[Qemu-devel] [PATCH 23/27] Implement PAPR CRQ hypercalls

[David Gibson]

This patch implements the infrastructure and hypercalls necessary for the
PAPR specified CRQ (Command Request Queue) mechanism.  This general
request queueing system is used by many of the PAPR virtual IO devices,
including the virtual scsi adapter.

Signed-off-by: Ben Herrenschmidt b...@kernel.crashing.org
Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr.c   |2 +-
 hw/spapr_vio.c   |  160 ++
 hw/spapr_vio.h   |   12 
 target-ppc/kvm_ppc.h |   11 
 4 files changed, 184 insertions(+), 1 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index 98ca5ac..3d161db 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -66,7 +66,7 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
 uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
 uint32_t pft_size_prop[] = {0, cpu_to_be32(hash_shift)};
 char hypertas_prop[] = hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt
-\0hcall-tce;
+\0hcall-tce\0hcall-vio;
 uint32_t interrupt_server_ranges_prop[] = {0, cpu_to_be32(smp_cpus)};
 int i;
 char *modelname;
diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index 39d77ee..8f14fcc 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -28,6 +28,7 @@
 #include hw/sysbus.h
 #include kvm.h
 #include device_tree.h
+#include kvm_ppc.h
 
 #include hw/spapr.h
 #include hw/spapr_vio.h
@@ -359,6 +360,159 @@ uint64_t ldq_tce(VIOsPAPRDevice *dev, uint64_t taddr)
 return tswap64(val);
 }
 
+/*
+ * CRQ handling
+ */
+static target_ulong h_reg_crq(CPUState *env, sPAPREnvironment *spapr,
+  target_ulong opcode, target_ulong *args)
+{
+target_ulong reg = args[0];
+target_ulong queue_addr = args[1];
+target_ulong queue_len = args[2];
+VIOsPAPRDevice *dev = spapr_vio_find_by_reg(spapr-vio_bus, reg);
+
+if (!dev) {
+hcall_dprintf(h_reg_crq on non-existent unit 0x
+  TARGET_FMT_lx \n, reg);
+return H_PARAMETER;
+}
+
+/* We can't grok a queue size bigger than 256M for now */
+if (queue_len  0x1000 || queue_len  0x1000) {
+hcall_dprintf(h_reg_crq, queue size too small or too big (0x%llx)\n,
+  (unsigned long long)queue_len);
+return H_PARAMETER;
+}
+
+/* Check queue alignment */
+if (queue_addr  0xfff) {
+hcall_dprintf(h_reg_crq, queue not aligned (0x%llx)\n,
+  (unsigned long long)queue_addr);
+return H_PARAMETER;
+}
+
+/* Check if device supports CRQs */
+if (!dev-crq.SendFunc) {
+return H_NOT_FOUND;
+}
+
+
+/* Already a queue ? */
+if (dev-crq.qsize) {
+return H_RESOURCE;
+}
+dev-crq.qladdr = queue_addr;
+dev-crq.qsize = queue_len;
+dev-crq.qnext = 0;
+
+dprintf(CRQ for dev 0x TARGET_FMT_lx  registered at 0x
+TARGET_FMT_lx /0x TARGET_FMT_lx \n,
+reg, queue_addr, queue_len);
+return H_SUCCESS;
+}
+
+static target_ulong h_free_crq(CPUState *env, sPAPREnvironment *spapr,
+   target_ulong opcode, target_ulong *args)
+{
+target_ulong reg = args[0];
+VIOsPAPRDevice *dev = spapr_vio_find_by_reg(spapr-vio_bus, reg);
+
+if (!dev) {
+hcall_dprintf(h_free_crq on non-existent unit 0x
+  TARGET_FMT_lx \n, reg);
+return H_PARAMETER;
+}
+
+dev-crq.qladdr = 0;
+dev-crq.qsize = 0;
+dev-crq.qnext = 0;
+
+dprintf(CRQ for dev 0x TARGET_FMT_lx  freed\n, reg);
+
+return H_SUCCESS;
+}
+
+static target_ulong h_send_crq(CPUState *env, sPAPREnvironment *spapr,
+   target_ulong opcode, target_ulong *args)
+{
+target_ulong reg = args[0];
+target_ulong msg_hi = args[1];
+target_ulong msg_lo = args[2];
+VIOsPAPRDevice *dev = spapr_vio_find_by_reg(spapr-vio_bus, reg);
+uint64_t crq_mangle[2];
+
+if (!dev) {
+hcall_dprintf(h_send_crq on non-existent unit 0x
+  TARGET_FMT_lx \n, reg);
+return H_PARAMETER;
+}
+crq_mangle[0] = cpu_to_be64(msg_hi);
+crq_mangle[1] = cpu_to_be64(msg_lo);
+
+if (dev-crq.SendFunc) {
+return dev-crq.SendFunc(dev, (uint8_t *)crq_mangle);
+}
+
+return H_HARDWARE;
+}
+
+static target_ulong h_enable_crq(CPUState *env, sPAPREnvironment *spapr,
+ target_ulong opcode, target_ulong *args)
+{
+target_ulong reg = args[0];
+VIOsPAPRDevice *dev = spapr_vio_find_by_reg(spapr-vio_bus, reg);
+
+if (!dev) {
+hcall_dprintf(h_enable_crq on non-existent unit 0x
+  TARGET_FMT_lx \n, reg);
+return H_PARAMETER;
+}
+
+return 0;
+}
+
+/* Returns negative error, 0 success, or positive: queue full */
+int spapr_vio_send_crq(VIOsPAPRDevice *dev, uint8_t *crq)
+{
+int rc;
+uint8_t byte;
+
+if (!dev-crq.qsize) {
+fprintf(stderr, spapr_vio_send_creq on 

[Qemu-devel] [PATCH 08/27] Parse SDR1 on mtspr instead of at translate time

[David Gibson]

On ppc machines with hash table MMUs, the special purpose register SDR1
contains both the base address of the encoded size (hashed) page tables.

At present, we interpret the SDR1 value within the address translation
path.  But because the encodings of the size for 32-bit and 64-bit are
different this makes for a confusing branch on the MMU type with a bunch
of curly shifts and masks in the middle of the translate path.

This patch cleans things up by moving the interpretation on SDR1 into the
helper function handling the write to the register.  This leaves a simple
pre-sanitized base address and mask for the hash table in the CPUState
structure which is easier to work with in the translation path.

This makes the translation path more readable.  It addresses the FIXME
comment currently in the mtsdr1 helper, by validating the SDR1 value during
interpretation.  Finally it opens the way for emulating a pSeries-style
partition where the hash table used for translation is not mapped into
the guests's RAM.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 monitor.c   |2 +-
 target-ppc/cpu.h|   11 +-
 target-ppc/helper.c |   80 ---
 target-ppc/kvm.c|2 +-
 target-ppc/machine.c|6 ++-
 target-ppc/translate.c  |2 +-
 target-ppc/translate_init.c |7 +---
 7 files changed, 63 insertions(+), 47 deletions(-)

diff --git a/monitor.c b/monitor.c
index 76a8207..f1a08dc 100644
--- a/monitor.c
+++ b/monitor.c
@@ -3462,7 +3462,7 @@ static const MonitorDef monitor_defs[] = {
 { asr, offsetof(CPUState, asr) },
 #endif
 /* Segment registers */
-{ sdr1, offsetof(CPUState, sdr1) },
+{ sdr1, offsetof(CPUState, spr[SPR_SDR1]) },
 { sr0, offsetof(CPUState, sr[0]) },
 { sr1, offsetof(CPUState, sr[1]) },
 { sr2, offsetof(CPUState, sr[2]) },
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 37dde39..ead4566 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -359,6 +359,14 @@ union ppc_tlb_t {
 };
 #endif
 
+#define SDR_32_HTABORG 0xUL
+#define SDR_32_HTABMASK0x01FFUL
+
+#if defined(TARGET_PPC64)
+#define SDR_64_HTABORG 0xFFFCULL
+#define SDR_64_HTABSIZE0x001FULL
+#endif /* defined(TARGET_PPC64 */
+
 typedef struct ppc_slb_t ppc_slb_t;
 struct ppc_slb_t {
 uint64_t esid;
@@ -642,7 +650,8 @@ struct CPUPPCState {
 int slb_nr;
 #endif
 /* segment registers */
-target_ulong sdr1;
+target_phys_addr_t htab_base;
+target_phys_addr_t htab_mask;
 target_ulong sr[32];
 /* BATs */
 int nb_BATs;
diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index 7ca33cb..68d2d9c 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -788,20 +788,19 @@ int ppc_load_slb_vsid (CPUPPCState *env, target_ulong rb, 
target_ulong *rt)
 #endif /* defined(TARGET_PPC64) */
 
 /* Perform segment based translation */
-static inline target_phys_addr_t get_pgaddr(target_phys_addr_t sdr1,
-int sdr_sh,
-target_phys_addr_t hash,
-target_phys_addr_t mask)
+static inline target_phys_addr_t get_pgaddr(target_phys_addr_t htab_base,
+target_phys_addr_t htab_mask,
+target_phys_addr_t hash)
 {
-return (sdr1  ((target_phys_addr_t)(-1ULL)  sdr_sh)) | (hash  mask);
+return htab_base | (hash  htab_mask);
 }
 
 static inline int get_segment(CPUState *env, mmu_ctx_t *ctx,
   target_ulong eaddr, int rw, int type)
 {
-target_phys_addr_t sdr, hash, mask, sdr_mask, htab_mask;
+target_phys_addr_t hash;
 target_ulong sr, vsid, vsid_mask, pgidx, page_mask;
-int ds, vsid_sh, sdr_sh, pr, target_page_bits;
+int ds, vsid_sh, pr, target_page_bits;
 int ret, ret2;
 
 pr = msr_pr;
@@ -826,8 +825,6 @@ static inline int get_segment(CPUState *env, mmu_ctx_t *ctx,
 ctx-eaddr = eaddr;
 vsid_mask = 0x3F80ULL;
 vsid_sh = 7;
-sdr_sh = 18;
-sdr_mask = 0x3FF80;
 } else
 #endif /* defined(TARGET_PPC64) */
 {
@@ -840,8 +837,6 @@ static inline int get_segment(CPUState *env, mmu_ctx_t *ctx,
 vsid = sr  0x00FF;
 vsid_mask = 0x01C0;
 vsid_sh = 6;
-sdr_sh = 16;
-sdr_mask = 0xFFC0;
 target_page_bits = TARGET_PAGE_BITS;
 LOG_MMU(Check segment v= TARGET_FMT_lx  %d  TARGET_FMT_lx  nip=
 TARGET_FMT_lx  lr= TARGET_FMT_lx
@@ -857,29 +852,26 @@ static inline int get_segment(CPUState *env, mmu_ctx_t 
*ctx,
 if (type != ACCESS_CODE || ctx-nx == 0) {
 /* Page address translation */
 /* Primary table address */
-sdr = env-sdr1;
 pgidx = (eaddr  page_mask)  target_page_bits;
 #if 

[Qemu-devel] [PATCH 12/27] Add POWER7 support for ppc

[David Gibson]

This adds emulation support for the recent POWER7 cpu to qemu.  It's far
from perfect - it's missing a number of POWER7 features so far, including
any support for VSX or decimal floating point instructions.  However, it's
close enough to boot a kernel with the POWER7 PVR.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/ppc.c|   35 +++
 hw/ppc.h|1 +
 target-ppc/cpu.h|   16 +++
 target-ppc/helper.c |6 +++
 target-ppc/translate_init.c |  103 +++
 5 files changed, 161 insertions(+), 0 deletions(-)

diff --git a/hw/ppc.c b/hw/ppc.c
index b55a848..dabb816 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -247,6 +247,41 @@ void ppc970_irq_init (CPUState *env)
 env-irq_inputs = (void **)qemu_allocate_irqs(ppc970_set_irq, env,
   PPC970_INPUT_NB);
 }
+
+/* POWER7 internal IRQ controller */
+static void power7_set_irq (void *opaque, int pin, int level)
+{
+CPUState *env = opaque;
+int cur_level;
+
+LOG_IRQ(%s: env %p pin %d level %d\n, __func__,
+env, pin, level);
+cur_level = (env-irq_input_state  pin)  1;
+
+switch (pin) {
+case POWER7_INPUT_INT:
+/* Level sensitive - active high */
+LOG_IRQ(%s: set the external IRQ state to %d\n,
+__func__, level);
+ppc_set_irq(env, PPC_INTERRUPT_EXT, level);
+break;
+default:
+/* Unknown pin - do nothing */
+LOG_IRQ(%s: unknown IRQ pin %d\n, __func__, pin);
+return;
+}
+if (level) {
+env-irq_input_state |= 1  pin;
+} else {
+env-irq_input_state = ~(1  pin);
+}
+}
+
+void ppcPOWER7_irq_init (CPUState *env)
+{
+env-irq_inputs = (void **)qemu_allocate_irqs(power7_set_irq, env,
+  POWER7_INPUT_NB);
+}
 #endif /* defined(TARGET_PPC64) */
 
 /* PowerPC 40x internal IRQ controller */
diff --git a/hw/ppc.h b/hw/ppc.h
index 34f54cf..3ccf134 100644
--- a/hw/ppc.h
+++ b/hw/ppc.h
@@ -36,6 +36,7 @@ void ppc40x_irq_init (CPUState *env);
 void ppce500_irq_init (CPUState *env);
 void ppc6xx_irq_init (CPUState *env);
 void ppc970_irq_init (CPUState *env);
+void ppcPOWER7_irq_init (CPUState *env);
 
 /* PPC machines for OpenBIOS */
 enum {
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 10341b3..25d0658 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -119,6 +119,8 @@ enum powerpc_mmu_t {
 POWERPC_MMU_64B= POWERPC_MMU_64 | 0x0001,
 /* 620 variant (no segment exceptions) */
 POWERPC_MMU_620= POWERPC_MMU_64 | 0x0002,
+/* Architecture 2.06 variant   */
+POWERPC_MMU_2_06   = POWERPC_MMU_64 | POWERPC_MMU_1TSEG | 0x0003,
 #endif /* defined(TARGET_PPC64) */
 };
 
@@ -154,6 +156,8 @@ enum powerpc_excp_t {
 #if defined(TARGET_PPC64)
 /* PowerPC 970 exception model  */
 POWERPC_EXCP_970,
+/* POWER7 exception model   */
+POWERPC_EXCP_POWER7,
 #endif /* defined(TARGET_PPC64) */
 };
 
@@ -289,6 +293,8 @@ enum powerpc_input_t {
 PPC_FLAGS_INPUT_405,
 /* PowerPC 970 bus  */
 PPC_FLAGS_INPUT_970,
+/* PowerPC POWER7 bus   */
+PPC_FLAGS_INPUT_POWER7,
 /* PowerPC 401 bus  */
 PPC_FLAGS_INPUT_401,
 /* Freescale RCPU bus   */
@@ -1001,6 +1007,7 @@ static inline void cpu_clone_regs(CPUState *env, 
target_ulong newsp)
 #define SPR_HSPRG1(0x131)
 #define SPR_HDSISR(0x132)
 #define SPR_HDAR  (0x133)
+#define SPR_SPURR (0x134)
 #define SPR_BOOKE_DBCR0   (0x134)
 #define SPR_IBCR  (0x135)
 #define SPR_PURR  (0x135)
@@ -1625,6 +1632,15 @@ enum {
 PPC970_INPUT_THINT  = 6,
 PPC970_INPUT_NB,
 };
+
+enum {
+/* POWER7 input pins */
+POWER7_INPUT_INT= 0,
+/* POWER7 probably has other inputs, but we don't care about them
+ * for any existing machine.  We can wire these up when we need
+ * them */
+POWER7_INPUT_NB,
+};
 #endif
 
 /* Hardware exceptions definitions */
diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index 6712fce..278bee4 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -1200,6 +1200,7 @@ static inline int check_physical(CPUState *env, mmu_ctx_t 
*ctx,
 #if defined(TARGET_PPC64)
 case POWERPC_MMU_620:
 case POWERPC_MMU_64B:
+case POWERPC_MMU_2_06:
 /* Real address are 60 bits long */
 ctx-raddr = 0x0FFFULL;
 ctx-prot |= PAGE_WRITE;
@@ -1277,6 +1278,7 @@ int get_physical_address (CPUState *env, mmu_ctx_t *ctx, 
target_ulong eaddr,
 #if defined(TARGET_PPC64)
 case POWERPC_MMU_620:
 case POWERPC_MMU_64B:
+case POWERPC_MMU_2_06:
 #endif
 if (ret  0) {
 /* We didn't match any BAT entry or don't 

[Qemu-devel] [PATCH 21/27] Implement TCE translation for sPAPR VIO

[David Gibson]

This patch implements the necessary infrastructure and hypercalls for
sPAPR's TCE (Translation Control Entry) IOMMU mechanism.  This is necessary
for all virtual IO devices which do DMA (i.e. nearly all of them).

Signed-off-by: Ben Herrenschmidt b...@kernel.crashing.org
Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr.c |3 +-
 hw/spapr_vio.c |  238 
 hw/spapr_vio.h |   32 
 3 files changed, 272 insertions(+), 1 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index cd09104..bc0cd0e 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -64,7 +64,8 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
 uint32_t start_prop = cpu_to_be32(initrd_base);
 uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
 uint32_t pft_size_prop[] = {0, cpu_to_be32(hash_shift)};
-char hypertas_prop[] = 
hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt;
+char hypertas_prop[] = hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt
+\0hcall-tce;
 uint32_t interrupt_server_ranges_prop[] = {0, cpu_to_be32(smp_cpus)};
 int i;
 char *modelname;
diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index 605079c..39d77ee 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -37,6 +37,7 @@
 #endif /* CONFIG_FDT */
 
 /* #define DEBUG_SPAPR */
+/* #define DEBUG_TCE */
 
 #ifdef DEBUG_SPAPR
 #define dprintf(fmt, ...) \
@@ -115,6 +116,28 @@ static int vio_make_devnode(VIOsPAPRDevice *dev,
 }
 }
 
+if (dev-rtce_window_size) {
+uint32_t dma_prop[] = {cpu_to_be32(dev-reg),
+   0, 0,
+   0, cpu_to_be32(dev-rtce_window_size)};
+
+ret = fdt_setprop_cell(fdt, node_off, ibm,#dma-address-cells, 2);
+if (ret  0) {
+return ret;
+}
+
+ret = fdt_setprop_cell(fdt, node_off, ibm,#dma-size-cells, 2);
+if (ret  0) {
+return ret;
+}
+
+ret = fdt_setprop(fdt, node_off, ibm,my-dma-window, dma_prop,
+  sizeof(dma_prop));
+if (ret  0) {
+return ret;
+}
+}
+
 if (info-devnode) {
 ret = (info-devnode)(dev, fdt, node_off);
 if (ret  0) {
@@ -126,6 +149,216 @@ static int vio_make_devnode(VIOsPAPRDevice *dev,
 }
 #endif /* CONFIG_FDT */
 
+/*
+ * RTCE handling
+ */
+
+static void rtce_init(VIOsPAPRDevice *dev)
+{
+size_t size = (dev-rtce_window_size  SPAPR_VIO_TCE_PAGE_SHIFT)
+* sizeof(VIOsPAPR_RTCE);
+
+if (size) {
+dev-rtce_table = qemu_mallocz(size);
+}
+}
+
+static target_ulong h_put_tce(CPUState *env, sPAPREnvironment *spapr,
+  target_ulong opcode, target_ulong *args)
+{
+target_ulong liobn = args[0];
+target_ulong ioba = args[1];
+target_ulong tce = args[2];
+VIOsPAPRDevice *dev = spapr_vio_find_by_reg(spapr-vio_bus, liobn);
+VIOsPAPR_RTCE *rtce;
+
+if (!dev) {
+hcall_dprintf(spapr_vio_put_tce on non-existent LIOBN 
+  TARGET_FMT_lx \n, liobn);
+return H_PARAMETER;
+}
+
+ioba = ~(SPAPR_VIO_TCE_PAGE_SIZE - 1);
+
+#ifdef DEBUG_TCE
+fprintf(stderr, spapr_vio_put_tce on %s  ioba 0x TARGET_FMT_lx
+  TCE 0x TARGET_FMT_lx \n, dev-qdev.id, ioba, tce);
+#endif
+
+if (ioba = dev-rtce_window_size) {
+hcall_dprintf(spapr_vio_put_tce on out-of-boards IOBA 0x
+  TARGET_FMT_lx \n, ioba);
+return H_PARAMETER;
+}
+
+rtce = dev-rtce_table + (ioba  SPAPR_VIO_TCE_PAGE_SHIFT);
+rtce-tce = tce;
+
+return H_SUCCESS;
+}
+
+int spapr_vio_check_tces(VIOsPAPRDevice *dev, target_ulong ioba,
+ target_ulong len, enum VIOsPAPR_TCEAccess access)
+{
+int start, end, i;
+
+start = ioba  SPAPR_VIO_TCE_PAGE_SHIFT;
+end = (ioba + len - 1)  SPAPR_VIO_TCE_PAGE_SHIFT;
+
+for (i = start; i = end; i++) {
+if ((dev-rtce_table[i].tce  access) != access) {
+#ifdef DEBUG_TCE
+fprintf(stderr, FAIL on %d\n, i);
+#endif
+return -1;
+}
+}
+
+return 0;
+}
+
+int spapr_tce_dma_write(VIOsPAPRDevice *dev, uint64_t taddr, const void *buf,
+uint32_t size)
+{
+#ifdef DEBUG_TCE
+fprintf(stderr, spapr_tce_dma_write taddr=0x%llx size=0x%x\n,
+(unsigned long long)taddr, size);
+#endif
+
+while (size) {
+uint64_t tce;
+uint32_t lsize;
+uint64_t txaddr;
+
+/* Check if we are in bound */
+if (taddr = dev-rtce_window_size) {
+#ifdef DEBUG_TCE
+fprintf(stderr, spapr_tce_dma_write out of bounds\n);
+#endif
+return H_DEST_PARM;
+}
+tce = dev-rtce_table[taddr  SPAPR_VIO_TCE_PAGE_SHIFT].tce;
+
+/* How much til end of page ? */
+lsize = MIN(size, ((~taddr)  SPAPR_VIO_TCE_PAGE_MASK) + 1);
+
+/* Check TCE */
+if (!(tce  2)) {
+

[Qemu-devel] [PATCH 11/27] Support 1T segments on ppc

[David Gibson]

Traditionally, the segments used for the two-stage translation used on
powerpc MMUs were 256MB in size.  This was the only option on all hash
page table based 32-bit powerpc cpus, and on the earlier 64-bit hash page
table based cpus.  However, newer 64-bit cpus also permit 1TB segments

This patch adds support for 1TB segment translation to the qemu code.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 target-ppc/cpu.h|7 +++
 target-ppc/helper.c |   50 ++
 2 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index fd2dfcd..10341b3 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -114,6 +114,7 @@ enum powerpc_mmu_t {
 POWERPC_MMU_601= 0x000A,
 #if defined(TARGET_PPC64)
 #define POWERPC_MMU_64   0x0001
+#define POWERPC_MMU_1TSEG0x0002
 /* 64 bits PowerPC MMU */
 POWERPC_MMU_64B= POWERPC_MMU_64 | 0x0001,
 /* 620 variant (no segment exceptions) */
@@ -382,9 +383,11 @@ struct ppc_slb_t {
 
 /* Bits in the SLB VSID word */
 #define SLB_VSID_SHIFT  12
+#define SLB_VSID_SHIFT_1T   24
 #define SLB_VSID_SSIZE_SHIFT62
 #define SLB_VSID_B  0xc000ULL
 #define SLB_VSID_B_256M 0xULL
+#define SLB_VSID_B_1T   0x4000ULL
 #define SLB_VSID_VSID   0x3000ULL
 #define SLB_VSID_PTEM   (SLB_VSID_B | SLB_VSID_VSID)
 #define SLB_VSID_KS 0x0800ULL
@@ -398,6 +401,10 @@ struct ppc_slb_t {
 #define SEGMENT_SHIFT_256M  28
 #define SEGMENT_MASK_256M   (~((1ULL  SEGMENT_SHIFT_256M) - 1))
 
+#define SEGMENT_SHIFT_1T40
+#define SEGMENT_MASK_1T (~((1ULL  SEGMENT_SHIFT_1T) - 1))
+
+
 /*/
 /* Machine state register bits definition*/
 #define MSR_SF   63 /* Sixty-four-bit modehflags */
diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index ae8001c..6712fce 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -675,19 +675,26 @@ static inline int find_pte(CPUState *env, mmu_ctx_t *ctx, 
int h, int rw,
 #if defined(TARGET_PPC64)
 static inline ppc_slb_t *slb_lookup(CPUPPCState *env, target_ulong eaddr)
 {
-uint64_t esid;
+uint64_t esid_256M, esid_1T;
 int n;
 
 LOG_SLB(%s: eaddr  TARGET_FMT_lx \n, __func__, eaddr);
 
-esid = (eaddr  SEGMENT_MASK_256M) | SLB_ESID_V;
+esid_256M = (eaddr  SEGMENT_MASK_256M) | SLB_ESID_V;
+esid_1T = (eaddr  SEGMENT_MASK_1T) | SLB_ESID_V;
 
 for (n = 0; n  env-slb_nr; n++) {
 ppc_slb_t *slb = env-slb[n];
 
 LOG_SLB(%s: slot %d %016 PRIx64  %016
 PRIx64 \n, __func__, n, slb-esid, slb-vsid);
-if (slb-esid == esid) {
+/* We check for 1T matches on all MMUs here - if the MMU
+ * doesn't have 1T segment support, we will have prevented 1T
+ * entries from being inserted in the slbmte code. */
+if (((slb-esid == esid_256M) 
+ ((slb-vsid  SLB_VSID_B) == SLB_VSID_B_256M))
+|| ((slb-esid == esid_1T) 
+((slb-vsid  SLB_VSID_B) == SLB_VSID_B_1T))) {
 return slb;
 }
 }
@@ -740,14 +747,20 @@ void ppc_slb_invalidate_one (CPUPPCState *env, uint64_t 
T0)
 int ppc_store_slb (CPUPPCState *env, target_ulong rb, target_ulong rs)
 {
 int slot = rb  0xfff;
-uint64_t esid = rb  ~0xfff;
 ppc_slb_t *slb = env-slb[slot];
 
-if (slot = env-slb_nr) {
-return -1;
+if (rb  (0x1000 - env-slb_nr)) {
+return -1; /* Reserved bits set or slot too high */
+}
+if (rs  (SLB_VSID_B  ~SLB_VSID_B_1T)) {
+return -1; /* Bad segment size */
+}
+if ((rs  SLB_VSID_B)  !(env-mmu_model  POWERPC_MMU_1TSEG)) {
+return -1; /* 1T segment on MMU that doesn't support it */
 }
 
-slb-esid = esid;
+/* Mask out the slot number as we store the entry */
+slb-esid = rb  (SLB_ESID_ESID | SLB_ESID_V);
 slb-vsid = rs;
 
 LOG_SLB(%s: %d  TARGET_FMT_lx  -  TARGET_FMT_lx  = %016 PRIx64
@@ -799,6 +812,7 @@ static inline int get_segment(CPUState *env, mmu_ctx_t *ctx,
 if (env-mmu_model  POWERPC_MMU_64) {
 ppc_slb_t *slb;
 target_ulong pageaddr;
+int segment_bits;
 
 LOG_MMU(Check SLBs\n);
 slb = slb_lookup(env, eaddr);
@@ -806,7 +820,14 @@ static inline int get_segment(CPUState *env, mmu_ctx_t 
*ctx,
 return -5;
 }
 
-vsid = (slb-vsid  SLB_VSID_VSID)  SLB_VSID_SHIFT;
+if (slb-vsid  SLB_VSID_B) {
+vsid = (slb-vsid  SLB_VSID_VSID)  SLB_VSID_SHIFT_1T;
+segment_bits = 40;
+} else {
+vsid = (slb-vsid  SLB_VSID_VSID)  SLB_VSID_SHIFT;
+segment_bits = 28;
+}
+
 

[Qemu-devel] [PATCH 19/27] Add PAPR H_VIO_SIGNAL hypercall and infrastructure for VIO interrupts

[David Gibson]

This patch adds infrastructure to support interrupts from PAPR virtual IO
devices.  This includes correctly advertising those interrupts in the
device tree, and implementing the H_VIO_SIGNAL hypercall, used to
enable and disable individual device interrupts.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr.c |2 +-
 hw/spapr_vio.c |   37 +
 hw/spapr_vio.h |6 ++
 3 files changed, 44 insertions(+), 1 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index 9a16990..0f0cd2e 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -64,7 +64,7 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
 uint32_t start_prop = cpu_to_be32(initrd_base);
 uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
 uint32_t pft_size_prop[] = {0, cpu_to_be32(hash_shift)};
-char hypertas_prop[] = hcall-pft\0hcall-term\0hcall-dabr;
+char hypertas_prop[] = 
hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt;
 uint32_t interrupt_server_ranges_prop[] = {0, cpu_to_be32(smp_cpus)};
 int i;
 char *modelname;
diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index 10acb4c..605079c 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -105,6 +105,16 @@ static int vio_make_devnode(VIOsPAPRDevice *dev,
 }
 }
 
+if (dev-qirq) {
+uint32_t ints_prop[] = {cpu_to_be32(dev-vio_irq_num), 0};
+
+ret = fdt_setprop(fdt, node_off, interrupts, ints_prop,
+  sizeof(ints_prop));
+if (ret  0) {
+return ret;
+}
+}
+
 if (info-devnode) {
 ret = (info-devnode)(dev, fdt, node_off);
 if (ret  0) {
@@ -140,6 +150,30 @@ void spapr_vio_bus_register_withprop(VIOsPAPRDeviceInfo 
*info)
 qdev_register(info-qdev);
 }
 
+static target_ulong h_vio_signal(CPUState *env, sPAPREnvironment *spapr,
+ target_ulong opcode,
+ target_ulong *args)
+{
+target_ulong reg = args[0];
+target_ulong mode = args[1];
+VIOsPAPRDevice *dev = spapr_vio_find_by_reg(spapr-vio_bus, reg);
+VIOsPAPRDeviceInfo *info;
+
+if (!dev) {
+return H_PARAMETER;
+}
+
+info = (VIOsPAPRDeviceInfo *)dev-qdev.info;
+
+if (mode  ~info-signal_mask) {
+return H_PARAMETER;
+}
+
+dev-signal_state = mode;
+
+return H_SUCCESS;
+}
+
 VIOsPAPRBus *spapr_vio_bus_init(void)
 {
 VIOsPAPRBus *bus;
@@ -156,6 +190,9 @@ VIOsPAPRBus *spapr_vio_bus_init(void)
 qbus = qbus_create(spapr_vio_bus_info, dev, spapr-vio);
 bus = DO_UPCAST(VIOsPAPRBus, bus, qbus);
 
+/* hcall-vio */
+spapr_register_hypercall(H_VIO_SIGNAL, h_vio_signal);
+
 for (qinfo = device_info_list; qinfo; qinfo = qinfo-next) {
 VIOsPAPRDeviceInfo *info = (VIOsPAPRDeviceInfo *)qinfo;
 
diff --git a/hw/spapr_vio.h b/hw/spapr_vio.h
index b164ad3..8a000c6 100644
--- a/hw/spapr_vio.h
+++ b/hw/spapr_vio.h
@@ -24,6 +24,9 @@
 typedef struct VIOsPAPRDevice {
 DeviceState qdev;
 uint32_t reg;
+qemu_irq qirq;
+uint32_t vio_irq_num;
+target_ulong signal_state;
 } VIOsPAPRDevice;
 
 typedef struct VIOsPAPRBus {
@@ -33,6 +36,7 @@ typedef struct VIOsPAPRBus {
 typedef struct {
 DeviceInfo qdev;
 const char *dt_name, *dt_type, *dt_compatible;
+target_ulong signal_mask;
 int (*init)(VIOsPAPRDevice *dev);
 void (*hcalls)(VIOsPAPRBus *bus);
 int (*devnode)(VIOsPAPRDevice *dev, void *fdt, int node_off);
@@ -43,6 +47,8 @@ extern VIOsPAPRDevice *spapr_vio_find_by_reg(VIOsPAPRBus 
*bus, uint32_t reg);
 extern void spapr_vio_bus_register_withprop(VIOsPAPRDeviceInfo *info);
 extern int spapr_populate_vdevice(VIOsPAPRBus *bus, void *fdt);
 
+extern int spapr_vio_signal(VIOsPAPRDevice *dev, target_ulong mode);
+
 void vty_putchars(VIOsPAPRDevice *sdev, uint8_t *buf, int len);
 void spapr_vty_create(VIOsPAPRBus *bus,
   uint32_t reg, CharDriverState *chardev);
-- 
1.7.1

[Qemu-devel] [PATCH 24/27] Implement PAPR virtual SCSI interface (ibmvscsi)

[David Gibson]

From: Ben Herrenschmidt b...@kernel.crashing.org

This patch implements the infrastructure and hypercalls necessary for
the PAPR specified Virtual SCSI interface.  This is the normal method
for providing (virtual) disks to PAPR partitions.

Signed-off-by: Ben Herrenschmidt b...@kernel.crashing.org
Signed-off-by: David Gibson d...@au1.ibm.com
---
 Makefile.target  |2 +-
 hw/ppc-viosrp.h  |  216 
 hw/spapr.c   |   11 +-
 hw/spapr_vio.h   |3 +
 hw/spapr_vscsi.c |  988 ++
 hw/srp.h |  240 +
 6 files changed, 1458 insertions(+), 2 deletions(-)
 create mode 100644 hw/ppc-viosrp.h
 create mode 100644 hw/spapr_vscsi.c
 create mode 100644 hw/srp.h

diff --git a/Makefile.target b/Makefile.target
index 58b7a49..f0696ce 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -233,7 +233,7 @@ obj-ppc-y += ppc_oldworld.o
 obj-ppc-y += ppc_newworld.o
 # IBM pSeries (sPAPR)
 obj-ppc-y += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
-obj-ppc-y += xics.o spapr_vty.o spapr_llan.o
+obj-ppc-y += xics.o spapr_vty.o spapr_llan.o spapr_vscsi.o
 # PowerPC 4xx boards
 obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
 obj-ppc-y += ppc440.o ppc440_bamboo.o
diff --git a/hw/ppc-viosrp.h b/hw/ppc-viosrp.h
new file mode 100644
index 000..d8e365d
--- /dev/null
+++ b/hw/ppc-viosrp.h
@@ -0,0 +1,216 @@
+/*/
+/* srp.h -- SCSI RDMA Protocol definitions   */
+/*   */
+/* Written By: Colin Devilbis, IBM Corporation   */
+/*   */
+/* Copyright (C) 2003 IBM Corporation*/
+/*   */
+/* This program is free software; you can redistribute it and/or modify  */
+/* it under the terms of the GNU General Public License as published by  */
+/* the Free Software Foundation; either version 2 of the License, or */
+/* (at your option) any later version.   */
+/*   */
+/* This program is distributed in the hope that it will be useful,   */
+/* but WITHOUT ANY WARRANTY; without even the implied warranty of*/
+/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the */
+/* GNU General Public License for more details.  */
+/*   */
+/* You should have received a copy of the GNU General Public License */
+/* along with this program; if not, write to the Free Software   */
+/* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
+/*   */
+/*   */
+/* This file contains structures and definitions for IBM RPA (RS/6000*/
+/* platform architecture) implementation of the SRP (SCSI RDMA Protocol) */
+/* standard.  SRP is used on IBM iSeries and pSeries platforms to send SCSI  */
+/* commands between logical partitions.  */
+/*   */
+/* SRP Information Units (IUs) are sent on a Command/Response Queue (CRQ)  */
+/* between partitions.  The definitions in this file are architected,*/
+/* and cannot be changed without breaking compatibility with other versions  */
+/* of Linux and other operating systems (AIX, OS/400) that talk this protocol*/
+/* between logical partitions*/
+/*/
+#ifndef PPC_VIOSRP_H
+#define PPC_VIOSRP_H
+
+#define SRP_VERSION 16.a
+#define SRP_MAX_IU_LEN256
+#define SRP_MAX_LOC_LEN 32
+
+union srp_iu {
+struct srp_login_req login_req;
+struct srp_login_rsp login_rsp;
+struct srp_login_rej login_rej;
+struct srp_i_logout i_logout;
+struct srp_t_logout t_logout;
+struct srp_tsk_mgmt tsk_mgmt;
+struct srp_cmd cmd;
+struct srp_rsp rsp;
+uint8_t reserved[SRP_MAX_IU_LEN];
+};
+
+enum viosrp_crq_formats {
+VIOSRP_SRP_FORMAT = 0x01,
+VIOSRP_MAD_FORMAT = 0x02,
+VIOSRP_OS400_FORMAT = 0x03,
+VIOSRP_AIX_FORMAT = 0x04,
+VIOSRP_LINUX_FORMAT = 0x06,
+VIOSRP_INLINE_FORMAT = 0x07
+};
+
+enum viosrp_crq_status {
+VIOSRP_OK = 0x0,
+VIOSRP_NONRECOVERABLE_ERR = 0x1,
+VIOSRP_VIOLATES_MAX_XFER = 0x2,
+VIOSRP_PARTNER_PANIC = 0x3,
+VIOSRP_DEVICE_BUSY = 0x8,
+VIOSRP_ADAPTER_FAIL = 0x10,
+VIOSRP_OK2 

[Qemu-devel] [PATCH 13/27] Start implementing pSeries logical partition machine

[David Gibson]

This patch adds a pseries machine to qemu.  This aims to emulate a
logical partition on an IBM pSeries machine, compliant to the
PowerPC Architecture Platform Requirements (PAPR) document.

This initial version is quite limited, it implements a basic machine
and PAPR hypercall emulation.  So far only one hypercall is present -
H_PUT_TERM_CHAR - so that a (write-only) console is available.

Multiple CPUs are permitted, with SMP entry handled kexec() style.

The machine so far more resembles an old POWER4 style full system
partition rather than a modern LPAR, in that the guest manages the
page tables directly, rather than via hypercalls.

The machine requires qemu to be configured with --enable-fdt.  The
machine can (so far) only be booted with -kernel - i.e. no partition
firmware is provided.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 Makefile.target  |2 +
 hw/spapr.c   |  317 ++
 hw/spapr.h   |  257 +++
 hw/spapr_hcall.c |   43 
 4 files changed, 619 insertions(+), 0 deletions(-)
 create mode 100644 hw/spapr.c
 create mode 100644 hw/spapr.h
 create mode 100644 hw/spapr_hcall.c

diff --git a/Makefile.target b/Makefile.target
index 62b102a..0fc0623 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -231,6 +231,8 @@ obj-ppc-y += ppc_prep.o
 obj-ppc-y += ppc_oldworld.o
 # NewWorld PowerMac
 obj-ppc-y += ppc_newworld.o
+# IBM pSeries (sPAPR)
+obj-ppc-y += spapr.o spapr_hcall.o
 # PowerPC 4xx boards
 obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
 obj-ppc-y += ppc440.o ppc440_bamboo.o
diff --git a/hw/spapr.c b/hw/spapr.c
new file mode 100644
index 000..3bfb8e9
--- /dev/null
+++ b/hw/spapr.c
@@ -0,0 +1,317 @@
+/*
+ * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
+ *
+ * Copyright (c) 2004-2007 Fabrice Bellard
+ * Copyright (c) 2007 Jocelyn Mayer
+ * Copyright (c) 2010 David Gibson, IBM Corporation.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the Software), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED AS IS, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ */
+#include sysemu.h
+#include qemu-char.h
+#include hw.h
+#include elf.h
+
+#include hw/boards.h
+#include hw/ppc.h
+#include hw/loader.h
+
+#include hw/spapr.h
+
+#include libfdt.h
+
+#define KERNEL_LOAD_ADDR0x
+#define INITRD_LOAD_ADDR0x0280
+#define FDT_MAX_SIZE0x1
+
+#define TIMEBASE_FREQ   51200ULL
+
+#define MAX_CPUS32
+
+sPAPREnvironment *spapr;
+
+static void *spapr_create_fdt(int *fdt_size, ram_addr_t ramsize,
+  const char *cpu_model, CPUState *envs[],
+  sPAPREnvironment *spapr,
+  target_phys_addr_t initrd_base,
+  target_phys_addr_t initrd_size,
+  const char *kernel_cmdline)
+{
+void *fdt;
+uint64_t mem_reg_property[] = { 0, cpu_to_be64(ramsize) };
+uint32_t start_prop = cpu_to_be32(initrd_base);
+uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
+int i;
+char *modelname;
+
+#define _FDT(exp) \
+do { \
+int ret = (exp);   \
+if (ret  0) { \
+hw_error(qemu: error creating device tree: %s: %s\n, \
+ #exp, fdt_strerror(ret)); \
+return NULL;   \
+}  \
+} while (0)
+
+fdt = qemu_mallocz(FDT_MAX_SIZE);
+_FDT((fdt_create(fdt, FDT_MAX_SIZE)));
+
+_FDT((fdt_finish_reservemap(fdt)));
+
+/* Root node */
+_FDT((fdt_begin_node(fdt, )));
+_FDT((fdt_property_string(fdt, device_type, chrp)));
+_FDT((fdt_property_string(fdt, model, qemu,emulated-pSeries-LPAR)));
+
+_FDT((fdt_property_cell(fdt, #address-cells, 0x2)));
+

[Qemu-devel] [PATCH 20/27] Add (virtual) interrupt to PAPR virtual tty device

[David Gibson]

Now that we have implemented the PAPR xics virtualized interrupt
controller, we can add interrupts in PAPR VIO devices.  This patch adds
interrupt support to the PAPR virtual tty/console device.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr.c |6 --
 hw/spapr_vio.h |3 ++-
 hw/spapr_vty.c |   11 ++-
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index 0f0cd2e..cd09104 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -262,6 +262,7 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 long pteg_shift = 17;
 int fdt_size;
 char *filename;
+int irq = 16;
 
 spapr = qemu_malloc(sizeof(*spapr));
 cpu_ppc_hypercall = emulate_spapr_hypercall;
@@ -325,9 +326,10 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 /* Set up VIO bus */
 spapr-vio_bus = spapr_vio_bus_init();
 
-for (i = 0; i  MAX_SERIAL_PORTS; i++) {
+for (i = 0; i  MAX_SERIAL_PORTS; i++, irq++) {
 if (serial_hds[i]) {
-spapr_vty_create(spapr-vio_bus, i, serial_hds[i]);
+spapr_vty_create(spapr-vio_bus, i, serial_hds[i],
+ xics_find_qirq(spapr-icp, irq), irq);
 }
 }
 
diff --git a/hw/spapr_vio.h b/hw/spapr_vio.h
index 8a000c6..2013927 100644
--- a/hw/spapr_vio.h
+++ b/hw/spapr_vio.h
@@ -51,6 +51,7 @@ extern int spapr_vio_signal(VIOsPAPRDevice *dev, target_ulong 
mode);
 
 void vty_putchars(VIOsPAPRDevice *sdev, uint8_t *buf, int len);
 void spapr_vty_create(VIOsPAPRBus *bus,
-  uint32_t reg, CharDriverState *chardev);
+  uint32_t reg, CharDriverState *chardev,
+  qemu_irq qirq, uint32_t vio_irq_num);
 
 #endif /* _HW_SPAPR_VIO_H */
diff --git a/hw/spapr_vty.c b/hw/spapr_vty.c
index b4da6a8..6fc0105 100644
--- a/hw/spapr_vty.c
+++ b/hw/spapr_vty.c
@@ -24,6 +24,10 @@ static void vty_receive(void *opaque, const uint8_t *buf, 
int size)
 VIOsPAPRVTYDevice *dev = (VIOsPAPRVTYDevice *)opaque;
 int i;
 
+if ((dev-in == dev-out)  size) {
+/* toggle line to simulate edge interrupt */
+qemu_irq_pulse(dev-sdev.qirq);
+}
 for (i = 0; i  size; i++) {
 assert((dev-in - dev-out)  VTERM_BUFSIZE);
 dev-buf[dev-in++ % VTERM_BUFSIZE] = buf[i];
@@ -112,14 +116,19 @@ static target_ulong h_get_term_char(CPUState *env, 
sPAPREnvironment *spapr,
 }
 
 void spapr_vty_create(VIOsPAPRBus *bus,
-  uint32_t reg, CharDriverState *chardev)
+  uint32_t reg, CharDriverState *chardev,
+  qemu_irq qirq, uint32_t vio_irq_num)
 {
 DeviceState *dev;
+VIOsPAPRDevice *sdev;
 
 dev = qdev_create(bus-bus, spapr-vty);
 qdev_prop_set_uint32(dev, reg, reg);
 qdev_prop_set_chr(dev, chardev, chardev);
 qdev_init_nofail(dev);
+sdev = (VIOsPAPRDevice *)dev;
+sdev-qirq = qirq;
+sdev-vio_irq_num = vio_irq_num;
 }
 
 static void vty_hcalls(VIOsPAPRBus *bus)
-- 
1.7.1

[Qemu-devel] [PATCH 16/27] Implement hcall based RTAS for pSeries machines

[David Gibson]

On pSeries machines, operating systems can instantiate RTAS (Run-Time
Abstraction Services), a runtime component of the firmware which implements
a number of low-level, infrequently used operations.  On logical partitions
under a hypervisor, many of the RTAS functions require hypervisor
privilege.  For simplicity, therefore, hypervisor systems typically
implement the in-partition RTAS as just a tiny wrapper around a hypercall
which actually implements the various RTAS functions.

This patch implements such a hypercall based RTAS for our emulated pSeries
machine.  A tiny in-partition firmware calls a new hypercall, which
looks up available RTAS services in a table.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 Makefile|3 +-
 Makefile.target |2 +-
 configure   |4 +-
 hw/spapr.c  |   26 +++-
 hw/spapr.h  |   22 +++
 hw/spapr_hcall.c|   15 +
 hw/spapr_rtas.c |  131 +++
 pc-bios/spapr-rtas.bin  |  Bin 0 - 20 bytes
 pc-bios/spapr-rtas/Makefile |   24 +++
 pc-bios/spapr-rtas/spapr-rtas.S |   36 +++
 10 files changed, 257 insertions(+), 6 deletions(-)
 create mode 100644 hw/spapr_rtas.c
 create mode 100644 pc-bios/spapr-rtas.bin
 create mode 100644 pc-bios/spapr-rtas/Makefile
 create mode 100644 pc-bios/spapr-rtas/spapr-rtas.S

diff --git a/Makefile b/Makefile
index 89e88b4..e0b3fea 100644
--- a/Makefile
+++ b/Makefile
@@ -213,7 +213,8 @@ pxe-ne2k_pci.bin pxe-pcnet.bin \
 pxe-rtl8139.bin pxe-virtio.bin \
 bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
 multiboot.bin linuxboot.bin \
-s390-zipl.rom
+s390-zipl.rom \
+spapr-rtas.bin
 else
 BLOBS=
 endif
diff --git a/Makefile.target b/Makefile.target
index 2cea6ad..e52b058 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -232,7 +232,7 @@ obj-ppc-y += ppc_oldworld.o
 # NewWorld PowerMac
 obj-ppc-y += ppc_newworld.o
 # IBM pSeries (sPAPR)
-obj-ppc-y += spapr.o spapr_hcall.o spapr_vio.o
+obj-ppc-y += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
 obj-ppc-y += spapr_vty.o
 # PowerPC 4xx boards
 obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
diff --git a/configure b/configure
index 5a5827f..7d8d890 100755
--- a/configure
+++ b/configure
@@ -2461,7 +2461,9 @@ if test \( $cpu = i386 -o $cpu = x86_64 \) -a \
 $softmmu = yes ; then
   roms=optionrom
 fi
-
+if test $cpu = ppc64 ; then
+  roms=$roms spapr-rtas
+fi
 
 echo Install prefix$prefix
 echo BIOS directory`eval echo $datadir`
diff --git a/hw/spapr.c b/hw/spapr.c
index 15c1509..59e07d7 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -40,6 +40,7 @@
 #define KERNEL_LOAD_ADDR0x
 #define INITRD_LOAD_ADDR0x0280
 #define FDT_MAX_SIZE0x1
+#define RTAS_MAX_SIZE   0x1
 
 #define TIMEBASE_FREQ   51200ULL
 
@@ -53,6 +54,8 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
   target_phys_addr_t initrd_base,
   target_phys_addr_t initrd_size,
   const char *kernel_cmdline,
+  target_phys_addr_t rtas_addr,
+  target_phys_addr_t rtas_size,
   long hash_shift)
 {
 void *fdt;
@@ -194,6 +197,12 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
 fprintf(stderr, couldn't setup vio devices in fdt\n);
 }
 
+/* RTAS */
+ret = spapr_rtas_device_tree_setup(fdt, rtas_addr, rtas_size);
+if (ret  0) {
+fprintf(stderr, Couldn't set up RTAS device tree properties\n);
+}
+
 _FDT((fdt_pack(fdt)));
 
 if (fdt_size) {
@@ -225,11 +234,12 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 void *fdt, *htab;
 int i;
 ram_addr_t ram_offset;
-target_phys_addr_t fdt_addr;
+target_phys_addr_t fdt_addr, rtas_addr;
 uint32_t kernel_base, initrd_base;
-long kernel_size, initrd_size, htab_size;
+long kernel_size, initrd_size, htab_size, rtas_size;
 long pteg_shift = 17;
 int fdt_size;
+char *filename;
 
 spapr = qemu_malloc(sizeof(*spapr));
 cpu_ppc_hypercall = emulate_spapr_hypercall;
@@ -238,6 +248,8 @@ static void ppc_spapr_init(ram_addr_t ram_size,
  * 2GB, so that it can be processed with 32-bit code if
  * necessary */
 fdt_addr = MIN(ram_size, 0x8000) - FDT_MAX_SIZE;
+/* RTAS goes just below that */
+rtas_addr = fdt_addr - RTAS_MAX_SIZE;
 
 /* init CPUs */
 if (cpu_model == NULL) {
@@ -277,6 +289,14 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 envs[i]-htab_mask = htab_size - 1;
 }
 
+filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, spapr-rtas.bin);
+rtas_size = load_image_targphys(filename, rtas_addr, ram_size - rtas_addr);
+if (rtas_size  0) {
+hw_error(qemu: 

[Qemu-devel] [PATCH 22/27] Implement sPAPR Virtual LAN (ibmveth)

[David Gibson]

This patch implements the PAPR specified Inter Virtual Machine Logical
LAN; that is the virtual hardware used by the Linux ibmveth driver.

Signed-off-by: Paul Mackerras pau...@samba.org
Signed-off-by: David Gibson d...@au1.ibm.com
---
 Makefile.target |2 +-
 hw/spapr.c  |   21 ++-
 hw/spapr_llan.c |  521 +++
 hw/spapr_vio.h  |3 +
 4 files changed, 545 insertions(+), 2 deletions(-)
 create mode 100644 hw/spapr_llan.c

diff --git a/Makefile.target b/Makefile.target
index f0b9f01..58b7a49 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -233,7 +233,7 @@ obj-ppc-y += ppc_oldworld.o
 obj-ppc-y += ppc_newworld.o
 # IBM pSeries (sPAPR)
 obj-ppc-y += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
-obj-ppc-y += xics.o spapr_vty.o
+obj-ppc-y += xics.o spapr_vty.o spapr_llan.o
 # PowerPC 4xx boards
 obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
 obj-ppc-y += ppc440.o ppc440_bamboo.o
diff --git a/hw/spapr.c b/hw/spapr.c
index bc0cd0e..98ca5ac 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -27,6 +27,7 @@
 #include sysemu.h
 #include hw.h
 #include elf.h
+#include net.h
 
 #include hw/boards.h
 #include hw/ppc.h
@@ -322,7 +323,7 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 qemu_free(filename);
 
 /* Set up Interrupt Controller */
-spapr-icp = xics_system_init(smp_cpus, envs, MAX_SERIAL_PORTS);
+spapr-icp = xics_system_init(smp_cpus, envs, MAX_SERIAL_PORTS + nb_nics);
 
 /* Set up VIO bus */
 spapr-vio_bus = spapr_vio_bus_init();
@@ -334,6 +335,24 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 }
 }
 
+for (i = 0; i  nb_nics; i++, irq++) {
+NICInfo *nd = nd_table[i];
+
+if (!nd-model) {
+nd-model = qemu_strdup(ibmveth);
+}
+
+if (strcmp(nd-model, ibmveth) == 0) {
+spapr_vlan_create(spapr-vio_bus, 0x1000 + i, nd,
+  xics_find_qirq(spapr-icp, irq), irq);
+} else {
+fprintf(stderr, pSeries (sPAPR) platform does not support 
+NIC model '%s' (only ibmveth is supported)\n,
+nd-model);
+exit(1);
+}
+}
+
 if (kernel_filename) {
 uint64_t lowaddr = 0;
 
diff --git a/hw/spapr_llan.c b/hw/spapr_llan.c
new file mode 100644
index 000..1d83fd5
--- /dev/null
+++ b/hw/spapr_llan.c
@@ -0,0 +1,521 @@
+/*
+ * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
+ *
+ * PAPR Inter-VM Logical Lan, aka ibmveth
+ *
+ * Copyright (c) 2010,2011 David Gibson, IBM Corporation.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the Software), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED AS IS, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ */
+#include hw.h
+#include net.h
+#include hw/qdev.h
+#include hw/spapr.h
+#include hw/spapr_vio.h
+
+#include libfdt.h
+
+#define ETH_ALEN6
+#define MAX_PACKET_SIZE 65536
+
+/*#define DEBUG*/
+
+#ifdef DEBUG
+#define dprintf(fmt...) do { fprintf(stderr, fmt); } while (0)
+#else
+#define dprintf(fmt...)
+#endif
+
+/*
+ * Virtual LAN device
+ */
+
+typedef uint64_t vlan_bd_t;
+
+#define VLAN_BD_VALID0x8000ULL
+#define VLAN_BD_TOGGLE   0x4000ULL
+#define VLAN_BD_NO_CSUM  0x0200ULL
+#define VLAN_BD_CSUM_GOOD0x0100ULL
+#define VLAN_BD_LEN_MASK 0x00ffULL
+#define VLAN_BD_LEN(bd)  (((bd)  VLAN_BD_LEN_MASK)  32)
+#define VLAN_BD_ADDR_MASK0xULL
+#define VLAN_BD_ADDR(bd) ((bd)  VLAN_BD_ADDR_MASK)
+
+#define VLAN_VALID_BD(addr, len) (VLAN_BD_VALID | \
+  (((len)  32)  VLAN_BD_LEN_MASK) |  \
+  (addr  VLAN_BD_ADDR_MASK))
+
+#define VLAN_RXQC_TOGGLE 0x80
+#define VLAN_RXQC_VALID  0x40
+#define VLAN_RXQC_NO_CSUM0x02
+#define VLAN_RXQC_CSUM_GOOD  0x01
+
+#define VLAN_RQ_ALIGNMENT16
+#define VLAN_RXQ_BD_OFF  0
+#define VLAN_FILTER_BD_OFF   8
+#define VLAN_RX_BDS_OFF  

[Qemu-devel] [PATCH 07/27] Clean up slb_lookup() function

[David Gibson]

The slb_lookup() function, used in the ppc translation path returns a
number of slb entry fields in reference parameters.  However, only one
of the two callers of slb_lookup() actually wants this information.

This patch, therefore, makes slb_lookup() return a simple pointer to the
located SLB entry (or NULL), and the caller which needs the fields can
extract them itself.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 target-ppc/helper.c |   45 ++---
 1 files changed, 18 insertions(+), 27 deletions(-)

diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index b9621d2..7ca33cb 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -676,9 +676,7 @@ static inline int find_pte(CPUState *env, mmu_ctx_t *ctx, 
int h, int rw,
 }
 
 #if defined(TARGET_PPC64)
-static inline int slb_lookup(CPUPPCState *env, target_ulong eaddr,
- target_ulong *vsid, target_ulong *page_mask,
- int *attr, int *target_page_bits)
+static inline ppc_slb_t *slb_lookup(CPUPPCState *env, target_ulong eaddr)
 {
 uint64_t esid;
 int n;
@@ -693,19 +691,11 @@ static inline int slb_lookup(CPUPPCState *env, 
target_ulong eaddr,
 LOG_SLB(%s: slot %d %016 PRIx64  %016
 PRIx64 \n, __func__, n, slb-esid, slb-vsid);
 if (slb-esid == esid) {
-*vsid = (slb-vsid  SLB_VSID_VSID)  SLB_VSID_SHIFT;
-*page_mask = ~SEGMENT_MASK_256M;
-*attr = slb-vsid  SLB_VSID_ATTR;
-if (target_page_bits) {
-*target_page_bits = (slb-vsid  SLB_VSID_L)
-? TARGET_PAGE_BITS_16M
-: TARGET_PAGE_BITS;
-}
-return n;
+return slb;
 }
 }
 
-return -5;
+return NULL;
 }
 
 void ppc_slb_invalidate_all (CPUPPCState *env)
@@ -732,18 +722,13 @@ void ppc_slb_invalidate_all (CPUPPCState *env)
 
 void ppc_slb_invalidate_one (CPUPPCState *env, uint64_t T0)
 {
-target_ulong vsid, page_mask;
-int attr;
-int n;
 ppc_slb_t *slb;
 
-n = slb_lookup(env, T0, vsid, page_mask, attr, NULL);
-if (n  0) {
+slb = slb_lookup(env, T0);
+if (!slb) {
 return;
 }
 
-slb = env-slb[n];
-
 if (slb-esid  SLB_ESID_V) {
 slb-esid = ~SLB_ESID_V;
 
@@ -822,16 +807,22 @@ static inline int get_segment(CPUState *env, mmu_ctx_t 
*ctx,
 pr = msr_pr;
 #if defined(TARGET_PPC64)
 if (env-mmu_model  POWERPC_MMU_64) {
-int attr;
+ppc_slb_t *slb;
 
 LOG_MMU(Check SLBs\n);
-ret = slb_lookup(env, eaddr, vsid, page_mask, attr,
- target_page_bits);
-if (ret  0)
-return ret;
-ctx-key = !!(pr ? (attr  SLB_VSID_KP) : (attr  SLB_VSID_KS));
+slb = slb_lookup(env, eaddr);
+if (!slb) {
+return -5;
+}
+
+vsid = (slb-vsid  SLB_VSID_VSID)  SLB_VSID_SHIFT;
+page_mask = ~SEGMENT_MASK_256M;
+target_page_bits = (slb-vsid  SLB_VSID_L)
+? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
+ctx-key = !!(pr ? (slb-vsid  SLB_VSID_KP)
+  : (slb-vsid  SLB_VSID_KS));
 ds = 0;
-ctx-nx = !!(attr  SLB_VSID_N);
+ctx-nx = !!(slb-vsid  SLB_VSID_N);
 ctx-eaddr = eaddr;
 vsid_mask = 0x3F80ULL;
 vsid_sh = 7;
-- 
1.7.1

[Qemu-devel] [PATCH 02/27] Allow qemu_devtree_setprop() to take arbitrary values

[David Gibson]

From: David Gibson d...@au1.ibm.com

Currently qemu_devtree_setprop() expects the new property value to be
given as a uint32_t *.  While property values consisting of u32s are
common, in general they can have any bytestring value.

Therefore, this patch alters the function to take a void * instead,
allowing callers to easily give anything as the property value.

Signed-off-by: David Gibson da...@gibson.dropbear.id.au
---
 device_tree.c |2 +-
 device_tree.h |2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/device_tree.c b/device_tree.c
index 426a631..21be070 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -74,7 +74,7 @@ fail:
 }
 
 int qemu_devtree_setprop(void *fdt, const char *node_path,
- const char *property, uint32_t *val_array, int size)
+ const char *property, void *val_array, int size)
 {
 int offset;
 
diff --git a/device_tree.h b/device_tree.h
index f05c4e7..cecd98f 100644
--- a/device_tree.h
+++ b/device_tree.h
@@ -17,7 +17,7 @@
 void *load_device_tree(const char *filename_path, int *sizep);
 
 int qemu_devtree_setprop(void *fdt, const char *node_path,
- const char *property, uint32_t *val_array, int size);
+ const char *property, void *val_array, int size);
 int qemu_devtree_setprop_cell(void *fdt, const char *node_path,
   const char *property, uint32_t val);
 int qemu_devtree_setprop_string(void *fdt, const char *node_path,
-- 
1.7.1

[Qemu-devel] [PATCH 26/27] Implement PAPR VPA functions for pSeries shared processor partitions

[David Gibson]

Shared-processor partitions are those where a CPU is time-sliced between
partitions, rather than being permanently dedicated to a single
partition.  qemu emulated partitions, since they are just scheduled with
the qemu user process, behave mostly like shared processor partitions.

In order to better support shared processor partitions (splpar), PAPR
defines the VPA (Virtual Processor Area), a shared memory communication
channel between the hypervisor and partitions.  There are also two
additional shared memory communication areas for specialized purposes
associated with the VPA.

A VPA is not essential for operating an splpar, though it can be necessary
for obtaining accurate performance measurements in the presence of
runtime partition switching.

Most importantly, however, the VPA is a prerequisite for PAPR's H_CEDE,
hypercall, which allows a partition OS to give up it's shared processor
timeslices to other partitions when idle.

This patch implements the VPA and H_CEDE hypercalls in qemu.  We don't
implement any of the more advanced statistics which can be communicated
through the VPA.  However, this is enough to make normal pSeries kernels
do an effective power-save idle on an emulated pSeries, significantly
reducing the host load of a qemu emulated pSeries running an idle guest OS.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr.c   |2 +-
 hw/spapr_hcall.c |  192 ++
 target-ppc/cpu.h |5 ++
 3 files changed, 198 insertions(+), 1 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index 8585520..941f8a3 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -67,7 +67,7 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
 uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
 uint32_t pft_size_prop[] = {0, cpu_to_be32(hash_shift)};
 char hypertas_prop[] = hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt
-\0hcall-tce\0hcall-vio;
+\0hcall-tce\0hcall-vio\0hcall-splpar;
 uint32_t interrupt_server_ranges_prop[] = {0, cpu_to_be32(smp_cpus)};
 int i;
 char *modelname;
diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index 02ccafd..6cc101d 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -4,6 +4,8 @@
 #include sysemu.h
 #include qemu-char.h
 #include exec-all.h
+#include exec.h
+#include helper_regs.h
 #include hw/spapr.h
 
 #define HPTES_PER_GROUP 8
@@ -255,6 +257,192 @@ static target_ulong h_set_dabr(CPUState *env, 
sPAPREnvironment *spapr,
 return H_HARDWARE;
 }
 
+#define FLAGS_REGISTER_VPA 0x2000ULL
+#define FLAGS_REGISTER_DTL 0x4000ULL
+#define FLAGS_REGISTER_SLBSHADOW   0x6000ULL
+#define FLAGS_DEREGISTER_VPA   0xa000ULL
+#define FLAGS_DEREGISTER_DTL   0xc000ULL
+#define FLAGS_DEREGISTER_SLBSHADOW 0xe000ULL
+
+#define VPA_MIN_SIZE   640
+#define VPA_SIZE_OFFSET0x4
+#define VPA_SHARED_PROC_OFFSET 0x9
+#define VPA_SHARED_PROC_VAL0x2
+
+static target_ulong register_vpa(CPUState *env, target_ulong vpa)
+{
+uint16_t size;
+uint8_t tmp;
+
+if (vpa == 0) {
+hcall_dprintf(Can't cope with registering a VPA at logical 0\n);
+return H_HARDWARE;
+}
+
+if (vpa % env-dcache_line_size) {
+return H_PARAMETER;
+}
+/* FIXME: bounds check the address */
+
+size = lduw_phys(vpa + 0x4);
+
+if (size  VPA_MIN_SIZE) {
+return H_PARAMETER;
+}
+
+/* VPA is not allowed to cross a page boundary */
+if ((vpa / 4096) != ((vpa + size - 1) / 4096)) {
+return H_PARAMETER;
+}
+
+env-vpa = vpa;
+
+tmp = ldub_phys(env-vpa + VPA_SHARED_PROC_OFFSET);
+tmp |= VPA_SHARED_PROC_VAL;
+stb_phys(env-vpa + VPA_SHARED_PROC_OFFSET, tmp);
+
+return H_SUCCESS;
+}
+
+static target_ulong deregister_vpa(CPUState *env, target_ulong vpa)
+{
+if (env-slb_shadow) {
+return H_RESOURCE;
+}
+
+if (env-dispatch_trace_log) {
+return H_RESOURCE;
+}
+
+env-vpa = 0;
+return H_SUCCESS;
+}
+
+static target_ulong register_slb_shadow(CPUState *env, target_ulong addr)
+{
+uint32_t size;
+
+if (addr == 0) {
+hcall_dprintf(Can't cope with SLB shadow at logical 0\n);
+return H_HARDWARE;
+}
+
+size = ldl_phys(addr + 0x4);
+if (size  0x8) {
+return H_PARAMETER;
+}
+
+if ((addr / 4096) != ((addr + size - 1) / 4096)) {
+return H_PARAMETER;
+}
+
+if (!env-vpa) {
+return H_RESOURCE;
+}
+
+env-slb_shadow = addr;
+
+return H_SUCCESS;
+}
+
+static target_ulong deregister_slb_shadow(CPUState *env, target_ulong addr)
+{
+env-slb_shadow = 0;
+return H_SUCCESS;
+}
+
+static target_ulong register_dtl(CPUState *env, target_ulong addr)
+{
+uint32_t size;
+
+if (addr == 0) {
+hcall_dprintf(Can't cope with DTL at logical 0\n);
+return H_HARDWARE;
+}
+
+size = 

[Qemu-devel] [PATCH 17/27] Implement assorted pSeries hcalls and RTAS methods

[David Gibson]

This patch adds several small utility hypercalls and RTAS methods to
the pSeries platform emulation.  Specifically:

* 'display-character' rtas call

This just prints a character to the console, it's occasionally used
for early debug of the OS.  The support includes a hack to make this
RTAS call respond on the normal token value present on real hardware,
since some early debugging tools just assume this value without
checking the device tree.

* 'get-time-of-day' rtas call

This one just takes the host real time, converts to the PAPR described
format and returns it to the guest.

* 'power-off' rtas call

This one shuts down the emulated system.

* H_DABR hypercall

On pSeries, the DABR debug register is usually a hypervisor resource
and virtualized through this hypercall.  If the hypercall is not
present, Linux will under some circumstances attempt to manipulate the
DABR directly which will fail on this emulated machine.

This stub implementation is enough to stop that behaviour, although it
doesn't actually implement the requested DABR operations as yet.

Signed-off-by: Paul Mackerras pau...@samba.org
Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr.c   |2 +-
 hw/spapr_hcall.c |   10 
 hw/spapr_rtas.c  |   69 ++
 3 files changed, 80 insertions(+), 1 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index 59e07d7..1060d9e 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -63,7 +63,7 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
 uint32_t start_prop = cpu_to_be32(initrd_base);
 uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
 uint32_t pft_size_prop[] = {0, cpu_to_be32(hash_shift)};
-char hypertas_prop[] = hcall-pft\0hcall-term;
+char hypertas_prop[] = hcall-pft\0hcall-term\0hcall-dabr;
 int i;
 char *modelname;
 int ret;
diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index 594e27d..02ccafd 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -248,6 +248,13 @@ static target_ulong h_protect(CPUState *env, 
sPAPREnvironment *spapr,
 return H_SUCCESS;
 }
 
+static target_ulong h_set_dabr(CPUState *env, sPAPREnvironment *spapr,
+   target_ulong opcode, target_ulong *args)
+{
+/* FIXME: actually implement this */
+return H_HARDWARE;
+}
+
 static target_ulong h_rtas(sPAPREnvironment *spapr, target_ulong rtas_r3)
 {
 uint32_t token = ldl_phys(rtas_r3);
@@ -308,5 +315,8 @@ static void hypercall_init(void)
 spapr_register_hypercall(H_ENTER, h_enter);
 spapr_register_hypercall(H_REMOVE, h_remove);
 spapr_register_hypercall(H_PROTECT, h_protect);
+
+/* hcall-dabr */
+spapr_register_hypercall(H_SET_DABR, h_set_dabr);
 }
 device_init(hypercall_init);
diff --git a/hw/spapr_rtas.c b/hw/spapr_rtas.c
index 3f090f5..7226853 100644
--- a/hw/spapr_rtas.c
+++ b/hw/spapr_rtas.c
@@ -38,6 +38,58 @@
 #define TOKEN_BASE  0x2000
 #define TOKEN_MAX   0x100
 
+static void rtas_display_character(sPAPREnvironment *spapr,
+   uint32_t token, uint32_t nargs,
+   target_ulong args,
+   uint32_t nret, target_ulong rets)
+{
+uint8_t c = rtas_ld(args, 0);
+VIOsPAPRDevice *sdev = spapr_vio_find_by_reg(spapr-vio_bus, 0);
+
+if (!sdev) {
+rtas_st(rets, 0, -1);
+} else {
+vty_putchars(sdev, c, sizeof(c));
+rtas_st(rets, 0, 0);
+}
+}
+
+static void rtas_get_time_of_day(sPAPREnvironment *spapr,
+ uint32_t token, uint32_t nargs,
+ target_ulong args,
+ uint32_t nret, target_ulong rets)
+{
+struct tm tm;
+
+if (nret != 8) {
+rtas_st(rets, 0, -3);
+return;
+}
+
+qemu_get_timedate(tm, 0);
+
+rtas_st(rets, 0, 0); /* Success */
+rtas_st(rets, 1, tm.tm_year + 1900);
+rtas_st(rets, 2, tm.tm_mon + 1);
+rtas_st(rets, 3, tm.tm_mday);
+rtas_st(rets, 4, tm.tm_hour);
+rtas_st(rets, 5, tm.tm_min);
+rtas_st(rets, 6, tm.tm_sec);
+rtas_st(rets, 7, 0); /* we don't do nanoseconds */
+}
+
+static void rtas_power_off(sPAPREnvironment *spapr,
+   uint32_t token, uint32_t nargs, target_ulong args,
+   uint32_t nret, target_ulong rets)
+{
+if (nargs != 2 || nret != 1) {
+rtas_st(rets, 0, -3);
+return;
+}
+qemu_system_shutdown_request();
+rtas_st(rets, 0, 0);
+}
+
 static struct rtas_call {
 const char *name;
 spapr_rtas_fn fn;
@@ -59,6 +111,15 @@ target_ulong spapr_rtas_call(sPAPREnvironment *spapr,
 }
 }
 
+/* HACK: Some Linux early debug code uses RTAS display-character,
+ * but assumes the token value is 0xa (which it is on some real
+ * machines) without looking it up in the device tree.  This
+ * special case makes this work */
+if (token == 

[Qemu-devel] [PATCH 25/27] Add a PAPR TCE-bypass mechanism for the pSeries machine

[David Gibson]

From: Ben Herrenschmidt b...@kernel.crashing.org

Usually, PAPR virtual IO devices use a virtual IOMMU mechanism, TCEs,
to mediate all DMA transfers.  While this is necessary for some sorts of
operation, it can be complex to program and slow for others.

This patch implements a mechanism for bypassing TCE translation, treating
IO addresses as plain (guest) physical memory addresses.  This has two
main uses:
 * Simple, but 64-bit aware programs like firmwares can use the VIO devices
without the complexity of TCE setup.
 * The guest OS can optionally use the TCE bypass to improve performance in
suitable situations.

The mechanism used is a per-device flag which disables TCE translation.
The flag is toggled with some (hypervisor-implemented) RTAS methods.

Signed-off-by: Ben Herrenschmidt b...@kernel.crashing.org
Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr_vio.c |   82 
 hw/spapr_vio.h |5 +++
 2 files changed, 87 insertions(+), 0 deletions(-)

diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index 8f14fcc..481a804 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -226,6 +226,12 @@ int spapr_tce_dma_write(VIOsPAPRDevice *dev, uint64_t 
taddr, const void *buf,
 (unsigned long long)taddr, size);
 #endif
 
+/* Check for bypass */
+if (dev-flags  VIO_PAPR_FLAG_DMA_BYPASS) {
+cpu_physical_memory_write(taddr, buf, size);
+return 0;
+}
+
 while (size) {
 uint64_t tce;
 uint32_t lsize;
@@ -313,6 +319,12 @@ int spapr_tce_dma_read(VIOsPAPRDevice *dev, uint64_t 
taddr, void *buf,
 (unsigned long long)taddr, size);
 #endif
 
+/* Check for bypass */
+if (dev-flags  VIO_PAPR_FLAG_DMA_BYPASS) {
+cpu_physical_memory_read(taddr, buf, size);
+return 0;
+}
+
 while (size) {
 uint64_t tce;
 uint32_t lsize;
@@ -513,6 +525,72 @@ int spapr_vio_send_crq(VIOsPAPRDevice *dev, uint8_t *crq)
 return 0;
 }
 
+/* quiesce handling */
+
+static void spapr_vio_quiesce_one(VIOsPAPRDevice *dev)
+{
+dev-flags = ~VIO_PAPR_FLAG_DMA_BYPASS;
+
+if (dev-rtce_table) {
+size_t size = (dev-rtce_window_size  SPAPR_VIO_TCE_PAGE_SHIFT)
+* sizeof(VIOsPAPR_RTCE);
+memset(dev-rtce_table, 0, size);
+}
+
+dev-crq.qladdr = 0;
+dev-crq.qsize = 0;
+dev-crq.qnext = 0;
+}
+
+static void rtas_set_tce_bypass(sPAPREnvironment *spapr, uint32_t token,
+uint32_t nargs, target_ulong args,
+uint32_t nret, target_ulong rets)
+{
+VIOsPAPRBus *bus = spapr-vio_bus;
+VIOsPAPRDevice *dev;
+uint32_t unit, enable;
+
+if (nargs != 2) {
+rtas_st(rets, 0, -3);
+return;
+}
+unit = rtas_ld(args, 0);
+enable = rtas_ld(args, 1);
+dev = spapr_vio_find_by_reg(bus, unit);
+if (!dev) {
+rtas_st(rets, 0, -3);
+return;
+}
+if (enable) {
+dev-flags |= VIO_PAPR_FLAG_DMA_BYPASS;
+} else {
+dev-flags = ~VIO_PAPR_FLAG_DMA_BYPASS;
+}
+
+rtas_st(rets, 0, 0);
+}
+
+static void rtas_quiesce(sPAPREnvironment *spapr, uint32_t token,
+ uint32_t nargs, target_ulong args,
+ uint32_t nret, target_ulong rets)
+{
+VIOsPAPRBus *bus = spapr-vio_bus;
+DeviceState *qdev;
+VIOsPAPRDevice *dev = NULL;
+
+if (nargs != 0) {
+rtas_st(rets, 0, -3);
+return;
+}
+
+QLIST_FOREACH(qdev, bus-bus.children, sibling) {
+dev = (VIOsPAPRDevice *)qdev;
+spapr_vio_quiesce_one(dev);
+}
+
+rtas_st(rets, 0, 0);
+}
+
 static int spapr_vio_busdev_init(DeviceState *qdev, DeviceInfo *qinfo)
 {
 VIOsPAPRDeviceInfo *info = (VIOsPAPRDeviceInfo *)qinfo;
@@ -591,6 +669,10 @@ VIOsPAPRBus *spapr_vio_bus_init(void)
 spapr_register_hypercall(H_SEND_CRQ, h_send_crq);
 spapr_register_hypercall(H_ENABLE_CRQ, h_enable_crq);
 
+/* RTAS calls */
+spapr_rtas_register(ibm,set-tce-bypass, rtas_set_tce_bypass);
+spapr_rtas_register(quiesce, rtas_quiesce);
+
 for (qinfo = device_info_list; qinfo; qinfo = qinfo-next) {
 VIOsPAPRDeviceInfo *info = (VIOsPAPRDeviceInfo *)qinfo;
 
diff --git a/hw/spapr_vio.h b/hw/spapr_vio.h
index b7d0daa..841b043 100644
--- a/hw/spapr_vio.h
+++ b/hw/spapr_vio.h
@@ -48,6 +48,8 @@ typedef struct VIOsPAPR_CRQ {
 typedef struct VIOsPAPRDevice {
 DeviceState qdev;
 uint32_t reg;
+uint32_t flags;
+#define VIO_PAPR_FLAG_DMA_BYPASS0x1
 qemu_irq qirq;
 uint32_t vio_irq_num;
 target_ulong signal_state;
@@ -104,4 +106,7 @@ void spapr_vlan_create(VIOsPAPRBus *bus, uint32_t reg, 
NICInfo *nd,
 void spapr_vscsi_create(VIOsPAPRBus *bus, uint32_t reg,
 qemu_irq qirq, uint32_t vio_irq_num);
 
+int spapr_tce_set_bypass(uint32_t unit, uint32_t enable);
+void spapr_vio_quiesce(void);
+
 #endif /* _HW_SPAPR_VIO_H */
-- 
1.7.1

[Qemu-devel] [PATCH 15/27] Virtual hash page table handling on pSeries machine

[David Gibson]

On pSeries logical partitions, excepting the old POWER4-style full system
partitions, the guest does not have direct access to the hardware page
table.  Instead, the pagetable exists in hypervisor memory, and the guest
must manipulate it with hypercalls.

However, our current pSeries emulation more closely resembles the old
style where the guest must set up and handle the pagetables itself.  This
patch converts it to act like a modern partition.

This involves two things: first, the hash translation path is modified to
permit the has table to be stored externally to the emulated machine's
RAM.  The pSeries machine init code configures the CPUs to use this mode.

Secondly, we emulate the PAPR hypercalls for manipulating the external
hashed page table.

Signed-off-by: David Gibson d...@au1.ibm.com
---
 hw/spapr.c  |   35 ++-
 hw/spapr_hcall.c|  254 +++
 target-ppc/cpu.h|2 +
 target-ppc/helper.c |   36 ++--
 4 files changed, 315 insertions(+), 12 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index 24110eb..15c1509 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -52,12 +52,15 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
   sPAPREnvironment *spapr,
   target_phys_addr_t initrd_base,
   target_phys_addr_t initrd_size,
-  const char *kernel_cmdline)
+  const char *kernel_cmdline,
+  long hash_shift)
 {
 void *fdt;
 uint64_t mem_reg_property[] = { 0, cpu_to_be64(ramsize) };
 uint32_t start_prop = cpu_to_be32(initrd_base);
 uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
+uint32_t pft_size_prop[] = {0, cpu_to_be32(hash_shift)};
+char hypertas_prop[] = hcall-pft\0hcall-term;
 int i;
 char *modelname;
 int ret;
@@ -145,6 +148,8 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
  * full emu, for kvm we should copy it from the host */
 _FDT((fdt_property_cell(fdt, clock-frequency, 10)));
 _FDT((fdt_property_cell(fdt, ibm,slb-size, env-slb_nr)));
+_FDT((fdt_property(fdt, ibm,pft-size,
+   pft_size_prop, sizeof(pft_size_prop;
 _FDT((fdt_property_string(fdt, status, okay)));
 _FDT((fdt_property(fdt, 64-bit, NULL, 0)));
 
@@ -160,6 +165,14 @@ static void *spapr_create_fdt(int *fdt_size, ram_addr_t 
ramsize,
 
 _FDT((fdt_end_node(fdt)));
 
+/* RTAS */
+_FDT((fdt_begin_node(fdt, rtas)));
+
+_FDT((fdt_property(fdt, ibm,hypertas-functions, hypertas_prop,
+   sizeof(hypertas_prop;
+
+_FDT((fdt_end_node(fdt)));
+
 /* vdevice */
 _FDT((fdt_begin_node(fdt, vdevice)));
 
@@ -209,12 +222,13 @@ static void ppc_spapr_init(ram_addr_t ram_size,
const char *cpu_model)
 {
 CPUState *envs[MAX_CPUS];
-void *fdt;
+void *fdt, *htab;
 int i;
 ram_addr_t ram_offset;
 target_phys_addr_t fdt_addr;
 uint32_t kernel_base, initrd_base;
-long kernel_size, initrd_size;
+long kernel_size, initrd_size, htab_size;
+long pteg_shift = 17;
 int fdt_size;
 
 spapr = qemu_malloc(sizeof(*spapr));
@@ -251,6 +265,18 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 ram_offset = qemu_ram_alloc(NULL, ppc_spapr.ram, ram_size);
 cpu_register_physical_memory(0, ram_size, ram_offset);
 
+/* allocate hash page table.  For now we always make this 16mb,
+ * later we should probably make it scale to the size of guest
+ * RAM */
+htab_size = 1ULL  (pteg_shift + 7);
+htab = qemu_mallocz(htab_size);
+
+for (i = 0; i  smp_cpus; i++) {
+envs[i]-external_htab = htab;
+envs[i]-htab_base = -1;
+envs[i]-htab_mask = htab_size - 1;
+}
+
 spapr-vio_bus = spapr_vio_bus_init();
 
 for (i = 0; i  MAX_SERIAL_PORTS; i++) {
@@ -296,7 +322,8 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 
 /* Prepare the device tree */
 fdt = spapr_create_fdt(fdt_size, ram_size, cpu_model, envs, spapr,
-   initrd_base, initrd_size, kernel_cmdline);
+   initrd_base, initrd_size, kernel_cmdline,
+   pteg_shift + 7);
 if (!fdt) {
 hw_error(Couldn't create pSeries device tree\n);
 exit(1);
diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index 7623969..5c2dd88 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -1,8 +1,253 @@
 #include sysemu.h
 #include cpu.h
 #include qemu-char.h
+#include sysemu.h
+#include qemu-char.h
+#include exec-all.h
 #include hw/spapr.h
 
+#define HPTES_PER_GROUP 8
+
+#define HPTE_V_SSIZE_SHIFT  62
+#define HPTE_V_AVPN_SHIFT   7
+#define HPTE_V_AVPN 0x3f80ULL
+#define HPTE_V_AVPN_VAL(x)  (((x)  HPTE_V_AVPN)  HPTE_V_AVPN_SHIFT)
+#define 

Re: [Qemu-devel] [PATCH] simpletrace: Thread-safe tracing

[Stefan Hajnoczi]

On Tue, Mar 22, 2011 at 11:52 PM, Andreas Färber andreas.faer...@web.de wrote:
 Am 28.02.2011 um 10:38 schrieb Stefan Hajnoczi:

 Trace events outside the global mutex cannot be used with the simple
 trace backend since it is not thread-safe.  There is no check to prevent
 them being enabled so people sometimes learn this the hard way.

 This patch restructures the simple trace backend with a ring buffer
 suitable for multiple concurrent writers.  A writeout thread empties the
 trace buffer when threshold fill levels are reached.  Should the
 writeout thread be unable to keep up with trace generation, records will
 simply be dropped.

 Each time events are dropped a special record is written to the trace
 file indicating how many events were dropped.  The event ID is
 0xfffe and its signature is dropped(uint32_t count).

 Signed-off-by: Stefan Hajnoczi stefa...@linux.vnet.ibm.com
 ---
 v2:
 * Add 'dropped' event so we know when events were lost.

 [...]

 +    __sync_synchronize(); /* read memory barrier before accessing record
 */

 Getting this at HEAD on Darwin/ppc64:

  CC    simpletrace.o
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘get_trace_record’:
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: implicit declaration of
 function ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: nested extern
 declaration of ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘trace’:
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: implicit declaration of
 function ‘__sync_fetch_and_add’
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: nested extern
 declaration of ‘__sync_fetch_and_add’
 [...]
  LINK  qemu-nbd
 Undefined symbols:
  ___sync_fetch_and_add, referenced from:
      _trace in simpletrace.o
  ___sync_synchronize, referenced from:
      _get_trace_record in simpletrace.o
      _trace in simpletrace.o
 ld: symbol(s) not found
 collect2: ld returned 1 exit status
 make: *** [qemu-nbd] Error 1

 Haven't investigated further yet.

/me shakes his fist at Apple gcc!

These are gcc builtins, I believe the were added in gcc 4.1:
http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Atomic-Builtins.html#Atomic-Builtins

Which version of gcc are you running?

We can replace them with equivalent library functions or inline
assembly code.  Here's what we need:
Read memory barrier
Write memory barrier
Atomic load and increment

CCed Alex and Anthony who may have thoughts on adding these atomic ops to QEMU.

Stefan

Re: [Qemu-devel] [PATCH] simpletrace: Thread-safe tracing

[Stefan Hajnoczi]

On Wed, Mar 23, 2011 at 7:39 AM, Stefan Hajnoczi stefa...@gmail.com wrote:
 On Tue, Mar 22, 2011 at 11:52 PM, Andreas Färber andreas.faer...@web.de 
 wrote:
 Am 28.02.2011 um 10:38 schrieb Stefan Hajnoczi:

 Trace events outside the global mutex cannot be used with the simple
 trace backend since it is not thread-safe.  There is no check to prevent
 them being enabled so people sometimes learn this the hard way.

 This patch restructures the simple trace backend with a ring buffer
 suitable for multiple concurrent writers.  A writeout thread empties the
 trace buffer when threshold fill levels are reached.  Should the
 writeout thread be unable to keep up with trace generation, records will
 simply be dropped.

 Each time events are dropped a special record is written to the trace
 file indicating how many events were dropped.  The event ID is
 0xfffe and its signature is dropped(uint32_t count).

 Signed-off-by: Stefan Hajnoczi stefa...@linux.vnet.ibm.com
 ---
 v2:
 * Add 'dropped' event so we know when events were lost.

 [...]

 +    __sync_synchronize(); /* read memory barrier before accessing record
 */

 Getting this at HEAD on Darwin/ppc64:

  CC    simpletrace.o
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘get_trace_record’:
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: implicit declaration of
 function ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: nested extern
 declaration of ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘trace’:
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: implicit declaration of
 function ‘__sync_fetch_and_add’
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: nested extern
 declaration of ‘__sync_fetch_and_add’
 [...]
  LINK  qemu-nbd
 Undefined symbols:
  ___sync_fetch_and_add, referenced from:
      _trace in simpletrace.o
  ___sync_synchronize, referenced from:
      _get_trace_record in simpletrace.o
      _trace in simpletrace.o
 ld: symbol(s) not found
 collect2: ld returned 1 exit status
 make: *** [qemu-nbd] Error 1

 Haven't investigated further yet.

 /me shakes his fist at Apple gcc!

 These are gcc builtins, I believe the were added in gcc 4.1:
 http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Atomic-Builtins.html#Atomic-Builtins

 Which version of gcc are you running?

 We can replace them with equivalent library functions or inline
 assembly code.  Here's what we need:
 Read memory barrier
 Write memory barrier
 Atomic load and increment

 CCed Alex and Anthony who may have thoughts on adding these atomic ops to 
 QEMU.

Thinking about it more, the way I'd like to solve this (and make
simpletrace work on Windows too!) is to go ahead and use glib threads
and atomics.  I don't want to be in the business of writing
portability wrappers for different OSes and architectures, and glib
already does this:
file:///usr/share/doc/libglib2.0-doc/glib/glib-Atomic-Operations.html#g-atomic-int-exchange-and-add

Stefan

Re: [Qemu-devel] [PATCH] simpletrace: Thread-safe tracing

[Stefan Hajnoczi]

On Wed, Mar 23, 2011 at 7:58 AM, Stefan Hajnoczi stefa...@gmail.com wrote:
 On Wed, Mar 23, 2011 at 7:39 AM, Stefan Hajnoczi stefa...@gmail.com wrote:
 On Tue, Mar 22, 2011 at 11:52 PM, Andreas Färber andreas.faer...@web.de 
 wrote:
 Am 28.02.2011 um 10:38 schrieb Stefan Hajnoczi:

 Trace events outside the global mutex cannot be used with the simple
 trace backend since it is not thread-safe.  There is no check to prevent
 them being enabled so people sometimes learn this the hard way.

 This patch restructures the simple trace backend with a ring buffer
 suitable for multiple concurrent writers.  A writeout thread empties the
 trace buffer when threshold fill levels are reached.  Should the
 writeout thread be unable to keep up with trace generation, records will
 simply be dropped.

 Each time events are dropped a special record is written to the trace
 file indicating how many events were dropped.  The event ID is
 0xfffe and its signature is dropped(uint32_t count).

 Signed-off-by: Stefan Hajnoczi stefa...@linux.vnet.ibm.com
 ---
 v2:
 * Add 'dropped' event so we know when events were lost.

 [...]

 +    __sync_synchronize(); /* read memory barrier before accessing record
 */

 Getting this at HEAD on Darwin/ppc64:

  CC    simpletrace.o
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘get_trace_record’:
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: implicit declaration of
 function ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: nested extern
 declaration of ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘trace’:
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: implicit declaration of
 function ‘__sync_fetch_and_add’
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: nested extern
 declaration of ‘__sync_fetch_and_add’
 [...]
  LINK  qemu-nbd
 Undefined symbols:
  ___sync_fetch_and_add, referenced from:
      _trace in simpletrace.o
  ___sync_synchronize, referenced from:
      _get_trace_record in simpletrace.o
      _trace in simpletrace.o
 ld: symbol(s) not found
 collect2: ld returned 1 exit status
 make: *** [qemu-nbd] Error 1

 Haven't investigated further yet.

 /me shakes his fist at Apple gcc!

 These are gcc builtins, I believe the were added in gcc 4.1:
 http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Atomic-Builtins.html#Atomic-Builtins

 Which version of gcc are you running?

 We can replace them with equivalent library functions or inline
 assembly code.  Here's what we need:
 Read memory barrier
 Write memory barrier
 Atomic load and increment

 CCed Alex and Anthony who may have thoughts on adding these atomic ops to 
 QEMU.

 Thinking about it more, the way I'd like to solve this (and make
 simpletrace work on Windows too!) is to go ahead and use glib threads
 and atomics.  I don't want to be in the business of writing
 portability wrappers for different OSes and architectures, and glib
 already does this:
 file:///usr/share/doc/libglib2.0-doc/glib/glib-Atomic-Operations.html#g-atomic-int-exchange-and-add

Corrected URI:
http://library.gnome.org/devel/glib/2.28/glib-Atomic-Operations.html#g-atomic-int-exchange-and-add

Stefan

Re: [Qemu-devel] [PATCH 01/11] Add hard build dependency on glib

[Stefan Hajnoczi]

On Wed, Mar 23, 2011 at 12:16 AM, Anthony Liguori aligu...@us.ibm.com wrote:
 GLib is an extremely common library that has a portable thread implementation
 along with tons of other goodies.

 GLib and GObject have a fantastic amount of infrastructure we can leverage in
 QEMU including an object oriented programming infrastructure.

 Short term, it has a very nice thread pool implementation that we could 
 leverage
 in something like virtio-9p.  It also has a test harness implementation that
 this series will use.

 Signed-off-by: Anthony Liguori aligu...@us.ibm.com
 ---
  Makefile        |    2 ++
  Makefile.objs   |    2 ++
  Makefile.target |    1 +
  configure       |   13 +
  4 files changed, 18 insertions(+), 0 deletions(-)

Yes, please.  I'd like to use glib to make simpletrace portable.

To paraphrase the saying about non-trivial C programs and LISP interpreters:

In every cross-platform C program there is a glib.

Stefan

Re: [Qemu-devel] [PATCH] simpletrace: Thread-safe tracing

[Alexander Graf]

On 23.03.2011, at 08:59, Stefan Hajnoczi wrote:

 On Wed, Mar 23, 2011 at 7:58 AM, Stefan Hajnoczi stefa...@gmail.com wrote:
 On Wed, Mar 23, 2011 at 7:39 AM, Stefan Hajnoczi stefa...@gmail.com wrote:
 On Tue, Mar 22, 2011 at 11:52 PM, Andreas Färber andreas.faer...@web.de 
 wrote:
 Am 28.02.2011 um 10:38 schrieb Stefan Hajnoczi:
 
 Trace events outside the global mutex cannot be used with the simple
 trace backend since it is not thread-safe.  There is no check to prevent
 them being enabled so people sometimes learn this the hard way.
 
 This patch restructures the simple trace backend with a ring buffer
 suitable for multiple concurrent writers.  A writeout thread empties the
 trace buffer when threshold fill levels are reached.  Should the
 writeout thread be unable to keep up with trace generation, records will
 simply be dropped.
 
 Each time events are dropped a special record is written to the trace
 file indicating how many events were dropped.  The event ID is
 0xfffe and its signature is dropped(uint32_t count).
 
 Signed-off-by: Stefan Hajnoczi stefa...@linux.vnet.ibm.com
 ---
 v2:
 * Add 'dropped' event so we know when events were lost.
 
 [...]
 
 +__sync_synchronize(); /* read memory barrier before accessing record
 */
 
 Getting this at HEAD on Darwin/ppc64:
 
  CCsimpletrace.o
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘get_trace_record’:
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: implicit declaration of
 function ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c:81: warning: nested extern
 declaration of ‘__sync_synchronize’
 /Users/andreas/QEMU/qemu/simpletrace.c: In function ‘trace’:
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: implicit declaration 
 of
 function ‘__sync_fetch_and_add’
 /Users/andreas/QEMU/qemu/simpletrace.c:161: warning: nested extern
 declaration of ‘__sync_fetch_and_add’
 [...]
  LINK  qemu-nbd
 Undefined symbols:
  ___sync_fetch_and_add, referenced from:
  _trace in simpletrace.o
  ___sync_synchronize, referenced from:
  _get_trace_record in simpletrace.o
  _trace in simpletrace.o
 ld: symbol(s) not found
 collect2: ld returned 1 exit status
 make: *** [qemu-nbd] Error 1
 
 Haven't investigated further yet.
 
 /me shakes his fist at Apple gcc!
 
 These are gcc builtins, I believe the were added in gcc 4.1:
 http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Atomic-Builtins.html#Atomic-Builtins
 
 Which version of gcc are you running?
 
 We can replace them with equivalent library functions or inline
 assembly code.  Here's what we need:
 Read memory barrier
 Write memory barrier
 Atomic load and increment
 
 CCed Alex and Anthony who may have thoughts on adding these atomic ops to 
 QEMU.
 
 Thinking about it more, the way I'd like to solve this (and make
 simpletrace work on Windows too!) is to go ahead and use glib threads
 and atomics.  I don't want to be in the business of writing
 portability wrappers for different OSes and architectures, and glib
 already does this:
 file:///usr/share/doc/libglib2.0-doc/glib/glib-Atomic-Operations.html#g-atomic-int-exchange-and-add
 
 Corrected URI:
 http://library.gnome.org/devel/glib/2.28/glib-Atomic-Operations.html#g-atomic-int-exchange-and-add

Yeah, either that or adding a configure check for the availability of atomic 
operations. If the glib folks did go through the work already, I agree that 
it'd be nice to reuse that work though.


Alex

Re: [Qemu-devel] [PATCH 01/11] Add hard build dependency on glib

[Roy Tam]

2011/3/23 Stefan Hajnoczi stefa...@gmail.com:
 On Wed, Mar 23, 2011 at 12:16 AM, Anthony Liguori aligu...@us.ibm.com wrote:
 GLib is an extremely common library that has a portable thread implementation
 along with tons of other goodies.

 GLib and GObject have a fantastic amount of infrastructure we can leverage in
 QEMU including an object oriented programming infrastructure.

 Short term, it has a very nice thread pool implementation that we could 
 leverage
 in something like virtio-9p.  It also has a test harness implementation that
 this series will use.

 Signed-off-by: Anthony Liguori aligu...@us.ibm.com
 ---
  Makefile        |    2 ++
  Makefile.objs   |    2 ++
  Makefile.target |    1 +
  configure       |   13 +
  4 files changed, 18 insertions(+), 0 deletions(-)

 Yes, please.  I'd like to use glib to make simpletrace portable.

 To paraphrase the saying about non-trivial C programs and LISP interpreters:

 In every cross-platform C program there is a glib.

 Stefan



So, breaking win32 support again?

Roy

Re: [Qemu-devel] [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Stefan Hajnoczi]

On Wed, Mar 23, 2011 at 12:16 AM, Anthony Liguori aligu...@us.ibm.com wrote:
 +static QObject *read_current_schema(void)
 +{
 +    char buffer[65536];
 +    int fd;
 +    int ret;
 +    size_t offset = 0;
 +    ssize_t len;
 +
 +    ret = system(i386-softmmu/qemu -vmstate-dump  /tmp/schema.json);

Please don't hardcode i386-softmmu, there should at least be a way to
override it.  For example, I tend to build x86_64-softmmu only.

Using a temporary file is not ideal because as soon as this program
runs as part of an automated build system we could be clobbering the
file if multiple runs are going in parallel.  How about popen(3)?

 diff --git a/vmstate/schema.json b/vmstate/schema.json
 new file mode 100644
 index 000..23483ab
 --- /dev/null
 +++ b/vmstate/schema.json
 @@ -0,0 +1,1176 @@
 +{
 +    cpu: {
 +        mcg_cap: uint64,
 +        a20_mask: int32,
 +        tsc_offset: uint64,
 +        idt: {
 +            flags: uint32,
 +            limit: uint32,
 +            selector: uint32,
 +            base: uint32,
 +            __version__: 1
 +        },

Is field ordering important and did we lose that information as soon
as we started using dicts to represent vmstate dumps?

Stefan

Re: [Qemu-devel] [PATCH 01/11] Add hard build dependency on glib

[Stefan Hajnoczi]

On Wed, Mar 23, 2011 at 8:19 AM, Roy Tam roy...@gmail.com wrote:
 2011/3/23 Stefan Hajnoczi stefa...@gmail.com:
 On Wed, Mar 23, 2011 at 12:16 AM, Anthony Liguori aligu...@us.ibm.com 
 wrote:
 GLib is an extremely common library that has a portable thread 
 implementation
 along with tons of other goodies.

 GLib and GObject have a fantastic amount of infrastructure we can leverage 
 in
 QEMU including an object oriented programming infrastructure.

 Short term, it has a very nice thread pool implementation that we could 
 leverage
 in something like virtio-9p.  It also has a test harness implementation that
 this series will use.

 Signed-off-by: Anthony Liguori aligu...@us.ibm.com
 ---
  Makefile        |    2 ++
  Makefile.objs   |    2 ++
  Makefile.target |    1 +
  configure       |   13 +
  4 files changed, 18 insertions(+), 0 deletions(-)

 Yes, please.  I'd like to use glib to make simpletrace portable.

 To paraphrase the saying about non-trivial C programs and LISP interpreters:

 In every cross-platform C program there is a glib.

 Stefan



 So, breaking win32 support again?

Can you please explain the win32 issue with glib?

Stefan

[Qemu-devel] Re: [PATCH 27/27] Add SLOF-based partition firmware for pSeries machine, allowing more boot options

[Benjamin Herrenschmidt]

On Wed, 2011-03-23 at 16:30 +1100, David Gibson wrote:
 +- SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
 +  implementation for certain IBM POWER hardware.  The image currently
 +  in qemu is built from git tag qemu-slof-20110323.
 +

For those who can't wait to check it out ...

David forgot to mention the actual git URL ;-)

It's on github (https://github.com/dgibson/SLOF)

Cheers,
Ben.

[Qemu-devel] Re: [PATCH v2 1/2] hw/arm_sysctl.c: Add the Versatile Express system registers

[Paolo Bonzini]

On 03/22/2011 09:32 PM, Peter Maydell wrote:

  Just to make things more complicated, this has been deprecatedO:-)


It has? Your examples below still use it...


The case in which the subsection needed function returns true should 
be rare, so the version number should rarely need to be bumped.  In this 
sense, using _V is discouraged/deprecated.


In fact, some people would prefer the version number not to be bumped 
anymore, and subsections to be always used instead.  So far, every time 
the above argument was brought up in the list, people always found a way 
to define the subsection needed function so that it didn't return 
true, and the decision on deprecation of _V was postponed.


Subsections make it easier for downstream versions to backport features 
arbitrarily.  Suppose you release QEMU with a device at version 9.  The 
next version adds feature A as version 10 and feature B as version 11. 
For a downstream vendor, backporting just feature B is difficult because 
they would have three choices:


- the good, but also the hardest: bump to version 11, and save some 
dummy (but valid) value for fields related to feature A.  This 
introduces undesired differences from upstream, and may be difficult.


- the bad: bump to version 10, and have a migration format that is 
incompatible with upstream version 10.


- the ugly: keep version 9, and convert the migration data for feature B 
to a subsection.  This introduces differences from upstream and makes 
the migration format incompatible with upstream version, but avoids that 
the same version number means different things in different distributions.


So, those people say that subsections are a bit more friendly to 
downstream vendors.  So they suggest that upstream should use the third 
option to begin with, and even use subsections even if the subsection 
needed function returns true.  This makes the backport easier and more 
straightforward.  The argument is good but, as I said, so far there has 
never been an actual need to apply it.


So, Juan's mail documents what QEMU is doing right now accurately, but 
there isn't 100% agreement that it should be that way in the future. 
Just note that you are encouraged to use subsections (and thus devise a 
way to make the subsection optional) whenever possible and whenever it 
makes sense to help such downstream distributors.


Paolo

Re: [Qemu-devel] [PATCH 01/11] Add hard build dependency on glib

[Roy Tam]

2011/3/23 Stefan Hajnoczi stefa...@gmail.com:
 On Wed, Mar 23, 2011 at 8:19 AM, Roy Tam roy...@gmail.com wrote:
 2011/3/23 Stefan Hajnoczi stefa...@gmail.com:
 On Wed, Mar 23, 2011 at 12:16 AM, Anthony Liguori aligu...@us.ibm.com 
 wrote:
 GLib is an extremely common library that has a portable thread 
 implementation
 along with tons of other goodies.

 GLib and GObject have a fantastic amount of infrastructure we can leverage 
 in
 QEMU including an object oriented programming infrastructure.

 Short term, it has a very nice thread pool implementation that we could 
 leverage
 in something like virtio-9p.  It also has a test harness implementation 
 that
 this series will use.

 Signed-off-by: Anthony Liguori aligu...@us.ibm.com
 ---
  Makefile        |    2 ++
  Makefile.objs   |    2 ++
  Makefile.target |    1 +
  configure       |   13 +
  4 files changed, 18 insertions(+), 0 deletions(-)

 Yes, please.  I'd like to use glib to make simpletrace portable.

 To paraphrase the saying about non-trivial C programs and LISP interpreters:

 In every cross-platform C program there is a glib.

 Stefan



 So, breaking win32 support again?

 Can you please explain the win32 issue with glib?

 Stefan


I think I have to change my words. Glib works in win32, but adding
Glib to QEMU will bloat the binary size. It adds more dependency on
building and the result binary. I wonder if it is a must to add it.

Roy

Re: Supsend/resume regression in c995b4 WAS: Re: [Qemu-devel] [PATCH] Fix migration uint8 arrys handled

[Avi Kivity]

On 03/22/2011 03:26 PM, Anthony Liguori wrote:


Here's how I propose we tackle this.  This patch adds a -dump-savevm 
option that takes a version.  It spits out all of the fields we save 
for a particular version (well, not really, but it should).  We also 
can add type information.  The idea is that we'd write a simple test 
case (using gtester) that ran through and dumped the schema for each 
version.  We'd store the schema's in the tree and the test can compare 
old schema's to the current schema to check for failure.




Instead of generating the schema and comparing, what about the other way 
round?  Write vmstate in a formal schema, and generate the code at runtime.


--
error compiling committee.c: too many arguments to function

[Qemu-devel] Re: [PATCH 01/11] Add hard build dependency on glib

[Paolo Bonzini]

On 03/23/2011 09:58 AM, Roy Tam wrote:

I think I have to change my words. Glib works in win32, but adding
Glib to QEMU will bloat the binary size. It adds more dependency on
building and the result binary. I wonder if it is a must to add it.


That's very far from my definition of breaking.

Paolo

Re: [Qemu-devel] [PATCH 01/11] Add hard build dependency on glib

[Stefan Hajnoczi]

On Wed, Mar 23, 2011 at 8:58 AM, Roy Tam roy...@gmail.com wrote:
 I think I have to change my words. Glib works in win32, but adding
 Glib to QEMU will bloat the binary size. It adds more dependency on
 building and the result binary. I wonder if it is a must to add it.

If we stick to re-implementing cross-platform wrappers then Windows
support will always lag behind POSIX and developers will spend effort
working around platform quirks rather than improving QEMU.  Very few
QEMU developers build on Windows, for example Paolo's latest Windows
iothread support patches were tested under Wine.

Will introducing glib add a dependency and at worst some temporary
breakage?  Yes, there's a risk.  But longer term this is great news
for Windows because it gives it a chance of actually working on a
level close to *nix.

Stefan

[Qemu-devel] Re: [PATCH v2 1/2] hw/arm_sysctl.c: Add the Versatile Express system registers

[Juan Quintela]

Peter Maydell peter.mayd...@linaro.org wrote:
 On 22 March 2011 19:53, Juan Quintela quint...@redhat.com wrote:
 Peter Maydell peter.mayd...@linaro.org wrote:
 Migration from the old version to the new version can be supported
 if it is OK for the new fields to remain in their default state
 [XXX is this right? are they zeroed, or do they get the value
 the device's reset function sets them to, or something else?]

 You can initialize in your init function at the value that you want, or
 use foo_post_load() function (that receives the version as a parameter)
 to assign to any correct values that you need.

 To check I understand this, this means an incoming migration is
 always done to a fresh, never-been-used-before device that has had
 its init called but not its reset?

 when the state of an old-version snapshot is loaded. To implement
 this you need to use the VMSTATE_*_V macros which let you specify
 the version in which a field was introduced, for instance:

  VMSTATE_UINT32_V(sys_cfgdata, arm_sysctl_state, 2)

 for a field introduced in version 2. You should also increment
 the version_id, but leave the minimum_version_id unchanged.
 Newly added VMSTATE_*_V fields should go at the end of the
 VMState description.

 Just to make things more complicated, this has been deprecated O:-)

 It has? Your examples below still use it...

as Paolo says, it should be rare that you need it.


 - We know that old device was wrong, and that there is no way we can
  load (reliabely) from version 0.  Then we just increase the version:

 If you're increasing the version can you also clean up by
 converting any old VMSTATE_*_V() into plain VMSTATE_*() at this
 point, since we can't migrate from those old versions any more?

From vl.c

qemu_system_reset();
if (loadvm) {
if (load_vmstate(loadvm)  0) {
autostart = 0;
}
}

if (incoming) {
int ret = qemu_start_incoming_migration(incoming);
if (ret  0) {
fprintf(stderr, Migration failed. Exit code %s(%d), exiting.\n,
incoming, ret);
exit(ret);
}
} else if (autostart) {
vm_start();
}


reset is always called after init, before both incoming migration and
normal start.

 - We know that we can load from v1.  But that we want to always sent
  bar2 for migration, then we just increase versions to:


 const VMStateDescription vmstate_foo = {
    .name = foo,
    .version_id = 2,
    .minimum_version_id = 1,
    .minimum_version_id_old = 1,
    .fields      = (VMStateField []) {
        VMSTATE_INT32(bar, FOOState),
        VMSTATE_INT32_V(bar2, FOOState, 1),
        VMSTATE_END_OF_LIST()
    }
 };

 And we are done.  We are able to receive state 0 and 1, and we would
 always sent version 1.

 Your numbers in the struct and the text don't seem to match?
 My guess is you meant to write version_id = 1, minimum_version* = 0 ?

My fault. copy paste :-(

 Have I manage to explain myself a little bit?

 Yes, thanks, that's very helpful.

You are welcome.

Later, Juan.

[Qemu-devel] Re: [PATCH 04/11] sb16: fix migration quirk

[Juan Quintela]

Anthony Liguori aligu...@us.ibm.com wrote:
 We seem to migrate the same field twice.  It's been this way since Fabrice
 committed the original file.  Since semantically, we basically ignore the 
 first
 value, make this an unused entry.

 Signed-off-by: Anthony Liguori aligu...@us.ibm.com
 ---
  hw/sb16.c |3 ++-
  1 files changed, 2 insertions(+), 1 deletions(-)

 diff --git a/hw/sb16.c b/hw/sb16.c
 index c98546a..1c30e4c 100644
 --- a/hw/sb16.c
 +++ b/hw/sb16.c
 @@ -77,6 +77,7 @@ typedef struct SB16State {
  
  int v2x6;
  
 +uint8_t csp_param_dummy;
  uint8_t csp_param;
  uint8_t csp_value;
  uint8_t csp_mode;
 @@ -1313,7 +1314,7 @@ static const VMStateDescription vmstate_sb16 = {
  VMSTATE_INT32(can_write, SB16State),
  VMSTATE_INT32(v2x6, SB16State),
  
 -VMSTATE_UINT8(csp_param, SB16State),
 +VMSTATE_UINT8(csp_param_dummy, SB16State),
  VMSTATE_UINT8(csp_value, SB16State),
  VMSTATE_UINT8(csp_mode, SB16State),
  VMSTATE_UINT8(csp_param, SB16State),

VMSTATE_UNUSED(1) instead?

Later, Juan.

[Qemu-devel] Re: [PATCH 05/11] vga-isa: fix migration by breaking it

[Juan Quintela]

Anthony Liguori aligu...@us.ibm.com wrote:
 This is pretty sad.  We use the same section name for vga-isa as we do for
 vga-pci even though we use separate formats.  This breaks the live migration
 protocol because we may misinterpret the vga-isa as a vga-pci device.

 vga-isa should use it's own wrapper just like vga-pci does.  That's what we do
 in this patch.

 Signed-by-off: Anthony Liguori aligu...@us.ibm.com
 ---
  hw/vga-isa.c |   13 +++--
  1 files changed, 11 insertions(+), 2 deletions(-)

 diff --git a/hw/vga-isa.c b/hw/vga-isa.c
 index 5f1ef76..eaae2e0 100644
 --- a/hw/vga-isa.c
 +++ b/hw/vga-isa.c
 @@ -72,10 +72,19 @@ static int vga_initfn(ISADevice *dev)
  return 0;
  }
  
 +static const VMStateDescription vmstate_vga_isa = {
 +.name = isa-vga,
 +.version_id = 1,
 +.fields = (VMStateField []) {
 +VMSTATE_STRUCT(state, ISAVGAState, 0, vmstate_vga_common, 
 VGACommonState),
 +VMSTATE_END_OF_LIST(),
 +},
 +};
 +
  static ISADeviceInfo vga_info = {
  .qdev.name = isa-vga,
  .qdev.size = sizeof(ISAVGAState),
 -.qdev.vmsd = vmstate_vga_common,
 +.qdev.vmsd = vmstate_vga_isa,
  .qdev.reset = vga_reset_isa,
  .qdev.no_user  = 1,
  .init  = vga_initfn,
 @@ -84,7 +93,7 @@ static ISADeviceInfo vga_info = {
  /* Register the VMState Description to support VMState introspection */
  static void init_vmstate_description_0(void)
  {
 -register_vmstate_description(vmstate_vga_common);
 +register_vmstate_description(vmstate_vga_isa);
  }
  
  vmstate_init(init_vmstate_description_0);

This was done that way when I ported this device.

This define is also always setup CONFIG_BOCHS_VBE, and at some point it
didn't worked without it.

But this is a different problem that doing the tests.

Later, JUan.

[Qemu-devel] Re: [PATCH] virtio-serial: don't crash on invalid input

[Michael S. Tsirkin]

On Tue, Mar 22, 2011 at 10:25:06PM +0530, Amit Shah wrote:
 On (Tue) 22 Mar 2011 [18:32:50], Michael S. Tsirkin wrote:
  Fix crash on invalid input in virtio-serial.
  Discovered by code review, untested.
  
  Signed-off-by: Michael S. Tsirkin m...@redhat.com
  ---
   hw/virtio-serial-bus.c |3 +++
   1 files changed, 3 insertions(+), 0 deletions(-)
  
  diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
  index e0bf6c5..8807a2f 100644
  --- a/hw/virtio-serial-bus.c
  +++ b/hw/virtio-serial-bus.c
  @@ -654,6 +654,9 @@ static int virtio_serial_load(QEMUFile *f, void 
  *opaque, int version_id)
   
   id = qemu_get_be32(f);
   port = find_port_by_id(s, id);
  +if (!port) {
  +return -EINVAL;
  +}
 
 Just before this, we matched the ports_map which would bail out if the
 corresponding port isn't avl. in the destination, so this check is
 made redundant.
 
   Amit

You are trusting the remote here, this is a security problem.
A malicious remote will always be able to create arbitrary guest state,
but it should not be able to corrupt the host.

-- 
MST

[Qemu-devel] Re: [PATCH 07/11] eeprom93xx: Use the new hack macro to avoid duplicate field names

[Juan Quintela]

Anthony Liguori aligu...@us.ibm.com wrote:
 I don't fully understand this hack business but we need field to be unique 
 so..

 Signed-off-by: Anthony Liguori aligu...@us.ibm.com
 ---
  hw/eeprom93xx.c |2 +-
  1 files changed, 1 insertions(+), 1 deletions(-)

 diff --git a/hw/eeprom93xx.c b/hw/eeprom93xx.c
 index cfa695d..f1d75ec 100644
 --- a/hw/eeprom93xx.c
 +++ b/hw/eeprom93xx.c
 @@ -114,7 +114,7 @@ static const VMStateInfo vmstate_hack_uint16_from_uint8 = 
 {
  };
  
  #define VMSTATE_UINT16_HACK_TEST(_f, _s, _t)   \
 -VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, 
 uint16_t)
 +VMSTATE_SINGLE_TEST_HACK(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, 
 uint16_t)
  
  static bool is_old_eeprom_version(void *opaque, int version_id)
  {

After the fact, we need to promote it as full types.

Basically it is needed when we sent a field with a different size that
we use it on the struct.

if we have

struct FOOState {
   int32_t bar;

}

and it is sent as

VMSTATE_INT8(bar, )

In this case, I went through the whole device, checed that int8_t was
enough and did the change.

But if we have:

struct FOOState {
   int8_t bar;

}

and it is sent as

VMSTATE_INT32(bar, )

Then it is not trivial :-(

We change FOOState to int32 or we break migration format.  Here is where
the _HACK suffix appeared.

I thought it was not going to be needed a lot, but there are several
devices that just sent everything over the wire as uint32, independently
of its type.

Later, Juan.

[Qemu-devel] Re: [PATCH 27/27] Add SLOF-based partition firmware for pSeries machine, allowing more boot options

[Benjamin Herrenschmidt]

On Wed, 2011-03-23 at 19:51 +1100, Benjamin Herrenschmidt wrote:
 On Wed, 2011-03-23 at 16:30 +1100, David Gibson wrote:
  +- SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
  +  implementation for certain IBM POWER hardware.  The image currently
  +  in qemu is built from git tag qemu-slof-20110323.
  +
 
 For those who can't wait to check it out ...
 
 David forgot to mention the actual git URL ;-)
 
 It's on github (https://github.com/dgibson/SLOF)

And I just realized it wasn't actually pushed out either :-) I've just
fixed that.

Cheers,
Ben.

Re: [Qemu-devel] [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Peter Maydell]

On 23 March 2011 00:16, Anthony Liguori aligu...@us.ibm.com wrote:
 +    if (old_version != new_version) {
 +        g_error(Version %d of device `%s' is available in QEMU, but schema 
 still reports %d, please update schema.\n,
 +                new_version, device, old_version);
 +    }

Might be nice for these please update error messages to
include a pointer to a docs file explaining in more detail
how to do that?
(also 80 char line ;-))

 diff --git a/vmstate/schema.json b/vmstate/schema.json
 new file mode 100644
 index 000..23483ab
 --- /dev/null
 +++ b/vmstate/schema.json
 @@ -0,0 +1,1176 @@
 +{
 +    cpu: {
 +        mcg_cap: uint64,
 +        a20_mask: int32,
 +        tsc_offset: uint64,

This schema file appears to be board-specific (or at least
x86-specific) -- shouldn't the cpu/board/whatever name
be in the filename, so we have scope to expand the test
to checking migration issues for other platforms too?

(I don't care much about ARM migration breakages just at the
moment but I suspect that it will be becoming more important
by this time next year...)

Also since this looks like an autogenerated file that's going
to be going into version control maybe it should have a
comment header at the top of the autogenerated, do not edit
by hand! type.

-- PMM

Re: [Qemu-devel] [PATCH V11 03/15] xen: Support new libxc calls from xen unstable.

[Alexander Graf]

On 01.03.2011, at 19:35, anthony.per...@citrix.com wrote:

 From: Anthony PERARD anthony.per...@citrix.com
 
 This patch updates the libxenctrl calls in Qemu to use the new interface,
 otherwise Qemu wouldn't be able to build against new versions of the
 library.
 
 We check libxenctrl version in configure, from Xen 3.3.0 to Xen
 unstable.
 
 Signed-off-by: Anthony PERARD anthony.per...@citrix.com
 Signed-off-by: Stefano Stabellini stefano.stabell...@eu.citrix.com
 Acked-by: Alexander Graf ag...@suse.de
 ---
 configure|   67 -
 hw/xen_backend.c |   21 ---
 hw/xen_backend.h |6 ++--
 hw/xen_common.h  |   64 +--
 hw/xen_disk.c|4 +-
 hw/xen_domainbuild.c |3 +-
 6 files changed, 133 insertions(+), 32 deletions(-)
 
 diff --git a/configure b/configure
 index 3036faf..a84d974 100755
 --- a/configure
 +++ b/configure
 @@ -126,6 +126,7 @@ vnc_jpeg=
 vnc_png=
 vnc_thread=no
 xen=
 +xen_ctrl_version=
 linux_aio=
 attr=
 vhost_net=
 @@ -1147,20 +1148,81 @@ fi
 
 if test $xen != no ; then
   xen_libs=-lxenstore -lxenctrl -lxenguest
 +
 +  # Xen unstable
   cat  $TMPC EOF
 #include xenctrl.h
 #include xs.h
 -int main(void) { xs_daemon_open(); xc_interface_open(); return 0; }
 +#include stdint.h
 +#include xen/hvm/hvm_info_table.h
 +#if !defined(HVM_MAX_VCPUS)
 +# error HVM_MAX_VCPUS not defined
 +#endif
 +int main(void) {
 +  xc_interface *xc;
 +  xs_daemon_open();
 +  xc = xc_interface_open(0, 0, 0);
 +  xc_hvm_set_mem_type(0, 0, HVMMEM_ram_ro, 0, 0);
 +  xc_gnttab_open(NULL, 0);
 +  return 0;
 +}
 EOF
   if compile_prog  $xen_libs ; then
 +xen_ctrl_version=410
 xen=yes
 -libs_softmmu=$xen_libs $libs_softmmu
 +
 +  # Xen 4.0.0
 +  elif (
 +  cat  $TMPC EOF
 +#include xenctrl.h
 +#include xs.h
 +#include stdint.h
 +#include xen/hvm/hvm_info_table.h
 +#if !defined(HVM_MAX_VCPUS)
 +# error HVM_MAX_VCPUS not defined
 +#endif
 +int main(void) {
 +  xs_daemon_open();
 +  xc_interface_open();
 +  xc_gnttab_open();
 +  xc_hvm_set_mem_type(0, 0, HVMMEM_ram_ro, 0, 0);
 +  return 0;
 +}
 +EOF
 +  compile_prog  $xen_libs
 +) ; then
 +xen_ctrl_version=400
 +xen=yes
 +
 +  # Xen 3.3.0, 3.4.0
 +  elif (
 +  cat  $TMPC EOF
 +#include xenctrl.h
 +#include xs.h
 +int main(void) {
 +  xs_daemon_open();
 +  xc_interface_open();
 +  xc_gnttab_open();
 +  xc_hvm_set_mem_type(0, 0, HVMMEM_ram_ro, 0, 0);
 +  return 0;
 +}
 +EOF
 +  compile_prog  $xen_libs
 +) ; then
 +xen_ctrl_version=330
 +xen=yes
 +
 +  # Xen not found or unsupported
   else
 if test $xen = yes ; then
   feature_not_found xen
 fi
 xen=no
   fi
 +
 +  if test $xen = yes; then
 +libs_softmmu=$xen_libs $libs_softmmu
 +  fi
 fi
 
 ##
 @@ -2755,6 +2817,7 @@ if test $bluez = yes ; then
 fi
 if test $xen = yes ; then
   echo CONFIG_XEN=y  $config_host_mak
 +  echo CONFIG_XEN_CTRL_INTERFACE_VERSION=$xen_ctrl_version  
 $config_host_mak
 fi
 if test $io_thread = yes ; then
   echo CONFIG_IOTHREAD=y  $config_host_mak
 diff --git a/hw/xen_backend.c b/hw/xen_backend.c
 index 9f4ec4b..3907b83 100644
 --- a/hw/xen_backend.c
 +++ b/hw/xen_backend.c
 @@ -43,7 +43,8 @@
 /* - */
 
 /* public */
 -int xen_xc;
 +XenXC xen_xc = XC_HANDLER_INITIAL_VALUE;
 +XenGnttab xen_xcg = XC_HANDLER_INITIAL_VALUE;
 struct xs_handle *xenstore = NULL;
 const char *xen_protocol;
 
 @@ -214,8 +215,8 @@ static struct XenDevice *xen_be_get_xendev(const char 
 *type, int dom, int dev,
 xendev-debug  = debug;
 xendev-local_port = -1;
 
 -xendev-evtchndev = xc_evtchn_open();
 -if (xendev-evtchndev  0) {
 +xendev-evtchndev = xc_evtchn_open(NULL, 0);
 +if (xendev-evtchndev == XC_HANDLER_INITIAL_VALUE) {
 xen_be_printf(NULL, 0, can't open evtchn device\n);
 qemu_free(xendev);
 return NULL;
 @@ -223,15 +224,15 @@ static struct XenDevice *xen_be_get_xendev(const char 
 *type, int dom, int dev,
 fcntl(xc_evtchn_fd(xendev-evtchndev), F_SETFD, FD_CLOEXEC);
 
 if (ops-flags  DEVOPS_FLAG_NEED_GNTDEV) {
 -xendev-gnttabdev = xc_gnttab_open();
 -if (xendev-gnttabdev  0) {
 +xendev-gnttabdev = xc_gnttab_open(NULL, 0);
 +if (xendev-gnttabdev == XC_HANDLER_INITIAL_VALUE) {
 xen_be_printf(NULL, 0, can't open gnttab device\n);
 xc_evtchn_close(xendev-evtchndev);
 qemu_free(xendev);
 return NULL;
 }
 } else {
 -xendev-gnttabdev = -1;
 +xendev-gnttabdev = XC_HANDLER_INITIAL_VALUE;
 }
 
 QTAILQ_INSERT_TAIL(xendevs, xendev, next);
 @@ -277,10 +278,10 @@ static struct XenDevice *xen_be_del_xendev(int dom, int 
 dev)
 qemu_free(xendev-fe);
 }
 
 -if (xendev-evtchndev = 0) {
 +if (xendev-evtchndev != 

Re: [Qemu-devel] [PATCH V11 02/15] xen: Make Xen build once.

[Alexander Graf]

On 01.03.2011, at 19:35, anthony.per...@citrix.com wrote:

 From: Anthony PERARD anthony.per...@citrix.com
 
 xen_domainbuild is now build in libhw. And xen_machine_pv is build only
 for i386 targets.
 
 Signed-off-by: Anthony PERARD anthony.per...@citrix.com
 ---
 Makefile.objs|3 +++
 Makefile.target  |2 +-
 hw/xen_domainbuild.c |   10 +-
 hw/xen_domainbuild.h |5 +++--
 hw/xen_machine_pv.c  |2 +-
 5 files changed, 13 insertions(+), 9 deletions(-)
 
 diff --git a/Makefile.objs b/Makefile.objs
 index 9e98a66..8034115 100644
 --- a/Makefile.objs
 +++ b/Makefile.objs
 @@ -269,6 +269,9 @@ hw-obj-$(CONFIG_DP8393X) += dp8393x.o
 hw-obj-$(CONFIG_DS1225Y) += ds1225y.o
 hw-obj-$(CONFIG_MIPSNET) += mipsnet.o
 
 +# Xen
 +hw-obj-$(CONFIG_XEN) += xen_domainbuild.o

Why is this in generic code? Xen is x86 only and really should stay that way 
IMHO.

 +
 # Sound
 sound-obj-y =
 sound-obj-$(CONFIG_SB16) += sb16.o
 diff --git a/Makefile.target b/Makefile.target
 index 220589e..ab0a570 100644
 --- a/Makefile.target
 +++ b/Makefile.target
 @@ -206,7 +206,7 @@ QEMU_CFLAGS += $(VNC_JPEG_CFLAGS)
 QEMU_CFLAGS += $(VNC_PNG_CFLAGS)
 
 # xen backend driver support
 -obj-$(CONFIG_XEN) += xen_machine_pv.o xen_domainbuild.o
 +obj-i386-$(CONFIG_XEN) += xen_machine_pv.o
 
 # Inter-VM PCI shared memory
 obj-$(CONFIG_KVM) += ivshmem.o
 diff --git a/hw/xen_domainbuild.c b/hw/xen_domainbuild.c
 index 7f1fd66..b73d47f 100644
 --- a/hw/xen_domainbuild.c
 +++ b/hw/xen_domainbuild.c
 @@ -1,9 +1,9 @@
 #include signal.h
 -#include xen_backend.h
 -#include xen_domainbuild.h
 #include sysemu.h
 #include qemu-timer.h
 #include qemu-log.h
 +#include xen_backend.h
 +#include xen_domainbuild.h
 
 #include xenguest.h
 
 @@ -49,7 +49,7 @@ static int xenstore_domain_mkdir(char *path)
 }
 
 int xenstore_domain_init1(const char *kernel, const char *ramdisk,
 -  const char *cmdline)
 +  const char *cmdline, ram_addr_t ram_size)

Isn't ram_size a global anyways? What's the rationale behind moving it to a 
parameter? Not saying I'm against it, just missed the reasoning here :)


Alex

[Qemu-devel] [Bug 740895] [NEW] qemu freeze when loading msdos with EMM386.EXE NOEMS HIGHSCAN

[Guillaume Robin]

Public bug reported:

Qemu version used : 0.11.2 and 0.14.0
Guest : Ms-Dos 6.2
Host : Ubuntu 10.04 with 2.6.32-29-generic SMP i686
Starting Qemu with command : qemu -hda dos.img -cpu 486 -m 16

When I start msDos under Qemu with the option (in CONFIG.SYS) 
DEVICE=C:\DOS\EMM386.EXE NOEMS HIGHSCAN
the guest freeze.
If I remove HIGHSCAN system is booting (but my software is not working).

The whole thing is working on a real computer with a 486 with 16Mb ram
or a PII.

HIGHSCAN switch allows EMM386.EXE to map expanded memory pages or upper
memory blocks (UMBs) over portions of the upper memory area (UMA) used
by system read-only memory  from http://support.microsoft.com/kb/96522
/en-us

I add some traces inside default_ioport_read in ioport.c, but I don't
see any access to F000h-F7FFh like said in ms help.

Before the system hung, there is access to dma1, dma page register and
dma2 :

inb : 0087 00
outb: 000c 00
inb :  00
inb :  00
inb : 0001 00
inb : 0001 00
inb : 0083 00
outb: 000c 00
inb : 0002 00
inb : 0002 00
inb : 0003 00
inb : 0003 00
inb : 0081 00
outb: 000c 00
inb : 0004 00
inb : 0004 00
inb : 0005 00
inb : 0005 00
inb : 0082 00
outb: 000c 00
inb : 0006 00
inb : 0006 00
inb : 0007 00
inb : 0007 00
inb : 008b 00
outb: 00d8 00
inb : 00c4 00
inb : 00c4 00
inb : 00c6 00
inb : 00c6 00
inb : 0089 00
outb: 00d8 00
inb : 00c8 00
inb : 00c8 00
inb : 00ca 00
inb : 00ca 00
inb : 008a 00
outb: 00d8 00
inb : 00cc 00
inb : 00cc 00
inb : 00ce 00
inb : 00ce 00
outb: 000c 00
outb: 00d8 00

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/740895

Title:
  qemu freeze when loading msdos with EMM386.EXE NOEMS HIGHSCAN

Status in QEMU:
  New

Bug description:
  Qemu version used : 0.11.2 and 0.14.0
  Guest : Ms-Dos 6.2
  Host : Ubuntu 10.04 with 2.6.32-29-generic SMP i686
  Starting Qemu with command : qemu -hda dos.img -cpu 486 -m 16

  When I start msDos under Qemu with the option (in CONFIG.SYS) 
  DEVICE=C:\DOS\EMM386.EXE NOEMS HIGHSCAN
  the guest freeze.
  If I remove HIGHSCAN system is booting (but my software is not working).

  The whole thing is working on a real computer with a 486 with 16Mb ram
  or a PII.

  HIGHSCAN switch allows EMM386.EXE to map expanded memory pages or
  upper memory blocks (UMBs) over portions of the upper memory area
  (UMA) used by system read-only memory  from
  http://support.microsoft.com/kb/96522/en-us

  I add some traces inside default_ioport_read in ioport.c, but I
  don't see any access to F000h-F7FFh like said in ms help.

  Before the system hung, there is access to dma1, dma page register and
  dma2 :

  inb : 0087 00
  outb: 000c 00
  inb :  00
  inb :  00
  inb : 0001 00
  inb : 0001 00
  inb : 0083 00
  outb: 000c 00
  inb : 0002 00
  inb : 0002 00
  inb : 0003 00
  inb : 0003 00
  inb : 0081 00
  outb: 000c 00
  inb : 0004 00
  inb : 0004 00
  inb : 0005 00
  inb : 0005 00
  inb : 0082 00
  outb: 000c 00
  inb : 0006 00
  inb : 0006 00
  inb : 0007 00
  inb : 0007 00
  inb : 008b 00
  outb: 00d8 00
  inb : 00c4 00
  inb : 00c4 00
  inb : 00c6 00
  inb : 00c6 00
  inb : 0089 00
  outb: 00d8 00
  inb : 00c8 00
  inb : 00c8 00
  inb : 00ca 00
  inb : 00ca 00
  inb : 008a 00
  outb: 00d8 00
  inb : 00cc 00
  inb : 00cc 00
  inb : 00ce 00
  inb : 00ce 00
  outb: 000c 00
  outb: 00d8 00

Re: Supsend/resume regression in c995b4 WAS: Re: [Qemu-devel] [PATCH] Fix migration uint8 arrys handled

[Yoshiaki Tamura]

2011/3/23 Avi Kivity a...@redhat.com:
 On 03/22/2011 03:26 PM, Anthony Liguori wrote:

 Here's how I propose we tackle this.  This patch adds a -dump-savevm
 option that takes a version.  It spits out all of the fields we save for a
 particular version (well, not really, but it should).  We also can add type
 information.  The idea is that we'd write a simple test case (using gtester)
 that ran through and dumped the schema for each version.  We'd store the
 schema's in the tree and the test can compare old schema's to the current
 schema to check for failure.


 Instead of generating the schema and comparing, what about the other way
 round?  Write vmstate in a formal schema, and generate the code at runtime.

I agree :)

Yoshi


 --
 error compiling committee.c: too many arguments to function

Re: [Qemu-devel] [PATCH v2 0/3] Allow ipv6 for migration

[Amit Shah]

On (Fri) 18 Mar 2011 [14:22:47], Juan Quintela wrote:
 Hi
 
 
 v2:
 - create socket_set_reuseaddr() to have it different for
   Windows and everything else (Peter Maydell)
 - use strerror() instead of perror (Peter Maydell)
 - fprintf(): one of them removed, the other one ...
   it is complicated, would have to return two errors: getaddrinfo one
   and normal errno.  Not feasible IMHO until we integrate all other users
   of getaddrinfo() and think of a nice API.
 
 v1.
 
 1st patch moves migration to use getaddrinfo() instead of parse_host_port().
 This allows us to use ipv6 addresses.  As an extra bonus, now we can use
 names from /etc/services.
 
 Code for net_socket_listen_init() and net_socket_connect_init() was
 almost identical to migration one, so also changed that ones.
 The difference were small based on how error codes were handled.
 After discussing with Anthony, it appears that the right ones are
 the migration ones.
 
 Tested (the migration code) with:
 - tcp:foo: ipv4 name
 - tcp:foo6: ipv6 name
 - tcp:0:
 - tcp:foo6:iqobject (this was an unused entry on my machine /etc/services)
iqobject48619/tcp   # iqobject
 - tcp::: let the kernel make a choice
 
 Please review.

ACK series.

A couple of whitespace issues; if you're fixing that, you can add my
acked-by to the git log.

Amit

Re: [Qemu-devel] [PATCH 1/3] create socket_set_reuseaddr()

[Amit Shah]

On (Fri) 18 Mar 2011 [14:22:48], Juan Quintela wrote:
 Windows is different than unix, SO_REUSEADDR is the default value
 there.  Create one function to do it and change all callers.
 
 Signed-off-by: Juan Quintela quint...@redhat.com
 ---
  gdbstub.c  |6 ++
  migration-tcp.c|4 +---
  nbd.c  |5 +
  net/socket.c   |   13 -
  os-posix.c |1 +

Nitpick: this addition in os-posix is a newline, can be dropped.

Amit

Re: [Qemu-devel] [PATCH 2/3] Use getaddrinfo for migration

[Amit Shah]

On (Fri) 18 Mar 2011 [14:22:49], Juan Quintela wrote:
 This allows us to use ipv4/ipv6 for migration addresses.
 Once there, it also uses /etc/services names (it came free).
 
 Signed-off-by: Juan Quintela quint...@redhat.com
 ---
  migration-tcp.c |   51 +++
  net.c   |  106 
 +++
  qemu_socket.h   |3 ++
  3 files changed, 122 insertions(+), 38 deletions(-)
 
 diff --git a/migration-tcp.c b/migration-tcp.c
 index 2340b55..2fa496a 100644
 --- a/migration-tcp.c
 +++ b/migration-tcp.c
 @@ -48,8 +48,6 @@ static int tcp_close(FdMigrationState *s)
  }
  return 0;
  }
 -
 -
  static void tcp_wait_for_connect(void *opaque)

Another nitpick: one newline should be kept.

Amit

Re: [Qemu-devel] [PATCH V11 06/15] xen: Add the Xen platform pci device

[Alexander Graf]

On 01.03.2011, at 19:35, anthony.per...@citrix.com wrote:

 From: Steven Smith ssm...@xensource.com
 
 Introduce a new emulated PCI device, specific to fully virtualized Xen
 guests.  The device is necessary for PV on HVM drivers to work.
 
 Signed-off-by: Steven Smith ssm...@xensource.com
 Signed-off-by: Anthony PERARD anthony.per...@citrix.com
 Signed-off-by: Stefano Stabellini stefano.stabell...@eu.citrix.com
 ---
 Makefile.target   |2 +
 hw/hw.h   |3 +
 hw/pc_piix.c  |4 +
 hw/pci_ids.h  |2 +
 hw/xen.h  |2 +
 hw/xen_platform.c |  349 +
 trace-events  |3 +
 xen-stub.c|4 +
 8 files changed, 369 insertions(+), 0 deletions(-)
 create mode 100644 hw/xen_platform.c
 
 diff --git a/Makefile.target b/Makefile.target
 index b08c7f7..c539b1e 100644
 --- a/Makefile.target
 +++ b/Makefile.target
 @@ -217,6 +217,8 @@ endif
 obj-i386-$(CONFIG_XEN) += xen-all.o
 obj-$(CONFIG_NO_XEN) += xen-stub.o
 
 +obj-i386-$(CONFIG_XEN) += xen_platform.o
 +
 # Inter-VM PCI shared memory
 obj-$(CONFIG_KVM) += ivshmem.o
 
 diff --git a/hw/hw.h b/hw/hw.h
 index 5e24329..c285b2e 100644
 --- a/hw/hw.h
 +++ b/hw/hw.h
 @@ -682,6 +682,9 @@ extern const VMStateDescription vmstate_usb_device;
 #define VMSTATE_INT32_LE(_f, _s)   \
 VMSTATE_SINGLE(_f, _s, 0, vmstate_info_int32_le, int32_t)
 
 +#define VMSTATE_UINT8_TEST(_f, _s, _t)   \
 +VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_info_uint8, uint8_t)
 +
 #define VMSTATE_UINT16_TEST(_f, _s, _t)   \
 VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_info_uint16, uint16_t)
 
 diff --git a/hw/pc_piix.c b/hw/pc_piix.c
 index 6eff06e..417c456 100644
 --- a/hw/pc_piix.c
 +++ b/hw/pc_piix.c
 @@ -121,6 +121,10 @@ static void pc_init1(ram_addr_t ram_size,
 
 pc_vga_init(pci_enabled? pci_bus: NULL);
 
 +if (xen_enabled()) {
 +pci_xen_platform_init(pci_bus);

It probably makes sense to fold that function in here. That way you wouldn't 
need the entry in the stub file.


Alex

Re: Supsend/resume regression in c995b4 WAS: Re: [Qemu-devel] [PATCH] Fix migration uint8 arrys handled

[Anthony Liguori]

On 03/23/2011 04:10 AM, Avi Kivity wrote:

On 03/22/2011 03:26 PM, Anthony Liguori wrote:


Here's how I propose we tackle this.  This patch adds a -dump-savevm 
option that takes a version.  It spits out all of the fields we save 
for a particular version (well, not really, but it should).  We also 
can add type information.  The idea is that we'd write a simple test 
case (using gtester) that ran through and dumped the schema for each 
version.  We'd store the schema's in the tree and the test can 
compare old schema's to the current schema to check for failure.




Instead of generating the schema and comparing, what about the other 
way round?  Write vmstate in a formal schema, and generate the code at 
runtime.


This is exactly where I want to go in the future.

Regards,

Anthony Liguori

Re: [Qemu-devel] Re: [PATCH 04/11] sb16: fix migration quirk

[Anthony Liguori]

On 03/23/2011 04:51 AM, Juan Quintela wrote:

Anthony Liguorialigu...@us.ibm.com  wrote:

We seem to migrate the same field twice.  It's been this way since Fabrice
committed the original file.  Since semantically, we basically ignore the first
value, make this an unused entry.

Signed-off-by: Anthony Liguorialigu...@us.ibm.com
---
  hw/sb16.c |3 ++-
  1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/hw/sb16.c b/hw/sb16.c
index c98546a..1c30e4c 100644
--- a/hw/sb16.c
+++ b/hw/sb16.c
@@ -77,6 +77,7 @@ typedef struct SB16State {

  int v2x6;

+uint8_t csp_param_dummy;
  uint8_t csp_param;
  uint8_t csp_value;
  uint8_t csp_mode;
@@ -1313,7 +1314,7 @@ static const VMStateDescription vmstate_sb16 = {
  VMSTATE_INT32(can_write, SB16State),
  VMSTATE_INT32(v2x6, SB16State),

-VMSTATE_UINT8(csp_param, SB16State),
+VMSTATE_UINT8(csp_param_dummy, SB16State),
  VMSTATE_UINT8(csp_value, SB16State),
  VMSTATE_UINT8(csp_mode, SB16State),
  VMSTATE_UINT8(csp_param, SB16State),

VMSTATE_UNUSED(1) instead?


Ack.  I forgot to update this patch to do that.

Regards,

Anthony Liguori


Later, Juan.

[Qemu-devel] Re: [PULL (resend, rebase) 1/5] virtio-serial: Use a struct to pass config information from proxy

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 Instead of using a single variable to pass to the virtio_serial_init
 function, use a struct so that expanding the number of variables to be
 passed on later is easier.

 Signed-off-by: Amit Shah amit.s...@redhat.com

Reviewed-by: Juan Quintela quint...@redhat.com

[Qemu-devel] Re: [PULL (resend, rebase) 2/5] virtio-serial: Disallow generic ports at id 0

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 On (Thu) 10 Mar 2011 [11:39:16], Amit Shah wrote:
 Port 0 is reserved for virtconsole devices for backward compatibility
 with the old -virtioconsole (from qemu 0.12) device type.
 
 libvirt prior to commit 8e28c5d40200b4c5d483bd585d237b9d870372e5 used
 port 0 for generic ports.  libvirt will no longer do that, but disallow
 instantiating generic ports at id 0 from qemu as well.
 
 Signed-off-by: Amit Shah amit.s...@redhat.com

 Updated patch below, fixes a build break after rebase.  The git tree
 in the pull request has been updated with this fix.

Reviewed-by: Juan Quintela quint...@redhat.com

[Qemu-devel] Re: [PULL (resend, rebase) 3/5] virtio-serial: Enable ioeventfd

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 Enable ioeventfd for virtio-serial devices by default.  Commit
 25db9ebe15125deb32958c6df74996f745edf1f9 lists the benefits of using
 ioeventfd.

 Copying a file from guest to host over a virtio-serial channel didn't
 show much difference in time or io_exit rate.

 Signed-off-by: Amit Shah amit.s...@redhat.com
 ---
  hw/virtio-pci.c |3 +++
  1 files changed, 3 insertions(+), 0 deletions(-)


Revieved-by: Juan Quintela quint...@redhat.com

Re: [Qemu-devel] [PATCH 02/11] vmstate: register all VMStateDescriptions

[Peter Maydell]

On 23 March 2011 00:16, Anthony Liguori aligu...@us.ibm.com wrote:
 This is a purely mechanical change.

 +/* Register the VMState Description to support VMState introspection */
 +static void init_vmstate_description_0(void)
 +{
 +    register_vmstate_description(vmstate_ac97);
 +}
 +
 +vmstate_init(init_vmstate_description_0);
 +

 +/* Register the VMState Description to support VMState introspection */
 +static void init_vmstate_description_0(void)
 +{
 +    register_vmstate_description(vmstate_acpi);
 +}
 +
 +vmstate_init(init_vmstate_description_0);
 +

Do we really need five lines of boilerplate for every device?

(I'm wondering if there's some way you could avoid having
all this for the common case where the vmstate is pointed to
by the DeviceInfo struct, given that we already register
all the devices. Failing that, some sort of macro...)

-- PMM

Re: [Qemu-devel] Re: [PATCH 07/11] eeprom93xx: Use the new hack macro to avoid duplicate field names

[Anthony Liguori]

On 03/23/2011 04:58 AM, Juan Quintela wrote:

Anthony Liguorialigu...@us.ibm.com  wrote:

I don't fully understand this hack business but we need field to be unique so..

Signed-off-by: Anthony Liguorialigu...@us.ibm.com
---
  hw/eeprom93xx.c |2 +-
  1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/eeprom93xx.c b/hw/eeprom93xx.c
index cfa695d..f1d75ec 100644
--- a/hw/eeprom93xx.c
+++ b/hw/eeprom93xx.c
@@ -114,7 +114,7 @@ static const VMStateInfo vmstate_hack_uint16_from_uint8 = {
  };

  #define VMSTATE_UINT16_HACK_TEST(_f, _s, _t)   \
-VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, 
uint16_t)
+VMSTATE_SINGLE_TEST_HACK(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, 
uint16_t)

  static bool is_old_eeprom_version(void *opaque, int version_id)
  {

After the fact, we need to promote it as full types.

Basically it is needed when we sent a field with a different size that
we use it on the struct.

if we have

struct FOOState {
int32_t bar;

}

and it is sent as

VMSTATE_INT8(bar, )

In this case, I went through the whole device, checed that int8_t was
enough and did the change.

But if we have:

struct FOOState {
int8_t bar;

}

and it is sent as

VMSTATE_INT32(bar, )

Then it is not trivial :-(

We change FOOState to int32 or we break migration format.  Here is where
the _HACK suffix appeared.

I thought it was not going to be needed a lot, but there are several
devices that just sent everything over the wire as uint32, independently
of its type.


Could we get away with just doing:

VMSTATE_UNUSED(3),
VMSTATE_UINT8(bar, ...),

That's fully compatible on the wire and seems to be a clearer expression 
of exactly what the problem is.


Regards,

Anthony Liguori


Later, Juan.

[Qemu-devel] Re: [PULL (resend, rebase) 4/5] virtio-serial-bus: Simplify handle_output() function

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 There's no code change, just re-arrangement to simplify the function
 after recent modifications.

 Reported-by: Juan Quintela quint...@redhat.com
 Signed-off-by: Amit Shah amit.s...@redhat.com

Reviewed-by:  Juan Quintela quint...@redhat.com

Re: [Qemu-devel] [PATCH 02/11] vmstate: register all VMStateDescriptions

[Anthony Liguori]

On 03/23/2011 07:30 AM, Peter Maydell wrote:

On 23 March 2011 00:16, Anthony Liguorialigu...@us.ibm.com  wrote:

This is a purely mechanical change.
+/* Register the VMState Description to support VMState introspection */
+static void init_vmstate_description_0(void)
+{
+register_vmstate_description(vmstate_ac97);
+}
+
+vmstate_init(init_vmstate_description_0);
+
+/* Register the VMState Description to support VMState introspection */
+static void init_vmstate_description_0(void)
+{
+register_vmstate_description(vmstate_acpi);
+}
+
+vmstate_init(init_vmstate_description_0);
+

Do we really need five lines of boilerplate for every device?

(I'm wondering if there's some way you could avoid having
all this for the common case where the vmstate is pointed to
by the DeviceInfo struct, given that we already register
all the devices. Failing that, some sort of macro...)


Heh, well that just goes right and head and tremendously simplifies 
everything :-)


There are just a few cases where VMStateDescription is not reachable via 
DeviceInfo so DeviceInfo is definitely the way to go.


Regards,

Anthony Liguori


-- PMM

Re: [Qemu-devel] OVMF, SeaBIOS non-CSM based legacy boot

[Gleb Natapov]

On Tue, Mar 22, 2011 at 02:53:16PM -0700, Jordan Justen wrote:
 2011/3/22 Gleb Natapov g...@redhat.com:
  On Tue, Mar 22, 2011 at 12:28:51PM -0700, Jordan Justen wrote:
  Can this cover a full path like this?
  /pci@i0cf8/ide@1,1/drive@1/disk@0 = partition0 = /path/abc.efi
 
  Open Firmware have syntax for that. 
  /pci@i0cf8/ide@1,1/drive@1/disk@0:0,/path/abc.efi
  But QEMU has no way to know how to specify those additional
  parameters. With legacy BIOS each HD has only one boot method.
 
 It is just a matter of figuring out what to send to the firmware then?
 
Well yes. But it is not as easy as it sounds.

 To support a boot override for UEFI, this full path would be needed.
 For the purposes of a UEFI boot override, could the user could provide
 the partition  path info?
 
How the user knows what to provide. In most cases this user will be
management anyway. So the use case is like this: new HD is connected
to a VM and user wants to boot whatever is installed there. With legacy
boot this is the matter of running MBR code, with UEFI user need to boot
something else and browse file system hierarchy to find magic file to
boot from? Sound like step backward even from legacy bios :) Is the some
notion of default boot in UEFI.

  (Where can I learn more about bootindex?)
  It is a device property which is used to set boot priority for a device.
  For each device that have this property set QEMU generates device path
  and pass it into a firmware along with its boot priority.
 
 How does this get passed to the firmware?  I'd like to investigate how
 to support it in OVMF.
 
It is passed using simple ISA device. Look at src/paravirt.c in Seabios source 
code.
The device emulation itself is in hw/fw_cfg.c in QEMU source tree.

  I agree, but the mapping is not 100% right now.  '-boot c' does not
  quite make sense for UEFI, for example.  For floppies or CD's there is
  the concept of a default path: /efi/boot/bootia32.efi or
  /efi/boot/bootx64.efi, but this doesn't apply to hard disks, and you
  need to know the path to the image to load off that hard disk.
  Looks like UEFI tries to be second stage boot loader too.
 
 I don't know that it matters what you call it (second stage loader?
 perhaps...).  One (arguable) issue with legacy boot process is that
 some 'magic' code must exist in the MBR. 
Legacy boot process has many issues but I wouldn't call MBR one of them.
But lest not argue about that. I doubt we will be able to change UEFI now :)

   UEFI has a spec'd image
 format, and rather than rely on MBR code, we store a path to the boot
 image in a variable.
With legacy boot, given hard drive firmware knows how to boot from it.
HD is self contained. No need out of band channel to inform firmware
how to boot from the HD.

 
 In UEFI terminology the OS loader is the image pointed at by the boot
 variable.  Loading and executing that image is the UEFI equivalent of
 loading the MBR and jumping to it.
 
So no much difference except that MBR is actually better because it is
in the knows location? Why not store default boot path in MBR if it is
unused now anyway (we have no much space there, but should be enough for
reasonable paths)?

  Given device
  path that points to HD can OVMF scan it for common locations where OSes
  usually install .efi files and boot the first one it finds?
 
 This sounds like a tough to maintain solution.  For boot overrides,
 maybe the user can specify the path.
User shouldn't know or care. He should be able to download raw disk
image from internet and run it with qemu -hda image.raw and boot into
whatever installed there if the image is bootable. It sounds like UEFI
can't support such usage scenario! And I am not even talk about boot
overrides in the above scenario.

 
 For the non-boot override case, we should add support for
 nv-variables, and use the path that the OS sets.
That makes VM usage much less flexible then it is today. Disk images are
not self contained any more. I have tens of images that I run inside
different VMs from different hosts all of the time. It is unreasonable
to expect that I will track additional images with nv-variables needed
to boot from them.

 
  Also, could QEMU support one mode where the boot device is specified,
  and the firmware would know that an override was provided for the boot
  path, and another mode where it is not specified, and we can look at
  the boot variables?
 
  That what QEMU does today. It either supplies boot order information or
  leaves it to firmware to decide where to boot from, or tells firmware to
  present user with boot menu.
 
 Sounds good.  Can you point me at documentation for how this is passed
 to the firmware?
 
No documentation, but it is very simple interface. See source code I
pointed to above. Ah and bootindex actually has a little bit of
documentation in qemu/docs/bootindex.txt

--
Gleb.

Re: [Qemu-devel] [PATCH V11 09/15] xen: Introduce the Xen mapcache

[Alexander Graf]

On 01.03.2011, at 19:35, anthony.per...@citrix.com wrote:

 From: Jun Nakajima jun.nakaj...@intel.com
 
 On IA32 host or IA32 PAE host, at present, generally, we can't create
 an HVM guest with more than 2G memory, because generally it's almost
 impossible for Qemu to find a large enough and consecutive virtual
 address space to map an HVM guest's whole physical address space.
 The attached patch fixes this issue using dynamic mapping based on
 little blocks of memory.
 
 Each call to qemu_get_ram_ptr makes a call to qemu_map_cache with the
 lock option, so mapcache will not unmap these ram_ptr.
 
 Signed-off-by: Jun Nakajima jun.nakaj...@intel.com
 Signed-off-by: Anthony PERARD anthony.per...@citrix.com
 Signed-off-by: Stefano Stabellini stefano.stabell...@eu.citrix.com
 ---
 Makefile.target |3 +
 configure   |3 +
 exec.c  |   40 ++-
 hw/xen.h|   13 ++
 hw/xen_common.h |9 ++
 xen-all.c   |   64 +++
 xen-mapcache-stub.c |   40 +++
 xen-mapcache.c  |  310 +++
 xen-mapcache.h  |   22 
 xen-stub.c  |4 +
 10 files changed, 504 insertions(+), 4 deletions(-)
 create mode 100644 xen-mapcache-stub.c
 create mode 100644 xen-mapcache.c
 create mode 100644 xen-mapcache.h
 
 diff --git a/Makefile.target b/Makefile.target
 index c539b1e..dcdd51d 100644
 --- a/Makefile.target
 +++ b/Makefile.target
 @@ -214,8 +214,11 @@ else
 CONFIG_NO_XEN = y
 endif
 # xen support
 +CONFIG_NO_XEN_MAPCACHE = $(if $(subst n,,$(CONFIG_XEN_MAPCACHE)),n,y)
 obj-i386-$(CONFIG_XEN) += xen-all.o
 obj-$(CONFIG_NO_XEN) += xen-stub.o
 +obj-i386-$(CONFIG_XEN_MAPCACHE) += xen-mapcache.o
 +obj-$(CONFIG_NO_XEN_MAPCACHE) += xen-mapcache-stub.o
 
 obj-i386-$(CONFIG_XEN) += xen_platform.o
 
 diff --git a/configure b/configure
 index a84d974..4fd8696 100755
 --- a/configure
 +++ b/configure
 @@ -3172,6 +3172,9 @@ case $target_arch2 in
   i386|x86_64)
 if test $xen = yes -a $target_softmmu = yes ; then
   echo CONFIG_XEN=y  $config_target_mak
 +  if test $cpu = i386 -o $cpu = x86_64; then
 +  echo CONFIG_XEN_MAPCACHE=y  $config_target_mak
 +  fi
 fi
 esac
 case $target_arch2 in
 diff --git a/exec.c b/exec.c
 index d611100..558595a 100644
 --- a/exec.c
 +++ b/exec.c
 @@ -32,6 +32,7 @@
 #include hw/qdev.h
 #include osdep.h
 #include kvm.h
 +#include hw/xen.h
 #include qemu-timer.h
 #if defined(CONFIG_USER_ONLY)
 #include qemu.h
 @@ -51,6 +52,8 @@
 #include libutil.h
 #endif
 #endif
 +#else /* !CONFIG_USER_ONLY */
 +#include xen-mapcache.h
 #endif
 
 //#define DEBUG_TB_INVALIDATE
 @@ -2865,6 +2868,7 @@ ram_addr_t qemu_ram_alloc_from_ptr(DeviceState *dev, 
 const char *name,
 }
 }
 
 +new_block-offset = find_ram_offset(size);
 if (host) {
 new_block-host = host;
 } else {
 @@ -2886,13 +2890,15 @@ ram_addr_t qemu_ram_alloc_from_ptr(DeviceState *dev, 
 const char *name,
PROT_EXEC|PROT_READ|PROT_WRITE,
MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 #else
 -new_block-host = qemu_vmalloc(size);
 +if (xen_mapcache_enabled()) {
 +xen_ram_alloc(new_block-offset, size);
 +} else {
 +new_block-host = qemu_vmalloc(size);
 +}
 #endif
 qemu_madvise(new_block-host, size, QEMU_MADV_MERGEABLE);
 }
 }
 -
 -new_block-offset = find_ram_offset(size);
 new_block-length = size;
 
 QLIST_INSERT_HEAD(ram_list.blocks, new_block, next);
 @@ -2933,7 +2939,11 @@ void qemu_ram_free(ram_addr_t addr)
 #if defined(TARGET_S390X)  defined(CONFIG_KVM)
 munmap(block-host, block-length);
 #else
 -qemu_vfree(block-host);
 +if (xen_mapcache_enabled()) {
 +qemu_invalidate_entry(block-host);
 +} else {
 +qemu_vfree(block-host);
 +}
 #endif
 }
 qemu_free(block);
 @@ -2959,6 +2969,15 @@ void *qemu_get_ram_ptr(ram_addr_t addr)
 if (addr - block-offset  block-length) {
 QLIST_REMOVE(block, next);
 QLIST_INSERT_HEAD(ram_list.blocks, block, next);
 +if (xen_mapcache_enabled()) {
 +/* We need to check if the requested address is in the RAM
 + * because we don't want to map the entire memory in QEMU.
 + */
 +if (block-offset == 0) {
 +return qemu_map_cache(addr, 0, 1);
 +}
 +block-host = qemu_map_cache(block-offset, block-length, 
 1);
 +}
 return block-host + (addr - block-offset);
 }
 }
 @@ -2994,11 +3013,21 @@ int qemu_ram_addr_from_host(void *ptr, ram_addr_t 
 *ram_addr)
 uint8_t *host = ptr;
 
 QLIST_FOREACH(block, ram_list.blocks, next) {
 +/* This case append when the 

Re: [Qemu-devel] [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Anthony Liguori]

On 03/23/2011 05:22 AM, Peter Maydell wrote:

On 23 March 2011 00:16, Anthony Liguorialigu...@us.ibm.com  wrote:

+if (old_version != new_version) {
+g_error(Version %d of device `%s' is available in QEMU, but schema still 
reports %d, please update schema.\n,
+new_version, device, old_version);
+}

Might be nice for these please update error messages to
include a pointer to a docs file explaining in more detail
how to do that?
(also80 char line ;-))


Ack.


diff --git a/vmstate/schema.json b/vmstate/schema.json
new file mode 100644
index 000..23483ab
--- /dev/null
+++ b/vmstate/schema.json
@@ -0,0 +1,1176 @@
+{
+cpu: {
+mcg_cap: uint64,
+a20_mask: int32,
+tsc_offset: uint64,

This schema file appears to be board-specific (or at least
x86-specific) -- shouldn't the cpu/board/whatever name
be in the filename, so we have scope to expand the test
to checking migration issues for other platforms too?


It's not really.  Every VMStateDescription that is builtin into the tree 
is in the file.


That said, the only target where the CPU is currently described by 
VMStateDescription is target-i386.


Right now the file is generated via i386-softmmu.  There may be a few 
devices left out because they are either not compiled into i386-softmmu 
or are target specific.


We could complicate things further by trying to run against every target 
and then building a union of all target outputs but I'm not sure it's 
worth the effort at this stage.



(I don't care much about ARM migration breakages just at the
moment but I suspect that it will be becoming more important
by this time next year...)

Also since this looks like an autogenerated file that's going
to be going into version control maybe it should have a
comment header at the top of the autogenerated, do not edit
by hand! type.


JSON doesn't support comments..  I can add comment parsing to our parser 
though.


Regards,

Anthony Liguori


-- PMM

Re: [Qemu-devel] [PATCH V11 13/15] xen: Initialize event channels and io rings

[Alexander Graf]

On 01.03.2011, at 19:35, anthony.per...@citrix.com wrote:

 From: Arun Sharma arun.sha...@intel.com
 
 Open and bind event channels; map ioreq and buffered ioreq rings.
 
 Signed-off-by: Arun Sharma arun.sha...@intel.com
 Signed-off-by: Anthony PERARD anthony.per...@citrix.com
 Signed-off-by: Stefano Stabellini stefano.stabell...@eu.citrix.com
 Acked-by: Alexander Graf ag...@suse.de
 ---
 hw/xen_common.h |2 +
 xen-all.c   |  411 +++
 2 files changed, 413 insertions(+), 0 deletions(-)
 
 diff --git a/hw/xen_common.h b/hw/xen_common.h
 index 5a36642..a5fc74b 100644
 --- a/hw/xen_common.h
 +++ b/hw/xen_common.h
 @@ -76,4 +76,6 @@ static inline int xc_fd(xc_interface *xen_xc)
 }
 #endif
 
 +void destroy_hvm_domain(void);
 +
 #endif /* QEMU_HW_XEN_COMMON_H */
 diff --git a/xen-all.c b/xen-all.c
 index 03d1e90..f96fd7d 100644
 --- a/xen-all.c
 +++ b/xen-all.c
 @@ -6,12 +6,58 @@
  *
  */
 
 +#include sys/mman.h
 +
 #include hw/pci.h
 #include hw/xen_common.h
 #include hw/xen_backend.h
 
 #include xen-mapcache.h
 
 +#include xen/hvm/ioreq.h
 +#include xen/hvm/params.h
 +
 +//#define DEBUG_XEN
 +
 +#ifdef DEBUG_XEN
 +#define DPRINTF(fmt, ...) \
 +do { fprintf(stderr, xen:  fmt, ## __VA_ARGS__); } while (0)
 +#else
 +#define DPRINTF(fmt, ...) \
 +do { } while (0)
 +#endif
 +
 +/* Compatibility with older version */
 +#if __XEN_LATEST_INTERFACE_VERSION__  0x0003020a
 +#  define xen_vcpu_eport(shared_page, i) \
 +(shared_page-vcpu_iodata[i].vp_eport)
 +#  define xen_vcpu_ioreq(shared_page, vcpu) \
 +(shared_page-vcpu_iodata[vcpu].vp_ioreq)
 +#  define FMT_ioreq_size PRIx64
 +#else
 +#  define xen_vcpu_eport(shared_page, i) \
 +(shared_page-vcpu_ioreq[i].vp_eport)
 +#  define xen_vcpu_ioreq(shared_page, vcpu) \
 +(shared_page-vcpu_ioreq[vcpu])

Could you please change these to static inline functions?


Alex

Re: [Qemu-devel] [PATCH V11 00/15] Xen device model support

[Alexander Graf]

On 01.03.2011, at 19:35, anthony.per...@citrix.com wrote:

 From: Anthony PERARD anthony.per...@citrix.com
 
 Hi all,
 
 Here is the few change since the V10:
 
  - Add braces for blocks with single statement in the clean-up patch;
  - the patch that builds Xen only for x86 have been removed, instead,
xen_domainbuild is built with libhw and other Xen files are built for i386
target only;
  - the redirection structure with function pointer have been removed, instead,
there are few #define or static inline function use for the compatibility;
  - the platform device uses trace instead of dprintf for guest log;
  - introduce i440fx_xen_init and i440fx_common_init to avoid xen_enabled() in
piix_pci.
 

Nice series. I'm confident that V12 will go in :)


Alex

[Qemu-devel] Re: [PATCH 27/27] Add SLOF-based partition firmware for pSeries machine, allowing more boot options

[David Gibson]

On Wed, Mar 23, 2011 at 08:55:53PM +1100, Benjamin Herrenschmidt wrote:
 On Wed, 2011-03-23 at 19:51 +1100, Benjamin Herrenschmidt wrote:
  On Wed, 2011-03-23 at 16:30 +1100, David Gibson wrote:
   +- SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   +  implementation for certain IBM POWER hardware.  The image currently
   +  in qemu is built from git tag qemu-slof-20110323.
   +
  
  For those who can't wait to check it out ...
  
  David forgot to mention the actual git URL ;-)
  
  It's on github (https://github.com/dgibson/SLOF)
 
 And I just realized it wasn't actually pushed out either :-) I've just
 fixed that.

*facepalm*

Sorry.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson

Re: [Qemu-devel] [PATCH v22 06/11] libcacard: initial commit

[Alon Levy]

On Tue, Mar 22, 2011 at 03:25:11PM +, Stefan Hajnoczi wrote:
 On Mon, Mar 21, 2011 at 10:07 PM, Alon Levy al...@redhat.com wrote:
  +# check for libcacard for smartcard support
  +if test $smartcard != no ; then
  +    smartcard=yes
  +    smartcard_cflags=
  +    # TODO - what's the minimal nss version we support?
  +    if test $smartcard_nss != no; then
  +        if $pkg_config --atleast-version=3.12.8 nss /dev/null 21 ; then
  +            smartcard_nss=yes
  +            smartcard_cflags=-I\$(SRC_PATH)/libcacard
  +            libcacard_libs=$($pkg_config --libs nss 2/dev/null)
  +            libcacard_cflags=$($pkg_config --cflags nss 2/dev/null)
  +            QEMU_CFLAGS=$QEMU_CFLAGS $smartcard_cflags $libcacard_cflags
  +            LIBS=$libcacard_libs $LIBS
  +        else
  +            if test $smartcard_nss == yes; then
  +                feature_not_found nss
  +            fi
  +            smartcard_nss=no
  +        fi
  +    fi
  +fi
  +if test $smartcard == no ; then
  +    smartcard_nss=no
  +fi
 
 '==' is not portable, please use '=':
 
 $ test x == y
 test: 1: x: unexpected operator
 
 I noticed that this patch introduces error messages here when I run 
 ./configure.
 
  +if [ $source_path != `pwd` ]; then
  +    # out of tree build
  +    mkdir -p libcacard
  +    rm -f libcacard/Makefile
  +    ln -s $source_path/libcacard/Makefile libcacard/Makefile
  +fi
 
 $source_path should have double-quotes around it so this works even
 when the path has spaces.

it is unquoted in the lines above that patch. I'll fix it in the same patch
in v23.

 
 Stefan
 

Re: [Qemu-devel] [PATCH v22 06/11] libcacard: initial commit

[Alon Levy]

On Wed, Mar 23, 2011 at 02:54:04PM +0200, Alon Levy wrote:
 On Tue, Mar 22, 2011 at 03:25:11PM +, Stefan Hajnoczi wrote:
  On Mon, Mar 21, 2011 at 10:07 PM, Alon Levy al...@redhat.com wrote:
   +# check for libcacard for smartcard support
   +if test $smartcard != no ; then
   +    smartcard=yes
   +    smartcard_cflags=
   +    # TODO - what's the minimal nss version we support?
   +    if test $smartcard_nss != no; then
   +        if $pkg_config --atleast-version=3.12.8 nss /dev/null 21 ; 
   then
   +            smartcard_nss=yes
   +            smartcard_cflags=-I\$(SRC_PATH)/libcacard
   +            libcacard_libs=$($pkg_config --libs nss 2/dev/null)
   +            libcacard_cflags=$($pkg_config --cflags nss 2/dev/null)
   +            QEMU_CFLAGS=$QEMU_CFLAGS $smartcard_cflags 
   $libcacard_cflags
   +            LIBS=$libcacard_libs $LIBS
   +        else
   +            if test $smartcard_nss == yes; then
   +                feature_not_found nss
   +            fi
   +            smartcard_nss=no
   +        fi
   +    fi
   +fi
   +if test $smartcard == no ; then
   +    smartcard_nss=no
   +fi
  
  '==' is not portable, please use '=':
  
  $ test x == y
  test: 1: x: unexpected operator
  
  I noticed that this patch introduces error messages here when I run 
  ./configure.
  
   +if [ $source_path != `pwd` ]; then
   +    # out of tree build
   +    mkdir -p libcacard
   +    rm -f libcacard/Makefile
   +    ln -s $source_path/libcacard/Makefile libcacard/Makefile
   +fi
  
  $source_path should have double-quotes around it so this works even
  when the path has spaces.
 
 it is unquoted in the lines above that patch. I'll fix it in the same patch
 in v23.

Actually, it's unquoted all over the place - solving this is a much bigger
patch, I'm not going to force it inside this one. I can fix the two unquoted
instances I've introduced, that leaves 10+ in configure that need fixing.

 
  
  Stefan
  
 

[Qemu-devel] [PATCH v23 01/11] trace: move trace objects from Makefile to Makefile.objs

[Alon Levy]

---
 Makefile  |   32 
 Makefile.objs |   32 
 2 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/Makefile b/Makefile
index 89e88b4..209e14d 100644
--- a/Makefile
+++ b/Makefile
@@ -112,38 +112,6 @@ ui/vnc.o: QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
 
 bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)
 
-ifeq ($(TRACE_BACKEND),dtrace)
-trace.h: trace.h-timestamp trace-dtrace.h
-else
-trace.h: trace.h-timestamp
-endif
-trace.h-timestamp: $(SRC_PATH)/trace-events config-host.mak
-   $(call quiet-command,sh $(SRC_PATH)/scripts/tracetool 
--$(TRACE_BACKEND) -h  $  $@,  GEN   trace.h)
-   @cmp -s $@ trace.h || cp $@ trace.h
-
-trace.c: trace.c-timestamp
-trace.c-timestamp: $(SRC_PATH)/trace-events config-host.mak
-   $(call quiet-command,sh $(SRC_PATH)/scripts/tracetool 
--$(TRACE_BACKEND) -c  $  $@,  GEN   trace.c)
-   @cmp -s $@ trace.c || cp $@ trace.c
-
-trace.o: trace.c $(GENERATED_HEADERS)
-
-trace-dtrace.h: trace-dtrace.dtrace
-   $(call quiet-command,dtrace -o $@ -h -s $,   GEN   trace-dtrace.h)
-
-# Normal practice is to name DTrace probe file with a '.d' extension
-# but that gets picked up by QEMU's Makefile as an external dependancy
-# rule file. So we use '.dtrace' instead
-trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
-trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events config-host.mak
-   $(call quiet-command,sh $(SRC_PATH)/scripts/tracetool 
--$(TRACE_BACKEND) -d  $  $@,  GEN   trace-dtrace.dtrace)
-   @cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
-
-trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
-   $(call quiet-command,dtrace -o $@ -G -s $,   GEN trace-dtrace.o)
-
-simpletrace.o: simpletrace.c $(GENERATED_HEADERS)
-
 version.o: $(SRC_PATH)/version.rc config-host.mak
$(call quiet-command,$(WINDRES) -I. -o $@ $,  RC$(TARGET_DIR)$@)
 
diff --git a/Makefile.objs b/Makefile.objs
index f8cf199..1fa7a29 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -310,6 +310,38 @@ libdis-$(CONFIG_SPARC_DIS) += sparc-dis.o
 # trace
 
 ifeq ($(TRACE_BACKEND),dtrace)
+trace.h: trace.h-timestamp trace-dtrace.h
+else
+trace.h: trace.h-timestamp
+endif
+trace.h-timestamp: $(SRC_PATH)/trace-events config-host.mak
+   $(call quiet-command,sh $(SRC_PATH)/scripts/tracetool 
--$(TRACE_BACKEND) -h  $  $@,  GEN   trace.h)
+   @cmp -s $@ trace.h || cp $@ trace.h
+
+trace.c: trace.c-timestamp
+trace.c-timestamp: $(SRC_PATH)/trace-events config-host.mak
+   $(call quiet-command,sh $(SRC_PATH)/scripts/tracetool 
--$(TRACE_BACKEND) -c  $  $@,  GEN   trace.c)
+   @cmp -s $@ trace.c || cp $@ trace.c
+
+trace.o: trace.c $(GENERATED_HEADERS)
+
+trace-dtrace.h: trace-dtrace.dtrace
+   $(call quiet-command,dtrace -o $@ -h -s $,   GEN   trace-dtrace.h)
+
+# Normal practice is to name DTrace probe file with a '.d' extension
+# but that gets picked up by QEMU's Makefile as an external dependancy
+# rule file. So we use '.dtrace' instead
+trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
+trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events config-host.mak
+   $(call quiet-command,sh $(SRC_PATH)/scripts/tracetool 
--$(TRACE_BACKEND) -d  $  $@,  GEN   trace-dtrace.dtrace)
+   @cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
+
+trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
+   $(call quiet-command,dtrace -o $@ -G -s $,   GEN trace-dtrace.o)
+
+simpletrace.o: simpletrace.c $(GENERATED_HEADERS)
+
+ifeq ($(TRACE_BACKEND),dtrace)
 trace-obj-y = trace-dtrace.o
 else
 trace-obj-y = trace.o
-- 
1.7.4.1

[Qemu-devel] [PATCH v23 05/11] ccid: add passthru card device

[Alon Levy]

The passthru ccid card is a device sitting on the usb-ccid bus and
using a chardevice to communicate with a remote device using the
VSCard protocol defined in libcacard/vscard_common.h

Usage docs available in following patch in docs/ccid.txt

Signed-off-by: Alon Levy al...@redhat.com

---

Changes from v20-v21: (Jes Sorenson review)
 * add reference to COPYING in header
 * long comment reformatting

Changes from v19-v20:
 * checkpatch.pl

Changes from v18-v19:
 * add qdev.desc
 * remove .qdev.unplug (no hot unplug support for ccid bus)

Changes from v16-v17:
 * fix wrong cast when receiving VSC_Error
 * ccid-card-passthru: force chardev user wakeup by sending Init
   see lengthy comment below.

Changes from v15-v16:

Behavioral changes:
 * return correct size
 * return error instead of assert if client sent too large ATR
 * don't assert if client sent too large a size, but add asserts for indices to 
buffer
 * reset vscard_in indices on chardev disconnect
 * handle init from client
 * error if no chardev supplied
 * use ntoh, hton
 * eradicate reader_id_t
 * remove Reconnect usage (removed from VSCARD protocol)
 * send VSC_SUCCESS on card insert/remove and reader add/remove

Style fixes:
 * width of line fix
 * update copyright
 * remove old TODO's
 * update file header comment
 * use macros for debug levels
 * c++ style comment replacement
 * update copyright license
 * fix ATR size comment
 * fix whitespace in struct def
 * fix DPRINTF prefix
 * line width fix

ccid-card-passthru: force chardev user wakeup by sending Init

The problem: how to wakeup the user of the smartcard when the smartcard
device is initialized?

Long term solution: have a callback interface. This was done via
the deprecated so called chardev ioctl interface.

Short term solution: do a write. Specifically we write an Init message.
And we change the client to send it's own Init message regardless of
receiving this one. Additional Init messages will be regarded as
acceptable, the first one received after connection establishment is
the determining one wrt capabilities.
---
 Makefile.objs   |2 +-
 hw/ccid-card-passthru.c |  341 +++
 2 files changed, 342 insertions(+), 1 deletions(-)
 create mode 100644 hw/ccid-card-passthru.c

diff --git a/Makefile.objs b/Makefile.objs
index 489a46b..744e1d3 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -200,7 +200,7 @@ hw-obj-$(CONFIG_APM) += pm_smbus.o apm.o
 hw-obj-$(CONFIG_DMA) += dma.o
 hw-obj-$(CONFIG_HPET) += hpet.o
 hw-obj-$(CONFIG_APPLESMC) += applesmc.o
-hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o
+hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o ccid-card-passthru.o
 
 # PPC devices
 hw-obj-$(CONFIG_OPENPIC) += openpic.o
diff --git a/hw/ccid-card-passthru.c b/hw/ccid-card-passthru.c
new file mode 100644
index 000..76abfb1
--- /dev/null
+++ b/hw/ccid-card-passthru.c
@@ -0,0 +1,341 @@
+/*
+ * CCID Passthru Card Device emulation
+ *
+ * Copyright (c) 2011 Red Hat.
+ * Written by Alon Levy.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.1 or later.
+ * This code is licenced under the GNU LGPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include arpa/inet.h
+
+#include qemu-char.h
+#include monitor.h
+#include hw/ccid.h
+#include libcacard/vscard_common.h
+
+#define DPRINTF(card, lvl, fmt, ...)\
+do {\
+if (lvl = card-debug) {   \
+printf(ccid-card-passthru:  fmt , ## __VA_ARGS__); \
+}   \
+} while (0)
+
+#define D_WARN 1
+#define D_INFO 2
+#define D_MORE_INFO 3
+#define D_VERBOSE 4
+
+/* TODO: do we still need this? */
+uint8_t DEFAULT_ATR[] = {
+/*
+ * From some example somewhere
+ * 0x3B, 0xB0, 0x18, 0x00, 0xD1, 0x81, 0x05, 0xB1, 0x40, 0x38, 0x1F, 0x03, 0x28
+ */
+
+/* From an Athena smart card */
+ 0x3B, 0xD5, 0x18, 0xFF, 0x80, 0x91, 0xFE, 0x1F, 0xC3, 0x80, 0x73, 0xC8, 0x21,
+ 0x13, 0x08
+};
+
+
+#define PASSTHRU_DEV_NAME ccid-card-passthru
+#define VSCARD_IN_SIZE 65536
+
+/* maximum size of ATR - from 7816-3 */
+#define MAX_ATR_SIZE40
+
+typedef struct PassthruState PassthruState;
+
+struct PassthruState {
+CCIDCardState base;
+CharDriverState *cs;
+uint8_t  vscard_in_data[VSCARD_IN_SIZE];
+uint32_t vscard_in_pos;
+uint32_t vscard_in_hdr;
+uint8_t  atr[MAX_ATR_SIZE];
+uint8_t  atr_length;
+uint8_t  debug;
+};
+
+/*
+ * VSCard protocol over chardev
+ * This code should not depend on the card type.
+ */
+
+static void ccid_card_vscard_send_msg(PassthruState *s,
+VSCMsgType type, uint32_t reader_id,
+const uint8_t *payload, uint32_t length)
+{
+VSCMsgHeader scr_msg_header;
+
+scr_msg_header.type = htonl(type);
+scr_msg_header.reader_id = htonl(reader_id);
+scr_msg_header.length = htonl(length);
+qemu_chr_write(s-cs, (uint8_t *)scr_msg_header, 

[Qemu-devel] [PATCH v23 00/11] usb-ccid

[Alon Levy]

This patchset adds three new devices, usb-ccid, ccid-card-passthru and
ccid-card-emulated, providing a CCID bus, a simple passthru protocol
implementing card requiring a client, and a standalone emulated card.

It also introduces a new directory libcaccard with CAC card emulation,
CAC is a type of ISO 7816 smart card.

Tree for pull: git://anongit.freedesktop.org/~alon/qemu usb_ccid.v23

v22-v23 changes:
 * libcacard
  * configure fixes: (reported by Stefan Hajnoczi)
   * test a = b, not a == b (second isn't portable)
   * quote $source_path in case it contains spaces
- this doesn't really help since there are many other places
  that need similar fixes, not introduced by this patch.

v21-v22 changes:
 * libcacard:
  * fix configure to not link libcacard if nss not found
 (reported by Stefan Hajnoczi)
  * fix vscclient linkage with simpletrace backend
 (reported by Stefan Hajnoczi)
  * card_7816.c: add missing break in ERROR_DATA_NOT_FOUND
 (reported by William van de Velde)

v20-v21 changes:
 * all: cosmetics
 * libcacard, ccid-card-passthru:
  * use qemu-{malloc,free} and qemu-thread, error_report
 * libcacard:
  * split to multiple patches

v19-v20 changes:
 * checkpatch.pl. Here are the remaining errors with explanation:
  * ignored 5 macro errors of the type
   ERROR: Macros with complex values should be enclosed in parenthesis
   because fixing them breaks current code, if it really bothers someone
   I can fix it.
   * four of them are in libcacard/card_7816t.h:
   /* give the subfields a unified look */
   ..
#define a_cla a_header-ah_cla /* class */
#define a_ins a_header-ah_ins /* instruction */
#define a_p1 a_header-ah_p1   /* parameter 1 */
#define a_p2 a_header-ah_p2   /* parameter 2 */
   * and the fifth:
#4946: FILE: libcacard/vcardt.h:31:
+#define VCARD_ATR_PREFIX(size) 0x3b, 0x66+(size), 0x00, 0xff, \
+   'V', 'C', 'A', 'R', 'D', '_'
  * Ignored this warning since I couldn't figure it out, and it's a test
   file:
WARNING: externs should be avoided in .c files
#2343: FILE: libcacard/link_test.c:7:
+VCardStatus cac_card_init(const char *flags, VCard *card,

v18-v19 changes:
 * more merges, down to a single digit number of patches.
 * drop enumeration property, use string.
 * rebased (trivial)

v17-v18 changes:
 * merge vscard_common.h patches.
 * actually provide a tree to pull.

v16-v17 changes:
 * merged all the v15-v16 patches
 * merged some more wherever it was easy (all same file commits).
 * added signed off by to first four patches
 * ccid.h: added copyright, removed underscore in defines, and replaced
 non C89 comments

v15-v16 changes:
 * split vscard_common introducing patch for ease of review
 * sum of commit logs for the v15-v16 commits: (whitespace fixes
removed for space, see original commit messages in later patches)
  * usb-ccid:
   * fix abort on client answer after card remove
   * enable migration
   * remove side affect code from asserts
   * return consistent self-powered state
   * mask out reserved bits in ccid_set_parameters
   * add missing abRFU in SetParameters (no affect on linux guest)
  * vscard_common.h protocol change:
   * VSCMsgInit capabilities and magic
   * removed ReaderResponse, will use Error instead with code==VSC_SUCCESS.
   * added Flush and FlushComplete, remove Reconnect.
   * define VSCARD_MAGIC
   * added error code VSC_SUCCESS.
  * ccid-card-passthru
   * return correct size
   * return error instead of assert if client sent too large ATR
   * don't assert if client sent too large a size, but add asserts for indices 
to buffer
   * reset vscard_in indices on chardev disconnect
   * handle init from client
   * error if no chardev supplied
   * use ntoh, hton
   * eradicate reader_id_t
   * remove Reconnect usage (removed from VSCARD protocol)
   * send VSC_SUCCESS on card insert/remove and reader add/remove
  * ccid-card-emulated
   * fix error reporting in initfn

v14-v15 changes:
 * add patch with --enable-smartcard and --disable-smartcard and only
  disable ccid-card-emulated if nss not found.
 * add patch with description strings
 * s/libcaccard/libcacard/ in docs/ccid.txt

v13-v14 changes:
 - support device_del/device_add on ccid-card-* and usb-ccid
 * usb-ccid:
  * lose card reference when card device deleted
  * check slot number and deny adding a slot if one is already added.
 * ccid-card-*: use qdev_simple_unplug_cb in both emulated and passthru ccid 
cards,
   the exitfn already takes care of triggering card removal in the usb dev.
 * libcacard:
  * remove double include of config-host.mak
  * add replay of card events to libcacard to support second and more emulation
  * don't initialize more then once (doesn't support it right now, so one
   thread, NSS thread, is left when device_del is done)
  * add VCARD_EMUL_INIT_ALREADY_INITED
 * ccid-card-emulated:
  * take correct mutexes on signaling to fix deadlocks on device_del
  * allow card insertion/removal event without proper 

[Qemu-devel] [PATCH v23 02/11] qemu-thread.h: include inttypes.h

[Alon Levy]

qemu-thread.h relies on uint64_t being defined, but doesn't include
inttypes.h explicitly. This makes it easier to use it from vscclient (part
of libcacard).
---
 qemu-thread.h |2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/qemu-thread.h b/qemu-thread.h
index edc7ab6..0a73d50 100644
--- a/qemu-thread.h
+++ b/qemu-thread.h
@@ -1,6 +1,8 @@
 #ifndef __QEMU_THREAD_H
 #define __QEMU_THREAD_H 1
 
+#include inttypes.h
+
 typedef struct QemuMutex QemuMutex;
 typedef struct QemuCond QemuCond;
 typedef struct QemuThread QemuThread;
-- 
1.7.4.1

[Qemu-devel] [PATCH v23 08/11] libcacard: add passthru

[Alon Levy]

From: Robert Relyea rrel...@redhat.com

In this mode libcacard doesn't emulate a card, but just passes apdu's
straight to the underlying card.

Not to be confused with ccid-card-passthru, which doesn't use libcacard
at all. So with this functionality in libcacard you can talk directly
to the host accessible card, for instance for provisioning or other
functions not available through the CAC interface. This can also be
used from a remote client for the same purpose.
---
 Makefile.objs   |2 +-
 libcacard/passthru.c|  609 +++
 libcacard/passthru.h|   53 
 libcacard/vcard_emul_type.c |6 +
 libcacard/vscclient.c   |   22 ++-
 5 files changed, 688 insertions(+), 4 deletions(-)
 create mode 100644 libcacard/passthru.c
 create mode 100644 libcacard/passthru.h

diff --git a/Makefile.objs b/Makefile.objs
index f513ffa..1fe1146 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -355,7 +355,7 @@ endif
 ##
 # smartcard
 
-libcacard-y = cac.o event.o vcard.o vreader.o vcard_emul_nss.o 
vcard_emul_type.o card_7816.o
+libcacard-y = cac.o event.o passthru.o vcard.o vreader.o vcard_emul_nss.o 
vcard_emul_type.o card_7816.o
 
 vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)
 
diff --git a/libcacard/passthru.c b/libcacard/passthru.c
new file mode 100644
index 000..d78e2db
--- /dev/null
+++ b/libcacard/passthru.c
@@ -0,0 +1,609 @@
+/*
+ * implement the applets for the CAC card.
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+#ifdef USE_PASSTHRU
+#include stdlib.h
+#include string.h
+
+#include pcsclite.h
+
+#include qemu-thread.h
+
+#include vcard.h
+#include vcard_emul.h
+#include card_7816.h
+#include vreader.h
+#include vcard_emul.h
+#include passthru.h
+
+/*
+ * Passthru applet private data
+ */
+struct VCardAppletPrivateStruct {
+char *reader_name;
+/* pcsc-lite parameters */
+SCARDHANDLE hCard;
+uint32_t hProtocol;
+SCARD_IO_REQUEST *send_io;
+unsigned char atr[MAX_ATR_SIZE];
+int atr_len;
+};
+
+static SCARDCONTEXT global_context;
+
+#define MAX_RESPONSE_LENGTH 261 /*65537 */
+/*
+ * handle all the APDU's that are common to all CAC applets
+ */
+static VCardStatus
+passthru_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
+{
+LONG rv;
+unsigned char buf[MAX_RESPONSE_LENGTH];
+uint32_t len = MAX_RESPONSE_LENGTH;
+VCardAppletPrivate *applet_private = NULL;
+SCARD_IO_REQUEST receive_io;
+
+applet_private = vcard_get_current_applet_private(card, 0);
+if (applet_private == NULL) {
+*response = vcard_make_response(VCARD7816_STATUS_EXC_ERROR);
+return VCARD_DONE;
+}
+
+rv = SCardTransmit(applet_private-hCard, applet_private-send_io,
+   apdu-a_data, apdu-a_len, receive_io, buf, len);
+if (rv != SCARD_S_SUCCESS) {
+*response = vcard_make_response(VCARD7816_STATUS_EXC_ERROR);
+return VCARD_DONE;
+}
+
+*response = vcard_response_new_data(buf, len);
+if (*response == NULL) {
+*response =
+vcard_make_response(VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
+} else {
+(*response)-b_total_len = (*response)-b_len;
+}
+return VCARD_DONE;
+}
+
+static void
+passthru_card_set_atr(VCard *card, unsigned char *atr, int atr_len)
+{
+VCardAppletPrivate *applet_private = NULL;
+applet_private = vcard_get_current_applet_private(card, 0);
+if (applet_private == NULL) {
+return;
+}
+applet_private-atr_len = MIN(atr_len, sizeof(applet_private-atr));
+memcpy(applet_private-atr, atr, applet_private-atr_len);
+}
+
+static void passthru_card_get_atr(VCard *card, unsigned char *atr, int 
*atr_len)
+{
+VCardAppletPrivate *applet_private = NULL;
+SCARD_READERSTATE *state;
+
+applet_private = vcard_get_current_applet_private(card, 0);
+if ((applet_private == NULL) || (applet_private-atr_len == 0)) {
+vcard_emul_get_atr(card, atr, atr_len);
+return;
+}
+*atr_len = MIN(applet_private-atr_len, *atr_len);
+memcpy(atr, applet_private-atr, *atr_len);
+return;
+}
+
+/*
+ *  reset the inter call state between applet selects
+ */
+static VCardStatus
+passthru_reset(VCard *card, int channel)
+{
+return VCARD_DONE;
+}
+
+static VCardStatus
+passthru_pcsc_lite_init()
+{
+LONG rv;
+if (global_context != 0) {
+return VCARD_DONE;
+}
+rv = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL, 
global_context);
+if (rv != SCARD_S_SUCCESS) {
+return VCARD_FAIL;
+}
+return VCARD_DONE;
+}
+
+/*
+ *  match if s1 is completely contained in s2
+ */
+static int
+string_match(const char *s1, const char *s2)
+{
+int len = strlen(s1);
+const char *start;
+
+for (start = strchr(s2, *s1); start; start = strchr(start+1, 

[Qemu-devel] [PATCH v23 11/11] ccid: add docs

[Alon Levy]

Add documentation for the usb-ccid device and accompanying two card
devices, ccid-card-emulated and ccid-card-passthru.

Signed-off-by: Alon Levy al...@redhat.com
---
 docs/ccid.txt |  135 +
 1 files changed, 135 insertions(+), 0 deletions(-)
 create mode 100644 docs/ccid.txt

diff --git a/docs/ccid.txt b/docs/ccid.txt
new file mode 100644
index 000..b8e504a
--- /dev/null
+++ b/docs/ccid.txt
@@ -0,0 +1,135 @@
+Qemu CCID Device Documentation.
+
+Contents
+1. USB CCID device
+2. Building
+3. Using ccid-card-emulated with hardware
+4. Using ccid-card-emulated with certificates
+5. Using ccid-card-passthru with client side hardware
+6. Using ccid-card-passthru with client side certificates
+7. Passthrough protocol scenario
+8. libcacard
+
+1. USB CCID device
+
+The USB CCID device is a USB device implementing the CCID specification, which
+lets one connect smart card readers that implement the same spec. For more
+information see the specification:
+
+ Universal Serial Bus
+ Device Class: Smart Card
+ CCID
+ Specification for
+ Integrated Circuit(s) Cards Interface Devices
+ Revision 1.1
+ April 22rd, 2005
+
+Smartcard are used for authentication, single sign on, decryption in
+public/private schemes and digital signatures. A smartcard reader on the client
+cannot be used on a guest with simple usb passthrough since it will then not be
+available on the client, possibly locking the computer when it is removed. On
+the other hand this device can let you use the smartcard on both the client and
+the guest machine. It is also possible to have a completely virtual smart card
+reader and smart card (i.e. not backed by a physical device) using this device.
+
+2. Building
+
+The cryptographic functions and access to the physical card is done via NSS.
+
+Installing NSS:
+
+In redhat/fedora:
+yum install nss-devel
+In ubuntu/debian:
+apt-get install libnss3-dev
+(not tested on ubuntu)
+
+Configuring and building:
+./configure --enable-smartcard  make
+
+3. Using ccid-card-emulated with hardware
+
+Assuming you have a working smartcard on the host with the current
+user, using NSS, qemu acts as another NSS client using ccid-card-emulated:
+
+qemu -usb -device usb-ccid -device ccid-card-emualated
+
+4. Using ccid-card-emulated with certificates
+
+You must create the certificates. This is a one time process. We use NSS
+certificates:
+
+certutil -d /etc/pki/nssdb -x -t CT,CT,CT -S -s CN=cert1 -n cert1
+
+Note: you must have exactly three certificates.
+
+Assuming the current user can access the certificates (use certutil -L to
+verify), you can use the emulated card type with the certificates backend:
+
+qemu -usb -device usb-ccid -device 
ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,cert3=cert3
+
+5. Using ccid-card-passthru with client side hardware
+
+on the host specify the ccid-card-passthru device with a suitable chardev:
+
+qemu -chardev socket,server,host=0.0.0.0,port=2001,id=ccid,nowait -usb 
-device usb-ccid -device ccid-card-passthru,chardev=ccid
+
+on the client run vscclient, built when you built the libcacard library:
+libcacard/vscclient qemu-host 2001
+
+6. Using ccid-card-passthru with client side certificates
+
+Run qemu as per #5, and run vscclient as follows:
+(Note: vscclient command line interface is in a state of change)
+
+libcacard/vscclient -e db=\/etc/pki/nssdb\ use_hw=no 
soft=(,Test,CAC,,cert1,cert2,cert3) qemu-host 2001
+
+7. Passthrough protocol scenario
+
+This is a typical interchange of messages when using the passthru card device.
+usb-ccid is a usb device. It defaults to an unattached usb device on startup.
+usb-ccid expects a chardev and expects the protocol defined in
+cac_card/vscard_common.h to be passed over that.
+The usb-ccid device can be in one of three modes:
+ * detached
+ * attached with no card
+ * attached with card
+
+A typical interchange is: (the arrow shows who started each exchange, it can 
be client
+originated or guest originated)
+
+client event  |  vscclient   |passthru| usb-ccid  
|  guest event
+--
+  |  VSC_Init||   |
+  |  VSC_ReaderAdd   || attach|
+  |  ||   
|  sees new usb device.
+card inserted -  |  ||   |
+  |  VSC_ATR |   insert   | insert
|  see new card
+  |  ||   |
+  |  VSC_APDU|   VSC_APDU |   
| - guest sends APDU
+client-physical |  ||   |
+card APDU exchange|   

[Qemu-devel] [PATCH v23 04/11] introduce libcacard/vscard_common.h

[Alon Levy]

---

Signed-off-by: Alon Levy al...@redhat.com

v20-v21 changes: (Jes Sorenson review)
 * license set to 2+
 * long comment fixes, remove empty line at eof.
 * add reference to COPYING

v19-v20 changes:
 * checkpatch.pl

v15-v16 changes:

Protocol change:
 * VSCMsgInit capabilities and magic
 * removed ReaderResponse, will use Error instead with code==VSC_SUCCESS.
 * adaded Flush and FlushComplete, remove Reconnect.
 * define VSCARD_MAGIC
 * added error code VSC_SUCCESS.

Fixes:
 * update VSCMsgInit comment
 * fix message type enum
 * remove underscore from wrapping define
 * update copyright
 * updated comments.
 * Header comment updated
 * remove C++ style comment
 * fix comment for VSCMsgError
 * give names to enums in typedefs
---
 libcacard/vscard_common.h |  178 +
 1 files changed, 178 insertions(+), 0 deletions(-)
 create mode 100644 libcacard/vscard_common.h

diff --git a/libcacard/vscard_common.h b/libcacard/vscard_common.h
new file mode 100644
index 000..bebd52d
--- /dev/null
+++ b/libcacard/vscard_common.h
@@ -0,0 +1,178 @@
+/* Virtual Smart Card protocol definition
+ *
+ * This protocol is between a host using virtual smart card readers,
+ * and a client providing the smart cards, perhaps by emulating them or by
+ * access to real cards.
+ *
+ * Definitions for this protocol:
+ *  Host   - user of the card
+ *  Client - owner of the card
+ *
+ * The current implementation passes the raw APDU's from 7816 and additionally
+ * contains messages to setup and teardown readers, handle insertion and
+ * removal of cards, negotiate the protocol via capabilities and provide
+ * for error responses.
+ *
+ * Copyright (c) 2011 Red Hat.
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+
+#ifndef VSCARD_COMMON_H
+#define VSCARD_COMMON_H
+
+#include stdint.h
+
+#define VERSION_MAJOR_BITS 11
+#define VERSION_MIDDLE_BITS 11
+#define VERSION_MINOR_BITS 10
+
+#define MAKE_VERSION(major, middle, minor) \
+ ((major   (VERSION_MINOR_BITS + VERSION_MIDDLE_BITS)) \
+  | (middle   VERSION_MINOR_BITS) \
+  | (minor))
+
+/*
+ * IMPORTANT NOTE on VERSION
+ *
+ * The version below MUST be changed whenever a change in this file is made.
+ *
+ * The last digit, the minor, is for bug fix changes only.
+ *
+ * The middle digit is for backward / forward compatible changes, updates
+ * to the existing messages, addition of fields.
+ *
+ * The major digit is for a breaking change of protocol, presumably
+ * something that cannot be accomodated with the existing protocol.
+ */
+
+#define VSCARD_VERSION MAKE_VERSION(0, 0, 2)
+
+typedef enum VSCMsgType {
+VSC_Init = 1,
+VSC_Error,
+VSC_ReaderAdd,
+VSC_ReaderRemove,
+VSC_ATR,
+VSC_CardRemove,
+VSC_APDU,
+VSC_Flush,
+VSC_FlushComplete
+} VSCMsgType;
+
+typedef enum VSCErrorCode {
+VSC_SUCCESS = 0,
+VSC_GENERAL_ERROR = 1,
+VSC_CANNOT_ADD_MORE_READERS,
+VSC_CARD_ALREAY_INSERTED,
+} VSCErrorCode;
+
+#define VSCARD_UNDEFINED_READER_ID  0x
+#define VSCARD_MINIMAL_READER_ID0
+
+#define VSCARD_MAGIC (*(uint32_t *)VSCD)
+
+/*
+ * Header
+ * Each message starts with the header.
+ * type - message type
+ * reader_id - used by messages that are reader specific
+ * length - length of payload (not including header, i.e. zero for
+ *  messages containing empty payloads)
+ */
+typedef struct VSCMsgHeader {
+uint32_t   type;
+uint32_t   reader_id;
+uint32_t   length;
+uint8_tdata[0];
+} VSCMsgHeader;
+
+/*
+ * VSCMsgInit   Client - Host
+ * Client sends it on connection, with its own capabilities.
+ * Host replies with VSCMsgInit filling in its capabilities.
+ *
+ * It is not meant to be used for negotiation, i.e. sending more then
+ * once from any side, but could be used for that in the future.
+ */
+typedef struct VSCMsgInit {
+uint32_t   magic;
+uint32_t   version;
+uint32_t   capabilities[1]; /* receiver must check length,
+   array may grow in the future*/
+} VSCMsgInit;
+
+/*
+ * VSCMsgError  Client - Host
+ * This message is a response to any of:
+ *  Reader Add
+ *  Reader Remove
+ *  Card Remove
+ * If the operation was successful then VSC_SUCCESS
+ * is returned, other wise a specific error code.
+ */
+typedef struct VSCMsgError {
+uint32_t   code;
+} VSCMsgError;
+
+/*
+ * VSCMsgReaderAdd  Client - Host
+ * Host replies with allocated reader id in VSCMsgError with code==SUCCESS.
+ *
+ * name - name of the reader on client side, UTF-8 encoded. Only used
+ *  for client presentation (may be translated to the device presented to the
+ *  guest), protocol wise only reader_id is important.
+ */
+typedef struct VSCMsgReaderAdd {
+uint8_tname[0];
+} VSCMsgReaderAdd;
+
+/*
+ * VSCMsgReaderRemove   Client - Host
+ * The client's reader has been removed.
+ */
+typedef 

[Qemu-devel] [PATCH v23 03/11] usb-ccid: add CCID bus

[Alon Levy]

A CCID device is a smart card reader. It is a USB device, defined at [1].
This patch introduces the usb-ccid device that is a ccid bus. Next patches will
introduce two card types to use it, a passthru card and an emulated card.

 [1] http://www.usb.org/developers/devclass_docs/DWG_Smart-Card_CCID_Rev110.

Signed-off-by: Alon Levy al...@redhat.com

---

changes from v20-v21: (Jes Sorenson review)
 * cosmetic changes - fix multi line comments.
 * reorder fields in USBCCIDState
 * add reference to COPYING
 * add --enable-smartcard and --disable-smartcard here (moved
 from last patch)

changes from v19-v20:
 * checkpatch.pl

changes from v18-v19:
 * merged: ccid.h: add copyright, fix define and remove non C89 comments
 * add qdev.desc

changes from v15-v16:

Behavioral changes:
 * fix abort on client answer after card remove
 * enable migration
 * remove side affect code from asserts
 * return consistent self-powered state
 * mask out reserved bits in ccid_set_parameters
 * add missing abRFU in SetParameters (no affect on linux guest)

whitefixes / comments / consts defines:
 * remove stale comment
 * remove ccid_print_pending_answers if no DEBUG_CCID
 * replace printf's with DPRINTF, remove DEBUG_CCID, add verbosity defines
 * use error_report
 * update copyright (most of the code is not original)
 * reword known bug comment
 * add missing closing quote in comment
 * add missing whitespace on one line
 * s/CCID_SetParameter/CCID_SetParameters/
 * add comments
 * use define for max packet size

Comment for return consistent self-powered state:

the Configuration Descriptor bmAttributes claims we are self powered,
but we were returning not self powered to USB_REQ_GET_STATUS control message.

In practice, this message is not sent by a linux 2.6.35.10-74.fc14.x86_64
guest (not tested on other guests), unless you issue lsusb -v as root (for
example).
---
 Makefile.objs |1 +
 configure |   11 +
 hw/ccid.h |   59 +++
 hw/usb-ccid.c | 1419 +
 4 files changed, 1490 insertions(+), 0 deletions(-)
 create mode 100644 hw/ccid.h
 create mode 100644 hw/usb-ccid.c

diff --git a/Makefile.objs b/Makefile.objs
index 1fa7a29..489a46b 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -200,6 +200,7 @@ hw-obj-$(CONFIG_APM) += pm_smbus.o apm.o
 hw-obj-$(CONFIG_DMA) += dma.o
 hw-obj-$(CONFIG_HPET) += hpet.o
 hw-obj-$(CONFIG_APPLESMC) += applesmc.o
+hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o
 
 # PPC devices
 hw-obj-$(CONFIG_OPENPIC) += openpic.o
diff --git a/configure b/configure
index 5a5827f..159549d 100755
--- a/configure
+++ b/configure
@@ -175,6 +175,7 @@ trace_backend=nop
 trace_file=trace
 spice=
 rbd=
+smartcard=
 
 # parse CC options first
 for opt do
@@ -724,6 +725,10 @@ for opt do
   ;;
   --enable-rbd) rbd=yes
   ;;
+  --disable-smartcard) smartcard=no
+  ;;
+  --enable-smartcard) smartcard=yes
+  ;;
   *) echo ERROR: unknown option $opt; show_help=yes
   ;;
   esac
@@ -921,6 +926,8 @@ echoDefault:trace-pid
 echo   --disable-spice  disable spice
 echo   --enable-spice   enable spice
 echo   --enable-rbd enable building the rados block device (rbd)
+echo   --disable-smartcard  disable smartcard support
+echo   --enable-smartcard   enable smartcard support
 echo 
 echo NOTE: The object files are built at the place where configure is 
launched
 exit 1
@@ -2822,6 +2829,10 @@ if test $spice = yes ; then
   echo CONFIG_SPICE=y  $config_host_mak
 fi
 
+if test $smartcard = yes ; then
+  echo CONFIG_SMARTCARD=y  $config_host_mak
+fi
+
 # XXX: suppress that
 if [ $bsd = yes ] ; then
   echo CONFIG_BSD=y  $config_host_mak
diff --git a/hw/ccid.h b/hw/ccid.h
new file mode 100644
index 000..dbfc13c
--- /dev/null
+++ b/hw/ccid.h
@@ -0,0 +1,59 @@
+/*
+ * CCID Passthru Card Device emulation
+ *
+ * Copyright (c) 2011 Red Hat.
+ * Written by Alon Levy.
+ *
+ * This code is licenced under the GNU LGPL, version 2 or later.
+ */
+
+#ifndef CCID_H
+#define CCID_H
+
+#include qdev.h
+
+typedef struct CCIDCardState CCIDCardState;
+typedef struct CCIDCardInfo CCIDCardInfo;
+
+/*
+ * state of the CCID Card device (i.e. hw/ccid-card-*.c)
+ */
+struct CCIDCardState {
+DeviceState qdev;
+uint32_tslot; /* For future use with multiple slot reader. */
+};
+
+/*
+ * callbacks to be used by the CCID device (hw/usb-ccid.c) to call
+ * into the smartcard device (hw/ccid-card-*.c)
+ */
+struct CCIDCardInfo {
+DeviceInfo qdev;
+void (*print)(Monitor *mon, CCIDCardState *card, int indent);
+const uint8_t *(*get_atr)(CCIDCardState *card, uint32_t *len);
+void (*apdu_from_guest)(CCIDCardState *card,
+const uint8_t *apdu,
+uint32_t len);
+int (*exitfn)(CCIDCardState *card);
+int (*initfn)(CCIDCardState *card);
+};
+
+/*
+ * API for smartcard calling the CCID device (used by hw/ccid-card-*.c)
+ */
+void 

[Qemu-devel] Re: [PATCH 1/7] virtio-serial: Use a struct to pass config information from proxy

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 Instead of using a single variable to pass to the virtio_serial_init
 function, use a struct so that expanding the number of variables to be
 passed on later is easier.

 Signed-off-by: Amit Shah amit.s...@redhat.com

Reviewed-by: Juan Quintela quint...@redhat.com

[Qemu-devel] [PATCH v23 07/11] libcacard: add vscclient

[Alon Levy]

From: Robert Relyea rrel...@redhat.com

client to talk to ccid-card-passthru and use smartcard on client to
perform actual operations.
---
 libcacard/Makefile|7 +-
 libcacard/vscclient.c |  730 +
 2 files changed, 736 insertions(+), 1 deletions(-)
 create mode 100644 libcacard/vscclient.c

diff --git a/libcacard/Makefile b/libcacard/Makefile
index 410fa1e..85e3376 100644
--- a/libcacard/Makefile
+++ b/libcacard/Makefile
@@ -12,6 +12,11 @@ endif
 
 QEMU_OBJS=$(QEMU_THREAD) $(oslib-obj-y) $(trace-obj-y) qemu-malloc.o 
qemu-timer-common.o
 
+vscclient: $(libcacard-y) $(QEMU_OBJS) vscclient.o
+   $(call quiet-command,$(CC) $(libcacard_libs) -lrt -o $@ $^,  LINK  
$(TARGET_DIR)$@)
+
+all: vscclient
+
 clean:
-   rm -f *.o */*.o *.d */*.d *.a */*.a *~ */*~
+   rm -f *.o */*.o *.d */*.d *.a */*.a *~ */*~ vscclient
 
diff --git a/libcacard/vscclient.c b/libcacard/vscclient.c
new file mode 100644
index 000..8dde449
--- /dev/null
+++ b/libcacard/vscclient.c
@@ -0,0 +1,730 @@
+/*
+ * Tester for VSCARD protocol, client side.
+ *
+ * Can be used with ccid-card-passthru.
+ *
+ * Copyright (c) 2011 Red Hat.
+ * Written by Alon Levy.
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+
+#include sys/types.h
+#include stdio.h
+#include stdlib.h
+#include string.h
+#include unistd.h
+
+#include sys/types.h
+#include sys/socket.h
+#include netdb.h
+#include netinet/in.h
+#include arpa/inet.h
+
+#include qemu-thread.h
+#include qemu-common.h
+
+#include vscard_common.h
+
+#include vreader.h
+#include vcard_emul.h
+#include vevent.h
+
+int verbose;
+
+int sock;
+
+static void
+print_byte_array(
+uint8_t *arrBytes,
+unsigned int nSize
+) {
+int i;
+for (i = 0; i  nSize; i++) {
+printf(%02X , arrBytes[i]);
+}
+printf(\n);
+}
+
+static void
+print_usage(void) {
+printf(vscclient [-c certname .. -e emul_args -d level%s] 
+host port\n,
+#ifdef USE_PASSTHRU
+ -p);
+printf( -p use passthrough mode\n);
+#else
+   );
+#endif
+vcard_emul_usage();
+}
+
+static QemuMutex write_lock;
+
+static int
+send_msg(
+VSCMsgType type,
+uint32_t reader_id,
+const void *msg,
+unsigned int length
+) {
+int rv;
+VSCMsgHeader mhHeader;
+
+qemu_mutex_lock(write_lock);
+
+if (verbose  10) {
+printf(sending type=%d id=%d, len =%d (0x%x)\n,
+   type, reader_id, length, length);
+}
+
+mhHeader.type = htonl(type);
+mhHeader.reader_id = 0;
+mhHeader.length = htonl(length);
+rv = write(
+sock,
+mhHeader,
+sizeof(mhHeader)
+);
+if (rv  0) {
+/* Error */
+printf(write header error\n);
+close(sock);
+qemu_mutex_unlock(write_lock);
+return 16;
+}
+rv = write(
+sock,
+msg,
+length
+);
+if (rv  0) {
+/* Error */
+printf(write error\n);
+close(sock);
+qemu_mutex_unlock(write_lock);
+return 16;
+}
+qemu_mutex_unlock(write_lock);
+
+return 0;
+}
+
+static VReader *pending_reader;
+static QemuMutex pending_reader_lock;
+static QemuCond pending_reader_condition;
+
+#define MAX_ATR_LEN 40
+static void *
+event_thread(void *arg)
+{
+unsigned char atr[MAX_ATR_LEN];
+int atr_len = MAX_ATR_LEN;
+VEvent *event = NULL;
+unsigned int reader_id;
+
+
+while (1) {
+const char *reader_name;
+
+event = vevent_wait_next_vevent();
+if (event == NULL) {
+break;
+}
+reader_id = vreader_get_id(event-reader);
+if (reader_id == VSCARD_UNDEFINED_READER_ID 
+event-type != VEVENT_READER_INSERT) {
+/* ignore events from readers qemu has rejected */
+/* if qemu is still deciding on this reader, wait to see if need to
+ * forward this event */
+qemu_mutex_lock(pending_reader_lock);
+if (!pending_reader || (pending_reader != event-reader)) {
+/* wasn't for a pending reader, this reader has already been
+ * rejected by qemu */
+qemu_mutex_unlock(pending_reader_lock);
+vevent_delete(event);
+continue;
+}
+/* this reader hasn't been told it's status from qemu yet, wait for
+ * that status */
+while (pending_reader != NULL) {
+qemu_cond_wait(pending_reader_condition, 
pending_reader_lock);
+}
+qemu_mutex_unlock(pending_reader_lock);
+/* now recheck the id */
+reader_id = vreader_get_id(event-reader);
+if (reader_id == VSCARD_UNDEFINED_READER_ID) {
+/* this reader was rejected */
+vevent_delete(event);
+continue;
+}
+/* reader 

[Qemu-devel] [PATCH v23 10/11] ccid: add ccid-card-emulated device

[Alon Levy]

This devices uses libcacard (internal) to emulate a smartcard conforming
to the CAC standard. It attaches to the usb-ccid bus. Usage instructions
(example command lines) are in the following patch in docs/ccid.txt. It
uses libcacard which uses nss, so it can work with both hw cards and
certificates (files).

Signed-off-by: Alon Levy al...@redhat.com

---

changes from v20-v21: (Jes Sorenson review)
 * cosmetics
 * use qemu-thread and qemu_malloc/qemu_free

changes from v19-v20:
 * checkpatch.pl

changes from v18-v19:
 * add qdev.desc
 * backend: drop the enumeration property, back to using a string one.

changes from v16-v17:
 * use PROP_TYPE_ENUM for backend

changes from v15-v16:
 * fix error reporting in initfn
 * bump copyright year
 * update copyright license

changes from v1:
 * remove stale comments, use only c-style comments
 * bugfix, forgot to set recv_len
 * change reader name to 'Virtual Reader'
---
 Makefile.objs   |1 +
 hw/ccid-card-emulated.c |  595 +++
 2 files changed, 596 insertions(+), 0 deletions(-)
 create mode 100644 hw/ccid-card-emulated.c

diff --git a/Makefile.objs b/Makefile.objs
index 1fe1146..88cb256 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -201,6 +201,7 @@ hw-obj-$(CONFIG_DMA) += dma.o
 hw-obj-$(CONFIG_HPET) += hpet.o
 hw-obj-$(CONFIG_APPLESMC) += applesmc.o
 hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o ccid-card-passthru.o
+hw-obj-$(CONFIG_SMARTCARD_NSS) += ccid-card-emulated.o
 
 # PPC devices
 hw-obj-$(CONFIG_OPENPIC) += openpic.o
diff --git a/hw/ccid-card-emulated.c b/hw/ccid-card-emulated.c
new file mode 100644
index 000..0b07184
--- /dev/null
+++ b/hw/ccid-card-emulated.c
@@ -0,0 +1,595 @@
+/*
+ * CCID Card Device. Emulated card.
+ *
+ * Copyright (c) 2011 Red Hat.
+ * Written by Alon Levy.
+ *
+ * This code is licenced under the GNU LGPL, version 2 or later.
+ */
+
+/*
+ * It can be used to provide access to the local hardware in a non exclusive
+ * way, or it can use certificates. It requires the usb-ccid bus.
+ *
+ * Usage 1: standard, mirror hardware reader+card:
+ * qemu .. -usb -device usb-ccid -device ccid-card-emulated
+ *
+ * Usage 2: use certificates, no hardware required
+ * one time: create the certificates:
+ *  for i in 1 2 3; do
+ *  certutil -d /etc/pki/nssdb -x -t CT,CT,CT -S -s CN=user$i -n user$i
+ *  done
+ * qemu .. -usb -device usb-ccid \
+ *  -device ccid-card-emulated,cert1=user1,cert2=user2,cert3=user3
+ *
+ * If you use a non default db for the certificates you can specify it using
+ * the db parameter.
+ */
+
+#include eventt.h
+#include vevent.h
+#include vreader.h
+#include vcard_emul.h
+
+#include qemu-thread.h
+#include qemu-char.h
+#include monitor.h
+#include hw/ccid.h
+
+#define DPRINTF(card, lvl, fmt, ...) \
+do {\
+if (lvl = card-debug) {\
+printf(ccid-card-emul: %s:  fmt , __func__, ## __VA_ARGS__);\
+} \
+} while (0)
+
+#define EMULATED_DEV_NAME ccid-card-emulated
+
+#define BACKEND_NSS_EMULATED_NAME nss-emulated
+#define BACKEND_CERTIFICATES_NAME certificates
+
+enum {
+BACKEND_NSS_EMULATED = 1,
+BACKEND_CERTIFICATES
+};
+
+#define DEFAULT_BACKEND BACKEND_NSS_EMULATED
+
+typedef struct EmulatedState EmulatedState;
+
+enum {
+EMUL_READER_INSERT = 0,
+EMUL_READER_REMOVE,
+EMUL_CARD_INSERT,
+EMUL_CARD_REMOVE,
+EMUL_GUEST_APDU,
+EMUL_RESPONSE_APDU,
+EMUL_ERROR,
+};
+
+static const char *emul_event_to_string(uint32_t emul_event)
+{
+switch (emul_event) {
+case EMUL_READER_INSERT:
+return EMUL_READER_INSERT;
+case EMUL_READER_REMOVE:
+return EMUL_READER_REMOVE;
+case EMUL_CARD_INSERT:
+return EMUL_CARD_INSERT;
+case EMUL_CARD_REMOVE:
+return EMUL_CARD_REMOVE;
+case EMUL_GUEST_APDU:
+return EMUL_GUEST_APDU;
+case EMUL_RESPONSE_APDU:
+return EMUL_RESPONSE_APDU;
+case EMUL_ERROR:
+return EMUL_ERROR;
+}
+return UNKNOWN;
+}
+
+typedef struct EmulEvent {
+QSIMPLEQ_ENTRY(EmulEvent) entry;
+union {
+struct {
+uint32_t type;
+} gen;
+struct {
+uint32_t type;
+uint64_t code;
+} error;
+struct {
+uint32_t type;
+uint32_t len;
+uint8_t data[];
+} data;
+} p;
+} EmulEvent;
+
+#define MAX_ATR_SIZE 40
+struct EmulatedState {
+CCIDCardState base;
+uint8_t  debug;
+char*backend_str;
+uint32_t backend;
+char*cert1;
+char*cert2;
+char*cert3;
+char*db;
+uint8_t  atr[MAX_ATR_SIZE];
+uint8_t  atr_length;
+QSIMPLEQ_HEAD(event_list, EmulEvent) event_list;
+QemuMutex event_list_mutex;
+VReader *reader;
+QSIMPLEQ_HEAD(guest_apdu_list, EmulEvent) guest_apdu_list;
+QemuMutex vreader_mutex; /* and guest_apdu_list mutex */
+QemuMutex handle_apdu_mutex;
+QemuCond handle_apdu_cond;
+int  pipe[2];
+int  quit_apdu_thread;
+

[Qemu-devel] [PATCH v23 09/11] libcacard: add docs

[Alon Levy]

From: Robert Relyea rrel...@redhat.com

---
 docs/libcacard.txt |  483 
 1 files changed, 483 insertions(+), 0 deletions(-)
 create mode 100644 docs/libcacard.txt

diff --git a/docs/libcacard.txt b/docs/libcacard.txt
new file mode 100644
index 000..5dee6fa
--- /dev/null
+++ b/docs/libcacard.txt
@@ -0,0 +1,483 @@
+This file documents the CAC (Common Access Card) library in the libcacard
+subdirectory.
+
+Virtual Smart Card Emulator
+
+This emulator is designed to provide emulation of actual smart cards to a
+virtual card reader running in a guest virtual machine. The emulated smart
+cards can be representations of real smart cards, where the necessary functions
+such as signing, card removal/insertion, etc. are mapped to real, physical
+cards which are shared with the client machine the emulator is running on, or
+the cards could be pure software constructs.
+
+The emulator is structured to allow multiple replacable or additional pieces,
+so it can be easily modified for future requirements. The primary envisioned
+modifications are:
+
+1) The socket connection to the virtual card reader (presumably a CCID reader,
+but other ISO-7816 compatible readers could be used). The code that handles
+this is in vscclient.c.
+
+2) The virtual card low level emulation. This is currently supplied by using
+NSS. This emulation could be replaced by implementations based on other
+security libraries, including but not limitted to openssl+pkcs#11 library,
+raw pkcs#11, Microsoft CAPI, direct opensc calls, etc. The code that handles
+this is in vcard_emul_nss.c.
+
+3) Emulation for new types of cards. The current implementation emulates the
+original DoD CAC standard with separate pki containers. This emulator lives in
+cac.c. More than one card type emulator could be included. Other cards could
+be emulated as well, including PIV, newer versions of CAC, PKCS #15, etc.
+
+
+Replacing the Socket Based Virtual Reader Interface.
+
+The current implementation contains a replacable module vscclient.c. The
+current vscclient.c implements a sockets interface to the virtual ccid reader
+on the guest. CCID commands that are pertinent to emulation are passed
+across the socket, and their responses are passed back along that same socket.
+The protocol that vscclient uses is defined in vscard_common.h and connects
+to a qemu ccid usb device. Since this socket runs as a client, vscclient.c
+implements a program with a main entry. It also handles argument parsing for
+the emulator.
+
+An application that wants to use the virtual reader can replace vscclient.c
+with it's own implementation that connects to it's own CCID reader.  The calls
+that the CCID reader can call are:
+
+  VReaderList * vreader_get_reader_list();
+
+  This function returns a list of virtual readers.  These readers may map to
+  physical devices, or simulated devices depending on vcard the back end. Each
+  reader in the list should represent a reader to the virtual machine. Virtual
+  USB address mapping is left to the CCID reader front end. This call can be
+  made any time to get an updated list. The returned list is a copy of the
+  internal list that can be referenced by the caller without locking. This copy
+  must be freed by the caller with vreader_list_delete when it is no longer
+  needed.
+
+  VReaderListEntry *vreader_list_get_first(VReaderList *);
+
+  This function gets the first entry on the reader list. Along with
+  vreader_list_get_next(), vreader_list_get_first() can be used to walk the
+  reader list returned from vreader_get_reader_list(). VReaderListEntries are
+  part of the list themselves and do not need to be freed separately from the
+  list. If there are no entries on the list, it will return NULL.
+
+  VReaderListEntry *vreader_list_get_next(VReaderListEntry *);
+
+  This function gets the next entry in the list. If there are no more entries
+  it will return NULL.
+
+  VReader * vreader_list_get_reader(VReaderListEntry *)
+
+  This function returns the reader stored in the reader List entry. Caller gets
+  a new reference to a reader. The caller must free it's reference when it is
+  finished with vreader_free().
+
+  void vreader_free(VReader *reader);
+
+   This function frees a reference to a reader. Reader's are reference counted
+   and are automatically deleted when the last reference is freed.
+
+  void vreader_list_delete(VReaderList *list);
+
+   This function frees the list, all the elements on the list, and all the
+   reader references held by the list.
+
+  VReaderStatus vreader_power_on(VReader *reader, char *atr, int *len);
+
+  This functions simulates a card power on. Virtual cards do not care about
+  the actual voltage and other physical parameters, but it does care that the
+  card is actually on or off. Cycling the card causes the card to reset. If
+  the caller provides enough space, vreader_power_on will return 

[Qemu-devel] Re: [PATCH 5/7] virtio-serial: Don't clear -have_data() pointer after unplug

[Amit Shah]

On (Wed) 23 Mar 2011 [14:33:25], Juan Quintela wrote:
 Amit Shah amit.s...@redhat.com wrote:
  After a port unplug operation, the port-info-have_data() pointer was
  set to NULL.  The problem is, the -info struct is shared by all ports,
  effectively disabling writes to other ports.
 
  Reported-by: juzhang juzh...@redhat.com
  Signed-off-by: Amit Shah amit.s...@redhat.com
  ---
   hw/virtio-console.c |1 -
   1 files changed, 0 insertions(+), 1 deletions(-)
 
  diff --git a/hw/virtio-console.c b/hw/virtio-console.c
  index 4440784..be59558 100644
  --- a/hw/virtio-console.c
  +++ b/hw/virtio-console.c
  @@ -82,7 +82,6 @@ static int virtconsole_exitfn(VirtIOSerialPort *port)
   VirtConsole *vcon = DO_UPCAST(VirtConsole, port, port);
   
   if (vcon-chr) {
  -port-info-have_data = NULL;
   qemu_chr_close(vcon-chr);
   }
 
 Discussed with Amit over irc, I think that we are missing setup of
 have_data for non console devices, but that is a different bug that the
 one being fixed here.

Actually other virtio_serial devices will provide their own have_data,
like spice did earlier (now it's a chardev, so it uses this code
path).

I think the bug is that we should set have_data regardless of a chardev
backend and call qemu_chr_write() in have_data only if a chardev
exists.

Amit

[Qemu-devel] Re: [PATCH] vl.c: Fix compilation failure if CONFIG_SDL isn't defined

[Jes Sorensen]

On 03/23/11 14:40, Peter Maydell wrote:
 Fix a compilation failure if CONFIG_SDL isn't defined (gcc complained
 that the label 'invalid_display' wasn't used).
 
 Signed-off-by: Peter Maydell peter.mayd...@linaro.org

Acked-by: Jes Sorensen jes.soren...@redhat.com

[Qemu-devel] Re: [PATCH 5/7] virtio-serial: Don't clear -have_data() pointer after unplug

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 After a port unplug operation, the port-info-have_data() pointer was
 set to NULL.  The problem is, the -info struct is shared by all ports,
 effectively disabling writes to other ports.

 Reported-by: juzhang juzh...@redhat.com
 Signed-off-by: Amit Shah amit.s...@redhat.com
 ---
  hw/virtio-console.c |1 -
  1 files changed, 0 insertions(+), 1 deletions(-)

 diff --git a/hw/virtio-console.c b/hw/virtio-console.c
 index 4440784..be59558 100644
 --- a/hw/virtio-console.c
 +++ b/hw/virtio-console.c
 @@ -82,7 +82,6 @@ static int virtconsole_exitfn(VirtIOSerialPort *port)
  VirtConsole *vcon = DO_UPCAST(VirtConsole, port, port);
  
  if (vcon-chr) {
 -port-info-have_data = NULL;
  qemu_chr_close(vcon-chr);
  }

Discussed with Amit over irc, I think that we are missing setup of
have_data for non console devices, but that is a different bug that the
one being fixed here.

Later, Juan.

[Qemu-devel] Re: [PATCH 7/7] char: Prevent multiple devices opening same chardev

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 Prevent:

 -chardev socket,path=/tmp/foo,server,nowait,id=c0 \
 -device virtserialport,chardev=c0,id=vs0 \
 -device virtserialport,chardev=c0,id=vs1

 Reported-by: Mike Cao b...@redhat.com
 Signed-off-by: Amit Shah amit.s...@redhat.com

 @@ -197,6 +197,10 @@ void qemu_chr_add_handlers(CharDriverState *s,
 IOEventHandler *fd_event,
 void *opaque)
  {
 +if (!opaque) {
 +/* chr driver being released. */
 +s-assigned = 0;
 +}
  s-chr_can_read = fd_can_read;
  s-chr_read = fd_read;
  s-chr_event = fd_event;

I preffer to decide that a handler is empty when fd_can_read/fd_read and
fd_event are all NULL, and don't take into account the opaque handler.

This covers the case where opaque is NULL because state is implicit on
the other functions.

Later, Juan.

[Qemu-devel] Re: [PULL #7 0/7] virtio-serial fixes, enhancements

[Juan Quintela]

Amit Shah amit.s...@redhat.com wrote:
 Hello,

 This series fixes a few bugs reported against virtio-serial.  Please
 apply.

 The following changes since commit e0efb993b817564ef84e462ac1fe35f89b57ad7b:

   Fix conversions from pointer to int and vice versa (2011-03-20 21:39:23 
 +)

 are available in the git repository at:
   git://git.kernel.org/pub/scm/virt/qemu/amit/virtio-serial.git for-anthony

 Amit Shah (7):
   virtio-serial: Use a struct to pass config information from proxy
   virtio-serial: Disallow generic ports at id 0
   virtio-serial: Enable ioeventfd
   virtio-serial-bus: Simplify handle_output() function
   virtio-serial: Don't clear -have_data() pointer after unplug
   virtio-console: Keep chardev open for other users after hot-unplug
   char: Prevent multiple devices opening same chardev

  hw/qdev-properties.c   |7 ++-
  hw/virtio-console.c|   16 ++--
  hw/virtio-pci.c|   15 +--
  hw/virtio-serial-bus.c |   28 +++-
  hw/virtio-serial.h |5 +
  hw/virtio.h|3 ++-
  qemu-char.c|4 
  qemu-char.h|1 +
  8 files changed, 52 insertions(+), 27 deletions(-)

Reviewed-by: Juan Quintela quint...@redhat.com

Comment about have_data on mail for it, but it can be improved later.

[Qemu-devel] Re: [PULL #7 0/7] virtio-serial fixes, enhancements

[Amit Shah]

On (Wed) 23 Mar 2011 [14:31:09], Juan Quintela wrote:
 Reviewed-by: Juan Quintela quint...@redhat.com

Thanks!

Anthony, ping again for pulling this.

Amit

[Qemu-devel] Re: [PATCH 07/11] eeprom93xx: Use the new hack macro to avoid duplicate field names

[Juan Quintela]

Anthony Liguori anth...@codemonkey.ws wrote:
 On 03/23/2011 04:58 AM, Juan Quintela wrote:
 Anthony Liguorialigu...@us.ibm.com  wrote:
 I don't fully understand this hack business but we need field to be unique 
 so..

 Signed-off-by: Anthony Liguorialigu...@us.ibm.com
 ---
   hw/eeprom93xx.c |2 +-
   1 files changed, 1 insertions(+), 1 deletions(-)

 diff --git a/hw/eeprom93xx.c b/hw/eeprom93xx.c
 index cfa695d..f1d75ec 100644
 --- a/hw/eeprom93xx.c
 +++ b/hw/eeprom93xx.c
 @@ -114,7 +114,7 @@ static const VMStateInfo vmstate_hack_uint16_from_uint8 
 = {
   };

   #define VMSTATE_UINT16_HACK_TEST(_f, _s, _t)   \
 -VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, 
 uint16_t)
 +VMSTATE_SINGLE_TEST_HACK(_f, _s, _t, 0, 
 vmstate_hack_uint16_from_uint8, uint16_t)

   static bool is_old_eeprom_version(void *opaque, int version_id)
   {

 Could we get away with just doing:

 VMSTATE_UNUSED(3),
 VMSTATE_UINT8(bar, ...),

Remember that we are supposed to be big/little endian safe.

 That's fully compatible on the wire and seems to be a clearer
 expression of exactly what the problem is.

if we are going to break big endian machines, I fully agree.

Later, Juan.

[Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Juan Quintela]

Peter Maydell peter.mayd...@linaro.org wrote:
 On 23 March 2011 00:16, Anthony Liguori aligu...@us.ibm.com wrote:
 +    if (old_version != new_version) {
 +        g_error(Version %d of device `%s' is available in QEMU, but schema 
 still reports %d, please update schema.\n,
 +                new_version, device, old_version);
 +    }

 Might be nice for these please update error messages to
 include a pointer to a docs file explaining in more detail
 how to do that?
 (also 80 char line ;-))

 diff --git a/vmstate/schema.json b/vmstate/schema.json
 new file mode 100644
 index 000..23483ab
 --- /dev/null
 +++ b/vmstate/schema.json
 @@ -0,0 +1,1176 @@
 +{
 +    cpu: {
 +        mcg_cap: uint64,
 +        a20_mask: int32,
 +        tsc_offset: uint64,

 This schema file appears to be board-specific (or at least
 x86-specific) -- shouldn't the cpu/board/whatever name
 be in the filename, so we have scope to expand the test
 to checking migration issues for other platforms too?

 (I don't care much about ARM migration breakages just at the
 moment but I suspect that it will be becoming more important
 by this time next year...)

 Also since this looks like an autogenerated file that's going
 to be going into version control maybe it should have a
 comment header at the top of the autogenerated, do not edit
 by hand! type.

I agree with you.  Just passing another argument to all programs telling
what we are talking about would be much better for this.

And we need (at least) x86_64  i386 (this ones are supposed to work).
ARM people are sending lots of vmstate changes, I guess/hope that
somebody is trying to get it working.

/me looks at Peter O:-), hint, hint, ...

Any idea if there are images for testing ARM?

Later, Juan.

[Qemu-devel] Re: [0/27] Implement emulation of pSeries logical partitions (v4)

[Alexander Graf]

On 23.03.2011, at 06:30, David Gibson wrote:

 This patch series adds a pseries machine to qemu, allowing it to
 emulate IBM pSeries logical partitions.  More specifically it
 implements the interface defined by the PowerPC Architecture Platform
 Requirements document (PAPR, or sPAPR for short).
 
 Along the way we add a bunch of support for more modern ppc CPUs than
 are currently supported.  It also makes some significant cleanups to
 the translation code for hash page table based ppc MMUs.

Please add a check on libfdt on all sources that require it:


agraf@lychee:/space/qemu ./configure --target-list=ppc-softmmu,ppc64-softmmu
make -j8
Install prefix/usr/local
BIOS directory/usr/local/share/qemu
binary directory  /usr/local/bin
config directory  /usr/local/etc
Manual directory  /usr/local/share/man
ELF interp prefix /usr/gnemul/qemu-%M
Source path   /space/qemu
C compilergcc
Host C compiler   gcc
CFLAGS-O2 -g 
QEMU_CFLAGS   -Werror -D_FORTIFY_SOURCE=2 -D_GNU_SOURCE 
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes 
-Wredundant-decls -Wall -Wundef -Wendif-labels -Wwrite-strings 
-Wmissing-prototypes -fno-strict-aliasing  -fstack-protector-all 
-Wmissing-include-dirs -Wempty-body -Wnested-externs -Wformat-security 
-Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration 
-Wold-style-definition -Wtype-limits
LDFLAGS   -Wl,--warn-common -g 
make  make
install   install
host CPU  ppc
host big endian   yes
target list   ppc-softmmu ppc64-softmmu
tcg debug enabled no
Mon debug enabled no
gprof enabled no
sparse enabledno
strip binariesyes
profiler  no
static build  no
-Werror enabled   yes
SDL support   yes
curses supportyes
curl support  no
check support no
mingw32 support   no
Audio drivers oss
Extra audio cards ac97 es1370 sb16 hda
Block whitelist   
Mixer emulation   no
VNC support   yes
VNC TLS support   no
VNC SASL support  yes
VNC JPEG support  yes
VNC PNG support   yes
VNC threadno
xen support   no
brlapi supportno
bluez  supportyes
Documentation yes
NPTL support  yes
GUEST_BASEyes
PIE user targets  no
vde support   no
IO thread no
Linux AIO support no
ATTR/XATTR support no
Install blobs yes
KVM support   yes
fdt support   no
preadv supportno
fdatasync yes
madvise   yes
posix_madvise yes
uuid support  yes
vhost-net support no
Trace backend nop
Trace output file trace-pid
spice support no
rbd support   no
xfsctl supportno
agraf@lychee:/space/qemu make -j8
  GEN   ppc-softmmu/config-devices.mak
  GEN   config-all-devices.mak
  GEN   qemu-options.texi
  GEN   qemu-monitor.texi
  GEN   qemu-tech.html
  GEN   qemu-img.1
  GEN   QMP/qmp-commands.txt
  GEN   trace.h
  GEN   config-host.h
  GEN   qemu-options.def
  GEN   trace.c
  GEN   qemu-doc.html
  GEN   qemu.1
  CCqemu-nbd.o
  CCqemu-tool.o
  CCqemu-error.o
  CCosdep.o
  CCoslib-posix.o
  CCtrace.o
  CCcutils.o
  CCcache-utils.o
  CCqemu-malloc.o
  CCqemu-option.o
  CCmodule.o
  CCasync.o
  CCnbd.o
  CCblock.o
  CCaio.o
  CCaes.o
  CCqemu-config.o
  CCposix-aio-compat.o
  CCblock/raw.o
  CCblock/cow.o
  CCblock/qcow.o
  CCblock/vdi.o
  CCblock/vmdk.o
  CCblock/cloop.o
  CCblock/dmg.o
  CCblock/bochs.o
  CCblock/vpc.o
  CCblock/vvfat.o
  CCblock/qcow2.o
  CCblock/qcow2-refcount.o
  CCblock/qcow2-cluster.o
  CCblock/qcow2-snapshot.o
  CCblock/qcow2-cache.o
  CCblock/qed.o
  CCblock/qed-gencb.o
  CCblock/qed-l2-cache.o
  CCblock/qed-table.o
  CCblock/qed-cluster.o
  CCblock/qed-check.o
  CCblock/parallels.o
  CCblock/nbd.o
  CCblock/blkdebug.o
  CCblock/sheepdog.o
  CCblock/blkverify.o
  CCblock/raw-posix.o
  CCqint.o
  CCqstring.o
  CCqdict.o
  CCqlist.o
  CCqfloat.o
  CCqbool.o
  CCqjson.o
  CCjson-lexer.o
  CCjson-streamer.o
  CCjson-parser.o
  CCqerror.o
  CCqemu-timer-common.o
  CCqemu-img.o
  CCqemu-io.o
  CCcmd.o
  CClibhw32/vl.o
  CCblockdev.o
  CCnet.o
  CCnet/queue.o
  CClibhw32/loader.o
  CCnet/checksum.o
  CCnet/util.o
  CCnet/socket.o
  CCnet/dump.o
  CCnet/tap.o
  CCnet/tap-linux.o
  CCnet/slirp.o
  CCreadline.o
  CCconsole.o
  CCcursor.o
  CCos-posix.o
  CCtcg-runtime.o
  CChost-utils.o
  CCirq.o
  CCioport.o
  CCinput.o
  CCptimer.o
  CClibhw32/virtio.o
  CClibhw32/virtio-console.o
  CCi2c.o
  CClibhw32/fw_cfg.o
  CClibhw32/pci.o
  CClibhw32/pci_bridge.o
  CCsmbus.o
  CCsmbus_eeprom.o
  CCeeprom93xx.o
  CCscsi-disk.o
  CClibhw32/msix.o
  CClibhw32/msi.o
  CCcdrom.o
  CClibhw32/pci_host.o
  CCscsi-generic.o
  

[Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Peter Maydell]

On 23 March 2011 14:19, Juan Quintela quint...@redhat.com wrote:
 Peter Maydell peter.mayd...@linaro.org wrote:
 ARM people are sending lots of vmstate changes, I guess/hope that
 somebody is trying to get it working.

 /me looks at Peter O:-), hint, hint, ...

Well, the main thing I care about currently (or did back before
Christmas which is when I sent a patchset to add save/restore
to a pile of ARM devices) is simple save-and-restore for debugging
use. The rest is just that patches don't get through code review
unless they get the vmstate stuff right, and I care about not
being rejected :-)

I think it's still the case that there are devices in
some of the ARM devboards with no save/restore support
at all. I would really prefer it if the default for a
device was I do not support this with the things like
USB where somebody has audited them as genuinely needing
no save/restore code explicitly marked as this is OK;
then we could easily determine what needed fixing and
not offer a broken facility to users.

 Any idea if there are images for testing ARM?

There are prebuilt images on Aurelien's website for
ARM and others, which is the simplest thing:
http://www.aurel32.net/info/debian_arm_qemu.php

-- PMM

[Qemu-devel] Re: [0/27] Implement emulation of pSeries logical partitions (v4)

[Alexander Graf]

On 23.03.2011, at 06:30, David Gibson wrote:

 This patch series adds a pseries machine to qemu, allowing it to
 emulate IBM pSeries logical partitions.  More specifically it
 implements the interface defined by the PowerPC Architecture Platform
 Requirements document (PAPR, or sPAPR for short).
 
 Along the way we add a bunch of support for more modern ppc CPUs than
 are currently supported.  It also makes some significant cleanups to
 the translation code for hash page table based ppc MMUs.

What's the magic to start a guest? I tried passing a disk which SLOF didn't 
detect (obviously - there's no IDE there). I also tried running a kernel 
directly with -kernel which gave me no output. How are you usually running your 
images?


Alex

Re: [Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Anthony Liguori]

On 03/23/2011 09:17 AM, Juan Quintela wrote:

Anthony Liguorianth...@codemonkey.ws  wrote:

On 03/23/2011 05:22 AM, Peter Maydell wrote:

On 23 March 2011 00:16, Anthony Liguorialigu...@us.ibm.com   wrote:

+if (old_version != new_version) {
+g_error(Version %d of device `%s' is available in QEMU, but schema still 
reports %d, please update schema.\n,
+new_version, device, old_version);
+}

Might be nice for these please update error messages to
include a pointer to a docs file explaining in more detail
how to do that?
(also80 char line ;-))

Ack.


diff --git a/vmstate/schema.json b/vmstate/schema.json
new file mode 100644
index 000..23483ab
--- /dev/null
+++ b/vmstate/schema.json
@@ -0,0 +1,1176 @@
+{
+cpu: {
+mcg_cap: uint64,
+a20_mask: int32,
+tsc_offset: uint64,

This schema file appears to be board-specific (or at least
x86-specific) -- shouldn't the cpu/board/whatever name
be in the filename, so we have scope to expand the test
to checking migration issues for other platforms too?

It's not really.  Every VMStateDescription that is builtin into the
tree is in the file.

That said, the only target where the CPU is currently described by
VMStateDescription is target-i386.

Right now the file is generated via i386-softmmu.  There may be a few
devices left out because they are either not compiled into
i386-softmmu or are target specific.

We could complicate things further by trying to run against every
target and then building a union of all target outputs but I'm not
sure it's worth the effort at this stage.


(I don't care much about ARM migration breakages just at the
moment but I suspect that it will be becoming more important
by this time next year...)

Also since this looks like an autogenerated file that's going
to be going into version control maybe it should have a
comment header at the top of the autogenerated, do not edit
by hand! type.

JSON doesn't support comments..  I can add comment parsing to our
parser though.

We need to fix the ordering problem.


Dunno what you mean by ordering.


Whatever schema we have should be good enough to allow:
- describe me this blob that contains the state for this device.


Schema for VMState is different than what's used for this test case 
here.  I agree, it's a harder problem than just what's being spit out 
here :-)



eepro100 at least is missing.  Althought I would vote to just change the
eepro100 naming to always use eepro100 or similar, and remove the
current hack of having to change the vmstate-name for each different
device.


I just ran into eepro100 and my head nearly exploded.

I set the name to be eepro100-base and then just added that once.  A 
better solution would be to separate out the fields such that we can 
have a bunch of VMStateDescriptions that all use the same fields.


I think we ought to merge VMStateDescription into DeviceInfo.  For 
compatibility, we probably need a vmstate_alias name since the device 
names don't always map 1-1 with the qdev names.  But this should 
eliminate the problem of reusing VMStateDescriptions for multiple devices.


Regards,

Anthony Liguori


Later, Juan.

[Qemu-devel] Re: [PATCH 07/11] eeprom93xx: Use the new hack macro to avoid duplicate field names

[Anthony Liguori]

On 03/23/2011 09:14 AM, Juan Quintela wrote:

Anthony Liguorianth...@codemonkey.ws  wrote:

On 03/23/2011 04:58 AM, Juan Quintela wrote:

Anthony Liguorialigu...@us.ibm.com   wrote:

I don't fully understand this hack business but we need field to be unique so..

Signed-off-by: Anthony Liguorialigu...@us.ibm.com
---
   hw/eeprom93xx.c |2 +-
   1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/eeprom93xx.c b/hw/eeprom93xx.c
index cfa695d..f1d75ec 100644
--- a/hw/eeprom93xx.c
+++ b/hw/eeprom93xx.c
@@ -114,7 +114,7 @@ static const VMStateInfo vmstate_hack_uint16_from_uint8 = {
   };

   #define VMSTATE_UINT16_HACK_TEST(_f, _s, _t)   \
-VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, 
uint16_t)
+VMSTATE_SINGLE_TEST_HACK(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, 
uint16_t)

   static bool is_old_eeprom_version(void *opaque, int version_id)
   {

Could we get away with just doing:

VMSTATE_UNUSED(3),
VMSTATE_UINT8(bar, ...),

Remember that we are supposed to be big/little endian safe.


We always send in network byte order (big endian) so this is safe.


That's fully compatible on the wire and seems to be a clearer
expression of exactly what the problem is.

if we are going to break big endian machines, I fully agree.


The migration protocol is always big endian, see:

void qemu_put_be32(QEMUFile *f, unsigned int v)
{
qemu_put_byte(f, v  24);
qemu_put_byte(f, v  16);
qemu_put_byte(f, v  8);
qemu_put_byte(f, v);
}

So this is completely safe.

Regards,

ANthony Liguori


Later, Juan.

Re: [Qemu-devel] Re: [0/27] Implement emulation of pSeries logical partitions (v4)

[Alexander Graf]

On 23.03.2011, at 15:45, Alexander Graf wrote:

 
 On 23.03.2011, at 06:30, David Gibson wrote:
 
 This patch series adds a pseries machine to qemu, allowing it to
 emulate IBM pSeries logical partitions.  More specifically it
 implements the interface defined by the PowerPC Architecture Platform
 Requirements document (PAPR, or sPAPR for short).
 
 Along the way we add a bunch of support for more modern ppc CPUs than
 are currently supported.  It also makes some significant cleanups to
 the translation code for hash page table based ppc MMUs.
 
 What's the magic to start a guest? I tried passing a disk which SLOF didn't 
 detect (obviously - there's no IDE there). I also tried running a kernel 
 directly with -kernel which gave me no output. How are you usually running 
 your images?

Ok, -kernel works. I was trying to load a non-kernel as kernel :).


Alex

[Qemu-devel] Re: [0/27] Implement emulation of pSeries logical partitions (v4)

[Alexander Graf]

On 23.03.2011, at 06:30, David Gibson wrote:

 This patch series adds a pseries machine to qemu, allowing it to
 emulate IBM pSeries logical partitions.  More specifically it
 implements the interface defined by the PowerPC Architecture Platform
 Requirements document (PAPR, or sPAPR for short).
 
 Along the way we add a bunch of support for more modern ppc CPUs than
 are currently supported.  It also makes some significant cleanups to
 the translation code for hash page table based ppc MMUs.

Even with libfdt installed it doesn't compile on my x86_64 box w/ ppc-softmmu 
and ppc64-softmmu targets. Maybe you should simply not build the pseries target 
on 32bit? It won't work there anyways, right?


Alex

  CCppc-softmmu/ppc_newworld.o
  CCppc-softmmu/spapr.o
  CCppc-softmmu/spapr_hcall.o
  CCppc-softmmu/spapr_rtas.o
  CCppc-softmmu/spapr_vio.o
cc1: warnings being treated as errors
/dev/shm/qemu/hw/spapr_hcall.c: In function ‘compute_tlbie_rb’:
/dev/shm/qemu/hw/spapr_hcall.c:92: error: right shift count = width of type
/dev/shm/qemu/hw/spapr_hcall.c: In function ‘h_protect’:
/dev/shm/qemu/hw/spapr_hcall.c:240: error: left shift count = width of type
/dev/shm/qemu/hw/spapr_hcall.c:241: error: left shift count = width of type
/dev/shm/qemu/hw/spapr_hcall.c: In function ‘h_register_vpa’:
/dev/shm/qemu/hw/spapr_hcall.c:407: error: large integer implicitly truncated 
to unsigned type
/dev/shm/qemu/hw/spapr_hcall.c:411: error: large integer implicitly truncated 
to unsigned type
/dev/shm/qemu/hw/spapr_hcall.c:411: error: duplicate case value
/dev/shm/qemu/hw/spapr_hcall.c:407: error: previously used here
/dev/shm/qemu/hw/spapr_hcall.c:415: error: large integer implicitly truncated 
to unsigned type
/dev/shm/qemu/hw/spapr_hcall.c:415: error: duplicate case value
/dev/shm/qemu/hw/spapr_hcall.c:407: error: previously used here
/dev/shm/qemu/hw/spapr_hcall.c:419: error: large integer implicitly truncated 
to unsigned type
/dev/shm/qemu/hw/spapr_hcall.c:419: error: duplicate case value
/dev/shm/qemu/hw/spapr_hcall.c:407: error: previously used here
/dev/shm/qemu/hw/spapr_hcall.c:423: error: large integer implicitly truncated 
to unsigned type
/dev/shm/qemu/hw/spapr_hcall.c:423: error: duplicate case value
/dev/shm/qemu/hw/spapr_hcall.c:407: error: previously used here
/dev/shm/qemu/hw/spapr_hcall.c:427: error: large integer implicitly truncated 
to unsigned type
/dev/shm/qemu/hw/spapr_hcall.c:427: error: duplicate case value
/dev/shm/qemu/hw/spapr_hcall.c:407: error: previously used here
make[1]: *** [spapr_hcall.o] Error 1
make[1]: *** Waiting for unfinished jobs
  CCppc-softmmu/xics.o
  GEN   config-target.h
/dev/shm/qemu/hw/spapr.c: In function ‘spapr_create_fdt’:
/dev/shm/qemu/hw/spapr.c:163: error: ‘struct CPUPPCState’ has no member named 
‘slb_nr’
/dev/shm/qemu/hw/spapr.c:172: error: ‘POWERPC_MMU_1TSEG’ undeclared (first use 
in this function)
/dev/shm/qemu/hw/spapr.c:172: error: (Each undeclared identifier is reported 
only once
/dev/shm/qemu/hw/spapr.c:172: error: for each function it appears in.)
/dev/shm/qemu/hw/xics.c: In function ‘xics_system_init’:
/dev/shm/qemu/hw/xics.c:444: error: ‘POWER7_INPUT_INT’ undeclared (first use in 
this function)
/dev/shm/qemu/hw/xics.c:444: error: (Each undeclared identifier is reported 
only once
/dev/shm/qemu/hw/xics.c:444: error: for each function it appears in.)
/dev/shm/qemu/hw/xics.c:448: error: ‘PPC970_INPUT_INT’ undeclared (first use in 
this function)
make[1]: *** [xics.o] Error 1
  GEN   ppc64-softmmu/hmp-commands.h
cc1: warnings being treated as errors
/dev/shm/qemu/hw/spapr_rtas.c: In function ‘rtas_start_cpu’:
/dev/shm/qemu/hw/spapr_rtas.c:153: error: large integer implicitly truncated to 
unsigned type
make[1]: *** [spapr.o] Error 1
make[1]: *** [spapr_rtas.o] Error 1

Re: [Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Peter Maydell]

On 23 March 2011 14:52, Anthony Liguori anth...@codemonkey.ws wrote:
 I think we ought to merge VMStateDescription into DeviceInfo.  For
 compatibility, we probably need a vmstate_alias name since the device names
 don't always map 1-1 with the qdev names.  But this should eliminate the
 problem of reusing VMStateDescriptions for multiple devices.

That's a feature, not a bug. Consider eg hw/pl110.c -- there
are two different DeviceInfo devices but since the underlying
implementation is the same you definitely don't want to have
two separate VMStateDescription structures to get out of sync.

-- PMM

[Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Juan Quintela]

Anthony Liguori anth...@codemonkey.ws wrote:
 On 03/23/2011 05:22 AM, Peter Maydell wrote:
 On 23 March 2011 00:16, Anthony Liguorialigu...@us.ibm.com  wrote:
 +if (old_version != new_version) {
 +g_error(Version %d of device `%s' is available in QEMU, but 
 schema still reports %d, please update schema.\n,
 +new_version, device, old_version);
 +}
 Might be nice for these please update error messages to
 include a pointer to a docs file explaining in more detail
 how to do that?
 (also80 char line ;-))

 Ack.

 diff --git a/vmstate/schema.json b/vmstate/schema.json
 new file mode 100644
 index 000..23483ab
 --- /dev/null
 +++ b/vmstate/schema.json
 @@ -0,0 +1,1176 @@
 +{
 +cpu: {
 +mcg_cap: uint64,
 +a20_mask: int32,
 +tsc_offset: uint64,
 This schema file appears to be board-specific (or at least
 x86-specific) -- shouldn't the cpu/board/whatever name
 be in the filename, so we have scope to expand the test
 to checking migration issues for other platforms too?

 It's not really.  Every VMStateDescription that is builtin into the
 tree is in the file.

 That said, the only target where the CPU is currently described by
 VMStateDescription is target-i386.

 Right now the file is generated via i386-softmmu.  There may be a few
 devices left out because they are either not compiled into
 i386-softmmu or are target specific.

 We could complicate things further by trying to run against every
 target and then building a union of all target outputs but I'm not
 sure it's worth the effort at this stage.

 (I don't care much about ARM migration breakages just at the
 moment but I suspect that it will be becoming more important
 by this time next year...)

 Also since this looks like an autogenerated file that's going
 to be going into version control maybe it should have a
 comment header at the top of the autogenerated, do not edit
 by hand! type.

 JSON doesn't support comments..  I can add comment parsing to our
 parser though.

We need to fix the ordering problem.

Whatever schema we have should be good enough to allow:
- describe me this blob that contains the state for this device.

eepro100 at least is missing.  Althought I would vote to just change the
eepro100 naming to always use eepro100 or similar, and remove the
current hack of having to change the vmstate-name for each different
device.

Later, Juan.

Re: [Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Jan Kiszka]

On 2011-03-23 16:00, Peter Maydell wrote:
 On 23 March 2011 14:52, Anthony Liguori anth...@codemonkey.ws wrote:
 I think we ought to merge VMStateDescription into DeviceInfo.  For
 compatibility, we probably need a vmstate_alias name since the device names
 don't always map 1-1 with the qdev names.  But this should eliminate the
 problem of reusing VMStateDescriptions for multiple devices.
 
 That's a feature, not a bug. Consider eg hw/pl110.c -- there
 are two different DeviceInfo devices but since the underlying
 implementation is the same you definitely don't want to have
 two separate VMStateDescription structures to get out of sync.

Yep. i8254/apic/ioapic vs. (upcoming) i8254-kvm/apic-kvm/ioapic-kvm will
provide further use cases.

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux

[Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Juan Quintela]

Peter Maydell peter.mayd...@linaro.org wrote:
 On 23 March 2011 14:19, Juan Quintela quint...@redhat.com wrote:
 Peter Maydell peter.mayd...@linaro.org wrote:
 ARM people are sending lots of vmstate changes, I guess/hope that
 somebody is trying to get it working.

 /me looks at Peter O:-), hint, hint, ...

 Well, the main thing I care about currently (or did back before
 Christmas which is when I sent a patchset to add save/restore
 to a pile of ARM devices) is simple save-and-restore for debugging
 use. The rest is just that patches don't get through code review
 unless they get the vmstate stuff right, and I care about not
 being rejected :-)

 I think it's still the case that there are devices in
 some of the ARM devboards with no save/restore support
 at all. I would really prefer it if the default for a
 device was I do not support this with the things like
 USB where somebody has audited them as genuinely needing
 no save/restore code explicitly marked as this is OK;
 then we could easily determine what needed fixing and
 not offer a broken facility to users.

I agree, but that means (again), review of all devices to change the
defaults.  It is on my ToDo list (but my ToDo list is huge :-(

 Any idea if there are images for testing ARM?

 There are prebuilt images on Aurelien's website for
 ARM and others, which is the simplest thing:
 http://www.aurel32.net/info/debian_arm_qemu.php

That images don't migrate for me at all.  Guest got hung after
migration, at least some state (probably irq's) are not passed
correctly.

Later, Juan.

Re: [Qemu-devel] Re: [0/27] Implement emulation of pSeries logical partitions (v4)

[Alexander Graf]

On 23.03.2011, at 15:55, Alexander Graf wrote:

 
 On 23.03.2011, at 15:45, Alexander Graf wrote:
 
 
 On 23.03.2011, at 06:30, David Gibson wrote:
 
 This patch series adds a pseries machine to qemu, allowing it to
 emulate IBM pSeries logical partitions.  More specifically it
 implements the interface defined by the PowerPC Architecture Platform
 Requirements document (PAPR, or sPAPR for short).
 
 Along the way we add a bunch of support for more modern ppc CPUs than
 are currently supported.  It also makes some significant cleanups to
 the translation code for hash page table based ppc MMUs.
 
 What's the magic to start a guest? I tried passing a disk which SLOF didn't 
 detect (obviously - there's no IDE there). I also tried running a kernel 
 directly with -kernel which gave me no output. How are you usually running 
 your images?
 
 Ok, -kernel works. I was trying to load a non-kernel as kernel :).

-drive ...if=scsi did the trick. It might be good to document all this 
somewhere :)


Alex

[Qemu-devel] [PATCH] vl.c: Fix compilation failure if CONFIG_SDL isn't defined

[Peter Maydell]

Fix a compilation failure if CONFIG_SDL isn't defined (gcc complained
that the label 'invalid_display' wasn't used).

Signed-off-by: Peter Maydell peter.mayd...@linaro.org
---
 vl.c |   13 +++--
 1 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/vl.c b/vl.c
index dbb927d..c387f2b 100644
--- a/vl.c
+++ b/vl.c
@@ -1575,7 +1575,7 @@ static DisplayType select_display(const char *p)
 } else if (strstart(opts, off, nextopt)) {
 no_frame = 1;
 } else {
-goto invalid_display;
+goto invalid_sdl_args;
 }
 } else if (strstart(opts, ,alt_grab=, nextopt)) {
 opts = nextopt;
@@ -1584,7 +1584,7 @@ static DisplayType select_display(const char *p)
 } else if (strstart(opts, off, nextopt)) {
 alt_grab = 0;
 } else {
-goto invalid_display;
+goto invalid_sdl_args;
 }
 } else if (strstart(opts, ,ctrl_grab=, nextopt)) {
 opts = nextopt;
@@ -1593,7 +1593,7 @@ static DisplayType select_display(const char *p)
 } else if (strstart(opts, off, nextopt)) {
 ctrl_grab = 0;
 } else {
-goto invalid_display;
+goto invalid_sdl_args;
 }
 } else if (strstart(opts, ,window_close=, nextopt)) {
 opts = nextopt;
@@ -1602,10 +1602,12 @@ static DisplayType select_display(const char *p)
 } else if (strstart(opts, off, nextopt)) {
 no_quit = 1;
 } else {
-goto invalid_display;
+goto invalid_sdl_args;
 }
 } else {
-goto invalid_display;
+invalid_sdl_args:
+fprintf(stderr, Invalid SDL option string: %s\n, p);
+exit(1);
 }
 opts = nextopt;
 }
@@ -1642,7 +1644,6 @@ static DisplayType select_display(const char *p)
 } else if (strstart(p, none, opts)) {
 display = DT_NONE;
 } else {
-invalid_display:
 fprintf(stderr, Unknown display type: %s\n, p);
 exit(1);
 }
-- 
1.7.1

[Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Peter Maydell]

On 23 March 2011 15:13, Juan Quintela quint...@redhat.com wrote:
 Peter Maydell peter.mayd...@linaro.org wrote:
 There are prebuilt images on Aurelien's website for
 ARM and others, which is the simplest thing:
 http://www.aurel32.net/info/debian_arm_qemu.php

 That images don't migrate for me at all.  Guest got hung after
 migration, at least some state (probably irq's) are not passed
 correctly.

Yeah, I said they were probably buggy. The only thing I've
ever tested is vmsave/restore for versatilepb, and that was
a few months ago now.

-- PMM

[Qemu-devel] Re: [PATCH 11/11] test-vmstate: add test case to verify we don't change VMState

[Juan Quintela]

Anthony Liguori anth...@codemonkey.ws wrote:
 On 03/23/2011 09:17 AM, Juan Quintela wrote:
 Anthony Liguorianth...@codemonkey.ws  wrote:
 We need to fix the ordering problem.

 Dunno what you mean by ordering.

vmstate:

static const VMStateDescription vmstate_cpu = {
.name = cpu,
.version_id = CPU_SAVE_VERSION,
.minimum_version_id = 3,
.minimum_version_id_old = 3,
.pre_save = cpu_pre_save,
.post_load = cpu_post_load,
.fields  = (VMStateField []) {
VMSTATE_UINTTL_ARRAY(regs, CPUState, CPU_NB_REGS),
VMSTATE_UINTTL(eip, CPUState),
VMSTATE_UINTTL(eflags, CPUState),
VMSTATE_UINT32(hflags, CPUState),
/* FPU */


vs

dump

cpu: {
mcg_cap: uint64, 
a20_mask: int32, 
tsc_offset: uint64, 
idt: {
flags: uint32, 
limit: uint32, 
selector: uint32, 
base: uint32, 
__version__: 1
}, 
intercept_cr_write: uint16, 
nmi_injected: uint8, 


You see that they are not in same order, then I can't use the schema to
read an arbitrary savevm image.  I think that ordering should be
preserved, makes schema much, much more useful.


Once told that, I think that doing a big schema is just wrong, we should
do an schema for device (or at least for architecture).  And no
hardcoded names (as they are today).  It is just trivial to run it for
x86_64-softmmu/i386-softmmu (the things that should work nowadays).

That way, downstreams can use it for its own minimal machines.


 Whatever schema we have should be good enough to allow:
 - describe me this blob that contains the state for this device.

 Schema for VMState is different than what's used for this test case
 here.  I agree, it's a harder problem than just what's being spit out
 here :-)

It should be the same IMHO, it will not complicate anything here, and
just make it more useful.

 eepro100 at least is missing.  Althought I would vote to just change the
 eepro100 naming to always use eepro100 or similar, and remove the
 current hack of having to change the vmstate-name for each different
 device.

 I just ran into eepro100 and my head nearly exploded.

Being there, know the feeling.

 I set the name to be eepro100-base and then just added that once.  A
 better solution would be to separate out the fields such that we can
 have a bunch of VMStateDescriptions that all use the same fields.

 I think we ought to merge VMStateDescription into DeviceInfo.  For
 compatibility, we probably need a vmstate_alias name since the device
 names don't always map 1-1 with the qdev names.  But this should
 eliminate the problem of reusing VMStateDescriptions for multiple
 devices.

Agreed with that.

Later, Juan.

Re: [Qemu-devel] [PATCH v23 00/11] usb-ccid

[Hans de Goede]

Ack Series

Acked-by: Hans de Goede hdego...@redhat.com

On 03/23/2011 02:19 PM, Alon Levy wrote:

This patchset adds three new devices, usb-ccid, ccid-card-passthru and
ccid-card-emulated, providing a CCID bus, a simple passthru protocol
implementing card requiring a client, and a standalone emulated card.

It also introduces a new directory libcaccard with CAC card emulation,
CAC is a type of ISO 7816 smart card.

Tree for pull: git://anongit.freedesktop.org/~alon/qemu usb_ccid.v23

v22-v23 changes:
  * libcacard
   * configure fixes: (reported by Stefan Hajnoczi)
* test a = b, not a == b (second isn't portable)
* quote $source_path in case it contains spaces
 - this doesn't really help since there are many other places
   that need similar fixes, not introduced by this patch.

v21-v22 changes:
  * libcacard:
   * fix configure to not link libcacard if nss not found
  (reported by Stefan Hajnoczi)
   * fix vscclient linkage with simpletrace backend
  (reported by Stefan Hajnoczi)
   * card_7816.c: add missing break in ERROR_DATA_NOT_FOUND
  (reported by William van de Velde)

v20-v21 changes:
  * all: cosmetics
  * libcacard, ccid-card-passthru:
   * use qemu-{malloc,free} and qemu-thread, error_report
  * libcacard:
   * split to multiple patches

v19-v20 changes:
  * checkpatch.pl. Here are the remaining errors with explanation:
   * ignored 5 macro errors of the type
ERROR: Macros with complex values should be enclosed in parenthesis
because fixing them breaks current code, if it really bothers someone
I can fix it.
* four of them are in libcacard/card_7816t.h:
/* give the subfields a unified look */
..
#define a_cla a_header-ah_cla /* class */
#define a_ins a_header-ah_ins /* instruction */
#define a_p1 a_header-ah_p1   /* parameter 1 */
#define a_p2 a_header-ah_p2   /* parameter 2 */
* and the fifth:
#4946: FILE: libcacard/vcardt.h:31:
+#define VCARD_ATR_PREFIX(size) 0x3b, 0x66+(size), 0x00, 0xff, \
+   'V', 'C', 'A', 'R', 'D', '_'
   * Ignored this warning since I couldn't figure it out, and it's a test
file:
WARNING: externs should be avoided in .c files
#2343: FILE: libcacard/link_test.c:7:
+VCardStatus cac_card_init(const char *flags, VCard *card,

v18-v19 changes:
  * more merges, down to a single digit number of patches.
  * drop enumeration property, use string.
  * rebased (trivial)

v17-v18 changes:
  * merge vscard_common.h patches.
  * actually provide a tree to pull.

v16-v17 changes:
  * merged all the v15-v16 patches
  * merged some more wherever it was easy (all same file commits).
  * added signed off by to first four patches
  * ccid.h: added copyright, removed underscore in defines, and replaced
  non C89 comments

v15-v16 changes:
  * split vscard_common introducing patch for ease of review
  * sum of commit logs for the v15-v16 commits: (whitespace fixes
 removed for space, see original commit messages in later patches)
   * usb-ccid:
* fix abort on client answer after card remove
* enable migration
* remove side affect code from asserts
* return consistent self-powered state
* mask out reserved bits in ccid_set_parameters
* add missing abRFU in SetParameters (no affect on linux guest)
   * vscard_common.h protocol change:
* VSCMsgInit capabilities and magic
* removed ReaderResponse, will use Error instead with code==VSC_SUCCESS.
* added Flush and FlushComplete, remove Reconnect.
* define VSCARD_MAGIC
* added error code VSC_SUCCESS.
   * ccid-card-passthru
* return correct size
* return error instead of assert if client sent too large ATR
* don't assert if client sent too large a size, but add asserts for indices 
to buffer
* reset vscard_in indices on chardev disconnect
* handle init from client
* error if no chardev supplied
* use ntoh, hton
* eradicate reader_id_t
* remove Reconnect usage (removed from VSCARD protocol)
* send VSC_SUCCESS on card insert/remove and reader add/remove
   * ccid-card-emulated
* fix error reporting in initfn

v14-v15 changes:
  * add patch with --enable-smartcard and --disable-smartcard and only
   disable ccid-card-emulated if nss not found.
  * add patch with description strings
  * s/libcaccard/libcacard/ in docs/ccid.txt

v13-v14 changes:
  - support device_del/device_add on ccid-card-* and usb-ccid
  * usb-ccid:
   * lose card reference when card device deleted
   * check slot number and deny adding a slot if one is already added.
  * ccid-card-*: use qdev_simple_unplug_cb in both emulated and passthru ccid 
cards,
the exitfn already takes care of triggering card removal in the usb dev.
  * libcacard:
   * remove double include of config-host.mak
   * add replay of card events to libcacard to support second and more emulation
   * don't initialize more then once (doesn't support it right now, so one
thread, NSS thread, is left when device_del is done)
   * 

[Qemu-devel] Re: [PATCH] virtio-serial: don't crash on invalid input

[Amit Shah]

On (Tue) 22 Mar 2011 [18:32:50], Michael S. Tsirkin wrote:
 Fix crash on invalid input in virtio-serial.
 Discovered by code review, untested.
 
 Signed-off-by: Michael S. Tsirkin m...@redhat.com

Acked-by: Amit Shah amit.s...@redhat.com

Amit