register(map[VE_NORFLASH0], "vexpress.flash0",
-   dinfo);
-if (!pflash0) {
+dev = ve_pflash_cfi01_register(map[VE_NORFLASH0], "vexpress.flash0", 
dinfo);
+if (!dev) {
 error_report("vexpress: error registering flash 0");
 exit(1);
 }
 
 if (map[VE_NORFLASHALIAS] != -1) {
 /* Map flash 0 as an alias into low memory */
-flash0mem = sysbus_mmio_get_region(SYS_BUS_DEVICE(pflash0), 0);
+flash0mem = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 memory_region_init_alias(flashalias, NULL, "vexpress.flashalias",
  flash0mem, 0, VEXPRESS_FLASH_SIZE);
 memory_region_add_subregion(sysmem, map[VE_NORFLASHALIAS], flashalias);
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 57726b0f52..e47070105d 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1105,7 +1105,7 @@ static void create_virtio_devices(const VirtMachineState 
*vms)
 
 #define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
 
-static PFlashCFI01 *virt_flash_create1(VirtMachineState *vms,
+static DeviceState *virt_flash_create1(Vir

[RFC PATCH 11/27] target/arm: only perform TCG cpu and machine inits if TCG enabled

[Fabiano Rosas]

From: Claudio Fontana 

of note, cpreg lists were previously initialized by TCG first,
and then thrown away and replaced with the data coming from KVM.

Now we just initialize once, either for TCG or for KVM.

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
[moved arm_cpu_register_gdb_regs_for_features out of tcg_enabled]
Signed-off-by: Fabiano Rosas 
---
 target/arm/cpu.c | 31 +-
 target/arm/kvm.c | 18 +-
 target/arm/kvm_arm.h |  3 +--
 target/arm/machine.c | 45 +---
 4 files changed, 54 insertions(+), 43 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index f5381af437..5a132aa7bc 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -524,9 +524,11 @@ static void arm_cpu_reset_hold(Object *obj)
 }
 #endif
 
-hw_breakpoint_update_all(cpu);
-hw_watchpoint_update_all(cpu);
-arm_rebuild_hflags(env);
+if (tcg_enabled()) {
+hw_breakpoint_update_all(cpu);
+hw_watchpoint_update_all(cpu);
+arm_rebuild_hflags(env);
+}
 }
 
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
@@ -1599,6 +1601,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
 }
 }
 
+#ifdef CONFIG_TCG
 {
 uint64_t scale;
 
@@ -1624,7 +1627,8 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
 cpu->gt_timer[GTIMER_HYPVIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
   arm_gt_hvtimer_cb, cpu);
 }
-#endif
+#endif /* CONFIG_TCG */
+#endif /* !CONFIG_USER_ONLY */
 
 cpu_exec_realizefn(cs, &local_err);
 if (local_err != NULL) {
@@ -1942,17 +1946,16 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
 unset_feature(env, ARM_FEATURE_PMU);
 }
 if (arm_feature(env, ARM_FEATURE_PMU)) {
-pmu_init(cpu);
-
-if (!kvm_enabled()) {
+if (tcg_enabled()) {
+pmu_init(cpu);
 arm_register_pre_el_change_hook(cpu, &pmu_pre_el_change, 0);
 arm_register_el_change_hook(cpu, &pmu_post_el_change, 0);
-}
 
 #ifndef CONFIG_USER_ONLY
-cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, arm_pmu_timer_cb,
-cpu);
+cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, arm_pmu_timer_cb,
+  cpu);
 #endif
+}
 } else {
 cpu->isar.id_aa64dfr0 =
 FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMUVER, 0);
@@ -2048,11 +2051,13 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
 set_feature(env, ARM_FEATURE_VBAR);
 }
 
-register_cp_regs_for_features(cpu);
+if (tcg_enabled()) {
+register_cp_regs_for_features(cpu);
+init_cpreg_list(cpu);
+}
+
 arm_cpu_register_gdb_regs_for_features(cpu);
 
-init_cpreg_list(cpu);
-
 #ifndef CONFIG_USER_ONLY
 MachineState *ms = MACHINE(qdev_get_machine());
 unsigned int smp_cpus = ms->smp.cpus;
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index f022c644d2..2f01c26f54 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -438,9 +438,11 @@ static uint64_t *kvm_arm_get_cpreg_ptr(ARMCPU *cpu, 
uint64_t regidx)
 return &cpu->cpreg_values[res - cpu->cpreg_indexes];
 }
 
-/* Initialize the ARMCPU cpreg list according to the kernel's
- * definition of what CPU registers it knows about (and throw away
- * the previous TCG-created cpreg list).
+/*
+ * Initialize the ARMCPU cpreg list according to the kernel's
+ * definition of what CPU registers it knows about.
+ *
+ * The parallel for TCG is init_cpreg_list()
  */
 int kvm_arm_init_cpreg_list(ARMCPU *cpu)
 {
@@ -482,12 +484,10 @@ int kvm_arm_init_cpreg_list(ARMCPU *cpu)
 arraylen++;
 }
 
-cpu->cpreg_indexes = g_renew(uint64_t, cpu->cpreg_indexes, arraylen);
-cpu->cpreg_values = g_renew(uint64_t, cpu->cpreg_values, arraylen);
-cpu->cpreg_vmstate_indexes = g_renew(uint64_t, cpu->cpreg_vmstate_indexes,
- arraylen);
-cpu->cpreg_vmstate_values = g_renew(uint64_t, cpu->cpreg_vmstate_values,
-arraylen);
+cpu->cpreg_indexes = g_new(uint64_t, arraylen);
+cpu->cpreg_values = g_new(uint64_t, arraylen);
+cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
+cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
 cpu->cpreg_array_len = arraylen;
 cpu->cpreg_vmstate_array_len = arraylen;
 
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index 99017b635c..41de2a7cf1 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -70,8 +70,7 @@ void kvm_arm_register_device(MemoryRegion *mr, uint64_t 
devid, uint64_t group,
  * @cpu: ARMCPU
  *
  * Initialize the ARMCPU cpreg list according to the kernel's
- * definition of what CPU registers it knows about (and throw away
- * the previous TCG-created cpreg list).
+ * definition of w

[PATCH 1/3] block: add BdrvChildClass->pre_detach() and ->post_attach()

[Stefan Hajnoczi]

Add callbacks for graph changes and propagate them to the root via
child_of_bds. The purpose is to respond to graph changes.

This commit doesn't do anything on its own since the callbacks aren't
used by BlockBackend's child_root yet. That will be done in the next
commit.

Signed-off-by: Stefan Hajnoczi 
---
 include/block/block_int-common.h |  8 
 block.c  | 34 
 2 files changed, 42 insertions(+)

diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index c34c525fa6..6cefde5d23 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -899,6 +899,14 @@ struct BdrvChildClass {
 void GRAPH_WRLOCK_PTR (*attach)(BdrvChild *child);
 void GRAPH_WRLOCK_PTR (*detach)(BdrvChild *child);
 
+/*
+ * Notifies the parent that an immediate child or deeper descendant is
+ * about to be detached or has been attached. Use this to monitor graph
+ * changes. to_detach->bs and attached->bs can be NULL.
+ */
+void (*pre_detach)(BdrvChild *child, BdrvChild *to_detach);
+void (*post_attach)(BdrvChild *child, BdrvChild *attached);
+
 /*
  * Notifies the parent that the filename of its child has changed (e.g.
  * because the direct child was removed from the backing chain), so that it
diff --git a/block.c b/block.c
index 9c2ac757e4..e472a4b105 100644
--- a/block.c
+++ b/block.c
@@ -1402,6 +1402,30 @@ static void bdrv_inherited_options(BdrvChildRole role, 
bool parent_is_format,
 *child_flags = flags;
 }
 
+static void bdrv_child_cb_pre_detach(BdrvChild *child, BdrvChild *to_detach)
+{
+BlockDriverState *parent_bs = child->opaque;
+BdrvChild *grandparent;
+
+QLIST_FOREACH(grandparent, &parent_bs->parents, next_parent) {
+if (grandparent->klass->pre_detach) {
+grandparent->klass->pre_detach(grandparent, to_detach);
+}
+}
+}
+
+static void bdrv_child_cb_post_attach(BdrvChild *child, BdrvChild *attached)
+{
+BlockDriverState *parent_bs = child->opaque;
+BdrvChild *grandparent;
+
+QLIST_FOREACH(grandparent, &parent_bs->parents, next_parent) {
+if (grandparent->klass->post_attach) {
+grandparent->klass->post_attach(grandparent, attached);
+}
+}
+}
+
 static void GRAPH_WRLOCK bdrv_child_cb_attach(BdrvChild *child)
 {
 BlockDriverState *bs = child->opaque;
@@ -1488,6 +1512,8 @@ const BdrvChildClass child_of_bds = {
 .drained_end = bdrv_child_cb_drained_end,
 .attach  = bdrv_child_cb_attach,
 .detach  = bdrv_child_cb_detach,
+.pre_detach  = bdrv_child_cb_pre_detach,
+.post_attach = bdrv_child_cb_post_attach,
 .inactivate  = bdrv_child_cb_inactivate,
 .change_aio_ctx  = bdrv_child_cb_change_aio_ctx,
 .update_filename = bdrv_child_cb_update_filename,
@@ -2873,6 +2899,10 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
 assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
 }
 
+if (child->klass->pre_detach) {
+child->klass->pre_detach(child, child);
+}
+
 /* TODO Pull this up into the callers to avoid polling here */
 bdrv_graph_wrlock();
 if (old_bs) {
@@ -2892,6 +2922,10 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
 }
 bdrv_graph_wrunlock();
 
+if (child->klass->post_attach) {
+child->klass->post_attach(child, child);
+}
+
 /*
  * If the parent was drained through this BdrvChild previously, but new_bs
  * is not drained, allow requests to come in only after the new node has
-- 
2.39.0

[RFC PATCH 14/27] target/arm: Move regime_using_lpae_format into internal.h

[Fabiano Rosas]

This function is needed by common code (ptw.c), so move it along with
the other regime_* functions in internal.h. When we enable the build
without TCG, the tlb_helper.c file will not be present.

Signed-off-by: Fabiano Rosas 
---
 target/arm/internals.h  | 17 ++---
 target/arm/tlb_helper.c | 14 --
 2 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 161e42d50f..3493b5cc88 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -610,9 +610,6 @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState 
*env,
 /* Return the MMU index for a v7M CPU in the specified security state */
 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
 
-/* Return true if the translation regime is using LPAE format page tables */
-bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx);
-
 /*
  * Return true if the stage 1 translation regime is using LPAE
  * format page tables
@@ -777,6 +774,20 @@ static inline uint64_t regime_tcr(CPUARMState *env, 
ARMMMUIdx mmu_idx)
 return env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
+/* Return true if the translation regime is using LPAE format page tables */
+static inline bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx 
mmu_idx)
+{
+int el = regime_el(env, mmu_idx);
+if (el == 2 || arm_el_is_aa64(env, el)) {
+return true;
+}
+if (arm_feature(env, ARM_FEATURE_LPAE)
+&& (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
+return true;
+}
+return false;
+}
+
 /**
  * arm_num_brps: Return number of implemented breakpoints.
  * Note that the ID register BRPS field is "number of bps - 1",
diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index 0f4f4fc809..31eb77f7df 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -12,20 +12,6 @@
 #include "exec/helper-proto.h"
 
 
-/* Return true if the translation regime is using LPAE format page tables */
-bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
-int el = regime_el(env, mmu_idx);
-if (el == 2 || arm_el_is_aa64(env, el)) {
-return true;
-}
-if (arm_feature(env, ARM_FEATURE_LPAE)
-&& (regime_tcr(env, mmu_idx) & TTBCR_EAE)) {
-return true;
-}
-return false;
-}
-
 /*
  * Returns true if the stage 1 translation regime is using LPAE format page
  * tables. Used when raising alignment exceptions, whose FSR changes depending
-- 
2.35.3

[PATCH 0/3] block-ram-registrar: reset when the graph changes

[Stefan Hajnoczi]

Kevin pointed out that block-ram-registrar doesn't handle graph changes. New
nodes must have all of guest RAM registered before they can process I/O
requests with BDRV_REQ_REGISTERED_BUF.

These patches add a mechanism for monitoring graph changes and use it to
refresh registered buffers in block-ram-registrar.

Stefan Hajnoczi (3):
  block: add BdrvChildClass->pre_detach() and ->post_attach()
  block-backend: add graph change notifier API
  block-ram-registrar: reset when the graph changes

 include/block/block_int-common.h|  8 +++
 include/sysemu/block-backend-global-state.h | 10 +++
 block.c | 34 +
 block/block-backend.c   | 79 +
 block/block-ram-registrar.c | 40 +--
 block/trace-events  |  2 +
 6 files changed, 168 insertions(+), 5 deletions(-)

-- 
2.39.0

[RFC PATCH 18/27] target/arm: Move cpregs code out of cpu.h

[Fabiano Rosas]

Since commit cf7c6d1004 ("target/arm: Split out cpregs.h") we now have
a cpregs.h header which is more suitable for this code.

Code moved verbatim.

Signed-off-by: Fabiano Rosas 
---
Extracted from:
https://lore.kernel.org/r/20210416162824.25131-15-cfont...@suse.de
[RFC v14 14/80] target/arm: split cpregs from tcg/helper.c
---
 target/arm/cpregs.h | 98 +
 target/arm/cpu.h| 91 -
 2 files changed, 98 insertions(+), 91 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 1c35574102..9e43ea6c3c 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -120,6 +120,104 @@ enum {
 ARM_CP_SME   = 1 << 19,
 };
 
+/*
+ * Interface for defining coprocessor registers.
+ * Registers are defined in tables of arm_cp_reginfo structs
+ * which are passed to define_arm_cp_regs().
+ */
+
+/*
+ * When looking up a coprocessor register we look for it
+ * via an integer which encodes all of:
+ *  coprocessor number
+ *  Crn, Crm, opc1, opc2 fields
+ *  32 or 64 bit register (ie is it accessed via MRC/MCR
+ *or via MRRC/MCRR?)
+ *  non-secure/secure bank (AArch32 only)
+ * We allow 4 bits for opc1 because MRRC/MCRR have a 4 bit field.
+ * (In this case crn and opc2 should be zero.)
+ * For AArch64, there is no 32/64 bit size distinction;
+ * instead all registers have a 2 bit op0, 3 bit op1 and op2,
+ * and 4 bit CRn and CRm. The encoding patterns are chosen
+ * to be easy to convert to and from the KVM encodings, and also
+ * so that the hashtable can contain both AArch32 and AArch64
+ * registers (to allow for interprocessing where we might run
+ * 32 bit code on a 64 bit core).
+ */
+/*
+ * This bit is private to our hashtable cpreg; in KVM register
+ * IDs the AArch64/32 distinction is the KVM_REG_ARM/ARM64
+ * in the upper bits of the 64 bit ID.
+ */
+#define CP_REG_AA64_SHIFT 28
+#define CP_REG_AA64_MASK (1 << CP_REG_AA64_SHIFT)
+
+/*
+ * To enable banking of coprocessor registers depending on ns-bit we
+ * add a bit to distinguish between secure and non-secure cpregs in the
+ * hashtable.
+ */
+#define CP_REG_NS_SHIFT 29
+#define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT)
+
+#define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2)   \
+((ns) << CP_REG_NS_SHIFT | ((cp) << 16) | ((is64) << 15) |   \
+ ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
+
+#define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \
+(CP_REG_AA64_MASK | \
+ ((cp) << CP_REG_ARM_COPROC_SHIFT) |\
+ ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) | \
+ ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) | \
+ ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) | \
+ ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) | \
+ ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT))
+
+/*
+ * Convert a full 64 bit KVM register ID to the truncated 32 bit
+ * version used as a key for the coprocessor register hashtable
+ */
+static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
+{
+uint32_t cpregid = kvmid;
+if ((kvmid & CP_REG_ARCH_MASK) == CP_REG_ARM64) {
+cpregid |= CP_REG_AA64_MASK;
+} else {
+if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) {
+cpregid |= (1 << 15);
+}
+
+/*
+ * KVM is always non-secure so add the NS flag on AArch32 register
+ * entries.
+ */
+ cpregid |= 1 << CP_REG_NS_SHIFT;
+}
+return cpregid;
+}
+
+/*
+ * Convert a truncated 32 bit hashtable key into the full
+ * 64 bit KVM register ID.
+ */
+static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+{
+uint64_t kvmid;
+
+if (cpregid & CP_REG_AA64_MASK) {
+kvmid = cpregid & ~CP_REG_AA64_MASK;
+kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM64;
+} else {
+kvmid = cpregid & ~(1 << 15);
+if (cpregid & (1 << 15)) {
+kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM;
+} else {
+kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM;
+}
+}
+return kvmid;
+}
+
 /*
  * Valid values for ARMCPRegInfo state field, indicating which of
  * the AArch32 and AArch64 execution states this register is visible in.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 2b4bd20f9d..20fa29d119 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2663,97 +2663,6 @@ static inline bool armv7m_nvic_neg_prio_requested(void 
*opaque, bool secure)
 }
 #endif
 
-/* Interface for defining coprocessor registers.
- * Registers are defined in tables of arm_cp_reginfo structs
- * which are passed to define_arm_cp_regs().
- */
-
-/* When looking up a coprocessor register we look for it
- * via an integer which encodes all of:
- *  coprocessor number
- *  Crn, Crm, opc1, opc2 fields
- *  32 or 64 bit register (ie is it accessed via MRC/MCR
- *or via MRRC/MCRR?)
- *  non-secure/secure bank (AArch32 only)
- * We allow 4 bits for opc1 because MRRC/MCRR have a 4 bit fi

[RFC PATCH 09/27] target/arm: wrap call to aarch64_sve_change_el in tcg_enabled()

[Fabiano Rosas]

From: Claudio Fontana 

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2bb302e5d2..506c057675 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -10202,11 +10202,13 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
 unsigned int cur_el = arm_current_el(env);
 int rt;
 
-/*
- * Note that new_el can never be 0.  If cur_el is 0, then
- * el0_a64 is is_a64(), else el0_a64 is ignored.
- */
-aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+if (tcg_enabled()) {
+/*
+ * Note that new_el can never be 0.  If cur_el is 0, then
+ * el0_a64 is is_a64(), else el0_a64 is ignored.
+ */
+aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+}
 
 if (cur_el < new_el) {
 /*
-- 
2.35.3

[PATCH v7 6/7] mac_newworld: Deprecate mac99 "via" option

[BALATON Zoltan]

Setting emulated machine type with a property called "via" is
confusing users so deprecate the "via" option in favour of newly added
explicit machine types. The default via=cuda option is not a valid
config (no real Mac has this combination of hardware) so no machine
type could be defined for that therefore it is kept for backwards
compatibility with older QEMU versions for now but other options
resembling real machines are deprecated.

Signed-off-by: BALATON Zoltan 
---
 hw/ppc/mac_newworld.c | 9 +
 1 file changed, 9 insertions(+)

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index f07c37328b..adf185bd3a 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -169,6 +169,15 @@ static void ppc_core99_init(MachineState *machine)
 if (PPC_INPUT(env) == PPC_FLAGS_INPUT_970) {
 warn_report("mac99 with G5 CPU is deprecated, "
 "use powermac7_3 instead");
+} else {
+if (core99_machine->via_config == CORE99_VIA_CONFIG_PMU) {
+warn_report("mac99,via=pmu is deprecated, "
+"use powermac3_1 instead");
+}
+if (core99_machine->via_config == CORE99_VIA_CONFIG_PMU_ADB) {
+warn_report("mac99,via=pmu-adb is deprecated, "
+"use powerbook3_2 instead");
+}
 }
 }
 /* allocate RAM */
-- 
2.30.6

[RFC PATCH 05/27] target/arm: Remove unused includes from helper.c

[Fabiano Rosas]

Reviewed-by: Claudio Fontana 
Reviewed-by: Cornelia Huck 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 7 ---
 1 file changed, 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index ed3da5ada3..6b0840ee31 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7,13 +7,11 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/units.h"
 #include "qemu/log.h"
 #include "trace.h"
 #include "cpu.h"
 #include "internals.h"
 #include "exec/helper-proto.h"
-#include "qemu/host-utils.h"
 #include "qemu/main-loop.h"
 #include "qemu/timer.h"
 #include "qemu/bitops.h"
@@ -22,17 +20,12 @@
 #include "exec/exec-all.h"
 #include  /* For crc32 */
 #include "hw/irq.h"
-#include "semihosting/semihost.h"
-#include "sysemu/cpus.h"
 #include "sysemu/cpu-timers.h"
 #include "sysemu/kvm.h"
-#include "qemu/range.h"
 #include "qapi/qapi-commands-machine-target.h"
 #include "qapi/error.h"
 #include "qemu/guest-random.h"
 #ifdef CONFIG_TCG
-#include "arm_ldst.h"
-#include "exec/cpu_ldst.h"
 #include "semihosting/common-semi.h"
 #endif
 #include "cpregs.h"
-- 
2.35.3

[PATCH 18/20] hw/sh4: Open-code pflash_cfi02_register()

[Philippe Mathieu-Daudé]

pflash_cfi02_register() hides an implicit sysbus mapping of
MMIO region #0. This is not practical in a heterogeneous world
where multiple cores use different address spaces. In order to
remove to remove pflash_cfi02_register() from the pflash API,
open-code it as a qdev creation call followed by an explicit
sysbus mapping.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/sh4/r2d.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index 39fc4f19d9..43a8c56d14 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -302,10 +302,11 @@ static void r2d_init(MachineState *machine)
  * addressable in words of 16bit.
  */
 dinfo = drive_get(IF_PFLASH, 0, 0);
-pflash_cfi02_register(0x0, "r2d.flash", FLASH_SIZE,
-  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-  64 * KiB, 1, 2, 0x0001, 0x227e, 0x2220, 0x2200,
-  0x555, 0x2aa, 0);
+dev = pflash_cfi02_create("r2d.flash", FLASH_SIZE,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  64 * KiB, 1, 2, 0x0001, 0x227e, 0x2220, 0x2200,
+  0x555, 0x2aa, 0);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x);
 
 /* NIC: rtl8139 on-board, and 2 slots. */
 for (i = 0; i < nb_nics; i++)
-- 
2.38.1

[RFC PATCH 12/27] target/arm: Add tcg/meson.build

[Fabiano Rosas]

This introduces the target/arm/tcg directory. Its purpose is to hold
the TCG code that is selected by CONFIG_TCG.

Signed-off-by: Fabiano Rosas 
---
We could squash this onto the next one perhaps.
---
 MAINTAINERS| 1 +
 target/arm/meson.build | 4 
 target/arm/tcg/meson.build | 0
 3 files changed, 5 insertions(+)
 create mode 100644 target/arm/tcg/meson.build

diff --git a/MAINTAINERS b/MAINTAINERS
index 7a40d4d865..50ccb74593 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -159,6 +159,7 @@ M: Peter Maydell 
 L: qemu-...@nongnu.org
 S: Maintained
 F: target/arm/
+F: target/arm/tcg/
 F: tests/tcg/arm/
 F: tests/tcg/aarch64/
 F: tests/qtest/arm-cpu-features.c
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 87e911b27f..3225dbd693 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -67,5 +67,9 @@ arm_softmmu_ss.add(files(
 
 subdir('hvf')
 
+if 'CONFIG_TCG' in config_all
+   subdir('tcg')
+endif
+
 target_arch += {'arm': arm_ss}
 target_softmmu_arch += {'arm': arm_softmmu_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
new file mode 100644
index 00..e69de29bb2
-- 
2.35.3

[RFC PATCH 03/27] target/arm: Fix checkpatch brace errors in helper.c

[Fabiano Rosas]

Fix this:
ERROR: braces {} are necessary for all arms of this statement

Reviewed-by: Claudio Fontana 
Reviewed-by: Cornelia Huck 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 67 -
 1 file changed, 42 insertions(+), 25 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 18e4680912..ed3da5ada3 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9147,10 +9147,12 @@ void cpsr_write(CPUARMState *env, uint32_t val, 
uint32_t mask,
 env->CF = (val >> 29) & 1;
 env->VF = (val << 3) & 0x8000;
 }
-if (mask & CPSR_Q)
+if (mask & CPSR_Q) {
 env->QF = ((val & CPSR_Q) != 0);
-if (mask & CPSR_T)
+}
+if (mask & CPSR_T) {
 env->thumb = ((val & CPSR_T) != 0);
+}
 if (mask & CPSR_IT_0_1) {
 env->condexec_bits &= ~3;
 env->condexec_bits |= (val >> 25) & 3;
@@ -9355,8 +9357,9 @@ static void switch_mode(CPUARMState *env, int mode)
 int i;
 
 old_mode = env->uncached_cpsr & CPSR_M;
-if (mode == old_mode)
+if (mode == old_mode) {
 return;
+}
 
 if (old_mode == ARM_CPU_MODE_FIQ) {
 memcpy(env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
@@ -9962,10 +9965,11 @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
 new_mode = ARM_CPU_MODE_UND;
 addr = 0x04;
 mask = CPSR_I;
-if (env->thumb)
+if (env->thumb) {
 offset = 2;
-else
+} else {
 offset = 4;
+}
 break;
 case EXCP_SWI:
 new_mode = ARM_CPU_MODE_SVC;
@@ -10756,10 +10760,11 @@ static inline uint16_t add16_sat(uint16_t a, uint16_t 
b)
 
 res = a + b;
 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
-if (a & 0x8000)
+if (a & 0x8000) {
 res = 0x8000;
-else
+} else {
 res = 0x7fff;
+}
 }
 return res;
 }
@@ -10771,10 +10776,11 @@ static inline uint8_t add8_sat(uint8_t a, uint8_t b)
 
 res = a + b;
 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
-if (a & 0x80)
+if (a & 0x80) {
 res = 0x80;
-else
+} else {
 res = 0x7f;
+}
 }
 return res;
 }
@@ -10786,10 +10792,11 @@ static inline uint16_t sub16_sat(uint16_t a, uint16_t 
b)
 
 res = a - b;
 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
-if (a & 0x8000)
+if (a & 0x8000) {
 res = 0x8000;
-else
+} else {
 res = 0x7fff;
+}
 }
 return res;
 }
@@ -10801,10 +10808,11 @@ static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
 
 res = a - b;
 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
-if (a & 0x80)
+if (a & 0x80) {
 res = 0x80;
-else
+} else {
 res = 0x7f;
+}
 }
 return res;
 }
@@ -10822,34 +10830,38 @@ static inline uint16_t add16_usat(uint16_t a, 
uint16_t b)
 {
 uint16_t res;
 res = a + b;
-if (res < a)
+if (res < a) {
 res = 0x;
+}
 return res;
 }
 
 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
 {
-if (a > b)
+if (a > b) {
 return a - b;
-else
+} else {
 return 0;
+}
 }
 
 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
 {
 uint8_t res;
 res = a + b;
-if (res < a)
+if (res < a) {
 res = 0xff;
+}
 return res;
 }
 
 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
 {
-if (a > b)
+if (a > b) {
 return a - b;
-else
+} else {
 return 0;
+}
 }
 
 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
@@ -10953,10 +10965,11 @@ static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
 
 static inline uint8_t do_usad(uint8_t a, uint8_t b)
 {
-if (a > b)
+if (a > b) {
 return a - b;
-else
+} else {
 return b - a;
+}
 }
 
 /* Unsigned sum of absolute byte differences.  */
@@ -10976,14 +10989,18 @@ uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t 
a, uint32_t b)
 uint32_t mask;
 
 mask = 0;
-if (flags & 1)
+if (flags & 1) {
 mask |= 0xff;
-if (flags & 2)
+}
+if (flags & 2) {
 mask |= 0xff00;
-if (flags & 4)
+}
+if (flags & 4) {
 mask |= 0xff;
-if (flags & 8)
+}
+if (flags & 8) {
 mask |= 0xff00;
+}
 return (a & mask) | (b & ~mask);
 }
 
-- 
2.35.3

[PATCH 05/20] hw/loongarch: Use generic DeviceState instead of PFlashCFI01

[Philippe Mathieu-Daudé]

Nothing here requires access to PFlashCFI01 internal fields:
use the inherited generic DeviceState.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/loongarch/virt.c | 9 -
 include/hw/loongarch/virt.h | 3 +--
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index c8a495ea30..cd5aa26f49 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -45,7 +45,7 @@
 #include "sysemu/block-backend.h"
 #include "hw/block/flash.h"
 
-static void virt_flash_create(LoongArchMachineState *lams)
+static DeviceState *virt_flash_create(LoongArchMachineState *lams)
 {
 DeviceState *dev = qdev_new(TYPE_PFLASH_CFI01);
 
@@ -62,14 +62,13 @@ static void virt_flash_create(LoongArchMachineState *lams)
 object_property_add_alias(OBJECT(lams), "pflash",
   OBJECT(dev), "drive");
 
-lams->flash = PFLASH_CFI01(dev);
+return dev;
 }
 
 static void virt_flash_map(LoongArchMachineState *lams,
MemoryRegion *sysmem)
 {
-PFlashCFI01 *flash = lams->flash;
-DeviceState *dev = DEVICE(flash);
+DeviceState *dev = lams->flash;
 hwaddr base = VIRT_FLASH_BASE;
 hwaddr size = VIRT_FLASH_SIZE;
 
@@ -899,7 +898,7 @@ static void loongarch_machine_initfn(Object *obj)
 lams->acpi = ON_OFF_AUTO_AUTO;
 lams->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
 lams->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
-virt_flash_create(lams);
+lams->flash = virt_flash_create(lams);
 }
 
 static bool memhp_type_supported(DeviceState *dev)
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index f5f818894e..519b25c722 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -12,7 +12,6 @@
 #include "hw/boards.h"
 #include "qemu/queue.h"
 #include "hw/intc/loongarch_ipi.h"
-#include "hw/block/flash.h"
 
 #define LOONGARCH_MAX_VCPUS 4
 
@@ -52,7 +51,7 @@ struct LoongArchMachineState {
 int  fdt_size;
 DeviceState *platform_bus_dev;
 PCIBus   *pci_bus;
-PFlashCFI01  *flash;
+DeviceState  *flash;
 };
 
 #define TYPE_LOONGARCH_MACHINE  MACHINE_TYPE_NAME("virt")
-- 
2.38.1

[PATCH 3/3] block-ram-registrar: reset when the graph changes

[Stefan Hajnoczi]

The BDRV_REQ_REGISTERED_BUF flag can be set on I/O requests to indicate
that I/O buffers were previously registered using bdrv_register_buf().
block-ram-registrar automatically registers guest RAM so that emulated
storage controllers can set BDRV_REQ_REGISTERED_BUF without having to
worry about registering buffers themselves.

Kevin Wolf  pointed out that block-ram-registrar does
not handle graph changes. This means buffers aren't unregistered when a
node is removed from the graph and buffer registrations aren't replayed
when a new node is inserted in the graph. Therefore
BDRV_REQ_REGISTERED_BUF may be set but the buffer wasn't previously
registered with the new node.

Fix this by monitoring graph changes and replaying buffer registration.
Note that the ram_block_notifier_add() API enumerates all RAM blocks so
we don't need to manually replay them.

Signed-off-by: Stefan Hajnoczi 
---
 block/block-ram-registrar.c | 40 -
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/block/block-ram-registrar.c b/block/block-ram-registrar.c
index 25dbafa789..1a111ac124 100644
--- a/block/block-ram-registrar.c
+++ b/block/block-ram-registrar.c
@@ -33,6 +33,35 @@ static void ram_block_removed(RAMBlockNotifier *n, void 
*host, size_t size,
 blk_unregister_buf(r->blk, host, max_size);
 }
 
+static void remove_ram_block_notifier(BlockRAMRegistrar *r)
+{
+if (r->ok) {
+ram_block_notifier_remove(&r->notifier);
+}
+}
+
+static void add_ram_block_notifier(BlockRAMRegistrar *r)
+{
+r->ok = true; /* reset flag in case it was false */
+ram_block_notifier_add(&r->notifier);
+}
+
+static void graph_change_pre_detach(BlockBackend *blk, void *opaque)
+{
+BlockRAMRegistrar *r = opaque;
+
+/* Unregisters all buffers from all BDSes */
+remove_ram_block_notifier(r);
+}
+
+static void graph_change_post_attach(BlockBackend *blk, void *opaque)
+{
+BlockRAMRegistrar *r = opaque;
+
+/* Re-registers all buffers with all BDSes */
+add_ram_block_notifier(r);
+}
+
 void blk_ram_registrar_init(BlockRAMRegistrar *r, BlockBackend *blk)
 {
 r->blk = blk;
@@ -45,14 +74,15 @@ void blk_ram_registrar_init(BlockRAMRegistrar *r, 
BlockBackend *blk)
  * value that does not change across resize.
  */
 };
-r->ok = true;
 
-ram_block_notifier_add(&r->notifier);
+blk_add_graph_change_notifier(blk, graph_change_pre_detach,
+  graph_change_post_attach, r);
+add_ram_block_notifier(r);
 }
 
 void blk_ram_registrar_destroy(BlockRAMRegistrar *r)
 {
-if (r->ok) {
-ram_block_notifier_remove(&r->notifier);
-}
+remove_ram_block_notifier(r);
+blk_remove_graph_change_notifier(r->blk, graph_change_pre_detach,
+ graph_change_post_attach, r);
 }
-- 
2.39.0

[RFC PATCH 23/27] tests: do not run test-hmp on all machines for ARM KVM-only

[Fabiano Rosas]

From: Claudio Fontana 

on ARM we currently list and build all machines, even when
building KVM-only, without TCG.

Until we fix this (and we only list and build machines that are
compatible with KVM), only test specifically using the "virt"
machine in this case.

Signed-off-by: Claudio Fontana 
Signed-off-by: Fabiano Rosas 
Cc: Thomas Huth 
cc: Laurent Vivier 
Cc: "Dr. David Alan Gilbert" 
---
 tests/qtest/test-hmp.c | 21 +
 1 file changed, 21 insertions(+)

diff --git a/tests/qtest/test-hmp.c b/tests/qtest/test-hmp.c
index f8b22abe4c..daa1e76a06 100644
--- a/tests/qtest/test-hmp.c
+++ b/tests/qtest/test-hmp.c
@@ -157,8 +157,29 @@ int main(int argc, char **argv)
 
 g_test_init(&argc, &argv, NULL);
 
+/*
+ * XXX currently we build also boards for ARM that are
+ * incompatible with KVM.  We therefore need to check this
+ * explicitly, and only test virt for kvm-only arm builds. After
+ * we do the work of Kconfig etc to ensure that only
+ * KVM-compatible boards are built for the kvm-only build, we
+ * could remove this.
+ */
+#ifndef CONFIG_TCG
+{
+const char *arch = qtest_get_arch();
+
+if (strcmp(arch, "arm") == 0 || strcmp(arch, "aarch64") == 0) {
+add_machine_test_case("virt");
+goto add_machine_test_done;
+}
+}
+#endif /* !CONFIG_TCG */
+
 qtest_cb_for_every_machine(add_machine_test_case, g_test_quick());
+goto add_machine_test_done;
 
+ add_machine_test_done:
 /* as none machine has no memory by default, add a test case with memory */
 qtest_add_data_func("hmp/none+2MB", g_strdup("none -m 2"), test_machine);
 
-- 
2.35.3

Re: [RFC PATCH 07/27] target/arm: rename handle_semihosting to tcg_handle_semihosting

[Philippe Mathieu-Daudé]

On 4/1/23 22:58, Fabiano Rosas wrote:

From: Claudio Fontana 

make it clearer from the name that this is a tcg-only function.

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
Signed-off-by: Fabiano Rosas 
---
  target/arm/helper.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)


Reviewed-by: Philippe Mathieu-Daudé 

[RFC PATCH 10/27] target/arm: Move PC alignment check

[Fabiano Rosas]

Move this earlier to make the next patch diff cleaner. While here
update the comment slightly to not give the impression that the
misalignment affects only TCG.

Reviewed-by: Richard Henderson 
Signed-off-by: Fabiano Rosas 
---
 target/arm/machine.c | 18 +-
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index 54c5c62433..a186787d2b 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -811,6 +811,15 @@ static int cpu_post_load(void *opaque, int version_id)
 }
 }
 
+/*
+ * Misaligned thumb pc is architecturally impossible. Fail the
+ * incoming migration. For TCG it would trigger the assert in
+ * thumb_tr_translate_insn().
+ */
+if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
+return -1;
+}
+
 hw_breakpoint_update_all(cpu);
 hw_watchpoint_update_all(cpu);
 
@@ -828,15 +837,6 @@ static int cpu_post_load(void *opaque, int version_id)
 }
 }
 
-/*
- * Misaligned thumb pc is architecturally impossible.
- * We have an assert in thumb_tr_translate_insn to verify this.
- * Fail an incoming migrate to avoid this assert.
- */
-if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
-return -1;
-}
-
 if (!kvm_enabled()) {
 pmu_op_finish(&cpu->env);
 }
-- 
2.35.3

Re: [RFC PATCH 13/27] target/arm: move translate modules to tcg/

[Philippe Mathieu-Daudé]

On 4/1/23 22:58, Fabiano Rosas wrote:

From: Claudio Fontana 

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
Reviewed-by: Alex Bennée 
Signed-off-by: Fabiano Rosas 
---
I also moved translate-{m-nocp,mve,neon,vfp,sme}.c

Originally from:
https://lore.kernel.org/r/20210416162824.25131-2-cfont...@suse.de
[RFC v14 01/80] target/arm: move translate modules to tcg/
---
  target/arm/meson.build  | 26 
  target/arm/{ => tcg}/a32-uncond.decode  |  0
  target/arm/{ => tcg}/a32.decode |  0
  target/arm/{ => tcg}/m-nocp.decode  |  0
  target/arm/tcg/meson.build  | 32 +
  target/arm/{ => tcg}/mve.decode |  0
  target/arm/{ => tcg}/neon-dp.decode |  0
  target/arm/{ => tcg}/neon-ls.decode |  0
  target/arm/{ => tcg}/neon-shared.decode |  0
  target/arm/{ => tcg}/sme-fa64.decode|  0
  target/arm/{ => tcg}/sme.decode |  0
  target/arm/{ => tcg}/sve.decode |  0
  target/arm/{ => tcg}/t16.decode |  0
  target/arm/{ => tcg}/t32.decode |  0
  target/arm/{ => tcg}/translate-a64.c|  0
  target/arm/{ => tcg}/translate-a64.h|  0
  target/arm/{ => tcg}/translate-m-nocp.c |  0
  target/arm/{ => tcg}/translate-mve.c|  0
  target/arm/{ => tcg}/translate-neon.c   |  0
  target/arm/{ => tcg}/translate-sme.c|  0
  target/arm/{ => tcg}/translate-sve.c|  0
  target/arm/{ => tcg}/translate-vfp.c|  0
  target/arm/{ => tcg}/translate.c|  0
  target/arm/{ => tcg}/translate.h|  0
  target/arm/{ => tcg}/vfp-uncond.decode  |  0
  target/arm/{ => tcg}/vfp.decode |  0
  26 files changed, 32 insertions(+), 26 deletions(-)
  rename target/arm/{ => tcg}/a32-uncond.decode (100%)
  rename target/arm/{ => tcg}/a32.decode (100%)
  rename target/arm/{ => tcg}/m-nocp.decode (100%)
  rename target/arm/{ => tcg}/mve.decode (100%)
  rename target/arm/{ => tcg}/neon-dp.decode (100%)
  rename target/arm/{ => tcg}/neon-ls.decode (100%)
  rename target/arm/{ => tcg}/neon-shared.decode (100%)
  rename target/arm/{ => tcg}/sme-fa64.decode (100%)
  rename target/arm/{ => tcg}/sme.decode (100%)
  rename target/arm/{ => tcg}/sve.decode (100%)
  rename target/arm/{ => tcg}/t16.decode (100%)
  rename target/arm/{ => tcg}/t32.decode (100%)
  rename target/arm/{ => tcg}/translate-a64.c (100%)
  rename target/arm/{ => tcg}/translate-a64.h (100%)
  rename target/arm/{ => tcg}/translate-m-nocp.c (100%)
  rename target/arm/{ => tcg}/translate-mve.c (100%)
  rename target/arm/{ => tcg}/translate-neon.c (100%)
  rename target/arm/{ => tcg}/translate-sme.c (100%)
  rename target/arm/{ => tcg}/translate-sve.c (100%)
  rename target/arm/{ => tcg}/translate-vfp.c (100%)
  rename target/arm/{ => tcg}/translate.c (100%)
  rename target/arm/{ => tcg}/translate.h (100%)
  rename target/arm/{ => tcg}/vfp-uncond.decode (100%)
  rename target/arm/{ => tcg}/vfp.decode (100%)


Reviewed-by: Philippe Mathieu-Daudé 

[PATCH 11/20] hw/microblaze: Open-code pflash_cfi01_register()

[Philippe Mathieu-Daudé]

pflash_cfi01_register() hides an implicit sysbus mapping of
MMIO region #0. This is not practical in a heterogeneous world
where multiple cores use different address spaces. In order to
remove to remove pflash_cfi01_register() from the pflash API,
open-code it as a qdev creation call followed by an explicit
sysbus mapping.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/microblaze/petalogix_ml605_mmu.c  | 8 
 hw/microblaze/petalogix_s3adsp1800_mmu.c | 8 
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/microblaze/petalogix_ml605_mmu.c 
b/hw/microblaze/petalogix_ml605_mmu.c
index a24fadddca..d5ff71218d 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -105,10 +105,10 @@ petalogix_ml605_init(MachineState *machine)
 dinfo = drive_get(IF_PFLASH, 0, 0);
 /* 5th parameter 2 means bank-width
  * 10th paremeter 0 means little-endian */
-pflash_cfi01_register(FLASH_BASEADDR, "petalogix_ml605.flash", FLASH_SIZE,
-  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-  64 * KiB, 2, 0x89, 0x18, 0x, 0x0, 0);
-
+dev = pflash_cfi01_create("petalogix_ml605.flash", FLASH_SIZE,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  64 * KiB, 2, 0x89, 0x18, 0x, 0x0, 0);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, FLASH_BASEADDR);
 
 dev = qdev_new("xlnx.xps-intc");
 qdev_prop_set_uint32(dev, "kind-of-intr", 1 << TIMER_IRQ);
diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c 
b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index 9d959d1ad8..426ff1de93 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -84,10 +84,10 @@ petalogix_s3adsp1800_init(MachineState *machine)
 memory_region_add_subregion(sysmem, ddr_base, phys_ram);
 
 dinfo = drive_get(IF_PFLASH, 0, 0);
-pflash_cfi01_register(FLASH_BASEADDR,
-  "petalogix_s3adsp1800.flash", FLASH_SIZE,
-  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-  64 * KiB, 1, 0x89, 0x18, 0x, 0x0, 1);
+dev = pflash_cfi01_create("petalogix_s3adsp1800.flash", FLASH_SIZE,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  64 * KiB, 1, 0x89, 0x18, 0x, 0x0, 1);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, FLASH_BASEADDR);
 
 dev = qdev_new("xlnx.xps-intc");
 qdev_prop_set_uint32(dev, "kind-of-intr",
-- 
2.38.1

[PATCH 19/20] hw/block: Remove unused pflash_cfi02_register()

[Philippe Mathieu-Daudé]

We converted all caller of pflash_cfi02_register() by open
coding a call to pflash_cfi02_create() followed by an explicit
call to sysbus_mmio_map(); we can now remove it.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/block/pflash_cfi02.c  | 22 --
 include/hw/block/flash.h | 12 
 2 files changed, 34 deletions(-)

diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index 176f93b512..a9dcabdeb2 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -1024,25 +1024,3 @@ DeviceState *pflash_cfi02_create(const char *name, 
hwaddr size,
 
 return dev;
 }
-
-PFlashCFI02 *pflash_cfi02_register(hwaddr base,
-   const char *name,
-   hwaddr size,
-   BlockBackend *blk,
-   uint32_t sector_len,
-   int nb_mappings, int width,
-   uint16_t id0, uint16_t id1,
-   uint16_t id2, uint16_t id3,
-   uint16_t unlock_addr0,
-   uint16_t unlock_addr1,
-   int be)
-{
-DeviceState *dev;
-
-dev = pflash_cfi02_create(name, size, blk, sector_len,
-  nb_mappings, width, id0, id1, id2, id3,
-  unlock_addr0, unlock_addr1, be);
-sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
-
-return PFLASH_CFI02(dev);
-}
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 78b078955e..64ee40c561 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -45,18 +45,6 @@ DeviceState *pflash_cfi02_create(const char *name, hwaddr 
size,
  uint16_t id2, uint16_t id3,
  uint16_t unlock_addr0, uint16_t unlock_addr1,
  int be);
-PFlashCFI02 *pflash_cfi02_register(hwaddr base,
-   const char *name,
-   hwaddr size,
-   BlockBackend *blk,
-   uint32_t sector_len,
-   int nb_mappings,
-   int width,
-   uint16_t id0, uint16_t id1,
-   uint16_t id2, uint16_t id3,
-   uint16_t unlock_addr0,
-   uint16_t unlock_addr1,
-   int be);
 
 /* nand.c */
 DeviceState *nand_init(BlockBackend *blk, int manf_id, int chip_id);
-- 
2.38.1

[RFC PATCH 21/27] target/arm: make further preparation for the exception code to move

[Fabiano Rosas]

From: Claudio Fontana 

the exception code needs some adjustment before being exposed to
KVM-only builds. We need to call arm_rebuild_hflags only when TCG is
enabled, or we will error out.

The direct call to helper_rebuild_hflags_a64(env, new_el) will not
be possible when extracting out to common code,
it seems safe to replace it with a call to arm_rebuild_hflags, since
the write to pstate is already done.

Signed-off-by: Claudio Fontana 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 10 --
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index bea1ef242a..a536d77611 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1131,7 +1131,9 @@ static void take_aarch32_exception(CPUARMState *env, int 
new_mode,
 env->regs[14] = env->regs[15] + offset;
 }
 env->regs[15] = newpc;
-arm_rebuild_hflags(env);
+if (tcg_enabled()) {
+arm_rebuild_hflags(env);
+}
 }
 
 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
@@ -1687,7 +1689,11 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
 pstate_write(env, PSTATE_DAIF | new_mode);
 env->aarch64 = true;
 aarch64_restore_sp(env, new_el);
-helper_rebuild_hflags_a64(env, new_el);
+
+if (tcg_enabled()) {
+/* pstate already written, so we can use arm_rebuild_hflags here */
+arm_rebuild_hflags(env);
+}
 
 env->pc = addr;
 
-- 
2.35.3

[PATCH 00/20] hw: Remove implicit sysbus_mmio_map() from pflash APIs

[Philippe Mathieu-Daudé]

Paving the road toward heterogeneous QEMU, the limitations of
having a single machine sysbus become more apparent.

The sysbus_mmio_map() API forces the caller to map a sysbus
device to an address on the system bus (system bus here is
the root MemoryRegion returned by get_system_memory() ).

This is not practical when each core has its own address
space and group of cores have access to a part of the
peripherals.

Experimenting with the PFLASH devices. Here the fix is
quite easy, we split the pflash_cfi_register() -- which
does the implicit sysbus mapping -- into an explicit qdev
pflash_cfi_create() followed by the sysbus_mmio_map() call.

Since we were touching the PFLASH API, we restricted the
PFlashCFI0X structures to their models. The API now deals
with a generic qdev pointer (DeviceState*).

First 15 patches deal with the CFI type 1 model, then the
last 5 with the type 2.

The patch logic is mostly:

- extract pflash_cfi_create() from pflash_cfi_register()
- open-code pflash_cfi_register() for each hw/${ARCH}/
- remove unused pflash_cfi_register()
- reduce PFlashCFI0x structure scope

Please review,

Phil.

Philippe Mathieu-Daudé (20):
  hw/block: Pass DeviceState to pflash_cfi01_get_blk()
  hw/block: Use pflash_cfi01_get_blk() in pflash_cfi01_legacy_drive()
  hw/block: Pass DeviceState to pflash_cfi01_get_memory()
  hw/arm: Use generic DeviceState instead of PFlashCFI01
  hw/loongarch: Use generic DeviceState instead of PFlashCFI01
  hw/riscv: Use generic DeviceState instead of PFlashCFI01
  hw/i386: Use generic DeviceState instead of PFlashCFI01
  hw/xtensa: Use generic DeviceState instead of PFlashCFI01
  hw/block: Factor pflash_cfi01_create() out of pflash_cfi01_register()
  hw/arm: Open-code pflash_cfi01_register()
  hw/microblaze: Open-code pflash_cfi01_register()
  hw/mips: Open-code pflash_cfi01_register()
  hw/ppc: Open-code pflash_cfi01_register()
  hw/block: Remove unused pflash_cfi01_register()
  hw/block: Make PFlashCFI01 QOM declaration internal
  hw/block: Factor pflash_cfi02_create() out of pflash_cfi02_register()
  hw/arm: Open-code pflash_cfi02_register()
  hw/sh4: Open-code pflash_cfi02_register()
  hw/block: Remove unused pflash_cfi02_register()
  hw/block: Make PFlashCFI02 QOM declaration internal

 hw/arm/collie.c  | 15 ---
 hw/arm/digic_boards.c| 14 +++---
 hw/arm/gumstix.c | 19 +---
 hw/arm/mainstone.c   | 13 +++---
 hw/arm/musicpal.c| 13 +++---
 hw/arm/omap_sx1.c| 22 +
 hw/arm/sbsa-ref.c|  8 ++--
 hw/arm/versatilepb.c | 13 +++---
 hw/arm/vexpress.c| 12 +++--
 hw/arm/virt.c|  6 +--
 hw/arm/xilinx_zynq.c | 10 ++---
 hw/arm/z2.c  | 10 +++--
 hw/block/pflash_cfi01.c  | 35 ---
 hw/block/pflash_cfi02.c  | 25 +--
 hw/i386/pc_sysfw.c   |  6 +--
 hw/loongarch/virt.c  |  9 ++--
 hw/microblaze/petalogix_ml605_mmu.c  |  8 ++--
 hw/microblaze/petalogix_s3adsp1800_mmu.c |  8 ++--
 hw/mips/malta.c  | 13 +++---
 hw/ppc/e500.c|  2 +-
 hw/ppc/sam460ex.c| 12 +++--
 hw/ppc/virtex_ml507.c|  7 +--
 hw/riscv/virt.c  |  7 +--
 hw/sh4/r2d.c |  9 ++--
 hw/xtensa/xtfpga.c   |  6 +--
 include/hw/arm/virt.h|  3 +-
 include/hw/block/flash.h | 57 
 include/hw/i386/pc.h |  3 +-
 include/hw/loongarch/virt.h  |  3 +-
 include/hw/riscv/virt.h  |  3 +-
 30 files changed, 200 insertions(+), 171 deletions(-)

-- 
2.38.1

[RFC PATCH 07/27] target/arm: rename handle_semihosting to tcg_handle_semihosting

[Fabiano Rosas]

From: Claudio Fontana 

make it clearer from the name that this is a tcg-only function.

Signed-off-by: Claudio Fontana 
Reviewed-by: Richard Henderson 
Signed-off-by: Fabiano Rosas 
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 6b0840ee31..89c07a88ea 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -10389,7 +10389,7 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
  * trapped to the hypervisor in KVM.
  */
 #ifdef CONFIG_TCG
-static void handle_semihosting(CPUState *cs)
+static void tcg_handle_semihosting(CPUState *cs)
 {
 ARMCPU *cpu = ARM_CPU(cs);
 CPUARMState *env = &cpu->env;
@@ -10451,7 +10451,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
  */
 #ifdef CONFIG_TCG
 if (cs->exception_index == EXCP_SEMIHOST) {
-handle_semihosting(cs);
+tcg_handle_semihosting(cs);
 return;
 }
 #endif
-- 
2.35.3

[RFC PATCH 24/27] tests: do not run qom-test on all machines for ARM KVM-only

[Fabiano Rosas]

From: Claudio Fontana 

on ARM we currently list and build all machines, even when
building KVM-only, without TCG.

Until we fix this (and we only list and build machines that are
compatible with KVM), only test specifically using the "virt"
machine in this case.

Signed-off-by: Claudio Fontana 
Signed-off-by: Fabiano Rosas 
Cc: Thomas Huth 
Cc: Laurent Vivier 
---
 tests/qtest/qom-test.c | 21 +
 1 file changed, 21 insertions(+)

diff --git a/tests/qtest/qom-test.c b/tests/qtest/qom-test.c
index 13510bc349..aea969ef60 100644
--- a/tests/qtest/qom-test.c
+++ b/tests/qtest/qom-test.c
@@ -105,7 +105,28 @@ int main(int argc, char **argv)
 {
 g_test_init(&argc, &argv, NULL);
 
+/*
+ * XXX currently we build also boards for ARM that are
+ * incompatible with KVM.  We therefore need to check this
+ * explicitly, and only test virt for kvm-only arm builds. After
+ * we do the work of Kconfig etc to ensure that only
+ * KVM-compatible boards are built for the kvm-only build, we
+ * could remove this.
+ */
+#ifndef CONFIG_TCG
+{
+const char *arch = qtest_get_arch();
+
+if (strcmp(arch, "arm") == 0 || strcmp(arch, "aarch64") == 0) {
+add_machine_test_case("virt");
+goto add_machine_test_done;
+}
+}
+#endif /* !CONFIG_TCG */
+
 qtest_cb_for_every_machine(add_machine_test_case, g_test_quick());
+goto add_machine_test_done;
 
+ add_machine_test_done:
 return g_test_run();
 }
-- 
2.35.3

[RFC PATCH 27/27] target/arm: don't access TCG code when debugging with KVM

[Fabiano Rosas]

When TCG is disabled this part of the code should not be reachable, so
wrap it with an ifdef for now.

This allows us to start using CONFIG_TCG=n (--disable-tcg in the
configure line).

Signed-off-by: Fabiano Rosas 
---
As I understand it, only a small part of the ptw routines should be
necessary for use with KVM+gdbstub. But I don't know enough about arm
MMU yet to make that distinction.
---
 target/arm/ptw.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index f812734bfb..a85eba101f 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -254,6 +254,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate 
*ptw,
 ptw->out_host = NULL;
 ptw->out_rw = false;
 } else {
+#ifdef CONFIG_TCG
 CPUTLBEntryFull *full;
 int flags;
 
@@ -270,6 +271,9 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate 
*ptw,
 ptw->out_rw = full->prot & PAGE_WRITE;
 pte_attrs = full->pte_attrs;
 pte_secure = full->attrs.secure;
+#else
+g_assert_not_reached();
+#endif
 }
 
 if (regime_is_stage2(s2_mmu_idx)) {
-- 
2.35.3

[PATCH 01/20] hw/block: Pass DeviceState to pflash_cfi01_get_blk()

[Philippe Mathieu-Daudé]

The point of a getter() function is to not expose the structure
internal fields. Otherwise callers could simply access the
PFlashCFI01::blk field.

Have the callers pass a DeviceState* argument. The QOM
type check is done in the callee.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/sbsa-ref.c| 2 +-
 hw/arm/virt.c| 2 +-
 hw/block/pflash_cfi01.c  | 4 +++-
 hw/i386/pc_sysfw.c   | 4 ++--
 include/hw/block/flash.h | 2 +-
 5 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 4bb444684f..65b9acba04 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -346,7 +346,7 @@ static bool sbsa_firmware_init(SBSAMachineState *sms,
 
 sbsa_flash_map(sms, sysmem, secure_sysmem);
 
-pflash_blk0 = pflash_cfi01_get_blk(sms->flash[0]);
+pflash_blk0 = pflash_cfi01_get_blk(DEVICE(sms->flash[0]));
 
 bios_name = MACHINE(sms)->firmware;
 if (bios_name) {
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index ea2413a0ba..954e3ca5ce 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1233,7 +1233,7 @@ static bool virt_firmware_init(VirtMachineState *vms,
 
 virt_flash_map(vms, sysmem, secure_sysmem);
 
-pflash_blk0 = pflash_cfi01_get_blk(vms->flash[0]);
+pflash_blk0 = pflash_cfi01_get_blk(DEVICE(vms->flash[0]));
 
 bios_name = MACHINE(vms)->firmware;
 if (bios_name) {
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 0cbc2fb4cb..458c50ec45 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -984,8 +984,10 @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
 return PFLASH_CFI01(dev);
 }
 
-BlockBackend *pflash_cfi01_get_blk(PFlashCFI01 *fl)
+BlockBackend *pflash_cfi01_get_blk(DeviceState *dev)
 {
+PFlashCFI01 *fl = PFLASH_CFI01(dev);
+
 return fl->blk;
 }
 
diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index c8d9e71b88..4b85c48ec8 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -152,7 +152,7 @@ static void pc_system_flash_map(PCMachineState *pcms,
 
 for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
 system_flash = pcms->flash[i];
-blk = pflash_cfi01_get_blk(system_flash);
+blk = pflash_cfi01_get_blk(DEVICE(system_flash));
 if (!blk) {
 break;
 }
@@ -216,7 +216,7 @@ void pc_system_firmware_init(PCMachineState *pcms,
 for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
 pflash_cfi01_legacy_drive(pcms->flash[i],
   drive_get(IF_PFLASH, 0, i));
-pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
+pflash_blk[i] = pflash_cfi01_get_blk(DEVICE(pcms->flash[i]));
 }
 
 /* Reject gaps */
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 86d8363bb0..961b6e9f74 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -21,7 +21,7 @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
uint16_t id0, uint16_t id1,
uint16_t id2, uint16_t id3,
int be);
-BlockBackend *pflash_cfi01_get_blk(PFlashCFI01 *fl);
+BlockBackend *pflash_cfi01_get_blk(DeviceState *dev);
 MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl);
 void pflash_cfi01_legacy_drive(PFlashCFI01 *dev, DriveInfo *dinfo);
 
-- 
2.38.1

[PATCH 20/20] hw/block: Make PFlashCFI02 QOM declaration internal

[Philippe Mathieu-Daudé]

Convert the QOM PFlashCFI02 to a forward/opaque pointer declaration.
Only pflash_cfi02.c is able to poke at the internal fields.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/block/pflash_cfi02.c  | 2 ++
 include/hw/block/flash.h | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index a9dcabdeb2..90b5feb36c 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -63,6 +63,8 @@ enum {
 WCYCLE_AUTOSELECT_CFI   = 8,
 };
 
+OBJECT_DECLARE_SIMPLE_TYPE(PFlashCFI02, PFLASH_CFI02)
+
 struct PFlashCFI02 {
 /*< private >*/
 SysBusDevice parent_obj;
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 64ee40c561..aefbaa9493 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -30,7 +30,6 @@ void pflash_cfi01_legacy_drive(DeviceState *dev, DriveInfo 
*dinfo);
 /* pflash_cfi02.c */
 
 #define TYPE_PFLASH_CFI02 "cfi.pflash02"
-OBJECT_DECLARE_SIMPLE_TYPE(PFlashCFI02, PFLASH_CFI02)
 
 /**
  * Create and realize a parallel NOR flash (CFI type 2) on the heap.
-- 
2.38.1

[PATCH 03/20] hw/block: Pass DeviceState to pflash_cfi01_get_memory()

[Philippe Mathieu-Daudé]

The point of a getter() function is to not expose the structure
internal fields. Otherwise callers could simply access the
PFlashCFI01::mem field.

Have the callers pass a DeviceState* argument. The QOM
type check is done in the callee.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/block/pflash_cfi01.c  | 4 +++-
 hw/i386/pc_sysfw.c   | 2 +-
 hw/mips/malta.c  | 3 ++-
 hw/ppc/e500.c| 2 +-
 hw/xtensa/xtfpga.c   | 2 +-
 include/hw/block/flash.h | 2 +-
 6 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 8beba24989..866ea596ea 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -991,8 +991,10 @@ BlockBackend *pflash_cfi01_get_blk(DeviceState *dev)
 return fl->blk;
 }
 
-MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl)
+MemoryRegion *pflash_cfi01_get_memory(DeviceState *dev)
 {
+PFlashCFI01 *fl = PFLASH_CFI01(dev);
+
 return &fl->mem;
 }
 
diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index c08cba6628..60db0efb41 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -187,7 +187,7 @@ static void pc_system_flash_map(PCMachineState *pcms,
 0x1ULL - total_size);
 
 if (i == 0) {
-flash_mem = pflash_cfi01_get_memory(system_flash);
+flash_mem = pflash_cfi01_get_memory(DEVICE(system_flash));
 pc_isa_bios_init(rom_memory, flash_mem, size);
 
 /* Encrypt the pflash boot ROM */
diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index c0a2e0ab04..43fbb97799 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -1291,7 +1291,8 @@ void mips_malta_init(MachineState *machine)
dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
65536,
4, 0x, 0x, 0x, 0x, be);
-bios = pflash_cfi01_get_memory(fl);
+dev = DEVICE(fl);
+bios = pflash_cfi01_get_memory(dev);
 fl_idx++;
 if (kernel_filename) {
 ram_low_size = MIN(ram_size, 256 * MiB);
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 9fa1f8e6cf..b127068431 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -1144,7 +1144,7 @@ void ppce500_init(MachineState *machine)
 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
 memory_region_add_subregion(&pms->pbus_dev->mmio, 0,
-
pflash_cfi01_get_memory(PFLASH_CFI01(dev)));
+pflash_cfi01_get_memory(dev));
 }
 
 /*
diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
index 2a5556a35f..bce3a543b0 100644
--- a/hw/xtensa/xtfpga.c
+++ b/hw/xtensa/xtfpga.c
@@ -459,7 +459,7 @@ static void xtfpga_init(const XtfpgaBoardDesc *board, 
MachineState *machine)
 }
 } else {
 if (flash) {
-MemoryRegion *flash_mr = pflash_cfi01_get_memory(flash);
+MemoryRegion *flash_mr = pflash_cfi01_get_memory(DEVICE(flash));
 MemoryRegion *flash_io = g_malloc(sizeof(*flash_io));
 uint32_t size = env->config->sysrom.location[0].size;
 
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 701a2c1701..25affdf7a5 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -22,7 +22,7 @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
uint16_t id2, uint16_t id3,
int be);
 BlockBackend *pflash_cfi01_get_blk(DeviceState *dev);
-MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl);
+MemoryRegion *pflash_cfi01_get_memory(DeviceState *dev);
 void pflash_cfi01_legacy_drive(DeviceState *dev, DriveInfo *dinfo);
 
 /* pflash_cfi02.c */
-- 
2.38.1

[PATCH 10/20] hw/arm: Open-code pflash_cfi01_register()

[Philippe Mathieu-Daudé]

pflash_cfi01_register() hides an implicit sysbus mapping of
MMIO region #0. This is not practical in a heterogeneous world
where multiple cores use different address spaces. In order to
remove to remove pflash_cfi01_register() from the pflash API,
open-code it as a qdev creation call followed by an explicit
sysbus mapping.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/collie.c  | 15 +--
 hw/arm/gumstix.c | 19 +--
 hw/arm/mainstone.c   | 13 -
 hw/arm/omap_sx1.c| 22 ++
 hw/arm/versatilepb.c | 13 -
 hw/arm/z2.c  | 10 +++---
 6 files changed, 59 insertions(+), 33 deletions(-)

diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index 8df31e2793..1fbb1a5773 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -39,6 +39,7 @@ static void collie_init(MachineState *machine)
 DriveInfo *dinfo;
 MachineClass *mc = MACHINE_GET_CLASS(machine);
 CollieMachineState *cms = COLLIE_MACHINE(machine);
+DeviceState *dev;
 
 if (machine->ram_size != mc->default_ram_size) {
 char *sz = size_to_str(mc->default_ram_size);
@@ -52,14 +53,16 @@ static void collie_init(MachineState *machine)
 memory_region_add_subregion(get_system_memory(), SA_SDCS0, machine->ram);
 
 dinfo = drive_get(IF_PFLASH, 0, 0);
-pflash_cfi01_register(SA_CS0, "collie.fl1", 0x0200,
-dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-64 * KiB, 4, 0x00, 0x00, 0x00, 0x00, 0);
+dev = pflash_cfi01_create("collie.fl1", 0x0200,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  64 * KiB, 4, 0x00, 0x00, 0x00, 0x00, 0);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, SA_CS0);
 
 dinfo = drive_get(IF_PFLASH, 0, 1);
-pflash_cfi01_register(SA_CS1, "collie.fl2", 0x0200,
-dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-64 * KiB, 4, 0x00, 0x00, 0x00, 0x00, 0);
+dev = pflash_cfi01_create("collie.fl2", 0x0200,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  64 * KiB, 4, 0x00, 0x00, 0x00, 0x00, 0);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, SA_CS1);
 
 sysbus_create_simple("scoop", 0x4080, NULL);
 
diff --git a/hw/arm/gumstix.c b/hw/arm/gumstix.c
index 3a4bc332c4..7b80a7d0a4 100644
--- a/hw/arm/gumstix.c
+++ b/hw/arm/gumstix.c
@@ -40,6 +40,7 @@
 #include "net/net.h"
 #include "hw/block/flash.h"
 #include "hw/net/smc91c111.h"
+#include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "exec/address-spaces.h"
 #include "sysemu/qtest.h"
@@ -51,6 +52,7 @@ static void connex_init(MachineState *machine)
 {
 PXA2xxState *cpu;
 DriveInfo *dinfo;
+DeviceState *dev;
 MemoryRegion *address_space_mem = get_system_memory();
 
 uint32_t connex_rom = 0x0100;
@@ -65,12 +67,14 @@ static void connex_init(MachineState *machine)
 exit(1);
 }
 
-if (!pflash_cfi01_register(0x, "connext.rom", connex_rom,
-   dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-   sector_len, 2, 0, 0, 0, 0, 0)) {
+dev = pflash_cfi01_create("connext.rom", connex_rom,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  sector_len, 2, 0, 0, 0, 0, 0);
+if (!dev) {
 error_report("Error registering flash memory");
 exit(1);
 }
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x);
 
 /* Interrupt line of NIC is connected to GPIO line 36 */
 smc91c111_init(&nd_table[0], 0x04000300,
@@ -81,6 +85,7 @@ static void verdex_init(MachineState *machine)
 {
 PXA2xxState *cpu;
 DriveInfo *dinfo;
+DeviceState *dev;
 MemoryRegion *address_space_mem = get_system_memory();
 
 uint32_t verdex_rom = 0x0200;
@@ -95,12 +100,14 @@ static void verdex_init(MachineState *machine)
 exit(1);
 }
 
-if (!pflash_cfi01_register(0x, "verdex.rom", verdex_rom,
-   dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-   sector_len, 2, 0, 0, 0, 0, 0)) {
+dev = pflash_cfi01_create("verdex.rom", verdex_rom,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  sector_len, 2, 0, 0, 0, 0, 0);
+if (!dev) {
 error_report("Error registering flash memory");
 exit(1);
 }
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x);
 
 /* Interrupt line of NIC is connected to GPIO line 99 */
 smc91c111_init(&nd_table[0], 0x04000300,
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index 8454b65458..ac34be3709 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -129,15 +129,18 @@ static void mainstone_common_init(MemoryRegion 
*address_space_mem,
 
 /* There are two 32MiB flash devices on the board */
 for (i = 0; i < 2; i ++) {
+Devic

[PATCH 17/20] hw/arm: Open-code pflash_cfi02_register()

[Philippe Mathieu-Daudé]

pflash_cfi02_register() hides an implicit sysbus mapping of
MMIO region #0. This is not practical in a heterogeneous world
where multiple cores use different address spaces. In order to
remove to remove pflash_cfi02_register() from the pflash API,
open-code it as a qdev creation call followed by an explicit
sysbus mapping.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/digic_boards.c | 14 --
 hw/arm/musicpal.c | 13 +++--
 hw/arm/xilinx_zynq.c  | 10 +-
 3 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c
index 4093af09cb..98b0002d16 100644
--- a/hw/arm/digic_boards.c
+++ b/hw/arm/digic_boards.c
@@ -115,13 +115,15 @@ static void digic4_add_k8p3215uqb_rom(DigicState *s, 
hwaddr addr,
 {
 #define FLASH_K8P3215UQB_SIZE (4 * 1024 * 1024)
 #define FLASH_K8P3215UQB_SECTOR_SIZE (64 * 1024)
+DeviceState *dev;
 
-pflash_cfi02_register(addr, "pflash", FLASH_K8P3215UQB_SIZE,
-  NULL, FLASH_K8P3215UQB_SECTOR_SIZE,
-  DIGIC4_ROM_MAX_SIZE / FLASH_K8P3215UQB_SIZE,
-  4,
-  0x00EC, 0x007E, 0x0003, 0x0001,
-  0x0555, 0x2aa, 0);
+dev = pflash_cfi02_create("pflash", FLASH_K8P3215UQB_SIZE,
+  NULL, FLASH_K8P3215UQB_SECTOR_SIZE,
+  DIGIC4_ROM_MAX_SIZE / FLASH_K8P3215UQB_SIZE,
+  4,
+  0x00EC, 0x007E, 0x0003, 0x0001,
+  0x0555, 0x2aa, 0);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 
 digic_load_rom(s, addr, FLASH_K8P3215UQB_SIZE, filename);
 }
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index b65c020115..9f75d69b7f 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -1275,12 +1275,13 @@ static void musicpal_init(MachineState *machine)
  * 0xFF80 (if there is 8 MB flash). So remap flash access if the
  * image is smaller than 32 MB.
  */
-pflash_cfi02_register(0x1ULL - MP_FLASH_SIZE_MAX,
-  "musicpal.flash", flash_size,
-  blk, 0x1,
-  MP_FLASH_SIZE_MAX / flash_size,
-  2, 0x00BF, 0x236D, 0x, 0x,
-  0x, 0x2AAA, 0);
+dev = pflash_cfi02_create("musicpal.flash", flash_size,
+  blk, 0x1,
+  MP_FLASH_SIZE_MAX / flash_size,
+  2, 0x00BF, 0x236D, 0x, 0x,
+  0x, 0x2AAA, 0);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
+0x1ULL - MP_FLASH_SIZE_MAX);
 }
 sysbus_create_simple(TYPE_MV88W8618_FLASHCFG, MP_FLASHCFG_BASE, NULL);
 
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index 3190cc0b8d..e55aff5532 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -218,11 +218,11 @@ static void zynq_init(MachineState *machine)
 DriveInfo *dinfo = drive_get(IF_PFLASH, 0, 0);
 
 /* AMD */
-pflash_cfi02_register(0xe200, "zynq.pflash", FLASH_SIZE,
-  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-  FLASH_SECTOR_SIZE, 1,
-  1, 0x0066, 0x0022, 0x, 0x, 0x0555, 0x2aa,
-  0);
+dev = pflash_cfi02_create("zynq.pflash", FLASH_SIZE,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  FLASH_SECTOR_SIZE, 1, 1,
+  0x0066, 0x0022, 0x, 0x, 0x0555, 0x2aa, 
0);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xe200);
 
 /* Create the main clock source, and feed slcr with it */
 zynq_machine->ps_clk = CLOCK(object_new(TYPE_CLOCK));
-- 
2.38.1

[PATCH v7 0/7] Misc ppc/mac machines clean up

[BALATON Zoltan]

This is the remainder of the series that were postponed to after the
freeze the last time I've tried to submit them with some new patches
I did meanwhile.

BALATON Zoltan (7):
  input/adb: Only include header where needed
  mac_{old,new}world: Use local variable instead of qdev_get_machine()
  mac_{old,new}world: Pass MacOS VGA NDRV in card ROM instead of fw_cfg
  mac_newworld: Add machine types for different mac99 configs
  mac_newworld: Deprecate mac99 with G5 CPU
  mac_newworld: Deprecate mac99 "via" option
  mac_newworld: Document deprecation

 docs/about/deprecated.rst|   7 ++
 docs/system/ppc/powermac.rst |  12 ++--
 hw/misc/macio/cuda.c |   2 -
 hw/misc/macio/pmu.c  |   3 -
 hw/misc/mos6522.c|   1 -
 hw/ppc/mac_newworld.c| 130 +++
 hw/ppc/mac_oldworld.c|  21 ++
 include/hw/misc/mac_via.h|   1 +
 include/hw/misc/macio/cuda.h |   1 +
 include/hw/misc/macio/pmu.h  |   1 +
 include/hw/misc/mos6522.h|   3 +-
 11 files changed, 142 insertions(+), 40 deletions(-)

-- 
2.30.6

[PATCH 06/20] hw/riscv: Use generic DeviceState instead of PFlashCFI01

[Philippe Mathieu-Daudé]

Nothing here requires access to PFlashCFI01 internal fields:
use the inherited generic DeviceState.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/riscv/virt.c | 9 +
 include/hw/riscv/virt.h | 3 +--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 400bd9329f..b421a9dc12 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -46,6 +46,7 @@
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "sysemu/tpm.h"
+#include "hw/block/flash.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/display/ramfb.h"
@@ -106,7 +107,7 @@ static MemMapEntry virt_high_pcie_memmap;
 
 #define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
 
-static PFlashCFI01 *virt_flash_create1(RISCVVirtState *s,
+static DeviceState *virt_flash_create1(RISCVVirtState *s,
const char *name,
const char *alias_prop_name)
 {
@@ -130,7 +131,7 @@ static PFlashCFI01 *virt_flash_create1(RISCVVirtState *s,
 object_property_add_alias(OBJECT(s), alias_prop_name,
   OBJECT(dev), "drive");
 
-return PFLASH_CFI01(dev);
+return dev;
 }
 
 static void virt_flash_create(RISCVVirtState *s)
@@ -139,7 +140,7 @@ static void virt_flash_create(RISCVVirtState *s)
 s->flash[1] = virt_flash_create1(s, "virt.flash1", "pflash1");
 }
 
-static void virt_flash_map1(PFlashCFI01 *flash,
+static void virt_flash_map1(DeviceState *flash,
 hwaddr base, hwaddr size,
 MemoryRegion *sysmem)
 {
@@ -1517,7 +1518,7 @@ static void virt_machine_init(MachineState *machine)
 
 for (i = 0; i < ARRAY_SIZE(s->flash); i++) {
 /* Map legacy -drive if=pflash to machine properties */
-pflash_cfi01_legacy_drive(DEVICE(s->flash[i]),
+pflash_cfi01_legacy_drive(s->flash[i],
   drive_get(IF_PFLASH, 0, i));
 }
 virt_flash_map(s, system_memory);
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index be4ab8fe7f..b700a46763 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -21,7 +21,6 @@
 
 #include "hw/riscv/riscv_hart.h"
 #include "hw/sysbus.h"
-#include "hw/block/flash.h"
 #include "qom/object.h"
 
 #define VIRT_CPUS_MAX_BITS 9
@@ -49,7 +48,7 @@ struct RISCVVirtState {
 DeviceState *platform_bus_dev;
 RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
 DeviceState *irqchip[VIRT_SOCKETS_MAX];
-PFlashCFI01 *flash[2];
+DeviceState *flash[2];
 FWCfgState *fw_cfg;
 
 int fdt_size;
-- 
2.38.1

Re: [PATCH 0/3] python: testing fixes

[John Snow]

On Sun, Dec 4, 2022 at 5:39 PM Wilfred Mallawa  wrote:
>
> On Fri, 2022-12-02 at 19:52 -0500, John Snow wrote:
> > A few tiny touchups needed for cutting edge 'flake8' tooling, a minor
> > type touchup in iotests, and extending the python tests to cover the
> > recently released Python 3.11.
> >
> > John Snow (3):
> >   Python: fix flake8 config
> >   iotests/check: Fix typing for sys.exit() value
> >   python: add 3.11 to supported list
> >
> >  python/setup.cfg | 6 --
> >  tests/qemu-iotests/check | 2 +-
> >  2 files changed, 5 insertions(+), 3 deletions(-)
> >
> > --
> > 2.38.1
> >
> I see you've left Westeros! xD

I'm not a huge fan of these ...

>
> Reviewed-by: Wilfred Mallawa 

... but thank you for the review.

--js

[PATCH v7 7/7] mac_newworld: Document deprecation

[BALATON Zoltan]

Also update PowerMac family docs with some more recent info.

Signed-off-by: BALATON Zoltan 
---
 docs/about/deprecated.rst|  7 +++
 docs/system/ppc/powermac.rst | 12 
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 93affe3669..07661af7fe 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -248,6 +248,13 @@ These old machine types are quite neglected nowadays and 
thus might have
 various pitfalls with regards to live migration. Use a newer machine type
 instead.
 
+``mac99`` variants other than the default qemu-system-ppc version (since 7.2)
+'
+
+The ``mac99`` machine emulates different hardware depending on using
+qemu-system-ppc64 or ``via`` property. To avoid confusion new machine
+types has been added for these variants which are now preferred over
+``mac99``.
 
 Backend options
 ---
diff --git a/docs/system/ppc/powermac.rst b/docs/system/ppc/powermac.rst
index 04334ba210..d4a47a6881 100644
--- a/docs/system/ppc/powermac.rst
+++ b/docs/system/ppc/powermac.rst
@@ -4,8 +4,12 @@ PowerMac family boards (``g3beige``, ``mac99``)
 Use the executable ``qemu-system-ppc`` to simulate a complete PowerMac
 PowerPC system.
 
-- ``g3beige``  Heathrow based PowerMAC
-- ``mac99``Mac99 based PowerMAC
+- ``g3beige``   Heathrow based old world Power Macintosh G3
+- ``mac99`` Core99 based generic PowerMac
+- ``powermac3_1``   Power Mac G4 AGP (Sawtooth)
+- ``powerbook3_2``  PowerBook G4 Titanium (Mercury)
+- ``powermac7_3``   Power Mac G5 (Niagara) (only in ``qemu-system-ppc64``)
+
 
 Supported devices
 -
@@ -15,9 +19,9 @@ QEMU emulates the following PowerMac peripherals:
  *  UniNorth or Grackle PCI Bridge
  *  PCI VGA compatible card with VESA Bochs Extensions
  *  2 PMAC IDE interfaces with hard disk and CD-ROM support
- *  NE2000 PCI adapters
+ *  Sungem PCI network adapter
  *  Non Volatile RAM
- *  VIA-CUDA with ADB keyboard and mouse.
+ *  VIA-CUDA or VIA-PMU99 with or without ADB or USB keyboard and mouse.
 
 
 Missing devices
-- 
2.30.6

[PATCH 12/20] hw/mips: Open-code pflash_cfi01_register()

[Philippe Mathieu-Daudé]

pflash_cfi01_register() hides an implicit sysbus mapping of
MMIO region #0. This is not practical in a heterogeneous world
where multiple cores use different address spaces. In order to
remove to remove pflash_cfi01_register() from the pflash API,
open-code it as a qdev creation call followed by an explicit
sysbus mapping.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/mips/malta.c | 12 +---
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index 43fbb97799..e690f13bdb 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -1222,7 +1222,6 @@ void mips_malta_init(MachineState *machine)
 const char *kernel_cmdline = machine->kernel_cmdline;
 const char *initrd_filename = machine->initrd_filename;
 char *filename;
-PFlashCFI01 *fl;
 MemoryRegion *system_memory = get_system_memory();
 MemoryRegion *ram_low_preio = g_new(MemoryRegion, 1);
 MemoryRegion *ram_low_postio;
@@ -1286,12 +1285,11 @@ void mips_malta_init(MachineState *machine)
 
 /* Load firmware in flash / BIOS. */
 dinfo = drive_get(IF_PFLASH, 0, fl_idx);
-fl = pflash_cfi01_register(FLASH_ADDRESS, "mips_malta.bios",
-   FLASH_SIZE,
-   dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-   65536,
-   4, 0x, 0x, 0x, 0x, be);
-dev = DEVICE(fl);
+dev = pflash_cfi01_create("mips_malta.bios", FLASH_SIZE,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  65536, 4,
+  0x, 0x, 0x, 0x, be);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, FLASH_ADDRESS);
 bios = pflash_cfi01_get_memory(dev);
 fl_idx++;
 if (kernel_filename) {
-- 
2.38.1

[RFC PATCH 22/27] target/arm: Move hflags code into the tcg directory

[Fabiano Rosas]

The hflags are used only for TCG code, so introduce a new file
hflags.c to keep that code.

Signed-off-by: Fabiano Rosas 
---
 hw/arm/boot.c  |   5 +-
 target/arm/arm-powerctl.c  |   8 +-
 target/arm/helper.c| 337 +---
 target/arm/internals.h |   3 +
 target/arm/tcg-stubs.c |  10 ++
 target/arm/tcg/hflags.c| 344 +
 target/arm/tcg/meson.build |   1 +
 7 files changed, 369 insertions(+), 339 deletions(-)
 create mode 100644 target/arm/tcg/hflags.c

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 3d7d11f782..54b9dbd994 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -25,6 +25,7 @@
 #include "qemu/config-file.h"
 #include "qemu/option.h"
 #include "qemu/units.h"
+#include "sysemu/tcg.h"
 
 /* Kernel boot protocol is specified in the kernel docs
  * Documentation/arm/Booting and Documentation/arm64/booting.txt
@@ -827,7 +828,9 @@ static void do_cpu_reset(void *opaque)
 info->secondary_cpu_reset_hook(cpu, info);
 }
 }
-arm_rebuild_hflags(env);
+if (tcg_enabled()) {
+arm_rebuild_hflags(env);
+}
 }
 }
 
diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
index b75f813b40..a00624876c 100644
--- a/target/arm/arm-powerctl.c
+++ b/target/arm/arm-powerctl.c
@@ -15,6 +15,7 @@
 #include "arm-powerctl.h"
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
+#include "sysemu/tcg.h"
 
 #ifndef DEBUG_ARM_POWERCTL
 #define DEBUG_ARM_POWERCTL 0
@@ -127,9 +128,10 @@ static void arm_set_cpu_on_async_work(CPUState 
*target_cpu_state,
 target_cpu->env.regs[0] = info->context_id;
 }
 
-/* CP15 update requires rebuilding hflags */
-arm_rebuild_hflags(&target_cpu->env);
-
+if (tcg_enabled()) {
+/* CP15 update requires rebuilding hflags */
+arm_rebuild_hflags(&target_cpu->env);
+}
 /* Start the new CPU at the requested address */
 cpu_set_pc(target_cpu_state, info->entry);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index a536d77611..ed4a76ccdb 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -241,7 +241,7 @@ int sme_exception_el(CPUARMState *env, int el)
 }
 
 /* This corresponds to the ARM pseudocode function IsFullA64Enabled(). */
-static bool sme_fa64(CPUARMState *env, int el)
+bool sme_fa64(CPUARMState *env, int el)
 {
 if (!cpu_isar_feature(aa64_sme_fa64, env_archcpu(env))) {
 return false;
@@ -1834,7 +1834,7 @@ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx 
mmu_idx)
 }
 }
 
-static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
+int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
 if (regime_has_2_ranges(mmu_idx)) {
 return extract64(tcr, 57, 2);
@@ -2545,339 +2545,6 @@ ARMMMUIdx arm_mmu_idx(CPUARMState *env)
 return arm_mmu_idx_el(env, arm_current_el(env));
 }
 
-static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
-   ARMMMUIdx mmu_idx,
-   CPUARMTBFlags flags)
-{
-DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el);
-DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
-
-if (arm_singlestep_active(env)) {
-DP_TBFLAG_ANY(flags, SS_ACTIVE, 1);
-}
-return flags;
-}
-
-static CPUARMTBFlags rebuild_hflags_common_32(CPUARMState *env, int fp_el,
-  ARMMMUIdx mmu_idx,
-  CPUARMTBFlags flags)
-{
-bool sctlr_b = arm_sctlr_b(env);
-
-if (sctlr_b) {
-DP_TBFLAG_A32(flags, SCTLR__B, 1);
-}
-if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
-DP_TBFLAG_ANY(flags, BE_DATA, 1);
-}
-DP_TBFLAG_A32(flags, NS, !access_secure_reg(env));
-
-return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
-}
-
-static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
-ARMMMUIdx mmu_idx)
-{
-CPUARMTBFlags flags = {};
-uint32_t ccr = env->v7m.ccr[env->v7m.secure];
-
-/* Without HaveMainExt, CCR.UNALIGN_TRP is RES1. */
-if (ccr & R_V7M_CCR_UNALIGN_TRP_MASK) {
-DP_TBFLAG_ANY(flags, ALIGN_MEM, 1);
-}
-
-if (arm_v7m_is_handler_mode(env)) {
-DP_TBFLAG_M32(flags, HANDLER, 1);
-}
-
-/*
- * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN
- * is suppressing them because the requested execution priority
- * is less than 0.
- */
-if (arm_feature(env, ARM_FEATURE_V8) &&
-!((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
-  (ccr & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
-DP_TBFLAG_M32(flags, STACKCHECK, 1);
-}
-
-if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) {
-DP_TBFLAG_M32(flags, SECURE, 1);
-}
-
-return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
-}
-
-static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *

[PATCH 13/20] hw/ppc: Open-code pflash_cfi01_register()

[Philippe Mathieu-Daudé]

pflash_cfi01_register() hides an implicit sysbus mapping of
MMIO region #0. This is not practical in a heterogeneous world
where multiple cores use different address spaces. In order to
remove to remove pflash_cfi01_register() from the pflash API,
open-code it as a qdev creation call followed by an explicit
sysbus mapping.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/ppc/sam460ex.c | 12 
 hw/ppc/virtex_ml507.c |  7 ---
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index 4a22ce3761..a82c9e0642 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -82,6 +82,8 @@ struct boot_info {
 
 static int sam460ex_load_uboot(void)
 {
+DeviceState *dev;
+
 /*
  * This first creates 1MiB of flash memory mapped at the end of
  * the 32-bit address space (0xFFF0..0x).
@@ -103,14 +105,16 @@ static int sam460ex_load_uboot(void)
 DriveInfo *dinfo;
 
 dinfo = drive_get(IF_PFLASH, 0, 0);
-if (!pflash_cfi01_register(FLASH_BASE | ((hwaddr)FLASH_BASE_H << 32),
-   "sam460ex.flash", FLASH_SIZE,
-   dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-   64 * KiB, 1, 0x89, 0x18, 0x, 0x0, 1)) {
+dev = pflash_cfi01_create("sam460ex.flash", FLASH_SIZE,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  64 * KiB, 1, 0x89, 0x18, 0x, 0x0, 1);
+if (!dev) {
 error_report("Error registering flash memory");
 /* XXX: return an error instead? */
 exit(1);
 }
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
+FLASH_BASE | ((hwaddr)FLASH_BASE_H << 32));
 
 if (!dinfo) {
 /*error_report("No flash image given with the 'pflash' parameter,"
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index f2f81bd425..ee211664a8 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -233,9 +233,10 @@ static void virtex_init(MachineState *machine)
 memory_region_add_subregion(address_space_mem, ram_base, machine->ram);
 
 dinfo = drive_get(IF_PFLASH, 0, 0);
-pflash_cfi01_register(PFLASH_BASEADDR, "virtex.flash", FLASH_SIZE,
-  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
-  64 * KiB, 1, 0x89, 0x18, 0x, 0x0, 1);
+dev = pflash_cfi01_create("virtex.flash", FLASH_SIZE,
+  dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
+  64 * KiB, 1, 0x89, 0x18, 0x, 0x0, 1);
+sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, PFLASH_BASEADDR);
 
 cpu_irq = qdev_get_gpio_in(DEVICE(cpu), PPC40x_INPUT_INT);
 dev = qdev_new("xlnx.xps-intc");
-- 
2.38.1

Re: [PATCH] .gitlab-ci.d/windows: Work-around timeout and OpenGL problems of the MSYS2 jobs

[Peter Maydell]

On Wed, 4 Jan 2023 at 12:36, Thomas Huth  wrote:
>
> The windows jobs (especially the 32-bit job) recently started to
> hit the timeout limit. Bump it a little bit to ease the situation
> (80 minutes is quite long already - OTOH, these jobs do not have to
> wait for a job from the container stage to finish, so this should
> still be OK).
>
> Additionally, some update on the container side recently enabled
> OpenGL in these jobs - but the corresponding code fails to compile.
> Thus disable OpenGL here for the time being until someone figured
> out the proper fix in the shader code for this.
>
> Signed-off-by: Thomas Huth 
> ---
>  Now that the timeout and OpenGL problems are gone, the 64-bit is
>  working fine for me again. However, I'm still seeing random issues
>  with the 32-bit job ... not sure whether it's a problem on the
>  QEMU side or whether the builders are currently instable, since
>  the issues do not reproduce reliably...
>
>  .gitlab-ci.d/windows.yml | 7 ---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Thanks; applied to master on the assumption it will improve the
CI situation. I found that the msys2-32bit job still timed out
at 1h20, though:

https://gitlab.com/qemu-project/qemu/-/jobs/3555245586

-- PMM

[PATCH 16/20] hw/block: Factor pflash_cfi02_create() out of pflash_cfi02_register()

[Philippe Mathieu-Daudé]

Currently pflash_cfi02_register():

 1/ creates a TYPE_PFLASH_CFI02 qdev instance
 2/ maps the first MMIO region to the system bus

The first minor issue is the implicit sysbus mapping is not
obvious (the function name could mention it), and the function
is not documented.

Another issue is we are forced to map on sysbus, thus code
wanting to simply instantiate this device are forced to open
code the qdev creation.

This is a problem in a heterogeneous system where not all cores
has access to the sysbus, or if we want to map the pflash on
different address spaces.

To clarify this API, extract the qdev creation in a new helper
named pflash_cfi02_create().

We don't document pflash_cfi02_register() because we are going
to remove it in a pair of commits.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/block/pflash_cfi02.c  | 55 ++--
 include/hw/block/flash.h | 14 +-
 2 files changed, 49 insertions(+), 20 deletions(-)

diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index 2a99b286b0..176f93b512 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -994,6 +994,37 @@ static void pflash_cfi02_register_types(void)
 
 type_init(pflash_cfi02_register_types)
 
+DeviceState *pflash_cfi02_create(const char *name, hwaddr size,
+ BlockBackend *blk, uint32_t sector_len,
+ int nb_mappings, int bank_width,
+ uint16_t id0, uint16_t id1,
+ uint16_t id2, uint16_t id3,
+ uint16_t unlock_addr0, uint16_t unlock_addr1,
+ int be)
+{
+DeviceState *dev = qdev_new(TYPE_PFLASH_CFI02);
+
+if (blk) {
+qdev_prop_set_drive(dev, "drive", blk);
+}
+assert(QEMU_IS_ALIGNED(size, sector_len));
+qdev_prop_set_uint32(dev, "num-blocks", size / sector_len);
+qdev_prop_set_uint32(dev, "sector-length", sector_len);
+qdev_prop_set_uint8(dev, "width", bank_width);
+qdev_prop_set_uint8(dev, "mappings", nb_mappings);
+qdev_prop_set_uint8(dev, "big-endian", !!be);
+qdev_prop_set_uint16(dev, "id0", id0);
+qdev_prop_set_uint16(dev, "id1", id1);
+qdev_prop_set_uint16(dev, "id2", id2);
+qdev_prop_set_uint16(dev, "id3", id3);
+qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0);
+qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1);
+qdev_prop_set_string(dev, "name", name);
+sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+
+return dev;
+}
+
 PFlashCFI02 *pflash_cfi02_register(hwaddr base,
const char *name,
hwaddr size,
@@ -1006,26 +1037,12 @@ PFlashCFI02 *pflash_cfi02_register(hwaddr base,
uint16_t unlock_addr1,
int be)
 {
-DeviceState *dev = qdev_new(TYPE_PFLASH_CFI02);
-
-if (blk) {
-qdev_prop_set_drive(dev, "drive", blk);
-}
-assert(QEMU_IS_ALIGNED(size, sector_len));
-qdev_prop_set_uint32(dev, "num-blocks", size / sector_len);
-qdev_prop_set_uint32(dev, "sector-length", sector_len);
-qdev_prop_set_uint8(dev, "width", width);
-qdev_prop_set_uint8(dev, "mappings", nb_mappings);
-qdev_prop_set_uint8(dev, "big-endian", !!be);
-qdev_prop_set_uint16(dev, "id0", id0);
-qdev_prop_set_uint16(dev, "id1", id1);
-qdev_prop_set_uint16(dev, "id2", id2);
-qdev_prop_set_uint16(dev, "id3", id3);
-qdev_prop_set_uint16(dev, "unlock-addr0", unlock_addr0);
-qdev_prop_set_uint16(dev, "unlock-addr1", unlock_addr1);
-qdev_prop_set_string(dev, "name", name);
-sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+DeviceState *dev;
 
+dev = pflash_cfi02_create(name, size, blk, sector_len,
+  nb_mappings, width, id0, id1, id2, id3,
+  unlock_addr0, unlock_addr1, be);
 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+
 return PFLASH_CFI02(dev);
 }
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 321aede8ef..78b078955e 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -32,7 +32,19 @@ void pflash_cfi01_legacy_drive(DeviceState *dev, DriveInfo 
*dinfo);
 #define TYPE_PFLASH_CFI02 "cfi.pflash02"
 OBJECT_DECLARE_SIMPLE_TYPE(PFlashCFI02, PFLASH_CFI02)
 
-
+/**
+ * Create and realize a parallel NOR flash (CFI type 2) on the heap.
+ *
+ * Create the device state structure, initialize it, and drop the
+ * reference to it (the device is realized).
+ */
+DeviceState *pflash_cfi02_create(const char *name, hwaddr size,
+ BlockBackend *blk, uint32_t sector_len,
+ int nb_mappings, int bank_width,
+ uint16_t id0, uint16_t id1,
+ uint16_t id2, uint16_t id3,
+   

[PATCH 15/20] hw/block: Make PFlashCFI01 QOM declaration internal

[Philippe Mathieu-Daudé]

Convert the QOM PFlashCFI01 to a forward/opaque pointer declaration.
Only pflash_cfi01.c is able to poke at the internal fields.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/block/pflash_cfi01.c  | 2 ++
 include/hw/block/flash.h | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 9df79b102b..2af9273fc1 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -59,6 +59,8 @@
 #define PFLASH_BE  0
 #define PFLASH_SECURE  1
 
+OBJECT_DECLARE_SIMPLE_TYPE(PFlashCFI01, PFLASH_CFI01)
+
 struct PFlashCFI01 {
 /*< private >*/
 SysBusDevice parent_obj;
diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index 858c0a1b6e..321aede8ef 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -9,7 +9,6 @@
 /* pflash_cfi01.c */
 
 #define TYPE_PFLASH_CFI01 "cfi.pflash01"
-OBJECT_DECLARE_SIMPLE_TYPE(PFlashCFI01, PFLASH_CFI01)
 
 /**
  * Create and realize a parallel NOR flash (CFI type 1) on the heap.
-- 
2.38.1

Re: [PATCH] hw/core: Introduce proxy-pic

[Mark Cave-Ayland]

On 04/01/2023 19:53, Bernhard Beschow wrote:


Having a proxy PIC allows for ISA PICs to be created and wired up in
southbridges. This is especially useful for PIIX3 for two reasons:
First, the southbridge doesn't need to care about the virtualization
technology used (KVM, TCG, Xen) due to in-IRQs (where devices get
attached) and out-IRQs (which will trigger the IRQs of the respective
virtualization technology) are separated. Second, since the in-IRQs are
populated with fully initialized qemu_irq's, they can already be wired
up inside PIIX3.

Signed-off-by: Bernhard Beschow 
Reviewed-by: Michael S. Tsirkin 
Message-Id: <20221022150508.26830-15-shen...@gmail.com>
---
Changes since v4:
* Change license to GPL-2.0-or-later and use SPDX-License-Identifier
* Fix typo in commit message
---
  include/hw/core/proxy-pic.h | 38 ++
  hw/core/proxy-pic.c | 54 +
  MAINTAINERS |  2 ++
  hw/core/Kconfig |  3 +++
  hw/core/meson.build |  1 +
  5 files changed, 98 insertions(+)
  create mode 100644 include/hw/core/proxy-pic.h
  create mode 100644 hw/core/proxy-pic.c

diff --git a/include/hw/core/proxy-pic.h b/include/hw/core/proxy-pic.h
new file mode 100644
index 00..32bc7936bd
--- /dev/null
+++ b/include/hw/core/proxy-pic.h
@@ -0,0 +1,38 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Proxy interrupt controller device.
+ *
+ * Copyright (c) 2022 Bernhard Beschow 
+ */
+
+#ifndef HW_PROXY_PIC_H
+#define HW_PROXY_PIC_H
+
+#include "hw/qdev-core.h"
+#include "qom/object.h"
+#include "hw/irq.h"
+
+#define TYPE_PROXY_PIC "proxy-pic"
+OBJECT_DECLARE_SIMPLE_TYPE(ProxyPICState, PROXY_PIC)
+
+#define MAX_PROXY_PIC_LINES 16
+
+/**
+ * This is a simple device which has 16 pairs of GPIO input and output lines.
+ * Any change on an input line is forwarded to the respective output.
+ *
+ * QEMU interface:
+ *  + 16 unnamed GPIO inputs: the input lines
+ *  + 16 unnamed GPIO outputs: the output lines
+ */


Re-reading this as a standalone patch, I can understand now why Phil was asking about 
device properties etc. because aside from the commit message, it isn't particularly 
clear that this is a workaround for QEMU's PIC devices and accelerator 
implementations not (yet) supporting direct wiring with qdev gpios. I would 
definitely argue that it is a special purpose and not a generic device.


I apologise that this is quite late in the review process, however given that this 
wasn't immediately clear I do think it is worth making a few minor changes. Perhaps 
something like:


- Update the comment above in proxy_pic.h clarifying that this is only for 
wiring up
  ISA PICs (similar to the commit message) until gpios can be used

- Move the .c and .h files from hw/core/proxy-pic.c and 
include/hw/core/proxy_pic.h
  to hw/i386/proxy-pic.c and include/hw/i386/proxy_pic.h to provide a strong 
hint
  that the device is restricted to x86-only

I think this makes it more obvious what the device is doing, and also prevent its 
usage leaking into other places in the codebase. In fact in its current form there is 
no need for device properties to configure the PIC lines, since legacy x86 PICs 
always have 16 (ISA) IRQ lines.



+struct ProxyPICState {
+/*< private >*/
+struct DeviceState parent_obj;
+/*< public >*/
+
+qemu_irq in_irqs[MAX_PROXY_PIC_LINES];
+qemu_irq out_irqs[MAX_PROXY_PIC_LINES];
+};
+
+#endif /* HW_PROXY_PIC_H */
diff --git a/hw/core/proxy-pic.c b/hw/core/proxy-pic.c
new file mode 100644
index 00..40fd70b9e2
--- /dev/null
+++ b/hw/core/proxy-pic.c
@@ -0,0 +1,54 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Proxy interrupt controller device.
+ *
+ * Copyright (c) 2022 Bernhard Beschow 
+ */
+
+#include "qemu/osdep.h"
+#include "hw/core/proxy-pic.h"
+
+static void proxy_pic_set_irq(void *opaque, int irq, int level)
+{
+ProxyPICState *s = opaque;
+
+qemu_set_irq(s->out_irqs[irq], level);
+}
+
+static void proxy_pic_realize(DeviceState *dev, Error **errp)
+{
+ProxyPICState *s = PROXY_PIC(dev);
+
+qdev_init_gpio_in(DEVICE(s), proxy_pic_set_irq, MAX_PROXY_PIC_LINES);
+qdev_init_gpio_out(DEVICE(s), s->out_irqs, MAX_PROXY_PIC_LINES);
+
+for (int i = 0; i < MAX_PROXY_PIC_LINES; ++i) {
+s->in_irqs[i] = qdev_get_gpio_in(DEVICE(s), i);
+}
+}
+
+static void proxy_pic_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+
+/* No state to reset or migrate */
+dc->realize = proxy_pic_realize;
+
+/* Reason: Needs to be wired up to work */
+dc->user_creatable = false;
+}
+
+static const TypeInfo proxy_pic_info = {
+.name  = TYPE_PROXY_PIC,
+.parent= TYPE_DEVICE,
+.instance_size = sizeof(ProxyPICState),
+.class_init = proxy_pic_class_init,
+};
+
+static void split_irq_register_types(void)
+{
+type_register_static(&proxy_pic_info);
+}
+
+type_init(split_irq_re