Re: [Qemu-devel] [PATCH 1/8] spec: add qcow2-dirty-bitmaps specification

[Kevin Wolf]

Am 11.06.2015 um 18:30 hat John Snow geschrieben:
 On 06/11/2015 06:25 AM, Vladimir Sementsov-Ogievskiy wrote:
  On 10.06.2015 18:34, Kevin Wolf wrote:
  Am 08.06.2015 um 17:21 hat Vladimir Sementsov-Ogievskiy geschrieben:
  +=== Bitmap table ===
  +
  +A directory of all bitmaps is stored in the bitmap table, a
  contiguous area in
  +the image file, whose starting offset and length are given by the
  header fields
  +dirty_bitmaps_offset and nb_dirty_bitmaps. The entries of the bitmap
  table have
  +variable length, depending on the length of name and extra data.
  +
  +Bitmap table entry:
  +
  +Byte 0 -  7:Offset into the image file at which the L1 table
  for the
  +bitmap starts. Must be aligned to a cluster
  boundary.
  +
  + 8 - 11:Number of entries in the L1 table of the bitmap
  Worth using 64 bits here? This can only cover 4 * 512 GB = 2 TB for the
  smallest possible cluster size. Though it's 65536 * 512 = 32 PB for the
  default, which might be enough for a while.
 
  +12 - 15:Bitmap granularity in bytes
  +
  +16 - 23:Bitmap size in sectors
  Please don't use sectors, that's a meaningless unit. Bytes is better.
  Just bad description. Actually it is ~ (number of bits in bitmap *
  granularity), and it is corresponding to number of sectors in the image.
 
 In defense of this, it does happen to be sectors, but what it /really/
 represents is the virtual addressable range of the bitmap (its 'size'),
 which just-so-happens to be a sector bitmap.

So not the size of the bitmap, but the size of (range in) the image that
is covered by the bitmap?

 We could just remove the word sectors entirely, and just flatly call
 it the bitmap size -- but this does reveal the internal nature of the
 block layer, which uses sector bitmaps.
 
 If you wish, we can rework this field to use bytes and just convert on
 every load/store into the format that we actually require. I suppose
 it'd match the QMP interface in that way.

Internally we can do whatever we want, but what is stored in the image
format can't be changed later on, so it should be kept as generic as
possible.

How about number of bits in the bitmap as the unit for the size? And
possibly require that it's a multiple of 8.

Kevin

[Qemu-devel] [PATCH v2 6/6] [testing-only] virtio-vga: add vgabios binary

[Gerd Hoffmann]

Add prebuilt vgabios-virtio.bin binary.

Signed-off-by: Gerd Hoffmann kra...@redhat.com
---
 pc-bios/vgabios-virtio.bin | Bin 0 - 38912 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 pc-bios/vgabios-virtio.bin

diff --git a/pc-bios/vgabios-virtio.bin b/pc-bios/vgabios-virtio.bin
new file mode 100644
index 
..ef283a2137e17cf5e818eb347a7b5ab77cb8aeef
GIT binary patch
literal 38912
zcmeIbeSB2axi7wF@*all0Rs*!c+kfg-+CB(9uL=z?Y(X%Mm0@U{kRDwNEScnl#l
ziDn3_T2WgevY{pU(V-xtoKMcUfyhRlGr3@ihvfQp%`8YGftWWu#kk9-0$OwdVz6
zpG#Vf1lq!-IDCR_IlQ{p7pF}J#TC6Sop?wLsJU+T~YmJ-xa2u0@(C6#hSpg6eG
zns`Uc)wJO@@AX1|yYqBpNRzY;GQzw)v#i6`m*#9oOG_U-GN#JFQrZwPwzwmd6
z$HcNGv%7k6nI44vQ*(e=Gn5$A{x7_BCSbe1?mGcg@2;OBa6Ylh?N1=1S0i9uW74
zs;(a4Z+=NsHDBKlHvfBu*b6GO`X+Jz%-X5dc$n$WsL{~L4`RA`M4%)5=l{qf{EPa8
zzevhv}7{6bNwtJQzT}MVOjB!j#|V5f_(PJfdoRrAiNZvxDsRQRx)#qC~OVXG
zT78E{j4ZNxL;?ZUMFHg+CBWxZB5N$BzjA8IakU+90Y^`k}UkmQ~urmFj9;u)Bt
zX(M9uiII^JP56(9tP!EVcF`tPg{lmoJhMQHouQ54TKjS6q`TL{+mwE%RUzV7P0v
zx1Pa`vks$W6Iv1vkBG6VRep!qd_cAG9TkT{TMyO;#BS|54gK|i!j?e8z#k?I4vCk
zQc?BZBh}U)?VrkIa-owN+I0)z@3ZPkC#EcBh{UlNB-150uP3Y{;BA9f~Sa*`Ut
z7O^i0cW9qxBnB-*oGon9_sdP!JPo7XCwMe7u1sr5h|?-EFQtBv?9?_cLXF}u3
zfn@JkQFX!$-0#b|+e`0jKNTOH;O140BMrg?{`waMF^`QRSL{ikZeJ7^2kuklH0
zk}#b`FCVQwC3aJD;Xf-rcZFqBY0g`*e6VbXxxOx`;5lJ)JGR;mjOc~Fnmg`Q6+Z
z1SSaJcMaeXVQK^KtOoDEwz;A%NIqw3?VQH6ecHi-f-wxU{*RExE~_+WcQ)bOECE
zbx@Q-58FMWapU#`04DYfMELbUxS$LTA0DYit4)3M0)Xv6?7jFrq6__3GxIoKOlB4
zd(*S!5liJ@f?hqzTsfGiSN|S2vtIr0rmY9j*tZ=lcu6!KPr$703P5HOl`y;wZbH;Q
za|c~t0g-lG#9UfXOOzOe3a@){PKZ6|CcV^d$mi60hZ*UE|5Qp80?M_gV@SLc)jH
zgP8B*No^D#ofZ#ZTE!unxxO^scU4$zbQTnifi+fCUopA|d}JfE2zaUc`dk2G_n
zw}H6AH)-0wpr!RKNG604`1{16eqrh$kr-xf*7@G_h--YW0pJ25tD~;kz`VWg%7KX
zbig*vku`a-YKFc;JuOGn0*sP)g`l!7J}KA9=1bUiLArnR4H0JQbpEkCmo6kRI
zT=$zqF~6Bs%b}BEevAH#fJi$i(%M8?2fFsX?y0@|mhn!`LCl$Q*RZS8aSfRj=_6
zhc;rx@H)lRWOZWFcYbdg!0Yl~cL!GtVc^Lk5B$KCR$WTeZKWDjb}T}EvELcXgqb
z4U(+W)RI2Sf72a{8DI!iEuq)pt^EM_(K3|1lZnGo^L-O5`gMH-+88t6sCogodq9
zH3n*fG}AfE7QlROg5mDq@F0ojgOf#72lUR3urJ8m0bhckuY2c!y@3Ko;7GInV!+
z3lBmk6D;s7OvDo;A5$t!2i?K{H7N4J2dKs4QDq_)bDFh+K_mOhC~1y1V%=Zj}EcQ
zZd+d$wZ?5br=u*EzGJZ9|)VpMPLArHSbj6AArCU3dQjbdM|o9uo#)Iv@TF%ep9L
zS977^=jz*`AqoQ)@J0{okhL}Mt$YjYlkB@%TL%b{yv99u}#D;vTY%Cyz7X+uRH
zEq#m=`U6G@nlavR0bNbt=_|$F_nLSZnLgwy*mzw-HBjc_*B8;3Bk?sA@Aym|n;+
zRy%eB?uS`!yR_)oo=fSm(2N{Q0Ln{zaz@bmieEIZi7?r?Y3NtXy!64WxP%%
zAnx;zLnSx?UYvteXqj%nLT3S|sTScWjQU_vg?tmLQSWfGPcH3*U-?r?O_ZIQ4
zwrymjp7bHv0N7dl+8FfI)7aAS$zkr?Pnz3P`qqqF=zQfN4WWNqKVAyiM`H1?~e9v
zu_qm5zHaiGf0GgAN3z^fWRd8a7(gMDPC*KD}87K%jXWH%0?%+ZN|^tQEf(Bz%A
zegfu`wCv9Vte3FJObyToyTL3ioCyllEIGsvP(8eQ7l55R6~YdEh6XTWXV-2lGp
zbLDZ9Uh}+G+X$OD4V86wK+Hx`HVQlq?DGxi)s76MZ75aTHHO~zULdGYb7Q3kd
zss?QT^sAo-zeUtB~28J@G7oq9%%?eg*CnzV#`ZlWq|7L6xiZu(SvYS!4FKfrG
zn${dnKvQ?H6FL;4+976W@Jk?Q=@7aOC3ItYM_(%+xr5Ea=A!rnrN@1dbN5hiO7v
zvegQ~6;KepqDLhg5iFUH6(IKh@fR2BwDto^@zK=A$nbGFW4hUYwH2nC9y9T!(_c
z=?ClFK?lGaw~rV8_u)jok6|{M8a)2Oo^BZ7zidyT_ntZ`qV1x;)HW4gOq3rti$`
z03GEL2{4~s2~bVag0dOvt8W24gmK2X6;0{qb)P*Cf=t3ybW`47~^sW_kM}DuYMQH
zIVBk$ZSiERgiD^AXQ%^pd*a1pC(|qfvf}=cVFNgQ=nSzLFAJAga1y7n;SMmf~9
zyn9E0MscaOqi08BcWtwL1uK22rxr|qjb{4em6}3tmIy5PmLjE{yxC=)Pi;K%qMNf
z-Nm;+cNeJ*`V$vnZ#!Vqb_9CR=fxh?JX;Va46-7-Xy1+lsEKx0(yy8Dj5#BBZ``
zrlSR-ttW9Zidh#hzG()3^qi((gN`?m_RO#zVm*#Lg3buV9OUY1p^K4VD*T26!Z*u
zYV#)GK8X7y;tB3H(6J0QuRDeQp#dUYOe0Xxow?3GLxRo=M%!81Ofc_^@Y-dxEF7
z@GIOW;XaJJ4fhc;)cVeQi0Y;)n9??AA{=A2z!Wyf7f7S(jZR|^Ie_7^tqUSNq_!%
zlC+%rPvT7MID1=g}*v6OlJS%9co9A2pA%06eo1P`~sBE!@06U(3`~Orb@hT
z5RHSFs)JR7IUAD2?i{?rq@TynIsBachK_aBNECB6^}d-0tXkUVQnr+2f@Wcmx5`
zU|MM!`XRY@Hq5P?cVp)#7qlpZ8KmJy^A+x;BNL7Z+cAJ=kvyRt+Y5uP*;K?kV0e
ztcHSickq8e$w4CpZCIiJNSYsX3FAbRfPJZ+V!evk;Rp2+c~h-4gzSL4mYG^ry
zZW)Pn?ES5^ZRAU^YXdhR(VGaDpM=@*Byh9SEQ?vJrKscKvDM_90^U7h+r^MtM?~
zVK=#QAi?W^54jh1N()a!r8~J2^P%rNyaCiTr9eF)qCObqRBh96zBRxP4-6|41
zfR;g!u2l}ElwNDRCjJ+bAKDhWymFHHK1a+o5m@`28YR}=3rvgVm}^X}8?ahnRw
zMIuLLjZ6n?Lb(24hjItF+3nlRCNftkp~#ThmdIE%}YtS*Btg{!W@(L!oE!Jjt~C=
z2AeMHn*`n+Y#ON!_^ySsi@`Q+zk-y#R6QN;;8S?l$g+Ep)N%NF11nT392a0EH3z`|
z4(qe)2*^5Un4Nt@1C^kuwFX8r{J=2He4XbnbORAEe*k@bkf56o-@5H*kmBlWZQ
zLw2LS!GOsDogK!29(4zQ2KCvv-9lzZ_zyt%TVSQ=V)~2wvUysxdd^+5Pm}7yn@e
zo#0WQrF01`oW?G*q#|6(!2k9Yjr+SVqyj)u2|KVWt!aQ@DT-O~QzJHN;-koLu
z(hGeT8Ld|E42TT(;S%7`^DZ=}_ZasjJTxLIhMgj_q0%3mC{p^A%!WJoDpo=(Gjh)b
zG=b?NFII96d^NlYuwyXBiyhnR4mN;IjGKpFm^7?~V?O=a?8z)WkYDT-oq74J$=
zIZ{HbybWj+$uOt7z9a2Ai^FvhmsR$pzk7E8gWVF@Zf;ymqkeGs*(-ZZ5`C4}R@D
z3-^Q)M#zc5q0)Eui8P9!e0?)L{_oFo!**$xbqT)HmN9{5eJhA+Px3D-Vy92Jd_
zwn;|;Kzc7h?}MN#wVL%=wJ_@;wCE;hS`iomHAP+@@D2nM2!?T*w4;Cc2XKn%9zm
zEk-Ga9)LezSCHtbdnSVtHTtd*nv!c1{9I!Ghe_mOKj*an*eqAzE7A)`=Fl127*
ze1j6Gdps?PNbuDJd|!$zOgfg1^E~tr`T20%hicEgE8G(jDZ;bGcqZ2-@Jxb6@E
zbcJrSsiem#*=#Y730NS(DA9hPO(5#4JZ2k)dFMLZaT#9}le|L@)O%{z}=l2re
z^C9Ik2#skHd$_afkZm|2(mp{NrZ~I*AYV?WeEGhnQ4nZ-swmVD+3Me0dU`r12u6
zczsua9fUuFoQ!|tDe!Qz$G@@L)A*zA1iaozG0(;zX}xQr@s7TW1D=h+^KXdz2j9f
zoQ=V7hwAmGp~-RzDBQqvG=gm__Q?81#uwFEPkH@PuLGZqkT@DQlrOoH7SJl^3i
z;E7oj#PFFofbRib*KUy5EXlc}NdnMN%0mzQB6qSfSo|Iin}ifMZ56XE{^enBg8

[Qemu-devel] [PATCH v2 0/6] virtio-gpu: pci support bits.

[Gerd Hoffmann]

  Hi,

Here is the code to add virtio-pci support for the virtio-gpu.
This time it goes on top of master, all dependencies are merged
upstream meanwhile.  Yea!  The only missing bit to make this
fully functional is the seabios update which is needed for a
working vgabios.

I plan to send a pull req early next week for patches 1-5.

Patch 6 carries a vgabios binary, for testing convinience.
Note that rebuilding this from the current roms/seabios
submodule (rel-1.8.1) will *not* work, you'll need the
upcoming 1.8.2 seabios release for that.  Seabios update
pull request for this will follow after 1.8.2 is released,
and it will add the vgabios properly.

Gerd Hoffmann (6):
  virtio-gpu: fix error message
  virtio-gpu-pci: add virtio pci support
  virtio-vga: add virtio gpu device with vga compatibility
  virtio-vga: add '-vga virtio' support
  virtio-vga: add vgabios configuration
  [testing-only] virtio-vga: add vgabios binary

 Makefile   |   2 +-
 default-configs/x86_64-softmmu.mak |   1 +
 hw/display/Makefile.objs   |   2 +
 hw/display/vga-pci.c   |   8 +-
 hw/display/vga_int.h   |   6 ++
 hw/display/virtio-gpu-pci.c|  68 ++
 hw/display/virtio-gpu.c|   2 +-
 hw/display/virtio-vga.c| 175 +
 hw/isa/isa-bus.c   |   3 +
 hw/pci/pci.c   |   2 +
 hw/virtio/virtio-pci.h |  14 +++
 include/sysemu/sysemu.h|   2 +-
 pc-bios/vgabios-virtio.bin | Bin 0 - 38912 bytes
 qemu-options.hx|   4 +-
 roms/Makefile  |   2 +-
 roms/config.vga-virtio |   6 ++
 vl.c   |  13 +++
 17 files changed, 301 insertions(+), 9 deletions(-)
 create mode 100644 hw/display/virtio-gpu-pci.c
 create mode 100644 hw/display/virtio-vga.c
 create mode 100644 pc-bios/vgabios-virtio.bin
 create mode 100644 roms/config.vga-virtio

-- 
1.8.3.1

[Qemu-devel] [PATCH v2 3/6] virtio-vga: add virtio gpu device with vga compatibility

[Gerd Hoffmann]

This patch adds a virtio-vga device.  It is simliar to virtio-gpu-pci,
but it also adds in vga compatibility, so guests without native
virtio-gpu support can drive the device in vga mode.  It is compatible
with stdvga.

Written by Dave Airlie and Gerd Hoffmann.

Signed-off-by: Dave Airlie airl...@redhat.com
Signed-off-by: Gerd Hoffmann kra...@redhat.com
---
 default-configs/x86_64-softmmu.mak |   1 +
 hw/display/Makefile.objs   |   1 +
 hw/display/vga-pci.c   |   8 +-
 hw/display/vga_int.h   |   6 ++
 hw/display/virtio-vga.c| 175 +
 5 files changed, 187 insertions(+), 4 deletions(-)
 create mode 100644 hw/display/virtio-vga.c

diff --git a/default-configs/x86_64-softmmu.mak 
b/default-configs/x86_64-softmmu.mak
index 2f2955b..62575eb 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -7,6 +7,7 @@ CONFIG_QXL=$(CONFIG_SPICE)
 CONFIG_VGA_ISA=y
 CONFIG_VGA_CIRRUS=y
 CONFIG_VMWARE_VGA=y
+CONFIG_VIRTIO_VGA=y
 CONFIG_VMMOUSE=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
diff --git a/hw/display/Makefile.objs b/hw/display/Makefile.objs
index 26284a1..dd8ea76 100644
--- a/hw/display/Makefile.objs
+++ b/hw/display/Makefile.objs
@@ -37,3 +37,4 @@ common-obj-$(CONFIG_QXL) += qxl.o qxl-logger.o qxl-render.o
 
 obj-$(CONFIG_VIRTIO) += virtio-gpu.o
 obj-$(CONFIG_VIRTIO_PCI) += virtio-gpu-pci.o
+obj-$(CONFIG_VIRTIO_VGA) += virtio-vga.o
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 0ed44c7..1dfa331 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -204,10 +204,10 @@ static const MemoryRegionOps pci_vga_qext_ops = {
 .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-static void pci_std_vga_mmio_region_init(VGACommonState *s,
- MemoryRegion *parent,
- MemoryRegion *subs,
- bool qext)
+void pci_std_vga_mmio_region_init(VGACommonState *s,
+  MemoryRegion *parent,
+  MemoryRegion *subs,
+  bool qext)
 {
 memory_region_init_io(subs[0], NULL, pci_vga_ioport_ops, s,
   vga ioports remapped, PCI_VGA_IOPORT_SIZE);
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index fcfcc5f..40ba6a4 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -219,4 +219,10 @@ extern const uint8_t gr_mask[16];
 
 extern const MemoryRegionOps vga_mem_ops;
 
+/* vga-pci.c */
+void pci_std_vga_mmio_region_init(VGACommonState *s,
+  MemoryRegion *parent,
+  MemoryRegion *subs,
+  bool qext);
+
 #endif
diff --git a/hw/display/virtio-vga.c b/hw/display/virtio-vga.c
new file mode 100644
index 000..94f9d0e
--- /dev/null
+++ b/hw/display/virtio-vga.c
@@ -0,0 +1,175 @@
+#include hw/hw.h
+#include hw/pci/pci.h
+#include ui/console.h
+#include vga_int.h
+#include hw/virtio/virtio-pci.h
+
+/*
+ * virtio-vga: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_VGA virtio-vga
+#define VIRTIO_VGA(obj) \
+OBJECT_CHECK(VirtIOVGA, (obj), TYPE_VIRTIO_VGA)
+
+typedef struct VirtIOVGA {
+VirtIOPCIProxy parent_obj;
+VirtIOGPU  vdev;
+VGACommonState vga;
+MemoryRegion   vga_mrs[3];
+} VirtIOVGA;
+
+static void virtio_vga_invalidate_display(void *opaque)
+{
+VirtIOVGA *vvga = opaque;
+
+if (vvga-vdev.enable) {
+virtio_gpu_ops.invalidate(vvga-vdev);
+} else {
+vvga-vga.hw_ops-invalidate(vvga-vga);
+}
+}
+
+static void virtio_vga_update_display(void *opaque)
+{
+VirtIOVGA *vvga = opaque;
+
+if (vvga-vdev.enable) {
+virtio_gpu_ops.gfx_update(vvga-vdev);
+} else {
+vvga-vga.hw_ops-gfx_update(vvga-vga);
+}
+}
+
+static void virtio_vga_text_update(void *opaque, console_ch_t *chardata)
+{
+VirtIOVGA *vvga = opaque;
+
+if (vvga-vdev.enable) {
+if (virtio_gpu_ops.text_update) {
+virtio_gpu_ops.text_update(vvga-vdev, chardata);
+}
+} else {
+if (vvga-vga.hw_ops-text_update) {
+vvga-vga.hw_ops-text_update(vvga-vga, chardata);
+}
+}
+}
+
+static int virtio_vga_ui_info(void *opaque, uint32_t idx, QemuUIInfo *info)
+{
+VirtIOVGA *vvga = opaque;
+
+if (virtio_gpu_ops.ui_info) {
+return virtio_gpu_ops.ui_info(vvga-vdev, idx, info);
+}
+return -1;
+}
+
+static const GraphicHwOps virtio_vga_ops = {
+.invalidate = virtio_vga_invalidate_display,
+.gfx_update = virtio_vga_update_display,
+.text_update = virtio_vga_text_update,
+.ui_info = virtio_vga_ui_info,
+};
+
+/* VGA device wrapper around PCI device around virtio GPU */
+static void virtio_vga_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VirtIOVGA *vvga = VIRTIO_VGA(vpci_dev);
+VirtIOGPU *g = vvga-vdev;
+VGACommonState *vga = 

[Qemu-devel] [PULL 18/29] net/dp8393x: QOM'ify

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Laurent Vivier laur...@vivier.eu
Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/mips/mips_jazz.c| 12 ++--
 hw/net/dp8393x.c   | 83 ++
 include/hw/mips/mips.h |  5 ---
 3 files changed, 67 insertions(+), 33 deletions(-)

diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 29a13c0..648654e 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -273,8 +273,16 @@ static void mips_jazz_init(MachineState *machine,
 if (!nd-model)
 nd-model = g_strdup(dp83932);
 if (strcmp(nd-model, dp83932) == 0) {
-dp83932_init(nd, 0x80001000, 2, get_system_memory(),
- qdev_get_gpio_in(rc4030, 4), rc4030_dma_mr);
+qemu_check_nic_model(nd, dp83932);
+
+dev = qdev_create(NULL, dp8393x);
+qdev_set_nic_properties(dev, nd);
+qdev_prop_set_uint8(dev, it_shift, 2);
+qdev_prop_set_ptr(dev, dma_mr, rc4030_dma_mr);
+qdev_init_nofail(dev);
+sysbus = SYS_BUS_DEVICE(dev);
+sysbus_mmio_map(sysbus, 0, 0x80001000);
+sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(rc4030, 4));
 break;
 } else if (is_help_option(nd-model)) {
 fprintf(stderr, qemu: Supported NICs: dp83932\n);
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 0aff04f..51e728b 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -17,10 +17,10 @@
  * with this program; if not, see http://www.gnu.org/licenses/.
  */
 
-#include hw/hw.h
-#include qemu/timer.h
+#include hw/sysbus.h
+#include hw/devices.h
 #include net/net.h
-#include hw/mips/mips.h
+#include qemu/timer.h
 #include zlib.h
 
 //#define DEBUG_SONIC
@@ -139,9 +139,14 @@ do { printf(sonic ERROR: %s:  fmt, __func__ , ## 
__VA_ARGS__); } while (0)
 #define SONIC_ISR_PINT   0x0800
 #define SONIC_ISR_LCD0x1000
 
+#define TYPE_DP8393X dp8393x
+#define DP8393X(obj) OBJECT_CHECK(dp8393xState, (obj), TYPE_DP8393X)
+
 typedef struct dp8393xState {
+SysBusDevice parent_obj;
+
 /* Hardware */
-int it_shift;
+uint8_t it_shift;
 qemu_irq irq;
 #ifdef DEBUG_SONIC
 int irq_level;
@@ -150,7 +155,6 @@ typedef struct dp8393xState {
 int64_t wt_last_update;
 NICConf conf;
 NICState *nic;
-MemoryRegion *address_space;
 MemoryRegion mmio;
 
 /* Registers */
@@ -162,6 +166,7 @@ typedef struct dp8393xState {
 int loopback_packet;
 
 /* Memory access */
+void *dma_mr;
 AddressSpace as;
 } dp8393xState;
 
@@ -774,9 +779,9 @@ static ssize_t dp8393x_receive(NetClientState *nc, const 
uint8_t * buf,
 return size;
 }
 
-static void dp8393x_reset(void *opaque)
+static void dp8393x_reset(DeviceState *dev)
 {
-dp8393xState *s = opaque;
+dp8393xState *s = DP8393X(dev);
 timer_del(s-watchdog);
 
 s-regs[SONIC_CR] = SONIC_CR_RST | SONIC_CR_STP | SONIC_CR_RXDIS;
@@ -805,33 +810,59 @@ static NetClientInfo net_dp83932_info = {
 .receive = dp8393x_receive,
 };
 
-void dp83932_init(NICInfo *nd, hwaddr base, int it_shift,
-  MemoryRegion *address_space,
-  qemu_irq irq, MemoryRegion *dma_mr)
+static void dp8393x_instance_init(Object *obj)
 {
-dp8393xState *s;
+SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+dp8393xState *s = DP8393X(obj);
 
-qemu_check_nic_model(nd, dp83932);
+sysbus_init_mmio(sbd, s-mmio);
+sysbus_init_irq(sbd, s-irq);
+}
+
+static void dp8393x_realize(DeviceState *dev, Error **errp)
+{
+dp8393xState *s = DP8393X(dev);
 
-s = g_malloc0(sizeof(dp8393xState));
+address_space_init(s-as, s-dma_mr, dp8393x);
+memory_region_init_io(s-mmio, OBJECT(dev), dp8393x_ops, s,
+  dp8393x-regs, 0x40  s-it_shift);
+
+s-nic = qemu_new_nic(net_dp83932_info, s-conf,
+  object_get_typename(OBJECT(dev)), dev-id, s);
+qemu_format_nic_info_str(qemu_get_queue(s-nic), s-conf.macaddr.a);
 
-s-address_space = address_space;
-address_space_init(s-as, dma_mr, dp8393x-dma);
-s-it_shift = it_shift;
-s-irq = irq;
 s-watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s);
 s-regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
+}
 
-s-conf.macaddr = nd-macaddr;
-s-conf.peers.ncs[0] = nd-netdev;
+static Property dp8393x_properties[] = {
+DEFINE_NIC_PROPERTIES(dp8393xState, conf),
+DEFINE_PROP_PTR(dma_mr, dp8393xState, dma_mr),
+DEFINE_PROP_UINT8(it_shift, dp8393xState, it_shift, 0),
+DEFINE_PROP_END_OF_LIST(),
+};
 
-s-nic = qemu_new_nic(net_dp83932_info, s-conf, nd-model, nd-name, s);
+static void dp8393x_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
 
-qemu_format_nic_info_str(qemu_get_queue(s-nic), 

[Qemu-devel] [PULL 17/29] net/dp8393x: use dp8393x_ prefix for all functions

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/net/dp8393x.c | 80 +---
 1 file changed, 41 insertions(+), 39 deletions(-)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 5cc1e6b..0aff04f 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -183,7 +183,7 @@ static void dp8393x_update_irq(dp8393xState *s)
 qemu_set_irq(s-irq, level);
 }
 
-static void do_load_cam(dp8393xState *s)
+static void dp8393x_do_load_cam(dp8393xState *s)
 {
 uint16_t data[8];
 int width, size;
@@ -225,7 +225,7 @@ static void do_load_cam(dp8393xState *s)
 dp8393x_update_irq(s);
 }
 
-static void do_read_rra(dp8393xState *s)
+static void dp8393x_do_read_rra(dp8393xState *s)
 {
 uint16_t data[8];
 int width, size;
@@ -265,7 +265,7 @@ static void do_read_rra(dp8393xState *s)
 s-regs[SONIC_CR] = ~SONIC_CR_RRRA;
 }
 
-static void do_software_reset(dp8393xState *s)
+static void dp8393x_do_software_reset(dp8393xState *s)
 {
 timer_del(s-watchdog);
 
@@ -273,7 +273,7 @@ static void do_software_reset(dp8393xState *s)
 s-regs[SONIC_CR] |= SONIC_CR_RST | SONIC_CR_RXDIS;
 }
 
-static void set_next_tick(dp8393xState *s)
+static void dp8393x_set_next_tick(dp8393xState *s)
 {
 uint32_t ticks;
 int64_t delay;
@@ -289,7 +289,7 @@ static void set_next_tick(dp8393xState *s)
 timer_mod(s-watchdog, s-wt_last_update + delay);
 }
 
-static void update_wt_regs(dp8393xState *s)
+static void dp8393x_update_wt_regs(dp8393xState *s)
 {
 int64_t elapsed;
 uint32_t val;
@@ -304,33 +304,33 @@ static void update_wt_regs(dp8393xState *s)
 val -= elapsed / 500;
 s-regs[SONIC_WT1] = (val  16)  0x;
 s-regs[SONIC_WT0] = (val  0)   0x;
-set_next_tick(s);
+dp8393x_set_next_tick(s);
 
 }
 
-static void do_start_timer(dp8393xState *s)
+static void dp8393x_do_start_timer(dp8393xState *s)
 {
 s-regs[SONIC_CR] = ~SONIC_CR_STP;
-set_next_tick(s);
+dp8393x_set_next_tick(s);
 }
 
-static void do_stop_timer(dp8393xState *s)
+static void dp8393x_do_stop_timer(dp8393xState *s)
 {
 s-regs[SONIC_CR] = ~SONIC_CR_ST;
-update_wt_regs(s);
+dp8393x_update_wt_regs(s);
 }
 
-static void do_receiver_enable(dp8393xState *s)
+static void dp8393x_do_receiver_enable(dp8393xState *s)
 {
 s-regs[SONIC_CR] = ~SONIC_CR_RXDIS;
 }
 
-static void do_receiver_disable(dp8393xState *s)
+static void dp8393x_do_receiver_disable(dp8393xState *s)
 {
 s-regs[SONIC_CR] = ~SONIC_CR_RXEN;
 }
 
-static void do_transmit_packets(dp8393xState *s)
+static void dp8393x_do_transmit_packets(dp8393xState *s)
 {
 NetClientState *nc = qemu_get_queue(s-nic);
 uint16_t data[12];
@@ -439,12 +439,12 @@ static void do_transmit_packets(dp8393xState *s)
 dp8393x_update_irq(s);
 }
 
-static void do_halt_transmission(dp8393xState *s)
+static void dp8393x_do_halt_transmission(dp8393xState *s)
 {
 /* Nothing to do */
 }
 
-static void do_command(dp8393xState *s, uint16_t command)
+static void dp8393x_do_command(dp8393xState *s, uint16_t command)
 {
 if ((s-regs[SONIC_CR]  SONIC_CR_RST)  !(command  SONIC_CR_RST)) {
 s-regs[SONIC_CR] = ~SONIC_CR_RST;
@@ -454,23 +454,23 @@ static void do_command(dp8393xState *s, uint16_t command)
 s-regs[SONIC_CR] |= (command  SONIC_CR_MASK);
 
 if (command  SONIC_CR_HTX)
-do_halt_transmission(s);
+dp8393x_do_halt_transmission(s);
 if (command  SONIC_CR_TXP)
-do_transmit_packets(s);
+dp8393x_do_transmit_packets(s);
 if (command  SONIC_CR_RXDIS)
-do_receiver_disable(s);
+dp8393x_do_receiver_disable(s);
 if (command  SONIC_CR_RXEN)
-do_receiver_enable(s);
+dp8393x_do_receiver_enable(s);
 if (command  SONIC_CR_STP)
-do_stop_timer(s);
+dp8393x_do_stop_timer(s);
 if (command  SONIC_CR_ST)
-do_start_timer(s);
+dp8393x_do_start_timer(s);
 if (command  SONIC_CR_RST)
-do_software_reset(s);
+dp8393x_do_software_reset(s);
 if (command  SONIC_CR_RRRA)
-do_read_rra(s);
+dp8393x_do_read_rra(s);
 if (command  SONIC_CR_LCAM)
-do_load_cam(s);
+dp8393x_do_load_cam(s);
 }
 
 static uint64_t dp8393x_read(void *opaque, hwaddr addr, unsigned int size)
@@ -483,7 +483,7 @@ static uint64_t dp8393x_read(void *opaque, hwaddr addr, 
unsigned int size)
 /* Update data before reading it */
 case SONIC_WT0:
 case SONIC_WT1:
-update_wt_regs(s);
+dp8393x_update_wt_regs(s);
 val = s-regs[reg];
 break;
 /* Accept read to some registers only when in reset mode */
@@ -516,7 +516,7 @@ static void dp8393x_write(void *opaque, hwaddr addr, 
uint64_t data,
 switch (reg) {
 /* Command register */
 case 

[Qemu-devel] [Bug 1463812] Re: qemu-system-ppc64 V2.30 cause RHEL5.9 disk corruption

[wzis]

I built 2.3.0 on CentOS 6.6 machine, and run the RHEL5.9 using the new
qemu-system-64 ,and gets the same issue as 2.3.0 on RHEL5.3:

Checking filesystems
Checking all file systems.
[/sbin/fsck.ext3 (1) -- /] fsck.ext3 -a /dev/sda5
/: Resize inode not valid.

/: UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY.
(i.e., without -a or -p options)
[FAILED]

As I stated before on the CentOS6.6, the qemu 1.5.3 running the RHEL5.9
for power is ok. That proves it's not because of RHEL5.3 machine that fs
is corrupted, it's the newer qemu for power emulation has issue to run
big-endian version of RHEL.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1463812

Title:
  qemu-system-ppc64 V2.30 cause RHEL5.9 disk corruption

Status in QEMU:
  New

Bug description:
  copied the RHEL5.9 power disk image from qemu 1.5.3, run it under qemu 2.3.0, 
corrupted; copied again, run, corrupted again.
  Run the image on qemu 1.5.3, no problem.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1463812/+subscriptions

Re: [Qemu-devel] [PULL 20/22] hw/arm/boot: arm_load_kernel implemented as a machine init done notifier

[Eric Auger]

Hi Peter,
On 06/12/2015 04:54 AM, Peter Crosthwaite wrote:
 On Tue, Jun 2, 2015 at 9:33 AM, Peter Maydell peter.mayd...@linaro.org 
 wrote:
 From: Eric Auger eric.au...@linaro.org

 Device tree nodes for the platform bus and its children dynamic sysbus
 devices are added in a machine init done notifier. To load the dtb once,
 after those latter nodes are built and before ROM freeze, the actual
 arm_load_kernel existing code is moved into a notifier notify function,
 arm_load_kernel_notify. arm_load_kernel now only registers the
 corresponding notifier.

 
 Does this work? I am experiencing a regression on this patch for
 xlnx-ep108 board.

Sorry for the inconvenience. On my side I tested it on virt board.

I am currently looking at the issue ...

Best Regards

Eric
 I think it is because this is now delaying
 arm_load_kernel_notify call until after rom_load_all. From vl.c:
 
 if (rom_load_all() != 0) {
 fprintf(stderr, rom loading failed\n);
 exit(1);
 }
 
 /* TODO: once all bus devices are qdevified, this should be done
  * when bus is created by qdev.c */
 qemu_register_reset(qbus_reset_all_fn, sysbus_get_default());
 qemu_run_machine_init_done_notifiers();
 
 the machine_init_done_notifiers are called after the rom_load_all()
 call which does the image loading. So the image-to-load registration
 is too late.
 
 Straight revert of this patch fixes the issue for me.
 
 Regards,
 Peter
 
 
 Machine files that do not support platform bus stay unchanged. Machine
 files willing to support dynamic sysbus devices must call arm_load_kernel
 before sysbus-fdt arm_register_platform_bus_fdt_creator to make sure
 dynamic sysbus device nodes are integrated in the dtb.

 Signed-off-by: Eric Auger eric.au...@linaro.org
 Reviewed-by: Shannon Zhao zhaoshengl...@huawei.com
 Reviewed-by: Alexander Graf ag...@suse.de
 Reviewed-by: Alex Bennée alex.ben...@linaro.org
 Message-id: 1433244554-12898-3-git-send-email-eric.au...@linaro.org
 Signed-off-by: Peter Maydell peter.mayd...@linaro.org
 ---
  hw/arm/boot.c| 14 +-
  include/hw/arm/arm.h | 28 
  2 files changed, 41 insertions(+), 1 deletion(-)

 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index fa69503..d036624 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
 @@ -557,7 +557,7 @@ static void load_image_to_fw_cfg(FWCfgState *fw_cfg, 
 uint16_t size_key,
  fw_cfg_add_bytes(fw_cfg, data_key, data, size);
  }

 -void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
 +static void arm_load_kernel_notify(Notifier *notifier, void *data)
  {
  CPUState *cs;
  int kernel_size;
 @@ -568,6 +568,11 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info 
 *info)
  hwaddr entry, kernel_load_offset;
  int big_endian;
  static const ARMInsnFixup *primary_loader;
 +ArmLoadKernelNotifier *n = DO_UPCAST(ArmLoadKernelNotifier,
 + notifier, notifier);
 +ARMCPU *cpu = n-cpu;
 +struct arm_boot_info *info =
 +container_of(n, struct arm_boot_info, load_kernel_notifier);

  /* CPU objects (unlike devices) are not automatically reset on system
   * reset, so we must always register a handler to do so. If we're
 @@ -775,3 +780,10 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info 
 *info)
  ARM_CPU(cs)-env.boot_info = info;
  }
  }
 +
 +void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
 +{
 +info-load_kernel_notifier.cpu = cpu;
 +info-load_kernel_notifier.notifier.notify = arm_load_kernel_notify;
 +
 qemu_add_machine_init_done_notifier(info-load_kernel_notifier.notifier);
 +}
 diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index 5c940eb..760804c 100644
 --- a/include/hw/arm/arm.h
 +++ b/include/hw/arm/arm.h
 @@ -13,11 +13,21 @@

  #include exec/memory.h
  #include hw/irq.h
 +#include qemu/notify.h

  /* armv7m.c */
  qemu_irq *armv7m_init(MemoryRegion *system_memory, int mem_size, int 
 num_irq,
const char *kernel_filename, const char *cpu_model);

 +/*
 + * struct used as a parameter of the arm_load_kernel machine init
 + * done notifier
 + */
 +typedef struct {
 +Notifier notifier; /* actual notifier */
 +ARMCPU *cpu; /* handle to the first cpu object */
 +} ArmLoadKernelNotifier;
 +
  /* arm_boot.c */
  struct arm_boot_info {
  uint64_t ram_size;
 @@ -64,6 +74,8 @@ struct arm_boot_info {
   * the user it should implement this hook.
   */
  void (*modify_dtb)(const struct arm_boot_info *info, void *fdt);
 +/* machine init done notifier executing arm_load_dtb */
 +ArmLoadKernelNotifier load_kernel_notifier;
  /* Used internally by arm_boot.c */
  int is_linux;
  hwaddr initrd_start;
 @@ -75,6 +87,22 @@ struct arm_boot_info {
   */
  bool firmware_loaded;
  };
 +
 +/**
 + * arm_load_kernel - Loads memory with everything needed to boot
 + *
 + * @cpu: handle to the first CPU object
 + * 

Re: [Qemu-devel] where is the definition of cpu_ldub_code() for Softmmu mode?

[Jun Koi]

On Fri, Jun 12, 2015 at 3:59 PM, Peter Maydell peter.mayd...@linaro.org
wrote:

 On 12 June 2015 at 08:29, Jun Koi junkoi2...@gmail.com wrote:
  On Mon, May 18, 2015 at 6:20 PM, Peter Maydell peter.mayd...@linaro.org
 
  wrote:
  In cpu_ldst.h we #define MEMSUFFIX _code and then include
  exec/cpu_ldst_template.h multiple times to define the
  accessor functions for the various widths. (For the usermode
  version we include exec/cpu_ldst_useronly_template.h, for
  similar effect.)
 
 
  Looking closer to this code, this leads to the function
 helper_ldb_cmmu(),
  but I cannot find where this code is defined.

 manooth$ git grep cmmu
 cputlb.c:#define MMUSUFFIX _cmmu
 include/exec/cpu_ldst.h:uint8_t helper_ldb_cmmu(CPUArchState *env,
 target_ulong addr, int mmu_idx);
 include/exec/cpu_ldst.h:uint16_t helper_ldw_cmmu(CPUArchState *env,
 target_ulong addr, int mmu_idx);
 include/exec/cpu_ldst.h:uint32_t helper_ldl_cmmu(CPUArchState *env,
 target_ulong addr, int mmu_idx);
 include/exec/cpu_ldst.h:uint64_t helper_ldq_cmmu(CPUArchState *env,
 target_ulong addr, int mmu_idx);
 include/exec/cpu_ldst_template.h:#define MMUSUFFIX _cmmu

 The first of these is where cputlb.c includes
 softmmu_template.h, which is what's defining the
 function you're interested in.


Excellent, thanks!!!

[Qemu-devel] [PATCH v2 4/6] virtio-vga: add '-vga virtio' support

[Gerd Hoffmann]

Some convinience fluff:  Add support for '-vga virtio', also add
virtio-vga to the list of vga cards so '-device virtio-vga' will
turn off the default vga.

Written by Dave Airlie and Gerd Hoffmann.

Signed-off-by: Dave Airlie airl...@redhat.com
Signed-off-by: Gerd Hoffmann kra...@redhat.com
---
 hw/isa/isa-bus.c|  3 +++
 hw/pci/pci.c|  2 ++
 include/sysemu/sysemu.h |  2 +-
 qemu-options.hx |  4 +++-
 vl.c| 13 +
 5 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/hw/isa/isa-bus.c b/hw/isa/isa-bus.c
index ec8e7de..43e0cd8 100644
--- a/hw/isa/isa-bus.c
+++ b/hw/isa/isa-bus.c
@@ -179,6 +179,9 @@ ISADevice *isa_vga_init(ISABus *bus)
 case VGA_VMWARE:
 fprintf(stderr, %s: vmware_vga: no PCI bus\n, __func__);
 return NULL;
+case VGA_VIRTIO:
+fprintf(stderr, %s: virtio-vga: no PCI bus\n, __func__);
+return NULL;
 case VGA_NONE:
 default:
 return NULL;
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 750f3da..2158043 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1698,6 +1698,8 @@ PCIDevice *pci_vga_init(PCIBus *bus)
 return pci_create_simple(bus, -1, VGA);
 case VGA_VMWARE:
 return pci_create_simple(bus, -1, vmware-svga);
+case VGA_VIRTIO:
+return pci_create_simple(bus, -1, virtio-vga);
 case VGA_NONE:
 default: /* Other non-PCI types. Checking for unsupported types is already
 done in vl.c. */
diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index 853d90a..7beb926 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -104,7 +104,7 @@ extern int autostart;
 
 typedef enum {
 VGA_NONE, VGA_STD, VGA_CIRRUS, VGA_VMWARE, VGA_XENFB, VGA_QXL,
-VGA_TCX, VGA_CG3, VGA_DEVICE
+VGA_TCX, VGA_CG3, VGA_DEVICE, VGA_VIRTIO,
 } VGAInterfaceType;
 
 extern int vga_interface_type;
diff --git a/qemu-options.hx b/qemu-options.hx
index 1d281f6..c6221d4 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1103,7 +1103,7 @@ Rotate graphical output some deg left (only PXA LCD).
 ETEXI
 
 DEF(vga, HAS_ARG, QEMU_OPTION_vga,
--vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|none]\n
+-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]\n
 select video card type\n, QEMU_ARCH_ALL)
 STEXI
 @item -vga @var{type}
@@ -1136,6 +1136,8 @@ fixed resolution of 1024x768.
 (sun4m only) Sun cgthree framebuffer. This is a simple 8-bit framebuffer
 for sun4m machines available in both 1024x768 (OpenBIOS) and 1152x900 (OBP)
 resolutions aimed at people wishing to run older Solaris versions.
+@item virtio
+Virtio VGA card.
 @item none
 Disable VGA card.
 @end table
diff --git a/vl.c b/vl.c
index 9542095..2201e27 100644
--- a/vl.c
+++ b/vl.c
@@ -231,6 +231,7 @@ static struct {
 { .driver = isa-cirrus-vga,   .flag = default_vga   },
 { .driver = vmware-svga,  .flag = default_vga   },
 { .driver = qxl-vga,  .flag = default_vga   },
+{ .driver = virtio-vga,   .flag = default_vga   },
 };
 
 static QemuOptsList qemu_rtc_opts = {
@@ -1884,6 +1885,11 @@ static bool cg3_vga_available(void)
 return object_class_by_name(cgthree);
 }
 
+static bool virtio_vga_available(void)
+{
+return object_class_by_name(virtio-vga);
+}
+
 static void select_vgahw (const char *p)
 {
 const char *opts;
@@ -1910,6 +1916,13 @@ static void select_vgahw (const char *p)
 fprintf(stderr, Error: VMWare SVGA not available\n);
 exit(0);
 }
+} else if (strstart(p, virtio, opts)) {
+if (virtio_vga_available()) {
+vga_interface_type = VGA_VIRTIO;
+} else {
+fprintf(stderr, Error: Virtio VGA not available\n);
+exit(0);
+}
 } else if (strstart(p, xenfb, opts)) {
 vga_interface_type = VGA_XENFB;
 } else if (strstart(p, qxl, opts)) {
-- 
1.8.3.1

[Qemu-devel] [PATCH v2 5/6] virtio-vga: add vgabios configuration

[Gerd Hoffmann]

Add seavgabios configuration for virtio-vga,
hook up the new vgabios in the makefiles.

Signed-off-by: Gerd Hoffmann kra...@redhat.com
---
 Makefile   | 2 +-
 roms/Makefile  | 2 +-
 roms/config.vga-virtio | 6 ++
 3 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 roms/config.vga-virtio

diff --git a/Makefile b/Makefile
index 2d52536..3f97904 100644
--- a/Makefile
+++ b/Makefile
@@ -342,7 +342,7 @@ bepocz
 
 ifdef INSTALL_BLOBS
 BLOBS=bios.bin bios-256k.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
-vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
+vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin vgabios-virtio.bin \
 acpi-dsdt.aml q35-acpi-dsdt.aml \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc QEMU,tcx.bin 
QEMU,cgthree.bin \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
diff --git a/roms/Makefile b/roms/Makefile
index 610b534..c76cd5b 100644
--- a/roms/Makefile
+++ b/roms/Makefile
@@ -1,5 +1,5 @@
 
-vgabios_variants := stdvga cirrus vmware qxl isavga
+vgabios_variants := stdvga cirrus vmware qxl isavga virtio
 vgabios_targets  := $(subst -isavga,,$(patsubst 
%,vgabios-%.bin,$(vgabios_variants)))
 pxerom_variants  := e1000 eepro100 ne2k_pci pcnet rtl8139 virtio
 pxerom_targets   := 8086100e 80861209 10500940 10222000 10ec8139 1af41000
diff --git a/roms/config.vga-virtio b/roms/config.vga-virtio
new file mode 100644
index 000..aa7a15b
--- /dev/null
+++ b/roms/config.vga-virtio
@@ -0,0 +1,6 @@
+CONFIG_BUILD_VGABIOS=y
+CONFIG_VGA_BOCHS=y
+CONFIG_VGA_PCI=y
+CONFIG_OVERRIDE_PCI_ID=y
+CONFIG_VGA_VID=0x1af4
+CONFIG_VGA_DID=0x1050
-- 
1.8.3.1

[Qemu-devel] [PULL 02/29] target-mips: add Config5.FRE support allowing Status.FR=0 emulation

[Leon Alrae]

This relatively small architectural feature adds the following:

FIR.FREP: Read-only. If FREP=1, then Config5.FRE and Config5.UFE are
  available.

Config5.FRE: When enabled all single-precision FP arithmetic instructions,
 LWC1/LWXC1/MTC1, SWC1/SWXC1/MFC1 cause a Reserved Instructions
 exception.

Config5.UFE: Allows user to write/read Config5.FRE using CTC1/CFC1
 instructions.

Enable the feature in MIPS64R6-generic CPU.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 target-mips/cpu.h|  13 +-
 target-mips/op_helper.c  |  34 +
 target-mips/translate.c  | 308 ++-
 target-mips/translate_init.c |   9 +-
 4 files changed, 208 insertions(+), 156 deletions(-)

diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index f9d2b4c..03eb888 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -100,6 +100,7 @@ struct CPUMIPSFPUContext {
 float_status fp_status;
 /* fpu implementation/revision register (fir) */
 uint32_t fcr0;
+#define FCR0_FREP 29
 #define FCR0_UFRP 28
 #define FCR0_F64 22
 #define FCR0_L 21
@@ -462,6 +463,8 @@ struct CPUMIPSState {
 #define CP0C5_CV 29
 #define CP0C5_EVA28
 #define CP0C5_MSAEn  27
+#define CP0C5_UFE9
+#define CP0C5_FRE8
 #define CP0C5_SBRI   6
 #define CP0C5_UFR2
 #define CP0C5_NFExists   0
@@ -514,7 +517,7 @@ struct CPUMIPSState {
 #define EXCP_INST_NOTAVAIL 0x2 /* No valid instruction word for BadInstr */
 uint32_t hflags;/* CPU State */
 /* TMASK defines different execution modes */
-#define MIPS_HFLAG_TMASK  0x15807FF
+#define MIPS_HFLAG_TMASK  0x35807FF
 #define MIPS_HFLAG_MODE   0x7 /* execution modes*/
 /* The KSU flags must be the lowest bits in hflags. The flag order
must be the same as defined for CP0 Status. This allows to use
@@ -561,6 +564,7 @@ struct CPUMIPSState {
 #define MIPS_HFLAG_SBRI  0x40 /* R6 SDBBP causes RI excpt. in user mode */
 #define MIPS_HFLAG_FBNSLOT 0x80 /* Forbidden slot   */
 #define MIPS_HFLAG_MSA   0x100
+#define MIPS_HFLAG_FRE   0x200 /* FRE enabled */
 target_ulong btarget;/* Jump / branch target   */
 target_ulong bcond;  /* Branch condition (if needed)   */
 
@@ -843,7 +847,7 @@ static inline void compute_hflags(CPUMIPSState *env)
 env-hflags = ~(MIPS_HFLAG_COP1X | MIPS_HFLAG_64 | MIPS_HFLAG_CP0 |
  MIPS_HFLAG_F64 | MIPS_HFLAG_FPU | MIPS_HFLAG_KSU |
  MIPS_HFLAG_AWRAP | MIPS_HFLAG_DSP | MIPS_HFLAG_DSPR2 |
- MIPS_HFLAG_SBRI | MIPS_HFLAG_MSA);
+ MIPS_HFLAG_SBRI | MIPS_HFLAG_MSA | MIPS_HFLAG_FRE);
 if (!(env-CP0_Status  (1  CP0St_EXL)) 
 !(env-CP0_Status  (1  CP0St_ERL)) 
 !(env-hflags  MIPS_HFLAG_DM)) {
@@ -924,6 +928,11 @@ static inline void compute_hflags(CPUMIPSState *env)
 env-hflags |= MIPS_HFLAG_MSA;
 }
 }
+if (env-active_fpu.fcr0  (1  FCR0_FREP)) {
+if (env-CP0_Config5  (1  CP0C5_FRE)) {
+env-hflags |= MIPS_HFLAG_FRE;
+}
+}
 }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 73a8e45..dd89068 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -2303,6 +2303,16 @@ target_ulong helper_cfc1(CPUMIPSState *env, uint32_t reg)
 }
 }
 break;
+case 5:
+/* FRE Support - read Config5.FRE bit */
+if (env-active_fpu.fcr0  (1  FCR0_FREP)) {
+if (env-CP0_Config5  (1  CP0C5_UFE)) {
+arg1 = (env-CP0_Config5  CP0C5_FRE)  1;
+} else {
+helper_raise_exception(env, EXCP_RI);
+}
+}
+break;
 case 25:
 arg1 = ((env-active_fpu.fcr31  24)  0xfe) | 
((env-active_fpu.fcr31  23)  0x1);
 break;
@@ -2347,6 +2357,30 @@ void helper_ctc1(CPUMIPSState *env, target_ulong arg1, 
uint32_t fs, uint32_t rt)
 helper_raise_exception(env, EXCP_RI);
 }
 break;
+case 5:
+/* FRE Support - clear Config5.FRE bit */
+if (!((env-active_fpu.fcr0  (1  FCR0_FREP))  (rt == 0))) {
+return;
+}
+if (env-CP0_Config5  (1  CP0C5_UFE)) {
+env-CP0_Config5 = ~(1  CP0C5_FRE);
+compute_hflags(env);
+} else {
+helper_raise_exception(env, EXCP_RI);
+}
+break;
+case 6:
+/* FRE Support - set Config5.FRE bit */
+if (!((env-active_fpu.fcr0  (1  FCR0_FREP))  (rt == 0))) {
+return;
+}
+if (env-CP0_Config5  (1  CP0C5_UFE)) {
+env-CP0_Config5 |= (1  CP0C5_FRE);
+compute_hflags(env);
+} else {
+helper_raise_exception(env, EXCP_RI);
+}
+break;
 case 25:
 if ((env-insn_flags  ISA_MIPS32R6) || (arg1 

[Qemu-devel] [PULL 12/29] dma/rc4030: document register at offset 0x210

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/dma/rc4030.c | 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index 96f796b..bf82eed 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -86,7 +86,7 @@ typedef struct rc4030State
 uint32_t cache_bmask; /* 0x0058: I/O Cache Byte Mask */
 
 uint32_t nmi_interrupt; /* 0x0200: interrupt source */
-uint32_t offset210;
+uint32_t memory_refresh_rate; /* 0x0210: memory refresh rate */
 uint32_t nvram_protect; /* 0x0220: NV ram protect register */
 uint32_t rem_speed[16];
 uint32_t imr_jazz; /* Local bus int enable mask */
@@ -233,9 +233,9 @@ static uint64_t rc4030_read(void *opaque, hwaddr addr, 
unsigned int size)
 case 0x0208:
 val = 0;
 break;
-/* Offset 0x0210 */
+/* Memory refresh rate */
 case 0x0210:
-val = s-offset210;
+val = s-memory_refresh_rate;
 break;
 /* NV ram protect register */
 case 0x0220:
@@ -461,9 +461,9 @@ static void rc4030_write(void *opaque, hwaddr addr, 
uint64_t data,
 s-dma_regs[entry][idx] = val;
 }
 break;
-/* Offset 0x0210 */
+/* Memory refresh rate */
 case 0x0210:
-s-offset210 = val;
+s-memory_refresh_rate = val;
 break;
 /* Interval timer reload */
 case 0x0228:
@@ -621,7 +621,7 @@ static void rc4030_reset(void *opaque)
 s-cache_ptag = s-cache_ltag = 0;
 s-cache_bmask = 0;
 
-s-offset210 = 0x18186;
+s-memory_refresh_rate = 0x18186;
 s-nvram_protect = 7;
 for (i = 0; i  15; i++)
 s-rem_speed[i] = 7;
@@ -655,7 +655,7 @@ static int rc4030_load(QEMUFile *f, void *opaque, int 
version_id)
 s-cache_ptag = qemu_get_be32(f);
 s-cache_ltag = qemu_get_be32(f);
 s-cache_bmask = qemu_get_be32(f);
-s-offset210 = qemu_get_be32(f);
+s-memory_refresh_rate = qemu_get_be32(f);
 s-nvram_protect = qemu_get_be32(f);
 for (i = 0; i  15; i++)
 s-rem_speed[i] = qemu_get_be32(f);
@@ -687,7 +687,7 @@ static void rc4030_save(QEMUFile *f, void *opaque)
 qemu_put_be32(f, s-cache_ptag);
 qemu_put_be32(f, s-cache_ltag);
 qemu_put_be32(f, s-cache_bmask);
-qemu_put_be32(f, s-offset210);
+qemu_put_be32(f, s-memory_refresh_rate);
 qemu_put_be32(f, s-nvram_protect);
 for (i = 0; i  15; i++)
 qemu_put_be32(f, s-rem_speed[i]);
-- 
2.1.0

[Qemu-devel] [PULL 25/29] target-mips: support Page Frame Number Extension field

[Leon Alrae]

Update tlb-PFN to contain PFN concatenated with PFNX. PFNX is 0 if large
physical address is not supported.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 target-mips/op_helper.c | 32 ++--
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 4dc4970..31bafcf 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -1826,6 +1826,16 @@ static void r4k_mips_tlb_flush_extra (CPUMIPSState *env, 
int first)
 }
 }
 
+static inline uint64_t get_tlb_pfn_from_entrylo(uint64_t entrylo)
+{
+#if defined(TARGET_MIPS64)
+return extract64(entrylo, 6, 54);
+#else
+return extract64(entrylo, 6, 24) | /* PFN */
+   (extract64(entrylo, 32, 32)  24); /* PFNX */
+#endif
+}
+
 static void r4k_fill_tlb(CPUMIPSState *env, int idx)
 {
 r4k_tlb_t *tlb;
@@ -1849,13 +1859,13 @@ static void r4k_fill_tlb(CPUMIPSState *env, int idx)
 tlb-C0 = (env-CP0_EntryLo0  3)  0x7;
 tlb-XI0 = (env-CP0_EntryLo0  CP0EnLo_XI)  1;
 tlb-RI0 = (env-CP0_EntryLo0  CP0EnLo_RI)  1;
-tlb-PFN[0] = (env-CP0_EntryLo0  6)  12;
+tlb-PFN[0] = get_tlb_pfn_from_entrylo(env-CP0_EntryLo0)  12;
 tlb-V1 = (env-CP0_EntryLo1  2) != 0;
 tlb-D1 = (env-CP0_EntryLo1  4) != 0;
 tlb-C1 = (env-CP0_EntryLo1  3)  0x7;
 tlb-XI1 = (env-CP0_EntryLo1  CP0EnLo_XI)  1;
 tlb-RI1 = (env-CP0_EntryLo1  CP0EnLo_RI)  1;
-tlb-PFN[1] = (env-CP0_EntryLo1  6)  12;
+tlb-PFN[1] = get_tlb_pfn_from_entrylo(env-CP0_EntryLo1)  12;
 }
 
 void r4k_helper_tlbinv(CPUMIPSState *env)
@@ -1972,6 +1982,16 @@ void r4k_helper_tlbp(CPUMIPSState *env)
 }
 }
 
+static inline uint64_t get_entrylo_pfn_from_tlb(uint64_t tlb_pfn)
+{
+#if defined(TARGET_MIPS64)
+return tlb_pfn  6;
+#else
+return (extract64(tlb_pfn, 0, 24)  6) | /* PFN */
+   (extract64(tlb_pfn, 24, 32)  32); /* PFNX */
+#endif
+}
+
 void r4k_helper_tlbr(CPUMIPSState *env)
 {
 r4k_tlb_t *tlb;
@@ -1998,12 +2018,12 @@ void r4k_helper_tlbr(CPUMIPSState *env)
 env-CP0_PageMask = tlb-PageMask;
 env-CP0_EntryLo0 = tlb-G | (tlb-V0  1) | (tlb-D0  2) |
 ((uint64_t)tlb-RI0  CP0EnLo_RI) |
-((uint64_t)tlb-XI0  CP0EnLo_XI) |
-(tlb-C0  3) | (tlb-PFN[0]  6);
+((uint64_t)tlb-XI0  CP0EnLo_XI) | (tlb-C0  3) |
+get_entrylo_pfn_from_tlb(tlb-PFN[0]  12);
 env-CP0_EntryLo1 = tlb-G | (tlb-V1  1) | (tlb-D1  2) |
 ((uint64_t)tlb-RI1  CP0EnLo_RI) |
-((uint64_t)tlb-XI1  CP0EnLo_XI) |
-(tlb-C1  3) | (tlb-PFN[1]  6);
+((uint64_t)tlb-XI1  CP0EnLo_XI) | (tlb-C1  3) |
+get_entrylo_pfn_from_tlb(tlb-PFN[1]  12);
 }
 }
 
-- 
2.1.0

Re: [Qemu-devel] [PATCH v2] net:Enable vhost with vhostforce, vhost options for guests without MSI-X support

[Jason Wang]

On 06/11/2015 07:49 PM, Pankaj Gupta wrote:
 On 06/05/2015 10:32 PM, Pankaj Gupta wrote:
 We use vhostforce to enable vhost even if Guests don't have MSI-X
 support
 and we fall back to QEMU virtio-net. This patch will enable vhost
 unconditionally
 whenever we have vhostforce='ON' or vhost='ON'.

 Initially, I wanted to remove vhostforce completely as an additional
 argument.
 But after discussing this in mailing list found that some programs are
 using vhostforce
 and some vhost. So, we want to keep semantics of both the options.

 Signed-off-by: Pankaj Gupta pagu...@redhat.com
 ---
  net/tap.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)

 diff --git a/net/tap.c b/net/tap.c
 index d1ca314..4618359 100644
 --- a/net/tap.c
 +++ b/net/tap.c
 @@ -649,13 +649,13 @@ static void net_init_tap_one(const NetdevTapOptions
 *tap, NetClientState *peer,
  }
  }
  
 -if (tap-has_vhost ? tap-vhost :
 -vhostfdname || (tap-has_vhostforce  tap-vhostforce)) {
 +if ((tap-has_vhost ? tap-vhost :
 +vhostfdname) || tap-vhostforce) {

The change here seems useless.

  VhostNetOptions options;
  
  options.backend_type = VHOST_BACKEND_TYPE_KERNEL;
  options.net_backend = s-nc;
 -options.force = tap-has_vhostforce  tap-vhostforce;
 +options.force = true;
  
  if (tap-has_vhostfd || tap-has_vhostfds) {
  vhostfd = monitor_fd_param(cur_mon, vhostfdname, err);
 In this case, I believe there's no need to have vhost_net_query() and
 query_guest_notifiers() callbacks (and maybe more others).
 I also thought on this. If same functions can be used by some other module in 
 future?
 If not, I was thinking to remove those in another patch.

I could not think a usage of this in the future.

 Does the main functionality looks OK? 

See comment above and I prefer to remove all unnecessary functions.

Thanks

Re: [Qemu-devel] [PATCH v2] net:Enable vhost with vhostforce, vhost options for guests without MSI-X support

[Pankaj Gupta]

 
 On 06/11/2015 07:49 PM, Pankaj Gupta wrote:
  On 06/05/2015 10:32 PM, Pankaj Gupta wrote:
  We use vhostforce to enable vhost even if Guests don't have MSI-X
  support
  and we fall back to QEMU virtio-net. This patch will enable vhost
  unconditionally
  whenever we have vhostforce='ON' or vhost='ON'.
 
  Initially, I wanted to remove vhostforce completely as an additional
  argument.
  But after discussing this in mailing list found that some programs are
  using vhostforce
  and some vhost. So, we want to keep semantics of both the options.
 
  Signed-off-by: Pankaj Gupta pagu...@redhat.com
  ---
   net/tap.c | 6 +++---
   1 file changed, 3 insertions(+), 3 deletions(-)
 
  diff --git a/net/tap.c b/net/tap.c
  index d1ca314..4618359 100644
  --- a/net/tap.c
  +++ b/net/tap.c
  @@ -649,13 +649,13 @@ static void net_init_tap_one(const NetdevTapOptions
  *tap, NetClientState *peer,
   }
   }
   
  -if (tap-has_vhost ? tap-vhost :
  -vhostfdname || (tap-has_vhostforce  tap-vhostforce)) {
  +if ((tap-has_vhost ? tap-vhost :
  +vhostfdname) || tap-vhostforce) {
 
 The change here seems useless.
 
   VhostNetOptions options;
   
   options.backend_type = VHOST_BACKEND_TYPE_KERNEL;
   options.net_backend = s-nc;
  -options.force = tap-has_vhostforce  tap-vhostforce;
  +options.force = true;
   
   if (tap-has_vhostfd || tap-has_vhostfds) {
   vhostfd = monitor_fd_param(cur_mon, vhostfdname, err);
  In this case, I believe there's no need to have vhost_net_query() and
  query_guest_notifiers() callbacks (and maybe more others).
  I also thought on this. If same functions can be used by some other module
  in future?
  If not, I was thinking to remove those in another patch.
 
 I could not think a usage of this in the future.
 
  Does the main functionality looks OK?
 
 See comment above and I prefer to remove all unnecessary functions.

o.k, will do the changes and post a new version.
 
 
 Thanks
 
 
 

[Qemu-devel] [PULL 06/29] target-mips: Misaligned memory accesses for MSA

[Leon Alrae]

From: Yongbok Kim yongbok@imgtec.com

MIPS SIMD Architecture vector loads and stores require misalignment support.
MSA Memory access should work as an atomic operation. Therefore, it has to
check validity of all addresses for a vector store access if it is spanning
into two pages.

Separating helper functions for each data format as format is known in
translation.
To use mmu_idx from cpu_mmu_index() instead of calculating it from hflag.
Removing save_cpu_state() call in translation because it is able to use
cpu_restore_state() on fault as GETRA() is passed.

Signed-off-by: Yongbok Kim yongbok@imgtec.com
Reviewed-by: Leon Alrae leon.al...@imgtec.com
[leon.al...@imgtec.com: remove unused do_* functions]
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 target-mips/helper.h|  10 +++-
 target-mips/op_helper.c | 143 ++--
 target-mips/translate.c |  27 +
 3 files changed, 102 insertions(+), 78 deletions(-)

diff --git a/target-mips/helper.h b/target-mips/helper.h
index 3bd0b02..bdd5ba5 100644
--- a/target-mips/helper.h
+++ b/target-mips/helper.h
@@ -931,5 +931,11 @@ DEF_HELPER_4(msa_ftint_u_df, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_ffint_s_df, void, env, i32, i32, i32)
 DEF_HELPER_4(msa_ffint_u_df, void, env, i32, i32, i32)
 
-DEF_HELPER_5(msa_ld_df, void, env, i32, i32, i32, s32)
-DEF_HELPER_5(msa_st_df, void, env, i32, i32, i32, s32)
+#define MSALDST_PROTO(type) \
+DEF_HELPER_3(msa_ld_ ## type, void, env, i32, tl)   \
+DEF_HELPER_3(msa_st_ ## type, void, env, i32, tl)
+MSALDST_PROTO(b)
+MSALDST_PROTO(h)
+MSALDST_PROTO(w)
+MSALDST_PROTO(d)
+#undef MSALDST_PROTO
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index dd89068..2fe862a 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -90,10 +90,10 @@ static inline type do_##name(CPUMIPSState *env, 
target_ulong addr,  \
 }   \
 }
 #endif
-HELPER_LD(lbu, ldub, uint8_t)
-HELPER_LD(lhu, lduw, uint16_t)
 HELPER_LD(lw, ldl, int32_t)
+#if defined(TARGET_MIPS64)
 HELPER_LD(ld, ldq, int64_t)
+#endif
 #undef HELPER_LD
 
 #if defined(CONFIG_USER_ONLY)
@@ -118,9 +118,10 @@ static inline void do_##name(CPUMIPSState *env, 
target_ulong addr,  \
 }
 #endif
 HELPER_ST(sb, stb, uint8_t)
-HELPER_ST(sh, stw, uint16_t)
 HELPER_ST(sw, stl, uint32_t)
+#if defined(TARGET_MIPS64)
 HELPER_ST(sd, stq, uint64_t)
+#endif
 #undef HELPER_ST
 
 target_ulong helper_clo (target_ulong arg1)
@@ -3592,72 +3593,82 @@ FOP_CONDN_S(sne,  (float32_lt(fst1, fst0, 
env-active_fpu.fp_status)
 /* Element-by-element access macros */
 #define DF_ELEMENTS(df) (MSA_WRLEN / DF_BITS(df))
 
-void helper_msa_ld_df(CPUMIPSState *env, uint32_t df, uint32_t wd, uint32_t rs,
- int32_t s10)
-{
-wr_t *pwd = (env-active_fpu.fpr[wd].wr);
-target_ulong addr = env-active_tc.gpr[rs] + (s10  df);
-int i;
+#if !defined(CONFIG_USER_ONLY)
+#define MEMOP_IDX(DF)   \
+TCGMemOpIdx oi = make_memop_idx(MO_TE | DF | MO_UNALN,  \
+cpu_mmu_index(env));
+#else
+#define MEMOP_IDX(DF)
+#endif
 
-switch (df) {
-case DF_BYTE:
-for (i = 0; i  DF_ELEMENTS(DF_BYTE); i++) {
-pwd-b[i] = do_lbu(env, addr + (i  DF_BYTE),
-env-hflags  MIPS_HFLAG_KSU);
-}
-break;
-case DF_HALF:
-for (i = 0; i  DF_ELEMENTS(DF_HALF); i++) {
-pwd-h[i] = do_lhu(env, addr + (i  DF_HALF),
-env-hflags  MIPS_HFLAG_KSU);
-}
-break;
-case DF_WORD:
-for (i = 0; i  DF_ELEMENTS(DF_WORD); i++) {
-pwd-w[i] = do_lw(env, addr + (i  DF_WORD),
-env-hflags  MIPS_HFLAG_KSU);
-}
-break;
-case DF_DOUBLE:
-for (i = 0; i  DF_ELEMENTS(DF_DOUBLE); i++) {
-pwd-d[i] = do_ld(env, addr + (i  DF_DOUBLE),
-env-hflags  MIPS_HFLAG_KSU);
-}
-break;
-}
+#define MSA_LD_DF(DF, TYPE, LD_INSN, ...)   \
+void helper_msa_ld_ ## TYPE(CPUMIPSState *env, uint32_t wd, \
+target_ulong addr)  \
+{   \
+wr_t *pwd = (env-active_fpu.fpr[wd].wr);  \
+wr_t wx;\
+int i;  \
+MEMOP_IDX(DF)   \
+for (i = 0; i  DF_ELEMENTS(DF); i++) { \
+wx.TYPE[i] = LD_INSN(env, addr + (i  DF), ##__VA_ARGS__); \
+}   \
+memcpy(pwd, wx, sizeof(wr_t));  

[Qemu-devel] [PULL 13/29] dma/rc4030: use trace events instead of custom logging

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Remove also unneeded debug logs.

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/dma/rc4030.c | 81 -
 trace-events|  6 +
 2 files changed, 22 insertions(+), 65 deletions(-)

diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index bf82eed..55844ed 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -26,24 +26,7 @@
 #include hw/mips/mips.h
 #include qemu/timer.h
 #include exec/address-spaces.h
-
-//
-/* debug rc4030 */
-
-//#define DEBUG_RC4030
-//#define DEBUG_RC4030_DMA
-
-#ifdef DEBUG_RC4030
-#define DPRINTF(fmt, ...) \
-do { printf(rc4030:  fmt , ## __VA_ARGS__); } while (0)
-static const char* irq_names[] = { parallel, floppy, sound, video,
-network, scsi, keyboard, mouse, serial0, serial1 };
-#else
-#define DPRINTF(fmt, ...)
-#endif
-
-#define RC4030_ERROR(fmt, ...) \
-do { fprintf(stderr, rc4030 ERROR: %s:  fmt, __func__ , ## __VA_ARGS__); } 
while (0)
+#include trace.h
 
 //
 /* rc4030 emulation */
@@ -251,13 +234,14 @@ static uint64_t rc4030_read(void *opaque, hwaddr addr, 
unsigned int size)
 val = 7; /* FIXME: should be read from EISA controller */
 break;
 default:
-RC4030_ERROR(invalid read [ TARGET_FMT_plx ]\n, addr);
+qemu_log_mask(LOG_GUEST_ERROR,
+  rc4030: invalid read at 0x%x, (int)addr);
 val = 0;
 break;
 }
 
 if ((addr  ~3) != 0x230) {
-DPRINTF(read 0x%02x at  TARGET_FMT_plx \n, val, addr);
+trace_rc4030_read(addr, val);
 }
 
 return val;
@@ -360,7 +344,7 @@ static void rc4030_write(void *opaque, hwaddr addr, 
uint64_t data,
 uint32_t val = data;
 addr = 0x3fff;
 
-DPRINTF(write 0x%02x at  TARGET_FMT_plx \n, val, addr);
+trace_rc4030_write(addr, val);
 
 switch (addr  ~0x3) {
 /* Global config register */
@@ -475,7 +459,9 @@ static void rc4030_write(void *opaque, hwaddr addr, 
uint64_t data,
 case 0x0238:
 break;
 default:
-RC4030_ERROR(invalid write of 0x%02x at [ TARGET_FMT_plx ]\n, val, 
addr);
+qemu_log_mask(LOG_GUEST_ERROR,
+  rc4030: invalid write of 0x%02x at 0x%x,
+  val, (int)addr);
 break;
 }
 }
@@ -494,22 +480,6 @@ static void update_jazz_irq(rc4030State *s)
 
 pending = s-isr_jazz  s-imr_jazz;
 
-#ifdef DEBUG_RC4030
-if (s-isr_jazz != 0) {
-uint32_t irq = 0;
-DPRINTF(pending irqs:);
-for (irq = 0; irq  ARRAY_SIZE(irq_names); irq++) {
-if (s-isr_jazz  (1  irq)) {
-printf( %s, irq_names[irq]);
-if (!(s-imr_jazz  (1  irq))) {
-printf((ignored));
-}
-}
-}
-printf(\n);
-}
-#endif
-
 if (pending != 0)
 qemu_irq_raise(s-jazz_bus_irq);
 else
@@ -552,7 +522,6 @@ static uint64_t jazzio_read(void *opaque, hwaddr addr, 
unsigned int size)
 irq = 0;
 while (pending) {
 if (pending  1) {
-DPRINTF(returning irq %s\n, irq_names[irq]);
 val = (irq + 1)  2;
 break;
 }
@@ -566,11 +535,13 @@ static uint64_t jazzio_read(void *opaque, hwaddr addr, 
unsigned int size)
 val = s-imr_jazz;
 break;
 default:
-RC4030_ERROR((jazz io controller) invalid read [ TARGET_FMT_plx 
]\n, addr);
+qemu_log_mask(LOG_GUEST_ERROR,
+  rc4030/jazzio: invalid read at 0x%x, (int)addr);
 val = 0;
+break;
 }
 
-DPRINTF((jazz io controller) read 0x%04x at  TARGET_FMT_plx \n, val, 
addr);
+trace_jazzio_read(addr, val);
 
 return val;
 }
@@ -582,7 +553,7 @@ static void jazzio_write(void *opaque, hwaddr addr, 
uint64_t data,
 uint32_t val = data;
 addr = 0xfff;
 
-DPRINTF((jazz io controller) write 0x%04x at  TARGET_FMT_plx \n, val, 
addr);
+trace_jazzio_write(addr, val);
 
 switch (addr) {
 /* Local bus int enable mask */
@@ -591,7 +562,9 @@ static void jazzio_write(void *opaque, hwaddr addr, 
uint64_t data,
 update_jazz_irq(s);
 break;
 default:
-RC4030_ERROR((jazz io controller) invalid write of 0x%04x at [ 
TARGET_FMT_plx ]\n, val, addr);
+qemu_log_mask(LOG_GUEST_ERROR,
+  rc4030/jazzio: invalid write of 0x%02x at 0x%x,
+  val, (int)addr);
 break;
 }
 }
@@ -724,28 +697,6 @@ static void rc4030_do_dma(void *opaque, int n, uint8_t 
*buf, int len, int is_wri
 
 s-dma_regs[n][DMA_REG_ENABLE] |= DMA_FLAG_TC_INTR;
 s-dma_regs[n][DMA_REG_COUNT] -= len;
-
-#ifdef DEBUG_RC4030_DMA
-{
-int i, 

[Qemu-devel] [PULL 21/29] net/dp8393x: correctly reset in_use field

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Don't write more than the field width, which is always 16 bit.
Fixes network in NetBSD 5.1/arc

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/net/dp8393x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 4184045..ff633f7 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -764,7 +764,7 @@ static ssize_t dp8393x_receive(NetClientState *nc, const 
uint8_t * buf,
 data[0 * width] = 0; /* in_use */
 address_space_rw(s-as,
 ((s-regs[SONIC_URDA]  16) | s-regs[SONIC_CRDA]) + 
sizeof(uint16_t) * 6 * width,
-MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 1);
+MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, sizeof(uint16_t), 1);
 s-regs[SONIC_CRDA] = s-regs[SONIC_LLFA];
 s-regs[SONIC_ISR] |= SONIC_ISR_PKTRX;
 s-regs[SONIC_RSC] = (s-regs[SONIC_RSC]  0xff00) | 
(((s-regs[SONIC_RSC]  0x00ff) + 1)  0x00ff);
-- 
2.1.0

Re: [Qemu-devel] [PATCH v2 RFC 0/8] block: persistent dirty bitmaps

[Denis V. Lunev]

On 11/06/15 23:06, Stefan Hajnoczi wrote:

The load/store API is not scalable when bitmaps are 1 MB or larger.

For example, a 500 GB disk image with 64 KB granularity requires a 1 MB
bitmap.  If a guest has several disk images of this size, then multiple
megabytes must be read to start the guest and written out to shut down
the guest.

By comparison, the L1 table for the 500 GB disk image is less than 8 KB.

I think something like qcow2-cache.c or metabitmaps should be used to
lazily read/write persistent bitmaps.  That way only small portions need
to be read/written at a time.

Stefan

for the first iteration we could open the image, start tracking,
read bitmap as one entity in the background and or read
and collected data.

partial read could be done in the next step

[Qemu-devel] [RFC PATCH v1 1/4] pc, pc-dimm: Factor out reusable parts in pc_dimm_plug to a separate routine

[Bharata B Rao]

pc_dimm_plug() has code that will be needed for memory plug handlers
in other archs too. Extract code from pc_dimm_plug() into a generic
routine pc_dimm_memory_plug() that resides in pc-dimm.c. Also
correspondingly refactor re-usable unplug code into pc_dimm_memory_unplug().

Signed-off-by: Bharata B Rao bhar...@linux.vnet.ibm.com
---
 hw/i386/acpi-build.c |  2 +-
 hw/i386/pc.c | 90 +---
 hw/mem/pc-dimm.c | 80 ++
 include/hw/i386/pc.h |  4 +--
 include/hw/mem/pc-dimm.h |  9 +
 5 files changed, 109 insertions(+), 76 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index b71e942..5f6fa95 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1512,7 +1512,7 @@ build_srat(GArray *table_data, GArray *linker, 
PcGuestInfo *guest_info)
  */
 if (hotplugabble_address_space_size) {
 numamem = acpi_data_push(table_data, sizeof *numamem);
-acpi_build_srat_memory(numamem, pcms-hotplug_memory_base,
+acpi_build_srat_memory(numamem, pcms-hotplug_memory.base,
hotplugabble_address_space_size, 0,
MEM_AFFINITY_HOTPLUGGABLE |
MEM_AFFINITY_ENABLED);
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 3f0d435..c869588 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -64,7 +64,6 @@
 #include hw/pci/pci_host.h
 #include acpi-build.h
 #include hw/mem/pc-dimm.h
-#include trace.h
 #include qapi/visitor.h
 #include qapi-visit.h
 
@@ -1297,7 +1296,7 @@ FWCfgState *pc_memory_init(MachineState *machine,
 exit(EXIT_FAILURE);
 }
 
-pcms-hotplug_memory_base =
+pcms-hotplug_memory.base =
 ROUND_UP(0x1ULL + above_4g_mem_size, 1ULL  30);
 
 if (pcms-enforce_aligned_dimm) {
@@ -1305,17 +1304,17 @@ FWCfgState *pc_memory_init(MachineState *machine,
 hotplug_mem_size += (1ULL  30) * machine-ram_slots;
 }
 
-if ((pcms-hotplug_memory_base + hotplug_mem_size) 
+if ((pcms-hotplug_memory.base + hotplug_mem_size) 
 hotplug_mem_size) {
 error_report(unsupported amount of maximum memory:  RAM_ADDR_FMT,
  machine-maxram_size);
 exit(EXIT_FAILURE);
 }
 
-memory_region_init(pcms-hotplug_memory, OBJECT(pcms),
+memory_region_init(pcms-hotplug_memory.mr, OBJECT(pcms),
hotplug-memory, hotplug_mem_size);
-memory_region_add_subregion(system_memory, pcms-hotplug_memory_base,
-pcms-hotplug_memory);
+memory_region_add_subregion(system_memory, pcms-hotplug_memory.base,
+pcms-hotplug_memory.mr);
 }
 
 /* Initialize PC system firmware */
@@ -1333,9 +1332,9 @@ FWCfgState *pc_memory_init(MachineState *machine,
 fw_cfg = bochs_bios_init();
 rom_set_fw(fw_cfg);
 
-if (guest_info-has_reserved_memory  pcms-hotplug_memory_base) {
+if (guest_info-has_reserved_memory  pcms-hotplug_memory.base) {
 uint64_t *val = g_malloc(sizeof(*val));
-*val = cpu_to_le64(ROUND_UP(pcms-hotplug_memory_base, 0x1ULL  30));
+*val = cpu_to_le64(ROUND_UP(pcms-hotplug_memory.base, 0x1ULL  30));
 fw_cfg_add_file(fw_cfg, etc/reserved-memory-end, val, sizeof(*val));
 }
 
@@ -1554,20 +1553,17 @@ void ioapic_init_gsi(GSIState *gsi_state, const char 
*parent_name)
 static void pc_dimm_plug(HotplugHandler *hotplug_dev,
  DeviceState *dev, Error **errp)
 {
-int slot;
 HotplugHandlerClass *hhc;
 Error *local_err = NULL;
 PCMachineState *pcms = PC_MACHINE(hotplug_dev);
-MachineState *machine = MACHINE(hotplug_dev);
 PCDIMMDevice *dimm = PC_DIMM(dev);
 PCDIMMDeviceClass *ddc = PC_DIMM_GET_CLASS(dimm);
 MemoryRegion *mr = ddc-get_memory_region(dimm);
-uint64_t existing_dimms_capacity = 0;
 uint64_t align = TARGET_PAGE_SIZE;
-uint64_t addr;
 
-addr = object_property_get_int(OBJECT(dimm), PC_DIMM_ADDR_PROP, 
local_err);
-if (local_err) {
+if (!pcms-acpi_dev) {
+error_setg(local_err,
+   memory hotplug is not enabled: missing acpi device);
 goto out;
 }
 
@@ -1575,67 +1571,18 @@ static void pc_dimm_plug(HotplugHandler *hotplug_dev,
 align = memory_region_get_alignment(mr);
 }
 
-addr = pc_dimm_get_free_addr(pcms-hotplug_memory_base,
- memory_region_size(pcms-hotplug_memory),
- !addr ? NULL : addr, align,
- memory_region_size(mr), local_err);
-if (local_err) {
-goto out;
-}
-
-existing_dimms_capacity = pc_existing_dimms_capacity(local_err);
-if (local_err) {
-goto out;
-}
-
-if (existing_dimms_capacity + memory_region_size(mr) 
-   

[Qemu-devel] [RFC PATCH v1 2/4] numa, pc-dimm: Store pc-dimm memory information in numa_info

[Bharata B Rao]

Start storing the (start_addr, size, nodeid) of the pc-dimm memory
in numa_info so that this information can be used to lookup
node by address.

Signed-off-by: Bharata B Rao bhar...@linux.vnet.ibm.com
---
 hw/mem/pc-dimm.c  |  4 
 include/sysemu/numa.h | 10 ++
 numa.c| 26 ++
 3 files changed, 40 insertions(+)

diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index 98971b7..bb04862 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -97,6 +97,7 @@ void pc_dimm_memory_plug(DeviceState *dev, MemoryHotplugState 
*hpms,
 
 memory_region_add_subregion(hpms-mr, addr - hpms-base, mr);
 vmstate_register_ram(mr, dev);
+numa_set_mem_node_id(addr, memory_region_size(mr), dimm-node);
 
 out:
 error_propagate(errp, local_err);
@@ -105,6 +106,9 @@ out:
 void pc_dimm_memory_unplug(DeviceState *dev, MemoryHotplugState *hpms,
MemoryRegion *mr)
 {
+PCDIMMDevice *dimm = PC_DIMM(dev);
+
+numa_unset_mem_node_id(dimm-addr, memory_region_size(mr), dimm-node);
 memory_region_del_subregion(hpms-mr, mr);
 vmstate_unregister_ram(mr, dev);
 }
diff --git a/include/sysemu/numa.h b/include/sysemu/numa.h
index 6523b4d..7176364 100644
--- a/include/sysemu/numa.h
+++ b/include/sysemu/numa.h
@@ -10,16 +10,26 @@
 
 extern int nb_numa_nodes;   /* Number of NUMA nodes */
 
+struct numa_addr_range {
+ram_addr_t mem_start;
+ram_addr_t mem_end;
+QLIST_ENTRY(numa_addr_range) entry;
+};
+
 typedef struct node_info {
 uint64_t node_mem;
 DECLARE_BITMAP(node_cpu, MAX_CPUMASK_BITS);
 struct HostMemoryBackend *node_memdev;
 bool present;
+QLIST_HEAD(, numa_addr_range) addr; /* List to store address ranges */
 } NodeInfo;
+
 extern NodeInfo numa_info[MAX_NODES];
 void parse_numa_opts(MachineClass *mc);
 void numa_post_machine_init(void);
 void query_numa_node_mem(uint64_t node_mem[]);
 extern QemuOptsList qemu_numa_opts;
+void numa_set_mem_node_id(ram_addr_t addr, uint64_t size, uint32_t node);
+void numa_unset_mem_node_id(ram_addr_t addr, uint64_t size, uint32_t node);
 
 #endif
diff --git a/numa.c b/numa.c
index d227ccc..27ca743 100644
--- a/numa.c
+++ b/numa.c
@@ -53,6 +53,28 @@ static int max_numa_nodeid; /* Highest specified NUMA node 
ID, plus one.
 int nb_numa_nodes;
 NodeInfo numa_info[MAX_NODES];
 
+void numa_set_mem_node_id(ram_addr_t addr, uint64_t size, uint32_t node)
+{
+struct numa_addr_range *range = g_malloc0(sizeof(*range));
+
+range-mem_start = addr;
+range-mem_end = addr + size;
+QLIST_INSERT_HEAD(numa_info[node].addr, range, entry);
+}
+
+void numa_unset_mem_node_id(ram_addr_t addr, uint64_t size, uint32_t node)
+{
+struct numa_addr_range *range, *next;
+
+QLIST_FOREACH_SAFE(range, numa_info[node].addr, entry, next) {
+if (addr == range-mem_start  (addr + size) == range-mem_end) {
+QLIST_REMOVE(range, entry);
+g_free(range);
+return;
+}
+}
+}
+
 static void numa_node_parse(NumaNodeOptions *node, QemuOpts *opts, Error 
**errp)
 {
 uint16_t nodenr;
@@ -275,6 +297,10 @@ void parse_numa_opts(MachineClass *mc)
 }
 
 for (i = 0; i  nb_numa_nodes; i++) {
+QLIST_INIT(numa_info[i].addr);
+}
+
+for (i = 0; i  nb_numa_nodes; i++) {
 if (!bitmap_empty(numa_info[i].node_cpu, MAX_CPUMASK_BITS)) {
 break;
 }
-- 
2.1.0

[Qemu-devel] [RFC PATCH v1 4/4] numa: API to lookup NUMA node by address

[Bharata B Rao]

Introduce an API numa_get_node(ram_addr_t addr, Error **errp) that
returns the NUMA node to which the given address belongs to. This
API works uniformly for both boot time as well as hotplugged memory.

This API is needed by sPAPR PowerPC to support
ibm,dynamic-reconfiguration-memory device tree node which is needed for
memory hotplug.

Signed-off-by: Bharata B Rao bhar...@linux.vnet.ibm.com
---
 include/sysemu/numa.h |  1 +
 numa.c| 34 ++
 2 files changed, 35 insertions(+)

diff --git a/include/sysemu/numa.h b/include/sysemu/numa.h
index 7176364..a6392bc 100644
--- a/include/sysemu/numa.h
+++ b/include/sysemu/numa.h
@@ -31,5 +31,6 @@ void query_numa_node_mem(uint64_t node_mem[]);
 extern QemuOptsList qemu_numa_opts;
 void numa_set_mem_node_id(ram_addr_t addr, uint64_t size, uint32_t node);
 void numa_unset_mem_node_id(ram_addr_t addr, uint64_t size, uint32_t node);
+uint32_t numa_get_node(ram_addr_t addr, Error **errp);
 
 #endif
diff --git a/numa.c b/numa.c
index d67b1fb..ed18a61 100644
--- a/numa.c
+++ b/numa.c
@@ -95,6 +95,40 @@ static void numa_set_mem_ranges(void)
 }
 }
 
+/*
+ * Check if @addr falls under NUMA @node.
+ */
+static bool numa_addr_belongs_to_node(ram_addr_t addr, uint32_t node)
+{
+struct numa_addr_range *range;
+
+QLIST_FOREACH(range, numa_info[node].addr, entry) {
+if (addr = range-mem_start  addr  range-mem_end) {
+return true;
+}
+}
+return false;
+}
+
+/*
+ * Given an address, return the index of the NUMA node to which the
+ * address belongs to.
+ */
+uint32_t numa_get_node(ram_addr_t addr, Error **errp)
+{
+uint32_t i;
+
+for (i = 0; i  nb_numa_nodes; i++) {
+if (numa_addr_belongs_to_node(addr, i)) {
+return i;
+}
+}
+
+error_setg(errp, Address 0x RAM_ADDR_FMT  doesn't belong to any 
+NUMA node, addr);
+return -1;
+}
+
 static void numa_node_parse(NumaNodeOptions *node, QemuOpts *opts, Error 
**errp)
 {
 uint16_t nodenr;
-- 
2.1.0

[Qemu-devel] [PULL 07/29] target-mips: add ERETNC instruction and Config5.LLB bit

[Leon Alrae]

ERETNC is identical to ERET except that an ERETNC will not clear the LLbit
that is set by execution of an LL instruction, and thus when placed between
an LL and SC sequence, will never cause the SC to fail.

Presence of ERETNC is denoted by the Config5.LLB.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 disas/mips.c |  1 +
 target-mips/cpu.h|  1 +
 target-mips/helper.h |  1 +
 target-mips/op_helper.c  | 12 +++-
 target-mips/translate.c  | 20 +++-
 target-mips/translate_init.c |  3 ++-
 6 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/disas/mips.c b/disas/mips.c
index 1afe0c5..832468c 100644
--- a/disas/mips.c
+++ b/disas/mips.c
@@ -2407,6 +2407,7 @@ const struct mips_opcode mips_builtin_opcodes[] =
 {emt, ,0x41600be1, 0x, TRAP,   
0,  MT32},
 {emt, t,   0x41600be1, 0xffe0, TRAP|WR_t,  0,  
MT32},
 {eret,, 0x4218, 0x, 0, 0,  
I3|I32  },
+{eretnc,  , 0x4258, 0x, 0,0, I33},
 {evpe,,0x41600021, 0x, TRAP,   
0,  MT32},
 {evpe,t,   0x41600021, 0xffe0, TRAP|WR_t,  0,  
MT32},
 {ext, t,r,+A,+C, 0x7c00, 0xfc3f, WR_t|RD_s,
0,  I33 },
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 03eb888..2c68782 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -466,6 +466,7 @@ struct CPUMIPSState {
 #define CP0C5_UFE9
 #define CP0C5_FRE8
 #define CP0C5_SBRI   6
+#define CP0C5_LLB4
 #define CP0C5_UFR2
 #define CP0C5_NFExists   0
 int32_t CP0_Config6;
diff --git a/target-mips/helper.h b/target-mips/helper.h
index bdd5ba5..8df98c7 100644
--- a/target-mips/helper.h
+++ b/target-mips/helper.h
@@ -348,6 +348,7 @@ DEF_HELPER_1(tlbinvf, void, env)
 DEF_HELPER_1(di, tl, env)
 DEF_HELPER_1(ei, tl, env)
 DEF_HELPER_1(eret, void, env)
+DEF_HELPER_1(eretnc, void, env)
 DEF_HELPER_1(deret, void, env)
 #endif /* !CONFIG_USER_ONLY */
 DEF_HELPER_1(rdhwr_cpunum, tl, env)
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 2fe862a..b412f94 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -2099,7 +2099,7 @@ static void set_pc(CPUMIPSState *env, target_ulong 
error_pc)
 }
 }
 
-void helper_eret(CPUMIPSState *env)
+static inline void exception_return(CPUMIPSState *env)
 {
 debug_pre_eret(env);
 if (env-CP0_Status  (1  CP0St_ERL)) {
@@ -2111,9 +2111,19 @@ void helper_eret(CPUMIPSState *env)
 }
 compute_hflags(env);
 debug_post_eret(env);
+}
+
+void helper_eret(CPUMIPSState *env)
+{
+exception_return(env);
 env-lladdr = 1;
 }
 
+void helper_eretnc(CPUMIPSState *env)
+{
+exception_return(env);
+}
+
 void helper_deret(CPUMIPSState *env)
 {
 debug_pre_eret(env);
diff --git a/target-mips/translate.c b/target-mips/translate.c
index fe6bc16..f6ae0d3 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -7917,16 +7917,26 @@ static void gen_cp0 (CPUMIPSState *env, DisasContext 
*ctx, uint32_t opc, int rt,
 goto die;
 gen_helper_tlbr(cpu_env);
 break;
-case OPC_ERET:
-opn = eret;
-check_insn(ctx, ISA_MIPS2);
+case OPC_ERET: /* OPC_ERETNC */
 if ((ctx-insn_flags  ISA_MIPS32R6) 
 (ctx-hflags  MIPS_HFLAG_BMASK)) {
 MIPS_DEBUG(CTI in delay / forbidden slot);
 goto die;
+} else {
+int bit_shift = (ctx-hflags  MIPS_HFLAG_M16) ? 16 : 6;
+if (ctx-opcode  (1  bit_shift)) {
+/* OPC_ERETNC */
+opn = eretnc;
+check_insn(ctx, ISA_MIPS32R5);
+gen_helper_eretnc(cpu_env);
+} else {
+/* OPC_ERET */
+opn = eret;
+check_insn(ctx, ISA_MIPS2);
+gen_helper_eret(cpu_env);
+}
+ctx-bstate = BS_EXCP;
 }
-gen_helper_eret(cpu_env);
-ctx-bstate = BS_EXCP;
 break;
 case OPC_DERET:
 opn = deret;
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index 00369f1..51e7c98 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -403,7 +403,7 @@ static const mips_def_t mips_defs[] =
 .CP0_Config3 = MIPS_CONFIG3 | (1U  CP0C3_M) | (1  CP0C3_MSAP),
 .CP0_Config4 = MIPS_CONFIG4 | (1U  CP0C4_M),
 .CP0_Config4_rw_bitmask = 0,
-.CP0_Config5 = MIPS_CONFIG5 | (1  CP0C5_UFR),
+.CP0_Config5 = MIPS_CONFIG5 | (1  CP0C5_UFR) | (1  CP0C5_LLB),
 .CP0_Config5_rw_bitmask = (0  CP0C5_M) | (1  CP0C5_K) |
   (1  CP0C5_CV) | (0  CP0C5_EVA) |
  

[Qemu-devel] [PULL 23/29] target-mips: correct MFC0 for CP0.EntryLo in MIPS64

[Leon Alrae]

CP0.EntryLo bits 31:30 have to be cleared.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 target-mips/translate.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target-mips/translate.c b/target-mips/translate.c
index f6ae0d3..2cc5875 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -4964,10 +4964,10 @@ static void gen_mfc0(DisasContext *ctx, TCGv arg, int 
reg, int sel)
 tcg_gen_ld_tl(arg, cpu_env, offsetof(CPUMIPSState, CP0_EntryLo0));
 #if defined(TARGET_MIPS64)
 if (ctx-rxi) {
+/* Move RI/XI fields to bits 31:30 */
 TCGv tmp = tcg_temp_new();
-tcg_gen_andi_tl(tmp, arg, (3ull  CP0EnLo_XI));
-tcg_gen_shri_tl(tmp, tmp, 32);
-tcg_gen_or_tl(arg, arg, tmp);
+tcg_gen_shri_tl(tmp, arg, CP0EnLo_XI);
+tcg_gen_deposit_tl(arg, arg, tmp, 30, 2);
 tcg_temp_free(tmp);
 }
 #endif
@@ -5019,10 +5019,10 @@ static void gen_mfc0(DisasContext *ctx, TCGv arg, int 
reg, int sel)
 tcg_gen_ld_tl(arg, cpu_env, offsetof(CPUMIPSState, CP0_EntryLo1));
 #if defined(TARGET_MIPS64)
 if (ctx-rxi) {
+/* Move RI/XI fields to bits 31:30 */
 TCGv tmp = tcg_temp_new();
-tcg_gen_andi_tl(tmp, arg, (3ull  CP0EnLo_XI));
-tcg_gen_shri_tl(tmp, tmp, 32);
-tcg_gen_or_tl(arg, arg, tmp);
+tcg_gen_shri_tl(tmp, arg, CP0EnLo_XI);
+tcg_gen_deposit_tl(arg, arg, tmp, 30, 2);
 tcg_temp_free(tmp);
 }
 #endif
-- 
2.1.0

[Qemu-devel] [PULL 15/29] net/dp8393x: always calculate proper checksums

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/net/dp8393x.c | 12 +---
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 2297231..093f0cc 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -21,16 +21,10 @@
 #include qemu/timer.h
 #include net/net.h
 #include hw/mips/mips.h
+#include zlib.h
 
 //#define DEBUG_SONIC
 
-/* Calculate CRCs properly on Rx packets */
-#define SONIC_CALCULATE_RXCRC
-
-#if defined(SONIC_CALCULATE_RXCRC)
-/* For crc32 */
-#include zlib.h
-#endif
 
 #ifdef DEBUG_SONIC
 #define DPRINTF(fmt, ...) \
@@ -764,11 +758,7 @@ static ssize_t nic_receive(NetClientState *nc, const 
uint8_t * buf, size_t size)
 s-regs[SONIC_TRBA0] = s-regs[SONIC_CRBA0];
 
 /* Calculate the ethernet checksum */
-#ifdef SONIC_CALCULATE_RXCRC
 checksum = cpu_to_le32(crc32(0, buf, rx_len));
-#else
-checksum = 0;
-#endif
 
 /* Put packet into RBA */
 DPRINTF(Receive packet at %08x\n, (s-regs[SONIC_CRBA1]  16) | 
s-regs[SONIC_CRBA0]);
-- 
2.1.0

Re: [Qemu-devel] [PATCH v5 2/4] monitor: cleanup parsing of cmd name and cmd arguments

[Markus Armbruster]

Bandan Das b...@redhat.com writes:

 There's too much going on in monitor_parse_command().
 Split up the arguments parsing bits into a separate function
 monitor_parse_arguments(). Let the original function check for
 command validity and sub-commands if any and return data (*cmd)
 that the newly introduced function can process and return a
 QDict. Also, pass a pointer to the cmdline to track current
 parser location.

 Suggested-by: Markus Armbruster arm...@redhat.com
 Signed-off-by: Bandan Das b...@redhat.com

Doesn't apply cleanly anymore.  Please double-check my conflict
resolution carefully:

diff --git a/monitor.c b/monitor.c
index bcb88cd..0b0a8df 100644
--- a/monitor.c
+++ b/monitor.c
[...]
@@ -4156,13 +4168,17 @@ static void handle_hmp_command(Monitor *mon, const char 
*cmdline)
 QDict *qdict;
 const mon_cmd_t *cmd;
 
-qdict = qdict_new();
+cmd = monitor_parse_command(mon, cmdline, mon-cmd_table);
+if (!cmd) {
+return;
+}
 
-cmd = monitor_parse_command(mon, cmdline, 0, mon-cmd_table, qdict);
-if (cmd) {
-cmd-mhandler.cmd(mon, qdict);
+qdict = monitor_parse_arguments(mon, cmdline, cmd);
+if (!qdict) {
+return;
 }
 
+cmd-mhandler.cmd(mon, qdict);
 QDECREF(qdict);
 }
 

[Qemu-devel] [PULL 11/29] dma/rc4030: do not use old_mmio accesses

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/dma/rc4030.c | 112 
 1 file changed, 16 insertions(+), 96 deletions(-)

diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index a0b617f..96f796b 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -125,7 +125,7 @@ static void set_next_tick(rc4030State *s)
 }
 
 /* called for accesses to rc4030 */
-static uint32_t rc4030_readl(void *opaque, hwaddr addr)
+static uint64_t rc4030_read(void *opaque, hwaddr addr, unsigned int size)
 {
 rc4030State *s = opaque;
 uint32_t val;
@@ -263,21 +263,6 @@ static uint32_t rc4030_readl(void *opaque, hwaddr addr)
 return val;
 }
 
-static uint32_t rc4030_readw(void *opaque, hwaddr addr)
-{
-uint32_t v = rc4030_readl(opaque, addr  ~0x3);
-if (addr  0x2)
-return v  16;
-else
-return v  0x;
-}
-
-static uint32_t rc4030_readb(void *opaque, hwaddr addr)
-{
-uint32_t v = rc4030_readl(opaque, addr  ~0x3);
-return (v  (8 * (addr  0x3)))  0xff;
-}
-
 static void rc4030_dma_as_update_one(rc4030State *s, int index, uint32_t frame)
 {
 if (index  MAX_TL_ENTRIES) {
@@ -368,10 +353,11 @@ static void rc4030_dma_tt_update(rc4030State *s, uint32_t 
new_tl_base,
 }
 }
 
-
-static void rc4030_writel(void *opaque, hwaddr addr, uint32_t val)
+static void rc4030_write(void *opaque, hwaddr addr, uint64_t data,
+ unsigned int size)
 {
 rc4030State *s = opaque;
+uint32_t val = data;
 addr = 0x3fff;
 
 DPRINTF(write 0x%02x at  TARGET_FMT_plx \n, val, addr);
@@ -494,43 +480,11 @@ static void rc4030_writel(void *opaque, hwaddr addr, 
uint32_t val)
 }
 }
 
-static void rc4030_writew(void *opaque, hwaddr addr, uint32_t val)
-{
-uint32_t old_val = rc4030_readl(opaque, addr  ~0x3);
-
-if (addr  0x2)
-val = (val  16) | (old_val  0x);
-else
-val = val | (old_val  0x);
-rc4030_writel(opaque, addr  ~0x3, val);
-}
-
-static void rc4030_writeb(void *opaque, hwaddr addr, uint32_t val)
-{
-uint32_t old_val = rc4030_readl(opaque, addr  ~0x3);
-
-switch (addr  3) {
-case 0:
-val = val | (old_val  0xff00);
-break;
-case 1:
-val = (val  8) | (old_val  0x00ff);
-break;
-case 2:
-val = (val  16) | (old_val  0xff00);
-break;
-case 3:
-val = (val  24) | (old_val  0x00ff);
-break;
-}
-rc4030_writel(opaque, addr  ~0x3, val);
-}
-
 static const MemoryRegionOps rc4030_ops = {
-.old_mmio = {
-.read = { rc4030_readb, rc4030_readw, rc4030_readl, },
-.write = { rc4030_writeb, rc4030_writew, rc4030_writel, },
-},
+.read = rc4030_read,
+.write = rc4030_write,
+.impl.min_access_size = 4,
+.impl.max_access_size = 4,
 .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
@@ -583,7 +537,7 @@ static void rc4030_periodic_timer(void *opaque)
 qemu_irq_raise(s-timer_irq);
 }
 
-static uint32_t jazzio_readw(void *opaque, hwaddr addr)
+static uint64_t jazzio_read(void *opaque, hwaddr addr, unsigned int size)
 {
 rc4030State *s = opaque;
 uint32_t val;
@@ -621,24 +575,11 @@ static uint32_t jazzio_readw(void *opaque, hwaddr addr)
 return val;
 }
 
-static uint32_t jazzio_readb(void *opaque, hwaddr addr)
-{
-uint32_t v;
-v = jazzio_readw(opaque, addr  ~0x1);
-return (v  (8 * (addr  0x1)))  0xff;
-}
-
-static uint32_t jazzio_readl(void *opaque, hwaddr addr)
-{
-uint32_t v;
-v = jazzio_readw(opaque, addr);
-v |= jazzio_readw(opaque, addr + 2)  16;
-return v;
-}
-
-static void jazzio_writew(void *opaque, hwaddr addr, uint32_t val)
+static void jazzio_write(void *opaque, hwaddr addr, uint64_t data,
+ unsigned int size)
 {
 rc4030State *s = opaque;
+uint32_t val = data;
 addr = 0xfff;
 
 DPRINTF((jazz io controller) write 0x%04x at  TARGET_FMT_plx \n, val, 
addr);
@@ -655,32 +596,11 @@ static void jazzio_writew(void *opaque, hwaddr addr, 
uint32_t val)
 }
 }
 
-static void jazzio_writeb(void *opaque, hwaddr addr, uint32_t val)
-{
-uint32_t old_val = jazzio_readw(opaque, addr  ~0x1);
-
-switch (addr  1) {
-case 0:
-val = val | (old_val  0xff00);
-break;
-case 1:
-val = (val  8) | (old_val  0x00ff);
-break;
-}
-jazzio_writew(opaque, addr  ~0x1, val);
-}
-
-static void jazzio_writel(void *opaque, hwaddr addr, uint32_t val)
-{
-jazzio_writew(opaque, addr, val  0x);
-jazzio_writew(opaque, addr + 2, (val  16)  0x);
-}
-
 static const MemoryRegionOps jazzio_ops = {
-.old_mmio = {
-.read = { jazzio_readb, jazzio_readw, jazzio_readl, },
-.write = { jazzio_writeb, jazzio_writew, jazzio_writel, },
-},
+.read = jazzio_read,
+

[Qemu-devel] [PULL 03/29] mips_malta: provide ememsize env variable to kernels

[Leon Alrae]

From: Paul Burton paul.bur...@imgtec.com

Commit 94c2b6aff43c (mips_malta: support up to 2GiB RAM) provided
support for using over 256MB of RAM with the MIPS Malta board, including
capping the memsize variable that QEMUs pseudo-bootloader provides to
the kernel at 256MB in order to match YAMON. It didn't however provide
the ememsize variable which kernels supporting memory outside of the
unmapped address spaces (ie. EVA or highmem) may use to determine the
true size of the RAM present in the system.

Set ememsize to the size of RAM so that such kernels may use all
available memory without the user having to manually specifying its size
 location.

Signed-off-by: Paul Burton paul.bur...@imgtec.com
Cc: Aurelien Jarno aurel...@aurel32.net
Cc: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/mips/mips_malta.c | 15 +--
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 5140882..786a8f0 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -97,7 +97,7 @@ typedef struct {
 static ISADevice *pit;
 
 static struct _loaderparams {
-int ram_size;
+int ram_size, ram_low_size;
 const char *kernel_filename;
 const char *kernel_cmdline;
 const char *initrd_filename;
@@ -641,8 +641,8 @@ static void write_bootloader (CPUMIPSState *env, uint8_t 
*base,
 stl_p(p++, 0x34a5 | (ENVP_ADDR  0x));   /* ori a1, 
a1, low(ENVP_ADDR) */
 stl_p(p++, 0x3c06 | (((ENVP_ADDR + 8)  16)  0x)); /* lui a2, 
high(ENVP_ADDR + 8) */
 stl_p(p++, 0x34c6 | ((ENVP_ADDR + 8)  0x)); /* ori a2, 
a2, low(ENVP_ADDR + 8) */
-stl_p(p++, 0x3c07 | (loaderparams.ram_size  16)); /* lui a3, 
high(ram_size) */
-stl_p(p++, 0x34e7 | (loaderparams.ram_size  0x));  /* ori a3, a3, 
low(ram_size) */
+stl_p(p++, 0x3c07 | (loaderparams.ram_low_size  16)); /* lui a3, 
high(ram_low_size) */
+stl_p(p++, 0x34e7 | (loaderparams.ram_low_size  0x));  /* ori a3, 
a3, low(ram_low_size) */
 
 /* Load BAR registers as done by YAMON */
 stl_p(p++, 0x3c09b400);  /* lui t1, 
0xb400 */
@@ -851,8 +851,10 @@ static int64_t load_kernel (void)
 }
 
 prom_set(prom_buf, prom_index++, memsize);
-prom_set(prom_buf, prom_index++, %i,
- MIN(loaderparams.ram_size, 256  20));
+prom_set(prom_buf, prom_index++, %u, loaderparams.ram_low_size);
+
+prom_set(prom_buf, prom_index++, ememsize);
+prom_set(prom_buf, prom_index++, %u, loaderparams.ram_size);
 
 prom_set(prom_buf, prom_index++, modetty0);
 prom_set(prom_buf, prom_index++, 38400n8r);
@@ -1054,7 +1056,8 @@ void mips_malta_init(MachineState *machine)
 }
 
 /* Write a small bootloader to the flash location. */
-loaderparams.ram_size = ram_low_size;
+loaderparams.ram_size = ram_size;
+loaderparams.ram_low_size = ram_low_size;
 loaderparams.kernel_filename = kernel_filename;
 loaderparams.kernel_cmdline = kernel_cmdline;
 loaderparams.initrd_filename = initrd_filename;
-- 
2.1.0

[Qemu-devel] [RFC PATCH v1 3/4] numa: Store boot memory address range in node_info

[Bharata B Rao]

Store memory address range information of boot memory  in address
range list of numa_info.

This helps to have a common NUMA node lookup by address function that
works for both boot time memory and hotplugged memory.

Signed-off-by: Bharata B Rao bhar...@linux.vnet.ibm.com
---
 numa.c | 22 ++
 1 file changed, 22 insertions(+)

diff --git a/numa.c b/numa.c
index 27ca743..d67b1fb 100644
--- a/numa.c
+++ b/numa.c
@@ -75,6 +75,26 @@ void numa_unset_mem_node_id(ram_addr_t addr, uint64_t size, 
uint32_t node)
 }
 }
 
+static void numa_set_mem_ranges(void)
+{
+int i;
+ram_addr_t mem_start, mem_end_prev;
+
+/*
+ * Deduce start address of each node and use it to store
+ * the address range info in numa_info address range list
+ */
+for (i = 0; i  nb_numa_nodes; i++) {
+if (i) {
+mem_start = mem_end_prev;
+} else {
+mem_start = 0;
+}
+mem_end_prev = mem_start + numa_info[i].node_mem;
+numa_set_mem_node_id(mem_start, numa_info[i].node_mem, i);
+}
+}
+
 static void numa_node_parse(NumaNodeOptions *node, QemuOpts *opts, Error 
**errp)
 {
 uint16_t nodenr;
@@ -300,6 +320,8 @@ void parse_numa_opts(MachineClass *mc)
 QLIST_INIT(numa_info[i].addr);
 }
 
+numa_set_mem_ranges();
+
 for (i = 0; i  nb_numa_nodes; i++) {
 if (!bitmap_empty(numa_info[i].node_cpu, MAX_CPUMASK_BITS)) {
 break;
-- 
2.1.0

[Qemu-devel] [RFC PATCH v1 0/4] Refactoring pc_dimm_plug and NUMA node lookup API

[Bharata B Rao]

Hi,

This is the next version of the NUMA lookup API v0 that I posted earlier.
In this version, I have added a patch to factor out generic code from
pc_dimm_plug() so that the same can be used by other architectures. I
combined NUMA lookup API and this patch together since they are related
and touch common code.

This version is based on the feedback I received for my v0 post:
https://lists.gnu.org/archive/html/qemu-devel/2015-05/msg01078.html

Bharata B Rao (4):
  pc,pc-dimm: Factor out reusable parts in pc_dimm_plug to a separate
routine
  numa,pc-dimm: Store pc-dimm memory information in numa_info
  numa: Store boot memory address range in node_info
  numa: API to lookup NUMA node by address

 hw/i386/acpi-build.c |  2 +-
 hw/i386/pc.c | 90 +---
 hw/mem/pc-dimm.c | 84 
 include/hw/i386/pc.h |  4 +--
 include/hw/mem/pc-dimm.h |  9 +
 include/sysemu/numa.h| 11 ++
 numa.c   | 82 +++
 7 files changed, 206 insertions(+), 76 deletions(-)

-- 
2.1.0

[Qemu-devel] [PULL 16/29] net/dp8393x: do not use old_mmio accesses

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/net/dp8393x.c | 114 ++-
 1 file changed, 29 insertions(+), 85 deletions(-)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 093f0cc..5cc1e6b 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -473,8 +473,10 @@ static void do_command(dp8393xState *s, uint16_t command)
 do_load_cam(s);
 }
 
-static uint16_t read_register(dp8393xState *s, int reg)
+static uint64_t dp8393x_read(void *opaque, hwaddr addr, unsigned int size)
 {
+dp8393xState *s = opaque;
+int reg = addr  s-it_shift;
 uint16_t val = 0;
 
 switch (reg) {
@@ -503,14 +505,18 @@ static uint16_t read_register(dp8393xState *s, int reg)
 return val;
 }
 
-static void write_register(dp8393xState *s, int reg, uint16_t val)
+static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+  unsigned int size)
 {
-DPRINTF(write 0x%04x to reg %s\n, val, reg_names[reg]);
+dp8393xState *s = opaque;
+int reg = addr  s-it_shift;
+
+DPRINTF(write 0x%04x to reg %s\n, (uint16_t)data, reg_names[reg]);
 
 switch (reg) {
 /* Command register */
 case SONIC_CR:
-do_command(s, val);
+do_command(s, data);
 break;
 /* Prevent write to read-only registers */
 case SONIC_CAP2:
@@ -523,36 +529,36 @@ static void write_register(dp8393xState *s, int reg, 
uint16_t val)
 /* Accept write to some registers only when in reset mode */
 case SONIC_DCR:
 if (s-regs[SONIC_CR]  SONIC_CR_RST) {
-s-regs[reg] = val  0xbfff;
+s-regs[reg] = data  0xbfff;
 } else {
 DPRINTF(writing to DCR invalid\n);
 }
 break;
 case SONIC_DCR2:
 if (s-regs[SONIC_CR]  SONIC_CR_RST) {
-s-regs[reg] = val  0xf017;
+s-regs[reg] = data  0xf017;
 } else {
 DPRINTF(writing to DCR2 invalid\n);
 }
 break;
 /* 12 lower bytes are Read Only */
 case SONIC_TCR:
-s-regs[reg] = val  0xf000;
+s-regs[reg] = data  0xf000;
 break;
 /* 9 lower bytes are Read Only */
 case SONIC_RCR:
-s-regs[reg] = val  0xffe0;
+s-regs[reg] = data  0xffe0;
 break;
 /* Ignore most significant bit */
 case SONIC_IMR:
-s-regs[reg] = val  0x7fff;
+s-regs[reg] = data  0x7fff;
 dp8393x_update_irq(s);
 break;
 /* Clear bits by writing 1 to them */
 case SONIC_ISR:
-val = s-regs[reg];
-s-regs[reg] = ~val;
-if (val  SONIC_ISR_RBE) {
+data = s-regs[reg];
+s-regs[reg] = ~data;
+if (data  SONIC_ISR_RBE) {
 do_read_rra(s);
 }
 dp8393x_update_irq(s);
@@ -562,17 +568,17 @@ static void write_register(dp8393xState *s, int reg, 
uint16_t val)
 case SONIC_REA:
 case SONIC_RRP:
 case SONIC_RWP:
-s-regs[reg] = val  0xfffe;
+s-regs[reg] = data  0xfffe;
 break;
 /* Invert written value for some registers */
 case SONIC_CRCT:
 case SONIC_FAET:
 case SONIC_MPT:
-s-regs[reg] = val ^ 0x;
+s-regs[reg] = data ^ 0x;
 break;
 /* All other registers have no special contrainst */
 default:
-s-regs[reg] = val;
+s-regs[reg] = data;
 }
 
 if (reg == SONIC_WT0 || reg == SONIC_WT1) {
@@ -580,6 +586,14 @@ static void write_register(dp8393xState *s, int reg, 
uint16_t val)
 }
 }
 
+static const MemoryRegionOps dp8393x_ops = {
+.read = dp8393x_read,
+.write = dp8393x_write,
+.impl.min_access_size = 2,
+.impl.max_access_size = 2,
+.endianness = DEVICE_NATIVE_ENDIAN,
+};
+
 static void dp8393x_watchdog(void *opaque)
 {
 dp8393xState *s = opaque;
@@ -597,76 +611,6 @@ static void dp8393x_watchdog(void *opaque)
 dp8393x_update_irq(s);
 }
 
-static uint32_t dp8393x_readw(void *opaque, hwaddr addr)
-{
-dp8393xState *s = opaque;
-int reg;
-
-if ((addr  ((1  s-it_shift) - 1)) != 0) {
-return 0;
-}
-
-reg = addr  s-it_shift;
-return read_register(s, reg);
-}
-
-static uint32_t dp8393x_readb(void *opaque, hwaddr addr)
-{
-uint16_t v = dp8393x_readw(opaque, addr  ~0x1);
-return (v  (8 * (addr  0x1)))  0xff;
-}
-
-static uint32_t dp8393x_readl(void *opaque, hwaddr addr)
-{
-uint32_t v;
-v = dp8393x_readw(opaque, addr);
-v |= dp8393x_readw(opaque, addr + 2)  16;
-return v;
-}
-
-static void dp8393x_writew(void *opaque, hwaddr 

[Qemu-devel] [PULL 27/29] target-mips: add MTHC0 and MFHC0 instructions

[Leon Alrae]

Implement MTHC0 and MFHC0 instructions. In MIPS32 they are used to access
upper word of extended to 64-bits CP0 registers.

In MIPS64, when CP0 destination register specified is the EntryLo0 or
EntryLo1, bits 1:0 of the GPR appear at bits 31:30 of EntryLo0 or
EntryLo1. This is to compensate for RI and XI, which were shifted to bits
63:62 by MTC0 to EntryLo0 or EntryLo1. Therefore creating separate
functions for EntryLo0 and EntryLo1.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 disas/mips.c|   2 +
 target-mips/cpu.h   |   1 +
 target-mips/translate.c | 226 
 3 files changed, 229 insertions(+)

diff --git a/disas/mips.c b/disas/mips.c
index 832468c..32940fe 100644
--- a/disas/mips.c
+++ b/disas/mips.c
@@ -2238,6 +2238,8 @@ const struct mips_opcode mips_builtin_opcodes[] =
 {ceil.l.s, D,S,0x460a, 0x003f, WR_D|RD_S|FP_S|FP_D,0,  
I3|I33  },
 {ceil.w.d, D,S,0x462e, 0x003f, WR_D|RD_S|FP_S|FP_D,0,  
I2  },
 {ceil.w.s, D,S,0x460e, 0x003f, WR_D|RD_S|FP_S, 0,  
I2  },
+{mfhc0,   t,G,H,0x4040, 0xffe007f8, LCD|WR_t|RD_C0,   0, I33},
+{mthc0,   t,G,H,0x40c0, 0xffe007f8, COD|RD_t|WR_C0|WR_CC, 0, I33},
 {cfc0,t,G, 0x4040, 0xffe007ff, LCD|WR_t|RD_C0, 0,  
I1  },
 {cfc1,t,G, 0x4440, 0xffe007ff, LCD|WR_t|RD_C1|FP_S,0,  
I1  },
 {cfc1,t,S, 0x4440, 0xffe007ff, LCD|WR_t|RD_C1|FP_S,0,  
I1  },
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index c266e9f..474a0e3 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -473,6 +473,7 @@ struct CPUMIPSState {
 #define CP0C5_UFE9
 #define CP0C5_FRE8
 #define CP0C5_SBRI   6
+#define CP0C5_MVH5
 #define CP0C5_LLB4
 #define CP0C5_UFR2
 #define CP0C5_NFExists   0
diff --git a/target-mips/translate.c b/target-mips/translate.c
index 6a39ef0..1d128ee 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -868,8 +868,10 @@ enum {
 enum {
 OPC_MFC0 = (0x00  21) | OPC_CP0,
 OPC_DMFC0= (0x01  21) | OPC_CP0,
+OPC_MFHC0= (0x02  21) | OPC_CP0,
 OPC_MTC0 = (0x04  21) | OPC_CP0,
 OPC_DMTC0= (0x05  21) | OPC_CP0,
+OPC_MTHC0= (0x06  21) | OPC_CP0,
 OPC_MFTR = (0x08  21) | OPC_CP0,
 OPC_RDPGPR   = (0x0A  21) | OPC_CP0,
 OPC_MFMC0= (0x0B  21) | OPC_CP0,
@@ -1424,6 +1426,9 @@ typedef struct DisasContext {
 int ie;
 bool bi;
 bool bp;
+uint64_t PAMask;
+bool mvh;
+int CP0_LLAddr_shift;
 } DisasContext;
 
 enum {
@@ -1821,6 +1826,15 @@ static inline void check_mips_64(DisasContext *ctx)
 }
 #endif
 
+#ifndef CONFIG_USER_ONLY
+static inline void check_mvh(DisasContext *ctx)
+{
+if (unlikely(!ctx-mvh)) {
+generate_exception(ctx, EXCP_RI);
+}
+}
+#endif
+
 /* Define small wrappers for gen_load_fpr* so that we have a uniform
calling interface for 32 and 64-bit FPRs.  No sense in changing
all callers for gen_load_fpr32 when we need the CTX parameter for
@@ -4842,6 +4856,60 @@ static inline void gen_move_low32(TCGv ret, TCGv_i64 arg)
 #endif
 }
 
+static inline void gen_mthc0_entrylo(TCGv arg, target_ulong off)
+{
+TCGv_i64 t0 = tcg_temp_new_i64();
+TCGv_i64 t1 = tcg_temp_new_i64();
+
+tcg_gen_ext_tl_i64(t0, arg);
+tcg_gen_ld_i64(t1, cpu_env, off);
+#if defined(TARGET_MIPS64)
+tcg_gen_deposit_i64(t1, t1, t0, 30, 32);
+#else
+tcg_gen_concat32_i64(t1, t1, t0);
+#endif
+tcg_gen_st_i64(t1, cpu_env, off);
+tcg_temp_free_i64(t1);
+tcg_temp_free_i64(t0);
+}
+
+static inline void gen_mthc0_store64(TCGv arg, target_ulong off)
+{
+TCGv_i64 t0 = tcg_temp_new_i64();
+TCGv_i64 t1 = tcg_temp_new_i64();
+
+tcg_gen_ext_tl_i64(t0, arg);
+tcg_gen_ld_i64(t1, cpu_env, off);
+tcg_gen_concat32_i64(t1, t1, t0);
+tcg_gen_st_i64(t1, cpu_env, off);
+tcg_temp_free_i64(t1);
+tcg_temp_free_i64(t0);
+}
+
+static inline void gen_mfhc0_entrylo(TCGv arg, target_ulong off)
+{
+TCGv_i64 t0 = tcg_temp_new_i64();
+
+tcg_gen_ld_i64(t0, cpu_env, off);
+#if defined(TARGET_MIPS64)
+tcg_gen_shri_i64(t0, t0, 30);
+#else
+tcg_gen_shri_i64(t0, t0, 32);
+#endif
+gen_move_low32(arg, t0);
+tcg_temp_free_i64(t0);
+}
+
+static inline void gen_mfhc0_load64(TCGv arg, target_ulong off, int shift)
+{
+TCGv_i64 t0 = tcg_temp_new_i64();
+
+tcg_gen_ld_i64(t0, cpu_env, off);
+tcg_gen_shri_i64(t0, t0, 32 + shift);
+gen_move_low32(arg, t0);
+tcg_temp_free_i64(t0);
+}
+
 static inline void gen_mfc0_load32 (TCGv arg, target_ulong off)
 {
 TCGv_i32 t0 = tcg_temp_new_i32();
@@ -4872,6 +4940,140 @@ static inline void gen_mtc0_store64 (TCGv arg, 
target_ulong off)
 tcg_gen_st_tl(arg, cpu_env, off);
 }
 
+static void gen_mfhc0(DisasContext *ctx, 

[Qemu-devel] [PULL 20/29] net/dp8393x: add load/save support

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/net/dp8393x.c | 12 
 1 file changed, 12 insertions(+)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index ef1fb0e..4184045 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -853,6 +853,17 @@ static void dp8393x_realize(DeviceState *dev, Error **errp)
 prom[7] = 0xff - checksum;
 }
 
+static const VMStateDescription vmstate_dp8393x = {
+.name = dp8393x,
+.version_id = 0,
+.minimum_version_id = 0,
+.fields = (VMStateField []) {
+VMSTATE_BUFFER_UNSAFE(cam, dp8393xState, 0, 16 * 6),
+VMSTATE_UINT16_ARRAY(regs, dp8393xState, 0x40),
+VMSTATE_END_OF_LIST()
+}
+};
+
 static Property dp8393x_properties[] = {
 DEFINE_NIC_PROPERTIES(dp8393xState, conf),
 DEFINE_PROP_PTR(dma_mr, dp8393xState, dma_mr),
@@ -867,6 +878,7 @@ static void dp8393x_class_init(ObjectClass *klass, void 
*data)
 set_bit(DEVICE_CATEGORY_NETWORK, dc-categories);
 dc-realize = dp8393x_realize;
 dc-reset = dp8393x_reset;
+dc-vmsd = vmstate_dp8393x;
 dc-props = dp8393x_properties;
 }
 
-- 
2.1.0

[Qemu-devel] [PULL 28/29] target-mips: remove misleading comments in translate_init.c

[Leon Alrae]

PABITS are not hardcoded to 36 bits and we do not model 59 PABITS (which is
the architectural limit) in QEMU.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 target-mips/translate_init.c | 9 -
 1 file changed, 9 deletions(-)

diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index 51e7c98..5f0cf9a 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -553,9 +553,6 @@ static const mips_def_t mips_defs[] =
 (1  FCR0_L) | (1  FCR0_W) | (1  FCR0_D) |
 (1  FCR0_S) | (0x00  FCR0_PRID) | (0x0  FCR0_REV),
 .SEGBITS = 42,
-/* The architectural limit is 59, but we have hardcoded 36 bit
-   in some places...
-.PABITS = 59, */ /* the architectural limit */
 .PABITS = 36,
 .insn_flags = CPU_MIPS64R2 | ASE_MIPS3D,
 .mmu_type = MMU_TYPE_R4000,
@@ -637,9 +634,6 @@ static const mips_def_t mips_defs[] =
 (1  FCR0_W) | (1  FCR0_D) | (1  FCR0_S) |
 (0x00  FCR0_PRID) | (0x0  FCR0_REV),
 .SEGBITS = 42,
-/* The architectural limit is 59, but we have hardcoded 36 bit
-   in some places...
-.PABITS = 59, */ /* the architectural limit */
 .PABITS = 36,
 .insn_flags = CPU_MIPS64R6,
 .mmu_type = MMU_TYPE_R4000,
@@ -703,9 +697,6 @@ static const mips_def_t mips_defs[] =
 (1  FCR0_L) | (1  FCR0_W) | (1  FCR0_D) |
 (1  FCR0_S) | (0x00  FCR0_PRID) | (0x0  FCR0_REV),
 .SEGBITS = 42,
-/* The architectural limit is 59, but we have hardcoded 36 bit
-   in some places...
-.PABITS = 59, */ /* the architectural limit */
 .PABITS = 36,
 .insn_flags = CPU_MIPS64R2 | ASE_DSP | ASE_DSPR2,
 .mmu_type = MMU_TYPE_R4000,
-- 
2.1.0

Re: [Qemu-devel] [PATCH v3 2/2] vhost user: Add RARP injection for legacy guest

[Jason Wang]

On 06/11/2015 08:13 PM, Michael S. Tsirkin wrote:
 On Thu, Jun 11, 2015 at 02:10:48PM +0200, Thibaut Collet wrote:
 I am not sure to understand your remark:

 It needs to be sent when backend is activated by guest kick
 (in case of virtio 1, it's possible to use DRIVER_OK for this).
 This does not happen when VM still runs on source.
 Could you confirm rarp can be sent by backend when the 
 VHOST_USER_SET_VRING_KICK message is received by the backend ?
 No - the time to send pakets is when you start processing
 the rings.

 And the time to do that is when you detect a kick on
 an eventfd, not when said fd is set.


Probably not. What if guest is only doing receiving? In this case, you
won't detect any kick if you don't send the rarp first.

Re: [Qemu-devel] [PATCH v2 1/2] monitor: Split mon_get_cpu fn to remove ENV_GET_CPU

[Markus Armbruster]

Peter Crosthwaite crosthwaitepe...@gmail.com writes:

 The monitor currently has one helper, mon_get_cpu() which will return
 an env pointer. The target specific users of this API want an env, but
 all the target agnostic users really just want the cpu pointer. These
 users then need to use the target-specifically defined ENV_GET_CPU to
 navigate back up to the CPU from the ENV. Split the API for the two
 uses cases to remove all need for ENV_GET_CPU.

 Reviewed-by: Richard Henderson r...@twiddle.net
 Reviewed-by: Andreas Färber afaer...@suse.de
 Signed-off-by: Peter Crosthwaite crosthwaite.pe...@gmail.com
 ---
 Changed since v1:
 s/mon_get_env/mon_get_cpu_env (Andreas review)
 Avoid C99 declaration (RH review)

  CCx86_64-softmmu/monitor.o
/work/armbru/qemu/monitor.c: In function ‘memory_search’:
/work/armbru/qemu/monitor.c:1222:9: warning: passing argument 1 of 
‘x86_env_get_cpu’ from incompatible pointer type [enabled by default]
 } else if (cpu_memory_rw_debug(ENV_GET_CPU(mon_get_cpu()), addr,
 ^
In file included from /work/armbru/qemu/target-i386/cpu.h:982:0,
 from /work/armbru/qemu/include/qemu-common.h:124,
 from /work/armbru/qemu/include/hw/hw.h:5,
 from /work/armbru/qemu/monitor.c:25:
/work/armbru/qemu/target-i386/cpu-qom.h:119:23: note: expected ‘struct 
CPUX86State *’ but argument is of type ‘struct CPUState *’
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
   ^

Re: [Qemu-devel] [PATCH v2 1/2] monitor: Split mon_get_cpu fn to remove ENV_GET_CPU

[Markus Armbruster]

Markus Armbruster arm...@redhat.com writes:

 Peter Crosthwaite crosthwaitepe...@gmail.com writes:

 The monitor currently has one helper, mon_get_cpu() which will return
 an env pointer. The target specific users of this API want an env, but
 all the target agnostic users really just want the cpu pointer. These
 users then need to use the target-specifically defined ENV_GET_CPU to
 navigate back up to the CPU from the ENV. Split the API for the two
 uses cases to remove all need for ENV_GET_CPU.

 Reviewed-by: Richard Henderson r...@twiddle.net
 Reviewed-by: Andreas Färber afaer...@suse.de
 Signed-off-by: Peter Crosthwaite crosthwaite.pe...@gmail.com
 ---
 Changed since v1:
 s/mon_get_env/mon_get_cpu_env (Andreas review)
 Avoid C99 declaration (RH review)

   CCx86_64-softmmu/monitor.o
 /work/armbru/qemu/monitor.c: In function ‘memory_search’:
 /work/armbru/qemu/monitor.c:1222:9: warning: passing argument 1 of 
 ‘x86_env_get_cpu’ from incompatible pointer type [enabled by default]
  } else if (cpu_memory_rw_debug(ENV_GET_CPU(mon_get_cpu()), addr,
  ^
 In file included from /work/armbru/qemu/target-i386/cpu.h:982:0,
  from /work/armbru/qemu/include/qemu-common.h:124,
  from /work/armbru/qemu/include/hw/hw.h:5,
  from /work/armbru/qemu/monitor.c:25:
 /work/armbru/qemu/target-i386/cpu-qom.h:119:23: note: expected ‘struct 
 CPUX86State *’ but argument is of type ‘struct CPUState *’
  static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
^

Semantic conflict with
[RFC v6 0/2] monitor: add memory search commands s, sp

Since that series is marked RFC, I'm picking up yours, and will ask
Claudio to rebase.

[Qemu-devel] [PATCH v2 1/6] virtio-gpu: fix error message

[Gerd Hoffmann]

iov limit was raised, but the error message still has the old limit ...

Signed-off-by: Gerd Hoffmann kra...@redhat.com
---
 hw/display/virtio-gpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 4b10ca1..8c109b7 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -534,7 +534,7 @@ int virtio_gpu_create_mapping_iov(struct 
virtio_gpu_resource_attach_backing *ab,
 
 if (ab-nr_entries  16384) {
 qemu_log_mask(LOG_GUEST_ERROR,
-  %s: nr_entries is too big (%d  1024)\n,
+  %s: nr_entries is too big (%d  16384)\n,
   __func__, ab-nr_entries);
 return -1;
 }
-- 
1.8.3.1

[Qemu-devel] [PATCH v2 2/6] virtio-gpu-pci: add virtio pci support

[Gerd Hoffmann]

This patch adds virtio-gpu-pci, which is the pci proxy for the virtio
gpu device.  With this patch in place virtio-gpu is functional.  You
need a linux guest with a virtio-gpu driver though, and output will
appear pretty late in boot, once the kernel initialized drm and fbcon.

Written by Dave Airlie and Gerd Hoffmann.

Signed-off-by: Dave Airlie airl...@redhat.com
Signed-off-by: Gerd Hoffmann kra...@redhat.com
---
 hw/display/Makefile.objs|  1 +
 hw/display/virtio-gpu-pci.c | 68 +
 hw/virtio/virtio-pci.h  | 14 ++
 3 files changed, 83 insertions(+)
 create mode 100644 hw/display/virtio-gpu-pci.c

diff --git a/hw/display/Makefile.objs b/hw/display/Makefile.objs
index 61c80f3..26284a1 100644
--- a/hw/display/Makefile.objs
+++ b/hw/display/Makefile.objs
@@ -36,3 +36,4 @@ obj-$(CONFIG_VGA) += vga.o
 common-obj-$(CONFIG_QXL) += qxl.o qxl-logger.o qxl-render.o
 
 obj-$(CONFIG_VIRTIO) += virtio-gpu.o
+obj-$(CONFIG_VIRTIO_PCI) += virtio-gpu-pci.o
diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c
new file mode 100644
index 000..f0f25c7
--- /dev/null
+++ b/hw/display/virtio-gpu-pci.c
@@ -0,0 +1,68 @@
+/*
+ * Virtio video device
+ *
+ * Copyright Red Hat
+ *
+ * Authors:
+ *  Dave Airlie
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+#include hw/pci/pci.h
+#include hw/virtio/virtio.h
+#include hw/virtio/virtio-bus.h
+#include hw/virtio/virtio-pci.h
+#include hw/virtio/virtio-gpu.h
+
+static Property virtio_gpu_pci_properties[] = {
+DEFINE_VIRTIO_GPU_PROPERTIES(VirtIOGPUPCI, vdev.conf),
+DEFINE_VIRTIO_GPU_PCI_PROPERTIES(VirtIOPCIProxy),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void virtio_gpu_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VirtIOGPUPCI *vgpu = VIRTIO_GPU_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(vgpu-vdev);
+
+qdev_set_parent_bus(vdev, BUS(vpci_dev-bus));
+/* force virtio-1.0 */
+vpci_dev-flags = ~VIRTIO_PCI_FLAG_DISABLE_MODERN;
+vpci_dev-flags |= VIRTIO_PCI_FLAG_DISABLE_LEGACY;
+object_property_set_bool(OBJECT(vdev), true, realized, errp);
+}
+
+static void virtio_gpu_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+
+set_bit(DEVICE_CATEGORY_DISPLAY, dc-categories);
+dc-props = virtio_gpu_pci_properties;
+k-realize = virtio_gpu_pci_realize;
+pcidev_k-class_id = PCI_CLASS_DISPLAY_OTHER;
+}
+
+static void virtio_gpu_initfn(Object *obj)
+{
+VirtIOGPUPCI *dev = VIRTIO_GPU_PCI(obj);
+object_initialize(dev-vdev, sizeof(dev-vdev), TYPE_VIRTIO_GPU);
+object_property_add_child(obj, virtio-backend, OBJECT(dev-vdev), NULL);
+}
+
+static const TypeInfo virtio_gpu_pci_info = {
+.name = TYPE_VIRTIO_GPU_PCI,
+.parent = TYPE_VIRTIO_PCI,
+.instance_size = sizeof(VirtIOGPUPCI),
+.instance_init = virtio_gpu_initfn,
+.class_init = virtio_gpu_pci_class_init,
+};
+
+static void virtio_gpu_pci_register_types(void)
+{
+type_register_static(virtio_gpu_pci_info);
+}
+type_init(virtio_gpu_pci_register_types)
diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index d962125..96025ca 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -25,6 +25,7 @@
 #include hw/virtio/virtio-bus.h
 #include hw/virtio/virtio-9p.h
 #include hw/virtio/virtio-input.h
+#include hw/virtio/virtio-gpu.h
 #ifdef CONFIG_VIRTFS
 #include hw/9pfs/virtio-9p.h
 #endif
@@ -42,6 +43,7 @@ typedef struct VHostSCSIPCI VHostSCSIPCI;
 typedef struct VirtIORngPCI VirtIORngPCI;
 typedef struct VirtIOInputPCI VirtIOInputPCI;
 typedef struct VirtIOInputHIDPCI VirtIOInputHIDPCI;
+typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 
 /* virtio-pci-bus */
 
@@ -261,6 +263,18 @@ struct VirtIOInputHIDPCI {
 VirtIOInputHID vdev;
 };
 
+/*
+ * virtio-gpu-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_GPU_PCI virtio-gpu-pci
+#define VIRTIO_GPU_PCI(obj) \
+OBJECT_CHECK(VirtIOGPUPCI, (obj), TYPE_VIRTIO_GPU_PCI)
+
+struct VirtIOGPUPCI {
+VirtIOPCIProxy parent_obj;
+VirtIOGPU vdev;
+};
+
 /* Virtio ABI version, if we increment this, we break the guest driver. */
 #define VIRTIO_PCI_ABI_VERSION  0
 
-- 
1.8.3.1

Re: [Qemu-devel] [PULL 20/22] hw/arm/boot: arm_load_kernel implemented as a machine init done notifier

[Eric Auger]

On 06/12/2015 10:25 AM, Eric Auger wrote:
 Hi Peter,
 On 06/12/2015 04:54 AM, Peter Crosthwaite wrote:
 On Tue, Jun 2, 2015 at 9:33 AM, Peter Maydell peter.mayd...@linaro.org 
 wrote:
 From: Eric Auger eric.au...@linaro.org

 Device tree nodes for the platform bus and its children dynamic sysbus
 devices are added in a machine init done notifier. To load the dtb once,
 after those latter nodes are built and before ROM freeze, the actual
 arm_load_kernel existing code is moved into a notifier notify function,
 arm_load_kernel_notify. arm_load_kernel now only registers the
 corresponding notifier.


 Does this work? I am experiencing a regression on this patch for
 xlnx-ep108 board.
 
 Sorry for the inconvenience. On my side I tested it on virt board.
 
 I am currently looking at the issue ...
 
 Best Regards
 
 Eric
  I think it is because this is now delaying
 arm_load_kernel_notify call until after rom_load_all. From vl.c:

 if (rom_load_all() != 0) {
 fprintf(stderr, rom loading failed\n);
 exit(1);
 }

 /* TODO: once all bus devices are qdevified, this should be done
  * when bus is created by qdev.c */
 qemu_register_reset(qbus_reset_all_fn, sysbus_get_default());
 qemu_run_machine_init_done_notifiers();

 the machine_init_done_notifiers are called after the rom_load_all()
 call which does the image loading.

Isn't the actual rom loading done in a reset notifier? If confirmed the
problem comes from the fact the order of registration of reset notifiers
for rom_reset and do_cpu_reset has swapped?

Best Regards

Eric
 So the image-to-load registration
 is too late.

 Straight revert of this patch fixes the issue for me.

 Regards,
 Peter


 Machine files that do not support platform bus stay unchanged. Machine
 files willing to support dynamic sysbus devices must call arm_load_kernel
 before sysbus-fdt arm_register_platform_bus_fdt_creator to make sure
 dynamic sysbus device nodes are integrated in the dtb.

 Signed-off-by: Eric Auger eric.au...@linaro.org
 Reviewed-by: Shannon Zhao zhaoshengl...@huawei.com
 Reviewed-by: Alexander Graf ag...@suse.de
 Reviewed-by: Alex Bennée alex.ben...@linaro.org
 Message-id: 1433244554-12898-3-git-send-email-eric.au...@linaro.org
 Signed-off-by: Peter Maydell peter.mayd...@linaro.org
 ---
  hw/arm/boot.c| 14 +-
  include/hw/arm/arm.h | 28 
  2 files changed, 41 insertions(+), 1 deletion(-)

 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index fa69503..d036624 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
 @@ -557,7 +557,7 @@ static void load_image_to_fw_cfg(FWCfgState *fw_cfg, 
 uint16_t size_key,
  fw_cfg_add_bytes(fw_cfg, data_key, data, size);
  }

 -void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
 +static void arm_load_kernel_notify(Notifier *notifier, void *data)
  {
  CPUState *cs;
  int kernel_size;
 @@ -568,6 +568,11 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info 
 *info)
  hwaddr entry, kernel_load_offset;
  int big_endian;
  static const ARMInsnFixup *primary_loader;
 +ArmLoadKernelNotifier *n = DO_UPCAST(ArmLoadKernelNotifier,
 + notifier, notifier);
 +ARMCPU *cpu = n-cpu;
 +struct arm_boot_info *info =
 +container_of(n, struct arm_boot_info, load_kernel_notifier);

  /* CPU objects (unlike devices) are not automatically reset on system
   * reset, so we must always register a handler to do so. If we're
 @@ -775,3 +780,10 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info 
 *info)
  ARM_CPU(cs)-env.boot_info = info;
  }
  }
 +
 +void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
 +{
 +info-load_kernel_notifier.cpu = cpu;
 +info-load_kernel_notifier.notifier.notify = arm_load_kernel_notify;
 +
 qemu_add_machine_init_done_notifier(info-load_kernel_notifier.notifier);
 +}
 diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index 5c940eb..760804c 100644
 --- a/include/hw/arm/arm.h
 +++ b/include/hw/arm/arm.h
 @@ -13,11 +13,21 @@

  #include exec/memory.h
  #include hw/irq.h
 +#include qemu/notify.h

  /* armv7m.c */
  qemu_irq *armv7m_init(MemoryRegion *system_memory, int mem_size, int 
 num_irq,
const char *kernel_filename, const char *cpu_model);

 +/*
 + * struct used as a parameter of the arm_load_kernel machine init
 + * done notifier
 + */
 +typedef struct {
 +Notifier notifier; /* actual notifier */
 +ARMCPU *cpu; /* handle to the first cpu object */
 +} ArmLoadKernelNotifier;
 +
  /* arm_boot.c */
  struct arm_boot_info {
  uint64_t ram_size;
 @@ -64,6 +74,8 @@ struct arm_boot_info {
   * the user it should implement this hook.
   */
  void (*modify_dtb)(const struct arm_boot_info *info, void *fdt);
 +/* machine init done notifier executing arm_load_dtb */
 +ArmLoadKernelNotifier load_kernel_notifier;
  /* Used internally by arm_boot.c */
  

[Qemu-devel] [PULL 04/29] target-mips: Misaligned memory accesses for R6

[Leon Alrae]

From: Yongbok Kim yongbok@imgtec.com

Release 6 requires misaligned memory access support for all ordinary memory
access instructions (for example, LW/SW, LWC1/SWC1).
However misaligned support is not provided for certain special memory accesses
such as atomics (for example, LL/SC).

Signed-off-by: Yongbok Kim yongbok@imgtec.com
Reviewed-by: Leon Alrae leon.al...@imgtec.com
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 target-mips/translate.c  | 39 +++
 target-mips/translate_init.c |  2 +-
 2 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/target-mips/translate.c b/target-mips/translate.c
index 8bf08c8..966996f 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -1414,6 +1414,7 @@ typedef struct DisasContext {
 int32_t CP0_Config1;
 /* Routine used to access memory */
 int mem_idx;
+TCGMemOp default_tcg_memop_mask;
 uint32_t hflags, saved_hflags;
 int bstate;
 target_ulong btarget;
@@ -2086,12 +2087,14 @@ static void gen_ld(DisasContext *ctx, uint32_t opc,
 switch (opc) {
 #if defined(TARGET_MIPS64)
 case OPC_LWU:
-tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TEUL);
+tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TEUL |
+   ctx-default_tcg_memop_mask);
 gen_store_gpr(t0, rt);
 opn = lwu;
 break;
 case OPC_LD:
-tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TEQ);
+tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TEQ |
+   ctx-default_tcg_memop_mask);
 gen_store_gpr(t0, rt);
 opn = ld;
 break;
@@ -2162,17 +2165,20 @@ static void gen_ld(DisasContext *ctx, uint32_t opc,
 opn = lwpc;
 break;
 case OPC_LW:
-tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TESL);
+tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TESL |
+   ctx-default_tcg_memop_mask);
 gen_store_gpr(t0, rt);
 opn = lw;
 break;
 case OPC_LH:
-tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TESW);
+tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TESW |
+   ctx-default_tcg_memop_mask);
 gen_store_gpr(t0, rt);
 opn = lh;
 break;
 case OPC_LHU:
-tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TEUW);
+tcg_gen_qemu_ld_tl(t0, t0, ctx-mem_idx, MO_TEUW |
+   ctx-default_tcg_memop_mask);
 gen_store_gpr(t0, rt);
 opn = lhu;
 break;
@@ -2256,7 +2262,8 @@ static void gen_st (DisasContext *ctx, uint32_t opc, int 
rt,
 switch (opc) {
 #if defined(TARGET_MIPS64)
 case OPC_SD:
-tcg_gen_qemu_st_tl(t1, t0, ctx-mem_idx, MO_TEQ);
+tcg_gen_qemu_st_tl(t1, t0, ctx-mem_idx, MO_TEQ |
+   ctx-default_tcg_memop_mask);
 opn = sd;
 break;
 case OPC_SDL:
@@ -2271,11 +2278,13 @@ static void gen_st (DisasContext *ctx, uint32_t opc, 
int rt,
 break;
 #endif
 case OPC_SW:
-tcg_gen_qemu_st_tl(t1, t0, ctx-mem_idx, MO_TEUL);
+tcg_gen_qemu_st_tl(t1, t0, ctx-mem_idx, MO_TEUL |
+   ctx-default_tcg_memop_mask);
 opn = sw;
 break;
 case OPC_SH:
-tcg_gen_qemu_st_tl(t1, t0, ctx-mem_idx, MO_TEUW);
+tcg_gen_qemu_st_tl(t1, t0, ctx-mem_idx, MO_TEUW |
+   ctx-default_tcg_memop_mask);
 opn = sh;
 break;
 case OPC_SB:
@@ -2352,7 +2361,8 @@ static void gen_flt_ldst (DisasContext *ctx, uint32_t 
opc, int ft,
 case OPC_LWC1:
 {
 TCGv_i32 fp0 = tcg_temp_new_i32();
-tcg_gen_qemu_ld_i32(fp0, t0, ctx-mem_idx, MO_TESL);
+tcg_gen_qemu_ld_i32(fp0, t0, ctx-mem_idx, MO_TESL |
+ctx-default_tcg_memop_mask);
 gen_store_fpr32(ctx, fp0, ft);
 tcg_temp_free_i32(fp0);
 }
@@ -2362,7 +2372,8 @@ static void gen_flt_ldst (DisasContext *ctx, uint32_t 
opc, int ft,
 {
 TCGv_i32 fp0 = tcg_temp_new_i32();
 gen_load_fpr32(ctx, fp0, ft);
-tcg_gen_qemu_st_i32(fp0, t0, ctx-mem_idx, MO_TEUL);
+tcg_gen_qemu_st_i32(fp0, t0, ctx-mem_idx, MO_TEUL |
+ctx-default_tcg_memop_mask);
 tcg_temp_free_i32(fp0);
 }
 opn = swc1;
@@ -2370,7 +2381,8 @@ static void gen_flt_ldst (DisasContext *ctx, uint32_t 
opc, int ft,
 case OPC_LDC1:
 {
 TCGv_i64 fp0 = tcg_temp_new_i64();
-tcg_gen_qemu_ld_i64(fp0, t0, ctx-mem_idx, MO_TEQ);
+tcg_gen_qemu_ld_i64(fp0, t0, ctx-mem_idx, MO_TEQ |
+ctx-default_tcg_memop_mask);
 gen_store_fpr64(ctx, fp0, ft);
 tcg_temp_free_i64(fp0);
 }
@@ -2380,7 +2392,8 @@ static void gen_flt_ldst (DisasContext *ctx, uint32_t 
opc, int ft,
 {
 TCGv_i64 fp0 = 

[Qemu-devel] [PULL 00/29] target-mips queue

[Leon Alrae]

Hi,

This pull request introduces new MIPS architectural features and improves
MIPS Jazz and Malta emulation. It doesn't include the address_space_rw()
workaround patch from Hervé's series as it's still being discussed.

Thanks,
Leon

Cc: Peter Maydell peter.mayd...@linaro.org
Cc: Aurelien Jarno aurel...@aurel32.net

The following changes since commit 0e12e61ff9a3407d123d0dbc4d945aec98d60fdf:

  Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150610-1' into 
staging (2015-06-10 18:13:58 +0100)

are available in the git repository at:

  git://github.com/lalrae/qemu.git tags/mips-20150612

for you to fetch changes up to 6773f9b687e0a8ab4b638ef88d075fb233fb7669:

  target-mips: enable XPA and LPA features (2015-06-12 09:06:03 +0100)


MIPS patches 2015-06-12

Changes:
* improve dp8393x network card and rc4030 chipset emulation
* support misaligned R6 and MSA memory accesses
* support MIPS eXtended and Large Physical Addressing
* add Config5.FRE bit and ERETNC instruction (Config5.LLB)
* support ememsize on MALTA


Hervé Poussineau (15):
  mips jazz: compile only in 64 bit
  dma/rc4030: create custom DMA address space
  dma/rc4030: use AddressSpace and address_space_rw in users
  dma/rc4030: do not use old_mmio accesses
  dma/rc4030: document register at offset 0x210
  dma/rc4030: use trace events instead of custom logging
  dma/rc4030: convert to QOM
  net/dp8393x: always calculate proper checksums
  net/dp8393x: do not use old_mmio accesses
  net/dp8393x: use dp8393x_ prefix for all functions
  net/dp8393x: QOM'ify
  net/dp8393x: add PROM to store MAC address
  net/dp8393x: add load/save support
  net/dp8393x: correctly reset in_use field
  net/dp8393x: fix hardware reset

Leon Alrae (10):
  target-mips: move group of functions above gen_load_fpr32()
  target-mips: add Config5.FRE support allowing Status.FR=0 emulation
  target-mips: add ERETNC instruction and Config5.LLB bit
  target-mips: correct MFC0 for CP0.EntryLo in MIPS64
  target-mips: extend selected CP0 registers to 64-bits in MIPS32
  target-mips: support Page Frame Number Extension field
  target-mips: add CP0.PageGrain.ELPA support
  target-mips: add MTHC0 and MFHC0 instructions
  target-mips: remove misleading comments in translate_init.c
  target-mips: enable XPA and LPA features

Paul Burton (1):
  mips_malta: provide ememsize env variable to kernels

Yongbok Kim (3):
  target-mips: Misaligned memory accesses for R6
  softmmu: Add probe_write()
  target-mips: Misaligned memory accesses for MSA

 default-configs/mips-softmmu.mak |   5 -
 default-configs/mips64-softmmu.mak   |   1 +
 default-configs/mips64el-softmmu.mak |   1 +
 default-configs/mipsel-softmmu.mak   |   5 -
 disas/mips.c |   3 +
 hw/dma/rc4030.c  | 462 ++--
 hw/mips/Makefile.objs|   3 +-
 hw/mips/mips_jazz.c  |  53 ++-
 hw/mips/mips_malta.c |  15 +-
 hw/net/dp8393x.c | 369 
 include/exec/exec-all.h  |   2 +
 include/hw/mips/mips.h   |  11 +-
 softmmu_template.h   |  22 +
 target-mips/cpu.h|  52 ++-
 target-mips/helper.h |  11 +-
 target-mips/machine.c|  21 +-
 target-mips/mips-defs.h  |   4 +-
 target-mips/op_helper.c  | 244 +++
 target-mips/translate.c  | 802 ---
 target-mips/translate_init.c |  37 +-
 tests/endianness-test.c  |   2 -
 trace-events |   6 +
 22 files changed, 1291 insertions(+), 840 deletions(-)

[Qemu-devel] [PULL 22/29] net/dp8393x: fix hardware reset

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Documentation is not clear of what happens when doing a hardware reset,
but firmware expect all registers to be zero unless specified otherwise.

This fixes reboot on MIPS Magnum.

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/net/dp8393x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index ff633f7..cd889bc 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -786,6 +786,7 @@ static void dp8393x_reset(DeviceState *dev)
 dp8393xState *s = DP8393X(dev);
 timer_del(s-watchdog);
 
+memset(s-regs, 0, sizeof(s-regs));
 s-regs[SONIC_CR] = SONIC_CR_RST | SONIC_CR_STP | SONIC_CR_RXDIS;
 s-regs[SONIC_DCR] = ~(SONIC_DCR_EXBUS | SONIC_DCR_LBR);
 s-regs[SONIC_RCR] = ~(SONIC_RCR_LB0 | SONIC_RCR_LB1 | SONIC_RCR_BRD | 
SONIC_RCR_RNT);
-- 
2.1.0

[Qemu-devel] [PULL 29/29] target-mips: enable XPA and LPA features

[Leon Alrae]

Enable XPA in MIPS32R5-generic and LPA in MIPS64R6-generic.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 target-mips/translate_init.c | 16 ++--
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index 5f0cf9a..30605da 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -400,10 +400,12 @@ static const mips_def_t mips_defs[] =
(0  CP0C1_DS) | (3  CP0C1_DL) | (1  CP0C1_DA) |
(1  CP0C1_CA),
 .CP0_Config2 = MIPS_CONFIG2,
-.CP0_Config3 = MIPS_CONFIG3 | (1U  CP0C3_M) | (1  CP0C3_MSAP),
+.CP0_Config3 = MIPS_CONFIG3 | (1U  CP0C3_M) | (1  CP0C3_MSAP) |
+   (1  CP0C3_LPA),
 .CP0_Config4 = MIPS_CONFIG4 | (1U  CP0C4_M),
 .CP0_Config4_rw_bitmask = 0,
-.CP0_Config5 = MIPS_CONFIG5 | (1  CP0C5_UFR) | (1  CP0C5_LLB),
+.CP0_Config5 = MIPS_CONFIG5 | (1  CP0C5_UFR) | (1  CP0C5_LLB) |
+   (1  CP0C5_MVH),
 .CP0_Config5_rw_bitmask = (0  CP0C5_M) | (1  CP0C5_K) |
   (1  CP0C5_CV) | (0  CP0C5_EVA) |
   (1  CP0C5_MSAEn) | (1  CP0C5_UFR) |
@@ -413,11 +415,12 @@ static const mips_def_t mips_defs[] =
 .SYNCI_Step = 32,
 .CCRes = 2,
 .CP0_Status_rw_bitmask = 0x3778FF1F,
+.CP0_PageGrain_rw_bitmask = (1  CP0PG_ELPA),
 .CP1_fcr0 = (1  FCR0_UFRP) | (1  FCR0_F64) | (1  FCR0_L) |
 (1  FCR0_W) | (1  FCR0_D) | (1  FCR0_S) |
 (0x93  FCR0_PRID),
 .SEGBITS = 32,
-.PABITS = 32,
+.PABITS = 40,
 .insn_flags = CPU_MIPS32R5 | ASE_MIPS16 | ASE_MSA,
 .mmu_type = MMU_TYPE_R4000,
 },
@@ -616,7 +619,8 @@ static const mips_def_t mips_defs[] =
(0  CP0C1_PC) | (1  CP0C1_WR) | (1  CP0C1_EP),
 .CP0_Config2 = MIPS_CONFIG2,
 .CP0_Config3 = MIPS_CONFIG3 | (1  CP0C3_RXI) | (1  CP0C3_BP) |
-   (1  CP0C3_BI) | (1  CP0C3_ULRI) | (1U  CP0C3_M),
+   (1  CP0C3_BI) | (1  CP0C3_ULRI) | (1  CP0C3_LPA) |
+   (1U  CP0C3_M),
 .CP0_Config4 = MIPS_CONFIG4 | (0xfc  CP0C4_KScrExist) |
(3  CP0C4_IE) | (1  CP0C4_M),
 .CP0_Config5 = MIPS_CONFIG5 | (1  CP0C5_LLB),
@@ -629,12 +633,12 @@ static const mips_def_t mips_defs[] =
 .CP0_Status_rw_bitmask = 0x30D8,
 .CP0_PageGrain = (1  CP0PG_IEC) | (1  CP0PG_XIE) |
  (1U  CP0PG_RIE),
-.CP0_PageGrain_rw_bitmask = 0,
+.CP0_PageGrain_rw_bitmask = (1  CP0PG_ELPA),
 .CP1_fcr0 = (1  FCR0_FREP) | (1  FCR0_F64) | (1  FCR0_L) |
 (1  FCR0_W) | (1  FCR0_D) | (1  FCR0_S) |
 (0x00  FCR0_PRID) | (0x0  FCR0_REV),
 .SEGBITS = 42,
-.PABITS = 36,
+.PABITS = 48,
 .insn_flags = CPU_MIPS64R6,
 .mmu_type = MMU_TYPE_R4000,
 },
-- 
2.1.0

Re: [Qemu-devel] [PATCH V2] pci: fixes to allow booting from extra root pci buses.

[Gerd Hoffmann]

  Hi,

 On each boot, coreboot might decide to assign a different bus id to
 the extra roots (for example, if a device with a PCI bridge is
 inserted and it's bus allocation causes bus ids to shift).
 Technically, coreboot could even change the order extra buses are
 assigned bus ids, but doesn't today.
 
 This was seen on several AMD systems - I'm told at least some Intel
 systems have multiple root buses, but the bus numbers are just hard
 wired.

This is how the qemu pxb works: root bus numbers are a config option for
the root bridge device, i.e. from the guest point of view they are
hard-wired.

cheers,
  Gerd

Re: [Qemu-devel] where is the definition of cpu_ldub_code() for Softmmu mode?

[Jun Koi]

On Mon, May 18, 2015 at 6:20 PM, Peter Maydell peter.mayd...@linaro.org
wrote:

 On 18 May 2015 at 10:55, Jun Koi junkoi2...@gmail.com wrote:
  Hi,
 
  I am trying to find the definition of cpu_ldub_code() in Softmmu mode.
  However, the only thing I can find is like this in
 include/exec/cpu_ldst.h:
 
  #define cpu_ldub_code(env1, p) ldub_raw(p)

 Your QEMU tree is out of date -- this macro was removed in
 commit 9220fe54c6.

  Unfortunately, this is only for Usermode (CONFIG_USER_ONLY), so
  still I have no idea where cpu_ldub_code() is defined for Softmmu mode.

 In cpu_ldst.h we #define MEMSUFFIX _code and then include
 exec/cpu_ldst_template.h multiple times to define the
 accessor functions for the various widths. (For the usermode
 version we include exec/cpu_ldst_useronly_template.h, for
 similar effect.)


Looking closer to this code, this leads to the function helper_ldb_cmmu(),
but I cannot find where this code is defined.

Any hints, please?

Thanks.

Re: [Qemu-devel] where is the definition of cpu_ldub_code() for Softmmu mode?

[Peter Maydell]

On 12 June 2015 at 08:29, Jun Koi junkoi2...@gmail.com wrote:
 On Mon, May 18, 2015 at 6:20 PM, Peter Maydell peter.mayd...@linaro.org
 wrote:
 In cpu_ldst.h we #define MEMSUFFIX _code and then include
 exec/cpu_ldst_template.h multiple times to define the
 accessor functions for the various widths. (For the usermode
 version we include exec/cpu_ldst_useronly_template.h, for
 similar effect.)


 Looking closer to this code, this leads to the function helper_ldb_cmmu(),
 but I cannot find where this code is defined.

manooth$ git grep cmmu
cputlb.c:#define MMUSUFFIX _cmmu
include/exec/cpu_ldst.h:uint8_t helper_ldb_cmmu(CPUArchState *env,
target_ulong addr, int mmu_idx);
include/exec/cpu_ldst.h:uint16_t helper_ldw_cmmu(CPUArchState *env,
target_ulong addr, int mmu_idx);
include/exec/cpu_ldst.h:uint32_t helper_ldl_cmmu(CPUArchState *env,
target_ulong addr, int mmu_idx);
include/exec/cpu_ldst.h:uint64_t helper_ldq_cmmu(CPUArchState *env,
target_ulong addr, int mmu_idx);
include/exec/cpu_ldst_template.h:#define MMUSUFFIX _cmmu

The first of these is where cputlb.c includes
softmmu_template.h, which is what's defining the
function you're interested in.

-- PMM

Re: [Qemu-devel] [RFC v6 0/2] monitor: add memory search commands s, sp

[Claudio Fontana]

On 12.06.2015 08:21, Markus Armbruster wrote:
 Luiz Capitulino lcapitul...@redhat.com writes:
 
 On Thu, 28 May 2015 16:18:41 -0400
 Luiz Capitulino lcapitul...@redhat.com wrote:

 On Mon, 18 May 2015 13:22:16 +0200
 hw.clau...@gmail.com wrote:

 From: Claudio Fontana claudio.font...@huawei.com

 This is the latest iteration of the memory search patch,
 including a trivial replacement for the memmem function for systems
 which don't provide one (notably Windows).

 It detects the presence of memmem in configure and sets CONFIG_MEMMEM,
 providing a trivial implementation for the !CONFIG_MEMMEM case.

 The new code is MIT licensed, following usage of other files in the same
 directory dealing with replacement functions (osdep, oslib, getauxval etc),
 and to maximize reusability.

 I have tested this in both CONFIG_MEMMEM defined/undefined scenarios,
 but more feedback and testing is welcome of course.

 changes from v5:
 dropped the import from gnulib and implemented a trivial replacement.

 changes from v4:
 made into a series of two patches.
 Introduced a memmem replacement function (import from gnulib)
 and detection code in configure.

 changes from v3:
 initialize pointer variable to NULL to finally get rid of spurious warning

 changes from v2:
 move code to try to address spurious warning

 changes from v1:
 make checkpatch happy by adding braces here and there.


 Claudio Fontana (2):
   util: add memmem replacement function
   monitor: add memory search commands s, sp

 Applied to the qmp branch, thanks.


 Unfortunately, I'm quite busy and won't have time to push this
 through my tree. Markus is going to pick up this series soon.

 Acked-by: Luiz Capitulino lcapitul...@redhat.com
 
 This series is marked RFC.  Is it intended for merging anyway?
 
 Semantic conflict with
 [PATCH v2 0/2] monitor+disas: Remove uses of ENV_GET_CPU
 needs to be resolved:

Hello Markus,

the two series conflict, but the resolution is quite simple.
I would suggest applying the Remove uses of ENV_GET_CPU stuff first, and then 
fixing up my patch, I can do it for you if you need.

Thanks!

Claudio


 
   CCx86_64-softmmu/monitor.o
 /work/armbru/qemu/monitor.c: In function ‘memory_search’:
 /work/armbru/qemu/monitor.c:1222:9: warning: passing argument 1 of 
 ‘x86_env_get_cpu’ from incompatible pointer type [enabled by default]
  } else if (cpu_memory_rw_debug(ENV_GET_CPU(mon_get_cpu()), addr,
  ^
 In file included from /work/armbru/qemu/target-i386/cpu.h:982:0,
  from /work/armbru/qemu/include/qemu-common.h:124,
  from /work/armbru/qemu/include/hw/hw.h:5,
  from /work/armbru/qemu/monitor.c:25:
 /work/armbru/qemu/target-i386/cpu-qom.h:119:23: note: expected ‘struct 
 CPUX86State *’ but argument is of type ‘struct CPUState *’
  static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
^
 


-- 
Claudio Fontana
Server Virtualization Architect
Huawei Technologies Duesseldorf GmbH
Riesstraße 25 - 80992 München

[Qemu-devel] [PULL 14/29] dma/rc4030: convert to QOM

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/dma/rc4030.c| 115 ++---
 hw/mips/mips_jazz.c|  37 ++--
 include/hw/mips/mips.h |   4 +-
 3 files changed, 113 insertions(+), 43 deletions(-)

diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index 55844ed..3efa6de 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -1,7 +1,7 @@
 /*
  * QEMU JAZZ RC4030 chipset
  *
- * Copyright (c) 2007-2009 Herve Poussineau
+ * Copyright (c) 2007-2013 Hervé Poussineau
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the Software), to 
deal
@@ -24,6 +24,7 @@
 
 #include hw/hw.h
 #include hw/mips/mips.h
+#include hw/sysbus.h
 #include qemu/timer.h
 #include exec/address-spaces.h
 #include trace.h
@@ -49,8 +50,14 @@ typedef struct dma_pagetable_entry {
 #define DMA_FLAG_MEM_INTR   0x0200
 #define DMA_FLAG_ADDR_INTR  0x0400
 
+#define TYPE_RC4030 rc4030
+#define RC4030(obj) \
+OBJECT_CHECK(rc4030State, (obj), TYPE_RC4030)
+
 typedef struct rc4030State
 {
+SysBusDevice parent;
+
 uint32_t config; /* 0x: RC4030 config register */
 uint32_t revision; /* 0x0008: RC4030 Revision register */
 uint32_t invalid_address_register; /* 0x0010: Invalid Address register */
@@ -317,7 +324,7 @@ static void rc4030_dma_tt_update(rc4030State *s, uint32_t 
new_tl_base,
 } else {
 dma_tt_size = memory_region_size(s-dma_tt);
 }
-memory_region_init_alias(s-dma_tt_alias, NULL,
+memory_region_init_alias(s-dma_tt_alias, OBJECT(s),
  dma-table-alias,
  s-dma_tt, 0, dma_tt_size);
 dma_tl_contents = memory_region_get_ram_ptr(s-dma_tt);
@@ -332,7 +339,7 @@ static void rc4030_dma_tt_update(rc4030State *s, uint32_t 
new_tl_base,
 s-dma_tt_alias);
 memory_region_transaction_commit();
 } else {
-memory_region_init(s-dma_tt_alias, NULL,
+memory_region_init(s-dma_tt_alias, OBJECT(s),
dma-table-alias, 0);
 }
 }
@@ -577,9 +584,9 @@ static const MemoryRegionOps jazzio_ops = {
 .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static void rc4030_reset(void *opaque)
+static void rc4030_reset(DeviceState *dev)
 {
-rc4030State *s = opaque;
+rc4030State *s = RC4030(dev);
 int i;
 
 s-config = 0x410; /* some boards seem to accept 0x104 too */
@@ -733,46 +740,102 @@ static rc4030_dma *rc4030_allocate_dmas(void *opaque, 
int n)
 return s;
 }
 
-MemoryRegion *rc4030_init(qemu_irq timer, qemu_irq jazz_bus,
-  qemu_irq **irqs, rc4030_dma **dmas,
-  MemoryRegion *sysmem)
+static void rc4030_initfn(Object *obj)
 {
-rc4030State *s;
-int i;
-
-s = g_malloc0(sizeof(rc4030State));
+DeviceState *dev = DEVICE(obj);
+rc4030State *s = RC4030(obj);
+SysBusDevice *sysbus = SYS_BUS_DEVICE(obj);
 
-*irqs = qemu_allocate_irqs(rc4030_irq_jazz_request, s, 16);
-*dmas = rc4030_allocate_dmas(s, 4);
+qdev_init_gpio_in(dev, rc4030_irq_jazz_request, 16);
 
-s-periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, 
rc4030_periodic_timer, s);
-s-timer_irq = timer;
-s-jazz_bus_irq = jazz_bus;
+sysbus_init_irq(sysbus, s-timer_irq);
+sysbus_init_irq(sysbus, s-jazz_bus_irq);
 
-qemu_register_reset(rc4030_reset, s);
 register_savevm(NULL, rc4030, 0, 2, rc4030_save, rc4030_load, s);
-rc4030_reset(s);
+
+sysbus_init_mmio(sysbus, s-iomem_chipset);
+sysbus_init_mmio(sysbus, s-iomem_jazzio);
+}
+
+static void rc4030_realize(DeviceState *dev, Error **errp)
+{
+rc4030State *s = RC4030(dev);
+Object *o = OBJECT(dev);
+int i;
+
+s-periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+ rc4030_periodic_timer, s);
 
 memory_region_init_io(s-iomem_chipset, NULL, rc4030_ops, s,
   rc4030.chipset, 0x300);
-memory_region_add_subregion(sysmem, 0x8000, s-iomem_chipset);
 memory_region_init_io(s-iomem_jazzio, NULL, jazzio_ops, s,
   rc4030.jazzio, 0x1000);
-memory_region_add_subregion(sysmem, 0xf000, s-iomem_jazzio);
 
-memory_region_init_rom_device(s-dma_tt, NULL,
+memory_region_init_rom_device(s-dma_tt, o,
   rc4030_dma_tt_ops, s, dma-table,
   MAX_TL_ENTRIES * sizeof(dma_pagetable_entry),
   NULL);
-memory_region_init(s-dma_tt_alias, NULL, dma-table-alias, 0);
-memory_region_init(s-dma_mr, NULL, dma, INT32_MAX);
+memory_region_init(s-dma_tt_alias, o, dma-table-alias, 0);
+memory_region_init(s-dma_mr, o, 

[Qemu-devel] [PULL 05/29] softmmu: Add probe_write()

[Leon Alrae]

From: Yongbok Kim yongbok@imgtec.com

Probe for whether the specified guest write access is permitted.
If it is not permitted then an exception will be taken in the same
way as if this were a real write access (and we will not return).
Otherwise the function will return, and there will be a valid
entry in the TLB for this access.

Signed-off-by: Yongbok Kim yongbok@imgtec.com
Reviewed-by: Leon Alrae leon.al...@imgtec.com
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 include/exec/exec-all.h |  2 ++
 softmmu_template.h  | 22 ++
 2 files changed, 24 insertions(+)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 2f7a4f1..2573e8c 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -105,6 +105,8 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong 
vaddr,
  hwaddr paddr, MemTxAttrs attrs,
  int prot, int mmu_idx, target_ulong size);
 void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr);
+void probe_write(CPUArchState *env, target_ulong addr, int mmu_idx,
+ uintptr_t retaddr);
 #else
 static inline void tlb_flush_page(CPUState *cpu, target_ulong addr)
 {
diff --git a/softmmu_template.h b/softmmu_template.h
index 39f571b..d42d89d 100644
--- a/softmmu_template.h
+++ b/softmmu_template.h
@@ -548,6 +548,28 @@ glue(glue(helper_st, SUFFIX), MMUSUFFIX)(CPUArchState 
*env, target_ulong addr,
 helper_te_st_name(env, addr, val, oi, GETRA());
 }
 
+#if DATA_SIZE == 1
+/* Probe for whether the specified guest write access is permitted.
+ * If it is not permitted then an exception will be taken in the same
+ * way as if this were a real write access (and we will not return).
+ * Otherwise the function will return, and there will be a valid
+ * entry in the TLB for this access.
+ */
+void probe_write(CPUArchState *env, target_ulong addr, int mmu_idx,
+ uintptr_t retaddr)
+{
+int index = (addr  TARGET_PAGE_BITS)  (CPU_TLB_SIZE - 1);
+target_ulong tlb_addr = env-tlb_table[mmu_idx][index].addr_write;
+
+if ((addr  TARGET_PAGE_MASK)
+!= (tlb_addr  (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
+/* TLB entry is for a different page */
+if (!VICTIM_TLB_HIT(addr_write)) {
+tlb_fill(ENV_GET_CPU(env), addr, MMU_DATA_STORE, mmu_idx, retaddr);
+}
+}
+}
+#endif
 #endif /* !defined(SOFTMMU_CODE_ACCESS) */
 
 #undef READ_ACCESS_TYPE
-- 
2.1.0

[Qemu-devel] [PULL 01/29] target-mips: move group of functions above gen_load_fpr32()

[Leon Alrae]

Move the Tests group of functions so that gen_load_fpr32() and
gen_store_fpr32() can use generate_exception().

Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 target-mips/translate.c | 118 
 1 file changed, 58 insertions(+), 60 deletions(-)

diff --git a/target-mips/translate.c b/target-mips/translate.c
index fd063a2..c087fb5 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -1557,6 +1557,64 @@ static inline void gen_store_srsgpr (int from, int to)
 }
 }
 
+/* Tests */
+static inline void gen_save_pc(target_ulong pc)
+{
+tcg_gen_movi_tl(cpu_PC, pc);
+}
+
+static inline void save_cpu_state(DisasContext *ctx, int do_save_pc)
+{
+LOG_DISAS(hflags %08x saved %08x\n, ctx-hflags, ctx-saved_hflags);
+if (do_save_pc  ctx-pc != ctx-saved_pc) {
+gen_save_pc(ctx-pc);
+ctx-saved_pc = ctx-pc;
+}
+if (ctx-hflags != ctx-saved_hflags) {
+tcg_gen_movi_i32(hflags, ctx-hflags);
+ctx-saved_hflags = ctx-hflags;
+switch (ctx-hflags  MIPS_HFLAG_BMASK_BASE) {
+case MIPS_HFLAG_BR:
+break;
+case MIPS_HFLAG_BC:
+case MIPS_HFLAG_BL:
+case MIPS_HFLAG_B:
+tcg_gen_movi_tl(btarget, ctx-btarget);
+break;
+}
+}
+}
+
+static inline void restore_cpu_state(CPUMIPSState *env, DisasContext *ctx)
+{
+ctx-saved_hflags = ctx-hflags;
+switch (ctx-hflags  MIPS_HFLAG_BMASK_BASE) {
+case MIPS_HFLAG_BR:
+break;
+case MIPS_HFLAG_BC:
+case MIPS_HFLAG_BL:
+case MIPS_HFLAG_B:
+ctx-btarget = env-btarget;
+break;
+}
+}
+
+static inline void generate_exception_err(DisasContext *ctx, int excp, int err)
+{
+TCGv_i32 texcp = tcg_const_i32(excp);
+TCGv_i32 terr = tcg_const_i32(err);
+save_cpu_state(ctx, 1);
+gen_helper_raise_exception_err(cpu_env, texcp, terr);
+tcg_temp_free_i32(terr);
+tcg_temp_free_i32(texcp);
+}
+
+static inline void generate_exception(DisasContext *ctx, int excp)
+{
+save_cpu_state(ctx, 1);
+gen_helper_0e0i(raise_exception, excp);
+}
+
 /* Floating point register moves. */
 static void gen_load_fpr32(TCGv_i32 t, int reg)
 {
@@ -1626,66 +1684,6 @@ static inline int get_fp_bit (int cc)
 return 23;
 }
 
-/* Tests */
-static inline void gen_save_pc(target_ulong pc)
-{
-tcg_gen_movi_tl(cpu_PC, pc);
-}
-
-static inline void save_cpu_state (DisasContext *ctx, int do_save_pc)
-{
-LOG_DISAS(hflags %08x saved %08x\n, ctx-hflags, ctx-saved_hflags);
-if (do_save_pc  ctx-pc != ctx-saved_pc) {
-gen_save_pc(ctx-pc);
-ctx-saved_pc = ctx-pc;
-}
-if (ctx-hflags != ctx-saved_hflags) {
-tcg_gen_movi_i32(hflags, ctx-hflags);
-ctx-saved_hflags = ctx-hflags;
-switch (ctx-hflags  MIPS_HFLAG_BMASK_BASE) {
-case MIPS_HFLAG_BR:
-break;
-case MIPS_HFLAG_BC:
-case MIPS_HFLAG_BL:
-case MIPS_HFLAG_B:
-tcg_gen_movi_tl(btarget, ctx-btarget);
-break;
-}
-}
-}
-
-static inline void restore_cpu_state (CPUMIPSState *env, DisasContext *ctx)
-{
-ctx-saved_hflags = ctx-hflags;
-switch (ctx-hflags  MIPS_HFLAG_BMASK_BASE) {
-case MIPS_HFLAG_BR:
-break;
-case MIPS_HFLAG_BC:
-case MIPS_HFLAG_BL:
-case MIPS_HFLAG_B:
-ctx-btarget = env-btarget;
-break;
-}
-}
-
-static inline void
-generate_exception_err (DisasContext *ctx, int excp, int err)
-{
-TCGv_i32 texcp = tcg_const_i32(excp);
-TCGv_i32 terr = tcg_const_i32(err);
-save_cpu_state(ctx, 1);
-gen_helper_raise_exception_err(cpu_env, texcp, terr);
-tcg_temp_free_i32(terr);
-tcg_temp_free_i32(texcp);
-}
-
-static inline void
-generate_exception (DisasContext *ctx, int excp)
-{
-save_cpu_state(ctx, 1);
-gen_helper_0e0i(raise_exception, excp);
-}
-
 /* Addresses computation */
 static inline void gen_op_addr_add (DisasContext *ctx, TCGv ret, TCGv arg0, 
TCGv arg1)
 {
-- 
2.1.0

[Qemu-devel] [PULL 08/29] mips jazz: compile only in 64 bit

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Remove now useless device models from other MIPS configurations

We're now compiling 12 files less than before.

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 default-configs/mips-softmmu.mak | 5 -
 default-configs/mips64-softmmu.mak   | 1 +
 default-configs/mips64el-softmmu.mak | 1 +
 default-configs/mipsel-softmmu.mak   | 5 -
 hw/mips/Makefile.objs| 3 ++-
 hw/mips/mips_jazz.c  | 5 -
 tests/endianness-test.c  | 2 --
 7 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/default-configs/mips-softmmu.mak b/default-configs/mips-softmmu.mak
index fd0607d..44467c3 100644
--- a/default-configs/mips-softmmu.mak
+++ b/default-configs/mips-softmmu.mak
@@ -24,14 +24,9 @@ CONFIG_PIIX4=y
 CONFIG_IDE_ISA=y
 CONFIG_IDE_PIIX=y
 CONFIG_NE2000_ISA=y
-CONFIG_RC4030=y
-CONFIG_DP8393X=y
-CONFIG_DS1225Y=y
 CONFIG_MIPSNET=y
 CONFIG_PFLASH_CFI01=y
-CONFIG_G364FB=y
 CONFIG_I8259=y
-CONFIG_JAZZ_LED=y
 CONFIG_MC146818RTC=y
 CONFIG_ISA_TESTDEV=y
 CONFIG_EMPTY_SLOT=y
diff --git a/default-configs/mips64-softmmu.mak 
b/default-configs/mips64-softmmu.mak
index b8c7910..66ed5f9 100644
--- a/default-configs/mips64-softmmu.mak
+++ b/default-configs/mips64-softmmu.mak
@@ -29,6 +29,7 @@ CONFIG_DP8393X=y
 CONFIG_DS1225Y=y
 CONFIG_MIPSNET=y
 CONFIG_PFLASH_CFI01=y
+CONFIG_JAZZ=y
 CONFIG_G364FB=y
 CONFIG_I8259=y
 CONFIG_JAZZ_LED=y
diff --git a/default-configs/mips64el-softmmu.mak 
b/default-configs/mips64el-softmmu.mak
index ae4274b..bfca2b2 100644
--- a/default-configs/mips64el-softmmu.mak
+++ b/default-configs/mips64el-softmmu.mak
@@ -31,6 +31,7 @@ CONFIG_DS1225Y=y
 CONFIG_MIPSNET=y
 CONFIG_PFLASH_CFI01=y
 CONFIG_FULONG=y
+CONFIG_JAZZ=y
 CONFIG_G364FB=y
 CONFIG_I8259=y
 CONFIG_JAZZ_LED=y
diff --git a/default-configs/mipsel-softmmu.mak 
b/default-configs/mipsel-softmmu.mak
index 1e2374b..0162ef0 100644
--- a/default-configs/mipsel-softmmu.mak
+++ b/default-configs/mipsel-softmmu.mak
@@ -24,14 +24,9 @@ CONFIG_PIIX4=y
 CONFIG_IDE_ISA=y
 CONFIG_IDE_PIIX=y
 CONFIG_NE2000_ISA=y
-CONFIG_RC4030=y
-CONFIG_DP8393X=y
-CONFIG_DS1225Y=y
 CONFIG_MIPSNET=y
 CONFIG_PFLASH_CFI01=y
-CONFIG_G364FB=y
 CONFIG_I8259=y
-CONFIG_JAZZ_LED=y
 CONFIG_MC146818RTC=y
 CONFIG_ISA_TESTDEV=y
 CONFIG_EMPTY_SLOT=y
diff --git a/hw/mips/Makefile.objs b/hw/mips/Makefile.objs
index 0a652f8..9633f3a 100644
--- a/hw/mips/Makefile.objs
+++ b/hw/mips/Makefile.objs
@@ -1,4 +1,5 @@
-obj-y += mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
+obj-y += mips_r4k.o mips_malta.o mips_mipssim.o
 obj-y += addr.o cputimer.o mips_int.o
+obj-$(CONFIG_JAZZ) += mips_jazz.o
 obj-$(CONFIG_FULONG) += mips_fulong2e.o
 obj-y += gt64xxx_pci.o
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 2c153e0..f16070e 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -157,12 +157,7 @@ static void mips_jazz_init(MachineState *machine,
 
 /* init CPUs */
 if (cpu_model == NULL) {
-#ifdef TARGET_MIPS64
 cpu_model = R4000;
-#else
-/* FIXME: All wrong, this maybe should be R3000 for the older JAZZs. */
-cpu_model = 24Kf;
-#endif
 }
 cpu = cpu_mips_init(cpu_model);
 if (cpu == NULL) {
diff --git a/tests/endianness-test.c b/tests/endianness-test.c
index 92e17d2..26ee734 100644
--- a/tests/endianness-test.c
+++ b/tests/endianness-test.c
@@ -31,8 +31,6 @@ struct TestCase {
 
 static const TestCase test_cases[] = {
 { i386, pc, -1 },
-{ mips, magnum, 0x9000, .bswap = true },
-{ mips, pica61, 0x9000, .bswap = true },
 { mips, mips, 0x1400, .bswap = true },
 { mips, malta, 0x1000, .bswap = true },
 { mips64, magnum, 0x9000, .bswap = true },
-- 
2.1.0

[Qemu-devel] [PULL 19/29] net/dp8393x: add PROM to store MAC address

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Signed-off-by: Laurent Vivier laur...@vivier.eu
Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/mips/mips_jazz.c |  1 +
 hw/net/dp8393x.c| 18 ++
 2 files changed, 19 insertions(+)

diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 648654e..9d60633 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -282,6 +282,7 @@ static void mips_jazz_init(MachineState *machine,
 qdev_init_nofail(dev);
 sysbus = SYS_BUS_DEVICE(dev);
 sysbus_mmio_map(sysbus, 0, 0x80001000);
+sysbus_mmio_map(sysbus, 1, 0x8000b000);
 sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(rc4030, 4));
 break;
 } else if (is_help_option(nd-model)) {
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 51e728b..ef1fb0e 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -25,6 +25,7 @@
 
 //#define DEBUG_SONIC
 
+#define SONIC_PROM_SIZE 0x1000
 
 #ifdef DEBUG_SONIC
 #define DPRINTF(fmt, ...) \
@@ -156,6 +157,7 @@ typedef struct dp8393xState {
 NICConf conf;
 NICState *nic;
 MemoryRegion mmio;
+MemoryRegion prom;
 
 /* Registers */
 uint8_t cam[16][6];
@@ -816,12 +818,15 @@ static void dp8393x_instance_init(Object *obj)
 dp8393xState *s = DP8393X(obj);
 
 sysbus_init_mmio(sbd, s-mmio);
+sysbus_init_mmio(sbd, s-prom);
 sysbus_init_irq(sbd, s-irq);
 }
 
 static void dp8393x_realize(DeviceState *dev, Error **errp)
 {
 dp8393xState *s = DP8393X(dev);
+int i, checksum;
+uint8_t *prom;
 
 address_space_init(s-as, s-dma_mr, dp8393x);
 memory_region_init_io(s-mmio, OBJECT(dev), dp8393x_ops, s,
@@ -833,6 +838,19 @@ static void dp8393x_realize(DeviceState *dev, Error **errp)
 
 s-watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s);
 s-regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
+
+memory_region_init_rom_device(s-prom, OBJECT(dev), NULL, NULL,
+  dp8393x-prom, SONIC_PROM_SIZE, NULL);
+prom = memory_region_get_ram_ptr(s-prom);
+checksum = 0;
+for (i = 0; i  6; i++) {
+prom[i] = s-conf.macaddr.a[i];
+checksum += prom[i];
+if (checksum  0xff) {
+checksum = (checksum + 1)  0xff;
+}
+}
+prom[7] = 0xff - checksum;
 }
 
 static Property dp8393x_properties[] = {
-- 
2.1.0

[Qemu-devel] [PULL 26/29] target-mips: add CP0.PageGrain.ELPA support

[Leon Alrae]

CP0.PageGrain.ELPA enables support for large physical addresses. This field
is encoded as follows:
0: Large physical address support is disabled.
1: Large physical address support is enabled.

If this bit is a 1, the following changes occur to coprocessor 0 registers:
- The PFNX field of the EntryLo0 and EntryLo1 registers is writable and
  concatenated with the PFN field to form the full page frame number.
- Access to optional COP0 registers with PA extension, LLAddr, TagLo is
  defined.

P5600 can operate in 32-bit or 40-bit Physical Address Mode. Therefore if
XPA is disabled (CP0.PageGrain.ELPA = 0) then assume 32-bit Address Mode.
In MIPS64 assume 36 as default PABITS (when CP0.PageGrain.ELPA = 0).

env-PABITS value is constant and indicates maximum PABITS available on
a core, whereas env-PAMask is calculated from env-PABITS and is also
affected by CP0.PageGrain.ELPA.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 target-mips/cpu.h   | 27 +--
 target-mips/machine.c   |  1 +
 target-mips/mips-defs.h |  4 ++--
 target-mips/op_helper.c | 19 ---
 target-mips/translate.c |  3 ++-
 5 files changed, 42 insertions(+), 12 deletions(-)

diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 4b81798..c266e9f 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -224,8 +224,14 @@ struct CPUMIPSState {
 
 uint32_t SEGBITS;
 uint32_t PABITS;
+#if defined(TARGET_MIPS64)
+# define PABITS_BASE 36
+#else
+# define PABITS_BASE 32
+#endif
 target_ulong SEGMask;
 uint64_t PAMask;
+#define PAMASK_BASE ((1ULL  PABITS_BASE) - 1)
 
 int32_t msair;
 #define MSAIR_ProcID8
@@ -289,6 +295,7 @@ struct CPUMIPSState {
 int32_t CP0_PageGrain;
 #define CP0PG_RIE 31
 #define CP0PG_XIE 30
+#define CP0PG_ELPA 29
 #define CP0PG_IEC 27
 int32_t CP0_Wired;
 int32_t CP0_SRSConf0_rw_bitmask;
@@ -518,7 +525,7 @@ struct CPUMIPSState {
 #define EXCP_INST_NOTAVAIL 0x2 /* No valid instruction word for BadInstr */
 uint32_t hflags;/* CPU State */
 /* TMASK defines different execution modes */
-#define MIPS_HFLAG_TMASK  0x35807FF
+#define MIPS_HFLAG_TMASK  0x75807FF
 #define MIPS_HFLAG_MODE   0x7 /* execution modes*/
 /* The KSU flags must be the lowest bits in hflags. The flag order
must be the same as defined for CP0 Status. This allows to use
@@ -566,6 +573,7 @@ struct CPUMIPSState {
 #define MIPS_HFLAG_FBNSLOT 0x80 /* Forbidden slot   */
 #define MIPS_HFLAG_MSA   0x100
 #define MIPS_HFLAG_FRE   0x200 /* FRE enabled */
+#define MIPS_HFLAG_ELPA  0x400
 target_ulong btarget;/* Jump / branch target   */
 target_ulong bcond;  /* Branch condition (if needed)   */
 
@@ -801,6 +809,15 @@ static inline void restore_msa_fp_status(CPUMIPSState *env)
 set_flush_inputs_to_zero(flush_to_zero, status);
 }
 
+static inline void restore_pamask(CPUMIPSState *env)
+{
+if (env-hflags  MIPS_HFLAG_ELPA) {
+env-PAMask = (1ULL  env-PABITS) - 1;
+} else {
+env-PAMask = PAMASK_BASE;
+}
+}
+
 static inline void cpu_get_tb_cpu_state(CPUMIPSState *env, target_ulong *pc,
 target_ulong *cs_base, int *flags)
 {
@@ -848,7 +865,8 @@ static inline void compute_hflags(CPUMIPSState *env)
 env-hflags = ~(MIPS_HFLAG_COP1X | MIPS_HFLAG_64 | MIPS_HFLAG_CP0 |
  MIPS_HFLAG_F64 | MIPS_HFLAG_FPU | MIPS_HFLAG_KSU |
  MIPS_HFLAG_AWRAP | MIPS_HFLAG_DSP | MIPS_HFLAG_DSPR2 |
- MIPS_HFLAG_SBRI | MIPS_HFLAG_MSA | MIPS_HFLAG_FRE);
+ MIPS_HFLAG_SBRI | MIPS_HFLAG_MSA | MIPS_HFLAG_FRE |
+ MIPS_HFLAG_ELPA);
 if (!(env-CP0_Status  (1  CP0St_EXL)) 
 !(env-CP0_Status  (1  CP0St_ERL)) 
 !(env-hflags  MIPS_HFLAG_DM)) {
@@ -934,6 +952,11 @@ static inline void compute_hflags(CPUMIPSState *env)
 env-hflags |= MIPS_HFLAG_FRE;
 }
 }
+if (env-CP0_Config3  (1  CP0C3_LPA)) {
+if (env-CP0_PageGrain  (1  CP0PG_ELPA)) {
+env-hflags |= MIPS_HFLAG_ELPA;
+}
+}
 }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 559402c..8fa755c 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -10,6 +10,7 @@ static int cpu_post_load(void *opaque, int version_id)
 restore_fp_status(env);
 restore_msa_fp_status(env);
 compute_hflags(env);
+restore_pamask(env);
 
 return 0;
 }
diff --git a/target-mips/mips-defs.h b/target-mips/mips-defs.h
index 1784227..20aa87c 100644
--- a/target-mips/mips-defs.h
+++ b/target-mips/mips-defs.h
@@ -10,11 +10,11 @@
 
 #if defined(TARGET_MIPS64)
 #define TARGET_LONG_BITS 64
-#define TARGET_PHYS_ADDR_SPACE_BITS 36
+#define TARGET_PHYS_ADDR_SPACE_BITS 48
 #define TARGET_VIRT_ADDR_SPACE_BITS 42
 #else
 #define 

Re: [Qemu-devel] [SeaBIOS] qemu freeze, seabios release

[Gerd Hoffmann]

  Hi,

 should be cherry-picked into stable please speak up now.  So far my list
 is pretty short:

Looked through the log.  The leal instruction and ahci max-ports fixes
are worth having too I think.  So I have this list now:

nilsson kraxel ~/projects/seabios (1.8-stable)# git log --oneline rel-1.8.1..
eb3677a vga: rework virtio-vga support
33d4d4f build: Support make VERSION=xyz to override the default build version
dbd4a87 ahci: Ignore max_ports.
42f6019 vgabios: Emulate leal instruction
c5fa0c5 vgabios: Add config option for assembler fixups

cheers,
  Gerd

Re: [Qemu-devel] [RFC v6 0/2] monitor: add memory search commands s, sp

[Markus Armbruster]

Luiz Capitulino lcapitul...@redhat.com writes:

 On Thu, 28 May 2015 16:18:41 -0400
 Luiz Capitulino lcapitul...@redhat.com wrote:

 On Mon, 18 May 2015 13:22:16 +0200
 hw.clau...@gmail.com wrote:
 
  From: Claudio Fontana claudio.font...@huawei.com
  
  This is the latest iteration of the memory search patch,
  including a trivial replacement for the memmem function for systems
  which don't provide one (notably Windows).
  
  It detects the presence of memmem in configure and sets CONFIG_MEMMEM,
  providing a trivial implementation for the !CONFIG_MEMMEM case.
  
  The new code is MIT licensed, following usage of other files in the same
  directory dealing with replacement functions (osdep, oslib, getauxval etc),
  and to maximize reusability.
  
  I have tested this in both CONFIG_MEMMEM defined/undefined scenarios,
  but more feedback and testing is welcome of course.
  
  changes from v5:
  dropped the import from gnulib and implemented a trivial replacement.
  
  changes from v4:
  made into a series of two patches.
  Introduced a memmem replacement function (import from gnulib)
  and detection code in configure.
  
  changes from v3:
  initialize pointer variable to NULL to finally get rid of spurious warning
  
  changes from v2:
  move code to try to address spurious warning
  
  changes from v1:
  make checkpatch happy by adding braces here and there.
  
  
  Claudio Fontana (2):
util: add memmem replacement function
monitor: add memory search commands s, sp
 
 Applied to the qmp branch, thanks.


 Unfortunately, I'm quite busy and won't have time to push this
 through my tree. Markus is going to pick up this series soon.

 Acked-by: Luiz Capitulino lcapitul...@redhat.com

This series is marked RFC.  Is it intended for merging anyway?

Semantic conflict with
[PATCH v2 0/2] monitor+disas: Remove uses of ENV_GET_CPU
needs to be resolved:

  CCx86_64-softmmu/monitor.o
/work/armbru/qemu/monitor.c: In function ‘memory_search’:
/work/armbru/qemu/monitor.c:1222:9: warning: passing argument 1 of 
‘x86_env_get_cpu’ from incompatible pointer type [enabled by default]
 } else if (cpu_memory_rw_debug(ENV_GET_CPU(mon_get_cpu()), addr,
 ^
In file included from /work/armbru/qemu/target-i386/cpu.h:982:0,
 from /work/armbru/qemu/include/qemu-common.h:124,
 from /work/armbru/qemu/include/hw/hw.h:5,
 from /work/armbru/qemu/monitor.c:25:
/work/armbru/qemu/target-i386/cpu-qom.h:119:23: note: expected ‘struct 
CPUX86State *’ but argument is of type ‘struct CPUState *’
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
   ^

Re: [Qemu-devel] [PATCH V2] pci: fixes to allow booting from extra root pci buses.

[Laszlo Ersek]

On 06/11/15 21:24, Kevin O'Connor wrote:
 On Thu, Jun 11, 2015 at 08:34:56PM +0200, Laszlo Ersek wrote:
 On 06/11/15 19:46, Marcel Apfelbaum wrote:
 On 06/11/2015 07:54 PM, Kevin O'Connor wrote:
 On real machines, the firmware assigns the 4 - it's not a physical
 address; it's a logical address (like all bus numbers in PCI).  The
 firmware might assign a totally different number on the next boot.
 Now I am confused. Don't get me wrong, I am not an expert on fw, I hardly
 try to understand it.

 I looked up a real hardware machine and it seemed to me that the extra
 pci root numbers
 are provided in the ACPI tables, meaning by the vendor, not the fw.
 In this case QEMU is the vendor, i440fx is the machine, right?

 I am not aware that Seabios/OVMF are deciding the bus numbers for the
 *PCI roots*.
 They are doing it for the pci-2-pci bridges of course.
 I saw that Seabios is trying to guess the root-buses by going over all
 the 0-0xff range
 and probing all the slots, looking for devices. So it expects the hw to
 be hardwired regarding
 PCI root buses.

 This is exactly how I understood it.

 We're not interested in placing such bus numbers in device paths that
 are assigned during PCI enumeration. (Like subordinate bus numbers.)
 We're talking about the root bus numbers.

 OVMF implements the same kind of probing that SeaBIOS does (based on
 natural language description from Michael and Marcel, not on the actual
 code). Devices on the root buses respond without any prior bus number
 assignments.
 
 Alas, that is not correct.  Coreboot supports several AMD boards that
 have multiple southbridge chips which provide independent PCI root
 buses.  These chips have to be configured and assigned a bus number
 prior to use (which coreboot does).

Thanks.

Assuming such a physical hardware configuration, and that Coreboot
configures the root buses before the SeaBIOS payload is launched: how
does Coreboot identify a device, on a nonzero root bus, for SeaBIOS to
boot from? Is that possible at all, or is the user expected to configure
/ select that in SeaBIOS exclusively?

Our use case does not include Coreboot (as far as I can tell), but I'm
trying to find some parallels here.

* In the QEMU without Coreboot case, QEMU is the component that sets
up the root buses for the firmware. Therefore it has all knowledge about
the root buses. OVMF is meant solely for QEMU hardware, therefore it
has a full understanding with QEMU. QEMU can refer to root buses in the
bootorder fw_cfg file because it owns both the root buses and the
bootorder fw_cfg file, and OVMF can trust them to match.

* In the physical hardware with Coreboot case, Coreboot is the
component that sets up the root buses for the firmware (SeaBIOS).
Coreboot *could* refer to the root buses in some boot order file (a cbfs
file I guess?) -- if such a feature existed between Coreboot and SeaBIOS
-- because Coreboot would own both the root buses and the (theoretical)
cbfs boot order file. Hence SeaBIOS could trust them to match.

Assuming there is no such feature between Coreboot and SeaBIOS (ie. one
that would parallel our QEMU use case on physical hardware), what
solution would you find acceptable for the case when QEMU basically
promises I know where you'll find those root buses, and the bootorder
fw_cfg file will match them?

Could we simply make this patch conditional on runningOnQEMU()?

Thanks
Laszlo

[Qemu-devel] [PULL 10/29] dma/rc4030: use AddressSpace and address_space_rw in users

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Now that rc4030 internally uses an AddressSpace for DMA handling, make its root
memory region public. This is especially usefull for dp8393x netcard, which now
uses well known QEMU types and methods.

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/dma/rc4030.c| 15 -
 hw/mips/mips_jazz.c|  6 ++---
 hw/net/dp8393x.c   | 61 +-
 include/hw/mips/mips.h | 10 -
 4 files changed, 42 insertions(+), 50 deletions(-)

diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index 84039dc..a0b617f 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -776,13 +776,6 @@ static void rc4030_save(QEMUFile *f, void *opaque)
 qemu_put_be32(f, s-itr);
 }
 
-void rc4030_dma_memory_rw(void *opaque, hwaddr addr, uint8_t *buf, int len, 
int is_write)
-{
-rc4030State *s = opaque;
-address_space_rw(s-dma_as, addr, MEMTXATTRS_UNSPECIFIED, buf, len,
- is_write);
-}
-
 static void rc4030_do_dma(void *opaque, int n, uint8_t *buf, int len, int 
is_write)
 {
 rc4030State *s = opaque;
@@ -869,9 +862,9 @@ static rc4030_dma *rc4030_allocate_dmas(void *opaque, int n)
 return s;
 }
 
-void *rc4030_init(qemu_irq timer, qemu_irq jazz_bus,
-  qemu_irq **irqs, rc4030_dma **dmas,
-  MemoryRegion *sysmem)
+MemoryRegion *rc4030_init(qemu_irq timer, qemu_irq jazz_bus,
+  qemu_irq **irqs, rc4030_dma **dmas,
+  MemoryRegion *sysmem)
 {
 rc4030State *s;
 int i;
@@ -910,5 +903,5 @@ void *rc4030_init(qemu_irq timer, qemu_irq jazz_bus,
 s-dma_mrs[i]);
 }
 address_space_init(s-dma_as, s-dma_mr, rc4030-dma);
-return s;
+return s-dma_mr;
 }
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index f16070e..05cad6b 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -137,7 +137,7 @@ static void mips_jazz_init(MachineState *machine,
 CPUMIPSState *env;
 qemu_irq *rc4030, *i8259;
 rc4030_dma *dmas;
-void* rc4030_opaque;
+MemoryRegion *rc4030_dma_mr;
 MemoryRegion *isa_mem = g_new(MemoryRegion, 1);
 MemoryRegion *isa_io = g_new(MemoryRegion, 1);
 MemoryRegion *rtc = g_new(MemoryRegion, 1);
@@ -213,7 +213,7 @@ static void mips_jazz_init(MachineState *machine,
 cpu_mips_clock_init(env);
 
 /* Chipset */
-rc4030_opaque = rc4030_init(env-irq[6], env-irq[3], rc4030, dmas,
+rc4030_dma_mr = rc4030_init(env-irq[6], env-irq[3], rc4030, dmas,
 address_space);
 memory_region_init_io(dma_dummy, NULL, dma_dummy_ops, NULL, dummy_dma, 
0x1000);
 memory_region_add_subregion(address_space, 0x8000d000, dma_dummy);
@@ -268,7 +268,7 @@ static void mips_jazz_init(MachineState *machine,
 nd-model = g_strdup(dp83932);
 if (strcmp(nd-model, dp83932) == 0) {
 dp83932_init(nd, 0x80001000, 2, get_system_memory(), rc4030[4],
- rc4030_opaque, rc4030_dma_memory_rw);
+ rc4030_dma_mr);
 break;
 } else if (is_help_option(nd-model)) {
 fprintf(stderr, qemu: Supported NICs: dp83932\n);
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 7ce13d2..2297231 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -168,8 +168,7 @@ typedef struct dp8393xState {
 int loopback_packet;
 
 /* Memory access */
-void (*memory_rw)(void *opaque, hwaddr addr, uint8_t *buf, int len, int 
is_write);
-void* mem_opaque;
+AddressSpace as;
 } dp8393xState;
 
 static void dp8393x_update_irq(dp8393xState *s)
@@ -201,9 +200,9 @@ static void do_load_cam(dp8393xState *s)
 
 while (s-regs[SONIC_CDC]  0x1f) {
 /* Fill current entry */
-s-memory_rw(s-mem_opaque,
+address_space_rw(s-as,
 (s-regs[SONIC_URRA]  16) | s-regs[SONIC_CDP],
-(uint8_t *)data, size, 0);
+MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0);
 s-cam[index][0] = data[1 * width]  0xff;
 s-cam[index][1] = data[1 * width]  8;
 s-cam[index][2] = data[2 * width]  0xff;
@@ -220,9 +219,9 @@ static void do_load_cam(dp8393xState *s)
 }
 
 /* Read CAM enable */
-s-memory_rw(s-mem_opaque,
+address_space_rw(s-as,
 (s-regs[SONIC_URRA]  16) | s-regs[SONIC_CDP],
-(uint8_t *)data, size, 0);
+MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0);
 s-regs[SONIC_CE] = data[0 * width];
 DPRINTF(load cam done. cam enable mask 0x%04x\n, s-regs[SONIC_CE]);
 
@@ -240,9 +239,9 @@ static void do_read_rra(dp8393xState *s)
 /* Read memory */
 width = (s-regs[SONIC_DCR]  SONIC_DCR_DW) ? 2 : 1;
 size = sizeof(uint16_t) * 4 * width;
-s-memory_rw(s-mem_opaque,
+address_space_rw(s-as,
 

[Qemu-devel] [PULL 24/29] target-mips: extend selected CP0 registers to 64-bits in MIPS32

[Leon Alrae]

Extend EntryLo0, EntryLo1, LLAddr and TagLo from 32 to 64 bits in MIPS32.

Introduce gen_move_low32() function which moves low 32 bits from 64-bit
temp to GPR; it sign extends 32-bit value on MIPS64 and truncates on
MIPS32.

Signed-off-by: Leon Alrae leon.al...@imgtec.com
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
---
 target-mips/cpu.h   | 14 +--
 target-mips/machine.c   | 20 
 target-mips/op_helper.c |  8 +++
 target-mips/translate.c | 63 -
 4 files changed, 63 insertions(+), 42 deletions(-)

diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 2c68782..4b81798 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -34,7 +34,7 @@ struct r4k_tlb_t {
 uint_fast16_t RI0:1;
 uint_fast16_t RI1:1;
 uint_fast16_t EHINV:1;
-target_ulong PFN[2];
+uint64_t PFN[2];
 };
 
 #if !defined(CONFIG_USER_ONLY)
@@ -225,7 +225,7 @@ struct CPUMIPSState {
 uint32_t SEGBITS;
 uint32_t PABITS;
 target_ulong SEGMask;
-target_ulong PAMask;
+uint64_t PAMask;
 
 int32_t msair;
 #define MSAIR_ProcID8
@@ -273,8 +273,8 @@ struct CPUMIPSState {
 #define CP0VPEOpt_DWX2 2
 #define CP0VPEOpt_DWX1 1
 #define CP0VPEOpt_DWX0 0
-target_ulong CP0_EntryLo0;
-target_ulong CP0_EntryLo1;
+uint64_t CP0_EntryLo0;
+uint64_t CP0_EntryLo1;
 #if defined(TARGET_MIPS64)
 # define CP0EnLo_RI 63
 # define CP0EnLo_XI 62
@@ -472,11 +472,11 @@ struct CPUMIPSState {
 int32_t CP0_Config6;
 int32_t CP0_Config7;
 /* XXX: Maybe make LLAddr per-TC? */
-target_ulong lladdr;
+uint64_t lladdr;
 target_ulong llval;
 target_ulong llnewval;
 target_ulong llreg;
-target_ulong CP0_LLAddr_rw_bitmask;
+uint64_t CP0_LLAddr_rw_bitmask;
 int CP0_LLAddr_shift;
 target_ulong CP0_WatchLo[8];
 int32_t CP0_WatchHi[8];
@@ -503,7 +503,7 @@ struct CPUMIPSState {
 #define CP0DB_DSS  0
 target_ulong CP0_DEPC;
 int32_t CP0_Performance0;
-int32_t CP0_TagLo;
+uint64_t CP0_TagLo;
 int32_t CP0_DataLo;
 int32_t CP0_TagHi;
 int32_t CP0_DataHi;
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 7d1fa32..559402c 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -142,8 +142,8 @@ static int get_tlb(QEMUFile *f, void *pv, size_t size)
 v-RI0 = (flags  13)  1;
 v-XI1 = (flags  12)  1;
 v-XI0 = (flags  11)  1;
-qemu_get_betls(f, v-PFN[0]);
-qemu_get_betls(f, v-PFN[1]);
+qemu_get_be64s(f, v-PFN[0]);
+qemu_get_be64s(f, v-PFN[1]);
 
 return 0;
 }
@@ -169,8 +169,8 @@ static void put_tlb(QEMUFile *f, void *pv, size_t size)
 qemu_put_be32s(f, v-PageMask);
 qemu_put_8s(f, v-ASID);
 qemu_put_be16s(f, flags);
-qemu_put_betls(f, v-PFN[0]);
-qemu_put_betls(f, v-PFN[1]);
+qemu_put_be64s(f, v-PFN[0]);
+qemu_put_be64s(f, v-PFN[1]);
 }
 
 const VMStateInfo vmstate_info_tlb = {
@@ -201,8 +201,8 @@ const VMStateDescription vmstate_tlb = {
 
 const VMStateDescription vmstate_mips_cpu = {
 .name = cpu,
-.version_id = 6,
-.minimum_version_id = 6,
+.version_id = 7,
+.minimum_version_id = 7,
 .post_load = cpu_post_load,
 .fields = (VMStateField[]) {
 /* Active TC */
@@ -237,8 +237,8 @@ const VMStateDescription vmstate_mips_cpu = {
 VMSTATE_UINTTL(env.CP0_VPESchedule, MIPSCPU),
 VMSTATE_UINTTL(env.CP0_VPEScheFBack, MIPSCPU),
 VMSTATE_INT32(env.CP0_VPEOpt, MIPSCPU),
-VMSTATE_UINTTL(env.CP0_EntryLo0, MIPSCPU),
-VMSTATE_UINTTL(env.CP0_EntryLo1, MIPSCPU),
+VMSTATE_UINT64(env.CP0_EntryLo0, MIPSCPU),
+VMSTATE_UINT64(env.CP0_EntryLo1, MIPSCPU),
 VMSTATE_UINTTL(env.CP0_Context, MIPSCPU),
 VMSTATE_INT32(env.CP0_PageMask, MIPSCPU),
 VMSTATE_INT32(env.CP0_PageGrain, MIPSCPU),
@@ -269,7 +269,7 @@ const VMStateDescription vmstate_mips_cpu = {
 VMSTATE_INT32(env.CP0_Config3, MIPSCPU),
 VMSTATE_INT32(env.CP0_Config6, MIPSCPU),
 VMSTATE_INT32(env.CP0_Config7, MIPSCPU),
-VMSTATE_UINTTL(env.lladdr, MIPSCPU),
+VMSTATE_UINT64(env.lladdr, MIPSCPU),
 VMSTATE_UINTTL_ARRAY(env.CP0_WatchLo, MIPSCPU, 8),
 VMSTATE_INT32_ARRAY(env.CP0_WatchHi, MIPSCPU, 8),
 VMSTATE_UINTTL(env.CP0_XContext, MIPSCPU),
@@ -277,7 +277,7 @@ const VMStateDescription vmstate_mips_cpu = {
 VMSTATE_INT32(env.CP0_Debug, MIPSCPU),
 VMSTATE_UINTTL(env.CP0_DEPC, MIPSCPU),
 VMSTATE_INT32(env.CP0_Performance0, MIPSCPU),
-VMSTATE_INT32(env.CP0_TagLo, MIPSCPU),
+VMSTATE_UINT64(env.CP0_TagLo, MIPSCPU),
 VMSTATE_INT32(env.CP0_DataLo, MIPSCPU),
 VMSTATE_INT32(env.CP0_TagHi, MIPSCPU),
 VMSTATE_INT32(env.CP0_DataHi, MIPSCPU),
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index b412f94..4dc4970 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -1997,12 +1997,12 @@ void 

[Qemu-devel] [PULL 09/29] dma/rc4030: create custom DMA address space

[Leon Alrae]

From: Hervé Poussineau hpous...@reactos.org

Add a new memory region in system address space where DMA address space
definition (the 'translation table') belongs, so we can update on the fly
the DMA address space.

Signed-off-by: Hervé Poussineau hpous...@reactos.org
Reviewed-by: Aurelien Jarno aurel...@aurel32.net
Signed-off-by: Leon Alrae leon.al...@imgtec.com
---
 hw/dma/rc4030.c | 163 +++-
 1 file changed, 126 insertions(+), 37 deletions(-)

diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index af26632..84039dc 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -25,6 +25,7 @@
 #include hw/hw.h
 #include hw/mips/mips.h
 #include qemu/timer.h
+#include exec/address-spaces.h
 
 //
 /* debug rc4030 */
@@ -47,6 +48,8 @@ do { fprintf(stderr, rc4030 ERROR: %s:  fmt, __func__ , ## 
__VA_ARGS__); } whi
 //
 /* rc4030 emulation */
 
+#define MAX_TL_ENTRIES 512
+
 typedef struct dma_pagetable_entry {
 int32_t frame;
 int32_t owner;
@@ -96,6 +99,16 @@ typedef struct rc4030State
 qemu_irq timer_irq;
 qemu_irq jazz_bus_irq;
 
+/* biggest translation table */
+MemoryRegion dma_tt;
+/* translation table memory region alias, added to system RAM */
+MemoryRegion dma_tt_alias;
+/* whole DMA memory region, root of DMA address space */
+MemoryRegion dma_mr;
+/* translation table entry aliases, added to DMA memory region */
+MemoryRegion dma_mrs[MAX_TL_ENTRIES];
+AddressSpace dma_as;
+
 MemoryRegion iomem_chipset;
 MemoryRegion iomem_jazzio;
 } rc4030State;
@@ -265,6 +278,97 @@ static uint32_t rc4030_readb(void *opaque, hwaddr addr)
 return (v  (8 * (addr  0x3)))  0xff;
 }
 
+static void rc4030_dma_as_update_one(rc4030State *s, int index, uint32_t frame)
+{
+if (index  MAX_TL_ENTRIES) {
+memory_region_set_enabled(s-dma_mrs[index], false);
+}
+
+if (!frame) {
+return;
+}
+
+if (index = MAX_TL_ENTRIES) {
+qemu_log_mask(LOG_UNIMP,
+  rc4030: trying to use too high 
+  translation table entry %d (max allowed=%d),
+  index, MAX_TL_ENTRIES);
+return;
+}
+memory_region_set_alias_offset(s-dma_mrs[index], frame);
+memory_region_set_enabled(s-dma_mrs[index], true);
+}
+
+static void rc4030_dma_tt_write(void *opaque, hwaddr addr, uint64_t data,
+unsigned int size)
+{
+rc4030State *s = opaque;
+
+/* write memory */
+memcpy(memory_region_get_ram_ptr(s-dma_tt) + addr, data, size);
+
+/* update dma address space (only if frame field has been written) */
+if (addr % sizeof(dma_pagetable_entry) == 0) {
+int index = addr / sizeof(dma_pagetable_entry);
+memory_region_transaction_begin();
+rc4030_dma_as_update_one(s, index, (uint32_t)data);
+memory_region_transaction_commit();
+}
+}
+
+static const MemoryRegionOps rc4030_dma_tt_ops = {
+.write = rc4030_dma_tt_write,
+.impl.min_access_size = 4,
+.impl.max_access_size = 4,
+};
+
+static void rc4030_dma_tt_update(rc4030State *s, uint32_t new_tl_base,
+ uint32_t new_tl_limit)
+{
+int entries, i;
+dma_pagetable_entry *dma_tl_contents;
+
+if (s-dma_tl_limit) {
+/* write old dma tl table to physical memory */
+memory_region_del_subregion(get_system_memory(), s-dma_tt_alias);
+cpu_physical_memory_write(s-dma_tl_limit  0x7fff,
+  memory_region_get_ram_ptr(s-dma_tt),
+  memory_region_size(s-dma_tt_alias));
+}
+object_unparent(OBJECT(s-dma_tt_alias));
+
+s-dma_tl_base = new_tl_base;
+s-dma_tl_limit = new_tl_limit;
+new_tl_base = 0x7fff;
+
+if (s-dma_tl_limit) {
+uint64_t dma_tt_size;
+if (s-dma_tl_limit = memory_region_size(s-dma_tt)) {
+dma_tt_size = s-dma_tl_limit;
+} else {
+dma_tt_size = memory_region_size(s-dma_tt);
+}
+memory_region_init_alias(s-dma_tt_alias, NULL,
+ dma-table-alias,
+ s-dma_tt, 0, dma_tt_size);
+dma_tl_contents = memory_region_get_ram_ptr(s-dma_tt);
+cpu_physical_memory_read(new_tl_base, dma_tl_contents, dma_tt_size);
+
+memory_region_transaction_begin();
+entries = dma_tt_size / sizeof(dma_pagetable_entry);
+for (i = 0; i  entries; i++) {
+rc4030_dma_as_update_one(s, i, dma_tl_contents[i].frame);
+}
+memory_region_add_subregion(get_system_memory(), new_tl_base,
+s-dma_tt_alias);
+memory_region_transaction_commit();
+} else {
+memory_region_init(s-dma_tt_alias, NULL,
+

[Qemu-devel] [RFC 8/9] iotests: 124 - transactional failure test

[Stefan Hajnoczi]

From: John Snow js...@redhat.com

Use a transaction to request an incremental backup across two drives.
Coerce one of the jobs to fail, and then re-run the transaction.

Verify that no bitmap data was lost due to the partial transaction
failure.

Signed-off-by: John Snow js...@redhat.com
Reviewed-by: Max Reitz mre...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 tests/qemu-iotests/124 | 126 -
 tests/qemu-iotests/124.out |   4 +-
 2 files changed, 127 insertions(+), 3 deletions(-)

diff --git a/tests/qemu-iotests/124 b/tests/qemu-iotests/124
index 2d50594..ea820a0 100644
--- a/tests/qemu-iotests/124
+++ b/tests/qemu-iotests/124
@@ -139,9 +139,12 @@ class TestIncrementalBackup(iotests.QMPTestCase):
 def do_qmp_backup(self, error='Input/output error', **kwargs):
 res = self.vm.qmp('drive-backup', **kwargs)
 self.assert_qmp(res, 'return', {})
+return self.wait_qmp_backup(kwargs['device'], error)
 
+
+def wait_qmp_backup(self, device, error='Input/output error'):
 event = self.vm.event_wait(name=BLOCK_JOB_COMPLETED,
-   match={'data': {'device': 
kwargs['device']}})
+   match={'data': {'device': device}})
 self.assertIsNotNone(event)
 
 try:
@@ -156,6 +159,12 @@ class TestIncrementalBackup(iotests.QMPTestCase):
 return False
 
 
+def wait_qmp_backup_cancelled(self, device):
+event = self.vm.event_wait(name='BLOCK_JOB_CANCELLED',
+   match={'data': {'device': device}})
+self.assertIsNotNone(event)
+
+
 def create_anchor_backup(self, drive=None):
 if drive is None:
 drive = self.drives[-1]
@@ -375,6 +384,121 @@ class TestIncrementalBackup(iotests.QMPTestCase):
 self.check_backups()
 
 
+def test_transaction_failure(self):
+'''Test: Verify backups made from a transaction that partially fails.
+
+Add a second drive with its own unique pattern, and add a bitmap to 
each
+drive. Use blkdebug to interfere with the backup on just one drive and
+attempt to create a coherent incremental backup across both drives.
+
+verify a failure in one but not both, then delete the failed stubs and
+re-run the same transaction.
+
+verify that both incrementals are created successfully.
+'''
+
+# Create a second drive, with pattern:
+drive1 = self.add_node('drive1')
+self.img_create(drive1['file'], drive1['fmt'])
+io_write_patterns(drive1['file'], (('0x14', 0, 512),
+   ('0x5d', '1M', '32k'),
+   ('0xcd', '32M', '124k')))
+
+# Create a blkdebug interface to this img as 'drive1'
+result = self.vm.qmp('blockdev-add', options={
+'id': drive1['id'],
+'driver': drive1['fmt'],
+'file': {
+'driver': 'blkdebug',
+'image': {
+'driver': 'file',
+'filename': drive1['file']
+},
+'set-state': [{
+'event': 'flush_to_disk',
+'state': 1,
+'new_state': 2
+}],
+'inject-error': [{
+'event': 'read_aio',
+'errno': 5,
+'state': 2,
+'immediately': False,
+'once': True
+}],
+}
+})
+self.assert_qmp(result, 'return', {})
+
+# Create bitmaps and full backups for both drives
+drive0 = self.drives[0]
+dr0bm0 = self.add_bitmap('bitmap0', drive0)
+dr1bm0 = self.add_bitmap('bitmap0', drive1)
+self.create_anchor_backup(drive0)
+self.create_anchor_backup(drive1)
+self.assert_no_active_block_jobs()
+self.assertFalse(self.vm.get_qmp_events(wait=False))
+
+# Emulate some writes
+self.hmp_io_writes(drive0['id'], (('0xab', 0, 512),
+  ('0xfe', '16M', '256k'),
+  ('0x64', '32736k', '64k')))
+self.hmp_io_writes(drive1['id'], (('0xba', 0, 512),
+  ('0xef', '16M', '256k'),
+  ('0x46', '32736k', '64k')))
+
+# Create incremental backup targets
+target0 = self.prepare_backup(dr0bm0)
+target1 = self.prepare_backup(dr1bm0)
+
+# Ask for a new incremental backup per-each drive,
+# expecting drive1's backup to fail:
+transaction = [
+transaction_drive_backup(drive0['id'], target0, 
sync='dirty-bitmap',
+ format=drive0['fmt'], mode='existing',
+ bitmap=dr0bm0.name),
+ 

[Qemu-devel] [RFC 1/9] qapi: Add transaction support to block-dirty-bitmap operations

[Stefan Hajnoczi]

From: John Snow js...@redhat.com

This adds two qmp commands to transactions.

block-dirty-bitmap-add allows you to create a bitmap simultaneously
alongside a new full backup to accomplish a clean synchronization
point.

block-dirty-bitmap-clear allows you to reset a bitmap back to as-if
it were new, which can also be used alongside a full backup to
accomplish a clean synchronization point.

Signed-off-by: Fam Zheng f...@redhat.com
Signed-off-by: John Snow js...@redhat.com
Reviewed-by: Max Reitz mre...@redhat.com
Reviewed-by: Stefan Hajnoczi stefa...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 block.c   |  19 +++-
 blockdev.c| 114 +-
 docs/bitmaps.md   |   6 +--
 include/block/block.h |   1 -
 include/block/block_int.h |   3 ++
 qapi-schema.json  |   6 ++-
 6 files changed, 139 insertions(+), 10 deletions(-)

diff --git a/block.c b/block.c
index 2b9ceae..a481654 100644
--- a/block.c
+++ b/block.c
@@ -3329,10 +3329,25 @@ void bdrv_reset_dirty_bitmap(BdrvDirtyBitmap *bitmap,
 hbitmap_reset(bitmap-bitmap, cur_sector, nr_sectors);
 }
 
-void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap)
+void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap **out)
 {
 assert(bdrv_dirty_bitmap_enabled(bitmap));
-hbitmap_reset(bitmap-bitmap, 0, bitmap-size);
+if (!out) {
+hbitmap_reset(bitmap-bitmap, 0, bitmap-size);
+} else {
+HBitmap *backup = bitmap-bitmap;
+bitmap-bitmap = hbitmap_alloc(bitmap-size,
+   hbitmap_granularity(backup));
+*out = backup;
+}
+}
+
+void bdrv_undo_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap *in)
+{
+HBitmap *tmp = bitmap-bitmap;
+assert(bdrv_dirty_bitmap_enabled(bitmap));
+bitmap-bitmap = in;
+hbitmap_free(tmp);
 }
 
 void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector,
diff --git a/blockdev.c b/blockdev.c
index de94a8b..cc91270 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1694,6 +1694,106 @@ static void blockdev_backup_clean(BlkTransactionState 
*common)
 }
 }
 
+typedef struct BlockDirtyBitmapState {
+BlkTransactionState common;
+BdrvDirtyBitmap *bitmap;
+BlockDriverState *bs;
+AioContext *aio_context;
+HBitmap *backup;
+bool prepared;
+} BlockDirtyBitmapState;
+
+static void block_dirty_bitmap_add_prepare(BlkTransactionState *common,
+   Error **errp)
+{
+Error *local_err = NULL;
+BlockDirtyBitmapAdd *action;
+BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
+ common, common);
+
+action = common-action-block_dirty_bitmap_add;
+/* AIO context taken and released within qmp_block_dirty_bitmap_add */
+qmp_block_dirty_bitmap_add(action-node, action-name,
+   action-has_granularity, action-granularity,
+   local_err);
+
+if (!local_err) {
+state-prepared = true;
+} else {
+error_propagate(errp, local_err);
+}
+}
+
+static void block_dirty_bitmap_add_abort(BlkTransactionState *common)
+{
+BlockDirtyBitmapAdd *action;
+BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
+ common, common);
+
+action = common-action-block_dirty_bitmap_add;
+/* Should not be able to fail: IF the bitmap was added via .prepare(),
+ * then the node reference and bitmap name must have been valid.
+ */
+if (state-prepared) {
+qmp_block_dirty_bitmap_remove(action-node, action-name, 
error_abort);
+}
+}
+
+static void block_dirty_bitmap_clear_prepare(BlkTransactionState *common,
+ Error **errp)
+{
+BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
+ common, common);
+BlockDirtyBitmap *action;
+
+action = common-action-block_dirty_bitmap_clear;
+state-bitmap = block_dirty_bitmap_lookup(action-node,
+  action-name,
+  state-bs,
+  state-aio_context,
+  errp);
+if (!state-bitmap) {
+return;
+}
+
+if (bdrv_dirty_bitmap_frozen(state-bitmap)) {
+error_setg(errp, Cannot modify a frozen bitmap);
+return;
+} else if (!bdrv_dirty_bitmap_enabled(state-bitmap)) {
+error_setg(errp, Cannot clear a disabled bitmap);
+return;
+}
+
+bdrv_clear_dirty_bitmap(state-bitmap, state-backup);
+/* AioContext is released in .clean() */
+}
+
+static void block_dirty_bitmap_clear_abort(BlkTransactionState *common)
+{
+BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
+ 

[Qemu-devel] [RFC 9/9] qmp-commands.hx: Update the supported 'transaction' operations

[Stefan Hajnoczi]

From: Kashyap Chamarthy kcham...@redhat.com

Although the canonical source of reference for QMP commands is
qapi-schema.json, for consistency's sake, update qmp-commands.hx to
state the list of supported transactionable operations, namely:

drive-backup
blockdev-backup
blockdev-snapshot-internal-sync
abort
block-dirty-bitmap-add
block-dirty-bitmap-clear

Signed-off-by: Kashyap Chamarthy kcham...@redhat.com
Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Max Reitz mre...@redhat.com
Signed-off-by: John Snow js...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 qmp-commands.hx | 21 -
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/qmp-commands.hx b/qmp-commands.hx
index 867a21f..cdab36c 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -1238,11 +1238,22 @@ SQMP
 transaction
 ---
 
-Atomically operate on one or more block devices.  The only supported operations
-for now are drive-backup, internal and external snapshotting.  A list of
-dictionaries is accepted, that contains the actions to be performed.
-If there is any failure performing any of the operations, all operations
-for the group are abandoned.
+Atomically operate on one or more block devices.  Operations that are
+currently supported:
+
+- drive-backup
+- blockdev-backup
+- blockdev-snapshot-sync
+- blockdev-snapshot-internal-sync
+- abort
+- block-dirty-bitmap-add
+- block-dirty-bitmap-clear
+
+Refer to the qemu/qapi-schema.json file for minimum required QEMU
+versions for these operations.  A list of dictionaries is accepted,
+that contains the actions to be performed.  If there is any failure
+performing any of the operations, all operations for the group are
+abandoned.
 
 For external snapshots, the dictionary contains the device, the file to use for
 the new snapshot, and the format.  The default format, if not specified, is
-- 
2.4.2

Re: [Qemu-devel] [PATCH v3 2/2] vhost user: Add RARP injection for legacy guest

[Thibaut Collet]

If I correctly understand how vhost user / virtio works the solution
proposed by Michael is OK:
 - Rings to exchange data between host and guest are allocated by the guest.
 - As soon as the guest add rings in a queue (for RX or TX) a kick is
done on the eventfd associated to the queue
 - On a live migration (as for a first startup), the guest virtio-net
pre-allocates rings for each queue and so send a kick on the eventfd
(for RX and TX)

So even if the guest is only doing receiving, there is a kick on any
queues. -- Vhost-user backend knows when send the rarp in any
conditions without involving QEMU.

Michael, could you confirm that my analysis is correct?

On Fri, Jun 12, 2015 at 9:55 AM, Jason Wang jasow...@redhat.com wrote:


 On 06/11/2015 08:13 PM, Michael S. Tsirkin wrote:
 On Thu, Jun 11, 2015 at 02:10:48PM +0200, Thibaut Collet wrote:
 I am not sure to understand your remark:

 It needs to be sent when backend is activated by guest kick
 (in case of virtio 1, it's possible to use DRIVER_OK for this).
 This does not happen when VM still runs on source.
 Could you confirm rarp can be sent by backend when the
 VHOST_USER_SET_VRING_KICK message is received by the backend ?
 No - the time to send pakets is when you start processing
 the rings.

 And the time to do that is when you detect a kick on
 an eventfd, not when said fd is set.


 Probably not. What if guest is only doing receiving? In this case, you
 won't detect any kick if you don't send the rarp first.

[Qemu-devel] [PATCH 07/12] qapi: qapi for audio backends

[Kővágó, Zoltán]

This patch adds structures into qapi to replace the existing configuration
structures used by audio backends currently. This qapi will be the base of the
-audiodev command line parameter (that replaces the old environment variables
based config).

This is not a 1:1 translation of the old options, I've tried to make them much
more consistent (e.g. almost every backend had an option to specify buffer size,
but the name was different for every backend, and some backends required usecs,
while some other required frames, samples or bytes). Also tried to reduce the
number of abbreviations used by the config keys.

Some of the more important changes:
* use `in` and `out` instead of `ADC` and `DAC`, as the former is more user
  friendly imho
* moved buffer settings into the global setting area (so it's the same for all
  backends that support it. Backends that can't change buffer size will simply
  ignore them). Also using usecs, as it's probably more user friendly than
  samples or bytes.
* try-poll is now an alsa and oss backend specific option (as all other backends
  currently ignore it)

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com

---

Changes from v2 RFC patch:
* in, out are no longer optional
* try-poll: moved to alsa and oss (as no other backend used them)
* voices: added (env variables had this option)
* dsound: removed primary buffer related fields

Changes from v1 RFC patch:
* fixed style issues
* moved definitions into a separate file
* documented undocumented options (hopefully)
* removed plive option. It was useless even years ago so it can probably safely
  go away: 
https://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg02427.html
* removed verbose, debug options. Backends should use trace events instead.
* removed *_retries options from dsound. It's a kludge.
* moved buffer_usecs and buffer_count to the global config options. Some driver
  might ignore it (as they do not expose API to change them).
* wav backend: removed frequecy, format, channels as AudiodevPerDirectionOptions
  already have them.

 Makefile |   4 +-
 qapi-schema.json |   3 +
 qapi/audio.json  | 217 +++
 3 files changed, 222 insertions(+), 2 deletions(-)
 create mode 100644 qapi/audio.json

diff --git a/Makefile b/Makefile
index 2d52536..982563e 100644
--- a/Makefile
+++ b/Makefile
@@ -257,8 +257,8 @@ $(SRC_PATH)/qga/qapi-schema.json 
$(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
  GEN   $@)
 
 qapi-modules = $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/qapi/common.json \
-   $(SRC_PATH)/qapi/block.json $(SRC_PATH)/qapi/block-core.json \
-   $(SRC_PATH)/qapi/event.json
+   $(SRC_PATH)/qapi/audio.json  $(SRC_PATH)/qapi/block.json \
+   $(SRC_PATH)/qapi/block-core.json $(SRC_PATH)/qapi/event.json
 
 qapi-types.c qapi-types.h :\
 $(qapi-modules) $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
diff --git a/qapi-schema.json b/qapi-schema.json
index 6e17a5c..26c470a 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -5,6 +5,9 @@
 # QAPI common definitions
 { 'include': 'qapi/common.json' }
 
+# QAPI audio definitions
+{ 'include': 'qapi/audio.json' }
+
 # QAPI block definitions
 { 'include': 'qapi/block.json' }
 
diff --git a/qapi/audio.json b/qapi/audio.json
new file mode 100644
index 000..157ccf6
--- /dev/null
+++ b/qapi/audio.json
@@ -0,0 +1,217 @@
+# -*- mode: python -*-
+
+##
+# @AudiodevNoneOptions
+#
+# The none, coreaudio, sdl and spice audio backend has no options.
+#
+# Since: 2.4
+##
+{ 'struct': 'AudiodevNoneOptions',
+  'data': { } }
+
+##
+# @AudiodevAlsaPerDirectionOptions
+#
+# Options of the alsa backend that are used for both playback and recording.
+#
+# @dev: #optional the name of the alsa device to use
+#
+# @try-poll: #optional attempt to use poll mode
+#
+# Since: 2.4
+##
+{ 'struct': 'AudiodevAlsaPerDirectionOptions',
+  'data': {
+'*dev':  'str',
+'*try-poll': 'bool' } }
+
+##
+# @AudiodevAlsaOptions
+#
+# Options of the alsa audio backend.
+#
+# @in: #optional options of the capture stream
+#
+# @out: #optional options of the playback stream
+#
+# @threshold: #optional set the threshold (in frames) when playback starts
+#
+# Since: 2.4
+##
+{ 'struct': 'AudiodevAlsaOptions',
+  'data': {
+'in': 'AudiodevAlsaPerDirectionOptions',
+'out':'AudiodevAlsaPerDirectionOptions',
+'*threshold': 'int' } }
+
+##
+# @AudiodevDsoundOptions
+#
+# Options of the dsound audio backend.
+#
+# @latency-millis: #optional add extra latency to playback
+#
+# Since: 2.4
+##
+{ 'struct': 'AudiodevDsoundOptions',
+  'data': {
+'*latency-millis': 'int' } }
+
+##
+# @AudiodevOssPerDirectionOptions
+#
+# Options of the oss backend that are used for both playback and recording.
+#
+# @dev: #optional path of the oss device
+#
+# @try-poll: #optional attempt to use poll mode
+#
+# Since: 2.4
+##
+{ 'struct': 'AudiodevOssPerDirectionOptions',
+  'data': {
+  

[Qemu-devel] [PATCH 10/12] qapi: AllocVisitor

[Kővágó, Zoltán]

Simple visitor that recursively allocates structures with only optional
variables. Unions are initialized to the first type specified. Other non
optional types are not supported.

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com
---
 include/qapi/alloc-visitor.h | 18 +
 qapi/Makefile.objs   |  1 +
 qapi/alloc-visitor.c | 62 
 3 files changed, 81 insertions(+)
 create mode 100644 include/qapi/alloc-visitor.h
 create mode 100644 qapi/alloc-visitor.c

diff --git a/include/qapi/alloc-visitor.h b/include/qapi/alloc-visitor.h
new file mode 100644
index 000..3d54295
--- /dev/null
+++ b/include/qapi/alloc-visitor.h
@@ -0,0 +1,18 @@
+/*
+ * Alloc Visitor.
+ * Recursively allocates structs, leaving all optional fields unset. In case of
+ * a non-optional field it fails.
+ */
+
+#ifndef ALLOC_VISITOR_H
+#define ALLOC_VISITOR_H
+
+#include qapi/visitor.h
+
+typedef struct AllocVisitor AllocVisitor;
+
+AllocVisitor *alloc_visitor_new(void);
+void alloc_visitor_cleanup(AllocVisitor *v);
+Visitor *alloc_visitor_get_visitor(AllocVisitor *v);
+
+#endif
diff --git a/qapi/Makefile.objs b/qapi/Makefile.objs
index 2278970..7bc26a3 100644
--- a/qapi/Makefile.objs
+++ b/qapi/Makefile.objs
@@ -4,3 +4,4 @@ util-obj-y += string-input-visitor.o string-output-visitor.o
 util-obj-y += opts-visitor.o
 util-obj-y += qmp-event.o
 util-obj-y += qapi-util.o
+util-obj-y += alloc-visitor.o
diff --git a/qapi/alloc-visitor.c b/qapi/alloc-visitor.c
new file mode 100644
index 000..dbb83af
--- /dev/null
+++ b/qapi/alloc-visitor.c
@@ -0,0 +1,62 @@
+#include qapi/alloc-visitor.h
+#include qemu-common.h
+#include qapi/visitor-impl.h
+
+struct AllocVisitor {
+Visitor visitor;
+};
+
+static void alloc_start_struct(Visitor *v, void **obj, const char* kind,
+   const char *name, size_t size, Error **errp)
+{
+if (obj) {
+*obj = g_malloc0(size);
+}
+}
+
+static void alloc_end_struct(Visitor *v, Error **errp)
+{
+}
+
+static void alloc_start_implicit_struct(Visitor *v, void **obj, size_t size,
+Error **errp)
+{
+if (obj) {
+*obj = g_malloc0(size);
+}
+}
+
+static void alloc_end_implicit_struct(Visitor *v, Error **errp)
+{
+}
+
+static void alloc_type_enum(Visitor *v, int *obj, const char *strings[],
+const char *kind, const char *name, Error **errp)
+{
+assert(*strings); /* there is at least one valid enum value... */
+*obj = 0;
+}
+
+AllocVisitor *alloc_visitor_new(void)
+{
+AllocVisitor *v = g_malloc0(sizeof(AllocVisitor));
+
+v-visitor.start_struct = alloc_start_struct;
+v-visitor.end_struct = alloc_end_struct;
+v-visitor.start_implicit_struct = alloc_start_implicit_struct;
+v-visitor.end_implicit_struct = alloc_end_implicit_struct;
+
+v-visitor.type_enum = alloc_type_enum;
+
+return v;
+}
+
+void alloc_visitor_cleanup(AllocVisitor *v)
+{
+g_free(v);
+}
+
+Visitor *alloc_visitor_get_visitor(AllocVisitor *v)
+{
+return v-visitor;
+}
-- 
2.4.2

[Qemu-devel] [PATCH 11/12] audio: use qapi AudioFormat instead of audfmt_e

[Kővágó, Zoltán]

I had to include an enum for audio sampling formats into qapi, but that meant
duplicating the audfmt_e enum. This patch replaces audfmt_e and associated
values with the qapi generated AudioFormat enum.

This patch is mostly a search-and-replace, except for switches where the qapi
generated AUDIO_FORMAT_MAX caused problems.

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com
---
 audio/alsaaudio.c | 53 ++
 audio/audio.c | 97 ++-
 audio/audio.h | 11 +-
 audio/audio_win_int.c | 18 -
 audio/ossaudio.c  | 30 +++
 audio/paaudio.c   | 28 +++---
 audio/sdlaudio.c  | 26 ++---
 audio/spiceaudio.c|  4 +-
 audio/wavaudio.c  | 17 +
 audio/wavcapture.c|  2 +-
 hw/arm/omap2.c|  2 +-
 hw/audio/ac97.c   |  2 +-
 hw/audio/adlib.c  |  2 +-
 hw/audio/cs4231a.c|  6 +--
 hw/audio/es1370.c |  4 +-
 hw/audio/gus.c|  2 +-
 hw/audio/hda-codec.c  | 18 -
 hw/audio/lm4549.c |  6 +--
 hw/audio/milkymist-ac97.c |  2 +-
 hw/audio/pcspk.c  |  2 +-
 hw/audio/sb16.c   | 14 +++
 hw/audio/wm8750.c |  4 +-
 hw/input/tsc210x.c|  2 +-
 hw/usb/dev-audio.c|  2 +-
 ui/vnc.c  | 14 +++
 25 files changed, 187 insertions(+), 181 deletions(-)

diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index b0a451a..6882638 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -88,7 +88,7 @@ struct alsa_params_req {
 
 struct alsa_params_obt {
 int freq;
-audfmt_e fmt;
+AudioFormat fmt;
 int endianness;
 int nchannels;
 snd_pcm_uframes_t samples;
@@ -307,16 +307,16 @@ static int alsa_write (SWVoiceOut *sw, void *buf, int len)
 return audio_pcm_sw_write (sw, buf, len);
 }
 
-static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int endianness)
+static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
 {
 switch (fmt) {
-case AUD_FMT_S8:
+case AUDIO_FORMAT_S8:
 return SND_PCM_FORMAT_S8;
 
-case AUD_FMT_U8:
+case AUDIO_FORMAT_U8:
 return SND_PCM_FORMAT_U8;
 
-case AUD_FMT_S16:
+case AUDIO_FORMAT_S16:
 if (endianness) {
 return SND_PCM_FORMAT_S16_BE;
 }
@@ -324,7 +324,7 @@ static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int 
endianness)
 return SND_PCM_FORMAT_S16_LE;
 }
 
-case AUD_FMT_U16:
+case AUDIO_FORMAT_U16:
 if (endianness) {
 return SND_PCM_FORMAT_U16_BE;
 }
@@ -332,7 +332,7 @@ static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int 
endianness)
 return SND_PCM_FORMAT_U16_LE;
 }
 
-case AUD_FMT_S32:
+case AUDIO_FORMAT_S32:
 if (endianness) {
 return SND_PCM_FORMAT_S32_BE;
 }
@@ -340,7 +340,7 @@ static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int 
endianness)
 return SND_PCM_FORMAT_S32_LE;
 }
 
-case AUD_FMT_U32:
+case AUDIO_FORMAT_U32:
 if (endianness) {
 return SND_PCM_FORMAT_U32_BE;
 }
@@ -357,58 +357,58 @@ static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int 
endianness)
 }
 }
 
-static int alsa_to_audfmt (snd_pcm_format_t alsafmt, audfmt_e *fmt,
+static int alsa_to_audfmt (snd_pcm_format_t alsafmt, AudioFormat *fmt,
int *endianness)
 {
 switch (alsafmt) {
 case SND_PCM_FORMAT_S8:
 *endianness = 0;
-*fmt = AUD_FMT_S8;
+*fmt = AUDIO_FORMAT_S8;
 break;
 
 case SND_PCM_FORMAT_U8:
 *endianness = 0;
-*fmt = AUD_FMT_U8;
+*fmt = AUDIO_FORMAT_U8;
 break;
 
 case SND_PCM_FORMAT_S16_LE:
 *endianness = 0;
-*fmt = AUD_FMT_S16;
+*fmt = AUDIO_FORMAT_S16;
 break;
 
 case SND_PCM_FORMAT_U16_LE:
 *endianness = 0;
-*fmt = AUD_FMT_U16;
+*fmt = AUDIO_FORMAT_U16;
 break;
 
 case SND_PCM_FORMAT_S16_BE:
 *endianness = 1;
-*fmt = AUD_FMT_S16;
+*fmt = AUDIO_FORMAT_S16;
 break;
 
 case SND_PCM_FORMAT_U16_BE:
 *endianness = 1;
-*fmt = AUD_FMT_U16;
+*fmt = AUDIO_FORMAT_U16;
 break;
 
 case SND_PCM_FORMAT_S32_LE:
 *endianness = 0;
-*fmt = AUD_FMT_S32;
+*fmt = AUDIO_FORMAT_S32;
 break;
 
 case SND_PCM_FORMAT_U32_LE:
 *endianness = 0;
-*fmt = AUD_FMT_U32;
+*fmt = AUDIO_FORMAT_U32;
 break;
 
 case SND_PCM_FORMAT_S32_BE:
 *endianness = 1;
-*fmt = AUD_FMT_S32;
+*fmt = AUDIO_FORMAT_S32;
 break;
 
 case SND_PCM_FORMAT_U32_BE:
 *endianness = 1;
-*fmt = AUD_FMT_U32;
+*fmt = AUDIO_FORMAT_U32;
 break;
 
 default:
@@ -651,19 +651,22 @@ static int alsa_open (int in, 

[Qemu-devel] [PULL 00/16] Net patches

[Stefan Hajnoczi]

The following changes since commit d8e3b729cf452d2689c8669f1ec18158db29fd5a:

  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging 
(2015-06-11 15:33:38 +0100)

are available in the git repository at:

  git://github.com/stefanha/qemu.git tags/net-pull-request

for you to fetch changes up to fafa4d508b42a70a59a6bd647a2c0cfad86246c3:

  qmp/hmp: add rocker device support (2015-06-12 13:42:17 +0100)





David Ahern (1):
  rocker: Add support for phys name

Fam Zheng (12):
  stubs: Add qemu_set_fd_handler
  l2tpv3: Drop l2tpv3_can_send
  netmap: Drop netmap_can_send
  net/socket: Drop net_socket_can_send
  tap: Drop tap_can_send
  Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler
  main-loop: Drop qemu_set_fd_handler2
  alsaaudio: Remove unused error handling of qemu_set_fd_handler
  oss: Remove unused error handling of qemu_set_fd_handler
  xen_backend: Remove unused error handling of qemu_set_fd_handler
  event-notifier: Always return 0 for posix implementation
  iohandler: Change return type of qemu_set_fd_handler to void

Scott Feldman (3):
  rocker: update tests using hw-derived interface names
  rocker: bring link up/down on PHY enable/disable
  qmp/hmp: add rocker device support

 audio/alsaaudio.c |  16 +--
 audio/ossaudio.c  |  14 +-
 blockdev-nbd.c|   4 +-
 docs/specs/rocker.txt |   1 +
 hmp-commands.hx   |  24 
 hmp.c | 303 
 hmp.h |   4 +
 hw/net/Makefile.objs  |   1 +
 hw/net/rocker/qmp-norocker.c  |  50 +++
 hw/net/rocker/rocker.c|  68 -
 hw/net/rocker/rocker_fp.c |  29 +++-
 hw/net/rocker/rocker_fp.h |   2 +
 hw/net/rocker/rocker_hw.h |   1 +
 hw/net/rocker/rocker_of_dpa.c | 312 ++
 hw/xen/xen_backend.c  |   4 +-
 include/block/aio.h   |   2 +-
 include/qemu/main-loop.h  |  57 +---
 iohandler.c   |  21 +--
 main-loop.c   |   3 +-
 migration/exec.c  |   6 +-
 migration/fd.c|   4 +-
 migration/rdma.c  |   7 +-
 migration/tcp.c   |   6 +-
 migration/unix.c  |   6 +-
 monitor.c |  28 
 net/l2tpv3.c  |  17 +--
 net/netmap.c  |  20 +--
 net/socket.c  |  37 +++--
 net/tap.c |  19 +--
 qapi-schema.json  |   3 +
 qapi/rocker.json  | 286 ++
 qmp-commands.hx   | 103 ++
 stubs/set-fd-handler.c|   3 +-
 tests/rocker/bridge   |  25 ++--
 tests/rocker/bridge-stp   |  25 ++--
 tests/rocker/bridge-vlan  |  37 +++--
 tests/rocker/bridge-vlan-stp  |  37 +++--
 tests/rocker/port |   8 +-
 ui/vnc-auth-sasl.c|   2 +-
 ui/vnc-auth-vencrypt.c|   2 +-
 ui/vnc-ws.c   |   6 +-
 ui/vnc.c  |  27 ++--
 util/event_notifier-posix.c   |   3 +-
 util/qemu-sockets.c   |   8 +-
 44 files changed, 1364 insertions(+), 277 deletions(-)
 create mode 100644 hw/net/rocker/qmp-norocker.c
 create mode 100644 qapi/rocker.json

-- 
2.4.2

Re: [Qemu-devel] [Bug 1464611] [NEW] 4 * redundant conditions

[Eric Blake]

On 06/12/2015 05:01 AM, Peter Maydell wrote:

 4.

 [qemu/target-arm/translate-a64.c:5729]: (style) Redundant condition:
 size3. 'A  (!A || B)' is equivalent to 'A || B'

   if (size  3
 || (size  3  is_q)
 || (size == 3  !is_q)) {
 
 ...but I'm less sure about this one. I'm not even sure
 what it's trying to suggest this should simplify to:
 just dropping size  3 is obviously wrong, and the
 condition format isn't A  (!A || B) either.

Let's break it down into the 6 possibilities based on the binary *
ternary conditions being checked:

 3, is_q   = accept
 3, !is_q  = accept
== 3, is_q  = reject
== 3, !is_q = accept
 3, is_q   = accept
 3, !is_q  = reject

Here's a shorter conditional with the same properties, but it's gross:

if (size  3 || (is_q != (size == 3))) {

Too much mental thought to prove it accepts the same set of conditions.

-- 
Eric Blake   eblake redhat com+1-919-301-3266
Libvirt virtualization library http://libvirt.org



signature.asc
Description: OpenPGP digital signature

Re: [Qemu-devel] [Bug 1464611] [NEW] 4 * redundant conditions

[Peter Maydell]

On 12 June 2015 at 14:03, Eric Blake ebl...@redhat.com wrote:
 On 06/12/2015 05:01 AM, Peter Maydell wrote:

 4.

 [qemu/target-arm/translate-a64.c:5729]: (style) Redundant condition:
 size3. 'A  (!A || B)' is equivalent to 'A || B'

   if (size  3
 || (size  3  is_q)
 || (size == 3  !is_q)) {

 ...but I'm less sure about this one. I'm not even sure
 what it's trying to suggest this should simplify to:
 just dropping size  3 is obviously wrong, and the
 condition format isn't A  (!A || B) either.

 Let's break it down into the 6 possibilities based on the binary *
 ternary conditions being checked:

 3, is_q   = accept
 3, !is_q  = accept
 == 3, is_q  = reject
 == 3, !is_q = accept
  3, is_q   = accept
  3, !is_q  = reject

 Here's a shorter conditional with the same properties, but it's gross:

 if (size  3 || (is_q != (size == 3))) {

 Too much mental thought to prove it accepts the same set of conditions.

Yeah, I think this is the kind of thing where I say the compiler
should do this simplification if it cares enough :-)

-- PMM

Re: [Qemu-devel] [PATCH v2] linux-user: ioctl() command type is int

[Riku Voipio]

On Saturday, May 23, 2015 4:17:05 PM EEST, Laurent Vivier wrote:

When executing a 64bit target chroot on 64bit host,
the ioctl() command can mismatch.

It seems the previous commit doesn't solve the problem in
my case:

9c6bf9c7 linux-user: Fix ioctl cmd type mismatch on 64-bit targets

For example, a ppc64 chroot on an x86_64 host:

bash-4.3# ls
Unsupported ioctl: cmd=0x80087467
Unsupported ioctl: cmd=0x802c7415

The origin of the problem is in syscall.c:do_ioctl().

static abi_long do_ioctl(int fd, abi_long cmd, abi_long arg)

In this case (ppc64) abi_long is long (on the x86_64), and

cmd = 0x80087467

then
if (ie-target_cmd == cmd)

target_cmd is int, so target_cmd = 0x80087467
and to compare an int with a long, the sign is extended to 64bit,
so the comparison is:

if (0x80087467 == 0x80087467)

which doesn't match whereas it should.

This patch uses int in the case of the target command type
instead of abi_long (and for consistency, update IOCTLEntry).

Signed-off-by: Laurent Vivier laur...@vivier.eu


Applied to linux-user que,

Thanks


---
v2: use int instead of abi_int, as it is recommended by Peter Maydell.

 linux-user/syscall.c | 18 +-
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 1622ad6..c28cd05 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3290,11 +3290,11 @@ enum {
 typedef struct IOCTLEntry IOCTLEntry;
 
 typedef abi_long do_ioctl_fn(const IOCTLEntry *ie, uint8_t *buf_temp,

- int fd, abi_long cmd, abi_long arg);
+ int fd, int cmd, abi_long arg);
 
 struct IOCTLEntry {

 int target_cmd;
-unsigned int host_cmd;
+int host_cmd;
 const char *name;
 int access;
 do_ioctl_fn *do_ioctl;
@@ -3316,7 +3316,7 @@ struct IOCTLEntry {
 / sizeof(struct fiemap_extent))
 
 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, 
uint8_t *buf_temp,

-   int fd, abi_long cmd, abi_long arg)
+   int fd, int cmd, abi_long arg)
 {
 /* The parameter for this ioctl is a struct fiemap followed
  * by an array of struct fiemap_extent whose size is set
@@ -3397,7 +3397,7 @@ static abi_long 
do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,

 #endif
 
 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,

-int fd, abi_long cmd, abi_long arg)
+int fd, int cmd, abi_long arg)
 {
 const argtype *arg_type = ie-arg_type;
 int target_size;
@@ -3491,7 +3491,7 @@ static abi_long do_ioctl_ifconf(const 
IOCTLEntry *ie, uint8_t *buf_temp,

 }
 
 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t 
*buf_temp, int fd,

-abi_long cmd, abi_long arg)
+int cmd, abi_long arg)
 {
 void *argptr;
 struct dm_ioctl *host_dm;
@@ -3716,7 +3716,7 @@ out:
 }
 
 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t 
*buf_temp, int fd,

-   abi_long cmd, abi_long arg)
+   int cmd, abi_long arg)
 {
 void *argptr;
 int target_size;
@@ -3769,7 +3769,7 @@ out:
 }
 
 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,

-int fd, abi_long cmd, abi_long arg)
+int fd, int cmd, abi_long arg)
 {
 const argtype *arg_type = ie-arg_type;
 const StructEntry *se;
@@ -3832,7 +3832,7 @@ static abi_long do_ioctl_rt(const 
IOCTLEntry *ie, uint8_t *buf_temp,

 }
 
 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, 
uint8_t *buf_temp,

- int fd, abi_long cmd, abi_long arg)
+ int fd, int cmd, abi_long arg)
 {
 int sig = target_to_host_signal(arg);
 return get_errno(ioctl(fd, ie-host_cmd, sig));
@@ -3849,7 +3849,7 @@ static IOCTLEntry ioctl_entries[] = {
 
 /* ??? Implement proper locking for ioctls.  */

 /* do_ioctl() Must return target values and target errnos. */
-static abi_long do_ioctl(int fd, abi_long cmd, abi_long arg)
+static abi_long do_ioctl(int fd, int cmd, abi_long arg)
 {
 const IOCTLEntry *ie;
 const argtype *arg_type;

Re: [Qemu-devel] [PATCH 0/2] sh4 linux-user cpu and hwcap

[Riku Voipio]

On Thursday, June 4, 2015 10:55:12 PM EEST, Aurelien Jarno wrote:

On 2015-06-02 21:50, Richard Henderson wrote:

On 05/24/2015 03:51 PM, Aurelien Jarno wrote: ...



I have added them in my sh4-next branch [1], they will be in the next
pull request.



[1] http://git.aurel32.net/?p=qemu.git;a=shortlog;h=refs/heads/sh4-next


A bit late, but I'm ok for merging these patches via sh4 tree. If you still 
going to edit branch, you can add my


Acked-by: Riku Voipio riku.voi...@linaro.org

Riku

[Qemu-devel] [RFC 5/9] block: add block job transactions

[Stefan Hajnoczi]

Sometimes block jobs must execute as a transaction group.  Finishing
jobs wait until all other jobs are ready to complete successfully.
Failure or cancellation of one job cancels the other jobs in the group.

Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 blockjob.c| 160 ++
 include/block/block.h |   1 +
 include/block/block_int.h |   3 +-
 include/block/blockjob.h  |  49 ++
 trace-events  |   4 ++
 5 files changed, 216 insertions(+), 1 deletion(-)

diff --git a/blockjob.c b/blockjob.c
index 2755465..ff622f5 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -399,3 +399,163 @@ void block_job_defer_to_main_loop(BlockJob *job,
 
 qemu_bh_schedule(data-bh);
 }
+
+/* Transactional group of block jobs */
+struct BlockJobTxn {
+/* Jobs may be in different AioContexts so protect all fields */
+QemuMutex lock;
+
+/* Reference count for txn object */
+unsigned int ref;
+
+/* Is this txn cancelling its jobs? */
+bool aborting;
+
+/* Number of jobs still running */
+unsigned int jobs_pending;
+
+/* List of jobs */
+QLIST_HEAD(, BlockJob) jobs;
+};
+
+BlockJobTxn *block_job_txn_new(void)
+{
+BlockJobTxn *txn = g_new(BlockJobTxn, 1);
+qemu_mutex_init(txn-lock);
+txn-ref = 1; /* dropped by block_job_txn_begin() */
+txn-aborting = false;
+txn-jobs_pending = 0;
+QLIST_INIT(txn-jobs);
+return txn;
+}
+
+static void block_job_txn_unref(BlockJobTxn *txn)
+{
+qemu_mutex_lock(txn-lock);
+
+if (--txn-ref  0) {
+qemu_mutex_unlock(txn-lock);
+return;
+}
+
+qemu_mutex_unlock(txn-lock);
+qemu_mutex_destroy(txn-lock);
+g_free(txn);
+}
+
+/* The purpose of this is to keep txn alive until all jobs have been added */
+void block_job_txn_begin(BlockJobTxn *txn)
+{
+block_job_txn_unref(txn);
+}
+
+void block_job_txn_add_job(BlockJobTxn *txn, BlockJob *job)
+{
+if (!txn) {
+return;
+}
+
+assert(!job-txn);
+job-txn = txn;
+
+qemu_mutex_lock(txn-lock);
+txn-ref++;
+txn-jobs_pending++;
+QLIST_INSERT_HEAD(txn-jobs, job, txn_list);
+qemu_mutex_unlock(txn-lock);
+}
+
+/* Cancel all other jobs in case of abort, wake all waiting jobs in case of
+ * successful completion.  Runs from main loop.
+ */
+static void block_job_txn_complete(BlockJob *job, void *opaque)
+{
+BlockJobTxn *txn = opaque;
+BlockJob *other_job;
+bool aborting = txn-aborting;
+
+qemu_mutex_lock(txn-lock);
+txn-ref++; /* keep txn alive until the end of this loop */
+
+QLIST_FOREACH(other_job, txn-jobs, txn_list) {
+AioContext *ctx;
+
+qemu_mutex_unlock(txn-lock);
+ctx = bdrv_get_aio_context(other_job-bs);
+aio_context_acquire(ctx);
+
+/* Cancel all other jobs if aborting.  Don't cancel our own failed job
+ * since cancellation throws away the error value.
+ */
+if (aborting  other_job != job) {
+block_job_cancel(other_job);
+} else {
+block_job_enter(other_job);
+}
+
+aio_context_release(ctx);
+qemu_mutex_lock(txn-lock);
+}
+
+qemu_mutex_unlock(txn-lock);
+block_job_txn_unref(txn);
+}
+
+void coroutine_fn block_job_txn_prepare_to_complete(BlockJobTxn *txn,
+BlockJob *job,
+int ret)
+{
+if (!txn) {
+return;
+}
+
+qemu_mutex_lock(txn-lock);
+
+/* This function is entered in 3 cases:
+ *
+ * 1. Successful job completion - wait for other jobs
+ * 2. First failed/cancelled job in txn - cancel other jobs and wait
+ * 3. Subsequent cancelled jobs - finish immediately, don't wait
+ */
+trace_block_job_txn_prepare_to_complete_entry(txn, job, ret,
+  block_job_is_cancelled(job),
+  txn-aborting,
+  txn-jobs_pending);
+
+if (txn-aborting) { /* Case 3 */
+assert(block_job_is_cancelled(job));
+goto out; /* already cancelled, don't yield */
+}
+
+if (ret != 0 || block_job_is_cancelled(job)) { /* Case 2 */
+abort:
+txn-aborting = true;
+block_job_defer_to_main_loop(job, block_job_txn_complete, txn);
+} else { /* Case 1 */
+if (--txn-jobs_pending == 0) {
+block_job_defer_to_main_loop(job, block_job_txn_complete, txn);
+}
+}
+
+/* Wait for block_job_txn_complete() */
+do {
+qemu_mutex_unlock(txn-lock);
+job-busy = false;
+qemu_coroutine_yield();
+job-busy = true;
+qemu_mutex_lock(txn-lock);
+
+if (block_job_is_cancelled(job)  !txn-aborting) {
+goto abort; /* this job just got cancelled by the user */
+}
+} while (!txn-aborting  txn-jobs_pending  0);

[Qemu-devel] [RFC 7/9] block/backup: support block job transactions

[Stefan Hajnoczi]

Join the transaction when the backup block job is in incremental backup
mode.

This ensures that the sync bitmap is not thrown away if another block
job in the transaction is cancelled or fails.  This is critical so
incremental backup with multiple disks can be retried in case of
cancellation/failure.

Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 block/backup.c |  7 +-
 blockdev.c | 73 ++
 2 files changed, 59 insertions(+), 21 deletions(-)

diff --git a/block/backup.c b/block/backup.c
index c1ad975..ecc1b00 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -428,6 +428,8 @@ static void coroutine_fn backup_run(void *opaque)
 qemu_co_rwlock_wrlock(job-flush_rwlock);
 qemu_co_rwlock_unlock(job-flush_rwlock);
 
+block_job_txn_prepare_to_complete(job-common.txn, job-common, ret);
+
 if (job-sync_bitmap) {
 BdrvDirtyBitmap *bm;
 if (ret  0 || block_job_is_cancelled(job-common)) {
@@ -456,7 +458,7 @@ void backup_start(BlockDriverState *bs, BlockDriverState 
*target,
   BlockdevOnError on_source_error,
   BlockdevOnError on_target_error,
   BlockCompletionFunc *cb, void *opaque,
-  Error **errp)
+  BlockJobTxn *txn, Error **errp)
 {
 int64_t len;
 
@@ -536,6 +538,9 @@ void backup_start(BlockDriverState *bs, BlockDriverState 
*target,
 job-sync_mode = sync_mode;
 job-sync_bitmap = sync_mode == MIRROR_SYNC_MODE_DIRTY_BITMAP ?
sync_bitmap : NULL;
+if (job-sync_bitmap) {
+block_job_txn_add_job(txn, job-common);
+}
 job-common.len = len;
 job-common.co = qemu_coroutine_create(backup_run);
 qemu_coroutine_enter(job-common.co, job);
diff --git a/blockdev.c b/blockdev.c
index 2cdc7f3..aa46d7c 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1573,6 +1573,18 @@ typedef struct DriveBackupState {
 BlockJob *job;
 } DriveBackupState;
 
+static void do_drive_backup(const char *device, const char *target,
+bool has_format, const char *format,
+enum MirrorSyncMode sync,
+bool has_mode, enum NewImageMode mode,
+bool has_speed, int64_t speed,
+bool has_bitmap, const char *bitmap,
+bool has_on_source_error,
+BlockdevOnError on_source_error,
+bool has_on_target_error,
+BlockdevOnError on_target_error,
+BlockJobTxn *txn, Error **errp);
+
 static void drive_backup_prepare(BlkActionState *common, Error **errp)
 {
 DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
@@ -1595,15 +1607,16 @@ static void drive_backup_prepare(BlkActionState 
*common, Error **errp)
 state-aio_context = bdrv_get_aio_context(bs);
 aio_context_acquire(state-aio_context);
 
-qmp_drive_backup(backup-device, backup-target,
- backup-has_format, backup-format,
- backup-sync,
- backup-has_mode, backup-mode,
- backup-has_speed, backup-speed,
- backup-has_bitmap, backup-bitmap,
- backup-has_on_source_error, backup-on_source_error,
- backup-has_on_target_error, backup-on_target_error,
- local_err);
+do_drive_backup(backup-device, backup-target,
+backup-has_format, backup-format,
+backup-sync,
+backup-has_mode, backup-mode,
+backup-has_speed, backup-speed,
+backup-has_bitmap, backup-bitmap,
+backup-has_on_source_error, backup-on_source_error,
+backup-has_on_target_error, backup-on_target_error,
+common-block_job_txn,
+local_err);
 if (local_err) {
 error_propagate(errp, local_err);
 return;
@@ -2559,15 +2572,17 @@ out:
 aio_context_release(aio_context);
 }
 
-void qmp_drive_backup(const char *device, const char *target,
-  bool has_format, const char *format,
-  enum MirrorSyncMode sync,
-  bool has_mode, enum NewImageMode mode,
-  bool has_speed, int64_t speed,
-  bool has_bitmap, const char *bitmap,
-  bool has_on_source_error, BlockdevOnError 
on_source_error,
-  bool has_on_target_error, BlockdevOnError 
on_target_error,
-  Error **errp)
+static void do_drive_backup(const char *device, const char *target,
+bool has_format, const char *format,
+enum MirrorSyncMode sync,
+bool has_mode, enum NewImageMode mode,
+  

[Qemu-devel] [RFC 4/9] block: keep bitmap if incremental backup job is cancelled

[Stefan Hajnoczi]

Reclaim the dirty bitmap if an incremental backup block job is
cancelled.  The ret variable may be 0 when the job is cancelled so it's
not enough to check ret  0.

Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 block/backup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/backup.c b/block/backup.c
index d3f648d..c1ad975 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -430,7 +430,7 @@ static void coroutine_fn backup_run(void *opaque)
 
 if (job-sync_bitmap) {
 BdrvDirtyBitmap *bm;
-if (ret  0) {
+if (ret  0 || block_job_is_cancelled(job-common)) {
 /* Merge the successor back into the parent, delete nothing. */
 bm = bdrv_reclaim_dirty_bitmap(bs, job-sync_bitmap, NULL);
 assert(bm);
-- 
2.4.2

[Qemu-devel] [PULL 00/11] sh4-next queue

[Aurelien Jarno]

The following changes since commit b0411142f482df92717f8b4a3b746081a62b724f:

  Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150609' into 
staging (2015-06-09 15:29:34 +0100)

are available in the git repository at:

  git://git.aurel32.net/qemu tags/pull-sh4-next-20150612

for you to fetch changes up to d218b28d28b8f4de297bfd35c082b22f153cf0df:

  target-sh4: remove dead code (2015-06-12 12:02:48 +0200)


sh4 linux-user cpu and hwcap
misc optimizations and cleanup
convert r2d to new MMIO accessor style


Aurelien Jarno (9):
  sh4/r2d: convert to new MMIO accessor style
  target-sh4: use bit number for SR constants
  target-sh4: Split out T from SR
  target-sh4: optimize addc using add2
  target-sh4: optimize subc using sub2
  target-sh4: optimize negc using add2 and sub2
  target-sh4: split out Q and M from of SR and optimize div1
  target-sh4: factorize fmov implementation
  target-sh4: remove dead code

Richard Henderson (2):
  linux-user: Default sh4 to sh7785
  linux-user: Add HWCAP for SH4

 hw/sh4/r2d.c   |  12 +-
 linux-user/elfload.c   |  29 +
 linux-user/main.c  |   2 +
 target-sh4/cpu.c   |   3 +-
 target-sh4/cpu.h   |  50 +---
 target-sh4/gdbstub.c   |   8 +-
 target-sh4/helper.c|  29 ++---
 target-sh4/helper.h|   1 -
 target-sh4/op_helper.c | 148 +-
 target-sh4/translate.c | 327 -
 10 files changed, 255 insertions(+), 354 deletions(-)

-- 
2.1.4

[Qemu-devel] [PULL 01/11] linux-user: Default sh4 to sh7785

[Aurelien Jarno]

From: Richard Henderson r...@twiddle.net

Signed-off-by: Richard Henderson r...@twiddle.net
Signed-off-by: Aurelien Jarno aurel...@aurel32.net
---
 linux-user/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/linux-user/main.c b/linux-user/main.c
index 6989b82..a0d3e58 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3925,6 +3925,8 @@ int main(int argc, char **argv, char **envp)
 # else
 cpu_model = 750;
 # endif
+#elif defined TARGET_SH4
+cpu_model = TYPE_SH7785_CPU;
 #else
 cpu_model = any;
 #endif
-- 
2.1.4

[Qemu-devel] [PULL 07/11] target-sh4: optimize subc using sub2

[Aurelien Jarno]

Reviewed-by: Richard Henderson r...@twiddle.net
Signed-off-by: Aurelien Jarno aurel...@aurel32.net
---
 target-sh4/translate.c | 18 +++---
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 5c90fe3..b8abfd5 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -880,19 +880,15 @@ static void _decode_opc(DisasContext * ctx)
return;
 case 0x300a:   /* subc Rm,Rn */
 {
-TCGv t0, t1, t2;
-t0 = tcg_temp_new();
+TCGv t0, t1;
+t0 = tcg_const_tl(0);
 t1 = tcg_temp_new();
-tcg_gen_sub_i32(t1, REG(B11_8), REG(B7_4));
-tcg_gen_sub_i32(t0, t1, cpu_sr_t);
-t2 = tcg_temp_new();
-tcg_gen_setcond_i32(TCG_COND_LTU, t2, REG(B11_8), t1);
-tcg_gen_setcond_i32(TCG_COND_LTU, t1, t1, t0);
-tcg_gen_or_i32(cpu_sr_t, t1, t2);
-tcg_temp_free(t2);
-tcg_temp_free(t1);
-tcg_gen_mov_i32(REG(B11_8), t0);
+tcg_gen_add2_i32(t1, cpu_sr_t, cpu_sr_t, t0, REG(B7_4), t0);
+tcg_gen_sub2_i32(REG(B11_8), cpu_sr_t,
+ REG(B11_8), t0, t1, cpu_sr_t);
+tcg_gen_andi_i32(cpu_sr_t, cpu_sr_t, 1);
 tcg_temp_free(t0);
+tcg_temp_free(t1);
 }
return;
 case 0x300b:   /* subv Rm,Rn */
-- 
2.1.4

Re: [Qemu-devel] [PATCH] hw/arm/boot: fix rom_reset notifier registration order

[Eric Auger]

Hi Peter,

Please can you test whether this patch fixes the issue on xlnx-ep108
board. I acknowledge I do not feel comfortable with that piece of code
and meanwhile I continue looking at boot.c  loader.c files.

Thank you in advance

Best Regards

Eric

On 06/12/2015 02:19 PM, Eric Auger wrote:
 commit ac9d32e39664e060cd1b538ff190980d57ad69e4 had the consequence to
 register the do_cpu_reset after the rom_reset one. Hence they get
 executed in the wrong order. This commit restores the registration of
 do_cpu_reset in arm_load_kernel.
 
 Signed-off-by: Eric Auger eric.au...@linaro.org
 ---
  hw/arm/boot.c | 20 +++-
  1 file changed, 11 insertions(+), 9 deletions(-)
 
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index d036624..1e7fd28 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
 @@ -574,15 +574,6 @@ static void arm_load_kernel_notify(Notifier *notifier, 
 void *data)
  struct arm_boot_info *info =
  container_of(n, struct arm_boot_info, load_kernel_notifier);
  
 -/* CPU objects (unlike devices) are not automatically reset on system
 - * reset, so we must always register a handler to do so. If we're
 - * actually loading a kernel, the handler is also responsible for
 - * arranging that we start it correctly.
 - */
 -for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
 -qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
 -}
 -
  /* Load the kernel.  */
  if (!info-kernel_filename || info-firmware_loaded) {
  
 @@ -783,7 +774,18 @@ static void arm_load_kernel_notify(Notifier *notifier, 
 void *data)
  
  void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
  {
 +CPUState *cs;
 +
  info-load_kernel_notifier.cpu = cpu;
  info-load_kernel_notifier.notifier.notify = arm_load_kernel_notify;
  
 qemu_add_machine_init_done_notifier(info-load_kernel_notifier.notifier);
 +
 +/* CPU objects (unlike devices) are not automatically reset on system
 + * reset, so we must always register a handler to do so. If we're
 + * actually loading a kernel, the handler is also responsible for
 + * arranging that we start it correctly.
 + */
 +for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
 +qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
 +}
  }
 

[Qemu-devel] [PATCH 12/12] audio: -audiodev command line option

[Kővágó, Zoltán]

This patch adds an -audiodev command line option, and deprecates the QEMU_*
environment variables for audio backend configuration. It's syntax is similar to
existing options (-netdev, -device, etc):
 -audiodev driver_name,property=value,...

Audio drivers now get an Audiodev * as config paramters, instead of the global
audio_option structs. There is some code in audio/audio_legacy.c that converts
the old environment variables to audiodev options (this way backends do not have
to worry about legacy options, also print out them with -audio-help, to ease
migrating to -audiodev).

Although now it's possible to specify multiple -audiodev options on command
line, multiple audio backends are not supported yet.

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com
---
 audio/Makefile.objs |   2 +-
 audio/alsaaudio.c   | 284 ++
 audio/audio.c   | 745 +---
 audio/audio.h   |  21 +-
 audio/audio_int.h   |   7 +-
 audio/audio_legacy.c| 319 +
 audio/audio_template.h  |  13 +-
 audio/coreaudio.c   |  49 +---
 audio/dsound_template.h |   6 +-
 audio/dsoundaudio.c |  56 +---
 audio/noaudio.c |   3 +-
 audio/ossaudio.c| 155 +++---
 audio/paaudio.c |  81 ++
 audio/sdlaudio.c|  24 +-
 audio/spiceaudio.c  |   7 +-
 audio/wavaudio.c|  61 +---
 qemu-options.hx | 218 +-
 vl.c|   9 +-
 18 files changed, 979 insertions(+), 1081 deletions(-)
 create mode 100644 audio/audio_legacy.c

diff --git a/audio/Makefile.objs b/audio/Makefile.objs
index 481d1aa..9d8f579 100644
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -1,4 +1,4 @@
-common-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
+common-obj-y = audio.o audio_legacy.o noaudio.o wavaudio.o mixeng.o
 common-obj-$(CONFIG_SDL) += sdlaudio.o
 common-obj-$(CONFIG_OSS) += ossaudio.o
 common-obj-$(CONFIG_SPICE) += spiceaudio.o
diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index 6882638..06230c8 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -22,6 +22,8 @@
  * THE SOFTWARE.
  */
 #include alsa/asoundlib.h
+#include qapi/alloc-visitor.h
+#include qapi-visit.h
 #include qemu-common.h
 #include qemu/main-loop.h
 #include audio.h
@@ -34,28 +36,9 @@
 #define AUDIO_CAP alsa
 #include audio_int.h
 
-typedef struct ALSAConf {
-int size_in_usec_in;
-int size_in_usec_out;
-const char *pcm_name_in;
-const char *pcm_name_out;
-unsigned int buffer_size_in;
-unsigned int period_size_in;
-unsigned int buffer_size_out;
-unsigned int period_size_out;
-unsigned int threshold;
-
-int buffer_size_in_overridden;
-int period_size_in_overridden;
-
-int buffer_size_out_overridden;
-int period_size_out_overridden;
-} ALSAConf;
-
 struct pollhlp {
 snd_pcm_t *handle;
 struct pollfd *pfds;
-ALSAConf *conf;
 int count;
 int mask;
 };
@@ -67,6 +50,7 @@ typedef struct ALSAVoiceOut {
 void *pcm_buf;
 snd_pcm_t *handle;
 struct pollhlp pollhlp;
+Audiodev *dev;
 } ALSAVoiceOut;
 
 typedef struct ALSAVoiceIn {
@@ -74,16 +58,13 @@ typedef struct ALSAVoiceIn {
 snd_pcm_t *handle;
 void *pcm_buf;
 struct pollhlp pollhlp;
+Audiodev *dev;
 } ALSAVoiceIn;
 
 struct alsa_params_req {
 int freq;
 snd_pcm_format_t fmt;
 int nchannels;
-int size_in_usec;
-int override_mask;
-unsigned int buffer_size;
-unsigned int period_size;
 };
 
 struct alsa_params_obt {
@@ -421,7 +402,8 @@ static int alsa_to_audfmt (snd_pcm_format_t alsafmt, 
AudioFormat *fmt,
 
 static void alsa_dump_info (struct alsa_params_req *req,
 struct alsa_params_obt *obt,
-snd_pcm_format_t obtfmt)
+snd_pcm_format_t obtfmt,
+AudiodevPerDirectionOptions *pdo)
 {
 dolog (parameter | requested value | obtained value\n);
 dolog (format|  %10d | %10d\n, req-fmt, obtfmt);
@@ -429,8 +411,9 @@ static void alsa_dump_info (struct alsa_params_req *req,
req-nchannels, obt-nchannels);
 dolog (frequency |  %10d | %10d\n, req-freq, obt-freq);
 dolog (\n);
-dolog (requested: buffer size %d period size %d\n,
-   req-buffer_size, req-period_size);
+dolog (requested: buffer size % PRId64  buffer count % PRId64 \n,
+   pdo-has_buffer_usecs ? pdo-buffer_usecs : 0,
+   pdo-has_buffer_count ? pdo-buffer_count : 0);
 dolog (obtained: samples %ld\n, obt-samples);
 }
 
@@ -464,23 +447,24 @@ static void alsa_set_threshold (snd_pcm_t *handle, 
snd_pcm_uframes_t threshold)
 }
 }
 
-static int alsa_open (int in, struct alsa_params_req *req,
-  struct alsa_params_obt *obt, snd_pcm_t **handlep,
-  ALSAConf *conf)
+static int alsa_open(bool in, struct 

[Qemu-devel] [PATCH 06/12] ossaudio: use trace events instead of debug config flag

[Kővágó, Zoltán]

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com
---
 audio/ossaudio.c | 25 -
 trace-events |  4 
 2 files changed, 8 insertions(+), 21 deletions(-)

diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index d247969..d5362ab 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -30,6 +30,7 @@
 #include qemu/main-loop.h
 #include qemu/host-utils.h
 #include audio.h
+#include trace.h
 
 #define AUDIO_CAP oss
 #include audio_int.h
@@ -44,7 +45,6 @@ typedef struct OSSConf {
 int fragsize;
 const char *devpath_out;
 const char *devpath_in;
-int debug;
 int exclusive;
 int policy;
 } OSSConf;
@@ -314,9 +314,7 @@ static int oss_open (int in, struct oss_params *req,
 int version;
 
 if (!oss_get_version (fd, version, typ)) {
-if (conf-debug) {
-dolog (OSS version = %#x\n, version);
-}
+trace_oss_version(version);
 
 if (version = 0x04) {
 int policy = conf-policy;
@@ -427,7 +425,6 @@ static int oss_run_out (HWVoiceOut *hw, int live)
 struct audio_buf_info abinfo;
 struct count_info cntinfo;
 int bufsize;
-OSSConf *conf = oss-conf;
 
 bufsize = hw-samples  hw-info.shift;
 
@@ -452,19 +449,12 @@ static int oss_run_out (HWVoiceOut *hw, int live)
 }
 
 if (abinfo.bytes  bufsize) {
-if (conf-debug) {
-dolog (warning: Invalid available size, size=%d bufsize=%d\n
-   please report your OS/audio hw to av1...@comtv.ru\n,
-   abinfo.bytes, bufsize);
-}
+trace_oss_invalid_available_size(abinfo.bytes, bufsize);
 abinfo.bytes = bufsize;
 }
 
 if (abinfo.bytes  0) {
-if (conf-debug) {
-dolog (warning: Invalid available size, size=%d bufsize=%d\n,
-   abinfo.bytes, bufsize);
-}
+trace_oss_invalid_available_size(abinfo.bytes, bufsize);
 return 0;
 }
 
@@ -850,7 +840,6 @@ static OSSConf glob_conf = {
 .fragsize = 4096,
 .devpath_out = /dev/dsp,
 .devpath_in = /dev/dsp,
-.debug = 0,
 .exclusive = 0,
 .policy = 5
 };
@@ -917,12 +906,6 @@ static struct audio_option oss_options[] = {
 .descr = Set the timing policy of the device, -1 to use fragment 
mode,
 },
 #endif
-{
-.name  = DEBUG,
-.tag   = AUD_OPT_BOOL,
-.valp  = glob_conf.debug,
-.descr = Turn on some debugging messages
-},
 { /* End of list */ }
 };
 
diff --git a/trace-events b/trace-events
index 0f372bb..2be8e09 100644
--- a/trace-events
+++ b/trace-events
@@ -1638,3 +1638,7 @@ alsa_xrun_in(void) Recovering from capture xrun
 alsa_resume_out(void) Resuming suspended output stream
 alsa_resume_in(void) Resuming suspended input stream
 alsa_no_frames(int state) No frames available and ALSA state is %d
+
+# audio/ossaudio.c
+oss_version(int version) OSS version = %#x
+oss_invalid_available_size(int size, int bufsize) Invalid available size, 
size=%d bufsize=%d
-- 
2.4.2

[Qemu-devel] [PATCH 05/12] alsaaudio: use trace events instead of verbose

[Kővágó, Zoltán]

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com
---
 audio/alsaaudio.c | 60 +--
 trace-events  | 12 +++
 2 files changed, 26 insertions(+), 46 deletions(-)

diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index d7e181b..b0a451a 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -25,6 +25,7 @@
 #include qemu-common.h
 #include qemu/main-loop.h
 #include audio.h
+#include trace.h
 
 #if QEMU_GNUC_PREREQ(4, 3)
 #pragma GCC diagnostic ignored -Waddress
@@ -49,7 +50,6 @@ typedef struct ALSAConf {
 
 int buffer_size_out_overridden;
 int period_size_out_overridden;
-int verbose;
 } ALSAConf;
 
 struct pollhlp {
@@ -180,7 +180,6 @@ static void alsa_poll_handler (void *opaque)
 snd_pcm_state_t state;
 struct pollhlp *hlp = opaque;
 unsigned short revents;
-ALSAConf *conf = hlp-conf;
 
 count = poll (hlp-pfds, hlp-count, 0);
 if (count  0) {
@@ -202,9 +201,7 @@ static void alsa_poll_handler (void *opaque)
 }
 
 if (!(revents  hlp-mask)) {
-if (conf-verbose) {
-dolog (revents = %d\n, revents);
-}
+trace_alsa_revents(revents);
 return;
 }
 
@@ -239,7 +236,6 @@ static int alsa_poll_helper (snd_pcm_t *handle, struct 
pollhlp *hlp, int mask)
 {
 int i, count, err;
 struct pollfd *pfds;
-ALSAConf *conf = hlp-conf;
 
 count = snd_pcm_poll_descriptors_count (handle);
 if (count = 0) {
@@ -268,16 +264,11 @@ static int alsa_poll_helper (snd_pcm_t *handle, struct 
pollhlp *hlp, int mask)
NULL, hlp);
 }
 if (pfds[i].events  POLLOUT) {
-if (conf-verbose) {
-dolog (POLLOUT %d %d\n, i, pfds[i].fd);
-}
+trace_alsa_pollout(i, pfds[i].fd);
 err = qemu_set_fd_handler (pfds[i].fd, NULL,
alsa_poll_handler, hlp);
 }
-if (conf-verbose) {
-dolog (Set handler events=%#x index=%d fd=%d err=%d\n,
-   pfds[i].events, i, pfds[i].fd, err);
-}
+trace_alsa_set_handler(pfds[i].events, i, pfds[i].fd, err);
 
 if (err) {
 dolog (Failed to set handler events=%#x index=%d fd=%d err=%d\n,
@@ -521,7 +512,7 @@ static int alsa_open (int in, struct alsa_params_req *req,
 }
 
 err = snd_pcm_hw_params_set_format (handle, hw_params, req-fmt);
-if (err  0  conf-verbose) {
+if (err  0) {
 alsa_logerr2 (err, typ, Failed to set format %d\n, req-fmt);
 }
 
@@ -685,10 +676,9 @@ static int alsa_open (int in, struct alsa_params_req *req,
 
 *handlep = handle;
 
-if (conf-verbose 
-(obtfmt != req-fmt ||
+if (obtfmt != req-fmt ||
  obt-nchannels != req-nchannels ||
- obt-freq != req-freq)) {
+ obt-freq != req-freq) {
 dolog (Audio parameters for %s\n, typ);
 alsa_dump_info (req, obt, obtfmt);
 }
@@ -728,7 +718,6 @@ static snd_pcm_sframes_t alsa_get_avail (snd_pcm_t *handle)
 static void alsa_write_pending (ALSAVoiceOut *alsa)
 {
 HWVoiceOut *hw = alsa-hw;
-ALSAConf *conf = alsa-pollhlp.conf;
 
 while (alsa-pending) {
 int left_till_end_samples = hw-samples - alsa-wpos;
@@ -743,9 +732,7 @@ static void alsa_write_pending (ALSAVoiceOut *alsa)
 if (written = 0) {
 switch (written) {
 case 0:
-if (conf-verbose) {
-dolog (Failed to write %d frames (wrote zero)\n, 
len);
-}
+trace_alsa_wrote_zero(len);
 return;
 
 case -EPIPE:
@@ -754,9 +741,7 @@ static void alsa_write_pending (ALSAVoiceOut *alsa)
  len);
 return;
 }
-if (conf-verbose) {
-dolog (Recovering from playback xrun\n);
-}
+trace_alsa_xrun_out();
 continue;
 
 case -ESTRPIPE:
@@ -767,9 +752,7 @@ static void alsa_write_pending (ALSAVoiceOut *alsa)
  len);
 return;
 }
-if (conf-verbose) {
-dolog (Resuming suspended output stream\n);
-}
+trace_alsa_resume_out();
 continue;
 
 case -EAGAIN:
@@ -1002,7 +985,6 @@ static int alsa_run_in (HWVoiceIn *hw)
 };
 snd_pcm_sframes_t avail;
 snd_pcm_uframes_t read_samples = 0;
-ALSAConf *conf = alsa-pollhlp.conf;
 
 if (!dead) {
 return 0;
@@ -1028,14 +1010,10 @@ static int alsa_run_in (HWVoiceIn *hw)
 dolog (Failed to resume suspended input stream\n);
 return 0;
 }
-if (conf-verbose) {
-dolog 

[Qemu-devel] [PULL 16/16] qmp/hmp: add rocker device support

[Stefan Hajnoczi]

From: Scott Feldman sfel...@gmail.com

Add QMP/HMP support for rocker devices.  This is mostly for debugging purposes
to see inside the device's tables and port configurations.  Some examples:

(qemu) info rocker sw1
name: sw1
id: 0x013512005452
ports: 4

(qemu) info rocker-ports sw1
ena/speed/ auto
  port  linkduplex neg?
 sw1.1  up 10G  FD  No
 sw1.2  up 10G  FD  No
 sw1.3  !ena   10G  FD  No
 sw1.4  !ena   10G  FD  No

(qemu) info rocker-of-dpa-flows sw1
prio tbl hits key(mask) -- actions
260   pport 1 vlan 1 LLDP src 00:02:00:00:02:00 dst 01:80:c2:00:00:0e
260   pport 1 vlan 1 ARP src 00:02:00:00:02:00 dst 00:02:00:00:03:00
260   pport 2 vlan 2 IPv6 src 00:02:00:00:03:00 dst 33:33:ff:00:00:02 
proto 58
350   vlan 2 dst 33:33:ff:00:00:02 -- write group 0x3201 goto tbl 
60
260   pport 2 vlan 2 IPv6 src 00:02:00:00:03:00 dst 33:33:ff:00:03:00 
proto 58
350  1vlan 2 dst 33:33:ff:00:03:00 -- write group 0x3201 goto tbl 
60
260   pport 2 vlan 2 ARP src 00:02:00:00:03:00 dst 00:02:00:00:02:00
350  2vlan 2 dst 00:02:00:00:02:00 -- write group 0x0201 goto tbl 
60
260  1pport 2 vlan 2 IP src 00:02:00:00:03:00 dst 00:02:00:00:02:00 
proto 1
350  2vlan 1 dst 00:02:00:00:03:00 -- write group 0x0102 goto tbl 
60
260  1pport 1 vlan 1 IP src 00:02:00:00:02:00 dst 00:02:00:00:03:00 
proto 1
260   pport 1 vlan 1 IPv6 src 00:02:00:00:02:00 dst 33:33:ff:00:00:01 
proto 58
350   vlan 1 dst 33:33:ff:00:00:01 -- write group 0x3100 goto tbl 
60
260   pport 1 vlan 1 IPv6 src 00:02:00:00:02:00 dst 33:33:ff:00:02:00 
proto 58
350  1vlan 1 dst 33:33:ff:00:02:00 -- write group 0x3100 goto tbl 
60
160  173  pport 2 vlan 2 LLDP src any dst 01:80:c2:00:00:0e -- write 
group 0x0200
160  6pport 2 vlan 2 IPv6 src any dst any -- write group 0x0200
160  174  pport 1 vlan 1 LLDP src any dst 01:80:c2:00:00:0e -- write 
group 0x0100
160  174  pport 2 vlan 2 IP src any dst any -- write group 0x0200
160  6pport 1 vlan 1 IPv6 src any dst any -- write group 0x0100
160  181  pport 2 vlan 2 ARP src any dst any -- write group 0x0200
110  715  pport 2 -- apply new vlan 2 goto tbl 20
160  177  pport 1 vlan 1 ARP src any dst any -- write group 0x0100
160  174  pport 1 vlan 1 IP src any dst any -- write group 0x0100
110  717  pport 1 -- apply new vlan 1 goto tbl 20
10   1432 pport 0(0x) -- goto tbl 10

(qemu) info rocker-of-dpa-groups sw1
id (decode) -- buckets
0x3201 (type L2 multicast vlan 2 index 1) -- groups [0x0201,0x0200]
0x0201 (type L2 interface vlan 2 pport 1) -- pop vlan out pport 1
0x0102 (type L2 interface vlan 1 pport 2) -- pop vlan out pport 2
0x0200 (type L2 interface vlan 2 pport 0) -- pop vlan out pport 0
0x0100 (type L2 interface vlan 1 pport 0) -- pop vlan out pport 0
0x3100 (type L2 multicast vlan 1 index 0) -- groups [0x0102,0x0100]

[Added query- prefixes to rocker.json commands as suggested by Eric
Blake ebl...@redhat.com.
--Stefan]

Signed-off-by: Scott Feldman sfel...@gmail.com
Signed-off-by: Jiri Pirko j...@resnulli.us
Message-id: 1433985681-56138-5-git-send-email-sfel...@gmail.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 hmp-commands.hx   |  24 
 hmp.c | 303 
 hmp.h |   4 +
 hw/net/Makefile.objs  |   1 +
 hw/net/rocker/qmp-norocker.c  |  50 +++
 hw/net/rocker/rocker.c|  45 ++
 hw/net/rocker/rocker_fp.c |  10 ++
 hw/net/rocker/rocker_fp.h |   1 +
 hw/net/rocker/rocker_of_dpa.c | 312 ++
 monitor.c |  28 
 qapi-schema.json  |   3 +
 qapi/rocker.json  | 286 ++
 qmp-commands.hx   | 103 ++
 13 files changed, 1170 insertions(+)
 create mode 100644 hw/net/rocker/qmp-norocker.c
 create mode 100644 qapi/rocker.json

diff --git a/hmp-commands.hx b/hmp-commands.hx
index 3d7dfcc..d3b7932 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1799,5 +1799,29 @@ show available trace events and their state
 ETEXI
 
 STEXI
+@item rocker @var{name}
+@findex rocker
+Show Rocker(s)
+ETEXI
+
+STEXI
+@item rocker_ports @var{name}
+@findex rocker_ports
+Show Rocker ports
+ETEXI
+
+STEXI
+@item rocker_of_dpa_flows @var{name} [@var{tbl_id}]
+@findex rocker_of_dpa_flows
+Show Rocker OF-DPA flow tables
+ETEXI
+
+STEXI
+@item rocker_of_dpa_groups @var{name} [@var{type}]
+@findex rocker_of_dpa_groups
+Show Rocker OF-DPA groups
+ETEXI
+
+STEXI
 @end table
 ETEXI
diff --git a/hmp.c b/hmp.c
index 514f22f..1e7cac0 100644
--- a/hmp.c
+++ b/hmp.c
@@ -15,6 +15,7 @@
 
 #include hmp.h
 #include net/net.h
+#include net/eth.h
 #include sysemu/char.h
 

[Qemu-devel] [PULL 03/16] netmap: Drop netmap_can_send

[Stefan Hajnoczi]

From: Fam Zheng f...@redhat.com

This callback is called by main loop before polling s-fd, if it returns
false, the fd will not be polled in this iteration.

This is redundant with checks inside read callback. After this patch,
the data will be copied from s-fd to s-iov when it arrives. If the
device can't receive, it will be queued to incoming_queue, and when the
device status changes, this queue will be flushed.

Also remove the qemu_can_send_packet() check in netmap_send. If it's
true, we are good; if it's false, the qemu_sendv_packet_async would
return 0 and read poll will be disabled until netmap_send_completed is
called.

Signed-off-by: Fam Zheng f...@redhat.com
Message-id: 1433400324-7358-5-git-send-email-f...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 net/netmap.c | 14 ++
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/net/netmap.c b/net/netmap.c
index 69300eb..19d0542 100644
--- a/net/netmap.c
+++ b/net/netmap.c
@@ -132,23 +132,13 @@ error:
 return -1;
 }
 
-/* Tell the event-loop if the netmap backend can send packets
-   to the frontend. */
-static int netmap_can_send(void *opaque)
-{
-NetmapState *s = opaque;
-
-return qemu_can_send_packet(s-nc);
-}
-
 static void netmap_send(void *opaque);
 static void netmap_writable(void *opaque);
 
 /* Set the event-loop handlers for the netmap backend. */
 static void netmap_update_fd_handler(NetmapState *s)
 {
-qemu_set_fd_handler2(s-me.fd,
- s-read_poll  ? netmap_can_send : NULL,
+qemu_set_fd_handler2(s-me.fd, NULL,
  s-read_poll  ? netmap_send : NULL,
  s-write_poll ? netmap_writable : NULL,
  s);
@@ -317,7 +307,7 @@ static void netmap_send(void *opaque)
 
 /* Keep sending while there are available packets into the netmap
RX ring and the forwarding path towards the peer is open. */
-while (!nm_ring_empty(ring)  qemu_can_send_packet(s-nc)) {
+while (!nm_ring_empty(ring)) {
 uint32_t i;
 uint32_t idx;
 bool morefrag;
-- 
2.4.2

[Qemu-devel] [PULL 12/16] iohandler: Change return type of qemu_set_fd_handler to void

[Stefan Hajnoczi]

From: Fam Zheng f...@redhat.com

Signed-off-by: Fam Zheng f...@redhat.com
Message-id: 1433400324-7358-14-git-send-email-f...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 include/qemu/main-loop.h | 8 
 iohandler.c  | 9 -
 stubs/set-fd-handler.c   | 8 
 3 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
index 7da1d63..0f4a0fd 100644
--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
@@ -198,10 +198,10 @@ typedef int IOCanReadHandler(void *opaque);
  *
  * @opaque: A pointer-sized value that is passed to @fd_read and @fd_write.
  */
-int qemu_set_fd_handler(int fd,
-IOHandler *fd_read,
-IOHandler *fd_write,
-void *opaque);
+void qemu_set_fd_handler(int fd,
+ IOHandler *fd_read,
+ IOHandler *fd_write,
+ void *opaque);
 
 #ifdef CONFIG_POSIX
 /**
diff --git a/iohandler.c b/iohandler.c
index d361cf2..826f713 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -45,10 +45,10 @@ typedef struct IOHandlerRecord {
 static QLIST_HEAD(, IOHandlerRecord) io_handlers =
 QLIST_HEAD_INITIALIZER(io_handlers);
 
-int qemu_set_fd_handler(int fd,
-IOHandler *fd_read,
-IOHandler *fd_write,
-void *opaque)
+void qemu_set_fd_handler(int fd,
+ IOHandler *fd_read,
+ IOHandler *fd_write,
+ void *opaque)
 {
 IOHandlerRecord *ioh;
 
@@ -77,7 +77,6 @@ int qemu_set_fd_handler(int fd,
 ioh-deleted = 0;
 qemu_notify_event();
 }
-return 0;
 }
 
 void qemu_iohandler_fill(GArray *pollfds)
diff --git a/stubs/set-fd-handler.c b/stubs/set-fd-handler.c
index a895e62..a8481bc 100644
--- a/stubs/set-fd-handler.c
+++ b/stubs/set-fd-handler.c
@@ -1,10 +1,10 @@
 #include qemu-common.h
 #include qemu/main-loop.h
 
-int qemu_set_fd_handler(int fd,
-IOHandler *fd_read,
-IOHandler *fd_write,
-void *opaque)
+void qemu_set_fd_handler(int fd,
+ IOHandler *fd_read,
+ IOHandler *fd_write,
+ void *opaque)
 {
 abort();
 }
-- 
2.4.2

[Qemu-devel] [PATCH 1/1] linux-user: fix the breakpoint inheritance in spawned threads

[Thierry Bultel]

When a thread is spawned, cpu_copy re-initializes
the bp  wp lists of current thread, instead of the ones
of the new thread.
The effect is that breakpoints are no longer hit.

Signed-off-by: Thierry Bultel thierry.bul...@basystemes.fr
---
 linux-user/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index 6989b82..309562a 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3459,8 +3459,8 @@ CPUArchState *cpu_copy(CPUArchState *env)
 /* Clone all break/watchpoints.
Note: Once we support ptrace with hw-debug register access, make sure
BP_CPU break/watchpoints are handled correctly on clone. */
-QTAILQ_INIT(cpu-breakpoints);
-QTAILQ_INIT(cpu-watchpoints);
+QTAILQ_INIT(new_cpu-breakpoints);
+QTAILQ_INIT(new_cpu-watchpoints);
 QTAILQ_FOREACH(bp, cpu-breakpoints, entry) {
 cpu_breakpoint_insert(new_cpu, bp-pc, bp-flags, NULL);
 }
-- 
1.9.1

[Qemu-devel] [PULL 05/11] target-sh4: Split out T from SR

[Aurelien Jarno]

In preparation for more efficient setting of this field.

Reviewed-by: Richard Henderson r...@twiddle.net
Signed-off-by: Aurelien Jarno aurel...@aurel32.net
---
 target-sh4/cpu.h   |  14 +++-
 target-sh4/gdbstub.c   |   4 +-
 target-sh4/helper.c|   2 +-
 target-sh4/op_helper.c |  32 ++--
 target-sh4/translate.c | 213 +
 5 files changed, 112 insertions(+), 153 deletions(-)

diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index 76fda35..a308c53 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -138,7 +138,8 @@ typedef struct CPUSH4State {
 uint32_t flags;/* general execution flags */
 uint32_t gregs[24];/* general registers */
 float32 fregs[32]; /* floating point registers */
-uint32_t sr;   /* status register */
+uint32_t sr;/* status register (with T split out) */
+uint32_t sr_t;  /* T bit of status register */
 uint32_t ssr;  /* saved status register */
 uint32_t spc;  /* saved program counter */
 uint32_t gbr;  /* global base register */
@@ -331,6 +332,17 @@ static inline int cpu_ptel_pr (uint32_t ptel)
 
 #define TB_FLAG_PENDING_MOVCA  (1  4)
 
+static inline target_ulong cpu_read_sr(CPUSH4State *env)
+{
+return env-sr | (env-sr_t  SR_T);
+}
+
+static inline void cpu_write_sr(CPUSH4State *env, target_ulong sr)
+{
+env-sr_t = sr  (1u  SR_T);
+env-sr = sr  ~(1u  SR_T);
+}
+
 static inline void cpu_get_tb_cpu_state(CPUSH4State *env, target_ulong *pc,
 target_ulong *cs_base, int *flags)
 {
diff --git a/target-sh4/gdbstub.c b/target-sh4/gdbstub.c
index 05ba728..a365a27 100644
--- a/target-sh4/gdbstub.c
+++ b/target-sh4/gdbstub.c
@@ -51,7 +51,7 @@ int superh_cpu_gdb_read_register(CPUState *cs, uint8_t 
*mem_buf, int n)
 case 21:
 return gdb_get_regl(mem_buf, env-macl);
 case 22:
-return gdb_get_regl(mem_buf, env-sr);
+return gdb_get_regl(mem_buf, cpu_read_sr(env));
 case 23:
 return gdb_get_regl(mem_buf, env-fpul);
 case 24:
@@ -111,7 +111,7 @@ int superh_cpu_gdb_write_register(CPUState *cs, uint8_t 
*mem_buf, int n)
 env-macl = ldl_p(mem_buf);
 break;
 case 22:
-env-sr = ldl_p(mem_buf);
+cpu_write_sr(env, ldl_p(mem_buf));
 break;
 case 23:
 env-fpul = ldl_p(mem_buf);
diff --git a/target-sh4/helper.c b/target-sh4/helper.c
index 1cb0e8d..a533f08 100644
--- a/target-sh4/helper.c
+++ b/target-sh4/helper.c
@@ -162,7 +162,7 @@ void superh_cpu_do_interrupt(CPUState *cs)
 log_cpu_state(cs, 0);
 }
 
-env-ssr = env-sr;
+env-ssr = cpu_read_sr(env);
 env-spc = env-pc;
 env-sgr = env-gregs[15];
 env-sr |= (1u  SR_BL) | (1u  SR_MD) | (1u  SR_RB);
diff --git a/target-sh4/op_helper.c b/target-sh4/op_helper.c
index 6f34292..524d7f6 100644
--- a/target-sh4/op_helper.c
+++ b/target-sh4/op_helper.c
@@ -156,11 +156,11 @@ void helper_ocbi(CPUSH4State *env, uint32_t address)
 }
 }
 
-#define T (env-sr  (1u  SR_T))
+#define T (env-sr_t)
 #define Q (env-sr  (1u  SR_Q) ? 1 : 0)
 #define M (env-sr  (1u  SR_M) ? 1 : 0)
-#define SETT (env-sr |= (1u  SR_T))
-#define CLRT (env-sr = ~(1u  SR_T))
+#define SETT (env-sr_t = 1)
+#define CLRT (env-sr_t = 0)
 #define SETQ (env-sr |= (1u  SR_Q))
 #define CLRQ (env-sr = ~(1u  SR_Q))
 #define SETM (env-sr |= (1u  SR_M))
@@ -309,16 +309,6 @@ void helper_macw(CPUSH4State *env, uint32_t arg0, uint32_t 
arg1)
 }
 }
 
-static inline void set_t(CPUSH4State *env)
-{
-env-sr |= (1u  SR_T);
-}
-
-static inline void clr_t(CPUSH4State *env)
-{
-env-sr = ~(1u  SR_T);
-}
-
 void helper_ld_fpscr(CPUSH4State *env, uint32_t val)
 {
 env-fpscr = val  FPSCR_MASK;
@@ -403,10 +393,8 @@ void helper_fcmp_eq_FT(CPUSH4State *env, float32 t0, 
float32 t1)
 relation = float32_compare(t0, t1, env-fp_status);
 if (unlikely(relation == float_relation_unordered)) {
 update_fpscr(env, GETPC());
-} else if (relation == float_relation_equal) {
-set_t(env);
 } else {
-clr_t(env);
+env-sr_t = (relation == float_relation_equal);
 }
 }
 
@@ -418,10 +406,8 @@ void helper_fcmp_eq_DT(CPUSH4State *env, float64 t0, 
float64 t1)
 relation = float64_compare(t0, t1, env-fp_status);
 if (unlikely(relation == float_relation_unordered)) {
 update_fpscr(env, GETPC());
-} else if (relation == float_relation_equal) {
-set_t(env);
 } else {
-clr_t(env);
+env-sr_t = (relation == float_relation_equal);
 }
 }
 
@@ -433,10 +419,8 @@ void helper_fcmp_gt_FT(CPUSH4State *env, float32 t0, 
float32 t1)
 relation = float32_compare(t0, t1, env-fp_status);
 if (unlikely(relation == float_relation_unordered)) {
 update_fpscr(env, GETPC());
-} else if (relation == float_relation_greater) {
-set_t(env);
 } else {

[Qemu-devel] [Bug 1464611] [NEW] 4 * redundant conditions

[dcb]

Public bug reported:


1.

[qemu/hw/block/nvme.c:355]: (style) Redundant condition: sqid. 'A  (!A
|| B)' is equivalent to 'A || B'

  if (!sqid || (sqid  !nvme_check_sqid(n, sqid))) {

2.

[qemu/hw/block/nvme.c:429]: (style) Redundant condition: cqid. 'A  (!A
|| B)' is equivalent to 'A || B'

  if (!cqid || (cqid  !nvme_check_cqid(n, cqid))) {

3.

[qemu/hw/tpm/tpm_passthrough.c:157]: (style) Redundant condition:
tpm_pt.tpm_op_canceled. 'A  (!A || B)' is equivalent to 'A || B'

 if (!tpm_pt-tpm_op_canceled ||
(tpm_pt-tpm_op_canceled  errno != ECANCELED)) {

4.

[qemu/target-arm/translate-a64.c:5729]: (style) Redundant condition:
size3. 'A  (!A || B)' is equivalent to 'A || B'

  if (size  3
|| (size  3  is_q)
|| (size == 3  !is_q)) {

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1464611

Title:
  4 * redundant conditions

Status in QEMU:
  New

Bug description:
  
  1.

  [qemu/hw/block/nvme.c:355]: (style) Redundant condition: sqid. 'A 
  (!A || B)' is equivalent to 'A || B'

if (!sqid || (sqid  !nvme_check_sqid(n, sqid))) {

  2.

  [qemu/hw/block/nvme.c:429]: (style) Redundant condition: cqid. 'A 
  (!A || B)' is equivalent to 'A || B'

if (!cqid || (cqid  !nvme_check_cqid(n, cqid))) {

  3.

  [qemu/hw/tpm/tpm_passthrough.c:157]: (style) Redundant condition:
  tpm_pt.tpm_op_canceled. 'A  (!A || B)' is equivalent to 'A || B'

   if (!tpm_pt-tpm_op_canceled ||
  (tpm_pt-tpm_op_canceled  errno != ECANCELED)) {

  4.

  [qemu/target-arm/translate-a64.c:5729]: (style) Redundant condition:
  size3. 'A  (!A || B)' is equivalent to 'A || B'

if (size  3
  || (size  3  is_q)
  || (size == 3  !is_q)) {

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1464611/+subscriptions

Re: [Qemu-devel] [PATCH 1/1] balloon: add a feature bit to let Guest OS deflate balloon on oom

[Christian Borntraeger]

Am 10.06.2015 um 15:13 schrieb Michael S. Tsirkin:
 On Wed, Jun 10, 2015 at 03:02:21PM +0300, Denis V. Lunev wrote:
 On 09/06/15 13:37, Christian Borntraeger wrote:
 Am 09.06.2015 um 12:19 schrieb Denis V. Lunev:
 Excessive virtio_balloon inflation can cause invocation of OOM-killer,
 when Linux is under severe memory pressure. Various mechanisms are
 responsible for correct virtio_balloon memory management. Nevertheless it
 is often the case that these control tools does not have enough time to
 react on fast changing memory load. As a result OS runs out of memory and
 invokes OOM-killer. The balancing of memory by use of the virtio balloon
 should not cause the termination of processes while there are pages in the
 balloon. Now there is no way for virtio balloon driver to free memory at
 the last moment before some process get killed by OOM-killer.

 This does not provide a security breach as balloon itself is running
 inside Guest OS and is working in the cooperation with the host. Thus
 some improvements from Guest side should be considered as normal.

 To solve the problem, introduce a virtio_balloon callback which is
 expected to be called from the oom notifier call chain in out_of_memory()
 function. If virtio balloon could release some memory, it will make the
 system return and retry the allocation that forced the out of memory
 killer to run.

 This behavior should be enabled if and only if appropriate feature bit
 is set on the device. It is off by default.
 The balloon frees pages in this way

 static void balloon_page(void *addr, int deflate)
 {
 #if defined(__linux__)
 if (!kvm_enabled() || kvm_has_sync_mmu())
 qemu_madvise(addr, TARGET_PAGE_SIZE,
 deflate ? QEMU_MADV_WILLNEED : QEMU_MADV_DONTNEED);
 #endif
 }

 The guest can re-touch that page and get a empty zero or the old page back 
 without
 tampering the host integrity. This should work for all cases I am aware of 
 (without sync_mmu its a nop anyway) so why not enable that by default? 
 Anything that I missed?

 Christian

 I'd like to do that :) Actually original version of kernel patch
 has enabled this unconditionally. But Michael asked to make
 it configurable and off by default.

 Den
 
 That's not the question here.  The question is why is it limited by 
 kvm_has_sync_mmu.

Well we have two interesting options here:

VIRTIO_BALLOON_F_MUST_TELL_HOST and VIRTIO_BALLOON_F_DEFLATE_ON_OOM

For any sane host with ondemand paging just re-accessing the page
should simply work. So the common case could be
VIRTIO_BALLOON_F_MUST_TELL_HOST == off
VIRTIO_BALLOON_F_DEFLATE_ON_OOM == on

Only for the rare case of hypervisors without paging or other memory
related restrictions we have to enable MUST_TELL_HOST.
Now: QEMU knows exactly which case we have, so why not let QEMU tell
the guest what the capabilities are. (e.g. sync_mmu --- no need to 
tell the host).

I can at least imaging that some admin wants to make the the oom case
configurable, but a sane default seems to be to not kill random
guest processes.

Christian

[Qemu-devel] [PATCH 02/12] audio: remove plive

[Kővágó, Zoltán]

It was useless even 3 years ago, so it can probably safely go away:
https://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg02427.html

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com
---
 audio/audio.c  | 12 
 audio/audio_template.h | 41 -
 2 files changed, 53 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index cb1cba9..5be4b15 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -30,7 +30,6 @@
 #define AUDIO_CAP audio
 #include audio_int.h
 
-/* #define DEBUG_PLIVE */
 /* #define DEBUG_LIVE */
 /* #define DEBUG_OUT */
 /* #define DEBUG_CAPTURE */
@@ -66,7 +65,6 @@ static struct {
 int hertz;
 int64_t ticks;
 } period;
-int plive;
 int try_poll_in;
 int try_poll_out;
 } conf = {
@@ -95,7 +93,6 @@ static struct {
 },
 
 .period = { .hertz = 100 },
-.plive = 0,
 .try_poll_in = 1,
 .try_poll_out = 1,
 };
@@ -1443,9 +1440,6 @@ static void audio_run_out (AudioState *s)
 while (sw) {
 sw1 = sw-entries.le_next;
 if (!sw-active  !sw-callback.fn) {
-#ifdef DEBUG_PLIVE
-dolog (Finishing with old voice\n);
-#endif
 audio_close_out (sw);
 }
 sw = sw1;
@@ -1637,12 +1631,6 @@ static struct audio_option audio_options[] = {
 .valp  = conf.period.hertz,
 .descr = Timer period in HZ (0 - use lowest possible)
 },
-{
-.name  = PLIVE,
-.tag   = AUD_OPT_BOOL,
-.valp  = conf.plive,
-.descr = (undocumented)
-},
 { /* End of list */ }
 };
 
diff --git a/audio/audio_template.h b/audio/audio_template.h
index f716d97..99b27b2 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -398,10 +398,6 @@ SW *glue (AUD_open_, TYPE) (
 )
 {
 AudioState *s = glob_audio_state;
-#ifdef DAC
-int live = 0;
-SW *old_sw = NULL;
-#endif
 
 if (audio_bug (AUDIO_FUNC, !card || !name || !callback_fn || !as)) {
 dolog (card=%p name=%p callback_fn=%p as=%p\n,
@@ -426,29 +422,6 @@ SW *glue (AUD_open_, TYPE) (
 return sw;
 }
 
-#ifdef DAC
-if (conf.plive  sw  (!sw-active  !sw-empty)) {
-live = sw-total_hw_samples_mixed;
-
-#ifdef DEBUG_PLIVE
-dolog (Replacing voice %s with %d live samples\n, SW_NAME (sw), 
live);
-dolog (Old %s freq %d, bits %d, channels %d\n,
-   SW_NAME (sw), sw-info.freq, sw-info.bits, sw-info.nchannels);
-dolog (New %s freq %d, bits %d, channels %d\n,
-   name,
-   as-freq,
-   (as-fmt == AUD_FMT_S16 || as-fmt == AUD_FMT_U16) ? 16 : 8,
-   as-nchannels);
-#endif
-
-if (live) {
-old_sw = sw;
-old_sw-callback.fn = NULL;
-sw = NULL;
-}
-}
-#endif
-
 if (!glue (conf.fixed_, TYPE).enabled  sw) {
 glue (AUD_close_, TYPE) (card, sw);
 sw = NULL;
@@ -481,20 +454,6 @@ SW *glue (AUD_open_, TYPE) (
 sw-callback.fn = callback_fn;
 sw-callback.opaque = callback_opaque;
 
-#ifdef DAC
-if (live) {
-int mixed =
-(live  old_sw-info.shift)
-* old_sw-info.bytes_per_second
-/ sw-info.bytes_per_second;
-
-#ifdef DEBUG_PLIVE
-dolog (Silence will be mixed %d\n, mixed);
-#endif
-sw-total_hw_samples_mixed += mixed;
-}
-#endif
-
 #ifdef DEBUG_AUDIO
 dolog (%s\n, name);
 audio_pcm_print_info (hw, sw-hw-info);
-- 
2.4.2

[Qemu-devel] [PATCH 00/12] -audiodev option

[Kővágó, Zoltán]

Note: this patch depends on my not-yet-merged audio cleanup patches:
https://lists.nongnu.org/archive/html/qemu-devel/2015-06/msg02558.html

This series of patches adds a new -audiodev command line option to specify audio
subsytem parameters instead of environment variables. This will later allow us
to specify multiple audio backends. The syntax is something like this:
 -audiodev driver_name,property=value,...
like:
 -audiodev alsa,frequency=8000,channels=1

The first 6 commits are cleanup commits of the audio backends. The next commit
adds a qapi Audiodev struct that describes the audio backend options. The next 4
commits are some miscellaneous additions that are needed by the last commit
which finally adds the -audiodev option.

For users with esoteric platforms or needs please check I did not break anything
accidentally. For easier testing, pull https://github.com/DirtYiCE/qemu.git tag
audio-cmdline-v1.

Please review.

Kővágó, Zoltán (12):
  audio: remove LOG_TO_MONITOR along with default_mon
  audio: remove plive
  dsoundaudio: remove *_retries kludges
  dsoundaudio: remove primary buffer
  alsaaudio: use trace events instead of verbose
  ossaudio: use trace events instead of debug config flag
  qapi: qapi for audio backends
  qapi: support nested structs in OptsVisitor
  opts: do not print separator before first item in qemu_opts_print
  qapi: AllocVisitor
  audio: use qapi AudioFormat instead of audfmt_e
  audio: -audiodev command line option

 Makefile|   4 +-
 audio/Makefile.objs |   2 +-
 audio/alsaaudio.c   | 397 +--
 audio/audio.c   | 831 +---
 audio/audio.h   |  32 +-
 audio/audio_int.h   |   7 +-
 audio/audio_legacy.c| 319 
 audio/audio_template.h  |  54 +--
 audio/audio_win_int.c   |  18 +-
 audio/coreaudio.c   |  49 +-
 audio/dsound_template.h |  41 +-
 audio/dsoundaudio.c | 228 ++---
 audio/noaudio.c |   3 +-
 audio/ossaudio.c| 208 +++-
 audio/paaudio.c | 109 ++---
 audio/sdlaudio.c|  50 +-
 audio/spiceaudio.c  |  11 +-
 audio/wavaudio.c|  76 +--
 audio/wavcapture.c  |   2 +-
 block.c |   2 +-
 hw/arm/omap2.c  |   2 +-
 hw/audio/ac97.c |   2 +-
 hw/audio/adlib.c|   2 +-
 hw/audio/cs4231a.c  |   6 +-
 hw/audio/es1370.c   |   4 +-
 hw/audio/gus.c  |   2 +-
 hw/audio/hda-codec.c|  18 +-
 hw/audio/lm4549.c   |   6 +-
 hw/audio/milkymist-ac97.c   |   2 +-
 hw/audio/pcspk.c|   2 +-
 hw/audio/sb16.c |  14 +-
 hw/audio/wm8750.c   |   4 +-
 hw/input/tsc210x.c  |   2 +-
 hw/usb/dev-audio.c  |   2 +-
 include/monitor/monitor.h   |   1 -
 include/qapi/alloc-visitor.h|  18 +
 monitor.c   |   4 -
 qapi-schema.json|   3 +
 qapi/Makefile.objs  |   1 +
 qapi/alloc-visitor.c|  62 +++
 qapi/audio.json | 217 +
 qapi/opts-visitor.c | 144 --
 qemu-options.hx | 218 -
 tests/qapi-schema/qapi-schema-test.json |   9 +-
 tests/test-opts-visitor.c   |  34 ++
 trace-events|  16 +
 ui/vnc.c|  14 +-
 util/qemu-option.c  |   5 +-
 vl.c|   9 +-
 49 files changed, 1663 insertions(+), 1603 deletions(-)
 create mode 100644 audio/audio_legacy.c
 create mode 100644 include/qapi/alloc-visitor.h
 create mode 100644 qapi/alloc-visitor.c
 create mode 100644 qapi/audio.json

-- 
2.4.2

[Qemu-devel] [PATCH 01/12] audio: remove LOG_TO_MONITOR along with default_mon

[Kővágó, Zoltán]

Setting QEMU_AUDIO_LOG_TO_MONITOR=1 can crash qemu (if qemu tries to log
to the monitor before it's being initialized), and also nothing else in
qemu logs to the monitor.

This log to monitor feature was the last thing that used the default_mon
variable, so I removed it too (as using it can cause problems).

Signed-off-by: Kővágó, Zoltán dirty.ice...@gmail.com
---
 audio/audio.c | 23 +++
 include/monitor/monitor.h |  1 -
 monitor.c |  4 
 3 files changed, 3 insertions(+), 25 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 9d018e9..cb1cba9 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -67,7 +67,6 @@ static struct {
 int64_t ticks;
 } period;
 int plive;
-int log_to_monitor;
 int try_poll_in;
 int try_poll_out;
 } conf = {
@@ -97,7 +96,6 @@ static struct {
 
 .period = { .hertz = 100 },
 .plive = 0,
-.log_to_monitor = 0,
 .try_poll_in = 1,
 .try_poll_out = 1,
 };
@@ -331,20 +329,11 @@ static const char *audio_get_conf_str (const char *key,
 
 void AUD_vlog (const char *cap, const char *fmt, va_list ap)
 {
-if (conf.log_to_monitor) {
-if (cap) {
-monitor_printf(default_mon, %s: , cap);
-}
-
-monitor_vprintf(default_mon, fmt, ap);
+if (cap) {
+fprintf(stderr, %s: , cap);
 }
-else {
-if (cap) {
-fprintf (stderr, %s: , cap);
-}
 
-vfprintf (stderr, fmt, ap);
-}
+vfprintf(stderr, fmt, ap);
 }
 
 void AUD_log (const char *cap, const char *fmt, ...)
@@ -1654,12 +1643,6 @@ static struct audio_option audio_options[] = {
 .valp  = conf.plive,
 .descr = (undocumented)
 },
-{
-.name  = LOG_TO_MONITOR,
-.tag   = AUD_OPT_BOOL,
-.valp  = conf.log_to_monitor,
-.descr = Print logging messages to monitor instead of stderr
-},
 { /* End of list */ }
 };
 
diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
index 57f8394..88644ce 100644
--- a/include/monitor/monitor.h
+++ b/include/monitor/monitor.h
@@ -8,7 +8,6 @@
 #include qemu/readline.h
 
 extern Monitor *cur_mon;
-extern Monitor *default_mon;
 
 /* flags for monitor_init */
 #define MONITOR_IS_DEFAULT0x01
diff --git a/monitor.c b/monitor.c
index 9afee7b..06aee1f 100644
--- a/monitor.c
+++ b/monitor.c
@@ -226,7 +226,6 @@ static mon_cmd_t info_cmds[];
 static const mon_cmd_t qmp_cmds[];
 
 Monitor *cur_mon;
-Monitor *default_mon;
 
 static void monitor_command_cb(void *opaque, const char *cmdline,
void *readline_opaque);
@@ -5270,9 +5269,6 @@ void monitor_init(CharDriverState *chr, int flags)
 qemu_mutex_lock(monitor_lock);
 QLIST_INSERT_HEAD(mon_list, mon, entry);
 qemu_mutex_unlock(monitor_lock);
-
-if (!default_mon || (flags  MONITOR_IS_DEFAULT))
-default_mon = mon;
 }
 
 static void bdrv_password_cb(void *opaque, const char *password,
-- 
2.4.2

Re: [Qemu-devel] [PATCH] linux-user: Use abi_ulong for TARGET_ELF_PAGESTART

[Riku Voipio]

Hi,

Applied to linux-user que, thanks

Riku

On Tuesday, June 2, 2015 12:12:21 PM EEST, Yongbok Kim wrote:

ping!

On 20/04/2015 16:15, Yongbok Kim wrote:

TARGET_ELF_PAGESTART is required to use abi_ulong to correctly handle
addresses for different target bits width.
This patch fixes a problem when running a 64-bit user mode application
on 32-bit host machines.

Signed-off-by: Yongbok Kim yongbok@imgtec.com ...

[Qemu-devel] [PULL 07/16] main-loop: Drop qemu_set_fd_handler2

[Stefan Hajnoczi]

From: Fam Zheng f...@redhat.com

All users are converted to qemu_set_fd_handler now, drop
qemu_set_fd_handler2 and IOHandlerRecord.fd_read_poll.

Signed-off-by: Fam Zheng f...@redhat.com
Message-id: 1433400324-7358-9-git-send-email-f...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 include/block/aio.h  |  2 +-
 include/qemu/main-loop.h | 49 +---
 iohandler.c  | 26 +
 stubs/set-fd-handler.c   |  9 -
 4 files changed, 7 insertions(+), 79 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index d2bb423..b46103e 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -241,7 +241,7 @@ bool aio_dispatch(AioContext *ctx);
 bool aio_poll(AioContext *ctx, bool blocking);
 
 /* Register a file descriptor and associated callbacks.  Behaves very similarly
- * to qemu_set_fd_handler2.  Unlike qemu_set_fd_handler2, these callbacks will
+ * to qemu_set_fd_handler.  Unlike qemu_set_fd_handler, these callbacks will
  * be invoked when using aio_poll().
  *
  * Code that invokes AIO completion functions should rely on this function
diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
index 62c68c0..7da1d63 100644
--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
@@ -96,8 +96,7 @@ AioContext *qemu_get_aio_context(void);
  * that the main loop waits for.
  *
  * Calling qemu_notify_event is rarely necessary, because main loop
- * services (bottom halves and timers) call it themselves.  One notable
- * exception occurs when using qemu_set_fd_handler2 (see below).
+ * services (bottom halves and timers) call it themselves.
  */
 void qemu_notify_event(void);
 
@@ -172,52 +171,6 @@ typedef void IOReadHandler(void *opaque, const uint8_t 
*buf, int size);
 typedef int IOCanReadHandler(void *opaque);
 
 /**
- * qemu_set_fd_handler2: Register a file descriptor with the main loop
- *
- * This function tells the main loop to wake up whenever one of the
- * following conditions is true:
- *
- * 1) if @fd_write is not %NULL, when the file descriptor is writable;
- *
- * 2) if @fd_read is not %NULL, when the file descriptor is readable.
- *
- * @fd_read_poll can be used to disable the @fd_read callback temporarily.
- * This is useful to avoid calling qemu_set_fd_handler2 every time the
- * client becomes interested in reading (or dually, stops being interested).
- * A typical example is when @fd is a listening socket and you want to bound
- * the number of active clients.  Remember to call qemu_notify_event whenever
- * the condition may change from %false to %true.
- *
- * The callbacks that are set up by qemu_set_fd_handler2 are level-triggered.
- * If @fd_read does not read from @fd, or @fd_write does not write to @fd
- * until its buffers are full, they will be called again on the next
- * iteration.
- *
- * @fd: The file descriptor to be observed.  Under Windows it must be
- * a #SOCKET.
- *
- * @fd_read_poll: A function that returns 1 if the @fd_read callback
- * should be fired.  If the function returns 0, the main loop will not
- * end its iteration even if @fd becomes readable.
- *
- * @fd_read: A level-triggered callback that is fired if @fd is readable
- * at the beginning of a main loop iteration, or if it becomes readable
- * during one.
- *
- * @fd_write: A level-triggered callback that is fired when @fd is writable
- * at the beginning of a main loop iteration, or if it becomes writable
- * during one.
- *
- * @opaque: A pointer-sized value that is passed to @fd_read_poll,
- * @fd_read and @fd_write.
- */
-int qemu_set_fd_handler2(int fd,
- IOCanReadHandler *fd_read_poll,
- IOHandler *fd_read,
- IOHandler *fd_write,
- void *opaque);
-
-/**
  * qemu_set_fd_handler: Register a file descriptor with the main loop
  *
  * This function tells the main loop to wake up whenever one of the
diff --git a/iohandler.c b/iohandler.c
index cca614f..d361cf2 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -33,7 +33,6 @@
 #endif
 
 typedef struct IOHandlerRecord {
-IOCanReadHandler *fd_read_poll;
 IOHandler *fd_read;
 IOHandler *fd_write;
 void *opaque;
@@ -46,14 +45,10 @@ typedef struct IOHandlerRecord {
 static QLIST_HEAD(, IOHandlerRecord) io_handlers =
 QLIST_HEAD_INITIALIZER(io_handlers);
 
-
-/* XXX: fd_read_poll should be suppressed, but an API change is
-   necessary in the character devices to suppress fd_can_read(). */
-int qemu_set_fd_handler2(int fd,
- IOCanReadHandler *fd_read_poll,
- IOHandler *fd_read,
- IOHandler *fd_write,
- void *opaque)
+int qemu_set_fd_handler(int fd,
+IOHandler *fd_read,
+IOHandler *fd_write,
+void *opaque)
 {
 IOHandlerRecord *ioh;
 
@@ -75,7 +70,6 @@ int 

[Qemu-devel] [PULL 05/16] tap: Drop tap_can_send

[Stefan Hajnoczi]

From: Fam Zheng f...@redhat.com

This callback is called by main loop before polling s-fd, if it returns
false, the fd will not be polled in this iteration.

This is redundant with checks inside read callback. After this patch,
the data will be sent to peer when it arrives. If the device can't
receive, it will be queued to incoming_queue, and when the device status
changes, this queue will be flushed.

Signed-off-by: Fam Zheng f...@redhat.com
Message-id: 1433400324-7358-7-git-send-email-f...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 net/tap.c | 13 ++---
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/net/tap.c b/net/tap.c
index d1ca314..0d184cf 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -62,14 +62,12 @@ typedef struct TAPState {
 static void launch_script(const char *setup_script, const char *ifname,
   int fd, Error **errp);
 
-static int tap_can_send(void *opaque);
 static void tap_send(void *opaque);
 static void tap_writable(void *opaque);
 
 static void tap_update_fd_handler(TAPState *s)
 {
-qemu_set_fd_handler2(s-fd,
- s-read_poll  s-enabled ? tap_can_send : NULL,
+qemu_set_fd_handler2(s-fd, NULL,
  s-read_poll  s-enabled ? tap_send : NULL,
  s-write_poll  s-enabled ? tap_writable : NULL,
  s);
@@ -166,13 +164,6 @@ static ssize_t tap_receive(NetClientState *nc, const 
uint8_t *buf, size_t size)
 return tap_write_packet(s, iov, 1);
 }
 
-static int tap_can_send(void *opaque)
-{
-TAPState *s = opaque;
-
-return qemu_can_send_packet(s-nc);
-}
-
 #ifndef __sun__
 ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
 {
@@ -192,7 +183,7 @@ static void tap_send(void *opaque)
 int size;
 int packets = 0;
 
-while (qemu_can_send_packet(s-nc)) {
+while (true) {
 uint8_t *buf = s-buf;
 
 size = tap_read_packet(s-fd, s-buf, sizeof(s-buf));
-- 
2.4.2

[Qemu-devel] [PULL 04/16] net/socket: Drop net_socket_can_send

[Stefan Hajnoczi]

From: Fam Zheng f...@redhat.com

This callback is called by main loop before polling s-fd, if it returns
false, the fd will not be polled in this iteration.

This is redundant with checks inside read callback. After this patch,
the data will be sent to peer when it arrives. If the device can't
receive, it will be queued to incoming_queue, and when the device status
changes, this queue will be flushed.

If the peer is not ready, disable the read poll until send completes.

Signed-off-by: Fam Zheng f...@redhat.com
Message-id: 1433400324-7358-6-git-send-email-f...@redhat.com
Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
---
 net/socket.c | 31 +++
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index 5a19aa1..7055d1e 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -51,18 +51,9 @@ typedef struct NetSocketState {
 static void net_socket_accept(void *opaque);
 static void net_socket_writable(void *opaque);
 
-/* Only read packets from socket when peer can receive them */
-static int net_socket_can_send(void *opaque)
-{
-NetSocketState *s = opaque;
-
-return qemu_can_send_packet(s-nc);
-}
-
 static void net_socket_update_fd_handler(NetSocketState *s)
 {
-qemu_set_fd_handler2(s-fd,
- s-read_poll  ? net_socket_can_send : NULL,
+qemu_set_fd_handler2(s-fd, NULL,
  s-read_poll  ? s-send_fn : NULL,
  s-write_poll ? net_socket_writable : NULL,
  s);
@@ -142,6 +133,15 @@ static ssize_t net_socket_receive_dgram(NetClientState 
*nc, const uint8_t *buf,
 return ret;
 }
 
+static void net_socket_send_completed(NetClientState *nc, ssize_t len)
+{
+NetSocketState *s = DO_UPCAST(NetSocketState, nc, nc);
+
+if (!s-read_poll) {
+net_socket_read_poll(s, true);
+}
+}
+
 static void net_socket_send(void *opaque)
 {
 NetSocketState *s = opaque;
@@ -211,9 +211,13 @@ static void net_socket_send(void *opaque)
 buf += l;
 size -= l;
 if (s-index = s-packet_len) {
-qemu_send_packet(s-nc, s-buf, s-packet_len);
 s-index = 0;
 s-state = 0;
+if (qemu_send_packet_async(s-nc, s-buf, size,
+   net_socket_send_completed) == 0) {
+net_socket_read_poll(s, false);
+break;
+}
 }
 break;
 }
@@ -234,7 +238,10 @@ static void net_socket_send_dgram(void *opaque)
 net_socket_write_poll(s, false);
 return;
 }
-qemu_send_packet(s-nc, s-buf, size);
+if (qemu_send_packet_async(s-nc, s-buf, size,
+   net_socket_send_completed) == 0) {
+net_socket_read_poll(s, false);
+}
 }
 
 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr, struct 
in_addr *localaddr)
-- 
2.4.2

Re: [Qemu-devel] [PATCH V2] pci: fixes to allow booting from extra root pci buses.

[Kevin O'Connor]

On Fri, Jun 12, 2015 at 11:25:50AM +0200, Laszlo Ersek wrote:
 On 06/11/15 21:24, Kevin O'Connor wrote:
  On Thu, Jun 11, 2015 at 08:34:56PM +0200, Laszlo Ersek wrote:
  On 06/11/15 19:46, Marcel Apfelbaum wrote:
  On 06/11/2015 07:54 PM, Kevin O'Connor wrote:
  On real machines, the firmware assigns the 4 - it's not a physical
  address; it's a logical address (like all bus numbers in PCI).  The
  firmware might assign a totally different number on the next boot.
  Now I am confused. Don't get me wrong, I am not an expert on fw, I hardly
  try to understand it.
 
  I looked up a real hardware machine and it seemed to me that the extra
  pci root numbers
  are provided in the ACPI tables, meaning by the vendor, not the fw.
  In this case QEMU is the vendor, i440fx is the machine, right?
 
  I am not aware that Seabios/OVMF are deciding the bus numbers for the
  *PCI roots*.
  They are doing it for the pci-2-pci bridges of course.
  I saw that Seabios is trying to guess the root-buses by going over all
  the 0-0xff range
  and probing all the slots, looking for devices. So it expects the hw to
  be hardwired regarding
  PCI root buses.
 
  This is exactly how I understood it.
 
  We're not interested in placing such bus numbers in device paths that
  are assigned during PCI enumeration. (Like subordinate bus numbers.)
  We're talking about the root bus numbers.
 
  OVMF implements the same kind of probing that SeaBIOS does (based on
  natural language description from Michael and Marcel, not on the actual
  code). Devices on the root buses respond without any prior bus number
  assignments.
  
  Alas, that is not correct.  Coreboot supports several AMD boards that
  have multiple southbridge chips which provide independent PCI root
  buses.  These chips have to be configured and assigned a bus number
  prior to use (which coreboot does).
 
 Thanks.
 
 Assuming such a physical hardware configuration, and that Coreboot
 configures the root buses before the SeaBIOS payload is launched: how
 does Coreboot identify a device, on a nonzero root bus, for SeaBIOS to
 boot from? Is that possible at all, or is the user expected to configure
 / select that in SeaBIOS exclusively?

Coreboot does not provide information on what to boot.  It's task is
low level hardware initialization.  It's the job of SeaBIOS to boot
the OS (and determine which media, etc to boot from).  SeaBIOS gets
boot preference information from a static configuration file
(bootorder) stored in flash (cbfs).

 Assuming there is no such feature between Coreboot and SeaBIOS (ie. one
 that would parallel our QEMU use case on physical hardware), what
 solution would you find acceptable for the case when QEMU basically
 promises I know where you'll find those root buses, and the bootorder
 fw_cfg file will match them?

We currently go to great lengths to avoid logical identifiers in
bootorder and I'm confused why we would wish to add them now.  Bus
number is not currently used anywhere in bootorder because (in the
general case) it's an arbitrary identifier that's not stable between
boots and (in the general case) may not be stable even within a boot.

I understand that in this specific case (extra root buses on QEMU) it
is stable within a boot, but it seems strange that we'd want to define
the interface knowing it's a poor choice in the general case.

As for what I would suggest - well, SeaBIOS has already supported
multiple root buses for years and already has a mechanism for
deterministically specifying a device on an extra root bus.  (By
specifying the N'th extra root bus instead of specifying the logical
id given to that bus).  This is by no means a perfect solution and
it's certainly open to change - but the current proposed patches
appear to be regressions to me.

 Could we simply make this patch conditional on runningOnQEMU()?

It's possible.  I'd certainly prefer to avoid adding special cases if
possible.

-Kevin

Re: [Qemu-devel] [PULL 20/22] hw/arm/boot: arm_load_kernel implemented as a machine init done notifier

[Peter Maydell]

On 12 June 2015 at 09:53, Eric Auger eric.au...@linaro.org wrote:
 On 06/12/2015 10:25 AM, Eric Auger wrote:
  I think it is because this is now delaying
 arm_load_kernel_notify call until after rom_load_all. From vl.c:

 if (rom_load_all() != 0) {
 fprintf(stderr, rom loading failed\n);
 exit(1);
 }

 /* TODO: once all bus devices are qdevified, this should be done
  * when bus is created by qdev.c */
 qemu_register_reset(qbus_reset_all_fn, sysbus_get_default());
 qemu_run_machine_init_done_notifiers();

 the machine_init_done_notifiers are called after the rom_load_all()
 call which does the image loading.

 Isn't the actual rom loading done in a reset notifier? If confirmed the
 problem comes from the fact the order of registration of reset notifiers
 for rom_reset and do_cpu_reset has swapped?

Yes, actual writing of rom data to ram happens in rom_reset_all().
This does seem to be called after arm_load_kernel_notify and
before do_cpu_reset, which is the order I would expect we require...

-- PMM

[Qemu-devel] [PULL 06/11] target-sh4: optimize addc using add2

[Aurelien Jarno]

Reviewed-by: Richard Henderson r...@twiddle.net
Signed-off-by: Aurelien Jarno aurel...@aurel32.net
---
 target-sh4/translate.c | 11 ---
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index bcdf4f3..5c90fe3 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -644,15 +644,12 @@ static void _decode_opc(DisasContext * ctx)
 case 0x300e:   /* addc Rm,Rn */
 {
 TCGv t0, t1;
-t0 = tcg_temp_new();
+t0 = tcg_const_tl(0);
 t1 = tcg_temp_new();
-tcg_gen_add_i32(t0, REG(B7_4), REG(B11_8));
-tcg_gen_add_i32(t1, cpu_sr_t, t0);
-tcg_gen_setcond_i32(TCG_COND_GTU, cpu_sr_t, REG(B11_8), t0);
-tcg_gen_setcond_i32(TCG_COND_GTU, t0, t0, t1);
-tcg_gen_or_i32(cpu_sr_t, cpu_sr_t, t0);
+tcg_gen_add2_i32(t1, cpu_sr_t, cpu_sr_t, t0, REG(B7_4), t0);
+tcg_gen_add2_i32(REG(B11_8), cpu_sr_t,
+ REG(B11_8), t0, t1, cpu_sr_t);
 tcg_temp_free(t0);
-tcg_gen_mov_i32(REG(B11_8), t1);
 tcg_temp_free(t1);
 }
return;
-- 
2.1.4