[PATCH 00/22] hw/core/cpu: Remove @CPUState::as field

[PATCH 00/22] hw/core/cpu: Remove @CPUState::as field

[Philippe Mathieu-Daudé]

Instead of using the convenient @CPUState::as shortcut, use
cpu_get_address_space(asidx=0) to get the vCPU first address
space.

The goal is to reduce the risk of AS mis-use for targets
that uses multiple ASes per vCPU.

Based-on: <20251001082127.65741-1-philmd@linaro.org>

Philippe Mathieu-Daudé (22):
  system/qtest: Use &address_space_memory for first vCPU address space
  disas/disas-mon: Get cpu first addr space with cpu_get_address_space()
  monitor/hmp-cmds: Get cpu first addr space with
    cpu_get_address_space()
  hw/core/loader: Get cpu first addr space with cpu_get_address_space()
  hw/ppc: Get cpu first addr space with cpu_get_address_space()
  hw/m86k: Get cpu first addr space with cpu_get_address_space()
  target/xtensa: Get cpu first addr space with cpu_get_address_space()
  target/riscv: Get cpu first addr space with cpu_get_address_space()
  semihosting: Get cpu first addr space with cpu_get_address_space()
  target/alpha: Get cpu first addr space with cpu_get_address_space()
  target/arm: Get cpu first addr space with cpu_get_address_space()
  target/hppa: Get cpu first addr space with cpu_get_address_space()
  target/i386: Get cpu first addr space with cpu_get_address_space()
  target/loongarch: Get cpu first addr space with
    cpu_get_address_space()
  target/m68k: Get cpu first addr space with cpu_get_address_space()
  target/microblaze: Get cpu first addr space with
    cpu_get_address_space()
  target/ppc: Get cpu first addr space with cpu_get_address_space()
  target/s390x: Get cpu first addr space with cpu_get_address_space()
  target/sparc: Get cpu first addr space with cpu_get_address_space()
  hw/core/cpu: Remove @CPUState::as field
  exec/cpu: Declare cpu_memory_rw_debug() in 'hw/core/cpu.h' and
    document
  target/sparc: Reduce inclusions of 'exec/cpu-common.h'

 include/exec/cpu-common.h         |  4 ---
 include/hw/core/cpu.h             | 23 +++++++++++--
 target/ppc/mmu-hash32.h           | 12 ++++---
 target/sparc/cpu.h                |  1 -
 disas/disas-mon.c                 |  3 +-
 hw/core/cpu-common.c              |  1 -
 hw/core/generic-loader.c          |  5 +--
 hw/intc/spapr_xive.c              |  5 +--
 hw/m68k/mcf5208.c                 |  6 ++--
 hw/m68k/q800.c                    | 17 ++++++----
 hw/m68k/virt.c                    |  5 +--
 hw/ppc/pegasos2.c                 |  2 +-
 hw/ppc/spapr.c                    | 12 +++----
 hw/ppc/spapr_hcall.c              | 55 ++++++++++++++++---------------
 hw/ppc/spapr_iommu.c              |  4 +--
 hw/ppc/spapr_nested.c             | 43 +++++++++++++-----------
 monitor/hmp-cmds-target.c         |  3 +-
 semihosting/arm-compat-semi.c     |  4 ++-
 system/cpus.c                     |  2 +-
 system/physmem.c                  | 10 ------
 system/qtest.c                    | 27 +++++++--------
 target/alpha/helper.c             |  8 +++--
 target/arm/cpu.c                  |  7 ++--
 target/hppa/int_helper.c          |  3 +-
 target/i386/arch_memory_mapping.c | 10 +++---
 target/loongarch/cpu_helper.c     |  5 +--
 target/loongarch/tcg/tlb_helper.c |  7 ++--
 target/m68k/helper.c              | 28 ++++++++--------
 target/microblaze/op_helper.c     |  6 ++--
 target/ppc/excp_helper.c          |  4 +--
 target/ppc/mmu-book3s-v3.c        |  5 +--
 target/ppc/mmu-hash32.c           |  6 ++--
 target/ppc/mmu-hash64.c           | 12 ++++---
 target/ppc/mmu-radix64.c          | 13 ++++----
 target/riscv/cpu_helper.c         |  7 ++--
 target/s390x/cpu-system.c         |  4 ++-
 target/s390x/mmu_helper.c         |  9 ++---
 target/s390x/tcg/excp_helper.c    | 10 +++---
 target/s390x/tcg/mem_helper.c     |  6 ++--
 target/sparc/helper.c             |  1 +
 target/sparc/int64_helper.c       |  1 +
 target/sparc/ldst_helper.c        | 22 +++++++------
 target/sparc/mmu_helper.c         | 21 +++++++-----
 target/xtensa/mmu_helper.c        |  3 +-
 44 files changed, 253 insertions(+), 189 deletions(-)

-- 
2.51.0

[PATCH 01/22] system/qtest: Use &address_space_memory for first vCPU address space

[Philippe Mathieu-Daudé]

The QTest framework implementation of the read/write[bwlq]
commands doesn't care about which address space is used.
Historically it accessed the default address space of the
first vCPU (although this is dubious since there is no vCPU
within QTest).

On all targets the first address space is &address_space_memory:

* Only ARM and X86 call cpu_address_space_init() to set an AS,
  and the index #0 is &address_space_memory:

    target/arm/cpu.h:2505:    ARMASIdx_NS = 0,
    target/arm/cpu.c:2162:    cpu_address_space_init(cs, ARMASIdx_NS, "cpu-memory", cs->memory);

    target/i386/cpu.h:2578:    X86ASIdx_MEM = 0,
    target/i386/kvm/kvm-cpu.c:102:    cpu_address_space_init(cs, X86ASIdx_MEM, "cpu-memory", cs->memory);
    target/i386/tcg/system/tcg-cpu.c:77:    cpu_address_space_init(cs, X86ASIdx_MEM, "cpu-memory", cs->memory);

* Other targets don't call cpu_address_space_init() so default
  to &address_space_memory.

Directly use '&address_space_memory' instead of first_cpu->as.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/qtest.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/system/qtest.c b/system/qtest.c
index fa42c9f9215..62bb9120dc7 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -16,6 +16,7 @@
 #include "system/qtest.h"
 #include "system/runstate.h"
 #include "chardev/char-fe.h"
+#include "system/address-spaces.h"
 #include "system/ioport.h"
 #include "system/memory.h"
 #include "exec/tswap.h"
@@ -512,22 +513,22 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
 
         if (words[0][5] == 'b') {
             uint8_t data = value;
-            address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                 &data, 1);
         } else if (words[0][5] == 'w') {
             uint16_t data = value;
             tswap16s(&data);
-            address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                 &data, 2);
         } else if (words[0][5] == 'l') {
             uint32_t data = value;
             tswap32s(&data);
-            address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                 &data, 4);
         } else if (words[0][5] == 'q') {
             uint64_t data = value;
             tswap64s(&data);
-            address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                 &data, 8);
         }
         qtest_send(chr, "OK\n");
@@ -545,21 +546,21 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
 
         if (words[0][4] == 'b') {
             uint8_t data;
-            address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                &data, 1);
             value = data;
         } else if (words[0][4] == 'w') {
             uint16_t data;
-            address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                &data, 2);
             value = tswap16(data);
         } else if (words[0][4] == 'l') {
             uint32_t data;
-            address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                &data, 4);
             value = tswap32(data);
         } else if (words[0][4] == 'q') {
-            address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                &value, 8);
             tswap64s(&value);
         }
@@ -579,7 +580,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
         g_assert(len);
 
         data = g_malloc(len);
-        address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
+        address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED, data,
                            len);
 
         enc = qemu_hexdump_line(NULL, data, len, 0, 0);
@@ -600,7 +601,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
         g_assert(ret == 0);
 
         data = g_malloc(len);
-        address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
+        address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED, data,
                            len);
         b64_data = g_base64_encode(data, len);
         qtest_sendf(chr, "OK %s\n", b64_data);
@@ -634,7 +635,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
                 data[i] = 0;
             }
         }
-        address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
+        address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED, data,
                             len);
         g_free(data);
 
@@ -656,7 +657,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
         if (len) {
             data = g_malloc(len);
             memset(data, pattern, len);
-            address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
+            address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
                                 data, len);
             g_free(data);
         }
@@ -689,7 +690,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
             out_len = MIN(out_len, len);
         }
 
-        address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
+        address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED, data,
                             len);
 
         qtest_send(chr, "OK\n");
-- 
2.51.0

[PATCH 02/22] disas/disas-mon: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 disas/disas-mon.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/disas/disas-mon.c b/disas/disas-mon.c
index 9c693618c27..f2e45d16021 100644
--- a/disas/disas-mon.c
+++ b/disas/disas-mon.c
@@ -29,9 +29,10 @@ physical_read_memory(bfd_vma memaddr, bfd_byte *myaddr, int length,
                      struct disassemble_info *info)
 {
     CPUDebug *s = container_of(info, CPUDebug, info);
+    AddressSpace *as = cpu_get_address_space(s->cpu, 0);
     MemTxResult res;
 
-    res = address_space_read(s->cpu->as, memaddr, MEMTXATTRS_UNSPECIFIED,
+    res = address_space_read(as, memaddr, MEMTXATTRS_UNSPECIFIED,
                              myaddr, length);
     return res == MEMTX_OK ? 0 : EIO;
 }
-- 
2.51.0

[PATCH 03/22] monitor/hmp-cmds: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 monitor/hmp-cmds-target.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
index e9820611466..602af851328 100644
--- a/monitor/hmp-cmds-target.c
+++ b/monitor/hmp-cmds-target.c
@@ -128,6 +128,8 @@ static void memory_dump(Monitor *mon, int count, int format, int wsize,
     uint8_t buf[16];
     uint64_t v;
     CPUState *cs = mon_get_cpu(mon);
+    AddressSpace *as = cs ? cpu_get_address_space(cs, 0)
+                          : &address_space_memory;
 
     if (!cs && (format == 'i' || !is_physical)) {
         monitor_printf(mon, "Can not dump without CPU\n");
@@ -174,7 +176,6 @@ static void memory_dump(Monitor *mon, int count, int format, int wsize,
         if (l > line_size)
             l = line_size;
         if (is_physical) {
-            AddressSpace *as = cs ? cs->as : &address_space_memory;
             MemTxResult r = address_space_read(as, addr,
                                                MEMTXATTRS_UNSPECIFIED, buf, l);
             if (r != MEMTX_OK) {
-- 
2.51.0

[PATCH 04/22] hw/core/loader: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/generic-loader.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/core/generic-loader.c b/hw/core/generic-loader.c
index e72bbde2a23..cc8eacdf067 100644
--- a/hw/core/generic-loader.c
+++ b/hw/core/generic-loader.c
@@ -52,8 +52,9 @@ static void generic_loader_reset(void *opaque)
     }
 
     if (s->data_len) {
+        AddressSpace *as = cpu_get_address_space(s->cpu, 0);
         assert(s->data_len <= sizeof(s->data));
-        dma_memory_write(s->cpu->as, s->addr, &s->data, s->data_len,
+        dma_memory_write(as, s->addr, &s->data, s->data_len,
                          MEMTXATTRS_UNSPECIFIED);
     }
 }
@@ -130,7 +131,7 @@ static void generic_loader_realize(DeviceState *dev, Error **errp)
     }
 
     if (s->file) {
-        AddressSpace *as = s->cpu ? s->cpu->as :  NULL;
+        AddressSpace *as = cpu_get_address_space(s->cpu, 0);
 
         if (!s->force_raw) {
             size = load_elf_as(s->file, NULL, NULL, NULL, &entry, NULL, NULL,
-- 
2.51.0

[PATCH 05/22] hw/ppc: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/intc/spapr_xive.c  |  5 ++--
 hw/ppc/pegasos2.c     |  2 +-
 hw/ppc/spapr.c        | 12 +++++-----
 hw/ppc/spapr_hcall.c  | 55 +++++++++++++++++++++++--------------------
 hw/ppc/spapr_iommu.c  |  4 ++--
 hw/ppc/spapr_nested.c | 43 ++++++++++++++++++---------------
 6 files changed, 65 insertions(+), 56 deletions(-)

diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index e393f5dcdcc..b68961e1bf5 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -1391,6 +1391,7 @@ static target_ulong h_int_set_queue_config(PowerPCCPU *cpu,
     }
 
     if (qsize) {
+        AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
         hwaddr plen = 1 << qsize;
         void *eq;
 
@@ -1398,14 +1399,14 @@ static target_ulong h_int_set_queue_config(PowerPCCPU *cpu,
          * Validate the guest EQ. We should also check that the queue
          * has been zeroed by the OS.
          */
-        eq = address_space_map(CPU(cpu)->as, qpage, &plen, true,
+        eq = address_space_map(as, qpage, &plen, true,
                                MEMTXATTRS_UNSPECIFIED);
         if (plen != 1 << qsize) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to map EQ @0x%"
                           HWADDR_PRIx "\n", qpage);
             return H_P4;
         }
-        address_space_unmap(CPU(cpu)->as, eq, plen, true, plen);
+        address_space_unmap(as, eq, plen, true, plen);
     }
 
     /* "target" should have been validated above */
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index e15cf964278..86c6a73236b 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -451,7 +451,7 @@ enum pegasos2_rtas_tokens {
 static target_ulong pegasos2_rtas(PowerPCCPU *cpu, Pegasos2MachineState *pm,
                                   target_ulong args_real)
 {
-    AddressSpace *as = CPU(cpu)->as;
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     uint32_t token = ldl_be_phys(as, args_real);
     uint32_t nargs = ldl_be_phys(as, args_real + 4);
     uint32_t nrets = ldl_be_phys(as, args_real + 8);
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 15d09ef9618..b8aa0352ab2 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4550,10 +4550,10 @@ static void spapr_cpu_exec_enter(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
 
     spapr_cpu->prod = false;
     if (spapr_cpu->vpa_addr) {
-        CPUState *cs = CPU(cpu);
+        AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
         uint32_t dispatch;
 
-        dispatch = ldl_be_phys(cs->as,
+        dispatch = ldl_be_phys(as,
                                spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
         dispatch++;
         if ((dispatch & 1) != 0) {
@@ -4562,7 +4562,7 @@ static void spapr_cpu_exec_enter(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
                           "dispatched partition %u, correcting.\n", dispatch);
             dispatch++;
         }
-        stl_be_phys(cs->as,
+        stl_be_phys(as,
                     spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER, dispatch);
     }
 }
@@ -4572,10 +4572,10 @@ static void spapr_cpu_exec_exit(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
 
     if (spapr_cpu->vpa_addr) {
-        CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
         uint32_t dispatch;
 
-        dispatch = ldl_be_phys(cs->as,
+        dispatch = ldl_be_phys(as,
                                spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
         dispatch++;
         if ((dispatch & 1) != 1) {
@@ -4584,7 +4584,7 @@ static void spapr_cpu_exec_exit(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
                           "preempted partition %u, correcting.\n", dispatch);
             dispatch++;
         }
-        stl_be_phys(cs->as,
+        stl_be_phys(as,
                     spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER, dispatch);
     }
 }
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 8c1e0a4817b..be83b5591b5 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -321,7 +321,7 @@ unmap_out:
 
 static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
 {
-    CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     CPUPPCState *env = &cpu->env;
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
     uint16_t size;
@@ -337,7 +337,7 @@ static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
     }
     /* FIXME: bounds check the address */
 
-    size = lduw_be_phys(cs->as, vpa + 0x4);
+    size = lduw_be_phys(as, vpa + 0x4);
 
     if (size < VPA_MIN_SIZE) {
         return H_PARAMETER;
@@ -350,9 +350,9 @@ static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
 
     spapr_cpu->vpa_addr = vpa;
 
-    tmp = ldub_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET);
+    tmp = ldub_phys(as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET);
     tmp |= VPA_SHARED_PROC_VAL;
-    stb_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET, tmp);
+    stb_phys(as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET, tmp);
 
     return H_SUCCESS;
 }
@@ -375,6 +375,7 @@ static target_ulong deregister_vpa(PowerPCCPU *cpu, target_ulong vpa)
 
 static target_ulong register_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
     uint32_t size;
 
@@ -383,7 +384,7 @@ static target_ulong register_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
         return H_HARDWARE;
     }
 
-    size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
+    size = ldl_be_phys(as, addr + 0x4);
     if (size < 0x8) {
         return H_PARAMETER;
     }
@@ -413,6 +414,7 @@ static target_ulong deregister_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
 
 static target_ulong register_dtl(PowerPCCPU *cpu, target_ulong addr)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
     uint32_t size;
 
@@ -421,7 +423,7 @@ static target_ulong register_dtl(PowerPCCPU *cpu, target_ulong addr)
         return H_HARDWARE;
     }
 
-    size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
+    size = ldl_be_phys(as, addr + 0x4);
 
     if (size < 48) {
         return H_PARAMETER;
@@ -579,6 +581,7 @@ static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
     target_long target = args[0];
     uint32_t dispatch = args[1];
     CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     SpaprCpuState *spapr_cpu;
 
     assert(tcg_enabled()); /* KVM will have handled this */
@@ -608,7 +611,7 @@ static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
             return H_SUCCESS;
         }
 
-        target_dispatch = ldl_be_phys(cs->as,
+        target_dispatch = ldl_be_phys(as,
                                   spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
         if (target_dispatch != dispatch) {
             return H_SUCCESS;
@@ -667,22 +670,22 @@ static target_ulong h_rtas(PowerPCCPU *cpu, SpaprMachineState *spapr,
 static target_ulong h_logical_load(PowerPCCPU *cpu, SpaprMachineState *spapr,
                                    target_ulong opcode, target_ulong *args)
 {
-    CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong size = args[0];
     target_ulong addr = args[1];
 
     switch (size) {
     case 1:
-        args[0] = ldub_phys(cs->as, addr);
+        args[0] = ldub_phys(as, addr);
         return H_SUCCESS;
     case 2:
-        args[0] = lduw_phys(cs->as, addr);
+        args[0] = lduw_phys(as, addr);
         return H_SUCCESS;
     case 4:
-        args[0] = ldl_phys(cs->as, addr);
+        args[0] = ldl_phys(as, addr);
         return H_SUCCESS;
     case 8:
-        args[0] = ldq_phys(cs->as, addr);
+        args[0] = ldq_phys(as, addr);
         return H_SUCCESS;
     }
     return H_PARAMETER;
@@ -691,7 +694,7 @@ static target_ulong h_logical_load(PowerPCCPU *cpu, SpaprMachineState *spapr,
 static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
                                     target_ulong opcode, target_ulong *args)
 {
-    CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
 
     target_ulong size = args[0];
     target_ulong addr = args[1];
@@ -699,16 +702,16 @@ static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
 
     switch (size) {
     case 1:
-        stb_phys(cs->as, addr, val);
+        stb_phys(as, addr, val);
         return H_SUCCESS;
     case 2:
-        stw_phys(cs->as, addr, val);
+        stw_phys(as, addr, val);
         return H_SUCCESS;
     case 4:
-        stl_phys(cs->as, addr, val);
+        stl_phys(as, addr, val);
         return H_SUCCESS;
     case 8:
-        stq_phys(cs->as, addr, val);
+        stq_phys(as, addr, val);
         return H_SUCCESS;
     }
     return H_PARAMETER;
@@ -717,7 +720,7 @@ static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
 static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
                                     target_ulong opcode, target_ulong *args)
 {
-    CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
 
     target_ulong dst   = args[0]; /* Destination address */
     target_ulong src   = args[1]; /* Source address */
@@ -745,16 +748,16 @@ static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
     while (count--) {
         switch (esize) {
         case 0:
-            tmp = ldub_phys(cs->as, src);
+            tmp = ldub_phys(as, src);
             break;
         case 1:
-            tmp = lduw_phys(cs->as, src);
+            tmp = lduw_phys(as, src);
             break;
         case 2:
-            tmp = ldl_phys(cs->as, src);
+            tmp = ldl_phys(as, src);
             break;
         case 3:
-            tmp = ldq_phys(cs->as, src);
+            tmp = ldq_phys(as, src);
             break;
         default:
             return H_PARAMETER;
@@ -764,16 +767,16 @@ static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
         }
         switch (esize) {
         case 0:
-            stb_phys(cs->as, dst, tmp);
+            stb_phys(as, dst, tmp);
             break;
         case 1:
-            stw_phys(cs->as, dst, tmp);
+            stw_phys(as, dst, tmp);
             break;
         case 2:
-            stl_phys(cs->as, dst, tmp);
+            stl_phys(as, dst, tmp);
             break;
         case 3:
-            stq_phys(cs->as, dst, tmp);
+            stq_phys(as, dst, tmp);
             break;
         }
         dst = dst + step;
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index c2432a0c00c..8b0c8bff8ef 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -485,7 +485,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
     target_ulong npages = args[3];
     target_ulong ret = H_PARAMETER, tce = 0;
     SpaprTceTable *tcet = spapr_tce_find_by_liobn(liobn);
-    CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     hwaddr page_mask, page_size;
 
     if (!tcet) {
@@ -501,7 +501,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
     ioba &= page_mask;
 
     for (i = 0; i < npages; ++i, ioba += page_size) {
-        tce = ldq_be_phys(cs->as, tce_list + i * sizeof(target_ulong));
+        tce = ldq_be_phys(as, tce_list + i * sizeof(target_ulong));
 
         ret = put_tce_emu(tcet, ioba, tce);
         if (ret) {
diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
index 10cf634da19..0486820e2ce 100644
--- a/hw/ppc/spapr_nested.c
+++ b/hw/ppc/spapr_nested.c
@@ -36,6 +36,7 @@ uint8_t spapr_nested_api(SpaprMachineState *spapr)
 bool spapr_get_pate_nested_hv(SpaprMachineState *spapr, PowerPCCPU *cpu,
                               target_ulong lpid, ppc_v3_pate_t *entry)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     uint64_t patb, pats;
 
     assert(lpid != 0);
@@ -56,8 +57,8 @@ bool spapr_get_pate_nested_hv(SpaprMachineState *spapr, PowerPCCPU *cpu,
 
     /* Grab entry */
     patb += 16 * lpid;
-    entry->dw0 = ldq_phys(CPU(cpu)->as, patb);
-    entry->dw1 = ldq_phys(CPU(cpu)->as, patb + 8);
+    entry->dw0 = ldq_phys(as, patb);
+    entry->dw1 = ldq_phys(as, patb + 8);
     return true;
 }
 
@@ -329,6 +330,7 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
     struct nested_ppc_state l2_state;
     target_ulong hv_ptr = args[0];
@@ -345,16 +347,16 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
     }
 
     len = sizeof(*hvstate);
-    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, false,
+    hvstate = address_space_map(as, hv_ptr, &len, false,
                                 MEMTXATTRS_UNSPECIFIED);
     if (len != sizeof(*hvstate)) {
-        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, false);
+        address_space_unmap(as, hvstate, len, 0, false);
         return H_PARAMETER;
     }
 
     memcpy(&hv_state, hvstate, len);
 
-    address_space_unmap(CPU(cpu)->as, hvstate, len, len, false);
+    address_space_unmap(as, hvstate, len, len, false);
 
     /*
      * We accept versions 1 and 2. Version 2 fields are unused because TCG
@@ -378,10 +380,10 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
     nested_save_state(spapr_cpu->nested_host_state, cpu);
 
     len = sizeof(*regs);
-    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, false,
+    regs = address_space_map(as, regs_ptr, &len, false,
                                 MEMTXATTRS_UNSPECIFIED);
     if (!regs || len != sizeof(*regs)) {
-        address_space_unmap(CPU(cpu)->as, regs, len, 0, false);
+        address_space_unmap(as, regs, len, 0, false);
         g_free(spapr_cpu->nested_host_state);
         return H_P2;
     }
@@ -397,7 +399,7 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
     l2_state.msr = regs->msr;
     l2_state.nip = regs->nip;
 
-    address_space_unmap(CPU(cpu)->as, regs, len, len, false);
+    address_space_unmap(as, regs, len, len, false);
 
     l2_state.cfar = hv_state.cfar;
     l2_state.lpidr = hv_state.lpid;
@@ -460,6 +462,7 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
 {
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
     struct nested_ppc_state l2_state;
     target_ulong hv_ptr = spapr_cpu->nested_host_state->gpr[4];
@@ -492,10 +495,10 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
     spapr_cpu->nested_host_state = NULL;
 
     len = sizeof(*hvstate);
-    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, true,
+    hvstate = address_space_map(as, hv_ptr, &len, true,
                                 MEMTXATTRS_UNSPECIFIED);
     if (len != sizeof(*hvstate)) {
-        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, true);
+        address_space_unmap(as, hvstate, len, 0, true);
         env->gpr[3] = H_PARAMETER;
         return;
     }
@@ -525,13 +528,13 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
     hvstate->ppr = l2_state.ppr;
 
     /* Is it okay to specify write length larger than actual data written? */
-    address_space_unmap(CPU(cpu)->as, hvstate, len, len, true);
+    address_space_unmap(as, hvstate, len, len, true);
 
     len = sizeof(*regs);
-    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, true,
+    regs = address_space_map(as, regs_ptr, &len, true,
                                 MEMTXATTRS_UNSPECIFIED);
     if (!regs || len != sizeof(*regs)) {
-        address_space_unmap(CPU(cpu)->as, regs, len, 0, true);
+        address_space_unmap(as, regs, len, 0, true);
         env->gpr[3] = H_P2;
         return;
     }
@@ -556,7 +559,7 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
     }
 
     /* Is it okay to specify write length larger than actual data written? */
-    address_space_unmap(CPU(cpu)->as, regs, len, len, true);
+    address_space_unmap(as, regs, len, len, true);
 }
 
 static bool spapr_nested_vcpu_check(SpaprMachineStateNestedGuest *guest,
@@ -1506,6 +1509,7 @@ static target_ulong map_and_getset_state(PowerPCCPU *cpu,
                                          uint64_t vcpuid,
                                          struct guest_state_request *gsr)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong rc;
     int64_t len;
     bool is_write;
@@ -1513,7 +1517,7 @@ static target_ulong map_and_getset_state(PowerPCCPU *cpu,
     len = gsr->len;
     /* only get_state would require write access to the provided buffer */
     is_write = (gsr->flags & GUEST_STATE_REQUEST_SET) ? false : true;
-    gsr->gsb = address_space_map(CPU(cpu)->as, gsr->buf, (uint64_t *)&len,
+    gsr->gsb = address_space_map(as, gsr->buf, (uint64_t *)&len,
                                  is_write, MEMTXATTRS_UNSPECIFIED);
     if (!gsr->gsb) {
         rc = H_P3;
@@ -1528,7 +1532,7 @@ static target_ulong map_and_getset_state(PowerPCCPU *cpu,
     rc = getset_state(spapr, guest, vcpuid, gsr);
 
 out1:
-    address_space_unmap(CPU(cpu)->as, gsr->gsb, len, is_write, len);
+    address_space_unmap(as, gsr->gsb, len, is_write, len);
     return rc;
 }
 
@@ -1699,6 +1703,7 @@ static void exit_process_output_buffer(SpaprMachineState *spapr,
                                        target_ulong vcpuid,
                                        target_ulong *r3)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     SpaprMachineStateNestedGuestVcpu *vcpu = &guest->vcpus[vcpuid];
     struct guest_state_request gsr;
     struct guest_state_buffer *gsb;
@@ -1709,10 +1714,10 @@ static void exit_process_output_buffer(SpaprMachineState *spapr,
     hwaddr len;
 
     len = vcpu->runbufout.size;
-    gsb = address_space_map(CPU(cpu)->as, vcpu->runbufout.addr, &len, true,
+    gsb = address_space_map(as, vcpu->runbufout.addr, &len, true,
                             MEMTXATTRS_UNSPECIFIED);
     if (!gsb || len != vcpu->runbufout.size) {
-        address_space_unmap(CPU(cpu)->as, gsb, len, true, len);
+        address_space_unmap(as, gsb, len, true, len);
         *r3 = H_P2;
         return;
     }
@@ -1734,7 +1739,7 @@ static void exit_process_output_buffer(SpaprMachineState *spapr,
     gsr.flags = 0; /* get + never guest wide */
     getset_state(spapr, guest, vcpuid, &gsr);
 
-    address_space_unmap(CPU(cpu)->as, gsb, len, true, len);
+    address_space_unmap(as, gsb, len, true, len);
 }
 
 static
-- 
2.51.0

[PATCH 06/22] hw/m86k: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/m68k/mcf5208.c |  6 ++++--
 hw/m68k/q800.c    | 17 ++++++++++-------
 hw/m68k/virt.c    |  5 +++--
 3 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
index 75cc076f787..9354829e8a4 100644
--- a/hw/m68k/mcf5208.c
+++ b/hw/m68k/mcf5208.c
@@ -206,12 +206,14 @@ static void m5208_rcm_write(void *opaque, hwaddr addr,
 {
     M68kCPU *cpu = opaque;
     CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
+
     switch (addr) {
     case 0x0: /* RCR */
         if (value & RCR_SOFTRST) {
             cpu_reset(cs);
-            cpu->env.aregs[7] = ldl_phys(cs->as, 0);
-            cpu->env.pc = ldl_phys(cs->as, 4);
+            cpu->env.aregs[7] = ldl_phys(as, 0);
+            cpu->env.pc = ldl_phys(as, 4);
         }
         break;
     default:
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 793b23f8155..9ec7122a4f8 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -107,10 +107,11 @@ static void main_cpu_reset(void *opaque)
 {
     M68kCPU *cpu = opaque;
     CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
 
     cpu_reset(cs);
-    cpu->env.aregs[7] = ldl_phys(cs->as, 0);
-    cpu->env.pc = ldl_phys(cs->as, 4);
+    cpu->env.aregs[7] = ldl_phys(as, 0);
+    cpu->env.pc = ldl_phys(as, 4);
 }
 
 static void rerandomize_rng_seed(void *opaque)
@@ -263,6 +264,7 @@ static void q800_machine_init(MachineState *machine)
     const char *bios_name = machine->firmware ?: MACROM_FILENAME;
     hwaddr parameters_base;
     CPUState *cs;
+    AddressSpace *cpu_as;
     DeviceState *dev;
     SysBusESPState *sysbus_esp;
     ESPState *esp;
@@ -573,6 +575,7 @@ static void q800_machine_init(MachineState *machine)
     macfb_mode = (NUBUS_MACFB(dev)->macfb).mode;
 
     cs = CPU(&m->cpu);
+    cpu_as = cpu_get_address_space(cs, 0);
     if (linux_boot) {
         uint64_t high;
         void *param_blob, *param_ptr, *param_rng_seed;
@@ -590,7 +593,7 @@ static void q800_machine_init(MachineState *machine)
             error_report("could not load kernel '%s'", kernel_filename);
             exit(1);
         }
-        stl_phys(cs->as, 4, elf_entry); /* reset initial PC */
+        stl_phys(cpu_as, 4, elf_entry); /* reset initial PC */
         parameters_base = (high + 1) & ~1;
         param_ptr = param_blob;
 
@@ -647,9 +650,9 @@ static void q800_machine_init(MachineState *machine)
         }
         BOOTINFO0(param_ptr, BI_LAST);
         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
-                              parameters_base, cs->as);
+                              parameters_base, cpu_as);
         qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
-                            rom_ptr_for_as(cs->as, parameters_base,
+                            rom_ptr_for_as(cpu_as, parameters_base,
                                            param_ptr - param_blob) +
                             (param_rng_seed - param_blob));
         g_free(param_blob);
@@ -683,8 +686,8 @@ static void q800_machine_init(MachineState *machine)
 
             ptr = rom_ptr(MACROM_ADDR, bios_size);
             assert(ptr != NULL);
-            stl_phys(cs->as, 0, ldl_be_p(ptr));    /* reset initial SP */
-            stl_phys(cs->as, 4,
+            stl_phys(cpu_as, 0, ldl_be_p(ptr));    /* reset initial SP */
+            stl_phys(cpu_as, 4,
                      MACROM_ADDR + ldl_be_p(ptr + 4)); /* reset initial PC */
         }
     }
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index 98cfe43c73a..e5ce0c28878 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -219,6 +219,7 @@ static void virt_init(MachineState *machine)
 
     if (kernel_filename) {
         CPUState *cs = CPU(cpu);
+        AddressSpace *as = cpu_get_address_space(cs, 0);
         uint64_t high;
         void *param_blob, *param_ptr, *param_rng_seed;
 
@@ -301,9 +302,9 @@ static void virt_init(MachineState *machine)
         }
         BOOTINFO0(param_ptr, BI_LAST);
         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
-                              parameters_base, cs->as);
+                              parameters_base, as);
         qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
-                            rom_ptr_for_as(cs->as, parameters_base,
+                            rom_ptr_for_as(as, parameters_base,
                                            param_ptr - param_blob) +
                             (param_rng_seed - param_blob));
         g_free(param_blob);
-- 
2.51.0

[PATCH 07/22] target/xtensa: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/xtensa/mmu_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/xtensa/mmu_helper.c b/target/xtensa/mmu_helper.c
index 71330fc84b9..9c868ec3cde 100644
--- a/target/xtensa/mmu_helper.c
+++ b/target/xtensa/mmu_helper.c
@@ -889,9 +889,10 @@ static bool get_pte(CPUXtensaState *env, uint32_t vaddr, uint32_t *pte)
     }
 
     if (ret == 0) {
+        AddressSpace *as = cpu_get_address_space(cs, 0);
         MemTxResult result;
 
-        *pte = address_space_ldl(cs->as, paddr, MEMTXATTRS_UNSPECIFIED,
+        *pte = address_space_ldl(as, paddr, MEMTXATTRS_UNSPECIFIED,
                                  &result);
         if (result != MEMTX_OK) {
             qemu_log_mask(CPU_LOG_MMU,
-- 
2.51.0

[PATCH 08/22] target/riscv: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/riscv/cpu_helper.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 3479a62cc7f..d28230d12ea 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -1282,6 +1282,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     CPUState *cs = env_cpu(env);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
     int va_bits = PGSHIFT + levels * ptidxbits + widened;
     int sxlen = 16 << riscv_cpu_sxl(env);
     int sxlen_bytes = sxlen / 8;
@@ -1365,9 +1366,9 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         }
 
         if (riscv_cpu_mxl(env) == MXL_RV32) {
-            pte = address_space_ldl(cs->as, pte_addr, attrs, &res);
+            pte = address_space_ldl(as, pte_addr, attrs, &res);
         } else {
-            pte = address_space_ldq(cs->as, pte_addr, attrs, &res);
+            pte = address_space_ldq(as, pte_addr, attrs, &res);
         }
 
         if (res != MEMTX_OK) {
@@ -1561,7 +1562,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
          */
         MemoryRegion *mr;
         hwaddr l = sxlen_bytes, addr1;
-        mr = address_space_translate(cs->as, pte_addr, &addr1, &l,
+        mr = address_space_translate(as, pte_addr, &addr1, &l,
                                      false, MEMTXATTRS_UNSPECIFIED);
         if (memory_region_is_ram(mr)) {
             target_ulong *pte_pa = qemu_map_ram_ptr(mr->ram_block, addr1);
-- 
2.51.0

[PATCH 09/22] semihosting: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 semihosting/arm-compat-semi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 61001267965..4c282aea5d6 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -149,12 +149,14 @@ static bool find_ram_cb(Int128 start, Int128 len, const MemoryRegion *mr,
 
 static LayoutInfo common_semi_find_bases(CPUState *cs)
 {
+    AddressSpace *as;
     FlatView *fv;
     LayoutInfo info = { 0, 0, 0, 0 };
 
     RCU_READ_LOCK_GUARD();
 
-    fv = address_space_to_flatview(cs->as);
+    as = cpu_get_address_space(cs, 0);
+    fv = address_space_to_flatview(as);
     flatview_for_each_range(fv, find_ram_cb, &info);
 
     /*
-- 
2.51.0

[PATCH 10/22] target/alpha: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/alpha/helper.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/alpha/helper.c b/target/alpha/helper.c
index 096eac34458..8819f0b6cb5 100644
--- a/target/alpha/helper.c
+++ b/target/alpha/helper.c
@@ -175,6 +175,7 @@ static int get_physical_address(CPUAlphaState *env, target_ulong addr,
     target_ulong pt, index;
     int prot = 0;
     int ret = MM_K_ACV;
+    AddressSpace *as;
 
     /* Handle physical accesses.  */
     if (mmu_idx == MMU_PHYS_IDX) {
@@ -211,6 +212,7 @@ static int get_physical_address(CPUAlphaState *env, target_ulong addr,
 
     /* Interpret the page table exactly like PALcode does.  */
 
+    as = cpu_get_address_space(cs, 0);
     pt = env->ptbr;
 
     /* TODO: rather than using ldq_phys() to read the page table we should
@@ -223,7 +225,7 @@ static int get_physical_address(CPUAlphaState *env, target_ulong addr,
 
     /* L1 page table read.  */
     index = (addr >> (TARGET_PAGE_BITS + 20)) & 0x3ff;
-    L1pte = ldq_phys(cs->as, pt + index*8);
+    L1pte = ldq_phys(as, pt + index*8);
 
     if (unlikely((L1pte & PTE_VALID) == 0)) {
         ret = MM_K_TNV;
@@ -236,7 +238,7 @@ static int get_physical_address(CPUAlphaState *env, target_ulong addr,
 
     /* L2 page table read.  */
     index = (addr >> (TARGET_PAGE_BITS + 10)) & 0x3ff;
-    L2pte = ldq_phys(cs->as, pt + index*8);
+    L2pte = ldq_phys(as, pt + index*8);
 
     if (unlikely((L2pte & PTE_VALID) == 0)) {
         ret = MM_K_TNV;
@@ -249,7 +251,7 @@ static int get_physical_address(CPUAlphaState *env, target_ulong addr,
 
     /* L3 page table read.  */
     index = (addr >> TARGET_PAGE_BITS) & 0x3ff;
-    L3pte = ldq_phys(cs->as, pt + index*8);
+    L3pte = ldq_phys(as, pt + index*8);
 
     phys = L3pte >> 32 << TARGET_PAGE_BITS;
     if (unlikely((L3pte & PTE_VALID) == 0)) {
-- 
2.51.0

[PATCH 11/22] target/arm: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/arm/cpu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 30e29fd3153..f781d1cfd80 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -371,6 +371,7 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
 
     if (arm_feature(env, ARM_FEATURE_M)) {
 #ifndef CONFIG_USER_ONLY
+        AddressSpace *as = cpu_get_address_space(cs, 0);
         uint32_t initial_msp; /* Loaded from 0x0 */
         uint32_t initial_pc; /* Loaded from 0x4 */
         uint8_t *rom;
@@ -439,7 +440,7 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
 
         /* Load the initial SP and PC from offset 0 and 4 in the vector table */
         vecbase = env->v7m.vecbase[env->v7m.secure];
-        rom = rom_ptr_for_as(cs->as, vecbase, 8);
+        rom = rom_ptr_for_as(as, vecbase, 8);
         if (rom) {
             /* Address zero is covered by ROM which hasn't yet been
              * copied into physical memory.
@@ -452,8 +453,8 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
              * it got copied into memory. In the latter case, rom_ptr
              * will return a NULL pointer and we should use ldl_phys instead.
              */
-            initial_msp = ldl_phys(cs->as, vecbase);
-            initial_pc = ldl_phys(cs->as, vecbase + 4);
+            initial_msp = ldl_phys(as, vecbase);
+            initial_pc = ldl_phys(as, vecbase + 4);
         }
 
         qemu_log_mask(CPU_LOG_INT,
-- 
2.51.0

[PATCH 12/22] target/hppa: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/hppa/int_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/hppa/int_helper.c b/target/hppa/int_helper.c
index 191ae19404b..4dd281e6c95 100644
--- a/target/hppa/int_helper.c
+++ b/target/hppa/int_helper.c
@@ -160,6 +160,7 @@ void hppa_cpu_do_interrupt(CPUState *cs)
                 /* ??? An alternate fool-proof method would be to store the
                    instruction data into the unwind info.  That's probably
                    a bit too much in the way of extra storage required.  */
+                AddressSpace *as = cpu_get_address_space(cs, 0);
                 vaddr vaddr = env->iaoq_f & -4;
                 hwaddr paddr = vaddr;
 
@@ -176,7 +177,7 @@ void hppa_cpu_do_interrupt(CPUState *cs)
                         break;
                     }
                 }
-                env->cr[CR_IIR] = ldl_phys(cs->as, paddr);
+                env->cr[CR_IIR] = ldl_phys(as, paddr);
                 if (i == EXCP_ASSIST) {
                     /* stuff insn code into bits of FP exception register #1 */
                     env->fr[0] |= (env->cr[CR_IIR] & 0x03ffffff);
-- 
2.51.0

[PATCH 13/22] target/i386: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/i386/arch_memory_mapping.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/i386/arch_memory_mapping.c b/target/i386/arch_memory_mapping.c
index 560f4689abc..809c4cb0298 100644
--- a/target/i386/arch_memory_mapping.c
+++ b/target/i386/arch_memory_mapping.c
@@ -273,12 +273,14 @@ bool x86_cpu_get_memory_mapping(CPUState *cs, MemoryMappingList *list,
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
     int32_t a20_mask;
+    AddressSpace *as;
 
     if (!cpu_paging_enabled(cs)) {
         /* paging is disabled */
         return true;
     }
 
+    as = cpu_get_address_space(cs, 0);
     a20_mask = x86_get_a20_mask(env);
     if (env->cr[4] & CR4_PAE_MASK) {
 #ifdef TARGET_X86_64
@@ -287,12 +289,12 @@ bool x86_cpu_get_memory_mapping(CPUState *cs, MemoryMappingList *list,
                 hwaddr pml5e_addr;
 
                 pml5e_addr = (env->cr[3] & PLM4_ADDR_MASK) & a20_mask;
-                walk_pml5e(list, cs->as, pml5e_addr, a20_mask);
+                walk_pml5e(list, as, pml5e_addr, a20_mask);
             } else {
                 hwaddr pml4e_addr;
 
                 pml4e_addr = (env->cr[3] & PLM4_ADDR_MASK) & a20_mask;
-                walk_pml4e(list, cs->as, pml4e_addr, a20_mask,
+                walk_pml4e(list, as, pml4e_addr, a20_mask,
                         0xffffULL << 48);
             }
         } else
@@ -301,7 +303,7 @@ bool x86_cpu_get_memory_mapping(CPUState *cs, MemoryMappingList *list,
             hwaddr pdpe_addr;
 
             pdpe_addr = (env->cr[3] & ~0x1f) & a20_mask;
-            walk_pdpe2(list, cs->as, pdpe_addr, a20_mask);
+            walk_pdpe2(list, as, pdpe_addr, a20_mask);
         }
     } else {
         hwaddr pde_addr;
@@ -309,7 +311,7 @@ bool x86_cpu_get_memory_mapping(CPUState *cs, MemoryMappingList *list,
 
         pde_addr = (env->cr[3] & ~0xfff) & a20_mask;
         pse = !!(env->cr[4] & CR4_PSE_MASK);
-        walk_pde2(list, cs->as, pde_addr, a20_mask, pse);
+        walk_pde2(list, as, pde_addr, a20_mask, pse);
     }
 
     return true;
-- 
2.51.0

[PATCH 14/22] target/loongarch: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/loongarch/cpu_helper.c     | 5 +++--
 target/loongarch/tcg/tlb_helper.c | 7 +++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 4a9db3ea4c1..f2ee66d0d52 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -110,6 +110,7 @@ static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
                                           int access_type, int mmu_idx)
 {
     CPUState *cs = env_cpu(env);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
     target_ulong index, phys;
     uint64_t dir_base, dir_width;
     uint64_t base;
@@ -134,7 +135,7 @@ static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
         /* get next level page directory */
         index = (address >> dir_base) & ((1 << dir_width) - 1);
         phys = base | index << 3;
-        base = ldq_phys(cs->as, phys) & TARGET_PHYS_MASK;
+        base = ldq_phys(as, phys) & TARGET_PHYS_MASK;
         if (FIELD_EX64(base, TLBENTRY, HUGE)) {
             /* base is a huge pte */
             break;
@@ -155,7 +156,7 @@ static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
         get_dir_base_width(env, &dir_base, &dir_width, 0);
         index = (address >> dir_base) & ((1 << dir_width) - 1);
         phys = base | index << 3;
-        base = ldq_phys(cs->as, phys);
+        base = ldq_phys(as, phys);
     }
 
     context->ps = dir_base;
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 8cfce48a297..5173e30b531 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -600,6 +600,7 @@ target_ulong helper_lddir(CPULoongArchState *env, target_ulong base,
     CPUState *cs = env_cpu(env);
     target_ulong badvaddr, index, phys;
     uint64_t dir_base, dir_width;
+    AddressSpace *as;
 
     if (unlikely((level == 0) || (level > 4))) {
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -621,12 +622,13 @@ target_ulong helper_lddir(CPULoongArchState *env, target_ulong base,
         }
     }
 
+    as = cpu_get_address_space(cs, 0);
     badvaddr = env->CSR_TLBRBADV;
     base = base & TARGET_PHYS_MASK;
     get_dir_base_width(env, &dir_base, &dir_width, level);
     index = (badvaddr >> dir_base) & ((1 << dir_width) - 1);
     phys = base | index << 3;
-    return ldq_phys(cs->as, phys) & TARGET_PHYS_MASK;
+    return ldq_phys(as, phys) & TARGET_PHYS_MASK;
 }
 
 void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
@@ -680,6 +682,7 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
             return;
         }
     } else {
+        AddressSpace *as = cpu_get_address_space(cs, 0);
         badv = env->CSR_TLBRBADV;
 
         ptindex = (badv >> ptbase) & ((1 << ptwidth) - 1);
@@ -687,7 +690,7 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
         ptoffset0 = ptindex << 3;
         ptoffset1 = (ptindex + 1) << 3;
         phys = base | (odd ? ptoffset1 : ptoffset0);
-        tmp0 = ldq_phys(cs->as, phys) & TARGET_PHYS_MASK;
+        tmp0 = ldq_phys(as, phys) & TARGET_PHYS_MASK;
         ps = ptbase;
     }
 
-- 
2.51.0

[PATCH 15/22] target/m68k: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/m68k/helper.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index 15f110fa7a2..0f8512af72c 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -491,6 +491,7 @@ static void dump_address_map(CPUM68KState *env, uint32_t root_pointer)
     int32_t size;
     int last_attr = -1, attr = -1;
     CPUState *cs = env_cpu(env);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
     MemTxResult txres;
 
     if (env->mmu.tcr & M68K_TCR_PAGE_8K) {
@@ -505,25 +506,25 @@ static void dump_address_map(CPUM68KState *env, uint32_t root_pointer)
         tib_mask = M68K_4K_PAGE_MASK;
     }
     for (unsigned i = 0; i < M68K_ROOT_POINTER_ENTRIES; i++) {
-        tia = address_space_ldl(cs->as, M68K_POINTER_BASE(root_pointer) + i * 4,
+        tia = address_space_ldl(as, M68K_POINTER_BASE(root_pointer) + i * 4,
                                 MEMTXATTRS_UNSPECIFIED, &txres);
         if (txres != MEMTX_OK || !M68K_UDT_VALID(tia)) {
             continue;
         }
         for (unsigned j = 0; j < M68K_ROOT_POINTER_ENTRIES; j++) {
-            tib = address_space_ldl(cs->as, M68K_POINTER_BASE(tia) + j * 4,
+            tib = address_space_ldl(as, M68K_POINTER_BASE(tia) + j * 4,
                                     MEMTXATTRS_UNSPECIFIED, &txres);
             if (txres != MEMTX_OK || !M68K_UDT_VALID(tib)) {
                 continue;
             }
             for (unsigned k = 0; k < tic_size; k++) {
-                tic = address_space_ldl(cs->as, (tib & tib_mask) + k * 4,
+                tic = address_space_ldl(as, (tib & tib_mask) + k * 4,
                                         MEMTXATTRS_UNSPECIFIED, &txres);
                 if (txres != MEMTX_OK || !M68K_PDT_VALID(tic)) {
                     continue;
                 }
                 if (M68K_PDT_INDIRECT(tic)) {
-                    tic = address_space_ldl(cs->as, M68K_INDIRECT_POINTER(tic),
+                    tic = address_space_ldl(as, M68K_INDIRECT_POINTER(tic),
                                             MEMTXATTRS_UNSPECIFIED, &txres);
                     if (txres != MEMTX_OK) {
                         continue;
@@ -732,6 +733,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
                                 int access_type, target_ulong *page_size)
 {
     CPUState *cs = env_cpu(env);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
     uint32_t entry;
     uint32_t next;
     target_ulong page_mask;
@@ -768,7 +770,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
     /* Root Index */
     entry = M68K_POINTER_BASE(next) | M68K_ROOT_INDEX(address);
 
-    next = address_space_ldl(cs->as, entry, MEMTXATTRS_UNSPECIFIED, &txres);
+    next = address_space_ldl(as, entry, MEMTXATTRS_UNSPECIFIED, &txres);
     if (txres != MEMTX_OK) {
         goto txfail;
     }
@@ -776,7 +778,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
         return -1;
     }
     if (!(next & M68K_DESC_USED) && !debug) {
-        address_space_stl(cs->as, entry, next | M68K_DESC_USED,
+        address_space_stl(as, entry, next | M68K_DESC_USED,
                           MEMTXATTRS_UNSPECIFIED, &txres);
         if (txres != MEMTX_OK) {
             goto txfail;
@@ -795,7 +797,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
     /* Pointer Index */
     entry = M68K_POINTER_BASE(next) | M68K_POINTER_INDEX(address);
 
-    next = address_space_ldl(cs->as, entry, MEMTXATTRS_UNSPECIFIED, &txres);
+    next = address_space_ldl(as, entry, MEMTXATTRS_UNSPECIFIED, &txres);
     if (txres != MEMTX_OK) {
         goto txfail;
     }
@@ -803,7 +805,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
         return -1;
     }
     if (!(next & M68K_DESC_USED) && !debug) {
-        address_space_stl(cs->as, entry, next | M68K_DESC_USED,
+        address_space_stl(as, entry, next | M68K_DESC_USED,
                           MEMTXATTRS_UNSPECIFIED, &txres);
         if (txres != MEMTX_OK) {
             goto txfail;
@@ -826,7 +828,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
         entry = M68K_4K_PAGE_BASE(next) | M68K_4K_PAGE_INDEX(address);
     }
 
-    next = address_space_ldl(cs->as, entry, MEMTXATTRS_UNSPECIFIED, &txres);
+    next = address_space_ldl(as, entry, MEMTXATTRS_UNSPECIFIED, &txres);
     if (txres != MEMTX_OK) {
         goto txfail;
     }
@@ -835,7 +837,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
         return -1;
     }
     if (M68K_PDT_INDIRECT(next)) {
-        next = address_space_ldl(cs->as, M68K_INDIRECT_POINTER(next),
+        next = address_space_ldl(as, M68K_INDIRECT_POINTER(next),
                                  MEMTXATTRS_UNSPECIFIED, &txres);
         if (txres != MEMTX_OK) {
             goto txfail;
@@ -844,7 +846,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
     if (access_type & ACCESS_STORE) {
         if (next & M68K_DESC_WRITEPROT) {
             if (!(next & M68K_DESC_USED) && !debug) {
-                address_space_stl(cs->as, entry, next | M68K_DESC_USED,
+                address_space_stl(as, entry, next | M68K_DESC_USED,
                                   MEMTXATTRS_UNSPECIFIED, &txres);
                 if (txres != MEMTX_OK) {
                     goto txfail;
@@ -852,7 +854,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
             }
         } else if ((next & (M68K_DESC_MODIFIED | M68K_DESC_USED)) !=
                            (M68K_DESC_MODIFIED | M68K_DESC_USED) && !debug) {
-            address_space_stl(cs->as, entry,
+            address_space_stl(as, entry,
                               next | (M68K_DESC_MODIFIED | M68K_DESC_USED),
                               MEMTXATTRS_UNSPECIFIED, &txres);
             if (txres != MEMTX_OK) {
@@ -861,7 +863,7 @@ static int get_physical_address(CPUM68KState *env, hwaddr *physical,
         }
     } else {
         if (!(next & M68K_DESC_USED) && !debug) {
-            address_space_stl(cs->as, entry, next | M68K_DESC_USED,
+            address_space_stl(as, entry, next | M68K_DESC_USED,
                               MEMTXATTRS_UNSPECIFIED, &txres);
             if (txres != MEMTX_OK) {
                 goto txfail;
-- 
2.51.0

[PATCH 16/22] target/microblaze: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/microblaze/op_helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index b8365b3b1d2..f07d795bdf3 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -448,8 +448,9 @@ void mb_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
 uint32_t HELPER(NAME)(CPUMBState *env, uint64_t ea)                     \
 {                                                                       \
     CPUState *cs = env_cpu(env);                                        \
+    AddressSpace *as = cpu_get_address_space(cs, 0);                    \
     MemTxResult txres;                                                  \
-    TYPE ret = FUNC(cs->as, ea, MEMTXATTRS_UNSPECIFIED, &txres);        \
+    TYPE ret = FUNC(as, ea, MEMTXATTRS_UNSPECIFIED, &txres);            \
     if (unlikely(txres != MEMTX_OK)) {                                  \
         mb_transaction_failed_internal(cs, ea, ea, sizeof(TYPE),        \
                                        MMU_DATA_LOAD, GETPC());         \
@@ -467,8 +468,9 @@ LD_EA(lwea_le, uint32_t, address_space_ldl_le)
 void HELPER(NAME)(CPUMBState *env, uint32_t data, uint64_t ea)          \
 {                                                                       \
     CPUState *cs = env_cpu(env);                                        \
+    AddressSpace *as = cpu_get_address_space(cs, 0);                    \
     MemTxResult txres;                                                  \
-    FUNC(cs->as, ea, data, MEMTXATTRS_UNSPECIFIED, &txres);             \
+    FUNC(as, ea, data, MEMTXATTRS_UNSPECIFIED, &txres);                 \
     if (unlikely(txres != MEMTX_OK)) {                                  \
         mb_transaction_failed_internal(cs, ea, ea, sizeof(TYPE),        \
                                        MMU_DATA_STORE, GETPC());        \
-- 
2.51.0

[PATCH 17/22] target/ppc: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/ppc/mmu-hash32.h    | 12 ++++++++----
 target/ppc/excp_helper.c   |  4 ++--
 target/ppc/mmu-book3s-v3.c |  5 +++--
 target/ppc/mmu-hash32.c    |  6 ++++--
 target/ppc/mmu-hash64.c    | 12 ++++++++----
 target/ppc/mmu-radix64.c   | 13 +++++++------
 6 files changed, 32 insertions(+), 20 deletions(-)

diff --git a/target/ppc/mmu-hash32.h b/target/ppc/mmu-hash32.h
index 04c23ea75ed..f49991e8651 100644
--- a/target/ppc/mmu-hash32.h
+++ b/target/ppc/mmu-hash32.h
@@ -74,33 +74,37 @@ static inline hwaddr ppc_hash32_hpt_mask(PowerPCCPU *cpu)
 static inline target_ulong ppc_hash32_load_hpte0(PowerPCCPU *cpu,
                                                  hwaddr pte_offset)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong base = ppc_hash32_hpt_base(cpu);
 
-    return ldl_phys(CPU(cpu)->as, base + pte_offset);
+    return ldl_phys(as, base + pte_offset);
 }
 
 static inline target_ulong ppc_hash32_load_hpte1(PowerPCCPU *cpu,
                                                  hwaddr pte_offset)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong base = ppc_hash32_hpt_base(cpu);
 
-    return ldl_phys(CPU(cpu)->as, base + pte_offset + HASH_PTE_SIZE_32 / 2);
+    return ldl_phys(as, base + pte_offset + HASH_PTE_SIZE_32 / 2);
 }
 
 static inline void ppc_hash32_store_hpte0(PowerPCCPU *cpu,
                                           hwaddr pte_offset, target_ulong pte0)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong base = ppc_hash32_hpt_base(cpu);
 
-    stl_phys(CPU(cpu)->as, base + pte_offset, pte0);
+    stl_phys(as, base + pte_offset, pte0);
 }
 
 static inline void ppc_hash32_store_hpte1(PowerPCCPU *cpu,
                                           hwaddr pte_offset, target_ulong pte1)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong base = ppc_hash32_hpt_base(cpu);
 
-    stl_phys(CPU(cpu)->as, base + pte_offset + HASH_PTE_SIZE_32 / 2, pte1);
+    stl_phys(as, base + pte_offset + HASH_PTE_SIZE_32 / 2, pte1);
 }
 
 static inline hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 1efdc4066eb..6dbcf4dae10 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1012,9 +1012,9 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
         break;
     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
         if (env->mpic_proxy) {
-            CPUState *cs = env_cpu(env);
+            AddressSpace *as = cpu_get_address_space(env_cpu(env), 0);
             /* IACK the IRQ on delivery */
-            env->spr[SPR_BOOKE_EPR] = ldl_phys(cs->as, env->mpic_iack);
+            env->spr[SPR_BOOKE_EPR] = ldl_phys(as, env->mpic_iack);
         }
         break;
     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
diff --git a/target/ppc/mmu-book3s-v3.c b/target/ppc/mmu-book3s-v3.c
index 38655563105..fb8dd3df8c4 100644
--- a/target/ppc/mmu-book3s-v3.c
+++ b/target/ppc/mmu-book3s-v3.c
@@ -25,6 +25,7 @@
 
 bool ppc64_v3_get_pate(PowerPCCPU *cpu, target_ulong lpid, ppc_v3_pate_t *entry)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     uint64_t patb = cpu->env.spr[SPR_PTCR] & PTCR_PATB;
     uint64_t pats = cpu->env.spr[SPR_PTCR] & PTCR_PATS;
 
@@ -41,7 +42,7 @@ bool ppc64_v3_get_pate(PowerPCCPU *cpu, target_ulong lpid, ppc_v3_pate_t *entry)
 
     /* Grab entry */
     patb += 16 * lpid;
-    entry->dw0 = ldq_phys(CPU(cpu)->as, patb);
-    entry->dw1 = ldq_phys(CPU(cpu)->as, patb + 8);
+    entry->dw0 = ldq_phys(as, patb);
+    entry->dw1 = ldq_phys(as, patb + 8);
     return true;
 }
diff --git a/target/ppc/mmu-hash32.c b/target/ppc/mmu-hash32.c
index 8b980a5aa90..957184fd2e9 100644
--- a/target/ppc/mmu-hash32.c
+++ b/target/ppc/mmu-hash32.c
@@ -235,20 +235,22 @@ static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
 
 static void ppc_hash32_set_r(PowerPCCPU *cpu, hwaddr pte_offset, uint32_t pte1)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong base = ppc_hash32_hpt_base(cpu);
     hwaddr offset = pte_offset + 6;
 
     /* The HW performs a non-atomic byte update */
-    stb_phys(CPU(cpu)->as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
+    stb_phys(as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
 }
 
 static void ppc_hash32_set_c(PowerPCCPU *cpu, hwaddr pte_offset, uint64_t pte1)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     target_ulong base = ppc_hash32_hpt_base(cpu);
     hwaddr offset = pte_offset + 7;
 
     /* The HW performs a non-atomic byte update */
-    stb_phys(CPU(cpu)->as, base + offset, (pte1 & 0xff) | 0x80);
+    stb_phys(as, base + offset, (pte1 & 0xff) | 0x80);
 }
 
 static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
index dd337558aa6..52db16ded5b 100644
--- a/target/ppc/mmu-hash64.c
+++ b/target/ppc/mmu-hash64.c
@@ -552,6 +552,7 @@ static hwaddr ppc_hash64_hpt_mask(PowerPCCPU *cpu)
 const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu,
                                              hwaddr ptex, int n)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     hwaddr pte_offset = ptex * HASH_PTE_SIZE_64;
     hwaddr base;
     hwaddr plen = n * HASH_PTE_SIZE_64;
@@ -566,7 +567,7 @@ const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu,
         return NULL;
     }
 
-    hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false,
+    hptes = address_space_map(as, base + pte_offset, &plen, false,
                               MEMTXATTRS_UNSPECIFIED);
     if (plen < (n * HASH_PTE_SIZE_64)) {
         hw_error("%s: Unable to map all requested HPTEs\n", __func__);
@@ -577,12 +578,13 @@ const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu,
 void ppc_hash64_unmap_hptes(PowerPCCPU *cpu, const ppc_hash_pte64_t *hptes,
                             hwaddr ptex, int n)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     if (cpu->vhyp) {
         cpu->vhyp_class->unmap_hptes(cpu->vhyp, hptes, ptex, n);
         return;
     }
 
-    address_space_unmap(CPU(cpu)->as, (void *)hptes, n * HASH_PTE_SIZE_64,
+    address_space_unmap(as, (void *)hptes, n * HASH_PTE_SIZE_64,
                         false, n * HASH_PTE_SIZE_64);
 }
 
@@ -864,6 +866,7 @@ static void ppc_hash64_set_dsi(CPUState *cs, int mmu_idx, uint64_t slb_vsid,
 
 static void ppc_hash64_set_r(PowerPCCPU *cpu, hwaddr ptex, uint64_t pte1)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     hwaddr base, offset = ptex * HASH_PTE_SIZE_64 + HPTE64_DW1_R;
 
     if (cpu->vhyp) {
@@ -874,11 +877,12 @@ static void ppc_hash64_set_r(PowerPCCPU *cpu, hwaddr ptex, uint64_t pte1)
 
 
     /* The HW performs a non-atomic byte update */
-    stb_phys(CPU(cpu)->as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
+    stb_phys(as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
 }
 
 static void ppc_hash64_set_c(PowerPCCPU *cpu, hwaddr ptex, uint64_t pte1)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     hwaddr base, offset = ptex * HASH_PTE_SIZE_64 + HPTE64_DW1_C;
 
     if (cpu->vhyp) {
@@ -888,7 +892,7 @@ static void ppc_hash64_set_c(PowerPCCPU *cpu, hwaddr ptex, uint64_t pte1)
     base = ppc_hash64_hpt_base(cpu);
 
     /* The HW performs a non-atomic byte update */
-    stb_phys(CPU(cpu)->as, base + offset, (pte1 & 0xff) | 0x80);
+    stb_phys(as, base + offset, (pte1 & 0xff) | 0x80);
 }
 
 static target_ulong rmls_limit(PowerPCCPU *cpu)
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 33ac3412901..c381a833ebd 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -431,6 +431,7 @@ static int ppc_radix64_partition_scoped_xlate(PowerPCCPU *cpu,
                                               int mmu_idx, uint64_t lpid,
                                               bool guest_visible)
 {
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     MMUAccessType access_type = orig_access_type;
     int fault_cause = 0;
     hwaddr pte_addr;
@@ -451,7 +452,7 @@ static int ppc_radix64_partition_scoped_xlate(PowerPCCPU *cpu,
 
     *h_page_size = PRTBE_R_GET_RTS(pate.dw0);
     /* No valid pte or access denied due to protection */
-    if (ppc_radix64_walk_tree(CPU(cpu)->as, g_raddr, pate.dw0 & PRTBE_R_RPDB,
+    if (ppc_radix64_walk_tree(as, g_raddr, pate.dw0 & PRTBE_R_RPDB,
                               pate.dw0 & PRTBE_R_RPDS, h_raddr, h_page_size,
                               &pte, &fault_cause, &pte_addr) ||
         ppc_radix64_check_prot(cpu, access_type, pte,
@@ -516,7 +517,7 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
                                             int mmu_idx, uint64_t lpid,
                                             bool guest_visible)
 {
-    CPUState *cs = CPU(cpu);
+    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
     CPUPPCState *env = &cpu->env;
     uint64_t offset, size, prtb, prtbe_addr, prtbe0, base_addr, nls, index, pte;
     int fault_cause = 0, h_page_size, h_prot;
@@ -550,7 +551,7 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
     prtbe_addr = prtb + offset;
 
     if (vhyp_flat_addressing(cpu)) {
-        prtbe0 = ldq_phys(cs->as, prtbe_addr);
+        prtbe0 = ldq_phys(as, prtbe_addr);
     } else {
         /*
          * Process table addresses are subject to partition-scoped
@@ -568,7 +569,7 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
         if (ret) {
             return ret;
         }
-        prtbe0 = ldq_phys(cs->as, h_raddr);
+        prtbe0 = ldq_phys(as, h_raddr);
     }
 
     /*
@@ -593,7 +594,7 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
         /*
          * Can treat process table addresses as real addresses
          */
-        ret = ppc_radix64_walk_tree(cs->as, eaddr & R_EADDR_MASK, base_addr,
+        ret = ppc_radix64_walk_tree(as, eaddr & R_EADDR_MASK, base_addr,
                                     nls, g_raddr, g_page_size, &pte,
                                     &fault_cause, &pte_addr);
         if (ret) {
@@ -630,7 +631,7 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
                 fault_cause |= DSISR_R_BADCONFIG;
                 ret = 1;
             } else {
-                ret = ppc_radix64_next_level(cs->as, eaddr & R_EADDR_MASK,
+                ret = ppc_radix64_next_level(as, eaddr & R_EADDR_MASK,
                                              &h_raddr, &nls, g_page_size,
                                              &pte, &fault_cause);
             }
-- 
2.51.0

[PATCH 18/22] target/s390x: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/s390x/cpu-system.c      |  4 +++-
 target/s390x/mmu_helper.c      |  9 +++++----
 target/s390x/tcg/excp_helper.c | 10 ++++++----
 target/s390x/tcg/mem_helper.c  |  6 ++++--
 4 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/target/s390x/cpu-system.c b/target/s390x/cpu-system.c
index f3a9ffb2a27..948dd7bc133 100644
--- a/target/s390x/cpu-system.c
+++ b/target/s390x/cpu-system.c
@@ -63,7 +63,9 @@ static void s390_cpu_load_normal(CPUState *s)
     uint64_t spsw;
 
     if (!s390_is_pv()) {
-        spsw = ldq_phys(s->as, 0);
+        AddressSpace *as = cpu_get_address_space(s, 0);
+
+        spsw = ldq_phys(as, 0);
         cpu->env.psw.mask = spsw & PSW_MASK_SHORT_CTRL;
         /*
          * Invert short psw indication, so SIE will report a specification
diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index 4e2f31dc763..358d5463a0a 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -42,9 +42,10 @@ static void trigger_access_exception(CPUS390XState *env, uint32_t type,
     if (kvm_enabled()) {
         kvm_s390_access_exception(cpu, type, tec);
     } else {
-        CPUState *cs = env_cpu(env);
         if (type != PGM_ADDRESSING) {
-            stq_phys(cs->as, env->psa + offsetof(LowCore, trans_exc_code), tec);
+            AddressSpace *as = cpu_get_address_space(env_cpu(env), 0);
+
+            stq_phys(as, env->psa + offsetof(LowCore, trans_exc_code), tec);
         }
         trigger_pgm_exception(env, type);
     }
@@ -106,7 +107,7 @@ bool mmu_absolute_addr_valid(target_ulong addr, bool is_write)
 static inline bool read_table_entry(CPUS390XState *env, hwaddr gaddr,
                                     uint64_t *entry)
 {
-    CPUState *cs = env_cpu(env);
+    AddressSpace *as = cpu_get_address_space(env_cpu(env), 0);
 
     /*
      * According to the PoP, these table addresses are "unpredictably real
@@ -115,7 +116,7 @@ static inline bool read_table_entry(CPUS390XState *env, hwaddr gaddr,
      *
      * We treat them as absolute addresses and don't wrap them.
      */
-    if (unlikely(address_space_read(cs->as, gaddr, MEMTXATTRS_UNSPECIFIED,
+    if (unlikely(address_space_read(as, gaddr, MEMTXATTRS_UNSPECIFIED,
                                     entry, sizeof(*entry)) !=
                  MEMTX_OK)) {
         return false;
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 4c7faeee82b..1db159be131 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -53,7 +53,7 @@ G_NORETURN void tcg_s390_data_exception(CPUS390XState *env, uint32_t dxc,
     g_assert(dxc <= 0xff);
 #if !defined(CONFIG_USER_ONLY)
     /* Store the DXC into the lowcore */
-    stl_phys(env_cpu(env)->as,
+    stl_phys(cpu_get_address_space(env_cpu(env), 0),
              env->psa + offsetof(LowCore, data_exc_code), dxc);
 #endif
 
@@ -70,7 +70,7 @@ G_NORETURN void tcg_s390_vector_exception(CPUS390XState *env, uint32_t vxc,
     g_assert(vxc <= 0xff);
 #if !defined(CONFIG_USER_ONLY)
     /* Always store the VXC into the lowcore, without AFP it is undefined */
-    stl_phys(env_cpu(env)->as,
+    stl_phys(cpu_get_address_space(env_cpu(env), 0),
              env->psa + offsetof(LowCore, data_exc_code), vxc);
 #endif
 
@@ -639,10 +639,12 @@ void monitor_event(CPUS390XState *env,
                    uint64_t monitor_code,
                    uint8_t monitor_class, uintptr_t ra)
 {
+    AddressSpace *as = cpu_get_address_space(env_cpu(env), 0);
+
     /* Store the Monitor Code and the Monitor Class Number into the lowcore */
-    stq_phys(env_cpu(env)->as,
+    stq_phys(as,
              env->psa + offsetof(LowCore, monitor_code), monitor_code);
-    stw_phys(env_cpu(env)->as,
+    stw_phys(as,
              env->psa + offsetof(LowCore, mon_class_num), monitor_class);
 
     tcg_s390_program_interrupt(env, PGM_MONITOR, ra);
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index f1acb1618f7..962f31d4cdb 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -957,12 +957,14 @@ uint32_t HELPER(mvpg)(CPUS390XState *env, uint64_t r0, uint32_t r1, uint32_t r2)
     return 0; /* data moved */
 inject_exc:
 #if !defined(CONFIG_USER_ONLY)
+    AddressSpace *as = cpu_get_address_space(env_cpu(env), 0);
+
     if (exc != PGM_ADDRESSING) {
-        stq_phys(env_cpu(env)->as, env->psa + offsetof(LowCore, trans_exc_code),
+        stq_phys(as, env->psa + offsetof(LowCore, trans_exc_code),
                  env->tlb_fill_tec);
     }
     if (exc == PGM_PAGE_TRANS) {
-        stb_phys(env_cpu(env)->as, env->psa + offsetof(LowCore, op_access_id),
+        stb_phys(as, env->psa + offsetof(LowCore, op_access_id),
                  r1 << 4 | r2);
     }
 #endif
-- 
2.51.0

[PATCH 19/22] target/sparc: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

In order to remove the convenient CPUState::as field, access
the vcpu first address space using the cpu_get_address_space()
helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/sparc/ldst_helper.c | 22 ++++++++++++----------
 target/sparc/mmu_helper.c  | 21 ++++++++++++---------
 2 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
index 2c63eb9e036..35d1f63fd2a 100644
--- a/target/sparc/ldst_helper.c
+++ b/target/sparc/ldst_helper.c
@@ -700,23 +700,24 @@ uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr,
     {
         MemTxResult result;
         hwaddr access_addr = (hwaddr)addr | ((hwaddr)(asi & 0xf) << 32);
+        AddressSpace *as = cpu_get_address_space(cs, 0);
 
         switch (size) {
         case 1:
-            ret = address_space_ldub(cs->as, access_addr,
+            ret = address_space_ldub(as, access_addr,
                                      MEMTXATTRS_UNSPECIFIED, &result);
             break;
         case 2:
-            ret = address_space_lduw(cs->as, access_addr,
+            ret = address_space_lduw(as, access_addr,
                                      MEMTXATTRS_UNSPECIFIED, &result);
             break;
         default:
         case 4:
-            ret = address_space_ldl(cs->as, access_addr,
+            ret = address_space_ldl(as, access_addr,
                                     MEMTXATTRS_UNSPECIFIED, &result);
             break;
         case 8:
-            ret = address_space_ldq(cs->as, access_addr,
+            ret = address_space_ldq(as, access_addr,
                                     MEMTXATTRS_UNSPECIFIED, &result);
             break;
         }
@@ -809,6 +810,7 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val,
 {
     int size = 1 << (memop & MO_SIZE);
     CPUState *cs = env_cpu(env);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
 
     do_check_align(env, addr, size - 1, GETPC());
     switch (asi) {
@@ -878,7 +880,7 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val,
                 MemTxResult result;
                 hwaddr access_addr = (env->mxccregs[0] & 0xffffffffULL) + 8 * i;
 
-                env->mxccdata[i] = address_space_ldq(cs->as,
+                env->mxccdata[i] = address_space_ldq(as,
                                                      access_addr,
                                                      MEMTXATTRS_UNSPECIFIED,
                                                      &result);
@@ -906,7 +908,7 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val,
                 MemTxResult result;
                 hwaddr access_addr = (env->mxccregs[1] & 0xffffffffULL) + 8 * i;
 
-                address_space_stq(cs->as, access_addr, env->mxccdata[i],
+                address_space_stq(as, access_addr, env->mxccdata[i],
                                   MEMTXATTRS_UNSPECIFIED, &result);
 
                 if (result != MEMTX_OK) {
@@ -1068,20 +1070,20 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val,
 
             switch (size) {
             case 1:
-                address_space_stb(cs->as, access_addr, val,
+                address_space_stb(as, access_addr, val,
                                   MEMTXATTRS_UNSPECIFIED, &result);
                 break;
             case 2:
-                address_space_stw(cs->as, access_addr, val,
+                address_space_stw(as, access_addr, val,
                                   MEMTXATTRS_UNSPECIFIED, &result);
                 break;
             case 4:
             default:
-                address_space_stl(cs->as, access_addr, val,
+                address_space_stl(as, access_addr, val,
                                   MEMTXATTRS_UNSPECIFIED, &result);
                 break;
             case 8:
-                address_space_stq(cs->as, access_addr, val,
+                address_space_stq(as, access_addr, val,
                                   MEMTXATTRS_UNSPECIFIED, &result);
                 break;
             }
diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index 217580a4d8c..1e13ef3da40 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -80,6 +80,7 @@ static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full,
     unsigned long page_offset;
     CPUState *cs = env_cpu(env);
     MemTxResult result;
+    AddressSpace *as;
 
     is_user = mmu_idx == MMU_USER_IDX;
 
@@ -96,13 +97,14 @@ static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full,
         return 0;
     }
 
+    as = cpu_get_address_space(cs, 0);
     *access_index = ((rw & 1) << 2) | (rw & 2) | (is_user ? 0 : 1);
     full->phys_addr = 0xffffffffffff0000ULL;
 
     /* SPARC reference MMU table walk: Context table->L1->L2->PTE */
     /* Context base + context number */
     pde_ptr = (env->mmuregs[1] << 4) + (env->mmuregs[2] << 2);
-    pde = address_space_ldl(cs->as, pde_ptr, MEMTXATTRS_UNSPECIFIED, &result);
+    pde = address_space_ldl(as, pde_ptr, MEMTXATTRS_UNSPECIFIED, &result);
     if (result != MEMTX_OK) {
         return 4 << 2; /* Translation fault, L = 0 */
     }
@@ -117,7 +119,7 @@ static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full,
         return 4 << 2;
     case 1: /* L0 PDE */
         pde_ptr = ((address >> 22) & ~3) + ((pde & ~3) << 4);
-        pde = address_space_ldl(cs->as, pde_ptr,
+        pde = address_space_ldl(as, pde_ptr,
                                 MEMTXATTRS_UNSPECIFIED, &result);
         if (result != MEMTX_OK) {
             return (1 << 8) | (4 << 2); /* Translation fault, L = 1 */
@@ -131,7 +133,7 @@ static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full,
             return (1 << 8) | (4 << 2);
         case 1: /* L1 PDE */
             pde_ptr = ((address & 0xfc0000) >> 16) + ((pde & ~3) << 4);
-            pde = address_space_ldl(cs->as, pde_ptr,
+            pde = address_space_ldl(as, pde_ptr,
                                     MEMTXATTRS_UNSPECIFIED, &result);
             if (result != MEMTX_OK) {
                 return (2 << 8) | (4 << 2); /* Translation fault, L = 2 */
@@ -145,7 +147,7 @@ static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full,
                 return (2 << 8) | (4 << 2);
             case 1: /* L2 PDE */
                 pde_ptr = ((address & 0x3f000) >> 10) + ((pde & ~3) << 4);
-                pde = address_space_ldl(cs->as, pde_ptr,
+                pde = address_space_ldl(as, pde_ptr,
                                         MEMTXATTRS_UNSPECIFIED, &result);
                 if (result != MEMTX_OK) {
                     return (3 << 8) | (4 << 2); /* Translation fault, L = 3 */
@@ -189,7 +191,7 @@ static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full,
         if (is_dirty) {
             pde |= PG_MODIFIED_MASK;
         }
-        stl_phys_notdirty(cs->as, pde_ptr, pde);
+        stl_phys_notdirty(as, pde_ptr, pde);
     }
 
     /* the page can be put in the TLB */
@@ -264,6 +266,7 @@ bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev)
 {
     CPUState *cs = env_cpu(env);
+    AddressSpace *as = cpu_get_address_space(cs, 0);
     hwaddr pde_ptr;
     uint32_t pde;
     MemTxResult result;
@@ -276,7 +279,7 @@ target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev)
     /* Context base + context number */
     pde_ptr = (hwaddr)(env->mmuregs[1] << 4) +
         (env->mmuregs[2] << 2);
-    pde = address_space_ldl(cs->as, pde_ptr, MEMTXATTRS_UNSPECIFIED, &result);
+    pde = address_space_ldl(as, pde_ptr, MEMTXATTRS_UNSPECIFIED, &result);
     if (result != MEMTX_OK) {
         return 0;
     }
@@ -292,7 +295,7 @@ target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev)
             return pde;
         }
         pde_ptr = ((address >> 22) & ~3) + ((pde & ~3) << 4);
-        pde = address_space_ldl(cs->as, pde_ptr,
+        pde = address_space_ldl(as, pde_ptr,
                                 MEMTXATTRS_UNSPECIFIED, &result);
         if (result != MEMTX_OK) {
             return 0;
@@ -310,7 +313,7 @@ target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev)
                 return pde;
             }
             pde_ptr = ((address & 0xfc0000) >> 16) + ((pde & ~3) << 4);
-            pde = address_space_ldl(cs->as, pde_ptr,
+            pde = address_space_ldl(as, pde_ptr,
                                     MEMTXATTRS_UNSPECIFIED, &result);
             if (result != MEMTX_OK) {
                 return 0;
@@ -328,7 +331,7 @@ target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev)
                     return pde;
                 }
                 pde_ptr = ((address & 0x3f000) >> 10) + ((pde & ~3) << 4);
-                pde = address_space_ldl(cs->as, pde_ptr,
+                pde = address_space_ldl(as, pde_ptr,
                                         MEMTXATTRS_UNSPECIFIED, &result);
                 if (result != MEMTX_OK) {
                     return 0;
-- 
2.51.0

[PATCH 20/22] hw/core/cpu: Remove @CPUState::as field

[Philippe Mathieu-Daudé]

All code now get the vcpu first address space using
cpu_get_address_space(). Nothing uses the CPUState::as
field anymore: remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/core/cpu.h |  3 ---
 hw/core/cpu-common.c  |  1 -
 system/cpus.c         |  2 +-
 system/physmem.c      | 10 ----------
 4 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index c9f40c25392..0f7eda1a10d 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -443,8 +443,6 @@ struct qemu_work_item;
  * @cpu_ases: Pointer to array of CPUAddressSpaces (which define the
  *            AddressSpaces this CPU has)
  * @num_ases: number of CPUAddressSpaces in @cpu_ases
- * @as: Pointer to the first AddressSpace, for the convenience of targets which
- *      only have a single AddressSpace
  * @gdb_regs: Additional GDB registers.
  * @gdb_num_regs: Number of total registers accessible to GDB.
  * @gdb_num_g_regs: Number of registers in GDB 'g' packets.
@@ -517,7 +515,6 @@ struct CPUState {
     struct CPUAddressSpace *cpu_ases;
     int cpu_ases_count;
     int num_ases;
-    AddressSpace *as;
     MemoryRegion *memory;
 
     struct CPUJumpCache *tb_jmp_cache;
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 41a339903ca..e46863d9e1d 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -307,7 +307,6 @@ static void cpu_common_initfn(Object *obj)
 
     cpu->cpu_index = UNASSIGNED_CPU_INDEX;
     cpu->cluster_index = UNASSIGNED_CLUSTER_INDEX;
-    cpu->as = NULL;
     cpu->num_ases = 0;
     /* user-mode doesn't have configurable SMP topology */
     /* the default value is changed by qemu_init_vcpu() for system-mode */
diff --git a/system/cpus.c b/system/cpus.c
index aa7bfcf56e5..ecd025a611d 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -704,7 +704,7 @@ void qemu_init_vcpu(CPUState *cpu)
     cpu->stopped = true;
     cpu->random_seed = qemu_guest_random_seed_thread_part1();
 
-    if (!cpu->as) {
+    if (cpu->num_ases == 0) {
         /* If the target cpu hasn't set up any address spaces itself,
          * give it the default one.
          */
diff --git a/system/physmem.c b/system/physmem.c
index b245cd14d43..31286b3c13f 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -791,11 +791,6 @@ void cpu_address_space_init(CPUState *cpu, int asidx,
     /* Target code should have set num_ases before calling us */
     assert(asidx < cpu->num_ases);
 
-    if (asidx == 0) {
-        /* address space 0 gets the convenience alias */
-        cpu->as = as;
-    }
-
     if (!cpu->cpu_ases) {
         cpu->cpu_ases = g_new0(CPUAddressSpace, cpu->num_ases);
         cpu->cpu_ases_count = cpu->num_ases;
@@ -827,11 +822,6 @@ void cpu_address_space_destroy(CPUState *cpu, int asidx)
     address_space_destroy(cpuas->as);
     g_free_rcu(cpuas->as, rcu);
 
-    if (asidx == 0) {
-        /* reset the convenience alias for address space 0 */
-        cpu->as = NULL;
-    }
-
     if (--cpu->cpu_ases_count == 0) {
         g_free(cpu->cpu_ases);
         cpu->cpu_ases = NULL;
-- 
2.51.0

[PATCH 21/22] exec/cpu: Declare cpu_memory_rw_debug() in 'hw/core/cpu.h' and document

[Philippe Mathieu-Daudé]

cpu_memory_rw_debug() dispatches to CPUClass::memory_rw_debug(),
move its declaration closer to the CPU API. Document.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/exec/cpu-common.h |  4 ----
 include/hw/core/cpu.h     | 20 ++++++++++++++++++++
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 910e1c2afb9..ce64a999035 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -150,10 +150,6 @@ typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
 
-/* Returns: 0 on success, -1 on error */
-int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
-                        void *ptr, size_t len, bool is_write);
-
 /* vl.c */
 void list_cpus(void);
 
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 0f7eda1a10d..1e928f57c99 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -685,6 +685,26 @@ int cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cpu,
 int cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
                              void *opaque);
 
+/**
+ * cpu_memory_rw_debug:
+ * @cpu: The CPU whose memory is to be accessed
+ * @addr: guest virtual address
+ * @ptr: buffer with the data transferred
+ * @len: the number of bytes to read or write
+ * @is_write: indicates the transfer direction
+ *
+ * Take a virtual address, convert it to a physical address via
+ * an MMU lookup using the current settings of the specified CPU,
+ * and then perform the access (using address_space_rw() for
+ * reads or address_space_write_rom() for writes).
+ *
+ * This function is intended for use by the GDB stub and similar code.
+ *
+ * Returns: 0 on success, -1 on error
+ */
+int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
+                        void *ptr, size_t len, bool is_write);
+
 /**
  * cpu_get_crash_info:
  * @cpu: The CPU to get crash information for
-- 
2.51.0

[PATCH 22/22] target/sparc: Reduce inclusions of 'exec/cpu-common.h'

[Philippe Mathieu-Daudé]

Only 2 files require declarations from "exec/cpu-common.h".
Include it there once, instead than polluting all files
including "cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/sparc/cpu.h          | 1 -
 target/sparc/helper.c       | 1 +
 target/sparc/int64_helper.c | 1 +
 3 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 31cb3d97eb1..7169a502432 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -3,7 +3,6 @@
 
 #include "qemu/bswap.h"
 #include "cpu-qom.h"
-#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/sparc/helper.c b/target/sparc/helper.c
index 9163b9d46ad..c5d88de37c9 100644
--- a/target/sparc/helper.c
+++ b/target/sparc/helper.c
@@ -21,6 +21,7 @@
 #include "cpu.h"
 #include "qemu/timer.h"
 #include "qemu/host-utils.h"
+#include "exec/cpu-common.h"
 #include "exec/helper-proto.h"
 
 void cpu_raise_exception_ra(CPUSPARCState *env, int tt, uintptr_t ra)
diff --git a/target/sparc/int64_helper.c b/target/sparc/int64_helper.c
index 23adda4cad7..96ef81c26cd 100644
--- a/target/sparc/int64_helper.c
+++ b/target/sparc/int64_helper.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "exec/cpu-common.h"
 #include "exec/helper-proto.h"
 #include "exec/log.h"
 #include "trace.h"
-- 
2.51.0

Re: [PATCH 04/22] hw/core/loader: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

On 1/10/25 17:05, Philippe Mathieu-Daudé wrote:
> In order to remove the convenient CPUState::as field, access
> the vcpu first address space using the cpu_get_address_space()
> helper.
> 
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
>   hw/core/generic-loader.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)


> @@ -130,7 +131,7 @@ static void generic_loader_realize(DeviceState *dev, Error **errp)
>       }
>   
>       if (s->file) {
> -        AddressSpace *as = s->cpu ? s->cpu->as :  NULL;
> +        AddressSpace *as = cpu_get_address_space(s->cpu, 0);

Oops, I missed the NULL check.

>   
>           if (!s->force_raw) {
>               size = load_elf_as(s->file, NULL, NULL, NULL, &entry, NULL, NULL,

Re: [PATCH 05/22] hw/ppc: Get cpu first addr space with cpu_get_address_space()

[Miles Glenn]

Reviewed-by: Glenn Miles <milesg@linux.ibm.com>

Thanks,

Glenn

On Wed, 2025-10-01 at 17:05 +0200, Philippe Mathieu-Daudé wrote:
> In order to remove the convenient CPUState::as field, access
> the vcpu first address space using the cpu_get_address_space()
> helper.
> 
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
>  hw/intc/spapr_xive.c  |  5 ++--
>  hw/ppc/pegasos2.c     |  2 +-
>  hw/ppc/spapr.c        | 12 +++++-----
>  hw/ppc/spapr_hcall.c  | 55 +++++++++++++++++++++++--------------------
>  hw/ppc/spapr_iommu.c  |  4 ++--
>  hw/ppc/spapr_nested.c | 43 ++++++++++++++++++---------------
>  6 files changed, 65 insertions(+), 56 deletions(-)
> 
> diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
> index e393f5dcdcc..b68961e1bf5 100644
> --- a/hw/intc/spapr_xive.c
> +++ b/hw/intc/spapr_xive.c
> @@ -1391,6 +1391,7 @@ static target_ulong h_int_set_queue_config(PowerPCCPU *cpu,
>      }
>  
>      if (qsize) {
> +        AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>          hwaddr plen = 1 << qsize;
>          void *eq;
>  
> @@ -1398,14 +1399,14 @@ static target_ulong h_int_set_queue_config(PowerPCCPU *cpu,
>           * Validate the guest EQ. We should also check that the queue
>           * has been zeroed by the OS.
>           */
> -        eq = address_space_map(CPU(cpu)->as, qpage, &plen, true,
> +        eq = address_space_map(as, qpage, &plen, true,
>                                 MEMTXATTRS_UNSPECIFIED);
>          if (plen != 1 << qsize) {
>              qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to map EQ @0x%"
>                            HWADDR_PRIx "\n", qpage);
>              return H_P4;
>          }
> -        address_space_unmap(CPU(cpu)->as, eq, plen, true, plen);
> +        address_space_unmap(as, eq, plen, true, plen);
>      }
>  
>      /* "target" should have been validated above */
> diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
> index e15cf964278..86c6a73236b 100644
> --- a/hw/ppc/pegasos2.c
> +++ b/hw/ppc/pegasos2.c
> @@ -451,7 +451,7 @@ enum pegasos2_rtas_tokens {
>  static target_ulong pegasos2_rtas(PowerPCCPU *cpu, Pegasos2MachineState *pm,
>                                    target_ulong args_real)
>  {
> -    AddressSpace *as = CPU(cpu)->as;
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      uint32_t token = ldl_be_phys(as, args_real);
>      uint32_t nargs = ldl_be_phys(as, args_real + 4);
>      uint32_t nrets = ldl_be_phys(as, args_real + 8);
> diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> index 15d09ef9618..b8aa0352ab2 100644
> --- a/hw/ppc/spapr.c
> +++ b/hw/ppc/spapr.c
> @@ -4550,10 +4550,10 @@ static void spapr_cpu_exec_enter(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
>  
>      spapr_cpu->prod = false;
>      if (spapr_cpu->vpa_addr) {
> -        CPUState *cs = CPU(cpu);
> +        AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>          uint32_t dispatch;
>  
> -        dispatch = ldl_be_phys(cs->as,
> +        dispatch = ldl_be_phys(as,
>                                 spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
>          dispatch++;
>          if ((dispatch & 1) != 0) {
> @@ -4562,7 +4562,7 @@ static void spapr_cpu_exec_enter(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
>                            "dispatched partition %u, correcting.\n", dispatch);
>              dispatch++;
>          }
> -        stl_be_phys(cs->as,
> +        stl_be_phys(as,
>                      spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER, dispatch);
>      }
>  }
> @@ -4572,10 +4572,10 @@ static void spapr_cpu_exec_exit(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
>      SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
>  
>      if (spapr_cpu->vpa_addr) {
> -        CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>          uint32_t dispatch;
>  
> -        dispatch = ldl_be_phys(cs->as,
> +        dispatch = ldl_be_phys(as,
>                                 spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
>          dispatch++;
>          if ((dispatch & 1) != 1) {
> @@ -4584,7 +4584,7 @@ static void spapr_cpu_exec_exit(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
>                            "preempted partition %u, correcting.\n", dispatch);
>              dispatch++;
>          }
> -        stl_be_phys(cs->as,
> +        stl_be_phys(as,
>                      spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER, dispatch);
>      }
>  }
> diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
> index 8c1e0a4817b..be83b5591b5 100644
> --- a/hw/ppc/spapr_hcall.c
> +++ b/hw/ppc/spapr_hcall.c
> @@ -321,7 +321,7 @@ unmap_out:
>  
>  static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
>  {
> -    CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      CPUPPCState *env = &cpu->env;
>      SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
>      uint16_t size;
> @@ -337,7 +337,7 @@ static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
>      }
>      /* FIXME: bounds check the address */
>  
> -    size = lduw_be_phys(cs->as, vpa + 0x4);
> +    size = lduw_be_phys(as, vpa + 0x4);
>  
>      if (size < VPA_MIN_SIZE) {
>          return H_PARAMETER;
> @@ -350,9 +350,9 @@ static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
>  
>      spapr_cpu->vpa_addr = vpa;
>  
> -    tmp = ldub_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET);
> +    tmp = ldub_phys(as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET);
>      tmp |= VPA_SHARED_PROC_VAL;
> -    stb_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET, tmp);
> +    stb_phys(as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET, tmp);
>  
>      return H_SUCCESS;
>  }
> @@ -375,6 +375,7 @@ static target_ulong deregister_vpa(PowerPCCPU *cpu, target_ulong vpa)
>  
>  static target_ulong register_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
>  {
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
>      uint32_t size;
>  
> @@ -383,7 +384,7 @@ static target_ulong register_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
>          return H_HARDWARE;
>      }
>  
> -    size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
> +    size = ldl_be_phys(as, addr + 0x4);
>      if (size < 0x8) {
>          return H_PARAMETER;
>      }
> @@ -413,6 +414,7 @@ static target_ulong deregister_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
>  
>  static target_ulong register_dtl(PowerPCCPU *cpu, target_ulong addr)
>  {
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
>      uint32_t size;
>  
> @@ -421,7 +423,7 @@ static target_ulong register_dtl(PowerPCCPU *cpu, target_ulong addr)
>          return H_HARDWARE;
>      }
>  
> -    size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
> +    size = ldl_be_phys(as, addr + 0x4);
>  
>      if (size < 48) {
>          return H_PARAMETER;
> @@ -579,6 +581,7 @@ static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
>      target_long target = args[0];
>      uint32_t dispatch = args[1];
>      CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      SpaprCpuState *spapr_cpu;
>  
>      assert(tcg_enabled()); /* KVM will have handled this */
> @@ -608,7 +611,7 @@ static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
>              return H_SUCCESS;
>          }
>  
> -        target_dispatch = ldl_be_phys(cs->as,
> +        target_dispatch = ldl_be_phys(as,
>                                    spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
>          if (target_dispatch != dispatch) {
>              return H_SUCCESS;
> @@ -667,22 +670,22 @@ static target_ulong h_rtas(PowerPCCPU *cpu, SpaprMachineState *spapr,
>  static target_ulong h_logical_load(PowerPCCPU *cpu, SpaprMachineState *spapr,
>                                     target_ulong opcode, target_ulong *args)
>  {
> -    CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      target_ulong size = args[0];
>      target_ulong addr = args[1];
>  
>      switch (size) {
>      case 1:
> -        args[0] = ldub_phys(cs->as, addr);
> +        args[0] = ldub_phys(as, addr);
>          return H_SUCCESS;
>      case 2:
> -        args[0] = lduw_phys(cs->as, addr);
> +        args[0] = lduw_phys(as, addr);
>          return H_SUCCESS;
>      case 4:
> -        args[0] = ldl_phys(cs->as, addr);
> +        args[0] = ldl_phys(as, addr);
>          return H_SUCCESS;
>      case 8:
> -        args[0] = ldq_phys(cs->as, addr);
> +        args[0] = ldq_phys(as, addr);
>          return H_SUCCESS;
>      }
>      return H_PARAMETER;
> @@ -691,7 +694,7 @@ static target_ulong h_logical_load(PowerPCCPU *cpu, SpaprMachineState *spapr,
>  static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
>                                      target_ulong opcode, target_ulong *args)
>  {
> -    CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>  
>      target_ulong size = args[0];
>      target_ulong addr = args[1];
> @@ -699,16 +702,16 @@ static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
>  
>      switch (size) {
>      case 1:
> -        stb_phys(cs->as, addr, val);
> +        stb_phys(as, addr, val);
>          return H_SUCCESS;
>      case 2:
> -        stw_phys(cs->as, addr, val);
> +        stw_phys(as, addr, val);
>          return H_SUCCESS;
>      case 4:
> -        stl_phys(cs->as, addr, val);
> +        stl_phys(as, addr, val);
>          return H_SUCCESS;
>      case 8:
> -        stq_phys(cs->as, addr, val);
> +        stq_phys(as, addr, val);
>          return H_SUCCESS;
>      }
>      return H_PARAMETER;
> @@ -717,7 +720,7 @@ static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
>  static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
>                                      target_ulong opcode, target_ulong *args)
>  {
> -    CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>  
>      target_ulong dst   = args[0]; /* Destination address */
>      target_ulong src   = args[1]; /* Source address */
> @@ -745,16 +748,16 @@ static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
>      while (count--) {
>          switch (esize) {
>          case 0:
> -            tmp = ldub_phys(cs->as, src);
> +            tmp = ldub_phys(as, src);
>              break;
>          case 1:
> -            tmp = lduw_phys(cs->as, src);
> +            tmp = lduw_phys(as, src);
>              break;
>          case 2:
> -            tmp = ldl_phys(cs->as, src);
> +            tmp = ldl_phys(as, src);
>              break;
>          case 3:
> -            tmp = ldq_phys(cs->as, src);
> +            tmp = ldq_phys(as, src);
>              break;
>          default:
>              return H_PARAMETER;
> @@ -764,16 +767,16 @@ static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
>          }
>          switch (esize) {
>          case 0:
> -            stb_phys(cs->as, dst, tmp);
> +            stb_phys(as, dst, tmp);
>              break;
>          case 1:
> -            stw_phys(cs->as, dst, tmp);
> +            stw_phys(as, dst, tmp);
>              break;
>          case 2:
> -            stl_phys(cs->as, dst, tmp);
> +            stl_phys(as, dst, tmp);
>              break;
>          case 3:
> -            stq_phys(cs->as, dst, tmp);
> +            stq_phys(as, dst, tmp);
>              break;
>          }
>          dst = dst + step;
> diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
> index c2432a0c00c..8b0c8bff8ef 100644
> --- a/hw/ppc/spapr_iommu.c
> +++ b/hw/ppc/spapr_iommu.c
> @@ -485,7 +485,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
>      target_ulong npages = args[3];
>      target_ulong ret = H_PARAMETER, tce = 0;
>      SpaprTceTable *tcet = spapr_tce_find_by_liobn(liobn);
> -    CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      hwaddr page_mask, page_size;
>  
>      if (!tcet) {
> @@ -501,7 +501,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
>      ioba &= page_mask;
>  
>      for (i = 0; i < npages; ++i, ioba += page_size) {
> -        tce = ldq_be_phys(cs->as, tce_list + i * sizeof(target_ulong));
> +        tce = ldq_be_phys(as, tce_list + i * sizeof(target_ulong));
>  
>          ret = put_tce_emu(tcet, ioba, tce);
>          if (ret) {
> diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
> index 10cf634da19..0486820e2ce 100644
> --- a/hw/ppc/spapr_nested.c
> +++ b/hw/ppc/spapr_nested.c
> @@ -36,6 +36,7 @@ uint8_t spapr_nested_api(SpaprMachineState *spapr)
>  bool spapr_get_pate_nested_hv(SpaprMachineState *spapr, PowerPCCPU *cpu,
>                                target_ulong lpid, ppc_v3_pate_t *entry)
>  {
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      uint64_t patb, pats;
>  
>      assert(lpid != 0);
> @@ -56,8 +57,8 @@ bool spapr_get_pate_nested_hv(SpaprMachineState *spapr, PowerPCCPU *cpu,
>  
>      /* Grab entry */
>      patb += 16 * lpid;
> -    entry->dw0 = ldq_phys(CPU(cpu)->as, patb);
> -    entry->dw1 = ldq_phys(CPU(cpu)->as, patb + 8);
> +    entry->dw0 = ldq_phys(as, patb);
> +    entry->dw1 = ldq_phys(as, patb + 8);
>      return true;
>  }
>  
> @@ -329,6 +330,7 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
>      PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
>      CPUPPCState *env = &cpu->env;
>      CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(cs, 0);
>      SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
>      struct nested_ppc_state l2_state;
>      target_ulong hv_ptr = args[0];
> @@ -345,16 +347,16 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
>      }
>  
>      len = sizeof(*hvstate);
> -    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, false,
> +    hvstate = address_space_map(as, hv_ptr, &len, false,
>                                  MEMTXATTRS_UNSPECIFIED);
>      if (len != sizeof(*hvstate)) {
> -        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, false);
> +        address_space_unmap(as, hvstate, len, 0, false);
>          return H_PARAMETER;
>      }
>  
>      memcpy(&hv_state, hvstate, len);
>  
> -    address_space_unmap(CPU(cpu)->as, hvstate, len, len, false);
> +    address_space_unmap(as, hvstate, len, len, false);
>  
>      /*
>       * We accept versions 1 and 2. Version 2 fields are unused because TCG
> @@ -378,10 +380,10 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
>      nested_save_state(spapr_cpu->nested_host_state, cpu);
>  
>      len = sizeof(*regs);
> -    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, false,
> +    regs = address_space_map(as, regs_ptr, &len, false,
>                                  MEMTXATTRS_UNSPECIFIED);
>      if (!regs || len != sizeof(*regs)) {
> -        address_space_unmap(CPU(cpu)->as, regs, len, 0, false);
> +        address_space_unmap(as, regs, len, 0, false);
>          g_free(spapr_cpu->nested_host_state);
>          return H_P2;
>      }
> @@ -397,7 +399,7 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
>      l2_state.msr = regs->msr;
>      l2_state.nip = regs->nip;
>  
> -    address_space_unmap(CPU(cpu)->as, regs, len, len, false);
> +    address_space_unmap(as, regs, len, len, false);
>  
>      l2_state.cfar = hv_state.cfar;
>      l2_state.lpidr = hv_state.lpid;
> @@ -460,6 +462,7 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
>  {
>      CPUPPCState *env = &cpu->env;
>      CPUState *cs = CPU(cpu);
> +    AddressSpace *as = cpu_get_address_space(cs, 0);
>      SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
>      struct nested_ppc_state l2_state;
>      target_ulong hv_ptr = spapr_cpu->nested_host_state->gpr[4];
> @@ -492,10 +495,10 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
>      spapr_cpu->nested_host_state = NULL;
>  
>      len = sizeof(*hvstate);
> -    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, true,
> +    hvstate = address_space_map(as, hv_ptr, &len, true,
>                                  MEMTXATTRS_UNSPECIFIED);
>      if (len != sizeof(*hvstate)) {
> -        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, true);
> +        address_space_unmap(as, hvstate, len, 0, true);
>          env->gpr[3] = H_PARAMETER;
>          return;
>      }
> @@ -525,13 +528,13 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
>      hvstate->ppr = l2_state.ppr;
>  
>      /* Is it okay to specify write length larger than actual data written? */
> -    address_space_unmap(CPU(cpu)->as, hvstate, len, len, true);
> +    address_space_unmap(as, hvstate, len, len, true);
>  
>      len = sizeof(*regs);
> -    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, true,
> +    regs = address_space_map(as, regs_ptr, &len, true,
>                                  MEMTXATTRS_UNSPECIFIED);
>      if (!regs || len != sizeof(*regs)) {
> -        address_space_unmap(CPU(cpu)->as, regs, len, 0, true);
> +        address_space_unmap(as, regs, len, 0, true);
>          env->gpr[3] = H_P2;
>          return;
>      }
> @@ -556,7 +559,7 @@ static void spapr_exit_nested_hv(PowerPCCPU *cpu, int excp)
>      }
>  
>      /* Is it okay to specify write length larger than actual data written? */
> -    address_space_unmap(CPU(cpu)->as, regs, len, len, true);
> +    address_space_unmap(as, regs, len, len, true);
>  }
>  
>  static bool spapr_nested_vcpu_check(SpaprMachineStateNestedGuest *guest,
> @@ -1506,6 +1509,7 @@ static target_ulong map_and_getset_state(PowerPCCPU *cpu,
>                                           uint64_t vcpuid,
>                                           struct guest_state_request *gsr)
>  {
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      target_ulong rc;
>      int64_t len;
>      bool is_write;
> @@ -1513,7 +1517,7 @@ static target_ulong map_and_getset_state(PowerPCCPU *cpu,
>      len = gsr->len;
>      /* only get_state would require write access to the provided buffer */
>      is_write = (gsr->flags & GUEST_STATE_REQUEST_SET) ? false : true;
> -    gsr->gsb = address_space_map(CPU(cpu)->as, gsr->buf, (uint64_t *)&len,
> +    gsr->gsb = address_space_map(as, gsr->buf, (uint64_t *)&len,
>                                   is_write, MEMTXATTRS_UNSPECIFIED);
>      if (!gsr->gsb) {
>          rc = H_P3;
> @@ -1528,7 +1532,7 @@ static target_ulong map_and_getset_state(PowerPCCPU *cpu,
>      rc = getset_state(spapr, guest, vcpuid, gsr);
>  
>  out1:
> -    address_space_unmap(CPU(cpu)->as, gsr->gsb, len, is_write, len);
> +    address_space_unmap(as, gsr->gsb, len, is_write, len);
>      return rc;
>  }
>  
> @@ -1699,6 +1703,7 @@ static void exit_process_output_buffer(SpaprMachineState *spapr,
>                                         target_ulong vcpuid,
>                                         target_ulong *r3)
>  {
> +    AddressSpace *as = cpu_get_address_space(CPU(cpu), 0);
>      SpaprMachineStateNestedGuestVcpu *vcpu = &guest->vcpus[vcpuid];
>      struct guest_state_request gsr;
>      struct guest_state_buffer *gsb;
> @@ -1709,10 +1714,10 @@ static void exit_process_output_buffer(SpaprMachineState *spapr,
>      hwaddr len;
>  
>      len = vcpu->runbufout.size;
> -    gsb = address_space_map(CPU(cpu)->as, vcpu->runbufout.addr, &len, true,
> +    gsb = address_space_map(as, vcpu->runbufout.addr, &len, true,
>                              MEMTXATTRS_UNSPECIFIED);
>      if (!gsb || len != vcpu->runbufout.size) {
> -        address_space_unmap(CPU(cpu)->as, gsb, len, true, len);
> +        address_space_unmap(as, gsb, len, true, len);
>          *r3 = H_P2;
>          return;
>      }
> @@ -1734,7 +1739,7 @@ static void exit_process_output_buffer(SpaprMachineState *spapr,
>      gsr.flags = 0; /* get + never guest wide */
>      getset_state(spapr, guest, vcpuid, &gsr);
>  
> -    address_space_unmap(CPU(cpu)->as, gsb, len, true, len);
> +    address_space_unmap(as, gsb, len, true, len);
>  }
>  
>  static

Re: [PATCH 02/22] disas/disas-mon: Get cpu first addr space with cpu_get_address_space()

[BALATON Zoltan]

[-- Attachment #1: Type: text/plain, Size: 1067 bytes --]

On Wed, 1 Oct 2025, Philippe Mathieu-Daudé wrote:
> In order to remove the convenient CPUState::as field, access
> the vcpu first address space using the cpu_get_address_space()
> helper.
>
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
> disas/disas-mon.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/disas/disas-mon.c b/disas/disas-mon.c
> index 9c693618c27..f2e45d16021 100644
> --- a/disas/disas-mon.c
> +++ b/disas/disas-mon.c
> @@ -29,9 +29,10 @@ physical_read_memory(bfd_vma memaddr, bfd_byte *myaddr, int length,
>                      struct disassemble_info *info)
> {
>     CPUDebug *s = container_of(info, CPUDebug, info);
> +    AddressSpace *as = cpu_get_address_space(s->cpu, 0);
>     MemTxResult res;
>
> -    res = address_space_read(s->cpu->as, memaddr, MEMTXATTRS_UNSPECIFIED,
> +    res = address_space_read(as, memaddr, MEMTXATTRS_UNSPECIFIED,
>                              myaddr, length);

Does this now fit on one line?

Regards,
BALATON Zoltan

>     return res == MEMTX_OK ? 0 : EIO;
> }
>

Re: [PATCH 03/22] monitor/hmp-cmds: Get cpu first addr space with cpu_get_address_space()

[BALATON Zoltan]

[-- Attachment #1: Type: text/plain, Size: 1424 bytes --]

On Wed, 1 Oct 2025, Philippe Mathieu-Daudé wrote:
> In order to remove the convenient CPUState::as field, access
> the vcpu first address space using the cpu_get_address_space()
> helper.
>
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
> monitor/hmp-cmds-target.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
> index e9820611466..602af851328 100644
> --- a/monitor/hmp-cmds-target.c
> +++ b/monitor/hmp-cmds-target.c
> @@ -128,6 +128,8 @@ static void memory_dump(Monitor *mon, int count, int format, int wsize,
>     uint8_t buf[16];
>     uint64_t v;
>     CPUState *cs = mon_get_cpu(mon);
> +    AddressSpace *as = cs ? cpu_get_address_space(cs, 0)
> +                          : &address_space_memory;

Why move from local scope to an upper level?

Regards,
BALATON Zoltan

>     if (!cs && (format == 'i' || !is_physical)) {
>         monitor_printf(mon, "Can not dump without CPU\n");
> @@ -174,7 +176,6 @@ static void memory_dump(Monitor *mon, int count, int format, int wsize,
>         if (l > line_size)
>             l = line_size;
>         if (is_physical) {
> -            AddressSpace *as = cs ? cs->as : &address_space_memory;
>             MemTxResult r = address_space_read(as, addr,
>                                                MEMTXATTRS_UNSPECIFIED, buf, l);
>             if (r != MEMTX_OK) {
>

Re: [PATCH 00/22] hw/core/cpu: Remove @CPUState::as field

[BALATON Zoltan]

[-- Attachment #1: Type: text/plain, Size: 4616 bytes --]

On Wed, 1 Oct 2025, Philippe Mathieu-Daudé wrote:
> Instead of using the convenient @CPUState::as shortcut, use

I'm not sure convenient in English means what you meant here at least it's 
not clear to me what you mean. Does this make it more inconvenient? Maybe 
you need a different word here.

> cpu_get_address_space(asidx=0) to get the vCPU first address

Could you move cpu_get_address_space() to the header and make it inline? I 
know you had another series to reduce inline functions but this is just 
one line and won't be inlined by the compiler unless it's defined in the 
header. I don't know if this is relevant but it keeps closer to the 
current behaviour.

Regards,
BALATON Zoltan

> space.
>
> The goal is to reduce the risk of AS mis-use for targets
> that uses multiple ASes per vCPU.
>
> Based-on: <20251001082127.65741-1-philmd@linaro.org>
>
> Philippe Mathieu-Daudé (22):
>  system/qtest: Use &address_space_memory for first vCPU address space
>  disas/disas-mon: Get cpu first addr space with cpu_get_address_space()
>  monitor/hmp-cmds: Get cpu first addr space with
>    cpu_get_address_space()
>  hw/core/loader: Get cpu first addr space with cpu_get_address_space()
>  hw/ppc: Get cpu first addr space with cpu_get_address_space()
>  hw/m86k: Get cpu first addr space with cpu_get_address_space()
>  target/xtensa: Get cpu first addr space with cpu_get_address_space()
>  target/riscv: Get cpu first addr space with cpu_get_address_space()
>  semihosting: Get cpu first addr space with cpu_get_address_space()
>  target/alpha: Get cpu first addr space with cpu_get_address_space()
>  target/arm: Get cpu first addr space with cpu_get_address_space()
>  target/hppa: Get cpu first addr space with cpu_get_address_space()
>  target/i386: Get cpu first addr space with cpu_get_address_space()
>  target/loongarch: Get cpu first addr space with
>    cpu_get_address_space()
>  target/m68k: Get cpu first addr space with cpu_get_address_space()
>  target/microblaze: Get cpu first addr space with
>    cpu_get_address_space()
>  target/ppc: Get cpu first addr space with cpu_get_address_space()
>  target/s390x: Get cpu first addr space with cpu_get_address_space()
>  target/sparc: Get cpu first addr space with cpu_get_address_space()
>  hw/core/cpu: Remove @CPUState::as field
>  exec/cpu: Declare cpu_memory_rw_debug() in 'hw/core/cpu.h' and
>    document
>  target/sparc: Reduce inclusions of 'exec/cpu-common.h'
>
> include/exec/cpu-common.h         |  4 ---
> include/hw/core/cpu.h             | 23 +++++++++++--
> target/ppc/mmu-hash32.h           | 12 ++++---
> target/sparc/cpu.h                |  1 -
> disas/disas-mon.c                 |  3 +-
> hw/core/cpu-common.c              |  1 -
> hw/core/generic-loader.c          |  5 +--
> hw/intc/spapr_xive.c              |  5 +--
> hw/m68k/mcf5208.c                 |  6 ++--
> hw/m68k/q800.c                    | 17 ++++++----
> hw/m68k/virt.c                    |  5 +--
> hw/ppc/pegasos2.c                 |  2 +-
> hw/ppc/spapr.c                    | 12 +++----
> hw/ppc/spapr_hcall.c              | 55 ++++++++++++++++---------------
> hw/ppc/spapr_iommu.c              |  4 +--
> hw/ppc/spapr_nested.c             | 43 +++++++++++++-----------
> monitor/hmp-cmds-target.c         |  3 +-
> semihosting/arm-compat-semi.c     |  4 ++-
> system/cpus.c                     |  2 +-
> system/physmem.c                  | 10 ------
> system/qtest.c                    | 27 +++++++--------
> target/alpha/helper.c             |  8 +++--
> target/arm/cpu.c                  |  7 ++--
> target/hppa/int_helper.c          |  3 +-
> target/i386/arch_memory_mapping.c | 10 +++---
> target/loongarch/cpu_helper.c     |  5 +--
> target/loongarch/tcg/tlb_helper.c |  7 ++--
> target/m68k/helper.c              | 28 ++++++++--------
> target/microblaze/op_helper.c     |  6 ++--
> target/ppc/excp_helper.c          |  4 +--
> target/ppc/mmu-book3s-v3.c        |  5 +--
> target/ppc/mmu-hash32.c           |  6 ++--
> target/ppc/mmu-hash64.c           | 12 ++++---
> target/ppc/mmu-radix64.c          | 13 ++++----
> target/riscv/cpu_helper.c         |  7 ++--
> target/s390x/cpu-system.c         |  4 ++-
> target/s390x/mmu_helper.c         |  9 ++---
> target/s390x/tcg/excp_helper.c    | 10 +++---
> target/s390x/tcg/mem_helper.c     |  6 ++--
> target/sparc/helper.c             |  1 +
> target/sparc/int64_helper.c       |  1 +
> target/sparc/ldst_helper.c        | 22 +++++++------
> target/sparc/mmu_helper.c         | 21 +++++++-----
> target/xtensa/mmu_helper.c        |  3 +-
> 44 files changed, 253 insertions(+), 189 deletions(-)
>
>

Re: [PATCH 00/22] hw/core/cpu: Remove @CPUState::as field

[Peter Maydell]

On Wed, 1 Oct 2025 at 16:05, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
>
> Instead of using the convenient @CPUState::as shortcut, use
> cpu_get_address_space(asidx=0) to get the vCPU first address
> space.
>
> The goal is to reduce the risk of AS mis-use for targets
> that uses multiple ASes per vCPU.

I'm not sure I agree with this. The cpu->as is handy for
the large number of targets which only use one AddressSpace:
which is everything except arm and x86 right now.

Targets that use multiple address spaces need to be careful
about which AS they use by definition. Unless we have a
track record of code in those targets carelessly using
cpu->as when it should do something else, I'm not sure
that there's a benefit that makes it worth making the
"use the one and only AS this CPU will ever have" more awkward.

thanks
-- PMM

Re: [PATCH 03/22] monitor/hmp-cmds: Get cpu first addr space with cpu_get_address_space()

[Philippe Mathieu-Daudé]

On 1/10/25 17:35, BALATON Zoltan wrote:
> On Wed, 1 Oct 2025, Philippe Mathieu-Daudé wrote:
>> In order to remove the convenient CPUState::as field, access
>> the vcpu first address space using the cpu_get_address_space()
>> helper.
>>
>> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>> ---
>> monitor/hmp-cmds-target.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/monitor/hmp-cmds-target.c b/monitor/hmp-cmds-target.c
>> index e9820611466..602af851328 100644
>> --- a/monitor/hmp-cmds-target.c
>> +++ b/monitor/hmp-cmds-target.c
>> @@ -128,6 +128,8 @@ static void memory_dump(Monitor *mon, int count, 
>> int format, int wsize,
>>     uint8_t buf[16];
>>     uint64_t v;
>>     CPUState *cs = mon_get_cpu(mon);
>> +    AddressSpace *as = cs ? cpu_get_address_space(cs, 0)
>> +                          : &address_space_memory;
> 
> Why move from local scope to an upper level?

Out of the while() loop to call it once only.

> 
> Regards,
> BALATON Zoltan
> 
>>     if (!cs && (format == 'i' || !is_physical)) {
>>         monitor_printf(mon, "Can not dump without CPU\n");
>> @@ -174,7 +176,6 @@ static void memory_dump(Monitor *mon, int count, 
>> int format, int wsize,
>>         if (l > line_size)
>>             l = line_size;
>>         if (is_physical) {
>> -            AddressSpace *as = cs ? cs->as : &address_space_memory;
>>             MemTxResult r = address_space_read(as, addr,
>>                                                MEMTXATTRS_UNSPECIFIED, 
>> buf, l);
>>             if (r != MEMTX_OK) {
>>

Re: [PATCH 00/22] hw/core/cpu: Remove @CPUState::as field

[Richard Henderson]

On 10/1/25 09:08, Peter Maydell wrote:
> On Wed, 1 Oct 2025 at 16:05, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
>>
>> Instead of using the convenient @CPUState::as shortcut, use
>> cpu_get_address_space(asidx=0) to get the vCPU first address
>> space.
>>
>> The goal is to reduce the risk of AS mis-use for targets
>> that uses multiple ASes per vCPU.
> 
> I'm not sure I agree with this. The cpu->as is handy for
> the large number of targets which only use one AddressSpace:
> which is everything except arm and x86 right now.
> 
> Targets that use multiple address spaces need to be careful
> about which AS they use by definition. Unless we have a
> track record of code in those targets carelessly using
> cpu->as when it should do something else, I'm not sure
> that there's a benefit that makes it worth making the
> "use the one and only AS this CPU will ever have" more awkward.

I agree.

Moreover, '0' as a default is just as bad as cpu->as, because you're giving no thought to 
the selection.  Similarly using MEMATTRS_UNSPECIFIED.  When such things matter, we need 
the real attributes and/or as piped down from the proper memory reference.


r~

Re: [PATCH 00/22] hw/core/cpu: Remove @CPUState::as field

[Philippe Mathieu-Daudé]

On 1/10/25 18:35, Richard Henderson wrote:
> On 10/1/25 09:08, Peter Maydell wrote:
>> On Wed, 1 Oct 2025 at 16:05, Philippe Mathieu-Daudé 
>> <philmd@linaro.org> wrote:
>>>
>>> Instead of using the convenient @CPUState::as shortcut, use
>>> cpu_get_address_space(asidx=0) to get the vCPU first address
>>> space.
>>>
>>> The goal is to reduce the risk of AS mis-use for targets
>>> that uses multiple ASes per vCPU.
>>
>> I'm not sure I agree with this. The cpu->as is handy for
>> the large number of targets which only use one AddressSpace:
>> which is everything except arm and x86 right now.
>>
>> Targets that use multiple address spaces need to be careful
>> about which AS they use by definition. Unless we have a
>> track record of code in those targets carelessly using
>> cpu->as when it should do something else, I'm not sure
>> that there's a benefit that makes it worth making the
>> "use the one and only AS this CPU will ever have" more awkward.
> 
> I agree.
> 
> Moreover, '0' as a default is just as bad as cpu->as, because you're 
> giving no thought to the selection.  Similarly using 
> MEMATTRS_UNSPECIFIED.  When such things matter, we need the real 
> attributes and/or as piped down from the proper memory reference.

OK.

Re: [PATCH 00/22] hw/core/cpu: Remove @CPUState::as field

[Philippe Mathieu-Daudé]

Hi,

On 1/10/25 18:42, Philippe Mathieu-Daudé wrote:
> On 1/10/25 18:35, Richard Henderson wrote:
>> On 10/1/25 09:08, Peter Maydell wrote:


>>> Targets that use multiple address spaces need to be careful
>>> about which AS they use by definition. Unless we have a
>>> track record of code in those targets carelessly using
>>> cpu->as when it should do something else, I'm not sure
>>> that there's a benefit that makes it worth making the
>>> "use the one and only AS this CPU will ever have" more awkward.
>>
>> I agree.
>>
>> Moreover, '0' as a default is just as bad as cpu->as, because you're 
>> giving no thought to the selection.  Similarly using 
>> MEMATTRS_UNSPECIFIED.  When such things matter, we need the real 
>> attributes and/or as piped down from the proper memory reference.

W.r.t MEMATTRS_UNSPECIFIED, is it better to have a legacy API using
it discreetly under the hood, or have it explicit by using the
recommended API without changing the default values?

To kill a legacy API such replacement is worthwhile IMHO,
otherwise the code stays in a limbo, we have issues with
developpers using different APIs / styles, etc. Also maintainers
are Cc'ed during conversion series, so they can suggest better
replacement for defaults such MEMATTRS_UNSPECIFIED.

Regards,

Phil.

Re: [PATCH 21/22] exec/cpu: Declare cpu_memory_rw_debug() in 'hw/core/cpu.h' and document

[Philippe Mathieu-Daudé]

(ping for this single patch)

On 1/10/25 17:05, Philippe Mathieu-Daudé wrote:
> cpu_memory_rw_debug() dispatches to CPUClass::memory_rw_debug(),
> move its declaration closer to the CPU API. Document.
> 
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
>   include/exec/cpu-common.h |  4 ----
>   include/hw/core/cpu.h     | 20 ++++++++++++++++++++
>   2 files changed, 20 insertions(+), 4 deletions(-)
> 
> diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
> index 910e1c2afb9..ce64a999035 100644
> --- a/include/exec/cpu-common.h
> +++ b/include/exec/cpu-common.h
> @@ -150,10 +150,6 @@ typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
>   
>   int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
>   
> -/* Returns: 0 on success, -1 on error */
> -int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
> -                        void *ptr, size_t len, bool is_write);
> -
>   /* vl.c */
>   void list_cpus(void);
>   
> diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
> index 0f7eda1a10d..1e928f57c99 100644
> --- a/include/hw/core/cpu.h
> +++ b/include/hw/core/cpu.h
> @@ -685,6 +685,26 @@ int cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cpu,
>   int cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
>                                void *opaque);
>   
> +/**
> + * cpu_memory_rw_debug:
> + * @cpu: The CPU whose memory is to be accessed
> + * @addr: guest virtual address
> + * @ptr: buffer with the data transferred
> + * @len: the number of bytes to read or write
> + * @is_write: indicates the transfer direction
> + *
> + * Take a virtual address, convert it to a physical address via
> + * an MMU lookup using the current settings of the specified CPU,
> + * and then perform the access (using address_space_rw() for
> + * reads or address_space_write_rom() for writes).
> + *
> + * This function is intended for use by the GDB stub and similar code.
> + *
> + * Returns: 0 on success, -1 on error
> + */
> +int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
> +                        void *ptr, size_t len, bool is_write);
> +
>   /**
>    * cpu_get_crash_info:
>    * @cpu: The CPU to get crash information for

Re: [PATCH 21/22] exec/cpu: Declare cpu_memory_rw_debug() in 'hw/core/cpu.h' and document

[Zhao Liu]

On Wed, Oct 01, 2025 at 05:05:26PM +0200, Philippe Mathieu-Daudé wrote:
> Date: Wed,  1 Oct 2025 17:05:26 +0200
> From: Philippe Mathieu-Daudé <philmd@linaro.org>
> Subject: [PATCH 21/22] exec/cpu: Declare cpu_memory_rw_debug() in
>  'hw/core/cpu.h' and document
> X-Mailer: git-send-email 2.51.0
> 
> cpu_memory_rw_debug() dispatches to CPUClass::memory_rw_debug(),
> move its declaration closer to the CPU API. Document.
> 
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
>  include/exec/cpu-common.h |  4 ----
>  include/hw/core/cpu.h     | 20 ++++++++++++++++++++
>  2 files changed, 20 insertions(+), 4 deletions(-)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>

Re: [PATCH 06/22] hw/m86k: Get cpu first addr space with cpu_get_address_space()

[Thomas Huth]

Am Wed,  1 Oct 2025 17:05:11 +0200
schrieb Philippe Mathieu-Daudé <philmd@linaro.org>:

> In order to remove the convenient CPUState::as field, access
> the vcpu first address space using the cpu_get_address_space()
> helper.
> 
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
>  hw/m68k/mcf5208.c |  6 ++++--
>  hw/m68k/q800.c    | 17 ++++++++++-------
>  hw/m68k/virt.c    |  5 +++--
>  3 files changed, 17 insertions(+), 11 deletions(-)

Reviewed-by: Thomas Huth <huth@tuxfamily.org>