Re: [PATCH 1/1] ui/cocoa: show/hide menu in fullscreen on mouse ungrab/grab

[Akihiko Odaki]

On 2022/01/03 20:45, Carwyn Ellis wrote:

The menu bar is only accessible when the Cocoa UI is windowed. In order
to allow the menu bar to be accessible in fullscreen mode, this change
makes the menu visible when the mouse is ungrabbed.

When the mouse is grabbed the menu is hidden again.

Signed-off-by: Carwyn Ellis 
---
  ui/cocoa.m | 8 ++--
  1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/ui/cocoa.m b/ui/cocoa.m
index 69745c483b..42dcf47da4 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -1037,7 +1037,9 @@ QemuCocoaView *cocoaView;
  {
  COCOA_DEBUG("QemuCocoaView: grabMouse\n");
  
-if (!isFullscreen) {

+if (isFullscreen) {
+[NSMenu setMenuBarVisible: FALSE];
+} else {
  if (qemu_name)
  [normalWindow setTitle:[NSString stringWithFormat:@"QEMU %s - (Press 
ctrl + alt + g to release Mouse)", qemu_name]];
  else
@@ -1052,7 +1054,9 @@ QemuCocoaView *cocoaView;
  {
  COCOA_DEBUG("QemuCocoaView: ungrabMouse\n");
  
-if (!isFullscreen) {

+if (isFullscreen) {
+[NSMenu setMenuBarVisible: TRUE];
+} else {
  if (qemu_name)
  [normalWindow setTitle:[NSString stringWithFormat:@"QEMU %s", 
qemu_name]];
  else


[QemuCocoaView -toggleFullscreen:] also has the calls to [NSMenu 
setMenuBarVisible:], which should be removed.


Regards,
Akihiko Odaki

Re: [PATCH 1/2] ui/cocoa: add option to disable left-command forwarding to guest

[Peter Maydell]

On Sun, 2 Jan 2022 at 17:42, Carwyn Ellis  wrote:
>
> When switching between guest and host on a Mac using command-tab the
> command key is sent to the guest which can trigger functionality in the
> guest OS. Specifying left-command-key=off disables forwarding this key
> to the guest. Defaults to enabled.
>
> Also updated the cocoa display documentation to reference the new
> left-command-key option along with the existing show-cursor option.
>
> Signed-off-by: Carwyn Ellis 

Ccing the QAPI folks for review on the QAPI parts of this.

-- PMM

> ---
>  qapi/ui.json| 17 +
>  qemu-options.hx | 12 
>  ui/cocoa.m  |  8 +++-
>  3 files changed, 36 insertions(+), 1 deletion(-)
>
> diff --git a/qapi/ui.json b/qapi/ui.json
> index 2b4371da37..764480e145 100644
> --- a/qapi/ui.json
> +++ b/qapi/ui.json
> @@ -1107,6 +1107,22 @@
>'data': { '*grab-on-hover' : 'bool',
>  '*zoom-to-fit'   : 'bool'  } }
>
> +##
> +# @DisplayCocoa:
> +#
> +# Cocoa display options.
> +#
> +# @left-command-key: Enable/disable forwarding of left command key to
> +#guest. Allows command-tab window switching on the
> +#host without sending this key to the guest when
> +#"off". Defaults to "on"
> +#
> +# Since: 6.2.50
> +#
> +##
> +{ 'struct'  : 'DisplayCocoa',
> +  'data': { '*left-command-key' : 'bool' } }
> +
>  ##
>  # @DisplayEGLHeadless:
>  #
> @@ -1254,6 +1270,7 @@
>'discriminator' : 'type',
>'data': {
>'gtk': { 'type': 'DisplayGTK', 'if': 'CONFIG_GTK' },
> +  'cocoa': { 'type': 'DisplayCocoa', 'if': 'CONFIG_COCOA' },
>'curses': { 'type': 'DisplayCurses', 'if': 'CONFIG_CURSES' },
>'egl-headless': { 'type': 'DisplayEGLHeadless',
>  'if': { 'all': ['CONFIG_OPENGL', 'CONFIG_GBM'] } },
> diff --git a/qemu-options.hx b/qemu-options.hx
> index fd1f8135fb..6fa9c38c83 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -1912,6 +1912,9 @@ DEF("display", HAS_ARG, QEMU_OPTION_display,
>  #if defined(CONFIG_DBUS_DISPLAY)
>  "-display dbus[,addr=]\n"
>  " [,gl=on|core|es|off][,rendernode=]\n"
> +#endif
> +#if defined(CONFIG_COCOA)
> +"-display cocoa[,show-cursor=on|off][,left-command-key=on|off]\n"
>  #endif
>  "-display none\n"
>  "select display backend type\n"
> @@ -1999,6 +2002,15 @@ SRST
>  ``charset=CP850`` for IBM CP850 encoding. The default is
>  ``CP437``.
>
> +``cocoa``
> +Display video output in a Cocoa window. Mac only. This interface
> +provides drop-down menus and other UI elements to configure and
> +control the VM during runtime. Valid parameters are:
> +
> +``show-cursor=on|off`` :  Force showing the mouse cursor
> +
> +``left-command-key=on|off`` : Disable forwarding left command key to 
> host
> +
>  ``egl-headless[,rendernode=]``
>  Offload all OpenGL operations to a local DRI device. For any
>  graphical display, this display needs to be paired with either
> diff --git a/ui/cocoa.m b/ui/cocoa.m
> index 69745c483b..01045d6698 100644
> --- a/ui/cocoa.m
> +++ b/ui/cocoa.m
> @@ -95,6 +95,7 @@ static DisplayChangeListener dcl = {
>  };
>  static int last_buttons;
>  static int cursor_hide = 1;
> +static int left_command_key_enabled = 1;
>
>  static int gArgc;
>  static char **gArgv;
> @@ -834,7 +835,8 @@ QemuCocoaView *cocoaView;
>  /* Don't pass command key changes to guest unless mouse is 
> grabbed */
>  case kVK_Command:
>  if (isMouseGrabbed &&
> -!!(modifiers & NSEventModifierFlagCommand)) {
> +!!(modifiers & NSEventModifierFlagCommand) &&
> +left_command_key_enabled) {
>  [self toggleKey:Q_KEY_CODE_META_L];
>  }
>  break;
> @@ -2054,6 +2056,10 @@ static void cocoa_display_init(DisplayState *ds, 
> DisplayOptions *opts)
>  cursor_hide = 0;
>  }
>
> +if (opts->u.cocoa.has_left_command_key && 
> !opts->u.cocoa.left_command_key) {
> +left_command_key_enabled = 0;
> +}
> +
>  // register vga output callbacks
>  register_displaychangelistener();

Re: [PATCH 2/2] ui/cocoa: release mouse when user switches away from QEMU window

[Akihiko Odaki]

Reviewed-by: Akihiko Odaki 

On 2022/01/03 2:41, Carwyn Ellis wrote:

This resolves an issue where using command-tab to switch between QEMU
and other windows on the host can leave the mouse pointer visible.

By releasing the mouse when the user switches away, the user must left
click on the QEMU window when switching back in order to hide the
pointer and return control to the guest.

This appraoch ensures that the calls to NSCursor hide and unhide are
always balanced and thus work correctly when invoked.

Signed-off-by: Carwyn Ellis 
---
  ui/cocoa.m | 2 ++
  1 file changed, 2 insertions(+)

diff --git a/ui/cocoa.m b/ui/cocoa.m
index 01045d6698..3f7af4a8fa 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -1243,6 +1243,7 @@ QemuCocoaView *cocoaView;
  - (void) applicationWillResignActive: (NSNotification *)aNotification
  {
  COCOA_DEBUG("QemuCocoaAppController: applicationWillResignActive\n");
+[cocoaView ungrabMouse];
  [cocoaView raiseAllKeys];
  }
  
@@ -2052,6 +2053,7 @@ static void cocoa_display_init(DisplayState *ds, DisplayOptions *opts)

  [(QemuCocoaAppController *)[[NSApplication sharedApplication] 
delegate] toggleFullScreen: nil];
  });
  }
+
  if (opts->has_show_cursor && opts->show_cursor) {
  cursor_hide = 0;
  }

Re: [PULL 00/10] Misc next patches

[Peter Maydell]

On Thu, 17 Feb 2022 at 12:01, Daniel P. Berrangé  wrote:
>
> The following changes since commit ad38520bdeb2b1e0b487db317f29119e94c1c88d:
>
>   Merge remote-tracking branch 
> 'remotes/stefanha-gitlab/tags/block-pull-request' into staging (2022-02-15 
> 19:30:33 +)
>
> are available in the Git repository at:
>
>   https://gitlab.com/berrange/qemu tags/misc-next-pull-request
>
> for you to fetch changes up to 2720ceda0521bc43139cfdf45e3e470559e11ce3:
>
>   docs: expand firmware descriptor to allow flash without NVRAM (2022-02-16 
> 18:53:26 +)
>
> 
> This misc series of changes:
>
>  - Improves documentation of SSH fingerprint checking
>  - Fixes SHA256 fingerprints with non-blockdev usage
>  - Blocks the clone3, setns, unshare & execveat syscalls
>with seccomp
>  - Blocks process spawning via clone syscall, but allows
>threads, with seccomp
>  - Takes over seccomp maintainer role
>  - Expands firmware descriptor spec to allow flash
>without NVRAM

Hi; this series seems to cause the x64-freebsd-13-build to fail:
https://gitlab.com/qemu-project/qemu/-/jobs/2112237501

1/1 qemu:block / qemu-iotests qcow2 ERROR 155.99s exit status 1
▶ 469/707 /or1k/qmp/x-query-opcount OK
▶ 493/707 /ppc64/pnv-xscom/cfam_id/POWER8NVL OK
Summary of Failures:
1/1 qemu:block / qemu-iotests qcow2 ERROR 155.99s exit status 1
Ok: 0
Expected Fail: 0
Fail: 1
Unexpected Pass: 0
Skipped: 0
Timeout: 0
Full log written to /tmp/cirrus-ci-build/build/meson-logs/iotestslog.txt

This is an allowed-to-fail job, so I could in theory allow the
merge, but OTOH the job was passing previously and the failure
is block-related and this is a block-related pullreq...

thanks
-- PMM

[PATCH v5 00/12] Improve PMU support

[Atish Patra]

The latest version of the SBI specification includes a Performance Monitoring
Unit(PMU) extension[1] which allows the supervisor to start/stop/configure
various PMU events. The Sscofpmf ('Ss' for Privileged arch and Supervisor-level
extensions, and 'cofpmf' for Count OverFlow and Privilege Mode Filtering)
extension[2] allows the perf like tool to handle overflow interrupts and
filtering support.

This series implements full PMU infrastructure to support
PMU in virt machine. This will allow us to add any PMU events in future.

Currently, this series enables the following omu events.
1. cycle count
2. instruction count
3. DTLB load/store miss
4. ITLB prefetch miss

The first two are computed using host ticks while last three are counted during
cpu_tlb_fill. We can do both sampling and count from guest userspace.
This series has been tested on both RV64 and RV32. Both Linux[3] and Opensbi[4]
patches are required to get the perf working.

Here is an output of perf stat/report while running hackbench with OpenSBI & 
Linux
kernel patches applied [3].

Perf stat:
==
[root@fedora-riscv ~]# perf stat -e cycles -e instructions -e dTLB-load-misses 
-e dTLB-store-misses -e iTLB-load-misses \
> perf bench sched messaging -g 1 -l 10
# Running 'sched/messaging' benchmark:
# 20 sender and receiver processes per group
# 1 groups == 40 processes run

 Total time: 0.265 [sec]

 Performance counter stats for 'perf bench sched messaging -g 1 -l 10':

 4,167,825,362  cycles  

 4,166,609,256  instructions  #1.00  insn per cycle 

 3,092,026  dTLB-load-misses

   258,280  dTLB-store-misses   

 2,068,966  iTLB-load-misses


   0.585791767 seconds time elapsed

   0.373802000 seconds user
   1.042359000 seconds sys

Perf record:

[root@fedora-riscv ~]# perf record -e cycles -e instructions \
> -e dTLB-load-misses -e dTLB-store-misses -e iTLB-load-misses -c 1 \
> perf bench sched messaging -g 1 -l 10
# Running 'sched/messaging' benchmark:
# 20 sender and receiver processes per group
# 1 groups == 40 processes run

 Total time: 1.397 [sec]
[ perf record: Woken up 10 times to write data ]
Check IO/CPU overload!
[ perf record: Captured and wrote 8.211 MB perf.data (214486 samples) ]

[root@fedora-riscv riscv]# perf report
Available samples   
107K cycles◆
107K instructions  ▒
250 dTLB-load-misses   ▒
13 dTLB-store-misses   ▒
172 iTLB-load-misses  
..

Changes from v4->v5:
1. Rebased on top of the -next with following patches.
   - isa extension
   - priv 1.12 spec
2. Addressed all the comments on v4
3. Removed additional isa-ext DT node in favor of riscv,isa string update

Changes from v3->v4:
1. Removed the dummy events from pmu DT node.
2. Fixed pmu_avail_counters mask generation.
3. Added a patch to simplify the predicate function for counters. 

Changes from v2->v3:
1. Addressed all the comments on PATCH1-4.
2. Split patch1 into two separate patches.
3. Added explicit comments to explain the event types in DT node.
4. Rebased on latest Qemu.

Changes from v1->v2:
1. Dropped the ACks from v1 as signficant changes happened after v1.
2. sscofpmf support.
3. A generic counter management framework.

[1] https://github.com/riscv-non-isa/riscv-sbi-doc/blob/master/riscv-sbi.adoc
[2] https://drive.google.com/file/d/171j4jFjIkKdj5LWcExphq4xG_2sihbfd/edit
[3] https://github.com/atishp04/linux/tree/riscv_pmu_v6
[4] https://github.com/atishp04/qemu/tree/riscv_pmu_v5

Atish Patra (12):
target/riscv: Fix PMU CSR predicate function
target/riscv: Implement PMU CSR predicate function for S-mode
target/riscv: pmu: Rename the counters extension to pmu
target/riscv: pmu: Make number of counters configurable
target/riscv: Implement mcountinhibit CSR
target/riscv: Add support for hpmcounters/hpmevents
target/riscv: Support mcycle/minstret write operation
target/riscv: Add sscofpmf extension support
target/riscv: Simplify counter predicate function
target/riscv: Add few cache related PMU events
hw/riscv: virt: Add PMU DT node to the device tree
target/riscv: Update the privilege field for sscofpmf CSRs

hw/riscv/virt.c   |  28 ++
target/riscv/cpu.c|  15 +-
target/riscv/cpu.h|  49 ++-
target/riscv/cpu_bits.h   |  59 +++
target/riscv/cpu_helper.c |  26 ++
target/riscv/csr.c| 862 --
target/riscv/machine.c|  25 ++
target/riscv/meson.build  |   1 +
target/riscv/pmu.c| 431 

[PATCH v5 05/12] target/riscv: Implement mcountinhibit CSR

[Atish Patra]

From: Atish Patra 

As per the privilege specification v1.11, mcountinhibit allows to start/stop
a pmu counter selectively.

Reviewed-by: Bin Meng 
Reviewed-by: Alistair Francis 
Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/cpu.h  |  2 ++
 target/riscv/cpu_bits.h |  4 
 target/riscv/csr.c  | 25 +
 target/riscv/machine.c  |  1 +
 4 files changed, 32 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index f6b994a74ed9..ea3862ccbf5c 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -259,6 +259,8 @@ struct CPURISCVState {
 target_ulong scounteren;
 target_ulong mcounteren;
 
+target_ulong mcountinhibit;
+
 target_ulong sscratch;
 target_ulong mscratch;
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index bb47cf7e77a2..48b39e6d52a7 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -367,6 +367,10 @@
 #define CSR_MHPMCOUNTER29   0xb1d
 #define CSR_MHPMCOUNTER30   0xb1e
 #define CSR_MHPMCOUNTER31   0xb1f
+
+/* Machine counter-inhibit register */
+#define CSR_MCOUNTINHIBIT   0x320
+
 #define CSR_MHPMEVENT3  0x323
 #define CSR_MHPMEVENT4  0x324
 #define CSR_MHPMEVENT5  0x325
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index d69bd2d88454..2283ff33a5d7 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -1379,6 +1379,28 @@ static RISCVException write_mtvec(CPURISCVState *env, 
int csrno,
 return RISCV_EXCP_NONE;
 }
 
+static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
+ target_ulong *val)
+{
+if (env->priv_ver < PRIV_VERSION_1_11_0) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+*val = env->mcountinhibit;
+return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
+  target_ulong val)
+{
+if (env->priv_ver < PRIV_VERSION_1_11_0) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+env->mcountinhibit = val;
+return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
   target_ulong *val)
 {
@@ -3553,6 +3575,9 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,   read_zero },
 [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,   read_zero },
 
+[CSR_MCOUNTINHIBIT]  = { "mcountinhibit",   any,read_mcountinhibit,
+   write_mcountinhibit },
+
 [CSR_MHPMEVENT3] = { "mhpmevent3", any,read_zero },
 [CSR_MHPMEVENT4] = { "mhpmevent4", any,read_zero },
 [CSR_MHPMEVENT5] = { "mhpmevent5", any,read_zero },
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index ebc33c9e2781..a34cc3f69c4b 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -299,6 +299,7 @@ const VMStateDescription vmstate_riscv_cpu = {
 VMSTATE_UINTTL(env.siselect, RISCVCPU),
 VMSTATE_UINTTL(env.scounteren, RISCVCPU),
 VMSTATE_UINTTL(env.mcounteren, RISCVCPU),
+VMSTATE_UINTTL(env.mcountinhibit, RISCVCPU),
 VMSTATE_UINTTL(env.sscratch, RISCVCPU),
 VMSTATE_UINTTL(env.mscratch, RISCVCPU),
 VMSTATE_UINT64(env.mfromhost, RISCVCPU),
-- 
2.30.2

[PATCH v5 00/12] Improve PMU support

[Atish Patra]

The latest version of the SBI specification includes a Performance Monitoring
Unit(PMU) extension[1] which allows the supervisor to start/stop/configure
various PMU events. The Sscofpmf ('Ss' for Privileged arch and Supervisor-level
extensions, and 'cofpmf' for Count OverFlow and Privilege Mode Filtering)
extension[2] allows the perf like tool to handle overflow interrupts and
filtering support.

This series implements full PMU infrastructure to support
PMU in virt machine. This will allow us to add any PMU events in future.

Currently, this series enables the following omu events.
1. cycle count
2. instruction count
3. DTLB load/store miss
4. ITLB prefetch miss

The first two are computed using host ticks while last three are counted during
cpu_tlb_fill. We can do both sampling and count from guest userspace.
This series has been tested on both RV64 and RV32. Both Linux[3] and Opensbi[4]
patches are required to get the perf working.

Here is an output of perf stat/report while running hackbench with OpenSBI & 
Linux
kernel patches applied [3].

Perf stat:
==
[root@fedora-riscv ~]# perf stat -e cycles -e instructions -e dTLB-load-misses 
-e dTLB-store-misses -e iTLB-load-misses \
> perf bench sched messaging -g 1 -l 10
# Running 'sched/messaging' benchmark:
# 20 sender and receiver processes per group
# 1 groups == 40 processes run

 Total time: 0.265 [sec]

 Performance counter stats for 'perf bench sched messaging -g 1 -l 10':

 4,167,825,362  cycles  

 4,166,609,256  instructions  #1.00  insn per cycle 

 3,092,026  dTLB-load-misses

   258,280  dTLB-store-misses   

 2,068,966  iTLB-load-misses


   0.585791767 seconds time elapsed

   0.373802000 seconds user
   1.042359000 seconds sys

Perf record:

[root@fedora-riscv ~]# perf record -e cycles -e instructions \
> -e dTLB-load-misses -e dTLB-store-misses -e iTLB-load-misses -c 1 \
> perf bench sched messaging -g 1 -l 10
# Running 'sched/messaging' benchmark:
# 20 sender and receiver processes per group
# 1 groups == 40 processes run

 Total time: 1.397 [sec]
[ perf record: Woken up 10 times to write data ]
Check IO/CPU overload!
[ perf record: Captured and wrote 8.211 MB perf.data (214486 samples) ]

[root@fedora-riscv riscv]# perf report
Available samples   
107K cycles◆
107K instructions  ▒
250 dTLB-load-misses   ▒
13 dTLB-store-misses   ▒
172 iTLB-load-misses  
..

Changes from v4->v5:
1. Rebased on top of the -next with following patches.
   - isa extension
   - priv 1.12 spec
2. Addressed all the comments on v4
3. Removed additional isa-ext DT node in favor of riscv,isa string update

Changes from v3->v4:
1. Removed the dummy events from pmu DT node.
2. Fixed pmu_avail_counters mask generation.
3. Added a patch to simplify the predicate function for counters. 

Changes from v2->v3:
1. Addressed all the comments on PATCH1-4.
2. Split patch1 into two separate patches.
3. Added explicit comments to explain the event types in DT node.
4. Rebased on latest Qemu.

Changes from v1->v2:
1. Dropped the ACks from v1 as signficant changes happened after v1.
2. sscofpmf support.
3. A generic counter management framework.

[1] https://github.com/riscv-non-isa/riscv-sbi-doc/blob/master/riscv-sbi.adoc
[2] https://drive.google.com/file/d/171j4jFjIkKdj5LWcExphq4xG_2sihbfd/edit
[3] https://github.com/atishp04/linux/tree/riscv_pmu_v6
[4] https://github.com/atishp04/qemu/tree/riscv_pmu_v5

Atish Patra (12):
target/riscv: Fix PMU CSR predicate function
target/riscv: Implement PMU CSR predicate function for S-mode
target/riscv: pmu: Rename the counters extension to pmu
target/riscv: pmu: Make number of counters configurable
target/riscv: Implement mcountinhibit CSR
target/riscv: Add support for hpmcounters/hpmevents
target/riscv: Support mcycle/minstret write operation
target/riscv: Add sscofpmf extension support
target/riscv: Simplify counter predicate function
target/riscv: Add few cache related PMU events
hw/riscv: virt: Add PMU DT node to the device tree
target/riscv: Update the privilege field for sscofpmf CSRs

hw/riscv/virt.c   |  28 ++
target/riscv/cpu.c|  15 +-
target/riscv/cpu.h|  49 ++-
target/riscv/cpu_bits.h   |  59 +++
target/riscv/cpu_helper.c |  26 ++
target/riscv/csr.c| 862 --
target/riscv/machine.c|  25 ++
target/riscv/meson.build  |   1 +
target/riscv/pmu.c| 431 

[PATCH v5 03/12] target/riscv: pmu: Rename the counters extension to pmu

[Atish Patra]

From: Atish Patra 

The PMU counters are supported via cpu config "Counters" which doesn't
indicate the correct purpose of those counters.

Rename the config property to pmu to indicate that these counters
are performance monitoring counters. This aligns with cpu options for
ARM architecture as well.

Reviewed-by: Bin Meng 
Reviewed-by: Alistair Francis 
Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/cpu.c | 2 +-
 target/riscv/cpu.h | 2 +-
 target/riscv/csr.c | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 09dc07d12d6f..173b9d3c5d3e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -768,7 +768,7 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
 DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
-DEFINE_PROP_BOOL("Counters", RISCVCPU, cfg.ext_counters, true),
+DEFINE_PROP_BOOL("pmu", RISCVCPU, cfg.ext_pmu, true),
 DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
 DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
 DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 5d914bd34550..2dc491887f24 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -365,7 +365,7 @@ struct RISCVCPUConfig {
 bool ext_zbb;
 bool ext_zbc;
 bool ext_zbs;
-bool ext_counters;
+bool ext_pmu;
 bool ext_ifencei;
 bool ext_icsr;
 bool ext_svinval;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 789f0c598932..2c3bba81c8af 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -69,8 +69,8 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 RISCVCPU *cpu = RISCV_CPU(cs);
 int ctr_index;
 
-if (!cpu->cfg.ext_counters) {
-/* The Counters extensions is not enabled */
+if (!cpu->cfg.ext_pmu) {
+/* The PMU extension is not enabled */
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
-- 
2.30.2

[PATCH v5 02/12] target/riscv: Implement PMU CSR predicate function for S-mode

[Atish Patra]

From: Atish Patra 

Currently, the predicate function for PMU related CSRs only works if
virtualization is enabled. It also does not check mcounteren bits before
before cycle/minstret/hpmcounterx access.

Support supervisor mode access in the predicate function as well.

Reviewed-by: Alistair Francis 
Reviewed-by: Bin Meng 
Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/csr.c | 52 ++
 1 file changed, 52 insertions(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 3799ee850087..789f0c598932 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -67,12 +67,64 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 #if !defined(CONFIG_USER_ONLY)
 CPUState *cs = env_cpu(env);
 RISCVCPU *cpu = RISCV_CPU(cs);
+int ctr_index;
 
 if (!cpu->cfg.ext_counters) {
 /* The Counters extensions is not enabled */
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
+if (env->priv == PRV_S) {
+switch (csrno) {
+case CSR_CYCLE:
+if (!get_field(env->mcounteren, COUNTEREN_CY)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+case CSR_TIME:
+if (!get_field(env->mcounteren, COUNTEREN_TM)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+case CSR_INSTRET:
+if (!get_field(env->mcounteren, COUNTEREN_IR)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
+ctr_index = csrno - CSR_CYCLE;
+if (!get_field(env->mcounteren, 1 << ctr_index)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+}
+if (riscv_cpu_is_32bit(env)) {
+switch (csrno) {
+case CSR_CYCLEH:
+if (!get_field(env->mcounteren, COUNTEREN_CY)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+case CSR_TIMEH:
+if (!get_field(env->mcounteren, COUNTEREN_TM)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+case CSR_INSTRETH:
+if (!get_field(env->mcounteren, COUNTEREN_IR)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
+ctr_index = csrno - CSR_CYCLEH;
+if (!get_field(env->mcounteren, 1 << ctr_index)) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+break;
+}
+}
+}
+
 if (riscv_cpu_virt_enabled(env)) {
 switch (csrno) {
 case CSR_CYCLE:
-- 
2.30.2

configure: How to pass flags to the Objective-C compiler?

[Joshua Seaton]

Hi all,

How does one pass Objective-C compilation flags (e.g., a sysroot
specification) when configuring/building? `configure` exposes
`--extra-cflags` and `--extra-cxxflags` for C/C++ compilation, but
there isn't an equivalent for Objective-C.

In my particular case, I'd like to specify a particular sysroot for a
macOS build.


Joshua.

[PATCH v2 1/2] hw/ide: split bmdma read and write functions from piix.c

[Liav Albani]

This is a preparation before implementing another PCI IDE controller
that relies on these functions, so these can be shared between both
implementations.

Signed-off-by: Liav Albani 
---
 hw/ide/bmdma.c | 84 ++
 hw/ide/meson.build |  2 +-
 hw/ide/piix.c  | 51 ++---
 include/hw/ide/bmdma.h | 34 +
 4 files changed, 122 insertions(+), 49 deletions(-)
 create mode 100644 hw/ide/bmdma.c
 create mode 100644 include/hw/ide/bmdma.h

diff --git a/hw/ide/bmdma.c b/hw/ide/bmdma.c
new file mode 100644
index 00..d12ed730dd
--- /dev/null
+++ b/hw/ide/bmdma.c
@@ -0,0 +1,84 @@
+/*
+ * QEMU IDE Emulation: Intel PCI Bus master IDE support for PIIX3/4 and ICH6/7.
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * Copyright (c) 2006 Openedhand Ltd.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qemu/module.h"
+#include "sysemu/block-backend.h"
+#include "sysemu/blockdev.h"
+#include "sysemu/dma.h"
+
+#include "hw/ide/bmdma.h"
+#include "hw/ide/pci.h"
+#include "trace.h"
+
+uint64_t intel_ide_bmdma_read(void *opaque, hwaddr addr, unsigned size)
+{
+BMDMAState *bm = opaque;
+uint32_t val;
+
+if (size != 1) {
+return ((uint64_t)1 << (size * 8)) - 1;
+}
+
+switch (addr & 3) {
+case 0:
+val = bm->cmd;
+break;
+case 2:
+val = bm->status;
+break;
+default:
+val = 0xff;
+break;
+}
+
+trace_bmdma_read(addr, val);
+return val;
+}
+
+void intel_ide_bmdma_write(void *opaque, hwaddr addr,
+uint64_t val, unsigned size)
+{
+BMDMAState *bm = opaque;
+
+if (size != 1) {
+return;
+}
+
+trace_bmdma_write(addr, val);
+
+switch (addr & 3) {
+case 0:
+bmdma_cmd_writeb(bm, val);
+break;
+case 2:
+uint8_t cur_val = bm->status;
+bm->status = (val & 0x60) | (cur_val & 1) | (cur_val & ~val & 0x06);
+break;
+}
+}
diff --git a/hw/ide/meson.build b/hw/ide/meson.build
index ddcb3b28d2..38f9ae7178 100644
--- a/hw/ide/meson.build
+++ b/hw/ide/meson.build
@@ -7,7 +7,7 @@ softmmu_ss.add(when: 'CONFIG_IDE_ISA', if_true: files('isa.c', 
'ioport.c'))
 softmmu_ss.add(when: 'CONFIG_IDE_MACIO', if_true: files('macio.c'))
 softmmu_ss.add(when: 'CONFIG_IDE_MMIO', if_true: files('mmio.c'))
 softmmu_ss.add(when: 'CONFIG_IDE_PCI', if_true: files('pci.c'))
-softmmu_ss.add(when: 'CONFIG_IDE_PIIX', if_true: files('piix.c', 'ioport.c'))
+softmmu_ss.add(when: 'CONFIG_IDE_PIIX', if_true: files('piix.c', 'ioport.c', 
'bmdma.c'))
 softmmu_ss.add(when: 'CONFIG_IDE_QDEV', if_true: files('qdev.c'))
 softmmu_ss.add(when: 'CONFIG_IDE_SII3112', if_true: files('sii3112.c'))
 softmmu_ss.add(when: 'CONFIG_IDE_VIA', if_true: files('via.c'))
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index ce89fd0aa3..8f94809eee 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -33,57 +33,12 @@
 #include "sysemu/dma.h"
 
 #include "hw/ide/pci.h"
+#include "hw/ide/bmdma.h"
 #include "trace.h"
 
-static uint64_t bmdma_read(void *opaque, hwaddr addr, unsigned size)
-{
-BMDMAState *bm = opaque;
-uint32_t val;
-
-if (size != 1) {
-return ((uint64_t)1 << (size * 8)) - 1;
-}
-
-switch(addr & 3) {
-case 0:
-val = bm->cmd;
-break;
-case 2:
-val = bm->status;
-break;
-default:
-val = 0xff;
-break;
-}
-
-trace_bmdma_read(addr, val);
-return val;
-}
-
-static void bmdma_write(void *opaque, hwaddr addr,
-uint64_t val, unsigned size)
-{
-BMDMAState *bm = opaque;
-
-if (size != 1) {
-return;
-}
-
-trace_bmdma_write(addr, val);
-
-switch(addr & 3) {
-case 0:
-bmdma_cmd_writeb(bm, val);
-break;
-case 

Re: Call for GSoC and Outreachy project ideas for summer 2022

[Alexander Bulekov]

On 220128 1547, Stefan Hajnoczi wrote:
> Dear QEMU, KVM, and rust-vmm communities,
> QEMU will apply for Google Summer of Code 2022
> (https://summerofcode.withgoogle.com/) and has been accepted into
> Outreachy May-August 2022 (https://www.outreachy.org/). You can now
> submit internship project ideas for QEMU, KVM, and rust-vmm!
> 
> If you have experience contributing to QEMU, KVM, or rust-vmm you can
> be a mentor. It's a great way to give back and you get to work with
> people who are just starting out in open source.
> 
> Please reply to this email by February 21st with your project ideas.
> 
> Good project ideas are suitable for remote work by a competent
> programmer who is not yet familiar with the codebase. In
> addition, they are:
> - Well-defined - the scope is clear
> - Self-contained - there are few dependencies
> - Uncontroversial - they are acceptable to the community
> - Incremental - they produce deliverables along the way
> 
> Feel free to post ideas even if you are unable to mentor the project.
> It doesn't hurt to share the idea!

Here are two fuzzing-related ideas:

Summary: Implement rapid guest-initiated snapshot/restore functionality (for
Fuzzing).

Description:
Many recent fuzzing projects rely on snapshot/restore functionality
[1,2,3,4,5]. For example tests/fuzzers that target large targets, such as OS
kernels and browsers benefit from full-VM snapshots, where solutions such as
manual state-cleanup and fork-servers are insufficient. 
Many of the existing solutions are based on QEMU, however there is currently no
upstream-solution. Furthermore, hypervisors, such as Xen have already
incorporated support for snapshot-fuzzing.
In this project, you will implement a virtual-device for snapshot fuzzing,
following a spec agreed-upon by the community.  The device will implement
standard fuzzing APIs that allow fuzzing using engines, such as libFuzzer and
AFL++. The simple APIs exposed by the device will allow fuzzer developers to
build custom harnesses in the VM to request snapshots, memory/device/register
restores, request new inputs, and report coverage.

[1] https://arxiv.org/pdf/2111.03013.pdf
[2] 
https://blog.mozilla.org/attack-and-defense/2021/01/27/effectively-fuzzing-the-ipc-layer-in-firefox/
[3] https://www.usenix.org/system/files/sec20-song.pdf
[4] https://github.com/intel/kernel-fuzzer-for-xen-project
[5] https://github.com/quarkslab/rewind

Skill level: Intermediate with interest and experience in fuzzing.
Language/Skills: C
Topic/Skill Areas: Fuzzing, OS/Systems/Drivers

Summary: Implement a coverage-guided fuzzer for QEMU images

Description:
QEMU has a qcow2 fuzzer (see tests/image-fuzzer). However, this fuzzer is not
coverage-guided, and is limited to qcow2 images. Furthermore, it does not run
on OSS-Fuzz. In some contexts, qemu-img is expected to handle untrusted disk
images. As such, it is important to effectively fuzz this code.
Your task will be to create a coverage-guided fuzzer for image formats
supported by QEMU. Beyond basic image-parsing code, the fuzzer should be able
to find bugs in image-conversion code.  Combined with a corpus of QEMU images,
the fuzzer harness will need less information about image layout.

Skill level: Intermediate
Language/Skills: C
Topic/Skill Areas: Fuzzing, libFuzzer/AFL

Thanks
-Alex

Re: configure: How to pass flags to the Objective-C compiler?

[Philippe Mathieu-Daudé via]

Hi Joshua,

On 18/2/22 22:58, Joshua Seaton wrote:

Hi all,

How does one pass Objective-C compilation flags (e.g., a sysroot
specification) when configuring/building? `configure` exposes
`--extra-cflags` and `--extra-cxxflags` for C/C++ compilation, but
there isn't an equivalent for Objective-C.


You can use this patch (which is going to be merged soon):
https://lore.kernel.org/qemu-devel/20220215080307.69550-3-f4...@amsat.org/


In my particular case, I'd like to specify a particular sysroot for a
macOS build.


Regards,

Phil.

[PATCH v5 08/12] target/riscv: Add sscofpmf extension support

[Atish Patra]

The Sscofpmf ('Ss' for Privileged arch and Supervisor-level extensions,
and 'cofpmf' for Count OverFlow and Privilege Mode Filtering)
extension allows the perf to handle overflow interrupts and filtering
support. This patch provides a framework for programmable
counters to leverage the extension. As the extension doesn't have any
provision for the overflow bit for fixed counters, the fixed events
can also be monitoring using programmable counters. The underlying
counters for cycle and instruction counters are always running. Thus,
a separate timer device is programmed to handle the overflow.

Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/cpu.c  |  12 ++
 target/riscv/cpu.h  |  25 +++
 target/riscv/cpu_bits.h |  55 +++
 target/riscv/csr.c  | 159 --
 target/riscv/pmu.c  | 346 +++-
 target/riscv/pmu.h  |   8 +
 6 files changed, 593 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 02e089710a7e..677210bc6d94 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -22,6 +22,7 @@
 #include "qemu/ctype.h"
 #include "qemu/log.h"
 #include "cpu.h"
+#include "pmu.h"
 #include "internals.h"
 #include "exec/exec-all.h"
 #include "qapi/error.h"
@@ -678,6 +679,16 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 set_misa(env, env->misa_mxl, ext);
 }
 
+if (cpu->cfg.pmu_num) {
+if (!riscv_pmu_init(cpu, cpu->cfg.pmu_num) && cpu->cfg.ext_sscofpmf) {
+cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+  riscv_pmu_timer_cb, cpu);
+if (!cpu->pmu_timer) {
+cpu->cfg.ext_sscofpmf = false;
+}
+}
+ }
+
 riscv_cpu_register_gdb_regs_for_features(cs);
 
 qemu_init_vcpu(cs);
@@ -769,6 +780,7 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
 DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
 DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
+DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
 DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
 DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
 DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 68522acda4d2..e2f92bb648d4 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -129,6 +129,8 @@ typedef struct PMUCTRState {
 /* Snapshort value of a counter in RV32 */
 target_ulong mhpmcounterh_prev;
 bool started;
+/* Value beyond UINT32_MAX/UINT64_MAX before overflow interrupt trigger */
+target_ulong irq_overflow_left;
 } PMUCTRState;
 
 struct CPURISCVState {
@@ -281,6 +283,9 @@ struct CPURISCVState {
 /* PMU event selector configured values. First three are unused*/
 target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
 
+/* PMU event selector configured values for RV32*/
+target_ulong mhpmeventh_val[RV_MAX_MHPMEVENTS];
+
 target_ulong sscratch;
 target_ulong mscratch;
 
@@ -396,6 +401,7 @@ struct RISCVCPUConfig {
 bool ext_zfhmin;
 bool ext_zve32f;
 bool ext_zve64f;
+bool ext_sscofpmf;
 
 /* Vendor-specific custom extensions */
 bool ext_XVentanaCondOps;
@@ -434,6 +440,12 @@ struct RISCVCPU {
 
 /* Configuration Settings */
 RISCVCPUConfig cfg;
+
+QEMUTimer *pmu_timer;
+/* A bitmask of Available programmable counters */
+uint32_t pmu_avail_ctrs;
+/* Mapping of events to counters */
+GHashTable *pmu_event_ctr_map;
 };
 
 static inline int riscv_has_ext(CPURISCVState *env, target_ulong ext)
@@ -693,6 +705,19 @@ enum {
 CSR_TABLE_SIZE = 0x1000
 };
 
+/**
+ * The event id are encoded based on the encoding specified in the
+ * SBI specification v0.3
+ */
+
+enum riscv_pmu_event_idx {
+RISCV_PMU_EVENT_HW_CPU_CYCLES = 0x01,
+RISCV_PMU_EVENT_HW_INSTRUCTIONS = 0x02,
+RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS = 0x10019,
+RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS = 0x1001B,
+RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS = 0x10021,
+};
+
 /* CSR function table */
 extern riscv_csr_operations csr_ops[CSR_TABLE_SIZE];
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 48b39e6d52a7..da78e2704081 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -400,6 +400,37 @@
 #define CSR_MHPMEVENT29 0x33d
 #define CSR_MHPMEVENT30 0x33e
 #define CSR_MHPMEVENT31 0x33f
+
+#define CSR_MHPMEVENT3H 0x723
+#define CSR_MHPMEVENT4H 0x724
+#define CSR_MHPMEVENT5H 0x725
+#define CSR_MHPMEVENT6H 0x726
+#define CSR_MHPMEVENT7H 0x727
+#define CSR_MHPMEVENT8H 0x728
+#define CSR_MHPMEVENT9H 0x729
+#define CSR_MHPMEVENT10H0x72a
+#define CSR_MHPMEVENT11H0x72b
+#define CSR_MHPMEVENT12H0x72c
+#define CSR_MHPMEVENT13H0x72d
+#define CSR_MHPMEVENT14H0x72e

[PATCH v5 07/12] target/riscv: Support mcycle/minstret write operation

[Atish Patra]

From: Atish Patra 

mcycle/minstret are actually WARL registers and can be written with any
given value. With SBI PMU extension, it will be used to store a initial
value provided from supervisor OS. The Qemu also need prohibit the counter
increment if mcountinhibit is set.

Support mcycle/minstret through generic counter infrastructure.

Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/cpu.h   |  23 +--
 target/riscv/csr.c   | 145 +++
 target/riscv/machine.c   |  25 ++-
 target/riscv/meson.build |   1 +
 target/riscv/pmu.c   |  32 +
 target/riscv/pmu.h   |  28 
 6 files changed, 201 insertions(+), 53 deletions(-)
 create mode 100644 target/riscv/pmu.c
 create mode 100644 target/riscv/pmu.h

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index cce5c3538c89..68522acda4d2 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -109,7 +109,7 @@ typedef struct CPURISCVState CPURISCVState;
 #endif
 
 #define RV_VLEN_MAX 1024
-#define RV_MAX_MHPMEVENTS 29
+#define RV_MAX_MHPMEVENTS 32
 #define RV_MAX_MHPMCOUNTERS 32
 
 FIELD(VTYPE, VLMUL, 0, 3)
@@ -119,6 +119,18 @@ FIELD(VTYPE, VMA, 7, 1)
 FIELD(VTYPE, VEDIV, 8, 2)
 FIELD(VTYPE, RESERVED, 10, sizeof(target_ulong) * 8 - 11)
 
+typedef struct PMUCTRState {
+/* Current value of a counter */
+target_ulong mhpmcounter_val;
+/* Current value of a counter in RV32*/
+target_ulong mhpmcounterh_val;
+/* Snapshot values of counter */
+target_ulong mhpmcounter_prev;
+/* Snapshort value of a counter in RV32 */
+target_ulong mhpmcounterh_prev;
+bool started;
+} PMUCTRState;
+
 struct CPURISCVState {
 target_ulong gpr[32];
 target_ulong gprh[32]; /* 64 top bits of the 128-bit registers */
@@ -263,13 +275,10 @@ struct CPURISCVState {
 
 target_ulong mcountinhibit;
 
-/* PMU counter configured values */
-target_ulong mhpmcounter_val[RV_MAX_MHPMCOUNTERS];
-
-/* for RV32 */
-target_ulong mhpmcounterh_val[RV_MAX_MHPMCOUNTERS];
+/* PMU counter state */
+PMUCTRState pmu_ctrs[RV_MAX_MHPMCOUNTERS];
 
-/* PMU event selector configured values */
+/* PMU event selector configured values. First three are unused*/
 target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
 
 target_ulong sscratch;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index dbb723a3307b..dc4d258205b3 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "cpu.h"
+#include "pmu.h"
 #include "qemu/main-loop.h"
 #include "exec/exec-all.h"
 
@@ -539,39 +540,33 @@ static int write_vcsr(CPURISCVState *env, int csrno, 
target_ulong val)
 }
 
 /* User Timers and Counters */
-static RISCVException read_instret(CPURISCVState *env, int csrno,
-   target_ulong *val)
+static target_ulong get_icount_ticks(bool rv32)
 {
+int64_t val;
+target_ulong result;
+
 #if !defined(CONFIG_USER_ONLY)
 if (icount_enabled()) {
-*val = icount_get();
+val = icount_get();
 } else {
-*val = cpu_get_host_ticks();
+val = cpu_get_host_ticks();
 }
 #else
-*val = cpu_get_host_ticks();
+val = cpu_get_host_ticks();
 #endif
-return RISCV_EXCP_NONE;
-}
 
-static RISCVException read_instreth(CPURISCVState *env, int csrno,
-target_ulong *val)
-{
-#if !defined(CONFIG_USER_ONLY)
-if (icount_enabled()) {
-*val = icount_get() >> 32;
+if (rv32) {
+result = val >> 32;
 } else {
-*val = cpu_get_host_ticks() >> 32;
+result = val;
 }
-#else
-*val = cpu_get_host_ticks() >> 32;
-#endif
-return RISCV_EXCP_NONE;
+
+return result;
 }
 
 static int read_mhpmevent(CPURISCVState *env, int csrno, target_ulong *val)
 {
-int evt_index = csrno - CSR_MHPMEVENT3;
+int evt_index = csrno - CSR_MCOUNTINHIBIT;
 
 *val = env->mhpmevent_val[evt_index];
 
@@ -580,7 +575,7 @@ static int read_mhpmevent(CPURISCVState *env, int csrno, 
target_ulong *val)
 
 static int write_mhpmevent(CPURISCVState *env, int csrno, target_ulong val)
 {
-int evt_index = csrno - CSR_MHPMEVENT3;
+int evt_index = csrno - CSR_MCOUNTINHIBIT;
 
 env->mhpmevent_val[evt_index] = val;
 
@@ -589,52 +584,102 @@ static int write_mhpmevent(CPURISCVState *env, int 
csrno, target_ulong val)
 
 static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
 {
-int ctr_index = csrno - CSR_MHPMCOUNTER3 + 3;
+int ctr_idx = csrno - CSR_MCYCLE;
+PMUCTRState *counter = >pmu_ctrs[ctr_idx];
 
-env->mhpmcounter_val[ctr_index] = val;
+counter->mhpmcounter_val = val;
+if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
+riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
+counter->mhpmcounter_prev = get_icount_ticks(false);
+} else {
+/* Other counters can keep incrementing from the given value 

[PATCH v5 12/12] target/riscv: Update the privilege field for sscofpmf CSRs

[Atish Patra]

The sscofpmf extension was ratified as a part of priv spec v1.12.
Mark the csr_ops accordingly.

Signed-off-by: Atish Patra 
---
 target/riscv/csr.c | 90 ++
 1 file changed, 60 insertions(+), 30 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 54966a770672..0407ff12b445 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -3786,63 +3786,92 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
write_mhpmevent },
 
 [CSR_MHPMEVENT3H]= { "mhpmevent3h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+  write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT4H]= { "mhpmevent4h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+  write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT5H]= { "mhpmevent5h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+  write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT6H]= { "mhpmevent6h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+  write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT7H]= { "mhpmevent7h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+  write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT8H]= { "mhpmevent8h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+  write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT9H]= { "mhpmevent9h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+  write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT10H]   = { "mhpmevent10h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+   write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT11H]   = { "mhpmevent11h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+   write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT12H]   = { "mhpmevent12h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+   write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT13H]   = { "mhpmevent13h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+   write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT14H]   = { "mhpmevent14h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+   write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT15H]   = { "mhpmevent15h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+   write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT16H]   = { "mhpmevent16h",sscofpmf,  read_mhpmeventh,
-   write_mhpmeventh},
+   write_mhpmeventh,
+ .min_priv_ver = PRIV_VERSION_1_12_0 },
 [CSR_MHPMEVENT17H]   = { "mhpmevent17h",sscofpmf,  read_mhpmeventh,
-   

Re: 'make check-acceptance' failing on s390 tests?

[Richard Henderson]

On 2/19/22 02:04, Peter Maydell wrote:

Hi; is anybody else seeing 'make check-acceptance' fail on some of
the s390 tests?

  (009/183) tests/avocado/boot_linux.py:BootLinuxS390X.test_s390_ccw_virtio_tcg:
INTERRUPTED: Test interrupted by SIGTERM\nRunner error occurred:
Timeout reached\nOriginal status: ERROR\n{'name':
'009-tests/avocado/boot_linux.py:BootLinuxS390X.test_s390_ccw_virtio_tcg',
'logdir': 
'/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/clang/tests/results/j...
(900.20 s)


  (090/183) 
tests/avocado/machine_s390_ccw_virtio.py:S390CCWVirtioMachine.test_s390x_fedora:
FAIL: b'1280 800\n' != b'1024 768\n' (26.79 s)


FWIW, yes, I'm seeing those.


r~

[PATCH v5 01/12] target/riscv: Fix PMU CSR predicate function

[Atish Patra]

From: Atish Patra 

The predicate function calculates the counter index incorrectly for
hpmcounterx. Fix the counter index to reflect correct CSR number.

Fixes: e39a8320b088 ("target/riscv: Support the Virtual Instruction fault")

Reviewed-by: Alistair Francis 
Reviewed-by: Bin Meng 
Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/csr.c | 10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index b16881615997..3799ee850087 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -94,8 +94,9 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 }
 break;
 case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
-if (!get_field(env->hcounteren, 1 << (csrno - CSR_HPMCOUNTER3)) &&
-get_field(env->mcounteren, 1 << (csrno - CSR_HPMCOUNTER3))) {
+ctr_index = csrno - CSR_CYCLE;
+if (!get_field(env->hcounteren, 1 << ctr_index) &&
+ get_field(env->mcounteren, 1 << ctr_index)) {
 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
@@ -121,8 +122,9 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 }
 break;
 case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
-if (!get_field(env->hcounteren, 1 << (csrno - 
CSR_HPMCOUNTER3H)) &&
-get_field(env->mcounteren, 1 << (csrno - 
CSR_HPMCOUNTER3H))) {
+ctr_index = csrno - CSR_CYCLEH;
+if (!get_field(env->hcounteren, 1 << ctr_index) &&
+ get_field(env->mcounteren, 1 << ctr_index)) {
 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 }
 break;
-- 
2.30.2

Re: [PATCH v2 2/2] hw/ide: add ich6 ide controller device emulation

[BALATON Zoltan]

On Fri, 18 Feb 2022, Liav Albani wrote:

This type of IDE controller has support for relocating the IO ports and
doesn't use IRQ 14 and 15 but one allocated PCI IRQ for the controller.

There's no x86 chipset in QEMU that will try to attach this device by
default. It is considered a legacy-free device in the aspect of PCI bus
resource management as the guest OS can relocate the IO ports as it sees
fit to its needs. However, this is still a legacy device that belongs to
chipsets from late 2000s.

Signed-off-by: Liav Albani 
---
hw/i386/Kconfig  |   2 +
hw/ide/Kconfig   |   5 +
hw/ide/ich6.c| 204 +++
hw/ide/meson.build   |   1 +
include/hw/ide/pci.h |   1 +
include/hw/pci/pci_ids.h |   1 +
6 files changed, 214 insertions(+)
create mode 100644 hw/ide/ich6.c

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index d22ac4a4b9..a18de2d962 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -75,6 +75,7 @@ config I440FX
select PCI_I440FX
select PIIX3
select IDE_PIIX
+select IDE_ICH6
select DIMM
select SMBIOS
select FW_CFG_DMA
@@ -101,6 +102,7 @@ config Q35
select PCI_EXPRESS_Q35
select LPC_ICH9
select AHCI_ICH9
+select IDE_ICH6
select DIMM
select SMBIOS
select FW_CFG_DMA
diff --git a/hw/ide/Kconfig b/hw/ide/Kconfig
index dd85fa3619..63304325a5 100644
--- a/hw/ide/Kconfig
+++ b/hw/ide/Kconfig
@@ -38,6 +38,11 @@ config IDE_VIA
select IDE_PCI
select IDE_QDEV

+config IDE_ICH6
+bool
+select IDE_PCI
+select IDE_QDEV
+
config MICRODRIVE
bool
select IDE_QDEV
diff --git a/hw/ide/ich6.c b/hw/ide/ich6.c
new file mode 100644
index 00..8f46d3fce2
--- /dev/null
+++ b/hw/ide/ich6.c
@@ -0,0 +1,204 @@
+/*
+ * QEMU IDE Emulation: PCI ICH6/ICH7 IDE support.


This is a small thing, but if these two are the same maybe keeping this 
comment but using the ich7 name everywhere else would make it less likely 
to get it confused with ich9. I mean ich6 and ich9 is easily confused, 
while ich7 is clearly distinct. But maybe it's just me, calling it ich6 is 
also correct and can be preferred by someone else.



+ *
+ * Copyright (c) 2022 Liav Albani
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qemu/module.h"
+#include "sysemu/block-backend.h"
+#include "sysemu/blockdev.h"
+#include "sysemu/dma.h"
+
+#include "hw/ide/pci.h"
+#include "hw/ide/bmdma.h"
+#include "trace.h"
+
+static const MemoryRegionOps ich6_bmdma_ops = {
+.read = intel_ide_bmdma_read,
+.write = intel_ide_bmdma_write,
+};
+
+static void bmdma_setup_bar(PCIIDEState *d)
+{
+int i;
+
+memory_region_init(>bmdma_bar, OBJECT(d), "ich6-bmdma-container", 16);
+for (i = 0; i < 2; i++) {
+BMDMAState *bm = >bmdma[i];
+
+memory_region_init_io(>extra_io, OBJECT(d), _bmdma_ops, bm,
+  "ich6-bmdma", 4);
+memory_region_add_subregion(>bmdma_bar, i * 8, >extra_io);
+memory_region_init_io(>addr_ioport, OBJECT(d),
+  _addr_ioport_ops, bm, "bmdma", 4);
+memory_region_add_subregion(>bmdma_bar, i * 8 + 4, 
>addr_ioport);
+}
+}
+
+static void ich6_pci_config_write(PCIDevice *d, uint32_t addr, uint32_t val,
+int l)
+{
+uint32_t i;
+
+pci_default_write_config(d, addr, val, l);
+
+for (i = addr; i < addr + l; i++) {
+switch (i) {
+case 0x40:
+pci_default_write_config(d, i, 0x8000, 2);
+continue;
+case 0x42:
+pci_default_write_config(d, i, 0x8000, 2);
+continue;
+}
+}


I'm not sure what this tries to do but this for cycle looks suspicious 
here. It's also only calls pci_default_write_config() so why didn't the 
default worked and why was this 

Re: [PATCH 1/2] ui/cocoa: add option to disable left-command forwarding to guest

[Akihiko Odaki]

Reviewed-by: Akihiko Odaki 

On 2022/01/03 2:41, Carwyn Ellis wrote:

When switching between guest and host on a Mac using command-tab the
command key is sent to the guest which can trigger functionality in the
guest OS. Specifying left-command-key=off disables forwarding this key
to the guest. Defaults to enabled.

Also updated the cocoa display documentation to reference the new
left-command-key option along with the existing show-cursor option.

Signed-off-by: Carwyn Ellis 
---
  qapi/ui.json| 17 +
  qemu-options.hx | 12 
  ui/cocoa.m  |  8 +++-
  3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/qapi/ui.json b/qapi/ui.json
index 2b4371da37..764480e145 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1107,6 +1107,22 @@
'data': { '*grab-on-hover' : 'bool',
  '*zoom-to-fit'   : 'bool'  } }
  
+##

+# @DisplayCocoa:
+#
+# Cocoa display options.
+#
+# @left-command-key: Enable/disable forwarding of left command key to
+#guest. Allows command-tab window switching on the
+#host without sending this key to the guest when
+#"off". Defaults to "on"
+#
+# Since: 6.2.50
+#
+##
+{ 'struct'  : 'DisplayCocoa',
+  'data': { '*left-command-key' : 'bool' } }
+
  ##
  # @DisplayEGLHeadless:
  #
@@ -1254,6 +1270,7 @@
'discriminator' : 'type',
'data': {
'gtk': { 'type': 'DisplayGTK', 'if': 'CONFIG_GTK' },
+  'cocoa': { 'type': 'DisplayCocoa', 'if': 'CONFIG_COCOA' },
'curses': { 'type': 'DisplayCurses', 'if': 'CONFIG_CURSES' },
'egl-headless': { 'type': 'DisplayEGLHeadless',
  'if': { 'all': ['CONFIG_OPENGL', 'CONFIG_GBM'] } },
diff --git a/qemu-options.hx b/qemu-options.hx
index fd1f8135fb..6fa9c38c83 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1912,6 +1912,9 @@ DEF("display", HAS_ARG, QEMU_OPTION_display,
  #if defined(CONFIG_DBUS_DISPLAY)
  "-display dbus[,addr=]\n"
  " [,gl=on|core|es|off][,rendernode=]\n"
+#endif
+#if defined(CONFIG_COCOA)
+"-display cocoa[,show-cursor=on|off][,left-command-key=on|off]\n"
  #endif
  "-display none\n"
  "select display backend type\n"
@@ -1999,6 +2002,15 @@ SRST
  ``charset=CP850`` for IBM CP850 encoding. The default is
  ``CP437``.
  
+``cocoa``

+Display video output in a Cocoa window. Mac only. This interface
+provides drop-down menus and other UI elements to configure and
+control the VM during runtime. Valid parameters are:
+
+``show-cursor=on|off`` :  Force showing the mouse cursor
+
+``left-command-key=on|off`` : Disable forwarding left command key to 
host
+
  ``egl-headless[,rendernode=]``
  Offload all OpenGL operations to a local DRI device. For any
  graphical display, this display needs to be paired with either
diff --git a/ui/cocoa.m b/ui/cocoa.m
index 69745c483b..01045d6698 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -95,6 +95,7 @@ static DisplayChangeListener dcl = {
  };
  static int last_buttons;
  static int cursor_hide = 1;
+static int left_command_key_enabled = 1;
  
  static int gArgc;

  static char **gArgv;
@@ -834,7 +835,8 @@ QemuCocoaView *cocoaView;
  /* Don't pass command key changes to guest unless mouse is 
grabbed */
  case kVK_Command:
  if (isMouseGrabbed &&
-!!(modifiers & NSEventModifierFlagCommand)) {
+!!(modifiers & NSEventModifierFlagCommand) &&
+left_command_key_enabled) {
  [self toggleKey:Q_KEY_CODE_META_L];
  }
  break;
@@ -2054,6 +2056,10 @@ static void cocoa_display_init(DisplayState *ds, 
DisplayOptions *opts)
  cursor_hide = 0;
  }
  
+if (opts->u.cocoa.has_left_command_key && !opts->u.cocoa.left_command_key) {

+left_command_key_enabled = 0;
+}
+
  // register vga output callbacks
  register_displaychangelistener();
  

Re: [PATCH 1/2] ui/cocoa: add option to disable left-command forwarding to guest

[Philippe Mathieu-Daudé via]

On 18/2/22 19:55, Peter Maydell wrote:

On Sun, 2 Jan 2022 at 17:42, Carwyn Ellis  wrote:


When switching between guest and host on a Mac using command-tab the
command key is sent to the guest which can trigger functionality in the
guest OS. Specifying left-command-key=off disables forwarding this key
to the guest. Defaults to enabled.

Also updated the cocoa display documentation to reference the new
left-command-key option along with the existing show-cursor option.

Signed-off-by: Carwyn Ellis 


Ccing the QAPI folks for review on the QAPI parts of this.

-- PMM


---
  qapi/ui.json| 17 +
  qemu-options.hx | 12 
  ui/cocoa.m  |  8 +++-
  3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/qapi/ui.json b/qapi/ui.json
index 2b4371da37..764480e145 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1107,6 +1107,22 @@
'data': { '*grab-on-hover' : 'bool',
  '*zoom-to-fit'   : 'bool'  } }

+##
+# @DisplayCocoa:
+#
+# Cocoa display options.
+#
+# @left-command-key: Enable/disable forwarding of left command key to
+#guest. Allows command-tab window switching on the
+#host without sending this key to the guest when
+#"off". Defaults to "on"
+#
+# Since: 6.2.50


Not a QAPI folk, but LGTM using 7.0 here instead of 6.2.50 (this the
number of the *released* QEMU version which contains this new type).


+#
+##
+{ 'struct'  : 'DisplayCocoa',
+  'data': { '*left-command-key' : 'bool' } }
+
  ##
  # @DisplayEGLHeadless:
  #
@@ -1254,6 +1270,7 @@
'discriminator' : 'type',
'data': {
'gtk': { 'type': 'DisplayGTK', 'if': 'CONFIG_GTK' },
+  'cocoa': { 'type': 'DisplayCocoa', 'if': 'CONFIG_COCOA' },
'curses': { 'type': 'DisplayCurses', 'if': 'CONFIG_CURSES' },
'egl-headless': { 'type': 'DisplayEGLHeadless',
  'if': { 'all': ['CONFIG_OPENGL', 'CONFIG_GBM'] } },
diff --git a/qemu-options.hx b/qemu-options.hx
index fd1f8135fb..6fa9c38c83 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1912,6 +1912,9 @@ DEF("display", HAS_ARG, QEMU_OPTION_display,
  #if defined(CONFIG_DBUS_DISPLAY)
  "-display dbus[,addr=]\n"
  " [,gl=on|core|es|off][,rendernode=]\n"
+#endif
+#if defined(CONFIG_COCOA)
+"-display cocoa[,show-cursor=on|off][,left-command-key=on|off]\n"
  #endif
  "-display none\n"
  "select display backend type\n"
@@ -1999,6 +2002,15 @@ SRST
  ``charset=CP850`` for IBM CP850 encoding. The default is
  ``CP437``.

+``cocoa``
+Display video output in a Cocoa window. Mac only. This interface
+provides drop-down menus and other UI elements to configure and
+control the VM during runtime. Valid parameters are:
+
+``show-cursor=on|off`` :  Force showing the mouse cursor
+
+``left-command-key=on|off`` : Disable forwarding left command key to 
host
+
  ``egl-headless[,rendernode=]``
  Offload all OpenGL operations to a local DRI device. For any
  graphical display, this display needs to be paired with either
diff --git a/ui/cocoa.m b/ui/cocoa.m
index 69745c483b..01045d6698 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -95,6 +95,7 @@ static DisplayChangeListener dcl = {
  };
  static int last_buttons;
  static int cursor_hide = 1;
+static int left_command_key_enabled = 1;

  static int gArgc;
  static char **gArgv;
@@ -834,7 +835,8 @@ QemuCocoaView *cocoaView;
  /* Don't pass command key changes to guest unless mouse is 
grabbed */
  case kVK_Command:
  if (isMouseGrabbed &&
-!!(modifiers & NSEventModifierFlagCommand)) {
+!!(modifiers & NSEventModifierFlagCommand) &&
+left_command_key_enabled) {
  [self toggleKey:Q_KEY_CODE_META_L];
  }
  break;
@@ -2054,6 +2056,10 @@ static void cocoa_display_init(DisplayState *ds, 
DisplayOptions *opts)
  cursor_hide = 0;
  }

+if (opts->u.cocoa.has_left_command_key && !opts->u.cocoa.left_command_key) 
{
+left_command_key_enabled = 0;
+}
+
  // register vga output callbacks
  register_displaychangelistener();

[PATCH v5 11/12] hw/riscv: virt: Add PMU DT node to the device tree

[Atish Patra]

Qemu virt machine can support few cache events and cycle/instret counters.
It also supports counter overflow for these events.

Add a DT node so that OpenSBI/Linux kernel is aware of the virt machine
capabilities. There are some dummy nodes added for testing as well.

Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 hw/riscv/virt.c| 28 +++
 target/riscv/cpu.c |  1 +
 target/riscv/pmu.c | 57 ++
 target/riscv/pmu.h |  1 +
 4 files changed, 87 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 7d5f1e58c983..6288e436aa73 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -28,6 +28,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/char/serial.h"
 #include "target/riscv/cpu.h"
+#include "target/riscv/pmu.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
@@ -687,6 +688,32 @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
 aplic_phandles[socket] = aplic_s_phandle;
 }
 
+static void create_fdt_socket_pmu(RISCVVirtState *s,
+  int socket, uint32_t *phandle,
+  uint32_t *intc_phandles)
+{
+int cpu;
+char *pmu_name;
+uint32_t *pmu_cells;
+MachineState *mc = MACHINE(s);
+RISCVCPU hart = s->soc[socket].harts[0];
+
+pmu_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+
+for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+pmu_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+pmu_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_PMU_OVF);
+}
+
+pmu_name = g_strdup_printf("/soc/pmu");
+qemu_fdt_add_subnode(mc->fdt, pmu_name);
+qemu_fdt_setprop_string(mc->fdt, pmu_name, "compatible", "riscv,pmu");
+riscv_pmu_generate_fdt_node(mc->fdt, hart.cfg.pmu_num, pmu_name);
+
+g_free(pmu_name);
+g_free(pmu_cells);
+}
+
 static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
bool is_32_bit, uint32_t *phandle,
uint32_t *irq_mmio_phandle,
@@ -732,6 +759,7 @@ static void create_fdt_sockets(RISCVVirtState *s, const 
MemMapEntry *memmap,
 _phandles[phandle_pos]);
 }
 }
+create_fdt_socket_pmu(s, socket, phandle, intc_phandles);
 }
 
 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 677210bc6d94..00c385009d67 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -910,6 +910,7 @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char 
*isa_str, int max_str_len)
 { "svpbmt", cpu->cfg.ext_svpbmt   },
 { "svinval", cpu->cfg.ext_svinval },
 { "svnapot", cpu->cfg.ext_svnapot },
+{ "sscofpmf", cpu->cfg.ext_sscofpmf },
 };
 
 for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index 5b212d2eb630..6e470a1d5f66 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -19,11 +19,68 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "pmu.h"
+#include "sysemu/device_tree.h"
 
 #define RISCV_TIMEBASE_FREQ 10 /* 1Ghz */
 #define MAKE_32BIT_MASK(shift, length) \
 (((uint32_t)(~0UL) >> (32 - (length))) << (shift))
 
+/**
+ * To keep it simple, any event can be mapped to any programmable counters in
+ * QEMU. The generic cycle & instruction count events can also be monitored
+ * using programmable counters. In that case, mcycle & minstret must continue
+ * to provide the correct value as well. Heterogeneous PMU per hart is not
+ * supported yet. Thus, number of counters are same across all harts.
+ */
+void riscv_pmu_generate_fdt_node(void *fdt, int num_ctrs, char *pmu_name)
+{
+uint32_t fdt_event_ctr_map[20] = {};
+uint32_t cmask;
+
+/* All the programmable counters can map to any event */
+cmask = MAKE_32BIT_MASK(3, num_ctrs);
+
+   /**
+* The event encoding is specified in the SBI specification
+* Event idx is a 20bits wide number encoded as follows:
+* event_idx[19:16] = type
+* event_idx[15:0] = code
+* The code field in cache events are encoded as follows:
+* event_idx.code[15:3] = cache_id
+* event_idx.code[2:1] = op_id
+* event_idx.code[0:0] = result_id
+*/
+
+   /* SBI_PMU_HW_CPU_CYCLES: 0x01 : type(0x00) */
+   fdt_event_ctr_map[0] = cpu_to_be32(0x0001);
+   fdt_event_ctr_map[1] = cpu_to_be32(0x0001);
+   fdt_event_ctr_map[2] = cpu_to_be32(cmask | 1 << 0);
+
+   /* SBI_PMU_HW_INSTRUCTIONS: 0x02 : type(0x00) */
+   fdt_event_ctr_map[3] = cpu_to_be32(0x0002);
+   fdt_event_ctr_map[4] = cpu_to_be32(0x0002);
+   fdt_event_ctr_map[5] = cpu_to_be32(cmask | 1 << 2);
+
+   /* SBI_PMU_HW_CACHE_DTLB : 0x03 READ : 0x00 MISS : 0x00 type(0x01) */
+   fdt_event_ctr_map[6] = cpu_to_be32(0x00010019);
+   fdt_event_ctr_map[7] = cpu_to_be32(0x00010019);
+   fdt_event_ctr_map[8] = 

[PATCH] ppc/pnv: fix default PHB4 QOM hierarchy

[Daniel Henrique Barboza]

Commit 3f4c369ea63e ("ppc/pnv: make PECs create and realize PHB4s")
changed phb4_pec code to create the default PHB4 objects in
pnv_pec_default_phb_realize(). In this process the stacks[] PEC array was
removed and each PHB4 object is tied together with its PEC via the
phb->pec pointer.

This change also broke the previous QOM hierarchy - the PHB4 objects are
being created and not being parented to their respective chips. This can
be verified by 'info pic' in a powernv9 domain with default settings.
pnv_chip_power9_pic_print_info() will fail to find the PHBs because
object_child_foreach_recursive() won't find any.

The solution is to set the parent chip and the parent bus, in the same
way done for user created PHB4 devices, for all PHB4 devices.

Fixes: 3f4c369ea63e ("ppc/pnv: make PECs create and realize PHB4s")
Signed-off-by: Daniel Henrique Barboza 
---
 hw/pci-host/pnv_phb4.c | 36 
 1 file changed, 16 insertions(+), 20 deletions(-)

diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index e91249ef64..846e7d0c3e 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1568,40 +1568,36 @@ static PnvPhb4PecState *pnv_phb4_get_pec(PnvChip *chip, 
PnvPHB4 *phb,
 static void pnv_phb4_realize(DeviceState *dev, Error **errp)
 {
 PnvPHB4 *phb = PNV_PHB4(dev);
+PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
+PnvChip *chip = pnv_get_chip(pnv, phb->chip_id);
 PCIHostState *pci = PCI_HOST_BRIDGE(dev);
 XiveSource *xsrc = >xsrc;
+BusState *s;
 Error *local_err = NULL;
 int nr_irqs;
 char name[32];
 
-/* User created PHB */
-if (!phb->pec) {
-PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
-PnvChip *chip = pnv_get_chip(pnv, phb->chip_id);
-BusState *s;
-
-if (!chip) {
-error_setg(errp, "invalid chip id: %d", phb->chip_id);
-return;
-}
+if (!chip) {
+error_setg(errp, "invalid chip id: %d", phb->chip_id);
+return;
+}
 
+/* User created PHBs need to be assigned to a PEC */
+if (!phb->pec) {
 phb->pec = pnv_phb4_get_pec(chip, phb, _err);
 if (local_err) {
 error_propagate(errp, local_err);
 return;
 }
+}
 
-/*
- * Reparent user created devices to the chip to build
- * correctly the device tree.
- */
-pnv_chip_parent_fixup(chip, OBJECT(phb), phb->phb_id);
+/* Reparent the PHB to the chip to build the device tree */
+pnv_chip_parent_fixup(chip, OBJECT(phb), phb->phb_id);
 
-s = qdev_get_parent_bus(DEVICE(chip));
-if (!qdev_set_parent_bus(DEVICE(phb), s, _err)) {
-error_propagate(errp, local_err);
-return;
-}
+s = qdev_get_parent_bus(DEVICE(chip));
+if (!qdev_set_parent_bus(DEVICE(phb), s, _err)) {
+error_propagate(errp, local_err);
+return;
 }
 
 /* Set the "big_phb" flag */
-- 
2.34.1

[PATCH v2 0/2] hw/ide: implement ich6 ide controller support

[Liav Albani]

This is version 2 of this patch, this time a patch series, after following
the suggestions from BALATON Zoltan. I implemented this device because I have an
old machine from 2009 which has the ICH7 south bridge in it, so when I tried to
run Linux on it, it booted just fine (as you might expect), but when I tried to
boot with the SerenityOS kernel, it struggled to initialize the IDE controller.
Therefore, upstreaming these changes might be beneficial to other OS developers
and hobbyists out there, and I will use this to fix the issues within the
SerenityOS kernel, without the need of preparing a bare metal setup each time I
need to test the code of the kernel.

Please keep in mind that while this is usable right now with the Q35 chipset,
when trying to boot with an i440FX machine, SeaBIOS doesn't handle this device
very well, so it tries no matter what type of IDE controller it sees to assign
the IO ports to legacy values. I have a patch I wrote locally which I gladly
will send to SeaBIOS, that fixes this problem by ensuring that when attaching a
storage device to this controller, SeaBIOS will relocate the IO ports to other
values so there's no collision with the default PIIX3/4 IDE controller. Even if
SeaBIOS didn't configure this device correctly, Linux will relocate the IO ports
and the user can still use the attached storage devices, given that the user
managed to boot from a storage device that is not attached to the ICH6 IDE
controller but to other storage controller in the system.

Liav Albani (2):
  hw/ide: split bmdma read and write functions from piix.c
  hw/ide: add ich6 ide controller device emulation

 hw/i386/Kconfig  |   2 +
 hw/ide/Kconfig   |   5 +
 hw/ide/bmdma.c   |  84 
 hw/ide/ich6.c| 204 +++
 hw/ide/meson.build   |   3 +-
 hw/ide/piix.c|  51 +-
 include/hw/ide/bmdma.h   |  34 +++
 include/hw/ide/pci.h |   1 +
 include/hw/pci/pci_ids.h |   1 +
 9 files changed, 336 insertions(+), 49 deletions(-)
 create mode 100644 hw/ide/bmdma.c
 create mode 100644 hw/ide/ich6.c
 create mode 100644 include/hw/ide/bmdma.h

-- 
2.35.1

Re: [PATCH v2 3/6] hw/misc: Add a model of the Xilinx ZynqMP CRF

[Edgar E. Iglesias]

On Fri, Feb 18, 2022 at 01:37:51PM +, Peter Maydell wrote:
> On Thu, 3 Feb 2022 at 14:01, Edgar E. Iglesias  
> wrote:
> >
> > From: "Edgar E. Iglesias" 
> >
> > Add a model of the Xilinx ZynqMP CRF. At the moment this
> > is mostly a stub model.
> >
> > Reviewed-by: Philippe Mathieu-Daudé 
> > Signed-off-by: Edgar E. Iglesias 
> > ---
> 
> 
> > +#define TYPE_XLNX_ZYNQMP_CRF "xlnx.zynqmp_crf"
> > +
> > +#define XILINX_CRF(obj) \
> > + OBJECT_CHECK(XlnxZynqMPCRF, (obj), TYPE_XLNX_ZYNQMP_CRF)
> 
> We prefer the OBJECT_DECLARE_SIMPLE_TYPE rather than directly
> defining a cast macro these days. (It also provides a typedef
> for you, among other things.)
> 
> Apart from that, and dropping minimum_version_id_old,
> Reviewed-by: Peter Maydell 
>

Thanks Peter and Luc for review comments.
Sorry, things have been very busy around here, I'll try to get a new version 
posted next week addressing all comments I've seen so far.

Best regards,
Edgar 

[PATCH v5 09/12] target/riscv: Simplify counter predicate function

[Atish Patra]

All the hpmcounters and the fixed counters (CY, IR, TM) can be represented
as a unified counter. Thus, the predicate function doesn't need handle each
case separately.

Simplify the predicate function so that we just handle things differently
between RV32/RV64 and S/HS mode.

Reviewed-by: Bin Meng 
Signed-off-by: Atish Patra 
---
 target/riscv/csr.c | 111 -
 1 file changed, 10 insertions(+), 101 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 0071b13bc50f..54966a770672 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -113,6 +113,7 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 CPUState *cs = env_cpu(env);
 RISCVCPU *cpu = RISCV_CPU(cs);
 int ctr_index;
+target_ulong ctr_mask;
 int base_csrno = CSR_CYCLE;
 bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
 
@@ -121,122 +122,30 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 base_csrno += 0x80;
 }
 ctr_index = csrno - base_csrno;
+ctr_mask = BIT(ctr_index);
 
 if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
 (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
 goto skip_ext_pmu_check;
 }
 
-if ((!cpu->cfg.pmu_num || !(cpu->pmu_avail_ctrs & BIT(ctr_index {
+if ((!cpu->cfg.pmu_num || !(cpu->pmu_avail_ctrs & ctr_mask))) {
 /* No counter is enabled in PMU or the counter is out of range */
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
 skip_ext_pmu_check:
 
-if (env->priv == PRV_S) {
-switch (csrno) {
-case CSR_CYCLE:
-if (!get_field(env->mcounteren, COUNTEREN_CY)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-case CSR_TIME:
-if (!get_field(env->mcounteren, COUNTEREN_TM)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-case CSR_INSTRET:
-if (!get_field(env->mcounteren, COUNTEREN_IR)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
-if (!get_field(env->mcounteren, 1 << ctr_index)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-}
-if (rv32) {
-switch (csrno) {
-case CSR_CYCLEH:
-if (!get_field(env->mcounteren, COUNTEREN_CY)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-case CSR_TIMEH:
-if (!get_field(env->mcounteren, COUNTEREN_TM)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-case CSR_INSTRETH:
-if (!get_field(env->mcounteren, COUNTEREN_IR)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
-if (!get_field(env->mcounteren, 1 << ctr_index)) {
-return RISCV_EXCP_ILLEGAL_INST;
-}
-break;
-}
-}
+if ((env->priv == PRV_S) && (!get_field(env->mcounteren, ctr_mask))) {
+return RISCV_EXCP_ILLEGAL_INST;
 }
 
 if (riscv_cpu_virt_enabled(env)) {
-switch (csrno) {
-case CSR_CYCLE:
-if (!get_field(env->hcounteren, COUNTEREN_CY) &&
-get_field(env->mcounteren, COUNTEREN_CY)) {
-return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-}
-break;
-case CSR_TIME:
-if (!get_field(env->hcounteren, COUNTEREN_TM) &&
-get_field(env->mcounteren, COUNTEREN_TM)) {
-return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-}
-break;
-case CSR_INSTRET:
-if (!get_field(env->hcounteren, COUNTEREN_IR) &&
-get_field(env->mcounteren, COUNTEREN_IR)) {
-return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-}
-break;
-case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
-if (!get_field(env->hcounteren, 1 << ctr_index) &&
- get_field(env->mcounteren, 1 << ctr_index)) {
-return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-}
-break;
-}
-if (rv32) {
-switch (csrno) {
-case CSR_CYCLEH:
-if (!get_field(env->hcounteren, COUNTEREN_CY) &&
-get_field(env->mcounteren, COUNTEREN_CY)) {
-return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-}
-break;
-case CSR_TIMEH:
-if (!get_field(env->hcounteren, COUNTEREN_TM) &&
-get_field(env->mcounteren, COUNTEREN_TM)) {
-return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-}
-break;
-case 

[PATCH v5 06/12] target/riscv: Add support for hpmcounters/hpmevents

[Atish Patra]

From: Atish Patra 

With SBI PMU extension, user can use any of the available hpmcounters to
track any perf events based on the value written to mhpmevent csr.
Add read/write functionality for these csrs.

Reviewed-by: Bin Meng 
Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/cpu.h |  11 +
 target/riscv/csr.c | 466 +++--
 target/riscv/machine.c |   3 +
 3 files changed, 328 insertions(+), 152 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index ea3862ccbf5c..cce5c3538c89 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -109,6 +109,8 @@ typedef struct CPURISCVState CPURISCVState;
 #endif
 
 #define RV_VLEN_MAX 1024
+#define RV_MAX_MHPMEVENTS 29
+#define RV_MAX_MHPMCOUNTERS 32
 
 FIELD(VTYPE, VLMUL, 0, 3)
 FIELD(VTYPE, VSEW, 3, 3)
@@ -261,6 +263,15 @@ struct CPURISCVState {
 
 target_ulong mcountinhibit;
 
+/* PMU counter configured values */
+target_ulong mhpmcounter_val[RV_MAX_MHPMCOUNTERS];
+
+/* for RV32 */
+target_ulong mhpmcounterh_val[RV_MAX_MHPMCOUNTERS];
+
+/* PMU event selector configured values */
+target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
+
 target_ulong sscratch;
 target_ulong mscratch;
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 2283ff33a5d7..dbb723a3307b 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -84,6 +84,15 @@ static RISCVException mctr(CPURISCVState *env, int csrno)
 return RISCV_EXCP_NONE;
 }
 
+static RISCVException mctr32(CPURISCVState *env, int csrno)
+{
+if (riscv_cpu_mxl(env) != MXL_RV32) {
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+return mctr(env, csrno);
+}
+
 static RISCVException ctr(CPURISCVState *env, int csrno)
 {
 #if !defined(CONFIG_USER_ONLY)
@@ -560,6 +569,72 @@ static RISCVException read_instreth(CPURISCVState *env, 
int csrno,
 return RISCV_EXCP_NONE;
 }
 
+static int read_mhpmevent(CPURISCVState *env, int csrno, target_ulong *val)
+{
+int evt_index = csrno - CSR_MHPMEVENT3;
+
+*val = env->mhpmevent_val[evt_index];
+
+return RISCV_EXCP_NONE;
+}
+
+static int write_mhpmevent(CPURISCVState *env, int csrno, target_ulong val)
+{
+int evt_index = csrno - CSR_MHPMEVENT3;
+
+env->mhpmevent_val[evt_index] = val;
+
+return RISCV_EXCP_NONE;
+}
+
+static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
+{
+int ctr_index = csrno - CSR_MHPMCOUNTER3 + 3;
+
+env->mhpmcounter_val[ctr_index] = val;
+
+return RISCV_EXCP_NONE;
+}
+
+static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
+{
+int ctr_index = csrno - CSR_MHPMCOUNTER3H + 3;
+
+env->mhpmcounterh_val[ctr_index] = val;
+
+return RISCV_EXCP_NONE;
+}
+
+static int read_hpmcounter(CPURISCVState *env, int csrno, target_ulong *val)
+{
+int ctr_index;
+
+if (env->priv == PRV_M) {
+ctr_index = csrno - CSR_MHPMCOUNTER3 + 3;
+} else {
+ctr_index = csrno - CSR_HPMCOUNTER3 + 3;
+}
+*val = env->mhpmcounter_val[ctr_index];
+
+return RISCV_EXCP_NONE;
+}
+
+static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
+{
+int ctr_index;
+
+if (env->priv == PRV_M) {
+ctr_index = csrno - CSR_MHPMCOUNTER3H + 3;
+} else {
+ctr_index = csrno - CSR_HPMCOUNTER3H + 3;
+}
+
+*val = env->mhpmcounterh_val[ctr_index];
+
+return RISCV_EXCP_NONE;
+}
+
+
 #if defined(CONFIG_USER_ONLY)
 static RISCVException read_time(CPURISCVState *env, int csrno,
 target_ulong *val)
@@ -3515,157 +3590,244 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 [CSR_SPMBASE] ={ "spmbase", pointer_masking, read_spmbase, 
write_spmbase },
 
 /* Performance Counters */
-[CSR_HPMCOUNTER3]= { "hpmcounter3",ctr,read_zero },
-[CSR_HPMCOUNTER4]= { "hpmcounter4",ctr,read_zero },
-[CSR_HPMCOUNTER5]= { "hpmcounter5",ctr,read_zero },
-[CSR_HPMCOUNTER6]= { "hpmcounter6",ctr,read_zero },
-[CSR_HPMCOUNTER7]= { "hpmcounter7",ctr,read_zero },
-[CSR_HPMCOUNTER8]= { "hpmcounter8",ctr,read_zero },
-[CSR_HPMCOUNTER9]= { "hpmcounter9",ctr,read_zero },
-[CSR_HPMCOUNTER10]   = { "hpmcounter10",   ctr,read_zero },
-[CSR_HPMCOUNTER11]   = { "hpmcounter11",   ctr,read_zero },
-[CSR_HPMCOUNTER12]   = { "hpmcounter12",   ctr,read_zero },
-[CSR_HPMCOUNTER13]   = { "hpmcounter13",   ctr,read_zero },
-[CSR_HPMCOUNTER14]   = { "hpmcounter14",   ctr,read_zero },
-[CSR_HPMCOUNTER15]   = { "hpmcounter15",   ctr,read_zero },
-[CSR_HPMCOUNTER16]   = { "hpmcounter16",   ctr,read_zero },
-[CSR_HPMCOUNTER17]   = { "hpmcounter17",   ctr,read_zero },
-[CSR_HPMCOUNTER18]   = { "hpmcounter18",   ctr,read_zero },
-[CSR_HPMCOUNTER19]   = { "hpmcounter19",   ctr,read_zero },
-[CSR_HPMCOUNTER20]   = { 

[PATCH v2 2/2] hw/ide: add ich6 ide controller device emulation

[Liav Albani]

This type of IDE controller has support for relocating the IO ports and
doesn't use IRQ 14 and 15 but one allocated PCI IRQ for the controller.

There's no x86 chipset in QEMU that will try to attach this device by
default. It is considered a legacy-free device in the aspect of PCI bus
resource management as the guest OS can relocate the IO ports as it sees
fit to its needs. However, this is still a legacy device that belongs to
chipsets from late 2000s.

Signed-off-by: Liav Albani 
---
 hw/i386/Kconfig  |   2 +
 hw/ide/Kconfig   |   5 +
 hw/ide/ich6.c| 204 +++
 hw/ide/meson.build   |   1 +
 include/hw/ide/pci.h |   1 +
 include/hw/pci/pci_ids.h |   1 +
 6 files changed, 214 insertions(+)
 create mode 100644 hw/ide/ich6.c

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index d22ac4a4b9..a18de2d962 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -75,6 +75,7 @@ config I440FX
 select PCI_I440FX
 select PIIX3
 select IDE_PIIX
+select IDE_ICH6
 select DIMM
 select SMBIOS
 select FW_CFG_DMA
@@ -101,6 +102,7 @@ config Q35
 select PCI_EXPRESS_Q35
 select LPC_ICH9
 select AHCI_ICH9
+select IDE_ICH6
 select DIMM
 select SMBIOS
 select FW_CFG_DMA
diff --git a/hw/ide/Kconfig b/hw/ide/Kconfig
index dd85fa3619..63304325a5 100644
--- a/hw/ide/Kconfig
+++ b/hw/ide/Kconfig
@@ -38,6 +38,11 @@ config IDE_VIA
 select IDE_PCI
 select IDE_QDEV
 
+config IDE_ICH6
+bool
+select IDE_PCI
+select IDE_QDEV
+
 config MICRODRIVE
 bool
 select IDE_QDEV
diff --git a/hw/ide/ich6.c b/hw/ide/ich6.c
new file mode 100644
index 00..8f46d3fce2
--- /dev/null
+++ b/hw/ide/ich6.c
@@ -0,0 +1,204 @@
+/*
+ * QEMU IDE Emulation: PCI ICH6/ICH7 IDE support.
+ *
+ * Copyright (c) 2022 Liav Albani
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qemu/module.h"
+#include "sysemu/block-backend.h"
+#include "sysemu/blockdev.h"
+#include "sysemu/dma.h"
+
+#include "hw/ide/pci.h"
+#include "hw/ide/bmdma.h"
+#include "trace.h"
+
+static const MemoryRegionOps ich6_bmdma_ops = {
+.read = intel_ide_bmdma_read,
+.write = intel_ide_bmdma_write,
+};
+
+static void bmdma_setup_bar(PCIIDEState *d)
+{
+int i;
+
+memory_region_init(>bmdma_bar, OBJECT(d), "ich6-bmdma-container", 16);
+for (i = 0; i < 2; i++) {
+BMDMAState *bm = >bmdma[i];
+
+memory_region_init_io(>extra_io, OBJECT(d), _bmdma_ops, bm,
+  "ich6-bmdma", 4);
+memory_region_add_subregion(>bmdma_bar, i * 8, >extra_io);
+memory_region_init_io(>addr_ioport, OBJECT(d),
+  _addr_ioport_ops, bm, "bmdma", 4);
+memory_region_add_subregion(>bmdma_bar, i * 8 + 4, 
>addr_ioport);
+}
+}
+
+static void ich6_pci_config_write(PCIDevice *d, uint32_t addr, uint32_t val,
+int l)
+{
+uint32_t i;
+
+pci_default_write_config(d, addr, val, l);
+
+for (i = addr; i < addr + l; i++) {
+switch (i) {
+case 0x40:
+pci_default_write_config(d, i, 0x8000, 2);
+continue;
+case 0x42:
+pci_default_write_config(d, i, 0x8000, 2);
+continue;
+}
+}
+}
+
+static void ich6_ide_reset(DeviceState *dev)
+{
+PCIIDEState *d = PCI_IDE(dev);
+PCIDevice *pd = PCI_DEVICE(d);
+uint8_t *pci_conf = pd->config;
+int i;
+
+for (i = 0; i < 2; i++) {
+ide_bus_reset(>bus[i]);
+}
+
+/* TODO: this is the default. do not override. */
+pci_conf[PCI_COMMAND] = 0x00;
+/* TODO: this is the default. do not override. */
+pci_conf[PCI_COMMAND + 1] = 0x00;
+/* TODO: use pci_set_word */
+pci_conf[PCI_STATUS] = PCI_STATUS_FAST_BACK;
+pci_conf[PCI_STATUS + 

Re: [PATCH v2 1/2] hw/ide: split bmdma read and write functions from piix.c

[BALATON Zoltan]

On Fri, 18 Feb 2022, Liav Albani wrote:

This is a preparation before implementing another PCI IDE controller
that relies on these functions, so these can be shared between both
implementations.

Signed-off-by: Liav Albani 
---
hw/ide/bmdma.c | 84 ++
hw/ide/meson.build |  2 +-
hw/ide/piix.c  | 51 ++---
include/hw/ide/bmdma.h | 34 +
4 files changed, 122 insertions(+), 49 deletions(-)
create mode 100644 hw/ide/bmdma.c
create mode 100644 include/hw/ide/bmdma.h

diff --git a/hw/ide/bmdma.c b/hw/ide/bmdma.c
new file mode 100644
index 00..d12ed730dd
--- /dev/null
+++ b/hw/ide/bmdma.c
@@ -0,0 +1,84 @@
+/*
+ * QEMU IDE Emulation: Intel PCI Bus master IDE support for PIIX3/4 and ICH6/7.
+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * Copyright (c) 2006 Openedhand Ltd.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qemu/module.h"
+#include "sysemu/block-backend.h"
+#include "sysemu/blockdev.h"
+#include "sysemu/dma.h"
+
+#include "hw/ide/bmdma.h"
+#include "hw/ide/pci.h"
+#include "trace.h"


Are you sure you need all these includes? I haven't checked but I think 
there may be some unneeded ones here. On the other hand I'm not sure 
putting these in a new file is worth it. There are already some bmdma_* 
functions in hw/ide/pci.c which are declared in include/hw/ide/pci.h so 
you could just move these there too then no new file, new header nor 
changes to meson.build is needed in this patch..



+
+uint64_t intel_ide_bmdma_read(void *opaque, hwaddr addr, unsigned size)


As I said before these aren't intel specific as the same functions also 
appear in other ide controllers such as via.c so maybe a better name would 
be bmdma_default_read and bmdma_default_write or somehting similar so 
these can be also reused by other non-intel devices too.


Regards,
BALATON Zoltan


+{
+BMDMAState *bm = opaque;
+uint32_t val;
+
+if (size != 1) {
+return ((uint64_t)1 << (size * 8)) - 1;
+}
+
+switch (addr & 3) {
+case 0:
+val = bm->cmd;
+break;
+case 2:
+val = bm->status;
+break;
+default:
+val = 0xff;
+break;
+}
+
+trace_bmdma_read(addr, val);
+return val;
+}
+
+void intel_ide_bmdma_write(void *opaque, hwaddr addr,
+uint64_t val, unsigned size)
+{
+BMDMAState *bm = opaque;
+
+if (size != 1) {
+return;
+}
+
+trace_bmdma_write(addr, val);
+
+switch (addr & 3) {
+case 0:
+bmdma_cmd_writeb(bm, val);
+break;
+case 2:
+uint8_t cur_val = bm->status;
+bm->status = (val & 0x60) | (cur_val & 1) | (cur_val & ~val & 0x06);
+break;
+}
+}
diff --git a/hw/ide/meson.build b/hw/ide/meson.build
index ddcb3b28d2..38f9ae7178 100644
--- a/hw/ide/meson.build
+++ b/hw/ide/meson.build
@@ -7,7 +7,7 @@ softmmu_ss.add(when: 'CONFIG_IDE_ISA', if_true: files('isa.c', 
'ioport.c'))
softmmu_ss.add(when: 'CONFIG_IDE_MACIO', if_true: files('macio.c'))
softmmu_ss.add(when: 'CONFIG_IDE_MMIO', if_true: files('mmio.c'))
softmmu_ss.add(when: 'CONFIG_IDE_PCI', if_true: files('pci.c'))
-softmmu_ss.add(when: 'CONFIG_IDE_PIIX', if_true: files('piix.c', 'ioport.c'))
+softmmu_ss.add(when: 'CONFIG_IDE_PIIX', if_true: files('piix.c', 'ioport.c', 
'bmdma.c'))
softmmu_ss.add(when: 'CONFIG_IDE_QDEV', if_true: files('qdev.c'))
softmmu_ss.add(when: 'CONFIG_IDE_SII3112', if_true: files('sii3112.c'))
softmmu_ss.add(when: 'CONFIG_IDE_VIA', if_true: files('via.c'))
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index ce89fd0aa3..8f94809eee 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -33,57 +33,12 @@
#include "sysemu/dma.h"

#include "hw/ide/pci.h"
+#include "hw/ide/bmdma.h"
#include "trace.h"

-static uint64_t bmdma_read(void 

[PATCH v5 04/12] target/riscv: pmu: Make number of counters configurable

[Atish Patra]

The RISC-V privilege specification provides flexibility to implement
any number of counters from 29 programmable counters. However, the QEMU
implements all the counters.

Make it configurable through pmu config parameter which now will indicate
how many programmable counters should be implemented by the cpu.

Reviewed-by: Bin Meng 
Reviewed-by: Alistair Francis 
Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/cpu.c |  2 +-
 target/riscv/cpu.h |  2 +-
 target/riscv/csr.c | 96 ++
 3 files changed, 65 insertions(+), 35 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 173b9d3c5d3e..02e089710a7e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -768,7 +768,7 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
 DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
-DEFINE_PROP_BOOL("pmu", RISCVCPU, cfg.ext_pmu, true),
+DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
 DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
 DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
 DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 2dc491887f24..f6b994a74ed9 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -365,7 +365,6 @@ struct RISCVCPUConfig {
 bool ext_zbb;
 bool ext_zbc;
 bool ext_zbs;
-bool ext_pmu;
 bool ext_ifencei;
 bool ext_icsr;
 bool ext_svinval;
@@ -379,6 +378,7 @@ struct RISCVCPUConfig {
 /* Vendor-specific custom extensions */
 bool ext_XVentanaCondOps;
 
+uint8_t pmu_num;
 char *priv_spec;
 char *user_spec;
 char *bext_spec;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 2c3bba81c8af..d69bd2d88454 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -62,15 +62,45 @@ static RISCVException vs(CPURISCVState *env, int csrno)
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
+static RISCVException mctr(CPURISCVState *env, int csrno)
+{
+#if !defined(CONFIG_USER_ONLY)
+CPUState *cs = env_cpu(env);
+RISCVCPU *cpu = RISCV_CPU(cs);
+int ctr_index;
+int base_csrno = CSR_MHPMCOUNTER3;
+
+if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
+/* Offset for RV32 mhpmcounternh counters */
+base_csrno += 0x80;
+}
+ctr_index = csrno - base_csrno;
+if (!cpu->cfg.pmu_num || ctr_index >= cpu->cfg.pmu_num) {
+/* The PMU is not enabled or counter is out of range*/
+return RISCV_EXCP_ILLEGAL_INST;
+}
+
+#endif
+return RISCV_EXCP_NONE;
+}
+
 static RISCVException ctr(CPURISCVState *env, int csrno)
 {
 #if !defined(CONFIG_USER_ONLY)
 CPUState *cs = env_cpu(env);
 RISCVCPU *cpu = RISCV_CPU(cs);
 int ctr_index;
+int base_csrno = CSR_HPMCOUNTER3;
+bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
+
+if (rv32 && csrno >= CSR_CYCLEH) {
+/* Offset for RV32 hpmcounternh counters */
+base_csrno += 0x80;
+}
+ctr_index = csrno - base_csrno;
 
-if (!cpu->cfg.ext_pmu) {
-/* The PMU extension is not enabled */
+if (!cpu->cfg.pmu_num || ctr_index >= (cpu->cfg.pmu_num)) {
+/* No counter is enabled in PMU or the counter is out of range */
 return RISCV_EXCP_ILLEGAL_INST;
 }
 
@@ -98,7 +128,7 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 }
 break;
 }
-if (riscv_cpu_is_32bit(env)) {
+if (rv32) {
 switch (csrno) {
 case CSR_CYCLEH:
 if (!get_field(env->mcounteren, COUNTEREN_CY)) {
@@ -153,7 +183,7 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 }
 break;
 }
-if (riscv_cpu_mxl(env) == MXL_RV32) {
+if (rv32) {
 switch (csrno) {
 case CSR_CYCLEH:
 if (!get_field(env->hcounteren, COUNTEREN_CY) &&
@@ -3493,35 +3523,35 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 [CSR_HPMCOUNTER30]   = { "hpmcounter30",   ctr,read_zero },
 [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,read_zero },
 
-[CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   any,read_zero },
-[CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   any,read_zero },
-[CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   any,read_zero },
-[CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   any,read_zero },
-[CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   any,read_zero },
-[CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   any,read_zero },
-[CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   any,read_zero },
-[CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  any,read_zero },
-[CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  any,read_zero },
-[CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  any,read_zero },
-

[PATCH v5 10/12] target/riscv: Add few cache related PMU events

[Atish Patra]

From: Atish Patra 

Qemu can monitor the following cache related PMU events through
tlb_fill functions.

1. DTLB load/store miss
3. ITLB prefetch miss

Increment the PMU counter in tlb_fill function.

Signed-off-by: Atish Patra 
Signed-off-by: Atish Patra 
---
 target/riscv/cpu_helper.c | 26 ++
 1 file changed, 26 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 746335bfd6b9..094d41ba07f7 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -21,10 +21,13 @@
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "pmu.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg-op.h"
 #include "trace.h"
 #include "semihosting/common-semi.h"
+#include "cpu.h"
+#include "cpu_bits.h"
 
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 {
@@ -1174,6 +1177,28 @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr 
addr,
 riscv_raise_exception(env, cs->exception_index, retaddr);
 }
 
+
+static void pmu_tlb_fill_incr_ctr(RISCVCPU *cpu, MMUAccessType access_type)
+{
+enum riscv_pmu_event_idx pmu_event_type;
+
+switch (access_type) {
+case MMU_INST_FETCH:
+pmu_event_type = RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS;
+break;
+case MMU_DATA_LOAD:
+pmu_event_type = RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS;
+break;
+case MMU_DATA_STORE:
+pmu_event_type = RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS;
+break;
+default:
+return;
+}
+
+riscv_pmu_incr_ctr(cpu, pmu_event_type);
+}
+
 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 MMUAccessType access_type, int mmu_idx,
 bool probe, uintptr_t retaddr)
@@ -1270,6 +1295,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int 
size,
 }
 }
 } else {
+pmu_tlb_fill_incr_ctr(cpu, access_type);
 /* Single stage lookup */
 ret = get_physical_address(env, , , address, NULL,
access_type, mmu_idx, true, false, false);
-- 
2.30.2

[PATCH v3 1/6] hw/openrisc/openrisc_sim: Create machine state for or1ksim

[Stafford Horne]

This will allow us to attach machine state attributes like
the device tree fdt.

Signed-off-by: Stafford Horne 
Reviewed-by: Philippe Mathieu-Daudé 
---
 hw/openrisc/openrisc_sim.c | 30 --
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 73fe383c2d..26d2370e60 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -37,6 +37,18 @@
 
 #define KERNEL_LOAD_ADDR 0x100
 
+#define TYPE_OR1KSIM_MACHINE MACHINE_TYPE_NAME("or1k-sim")
+#define OR1KSIM_MACHINE(obj) \
+OBJECT_CHECK(Or1ksimState, (obj), TYPE_OR1KSIM_MACHINE)
+
+typedef struct Or1ksimState {
+/*< private >*/
+MachineState parent_obj;
+
+/*< public >*/
+
+} Or1ksimState;
+
 static struct openrisc_boot_info {
 uint32_t bootstrap_pc;
 } boot_info;
@@ -183,8 +195,10 @@ static void openrisc_sim_init(MachineState *machine)
 openrisc_load_kernel(ram_size, kernel_filename);
 }
 
-static void openrisc_sim_machine_init(MachineClass *mc)
+static void openrisc_sim_machine_init(ObjectClass *oc, void *data)
 {
+MachineClass *mc = MACHINE_CLASS(oc);
+
 mc->desc = "or1k simulation";
 mc->init = openrisc_sim_init;
 mc->max_cpus = 2;
@@ -192,4 +206,16 @@ static void openrisc_sim_machine_init(MachineClass *mc)
 mc->default_cpu_type = OPENRISC_CPU_TYPE_NAME("or1200");
 }
 
-DEFINE_MACHINE("or1k-sim", openrisc_sim_machine_init)
+static const TypeInfo or1ksim_machine_typeinfo = {
+.name   = TYPE_OR1KSIM_MACHINE,
+.parent = TYPE_MACHINE,
+.class_init = openrisc_sim_machine_init,
+.instance_size = sizeof(Or1ksimState),
+};
+
+static void or1ksim_machine_init_register_types(void)
+{
+type_register_static(_machine_typeinfo);
+}
+
+type_init(or1ksim_machine_init_register_types)
-- 
2.31.1

[PATCH v3 0/6] OpenRISC Device Tree Generation

[Stafford Horne]

Changes since v2:
 - Fix description to say devicetree "generation" not "support"
 - Fix up various indentation issues.
 - Use HWADDR_PRIx string formatting.
 - Split device tree population out to device init.
 - Do not load device tree or initrd if we have no kernel.
 - Added patches to split uart initialization out to it's own function fix 2 CPU
   limit.

Changes since v1:
 - Fixed typos pointed out by Philippe
 - Moved usage of machine state to patch 3/4
 - added config dependency on FDT

This series adds device tree generation for the OpenRISC SIM hardware.

The simulator will generate an FDT and pass it to the kernel.

For example:
  qemu-system-or1k -cpu or1200 -M or1k-sim \
-kernel /home/shorne/work/linux/vmlinux \
-initrd /home/shorne/work/linux/initramfs.cpio.gz \
-serial mon:stdio -nographic -gdb tcp::10001 -m 32

Using the linux kernel or1ksim_defconfig we can remove the built-in
dts and the kernel will boot as expected.  The real benefit here is
being able to specify an external initrd which qemu will load into
memory and the device tree will tell the kernel where to find it.

Tested this by booting single core and SMP kernels with 4x CPUs.

Stafford Horne (6):
  hw/openrisc/openrisc_sim: Create machine state for or1ksim
  hw/openrisc/openrisc_sim: Parameterize initialization
  hw/openrisc/openrisc_sim: Use IRQ splitter when connecting UART
  hw/openrisc/openrisc_sim: Increase max_cpus to 4
  hw/openrisc/openrisc_sim: Add automatic device tree generation
  hw/openrisc/openrisc_sim: Add support for initrd loading

 configs/targets/or1k-softmmu.mak |   1 +
 hw/openrisc/openrisc_sim.c   | 308 ---
 2 files changed, 285 insertions(+), 24 deletions(-)

-- 
2.31.1

Re: [PATCH v2 2/2] hw/ide: add ich6 ide controller device emulation

[Liav Albani]

On 2/19/22 02:50, BALATON Zoltan wrote:

+/*
+ * QEMU IDE Emulation: PCI ICH6/ICH7 IDE support.


This is a small thing, but if these two are the same maybe keeping 
this comment but using the ich7 name everywhere else would make it 
less likely to get it confused with ich9. I mean ich6 and ich9 is 
easily confused, while ich7 is clearly distinct. But maybe it's just 
me, calling it ich6 is also correct and can be preferred by someone else.
ICH6 and ICH7 IDE controllers are quite the same as far as I know. I 
could change it, but then one could argue that the name ich6-ide seems 
like "ich9-ide", so not sure if we can really go on this path.


+static void ich6_pci_config_write(PCIDevice *d, uint32_t addr, 
uint32_t val,

+    int l)
+{
+    uint32_t i;
+
+    pci_default_write_config(d, addr, val, l);
+
+    for (i = addr; i < addr + l; i++) {
+    switch (i) {
+    case 0x40:
+    pci_default_write_config(d, i, 0x8000, 2);
+    continue;
+    case 0x42:
+    pci_default_write_config(d, i, 0x8000, 2);
+    continue;
+    }
+    }


I'm not sure what this tries to do but this for cycle looks suspicious 
here. It's also only calls pci_default_write_config() so why didn't 
the default worked and why was this override needed?


It's just a loop to ensure that if the guest OS tries to disable an IDE 
channel from the PCI config space, it seems "stuck" on enabled. I should 
probably put a comment on this to explain this, but I definitely don't 
want the guest OS to be able to disable any IDE channel for now (on real 
hardware, it does that, but I think we can either skip this feature or 
implement in a future patch, as Linux deals with the controller just fine).

+}
+
+static void ich6_ide_reset(DeviceState *dev)
+{
+    PCIIDEState *d = PCI_IDE(dev);
+    PCIDevice *pd = PCI_DEVICE(d);
+    uint8_t *pci_conf = pd->config;
+    int i;
+
+    for (i = 0; i < 2; i++) {
+    ide_bus_reset(>bus[i]);
+    }
+
+    /* TODO: this is the default. do not override. */
+    pci_conf[PCI_COMMAND] = 0x00;
+    /* TODO: this is the default. do not override. */
+    pci_conf[PCI_COMMAND + 1] = 0x00;
+    /* TODO: use pci_set_word */
+    pci_conf[PCI_STATUS] = PCI_STATUS_FAST_BACK;
+    pci_conf[PCI_STATUS + 1] = PCI_STATUS_DEVSEL_MEDIUM >> 8;
+    pci_conf[0x20] = 0x01; /* BMIBA: 20-23h */
+}
+
+static int pci_ich6_init_ports(PCIIDEState *d)
+{
+    int i;
+
+    for (i = 0; i < 2; i++) {
+    ide_bus_init(>bus[i], sizeof(d->bus[i]), DEVICE(d), i, 2);
+    ide_init2(>bus[i], d->native_irq);
+
+    bmdma_init(>bus[i], >bmdma[i], d);
+    d->bmdma[i].bus = >bus[i];
+    ide_register_restart_cb(>bus[i]);
+    }
+
+    return 0;
+}
+
+static void pci_ich6_ide_realize(PCIDevice *dev, Error **errp)
+{
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
+    int rc;


All in all this device looks very similar to piix ide devices with 
only some differentces so I wonder if ir could be implemented as 
another device in piix.c. We already have 3 variants there: piix3-ide, 
piix3-ide-xen, and piix4-ide so maybe putting this device in piix.c 
could avoid some code duplication. In that case moving out 
bmdma_{read,write} were not needed either although maybe that's a good 
idea anyway to share it with other devices.


As for putting the ich6-ide code in piix.c  - I'm not against it. 
Although, in the long run, if I send more patches to QEMU, I rather 
split the files a bit more in the /hw/ide directory as there's a lot of 
code duplication to solve.
So, what we could do instead, is to share more code between the devices 
and still keep them in separate files.


As for moving out the bmdma_{write,read} functions - I'm still in the 
previous mind that we need to move them out as via.c shares the same 
code but currently has code duplications for it, and that I want to 
solve as part of making the IDE code more clean and to add more features.


However, if it seems necessary to do this cleanup before implementing 
this ich6-ide controller, I'm more than happy to wait on this, send a 
patch to solve and clean up some issues in the IDE code, and then 
re-send this as v3.

I might even consider doing that now if nobody rejects this idea :)


+
+    pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
+
+    /* PCI native mode-only controller, supports bus mastering */
+    pci_conf[PCI_CLASS_PROG] = 0x85;
+
+    bmdma_setup_bar(d);
+    pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, >bmdma_bar);
+
+    d->native_irq = pci_allocate_irq(>parent_obj);


Is this irq and the new field in PCIIDEState really needed? If this 
device is using PCI interrupts could it do the same as CMD646 ide does 
instead?


I looked into how cmd646.c does that, but it creates that with the 
qdev_init_gpio_in function. The AHCI controller seems to use 
pci_allocate_irq function (in ich.c), as well as other hardware devices 
in QEMU, 

[PATCH v3 4/6] hw/openrisc/openrisc_sim: Increase max_cpus to 4

[Stafford Horne]

Now that we no longer have a limit of 2 CPUs due to fixing the
IRQ routing issues we can increase the max.  Here we increase
the limit to 4, we could go higher, but currently OMPIC has a
limit of 4, so we align with that.

Signed-off-by: Stafford Horne 
---
 hw/openrisc/openrisc_sim.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 5bfbac00f8..8cfb92bec6 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -37,6 +37,8 @@
 
 #define KERNEL_LOAD_ADDR 0x100
 
+#define OR1KSIM_CPUS_MAX 4
+
 #define TYPE_OR1KSIM_MACHINE MACHINE_TYPE_NAME("or1k-sim")
 #define OR1KSIM_MACHINE(obj) \
 OBJECT_CHECK(Or1ksimState, (obj), TYPE_OR1KSIM_MACHINE)
@@ -197,12 +199,12 @@ static void openrisc_sim_init(MachineState *machine)
 {
 ram_addr_t ram_size = machine->ram_size;
 const char *kernel_filename = machine->kernel_filename;
-OpenRISCCPU *cpus[2] = {};
+OpenRISCCPU *cpus[OR1KSIM_CPUS_MAX] = {};
 MemoryRegion *ram;
 int n;
 unsigned int smp_cpus = machine->smp.cpus;
 
-assert(smp_cpus >= 1 && smp_cpus <= 2);
+assert(smp_cpus >= 1 && smp_cpus <= OR1KSIM_CPUS_MAX);
 for (n = 0; n < smp_cpus; n++) {
 cpus[n] = OPENRISC_CPU(cpu_create(machine->cpu_type));
 if (cpus[n] == NULL) {
@@ -243,7 +245,7 @@ static void openrisc_sim_machine_init(ObjectClass *oc, void 
*data)
 
 mc->desc = "or1k simulation";
 mc->init = openrisc_sim_init;
-mc->max_cpus = 2;
+mc->max_cpus = OR1KSIM_CPUS_MAX;
 mc->is_default = true;
 mc->default_cpu_type = OPENRISC_CPU_TYPE_NAME("or1200");
 }
-- 
2.31.1

[PATCH v2] hvf: Fix OOB write in RDTSCP instruction decode

[Cameron Esfahani]

A guest could craft a specific stream of instructions that will have QEMU
write 0xF9 to inappropriate locations in memory.  Add additional asserts
to check for this.  Generate a #UD if there are more than 14 prefix bytes.

Found by Julian Stecklina 

Signed-off-by: Cameron Esfahani 
Signed-off-by: Philippe Mathieu-Daudé 
---
 target/i386/hvf/x86_decode.c | 12 ++--
 target/i386/hvf/x86hvf.c |  8 
 target/i386/hvf/x86hvf.h |  1 +
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/target/i386/hvf/x86_decode.c b/target/i386/hvf/x86_decode.c
index 062713b1a4..5d051252b4 100644
--- a/target/i386/hvf/x86_decode.c
+++ b/target/i386/hvf/x86_decode.c
@@ -24,8 +24,10 @@
 #include "vmx.h"
 #include "x86_mmu.h"
 #include "x86_descr.h"
+#include "x86hvf.h"
 
 #define OPCODE_ESCAPE   0xf
+#define X86_MAX_INSN_PREFIX_LENGTH (14)
 
 static void decode_invalid(CPUX86State *env, struct x86_decode *decode)
 {
@@ -541,7 +543,8 @@ static void decode_lidtgroup(CPUX86State *env, struct 
x86_decode *decode)
 };
 decode->cmd = group[decode->modrm.reg];
 if (0xf9 == decode->modrm.modrm) {
-decode->opcode[decode->len++] = decode->modrm.modrm;
+VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
+decode->opcode[decode->opcode_len++] = decode->modrm.modrm;
 decode->cmd = X86_DECODE_CMD_RDTSCP;
 }
 }
@@ -1847,7 +1850,8 @@ void calc_modrm_operand(CPUX86State *env, struct 
x86_decode *decode,
 
 static void decode_prefix(CPUX86State *env, struct x86_decode *decode)
 {
-while (1) {
+/* At most X86_MAX_INSN_PREFIX_LENGTH prefix bytes. */
+for (int i = 0; i < X86_MAX_INSN_PREFIX_LENGTH; i++) {
 /*
  * REX prefix must come after legacy prefixes.
  * REX before legacy is ignored.
@@ -1892,6 +1896,8 @@ static void decode_prefix(CPUX86State *env, struct 
x86_decode *decode)
 return;
 }
 }
+/* Too many prefixes!  Generate #UD. */
+hvf_inject_ud(env);
 }
 
 void set_addressing_size(CPUX86State *env, struct x86_decode *decode)
@@ -2090,11 +2096,13 @@ static void decode_opcodes(CPUX86State *env, struct 
x86_decode *decode)
 uint8_t opcode;
 
 opcode = decode_byte(env, decode);
+VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
 decode->opcode[decode->opcode_len++] = opcode;
 if (opcode != OPCODE_ESCAPE) {
 decode_opcode_1(env, decode, opcode);
 } else {
 opcode = decode_byte(env, decode);
+VM_PANIC_ON(decode->opcode_len >= sizeof(decode->opcode));
 decode->opcode[decode->opcode_len++] = opcode;
 decode_opcode_2(env, decode, opcode);
 }
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 05ec1bddc4..a805c125d9 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -425,6 +425,14 @@ bool hvf_inject_interrupts(CPUState *cpu_state)
 & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR));
 }
 
+void hvf_inject_ud(CPUX86State *env)
+{
+env->exception_nr = EXCP06_ILLOP;
+env->exception_injected = 1;
+env->has_error_code = false;
+env->error_code = 0;
+}
+
 int hvf_process_events(CPUState *cpu_state)
 {
 X86CPU *cpu = X86_CPU(cpu_state);
diff --git a/target/i386/hvf/x86hvf.h b/target/i386/hvf/x86hvf.h
index 99ed8d608d..ef472a32f9 100644
--- a/target/i386/hvf/x86hvf.h
+++ b/target/i386/hvf/x86hvf.h
@@ -22,6 +22,7 @@
 
 int hvf_process_events(CPUState *);
 bool hvf_inject_interrupts(CPUState *);
+void hvf_inject_ud(CPUX86State *);
 void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
  SegmentCache *qseg, bool is_tr);
 void hvf_get_segment(SegmentCache *qseg, struct vmx_segment *vmx_seg);
-- 
2.32.0 (Apple Git-132)

[PATCH v3 6/6] hw/openrisc/openrisc_sim: Add support for initrd loading

[Stafford Horne]

The initrd passed via the command line is loaded into memory.  It's
location and size is then added to the device tree so the kernel knows
where to find it.

Signed-off-by: Stafford Horne 
Reviewed-by: Peter Maydell 
---
 hw/openrisc/openrisc_sim.c | 31 +++
 1 file changed, 31 insertions(+)

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index e0e71c0faa..8184caa60b 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -315,6 +315,33 @@ static hwaddr openrisc_load_kernel(ram_addr_t ram_size,
 return 0;
 }
 
+static hwaddr openrisc_load_initrd(Or1ksimState *state, const char *filename,
+   hwaddr load_start, uint64_t mem_size)
+{
+void *fdt = state->fdt;
+int size;
+hwaddr start;
+
+/* We put the initrd right after the kernel; page aligned. */
+start = TARGET_PAGE_ALIGN(load_start);
+
+size = load_ramdisk(filename, start, mem_size - start);
+if (size < 0) {
+size = load_image_targphys(filename, start, mem_size - start);
+if (size < 0) {
+error_report("could not load ramdisk '%s'", filename);
+exit(1);
+}
+}
+
+qemu_fdt_setprop_cell(fdt, "/chosen",
+  "linux,initrd-start", start);
+qemu_fdt_setprop_cell(fdt, "/chosen",
+  "linux,initrd-end", start + size);
+
+return start + size;
+}
+
 static uint32_t openrisc_load_fdt(Or1ksimState *state, hwaddr load_start,
   uint64_t mem_size)
 {
@@ -393,6 +420,10 @@ static void openrisc_sim_init(MachineState *machine)
 
 load_addr = openrisc_load_kernel(ram_size, kernel_filename);
 if (load_addr > 0) {
+if (machine->initrd_filename) {
+load_addr = openrisc_load_initrd(state, machine->initrd_filename,
+ load_addr, machine->ram_size);
+}
 boot_info.fdt_addr = openrisc_load_fdt(state, load_addr,
machine->ram_size);
 }
-- 
2.31.1

[PATCH v3 3/6] hw/openrisc/openrisc_sim: Use IRQ splitter when connecting UART

[Stafford Horne]

Currently the OpenRISC SMP configuration only supports 2 cores due to
the UART IRQ routing being limited to 2 cores.  As was done in commit
1eeffbeb11 ("hw/openrisc/openrisc_sim: Use IRQ splitter when connecting
IRQ to multiple CPUs") we can use a splitter to wire more than 2 CPUs.

This patch moves serial initialization out to it's own function and
uses a splitter to connect multiple CPU irq lines to the UART.

Signed-off-by: Stafford Horne 
---
 hw/openrisc/openrisc_sim.c | 32 
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index d12b3e0c5e..5bfbac00f8 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -137,6 +137,28 @@ static void openrisc_sim_ompic_init(hwaddr base, int 
num_cpus,
 sysbus_mmio_map(s, 0, base);
 }
 
+static void openrisc_sim_serial_init(hwaddr base, int num_cpus,
+ OpenRISCCPU *cpus[], int irq_pin)
+{
+qemu_irq serial_irq;
+int i;
+
+if (num_cpus > 1) {
+DeviceState *splitter = qdev_new(TYPE_SPLIT_IRQ);
+qdev_prop_set_uint32(splitter, "num-lines", num_cpus);
+qdev_realize_and_unref(splitter, NULL, _fatal);
+for (i = 0; i < num_cpus; i++) {
+qdev_connect_gpio_out(splitter, i, get_cpu_irq(cpus, i, irq_pin));
+}
+serial_irq = qdev_get_gpio_in(splitter, 0);
+} else {
+serial_irq = get_cpu_irq(cpus, 0, irq_pin);
+}
+serial_mm_init(get_system_memory(), base, 0, serial_irq, 115200,
+   serial_hd(0), DEVICE_NATIVE_ENDIAN);
+}
+
+
 static void openrisc_load_kernel(ram_addr_t ram_size,
  const char *kernel_filename)
 {
@@ -177,7 +199,6 @@ static void openrisc_sim_init(MachineState *machine)
 const char *kernel_filename = machine->kernel_filename;
 OpenRISCCPU *cpus[2] = {};
 MemoryRegion *ram;
-qemu_irq serial_irq;
 int n;
 unsigned int smp_cpus = machine->smp.cpus;
 
@@ -208,15 +229,10 @@ static void openrisc_sim_init(MachineState *machine)
 if (smp_cpus > 1) {
 openrisc_sim_ompic_init(or1ksim_memmap[OR1KSIM_OMPIC].base, smp_cpus,
 cpus, OR1KSIM_OMPIC_IRQ);
-
-serial_irq = qemu_irq_split(get_cpu_irq(cpus, 0, OR1KSIM_UART_IRQ),
-get_cpu_irq(cpus, 1, OR1KSIM_UART_IRQ));
-} else {
-serial_irq = get_cpu_irq(cpus, 0, OR1KSIM_UART_IRQ);
 }
 
-serial_mm_init(get_system_memory(), or1ksim_memmap[OR1KSIM_UART].base, 0,
-   serial_irq, 115200, serial_hd(0), DEVICE_NATIVE_ENDIAN);
+openrisc_sim_serial_init(or1ksim_memmap[OR1KSIM_UART].base, smp_cpus, cpus,
+ OR1KSIM_UART_IRQ);
 
 openrisc_load_kernel(ram_size, kernel_filename);
 }
-- 
2.31.1

[PATCH v3 2/6] hw/openrisc/openrisc_sim: Parameterize initialization

[Stafford Horne]

Move magic numbers to variables and enums. These will be reused for
upcoming fdt initialization.

Signed-off-by: Stafford Horne 
Reviewed-by: Philippe Mathieu-Daudé 
---
 hw/openrisc/openrisc_sim.c | 42 ++
 1 file changed, 34 insertions(+), 8 deletions(-)

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 26d2370e60..d12b3e0c5e 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -49,6 +49,29 @@ typedef struct Or1ksimState {
 
 } Or1ksimState;
 
+enum {
+OR1KSIM_DRAM,
+OR1KSIM_UART,
+OR1KSIM_ETHOC,
+OR1KSIM_OMPIC,
+};
+
+enum {
+OR1KSIM_OMPIC_IRQ = 1,
+OR1KSIM_UART_IRQ = 2,
+OR1KSIM_ETHOC_IRQ = 4,
+};
+
+static const struct MemmapEntry {
+hwaddr base;
+hwaddr size;
+} or1ksim_memmap[] = {
+[OR1KSIM_DRAM] =  { 0x,  0 },
+[OR1KSIM_UART] =  { 0x9000,  0x100 },
+[OR1KSIM_ETHOC] = { 0x9200,  0x800 },
+[OR1KSIM_OMPIC] = { 0x9800, 16 },
+};
+
 static struct openrisc_boot_info {
 uint32_t bootstrap_pc;
 } boot_info;
@@ -176,21 +199,24 @@ static void openrisc_sim_init(MachineState *machine)
 memory_region_add_subregion(get_system_memory(), 0, ram);
 
 if (nd_table[0].used) {
-openrisc_sim_net_init(0x9200, 0x92000400, smp_cpus,
-  cpus, 4, nd_table);
+openrisc_sim_net_init(or1ksim_memmap[OR1KSIM_ETHOC].base,
+  or1ksim_memmap[OR1KSIM_ETHOC].base + 0x400,
+  smp_cpus, cpus,
+  OR1KSIM_ETHOC_IRQ, nd_table);
 }
 
 if (smp_cpus > 1) {
-openrisc_sim_ompic_init(0x9800, smp_cpus, cpus, 1);
+openrisc_sim_ompic_init(or1ksim_memmap[OR1KSIM_OMPIC].base, smp_cpus,
+cpus, OR1KSIM_OMPIC_IRQ);
 
-serial_irq = qemu_irq_split(get_cpu_irq(cpus, 0, 2),
-get_cpu_irq(cpus, 1, 2));
+serial_irq = qemu_irq_split(get_cpu_irq(cpus, 0, OR1KSIM_UART_IRQ),
+get_cpu_irq(cpus, 1, OR1KSIM_UART_IRQ));
 } else {
-serial_irq = get_cpu_irq(cpus, 0, 2);
+serial_irq = get_cpu_irq(cpus, 0, OR1KSIM_UART_IRQ);
 }
 
-serial_mm_init(get_system_memory(), 0x9000, 0, serial_irq,
-   115200, serial_hd(0), DEVICE_NATIVE_ENDIAN);
+serial_mm_init(get_system_memory(), or1ksim_memmap[OR1KSIM_UART].base, 0,
+   serial_irq, 115200, serial_hd(0), DEVICE_NATIVE_ENDIAN);
 
 openrisc_load_kernel(ram_size, kernel_filename);
 }
-- 
2.31.1

Re: [PATCH v2 1/2] hw/ide: split bmdma read and write functions from piix.c

[Liav Albani]

On 2/19/22 02:12, BALATON Zoltan wrote:

On Fri, 18 Feb 2022, Liav Albani wrote:

This is a preparation before implementing another PCI IDE controller
that relies on these functions, so these can be shared between both
implementations.

Signed-off-by: Liav Albani 
---
hw/ide/bmdma.c | 84 ++
hw/ide/meson.build |  2 +-
hw/ide/piix.c  | 51 ++---
include/hw/ide/bmdma.h | 34 +
4 files changed, 122 insertions(+), 49 deletions(-)
create mode 100644 hw/ide/bmdma.c
create mode 100644 include/hw/ide/bmdma.h

diff --git a/hw/ide/bmdma.c b/hw/ide/bmdma.c
new file mode 100644
index 00..d12ed730dd
--- /dev/null
+++ b/hw/ide/bmdma.c
@@ -0,0 +1,84 @@
+/*
+ * QEMU IDE Emulation: Intel PCI Bus master IDE support for PIIX3/4 
and ICH6/7.

+ *
+ * Copyright (c) 2003 Fabrice Bellard
+ * Copyright (c) 2006 Openedhand Ltd.
+ *
+ * Permission is hereby granted, free of charge, to any person 
obtaining a copy
+ * of this software and associated documentation files (the 
"Software"), to deal
+ * in the Software without restriction, including without limitation 
the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, 
and/or sell
+ * copies of the Software, and to permit persons to whom the 
Software is

+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be 
included in

+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 
MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT 
SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES 
OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 
ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 
DEALINGS IN

+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qemu/module.h"
+#include "sysemu/block-backend.h"
+#include "sysemu/blockdev.h"
+#include "sysemu/dma.h"
+
+#include "hw/ide/bmdma.h"
+#include "hw/ide/pci.h"
+#include "trace.h"


Are you sure you need all these includes? I haven't checked but I 
think there may be some unneeded ones here. On the other hand I'm not 
sure putting these in a new file is worth it. There are already some 
bmdma_* functions in hw/ide/pci.c which are declared in 
include/hw/ide/pci.h so you could just move these there too then no 
new file, new header nor changes to meson.build is needed in this patch..


Good question, probably not. I'll try to build without them, adding only 
what seems necessary to complete the build. Also, I think adding those 
functions to hw/ide/pci.c is a very good idea as it will make the patch 
smaller and it also makes total sense to me - Bus Master capabilities 
only appear on PCI IDE controllers and not on the ISA IDE controller 
(AFAIK).


It will happen in v3 :)


+
+uint64_t intel_ide_bmdma_read(void *opaque, hwaddr addr, unsigned size)


As I said before these aren't intel specific as the same functions 
also appear in other ide controllers such as via.c so maybe a better 
name would be bmdma_default_read and bmdma_default_write or somehting 
similar so these can be also reused by other non-intel devices too.


Right, I see now that via.c uses the exact same functions... I'll change 
it in v3. The names bmdma_default_read and bmdma_default_write seem like 
a good choice to me.

Regards,
BALATON Zoltan

Thanks for the review!

[PATCH v3 5/6] hw/openrisc/openrisc_sim: Add automatic device tree generation

[Stafford Horne]

Using the device tree means that qemu can now directly tell
the kernel what hardware is configured rather than use having
to maintain and update a separate device tree file.

This patch adds automatic device tree generation support for the
OpenRISC simulator.  A device tree is built up based on the state of the
configure openrisc simulator.

This is then dumped to memory and the load address is passed to the
kernel in register r3.

Signed-off-by: Stafford Horne 
---
 configs/targets/or1k-softmmu.mak |   1 +
 hw/openrisc/openrisc_sim.c   | 189 ---
 2 files changed, 175 insertions(+), 15 deletions(-)

diff --git a/configs/targets/or1k-softmmu.mak b/configs/targets/or1k-softmmu.mak
index 1dfb93e46d..9e1d4a1fb1 100644
--- a/configs/targets/or1k-softmmu.mak
+++ b/configs/targets/or1k-softmmu.mak
@@ -1,2 +1,3 @@
 TARGET_ARCH=openrisc
 TARGET_WORDS_BIGENDIAN=y
+TARGET_NEED_FDT=y
diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 8cfb92bec6..e0e71c0faa 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -29,15 +29,20 @@
 #include "net/net.h"
 #include "hw/loader.h"
 #include "hw/qdev-properties.h"
+#include "exec/address-spaces.h"
+#include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "sysemu/qtest.h"
 #include "sysemu/reset.h"
 #include "hw/core/split-irq.h"
 
+#include 
+
 #define KERNEL_LOAD_ADDR 0x100
 
 #define OR1KSIM_CPUS_MAX 4
+#define OR1KSIM_CLK_MHZ 2000
 
 #define TYPE_OR1KSIM_MACHINE MACHINE_TYPE_NAME("or1k-sim")
 #define OR1KSIM_MACHINE(obj) \
@@ -48,6 +53,8 @@ typedef struct Or1ksimState {
 MachineState parent_obj;
 
 /*< public >*/
+void *fdt;
+int fdt_size;
 
 } Or1ksimState;
 
@@ -76,6 +83,7 @@ static const struct MemmapEntry {
 
 static struct openrisc_boot_info {
 uint32_t bootstrap_pc;
+uint32_t fdt_addr;
 } boot_info;
 
 static void main_cpu_reset(void *opaque)
@@ -86,6 +94,7 @@ static void main_cpu_reset(void *opaque)
 cpu_reset(CPU(cpu));
 
 cpu_set_pc(cs, boot_info.bootstrap_pc);
+cpu_set_gpr(>env, 3, boot_info.fdt_addr);
 }
 
 static qemu_irq get_cpu_irq(OpenRISCCPU *cpus[], int cpunum, int irq_pin)
@@ -93,12 +102,77 @@ static qemu_irq get_cpu_irq(OpenRISCCPU *cpus[], int 
cpunum, int irq_pin)
 return qdev_get_gpio_in_named(DEVICE(cpus[cpunum]), "IRQ", irq_pin);
 }
 
-static void openrisc_sim_net_init(hwaddr base, hwaddr descriptors,
+static void openrisc_create_fdt(Or1ksimState *state,
+const struct MemmapEntry *memmap,
+int num_cpus, uint64_t mem_size,
+const char *cmdline)
+{
+void *fdt;
+int cpu;
+char *nodename;
+int pic_ph;
+
+fdt = state->fdt = create_device_tree(>fdt_size);
+if (!fdt) {
+error_report("create_device_tree() failed");
+exit(1);
+}
+
+qemu_fdt_setprop_string(fdt, "/", "compatible", "opencores,or1ksim");
+qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x1);
+qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x1);
+
+nodename = g_strdup_printf("/memory@%" HWADDR_PRIx,
+   memmap[OR1KSIM_DRAM].base);
+qemu_fdt_add_subnode(fdt, nodename);
+qemu_fdt_setprop_cells(fdt, nodename, "reg",
+   memmap[OR1KSIM_DRAM].base, mem_size);
+qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
+g_free(nodename);
+
+qemu_fdt_add_subnode(fdt, "/cpus");
+qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
+qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
+
+for (cpu = 0; cpu < num_cpus; cpu++) {
+nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
+qemu_fdt_add_subnode(fdt, nodename);
+qemu_fdt_setprop_string(fdt, nodename, "compatible",
+"opencores,or1200-rtlsvn481");
+qemu_fdt_setprop_cell(fdt, nodename, "reg", cpu);
+qemu_fdt_setprop_cell(fdt, nodename, "clock-frequency",
+  OR1KSIM_CLK_MHZ);
+g_free(nodename);
+}
+
+nodename = (char *)"/pic";
+qemu_fdt_add_subnode(fdt, nodename);
+pic_ph = qemu_fdt_alloc_phandle(fdt);
+qemu_fdt_setprop_string(fdt, nodename, "compatible",
+"opencores,or1k-pic-level");
+qemu_fdt_setprop_cell(fdt, nodename, "#interrupt-cells", 1);
+qemu_fdt_setprop(fdt, nodename, "interrupt-controller", NULL, 0);
+qemu_fdt_setprop_cell(fdt, nodename, "phandle", pic_ph);
+
+qemu_fdt_setprop_cell(fdt, "/", "interrupt-parent", pic_ph);
+
+qemu_fdt_add_subnode(fdt, "/chosen");
+if (cmdline) {
+qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
+}
+
+/* Create aliases node for use by devices. */
+qemu_fdt_add_subnode(fdt, "/aliases");
+}
+
+static void openrisc_sim_net_init(Or1ksimState *state, hwaddr base, hwaddr 
size,
  

Re: [PATCH V7 10/29] machine: memfd-alloc option

[Guoyi Tu]

On Wed, 2021-12-22 at 11:05 -0800, Steve Sistare wrote:
> Allocate anonymous memory using memfd_create if the memfd-alloc
> machine
> option is set.
> 
> Signed-off-by: Steve Sistare 
> ---
>  hw/core/machine.c   | 19 +++
>  include/hw/boards.h |  1 +
>  qemu-options.hx |  6 ++
>  softmmu/physmem.c   | 47 ++-
> 
>  softmmu/vl.c|  1 +
>  trace-events|  1 +
>  util/qemu-config.c  |  4 
>  7 files changed, 70 insertions(+), 9 deletions(-)
> 
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 53a99ab..7739d88 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -392,6 +392,20 @@ static void machine_set_mem_merge(Object *obj,
> bool value, Error **errp)
>  ms->mem_merge = value;
>  }
>  
> +static bool machine_get_memfd_alloc(Object *obj, Error **errp)
> +{
> +MachineState *ms = MACHINE(obj);
> +
> +return ms->memfd_alloc;
> +}
> +
> +static void machine_set_memfd_alloc(Object *obj, bool value, Error
> **errp)
> +{
> +MachineState *ms = MACHINE(obj);
> +
> +ms->memfd_alloc = value;
> +}
> +
>  static bool machine_get_usb(Object *obj, Error **errp)
>  {
>  MachineState *ms = MACHINE(obj);
> @@ -829,6 +843,11 @@ static void machine_class_init(ObjectClass *oc,
> void *data)
>  object_class_property_set_description(oc, "mem-merge",
>  "Enable/disable memory merge support");
>  
> +object_class_property_add_bool(oc, "memfd-alloc",
> +machine_get_memfd_alloc, machine_set_memfd_alloc);
> +object_class_property_set_description(oc, "memfd-alloc",
> +"Enable/disable allocating anonymous memory using
> memfd_create");
> +
>  object_class_property_add_bool(oc, "usb",
>  machine_get_usb, machine_set_usb);
>  object_class_property_set_description(oc, "usb",
> diff --git a/include/hw/boards.h b/include/hw/boards.h
> index 9c1c190..a57d7a0 100644
> --- a/include/hw/boards.h
> +++ b/include/hw/boards.h
> @@ -327,6 +327,7 @@ struct MachineState {
>  char *dt_compatible;
>  bool dump_guest_core;
>  bool mem_merge;
> +bool memfd_alloc;
>  bool usb;
>  bool usb_disabled;
>  char *firmware;
> diff --git a/qemu-options.hx b/qemu-options.hx
> index 7d47510..33c8173 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -30,6 +30,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
>  "vmport=on|off|auto controls emulation of vmport
> (default: auto)\n"
>  "dump-guest-core=on|off include guest memory in
> a core dump (default=on)\n"
>  "mem-merge=on|off controls memory merge support
> (default: on)\n"
> +"memfd-alloc=on|off controls allocating
> anonymous guest RAM using memfd_create (default: off)\n"
>  "aes-key-wrap=on|off controls support for AES
> key wrapping (default=on)\n"
>  "dea-key-wrap=on|off controls support for DEA
> key wrapping (default=on)\n"
>  "suppress-vmdesc=on|off disables self-describing 
> migration (default=off)\n"
> @@ -76,6 +77,11 @@ SRST
>  supported by the host, de-duplicates identical memory pages
>  among VMs instances (enabled by default).
>  
> +``memfd-alloc=on|off``
> +Enables or disables allocation of anonymous guest RAM using
> +memfd_create.  Any associated memory-backend objects are
> created with
> +share=on.  The memfd-alloc default is off.
> +
>  ``aes-key-wrap=on|off``
>  Enables or disables AES key wrapping support on s390-ccw
> hosts.
>  This feature controls whether AES wrapping keys will be
> created
> diff --git a/softmmu/physmem.c b/softmmu/physmem.c
> index 3524c04..95e2b49 100644
> --- a/softmmu/physmem.c
> +++ b/softmmu/physmem.c
> @@ -41,6 +41,7 @@
>  #include "qemu/config-file.h"
>  #include "qemu/error-report.h"
>  #include "qemu/qemu-print.h"
> +#include "qemu/memfd.h"
>  #include "exec/memory.h"
>  #include "exec/ioport.h"
>  #include "sysemu/dma.h"
> @@ -1964,35 +1965,63 @@ static void ram_block_add(RAMBlock
> *new_block, Error **errp)
>  const bool shared = qemu_ram_is_shared(new_block);
>  RAMBlock *block;
>  RAMBlock *last_block = NULL;
> +struct MemoryRegion *mr = new_block->mr;
>  ram_addr_t old_ram_size, new_ram_size;
>  Error *err = NULL;
> +const char *name;
> +void *addr = 0;
> +size_t maxlen;
> +MachineState *ms = MACHINE(qdev_get_machine());
>  
>  old_ram_size = last_ram_page();
>  
>  qemu_mutex_lock_ramlist();
> -new_block->offset = find_ram_offset(new_block->max_length);
> +maxlen = new_block->max_length;
> +new_block->offset = find_ram_offset(maxlen);
>  
>  if (!new_block->host) {
>  if (xen_enabled()) {
> -xen_ram_alloc(new_block->offset, new_block->max_length,
> -  new_block->mr, );
> +xen_ram_alloc(new_block->offset, maxlen, 

[PATCH v2 4/7] aspeed: rainier: Add strap values taken from hardware

[Cédric Le Goater]

From: Joel Stanley 

When time permits, we should introduce defines for the HW strapping
registers to cleanly decode the values.

SCU500 = 0x00422016
  Disable ARM JTAG trusted world debug: 0x1
  Disable ARM JTAG debug: 0x1
  VGA Memory Size: 0x1 [16MB]
  Cortex M3: 0x1 [Disabled]
  Boot device: 0x1 [eMMC]
  Reserved: 0x1

SCU510 = 0x8848
  Secure Boot Enable: 0x1
  Enable boot SPI or eMMC ABR (second boot): 0x1
  Enable LPC mode: 0x1 [LPC]
  Disable LPC SuperIO 0x2e/0x4e: 0x1

Signed-off-by: Joel Stanley 
[ clg: rewrote the commit log ]
Signed-off-by: Cédric Le Goater 
---
 hw/arm/aspeed.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 7590b36bb017..f71a5d87473f 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -160,8 +160,8 @@ struct AspeedMachineState {
 #define TACOMA_BMC_HW_STRAP2  0x0040
 
 /* Rainier hardware value: (QEMU prototype) */
-#define RAINIER_BMC_HW_STRAP1 0x
-#define RAINIER_BMC_HW_STRAP2 0x
+#define RAINIER_BMC_HW_STRAP1 0x00422016
+#define RAINIER_BMC_HW_STRAP2 0x8848
 
 /* Fuji hardware value */
 #define FUJI_BMC_HW_STRAP10x
-- 
2.34.1

Re: [PATCH v5 00/15] hw/nvme: SR-IOV with Virtualization Enhancements

[Michael S. Tsirkin]

On Thu, Feb 17, 2022 at 06:44:49PM +0100, Lukasz Maniak wrote:
> Changes since v4:
> - Added hello world example for SR-IOV to the docs
> - Moved AER initialization from nvme_init_ctrl to nvme_init_state
> - Fixed division by zero issue in calculation of vqfrt and vifrt
>   capabilities


BTW you should copy all reviewers on the cover letter.



> Knut Omang (2):
>   pcie: Add support for Single Root I/O Virtualization (SR/IOV)
>   pcie: Add some SR/IOV API documentation in docs/pcie_sriov.txt
> 
> Lukasz Maniak (4):
>   hw/nvme: Add support for SR-IOV
>   hw/nvme: Add support for Primary Controller Capabilities
>   hw/nvme: Add support for Secondary Controller List
>   docs: Add documentation for SR-IOV and Virtualization Enhancements
> 
> Łukasz Gieryk (9):
>   pcie: Add a helper to the SR/IOV API
>   pcie: Add 1.2 version token for the Power Management Capability
>   hw/nvme: Implement the Function Level Reset
>   hw/nvme: Make max_ioqpairs and msix_qsize configurable in runtime
>   hw/nvme: Remove reg_size variable and update BAR0 size calculation
>   hw/nvme: Calculate BAR attributes in a function
>   hw/nvme: Initialize capability structures for primary/secondary
> controllers
>   hw/nvme: Add support for the Virtualization Management command
>   hw/nvme: Update the initalization place for the AER queue
> 
>  docs/pcie_sriov.txt  | 115 ++
>  docs/system/devices/nvme.rst |  82 +
>  hw/nvme/ctrl.c   | 674 ---
>  hw/nvme/ns.c |   2 +-
>  hw/nvme/nvme.h   |  55 ++-
>  hw/nvme/subsys.c |  75 +++-
>  hw/nvme/trace-events |   6 +
>  hw/pci/meson.build   |   1 +
>  hw/pci/pci.c | 100 --
>  hw/pci/pcie.c|   5 +
>  hw/pci/pcie_sriov.c  | 302 
>  hw/pci/trace-events  |   5 +
>  include/block/nvme.h |  65 
>  include/hw/pci/pci.h |  12 +-
>  include/hw/pci/pci_ids.h |   1 +
>  include/hw/pci/pci_regs.h|   1 +
>  include/hw/pci/pcie.h|   6 +
>  include/hw/pci/pcie_sriov.h  |  77 
>  include/qemu/typedefs.h  |   2 +
>  19 files changed, 1505 insertions(+), 81 deletions(-)
>  create mode 100644 docs/pcie_sriov.txt
>  create mode 100644 hw/pci/pcie_sriov.c
>  create mode 100644 include/hw/pci/pcie_sriov.h
> 
> -- 
> 2.25.1
> 
> 
> 

Re: [PATCH v2] hw: riscv: opentitan: fixup SPI addresses

[Bin Meng]

On Fri, Feb 18, 2022 at 2:38 PM Alistair Francis
 wrote:
>
> From: Wilfred Mallawa 
>
> This patch updates the SPI_DEVICE, SPI_HOST0, SPI_HOST1
> base addresses. Also adds these as unimplemented devices.
>
> The address references can be found [1].
>
> [1] 
> https://github.com/lowRISC/opentitan/blob/6c317992fbd646818b34f2a2dbf44bc850e461e4/hw/top_earlgrey/sw/autogen/top_earlgrey_memory.h#L107
>
> Signed-off-by: Wilfred Mallawa 
> Reviewed-by: Alistair Francis 
> ---
> v2: arranged base addrs in sorted order
>
>  hw/riscv/opentitan.c | 12 +---
>  include/hw/riscv/opentitan.h |  4 +++-
>  2 files changed, 12 insertions(+), 4 deletions(-)
>

Reviewed-by: Bin Meng 

Re: [PATCH v3] arm: Remove swift-bmc machine

[Cédric Le Goater]

On 2/17/22 11:31, Joel Stanley wrote:

It was scheduled for removal in 7.0.

Signed-off-by: Joel Stanley 


Reviewed-by: Cédric Le Goater 

Thanks,

C.



--
v2: also remove from docs/about/deprecated.rst
v3: remove strap define, add note to removed-features.rst
---
  docs/about/deprecated.rst   |  7 
  docs/about/removed-features.rst |  5 +++
  docs/system/arm/aspeed.rst  |  1 -
  hw/arm/aspeed.c | 64 -
  4 files changed, 5 insertions(+), 72 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 26d00812ba94..85773db631c1 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -315,13 +315,6 @@ Use the more generic event ``DEVICE_UNPLUG_GUEST_ERROR`` 
instead.
  System emulator machines
  
  
-Aspeed ``swift-bmc`` machine (since 6.1)

-
-
-This machine is deprecated because we have enough AST2500 based OpenPOWER
-machines. It can be easily replaced by the ``witherspoon-bmc`` or the
-``romulus-bmc`` machines.
-
  PPC 405 ``taihu`` machine (since 7.0)
  '
  
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst

index cb0575fd4975..4b831ea29176 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -588,6 +588,11 @@ The Raspberry Pi machines come in various models (A, A+, 
B, B+). To be able
  to distinguish which model QEMU is implementing, the ``raspi2`` and ``raspi3``
  machines have been renamed ``raspi2b`` and ``raspi3b``.
  
+Aspeed ``swift-bmc`` machine (removed in 7.0)

+'
+
+This machine was removed because it was unused. Alternative AST2500 based
+OpenPOWER machines are ``witherspoon-bmc`` and ``romulus-bmc``.
  
  linux-user mode CPUs

  
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index d8b102fa0ad0..60ed94f18759 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -22,7 +22,6 @@ AST2500 SoC based machines :
  - ``romulus-bmc``  OpenPOWER Romulus POWER9 BMC
  - ``witherspoon-bmc``  OpenPOWER Witherspoon POWER9 BMC
  - ``sonorapass-bmc``   OCP SonoraPass BMC
-- ``swift-bmc``OpenPOWER Swift BMC POWER9 (to be removed in v7.0)
  - ``fp5280g2-bmc`` Inspur FP5280G2 BMC
  - ``g220a-bmc``Bytedance G220A BMC
  
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c

index d911dc904fb3..faf7a9fd6863 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -106,17 +106,6 @@ struct AspeedMachineState {
  SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |   \
  SCU_AST2500_HW_STRAP_RESERVED1)
  
-/* Swift hardware value: 0xF11AD206 */

-#define SWIFT_BMC_HW_STRAP1 (   \
-AST2500_HW_STRAP1_DEFAULTS |\
-SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE | \
-SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |\
-SCU_AST2500_HW_STRAP_UART_DEBUG |   \
-SCU_AST2500_HW_STRAP_DDR4_ENABLE |  \
-SCU_H_PLL_BYPASS_EN |   \
-SCU_AST2500_HW_STRAP_ACPI_ENABLE |  \
-SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
-
  #define G220A_BMC_HW_STRAP1 (  \
  SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE | \
  SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |\
@@ -544,35 +533,6 @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
  i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 11), "ds1338", 
0x32);
  }
  
-static void swift_bmc_i2c_init(AspeedMachineState *bmc)

-{
-AspeedSoCState *soc = >soc;
-
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 3), "pca9552", 0x60);
-
-/* The swift board expects a TMP275 but a TMP105 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "tmp105", 0x48);
-/* The swift board expects a pca9551 but a pca9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x60);
-
-/* The swift board expects an Epson RX8900 RTC but a ds1338 is compatible 
*/
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "ds1338", 0x32);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "pca9552", 0x60);
-
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 9), "tmp423", 0x4c);
-/* The swift board expects a pca9539 but a pca9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 9), "pca9552", 0x74);
-
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 10), "tmp423", 0x4c);
-/* The swift board expects a pca9539 but a pca9552 is compatible */
-

[PATCH v2 2/7] ast2600: Add Secure Boot Controller model

[Cédric Le Goater]

From: Joel Stanley 

Just a stub that indicates the system has booted in secure boot mode.
Used for testing the driver:

 https://lore.kernel.org/all/20211019080608.283324-1-j...@jms.id.au/

Signed-off-by: Joel Stanley 
[ clg: - Fixed typo
   - Adjusted Copyright dates ]
Signed-off-by: Cédric Le Goater 
---
 include/hw/arm/aspeed_soc.h  |   3 +
 include/hw/misc/aspeed_sbc.h |  32 
 hw/arm/aspeed_ast2600.c  |   9 +++
 hw/misc/aspeed_sbc.c | 141 +++
 hw/misc/meson.build  |   1 +
 5 files changed, 186 insertions(+)
 create mode 100644 include/hw/misc/aspeed_sbc.h
 create mode 100644 hw/misc/aspeed_sbc.c

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index cae9906684cb..da043dcb454d 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -24,6 +24,7 @@
 #include "hw/misc/aspeed_i3c.h"
 #include "hw/ssi/aspeed_smc.h"
 #include "hw/misc/aspeed_hace.h"
+#include "hw/misc/aspeed_sbc.h"
 #include "hw/watchdog/wdt_aspeed.h"
 #include "hw/net/ftgmac100.h"
 #include "target/arm/cpu.h"
@@ -60,6 +61,7 @@ struct AspeedSoCState {
 AspeedSMCState fmc;
 AspeedSMCState spi[ASPEED_SPIS_NUM];
 EHCISysBusState ehci[ASPEED_EHCIS_NUM];
+AspeedSBCState sbc;
 AspeedSDMCState sdmc;
 AspeedWDTState wdt[ASPEED_WDTS_NUM];
 FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
@@ -109,6 +111,7 @@ enum {
 ASPEED_DEV_SDMC,
 ASPEED_DEV_SCU,
 ASPEED_DEV_ADC,
+ASPEED_DEV_SBC,
 ASPEED_DEV_VIDEO,
 ASPEED_DEV_SRAM,
 ASPEED_DEV_SDHCI,
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
new file mode 100644
index ..651747e28f3a
--- /dev/null
+++ b/include/hw/misc/aspeed_sbc.h
@@ -0,0 +1,32 @@
+/*
+ * ASPEED Secure Boot Controller
+ *
+ * Copyright (C) 2021-2022 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ASPEED_SBC_H
+#define ASPEED_SBC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_ASPEED_SBC "aspeed.sbc"
+#define TYPE_ASPEED_AST2600_SBC TYPE_ASPEED_SBC "-ast2600"
+OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
+
+#define ASPEED_SBC_NR_REGS (0x93c >> 2)
+
+struct AspeedSBCState {
+SysBusDevice parent;
+
+MemoryRegion iomem;
+
+uint32_t regs[ASPEED_SBC_NR_REGS];
+};
+
+struct AspeedSBCClass {
+SysBusDeviceClass parent_class;
+};
+
+#endif /* _ASPEED_SBC_H_ */
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 12f6edc081fd..21cd3342c578 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -47,6 +47,7 @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
 [ASPEED_DEV_XDMA]  = 0x1E6E7000,
 [ASPEED_DEV_ADC]   = 0x1E6E9000,
 [ASPEED_DEV_DP]= 0x1E6EB000,
+[ASPEED_DEV_SBC]   = 0x1E6F2000,
 [ASPEED_DEV_VIDEO] = 0x1E70,
 [ASPEED_DEV_SDHCI] = 0x1E74,
 [ASPEED_DEV_EMMC]  = 0x1E75,
@@ -227,6 +228,8 @@ static void aspeed_soc_ast2600_init(Object *obj)
 object_initialize_child(obj, "hace", >hace, typename);
 
 object_initialize_child(obj, "i3c", >i3c, TYPE_ASPEED_I3C);
+
+object_initialize_child(obj, "sbc", >sbc, TYPE_ASPEED_SBC);
 }
 
 /*
@@ -539,6 +542,12 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, 
Error **errp)
 /* The AST2600 I3C controller has one IRQ per bus. */
 sysbus_connect_irq(SYS_BUS_DEVICE(>i3c.devices[i]), 0, irq);
 }
+
+/* Secure Boot Controller */
+if (!sysbus_realize(SYS_BUS_DEVICE(>sbc), errp)) {
+return;
+}
+sysbus_mmio_map(SYS_BUS_DEVICE(>sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
 }
 
 static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
new file mode 100644
index ..40f2a8c6312f
--- /dev/null
+++ b/hw/misc/aspeed_sbc.c
@@ -0,0 +1,141 @@
+/*
+ * ASPEED Secure Boot Controller
+ *
+ * Copyright (C) 2021-2022 IBM Corp.
+ *
+ * Joel Stanley 
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "hw/misc/aspeed_sbc.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+
+#define R_PROT  (0x000 / 4)
+#define R_STATUS(0x014 / 4)
+
+static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
+{
+AspeedSBCState *s = ASPEED_SBC(opaque);
+
+addr >>= 2;
+
+if (addr >= ASPEED_SBC_NR_REGS) {
+qemu_log_mask(LOG_GUEST_ERROR,
+  "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
+  __func__, addr << 2);
+return 0;
+}
+
+return s->regs[addr];
+}
+
+static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
+  unsigned int size)
+{
+AspeedSBCState *s = ASPEED_SBC(opaque);
+
+addr >>= 2;
+
+if (addr >= ASPEED_SBC_NR_REGS) {
+qemu_log_mask(LOG_GUEST_ERROR,
+  "%s: 

[PATCH v2 6/7] aspeed/smc: Add an address mask on segment registers

[Cédric Le Goater]

Only a limited set of bits are used for decoding the Start and End
addresses of the mapping window of a flash device.

Signed-off-by: Cédric Le Goater 
---
 include/hw/ssi/aspeed_smc.h |  1 +
 hw/ssi/aspeed_smc.c | 11 +++
 2 files changed, 12 insertions(+)

diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
index e2681996..cad73ddc13f2 100644
--- a/include/hw/ssi/aspeed_smc.h
+++ b/include/hw/ssi/aspeed_smc.h
@@ -99,6 +99,7 @@ struct AspeedSMCClass {
 uint8_t max_peripherals;
 const uint32_t *resets;
 const AspeedSegments *segments;
+uint32_t segment_addr_mask;
 hwaddr flash_window_base;
 uint32_t flash_window_size;
 uint32_t features;
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index ff154eb84f85..d899be17fd71 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -259,6 +259,10 @@ static void 
aspeed_smc_flash_set_segment_region(AspeedSMCState *s, int cs,
 memory_region_set_enabled(>mmio, !!seg.size);
 memory_region_transaction_commit();
 
+if (asc->segment_addr_mask) {
+regval &= asc->segment_addr_mask;
+}
+
 s->regs[R_SEG_ADDR0 + cs] = regval;
 }
 
@@ -1364,6 +1368,7 @@ static void aspeed_2400_fmc_class_init(ObjectClass 
*klass, void *data)
 asc->conf_enable_w0= CONF_ENABLE_W0;
 asc->max_peripherals   = 5;
 asc->segments  = aspeed_2400_fmc_segments;
+asc->segment_addr_mask = 0x;
 asc->resets= aspeed_2400_fmc_resets;
 asc->flash_window_base = 0x2000;
 asc->flash_window_size = 0x1000;
@@ -1446,6 +1451,7 @@ static void aspeed_2500_fmc_class_init(ObjectClass 
*klass, void *data)
 asc->conf_enable_w0= CONF_ENABLE_W0;
 asc->max_peripherals   = 3;
 asc->segments  = aspeed_2500_fmc_segments;
+asc->segment_addr_mask = 0x;
 asc->resets= aspeed_2500_fmc_resets;
 asc->flash_window_base = 0x2000;
 asc->flash_window_size = 0x1000;
@@ -1483,6 +1489,7 @@ static void aspeed_2500_spi1_class_init(ObjectClass 
*klass, void *data)
 asc->conf_enable_w0= CONF_ENABLE_W0;
 asc->max_peripherals   = 2;
 asc->segments  = aspeed_2500_spi1_segments;
+asc->segment_addr_mask = 0x;
 asc->flash_window_base = 0x3000;
 asc->flash_window_size = 0x800;
 asc->features  = 0x0;
@@ -1517,6 +1524,7 @@ static void aspeed_2500_spi2_class_init(ObjectClass 
*klass, void *data)
 asc->conf_enable_w0= CONF_ENABLE_W0;
 asc->max_peripherals   = 2;
 asc->segments  = aspeed_2500_spi2_segments;
+asc->segment_addr_mask = 0x;
 asc->flash_window_base = 0x3800;
 asc->flash_window_size = 0x800;
 asc->features  = 0x0;
@@ -1598,6 +1606,7 @@ static void aspeed_2600_fmc_class_init(ObjectClass 
*klass, void *data)
 asc->conf_enable_w0= CONF_ENABLE_W0;
 asc->max_peripherals   = 3;
 asc->segments  = aspeed_2600_fmc_segments;
+asc->segment_addr_mask = 0x0ff00ff0;
 asc->resets= aspeed_2600_fmc_resets;
 asc->flash_window_base = 0x2000;
 asc->flash_window_size = 0x1000;
@@ -1636,6 +1645,7 @@ static void aspeed_2600_spi1_class_init(ObjectClass 
*klass, void *data)
 asc->conf_enable_w0= CONF_ENABLE_W0;
 asc->max_peripherals   = 2;
 asc->segments  = aspeed_2600_spi1_segments;
+asc->segment_addr_mask = 0x0ff00ff0;
 asc->flash_window_base = 0x3000;
 asc->flash_window_size = 0x1000;
 asc->features  = ASPEED_SMC_FEATURE_DMA |
@@ -1674,6 +1684,7 @@ static void aspeed_2600_spi2_class_init(ObjectClass 
*klass, void *data)
 asc->conf_enable_w0= CONF_ENABLE_W0;
 asc->max_peripherals   = 3;
 asc->segments  = aspeed_2600_spi2_segments;
+asc->segment_addr_mask = 0x0ff00ff0;
 asc->flash_window_base = 0x5000;
 asc->flash_window_size = 0x1000;
 asc->features  = ASPEED_SMC_FEATURE_DMA |
-- 
2.34.1

Re: [PATCH v5 00/15] hw/nvme: SR-IOV with Virtualization Enhancements

[Michael S. Tsirkin]

On Thu, Feb 17, 2022 at 06:44:49PM +0100, Lukasz Maniak wrote:
> Changes since v4:
> - Added hello world example for SR-IOV to the docs
> - Moved AER initialization from nvme_init_ctrl to nvme_init_state
> - Fixed division by zero issue in calculation of vqfrt and vifrt
>   capabilities


So do you want to merge it all with nvme bits? which tree is this for?
Or would you like me to merge the pci bits for now?
Thanks!

> Knut Omang (2):
>   pcie: Add support for Single Root I/O Virtualization (SR/IOV)
>   pcie: Add some SR/IOV API documentation in docs/pcie_sriov.txt
> 
> Lukasz Maniak (4):
>   hw/nvme: Add support for SR-IOV
>   hw/nvme: Add support for Primary Controller Capabilities
>   hw/nvme: Add support for Secondary Controller List
>   docs: Add documentation for SR-IOV and Virtualization Enhancements
> 
> Łukasz Gieryk (9):
>   pcie: Add a helper to the SR/IOV API
>   pcie: Add 1.2 version token for the Power Management Capability
>   hw/nvme: Implement the Function Level Reset
>   hw/nvme: Make max_ioqpairs and msix_qsize configurable in runtime
>   hw/nvme: Remove reg_size variable and update BAR0 size calculation
>   hw/nvme: Calculate BAR attributes in a function
>   hw/nvme: Initialize capability structures for primary/secondary
> controllers
>   hw/nvme: Add support for the Virtualization Management command
>   hw/nvme: Update the initalization place for the AER queue
> 
>  docs/pcie_sriov.txt  | 115 ++
>  docs/system/devices/nvme.rst |  82 +
>  hw/nvme/ctrl.c   | 674 ---
>  hw/nvme/ns.c |   2 +-
>  hw/nvme/nvme.h   |  55 ++-
>  hw/nvme/subsys.c |  75 +++-
>  hw/nvme/trace-events |   6 +
>  hw/pci/meson.build   |   1 +
>  hw/pci/pci.c | 100 --
>  hw/pci/pcie.c|   5 +
>  hw/pci/pcie_sriov.c  | 302 
>  hw/pci/trace-events  |   5 +
>  include/block/nvme.h |  65 
>  include/hw/pci/pci.h |  12 +-
>  include/hw/pci/pci_ids.h |   1 +
>  include/hw/pci/pci_regs.h|   1 +
>  include/hw/pci/pcie.h|   6 +
>  include/hw/pci/pcie_sriov.h  |  77 
>  include/qemu/typedefs.h  |   2 +
>  19 files changed, 1505 insertions(+), 81 deletions(-)
>  create mode 100644 docs/pcie_sriov.txt
>  create mode 100644 hw/pci/pcie_sriov.c
>  create mode 100644 include/hw/pci/pcie_sriov.h
> 
> -- 
> 2.25.1
> 
> 
> 

Re: [PATCH v5 00/15] hw/nvme: SR-IOV with Virtualization Enhancements

[Klaus Jensen]

On Feb 18 03:26, Michael S. Tsirkin wrote:
> On Thu, Feb 17, 2022 at 06:44:49PM +0100, Lukasz Maniak wrote:
> > Changes since v4:
> > - Added hello world example for SR-IOV to the docs
> > - Moved AER initialization from nvme_init_ctrl to nvme_init_state
> > - Fixed division by zero issue in calculation of vqfrt and vifrt
> >   capabilities
> 
> 
> So do you want to merge it all with nvme bits? which tree is this for?
> Or would you like me to merge the pci bits for now?
> Thanks!
> 

I was wondering how to approach that as well. I think maybe it could all
go through your tree so the pcie bits doesnt just sit their without
being used by anything? It's up to you, but note that nvme bits are not
fully reviewed yet.

If you are fine with merging the pcie bits then lets do that and we
merge the nvme bits through the nvme tree. The nvme bits is fully acked,
so it will go in, just need to finalize the reviews.


signature.asc
Description: PGP signature

[PATCH v2 7/7] aspeed/sdmc: Add trace events

[Cédric Le Goater]

This is useful to analyze changes in the U-Boot RAM driver when SDRAM
training is performed.

Signed-off-by: Cédric Le Goater 
---
 hw/misc/aspeed_sdmc.c | 2 ++
 hw/misc/trace-events  | 4 
 2 files changed, 6 insertions(+)

diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index 08f856cbda7e..d2a3931033b3 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -130,6 +130,7 @@ static uint64_t aspeed_sdmc_read(void *opaque, hwaddr addr, 
unsigned size)
 return 0;
 }
 
+trace_aspeed_sdmc_read(addr, s->regs[addr]);
 return s->regs[addr];
 }
 
@@ -148,6 +149,7 @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, 
uint64_t data,
 return;
 }
 
+trace_aspeed_sdmc_write(addr, data);
 asc->write(s, addr, data);
 }
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index 1c373dd0a4c5..c3fc9fecbe34 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -205,6 +205,10 @@ aspeed_i3c_write(uint64_t offset, uint64_t data) "I3C 
write: offset 0x%" PRIx64
 aspeed_i3c_device_read(uint32_t deviceid, uint64_t offset, uint64_t data) "I3C 
Dev[%u] read: offset 0x%" PRIx64 " data 0x%" PRIx64
 aspeed_i3c_device_write(uint32_t deviceid, uint64_t offset, uint64_t data) 
"I3C Dev[%u] write: offset 0x%" PRIx64 " data 0x%" PRIx64
 
+# aspeed_sdmc.c
+aspeed_sdmc_write(uint32_t reg, uint32_t data) "reg @0x%" PRIx32 " data: 0x%" 
PRIx32
+aspeed_sdmc_read(uint32_t reg, uint32_t data) "reg @0x%" PRIx32 " data: 0x%" 
PRIx32
+
 # bcm2835_property.c
 bcm2835_mbox_property(uint32_t tag, uint32_t bufsize, size_t resplen) "mbox 
property tag:0x%08x in_sz:%u out_sz:%zu"
 
-- 
2.34.1

Re: [PATCH v5 03/15] pcie: Add a helper to the SR/IOV API

[Michael S. Tsirkin]

On Thu, Feb 17, 2022 at 06:44:52PM +0100, Lukasz Maniak wrote:
> From: Łukasz Gieryk 
> 
> Convenience function for retrieving the PCIDevice object of the N-th VF.
> 
> Signed-off-by: Łukasz Gieryk 
> Reviewed-by: Knut Omang 

Reviewed-by: Michael S. Tsirkin 

> ---
>  hw/pci/pcie_sriov.c | 10 +-
>  include/hw/pci/pcie_sriov.h |  6 ++
>  2 files changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> index 3f256d483fa..87abad6ac86 100644
> --- a/hw/pci/pcie_sriov.c
> +++ b/hw/pci/pcie_sriov.c
> @@ -287,8 +287,16 @@ uint16_t pcie_sriov_vf_number(PCIDevice *dev)
>  return dev->exp.sriov_vf.vf_number;
>  }
>  
> -
>  PCIDevice *pcie_sriov_get_pf(PCIDevice *dev)
>  {
>  return dev->exp.sriov_vf.pf;
>  }
> +
> +PCIDevice *pcie_sriov_get_vf_at_index(PCIDevice *dev, int n)
> +{
> +assert(!pci_is_vf(dev));
> +if (n < dev->exp.sriov_pf.num_vfs) {
> +return dev->exp.sriov_pf.vf[n];
> +}
> +return NULL;
> +}
> diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> index 990cff0a1c6..80f5c84e75c 100644
> --- a/include/hw/pci/pcie_sriov.h
> +++ b/include/hw/pci/pcie_sriov.h
> @@ -68,4 +68,10 @@ uint16_t pcie_sriov_vf_number(PCIDevice *dev);
>   */
>  PCIDevice *pcie_sriov_get_pf(PCIDevice *dev);
>  
> +/*
> + * Get the n-th VF of this physical function - only valid for PF.
> + * Returns NULL if index is invalid
> + */
> +PCIDevice *pcie_sriov_get_vf_at_index(PCIDevice *dev, int n);
> +
>  #endif /* QEMU_PCIE_SRIOV_H */
> -- 
> 2.25.1

[PATCH v2 1/7] arm: Remove swift-bmc machine

[Cédric Le Goater]

From: Joel Stanley 

It was scheduled for removal in 7.0.

Signed-off-by: Joel Stanley 
Reviewed-by: Cédric Le Goater 
Message-Id: <20220217103141.385345-1-j...@jms.id.au>
Signed-off-by: Cédric Le Goater 
---
 docs/about/deprecated.rst   |  7 
 docs/about/removed-features.rst |  5 +++
 docs/system/arm/aspeed.rst  |  1 -
 hw/arm/aspeed.c | 64 -
 4 files changed, 5 insertions(+), 72 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 26d00812ba94..85773db631c1 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -315,13 +315,6 @@ Use the more generic event ``DEVICE_UNPLUG_GUEST_ERROR`` 
instead.
 System emulator machines
 
 
-Aspeed ``swift-bmc`` machine (since 6.1)
-
-
-This machine is deprecated because we have enough AST2500 based OpenPOWER
-machines. It can be easily replaced by the ``witherspoon-bmc`` or the
-``romulus-bmc`` machines.
-
 PPC 405 ``taihu`` machine (since 7.0)
 '
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index cb0575fd4975..4b831ea29176 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -588,6 +588,11 @@ The Raspberry Pi machines come in various models (A, A+, 
B, B+). To be able
 to distinguish which model QEMU is implementing, the ``raspi2`` and ``raspi3``
 machines have been renamed ``raspi2b`` and ``raspi3b``.
 
+Aspeed ``swift-bmc`` machine (removed in 7.0)
+'
+
+This machine was removed because it was unused. Alternative AST2500 based
+OpenPOWER machines are ``witherspoon-bmc`` and ``romulus-bmc``.
 
 linux-user mode CPUs
 
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index d8b102fa0ad0..60ed94f18759 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -22,7 +22,6 @@ AST2500 SoC based machines :
 - ``romulus-bmc``  OpenPOWER Romulus POWER9 BMC
 - ``witherspoon-bmc``  OpenPOWER Witherspoon POWER9 BMC
 - ``sonorapass-bmc``   OCP SonoraPass BMC
-- ``swift-bmc``OpenPOWER Swift BMC POWER9 (to be removed in v7.0)
 - ``fp5280g2-bmc`` Inspur FP5280G2 BMC
 - ``g220a-bmc``Bytedance G220A BMC
 
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index d911dc904fb3..faf7a9fd6863 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -106,17 +106,6 @@ struct AspeedMachineState {
 SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |   \
 SCU_AST2500_HW_STRAP_RESERVED1)
 
-/* Swift hardware value: 0xF11AD206 */
-#define SWIFT_BMC_HW_STRAP1 (   \
-AST2500_HW_STRAP1_DEFAULTS |\
-SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE | \
-SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |\
-SCU_AST2500_HW_STRAP_UART_DEBUG |   \
-SCU_AST2500_HW_STRAP_DDR4_ENABLE |  \
-SCU_H_PLL_BYPASS_EN |   \
-SCU_AST2500_HW_STRAP_ACPI_ENABLE |  \
-SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
-
 #define G220A_BMC_HW_STRAP1 (  \
 SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE | \
 SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |\
@@ -544,35 +533,6 @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 11), "ds1338", 0x32);
 }
 
-static void swift_bmc_i2c_init(AspeedMachineState *bmc)
-{
-AspeedSoCState *soc = >soc;
-
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 3), "pca9552", 0x60);
-
-/* The swift board expects a TMP275 but a TMP105 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "tmp105", 0x48);
-/* The swift board expects a pca9551 but a pca9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x60);
-
-/* The swift board expects an Epson RX8900 RTC but a ds1338 is compatible 
*/
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "ds1338", 0x32);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "pca9552", 0x60);
-
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 9), "tmp423", 0x4c);
-/* The swift board expects a pca9539 but a pca9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 9), "pca9552", 0x74);
-
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 10), "tmp423", 0x4c);
-/* The swift board expects a pca9539 but a pca9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 10), "pca9552",
- 0x74);
-
-/* The swift board expects a TMP275 but a 

Re: [PATCH v5 01/15] pcie: Add support for Single Root I/O Virtualization (SR/IOV)

[Michael S. Tsirkin]

On Thu, Feb 17, 2022 at 06:44:50PM +0100, Lukasz Maniak wrote:
> From: Knut Omang 
> 
> This patch provides the building blocks for creating an SR/IOV
> PCIe Extended Capability header and register/unregister
> SR/IOV Virtual Functions.
> 
> Signed-off-by: Knut Omang 

Reviewed-by: Michael S. Tsirkin 

> ---
>  hw/pci/meson.build  |   1 +
>  hw/pci/pci.c| 100 +---
>  hw/pci/pcie.c   |   5 +
>  hw/pci/pcie_sriov.c | 294 
>  hw/pci/trace-events |   5 +
>  include/hw/pci/pci.h|  12 +-
>  include/hw/pci/pcie.h   |   6 +
>  include/hw/pci/pcie_sriov.h |  71 +
>  include/qemu/typedefs.h |   2 +
>  9 files changed, 470 insertions(+), 26 deletions(-)
>  create mode 100644 hw/pci/pcie_sriov.c
>  create mode 100644 include/hw/pci/pcie_sriov.h
> 
> diff --git a/hw/pci/meson.build b/hw/pci/meson.build
> index 5c4bbac8171..bcc9c75919f 100644
> --- a/hw/pci/meson.build
> +++ b/hw/pci/meson.build
> @@ -5,6 +5,7 @@ pci_ss.add(files(
>'pci.c',
>'pci_bridge.c',
>'pci_host.c',
> +  'pcie_sriov.c',
>'shpc.c',
>'slotid_cap.c'
>  ))
> diff --git a/hw/pci/pci.c b/hw/pci/pci.c
> index 5d30f9ca60e..ba8fb92efc6 100644
> --- a/hw/pci/pci.c
> +++ b/hw/pci/pci.c
> @@ -239,6 +239,9 @@ int pci_bar(PCIDevice *d, int reg)
>  {
>  uint8_t type;
>  
> +/* PCIe virtual functions do not have their own BARs */
> +assert(!pci_is_vf(d));
> +
>  if (reg != PCI_ROM_SLOT)
>  return PCI_BASE_ADDRESS_0 + reg * 4;
>  
> @@ -304,10 +307,30 @@ void pci_device_deassert_intx(PCIDevice *dev)
>  }
>  }
>  
> -static void pci_do_device_reset(PCIDevice *dev)
> +static void pci_reset_regions(PCIDevice *dev)
>  {
>  int r;
> +if (pci_is_vf(dev)) {
> +return;
> +}
> +
> +for (r = 0; r < PCI_NUM_REGIONS; ++r) {
> +PCIIORegion *region = >io_regions[r];
> +if (!region->size) {
> +continue;
> +}
>  
> +if (!(region->type & PCI_BASE_ADDRESS_SPACE_IO) &&
> +region->type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
> +pci_set_quad(dev->config + pci_bar(dev, r), region->type);
> +} else {
> +pci_set_long(dev->config + pci_bar(dev, r), region->type);
> +}
> +}
> +}
> +
> +static void pci_do_device_reset(PCIDevice *dev)
> +{
>  pci_device_deassert_intx(dev);
>  assert(dev->irq_state == 0);
>  
> @@ -323,19 +346,7 @@ static void pci_do_device_reset(PCIDevice *dev)
>pci_get_word(dev->wmask + PCI_INTERRUPT_LINE) |
>pci_get_word(dev->w1cmask + 
> PCI_INTERRUPT_LINE));
>  dev->config[PCI_CACHE_LINE_SIZE] = 0x0;
> -for (r = 0; r < PCI_NUM_REGIONS; ++r) {
> -PCIIORegion *region = >io_regions[r];
> -if (!region->size) {
> -continue;
> -}
> -
> -if (!(region->type & PCI_BASE_ADDRESS_SPACE_IO) &&
> -region->type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
> -pci_set_quad(dev->config + pci_bar(dev, r), region->type);
> -} else {
> -pci_set_long(dev->config + pci_bar(dev, r), region->type);
> -}
> -}
> +pci_reset_regions(dev);
>  pci_update_mappings(dev);
>  
>  msi_reset(dev);
> @@ -884,6 +895,16 @@ static void pci_init_multifunction(PCIBus *bus, 
> PCIDevice *dev, Error **errp)
>  dev->config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
>  }
>  
> +/*
> + * With SR/IOV and ARI, a device at function 0 need not be a 
> multifunction
> + * device, as it may just be a VF that ended up with function 0 in
> + * the legacy PCI interpretation. Avoid failing in such cases:
> + */
> +if (pci_is_vf(dev) &&
> +dev->exp.sriov_vf.pf->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
> +return;
> +}
> +
>  /*
>   * multifunction bit is interpreted in two ways as follows.
>   *   - all functions must set the bit to 1.
> @@ -1083,6 +1104,7 @@ static PCIDevice *do_pci_register_device(PCIDevice 
> *pci_dev,
> bus->devices[devfn]->name);
>  return NULL;
>  } else if (dev->hotplugged &&
> +   !pci_is_vf(pci_dev) &&
> pci_get_function_0(pci_dev)) {
>  error_setg(errp, "PCI: slot %d function 0 already occupied by %s,"
> " new func %s cannot be exposed to guest.",
> @@ -1191,6 +1213,7 @@ void pci_register_bar(PCIDevice *pci_dev, int 
> region_num,
>  pcibus_t size = memory_region_size(memory);
>  uint8_t hdr_type;
>  
> +assert(!pci_is_vf(pci_dev)); /* VFs must use pcie_sriov_vf_register_bar 
> */
>  assert(region_num >= 0);
>  assert(region_num < PCI_NUM_REGIONS);
>  assert(is_power_of_2(size));
> @@ -1294,11 +1317,45 @@ pcibus_t pci_get_bar_addr(PCIDevice *pci_dev, int 
> region_num)
>  return pci_dev->io_regions[region_num].addr;
>  }
>  
> -static pcibus_t 

[PATCH v2 0/7] aspeed extensions

[Cédric Le Goater]

Hi,

Here is a set of extensions for the Aspeed machines, the most
important ones being the removal of a deprecated machine and a simple
model for the Secure Boot Controller, both from Joel.

Thanks,

C. 

Changes in v2:

 - new create_pca9552() helper (Philippe)
 - fixed typos
 - fixed removal of the swift machine

Cédric Le Goater (3):
  aspeed: Introduce a create_pca9552() helper
  aspeed/smc: Add an address mask on segment registers
  aspeed/sdmc: Add trace events

Joel Stanley (4):
  arm: Remove swift-bmc machine
  ast2600: Add Secure Boot Controller model
  aspeed: rainier: Add i2c LED devices
  aspeed: rainier: Add strap values taken from hardware

 docs/about/deprecated.rst   |   7 --
 docs/about/removed-features.rst |   5 ++
 docs/system/arm/aspeed.rst  |   1 -
 include/hw/arm/aspeed_soc.h |   3 +
 include/hw/misc/aspeed_sbc.h|  32 
 include/hw/ssi/aspeed_smc.h |   1 +
 hw/arm/aspeed.c |  98 ++
 hw/arm/aspeed_ast2600.c |   9 ++
 hw/misc/aspeed_sbc.c| 141 
 hw/misc/aspeed_sdmc.c   |   2 +
 hw/ssi/aspeed_smc.c |  11 +++
 hw/misc/meson.build |   1 +
 hw/misc/trace-events|   4 +
 13 files changed, 236 insertions(+), 79 deletions(-)
 create mode 100644 include/hw/misc/aspeed_sbc.h
 create mode 100644 hw/misc/aspeed_sbc.c

-- 
2.34.1

[PATCH v2 3/7] aspeed: rainier: Add i2c LED devices

[Cédric Le Goater]

From: Joel Stanley 

This helps quieten booting the current Rainier kernel.

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Joel Stanley 
Signed-off-by: Cédric Le Goater 
---
 hw/arm/aspeed.c | 15 +++
 1 file changed, 15 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index faf7a9fd6863..7590b36bb017 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -712,6 +712,8 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 
 aspeed_eeprom_init(aspeed_i2c_get_bus(>i2c, 0), 0x51, 32 * KiB);
 
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 3), "pca9552", 0x61);
+
 /* The rainier expects a TMP275 but a TMP105 is compatible */
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 4), TYPE_TMP105,
  0x48);
@@ -724,11 +726,14 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x52, 64 * KiB);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 4), "pca9552", 0x60);
 
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), TYPE_TMP105,
  0x48);
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), TYPE_TMP105,
  0x49);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), "pca9552", 0x60);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), "pca9552", 0x61);
 i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5),
   "pca9546", 0x70);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
@@ -747,7 +752,12 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x50, 64 * KiB);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 3), 0x51, 64 * KiB);
 
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x30);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x31);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x32);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x33);
 /* Bus 7: TODO max31785@52 */
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x60);
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x61);
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "dps310", 0x76);
 /* Bus 7: TODO si7021-a20@20 */
@@ -762,6 +772,7 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
  0x4a);
 aspeed_eeprom_init(aspeed_i2c_get_bus(>i2c, 8), 0x50, 64 * KiB);
 aspeed_eeprom_init(aspeed_i2c_get_bus(>i2c, 8), 0x51, 64 * KiB);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "pca9552", 0x60);
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "pca9552", 0x61);
 /* Bus 8: ucd90320@11 */
 /* Bus 8: ucd90320@b */
@@ -783,13 +794,17 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
   "pca9546", 0x70);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 11), "pca9552", 
0x60);
 
 
 aspeed_eeprom_init(aspeed_i2c_get_bus(>i2c, 13), 0x50, 64 * KiB);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 13), "pca9552", 
0x60);
 
 aspeed_eeprom_init(aspeed_i2c_get_bus(>i2c, 14), 0x50, 64 * KiB);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 14), "pca9552", 
0x60);
 
 aspeed_eeprom_init(aspeed_i2c_get_bus(>i2c, 15), 0x50, 64 * KiB);
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 15), "pca9552", 
0x60);
 }
 
 static void get_pca9548_channels(I2CBus *bus, uint8_t mux_addr,
-- 
2.34.1

[PATCH v2 5/7] aspeed: Introduce a create_pca9552() helper

[Cédric Le Goater]

This unifies the way we create the pca9552 devices on the different boards.

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Cédric Le Goater 
---
 hw/arm/aspeed.c | 49 +++--
 1 file changed, 27 insertions(+), 22 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index f71a5d87473f..11558b327bc9 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -533,6 +533,12 @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 11), "ds1338", 0x32);
 }
 
+static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
+{
+i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, bus_id),
+TYPE_PCA9552, addr);
+}
+
 static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
 {
 AspeedSoCState *soc = >soc;
@@ -549,9 +555,9 @@ static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
 smbus_eeprom_init_one(aspeed_i2c_get_bus(>i2c, 4), 0x54,
   eeprom4_54);
 /* PCA9539 @ 0x76, but PCA9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 4), "pca9552", 0x76);
+create_pca9552(soc, 4, 0x76);
 /* PCA9539 @ 0x77, but PCA9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 4), "pca9552", 0x77);
+create_pca9552(soc, 4, 0x77);
 
 /* bus 6 : */
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 6), "tmp105", 0x48);
@@ -562,8 +568,8 @@ static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
 uint8_t *eeprom8_56 = g_malloc0(8 * 1024);
 smbus_eeprom_init_one(aspeed_i2c_get_bus(>i2c, 8), 0x56,
   eeprom8_56);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "pca9552", 0x60);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), "pca9552", 0x61);
+create_pca9552(soc, 8, 0x60);
+create_pca9552(soc, 8, 0x61);
 /* bus 8 : adc128d818 @ 0x1d */
 /* bus 8 : adc128d818 @ 0x1f */
 
@@ -701,8 +707,7 @@ static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 4), "ds1338", 0x68);
 
 /* It expects a pca9555 but a pca9552 is compatible */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 8), TYPE_PCA9552,
- 0x20);
+create_pca9552(soc, 8, 0x30);
 }
 
 static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
@@ -712,7 +717,7 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 
 aspeed_eeprom_init(aspeed_i2c_get_bus(>i2c, 0), 0x51, 32 * KiB);
 
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 3), "pca9552", 0x61);
+create_pca9552(soc, 3, 0x61);
 
 /* The rainier expects a TMP275 but a TMP105 is compatible */
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 4), TYPE_TMP105,
@@ -726,14 +731,14 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x52, 64 * KiB);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 4), "pca9552", 0x60);
+create_pca9552(soc, 4, 0x60);
 
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), TYPE_TMP105,
  0x48);
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), TYPE_TMP105,
  0x49);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), "pca9552", 0x60);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5), "pca9552", 0x61);
+create_pca9552(soc, 5, 0x60);
+create_pca9552(soc, 5, 0x61);
 i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 5),
   "pca9546", 0x70);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
@@ -752,13 +757,13 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x50, 64 * KiB);
 aspeed_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 3), 0x51, 64 * KiB);
 
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x30);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x31);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x32);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x33);
+create_pca9552(soc, 7, 0x30);
+create_pca9552(soc, 7, 0x31);
+create_pca9552(soc, 7, 0x32);
+create_pca9552(soc, 7, 0x33);
 /* Bus 7: TODO max31785@52 */
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x60);
-i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "pca9552", 0x61);
+create_pca9552(soc, 7, 0x60);
+create_pca9552(soc, 7, 0x61);
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), "dps310", 0x76);
 /* Bus 7: TODO si7021-a20@20 */
 i2c_slave_create_simple(aspeed_i2c_get_bus(>i2c, 7), TYPE_TMP105,
@@ -772,8 +777,8 @@ static void 

Re: [PATCH v5 02/15] pcie: Add some SR/IOV API documentation in docs/pcie_sriov.txt

[Michael S. Tsirkin]

On Thu, Feb 17, 2022 at 06:44:51PM +0100, Lukasz Maniak wrote:
> From: Knut Omang 
> 
> Add a small intro + minimal documentation for how to
> implement SR/IOV support for an emulated device.
> 
> Signed-off-by: Knut Omang 

Reviewed-by: Michael S. Tsirkin 

> ---
>  docs/pcie_sriov.txt | 115 
>  1 file changed, 115 insertions(+)
>  create mode 100644 docs/pcie_sriov.txt
> 
> diff --git a/docs/pcie_sriov.txt b/docs/pcie_sriov.txt
> new file mode 100644
> index 000..f5e891e1d45
> --- /dev/null
> +++ b/docs/pcie_sriov.txt
> @@ -0,0 +1,115 @@
> +PCI SR/IOV EMULATION SUPPORT
> +
> +
> +Description
> +===
> +SR/IOV (Single Root I/O Virtualization) is an optional extended capability
> +of a PCI Express device. It allows a single physical function (PF) to appear 
> as multiple
> +virtual functions (VFs) for the main purpose of eliminating software
> +overhead in I/O from virtual machines.
> +
> +Qemu now implements the basic common functionality to enable an emulated 
> device
> +to support SR/IOV. Yet no fully implemented devices exists in Qemu, but a
> +proof-of-concept hack of the Intel igb can be found here:
> +
> +git://github.com/knuto/qemu.git sriov_patches_v5
> +
> +Implementation
> +==
> +Implementing emulation of an SR/IOV capable device typically consists of
> +implementing support for two types of device classes; the "normal" physical 
> device
> +(PF) and the virtual device (VF). From Qemu's perspective, the VFs are just
> +like other devices, except that some of their properties are derived from
> +the PF.
> +
> +A virtual function is different from a physical function in that the BAR
> +space for all VFs are defined by the BAR registers in the PFs SR/IOV
> +capability. All VFs have the same BARs and BAR sizes.
> +
> +Accesses to these virtual BARs then is computed as
> +
> ++  *  + 
> +
> +From our emulation perspective this means that there is a separate call for
> +setting up a BAR for a VF.
> +
> +1) To enable SR/IOV support in the PF, it must be a PCI Express device so
> +   you would need to add a PCI Express capability in the normal PCI
> +   capability list. You might also want to add an ARI (Alternative
> +   Routing-ID Interpretation) capability to indicate that your device
> +   supports functions beyond it's "own" function space (0-7),
> +   which is necessary to support more than 7 functions, or
> +   if functions extends beyond offset 7 because they are placed at an
> +   offset > 1 or have stride > 1.
> +
> +   ...
> +   #include "hw/pci/pcie.h"
> +   #include "hw/pci/pcie_sriov.h"
> +
> +   pci_your_pf_dev_realize( ... )
> +   {
> +  ...
> +  int ret = pcie_endpoint_cap_init(d, 0x70);
> +  ...
> +  pcie_ari_init(d, 0x100, 1);
> +  ...
> +
> +  /* Add and initialize the SR/IOV capability */
> +  pcie_sriov_pf_init(d, 0x200, "your_virtual_dev",
> +   vf_devid, initial_vfs, total_vfs,
> +   fun_offset, stride);
> +
> +  /* Set up individual VF BARs (parameters as for normal BARs) */
> +  pcie_sriov_pf_init_vf_bar( ... )
> +  ...
> +   }
> +
> +   For cleanup, you simply call:
> +
> +  pcie_sriov_pf_exit(device);
> +
> +   which will delete all the virtual functions and associated resources.
> +
> +2) Similarly in the implementation of the virtual function, you need to
> +   make it a PCI Express device and add a similar set of capabilities
> +   except for the SR/IOV capability. Then you need to set up the VF BARs as
> +   subregions of the PFs SR/IOV VF BARs by calling
> +   pcie_sriov_vf_register_bar() instead of the normal pci_register_bar() 
> call:
> +
> +   pci_your_vf_dev_realize( ... )
> +   {
> +  ...
> +  int ret = pcie_endpoint_cap_init(d, 0x60);
> +  ...
> +  pcie_ari_init(d, 0x100, 1);
> +  ...
> +  memory_region_init(mr, ... )
> +  pcie_sriov_vf_register_bar(d, bar_nr, mr);
> +  ...
> +   }
> +
> +Testing on Linux guest
> +==
> +The easiest is if your device driver supports sysfs based SR/IOV
> +enabling. Support for this was added in kernel v.3.8, so not all drivers
> +support it yet.
> +
> +To enable 4 VFs for a device at 01:00.0:
> +
> + modprobe yourdriver
> + echo 4 > /sys/bus/pci/devices/:01:00.0/sriov_numvfs
> +
> +You should now see 4 VFs with lspci.
> +To turn SR/IOV off again - the standard requires you to turn it off before 
> you can enable
> +another VF count, and the emulation enforces this:
> +
> + echo 0 > /sys/bus/pci/devices/:01:00.0/sriov_numvfs
> +
> +Older drivers typically provide a max_vfs module parameter
> +to enable it at load time:
> +
> + modprobe yourdriver max_vfs=4
> +
> +To disable the VFs again then, you simply have to unload the driver:
> +
> + rmmod yourdriver
> -- 
> 2.25.1

Re: [PATCH v5 04/15] pcie: Add 1.2 version token for the Power Management Capability

[Michael S. Tsirkin]

On Thu, Feb 17, 2022 at 06:44:53PM +0100, Lukasz Maniak wrote:
> From: Łukasz Gieryk 
> 
> Signed-off-by: Łukasz Gieryk 

Reviewed-by: Michael S. Tsirkin 

> ---
>  include/hw/pci/pci_regs.h | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/include/hw/pci/pci_regs.h b/include/hw/pci/pci_regs.h
> index 77ba64b9314..a5901409622 100644
> --- a/include/hw/pci/pci_regs.h
> +++ b/include/hw/pci/pci_regs.h
> @@ -4,5 +4,6 @@
>  #include "standard-headers/linux/pci_regs.h"
>  
>  #define  PCI_PM_CAP_VER_1_1 0x0002  /* PCI PM spec ver. 1.1 */
> +#define  PCI_PM_CAP_VER_1_2 0x0003  /* PCI PM spec ver. 1.2 */
>  
>  #endif
> -- 
> 2.25.1

Re: [PATCH V7 28/29] chardev: cpr for sockets

[Guoyi Tu]

On Wed, 2021-12-22 at 11:05 -0800, Steve Sistare wrote:
> Save accepted socket fds before cpr-save, and look for them after
> cpr-load.
> in the environment after cpr-load.  Reject cpr-exec if a socket
> enables
> the TLS or websocket option.  Allow a monitor socket by closing it on
> exec.
> 
> Signed-off-by: Mark Kanda 
> Signed-off-by: Steve Sistare 
> ---
>  chardev/char-socket.c | 35 +++
>  monitor/hmp.c |  3 +++
>  monitor/qmp.c |  3 +++
>  3 files changed, 41 insertions(+)
> 
> diff --git a/chardev/char-socket.c b/chardev/char-socket.c
> index d619088..c111e17 100644
> --- a/chardev/char-socket.c
> +++ b/chardev/char-socket.c
> @@ -26,6 +26,7 @@
>  #include "chardev/char.h"
>  #include "io/channel-socket.h"
>  #include "io/channel-websock.h"
> +#include "migration/cpr.h"
>  #include "qemu/error-report.h"
>  #include "qemu/module.h"
>  #include "qemu/option.h"
> @@ -358,6 +359,10 @@ static void tcp_chr_free_connection(Chardev
> *chr)
>  SocketChardev *s = SOCKET_CHARDEV(chr);
>  int i;
>  
> +if (!chr->reopen_on_cpr) {
> +cpr_delete_fd(chr->label, 0);
> +}
> +
>  if (s->read_msgfds_num) {
>  for (i = 0; i < s->read_msgfds_num; i++) {
>  close(s->read_msgfds[i]);
> @@ -920,6 +925,10 @@ static void tcp_chr_accept(QIONetListener
> *listener,
> QIO_CHANNEL(cioc));
>  }
>  tcp_chr_new_client(chr, cioc);
> +
> +if (s->sioc && !chr->reopen_on_cpr) {

Is it necessary check if the device has QEMU_CHAR_FEATURE_CPR feature
here? In my opinion, fd should not be saved if device don't support
cpr.

> +cpr_save_fd(chr->label, 0, s->sioc->fd);
> +}
>  }
>  
>  
> @@ -1175,6 +1184,26 @@ static gboolean
> socket_reconnect_timeout(gpointer opaque)
>  return false;
>  }
>  
> +static int load_char_socket_fd(Chardev *chr, Error **errp)
> +{
> +SocketChardev *sockchar = SOCKET_CHARDEV(chr);
> +QIOChannelSocket *sioc;
> +const char *label = chr->label;
> +int fd = cpr_find_fd(label, 0);
> +
> +if (fd != -1) {
> +sockchar = SOCKET_CHARDEV(chr);
> +sioc = qio_channel_socket_new_fd(fd, errp);
> +if (sioc) {
> +tcp_chr_accept(sockchar->listener, sioc, chr);
> +object_unref(OBJECT(sioc));
> +} else {
> +error_setg(errp, "could not restore socket for %s",
> label);
> +return -1;
> +}
> +}
> +return 0;
> +}
>  
>  static int qmp_chardev_open_socket_server(Chardev *chr,
>bool is_telnet,
> @@ -1385,6 +1414,10 @@ static void qmp_chardev_open_socket(Chardev
> *chr,
>  }
>  s->registered_yank = true;
>  
> +if (!s->tls_creds && !s->is_websock) {
> +qemu_chr_set_feature(chr, QEMU_CHAR_FEATURE_CPR);
> +}
> +
>  /* be isn't opened until we get a connection */
>  *be_opened = false;
>  
> @@ -1400,6 +1433,8 @@ static void qmp_chardev_open_socket(Chardev
> *chr,
>  return;
>  }
>  }
> +
> +load_char_socket_fd(chr, errp);
>  }
>  
>  static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend
> *backend,
> diff --git a/monitor/hmp.c b/monitor/hmp.c
> index b20737e..a425894 100644
> --- a/monitor/hmp.c
> +++ b/monitor/hmp.c
> @@ -1484,4 +1484,7 @@ void monitor_init_hmp(Chardev *chr, bool
> use_readline, Error **errp)
>  qemu_chr_fe_set_handlers(>common.chr, monitor_can_read,
> monitor_read,
>   monitor_event, NULL, >common,
> NULL, true);
>  monitor_list_append(>common);
> +
> +/* monitor cannot yet be preserved across cpr */
> +chr->reopen_on_cpr = true;
>  }
> diff --git a/monitor/qmp.c b/monitor/qmp.c
> index 092c527..0043459 100644
> --- a/monitor/qmp.c
> +++ b/monitor/qmp.c
> @@ -535,4 +535,7 @@ void monitor_init_qmp(Chardev *chr, bool pretty,
> Error **errp)
>   NULL, >common, NULL, true);
>  monitor_list_append(>common);
>  }
> +
> +/* Monitor cannot yet be preserved across cpr */
> +chr->reopen_on_cpr = true;
>  }

[PATCH v2 1/1] numa: check NUMA nodes with memdev specified

[Li Zhang]

If there is no memdev in numa configuration, it always reports
the error as the following:

total memory for NUMA nodes (0x0) should equal RAM size (0x1)

This error is confusing, and the total memory is the memory of
NUMA nodes with memdev specified actually. The memory size of a node
without memdev specified is always 0. So it's better to remind
users to check the memory of the NUMA nodes with memdev specified.

Signed-off-by: Li Zhang 
---
 hw/core/numa.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/core/numa.c b/hw/core/numa.c
index 1aa05dcf42..7e1dbab0d5 100644
--- a/hw/core/numa.c
+++ b/hw/core/numa.c
@@ -688,7 +688,8 @@ void numa_complete_configuration(MachineState *ms)
 numa_total += numa_info[i].node_mem;
 }
 if (numa_total != ms->ram_size) {
-error_report("total memory for NUMA nodes (0x%" PRIx64 ")"
+error_report("total memory for NUMA nodes specified"
+ " with memdev backend memory (0x%" PRIx64 ")"
  " should equal RAM size (0x" RAM_ADDR_FMT ")",
  numa_total, ms->ram_size);
 exit(1);
-- 
2.31.1

[PATCH 1/2] pci-bridge/xio3130_upstream: Fix error handling

[Jonathan Cameron via]

Goto label is incorrect so msi cleanup would not occur if there is
an error in the ssvid initialization.

Signed-off-by: Jonathan Cameron 
---
Noticed whilst working on equivalent CXL upstream switch port.

 hw/pci-bridge/xio3130_upstream.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 5cd3af4fbc..5ff46ef050 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -75,7 +75,7 @@ static void xio3130_upstream_realize(PCIDevice *d, Error 
**errp)
XIO3130_SSVID_SVID, XIO3130_SSVID_SSID,
errp);
 if (rc < 0) {
-goto err_bridge;
+goto err_msi;
 }
 
 rc = pcie_cap_init(d, XIO3130_EXP_OFFSET, PCI_EXP_TYPE_UPSTREAM,
-- 
2.32.0

[PULL 02/39] spapr: nvdimm: Implement H_SCM_FLUSH hcall

[Cédric Le Goater]

From: Shivaprasad G Bhat 

The patch adds support for the SCM flush hcall for the nvdimm devices.
To be available for exploitation by guest through the next patch. The
hcall is applicable only for new SPAPR specific device class which is
also introduced in this patch.

The hcall expects the semantics such that the flush to return with
H_LONG_BUSY_ORDER_10_MSEC when the operation is expected to take longer
time along with a continue_token. The hcall to be called again by providing
the continue_token to get the status. So, all fresh requests are put into
a 'pending' list and flush worker is submitted to the thread pool. The
thread pool completion callbacks move the requests to 'completed' list,
which are cleaned up after collecting the return status for the guest
in subsequent hcall from the guest.

The semantics makes it necessary to preserve the continue_tokens and
their return status across migrations. So, the completed flush states
are forwarded to the destination and the pending ones are restarted
at the destination in post_load. The necessary nvdimm flush specific
vmstate structures are also introduced in this patch which are to be
saved in the new SPAPR specific nvdimm device to be introduced in the
following patch.

Signed-off-by: Shivaprasad G Bhat 
Reviewed-by: Daniel Henrique Barboza 
Message-Id: 
<164396254862.109112.16675611182159105748.st...@ltczzess4.aus.stglabs.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 include/hw/ppc/spapr.h|   4 +-
 include/hw/ppc/spapr_nvdimm.h |   1 +
 hw/ppc/spapr.c|   2 +
 hw/ppc/spapr_nvdimm.c | 260 ++
 4 files changed, 266 insertions(+), 1 deletion(-)

diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index ee7504b9760b..727b2a0e7fc9 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -341,6 +341,7 @@ struct SpaprMachineState {
 #define H_P7  -60
 #define H_P8  -61
 #define H_P9  -62
+#define H_UNSUPPORTED -67
 #define H_OVERLAP -68
 #define H_UNSUPPORTED_FLAG -256
 #define H_MULTI_THREADS_ACTIVE -9005
@@ -559,8 +560,9 @@ struct SpaprMachineState {
 #define H_SCM_UNBIND_ALL0x3FC
 #define H_SCM_HEALTH0x400
 #define H_RPT_INVALIDATE0x448
+#define H_SCM_FLUSH 0x44C
 
-#define MAX_HCALL_OPCODEH_RPT_INVALIDATE
+#define MAX_HCALL_OPCODEH_SCM_FLUSH
 
 /* The hcalls above are standardized in PAPR and implemented by pHyp
  * as well.
diff --git a/include/hw/ppc/spapr_nvdimm.h b/include/hw/ppc/spapr_nvdimm.h
index 764f999f5471..e9436cb6ef61 100644
--- a/include/hw/ppc/spapr_nvdimm.h
+++ b/include/hw/ppc/spapr_nvdimm.h
@@ -21,5 +21,6 @@ void spapr_dt_persistent_memory(SpaprMachineState *spapr, 
void *fdt);
 bool spapr_nvdimm_validate(HotplugHandler *hotplug_dev, NVDIMMDevice *nvdimm,
uint64_t size, Error **errp);
 void spapr_add_nvdimm(DeviceState *dev, uint64_t slot);
+void spapr_nvdimm_finish_flushes(void);
 
 #endif
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 3d6ec309dd21..92639856635a 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1634,6 +1634,8 @@ static void spapr_machine_reset(MachineState *machine)
 spapr->ov5_cas = spapr_ovec_clone(spapr->ov5);
 }
 
+spapr_nvdimm_finish_flushes();
+
 /* DRC reset may cause a device to be unplugged. This will cause troubles
  * if this device is used by another device (eg, a running vhost backend
  * will crash QEMU if the DIMM holding the vring goes away). To avoid such
diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
index 91de1052f233..ac44e0015317 100644
--- a/hw/ppc/spapr_nvdimm.c
+++ b/hw/ppc/spapr_nvdimm.c
@@ -22,6 +22,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
+#include "qemu/cutils.h"
 #include "qapi/error.h"
 #include "hw/ppc/spapr_drc.h"
 #include "hw/ppc/spapr_nvdimm.h"
@@ -30,6 +31,9 @@
 #include "hw/ppc/fdt.h"
 #include "qemu/range.h"
 #include "hw/ppc/spapr_numa.h"
+#include "block/thread-pool.h"
+#include "migration/vmstate.h"
+#include "qemu/pmem.h"
 
 /* DIMM health bitmap bitmap indicators. Taken from kernel's papr_scm.c */
 /* SCM device is unable to persist memory contents */
@@ -47,6 +51,14 @@
 /* Have an explicit check for alignment */
 QEMU_BUILD_BUG_ON(SPAPR_MINIMUM_SCM_BLOCK_SIZE % SPAPR_MEMORY_BLOCK_SIZE);
 
+#define TYPE_SPAPR_NVDIMM "spapr-nvdimm"
+OBJECT_DECLARE_TYPE(SpaprNVDIMMDevice, SPAPRNVDIMMClass, SPAPR_NVDIMM)
+
+struct SPAPRNVDIMMClass {
+/* private */
+NVDIMMClass parent_class;
+};
+
 bool spapr_nvdimm_validate(HotplugHandler *hotplug_dev, NVDIMMDevice *nvdimm,
uint64_t size, Error **errp)
 {
@@ -375,6 +387,253 @@ static target_ulong h_scm_bind_mem(PowerPCCPU *cpu, 
SpaprMachineState *spapr,
 return H_SUCCESS;
 }
 
+typedef struct SpaprNVDIMMDeviceFlushState {
+uint64_t continue_token;
+int64_t hcall_ret;
+uint32_t drcidx;
+
+

[PULL 17/39] target/ppc: cpu_init: Avoid nested SPR register functions

[Cédric Le Goater]

From: Fabiano Rosas 

Make sure that every register_*_sprs function only has calls to
spr_register* to register individual SPRs. Do not allow nesting. This
makes the code easier to follow and a look at init_proc_* should
suffice to know what SPRs a CPU has.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-6-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index c6db87fd5c74..53409a176ac3 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1128,8 +1128,6 @@ static void register_BookE206_sprs(CPUPPCState *env, 
uint32_t mas_mask,
 break;
 }
 #endif
-
-register_usprgh_sprs(env);
 }
 
 /* SPR specific to PowerPC 440 implementation */
@@ -1427,7 +1425,6 @@ static void register_405_sprs(CPUPPCState *env)
  SPR_NOACCESS, SPR_NOACCESS,
  spr_read_generic, _write_generic,
  0x);
-register_usprgh_sprs(env);
 }
 
 
@@ -2318,6 +2315,7 @@ static void init_proc_405(CPUPPCState *env)
 {
 register_40x_sprs(env);
 register_405_sprs(env);
+register_usprgh_sprs(env);
 /* Bus access control */
 /* not emulated, as QEMU never does speculative access */
 spr_register(env, SPR_40x_SGR, "SGR",
@@ -2947,6 +2945,7 @@ static void init_proc_e200(CPUPPCState *env)
  0x);
 /* Memory management */
 register_BookE206_sprs(env, 0x005D, NULL, 0);
+register_usprgh_sprs(env);
 
 spr_register(env, SPR_HID0, "HID0",
  SPR_NOACCESS, SPR_NOACCESS,
@@ -3294,6 +3293,7 @@ static void init_proc_e500(CPUPPCState *env, int version)
   env->spr[SPR_PVR]);
 }
 register_BookE206_sprs(env, 0x00DF, tlbncfg, mmucfg);
+register_usprgh_sprs(env);
 
 spr_register(env, SPR_HID0, "HID0",
  SPR_NOACCESS, SPR_NOACCESS,
-- 
2.34.1

[PULL 14/39] target/ppc: cpu_init: Remove G2LE init code

[Cédric Le Goater]

From: Fabiano Rosas 

The G2LE CPU initialization code is the same as the G2. Use the latter
for both.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-3-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 42 +-
 1 file changed, 1 insertion(+), 41 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 767994fb8f99..ec29ccf473e6 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -2885,53 +2885,13 @@ POWERPC_FAMILY(G2)(ObjectClass *oc, void *data)
  POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK;
 }
 
-static void init_proc_G2LE(CPUPPCState *env)
-{
-register_ne_601_sprs(env);
-register_sdr1_sprs(env);
-register_G2_755_sprs(env);
-register_G2_sprs(env);
-/* Time base */
-register_tbl(env);
-/* External access control */
-spr_register(env, SPR_EAR, "EAR",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-/* Hardware implementation register */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_HID2, "HID2",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-/* Memory management */
-register_low_BATs(env);
-register_high_BATs(env);
-register_6xx_7xx_soft_tlb(env, 64, 2);
-init_excp_G2(env);
-env->dcache_line_size = 32;
-env->icache_line_size = 32;
-/* Allocate hardware IRQ controller */
-ppc6xx_irq_init(env_archcpu(env));
-}
-
 POWERPC_FAMILY(G2LE)(ObjectClass *oc, void *data)
 {
 DeviceClass *dc = DEVICE_CLASS(oc);
 PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
 
 dc->desc = "PowerPC G2LE";
-pcc->init_proc = init_proc_G2LE;
+pcc->init_proc = init_proc_G2;
 pcc->check_pow = check_pow_hid0;
 pcc->insns_flags = PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |
PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
-- 
2.34.1

[PULL 16/39] target/ppc: cpu_init: Move Timebase registration into the common function

[Cédric Le Goater]

From: Fabiano Rosas 

Now that the 601 was removed, all of our CPUs have a timebase, so that
can be moved into the common function.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-5-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 98 ---
 1 file changed, 18 insertions(+), 80 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 1fb17a5e5112..c6db87fd5c74 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -221,6 +221,24 @@ static void register_generic_sprs(PowerPCCPU *cpu)
  pcc->svr);
 }
 }
+
+/* Time base */
+spr_register(env, SPR_VTBL,  "TBL",
+ _read_tbl, SPR_NOACCESS,
+ _read_tbl, SPR_NOACCESS,
+ 0x);
+spr_register(env, SPR_TBL,   "TBL",
+ _read_tbl, SPR_NOACCESS,
+ _read_tbl, _write_tbl,
+ 0x);
+spr_register(env, SPR_VTBU,  "TBU",
+ _read_tbu, SPR_NOACCESS,
+ _read_tbu, SPR_NOACCESS,
+ 0x);
+spr_register(env, SPR_TBU,   "TBU",
+ _read_tbu, SPR_NOACCESS,
+ _read_tbu, _write_tbu,
+ 0x);
 }
 
 /* SPR common to all non-embedded PowerPC, including 601 */
@@ -409,27 +427,6 @@ static void register_high_BATs(CPUPPCState *env)
 #endif
 }
 
-/* Generic PowerPC time base */
-static void register_tbl(CPUPPCState *env)
-{
-spr_register(env, SPR_VTBL,  "TBL",
- _read_tbl, SPR_NOACCESS,
- _read_tbl, SPR_NOACCESS,
- 0x);
-spr_register(env, SPR_TBL,   "TBL",
- _read_tbl, SPR_NOACCESS,
- _read_tbl, _write_tbl,
- 0x);
-spr_register(env, SPR_VTBU,  "TBU",
- _read_tbu, SPR_NOACCESS,
- _read_tbu, SPR_NOACCESS,
- 0x);
-spr_register(env, SPR_TBU,   "TBU",
- _read_tbu, SPR_NOACCESS,
- _read_tbu, _write_tbu,
- 0x);
-}
-
 /* Softare table search registers */
 static void register_6xx_7xx_soft_tlb(CPUPPCState *env, int nb_tlbs, int 
nb_ways)
 {
@@ -2319,8 +2316,6 @@ static int check_pow_hid0_74xx(CPUPPCState *env)
 
 static void init_proc_405(CPUPPCState *env)
 {
-/* Time base */
-register_tbl(env);
 register_40x_sprs(env);
 register_405_sprs(env);
 /* Bus access control */
@@ -2386,8 +2381,6 @@ POWERPC_FAMILY(405)(ObjectClass *oc, void *data)
 
 static void init_proc_440EP(CPUPPCState *env)
 {
-/* Time base */
-register_tbl(env);
 register_BookE_sprs(env, 0xULL);
 register_440_sprs(env);
 register_usprgh_sprs(env);
@@ -2528,8 +2521,6 @@ POWERPC_FAMILY(460EX)(ObjectClass *oc, void *data)
 
 static void init_proc_440GP(CPUPPCState *env)
 {
-/* Time base */
-register_tbl(env);
 register_BookE_sprs(env, 0xULL);
 register_440_sprs(env);
 register_usprgh_sprs(env);
@@ -2611,8 +2602,6 @@ POWERPC_FAMILY(440GP)(ObjectClass *oc, void *data)
 
 static void init_proc_440x5(CPUPPCState *env)
 {
-/* Time base */
-register_tbl(env);
 register_BookE_sprs(env, 0xULL);
 register_440_sprs(env);
 register_usprgh_sprs(env);
@@ -2750,8 +2739,6 @@ POWERPC_FAMILY(440x5wDFPU)(ObjectClass *oc, void *data)
 
 static void init_proc_MPC5xx(CPUPPCState *env)
 {
-/* Time base */
-register_tbl(env);
 register_5xx_8xx_sprs(env);
 register_5xx_sprs(env);
 init_excp_MPC5xx(env);
@@ -2794,8 +2781,6 @@ POWERPC_FAMILY(MPC5xx)(ObjectClass *oc, void *data)
 
 static void init_proc_MPC8xx(CPUPPCState *env)
 {
-/* Time base */
-register_tbl(env);
 register_5xx_8xx_sprs(env);
 register_8xx_sprs(env);
 init_excp_MPC8xx(env);
@@ -2843,8 +2828,6 @@ static void init_proc_G2(CPUPPCState *env)
 register_sdr1_sprs(env);
 register_G2_755_sprs(env);
 register_G2_sprs(env);
-/* Time base */
-register_tbl(env);
 /* External access control */
 spr_register(env, SPR_EAR, "EAR",
  SPR_NOACCESS, SPR_NOACCESS,
@@ -2956,8 +2939,6 @@ POWERPC_FAMILY(G2LE)(ObjectClass *oc, void *data)
 
 static void init_proc_e200(CPUPPCState *env)
 {
-/* Time base */
-register_tbl(env);
 register_BookE_sprs(env, 0x0007ULL);
 
 spr_register(env, SPR_BOOKE_SPEFSCR, "SPEFSCR",
@@ -3114,8 +3095,6 @@ static void init_proc_e300(CPUPPCState *env)
 register_ne_601_sprs(env);
 register_sdr1_sprs(env);
 register_603_sprs(env);
-/* Time base */
-register_tbl(env);
 /* hardware implementation registers */
 spr_register(env, SPR_HID0, "HID0",
  SPR_NOACCESS, SPR_NOACCESS,
@@ -3229,8 +3208,6 @@ static void init_proc_e500(CPUPPCState *env, int version)
 int i;
 #endif

[PULL 20/39] target/ppc: cpu_init: Decouple G2 SPR registration from 755

[Cédric Le Goater]

From: Fabiano Rosas 

We're considering these two to be in different CPU families (6xx and
7xx), so keep their SPR registration separate.

The code was copied into register_G2_sprs and the common function was
renamed to apply only to the 755.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-9-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 25 -
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 38bcc6b6072e..36d6377a51d2 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -466,8 +466,7 @@ static void register_6xx_7xx_soft_tlb(CPUPPCState *env, int 
nb_tlbs, int nb_ways
 #endif
 }
 
-/* SPR common to MPC755 and G2 */
-static void register_G2_755_sprs(CPUPPCState *env)
+static void register_755_sprs(CPUPPCState *env)
 {
 /* SGPRs */
 spr_register(env, SPR_SPRG4, "SPRG4",
@@ -783,6 +782,23 @@ static void register_G2_sprs(CPUPPCState *env)
  _read_generic, _write_generic,
  0x);
 
+/* SGPRs */
+spr_register(env, SPR_SPRG4, "SPRG4",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+spr_register(env, SPR_SPRG5, "SPRG5",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+spr_register(env, SPR_SPRG6, "SPRG6",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+spr_register(env, SPR_SPRG7, "SPRG7",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
 }
 
 static void register_74xx_sprs(CPUPPCState *env)
@@ -2848,7 +2864,6 @@ static void init_proc_G2(CPUPPCState *env)
 {
 register_ne_601_sprs(env);
 register_sdr1_sprs(env);
-register_G2_755_sprs(env);
 register_G2_sprs(env);
 
 /* Memory management */
@@ -4470,7 +4485,7 @@ static void init_proc_745(CPUPPCState *env)
 register_ne_601_sprs(env);
 register_sdr1_sprs(env);
 register_7xx_sprs(env);
-register_G2_755_sprs(env);
+register_755_sprs(env);
 /* Thermal management */
 register_thrm_sprs(env);
 /* Hardware implementation registers */
@@ -4543,7 +4558,7 @@ static void init_proc_755(CPUPPCState *env)
 register_ne_601_sprs(env);
 register_sdr1_sprs(env);
 register_7xx_sprs(env);
-register_G2_755_sprs(env);
+register_755_sprs(env);
 /* L2 cache control */
 spr_register(env, SPR_L2CR, "L2CR",
  SPR_NOACCESS, SPR_NOACCESS,
-- 
2.34.1

[PULL 11/39] target/ppc: Introduce a vhyp framework for nested HV support

[Cédric Le Goater]

From: Nicholas Piggin 

Introduce virtual hypervisor methods that can support a "Nested KVM HV"
implementation using the bare metal 2-level radix MMU, and using HV
exceptions to return from H_ENTER_NESTED (rather than cause interrupts).

HV exceptions can now be raised in the TCG spapr machine when running a
nested KVM HV guest. The main ones are the lev==1 syscall, the hdecr,
hdsi and hisi, hv fu, and hv emu, and h_virt external interrupts.

HV exceptions are intercepted in the exception handler code and instead
of causing interrupts in the guest and switching the machine to HV mode,
they go to the vhyp where it may exit the H_ENTER_NESTED hcall with the
interrupt vector numer as return value as required by the hcall API.

Address translation is provided by the 2-level page table walker that is
implemented for the bare metal radix MMU. The partition scope page table
is pointed to the L1's partition scope by the get_pate vhc method.

Reviewed-by: Fabiano Rosas 
Signed-off-by: Nicholas Piggin 
Reviewed-by: Cédric Le Goater 
Message-Id: <20220216102545.1808018-9-npig...@gmail.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu.h |  7 +
 hw/ppc/pegasos2.c|  6 
 hw/ppc/spapr.c   |  6 
 target/ppc/excp_helper.c | 64 +---
 target/ppc/mmu-radix64.c | 11 +--
 5 files changed, 81 insertions(+), 13 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index c79ae74f10de..2baa750729fd 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1311,6 +1311,8 @@ PowerPCCPUClass *ppc_cpu_get_family_class(PowerPCCPUClass 
*pcc);
 #ifndef CONFIG_USER_ONLY
 struct PPCVirtualHypervisorClass {
 InterfaceClass parent;
+bool (*cpu_in_nested)(PowerPCCPU *cpu);
+void (*deliver_hv_excp)(PowerPCCPU *cpu, int excp);
 void (*hypercall)(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu);
 hwaddr (*hpt_mask)(PPCVirtualHypervisor *vhyp);
 const ppc_hash_pte64_t *(*map_hptes)(PPCVirtualHypervisor *vhyp,
@@ -1330,6 +1332,11 @@ struct PPCVirtualHypervisorClass {
 #define TYPE_PPC_VIRTUAL_HYPERVISOR "ppc-virtual-hypervisor"
 DECLARE_OBJ_CHECKERS(PPCVirtualHypervisor, PPCVirtualHypervisorClass,
  PPC_VIRTUAL_HYPERVISOR, TYPE_PPC_VIRTUAL_HYPERVISOR)
+
+static inline bool vhyp_cpu_in_nested(PowerPCCPU *cpu)
+{
+return PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp)->cpu_in_nested(cpu);
+}
 #endif /* CONFIG_USER_ONLY */
 
 void ppc_cpu_dump_state(CPUState *cpu, FILE *f, int flags);
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 298e6b93e2dd..d45008ac7131 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -449,6 +449,11 @@ static target_ulong pegasos2_rtas(PowerPCCPU *cpu, 
Pegasos2MachineState *pm,
 }
 }
 
+static bool pegasos2_cpu_in_nested(PowerPCCPU *cpu)
+{
+return false;
+}
+
 static void pegasos2_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
 {
 Pegasos2MachineState *pm = PEGASOS2_MACHINE(vhyp);
@@ -504,6 +509,7 @@ static void pegasos2_machine_class_init(ObjectClass *oc, 
void *data)
 mc->default_ram_id = "pegasos2.ram";
 mc->default_ram_size = 512 * MiB;
 
+vhc->cpu_in_nested = pegasos2_cpu_in_nested;
 vhc->hypercall = pegasos2_hypercall;
 vhc->cpu_exec_enter = vhyp_nop;
 vhc->cpu_exec_exit = vhyp_nop;
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 4fdff12a9625..51ba8615f281 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4472,6 +4472,11 @@ PowerPCCPU *spapr_find_cpu(int vcpu_id)
 return NULL;
 }
 
+static bool spapr_cpu_in_nested(PowerPCCPU *cpu)
+{
+return false;
+}
+
 static void spapr_cpu_exec_enter(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
 {
 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
@@ -4580,6 +4585,7 @@ static void spapr_machine_class_init(ObjectClass *oc, 
void *data)
 fwc->get_dev_path = spapr_get_fw_dev_path;
 nc->nmi_monitor_handler = spapr_nmi;
 smc->phb_placement = spapr_phb_placement;
+vhc->cpu_in_nested = spapr_cpu_in_nested;
 vhc->hypercall = emulate_spapr_hypercall;
 vhc->hpt_mask = spapr_hpt_mask;
 vhc->map_hptes = spapr_map_hptes;
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 7499fa187f6f..f44b9da2a53c 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1280,6 +1280,18 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
 powerpc_set_excp_state(cpu, vector, new_msr);
 }
 
+/*
+ * When running a nested HV guest under vhyp, external interrupts are
+ * delivered as HVIRT.
+ */
+static bool books_vhyp_promotes_external_to_hvirt(PowerPCCPU *cpu)
+{
+if (cpu->vhyp) {
+return vhyp_cpu_in_nested(cpu);
+}
+return false;
+}
+
 #ifdef TARGET_PPC64
 /*
  * When running under vhyp, hcalls are always intercepted and sent to the
@@ -1288,7 +1300,21 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
 static bool books_vhyp_handles_hcall(PowerPCCPU *cpu)
 {
 if (cpu->vhyp) {
-return true;
+  

[PULL 12/39] spapr: implement nested-hv capability for the virtual hypervisor

[Cédric Le Goater]

From: Nicholas Piggin 

This implements the Nested KVM HV hcall API for spapr under TCG.

The L2 is switched in when the H_ENTER_NESTED hcall is made, and the
L1 is switched back in returned from the hcall when a HV exception
is sent to the vhyp. Register state is copied in and out according to
the nested KVM HV hcall API specification.

The hdecr timer is started when the L2 is switched in, and it provides
the HDEC / 0x980 return to L1.

The MMU re-uses the bare metal radix 2-level page table walker by
using the get_pate method to point the MMU to the nested partition
table entry. MMU faults due to partition scope errors raise HV
exceptions and accordingly are routed back to the L1.

The MMU does not tag translations for the L1 (direct) vs L2 (nested)
guests, so the TLB is flushed on any L1<->L2 transition (hcall entry
and exit).

Reviewed-by: Fabiano Rosas 
Signed-off-by: Nicholas Piggin 
Reviewed-by: Cédric Le Goater 
[ clg: checkpatch fixes ]
Message-Id: <20220216102545.1808018-10-npig...@gmail.com>
Signed-off-by: Cédric Le Goater 
---
 include/hw/ppc/spapr.h  |  74 ++-
 include/hw/ppc/spapr_cpu_core.h |   5 +
 hw/ppc/spapr.c  |  37 +++-
 hw/ppc/spapr_caps.c |  14 +-
 hw/ppc/spapr_hcall.c| 333 
 5 files changed, 452 insertions(+), 11 deletions(-)

diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 727b2a0e7fc9..f5c33dcc8616 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -197,6 +197,9 @@ struct SpaprMachineState {
 bool has_graphics;
 uint32_t vsmt;   /* Virtual SMT mode (KVM's "core stride") */
 
+/* Nested HV support (TCG only) */
+uint64_t nested_ptcr;
+
 Notifier epow_notifier;
 QTAILQ_HEAD(, SpaprEventLogEntry) pending_events;
 bool use_hotplug_event_source;
@@ -579,7 +582,14 @@ struct SpaprMachineState {
 #define KVMPPC_H_UPDATE_DT  (KVMPPC_HCALL_BASE + 0x3)
 /* 0x4 was used for KVMPPC_H_UPDATE_PHANDLE in SLOF */
 #define KVMPPC_H_VOF_CLIENT (KVMPPC_HCALL_BASE + 0x5)
-#define KVMPPC_HCALL_MAXKVMPPC_H_VOF_CLIENT
+
+/* Platform-specific hcalls used for nested HV KVM */
+#define KVMPPC_H_SET_PARTITION_TABLE   (KVMPPC_HCALL_BASE + 0x800)
+#define KVMPPC_H_ENTER_NESTED  (KVMPPC_HCALL_BASE + 0x804)
+#define KVMPPC_H_TLB_INVALIDATE(KVMPPC_HCALL_BASE + 0x808)
+#define KVMPPC_H_COPY_TOFROM_GUEST (KVMPPC_HCALL_BASE + 0x80C)
+
+#define KVMPPC_HCALL_MAXKVMPPC_H_COPY_TOFROM_GUEST
 
 /*
  * The hcall range 0xEF00 to 0xEF80 is reserved for use in facilitating
@@ -589,6 +599,65 @@ struct SpaprMachineState {
 #define SVM_H_TPM_COMM  0xEF10
 #define SVM_HCALL_MAX   SVM_H_TPM_COMM
 
+/*
+ * Register state for entering a nested guest with H_ENTER_NESTED.
+ * New member must be added at the end.
+ */
+struct kvmppc_hv_guest_state {
+uint64_t version;  /* version of this structure layout, must be first 
*/
+uint32_t lpid;
+uint32_t vcpu_token;
+/* These registers are hypervisor privileged (at least for writing) */
+uint64_t lpcr;
+uint64_t pcr;
+uint64_t amor;
+uint64_t dpdes;
+uint64_t hfscr;
+int64_t tb_offset;
+uint64_t dawr0;
+uint64_t dawrx0;
+uint64_t ciabr;
+uint64_t hdec_expiry;
+uint64_t purr;
+uint64_t spurr;
+uint64_t ic;
+uint64_t vtb;
+uint64_t hdar;
+uint64_t hdsisr;
+uint64_t heir;
+uint64_t asdr;
+/* These are OS privileged but need to be set late in guest entry */
+uint64_t srr0;
+uint64_t srr1;
+uint64_t sprg[4];
+uint64_t pidr;
+uint64_t cfar;
+uint64_t ppr;
+/* Version 1 ends here */
+uint64_t dawr1;
+uint64_t dawrx1;
+/* Version 2 ends here */
+};
+
+/* Latest version of hv_guest_state structure */
+#define HV_GUEST_STATE_VERSION  2
+
+/* Linux 64-bit powerpc pt_regs struct, used by nested HV */
+struct kvmppc_pt_regs {
+uint64_t gpr[32];
+uint64_t nip;
+uint64_t msr;
+uint64_t orig_gpr3;/* Used for restarting system calls */
+uint64_t ctr;
+uint64_t link;
+uint64_t xer;
+uint64_t ccr;
+uint64_t softe;/* Soft enabled/disabled */
+uint64_t trap; /* Reason for being here */
+uint64_t dar;  /* Fault registers */
+uint64_t dsisr;/* on 4xx/Book-E used for ESR */
+uint64_t result;   /* Result of a system call */
+};
 
 typedef struct SpaprDeviceTreeUpdateHeader {
 uint32_t version_id;
@@ -606,6 +675,9 @@ typedef target_ulong (*spapr_hcall_fn)(PowerPCCPU *cpu, 
SpaprMachineState *sm,
 void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn);
 target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
  target_ulong *args);
+
+void spapr_exit_nested(PowerPCCPU *cpu, int excp);
+
 target_ulong softmmu_resize_hpt_prepare(PowerPCCPU *cpu, SpaprMachineState 
*spapr,
  

[PULL 23/39] target/ppc: cpu_init: Deduplicate 603 SPR registration

[Cédric Le Goater]

From: Fabiano Rosas 

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-12-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 28 +---
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 43ba32423cf1..017a3b4b2979 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -710,6 +710,15 @@ static void register_603_sprs(CPUPPCState *env)
  _read_generic, _write_generic,
  0x);
 
+spr_register(env, SPR_HID0, "HID0",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+
+spr_register(env, SPR_HID1, "HID1",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
 }
 
 /* SPR specific to PowerPC G2 implementation */
@@ -3158,16 +3167,6 @@ static void init_proc_e300(CPUPPCState *env)
 register_sdr1_sprs(env);
 register_603_sprs(env);
 /* hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
 spr_register(env, SPR_HID2, "HID2",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
@@ -3714,16 +3713,7 @@ static void init_proc_603(CPUPPCState *env)
 register_ne_601_sprs(env);
 register_sdr1_sprs(env);
 register_603_sprs(env);
-/* hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 /* Memory management */
 register_low_BATs(env);
 register_6xx_7xx_soft_tlb(env, 64, 2);
-- 
2.34.1

Re: [PATCH 0/5] include: Trim some fat from osdep.h

[Peter Maydell]

On Tue, 8 Feb 2022 at 20:08, Peter Maydell  wrote:
>
> The osdep.h header is included by every C file we compile, so it helps
> build times to keep it small. (As the comment at the top of the file
> notes, in an ideal world this header would contain only things that
> everybody needs and things where we need to apply a compatibility
> workaround on some hosts.) This series trims more than 130 lines from
> osdep.h (about 16% of its current size) by splitting some prototypes
> that are used only in a few files out into new headers that are
> included by those source files that need them.



Applied to target-arm.next, thanks.

-- PMM

[PULL 01/39] nvdimm: Add realize, unrealize callbacks to NVDIMMDevice class

[Cédric Le Goater]

From: Shivaprasad G Bhat 

A new subclass inheriting NVDIMMDevice is going to be introduced in
subsequent patches. The new subclass uses the realize and unrealize
callbacks. Add them on NVDIMMClass to appropriately call them as part
of plug-unplug.

Signed-off-by: Shivaprasad G Bhat 
Acked-by: Daniel Henrique Barboza 
Message-Id: 
<164396253158.109112.1926755104259023743.st...@ltczzess4.aus.stglabs.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 include/hw/mem/nvdimm.h  |  2 ++
 include/hw/mem/pc-dimm.h |  1 +
 hw/mem/nvdimm.c  | 16 
 hw/mem/pc-dimm.c |  5 +
 4 files changed, 24 insertions(+)

diff --git a/include/hw/mem/nvdimm.h b/include/hw/mem/nvdimm.h
index bcf62f825c74..cf8f59be44f9 100644
--- a/include/hw/mem/nvdimm.h
+++ b/include/hw/mem/nvdimm.h
@@ -103,6 +103,8 @@ struct NVDIMMClass {
 /* write @size bytes from @buf to NVDIMM label data at @offset. */
 void (*write_label_data)(NVDIMMDevice *nvdimm, const void *buf,
  uint64_t size, uint64_t offset);
+void (*realize)(NVDIMMDevice *nvdimm, Error **errp);
+void (*unrealize)(NVDIMMDevice *nvdimm);
 };
 
 #define NVDIMM_DSM_MEM_FILE "etc/acpi/nvdimm-mem"
diff --git a/include/hw/mem/pc-dimm.h b/include/hw/mem/pc-dimm.h
index 1473e6db6254..322bebe555b5 100644
--- a/include/hw/mem/pc-dimm.h
+++ b/include/hw/mem/pc-dimm.h
@@ -63,6 +63,7 @@ struct PCDIMMDeviceClass {
 
 /* public */
 void (*realize)(PCDIMMDevice *dimm, Error **errp);
+void (*unrealize)(PCDIMMDevice *dimm);
 };
 
 void pc_dimm_pre_plug(PCDIMMDevice *dimm, MachineState *machine,
diff --git a/hw/mem/nvdimm.c b/hw/mem/nvdimm.c
index 7397b6715652..59959d556337 100644
--- a/hw/mem/nvdimm.c
+++ b/hw/mem/nvdimm.c
@@ -181,10 +181,25 @@ static MemoryRegion 
*nvdimm_md_get_memory_region(MemoryDeviceState *md,
 static void nvdimm_realize(PCDIMMDevice *dimm, Error **errp)
 {
 NVDIMMDevice *nvdimm = NVDIMM(dimm);
+NVDIMMClass *ndc = NVDIMM_GET_CLASS(nvdimm);
 
 if (!nvdimm->nvdimm_mr) {
 nvdimm_prepare_memory_region(nvdimm, errp);
 }
+
+if (ndc->realize) {
+ndc->realize(nvdimm, errp);
+}
+}
+
+static void nvdimm_unrealize(PCDIMMDevice *dimm)
+{
+NVDIMMDevice *nvdimm = NVDIMM(dimm);
+NVDIMMClass *ndc = NVDIMM_GET_CLASS(nvdimm);
+
+if (ndc->unrealize) {
+ndc->unrealize(nvdimm);
+}
 }
 
 /*
@@ -240,6 +255,7 @@ static void nvdimm_class_init(ObjectClass *oc, void *data)
 DeviceClass *dc = DEVICE_CLASS(oc);
 
 ddc->realize = nvdimm_realize;
+ddc->unrealize = nvdimm_unrealize;
 mdc->get_memory_region = nvdimm_md_get_memory_region;
 device_class_set_props(dc, nvdimm_properties);
 
diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index 48b913aba677..03bd0dd60e5c 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -216,6 +216,11 @@ static void pc_dimm_realize(DeviceState *dev, Error **errp)
 static void pc_dimm_unrealize(DeviceState *dev)
 {
 PCDIMMDevice *dimm = PC_DIMM(dev);
+PCDIMMDeviceClass *ddc = PC_DIMM_GET_CLASS(dimm);
+
+if (ddc->unrealize) {
+ddc->unrealize(dimm);
+}
 
 host_memory_backend_set_mapped(dimm->hostmem, false);
 }
-- 
2.34.1

[PULL 00/39] ppc queue

[Cédric Le Goater]

The following changes since commit c13b8e9973635f34f3ce4356af27a311c993729c:

  Merge remote-tracking branch 
'remotes/alistair/tags/pull-riscv-to-apply-20220216' into staging (2022-02-16 
09:57:11 +)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-ppc-20220218

for you to fetch changes up to 65e0446c86ee70d2125c1f1d1e36e6c2dfb08642:

  target/ppc: Move common SPR functions out of cpu_init (2022-02-18 08:34:15 
+0100)


ppc-7.0 queue

* target/ppc: SPR registration cleanups (Fabiano)
* ppc: nested KVM HV for spapr virtual hypervisor (Nicholas)
* spapr: nvdimm: Introduce spapr-nvdimm device (Shivaprasad)


Fabiano Rosas (27):
  target/ppc: cpu_init: Remove not implemented comments
  target/ppc: cpu_init: Remove G2LE init code
  target/ppc: cpu_init: Group registration of generic SPRs
  target/ppc: cpu_init: Move Timebase registration into the common function
  target/ppc: cpu_init: Avoid nested SPR register functions
  target/ppc: cpu_init: Move 405 SPRs into register_405_sprs
  target/ppc: cpu_init: Move G2 SPRs into register_G2_sprs
  target/ppc: cpu_init: Decouple G2 SPR registration from 755
  target/ppc: cpu_init: Decouple 74xx SPR registration from 7xx
  target/ppc: cpu_init: Deduplicate 440 SPR registration
  target/ppc: cpu_init: Deduplicate 603 SPR registration
  target/ppc: cpu_init: Deduplicate 604 SPR registration
  target/ppc: cpu_init: Deduplicate 745/755 SPR registration
  target/ppc: cpu_init: Deduplicate 7xx SPR registration
  target/ppc: cpu_init: Move 755 L2 cache SPRs into a function
  target/ppc: cpu_init: Move e300 SPR registration into a function
  target/ppc: cpu_init: Move 604e SPR registration into a function
  target/ppc: cpu_init: Reuse init_proc_603 for the e300
  target/ppc: cpu_init: Reuse init_proc_604 for the 604e
  target/ppc: cpu_init: Reuse init_proc_745 for the 755
  target/ppc: cpu_init: Rename register_ne_601_sprs
  target/ppc: cpu_init: Remove register_usprg3_sprs
  target/ppc: Rename spr_tcg.h to spr_common.h
  target/ppc: cpu_init: Expose some SPR registration helpers
  target/ppc: cpu_init: Move SPR registration macros to a header
  target/ppc: cpu_init: Move check_pow and QOM macros to a header
  target/ppc: Move common SPR functions out of cpu_init

Nicholas Piggin (9):
  target/ppc: raise HV interrupts for partition table entry problems
  spapr: prevent hdec timer being set up under virtual hypervisor
  ppc: allow the hdecr timer to be created/destroyed
  target/ppc: add vhyp addressing mode helper for radix MMU
  target/ppc: make vhyp get_pate method take lpid and return success
  target/ppc: add helper for books vhyp hypercall handler
  target/ppc: Add powerpc_reset_excp_state helper
  target/ppc: Introduce a vhyp framework for nested HV support
  spapr: implement nested-hv capability for the virtual hypervisor

Shivaprasad G Bhat (3):
  nvdimm: Add realize, unrealize callbacks to NVDIMMDevice class
  spapr: nvdimm: Implement H_SCM_FLUSH hcall
  spapr: nvdimm: Introduce spapr-nvdimm device

 include/hw/mem/nvdimm.h|2 +
 include/hw/mem/pc-dimm.h   |1 +
 include/hw/ppc/ppc.h   |3 +
 include/hw/ppc/spapr.h |   78 +-
 include/hw/ppc/spapr_cpu_core.h|5 +
 include/hw/ppc/spapr_nvdimm.h  |1 +
 target/ppc/cpu.h   |   49 +-
 target/ppc/{spr_tcg.h => spr_common.h} |   69 +-
 hw/mem/nvdimm.c|   16 +
 hw/mem/pc-dimm.c   |5 +
 hw/ppc/pegasos2.c  |6 +
 hw/ppc/ppc.c   |   23 +-
 hw/ppc/spapr.c |   48 +-
 hw/ppc/spapr_caps.c|   14 +-
 hw/ppc/spapr_cpu_core.c|6 +-
 hw/ppc/spapr_hcall.c   |  333 ++
 hw/ppc/spapr_nvdimm.c  |  392 +++
 target/ppc/cpu_init.c  | 1877 ++--
 target/ppc/excp_helper.c   |  118 +-
 target/ppc/helper_regs.c   |  402 +++
 target/ppc/mmu-radix64.c   |   40 +-
 target/ppc/translate.c |2 +-
 22 files changed, 2144 insertions(+), 1346 deletions(-)
 rename target/ppc/{spr_tcg.h => spr_common.h} (72%)

[PULL 08/39] target/ppc: make vhyp get_pate method take lpid and return success

[Cédric Le Goater]

From: Nicholas Piggin 

In prepartion for implementing a full partition table option for
vhyp, update the get_pate method to take an lpid and return a
success/fail indicator.

The spapr implementation currently just asserts lpid is always 0
and always return success.

Reviewed-by: Cédric Le Goater 
Signed-off-by: Nicholas Piggin 
[ clg: checkpatch fixes ]
Message-Id: <20220216102545.1808018-6-npig...@gmail.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu.h | 3 ++-
 hw/ppc/spapr.c   | 7 ++-
 target/ppc/mmu-radix64.c | 8 +++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 555c6b924576..c79ae74f10de 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1320,7 +1320,8 @@ struct PPCVirtualHypervisorClass {
 hwaddr ptex, int n);
 void (*hpte_set_c)(PPCVirtualHypervisor *vhyp, hwaddr ptex, uint64_t pte1);
 void (*hpte_set_r)(PPCVirtualHypervisor *vhyp, hwaddr ptex, uint64_t pte1);
-void (*get_pate)(PPCVirtualHypervisor *vhyp, ppc_v3_pate_t *entry);
+bool (*get_pate)(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu,
+ target_ulong lpid, ppc_v3_pate_t *entry);
 target_ulong (*encode_hpt_for_kvm_pr)(PPCVirtualHypervisor *vhyp);
 void (*cpu_exec_enter)(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu);
 void (*cpu_exec_exit)(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu);
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 92639856635a..4fdff12a9625 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1309,13 +1309,18 @@ void spapr_set_all_lpcrs(target_ulong value, 
target_ulong mask)
 }
 }
 
-static void spapr_get_pate(PPCVirtualHypervisor *vhyp, ppc_v3_pate_t *entry)
+static bool spapr_get_pate(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu,
+   target_ulong lpid, ppc_v3_pate_t *entry)
 {
 SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
 
+assert(lpid == 0);
+
 /* Copy PATE1:GR into PATE0:HR */
 entry->dw0 = spapr->patb_entry & PATE0_HR;
 entry->dw1 = spapr->patb_entry;
+
+return true;
 }
 
 #define HPTE(_table, _i)   (void *)(((uint64_t *)(_table)) + ((_i) * 2))
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 04690b64828f..9c557c6de97a 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -563,7 +563,13 @@ static bool ppc_radix64_xlate_impl(PowerPCCPU *cpu, vaddr 
eaddr,
 if (cpu->vhyp) {
 PPCVirtualHypervisorClass *vhc;
 vhc = PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
-vhc->get_pate(cpu->vhyp, );
+if (!vhc->get_pate(cpu->vhyp, cpu, lpid, )) {
+if (guest_visible) {
+ppc_radix64_raise_hsi(cpu, access_type, eaddr, eaddr,
+  DSISR_R_BADCONFIG);
+}
+return false;
+}
 } else {
 if (!ppc64_v3_get_pate(cpu, lpid, )) {
 if (guest_visible) {
-- 
2.34.1

[PULL 30/39] target/ppc: cpu_init: Reuse init_proc_603 for the e300

[Cédric Le Goater]

From: Fabiano Rosas 

init_proc_603 is defined after init_proc_e300, so I had to move some
code around to make it work.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-19-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 104 +++---
 1 file changed, 46 insertions(+), 58 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index f75aaf98c303..794486dd3a4d 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -3265,64 +3265,6 @@ POWERPC_FAMILY(e200)(ObjectClass *oc, void *data)
  POWERPC_FLAG_BUS_CLK;
 }
 
-static void init_proc_e300(CPUPPCState *env)
-{
-register_ne_601_sprs(env);
-register_sdr1_sprs(env);
-register_603_sprs(env);
-register_e300_sprs(env);
-
-/* Memory management */
-register_low_BATs(env);
-register_high_BATs(env);
-register_6xx_7xx_soft_tlb(env, 64, 2);
-init_excp_603(env);
-env->dcache_line_size = 32;
-env->icache_line_size = 32;
-/* Allocate hardware IRQ controller */
-ppc6xx_irq_init(env_archcpu(env));
-}
-
-POWERPC_FAMILY(e300)(ObjectClass *oc, void *data)
-{
-DeviceClass *dc = DEVICE_CLASS(oc);
-PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
-
-dc->desc = "e300 core";
-pcc->init_proc = init_proc_e300;
-pcc->check_pow = check_pow_hid0;
-pcc->insns_flags = PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |
-   PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
-   PPC_FLOAT_STFIWX |
-   PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |
-   PPC_MEM_SYNC | PPC_MEM_EIEIO |
-   PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
-   PPC_SEGMENT | PPC_EXTERN;
-pcc->msr_mask = (1ull << MSR_POW) |
-(1ull << MSR_TGPR) |
-(1ull << MSR_ILE) |
-(1ull << MSR_EE) |
-(1ull << MSR_PR) |
-(1ull << MSR_FP) |
-(1ull << MSR_ME) |
-(1ull << MSR_FE0) |
-(1ull << MSR_SE) |
-(1ull << MSR_DE) |
-(1ull << MSR_FE1) |
-(1ull << MSR_AL) |
-(1ull << MSR_EP) |
-(1ull << MSR_IR) |
-(1ull << MSR_DR) |
-(1ull << MSR_RI) |
-(1ull << MSR_LE);
-pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
-pcc->excp_model = POWERPC_EXCP_6xx;
-pcc->bus_model = PPC_FLAGS_INPUT_6xx;
-pcc->bfd_mach = bfd_mach_ppc_603;
-pcc->flags = POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |
- POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK;
-}
-
 enum fsl_e500_version {
 fsl_e500v1,
 fsl_e500v2,
@@ -3878,6 +3820,52 @@ POWERPC_FAMILY(603E)(ObjectClass *oc, void *data)
  POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK;
 }
 
+static void init_proc_e300(CPUPPCState *env)
+{
+init_proc_603(env);
+register_e300_sprs(env);
+}
+
+POWERPC_FAMILY(e300)(ObjectClass *oc, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(oc);
+PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+
+dc->desc = "e300 core";
+pcc->init_proc = init_proc_e300;
+pcc->check_pow = check_pow_hid0;
+pcc->insns_flags = PPC_INSNS_BASE | PPC_STRING | PPC_MFTB |
+   PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
+   PPC_FLOAT_STFIWX |
+   PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |
+   PPC_MEM_SYNC | PPC_MEM_EIEIO |
+   PPC_MEM_TLBIE | PPC_MEM_TLBSYNC | PPC_6xx_TLB |
+   PPC_SEGMENT | PPC_EXTERN;
+pcc->msr_mask = (1ull << MSR_POW) |
+(1ull << MSR_TGPR) |
+(1ull << MSR_ILE) |
+(1ull << MSR_EE) |
+(1ull << MSR_PR) |
+(1ull << MSR_FP) |
+(1ull << MSR_ME) |
+(1ull << MSR_FE0) |
+(1ull << MSR_SE) |
+(1ull << MSR_DE) |
+(1ull << MSR_FE1) |
+(1ull << MSR_AL) |
+(1ull << MSR_EP) |
+(1ull << MSR_IR) |
+(1ull << MSR_DR) |
+(1ull << MSR_RI) |
+(1ull << MSR_LE);
+pcc->mmu_model = POWERPC_MMU_SOFT_6xx;
+pcc->excp_model = POWERPC_EXCP_6xx;
+pcc->bus_model = PPC_FLAGS_INPUT_6xx;
+pcc->bfd_mach = bfd_mach_ppc_603;
+pcc->flags = POWERPC_FLAG_TGPR | POWERPC_FLAG_SE |
+ POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK;
+}
+
 static void init_proc_604(CPUPPCState *env)
 {
 register_ne_601_sprs(env);
-- 
2.34.1

[PULL 26/39] target/ppc: cpu_init: Deduplicate 7xx SPR registration

[Cédric Le Goater]

From: Fabiano Rosas 

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-15-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 68 +++
 1 file changed, 11 insertions(+), 57 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 43289a429fa8..d5c23785d727 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -596,6 +596,17 @@ static void register_7xx_sprs(CPUPPCState *env)
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
+
+/* Hardware implementation registers */
+spr_register(env, SPR_HID0, "HID0",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+
+spr_register(env, SPR_HID1, "HID1",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
 }
 
 #ifdef TARGET_PPC64
@@ -3958,16 +3969,7 @@ static void init_proc_740(CPUPPCState *env)
 register_7xx_sprs(env);
 /* Thermal management */
 register_thrm_sprs(env);
-/* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 /* Memory management */
 register_low_BATs(env);
 init_excp_7x0(env);
@@ -4028,16 +4030,7 @@ static void init_proc_750(CPUPPCState *env)
  0x);
 /* Thermal management */
 register_thrm_sprs(env);
-/* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 /* Memory management */
 register_low_BATs(env);
 /*
@@ -4137,16 +4130,6 @@ static void init_proc_750cl(CPUPPCState *env)
  _read_generic, _write_generic,
  0x);
 /* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
 spr_register(env, SPR_750CL_HID2, "HID2",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
@@ -4302,16 +4285,7 @@ static void init_proc_750cx(CPUPPCState *env)
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
-/* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 /* Memory management */
 register_low_BATs(env);
 /* PowerPC 750cx has 8 DBATs and 8 IBATs */
@@ -4380,16 +4354,6 @@ static void init_proc_750fx(CPUPPCState *env)
  _read_generic, _write_generic,
  0x);
 /* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
 spr_register(env, SPR_750FX_HID2, "HID2",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
@@ -4462,16 +4426,6 @@ static void init_proc_750gx(CPUPPCState *env)
  _read_generic, _write_generic,
  0x);
 /* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
 spr_register(env, SPR_750FX_HID2, "HID2",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
-- 

[PULL 07/39] target/ppc: add vhyp addressing mode helper for radix MMU

[Cédric Le Goater]

From: Nicholas Piggin 

The radix on vhyp MMU uses a single-level radix table walk, with the
partition scope mapping provided by the flat QEMU machine memory.

A subsequent change will use the two-level radix walk on vhyp in some
situations, so provide a helper which can abstract that logic.

Reviewed-by: Cédric Le Goater 
Signed-off-by: Nicholas Piggin 
Message-Id: <20220216102545.1808018-5-npig...@gmail.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/mmu-radix64.c | 19 +++
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 274494903244..04690b64828f 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -354,6 +354,17 @@ static int ppc_radix64_partition_scoped_xlate(PowerPCCPU 
*cpu,
 return 0;
 }
 
+/*
+ * The spapr vhc has a flat partition scope provided by qemu memory.
+ */
+static bool vhyp_flat_addressing(PowerPCCPU *cpu)
+{
+if (cpu->vhyp) {
+return true;
+}
+return false;
+}
+
 static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
 MMUAccessType access_type,
 vaddr eaddr, uint64_t pid,
@@ -385,7 +396,7 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
 }
 prtbe_addr = (pate.dw1 & PATE1_R_PRTB) + offset;
 
-if (cpu->vhyp) {
+if (vhyp_flat_addressing(cpu)) {
 prtbe0 = ldq_phys(cs->as, prtbe_addr);
 } else {
 /*
@@ -411,7 +422,7 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
 *g_page_size = PRTBE_R_GET_RTS(prtbe0);
 base_addr = prtbe0 & PRTBE_R_RPDB;
 nls = prtbe0 & PRTBE_R_RPDS;
-if (msr_hv || cpu->vhyp) {
+if (msr_hv || vhyp_flat_addressing(cpu)) {
 /*
  * Can treat process table addresses as real addresses
  */
@@ -515,7 +526,7 @@ static bool ppc_radix64_xlate_impl(PowerPCCPU *cpu, vaddr 
eaddr,
 relocation = !mmuidx_real(mmu_idx);
 
 /* HV or virtual hypervisor Real Mode Access */
-if (!relocation && (mmuidx_hv(mmu_idx) || cpu->vhyp)) {
+if (!relocation && (mmuidx_hv(mmu_idx) || vhyp_flat_addressing(cpu))) {
 /* In real mode top 4 effective addr bits (mostly) ignored */
 *raddr = eaddr & 0x0FFFULL;
 
@@ -594,7 +605,7 @@ static bool ppc_radix64_xlate_impl(PowerPCCPU *cpu, vaddr 
eaddr,
 g_raddr = eaddr & R_EADDR_MASK;
 }
 
-if (cpu->vhyp) {
+if (vhyp_flat_addressing(cpu)) {
 *raddr = g_raddr;
 } else {
 /*
-- 
2.34.1

[PULL 15/39] target/ppc: cpu_init: Group registration of generic SPRs

[Cédric Le Goater]

From: Fabiano Rosas 

The top level init_proc calls register_generic_sprs but also registers
some other SPRs outside of that function. Let's group everything into
a single place.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-4-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 58 ---
 1 file changed, 32 insertions(+), 26 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index ec29ccf473e6..1fb17a5e5112 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -150,8 +150,11 @@ static void _spr_register(CPUPPCState *env, int num, const 
char *name,
  oea_read, oea_write, 0, ival)
 
 /* Generic PowerPC SPRs */
-static void register_generic_sprs(CPUPPCState *env)
+static void register_generic_sprs(PowerPCCPU *cpu)
 {
+PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
+CPUPPCState *env = >env;
+
 /* Integer processing */
 spr_register(env, SPR_XER, "XER",
  _read_xer, _write_xer,
@@ -192,6 +195,32 @@ static void register_generic_sprs(CPUPPCState *env)
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
+
+spr_register(env, SPR_PVR, "PVR",
+ /* Linux permits userspace to read PVR */
+#if defined(CONFIG_LINUX_USER)
+ _read_generic,
+#else
+ SPR_NOACCESS,
+#endif
+ SPR_NOACCESS,
+ _read_generic, SPR_NOACCESS,
+ pcc->pvr);
+
+/* Register SVR if it's defined to anything else than POWERPC_SVR_NONE */
+if (pcc->svr != POWERPC_SVR_NONE) {
+if (pcc->svr & POWERPC_SVR_E500) {
+spr_register(env, SPR_E500_SVR, "SVR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, SPR_NOACCESS,
+ pcc->svr & ~POWERPC_SVR_E500);
+} else {
+spr_register(env, SPR_SVR, "SVR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, SPR_NOACCESS,
+ pcc->svr);
+}
+}
 }
 
 /* SPR common to all non-embedded PowerPC, including 601 */
@@ -7237,31 +7266,8 @@ static void init_ppc_proc(PowerPCCPU *cpu)
 env->tlb_type = TLB_NONE;
 #endif
 /* Register SPR common to all PowerPC implementations */
-register_generic_sprs(env);
-spr_register(env, SPR_PVR, "PVR",
- /* Linux permits userspace to read PVR */
-#if defined(CONFIG_LINUX_USER)
- _read_generic,
-#else
- SPR_NOACCESS,
-#endif
- SPR_NOACCESS,
- _read_generic, SPR_NOACCESS,
- pcc->pvr);
-/* Register SVR if it's defined to anything else than POWERPC_SVR_NONE */
-if (pcc->svr != POWERPC_SVR_NONE) {
-if (pcc->svr & POWERPC_SVR_E500) {
-spr_register(env, SPR_E500_SVR, "SVR",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, SPR_NOACCESS,
- pcc->svr & ~POWERPC_SVR_E500);
-} else {
-spr_register(env, SPR_SVR, "SVR",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, SPR_NOACCESS,
- pcc->svr);
-}
-}
+register_generic_sprs(cpu);
+
 /* PowerPC implementation specific initialisations (SPRs, timers, ...) */
 (*pcc->init_proc)(env);
 
-- 
2.34.1

[PULL 29/39] target/ppc: cpu_init: Move 604e SPR registration into a function

[Cédric Le Goater]

From: Fabiano Rosas 

This is done to improve init_proc readability and to make subsequent
patches that touch this code a bit cleaner.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-18-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 43 ---
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 62eec9e6f065..f75aaf98c303 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -743,6 +743,29 @@ static void register_604_sprs(CPUPPCState *env)
  0x);
 }
 
+static void register_604e_sprs(CPUPPCState *env)
+{
+spr_register(env, SPR_7XX_MMCR1, "MMCR1",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+
+spr_register(env, SPR_7XX_PMC3, "PMC3",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+
+spr_register(env, SPR_7XX_PMC4, "PMC4",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+/* Hardware implementation registers */
+spr_register(env, SPR_HID1, "HID1",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+}
+
 /* SPR specific to PowerPC 603 implementation */
 static void register_603_sprs(CPUPPCState *env)
 {
@@ -3914,26 +3937,8 @@ static void init_proc_604E(CPUPPCState *env)
 register_ne_601_sprs(env);
 register_sdr1_sprs(env);
 register_604_sprs(env);
+register_604e_sprs(env);
 
-spr_register(env, SPR_7XX_MMCR1, "MMCR1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_7XX_PMC3, "PMC3",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_7XX_PMC4, "PMC4",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-/* Hardware implementation registers */
-spr_register(env, SPR_HID1, "HID1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 /* Memory management */
 register_low_BATs(env);
 init_excp_604(env);
-- 
2.34.1

[PULL 10/39] target/ppc: Add powerpc_reset_excp_state helper

[Cédric Le Goater]

From: Nicholas Piggin 

This moves the logic to reset the QEMU exception state into its own
function.

Reviewed-by: Cédric Le Goater 
Signed-off-by: Nicholas Piggin 
[ clg: checkpatch fixes ]
Message-Id: <20220216102545.1808018-8-npig...@gmail.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/excp_helper.c | 42 +---
 1 file changed, 22 insertions(+), 20 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 6b6ec71bc22a..7499fa187f6f 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -360,12 +360,21 @@ static void ppc_excp_apply_ail(PowerPCCPU *cpu, int excp, 
target_ulong msr,
 }
 #endif
 
-static void powerpc_set_excp_state(PowerPCCPU *cpu,
-  target_ulong vector, target_ulong 
msr)
+static void powerpc_reset_excp_state(PowerPCCPU *cpu)
 {
 CPUState *cs = CPU(cpu);
 CPUPPCState *env = >env;
 
+/* Reset exception state */
+cs->exception_index = POWERPC_EXCP_NONE;
+env->error_code = 0;
+}
+
+static void powerpc_set_excp_state(PowerPCCPU *cpu, target_ulong vector,
+   target_ulong msr)
+{
+CPUPPCState *env = >env;
+
 assert((msr & env->msr_mask) == msr);
 
 /*
@@ -376,21 +385,20 @@ static void powerpc_set_excp_state(PowerPCCPU *cpu,
  * will prevent setting of the HV bit which some exceptions might need
  * to do.
  */
+env->nip = vector;
 env->msr = msr;
 hreg_compute_hflags(env);
-env->nip = vector;
-/* Reset exception state */
-cs->exception_index = POWERPC_EXCP_NONE;
-env->error_code = 0;
 
-/* Reset the reservation */
-env->reserve_addr = -1;
+powerpc_reset_excp_state(cpu);
 
 /*
  * Any interrupt is context synchronizing, check if TCG TLB needs
  * a delayed flush on ppc64
  */
 check_tlb_flush(env, false);
+
+/* Reset the reservation */
+env->reserve_addr = -1;
 }
 
 static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
@@ -471,8 +479,7 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
 case POWERPC_EXCP_FP:
 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
 trace_ppc_excp_fp_ignore();
-cs->exception_index = POWERPC_EXCP_NONE;
-env->error_code = 0;
+powerpc_reset_excp_state(cpu);
 return;
 }
 env->spr[SPR_40x_ESR] = ESR_FP;
@@ -609,8 +616,7 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
 case POWERPC_EXCP_FP:
 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
 trace_ppc_excp_fp_ignore();
-cs->exception_index = POWERPC_EXCP_NONE;
-env->error_code = 0;
+powerpc_reset_excp_state(cpu);
 return;
 }
 
@@ -783,8 +789,7 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
 case POWERPC_EXCP_FP:
 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
 trace_ppc_excp_fp_ignore();
-cs->exception_index = POWERPC_EXCP_NONE;
-env->error_code = 0;
+powerpc_reset_excp_state(cpu);
 return;
 }
 
@@ -969,8 +974,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
 case POWERPC_EXCP_FP:
 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
 trace_ppc_excp_fp_ignore();
-cs->exception_index = POWERPC_EXCP_NONE;
-env->error_code = 0;
+powerpc_reset_excp_state(cpu);
 return;
 }
 
@@ -1168,8 +1172,7 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
 case POWERPC_EXCP_FP:
 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
 trace_ppc_excp_fp_ignore();
-cs->exception_index = POWERPC_EXCP_NONE;
-env->error_code = 0;
+powerpc_reset_excp_state(cpu);
 return;
 }
 
@@ -1406,8 +1409,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
 case POWERPC_EXCP_FP:
 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
 trace_ppc_excp_fp_ignore();
-cs->exception_index = POWERPC_EXCP_NONE;
-env->error_code = 0;
+powerpc_reset_excp_state(cpu);
 return;
 }
 
-- 
2.34.1

[PULL 39/39] target/ppc: Move common SPR functions out of cpu_init

[Cédric Le Goater]

From: Fabiano Rosas 

Let's leave cpu_init with just generic CPU initialization and
QOM-related functions.

The rest of the SPR registration functions will be moved in the
following patches along with the code that uses them. These are only
the commonly used ones.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-28-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/spr_common.h  |   1 +
 target/ppc/cpu_init.c| 400 --
 target/ppc/helper_regs.c | 402 +++
 3 files changed, 403 insertions(+), 400 deletions(-)

diff --git a/target/ppc/spr_common.h b/target/ppc/spr_common.h
index a243c14a11d9..b5a5bc68952e 100644
--- a/target/ppc/spr_common.h
+++ b/target/ppc/spr_common.h
@@ -204,5 +204,6 @@ void register_thrm_sprs(CPUPPCState *env);
 void register_usprgh_sprs(CPUPPCState *env);
 void register_non_embedded_sprs(CPUPPCState *env);
 void register_6xx_7xx_soft_tlb(CPUPPCState *env, int nb_tlbs, int nb_ways);
+void register_generic_sprs(PowerPCCPU *cpu);
 
 #endif
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index a435525ea32f..61d36b11a093 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -57,367 +57,6 @@ static inline void vscr_init(CPUPPCState *env, uint32_t val)
 ppc_store_vscr(env, val);
 }
 
-/**
- * _spr_register
- *
- * Register an SPR with all the callbacks required for tcg,
- * and the ID number for KVM.
- *
- * The reason for the conditional compilation is that the tcg functions
- * may be compiled out, and the system kvm header may not be available
- * for supplying the ID numbers.  This is ugly, but the best we can do.
- */
-void _spr_register(CPUPPCState *env, int num, const char *name,
-   USR_ARG(spr_callback *uea_read)
-   USR_ARG(spr_callback *uea_write)
-   SYS_ARG(spr_callback *oea_read)
-   SYS_ARG(spr_callback *oea_write)
-   SYS_ARG(spr_callback *hea_read)
-   SYS_ARG(spr_callback *hea_write)
-   KVM_ARG(uint64_t one_reg_id)
-   target_ulong initial_value)
-{
-ppc_spr_t *spr = >spr_cb[num];
-
-/* No SPR should be registered twice. */
-assert(spr->name == NULL);
-assert(name != NULL);
-
-spr->name = name;
-spr->default_value = initial_value;
-env->spr[num] = initial_value;
-
-#ifdef CONFIG_TCG
-spr->uea_read = uea_read;
-spr->uea_write = uea_write;
-# ifndef CONFIG_USER_ONLY
-spr->oea_read = oea_read;
-spr->oea_write = oea_write;
-spr->hea_read = hea_read;
-spr->hea_write = hea_write;
-# endif
-#endif
-#ifdef CONFIG_KVM
-spr->one_reg_id = one_reg_id;
-#endif
-}
-
-/* Generic PowerPC SPRs */
-static void register_generic_sprs(PowerPCCPU *cpu)
-{
-PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
-CPUPPCState *env = >env;
-
-/* Integer processing */
-spr_register(env, SPR_XER, "XER",
- _read_xer, _write_xer,
- _read_xer, _write_xer,
- 0x);
-/* Branch control */
-spr_register(env, SPR_LR, "LR",
- _read_lr, _write_lr,
- _read_lr, _write_lr,
- 0x);
-spr_register(env, SPR_CTR, "CTR",
- _read_ctr, _write_ctr,
- _read_ctr, _write_ctr,
- 0x);
-/* Interrupt processing */
-spr_register(env, SPR_SRR0, "SRR0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-spr_register(env, SPR_SRR1, "SRR1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-/* Processor control */
-spr_register(env, SPR_SPRG0, "SPRG0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-spr_register(env, SPR_SPRG1, "SPRG1",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-spr_register(env, SPR_SPRG2, "SPRG2",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-spr_register(env, SPR_SPRG3, "SPRG3",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
-spr_register(env, SPR_PVR, "PVR",
- /* Linux permits userspace to read PVR */
-#if defined(CONFIG_LINUX_USER)
- _read_generic,
-#else
- SPR_NOACCESS,
-#endif
- SPR_NOACCESS,
- _read_generic, SPR_NOACCESS,
- pcc->pvr);
-
-/* Register SVR if it's defined to anything else than POWERPC_SVR_NONE */
-if (pcc->svr != POWERPC_SVR_NONE) {
-if (pcc->svr & 

[PULL 35/39] target/ppc: Rename spr_tcg.h to spr_common.h

[Cédric Le Goater]

From: Fabiano Rosas 

Initial intent for the spr_tcg header was to expose the spr_read|write
callbacks that are only used by TCG code. However, although these
routines are TCG-specific, the KVM code needs access to env->sprs
which creation is currently coupled to the callback registration.

We are probably not going to decouple SPR creation and TCG callback
registration any time soon, so let's rename the header to spr_common
to accomodate the register_*_sprs functions that will be moved out of
cpu_init.c in the following patches.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-24-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/{spr_tcg.h => spr_common.h} | 4 ++--
 target/ppc/cpu_init.c  | 2 +-
 target/ppc/translate.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)
 rename target/ppc/{spr_tcg.h => spr_common.h} (99%)

diff --git a/target/ppc/spr_tcg.h b/target/ppc/spr_common.h
similarity index 99%
rename from target/ppc/spr_tcg.h
rename to target/ppc/spr_common.h
index df2abacc644f..5aec76ade4dd 100644
--- a/target/ppc/spr_tcg.h
+++ b/target/ppc/spr_common.h
@@ -16,8 +16,8 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see .
  */
-#ifndef SPR_TCG_H
-#define SPR_TCG_H
+#ifndef SPR_COMMON_H
+#define SPR_COMMON_H
 
 #define SPR_NOACCESS (_noaccess)
 
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 452dbdda4db6..f0bbe340e4fd 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -44,7 +44,7 @@
 
 #include "helper_regs.h"
 #include "internal.h"
-#include "spr_tcg.h"
+#include "spr_common.h"
 #include "power8-pmu.h"
 
 /* #define PPC_DEBUG_SPR */
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 2eaffd432a9d..ecc5a104e049 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -35,7 +35,7 @@
 #include "exec/translator.h"
 #include "exec/log.h"
 #include "qemu/atomic128.h"
-#include "spr_tcg.h"
+#include "spr_common.h"
 
 #include "qemu/qemu-print.h"
 #include "qapi/error.h"
-- 
2.34.1

Re: [PATCH 2/2] Allow VIRTIO_F_IN_ORDER to be negotiated for vdpa devices

[Michael S. Tsirkin]

On Tue, Feb 15, 2022 at 12:52:31PM +0530, Gautam Dawar wrote:
> This patch adds the ability to negotiate VIRTIO_F_IN_ORDER bit
> for vhost-vdpa backend when the underlying device supports this
> feature.
> This would aid in reaping performance benefits with HW devices
> that implement this feature. At the same time, it shouldn't have
> any negative impact as vhost-vdpa backend doesn't involve any
> userspace virtqueue operations.
> 
> Signed-off-by: Gautam Dawar 

I have a question by the way. Would it be hard for xilinx device
to support VIRTIO_F_PARTIAL_ORDER instead of VIRTIO_F_IN_ORDER.

That proposal is on the virtio TC mailing list, but did not
get feedback from any hardware vendors. Feedback would be much
appreciated.

> ---
>  hw/net/virtio-net.c | 10 ++
>  net/vhost-vdpa.c|  1 +
>  2 files changed, 11 insertions(+)
> 
> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> index cf8ab0f8af..a1089d06f6 100644
> --- a/hw/net/virtio-net.c
> +++ b/hw/net/virtio-net.c
> @@ -3507,11 +3507,21 @@ static void virtio_net_device_realize(DeviceState 
> *dev, Error **errp)
>  nc->rxfilter_notify_enabled = 1;
>  
> if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_VDPA) {
> +uint64_t features = BIT_ULL(VIRTIO_F_IN_ORDER);
>  struct virtio_net_config netcfg = {};
> +
>  memcpy(, >nic_conf.macaddr, ETH_ALEN);
>  vhost_net_set_config(get_vhost_net(nc->peer),
>  (uint8_t *), 0, ETH_ALEN, VHOST_SET_CONFIG_TYPE_MASTER);
> +
> + /*
> + * For vhost-vdpa, if underlying device supports IN_ORDER feature,
> + * make it available for negotiation.
> + */
> + features = vhost_net_get_features(get_vhost_net(nc->peer), features);
> + n->host_features |= features;
>  }
> +
>  QTAILQ_INIT(>rsc_chains);
>  n->qdev = dev;
>  
> diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
> index 25dd6dd975..2886cba5ec 100644
> --- a/net/vhost-vdpa.c
> +++ b/net/vhost-vdpa.c
> @@ -62,6 +62,7 @@ const int vdpa_feature_bits[] = {
>  VIRTIO_NET_F_CTRL_VQ,
>  VIRTIO_F_IOMMU_PLATFORM,
>  VIRTIO_F_RING_PACKED,
> +VIRTIO_F_IN_ORDER,
>  VIRTIO_NET_F_RSS,
>  VIRTIO_NET_F_HASH_REPORT,
>  VIRTIO_NET_F_GUEST_ANNOUNCE,
> -- 
> 2.30.1

[PULL 27/39] target/ppc: cpu_init: Move 755 L2 cache SPRs into a function

[Cédric Le Goater]

From: Fabiano Rosas 

This is just to have 755-specific registers contained into a function,
intead of leaving them open-coded in init_proc_755. It makes init_proc
easier to read and keeps later patches that touch this code a bit
cleaner.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-16-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 24 +++-
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index d5c23785d727..ef9353a7fe43 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -503,6 +503,20 @@ static void register_745_sprs(CPUPPCState *env)
  0x);
 }
 
+static void register_755_sprs(CPUPPCState *env)
+{
+/* L2 cache control */
+spr_register(env, SPR_L2CR, "L2CR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, spr_access_nop,
+ 0x);
+
+spr_register(env, SPR_L2PMCR, "L2PMCR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+}
+
 /* SPR common to all 7xx PowerPC implementations */
 static void register_7xx_sprs(CPUPPCState *env)
 {
@@ -4545,16 +4559,8 @@ static void init_proc_755(CPUPPCState *env)
 register_sdr1_sprs(env);
 register_7xx_sprs(env);
 register_745_sprs(env);
-/* L2 cache control */
-spr_register(env, SPR_L2CR, "L2CR",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, spr_access_nop,
- 0x);
+register_755_sprs(env);
 
-spr_register(env, SPR_L2PMCR, "L2PMCR",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
 /* Thermal management */
 register_thrm_sprs(env);
 
-- 
2.34.1

[PULL 32/39] target/ppc: cpu_init: Reuse init_proc_745 for the 755

[Cédric Le Goater]

From: Fabiano Rosas 

The init_proc_755 function is identical to the 745 one except for the
755-specific registers. I think it is worth it to make them share
code.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-21-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 18 +-
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 28e65ba20476..243e05f7625d 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -4544,24 +4544,8 @@ POWERPC_FAMILY(745)(ObjectClass *oc, void *data)
 
 static void init_proc_755(CPUPPCState *env)
 {
-register_ne_601_sprs(env);
-register_sdr1_sprs(env);
-register_7xx_sprs(env);
-register_745_sprs(env);
+init_proc_745(env);
 register_755_sprs(env);
-
-/* Thermal management */
-register_thrm_sprs(env);
-
-/* Memory management */
-register_low_BATs(env);
-register_high_BATs(env);
-register_6xx_7xx_soft_tlb(env, 64, 2);
-init_excp_7x5(env);
-env->dcache_line_size = 32;
-env->icache_line_size = 32;
-/* Allocate hardware IRQ controller */
-ppc6xx_irq_init(env_archcpu(env));
 }
 
 POWERPC_FAMILY(755)(ObjectClass *oc, void *data)
-- 
2.34.1

meson incremental build doesn't handle config file going away

[Peter Maydell]

I've noticed that the meson incremental build doesn't seem to
cleanly handle a config file going away, as ppc64abi32-linux-user
has recently. The build fails with:

../../meson.build:1941:2: ERROR: Failed to load
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/configs/targets/ppc64abi32-linux-user.mak:
[Errno 2] No such file or directory:
'/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/configs/targets/ppc64abi32-linux-user.mak'

where line 1941 is
  config_target += keyval.load('configs/targets' / target + '.mak')

Rerunning make doesn't help; you have to manually re-run
configure.

Something here should figure out that "config file deleted" means
it needs to rerun configure, I think.

thanks
-- PMM

Re: meson incremental build doesn't handle config file going away

[Thomas Huth]

On 18/02/2022 12.59, Peter Maydell wrote:

I've noticed that the meson incremental build doesn't seem to
cleanly handle a config file going away, as ppc64abi32-linux-user
has recently. The build fails with:

../../meson.build:1941:2: ERROR: Failed to load
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/configs/targets/ppc64abi32-linux-user.mak:
[Errno 2] No such file or directory:
'/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/configs/targets/ppc64abi32-linux-user.mak'

where line 1941 is
   config_target += keyval.load('configs/targets' / target + '.mak')

Rerunning make doesn't help; you have to manually re-run
configure.

Something here should figure out that "config file deleted" means
it needs to rerun configure, I think.


That's weird, since the patch that removed that target actually change the 
configure script, too, so it should have re-run configure afterwards... or 
is that broken, too?


 Thomas

[PATCH 2/2] pci-bridge/xio3130_downstream: Fix error handling

[Jonathan Cameron via]

Wrong goto label, so msi cleanup would not occur if there is
an error in the ssvid initialization.

Signed-off-by: Jonathan Cameron 
---
 hw/pci-bridge/xio3130_downstream.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci-bridge/xio3130_downstream.c 
b/hw/pci-bridge/xio3130_downstream.c
index 04aae72cd6..080a6613fe 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -84,7 +84,7 @@ static void xio3130_downstream_realize(PCIDevice *d, Error 
**errp)
XIO3130_SSVID_SVID, XIO3130_SSVID_SSID,
errp);
 if (rc < 0) {
-goto err_bridge;
+goto err_msi;
 }
 
 rc = pcie_cap_init(d, XIO3130_EXP_OFFSET, PCI_EXP_TYPE_DOWNSTREAM,
-- 
2.32.0

Re: [PATCH 2/2] Allow VIRTIO_F_IN_ORDER to be negotiated for vdpa devices

[Eugenio Perez Martin]

On Thu, Feb 17, 2022 at 8:32 AM Michael S. Tsirkin  wrote:
>
> On Tue, Feb 15, 2022 at 12:52:31PM +0530, Gautam Dawar wrote:
> > This patch adds the ability to negotiate VIRTIO_F_IN_ORDER bit
> > for vhost-vdpa backend when the underlying device supports this
> > feature.
> > This would aid in reaping performance benefits with HW devices
> > that implement this feature. At the same time, it shouldn't have
> > any negative impact as vhost-vdpa backend doesn't involve any
> > userspace virtqueue operations.
> >
> > Signed-off-by: Gautam Dawar 
>
> Having features that hardware implements but qemu does not
> means we can't migrate between them.
> So I'd rather see a userspace implementation.
>

While I totally agree the userspace implementation is a better option,
would it be a problem if we implement it as a cmdline option as Jason
proposed?

I see other backends have similar issues with migration. For example
it's possible to run qemu with
-device=virtio-net-pci,...,indirect_desc=on and use a vhost-kernel
backend without indirect support in their features. I also understand
qemu emulated backend as "the base" somehow, but it should work
similarly to my example if cmdline parameter is off by default.

On the other hand, It may be worth thinking if it's worth waiting for
GSoC though, so we avoid this problem entirely at the moment. But I
feel that is going to come back with a different feature set with the
advent of more out of qemu devices and the fast adding of features of
VirtIO.

Thoughts?

Thanks!

> > ---
> >  hw/net/virtio-net.c | 10 ++
> >  net/vhost-vdpa.c|  1 +
> >  2 files changed, 11 insertions(+)
> >
> > diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> > index cf8ab0f8af..a1089d06f6 100644
> > --- a/hw/net/virtio-net.c
> > +++ b/hw/net/virtio-net.c
> > @@ -3507,11 +3507,21 @@ static void virtio_net_device_realize(DeviceState 
> > *dev, Error **errp)
> >  nc->rxfilter_notify_enabled = 1;
> >
> > if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_VDPA) {
> > +uint64_t features = BIT_ULL(VIRTIO_F_IN_ORDER);
> >  struct virtio_net_config netcfg = {};
> > +
> >  memcpy(, >nic_conf.macaddr, ETH_ALEN);
> >  vhost_net_set_config(get_vhost_net(nc->peer),
> >  (uint8_t *), 0, ETH_ALEN, VHOST_SET_CONFIG_TYPE_MASTER);
> > +
> > + /*
> > + * For vhost-vdpa, if underlying device supports IN_ORDER feature,
> > + * make it available for negotiation.
> > + */
> > + features = vhost_net_get_features(get_vhost_net(nc->peer), features);
> > + n->host_features |= features;
> >  }
> > +
> >  QTAILQ_INIT(>rsc_chains);
> >  n->qdev = dev;
> >
> > diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
> > index 25dd6dd975..2886cba5ec 100644
> > --- a/net/vhost-vdpa.c
> > +++ b/net/vhost-vdpa.c
> > @@ -62,6 +62,7 @@ const int vdpa_feature_bits[] = {
> >  VIRTIO_NET_F_CTRL_VQ,
> >  VIRTIO_F_IOMMU_PLATFORM,
> >  VIRTIO_F_RING_PACKED,
> > +VIRTIO_F_IN_ORDER,
> >  VIRTIO_NET_F_RSS,
> >  VIRTIO_NET_F_HASH_REPORT,
> >  VIRTIO_NET_F_GUEST_ANNOUNCE,
> > --
> > 2.30.1
>

[PULL 37/39] target/ppc: cpu_init: Move SPR registration macros to a header

[Cédric Le Goater]

From: Fabiano Rosas 

Put the SPR registration macros in a header that is accessible outside
of cpu_init.c. The following patches will move CPU-specific code to
separate files and will need to access it.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-26-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/spr_common.h | 56 +++
 target/ppc/cpu_init.c   | 65 ++---
 2 files changed, 65 insertions(+), 56 deletions(-)

diff --git a/target/ppc/spr_common.h b/target/ppc/spr_common.h
index 329b7e91a23a..a243c14a11d9 100644
--- a/target/ppc/spr_common.h
+++ b/target/ppc/spr_common.h
@@ -21,6 +21,62 @@
 
 #define SPR_NOACCESS (_noaccess)
 
+#ifdef CONFIG_TCG
+# define USR_ARG(X)X,
+# ifdef CONFIG_USER_ONLY
+#  define SYS_ARG(X)
+# else
+#  define SYS_ARG(X)   X,
+# endif
+#else
+# define USR_ARG(X)
+# define SYS_ARG(X)
+#endif
+#ifdef CONFIG_KVM
+# define KVM_ARG(X)X,
+#else
+# define KVM_ARG(X)
+#endif
+
+typedef void spr_callback(DisasContext *, int, int);
+
+void _spr_register(CPUPPCState *env, int num, const char *name,
+   USR_ARG(spr_callback *uea_read)
+   USR_ARG(spr_callback *uea_write)
+   SYS_ARG(spr_callback *oea_read)
+   SYS_ARG(spr_callback *oea_write)
+   SYS_ARG(spr_callback *hea_read)
+   SYS_ARG(spr_callback *hea_write)
+   KVM_ARG(uint64_t one_reg_id)
+   target_ulong initial_value);
+
+/* spr_register_kvm_hv passes all required arguments. */
+#define spr_register_kvm_hv(env, num, name, uea_read, uea_write, \
+oea_read, oea_write, hea_read, hea_write,\
+one_reg_id, initial_value)   \
+_spr_register(env, num, name,\
+  USR_ARG(uea_read) USR_ARG(uea_write)   \
+  SYS_ARG(oea_read) SYS_ARG(oea_write)   \
+  SYS_ARG(hea_read) SYS_ARG(hea_write)   \
+  KVM_ARG(one_reg_id) initial_value)
+
+/* spr_register_kvm duplicates the oea callbacks to the hea callbacks. */
+#define spr_register_kvm(env, num, name, uea_read, uea_write,\
+ oea_read, oea_write, one_reg_id, ival)  \
+spr_register_kvm_hv(env, num, name, uea_read, uea_write, oea_read,   \
+oea_write, oea_read, oea_write, one_reg_id, ival)
+
+/* spr_register_hv and spr_register are similar, except there is no kvm id. */
+#define spr_register_hv(env, num, name, uea_read, uea_write, \
+oea_read, oea_write, hea_read, hea_write, ival)  \
+spr_register_kvm_hv(env, num, name, uea_read, uea_write, oea_read,   \
+oea_write, hea_read, hea_write, 0, ival)
+
+#define spr_register(env, num, name, uea_read, uea_write,\
+ oea_read, oea_write, ival)  \
+spr_register_kvm(env, num, name, uea_read, uea_write,\
+ oea_read, oea_write, 0, ival)
+
 /* prototypes for readers and writers for SPRs */
 void spr_noaccess(DisasContext *ctx, int gprn, int sprn);
 void spr_read_generic(DisasContext *ctx, int gprn, int sprn);
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 40dd2c0fd813..c17994ec5876 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -67,35 +67,15 @@ static inline void vscr_init(CPUPPCState *env, uint32_t val)
  * may be compiled out, and the system kvm header may not be available
  * for supplying the ID numbers.  This is ugly, but the best we can do.
  */
-
-#ifdef CONFIG_TCG
-# define USR_ARG(X)X,
-# ifdef CONFIG_USER_ONLY
-#  define SYS_ARG(X)
-# else
-#  define SYS_ARG(X)   X,
-# endif
-#else
-# define USR_ARG(X)
-# define SYS_ARG(X)
-#endif
-#ifdef CONFIG_KVM
-# define KVM_ARG(X)X,
-#else
-# define KVM_ARG(X)
-#endif
-
-typedef void spr_callback(DisasContext *, int, int);
-
-static void _spr_register(CPUPPCState *env, int num, const char *name,
-  USR_ARG(spr_callback *uea_read)
-  USR_ARG(spr_callback *uea_write)
-  SYS_ARG(spr_callback *oea_read)
-  SYS_ARG(spr_callback *oea_write)
-  SYS_ARG(spr_callback *hea_read)
-  SYS_ARG(spr_callback *hea_write)
-  KVM_ARG(uint64_t one_reg_id)
-  target_ulong initial_value)
+void _spr_register(CPUPPCState *env, int num, const char *name,
+   USR_ARG(spr_callback *uea_read)
+   USR_ARG(spr_callback *uea_write)
+   SYS_ARG(spr_callback *oea_read)
+ 

[PULL 36/39] target/ppc: cpu_init: Expose some SPR registration helpers

[Cédric Le Goater]

From: Fabiano Rosas 

The following patches will move CPU-specific code into separate files,
so expose the most used SPR registration functions:

register_sdr1_sprs | 22 callers
register_low_BATs  | 20 callers
register_non_embedded_sprs | 19 callers
register_high_BATs | 10 callers
register_thrm_sprs | 8 callers
register_usprgh_sprs   | 6 callers
register_6xx_7xx_soft_tlb  | only 3 callers, but it helps to
 keep the soft TLB code consistent.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-25-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/spr_common.h |  8 
 target/ppc/cpu_init.c   | 14 +++---
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/target/ppc/spr_common.h b/target/ppc/spr_common.h
index 5aec76ade4dd..329b7e91a23a 100644
--- a/target/ppc/spr_common.h
+++ b/target/ppc/spr_common.h
@@ -141,4 +141,12 @@ void spr_write_hmer(DisasContext *ctx, int sprn, int gprn);
 void spr_write_lpcr(DisasContext *ctx, int sprn, int gprn);
 #endif
 
+void register_low_BATs(CPUPPCState *env);
+void register_high_BATs(CPUPPCState *env);
+void register_sdr1_sprs(CPUPPCState *env);
+void register_thrm_sprs(CPUPPCState *env);
+void register_usprgh_sprs(CPUPPCState *env);
+void register_non_embedded_sprs(CPUPPCState *env);
+void register_6xx_7xx_soft_tlb(CPUPPCState *env, int nb_tlbs, int nb_ways);
+
 #endif
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index f0bbe340e4fd..40dd2c0fd813 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -241,7 +241,7 @@ static void register_generic_sprs(PowerPCCPU *cpu)
  0x);
 }
 
-static void register_non_embedded_sprs(CPUPPCState *env)
+void register_non_embedded_sprs(CPUPPCState *env)
 {
 /* Exception processing */
 spr_register_kvm(env, SPR_DSISR, "DSISR",
@@ -260,7 +260,7 @@ static void register_non_embedded_sprs(CPUPPCState *env)
 }
 
 /* Storage Description Register 1 */
-static void register_sdr1_sprs(CPUPPCState *env)
+void register_sdr1_sprs(CPUPPCState *env)
 {
 #ifndef CONFIG_USER_ONLY
 if (env->has_hv_mode) {
@@ -283,7 +283,7 @@ static void register_sdr1_sprs(CPUPPCState *env)
 }
 
 /* BATs 0-3 */
-static void register_low_BATs(CPUPPCState *env)
+void register_low_BATs(CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
 spr_register(env, SPR_IBAT0U, "IBAT0U",
@@ -355,7 +355,7 @@ static void register_low_BATs(CPUPPCState *env)
 }
 
 /* BATs 4-7 */
-static void register_high_BATs(CPUPPCState *env)
+void register_high_BATs(CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
 spr_register(env, SPR_IBAT4U, "IBAT4U",
@@ -427,7 +427,7 @@ static void register_high_BATs(CPUPPCState *env)
 }
 
 /* Softare table search registers */
-static void register_6xx_7xx_soft_tlb(CPUPPCState *env, int nb_tlbs, int 
nb_ways)
+void register_6xx_7xx_soft_tlb(CPUPPCState *env, int nb_tlbs, int nb_ways)
 {
 #if !defined(CONFIG_USER_ONLY)
 env->nb_tlb = nb_tlbs;
@@ -667,7 +667,7 @@ static void register_iamr_sprs(CPUPPCState *env)
 }
 #endif /* TARGET_PPC64 */
 
-static void register_thrm_sprs(CPUPPCState *env)
+void register_thrm_sprs(CPUPPCState *env)
 {
 /* Thermal management */
 spr_register(env, SPR_THRM1, "THRM1",
@@ -1072,7 +1072,7 @@ static void register_l3_ctrl(CPUPPCState *env)
  0x);
 }
 
-static void register_usprgh_sprs(CPUPPCState *env)
+void register_usprgh_sprs(CPUPPCState *env)
 {
 spr_register(env, SPR_USPRG4, "USPRG4",
  _read_ureg, SPR_NOACCESS,
-- 
2.34.1

[PULL 38/39] target/ppc: cpu_init: Move check_pow and QOM macros to a header

[Cédric Le Goater]

From: Fabiano Rosas 

These will need to be accessed from other files once we move the CPUs
code to separate files.

The check_pow_hid0 and check_pow_hid0_74xx are too specific to be
moved to a header so I'll deal with them later when splitting this
code between the multiple CPU families.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-27-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu.h  | 39 +++
 target/ppc/cpu_init.c | 37 -
 2 files changed, 39 insertions(+), 37 deletions(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 2baa750729fd..5b01d409b31a 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -2732,4 +2732,43 @@ void dump_mmu(CPUPPCState *env);
 void ppc_maybe_bswap_register(CPUPPCState *env, uint8_t *mem_buf, int len);
 void ppc_store_vscr(CPUPPCState *env, uint32_t vscr);
 uint32_t ppc_get_vscr(CPUPPCState *env);
+
+/*/
+/* Power management enable checks*/
+static inline int check_pow_none(CPUPPCState *env)
+{
+return 0;
+}
+
+static inline int check_pow_nocheck(CPUPPCState *env)
+{
+return 1;
+}
+
+/*/
+/* PowerPC implementations definitions   */
+
+#define POWERPC_FAMILY(_name)   \
+static void \
+glue(glue(ppc_, _name), _cpu_family_class_init)(ObjectClass *, void *); \
+\
+static const TypeInfo   \
+glue(glue(ppc_, _name), _cpu_family_type_info) = {  \
+.name = stringify(_name) "-family-" TYPE_POWERPC_CPU,   \
+.parent = TYPE_POWERPC_CPU, \
+.abstract = true,   \
+.class_init = glue(glue(ppc_, _name), _cpu_family_class_init),  \
+};  \
+\
+static void glue(glue(ppc_, _name), _cpu_family_register_types)(void)   \
+{   \
+type_register_static(   \
+(glue(ppc_, _name), _cpu_family_type_info));   \
+}   \
+\
+type_init(glue(glue(ppc_, _name), _cpu_family_register_types))  \
+\
+static void glue(glue(ppc_, _name), _cpu_family_class_init)
+
+
 #endif /* PPC_CPU_H */
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index c17994ec5876..a435525ea32f 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -2480,18 +2480,6 @@ static void init_excp_POWER10(CPUPPCState *env)
 
 #endif
 
-/*/
-/* Power management enable checks*/
-static int check_pow_none(CPUPPCState *env)
-{
-return 0;
-}
-
-static int check_pow_nocheck(CPUPPCState *env)
-{
-return 1;
-}
-
 static int check_pow_hid0(CPUPPCState *env)
 {
 if (env->spr[SPR_HID0] & 0x00E0) {
@@ -2510,31 +2498,6 @@ static int check_pow_hid0_74xx(CPUPPCState *env)
 return 0;
 }
 
-/*/
-/* PowerPC implementations definitions   */
-
-#define POWERPC_FAMILY(_name)   \
-static void \
-glue(glue(ppc_, _name), _cpu_family_class_init)(ObjectClass *, void *); \
-\
-static const TypeInfo   \
-glue(glue(ppc_, _name), _cpu_family_type_info) = {  \
-.name = stringify(_name) "-family-" TYPE_POWERPC_CPU,   \
-.parent = TYPE_POWERPC_CPU, \
-.abstract = true,   \
-.class_init = glue(glue(ppc_, _name), _cpu_family_class_init),  \
-};  \
-\
-static 

Re: [PATCH v5 00/15] hw/nvme: SR-IOV with Virtualization Enhancements

[Michael S. Tsirkin]

On Fri, Feb 18, 2022 at 09:51:12AM +0100, Klaus Jensen wrote:
> On Feb 18 03:26, Michael S. Tsirkin wrote:
> > On Thu, Feb 17, 2022 at 06:44:49PM +0100, Lukasz Maniak wrote:
> > > Changes since v4:
> > > - Added hello world example for SR-IOV to the docs
> > > - Moved AER initialization from nvme_init_ctrl to nvme_init_state
> > > - Fixed division by zero issue in calculation of vqfrt and vifrt
> > >   capabilities
> > 
> > 
> > So do you want to merge it all with nvme bits? which tree is this for?
> > Or would you like me to merge the pci bits for now?
> > Thanks!
> > 
> 
> I was wondering how to approach that as well. I think maybe it could all
> go through your tree so the pcie bits doesnt just sit their without
> being used by anything? It's up to you, but note that nvme bits are not
> fully reviewed yet.
> 
> If you are fine with merging the pcie bits then lets do that and we
> merge the nvme bits through the nvme tree. The nvme bits is fully acked,
> so it will go in, just need to finalize the reviews.

Yes, I'm fine with this.

-- 
MST

Re: [PATCH 1/2] pci-bridge/xio3130_upstream: Fix error handling

[Jonathan Cameron via]

On Fri, 18 Feb 2022 10:23:02 +
Jonathan Cameron via  wrote:

> Goto label is incorrect so msi cleanup would not occur if there is
> an error in the ssvid initialization.
> 
> Signed-off-by: Jonathan Cameron 

+Cc: linux...@huawei.com  Turns out you get a weird result if you miss
a space in your git send-email command.  Apologies to Michael for scrambling
his email address as a result!

> ---
> Noticed whilst working on equivalent CXL upstream switch port.
> 
>  hw/pci-bridge/xio3130_upstream.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/pci-bridge/xio3130_upstream.c 
> b/hw/pci-bridge/xio3130_upstream.c
> index 5cd3af4fbc..5ff46ef050 100644
> --- a/hw/pci-bridge/xio3130_upstream.c
> +++ b/hw/pci-bridge/xio3130_upstream.c
> @@ -75,7 +75,7 @@ static void xio3130_upstream_realize(PCIDevice *d, Error 
> **errp)
> XIO3130_SSVID_SVID, XIO3130_SSVID_SSID,
> errp);
>  if (rc < 0) {
> -goto err_bridge;
> +goto err_msi;
>  }
>  
>  rc = pcie_cap_init(d, XIO3130_EXP_OFFSET, PCI_EXP_TYPE_UPSTREAM,

[PULL 34/39] target/ppc: cpu_init: Remove register_usprg3_sprs

[Cédric Le Goater]

From: Fabiano Rosas 

This function registers just one SPR and has only two callers, so open
code it.

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-23-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 21 +++--
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 5980a6a4d312..452dbdda4db6 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1072,14 +1072,6 @@ static void register_l3_ctrl(CPUPPCState *env)
  0x);
 }
 
-static void register_usprg3_sprs(CPUPPCState *env)
-{
-spr_register(env, SPR_USPRG3, "USPRG3",
- _read_ureg, SPR_NOACCESS,
- _read_ureg, SPR_NOACCESS,
- 0x);
-}
-
 static void register_usprgh_sprs(CPUPPCState *env)
 {
 spr_register(env, SPR_USPRG4, "USPRG4",
@@ -3306,7 +3298,12 @@ static void init_proc_e500(CPUPPCState *env, int version)
 break;
 }
 register_BookE_sprs(env, ivor_mask);
-register_usprg3_sprs(env);
+
+spr_register(env, SPR_USPRG3, "USPRG3",
+ _read_ureg, SPR_NOACCESS,
+ _read_ureg, SPR_NOACCESS,
+ 0x);
+
 /* Processor identification */
 spr_register(env, SPR_BOOKE_PIR, "PIR",
  SPR_NOACCESS, SPR_NOACCESS,
@@ -6196,7 +6193,6 @@ static void init_tcg_pmu_power8(CPUPPCState *env)
 static void init_proc_book3s_common(CPUPPCState *env)
 {
 register_non_embedded_sprs(env);
-register_usprg3_sprs(env);
 register_book3s_altivec_sprs(env);
 register_book3s_pmu_sup_sprs(env);
 register_book3s_pmu_user_sprs(env);
@@ -6206,6 +6202,11 @@ static void init_proc_book3s_common(CPUPPCState *env)
  * value is the one used by 74xx processors.
  */
 vscr_init(env, 0x0001);
+
+spr_register(env, SPR_USPRG3, "USPRG3",
+ _read_ureg, SPR_NOACCESS,
+ _read_ureg, SPR_NOACCESS,
+ 0x);
 }
 
 static void init_proc_970(CPUPPCState *env)
-- 
2.34.1

[PULL 13/39] target/ppc: cpu_init: Remove not implemented comments

[Cédric Le Goater]

From: Fabiano Rosas 

The /* XXX : not implemented */ comments all over cpu_init are
confusing and ambiguous.

Do they mean not implemented by QEMU, not implemented in a specific
access mode? Not implemented by the CPU? Do they apply to just the
register right after or to a whole block? Do they mean we have an
action to take in the future to implement these?  Are they only
informative?

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-2-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 582 ++
 1 file changed, 253 insertions(+), 329 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index d97f7183549f..767994fb8f99 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -466,95 +466,91 @@ static void register_G2_755_sprs(CPUPPCState *env)
 static void register_7xx_sprs(CPUPPCState *env)
 {
 /* Breakpoints */
-/* XXX : not implemented */
 spr_register_kvm(env, SPR_DABR, "DABR",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  KVM_REG_PPC_DABR, 0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_IABR, "IABR",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
 /* Cache management */
-/* XXX : not implemented */
 spr_register(env, SPR_ICTC, "ICTC",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
 /* Performance monitors */
-/* XXX : not implemented */
 spr_register(env, SPR_7XX_MMCR0, "MMCR0",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_MMCR1, "MMCR1",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_PMC1, "PMC1",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_PMC2, "PMC2",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_PMC3, "PMC3",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_PMC4, "PMC4",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_SIAR, "SIAR",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, SPR_NOACCESS,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_UMMCR0, "UMMCR0",
  _read_ureg, SPR_NOACCESS,
  _read_ureg, SPR_NOACCESS,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_UMMCR1, "UMMCR1",
  _read_ureg, SPR_NOACCESS,
  _read_ureg, SPR_NOACCESS,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_UPMC1, "UPMC1",
  _read_ureg, SPR_NOACCESS,
  _read_ureg, SPR_NOACCESS,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_UPMC2, "UPMC2",
  _read_ureg, SPR_NOACCESS,
  _read_ureg, SPR_NOACCESS,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_UPMC3, "UPMC3",
  _read_ureg, SPR_NOACCESS,
  _read_ureg, SPR_NOACCESS,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_UPMC4, "UPMC4",
  _read_ureg, SPR_NOACCESS,
  _read_ureg, SPR_NOACCESS,
  0x);
-/* XXX : not implemented */
+
 spr_register(env, SPR_7XX_USIAR, "USIAR",
  _read_ureg, SPR_NOACCESS,
  _read_ureg, SPR_NOACCESS,
  0x);
 /* External access control */
-/* XXX : not implemented */
 spr_register(env, SPR_EAR, "EAR",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
@@ -609,17 +605,16 @@ static void register_iamr_sprs(CPUPPCState *env)
 static void register_thrm_sprs(CPUPPCState *env)
 {
 /* Thermal management */
-/* XXX : not implemented */
 spr_register(env, SPR_THRM1, "THRM1",
  SPR_NOACCESS, 

[PULL 24/39] target/ppc: cpu_init: Deduplicate 604 SPR registration

[Cédric Le Goater]

From: Fabiano Rosas 

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-13-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 17 +++--
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 017a3b4b2979..970dc4ed0d73 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -694,6 +694,12 @@ static void register_604_sprs(CPUPPCState *env)
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
  0x);
+
+/* Hardware implementation registers */
+spr_register(env, SPR_HID0, "HID0",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
 }
 
 /* SPR specific to PowerPC 603 implementation */
@@ -3807,11 +3813,7 @@ static void init_proc_604(CPUPPCState *env)
 register_ne_601_sprs(env);
 register_sdr1_sprs(env);
 register_604_sprs(env);
-/* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
+
 /* Memory management */
 register_low_BATs(env);
 init_excp_604(env);
@@ -3881,11 +3883,6 @@ static void init_proc_604E(CPUPPCState *env)
  _read_generic, _write_generic,
  0x);
 /* Hardware implementation registers */
-spr_register(env, SPR_HID0, "HID0",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-
 spr_register(env, SPR_HID1, "HID1",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_generic, _write_generic,
-- 
2.34.1

[PULL 31/39] target/ppc: cpu_init: Reuse init_proc_604 for the 604e

[Cédric Le Goater]

From: Fabiano Rosas 

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-20-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 12 +---
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 794486dd3a4d..28e65ba20476 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -3922,18 +3922,8 @@ POWERPC_FAMILY(604)(ObjectClass *oc, void *data)
 
 static void init_proc_604E(CPUPPCState *env)
 {
-register_ne_601_sprs(env);
-register_sdr1_sprs(env);
-register_604_sprs(env);
+init_proc_604(env);
 register_604e_sprs(env);
-
-/* Memory management */
-register_low_BATs(env);
-init_excp_604(env);
-env->dcache_line_size = 32;
-env->icache_line_size = 32;
-/* Allocate hardware IRQ controller */
-ppc6xx_irq_init(env_archcpu(env));
 }
 
 POWERPC_FAMILY(604E)(ObjectClass *oc, void *data)
-- 
2.34.1

[PULL 18/39] target/ppc: cpu_init: Move 405 SPRs into register_405_sprs

[Cédric Le Goater]

From: Fabiano Rosas 

Signed-off-by: Fabiano Rosas 
Reviewed-by: David Gibson 
Message-Id: <20220216162426.1885923-7-faro...@linux.ibm.com>
Signed-off-by: Cédric Le Goater 
---
 target/ppc/cpu_init.c | 24 +---
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 53409a176ac3..c0990b43a2b3 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1425,6 +1425,18 @@ static void register_405_sprs(CPUPPCState *env)
  SPR_NOACCESS, SPR_NOACCESS,
  spr_read_generic, _write_generic,
  0x);
+
+/* Bus access control */
+/* not emulated, as QEMU never does speculative access */
+spr_register(env, SPR_40x_SGR, "SGR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
+/* not emulated, as QEMU do not emulate caches */
+spr_register(env, SPR_40x_DCWR, "DCWR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ _read_generic, _write_generic,
+ 0x);
 }
 
 
@@ -2316,17 +2328,7 @@ static void init_proc_405(CPUPPCState *env)
 register_40x_sprs(env);
 register_405_sprs(env);
 register_usprgh_sprs(env);
-/* Bus access control */
-/* not emulated, as QEMU never does speculative access */
-spr_register(env, SPR_40x_SGR, "SGR",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
-/* not emulated, as QEMU do not emulate caches */
-spr_register(env, SPR_40x_DCWR, "DCWR",
- SPR_NOACCESS, SPR_NOACCESS,
- _read_generic, _write_generic,
- 0x);
+
 /* Memory management */
 #if !defined(CONFIG_USER_ONLY)
 env->nb_tlb = 64;
-- 
2.34.1

Re: [PATCH v2 0/7] aspeed extensions

[Cédric Le Goater]

Peter,

On 2/18/22 09:18, Cédric Le Goater wrote:

Hi,

Here is a set of extensions for the Aspeed machines, the most
important ones being the removal of a deprecated machine and a simple
model for the Secure Boot Controller, both from Joel.


I have a PR ready to be sent if there are no further comments.

Thanks,

C.