Re: [PATCH v6 0/7] Add ARM Cortex-R52 CPU

2022-12-26 Thread Tobias Röhmel

Thanks for all the help, I learned a lot!

Best regards,

Tobias

On 19.12.22 18:05, Peter Maydell wrote:

On Tue, 6 Dec 2022 at 10:25,  wrote:

From: Tobias Röhmel 

Sorry for the "Reviewed-by" messup. I missed that on the explanation
page. Thanks again for the review :)

v6:
patch 5:
- I also changed HPRENR from ARM_CP_ALIAS to ARM_CP_NO_RAW.
   Its state is also present in the HPRLAR registers,
   but it doesn't make sense to access it raw. (I think)
- I'm freeing the PRBAR/... strings explicitly now since
   I don't know how to use autofree in this setup correctly.
   Maybe {} around the part were the string is created/used,
   such that it is dropped at }?


Applied to target-arm.next; thanks for your efforts in getting
this patchset through the code review process.

-- PMM




[PATCH v3 3/3] vdpa: commit all host notifier MRs in a single MR transaction

2022-12-26 Thread Longpeng(Mike)
From: Longpeng 

This allows the vhost-vdpa device to batch the setup of all its MRs of
host notifiers.

This significantly reduces the device starting time, e.g. the time spend
on setup the host notifier MRs reduce from 423ms to 32ms for a VM with
64 vCPUs and 3 vhost-vDPA generic devices (vdpa_sim_blk, 64vq per device).

Signed-off-by: Longpeng 
---
 hw/virtio/vhost-vdpa.c | 25 +++--
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index fd0c33b0e1..870265188a 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -512,9 +512,18 @@ static void vhost_vdpa_host_notifiers_uninit(struct 
vhost_dev *dev, int n)
 {
 int i;
 
+/*
+ * Pack all the changes to the memory regions in a single
+ * transaction to avoid a few updating of the address space
+ * topology.
+ */
+memory_region_transaction_begin();
+
 for (i = dev->vq_index; i < dev->vq_index + n; i++) {
 vhost_vdpa_host_notifier_uninit(dev, i);
 }
+
+memory_region_transaction_commit();
 }
 
 static void vhost_vdpa_host_notifiers_init(struct vhost_dev *dev)
@@ -527,17 +536,21 @@ static void vhost_vdpa_host_notifiers_init(struct 
vhost_dev *dev)
 return;
 }
 
+/*
+ * Pack all the changes to the memory regions in a single
+ * transaction to avoid a few updating of the address space
+ * topology.
+ */
+memory_region_transaction_begin();
+
 for (i = dev->vq_index; i < dev->vq_index + dev->nvqs; i++) {
 if (vhost_vdpa_host_notifier_init(dev, i)) {
-goto err;
+vhost_vdpa_host_notifiers_uninit(dev, i - dev->vq_index);
+break;
 }
 }
 
-return;
-
-err:
-vhost_vdpa_host_notifiers_uninit(dev, i - dev->vq_index);
-return;
+memory_region_transaction_commit();
 }
 
 static void vhost_vdpa_svq_cleanup(struct vhost_dev *dev)
-- 
2.23.0




[PATCH v3 2/3] vhost: configure all host notifiers in a single MR transaction

2022-12-26 Thread Longpeng(Mike)
From: Longpeng 

This allows the vhost device to batch the setup of all its host notifiers.
This significantly reduces the device starting time, e.g. the time spend
on enabling notifiers reduce from 376ms to 9.1ms for a VM with 64 vCPUs
and 3 vhost-vDPA generic devices (vdpa_sim_blk, 64vq per device)

Signed-off-by: Longpeng 
---
 hw/virtio/vhost.c | 24 
 1 file changed, 24 insertions(+)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 5994559da8..064d4abe5c 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1562,16 +1562,25 @@ int vhost_dev_enable_notifiers(struct vhost_dev *hdev, 
VirtIODevice *vdev)
 return r;
 }
 
+/*
+ * Batch all the host notifiers in a single transaction to avoid
+ * quadratic time complexity in address_space_update_ioeventfds().
+ */
+memory_region_transaction_begin();
+
 for (i = 0; i < hdev->nvqs; ++i) {
 r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i,
  true);
 if (r < 0) {
 error_report("vhost VQ %d notifier binding failed: %d", i, -r);
+memory_region_transaction_commit();
 vhost_dev_disable_notifiers(hdev, vdev);
 return r;
 }
 }
 
+memory_region_transaction_commit();
+
 return 0;
 }
 
@@ -1585,6 +1594,12 @@ void vhost_dev_disable_notifiers(struct vhost_dev *hdev, 
VirtIODevice *vdev)
 BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
 int i, r;
 
+/*
+ * Batch all the host notifiers in a single transaction to avoid
+ * quadratic time complexity in address_space_update_ioeventfds().
+ */
+memory_region_transaction_begin();
+
 for (i = 0; i < hdev->nvqs; ++i) {
 r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i,
  false);
@@ -1592,6 +1607,15 @@ void vhost_dev_disable_notifiers(struct vhost_dev *hdev, 
VirtIODevice *vdev)
 error_report("vhost VQ %d notifier cleanup failed: %d", i, -r);
 }
 assert (r >= 0);
+}
+
+/*
+ * The transaction expects the ioeventfds to be open when it
+ * commits. Do it now, before the cleanup loop.
+ */
+memory_region_transaction_commit();
+
+for (i = 0; i < hdev->nvqs; ++i) {
 virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i);
 }
 virtio_device_release_ioeventfd(vdev);
-- 
2.23.0




[PATCH v3 1/3] vhost: simplify vhost_dev_enable_notifiers

2022-12-26 Thread Longpeng(Mike)
From: Longpeng 

Simplify the error path in vhost_dev_enable_notifiers by using
vhost_dev_disable_notifiers directly.

Signed-off-by: Longpeng 
---
 hw/virtio/vhost.c | 20 
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index fdcd1a8fdf..5994559da8 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1551,7 +1551,7 @@ void vhost_dev_cleanup(struct vhost_dev *hdev)
 int vhost_dev_enable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev)
 {
 BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
-int i, r, e;
+int i, r;
 
 /* We will pass the notifiers to the kernel, make sure that QEMU
  * doesn't interfere.
@@ -1559,7 +1559,7 @@ int vhost_dev_enable_notifiers(struct vhost_dev *hdev, 
VirtIODevice *vdev)
 r = virtio_device_grab_ioeventfd(vdev);
 if (r < 0) {
 error_report("binding does not support host notifiers");
-goto fail;
+return r;
 }
 
 for (i = 0; i < hdev->nvqs; ++i) {
@@ -1567,24 +1567,12 @@ int vhost_dev_enable_notifiers(struct vhost_dev *hdev, 
VirtIODevice *vdev)
  true);
 if (r < 0) {
 error_report("vhost VQ %d notifier binding failed: %d", i, -r);
-goto fail_vq;
+vhost_dev_disable_notifiers(hdev, vdev);
+return r;
 }
 }
 
 return 0;
-fail_vq:
-while (--i >= 0) {
-e = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i,
- false);
-if (e < 0) {
-error_report("vhost VQ %d notifier cleanup error: %d", i, -r);
-}
-assert (e >= 0);
-virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i);
-}
-virtio_device_release_ioeventfd(vdev);
-fail:
-return r;
 }
 
 /* Stop processing guest IO notifications in vhost.
-- 
2.23.0




[PATCH v3 0/3] two optimizations to speed up the start time

2022-12-26 Thread Longpeng(Mike)
From: Longpeng 

Changes v3->v2:
 - cleanup the code [Philippe]

Changes v2->v1:
 Patch-1:
  - remove vq_init_count [Jason]
 Patch-2:
  - new added. [Jason]

v1: https://www.mail-archive.com/qemu-devel@nongnu.org/msg922499.html

Longpeng (Mike) (3):
  vhost: simplify vhost_dev_enable_notifiers
  vhost: configure all host notifiers in a single MR transaction
  vdpa: commit all host notifier MRs in a single MR transaction

 hw/virtio/vhost-vdpa.c | 25 ++--
 hw/virtio/vhost.c  | 44 +++---
 2 files changed, 47 insertions(+), 22 deletions(-)

-- 
2.23.0




[PATCH 05/12] hw/char: riscv_htif: Move registers from CPUArchState to HTIFState

2022-12-26 Thread Bin Meng
At present for some unknown reason the HTIF registers (fromhost &
tohost) are defined in the RISC-V CPUArchState. It should really
be put in the HTIFState struct as it is only meaningful to HTIF.

Signed-off-by: Bin Meng 
---

 include/hw/char/riscv_htif.h |  8 
 target/riscv/cpu.h   |  4 
 hw/char/riscv_htif.c | 35 +--
 hw/riscv/spike.c |  3 +--
 target/riscv/machine.c   |  6 ++
 5 files changed, 24 insertions(+), 32 deletions(-)

diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index 6d172ebd6d..55cc352331 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -23,7 +23,6 @@
 #include "chardev/char.h"
 #include "chardev/char-fe.h"
 #include "exec/memory.h"
-#include "target/riscv/cpu.h"
 
 #define TYPE_HTIF_UART "riscv.htif.uart"
 
@@ -31,11 +30,12 @@ typedef struct HTIFState {
 int allow_tohost;
 int fromhost_inprogress;
 
+uint64_t tohost;
+uint64_t fromhost;
 hwaddr tohost_offset;
 hwaddr fromhost_offset;
 MemoryRegion mmio;
 
-CPURISCVState *env;
 CharBackend chr;
 uint64_t pending_read;
 } HTIFState;
@@ -51,7 +51,7 @@ void htif_symbol_callback(const char *st_name, int st_info, 
uint64_t st_value,
 bool htif_uses_elf_symbols(void);
 
 /* legacy pre qom */
-HTIFState *htif_mm_init(MemoryRegion *address_space, CPURISCVState *env,
-Chardev *chr, uint64_t nonelf_base);
+HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
+uint64_t nonelf_base);
 
 #endif
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 443d15a47c..6f04d853dd 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -309,10 +309,6 @@ struct CPUArchState {
 target_ulong sscratch;
 target_ulong mscratch;
 
-/* temporary htif regs */
-uint64_t mfromhost;
-uint64_t mtohost;
-
 /* Sstc CSRs */
 uint64_t stimecmp;
 
diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index f28976b110..3bb0a37a3e 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -100,7 +100,7 @@ static void htif_recv(void *opaque, const uint8_t *buf, int 
size)
 uint64_t val_written = s->pending_read;
 uint64_t resp = 0x100 | *buf;
 
-s->env->mfromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
+s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
 }
 
 /*
@@ -175,7 +175,7 @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t 
val_written)
 if (cmd == HTIF_CONSOLE_CMD_GETC) {
 /* this should be a queue, but not yet implemented as such */
 s->pending_read = val_written;
-s->env->mtohost = 0; /* clear to indicate we read */
+s->tohost = 0; /* clear to indicate we read */
 return;
 } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
 qemu_chr_fe_write(>chr, (uint8_t *), 1);
@@ -195,11 +195,11 @@ static void htif_handle_tohost_write(HTIFState *s, 
uint64_t val_written)
  * HTIF needs protocol documentation and a more complete state machine.
  *
  *  while (!s->fromhost_inprogress &&
- *  s->env->mfromhost != 0x0) {
+ *  s->fromhost != 0x0) {
  *  }
  */
-s->env->mfromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
-s->env->mtohost = 0; /* clear to indicate we read */
+s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
+s->tohost = 0; /* clear to indicate we read */
 }
 
 #define TOHOST_OFFSET1  (s->tohost_offset)
@@ -212,13 +212,13 @@ static uint64_t htif_mm_read(void *opaque, hwaddr addr, 
unsigned size)
 {
 HTIFState *s = opaque;
 if (addr == TOHOST_OFFSET1) {
-return s->env->mtohost & 0x;
+return s->tohost & 0x;
 } else if (addr == TOHOST_OFFSET2) {
-return (s->env->mtohost >> 32) & 0x;
+return (s->tohost >> 32) & 0x;
 } else if (addr == FROMHOST_OFFSET1) {
-return s->env->mfromhost & 0x;
+return s->fromhost & 0x;
 } else if (addr == FROMHOST_OFFSET2) {
-return (s->env->mfromhost >> 32) & 0x;
+return (s->fromhost >> 32) & 0x;
 } else {
 qemu_log("Invalid htif read: address %016" PRIx64 "\n",
 (uint64_t)addr);
@@ -232,22 +232,22 @@ static void htif_mm_write(void *opaque, hwaddr addr,
 {
 HTIFState *s = opaque;
 if (addr == TOHOST_OFFSET1) {
-if (s->env->mtohost == 0x0) {
+if (s->tohost == 0x0) {
 s->allow_tohost = 1;
-s->env->mtohost = value & 0x;
+s->tohost = value & 0x;
 } else {
 s->allow_tohost = 0;
 }
 } else if (addr == TOHOST_OFFSET2) {
 if (s->allow_tohost) {
-s->env->mtohost |= value << 32;
-htif_handle_tohost_write(s, s->env->mtohost);
+s->tohost |= value << 32;
+

[PATCH 11/12] hw/riscv/boot.c: Introduce riscv_find_firmware()

2022-12-26 Thread Bin Meng
Rename previous riscv_find_firmware() to riscv_find_bios(), and
introduce a new riscv_find_firmware() to implement the first half
part of the work done in riscv_find_and_load_firmware().

This new API is helpful for machine that wants to know the final
chosen firmware file name but does not want to load it.

Signed-off-by: Bin Meng 
---

 include/hw/riscv/boot.h |  2 ++
 hw/riscv/boot.c | 39 +--
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index 60cf320c88..b273ab22f7 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -38,6 +38,8 @@ target_ulong riscv_find_and_load_firmware(MachineState 
*machine,
   hwaddr firmware_load_addr,
   symbol_fn_t sym_cb);
 const char *riscv_default_firmware_name(RISCVHartArrayState *harts);
+char *riscv_find_firmware(const char *firmware_filename,
+  const char *default_machine_firmware);
 target_ulong riscv_load_firmware(const char *firmware_filename,
  hwaddr firmware_load_addr,
  symbol_fn_t sym_cb);
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index e1a544b1d9..98b80af51b 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -84,11 +84,11 @@ const char *riscv_default_firmware_name(RISCVHartArrayState 
*harts)
 return RISCV64_BIOS_BIN;
 }
 
-static char *riscv_find_firmware(const char *firmware_filename)
+static char *riscv_find_bios(const char *bios_filename)
 {
 char *filename;
 
-filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware_filename);
+filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_filename);
 if (filename == NULL) {
 if (!qtest_enabled()) {
 /*
@@ -97,8 +97,8 @@ static char *riscv_find_firmware(const char 
*firmware_filename)
  * running QEMU test will complain hence let's suppress the error
  * report for QEMU testing.
  */
-error_report("Unable to load the RISC-V firmware \"%s\"",
- firmware_filename);
+error_report("Unable to find the RISC-V BIOS \"%s\"",
+ bios_filename);
 exit(1);
 }
 }
@@ -106,25 +106,36 @@ static char *riscv_find_firmware(const char 
*firmware_filename)
 return filename;
 }
 
-target_ulong riscv_find_and_load_firmware(MachineState *machine,
-  const char *default_machine_firmware,
-  hwaddr firmware_load_addr,
-  symbol_fn_t sym_cb)
+char *riscv_find_firmware(const char *firmware_filename,
+  const char *default_machine_firmware)
 {
-char *firmware_filename = NULL;
-target_ulong firmware_end_addr = firmware_load_addr;
+char *filename = NULL;
 
-if ((!machine->firmware) || (!strcmp(machine->firmware, "default"))) {
+if ((!firmware_filename) || (!strcmp(firmware_filename, "default"))) {
 /*
  * The user didn't specify -bios, or has specified "-bios default".
  * That means we are going to load the OpenSBI binary included in
  * the QEMU source.
  */
-firmware_filename = riscv_find_firmware(default_machine_firmware);
-} else if (strcmp(machine->firmware, "none")) {
-firmware_filename = riscv_find_firmware(machine->firmware);
+filename = riscv_find_bios(default_machine_firmware);
+} else if (strcmp(firmware_filename, "none")) {
+filename = riscv_find_bios(firmware_filename);
 }
 
+return filename;
+}
+
+target_ulong riscv_find_and_load_firmware(MachineState *machine,
+  const char *default_machine_firmware,
+  hwaddr firmware_load_addr,
+  symbol_fn_t sym_cb)
+{
+char *firmware_filename;
+target_ulong firmware_end_addr = firmware_load_addr;
+
+firmware_filename = riscv_find_firmware(machine->firmware,
+default_machine_firmware);
+
 if (firmware_filename) {
 /* If not "none" load the firmware */
 firmware_end_addr = riscv_load_firmware(firmware_filename,
-- 
2.34.1




[PATCH 08/12] hw/riscv: spike: Remove the out-of-date comments

2022-12-26 Thread Bin Meng
Spike machine now supports OpenSBI plain binary bios image, so the
comments are no longer valid.

Signed-off-by: Bin Meng 
---

 hw/riscv/spike.c | 5 -
 1 file changed, 5 deletions(-)

diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index 8606331f61..ab0a945f8b 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -256,11 +256,6 @@ static void spike_board_init(MachineState *machine)
 memory_region_add_subregion(system_memory, memmap[SPIKE_MROM].base,
 mask_rom);
 
-/*
- * Not like other RISC-V machines that use plain binary bios images,
- * keeping ELF files here was intentional because BIN files don't work
- * for the Spike machine as HTIF emulation depends on ELF parsing.
- */
 if (riscv_is_32bit(>soc[0])) {
 firmware_end_addr = riscv_find_and_load_firmware(machine,
 RISCV32_BIOS_BIN, memmap[SPIKE_DRAM].base,
-- 
2.34.1




[PATCH 12/12] hw/riscv: spike: Decouple create_fdt() dependency to ELF loading

2022-12-26 Thread Bin Meng
At present create_fdt() calls htif_uses_elf_symbols() to determine
whether to insert a  property for the HTIF. This unfortunately
creates a hidden dependency to riscv_load_{firmware,kernel} that
create_fdt() must be called after the ELF {firmware,kernel} image
has been loaded.

Decouple such dependency be adding a new parameter to create_fdt(),
whether custom HTIF base address is used. The flag will be set if
non ELF {firmware,kernel} image is given by user.

Signed-off-by: Bin Meng 

---

 include/hw/char/riscv_htif.h |  5 +---
 hw/char/riscv_htif.c | 17 +---
 hw/riscv/spike.c | 54 ++--
 3 files changed, 53 insertions(+), 23 deletions(-)

diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index 9e8ebbe017..5958c5b986 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -44,11 +44,8 @@ typedef struct HTIFState {
 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
 uint64_t st_size);
 
-/* Check if HTIF uses ELF symbols */
-bool htif_uses_elf_symbols(void);
-
 /* legacy pre qom */
 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
-uint64_t nonelf_base);
+uint64_t nonelf_base, bool custom_base);
 
 #endif
diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index 1477fc0090..098de50e35 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -52,20 +52,17 @@
 #define PK_SYS_WRITE64
 
 static uint64_t fromhost_addr, tohost_addr;
-static int address_symbol_set;
 
 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
   uint64_t st_size)
 {
 if (strcmp("fromhost", st_name) == 0) {
-address_symbol_set |= 1;
 fromhost_addr = st_value;
 if (st_size != 8) {
 error_report("HTIF fromhost must be 8 bytes");
 exit(1);
 }
 } else if (strcmp("tohost", st_name) == 0) {
-address_symbol_set |= 2;
 tohost_addr = st_value;
 if (st_size != 8) {
 error_report("HTIF tohost must be 8 bytes");
@@ -275,19 +272,19 @@ static const MemoryRegionOps htif_mm_ops = {
 .write = htif_mm_write,
 };
 
-bool htif_uses_elf_symbols(void)
-{
-return (address_symbol_set == 3) ? true : false;
-}
-
 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
-uint64_t nonelf_base)
+uint64_t nonelf_base, bool custom_base)
 {
 uint64_t base, size, tohost_offset, fromhost_offset;
 
-if (!htif_uses_elf_symbols()) {
+if (custom_base) {
 fromhost_addr = nonelf_base;
 tohost_addr = nonelf_base + 8;
+} else {
+if (!fromhost_addr || !tohost_addr) {
+error_report("Invalid HTIF fromhost or tohost address");
+exit(1);
+}
 }
 
 base = MIN(tohost_addr, fromhost_addr);
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index 810a18f283..90f9e581e4 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -50,7 +50,8 @@ static const MemMapEntry spike_memmap[] = {
 };
 
 static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
-   uint64_t mem_size, const char *cmdline, bool is_32_bit)
+   uint64_t mem_size, const char *cmdline,
+   bool is_32_bit, bool htif_custom_base)
 {
 void *fdt;
 uint64_t addr, size;
@@ -78,7 +79,7 @@ static void create_fdt(SpikeState *s, const MemMapEntry 
*memmap,
 
 qemu_fdt_add_subnode(fdt, "/htif");
 qemu_fdt_setprop_string(fdt, "/htif", "compatible", "ucb,htif0");
-if (!htif_uses_elf_symbols()) {
+if (htif_custom_base) {
 qemu_fdt_setprop_cells(fdt, "/htif", "reg",
 0x0, memmap[SPIKE_HTIF].base, 0x0, memmap[SPIKE_HTIF].size);
 }
@@ -184,6 +185,21 @@ static void create_fdt(SpikeState *s, const MemMapEntry 
*memmap,
 }
 }
 
+static bool spike_test_elf_image(char *filename)
+{
+Error *err = NULL;
+
+if (filename) {
+load_elf_hdr(filename, NULL, NULL, );
+if (err) {
+error_free(err);
+return false;
+}
+}
+
+return true;
+}
+
 static void spike_board_init(MachineState *machine)
 {
 const MemMapEntry *memmap = spike_memmap;
@@ -191,11 +207,12 @@ static void spike_board_init(MachineState *machine)
 MemoryRegion *system_memory = get_system_memory();
 MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
 target_ulong firmware_end_addr, kernel_start_addr;
-const char *firmware_name;
+char *firmware_name;
 uint32_t fdt_load_addr;
 uint64_t kernel_entry;
 char *soc_name;
 int i, base_hartid, hart_count;
+bool htif_custom_base;
 
 /* Check socket count limit */
 if (SPIKE_SOCKETS_MAX < riscv_socket_count(machine)) {
@@ -257,10 +274,28 @@ static void spike_board_init(MachineState *machine)
 

[PATCH 09/12] hw/riscv/boot.c: make riscv_find_firmware() static

2022-12-26 Thread Bin Meng
From: Daniel Henrique Barboza 

The only caller is riscv_find_and_load_firmware(), which is in the same
file.

Signed-off-by: Daniel Henrique Barboza 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-Id: <20221221182300.307900-5-dbarb...@ventanamicro.com>
Signed-off-by: Bin Meng 
---

 include/hw/riscv/boot.h |  1 -
 hw/riscv/boot.c | 44 -
 2 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index 93e5f8760d..c03e4e74c5 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -37,7 +37,6 @@ target_ulong riscv_find_and_load_firmware(MachineState 
*machine,
   const char *default_machine_firmware,
   hwaddr firmware_load_addr,
   symbol_fn_t sym_cb);
-char *riscv_find_firmware(const char *firmware_filename);
 target_ulong riscv_load_firmware(const char *firmware_filename,
  hwaddr firmware_load_addr,
  symbol_fn_t sym_cb);
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index ebd351c840..7361d5c0d8 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -75,6 +75,28 @@ target_ulong 
riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
 }
 }
 
+static char *riscv_find_firmware(const char *firmware_filename)
+{
+char *filename;
+
+filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware_filename);
+if (filename == NULL) {
+if (!qtest_enabled()) {
+/*
+ * We only ship OpenSBI binary bios images in the QEMU source.
+ * For machines that use images other than the default bios,
+ * running QEMU test will complain hence let's suppress the error
+ * report for QEMU testing.
+ */
+error_report("Unable to load the RISC-V firmware \"%s\"",
+ firmware_filename);
+exit(1);
+}
+}
+
+return filename;
+}
+
 target_ulong riscv_find_and_load_firmware(MachineState *machine,
   const char *default_machine_firmware,
   hwaddr firmware_load_addr,
@@ -104,28 +126,6 @@ target_ulong riscv_find_and_load_firmware(MachineState 
*machine,
 return firmware_end_addr;
 }
 
-char *riscv_find_firmware(const char *firmware_filename)
-{
-char *filename;
-
-filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware_filename);
-if (filename == NULL) {
-if (!qtest_enabled()) {
-/*
- * We only ship OpenSBI binary bios images in the QEMU source.
- * For machines that use images other than the default bios,
- * running QEMU test will complain hence let's suppress the error
- * report for QEMU testing.
- */
-error_report("Unable to load the RISC-V firmware \"%s\"",
- firmware_filename);
-exit(1);
-}
-}
-
-return filename;
-}
-
 target_ulong riscv_load_firmware(const char *firmware_filename,
  hwaddr firmware_load_addr,
  symbol_fn_t sym_cb)
-- 
2.34.1




[PATCH 00/12] hw/riscv: Improve Spike HTIF emulation fidelity

2022-12-26 Thread Bin Meng
At present the 32-bit OpenSBI generic firmware image does not boot on
Spike, only 64-bit image can. This is due to the HTIF emulation does
not implement the proxy syscall interface which is required for the
32-bit HTIF console output.

An OpenSBI bug fix [1] is also needed when booting the plain binary image.

With this series plus the above OpenSBI fix, both 32-bit OpenSBI BIN & ELF
images can boot on QEMU 'spike' machine.

[1] 
https://patchwork.ozlabs.org/project/opensbi/patch/20221226033603.1860569-1-bm...@tinylab.org/


Bin Meng (10):
  hw/char: riscv_htif: Avoid using magic numbers
  hw/char: riscv_htif: Drop {to,from}host_size in HTIFState
  hw/char: riscv_htif: Drop useless assignment of memory region
  hw/char: riscv_htif: Use conventional 's' for HTIFState
  hw/char: riscv_htif: Move registers from CPUArchState to HTIFState
  hw/char: riscv_htif: Remove forward declarations for non-existent
variables
  hw/char: riscv_htif: Support console output via proxy syscall
  hw/riscv: spike: Remove the out-of-date comments
  hw/riscv/boot.c: Introduce riscv_find_firmware()
  hw/riscv: spike: Decouple create_fdt() dependency to ELF loading

Daniel Henrique Barboza (2):
  hw/riscv/boot.c: make riscv_find_firmware() static
  hw/riscv/boot.c: introduce riscv_default_firmware_name()

 include/hw/char/riscv_htif.h |  19 +---
 include/hw/riscv/boot.h  |   4 +-
 target/riscv/cpu.h   |   4 -
 hw/char/riscv_htif.c | 172 +--
 hw/riscv/boot.c  |  76 ++--
 hw/riscv/sifive_u.c  |  11 +--
 hw/riscv/spike.c |  59 
 hw/riscv/virt.c  |  10 +-
 target/riscv/machine.c   |   6 +-
 9 files changed, 212 insertions(+), 149 deletions(-)

-- 
2.34.1




[PATCH 01/12] hw/char: riscv_htif: Avoid using magic numbers

2022-12-26 Thread Bin Meng
The Spike HTIF is poorly documented. The only relevant info we can
get from the internet is from Andrew Waterman at [1].

Add a comment block before htif_handle_tohost_write() to explain
the tohost register format, and use meaningful macros intead of
magic numbers in the codes.

While we are here, corret 2 multi-line comment blocks that have
wrong format.

Link: https://github.com/riscv-software-src/riscv-isa-sim/issues/364 [1]
Signed-off-by: Bin Meng 
---

 hw/char/riscv_htif.c | 72 
 1 file changed, 52 insertions(+), 20 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index 6577f0e640..088556bb04 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -38,6 +38,16 @@
 }  
\
 } while (0)
 
+#define HTIF_DEV_SHIFT  56
+#define HTIF_CMD_SHIFT  48
+
+#define HTIF_DEV_SYSTEM 0
+#define HTIF_DEV_CONSOLE1
+
+#define HTIF_SYSTEM_CMD_SYSCALL 0
+#define HTIF_CONSOLE_CMD_GETC   0
+#define HTIF_CONSOLE_CMD_PUTC   1
+
 static uint64_t fromhost_addr, tohost_addr;
 static int address_symbol_set;
 
@@ -81,9 +91,11 @@ static void htif_recv(void *opaque, const uint8_t *buf, int 
size)
 return;
 }
 
-/* TODO - we need to check whether mfromhost is zero which indicates
-  the device is ready to receive. The current implementation
-  will drop characters */
+/*
+ * TODO - we need to check whether mfromhost is zero which indicates
+ *the device is ready to receive. The current implementation
+ *will drop characters
+ */
 
 uint64_t val_written = htifstate->pending_read;
 uint64_t resp = 0x100 | *buf;
@@ -110,10 +122,30 @@ static int htif_be_change(void *opaque)
 return 0;
 }
 
+/*
+ * See below the tohost register format.
+ *
+ * Bits 63:56 indicate the "device".
+ * Bits 55:48 indicate the "command".
+ *
+ * Device 0 is the syscall device, which is used to emulate Unixy syscalls.
+ * It only implements command 0, which has two subfunctions:
+ * - If bit 0 is clear, then bits 47:0 represent a pointer to a struct
+ *   describing the syscall.
+ * - If bit 1 is set, then bits 47:1 represent an exit code, with a zero
+ *   value indicating success and other values indicating failure.
+ *
+ * Device 1 is the blocking character device.
+ * - Command 0 reads a character
+ * - Command 1 writes a character from the 8 LSBs of tohost
+ *
+ * For RV32, the tohost register is zero-extended, so only device=0 and
+ * command=0 (i.e. HTIF syscalls/exit codes) are supported.
+ */
 static void htif_handle_tohost_write(HTIFState *htifstate, uint64_t 
val_written)
 {
-uint8_t device = val_written >> 56;
-uint8_t cmd = val_written >> 48;
+uint8_t device = val_written >> HTIF_DEV_SHIFT;
+uint8_t cmd = val_written >> HTIF_CMD_SHIFT;
 uint64_t payload = val_written & 0xULL;
 int resp = 0;
 
@@ -125,9 +157,9 @@ static void htif_handle_tohost_write(HTIFState *htifstate, 
uint64_t val_written)
  * 0: riscv-tests Pass/Fail Reporting Only (no syscall proxy)
  * 1: Console
  */
-if (unlikely(device == 0x0)) {
+if (unlikely(device == HTIF_DEV_SYSTEM)) {
 /* frontend syscall handler, shutdown and exit code support */
-if (cmd == 0x0) {
+if (cmd == HTIF_SYSTEM_CMD_SYSCALL) {
 if (payload & 0x1) {
 /* exit code */
 int exit_code = payload >> 1;
@@ -138,14 +170,14 @@ static void htif_handle_tohost_write(HTIFState 
*htifstate, uint64_t val_written)
 } else {
 qemu_log("HTIF device %d: unknown command\n", device);
 }
-} else if (likely(device == 0x1)) {
+} else if (likely(device == HTIF_DEV_CONSOLE)) {
 /* HTIF Console */
-if (cmd == 0x0) {
+if (cmd == HTIF_CONSOLE_CMD_GETC) {
 /* this should be a queue, but not yet implemented as such */
 htifstate->pending_read = val_written;
 htifstate->env->mtohost = 0; /* clear to indicate we read */
 return;
-} else if (cmd == 0x1) {
+} else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
 qemu_chr_fe_write(>chr, (uint8_t *), 1);
 resp = 0x100 | (uint8_t)payload;
 } else {
@@ -157,15 +189,15 @@ static void htif_handle_tohost_write(HTIFState 
*htifstate, uint64_t val_written)
 " payload: %016" PRIx64, device, cmd, payload & 0xFF, payload);
 }
 /*
- * - latest bbl does not set fromhost to 0 if there is a value in tohost
- * - with this code enabled, qemu hangs waiting for fromhost to go to 0
- * - with this code disabled, qemu works with bbl priv v1.9.1 and v1.10
- * - HTIF needs protocol documentation and a more complete state machine
-
-while (!htifstate->fromhost_inprogress &&
-htifstate->env->mfromhost != 0x0) {
-}
-*/
+ 

[PATCH 04/12] hw/char: riscv_htif: Use conventional 's' for HTIFState

2022-12-26 Thread Bin Meng
QEMU source codes tend to use 's' to represent the hardware state.
Let's use it for HTIFState.

Signed-off-by: Bin Meng 
---

 hw/char/riscv_htif.c | 64 ++--
 1 file changed, 32 insertions(+), 32 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index e7e319ca1d..f28976b110 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -85,7 +85,7 @@ static int htif_can_recv(void *opaque)
  */
 static void htif_recv(void *opaque, const uint8_t *buf, int size)
 {
-HTIFState *htifstate = opaque;
+HTIFState *s = opaque;
 
 if (size != 1) {
 return;
@@ -97,10 +97,10 @@ static void htif_recv(void *opaque, const uint8_t *buf, int 
size)
  *will drop characters
  */
 
-uint64_t val_written = htifstate->pending_read;
+uint64_t val_written = s->pending_read;
 uint64_t resp = 0x100 | *buf;
 
-htifstate->env->mfromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
+s->env->mfromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
 }
 
 /*
@@ -142,7 +142,7 @@ static int htif_be_change(void *opaque)
  * For RV32, the tohost register is zero-extended, so only device=0 and
  * command=0 (i.e. HTIF syscalls/exit codes) are supported.
  */
-static void htif_handle_tohost_write(HTIFState *htifstate, uint64_t 
val_written)
+static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
 {
 uint8_t device = val_written >> HTIF_DEV_SHIFT;
 uint8_t cmd = val_written >> HTIF_CMD_SHIFT;
@@ -174,11 +174,11 @@ static void htif_handle_tohost_write(HTIFState 
*htifstate, uint64_t val_written)
 /* HTIF Console */
 if (cmd == HTIF_CONSOLE_CMD_GETC) {
 /* this should be a queue, but not yet implemented as such */
-htifstate->pending_read = val_written;
-htifstate->env->mtohost = 0; /* clear to indicate we read */
+s->pending_read = val_written;
+s->env->mtohost = 0; /* clear to indicate we read */
 return;
 } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-qemu_chr_fe_write(>chr, (uint8_t *), 1);
+qemu_chr_fe_write(>chr, (uint8_t *), 1);
 resp = 0x100 | (uint8_t)payload;
 } else {
 qemu_log("HTIF device %d: unknown command\n", device);
@@ -194,31 +194,31 @@ static void htif_handle_tohost_write(HTIFState 
*htifstate, uint64_t val_written)
  * With this code disabled, qemu works with bbl priv v1.9.1 and v1.10.
  * HTIF needs protocol documentation and a more complete state machine.
  *
- *  while (!htifstate->fromhost_inprogress &&
- *  htifstate->env->mfromhost != 0x0) {
+ *  while (!s->fromhost_inprogress &&
+ *  s->env->mfromhost != 0x0) {
  *  }
  */
-htifstate->env->mfromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
-htifstate->env->mtohost = 0; /* clear to indicate we read */
+s->env->mfromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
+s->env->mtohost = 0; /* clear to indicate we read */
 }
 
-#define TOHOST_OFFSET1 (htifstate->tohost_offset)
-#define TOHOST_OFFSET2 (htifstate->tohost_offset + 4)
-#define FROMHOST_OFFSET1 (htifstate->fromhost_offset)
-#define FROMHOST_OFFSET2 (htifstate->fromhost_offset + 4)
+#define TOHOST_OFFSET1  (s->tohost_offset)
+#define TOHOST_OFFSET2  (s->tohost_offset + 4)
+#define FROMHOST_OFFSET1(s->fromhost_offset)
+#define FROMHOST_OFFSET2(s->fromhost_offset + 4)
 
 /* CPU wants to read an HTIF register */
 static uint64_t htif_mm_read(void *opaque, hwaddr addr, unsigned size)
 {
-HTIFState *htifstate = opaque;
+HTIFState *s = opaque;
 if (addr == TOHOST_OFFSET1) {
-return htifstate->env->mtohost & 0x;
+return s->env->mtohost & 0x;
 } else if (addr == TOHOST_OFFSET2) {
-return (htifstate->env->mtohost >> 32) & 0x;
+return (s->env->mtohost >> 32) & 0x;
 } else if (addr == FROMHOST_OFFSET1) {
-return htifstate->env->mfromhost & 0x;
+return s->env->mfromhost & 0x;
 } else if (addr == FROMHOST_OFFSET2) {
-return (htifstate->env->mfromhost >> 32) & 0x;
+return (s->env->mfromhost >> 32) & 0x;
 } else {
 qemu_log("Invalid htif read: address %016" PRIx64 "\n",
 (uint64_t)addr);
@@ -230,25 +230,25 @@ static uint64_t htif_mm_read(void *opaque, hwaddr addr, 
unsigned size)
 static void htif_mm_write(void *opaque, hwaddr addr,
   uint64_t value, unsigned size)
 {
-HTIFState *htifstate = opaque;
+HTIFState *s = opaque;
 if (addr == TOHOST_OFFSET1) {
-if (htifstate->env->mtohost == 0x0) {
-htifstate->allow_tohost = 1;
-htifstate->env->mtohost = value & 0x;
+if (s->env->mtohost == 0x0) {
+s->allow_tohost = 1;
+s->env->mtohost = value & 0x;
 } else 

[PATCH 10/12] hw/riscv/boot.c: introduce riscv_default_firmware_name()

2022-12-26 Thread Bin Meng
From: Daniel Henrique Barboza 

Some boards are duplicating the 'riscv_find_and_load_firmware' call
because the 32 and 64 bits images have different names. Create
a function to handle this detail instead of hardcoding it in the boards.

Ideally we would bake this logic inside riscv_find_and_load_firmware(),
or even create a riscv_load_default_firmware(), but at this moment we
cannot infer whether the machine is running 32 or 64 bits without
accessing RISCVHartArrayState, which in turn can't be accessed via the
common code from boot.c. In the end we would exchange 'firmware_name'
for a flag with riscv_is_32bit(), which isn't much better than what we
already have today.

Cc: Palmer Dabbelt 
Signed-off-by: Daniel Henrique Barboza 
Reviewed-by: Alistair Francis 
Reviewed-by: Bin Meng 
Message-Id: <20221221182300.307900-6-dbarb...@ventanamicro.com>
Signed-off-by: Bin Meng 
---

 include/hw/riscv/boot.h |  1 +
 hw/riscv/boot.c |  9 +
 hw/riscv/sifive_u.c | 11 ---
 hw/riscv/spike.c| 14 +-
 hw/riscv/virt.c | 10 +++---
 5 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index c03e4e74c5..60cf320c88 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -37,6 +37,7 @@ target_ulong riscv_find_and_load_firmware(MachineState 
*machine,
   const char *default_machine_firmware,
   hwaddr firmware_load_addr,
   symbol_fn_t sym_cb);
+const char *riscv_default_firmware_name(RISCVHartArrayState *harts);
 target_ulong riscv_load_firmware(const char *firmware_filename,
  hwaddr firmware_load_addr,
  symbol_fn_t sym_cb);
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index 7361d5c0d8..e1a544b1d9 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -75,6 +75,15 @@ target_ulong 
riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
 }
 }
 
+const char *riscv_default_firmware_name(RISCVHartArrayState *harts)
+{
+if (riscv_is_32bit(harts)) {
+return RISCV32_BIOS_BIN;
+}
+
+return RISCV64_BIOS_BIN;
+}
+
 static char *riscv_find_firmware(const char *firmware_filename)
 {
 char *filename;
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index b139824aab..662ddf366d 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -532,6 +532,7 @@ static void sifive_u_machine_init(MachineState *machine)
 MemoryRegion *flash0 = g_new(MemoryRegion, 1);
 target_ulong start_addr = memmap[SIFIVE_U_DEV_DRAM].base;
 target_ulong firmware_end_addr, kernel_start_addr;
+const char *firmware_name;
 uint32_t start_addr_hi32 = 0x;
 int i;
 uint32_t fdt_load_addr;
@@ -594,13 +595,9 @@ static void sifive_u_machine_init(MachineState *machine)
 break;
 }
 
-if (riscv_is_32bit(>soc.u_cpus)) {
-firmware_end_addr = riscv_find_and_load_firmware(machine,
-RISCV32_BIOS_BIN, start_addr, NULL);
-} else {
-firmware_end_addr = riscv_find_and_load_firmware(machine,
-RISCV64_BIOS_BIN, start_addr, NULL);
-}
+firmware_name = riscv_default_firmware_name(>soc.u_cpus);
+firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
+ start_addr, NULL);
 
 if (machine->kernel_filename) {
 kernel_start_addr = riscv_calc_kernel_start_addr(>soc.u_cpus,
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index ab0a945f8b..810a18f283 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -191,6 +191,7 @@ static void spike_board_init(MachineState *machine)
 MemoryRegion *system_memory = get_system_memory();
 MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
 target_ulong firmware_end_addr, kernel_start_addr;
+const char *firmware_name;
 uint32_t fdt_load_addr;
 uint64_t kernel_entry;
 char *soc_name;
@@ -256,15 +257,10 @@ static void spike_board_init(MachineState *machine)
 memory_region_add_subregion(system_memory, memmap[SPIKE_MROM].base,
 mask_rom);
 
-if (riscv_is_32bit(>soc[0])) {
-firmware_end_addr = riscv_find_and_load_firmware(machine,
-RISCV32_BIOS_BIN, memmap[SPIKE_DRAM].base,
-htif_symbol_callback);
-} else {
-firmware_end_addr = riscv_find_and_load_firmware(machine,
-RISCV64_BIOS_BIN, memmap[SPIKE_DRAM].base,
-htif_symbol_callback);
-}
+firmware_name = riscv_default_firmware_name(>soc[0]);
+firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
+ memmap[SPIKE_DRAM].base,
+   

[PATCH 07/12] hw/char: riscv_htif: Support console output via proxy syscall

2022-12-26 Thread Bin Meng
At present the HTIF proxy syscall is unsupported. On RV32, only
device 0 is supported so there is no console device for RV32.
The only way to implement console funtionality on RV32 is to
support the SYS_WRITE syscall.

With this commit, the Spike machine is able to boot the 32-bit
OpenSBI generic image.

Signed-off-by: Bin Meng 
---

 hw/char/riscv_htif.c | 17 -
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index 3bb0a37a3e..1477fc0090 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -48,6 +48,9 @@
 #define HTIF_CONSOLE_CMD_GETC   0
 #define HTIF_CONSOLE_CMD_PUTC   1
 
+/* PK system call number */
+#define PK_SYS_WRITE64
+
 static uint64_t fromhost_addr, tohost_addr;
 static int address_symbol_set;
 
@@ -165,7 +168,19 @@ static void htif_handle_tohost_write(HTIFState *s, 
uint64_t val_written)
 int exit_code = payload >> 1;
 exit(exit_code);
 } else {
-qemu_log_mask(LOG_UNIMP, "pk syscall proxy not supported\n");
+uint64_t syscall[8];
+cpu_physical_memory_read(payload, syscall, sizeof(syscall));
+if (syscall[0] == PK_SYS_WRITE &&
+syscall[1] == HTIF_DEV_CONSOLE &&
+syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
+uint8_t ch;
+cpu_physical_memory_read(syscall[2], , 1);
+qemu_chr_fe_write(>chr, , 1);
+resp = 0x100 | (uint8_t)payload;
+} else {
+qemu_log_mask(LOG_UNIMP,
+  "pk syscall proxy not supported\n");
+}
 }
 } else {
 qemu_log("HTIF device %d: unknown command\n", device);
-- 
2.34.1




[PATCH 03/12] hw/char: riscv_htif: Drop useless assignment of memory region

2022-12-26 Thread Bin Meng
struct HTIFState has 3 members for address space and memory region,
and are initialized during htif_mm_init(). But they are actually
useless. Drop them.

Signed-off-by: Bin Meng 
---

 include/hw/char/riscv_htif.h | 7 ++-
 hw/char/riscv_htif.c | 7 ++-
 hw/riscv/spike.c | 5 ++---
 3 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index 3eccc1914f..6d172ebd6d 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -34,9 +34,6 @@ typedef struct HTIFState {
 hwaddr tohost_offset;
 hwaddr fromhost_offset;
 MemoryRegion mmio;
-MemoryRegion *address_space;
-MemoryRegion *main_mem;
-void *main_mem_ram_ptr;
 
 CPURISCVState *env;
 CharBackend chr;
@@ -54,7 +51,7 @@ void htif_symbol_callback(const char *st_name, int st_info, 
uint64_t st_value,
 bool htif_uses_elf_symbols(void);
 
 /* legacy pre qom */
-HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
-CPURISCVState *env, Chardev *chr, uint64_t nonelf_base);
+HTIFState *htif_mm_init(MemoryRegion *address_space, CPURISCVState *env,
+Chardev *chr, uint64_t nonelf_base);
 
 #endif
diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index 088556bb04..e7e319ca1d 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -265,8 +265,8 @@ bool htif_uses_elf_symbols(void)
 return (address_symbol_set == 3) ? true : false;
 }
 
-HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
-CPURISCVState *env, Chardev *chr, uint64_t nonelf_base)
+HTIFState *htif_mm_init(MemoryRegion *address_space, CPURISCVState *env,
+Chardev *chr, uint64_t nonelf_base)
 {
 uint64_t base, size, tohost_offset, fromhost_offset;
 
@@ -281,9 +281,6 @@ HTIFState *htif_mm_init(MemoryRegion *address_space, 
MemoryRegion *main_mem,
 fromhost_offset = fromhost_addr - base;
 
 HTIFState *s = g_new0(HTIFState, 1);
-s->address_space = address_space;
-s->main_mem = main_mem;
-s->main_mem_ram_ptr = memory_region_get_ram_ptr(main_mem);
 s->env = env;
 s->tohost_offset = tohost_offset;
 s->fromhost_offset = fromhost_offset;
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index 1e1d752c00..82cf41ac27 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -317,9 +317,8 @@ static void spike_board_init(MachineState *machine)
   fdt_load_addr);
 
 /* initialize HTIF using symbols found in load_kernel */
-htif_mm_init(system_memory, mask_rom,
- >soc[0].harts[0].env, serial_hd(0),
- memmap[SPIKE_HTIF].base);
+htif_mm_init(system_memory, >soc[0].harts[0].env,
+ serial_hd(0), memmap[SPIKE_HTIF].base);
 }
 
 static void spike_machine_instance_init(Object *obj)
-- 
2.34.1




[PATCH 02/12] hw/char: riscv_htif: Drop {to, from}host_size in HTIFState

2022-12-26 Thread Bin Meng
These are not used anywhere. Drop them.

Signed-off-by: Bin Meng 
---

 include/hw/char/riscv_htif.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index f888ac1b30..3eccc1914f 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -33,8 +33,6 @@ typedef struct HTIFState {
 
 hwaddr tohost_offset;
 hwaddr fromhost_offset;
-uint64_t tohost_size;
-uint64_t fromhost_size;
 MemoryRegion mmio;
 MemoryRegion *address_space;
 MemoryRegion *main_mem;
-- 
2.34.1




[PATCH 06/12] hw/char: riscv_htif: Remove forward declarations for non-existent variables

2022-12-26 Thread Bin Meng
There are forward declarations for 'vmstate_htif' and 'htif_io_ops'
in riscv_htif.h however there are no definitions in the C codes.

Signed-off-by: Bin Meng 
---

 include/hw/char/riscv_htif.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index 55cc352331..9e8ebbe017 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -40,9 +40,6 @@ typedef struct HTIFState {
 uint64_t pending_read;
 } HTIFState;
 
-extern const VMStateDescription vmstate_htif;
-extern const MemoryRegionOps htif_io_ops;
-
 /* HTIF symbol callback */
 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
 uint64_t st_size);
-- 
2.34.1




Re: [PATCH] qga: Add initial OpenBSD and NetBSD support

2022-12-26 Thread Brad Smith

On 12/26/2022 9:02 AM, Konstantin Kostiuk wrote:

the series was merged


Thank you.



Re: [PATCH] scripts/coverity-scan/model.c: update address_space_*_cached

2022-12-26 Thread Vladimir Sementsov-Ogievskiy

On 12/24/22 14:22, Philippe Mathieu-Daudé wrote:

On 23/12/22 21:43, Vladimir Sementsov-Ogievskiy wrote:

Make prototypes correspond to their origins. Also drop
address_space_rw_cached() which doesn't exist anywhere in the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy 
---
  scripts/coverity-scan/model.c | 15 +--
  1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/scripts/coverity-scan/model.c b/scripts/coverity-scan/model.c
index 686d1a3008..b40d0fcbf3 100644
--- a/scripts/coverity-scan/model.c
+++ b/scripts/coverity-scan/model.c
@@ -69,7 +69,6 @@ static void __bufread(uint8_t *buf, ssize_t len)
  }
  MemTxResult address_space_read_cached(MemoryRegionCache *cache, hwaddr addr,
-  MemTxAttrs attrs,
    void *buf, int len)
  {
  MemTxResult result;
@@ -80,25 +79,13 @@ MemTxResult address_space_read_cached(MemoryRegionCache 
*cache, hwaddr addr,
  }
  MemTxResult address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
-    MemTxAttrs attrs,
-    const void *buf, int len)
+   const void *buf, int len)
  {


Oops, missed in commit daa3dda43a ("exec: Let the address_space API use
void pointer arguments").


-MemTxResult address_space_rw_cached(MemoryRegionCache *cache, hwaddr addr,
-    MemTxAttrs attrs,
-    void *buf, int len, bool is_write)
-{
-    if (is_write) {
-    return address_space_write_cached(cache, addr, attrs, buf, len);
-    } else {
-    return address_space_read_cached(cache, addr, attrs, buf, len);
-    }
-}


Apparently never required?

Reviewed-by: Philippe Mathieu-Daudé 



Thanks for reviewing!

Seems, even better patch is possible, we can get rid of the whole physmem-related 
modelling, look at "[PATCH] coverity: physmem: use simple assertions instead of 
modelling".


--
Best regards,
Vladimir




[PATCH v3 2/7] hw/misc: Allwinner A10 DRAM Controller Emulation

2022-12-26 Thread Strahinja Jankovic
During SPL boot several DRAM Controller registers are used. Most
important registers are those related to DRAM initialization and
calibration, where SPL initiates process and waits until certain bit is
set/cleared.

This patch adds these registers, initializes reset values from user's
guide and updates state of registers as SPL expects it.

Signed-off-by: Strahinja Jankovic 

Reviewed-by: Niek Linnenbank 
---
 hw/arm/Kconfig|   1 +
 hw/arm/allwinner-a10.c|   7 +
 hw/misc/Kconfig   |   3 +
 hw/misc/allwinner-a10-dramc.c | 179 ++
 hw/misc/meson.build   |   1 +
 include/hw/arm/allwinner-a10.h|   2 +
 include/hw/misc/allwinner-a10-dramc.h |  68 ++
 7 files changed, 261 insertions(+)
 create mode 100644 hw/misc/allwinner-a10-dramc.c
 create mode 100644 include/hw/misc/allwinner-a10-dramc.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 14f52b41af..140f142ae5 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -320,6 +320,7 @@ config ALLWINNER_A10
 select ALLWINNER_A10_PIT
 select ALLWINNER_A10_PIC
 select ALLWINNER_A10_CCM
+select ALLWINNER_A10_DRAMC
 select ALLWINNER_EMAC
 select SERIAL
 select UNIMP
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index 86baeeeca2..a5f7a36ac9 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -25,6 +25,7 @@
 #include "hw/boards.h"
 #include "hw/usb/hcd-ohci.h"
 
+#define AW_A10_DRAMC_BASE   0x01c01000
 #define AW_A10_MMC0_BASE0x01c0f000
 #define AW_A10_CCM_BASE 0x01c2
 #define AW_A10_PIC_REG_BASE 0x01c20400
@@ -49,6 +50,8 @@ static void aw_a10_init(Object *obj)
 
 object_initialize_child(obj, "ccm", >ccm, TYPE_AW_A10_CCM);
 
+object_initialize_child(obj, "dramc", >dramc, TYPE_AW_A10_DRAMC);
+
 object_initialize_child(obj, "emac", >emac, TYPE_AW_EMAC);
 
 object_initialize_child(obj, "sata", >sata, TYPE_ALLWINNER_AHCI);
@@ -110,6 +113,10 @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
 sysbus_realize(SYS_BUS_DEVICE(>ccm), _fatal);
 sysbus_mmio_map(SYS_BUS_DEVICE(>ccm), 0, AW_A10_CCM_BASE);
 
+/* DRAM Control Module */
+sysbus_realize(SYS_BUS_DEVICE(>dramc), _fatal);
+sysbus_mmio_map(SYS_BUS_DEVICE(>dramc), 0, AW_A10_DRAMC_BASE);
+
 /* FIXME use qdev NIC properties instead of nd_table[] */
 if (nd_table[0].used) {
 qemu_check_nic_model(_table[0], TYPE_AW_EMAC);
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index ed07bf4133..052fb54310 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -177,4 +177,7 @@ config LASI
 config ALLWINNER_A10_CCM
 bool
 
+config ALLWINNER_A10_DRAMC
+bool
+
 source macio/Kconfig
diff --git a/hw/misc/allwinner-a10-dramc.c b/hw/misc/allwinner-a10-dramc.c
new file mode 100644
index 00..e118b0c2fd
--- /dev/null
+++ b/hw/misc/allwinner-a10-dramc.c
@@ -0,0 +1,179 @@
+/*
+ * Allwinner A10 DRAM Controller emulation
+ *
+ * Copyright (C) 2022 Strahinja Jankovic 
+ *
+ *  This file is derived from Allwinner H3 DRAMC,
+ *  by Niek Linnenbank.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "hw/misc/allwinner-a10-dramc.h"
+
+/* DRAMC register offsets */
+enum {
+REG_SDR_CCR = 0x,
+REG_SDR_ZQCR0 = 0x00a8,
+REG_SDR_ZQSR = 0x00b0
+};
+
+#define REG_INDEX(offset)(offset / sizeof(uint32_t))
+
+/* DRAMC register flags */
+enum {
+REG_SDR_CCR_DATA_TRAINING = (1 << 30),
+REG_SDR_CCR_DRAM_INIT = (1 << 31),
+};
+enum {
+REG_SDR_ZQSR_ZCAL = (1 << 31),
+};
+
+/* DRAMC register reset values */
+enum {
+REG_SDR_CCR_RESET   = 0x8002,
+REG_SDR_ZQCR0_RESET = 0x07b0,
+REG_SDR_ZQSR_RESET  = 0x8000
+};
+
+static uint64_t allwinner_a10_dramc_read(void *opaque, hwaddr offset,
+   unsigned size)
+{
+const AwA10DramControllerState *s = AW_A10_DRAMC(opaque);
+const uint32_t idx = REG_INDEX(offset);
+
+switch (offset) {
+case REG_SDR_CCR:
+case REG_SDR_ZQCR0:
+case REG_SDR_ZQSR:
+break;
+case 0x2e4 ... AW_A10_DRAMC_IOSIZE:
+qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 

[PATCH v3 1/7] hw/misc: Allwinner-A10 Clock Controller Module Emulation

2022-12-26 Thread Strahinja Jankovic
During SPL boot several Clock Controller Module (CCM) registers are
read, most important are PLL and Tuning, as well as divisor registers.

This patch adds these registers and initializes reset values from user's
guide.

Signed-off-by: Strahinja Jankovic 

Reviewed-by: Niek Linnenbank 
---
 hw/arm/Kconfig  |   1 +
 hw/arm/allwinner-a10.c  |   7 +
 hw/misc/Kconfig |   3 +
 hw/misc/allwinner-a10-ccm.c | 224 
 hw/misc/meson.build |   1 +
 include/hw/arm/allwinner-a10.h  |   2 +
 include/hw/misc/allwinner-a10-ccm.h |  67 +
 7 files changed, 305 insertions(+)
 create mode 100644 hw/misc/allwinner-a10-ccm.c
 create mode 100644 include/hw/misc/allwinner-a10-ccm.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 17fcde8e1c..14f52b41af 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -319,6 +319,7 @@ config ALLWINNER_A10
 select AHCI
 select ALLWINNER_A10_PIT
 select ALLWINNER_A10_PIC
+select ALLWINNER_A10_CCM
 select ALLWINNER_EMAC
 select SERIAL
 select UNIMP
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index 79082289ea..86baeeeca2 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -26,6 +26,7 @@
 #include "hw/usb/hcd-ohci.h"
 
 #define AW_A10_MMC0_BASE0x01c0f000
+#define AW_A10_CCM_BASE 0x01c2
 #define AW_A10_PIC_REG_BASE 0x01c20400
 #define AW_A10_PIT_REG_BASE 0x01c20c00
 #define AW_A10_UART0_REG_BASE   0x01c28000
@@ -46,6 +47,8 @@ static void aw_a10_init(Object *obj)
 
 object_initialize_child(obj, "timer", >timer, TYPE_AW_A10_PIT);
 
+object_initialize_child(obj, "ccm", >ccm, TYPE_AW_A10_CCM);
+
 object_initialize_child(obj, "emac", >emac, TYPE_AW_EMAC);
 
 object_initialize_child(obj, "sata", >sata, TYPE_ALLWINNER_AHCI);
@@ -103,6 +106,10 @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
 memory_region_add_subregion(get_system_memory(), 0x, >sram_a);
 create_unimplemented_device("a10-sram-ctrl", 0x01c0, 4 * KiB);
 
+/* Clock Control Module */
+sysbus_realize(SYS_BUS_DEVICE(>ccm), _fatal);
+sysbus_mmio_map(SYS_BUS_DEVICE(>ccm), 0, AW_A10_CCM_BASE);
+
 /* FIXME use qdev NIC properties instead of nd_table[] */
 if (nd_table[0].used) {
 qemu_check_nic_model(_table[0], TYPE_AW_EMAC);
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index cbabe9f78c..ed07bf4133 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -174,4 +174,7 @@ config VIRT_CTRL
 config LASI
 bool
 
+config ALLWINNER_A10_CCM
+bool
+
 source macio/Kconfig
diff --git a/hw/misc/allwinner-a10-ccm.c b/hw/misc/allwinner-a10-ccm.c
new file mode 100644
index 00..68146ee340
--- /dev/null
+++ b/hw/misc/allwinner-a10-ccm.c
@@ -0,0 +1,224 @@
+/*
+ * Allwinner A10 Clock Control Module emulation
+ *
+ * Copyright (C) 2022 Strahinja Jankovic 
+ *
+ *  This file is derived from Allwinner H3 CCU,
+ *  by Niek Linnenbank.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "hw/misc/allwinner-a10-ccm.h"
+
+/* CCM register offsets */
+enum {
+REG_PLL1_CFG = 0x, /* PLL1 Control */
+REG_PLL1_TUN = 0x0004, /* PLL1 Tuning */
+REG_PLL2_CFG = 0x0008, /* PLL2 Control */
+REG_PLL2_TUN = 0x000C, /* PLL2 Tuning */
+REG_PLL3_CFG = 0x0010, /* PLL3 Control */
+REG_PLL4_CFG = 0x0018, /* PLL4 Control */
+REG_PLL5_CFG = 0x0020, /* PLL5 Control */
+REG_PLL5_TUN = 0x0024, /* PLL5 Tuning */
+REG_PLL6_CFG = 0x0028, /* PLL6 Control */
+REG_PLL6_TUN = 0x002C, /* PLL6 Tuning */
+REG_PLL7_CFG = 0x0030, /* PLL7 Control */
+REG_PLL1_TUN2= 0x0038, /* PLL1 Tuning2 */
+REG_PLL5_TUN2= 0x003C, /* PLL5 Tuning2 */
+REG_PLL8_CFG = 0x0040, /* PLL8 Control */
+REG_OSC24M_CFG   = 0x0050, /* OSC24M Control */
+REG_CPU_AHB_APB0_CFG = 0x0054, /* CPU, AHB and APB0 Divide Ratio */
+};
+
+#define REG_INDEX(offset)(offset / sizeof(uint32_t))
+
+/* CCM register reset values */
+enum {
+

[PATCH v3 3/7] {hw/i2c,docs/system/arm}: Allwinner TWI/I2C Emulation

2022-12-26 Thread Strahinja Jankovic
This patch implements Allwinner TWI/I2C controller emulation. Only
master-mode functionality is implemented.

The SPL boot for Cubieboard expects AXP209 PMIC on TWI0/I2C0 bus, so this is
first part enabling the TWI/I2C bus operation.

Since both Allwinner A10 and H3 use the same module, it is added for
both boards.

Docs are also updated for Cubieboard and Orangepi-PC board to indicate
I2C availability.

Signed-off-by: Strahinja Jankovic 
---
 docs/system/arm/cubieboard.rst |   1 +
 docs/system/arm/orangepi.rst   |   1 +
 hw/arm/Kconfig |   2 +
 hw/arm/allwinner-a10.c |   8 +
 hw/arm/allwinner-h3.c  |  11 +-
 hw/i2c/Kconfig |   4 +
 hw/i2c/allwinner-i2c.c | 459 +
 hw/i2c/meson.build |   1 +
 hw/i2c/trace-events|   5 +
 include/hw/arm/allwinner-a10.h |   2 +
 include/hw/arm/allwinner-h3.h  |   3 +
 include/hw/i2c/allwinner-i2c.h |  55 
 12 files changed, 551 insertions(+), 1 deletion(-)
 create mode 100644 hw/i2c/allwinner-i2c.c
 create mode 100644 include/hw/i2c/allwinner-i2c.h

diff --git a/docs/system/arm/cubieboard.rst b/docs/system/arm/cubieboard.rst
index 344ff8cef9..8d485f5435 100644
--- a/docs/system/arm/cubieboard.rst
+++ b/docs/system/arm/cubieboard.rst
@@ -14,3 +14,4 @@ Emulated devices:
 - SDHCI
 - USB controller
 - SATA controller
+- TWI (I2C) controller
diff --git a/docs/system/arm/orangepi.rst b/docs/system/arm/orangepi.rst
index 83c7445197..e5973600a1 100644
--- a/docs/system/arm/orangepi.rst
+++ b/docs/system/arm/orangepi.rst
@@ -25,6 +25,7 @@ The Orange Pi PC machine supports the following devices:
  * Clock Control Unit
  * System Control module
  * Security Identifier device
+ * TWI (I2C)
 
 Limitations
 """
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 140f142ae5..eefe1fd134 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -322,6 +322,7 @@ config ALLWINNER_A10
 select ALLWINNER_A10_CCM
 select ALLWINNER_A10_DRAMC
 select ALLWINNER_EMAC
+select ALLWINNER_I2C
 select SERIAL
 select UNIMP
 
@@ -329,6 +330,7 @@ config ALLWINNER_H3
 bool
 select ALLWINNER_A10_PIT
 select ALLWINNER_SUN8I_EMAC
+select ALLWINNER_I2C
 select SERIAL
 select ARM_TIMER
 select ARM_GIC
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index a5f7a36ac9..17e439777e 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -36,6 +36,7 @@
 #define AW_A10_OHCI_BASE0x01c14400
 #define AW_A10_SATA_BASE0x01c18000
 #define AW_A10_RTC_BASE 0x01c20d00
+#define AW_A10_I2C0_BASE0x01c2ac00
 
 static void aw_a10_init(Object *obj)
 {
@@ -56,6 +57,8 @@ static void aw_a10_init(Object *obj)
 
 object_initialize_child(obj, "sata", >sata, TYPE_ALLWINNER_AHCI);
 
+object_initialize_child(obj, "i2c0", >i2c0, TYPE_AW_I2C);
+
 if (machine_usb(current_machine)) {
 int i;
 
@@ -176,6 +179,11 @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
 /* RTC */
 sysbus_realize(SYS_BUS_DEVICE(>rtc), _fatal);
 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(>rtc), 0, AW_A10_RTC_BASE, 10);
+
+/* I2C */
+sysbus_realize(SYS_BUS_DEVICE(>i2c0), _fatal);
+sysbus_mmio_map(SYS_BUS_DEVICE(>i2c0), 0, AW_A10_I2C0_BASE);
+sysbus_connect_irq(SYS_BUS_DEVICE(>i2c0), 0, qdev_get_gpio_in(dev, 7));
 }
 
 static void aw_a10_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index 308ed15552..bfce3c8d92 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -53,6 +53,7 @@ const hwaddr allwinner_h3_memmap[] = {
 [AW_H3_DEV_UART1]  = 0x01c28400,
 [AW_H3_DEV_UART2]  = 0x01c28800,
 [AW_H3_DEV_UART3]  = 0x01c28c00,
+[AW_H3_DEV_TWI0]   = 0x01c2ac00,
 [AW_H3_DEV_EMAC]   = 0x01c3,
 [AW_H3_DEV_DRAMCOM]= 0x01c62000,
 [AW_H3_DEV_DRAMCTL]= 0x01c63000,
@@ -106,7 +107,6 @@ struct AwH3Unimplemented {
 { "uart1", 0x01c28400, 1 * KiB },
 { "uart2", 0x01c28800, 1 * KiB },
 { "uart3", 0x01c28c00, 1 * KiB },
-{ "twi0",  0x01c2ac00, 1 * KiB },
 { "twi1",  0x01c2b000, 1 * KiB },
 { "twi2",  0x01c2b400, 1 * KiB },
 { "scr",   0x01c2c400, 1 * KiB },
@@ -150,6 +150,7 @@ enum {
 AW_H3_GIC_SPI_UART1 =  1,
 AW_H3_GIC_SPI_UART2 =  2,
 AW_H3_GIC_SPI_UART3 =  3,
+AW_H3_GIC_SPI_TWI0  =  6,
 AW_H3_GIC_SPI_TIMER0= 18,
 AW_H3_GIC_SPI_TIMER1= 19,
 AW_H3_GIC_SPI_MMC0  = 60,
@@ -225,6 +226,8 @@ static void allwinner_h3_init(Object *obj)
   "ram-size");
 
 object_initialize_child(obj, "rtc", >rtc, TYPE_AW_RTC_SUN6I);
+
+object_initialize_child(obj, "twi0", >i2c0, TYPE_AW_I2C);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -423,6 +426,12 @@ static void allwinner_h3_realize(DeviceState *dev, Error 
**errp)
 

[PATCH v3 4/7] hw/misc: AXP209 PMU Emulation

2022-12-26 Thread Strahinja Jankovic
This patch adds minimal support for AXP-209 PMU.
Most important is chip ID since U-Boot SPL expects version 0x1. Besides
the chip ID register, reset values for two more registers used by A10
U-Boot SPL are covered.

Signed-off-by: Strahinja Jankovic 
---
 MAINTAINERS  |   2 +
 hw/misc/Kconfig  |   4 +
 hw/misc/axp209.c | 238 +++
 hw/misc/meson.build  |   1 +
 hw/misc/trace-events |   5 +
 5 files changed, 250 insertions(+)
 create mode 100644 hw/misc/axp209.c

diff --git a/MAINTAINERS b/MAINTAINERS
index b270eb8e5b..354da68249 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -576,12 +576,14 @@ ARM Machines
 Allwinner-a10
 M: Beniamino Galvani 
 M: Peter Maydell 
+R: Strahinja Jankovic 
 L: qemu-...@nongnu.org
 S: Odd Fixes
 F: hw/*/allwinner*
 F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c
 F: docs/system/arm/cubieboard.rst
+F: hw/misc/axp209.c
 
 Allwinner-h3
 M: Niek Linnenbank 
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index 052fb54310..eaeddca277 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -180,4 +180,8 @@ config ALLWINNER_A10_CCM
 config ALLWINNER_A10_DRAMC
 bool
 
+config AXP209_PMU
+bool
+depends on I2C
+
 source macio/Kconfig
diff --git a/hw/misc/axp209.c b/hw/misc/axp209.c
new file mode 100644
index 00..2908ed99a6
--- /dev/null
+++ b/hw/misc/axp209.c
@@ -0,0 +1,238 @@
+/*
+ * AXP-209 PMU Emulation
+ *
+ * Copyright (C) 2022 Strahinja Jankovic 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/i2c/i2c.h"
+#include "migration/vmstate.h"
+
+#define TYPE_AXP209_PMU "axp209_pmu"
+
+#define AXP209(obj) \
+OBJECT_CHECK(AXP209I2CState, (obj), TYPE_AXP209_PMU)
+
+/* registers */
+enum {
+REG_POWER_STATUS = 0x0u,
+REG_OPERATING_MODE,
+REG_OTG_VBUS_STATUS,
+REG_CHIP_VERSION,
+REG_DATA_CACHE_0,
+REG_DATA_CACHE_1,
+REG_DATA_CACHE_2,
+REG_DATA_CACHE_3,
+REG_DATA_CACHE_4,
+REG_DATA_CACHE_5,
+REG_DATA_CACHE_6,
+REG_DATA_CACHE_7,
+REG_DATA_CACHE_8,
+REG_DATA_CACHE_9,
+REG_DATA_CACHE_A,
+REG_DATA_CACHE_B,
+REG_POWER_OUTPUT_CTRL = 0x12u,
+REG_DC_DC2_OUT_V_CTRL = 0x23u,
+REG_DC_DC2_DVS_CTRL = 0x25u,
+REG_DC_DC3_OUT_V_CTRL = 0x27u,
+REG_LDO2_4_OUT_V_CTRL,
+REG_LDO3_OUT_V_CTRL,
+REG_VBUS_CH_MGMT = 0x30u,
+REG_SHUTDOWN_V_CTRL,
+REG_SHUTDOWN_CTRL,
+REG_CHARGE_CTRL_1,
+REG_CHARGE_CTRL_2,
+REG_SPARE_CHARGE_CTRL,
+REG_PEK_KEY_CTRL,
+REG_DC_DC_FREQ_SET,
+REG_CHR_TEMP_TH_SET,
+REG_CHR_HIGH_TEMP_TH_CTRL,
+REG_IPSOUT_WARN_L1,
+REG_IPSOUT_WARN_L2,
+REG_DISCHR_TEMP_TH_SET,
+REG_DISCHR_HIGH_TEMP_TH_CTRL,
+REG_IRQ_BANK_1_CTRL = 0x40u,
+REG_IRQ_BANK_2_CTRL,
+REG_IRQ_BANK_3_CTRL,
+REG_IRQ_BANK_4_CTRL,
+REG_IRQ_BANK_5_CTRL,
+REG_IRQ_BANK_1_STAT = 0x48u,
+REG_IRQ_BANK_2_STAT,
+REG_IRQ_BANK_3_STAT,
+REG_IRQ_BANK_4_STAT,
+REG_IRQ_BANK_5_STAT,
+REG_ADC_ACIN_V_H = 0x56u,
+REG_ADC_ACIN_V_L,
+REG_ADC_ACIN_CURR_H,
+REG_ADC_ACIN_CURR_L,
+REG_ADC_VBUS_V_H,
+REG_ADC_VBUS_V_L,
+REG_ADC_VBUS_CURR_H,
+REG_ADC_VBUS_CURR_L,
+REG_ADC_INT_TEMP_H,
+REG_ADC_INT_TEMP_L,
+REG_ADC_TEMP_SENS_V_H = 0x62u,
+REG_ADC_TEMP_SENS_V_L,
+REG_ADC_BAT_V_H = 0x78u,
+REG_ADC_BAT_V_L,
+REG_ADC_BAT_DISCHR_CURR_H,
+REG_ADC_BAT_DISCHR_CURR_L,
+REG_ADC_BAT_CHR_CURR_H,
+REG_ADC_BAT_CHR_CURR_L,
+REG_ADC_IPSOUT_V_H,
+REG_ADC_IPSOUT_V_L,
+REG_DC_DC_MOD_SEL = 0x80u,
+REG_ADC_EN_1,
+REG_ADC_EN_2,
+REG_ADC_SR_CTRL,
+REG_ADC_IN_RANGE,
+REG_GPIO1_ADC_IRQ_RISING_TH,
+REG_GPIO1_ADC_IRQ_FALLING_TH,
+REG_TIMER_CTRL = 0x8au,
+REG_VBUS_CTRL_MON_SRP,
+REG_OVER_TEMP_SHUTDOWN = 0x8fu,
+REG_GPIO0_FEAT_SET,
+REG_GPIO_OUT_HIGH_SET,
+

[PATCH v3 7/7] tests/avocado: Add SD boot test to Cubieboard

2022-12-26 Thread Strahinja Jankovic
Cubieboard now can boot directly from SD card, without the need to pass
`-kernel` parameter. Update Avocado tests to cover this functionality.

Signed-off-by: Strahinja Jankovic 
---
 tests/avocado/boot_linux_console.py | 47 +
 1 file changed, 47 insertions(+)

diff --git a/tests/avocado/boot_linux_console.py 
b/tests/avocado/boot_linux_console.py
index ec07c64291..8c1d981586 100644
--- a/tests/avocado/boot_linux_console.py
+++ b/tests/avocado/boot_linux_console.py
@@ -620,6 +620,53 @@ def test_arm_cubieboard_sata(self):
 'sda')
 # cubieboard's reboot is not functioning; omit reboot test.
 
+@skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
+def test_arm_cubieboard_openwrt_22_03_2(self):
+"""
+:avocado: tags=arch:arm
+:avocado: tags=machine:cubieboard
+:avocado: tags=device:sd
+"""
+
+# This test download a 7.5 MiB compressed image and expand it
+# to 126 MiB.
+image_url = ('https://downloads.openwrt.org/releases/22.03.2/targets/'
+ 'sunxi/cortexa8/openwrt-22.03.2-sunxi-cortexa8-'
+ 'cubietech_a10-cubieboard-ext4-sdcard.img.gz')
+image_hash = ('94b5ecbfbc0b3b56276e5146b899eafa'
+  '2ac5dc2d08733d6705af9f144f39f554')
+image_path_gz = self.fetch_asset(image_url, asset_hash=image_hash,
+ algorithm='sha256')
+image_path = archive.extract(image_path_gz, self.workdir)
+image_pow2ceil_expand(image_path)
+
+self.vm.set_console()
+self.vm.add_args('-drive', 'file=' + image_path + ',if=sd,format=raw',
+ '-nic', 'user',
+ '-no-reboot')
+self.vm.launch()
+
+kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+   'usbcore.nousb '
+   'noreboot')
+
+self.wait_for_console_pattern('U-Boot SPL')
+
+interrupt_interactive_console_until_pattern(
+self, 'Hit any key to stop autoboot:', '=>')
+exec_command_and_wait_for_pattern(self, "setenv extraargs '" +
+kernel_command_line + "'", 
'=>')
+exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...');
+
+self.wait_for_console_pattern(
+'Please press Enter to activate this console.')
+
+exec_command_and_wait_for_pattern(self, ' ', 'root@')
+
+exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+'Allwinner sun4i/sun5i')
+# cubieboard's reboot is not functioning; omit reboot test.
+
 @skipUnless(os.getenv('AVOCADO_TIMEOUT_EXPECTED'), 'Test might timeout')
 def test_arm_quanta_gsj(self):
 """
-- 
2.30.2




[PATCH v3 6/7] hw/arm: Allwinner A10 enable SPL load from MMC

2022-12-26 Thread Strahinja Jankovic
This patch enables copying of SPL from MMC if `-kernel` parameter is not
passed when starting QEMU. SPL is copied to SRAM_A.

The approach is reused from Allwinner H3 implementation.

Tested with Armbian and custom Yocto image.

Signed-off-by: Strahinja Jankovic 

Reviewed-by: Niek Linnenbank 
---
 hw/arm/allwinner-a10.c | 18 ++
 hw/arm/cubieboard.c|  5 +
 include/hw/arm/allwinner-a10.h | 21 +
 3 files changed, 44 insertions(+)

diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index 17e439777e..dc1966ff7a 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -24,7 +24,9 @@
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
 #include "hw/usb/hcd-ohci.h"
+#include "hw/loader.h"
 
+#define AW_A10_SRAM_A_BASE  0x
 #define AW_A10_DRAMC_BASE   0x01c01000
 #define AW_A10_MMC0_BASE0x01c0f000
 #define AW_A10_CCM_BASE 0x01c2
@@ -38,6 +40,22 @@
 #define AW_A10_RTC_BASE 0x01c20d00
 #define AW_A10_I2C0_BASE0x01c2ac00
 
+void allwinner_a10_bootrom_setup(AwA10State *s, BlockBackend *blk)
+{
+const int64_t rom_size = 32 * KiB;
+g_autofree uint8_t *buffer = g_new0(uint8_t, rom_size);
+
+if (blk_pread(blk, 8 * KiB, rom_size, buffer, 0) < 0) {
+error_setg(_fatal, "%s: failed to read BlockBackend data",
+   __func__);
+return;
+}
+
+rom_add_blob("allwinner-a10.bootrom", buffer, rom_size,
+  rom_size, AW_A10_SRAM_A_BASE,
+  NULL, NULL, NULL, NULL, false);
+}
+
 static void aw_a10_init(Object *obj)
 {
 AwA10State *s = AW_A10(obj);
diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
index dca257620d..71a7df1508 100644
--- a/hw/arm/cubieboard.c
+++ b/hw/arm/cubieboard.c
@@ -99,6 +99,11 @@ static void cubieboard_init(MachineState *machine)
 memory_region_add_subregion(get_system_memory(), AW_A10_SDRAM_BASE,
 machine->ram);
 
+/* Load target kernel or start using BootROM */
+if (!machine->kernel_filename && blk && blk_is_available(blk)) {
+/* Use Boot ROM to copy data from SD card to SRAM */
+allwinner_a10_bootrom_setup(a10, blk);
+}
 /* TODO create and connect IDE devices for ide_drive_get() */
 
 cubieboard_binfo.ram_size = machine->ram_size;
diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index 763935fca9..e2e27e616a 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -15,6 +15,7 @@
 #include "hw/misc/allwinner-a10-ccm.h"
 #include "hw/misc/allwinner-a10-dramc.h"
 #include "hw/i2c/allwinner-i2c.h"
+#include "sysemu/block-backend.h"
 
 #include "target/arm/cpu.h"
 #include "qom/object.h"
@@ -47,4 +48,24 @@ struct AwA10State {
 OHCISysBusState ohci[AW_A10_NUM_USB];
 };
 
+/**
+ * Emulate Boot ROM firmware setup functionality.
+ *
+ * A real Allwinner A10 SoC contains a Boot ROM
+ * which is the first code that runs right after
+ * the SoC is powered on. The Boot ROM is responsible
+ * for loading user code (e.g. a bootloader) from any
+ * of the supported external devices and writing the
+ * downloaded code to internal SRAM. After loading the SoC
+ * begins executing the code written to SRAM.
+ *
+ * This function emulates the Boot ROM by copying 32 KiB
+ * of data at offset 8 KiB from the given block device and writes it to
+ * the start of the first internal SRAM memory.
+ *
+ * @s: Allwinner A10 state object pointer
+ * @blk: Block backend device object pointer
+ */
+void allwinner_a10_bootrom_setup(AwA10State *s, BlockBackend *blk);
+
 #endif
-- 
2.30.2




[PATCH] coverity: physmem: use simple assertions instead of modelling

2022-12-26 Thread Vladimir Sementsov-Ogievskiy
Unfortunately Coverity doesn't follow the logic aroung "len" and "l"
variables in stacks finishing with flatview_{read,write}_continue() and
generate a lot of OVERRUN false-positives. When small buffer (2 or 4
bytes) is passed to mem read/write path, Coverity assumes the worst
case of sz=8 in stn_he_p()/ldn_he_p() (defined in
include/qemu/bswap.h), and reports buffer overrun.

To silence these false-positives we have model functions, which hide
real logic from Coverity.

However, it turned out that these new two assertions are enough to
quiet Coverity.

Assertions are better than hiding the logic, so let's drop the
modelling and move to assertions for memory r/w call stacks.

After patch, the sequence

 cov-make-library --output-file /tmp/master.xmldb \
scripts/coverity-scan/model.c
 cov-build --dir ~/covtmp/master make -j9
 cov-analyze --user-model-file /tmp/master.xmldb \
--dir ~/covtmp/master --all --strip-path "$(pwd)
 cov-format-errors --dir ~/covtmp/master \
--html-output ~/covtmp/master_html_report

Generate for me the same big set of CIDs excepept for 6 disappeared (so
it becomes even better).

Signed-off-by: Vladimir Sementsov-Ogievskiy 
---
 scripts/coverity-scan/model.c | 88 ---
 softmmu/physmem.c | 18 +++
 2 files changed, 18 insertions(+), 88 deletions(-)

diff --git a/scripts/coverity-scan/model.c b/scripts/coverity-scan/model.c
index 686d1a3008..a064d84084 100644
--- a/scripts/coverity-scan/model.c
+++ b/scripts/coverity-scan/model.c
@@ -42,94 +42,6 @@ typedef _Bool bool;
 
 typedef struct va_list_str *va_list;
 
-/* exec.c */
-
-typedef struct AddressSpace AddressSpace;
-typedef struct MemoryRegionCache MemoryRegionCache;
-typedef uint64_t hwaddr;
-typedef uint32_t MemTxResult;
-typedef struct MemTxAttrs {} MemTxAttrs;
-
-static void __bufwrite(uint8_t *buf, ssize_t len)
-{
-int first, last;
-__coverity_negative_sink__(len);
-if (len == 0) return;
-buf[0] = first;
-buf[len-1] = last;
-__coverity_writeall__(buf);
-}
-
-static void __bufread(uint8_t *buf, ssize_t len)
-{
-__coverity_negative_sink__(len);
-if (len == 0) return;
-int first = buf[0];
-int last = buf[len-1];
-}
-
-MemTxResult address_space_read_cached(MemoryRegionCache *cache, hwaddr addr,
-  MemTxAttrs attrs,
-  void *buf, int len)
-{
-MemTxResult result;
-// TODO: investigate impact of treating reads as producing
-// tainted data, with __coverity_tainted_data_argument__(buf).
-__bufwrite(buf, len);
-return result;
-}
-
-MemTxResult address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
-MemTxAttrs attrs,
-const void *buf, int len)
-{
-MemTxResult result;
-__bufread(buf, len);
-return result;
-}
-
-MemTxResult address_space_rw_cached(MemoryRegionCache *cache, hwaddr addr,
-MemTxAttrs attrs,
-void *buf, int len, bool is_write)
-{
-if (is_write) {
-return address_space_write_cached(cache, addr, attrs, buf, len);
-} else {
-return address_space_read_cached(cache, addr, attrs, buf, len);
-}
-}
-
-MemTxResult address_space_read(AddressSpace *as, hwaddr addr,
-   MemTxAttrs attrs,
-   void *buf, int len)
-{
-MemTxResult result;
-// TODO: investigate impact of treating reads as producing
-// tainted data, with __coverity_tainted_data_argument__(buf).
-__bufwrite(buf, len);
-return result;
-}
-
-MemTxResult address_space_write(AddressSpace *as, hwaddr addr,
-MemTxAttrs attrs,
-const void *buf, int len)
-{
-MemTxResult result;
-__bufread(buf, len);
-return result;
-}
-
-MemTxResult address_space_rw(AddressSpace *as, hwaddr addr,
- MemTxAttrs attrs,
- void *buf, int len, bool is_write)
-{
-if (is_write) {
-return address_space_write(as, addr, attrs, buf, len);
-} else {
-return address_space_read(as, addr, attrs, buf, len);
-}
-}
-
 /* Tainting */
 
 typedef struct {} name2keysym_t;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index edec095c7a..24571002b3 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2821,6 +2821,15 @@ static MemTxResult flatview_write_continue(FlatView *fv, 
hwaddr addr,
 l = memory_access_size(mr, l, addr1);
 /* XXX: could force current_cpu to NULL to avoid
potential bugs */
+
+/*
+ * Assure Coverity (and ourselves) that we are not going to OVERRUN
+ * the buffer by following ldn_he_p().
+ */
+assert((l == 1 && len >= 1) ||
+   (l == 2 && len >= 2) ||
+   (l == 4 && 

[PATCH v3 0/7] Enable Cubieboard A10 boot SPL from SD card

2022-12-26 Thread Strahinja Jankovic
This patch series adds missing Allwinner A10 modules needed for
successful SPL boot:
- Clock controller module
- DRAM controller
- I2C0 controller (added also for Allwinner H3 since it is the same)
- AXP-209 connected to I2C0 bus

It also updates Allwinner A10 emulation so SPL is copied from attached
SD card if `-kernel` parameter is not passed when starting QEMU
(approach adapted from Allwinner H3 implementation).

Boot from SD card has been tested with Cubieboard Armbian SD card image and 
custom
Yocto image built for Cubieboard.
Example usage for Armbian image:
qemu-system-arm -M cubieboard -nographic -sd 
~/Armbian_22.11.0-trunk_Cubieboard_kinetic_edge_6.0.7.img

v3:
* new avocado test for SD card boot for Cubieboard with OpenWrt image 
* renamed file and functions for AXP209 so there is not allwinner prefix
* replaced cast with I2C_BUS in AXP209 instantiation for Cubieboard
* squashed commit with Cubieboard and OrangePi-PC documentation update
with actual code changes
* added myself as Designated Reviewer to the Allwinner-A10 section in
MAINTAINERS file and added hw/misc/axp209.c to the same section.

v2:
* replaced DB_PRINTF with tracing functions
* removed .init function in AXP209 since .reset covers functionality
* moved defines to allwinner_i2c.c from header file
* updated docs with information about TWI
* minor code style fixes


Strahinja Jankovic (7):
  hw/misc: Allwinner-A10 Clock Controller Module Emulation
  hw/misc: Allwinner A10 DRAM Controller Emulation
  {hw/i2c,docs/system/arm}: Allwinner TWI/I2C Emulation
  hw/misc: AXP209 PMU Emulation
  hw/arm: Add AXP209 to Cubieboard
  hw/arm: Allwinner A10 enable SPL load from MMC
  tests/avocado: Add SD boot test to Cubieboard

 MAINTAINERS   |   2 +
 docs/system/arm/cubieboard.rst|   1 +
 docs/system/arm/orangepi.rst  |   1 +
 hw/arm/Kconfig|   5 +
 hw/arm/allwinner-a10.c|  40 +++
 hw/arm/allwinner-h3.c |  11 +-
 hw/arm/cubieboard.c   |  11 +
 hw/i2c/Kconfig|   4 +
 hw/i2c/allwinner-i2c.c| 459 ++
 hw/i2c/meson.build|   1 +
 hw/i2c/trace-events   |   5 +
 hw/misc/Kconfig   |  10 +
 hw/misc/allwinner-a10-ccm.c   | 224 +
 hw/misc/allwinner-a10-dramc.c | 179 ++
 hw/misc/axp209.c  | 238 +
 hw/misc/meson.build   |   3 +
 hw/misc/trace-events  |   5 +
 include/hw/arm/allwinner-a10.h|  27 ++
 include/hw/arm/allwinner-h3.h |   3 +
 include/hw/i2c/allwinner-i2c.h|  55 +++
 include/hw/misc/allwinner-a10-ccm.h   |  67 
 include/hw/misc/allwinner-a10-dramc.h |  68 
 tests/avocado/boot_linux_console.py   |  47 +++
 23 files changed, 1465 insertions(+), 1 deletion(-)
 create mode 100644 hw/i2c/allwinner-i2c.c
 create mode 100644 hw/misc/allwinner-a10-ccm.c
 create mode 100644 hw/misc/allwinner-a10-dramc.c
 create mode 100644 hw/misc/axp209.c
 create mode 100644 include/hw/i2c/allwinner-i2c.h
 create mode 100644 include/hw/misc/allwinner-a10-ccm.h
 create mode 100644 include/hw/misc/allwinner-a10-dramc.h

-- 
2.30.2




[PATCH v3 5/7] hw/arm: Add AXP209 to Cubieboard

2022-12-26 Thread Strahinja Jankovic
SPL Boot for Cubieboard expects AXP209 connected to I2C0 bus.

Signed-off-by: Strahinja Jankovic 

Reviewed-by: Philippe Mathieu-Daudé 
---
 hw/arm/Kconfig  | 1 +
 hw/arm/cubieboard.c | 6 ++
 2 files changed, 7 insertions(+)

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index eefe1fd134..da6741f112 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -323,6 +323,7 @@ config ALLWINNER_A10
 select ALLWINNER_A10_DRAMC
 select ALLWINNER_EMAC
 select ALLWINNER_I2C
+select AXP209_PMU
 select SERIAL
 select UNIMP
 
diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
index 5e3372a3c7..dca257620d 100644
--- a/hw/arm/cubieboard.c
+++ b/hw/arm/cubieboard.c
@@ -20,6 +20,7 @@
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "hw/arm/allwinner-a10.h"
+#include "hw/i2c/i2c.h"
 
 static struct arm_boot_info cubieboard_binfo = {
 .loader_start = AW_A10_SDRAM_BASE,
@@ -34,6 +35,7 @@ static void cubieboard_init(MachineState *machine)
 BlockBackend *blk;
 BusState *bus;
 DeviceState *carddev;
+I2CBus *i2c;
 
 /* BIOS is not supported by this board */
 if (machine->firmware) {
@@ -80,6 +82,10 @@ static void cubieboard_init(MachineState *machine)
 exit(1);
 }
 
+/* Connect AXP 209 */
+i2c = I2C_BUS(qdev_get_child_bus(DEVICE(>i2c0), "i2c"));
+i2c_slave_create_simple(i2c, "axp209_pmu", 0x34);
+
 /* Retrieve SD bus */
 di = drive_get(IF_SD, 0, 0);
 blk = di ? blk_by_legacy_dinfo(di) : NULL;
-- 
2.30.2




Re: [PATCH] hw/audio/c97: fix abort in audio_calloc()

2022-12-26 Thread Volker Rümelin

Am 25.12.22 um 13:13 schrieb Qiang Liu:

Hi Qiang,

I didn't receive your email probably because the reverse DNS entry of 
your mail server isn't setup correctly.

This is from the mail header of the qemu-devel mailing list server.
X-Host-Lookup-Failed: Reverse DNS lookup failed for 220.184.252.86 (failed)

Did you see my patches at 
https://lists.nongnu.org/archive/html/qemu-devel/2022-12/msg02895.html ?
Patches 01/11 and 02/11 prevent the disturbing error message from 
audio_calloc and later patches remove the audio_calloc function.


I think the subject of your patch isn't correct. Your patch doesn't fix 
an abort in audio_calloc. In 
https://gitlab.com/qemu-project/qemu/-/issues/1393 you correctly notice 
this was already fixed.



Section 5.10.2 of the AC97 specification (https://hands.com/~lkcl/ac97_r23.pdf)
shows the feasibility to support for rates other than 48kHZ. Specifically,
AC97_PCM_Front_DAC_Rate (reg 2Ch) should be from 8kHZ to 48kHZ.


I think you misread section 5.10.2 of the AC97 Revision 2.3 
specification. Section 5.10 is about S/PDIF concurrency. It doesn't say 
anything about the lowest sample rate limit without concurrent S/PDIF 
transmission. The emulated SigmaTel STAC9700 codec doesn't even have a 
S/PDIF output. But I have an example for sample rates lower than 8kHz. 
The Texas Instruments LM4546B is an AC97 codec which supports sample 
rates from 4kHz - 48kHz.


The STAC9700 is a 48kHz fixed rate codec. You won't find anything about 
the highest or lowest sample rate in its data sheet. Someone added the 
VRA and VRM modes in QEMU and the guest drivers don't seem to mind.


I would like to keep the ability to select a 1Hz sample rate, as there 
is no reason to artificially limit the lowest supported sample rate. See 
https://lists.nongnu.org/archive/html/qemu-devel/2022-10/msg03987.html


I would support a patch to limit the VRA and VRM modes to the highest 
supported rate of 48kHz. This is a technical limit for single data rate.



Before Volker Rümelin fixed it in 12f4abf6a245 and 0cbc8bd4694f, an adversary
could leverage this to crash QEMU.

Fixes: e5c9a13e2670 ("PCI AC97 emulation by malc.")
Reported-by: Volker Rümelin
Reported-by: Qiang Liu
Resolves:https://gitlab.com/qemu-project/qemu/-/issues/1393
Signed-off-by: Qiang Liu
---
  hw/audio/ac97.c | 11 ---
  1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index be2dd701a4..826411e462 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -625,9 +625,14 @@ static void nam_writew(void *opaque, uint32_t addr, 
uint32_t val)
  break;
  case AC97_PCM_Front_DAC_Rate:
  if (mixer_load(s, AC97_Extended_Audio_Ctrl_Stat) & EACS_VRA) {
-mixer_store(s, addr, val);
-dolog("Set front DAC rate to %d\n", val);
-open_voice(s, PO_INDEX, val);
+if (val >= 8000 && val <= 48000) {
+mixer_store(s, addr, val);
+dolog("Set front DAC rate to %d\n", val);
+open_voice(s, PO_INDEX, val);
+} else {
+dolog("Attempt to set front DAC rate to %d, but valid is"
+  "8-48kHZ\n", val);


This is not correct. If you limit the sample rate, you should echo back 
the closest supported sample rate. See AC'97 2.3 Section 5.8.3. It's not 
a guest error if the guest writes an unsupported sample rate to the 
Audio Sample Rate Control Registers, which means it's also not necessary 
to log this.


With best regards,
Volker


+}
  } else {
  dolog("Attempt to set front DAC rate to %d, but VRA is not set\n",
val);





Re: [PATCH v5 4/4] x86: re-enable rng seeding via SetupData

2022-12-26 Thread Jason A. Donenfeld
On Mon, Dec 26, 2022 at 03:43:04PM +0100, Jason A. Donenfeld wrote:
> On Mon, Dec 26, 2022 at 03:24:07PM +0100, Jason A. Donenfeld wrote:
> > Hi,
> > 
> > I'm currently stumped at the moment, so adding linux-mm@ and x86@. Still
> > working on it though. Details of where I'm at are below the quote below.
> > 
> > On Sat, Dec 24, 2022 at 05:21:46AM +0100, Jason A. Donenfeld wrote:
> > > On Sat, Dec 24, 2022 at 04:09:08AM +0100, Jason A. Donenfeld wrote:
> > > > Hi Eric,
> > > > 
> > > > Replying to you from my telephone, and I'm traveling the next two days,
> > > > but I thought I should mention some preliminary results right away from
> > > > doing some termux compiles:
> > > > 
> > > > On Fri, Dec 23, 2022 at 04:14:00PM -0800, Eric Biggers wrote:
> > > > > Hi Jason,
> > > > > 
> > > > > On Wed, Sep 21, 2022 at 11:31:34AM +0200, Jason A. Donenfeld wrote:
> > > > > > This reverts 3824e25db1 ("x86: disable rng seeding via 
> > > > > > setup_data"), but
> > > > > > for 7.2 rather than 7.1, now that modifying setup_data is safe to 
> > > > > > do.
> > > > > > 
> > > > > > Cc: Laurent Vivier 
> > > > > > Cc: Michael S. Tsirkin 
> > > > > > Cc: Paolo Bonzini 
> > > > > > Cc: Peter Maydell 
> > > > > > Cc: Philippe Mathieu-Daudé 
> > > > > > Cc: Richard Henderson 
> > > > > > Cc: Ard Biesheuvel 
> > > > > > Acked-by: Gerd Hoffmann 
> > > > > > Signed-off-by: Jason A. Donenfeld 
> > > > > > ---
> > > > > >  hw/i386/microvm.c | 2 +-
> > > > > >  hw/i386/pc_piix.c | 3 ++-
> > > > > >  hw/i386/pc_q35.c  | 3 ++-
> > > > > >  3 files changed, 5 insertions(+), 3 deletions(-)
> > > > > > 
> > > > > 
> > > > > After upgrading to QEMU 7.2, Linux 6.1 no longer boots with some 
> > > > > configs.  There
> > > > > is no output at all.  I bisected it to this commit, and I verified 
> > > > > that the
> > > > > following change to QEMU's master branch makes the problem go away:
> > > > > 
> > > > > diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
> > > > > index b48047f50c..42f5b07d2f 100644
> > > > > --- a/hw/i386/pc_piix.c
> > > > > +++ b/hw/i386/pc_piix.c
> > > > > @@ -441,6 +441,7 @@ static void 
> > > > > pc_i440fx_8_0_machine_options(MachineClass *m)
> > > > >  pc_i440fx_machine_options(m);
> > > > >  m->alias = "pc";
> > > > >  m->is_default = true;
> > > > > +PC_MACHINE_CLASS(m)->legacy_no_rng_seed = true;
> > > > >  }
> > > > > 
> > > > > I've attached the kernel config I am seeing the problem on.
> > > > > 
> > > > > For some reason, the problem also goes away if I disable CONFIG_KASAN.
> > > > > 
> > > > > Any idea what is causing this?
> > > > 
> > > > - Commenting out the call to parse_setup_data() doesn't fix the issue.
> > > >   So there's no KASAN issue with the actual parser.
> > > > 
> > > > - Using KASAN_OUTLINE rather than INLINE does fix the issue!
> > > > 
> > > > That makes me suspect that it's file size related, and QEMU or the BIOS
> > > > is placing setup data at an overlapping offset by accident, or something
> > > > similar.
> > > 
> > > I removed the file systems from your config to bring the kernel size
> > > back down, and voila, it works, even with KASAN_INLINE. So perhaps I'm
> > > on the right track here...
> > 
> > QEMU sticks setup_data after the kernel image, the same as kexec-tools
> > and everything else. Apparently, when the kernel image is large, the
> > call to early_memremap(boot_params.hdr.setup_data, ...) returns a value
> > that points some place bogus, and the system crashes or does something
> > weird. I haven't yet determined what this limit is, but in my current
> > test kernel, a value of 0x01327650 is enough to make it point to
> > rubbish.
> > 
> > Is this expected? What's going on here?
> 
> Attaching gdb to QEMU and switching it to physical memory mode
> (`maintenance packet Qqemu.PhyMemMode:1 `) indicates that it
> early_memremap is actually working fine and something *else* is at this
> address? That's kinda weird... Is KASAN populating physical addresses
> immediately after the kernel image extremely early in boot? I'm seeing
> the crash happen from early_reserve_memory()->
> memblock_x86_reserve_range_setup_data(), which should be before
> kasan_init() even runs. Is QEMU calculating kernel_size wrong, when it
> goes to determine where to put the setup_data data? But that's the same
> calculation as used everywhere else, so hmm...
> 
> Jason

If bzImage is 15770544 bytes, it does not boot. If bzImage is 15641776
bytes, it does boot. So something is happening somewhat close to the
16MB mark?



Re: [PATCH 10/11] alsaaudio: change default playback settings

2022-12-26 Thread Volker Rümelin




diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index 5f50dfa0bf..0cc982e61f 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -913,17 +913,14 @@ static void *alsa_audio_init(Audiodev *dev)
  alsa_init_per_direction(aopts->in);
  alsa_init_per_direction(aopts->out);
  -    /*
- * need to define them, as otherwise alsa produces no sound
- * doesn't set has_* so alsa_open can identify it wasn't set by 
the user

- */
+    /* don't set has_* so alsa_open can identify it wasn't set by 
the user */

  if (!dev->u.alsa.out->has_period_length) {
-    /* 1024 frames assuming 44100Hz */
-    dev->u.alsa.out->period_length = 1024 * 100 / 44100;
+    /* 256 frames assuming 44100Hz */
+    dev->u.alsa.out->period_length = 5805;
  }
  if (!dev->u.alsa.out->has_buffer_length) {
  /* 4096 frames assuming 44100Hz */
-    dev->u.alsa.out->buffer_length = 4096ll * 100 / 44100;
+    dev->u.alsa.out->buffer_length = 92880;

Not a big fan of magic numbers, as it makes code less readable.


I can't see how this can be improved. The buffer length is unchanged. 
I just evaluated the constant expression to have a time in 
microseconds like the rest of the audio backends. And libasound tells 
me to use 5804us for the period length which I rounded up to 5805us. I 
would prefer a period length of 5000us.


./qemu-system-x86_64 -device ich9-intel-hda -device 
hda-duplex,audiodev=audio0 -audiodev 
alsa,id=audio0,out.period-length=5000,out.dev=PCH,,0

alsa: Requested period time 5000 was rejected, using 5804


The correct command line is:
./qemu-system-x86_64 -device ich9-intel-hda -device 
hda-duplex,audiodev=audio0 -audiodev 
alsa,id=audio0,out.period-length=5000,out.dev=hw:PCH,,0

alsa: Requested period time 5000 was rejected, using 5804





  }
    /*








Re: [PATCH 10/11] alsaaudio: change default playback settings

2022-12-26 Thread Volker Rümelin

Am 21.12.22 um 12:03 schrieb Christian Schoenebeck:

On Sunday, December 18, 2022 6:15:38 PM CET Volker Rümelin wrote:

The currently used default playback settings in the ALSA audio
backend are a bit unfortunate. With a few emulated audio devices,
audio playback does not work properly. Here is a short part of
the debug log while audio is playing (elapsed time in seconds).

Which emulated devices are these?


The hda device and sb16. When I wrote this patch two months ago ac97 
also had occasional dropouts, but at the moment ac97 works without issues.



audio: Elapsed since last alsa run (running): 0.046244
audio: Elapsed since last alsa run (running): 0.023137
audio: Elapsed since last alsa run (running): 0.023170
audio: Elapsed since last alsa run (running): 0.023650
audio: Elapsed since last alsa run (running): 0.060802
audio: Elapsed since last alsa run (running): 0.031931

For some audio devices the time of more than 23ms between updates
is too long.

Set the period time to 5.8ms so that the maximum time between
two updates typically does not exceed 11ms. This roughly matches
the 10ms period time when doing playback with the audio timer.
After this patch the debug log looks like this.

And what about dynamically adapting that value instead of reducing period time
for everyone by default?


It seems this would be only needed for the ALSA backend. All other 
backends with the exception of OSS are fine with a 10ms period, and the 
ALSA audio backend also uses 10ms with -audiodev 
alsa,out.try-poll=off,in.try-poll=off.



23ms is usually a good trade off between low latency, CPU load and potential
for audio dropouts.


Quite often it's longer than 23ms. For the rest of the audio backends a 
timer period of 10ms was selected as a good trade off between CPU load 
and audio dropouts. But you are right, this patch increases the CPU load.


On my system the CPU load is increased by 0.9%. This was measured with a 
Linux guest using rhythmbox for audio playback. The guest was configured 
to use pulseaudio as sound server. The measurement was done with top -b 
-d 10 -n 14 over a period of two minutes. The first and last measurement 
was dropped. The average QEMU CPU load was 10.7% with and 9.8% without 
this patch.


I would prefer a system with a 0.9% increased CPU load where audio just 
works over a system where you have to fine tune audio parameters.



audio: Elapsed since last alsa run (running): 0.011919
audio: Elapsed since last alsa run (running): 0.005788
audio: Elapsed since last alsa run (running): 0.005995
audio: Elapsed since last alsa run (running): 0.011069
audio: Elapsed since last alsa run (running): 0.005901
audio: Elapsed since last alsa run (running): 0.006084

Signed-off-by: Volker Rümelin
---
  audio/alsaaudio.c | 11 ---
  1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index 5f50dfa0bf..0cc982e61f 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -913,17 +913,14 @@ static void *alsa_audio_init(Audiodev *dev)
  alsa_init_per_direction(aopts->in);
  alsa_init_per_direction(aopts->out);
  
-/*

- * need to define them, as otherwise alsa produces no sound
- * doesn't set has_* so alsa_open can identify it wasn't set by the user
- */
+/* don't set has_* so alsa_open can identify it wasn't set by the user */
  if (!dev->u.alsa.out->has_period_length) {
-/* 1024 frames assuming 44100Hz */
-dev->u.alsa.out->period_length = 1024 * 100 / 44100;
+/* 256 frames assuming 44100Hz */
+dev->u.alsa.out->period_length = 5805;
  }
  if (!dev->u.alsa.out->has_buffer_length) {
  /* 4096 frames assuming 44100Hz */
-dev->u.alsa.out->buffer_length = 4096ll * 100 / 44100;
+dev->u.alsa.out->buffer_length = 92880;

Not a big fan of magic numbers, as it makes code less readable.


I can't see how this can be improved. The buffer length is unchanged. I 
just evaluated the constant expression to have a time in microseconds 
like the rest of the audio backends. And libasound tells me to use 
5804us for the period length which I rounded up to 5805us. I would 
prefer a period length of 5000us.


./qemu-system-x86_64 -device ich9-intel-hda -device 
hda-duplex,audiodev=audio0 -audiodev 
alsa,id=audio0,out.period-length=5000,out.dev=PCH,,0

alsa: Requested period time 5000 was rejected, using 5804


  }
  
  /*







Re: [PATCH v5 4/4] x86: re-enable rng seeding via SetupData

2022-12-26 Thread Jason A. Donenfeld
On Mon, Dec 26, 2022 at 03:24:07PM +0100, Jason A. Donenfeld wrote:
> Hi,
> 
> I'm currently stumped at the moment, so adding linux-mm@ and x86@. Still
> working on it though. Details of where I'm at are below the quote below.
> 
> On Sat, Dec 24, 2022 at 05:21:46AM +0100, Jason A. Donenfeld wrote:
> > On Sat, Dec 24, 2022 at 04:09:08AM +0100, Jason A. Donenfeld wrote:
> > > Hi Eric,
> > > 
> > > Replying to you from my telephone, and I'm traveling the next two days,
> > > but I thought I should mention some preliminary results right away from
> > > doing some termux compiles:
> > > 
> > > On Fri, Dec 23, 2022 at 04:14:00PM -0800, Eric Biggers wrote:
> > > > Hi Jason,
> > > > 
> > > > On Wed, Sep 21, 2022 at 11:31:34AM +0200, Jason A. Donenfeld wrote:
> > > > > This reverts 3824e25db1 ("x86: disable rng seeding via setup_data"), 
> > > > > but
> > > > > for 7.2 rather than 7.1, now that modifying setup_data is safe to do.
> > > > > 
> > > > > Cc: Laurent Vivier 
> > > > > Cc: Michael S. Tsirkin 
> > > > > Cc: Paolo Bonzini 
> > > > > Cc: Peter Maydell 
> > > > > Cc: Philippe Mathieu-Daudé 
> > > > > Cc: Richard Henderson 
> > > > > Cc: Ard Biesheuvel 
> > > > > Acked-by: Gerd Hoffmann 
> > > > > Signed-off-by: Jason A. Donenfeld 
> > > > > ---
> > > > >  hw/i386/microvm.c | 2 +-
> > > > >  hw/i386/pc_piix.c | 3 ++-
> > > > >  hw/i386/pc_q35.c  | 3 ++-
> > > > >  3 files changed, 5 insertions(+), 3 deletions(-)
> > > > > 
> > > > 
> > > > After upgrading to QEMU 7.2, Linux 6.1 no longer boots with some 
> > > > configs.  There
> > > > is no output at all.  I bisected it to this commit, and I verified that 
> > > > the
> > > > following change to QEMU's master branch makes the problem go away:
> > > > 
> > > > diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
> > > > index b48047f50c..42f5b07d2f 100644
> > > > --- a/hw/i386/pc_piix.c
> > > > +++ b/hw/i386/pc_piix.c
> > > > @@ -441,6 +441,7 @@ static void 
> > > > pc_i440fx_8_0_machine_options(MachineClass *m)
> > > >  pc_i440fx_machine_options(m);
> > > >  m->alias = "pc";
> > > >  m->is_default = true;
> > > > +PC_MACHINE_CLASS(m)->legacy_no_rng_seed = true;
> > > >  }
> > > > 
> > > > I've attached the kernel config I am seeing the problem on.
> > > > 
> > > > For some reason, the problem also goes away if I disable CONFIG_KASAN.
> > > > 
> > > > Any idea what is causing this?
> > > 
> > > - Commenting out the call to parse_setup_data() doesn't fix the issue.
> > >   So there's no KASAN issue with the actual parser.
> > > 
> > > - Using KASAN_OUTLINE rather than INLINE does fix the issue!
> > > 
> > > That makes me suspect that it's file size related, and QEMU or the BIOS
> > > is placing setup data at an overlapping offset by accident, or something
> > > similar.
> > 
> > I removed the file systems from your config to bring the kernel size
> > back down, and voila, it works, even with KASAN_INLINE. So perhaps I'm
> > on the right track here...
> 
> QEMU sticks setup_data after the kernel image, the same as kexec-tools
> and everything else. Apparently, when the kernel image is large, the
> call to early_memremap(boot_params.hdr.setup_data, ...) returns a value
> that points some place bogus, and the system crashes or does something
> weird. I haven't yet determined what this limit is, but in my current
> test kernel, a value of 0x01327650 is enough to make it point to
> rubbish.
> 
> Is this expected? What's going on here?

Attaching gdb to QEMU and switching it to physical memory mode
(`maintenance packet Qqemu.PhyMemMode:1 `) indicates that it
early_memremap is actually working fine and something *else* is at this
address? That's kinda weird... Is KASAN populating physical addresses
immediately after the kernel image extremely early in boot? I'm seeing
the crash happen from early_reserve_memory()->
memblock_x86_reserve_range_setup_data(), which should be before
kasan_init() even runs. Is QEMU calculating kernel_size wrong, when it
goes to determine where to put the setup_data data? But that's the same
calculation as used everywhere else, so hmm...

Jason



Re: [PATCH v5 4/4] x86: re-enable rng seeding via SetupData

2022-12-26 Thread Jason A. Donenfeld
Hi,

I'm currently stumped at the moment, so adding linux-mm@ and x86@. Still
working on it though. Details of where I'm at are below the quote below.

On Sat, Dec 24, 2022 at 05:21:46AM +0100, Jason A. Donenfeld wrote:
> On Sat, Dec 24, 2022 at 04:09:08AM +0100, Jason A. Donenfeld wrote:
> > Hi Eric,
> > 
> > Replying to you from my telephone, and I'm traveling the next two days,
> > but I thought I should mention some preliminary results right away from
> > doing some termux compiles:
> > 
> > On Fri, Dec 23, 2022 at 04:14:00PM -0800, Eric Biggers wrote:
> > > Hi Jason,
> > > 
> > > On Wed, Sep 21, 2022 at 11:31:34AM +0200, Jason A. Donenfeld wrote:
> > > > This reverts 3824e25db1 ("x86: disable rng seeding via setup_data"), but
> > > > for 7.2 rather than 7.1, now that modifying setup_data is safe to do.
> > > > 
> > > > Cc: Laurent Vivier 
> > > > Cc: Michael S. Tsirkin 
> > > > Cc: Paolo Bonzini 
> > > > Cc: Peter Maydell 
> > > > Cc: Philippe Mathieu-Daudé 
> > > > Cc: Richard Henderson 
> > > > Cc: Ard Biesheuvel 
> > > > Acked-by: Gerd Hoffmann 
> > > > Signed-off-by: Jason A. Donenfeld 
> > > > ---
> > > >  hw/i386/microvm.c | 2 +-
> > > >  hw/i386/pc_piix.c | 3 ++-
> > > >  hw/i386/pc_q35.c  | 3 ++-
> > > >  3 files changed, 5 insertions(+), 3 deletions(-)
> > > > 
> > > 
> > > After upgrading to QEMU 7.2, Linux 6.1 no longer boots with some configs. 
> > >  There
> > > is no output at all.  I bisected it to this commit, and I verified that 
> > > the
> > > following change to QEMU's master branch makes the problem go away:
> > > 
> > > diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
> > > index b48047f50c..42f5b07d2f 100644
> > > --- a/hw/i386/pc_piix.c
> > > +++ b/hw/i386/pc_piix.c
> > > @@ -441,6 +441,7 @@ static void 
> > > pc_i440fx_8_0_machine_options(MachineClass *m)
> > >  pc_i440fx_machine_options(m);
> > >  m->alias = "pc";
> > >  m->is_default = true;
> > > +PC_MACHINE_CLASS(m)->legacy_no_rng_seed = true;
> > >  }
> > > 
> > > I've attached the kernel config I am seeing the problem on.
> > > 
> > > For some reason, the problem also goes away if I disable CONFIG_KASAN.
> > > 
> > > Any idea what is causing this?
> > 
> > - Commenting out the call to parse_setup_data() doesn't fix the issue.
> >   So there's no KASAN issue with the actual parser.
> > 
> > - Using KASAN_OUTLINE rather than INLINE does fix the issue!
> > 
> > That makes me suspect that it's file size related, and QEMU or the BIOS
> > is placing setup data at an overlapping offset by accident, or something
> > similar.
> 
> I removed the file systems from your config to bring the kernel size
> back down, and voila, it works, even with KASAN_INLINE. So perhaps I'm
> on the right track here...

QEMU sticks setup_data after the kernel image, the same as kexec-tools
and everything else. Apparently, when the kernel image is large, the
call to early_memremap(boot_params.hdr.setup_data, ...) returns a value
that points some place bogus, and the system crashes or does something
weird. I haven't yet determined what this limit is, but in my current
test kernel, a value of 0x01327650 is enough to make it point to
rubbish.

Is this expected? What's going on here?

Jason



Re: [PATCH 13/15] hw/riscv/spike.c: simplify create_fdt()

2022-12-26 Thread Daniel Henrique Barboza




On 12/23/22 10:06, Bin Meng wrote:

On Thu, Dec 22, 2022 at 2:29 AM Daniel Henrique Barboza
 wrote:

'mem_size' and 'cmdline' aren't being used and the MachineState pointer
is being retrieved via a MACHINE() macro.

Remove 'mem_size' and 'cmdline' and add MachineState as a parameter.

Why do you add MachineState as a parameter? What's the problem of
using the MACHINE() macro?


Yeah, I went overboard with the macro removal in this case and in patch 14.
I'll also redo patch 15 to avoid the qdev_get_machine() call but keeping the
macro.



Daniel






Signed-off-by: Daniel Henrique Barboza 
---
  hw/riscv/spike.c | 8 +++-
  1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index 2b9af5689e..181bf394a0 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -48,15 +48,14 @@ static const MemMapEntry spike_memmap[] = {
  [SPIKE_DRAM] = { 0x8000,0x0 },
  };

-static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
-   uint64_t mem_size, const char *cmdline, bool is_32_bit)
+static void create_fdt(MachineState *mc, SpikeState *s,
+   const MemMapEntry *memmap, bool is_32_bit)
  {
  void *fdt;
  int fdt_size;
  uint64_t addr, size;
  unsigned long clint_addr;
  int cpu, socket;
-MachineState *mc = MACHINE(s);
  uint32_t *clint_cells;
  uint32_t cpu_phandle, intc_phandle, phandle = 1;
  char *name, *mem_name, *clint_name, *clust_name;
@@ -254,8 +253,7 @@ static void spike_board_init(MachineState *machine)
  mask_rom);

  /* Create device tree */
-create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
-   riscv_is_32bit(>soc[0]));
+create_fdt(machine, s, memmap, riscv_is_32bit(>soc[0]));

  /*
   * Not like other RISC-V machines that use plain binary bios images,
--

Regards,
Bin





Re: [PATCH 0/2] qga: Add ZFS TRIM support for FreeBSD

2022-12-26 Thread Konstantin Kostiuk
Hi Alexander,

Can you please rebase your changes to the current master?
I failed to apply these patches.

Best Regards,
Konstantin Kostiuk.


On Tue, Nov 15, 2022 at 8:46 PM Alexander Ivanov <
alexander.iva...@virtuozzo.com> wrote:

> Move Linux-specific FS TRIM code to commands-linux.c and add support of
> ZFS TRIM for FreeBSD.
>
> Alexander Ivanov (2):
>   qga: Move FS TRIM code to commands-linux.c
>   qga: Add ZFS TRIM support for FreeBSD
>
>  qga/commands-bsd.c| 109 ++
>  qga/commands-common.h |   1 +
>  qga/commands-linux.c  |  73 
>  qga/commands-posix.c  |  72 
>  4 files changed, 183 insertions(+), 72 deletions(-)
>
> --
> 2.34.1
>
>


Re: [PATCH] qga: Add initial OpenBSD and NetBSD support

2022-12-26 Thread Konstantin Kostiuk
the series was merged

Best Regards,
Konstantin Kostiuk.


On Thu, Nov 17, 2022 at 10:50 AM Konstantin Kostiuk 
wrote:

> Reviewed-by: Konstantin Kostiuk 
>
> On Sun, Nov 13, 2022 at 9:32 PM Philippe Mathieu-Daudé 
> wrote:
>
>> On 12/11/22 12:40, Brad Smith wrote:
>> > qga: Add initial OpenBSD and NetBSD support
>> >
>> > Signed-off-by: Brad Smith 
>> > ---
>> >   meson.build  | 2 +-
>> >   qga/commands-bsd.c   | 5 +
>> >   qga/commands-posix.c | 9 +++--
>> >   qga/main.c   | 6 +++---
>> >   4 files changed, 16 insertions(+), 6 deletions(-)
>>
>> Reviewed-by: Philippe Mathieu-Daudé 
>>
>>


Re: [PATCH v2] qga-win: choose the right libpcre version to include in MSI package

2022-12-26 Thread Konstantin Kostiuk
the series was merged

Best Regards,
Konstantin Kostiuk.


On Tue, Dec 13, 2022 at 9:20 PM Konstantin Kostiuk 
wrote:

> Reviewed-by: Konstantin Kostiuk 
> Tested-by: Konstantin Kostiuk 
>
> On Tue, Dec 13, 2022 at 5:13 PM Andrey Drobyshev <
> andrey.drobys...@virtuozzo.com> wrote:
>
>> According to GLib changelog [1], since version 2.73.2 GLib is using
>> libpcre2 instead of libpcre.  As a result, qemu-ga MSI installation
>> fails due to missing DLL when linked with the newer GLib.
>>
>> This commit makes wixl to put the right libpcre version into the MSI
>> bundle: either libpcre-1.dll or libpcre2-8-0.dll, depending on the
>> present version of GLib.
>>
>> [1] https://gitlab.gnome.org/GNOME/glib/-/releases#2.73.2
>>
>> Previous version:
>> https://lists.nongnu.org/archive/html/qemu-trivial/2022-11/msg00237.html
>>
>> Signed-off-by: Andrey Drobyshev 
>> ---
>>  qga/installer/qemu-ga.wxs | 12 +---
>>  qga/meson.build   |  6 ++
>>  2 files changed, 15 insertions(+), 3 deletions(-)
>>
>> diff --git a/qga/installer/qemu-ga.wxs b/qga/installer/qemu-ga.wxs
>> index e344c38e74..9f0bacae81 100644
>> --- a/qga/installer/qemu-ga.wxs
>> +++ b/qga/installer/qemu-ga.wxs
>> @@ -101,9 +101,15 @@
>>> Guid="{6C117C78-0F47-4B07-8F34-6BEE11643829}">
>>  > Source="$(var.BIN_DIR)/libwinpthread-1.dll" KeyPath="yes" DiskId="1"/>
>>
>> -  > Guid="{7A86B45E-A009-489A-A849-CE3BACF03CD0}">
>> -> Source="$(var.BIN_DIR)/libpcre-1.dll" KeyPath="yes" DiskId="1"/>
>> -  
>> +  
>> +> Guid="{7A86B45E-A009-489A-A849-CE3BACF03CD0}">
>> +  > Source="$(var.BIN_DIR)/libpcre-1.dll" KeyPath="yes" DiskId="1"/>
>> +
>> +  
>> +> Guid="{F92A3804-B59C-419D-8F29-99A30352C156}">
>> +  > Source="$(var.BIN_DIR)/libpcre2-8-0.dll" KeyPath="yes" DiskId="1"/>
>> +
>> +  
>>> Guid="{D075D109-51CA-11E3-9F8B-000C29858960}">
>>  >
>> Key="Software\$(var.QEMU_GA_MANUFACTURER)\$(var.QEMU_GA_DISTRO)\Tools\QemuGA">
>> diff --git a/qga/meson.build b/qga/meson.build
>> index 1ff159edc1..ad17dc7dca 100644
>> --- a/qga/meson.build
>> +++ b/qga/meson.build
>> @@ -140,6 +140,11 @@ if targetos == 'windows'
>>qemu_ga_msi_vss = ['-D', 'InstallVss']
>>deps += qga_vss
>>  endif
>> +if glib.version() < '2.73.2'
>> +  libpcre = 'libpcre1'
>> +else
>> +  libpcre = 'libpcre2'
>> +endif
>>  qga_msi = custom_target('QGA MSI',
>>  input: files('installer/qemu-ga.wxs'),
>>  output: 'qemu-ga-@0@.msi'.format(host_arch),
>> @@ -153,6 +158,7 @@ if targetos == 'windows'
>>'-D', 'QEMU_GA_VERSION=' +
>> config_host['QEMU_GA_VERSION'],
>>'-D', 'QEMU_GA_MANUFACTURER=' +
>> config_host['QEMU_GA_MANUFACTURER'],
>>'-D', 'QEMU_GA_DISTRO=' +
>> config_host['QEMU_GA_DISTRO'],
>> +  '-D', 'LIBPCRE=' + libpcre,
>>  ])
>>  all_qga += [qga_msi]
>>  alias_target('msi', qga_msi)
>> --
>> 2.34.3
>>
>>


Re: [PATCH 0/2] qemu-ga-win: 'guest-get-fsinfo' command wont query storage devices of bus type USB

2022-12-26 Thread Konstantin Kostiuk
the series was merged

Best Regards,
Konstantin Kostiuk.

On Mon, Nov 21, 2022 at 8:38 AM Marc-André Lureau <
marcandre.lur...@gmail.com> wrote:

> Hi
>
> On Sun, Nov 20, 2022 at 6:09 PM Kfir Manor  wrote:
> >
> > guest-get-fsinfo won't query storage devices of bus-type USB (
> https://bugzilla.redhat.com/show_bug.cgi?id=2090333).
> >
> > Bug, get_pci_info function returns an error after not finding any
> storage port device info on the USB disk parent device (because of USB
> abstraction).
> >
> > Fix, skip getting PCI info (get_pci_info function) for USB disks (as USB
> disk doesn't have PCI info), and return an empty PCI address instead to
> keep with schema.
> >
> >
> > Kfir Manor (2):
> >   adding a empty PCI address creation function
> >   skip getting pci info for USB disks
> >
> >  qga/commands-win32.c | 32 +---
> >  1 file changed, 21 insertions(+), 11 deletions(-)
> >
> > --
> > 2.38.1
> >
> >
>
> Reviewed-by: Marc-André Lureau 
>
>
>
> --
> Marc-André Lureau
>
>


Re: [PATCH 01/15] tests/avocado: add RISC-V opensbi boot test

2022-12-26 Thread Daniel Henrique Barboza




On 12/26/22 10:56, Bin Meng wrote:

On Sat, Dec 24, 2022 at 11:52 AM Bin Meng  wrote:

Hi,

On Fri, Dec 23, 2022 at 2:25 PM Bin Meng  wrote:

Hi Anup,

On Fri, Dec 23, 2022 at 12:56 AM Anup Patel  wrote:

On Thu, Dec 22, 2022 at 6:27 PM Bin Meng  wrote:

On Thu, Dec 22, 2022 at 6:47 PM Daniel Henrique Barboza
 wrote:



On 12/22/22 07:24, Bin Meng wrote:

On Thu, Dec 22, 2022 at 2:29 AM Daniel Henrique Barboza
 wrote:

This test is used to do a quick sanity check to ensure that we're able
to run the existing QEMU FW image.

'sifive_u', 'spike' and 'virt' riscv64 machines, and 'sifive_u' and
'virt' 32 bit machines are able to run the default RISCV64_BIOS_BIN |
RISCV32_BIOS_BIN firmware with minimal options.

Cc: Cleber Rosa 
Cc: Philippe Mathieu-Daudé 
Cc: Wainer dos Santos Moschetta 
Cc: Beraldo Leal 
Signed-off-by: Daniel Henrique Barboza 
---
   tests/avocado/riscv_opensbi.py | 65 ++
   1 file changed, 65 insertions(+)
   create mode 100644 tests/avocado/riscv_opensbi.py

diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
new file mode 100644
index 00..abc99ced30
--- /dev/null
+++ b/tests/avocado/riscv_opensbi.py
@@ -0,0 +1,65 @@
+# opensbi boot test for RISC-V machines
+#
+# Copyright (c) 2022, Ventana Micro
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+from avocado_qemu import QemuSystemTest
+from avocado_qemu import wait_for_console_pattern
+
+class RiscvOpensbi(QemuSystemTest):
+"""
+:avocado: tags=accel:tcg
+"""
+timeout = 5
+
+def test_riscv64_virt(self):
+"""
+:avocado: tags=arch:riscv64
+:avocado: tags=machine:virt
+"""
+self.vm.set_console()
+self.vm.launch()
+wait_for_console_pattern(self, 'Platform Name')
+wait_for_console_pattern(self, 'Boot HART MEDELEG')
+
+def test_riscv64_spike(self):
+"""
+:avocado: tags=arch:riscv64
+:avocado: tags=machine:spike
+"""
+self.vm.set_console()
+self.vm.launch()
+wait_for_console_pattern(self, 'Platform Name')
+wait_for_console_pattern(self, 'Boot HART MEDELEG')
+
+def test_riscv64_sifive_u(self):
+"""
+:avocado: tags=arch:riscv64
+:avocado: tags=machine:sifive_u
+"""
+self.vm.set_console()
+self.vm.launch()
+wait_for_console_pattern(self, 'Platform Name')
+wait_for_console_pattern(self, 'Boot HART MEDELEG')
+
+def test_riscv32_virt(self):
+"""
+:avocado: tags=arch:riscv32
+:avocado: tags=machine:virt
+"""
+self.vm.set_console()
+self.vm.launch()
+wait_for_console_pattern(self, 'Platform Name')
+wait_for_console_pattern(self, 'Boot HART MEDELEG')

How about testing riscv32_spike too?


I didn't manage to make it work. This riscv64 spark command line boots opensbi:


$ ./qemu-system-riscv64 -nographic -display none -vga none -machine spike

OpenSBI v1.1
 _  _
/ __ \  / |  _ \_   _|
   | |  | |_ __   ___ _ __ | (___ | |_) || |
   | |  | | '_ \ / _ \ '_ \ \___ \|  _ < | |
   | |__| | |_) |  __/ | | |) | |_) || |_
\/| .__/ \___|_| |_|_/|/_|
  | |
  |_|

(...)

The same command line doesn't boot riscv32 spark:

./qemu-system-riscv32 -nographic -display none -vga none -machine spike
(--- hangs indefinitely ---)

I debugged it a bit and, as far as boot code goes, it goes all the way and 
loads the
opensbi 32bit binary.

After that I tried to found any command line example that boots spike with 
riscv32
bit and didn't find any.  So I gave up digging it further because I became 
unsure
about whether 32-bit spike works.

If someone can verify that yes, 32-bit spike is supposed to work, then I 
believe it's
worth investigating why it's not the case ATM.


+Anup who might know if QEMU spike 32-bit machine works with opensbi
32-bit generic image.

We never got HTIF putc() working on QEMU RV32 Spike but it works
perfectly fine on QEMU RV64 Spike.

Where is the problem for the 32-bit? Is it in OpenSBI or in QEMU?


See below log of QEMU RV64 Spike ...


If we cannot get Spike 32-bit to work in QEMU, should we drop the
32-bit support? @Alistair Francis

I got a deeper look at the 32-bit spike issue and I believe it is a
problem of QEMU HTIF emulation.

I will see if I can spin a patch to fix this.


It turns out there is a bug in OpenSBI too when booting 32-bit BIN
image on Spike.

For ELF & BIN image boot on QEMU, QEMU changes are needed. I will send
the QEMU patches soon.


I'll wait for your patches to re-send this series. If you can get spike 32-bit
to work then I'll re-send the v2 with the 32 bit spike tests enabled.


Thanks,


Daniel



Regards,
Bin





Re: [PATCH 01/15] tests/avocado: add RISC-V opensbi boot test

2022-12-26 Thread Bin Meng
On Sat, Dec 24, 2022 at 11:52 AM Bin Meng  wrote:
>
> Hi,
>
> On Fri, Dec 23, 2022 at 2:25 PM Bin Meng  wrote:
> >
> > Hi Anup,
> >
> > On Fri, Dec 23, 2022 at 12:56 AM Anup Patel  wrote:
> > >
> > > On Thu, Dec 22, 2022 at 6:27 PM Bin Meng  wrote:
> > > >
> > > > On Thu, Dec 22, 2022 at 6:47 PM Daniel Henrique Barboza
> > > >  wrote:
> > > > >
> > > > >
> > > > >
> > > > > On 12/22/22 07:24, Bin Meng wrote:
> > > > > > On Thu, Dec 22, 2022 at 2:29 AM Daniel Henrique Barboza
> > > > > >  wrote:
> > > > > >> This test is used to do a quick sanity check to ensure that we're 
> > > > > >> able
> > > > > >> to run the existing QEMU FW image.
> > > > > >>
> > > > > >> 'sifive_u', 'spike' and 'virt' riscv64 machines, and 'sifive_u' and
> > > > > >> 'virt' 32 bit machines are able to run the default 
> > > > > >> RISCV64_BIOS_BIN |
> > > > > >> RISCV32_BIOS_BIN firmware with minimal options.
> > > > > >>
> > > > > >> Cc: Cleber Rosa 
> > > > > >> Cc: Philippe Mathieu-Daudé 
> > > > > >> Cc: Wainer dos Santos Moschetta 
> > > > > >> Cc: Beraldo Leal 
> > > > > >> Signed-off-by: Daniel Henrique Barboza 
> > > > > >> ---
> > > > > >>   tests/avocado/riscv_opensbi.py | 65 
> > > > > >> ++
> > > > > >>   1 file changed, 65 insertions(+)
> > > > > >>   create mode 100644 tests/avocado/riscv_opensbi.py
> > > > > >>
> > > > > >> diff --git a/tests/avocado/riscv_opensbi.py 
> > > > > >> b/tests/avocado/riscv_opensbi.py
> > > > > >> new file mode 100644
> > > > > >> index 00..abc99ced30
> > > > > >> --- /dev/null
> > > > > >> +++ b/tests/avocado/riscv_opensbi.py
> > > > > >> @@ -0,0 +1,65 @@
> > > > > >> +# opensbi boot test for RISC-V machines
> > > > > >> +#
> > > > > >> +# Copyright (c) 2022, Ventana Micro
> > > > > >> +#
> > > > > >> +# This work is licensed under the terms of the GNU GPL, version 2 
> > > > > >> or
> > > > > >> +# later.  See the COPYING file in the top-level directory.
> > > > > >> +
> > > > > >> +from avocado_qemu import QemuSystemTest
> > > > > >> +from avocado_qemu import wait_for_console_pattern
> > > > > >> +
> > > > > >> +class RiscvOpensbi(QemuSystemTest):
> > > > > >> +"""
> > > > > >> +:avocado: tags=accel:tcg
> > > > > >> +"""
> > > > > >> +timeout = 5
> > > > > >> +
> > > > > >> +def test_riscv64_virt(self):
> > > > > >> +"""
> > > > > >> +:avocado: tags=arch:riscv64
> > > > > >> +:avocado: tags=machine:virt
> > > > > >> +"""
> > > > > >> +self.vm.set_console()
> > > > > >> +self.vm.launch()
> > > > > >> +wait_for_console_pattern(self, 'Platform Name')
> > > > > >> +wait_for_console_pattern(self, 'Boot HART MEDELEG')
> > > > > >> +
> > > > > >> +def test_riscv64_spike(self):
> > > > > >> +"""
> > > > > >> +:avocado: tags=arch:riscv64
> > > > > >> +:avocado: tags=machine:spike
> > > > > >> +"""
> > > > > >> +self.vm.set_console()
> > > > > >> +self.vm.launch()
> > > > > >> +wait_for_console_pattern(self, 'Platform Name')
> > > > > >> +wait_for_console_pattern(self, 'Boot HART MEDELEG')
> > > > > >> +
> > > > > >> +def test_riscv64_sifive_u(self):
> > > > > >> +"""
> > > > > >> +:avocado: tags=arch:riscv64
> > > > > >> +:avocado: tags=machine:sifive_u
> > > > > >> +"""
> > > > > >> +self.vm.set_console()
> > > > > >> +self.vm.launch()
> > > > > >> +wait_for_console_pattern(self, 'Platform Name')
> > > > > >> +wait_for_console_pattern(self, 'Boot HART MEDELEG')
> > > > > >> +
> > > > > >> +def test_riscv32_virt(self):
> > > > > >> +"""
> > > > > >> +:avocado: tags=arch:riscv32
> > > > > >> +:avocado: tags=machine:virt
> > > > > >> +"""
> > > > > >> +self.vm.set_console()
> > > > > >> +self.vm.launch()
> > > > > >> +wait_for_console_pattern(self, 'Platform Name')
> > > > > >> +wait_for_console_pattern(self, 'Boot HART MEDELEG')
> > > > > > How about testing riscv32_spike too?
> > > > >
> > > > >
> > > > > I didn't manage to make it work. This riscv64 spark command line 
> > > > > boots opensbi:
> > > > >
> > > > >
> > > > > $ ./qemu-system-riscv64 -nographic -display none -vga none -machine 
> > > > > spike
> > > > >
> > > > > OpenSBI v1.1
> > > > > _  _
> > > > >/ __ \  / |  _ \_   _|
> > > > >   | |  | |_ __   ___ _ __ | (___ | |_) || |
> > > > >   | |  | | '_ \ / _ \ '_ \ \___ \|  _ < | |
> > > > >   | |__| | |_) |  __/ | | |) | |_) || |_
> > > > >\/| .__/ \___|_| |_|_/|/_|
> > > > >  | |
> > > > >  |_|
> > > > >
> > > > > (...)
> > > > >
> > > > > The same command line doesn't boot riscv32 spark:
> > > > >
> > > > > ./qemu-system-riscv32 -nographic -display none -vga none -machine 
> > > > > spike
> > > > > (--- hangs indefinitely ---)
> > > > >
> > > > > I 

Re: [PATCH 06/15] hw/riscv/spike.c: load initrd right after riscv_load_kernel()

2022-12-26 Thread Daniel Henrique Barboza




On 12/26/22 10:49, Bin Meng wrote:

On Fri, Dec 23, 2022 at 6:04 PM Bin Meng  wrote:

On Thu, Dec 22, 2022 at 2:28 AM Daniel Henrique Barboza
 wrote:

This will make the code more in line with what the other boards are
doing. We'll also avoid an extra check to machine->kernel_filename since
we already checked that before executing riscv_load_kernel().

Signed-off-by: Daniel Henrique Barboza 
---
  hw/riscv/spike.c | 31 +++
  1 file changed, 15 insertions(+), 16 deletions(-)


Reviewed-by: Bin Meng 

This change unfortunately breaks the ELF boot on Spike.

I will propose a patch to fix such unexpected dependency.


Interesting.  This is one of the most benign changes I did, or so I thought.

I believe we should wait for you patch fixing it first.


Daniel




Regards,
Bin





Re: [PATCH 06/15] hw/riscv/spike.c: load initrd right after riscv_load_kernel()

2022-12-26 Thread Bin Meng
On Fri, Dec 23, 2022 at 6:04 PM Bin Meng  wrote:
>
> On Thu, Dec 22, 2022 at 2:28 AM Daniel Henrique Barboza
>  wrote:
> >
> > This will make the code more in line with what the other boards are
> > doing. We'll also avoid an extra check to machine->kernel_filename since
> > we already checked that before executing riscv_load_kernel().
> >
> > Signed-off-by: Daniel Henrique Barboza 
> > ---
> >  hw/riscv/spike.c | 31 +++
> >  1 file changed, 15 insertions(+), 16 deletions(-)
> >
>
> Reviewed-by: Bin Meng 

This change unfortunately breaks the ELF boot on Spike.

I will propose a patch to fix such unexpected dependency.

Regards,
Bin



Re: [PATCH v5 01/43] tcg: convert tcg/README to rst

2022-12-26 Thread Philippe Mathieu-Daudé

On 25/12/22 00:56, Richard Henderson wrote:

From: Mark Cave-Ayland 

Convert tcg/README to rst and move it to docs/devel as a new "TCG Intermediate
Representation" page. There are a few minor changes to improve the aesthetic
of the final output which are as follows:

   - Rename the title from "Tiny Code Generator - Fabrice Bellard" to "TCG
 Intermediate Representation"

   - Remove the section numbering

   - Add the missing parameters to the ssadd_vec operations in the "Host
 vector operations" section

   - Change the path to the Atomic Operations document to use a proper
 reference

   - Replace tcg/README in tcg.rst with a proper reference to the new document

Signed-off-by: Mark Cave-Ayland 
Reviewed-by: Fabiano Rosas 
Message-Id: <20221130100434.64207-2-mark.cave-ayl...@ilande.co.uk>
Signed-off-by: Richard Henderson 
---
  docs/devel/atomics.rst   |   2 +
  docs/devel/index-tcg.rst |   1 +
  docs/devel/tcg-ops.rst   | 941 +++
  docs/devel/tcg.rst   |   2 +-
  tcg/README   | 784 
  5 files changed, 945 insertions(+), 785 deletions(-)
  create mode 100644 docs/devel/tcg-ops.rst
  delete mode 100644 tcg/README



diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
new file mode 100644
index 00..9adc0c9b6c
--- /dev/null
+++ b/docs/devel/tcg-ops.rst
@@ -0,0 +1,941 @@
+.. _tcg-ops-ref:
+
+***
+TCG Intermediate Representation
+***
+
+Introduction
+
+
+TCG (Tiny Code Generator) began as a generic backend for a C
+compiler


written by Fabrice Bellard?


It was simplified to be used in QEMU. It also has its roots
+in the QOP code generator written by Paul Brook.





Re: [PATCH v5 35/43] tcg: Pass number of arguments to tcg_emit_op() / tcg_op_insert_*()

2022-12-26 Thread Philippe Mathieu-Daudé

On 25/12/22 00:57, Richard Henderson wrote:

From: Philippe Mathieu-Daudé 

In order to have variable size allocated TCGOp, pass the number
of arguments we use (and would allocate) up to tcg_op_alloc().

This alters tcg_emit_op(), tcg_op_insert_before() and
tcg_op_insert_after() prototypes.

In tcg_op_alloc() ensure the number of arguments is in range.

Signed-off-by: Richard Henderson 
[PMD: Extracted from bigger patch]
Signed-off-by: Philippe Mathieu-Daudé 
Message-Id: <20221218211832.73312-2-phi...@linaro.org>
---
  include/tcg/tcg-op.h   |  2 +-
  include/tcg/tcg.h  |  8 +---
  accel/tcg/plugin-gen.c |  5 -
  tcg/optimize.c |  4 ++--
  tcg/tcg-op-vec.c   |  8 
  tcg/tcg-op.c   | 12 ++--
  tcg/tcg.c  | 30 +-
  7 files changed, 39 insertions(+), 30 deletions(-)


Reviewed-by: Philippe Mathieu-Daudé 




[PATCH] i.MX7D: Connect IRQs to GPIO devices.

2022-12-26 Thread Jean-Christophe Dubois
IRQs were not associated to the various GPIO devices inside i.MX7D.
This patch brings the i.MX7D on par with i.MX6.

Signed-off-by: Jean-Christophe Dubois 
---
 hw/arm/fsl-imx7.c | 31 ++-
 include/hw/arm/fsl-imx7.h | 15 +++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index cc6fdb9373..5629ee249d 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -235,8 +235,37 @@ static void fsl_imx7_realize(DeviceState *dev, Error 
**errp)
 FSL_IMX7_GPIO7_ADDR,
 };
 
+static const int FSL_IMX7_GPIOn_LOW_IRQ[FSL_IMX7_NUM_GPIOS] = {
+FSL_IMX7_GPIO1_LOW_IRQ,
+FSL_IMX7_GPIO2_LOW_IRQ,
+FSL_IMX7_GPIO3_LOW_IRQ,
+FSL_IMX7_GPIO4_LOW_IRQ,
+FSL_IMX7_GPIO5_LOW_IRQ,
+FSL_IMX7_GPIO6_LOW_IRQ,
+FSL_IMX7_GPIO7_LOW_IRQ,
+};
+
+static const int FSL_IMX7_GPIOn_HIGH_IRQ[FSL_IMX7_NUM_GPIOS] = {
+FSL_IMX7_GPIO1_HIGH_IRQ,
+FSL_IMX7_GPIO2_HIGH_IRQ,
+FSL_IMX7_GPIO3_HIGH_IRQ,
+FSL_IMX7_GPIO4_HIGH_IRQ,
+FSL_IMX7_GPIO5_HIGH_IRQ,
+FSL_IMX7_GPIO6_HIGH_IRQ,
+FSL_IMX7_GPIO7_HIGH_IRQ,
+};
+
 sysbus_realize(SYS_BUS_DEVICE(>gpio[i]), _abort);
-sysbus_mmio_map(SYS_BUS_DEVICE(>gpio[i]), 0, 
FSL_IMX7_GPIOn_ADDR[i]);
+sysbus_mmio_map(SYS_BUS_DEVICE(>gpio[i]), 0,
+FSL_IMX7_GPIOn_ADDR[i]);
+
+sysbus_connect_irq(SYS_BUS_DEVICE(>gpio[i]), 0,
+   qdev_get_gpio_in(DEVICE(>a7mpcore),
+FSL_IMX7_GPIOn_LOW_IRQ[i]));
+
+sysbus_connect_irq(SYS_BUS_DEVICE(>gpio[i]), 1,
+   qdev_get_gpio_in(DEVICE(>a7mpcore),
+FSL_IMX7_GPIOn_HIGH_IRQ[i]));
 }
 
 /*
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index 1c5fa6fd67..852eb0d238 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -235,6 +235,21 @@ enum FslIMX7IRQs {
 FSL_IMX7_USB2_IRQ = 42,
 FSL_IMX7_USB3_IRQ = 40,
 
+FSL_IMX7_GPIO1_LOW_IRQ  = 64,
+FSL_IMX7_GPIO1_HIGH_IRQ = 65,
+FSL_IMX7_GPIO2_LOW_IRQ  = 66,
+FSL_IMX7_GPIO2_HIGH_IRQ = 67,
+FSL_IMX7_GPIO3_LOW_IRQ  = 68,
+FSL_IMX7_GPIO3_HIGH_IRQ = 69,
+FSL_IMX7_GPIO4_LOW_IRQ  = 70,
+FSL_IMX7_GPIO4_HIGH_IRQ = 71,
+FSL_IMX7_GPIO5_LOW_IRQ  = 72,
+FSL_IMX7_GPIO5_HIGH_IRQ = 73,
+FSL_IMX7_GPIO6_LOW_IRQ  = 74,
+FSL_IMX7_GPIO6_HIGH_IRQ = 75,
+FSL_IMX7_GPIO7_LOW_IRQ  = 76,
+FSL_IMX7_GPIO7_HIGH_IRQ = 77,
+
 FSL_IMX7_WDOG1_IRQ= 78,
 FSL_IMX7_WDOG2_IRQ= 79,
 FSL_IMX7_WDOG3_IRQ= 10,
-- 
2.34.1