date:20220115


On 08/01/2022 09:13, Xiaojuan Yang wrote:


Mainly introduce how to run the softmmu

Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
---
  target/loongarch/README | 25 +
  1 file changed, 25 insertions(+)

diff --git a/target/loongarch/README b/target/loongarch/README
index d5780c5918..337ba55f33 100644
--- a/target/loongarch/README
+++ b/target/loongarch/README
@@ -72,6 +72,31 @@
./qemu-loongarch64  /opt/clfs/usr/bin/pwd
...
  
+- Softmmu emulation

+
+  Add support softmmu emulation support in the following series patches.
+  Mainly emulate a virt 3A5000 board and ls7a bridge that is not exactly
+  the same as the host. Kernel code and uefi code is on the github.
+  All required binaries can get from github for test.
+
+  1.Download kernel and the cross-tools.(vmlinux)
+
+  https://github.com/loongson/linux/tree/loongarch-next
+  
https://github.com/loongson/build-tools/releases/latest/download/loongarch64-clfs-20211202-cross-tools.tar.xz
+
+  2.Download uefi code.(loongarch_bios.bin)
+
+  https://github.com/loongson/edk2/tree/LoongArch
+  https://github.com/loongson/edk2-platforms
+
+  3.Download the clfs-system and make a ramdisk with busybox.(ramdisk)
+
+  4.Run with command,eg:
+
+   ./build/qemu-system-loongarch64 -m 4G -smp 4 --cpu Loongson-3A5000 --machine 
loongson3-ls7a -kernel ./vmlinux -initrd ./ramdisk  -append "root=/dev/ram 
console=ttyS0,115200 rdinit=/sbin/init loglevel=8" -monitor tcp::4000,server,nowait 
-nographic
+
+The vmlinux, ramdisk and uefi binary loongarch_bios.bin can get from :
+git clone https://github.com/yangxiaojuan-loongson/qemu-binary
  
  - Note.

We can get the latest LoongArch documents or LoongArch tools at 
https://github.com/loongson/


This target/loongarch/README file doesn't exist in git master, so presumably this is 
based upon another series, possibly introducing linux-user support?


Is the plan to merge the linux-user support first? If so then you should add a 
Based-on tag to the cover letter referencing the corresponding linux-user patch series.


Also: I don't see a URL for a git repo containing the complete patchset which can 
help making some bits of review easier.



ATB,

Mark.

Re: [RFC PATCH v4 05/30] target/loongarch: Add constant timer support


On 08/01/2022 09:13, Xiaojuan Yang wrote:


Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
---
  target/loongarch/constant_timer.c | 63 +++
  target/loongarch/cpu.c|  9 +
  target/loongarch/cpu.h| 10 +
  target/loongarch/meson.build  |  1 +
  4 files changed, 83 insertions(+)
  create mode 100644 target/loongarch/constant_timer.c

diff --git a/target/loongarch/constant_timer.c 
b/target/loongarch/constant_timer.c
new file mode 100644
index 00..e7d0f5ffe7
--- /dev/null
+++ b/target/loongarch/constant_timer.c
@@ -0,0 +1,63 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU LoongArch constant timer support
+ *
+ * Copyright (c) 2021 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "hw/loongarch/loongarch.h"
+#include "qemu/timer.h"
+#include "cpu.h"
+
+#define TIMER_PERIOD10 /* 10 ns period for 100 Mhz frequency */
+#define CONSTANT_TIMER_TICK_MASK0xfffcUL
+#define CONSTANT_TIMER_ENABLE   0x1UL
+
+/* LoongArch timer */
+uint64_t cpu_loongarch_get_constant_timer_counter(LoongArchCPU *cpu)
+{
+return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / TIMER_PERIOD;
+}
+
+uint64_t cpu_loongarch_get_constant_timer_ticks(LoongArchCPU *cpu)
+{
+uint64_t now, expire;
+
+now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+expire = timer_expire_time_ns(&cpu->timer);
+
+return (expire - now) / TIMER_PERIOD;
+}
+
+void cpu_loongarch_store_constant_timer_config(LoongArchCPU *cpu,
+   uint64_t value)
+{
+CPULoongArchState *env = &cpu->env;
+uint64_t now, next;
+
+env->CSR_TCFG = value;
+if (value & CONSTANT_TIMER_ENABLE) {
+now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+next = now + (value & CONSTANT_TIMER_TICK_MASK) * TIMER_PERIOD;
+timer_mod(&cpu->timer, next);
+}
+}
+
+void loongarch_constant_timer_cb(void *opaque)
+{
+LoongArchCPU *cpu  = opaque;
+CPULoongArchState *env = &cpu->env;
+uint64_t now, next;
+
+if (FIELD_EX64(env->CSR_TCFG, CSR_TCFG, PERIODIC)) {
+now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+next = now + (env->CSR_TCFG & CONSTANT_TIMER_TICK_MASK) * TIMER_PERIOD;
+timer_mod(&cpu->timer, next);
+} else {
+env->CSR_TCFG = FIELD_DP64(env->CSR_TCFG, CSR_TCFG, EN, 0);
+}
+
+env->CSR_ESTAT |= 1 << IRQ_TIMER;
+cpu_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);
+}
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 690eeea2e6..823951 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -235,12 +235,21 @@ static void loongarch_cpu_realizefn(DeviceState *dev, 
Error **errp)
  LoongArchCPUClass *lacc = LOONGARCH_CPU_GET_CLASS(dev);
  Error *local_err = NULL;
  
+#ifndef CONFIG_USER_ONLY

+LoongArchCPU *cpu = LOONGARCH_CPU(dev);
+#endif
+
  cpu_exec_realizefn(cs, &local_err);
  if (local_err != NULL) {
  error_propagate(errp, local_err);
  return;
  }
  
+#ifndef CONFIG_USER_ONLY

+timer_init_ns(&cpu->timer, QEMU_CLOCK_VIRTUAL,
+  &loongarch_constant_timer_cb, cpu);
+#endif
+


As I mentioned previously, I'm not convinced that adding the CONFIG_USER_ONLY guards 
is the right thing to do here.


For SPARC64 there is a separate sparc64_cpu_devinit() function that is only called in 
sysemu mode (via the machine init() function) which sets up the timers. Have a look 
at hw/sparc64/sparc64.c and hw/sparc64/sun4u.c for an existing reference as to how 
this is done.


This suggests that a similar function would need to exist in 
hw/loongarch/loongson3.c.


  cpu_reset(cs);
  qemu_init_vcpu(cs);
  
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h

index cf7fc46f72..ef84584678 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -12,6 +12,7 @@
  #include "fpu/softfloat-types.h"
  #include "hw/registerfields.h"
  #include "cpu-csr.h"
+#include "qemu/timer.h"
  
  #define TCG_GUEST_DEFAULT_MO (0)
  
@@ -148,6 +149,9 @@ FIELD(CPUCFG20, L3IU_SIZE, 24, 7)

  extern const char * const regnames[32];
  extern const char * const fregnames[32];
  
+#define N_IRQS  14

+#define IRQ_TIMER   11
+
  typedef struct CPULoongArchState CPULoongArchState;
  struct CPULoongArchState {
  uint64_t gpr[32];
@@ -242,6 +246,7 @@ struct LoongArchCPU {
  
  CPUNegativeOffsetState neg;

  CPULoongArchState env;
+QEMUTimer timer; /* Internal timer */
  };
  
  #define TYPE_LOONGARCH_CPU "loongarch-cpu"

@@ -306,4 +311,9 @@ enum {
  #define LOONGARCH_CPU_TYPE_NAME(model) model LOONGARCH_CPU_TYPE_SUFFIX
  #define CPU_RESOLVING_TYPE TYPE_LOONGARCH_CPU
  
+void loongarch_constant_timer_cb(void *opaque);

+uint64_t cpu_loongarch_get_constant_timer_counter(LoongArchCPU *cpu);
+uint64_t cpu_loongarch_get_constant_timer_ticks(LoongArchCPU *cpu);
+void cpu_loongarch_store_constant_timer_config(LoongArchCPU *cpu,
+

Re: [RFC PATCH v4 03/30] target/loongarch: Add basic vmstate description of CPU.


On 08/01/2022 09:13, Xiaojuan Yang wrote:


This patch introduce vmstate_loongarch_cpu

Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
Reviewed-by: Richard Henderson 
---
  target/loongarch/cpu.c   |  3 ++
  target/loongarch/internals.h |  4 ++
  target/loongarch/machine.c   | 84 
  target/loongarch/meson.build |  6 +++
  4 files changed, 97 insertions(+)
  create mode 100644 target/loongarch/machine.c

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index ed03ec2986..6e3dc5e6fa 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -320,6 +320,9 @@ static void loongarch_cpu_class_init(ObjectClass *c, void 
*data)
  cc->has_work = loongarch_cpu_has_work;
  cc->dump_state = loongarch_cpu_dump_state;
  cc->set_pc = loongarch_cpu_set_pc;
+#ifndef CONFIG_USER_ONLY
+dc->vmsd = &vmstate_loongarch_cpu;
+#endif


Do we need CONFIG_USER_ONLY guards around dc->vmsd? I'd expect this to simply be 
ignored in linux-user mode. Again it's a bit hard to see the full context without 
having the complete series available in git somewhere.



  cc->disas_set_info = loongarch_cpu_disas_set_info;
  #ifdef CONFIG_TCG
  cc->tcg_ops = &loongarch_tcg_ops;
diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index 774a87ec80..c8e6f7012c 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -25,4 +25,8 @@ const char *loongarch_exception_name(int32_t exception);
  
  void restore_fp_status(CPULoongArchState *env);
  
+#ifndef CONFIG_USER_ONLY

+extern const VMStateDescription vmstate_loongarch_cpu;
+#endif
+
  #endif
diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
new file mode 100644
index 00..b9effe6db2
--- /dev/null
+++ b/target/loongarch/machine.c
@@ -0,0 +1,84 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU LoongArch machine State
+ *
+ * Copyright (c) 2021 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "migration/cpu.h"
+
+/* LoongArch CPU state */
+
+const VMStateDescription vmstate_loongarch_cpu = {
+.name = "cpu",
+.version_id = 0,
+.minimum_version_id = 0,
+.fields = (VMStateField[]) {
+
+VMSTATE_UINTTL_ARRAY(env.gpr, LoongArchCPU, 32),
+VMSTATE_UINTTL(env.pc, LoongArchCPU),
+VMSTATE_UINT64_ARRAY(env.fpr, LoongArchCPU, 32),
+VMSTATE_UINT32(env.fcsr0, LoongArchCPU),
+
+/* Remaining CSR registers */
+VMSTATE_UINT64(env.CSR_CRMD, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PRMD, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_EUEN, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_MISC, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_ECFG, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_ESTAT, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_ERA, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_BADV, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_BADI, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_EENTRY, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBIDX, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBEHI, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBELO0, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBELO1, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_ASID, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PGDL, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PGDH, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PGD, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PWCL, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PWCH, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_STLBPS, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_RVACFG, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_CPUID, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PRCFG1, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PRCFG2, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_PRCFG3, LoongArchCPU),
+VMSTATE_UINT64_ARRAY(env.CSR_SAVE, LoongArchCPU, 16),
+VMSTATE_UINT64(env.CSR_TID, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TCFG, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TVAL, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_CNTC, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TICLR, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_LLBCTL, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_IMPCTL1, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_IMPCTL2, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBRENTRY, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBRBADV, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBRERA, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBRSAVE, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBRELO0, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBRELO1, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBREHI, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_TLBRPRMD, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_MERRCTL, LoongArchCPU),
+VMSTATE_UINT64(env.CSR_MERRINFO1, LoongArchCPU),
+VMSTATE

Re: [PATCH v13 2/7] net/vmnet: add vmnet backends to qapi/net

2022-01-15 Thread Vladislav Yaroshchuk

Hi Akihiko,

Thank you for the review! I will fix the problems and resubmit as v14.

---
Best regards,
Vladislav Yaroshchuk

пт, 14 янв. 2022 г. в 11:43, Akihiko Odaki :

> Hi,
>
> Thank you for fixing the feature availability check.
>
> I decided to just check the series thoroughly before adding Reviewed-By,
> and unfortunately ended up finding minor memory leaks and style
> problems. I'm sorry for adding comments so late.
>
> Particulalry, his patch has several 2-space indents. They should be
> 4-space. Reviews for other patch will shortly follow.
>
> Regards,
> Akihiko Odaki
>
> On 2022/01/14 2:22, Vladislav Yaroshchuk wrote:
> > Create separate netdevs for each vmnet operating mode:
> > - vmnet-host
> > - vmnet-shared
> > - vmnet-bridged
> >
> > Signed-off-by: Vladislav Yaroshchuk 
> > ---
> >   net/clients.h   |  11 
> >   net/meson.build |   7 +++
> >   net/net.c   |  10 
> >   net/vmnet-bridged.m |  25 +
> >   net/vmnet-common.m  |  20 +++
> >   net/vmnet-host.c|  24 
> >   net/vmnet-shared.c  |  25 +
> >   net/vmnet_int.h |  25 +
> >   qapi/net.json   | 133 +++-
> >   9 files changed, 278 insertions(+), 2 deletions(-)
> >   create mode 100644 net/vmnet-bridged.m
> >   create mode 100644 net/vmnet-common.m
> >   create mode 100644 net/vmnet-host.c
> >   create mode 100644 net/vmnet-shared.c
> >   create mode 100644 net/vmnet_int.h
> >
> > diff --git a/net/clients.h b/net/clients.h
> > index 92f9b59aed..c9157789f2 100644
> > --- a/net/clients.h
> > +++ b/net/clients.h
> > @@ -63,4 +63,15 @@ int net_init_vhost_user(const Netdev *netdev, const
> char *name,
> >
> >   int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
> >   NetClientState *peer, Error **errp);
> > +#ifdef CONFIG_VMNET
> > +int net_init_vmnet_host(const Netdev *netdev, const char *name,
> > +  NetClientState *peer, Error **errp);
> > +
> > +int net_init_vmnet_shared(const Netdev *netdev, const char *name,
> > +  NetClientState *peer, Error **errp);
> > +
> > +int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
> > +  NetClientState *peer, Error **errp);
> > +#endif /* CONFIG_VMNET */
> > +
> >   #endif /* QEMU_NET_CLIENTS_H */
> > diff --git a/net/meson.build b/net/meson.build
> > index 847bc2ac85..00a88c4951 100644
> > --- a/net/meson.build
> > +++ b/net/meson.build
> > @@ -42,4 +42,11 @@ softmmu_ss.add(when: 'CONFIG_POSIX', if_true:
> files(tap_posix))
> >   softmmu_ss.add(when: 'CONFIG_WIN32', if_true: files('tap-win32.c'))
> >   softmmu_ss.add(when: 'CONFIG_VHOST_NET_VDPA', if_true:
> files('vhost-vdpa.c'))
> >
> > +vmnet_files = files(
> > +  'vmnet-common.m',
> > +  'vmnet-bridged.m',
> > +  'vmnet-host.c',
> > +  'vmnet-shared.c'
> > +)
> > +softmmu_ss.add(when: vmnet, if_true: vmnet_files)
> >   subdir('can')
> > diff --git a/net/net.c b/net/net.c
> > index f0d14dbfc1..1dbb64b935 100644
> > --- a/net/net.c
> > +++ b/net/net.c
> > @@ -1021,6 +1021,11 @@ static int (* const
> net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
> >   #ifdef CONFIG_L2TPV3
> >   [NET_CLIENT_DRIVER_L2TPV3]= net_init_l2tpv3,
> >   #endif
> > +#ifdef CONFIG_VMNET
> > +[NET_CLIENT_DRIVER_VMNET_HOST] = net_init_vmnet_host,
> > +[NET_CLIENT_DRIVER_VMNET_SHARED] = net_init_vmnet_shared,
> > +[NET_CLIENT_DRIVER_VMNET_BRIDGED] = net_init_vmnet_bridged,
> > +#endif /* CONFIG_VMNET */
> >   };
> >
> >
> > @@ -1106,6 +,11 @@ void show_netdevs(void)
> >   #endif
> >   #ifdef CONFIG_VHOST_VDPA
> >   "vhost-vdpa",
> > +#endif
> > +#ifdef CONFIG_VMNET
> > +"vmnet-host",
> > +"vmnet-shared",
> > +"vmnet-bridged",
> >   #endif
> >   };
> >
> > diff --git a/net/vmnet-bridged.m b/net/vmnet-bridged.m
> > new file mode 100644
> > index 00..4e42a90391
> > --- /dev/null
> > +++ b/net/vmnet-bridged.m
> > @@ -0,0 +1,25 @@
> > +/*
> > + * vmnet-bridged.m
> > + *
> > + * Copyright(c) 2021 Vladislav Yaroshchuk 
> > + *
> > + * This work is licensed under the terms of the GNU GPL, version 2 or
> later.
> > + * See the COPYING file in the top-level directory.
> > + *
> > + */
> > +
> > +#include "qemu/osdep.h"
> > +#include "qapi/qapi-types-net.h"
> > +#include "vmnet_int.h"
> > +#include "clients.h"
> > +#include "qemu/error-report.h"
> > +#include "qapi/error.h"
> > +
> > +#include 
> > +
> > +int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
> > +   NetClientState *peer, Error **errp)
> > +{
> > +  error_setg(errp, "vmnet-bridged is not implemented yet");
> > +  return -1;
> > +}
> > diff --git a/net/vmnet-common.m b/net/vmnet-common.m
> > new file mode 100644
> > index 00..532d152840
> > --- /dev/null
> > +++ b/net/vmnet-common.m
> > @@ -0,0 +1,20 @@
> > +/*
> > + * vmnet-common.m - network client wrapper for Apple vmnet.

Re: [RFC PATCH v4 15/30] hw/loongarch: Add support loongson3-ls7a machine type.


On 08/01/2022 09:14, Xiaojuan Yang wrote:


Emulate a 3A5000 board use the new loongarch instruction.
3A5000 belongs to the Loongson3 series processors.
The board consists of a 3A5000 cpu model and the 7A1000
bridge. The host 3A5000 board is really complicated and
contains many functions.Now for the tcg softmmu mode
only part functions are emulated.

More detailed info you can see
https://github.com/loongson/LoongArch-Documentation

Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
---
  .../devices/loongarch64-softmmu/default.mak   |   3 +
  configs/targets/loongarch64-softmmu.mak   |   3 +
  hw/Kconfig|   1 +
  hw/loongarch/Kconfig  |   3 +
  hw/loongarch/loongson3.c  | 152 ++
  hw/loongarch/meson.build  |   4 +
  hw/meson.build|   1 +
  include/exec/poison.h |   2 +
  include/hw/loongarch/loongarch.h  |  50 ++
  include/sysemu/arch_init.h|   1 +
  qapi/machine.json |   2 +-
  target/Kconfig|   1 +
  target/loongarch/Kconfig  |   2 +
  target/loongarch/cpu.c|   3 +
  target/loongarch/cpu.h|   2 +
  15 files changed, 229 insertions(+), 1 deletion(-)
  create mode 100644 configs/devices/loongarch64-softmmu/default.mak
  create mode 100644 hw/loongarch/Kconfig
  create mode 100644 hw/loongarch/loongson3.c
  create mode 100644 hw/loongarch/meson.build
  create mode 100644 include/hw/loongarch/loongarch.h
  create mode 100644 target/loongarch/Kconfig

diff --git a/configs/devices/loongarch64-softmmu/default.mak 
b/configs/devices/loongarch64-softmmu/default.mak
new file mode 100644
index 00..973ce4c30a
--- /dev/null
+++ b/configs/devices/loongarch64-softmmu/default.mak
@@ -0,0 +1,3 @@
+# Default configuration for loongarch64-softmmu
+
+CONFIG_LOONGSON3_LS7A=y
diff --git a/configs/targets/loongarch64-softmmu.mak 
b/configs/targets/loongarch64-softmmu.mak
index f33fa1590b..7bc06c850c 100644
--- a/configs/targets/loongarch64-softmmu.mak
+++ b/configs/targets/loongarch64-softmmu.mak
@@ -1 +1,4 @@
+TARGET_ARCH=loongarch64
+TARGET_BASE_ARCH=loongarch
+TARGET_SUPPORTS_MTTCG=y
  TARGET_XML_FILES= gdb-xml/loongarch-base64.xml gdb-xml/loongarch-fpu64.xml
diff --git a/hw/Kconfig b/hw/Kconfig
index ad20cce0a9..f71b2155ed 100644
--- a/hw/Kconfig
+++ b/hw/Kconfig
@@ -49,6 +49,7 @@ source avr/Kconfig
  source cris/Kconfig
  source hppa/Kconfig
  source i386/Kconfig
+source loongarch/Kconfig
  source m68k/Kconfig
  source microblaze/Kconfig
  source mips/Kconfig
diff --git a/hw/loongarch/Kconfig b/hw/loongarch/Kconfig
new file mode 100644
index 00..ae8498de6a
--- /dev/null
+++ b/hw/loongarch/Kconfig
@@ -0,0 +1,3 @@
+config LOONGSON3_LS7A
+bool
+select PCI_EXPRESS_7A
diff --git a/hw/loongarch/loongson3.c b/hw/loongarch/loongson3.c
new file mode 100644
index 00..3e72c1666c
--- /dev/null
+++ b/hw/loongarch/loongson3.c
@@ -0,0 +1,152 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU loongson 3a5000 develop board emulation
+ *
+ * Copyright (c) 2021 Loongson Technology Corporation Limited
+ */
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qemu/units.h"
+#include "qemu/datadir.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/qtest.h"
+#include "sysemu/runstate.h"
+#include "sysemu/reset.h"
+#include "hw/loongarch/loongarch.h"
+#include "hw/pci-host/ls7a.h"
+
+static void loongarch_cpu_reset(void *opaque)
+{
+LoongArchCPU *cpu = opaque;
+
+cpu_reset(CPU(cpu));
+}
+
+#define LOONGARCH_SIMPLE_MMIO_OPS(ADDR, NAME, SIZE, INDEX) \
+({\
+ memory_region_init_io(env->iocsr_mem[INDEX], NULL, &loongarch_qemu_ops,\
+   (void *)ADDR, NAME, SIZE);\


The second parameter to memory_region_init_io() should be the name of the owning 
device if possible, which I believe here is the CPU (LoongArchCPU).



+ memory_region_add_subregion(env->system_iocsr, ADDR, 
env->iocsr_mem[INDEX]);\
+})
+
+static void loongarch_qemu_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+}
+
+static uint64_t loongarch_qemu_read(void *opaque, hwaddr addr, unsigned size)
+{
+uint64_t feature = 0UL;
+addr = ((hwaddr)(long)opaque) + addr;


This looks odd...


+switch (addr) {
+case FEATURE_REG:
+feature |= 1UL << IOCSRF_MSI | 1UL << IOCSRF_EXTIOI |
+   1UL << IOCSRF_CSRIPI;
+return feature ;
+case VENDOR_REG:
+return *(uint64_t *)"Loongson";
+case CPUNAME_REG:
+return *(uint64_t *)"3A5000";
+case MISC_FUNC_REG:
+return 1UL << IOCSRM_EXTIOI_EN;
+}
+return 0;
+}
+
+static const MemoryRegionOps loongarch_qemu_ops = {
+.read = loongarch_qemu_rea

Re: [RFC PATCH v4 18/30] hw/intc: Add LoongArch ls7a interrupt controller support(PCH-PIC)


On 08/01/2022 09:14, Xiaojuan Yang wrote:

This patch realize the PCH-PIC interrupt controller.

Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
---
  hw/intc/Kconfig |   4 +
  hw/intc/loongarch_pch_pic.c | 428 
  hw/intc/meson.build |   1 +
  hw/intc/trace-events|   7 +
  hw/loongarch/Kconfig|   1 +
  include/hw/intc/loongarch_pch_pic.h |  74 +
  6 files changed, 515 insertions(+)
  create mode 100644 hw/intc/loongarch_pch_pic.c
  create mode 100644 include/hw/intc/loongarch_pch_pic.h

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index 9f5aaffb6f..928db92bb4 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -81,3 +81,7 @@ config M68K_IRQC
  
  config LOONGARCH_IPI

  bool
+
+config LOONGARCH_PCH_PIC
+bool
+select UNIMP
diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
new file mode 100644
index 00..4da78b5bc8
--- /dev/null
+++ b/hw/intc/loongarch_pch_pic.c
@@ -0,0 +1,428 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU Loongson 7A1000 I/O interrupt controller.
+ *
+ * Copyright (C) 2021 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/loongarch/loongarch.h"
+#include "hw/irq.h"
+#include "hw/intc/loongarch_pch_pic.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+static void pch_pic_update_irq(LoongArchPCHPIC *s, uint32_t mask,
+   int level, int hi)
+{
+uint32_t val, irq;
+
+if (level == 1) {
+if (hi) {
+val = mask & s->intirr_hi & (~s->int_mask_hi);
+irq = find_first_bit((void *)&val, 32);
+if (irq != 32) {
+s->intisr_hi |= 1ULL << irq;
+qemu_set_irq(s->parent_irq[s->htmsi_vector[irq + 32]], 1);
+}
+} else {
+val = mask & s->intirr_lo & (~s->int_mask_lo);
+irq = find_first_bit((void *)&val, 32);
+if (irq != 32) {
+s->intisr_lo |= 1ULL << irq;
+qemu_set_irq(s->parent_irq[s->htmsi_vector[irq]], 1);
+}
+}
+} else {
+if (hi) {
+val = mask & s->intisr_hi;
+irq = find_first_bit((void *)&val, 32);
+if (irq != 32) {
+s->intisr_hi &= ~(0x1ULL << irq);
+qemu_set_irq(s->parent_irq[s->htmsi_vector[irq + 32]], 0);
+}
+} else {
+val = mask & s->intisr_lo;
+irq = find_first_bit((void *)&val, 32);
+if (irq != 32) {
+s->intisr_lo &= ~(0x1ULL << irq);
+qemu_set_irq(s->parent_irq[s->htmsi_vector[irq]], 0);
+}
+}
+}
+}
+
+static void pch_pic_irq_handler(void *opaque, int irq, int level)
+{
+LoongArchPCHPIC *s = LOONGARCH_PCH_PIC(opaque);
+int hi = 0;
+uint32_t mask;
+
+assert(irq < PCH_PIC_IRQ_NUM);
+trace_pch_pic_irq_handler(irq, level);
+
+hi = (irq >= 32) ? 1 : 0;
+if (hi) {
+irq = irq - 32;
+}
+
+mask = 1ULL << irq;
+
+if (hi) {
+if (s->intedge_hi & mask) {
+/* Edge triggered */
+if (level) {
+if ((s->last_intirr_hi & mask) == 0) {
+s->intirr_hi |= mask;
+}
+s->last_intirr_hi |= mask;
+} else {
+s->last_intirr_hi &= ~mask;
+}
+} else {
+/* Level triggered */
+if (level) {
+s->intirr_hi |= mask;
+s->last_intirr_hi |= mask;
+} else {
+s->intirr_hi &= ~mask;
+s->last_intirr_hi &= ~mask;
+}
+}
+} else {
+if (s->intedge_lo & mask) {
+/* Edge triggered */
+if (level) {
+if ((s->last_intirr_lo & mask) == 0) {
+s->intirr_lo |= mask;
+}
+s->last_intirr_lo |= mask;
+} else {
+s->last_intirr_lo &= ~mask;
+}
+} else {
+/* Level triggered */
+if (level) {
+s->intirr_lo |= mask;
+s->last_intirr_lo |= mask;
+} else {
+s->intirr_lo &= ~mask;
+s->last_intirr_lo &= ~mask;
+}
+
+}
+}
+pch_pic_update_irq(s, mask, level, hi);
+}
+
+static uint64_t loongarch_pch_pic_readw(void *opaque, hwaddr addr,
+unsigned size)
+{
+LoongArchPCHPIC *s = LOONGARCH_PCH_PIC(opaque);
+uint64_t val = 0;
+uint32_t offset = addr & 0xfff;
+
+switch (offset) {
+case PCH_PIC_INT_ID_LO:
+val = PCH_PIC_INT_ID_VAL;
+break;
+case PCH_PIC_INT_ID_HI:
+val = PCH_PIC_INT_ID_NUM;
+break;
+case PCH_PIC_INT_MASK_LO:
+val = s->int_mask_lo;

Re: [RFC PATCH v4 20/30] hw/intc: Add LoongArch extioi interrupt controller(EIOINTC)


On 08/01/2022 09:14, Xiaojuan Yang wrote:


This patch realize the EIOINTC interrupt controller.

Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
---
  hw/intc/Kconfig|   3 +
  hw/intc/loongarch_extioi.c | 376 +
  hw/intc/meson.build|   1 +
  hw/intc/trace-events   |  11 +
  hw/loongarch/Kconfig   |   1 +
  include/hw/intc/loongarch_extioi.h |  69 ++
  6 files changed, 461 insertions(+)
  create mode 100644 hw/intc/loongarch_extioi.c
  create mode 100644 include/hw/intc/loongarch_extioi.h

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index 727a3bb3e6..ecdf821205 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -90,3 +90,6 @@ config LOONGARCH_PCH_MSI
  select MSI_NONBROKEN
  bool
  select UNIMP
+
+config LOONGARCH_EXTIOI
+bool
diff --git a/hw/intc/loongarch_extioi.c b/hw/intc/loongarch_extioi.c
new file mode 100644
index 00..b9a91f77b3
--- /dev/null
+++ b/hw/intc/loongarch_extioi.c
@@ -0,0 +1,376 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Loongson 3A5000 ext interrupt controller emulation
+ *
+ * Copyright (C) 2021 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/sysbus.h"
+#include "hw/loongarch/loongarch.h"
+#include "hw/qdev-properties.h"
+#include "exec/address-spaces.h"
+#include "hw/intc/loongarch_extioi.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+static void extioi_update_irq(void *opaque, int irq_num, int level)
+{
+LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
+uint8_t  ipnum, cpu;
+unsigned long found1, found2;
+
+ipnum = s->sw_ipmap[irq_num];
+cpu   = s->sw_coremap[irq_num];
+if (level == 1) {
+if (test_bit(irq_num, (void *)s->enable) == false) {
+return;
+}
+bitmap_set((void *)s->coreisr[cpu], irq_num, 1);
+found1 = find_next_bit((void *)&(s->sw_ipisr[cpu][ipnum]),
+   EXTIOI_IRQS, 0);
+bitmap_set((void *)&(s->sw_ipisr[cpu][ipnum]), irq_num, 1);
+
+if (found1 >= EXTIOI_IRQS) {
+qemu_set_irq(s->parent_irq[cpu][ipnum], level);
+}
+} else {
+bitmap_clear((void *)s->coreisr[cpu], irq_num, 1);
+found1 = find_next_bit((void *)&(s->sw_ipisr[cpu][ipnum]),
+   EXTIOI_IRQS, 0);
+bitmap_clear((void *)&(s->sw_ipisr[cpu][ipnum]), irq_num, 1);
+found2 = find_next_bit((void *)&(s->sw_ipisr[cpu][ipnum]),
+   EXTIOI_IRQS, 0);
+
+if ((found1 < EXTIOI_IRQS) && (found2 >= EXTIOI_IRQS)) {
+qemu_set_irq(s->parent_irq[cpu][ipnum], level);
+}
+}
+}
+
+static void extioi_setirq(void *opaque, int irq, int level)
+{
+LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
+trace_extioi_setirq(irq, level);
+extioi_update_irq(s, irq, level);
+}
+
+static uint64_t extioi_readw(void *opaque, hwaddr addr, unsigned size)
+{
+LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
+unsigned long offset = addr & 0x;
+uint32_t ret, index;
+int cpu;
+
+if ((offset >= EXTIOI_NODETYPE_START) && (offset < EXTIOI_NODETYPE_END)) {
+index = (offset - EXTIOI_NODETYPE_START) >> 2;
+ret = s->nodetype[index];
+} else if ((offset >= EXTIOI_BOUNCE_START) &&
+   (offset < EXTIOI_BOUNCE_END)) {
+index = (offset - EXTIOI_BOUNCE_START) >> 2;
+ret = s->bounce[index];
+} else if ((offset >= EXTIOI_COREISR_START) &&
+   (offset < EXTIOI_COREISR_END)) {
+index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
+cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
+ret = s->coreisr[cpu][index];
+}


Please can you use a switch() statement here?


+trace_loongarch_extioi_readw((uint32_t)addr, ret);
+return ret;
+}
+
+static void extioi_writew(void *opaque, hwaddr addr,
+   uint64_t val, unsigned size)
+{
+LoongArchExtIOI *s = LOONGARCH_EXTIOI(opaque);
+int cpu, index;
+uint32_t offset, old_data, i, j, bits;
+
+offset = addr & 0x;
+trace_loongarch_extioi_writew(size, (uint32_t)addr, val);
+
+if ((offset >= EXTIOI_NODETYPE_START) && (offset < EXTIOI_NODETYPE_END)) {
+index = (offset - EXTIOI_NODETYPE_START) >> 2;
+s->nodetype[index] = val;
+} else if ((offset >= EXTIOI_BOUNCE_START) &&
+   (offset < EXTIOI_BOUNCE_END)) {
+index = (offset - EXTIOI_BOUNCE_START) >> 2;
+s->bounce[index] = val;
+} else if ((offset >= EXTIOI_COREISR_START) &&
+   (offset < EXTIOI_COREISR_END)) {
+index = ((offset - EXTIOI_COREISR_START) & 0x1f) >> 2;
+cpu = ((offset - EXTIOI_COREISR_START) >> 8) & 0x3;
+
+/* Ext_core_ioisr */
+old_data = s->coreisr[cpu][index];
+s->coreisr[cpu][index] =

Re: [RFC PATCH v4 21/30] hw/loongarch: Add irq hierarchy for the system


On 08/01/2022 09:14, Xiaojuan Yang wrote:


This patch add the irq hierarchy for the virt board.

Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
---
  hw/loongarch/loongson3.c   | 85 ++
  include/hw/pci-host/ls7a.h | 13 ++
  2 files changed, 98 insertions(+)

diff --git a/hw/loongarch/loongson3.c b/hw/loongarch/loongson3.c
index 6e796c2c08..cc7ee02003 100644
--- a/hw/loongarch/loongson3.c
+++ b/hw/loongarch/loongson3.c
@@ -15,6 +15,10 @@
  #include "sysemu/runstate.h"
  #include "sysemu/reset.h"
  #include "hw/loongarch/loongarch.h"
+#include "hw/intc/loongarch_ipi.h"
+#include "hw/intc/loongarch_extioi.h"
+#include "hw/intc/loongarch_pch_pic.h"
+#include "hw/intc/loongarch_pch_msi.h"
  #include "hw/pci-host/ls7a.h"
  
  static void loongarch_cpu_reset(void *opaque)

@@ -93,6 +97,84 @@ static void loongarch_cpu_set_irq(void *opaque, int irq, int 
level)
  }
  }
  
+static void loongarch_irq_init(LoongArchMachineState *lams)

+{
+MachineState *ms = MACHINE(lams);
+DeviceState *ipi, *extioi, *pch_pic, *pch_msi, *cpudev;
+SysBusDevice *d;
+int cpu, pin, i;
+unsigned long ipi_addr;
+CPULoongArchState *env;
+
+ipi = qdev_new(TYPE_LOONGARCH_IPI);
+d = SYS_BUS_DEVICE(ipi);
+sysbus_realize_and_unref(d, &error_fatal);
+for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
+cpudev = DEVICE(qemu_get_cpu(cpu));
+env = (qemu_get_cpu(cpu))->env_ptr;
+ipi_addr = SMP_IPI_MAILBOX + cpu * 0x100;
+memory_region_add_subregion(env->system_iocsr, ipi_addr,
+sysbus_mmio_get_region(d, cpu));
+/* connect ipi irq to cpu irq */
+qdev_connect_gpio_out(ipi, cpu, qdev_get_gpio_in(cpudev, IRQ_IPI));
+}
+
+extioi = qdev_new(TYPE_LOONGARCH_EXTIOI);
+d = SYS_BUS_DEVICE(extioi);
+sysbus_realize_and_unref(d, &error_fatal);
+for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
+env = (qemu_get_cpu(cpu))->env_ptr;
+memory_region_add_subregion(env->system_iocsr, APIC_BASE,
+sysbus_mmio_get_region(d, cpu * 4));
+memory_region_add_subregion_overlap(env->system_iocsr, ENABLE_OFFSET,
+sysbus_mmio_get_region(d, cpu * 4 
+ 1), 1);
+memory_region_add_subregion_overlap(env->system_iocsr, IPMAP_OFFSET,
+sysbus_mmio_get_region(d, cpu * 4 
+ 2), 1);
+memory_region_add_subregion_overlap(env->system_iocsr, COREMAP_OFFSET,
+sysbus_mmio_get_region(d, cpu * 4 
+ 3), 1);


This _overlap() doesn't look right: since all of these regions are contained within 
env->system_iocsr then I'd expect to see just the top memory_region_add_subregion() 
map env->system_iocsr into the CPU space.


Possibly I've misunderstood something about how these registers appear since I had a 
similar question earlier.



+}
+
+for (i = 0; i < EXTIOI_IRQS; i++) {
+sysbus_connect_irq(d, i, qdev_get_gpio_in(extioi, i));
+}
+
+/*
+ * connect ext irq to the cpu irq
+ * cpu_pin[9:2] <= intc_pin[7:0]
+ */
+for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
+cpudev = DEVICE(qemu_get_cpu(cpu));
+for (pin = 0; pin < LS3A_INTC_IP; pin++) {
+qdev_connect_gpio_out(extioi, (cpu * 8 + pin),
+  qdev_get_gpio_in(cpudev, pin + 2));
+}
+}
+
+pch_pic = qdev_new(TYPE_LOONGARCH_PCH_PIC);
+d = SYS_BUS_DEVICE(pch_pic);
+sysbus_realize_and_unref(d, &error_fatal);
+memory_region_add_subregion(get_system_memory(), LS7A_IOAPIC_REG_BASE,
+sysbus_mmio_get_region(d, 0));
+memory_region_add_subregion_overlap(get_system_memory(),
+LS7A_IOAPIC_REG_BASE + 
PCH_PIC_ROUTE_ENTRY_OFFSET,
+sysbus_mmio_get_region(d, 1), 1);


And also here - I can't quite understand what is happening here. Perhaps you could 
supply the output of "info mtree" highlighting the relevant entries here and above?



+/* Connect 64 pch_pic irqs to extioi */
+for (int i = 0; i < PCH_PIC_IRQ_NUM; i++) {
+sysbus_connect_irq(d, i, qdev_get_gpio_in(extioi, i));
+}
+
+pch_msi = qdev_new(TYPE_LOONGARCH_PCH_MSI);
+d = SYS_BUS_DEVICE(pch_msi);
+sysbus_realize_and_unref(d, &error_fatal);
+sysbus_mmio_map(d, 0, LS7A_PCH_MSI_ADDR_LOW);
+for (i = 0; i < PCH_MSI_IRQ_NUM; i++) {
+/* Connect 192 pch_msi irqs to extioi */
+sysbus_connect_irq(d, i,
+   qdev_get_gpio_in(extioi, i + PCH_MSI_IRQ_START));
+}
+}
+
  static void loongarch_init(MachineState *machine)
  {
  const char *cpu_model = machine->cpu_type;
@@ -145,6 +227,9 @@ static void loongarch_init(MachineState *machine)
   get_system_io(), 0, LOONGARCH_ISA_IO_SIZE);
  memory_region_add

Re: [RFC PATCH v3 22/27] hw/loongarch: Add some devices support for 3A5000.


On 10/01/2022 02:26, yangxiaojuan wrote:


Hi, Mark

On 12/23/2021 06:52 PM, Mark Cave-Ayland wrote:

On 22/12/2021 08:26, yangxiaojuan wrote:


Hi, Mark

On 12/18/2021 06:02 PM, Mark Cave-Ayland wrote:

On 04/12/2021 12:07, Xiaojuan Yang wrote:


1.Add uart,virtio-net,vga and usb for 3A5000.
2.Add irq set and map for the pci host. Non pci device
use irq 0-16, pci device use 16-64.
3.Add some unimplented device to emulate guest unused
memory space.

Signed-off-by: Xiaojuan Yang 
Signed-off-by: Song Gao 
---
hw/loongarch/Kconfig|  8 +
hw/loongarch/loongson3.c| 63 +++--
hw/pci-host/ls7a.c  | 42 +-
include/hw/intc/loongarch_ipi.h |  2 ++
include/hw/pci-host/ls7a.h  |  4 +++
softmmu/qdev-monitor.c  |  3 +-
6 files changed, 117 insertions(+), 5 deletions(-)

diff --git a/hw/loongarch/Kconfig b/hw/loongarch/Kconfig
index 468e3acc74..9ea3b92708 100644
--- a/hw/loongarch/Kconfig
+++ b/hw/loongarch/Kconfig
@@ -1,5 +1,13 @@
config LOONGSON3_LS7A
bool
+imply VGA_PCI
+imply VIRTIO_VGA
+imply PARALLEL
+imply PCI_DEVICES
+select ISA_BUS
+select SERIAL
+select SERIAL_ISA
+select VIRTIO_PCI
select PCI_EXPRESS_7A
select LOONGARCH_IPI
select LOONGARCH_PCH_PIC
diff --git a/hw/loongarch/loongson3.c b/hw/loongarch/loongson3.c
index c42f830208..e4a02e7c18 100644
--- a/hw/loongarch/loongson3.c
+++ b/hw/loongarch/loongson3.c
@@ -10,8 +10,11 @@
#include "qemu/datadir.h"
#include "qapi/error.h"
#include "hw/boards.h"
+#include "hw/char/serial.h"
#include "sysemu/sysemu.h"
#include "sysemu/qtest.h"
+#include "hw/irq.h"
+#include "net/net.h"
#include "sysemu/runstate.h"
#include "sysemu/reset.h"
#include "hw/loongarch/loongarch.h"
@@ -20,6 +23,7 @@
#include "hw/intc/loongarch_pch_pic.h"
#include "hw/intc/loongarch_pch_msi.h"
#include "hw/pci-host/ls7a.h"
+#include "hw/misc/unimp.h"
static void loongarch_cpu_reset(void *opaque)
@@ -91,11 +95,12 @@ static void sysbus_mmio_map_loongarch(SysBusDevice *dev, 
int n,
memory_region_add_subregion(iocsr, addr, dev->mmio[n].memory);
}
-static void loongson3_irq_init(MachineState *machine)
+static PCIBus *loongson3_irq_init(MachineState *machine)
{
LoongArchMachineState *lams = LOONGARCH_MACHINE(machine);
-DeviceState *ipi, *extioi, *pch_pic, *pch_msi, *cpudev;
+DeviceState *ipi, *extioi, *pch_pic, *pch_msi, *cpudev, *pciehost;
SysBusDevice *d;
+PCIBus *pci_bus;
int cpu, pin, i;
unsigned long ipi_addr;
@@ -135,6 +140,10 @@ static void loongson3_irq_init(MachineState *machine)
sysbus_realize_and_unref(d, &error_fatal);
sysbus_mmio_map(d, 0, LS7A_IOAPIC_REG_BASE);
+serial_mm_init(get_system_memory(), LS7A_UART_BASE, 0,
+   qdev_get_gpio_in(pch_pic, LS7A_UART_IRQ - 
PCH_PIC_IRQ_OFFSET),
+   115200, serial_hd(0), DEVICE_LITTLE_ENDIAN);
+
/* Connect 64 pch_pic irqs to extioi */
for (int i = 0; i < PCH_PIC_IRQ_NUM; i++) {
sysbus_connect_irq(d, i, qdev_get_gpio_in(extioi, i));
@@ -149,6 +158,35 @@ static void loongson3_irq_init(MachineState *machine)
sysbus_connect_irq(d, i,
   qdev_get_gpio_in(extioi, i + PCH_MSI_IRQ_START));
}
+
+pciehost = qdev_new(TYPE_LS7A_HOST_DEVICE);
+d = SYS_BUS_DEVICE(pciehost);
+sysbus_realize_and_unref(d, &error_fatal);
+pci_bus = PCI_HOST_BRIDGE(pciehost)->bus;
+
+/* Connect 48 pci irq to pch_pic */
+for (i = 0; i < LS7A_PCI_IRQS; i++) {
+qdev_connect_gpio_out(pciehost, i,
+  qdev_get_gpio_in(pch_pic, i + LS7A_DEVICE_IRQS));
+}
+
+return pci_bus;
+}
+
+/* Network support */
+static void network_init(PCIBus *pci_bus)
+{
+int i;
+
+for (i = 0; i < nb_nics; i++) {
+NICInfo *nd = &nd_table[i];
+
+if (!nd->model) {
+nd->model = g_strdup("virtio");
+}
+
+pci_nic_init_nofail(nd, pci_bus, nd->model, NULL);
+}
}
  static void loongson3_init(MachineState *machine)
@@ -161,6 +199,7 @@ static void loongson3_init(MachineState *machine)
MemoryRegion *address_space_mem = get_system_memory();
LoongArchMachineState *lams = LOONGARCH_MACHINE(machine);
int i;
+PCIBus *pci_bus = NULL;
  if (!cpu_model) {
cpu_model = LOONGARCH_CPU_TYPE_NAME("Loongson-3A5000");
@@ -207,8 +246,26 @@ static void loongson3_init(MachineState *machine)
memory_region_add_subregion(address_space_mem, 0x9000, 
&lams->highmem);
offset += highram_size;
+/*
+ * There are some invalid guest memory access.
+ * Create some unimplemented devices to emulate this.
+ */
+create_unimplemented_device("ls7a-lpc", 0x10002000, 0x14);
+create_unimplemented_device("pci-dma-cf

Re: [RFC PATCH v3 22/27] hw/loongarch: Add some devices support for 3A5000.


On 12/01/2022 09:37, maobibo wrote:


Isn't this part already handled by the code in hw/pci/pci.c when the IRQ is 
asserted, for example pci_change_irq_level()?


We design a different rule for the pcie devices connect to the root bridge, 
assign more irqs to these devices.
For the pci device connect to a pcie-to-pci bridge use the common 
pci_swizzle_map_irq_fn to map irq.


I'm less familiar with PCIe but shouldn't the interrupt mapping for devices 
connected via a pcie-to-pci bridge be handled by the bridge in this case? Have 
a look at pci_bridge_map_irq() to see how this is used. I'd expect the 
pcie-to-pci bridge to map the PCI irq to your host controller irq first before 
calling pci_ls7a_map_irq(), which I think then becomes just a simple call to 
pci_swizzle_map_irq_fn()?


Oh, we will remove these lines. Our original thoughts is that irq-lines of
root bridge is connected with irq controller, so root bridge can have more than
4 irq-lines, non root-bridge has 4 irq-lines at most.


From the code it is only treated as pcie root bridge, and its parent_dev is NULL

always. and we can simply add these sentences such as:
 /* pci device start from irq 80 */
 offset = PCH_PIC_IRQ_OFFSET + LS7A_DEVICE_IRQS;
 irq = offset + ((PCI_SLOT(d->devfn) * 4 + irq_num)) % LS7A_PCI_IRQS;

 return irq;


Right, that makes more sense to me. Generally root bridges are different enough from 
downstream bridges to be modelled as a separate device (often with a slightly 
different product id), so if you can remove the parent_dev check and use the above 
that works for me.



ATB,

Mark.

Re: [RFC PATCH v4 00/30] Add LoongArch softmmu support.


On 08/01/2022 09:13, Xiaojuan Yang wrote:


This series patch add softmmu support for LoongArch.
Base on the linux-user emulation support V14 patch.
   * https://patchew.org/QEMU/20220106094200.1801206-1-gaos...@loongson.cn/
The latest kernel:
   * https://github.com/loongson/linux/tree/loongarch-next
The latest uefi:
   * https://github.com/loongson/edk2
   * https://github.com/loongson/edk2-platforms
The manual:
   * https://github.com/loongson/LoongArch-Documentation/releases/tag/2021.10.11


Changes for v4:
1. Uefi code is open and add some fdt interface to pass info between qemu and 
uefi.
2. Use a per cpu address space for iocsr.
3. Modify the tlb emulation.
4. Machine and board code mainly follow Mark's advice.
5. Adjust pci host space map.
6. Use more memregion to simplify the interrupt controller's emulate.


Changes for v3:
1.Target code mainly follow Richard's code review comments.
2.Put the csr and iocsr read/write instruction emulate into 2 different patch.
3.Simply the tlb emulation.
4.Delete some unused csr registers defintion.
5.Machine and board code mainly follow Mark's advice, discard the obsolete 
interface.
6.NUMA function is removed for it is not completed.
7.Adjust some format problem and the Naming problem


Changes for v2:
1.Combine patch 2 and 3 into one.
2.Adjust the order of the patch.
3.Put all the binaries on the github.
4.Modify some emulate errors when use the kernel from the github.
5.Adjust some format problem and the Naming problem
6.Others mainly follow Richard's code review comments.

Please help review!

Thanks

Xiaojuan Yang (30):
   target/loongarch: Update README
   target/loongarch: Add CSR registers definition
   target/loongarch: Add basic vmstate description of CPU.
   target/loongarch: Implement qmp_query_cpu_definitions()
   target/loongarch: Add constant timer support
   target/loongarch: Add MMU support for LoongArch CPU.
   target/loongarch: Add LoongArch CSR instruction
   target/loongarch: Add LoongArch IOCSR instruction
   target/loongarch: Add TLB instruction support
   target/loongarch: Add other core instructions support
   target/loongarch: Add LoongArch interrupt and exception handle
   target/loongarch: Add timer related instructions support.
   target/loongarch: Add gdb support.
   hw/pci-host: Add ls7a1000 PCIe Host bridge support for Loongson3
 Platform
   hw/loongarch: Add support loongson3-ls7a machine type.
   hw/loongarch: Add LoongArch cpu interrupt support(CPUINTC)
   hw/loongarch: Add LoongArch ipi interrupt support(IPI)
   hw/intc: Add LoongArch ls7a interrupt controller support(PCH-PIC)
   hw/intc: Add LoongArch ls7a msi interrupt controller support(PCH-MSI)
   hw/intc: Add LoongArch extioi interrupt controller(EIOINTC)
   hw/loongarch: Add irq hierarchy for the system
   Enable common virtio pci support for LoongArch
   hw/loongarch: Add some devices support for 3A5000.
   hw/loongarch: Add LoongArch ls7a rtc device support
   hw/loongarch: Add default bios startup support.
   hw/loongarch: Add -kernel and -initrd options support
   hw/loongarch: Add LoongArch smbios support
   hw/loongarch: Add LoongArch acpi support
   hw/loongarch: Add fdt support.
   tests/tcg/loongarch64: Add hello/memory test in loongarch64 system

  .../devices/loongarch64-softmmu/default.mak   |   3 +
  configs/targets/loongarch64-softmmu.mak   |   4 +
  gdb-xml/loongarch-base64.xml  |  43 +
  gdb-xml/loongarch-fpu64.xml   |  57 ++
  hw/Kconfig|   1 +
  hw/acpi/Kconfig   |   4 +
  hw/acpi/ls7a.c| 374 +
  hw/acpi/meson.build   |   1 +
  hw/intc/Kconfig   |  15 +
  hw/intc/loongarch_extioi.c| 376 +
  hw/intc/loongarch_ipi.c   | 164 
  hw/intc/loongarch_pch_msi.c   |  75 ++
  hw/intc/loongarch_pch_pic.c   | 428 ++
  hw/intc/meson.build   |   4 +
  hw/intc/trace-events  |  25 +
  hw/loongarch/Kconfig  |  22 +
  hw/loongarch/acpi-build.c | 636 ++
  hw/loongarch/fw_cfg.c |  33 +
  hw/loongarch/fw_cfg.h |  15 +
  hw/loongarch/loongson3.c  | 685 +++
  hw/loongarch/meson.build  |   6 +
  hw/meson.build|   1 +
  hw/pci-host/Kconfig   |   4 +
  hw/pci-host/ls7a.c| 218 +
  hw/pci-host/meson.build   |   1 +
  hw/rtc/Kconfig|   3 +
  hw/rtc/ls7a_rtc.c | 322 
  hw/rtc/meson.build|   1 +
  include/exec/poison.h |   2 +
  include/hw/acpi/ls7a.h|

Re: [PATCH qemu] spapr: Force 32bit when resetting a core


On 14/01/2022 14:12, Cédric Le Goater wrote:


Yes, more info here :

https://patchwork.kernel.org/project/qemu-devel/patch/1458121432-2855-1-git-send-email-lviv...@redhat.com/ 


mac99+970 only boots with a 64bit kernel. 32bit are not supported because
of the use of the rfi instruction which was removed in v2.01. 32bit user
space is supported though.

However I was not able to build a disk with a compatible boot partition
for OpenBIOS. The above support only applies for kernel loaded in memory.
May be Mark knows how to do this ?


The Mac machines generally require a HFS filesystem for booting with OpenBIOS: it's a 
bit convoluted, but some instructions for grub can be found at 
https://wiki.gentoo.org/wiki/GRUB_on_Open_Firmware_(PowerPC).


I can certainly help out if you get stuck. If this is a more obscure combination then 
is it worth adding a tiny image for use with avocado?



ATB,

Mark.

Re: [PATCH 0/2] Introduce printer subsystem and USB printer device

2022-01-15 Thread Ruien Zhang


On 1/14/22 5:32 PM, Gerd Hoffmann wrote:

   Hi,


This patchset introduces:

1) Skeleton of QEMU printer subsystem with a dummy builtin driver.

2) USB printer device emulation, with definitions in the extension of IPP-over-
USB [3].

WIP:

1) QEMU printer subsystem interfaces, which will be finalized with a concrete
backend driver.

2) IPP-over-USB implementation.


Hmm, I'm wondering what uses cases you have in mind and whenever
it makes sense to introduce a printer subsystem?


I'm having an idea about the use case, let's discuss a bit more about it 
here.


If I want to expose some Virtual Device Interfaces (VDI) on USB-IPP 
printer device to remote desktop service like spice-server, is it 
rational to register these interfaces to the printer subsystem which 
will play as a middle layer? A concrete example is QXL virtual GPU with 
VDI between QEMU and spice-server. What if other QEMU-emulated devices 
also want to take part in the spice service routine? This can be 
achieved naturally by the registered handlers in the subsystems, which 
further exchange data with the underlying devices (USB-IPP printer here, 
for example). Nevertheless, I totally agree that it is straightforward 
to make devices like USB-IPP printer to be passed-through in local 
environments, which prompts me to add the uri-option. But I want it to 
be compatible with other use cases, like this one.


I'll give this idea a try.



Having an ipp-over-usb device looks useful, but the only use case I can
see is to allow guests access a network printer.  I can't see the
benefits of a printer subsystem, especially in a world where non-ipp
printers are going extinct.  We would most likely have just a single
kind of printer backend, where the only job qemu will have is to
forwarding requests and replies, maybe with some http header rewriting.

Likewise usb would be the one and only device (parallel ports are long
gone in printers).  So the indirection added by a printer subsystem
doesn't buy us anything because we just don't need that flexibility.
I'd suggest to pass the url directly to the device instead:

qemu -device usb-ipp-printer,url=ipp://hostname/ipp/printer

take care,
   Gerd


Regards,
Ruien

Re: [PATCH 6/6] tests/qtest/libqos: Add pci-arm and add a pci-arm producer in arm-virt machine


On 1/10/22 22:19, Eric Auger wrote:

Up to now the virt-machine node contains a virtio-mmio node.
However no driver produces any PCI interface node. Hence, PCI
tests cannot be run with aarch64 binary.

Add a GPEX driver node that produces a pci interface node. This latter
then can be consumed by all the pci tests. One of the first motivation
was to be able to run the virtio-iommu-pci tests.

We still face an issue with pci hotplug tests as hotplug cannot happen
on the pcie root bus and require a generic root port. This will be
addressed later on.

Signed-off-by: Eric Auger 


Hey Eric,

it's great to have gpex support in libqos/qgraph!  On the next versions 
you might also Cc Emanuele since he was the author of the framework.



---
  tests/qtest/libqos/arm-virt-machine.c |  47 +-
  tests/qtest/libqos/meson.build|   3 +
  tests/qtest/libqos/pci-arm.c  | 219 ++
  tests/qtest/libqos/pci-arm.h  |  56 +++
  tests/qtest/libqos/pci.h  |   1 +
  tests/qtest/libqos/qgraph.c   |   7 +
  tests/qtest/libqos/qgraph.h   |  15 ++
  7 files changed, 344 insertions(+), 4 deletions(-)
  create mode 100644 tests/qtest/libqos/pci-arm.c
  create mode 100644 tests/qtest/libqos/pci-arm.h

diff --git a/tests/qtest/libqos/arm-virt-machine.c 
b/tests/qtest/libqos/arm-virt-machine.c
index e0f59322845..130c45c51e2 100644
--- a/tests/qtest/libqos/arm-virt-machine.c
+++ b/tests/qtest/libqos/arm-virt-machine.c
@@ -22,6 +22,8 @@
  #include "malloc.h"
  #include "qgraph.h"
  #include "virtio-mmio.h"
+#include "pci-arm.h"
+#include "hw/pci/pci_regs.h"
  
  #define ARM_PAGE_SIZE   4096

  #define VIRTIO_MMIO_BASE_ADDR   0x0A003E00
@@ -30,13 +32,40 @@
  #define VIRTIO_MMIO_SIZE0x0200
  
  typedef struct QVirtMachine QVirtMachine;

+typedef struct QGenericPCIHost QGenericPCIHost;
+
+struct QGenericPCIHost {
+QOSGraphObject obj;
+QPCIBusARM pci;
+};


You can rename QPCIBusARM to QGenericPCIBus and move QGenericPCIHost to 
the same file.  There's nothing ARM specific in either file, and nothing 
specific to -M virt in QGenericPCIHost.



  struct QVirtMachine {
  QOSGraphObject obj;
  QGuestAllocator alloc;
  QVirtioMMIODevice virtio_mmio;
+QGenericPCIHost bridge;
  };
  
+/* QGenericPCIHost */

+
+static QOSGraphObject *generic_pcihost_get_device(void *obj, const char 
*device)
+{
+QGenericPCIHost *host = obj;
+if (!g_strcmp0(device, "pci-bus-arm")) {
+return &host->pci.obj;
+}
+fprintf(stderr, "%s not present in generic-pcihost\n", device);
+g_assert_not_reached();
+}
+
+static void qos_create_generic_pcihost(QGenericPCIHost *host,
+   QTestState *qts,
+   QGuestAllocator *alloc)
+{
+host->obj.get_device = generic_pcihost_get_device;
+qpci_init_arm(&host->pci, qts, alloc, false);
+}
+
  static void virt_destructor(QOSGraphObject *obj)
  {
  QVirtMachine *machine = (QVirtMachine *) obj;


This should also be in the same file as the bus implementation.


+qos_node_create_driver("generic-pcihost", NULL);
+qos_node_contains("generic-pcihost", "pci-bus-arm", NULL);


This too, with a new libqos_init.



+static uint8_t qpci_arm_config_readb(QPCIBus *bus, int devfn, uint8_t offset)
+{
+uint64_t addr = bus->ecam_alloc_ptr + ((0 << 20) | (devfn << 12) | offset);


ecam_alloc_ptr should be in QPCIBusARM (to be renamed to 
QGenericPCIBus), which you can retrieve from the "bus" QPCIBus* via 
container_of.



diff --git a/tests/qtest/libqos/pci-arm.h b/tests/qtest/libqos/pci-arm.h
new file mode 100644
index 000..8cd49ec2969
--- /dev/null
+++ b/tests/qtest/libqos/pci-arm.h
@@ -0,0 +1,56 @@
+/*
+ * libqos PCI bindings for ARM
+ *
+ * Copyright Red Hat Inc., 2021
+ *
+ * Authors:
+ *  Eric Auger   
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef LIBQOS_PCI_ARM_H
+#define LIBQOS_PCI_ARM_H
+
+#include "pci.h"
+#include "malloc.h"
+#include "qgraph.h"
+
+typedef struct QPCIBusARM {
+QOSGraphObject obj;
+QPCIBus bus;
+uint64_t gpex_pio_base;
+} QPCIBusARM;
+
+/*
+ * qpci_init_arm():
+ * @ret: A valid QPCIBusARM * pointer
+ * @qts: The %QTestState for this ARM machine
+ * @alloc: A previously initialized @alloc providing memory for @qts
+ * @bool: devices can be hotplugged on this bus
+ *
+ * This function initializes an already allocated
+ * QPCIBusARM object.
+ */
+void qpci_init_arm(QPCIBusARM *ret, QTestState *qts,
+   QGuestAllocator *alloc, bool hotpluggable);
+
+/*
+ * qpci_arm_new():
+ * @qts: The %QTestState for this ARM machine
+ * @alloc: A previously initialized @alloc providing memory for @qts
+ * @hotpluggable: the pci bus is hotpluggable
+ *
+ * This function creates a new QPCIBusARM object,
+ * and properly initialize its fields.
+ *
+ * Returns th

Re: [PATCH 1/2] build-sys: fix undefined ARCH error


On 1/14/22 09:43, marcandre.lur...@redhat.com wrote:

From: Marc-André Lureau 

../qga/meson.build:76:4: ERROR: Key ARCH is not in the dictionary.

Fixes commit 823eb013 ("configure, meson: move ARCH to meson.build")

Signed-off-by: Marc-André Lureau 
---
  qga/meson.build | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qga/meson.build b/qga/meson.build
index cfb1fbc0853c..613ecb980286 100644
--- a/qga/meson.build
+++ b/qga/meson.build
@@ -75,7 +75,7 @@ if targetos == 'windows'
  endif
  qga_msi = custom_target('QGA MSI',
  input: files('installer/qemu-ga.wxs'),
-output: 
'qemu-ga-@0@.msi'.format(config_host['ARCH']),
+output: 'qemu-ga-@0@.msi'.format(host_arch),
  depends: deps,
  command: [
find_program('env'),


Queued both, thanks.

Paolo

Re: [PATCH] build-sys: fix a meson deprecation warning


On 1/13/22 17:21, marcandre.lur...@redhat.com wrote:

From: Marc-André Lureau 

WARNING: Deprecated features used:
  * 0.56.0: {'meson.source_root'}

Signed-off-by: Marc-André Lureau 
Reported-by: Peter Maydell 
---
  tests/qtest/meson.build | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 37e1eaa4498e..2f6687576757 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -103,7 +103,7 @@ if dbus_daemon.found() and 
config_host.has_key('GDBUS_CODEGEN')
#qtests_i386 += ['dbus-vmstate-test']
dbus_vmstate1 = custom_target('dbus-vmstate description',
  output: ['dbus-vmstate1.h', 
'dbus-vmstate1.c'],
-input: meson.source_root() / 
'backends/dbus-vmstate1.xml',
+input: meson.project_source_root() / 
'backends/dbus-vmstate1.xml',
  command: [config_host['GDBUS_CODEGEN'],
'@INPUT@',
'--interface-prefix', 'org.qemu',


Queued, thanks.

Paolo

Re: [PATCH v2 0/3] Support fd-based KVM stats


On 11/19/21 20:51, Mark Kanda wrote:

v2: [Paolo]
- generalize the interface
- add support for querying stat schema and instances
- add additional HMP semantic processing for a few exponent/unit
   combinations (related to seconds and bytes)

This patchset adds QEMU support for querying fd-based KVM stats. The
kernel support was introduced by:

cb082bfab59a ("KVM: stats: Add fd-based API to read binary stats data")


Hi Mark,

sorry for the late review.  Fortunately there's very little that I'd change.

In particular:

* please change the callbacks to accept a NULL name and type, instead of 
having the "bool"/"const char *" pair.  You can probably benefit from a 
function to cutils.c like


bool qemu_match_string(const char *value, const char *request) {
return !request || g_str_equal(value, request);
}

* please pass a single const struct to add_stats_callbacks, using GList 
so that the struct can be const.


Putting both together it would be something like:

typedef struct StatsCallbacks {
char *name;
StatsList *(*get_values)(StatsList *list, const char *name,
   const char *type, Error **errp);
StatsSchemaList *(*get_schemas)(StatsSchemaList *list,
const char *name, Error **errp);
StatsInstanceList *(*get_instances)(StatsInstanceList *list,
Error **errp);
} StatsCallbacks;

Finally, please put everything in a new header include/monitor/stats.h, 
so that we can document everything and please it in docs/devel.  I can 
take care of that though.


Thanks,

Paolo



Mark Kanda (3):
   qmp: Support for querying stats
   hmp: Support for querying stats
   kvm: Support for querying fd-based stats

  accel/kvm/kvm-all.c   | 399 ++
  hmp-commands-info.hx  |  40 
  include/monitor/hmp.h |   3 +
  include/monitor/monitor.h |  27 +++
  monitor/hmp-cmds.c| 125 
  monitor/qmp-cmds.c|  71 +++
  qapi/misc.json| 142 ++
  7 files changed, 807 insertions(+)

Re: [RFC] linux-user: Remove stale "not threadsafe" comments

2022-01-15 Thread Warner Losh

On Sat, Jan 15, 2022 at 2:49 AM Alex Bennée  wrote:

>
> Peter Maydell  writes:
>
> > In linux-user/signal.c we have two FIXME comments claiming that
> > parts of the signal-handling code are not threadsafe. These are
> > very old, as they were first introduced in commit 624f7979058
> > in 2008. Since then we've radically overhauled the signal-handling
> > logic, while carefully preserving these FIXME comments.
> >
> > It's unclear exactly what thread-safety issue the original
> > author was trying to point out -- the relevant data structures
> > are in the TaskStruct, which makes them per-thread and only
> > operated on by that thread. The old code at the time of that
> > commit did have various races involving signal handlers being
> > invoked at awkward times; possibly this was what was meant.
> >
> > Delete these FIXME comments:
> >  * they were written at a time when the way we handled
> >signals was completely different
> >  * the code today appears to us to not have thread-safety issues
> >  * nobody knows what the problem the comments were trying to
> >point out was
> > so they are serving no useful purpose for us today.
> >
> > Signed-off-by: Peter Maydell 
> > ---
> > Marked "RFC" because I'm a bit uneasy with deleting FIXMEs
> > simply because I can't personally figure out why they're
> > there. This patch is more to start a discussion to see
> > if anybody does understand the issue -- in which case we
> > can instead augment the comments to describe it.
> > ---
> >  linux-user/signal.c | 2 --
> >  1 file changed, 2 deletions(-)
>




> > diff --git a/linux-user/signal.c b/linux-user/signal.c
> > index 32854bb3752..e7410776e21 100644
> > --- a/linux-user/signal.c
> > +++ b/linux-user/signal.c
> > @@ -1001,7 +1001,6 @@ int do_sigaction(int sig, const struct
> target_sigaction *act,
> >  oact->sa_mask = k->sa_mask;
> >  }
> >  if (act) {
> > -/* FIXME: This is not threadsafe.  */
> >  __get_user(k->_sa_handler, &act->_sa_handler);
> >  __get_user(k->sa_flags, &act->sa_flags);
> >  #ifdef TARGET_ARCH_HAS_SA_RESTORER
> > @@ -1151,7 +1150,6 @@ void process_pending_signals(CPUArchState *cpu_env)
> >  sigset_t *blocked_set;
> >
> >  while (qatomic_read(&ts->signal_pending)) {
> > -/* FIXME: This is not threadsafe.  */
> >  sigfillset(&set);
> >  sigprocmask(SIG_SETMASK, &set, 0);
>
> Looking at the history those FIXMEs could have been for code that they
> where attached to. Could the thread safety be about reading the
> sigaction stuff? I would have though sigaction updates where atomic by
> virtue of the syscall to set them...
>
> Anyway looks old to me:
>
> Reviewed-by: Alex Bennée 
>

Reviewed-by: Warner Losh 

I looked in bsd-user, to where this was also copied, and couldn't figure out
what it was talking about...  Though that's a weak review, imho..


> --
> Alex Bennée
>
>

[PULL 0/1] qemu-openbios queue 20220115

The following changes since commit 1cd2ad11d37c48f284f557954e1df675b126264c:

  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging 
(2022-01-14 15:56:30 +)

are available in the Git repository at:

  git://github.com/mcayland/qemu.git tags/qemu-openbios-20220115

for you to fetch changes up to 8d7ebae4803611ebd03096fc4804396add52ec62:

  roms/openbios: update OpenBIOS images to 04dfc98 built from submodule 
(2022-01-15 17:34:36 +)


qemu-openbios queue
- gcc 10 build fix
- change Qemu to QEMU
- add extra PVRs for MPC7450 family


Mark Cave-Ayland (1):
  roms/openbios: update OpenBIOS images to 04dfc98 built from submodule

 pc-bios/openbios-ppc | Bin 696912 -> 697088 bytes
 pc-bios/openbios-sparc32 | Bin 382048 -> 382048 bytes
 pc-bios/openbios-sparc64 | Bin 1593408 -> 1593408 bytes
 roms/openbios|   2 +-
 4 files changed, 1 insertion(+), 1 deletion(-)

Re: [PATCH 5/5] hw/display/artist: Fix framebuffer access for Linux

2022-01-15 Thread Sven Schnelle

Sven Schnelle  writes:

> Philippe Mathieu-Daudé  writes:
>
>> +Sven
>>
>> On 12/1/22 22:07, Helge Deller wrote:
>>> This patch fixes two problems which prevented Linux to access the
>>> artist graphics framebuffer:
>>> The check if the framebuffer or the color map should be accessed was
>>> incomplete. By using the vram_read/write_bufidx() functions we now check
>>> correctly if ARTIST_BUFFER_CMAP should be accessed.
>>> The second fix is to correctly calculate the X- and Y-coordinates
>>> and
>>> check against the graphics resolution.
>>> With this fix in place, the Linux stifb driver now works correctly,
>>> shows the penguins at bootup and uses the stifb as graphics console.
>>
>> Cool, could you add a test similar to these?
>>
>> $ git grep Tux tests/avocado/
>> tests/avocado/machine_arm_integratorcp.py:69:Boot Linux and
>> verify the Tux logo is displayed on the framebuffer.
>> tests/avocado/machine_mips_malta.py:44:Boot Linux kernel and
>> check Tux logo is displayed on the framebuffer.
>>
>>> I haven't seen any negative side effects when running HP-UX.
>

> Hmm, the patch below  breaks hp-ux 10.20 for me, please see the
> attached screenshot.

I think my initial thought that the register 118000 is the buffer access
mode for the color map is just wrong. I think it's setting the SRC & DST
buffer access mode at the same time because on the Visualize FX cards
we have similar registers:

#define B2_FBC_BABoth 0x00920804 /* DBA & SBA (reads return 
DBA) (RW) */
#define B2_FBC_DBA0x00920808 /* Destination Bitmap 
Access Register (RW) */
#define B2_FBC_SBA0x0092080C /* Source Bitmap Access 
Register (RW) */

Looking at Artist, we have:

CMAP_BM_ACCESS = 0x118000
DST_BM_ACCESS = 0x118004
SRC_BM_ACCESS = 0x118008

Given that artist and visualize fx are very similar when it comes to 2D
acceleration, i think CMAP_BM_ACCESS is just changing both registers,
completely unrelated to the color map. I tried changing the code, but
of course that breaks a lot of things. Let me see whether i can make
that work.

/Sven

[PATCH 1/3] exec/memory: Extract address_space_set() from dma_memory_set()

From: Philippe Mathieu-Daudé 

dma_memory_set() does a DMA barrier, set the address space with
a constant value. The constant value filling code is not specific
to DMA and can be used for AddressSpace. Extract it as a new
helper: address_space_set().

Signed-off-by: Philippe Mathieu-Daudé 
Reviewed-by: Laurent Vivier 
Reviewed-by: Stefano Garzarella 
Reviewed-by: Richard Henderson 
[lv: rebase]
Signed-off-by: Laurent Vivier 
---
 include/exec/memory.h | 16 
 softmmu/dma-helpers.c | 15 +--
 softmmu/physmem.c | 19 +++
 3 files changed, 36 insertions(+), 14 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index 20f1b27377ea..c00c50943107 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -2906,6 +2906,22 @@ address_space_write_cached(MemoryRegionCache *cache, 
hwaddr addr,
 }
 }
 
+/**
+ * address_space_set: Fill address space with a constant byte.
+ *
+ * Return a MemTxResult indicating whether the operation succeeded
+ * or failed (eg unassigned memory, device rejected the transaction,
+ * IOMMU fault).
+ *
+ * @as: #AddressSpace to be accessed
+ * @addr: address within that address space
+ * @c: constant byte to fill the memory
+ * @len: the number of bytes to fill with the constant byte
+ * @attrs: memory transaction attributes
+ */
+MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
+  uint8_t c, hwaddr len, MemTxAttrs attrs);
+
 #ifdef NEED_CPU_H
 /* enum device_endian to MemOp.  */
 static inline MemOp devend_memop(enum device_endian end)
diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index b0be1564797f..c2028b658582 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -23,20 +23,7 @@ MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t addr,
 {
 dma_barrier(as, DMA_DIRECTION_FROM_DEVICE);
 
-#define FILLBUF_SIZE 512
-uint8_t fillbuf[FILLBUF_SIZE];
-int l;
-MemTxResult error = MEMTX_OK;
-
-memset(fillbuf, c, FILLBUF_SIZE);
-while (len > 0) {
-l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE;
-error |= address_space_write(as, addr, attrs, fillbuf, l);
-len -= l;
-addr += l;
-}
-
-return error;
+return address_space_set(as, addr, c, len, attrs);
 }
 
 void qemu_sglist_init(QEMUSGList *qsg, DeviceState *dev, int alloc_hint,
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index 3524c04c2a16..dddf70edf5d2 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2927,6 +2927,25 @@ MemTxResult address_space_rw(AddressSpace *as, hwaddr 
addr, MemTxAttrs attrs,
 }
 }
 
+MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
+  uint8_t c, hwaddr len, MemTxAttrs attrs)
+{
+#define FILLBUF_SIZE 512
+uint8_t fillbuf[FILLBUF_SIZE];
+int l;
+MemTxResult error = MEMTX_OK;
+
+memset(fillbuf, c, FILLBUF_SIZE);
+while (len > 0) {
+l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE;
+error |= address_space_write(as, addr, attrs, fillbuf, l);
+len -= l;
+addr += l;
+}
+
+return error;
+}
+
 void cpu_physical_memory_rw(hwaddr addr, void *buf,
 hwaddr len, bool is_write)
 {
-- 
2.34.1

[PATCH 0/3] m68k: virt: fix reboot

This series fixes the reboot of the virt-m68k machine
by correctly initializing the start address and fixing
the ELF kernel image.

The two first patches were already sent last year and
never merged:

https://patchwork.kernel.org/project/qemu-devel/cover/20210429141326.69245-1-laur...@vivier.eu/

Thanks,
Laurent

Laurent Vivier (2):
  hw/elf_ops: clear uninitialized segment space
  m68k: virt: correctly set the initial PC

Philippe Mathieu-Daudé (1):
  exec/memory: Extract address_space_set() from dma_memory_set()

 include/exec/memory.h | 16 
 include/hw/elf_ops.h  | 13 +
 hw/core/loader.c  |  4 
 hw/m68k/virt.c| 22 +-
 softmmu/dma-helpers.c | 15 +--
 softmmu/physmem.c | 19 +++
 6 files changed, 70 insertions(+), 19 deletions(-)

-- 
2.34.1

[PATCH 2/3] hw/elf_ops: clear uninitialized segment space

When the mem_size of the segment is bigger than the file_size,
and if this space doesn't overlap another segment, it needs
to be cleared.

This bug is very similar to the one we had for linux-user,
22d113b52f41 ("linux-user: Fix loading of BSS segments"),
where .bss section is encoded as an extension of the the data
one by setting the segment p_memsz > p_filesz.

Signed-off-by: Laurent Vivier 
[PMD: Use recently added address_space_set()]
Signed-off-by: Philippe Mathieu-Daudé 
Reviewed-by: Stefano Garzarella 
Reviewed-by: Richard Henderson 
---
 include/hw/elf_ops.h | 13 +
 hw/core/loader.c |  4 
 2 files changed, 17 insertions(+)

diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h
index 995de8495c27..7c3b1d0f6cc5 100644
--- a/include/hw/elf_ops.h
+++ b/include/hw/elf_ops.h
@@ -555,6 +555,19 @@ static ssize_t glue(load_elf, SZ)(const char *name, int fd,
 if (res != MEMTX_OK) {
 goto fail;
 }
+/*
+ * We need to zero'ify the space that is not copied
+ * from file
+ */
+if (file_size < mem_size) {
+res = address_space_set(as ? as : 
&address_space_memory,
+addr + file_size, 0,
+mem_size - file_size,
+MEMTXATTRS_UNSPECIFIED);
+if (res != MEMTX_OK) {
+goto fail;
+}
+}
 }
 }
 
diff --git a/hw/core/loader.c b/hw/core/loader.c
index 052a0fd7198b..19edb928e999 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -1164,9 +1164,13 @@ static void rom_reset(void *unused)
 if (rom->mr) {
 void *host = memory_region_get_ram_ptr(rom->mr);
 memcpy(host, rom->data, rom->datasize);
+memset(host + rom->datasize, 0, rom->romsize - rom->datasize);
 } else {
 address_space_write_rom(rom->as, rom->addr, MEMTXATTRS_UNSPECIFIED,
 rom->data, rom->datasize);
+address_space_set(rom->as, rom->addr + rom->datasize, 0,
+  rom->romsize - rom->datasize,
+  MEMTXATTRS_UNSPECIFIED);
 }
 if (rom->isrom) {
 /* rom needs to be written only once */
-- 
2.34.1

[PATCH 3/3] m68k: virt: correctly set the initial PC

According to QEMU parameter, set initial PC to the entry of
the loaded kernel.

Signed-off-by: Laurent Vivier 
---
 hw/m68k/virt.c | 22 +-
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index 78e926a55457..bbaf630bbf20 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -85,14 +85,21 @@
 #define VIRT_VIRTIO_MMIO_BASE 0xff01 /* MMIO: 0xff01 - 0xff01 
*/
 #define VIRT_VIRTIO_IRQ_BASE  PIC_IRQ(2, 1)  /* PIC: 2, 3, 4, 5, IRQ: ALL */
 
+typedef struct {
+M68kCPU *cpu;
+hwaddr initial_pc;
+hwaddr initial_stack;
+} ResetInfo;
+
 static void main_cpu_reset(void *opaque)
 {
-M68kCPU *cpu = opaque;
+ResetInfo *reset_info = opaque;
+M68kCPU *cpu = reset_info->cpu;
 CPUState *cs = CPU(cpu);
 
 cpu_reset(cs);
-cpu->env.aregs[7] = ldl_phys(cs->as, 0);
-cpu->env.pc = ldl_phys(cs->as, 4);
+cpu->env.aregs[7] = reset_info->initial_stack;
+cpu->env.pc = reset_info->initial_pc;
 }
 
 static void virt_init(MachineState *machine)
@@ -113,6 +120,7 @@ static void virt_init(MachineState *machine)
 SysBusDevice *sysbus;
 hwaddr io_base;
 int i;
+ResetInfo *reset_info;
 
 if (ram_size > 3399672 * KiB) {
 /*
@@ -124,9 +132,13 @@ static void virt_init(MachineState *machine)
 exit(1);
 }
 
+reset_info = g_malloc0(sizeof(ResetInfo));
+
 /* init CPUs */
 cpu = M68K_CPU(cpu_create(machine->cpu_type));
-qemu_register_reset(main_cpu_reset, cpu);
+
+reset_info->cpu = cpu;
+qemu_register_reset(main_cpu_reset, reset_info);
 
 /* RAM */
 memory_region_add_subregion(get_system_memory(), 0, machine->ram);
@@ -206,7 +218,7 @@ static void virt_init(MachineState *machine)
 error_report("could not load kernel '%s'", kernel_filename);
 exit(1);
 }
-stl_phys(cs->as, 4, elf_entry); /* reset initial PC */
+reset_info->initial_pc = elf_entry;
 parameters_base = (high + 1) & ~1;
 
 BOOTINFO1(cs->as, parameters_base, BI_MACHTYPE, MACH_VIRT);
-- 
2.34.1

Re: [PATCH qemu] spapr: Force 32bit when resetting a core

2022-01-15 Thread BALATON Zoltan

On Fri, 14 Jan 2022, Cédric Le Goater wrote:

On 1/10/22 03:52, Alexey Kardashevskiy wrote:

On 08/01/2022 00:39, Greg Kurz wrote:

On Fri, 7 Jan 2022 23:19:03 +1100
David Gibson wrote:

On Fri, Jan 07, 2022 at 12:57:47PM +0100, Greg Kurz wrote:

On Fri, 7 Jan 2022 18:24:23 +1100
Alexey Kardashevskiy wrote:

"PowerPC Processor binding to IEEE 1275" says in
"8.2.1. Initial Register Values" that the initial state is defined as
32bit so do it for both SLOF and VOF.

This should not cause behavioral change as SLOF switches to 64bit very
early anyway.

Only one CPU goes through SLOF. What about the other ones, including
hot plugged CPUs ?

Those will be started by the start-cpu RTAS call which has its own
semantics.

Ah indeed, there's code in linux/arch/powerpc/kernel/head_64.S to switch
secondaries to 64bit... but then, as noted by Cedric, ppc_cpu_reset(),
which is called earlier sets MSR_SF but the changelog of commit
8b9f2118ca40

doesn't provide much details on the motivation. Any idea ?

https://patchwork.kernel.org/project/qemu-devel/patch/1458121432-2855-1-git-send-email-lviv...@redhat.com/

this is probably it:

===
Reset is properly defined as an exception (0x100). For exceptions, the
970MP user manual for example says:

4.5 Exception Definitions
When an exception/interrupt is taken, all bits in the MSR are set to
‘0’, with the following exceptions:
• Exceptions always set MSR[SF] to ‘1’.
===

but it looks like the above is about emulation bare metal 970 rather than
pseries VCPU so that quote does not apply to spapr.

Yes, more info here :

https://patchwork.kernel.org/project/qemu-devel/patch/1458121432-2855-1-git-send-email-lviv...@redhat.com/

mac99+970 only boots with a 64bit kernel. 32bit are not supported because
of the use of the rfi instruction which was removed in v2.01. 32bit user
space is supported though.

However I was not able to build a disk with a compatible boot partition
for OpenBIOS. The above support only applies for kernel loaded in memory.

Not sure it's related or helpful but I've managed to install Adélie Linux
(which still has official support for PPC Macs) on qemu-system-ppc64 -M
mac99,via=pmu a while ago. Here's a thread about my experiences with
Adélie Linux:

https://lists-old.adelielinux.org/hyperkitty/list/adelie-de...@lists.adelielinux.org/thread/CNWIYZCFN7XDBSDCZDVIUE3SXE2EX6YF/index.html

but that mentions qemu-system-ppc and ppc32 version so this was before the
ppc64 install which may be a newer Adélie version that I had no such
problem starting. Ar least I did not need the patched OpenBIOS for ppc64.
I think that version worked with qemu-system-ppc64 and could just install
it following the manual install described in the Adélie docs:

https://git.adelielinux.org/adelie/docs/-/wikis/Quick-Start-Guides/Installation

To boot the installed system I had to type "boot hd:2,\grub" as it did not
find the boot partition for some reason (maybe because not preserving
nvram variables).

The installed disk has these partitions:
1: Apple partition map
2. boot (HFS)
3: root (ext4)

This was a while ago so I don't remember the details but I think it worked
for the G5 mac99 without much problem.

Regards,
BALATON Zoltan

Re: [PULL 0/9] qemu-ga-win patches

2022-01-15 Thread Konstantin Kostiuk

On Sat, Jan 15, 2022 at 2:40 PM Peter Maydell 
wrote:

> On Mon, 10 Jan 2022 at 13:46, Konstantin Kostiuk 
> wrote:
> >
> > The following changes since commit
> df722e33d5da26ea8604500ca8f509245a0ea524:
> >
> >   Merge tag 'bsd-user-arm-pull-request' of gitlab.com:bsdimp/qemu into
> staging (2022-01-08 09:37:59 -0800)
> >
> > are available in the Git repository at:
> >
> >   https://github.com/kostyanf14/qemu.git tags/qga-win32-pull-2022-01-10
> >
> > for you to fetch changes up to 206ce9699fae1f631ac74b7e1115db2affc759fd:
> >
> >   qga-win: Detect Windows 11 by build number (2022-01-10 13:05:25 +)
>
> Hi; this tag doesn't seem to be gpg-signed. QEMU only alloows pullreqs
> which are for gpg-signed tags, so you'll need to sign it. Please make
> sure you've uploaded your gpg key to a suitable keyserver (eg
> keyserver.ubuntu.com and/or keys.openpgp.org) and let me know which
> one so I can download it. If you can arrange to get your key signed by
> some of your RedHat colleagues (and upload the key with those signatures)
> that would also be helpful.
>
> thanks
> -- PMM
>

Hi. I uploaded my GPG key to keys.openpgp.org. You can find it by my RedHat
email.
Unfortunately, for now, this key can not be signed by other RedHat
developers.
I signed my tag and pushed it to GitHub. Should I resend this set of
patches?

For tag signing, I use the 'git tag -s' command.
I am sorry for the mistakes, this is my first PR.

Best Regards,
Konstantin Kostiuk.

[PATCH 0/4] make check-block a meson test

This series makes "meson test" run the block layer tests, reporting
their outcome in the same way as the other TAP tests.

Based-on: <20211223183933.1497037-1-vsement...@virtuozzo.com>

Paolo Bonzini (4):
  scripts/mtest2make: add support for SPEED=thorough
  build: make check-block a meson test
  qemu-iotests: require at least an argument to check-block.sh
  check-block: replace -makecheck with TAP output

 meson.build  |  5 ++--
 scripts/mtest2make.py| 20 ++---
 tests/Makefile.include   | 16 ++-
 tests/check-block.sh | 45 +
 tests/meson.build|  1 +
 tests/qemu-iotests/check |  6 ++--
 tests/qemu-iotests/meson.build   | 30 +++
 tests/qemu-iotests/testenv.py| 30 +--
 tests/qemu-iotests/testrunner.py | 49 +---
 9 files changed, 117 insertions(+), 85 deletions(-)
 create mode 100644 tests/qemu-iotests/meson.build

-- 
2.33.1

[PATCH 0/4] make check-block a meson test

This series makes "meson test" run the block layer tests, reporting
their outcome in the same way as the other TAP tests.

Based-on: <20211223183933.1497037-1-vsement...@virtuozzo.com>

Paolo Bonzini (4):
  scripts/mtest2make: add support for SPEED=thorough
  build: make check-block a meson test
  qemu-iotests: require at least an argument to check-block.sh
  check-block: replace -makecheck with TAP output

 meson.build  |  5 ++--
 scripts/mtest2make.py| 20 ++---
 tests/Makefile.include   | 16 ++-
 tests/check-block.sh | 45 +
 tests/meson.build|  1 +
 tests/qemu-iotests/check |  6 ++--
 tests/qemu-iotests/meson.build   | 30 +++
 tests/qemu-iotests/testenv.py| 30 +--
 tests/qemu-iotests/testrunner.py | 49 +---
 9 files changed, 117 insertions(+), 85 deletions(-)
 create mode 100644 tests/qemu-iotests/meson.build

-- 
2.33.1

[PATCH 1/4] scripts/mtest2make: add support for SPEED=thorough

Signed-off-by: Paolo Bonzini 
---
 meson.build   |  5 +++--
 scripts/mtest2make.py | 10 +++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/meson.build b/meson.build
index 762d7cee85..c9004bd25e 100644
--- a/meson.build
+++ b/meson.build
@@ -3,8 +3,9 @@ project('qemu', ['c'], meson_version: '>=0.58.2',
   'b_staticpic=false', 'stdsplit=false'],
 version: files('VERSION'))
 
-add_test_setup('quick', exclude_suites: 'slow', is_default: true)
-add_test_setup('slow', env: ['G_TEST_SLOW=1', 'SPEED=slow'])
+add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true)
+add_test_setup('slow', exclude_suites: ['thorough'], env: ['G_TEST_SLOW=1', 
'SPEED=slow'])
+add_test_setup('thorough', env: ['G_TEST_SLOW=1', 'SPEED=thorough'])
 
 not_found = dependency('', required: false)
 keyval = import('keyval')
diff --git a/scripts/mtest2make.py b/scripts/mtest2make.py
index 7067bdadf5..4b9c561b30 100644
--- a/scripts/mtest2make.py
+++ b/scripts/mtest2make.py
@@ -23,8 +23,9 @@ def names(self, base):
 print('''
 SPEED = quick
 
-.speed.quick = $(foreach s,$(sort $(filter-out %-slow, $1)), --suite $s)
-.speed.slow = $(foreach s,$(sort $1), --suite $s)
+.speed.quick = $(foreach s,$(sort $(filter-out %-slow %-thorough, $1)), 
--suite $s)
+.speed.slow = $(foreach s,$(sort $(filter-out %-thorough, $1)), --suite $s)
+.speed.thorough = $(foreach s,$(sort $1), --suite $s)
 
 .mtestargs = --no-rebuild -t 0
 ifneq ($(SPEED), quick)
@@ -52,11 +53,14 @@ def process_tests(test, targets, suites):
 for s in test_suites:
 # The suite name in the introspection info is "PROJECT:SUITE"
 s = s.split(':')[1]
-if s == 'slow':
+if s == 'slow' or s == 'thorough':
 continue
 if s.endswith('-slow'):
 s = s[:-5]
 suites[s].speeds.append('slow')
+if s.endswith('-thorough'):
+s = s[:-9]
+suites[s].speeds.append('thorough')
 suites[s].deps.update(deps)
 
 def emit_prolog(suites, prefix):
-- 
2.33.1

[PATCH 2/4] build: make check-block a meson test

"meson test" can be asked to run tests verbosely; this makes it usable
also for qemu-iotests's own harness, and it lets "make check-block"
reuse mtest2make.py's infrastructure to find and build test dependencies.

Adjust check-block.sh to use the standard exit code that reports a test
as skipped.  Alternatively, in the future we could make it produce TAP
output, which is consistent with all other "make check" tests.

Signed-off-by: Paolo Bonzini 
---
 meson.build|  6 +++---
 scripts/mtest2make.py  | 10 +-
 tests/Makefile.include | 16 +++-
 tests/check-block.sh   | 28 +---
 tests/meson.build  |  1 +
 tests/qemu-iotests/meson.build | 29 +
 6 files changed, 58 insertions(+), 32 deletions(-)
 create mode 100644 tests/qemu-iotests/meson.build

diff --git a/meson.build b/meson.build
index c9004bd25e..229061f971 100644
--- a/meson.build
+++ b/meson.build
@@ -3,9 +3,9 @@ project('qemu', ['c'], meson_version: '>=0.58.2',
   'b_staticpic=false', 'stdsplit=false'],
 version: files('VERSION'))
 
-add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true)
-add_test_setup('slow', exclude_suites: ['thorough'], env: ['G_TEST_SLOW=1', 
'SPEED=slow'])
-add_test_setup('thorough', env: ['G_TEST_SLOW=1', 'SPEED=thorough'])
+add_test_setup('quick', exclude_suites: ['block', 'slow', 'thorough'], 
is_default: true)
+add_test_setup('slow', exclude_suites: ['block', 'thorough'], env: 
['G_TEST_SLOW=1', 'SPEED=slow'])
+add_test_setup('thorough', exclude_suites: ['block'], env: ['G_TEST_SLOW=1', 
'SPEED=thorough'])
 
 not_found = dependency('', required: false)
 keyval = import('keyval')
diff --git a/scripts/mtest2make.py b/scripts/mtest2make.py
index 4b9c561b30..4d542e8aaa 100644
--- a/scripts/mtest2make.py
+++ b/scripts/mtest2make.py
@@ -79,7 +79,7 @@ def emit_prolog(suites, prefix):
 print(f'{prefix}-report.junit.xml $(all-{prefix}-xml): 
{prefix}-report%.junit.xml: run-ninja')
 print(f'\t$(MAKE) {prefix}$* MTESTARGS="$(MTESTARGS) --logbase 
{prefix}-report$*" && ln -f meson-logs/$@ .')
 
-def emit_suite(name, suite, prefix):
+def emit_suite_deps(name, suite, prefix):
 deps = ' '.join(suite.deps)
 targets = f'{prefix}-{name} {prefix}-report-{name}.junit.xml {prefix} 
{prefix}-report.junit.xml'
 print()
@@ -87,6 +87,10 @@ def emit_suite(name, suite, prefix):
 print(f'ifneq ($(filter {prefix}-build {targets}, $(MAKECMDGOALS)),)')
 print(f'.{prefix}.build-suites += {name}')
 print(f'endif')
+
+def emit_suite(name, suite, prefix):
+emit_suite_deps(name, suite, prefix)
+targets = f'{prefix}-{name} {prefix}-report-{name}.junit.xml {prefix} 
{prefix}-report.junit.xml'
 print(f'ifneq ($(filter {targets}, $(MAKECMDGOALS)),)')
 print(f'.{prefix}.mtest-suites += ' + ' '.join(suite.names(name)))
 print(f'endif')
@@ -97,6 +101,10 @@ def emit_suite(name, suite, prefix):
 testsuites = defaultdict(Suite)
 for test in introspect['tests']:
 process_tests(test, targets, testsuites)
+# HACK: check-block is a separate target so that it runs with --verbose;
+# only write the dependencies
+emit_suite_deps('block', testsuites['block'], 'check')
+del testsuites['block']
 emit_prolog(testsuites, 'check')
 for name, suite in testsuites.items():
 emit_suite(name, suite, 'check')
diff --git a/tests/Makefile.include b/tests/Makefile.include
index 4c564cf789..722ff15145 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -156,19 +156,9 @@ check:
 
 ifeq ($(CONFIG_TOOLS)$(CONFIG_POSIX),yy)
 check: check-block
-export PYTHON
-
-ifneq ($(filter check check-block check-build, $(MAKECMDGOALS)),)
-ninja-cmd-goals += \
-   qemu-img$(EXESUF) \
-   qemu-io$(EXESUF) \
-   qemu-nbd$(EXESUF) \
-   storage-daemon/qemu-storage-daemon$(EXESUF) \
-   $(filter qemu-system-%, $(ninja-targets))
-endif
-
-check-block: $(SRC_PATH)/tests/check-block.sh run-ninja
-   @$<
+check-block: run-ninja
+   $(if $(MAKE.n),,+)$(MESON) test $(MTESTARGS) $(.mtestargs) --verbose \
+   --logbase iotestslog $(call .speed.$(SPEED), block block-slow 
block-thorough)
 endif
 
 check-build: run-ninja
diff --git a/tests/check-block.sh b/tests/check-block.sh
index d98d49ad63..9afeea5275 100755
--- a/tests/check-block.sh
+++ b/tests/check-block.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Honor the SPEED environment variable, just like we do it for the qtests.
+# Honor the SPEED environment variable, just like we do it for "meson test"
 if [ "$SPEED" = "slow" ]; then
 format_list="raw qcow2"
 group=
@@ -16,9 +16,13 @@ if [ "$#" -ne 0 ]; then
 format_list="$@"
 fi
 
+skip() {
+echo "$*"
+exit 77
+}
+
 if grep -q "CONFIG_GPROF=y" config-host.mak 2>/dev/null ; then
-echo "GPROF is enabled ==> Not running the qemu-iotests."
-exit 0
+skip "GPROF is enabled ==> Not running the qemu-iotests."
 fi

[PATCH 3/4] qemu-iotests: require at least an argument to check-block.sh

This is anyway how check-block.sh is used in practice, and by removing the
list of formats in the script we avoid duplication between meson.build
and check-block.sh.

Signed-off-by: Paolo Bonzini 
---
 tests/check-block.sh | 21 +
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/tests/check-block.sh b/tests/check-block.sh
index 9afeea5275..88e02453d2 100755
--- a/tests/check-block.sh
+++ b/tests/check-block.sh
@@ -1,19 +1,16 @@
 #!/bin/sh
 
-# Honor the SPEED environment variable, just like we do it for "meson test"
-if [ "$SPEED" = "slow" ]; then
-format_list="raw qcow2"
-group=
-elif [ "$SPEED" = "thorough" ]; then
-format_list="raw qcow2 qed vmdk vpc"
-group=
-else
-format_list=qcow2
-group="-g auto"
+if [ "$#" -eq 0 ]; then
+echo "Usage: $0 fmt..." >&2
+exit 99
 fi
 
-if [ "$#" -ne 0 ]; then
-format_list="$@"
+# Honor the SPEED environment variable, just like we do it for "meson test"
+format_list="$@"
+if [ "$SPEED" = "slow" ] || [ "$SPEED" = "thorough" ]; then
+group=
+else
+group="-g auto"
 fi
 
 skip() {
-- 
2.33.1

[PATCH 4/4] check-block: replace -makecheck with TAP output

Let "meson test" take care of showing the results of the individual tests,
consistently with other output from "make check V=1".

Signed-off-by: Paolo Bonzini 
---
 tests/check-block.sh |  6 ++--
 tests/qemu-iotests/check |  6 ++--
 tests/qemu-iotests/meson.build   |  1 +
 tests/qemu-iotests/testenv.py| 30 +--
 tests/qemu-iotests/testrunner.py | 49 +---
 5 files changed, 48 insertions(+), 44 deletions(-)

diff --git a/tests/check-block.sh b/tests/check-block.sh
index 88e02453d2..720a46bc36 100755
--- a/tests/check-block.sh
+++ b/tests/check-block.sh
@@ -14,8 +14,8 @@ else
 fi
 
 skip() {
-echo "$*"
-exit 77
+echo "1..0 #SKIP $*"
+exit 0
 }
 
 if grep -q "CONFIG_GPROF=y" config-host.mak 2>/dev/null ; then
@@ -79,7 +79,7 @@ JOBS=$(echo "$MAKEFLAGS" | sed -n 's/\(^\|.* 
\)-j\([0-9]\+\)\( .*\|$\)/-j \2/p')
 
 ret=0
 for fmt in $format_list ; do
-${PYTHON} ./check $JOBS -makecheck -$fmt $group || ret=1
+${PYTHON} ./check $JOBS -tap -$fmt $group || ret=1
 done
 
 exit $ret
diff --git a/tests/qemu-iotests/check b/tests/qemu-iotests/check
index 0c27721a41..75de1b4691 100755
--- a/tests/qemu-iotests/check
+++ b/tests/qemu-iotests/check
@@ -32,8 +32,6 @@ def make_argparser() -> argparse.ArgumentParser:
 
 p.add_argument('-n', '--dry-run', action='store_true',
help='show me, do not run tests')
-p.add_argument('-makecheck', action='store_true',
-   help='pretty print output for make check')
 p.add_argument('-j', dest='jobs', type=int, default=1,
help='run tests in multiple parallel jobs')
 
@@ -53,6 +51,8 @@ def make_argparser() -> argparse.ArgumentParser:
 p.add_argument('--color', choices=['on', 'off', 'auto'],
default='auto', help="use terminal colors. The default "
"'auto' value means use colors if terminal stdout detected")
+p.add_argument('-tap', action='store_true',
+   help='produce TAP output')
 
 g_env = p.add_argument_group('test environment options')
 mg = g_env.add_mutually_exclusive_group()
@@ -164,7 +164,7 @@ if __name__ == '__main__':
 if args.dry_run:
 print('\n'.join(tests))
 else:
-with TestRunner(env, makecheck=args.makecheck,
+with TestRunner(env, tap=args.tap,
 color=args.color) as tr:
 paths = [os.path.join(env.source_iotests, t) for t in tests]
 ok = tr.run_tests(paths, args.jobs)
diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
index 94f161d59c..319a3872ef 100644
--- a/tests/qemu-iotests/meson.build
+++ b/tests/qemu-iotests/meson.build
@@ -22,6 +22,7 @@ if have_tools
 endif
 test('qemu-iotests ' + format, sh, args: [files('../check-block.sh'), 
format],
  depends: qemu_iotests_binaries, env: qemu_iotests_env,
+ protocol: 'tap',
  suite: suites,
  timeout: 0,
  is_parallel: false)
diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
index c33454fa68..0f32897fe8 100644
--- a/tests/qemu-iotests/testenv.py
+++ b/tests/qemu-iotests/testenv.py
@@ -287,21 +287,21 @@ def __enter__(self) -> 'TestEnv':
 def __exit__(self, exc_type: Any, exc_value: Any, traceback: Any) -> None:
 self.close()
 
-def print_env(self) -> None:
+def print_env(self, prefix: str = '') -> None:
 template = """\
-QEMU  -- "{QEMU_PROG}" {QEMU_OPTIONS}
-QEMU_IMG  -- "{QEMU_IMG_PROG}" {QEMU_IMG_OPTIONS}
-QEMU_IO   -- "{QEMU_IO_PROG}" {QEMU_IO_OPTIONS}
-QEMU_NBD  -- "{QEMU_NBD_PROG}" {QEMU_NBD_OPTIONS}
-IMGFMT-- {IMGFMT}{imgopts}
-IMGPROTO  -- {IMGPROTO}
-PLATFORM  -- {platform}
-TEST_DIR  -- {TEST_DIR}
-SOCK_DIR  -- {SOCK_DIR}
-GDB_OPTIONS   -- {GDB_OPTIONS}
-VALGRIND_QEMU -- {VALGRIND_QEMU}
-PRINT_QEMU_OUTPUT -- {PRINT_QEMU}
-"""
+{prefix}QEMU  -- "{QEMU_PROG}" {QEMU_OPTIONS}
+{prefix}QEMU_IMG  -- "{QEMU_IMG_PROG}" {QEMU_IMG_OPTIONS}
+{prefix}QEMU_IO   -- "{QEMU_IO_PROG}" {QEMU_IO_OPTIONS}
+{prefix}QEMU_NBD  -- "{QEMU_NBD_PROG}" {QEMU_NBD_OPTIONS}
+{prefix}IMGFMT-- {IMGFMT}{imgopts}
+{prefix}IMGPROTO  -- {IMGPROTO}
+{prefix}PLATFORM  -- {platform}
+{prefix}TEST_DIR  -- {TEST_DIR}
+{prefix}SOCK_DIR  -- {SOCK_DIR}
+{prefix}GDB_OPTIONS   -- {GDB_OPTIONS}
+{prefix}VALGRIND_QEMU -- {VALGRIND_QEMU}
+{prefix}PRINT_QEMU_OUTPUT -- {PRINT_QEMU}
+{prefix}"""
 
 args = collections.defaultdict(str, self.get_env())
 
@@ -310,5 +310,5 @@ def print_env(self) -> None:
 
 u = os.uname()
 args['platform'] = f'{u.sysname}/{u.machine} {u.nodename} {u.release}'
-
+args['prefix'] = prefix
 print(template.format_map(args))
diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py
index 15788f919e..0eace147b8 100644
--- a/tests/qemu-iotests/testrunner.py
+++ b/tests/qemu-iotests

[PATCH v4 3/4] target/riscv: add support for svinval extension

- sinval.vma, hinval.vvma and hinval.gvma do the same as sfence.vma, 
hfence.vvma and hfence.gvma except extension check
- do nothing other than extension check for sfence.w.inval and sfence.inval.ir

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Anup Patel 
---
 target/riscv/cpu.c  |  1 +
 target/riscv/cpu.h  |  1 +
 target/riscv/insn32.decode  |  7 ++
 target/riscv/insn_trans/trans_svinval.c.inc | 75 +
 target/riscv/translate.c|  1 +
 5 files changed, 85 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_svinval.c.inc

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index ff6c86c85b..45ac98e06b 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -668,6 +668,7 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_UINT16("vlen", RISCVCPU, cfg.vlen, 128),
 DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
 
+DEFINE_PROP_BOOL("svinval", RISCVCPU, cfg.ext_svinval, false),
 DEFINE_PROP_BOOL("svnapot", RISCVCPU, cfg.ext_svnapot, false),
 
 DEFINE_PROP_BOOL("zba", RISCVCPU, cfg.ext_zba, true),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index d3d17cde82..c3d1845ca1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -327,6 +327,7 @@ struct RISCVCPU {
 bool ext_counters;
 bool ext_ifencei;
 bool ext_icsr;
+bool ext_svinval;
 bool ext_svnapot;
 bool ext_zfh;
 bool ext_zfhmin;
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index 5bbedc254c..1d3ff1efe1 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -809,3 +809,10 @@ fcvt_l_h   1100010  00010 . ... . 1010011 @r2_rm
 fcvt_lu_h  1100010  00011 . ... . 1010011 @r2_rm
 fcvt_h_l   1101010  00010 . ... . 1010011 @r2_rm
 fcvt_h_lu  1101010  00011 . ... . 1010011 @r2_rm
+
+# *** Svinval Standard Extension ***
+sinval_vma0001011 . . 000 0 1110011 @sfence_vma
+sfence_w_inval0001100 0 0 000 0 1110011
+sfence_inval_ir   0001100 1 0 000 0 1110011
+hinval_vvma   0010011 . . 000 0 1110011 @hfence_vvma
+hinval_gvma   0110011 . . 000 0 1110011 @hfence_gvma
diff --git a/target/riscv/insn_trans/trans_svinval.c.inc 
b/target/riscv/insn_trans/trans_svinval.c.inc
new file mode 100644
index 00..1dde665661
--- /dev/null
+++ b/target/riscv/insn_trans/trans_svinval.c.inc
@@ -0,0 +1,75 @@
+/*
+ * RISC-V translation routines for the Svinval Standard Instruction Set.
+ *
+ * Copyright (c) 2020-2021 PLCT lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#define REQUIRE_SVINVAL(ctx) do {\
+if (!RISCV_CPU(ctx->cs)->cfg.ext_svinval) {  \
+return false;\
+}\
+} while (0)
+
+static bool trans_sinval_vma(DisasContext *ctx, arg_sinval_vma *a)
+{
+REQUIRE_SVINVAL(ctx);
+/* Do the same as sfence.vma currently */
+REQUIRE_EXT(ctx, RVS);
+#ifndef CONFIG_USER_ONLY
+gen_helper_tlb_flush(cpu_env);
+return true;
+#endif
+return false;
+}
+
+static bool trans_sfence_w_inval(DisasContext *ctx, arg_sfence_w_inval *a)
+{
+REQUIRE_SVINVAL(ctx);
+REQUIRE_EXT(ctx, RVS);
+/* Do nothing currently */
+return true;
+}
+
+static bool trans_sfence_inval_ir(DisasContext *ctx, arg_sfence_inval_ir *a)
+{
+REQUIRE_SVINVAL(ctx);
+REQUIRE_EXT(ctx, RVS);
+/* Do nothing currently */
+return true;
+}
+
+static bool trans_hinval_vvma(DisasContext *ctx, arg_hinval_vvma *a)
+{
+REQUIRE_SVINVAL(ctx);
+/* Do the same as hfence.vvma currently */
+REQUIRE_EXT(ctx, RVH);
+#ifndef CONFIG_USER_ONLY
+gen_helper_hyp_tlb_flush(cpu_env);
+return true;
+#endif
+return false;
+}
+
+static bool trans_hinval_gvma(DisasContext *ctx, arg_hinval_gvma *a)
+{
+REQUIRE_SVINVAL(ctx);
+/* Do the same as hfence.gvma currently */
+REQUIRE_EXT(ctx, RVH);
+#ifndef CONFIG_USER_ONLY
+gen_helper_hyp_gvma_tlb_flush(cpu_env);
+return true;
+#endif
+return false;
+}
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 615048ec87..4e5a9660a4 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -838,6 +838,7 @@ static uint32_t opc

[PATCH v4 1/4] target/riscv: add PTE_A/PTE_D/PTE_U bits check for inner PTE

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
Reviewed-by: Anup Patel 
---
 target/riscv/cpu_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 434a83e66a..d84cde424d 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -626,6 +626,9 @@ restart:
 return TRANSLATE_FAIL;
 } else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
 /* Inner PTE, continue walking */
+if (pte & (PTE_D | PTE_A | PTE_U)) {
+return TRANSLATE_FAIL;
+}
 base = ppn << PGSHIFT;
 } else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
 /* Reserved leaf PTE flags: PTE_W */
-- 
2.17.1

[PATCH v4 2/4] target/riscv: add support for svnapot extension

- add PTE_N bit
- add PTE_N bit check for inner PTE
- update address translation to support 64KiB continuous region (napot_bits = 4)

Signed-off-by: Weiwei Li 
Signed-off-by: Junqiang Wang 
---
 target/riscv/cpu.c|  2 ++
 target/riscv/cpu.h|  1 +
 target/riscv/cpu_bits.h   |  1 +
 target/riscv/cpu_helper.c | 22 +-
 4 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 9bc25d3055..ff6c86c85b 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -668,6 +668,8 @@ static Property riscv_cpu_properties[] = {
 DEFINE_PROP_UINT16("vlen", RISCVCPU, cfg.vlen, 128),
 DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
 
+DEFINE_PROP_BOOL("svnapot", RISCVCPU, cfg.ext_svnapot, false),
+
 DEFINE_PROP_BOOL("zba", RISCVCPU, cfg.ext_zba, true),
 DEFINE_PROP_BOOL("zbb", RISCVCPU, cfg.ext_zbb, true),
 DEFINE_PROP_BOOL("zbc", RISCVCPU, cfg.ext_zbc, true),
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 4d63086765..d3d17cde82 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -327,6 +327,7 @@ struct RISCVCPU {
 bool ext_counters;
 bool ext_ifencei;
 bool ext_icsr;
+bool ext_svnapot;
 bool ext_zfh;
 bool ext_zfhmin;
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 5a6d49aa64..bc23e3b523 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -486,6 +486,7 @@ typedef enum {
 #define PTE_A   0x040 /* Accessed */
 #define PTE_D   0x080 /* Dirty */
 #define PTE_SOFT0x300 /* Reserved for Software */
+#define PTE_N   0x8000 /* NAPOT translation */
 
 /* Page table PPN shift amount */
 #define PTE_PPN_SHIFT   10
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index d84cde424d..832a2dd79c 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -619,14 +619,17 @@ restart:
 return TRANSLATE_FAIL;
 }
 
-hwaddr ppn = pte >> PTE_PPN_SHIFT;
+hwaddr ppn = (pte & ~(target_ulong)PTE_N) >> PTE_PPN_SHIFT;
 
-if (!(pte & PTE_V)) {
+RISCVCPU *cpu = env_archcpu(env);
+if (!cpu->cfg.ext_svnapot && (pte & PTE_N)) {
+return TRANSLATE_FAIL;
+} else if (!(pte & PTE_V)) {
 /* Invalid PTE */
 return TRANSLATE_FAIL;
 } else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
 /* Inner PTE, continue walking */
-if (pte & (PTE_D | PTE_A | PTE_U)) {
+if (pte & (PTE_D | PTE_A | PTE_U | PTE_N)) {
 return TRANSLATE_FAIL;
 }
 base = ppn << PGSHIFT;
@@ -702,8 +705,17 @@ restart:
 /* for superpage mappings, make a fake leaf PTE for the TLB's
benefit. */
 target_ulong vpn = addr >> PGSHIFT;
-*physical = ((ppn | (vpn & ((1L << ptshift) - 1))) << PGSHIFT) |
-(addr & ~TARGET_PAGE_MASK);
+
+int napot_bits = ((pte & PTE_N) ? (ctzl(ppn) + 1) : 0);
+if (((pte & PTE_N) && ((ppn == 0) || (i != (levels - 1 ||
+(napot_bits != 0 && napot_bits != 4)) {
+return TRANSLATE_FAIL;
+}
+
+*physical = (((ppn & ~(((target_ulong)1 << napot_bits) - 1)) |
+  (vpn & (((target_ulong)1 << napot_bits) - 1)) |
+  (vpn & (((target_ulong)1 << ptshift) - 1))
+) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
 
 /* set permissions on the TLB entry */
 if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
-- 
2.17.1

[PATCH v4 0/4] support subsets of virtual memory extension

This patchset implements virtual memory related RISC-V extensions: Svnapot 
version 1.0, Svinval vesion 1.0, Svpbmt version 1.0. 

Specification:
https://github.com/riscv/virtual-memory/tree/main/specs

The port is available here:
https://github.com/plctlab/plct-qemu/tree/plct-virtmem-upstream-v4

To test this implementation, specify cpu argument with 
'svinval=true,svnapot=true,svpbmt=true'.

This implementation can pass the riscv-tests for rv64ssvnapot.

v4:
* fix encodings for hinval_vvma and hinval_gvma
* partition inner PTE check into several steps added in first, second and 
fourth commits
* improve commit messages to describe changes

v3:
* drop "x-" in exposed properties

v2:
* add extension check for svnapot and svpbmt

Weiwei Li (4):
  target/riscv: add PTE_A/PTE_D/PTE_U bits check for inner PTE
  target/riscv: add support for svnapot extension
  target/riscv: add support for svinval extension
  target/riscv: add support for svpbmt extension

 target/riscv/cpu.c  |  4 ++
 target/riscv/cpu.h  |  3 +
 target/riscv/cpu_bits.h |  4 ++
 target/riscv/cpu_helper.c   | 27 ++--
 target/riscv/insn32.decode  |  7 ++
 target/riscv/insn_trans/trans_svinval.c.inc | 75 +
 target/riscv/translate.c|  1 +
 7 files changed, 117 insertions(+), 4 deletions(-)
 create mode 100644 target/riscv/insn_trans/trans_svinval.c.inc

-- 
2.17.1

[PATCH v4 4/4] target/riscv: add support for svpbmt extension