[PATCH] spapr: avoid overhead of finding vhyp class in critical operations

2024-02-23 Thread Nicholas Piggin
PPC_VIRTUAL_HYPERVISOR_GET_CLASS is used in critical operations like
interrupts and TLB misses and is quite costly. Running the
kvm-unit-tests sieve program with radix MMU enabled thrashes the TCG
TLB and spends a lot of time in TLB and page table walking code. The
test takes 67 seconds to complete with a lot of time being spent in
code related to finding the vhyp class:

   12.01%  [.] g_str_hash
8.94%  [.] g_hash_table_lookup
8.06%  [.] object_class_dynamic_cast
6.21%  [.] address_space_ldq
4.94%  [.] __strcmp_avx2
4.28%  [.] tlb_set_page_full
4.08%  [.] address_space_translate_internal
3.17%  [.] object_class_dynamic_cast_assert
2.84%  [.] ppc_radix64_xlate

Keep a pointer to the class and avoid this lookup. This reduces the
execution time to 40 seconds.

Signed-off-by: Nicholas Piggin 
---
This feels a bit ugly, but the performance problem of looking up the
class in fast paths can't be ignored. Is there a "nicer" way to get the
same result?

Thanks,
Nick

 target/ppc/cpu.h   |  3 ++-
 target/ppc/mmu-book3s-v3.h |  4 +---
 hw/ppc/pegasos2.c  |  1 +
 target/ppc/cpu_init.c  |  9 +++--
 target/ppc/excp_helper.c   | 16 
 target/ppc/kvm.c   |  4 +---
 target/ppc/mmu-hash64.c| 16 
 target/ppc/mmu-radix64.c   |  4 +---
 8 files changed, 17 insertions(+), 40 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index ec14574d14..eb85d9aa71 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1437,6 +1437,7 @@ struct ArchCPU {
 int vcpu_id;
 uint32_t compat_pvr;
 PPCVirtualHypervisor *vhyp;
+PPCVirtualHypervisorClass *vhyp_class;
 void *machine_data;
 int32_t node_id; /* NUMA node this CPU belongs to */
 PPCHash64Options *hash64_opts;
@@ -1535,7 +1536,7 @@ DECLARE_OBJ_CHECKERS(PPCVirtualHypervisor, 
PPCVirtualHypervisorClass,
 
 static inline bool vhyp_cpu_in_nested(PowerPCCPU *cpu)
 {
-return PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp)->cpu_in_nested(cpu);
+return cpu->vhyp_class->cpu_in_nested(cpu);
 }
 #endif /* CONFIG_USER_ONLY */
 
diff --git a/target/ppc/mmu-book3s-v3.h b/target/ppc/mmu-book3s-v3.h
index 674377a19e..f3f7993958 100644
--- a/target/ppc/mmu-book3s-v3.h
+++ b/target/ppc/mmu-book3s-v3.h
@@ -108,9 +108,7 @@ static inline hwaddr ppc_hash64_hpt_mask(PowerPCCPU *cpu)
 uint64_t base;
 
 if (cpu->vhyp) {
-PPCVirtualHypervisorClass *vhc =
-PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
-return vhc->hpt_mask(cpu->vhyp);
+return cpu->vhyp_class->hpt_mask(cpu->vhyp);
 }
 if (cpu->env.mmu_model == POWERPC_MMU_3_00) {
 ppc_v3_pate_t pate;
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 04d6decb2b..c22e8b336d 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -400,6 +400,7 @@ static void pegasos2_machine_reset(MachineState *machine, 
ShutdownCause reason)
 machine->fdt = fdt;
 
 pm->cpu->vhyp = PPC_VIRTUAL_HYPERVISOR(machine);
+pm->cpu->vhyp_class = PPC_VIRTUAL_HYPERVISOR_GET_CLASS(pm->cpu->vhyp);
 }
 
 enum pegasos2_rtas_tokens {
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 9bccddb350..63d0094024 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -6631,6 +6631,7 @@ void cpu_ppc_set_vhyp(PowerPCCPU *cpu, 
PPCVirtualHypervisor *vhyp)
 CPUPPCState *env = >env;
 
 cpu->vhyp = vhyp;
+cpu->vhyp_class = PPC_VIRTUAL_HYPERVISOR_GET_CLASS(vhyp);
 
 /*
  * With a virtual hypervisor mode we never allow the CPU to go
@@ -7224,9 +7225,7 @@ static void ppc_cpu_exec_enter(CPUState *cs)
 PowerPCCPU *cpu = POWERPC_CPU(cs);
 
 if (cpu->vhyp) {
-PPCVirtualHypervisorClass *vhc =
-PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
-vhc->cpu_exec_enter(cpu->vhyp, cpu);
+cpu->vhyp_class->cpu_exec_enter(cpu->vhyp, cpu);
 }
 }
 
@@ -7235,9 +7234,7 @@ static void ppc_cpu_exec_exit(CPUState *cs)
 PowerPCCPU *cpu = POWERPC_CPU(cs);
 
 if (cpu->vhyp) {
-PPCVirtualHypervisorClass *vhc =
-PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
-vhc->cpu_exec_exit(cpu->vhyp, cpu);
+cpu->vhyp_class->cpu_exec_exit(cpu->vhyp, cpu);
 }
 }
 #endif /* CONFIG_TCG */
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 98952de267..445350488c 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -840,9 +840,7 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
  * HV mode, we need to keep hypercall support.
  */
 if (lev == 1 && cpu->vhyp) {
-PPCVirtualHypervisorClass *vhc =
-PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
-vhc->hypercall(cpu->vhyp, cpu);
+cpu->vhyp_class->hypercall(cpu->vhyp, cpu);
 powerpc_reset_excp_state(cpu);
 return;
 }
@@ -1012,9 +1010,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
  * HV 

Re: Support Android hypervisors

2024-02-23 Thread RR NN
{
  "emoji": "",
  "version": 1
}

[PULL v2 31/39] *-user: Deprecate and disable -p pagesize

2024-02-23 Thread Richard Henderson
This option controls the host page size.  From the mis-usage in
our own testsuite, this is easily confused with guest page size.

The only thing that occurs when changing the host page size is
that stuff breaks, because one cannot actually change the host
page size.  Therefore reject all but the no-op setting as part
of the deprecation process.

Reviewed-by: Warner Losh 
Signed-off-by: Richard Henderson 
Reviewed-by: Philippe Mathieu-Daudé 
Acked-by: Helge Deller 
Message-Id: <20240102015808.132373-27-richard.hender...@linaro.org>
---
 docs/about/deprecated.rst | 10 ++
 docs/user/main.rst|  3 ---
 bsd-user/main.c   | 11 ++-
 linux-user/main.c | 12 ++--
 4 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 5a2305ccd6..3074303b9c 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -63,6 +63,16 @@ as short-form boolean values, and passed to plugins as 
``arg_name=on``.
 However, short-form booleans are deprecated and full explicit ``arg_name=on``
 form is preferred.
 
+User-mode emulator command line arguments
+-
+
+``-p`` (since 9.0)
+''
+
+The ``-p`` option pretends to control the host page size.  However,
+it is not possible to change the host page size, and using the
+option only causes failures.
+
 QEMU Machine Protocol (QMP) commands
 
 
diff --git a/docs/user/main.rst b/docs/user/main.rst
index 7e7ad07409..d5fbb78d3c 100644
--- a/docs/user/main.rst
+++ b/docs/user/main.rst
@@ -87,9 +87,6 @@ Debug options:
Activate logging of the specified items (use '-d help' for a list of
log items)
 
-``-p pagesize``
-   Act as if the host page size was 'pagesize' bytes
-
 ``-g port``
Wait gdb connection to port
 
diff --git a/bsd-user/main.c b/bsd-user/main.c
index e5efb7b845..6ab3efd6c0 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -364,11 +364,12 @@ int main(int argc, char **argv)
 } else if (!strcmp(r, "L")) {
 interp_prefix = argv[optind++];
 } else if (!strcmp(r, "p")) {
-qemu_host_page_size = atoi(argv[optind++]);
-if (qemu_host_page_size == 0 ||
-(qemu_host_page_size & (qemu_host_page_size - 1)) != 0) {
-fprintf(stderr, "page size must be a power of two\n");
-exit(1);
+unsigned size, want = qemu_real_host_page_size();
+
+r = argv[optind++];
+if (qemu_strtoui(r, NULL, 10, ) || size != want) {
+warn_report("Deprecated page size option cannot "
+"change host page size (%u)", want);
 }
 } else if (!strcmp(r, "g")) {
 gdbstub = g_strdup(argv[optind++]);
diff --git a/linux-user/main.c b/linux-user/main.c
index e540acb84a..bad03f06d3 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -332,11 +332,11 @@ static void handle_arg_ld_prefix(const char *arg)
 
 static void handle_arg_pagesize(const char *arg)
 {
-qemu_host_page_size = atoi(arg);
-if (qemu_host_page_size == 0 ||
-(qemu_host_page_size & (qemu_host_page_size - 1)) != 0) {
-fprintf(stderr, "page size must be a power of two\n");
-exit(EXIT_FAILURE);
+unsigned size, want = qemu_real_host_page_size();
+
+if (qemu_strtoui(arg, NULL, 10, ) || size != want) {
+warn_report("Deprecated page size option cannot "
+"change host page size (%u)", want);
 }
 }
 
@@ -496,7 +496,7 @@ static const struct qemu_argument arg_table[] = {
 {"D",  "QEMU_LOG_FILENAME", true, handle_arg_log_filename,
  "logfile", "write logs to 'logfile' (default stderr)"},
 {"p",  "QEMU_PAGESIZE",true,  handle_arg_pagesize,
- "pagesize",   "set the host page size to 'pagesize'"},
+ "pagesize",   "deprecated change to host page size"},
 {"one-insn-per-tb",
"QEMU_ONE_INSN_PER_TB",  false, handle_arg_one_insn_per_tb,
  "",   "run with one guest instruction per emulated TB"},
-- 
2.34.1




[PULL v2 00/39] tcg and linux-user patch queue

2024-02-23 Thread Richard Henderson
v2: Fix bsd-user build errors.


r~


The following changes since commit 3d54cbf269d63ff1d500b35b2bcf4565ff8ad485:

  Merge tag 'hw-misc-20240222' of https://github.com/philmd/qemu into staging 
(2024-02-22 15:44:29 +)

are available in the Git repository at:

  https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20240222-2

for you to fetch changes up to fcc6ad372f56d3f47b6d5457a904916b48b9e114:

  linux-user: Remove pgb_dynamic alignment assertion (2024-02-23 15:07:03 -0800)


tcg/aarch64: Apple does not align __int128_t in even registers
accel/tcg: Fixes for page tables in mmio memory
linux-user: Remove qemu_host_page_{size,mask}, HOST_PAGE_ALIGN
migration: Remove qemu_host_page_size
hw/tpm: Remove qemu_host_page_size
softmmu: Remove qemu_host_page_{size,mask}, HOST_PAGE_ALIGN
linux-user: Split and reorganize target_mmap.
*-user: Deprecate and disable -p pagesize
linux-user: Allow TARGET_PAGE_BITS_VARY
target/alpha: Enable TARGET_PAGE_BITS_VARY for user-only
target/arm: Enable TARGET_PAGE_BITS_VARY for AArch64 user-only
target/ppc: Enable TARGET_PAGE_BITS_VARY for user-only
linux-user: Remove pgb_dynamic alignment assertion


Jonathan Cameron (1):
  tcg: Avoid double lock if page tables happen to be in mmio memory.

Peter Maydell (1):
  accel/tcg: Set can_do_io at at start of lookup_tb_ptr helper

Richard Henderson (37):
  tcg/aarch64: Apple does not align __int128_t in even registers
  accel/tcg: Remove qemu_host_page_size from page_protect/page_unprotect
  linux-user: Adjust SVr4 NULL page mapping
  linux-user: Remove qemu_host_page_{size, mask} in probe_guest_base
  linux-user: Remove qemu_host_page_size from create_elf_tables
  linux-user/hppa: Simplify init_guest_commpage
  linux-user/nios2: Remove qemu_host_page_size from init_guest_commpage
  linux-user/arm: Remove qemu_host_page_size from init_guest_commpage
  linux-user: Remove qemu_host_page_{size, mask} from mmap.c
  linux-user: Remove REAL_HOST_PAGE_ALIGN from mmap.c
  linux-user: Remove HOST_PAGE_ALIGN from mmap.c
  migration: Remove qemu_host_page_size
  hw/tpm: Remove HOST_PAGE_ALIGN from tpm_ppi_init
  softmmu/physmem: Remove qemu_host_page_size
  softmmu/physmem: Remove HOST_PAGE_ALIGN
  linux-user: Remove qemu_host_page_size from main
  linux-user: Split out target_mmap__locked
  linux-user: Move some mmap checks outside the lock
  linux-user: Fix sub-host-page mmap
  linux-user: Split out mmap_end
  linux-user: Do early mmap placement only for reserved_va
  linux-user: Split out do_munmap
  linux-user: Use do_munmap for target_mmap failure
  linux-user: Split out mmap_h_eq_g
  linux-user: Split out mmap_h_lt_g
  linux-user: Split out mmap_h_gt_g
  tests/tcg: Remove run-test-mmap-*
  tests/tcg: Extend file in linux-madvise.c
  *-user: Deprecate and disable -p pagesize
  cpu: Remove page_size_init
  accel/tcg: Disconnect TargetPageDataNode from page size
  linux-user: Allow TARGET_PAGE_BITS_VARY
  target/arm: Enable TARGET_PAGE_BITS_VARY for AArch64 user-only
  linux-user: Bound mmap_min_addr by host page size
  target/ppc: Enable TARGET_PAGE_BITS_VARY for user-only
  target/alpha: Enable TARGET_PAGE_BITS_VARY for user-only
  linux-user: Remove pgb_dynamic alignment assertion

 docs/about/deprecated.rst |  10 +
 docs/user/main.rst|   3 -
 bsd-user/qemu.h   |   7 +
 include/exec/cpu-common.h |   7 -
 include/hw/core/cpu.h |   2 -
 target/alpha/cpu-param.h  |  16 +-
 target/arm/cpu-param.h|   6 +-
 target/ppc/cpu-param.h|   9 +-
 tcg/aarch64/tcg-target.h  |   6 +-
 accel/tcg/cpu-exec.c  |   8 +
 accel/tcg/cputlb.c|  34 +-
 accel/tcg/translate-all.c |   1 -
 accel/tcg/user-exec.c |  31 +-
 bsd-user/main.c   |  23 +-
 cpu-target.c  |  16 -
 hw/tpm/tpm_ppi.c  |   6 +-
 linux-user/elfload.c  |  68 +--
 linux-user/main.c |  34 +-
 linux-user/mmap.c | 767 ++
 migration/ram.c   |  22 +-
 system/physmem.c  |  17 +-
 system/vl.c   |   1 -
 target/arm/cpu.c  |  51 +-
 tests/tcg/multiarch/linux/linux-madvise.c |   2 +
 tests/tcg/alpha/Makefile.target   |   3 -
 tests/tcg/arm/Makefile.target |   3 -
 tests/tcg/hppa/Makefile.target|   3 -
 tests/tcg/i386/Makefile.target|   3 -
 tests/tcg/m68k/Makefile.target  

[PULL v2 32/39] cpu: Remove page_size_init

2024-02-23 Thread Richard Henderson
Move qemu_host_page_{size,mask} and HOST_PAGE_ALIGN into bsd-user.
It should be removed from bsd-user as well, but defer that cleanup.

Reviewed-by: Warner Losh 
Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
Tested-by: Ilya Leoshkevich 
Acked-by: Helge Deller 
Message-Id: <20240102015808.132373-28-richard.hender...@linaro.org>
---
 bsd-user/qemu.h   |  7 +++
 include/exec/cpu-common.h |  7 ---
 include/hw/core/cpu.h |  2 --
 accel/tcg/translate-all.c |  1 -
 bsd-user/main.c   | 12 
 cpu-target.c  | 16 
 system/vl.c   |  1 -
 7 files changed, 19 insertions(+), 27 deletions(-)

diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index dc842fffa7..c05c512767 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -39,6 +39,13 @@ extern char **environ;
 #include "qemu/clang-tsa.h"
 
 #include "qemu-os.h"
+/*
+ * TODO: Remove these and rely only on qemu_real_host_page_size().
+ */
+extern uintptr_t qemu_host_page_size;
+extern intptr_t qemu_host_page_mask;
+#define HOST_PAGE_ALIGN(addr) ROUND_UP((addr), qemu_host_page_size)
+
 /*
  * This struct is used to hold certain information about the image.  Basically,
  * it replicates in user space what would be certain task_struct fields in the
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 9ead1be100..6346df17ce 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -20,13 +20,6 @@
 void cpu_exec_init_all(void);
 void cpu_exec_step_atomic(CPUState *cpu);
 
-/* Using intptr_t ensures that qemu_*_page_mask is sign-extended even
- * when intptr_t is 32-bit and we are aligning a long long.
- */
-extern uintptr_t qemu_host_page_size;
-extern intptr_t qemu_host_page_mask;
-
-#define HOST_PAGE_ALIGN(addr) ROUND_UP((addr), qemu_host_page_size)
 #define REAL_HOST_PAGE_ALIGN(addr) ROUND_UP((addr), qemu_real_host_page_size())
 
 /* The CPU list lock nests outside page_(un)lock or mmap_(un)lock */
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 4385ce54c9..5c2d55f6d2 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -1179,8 +1179,6 @@ bool target_words_bigendian(void);
 
 const char *target_name(void);
 
-void page_size_init(void);
-
 #ifdef NEED_CPU_H
 
 #ifndef CONFIG_USER_ONLY
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 1c695efe02..c1f57e894a 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -256,7 +256,6 @@ bool cpu_unwind_state_data(CPUState *cpu, uintptr_t 
host_pc, uint64_t *data)
 
 void page_init(void)
 {
-page_size_init();
 page_table_config_init();
 }
 
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 6ab3efd6c0..512d4ab69f 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -49,6 +49,13 @@
 #include "host-os.h"
 #include "target_arch_cpu.h"
 
+
+/*
+ * TODO: Remove these and rely only on qemu_real_host_page_size().
+ */
+uintptr_t qemu_host_page_size;
+intptr_t qemu_host_page_mask;
+
 static bool opt_one_insn_per_tb;
 uintptr_t guest_base;
 bool have_guest_base;
@@ -307,6 +314,9 @@ int main(int argc, char **argv)
 (void) envlist_setenv(envlist, *wrk);
 }
 
+qemu_host_page_size = getpagesize();
+qemu_host_page_size = MAX(qemu_host_page_size, TARGET_PAGE_SIZE);
+
 cpu_model = NULL;
 
 qemu_add_opts(_trace_opts);
@@ -404,6 +414,8 @@ int main(int argc, char **argv)
 }
 }
 
+qemu_host_page_mask = -qemu_host_page_size;
+
 /* init debug */
 {
 int mask = 0;
diff --git a/cpu-target.c b/cpu-target.c
index 86444cc2c6..4c0621bf33 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -45,9 +45,6 @@
 #include "trace/trace-root.h"
 #include "qemu/accel.h"
 
-uintptr_t qemu_host_page_size;
-intptr_t qemu_host_page_mask;
-
 #ifndef CONFIG_USER_ONLY
 static int cpu_common_post_load(void *opaque, int version_id)
 {
@@ -474,16 +471,3 @@ const char *target_name(void)
 {
 return TARGET_NAME;
 }
-
-void page_size_init(void)
-{
-/* NOTE: we can always suppose that qemu_host_page_size >=
-   TARGET_PAGE_SIZE */
-if (qemu_host_page_size == 0) {
-qemu_host_page_size = qemu_real_host_page_size();
-}
-if (qemu_host_page_size < TARGET_PAGE_SIZE) {
-qemu_host_page_size = TARGET_PAGE_SIZE;
-}
-qemu_host_page_mask = -(intptr_t)qemu_host_page_size;
-}
diff --git a/system/vl.c b/system/vl.c
index b8469d9965..7913cc28aa 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -2118,7 +2118,6 @@ static void qemu_create_machine(QDict *qdict)
 }
 
 cpu_exec_init_all();
-page_size_init();
 
 if (machine_class->hw_version) {
 qemu_set_hw_version(machine_class->hw_version);
-- 
2.34.1




[PATCH] virtio-gpu: Fix HW cursor visibility

2024-02-23 Thread Satyeshwar Singh
When show-cursor is on, most of the time Windows VM draws the cursor by
itself and hands it over to Qemu as a separate resource. However,
sometimes, Windows OS gives control of the cursor to applications like
Notepad. In such cases a software cursor which is part of the overall
framebuffer is drawn by the application. Windows intimates the indirect
display driver (IDD) about this change through a flag and IDD is in turn
responsible for communicating with the hypervisor (Qemu) to hide the HW
cursor. This show/hide cursor can happen any time dynamically.

Unfortunately, it seems like Qemu doesn't expect this change to happen
dynamically. The code in virtio-gpu.c was written such that
update_cursor would first call dpy_cursor_define if the cursor shape has
changed and this is not a simple move operation (which indeed is the
case when moving to a SW cursor) and then call dpy_mouse_set.
dpy_cursor_define calls toolkits like GTK but in addition to creating
the cursor content, it also calls gdk_window_set_cursor thereby setting
the cursor. It is therefore, the right function to either show or hide
the cursor but there was no code present to hide the cursor. Changing
the cursor visibility in dpy_mouse_set has two issues. First,
dpy_cursor_define already decided to display the cursor so showing the
cursor in the previous call only to hide it in dpy_mouse_set doesn't
sound right. Second, dpy_mouse_set skips the rest of the code if we
are in absolute mode so adding this code there wouldn't work in that
mode.

Qemu makes the decision of whether to show or hide the cursor by
observing the cursor->resource_id flag in virtio-gpu.c as is evident
from the lines
dpy_mouse_set(s->con, cursor->pos.x, cursor->pos.y,
  cursor->resource_id ? 1 : 0);
The last parameter is considered the "visible" parameter in gdk code.
Therefore, in this patch we continue with the same model. Instead of
changing the function prototype and changing a dozen plus files, we are
adding the visible field in QEMUCursor data structure and passing
it from virtio-gpu to the GTK code where we check if the cursor is
visible or not. If not, we simply call gdk_window_set_cursor with NULL
parameter, thereby hiding the cursor. Once Windows VM switches back to
the HW cursor, then IDD would again provide a new resource_id to Qemu
and we can start displaying it once more.

Signed-off-by: Satyeshwar Singh 
Cc: Marc-André Lureau 
Cc: Vivek Kasireddy 
Cc: Dongwon Kim 
---
 hw/display/virtio-gpu.c | 1 +
 include/ui/console.h| 1 +
 ui/gtk.c| 5 +
 3 files changed, 7 insertions(+)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 1c1ee230b3..1ae9be605b 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -98,6 +98,7 @@ static void update_cursor(VirtIOGPU *g, struct 
virtio_gpu_update_cursor *cursor)
 
 s->current_cursor->hot_x = cursor->hot_x;
 s->current_cursor->hot_y = cursor->hot_y;
+s->current_cursor->visible = cursor->resource_id ? 1 : 0;
 
 if (cursor->resource_id > 0) {
 vgc->update_cursor_data(g, s, cursor->resource_id);
diff --git a/include/ui/console.h b/include/ui/console.h
index a4a49ffc64..47c39ed405 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -161,6 +161,7 @@ typedef struct QEMUCursor {
 uint16_twidth, height;
 int hot_x, hot_y;
 int refcount;
+int visible;
 uint32_tdata[];
 } QEMUCursor;
 
diff --git a/ui/gtk.c b/ui/gtk.c
index 810d7fc796..12a76de570 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -478,6 +478,11 @@ static void gd_cursor_define(DisplayChangeListener *dcl,
 return;
 }
 
+if(!c->visible) {
+gdk_window_set_cursor(gtk_widget_get_window(vc->gfx.drawing_area), 
NULL);
+return;
+}
+
 pixbuf = gdk_pixbuf_new_from_data((guchar *)(c->data),
   GDK_COLORSPACE_RGB, true, 8,
   c->width, c->height, c->width * 4,
-- 
2.33.1




[PATCH 1/1] virtio-gpu: Fix HW cursor visibility

2024-02-23 Thread Singh, Satyeshwar
When show-cursor is on, most of the time Windows VM draws the cursor by
itself and hands it over to Qemu as a separate resource. However,
sometimes, Windows OS gives control of the cursor to applications like
Notepad. In such cases a software cursor which is part of the overall
framebuffer is drawn by the application. Windows intimates the indirect
display driver (IDD) about this change through a flag and IDD is in turn
responsible for communicating with the hypervisor (Qemu) to hide the HW
cursor. This show/hide cursor can happen any time dynamically.

Unfortunately, it seems like Qemu doesn't expect this change to happen
dynamically. The code in virtio-gpu.c was written such that
update_cursor would first call dpy_cursor_define if the cursor shape has
changed and this is not a simple move operation (which indeed is the
case when moving to a SW cursor) and then call dpy_mouse_set.
dpy_cursor_define calls toolkits like GTK but in addition to creating
the cursor content, it also calls gdk_window_set_cursor thereby setting
the cursor. It is therefore, the right function to either show or hide
the cursor but there was no code present to hide the cursor. Changing
the cursor visibility in dpy_mouse_set has two issues. First,
dpy_cursor_define already decided to display the cursor so showing the
cursor in the previous call only to hide it in dpy_mouse_set doesn't
sound right. Second, dpy_mouse_set skips the rest of the code if we
are in absolute mode so adding this code there wouldn't work in that
mode.

Qemu makes the decision of whether to show or hide the cursor by
observing the cursor->resource_id flag in virtio-gpu.c as is evident
from the lines
dpy_mouse_set(s->con, cursor->pos.x, cursor->pos.y,
  cursor->resource_id ? 1 : 0);
The last parameter is considered the "visible" parameter in gdk code.
Therefore, in this patch we continue with the same model. Instead of
changing the function prototype and changing a dozen plus files, we are
adding the visible field in QEMUCursor data structure and passing
it from virtio-gpu to the GTK code where we check if the cursor is
visible or not. If not, we simply call gdk_window_set_cursor with NULL
parameter, thereby hiding the cursor. Once Windows VM switches back to
the HW cursor, then IDD would again provide a new resource_id to Qemu
and we can start displaying it once more.

Signed-off-by: Satyeshwar Singh 
mailto:satyeshwar.si...@intel.com>>
Cc: Marc-André Lureau 
mailto:marcandre.lur...@redhat.com>>
Cc: Vivek Kasireddy 
mailto:vivek.kasire...@intel.com>>
Cc: Dongwon Kim mailto:dongwon@intel.com>>

---
hw/display/virtio-gpu.c | 1 +
include/ui/console.h| 1 +
ui/gtk.c| 5 +
3 files changed, 7 insertions(+)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 1c1ee230b3..1ae9be605b 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -98,6 +98,7 @@ static void update_cursor(VirtIOGPU *g, struct 
virtio_gpu_update_cursor *cursor)
 s->current_cursor->hot_x = cursor->hot_x;
 s->current_cursor->hot_y = cursor->hot_y;
+s->current_cursor->visible = cursor->resource_id ? 1 : 0;
 if (cursor->resource_id > 0) {
 vgc->update_cursor_data(g, s, cursor->resource_id);
diff --git a/include/ui/console.h b/include/ui/console.h
index a4a49ffc64..47c39ed405 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -161,6 +161,7 @@ typedef struct QEMUCursor {
 uint16_twidth, height;
 int hot_x, hot_y;
 int refcount;
+int visible;
 uint32_tdata[];
} QEMUCursor;
diff --git a/ui/gtk.c b/ui/gtk.c
index 810d7fc796..12a76de570 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -478,6 +478,11 @@ static void gd_cursor_define(DisplayChangeListener *dcl,
 return;
 }
+if(!c->visible) {
+gdk_window_set_cursor(gtk_widget_get_window(vc->gfx.drawing_area), 
NULL);
+return;
+}
+
 pixbuf = gdk_pixbuf_new_from_data((guchar *)(c->data),
   GDK_COLORSPACE_RGB, true, 8,
   c->width, c->height, c->width * 4,
--
2.33.1



Re: [PULL 00/39] tcg and linux-user patch queue

2024-02-23 Thread Richard Henderson

On 2/23/24 03:45, Peter Maydell wrote:

bsd-user fails to compile:
https://gitlab.com/qemu-project/qemu/-/jobs/6241616724

../bsd-user/main.c:379:30: error: use of undeclared identifier 'arg';
did you mean 'argv'?
if (qemu_strtoui(arg, NULL, 10, ) || size != want) {
  ^~~


Grr.  I think it is An Error that make vm-build-freebsd does not test this.
Alex?


r~




Re: [RFC PATCH v3 21/21] hw/arm/virt: Add FEAT_GICv3_NMI feature support in virt GIC

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

A PE that implements FEAT_NMI and FEAT_GICv3 also implements
FEAT_GICv3_NMI. A PE that does not implement FEAT_NMI, does not implement
FEAT_GICv3_NMI

So included support FEAT_GICv3_NMI feature as part of virt platform
GIC initialization if FEAT_NMI and FEAT_GICv3 supported.

Signed-off-by: Jinjie Ruan
---


Reviewed-by: Richard Henderson 

r~



Re: [RFC PATCH v3 19/21] hw/intc/arm_gicv3: Report the NMI interrupt in gicv3_cpuif_update()

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

In CPU Interface, if the IRQ has the superpriority property, report
NMI to the corresponding PE.

Signed-off-by: Jinjie Ruan 
---
v3:
- Remove handling nmi_is_irq flag.
---
  hw/intc/arm_gicv3_cpuif.c | 6 +-
  1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index f5bf8df32b..3ffeb9543b 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -931,6 +931,7 @@ void gicv3_cpuif_update(GICv3CPUState *cs)
  /* Tell the CPU about its highest priority pending interrupt */
  int irqlevel = 0;
  int fiqlevel = 0;
+int nmilevel = 0;
  ARMCPU *cpu = ARM_CPU(cs->cpu);
  CPUARMState *env = >env;
  
@@ -967,7 +968,9 @@ void gicv3_cpuif_update(GICv3CPUState *cs)

  g_assert_not_reached();
  }
  
-if (isfiq) {

+if (cs->hppi.superprio) {
+nmilevel = 1;
+} else if (isfiq) {
  fiqlevel = 1;
  } else {
  irqlevel = 1;


NMI only applies to group 1, per Table 4-6.  Because group 0 always produces fiq, I think 
you need to swap the ordering of the IFs.



r~



Re: [PATCH 3/3] linux-user: Rewrite target_shmat

2024-02-23 Thread Richard Henderson

On 2/23/24 01:35, Ilya Leoshkevich wrote:

On Thu, Feb 22, 2024 at 05:03:09PM -1000, Richard Henderson wrote:

Handle combined host and guest alignment requirements.
Handle host and guest page size differences.
Handle SHM_EXEC.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/115
Signed-off-by: Richard Henderson 
---
  linux-user/mmap.c | 146 ++
  1 file changed, 110 insertions(+), 36 deletions(-)


[...]


-/* find out the length of the shared memory segment */
+/*
+ * Because we can't use host shmat() unless the address is sufficiently
+ * aligned for the host, we'll need to check both.
+ * TODO: Could be fixed with softmmu.
+ */


Are there any plans to introduce softmmu to qemu-user?


Long-term ones, yes.  There are *so* many places for which emulation doesn't quite work 
unless the host and guest page size match.  There are projects like asan which don't work 
unless the guest has a *very* specific memory layout, which often conflicts with the host.




r~



Re: [RFC PATCH v3 00/21] target/arm: Implement FEAT_NMI and FEAT_GICv3_NMI

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

This patch set implements FEAT_NMI and FEAT_GICv3_NMI for armv8. These
introduce support for a new category of interrupts in the architecture
which we can use to provide NMI like functionality.

There are two modes for using this FEAT_NMI. When PSTATE.ALLINT or
PSTATE.SP & SCTLR_ELx.SCTLR_SPINTMASK is set, any entry to ELx causes all
interrupts including those with superpriority to be masked on entry to ELn
until the mask is explicitly removed by software or hardware. PSTATE.ALLINT
can be managed by software using the new register control ALLINT.ALLINT.
Independent controls are provided for this feature at each EL, usage at EL1
should not disrupt EL2 or EL3.

I have tested it with the following linux patches which try to support
FEAT_NMI in linux kernel:


https://lore.kernel.org/linux-arm-kernel/Y4sH5qX5bK9xfEBp@lpieralisi/T/#mb4ba4a2c045bf72c10c2202c1dd1b82d3240dc88

In the test, SGI, PPI and SPI interrupts can all be set to have super priority
to be converted to a hardware NMI interrupt. The SGI is tested with kernel
IPI as NMI framework, and the PPI interrupt is tested with "perf top" command
with hardware NMI enabled, and the PPI interrupt is tested with a custom
test module, in which NMI interrupts can be received and transmitted normally.

  +-+
  |   Distributor   |
  +-+
  SPI |  NMI |  NMI
 \ /\ /
 ++ +---+
 | Redist | | Redist|
 ++ +---+
 SGI  | NMI PPI | NMI
 \ /   \ /
   +-+ +---+
   |CPU Interface|   ...   | CPU Interface |
   +-+ +---+
| NMI | NMI
   \ /   \ /
 +-+   +-+
 |  PE |   |  PE |
 +-+   +-+

Changes in v3:
- Remove the FIQ NMI.
- Adjust the patches Sequence.
- Reomve the patch "Set pstate.ALLINT in arm_cpu_reset_hold".
- Check whether support FEAT_NMI and FEAT_GICv3 for FEAT_GICv3_NMI.
- With CPU_INTERRUPT_NMI, both CPSR_I and ISR_IS must be set.
- Not include NMI logic when FEAT_NMI or SCTLR_ELx.NMI not enabled.
- Refator nmi mask in arm_excp_unmasked().
- Add VNMI definitions, add HCRX_VINMI and HCRX_VFNMI support in HCRX_EL2.
- Add Reviewed-by and Acked-by.
- Update the commit message.

Changes in v2:
- Break up the patches so that each one does only one thing.
- Remove the command line option and just implement it in "max" cpu.


Still missing all handling of virtual NMI, both within the CPU and the GIC.
This is not an optional portion of the spec.


r~




Re: [RFC PATCH v3 18/21] hw/intc/arm_gicv3: Implement NMI interrupt prioirty

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

If GICD_CTLR_DS bit is zero and the NMI is non-secure, the NMI prioirty
is higher than 0x80, otherwise it is higher than 0x0. And save NMI
super prioirty information in hppi.superprio to deliver NMI exception.
Since both GICR and GICD can deliver NMI, it is both necessary to check
whether the pending irq is NMI in gicv3_redist_update_noirqset and
gicv3_update_noirqset. And In irqbetter(), only a non-NMI with the same
priority and a smaller interrupt number can be preempted but not NMI.

Signed-off-by: Jinjie Ruan 
---
v3:
- Add missing brace
---
  hw/intc/arm_gicv3.c | 63 -
  1 file changed, 56 insertions(+), 7 deletions(-)

diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index 0b8f79a122..75999edd19 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -21,7 +21,7 @@
  #include "hw/intc/arm_gicv3.h"
  #include "gicv3_internal.h"
  
-static bool irqbetter(GICv3CPUState *cs, int irq, uint8_t prio)

+static bool irqbetter(GICv3CPUState *cs, int irq, uint8_t prio, bool is_nmi)
  {
  /* Return true if this IRQ at this priority should take
   * precedence over the current recorded highest priority
@@ -33,11 +33,21 @@ static bool irqbetter(GICv3CPUState *cs, int irq, uint8_t 
prio)
  if (prio < cs->hppi.prio) {
  return true;
  }
+
+/*
+ * Current highest prioirity pending interrupt is not a NMI
+ * and the new IRQ is a NMI with same priority.
+ */
+if (prio == cs->hppi.prio && !cs->hppi.superprio && is_nmi) {


It would be best to not mix terminology -- superpriority or nmi but not a mix.  It's 
unfortunate that the manual does so...


It is very tempting expand prio to more bits so that all of the rest of this 
Just Works.
Because of...


+if (superprio) {
+is_nmi = 1;
+
+/* DS = 0 & Non-secure NMI */
+if ((!(cs->gic->gicd_ctlr & GICD_CTLR_DS)) &&
+extract32(cs->gicr_igroupr0, i, 1)) {
+prio = 0x80;
+} else {
+prio = 0x0;
+}
+} else {
+   is_nmi = 0;
+   prio = cs->gicr_ipriorityr[i];


... the need to check GICD_CTLR_DS for interpreting superpriority within the continuum, 
per section 4.8.1 (NMI prioritization), it would seem that we could map


Secure NMI -> 0
Non-secure NMI -> 0x100
prio 0x00 .. 0xff  -> prio * 2 + 1

which matches the ordering in Figure 4-6.


@@ -240,10 +271,28 @@ static void gicv3_update_noirqset(GICv3State *s, int 
start, int len)
   */
  continue;
  }
-prio = s->gicd_ipriority[i];
-if (irqbetter(cs, i, prio)) {
+
+superprio = *gic_bmp_ptr32(s->superprio, i);
+/* NMI */
+if (superprio & (1 << (i & 0x1f))) {
+is_nmi = 1;
+
+/* DS = 0 & Non-secure NMI */
+if ((!(s->gicd_ctlr & GICD_CTLR_DS)) &&
+gicv3_gicd_group_test(s, i)) {
+prio = 0x80;
+} else {
+prio = 0x0;
+}
+} else {
+is_nmi = 0;
+prio = s->gicd_ipriority[i];
+}


In any case, let's not have two copies of this resolution.


r~



Re: [RFC PATCH v3 17/21] hw/intc/arm_gicv3: Add NMI handling CPU interface registers

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

Add the NMIAR CPU interface registers which deal with acknowledging NMI.

When introduce NMI interrupt, there are some updates to the semantics for the
register ICC_IAR1_EL1 and ICC_HPPIR1_EL1. For ICC_IAR1_EL1 register, it
should return 1022 if the intid has super priority. And for ICC_NMIAR1_EL1
register, it should return 1023 if the intid do not have super priority.
Howerever, these are not necessary for ICC_HPPIR1_EL1 register.

Signed-off-by: Jinjie Ruan 
---
  hw/intc/arm_gicv3_cpuif.c | 46 ---
  hw/intc/gicv3_internal.h  |  1 +
  2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index e1a60d8c15..f5bf8df32b 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -1097,7 +1097,8 @@ static uint64_t icc_hppir0_value(GICv3CPUState *cs, 
CPUARMState *env)
  return cs->hppi.irq;
  }
  
-static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)

+static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env,
+ bool is_nmi, bool is_hppi)
  {
  /* Return the highest priority pending interrupt register value
   * for group 1.
@@ -1108,6 +1109,16 @@ static uint64_t icc_hppir1_value(GICv3CPUState *cs, 
CPUARMState *env)
  return INTID_SPURIOUS;
  }
  
+if (!is_hppi) {

+if (is_nmi && (!cs->hppi.superprio)) {
+return INTID_SPURIOUS;
+}
+
+if ((!is_nmi) && cs->hppi.superprio) {
+return INTID_NMI;
+}
+}
+
  /* Check whether we can return the interrupt or if we should return
   * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
   * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
@@ -1168,7 +1179,30 @@ static uint64_t icc_iar1_read(CPUARMState *env, const 
ARMCPRegInfo *ri)
  if (!icc_hppi_can_preempt(cs)) {
  intid = INTID_SPURIOUS;
  } else {
-intid = icc_hppir1_value(cs, env);
+intid = icc_hppir1_value(cs, env, false, false);
+}
+
+if (!gicv3_intid_is_special(intid)) {
+icc_activate_irq(cs, intid);
+}
+
+trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
+return intid;
+}


This is incorrect.  For icc_iar1_read, you need something like

if (!is_hppi
&& cs->hppi.superprio
&& env->cp15.sctlr_el[current_el] & SCTLR_NMI) {
return INTID_NMI;
}

I think that if SCTLR_NMI is not set, the whole system ignores Superpriority entirely, so 
returning SPURIOUS here would be incorrect.  This would make sense, letting an OS that is 
not configured for FEAT_NMI to run on ARMv8.8 hardware without modification.




+
+static uint64_t icc_nmiar1_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+GICv3CPUState *cs = icc_cs_from_env(env);
+uint64_t intid;
+
+if (icv_access(env, HCR_IMO)) {
+return icv_iar_read(env, ri);
+}
+
+if (!icc_hppi_can_preempt(cs)) {
+intid = INTID_SPURIOUS;
+} else {
+intid = icc_hppir1_value(cs, env, true, false);


Here... believe that the result *should* only consider superpriority.  I guess SPURIOUS is 
the correct result when there is no pending interrupt with superpriority?  It's really 
unclear to me from the register description.


Peter?


@@ -2344,6 +2378,12 @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
.access = PL1_R, .accessfn = gicv3_irq_access,
.readfn = icc_iar1_read,
  },
+{ .name = "ICC_NMIAR1_EL1", .state = ARM_CP_STATE_BOTH,
+  .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 5,
+  .type = ARM_CP_IO | ARM_CP_NO_RAW,
+  .access = PL1_R, .accessfn = gicv3_irq_access,
+  .readfn = icc_nmiar1_read,
+},


This register is UNDEFINED if FEAT_GICv3_NMI is not implemented.
You need to register this separately.


r~



Re: [RFC PATCH v3 11/21] hw/intc/arm_gicv3: Add external IRQ lines for NMI

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

Augment the GICv3's QOM device interface by adding one
new set of sysbus IRQ line, to signal NMI to each CPU.

Signed-off-by: Jinjie Ruan
---
v3:
- Add support for VNMI.
---
  hw/intc/arm_gicv3_common.c | 6 ++
  include/hw/intc/arm_gic_common.h   | 2 ++
  include/hw/intc/arm_gicv3_common.h | 2 ++
  3 files changed, 10 insertions(+)


Reviewed-by: Richard Henderson 


r~



Re: [PATCH v2 1/3] qtest: migration: Enhance qtest migration functions to support 'channels' argument

2024-02-23 Thread Fabiano Rosas
Het Gala  writes:

> Introduce support for adding a 'channels' argument to migrate_qmp_fail,
> migrate_incoming_qmp and migrate_qmp functions within the migration qtest
> framework, enabling enhanced control over migration scenarios.

Can't we just pass a channels string like you did in the original series
with migrate_postcopy_prepare?

We'd change migrate_* functions like this:

  void migrate_qmp(QTestState *who, const char *uri, const char *channels,
   const char *fmt, ...)
  {
  ...
  g_assert(!qdict_haskey(args, "uri"));
  if (uri) {
  qdict_put_str(args, "uri", uri);
  }
  
  g_assert(!qdict_haskey(args, "channels"));
  if (channels) {
  qdict_put_str(args, "channels", channels);
  }
  }

Write the test like this:

  static void test_multifd_tcp_none_channels(void)
  {
  MigrateCommon args = {
  .listen_uri = "defer",
  .start_hook = test_migrate_precopy_tcp_multifd_start,
  .live = true,
  .connect_channels = "'channels': [ { 'channel-type': 'main',"
  "  'addr': { 'transport': 'socket',"
  "'type': 'inet',"
  "'host': '127.0.0.1',"
  "'port': '0' } } ]",
  .connect_uri = NULL;
   
  };
  test_precopy_common();
  }

  static void do_test_validate_uri_channel(MigrateCommon *args)
  {
  QTestState *from, *to;
  g_autofree char *connect_uri = NULL;
  
  if (test_migrate_start(, , args->listen_uri, >start)) {
  return;
  }
  
  wait_for_serial("src_serial");
  
  if (args->result == MIG_TEST_QMP_ERROR) {
  migrate_qmp_fail(from, args->connect_uri, args->connect_channels, 
"{}");
  } else {
  migrate_qmp(from, args->connect_uri, args->connect_channels, "{}");
  }
  
  test_migrate_end(from, to, false);
  }

It's better to require test writers to pass in their own uri and channel
strings. Otherwise any new transport added will require people to modify
these conversion helpers.

Also, using the same string as the user would use in QMP helps with
development in general. One could refer to the tests to see how to
invoke the migration or experiment with the string in the tests during
development.



Re: [RFC PATCH v3 12/21] target/arm: Handle NMI in arm_cpu_do_interrupt_aarch64()

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

According to Arm GIC section 4.6.3 Interrupt superpriority, the interrupt
with superpriority is always IRQ, never FIQ, so the NMI exception trap entry
behave like IRQ.

Signed-off-by: Jinjie Ruan 
---
v3:
- Remove the FIQ NMI handle.
---
  target/arm/helper.c | 1 +
  1 file changed, 1 insertion(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0a69638651..1a5e992d26 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -11452,6 +11452,7 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
  break;
  case EXCP_IRQ:
  case EXCP_VIRQ:
+case EXCP_NMI:
  addr += 0x80;
  break;
  case EXCP_FIQ:


Handle EXCP_VNMI.


r~



Re: [RFC PATCH v3 16/21] hw/intc: Enable FEAT_GICv3_NMI Feature

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

Added properties to enable FEAT_GICv3_NMI feature, setup distributor
and redistributor registers to indicate NMI support.

Signed-off-by: Jinjie Ruan
---
  hw/intc/arm_gicv3_common.c | 1 +
  hw/intc/arm_gicv3_dist.c   | 2 ++
  hw/intc/gicv3_internal.h   | 1 +
  include/hw/intc/arm_gicv3_common.h | 1 +
  4 files changed, 5 insertions(+)


Reviewed-by: Richard Henderson 

r~



Re: [RFC PATCH v3 10/21] hw/arm/virt: Wire NMI and VNMI irq lines from GIC to CPU

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

Wire the new NMI and VNMI interrupt line from the GIC to each CPU.

Signed-off-by: Jinjie Ruan
---
v3:
- Also add VNMI wire.
---
  hw/arm/virt.c | 7 ++-
  1 file changed, 6 insertions(+), 1 deletion(-)


Reviewed-by: Richard Henderson 

r~



Re: [RFC PATCH v3 08/21] target/arm: Handle IS/FS in ISR_EL1 for NMI

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

Add IS and FS bit in ISR_EL1 and handle the read. With CPU_INTERRUPT_NMI, both
CPSR_I and ISR_IS must be set.

Signed-off-by: Jinjie Ruan 
--
v3:
- CPU_INTERRUPT_NMI do not set FIQ, so remove it.
- With CPU_INTERRUPT_NMI, both CPSR_I and ISR_IS must be set.
---
  target/arm/cpu.h| 2 ++
  target/arm/helper.c | 5 +
  2 files changed, 7 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index b23be7fc24..ae9a75d717 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1476,6 +1476,8 @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
  #define CPSR_N (1U << 31)
  #define CPSR_NZCV (CPSR_N | CPSR_Z | CPSR_C | CPSR_V)
  #define CPSR_AIF (CPSR_A | CPSR_I | CPSR_F)
+#define ISR_FS (1U << 9)
+#define ISR_IS (1U << 10)
  
  #define CPSR_IT (CPSR_IT_0_1 | CPSR_IT_2_7)

  #define CACHED_CPSR_BITS (CPSR_T | CPSR_AIF | CPSR_GE | CPSR_IT | CPSR_Q \
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2f54413b01..eb97ce0356 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -2022,6 +2022,11 @@ static uint64_t isr_read(CPUARMState *env, const 
ARMCPRegInfo *ri)
  if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
  ret |= CPSR_I;
  }
+
+if (cs->interrupt_request & CPU_INTERRUPT_NMI) {
+ret |= ISR_IS;
+ret |= CPSR_I;
+}
  }


Need to handle CPU_INTERRUPT_VNMI (which can be raised from the GIC).

Need to handle HCRX_EL2.VFNMI with CPU_INTERRUPT_VFIQ (which cannot be raised from the 
GIC, so we can determine VFIQ superpriority based solely on the cpu state).



r~



Re: [RFC PATCH v3 14/21] hw/intc/arm_gicv3_redist: Implement GICR_INMIR0

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

Add GICR_INMIR0 register and support access GICR_INMIR0.

Signed-off-by: Jinjie Ruan 
---
  hw/intc/arm_gicv3_redist.c | 23 +++
  hw/intc/gicv3_internal.h   |  1 +
  2 files changed, 24 insertions(+)

diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index 8153525849..87e7823f34 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -35,6 +35,15 @@ static int gicr_ns_access(GICv3CPUState *cs, int irq)
  return extract32(cs->gicr_nsacr, irq * 2, 2);
  }
  
+static void gicr_write_bitmap_reg(GICv3CPUState *cs, MemTxAttrs attrs,

+  uint32_t *reg, uint32_t val)
+{
+/* Helper routine to implement writing to a "set" register */
+val &= mask_group(cs, attrs);
+*reg = val;
+gicv3_redist_update(cs);
+}
+
  static void gicr_write_set_bitmap_reg(GICv3CPUState *cs, MemTxAttrs attrs,
uint32_t *reg, uint32_t val)
  {
@@ -406,6 +415,13 @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr 
offset,
  *data = value;
  return MEMTX_OK;
  }
+case GICR_INMIR0:
+if (!cs->gic->nmi_support) {
+*data = 0;
+return MEMTX_OK;
+}
+*data = gicr_read_bitmap_reg(cs, attrs, cs->gicr_isuperprio);
+return MEMTX_OK;


Clearer as

*data = (cs->gic->nmi_support
 ? gicr_read_bitmap_reg(cs, attrs, cs->gicr_isuperprio)
 : 0);
return MEMTX_OK;


+case GICR_INMIR0:
+if (!cs->gic->nmi_support) {
+return MEMTX_OK;
+}
+gicr_write_bitmap_reg(cs, attrs, >gicr_isuperprio, value);
+return MEMTX_OK;


Likewise,

if (cs->gic->nmi_support) {
gicr_write_bitmap_reg(cs, attrs, >gicr_isuperprio, value);
}
return MEMTX_OK;


r~



Re: [PATCH 05/10] hppa: do not require CONFIG_USB

2024-02-23 Thread Thomas Huth

On 23/02/2024 13.44, Paolo Bonzini wrote:

With --without-default-devices it is possible to build a binary that
does not include any USB host controller and therefore that does not
include the code guarded by CONFIG_USB.  While the simpler creation
functions such as usb_create_simple can be inlined, this is not true
of usb_bus_find().  Remove it, replacing it with a search of the single
USB bus on the machine.

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Paolo Bonzini 
---
  hw/hppa/machine.c | 7 ---
  hw/hppa/Kconfig   | 2 +-
  2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 5fcaf5884be..11982d5776c 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -396,10 +396,11 @@ static void machine_HP_common_init_tail(MachineState 
*machine, PCIBus *pci_bus,
  }
  
  /* create USB OHCI controller for USB keyboard & mouse on Astro machines */

-if (!lasi_dev && machine->enable_graphics) {
+if (!lasi_dev && machine->enable_graphics && defaults_enabled()) {


Do we need the defaults_enabled() here? Isn't enable_graphics already 
disabled if defaults_enabled() is not set?


 Thomas



  pci_create_simple(pci_bus, -1, "pci-ohci");
-usb_create_simple(usb_bus_find(-1), "usb-kbd");
-usb_create_simple(usb_bus_find(-1), "usb-mouse");
+Object *usb_bus = object_resolve_type_unambiguous(TYPE_USB_BUS, 
_abort);
+usb_create_simple(USB_BUS(usb_bus), "usb-kbd");
+usb_create_simple(USB_BUS(usb_bus), "usb-mouse");
  }






Re: [RFC PATCH v3 07/21] target/arm: Add support for NMI in arm_phys_excp_target_el()

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

According to Arm GIC section 4.6.3 Interrupt superpriority, the interrupt
with superpriority is always IRQ, never FIQ, so handle NMI same as IRQ in
arm_phys_excp_target_el().

Signed-off-by: Jinjie Ruan
---
v3:
- Remove nmi_is_irq flag in CPUARMState.
- Handle NMI same as IRQ in arm_phys_excp_target_el()
---
  target/arm/helper.c | 1 +
  1 file changed, 1 insertion(+)


Reviewed-by: Richard Henderson 

r~



Re: [RFC PATCH v3 06/21] target/arm: Add support for Non-maskable Interrupt

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

This only implements the external delivery method via the GICv3.

Signed-off-by: Jinjie Ruan 
---
v3:
- Not include CPU_INTERRUPT_NMI when FEAT_NMI not enabled
- Add ARM_CPU_VNMI.
- Refator nmi mask in arm_excp_unmasked().
- Test SCTLR_ELx.NMI for ALLINT mask for NMI.
---
  target/arm/cpu-qom.h |  4 +++-
  target/arm/cpu.c | 54 
  target/arm/cpu.h |  4 
  target/arm/helper.c  |  2 ++
  4 files changed, 54 insertions(+), 10 deletions(-)

diff --git a/target/arm/cpu-qom.h b/target/arm/cpu-qom.h
index 8e032691db..e0c9e18036 100644
--- a/target/arm/cpu-qom.h
+++ b/target/arm/cpu-qom.h
@@ -36,11 +36,13 @@ DECLARE_CLASS_CHECKERS(AArch64CPUClass, AARCH64_CPU,
  #define ARM_CPU_TYPE_SUFFIX "-" TYPE_ARM_CPU
  #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
  
-/* Meanings of the ARMCPU object's four inbound GPIO lines */

+/* Meanings of the ARMCPU object's six inbound GPIO lines */
  #define ARM_CPU_IRQ 0
  #define ARM_CPU_FIQ 1
  #define ARM_CPU_VIRQ 2
  #define ARM_CPU_VFIQ 3
+#define ARM_CPU_NMI 4
+#define ARM_CPU_VNMI 5
  
  /* For M profile, some registers are banked secure vs non-secure;

   * these are represented as a 2-element array where the first element
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 5fa86bc8d5..d40ada9c75 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -126,11 +126,20 @@ static bool arm_cpu_has_work(CPUState *cs)
  {
  ARMCPU *cpu = ARM_CPU(cs);
  
-return (cpu->power_state != PSCI_OFF)

-&& cs->interrupt_request &
-(CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
- | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
- | CPU_INTERRUPT_EXITTB);
+if (cpu_isar_feature(aa64_nmi, cpu)) {
+return (cpu->power_state != PSCI_OFF)
+&& cs->interrupt_request &
+(CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
+ | CPU_INTERRUPT_NMI | CPU_INTERRUPT_VNMI
+ | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
+ | CPU_INTERRUPT_EXITTB);
+} else {
+return (cpu->power_state != PSCI_OFF)
+&& cs->interrupt_request &
+(CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
+ | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
+ | CPU_INTERRUPT_EXITTB);
+}


This can be factored better, to avoid repeating everything.

However, I am reconsidering my previous advice to ignore NMI if FEAT_NMI is not 
present.

Consider R_MHWBP, where IRQ with Superpriority, with SCTLR_ELx.NMI == 0, is masked 
identically with IRQ without Superpriority.  Moreover, if the GIC is configured so that 
FEAT_GICv3_NMI is only set if FEAT_NMI is set, then we won't ever see CPU_INTERRUPT_*NMI 
anyway.


So we might as well accept NMI here unconditionally.  But document this choice here with a 
comment.




@@ -678,13 +688,26 @@ static inline bool arm_excp_unmasked(CPUState *cs, 
unsigned int excp_idx,
  return false;
  }
  
+if (cpu_isar_feature(aa64_nmi, env_archcpu(env))) {

+nmi_unmasked = (cur_el == target_el) &&
+   (((env->cp15.sctlr_el[target_el] & SCTLR_NMI) &&
+(env->allint & PSTATE_ALLINT)) ||
+((env->cp15.sctlr_el[target_el] & SCTLR_SPINTMASK) &&
+(env->pstate & PSTATE_SP)));


In the manual, this is "allintmask".  It is easier to follow the logic if you 
use this...


+nmi_unmasked = !nmi_unmasked;


... and not the inverse.


  case EXCP_FIQ:
-pstate_unmasked = !(env->daif & PSTATE_F);
+pstate_unmasked = (!(env->daif & PSTATE_F)) & nmi_unmasked;


Clearer with "&&".


+if (cpu_isar_feature(aa64_nmi, env_archcpu(env))) {
+if (interrupt_request & CPU_INTERRUPT_NMI) {
+excp_idx = EXCP_NMI;
+target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
+if (arm_excp_unmasked(cs, excp_idx, target_el,
+  cur_el, secure, hcr_el2)) {
+goto found;
+}
+}
+}


Handling for vNMI?


@@ -957,6 +992,7 @@ static void arm_cpu_set_irq(void *opaque, int irq, int 
level)
  break;
  case ARM_CPU_IRQ:
  case ARM_CPU_FIQ:
+case ARM_CPU_NMI:
  if (level) {
  cpu_interrupt(cs, mask[irq]);
  } else {


Likewise.


r~



Re: [PATCH 05/10] hppa: do not require CONFIG_USB

2024-02-23 Thread BALATON Zoltan

On Fri, 23 Feb 2024, Thomas Huth wrote:

On 23/02/2024 13.44, Paolo Bonzini wrote:

With --without-default-devices it is possible to build a binary that
does not include any USB host controller and therefore that does not
include the code guarded by CONFIG_USB.  While the simpler creation
functions such as usb_create_simple can be inlined, this is not true
of usb_bus_find().  Remove it, replacing it with a search of the single
USB bus on the machine.

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Paolo Bonzini 
---
  hw/hppa/machine.c | 7 ---
  hw/hppa/Kconfig   | 2 +-
  2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 5fcaf5884be..11982d5776c 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -396,10 +396,11 @@ static void machine_HP_common_init_tail(MachineState 
*machine, PCIBus *pci_bus,

  }
/* create USB OHCI controller for USB keyboard & mouse on Astro 
machines */

-if (!lasi_dev && machine->enable_graphics) {
+if (!lasi_dev && machine->enable_graphics && defaults_enabled()) {


Do we need the defaults_enabled() here? Isn't enable_graphics already 
disabled if defaults_enabled() is not set?


Isn't enable_graphics controlled by -nographic and defaults_enabled 
controlled by -nodefaults? I think they are independent but maybe that 
does not answer the question if it's needed or not.


Regards,
BALATON Zoltan


Thomas



  pci_create_simple(pci_bus, -1, "pci-ohci");
-usb_create_simple(usb_bus_find(-1), "usb-kbd");
-usb_create_simple(usb_bus_find(-1), "usb-mouse");
+Object *usb_bus = object_resolve_type_unambiguous(TYPE_USB_BUS, 
_abort);

+usb_create_simple(USB_BUS(usb_bus), "usb-kbd");
+usb_create_simple(USB_BUS(usb_bus), "usb-mouse");
  }





[PULL 08/11] docs: Document that 32-bit Windows is unsupported

2024-02-23 Thread Thomas Huth
From: Peter Maydell 

Reviewed-by: Thomas Huth 
Reviewed-by: "Daniel P. Berrangé" 
Reviewed-by: Alex Bennée 
Signed-off-by: Peter Maydell 
Message-ID: <20240222130920.362517-2-peter.mayd...@linaro.org>
Signed-off-by: Thomas Huth 
---
 docs/about/build-platforms.rst  |  2 ++
 docs/about/removed-features.rst | 15 +++
 2 files changed, 17 insertions(+)

diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index f2a7aec56f..8fd7da140a 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -139,6 +139,8 @@ unprivileged accounts can create symlinks if Developer Mode 
is enabled.
 When Developer Mode is not available/enabled, the SeCreateSymbolicLinkPrivilege
 privilege is required, or the process must be run as an administrator.
 
+Only 64-bit Windows is supported.
+
 .. _Homebrew: https://brew.sh/
 .. _MacPorts: https://www.macports.org/
 .. _MSYS2: https://www.msys2.org/
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 54081a6c19..417a0e4fa1 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -659,6 +659,21 @@ This command didn't produce any output already. Removed 
with no replacement.
 The ``singlestep`` command has been replaced by the ``one-insn-per-tb``
 command, which has the same behaviour but a less misleading name.
 
+Host Architectures
+--
+
+System emulation on 32-bit Windows hosts (removed in 9.0)
+'
+
+Windows 11 has no support for 32-bit host installs, and Windows 10 did
+not support new 32-bit installs, only upgrades. 32-bit Windows support
+has now been dropped by the MSYS2 project. QEMU also is deprecating
+and dropping support for 32-bit x86 host deployments in
+general. 32-bit Windows is therefore no longer a supported host for
+QEMU.  Since all recent x86 hardware from the past >10 years is
+capable of the 64-bit x86 extensions, a corresponding 64-bit OS should
+be used instead.
+
 Guest Emulator ISAs
 ---
 
-- 
2.43.2




[PULL 07/11] meson: Enable -Wvla

2024-02-23 Thread Thomas Huth
From: Peter Maydell 

QEMU has historically used variable length arrays only very rarely.
Variable length arrays are a potential security issue where an
on-stack dynamic allocation isn't correctly size-checked, especially
when the size comes from the guest.  (An example problem of this kind
from the past is CVE-2021-3527).  Forbidding them entirely is a
defensive measure against further bugs of this kind.

Enable -Wvla to prevent any new uses from sneaking into the codebase.

Signed-off-by: Peter Maydell 
Message-ID: <20240125173211.1786196-3-peter.mayd...@linaro.org>
[thuth: rebased to current master branch]
Reviewed-by: Philippe Mathieu-Daudé 
Tested-by: Philippe Mathieu-Daudé 
Message-ID: <20240221162636.173136-4-th...@redhat.com>
Signed-off-by: Thomas Huth 
---
 meson.build | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meson.build b/meson.build
index c1dc83e4c0..0ef1654e86 100644
--- a/meson.build
+++ b/meson.build
@@ -592,6 +592,7 @@ warn_flags = [
   '-Wstrict-prototypes',
   '-Wtype-limits',
   '-Wundef',
+  '-Wvla',
   '-Wwrite-strings',
 
   # Then disable some undesirable warnings
-- 
2.43.2




[PULL 06/11] target/ppc/kvm: Replace variable length array in kvmppc_read_hptes()

2024-02-23 Thread Thomas Huth
HPTES_PER_GROUP is 8 and HASH_PTE_SIZE_64 is 16, so we don't waste
too many bytes by always allocating the maximum amount of bytes on
the stack here to get rid of the variable length array.

Suggested-by: Peter Maydell 
Message-ID: <20240221162636.173136-3-th...@redhat.com>
Reviewed-by: Peter Maydell 
Signed-off-by: Thomas Huth 
---
 target/ppc/kvm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index e7e39c3091..bcf30a5400 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -2770,9 +2770,9 @@ void kvmppc_read_hptes(ppc_hash_pte64_t *hptes, hwaddr 
ptex, int n)
 while (i < n) {
 struct kvm_get_htab_header *hdr;
 int m = n < HPTES_PER_GROUP ? n : HPTES_PER_GROUP;
-char buf[sizeof(*hdr) + m * HASH_PTE_SIZE_64];
+char buf[sizeof(*hdr) + HPTES_PER_GROUP * HASH_PTE_SIZE_64];
 
-rc = read(fd, buf, sizeof(buf));
+rc = read(fd, buf, sizeof(*hdr) + m * HASH_PTE_SIZE_64);
 if (rc < 0) {
 hw_error("kvmppc_read_hptes: Unable to read HPTEs");
 }
-- 
2.43.2




[PULL 11/11] target/i386: do not filter processor tracing features except on KVM

2024-02-23 Thread Thomas Huth
From: Paolo Bonzini 

The processor tracing features in cpu_x86_cpuid() are hardcoded to a set
that should be safe on all processor that support PT virtualization.
But as an additional check, x86_cpu_filter_features() also checks
that the accelerator supports that safe subset, and if not it marks
CPUID_7_0_EBX_INTEL_PT as unavailable.

This check fails on accelerators other than KVM, but it is actually
unnecessary to do it because KVM is the only accelerator that uses the
safe subset.  Everything else just provides nonzero values for CPUID
leaf 0x14 (TCG/HVF because processor tracing is not supported; qtest
because nothing is able to read CPUID anyway).  Restricting the check
to KVM fixes a warning with the qtest accelerator:

$ qemu-system-x86_64 -display none -cpu max,mmx=off -accel qtest
qemu-system-x86_64: warning: TCG doesn't support requested feature: 
CPUID.07H:EBX.intel-pt [bit 25]

The warning also happens in the test-x86-cpuid-compat qtest.

Reported-by: Peter Maydell 
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2096
Signed-off-by: Paolo Bonzini 
Message-ID: <20240221162910.101327-1-pbonz...@redhat.com>
Fixes: d047402436 ("target/i386: Call accel-agnostic 
x86_cpu_get_supported_cpuid()")
Reviewed-by: Thomas Huth 
Signed-off-by: Thomas Huth 
---
 target/i386/cpu.c | 11 ++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index bca776e1fe..7f90823676 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6412,6 +6412,10 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
uint32_t count,
 break;
 }
 
+/*
+ * If these are changed, they should stay in sync with
+ * x86_cpu_filter_features().
+ */
 if (count == 0) {
 *eax = INTEL_PT_MAX_SUBLEAF;
 *ebx = INTEL_PT_MINIMAL_EBX;
@@ -7156,7 +7160,12 @@ static void x86_cpu_filter_features(X86CPU *cpu, bool 
verbose)
 mark_unavailable_features(cpu, w, unavailable_features, prefix);
 }
 
-if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) {
+/*
+ * Check that KVM actually allows the processor tracing features that
+ * are advertised by cpu_x86_cpuid().  Keep these two in sync.
+ */
+if ((env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) &&
+kvm_enabled()) {
 uint32_t eax_0, ebx_0, ecx_0, edx_0_unused;
 uint32_t eax_1, ebx_1, ecx_1_unused, edx_1_unused;
 
-- 
2.43.2




Re: [RFC PATCH 0/2] hw: Replace cpu_interrupt() calls by qemu_irq(QDev GPIO)

2024-02-23 Thread Peter Maydell
On Tue, 20 Feb 2024 at 19:28, Philippe Mathieu-Daudé  wrote:
> cpu_interrupt() doesn't scale well with heterogenous machines
> because its mask is target specific (defined in target/ARCH/cpu.h).
>
> While it is (often...) used by target-specific hw to notify cpu,
> there is no restriction to use such target-specific hw in a
> heterogeneous setup, where it'd still target the same kind of
> target cpus.

When would this target-specific hw call cpu_interrupt()
on a CPU which is not of that target architecture?
For instance, in the typhoon code you change in patch 2,
the CPUState argument to cpu_interrupt() and cpu_reset_interrupt()
is always that of one of the 4 CPUs pointed to by the
TyphoonState struct, which are guaranteed to be Alpha CPUs.
In some hypothetical world where this machine type had an
Arm board-management CPU on it as well, that CPU would not
be one of the ones pointed to by the TyphoonState struct,
which would still all be Alpha.

I can see that you would run into slight awkwardness on
a device that wanted to do this same kind of thing on two
CPU types at once, just because the defines are in cpu.h
and you can't #include them both at once. But are we going to
in practice have those on a heterogenous machine?

> The Alpha Typhoon HW is unlikely to be used heterogeneously,
> but it is the simplest case I found to illustrate how I plan
> to remove cpu_interrupt() calls from hw/: use the QDev GPIO API.

I do generally think that it's probably nicer design to
have cpu_interrupt() be internal to target/foo (it's how
arm does it, except for a handful of calls in obsolete SoC
models). But I think it might be helpful if you could give
a description of what the immediate issue is that means that
we need to do this cleanup to progress with the heterogenous
machine work (and to what extent we can leave existing code
in old non-heterogenous board and device models alone).

thanks
-- PMM



Re: [PATCH] hw/ide: Remove last two uses of ide/internal.h outside of hw/ide

2024-02-23 Thread Thomas Huth

On 23/02/2024 15.26, BALATON Zoltan wrote:

Remove last two includes of hw/ide/intarnal.h outside of hw/ide and
replace them with newly added public header to allow moving internal.h
into hw/ide to really stop exposing it.

Fixes: a11f439a0e (hw/ide: Stop exposing internal.h to non-IDE files)
Signed-off-by: BALATON Zoltan 
---
  hw/arm/sbsa-ref.c | 2 +-
  {include/hw => hw}/ide/internal.h | 0
  include/hw/misc/macio/macio.h | 2 +-
  3 files changed, 2 insertions(+), 2 deletions(-)
  rename {include/hw => hw}/ide/internal.h (100%)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 5d3a574664..f027622a75 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -36,7 +36,7 @@
  #include "hw/arm/smmuv3.h"
  #include "hw/block/flash.h"
  #include "hw/boards.h"
-#include "hw/ide/internal.h"
+#include "hw/ide/ide-bus.h"
  #include "hw/ide/ahci_internal.h"
  #include "hw/ide/ahci-sysbus.h"
  #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/ide/internal.h b/hw/ide/internal.h
similarity index 100%
rename from include/hw/ide/internal.h
rename to hw/ide/internal.h
diff --git a/include/hw/misc/macio/macio.h b/include/hw/misc/macio/macio.h
index 86df2c2b60..2b54da6b31 100644
--- a/include/hw/misc/macio/macio.h
+++ b/include/hw/misc/macio/macio.h
@@ -28,7 +28,7 @@
  
  #include "hw/char/escc.h"

  #include "hw/pci/pci_device.h"
-#include "hw/ide/internal.h"
+#include "hw/ide/ide-bus.h"
  #include "hw/intc/heathrow_pic.h"
  #include "hw/misc/macio/cuda.h"
  #include "hw/misc/macio/gpio.h"


Oh, I was sure that I got them all ... thanks for double checking!

Reviewed-by: Thomas Huth 




Re: [PATCH v2 02/27] tests/tcg: bump TCG test timeout to 120s

2024-02-23 Thread Thomas Huth

On 23/02/2024 17.21, Alex Bennée wrote:

This is less than ideal but easier than making sure we get all the
iterations of the memory test. Update the comment accordingly.

Signed-off-by: Alex Bennée 
---
  tests/tcg/Makefile.target | 9 +++--
  1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 8cf65f68dd8..a4c25908fb7 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -93,12 +93,9 @@ QEMU_OPTS=
  
  
  # If TCG debugging, or TCI is enabled things are a lot slower

-# ??? Makefile no longer has any indication that TCI is enabled,
-# but for the record:
-#   15soriginal default
-#   60swith --enable-debug
-#   90swith --enable-tcg-interpreter
-TIMEOUT=90
+# so we have to set our timeout for that. The current worst case
+# offender is the system memory test running under TCI.
+TIMEOUT=120
  
  ifeq ($(filter %-softmmu, $(TARGET)),)

  # The order we include is important. We include multiarch first and


Reviewed-by: Thomas Huth 




[PULL 09/11] .gitlab-ci.d: Drop cross-win32-system job

2024-02-23 Thread Thomas Huth
From: Peter Maydell 

We don't support 32-bit Windows any more, so we don't need to defend it
with this CI job.

Signed-off-by: Peter Maydell 
Reviewed-by: Thomas Huth 
Reviewed-by: "Daniel P. Berrangé" 
Reviewed-by: Alex Bennée 
Message-ID: <20240222130920.362517-3-peter.mayd...@linaro.org>
Signed-off-by: Thomas Huth 
---
 .gitlab-ci.d/container-cross.yml  |   5 -
 .gitlab-ci.d/crossbuilds.yml  |  14 ---
 .../dockerfiles/fedora-win32-cross.docker | 111 --
 tests/lcitool/refresh |   5 -
 4 files changed, 135 deletions(-)
 delete mode 100644 tests/docker/dockerfiles/fedora-win32-cross.docker

diff --git a/.gitlab-ci.d/container-cross.yml b/.gitlab-ci.d/container-cross.yml
index 8d235cbea0..e3103940a0 100644
--- a/.gitlab-ci.d/container-cross.yml
+++ b/.gitlab-ci.d/container-cross.yml
@@ -101,11 +101,6 @@ cris-fedora-cross-container:
   variables:
 NAME: fedora-cris-cross
 
-win32-fedora-cross-container:
-  extends: .container_job_template
-  variables:
-NAME: fedora-win32-cross
-
 win64-fedora-cross-container:
   extends: .container_job_template
   variables:
diff --git a/.gitlab-ci.d/crossbuilds.yml b/.gitlab-ci.d/crossbuilds.yml
index d19d98cde0..987ba9694b 100644
--- a/.gitlab-ci.d/crossbuilds.yml
+++ b/.gitlab-ci.d/crossbuilds.yml
@@ -159,20 +159,6 @@ cross-mips64el-kvm-only:
 IMAGE: debian-mips64el-cross
 EXTRA_CONFIGURE_OPTS: --disable-tcg --target-list=mips64el-softmmu
 
-cross-win32-system:
-  extends: .cross_system_build_job
-  needs:
-job: win32-fedora-cross-container
-  variables:
-IMAGE: fedora-win32-cross
-EXTRA_CONFIGURE_OPTS: --enable-fdt=internal
-CROSS_SKIP_TARGETS: alpha-softmmu avr-softmmu hppa-softmmu m68k-softmmu
-microblazeel-softmmu mips64el-softmmu nios2-softmmu
-  artifacts:
-when: on_success
-paths:
-  - build/qemu-setup*.exe
-
 cross-win64-system:
   extends: .cross_system_build_job
   needs:
diff --git a/tests/docker/dockerfiles/fedora-win32-cross.docker 
b/tests/docker/dockerfiles/fedora-win32-cross.docker
deleted file mode 100644
index 08799219f9..00
--- a/tests/docker/dockerfiles/fedora-win32-cross.docker
+++ /dev/null
@@ -1,111 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool dockerfile --layers all --cross-arch mingw32 fedora-38 qemu
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM registry.fedoraproject.org/fedora:38
-
-RUN dnf install -y nosync && \
-printf '#!/bin/sh\n\
-if test -d /usr/lib64\n\
-then\n\
-export LD_PRELOAD=/usr/lib64/nosync/nosync.so\n\
-else\n\
-export LD_PRELOAD=/usr/lib/nosync/nosync.so\n\
-fi\n\
-exec "$@"\n' > /usr/bin/nosync && \
-chmod +x /usr/bin/nosync && \
-nosync dnf update -y && \
-nosync dnf install -y \
-   bash \
-   bc \
-   bison \
-   bzip2 \
-   ca-certificates \
-   ccache \
-   ctags \
-   dbus-daemon \
-   diffutils \
-   findutils \
-   flex \
-   gcc \
-   gcovr \
-   git \
-   glib2-devel \
-   glibc-langpack-en \
-   hostname \
-   llvm \
-   make \
-   meson \
-   mtools \
-   ninja-build \
-   nmap-ncat \
-   openssh-clients \
-   pcre-static \
-   python3 \
-   python3-PyYAML \
-   python3-numpy \
-   python3-opencv \
-   python3-pillow \
-   python3-pip \
-   python3-sphinx \
-   python3-sphinx_rtd_theme \
-   sed \
-   socat \
-   sparse \
-   spice-protocol \
-   swtpm \
-   tar \
-   tesseract \
-   tesseract-langpack-eng \
-   util-linux \
-   which \
-   xorriso \
-   zstd && \
-nosync dnf autoremove -y && \
-nosync dnf clean all -y
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN nosync dnf install -y \
-   mingw32-SDL2 \
-   mingw32-SDL2_image \
-   mingw32-bzip2 \
-   mingw32-curl \
-   mingw32-gcc \
-   mingw32-gcc-c++ \
-   mingw32-gettext \
-   mingw32-glib2 \
-   mingw32-gnutls \
-   mingw32-gtk3 \
-   mingw32-libepoxy \
-   mingw32-libgcrypt \
-   mingw32-libjpeg-turbo \
-   mingw32-libpng \
-   mingw32-libtasn1 \
-   mingw32-nettle \
-   mingw32-nsis \
-   mingw32-pixman \
-   mingw32-pkg-config && \
-nosync dnf clean all -y && \
-rpm -qa | 

[PULL 01/11] target/m68k: Fix exception frame format for 68010

2024-02-23 Thread Thomas Huth
From: Daniel Palmer 

>From the 68010 a word with the frame format and exception vector
are placed on the stack before the PC and SR.

M68K_FEATURE_QUAD_MULDIV is currently checked to workout if to do
this or not for the configured CPU but that flag isn't set for
68010 so currently the exception stack when 68010 is configured
is incorrect.

It seems like checking M68K_FEATURE_MOVEFROMSR_PRIV would do but
adding a new flag that shows exactly what is going on here is
maybe clearer.

Add a new flag for the behaviour, M68K_FEATURE_EXCEPTION_FORMAT_VEC,
and set it for 68010 and above, and then use it to control if the
format and vector word are pushed/pop during exception entry/exit.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2164
Signed-off-by: Daniel Palmer 
Message-ID: <20240115101643.2165387-1-dan...@0x0f.com>
Reviewed-by: Thomas Huth 
Signed-off-by: Thomas Huth 
---
 target/m68k/cpu.h   | 2 ++
 target/m68k/cpu.c   | 4 +++-
 target/m68k/op_helper.c | 4 ++--
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 646cacbdf1..346427e144 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -550,6 +550,8 @@ enum m68k_features {
 M68K_FEATURE_TRAPCC,
 /* MOVE from SR privileged (from 68010) */
 M68K_FEATURE_MOVEFROMSR_PRIV,
+/* Exception frame with format+vector (from 68010) */
+M68K_FEATURE_EXCEPTION_FORMAT_VEC,
 };
 
 static inline bool m68k_feature(CPUM68KState *env, int feature)
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 8a8392e694..d5a71c6315 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -142,7 +142,8 @@ static void m68000_cpu_initfn(Object *obj)
 }
 
 /*
- * Adds BKPT, MOVE-from-SR *now priv instr, and MOVEC, MOVES, RTD
+ * Adds BKPT, MOVE-from-SR *now priv instr, and MOVEC, MOVES, RTD,
+ *  format+vector in exception frame.
  */
 static void m68010_cpu_initfn(Object *obj)
 {
@@ -155,6 +156,7 @@ static void m68010_cpu_initfn(Object *obj)
 m68k_set_feature(env, M68K_FEATURE_BKPT);
 m68k_set_feature(env, M68K_FEATURE_MOVEC);
 m68k_set_feature(env, M68K_FEATURE_MOVEFROMSR_PRIV);
+m68k_set_feature(env, M68K_FEATURE_EXCEPTION_FORMAT_VEC);
 }
 
 /*
diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
index 47b4173bb9..956e76eb5f 100644
--- a/target/m68k/op_helper.c
+++ b/target/m68k/op_helper.c
@@ -52,7 +52,7 @@ throwaway:
 sp += 2;
 env->pc = cpu_ldl_mmuidx_ra(env, sp, MMU_KERNEL_IDX, 0);
 sp += 4;
-if (m68k_feature(env, M68K_FEATURE_QUAD_MULDIV)) {
+if (m68k_feature(env, M68K_FEATURE_EXCEPTION_FORMAT_VEC)) {
 /*  all except 68000 */
 fmt = cpu_lduw_mmuidx_ra(env, sp, MMU_KERNEL_IDX, 0);
 sp += 2;
@@ -256,7 +256,7 @@ static inline void do_stack_frame(CPUM68KState *env, 
uint32_t *sp,
   uint16_t format, uint16_t sr,
   uint32_t addr, uint32_t retaddr)
 {
-if (m68k_feature(env, M68K_FEATURE_QUAD_MULDIV)) {
+if (m68k_feature(env, M68K_FEATURE_EXCEPTION_FORMAT_VEC)) {
 /*  all except 68000 */
 CPUState *cs = env_cpu(env);
 switch (format) {
-- 
2.43.2




[PULL 05/11] target/ppc/kvm: Replace variable length array in kvmppc_save_htab()

2024-02-23 Thread Thomas Huth
To be able to compile QEMU with -Wvla (to prevent potential security
issues), we need to get rid of the variable length array in the
kvmppc_save_htab() function. Replace it with a heap allocation instead.

Message-ID: <20240221162636.173136-2-th...@redhat.com>
Reviewed-by: Peter Maydell 
Signed-off-by: Thomas Huth 
---
 target/ppc/kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 26fa9d0575..e7e39c3091 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -2688,7 +2688,7 @@ int kvmppc_get_htab_fd(bool write, uint64_t index, Error 
**errp)
 int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns)
 {
 int64_t starttime = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-uint8_t buf[bufsize];
+g_autofree uint8_t *buf = g_malloc(bufsize);
 ssize_t rc;
 
 do {
-- 
2.43.2




Re: [RFC PATCH v3 05/21] target/arm: Support MSR access to ALLINT

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

+static CPAccessResult aa64_allint_access(CPUARMState *env,
+ const ARMCPRegInfo *ri, bool isread)
+{
+if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) &&
+(arm_hcrx_el2_eff(env) & HCRX_TALLINT)) {


No need to test arm_is_el2_enabled explicitly, as that is done by 
arm_hcrx_el2_eff.
The bit test with TALLINT will fail if el2 is disabled.


r~



[PULL 04/11] tests: skip dbus-display tests that need a console

2024-02-23 Thread Thomas Huth
From: Marc-André Lureau 

When compiling with "configure --without-default-devices", the
dbus-display-test fails since it implicitly assumes that the
machine comes with a default console.

There doesn't seem to be an easy way to figure this during build time,
so skip the tests requiring the Console interface at runtime.

Reported-by: Thomas Huth 
Signed-off-by: Marc-André Lureau 
Message-ID: <20240221073759.171443-1-marcandre.lur...@redhat.com>
Tested-by: Thomas Huth 
Signed-off-by: Thomas Huth 
---
 tests/qtest/dbus-display-test.c | 16 ++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/dbus-display-test.c b/tests/qtest/dbus-display-test.c
index 21edaa1e32..0390bdcb41 100644
--- a/tests/qtest/dbus-display-test.c
+++ b/tests/qtest/dbus-display-test.c
@@ -135,6 +135,13 @@ test_dbus_console_registered(GObject *source_object,
 NULL,
 #endif
 res, );
+
+if (g_error_matches(err, G_DBUS_ERROR, G_DBUS_ERROR_UNKNOWN_METHOD)) {
+g_test_skip("The VM doesn't have a console!");
+g_main_loop_quit(test->loop);
+return;
+}
+
 g_assert_no_error(err);
 
 test->listener_conn = g_thread_join(test->thread);
@@ -156,7 +163,7 @@ test_dbus_display_console(void)
 g_autoptr(GMainLoop) loop = NULL;
 QTestState *qts = NULL;
 int pair[2];
-TestDBusConsoleRegister test;
+TestDBusConsoleRegister test = { 0, };
 #ifdef WIN32
 WSAPROTOCOL_INFOW info;
 g_autoptr(GVariant) listener = NULL;
@@ -245,7 +252,6 @@ test_dbus_display_keyboard(void)
 ));
 g_assert_no_error(err);
 
-
 g_assert_cmpint(qtest_inb(qts, 0x64) & 0x1, ==, 0);
 g_assert_cmpint(qtest_inb(qts, 0x60), ==, 0);
 
@@ -256,6 +262,12 @@ test_dbus_display_keyboard(void)
 -1,
 NULL,
 );
+if (g_error_matches(err, G_DBUS_ERROR, G_DBUS_ERROR_UNKNOWN_METHOD)) {
+g_test_skip("The VM doesn't have a console!");
+qtest_quit(qts);
+return;
+}
+
 g_assert_no_error(err);
 
 /* may be should wait for interrupt? */
-- 
2.43.2




[PULL 00/11] Test and misc patches

2024-02-23 Thread Thomas Huth
 Hi Peter!

The following changes since commit 3d54cbf269d63ff1d500b35b2bcf4565ff8ad485:

  Merge tag 'hw-misc-20240222' of https://github.com/philmd/qemu into staging 
(2024-02-22 15:44:29 +)

are available in the Git repository at:

  https://gitlab.com/thuth/qemu.git tags/pull-request-2024-02-23

for you to fetch changes up to 028ade14da9eb31a8c5dde48dd5b140e49888908:

  target/i386: do not filter processor tracing features except on KVM 
(2024-02-23 08:13:52 +0100)


* m68k: Fix exception frame format for 68010
* Add cdrom test for LoongArch virt machine
* Fix qtests when using --without-default-devices
* Enable -Wvla
* Windows 32-bit removal
* Silence warnings in the test-x86-cpuid-compat qtest


Bibo Mao (1):
  tests/cdrom-test: Add cdrom test for LoongArch virt machine

Daniel Palmer (1):
  target/m68k: Fix exception frame format for 68010

Marc-André Lureau (1):
  tests: skip dbus-display tests that need a console

Paolo Bonzini (1):
  target/i386: do not filter processor tracing features except on KVM

Peter Maydell (4):
  meson: Enable -Wvla
  docs: Document that 32-bit Windows is unsupported
  .gitlab-ci.d: Drop cross-win32-system job
  .gitlab-ci.d/windows.yml: Remove shared-msys2 abstraction

Thomas Huth (3):
  tests/qtest: Fix boot-serial-test when using --without-default-devices
  target/ppc/kvm: Replace variable length array in kvmppc_save_htab()
  target/ppc/kvm: Replace variable length array in kvmppc_read_hptes()

 docs/about/build-platforms.rst |   2 +
 docs/about/removed-features.rst|  15 +++
 meson.build|   1 +
 target/m68k/cpu.h  |   2 +
 target/i386/cpu.c  |  11 +-
 target/m68k/cpu.c  |   4 +-
 target/m68k/op_helper.c|   4 +-
 target/ppc/kvm.c   |   6 +-
 tests/qtest/boot-serial-test.c |   2 +-
 tests/qtest/cdrom-test.c   |   5 +
 tests/qtest/dbus-display-test.c|  16 ++-
 .gitlab-ci.d/container-cross.yml   |   5 -
 .gitlab-ci.d/crossbuilds.yml   |  14 ---
 .gitlab-ci.d/windows.yml   |  85 
 tests/docker/dockerfiles/fedora-win32-cross.docker | 111 -
 tests/lcitool/refresh  |   5 -
 16 files changed, 99 insertions(+), 189 deletions(-)
 delete mode 100644 tests/docker/dockerfiles/fedora-win32-cross.docker




[PULL 10/11] .gitlab-ci.d/windows.yml: Remove shared-msys2 abstraction

2024-02-23 Thread Thomas Huth
From: Peter Maydell 

Now we don't build msys2-32bit we don't need the abstraction out of the
common msys2 handling from the 32-vs-64-bit specifics. Collapse it
down into the msys2-64bit job definition.

Signed-off-by: Peter Maydell 
Reviewed-by: "Daniel P. Berrangé" 
Reviewed-by: Philippe Mathieu-Daudé 
Message-ID: <20240222130920.362517-4-peter.mayd...@linaro.org>
Signed-off-by: Thomas Huth 
---
 .gitlab-ci.d/windows.yml | 85 +++-
 1 file changed, 41 insertions(+), 44 deletions(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 8fc08218d2..f116b8012d 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -1,4 +1,4 @@
-.shared_msys2_builder:
+msys2-64bit:
   extends: .base_job_template
   tags:
   - shared-windows
@@ -14,9 +14,20 @@
   stage: build
   timeout: 100m
   variables:
+# Select the "64 bit, gcc and MSVCRT" MSYS2 environment
+MSYSTEM: MINGW64
 # This feature doesn't (currently) work with PowerShell, it stops
 # the echo'ing of commands being run and doesn't show any timing
 FF_SCRIPT_SECTIONS: 0
+# do not remove "--without-default-devices"!
+# commit 9f8e6cad65a6 ("gitlab-ci: Speed up the msys2-64bit job by using 
--without-default-devices"
+# changed to compile QEMU with the --without-default-devices switch
+# for this job, because otherwise the build could not complete within
+# the project timeout.
+CONFIGURE_ARGS:  --target-list=x86_64-softmmu --without-default-devices 
-Ddebug=false -Doptimization=0
+# qTests don't run successfully with "--without-default-devices",
+# so let's exclude the qtests from CI for now.
+TEST_ARGS: --no-suite qtest
   artifacts:
 name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
 expire_in: 7 days
@@ -72,33 +83,35 @@
   - .\msys64\usr\bin\bash -lc "pacman -Sy --noconfirm --needed
   bison diffutils flex
   git grep make sed
-  $MINGW_TARGET-binutils
-  $MINGW_TARGET-capstone
-  $MINGW_TARGET-ccache
-  $MINGW_TARGET-curl
-  $MINGW_TARGET-cyrus-sasl
-  $MINGW_TARGET-dtc
-  $MINGW_TARGET-gcc
-  $MINGW_TARGET-glib2
-  $MINGW_TARGET-gnutls
-  $MINGW_TARGET-gtk3
-  $MINGW_TARGET-libgcrypt
-  $MINGW_TARGET-libjpeg-turbo
-  $MINGW_TARGET-libnfs
-  $MINGW_TARGET-libpng
-  $MINGW_TARGET-libssh
-  $MINGW_TARGET-libtasn1
-  $MINGW_TARGET-lzo2
-  $MINGW_TARGET-nettle
-  $MINGW_TARGET-ninja
-  $MINGW_TARGET-pixman
-  $MINGW_TARGET-pkgconf
-  $MINGW_TARGET-python
-  $MINGW_TARGET-SDL2
-  $MINGW_TARGET-SDL2_image
-  $MINGW_TARGET-snappy
-  $MINGW_TARGET-zstd
-  $EXTRA_PACKAGES "
+  mingw-w64-x86_64-binutils
+  mingw-w64-x86_64-capstone
+  mingw-w64-x86_64-ccache
+  mingw-w64-x86_64-curl
+  mingw-w64-x86_64-cyrus-sasl
+  mingw-w64-x86_64-dtc
+  mingw-w64-x86_64-gcc
+  mingw-w64-x86_64-glib2
+  mingw-w64-x86_64-gnutls
+  mingw-w64-x86_64-gtk3
+  mingw-w64-x86_64-libgcrypt
+  mingw-w64-x86_64-libjpeg-turbo
+  mingw-w64-x86_64-libnfs
+  mingw-w64-x86_64-libpng
+  mingw-w64-x86_64-libssh
+  mingw-w64-x86_64-libtasn1
+  mingw-w64-x86_64-libusb
+  mingw-w64-x86_64-lzo2
+  mingw-w64-x86_64-nettle
+  mingw-w64-x86_64-ninja
+  mingw-w64-x86_64-pixman
+  mingw-w64-x86_64-pkgconf
+  mingw-w64-x86_64-python
+  mingw-w64-x86_64-SDL2
+  mingw-w64-x86_64-SDL2_image
+  mingw-w64-x86_64-snappy
+  mingw-w64-x86_64-spice
+  mingw-w64-x86_64-usbredir
+  mingw-w64-x86_64-zstd"
   - Write-Output "Running build at $(Get-Date -Format u)"
   - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
   - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
@@ -115,19 +128,3 @@
   - ..\msys64\usr\bin\bash -lc "make check MTESTARGS='$TEST_ARGS' || { cat 
meson-logs/testlog.txt; exit 1; } ;"
   - ..\msys64\usr\bin\bash -lc "ccache --show-stats"
   - Write-Output "Finished build at $(Get-Date -Format u)"
-
-msys2-64bit:
-  extends: .shared_msys2_builder
-  variables:
-MINGW_TARGET: mingw-w64-x86_64
-MSYSTEM: MINGW64
-# msys2 only ship these packages for 64-bit, not 32-bit
-EXTRA_PACKAGES: $MINGW_TARGET-libusb $MINGW_TARGET-usbredir 
$MINGW_TARGET-spice
-# do not remove "--without-default-devices"!
-# commit 9f8e6cad65a6 ("gitlab-ci: Speed up the msys2-64bit job by using 
--without-default-devices"
-# changed to compile QEMU with the --without-default-devices switch
-# for the msys2 64-bit job, due to the build could not complete within
-CONFIGURE_ARGS:  --target-list=x86_64-softmmu --without-default-devices 
-Ddebug=false -Doptimization=0
-# qTests don't run successfully with "--without-default-devices",
-# so let's exclude the qtests from CI for now.
-TEST_ARGS: --no-suite qtest
-- 
2.43.2




[PULL 03/11] tests/qtest: Fix boot-serial-test when using --without-default-devices

2024-02-23 Thread Thomas Huth
If "configure" has been run with "--without-default-devices", there is
no e1000 device in the binaries, so the boot-serial-test currently fails
in that case since it tries to use the e1000 with the sam460ex machine.

Since we're testing the serial output here, and not the NIC, let's
simply switch to the "pci-bridge" device here instead, which should
always be there for PCI-based machines like the sam460ex.

Message-ID: <20240219111030.384158-1-th...@redhat.com>
Signed-off-by: Thomas Huth 
---
 tests/qtest/boot-serial-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
index 6dd06aeaf4..e3b7d65fe5 100644
--- a/tests/qtest/boot-serial-test.c
+++ b/tests/qtest/boot-serial-test.c
@@ -156,7 +156,7 @@ static const testdef_t tests[] = {
   "Open Firmware" },
 { "ppc64", "powernv8", "", "OPAL" },
 { "ppc64", "powernv9", "", "OPAL" },
-{ "ppc64", "sam460ex", "-device e1000", "8086  100e" },
+{ "ppc64", "sam460ex", "-device pci-bridge,chassis_nr=2", "1b36  0001" },
 { "i386", "isapc", "-cpu qemu32 -M graphics=off", "SeaBIOS" },
 { "i386", "pc", "-M graphics=off", "SeaBIOS" },
 { "i386", "q35", "-M graphics=off", "SeaBIOS" },
-- 
2.43.2




[PULL 02/11] tests/cdrom-test: Add cdrom test for LoongArch virt machine

2024-02-23 Thread Thomas Huth
From: Bibo Mao 

The cdrom test skips to execute on LoongArch system with command
"make check", this patch enables cdrom test for LoongArch virt
machine platform.

With this patch, cdrom test passes to run on LoongArch virt
machine type.

Signed-off-by: Bibo Mao 
Message-ID: <20240217100230.134042-1-maob...@loongson.cn>
Reviewed-by: Thomas Huth 
Signed-off-by: Thomas Huth 
---
 tests/qtest/cdrom-test.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
index 0945383789..5d89e62515 100644
--- a/tests/qtest/cdrom-test.c
+++ b/tests/qtest/cdrom-test.c
@@ -271,6 +271,11 @@ int main(int argc, char **argv)
 const char *virtmachine[] = { "virt", NULL };
 add_cdrom_param_tests(virtmachine);
 }
+} else if (g_str_equal(arch, "loongarch64")) {
+if (qtest_has_device("virtio-blk-pci")) {
+const char *virtmachine[] = { "virt", NULL };
+add_cdrom_param_tests(virtmachine);
+}
 } else {
 const char *nonemachine[] = { "none", NULL };
 add_cdrom_param_tests(nonemachine);
-- 
2.43.2




Re: [RFC PATCH v3 04/21] target/arm: Implement ALLINT MSR (immediate)

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

Add ALLINT MSR (immediate) to decodetree. And the EL0 check is necessary
to ALLINT. Avoid the unconditional write to pc and use raise_exception_ra
to unwind.

Signed-off-by: Jinjie Ruan 
---
v3:
- Remove EL0 check in allint_check().
- Add TALLINT check for EL1 in allint_check().
- Remove unnecessarily arm_rebuild_hflags() in msr_i_allint helper.
---
  target/arm/tcg/a64.decode  |  1 +
  target/arm/tcg/helper-a64.c| 24 
  target/arm/tcg/helper-a64.h|  1 +
  target/arm/tcg/translate-a64.c | 10 ++
  4 files changed, 36 insertions(+)

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index 8a20dce3c8..3588080024 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -207,6 +207,7 @@ MSR_i_DIT   1101 0101  0 011 0100  010 1 
@msr_i
  MSR_i_TCO   1101 0101  0 011 0100  100 1 @msr_i
  MSR_i_DAIFSET   1101 0101  0 011 0100  110 1 @msr_i
  MSR_i_DAIFCLEAR 1101 0101  0 011 0100  111 1 @msr_i
+MSR_i_ALLINT1101 0101  0 001 0100  000 1 @msr_i


Decode is incorrect either here, or in trans_MSR_i_ALLINT, because CRm != 
'000x' is UNDEFINED.

MSR_i_ALLINT1101 0101  0 001 0100 000 imm:1 000 1

is perhaps the clearest implementation.


+static void allint_check(CPUARMState *env, uint32_t op,
+   uint32_t imm, uintptr_t ra)
+{
+/* ALLINT update to PSTATE. */
+if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) &&
+(arm_hcrx_el2_eff(env) & HCRX_TALLINT)) {
+raise_exception_ra(env, EXCP_UDEF,
+   syn_aa64_sysregtrap(0, extract32(op, 0, 3),
+   extract32(op, 3, 3), 4,
+   imm, 0x1f, 0),
+   exception_target_el(env), ra);
+}
+}
+
+void HELPER(msr_i_allint)(CPUARMState *env, uint32_t imm)
+{
+allint_check(env, 0x8, imm, GETPC());


As previously noted, the check for MSR_i only applies to imm==1, not 0.

As previously noted, with ALLINT in env->pstate, you can implement this completely inline 
for EL[23], or EL1 with imm==0.


No point in passing in "op" and extracting, because you know exactly what the value should 
be for all MSR ALLINT.



r~



Re: [RFC PATCH 1/2] target/alpha: Expose TMR and SMP IRQ lines via QDev

2024-02-23 Thread Peter Maydell
On Tue, 20 Feb 2024 at 19:28, Philippe Mathieu-Daudé  wrote:
>
> In order to remove calls to cpu_interrupt() from hw/ code,
> expose the TMR and SMP interrupts via QDev as named GPIOs.
>
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  target/alpha/cpu.c | 30 ++
>  1 file changed, 30 insertions(+)
>
> diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
> index bf70173a25..619cd54593 100644
> --- a/target/alpha/cpu.c
> +++ b/target/alpha/cpu.c
> @@ -25,6 +25,31 @@
>  #include "cpu.h"
>  #include "exec/exec-all.h"
>
> +#ifndef CONFIG_USER_ONLY
> +static void alpha_cpu_tmr_irq(void *opaque, int irq, int level)
> +{
> +DeviceState *dev = opaque;
> +CPUState *cs = CPU(dev);
> +
> +if (level) {
> +cs->interrupt_request |= CPU_INTERRUPT_TIMER;
> +} else {
> +cs->interrupt_request &= ~CPU_INTERRUPT_TIMER;
> +}

These should call cpu_interrupt(), because otherwise you
lose the logic that does a cpu-kick if one CPU triggers
an interrupt on another. (Also you lose the handling for
non-TCG accelerators, not that that's an issue for Alpha.)
Compare arm_cpu_set_irq().

thanks
-- PMM



Re: [PATCH] ui/cocoa: Fix incorrect window clipping on macOS Sonoma

2024-02-23 Thread BALATON Zoltan

On Fri, 23 Feb 2024, David Parsons wrote:

Hi Akihiko

I’ve re-worked the patch to match your suggestion. I have compiled
and tested it on Sonoma and Monterey and both builds worked correctly.

New patch is below. I’m new to sending patches to QEMU so please let
me know if I need to do anything else to get it incorporated into the
repo.


See here for detailed docs:
https://www.qemu.org/docs/master/devel/submitting-a-patch.html

In short you'd need to make the patch the same way you did the first 
version with the changed content but as [PATCH v2] and send it again as a 
new patch like you did the first time. (You can use -v2 option to git 
format-patch to add v2 to subject but if you're not using git format-patch 
directly then I'm not sure what option will do that for the way you send 
the patch.)


Regards,
BALATON Zoltan


Dave

diff --git a/ui/cocoa.m b/ui/cocoa.m
index eb99064bee..bbf9704b8c 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -54,6 +54,10 @@
#define MAC_OS_X_VERSION_10_13 101300
#endif

+#ifndef MAC_OS_VERSION_14_0
+#define MAC_OS_VERSION_14_0 14
+#endif
+
/* 10.14 deprecates NSOnState and NSOffState in favor of
 * NSControlStateValueOn/Off, which were introduced in 10.13.
 * Define for older versions
@@ -365,6 +369,9 @@ - (id)initWithFrame:(NSRect)frameRect
screen.width = frameRect.size.width;
screen.height = frameRect.size.height;
kbd = qkbd_state_init(dcl.con);
+#if MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_14_0
+[self setClipsToBounds:YES];
+#endif

}
return self;



On 23 Feb 2024, at 11:28, Akihiko Odaki  wrote:

On 2024/02/23 2:10, Peter Maydell wrote:

On Thu, 22 Feb 2024 at 06:08, Michael Tokarev  wrote:


[Adding a few more Ccs]

17.02.2024 18:58, David Parsons :

macOS Sonoma changes the NSView.clipsToBounds to false by default where it was 
true in
earlier version of macOS. This causes the window contents to be obscured by the 
window
frame. This fixes the issue by conditionally setting the clipping on Sonoma to 
true.


Thanks for posting a patch for this critical problem.



Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1994
Signed-off-by: David Parsons 

diff --git a/ui/cocoa.m b/ui/cocoa.m
index eb99064bee..c9e3b96004 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -365,6 +365,9 @@ - (id)initWithFrame:(NSRect)frameRect
  screen.width = frameRect.size.width;
  screen.height = frameRect.size.height;
  kbd = qkbd_state_init(dcl.con);
+if (@available(macOS 14, *)) {
+[self setClipsToBounds:YES];
+}

  }
  return self;



Hi David!

While the code change is tiny, I for one know nothing about MacOS and
its cocoa thing, so to me (with my trivial-patches hat on) this is a
no-go.  I'd love to have a review from someone more knowlegeable in
this area.

Mmm. Akihiko is the expert here, but I do notice that we don't
seem to be handling the "macos-version-specific" stuff in a
way we've done it before (we don't use @available elsewhere).
I did wonder if we could call the setClipsToBounds method unconditionally;
The release notes say
https://developer.apple.com/documentation/macos-release-notes/appkit-release-notes-for-macos-14#NSView
"This property is available back to macOS 10.9. This availability is
intended to allow code targeting older OSes to set this property to
true without guarding the setter in an availability check."
but I think that might only mean "you can do this building on a new
SDK that's targeting an old version", not "you can do this
when building on an older SDK" (at least judging from the
comments in the gitlab issue).


Apparently it is that case.

Please check if MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_14_0
instead of using @available. See commit 5e24600a7c1c ("ui/cocoa.m: Fix macOS 10.14 
deprecation warnings") for example.


The other option would be to fix whatever it is that we're
presumably not getting right that means this default change
caused the bug. My guess is that we are in the case
"Confusing a view’s bounds and its dirty rect. The dirty rect
 passed to .drawRect() should be used to determine what to draw,
 not where to draw it. Use NSView.bounds when determining the
 layout of what your view draws."
But unless the fix for that is really obvious and easy I guess
that flipping the default back to its old value is the better
approach.


It is a chore to convert the coordinates using NSView.bounds. Let's keep using 
clipsToBounds.


-- PMM







Re: proposed schedule for 9.0 release

2024-02-23 Thread Peter Maydell
On Tue, 23 Jan 2024 at 17:14, Peter Maydell  wrote:
>
> Here's my proposal for the freeze dates for 9.0:
>
> 2024-03-12 Soft feature freeze (all feature changes must be in
>a pullreq on list by this date)
> 2024-03-19 Hard feature freeze. Tag rc0
> 2024-03-26 Tag rc1
> 2024-04-02 Tag rc2
> 2024-04-09 Tag rc3
> 2024-04-16 Release; or tag rc4 if needed
> 2024-04-23 Release if we needed an rc4
>
> (Easter is 29Mar-1Apr this year, but we can hardly avoid
> that entirely.)
>
> Any objections/suggested tweaks?

Nobody complained, so this is what we're going with.
Softfreeze is just over two weeks away :-)

-- PMM



Re: [RFC PATCH v3 02/21] target/arm: Add PSTATE.ALLINT

2024-02-23 Thread Richard Henderson

On 2/23/24 00:32, Jinjie Ruan via wrote:

The ALLINT bit in PSTATE is used to mask all IRQ or FIQ interrupts.

Place this in its own field within ENV, as that will
make it easier to handle ALLINT set/clear.

With the change to pstate_read/write, exception entry
and return are automatically handled.

Signed-off-by: Jinjie Ruan
---
v3:
- Remove ALLINT dump in aarch64_cpu_dump_state().
- Update the commit message.
---
  target/arm/cpu.h | 9 +++--
  1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 63f31e0d98..f9646dbbfb 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -224,6 +224,7 @@ typedef struct CPUArchState {
   *semantics as for AArch32, as described in the comments on each 
field)
   *  nRW (also known as M[4]) is kept, inverted, in env->aarch64
   *  DAIF (exception masks) are kept in env->daif
+ *  ALLINT (all IRQ or FIQ interrupts masks) are kept in env->allint
   *  BTYPE is kept in env->btype
   *  SM and ZA are kept in env->svcr
   *  all other bits are stored in their correct places in env->pstate
@@ -261,6 +262,7 @@ typedef struct CPUArchState {
  uint32_t btype;  /* BTI branch type.  spsr[11:10].  */
  uint64_t daif; /* exception masks, in the bits they are in PSTATE */
  uint64_t svcr; /* PSTATE.{SM,ZA} in the bits they are in SVCR */
+uint64_t allint; /* All IRQ or FIQ interrupt mask, in the bit in PSTATE */
  


I still think you should keep this bit in env->pstate.


r~



Re: [PATCH] atomic.h: Reword confusing comment for qatomic_cmpxchg

2024-02-23 Thread Jonathan Cameron via
On Fri, 23 Feb 2024 08:21:42 -1000
Richard Henderson  wrote:

> On 2/23/24 08:20, Peter Maydell wrote:
> > The qatomic_cmpxchg() and qatomic_cmpxchg__nocheck() macros have
> > a comment that reads:
> >   Returns the eventual value, failed or not
> > 
> > This is somewhere between cryptic and wrong, since the value actually
> > returned is the value that was in memory before the cmpxchg.  Reword
> > to match how we describe these macros in atomics.rst.
> > 
> > Signed-off-by: Peter Maydell 
> > ---
> >   include/qemu/atomic.h | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
> > index f1d3d1702a9..99110abefb3 100644
> > --- a/include/qemu/atomic.h
> > +++ b/include/qemu/atomic.h
> > @@ -202,7 +202,7 @@
> >   qatomic_xchg__nocheck(ptr, i);  \
> >   })
> >   
> > -/* Returns the eventual value, failed or not */
> > +/* Returns the old value of '*ptr' (whether the cmpxchg failed or not) */
> >   #define qatomic_cmpxchg__nocheck(ptr, old, new)({   \
> >   typeof_strip_qual(*ptr) _old = (old);   \
> >   (void)__atomic_compare_exchange_n(ptr, &_old, new, false,   \ 
> >  
> 
> Reviewed-by: Richard Henderson 
Reviewed-by: Jonathan Cameron 

As the person it confused ;)
> 
> r~




[PATCH v5 0/3] Add device STM32L4x5 GPIO

2024-02-23 Thread Inès Varhol
This patch adds a new device STM32L4x5 GPIO device and is part
of a series implementing the STM32L4x5 with a few peripherals.

Changes from v4 :
- gpio.c : use helpers `is_pull_up()`, `is_pull_down()`, `is_output()`
for more clarity
- gpio.c : correct `update_gpio_idr()` in case of open-drain pin
set to 1 in ODR and set to 0 externally
- gpio.c : rename `get_gpio_pins_to_disconnect()` to
`get_gpio_pinmask_to_disconnect()` and associated comments
- gpio.c : correct coding style issues (alignment and declaration)
- soc.c : unite structs `gpio_addr` and `stm32l4x5_gpio_initval`

Changes from v3 :
- replacing occurences of '16' with the correct macro `GPIO_NUM_PINS`
- updating copyright year
- rebasing on latest version of STM32L4x5 RCC

Changes from v2 :
- correct memory leaks caused by re-assigning a `g_autofree`
pointer without freeing it
- gpio-test : test that reset values (and not just initialization
values) are correct, correct `stm32l4x5_gpio_reset()` accordingly
- adding a `clock-freq-hz` object property to test that
enabling GPIO clock in RCC sets the GPIO clocks

Changes from v1 :
- replacing test GPIO register `DISCONNECTED_PINS` with an object
property accessed using `qtest_qmp()` in the qtest (through helpers
`get_disconnected_pins()` and `disconnect_all_pins()`)
- removing GPIO subclasses and storing MODER, OSPEEDR and PUPDR reset
values in properties
- adding a `name` property and using it for more lisible traces
- using `g_strdup_printf()` to facilitate setting irqs in the qtest,
and initializing GPIO children in soc_initfn

Changes from RFC v1 :
- `stm32l4x5-gpio-test.c` : correct typos, make the test generic,
add a test for bitwise writing in register ODR
- `stm32l4x5_soc.c` : connect gpios to their clock, use an
array of GpioState
- `stm32l4x5_gpio.c` : correct comments in `update_gpio_idr()`,
correct `get_gpio_pins_to_disconnect()`, correct `stm32l4x5_gpio_init()`
and initialize the clock, add a realize function
- update MAINAINERS

Based-on: 20240219200908.49551-1-arnaud.min...@telecom-paris.fr
([PATCH v5 0/8] Add device STM32L4x5 RCC)

Signed-off-by: Arnaud Minier 
Signed-off-by: Inès Varhol 

Inès Varhol (3):
  hw/gpio: Implement STM32L4x5 GPIO
  hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
  tests/qtest: Add STM32L4x5 GPIO QTest testcase

 MAINTAINERS|   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/arm/stm32l4x5_soc.h |   2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  70 
 hw/arm/stm32l4x5_soc.c |  68 +++-
 hw/gpio/stm32l4x5_gpio.c   | 477 +++
 tests/qtest/stm32l4x5_gpio-test.c  | 586 +
 hw/arm/Kconfig |   3 +-
 hw/gpio/Kconfig|   3 +
 hw/gpio/meson.build|   1 +
 hw/gpio/trace-events   |   6 +
 tests/qtest/meson.build|   3 +-
 12 files changed, 1205 insertions(+), 17 deletions(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

-- 
2.43.2




Re: [PATCH] atomic.h: Reword confusing comment for qatomic_cmpxchg

2024-02-23 Thread Richard Henderson

On 2/23/24 08:20, Peter Maydell wrote:

The qatomic_cmpxchg() and qatomic_cmpxchg__nocheck() macros have
a comment that reads:
  Returns the eventual value, failed or not

This is somewhere between cryptic and wrong, since the value actually
returned is the value that was in memory before the cmpxchg.  Reword
to match how we describe these macros in atomics.rst.

Signed-off-by: Peter Maydell 
---
  include/qemu/atomic.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index f1d3d1702a9..99110abefb3 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -202,7 +202,7 @@
  qatomic_xchg__nocheck(ptr, i);  \
  })
  
-/* Returns the eventual value, failed or not */

+/* Returns the old value of '*ptr' (whether the cmpxchg failed or not) */
  #define qatomic_cmpxchg__nocheck(ptr, old, new)({   \
  typeof_strip_qual(*ptr) _old = (old);   \
  (void)__atomic_compare_exchange_n(ptr, &_old, new, false,   \


Reviewed-by: Richard Henderson 

r~



[PATCH v5 2/3] hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC

2024-02-23 Thread Inès Varhol
Signed-off-by: Arnaud Minier 
Signed-off-by: Inès Varhol 
Reviewed-by: Philippe Mathieu-Daudé 
---
 include/hw/arm/stm32l4x5_soc.h |  2 +
 hw/arm/stm32l4x5_soc.c | 68 +++---
 hw/arm/Kconfig |  3 +-
 3 files changed, 58 insertions(+), 15 deletions(-)

diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index 1f71298b45..cb4da08629 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -29,6 +29,7 @@
 #include "hw/misc/stm32l4x5_syscfg.h"
 #include "hw/misc/stm32l4x5_exti.h"
 #include "hw/misc/stm32l4x5_rcc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "qom/object.h"
 
 #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -45,6 +46,7 @@ struct Stm32l4x5SocState {
 Stm32l4x5ExtiState exti;
 Stm32l4x5SyscfgState syscfg;
 Stm32l4x5RccState rcc;
+Stm32l4x5GpioState gpio[NUM_GPIOS];
 
 MemoryRegion sram1;
 MemoryRegion sram2;
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index 347a5377e5..be0f11dc1b 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -78,6 +78,22 @@ static const int exti_irq[NUM_EXTI_IRQ] = {
 #define RCC_BASE_ADDRESS 0x40021000
 #define RCC_IRQ 5
 
+static const struct {
+uint32_t addr;
+uint32_t moder_reset;
+uint32_t ospeedr_reset;
+uint32_t pupdr_reset;
+} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
+{ 0x4800, 0xABFF, 0x0C00, 0x6400 },
+{ 0x48000400, 0xFEBF, 0x, 0x0100 },
+{ 0x48000800, 0x, 0x, 0x },
+{ 0x48000C00, 0x, 0x, 0x },
+{ 0x48001000, 0x, 0x, 0x },
+{ 0x48001400, 0x, 0x, 0x },
+{ 0x48001800, 0x, 0x, 0x },
+{ 0x48001C00, 0x000F, 0x, 0x },
+};
+
 static void stm32l4x5_soc_initfn(Object *obj)
 {
 Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -85,6 +101,11 @@ static void stm32l4x5_soc_initfn(Object *obj)
 object_initialize_child(obj, "exti", >exti, TYPE_STM32L4X5_EXTI);
 object_initialize_child(obj, "syscfg", >syscfg, TYPE_STM32L4X5_SYSCFG);
 object_initialize_child(obj, "rcc", >rcc, TYPE_STM32L4X5_RCC);
+
+for (unsigned i = 0; i < NUM_GPIOS; i++) {
+g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
+object_initialize_child(obj, name, >gpio[i], TYPE_STM32L4X5_GPIO);
+}
 }
 
 static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -93,8 +114,9 @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, 
Error **errp)
 Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
 const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
 MemoryRegion *system_memory = get_system_memory();
-DeviceState *armv7m;
+DeviceState *armv7m, *dev;
 SysBusDevice *busdev;
+uint32_t pin_index;
 
 if (!memory_region_init_rom(>flash, OBJECT(dev_soc), "flash",
 sc->flash_size, errp)) {
@@ -135,17 +157,43 @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, 
Error **errp)
 return;
 }
 
+/* GPIOs */
+for (unsigned i = 0; i < NUM_GPIOS; i++) {
+g_autofree char *name = g_strdup_printf("%c", 'A' + i);
+dev = DEVICE(>gpio[i]);
+qdev_prop_set_string(dev, "name", name);
+qdev_prop_set_uint32(dev, "mode-reset",
+ stm32l4x5_gpio_cfg[i].moder_reset);
+qdev_prop_set_uint32(dev, "ospeed-reset",
+ stm32l4x5_gpio_cfg[i].ospeedr_reset);
+qdev_prop_set_uint32(dev, "pupd-reset",
+stm32l4x5_gpio_cfg[i].pupdr_reset);
+busdev = SYS_BUS_DEVICE(>gpio[i]);
+g_free(name);
+name = g_strdup_printf("gpio%c-out", 'a' + i);
+qdev_connect_clock_in(DEVICE(>gpio[i]), "clk",
+qdev_get_clock_out(DEVICE(&(s->rcc)), name));
+if (!sysbus_realize(busdev, errp)) {
+return;
+}
+sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
+}
+
 /* System configuration controller */
 busdev = SYS_BUS_DEVICE(>syscfg);
 if (!sysbus_realize(busdev, errp)) {
 return;
 }
 sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-/*
- * TODO: when the GPIO device is implemented, connect it
- * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
- * GPIO_NUM_PINS.
- */
+
+for (unsigned i = 0; i < NUM_GPIOS; i++) {
+for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
+pin_index = GPIO_NUM_PINS * i + j;
+qdev_connect_gpio_out(DEVICE(>gpio[i]), j,
+  qdev_get_gpio_in(DEVICE(>syscfg),
+  pin_index));
+}
+}
 
 /* EXTI device */
 busdev = SYS_BUS_DEVICE(>exti);
@@ -242,14 +290,6 @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, 
Error **errp)
 /* RESERVED:0x40024400, 0x7FDBC00 */
 
   

[PATCH v5 1/3] hw/gpio: Implement STM32L4x5 GPIO

2024-02-23 Thread Inès Varhol
Features supported :
- the 8 STM32L4x5 GPIOs are initialized with their reset values
(except IDR, see below)
- input mode : setting a pin in input mode "externally" (using input
irqs) results in an out irq (transmitted to SYSCFG)
- output mode : setting a bit in ODR sets the corresponding out irq
(if this line is configured in output mode)
- pull-up, pull-down
- push-pull, open-drain

Difference with the real GPIOs :
- Alternate Function and Analog mode aren't implemented :
pins in AF/Analog behave like pins in input mode
- floating pins stay at their last value
- register IDR reset values differ from the real one :
values are coherent with the other registers reset values
and the fact that AF/Analog modes aren't implemented
- setting I/O output speed isn't supported
- locking port bits isn't supported
- ADC function isn't supported
- GPIOH has 16 pins instead of 2 pins
- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective

Signed-off-by: Arnaud Minier 
Signed-off-by: Inès Varhol 
Reviewed-by: Philippe Mathieu-Daudé 
---
 MAINTAINERS|   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/gpio/stm32l4x5_gpio.h   |  70 +
 hw/gpio/stm32l4x5_gpio.c   | 477 +
 hw/gpio/Kconfig|   3 +
 hw/gpio/meson.build|   1 +
 hw/gpio/trace-events   |   6 +
 7 files changed, 559 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 50ab2982bb..cf49c151f3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1131,6 +1131,7 @@ F: hw/arm/stm32l4x5_soc.c
 F: hw/misc/stm32l4x5_exti.c
 F: hw/misc/stm32l4x5_syscfg.c
 F: hw/misc/stm32l4x5_rcc.c
+F: hw/gpio/stm32l4x5_gpio.c
 F: include/hw/*/stm32l4x5_*.h
 
 B-L475E-IOT01A IoT Node
diff --git a/docs/system/arm/b-l475e-iot01a.rst 
b/docs/system/arm/b-l475e-iot01a.rst
index b857a56ca4..0afef8e4f4 100644
--- a/docs/system/arm/b-l475e-iot01a.rst
+++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -18,6 +18,7 @@ Currently B-L475E-IOT01A machine's only supports the 
following devices:
 - STM32L4x5 EXTI (Extended interrupts and events controller)
 - STM32L4x5 SYSCFG (System configuration controller)
 - STM32L4x5 RCC (Reset and clock control)
+- STM32L4x5 GPIOs (General-purpose I/Os)
 
 Missing devices
 """
@@ -25,7 +26,6 @@ Missing devices
 The B-L475E-IOT01A does *not* support the following devices:
 
 - Serial ports (UART)
-- General-purpose I/Os (GPIO)
 - Analog to Digital Converter (ADC)
 - SPI controller
 - Timer controller (TIMER)
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
new file mode 100644
index 00..0d361f3410
--- /dev/null
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -0,0 +1,70 @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier 
+ * Copyright (c) 2024 Inès Varhol 
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * 
https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#ifndef HW_STM32L4X5_GPIO_H
+#define HW_STM32L4X5_GPIO_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
+OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
+
+#define GPIO_NUM_PINS 16
+
+struct Stm32l4x5GpioState {
+SysBusDevice parent_obj;
+
+MemoryRegion mmio;
+
+/* GPIO registers */
+uint32_t moder;
+uint32_t otyper;
+uint32_t ospeedr;
+uint32_t pupdr;
+uint32_t idr;
+uint32_t odr;
+uint32_t lckr;
+uint32_t afrl;
+uint32_t afrh;
+uint32_t ascr;
+
+/* GPIO registers reset values */
+uint32_t moder_reset;
+uint32_t ospeedr_reset;
+uint32_t pupdr_reset;
+
+/*
+ * External driving of pins.
+ * The pins can be set externally through the device
+ * anonymous input GPIOs lines under certain conditions.
+ * The pin must not be in push-pull output mode,
+ * and can't be set high in open-drain mode.
+ * Pins driven externally and configured to
+ * output mode will in general be "disconnected"
+ * (see `get_gpio_pinmask_to_disconnect()`)
+ */
+uint16_t disconnected_pins;
+uint16_t pins_connected_high;
+
+char *name;
+Clock *clk;
+qemu_irq pin[GPIO_NUM_PINS];
+};
+
+#endif
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
new file mode 100644
index 00..63b8763e9d
--- /dev/null
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -0,0 +1,477 @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier 
+ * Copyright (c) 2024 

[PATCH] atomic.h: Reword confusing comment for qatomic_cmpxchg

2024-02-23 Thread Peter Maydell
The qatomic_cmpxchg() and qatomic_cmpxchg__nocheck() macros have
a comment that reads:
 Returns the eventual value, failed or not

This is somewhere between cryptic and wrong, since the value actually
returned is the value that was in memory before the cmpxchg.  Reword
to match how we describe these macros in atomics.rst.

Signed-off-by: Peter Maydell 
---
 include/qemu/atomic.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index f1d3d1702a9..99110abefb3 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -202,7 +202,7 @@
 qatomic_xchg__nocheck(ptr, i);  \
 })
 
-/* Returns the eventual value, failed or not */
+/* Returns the old value of '*ptr' (whether the cmpxchg failed or not) */
 #define qatomic_cmpxchg__nocheck(ptr, old, new)({   \
 typeof_strip_qual(*ptr) _old = (old);   \
 (void)__atomic_compare_exchange_n(ptr, &_old, new, false,   \
-- 
2.34.1




[PATCH v5 3/3] tests/qtest: Add STM32L4x5 GPIO QTest testcase

2024-02-23 Thread Inès Varhol
The testcase contains :
- `test_idr_reset_value()` :
Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
- `test_gpio_output_mode()` :
Checks that writing a bit in register ODR results in the corresponding
pin rising or lowering, if this pin is configured in output mode.
- `test_gpio_input_mode()` :
Checks that a input pin set high or low externally results
in the pin rising and lowering.
- `test_pull_up_pull_down()` :
Checks that a floating pin in pull-up/down mode is actually high/down.
- `test_push_pull()` :
Checks that a pin set externally is disconnected when configured in
push-pull output mode, and can't be set externally while in this mode.
- `test_open_drain()` :
Checks that a pin set externally high is disconnected when configured
in open-drain output mode, and can't be set high while in this mode.
- `test_bsrr_brr()` :
Checks that writing to BSRR and BRR has the desired result in ODR.
- `test_clock_enable()` :
Checks that GPIO clock is at the right frequency after enabling it.

Acked-by: Thomas Huth 
Signed-off-by: Arnaud Minier 
Signed-off-by: Inès Varhol 
---
 tests/qtest/stm32l4x5_gpio-test.c | 586 ++
 tests/qtest/meson.build   |   3 +-
 2 files changed, 588 insertions(+), 1 deletion(-)
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

diff --git a/tests/qtest/stm32l4x5_gpio-test.c 
b/tests/qtest/stm32l4x5_gpio-test.c
new file mode 100644
index 00..cd4fd9bae2
--- /dev/null
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -0,0 +1,586 @@
+/*
+ * QTest testcase for STM32L4x5_GPIO
+ *
+ * Copyright (c) 2024 Arnaud Minier 
+ * Copyright (c) 2024 Inès Varhol 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+#define GPIO_BASE_ADDR 0x4800
+#define GPIO_SIZE  0x400
+#define NUM_GPIOS  8
+#define NUM_GPIO_PINS  16
+
+#define GPIO_A 0x4800
+#define GPIO_B 0x48000400
+#define GPIO_C 0x48000800
+#define GPIO_D 0x48000C00
+#define GPIO_E 0x48001000
+#define GPIO_F 0x48001400
+#define GPIO_G 0x48001800
+#define GPIO_H 0x48001C00
+
+/*
+ * MSI is used as system clock source after startup
+ * from Reset, configured at 4 MHz.
+ */
+#define SYSCLK_FREQ_HZ 400
+#define RCC_AHB2ENR 0x4002104C
+
+#define MODER 0x00
+#define OTYPER 0x04
+#define PUPDR 0x0C
+#define IDR 0x10
+#define ODR 0x14
+#define BSRR 0x18
+#define BRR 0x28
+
+#define MODER_INPUT 0
+#define MODER_OUTPUT 1
+
+#define PUPDR_NONE 0
+#define PUPDR_PULLUP 1
+#define PUPDR_PULLDOWN 2
+
+#define OTYPER_PUSH_PULL 0
+#define OTYPER_OPEN_DRAIN 1
+
+const uint32_t moder_reset[NUM_GPIOS] = {
+0xABFF,
+0xFEBF,
+0x,
+0x,
+0x,
+0x,
+0x,
+0x000F
+};
+
+const uint32_t pupdr_reset[NUM_GPIOS] = {
+0x6400,
+0x0100,
+0x,
+0x,
+0x,
+0x,
+0x,
+0x
+};
+
+const uint32_t idr_reset[NUM_GPIOS] = {
+0xA000,
+0x0010,
+0x,
+0x,
+0x,
+0x,
+0x,
+0x
+};
+
+static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
+{
+return readl(gpio + offset);
+}
+
+static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
+{
+writel(gpio + offset, value);
+}
+
+static void gpio_set_bit(unsigned int gpio, unsigned int reg,
+ unsigned int pin, uint32_t value)
+{
+uint32_t mask = 0x & ~(0x1 << pin);
+gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
+}
+
+static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
+   unsigned int pin, uint32_t value)
+{
+uint32_t offset = 2 * pin;
+uint32_t mask = 0x & ~(0x3 << offset);
+gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
+}
+
+static unsigned int get_gpio_id(uint32_t gpio_addr)
+{
+return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
+}
+
+static void gpio_set_irq(unsigned int gpio, int num, int level)
+{
+g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
+get_gpio_id(gpio) + 'a');
+qtest_set_irq_in(global_qtest, name, NULL, num, level);
+}
+
+static void disconnect_all_pins(unsigned int gpio)
+{
+g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+get_gpio_id(gpio) + 'a');
+QDict *r;
+
+r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
+"{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
+path, 0x);
+g_assert_false(qdict_haskey(r, "error"));
+qobject_unref(r);
+}
+
+static uint32_t get_disconnected_pins(unsigned int gpio)
+{
+g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+   

Re: [PATCH v3] arm/ptw: Handle atomic updates of page tables entries in MMIO during PTW.

2024-02-23 Thread Richard Henderson

On 2/23/24 08:01, Jonathan Cameron wrote:

Seen testing of CXL emulation on arm64 (currently out of tree).

CXL interleave occurs at subpage granularity so is emulated using an IO
Memory Region. The memory is general purpose and as such may contain page
tables. FEAT_HADFS using atomic accesses from the page table walkers to
update accessed and dirty bits.

Note that disabling kernel support this ARM 8.1 feature avoids this issue
as the PTW no longer does an atomic update of the page table entries, but
that is a nasty workaround beyond its use in root causing this issue.

Signed-off-by: Jonathan Cameron
---


Reviewed-by: Richard Henderson 

r~



Re: [PATCH v2 7/7] hw/intc: Check @errp to handle the error of IOAPICCommonClass.realize()

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 09:56, Zhao Liu wrote:

From: Zhao Liu 

IOAPICCommonClass implements its own private realize(), and this private
realize() allows error.

Since IOAPICCommonClass.realize() returns void, to check the error,
dereference @errp with ERRP_GUARD().

Signed-off-by: Zhao Liu 
---
v2:
  * Add the missing ERRP_GUARD(). (Markus)
  * Move this single patch into @errp fixing series. (Micheal)
---
  hw/intc/ioapic_common.c | 4 
  1 file changed, 4 insertions(+)


Reviewed-by: Philippe Mathieu-Daudé 




Re: [PATCH V5 1/5] util: str_split

2024-02-23 Thread Steven Sistare
On 2/23/2024 12:41 PM, Philippe Mathieu-Daudé wrote:
> On 23/2/24 15:01, Steven Sistare wrote:
>> On 2/23/2024 1:01 AM, Philippe Mathieu-Daudé wrote:
>>> On 22/2/24 22:47, Steve Sistare wrote:
 Generalize hmp_split_at_comma() to take any delimiter string, rename
 as str_split(), and move it to util/strList.c.

 No functional change.

 Signed-off-by: Steve Sistare 
 ---
    include/monitor/hmp.h  |  1 -
    include/qemu/strList.h | 24 
    monitor/hmp-cmds.c | 19 ---
    net/net-hmp-cmds.c |  3 ++-
    stats/stats-hmp-cmds.c |  3 ++-
    util/meson.build   |  1 +
    util/strList.c | 24 
    7 files changed, 53 insertions(+), 22 deletions(-)
    create mode 100644 include/qemu/strList.h
    create mode 100644 util/strList.c
>>>
>>>
 +#include "qapi/qapi-builtin-types.h"
 +
 +/*
 + * Split @str into a strList using the delimiter string @delim.
 + * The delimiter is not included in the result.
 + * Return NULL if @str is NULL or an empty string.
 + * A leading, trailing, or consecutive delimiter produces an
 + * empty string at that position in the output.
 + * All strings are g_strdup'd, and the result can be freed
 + * using qapi_free_strList.
>>>
>>> Note "qapi/qapi-builtin-types.h" defines:
>>>
>>>    G_DEFINE_AUTOPTR_CLEANUP_FUNC(strList, qapi_free_strList)
>>>
>>> Maybe mention we can also use:
>>>
>>>    g_autoptr(strList)
>>
>> Thanks Philippe.  If we get to V6 for this series, I will mention this,
>> and also mention g_autoptr(GStrv) in the header comment for 
>> strv_from_strlist.
> 
> If there is no need for v6, do you mind sharing here what would be
> the resulting comment? Maybe Markus can update it directly...
> (assuming he takes your series).

Sure - steve


diff --git a/include/qemu/strList.h b/include/qemu/strList.h
index c1eb1dd..b13bd53 100644
--- a/include/qemu/strList.h
+++ b/include/qemu/strList.h
@@ -17,13 +17,16 @@
  * A leading, trailing, or consecutive delimiter produces an
  * empty string at that position in the output.
  * All strings are g_strdup'd, and the result can be freed
- * using qapi_free_strList.
+ * using qapi_free_strList, or by declaring a local variable
+ * with g_autoptr(strList).
  */
 strList *str_split(const char *str, const char *delim);

 /*
  * Produce and return a NULL-terminated array of strings from @list.
- * The result is g_malloc'd and all strings are g_strdup'd.
+ * The result is g_malloc'd and all strings are g_strdup'd.  The result
+ * can be freed using g_strfreev, or by declaring a local variable with
+ * g_auto(GStrv).
  */
 char **strv_from_strList(const strList *list);





Re: [RFC PATCH v2] arm/ptw: Handle atomic updates of page tables entries in MMIO during PTW.

2024-02-23 Thread Peter Maydell
On Fri, 23 Feb 2024 at 10:02, Peter Maydell  wrote:
>
> On Thu, 22 Feb 2024 at 21:21, Richard Henderson
>  wrote:
> >
> > On 2/19/24 06:12, Jonathan Cameron wrote:
> > > I'm far from confident this handling here is correct. Hence
> > > RFC.  In particular not sure on what locks I should hold for this
> > > to be even moderately safe.
> > >
> > > The function already appears to be inconsistent in what it returns
> > > as the CONFIG_ATOMIC64 block returns the endian converted 'eventual'
> > > value of the cmpxchg whereas the TCG_OVERSIZED_GUEST case returns
> > > the previous value.
>
> I think this is a bug in the TCG_OVERSIZED_GUEST handling,
> which we've never noticed because you only see that case
> on a 32-bit host.

Having looked through the code and talked to Richard on IRC,
I think that the TCG_OVERSIZED_GUEST handling is correct.
The return value of qatomic_cmpxchg__nocheck() is the value
that was in memory before the cmpxchg. So the TCG_OVERSIZED_GUEST
code's semantics are the same as the normal path. (The comment on
qatomic_cmpxchg__nocheck() that describes this as the
"eventual value" is rather confusing so we should improve that.)

thanks
-- PMM



Re: [PATCH v4 00/10] Enabling DCD emulation support in Qemu

2024-02-23 Thread fan
On Wed, Feb 21, 2024 at 10:15:53AM -0800, nifan@gmail.com wrote:
> From: Fan Ni 
> 
> v3[1]->v4: 
> 
> The code is rebased on mainstream QEMU with the following patch series:
> 
> hw/cxl/mailbox: change CCI cmd set structure to be a member, not a reference
> hw/cxl/mailbox: interface to add CCI commands to an existing CCI
> 
> Main changes include:
> 
> 1. Updated the specification references to align with cxl spec r3.1.
> 2. Add extra elements to get dc region configuration output payload and
> procecced accordingly in mailbox command 4800h.
> 3. Removed the unwanted space.
> 4. Refactored ct3_build_cdat_entries_for_mr and extract it as a separate 
> patch.
> 5. Updated cxl_create_dc_regions function to derive region len from host
> backend size.
> 6. Changed the logic for creating DC regions when host backend and address
> space processing is introduced, now cxl_create_dc_regions is called only
> when host backend exists.
> 7. Updated the name of the definitions related to DC extents for consistency.
> 7. Updated dynamic capacity event record definition to align with spec r3.1.
> 9. Changed the dynamic capacity request process logic, for release request,
> extra checks are done against the pending list to remove the extent yet added.
> 10. Changed the return value of cxl_create_dc_regions so the return can be 
> used
> to Remove the extent for the list if needed.
> 11. offset and size in the qmp interface are changed to be byte-wise while the
> original is MiB-wise.
> 12. Fixed bugs in handling bitmap for dpa range existence.
> 13. NOTE: in previous version DC is set to non-volatile, while in this version
> we change it to volatile per Jonathan's suggestion.
> 14. Updated the doc in qapi/cxl.json.
> 
> Thank Jonathan for the detailed review of the last version[1].
> 
> The code is tested with Ira's last kernel DCD patch set [2] with some minor
> bug fixes[3]. Tested operations include:
> 1. create DC region;
> 2. Add/release DC extents;
> 3. convert DC capacity into system RAM (no real read/write to DCD tested);
> 
> 
> v3: 
> [1] 
> https://lore.kernel.org/linux-cxl/20231107180907.553451-1-nifan@gmail.com/T/#t
> [2] https://github.com/weiny2/linux-kernel/tree/dcd-v3-2023-10-30
> [3] 
> https://github.com/moking/linux-dcd/commit/9d24fa6e5d39f934623220953caecc080f93e964
> 
> Fan Ni (10):
>   hw/cxl/cxl-mailbox-utils: Add dc_event_log_size field to output
> payload of identify memory device command
>   hw/cxl/cxl-mailbox-utils: Add dynamic capacity region representative
> and mailbox command support
>   include/hw/cxl/cxl_device: Rename mem_size as static_mem_size for
> type3 memory devices
>   hw/mem/cxl_type3: Add support to create DC regions to type3 memory
> devices
>   hw/mem/cxl-type3: Refactor ct3_build_cdat_entries_for_mr to take mr
> size insead of mr as argument
>   hw/mem/cxl_type3: Add host backend and address space handling for DC
> regions
>   hw/mem/cxl_type3: Add DC extent list representative and get DC extent
> list mailbox support
>   hw/cxl/cxl-mailbox-utils: Add mailbox commands to support add/release
> dynamic capacity response
>   hw/cxl/events: Add qmp interfaces to add/release dynamic capacity
> extents
>   hw/mem/cxl_type3: Add dpa range validation for accesses to DC regions
> 
>  hw/cxl/cxl-mailbox-utils.c  | 507 +++-
>  hw/mem/cxl_type3.c  | 559 +---
>  hw/mem/cxl_type3_stubs.c|  14 +
>  include/hw/cxl/cxl_device.h |  61 +++-
>  include/hw/cxl/cxl_events.h |  18 ++
>  qapi/cxl.json   |  61 +++-
>  6 files changed, 1174 insertions(+), 46 deletions(-)
> 
> -- 
> 2.43.0
> 

Hi,

I fixed some issues mentioned by Wonjae Lee (wj28@gmail.com) in his
review comments and pushed the changes to my local tree:
https://github.com/moking/qemu/tree/dcd-v4

This is no functional changes to the code, mainly fixes include:
1. Did spell check for the patchset and fixed 2 typos;
2. Fixed a misuse of stq_le_p and replaced it with stl_le_p in
cmd_dcd_get_dyn_cap_config;
3. Removed unnecessary switch case in patch 9;
4. Capitalized ""opcode" to "Opcode" in two code comments;
5. Updated one reference text to the spec;
6. Minor text change in qapi/cxl.json.

Thanks Wonjae for the careful review.


I will wait until next week to send out v5 to see if there are further
comments to come in.

Fan




[PATCH v3] arm/ptw: Handle atomic updates of page tables entries in MMIO during PTW.

2024-02-23 Thread Jonathan Cameron via
Seen testing of CXL emulation on arm64 (currently out of tree).

CXL interleave occurs at subpage granularity so is emulated using an IO
Memory Region. The memory is general purpose and as such may contain page
tables. FEAT_HADFS using atomic accesses from the page table walkers to
update accessed and dirty bits.

Note that disabling kernel support this ARM 8.1 feature avoids this issue
as the PTW no longer does an atomic update of the page table entries, but
that is a nasty workaround beyond its use in root causing this issue.

Signed-off-by: Jonathan Cameron 
---

v3: Thanks Richard and Peter for reviewing.
Much simpler error handle + use of BQL_LOCK_GUARD() (Richard)
Dropped RFC and updated description as seems this is converging!
---
 target/arm/ptw.c | 31 +--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 5eb3577bcd..140afed451 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -711,8 +711,35 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t 
old_val,
 void *host = ptw->out_host;
 
 if (unlikely(!host)) {
-fi->type = ARMFault_UnsuppAtomicUpdate;
-return 0;
+/* Page table in MMIO Memory Region */
+CPUState *cs = env_cpu(env);
+MemTxAttrs attrs = {
+.space = ptw->out_space,
+.secure = arm_space_is_secure(ptw->out_space),
+};
+AddressSpace *as = arm_addressspace(cs, attrs);
+MemTxResult result = MEMTX_OK;
+BQL_LOCK_GUARD();
+
+cur_val = (ptw->out_be
+   ? address_space_ldq_be(as, ptw->out_phys, attrs, )
+   : address_space_ldq_le(as, ptw->out_phys, attrs, ));
+if (result == MEMTX_OK && cur_val == old_val) {
+if (ptw->out_be) {
+address_space_stq_be(as, ptw->out_phys, new_val, attrs,
+ );
+} else {
+address_space_stq_le(as, ptw->out_phys, new_val, attrs,
+ );
+}
+}
+if (unlikely(result != MEMTX_OK)) {
+fi->type = ARMFault_SyncExternalOnWalk;
+fi->ea = arm_extabort_type(result);
+return old_val;
+}
+
+return cur_val;
 }
 
 /*
-- 
2.39.2




Re: [PATCH v2 0/7] target/i386: Fix physical address masking bugs

2024-02-23 Thread Michael Brown

On 23/02/2024 13:09, Paolo Bonzini wrote:

The address translation logic in get_physical_address() will currently
truncate physical addresses to 32 bits unless long mode is enabled.
This is incorrect when using physical address extensions (PAE) outside
of long mode, with the result that a 32-bit operating system using PAE
to access memory above 4G will experience undefined behaviour.
Instead, truncation must be applied to the linear address.  Because
this truncation is diffent between 32- and 64-bit modes, the series
opts to split 32- and 64-bit modes to separate MMU indices, which is
the simplest way to ensure that, for example, a kernel that runs both
32-bit and 64-bit programs looks up the correct address in the
(64-bit) page tables.

Furthermore, when inspecting the code I noticed that the A20 mask is
applied incorrectly when NPT is active.  The mask should not be applied
to the addresses that are looked up in the NPT, only to the physical
addresses.  Obviously no hypervisor is going to leave A20 masking on,
but the code actually becomes simpler so let's do it.

Patches 1 and 2 fix cases in which the addresses must be masked,
or overflow is otherwise invalid, for MMU_PHYS_IDX accesses.

Patches 3 and 4 introduce separate MMU indexes for 32- and 64-bit
accesses.

Patch 5 fixes the bug, by limiting the masking to the 32-bit MMU indexes.

Patches 6 and 7 further clean up the MMU functions to centralize
application of the A20 mask and fix bugs in the process.

Tested with kvm-unit-tests SVM tests and with an old 32-bit Debian image.

Paolo Bonzini (7):
   target/i386: mask high bits of CR3 in 32-bit mode
   target/i386: check validity of VMCB addresses
   target/i386: introduce function to query MMU indices
   target/i386: use separate MMU indexes for 32-bit accesses
   target/i386: Fix physical address truncation
   target/i386: remove unnecessary/wrong application of the A20 mask
   target/i386: leave the A20 bit set in the final NPT walk

  target/i386/cpu.h| 46 +++-
  target/i386/cpu.c|  9 +++--
  target/i386/tcg/sysemu/excp_helper.c | 52 +---
  target/i386/tcg/sysemu/misc_helper.c |  3 ++
  target/i386/tcg/sysemu/svm_helper.c  | 27 +++
  5 files changed, 92 insertions(+), 45 deletions(-)


Thank you for putting in the work to fix this all up!

I confirm that this patch series resolves the issue that I originally 
observed in https://gitlab.com/qemu-project/qemu/-/issues/2040 and that 
Windows 10 32-bit is able to boot with PAE enabled and memory over 4G.


Tested-by: Michael Brown 

Thanks,

Michael





Re: [PATCH v2 4/7] hw/misc/xlnx-versal-trng: Check returned bool in trng_prop_fault_event_set()

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 09:56, Zhao Liu wrote:

From: Zhao Liu 

As the comment in qapi/error, dereferencing @errp requires
ERRP_GUARD():

* = Why, when and how to use ERRP_GUARD() =
*
* Without ERRP_GUARD(), use of the @errp parameter is restricted:
* - It must not be dereferenced, because it may be null.
...
* ERRP_GUARD() lifts these restrictions.
*
* To use ERRP_GUARD(), add it right at the beginning of the function.
* @errp can then be used without worrying about the argument being
* NULL or _fatal.
*
* Using it when it's not needed is safe, but please avoid cluttering
* the source with useless code.

But in trng_prop_fault_event_set, @errp is dereferenced without
ERRP_GUARD():

visit_type_uint32(v, name, events, errp);
if (*errp) {
 return;
}

Currently, since trng_prop_fault_event_set() doesn't get the NULL @errp
parameter as a "set" method of object property, it hasn't triggered the
bug that dereferencing the NULL @errp.

And since visit_type_uint32() returns bool, check the returned bool
directly instead of dereferencing @errp, then we needn't the add missing
ERRP_GUARD().

Suggested-by: Markus Armbruster 
Signed-off-by: Zhao Liu 
---
Suggested by credit:
  Markus: Referred his explanation about ERRP_GUARD().
---
v2:
  * Add the @errp dereference code in commit message to make review
easier. (Markus)
  * Check the returned bool instead of dereferencing @errp. (Markus)
---
  hw/misc/xlnx-versal-trng.c | 3 +--
  1 file changed, 1 insertion(+), 2 deletions(-)


Reviewed-by: Philippe Mathieu-Daudé 




Re: [PATCH v3 0/3] nubus: add nubus-virtio-mmio device

2024-02-23 Thread Philippe Mathieu-Daudé

On 11/1/24 11:29, Mark Cave-Ayland wrote:


Mark Cave-Ayland (3):
   nubus-device: round Declaration ROM memory region address to
 qemu_target_page_size()
   nubus.h: increase maximum Declaration ROM size from 128k to 1Mb
   nubus: add nubus-virtio-mmio device


Thanks, series queued.



Re: [PATCH v3 2/3] qga/commands-win32: Do not set matrix_lookup_t/win_10_0_t arrays size

2024-02-23 Thread Philippe Mathieu-Daudé

On 22/2/24 16:28, Philippe Mathieu-Daudé wrote:

ga_get_win_name() iterates over all elements in the arrays by
checking the 'version' field is non-NULL. Since the arrays are
guarded by a NULL terminating element, we don't need to specify
their size:

   static char *ga_get_win_name(...)
   {
   ...
   const ga_matrix_lookup_t *table = WIN_VERSION_MATRIX[tbl_idx];
   const ga_win_10_0_t *win_10_0_table = ...
   ...
   while (table->version != NULL) {
 ^^^
   while (win_10_0_table->version != NULL) {
  ^^^

This will simplify maintenance when adding new entries to these
arrays.

Signed-off-by: Philippe Mathieu-Daudé 
---
  qga/commands-win32.c | 19 +--
  1 file changed, 9 insertions(+), 10 deletions(-)




  typedef struct _ga_win_10_0_t {
  int first_build;
-const char *version;
-const char *version_id;
+char const *version;
+char const *version_id;


Oops, missed rebase.


  } ga_win_10_0_t;




Re: [PATCH 07/10] pseries: do not require CONFIG_USB

2024-02-23 Thread Paolo Bonzini
On Fri, Feb 23, 2024 at 6:33 PM Philippe Mathieu-Daudé
 wrote:
>
> On 23/2/24 13:44, Paolo Bonzini wrote:
> > With --without-default-devices it is possible to build a binary that
> > does not include any USB host controller and therefore that does not
> > include the code guarded by CONFIG_USB.  While the simpler creation
> > functions such as usb_create_simple can be inlined, this is not true
> > of usb_bus_find().  Remove it, replacing it with a search of the single
> > USB bus on the machine.
> >
> > Suggested-by: Philippe Mathieu-Daudé 
> > Signed-off-by: Paolo Bonzini 
> > ---
> >   hw/ppc/spapr.c | 7 +++
> >   hw/ppc/Kconfig | 1 +
> >   2 files changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> > index 0d72d286d80..44d339982da 100644
> > --- a/hw/ppc/spapr.c
> > +++ b/hw/ppc/spapr.c
> > @@ -3024,10 +3024,9 @@ static void spapr_machine_init(MachineState *machine)
> >   }
> >
> >   if (has_vga) {
>
> Pre-existing, don't we want defaults_enabled() instead of has_vga here?

Yeah, but I am not sure it can be changed since pseries machine types
are versioned.

Paolo




Re: [PATCH v3 0/3] nubus: add nubus-virtio-mmio device

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 15:47, Laurent Vivier wrote:

Le 11/01/2024 à 11:29, Mark Cave-Ayland a écrit :




Mark Cave-Ayland (3):
   nubus-device: round Declaration ROM memory region address to
 qemu_target_page_size()
   nubus.h: increase maximum Declaration ROM size from 128k to 1Mb
   nubus: add nubus-virtio-mmio device

  hw/nubus/meson.build |   1 +
  hw/nubus/nubus-device.c  |  18 +++--
  hw/nubus/nubus-virtio-mmio.c | 102 +++
  include/hw/nubus/nubus-virtio-mmio.h |  36 ++
  include/hw/nubus/nubus.h |   2 +-
  5 files changed, 154 insertions(+), 5 deletions(-)
  create mode 100644 hw/nubus/nubus-virtio-mmio.c
  create mode 100644 include/hw/nubus/nubus-virtio-mmio.h



Series Reviewed-by: Laurent Vivier 


Since patch tools didn't processed your tag:
Reviewed-by: Laurent Vivier 




Re: [PATCH V5 1/5] util: str_split

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 15:01, Steven Sistare wrote:

On 2/23/2024 1:01 AM, Philippe Mathieu-Daudé wrote:

On 22/2/24 22:47, Steve Sistare wrote:

Generalize hmp_split_at_comma() to take any delimiter string, rename
as str_split(), and move it to util/strList.c.

No functional change.

Signed-off-by: Steve Sistare 
---
   include/monitor/hmp.h  |  1 -
   include/qemu/strList.h | 24 
   monitor/hmp-cmds.c | 19 ---
   net/net-hmp-cmds.c |  3 ++-
   stats/stats-hmp-cmds.c |  3 ++-
   util/meson.build   |  1 +
   util/strList.c | 24 
   7 files changed, 53 insertions(+), 22 deletions(-)
   create mode 100644 include/qemu/strList.h
   create mode 100644 util/strList.c




+#include "qapi/qapi-builtin-types.h"
+
+/*
+ * Split @str into a strList using the delimiter string @delim.
+ * The delimiter is not included in the result.
+ * Return NULL if @str is NULL or an empty string.
+ * A leading, trailing, or consecutive delimiter produces an
+ * empty string at that position in the output.
+ * All strings are g_strdup'd, and the result can be freed
+ * using qapi_free_strList.


Note "qapi/qapi-builtin-types.h" defines:

   G_DEFINE_AUTOPTR_CLEANUP_FUNC(strList, qapi_free_strList)

Maybe mention we can also use:

   g_autoptr(strList)


Thanks Philippe.  If we get to V6 for this series, I will mention this,
and also mention g_autoptr(GStrv) in the header comment for strv_from_strlist.


If there is no need for v6, do you mind sharing here what would be
the resulting comment? Maybe Markus can update it directly...
(assuming he takes your series).




Re: [PATCH] ui/cocoa: Fix incorrect window clipping on macOS Sonoma

2024-02-23 Thread David Parsons
Hi Akihiko

I’ve re-worked the patch to match your suggestion. I have compiled
and tested it on Sonoma and Monterey and both builds worked correctly.

New patch is below. I’m new to sending patches to QEMU so please let 
me know if I need to do anything else to get it incorporated into the
repo.

Dave 

diff --git a/ui/cocoa.m b/ui/cocoa.m
index eb99064bee..bbf9704b8c 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -54,6 +54,10 @@
 #define MAC_OS_X_VERSION_10_13 101300
 #endif
 
+#ifndef MAC_OS_VERSION_14_0
+#define MAC_OS_VERSION_14_0 14
+#endif
+
 /* 10.14 deprecates NSOnState and NSOffState in favor of
  * NSControlStateValueOn/Off, which were introduced in 10.13.
  * Define for older versions
@@ -365,6 +369,9 @@ - (id)initWithFrame:(NSRect)frameRect
 screen.width = frameRect.size.width;
 screen.height = frameRect.size.height;
 kbd = qkbd_state_init(dcl.con);
+#if MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_14_0
+[self setClipsToBounds:YES];
+#endif
 
 }
 return self;


> On 23 Feb 2024, at 11:28, Akihiko Odaki  wrote:
> 
> On 2024/02/23 2:10, Peter Maydell wrote:
>> On Thu, 22 Feb 2024 at 06:08, Michael Tokarev  wrote:
>>> 
>>> [Adding a few more Ccs]
>>> 
>>> 17.02.2024 18:58, David Parsons :
 macOS Sonoma changes the NSView.clipsToBounds to false by default where it 
 was true in
 earlier version of macOS. This causes the window contents to be obscured 
 by the window
 frame. This fixes the issue by conditionally setting the clipping on 
 Sonoma to true.
> 
> Thanks for posting a patch for this critical problem.
> 
 
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1994
 Signed-off-by: David Parsons 
 
 diff --git a/ui/cocoa.m b/ui/cocoa.m
 index eb99064bee..c9e3b96004 100644
 --- a/ui/cocoa.m
 +++ b/ui/cocoa.m
 @@ -365,6 +365,9 @@ - (id)initWithFrame:(NSRect)frameRect
   screen.width = frameRect.size.width;
   screen.height = frameRect.size.height;
   kbd = qkbd_state_init(dcl.con);
 +if (@available(macOS 14, *)) {
 +[self setClipsToBounds:YES];
 +}
 
   }
   return self;
 
>>> 
>>> Hi David!
>>> 
>>> While the code change is tiny, I for one know nothing about MacOS and
>>> its cocoa thing, so to me (with my trivial-patches hat on) this is a
>>> no-go.  I'd love to have a review from someone more knowlegeable in
>>> this area.
>> Mmm. Akihiko is the expert here, but I do notice that we don't
>> seem to be handling the "macos-version-specific" stuff in a
>> way we've done it before (we don't use @available elsewhere).
>> I did wonder if we could call the setClipsToBounds method unconditionally;
>> The release notes say
>> https://developer.apple.com/documentation/macos-release-notes/appkit-release-notes-for-macos-14#NSView
>> "This property is available back to macOS 10.9. This availability is
>> intended to allow code targeting older OSes to set this property to
>> true without guarding the setter in an availability check."
>> but I think that might only mean "you can do this building on a new
>> SDK that's targeting an old version", not "you can do this
>> when building on an older SDK" (at least judging from the
>> comments in the gitlab issue).
> 
> Apparently it is that case.
> 
> Please check if MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_14_0
> instead of using @available. See commit 5e24600a7c1c ("ui/cocoa.m: Fix macOS 
> 10.14 deprecation warnings") for example.
> 
>> The other option would be to fix whatever it is that we're
>> presumably not getting right that means this default change
>> caused the bug. My guess is that we are in the case
>> "Confusing a view’s bounds and its dirty rect. The dirty rect
>>  passed to .drawRect() should be used to determine what to draw,
>>  not where to draw it. Use NSView.bounds when determining the
>>  layout of what your view draws."
>> But unless the fix for that is really obvious and easy I guess
>> that flipping the default back to its old value is the better
>> approach.
> 
> It is a chore to convert the coordinates using NSView.bounds. Let's keep 
> using clipsToBounds.
> 
>> -- PMM
> 
> 



Re: [PATCH 06/10] mac_newworld: do not require CONFIG_USB

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 13:44, Paolo Bonzini wrote:

With --without-default-devices it should not be required to have
devices in the binary that are removed by -nodefaults.  It should be
therefore possible to build a binary that does not include any USB
host controller or any of the code guarded by CONFIG_USB.  While the
simpler creation functions such as usb_create_simple can be inlined,
this is not true of usb_bus_find().  Remove it, replacing it with a
search of the single USB bus on the machine.

With this change, it is possible to change "select USB_OHCI_PCI" into
an "imply" directive.

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Paolo Bonzini 
---
  hw/ppc/mac_newworld.c | 7 +++
  hw/ppc/Kconfig| 2 +-
  2 files changed, 4 insertions(+), 5 deletions(-)


Reviewed-by: Philippe Mathieu-Daudé 




Re: [PATCH 10/10] usb: remove duplicate file in system_ss

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 13:44, Paolo Bonzini wrote:

Because USB_EHCI_SYSBUS selects USB_EHCI, there is no need to include
hcd-ehci.c explicitly.

Signed-off-by: Paolo Bonzini 
---
  hw/usb/meson.build | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)


Reviewed-by: Philippe Mathieu-Daudé 





Re: [PATCH 07/10] pseries: do not require CONFIG_USB

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 13:44, Paolo Bonzini wrote:

With --without-default-devices it is possible to build a binary that
does not include any USB host controller and therefore that does not
include the code guarded by CONFIG_USB.  While the simpler creation
functions such as usb_create_simple can be inlined, this is not true
of usb_bus_find().  Remove it, replacing it with a search of the single
USB bus on the machine.

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Paolo Bonzini 
---
  hw/ppc/spapr.c | 7 +++
  hw/ppc/Kconfig | 1 +
  2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 0d72d286d80..44d339982da 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -3024,10 +3024,9 @@ static void spapr_machine_init(MachineState *machine)
  }
  
  if (has_vga) {


Pre-existing, don't we want defaults_enabled() instead of has_vga here?


-USBBus *usb_bus = usb_bus_find(-1);
-
-usb_create_simple(usb_bus, "usb-kbd");
-usb_create_simple(usb_bus, "usb-mouse");
+Object *usb_bus = object_resolve_type_unambiguous(TYPE_USB_BUS, 
_abort);
+usb_create_simple(USB_BUS(usb_bus), "usb-kbd");
+usb_create_simple(USB_BUS(usb_bus), "usb-mouse");
  }
  }
  
diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig

index 9841c2c9690..d497fa2b825 100644
--- a/hw/ppc/Kconfig
+++ b/hw/ppc/Kconfig
@@ -1,5 +1,6 @@
  config PSERIES
  bool
+imply USB_OHCI_PCI
  imply PCI_DEVICES
  imply TEST_DEVICES
  imply VIRTIO_VGA


Reviewed-by: Philippe Mathieu-Daudé 




[PATCH V1] migration: export fewer options

2024-02-23 Thread Steve Sistare
A small number of migration options are accessed by migration clients,
but to see them clients must include all of options.h, which is mostly
for migration core code.  migrate_mode() in particular will be needed by
multiple clients.

Refactor the option declarations so clients can see the necessary few via
misc.h, which already exports a portion of the client API.

Signed-off-by: Steve Sistare 
---
I suggest that eventually we should define a single file migration/client.h
which exports everything needed by the simpler clients: blockers, notifiers,
options, cpr, and state accessors.
---
---
 hw/vfio/migration.c |  1 -
 hw/virtio/virtio-balloon.c  |  1 -
 include/migration/misc.h|  1 +
 include/migration/options-pub.h | 24 
 migration/options.h |  6 +-
 system/dirtylimit.c |  1 -
 6 files changed, 26 insertions(+), 8 deletions(-)
 create mode 100644 include/migration/options-pub.h

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 86d8c9e..f1f6878 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -18,7 +18,6 @@
 #include "sysemu/runstate.h"
 #include "hw/vfio/vfio-common.h"
 #include "migration/migration.h"
-#include "migration/options.h"
 #include "migration/savevm.h"
 #include "migration/vmstate.h"
 #include "migration/qemu-file.h"
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index d004cf2..74d419f 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -32,7 +32,6 @@
 #include "qemu/error-report.h"
 #include "migration/misc.h"
 #include "migration/migration.h"
-#include "migration/options.h"
 
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-access.h"
diff --git a/include/migration/misc.h b/include/migration/misc.h
index 916b65f..627726c 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -17,6 +17,7 @@
 #include "qemu/notify.h"
 #include "qapi/qapi-types-migration.h"
 #include "qapi/qapi-types-net.h"
+#include "migration/options-pub.h"
 
 /* migration/ram.c */
 
diff --git a/include/migration/options-pub.h b/include/migration/options-pub.h
new file mode 100644
index 000..54bd678
--- /dev/null
+++ b/include/migration/options-pub.h
@@ -0,0 +1,24 @@
+/*
+ * QEMU public migration capabilities
+ *
+ * Copyright (c) 2012-2023 Red Hat Inc
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef QEMU_MIGRATION_OPTIONS_PUB_H
+#define QEMU_MIGRATION_OPTIONS_PUB_H
+
+/* capabilities */
+
+bool migrate_background_snapshot(void);
+bool migrate_dirty_limit(void);
+bool migrate_postcopy_ram(void);
+bool migrate_switchover_ack(void);
+
+/* parameters */
+
+MigMode migrate_mode(void);
+
+#endif
diff --git a/migration/options.h b/migration/options.h
index 246c160..84c08e1 100644
--- a/migration/options.h
+++ b/migration/options.h
@@ -16,6 +16,7 @@
 
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
+#include "migration/options-pub.h"
 
 /* migration properties */
 
@@ -24,12 +25,10 @@ extern Property migration_properties[];
 /* capabilities */
 
 bool migrate_auto_converge(void);
-bool migrate_background_snapshot(void);
 bool migrate_block(void);
 bool migrate_colo(void);
 bool migrate_compress(void);
 bool migrate_dirty_bitmaps(void);
-bool migrate_dirty_limit(void);
 bool migrate_events(void);
 bool migrate_ignore_shared(void);
 bool migrate_late_block_activate(void);
@@ -37,11 +36,9 @@ bool migrate_multifd(void);
 bool migrate_pause_before_switchover(void);
 bool migrate_postcopy_blocktime(void);
 bool migrate_postcopy_preempt(void);
-bool migrate_postcopy_ram(void);
 bool migrate_rdma_pin_all(void);
 bool migrate_release_ram(void);
 bool migrate_return_path(void);
-bool migrate_switchover_ack(void);
 bool migrate_validate_uuid(void);
 bool migrate_xbzrle(void);
 bool migrate_zero_blocks(void);
@@ -83,7 +80,6 @@ uint8_t migrate_max_cpu_throttle(void);
 uint64_t migrate_max_bandwidth(void);
 uint64_t migrate_avail_switchover_bandwidth(void);
 uint64_t migrate_max_postcopy_bandwidth(void);
-MigMode migrate_mode(void);
 int migrate_multifd_channels(void);
 MultiFDCompression migrate_multifd_compression(void);
 int migrate_multifd_zlib_level(void);
diff --git a/system/dirtylimit.c b/system/dirtylimit.c
index 495c7a7..696eaab 100644
--- a/system/dirtylimit.c
+++ b/system/dirtylimit.c
@@ -26,7 +26,6 @@
 #include "trace.h"
 #include "migration/misc.h"
 #include "migration/migration.h"
-#include "migration/options.h"
 
 /*
  * Dirtylimit stop working if dirty page rate error
-- 
1.8.3.1




Re: [PATCH 05/10] hppa: do not require CONFIG_USB

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 13:44, Paolo Bonzini wrote:

With --without-default-devices it is possible to build a binary that
does not include any USB host controller and therefore that does not
include the code guarded by CONFIG_USB.  While the simpler creation
functions such as usb_create_simple can be inlined, this is not true
of usb_bus_find().  Remove it, replacing it with a search of the single
USB bus on the machine.

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Paolo Bonzini 
---
  hw/hppa/machine.c | 7 ---
  hw/hppa/Kconfig   | 2 +-
  2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 5fcaf5884be..11982d5776c 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -396,10 +396,11 @@ static void machine_HP_common_init_tail(MachineState 
*machine, PCIBus *pci_bus,
  }
  
  /* create USB OHCI controller for USB keyboard & mouse on Astro machines */

-if (!lasi_dev && machine->enable_graphics) {
+if (!lasi_dev && machine->enable_graphics && defaults_enabled()) {
  pci_create_simple(pci_bus, -1, "pci-ohci");
-usb_create_simple(usb_bus_find(-1), "usb-kbd");
-usb_create_simple(usb_bus_find(-1), "usb-mouse");
+Object *usb_bus = object_resolve_type_unambiguous(TYPE_USB_BUS, 
_abort);


Declare variable at begin of function; can be casted to USB_BUS once.
Otherwise:

Reviewed-by: Philippe Mathieu-Daudé 


+usb_create_simple(USB_BUS(usb_bus), "usb-kbd");
+usb_create_simple(USB_BUS(usb_bus), "usb-mouse");
  }





Re: [PATCH 09/10] usb: extract sysbus-ohci to a separate file

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 13:44, Paolo Bonzini wrote:

Split the sysbus version to a separate file so that it is not
included in PCI-only machines, and adjust Kconfig for machines
that do need sysbus-ohci.  The copyrights are based on the
time and employer of balrog and Paul Brook's contributions.

While adjusting the SM501 dependency, move it to the right place
instead of keeping it in the R4D machine.

Signed-off-by: Paolo Bonzini 
---
  hw/usb/hcd-ohci-sysbus.c | 91 
  hw/usb/hcd-ohci.c| 58 
  hw/arm/Kconfig   | 12 +++--
  hw/display/Kconfig   |  1 +
  hw/ppc/Kconfig   |  2 +-
  hw/sh4/Kconfig   |  1 -
  hw/usb/Kconfig   |  4 ++
  hw/usb/meson.build   |  1 +
  8 files changed, 105 insertions(+), 65 deletions(-)
  create mode 100644 hw/usb/hcd-ohci-sysbus.c




+static void ohci_realize_pxa(DeviceState *dev, Error **errp)


s/ohci_realize_pxa/ohci_sysbus_realize/


+{
+OHCISysBusState *s = SYSBUS_OHCI(dev);
+SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+Error *err = NULL;
+
+usb_ohci_init(>ohci, dev, s->num_ports, s->dma_offset,
+  s->masterbus, s->firstport,
+  _space_memory, ohci_sysbus_die, );
+if (err) {
+error_propagate(errp, err);
+return;
+}
+sysbus_init_irq(sbd, >ohci.irq);
+sysbus_init_mmio(sbd, >ohci.mem);
+}
+
+static void usb_ohci_reset_sysbus(DeviceState *dev)


s/usb_ohci_reset_sysbus/ohci_sysbus/reset/.

To be converted to Resettable API.


+{
+OHCISysBusState *s = SYSBUS_OHCI(dev);
+OHCIState *ohci = >ohci;
+
+ohci_hard_reset(ohci);
+}




+static void ohci_register_types(void)
+{
+type_register_static(_sysbus_info);
+}
+
+type_init(ohci_register_types)


Better directly use DEFINE_TYPES() in new uses, even for
a single type.



diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
index 0f486764ed6..f569ed7eeaa 100644
--- a/hw/usb/Kconfig
+++ b/hw/usb/Kconfig
@@ -11,6 +11,10 @@ config USB_OHCI
  bool
  select USB
  
+config USB_OHCI_SYSBUS

+bool
+select USB_OHCI


I start to think USB_OHCI_MMIO would be clearer. I can
clean that up later, so:

Reviewed-by: Philippe Mathieu-Daudé 


  config USB_OHCI_PCI
  bool
  default y if PCI_DEVICES




Re: [PATCH v5 16/41] Add RPi4 RNG200

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:20, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  hw/arm/bcm2838.c |   4 +
>  hw/arm/bcm2838_peripherals.c |  14 +
>  hw/arm/raspi4b.c |   1 -
>  hw/misc/bcm2838_rng200.c | 405 +++
>  hw/misc/meson.build  |   1 +
>  hw/misc/trace-events |   9 +
>  include/hw/arm/bcm2838_peripherals.h |   2 +
>  include/hw/misc/bcm2838_rng200.h |  43 +++
>  8 files changed, 478 insertions(+), 1 deletion(-)
>  create mode 100644 hw/misc/bcm2838_rng200.c
>  create mode 100644 include/hw/misc/bcm2838_rng200.h

Compiling with clang detects an off-by-one-error in this patch:

../../hw/misc/bcm2838_rng200.c:119:32: error: array index 9 is past
the end of the array (which contains 9 elements)
[-Werror,-Warray-bounds]
fifo_thld = FIELD_EX32(s->regs[R_RNG_FIFO_COUNT],
   ^   

This is because N_BCM2838_RNG200_REGS is 9, but
R_RNG_FIFO_COUNT is 0x24 / 4 == 9.

N_BCM2838_RNG200_REGS should be 10. (The regs[] array has
an empty slot for the 0x14 offset.)

thanks
-- PMM



Re: [PATCH 08/10] usb: remove usb_bus_find

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 13:44, Paolo Bonzini wrote:

Inline the sole remaining use, which is for the -usbdevice command line.

Signed-off-by: Paolo Bonzini 
---
  include/hw/usb.h |  1 -
  hw/usb/bus.c | 15 +--
  2 files changed, 1 insertion(+), 15 deletions(-)


Reviewed-by: Philippe Mathieu-Daudé 




Re: [PATCH v4 07/10] hw/mem/cxl_type3: Add DC extent list representative and get DC extent list mailbox support

2024-02-23 Thread fan
On Fri, Feb 23, 2024 at 04:16:53PM +0900, Wonjae Lee wrote:
> On 2024-02-22 오전 3:16, nifan@gmail.com wrote:
> > From: Fan Ni 
> > 
> > Add dynamic capacity extent list representative to the definition of
> > CXLType3Dev and add get DC extent list mailbox command per
> > CXL.spec.3.1:.8.2.9.9.9.2.
> > 
> > Signed-off-by: Fan Ni 
> > ---
> >   hw/cxl/cxl-mailbox-utils.c  | 71 +
> >   hw/mem/cxl_type3.c  |  1 +
> >   include/hw/cxl/cxl_device.h | 23 
> >   3 files changed, 95 insertions(+)
> > 
> > diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
> > index f95e417683..dae7fe00ed 100644
> > --- a/hw/cxl/cxl-mailbox-utils.c
> > +++ b/hw/cxl/cxl-mailbox-utils.c
> > @@ -83,6 +83,7 @@ enum {
> >   #define CLEAR_POISON   0x2
> >   DCD_CONFIG  = 0x48,
> >   #define GET_DC_CONFIG  0x0
> > +#define GET_DYN_CAP_EXT_LIST   0x1
> >   PHYSICAL_SWITCH = 0x51,
> >   #define IDENTIFY_SWITCH_DEVICE  0x0
> >   #define GET_PHYSICAL_PORT_STATE 0x1
> > @@ -1344,6 +1345,73 @@ static CXLRetCode cmd_dcd_get_dyn_cap_config(const 
> > struct cxl_cmd *cmd,
> >   return CXL_MBOX_SUCCESS;
> >   }
> > +/*
> > + * CXL r3.1 section 8.2.9.9.9.2:
> > + * Get Dynamic Capacity Extent List (Opcode 4801h)
> > + */
> > +static CXLRetCode cmd_dcd_get_dyn_cap_ext_list(const struct cxl_cmd *cmd,
> > +   uint8_t *payload_in,
> > +   size_t len_in,
> > +   uint8_t *payload_out,
> > +   size_t *len_out,
> > +   CXLCCI *cci)
> > +{
> > +CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
> > +struct get_dyn_cap_ext_list_in_pl {
> > +uint32_t extent_cnt;
> > +uint32_t start_extent_id;
> > +} QEMU_PACKED;
> > +
> > +struct get_dyn_cap_ext_list_out_pl {
> > +uint32_t count;
> > +uint32_t total_extents;
> > +uint32_t generation_num;
> > +uint8_t rsvd[4];
> > +CXLDCExtentRaw records[];
> > +} QEMU_PACKED;
> > +
> > +struct get_dyn_cap_ext_list_in_pl *in = (void *)payload_in;
> > +struct get_dyn_cap_ext_list_out_pl *out = (void *)payload_out;
> > +uint16_t record_count = 0, i = 0, record_done = 0;
> > +CXLDCExtentList *extent_list = >dc.extents;
> > +CXLDCExtent *ent;
> > +uint16_t out_pl_len;
> > +uint32_t start_extent_id = in->start_extent_id;
> > +
> > +if (start_extent_id > ct3d->dc.total_extent_count) {
> 
> Hello,
> 
> Shouldn't it be >= rather than >?
> 
> (I accidentally replied to v3 with the same comment above, so please ignore
> that.)

The spec says "Greater than", so I will keep it as it is until there is
more clarification about this. When start_extent_id ==
total_extent_count, return 0 extents.

Fan
> 
> Thanks,
> Wonjae
> 



Re: [PATCH 01/10] acpi, qom: move object_resolve_type_unambiguous to core QOM

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 13:43, Paolo Bonzini wrote:

object_resolve_type_unambiguous provides a useful functionality, that
is currently emulated for example by usb_bus_find().  Move it to core
code and add error reporting for increased generality.

Signed-off-by: Paolo Bonzini 
---
  include/qom/object.h | 13 +
  hw/i386/acpi-build.c | 19 ---
  qom/object.c | 16 
  3 files changed, 33 insertions(+), 15 deletions(-)


Reviewed-by: Philippe Mathieu-Daudé 




Re: [PATCH] hw/ide: Remove last two uses of ide/internal.h outside of hw/ide

2024-02-23 Thread Philippe Mathieu-Daudé

On 23/2/24 15:26, BALATON Zoltan wrote:

Remove last two includes of hw/ide/intarnal.h outside of hw/ide and
replace them with newly added public header to allow moving internal.h
into hw/ide to really stop exposing it.

Fixes: a11f439a0e (hw/ide: Stop exposing internal.h to non-IDE files)
Signed-off-by: BALATON Zoltan 
---
  hw/arm/sbsa-ref.c | 2 +-
  {include/hw => hw}/ide/internal.h | 0
  include/hw/misc/macio/macio.h | 2 +-
  3 files changed, 2 insertions(+), 2 deletions(-)
  rename {include/hw => hw}/ide/internal.h (100%)


Reviewed-by: Philippe Mathieu-Daudé 




Re: [PATCH v5 11/41] Temporarily disable unimplemented rpi4b devices

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:21, Sergey Kambalin  wrote:
>
> This commit adds RPi4B device tree modifications:
> - disable pcie, rng200, thermal sensor and genet devices
>   (they're going to be re-enabled in the following commits)
> - create additional memory region in device tree
>   if RAM amount exceeds VC base address.
>
> Signed-off-by: Sergey Kambalin 

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

2024-02-23 Thread Alex Bennée
Alex Bennée  writes:

> Peter Maydell  writes:
>
>> The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
>> was unfortunately added with a license of GPL-v3-or-later, which is
>> not compatible with other QEMU code which has a GPL-v2-only license.
>>
>> Relicense the code in the .c and the .h file to GPL-v2-or-later,
>> to make it compatible with the rest of QEMU.
>>
>> Signed-off-by: Peter Maydell 
>
> Acked-by: Alex Bennée 

Or a

Signed-off-by: Alex Bennée 

if you prefer.

-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro



Re: [PATCH v5 41/41] Add RPi4B to paspi.rst

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:23, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  docs/system/arm/raspi.rst | 11 +++
>  1 file changed, 7 insertions(+), 4 deletions(-)

Still has the typo in the commit message subject.
Otherwise
Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 17/41] Implement BCM2838 thermal sensor

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:21, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  hw/arm/bcm2838_peripherals.c | 27 ++--
>  hw/arm/raspi4b.c |  1 -
>  hw/misc/bcm2838_thermal.c| 98 
>  hw/misc/meson.build  |  3 +-
>  include/hw/arm/bcm2838_peripherals.h |  2 +
>  include/hw/misc/bcm2838_thermal.h| 24 +++
>  6 files changed, 147 insertions(+), 8 deletions(-)
>  create mode 100644 hw/misc/bcm2838_thermal.c
>  create mode 100644 include/hw/misc/bcm2838_thermal.h
>
> diff --git a/hw/arm/bcm2838_peripherals.c b/hw/arm/bcm2838_peripherals.c
> index 6b4c840c5b..48c5fd5978 100644
> --- a/hw/arm/bcm2838_peripherals.c
> +++ b/hw/arm/bcm2838_peripherals.c
> @@ -37,6 +37,9 @@ static void bcm2838_peripherals_init(Object *obj)
>  /* Random Number Generator */
>  object_initialize_child(obj, "rng200", >rng200, TYPE_BCM2838_RNG200);
>
> +/* Thermal */
> +object_initialize_child(obj, "thermal", >thermal, 
> TYPE_BCM2838_THERMAL);
> +
>  /* PCIe Host Bridge */
>  object_initialize_child(obj, "pcie-host", >pcie_host,
>  TYPE_BCM2838_PCIE_HOST);
> @@ -78,6 +81,9 @@ static void bcm2838_peripherals_realize(DeviceState *dev, 
> Error **errp)
>  BCMSocPeripheralBaseState *s_base = BCM_SOC_PERIPHERALS_BASE(dev);
>  MemoryRegion *regs_mr;
>  MemoryRegion *mmio_mr;
> +MemoryRegion *rng200_mr;
> +MemoryRegion *thermal_mr;
> +qemu_irq rng_200_irq;
>
>  int n;
>
> @@ -95,12 +101,20 @@ static void bcm2838_peripherals_realize(DeviceState 
> *dev, Error **errp)
>  if (!sysbus_realize(SYS_BUS_DEVICE(>rng200), errp)) {
>  return;
>  }
> -memory_region_add_subregion(
> -_base->peri_mr, RNG_OFFSET,
> -sysbus_mmio_get_region(SYS_BUS_DEVICE(>rng200), 0));
> -sysbus_connect_irq(SYS_BUS_DEVICE(>rng200), 0,
> -qdev_get_gpio_in_named(DEVICE(_base->ic), BCM2835_IC_GPU_IRQ,
> -   INTERRUPT_RNG));
> +rng200_mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(>rng200), 0);
> +memory_region_add_subregion(_base->peri_mr, RNG_OFFSET, rng200_mr);
> +
> +rng_200_irq = qdev_get_gpio_in_named(DEVICE(_base->ic),
> + BCM2835_IC_GPU_IRQ, INTERRUPT_RNG);
> +sysbus_connect_irq(SYS_BUS_DEVICE(>rng200), 0, rng_200_irq);

These are RNG200 related and look like they should be squashed into
the patch that added the RNG200 to the SoC.

> +
> +
> +/* THERMAL */
> +if (!sysbus_realize(SYS_BUS_DEVICE(>thermal), errp)) {
> +return;
> +}
> +thermal_mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(>thermal), 0);
> +memory_region_add_subregion( >peri_low_mr, 0x15D2000, thermal_mr);
>
>  /* Extended Mass Media Controller 2 */
>  object_property_set_uint(OBJECT(>emmc2), "sd-spec-version", 3,
> @@ -201,6 +215,7 @@ static void bcm2838_peripherals_realize(DeviceState *dev, 
> Error **errp)
>   BCM2838_MPHI_SIZE);
>  memory_region_add_subregion(_base->peri_mr, BCM2838_MPHI_OFFSET,
>  >mphi_mr_alias);
> +

Stray whitespace change: should be in some other patch, I suspect
(maybe the one adding the pcie to the SoC?)

>  /* PCIe Root Complex */
>  if (!sysbus_realize(SYS_BUS_DEVICE(>pcie_host), errp)) {
>  return;

> diff --git a/hw/misc/meson.build b/hw/misc/meson.build
> index 7c769fd2a4..8a8c5ce659 100644
> --- a/hw/misc/meson.build
> +++ b/hw/misc/meson.build
> @@ -91,7 +91,8 @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
>'bcm2835_thermal.c',
>'bcm2835_cprman.c',
>'bcm2835_powermgt.c',
> -  'bcm2838_rng200.c'
> +  'bcm2838_rng200.c',
> +  'bcm2838_thermal.c'

If you always keep a trailing comma on the end of this kind of list,
then you don't have to modify the preceding line when you add a new one.

>  ))
>  system_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
>  system_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))

Otherwise
Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 07/41] Implement BCM2838 GPIO functionality

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:23, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 12/41] Add memory region for BCM2837 RPiVid ASB

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:23, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  hw/arm/bcm2838_peripherals.c | 3 +++
>  include/hw/arm/bcm2838_peripherals.h | 2 ++
>  include/hw/arm/raspi_platform.h  | 2 +-
>  3 files changed, 6 insertions(+), 1 deletion(-)

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 08/41] Connect SD controller to BCM2838 GPIO

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:18, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 05/41] Add GIC-400 to BCM2838 SoC

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:20, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  hw/arm/bcm2838.c | 167 ++-
>  hw/arm/trace-events  |   3 +
>  include/hw/arm/bcm2838.h |   2 +
>  include/hw/arm/bcm2838_peripherals.h |  37 ++
>  4 files changed, 207 insertions(+), 2 deletions(-)

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 06/41] Add BCM2838 GPIO stub

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:19, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  hw/gpio/bcm2838_gpio.c | 153 +
>  hw/gpio/meson.build|   5 +-
>  include/hw/gpio/bcm2838_gpio.h |  40 +
>  3 files changed, 197 insertions(+), 1 deletion(-)
>  create mode 100644 hw/gpio/bcm2838_gpio.c
>  create mode 100644 include/hw/gpio/bcm2838_gpio.h

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 09/41] Add GPIO and SD to BCM2838 periph

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:22, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  hw/arm/bcm2838_peripherals.c | 143 +++
>  include/hw/arm/bcm2838_peripherals.h |   8 ++
>  2 files changed, 151 insertions(+)

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 01/41] Split out common part of BCM283X classes

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:18, Sergey Kambalin  wrote:
>
> Pre setup for BCM2838 introduction
>
> Signed-off-by: Sergey Kambalin 
> ---

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 10/41] Introduce Raspberry PI 4 machine

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:24, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 03/41] Split out raspi machine common part

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:23, Sergey Kambalin  wrote:
>
> Pre-setup for raspberry pi 4 introduction
>
> Signed-off-by: Sergey Kambalin 
> ---

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 02/41] Split out common part of peripherals

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:19, Sergey Kambalin  wrote:
>
> Pre-setup for BCM2838 introduction
>
> Signed-off-by: Sergey Kambalin 
> ---

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH v5 04/41] Introduce BCM2838 SoC

2024-02-23 Thread Peter Maydell
On Mon, 19 Feb 2024 at 01:20, Sergey Kambalin  wrote:
>
> Signed-off-by: Sergey Kambalin 
> ---
>  hw/arm/bcm2838.c | 98 
>  hw/arm/bcm2838_peripherals.c | 72 
>  hw/arm/meson.build   |  2 +
>  include/hw/arm/bcm2838.h | 29 
>  include/hw/arm/bcm2838_peripherals.h | 36 ++
>  5 files changed, 237 insertions(+)
>  create mode 100644 hw/arm/bcm2838.c
>  create mode 100644 hw/arm/bcm2838_peripherals.c
>  create mode 100644 include/hw/arm/bcm2838.h
>  create mode 100644 include/hw/arm/bcm2838_peripherals.h

Reviewed-by: Peter Maydell 

thanks
-- PMM



Re: [PATCH] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

2024-02-23 Thread Alex Bennée
Peter Maydell  writes:

> The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
> was unfortunately added with a license of GPL-v3-or-later, which is
> not compatible with other QEMU code which has a GPL-v2-only license.
>
> Relicense the code in the .c and the .h file to GPL-v2-or-later,
> to make it compatible with the rest of QEMU.
>
> Signed-off-by: Peter Maydell 

Acked-by: Alex Bennée 

-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro



[PATCH v2 25/27] docs/devel: lift example and plugin API sections up

2024-02-23 Thread Alex Bennée
This makes them a bit more visible in the TCG emulation menu rather
than hiding them away bellow the ToC limit.

Message-Id: <20240103173349.398526-43-alex.ben...@linaro.org>
Reviewed-by: Pierrick Bouvier 
Signed-off-by: Alex Bennée 
Reviewed-by: Philippe Mathieu-Daudé 
---
 docs/devel/tcg-plugins.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/devel/tcg-plugins.rst b/docs/devel/tcg-plugins.rst
index fa7421279f5..535a74684c5 100644
--- a/docs/devel/tcg-plugins.rst
+++ b/docs/devel/tcg-plugins.rst
@@ -143,7 +143,7 @@ requested. The plugin isn't completely uninstalled until 
the safe work
 has executed while all vCPUs are quiescent.
 
 Example Plugins

+===
 
 There are a number of plugins included with QEMU and you are
 encouraged to contribute your own plugins plugins upstream. There is a
@@ -591,8 +591,8 @@ The plugin has a number of arguments, all of them are 
optional:
   configuration arguments implies ``l2=on``.
   (default: N = 2097152 (2MB), B = 64, A = 16)
 
-API

+Plugin API
+==
 
 The following API is generated from the inline documentation in
 ``include/qemu/qemu-plugin.h``. Please ensure any updates to the API
-- 
2.39.2




[PATCH v2 23/27] contrib/plugins: fix imatch

2024-02-23 Thread Alex Bennée
We can't directly save the ephemeral imatch from argv as that memory
will get recycled.

Message-Id: <20240103173349.398526-40-alex.ben...@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Alex Bennée 
Reviewed-by: Philippe Mathieu-Daudé 
---
 contrib/plugins/execlog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/plugins/execlog.c b/contrib/plugins/execlog.c
index 82dc2f584e2..f262eeb 100644
--- a/contrib/plugins/execlog.c
+++ b/contrib/plugins/execlog.c
@@ -199,7 +199,7 @@ static void parse_insn_match(char *match)
 if (!imatches) {
 imatches = g_ptr_array_new();
 }
-g_ptr_array_add(imatches, match);
+g_ptr_array_add(imatches, g_strdup(match));
 }
 
 static void parse_vaddr_match(char *match)
-- 
2.39.2




[PATCH v2 12/27] gdbstub: Add members to identify registers to GDBFeature

2024-02-23 Thread Alex Bennée
From: Akihiko Odaki 

These members will be used to help plugins to identify registers.
The added members in instances of GDBFeature dynamically generated by
CPUs will be filled in later changes.

Signed-off-by: Akihiko Odaki 
Message-Id: <20240103173349.398526-36-alex.ben...@linaro.org>
Message-Id: <20231213-gdb-v17-10-777047380...@daynix.com>
Signed-off-by: Alex Bennée 
---
 include/exec/gdbstub.h  |  3 +++
 gdbstub/gdbstub.c   | 12 +---
 target/riscv/gdbstub.c  |  4 +---
 scripts/feature_to_c.py | 14 +-
 4 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 82a8afa237f..da9ddfe54c5 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -13,12 +13,15 @@
 typedef struct GDBFeature {
 const char *xmlname;
 const char *xml;
+const char *name;
+const char * const *regs;
 int num_regs;
 } GDBFeature;
 
 typedef struct GDBFeatureBuilder {
 GDBFeature *feature;
 GPtrArray *xml;
+GPtrArray *regs;
 int base_reg;
 } GDBFeatureBuilder;
 
diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index f766ee277a0..a55b5e6581a 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -419,9 +419,10 @@ void gdb_feature_builder_init(GDBFeatureBuilder *builder, 
GDBFeature *feature,
 builder->feature = feature;
 builder->xml = g_ptr_array_new();
 g_ptr_array_add(builder->xml, header);
+builder->regs = g_ptr_array_new();
 builder->base_reg = base_reg;
 feature->xmlname = xmlname;
-feature->num_regs = 0;
+feature->name = name;
 }
 
 void gdb_feature_builder_append_tag(const GDBFeatureBuilder *builder,
@@ -440,10 +441,12 @@ void gdb_feature_builder_append_reg(const 
GDBFeatureBuilder *builder,
 const char *type,
 const char *group)
 {
-if (builder->feature->num_regs < regnum) {
-builder->feature->num_regs = regnum;
+if (builder->regs->len <= regnum) {
+g_ptr_array_set_size(builder->regs, regnum + 1);
 }
 
+builder->regs->pdata[regnum] = (gpointer *)name;
+
 if (group) {
 gdb_feature_builder_append_tag(
 builder,
@@ -469,6 +472,9 @@ void gdb_feature_builder_end(const GDBFeatureBuilder 
*builder)
 }
 
 g_ptr_array_free(builder->xml, TRUE);
+
+builder->feature->num_regs = builder->regs->len;
+builder->feature->regs = (void *)g_ptr_array_free(builder->regs, FALSE);
 }
 
 const GDBFeature *gdb_find_static_feature(const char *xmlname)
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index 546e8692d17..be7a02cd903 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -266,11 +266,9 @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState 
*cs, int base_reg)
 }
 predicate = csr_ops[i].predicate;
 if (predicate && (predicate(env, i) == RISCV_EXCP_NONE)) {
-g_autofree char *dynamic_name = NULL;
 name = csr_ops[i].name;
 if (!name) {
-dynamic_name = g_strdup_printf("csr%03x", i);
-name = dynamic_name;
+name = g_strdup_printf("csr%03x", i);
 }
 
 gdb_feature_builder_append_reg(, name, bitsize, i,
diff --git a/scripts/feature_to_c.py b/scripts/feature_to_c.py
index e04d6b2df7f..807af0e685c 100644
--- a/scripts/feature_to_c.py
+++ b/scripts/feature_to_c.py
@@ -50,7 +50,9 @@ def writeliteral(indent, bytes):
 sys.stderr.write(f'unexpected start tag: {element.tag}\n')
 exit(1)
 
+feature_name = element.attrib['name']
 regnum = 0
+regnames = []
 regnums = []
 tags = ['feature']
 for event, element in events:
@@ -67,6 +69,7 @@ def writeliteral(indent, bytes):
 if 'regnum' in element.attrib:
 regnum = int(element.attrib['regnum'])
 
+regnames.append(element.attrib['name'])
 regnums.append(regnum)
 regnum += 1
 
@@ -85,6 +88,15 @@ def writeliteral(indent, bytes):
 writeliteral(8, bytes(os.path.basename(input), 'utf-8'))
 sys.stdout.write(',\n')
 writeliteral(8, read)
-sys.stdout.write(f',\n{num_regs},\n}},\n')
+sys.stdout.write(',\n')
+writeliteral(8, bytes(feature_name, 'utf-8'))
+sys.stdout.write(',\n(const char * const []) {\n')
+
+for index, regname in enumerate(regnames):
+sys.stdout.write(f'[{regnums[index] - base_reg}] =\n')
+writeliteral(16, bytes(regname, 'utf-8'))
+sys.stdout.write(',\n')
+
+sys.stdout.write(f'}},\n{num_regs},\n}},\n')
 
 sys.stdout.write('{ NULL }\n};\n')
-- 
2.39.2




[PATCH v2 24/27] contrib/plugins: extend execlog to track register changes

2024-02-23 Thread Alex Bennée
With the new plugin register API we can now track changes to register
values. Currently the implementation is fairly dumb which will slow
down if a large number of register values are being tracked. This
could be improved by only instrumenting instructions which mention
registers we are interested in tracking.

Example usage:

  ./qemu-aarch64 -D plugin.log -d plugin \
 -cpu max,sve256=on \
 -plugin contrib/plugins/libexeclog.so,reg=sp,reg=z\* \
 ./tests/tcg/aarch64-linux-user/sha512-sve

will display in the execlog any changes to the stack pointer (sp) and
the SVE Z registers.

As testing registers every instruction will be quite a heavy operation
there is an additional flag which attempts to optimise the register
tracking by only instrumenting instructions which are likely to change
its value. This relies on the QEMU disassembler showing up the register
names in disassembly so is an explicit opt-in.

Message-Id: <20240103173349.398526-41-alex.ben...@linaro.org>
Signed-off-by: Alex Bennée 
Cc: Akihiko Odaki 
Based-On: <20231025093128.33116-19-akihiko.od...@daynix.com>

---
v3
  - just use a GArray for the CPU array
  - drop duplicate of cpu_index
v4
  - rebase and api fixups
  - I accidentally squashed the optimisation last round so update
  commit message with the details.
---
 docs/devel/tcg-plugins.rst |  17 +-
 contrib/plugins/execlog.c  | 316 +++--
 2 files changed, 281 insertions(+), 52 deletions(-)

diff --git a/docs/devel/tcg-plugins.rst b/docs/devel/tcg-plugins.rst
index 81dcd43a612..fa7421279f5 100644
--- a/docs/devel/tcg-plugins.rst
+++ b/docs/devel/tcg-plugins.rst
@@ -497,6 +497,22 @@ arguments if required::
   $ qemu-system-arm $(QEMU_ARGS) \
 -plugin ./contrib/plugins/libexeclog.so,ifilter=st1w,afilter=0x40001808 -d 
plugin
 
+This plugin can also dump registers when they change value. Specify the name 
of the
+registers with multiple ``reg`` options. You can also use glob style matching 
if you wish::
+
+  $ qemu-system-arm $(QEMU_ARGS) \
+-plugin ./contrib/plugins/libexeclog.so,reg=\*_el2,reg=sp -d plugin
+
+Be aware that each additional register to check will slow down
+execution quite considerably. You can optimise the number of register
+checks done by using the rdisas option. This will only instrument
+instructions that mention the registers in question in disassembly.
+This is not foolproof as some instructions implicitly change
+instructions. You can use the ifilter to catch these cases:
+
+  $ qemu-system-arm $(QEMU_ARGS) \
+-plugin 
./contrib/plugins/libexeclog.so,ifilter=msr,ifilter=blr,reg=x30,reg=\*_el1,rdisas=on
+
 - contrib/plugins/cache.c
 
 Cache modelling plugin that measures the performance of a given L1 cache
@@ -583,4 +599,3 @@ The following API is generated from the inline 
documentation in
 include the full kernel-doc annotations.
 
 .. kernel-doc:: include/qemu/qemu-plugin.h
-
diff --git a/contrib/plugins/execlog.c b/contrib/plugins/execlog.c
index f262eeb..dd7168cb548 100644
--- a/contrib/plugins/execlog.c
+++ b/contrib/plugins/execlog.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2021, Alexandre Iooss 
  *
- * Log instruction execution with memory access.
+ * Log instruction execution with memory access and register changes
  *
  * License: GNU GPL, version 2 or later.
  *   See the COPYING file in the top-level directory.
@@ -15,29 +15,40 @@
 
 #include 
 
+typedef struct {
+struct qemu_plugin_register *handle;
+GByteArray *last;
+GByteArray *new;
+const char *name;
+} Register;
+
+typedef struct CPU {
+/* Store last executed instruction on each vCPU as a GString */
+GString *last_exec;
+/* Ptr array of Register */
+GPtrArray *registers;
+} CPU;
+
 QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
 
-/* Store last executed instruction on each vCPU as a GString */
-static GPtrArray *last_exec;
+static GArray *cpus;
 static GRWLock expand_array_lock;
 
 static GPtrArray *imatches;
 static GArray *amatches;
+static GPtrArray *rmatches;
+static bool disas_assist;
+static GMutex add_reg_name_lock;
+static GPtrArray *all_reg_names;
 
-/*
- * Expand last_exec array.
- *
- * As we could have multiple threads trying to do this we need to
- * serialise the expansion under a lock.
- */
-static void expand_last_exec(int cpu_index)
+static CPU *get_cpu(int vcpu_index)
 {
-g_rw_lock_writer_lock(_array_lock);
-while (cpu_index >= last_exec->len) {
-GString *s = g_string_new(NULL);
-g_ptr_array_add(last_exec, s);
-}
-g_rw_lock_writer_unlock(_array_lock);
+CPU *c;
+g_rw_lock_reader_lock(_array_lock);
+c = _array_index(cpus, CPU, vcpu_index);
+g_rw_lock_reader_unlock(_array_lock);
+
+return c;
 }
 
 /**
@@ -46,13 +57,10 @@ static void expand_last_exec(int cpu_index)
 static void vcpu_mem(unsigned int cpu_index, qemu_plugin_meminfo_t info,
  uint64_t vaddr, void *udata)
 {
-GString *s;
+CPU *c = 

[PATCH v2 22/27] tests/tcg: expand insn test case to exercise register API

2024-02-23 Thread Alex Bennée
This ensure we at least read every register the plugin API reports at
least once during the check-tcg checks.

Signed-off-by: Alex Bennée 
---
 tests/plugin/insn.c | 21 +
 1 file changed, 21 insertions(+)

diff --git a/tests/plugin/insn.c b/tests/plugin/insn.c
index 5fd3017c2b3..54da06fcf26 100644
--- a/tests/plugin/insn.c
+++ b/tests/plugin/insn.c
@@ -46,6 +46,25 @@ typedef struct {
 char *disas;
 } Instruction;
 
+/*
+ * Initialise a new vcpu with reading the register list
+ */
+static void vcpu_init(qemu_plugin_id_t id, unsigned int vcpu_index)
+{
+g_autoptr(GArray) reg_list = qemu_plugin_get_registers();
+g_autoptr(GByteArray) reg_value = g_byte_array_new();
+
+if (reg_list) {
+for (int i = 0; i < reg_list->len; i++) {
+qemu_plugin_reg_descriptor *rd = _array_index(
+reg_list, qemu_plugin_reg_descriptor, i);
+int count = qemu_plugin_read_register(rd->handle, reg_value);
+g_assert(count > 0);
+}
+}
+}
+
+
 static void vcpu_insn_exec_before(unsigned int cpu_index, void *udata)
 {
 unsigned int i = cpu_index % MAX_CPUS;
@@ -212,6 +231,8 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t 
id,
 sizes = g_array_new(true, true, sizeof(unsigned long));
 }
 
+/* Register init, translation block and exit callbacks */
+qemu_plugin_register_vcpu_init_cb(id, vcpu_init);
 qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans);
 qemu_plugin_register_atexit_cb(id, plugin_exit, NULL);
 return 0;
-- 
2.39.2




[PATCH v2 05/27] target/riscv: Use GDBFeature for dynamic XML

2024-02-23 Thread Alex Bennée
From: Akihiko Odaki 

In preparation for a change to use GDBFeature as a parameter of
gdb_register_coprocessor(), convert the internal representation of
dynamic feature from plain XML to GDBFeature.

Signed-off-by: Akihiko Odaki 
Message-Id: <20240103173349.398526-29-alex.ben...@linaro.org>
Message-Id: <20231213-gdb-v17-3-777047380...@daynix.com>
Signed-off-by: Alex Bennée 
---
 target/riscv/cpu.h |  5 +--
 target/riscv/cpu.c |  4 +--
 target/riscv/gdbstub.c | 81 +++---
 3 files changed, 41 insertions(+), 49 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index f52dce78baa..5d291a70925 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -24,6 +24,7 @@
 #include "hw/registerfields.h"
 #include "hw/qdev-properties.h"
 #include "exec/cpu-defs.h"
+#include "exec/gdbstub.h"
 #include "qemu/cpu-float.h"
 #include "qom/object.h"
 #include "qemu/int128.h"
@@ -445,8 +446,8 @@ struct ArchCPU {
 
 CPURISCVState env;
 
-char *dyn_csr_xml;
-char *dyn_vreg_xml;
+GDBFeature dyn_csr_feature;
+GDBFeature dyn_vreg_feature;
 
 /* Configuration Settings */
 RISCVCPUConfig cfg;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 1b8d001d237..1b62e269b90 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -2305,9 +2305,9 @@ static const char *riscv_gdb_get_dynamic_xml(CPUState 
*cs, const char *xmlname)
 RISCVCPU *cpu = RISCV_CPU(cs);
 
 if (strcmp(xmlname, "riscv-csr.xml") == 0) {
-return cpu->dyn_csr_xml;
+return cpu->dyn_csr_feature.xml;
 } else if (strcmp(xmlname, "riscv-vector.xml") == 0) {
-return cpu->dyn_vreg_xml;
+return cpu->dyn_vreg_feature.xml;
 }
 
 return NULL;
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index ca9b71f7bbc..d8da84fa52e 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -214,14 +214,15 @@ static int riscv_gdb_set_virtual(CPURISCVState *cs, 
uint8_t *mem_buf, int n)
 return 0;
 }
 
-static int riscv_gen_dynamic_csr_xml(CPUState *cs, int base_reg)
+static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
 {
 RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cs);
 RISCVCPU *cpu = RISCV_CPU(cs);
 CPURISCVState *env = >env;
-GString *s = g_string_new(NULL);
+GDBFeatureBuilder builder;
 riscv_csr_predicate_fn predicate;
 int bitsize = riscv_cpu_max_xlen(mcc);
+const char *name;
 int i;
 
 #if !defined(CONFIG_USER_ONLY)
@@ -233,9 +234,9 @@ static int riscv_gen_dynamic_csr_xml(CPUState *cs, int 
base_reg)
 bitsize = 64;
 }
 
-g_string_printf(s, "");
-g_string_append_printf(s, "");
-g_string_append_printf(s, "");
+gdb_feature_builder_init(, >dyn_csr_feature,
+ "org.gnu.gdb.riscv.csr", "riscv-csr.xml",
+ base_reg);
 
 for (i = 0; i < CSR_TABLE_SIZE; i++) {
 if (env->priv_ver < csr_ops[i].min_priv_ver) {
@@ -243,72 +244,64 @@ static int riscv_gen_dynamic_csr_xml(CPUState *cs, int 
base_reg)
 }
 predicate = csr_ops[i].predicate;
 if (predicate && (predicate(env, i) == RISCV_EXCP_NONE)) {
-if (csr_ops[i].name) {
-g_string_append_printf(s, "", base_reg + i);
+
+gdb_feature_builder_append_reg(, name, bitsize, i,
+   "int", NULL);
 }
 }
 
-g_string_append_printf(s, "");
-
-cpu->dyn_csr_xml = g_string_free(s, false);
+gdb_feature_builder_end();
 
 #if !defined(CONFIG_USER_ONLY)
 env->debugger = false;
 #endif
 
-return CSR_TABLE_SIZE;
+return >dyn_csr_feature;
 }
 
-static int ricsv_gen_dynamic_vector_xml(CPUState *cs, int base_reg)
+static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
 {
 RISCVCPU *cpu = RISCV_CPU(cs);
-GString *s = g_string_new(NULL);
-g_autoptr(GString) ts = g_string_new("");
-int reg_width = cpu->cfg.vlenb << 3;
-int num_regs = 0;
+int reg_width = cpu->cfg.vlenb;
+GDBFeatureBuilder builder;
 int i;
 
-g_string_printf(s, "");
-g_string_append_printf(s, "");
-g_string_append_printf(s, "");
+gdb_feature_builder_init(, >dyn_vreg_feature,
+ "org.gnu.gdb.riscv.vector", "riscv-vector.xml",
+ base_reg);
 
 /* First define types and totals in a whole VL */
 for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
 int count = reg_width / vec_lanes[i].size;
-g_string_printf(ts, "%s", vec_lanes[i].id);
-g_string_append_printf(s,
-   "",
-   ts->str, vec_lanes[i].gdb_type, count);
+gdb_feature_builder_append_tag(
+, "",
+vec_lanes[i].id, vec_lanes[i].gdb_type, count);
 }
 
 /* Define unions */
-g_string_append_printf(s, "");
+gdb_feature_builder_append_tag(, "");
 for (i = 

  1   2   3   >