Re: [PATCH v3 1/1] util/async-teardown: wire up query-command-line-options

[Thomas Huth]

On 24/03/2023 20.10, Claudio Imbrenda wrote:

On Fri, 24 Mar 2023 18:56:06 +0100
Thomas Huth  wrote:


On 24/03/2023 18.45, Claudio Imbrenda wrote:

The recently introduced -async-teardown commandline option was not
wired up properly and did not show up in the output of the QMP command
query-command-line-options. This means that libvirt will have no way to
discover whether the feature is supported.

This patch fixes the issue by correctly wiring up the commandline
option so that it appears in the output of query-command-line-options.

Reported-by: Boris Fiuczynski 
Fixes: c891c24b1a ("os-posix: asynchronous teardown for shutdown on Linux")
Signed-off-by: Claudio Imbrenda 
---
   os-posix.c| 14 ++
   qemu-options.hx   | 35 ---
   util/async-teardown.c | 21 +
   3 files changed, 59 insertions(+), 11 deletions(-)

diff --git a/os-posix.c b/os-posix.c
index 5adc69f560..48acd7acf5 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -36,6 +36,8 @@
   #include "qemu/log.h"
   #include "sysemu/runstate.h"
   #include "qemu/cutils.h"
+#include "qemu/config-file.h"
+#include "qemu/option.h"
   
   #ifdef CONFIG_LINUX

   #include 
@@ -132,6 +134,8 @@ static bool os_parse_runas_uid_gid(const char *optarg)
*/
   int os_parse_cmd_args(int index, const char *optarg)
   {
+QemuOpts *opts;
+
   switch (index) {
   case QEMU_OPTION_runas:
   user_pwd = getpwnam(optarg);
@@ -155,6 +159,16 @@ int os_parse_cmd_args(int index, const char *optarg)
   case QEMU_OPTION_asyncteardown:
   init_async_teardown();
   break;
+case QEMU_OPTION_teardown:
+opts = qemu_opts_parse_noisily(qemu_find_opts("teardown"),
+   optarg, false);
+if (!opts) {
+return -1;
+}
+if (qemu_opt_get_bool(opts, "async", false)) {
+init_async_teardown();
+}
+break;
   #endif
   default:
   return -1;
diff --git a/qemu-options.hx b/qemu-options.hx
index d42f60fb91..8582980b12 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4766,20 +4766,33 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", 
QEMU_ARCH_ALL)
   DEF("async-teardown", 0, QEMU_OPTION_asyncteardown,
   "-async-teardown enable asynchronous teardown\n",
   QEMU_ARCH_ALL)
-#endif
   SRST
   ``-async-teardown``
-Enable asynchronous teardown. A new process called "cleanup/"
-will be created at startup sharing the address space with the main qemu
-process, using clone. It will wait for the main qemu process to
-terminate completely, and then exit.
-This allows qemu to terminate very quickly even if the guest was
-huge, leaving the teardown of the address space to the cleanup
-process. Since the cleanup process shares the same cgroups as the
-main qemu process, accounting is performed correctly. This only
-works if the cleanup process is not forcefully killed with SIGKILL
-before the main qemu process has terminated completely.
+Equivalent to -teardown async=on


We should avoid of providing multiple ways of doing the same thing to the
users if there is no real benefit. So I'd vote for either removing the
"-async-teardown" option here directly (since it just has been introduced in
7.2 and there are no known users out there yet), or at least deprecate it
(put an entry in docs/about/deprecated.rst), so we can remove it again in


both are fine for me (although I have a slight preference for removing
it altogether)


If nobody objects, i.e. if we feel certain that nobody is really using the 
old option yet, I'd also prefer if we'd remove it immediately.


 Thomas

Re: [PATCH v3 1/1] util/async-teardown: wire up query-command-line-options

[Thomas Huth]

On 24/03/2023 18.45, Claudio Imbrenda wrote:

The recently introduced -async-teardown commandline option was not
wired up properly and did not show up in the output of the QMP command
query-command-line-options. This means that libvirt will have no way to
discover whether the feature is supported.

This patch fixes the issue by correctly wiring up the commandline
option so that it appears in the output of query-command-line-options.

Reported-by: Boris Fiuczynski 
Fixes: c891c24b1a ("os-posix: asynchronous teardown for shutdown on Linux")
Signed-off-by: Claudio Imbrenda 
---
  os-posix.c| 14 ++
  qemu-options.hx   | 35 ---
  util/async-teardown.c | 21 +
  3 files changed, 59 insertions(+), 11 deletions(-)

diff --git a/os-posix.c b/os-posix.c
index 5adc69f560..48acd7acf5 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -36,6 +36,8 @@
  #include "qemu/log.h"
  #include "sysemu/runstate.h"
  #include "qemu/cutils.h"
+#include "qemu/config-file.h"
+#include "qemu/option.h"
  
  #ifdef CONFIG_LINUX

  #include 
@@ -132,6 +134,8 @@ static bool os_parse_runas_uid_gid(const char *optarg)
   */
  int os_parse_cmd_args(int index, const char *optarg)
  {
+QemuOpts *opts;
+
  switch (index) {
  case QEMU_OPTION_runas:
  user_pwd = getpwnam(optarg);
@@ -155,6 +159,16 @@ int os_parse_cmd_args(int index, const char *optarg)
  case QEMU_OPTION_asyncteardown:
  init_async_teardown();
  break;
+case QEMU_OPTION_teardown:
+opts = qemu_opts_parse_noisily(qemu_find_opts("teardown"),
+   optarg, false);
+if (!opts) {
+return -1;


Maybe it's better to use exit(1) here (like it is done in the -runas part), 
otherwise you get a somewhat weird second error message:


$ ./qemu-system-s390x -teardown aysnc=on
qemu-system-s390x: -teardown aysnc=on: Invalid parameter 'aysnc'
qemu-system-s390x: -teardown aysnc=on: Option not supported in this build


+}
+if (qemu_opt_get_bool(opts, "async", false)) {
+init_async_teardown();
+}
+break;
  #endif
  default:
  return -1;
diff --git a/qemu-options.hx b/qemu-options.hx
index d42f60fb91..8582980b12 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4766,20 +4766,33 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", 
QEMU_ARCH_ALL)
  DEF("async-teardown", 0, QEMU_OPTION_asyncteardown,
  "-async-teardown enable asynchronous teardown\n",
  QEMU_ARCH_ALL)
-#endif
  SRST
  ``-async-teardown``
-Enable asynchronous teardown. A new process called "cleanup/"
-will be created at startup sharing the address space with the main qemu
-process, using clone. It will wait for the main qemu process to
-terminate completely, and then exit.
-This allows qemu to terminate very quickly even if the guest was
-huge, leaving the teardown of the address space to the cleanup
-process. Since the cleanup process shares the same cgroups as the
-main qemu process, accounting is performed correctly. This only
-works if the cleanup process is not forcefully killed with SIGKILL
-before the main qemu process has terminated completely.
+Equivalent to -teardown async=on
+ERST
+
+DEF("teardown", HAS_ARG, QEMU_OPTION_teardown,
+"-teardown async[=on|off]\n"
+"process teardown options\n"
+"async=on enables asynchronous teardown\n"
+   ,
+QEMU_ARCH_ALL)
+SRST
+``-teardown``
+Set process teardown options.
+
+``async=on`` enables asynchronous teardown.  A new process called
+"cleanup/" will be created at startup sharing the address
+space with the main qemu process, using clone.  It will wait for the


While you're at it, we officially spell QEMU with capital letters, so I'd 
maybe do a s/qemu/QEMU/g here.



+main qemu process to terminate completely, and then exit.  This allows
+qemu to terminate very quickly even if the guest was huge, leaving the
+teardown of the address space to the cleanup process.  Since the cleanup
+process shares the same cgroups as the main qemu process, accounting is
+performed correctly.  This only works if the cleanup process is not
+forcefully killed with SIGKILL before the main qemu process has
+terminated completely.
  ERST
+#endif
  
  DEF("msg", HAS_ARG, QEMU_OPTION_msg,

  "-msg [timestamp[=on|off]][,guest-name=[on|off]]\n"
diff --git a/util/async-teardown.c b/util/async-teardown.c
index 62cdeb0f20..4a5dbce958 100644
--- a/util/async-teardown.c
+++ b/util/async-teardown.c
@@ -12,6 +12,9 @@
   */
  
  #include "qemu/osdep.h"

+#include "qemu/config-file.h"
+#include "qemu/option.h"
+#include "qemu/module.h"
  #include 
  #include 
  #include 
@@ -144,3 +147,21 @@ void init_async_teardown(void)
  clone(async_teardown_fn, new_stack_for_clone(), CLONE_VM, NULL);
  sigprocmask(SIG_SETMASK, &old_signals, NU

Re: [RESEND PATCH v2] target/i386: Switch back XFRM value

[Christian Ehrhardt]

On Thu, Oct 27, 2022 at 2:36 AM Yang, Weijiang  wrote:
>
>
> On 10/26/2022 7:57 PM, Zhong, Yang wrote:
> > The previous patch wrongly replaced FEAT_XSAVE_XCR0_{LO|HI} with
> > FEAT_XSAVE_XSS_{LO|HI} in CPUID(EAX=12,ECX=1):{ECX,EDX}, which made
> > SGX enclave only supported SSE and x87 feature(xfrm=0x3).
> >
> > Fixes: 301e90675c3f ("target/i386: Enable support for XSAVES based 
> > features")
> >
> > Signed-off-by: Yang Zhong 
> > ---
> >   target/i386/cpu.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> > index ad623d91e4..19aaed877b 100644
> > --- a/target/i386/cpu.c
> > +++ b/target/i386/cpu.c
> > @@ -5584,8 +5584,8 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
> > uint32_t count,
> >   } else {
> >   *eax &= env->features[FEAT_SGX_12_1_EAX];
> >   *ebx &= 0; /* ebx reserve */
> > -*ecx &= env->features[FEAT_XSAVE_XSS_LO];
> > -*edx &= env->features[FEAT_XSAVE_XSS_HI];
> > +*ecx &= env->features[FEAT_XSAVE_XCR0_LO];
> > +*edx &= env->features[FEAT_XSAVE_XCR0_HI];
>
> Oops, that's my fault to replace with wrong definitions, thanks for the fix!
>
> Reviewed-by:  Yang Weijiang 

Hi,
I do not have any background on this but stumbled over this and wondered,
is there any particular reason why this wasn't applied yet?

It seemed to fix a former mistake, was acked and then ... silence

> >
> >   /* FP and SSE are always allowed regardless of XSAVE/XCR0. */
> >   *ecx |= XSTATE_FP_MASK | XSTATE_SSE_MASK;
>


-- 
Christian Ehrhardt
Senior Staff Engineer, Ubuntu Server
Canonical Ltd

Re: [PATCH v2] virtio: refresh vring region cache after updating a virtqueue size

[Cornelia Huck]

On Fri, Mar 24 2023, Halil Pasic  wrote:

> On Wed, 22 Mar 2023 18:24:33 +0100
> Halil Pasic  wrote:
>
>> > > --- a/hw/s390x/virtio-ccw.c
>> > > +++ b/hw/s390x/virtio-ccw.c
>> > > @@ -237,6 +237,7 @@ static int virtio_ccw_set_vqs(SubchDev *sch, 
>> > > VqInfoBlock *info,
>> > >  return -EINVAL;
>> > >  }
>> > >  virtio_queue_set_num(vdev, index, num);
>> > > +virtio_init_region_cache(vdev, index);
>> > 
>> > Hmm... this is not wrong, but looking at it again, I see that the guest
>> > has no way to change num after our last call to
>> > virtio_init_region_cache() (while setting up the queue addresses.) IOW,
>> > this introduces an extra round trip that is not really needed.
>> >   
>> 
>> I don't quite understand. AFAIU the virtio_init_region_cache() would see
>> the (new) queue addresses but not the new size (num). Yes virtio-ccw
>> already knows the new num but it is yet to call
>> to put it into vdev->vq[n].vring.num from where
>> virtio_init_region_cache() picks it up.
>> 
>> If we were to first virtio_queue_set_num() and only then the address
>> I would understand. But with the code as is, I don't. Am I missing
>> something?
>
> Connie: have you had a chance to have yet another look at this? I
> would like to understand the reason for seeing this differently.

I'm just back from being sick, please give me some time to work through
my backlog.

Re: [PATCH v7 1/3] docs: Add support for TPM devices over I2C bus

[Joel Stanley]

On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:
>
> This is a documentation change for I2C TPM device support.
>
> Qemu already supports devices attached to ISA and sysbus.
> This drop adds support for the I2C bus attached TPM devices.
>
> Signed-off-by: Ninad Palsule 
>
> ---
> V2:
>
> Incorporated Stephen's review comments
> - Added example in the document.
>
> ---
> V4:
> Incorporate Cedric & Stefan's comments
>
> - Added example for ast2600-evb
> - Corrected statement about arm virtual machine.
>
> ---
> V6:
> Incorporated review comments from Stefan.
> ---
>  docs/specs/tpm.rst | 32 
>  1 file changed, 32 insertions(+)
>
> diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
> index 535912a92b..590e670a9a 100644
> --- a/docs/specs/tpm.rst
> +++ b/docs/specs/tpm.rst
> @@ -21,12 +21,16 @@ QEMU files related to TPM TIS interface:
>   - ``hw/tpm/tpm_tis_common.c``
>   - ``hw/tpm/tpm_tis_isa.c``
>   - ``hw/tpm/tpm_tis_sysbus.c``
> + - ``hw/tpm/tpm_tis_i2c.c``
>   - ``hw/tpm/tpm_tis.h``
>
>  Both an ISA device and a sysbus device are available. The former is
>  used with pc/q35 machine while the latter can be instantiated in the
>  Arm virt machine.
>
> +An I2C device support is also provided which can be instantiated in the Arm
> +based emulation machines. This device only supports the TPM 2 protocol.
> +
>  CRB interface
>  -
>
> @@ -348,6 +352,34 @@ In case an Arm virt machine is emulated, use the 
> following command line:
>  -drive if=pflash,format=raw,file=flash0.img,readonly=on \
>  -drive if=pflash,format=raw,file=flash1.img
>
> +In case a ast2600-evb bmc machine is emulated and want to use TPM device
> +attached to I2C bus, use the following command line:
> +
> +.. code-block:: console
> +
> +  qemu-system-arm -M ast2600-evb -nographic \
> +-kernel arch/arm/boot/zImage \
> +-dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \
> +-initrd rootfs.cpio \
> +-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
> +-tpmdev emulator,id=tpm0,chardev=chrtpm \
> +-device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e

For testing, use this command to load the driver to the correct address:

echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device

(I don't know how specific we want to make the instructions, but
adding a line like above would help others from having to re-discover
the command).

> +
> +In case a Rainier bmc machine is emulated and want to use TPM device
> +attached to I2C bus, use the following command line:
> +
> +.. code-block:: console
> +
> +  qemu-system-arm -M rainier-bmc -nographic \
> +-kernel ${IMAGEPATH}/fitImage-linux.bin \
> +-dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \
> +-initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \
> +-drive 
> file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\
> +-net nic -net 
> user,hostfwd=:127.0.0.1:-:22,hostfwd=:127.0.0.1:2443-:443\
> +-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
> +-tpmdev emulator,id=tpm0,chardev=chrtpm \
> +-device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e
> +

I'd drop this example, the above one is enough.

>  In case SeaBIOS is used as firmware, it should show the TPM menu item
>  after entering the menu with 'ESC'.
>
> --
> 2.37.2
>

Re: [PATCH 2/2] qtest: Add a test case for TPM TIS I2C connected to Aspeed I2C controller

[Cédric Le Goater]

On 3/27/23 02:37, Stefan Berger wrote:

Add a test case for the TPM TIS I2C device exercising most of its
functionality, including localities.

Add library functions for being able to read from and write to registers
of the TPM TIS I2C device connected to the Aspeed i2c controller.

Signed-off-by: Stefan Berger 


Thanks for doing the I2C qtest driver. This gives the opportunity to write
more unit tests.


---
  tests/qtest/meson.build|   3 +
  tests/qtest/qtest_aspeed.c | 117 ++
  tests/qtest/qtest_aspeed.h |  27 ++
  tests/qtest/tpm-tis-i2c-test.c | 628 +
  4 files changed, 775 insertions(+)
  create mode 100644 tests/qtest/qtest_aspeed.c
  create mode 100644 tests/qtest/qtest_aspeed.h
  create mode 100644 tests/qtest/tpm-tis-i2c-test.c

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 29a4efb4c2..065a00d34d 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -200,6 +200,7 @@ qtests_arm = \
(config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
(config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
(config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : 
[]) + \
+  (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : 
[]) + \
['arm-cpu-features',
 'microbit-test',
 'test-arm-mptimer',
@@ -212,6 +213,7 @@ qtests_aarch64 = \
  ['tpm-tis-device-test', 'tpm-tis-device-swtpm-test'] : []) +  
   \
(config_all_devices.has_key('CONFIG_XLNX_ZYNQMP_ARM') ? ['xlnx-can-test', 
'fuzz-xlnx-dp-test'] : []) + \
(config_all_devices.has_key('CONFIG_RASPI') ? ['bcm2835-dma-test'] : []) +  
\
+  (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : 
[]) + \
['arm-cpu-features',
 'numa-test',
 'boot-serial-test',
@@ -303,6 +305,7 @@ qtests = {
'tpm-crb-test': [io, tpmemu_files],
'tpm-tis-swtpm-test': [io, tpmemu_files, 'tpm-tis-util.c'],
'tpm-tis-test': [io, tpmemu_files, 'tpm-tis-util.c'],
+  'tpm-tis-i2c-test': [io, tpmemu_files, 'qtest_aspeed.c'],
'tpm-tis-device-swtpm-test': [io, tpmemu_files, 'tpm-tis-util.c'],
'tpm-tis-device-test': [io, tpmemu_files, 'tpm-tis-util.c'],
'vmgenid-test': files('boot-sector.c', 'acpi-utils.c'),
diff --git a/tests/qtest/qtest_aspeed.c b/tests/qtest/qtest_aspeed.c
new file mode 100644
index 00..2b316178e4
--- /dev/null
+++ b/tests/qtest/qtest_aspeed.c
@@ -0,0 +1,117 @@
+/*
+ * Aspeed i2c bus interface to reading and writing to i2c device registers
+ *
+ * Copyright (c) 2023 IBM Corporation
+ *
+ * Authors:
+ *   Stefan Berger 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "qtest_aspeed.h"
+
+#include "hw/i2c/aspeed_i2c.h"
+#include "libqtest-single.h"
+
+#define A_I2CD_M_STOP_CMD   BIT(5)
+#define A_I2CD_M_RX_CMD BIT(3)
+#define A_I2CD_M_TX_CMD BIT(1)
+#define A_I2CD_M_START_CMD  BIT(0)
+
+#define A_I2CD_MASTER_ENBIT(0)


Why do you need to include the aspeed_i2c.h file and add some more
definitions ? Couldn't we gather all of them under the same file ?


+
+static void aspeed_i2c_startup(uint32_t baseaddr, uint8_t slave_addr,
+   uint8_t reg)
+{
+uint32_t v;
+static int once;
+
+if (!once) {
+/* one time: enable master */
+   writel(baseaddr + A_I2CC_FUN_CTRL, 0);
+   v = readl(baseaddr + A_I2CC_FUN_CTRL) | A_I2CD_MASTER_EN;
+   writel(baseaddr + A_I2CC_FUN_CTRL, v);
+   once = 1;
+}
+
+/* select device */
+writel(baseaddr + A_I2CD_BYTE_BUF, slave_addr << 1);
+writel(baseaddr + A_I2CD_CMD, A_I2CD_M_START_CMD | A_I2CD_M_RX_CMD);
+
+/* select the register to write to */
+writel(baseaddr + A_I2CD_BYTE_BUF, reg);
+writel(baseaddr + A_I2CD_CMD, A_I2CD_M_TX_CMD);
+}
+
+static uint32_t aspeed_i2c_read_n(uint32_t baseaddr, uint8_t slave_addr,
+  uint8_t reg, size_t nbytes)
+{
+uint32_t res = 0;
+uint32_t v;
+size_t i;
+
+aspeed_i2c_startup(baseaddr, slave_addr, reg);
+
+for (i = 0; i < nbytes; i++) {
+writel(baseaddr + A_I2CD_CMD, A_I2CD_M_RX_CMD);
+v = readl(baseaddr + A_I2CD_BYTE_BUF) >> 8;
+res |= (v & 0xff) << (i * 8);
+}
+
+writel(baseaddr + A_I2CD_CMD, A_I2CD_M_STOP_CMD);
+
+return res;
+}
+
+uint32_t aspeed_i2c_readl(uint32_t baseaddr, uint8_t slave_addr, uint8_t reg)
+{
+return aspeed_i2c_read_n(baseaddr, slave_addr, reg, sizeof(uint32_t));
+}
+
+uint16_t aspeed_i2c_readw(uint32_t baseaddr, uint8_t slave_addr, uint8_t reg)
+{
+return aspeed_i2c_read_n(baseaddr, slave_addr, reg, sizeof(uint16_t));
+}
+
+uint8_t aspeed_i2c_readb(uint32_t baseaddr, uint8_t slave_addr, uint8_t reg)
+{
+return aspeed_i2c_read_n(baseaddr, slave_addr, reg, size

Re: [PATCH v7 1/3] docs: Add support for TPM devices over I2C bus

[Cédric Le Goater]

On 3/27/23 09:47, Joel Stanley wrote:

On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:


This is a documentation change for I2C TPM device support.

Qemu already supports devices attached to ISA and sysbus.
This drop adds support for the I2C bus attached TPM devices.

Signed-off-by: Ninad Palsule 

---
V2:

Incorporated Stephen's review comments
- Added example in the document.

---
V4:
Incorporate Cedric & Stefan's comments

- Added example for ast2600-evb
- Corrected statement about arm virtual machine.

---
V6:
Incorporated review comments from Stefan.
---
  docs/specs/tpm.rst | 32 
  1 file changed, 32 insertions(+)

diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
index 535912a92b..590e670a9a 100644
--- a/docs/specs/tpm.rst
+++ b/docs/specs/tpm.rst
@@ -21,12 +21,16 @@ QEMU files related to TPM TIS interface:
   - ``hw/tpm/tpm_tis_common.c``
   - ``hw/tpm/tpm_tis_isa.c``
   - ``hw/tpm/tpm_tis_sysbus.c``
+ - ``hw/tpm/tpm_tis_i2c.c``
   - ``hw/tpm/tpm_tis.h``

  Both an ISA device and a sysbus device are available. The former is
  used with pc/q35 machine while the latter can be instantiated in the
  Arm virt machine.

+An I2C device support is also provided which can be instantiated in the Arm
+based emulation machines. This device only supports the TPM 2 protocol.
+
  CRB interface
  -

@@ -348,6 +352,34 @@ In case an Arm virt machine is emulated, use the following 
command line:
  -drive if=pflash,format=raw,file=flash0.img,readonly=on \
  -drive if=pflash,format=raw,file=flash1.img

+In case a ast2600-evb bmc machine is emulated and want to use TPM device
+attached to I2C bus, use the following command line:
+
+.. code-block:: console
+
+  qemu-system-arm -M ast2600-evb -nographic \
+-kernel arch/arm/boot/zImage \
+-dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \
+-initrd rootfs.cpio \
+-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+-tpmdev emulator,id=tpm0,chardev=chrtpm \
+-device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e


For testing, use this command to load the driver to the correct address:

echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device

(I don't know how specific we want to make the instructions, but
adding a line like above would help others from having to re-discover
the command).


or/and add an avocado test for it. See tests/avocado/machine_aspeed.py.

The avocado framework is a bit fragile when reading from the console but
we hope to fix that.

Thanks

C.




+
+In case a Rainier bmc machine is emulated and want to use TPM device
+attached to I2C bus, use the following command line:
+
+.. code-block:: console
+
+  qemu-system-arm -M rainier-bmc -nographic \
+-kernel ${IMAGEPATH}/fitImage-linux.bin \
+-dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \
+-initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \
+-drive 
file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\
+-net nic -net 
user,hostfwd=:127.0.0.1:-:22,hostfwd=:127.0.0.1:2443-:443\
+-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+-tpmdev emulator,id=tpm0,chardev=chrtpm \
+-device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e
+


I'd drop this example, the above one is enough.


  In case SeaBIOS is used as firmware, it should show the TPM menu item
  after entering the menu with 'ESC'.

--
2.37.2

[PATCH] riscv: Add support for the Zfa extension

[Christoph Muellner]

From: Christoph Müllner 

This patch introduces the RISC-V Zfa extension, which introduces
additional floating-point extensions:
* fli (load-immediate) with pre-defined immediates
* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
* fround/froundmx (round to integer)
* fcvtmod.w.d (Modular Convert-to-Integer)
* fmv* to access high bits of float register bigger than XLEN
* Quiet comparison instructions (fleq/fltq)

Zfa defines its instructions in combination with the following extensions:
* single-precision floating-point (F)
* double-precision floating-point (D)
* quad-precision floating-point (Q)
* half-precision floating-point (Zfh)

Since QEMU does not support the RISC-V quad-precision floating-point
ISA extension (Q), this patch does not include the instructions that
depend on this extension. All other instructions are included in this
patch.

The Zfa specification is not frozen at the moment (which is why this
patch is RFC) and can be found here:
  https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex

Signed-off-by: Christoph Müllner 
---
 target/riscv/cpu.c|   8 +
 target/riscv/cpu.h|   1 +
 target/riscv/fpu_helper.c | 324 +
 target/riscv/helper.h |  22 ++
 target/riscv/insn32.decode|  67 
 target/riscv/insn_trans/trans_rvzfa.c.inc | 410 ++
 target/riscv/translate.c  |   1 +
 7 files changed, 833 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 1e97473af2..bac9ced4a2 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -83,6 +83,7 @@ static const struct isa_ext_data isa_edata_arr[] = {
 ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
 ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, 
ext_zihintpause),
 ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
+ISA_EXT_DATA_ENTRY(zfa, true, PRIV_VERSION_1_12_0, ext_zfa),
 ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_11_0, ext_zfh),
 ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
 ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -404,6 +405,7 @@ static void rv64_thead_c906_cpu_init(Object *obj)
 cpu->cfg.ext_u = true;
 cpu->cfg.ext_s = true;
 cpu->cfg.ext_icsr = true;
+cpu->cfg.ext_zfa = true;
 cpu->cfg.ext_zfh = true;
 cpu->cfg.mmu = true;
 cpu->cfg.ext_xtheadba = true;
@@ -865,6 +867,11 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
+if (cpu->cfg.ext_zfa && !cpu->cfg.ext_f) {
+error_setg(errp, "Zfa extension requires F extension");
+return;
+}
+
 if (cpu->cfg.ext_zfh) {
 cpu->cfg.ext_zfhmin = true;
 }
@@ -1381,6 +1388,7 @@ static Property riscv_cpu_extensions[] = {
 DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
 DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
 DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, false),
 DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
 DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
 DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 638e47c75a..deae410fc2 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -462,6 +462,7 @@ struct RISCVCPUConfig {
 bool ext_svpbmt;
 bool ext_zdinx;
 bool ext_zawrs;
+bool ext_zfa;
 bool ext_zfh;
 bool ext_zfhmin;
 bool ext_zfinx;
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index 449d236df6..55c75bf063 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -252,6 +252,18 @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, 
uint64_t rs2)
 float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+
+if (float32_is_any_nan(frs1) || float32_is_any_nan(frs2)) {
+return float32_default_nan(&env->fp_status);
+}
+
+return nanbox_s(env, float32_minimum_number(frs1, frs2, &env->fp_status));
+}
+
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
 float32 frs1 = check_nanbox_s(env, rs1);
@@ -261,6 +273,18 @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, 
uint64_t rs2)
 float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+
+if (float32_is_any_nan(frs1) || float32_is_any_nan(frs

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Joel Stanley]

On Mon, 27 Mar 2023 at 03:52, Ninad Palsule  wrote:
>
> Hi Joel,
>
> On 3/26/23 8:05 PM, Joel Stanley wrote:
> > Hi Ninad,
> >
> > On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:
> >> Hello,
> >>
> >> I have incorporated review comments from Stefan. Please review.
> >>
> >> This drop adds support for the TPM devices attached to the I2C bus. It
> >> only supports the TPM2 protocol. You need to run it with the external
> >> TPM emulator like swtpm. I have tested it with swtpm.
> > Nice work. I tested these stop cedric's aspeed-8.0 qemu tree, using
> > the rainier machine and the openbmc dev-6.1 kernel.
> >
> > We get this message when booting from a kernel:
> >
> > [0.582699] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
> > [0.586361] tpm tpm0: A TPM error (256) occurred attempting the self test
> > [0.586623] tpm tpm0: starting up the TPM manually
> >
> > Do we understand why the error appears?
>
>
> Yes, As per kernel code this is an expected error for some emulators.
>
> On swtpm emulator, It returns TPM2_RC_INITIALIZE if emulator is not
> initialized. I searched it in swtpm and it indicated that selftest
> requested before it is initialized. I meant to ask Stefan but busy with
> the review comments.

The swtpm man page mentions some flags we can set. Perhaps they would help?

   --flags [not-need-init]
[,startup-clear|startup-state|startup-deactivated|startup-none]


>
> This function comment in the driver mentioned below indicate that this
> case possible with emulators.
>
> /**
>   * tpm2_startup - turn on the TPM
>   * @chip: TPM chip to use
>   *
>   * Normally the firmware should start the TPM. This function is
> provided as a
>   * workaround if this does not happen. A legal case for this could be for
>   * example when a TPM emulator is used.
>   *
>   * Return: same as tpm_transmit_cmd()
>   */
>
> static int tpm2_startup(struct tpm_chip *chip)
>

> > However on a clean boot into the TPM, the u-boot tpm commands fail:
> >
> > ast# tpm info
> > tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [closed]
> > ast# tpINTERRUPT>
> > ast# tpm init
> > ast# tpm info
> > tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [open]
> > ast# tpm pcr_read 0 0x8100
> > Error: 256
> > ast# md.l 0x8100 16
> > 8100:    
> > 8110:    
> > 8120:    
> > 8130:    
> > 8140:    
> > 8150:    
> >
> > This doesn't need to block merging into qemu, as the model works fine
> > for pcr measurement and accessing under Linux. However it would be
> > good to work though these issues in case there's a modelling
> > discrepancy.
>
>
> Yes, Please provide me details on how to reproduce it. I will take a look.

This is the buildroot tree I've been using for testing:

https://github.com/shenki/buildroot/commits/ast2600-tpm

git clone https://github.com/shenki/buildroot -b ast2600-tpm
cd buildroot
make O=ast2600evb aspeed_ast2600evb_defconfig

I launch it with this qemu commandline:

swtpm socket --tpmstate dir=$XDG_RUNTIME_DIR --ctrl
type=unixio,path=$XDG_RUNTIME_DIR/swtpm-socket --tpm2

qemu-system-arm -M ast2600-evb -nographic -drive
file=ast2600evb/images/flash.img,if=mtd,format=raw -chardev
socket,id=chrtpm,path=$XDG_RUNTIME_DIR/swtpm-socket -tpmdev
emulator,id=tpm0,chardev=chrtpm -device
tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e

If you want to reproduce the u-boot behaviour, press any key to
interrupt the boot.

Booting this way, you can also test the u-boot behaviour. Once you're
in userspace:

# echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device
[   13.637081] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
[   13.665239] i2c i2c-12: new_device: Instantiated device tpm_tis_i2c at 0x2e

# cat /sys/class/tpm/tpm0/pcr-sha256/0
FE9A732EAA7842D77DEECFC1DC610EBEA9414BFC39BEEBC8D2F071CF030FA592

Re: [RESEND PATCH v2] target/i386: Switch back XFRM value

[Yang, Weijiang]

On 3/27/2023 3:33 PM, Christian Ehrhardt wrote:

On Thu, Oct 27, 2022 at 2:36 AM Yang, Weijiang  wrote:


On 10/26/2022 7:57 PM, Zhong, Yang wrote:

The previous patch wrongly replaced FEAT_XSAVE_XCR0_{LO|HI} with
FEAT_XSAVE_XSS_{LO|HI} in CPUID(EAX=12,ECX=1):{ECX,EDX}, which made
SGX enclave only supported SSE and x87 feature(xfrm=0x3).

Fixes: 301e90675c3f ("target/i386: Enable support for XSAVES based features")

Signed-off-by: Yang Zhong 
---
   target/i386/cpu.c | 4 ++--
   1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ad623d91e4..19aaed877b 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5584,8 +5584,8 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
uint32_t count,
   } else {
   *eax &= env->features[FEAT_SGX_12_1_EAX];
   *ebx &= 0; /* ebx reserve */
-*ecx &= env->features[FEAT_XSAVE_XSS_LO];
-*edx &= env->features[FEAT_XSAVE_XSS_HI];
+*ecx &= env->features[FEAT_XSAVE_XCR0_LO];
+*edx &= env->features[FEAT_XSAVE_XCR0_HI];

Oops, that's my fault to replace with wrong definitions, thanks for the fix!

Reviewed-by:  Yang Weijiang 

Hi,
I do not have any background on this but stumbled over this and wondered,
is there any particular reason why this wasn't applied yet?

It seemed to fix a former mistake, was acked and then ... silence


Chris, thanks for the catch!

I double checked this patch isn't in the latest 8.0.0-rc1 tree.


Hi, Paolo,

Could you help merge this fixup patch? Thanks!




   /* FP and SSE are always allowed regardless of XSAVE/XCR0. */
   *ecx |= XSTATE_FP_MASK | XSTATE_SSE_MASK;

[PATCH v2 07/10] target/riscv: Remove redundant parentheses

[Weiwei Li]

Remove redundant parentheses in get_physical_address.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Richard Henderson 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/cpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 1ad39e7157..9145ca0ddb 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -1046,7 +1046,7 @@ restart:
 if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
 *prot |= PAGE_READ;
 }
-if ((pte & PTE_X)) {
+if (pte & PTE_X) {
 *prot |= PAGE_EXEC;
 }
 /* add write permission on stores or if the page is already dirty,
-- 
2.25.1

[PATCH v2 05/10] target/riscv: Convert env->virt to a bool env->virt_enabled

[Weiwei Li]

From: LIU Zhiwei 

Currently we only use the env->virt to encode the virtual mode enabled
status. Let's make it a bool type.

Signed-off-by: LIU Zhiwei 
Reviewed-by: Weiwei Li 
Message-ID: <20230325145348.1208-1-zhiwei_...@linux.alibaba.com>
---
 target/riscv/cpu.h| 2 +-
 target/riscv/cpu_bits.h   | 3 ---
 target/riscv/cpu_helper.c | 6 +++---
 target/riscv/machine.c| 6 +++---
 target/riscv/translate.c  | 4 ++--
 5 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 5adefe4ab5..22dc5ddb95 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -183,7 +183,7 @@ struct CPUArchState {
 #ifndef CONFIG_USER_ONLY
 target_ulong priv;
 /* This contains QEMU specific information about the virt state. */
-target_ulong virt;
+bool virt_enabled;
 target_ulong geilen;
 uint64_t resetvec;
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index fca7ef0cef..45ddb00aa5 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -607,9 +607,6 @@ typedef enum {
 #define PRV_H 2 /* Reserved */
 #define PRV_M 3
 
-/* Virtulisation Register Fields */
-#define VIRT_ONOFF  1
-
 /* RV32 satp CSR field masks */
 #define SATP32_MODE 0x8000
 #define SATP32_ASID 0x7fc0
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index b286118a6b..c7bc3fc553 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -560,18 +560,18 @@ void riscv_cpu_set_geilen(CPURISCVState *env, 
target_ulong geilen)
 
 bool riscv_cpu_virt_enabled(CPURISCVState *env)
 {
-return get_field(env->virt, VIRT_ONOFF);
+return env->virt_enabled;
 }
 
 /* This function can only be called to set virt when RVH is enabled */
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 {
 /* Flush the TLB on all virt mode changes. */
-if (get_field(env->virt, VIRT_ONOFF) != enable) {
+if (env->virt_enabled != enable) {
 tlb_flush(env_cpu(env));
 }
 
-env->virt = set_field(env->virt, VIRT_ONOFF, enable);
+env->virt_enabled = enable;
 
 if (enable) {
 /*
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index 9c455931d8..0fb3ddda06 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -331,8 +331,8 @@ static const VMStateDescription vmstate_pmu_ctr_state = {
 
 const VMStateDescription vmstate_riscv_cpu = {
 .name = "cpu",
-.version_id = 7,
-.minimum_version_id = 7,
+.version_id = 8,
+.minimum_version_id = 8,
 .post_load = riscv_cpu_post_load,
 .fields = (VMStateField[]) {
 VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
@@ -352,7 +352,7 @@ const VMStateDescription vmstate_riscv_cpu = {
 VMSTATE_UINT32(env.misa_mxl_max, RISCVCPU),
 VMSTATE_UINT32(env.misa_ext_mask, RISCVCPU),
 VMSTATE_UINTTL(env.priv, RISCVCPU),
-VMSTATE_UINTTL(env.virt, RISCVCPU),
+VMSTATE_BOOL(env.virt_enabled, RISCVCPU),
 VMSTATE_UINT64(env.resetvec, RISCVCPU),
 VMSTATE_UINTTL(env.mhartid, RISCVCPU),
 VMSTATE_UINT64(env.mstatus, RISCVCPU),
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 0ee8ee147d..c3adf30b54 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1255,8 +1255,8 @@ static void riscv_tr_disas_log(const DisasContextBase 
*dcbase,
 
 fprintf(logfile, "IN: %s\n", lookup_symbol(dcbase->pc_first));
 #ifndef CONFIG_USER_ONLY
-fprintf(logfile, "Priv: "TARGET_FMT_ld"; Virt: "TARGET_FMT_ld"\n",
-env->priv, env->virt);
+fprintf(logfile, "Priv: "TARGET_FMT_ld"; Virt: %d\n",
+env->priv, env->virt_enabled);
 #endif
 target_disas(logfile, cpu, dcbase->pc_first, dcbase->tb->size);
 }
-- 
2.25.1

[PATCH v2 02/10] target/riscv: Remove redundant check on RVH

[Weiwei Li]

Check on riscv_cpu_virt_enabled contains the check on RVH.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Richard Henderson 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/op_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 84ee018f7d..1eecae9547 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -278,8 +278,7 @@ target_ulong helper_sret(CPURISCVState *env)
 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 }
 
-if (riscv_has_ext(env, RVH) && riscv_cpu_virt_enabled(env) &&
-get_field(env->hstatus, HSTATUS_VTSR)) {
+if (riscv_cpu_virt_enabled(env) && get_field(env->hstatus, HSTATUS_VTSR)) {
 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
 }
 
-- 
2.25.1

[PATCH v2 06/10] target/riscv: Remove riscv_cpu_virt_enabled()

[Weiwei Li]

Directly use env->virt_enabled instead.

Suggested-by: LIU Zhiwei 
Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/cpu.c|  2 +-
 target/riscv/cpu.h|  1 -
 target/riscv/cpu_helper.c | 51 ++-
 target/riscv/csr.c| 46 +--
 target/riscv/debug.c  | 10 
 target/riscv/op_helper.c  | 18 +++---
 target/riscv/pmu.c|  4 +--
 target/riscv/translate.c  |  2 +-
 8 files changed, 64 insertions(+), 70 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 16e465a0ab..e71b4d24a7 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -549,7 +549,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int 
flags)
 
 #if !defined(CONFIG_USER_ONLY)
 if (riscv_has_ext(env, RVH)) {
-qemu_fprintf(f, " %s %d\n", "V  =  ", riscv_cpu_virt_enabled(env));
+qemu_fprintf(f, " %s %d\n", "V  =  ", env->virt_enabled);
 }
 #endif
 qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc  ", env->pc);
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 22dc5ddb95..dc9817b40d 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -576,7 +576,6 @@ bool riscv_cpu_fp_enabled(CPURISCVState *env);
 target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
 void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
 bool riscv_cpu_vector_enabled(CPURISCVState *env);
-bool riscv_cpu_virt_enabled(CPURISCVState *env);
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
 bool riscv_cpu_two_stage_lookup(int mmu_idx);
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index c7bc3fc553..1ad39e7157 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -93,8 +93,8 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong 
*pc,
 
 if (riscv_has_ext(env, RVH)) {
 if (env->priv == PRV_M ||
-(env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
-(env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
+(env->priv == PRV_S && !env->virt_enabled) ||
+(env->priv == PRV_U && !env->virt_enabled &&
 get_field(env->hstatus, HSTATUS_HU))) {
 flags = FIELD_DP32(flags, TB_FLAGS, HLSX, 1);
 }
@@ -391,7 +391,7 @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
 uint64_t irqs, pending, mie, hsie, vsie;
 
 /* Determine interrupt enable state of all privilege modes */
-if (riscv_cpu_virt_enabled(env)) {
+if (env->virt_enabled) {
 mie = 1;
 hsie = 1;
 vsie = (env->priv < PRV_S) ||
@@ -452,7 +452,7 @@ bool riscv_cpu_exec_interrupt(CPUState *cs, int 
interrupt_request)
 bool riscv_cpu_fp_enabled(CPURISCVState *env)
 {
 if (env->mstatus & MSTATUS_FS) {
-if (riscv_cpu_virt_enabled(env) && !(env->mstatus_hs & MSTATUS_FS)) {
+if (env->virt_enabled && !(env->mstatus_hs & MSTATUS_FS)) {
 return false;
 }
 return true;
@@ -465,7 +465,7 @@ bool riscv_cpu_fp_enabled(CPURISCVState *env)
 bool riscv_cpu_vector_enabled(CPURISCVState *env)
 {
 if (env->mstatus & MSTATUS_VS) {
-if (riscv_cpu_virt_enabled(env) && !(env->mstatus_hs & MSTATUS_VS)) {
+if (env->virt_enabled && !(env->mstatus_hs & MSTATUS_VS)) {
 return false;
 }
 return true;
@@ -483,7 +483,7 @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
 if (riscv_has_ext(env, RVF)) {
 mstatus_mask |= MSTATUS_FS;
 }
-bool current_virt = riscv_cpu_virt_enabled(env);
+bool current_virt = env->virt_enabled;
 
 g_assert(riscv_has_ext(env, RVH));
 
@@ -558,11 +558,6 @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong 
geilen)
 env->geilen = geilen;
 }
 
-bool riscv_cpu_virt_enabled(CPURISCVState *env)
-{
-return env->virt_enabled;
-}
-
 /* This function can only be called to set virt when RVH is enabled */
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 {
@@ -609,7 +604,7 @@ uint64_t riscv_cpu_update_mip(CPURISCVState *env, uint64_t 
mask,
 CPUState *cs = env_cpu(env);
 uint64_t gein, vsgein = 0, vstip = 0, old = env->mip;
 
-if (riscv_cpu_virt_enabled(env)) {
+if (env->virt_enabled) {
 gein = get_field(env->hstatus, HSTATUS_VGEIN);
 vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
 }
@@ -768,7 +763,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr 
*physical,
  * was called. Background registers will be used if the guest has
  * forced a two stage translation to be on (in HS or M mode).
  */
-if (!riscv_cpu_virt_enabled(env) && two_stage) {
+if (!env->virt_enabled && two_stage) {
 use_background = true;
 }
 
@@ -931,7 +926,7 @@ restart:
 bool pbmte = env->menvcfg & MENVCFG_PBMTE;
 bool hade = env->menvcf

[PATCH v2 10/10] target/riscv: Fix lines with over 80 characters

[Weiwei Li]

Fix lines with over 80 characters for both code and comments in
vector_helper.c, pmp.c and pmu.c.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/pmp.c   |  6 ++-
 target/riscv/pmu.c   |  3 +-
 target/riscv/vector_helper.c | 76 
 3 files changed, 56 insertions(+), 29 deletions(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index 665a8528d5..428ebe7272 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -129,7 +129,8 @@ static void pmp_write_cfg(CPURISCVState *env, uint32_t 
pmp_index, uint8_t val)
 }
 }
 
-static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong 
*ea)
+static void pmp_decode_napot(target_ulong a, target_ulong *sa,
+ target_ulong *ea)
 {
 /*
...aaa0   8-byte NAPOT range
@@ -217,7 +218,8 @@ static void pmp_update_rule(CPURISCVState *env, uint32_t 
pmp_index)
 pmp_update_rule_nums(env);
 }
 
-static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong 
addr)
+static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
+   target_ulong addr)
 {
 int result = 0;
 
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index 7ad85ab476..903bf29361 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -419,7 +419,8 @@ int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t 
value, uint32_t ctr_idx)
 } else {
 return -1;
 }
-overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 
overflow_ns;
+overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+  overflow_ns;
 
 if (overflow_at > INT64_MAX) {
 overflow_left += overflow_at - INT64_MAX;
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 81b99a0e3c..b5ab8edcb3 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -385,8 +385,8 @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState 
*env, uint32_t desc,
 }
 
 /*
- * masked unit-stride load and store operation will be a special case of 
stride,
- * stride = NF * sizeof (MTYPE)
+ * masked unit-stride load and store operation will be a special case of
+ * stride, stride = NF * sizeof (MTYPE)
  */
 
 #define GEN_VEXT_LD_US(NAME, ETYPE, LOAD_FN)\
@@ -681,7 +681,8 @@ vext_ldst_whole(void *vd, target_ulong base, CPURISCVState 
*env, uint32_t desc,
 /* load/store rest of elements of current segment pointed by vstart */
 for (pos = off; pos < max_elems; pos++, env->vstart++) {
 target_ulong addr = base + ((pos + k * max_elems) << log2_esz);
-ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd, 
ra);
+ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd,
+  ra);
 }
 k++;
 }
@@ -1309,7 +1310,9 @@ GEN_VEXT_SHIFT_VV(vsra_vv_h, uint16_t, int16_t, H2, H2, 
DO_SRL, 0xf)
 GEN_VEXT_SHIFT_VV(vsra_vv_w, uint32_t, int32_t, H4, H4, DO_SRL, 0x1f)
 GEN_VEXT_SHIFT_VV(vsra_vv_d, uint64_t, int64_t, H8, H8, DO_SRL, 0x3f)
 
-/* generate the helpers for shift instructions with one vector and one scalar 
*/
+/*
+ * generate the helpers for shift instructions with one vector and one scalar
+ */
 #define GEN_VEXT_SHIFT_VX(NAME, TD, TS2, HD, HS2, OP, MASK) \
 void HELPER(NAME)(void *vd, void *v0, target_ulong s1,  \
   void *vs2, CPURISCVState *env,\
@@ -2168,7 +2171,8 @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void 
*vs2, \
  do_##NAME, ESZ);   \
 }
 
-static inline uint8_t saddu8(CPURISCVState *env, int vxrm, uint8_t a, uint8_t 
b)
+static inline uint8_t saddu8(CPURISCVState *env, int vxrm, uint8_t a,
+ uint8_t b)
 {
 uint8_t res = a + b;
 if (res < a) {
@@ -2312,7 +2316,8 @@ static inline int8_t sadd8(CPURISCVState *env, int vxrm, 
int8_t a, int8_t b)
 return res;
 }
 
-static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a, int16_t 
b)
+static inline int16_t sadd16(CPURISCVState *env, int vxrm, int16_t a,
+ int16_t b)
 {
 int16_t res = a + b;
 if ((res ^ a) & (res ^ b) & INT16_MIN) {
@@ -2322,7 +2327,8 @@ static inline int16_t sadd16(CPURISCVState *env, int 
vxrm, int16_t a, int16_t b)
 return res;
 }
 
-static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a, int32_t 
b)
+static inline int32_t sadd32(CPURISCVState *env, int vxrm, int32_t a,
+ int32_t b)
 {
 int32_t res = a + b;
 if ((res ^ a) & (res ^ b) & INT32_MIN) {
@@ -2332,7 +2338,8 @@ static inline int32_t sadd32(CPURISCVState *env, int 
vxrm, int32_t a, int32_t b)
 return res;
 }
 
-static inline int64_t sadd64(CPURISCVState *env, int vxrm, int64_t a, int64_t 
b)
+static inline int64_t sadd64(CPURISCVState *env, int vxrm, int64_t a,
+   

[PATCH v2 08/10] target/riscv: Fix format for indentation

[Weiwei Li]

Fix identation problems, and try to use the same indentation strategy
in the same file.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/arch_dump.c|   4 +-
 target/riscv/cpu.c  |   4 +-
 target/riscv/cpu_helper.c   |  15 +--
 target/riscv/insn_trans/trans_rvv.c.inc |  28 ++---
 target/riscv/op_helper.c|   4 +-
 target/riscv/pmp.c  |  19 ++--
 target/riscv/pmp.h  |   9 +-
 target/riscv/vector_helper.c| 134 +---
 8 files changed, 113 insertions(+), 104 deletions(-)

diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
index 736a232956..573587810e 100644
--- a/target/riscv/arch_dump.c
+++ b/target/riscv/arch_dump.c
@@ -180,8 +180,8 @@ int cpu_get_dump_info(ArchDumpInfo *info,
 info->d_class = ELFCLASS32;
 #endif
 
-info->d_endian = (env->mstatus & MSTATUS_UBE) != 0
- ? ELFDATA2MSB : ELFDATA2LSB;
+info->d_endian = (env->mstatus & MSTATUS_UBE) != 0 ?
+ ELFDATA2MSB : ELFDATA2LSB;
 
 return 0;
 }
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index e71b4d24a7..b0cbacc5f4 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -344,8 +344,8 @@ static void riscv_any_cpu_init(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
 set_satp_mode_max_supported(RISCV_CPU(obj),
-riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
-VM_1_10_SV32 : VM_1_10_SV57);
+riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
+VM_1_10_SV32 : VM_1_10_SV57);
 #endif
 
 set_priv_version(env, PRIV_VERSION_1_12_0);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 9145ca0ddb..6f4d0a6030 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -68,12 +68,12 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong 
*pc,
 flags = FIELD_DP32(flags, TB_FLAGS, VILL, env->vill);
 flags = FIELD_DP32(flags, TB_FLAGS, SEW, sew);
 flags = FIELD_DP32(flags, TB_FLAGS, LMUL,
-FIELD_EX64(env->vtype, VTYPE, VLMUL));
+   FIELD_EX64(env->vtype, VTYPE, VLMUL));
 flags = FIELD_DP32(flags, TB_FLAGS, VL_EQ_VLMAX, vl_eq_vlmax);
 flags = FIELD_DP32(flags, TB_FLAGS, VTA,
-FIELD_EX64(env->vtype, VTYPE, VTA));
+   FIELD_EX64(env->vtype, VTYPE, VTA));
 flags = FIELD_DP32(flags, TB_FLAGS, VMA,
-FIELD_EX64(env->vtype, VTYPE, VMA));
+   FIELD_EX64(env->vtype, VTYPE, VMA));
 } else {
 flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
 }
@@ -1052,7 +1052,7 @@ restart:
 /* add write permission on stores or if the page is already dirty,
so that we TLB miss on later writes to update the dirty bit */
 if ((pte & PTE_W) &&
-(access_type == MMU_DATA_STORE || (pte & PTE_D))) {
+(access_type == MMU_DATA_STORE || (pte & PTE_D))) {
 *prot |= PAGE_WRITE;
 }
 return TRANSLATE_SUCCESS;
@@ -1281,9 +1281,10 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int 
size,
false);
 
 qemu_log_mask(CPU_LOG_MMU,
-"%s 2nd-stage address=%" VADDR_PRIx " ret %d physical "
-HWADDR_FMT_plx " prot %d\n",
-__func__, im_address, ret, pa, prot2);
+  "%s 2nd-stage address=%" VADDR_PRIx
+  " ret %d physical "
+  HWADDR_FMT_plx " prot %d\n",
+  __func__, im_address, ret, pa, prot2);
 
 prot &= prot2;
 
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc 
b/target/riscv/insn_trans/trans_rvv.c.inc
index f2e3d38515..8e43bfc07c 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -238,8 +238,8 @@ static bool vext_check_store(DisasContext *s, int vd, int 
nf, uint8_t eew)
 {
 int8_t emul = eew - s->sew + s->lmul;
 return (emul >= -3 && emul <= 3) &&
-require_align(vd, emul) &&
-require_nf(vd, nf, emul);
+   require_align(vd, emul) &&
+   require_nf(vd, nf, emul);
 }
 
 /*
@@ -315,7 +315,7 @@ static bool vext_check_ld_index(DisasContext *s, int vd, 
int vs2,
 int8_t seg_vd;
 int8_t emul = eew - s->sew + s->lmul;
 bool ret = vext_check_st_index(s, vd, vs2, nf, eew) &&
-require_vm(vm, vd);
+   require_vm(vm, vd);
 
 /* Each segment register group has to follow overlap rules. */
 for (int i = 0; i < nf; ++i) {
@@ -345,8 +345,8 @@ static bool vext_check_ld_index(DisasContext *s, int vd, 
int vs2,
 static bool vext_check_ss(DisasContext *s, int vd, int vs, int vm)
 {
 return require_vm(vm, vd) &&

[PATCH v2 01/10] target/riscv: Remove redundant call to riscv_cpu_virt_enabled

[Weiwei Li]

The assignment is done under the condition riscv_cpu_virt_enabled()=true.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Richard Henderson 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/cpu_helper.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 824f0cbd92..e140d6a8d0 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -1706,9 +1706,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
 riscv_cpu_swap_hypervisor_regs(env);
 env->hstatus = set_field(env->hstatus, HSTATUS_SPVP,
  env->priv);
-env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
- riscv_cpu_virt_enabled(env));
-
+env->hstatus = set_field(env->hstatus, HSTATUS_SPV, true);
 
 htval = env->guest_phys_fault_addr;
 
-- 
2.25.1

[PATCH v2 00/10] target/riscv: Simplification for RVH related check and code style fix

[Weiwei Li]

This patchset tries to simplify the RVH related check and fix some code style 
problems, such as problems for indentation, multi-line comments and lines with 
over 80 characters.

The port is available here:
https://github.com/plctlab/plct-qemu/tree/plct-virtfix-upstream

v2:
* add comment to specify riscv_cpu_set_virt_enabled() can only be called when 
RVH is enabled in patch 4 (suggested by Richard Henderson)
* merge patch from LIU Zhiwei(Message-ID: 
<20230325145348.1208-1-zhiwei_...@linux.alibaba.com>) to patch 5
* use env->virt_enabled directly instead of riscv_cpu_virt_enabled() in patch 6 
(suggested by LIU Zhiwei)
* remain the orginal identation for macro name in patch 8 (suggested by LIU 
Zhiwei)

LIU Zhiwei (1):
  target/riscv: Convert env->virt to a bool env->virt_enabled

Weiwei Li (9):
  target/riscv: Remove redundant call to riscv_cpu_virt_enabled
  target/riscv: Remove redundant check on RVH
  target/riscv: Remove check on RVH for riscv_cpu_virt_enabled
  target/riscv: Remove check on RVH for riscv_cpu_set_virt_enabled
  target/riscv: Remove riscv_cpu_virt_enabled()
  target/riscv: Remove redundant parentheses
  target/riscv: Fix format for indentation
  target/riscv: Fix format for comments
  target/riscv: Fix lines with over 80 characters

 target/riscv/arch_dump.c|   7 +-
 target/riscv/cpu.c  |   8 +-
 target/riscv/cpu.h  |  29 +--
 target/riscv/cpu_bits.h |   5 +-
 target/riscv/cpu_helper.c   | 142 ++--
 target/riscv/csr.c  |  52 ++---
 target/riscv/debug.c|  10 +-
 target/riscv/insn_trans/trans_rvv.c.inc |  36 +--
 target/riscv/machine.c  |   6 +-
 target/riscv/op_helper.c|  21 +-
 target/riscv/pmp.c  |  48 ++--
 target/riscv/pmp.h  |   9 +-
 target/riscv/pmu.c  |   7 +-
 target/riscv/sbi_ecall_interface.h  |   8 +-
 target/riscv/translate.c|  14 +-
 target/riscv/vector_helper.c| 292 ++--
 16 files changed, 378 insertions(+), 316 deletions(-)

-- 
2.25.1

[PATCH v2 04/10] target/riscv: Remove check on RVH for riscv_cpu_set_virt_enabled

[Weiwei Li]

In current implementation, riscv_cpu_set_virt_enabled is only called when
RVH is enabled.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Richard Henderson 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/cpu_helper.c | 5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 62fd2c90f1..b286118a6b 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -563,12 +563,9 @@ bool riscv_cpu_virt_enabled(CPURISCVState *env)
 return get_field(env->virt, VIRT_ONOFF);
 }
 
+/* This function can only be called to set virt when RVH is enabled */
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable)
 {
-if (!riscv_has_ext(env, RVH)) {
-return;
-}
-
 /* Flush the TLB on all virt mode changes. */
 if (get_field(env->virt, VIRT_ONOFF) != enable) {
 tlb_flush(env_cpu(env));
-- 
2.25.1

[PATCH v2 03/10] target/riscv: Remove check on RVH for riscv_cpu_virt_enabled

[Weiwei Li]

Since env->virt.VIRT_ONOFF is initialized as false, and will not be set
to true when RVH is disabled, so we can just return this bit(false) when
RVH is not disabled.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Richard Henderson 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/cpu_helper.c | 4 
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index e140d6a8d0..62fd2c90f1 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -560,10 +560,6 @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong 
geilen)
 
 bool riscv_cpu_virt_enabled(CPURISCVState *env)
 {
-if (!riscv_has_ext(env, RVH)) {
-return false;
-}
-
 return get_field(env->virt, VIRT_ONOFF);
 }
 
-- 
2.25.1

[PATCH v2 09/10] target/riscv: Fix format for comments

[Weiwei Li]

Fix formats for multi-lines comments.
Add spaces around single line comments(after "/*" and before "*/").

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Acked-by: Richard Henderson 
Reviewed-by: LIU Zhiwei 
---
 target/riscv/arch_dump.c|  3 +-
 target/riscv/cpu.c  |  2 +-
 target/riscv/cpu.h  | 26 
 target/riscv/cpu_bits.h |  2 +-
 target/riscv/cpu_helper.c   | 57 +++--
 target/riscv/csr.c  |  6 +-
 target/riscv/insn_trans/trans_rvv.c.inc |  8 ++-
 target/riscv/pmp.c  | 23 ---
 target/riscv/sbi_ecall_interface.h  |  8 +--
 target/riscv/translate.c|  8 ++-
 target/riscv/vector_helper.c| 82 +++--
 11 files changed, 135 insertions(+), 90 deletions(-)

diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
index 573587810e..434c8a3dbb 100644
--- a/target/riscv/arch_dump.c
+++ b/target/riscv/arch_dump.c
@@ -1,4 +1,5 @@
-/* Support for writing ELF notes for RISC-V architectures
+/*
+ * Support for writing ELF notes for RISC-V architectures
  *
  * Copyright (C) 2021 Huawei Technologies Co., Ltd
  *
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index b0cbacc5f4..7f6184346e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -56,7 +56,7 @@ struct isa_ext_data {
 #define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
 {#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
-/**
+/*
  * Here are the ordering rules of extension naming defined by RISC-V
  * specification :
  * 1. All extensions should be separated from other multi-letter extensions
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index dc9817b40d..2fcdacf216 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -124,7 +124,7 @@ FIELD(VTYPE, RESERVED, 10, sizeof(target_ulong) * 8 - 11)
 typedef struct PMUCTRState {
 /* Current value of a counter */
 target_ulong mhpmcounter_val;
-/* Current value of a counter in RV32*/
+/* Current value of a counter in RV32 */
 target_ulong mhpmcounterh_val;
 /* Snapshot values of counter */
 target_ulong mhpmcounter_prev;
@@ -278,8 +278,10 @@ struct CPUArchState {
 target_ulong satp_hs;
 uint64_t mstatus_hs;
 
-/* Signals whether the current exception occurred with two-stage address
-   translation active. */
+/*
+ * Signals whether the current exception occurred with two-stage address
+ * translation active.
+ */
 bool two_stage_lookup;
 /*
  * Signals whether the current exception occurred while doing two-stage
@@ -295,10 +297,10 @@ struct CPUArchState {
 /* PMU counter state */
 PMUCTRState pmu_ctrs[RV_MAX_MHPMCOUNTERS];
 
-/* PMU event selector configured values. First three are unused*/
+/* PMU event selector configured values. First three are unused */
 target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
 
-/* PMU event selector configured values for RV32*/
+/* PMU event selector configured values for RV32 */
 target_ulong mhpmeventh_val[RV_MAX_MHPMEVENTS];
 
 target_ulong sscratch;
@@ -387,7 +389,7 @@ struct CPUArchState {
 
 OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
 
-/**
+/*
  * RISCVCPUClass:
  * @parent_realize: The parent class' realize handler.
  * @parent_phases: The parent class' reset phase handlers.
@@ -395,9 +397,9 @@ OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
  * A RISCV CPU model.
  */
 struct RISCVCPUClass {
-/*< private >*/
+/* < private > */
 CPUClass parent_class;
-/*< public >*/
+/* < public > */
 DeviceRealize parent_realize;
 ResettablePhases parent_phases;
 };
@@ -521,16 +523,16 @@ struct RISCVCPUConfig {
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;
 
-/**
+/*
  * RISCVCPU:
  * @env: #CPURISCVState
  *
  * A RISCV CPU.
  */
 struct ArchCPU {
-/*< private >*/
+/* < private > */
 CPUState parent_obj;
-/*< public >*/
+/* < public > */
 CPUNegativeOffsetState neg;
 CPURISCVState env;
 
@@ -802,7 +804,7 @@ enum {
 CSR_TABLE_SIZE = 0x1000
 };
 
-/**
+/*
  * The event id are encoded based on the encoding specified in the
  * SBI specification v0.3
  */
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 45ddb00aa5..063535b1aa 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -727,7 +727,7 @@ typedef enum RISCVException {
 #define MIE_SSIE   (1 << IRQ_S_SOFT)
 #define MIE_USIE   (1 << IRQ_U_SOFT)
 
-/* General PointerMasking CSR bits*/
+/* General PointerMasking CSR bits */
 #define PM_ENABLE   0x0001ULL
 #define PM_CURRENT  0x0002ULL
 #define PM_INSN 0x0004ULL
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 6f4d0a6030..e46b667239 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Cédric Le Goater]

However on a clean boot into the TPM, the u-boot tpm commands fail:

ast# tpm info
tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [closed]
ast# tpINTERRUPT>
ast# tpm init
ast# tpm info
tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [open]
ast# tpm pcr_read 0 0x8100
Error: 256
ast# md.l 0x8100 16
8100:    
8110:    
8120:    
8130:    
8140:    
8150:    

This doesn't need to block merging into qemu, as the model works fine
for pcr measurement and accessing under Linux. However it would be
good to work though these issues in case there's a modelling
discrepancy.



Yes, Please provide me details on how to reproduce it. I will take a look.


This is the buildroot tree I've been using for testing:

https://github.com/shenki/buildroot/commits/ast2600-tpm

git clone https://github.com/shenki/buildroot -b ast2600-tpm
cd buildroot
make O=ast2600evb aspeed_ast2600evb_defconfig


I have pushed binaries here also :

  
https://github.com/legoater/qemu-aspeed-boot/tree/master/images/ast2600-evb/buildroot-2023.02-tpm

Cheers,

C.

Re: [PATCH for-8.0 11/11] linux-user/arm: Take more care allocating commpage

[Alex Bennée]

Richard Henderson  writes:

> User setting of -R reserved_va can lead to an assertion
> failure in page_set_flags.  Sanity check the value of
> reserved_va and print an error message instead.  Do not
> allocate a commpage at all for m-profile cpus.

I see this:

  TESTconvd on i386
qemu-i386: Unable to reserve 0x1 bytes of virtual address space
at 0x8000 (File exists) for use as guest address space (check your
virtual memory ulimit setting, min_mmap_addr or reserve less using -R
option)

on the ubuntu aarch64 static build:

  https://gitlab.com/stsquad/qemu/-/jobs/4003523064

>
> Signed-off-by: Richard Henderson 
> ---
>  linux-user/elfload.c | 37 +++--
>  1 file changed, 27 insertions(+), 10 deletions(-)
>
> diff --git a/linux-user/elfload.c b/linux-user/elfload.c
> index b068676340..0529430b1d 100644
> --- a/linux-user/elfload.c
> +++ b/linux-user/elfload.c
> @@ -422,12 +422,32 @@ enum {
>  
>  static bool init_guest_commpage(void)
>  {
> -abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
> -void *want = g2h_untagged(commpage);
> -void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
> -  MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
> +ARMCPU *cpu = ARM_CPU(thread_cpu);
> +abi_ptr want = HI_COMMPAGE & TARGET_PAGE_MASK;
> +abi_ptr addr;
>  
> -if (addr == MAP_FAILED) {
> +/*
> + * M-profile allocates maximum of 2GB address space, so can never
> + * allocate the commpage.  Skip it.
> + */
> +if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
> +return true;
> +}
> +
> +/*
> + * If reserved_va does not cover the commpage, we get an assert
> + * in page_set_flags.  Produce an intelligent error instead.
> + */
> +if (reserved_va != 0 && want + TARGET_PAGE_SIZE - 1 > reserved_va) {
> +error_report("Allocating guest commpage: -R 0x%" PRIx64 " too small",
> + (uint64_t)reserved_va + 1);
> +exit(EXIT_FAILURE);
> +}
> +
> +addr = target_mmap(want, TARGET_PAGE_SIZE, PROT_READ | PROT_WRITE,
> +   MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
> +
> +if (addr == -1) {
>  perror("Allocating guest commpage");
>  exit(EXIT_FAILURE);
>  }
> @@ -436,15 +456,12 @@ static bool init_guest_commpage(void)
>  }
>  
>  /* Set kernel helper versions; rest of page is 0.  */
> -__put_user(5, (uint32_t *)g2h_untagged(0x0ffcu));
> +put_user_u32(5, 0x0ffcu);
>  
> -if (mprotect(addr, qemu_host_page_size, PROT_READ)) {
> +if (target_mprotect(addr, qemu_host_page_size, PROT_READ | PROT_EXEC)) {
>  perror("Protecting guest commpage");
>  exit(EXIT_FAILURE);
>  }
> -
> -page_set_flags(commpage, commpage | ~qemu_host_page_mask,
> -   PAGE_READ | PAGE_EXEC | PAGE_VALID);
>  return true;
>  }


-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro

Re: [PATCH] riscv: Add support for the Zfa extension

[liweiwei]

On 2023/3/27 16:00, Christoph Muellner wrote:

From: Christoph Müllner 

This patch introduces the RISC-V Zfa extension, which introduces
additional floating-point extensions:
* fli (load-immediate) with pre-defined immediates
* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
* fround/froundmx (round to integer)
* fcvtmod.w.d (Modular Convert-to-Integer)
* fmv* to access high bits of float register bigger than XLEN
* Quiet comparison instructions (fleq/fltq)

Zfa defines its instructions in combination with the following extensions:
* single-precision floating-point (F)
* double-precision floating-point (D)
* quad-precision floating-point (Q)
* half-precision floating-point (Zfh)

Since QEMU does not support the RISC-V quad-precision floating-point
ISA extension (Q), this patch does not include the instructions that
depend on this extension. All other instructions are included in this
patch.

The Zfa specification is not frozen at the moment (which is why this
patch is RFC) and can be found here:
   https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex

Signed-off-by: Christoph Müllner 
---
  target/riscv/cpu.c|   8 +
  target/riscv/cpu.h|   1 +
  target/riscv/fpu_helper.c | 324 +
  target/riscv/helper.h |  22 ++
  target/riscv/insn32.decode|  67 
  target/riscv/insn_trans/trans_rvzfa.c.inc | 410 ++
  target/riscv/translate.c  |   1 +
  7 files changed, 833 insertions(+)
  create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 1e97473af2..bac9ced4a2 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -83,6 +83,7 @@ static const struct isa_ext_data isa_edata_arr[] = {
  ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
  ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, 
ext_zihintpause),
  ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
+ISA_EXT_DATA_ENTRY(zfa, true, PRIV_VERSION_1_12_0, ext_zfa),
  ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_11_0, ext_zfh),
  ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
  ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -404,6 +405,7 @@ static void rv64_thead_c906_cpu_init(Object *obj)
  cpu->cfg.ext_u = true;
  cpu->cfg.ext_s = true;
  cpu->cfg.ext_icsr = true;
+cpu->cfg.ext_zfa = true;
  cpu->cfg.ext_zfh = true;
  cpu->cfg.mmu = true;
  cpu->cfg.ext_xtheadba = true;
@@ -865,6 +867,11 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
  return;
  }
  
+if (cpu->cfg.ext_zfa && !cpu->cfg.ext_f) {

+error_setg(errp, "Zfa extension requires F extension");
+return;
+}
+
  if (cpu->cfg.ext_zfh) {
  cpu->cfg.ext_zfhmin = true;
  }
@@ -1381,6 +1388,7 @@ static Property riscv_cpu_extensions[] = {
  DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
  DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
  DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, false),
  DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
  DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
  DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 638e47c75a..deae410fc2 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -462,6 +462,7 @@ struct RISCVCPUConfig {
  bool ext_svpbmt;
  bool ext_zdinx;
  bool ext_zawrs;
+bool ext_zfa;
  bool ext_zfh;
  bool ext_zfhmin;
  bool ext_zfinx;
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index 449d236df6..55c75bf063 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -252,6 +252,18 @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, 
uint64_t rs2)
  float32_minimum_number(frs1, frs2, &env->fp_status));
  }
  
+uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)

+{
+float32 frs1 = check_nanbox_s(env, rs1);
+float32 frs2 = check_nanbox_s(env, rs2);
+
+if (float32_is_any_nan(frs1) || float32_is_any_nan(frs2)) {
+return float32_default_nan(&env->fp_status);

I think we should also add nanbox_s for it.

+}
+
+return nanbox_s(env, float32_minimum_number(frs1, frs2, &env->fp_status));
+}
+
  uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
  float32 frs1 = check_nanbox_s(env, rs1);
@@ -261,6 +273,18 @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, 
uint64_t rs2)
  float32_maximum_number(frs1, frs2, &env->fp_status));
  }
  
+uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)

+{
+

Re: [PATCH] Change the default for Mixed declarations.

[Daniel P . Berrangé]

On Fri, Mar 24, 2023 at 06:39:34PM +0100, Juan Quintela wrote:
> Daniel P. Berrangé  wrote:
> > On Tue, Feb 14, 2023 at 05:07:38PM +0100, Juan Quintela wrote:
> >> Hi
> >> 
> >> I want to enter a discussion about changing the default of the style
> >> guide.
> >> 
> >> There are several reasons for that:
> >> - they exist since C99 (i.e. all supported compilers support them)
> >> - they eliminate the posibility of an unitialized variable.
> >
> > Actually they don't do that reliably. In fact, when combined
> > with usage of 'goto', they introduce uninitialized variables,
> > despite the declaration having an initialization present, and
> > thus actively mislead reviewers into thinking their code is
> > safe.
> 
> Wait a minute.
> If you use goto, you are already in special rules.
> 
> And don't get confused, I fully agree when using goto for two reasons:
> - performance
>   if you show that the code is x% faster when using goto, it is
>   justified.  It is even better if you send a bug report to gcc/clang,
>   but I will not opose that use.
> - code clearity
>   Some code (basically error paths) are clearer with goto that without
>   them.
> 
> But that don't mind that mixed declarations are bad.  It means that goto
> is complicated.

Yes, goto is complicated and we shouldn't make that worse by using a
code pattern that encourages mistakes IMHO.

> >> - Current documentation already declares that they are allowed in some
> >>   cases.
> >> - Lots of places already use them.
> >> 
> >> We can change the text to whatever you want, just wondering if it is
> >> valib to change the standard.
> >> 
> >> Doing a trivial grep through my local qemu messages (around 100k) it
> >> shows that some people are complaining that they are not allowed, and
> >> other saying that they are used all over the place.
> >
> > IMHO the status quo is bad because it is actively dangerous when
> > combined with goto and we aren't using any compiler warnings to
> > help us.
> >
> > Either we allow it, but use -Wjump-misses-init to prevent mixing
> > delayed declarations with gotos, and just avoid this when it triggers
> > a false positive.
> >
> > Or we forbid it, rewrite current cases that use it, and then add
> > -Wdeclaration-after-statement to enforce it.
> >
> >
> > IMHO if we are concerned about uninitialized variables then I think
> > a better approach is to add -ftrivial-auto-var-init=zero, which will
> > make the compiler initialize all variables to 0 if they lack an
> > explicit initializer. 
> 
> I think this is a bad idea.
> If we want to "catch" unitialized variables, using something like:
> 
> -ftrivial-auto-var-init=pattern sounds much saner.

It depends on what you are aiming to achieve.

In almost all cases where we forgot to initialize something, all-zeros
is the value that we would have wanted to be present. IOW, init=zero
will (almost) always make the code do what we wanted it to do, and thus
is the safe option to make QEMU robust.

Using a non-zero value will be potentially dangerous in a number of
possible ways. It will lead to loops iterating when they should not,
potentially even infinite loops. It will lead to reads/writes off
the end of arrays. It will lead to attempts to free() invalid pointers.
Essentially all the ways in which an uninitialized value can make the
code go wrong wil still potentially happen if we initialized to a
non-zero value. The only benefit is that it will go horribly wrong
in the same way each time.

IOW...

* If you want the application to be robust and generally "do the
  right thing", even in the face of missing initializers, then
  using -ftrivial-auto-var-init=zero is the right answer.

* If you want the application to go horribly wrong, but in a
  repeatable manner, then -ftrivial-auto-var-init=pattern is the
  right answer

Personally I prefer QEMU to be robust and thus believe we should
initialize to zero in real world deployments.

Potentially there's a case for CI jobs to use a non-zero pattern
though to try to expose edge cases.

With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [PATCH] Change the default for Mixed declarations.

[Daniel P . Berrangé]

On Fri, Mar 24, 2023 at 05:56:46PM +, Alex Bennée wrote:
> 
> Juan Quintela  writes:
> 
> > Daniel P. Berrangé  wrote:
> >> On Tue, Feb 14, 2023 at 05:07:38PM +0100, Juan Quintela wrote:
> >>> Hi
> >>> 
> >>> I want to enter a discussion about changing the default of the style
> >>> guide.
> >>> 
> >>> There are several reasons for that:
> >>> - they exist since C99 (i.e. all supported compilers support them)
> >>> - they eliminate the posibility of an unitialized variable.
> >>
> >> Actually they don't do that reliably. In fact, when combined
> >> with usage of 'goto', they introduce uninitialized variables,
> >> despite the declaration having an initialization present, and
> >> thus actively mislead reviewers into thinking their code is
> >> safe.
> >
> > Wait a minute.
> > If you use goto, you are already in special rules.
> >
> > And don't get confused, I fully agree when using goto for two reasons:
> > - performance
> >   if you show that the code is x% faster when using goto, it is
> >   justified.  It is even better if you send a bug report to gcc/clang,
> >   but I will not opose that use.
> 
> I await a clear example in the context of QEMU - there is almost always
> a better way to structure things.
> 
> > - code clearity
> >   Some code (basically error paths) are clearer with goto that without
> >   them.
> 
> Now we have g_auto* and lock guards we should encourage their use. goto
> error_path is a relic of a simpler time ;-)
> 
> 
> >> IMHO if we are concerned about uninitialized variables then I think
> >> a better approach is to add -ftrivial-auto-var-init=zero, which will
> >> make the compiler initialize all variables to 0 if they lack an
> >> explicit initializer. 
> >
> > I think this is a bad idea.
> > If we want to "catch" unitialized variables, using something like:
> >
> > -ftrivial-auto-var-init=pattern sounds much saner.
> >
> > Obviously gcc is missing
> >
> > -ftrivial-auto-var-init=42
> 
> I think we could at least eat the runtime cost of
> -ftrvial-auto-var-init=0xDEADBEEF for our --enable-debug builds.

If there is ever a case where an uninitialized var gets used as a
loop counter, that's 3,735,928,559 iterations. A small value pattern
would avoid such CPU burn.


With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [PATCH] systemd: Also clear LISTEN_FDNAMES during systemd socket activation

[Daniel P . Berrangé]

On Fri, Mar 24, 2023 at 10:33:49AM -0500, Eric Blake wrote:
> Some time after systemd documented LISTEN_PID and LISTEN_FDS for
> socket activation, they later added LISTEN_FDNAMES; now documented at:
> https://www.freedesktop.org/software/systemd/man/sd_listen_fds.html
> 
> In particular, look at the implementation of sd_listen_fds_with_names():
> https://github.com/systemd/systemd/blob/main/src/libsystemd/sd-daemon/sd-daemon.c
> 
> If we ever pass LISTEN_PID=xxx and LISTEN_FDS=n to a child process,
> but leave LISTEN_FDNAMES=... unchanged as inherited from our parent
> process, then our child process using sd_listen_fds_with_names() might
> see a mismatch in the number of names (unexpected -EINVAL failure), or
> even if the number of names matches the values of those names may be
> unexpected (with even less predictable results).
> 
> Usually, this is not an issue - the point of LISTEN_PID is to tell
> systemd socket activation to ignore all other LISTEN_* if they were
> not directed to this particular pid.  But if we end up consuming a
> socket directed to this qemu process, and later decide to spawn a
> child process that also needs systemd socket activation, we must
> ensure we are not leaking any stale systemd variables through to that
> child.  The easiest way to do this is to wipe ALL LISTEN_* variables
> at the time we consume a socket, even if we do not yet care about a
> LISTEN_FDNAMES passed in from the parent process.
> 
> See also 
> https://lists.freedesktop.org/archives/systemd-devel/2023-March/048920.html
> 
> Thanks: Laszlo Ersek 
> Signed-off-by: Eric Blake 
> ---
>  util/systemd.c | 1 +
>  1 file changed, 1 insertion(+)

Reviewed-by: Daniel P. Berrangé 


With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [RFC PATCH] MAINTAINERS: add a section for policy documents

[Daniel P . Berrangé]

On Fri, Mar 24, 2023 at 05:38:36PM +, Alex Bennée wrote:
> We don't update these often but if your the sort of person who enjoys

s/your/you are/

> debating and tuning project policies you could now add yourself as a
> reviewer here so you don't miss the next debate over tabs vs spaces
> ;-)
> 
> Who's with me?

Sure, you can add me.

> 
> Signed-off-by: Alex Bennée 
> Cc: Thomas Huth 
> Cc: Daniel P. Berrangé 
> Cc: Markus Armbruster 
> Cc: Kashyap Chamarthy 
> Cc: Paolo Bonzini 
> Cc: Peter Maydell 
> Cc: Philippe Mathieu-Daudé 
> Cc: Bernhard Beschow 
> ---
>  MAINTAINERS | 10 ++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 9b56ccdd92..992deb2667 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -64,6 +64,16 @@ L: qemu-devel@nongnu.org
>  F: *
>  F: */
>  
> +Project policy and developer guides
> +R: Alex Bennée 
> +W: https://www.qemu.org/docs/master/devel/index.html
> +S: Odd Fixes
> +F: docs/devel/style.rst
> +F: docs/devel/code-of-conduct.rst
> +F: docs/devel/conflict-resolution.rst
> +F: docs/devel/submitting-a-patch.rst
> +F: docs/devel/submitting-a-pull-request.rst
> +
>  Responsible Disclosure, Reporting Security Issues
>  -
>  W: https://wiki.qemu.org/SecurityProcess
> -- 
> 2.39.2
> 

With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [PATCH] tracing: install trace events file only if necessary

[Daniel P . Berrangé]

On Sun, Mar 26, 2023 at 06:04:46PM -0300, casan...@redhat.com wrote:
> From: Carlos Santos 
> 
> It is required only if linux-user, bsd-user or system emulator is built.
> 
> Signed-off-by: Carlos Santos 
> ---
>  trace/meson.build | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/trace/meson.build b/trace/meson.build
> index 8e80be895c..3fb41c97a4 100644
> --- a/trace/meson.build
> +++ b/trace/meson.build
> @@ -64,7 +64,7 @@ trace_events_all = custom_target('trace-events-all',
>   input: trace_events_files,
>   command: [ 'cat', '@INPUT@' ],
>   capture: true,
> - install: true,
> + install: have_linux_user or have_bsd_user 
> or have_system,

Trace events are used by our command line tools too qemu-img, qemu-io,
qemu-nbd, qemu-pr-helper, qemu-storage-daemon.

What build scenario are you seeing that does NOT want the trace events
to be present ?   If there is any, then I might even call that situation
a bug, as we want trace events to be available as a debugging mechanism
for everything we build.

With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [PATCH] meson: install keyboard maps only if necessary

[Daniel P . Berrangé]

On Sun, Mar 26, 2023 at 06:04:27PM -0300, casan...@redhat.com wrote:
> From: Carlos Santos 
> 
> They are required only for system emulation (i.e. have_system is true).
> 
> Signed-off-by: Carlos Santos 
> ---
>  pc-bios/keymaps/meson.build   | 6 --
>  scripts/meson-buildoptions.sh | 2 ++
>  tests/fp/berkeley-testfloat-3 | 2 +-
>  ui/keycodemapdb   | 2 +-

You've got some git submodule updates included by accident
here.

>  4 files changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/pc-bios/keymaps/meson.build b/pc-bios/keymaps/meson.build
> index 158a3b410c..bff3083313 100644
> --- a/pc-bios/keymaps/meson.build
> +++ b/pc-bios/keymaps/meson.build
> @@ -47,7 +47,7 @@ if native_qemu_keymap.found()
> build_by_default: true,
> output: km,
> command: [native_qemu_keymap, '-f', '@OUTPUT@', 
> args.split()],
> -   install: true,
> +   install: have_system,
> install_dir: qemu_datadir / 'keymaps')
>endforeach
>  
> @@ -56,4 +56,6 @@ else
>install_data(keymaps.keys(), install_dir: qemu_datadir / 'keymaps')
>  endif
>  
> -install_data(['sl', 'sv'], install_dir: qemu_datadir / 'keymaps')
> +if have_system
> +  install_data(['sl', 'sv'], install_dir: qemu_datadir / 'keymaps')
> +endif
> diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
> index 009fab1515..6eec7bc57f 100644
> --- a/scripts/meson-buildoptions.sh
> +++ b/scripts/meson-buildoptions.sh
> @@ -301,6 +301,8 @@ _meson_option_parse() {
>  --includedir=*) quote_sh "-Dincludedir=$2" ;;
>  --enable-install-blobs) printf "%s" -Dinstall_blobs=true ;;
>  --disable-install-blobs) printf "%s" -Dinstall_blobs=false ;;
> +--enable-install-keymaps) printf "%s" -Dinstall_keymaps=true ;;
> +--disable-install-keymaps) printf "%s" -Dinstall_keymaps=false ;;
>  --interp-prefix=*) quote_sh "-Dinterp_prefix=$2" ;;
>  --enable-jack) printf "%s" -Djack=enabled ;;
>  --disable-jack) printf "%s" -Djack=disabled ;;
> diff --git a/tests/fp/berkeley-testfloat-3 b/tests/fp/berkeley-testfloat-3
> index 40619cbb3b..5a59dcec19 16
> --- a/tests/fp/berkeley-testfloat-3
> +++ b/tests/fp/berkeley-testfloat-3
> @@ -1 +1 @@
> -Subproject commit 40619cbb3bf32872df8c53cc457039229428a263
> +Subproject commit 5a59dcec19327396a011a17fd924aed4fec416b3
> diff --git a/ui/keycodemapdb b/ui/keycodemapdb
> index f5772a62ec..d21009b1c9 16
> --- a/ui/keycodemapdb
> +++ b/ui/keycodemapdb
> @@ -1 +1 @@
> -Subproject commit f5772a62ec52591ff6870b7e8ef32482371f22c6
> +Subproject commit d21009b1c9f94b740ea66be8e48a1d8ad8124023
> -- 
> 2.31.1
> 
> 

With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [PATCH V2] meson: install keyboard maps only if necessary

[Daniel P . Berrangé]

On Sun, Mar 26, 2023 at 06:17:00PM -0300, casan...@redhat.com wrote:
> From: Carlos Santos 
> 
> They are required only for system emulation (i.e. have_system is true).
> 
> Signed-off-by: Carlos Santos 
> ---
>  pc-bios/keymaps/meson.build   | 6 --
>  tests/fp/berkeley-testfloat-3 | 2 +-
>  ui/keycodemapdb   | 2 +-

This still has the accidental git submodule updates included

>  3 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/pc-bios/keymaps/meson.build b/pc-bios/keymaps/meson.build
> index 158a3b410c..bff3083313 100644
> --- a/pc-bios/keymaps/meson.build
> +++ b/pc-bios/keymaps/meson.build
> @@ -47,7 +47,7 @@ if native_qemu_keymap.found()
> build_by_default: true,
> output: km,
> command: [native_qemu_keymap, '-f', '@OUTPUT@', 
> args.split()],
> -   install: true,
> +   install: have_system,
> install_dir: qemu_datadir / 'keymaps')
>endforeach
>  
> @@ -56,4 +56,6 @@ else
>install_data(keymaps.keys(), install_dir: qemu_datadir / 'keymaps')
>  endif
>  
> -install_data(['sl', 'sv'], install_dir: qemu_datadir / 'keymaps')
> +if have_system
> +  install_data(['sl', 'sv'], install_dir: qemu_datadir / 'keymaps')
> +endif
> diff --git a/tests/fp/berkeley-testfloat-3 b/tests/fp/berkeley-testfloat-3
> index 40619cbb3b..5a59dcec19 16
> --- a/tests/fp/berkeley-testfloat-3
> +++ b/tests/fp/berkeley-testfloat-3
> @@ -1 +1 @@
> -Subproject commit 40619cbb3bf32872df8c53cc457039229428a263
> +Subproject commit 5a59dcec19327396a011a17fd924aed4fec416b3
> diff --git a/ui/keycodemapdb b/ui/keycodemapdb
> index f5772a62ec..d21009b1c9 16
> --- a/ui/keycodemapdb
> +++ b/ui/keycodemapdb
> @@ -1 +1 @@
> -Subproject commit f5772a62ec52591ff6870b7e8ef32482371f22c6
> +Subproject commit d21009b1c9f94b740ea66be8e48a1d8ad8124023
> -- 
> 2.31.1
> 
> 

With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

Re: [RFC PATCH] MAINTAINERS: add a section for policy documents

[Thomas Huth]

On 27/03/2023 11.16, Daniel P. Berrangé wrote:

On Fri, Mar 24, 2023 at 05:38:36PM +, Alex Bennée wrote:

We don't update these often but if your the sort of person who enjoys


s/your/you are/


debating and tuning project policies you could now add yourself as a
reviewer here so you don't miss the next debate over tabs vs spaces
;-)

Who's with me?


Sure, you can add me.


Me too, please!

 Thomas

Re: [PATCH for 8.1 v2 1/6] vdpa: Remove status in reset tracing

[Stefano Garzarella]

On Thu, Mar 23, 2023 at 08:53:59PM +0100, Eugenio Pérez wrote:

It is always 0 and it is not useful to route call through file
descriptor.

Signed-off-by: Eugenio Pérez 
---
hw/virtio/vhost-vdpa.c | 2 +-
hw/virtio/trace-events | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)


Reviewed-by: Stefano Garzarella 



diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index bc6bad23d5..bbabea18f3 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -716,7 +716,7 @@ static int vhost_vdpa_reset_device(struct vhost_dev *dev)
uint8_t status = 0;

ret = vhost_vdpa_call(dev, VHOST_VDPA_SET_STATUS, &status);
-trace_vhost_vdpa_reset_device(dev, status);
+trace_vhost_vdpa_reset_device(dev);
v->suspended = false;
return ret;
}
diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 8f8d05cf9b..6265231683 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -44,7 +44,7 @@ vhost_vdpa_set_mem_table(void *dev, uint32_t nregions, uint32_t 
padding) "dev: %
vhost_vdpa_dump_regions(void *dev, int i, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, 
uint64_t flags_padding) "dev: %p %d: guest_phys_addr: 0x%"PRIx64" memory_size: 0x%"PRIx64" 
userspace_addr: 0x%"PRIx64" flags_padding: 0x%"PRIx64
vhost_vdpa_set_features(void *dev, uint64_t features) "dev: %p features: 
0x%"PRIx64
vhost_vdpa_get_device_id(void *dev, uint32_t device_id) "dev: %p device_id 
%"PRIu32
-vhost_vdpa_reset_device(void *dev, uint8_t status) "dev: %p status: 0x%"PRIx8
+vhost_vdpa_reset_device(void *dev) "dev: %p"
vhost_vdpa_get_vq_index(void *dev, int idx, int vq_idx) "dev: %p idx: %d vq idx: 
%d"
vhost_vdpa_set_vring_ready(void *dev) "dev: %p"
vhost_vdpa_dump_config(void *dev, const char *line) "dev: %p %s"
--
2.31.1

Re: [PATCH for 8.1 v2 2/6] vdpa: add vhost_vdpa_reset_status_fd

[Stefano Garzarella]

On Thu, Mar 23, 2023 at 08:54:00PM +0100, Eugenio Pérez wrote:

This allows to reset a vhost-vdpa device from external subsystems like
vhost-net, since it does not have any struct vhost_dev by the time we
need to use it.

It is used in subsequent patches to negotiate features
and probe for CVQ ASID isolation.

Signed-off-by: Eugenio Pérez 
---
include/hw/virtio/vhost-vdpa.h |  1 +
hw/virtio/vhost-vdpa.c | 58 +++---
2 files changed, 41 insertions(+), 18 deletions(-)


Reviewed-by: Stefano Garzarella 



diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
index c278a2a8de..28de7da91e 100644
--- a/include/hw/virtio/vhost-vdpa.h
+++ b/include/hw/virtio/vhost-vdpa.h
@@ -54,6 +54,7 @@ typedef struct vhost_vdpa {
VhostVDPAHostNotifier notifier[VIRTIO_QUEUE_MAX];
} VhostVDPA;

+void vhost_vdpa_reset_status_fd(int fd);
int vhost_vdpa_get_iova_range(int fd, struct vhost_vdpa_iova_range *iova_range);

int vhost_vdpa_dma_map(struct vhost_vdpa *v, uint32_t asid, hwaddr iova,
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index bbabea18f3..7a2053b8d9 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -335,38 +335,45 @@ static const MemoryListener vhost_vdpa_memory_listener = {
.region_del = vhost_vdpa_listener_region_del,
};

-static int vhost_vdpa_call(struct vhost_dev *dev, unsigned long int request,
- void *arg)
+static int vhost_vdpa_dev_fd(const struct vhost_dev *dev)
{
struct vhost_vdpa *v = dev->opaque;
-int fd = v->device_fd;
-int ret;

assert(dev->vhost_ops->backend_type == VHOST_BACKEND_TYPE_VDPA);
+return v->device_fd;
+}
+
+static int vhost_vdpa_call_fd(int fd, unsigned long int request, void *arg)
+{
+int ret = ioctl(fd, request, arg);

-ret = ioctl(fd, request, arg);
return ret < 0 ? -errno : ret;
}

-static int vhost_vdpa_add_status(struct vhost_dev *dev, uint8_t status)
+static int vhost_vdpa_call(struct vhost_dev *dev, unsigned long int request,
+   void *arg)
+{
+return vhost_vdpa_call_fd(vhost_vdpa_dev_fd(dev), request, arg);
+}
+
+static int vhost_vdpa_add_status_fd(int fd, uint8_t status)
{
uint8_t s;
int ret;

-trace_vhost_vdpa_add_status(dev, status);
-ret = vhost_vdpa_call(dev, VHOST_VDPA_GET_STATUS, &s);
+ret = vhost_vdpa_call_fd(fd, VHOST_VDPA_GET_STATUS, &s);
if (ret < 0) {
return ret;
}

s |= status;

-ret = vhost_vdpa_call(dev, VHOST_VDPA_SET_STATUS, &s);
+ret = vhost_vdpa_call_fd(fd, VHOST_VDPA_SET_STATUS, &s);
if (ret < 0) {
return ret;
}

-ret = vhost_vdpa_call(dev, VHOST_VDPA_GET_STATUS, &s);
+ret = vhost_vdpa_call_fd(fd, VHOST_VDPA_GET_STATUS, &s);
if (ret < 0) {
return ret;
}
@@ -378,6 +385,12 @@ static int vhost_vdpa_add_status(struct vhost_dev *dev, 
uint8_t status)
return 0;
}

+static int vhost_vdpa_add_status(struct vhost_dev *dev, uint8_t status)
+{
+trace_vhost_vdpa_add_status(dev, status);
+return vhost_vdpa_add_status_fd(vhost_vdpa_dev_fd(dev), status);
+}
+
int vhost_vdpa_get_iova_range(int fd, struct vhost_vdpa_iova_range *iova_range)
{
int ret = ioctl(fd, VHOST_VDPA_GET_IOVA_RANGE, iova_range);
@@ -709,16 +722,20 @@ static int vhost_vdpa_get_device_id(struct vhost_dev *dev,
return ret;
}

+static int vhost_vdpa_reset_device_fd(int fd)
+{
+uint8_t status = 0;
+
+return vhost_vdpa_call_fd(fd, VHOST_VDPA_SET_STATUS, &status);
+}
+
static int vhost_vdpa_reset_device(struct vhost_dev *dev)
{
struct vhost_vdpa *v = dev->opaque;
-int ret;
-uint8_t status = 0;

-ret = vhost_vdpa_call(dev, VHOST_VDPA_SET_STATUS, &status);
-trace_vhost_vdpa_reset_device(dev);
v->suspended = false;
-return ret;
+trace_vhost_vdpa_reset_device(dev);
+return vhost_vdpa_reset_device_fd(vhost_vdpa_dev_fd(dev));
}

static int vhost_vdpa_get_vq_index(struct vhost_dev *dev, int idx)
@@ -1170,6 +1187,13 @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, 
bool started)
return 0;
}

+void vhost_vdpa_reset_status_fd(int fd)
+{
+vhost_vdpa_reset_device_fd(fd);
+vhost_vdpa_add_status_fd(fd, VIRTIO_CONFIG_S_ACKNOWLEDGE |
+ VIRTIO_CONFIG_S_DRIVER);
+}
+
static void vhost_vdpa_reset_status(struct vhost_dev *dev)
{
struct vhost_vdpa *v = dev->opaque;
@@ -1178,9 +1202,7 @@ static void vhost_vdpa_reset_status(struct vhost_dev *dev)
return;
}

-vhost_vdpa_reset_device(dev);
-vhost_vdpa_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE |
-   VIRTIO_CONFIG_S_DRIVER);
+vhost_vdpa_reset_status_fd(vhost_vdpa_dev_fd(dev));
memory_listener_unregister(&v->listener);
}

--
2.31.1

Re: [PATCH for 8.1 v2 4/6] vdpa: return errno in vhost_vdpa_get_vring_group error

[Stefano Garzarella]

On Thu, Mar 23, 2023 at 08:54:02PM +0100, Eugenio Pérez wrote:

We need to tell in the caller, as some errors are expected in a normal
workflow.  In particular, parent drivers in recent kernels with
VHOST_BACKEND_F_IOTLB_ASID may not support vring groups.  In that case,
-ENOTSUP is returned.

This is the case of vp_vdpa in Linux 6.2.

Next patches in this series will use that information to know if it must
abort or not.  Also, next patches return properly an errp instead of
printing with error_report.

Signed-off-by: Eugenio Pérez 
---
net/vhost-vdpa.c | 9 +
1 file changed, 9 insertions(+)


Reviewed-by: Stefano Garzarella 



diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 99904a0da7..4397c0d4b3 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -361,6 +361,14 @@ static NetClientInfo net_vhost_vdpa_info = {
.check_peer_type = vhost_vdpa_check_peer_type,
};

+/**
+ * Get vring virtqueue group
+ *
+ * @device_fd  vdpa device fd
+ * @vq_index   Virtqueue index
+ *
+ * Return -errno in case of error, or vq group if success.
+ */
static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index)
{
struct vhost_vring_state state = {
@@ -369,6 +377,7 @@ static int64_t vhost_vdpa_get_vring_group(int device_fd, 
unsigned vq_index)
int r = ioctl(device_fd, VHOST_VDPA_GET_VRING_GROUP, &state);

if (unlikely(r < 0)) {
+r = -errno;
error_report("Cannot get VQ %u group: %s", vq_index,
 g_strerror(errno));
return r;
--
2.31.1

Re: [PATCH for 8.1 v2 5/6] vdpa: move CVQ isolation check to net_init_vhost_vdpa

[Stefano Garzarella]

On Thu, Mar 23, 2023 at 08:54:03PM +0100, Eugenio Pérez wrote:

Evaluating it at start time instead of initialization time may make the
guest capable of dynamically adding or removing migration blockers.

Also, moving to initialization reduces the number of ioctls in the
migration, reducing failure possibilities.

As a drawback we need to check for CVQ isolation twice: one time with no
MQ negotiated and another one acking it, as long as the device supports
it.  This is because Vring ASID / group management is based on vq
indexes, but we don't know the index of CVQ before negotiating MQ.


I don't know this code sufficiently to do a review, but now I understand
the motivation behind it ;-)

Thanks,
Stefano



Signed-off-by: Eugenio Pérez 
---
v2: Take out the reset of the device from vhost_vdpa_cvq_is_isolated
---
net/vhost-vdpa.c | 194 ---
1 file changed, 151 insertions(+), 43 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 4397c0d4b3..db2c9afcb3 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -43,6 +43,13 @@ typedef struct VhostVDPAState {

/* The device always have SVQ enabled */
bool always_svq;
+
+/* The device can isolate CVQ in its own ASID if MQ is negotiated */
+bool cvq_isolated_mq;
+
+/* The device can isolate CVQ in its own ASID if MQ is not negotiated */
+bool cvq_isolated;
+
bool started;
} VhostVDPAState;

@@ -361,15 +368,8 @@ static NetClientInfo net_vhost_vdpa_info = {
.check_peer_type = vhost_vdpa_check_peer_type,
};

-/**
- * Get vring virtqueue group
- *
- * @device_fd  vdpa device fd
- * @vq_index   Virtqueue index
- *
- * Return -errno in case of error, or vq group if success.
- */
-static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index)
+static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
+  Error **errp)
{
struct vhost_vring_state state = {
.index = vq_index,
@@ -378,8 +378,7 @@ static int64_t vhost_vdpa_get_vring_group(int device_fd, 
unsigned vq_index)

if (unlikely(r < 0)) {
r = -errno;
-error_report("Cannot get VQ %u group: %s", vq_index,
- g_strerror(errno));
+error_setg_errno(errp, errno, "Cannot get VQ %u group", vq_index);
return r;
}

@@ -479,9 +478,9 @@ static int vhost_vdpa_net_cvq_start(NetClientState *nc)
{
VhostVDPAState *s, *s0;
struct vhost_vdpa *v;
-uint64_t backend_features;
int64_t cvq_group;
-int cvq_index, r;
+int r;
+Error *err = NULL;

assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);

@@ -501,42 +500,29 @@ static int vhost_vdpa_net_cvq_start(NetClientState *nc)
/*
 * If we early return in these cases SVQ will not be enabled. The migration
 * will be blocked as long as vhost-vdpa backends will not offer _F_LOG.
- *
- * Calling VHOST_GET_BACKEND_FEATURES as they are not available in v->dev
- * yet.
 */
-r = ioctl(v->device_fd, VHOST_GET_BACKEND_FEATURES, &backend_features);
-if (unlikely(r < 0)) {
-error_report("Cannot get vdpa backend_features: %s(%d)",
-g_strerror(errno), errno);
-return -1;
-}
-if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID)) ||
-!vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
+if (!vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
return 0;
}

-/*
- * Check if all the virtqueues of the virtio device are in a different vq
- * than the last vq. VQ group of last group passed in cvq_group.
- */
-cvq_index = v->dev->vq_index_end - 1;
-cvq_group = vhost_vdpa_get_vring_group(v->device_fd, cvq_index);
-if (unlikely(cvq_group < 0)) {
-return cvq_group;
-}
-for (int i = 0; i < cvq_index; ++i) {
-int64_t group = vhost_vdpa_get_vring_group(v->device_fd, i);
-
-if (unlikely(group < 0)) {
-return group;
+if (v->dev->features & BIT_ULL(VIRTIO_NET_F_MQ)) {
+if (!s->cvq_isolated_mq) {
+return 0;
}
-
-if (group == cvq_group) {
+} else {
+if (!s->cvq_isolated) {
return 0;
}
}

+cvq_group = vhost_vdpa_get_vring_group(v->device_fd,
+   v->dev->vq_index_end - 1,
+   &err);
+if (unlikely(cvq_group < 0)) {
+error_report_err(err);
+return cvq_group;
+}
+
r = vhost_vdpa_set_address_space_id(v, cvq_group, VHOST_VDPA_NET_CVQ_ASID);
if (unlikely(r < 0)) {
return r;
@@ -798,6 +784,116 @@ static const VhostShadowVirtqueueOps 
vhost_vdpa_net_svq_ops = {
.avail_handler = vhost_vdpa_net_handle_ctrl_avail,
};

+/**
+ * Probe the device to check control virtqueue is isolated.
+ *
+ * @device_fd vhost-vdpa file descriptor
+ * @features features to negotiate
+ * @cvq_index Contr

[PATCH 3/5] target/riscv: Fix pointer mask transformation for vector address

[Weiwei Li]

actual_address = (requested_address & ~mpmmask) | mpmbase.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/vector_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 2423affe37..a58d82af8c 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -172,7 +172,7 @@ static inline uint32_t vext_get_total_elems(CPURISCVState 
*env, uint32_t desc,
 
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
-return (addr & env->cur_pmmask) | env->cur_pmbase;
+return (addr & ~env->cur_pmmask) | env->cur_pmbase;
 }
 
 /*
-- 
2.25.1

[PATCH 0/5] target/riscv: Fix pointer mask related support

[Weiwei Li]

This patchset tries to fix some problems in current implementation for pointer
mask extension, and add support for pointer mask of instruction fetch.

The port is available here:
https://github.com/plctlab/plct-qemu/tree/plct-pm-fix

Weiwei Li (5):
  target/riscv: Fix effective address for pointer mask
  target/riscv: Use sign-extended data address when xl = 32
  target/riscv: Fix pointer mask transformation for vector address
  target/riscv: take xl into consideration for vector address
  target/riscv: Add pointer mask support for instruction fetch

 target/riscv/cpu.h   |  1 +
 target/riscv/cpu_helper.c| 25 +++--
 target/riscv/csr.c   |  2 --
 target/riscv/translate.c | 16 
 target/riscv/vector_helper.c |  5 -
 5 files changed, 40 insertions(+), 9 deletions(-)

-- 
2.25.1

[PATCH 1/5] target/riscv: Fix effective address for pointer mask

[Weiwei Li]

Since pointer mask works on effective address, and the xl works on the
generation of effective address, so xl related calculation should be done
before pointer mask.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/translate.c | 16 
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 0ee8ee147d..bf0e2d318e 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -568,11 +568,15 @@ static TCGv get_address(DisasContext *ctx, int rs1, int 
imm)
 TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
 tcg_gen_addi_tl(addr, src1, imm);
+
+if (get_xl(ctx) == MXL_RV32) {
+tcg_gen_ext32u_tl(addr, addr);
+}
+
 if (ctx->pm_mask_enabled) {
 tcg_gen_andc_tl(addr, addr, pm_mask);
-} else if (get_xl(ctx) == MXL_RV32) {
-tcg_gen_ext32u_tl(addr, addr);
 }
+
 if (ctx->pm_base_enabled) {
 tcg_gen_or_tl(addr, addr, pm_base);
 }
@@ -586,11 +590,15 @@ static TCGv get_address_indexed(DisasContext *ctx, int 
rs1, TCGv offs)
 TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
 tcg_gen_add_tl(addr, src1, offs);
+
+if (get_xl(ctx) == MXL_RV32) {
+tcg_gen_ext32u_tl(addr, addr);
+}
+
 if (ctx->pm_mask_enabled) {
 tcg_gen_andc_tl(addr, addr, pm_mask);
-} else if (get_xl(ctx) == MXL_RV32) {
-tcg_gen_ext32u_tl(addr, addr);
 }
+
 if (ctx->pm_base_enabled) {
 tcg_gen_or_tl(addr, addr, pm_base);
 }
-- 
2.25.1

[PATCH 4/5] target/riscv: take xl into consideration for vector address

[Weiwei Li]

Sign-extend the vector address when xl = 32.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/vector_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index a58d82af8c..07477663eb 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -172,6 +172,9 @@ static inline uint32_t vext_get_total_elems(CPURISCVState 
*env, uint32_t desc,
 
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
+if (env->xl == MXL_RV32) {
+addr = (int32_t)addr;
+}
 return (addr & ~env->cur_pmmask) | env->cur_pmbase;
 }
 
-- 
2.25.1

[PATCH 2/5] target/riscv: Use sign-extended data address when xl = 32

[Weiwei Li]

Currently, the pc use signed-extend(in gen_set_pc*) when xl = 32. And
data address should use the same memory address space with it when
xl = 32. So we should change their address calculation to use sign-extended
address when xl = 32.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index bf0e2d318e..c48cb19389 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -570,7 +570,7 @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
 tcg_gen_addi_tl(addr, src1, imm);
 
 if (get_xl(ctx) == MXL_RV32) {
-tcg_gen_ext32u_tl(addr, addr);
+tcg_gen_ext32s_tl(addr, addr);
 }
 
 if (ctx->pm_mask_enabled) {
@@ -592,7 +592,7 @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, 
TCGv offs)
 tcg_gen_add_tl(addr, src1, offs);
 
 if (get_xl(ctx) == MXL_RV32) {
-tcg_gen_ext32u_tl(addr, addr);
+tcg_gen_ext32s_tl(addr, addr);
 }
 
 if (ctx->pm_mask_enabled) {
-- 
2.25.1

[PATCH 5/5] target/riscv: Add pointer mask support for instruction fetch

[Weiwei Li]

Transform the fetch address before page walk when pointer mask is
enabled for instruction fetch.

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/cpu.h|  1 +
 target/riscv/cpu_helper.c | 25 +++--
 target/riscv/csr.c|  2 --
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 638e47c75a..57bd9c3279 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -368,6 +368,7 @@ struct CPUArchState {
 #endif
 target_ulong cur_pmmask;
 target_ulong cur_pmbase;
+bool cur_pminsn;
 
 /* Fields from here on are preserved across CPU reset. */
 QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index f88c503cf4..77132a3e0c 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -124,6 +124,7 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong 
*pc,
 void riscv_cpu_update_mask(CPURISCVState *env)
 {
 target_ulong mask = -1, base = 0;
+bool insn = false;
 /*
  * TODO: Current RVJ spec does not specify
  * how the extension interacts with XLEN.
@@ -135,18 +136,21 @@ void riscv_cpu_update_mask(CPURISCVState *env)
 if (env->mmte & M_PM_ENABLE) {
 mask = env->mpmmask;
 base = env->mpmbase;
+insn = env->mmte & MMTE_M_PM_INSN;
 }
 break;
 case PRV_S:
 if (env->mmte & S_PM_ENABLE) {
 mask = env->spmmask;
 base = env->spmbase;
+insn = env->mmte & MMTE_S_PM_INSN;
 }
 break;
 case PRV_U:
 if (env->mmte & U_PM_ENABLE) {
 mask = env->upmmask;
 base = env->upmbase;
+insn = env->mmte & MMTE_U_PM_INSN;
 }
 break;
 default:
@@ -161,6 +165,7 @@ void riscv_cpu_update_mask(CPURISCVState *env)
 env->cur_pmmask = mask;
 env->cur_pmbase = base;
 }
+env->cur_pminsn = insn;
 }
 
 #ifndef CONFIG_USER_ONLY
@@ -1225,6 +1230,17 @@ static void pmu_tlb_fill_incr_ctr(RISCVCPU *cpu, 
MMUAccessType access_type)
 riscv_pmu_incr_ctr(cpu, pmu_event_type);
 }
 
+static target_ulong adjust_pc_address(CPURISCVState *env, target_ulong pc)
+{
+target_ulong adjust_pc = pc;
+
+if (env->cur_pminsn) {
+adjust_pc = (adjust_pc & ~env->cur_pmmask) | env->cur_pmbase;
+}
+
+return adjust_pc;
+}
+
 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 MMUAccessType access_type, int mmu_idx,
 bool probe, uintptr_t retaddr)
@@ -1232,6 +1248,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int 
size,
 RISCVCPU *cpu = RISCV_CPU(cs);
 CPURISCVState *env = &cpu->env;
 vaddr im_address;
+vaddr orig_address = address;
 hwaddr pa = 0;
 int prot, prot2, prot_pmp;
 bool pmp_violation = false;
@@ -1248,6 +1265,10 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int 
size,
 qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
   __func__, address, access_type, mmu_idx);
 
+if (access_type == MMU_INST_FETCH) {
+address = adjust_pc_address(env, address);
+}
+
 /* MPRV does not affect the virtual-machine load/store
instructions, HLV, HLVX, and HSV. */
 if (riscv_cpu_two_stage_lookup(mmu_idx)) {
@@ -1351,13 +1372,13 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, 
int size,
 }
 
 if (ret == TRANSLATE_SUCCESS) {
-tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
+tlb_set_page(cs, orig_address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
  prot, mmu_idx, tlb_size);
 return true;
 } else if (probe) {
 return false;
 } else {
-raise_mmu_exception(env, address, access_type, pmp_violation,
+raise_mmu_exception(env, orig_address, access_type, pmp_violation,
 first_stage_error,
 riscv_cpu_virt_enabled(env) ||
 riscv_cpu_two_stage_lookup(mmu_idx),
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index d522efc0b6..4544c9d934 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -3511,8 +3511,6 @@ static RISCVException write_mmte(CPURISCVState *env, int 
csrno,
 /* for machine mode pm.current is hardwired to 1 */
 wpri_val |= MMTE_M_PM_CURRENT;
 
-/* hardwiring pm.instruction bit to 0, since it's not supported yet */
-wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
 env->mmte = wpri_val | PM_EXT_DIRTY;
 riscv_cpu_update_mask(env);
 
-- 
2.25.1

Re: [RFC PATCH] MAINTAINERS: add a section for policy documents

[Markus Armbruster]

Daniel P. Berrangé  writes:

> On Fri, Mar 24, 2023 at 05:38:36PM +, Alex Bennée wrote:
>> We don't update these often but if your the sort of person who enjoys
>
> s/your/you are/
>
>> debating and tuning project policies you could now add yourself as a
>> reviewer here so you don't miss the next debate over tabs vs spaces
>> ;-)
>> 
>> Who's with me?
>
> Sure, you can add me.

Me too.

Re: [PATCH] Change the default for Mixed declarations.

[Markus Armbruster]

Daniel P. Berrangé  writes:

> On Tue, Feb 14, 2023 at 05:07:38PM +0100, Juan Quintela wrote:
>> Hi
>> 
>> I want to enter a discussion about changing the default of the style
>> guide.
>> 
>> There are several reasons for that:
>> - they exist since C99 (i.e. all supported compilers support them)
>> - they eliminate the posibility of an unitialized variable.
>
> Actually they don't do that reliably. In fact, when combined
> with usage of 'goto', they introduce uninitialized variables,
> despite the declaration having an initialization present, and
> thus actively mislead reviewers into thinking their code is
> safe.
>
> Consider this example:

[...]

> What happens is that when you 'goto $LABEL' across a variable
> declaration, the variable is in scope at your target label, but
> its declared initializers never get run :-(
>
> Luckily you can protect against that with gcc:
>
> $ gcc -Wjump-misses-init -Wall -o mixed mixed.c
> mixed.c: In function ‘foo’:
> mixed.c:7:12: warning: jump skips variable initialization [-Wjump-misses-init]
> 7 |goto cleanup;
>   |^~~~
> mixed.c:15:5: note: label ‘cleanup’ defined here
>15 | cleanup:
>   | ^~~
> mixed.c:11:13: note: ‘items’ declared here
>11 |int *items = malloc(sizeof(int) *nitems);
>   | ^
> mixed.c:7:12: warning: jump skips variable initialization [-Wjump-misses-init]
> 7 |goto cleanup;
>   |^~~~
> mixed.c:15:5: note: label ‘cleanup’ defined here
>15 | cleanup:
>   | ^~~
> mixed.c:10:12: note: ‘nitems’ declared here
>10 |int nitems = 3;
>   |^~
>
>
> however that will warn about *all* cases where we jump over a
> declared variable, even if the variable we're jumping over is
> not used at the target label location. IOW, it has significant
> false positive rates. There are quite a few triggers for this
> in the QEMU code already if we turn on this warning.
>
> It also doesn't alter that the code initialization is misleading
> to read.

Yup.  Strong dislike.

>> - (at least for me), declaring the index inside the for make clear
>>   that index is not used outside the for.
>
> I'll admit that declaring loop indexes in the for() is a nice
> bit, but I'm not a fan in general of mixing the declarations
> in the middle of code for projects that use the 'goto cleanup'
> pattern.

A declaration in a for statement's first operand is effectively at the
beginning of a block.  Therefore, use of this feature is already
sanctioned by the QEMU Coding Style.  The proposed patch at most
clarifies this.

>> - Current documentation already declares that they are allowed in some
>>   cases.
>> - Lots of places already use them.
>> 
>> We can change the text to whatever you want, just wondering if it is
>> valib to change the standard.
>> 
>> Doing a trivial grep through my local qemu messages (around 100k) it
>> shows that some people are complaining that they are not allowed, and
>> other saying that they are used all over the place.
>
> IMHO the status quo is bad because it is actively dangerous when
> combined with goto and we aren't using any compiler warnings to
> help us.
>
> Either we allow it, but use -Wjump-misses-init to prevent mixing
> delayed declarations with gotos, and just avoid this when it triggers
> a false positive.
>
> Or we forbid it, rewrite current cases that use it, and then add
> -Wdeclaration-after-statement to enforce it.

I'm in favour of -Wdeclaration-after-statement.

> IMHO if we are concerned about uninitialized variables then I think
> a better approach is to add -ftrivial-auto-var-init=zero, which will
> make the compiler initialize all variables to 0 if they lack an
> explicit initializer. 

How often do we get bitten by uninitialized variables despite
-Wmaybe-uninitialized?  Honest question!

>> Discuss.

Re: [PATCH 2/2] qtest: Add a test case for TPM TIS I2C connected to Aspeed I2C controller

[Stefan Berger]

On 3/27/23 03:49, Cédric Le Goater wrote:

On 3/27/23 02:37, Stefan Berger wrote:

Add a test case for the TPM TIS I2C device exercising most of its
functionality, including localities.

Add library functions for being able to read from and write to registers
of the TPM TIS I2C device connected to the Aspeed i2c controller.

Signed-off-by: Stefan Berger 


Thanks for doing the I2C qtest driver. This gives the opportunity to write
more unit tests.


---
  tests/qtest/meson.build    |   3 +
  tests/qtest/qtest_aspeed.c | 117 ++
  tests/qtest/qtest_aspeed.h |  27 ++
  tests/qtest/tpm-tis-i2c-test.c | 628 +
  4 files changed, 775 insertions(+)
  create mode 100644 tests/qtest/qtest_aspeed.c
  create mode 100644 tests/qtest/qtest_aspeed.h
  create mode 100644 tests/qtest/tpm-tis-i2c-test.c

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 29a4efb4c2..065a00d34d 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -200,6 +200,7 @@ qtests_arm = \
    (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
    (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
    (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : 
[]) + \
+  (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : 
[]) + \
    ['arm-cpu-features',
 'microbit-test',
 'test-arm-mptimer',
@@ -212,6 +213,7 @@ qtests_aarch64 = \
  ['tpm-tis-device-test', 'tpm-tis-device-swtpm-test'] : []) +  
   \
    (config_all_devices.has_key('CONFIG_XLNX_ZYNQMP_ARM') ? ['xlnx-can-test', 
'fuzz-xlnx-dp-test'] : []) + \
    (config_all_devices.has_key('CONFIG_RASPI') ? ['bcm2835-dma-test'] : []) +  
\
+  (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : 
[]) + \
    ['arm-cpu-features',
 'numa-test',
 'boot-serial-test',
@@ -303,6 +305,7 @@ qtests = {
    'tpm-crb-test': [io, tpmemu_files],
    'tpm-tis-swtpm-test': [io, tpmemu_files, 'tpm-tis-util.c'],
    'tpm-tis-test': [io, tpmemu_files, 'tpm-tis-util.c'],
+  'tpm-tis-i2c-test': [io, tpmemu_files, 'qtest_aspeed.c'],
    'tpm-tis-device-swtpm-test': [io, tpmemu_files, 'tpm-tis-util.c'],
    'tpm-tis-device-test': [io, tpmemu_files, 'tpm-tis-util.c'],
    'vmgenid-test': files('boot-sector.c', 'acpi-utils.c'),
diff --git a/tests/qtest/qtest_aspeed.c b/tests/qtest/qtest_aspeed.c
new file mode 100644
index 00..2b316178e4
--- /dev/null
+++ b/tests/qtest/qtest_aspeed.c
@@ -0,0 +1,117 @@
+/*
+ * Aspeed i2c bus interface to reading and writing to i2c device registers
+ *
+ * Copyright (c) 2023 IBM Corporation
+ *
+ * Authors:
+ *   Stefan Berger 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "qtest_aspeed.h"
+
+#include "hw/i2c/aspeed_i2c.h"
+#include "libqtest-single.h"
+
+#define A_I2CD_M_STOP_CMD   BIT(5)
+#define A_I2CD_M_RX_CMD BIT(3)
+#define A_I2CD_M_TX_CMD BIT(1)
+#define A_I2CD_M_START_CMD  BIT(0)
+
+#define A_I2CD_MASTER_EN    BIT(0)


Why do you need to include the aspeed_i2c.h file and add some more
definitions ? Couldn't we gather all of them under the same file ?


I moved them now.




+
+#define I2C_SLAVE_ADDR   0x2e
+#define I2C_DEV_BUS_NUM  10
+
+static const uint8_t TPM_CMD[12] =
+    "\x80\x01\x00\x00\x00\x0c\x00\x00\x01\x44\x00\x00";
+
+uint32_t aspeed_dev_addr = 0X1e78a000 + 0x80 + I2C_DEV_BUS_NUM * 0x80;


0X1e78a000 could be a define


Is it suitable for a public header file or limited to the board we are using it 
with?
Where should the define go? Into the qtest_aspeed.h file under this name?

#define AST2600_ASPEED_I2C_BASE_ADDR 0x1e78a


> The resulting address should be calculated with an helper defined in
qtest_aspeed.h, with an ast2600_ prefix in the name since the calculation
is SoC dependent.  See aspeed_i2c_realize()


static inline uint32_t ast2600_aspeed_i2c_calc_dev_addr(uint8_t bus_num)
{
return AST2600_ASPEED_I2C_BASE_ADDR + 0x80 + bus_num * 0x80;
}
Like this?



My knowledge on TPM is too limited to comment. Could you please extract
the I2C driver in its own patch ?


Will do.

   Stefan

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Joel Stanley]

On Mon, 27 Mar 2023 at 08:21, Cédric Le Goater  wrote:
>
> >>> However on a clean boot into the TPM, the u-boot tpm commands fail:
> >>>
> >>> ast# tpm info
> >>> tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [closed]
> >>> ast# tpINTERRUPT>
> >>> ast# tpm init
> >>> ast# tpm info
> >>> tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [open]
> >>> ast# tpm pcr_read 0 0x8100
> >>> Error: 256
> >>> ast# md.l 0x8100 16
> >>> 8100:    
> >>> 8110:    
> >>> 8120:    
> >>> 8130:    
> >>> 8140:    
> >>> 8150:    
> >>>
> >>> This doesn't need to block merging into qemu, as the model works fine
> >>> for pcr measurement and accessing under Linux. However it would be
> >>> good to work though these issues in case there's a modelling
> >>> discrepancy.
> >>
> >>
> >> Yes, Please provide me details on how to reproduce it. I will take a look.
> >
> > This is the buildroot tree I've been using for testing:
> >
> > https://github.com/shenki/buildroot/commits/ast2600-tpm
> >
> > git clone https://github.com/shenki/buildroot -b ast2600-tpm
> > cd buildroot
> > make O=ast2600evb aspeed_ast2600evb_defconfig
>
> I have pushed binaries here also :
>
>
> https://github.com/legoater/qemu-aspeed-boot/tree/master/images/ast2600-evb/buildroot-2023.02-tpm

Thank you!

The non-zero PCRs I see with this are:

#  grep -r . /sys/class/tpm/tpm0/pcr-sha256/ | sort -n -k 7 -t /
/sys/class/tpm/tpm0/pcr-sha256/0:B804724EA13F52A9072BA87FE8FDCC497DFC9DF9AA15B9088694639C431688E0
/sys/class/tpm/tpm0/pcr-sha256/1:37F0F710A5502FAE6DB7433B36001FEE1CBF15BA2A7D6923207FF56888584714
/sys/class/tpm/tpm0/pcr-sha256/2:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/3:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/4:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/5:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/6:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/7:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/8:C840364040A0F98631A48A4C401C567226BFE5A2A30B958F1800E4849A140F69
/sys/class/tpm/tpm0/pcr-sha256/9:9D00428C528120A3F2D0D8CB0EB5D036D87C0D0F8D2990B8C1F12DEFAE3890C7

They seem to be stable across boots, which is good! We could use these
images and that pcr0 value for an avocado test.

Perhaps we could add an init script that binds the driver and prints
the value to the console to save having to log in.

Re: [PATCH] Change the default for Mixed declarations.

[Markus Armbruster]

Alex Bennée  writes:

> Juan Quintela  writes:
>
>> Daniel P. Berrangé  wrote:
>>> On Tue, Feb 14, 2023 at 05:07:38PM +0100, Juan Quintela wrote:
 Hi
 
 I want to enter a discussion about changing the default of the style
 guide.
 
 There are several reasons for that:
 - they exist since C99 (i.e. all supported compilers support them)
 - they eliminate the posibility of an unitialized variable.
>>>
>>> Actually they don't do that reliably. In fact, when combined
>>> with usage of 'goto', they introduce uninitialized variables,
>>> despite the declaration having an initialization present, and
>>> thus actively mislead reviewers into thinking their code is
>>> safe.
>>
>> Wait a minute.
>> If you use goto, you are already in special rules.
>>
>> And don't get confused, I fully agree when using goto for two reasons:
>> - performance
>>   if you show that the code is x% faster when using goto, it is
>>   justified.  It is even better if you send a bug report to gcc/clang,
>>   but I will not opose that use.
>
> I await a clear example in the context of QEMU - there is almost always
> a better way to structure things.
>
>> - code clearity
>>   Some code (basically error paths) are clearer with goto that without
>>   them.
>
> Now we have g_auto* and lock guards we should encourage their use. goto
> error_path is a relic of a simpler time ;-)

Only 8004 places to "modernize" (not counting generated code and
documentation) before presence of goto ceases to be a concern.

[...]

Re: [PATCH v2 2/5] apic: add support for x2APIC mode

[David Woodhouse]

On Sun, 2023-03-26 at 12:20 +0700, Bui Quang Minh wrote:
> This commit extends the APIC ID to 32-bit long and remove the 255 max APIC
> ID limit in userspace APIC. The array that manages local APICs is now
> dynamically allocated based on the max APIC ID of created x86 machine.
> Also, new x2APIC IPI destination determination scheme, self IPI and x2APIC
> mode register access are supported.
> 
> Signed-off-by: Bui Quang Minh 
> ---
>  hw/i386/x86.c   |   8 +-
>  hw/intc/apic.c  | 229 +++-
>  hw/intc/apic_common.c   |   8 +-
>  include/hw/i386/apic.h  |   3 +-
>  include/hw/i386/apic_internal.h |   2 +-
>  5 files changed, 184 insertions(+), 66 deletions(-)
> 
> diff --git a/hw/i386/x86.c b/hw/i386/x86.c
> index a88a126123..fa9b15190d 100644
> --- a/hw/i386/x86.c
> +++ b/hw/i386/x86.c
> @@ -132,11 +132,11 @@ void x86_cpus_init(X86MachineState *x86ms, int 
> default_cpu_version)
>   * Can we support APIC ID 255 or higher?
>   *
>   * Under Xen: yes.
> - * With userspace emulated lapic: no
> + * With userspace emulated lapic: yes.

Are you making this unconditional? It shall not be possible to emulate
a CPU *without* X2APIC?


>   * With KVM's in-kernel lapic: only if X2APIC API is enabled.
>   */
>  if (x86ms->apic_id_limit > 255 && !xen_enabled() &&
> -    (!kvm_irqchip_in_kernel() || !kvm_enable_x2apic())) {
> +    kvm_irqchip_in_kernel() && !kvm_enable_x2apic()) {
>  error_report("current -smp configuration requires kernel "
>   "irqchip and X2APIC API support.");
>  exit(EXIT_FAILURE);
...
> @@ -276,16 +288,17 @@ static void apic_bus_deliver(const uint32_t 
> *deliver_bitmask,
>   apic_set_irq(apic_iter, vector_num, trigger_mode) );
>  }
>  
> -void apic_deliver_irq(uint8_t dest, uint8_t dest_mode, uint8_t delivery_mode,
> +void apic_deliver_irq(uint32_t dest, uint8_t dest_mode, uint8_t 
> delivery_mode,
>    uint8_t vector_num, uint8_t trigger_mode)

We can make this 'static' while we're here. It isn't actually called
from anywhere else, is it?

>  {
> -    uint32_t deliver_bitmask[MAX_APIC_WORDS];
> +    uint32_t *deliver_bitmask = g_malloc(max_apic_words * sizeof(uint32_t));
>  
>  trace_apic_deliver_irq(dest, dest_mode, delivery_mode, vector_num,
>     trigger_mode);
>  
>  apic_get_delivery_bitmask(deliver_bitmask, dest, dest_mode);
>  apic_bus_deliver(deliver_bitmask, delivery_mode, vector_num, 
> trigger_mode);
> +    g_free(deliver_bitmask);
>  }
>  
>  bool is_x2apic_mode(DeviceState *dev)
...
>  
>  static void apic_get_delivery_bitmask(uint32_t *deliver_bitmask,
> -  uint8_t dest, uint8_t dest_mode)
> +  uint32_t dest, uint8_t dest_mode)
>  {
>  APICCommonState *apic_iter;
>  int i;
>  
> +    memset(deliver_bitmask, 0x00, max_apic_words * sizeof(uint32_t));
> +
> +    /* x2APIC broadcast id for both physical and logical (cluster) mode */
> +    if (dest == 0x) {
> +    apic_get_broadcast_bitmask(deliver_bitmask, true);
> +    return;
> +    }
> +
>  if (dest_mode == 0) {

Might be nice to have a constant for DEST_MODE_PHYS vs.
DEST_MODE_LOGICAL to make this clearer? 

> +    apic_find_dest(deliver_bitmask, dest);
> +    /* Broadcast to xAPIC mode apics */
>  if (dest == 0xff) {
> -    memset(deliver_bitmask, 0xff, MAX_APIC_WORDS * sizeof(uint32_t));
> -    } else {
> -    int idx = apic_find_dest(dest);
> -    memset(deliver_bitmask, 0x00, MAX_APIC_WORDS * sizeof(uint32_t));
> -    if (idx >= 0)
> -    apic_set_bit(deliver_bitmask, idx);
> +    apic_get_broadcast_bitmask(deliver_bitmask, false);


Hrm... aren't you still interpreting destination 0x00FF as
broadcast even for X2APIC mode? Or am I misreading this?


>  }
>  } else {
>  /* XXX: cluster mode */
> 
...

> @@ -366,7 +370,7 @@ static const VMStateDescription vmstate_apic_common = {
>  VMSTATE_UINT8(arb_id, APICCommonState),
>  VMSTATE_UINT8(tpr, APICCommonState),
>  VMSTATE_UINT32(spurious_vec, APICCommonState),
> -    VMSTATE_UINT8(log_dest, APICCommonState),
> +    VMSTATE_UINT32(log_dest, APICCommonState),
>  VMSTATE_UINT8(dest_mode, APICCommonState),
>  VMSTATE_UINT32_ARRAY(isr, APICCommonState, 8),
>  VMSTATE_UINT32_ARRAY(tmr, APICCommonState, 8),


Hm, doesn't this need to be added in a separate subsection, much as
ide_drive/pio_state in the example in docs/devel/migration.rst? Or did
I *not* need to do that in commit ecb0e98b4 (unrelated to x2apic, but
similar addition of state)?

Can you confirm that you've tested the behaviour when migrating back
from this to an older QEMU, both for a guest *with* X2APIC enabled
(which should fail gracefully), and a guest wi

Re: [PATCH v2] virtio: refresh vring region cache after updating a virtqueue size

[Cornelia Huck]

On Wed, Mar 22 2023, Halil Pasic  wrote:

> On Wed, 22 Mar 2023 10:52:31 +0100
> Cornelia Huck  wrote:
> [..]
>> >
>> > diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
>> > index e33e5207ab..f44de1a8c1 100644
>> > --- a/hw/s390x/virtio-ccw.c
>> > +++ b/hw/s390x/virtio-ccw.c
>> > @@ -237,6 +237,7 @@ static int virtio_ccw_set_vqs(SubchDev *sch, 
>> > VqInfoBlock *info,
>> >  return -EINVAL;
>> >  }
>> >  virtio_queue_set_num(vdev, index, num);
>> > +virtio_init_region_cache(vdev, index);  
>> 
>> Hmm... this is not wrong, but looking at it again, I see that the guest
>> has no way to change num after our last call to
>> virtio_init_region_cache() (while setting up the queue addresses.) IOW,
>> this introduces an extra round trip that is not really needed.
>> 
>
> I don't quite understand. AFAIU the virtio_init_region_cache() would see
> the (new) queue addresses but not the new size (num). Yes virtio-ccw
> already knows the new num but it is yet to call
> to put it into vdev->vq[n].vring.num from where
> virtio_init_region_cache() picks it up.
>
> If we were to first virtio_queue_set_num() and only then the address
> I would understand. But with the code as is, I don't. Am I missing
> something?

Hrm, virtio_queue_set_rings() doesn't pass num, I thought it did... I
wonder whether ordering virtio_queue_set_num() before it would be better
anyway (if the guest gave us an invalid num, we don't need to setup any
addresses and init any caches).

Smth like

if (info) {
   if (desc) {
  if (virtio_queue_get_max_num(...) < num) {
  return -EINVAL;
  }
  virtio_queue_set_num(...);
   }
   virtio_queue_set_rings(...);
} else { /* legacy */
   if (desc && virtio_queue_get_max_num(...) > num) {
   return -EINVAL;
   }
   virtio_queue_set_addr(...);
}
virtio_queue_set_vector(vdev, index, desc ? index : VIRTIO_NO_VECTOR);

might be easier to follow than the current code.

Or we could just go with this patch, which has the advantage of already
existing :)

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Stefan Berger]

On 3/26/23 21:05, Joel Stanley wrote:

Hi Ninad,

On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:


Hello,

I have incorporated review comments from Stefan. Please review.

This drop adds support for the TPM devices attached to the I2C bus. It
only supports the TPM2 protocol. You need to run it with the external
TPM emulator like swtpm. I have tested it with swtpm.


Nice work. I tested these stop cedric's aspeed-8.0 qemu tree, using
the rainier machine and the openbmc dev-6.1 kernel.

We get this message when booting from a kernel:

[0.582699] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
[0.586361] tpm tpm0: A TPM error (256) occurred attempting the self test
[0.586623] tpm tpm0: starting up the TPM manually

Do we understand why the error appears?


The firmware did not initialize the TPM 2.





# grep -r . /sys/class/tpm/tpm0/pcr-sha256/ | sort -n -k 7 -t /
/sys/class/tpm/tpm0/pcr-sha256/0:
/sys/class/tpm/tpm0/pcr-sha256/1:
/sys/class/tpm/tpm0/pcr-sha256/2:
/sys/class/tpm/tpm0/pcr-sha256/3:
/sys/class/tpm/tpm0/pcr-sha256/4:
/sys/class/tpm/tpm0/pcr-sha256/5:
/sys/class/tpm/tpm0/pcr-sha256/6:
/sys/class/tpm/tpm0/pcr-sha256/7:
/sys/class/tpm/tpm0/pcr-sha256/8:
/sys/class/tpm/tpm0/pcr-sha256/9:
/sys/class/tpm/tpm0/pcr-sha256/10:
/sys/class/tpm/tpm0/pcr-sha256/11:
/sys/class/tpm/tpm0/pcr-sha256/12:
/sys/class/tpm/tpm0/pcr-sha256/13:
/sys/class/tpm/tpm0/pcr-sha256/14:
/sys/class/tpm/tpm0/pcr-sha256/15:
/sys/class/tpm/tpm0/pcr-sha256/16:
/sys/class/tpm/tpm0/pcr-sha256/17:
/sys/class/tpm/tpm0/pcr-sha256/18:
/sys/class/tpm/tpm0/pcr-sha256/19:
/sys/class/tpm/tpm0/pcr-sha256/20:
/sys/class/tpm/tpm0/pcr-sha256/21:
/sys/class/tpm/tpm0/pcr-sha256/22:
/sys/class/tpm/tpm0/pcr-sha256/23:

If I boot through the openbmc u-boot for the p10bmc machine, which
measures things into the PCRs:

[0.556713] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)


In this case the firmware started up the TPM 2. Also the PCRs have been touched 
by the firmware in this case.



/ # grep -r . /sys/class/tpm/tpm0/pcr-sha256/ | sort -n -k 7 -t /
/sys/class/tpm/tpm0/pcr-sha256/0:AFA13691EFC7BC6E189E92347F20676FB4523302CB957DA9A65C3430C45E8BCC
/sys/class/tpm/tpm0/pcr-sha256/1:37F0F710A5502FAE6DB7433B36001FEE1CBF15BA2A7D6923207FF56888584714
/sys/class/tpm/tpm0/pcr-sha256/2:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/3:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/4:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/5:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/6:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/7:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
/sys/class/tpm/tpm0/pcr-sha256/8:AE67485BD01E8D6FE0208C46C473940173F66E9C6F43C75ABB404375787E9705
/sys/class/tpm/tpm0/pcr-sha256/9:DB99D92EADBB446894CB0C062AEB673F60DDAFBC62BC2A9CA561A13B31E5357C
/sys/class/tpm/tpm0/pcr-sha256/10:
/sys/class/tpm/tpm0/pcr-sha256/11:
/sys/class/tpm/tpm0/pcr-sha256/12:
/sys/class/tpm/tpm0/pcr-sha256/13:
/

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Stefan Berger]

On 3/27/23 04:04, Joel Stanley wrote:

On Mon, 27 Mar 2023 at 03:52, Ninad Palsule  wrote:


Hi Joel,

On 3/26/23 8:05 PM, Joel Stanley wrote:

Hi Ninad,

On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:

Hello,

I have incorporated review comments from Stefan. Please review.

This drop adds support for the TPM devices attached to the I2C bus. It
only supports the TPM2 protocol. You need to run it with the external
TPM emulator like swtpm. I have tested it with swtpm.

Nice work. I tested these stop cedric's aspeed-8.0 qemu tree, using
the rainier machine and the openbmc dev-6.1 kernel.

We get this message when booting from a kernel:

[0.582699] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
[0.586361] tpm tpm0: A TPM error (256) occurred attempting the self test
[0.586623] tpm tpm0: starting up the TPM manually

Do we understand why the error appears?



Yes, As per kernel code this is an expected error for some emulators.

On swtpm emulator, It returns TPM2_RC_INITIALIZE if emulator is not
initialized. I searched it in swtpm and it indicated that selftest
requested before it is initialized. I meant to ask Stefan but busy with
the review comments.


The swtpm man page mentions some flags we can set. Perhaps they would help?

--flags [not-need-init]
[,startup-clear|startup-state|startup-deactivated|startup-none]


With firmware initializing the TPM 2 neither of these options is necessary.
If firmware doesn't initialize the TPM 2 then Linux will show that error 
message and initialize it.



   Stefan

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Joel Stanley]

On Mon, 27 Mar 2023 at 11:11, Stefan Berger  wrote:
>
>
>
> On 3/26/23 21:05, Joel Stanley wrote:
> > Hi Ninad,
> >
> > On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:
> >>
> >> Hello,
> >>
> >> I have incorporated review comments from Stefan. Please review.
> >>
> >> This drop adds support for the TPM devices attached to the I2C bus. It
> >> only supports the TPM2 protocol. You need to run it with the external
> >> TPM emulator like swtpm. I have tested it with swtpm.
> >
> > Nice work. I tested these stop cedric's aspeed-8.0 qemu tree, using
> > the rainier machine and the openbmc dev-6.1 kernel.
> >
> > We get this message when booting from a kernel:
> >
> > [0.582699] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
> > [0.586361] tpm tpm0: A TPM error (256) occurred attempting the self test
> > [0.586623] tpm tpm0: starting up the TPM manually
> >
> > Do we understand why the error appears?
>
> The firmware did not initialize the TPM 2.

Which firmware are we talking about here?

In the case of these systems, we (u-boot+linux) are what would
traditionally be referred to as firmware.

> > # grep -r . /sys/class/tpm/tpm0/pcr-sha256/ | sort -n -k 7 -t /
> > /sys/class/tpm/tpm0/pcr-sha256/0:
> > /sys/class/tpm/tpm0/pcr-sha256/1:
> > /sys/class/tpm/tpm0/pcr-sha256/2:
> > /sys/class/tpm/tpm0/pcr-sha256/3:
> > /sys/class/tpm/tpm0/pcr-sha256/4:
> > /sys/class/tpm/tpm0/pcr-sha256/5:
> > /sys/class/tpm/tpm0/pcr-sha256/6:
> > /sys/class/tpm/tpm0/pcr-sha256/7:
> > /sys/class/tpm/tpm0/pcr-sha256/8:
> > /sys/class/tpm/tpm0/pcr-sha256/9:
> > /sys/class/tpm/tpm0/pcr-sha256/10:
> > /sys/class/tpm/tpm0/pcr-sha256/11:
> > /sys/class/tpm/tpm0/pcr-sha256/12:
> > /sys/class/tpm/tpm0/pcr-sha256/13:
> > /sys/class/tpm/tpm0/pcr-sha256/14:
> > /sys/class/tpm/tpm0/pcr-sha256/15:
> > /sys/class/tpm/tpm0/pcr-sha256/16:
> > /sys/class/tpm/tpm0/pcr-sha256/17:
> > /sys/class/tpm/tpm0/pcr-sha256/18:
> > /sys/class/tpm/tpm0/pcr-sha256/19:
> > /sys/class/tpm/tpm0/pcr-sha256/20:
> > /sys/class/tpm/tpm0/pcr-sha256/21:
> > /sys/class/tpm/tpm0/pcr-sha256/22:
> > /sys/class/tpm/tpm0/pcr-sha256/23:
> >
> > If I boot through the openbmc u-boot for the p10bmc machine, which
> > measures things into the PCRs:
> >
> > [0.556713] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
>
> In this case the firmware started up the TPM 2. Also the PCRs have been 
> touched by the firmware in this case.
>
> >
> > / # grep -r . /sys/class/tpm/tpm0/pcr-sha256/ | sort -n -k 7 -t /
> > /sys/class/tpm/tpm0/pcr-sha256/0:AFA13691EFC7BC6E189E92347F20676FB4523302CB957DA9A65C3430C45E8BCC
> > /sys/class/tpm/tpm0/pcr-sha256/1:37F0F710A5502FAE6DB7433B36001FEE1CBF15BA2A7D6923207FF56888584714
> > /sys/class/tpm/tpm0/pcr-sha256/2:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
> > /sys/class/tpm/tpm0/pcr-sha256/3:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
> > /sys/class/tpm/tpm0/pcr-sha256/4:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
> > /sys/class/tpm/tpm0/pcr-sha256/5:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
> > /sys/class/tpm/tpm0/pcr-sha256/6:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
> > /sys/class/tpm/tpm0/pcr-sha256/7:E21B703EE69C77476BCCB43EC0336A9A1B2914B378944F7B00A10214CA8FEA93
> > /sys/class/tpm/tpm0/pcr-sha256/8:AE67485BD01E8D6FE0208C46C473940173F66E9C6F43C75ABB404375787E9705
> > /sys/class/tpm/tpm0/pcr-sha256/9:DB99D

[PATCH] hw/loongarch/virt: Fix virt_to_phys_addr function

[Tianrui Zhao]

The virt addr should mask TARGET_PHYS_ADDR_SPACE_BITS to
get the phys addr, and this is used by loading kernel elf.

Signed-off-by: Tianrui Zhao 
---
 hw/loongarch/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index b702c3f51e..f4bf14c1c8 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -399,7 +399,7 @@ static struct _loaderparams {
 
 static uint64_t cpu_loongarch_virt_to_phys(void *opaque, uint64_t addr)
 {
-return addr & 0x1fffll;
+return addr & MAKE_64BIT_MASK(0, TARGET_PHYS_ADDR_SPACE_BITS);
 }
 
 static int64_t load_kernel_info(void)
-- 
2.31.1

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Stefan Berger]

On 3/27/23 07:18, Joel Stanley wrote:

On Mon, 27 Mar 2023 at 11:11, Stefan Berger  wrote:




On 3/26/23 21:05, Joel Stanley wrote:

Hi Ninad,

On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:


Hello,

I have incorporated review comments from Stefan. Please review.

This drop adds support for the TPM devices attached to the I2C bus. It
only supports the TPM2 protocol. You need to run it with the external
TPM emulator like swtpm. I have tested it with swtpm.


Nice work. I tested these stop cedric's aspeed-8.0 qemu tree, using
the rainier machine and the openbmc dev-6.1 kernel.

We get this message when booting from a kernel:

[0.582699] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
[0.586361] tpm tpm0: A TPM error (256) occurred attempting the self test
[0.586623] tpm tpm0: starting up the TPM manually

Do we understand why the error appears?


The firmware did not initialize the TPM 2.


Which firmware are we talking about here?


This happens if either no firmware is used or the firmware doesn't know how to 
talk to the TPM 2.
Linux detects that the TPM 2 wasn't initialized (TPM2_Startup was not sent).
  
   Stefan

[PATCH for-8.0] block/export: Fix graph locking in blk_get_geometry() call

[Kevin Wolf]

blk_get_geometry() eventually calls bdrv_nb_sectors(), which is a
co_wrapper_mixed_bdrv_rdlock. This means that when it is called from
coroutine context, it already assume to have the graph locked.

However, virtio_blk_sect_range_ok() in block/export/virtio-blk-handler.c
(used by vhost-user-blk and VDUSE exports) runs in a coroutine, but
doesn't take the graph lock - blk_*() functions are generally expected
to do that internally. This causes an assertion failure when accessing
an export for the first time if it runs in an iothread.

This is an example of the crash:

$ ./storage-daemon/qemu-storage-daemon --object iothread,id=th0 --blockdev 
file,filename=/home/kwolf/images/hd.img,node-name=disk --export 
vhost-user-blk,addr.type=unix,addr.path=/tmp/vhost.sock,node-name=disk,id=exp0,iothread=th0
qemu-storage-daemon: ../block/graph-lock.c:268: void 
assert_bdrv_graph_readable(void): Assertion `qemu_in_main_thread() || 
reader_count()' failed.

(gdb) bt

Fix this by creating a new blk_co_get_geometry() that takes the lock,
and changing blk_get_geometry() to be a co_wrapper_mixed around it.

To make the resulting code cleaner, virtio-blk-handler.c can directly
call the coroutine version now (though that wouldn't be necessary for
fixing the bug, taking the lock in blk_co_get_geometry() is what fixes
it).

Fixes: 8ab8140a04cf771d63e9754d6ba6c1e676bfe507
Reported-by: Lukáš Doktor 
Signed-off-by: Kevin Wolf 
---
 include/block/block-io.h  | 4 +++-
 include/sysemu/block-backend-io.h | 5 -
 block.c   | 5 +++--
 block/block-backend.c | 7 +--
 block/export/virtio-blk-handler.c | 7 ---
 5 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/include/block/block-io.h b/include/block/block-io.h
index 5da99d4d60..dbc034b728 100644
--- a/include/block/block-io.h
+++ b/include/block/block-io.h
@@ -89,7 +89,9 @@ int64_t co_wrapper 
bdrv_get_allocated_file_size(BlockDriverState *bs);
 
 BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
BlockDriverState *in_bs, Error **errp);
-void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
+
+void coroutine_fn GRAPH_RDLOCK
+bdrv_co_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
 
 int coroutine_fn GRAPH_RDLOCK
 bdrv_co_delete_file(BlockDriverState *bs, Error **errp);
diff --git a/include/sysemu/block-backend-io.h 
b/include/sysemu/block-backend-io.h
index 40ab178719..c672b77247 100644
--- a/include/sysemu/block-backend-io.h
+++ b/include/sysemu/block-backend-io.h
@@ -70,7 +70,10 @@ void co_wrapper blk_eject(BlockBackend *blk, bool 
eject_flag);
 int64_t coroutine_fn blk_co_getlength(BlockBackend *blk);
 int64_t co_wrapper_mixed blk_getlength(BlockBackend *blk);
 
-void blk_get_geometry(BlockBackend *blk, uint64_t *nb_sectors_ptr);
+void coroutine_fn blk_co_get_geometry(BlockBackend *blk,
+  uint64_t *nb_sectors_ptr);
+void co_wrapper_mixed blk_get_geometry(BlockBackend *blk,
+   uint64_t *nb_sectors_ptr);
 
 int64_t coroutine_fn blk_co_nb_sectors(BlockBackend *blk);
 int64_t co_wrapper_mixed blk_nb_sectors(BlockBackend *blk);
diff --git a/block.c b/block.c
index 0dd604d0f6..e0c6c648b1 100644
--- a/block.c
+++ b/block.c
@@ -5879,9 +5879,10 @@ int64_t coroutine_fn bdrv_co_getlength(BlockDriverState 
*bs)
 }
 
 /* return 0 as number of sectors if no device present or error */
-void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr)
+void coroutine_fn bdrv_co_get_geometry(BlockDriverState *bs,
+   uint64_t *nb_sectors_ptr)
 {
-int64_t nb_sectors = bdrv_nb_sectors(bs);
+int64_t nb_sectors = bdrv_co_nb_sectors(bs);
 IO_CODE();
 
 *nb_sectors_ptr = nb_sectors < 0 ? 0 : nb_sectors;
diff --git a/block/block-backend.c b/block/block-backend.c
index 278b04ce69..2ee39229e4 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -1615,13 +1615,16 @@ int64_t coroutine_fn blk_co_getlength(BlockBackend *blk)
 return bdrv_co_getlength(blk_bs(blk));
 }
 
-void blk_get_geometry(BlockBackend *blk, uint64_t *nb_sectors_ptr)
+void coroutine_fn blk_co_get_geometry(BlockBackend *blk,
+  uint64_t *nb_sectors_ptr)
 {
 IO_CODE();
+GRAPH_RDLOCK_GUARD();
+
 if (!blk_bs(blk)) {
 *nb_sectors_ptr = 0;
 } else {
-bdrv_get_geometry(blk_bs(blk), nb_sectors_ptr);
+bdrv_co_get_geometry(blk_bs(blk), nb_sectors_ptr);
 }
 }
 
diff --git a/block/export/virtio-blk-handler.c 
b/block/export/virtio-blk-handler.c
index 313666e8ab..bc1cec6757 100644
--- a/block/export/virtio-blk-handler.c
+++ b/block/export/virtio-blk-handler.c
@@ -22,8 +22,9 @@ struct virtio_blk_inhdr {
 unsigned char status;
 };
 
-static bool virtio_blk_sect_range_ok(BlockBackend *blk, uint32_t block_size,
- uint64_t sector, size_t size)
+static bool cor

Re: [PATCH 1/1] nbd/server: push pending frames after sending reply

[Kevin Wolf]

Am 24.03.2023 um 11:47 hat Florian Westphal geschrieben:
> qemu-nbd doesn't set TCP_NODELAY on the tcp socket.
> 
> Kernel waits for more data and avoids transmission of small packets.
> Without TLS this is barely noticeable, but with TLS this really shows.
> 
> Booting a VM via qemu-nbd on localhost (with tls) takes more than
> 2 minutes on my system.  tcpdump shows frequent wait periods, where no
> packets get sent for a 40ms period.
> 
> Add explicit (un)corking when processing (and responding to) requests.
> "TCP_CORK, &zero" after earlier "CORK, &one" will flush pending data.
> 
> VM Boot time:
> main:no tls:  23s, with tls: 2m45s
> patched: no tls:  14s, with tls: 15s
> 
> VM Boot time, qemu-nbd via network (same lan):
> main:no tls:  18s, with tls: 1m50s
> patched: no tls:  17s, with tls: 18s
> 
> Future optimization: if we could detect if there is another pending
> request we could defer the uncork operation because more data would be
> appended.
> 
> Signed-off-by: Florian Westphal 

Thanks, applied to the block branch.

Kevin

Re: [PATCH] block/export: only acquire AioContext once for vhost_user_server_stop()

[Kevin Wolf]

Am 23.03.2023 um 15:58 hat Stefan Hajnoczi geschrieben:
> vhost_user_server_stop() uses AIO_WAIT_WHILE(). AIO_WAIT_WHILE()
> requires that AioContext is only acquired once.
> 
> Since blk_exp_request_shutdown() already acquires the AioContext it
> shouldn't be acquired again in vhost_user_server_stop().
> 
> Signed-off-by: Stefan Hajnoczi 

Thanks, applied to the block branch.

Kevin

[PATCH 1/2] linux-user: elfload: s/min_mmap_addr/mmap_min_addr/

[Andrew Jeffery]

As-is the error message can cause some confusion as the mentioned sysctl
attribute name is wrong:

https://www.kernel.org/doc/html/latest/admin-guide/sysctl/vm.html#mmap-min-addr

Signed-off-by: Andrew Jeffery 
---
 linux-user/elfload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 1dbc1f0f9baa..601b156b476b 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2771,7 +2771,7 @@ static void pgb_reserved_va(const char *image_name, 
abi_ulong guest_loaddr,
 if (addr == MAP_FAILED || addr != test) {
 error_report("Unable to reserve 0x%lx bytes of virtual address "
  "space at %p (%s) for use as guest address space (check 
your "
- "virtual memory ulimit setting, min_mmap_addr or reserve 
less "
+ "virtual memory ulimit setting, mmap_min_addr or reserve 
less "
  "using -R option)", reserved_va, test, strerror(errno));
 exit(EXIT_FAILURE);
 }
-- 
2.39.2

[PATCH 2/2] linux-user: elfload: Specify -R is an option for qemu-user binaries

[Andrew Jeffery]

Given several different concepts are suggested for investigation, let's
not confuse e.g. ulimit's -R with what was actually intended.

Signed-off-by: Andrew Jeffery 
---
 linux-user/elfload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 601b156b476b..694794f97202 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2772,7 +2772,8 @@ static void pgb_reserved_va(const char *image_name, 
abi_ulong guest_loaddr,
 error_report("Unable to reserve 0x%lx bytes of virtual address "
  "space at %p (%s) for use as guest address space (check 
your "
  "virtual memory ulimit setting, mmap_min_addr or reserve 
less "
- "using -R option)", reserved_va, test, strerror(errno));
+ "using qemu-user's -R option)",
+ reserved_va, test, strerror(errno));
 exit(EXIT_FAILURE);
 }
 
-- 
2.39.2

[PATCH 0/2] linux-user: Clarify error on failure to map guest address space

[Andrew Jeffery]

Hello,

This series is a couple of trivial improvements to the error message from 
linux-user's ELF loader
when it fails to mmap() the guest's address space. Both issues caused me brief 
confusion when trying
to sort myself out after hitting 
https://gitlab.com/qemu-project/qemu/-/issues/447

I've build tested the two as a sanity check.

Cheers,

Andrew

Andrew Jeffery (2):
  linux-user: elfload: s/min_mmap_addr/mmap_min_addr/
  linux-user: elfload: Specify -R is an option for qemu-user binaries

 linux-user/elfload.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

-- 
2.39.2

[PATCH v4 1/1] util/async-teardown: wire up query-command-line-options

[Claudio Imbrenda]

The recently introduced -async-teardown commandline option was not
wired up properly and did not show up in the output of the QMP command
query-command-line-options. This means that libvirt had no way to
discover whether the feature was supported.

This patch fixes the issue by replacing the -async-teardown option with
a new -teardown option with a new async=on|off parameter.
The new option is correctly wired up so that it appears in the output
of query-command-line-options.

Reported-by: Boris Fiuczynski 
Fixes: c891c24b1a ("os-posix: asynchronous teardown for shutdown on Linux")
Signed-off-by: Claudio Imbrenda 
---
 os-posix.c| 15 +--
 qemu-options.hx   | 33 +++--
 util/async-teardown.c | 21 +
 3 files changed, 53 insertions(+), 16 deletions(-)

diff --git a/os-posix.c b/os-posix.c
index 5adc69f560..c1ca7b1cb3 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -36,6 +36,8 @@
 #include "qemu/log.h"
 #include "sysemu/runstate.h"
 #include "qemu/cutils.h"
+#include "qemu/config-file.h"
+#include "qemu/option.h"
 
 #ifdef CONFIG_LINUX
 #include 
@@ -132,6 +134,8 @@ static bool os_parse_runas_uid_gid(const char *optarg)
  */
 int os_parse_cmd_args(int index, const char *optarg)
 {
+QemuOpts *opts;
+
 switch (index) {
 case QEMU_OPTION_runas:
 user_pwd = getpwnam(optarg);
@@ -152,8 +156,15 @@ int os_parse_cmd_args(int index, const char *optarg)
 daemonize = 1;
 break;
 #if defined(CONFIG_LINUX)
-case QEMU_OPTION_asyncteardown:
-init_async_teardown();
+case QEMU_OPTION_teardown:
+opts = qemu_opts_parse_noisily(qemu_find_opts("teardown"),
+   optarg, false);
+if (!opts) {
+exit(1);
+}
+if (qemu_opt_get_bool(opts, "async", false)) {
+init_async_teardown();
+}
 break;
 #endif
 default:
diff --git a/qemu-options.hx b/qemu-options.hx
index d42f60fb91..6a69b84f3c 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4763,23 +4763,28 @@ DEF("qtest", HAS_ARG, QEMU_OPTION_qtest, "", 
QEMU_ARCH_ALL)
 DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
 
 #ifdef __linux__
-DEF("async-teardown", 0, QEMU_OPTION_asyncteardown,
-"-async-teardown enable asynchronous teardown\n",
+DEF("teardown", HAS_ARG, QEMU_OPTION_teardown,
+"-teardown async[=on|off]\n"
+"process teardown options\n"
+"async=on enables asynchronous teardown\n"
+   ,
 QEMU_ARCH_ALL)
-#endif
 SRST
-``-async-teardown``
-Enable asynchronous teardown. A new process called "cleanup/"
-will be created at startup sharing the address space with the main qemu
-process, using clone. It will wait for the main qemu process to
-terminate completely, and then exit.
-This allows qemu to terminate very quickly even if the guest was
-huge, leaving the teardown of the address space to the cleanup
-process. Since the cleanup process shares the same cgroups as the
-main qemu process, accounting is performed correctly. This only
-works if the cleanup process is not forcefully killed with SIGKILL
-before the main qemu process has terminated completely.
+``-teardown``
+Set process teardown options.
+
+``async=on`` enables asynchronous teardown. A new process called
+"cleanup/" will be created at startup sharing the address
+space with the main QEMU process, using clone. It will wait for the
+main QEMU process to terminate completely, and then exit. This allows
+QEMU to terminate very quickly even if the guest was huge, leaving the
+teardown of the address space to the cleanup process. Since the cleanup
+process shares the same cgroups as the main QEMU process, accounting is
+performed correctly. This only works if the cleanup process is not
+forcefully killed with SIGKILL before the main QEMU process has
+terminated completely.
 ERST
+#endif
 
 DEF("msg", HAS_ARG, QEMU_OPTION_msg,
 "-msg [timestamp[=on|off]][,guest-name=[on|off]]\n"
diff --git a/util/async-teardown.c b/util/async-teardown.c
index 62cdeb0f20..4a5dbce958 100644
--- a/util/async-teardown.c
+++ b/util/async-teardown.c
@@ -12,6 +12,9 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/config-file.h"
+#include "qemu/option.h"
+#include "qemu/module.h"
 #include 
 #include 
 #include 
@@ -144,3 +147,21 @@ void init_async_teardown(void)
 clone(async_teardown_fn, new_stack_for_clone(), CLONE_VM, NULL);
 sigprocmask(SIG_SETMASK, &old_signals, NULL);
 }
+
+static QemuOptsList qemu_teardown_opts = {
+.name = "teardown",
+.head = QTAILQ_HEAD_INITIALIZER(qemu_teardown_opts.head),
+.desc = {
+{
+.name = "async",
+.type = QEMU_OPT_BOOL,
+},
+{ /* end of list */ }
+},
+};
+
+static void register_teardown(void)
+{
+qemu_add_opts(&qemu_teardown_opts);
+}
+opts_init(register_tear

[PATCH v4 0/1] util/async-teardown: wire up query-command-line-options

[Claudio Imbrenda]

The recently introduced -async-teardown commandline option was not
wired up properly and did not show up in the output of the QMP command
query-command-line-options. This means that libvirt will have no way to
discover whether the feature is supported.

This patch fixes the issue by adding a new -teardown commandline option
with an async=on|off parameter, correctly wired up so that it appears
in the output of query-command-line-options.

v3->v4
* completely remove the useless -async-teardown option, since it was
  not wired up properly and it had no users [thomas]
* QEMU should be always uppercase in text and documentation [thomas]
* if the new -teardown option fails to parse, exit immediately instead
  of returning an error [thomas]

v2->v3
* add a new teardown option with an async parameter [Markus]
* reworded documentation of existing -async-teardown option so that it
  points to the new teardown option

v1->v2
* remove the unneeded .implied_opt_name initializer [Thomas]

Claudio Imbrenda (1):
  util/async-teardown: wire up query-command-line-options

 os-posix.c| 15 +--
 qemu-options.hx   | 33 +++--
 util/async-teardown.c | 21 +
 3 files changed, 53 insertions(+), 16 deletions(-)

-- 
2.39.2

Re: [PATCH for-8.0] block/export: Fix graph locking in blk_get_geometry() call

[Emanuele Giuseppe Esposito]

Am 27/03/2023 um 13:39 schrieb Kevin Wolf:
> blk_get_geometry() eventually calls bdrv_nb_sectors(), which is a
> co_wrapper_mixed_bdrv_rdlock. This means that when it is called from
> coroutine context, it already assume to have the graph locked.
> 
> However, virtio_blk_sect_range_ok() in block/export/virtio-blk-handler.c
> (used by vhost-user-blk and VDUSE exports) runs in a coroutine, but
> doesn't take the graph lock - blk_*() functions are generally expected
> to do that internally. This causes an assertion failure when accessing
> an export for the first time if it runs in an iothread.
> 
> This is an example of the crash:
> 
> $ ./storage-daemon/qemu-storage-daemon --object iothread,id=th0 --blockdev 
> file,filename=/home/kwolf/images/hd.img,node-name=disk --export 
> vhost-user-blk,addr.type=unix,addr.path=/tmp/vhost.sock,node-name=disk,id=exp0,iothread=th0
> qemu-storage-daemon: ../block/graph-lock.c:268: void 
> assert_bdrv_graph_readable(void): Assertion `qemu_in_main_thread() || 
> reader_count()' failed.
> 
> (gdb) bt
> 
> Fix this by creating a new blk_co_get_geometry() that takes the lock,
> and changing blk_get_geometry() to be a co_wrapper_mixed around it.
> 
> To make the resulting code cleaner, virtio-blk-handler.c can directly
> call the coroutine version now (though that wouldn't be necessary for
> fixing the bug, taking the lock in blk_co_get_geometry() is what fixes
> it).
> 
> Fixes: 8ab8140a04cf771d63e9754d6ba6c1e676bfe507
> Reported-by: Lukáš Doktor 
> Signed-off-by: Kevin Wolf 

Reviewed-by: Emanuele Giuseppe Esposito 

> ---
>  include/block/block-io.h  | 4 +++-
>  include/sysemu/block-backend-io.h | 5 -
>  block.c   | 5 +++--
>  block/block-backend.c | 7 +--
>  block/export/virtio-blk-handler.c | 7 ---
>  5 files changed, 19 insertions(+), 9 deletions(-)
> 
> diff --git a/include/block/block-io.h b/include/block/block-io.h
> index 5da99d4d60..dbc034b728 100644
> --- a/include/block/block-io.h
> +++ b/include/block/block-io.h
> @@ -89,7 +89,9 @@ int64_t co_wrapper 
> bdrv_get_allocated_file_size(BlockDriverState *bs);
>  
>  BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
> BlockDriverState *in_bs, Error **errp);
> -void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
> +
> +void coroutine_fn GRAPH_RDLOCK
> +bdrv_co_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
>  
>  int coroutine_fn GRAPH_RDLOCK
>  bdrv_co_delete_file(BlockDriverState *bs, Error **errp);
> diff --git a/include/sysemu/block-backend-io.h 
> b/include/sysemu/block-backend-io.h
> index 40ab178719..c672b77247 100644
> --- a/include/sysemu/block-backend-io.h
> +++ b/include/sysemu/block-backend-io.h
> @@ -70,7 +70,10 @@ void co_wrapper blk_eject(BlockBackend *blk, bool 
> eject_flag);
>  int64_t coroutine_fn blk_co_getlength(BlockBackend *blk);
>  int64_t co_wrapper_mixed blk_getlength(BlockBackend *blk);
>  
> -void blk_get_geometry(BlockBackend *blk, uint64_t *nb_sectors_ptr);
> +void coroutine_fn blk_co_get_geometry(BlockBackend *blk,
> +  uint64_t *nb_sectors_ptr);
> +void co_wrapper_mixed blk_get_geometry(BlockBackend *blk,
> +   uint64_t *nb_sectors_ptr);
>  
>  int64_t coroutine_fn blk_co_nb_sectors(BlockBackend *blk);
>  int64_t co_wrapper_mixed blk_nb_sectors(BlockBackend *blk);
> diff --git a/block.c b/block.c
> index 0dd604d0f6..e0c6c648b1 100644
> --- a/block.c
> +++ b/block.c
> @@ -5879,9 +5879,10 @@ int64_t coroutine_fn 
> bdrv_co_getlength(BlockDriverState *bs)
>  }
>  
>  /* return 0 as number of sectors if no device present or error */
> -void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr)
> +void coroutine_fn bdrv_co_get_geometry(BlockDriverState *bs,
> +   uint64_t *nb_sectors_ptr)
>  {
> -int64_t nb_sectors = bdrv_nb_sectors(bs);
> +int64_t nb_sectors = bdrv_co_nb_sectors(bs);
>  IO_CODE();
>  
>  *nb_sectors_ptr = nb_sectors < 0 ? 0 : nb_sectors;
> diff --git a/block/block-backend.c b/block/block-backend.c
> index 278b04ce69..2ee39229e4 100644
> --- a/block/block-backend.c
> +++ b/block/block-backend.c
> @@ -1615,13 +1615,16 @@ int64_t coroutine_fn blk_co_getlength(BlockBackend 
> *blk)
>  return bdrv_co_getlength(blk_bs(blk));
>  }
>  
> -void blk_get_geometry(BlockBackend *blk, uint64_t *nb_sectors_ptr)
> +void coroutine_fn blk_co_get_geometry(BlockBackend *blk,
> +  uint64_t *nb_sectors_ptr)
>  {
>  IO_CODE();
> +GRAPH_RDLOCK_GUARD();
> +
>  if (!blk_bs(blk)) {
>  *nb_sectors_ptr = 0;
>  } else {
> -bdrv_get_geometry(blk_bs(blk), nb_sectors_ptr);
> +bdrv_co_get_geometry(blk_bs(blk), nb_sectors_ptr);
>  }
>  }
>  
> diff --git a/block/export/virtio-blk-handler.c 
> b/block/export/virtio-blk-handler.c
> index 313666e8ab..bc1cec675

[PATCH 1/2] tests/requirements.txt: bump up avocado-framework version to 101.0

[Kautuk Consul]

Avocado version 101.0 has a fix to re-compute the checksum
of an asset file if the algorithm used in the *-CHECKSUM
file isn't the same as the one being passed to it by the
avocado user (i.e. the avocado_qemu python module).
In the earlier avocado versions this fix wasn't there due
to which if the checksum wouldn't match the earlier
checksum (calculated by a different algorithm), the avocado
code would start downloading a fresh image from the internet
URL thus making the test-cases take longer to execute.

Bump up the avocado-framework version to 101.0.

Signed-off-by: Kautuk Consul 
Tested-by: Hariharan T S 
---
 tests/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/requirements.txt b/tests/requirements.txt
index 0ba561b6bd..a6f73da681 100644
--- a/tests/requirements.txt
+++ b/tests/requirements.txt
@@ -2,5 +2,5 @@
 # in the tests/venv Python virtual environment. For more info,
 # refer to: https://pip.pypa.io/en/stable/user_guide/#id1
 # Note that qemu.git/python/ is always implicitly installed.
-avocado-framework==88.1
+avocado-framework==101.0
 pycdlib==1.11.0
-- 
2.39.2

[PATCH 0/2] Re-enabling tests/avocado/boot_linux.py for PPC64

[Kautuk Consul]

The tests/avocado/boot_linux.py was disabled because it would take
too long to execute due to which it would timeout. On investigation
of this it was found that:
1)  The avocado module was downloading the Fedora 31 qcow2 image 2
times due to checksum algorithm mismatch. The first download
was computing the checksum with the sha1 algorithm whereas the
second time the sha256 algorithm checksum was being passed by the
avocado_qemu module due to which the 2nd download was being
triggered.
2)  The boot_linux.py test-case was including the image download time
for the 2nd download (as mentioned in point 1) in the test-case
timeout time.

This patchset aims to solve the above problems by:
1)  Bumping up the avocado-framework version used by qemu to 101.0.
This version of avocado includes a fix that re-computes the
checksum of the already downloaded file using sha256 and then checks
the checksum string being passed by avocado_qemu. This fix will
also update the *-CHECKSUM file with a new line for the sha256
checksum.
2)  Separating the download timeout from the actual test-case
execution timeout in boot_linux.py.

Kautuk Consul (2):
  tests/requirements.txt: bump up avocado-framework version to 101.0
  tests/avocado/boot_linux.py: re-enable test-case for ppc64

 tests/avocado/boot_linux.py | 6 +-
 tests/requirements.txt  | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

-- 
2.39.2

[PATCH 2/2] tests/avocado/boot_linux.py: re-enable test-case for ppc64

[Kautuk Consul]

Fixes c0c8687ef0("tests/avocado: disable BootLinuxPPC64 test in CI").

Commit c0c8687ef0fd990db8db1655a8a6c5a5e35dd4bb disabled the test-case
for PPC64. On investigation, this turns out to be an issue with the
time taken for downloading the Fedora 31 qcow2 image being included
within the test-case timeout.
Re-enable this test-case by setting the timeout to 360 seconds just
before launching the downloaded VM image.

Signed-off-by: Kautuk Consul 
Reported-by: Alex Bennée 
Tested-by: Hariharan T S hariharan...@linux.vnet.ibm.com
---
 tests/avocado/boot_linux.py | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/avocado/boot_linux.py b/tests/avocado/boot_linux.py
index be30dcbd58..c3869a987c 100644
--- a/tests/avocado/boot_linux.py
+++ b/tests/avocado/boot_linux.py
@@ -91,9 +91,9 @@ class BootLinuxPPC64(LinuxTest):
 :avocado: tags=arch:ppc64
 """
 
+# timeout for downloading new VM image.
 timeout = 360
 
-@skipIf(os.getenv('GITLAB_CI'), 'Running on GitLab')
 def test_pseries_tcg(self):
 """
 :avocado: tags=machine:pseries
@@ -101,6 +101,10 @@ def test_pseries_tcg(self):
 """
 self.require_accelerator("tcg")
 self.vm.add_args("-accel", "tcg")
+
+# timeout for actual Linux PPC boot test
+self.timeout = 360
+
 self.launch_and_wait(set_up_ssh_connection=False)
 
 
-- 
2.39.2

Re: [PATCH v2] virtio: refresh vring region cache after updating a virtqueue size

[Michael S. Tsirkin]

On Mon, Mar 27, 2023 at 01:06:19PM +0200, Cornelia Huck wrote:
> On Wed, Mar 22 2023, Halil Pasic  wrote:
> 
> > On Wed, 22 Mar 2023 10:52:31 +0100
> > Cornelia Huck  wrote:
> > [..]
> >> >
> >> > diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
> >> > index e33e5207ab..f44de1a8c1 100644
> >> > --- a/hw/s390x/virtio-ccw.c
> >> > +++ b/hw/s390x/virtio-ccw.c
> >> > @@ -237,6 +237,7 @@ static int virtio_ccw_set_vqs(SubchDev *sch, 
> >> > VqInfoBlock *info,
> >> >  return -EINVAL;
> >> >  }
> >> >  virtio_queue_set_num(vdev, index, num);
> >> > +virtio_init_region_cache(vdev, index);  
> >> 
> >> Hmm... this is not wrong, but looking at it again, I see that the guest
> >> has no way to change num after our last call to
> >> virtio_init_region_cache() (while setting up the queue addresses.) IOW,
> >> this introduces an extra round trip that is not really needed.
> >> 
> >
> > I don't quite understand. AFAIU the virtio_init_region_cache() would see
> > the (new) queue addresses but not the new size (num). Yes virtio-ccw
> > already knows the new num but it is yet to call
> > to put it into vdev->vq[n].vring.num from where
> > virtio_init_region_cache() picks it up.
> >
> > If we were to first virtio_queue_set_num() and only then the address
> > I would understand. But with the code as is, I don't. Am I missing
> > something?
> 
> Hrm, virtio_queue_set_rings() doesn't pass num, I thought it did... I
> wonder whether ordering virtio_queue_set_num() before it would be better
> anyway (if the guest gave us an invalid num, we don't need to setup any
> addresses and init any caches).
> 
> Smth like
> 
> if (info) {
>if (desc) {
>   if (virtio_queue_get_max_num(...) < num) {
>   return -EINVAL;
>   }
>   virtio_queue_set_num(...);
>}
>virtio_queue_set_rings(...);
> } else { /* legacy */
>if (desc && virtio_queue_get_max_num(...) > num) {
>return -EINVAL;
>}
>virtio_queue_set_addr(...);
> }
> virtio_queue_set_vector(vdev, index, desc ? index : VIRTIO_NO_VECTOR);
> 
> might be easier to follow than the current code.
> 
> Or we could just go with this patch, which has the advantage of already
> existing :)

Yea ... an ack would be appreciated.

-- 
MST

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Stefan Berger]

On 3/27/23 07:11, Stefan Berger wrote:






We get this message when booting from a kernel:

[    0.582699] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
[    0.586361] tpm tpm0: A TPM error (256) occurred attempting the self test
[    0.586623] tpm tpm0: starting up the TPM manually

Do we understand why the error appears?


The firmware did not initialize the TPM 2.




However on a clean boot into the TPM, the u-boot tpm commands fail:

ast# tpm info
tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [closed]
ast# tpINTERRUPT>


Is this normal output? Is it an indication of some sort of IRQ?


ast# tpm init
ast# tpm info
tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [open]
ast# tpm pcr_read 0 0x8100
Error: 256


If this is an error from the TPM 2 , then the 256 error code is the same as 
reported by Linux above:

$ tssreturncode 0x100
TPM_RC_INITIALIZE - TPM not initialized by TPM2_Startup or already initialized


I will try to reproduce this today. u-boot should have a sent TPM2_Startup as 
part of 'tpm init' command above or even before on its own.

Stefan

Re: [PATCH v2 4/7] hw/ipmi: Refactor IPMI interface

[Cédric Le Goater]

Hello Hao,

On 3/25/23 00:09, Hao Wu wrote:

This patch refactors the IPMI interface so that it can be used by both
the BMC side and core-side simulation.

Detail changes:
(1) Split IPMIInterface into IPMIInterfaceHost (for host side
 simulation) and IPMIInterfaceClient (for BMC side simulation).
(2) rename handle_rsp -> handle_msg so the name fits both BMC side and
 Core side.
(3) Add a new class IPMICore. This class represents a simulator/external
 connection for both BMC and Core side emulation.
(4) Change the original IPMIBmc to IPMIBmcHost, representing host side
 simulation.
(5) Add a new type IPMIBmcClient representing BMC side simulation.
(6) Appy the changes to  the entire IPMI library.


'IPMIBmcHost' is a BMC object model (internal or external) and
'IPMIBmcClient' is a host object model ?

[ ... ]


@@ -267,15 +267,15 @@ void pnv_bmc_set_pnor(IPMIBmc *bmc, PnvPnor *pnor)
   * Instantiate the machine BMC. PowerNV uses the QEMU internal
   * simulator but it could also be external.
   */
-IPMIBmc *pnv_bmc_create(PnvPnor *pnor)
+IPMIBmcHost *pnv_bmc_create(PnvPnor *pnor)
  {
  Object *obj;
  
  obj = object_new(TYPE_IPMI_BMC_SIMULATOR);

  qdev_realize(DEVICE(obj), NULL, &error_fatal);
-pnv_bmc_set_pnor(IPMI_BMC(obj), pnor);
+pnv_bmc_set_pnor(IPMI_BMC_HOST(obj), pnor);
  
-return IPMI_BMC(obj);

+return IPMI_BMC_HOST(obj);


QEMU PowerNV machines model the host side of OpenPOWER systems which
have an Aspeed SoC based BMC for management. The routine above creates
an Aspeed *BMC* object model for the PowerNV *host* machine. I find
'IPMIBmcHost' confusing. It shouldn't have a 'Host' suffix I think.

'IPMIBmcClient' sounds ok, or 'IPMIBmcPeer' maybe.

Thanks,

C.

[PATCH 04/19] target/riscv: remove cpu->cfg.ext_a

[Daniel Henrique Barboza]

Create a new "a" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVA. Instances of cpu->cfg.ext_a and similar are
replaced with riscv_has_ext(env, RVA).

Remove the old "a" property and 'ext_a' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 16 
 target/riscv/cpu.h |  1 -
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index c33ba86085..d2484396c4 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -813,13 +813,12 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 
 /* Do some ISA extension error checking */
 if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
-cpu->cfg.ext_a && cpu->cfg.ext_f &&
-cpu->cfg.ext_d &&
+riscv_has_ext(env, RVA) &&
+cpu->cfg.ext_f && cpu->cfg.ext_d &&
 cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
 warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
 cpu->cfg.ext_i = true;
 cpu->cfg.ext_m = true;
-cpu->cfg.ext_a = true;
 cpu->cfg.ext_f = true;
 cpu->cfg.ext_d = true;
 cpu->cfg.ext_icsr = true;
@@ -863,7 +862,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if ((cpu->cfg.ext_zawrs) && !cpu->cfg.ext_a) {
+if ((cpu->cfg.ext_zawrs) && !riscv_has_ext(env, RVA)) {
 error_setg(errp, "Zawrs extension requires A extension");
 return;
 }
@@ -1101,7 +1100,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_cpu_cfg(env)->ext_m) {
 ext |= RVM;
 }
-if (riscv_cpu_cfg(env)->ext_a) {
+if (riscv_has_ext(env, RVA)) {
 ext |= RVA;
 }
 if (riscv_cpu_cfg(env)->ext_f) {
@@ -1437,7 +1436,10 @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor 
*v, const char *name,
 visit_type_bool(v, name, &value, errp);
 }
 
-static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {};
+static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+{.name = "a", .description = "Atomic instructions",
+ .misa_bit = RVA, .enabled = true},
+};
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 {
@@ -1463,7 +1465,6 @@ static Property riscv_cpu_extensions[] = {
 DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
 DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
-DEFINE_PROP_BOOL("a", RISCVCPU, cfg.ext_a, true),
 DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
 DEFINE_PROP_BOOL("d", RISCVCPU, cfg.ext_d, true),
 DEFINE_PROP_BOOL("c", RISCVCPU, cfg.ext_c, true),
@@ -1577,7 +1578,6 @@ static void register_cpu_props(Object *obj)
 cpu->cfg.ext_i = misa_ext & RVI;
 cpu->cfg.ext_e = misa_ext & RVE;
 cpu->cfg.ext_m = misa_ext & RVM;
-cpu->cfg.ext_a = misa_ext & RVA;
 cpu->cfg.ext_f = misa_ext & RVF;
 cpu->cfg.ext_d = misa_ext & RVD;
 cpu->cfg.ext_v = misa_ext & RVV;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 638e47c75a..f703888310 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -422,7 +422,6 @@ struct RISCVCPUConfig {
 bool ext_e;
 bool ext_g;
 bool ext_m;
-bool ext_a;
 bool ext_f;
 bool ext_d;
 bool ext_c;
-- 
2.39.2

[PATCH 14/19] target/riscv: remove cpu->cfg.ext_j

[Daniel Henrique Barboza]

Create a new "j" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVJ. Instances of cpu->cfg.ext_j and similar are
replaced with riscv_has_ext(env, RVJ).

Remove the old "j" property and 'ext_j' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 6 +++---
 target/riscv/cpu.h | 1 -
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 90c8fc0f30..8589f7bd67 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1119,7 +1119,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_cpu_cfg(env)->ext_v) {
 ext |= RVV;
 }
-if (riscv_cpu_cfg(env)->ext_j) {
+if (riscv_has_ext(env, RVJ)) {
 ext |= RVJ;
 }
 
@@ -1452,6 +1452,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVU, .enabled = true},
 {.name = "h", .description = "Hypervisor",
  .misa_bit = RVH, .enabled = true},
+{.name = "x-j", .description = "Dynamic translated languages",
+ .misa_bit = RVJ, .enabled = false},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1548,7 +1550,6 @@ static Property riscv_cpu_extensions[] = {
 
 /* These are experimental so mark with 'x-' */
 DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
-DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
 /* ePMP 0.9.3 */
 DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
 DEFINE_PROP_BOOL("x-smaia", RISCVCPU, cfg.ext_smaia, false),
@@ -1580,7 +1581,6 @@ static void register_cpu_props(Object *obj)
  */
 if (cpu->env.misa_ext != 0) {
 cpu->cfg.ext_v = misa_ext & RVV;
-cpu->cfg.ext_j = misa_ext & RVJ;
 
 /*
  * We don't want to set the default riscv_cpu_extensions
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index f3cb28443c..43a40ba950 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -419,7 +419,6 @@ typedef struct {
 
 struct RISCVCPUConfig {
 bool ext_g;
-bool ext_j;
 bool ext_v;
 bool ext_zba;
 bool ext_zbb;
-- 
2.39.2

[PATCH 09/19] target/riscv: remove cpu->cfg.ext_e

[Daniel Henrique Barboza]

Create a new "e" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVE. Instances of cpu->cfg.ext_e and similar are
replaced with riscv_has_ext(env, RVE).

Remove the old "e" property and 'ext_e' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 10 +-
 target/riscv/cpu.h |  1 -
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index e3d9496405..65e4a76bae 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -825,13 +825,13 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 env->misa_ext_mask = env->misa_ext;
 }
 
-if (riscv_has_ext(env, RVI) && cpu->cfg.ext_e) {
+if (riscv_has_ext(env, RVI) && riscv_has_ext(env, RVE)) {
 error_setg(errp,
"I and E extensions are incompatible");
 return;
 }
 
-if (!riscv_has_ext(env, RVI) && !cpu->cfg.ext_e) {
+if (!riscv_has_ext(env, RVI) && !riscv_has_ext(env, RVE)) {
 error_setg(errp,
"Either I or E extension must be set");
 return;
@@ -1091,7 +1091,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_has_ext(env, RVI)) {
 ext |= RVI;
 }
-if (riscv_cpu_cfg(env)->ext_e) {
+if (riscv_has_ext(env, RVE)) {
 ext |= RVE;
 }
 if (riscv_cpu_cfg(env)->ext_m) {
@@ -1444,6 +1444,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVF, .enabled = true},
 {.name = "i", .description = "Base integer instruction set",
  .misa_bit = RVI, .enabled = true},
+{.name = "e", .description = "Base integer instruction set (embedded)",
+ .misa_bit = RVE, .enabled = false},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1466,7 +1468,6 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
-DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
 DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
 DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
@@ -1576,7 +1577,6 @@ static void register_cpu_props(Object *obj)
  * later on.
  */
 if (cpu->env.misa_ext != 0) {
-cpu->cfg.ext_e = misa_ext & RVE;
 cpu->cfg.ext_m = misa_ext & RVM;
 cpu->cfg.ext_v = misa_ext & RVV;
 cpu->cfg.ext_s = misa_ext & RVS;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 573bf85ff1..cc0b9e73ac 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -418,7 +418,6 @@ typedef struct {
 } RISCVSATPMap;
 
 struct RISCVCPUConfig {
-bool ext_e;
 bool ext_g;
 bool ext_m;
 bool ext_s;
-- 
2.39.2

[PATCH 11/19] target/riscv: remove cpu->cfg.ext_s

[Daniel Henrique Barboza]

Create a new "s" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVS. Instances of cpu->cfg.ext_s and similar are
replaced with riscv_has_ext(env, RVS).

Remove the old "s" property and 'ext_s' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 11 +--
 target/riscv/cpu.h |  1 -
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 9f4d8fe7e8..d657ad2fcf 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -402,7 +402,6 @@ static void rv64_thead_c906_cpu_init(Object *obj)
 
 cpu->cfg.ext_g = true;
 cpu->cfg.ext_u = true;
-cpu->cfg.ext_s = true;
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_zfh = true;
 cpu->cfg.mmu = true;
@@ -837,7 +836,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (cpu->cfg.ext_s && !cpu->cfg.ext_u) {
+if (riscv_has_ext(env, RVS) && !cpu->cfg.ext_u) {
 error_setg(errp,
"Setting S extension without U extension is illegal");
 return;
@@ -849,7 +848,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (cpu->cfg.ext_h && !cpu->cfg.ext_s) {
+if (cpu->cfg.ext_h && !riscv_has_ext(env, RVS)) {
 error_setg(errp, "H extension implicitly requires S-mode");
 return;
 }
@@ -1109,7 +1108,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_has_ext(env, RVC)) {
 ext |= RVC;
 }
-if (riscv_cpu_cfg(env)->ext_s) {
+if (riscv_has_ext(env, RVS)) {
 ext |= RVS;
 }
 if (riscv_cpu_cfg(env)->ext_u) {
@@ -1448,6 +1447,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVE, .enabled = false},
 {.name = "m", .description = "Integer multiplication and division",
  .misa_bit = RVM, .enabled = true},
+{.name = "s", .description = "Supervisor-level instructions",
+ .misa_bit = RVS, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1471,7 +1472,6 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
 DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
 DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
@@ -1579,7 +1579,6 @@ static void register_cpu_props(Object *obj)
  */
 if (cpu->env.misa_ext != 0) {
 cpu->cfg.ext_v = misa_ext & RVV;
-cpu->cfg.ext_s = misa_ext & RVS;
 cpu->cfg.ext_u = misa_ext & RVU;
 cpu->cfg.ext_h = misa_ext & RVH;
 cpu->cfg.ext_j = misa_ext & RVJ;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 7a42c80b7d..fc35aa7509 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -419,7 +419,6 @@ typedef struct {
 
 struct RISCVCPUConfig {
 bool ext_g;
-bool ext_s;
 bool ext_u;
 bool ext_h;
 bool ext_j;
-- 
2.39.2

[PATCH 15/19] target/riscv: remove cpu->cfg.ext_v

[Daniel Henrique Barboza]

Create a new "v" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVV. Instances of cpu->cfg.ext_v and similar are
replaced with riscv_has_ext(env, RVV).

Remove the old "v" property and 'ext_v' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 12 +---
 target/riscv/cpu.h |  1 -
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 8589f7bd67..025d1f6258 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -877,7 +877,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 }
 
 /* The V vector extension depends on the Zve64d extension */
-if (cpu->cfg.ext_v) {
+if (riscv_has_ext(env, RVV)) {
 cpu->cfg.ext_zve64d = true;
 }
 
@@ -959,7 +959,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 cpu->cfg.ext_zksh = true;
 }
 
-if (cpu->cfg.ext_v) {
+if (riscv_has_ext(env, RVV)) {
 int vext_version = VEXT_VERSION_1_00_0;
 if (!is_power_of_2(cpu->cfg.vlen)) {
 error_setg(errp,
@@ -1116,7 +1116,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_has_ext(env, RVH)) {
 ext |= RVH;
 }
-if (riscv_cpu_cfg(env)->ext_v) {
+if (riscv_has_ext(env, RVV)) {
 ext |= RVV;
 }
 if (riscv_has_ext(env, RVJ)) {
@@ -1454,6 +1454,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVH, .enabled = true},
 {.name = "x-j", .description = "Dynamic translated languages",
  .misa_bit = RVJ, .enabled = false},
+{.name = "v", .description = "Vector operations",
+ .misa_bit = RVV, .enabled = false},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1477,7 +1479,6 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
 DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
 DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
 DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
@@ -1570,7 +1571,6 @@ static Property riscv_cpu_extensions[] = {
 static void register_cpu_props(Object *obj)
 {
 RISCVCPU *cpu = RISCV_CPU(obj);
-uint32_t misa_ext = cpu->env.misa_ext;
 Property *prop;
 DeviceState *dev = DEVICE(obj);
 
@@ -1580,8 +1580,6 @@ static void register_cpu_props(Object *obj)
  * later on.
  */
 if (cpu->env.misa_ext != 0) {
-cpu->cfg.ext_v = misa_ext & RVV;
-
 /*
  * We don't want to set the default riscv_cpu_extensions
  * in this case.
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 43a40ba950..c0280ace2a 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -419,7 +419,6 @@ typedef struct {
 
 struct RISCVCPUConfig {
 bool ext_g;
-bool ext_v;
 bool ext_zba;
 bool ext_zbb;
 bool ext_zbc;
-- 
2.39.2

[PATCH 10/19] target/riscv: remove cpu->cfg.ext_m

[Daniel Henrique Barboza]

Create a new "m" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVM. Instances of cpu->cfg.ext_m and similar are
replaced with riscv_has_ext(env, RVM).

Remove the old "m" property and 'ext_m' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 10 +-
 target/riscv/cpu.h |  1 -
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 65e4a76bae..9f4d8fe7e8 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -811,13 +811,13 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 CPURISCVState *env = &cpu->env;
 
 /* Do some ISA extension error checking */
-if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) && cpu->cfg.ext_m &&
+if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) &&
+riscv_has_ext(env, RVM) &&
 riscv_has_ext(env, RVA) &&
 riscv_has_ext(env, RVF) &&
 riscv_has_ext(env, RVD) &&
 cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
 warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-cpu->cfg.ext_m = true;
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_ifencei = true;
 
@@ -1094,7 +1094,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_has_ext(env, RVE)) {
 ext |= RVE;
 }
-if (riscv_cpu_cfg(env)->ext_m) {
+if (riscv_has_ext(env, RVM)) {
 ext |= RVM;
 }
 if (riscv_has_ext(env, RVA)) {
@@ -1446,6 +1446,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVI, .enabled = true},
 {.name = "e", .description = "Base integer instruction set (embedded)",
  .misa_bit = RVE, .enabled = false},
+{.name = "m", .description = "Integer multiplication and division",
+ .misa_bit = RVM, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1469,7 +1471,6 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
 DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
 DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -1577,7 +1578,6 @@ static void register_cpu_props(Object *obj)
  * later on.
  */
 if (cpu->env.misa_ext != 0) {
-cpu->cfg.ext_m = misa_ext & RVM;
 cpu->cfg.ext_v = misa_ext & RVV;
 cpu->cfg.ext_s = misa_ext & RVS;
 cpu->cfg.ext_u = misa_ext & RVU;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index cc0b9e73ac..7a42c80b7d 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -419,7 +419,6 @@ typedef struct {
 
 struct RISCVCPUConfig {
 bool ext_g;
-bool ext_m;
 bool ext_s;
 bool ext_u;
 bool ext_h;
-- 
2.39.2

[PATCH 07/19] target/riscv: remove cpu->cfg.ext_f

[Daniel Henrique Barboza]

Create a new "f" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVF. Instances of cpu->cfg.ext_f and similar are
replaced with riscv_has_ext(env, RVF).

Remove the old "f" property and 'ext_f' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 20 ++--
 target/riscv/cpu.h |  1 -
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 701441b822..eb94db527d 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -813,12 +813,12 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 /* Do some ISA extension error checking */
 if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
 riscv_has_ext(env, RVA) &&
-cpu->cfg.ext_f && riscv_has_ext(env, RVD) &&
+riscv_has_ext(env, RVF) &&
+riscv_has_ext(env, RVD) &&
 cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
 warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
 cpu->cfg.ext_i = true;
 cpu->cfg.ext_m = true;
-cpu->cfg.ext_f = true;
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_ifencei = true;
 
@@ -855,7 +855,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (cpu->cfg.ext_f && !cpu->cfg.ext_icsr) {
+if (riscv_has_ext(env, RVF) && !cpu->cfg.ext_icsr) {
 error_setg(errp, "F extension requires Zicsr");
 return;
 }
@@ -869,12 +869,12 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 cpu->cfg.ext_zfhmin = true;
 }
 
-if (cpu->cfg.ext_zfhmin && !cpu->cfg.ext_f) {
+if (cpu->cfg.ext_zfhmin && !riscv_has_ext(env, RVF)) {
 error_setg(errp, "Zfh/Zfhmin extensions require F extension");
 return;
 }
 
-if (riscv_has_ext(env, RVD) && !cpu->cfg.ext_f) {
+if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
 error_setg(errp, "D extension requires F extension");
 return;
 }
@@ -899,7 +899,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (cpu->cfg.ext_zve32f && !cpu->cfg.ext_f) {
+if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
 error_setg(errp, "Zve32f/Zve64f extensions require F extension");
 return;
 }
@@ -932,7 +932,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 error_setg(errp, "Zfinx extension requires Zicsr");
 return;
 }
-if (cpu->cfg.ext_f) {
+if (riscv_has_ext(env, RVF)) {
 error_setg(errp,
"Zfinx cannot be supported together with F extension");
 return;
@@ -1101,7 +1101,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_has_ext(env, RVA)) {
 ext |= RVA;
 }
-if (riscv_cpu_cfg(env)->ext_f) {
+if (riscv_has_ext(env, RVF)) {
 ext |= RVF;
 }
 if (riscv_has_ext(env, RVD)) {
@@ -1441,6 +1441,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVC, .enabled = true},
 {.name = "d", .description = "Double-precision float point",
  .misa_bit = RVD, .enabled = true},
+{.name = "f", .description = "Single-precision float point",
+ .misa_bit = RVF, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1467,7 +1469,6 @@ static Property riscv_cpu_extensions[] = {
 DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
 DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
-DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
 DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
 DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -1578,7 +1579,6 @@ static void register_cpu_props(Object *obj)
 cpu->cfg.ext_i = misa_ext & RVI;
 cpu->cfg.ext_e = misa_ext & RVE;
 cpu->cfg.ext_m = misa_ext & RVM;
-cpu->cfg.ext_f = misa_ext & RVF;
 cpu->cfg.ext_v = misa_ext & RVV;
 cpu->cfg.ext_s = misa_ext & RVS;
 cpu->cfg.ext_u = misa_ext & RVU;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index e4cf79e36f..ce23b1c431 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -422,7 +422,6 @@ struct RISCVCPUConfig {
 bool ext_e;
 bool ext_g;
 bool ext_m;
-bool ext_f;
 bool ext_s;
 bool ext_u;
 bool ext_h;
-- 
2.39.2

[PATCH 12/19] target/riscv: remove cpu->cfg.ext_u

[Daniel Henrique Barboza]

Create a new "u" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVU. Instances of cpu->cfg.ext_u and similar are
replaced with riscv_has_ext(env, RVU).

Remove the old "u" property and 'ext_u' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 9 -
 target/riscv/cpu.h | 1 -
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index d657ad2fcf..12bc307992 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -401,7 +401,6 @@ static void rv64_thead_c906_cpu_init(Object *obj)
 set_priv_version(env, PRIV_VERSION_1_11_0);
 
 cpu->cfg.ext_g = true;
-cpu->cfg.ext_u = true;
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_zfh = true;
 cpu->cfg.mmu = true;
@@ -836,7 +835,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (riscv_has_ext(env, RVS) && !cpu->cfg.ext_u) {
+if (riscv_has_ext(env, RVS) && !riscv_has_ext(env, RVU)) {
 error_setg(errp,
"Setting S extension without U extension is illegal");
 return;
@@ -,7 +1110,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_has_ext(env, RVS)) {
 ext |= RVS;
 }
-if (riscv_cpu_cfg(env)->ext_u) {
+if (riscv_has_ext(env, RVU)) {
 ext |= RVU;
 }
 if (riscv_cpu_cfg(env)->ext_h) {
@@ -1449,6 +1448,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVM, .enabled = true},
 {.name = "s", .description = "Supervisor-level instructions",
  .misa_bit = RVS, .enabled = true},
+{.name = "u", .description = "User-level instructions",
+ .misa_bit = RVU, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1472,7 +1473,6 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
-DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
 DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
 DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
@@ -1579,7 +1579,6 @@ static void register_cpu_props(Object *obj)
  */
 if (cpu->env.misa_ext != 0) {
 cpu->cfg.ext_v = misa_ext & RVV;
-cpu->cfg.ext_u = misa_ext & RVU;
 cpu->cfg.ext_h = misa_ext & RVH;
 cpu->cfg.ext_j = misa_ext & RVJ;
 
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index fc35aa7509..7b98cf4dd7 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -419,7 +419,6 @@ typedef struct {
 
 struct RISCVCPUConfig {
 bool ext_g;
-bool ext_u;
 bool ext_h;
 bool ext_j;
 bool ext_v;
-- 
2.39.2

[PATCH 17/19] target/riscv: remove cfg.ext_g setup from rv64_thead_c906_cpu_init()

[Daniel Henrique Barboza]

This CPU is enabling G via cfg.ext_g and, at the same time, setting
IMAFD in set_misa() and cfg.ext_icsr.

riscv_cpu_validate_set_extensions() is already doing that, so there's no
need for cpu_init() setups to worry about setting G and its extensions.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 81c8e0d541..3078d1a097 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -397,11 +397,10 @@ static void rv64_thead_c906_cpu_init(Object *obj)
 CPURISCVState *env = &RISCV_CPU(obj)->env;
 RISCVCPU *cpu = RISCV_CPU(obj);
 
-set_misa(env, MXL_RV64, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
+set_misa(env, MXL_RV64, RVC | RVS | RVU);
 set_priv_version(env, PRIV_VERSION_1_11_0);
 
 cpu->cfg.ext_g = true;
-cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_zfh = true;
 cpu->cfg.mmu = true;
 cpu->cfg.ext_xtheadba = true;
-- 
2.39.2

[PATCH 16/19] target/riscv: remove riscv_cpu_sync_misa_cfg()

[Daniel Henrique Barboza]

This function was created to move the sync between cpu->cfg.ext_N bit
changes to env->misa_ext* from the validation step to an ealier step,
giving us a guarantee that we could use either cpu->cfg.ext_N or
riscv_has_ext(env,N) in the validation.

We don't have any cpu->cfg.ext_N left that has an existing MISA bit
(cfg.ext_g will be handled shortly). The function is now a no-op, simply
copying the existing values of misa_ext* back to misa_ext*.

Remove it.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 52 --
 1 file changed, 52 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 025d1f6258..81c8e0d541 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1082,50 +1082,6 @@ static void riscv_cpu_finalize_features(RISCVCPU *cpu, 
Error **errp)
 #endif
 }
 
-static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
-{
-uint32_t ext = 0;
-
-if (riscv_has_ext(env, RVI)) {
-ext |= RVI;
-}
-if (riscv_has_ext(env, RVE)) {
-ext |= RVE;
-}
-if (riscv_has_ext(env, RVM)) {
-ext |= RVM;
-}
-if (riscv_has_ext(env, RVA)) {
-ext |= RVA;
-}
-if (riscv_has_ext(env, RVF)) {
-ext |= RVF;
-}
-if (riscv_has_ext(env, RVD)) {
-ext |= RVD;
-}
-if (riscv_has_ext(env, RVC)) {
-ext |= RVC;
-}
-if (riscv_has_ext(env, RVS)) {
-ext |= RVS;
-}
-if (riscv_has_ext(env, RVU)) {
-ext |= RVU;
-}
-if (riscv_has_ext(env, RVH)) {
-ext |= RVH;
-}
-if (riscv_has_ext(env, RVV)) {
-ext |= RVV;
-}
-if (riscv_has_ext(env, RVJ)) {
-ext |= RVJ;
-}
-
-env->misa_ext = env->misa_ext_mask = ext;
-}
-
 static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
 {
 if (riscv_has_ext(env, RVH) && env->priv_ver < PRIV_VERSION_1_12_0) {
@@ -1169,14 +1125,6 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 set_priv_version(env, priv_version);
 }
 
-/*
- * We can't be sure of whether we set defaults during cpu_init()
- * or whether the user enabled/disabled some bits via cpu->cfg
- * flags. Sync env->misa_ext with cpu->cfg now to allow us to
- * use just env->misa_ext later.
- */
-riscv_cpu_sync_misa_cfg(env);
-
 riscv_cpu_validate_misa_priv(env, &local_err);
 if (local_err != NULL) {
 error_propagate(errp, local_err);
-- 
2.39.2

[PATCH 02/19] target/riscv: remove MISA properties from isa_edata_arr[]

[Daniel Henrique Barboza]

The code that disables extensions if there's a priv version mismatch
uses cpu->cfg.ext_N properties to do its job.

We're aiming to not rely on cpu->cfg.ext_N props for MISA bits. Split
the MISA related verifications in a new function, removing it from
isa_edata_arr[].

We're also erroring it out instead of disabling, making the cpu_init()
function responsible for running an adequate priv spec for the MISA
extensions it wants to use.

Note that the RVV verification is being ignored since we're always have
at least PRIV_VERSION_1_10_0.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 19 +--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 2711d80e16..21c0c637e4 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -72,10 +72,11 @@ struct isa_ext_data {
  * 4. Non-standard extensions (starts with 'X') must be listed after all
  *standard extensions. They must be separated from other multi-letter
  *extensions by an underscore.
+ *
+ * Single letter extensions are checked in riscv_cpu_validate_misa_priv()
+ * instead.
  */
 static const struct isa_ext_data isa_edata_arr[] = {
-ISA_EXT_DATA_ENTRY(h, false, PRIV_VERSION_1_12_0, ext_h),
-ISA_EXT_DATA_ENTRY(v, false, PRIV_VERSION_1_10_0, ext_v),
 ISA_EXT_DATA_ENTRY(zicbom, true, PRIV_VERSION_1_12_0, ext_icbom),
 ISA_EXT_DATA_ENTRY(zicboz, true, PRIV_VERSION_1_12_0, ext_icboz),
 ISA_EXT_DATA_ENTRY(zicond, true, PRIV_VERSION_1_12_0, ext_zicond),
@@ -1131,6 +1132,14 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 env->misa_ext = env->misa_ext_mask = ext;
 }
 
+static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
+{
+if (riscv_has_ext(env, RVH) && env->priv_ver < PRIV_VERSION_1_12_0) {
+error_setg(errp, "H extension requires priv spec 1.12.0");
+return;
+}
+}
+
 static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 {
 CPUState *cs = CPU(dev);
@@ -1174,6 +1183,12 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
  */
 riscv_cpu_sync_misa_cfg(env);
 
+riscv_cpu_validate_misa_priv(env, &local_err);
+if (local_err != NULL) {
+error_propagate(errp, local_err);
+return;
+}
+
 /* Force disable extensions if priv spec version does not match */
 for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
 if (isa_ext_is_enabled(cpu, &isa_edata_arr[i]) &&
-- 
2.39.2

[PATCH 08/19] target/riscv: remove cpu->cfg.ext_i

[Daniel Henrique Barboza]

Create a new "i" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVI. Instances of cpu->cfg.ext_i and similar are
replaced with riscv_has_ext(env, RVI).

Remove the old "i" property and 'ext_i' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 15 +++
 target/riscv/cpu.h |  1 -
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index eb94db527d..e3d9496405 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -811,13 +811,12 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 CPURISCVState *env = &cpu->env;
 
 /* Do some ISA extension error checking */
-if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
+if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) && cpu->cfg.ext_m &&
 riscv_has_ext(env, RVA) &&
 riscv_has_ext(env, RVF) &&
 riscv_has_ext(env, RVD) &&
 cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
 warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
-cpu->cfg.ext_i = true;
 cpu->cfg.ext_m = true;
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_ifencei = true;
@@ -826,13 +825,13 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 env->misa_ext_mask = env->misa_ext;
 }
 
-if (cpu->cfg.ext_i && cpu->cfg.ext_e) {
+if (riscv_has_ext(env, RVI) && cpu->cfg.ext_e) {
 error_setg(errp,
"I and E extensions are incompatible");
 return;
 }
 
-if (!cpu->cfg.ext_i && !cpu->cfg.ext_e) {
+if (!riscv_has_ext(env, RVI) && !cpu->cfg.ext_e) {
 error_setg(errp,
"Either I or E extension must be set");
 return;
@@ -844,7 +843,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (cpu->cfg.ext_h && !cpu->cfg.ext_i) {
+if (cpu->cfg.ext_h && !riscv_has_ext(env, RVI)) {
 error_setg(errp,
"H depends on an I base integer ISA with 32 x registers");
 return;
@@ -1089,7 +1088,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 {
 uint32_t ext = 0;
 
-if (riscv_cpu_cfg(env)->ext_i) {
+if (riscv_has_ext(env, RVI)) {
 ext |= RVI;
 }
 if (riscv_cpu_cfg(env)->ext_e) {
@@ -1443,6 +1442,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVD, .enabled = true},
 {.name = "f", .description = "Single-precision float point",
  .misa_bit = RVF, .enabled = true},
+{.name = "i", .description = "Base integer instruction set",
+ .misa_bit = RVI, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1465,7 +1466,6 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
-DEFINE_PROP_BOOL("i", RISCVCPU, cfg.ext_i, true),
 DEFINE_PROP_BOOL("e", RISCVCPU, cfg.ext_e, false),
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
 DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
@@ -1576,7 +1576,6 @@ static void register_cpu_props(Object *obj)
  * later on.
  */
 if (cpu->env.misa_ext != 0) {
-cpu->cfg.ext_i = misa_ext & RVI;
 cpu->cfg.ext_e = misa_ext & RVE;
 cpu->cfg.ext_m = misa_ext & RVM;
 cpu->cfg.ext_v = misa_ext & RVV;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index ce23b1c431..573bf85ff1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -418,7 +418,6 @@ typedef struct {
 } RISCVSATPMap;
 
 struct RISCVCPUConfig {
-bool ext_i;
 bool ext_e;
 bool ext_g;
 bool ext_m;
-- 
2.39.2

[PATCH 01/19] target/riscv: sync env->misa_ext* with cpu->cfg in realize()

[Daniel Henrique Barboza]

When riscv_cpu_realize() starts we're guaranteed to have cpu->cfg.ext_N
properties updated. The same can't be said about env->misa_ext*, since
the user might enable/disable MISA extensions in the command line, and
env->misa_ext* won't caught these changes. The current solution is to
sync everything at the end of validate_set_extensions(), checking every
cpu->cfg.ext_N value to do a set_misa() in the end.

The last change we're making in the MISA cfg flags are in the G
extension logic, enabling IMAFG if cpu->cfg_ext.g is enabled. Otherwise
we're not making any changes in MISA bits ever since realize() starts.

There's no reason to postpone misa_ext updates until the end of the
validation. Let's do it earlier, during realize(), in a new helper
called riscv_cpu_sync_misa_cfg(). If cpu->cfg.ext_g is enabled, do it
again by updating env->misa_ext* directly.

This is a pre-requisite to allow riscv_cpu_validate_set_extensions() to
use riscv_has_ext() instead of cpu->cfg.ext_N to validate the MISA
extensions, which is our end goal here.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 94 +++---
 1 file changed, 56 insertions(+), 38 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 1e97473af2..2711d80e16 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -804,12 +804,11 @@ static void riscv_cpu_disas_set_info(CPUState *s, 
disassemble_info *info)
 
 /*
  * Check consistency between chosen extensions while setting
- * cpu->cfg accordingly, doing a set_misa() in the end.
+ * cpu->cfg accordingly.
  */
 static void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 {
 CPURISCVState *env = &cpu->env;
-uint32_t ext = 0;
 
 /* Do some ISA extension error checking */
 if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
@@ -824,6 +823,9 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 cpu->cfg.ext_d = true;
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_ifencei = true;
+
+env->misa_ext |= RVI | RVM | RVA | RVF | RVD;
+env->misa_ext_mask = env->misa_ext;
 }
 
 if (cpu->cfg.ext_i && cpu->cfg.ext_e) {
@@ -962,39 +964,8 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 cpu->cfg.ext_zksh = true;
 }
 
-if (cpu->cfg.ext_i) {
-ext |= RVI;
-}
-if (cpu->cfg.ext_e) {
-ext |= RVE;
-}
-if (cpu->cfg.ext_m) {
-ext |= RVM;
-}
-if (cpu->cfg.ext_a) {
-ext |= RVA;
-}
-if (cpu->cfg.ext_f) {
-ext |= RVF;
-}
-if (cpu->cfg.ext_d) {
-ext |= RVD;
-}
-if (cpu->cfg.ext_c) {
-ext |= RVC;
-}
-if (cpu->cfg.ext_s) {
-ext |= RVS;
-}
-if (cpu->cfg.ext_u) {
-ext |= RVU;
-}
-if (cpu->cfg.ext_h) {
-ext |= RVH;
-}
 if (cpu->cfg.ext_v) {
 int vext_version = VEXT_VERSION_1_00_0;
-ext |= RVV;
 if (!is_power_of_2(cpu->cfg.vlen)) {
 error_setg(errp,
"Vector extension VLEN must be power of 2");
@@ -1032,11 +1003,6 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 }
 set_vext_version(env, vext_version);
 }
-if (cpu->cfg.ext_j) {
-ext |= RVJ;
-}
-
-set_misa(env, env->misa_mxl, ext);
 }
 
 #ifndef CONFIG_USER_ONLY
@@ -1121,6 +1087,50 @@ static void riscv_cpu_finalize_features(RISCVCPU *cpu, 
Error **errp)
 #endif
 }
 
+static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
+{
+uint32_t ext = 0;
+
+if (riscv_cpu_cfg(env)->ext_i) {
+ext |= RVI;
+}
+if (riscv_cpu_cfg(env)->ext_e) {
+ext |= RVE;
+}
+if (riscv_cpu_cfg(env)->ext_m) {
+ext |= RVM;
+}
+if (riscv_cpu_cfg(env)->ext_a) {
+ext |= RVA;
+}
+if (riscv_cpu_cfg(env)->ext_f) {
+ext |= RVF;
+}
+if (riscv_cpu_cfg(env)->ext_d) {
+ext |= RVD;
+}
+if (riscv_cpu_cfg(env)->ext_c) {
+ext |= RVC;
+}
+if (riscv_cpu_cfg(env)->ext_s) {
+ext |= RVS;
+}
+if (riscv_cpu_cfg(env)->ext_u) {
+ext |= RVU;
+}
+if (riscv_cpu_cfg(env)->ext_h) {
+ext |= RVH;
+}
+if (riscv_cpu_cfg(env)->ext_v) {
+ext |= RVV;
+}
+if (riscv_cpu_cfg(env)->ext_j) {
+ext |= RVJ;
+}
+
+env->misa_ext = env->misa_ext_mask = ext;
+}
+
 static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 {
 CPUState *cs = CPU(dev);
@@ -1156,6 +1166,14 @@ static void riscv_cpu_realize(DeviceState *dev, Error 
**errp)
 set_priv_version(env, priv_version);
 }
 
+/*
+ * We can't be sure of whether we set defaults during cpu_init()
+ * or whether the user enabled/disabled some bits via cpu->cfg
+ * flags. Sync env->misa_ext with cpu->cfg now to allow us to
+ * use just env->misa_ext later.
+ */
+riscv_cpu_sync_misa

[PATCH 05/19] target/riscv: remove cpu->cfg.ext_c

[Daniel Henrique Barboza]

Create a new "c" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVC. Instances of cpu->cfg.ext_c and similar are
replaced with riscv_has_ext(env, RVC).

Remove the old "c" property and 'ext_c' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 7 +++
 target/riscv/cpu.h | 1 -
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index d2484396c4..694b1fc421 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -401,7 +401,6 @@ static void rv64_thead_c906_cpu_init(Object *obj)
 set_priv_version(env, PRIV_VERSION_1_11_0);
 
 cpu->cfg.ext_g = true;
-cpu->cfg.ext_c = true;
 cpu->cfg.ext_u = true;
 cpu->cfg.ext_s = true;
 cpu->cfg.ext_icsr = true;
@@ -1109,7 +1108,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_cpu_cfg(env)->ext_d) {
 ext |= RVD;
 }
-if (riscv_cpu_cfg(env)->ext_c) {
+if (riscv_has_ext(env, RVC)) {
 ext |= RVC;
 }
 if (riscv_cpu_cfg(env)->ext_s) {
@@ -1439,6 +1438,8 @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, 
const char *name,
 static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
 {.name = "a", .description = "Atomic instructions",
  .misa_bit = RVA, .enabled = true},
+{.name = "c", .description = "Compressed instructions",
+ .misa_bit = RVC, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1467,7 +1468,6 @@ static Property riscv_cpu_extensions[] = {
 DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
 DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
 DEFINE_PROP_BOOL("d", RISCVCPU, cfg.ext_d, true),
-DEFINE_PROP_BOOL("c", RISCVCPU, cfg.ext_c, true),
 DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
 DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -1581,7 +1581,6 @@ static void register_cpu_props(Object *obj)
 cpu->cfg.ext_f = misa_ext & RVF;
 cpu->cfg.ext_d = misa_ext & RVD;
 cpu->cfg.ext_v = misa_ext & RVV;
-cpu->cfg.ext_c = misa_ext & RVC;
 cpu->cfg.ext_s = misa_ext & RVS;
 cpu->cfg.ext_u = misa_ext & RVU;
 cpu->cfg.ext_h = misa_ext & RVH;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index f703888310..c6dc24d236 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -424,7 +424,6 @@ struct RISCVCPUConfig {
 bool ext_m;
 bool ext_f;
 bool ext_d;
-bool ext_c;
 bool ext_s;
 bool ext_u;
 bool ext_h;
-- 
2.39.2

[PATCH 00/19] remove MISA ext_N flags from cpu->cfg

[Daniel Henrique Barboza]

Hi,

This is a work I was intending to do later but the reviews in the
"[PATCH for-8.1 v4 00/25] target/riscv: rework CPU extensions
validation" series [1] really made me realize it's better to do it now.

We store CPU extension state in two places: cpu->cfg.ext_N flags and
env->misa_ext. This was done a while ago when the cpu->cfg object was
introduced, where cpu->cfg.ext_N flags are exposed to users to allow
them to enable/disable extensions.

This forces the code to always have to mirror env->misa_ext and
cpu->cfg.ext_N changes. The code in target/riscv/cpu.c uses the cfg
flags, and the rest of the code uses env->misa_ext. This worked for us
so far, but when implemeting write_misa() this really started to get in
the way - we have a handful of patches and code juggling happening there
just to deal with cpu->cfg and env->misa_ext mirroring.

In the end, what we need is to provide users with a way to set CPU MISA
extensions.  It doesn't have to be in cpu->cfg.ext_N, and in this series
we're going to address that. In patch 3 we have the machinery used to
expose the same MISA user flags we have today, but updating directly in
env->misa_ext*. Patches 4 and onward will then eliminate each
cpu->cfg.ext_N flag for each MISA bit we have, until we eliminate all of
cpu->cfg.ext_N flags from the code.

It is worth mentioning that patch 3 had a strong inspiration from
hw/ppc/spapr_caps.c, the code that handles PowerPC64 capabilities for
the pSeries machine. 

After this series, we'll have a more pleasant time dealing with user
input in the extensions code. I'll postpone the v5 of [1] until we get
this in a good shape, since this cleanup will really go a long way in
the centralization work.

The only behavioral change made is in patch 2, where we're erroring out
in the RVH priv spec mismatch instead of silently disabling. User API is
still the same, default values of each extension is still the same.


[1] https://lists.gnu.org/archive/html/qemu-devel/2023-03/msg05785.html


Daniel Henrique Barboza (19):
  target/riscv: sync env->misa_ext* with cpu->cfg in realize()
  target/riscv: remove MISA properties from isa_edata_arr[]
  target/riscv: introduce riscv_cpu_add_misa_properties()
  target/riscv: remove cpu->cfg.ext_a
  target/riscv: remove cpu->cfg.ext_c
  target/riscv: remove cpu->cfg.ext_d
  target/riscv: remove cpu->cfg.ext_f
  target/riscv: remove cpu->cfg.ext_i
  target/riscv: remove cpu->cfg.ext_e
  target/riscv: remove cpu->cfg.ext_m
  target/riscv: remove cpu->cfg.ext_s
  target/riscv: remove cpu->cfg.ext_u
  target/riscv: remove cpu->cfg.ext_h
  target/riscv: remove cpu->cfg.ext_j
  target/riscv: remove cpu->cfg.ext_v
  target/riscv: remove riscv_cpu_sync_misa_cfg()
  target/riscv: remove cfg.ext_g setup from rv64_thead_c906_cpu_init()
  target/riscv: add RVG and remove cpu->cfg.ext_g
  target/riscv/cpu.c: redesign register_cpu_props()

 target/riscv/cpu.c | 268 -
 target/riscv/cpu.h |  19 +---
 2 files changed, 144 insertions(+), 143 deletions(-)

-- 
2.39.2

[PATCH 18/19] target/riscv: add RVG and remove cpu->cfg.ext_g

[Daniel Henrique Barboza]

We're still have one RISCVCPUConfig MISA flag, 'ext_g'. We'll remove it
the same way we did with the others: create a "g" RISCVCPUMisaExtConfig
property, remove the old "g" property, remove all instances of 'cfg.ext_g'
and use riscv_has_ext(env, RVG).

The caveat is that we don't have RVG, so add it. RVG will be used right
off the bat in set_misa() of rv64_thead_c906_cpu_init() because the CPU is
enabling G via the now removed 'ext_g' flag.

After this patch, there are no more MISA extensions represented by flags
in RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 17 -
 target/riscv/cpu.h |  2 +-
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 3078d1a097..01755036f0 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -397,10 +397,9 @@ static void rv64_thead_c906_cpu_init(Object *obj)
 CPURISCVState *env = &RISCV_CPU(obj)->env;
 RISCVCPU *cpu = RISCV_CPU(obj);
 
-set_misa(env, MXL_RV64, RVC | RVS | RVU);
+set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
 set_priv_version(env, PRIV_VERSION_1_11_0);
 
-cpu->cfg.ext_g = true;
 cpu->cfg.ext_zfh = true;
 cpu->cfg.mmu = true;
 cpu->cfg.ext_xtheadba = true;
@@ -808,12 +807,11 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 CPURISCVState *env = &cpu->env;
 
 /* Do some ISA extension error checking */
-if (cpu->cfg.ext_g && !(riscv_has_ext(env, RVI) &&
-riscv_has_ext(env, RVM) &&
-riscv_has_ext(env, RVA) &&
-riscv_has_ext(env, RVF) &&
-riscv_has_ext(env, RVD) &&
-cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
+if (riscv_has_ext(env, RVG) &&
+!(riscv_has_ext(env, RVI) && riscv_has_ext(env, RVM) &&
+  riscv_has_ext(env, RVA) && riscv_has_ext(env, RVF) &&
+  riscv_has_ext(env, RVD) &&
+  cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
 warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_ifencei = true;
@@ -1403,6 +1401,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVJ, .enabled = false},
 {.name = "v", .description = "Vector operations",
  .misa_bit = RVV, .enabled = false},
+{.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
+ .misa_bit = RVG, .enabled = false},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1425,7 +1425,6 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
 
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
-DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
 DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
 DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
 DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index c0280ace2a..ce92e8393d 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -81,6 +81,7 @@
 #define RVU RV('U')
 #define RVH RV('H')
 #define RVJ RV('J')
+#define RVG RV('G')
 
 
 /* Privileged specification version */
@@ -418,7 +419,6 @@ typedef struct {
 } RISCVSATPMap;
 
 struct RISCVCPUConfig {
-bool ext_g;
 bool ext_zba;
 bool ext_zbb;
 bool ext_zbc;
-- 
2.39.2

[PATCH 13/19] target/riscv: remove cpu->cfg.ext_h

[Daniel Henrique Barboza]

Create a new "h" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVH. Instances of cpu->cfg.ext_h and similar are
replaced with riscv_has_ext(env, RVH).

Remove the old "h" property and 'ext_h' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 10 +-
 target/riscv/cpu.h |  1 -
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 12bc307992..90c8fc0f30 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -841,13 +841,13 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (cpu->cfg.ext_h && !riscv_has_ext(env, RVI)) {
+if (riscv_has_ext(env, RVH) && !riscv_has_ext(env, RVI)) {
 error_setg(errp,
"H depends on an I base integer ISA with 32 x registers");
 return;
 }
 
-if (cpu->cfg.ext_h && !riscv_has_ext(env, RVS)) {
+if (riscv_has_ext(env, RVH) && !riscv_has_ext(env, RVS)) {
 error_setg(errp, "H extension implicitly requires S-mode");
 return;
 }
@@ -1113,7 +1113,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_has_ext(env, RVU)) {
 ext |= RVU;
 }
-if (riscv_cpu_cfg(env)->ext_h) {
+if (riscv_has_ext(env, RVH)) {
 ext |= RVH;
 }
 if (riscv_cpu_cfg(env)->ext_v) {
@@ -1450,6 +1450,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVS, .enabled = true},
 {.name = "u", .description = "User-level instructions",
  .misa_bit = RVU, .enabled = true},
+{.name = "h", .description = "Hypervisor",
+ .misa_bit = RVH, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1474,7 +1476,6 @@ static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
-DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
 DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
 DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
 DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
@@ -1579,7 +1580,6 @@ static void register_cpu_props(Object *obj)
  */
 if (cpu->env.misa_ext != 0) {
 cpu->cfg.ext_v = misa_ext & RVV;
-cpu->cfg.ext_h = misa_ext & RVH;
 cpu->cfg.ext_j = misa_ext & RVJ;
 
 /*
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 7b98cf4dd7..f3cb28443c 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -419,7 +419,6 @@ typedef struct {
 
 struct RISCVCPUConfig {
 bool ext_g;
-bool ext_h;
 bool ext_j;
 bool ext_v;
 bool ext_zba;
-- 
2.39.2

[PATCH 06/19] target/riscv: remove cpu->cfg.ext_d

[Daniel Henrique Barboza]

Create a new "d" RISCVCPUMisaExtConfig property that will update
env->misa_ext* with RVD. Instances of cpu->cfg.ext_d and similar are
replaced with riscv_has_ext(env, RVD).

Remove the old "d" property and 'ext_d' from RISCVCPUConfig.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 13 ++---
 target/riscv/cpu.h |  1 -
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 694b1fc421..701441b822 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -813,13 +813,12 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 /* Do some ISA extension error checking */
 if (cpu->cfg.ext_g && !(cpu->cfg.ext_i && cpu->cfg.ext_m &&
 riscv_has_ext(env, RVA) &&
-cpu->cfg.ext_f && cpu->cfg.ext_d &&
+cpu->cfg.ext_f && riscv_has_ext(env, RVD) &&
 cpu->cfg.ext_icsr && cpu->cfg.ext_ifencei)) {
 warn_report("Setting G will also set IMAFD_Zicsr_Zifencei");
 cpu->cfg.ext_i = true;
 cpu->cfg.ext_m = true;
 cpu->cfg.ext_f = true;
-cpu->cfg.ext_d = true;
 cpu->cfg.ext_icsr = true;
 cpu->cfg.ext_ifencei = true;
 
@@ -875,7 +874,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 return;
 }
 
-if (cpu->cfg.ext_d && !cpu->cfg.ext_f) {
+if (riscv_has_ext(env, RVD) && !cpu->cfg.ext_f) {
 error_setg(errp, "D extension requires F extension");
 return;
 }
@@ -895,7 +894,7 @@ static void riscv_cpu_validate_set_extensions(RISCVCPU 
*cpu, Error **errp)
 cpu->cfg.ext_zve32f = true;
 }
 
-if (cpu->cfg.ext_zve64d && !cpu->cfg.ext_d) {
+if (cpu->cfg.ext_zve64d && !riscv_has_ext(env, RVD)) {
 error_setg(errp, "Zve64d/V extensions require D extension");
 return;
 }
@@ -1105,7 +1104,7 @@ static void riscv_cpu_sync_misa_cfg(CPURISCVState *env)
 if (riscv_cpu_cfg(env)->ext_f) {
 ext |= RVF;
 }
-if (riscv_cpu_cfg(env)->ext_d) {
+if (riscv_has_ext(env, RVD)) {
 ext |= RVD;
 }
 if (riscv_has_ext(env, RVC)) {
@@ -1440,6 +1439,8 @@ static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
  .misa_bit = RVA, .enabled = true},
 {.name = "c", .description = "Compressed instructions",
  .misa_bit = RVC, .enabled = true},
+{.name = "d", .description = "Double-precision float point",
+ .misa_bit = RVD, .enabled = true},
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1467,7 +1468,6 @@ static Property riscv_cpu_extensions[] = {
 DEFINE_PROP_BOOL("g", RISCVCPU, cfg.ext_g, false),
 DEFINE_PROP_BOOL("m", RISCVCPU, cfg.ext_m, true),
 DEFINE_PROP_BOOL("f", RISCVCPU, cfg.ext_f, true),
-DEFINE_PROP_BOOL("d", RISCVCPU, cfg.ext_d, true),
 DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
 DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
 DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
@@ -1579,7 +1579,6 @@ static void register_cpu_props(Object *obj)
 cpu->cfg.ext_e = misa_ext & RVE;
 cpu->cfg.ext_m = misa_ext & RVM;
 cpu->cfg.ext_f = misa_ext & RVF;
-cpu->cfg.ext_d = misa_ext & RVD;
 cpu->cfg.ext_v = misa_ext & RVV;
 cpu->cfg.ext_s = misa_ext & RVS;
 cpu->cfg.ext_u = misa_ext & RVU;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index c6dc24d236..e4cf79e36f 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -423,7 +423,6 @@ struct RISCVCPUConfig {
 bool ext_g;
 bool ext_m;
 bool ext_f;
-bool ext_d;
 bool ext_s;
 bool ext_u;
 bool ext_h;
-- 
2.39.2

[PATCH 03/19] target/riscv: introduce riscv_cpu_add_misa_properties()

[Daniel Henrique Barboza]

Ever since RISCVCPUConfig got introduced users are able to set CPU extensions
in the command line. User settings are reflected in the cpu->cfg object
for later use. These properties are used in the target/riscv/cpu.c code,
most notably in riscv_cpu_validate_set_extensions(), where most of our
realize time validations are made.

And then there's env->misa_ext, the field where the MISA extensions are
set, that is read everywhere else. We need to keep env->misa_ext updated
with cpu->cfg settings, since our validations rely on it, forcing us to
make register_cpu_props() write cpu->cfg.ext_N flags to cover for named
CPUs that aren't used named properties but also needs to go through the
same validation steps. Failing to so will make those name CPUs fail
validation (see c66ffcd5358b for more info). Not only that, but we also
need to sync env->misa_ext with cpu->cfg again during realize() time to
catch any change the user might have done, since the rest of the code
relies on that.

Making cpu->cfg.ext_N and env->misa_ext reflect each other is not
needed. What we want is a way for users to enable/disable MISA extensions,
and there's nothing stopping us from letting the user write env->misa_ext
directly. Here are the artifacts that will enable us to do that:

- RISCVCPUMisaExtConfig will declare each MISA property;

- cpu_set_misa_ext_cfg() is the setter for each property. We'll write
  env->misa_ext and env->misa_ext_mask with the appropriate misa_bit;
  cutting off cpu->cfg.ext_N from the logic;

- cpu_get_misa_ext_cfg() is a getter that will retrieve the current val
  of the property based on env->misa_ext;

- riscv_cpu_add_misa_properties() will be called in register_cpu_props()
  to init all MISA properties from the misa_ext_cfgs[] array.

With this infrastructure we'll start to get rid of each cpu->cfg.ext_N
attribute in the next patches.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 65 ++
 1 file changed, 65 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 21c0c637e4..c33ba86085 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1394,6 +1394,69 @@ static void riscv_cpu_init(Object *obj)
 #endif /* CONFIG_USER_ONLY */
 }
 
+typedef struct RISCVCPUMisaExtConfig {
+const char *name;
+const char *description;
+target_ulong misa_bit;
+bool enabled;
+} RISCVCPUMisaExtConfig;
+
+static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+ void *opaque, Error **errp)
+{
+RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
+target_ulong misa_bit = misa_ext_cfg->misa_bit;
+RISCVCPU *cpu = RISCV_CPU(obj);
+CPURISCVState *env = &cpu->env;
+bool value;
+
+if (!visit_type_bool(v, name, &value, errp)) {
+return;
+}
+
+if (value) {
+env->misa_ext |= misa_bit;
+env->misa_ext_mask |= misa_bit;
+} else {
+env->misa_ext &= ~misa_bit;
+env->misa_ext_mask &= ~misa_bit;
+}
+}
+
+static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
+ void *opaque, Error **errp)
+{
+RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
+target_ulong misa_bit = misa_ext_cfg->misa_bit;
+RISCVCPU *cpu = RISCV_CPU(obj);
+CPURISCVState *env = &cpu->env;
+bool value;
+
+value = env->misa_ext & misa_bit;
+
+visit_type_bool(v, name, &value, errp);
+}
+
+static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {};
+
+static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+{
+int i;
+
+   for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
+RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+g_autofree char *name = g_strdup_printf("%s", misa_cfg->name);
+g_autofree char *desc = g_strdup_printf("%s", misa_cfg->description);
+
+object_property_add(cpu_obj, name, "bool",
+cpu_get_misa_ext_cfg,
+cpu_set_misa_ext_cfg,
+NULL, misa_cfg);
+object_property_set_description(cpu_obj, name, desc);
+object_property_set_bool(cpu_obj, name, misa_cfg->enabled, NULL);
+}
+}
+
 static Property riscv_cpu_extensions[] = {
 /* Defaults for standard extensions */
 DEFINE_PROP_BOOL("i", RISCVCPU, cfg.ext_i, true),
@@ -1531,6 +1594,8 @@ static void register_cpu_props(Object *obj)
 return;
 }
 
+riscv_cpu_add_misa_properties(obj);
+
 for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
 qdev_property_add_static(dev, prop);
 }
-- 
2.39.2

[PATCH 19/19] target/riscv/cpu.c: redesign register_cpu_props()

[Daniel Henrique Barboza]

The function is now a no-op for all cpu_init() callers that are setting
a non-zero misa value in set_misa(), since it's no longer used to sync
cpu->cfg props with env->misa_ext bits. Remove it in those cases.

While we're at it, rename the function to match what it's actually
doing: create user properties to set/remove CPU extensions. Make a note
that it will overwrite env->misa_ext with the defaults set by each user
property.

Update the MISA bits comment in cpu.h as well.

Signed-off-by: Daniel Henrique Barboza 
---
 target/riscv/cpu.c | 41 ++---
 target/riscv/cpu.h |  5 +
 2 files changed, 11 insertions(+), 35 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 01755036f0..08cf5e9815 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -222,7 +222,7 @@ static const char * const riscv_intr_names[] = {
 "reserved"
 };
 
-static void register_cpu_props(Object *obj);
+static void riscv_cpu_add_user_properties(Object *obj);
 
 const char *riscv_cpu_get_trap_name(target_ulong cause, bool async)
 {
@@ -350,7 +350,6 @@ static void riscv_any_cpu_init(Object *obj)
 #endif
 
 set_priv_version(env, PRIV_VERSION_1_12_0);
-register_cpu_props(obj);
 }
 
 #if defined(TARGET_RISCV64)
@@ -359,7 +358,7 @@ static void rv64_base_cpu_init(Object *obj)
 CPURISCVState *env = &RISCV_CPU(obj)->env;
 /* We set this in the realise function */
 set_misa(env, MXL_RV64, 0);
-register_cpu_props(obj);
+riscv_cpu_add_user_properties(obj);
 /* Set latest version of privileged specification */
 set_priv_version(env, PRIV_VERSION_1_12_0);
 #ifndef CONFIG_USER_ONLY
@@ -371,7 +370,6 @@ static void rv64_sifive_u_cpu_init(Object *obj)
 {
 CPURISCVState *env = &RISCV_CPU(obj)->env;
 set_misa(env, MXL_RV64, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
-register_cpu_props(obj);
 set_priv_version(env, PRIV_VERSION_1_10_0);
 #ifndef CONFIG_USER_ONLY
 set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV39);
@@ -384,7 +382,6 @@ static void rv64_sifive_e_cpu_init(Object *obj)
 RISCVCPU *cpu = RISCV_CPU(obj);
 
 set_misa(env, MXL_RV64, RVI | RVM | RVA | RVC | RVU);
-register_cpu_props(obj);
 set_priv_version(env, PRIV_VERSION_1_10_0);
 cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -430,7 +427,7 @@ static void rv128_base_cpu_init(Object *obj)
 CPURISCVState *env = &RISCV_CPU(obj)->env;
 /* We set this in the realise function */
 set_misa(env, MXL_RV128, 0);
-register_cpu_props(obj);
+riscv_cpu_add_user_properties(obj);
 /* Set latest version of privileged specification */
 set_priv_version(env, PRIV_VERSION_1_12_0);
 #ifndef CONFIG_USER_ONLY
@@ -443,7 +440,7 @@ static void rv32_base_cpu_init(Object *obj)
 CPURISCVState *env = &RISCV_CPU(obj)->env;
 /* We set this in the realise function */
 set_misa(env, MXL_RV32, 0);
-register_cpu_props(obj);
+riscv_cpu_add_user_properties(obj);
 /* Set latest version of privileged specification */
 set_priv_version(env, PRIV_VERSION_1_12_0);
 #ifndef CONFIG_USER_ONLY
@@ -455,7 +452,6 @@ static void rv32_sifive_u_cpu_init(Object *obj)
 {
 CPURISCVState *env = &RISCV_CPU(obj)->env;
 set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
-register_cpu_props(obj);
 set_priv_version(env, PRIV_VERSION_1_10_0);
 #ifndef CONFIG_USER_ONLY
 set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV32);
@@ -468,7 +464,6 @@ static void rv32_sifive_e_cpu_init(Object *obj)
 RISCVCPU *cpu = RISCV_CPU(obj);
 
 set_misa(env, MXL_RV32, RVI | RVM | RVA | RVC | RVU);
-register_cpu_props(obj);
 set_priv_version(env, PRIV_VERSION_1_10_0);
 cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -482,7 +477,6 @@ static void rv32_ibex_cpu_init(Object *obj)
 RISCVCPU *cpu = RISCV_CPU(obj);
 
 set_misa(env, MXL_RV32, RVI | RVM | RVC | RVU);
-register_cpu_props(obj);
 set_priv_version(env, PRIV_VERSION_1_11_0);
 cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -497,7 +491,6 @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
 RISCVCPU *cpu = RISCV_CPU(obj);
 
 set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVC | RVU);
-register_cpu_props(obj);
 set_priv_version(env, PRIV_VERSION_1_10_0);
 cpu->cfg.mmu = false;
 #ifndef CONFIG_USER_ONLY
@@ -515,7 +508,7 @@ static void riscv_host_cpu_init(Object *obj)
 #elif defined(TARGET_RISCV64)
 set_misa(env, MXL_RV64, 0);
 #endif
-register_cpu_props(obj);
+riscv_cpu_add_user_properties(obj);
 }
 #endif
 
@@ -1509,30 +1502,16 @@ static Property riscv_cpu_extensions[] = {
 };
 
 /*
- * Register CPU props based on env.misa_ext. If a non-zero
- * value was set, register only the required cpu->cfg.ext_*
- * properties and leave. env.misa_ext = 0 means that we want
- * all the default properties to be registered.
+ * Add CPU properties with user-facing flags.
+ *
+ * This will overwrite existing env-

Re: [PATCH for-8.0 11/11] linux-user/arm: Take more care allocating commpage

[Philippe Mathieu-Daudé]

On 27/3/23 10:38, Alex Bennée wrote:


Richard Henderson  writes:


User setting of -R reserved_va can lead to an assertion
failure in page_set_flags.  Sanity check the value of
reserved_va and print an error message instead.  Do not
allocate a commpage at all for m-profile cpus.


I see this:

   TESTconvd on i386
qemu-i386: Unable to reserve 0x1 bytes of virtual address space
at 0x8000 (File exists) for use as guest address space (check your
virtual memory ulimit setting, min_mmap_addr or reserve less using -R
option)


Maybe revealing some pre-existing issue?
https://gitlab.com/qemu-project/qemu/-/issues/447



on the ubuntu aarch64 static build:

   https://gitlab.com/stsquad/qemu/-/jobs/4003523064



Signed-off-by: Richard Henderson 
---
  linux-user/elfload.c | 37 +++--
  1 file changed, 27 insertions(+), 10 deletions(-)

Re: [PATCH v2] virtio: refresh vring region cache after updating a virtqueue size

[Cornelia Huck]

On Fri, Mar 17 2023, Carlos López  wrote:

> When a virtqueue size is changed by the guest via
> virtio_queue_set_num(), its region cache is not automatically updated.
> If the size was increased, this could lead to accessing the cache out
> of bounds. For example, in vring_get_used_event():
>
> static inline uint16_t vring_get_used_event(VirtQueue *vq)
> {
> return vring_avail_ring(vq, vq->vring.num);
> }
>
> static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
> {
> VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
> hwaddr pa = offsetof(VRingAvail, ring[i]);
>
> if (!caches) {
> return 0;
> }
>
> return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
> }
>
> vq->vring.num will be greater than caches->avail.len, which will
> trigger a failed assertion down the call path of
> virtio_lduw_phys_cached().
>
> Fix this by calling virtio_init_region_cache() after
> virtio_queue_set_num() if we are not already calling
> virtio_queue_set_rings(). In the legacy path this is already done by
> virtio_queue_update_rings().
>
> Signed-off-by: Carlos López 
> ---
> v2: use virtio_init_region_cache() instead of
> virtio_queue_update_rings() in the path for modern devices.
>
>  hw/s390x/virtio-ccw.c  | 1 +
>  hw/virtio/virtio-mmio.c| 1 +
>  hw/virtio/virtio-pci.c | 1 +
>  hw/virtio/virtio.c | 2 +-
>  include/hw/virtio/virtio.h | 1 +
>  5 files changed, 5 insertions(+), 1 deletion(-)
>

Reviewed-by: Cornelia Huck 

We can always do any ccw reshuffling on top.

Re: [PATCH v2] virtio: refresh vring region cache after updating a virtqueue size

[Halil Pasic]

On Mon, 27 Mar 2023 08:29:09 -0400
"Michael S. Tsirkin"  wrote:

> On Mon, Mar 27, 2023 at 01:06:19PM +0200, Cornelia Huck wrote:
> > On Wed, Mar 22 2023, Halil Pasic  wrote:
> >   
> > > On Wed, 22 Mar 2023 10:52:31 +0100
> > > Cornelia Huck  wrote:
> > > [..]  
> > >> >
> > >> > diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
> > >> > index e33e5207ab..f44de1a8c1 100644
> > >> > --- a/hw/s390x/virtio-ccw.c
> > >> > +++ b/hw/s390x/virtio-ccw.c
> > >> > @@ -237,6 +237,7 @@ static int virtio_ccw_set_vqs(SubchDev *sch, 
> > >> > VqInfoBlock *info,
> > >> >  return -EINVAL;
> > >> >  }
> > >> >  virtio_queue_set_num(vdev, index, num);
> > >> > +virtio_init_region_cache(vdev, index);
> > >> 
> > >> Hmm... this is not wrong, but looking at it again, I see that the guest
> > >> has no way to change num after our last call to
> > >> virtio_init_region_cache() (while setting up the queue addresses.) IOW,
> > >> this introduces an extra round trip that is not really needed.
> > >>   
> > >
> > > I don't quite understand. AFAIU the virtio_init_region_cache() would see
> > > the (new) queue addresses but not the new size (num). Yes virtio-ccw
> > > already knows the new num but it is yet to call
> > > to put it into vdev->vq[n].vring.num from where
> > > virtio_init_region_cache() picks it up.
> > >
> > > If we were to first virtio_queue_set_num() and only then the address
> > > I would understand. But with the code as is, I don't. Am I missing
> > > something?  
> > 
> > Hrm, virtio_queue_set_rings() doesn't pass num, I thought it did... I
> > wonder whether ordering virtio_queue_set_num() before it would be better
> > anyway (if the guest gave us an invalid num, we don't need to setup any
> > addresses and init any caches).
> > 
> > Smth like
> > 
> > if (info) {
> >if (desc) {
> >   if (virtio_queue_get_max_num(...) < num) {
> >   return -EINVAL;
> >   }
> >   virtio_queue_set_num(...);
> >}
> >virtio_queue_set_rings(...);
> > } else { /* legacy */
> >if (desc && virtio_queue_get_max_num(...) > num) {
> >return -EINVAL;
> >}
> >virtio_queue_set_addr(...);
> > }
> > virtio_queue_set_vector(vdev, index, desc ? index : VIRTIO_NO_VECTOR);
> > 
> > might be easier to follow than the current code.
> > 
> > Or we could just go with this patch, which has the advantage of already
> > existing :)  
> 
> Yea ... an ack would be appreciated.

I'm in favor of taking the existing one. We can still do the refactoring
afterwards and also get rid of the then redundant update. That way
the git history would also "tell the story".

For the s390x part:
Acked-by: Halil Pasic 

Re: [PATCH v4 1/1] util/async-teardown: wire up query-command-line-options

[Markus Armbruster]

Claudio Imbrenda  writes:

> The recently introduced -async-teardown commandline option was not
> wired up properly and did not show up in the output of the QMP command
> query-command-line-options. This means that libvirt had no way to
> discover whether the feature was supported.

Excuse the pedantry...  The option *was* wired up correctly, just in a
way that isn't visible in query-command-line-options.  Suggest "The
recently introduced -async-teardown command line option -async-teardown
is not visible in query-command-line-options."

> This patch fixes the issue by replacing the -async-teardown option with
> a new -teardown option with a new async=on|off parameter.

Why we can drop -async-teardown right away, without a deprecating it
first?  The commit message needs to make the argument.

If we can drop it right away, you need to update
about/removed-features.rst.

Else, you need to update docs/about/deprecated.rst, and emit a warning
when the option is used.  Something like

warn_reportf("-async-teardown is deprecated, use -teardown async=on 
instead");

> The new option is correctly wired up so that it appears in the output
> of query-command-line-options.

Suggest

  Add new -teardown option with an async=on|off parameter.  It is
  visible in query-command-line-options.

Then either

  Option -async-teardown is now redundant.  We'd normally deprecate it
  and remove it after a grace period, but 
  Drop it.

or

  Option -async-teardown is now redundant.  Deprecate it.

> Reported-by: Boris Fiuczynski 
> Fixes: c891c24b1a ("os-posix: asynchronous teardown for shutdown on Linux")
> Signed-off-by: Claudio Imbrenda 

Re: [PATCH v7 1/3] docs: Add support for TPM devices over I2C bus

[Ninad Palsule]

Hi Joel,


On 3/27/23 2:47 AM, Joel Stanley wrote:

On Sun, 26 Mar 2023 at 22:44, Ninad Palsule  wrote:

This is a documentation change for I2C TPM device support.

Qemu already supports devices attached to ISA and sysbus.
This drop adds support for the I2C bus attached TPM devices.

Signed-off-by: Ninad Palsule 

---
V2:

Incorporated Stephen's review comments
- Added example in the document.

---
V4:
Incorporate Cedric & Stefan's comments

- Added example for ast2600-evb
- Corrected statement about arm virtual machine.

---
V6:
Incorporated review comments from Stefan.
---
  docs/specs/tpm.rst | 32 
  1 file changed, 32 insertions(+)

diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
index 535912a92b..590e670a9a 100644
--- a/docs/specs/tpm.rst
+++ b/docs/specs/tpm.rst
@@ -21,12 +21,16 @@ QEMU files related to TPM TIS interface:
   - ``hw/tpm/tpm_tis_common.c``
   - ``hw/tpm/tpm_tis_isa.c``
   - ``hw/tpm/tpm_tis_sysbus.c``
+ - ``hw/tpm/tpm_tis_i2c.c``
   - ``hw/tpm/tpm_tis.h``

  Both an ISA device and a sysbus device are available. The former is
  used with pc/q35 machine while the latter can be instantiated in the
  Arm virt machine.

+An I2C device support is also provided which can be instantiated in the Arm
+based emulation machines. This device only supports the TPM 2 protocol.
+
  CRB interface
  -

@@ -348,6 +352,34 @@ In case an Arm virt machine is emulated, use the following 
command line:
  -drive if=pflash,format=raw,file=flash0.img,readonly=on \
  -drive if=pflash,format=raw,file=flash1.img

+In case a ast2600-evb bmc machine is emulated and want to use TPM device
+attached to I2C bus, use the following command line:
+
+.. code-block:: console
+
+  qemu-system-arm -M ast2600-evb -nographic \
+-kernel arch/arm/boot/zImage \
+-dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \
+-initrd rootfs.cpio \
+-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+-tpmdev emulator,id=tpm0,chardev=chrtpm \
+-device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e

For testing, use this command to load the driver to the correct address:

echo tpm_tis_i2c 0x2e > /sys/bus/i2c/devices/i2c-12/new_device

(I don't know how specific we want to make the instructions, but
adding a line like above would help others from having to re-discover
the command).

Make sense. Added.



+
+In case a Rainier bmc machine is emulated and want to use TPM device
+attached to I2C bus, use the following command line:
+
+.. code-block:: console
+
+  qemu-system-arm -M rainier-bmc -nographic \
+-kernel ${IMAGEPATH}/fitImage-linux.bin \
+-dtb ${IMAGEPATH}/aspeed-bmc-ibm-rainier.dtb \
+-initrd ${IMAGEPATH}/obmc-phosphor-initramfs.rootfs.cpio.xz \
+-drive 
file=${IMAGEPATH}/obmc-phosphor-image.rootfs.wic.qcow2,if=sd,index=2\
+-net nic -net 
user,hostfwd=:127.0.0.1:-:22,hostfwd=:127.0.0.1:2443-:443\
+-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+-tpmdev emulator,id=tpm0,chardev=chrtpm \
+-device tpm-tis-i2c,tpmdev=tpm0,bus=aspeed.i2c.bus.12,address=0x2e
+

I'd drop this example, the above one is enough.

Removed.



  In case SeaBIOS is used as firmware, it should show the TPM menu item
  after entering the menu with 'ESC'.

--
2.37.2

Re: [PATCH v7 0/3] Add support for TPM devices over I2C bus

[Stefan Berger]

On 3/27/23 08:31, Stefan Berger wrote:



On 3/27/23 07:11, Stefan Berger wrote:






We get this message when booting from a kernel:

[    0.582699] tpm_tis_i2c 12-002e: 2.0 TPM (device-id 0x1, rev-id 1)
[    0.586361] tpm tpm0: A TPM error (256) occurred attempting the self test
[    0.586623] tpm tpm0: starting up the TPM manually

Do we understand why the error appears?


The firmware did not initialize the TPM 2.




However on a clean boot into the TPM, the u-boot tpm commands fail:

ast# tpm info
tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [closed]
ast# tpINTERRUPT>


Is this normal output? Is it an indication of some sort of IRQ?


ast# tpm init
ast# tpm info
tpm@2e v2.0: VendorID 0x1014, DeviceID 0x0001, RevisionID 0x01 [open]
ast# tpm pcr_read 0 0x8100
Error: 256


If this is an error from the TPM 2 , then the 256 error code is the same as 
reported by Linux above:

$ tssreturncode 0x100
TPM_RC_INITIALIZE - TPM not initialized by TPM2_Startup or already initialized


I will try to reproduce this today. u-boot should have a sent TPM2_Startup as 
part of 'tpm init' command above or even before on its own.


One needs to do this here:

ast# tpm2 startup TPM2_SU_CLEAR
ast# tpm2 pcr_read 0 0x8100
PCR #0 content (332 known updates):
 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

   Stefan

[PATCH v2 1/6] target/ppc: Fix width of some 32-bit SPRs

[Nicholas Piggin]

Some 32-bit SPRs are incorrectly implemented as 64-bits on 64-bit
targets.

This changes VRSAVE, DSISR, HDSISR, DAWRX0, PIDR, LPIDR, DEXCR,
HDEXCR, CTRL, TSCR, MMCRH, and PMC[1-6] from to be 32-bit registers.

This only goes by the 32/64 classification in the architecture, it
does not try to implement finer details of SPR implementation (e.g.,
not all bits implemented as simple read/write storage).

Signed-off-by: Nicholas Piggin 
---
 target/ppc/cpu_init.c| 18 +-
 target/ppc/helper_regs.c |  2 +-
 target/ppc/misc_helper.c |  4 ++--
 target/ppc/power8-pmu.c  |  2 +-
 target/ppc/translate.c   |  2 +-
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 0ce2e3c91d..5aa0b3f0f1 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -5085,8 +5085,8 @@ static void register_book3s_altivec_sprs(CPUPPCState *env)
 }
 
 spr_register_kvm(env, SPR_VRSAVE, "VRSAVE",
- &spr_read_generic, &spr_write_generic,
- &spr_read_generic, &spr_write_generic,
+ &spr_read_generic, &spr_write_generic32,
+ &spr_read_generic, &spr_write_generic32,
  KVM_REG_PPC_VRSAVE, 0x);
 
 }
@@ -5120,7 +5120,7 @@ static void register_book3s_207_dbg_sprs(CPUPPCState *env)
 spr_register_kvm_hv(env, SPR_DAWRX0, "DAWRX0",
 SPR_NOACCESS, SPR_NOACCESS,
 SPR_NOACCESS, SPR_NOACCESS,
-&spr_read_generic, &spr_write_generic,
+&spr_read_generic, &spr_write_generic32,
 KVM_REG_PPC_DAWRX, 0x);
 spr_register_kvm_hv(env, SPR_CIABR, "CIABR",
 SPR_NOACCESS, SPR_NOACCESS,
@@ -5376,7 +5376,7 @@ static void register_book3s_ids_sprs(CPUPPCState *env)
 spr_register_hv(env, SPR_TSCR, "TSCR",
  SPR_NOACCESS, SPR_NOACCESS,
  SPR_NOACCESS, SPR_NOACCESS,
- &spr_read_generic, &spr_write_generic,
+ &spr_read_generic, &spr_write_generic32,
  0x);
 spr_register_hv(env, SPR_HMER, "HMER",
  SPR_NOACCESS, SPR_NOACCESS,
@@ -5406,7 +5406,7 @@ static void register_book3s_ids_sprs(CPUPPCState *env)
 spr_register_hv(env, SPR_MMCRC, "MMCRC",
  SPR_NOACCESS, SPR_NOACCESS,
  SPR_NOACCESS, SPR_NOACCESS,
- &spr_read_generic, &spr_write_generic,
+ &spr_read_generic, &spr_write_generic32,
  0x);
 spr_register_hv(env, SPR_MMCRH, "MMCRH",
  SPR_NOACCESS, SPR_NOACCESS,
@@ -5441,7 +5441,7 @@ static void register_book3s_ids_sprs(CPUPPCState *env)
 spr_register_hv(env, SPR_HDSISR, "HDSISR",
  SPR_NOACCESS, SPR_NOACCESS,
  SPR_NOACCESS, SPR_NOACCESS,
- &spr_read_generic, &spr_write_generic,
+ &spr_read_generic, &spr_write_generic32,
  0x);
 spr_register_hv(env, SPR_HRMOR, "HRMOR",
  SPR_NOACCESS, SPR_NOACCESS,
@@ -5665,7 +5665,7 @@ static void register_power7_book4_sprs(CPUPPCState *env)
  KVM_REG_PPC_ACOP, 0);
 spr_register_kvm(env, SPR_BOOKS_PID, "PID",
  SPR_NOACCESS, SPR_NOACCESS,
- &spr_read_generic, &spr_write_generic,
+ &spr_read_generic, &spr_write_generic32,
  KVM_REG_PPC_PID, 0);
 #endif
 }
@@ -5730,7 +5730,7 @@ static void register_power10_dexcr_sprs(CPUPPCState *env)
 {
 spr_register(env, SPR_DEXCR, "DEXCR",
 SPR_NOACCESS, SPR_NOACCESS,
-&spr_read_generic, &spr_write_generic,
+&spr_read_generic, &spr_write_generic32,
 0);
 
 spr_register(env, SPR_UDEXCR, "DEXCR",
@@ -5741,7 +5741,7 @@ static void register_power10_dexcr_sprs(CPUPPCState *env)
 spr_register_hv(env, SPR_HDEXCR, "HDEXCR",
 SPR_NOACCESS, SPR_NOACCESS,
 SPR_NOACCESS, SPR_NOACCESS,
-&spr_read_generic, &spr_write_generic,
+&spr_read_generic, &spr_write_generic32,
 0);
 
 spr_register(env, SPR_UHDEXCR, "HDEXCR",
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index 779e7db513..fb351c303f 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -448,7 +448,7 @@ void register_non_embedded_sprs(CPUPPCState *env)
 /* Exception processing */
 spr_register_kvm(env, SPR_DSISR, "DSISR",
  SPR_NOACCESS, SPR_NOACCESS,
- &spr_read_generic, &spr_write_generic,
+ &spr_read_generic, &spr_write_generic32,
  KVM_REG_PPC_DSISR, 0x);
 spr_register_kvm(env, SPR_DAR, "DAR",
  SPR_NOACCESS, SPR_NOACCESS,
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index a9bc1522e2.

[PATCH v2 6/6] target/ppc: Implement HEIR SPR

[Nicholas Piggin]

The hypervisor emulation assistance interrupt modifies HEIR to
contain the value of the instruction which caused the exception.

Signed-off-by: Nicholas Piggin 
---
 target/ppc/cpu.h |  1 +
 target/ppc/cpu_init.c| 23 +++
 target/ppc/excp_helper.c | 12 +++-
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 557d736dab..8c4a203ecb 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1653,6 +1653,7 @@ void ppc_compat_add_property(Object *obj, const char 
*name,
 #define SPR_HMER  (0x150)
 #define SPR_HMEER (0x151)
 #define SPR_PCR   (0x152)
+#define SPR_HEIR  (0x153)
 #define SPR_BOOKE_LPIDR   (0x152)
 #define SPR_BOOKE_TCR (0x154)
 #define SPR_BOOKE_TLB0PS  (0x158)
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 5aa0b3f0f1..ff73be1812 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1629,6 +1629,7 @@ static void register_8xx_sprs(CPUPPCState *env)
  * HSRR0   => SPR 314 (Power 2.04 hypv)
  * HSRR1   => SPR 315 (Power 2.04 hypv)
  * LPIDR   => SPR 317 (970)
+ * HEIR=> SPR 339 (Power 2.05 hypv) (64-bit reg from 3.1)
  * EPR => SPR 702 (Power 2.04 emb)
  * perf=> 768-783 (Power 2.04)
  * perf=> 784-799 (Power 2.04)
@@ -5522,6 +5523,24 @@ static void register_power6_common_sprs(CPUPPCState *env)
  0x);
 }
 
+static void register_HEIR32_spr(CPUPPCState *env)
+{
+spr_register_hv(env, SPR_HEIR, "HEIR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ SPR_NOACCESS, SPR_NOACCESS,
+ &spr_read_generic, &spr_write_generic32,
+ 0x);
+}
+
+static void register_HEIR64_spr(CPUPPCState *env)
+{
+spr_register_hv(env, SPR_HEIR, "HEIR",
+ SPR_NOACCESS, SPR_NOACCESS,
+ SPR_NOACCESS, SPR_NOACCESS,
+ &spr_read_generic, &spr_write_generic,
+ 0x);
+}
+
 static void register_power8_tce_address_control_sprs(CPUPPCState *env)
 {
 spr_register_kvm(env, SPR_TAR, "TAR",
@@ -5950,6 +5969,7 @@ static void init_proc_POWER7(CPUPPCState *env)
 register_power5p_ear_sprs(env);
 register_power5p_tb_sprs(env);
 register_power6_common_sprs(env);
+register_HEIR32_spr(env);
 register_power6_dbg_sprs(env);
 register_power7_book4_sprs(env);
 
@@ -6072,6 +6092,7 @@ static void init_proc_POWER8(CPUPPCState *env)
 register_power5p_ear_sprs(env);
 register_power5p_tb_sprs(env);
 register_power6_common_sprs(env);
+register_HEIR32_spr(env);
 register_power6_dbg_sprs(env);
 register_power8_tce_address_control_sprs(env);
 register_power8_ids_sprs(env);
@@ -6234,6 +6255,7 @@ static void init_proc_POWER9(CPUPPCState *env)
 register_power5p_ear_sprs(env);
 register_power5p_tb_sprs(env);
 register_power6_common_sprs(env);
+register_HEIR32_spr(env);
 register_power6_dbg_sprs(env);
 register_power8_tce_address_control_sprs(env);
 register_power8_ids_sprs(env);
@@ -6409,6 +6431,7 @@ static void init_proc_POWER10(CPUPPCState *env)
 register_power5p_ear_sprs(env);
 register_power5p_tb_sprs(env);
 register_power6_common_sprs(env);
+register_HEIR64_spr(env);
 register_power6_dbg_sprs(env);
 register_power8_tce_address_control_sprs(env);
 register_power8_ids_sprs(env);
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 4e119c4dfc..84f222ba1d 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1596,13 +1596,23 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int 
excp)
 case POWERPC_EXCP_HDECR: /* Hypervisor decrementer exception */
 case POWERPC_EXCP_HDSI:  /* Hypervisor data storage exception*/
 case POWERPC_EXCP_SDOOR_HV:  /* Hypervisor Doorbell interrupt*/
-case POWERPC_EXCP_HV_EMU:
 case POWERPC_EXCP_HVIRT: /* Hypervisor virtualization*/
 srr0 = SPR_HSRR0;
 srr1 = SPR_HSRR1;
 new_msr |= (target_ulong)MSR_HVB;
 new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
 break;
+case POWERPC_EXCP_HV_EMU:
+env->spr[SPR_HEIR] = insn;
+if (is_prefix_excp(env, insn)) {
+uint32_t insn2 = ppc_ldl_code(env, env->nip + 4);
+env->spr[SPR_HEIR] |= (uint64_t)insn2 << 32;
+}
+srr0 = SPR_HSRR0;
+srr1 = SPR_HSRR1;
+new_msr |= (target_ulong)MSR_HVB;
+new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
+break;
 case POWERPC_EXCP_VPU:   /* Vector unavailable exception */
 case POWERPC_EXCP_VSXU:   /* VSX unavailable exception   */
 case POWERPC_EXCP_FU: /* Facility unavailable exception  */
-- 
2.37.2

[PATCH v2 2/6] target/ppc: Better CTRL SPR implementation

[Nicholas Piggin]

The CTRL register is able to write bit zero, and that is reflected in a
bit field in the register that reflects the state of all threads in the
core.

TCG does not implement SMT, so this just requires mirroring that bit into
the first bit of the thread state field.

Signed-off-by: Nicholas Piggin 
---
 target/ppc/translate.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 58fa509057..d699acb3d0 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -413,7 +413,14 @@ void spr_write_generic(DisasContext *ctx, int sprn, int 
gprn)
 
 void spr_write_CTRL(DisasContext *ctx, int sprn, int gprn)
 {
-spr_write_generic32(ctx, sprn, gprn);
+/* This does not implement >1 thread */
+TCGv t0 = tcg_temp_new();
+TCGv t1 = tcg_temp_new();
+tcg_gen_extract_tl(t0, cpu_gpr[gprn], 0, 1); /* Extract RUN field */
+tcg_gen_shli_tl(t1, t0, 8); /* Duplicate the bit in TS */
+tcg_gen_or_tl(t1, t1, t0);
+gen_store_spr(sprn, t1);
+spr_store_dump_spr(sprn);
 
 /*
  * SPR_CTRL writes must force a new translation block,
-- 
2.37.2

[PATCH v2 4/6] target/ppc: Alignment faults do not set DSISR in ISA v3.0 onward

[Nicholas Piggin]

This optional behavior was removed from the ISA in v3.0, see
Summary of Changes preface:

  Data Storage Interrupt Status Register for Alignment Interrupt:
  Simplifies the Alignment interrupt by remov- ing the Data Storage
  Interrupt Status Register (DSISR) from the set of registers modified
  by the Alignment interrupt.

Signed-off-by: Nicholas Piggin 
---
Since v1:
- Use insns_flags instead of excp_model [Fabiano review]

 target/ppc/excp_helper.c | 17 ++---
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 07729967b5..6ac003bcd5 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1449,13 +1449,16 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int 
excp)
 break;
 }
 case POWERPC_EXCP_ALIGN: /* Alignment exception  */
-/* Get rS/rD and rA from faulting opcode */
-/*
- * Note: the opcode fields will not be set properly for a
- * direct store load/store, but nobody cares as nobody
- * actually uses direct store segments.
- */
-env->spr[SPR_DSISR] |= (env->error_code & 0x03FF) >> 16;
+/* Optional DSISR update was removed from ISA v3.0 */
+if (!(env->insns_flags2 & PPC2_ISA300)) {
+/* Get rS/rD and rA from faulting opcode */
+/*
+ * Note: the opcode fields will not be set properly for a
+ * direct store load/store, but nobody cares as nobody
+ * actually uses direct store segments.
+ */
+env->spr[SPR_DSISR] |= (env->error_code & 0x03FF) >> 16;
+}
 break;
 case POWERPC_EXCP_PROGRAM:   /* Program exception*/
 switch (env->error_code & ~0xF) {
-- 
2.37.2

[PATCH v2 5/6] target/ppc: Add SRR1 prefix indication to interrupt handlers

[Nicholas Piggin]

ISA v3.1 introduced prefix instructions. Among the changes, various
synchronous interrupts report whether they were caused by a prefix
instruction in (H)SRR1.

Signed-off-by: Nicholas Piggin 
---
Since v1:
- Use insns_flags instead of excp_model [Fabiano review]

 target/ppc/excp_helper.c | 32 
 1 file changed, 32 insertions(+)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 6ac003bcd5..4e119c4dfc 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1346,12 +1346,21 @@ static bool books_vhyp_handles_hv_excp(PowerPCCPU *cpu)
 return false;
 }
 
+static bool is_prefix_excp(CPUPPCState *env, uint32_t insn)
+{
+if (!(env->insns_flags2 & PPC2_ISA310)) {
+return false;
+}
+return ((insn & 0xfc00) == 0x0400);
+}
+
 static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
 {
 CPUState *cs = CPU(cpu);
 CPUPPCState *env = &cpu->env;
 target_ulong msr, new_msr, vector;
 int srr0, srr1, lev = -1;
+uint32_t insn = 0;
 
 /* new srr1 value excluding must-be-zero bits */
 msr = env->msr & ~0x783fULL;
@@ -1390,6 +1399,29 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
 
 vector |= env->excp_prefix;
 
+switch (excp) {
+case POWERPC_EXCP_MCHECK:
+case POWERPC_EXCP_DSI:
+case POWERPC_EXCP_DSEG:
+case POWERPC_EXCP_ALIGN:
+case POWERPC_EXCP_PROGRAM:
+case POWERPC_EXCP_FPU:
+case POWERPC_EXCP_TRACE:
+case POWERPC_EXCP_HDSI:
+case POWERPC_EXCP_HV_EMU:
+case POWERPC_EXCP_VPU:
+case POWERPC_EXCP_VSXU:
+case POWERPC_EXCP_FU:
+case POWERPC_EXCP_HV_FU:
+insn = ppc_ldl_code(env, env->nip);
+if (is_prefix_excp(env, insn)) {
+msr |= PPC_BIT(34);
+}
+break;
+default:
+break;
+}
+
 switch (excp) {
 case POWERPC_EXCP_MCHECK:/* Machine check exception  */
 if (!FIELD_EX64(env->msr, MSR, ME)) {
-- 
2.37.2