Re: [Qemu-devel] [PATCH 1/5] option: Make option help nicer to read

[Markus Armbruster]

Max Reitz  writes:

> This adds some whitespace into the option help (including indentation)
> and replaces '=' by ': ' (not least because '=' should be used for
> values, not types).  Furthermore, the list name is no longer printed as
> part of every line, but only once in advance, and only if the caller did
> not print a caption already.
>
> Signed-off-by: Max Reitz 
> ---
>  include/qemu/option.h  |   2 +-
>  qemu-img.c |   4 +-
>  util/qemu-option.c |  31 +-
>  tests/qemu-iotests/082.out | 956 ++---
>  4 files changed, 505 insertions(+), 488 deletions(-)

082 fails for me in master (dddb37495b8).  If this patch fixes the
failure, its commit message should mention it.

091 and 142 also fail, but look unrelated.

Re: [Qemu-devel] No more chameleon devices (was: [PATCH] virtio: Provide version-specific variants of virtio PCI devices)

[Gerd Hoffmann]

On Wed, Oct 17, 2018 at 07:57:39AM +0200, Markus Armbruster wrote:
> Laine Stump  writes:
> 
> [...]
> > In the end, having a device that changed PCI ID depending on what kind
> > of slot it was plugged into was an idea "too clever for its own good",
> > should be avoided when new devices are added in the future, and we
> > should at least provide an alternative that doesn't do that for existing
> > devices.
> 
> That means for each chameleon PCI/PCIe device:
> 
> * create a pair of devices that can only go into one kind of slot
> * deprecate the chameleon

I think virtio devices are the only ones which actually change the pci
id and have non-trivial differences.

qemu-xhci can likewise be plugged into both pci and pcie slots.  When
plugged into a pcie slot it'll have pcie endpoint capability.  That is
the only difference though.  Do you consider that a chameleon device?

cheers,
  Gerd

[Qemu-devel] No more chameleon devices (was: [PATCH] virtio: Provide version-specific variants of virtio PCI devices)

[Markus Armbruster]

Laine Stump  writes:

[...]
> In the end, having a device that changed PCI ID depending on what kind
> of slot it was plugged into was an idea "too clever for its own good",
> should be avoided when new devices are added in the future, and we
> should at least provide an alternative that doesn't do that for existing
> devices.

That means for each chameleon PCI/PCIe device:

* create a pair of devices that can only go into one kind of slot

* deprecate the chameleon

Yes, please!  Volunteers?

Do we have similar chameleons outside PCI?

[...]

[Qemu-devel] "no-user" for properties (was: [PATCH] virtio: Provide version-specific variants of virtio PCI devices)

[Markus Armbruster]

Gerd Hoffmann  writes:

>   Hi,
>
>> > See above.  We can't drop disable-modern.
>> 
>> Good point.  But this doesn't require it to be a supported device
>> option for users/management.  Maybe we should rename it to
>> "x-disable-modern" (but that's a separate discussion).
>
> I think it would be more useful to allow properties being tagged as
> "no-user", simliar to devices which we do not want be created via
> -device.

You mean user_creatable, which replaced
cannot_instantiate_with_device_add_yet, which used to be called no_user.

Yes, having something like that for properties would be a better user
interface than our current, lazy one "I'm showing you a bunch of stuff
you're supposed to ignore, and you're supposed to divine that from the
'x-' prefix".  Patches?

[...]

Re: [Qemu-devel] [PATCH v3 37/38] raw: Convert a warning to warn_report()

[Markus Armbruster]

Eric Blake  writes:

> On 10/16/18 12:41 PM, Markus Armbruster wrote:
>> Signed-off-by: Markus Armbruster 
>> ---
>>   block/raw-format.c | 17 +
>>   1 file changed, 9 insertions(+), 8 deletions(-)
>
> Incomplete. tests/qemu-iotests/109.out needs updating:
>
>> @@ -436,14 +437,14 @@ static int raw_open(BlockDriverState *bs, QDict 
>> *options, int flags,
>>   bs->file->bs->supported_zero_flags);
>> if (bs->probed && !bdrv_is_read_only(bs)) {
>> -fprintf(stderr,
>> -"WARNING: Image format was not specified for '%s' and 
>> probing "
>> -"guessed raw.\n"
>> -" Automatically detecting the format is dangerous 
>> for "
>> -"raw images, write operations on block 0 will be 
>> restricted.\n"
>> -" Specify the 'raw' format explicitly to remove the 
>> "
>> -"restrictions.\n",
>> -bs->file->bs->filename);
>> +warn_report("Image format was not specified for '%s' and probing "
>
> as this changes s/WARNING/warning/

Not run by "make check-block"...  Will fix, thanks!

Re: [Qemu-devel] [RFC 0/5] Improve balloon handling of pagesizes other than 4kiB

[David Gibson]

On Fri, Oct 12, 2018 at 01:26:45PM -0400, Michael S. Tsirkin wrote:
> On Fri, Oct 12, 2018 at 02:24:26PM +1100, David Gibson wrote:
> > The virtio-balloon devices was never really thought out for cases
> > other than 4kiB pagesize on both guest and host.  It works in some
> > cases, but in others can be ineffectual or even cause guest memory
> > corruption.
> > 
> > This series makes a handful of preliminary cleanups, then makes a
> > change to safely, though not perfectly, handle cases with non 4kiB
> > pagesizes.
> 
> BTW do you want to add an interface to specify the page size?
> I can see either host or guest or both supporting that.

To make this work, it really has to be advertised by the host.  Only
the host can know what a suitable discard granularity is.  It would
make the balloon more widely usable, however it makes the guest side
driver vastly more complex, since it will need to find contiguous
chunks of memory to discard.

Given the numerous problems with the balloon model (which David
Hildenbrand has and is continuing to point out), I'm not sure it's
work the trouble.

> Reviewed-by: Michael S. Tsirkin 
> 
> 
> > David Gibson (5):
> >   virtio-balloon: Remove unnecessary MADV_WILLNEED on deflate
> >   virtio-balloon: Corrections to address verification
> >   virtio-balloon: Rework ballon_page() interface
> >   virtio-balloon: Use ram_block_discard_range() instead of raw madvise()
> >   virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size
> > 
> >  hw/virtio/virtio-balloon.c | 100 -
> >  include/hw/virtio/virtio-balloon.h |   3 +
> >  2 files changed, 87 insertions(+), 16 deletions(-)
> > 
> 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [RFC 5/5] virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size

[David Gibson]

On Mon, Oct 15, 2018 at 09:08:45AM +0200, David Hildenbrand wrote:
> >>> This occurs in practice routinely for POWER KVM systems, since both host
> >>> and guest typically use 64kiB pages.
> >>>
> >>> To make this safe, without breaking that useful case, we need to
> >>> accumulate 4kiB balloon requests until we have a whole contiguous host 
> >>> page
> >>> at which point we can discard it.
> >>
> >> ... and if you have a 4k guest it will just randomly report pages and
> >> your 67 LOC tweak is useless.
> > 
> > Yes.
> > 
> >> And this can and will easily happen.
> > 
> > What cases are you thinking of?  For POWER at least, 4k on 64k will be
> > vastly less common than 64k on 64k.
> 
> Okay, I was wondering why we don't get tons of bug reports for 4k on
> 64k.

Right, and the answer is because 64k has been the normal configuration
on every major ppc64 distro for years (for both host and guest).

> So 64k on 64k while using ballooning is supported and heavily used
> then I guess? Because as you said, 4k on 64k triggers memory corruptions.

Right.

> >>> We could in principle do that across all guest memory, but it would 
> >>> require
> >>> a large bitmap to track.  This patch represents a compromise: instead we
> >>
> >> Oh god no, no tracking of all memory. (size of bitmap, memory hotplug,
> >> ... migration?)
> > 
> > Quite, that's why I didn't do it.  Although, I don't actually think
> > migration is such an issue: we *already* essentially lose track of
> > which pages are inside the balloon across migration.
> 
> Well, we migrate zero pages that get replaces by zero pages on the
> target. So at least KSM could recover them.

Right, but there's no explicit state being transferred.  In a sense,
KSM and zero page handling across migration resets the balloon to a
state optimized for the current memory state of the guest.

> >>> track ballooned subpages for a single contiguous host page at a time.  
> >>> This
> >>> means that if the guest discards all 4kiB chunks of a host page in
> >>> succession, we will discard it.  In particular that means the balloon will
> >>> continue to work for the (host page size) == (guest page size) > 4kiB 
> >>> case.
> >>>
> >>> If the guest scatters 4kiB requests across different host pages, we don't
> >>> discard anything, and issue a warning.  Not ideal, but at least we don't
> >>> corrupt guest memory as the previous version could.
> >>
> >> My take would be to somehow disable the balloon on the hypervisor side
> >> in case the host page size is not 4k. Like not allowing to realize it.
> >> No corruptions, no warnings people will ignore.
> > 
> > No, that's even worse than just having it silently do nothing on
> > non-4k setups.  Silently being useless we might get away with, we'll
> > just waste memory, but failing the device load will absolutely break
> > existing setups.
> 
> Silently consume more memory is very very evil. Think about
> auto-ballooning setups
> https://www.ovirt.org/documentation/how-to/autoballooning/

Well, sure, I don't think this is a good idea.

> But on the other hand, this has been broken forever for huge pages
> without printing warnings. Oh man, virtio-balloon ...
> 
> Disallowing to realize will only break migration from an old host to a
> new host. But migration will bail out right away.

The issue isn't really migration here.  If we prevent the balloon
device from realizing, guests which already had it configured simply
won't be able to start after qemu is updated.

> We could of course
> glue this to a compat machine,

We could, but what would it accomplish?  We'd still have to do
something for the old machine versions - so we're back at either
allowing memory corruption like we do right now, or batch gathering as
my patch proposes.

> but I guess the point you have is that
> customer want to continue using this "works by accident without memory
> corruptions" virtio-balloon implementation.

Right.  That's why I really think we need this batch-gathering
approach, ugly and irritating though it is.

> 
> > 
> >>> Signed-off-by: David Gibson 
> >>> ---
> >>>  hw/virtio/virtio-balloon.c | 67 +-
> >>>  include/hw/virtio/virtio-balloon.h |  3 ++
> >>>  2 files changed, 60 insertions(+), 10 deletions(-)
> >>>
> >>> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> >>> index 4435905c87..39573ef2e3 100644
> >>> --- a/hw/virtio/virtio-balloon.c
> >>> +++ b/hw/virtio/virtio-balloon.c
> >>> @@ -33,33 +33,80 @@
> >>>  
> >>>  #define BALLOON_PAGE_SIZE  (1 << VIRTIO_BALLOON_PFN_SHIFT)
> >>>  
> >>> +typedef struct PartiallyBalloonedPage {
> >>> +RAMBlock *rb;
> >>> +ram_addr_t base;
> >>> +unsigned long bitmap[];
> >>> +} PartiallyBalloonedPage;
> >>> +
> >>>  static void balloon_inflate_page(VirtIOBalloon *balloon,
> >>>   MemoryRegion *mr, hwaddr offset)
> >>>  {
> >>>  void *addr = memory_region_get_ram_ptr(mr) + offset;
> >>>  RAMBlock *rb;

Re: [Qemu-devel] [PATCH] macio/pmu: Fix missing vmsd terminator

[David Gibson]

On Tue, Oct 16, 2018 at 12:30:45PM +0100, Dr. David Alan Gilbert wrote:
> 
> I noticed this hadn't got merged - who wants it?

I think that's one for my tree, but I'm afraid I completely missed it
before.  It's generally best to CC me on ppc related patches,
otherwise I'm likely to lose them in the flood of qemu-devel.

Anyway, I dug it out of my archives and applied.

> 
> Dave
> 
> * Dr. David Alan Gilbert (dgilb...@redhat.com) wrote:
> > * Mark Cave-Ayland (mark.cave-ayl...@ilande.co.uk) wrote:
> > > On 27/07/18 14:44, Dr. David Alan Gilbert wrote:
> > > 
> > > > * Mark Cave-Ayland (mark.cave-ayl...@ilande.co.uk) wrote:
> > > > > On 27/07/18 13:31, Dr. David Alan Gilbert (git) wrote:
> > > > > 
> > > > > > From: "Dr. David Alan Gilbert" 
> > > > > > 
> > > > > > Fix missing terminator in VMStateDescription
> > > > > > 
> > > > > > Fixes: d811d61fbc6ca5f2be2185fd7cfa916e7ba613ce
> > > > > > Signed-off-by: Dr. David Alan Gilbert 
> > > > > > ---
> > > > > >hw/misc/macio/pmu.c | 1 +
> > > > > >1 file changed, 1 insertion(+)
> > > > > > 
> > > > > > diff --git a/hw/misc/macio/pmu.c b/hw/misc/macio/pmu.c
> > > > > > index e246b0fd41..27dfaf8a74 100644
> > > > > > --- a/hw/misc/macio/pmu.c
> > > > > > +++ b/hw/misc/macio/pmu.c
> > > > > > @@ -686,6 +686,7 @@ static const VMStateDescription vmstate_pmu_adb 
> > > > > > = {
> > > > > >VMSTATE_TIMER_PTR(adb_poll_timer, PMUState),
> > > > > >VMSTATE_UINT8(adb_reply_size, PMUState),
> > > > > >VMSTATE_BUFFER(adb_reply, PMUState),
> > > > > > +VMSTATE_END_OF_LIST()
> > > > > >}
> > > > > >};
> > > > > 
> > > > > Gah, yes indeed it certainly looks like I missed this whilst working 
> > > > > on the
> > > > > PMU code :(
> > > > > 
> > > > > Reviewed-by: Mark Cave-Ayland 
> > > > > 
> > > > > Just out of interest does a savevm/loadvm migration still succeed 
> > > > > once this
> > > > > has been added?
> > > > 
> > > > Have you got a suggested command line to test it with?
> > > 
> > > I'm effectively AFK until tomorrow now, but just quickly:
> > > 
> > > $ ./qemu-system-ppc -M mac99,via=pmu
> > > 
> > > Note that PMU support is new for 3.0 so there shouldn't be any backward
> > > compatibility issue here.
> > 
> > [root@virtlab414 try-64]# ./ppc-softmmu/qemu-system-ppc -M mac99,via=pmu 
> > -nographic /home/vms/dummy1.qcow2 
> > QEMU 2.12.50 monitor - type 'help' for more information
> > (qemu) ss>> et_property: NULL phandle
> > 
> > >> =
> > >> OpenBIOS 1.1 [Jun 18 2018 18:20]
> > >> Configuration device id QEMU version 1 machine id 1
> > >> CPUs: 1
> > >> Memory: 128M
> > >> UUID: ----
> > >> CPU type PowerPC,G4
> > milliseconds isn't unique.
> > saWelcome to OpenBIOS v1.1 built on Jun 18 2018 18:20
> > Trying hd:,\\:tbxi...
> > savTrying hd:,\ppc\bootinfo.txt...
> > Trying hd:,%BOOT...
> > saveNo valid state has been set by load or init-program
> > 
> > 
> > (qemu) 
> >   ok
> > 0 >   ok
> > 0 > (qemu) 
> > (qemu) savevm "frob"
> > (qemu) loadvm "frob"
> > (qemu) 
> >   ok
> > 0 > 2 2 + . 4  ok
> > 
> > Looks OK to me.
> > 
> > Dave
> > 
> > > 
> > > ATB,
> > > 
> > > Mark.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

[Qemu-devel] [PATCH v2] target/arm : add pvpanic mmio device

[Peng Hao]

Add pvpanic mmio device that is similar to x86's pvpanic device.

v1 ---> v2 add copyright and license for new files.

Signed-off-by: Peng Hao 
---
 default-configs/arm-softmmu.mak |  2 +-
 hw/arm/virt.c   | 21 +
 hw/misc/Makefile.objs   |  1 +
 hw/misc/pvpanic-mmio.c  | 97 +
 include/hw/arm/virt.h   |  1 +
 include/hw/misc/pvpanic-mmio.h  | 33 ++
 6 files changed, 154 insertions(+), 1 deletion(-)
 create mode 100644 hw/misc/pvpanic-mmio.c
 create mode 100644 include/hw/misc/pvpanic-mmio.h

diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index 2420491..4713c92 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -43,7 +43,7 @@ CONFIG_USB_MUSB=y
 CONFIG_USB_EHCI_SYSBUS=y
 CONFIG_PLATFORM_BUS=y
 CONFIG_VIRTIO_MMIO=y
-
+CONFIG_PVPANIC_MMIO=y
 CONFIG_ARM11MPCORE=y
 CONFIG_A9MPCORE=y
 CONFIG_A15MPCORE=y
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index a472566..ab41128 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -140,6 +140,7 @@ static const MemMapEntry a15memmap[] = {
 [VIRT_UART] =   { 0x0900, 0x1000 },
 [VIRT_RTC] ={ 0x0901, 0x1000 },
 [VIRT_FW_CFG] = { 0x0902, 0x0018 },
+[VIRT_PVPANIC_MMIO] =   { 0x09020018, 0x0002 },
 [VIRT_GPIO] =   { 0x0903, 0x1000 },
 [VIRT_SECURE_UART] ={ 0x0904, 0x1000 },
 [VIRT_SMMU] =   { 0x0905, 0x0002 },
@@ -798,6 +799,24 @@ static void create_gpio(const VirtMachineState *vms, 
qemu_irq *pic)
 g_free(nodename);
 }
 
+static void create_pvpanic_device(const VirtMachineState *vms)
+{
+char *nodename;
+hwaddr base = vms->memmap[VIRT_PVPANIC_MMIO].base;
+hwaddr size = vms->memmap[VIRT_PVPANIC_MMIO].size;
+
+sysbus_create_simple("pvpanic-mmio", base, NULL);
+
+nodename = g_strdup_printf("/pvpanic-mmio@%" PRIx64, base);
+qemu_fdt_add_subnode(vms->fdt, nodename);
+qemu_fdt_setprop_string(vms->fdt, nodename,
+"compatible", "pvpanic,mmio");
+qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
+ 2, base, 2, size);
+g_free(nodename);
+
+}
+
 static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
 {
 int i;
@@ -1544,6 +1563,8 @@ static void machvirt_init(MachineState *machine)
 
 create_pcie(vms, pic);
 
+create_pvpanic_device(vms);
+
 create_gpio(vms, pic);
 
 /* Create mmio transports, so the user can create virtio backends
diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index 6d50b03..6326260 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -71,6 +71,7 @@ obj-$(CONFIG_IOTKIT_SYSCTL) += iotkit-sysctl.o
 obj-$(CONFIG_IOTKIT_SYSINFO) += iotkit-sysinfo.o
 
 obj-$(CONFIG_PVPANIC) += pvpanic.o
+obj-$(CONFIG_PVPANIC_MMIO) += pvpanic-mmio.o
 obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
 obj-$(CONFIG_AUX) += auxbus.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_scu.o aspeed_sdmc.o
diff --git a/hw/misc/pvpanic-mmio.c b/hw/misc/pvpanic-mmio.c
new file mode 100644
index 000..bcb9791
--- /dev/null
+++ b/hw/misc/pvpanic-mmio.c
@@ -0,0 +1,97 @@
+/*
+ * pvpanic mmio device emulation
+ *
+ * Copyright (c) 2018 ZTE Ltd.
+ *
+ * Author:
+ *  Peng Hao 
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "sysemu/sysemu.h"
+#include "qemu/log.h"
+#include "hw/misc/pvpanic-mmio.h"
+
+#define PVPANIC_MMIO_FEAT_CRASHED  0
+
+#define PVPANIC_MMIO_CRASHED(1 << PVPANIC_MMIO_FEAT_CRASHED)
+
+static void handle_mmio_event(int event)
+{
+static bool logged;
+
+if (event & ~PVPANIC_MMIO_CRASHED && !logged) {
+qemu_log_mask(LOG_GUEST_ERROR, "pvpanic-mmio: unknown event %#x.\n", 
event);
+logged = true;
+}
+
+if (event & PVPANIC_MMIO_CRASHED) {
+qemu_system_guest_panicked(NULL);
+return;
+}
+}
+
+static uint64_t pvpanic_mmio_read(void *opaque, hwaddr addr, unsigned size)
+{
+return -1;
+}
+
+static void pvpanic_mmio_write(void *opaque, hwaddr addr, uint64_t value,
+ unsigned size)
+{
+   handle_mmio_event(value);
+}
+
+static const MemoryRegionOps pvpanic_mmio_ops = {
+.read = pvpanic_mmio_read,
+.write = pvpanic_mmio_write,
+.impl =

[Qemu-devel] [PATCH 2/3] linux-user: Fix shmat emulation by honoring host SHMLBA

[Richard Henderson]

For those hosts with SHMLBA > getpagesize, we don't automatically
select a guest address that is compatible with the host.  We can
achieve this by boosting the alignment of guest_base and by adding
an extra alignment argument to mmap_find_vma.

Signed-off-by: Richard Henderson 
---
 linux-user/qemu.h|  2 +-
 linux-user/elfload.c | 17 +-
 linux-user/mmap.c| 74 +++-
 linux-user/syscall.c |  3 +-
 4 files changed, 52 insertions(+), 44 deletions(-)

diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index b4959e41c6..67a4f3c020 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -439,7 +439,7 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong 
old_size,
abi_ulong new_addr);
 extern unsigned long last_brk;
 extern abi_ulong mmap_next_start;
-abi_ulong mmap_find_vma(abi_ulong, abi_ulong);
+abi_ulong mmap_find_vma(abi_ulong, abi_ulong, abi_ulong);
 void mmap_fork_start(void);
 void mmap_fork_end(int child);
 
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 10bca65b99..ec200a39ad 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3,6 +3,7 @@
 #include 
 
 #include 
+#include 
 
 #include "qemu.h"
 #include "disas/disas.h"
@@ -1942,6 +1943,8 @@ unsigned long init_guest_space(unsigned long host_start,
unsigned long guest_start,
bool fixed)
 {
+/* In order to use host shmat, we must be able to honor SHMLBA.  */
+unsigned long align = MAX(SHMLBA, qemu_host_page_size);
 unsigned long current_start, aligned_start;
 int flags;
 
@@ -1959,7 +1962,7 @@ unsigned long init_guest_space(unsigned long host_start,
 }
 
 /* Setup the initial flags and start address.  */
-current_start = host_start & qemu_host_page_mask;
+current_start = host_start & -align;
 flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
 if (fixed) {
 flags |= MAP_FIXED;
@@ -1995,8 +1998,8 @@ unsigned long init_guest_space(unsigned long host_start,
 return (unsigned long)-1;
 }
 munmap((void *)real_start, host_full_size);
-if (real_start & ~qemu_host_page_mask) {
-/* The same thing again, but with an extra qemu_host_page_size
+if (real_start & (align - 1)) {
+/* The same thing again, but with extra
  * so that we can shift around alignment.
  */
 unsigned long real_size = host_full_size + qemu_host_page_size;
@@ -2009,7 +2012,7 @@ unsigned long init_guest_space(unsigned long host_start,
 return (unsigned long)-1;
 }
 munmap((void *)real_start, real_size);
-real_start = HOST_PAGE_ALIGN(real_start);
+real_start = ROUND_UP(real_start, align);
 }
 current_start = real_start;
 }
@@ -2036,7 +2039,7 @@ unsigned long init_guest_space(unsigned long host_start,
 }
 
 /* Ensure the address is properly aligned.  */
-if (real_start & ~qemu_host_page_mask) {
+if (real_start & (align - 1)) {
 /* Ideally, we adjust like
  *
  *pages: [  ][  ][  ][  ][  ]
@@ -2064,7 +2067,7 @@ unsigned long init_guest_space(unsigned long host_start,
 if (real_start == (unsigned long)-1) {
 return (unsigned long)-1;
 }
-aligned_start = HOST_PAGE_ALIGN(real_start);
+aligned_start = ROUND_UP(real_start, align);
 } else {
 aligned_start = real_start;
 }
@@ -2101,7 +2104,7 @@ unsigned long init_guest_space(unsigned long host_start,
  * because of trouble with ARM commpage setup.
  */
 munmap((void *)real_start, real_size);
-current_start += qemu_host_page_size;
+current_start += align;
 if (host_start == current_start) {
 /* Theoretically possible if host doesn't have any suitably
  * aligned areas.  Normally the first mmap will fail.
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 41e0983ce8..47950ee9d7 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -202,49 +202,52 @@ unsigned long last_brk;
 
 /* Subroutine of mmap_find_vma, used when we have pre-allocated a chunk
of guest address space.  */
-static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size)
+static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
+abi_ulong align)
 {
-abi_ulong addr;
-abi_ulong end_addr;
+abi_ulong addr, end_addr, incr = qemu_host_page_size;
 int prot;
-int looped = 0;
+bool looped = false;
 
 if (size > reserved_va) {
 return (abi_ulong)-1;
 }
 
-size = HOST_PAGE_ALIGN(size);
-end_addr = start + size;
-if (end_addr > reserved_va) {
-end_addr = reserved_va;
-}
-addr = end_addr - qemu_host_page_size;
+/* Note 

[Qemu-devel] [PATCH 3/3] linux-user: Align mmap_find_vma to host page size

[Richard Henderson]

This can avoid stack allocation failures for i386 guest
on ppc64 (64k page) host.

Suggested-by: Laurent Vivier 
Signed-off-by: Richard Henderson 
---
 linux-user/mmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 47950ee9d7..735bc928fe 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -262,6 +262,8 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, 
abi_ulong align)
 abi_ulong addr;
 int wrapped, repeat;
 
+align = MAX(align, qemu_host_page_size);
+
 /* If 'start' == 0, then a default start address is used. */
 if (start == 0) {
 start = mmap_next_start;
-- 
2.17.2

[Qemu-devel] [PATCH 1/3] tests/tcg/multiarch/linux-test: Fix error check for shmat

[Richard Henderson]

The error indicator for this syscall is -1, not 0.

Signed-off-by: Richard Henderson 
---
 tests/tcg/multiarch/linux-test.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/tcg/multiarch/linux-test.c b/tests/tcg/multiarch/linux-test.c
index e80eccc0ce..6d2c02c5c0 100644
--- a/tests/tcg/multiarch/linux-test.c
+++ b/tests/tcg/multiarch/linux-test.c
@@ -503,8 +503,9 @@ static void test_shm(void)
 
 shmid = chk_error(shmget(IPC_PRIVATE, SHM_SIZE, IPC_CREAT | 0777));
 ptr = shmat(shmid, NULL, 0);
-if (!ptr)
+if (ptr == (void *)-1) {
 error("shmat");
+}
 
 memset(ptr, 0, SHM_SIZE);
 
-- 
2.17.2

[Qemu-devel] [PATCH 0/3] linux-user: Fix shmat by honoring SHMLBA

[Richard Henderson]

These three patches were posted independently back in July.
The second patch has been modified for feedback from Laurent.

C.f.
  http://lists.nongnu.org/archive/html/qemu-devel/2018-07/msg01999.html
  http://lists.nongnu.org/archive/html/qemu-devel/2018-07/msg02180.html
  http://lists.nongnu.org/archive/html/qemu-devel/2018-07/msg02652.html


r~


Richard Henderson (3):
  tests/tcg/multiarch/linux-test: Fix error check for shmat
  linux-user: Fix shmat emulation by honoring host SHMLBA
  linux-user: Align mmap_find_vma to host page size

 linux-user/qemu.h|  2 +-
 linux-user/elfload.c | 17 ---
 linux-user/mmap.c| 76 +---
 linux-user/syscall.c |  3 +-
 tests/tcg/multiarch/linux-test.c |  3 +-
 5 files changed, 56 insertions(+), 45 deletions(-)

-- 
2.17.2

Re: [Qemu-devel] [PATCH 1/3] archive-source.sh: Modern shellscripting (use $() instead of ``)

[maozy]

Hi, Eric

On 10/15/18 11:44 PM, Eric Blake wrote:

On 10/15/18 1:51 AM, Mao Zhongyi wrote:

Various shell files contain a mix between obsolete `` and
modern $(); use of `` is only required when using /bin/sh
on Solaris. It would be nice to convert to using $()
everywhere, or at least in all bash scripts, as well as in
all scripts that are known to not be run on Solaris.


Did you have a particular program you used to find these, or just grep?


Just grep in scripts dir, I also entered the file to make sure I didn't 
missing anything. In addition, I will send a separated patch to replace 
all obsolete `` in the source tree.




Also, when sending a series, don't forget a 0/3 cover letter.



OK, I see. :)
 Thanks,
Mao



Signed-off-by: Mao Zhongyi 
---
  scripts/archive-source.sh | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

Re: [Qemu-devel] [PATCH] target/arm : add pvpanic mmio device

[peng.hao2]

>On 10/17/18 2:23 AM, Peng Hao wrote:
>> +++ b/hw/misc/pvpanic-mmio.c
>> @@ -0,0 +1,76 @@
>> +#include "qemu/osdep.h"
>
>New file requires file header w/ copyright and license.
I will handle it in new version .Thanks

>r~

Re: [Qemu-devel] [PATCH V5 1/4] target-i386: introduce coalesced_pio kvm headerupdate

[peng.hao2]

On Fri, Aug 31, 2018 at 05:05:02PM +0800, Peng Hao wrote:
>> add coalesced_pio's struct and KVM_CAP_COALESCED_PIO header.
>>
>> Signed-off-by: Peng Hao 
>
>I can merge ths together with q35 patch, but pls
>get acks from kvm folks, to this end fix up
>commit logs and subjects to match reality and repost.
the kvm kernel part  of the patch has merged. 
https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?h=queue&id=0804c849f1df0992d39a37c4fc259f7f8b16f385
But the  KVM_CAP_COALESCED_PIO has changed to 162, I will send patches again.

Re: [Qemu-devel] [PATCH] target/arm : add pvpanic mmio device

[Richard Henderson]

On 10/17/18 2:23 AM, Peng Hao wrote:
> +++ b/hw/misc/pvpanic-mmio.c
> @@ -0,0 +1,76 @@
> +#include "qemu/osdep.h"

New file requires file header w/ copyright and license.


r~

[Qemu-devel] [PATCH] target/arm : add pvpanic mmio device

[Peng Hao]

Add pvpanic mmio device that is similar to x86's pvpanic device.

Signed-off-by: Peng Hao 
---
 default-configs/arm-softmmu.mak |  2 +-
 hw/arm/virt.c   | 21 
 hw/misc/Makefile.objs   |  1 +
 hw/misc/pvpanic-mmio.c  | 76 +
 include/hw/arm/virt.h   |  1 +
 include/hw/misc/pvpanic-mmio.h  | 12 +++
 6 files changed, 112 insertions(+), 1 deletion(-)
 create mode 100644 hw/misc/pvpanic-mmio.c
 create mode 100644 include/hw/misc/pvpanic-mmio.h

diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index 2420491..4713c92 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -43,7 +43,7 @@ CONFIG_USB_MUSB=y
 CONFIG_USB_EHCI_SYSBUS=y
 CONFIG_PLATFORM_BUS=y
 CONFIG_VIRTIO_MMIO=y
-
+CONFIG_PVPANIC_MMIO=y
 CONFIG_ARM11MPCORE=y
 CONFIG_A9MPCORE=y
 CONFIG_A15MPCORE=y
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index a472566..ab41128 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -140,6 +140,7 @@ static const MemMapEntry a15memmap[] = {
 [VIRT_UART] =   { 0x0900, 0x1000 },
 [VIRT_RTC] ={ 0x0901, 0x1000 },
 [VIRT_FW_CFG] = { 0x0902, 0x0018 },
+[VIRT_PVPANIC_MMIO] =   { 0x09020018, 0x0002 },
 [VIRT_GPIO] =   { 0x0903, 0x1000 },
 [VIRT_SECURE_UART] ={ 0x0904, 0x1000 },
 [VIRT_SMMU] =   { 0x0905, 0x0002 },
@@ -798,6 +799,24 @@ static void create_gpio(const VirtMachineState *vms, 
qemu_irq *pic)
 g_free(nodename);
 }
 
+static void create_pvpanic_device(const VirtMachineState *vms)
+{
+char *nodename;
+hwaddr base = vms->memmap[VIRT_PVPANIC_MMIO].base;
+hwaddr size = vms->memmap[VIRT_PVPANIC_MMIO].size;
+
+sysbus_create_simple("pvpanic-mmio", base, NULL);
+
+nodename = g_strdup_printf("/pvpanic-mmio@%" PRIx64, base);
+qemu_fdt_add_subnode(vms->fdt, nodename);
+qemu_fdt_setprop_string(vms->fdt, nodename,
+"compatible", "pvpanic,mmio");
+qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
+ 2, base, 2, size);
+g_free(nodename);
+
+}
+
 static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
 {
 int i;
@@ -1544,6 +1563,8 @@ static void machvirt_init(MachineState *machine)
 
 create_pcie(vms, pic);
 
+create_pvpanic_device(vms);
+
 create_gpio(vms, pic);
 
 /* Create mmio transports, so the user can create virtio backends
diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index 6d50b03..6326260 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -71,6 +71,7 @@ obj-$(CONFIG_IOTKIT_SYSCTL) += iotkit-sysctl.o
 obj-$(CONFIG_IOTKIT_SYSINFO) += iotkit-sysinfo.o
 
 obj-$(CONFIG_PVPANIC) += pvpanic.o
+obj-$(CONFIG_PVPANIC_MMIO) += pvpanic-mmio.o
 obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
 obj-$(CONFIG_AUX) += auxbus.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_scu.o aspeed_sdmc.o
diff --git a/hw/misc/pvpanic-mmio.c b/hw/misc/pvpanic-mmio.c
new file mode 100644
index 000..c7f373e
--- /dev/null
+++ b/hw/misc/pvpanic-mmio.c
@@ -0,0 +1,76 @@
+#include "qemu/osdep.h"
+#include "sysemu/sysemu.h"
+#include "qemu/log.h"
+#include "hw/misc/pvpanic-mmio.h"
+
+#define PVPANIC_MMIO_FEAT_CRASHED  0
+
+#define PVPANIC_MMIO_CRASHED(1 << PVPANIC_MMIO_FEAT_CRASHED)
+
+static void handle_mmio_event(int event)
+{
+static bool logged;
+
+if (event & ~PVPANIC_MMIO_CRASHED && !logged) {
+qemu_log_mask(LOG_GUEST_ERROR, "pvpanic-mmio: unknown event %#x.\n", 
event);
+logged = true;
+}
+
+if (event & PVPANIC_MMIO_CRASHED) {
+qemu_system_guest_panicked(NULL);
+return;
+}
+}
+
+static uint64_t pvpanic_mmio_read(void *opaque, hwaddr addr, unsigned size)
+{
+return -1;
+}
+
+static void pvpanic_mmio_write(void *opaque, hwaddr addr, uint64_t value,
+ unsigned size)
+{
+   handle_mmio_event(value);
+}
+
+static const MemoryRegionOps pvpanic_mmio_ops = {
+.read = pvpanic_mmio_read,
+.write = pvpanic_mmio_write,
+.impl = {
+.min_access_size = 1,
+.max_access_size = 2,
+},
+};
+
+
+static void pvpanic_mmio_initfn(Object *obj)
+{
+PVPanicState *s = PVPANIC_MMIO_DEVICE(obj);
+SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+memory_region_init_io(&s->mmio, OBJECT(s), &pvpanic_mmio_ops, s,
+  "pvpanic-mmio", 2);
+sysbus_init_mmio(sbd, &s->mmio);
+}
+
+static void pvpanic_mmio_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+
+set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_mmio_info = {
+.name  = TYPE_PVPANIC_MMIO,
+.parent= TYPE_SYS_BUS_DEVICE,
+.instance_size = sizeof(PVPanicState),
+.instance_init = pvpanic_mmio_initfn,
+.cla

[Qemu-devel] [PATCH] target/arm : add pvpanic mmio device

[Peng Hao]

From: root 

Add pvpanic mmio device that is similar to x86's pvpanic device.

Signed-off-by: Peng Hao 
---
 default-configs/arm-softmmu.mak |  2 +-
 hw/arm/virt.c   | 21 
 hw/misc/Makefile.objs   |  1 +
 hw/misc/pvpanic-mmio.c  | 76 +
 include/hw/arm/virt.h   |  1 +
 include/hw/misc/pvpanic-mmio.h  | 12 +++
 6 files changed, 112 insertions(+), 1 deletion(-)
 create mode 100644 hw/misc/pvpanic-mmio.c
 create mode 100644 include/hw/misc/pvpanic-mmio.h

diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index 2420491..4713c92 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -43,7 +43,7 @@ CONFIG_USB_MUSB=y
 CONFIG_USB_EHCI_SYSBUS=y
 CONFIG_PLATFORM_BUS=y
 CONFIG_VIRTIO_MMIO=y
-
+CONFIG_PVPANIC_MMIO=y
 CONFIG_ARM11MPCORE=y
 CONFIG_A9MPCORE=y
 CONFIG_A15MPCORE=y
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index a472566..ab41128 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -140,6 +140,7 @@ static const MemMapEntry a15memmap[] = {
 [VIRT_UART] =   { 0x0900, 0x1000 },
 [VIRT_RTC] ={ 0x0901, 0x1000 },
 [VIRT_FW_CFG] = { 0x0902, 0x0018 },
+[VIRT_PVPANIC_MMIO] =   { 0x09020018, 0x0002 },
 [VIRT_GPIO] =   { 0x0903, 0x1000 },
 [VIRT_SECURE_UART] ={ 0x0904, 0x1000 },
 [VIRT_SMMU] =   { 0x0905, 0x0002 },
@@ -798,6 +799,24 @@ static void create_gpio(const VirtMachineState *vms, 
qemu_irq *pic)
 g_free(nodename);
 }
 
+static void create_pvpanic_device(const VirtMachineState *vms)
+{
+char *nodename;
+hwaddr base = vms->memmap[VIRT_PVPANIC_MMIO].base;
+hwaddr size = vms->memmap[VIRT_PVPANIC_MMIO].size;
+
+sysbus_create_simple("pvpanic-mmio", base, NULL);
+
+nodename = g_strdup_printf("/pvpanic-mmio@%" PRIx64, base);
+qemu_fdt_add_subnode(vms->fdt, nodename);
+qemu_fdt_setprop_string(vms->fdt, nodename,
+"compatible", "pvpanic,mmio");
+qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
+ 2, base, 2, size);
+g_free(nodename);
+
+}
+
 static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
 {
 int i;
@@ -1544,6 +1563,8 @@ static void machvirt_init(MachineState *machine)
 
 create_pcie(vms, pic);
 
+create_pvpanic_device(vms);
+
 create_gpio(vms, pic);
 
 /* Create mmio transports, so the user can create virtio backends
diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index 6d50b03..6326260 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -71,6 +71,7 @@ obj-$(CONFIG_IOTKIT_SYSCTL) += iotkit-sysctl.o
 obj-$(CONFIG_IOTKIT_SYSINFO) += iotkit-sysinfo.o
 
 obj-$(CONFIG_PVPANIC) += pvpanic.o
+obj-$(CONFIG_PVPANIC_MMIO) += pvpanic-mmio.o
 obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
 obj-$(CONFIG_AUX) += auxbus.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_scu.o aspeed_sdmc.o
diff --git a/hw/misc/pvpanic-mmio.c b/hw/misc/pvpanic-mmio.c
new file mode 100644
index 000..c7f373e
--- /dev/null
+++ b/hw/misc/pvpanic-mmio.c
@@ -0,0 +1,76 @@
+#include "qemu/osdep.h"
+#include "sysemu/sysemu.h"
+#include "qemu/log.h"
+#include "hw/misc/pvpanic-mmio.h"
+
+#define PVPANIC_MMIO_FEAT_CRASHED  0
+
+#define PVPANIC_MMIO_CRASHED(1 << PVPANIC_MMIO_FEAT_CRASHED)
+
+static void handle_mmio_event(int event)
+{
+static bool logged;
+
+if (event & ~PVPANIC_MMIO_CRASHED && !logged) {
+qemu_log_mask(LOG_GUEST_ERROR, "pvpanic-mmio: unknown event %#x.\n", 
event);
+logged = true;
+}
+
+if (event & PVPANIC_MMIO_CRASHED) {
+qemu_system_guest_panicked(NULL);
+return;
+}
+}
+
+static uint64_t pvpanic_mmio_read(void *opaque, hwaddr addr, unsigned size)
+{
+return -1;
+}
+
+static void pvpanic_mmio_write(void *opaque, hwaddr addr, uint64_t value,
+ unsigned size)
+{
+   handle_mmio_event(value);
+}
+
+static const MemoryRegionOps pvpanic_mmio_ops = {
+.read = pvpanic_mmio_read,
+.write = pvpanic_mmio_write,
+.impl = {
+.min_access_size = 1,
+.max_access_size = 2,
+},
+};
+
+
+static void pvpanic_mmio_initfn(Object *obj)
+{
+PVPanicState *s = PVPANIC_MMIO_DEVICE(obj);
+SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+memory_region_init_io(&s->mmio, OBJECT(s), &pvpanic_mmio_ops, s,
+  "pvpanic-mmio", 2);
+sysbus_init_mmio(sbd, &s->mmio);
+}
+
+static void pvpanic_mmio_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+
+set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_mmio_info = {
+.name  = TYPE_PVPANIC_MMIO,
+.parent= TYPE_SYS_BUS_DEVICE,
+.instance_size = sizeof(PVPanicState),
+.instance_init = pvpanic_mmio_init

Re: [Qemu-devel] [PATCH v6 13/14] target/arm: Implement PMSWINC

[Richard Henderson]

On 10/10/18 1:37 PM, Aaron Lindsay wrote:
> Signed-off-by: Aaron Lindsay 
> ---
>  target/arm/helper.c | 39 +--
>  1 file changed, 37 insertions(+), 2 deletions(-)
Reviewed-by: Richard Henderson 


r~

Re: [Qemu-devel] [PATCH v6 12/14] target/arm: PMU: Set PMCR.N to 4

[Richard Henderson]

On 10/10/18 1:37 PM, Aaron Lindsay wrote:
> This both advertises that we support four counters and enables them
> because the pmu_num_counters() reads this value from PMCR.
> 
> Signed-off-by: Aaron Lindsay 
> ---
>  target/arm/helper.c | 8 
>  1 file changed, 4 insertions(+), 4 deletions(-)

It looks like this should have been folded into patch 10,
or patch 10 split to include the code changes that go with
these comment changes.


r~

Re: [Qemu-devel] [PATCH v6 11/14] target/arm: PMU: Add instruction and cycle events

[Richard Henderson]

On 10/10/18 1:37 PM, Aaron Lindsay wrote:
> + * Return the underlying cycle count for the PMU cycle counters. If we're in
> + * usermode, simply return 0.
> + */
> +static uint64_t cycles_get_count(CPUARMState *env)
> +{
> +#ifndef CONFIG_USER_ONLY
> +return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
> +   ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
> +#else
> +return 0;
> +#endif
> +}

Usually we pass through the host cycle counter.
See cpu_get_host_ticks().


r~

Re: [Qemu-devel] [PATCH v6 10/14] target/arm: Finish implementation of PM[X]EVCNTR and PM[X]EVTYPER

[Richard Henderson]

On 10/10/18 1:37 PM, Aaron Lindsay wrote:
> Add arrays to hold the registers, the definitions themselves, access
> functions, and logic to reset counters when PMCR.P is set. Update
> filtering code to support counters other than PMCCNTR. Support migration
> with raw read/write functions.
> 
> Signed-off-by: Aaron Lindsay 
> Signed-off-by: Aaron Lindsay 
> ---
>  target/arm/cpu.h|   3 +
>  target/arm/helper.c | 296 +---
>  2 files changed, 282 insertions(+), 17 deletions(-)

Reviewed-by: Richard Henderson 


r~

[Qemu-devel] [PATCH] Acceptance tests: host arch to target arch name mapping

[Cleber Rosa]

The host arch name is not always the target arch name, so it's
necessary to have a mapping.

The configure scripts contains what is the authoritative and failproof
mapping, but, reusing it is not straightforward, so it's replicated in
the acceptance tests supporting code.

Signed-off-by: Cleber Rosa 
---
 configure |  2 ++
 tests/acceptance/avocado_qemu/__init__.py | 23 +++
 2 files changed, 25 insertions(+)

diff --git a/configure b/configure
index 8af2be959f..e029b756d4 100755
--- a/configure
+++ b/configure
@@ -6992,6 +6992,8 @@ TARGET_ARCH="$target_name"
 TARGET_BASE_ARCH=""
 TARGET_ABI_DIR=""
 
+# When updating target_name => TARGET_ARCH, please also update the
+# HOST_TARGET_ARCH mapping in tests/acceptance/avocado_qemu/__init__.py
 case "$target_name" in
   i386)
 mttcg="yes"
diff --git a/tests/acceptance/avocado_qemu/__init__.py 
b/tests/acceptance/avocado_qemu/__init__.py
index 1e54fd5932..d9bc4736ec 100644
--- a/tests/acceptance/avocado_qemu/__init__.py
+++ b/tests/acceptance/avocado_qemu/__init__.py
@@ -19,6 +19,28 @@ sys.path.append(os.path.join(SRC_ROOT_DIR, 'scripts'))
 
 from qemu import QEMUMachine
 
+
+#: Mapping of host arch names to target arch names.  It's expected that the
+#: arch identification on the host, using os.uname()[4], would return the
+#: key (LHS).  The QEMU target name, and consequently the target binary, would
+#: be based on the name on the value (RHS).
+HOST_TARGET_ARCH = {
+'armeb': 'arm',
+'aarch64_be': 'aarch64',
+'microblazeel': 'microblaze',
+'mipsel': 'mips',
+'mipsn32el' : 'mips64',
+'mips64el': 'mips64',
+'or1k': 'openrisc',
+'ppc64le': 'ppc64',
+'ppc64abi32': 'ppc64',
+'riscv64': 'riscv',
+'sh4eb': 'sh4',
+'sparc32plus': 'sparc64',
+'xtensaeb': 'xtensa'
+}
+
+
 def is_readable_executable_file(path):
 return os.path.isfile(path) and os.access(path, os.R_OK | os.X_OK)
 
@@ -29,6 +51,7 @@ def pick_default_qemu_bin():
 directory or in the source tree root directory.
 """
 arch = os.uname()[4]
+arch = HOST_TARGET_ARCH.get(arch, arch)
 qemu_bin_relative_path = os.path.join("%s-softmmu" % arch,
   "qemu-system-%s" % arch)
 if is_readable_executable_file(qemu_bin_relative_path):
-- 
2.17.1

[Qemu-devel] [PULL 0/1] target/hppa patch queue

[Richard Henderson]

The following changes since commit 09558375a634e17cea6cfbfec883ac2376d2dc7f:

  Merge remote-tracking branch 
'remotes/pmaydell/tags/pull-target-arm-20181016-1' into staging (2018-10-16 
17:42:56 +0100)

are available in the Git repository at:

  https://github.com/rth7680/qemu.git tags/pull-hppa-20181016

for you to fetch changes up to 5f538f75324ef69d624b5f71ab2c7f4e72a7d744:

  target/hppa: Raise exception 26 on emulated hardware (2018-10-16 15:32:22 
-0700)


Queued hppa patch


Helge Deller (1):
  target/hppa: Raise exception 26 on emulated hardware

 target/hppa/mem_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

[Qemu-devel] [PULL 1/1] target/hppa: Raise exception 26 on emulated hardware

[Richard Henderson]

From: Helge Deller 

On PCXS chips (PA7000, pa 1.1a), trap #18 is raised on memory faults,
while all later chips (>= PA7100) generate either trap #26, #27 or #28
(depending on the fault type).

Since the current qemu emulation emulates a B160L machine (with a
PA7300LC PCX-L2 chip, we should raise trap #26 (EXCP_DMAR) instead
of #18 (EXCP_DMP) on access faults by the Linux kernel to page zero.

With the patch we now get the correct output (I tested against real
hardware):
 Kernel Fault: Code=26 (Data memory access rights trap)
instead of:
 Kernel Fault: Code=18 (Data memory protection/unaligned access trap)

Signed-off-by: Helge Deller 
Message-Id: <20181007205153.ga30...@ls3530.fritz.box>
Signed-off-by: Richard Henderson 
---
 target/hppa/mem_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index ab160c2a74..aecf3075f6 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -137,7 +137,8 @@ int hppa_get_physical_address(CPUHPPAState *env, vaddr 
addr, int mmu_idx,
 
 if (unlikely(!(prot & type))) {
 /* The access isn't allowed -- Inst/Data Memory Protection Fault.  */
-ret = (type & PAGE_EXEC ? EXCP_IMP : EXCP_DMP);
+ret = (type & PAGE_EXEC ? EXCP_IMP :
+   prot & PAGE_READ ? EXCP_DMP : EXCP_DMAR);
 goto egress;
 }
 
-- 
2.17.2

Re: [Qemu-devel] [RFC PATCH v1 1/4] VFIO KABI for migration interface

[Alex Williamson]

On Tue, 16 Oct 2018 23:42:35 +0530
Kirti Wankhede  wrote:

> - Added vfio_device_migration_info structure to use interact with vendor
>   driver.
> - Different flags are used to get or set migration related information
>   from/to vendor driver.
> Flag VFIO_MIGRATION_PROBE: To query if feature is supported
> Flag VFIO_MIGRATION_GET_REGION: To get migration region info
> Flag VFIO_MIGRATION_SET_STATE: To convey device state in vendor driver
> Flag VFIO_MIGRATION_GET_PENDING: To get pending bytes yet to be migrated
>   from vendor driver
> Flag VFIO_MIGRATION_GET_BUFFER: On this flag, vendor driver should write
>   data to migration region and return number of bytes written in the region
> Flag VFIO_MIGRATION_SET_BUFFER: In migration resume path, user space app
>   writes to migration region and communicates it to vendor driver with
>   this ioctl with this flag.
> Flag VFIO_MIGRATION_GET_DIRTY_PFNS: Get bitmap of dirty pages from vendor
>   driver from given start address
> 
> - Added enum for possible device states.
> 
> Signed-off-by: Kirti Wankhede 
> Reviewed-by: Neo Jia 
> ---
>  linux-headers/linux/vfio.h | 91 
> ++
>  1 file changed, 91 insertions(+)
> 
> diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
> index 3615a269d378..8e9045ed9aa8 100644
> --- a/linux-headers/linux/vfio.h
> +++ b/linux-headers/linux/vfio.h
> @@ -602,6 +602,97 @@ struct vfio_device_ioeventfd {
>  
>  #define VFIO_DEVICE_IOEVENTFD_IO(VFIO_TYPE, VFIO_BASE + 16)
>  
> +/**
> + * VFIO_DEVICE_MIGRATION_INFO - _IOW(VFIO_TYPE, VFIO_BASE + 17,
> + *  struct vfio_device_migration_info)

This is quite a bit more than an "INFO" ioctl.

> + * Flag VFIO_MIGRATION_PROBE:
> + *  To query if feature is supported
> + *
> + * Flag VFIO_MIGRATION_GET_REGION:
> + *  To get migration region info
> + *  region_index [output] : region index to be used for migration region
> + *  size [output]: size of migration region

Of course the region migration region can describe itself as being used
for migration, so this is unnecessary.  The presence of that region
could also negate the need for a probe.

> + *
> + * Flag VFIO_MIGRATION_SET_STATE:
> + *  To set device state in vendor driver
> + *  device_state [input] : User space app sends device state to vendor
> + *   driver on state change

Valid states are the enum defined below, correct?

Does setting STOPNCOPY_ACTIVE stop any state change of the device or is
that expected to happen through other means?

What are the allowable state transitions?

How many bits in flags is a user allowed to set at once?

> + * Flag VFIO_MIGRATION_GET_PENDING:
> + *  To get pending bytes yet to be migrated from vendor driver
> + *  threshold_size [Input] : threshold of buffer in User space app.
> + *  pending_precopy_only [output] : pending data which must be migrated 
> in
> + *  precopy phase or in stopped state, in other words - before target
> + *  vm start
> + *  pending_compatible [output] : pending data which may be migrated in 
> any
> + *   phase
> + *  pending_postcopy_only [output] : pending data which must be migrated 
> in
> + *   postcopy phase or in stopped state, in other words - after 
> source
> + *   vm stop
> + *  Sum of pending_precopy_only, pending_compatible and
> + *  pending_postcopy_only is the whole amount of pending data.

What's the significance of the provided threshold, are the pending
bytes limited to threshold size?  It makes me nervous to define a
kernel API in terms of the internal API of a userspace program that can
change.  I wonder if it makes sense to define these in terms of the
state of the devices, pending initial data, runtime data, post-offline
data.

> + *
> + * Flag VFIO_MIGRATION_GET_BUFFER:
> + *  On this flag, vendor driver should write data to migration
> region and
> + *  return number of bytes written in the region.
> + *  bytes_written [output] : number of bytes written in
> migration buffer by
> + *  vendor driver

Does the data the user gets here depend on the device state set
earlier?  For example the user gets pending_precopy_only data while
PRECOPY_ACTIVE is the device state and pending_postcopy_only data
in STOPNCOPY_ACTIVE?  The user should continue to call GET_BUFFER
in a given state until the associated pending field reaches zero?
Jumping between the region and ioctl is rather awkward.

> + *
> + * Flag VFIO_MIGRATION_SET_BUFFER
> + *  In migration resume path, user space app writes to migration
> region and
> + *  communicates it to vendor driver with this ioctl with this
> flag.
> + *  bytes_written [Input] : number of bytes written in migration
> buffer by
> + *  user space app.
> + *
> + * Flag VFIO_MIGRATION_GET_DIRTY_PFNS
> + *  Get bitmap of dirty pages from vendor driver from given
> start address.
> + *  

[Qemu-devel] [PATCH v4 3/8] target/arm: Convert v8 extensions from feature bits to isar tests

[Richard Henderson]

Most of the v8 extensions are self-contained within the ISAR
registers and are not implied by other feature bits, which
makes them the easiest to convert.

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   | 131 +
 target/arm/translate.h |   7 ++
 linux-user/elfload.c   |  46 -
 target/arm/cpu.c   |  27 +---
 target/arm/cpu64.c |  57 +---
 target/arm/translate-a64.c | 101 ++--
 target/arm/translate.c |  36 +-
 7 files changed, 273 insertions(+), 132 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index cff739b74d..a87edbe869 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -669,6 +669,8 @@ typedef enum ARMPSCIState {
 PSCI_ON_PENDING = 2
 } ARMPSCIState;
 
+typedef struct ARMISARegisters ARMISARegisters;
+
 /**
  * ARMCPU:
  * @env: #CPUARMState
@@ -1577,30 +1579,18 @@ enum arm_features {
 ARM_FEATURE_LPAE, /* has Large Physical Address Extension */
 ARM_FEATURE_V8,
 ARM_FEATURE_AARCH64, /* supports 64 bit mode */
-ARM_FEATURE_V8_AES, /* implements AES part of v8 Crypto Extensions */
 ARM_FEATURE_CBAR, /* has cp15 CBAR */
 ARM_FEATURE_CRC, /* ARMv8 CRC instructions */
 ARM_FEATURE_CBAR_RO, /* has cp15 CBAR and it is read-only */
 ARM_FEATURE_EL2, /* has EL2 Virtualization support */
 ARM_FEATURE_EL3, /* has EL3 Secure monitor support */
-ARM_FEATURE_V8_SHA1, /* implements SHA1 part of v8 Crypto Extensions */
-ARM_FEATURE_V8_SHA256, /* implements SHA256 part of v8 Crypto Extensions */
-ARM_FEATURE_V8_PMULL, /* implements PMULL part of v8 Crypto Extensions */
 ARM_FEATURE_THUMB_DSP, /* DSP insns supported in the Thumb encodings */
 ARM_FEATURE_PMU, /* has PMU support */
 ARM_FEATURE_VBAR, /* has cp15 VBAR */
 ARM_FEATURE_M_SECURITY, /* M profile Security Extension */
 ARM_FEATURE_JAZELLE, /* has (trivial) Jazelle implementation */
 ARM_FEATURE_SVE, /* has Scalable Vector Extension */
-ARM_FEATURE_V8_SHA512, /* implements SHA512 part of v8 Crypto Extensions */
-ARM_FEATURE_V8_SHA3, /* implements SHA3 part of v8 Crypto Extensions */
-ARM_FEATURE_V8_SM3, /* implements SM3 part of v8 Crypto Extensions */
-ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */
-ARM_FEATURE_V8_ATOMICS, /* ARMv8.1-Atomics feature */
-ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */
-ARM_FEATURE_V8_DOTPROD, /* implements v8.2 simd dot product */
 ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
-ARM_FEATURE_V8_FCMA, /* has complex number part of v8.3 extensions.  */
 ARM_FEATURE_M_MAIN, /* M profile Main Extension */
 };
 
@@ -3152,4 +3142,121 @@ static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, 
unsigned regno)
 /* Shared between translate-sve.c and sve_helper.c.  */
 extern const uint64_t pred_esz_masks[4];
 
+/*
+ * 32-bit feature tests via id registers.
+ */
+static inline bool isar_feature_aa32_aes(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) != 0;
+}
+
+static inline bool isar_feature_aa32_pmull(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) > 1;
+}
+
+static inline bool isar_feature_aa32_sha1(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar5, ID_ISAR5, SHA1) != 0;
+}
+
+static inline bool isar_feature_aa32_sha2(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar5, ID_ISAR5, SHA2) != 0;
+}
+
+static inline bool isar_feature_aa32_crc32(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar5, ID_ISAR5, CRC32) != 0;
+}
+
+static inline bool isar_feature_aa32_rdm(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar5, ID_ISAR5, RDM) != 0;
+}
+
+static inline bool isar_feature_aa32_vcma(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar5, ID_ISAR5, VCMA) != 0;
+}
+
+static inline bool isar_feature_aa32_dp(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar6, ID_ISAR6, DP) != 0;
+}
+
+/*
+ * 64-bit feature tests via id registers.
+ */
+static inline bool isar_feature_aa64_aes(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, AES) != 0;
+}
+
+static inline bool isar_feature_aa64_pmull(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, AES) > 1;
+}
+
+static inline bool isar_feature_aa64_sha1(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA1) != 0;
+}
+
+static inline bool isar_feature_aa64_sha256(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA2) != 0;
+}
+
+static inline bool isar_feature_aa64_sha512(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA2) > 1;
+}
+
+static inline bool isar_feature_aa64_crc32(const ARMISARegisters *id)
+{
+return

[Qemu-devel] [PATCH v4 6/8] target/arm: Convert t32ee from feature bit to isar3 test

[Richard Henderson]

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h | 6 +-
 linux-user/elfload.c | 2 +-
 target/arm/cpu.c | 4 
 target/arm/helper.c  | 2 +-
 target/arm/machine.c | 3 +--
 5 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 4fdace5de1..af68932946 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1558,7 +1558,6 @@ enum arm_features {
 ARM_FEATURE_NEON,
 ARM_FEATURE_M, /* Microcontroller profile.  */
 ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
-ARM_FEATURE_THUMB2EE,
 ARM_FEATURE_V7MP,/* v7 Multiprocessing Extensions */
 ARM_FEATURE_V7VE, /* v7 Virtualization Extensions (non-EL2 parts) */
 ARM_FEATURE_V4T,
@@ -3157,6 +3156,11 @@ static inline bool isar_feature_jazelle(const 
ARMISARegisters *id)
 return FIELD_EX32(id->id_isar1, ID_ISAR1, JAZELLE) != 0;
 }
 
+static inline bool isar_feature_t32ee(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar3, ID_ISAR3, T32EE) != 0;
+}
+
 static inline bool isar_feature_aa32_aes(const ARMISARegisters *id)
 {
 return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) != 0;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 1e0f22d812..c6edc545ac 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -466,7 +466,7 @@ static uint32_t get_elf_hwcap(void)
 GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
 GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP);
 GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
-GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
+GET_FEATURE_ID(t32ee, ARM_HWCAP_ARM_THUMBEE);
 GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
 GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3);
 GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 8f16e96b6c..e08a2d2d79 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1440,7 +1440,6 @@ static void cortex_a8_initfn(Object *obj)
 set_feature(&cpu->env, ARM_FEATURE_V7);
 set_feature(&cpu->env, ARM_FEATURE_VFP3);
 set_feature(&cpu->env, ARM_FEATURE_NEON);
-set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
 set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
 set_feature(&cpu->env, ARM_FEATURE_EL3);
 cpu->midr = 0x410fc080;
@@ -1509,7 +1508,6 @@ static void cortex_a9_initfn(Object *obj)
 set_feature(&cpu->env, ARM_FEATURE_VFP3);
 set_feature(&cpu->env, ARM_FEATURE_VFP_FP16);
 set_feature(&cpu->env, ARM_FEATURE_NEON);
-set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
 set_feature(&cpu->env, ARM_FEATURE_EL3);
 /* Note that A9 supports the MP extensions even for
  * A9UP and single-core A9MP (which are both different
@@ -1572,7 +1570,6 @@ static void cortex_a7_initfn(Object *obj)
 set_feature(&cpu->env, ARM_FEATURE_V7VE);
 set_feature(&cpu->env, ARM_FEATURE_VFP4);
 set_feature(&cpu->env, ARM_FEATURE_NEON);
-set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
 set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
 set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
 set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
@@ -1618,7 +1615,6 @@ static void cortex_a15_initfn(Object *obj)
 set_feature(&cpu->env, ARM_FEATURE_V7VE);
 set_feature(&cpu->env, ARM_FEATURE_VFP4);
 set_feature(&cpu->env, ARM_FEATURE_NEON);
-set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
 set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
 set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
 set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 342c802a95..b7d9a3392e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5359,7 +5359,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
 }
-if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
+if (cpu_isar_feature(t32ee, cpu)) {
 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
 }
 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
diff --git a/target/arm/machine.c b/target/arm/machine.c
index ff4ec22bf7..5402ff8ae5 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -301,9 +301,8 @@ static const VMStateDescription vmstate_m = {
 static bool thumb2ee_needed(void *opaque)
 {
 ARMCPU *cpu = opaque;
-CPUARMState *env = &cpu->env;
 
-return arm_feature(env, ARM_FEATURE_THUMB2EE);
+return cpu_isar_feature(t32ee, cpu);
 }
 
 static const VMStateDescription vmstate_thumb2ee = {
-- 
2.17.2

[Qemu-devel] [PATCH v4 7/8] target/arm: Convert sve from feature bit to aa64pfr0 test

[Richard Henderson]

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h| 16 +++-
 linux-user/aarch64/signal.c |  4 ++--
 linux-user/elfload.c|  2 +-
 linux-user/syscall.c| 10 ++
 target/arm/cpu64.c  |  5 -
 target/arm/helper.c |  9 ++---
 target/arm/machine.c|  3 +--
 target/arm/translate-a64.c  |  4 ++--
 8 files changed, 37 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index af68932946..3ebf79745b 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1537,6 +1537,16 @@ FIELD(ID_AA64ISAR1, FRINTTS, 32, 4)
 FIELD(ID_AA64ISAR1, SB, 36, 4)
 FIELD(ID_AA64ISAR1, SPECRES, 40, 4)
 
+FIELD(ID_AA64PFR0, EL0, 0, 4)
+FIELD(ID_AA64PFR0, EL1, 4, 4)
+FIELD(ID_AA64PFR0, EL2, 8, 4)
+FIELD(ID_AA64PFR0, EL3, 12, 4)
+FIELD(ID_AA64PFR0, FP, 16, 4)
+FIELD(ID_AA64PFR0, ADVSIMD, 20, 4)
+FIELD(ID_AA64PFR0, GIC, 24, 4)
+FIELD(ID_AA64PFR0, RAS, 28, 4)
+FIELD(ID_AA64PFR0, SVE, 32, 4)
+
 QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= 
R_V7M_CSSELR_INDEX_MASK);
 
 /* If adding a feature bit which corresponds to a Linux ELF
@@ -1585,7 +1595,6 @@ enum arm_features {
 ARM_FEATURE_PMU, /* has PMU support */
 ARM_FEATURE_VBAR, /* has cp15 VBAR */
 ARM_FEATURE_M_SECURITY, /* M profile Security Extension */
-ARM_FEATURE_SVE, /* has Scalable Vector Extension */
 ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
 ARM_FEATURE_M_MAIN, /* M profile Main Extension */
 };
@@ -3269,6 +3278,11 @@ static inline bool isar_feature_aa64_fcma(const 
ARMISARegisters *id)
 return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FCMA) != 0;
 }
 
+static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
+}
+
 /*
  * Forward to the above feature tests given an ARMCPU pointer.
  */
diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index 07fedfc33c..f84a9cf28a 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -314,7 +314,7 @@ static int target_restore_sigframe(CPUARMState *env,
 break;
 
 case TARGET_SVE_MAGIC:
-if (arm_feature(env, ARM_FEATURE_SVE)) {
+if (cpu_isar_feature(aa64_sve, arm_env_get_cpu(env))) {
 vq = (env->vfp.zcr_el[1] & 0xf) + 1;
 sve_size = QEMU_ALIGN_UP(TARGET_SVE_SIG_CONTEXT_SIZE(vq), 16);
 if (!sve && size == sve_size) {
@@ -433,7 +433,7 @@ static void target_setup_frame(int usig, struct 
target_sigaction *ka,
   &layout);
 
 /* SVE state needs saving only if it exists.  */
-if (arm_feature(env, ARM_FEATURE_SVE)) {
+if (cpu_isar_feature(aa64_sve, arm_env_get_cpu(env))) {
 vq = (env->vfp.zcr_el[1] & 0xf) + 1;
 sve_size = QEMU_ALIGN_UP(TARGET_SVE_SIG_CONTEXT_SIZE(vq), 16);
 sve_ofs = alloc_sigframe_space(sve_size, &layout);
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index c6edc545ac..64e41fb235 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -593,7 +593,7 @@ static uint32_t get_elf_hwcap(void)
 GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
 GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
 GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
-GET_FEATURE(ARM_FEATURE_SVE, ARM_HWCAP_A64_SVE);
+GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
 
 #undef GET_FEATURE
 #undef GET_FEATURE_ID
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index ae3c0dfef7..48567a4416 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -9356,7 +9356,7 @@ static abi_long do_syscall1(void *cpu_env, int num, 
abi_long arg1,
  * even though the current architectural maximum is VQ=16.
  */
 ret = -TARGET_EINVAL;
-if (arm_feature(cpu_env, ARM_FEATURE_SVE)
+if (cpu_isar_feature(aa64_sve, arm_env_get_cpu(cpu_env))
 && arg2 >= 0 && arg2 <= 512 * 16 && !(arg2 & 15)) {
 CPUARMState *env = cpu_env;
 ARMCPU *cpu = arm_env_get_cpu(env);
@@ -9375,9 +9375,11 @@ static abi_long do_syscall1(void *cpu_env, int num, 
abi_long arg1,
 return ret;
 case TARGET_PR_SVE_GET_VL:
 ret = -TARGET_EINVAL;
-if (arm_feature(cpu_env, ARM_FEATURE_SVE)) {
-CPUARMState *env = cpu_env;
-ret = ((env->vfp.zcr_el[1] & 0xf) + 1) * 16;
+{
+ARMCPU *cpu = arm_env_get_cpu(cpu_env);
+if (cpu_isar_feature(aa64_sve, cpu)) {
+ret = ((cpu->env.vfp.zcr_el[1] & 0xf) + 1) * 16;
+}
 }
 return ret;
 #endif /* AARCH64 */
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index eb5aba4870..0520a42196 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -318,6 +318,10 @@ static void aarch64_max_initfn(Object

[Qemu-devel] [PATCH v4 1/8] target/arm: Move some system registers into a substructure

[Richard Henderson]

Create struct ARMISARegisters, to be accessed during translation.

Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h  |  32 
 hw/intc/armv7m_nvic.c |  12 +--
 target/arm/cpu.c  | 178 +-
 target/arm/cpu64.c|  70 -
 target/arm/helper.c   |  28 +++
 5 files changed, 162 insertions(+), 158 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index f00c0444c4..cff739b74d 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -788,13 +788,28 @@ struct ARMCPU {
  * ARMv7AR ARM Architecture Reference Manual. A reset_ prefix
  * is used for reset values of non-constant registers; no reset_
  * prefix means a constant register.
+ * Some of these registers are split out into a substructure that
+ * is shared with the translators to control the ISA.
  */
+struct ARMISARegisters {
+uint32_t id_isar0;
+uint32_t id_isar1;
+uint32_t id_isar2;
+uint32_t id_isar3;
+uint32_t id_isar4;
+uint32_t id_isar5;
+uint32_t id_isar6;
+uint32_t mvfr0;
+uint32_t mvfr1;
+uint32_t mvfr2;
+uint64_t id_aa64isar0;
+uint64_t id_aa64isar1;
+uint64_t id_aa64pfr0;
+uint64_t id_aa64pfr1;
+} isar;
 uint32_t midr;
 uint32_t revidr;
 uint32_t reset_fpsid;
-uint32_t mvfr0;
-uint32_t mvfr1;
-uint32_t mvfr2;
 uint32_t ctr;
 uint32_t reset_sctlr;
 uint32_t id_pfr0;
@@ -808,21 +823,10 @@ struct ARMCPU {
 uint32_t id_mmfr2;
 uint32_t id_mmfr3;
 uint32_t id_mmfr4;
-uint32_t id_isar0;
-uint32_t id_isar1;
-uint32_t id_isar2;
-uint32_t id_isar3;
-uint32_t id_isar4;
-uint32_t id_isar5;
-uint32_t id_isar6;
-uint64_t id_aa64pfr0;
-uint64_t id_aa64pfr1;
 uint64_t id_aa64dfr0;
 uint64_t id_aa64dfr1;
 uint64_t id_aa64afr0;
 uint64_t id_aa64afr1;
-uint64_t id_aa64isar0;
-uint64_t id_aa64isar1;
 uint64_t id_aa64mmfr0;
 uint64_t id_aa64mmfr1;
 uint32_t dbgdidr;
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 0d816fdd2c..0beefb05d4 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -1055,17 +1055,17 @@ static uint32_t nvic_readl(NVICState *s, uint32_t 
offset, MemTxAttrs attrs)
 case 0xd5c: /* MMFR3.  */
 return cpu->id_mmfr3;
 case 0xd60: /* ISAR0.  */
-return cpu->id_isar0;
+return cpu->isar.id_isar0;
 case 0xd64: /* ISAR1.  */
-return cpu->id_isar1;
+return cpu->isar.id_isar1;
 case 0xd68: /* ISAR2.  */
-return cpu->id_isar2;
+return cpu->isar.id_isar2;
 case 0xd6c: /* ISAR3.  */
-return cpu->id_isar3;
+return cpu->isar.id_isar3;
 case 0xd70: /* ISAR4.  */
-return cpu->id_isar4;
+return cpu->isar.id_isar4;
 case 0xd74: /* ISAR5.  */
-return cpu->id_isar5;
+return cpu->isar.id_isar5;
 case 0xd78: /* CLIDR */
 return cpu->clidr;
 case 0xd7c: /* CTR */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index cd48ad42d8..4f6756a4e2 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -144,9 +144,9 @@ static void arm_cpu_reset(CPUState *s)
 g_hash_table_foreach(cpu->cp_regs, cp_reg_check_reset, cpu);
 
 env->vfp.xregs[ARM_VFP_FPSID] = cpu->reset_fpsid;
-env->vfp.xregs[ARM_VFP_MVFR0] = cpu->mvfr0;
-env->vfp.xregs[ARM_VFP_MVFR1] = cpu->mvfr1;
-env->vfp.xregs[ARM_VFP_MVFR2] = cpu->mvfr2;
+env->vfp.xregs[ARM_VFP_MVFR0] = cpu->isar.mvfr0;
+env->vfp.xregs[ARM_VFP_MVFR1] = cpu->isar.mvfr1;
+env->vfp.xregs[ARM_VFP_MVFR2] = cpu->isar.mvfr2;
 
 cpu->power_state = cpu->start_powered_off ? PSCI_OFF : PSCI_ON;
 s->halted = cpu->start_powered_off;
@@ -938,7 +938,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
  * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12].
  */
 cpu->id_pfr1 &= ~0xf0;
-cpu->id_aa64pfr0 &= ~0xf000;
+cpu->isar.id_aa64pfr0 &= ~0xf000;
 }
 
 if (!cpu->has_el2) {
@@ -955,7 +955,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
  * registers if we don't have EL2. These are id_pfr1[15:12] and
  * id_aa64pfr0_el1[11:8].
  */
-cpu->id_aa64pfr0 &= ~0xf00;
+cpu->isar.id_aa64pfr0 &= ~0xf00;
 cpu->id_pfr1 &= ~0xf000;
 }
 
@@ -1151,8 +1151,8 @@ static void arm1136_r2_initfn(Object *obj)
 set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
 cpu->midr = 0x4107b362;
 cpu->reset_fpsid = 0x410120b4;
-cpu->mvfr0 = 0x;
-cpu->mvfr1 = 0x;
+cpu->isar.mvfr0 = 0x;
+cpu->isar.mvfr1 = 0x;
 cpu->ctr = 0x1dd20d2;
 cpu->reset_sctlr = 0x00050078;
 cpu->id_pfr0 = 0x111;
@@ -1162,11 +1162,11 @@ static void arm1136_r2_initfn(Object *obj)
 cpu->id_mmfr0 = 0x01130003;
 cpu->id_mmfr1 = 0x10030302;

[Qemu-devel] [PATCH v4 2/8] target/arm: V8M should not imply V7VE

[Richard Henderson]

Instantiating mps2-an505 (cortex-m33) will fail make check when
V7VE asserts that ID_ISAR0.Divide includes ARM division.  It is
also wrong to include ARM_FEATURE_LPAE.

Signed-off-by: Richard Henderson 
---
 target/arm/cpu.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 4f6756a4e2..12e6273d60 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -814,7 +814,11 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
 
 /* Some features automatically imply others: */
 if (arm_feature(env, ARM_FEATURE_V8)) {
-set_feature(env, ARM_FEATURE_V7VE);
+if (arm_feature(env, ARM_FEATURE_M)) {
+set_feature(env, ARM_FEATURE_V7);
+} else {
+set_feature(env, ARM_FEATURE_V7VE);
+}
 }
 if (arm_feature(env, ARM_FEATURE_V7VE)) {
 /* v7 Virtualization Extensions. In real hardware this implies
-- 
2.17.2

[Qemu-devel] [PATCH v4 8/8] target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test

[Richard Henderson]

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   | 17 +++-
 linux-user/elfload.c   |  6 +-
 target/arm/cpu64.c | 16 ---
 target/arm/helper.c|  2 +-
 target/arm/translate-a64.c | 40 +++---
 target/arm/translate.c |  6 +++---
 6 files changed, 50 insertions(+), 37 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 3ebf79745b..b342203d0e 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1595,7 +1595,6 @@ enum arm_features {
 ARM_FEATURE_PMU, /* has PMU support */
 ARM_FEATURE_VBAR, /* has cp15 VBAR */
 ARM_FEATURE_M_SECURITY, /* M profile Security Extension */
-ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
 ARM_FEATURE_M_MAIN, /* M profile Main Extension */
 };
 
@@ -3210,6 +3209,16 @@ static inline bool isar_feature_aa32_dp(const 
ARMISARegisters *id)
 return FIELD_EX32(id->id_isar6, ID_ISAR6, DP) != 0;
 }
 
+static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
+{
+/*
+ * This is a placeholder for use by VCMA until the rest of
+ * the ARMv8.2-FP16 extension is implemented for aa32 mode.
+ * At which point we can properly set and check MVFR1.FPHP.
+ */
+return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
+}
+
 /*
  * 64-bit feature tests via id registers.
  */
@@ -3278,6 +3287,12 @@ static inline bool isar_feature_aa64_fcma(const 
ARMISARegisters *id)
 return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FCMA) != 0;
 }
 
+static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
+{
+/* We always set the AdvSIMD and FP fields identically wrt FP16.  */
+return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
+}
+
 static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
 {
 return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 64e41fb235..45d6836bb9 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -573,8 +573,6 @@ static uint32_t get_elf_hwcap(void)
 hwcaps |= ARM_HWCAP_A64_ASIMD;
 
 /* probe for the extra features */
-#define GET_FEATURE(feat, hwcap) \
-do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)
 #define GET_FEATURE_ID(feat, hwcap) \
 do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
 
@@ -587,15 +585,13 @@ static uint32_t get_elf_hwcap(void)
 GET_FEATURE_ID(aa64_sha3, ARM_HWCAP_A64_SHA3);
 GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
 GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
-GET_FEATURE(ARM_FEATURE_V8_FP16,
-ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
+GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
 GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
 GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
 GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
 GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
 GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
 
-#undef GET_FEATURE
 #undef GET_FEATURE_ID
 
 return hwcaps;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 0520a42196..873f059bf2 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -320,6 +320,8 @@ static void aarch64_max_initfn(Object *obj)
 
 t = cpu->isar.id_aa64pfr0;
 t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
+t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);
+t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);
 cpu->isar.id_aa64pfr0 = t;
 
 /* Replicate the same data to the 32-bit id registers.  */
@@ -336,14 +338,14 @@ static void aarch64_max_initfn(Object *obj)
 u = FIELD_DP32(u, ID_ISAR6, DP, 1);
 cpu->isar.id_isar6 = u;
 
-#ifdef CONFIG_USER_ONLY
-/* We don't set these in system emulation mode for the moment,
- * since we don't correctly set the ID registers to advertise them,
- * and in some cases they're only available in AArch64 and not AArch32,
- * whereas the architecture requires them to be present in both if
- * present in either.
+/*
+ * FIXME: We do not yet support ARMv8.2-fp16 for AArch32 yet,
+ * so do not set MVFR1.FPHP.  Strictly speaking this is not legal,
+ * but it is also not legal to enable SVE without support for FP16,
+ * and enabling SVE in system mode is more useful in the short term.
  */
-set_feature(&cpu->env, ARM_FEATURE_V8_FP16);
+
+#ifdef CONFIG_USER_ONLY
 /* For usermode -cpu max we can use a larger and more efficient DCZ
  * blocksize since we don't have to follow what the hardware does.
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0685c9bc93..9a0e92f286 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -11612,7 +11612,7 @@ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t 
val)
 uint32_

[Qemu-devel] [PATCH v4 4/8] target/arm: Convert division from feature bits to isar0 tests

[Richard Henderson]

Both arm and thumb2 division are controlled by the same ISAR field,
which takes care of the arm implies thumb case.  Having M imply
thumb2 division was wrong for cortex-m0, which is v6m and does not
have thumb2 at all, much less thumb2 division.

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   | 12 ++--
 linux-user/elfload.c   |  4 ++--
 target/arm/cpu.c   | 10 +-
 target/arm/translate.c |  4 ++--
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index a87edbe869..a757aecd57 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1556,7 +1556,6 @@ enum arm_features {
 ARM_FEATURE_VFP3,
 ARM_FEATURE_VFP_FP16,
 ARM_FEATURE_NEON,
-ARM_FEATURE_THUMB_DIV, /* divide supported in Thumb encoding */
 ARM_FEATURE_M, /* Microcontroller profile.  */
 ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
 ARM_FEATURE_THUMB2EE,
@@ -1566,7 +1565,6 @@ enum arm_features {
 ARM_FEATURE_V5,
 ARM_FEATURE_STRONGARM,
 ARM_FEATURE_VAPA, /* cp15 VA to PA lookups */
-ARM_FEATURE_ARM_DIV, /* divide supported in ARM encoding */
 ARM_FEATURE_VFP4, /* VFPv4 (implies that NEON is v2) */
 ARM_FEATURE_GENERIC_TIMER,
 ARM_FEATURE_MVFR, /* Media and VFP Feature Registers 0 and 1 */
@@ -3145,6 +3143,16 @@ extern const uint64_t pred_esz_masks[4];
 /*
  * 32-bit feature tests via id registers.
  */
+static inline bool isar_feature_thumb_div(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) != 0;
+}
+
+static inline bool isar_feature_arm_div(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) > 1;
+}
+
 static inline bool isar_feature_aa32_aes(const ARMISARegisters *id)
 {
 return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) != 0;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 97014959ff..1e0f22d812 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -471,8 +471,8 @@ static uint32_t get_elf_hwcap(void)
 GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3);
 GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
 GET_FEATURE(ARM_FEATURE_VFP4, ARM_HWCAP_ARM_VFPv4);
-GET_FEATURE(ARM_FEATURE_ARM_DIV, ARM_HWCAP_ARM_IDIVA);
-GET_FEATURE(ARM_FEATURE_THUMB_DIV, ARM_HWCAP_ARM_IDIVT);
+GET_FEATURE_ID(arm_div, ARM_HWCAP_ARM_IDIVA);
+GET_FEATURE_ID(thumb_div, ARM_HWCAP_ARM_IDIVT);
 /* All QEMU's VFPv3 CPUs have 32 registers, see VFP_DREG in translate.c.
  * Note that the ARM_HWCAP_ARM_VFPv3D16 bit is always the inverse of
  * ARM_HWCAP_ARM_VFPD32 (and so always clear for QEMU); it is unrelated
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 6f27c33b55..9319f92f1f 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -829,7 +829,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
  * Presence of EL2 itself is ARM_FEATURE_EL2, and of the
  * Security Extensions is ARM_FEATURE_EL3.
  */
-set_feature(env, ARM_FEATURE_ARM_DIV);
+assert(cpu_isar_feature(arm_div, cpu));
 set_feature(env, ARM_FEATURE_LPAE);
 set_feature(env, ARM_FEATURE_V7);
 }
@@ -862,12 +862,6 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
 if (arm_feature(env, ARM_FEATURE_V5)) {
 set_feature(env, ARM_FEATURE_V4T);
 }
-if (arm_feature(env, ARM_FEATURE_M)) {
-set_feature(env, ARM_FEATURE_THUMB_DIV);
-}
-if (arm_feature(env, ARM_FEATURE_ARM_DIV)) {
-set_feature(env, ARM_FEATURE_THUMB_DIV);
-}
 if (arm_feature(env, ARM_FEATURE_VFP4)) {
 set_feature(env, ARM_FEATURE_VFP3);
 set_feature(env, ARM_FEATURE_VFP_FP16);
@@ -1388,8 +1382,6 @@ static void cortex_r5_initfn(Object *obj)
 ARMCPU *cpu = ARM_CPU(obj);
 
 set_feature(&cpu->env, ARM_FEATURE_V7);
-set_feature(&cpu->env, ARM_FEATURE_THUMB_DIV);
-set_feature(&cpu->env, ARM_FEATURE_ARM_DIV);
 set_feature(&cpu->env, ARM_FEATURE_V7MP);
 set_feature(&cpu->env, ARM_FEATURE_PMSA);
 cpu->midr = 0x411fc153; /* r1p3 */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index f621595197..8b2be71439 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -9755,7 +9755,7 @@ static void disas_arm_insn(DisasContext *s, unsigned int 
insn)
 case 1:
 case 3:
 /* SDIV, UDIV */
-if (!arm_dc_feature(s, ARM_FEATURE_ARM_DIV)) {
+if (!dc_isar_feature(arm_div, s)) {
 goto illegal_op;
 }
 if (((insn >> 5) & 7) || (rd != 15)) {
@@ -10963,7 +10963,7 @@ static void disas_thumb2_insn(DisasContext *s, uint32_t 
insn)
 tmp2 = load_reg(s, rm);
 if ((op & 0x50) == 0x10) {
 /* sdiv, udiv */
-if (!arm_dc_feature(s, ARM_

[Qemu-devel] [PATCH v4 5/8] target/arm: Convert jazelle from feature bit to isar1 test

[Richard Henderson]

Having V6 alone imply jazelle was wrong for cortex-m0.
Change to an assertion for V6 & !M.

This was harmless, because the only place we tested ARM_FEATURE_JAZELLE
was for 'bxj' in disas_arm(), which is unreachable for M-profile cores.

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/arm/cpu.h   |  6 +-
 target/arm/cpu.c   | 17 ++---
 target/arm/translate.c |  2 +-
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index a757aecd57..4fdace5de1 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1586,7 +1586,6 @@ enum arm_features {
 ARM_FEATURE_PMU, /* has PMU support */
 ARM_FEATURE_VBAR, /* has cp15 VBAR */
 ARM_FEATURE_M_SECURITY, /* M profile Security Extension */
-ARM_FEATURE_JAZELLE, /* has (trivial) Jazelle implementation */
 ARM_FEATURE_SVE, /* has Scalable Vector Extension */
 ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
 ARM_FEATURE_M_MAIN, /* M profile Main Extension */
@@ -3153,6 +3152,11 @@ static inline bool isar_feature_arm_div(const 
ARMISARegisters *id)
 return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) > 1;
 }
 
+static inline bool isar_feature_jazelle(const ARMISARegisters *id)
+{
+return FIELD_EX32(id->id_isar1, ID_ISAR1, JAZELLE) != 0;
+}
+
 static inline bool isar_feature_aa32_aes(const ARMISARegisters *id)
 {
 return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) != 0;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 9319f92f1f..8f16e96b6c 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -854,8 +854,8 @@ static void arm_cpu_realizefn(DeviceState *dev, Error 
**errp)
 }
 if (arm_feature(env, ARM_FEATURE_V6)) {
 set_feature(env, ARM_FEATURE_V5);
-set_feature(env, ARM_FEATURE_JAZELLE);
 if (!arm_feature(env, ARM_FEATURE_M)) {
+assert(cpu_isar_feature(jazelle, cpu));
 set_feature(env, ARM_FEATURE_AUXCR);
 }
 }
@@ -1082,11 +1082,16 @@ static void arm926_initfn(Object *obj)
 set_feature(&cpu->env, ARM_FEATURE_VFP);
 set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
 set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
-set_feature(&cpu->env, ARM_FEATURE_JAZELLE);
 cpu->midr = 0x41069265;
 cpu->reset_fpsid = 0x41011090;
 cpu->ctr = 0x1dd20d2;
 cpu->reset_sctlr = 0x00090078;
+
+/*
+ * ARMv5 does not have the ID_ISAR registers, but we can still
+ * set the field to indicate Jazelle support within QEMU.
+ */
+cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
 }
 
 static void arm946_initfn(Object *obj)
@@ -1112,12 +1117,18 @@ static void arm1026_initfn(Object *obj)
 set_feature(&cpu->env, ARM_FEATURE_AUXCR);
 set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
 set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
-set_feature(&cpu->env, ARM_FEATURE_JAZELLE);
 cpu->midr = 0x4106a262;
 cpu->reset_fpsid = 0x410110a0;
 cpu->ctr = 0x1dd20d2;
 cpu->reset_sctlr = 0x00090078;
 cpu->reset_auxcr = 1;
+
+/*
+ * ARMv5 does not have the ID_ISAR registers, but we can still
+ * set the field to indicate Jazelle support within QEMU.
+ */
+cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
+
 {
 /* The 1026 had an IFAR at c6,c0,0,1 rather than the ARMv6 c6,c0,0,2 */
 ARMCPRegInfo ifar = {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index 8b2be71439..e56b5cdff7 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -42,7 +42,7 @@
 #define ENABLE_ARCH_5 arm_dc_feature(s, ARM_FEATURE_V5)
 /* currently all emulated v5 cores are also v5TE, so don't bother */
 #define ENABLE_ARCH_5TE   arm_dc_feature(s, ARM_FEATURE_V5)
-#define ENABLE_ARCH_5Jarm_dc_feature(s, ARM_FEATURE_JAZELLE)
+#define ENABLE_ARCH_5Jdc_isar_feature(jazelle, s)
 #define ENABLE_ARCH_6 arm_dc_feature(s, ARM_FEATURE_V6)
 #define ENABLE_ARCH_6Karm_dc_feature(s, ARM_FEATURE_V6K)
 #define ENABLE_ARCH_6T2   arm_dc_feature(s, ARM_FEATURE_THUMB2)
-- 
2.17.2

[Qemu-devel] [PATCH v4 0/8] target/arm: Rely on id regs instead of features

[Richard Henderson]

This edition moves some of the system registers into a substructure,
which is then shared with "normal" runtime and the translators.
This is seen as a better solution than letting the entire translator
have access to the main ARMCPU structure.

Also after rebasing on mainline, there was a new cortex-m33 failure
caused by v8m implying v7ve implying arm_div.


r~


Richard Henderson (8):
  target/arm: Move some system registers into a substructure
  target/arm: V8M should not imply V7VE
  target/arm: Convert v8 extensions from feature bits to isar tests
  target/arm: Convert division from feature bits to isar0 tests
  target/arm: Convert jazelle from feature bit to isar1 test
  target/arm: Convert t32ee from feature bit to isar3 test
  target/arm: Convert sve from feature bit to aa64pfr0 test
  target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test

 target/arm/cpu.h| 220 +++-
 target/arm/translate.h  |   7 ++
 hw/intc/armv7m_nvic.c   |  12 +-
 linux-user/aarch64/signal.c |   4 +-
 linux-user/elfload.c|  60 +
 linux-user/syscall.c|  10 +-
 target/arm/cpu.c| 242 +++-
 target/arm/cpu64.c  | 148 --
 target/arm/helper.c |  41 +++---
 target/arm/machine.c|   6 +-
 target/arm/translate-a64.c  | 145 +++--
 target/arm/translate.c  |  48 ---
 12 files changed, 570 insertions(+), 373 deletions(-)

-- 
2.17.2

Re: [Qemu-devel] [PATCH v3 37/38] raw: Convert a warning to warn_report()

[Eric Blake]

On 10/16/18 12:41 PM, Markus Armbruster wrote:

Signed-off-by: Markus Armbruster 
---
  block/raw-format.c | 17 +
  1 file changed, 9 insertions(+), 8 deletions(-)


Incomplete. tests/qemu-iotests/109.out needs updating:


@@ -436,14 +437,14 @@ static int raw_open(BlockDriverState *bs, QDict *options, 
int flags,
  bs->file->bs->supported_zero_flags);
  
  if (bs->probed && !bdrv_is_read_only(bs)) {

-fprintf(stderr,
-"WARNING: Image format was not specified for '%s' and probing "
-"guessed raw.\n"
-" Automatically detecting the format is dangerous for "
-"raw images, write operations on block 0 will be restricted.\n"
-" Specify the 'raw' format explicitly to remove the "
-"restrictions.\n",
-bs->file->bs->filename);
+warn_report("Image format was not specified for '%s' and probing "


as this changes s/WARNING/warning/

--
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH v3 36/38] block: Clean up bdrv_img_create()'s error reporting

[Eric Blake]

On 10/16/18 12:41 PM, Markus Armbruster wrote:

bdrv_img_create() takes an Error ** argument and uses it in the
conventional way, except for one place: when qemu_opts_do_parse()
fails, it first reports its error to stderr or the HMP monitor with
error_report_err(), then error_setg()'s a generic error.

When the caller reports that second error similarly, this produces two
consecutive error messages on stderr or the HMP monitor.

When the caller does something else with it, such as send it via QMP,
the first error still goes to stderr or the HMP monitor.  Fortunately,
no such caller exists.

Simply use the first error as is.

Signed-off-by: Markus Armbruster 
---
  block.c | 3 ---
  1 file changed, 3 deletions(-)


Reviewed-by: Eric Blake 

--
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH] virtio: Provide version-specific variants of virtio PCI devices

[Laine Stump]

On 10/16/2018 01:02 PM, Daniel P. Berrangé wrote:
> On Mon, Oct 15, 2018 at 03:14:04PM -0300, Eduardo Habkost wrote:
>> On Sun, Oct 14, 2018 at 05:35:12PM -0400, Michael S. Tsirkin wrote:
>>> On Fri, Oct 12, 2018 at 11:54:35PM -0300, Eduardo Habkost wrote:
 The current virtio-*-pci device types actually represent 3
 different types of devices:
 * virtio 1.0 non-transitional devices
 * virtio 1.0 transitional devices
 * virtio 0.9 ("legacy device" in virtio 1.0 terminology)

 That would be just an annoyance if it didn't break our device/bus
 compatibility QMP interfaces.  With this multi-purpose device
 type, there's no way to tell management software that
 transitional devices and legacy devices require a Conventional
 PCI bus.

 The multi-purpose device types would also prevent us from telling
 management software what's the PCI vendor/device ID for them,
 because their PCI IDs change at runtime depending on the bus
 where they were is plugged.

 This patch adds separate device types for each of those virtio
 device flavors:

 - virtio-*-pci: the existing multi-purpose device types
   - Configurable using `disable-legacy` and `disable-modern`
 properties
   - Legacy driver support is automatically enabled/disabled
 depending on the bus where it is plugged
   - Supports Conventional PCI and PCI Express buses
 (but Conventional PCI is incompatible with
 disable-legacy=off)
   - Changes PCI vendor/device IDs at runtime
 - virtio-*-pci-0.9: legacy virtio device
   - Supports Conventional PCI buses only, because
 it has a PIO BAR
 - virtio-*-pci-1.0-transitional: virtio-1.0 device supporting legacy 
 drivers
   - Supports Conventional PCI buses only, because
 it has a PIO BAR
 - virtio-*-pci-1.0: modern-only
   - Supports both Conventional PCI and PCI Express buses
>>>
>>> I would prefer a "modern" suffix since it will likely cover future
>>> revisions as well.
>>
>> That's on purpose. The new device types don't cover future
>> revisions, otherwise we'll have exactly the same ambiguity
>> problems in the future.
>>
>> The moment we have a new virtio specification released, a device
>> type called "modern" will automatically become ambiguous.
> 
> Agreed, I don't want to see us back in the same mess, if a
> virtio-2.0 ever gets released with non-backcompatible
> changes.
> 
> How about using only the major digit in the device names eg
> 
>   'virtio-blk-0.x'
>   'virtio-blk-1.x'
> 
> to make it clearer that we cover 1.0 and 1.1 (and 1.2, etc
> by the same device.

+1 from me on either "-1" or "-1.x", and a -1 on "-1.0" or "-modern".

> 
> This assumes that virtio authors are indeed using semantic
> versioning where minor digit indicates backcompat changes
> and major digit indicates breaking  compat changes. 
> 
> 
>>> Besides, I don't have a problem with this but I'd like an
>>> ack from someone on the management side, confirming
>>> these new interfaces are actually going to be used.
>>>
>>> Could you copy some relevant people as well pls?
>>
>> CCing Andrea, Daniel, and Laine from the libvirt side.
> 
> I don't have a objection from libvirt side.
> 
> Last time, I suggested/discussed this I was not convinced that the benefit
> was compelling enough to justify the  work across all levels in the stack.
> 
> Apps using the new device model names would either make themselves
> incompatible with older libvirt/QEMU, or they would increase their
> code complexity & testing matrix by having to support both old & new
> names. The usage would also harm migration to older hosts.
> 
> This just to be able to switch from i440fx to q35 for OS which don't
> support virtio-1.0, but for such old OS, q35 isn't offering any
> compelling features, so they might as well stick with the thing that
> is known to work well.

The *current* compelling reason is to permit management apps to use Q35
for "old" OSes that don't have a driver for virtio-1.0, (and especially
*new* management apps that want to support only Q35 from the start), but
there are other future advantages that will make us appreciate that this
was done. For example, libosinfo currently reports separately that an
supports virtio-0.9 devices and/or virtio-1.0 devices, but a management
app would need to have extra logic to take account of the fact that the
only way to get a virtio-0.9 device would be to place it on a
conventional PCI bus; if qemu offers the two as separate devices then
all the management app has to do is use the device that libosinfo tells
it to use, and it will automatically be placed on the right kind of bus.
(and I've heard from Eduardo that eventually we'll be able to learn the
PCI ID of the devices from qmp introspection, so the management app will
be able to just look for a device ID that is on both the qemu and the OS
list, and use that).

Obviously using these devices will

Re: [Qemu-devel] [PATCH] target/mips: Support Toshiba specific three-operand MADD and MADDU

[Maciej W. Rozycki]

On Tue, 16 Oct 2018, Fredrik Noring wrote:

> > I would not implement r5900 for mips32 in that case,
> > I would implement it only for TARGET_MIPS64.
> 
> R5900 Linux implements the O32 ABI, which is why 32-bit QEMU user-mode is
> very useful. Perhaps a better alternative is to define the MMI registers
> as 128-bit, similar to
> 
> static TCGv_u128 mmi_gpr[32];
> 
> and then copy cpu_gpr to/from mmi_gpr as needed when running the MMIs?

 FWIW, I agree as far as the user emulation mode is concerned.  All 64-bit 
MIPS hardware is currently set up by the Linux kernel for 64-bit execution 
by keeping CP0.Status.UX set when running o32 user processes anyway.

 A change to this policy (and also the use of CP0.Status.PX for n32) has 
been discussed, in partictular in the course of investigating address 
space overflows caused by GCC using the indexed addressing modes under the 
assumption that the address space wraps at 32 bits for o32 and n32 
software, where indeed it does not.  No change has been implemented 
though.

  Maciej

Re: [Qemu-devel] [PATCH] target/mips: Support Toshiba specific three-operand MADD and MADDU

[Maciej W. Rozycki]

On Tue, 16 Oct 2018, Fredrik Noring wrote:

> One option is to create a new array such as
> 
> static TCGv_i64 mmi_gpr[32];
> 
> that represents the upper 64 bits of each GPR. Then cpu_gpr must be of
> a 64-bit type too, even when QEMU runs in 32-bit user mode. The R5900
> does not implement CP0.Status.UX in hardware, though, so system mode is
> 64 bits, regardless.

 It's more like modern CP0.Status.PX however, as the hardware does not 
implement 64-bit memory segments and only has legacy 32-bit segments 
implemented.

 Due to a hardware quirk however the value recorded in the target register 
(usually $ra) does not get sign-extended with linked jump or branch 
instructions, contrary to what is expected with processors implementing 
32-bit segments only.  This has implications for kernel code running from 
KSEG0/KSEG1/KSEG2 and has to be worked around in software, as experience 
has shown.

  Maciej

Re: [Qemu-devel] [PATCH] target/mips: Support Toshiba specific three-operand MADD and MADDU

[Fredrik Noring]

Hi Richard,

> > /* global register indices */
> > static TCGv cpu_gpr[32], cpu_PC;
> > static TCGv cpu_HI[MIPS_DSP_ACC], cpu_LO[MIPS_DSP_ACC];
> > 
> > One option is to create a new array such as
> > 
> > static TCGv_i64 mmi_gpr[32];
> > 
> > that represents the upper 64 bits of each GPR. Then cpu_gpr must be of
> > a 64-bit type too, even when QEMU runs in 32-bit user mode. The R5900
> > does not implement CP0.Status.UX in hardware, though, so system mode is
> > 64 bits, regardless.
> 
> I would not implement r5900 for mips32 in that case,
> I would implement it only for TARGET_MIPS64.

R5900 Linux implements the O32 ABI, which is why 32-bit QEMU user-mode is
very useful. Perhaps a better alternative is to define the MMI registers
as 128-bit, similar to

static TCGv_u128 mmi_gpr[32];

and then copy cpu_gpr to/from mmi_gpr as needed when running the MMIs?

Fredrik

Re: [Qemu-devel] [PATCH v2 3/8] block: Require auto-read-only for existing fallbacks

[Eric Blake]

On 10/16/18 9:12 AM, Kevin Wolf wrote:

Am 12.10.2018 um 19:02 hat Eric Blake geschrieben:

On 10/12/18 6:55 AM, Kevin Wolf wrote:

Some block drivers have traditionally changed their node to read-only
mode without asking the user. This behaviour has been marked deprecated
since 2.11, expecting users to provide an explicit read-only=on option.

Now that we have auto-read-only=on, enable these drivers to make use of
the option.

This is the only use of bdrv_set_read_only(), so we can make it a bit
more specific and turn it into a bdrv_apply_auto_read_only() that is
more convenient for drivers to use.

Signed-off-by: Kevin Wolf 
---





Worth documenting the -EINVAL (copy-on-read prevents setting read-only)
failure as well?  (The -EPERM failure of bdrv_can_set_read_only() is not
reachable, since this new function never clears readonly).


In fact, -EINVAL and the error string from bdrv_can_set_read_only() may
be confusing because the user didn't explicitly request a read-only
image. Maybe it would be better to just turn this case into -EACCES with
the same error message.

What do you think?


So, how would it trigger in practice? The user requests a copy-on-read 
action with the BDS as destination (thus the BDS must be writable, and 
can't be set to readonly); they omitted read-only (because they know 
they want copy-on-read); they supplied auto-read-only=true (because they 
are lazy and want to always use that flag if it is available); but the 
particular BDS they selected is not writable (whether read-only file 
system, read-only NBD server, etc).  In short, we can't grant them 
read-write to begin with, and can't gracefully fall back to read-only 
because it would violate their request for copy-on-read, so as long as 
we give them a sane error message about their request being impossible, 
we're good.  Yes, -EACCES sounds reasonable, if you want to code that in.


--
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH] target/mips: Support Toshiba specific three-operand MADD and MADDU

[Richard Henderson]

On 10/16/18 11:19 AM, Fredrik Noring wrote:
> /* global register indices */
> static TCGv cpu_gpr[32], cpu_PC;
> static TCGv cpu_HI[MIPS_DSP_ACC], cpu_LO[MIPS_DSP_ACC];
> 
> One option is to create a new array such as
> 
> static TCGv_i64 mmi_gpr[32];
> 
> that represents the upper 64 bits of each GPR. Then cpu_gpr must be of
> a 64-bit type too, even when QEMU runs in 32-bit user mode. The R5900
> does not implement CP0.Status.UX in hardware, though, so system mode is
> 64 bits, regardless.

I would not implement r5900 for mips32 in that case,
I would implement it only for TARGET_MIPS64.


r~

Re: [Qemu-devel] [PATCH 1/9] iotests: Make nbd-fault-injector flush

[Eric Blake]

On 10/15/18 9:14 AM, Max Reitz wrote:

When closing a connection, make the nbd-fault-injector flush the socket.
Without this, the output is a bit unreliable with Python 3.

Signed-off-by: Max Reitz 
---
  tests/qemu-iotests/083.out   | 9 +
  tests/qemu-iotests/nbd-fault-injector.py | 1 +
  2 files changed, 10 insertions(+)


I already had a complaint that the error message in 083.out should NOT 
be printing a message (whether the server is python 2 and auto-flushes, 
or python 3 and needs an explicit flush, the message itself is 
pointless, and the test is racy as a result).  We may need to revisit 
this patch when that thread is resolved.


https://lists.gnu.org/archive/html/qemu-devel/2018-08/msg01041.html

That said, I'm not opposed to this patch, if it gets iotests to be more 
useful in the meantime.




diff --git a/tests/qemu-iotests/083.out b/tests/qemu-iotests/083.out
index be6079d27e..f9af8bb691 100644
--- a/tests/qemu-iotests/083.out
+++ b/tests/qemu-iotests/083.out
@@ -41,6 +41,7 @@ can't open device nbd+tcp://127.0.0.1:PORT/foo
  
  === Check disconnect after neg2 ===
  
+Unable to read from socket: Connection reset by peer

  Connection closed
  read failed: Input/output error
  
@@ -54,6 +55,7 @@ can't open device nbd+tcp://127.0.0.1:PORT/foo
  
  === Check disconnect before request ===
  
+Unable to read from socket: Connection reset by peer

  Connection closed
  read failed: Input/output error
  
@@ -116,6 +118,7 @@ can't open device nbd+tcp://127.0.0.1:PORT/
  
  === Check disconnect after neg-classic ===
  
+Unable to read from socket: Connection reset by peer

  Connection closed
  read failed: Input/output error
  
@@ -161,6 +164,8 @@ can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
  
  === Check disconnect after neg2 ===
  
+Unable to read from socket: Connection reset by peer

+Connection closed
  read failed: Input/output error
  
  === Check disconnect 8 neg2 ===

@@ -173,6 +178,8 @@ can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
  
  === Check disconnect before request ===
  
+Unable to read from socket: Connection reset by peer

+Connection closed
  read failed: Input/output error
  
  === Check disconnect after request ===

@@ -234,6 +241,8 @@ can't open device nbd+unix:///?socket=TEST_DIR/nbd.sock
  
  === Check disconnect after neg-classic ===
  
+Unable to read from socket: Connection reset by peer

+Connection closed
  read failed: Input/output error
  
  *** done

diff --git a/tests/qemu-iotests/nbd-fault-injector.py 
b/tests/qemu-iotests/nbd-fault-injector.py
index f9193c0fae..439a090eb6 100755
--- a/tests/qemu-iotests/nbd-fault-injector.py
+++ b/tests/qemu-iotests/nbd-fault-injector.py
@@ -112,6 +112,7 @@ class FaultInjectionSocket(object):
  if rule.match(event, io):
  if rule.when == 0 or bufsize is None:
  print('Closing connection on rule match %s' % rule.name)
+self.sock.flush()
  sys.exit(0)
  if rule.when != -1:
  return rule.when



--
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH v2 2/8] block: Add auto-read-only option

[Eric Blake]

On 10/15/18 4:37 AM, Kevin Wolf wrote:

Am 12.10.2018 um 18:47 hat Eric Blake geschrieben:

On 10/12/18 6:55 AM, Kevin Wolf wrote:

If a management application builds the block graph node by node, the
protocol layer doesn't inherit its read-only option from the format
layer any more, so it must be set explicitly.







Bike-shedding: Do we really want to ignore @read-only? Here's the table of 9
combinations ('t'rue, 'f'alse, 'o'mitted), with '*' on the rows that must be
preserved for back-compat:

RO   Auto   effect
oo  *open for write, fail if not possible
fo  *open for write, fail if not possible
to  *open for read, no conversion to write
of  open for write, fail if not possible
ff  open for write, fail if not possible
tf  open for read, no conversion to write
ot  attempt write but graceful fall back to read
ft  attempt write but graceful fall back to read
tt  ignore RO flag, attempt write anyway

That last row is weird, why not make it an explicit error instead of
ignoring the implied difference in semantics between the two?


You're right that the description allows this. In practice,
auto-read-only can only make a node go from rw to ro, not the other way
round.

So our options are to document the current behaviour (auto-read-only has
no effect when the image is already read-only) or to make it an error.


Ah, that's different. I was reading it as "auto-read-only true lets you 
write if possible, overriding an explicit readonly request", while you 
are reading it as "auto-read-only true allows graceful fallback to 
read-only, and is thus a no-op if you already requested readonly"


I like yours better, so it's just a matter of coming up with the correct 
documentation wording.




One thought I had is that for convenience options like -hda (or in fact
-drive), auto-read-only=on could be the default, and only -blockdev and
blockdev-add would disable it by default. That would suggest that we
don't want to make it an error.


Yes, having convenience options set auto-read-only would not be too 
terrible (since those are already magic and designed for short-hand 
human use), as long as the low-level QMP commands don't add the magic 
(explicit control is better at the low levels).





Or, another idea: is it worth trying to support a single tri-state member
(via an alternative between bool and enum, since the existing code uses a
JSON bool):

"read-only": false (open for write, fail if not possible)
"read-only": true (open read-only, no later switching)
"read-only": "auto" (switch as needed; or for initial implementation attempt
for write with graceful fallback to read)
omitting read-only: same as "read-only":false for back-compat


If read-only were new, I would probably make it an enum, but adding it
now isn't very practical. I did actually start with an alternate and it
just wasn't very nice. One thing I remember is places that directly
accessed the options QDict, for which you could now have either a bool, a
string, an int or not present. It becomes a bit too much.


Fair enough. Maybe it's worth a commit message note that we at least 
considered and rejected alternate implementations.




As read-only is optional, we could make it true/false/absent without
introducing an alternate and the additional int/string options, but I
don't like that very much either.


No, that way is not introspectible.  Adding auto-read-only is much 
friendlier.





While we're talking about the schema, another thing I considered was
making auto-read-only an option only for the specific drivers that
support it so introspection could tell the management tool whether the
functionality is available. However, if we do this, we can't parse it in
block.c code and use a flag any more, but need to parse it in each
driver individually. Maybe it would be a better design anyway?


Which drivers do you have in mind? Ones like file-posix, gluster, and 
NBD that actually have a notion of opening either read-write or 
read-only, or others that are read-only no matter what?


I'm still not convinced that a per-driver option is smart, and am 
reasonably happy with you adding it globally.





@@ -1328,6 +1338,11 @@ QemuOptsList bdrv_runtime_opts = {
   .type = QEMU_OPT_BOOL,
   .help = "Node is opened in read-only mode",
   },
+{
+.name = BDRV_OPT_AUTO_READ_ONLY,
+.type = QEMU_OPT_BOOL,
+.help = "Node can become read-only if opening read-write fails",
+},


If we keep your current approach, is it worth mentioning that
auto-read-only true overrides read-only true?


This help text is never printed anywhere anyway... Maybe we should just
delete it. What we refer to is the QAPI documentation anyway.


Are you sure it never gets printed, with some of the recent patches 
around trying to improve help output?


--
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3266

[Qemu-devel] [PATCH v5 3/3] Travis support for the acceptance tests

[Cleber Rosa]

This enables the execution of the acceptance tests on Travis.

Because the Travis environment is based on Ubuntu Trusty, it requires
the python3-pip and python3.4-venv packages.

Signed-off-by: Cleber Rosa 
Tested-by: Philippe Mathieu-Daudé 
---
 .travis.yml | 5 +
 1 file changed, 5 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 95be6ec59f..f55f799c52 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -36,6 +36,8 @@ addons:
   - liburcu-dev
   - libusb-1.0-0-dev
   - libvte-2.90-dev
+  - python3-pip
+  - python3.4-venv
   - sparse
   - uuid-dev
   - gcovr
@@ -117,6 +119,9 @@ matrix:
 - env: CONFIG="--target-list=x86_64-softmmu"
   python:
 - "3.6"
+# Acceptance (Functional) tests
+- env: CONFIG="--python=/usr/bin/python3 --target-list=x86_64-softmmu"
+   TEST_CMD="make AVOCADO_SHOW=app check-acceptance"
 # Using newer GCC with sanitizers
 - addons:
 apt:
-- 
2.17.1

[Qemu-devel] [PATCH v5 2/3] Acceptance tests: add make rule for running them

[Cleber Rosa]

The acceptance (aka functional, aka Avocado-based) tests are
Python files located in "tests/acceptance" that need to be run
with the Avocado libs and test runner.

Let's provide a convenient way for QEMU developers to run them,
by making use of the tests-venv with the required setup.

Also, while the Avocado test runner will take care of creating a
location to save test results to, it was understood that it's better
if the results are kept within the build tree.

Signed-off-by: Cleber Rosa 
---
 docs/devel/testing.rst  | 43 -
 tests/Makefile.include  | 21 --
 tests/venv-requirements.txt |  1 +
 3 files changed, 58 insertions(+), 7 deletions(-)

diff --git a/docs/devel/testing.rst b/docs/devel/testing.rst
index 727c4019b5..e04feaccb5 100644
--- a/docs/devel/testing.rst
+++ b/docs/devel/testing.rst
@@ -545,10 +545,39 @@ Tests based on ``avocado_qemu.Test`` can easily:
- 
http://avocado-framework.readthedocs.io/en/latest/api/test/avocado.html#avocado.Test
- 
http://avocado-framework.readthedocs.io/en/latest/api/utils/avocado.utils.html
 
-Installation
-
+Running tests
+-
 
-To install Avocado and its dependencies, run:
+You can run the acceptance tests simply by executing:
+
+.. code::
+
+  make check-acceptance
+
+This involves the automatic creation of Python virtual environment
+within the build tree (at ``tests/venv``) which will have all the
+right dependencies, and will save tests results also within the
+build tree (at ``tests/results``).
+
+Note: the build environment must be using a Python 3 stack, and have
+the ``venv`` and ``pip`` packages installed.  If necessary, make sure
+``configure`` is called with ``--python=`` and that those modules are
+available.  On Debian and Ubuntu based systems, depending on the
+specific version, they may be on packages named ``python3-venv`` and
+``python3-pip``.
+
+The scripts installed inside the virtual environment may be used
+without an "activation".  For instance, the Avocado test runner
+may be invoked by running:
+
+ .. code::
+
+  tests/venv/bin/avocado run $OPTION1 $OPTION2 tests/acceptance/
+
+Manual Installation
+---
+
+To manually install Avocado and its dependencies, run:
 
 .. code::
 
@@ -689,11 +718,15 @@ The exact QEMU binary to be used on QEMUMachine.
 Uninstalling Avocado
 
 
-If you've followed the installation instructions above, you can easily
-uninstall Avocado.  Start by listing the packages you have installed::
+If you've followed the manual installation instructions above, you can
+easily uninstall Avocado.  Start by listing the packages you have
+installed::
 
   pip list --user
 
 And remove any package you want with::
 
   pip uninstall 
+
+If you've used ``make check-acceptance``, the Python virtual environment where
+Avocado is installed will be cleaned up as part of ``make check-clean``.
diff --git a/tests/Makefile.include b/tests/Makefile.include
index 49deb9b3a1..ff42cad3f0 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -11,6 +11,7 @@ check-help:
@echo " $(MAKE) check-qapi-schemaRun QAPI schema tests"
@echo " $(MAKE) check-block  Run block tests"
@echo " $(MAKE) check-tcgRun TCG tests"
+   @echo " $(MAKE) check-acceptance Run all acceptance (functional) 
tests"
@echo " $(MAKE) check-report.htmlGenerates an HTML test report"
@echo " $(MAKE) check-venv   Creates a Python venv for tests"
@echo " $(MAKE) check-clean  Clean the tests"
@@ -1020,10 +1021,15 @@ check-decodetree:
 
 # Python venv for running tests
 
-.PHONY: check-venv
+.PHONY: check-venv check-acceptance
 
 TESTS_VENV_DIR=$(BUILD_DIR)/tests/venv
 TESTS_VENV_REQ=$(SRC_PATH)/tests/venv-requirements.txt
+TESTS_RESULTS_DIR=$(BUILD_DIR)/tests/results
+# Controls the output generated by Avocado when running tests.
+# Any number of command separated loggers are accepted.  For more
+# information please refer to "avocado --help".
+AVOCADO_SHOW=none
 
 PYTHON_VER := $(findstring Python 3,$(shell $(PYTHON) -V))
 ifeq ($(PYTHON_VER),Python 3)
@@ -1040,8 +1046,19 @@ $(TESTS_VENV_DIR):
$(error "venv directory for tests requires Python 3")
 endif
 
+$(TESTS_RESULTS_DIR):
+   $(call quiet-command, mkdir -p $@, \
+MKDIR, $@)
+
 check-venv: $(TESTS_VENV_DIR)
 
+check-acceptance: check-venv $(TESTS_RESULTS_DIR)
+   $(call quiet-command, \
+$(TESTS_VENV_DIR)/bin/python -m avocado \
+--show=$(AVOCADO_SHOW) run --job-results-dir=$(TESTS_RESULTS_DIR) \
+--failfast=on $(SRC_PATH)/tests/acceptance, \
+"AVOCADO", "tests/acceptance")
+
 # Consolidated targets
 
 .PHONY: check-qapi-schema check-qtest check-unit check check-clean
@@ -1055,7 +1072,7 @@ check-clean:
rm -rf $(check-unit-y) tests/*.o $(QEMU_IOTESTS_HELPERS-y)
rm -rf $(sort $(foreach target,$(SYSEMU_TARG

Re: [Qemu-devel] [PATCH] virtio: Provide version-specific variants of virtio PCI devices

[Gerd Hoffmann]

  Hi,

> > See above.  We can't drop disable-modern.
> 
> Good point.  But this doesn't require it to be a supported device
> option for users/management.  Maybe we should rename it to
> "x-disable-modern" (but that's a separate discussion).

I think it would be more useful to allow properties being tagged as
"no-user", simliar to devices which we do not want be created via
-device.

> > > If we still want to provide a legacy-only virtio device, it should be
> > > a separate device type.
> > 
> > I can't see a reason why we should provide legacy-only virtio devices.
> 
> If the only reason for disable-modern to exist is for internal
> usage by machine-type code, I agree we don't need the -0.9 device
> types.

In the early virtio-1.0 days it was required for testing.  We had one or
two releases with virtio-1.0 support merged but not (yet) turned on by
default, so you had to use disable-modern=off to enable virtio-1.0
support.  That use case is gone though since we flipped the default.

cheers,
  Gerd

[Qemu-devel] [PATCH v5 1/3] Bootstrap Python venv for tests

[Cleber Rosa]

A number of QEMU tests are written in Python, and may benefit
from an untainted Python venv.

By using make rules, tests that depend on specific Python libs
can set that rule as a requirement, along with rules that require
the presence or installation of specific libraries.

The tests/venv-requirements.txt is supposed to contain the
Python requirements that should be added to the venv created
by check-venv.

Signed-off-by: Cleber Rosa 
Tested-by: Philippe Mathieu-Daudé 
Signed-off-by: Cleber Rosa 
---
 tests/Makefile.include  | 26 ++
 tests/venv-requirements.txt |  3 +++
 2 files changed, 29 insertions(+)
 create mode 100644 tests/venv-requirements.txt

diff --git a/tests/Makefile.include b/tests/Makefile.include
index 5eadfd52f9..49deb9b3a1 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -12,6 +12,7 @@ check-help:
@echo " $(MAKE) check-block  Run block tests"
@echo " $(MAKE) check-tcgRun TCG tests"
@echo " $(MAKE) check-report.htmlGenerates an HTML test report"
+   @echo " $(MAKE) check-venv   Creates a Python venv for tests"
@echo " $(MAKE) check-clean  Clean the tests"
@echo
@echo "Please note that HTML reports do not regenerate if the unit 
tests"
@@ -1017,6 +1018,30 @@ check-decodetree:
   ./check.sh "$(PYTHON)" "$(SRC_PATH)/scripts/decodetree.py", \
   TEST, decodetree.py)
 
+# Python venv for running tests
+
+.PHONY: check-venv
+
+TESTS_VENV_DIR=$(BUILD_DIR)/tests/venv
+TESTS_VENV_REQ=$(SRC_PATH)/tests/venv-requirements.txt
+
+PYTHON_VER := $(findstring Python 3,$(shell $(PYTHON) -V))
+ifeq ($(PYTHON_VER),Python 3)
+$(TESTS_VENV_DIR): $(TESTS_VENV_REQ)
+   $(call quiet-command, \
+$(PYTHON) -m venv --system-site-packages $@, \
+VENV, $@)
+   $(call quiet-command, \
+$(TESTS_VENV_DIR)/bin/python -m pip -q install -r 
$(TESTS_VENV_REQ), \
+PIP, $(TESTS_VENV_REQ))
+   $(call quiet-command, touch $@)
+else
+$(TESTS_VENV_DIR):
+   $(error "venv directory for tests requires Python 3")
+endif
+
+check-venv: $(TESTS_VENV_DIR)
+
 # Consolidated targets
 
 .PHONY: check-qapi-schema check-qtest check-unit check check-clean
@@ -1030,6 +1055,7 @@ check-clean:
rm -rf $(check-unit-y) tests/*.o $(QEMU_IOTESTS_HELPERS-y)
rm -rf $(sort $(foreach target,$(SYSEMU_TARGET_LIST), 
$(check-qtest-$(target)-y)) $(check-qtest-generic-y))
rm -f tests/test-qapi-gen-timestamp
+   rm -rf $(TESTS_VENV_DIR)
 
 clean: check-clean
 
diff --git a/tests/venv-requirements.txt b/tests/venv-requirements.txt
new file mode 100644
index 00..d39f9d1576
--- /dev/null
+++ b/tests/venv-requirements.txt
@@ -0,0 +1,3 @@
+# Add Python module requirements, one per line, to be installed
+# in the tests/venv Python virtual environment. For more info,
+# refer to: https://pip.pypa.io/en/stable/user_guide/#id1
-- 
2.17.1

Re: [Qemu-devel] [PATCH v1 0/5] Misc RISC-V patches

[Palmer Dabbelt]

On Tue, 16 Oct 2018 01:05:11 PDT (-0700), peter.mayd...@linaro.org wrote:

On 15 October 2018 at 21:28, Palmer Dabbelt  wrote:

On Fri, 12 Oct 2018 02:34:12 PDT (-0700), peter.mayd...@linaro.org wrote:

The expected patch flow for QEMU is:
 * original patch author posts patch to qemu-devel
   (this applies also if the author happens to be the
   submaintainer)
 * patch gets reviewed on this mailing list, by you or
   anybody else
 * patches relevant to risc-v get collected up by the
   submaintainer
 * submaintainer submits those patches via pull request
   (with a frequency usually about every two weeks, more
   often if volume of patches merits it)



This makes sense.  It's almost exactly the Linux flow, which I'm used to and
I have down to a fairly mechanical process.  I think the real issue here is
that we don't have anyone who has officially committed to doing this, so I'm
just going to pull the trigger and say I'm doing so.


Thanks for picking this up.


My Linux PR flow is to tag a PR on Mondays, send it out to the list for
comments, and then if it passes muster to submit an official PR on
Wednesdays.  It's been working smoothly (we've yet to have to kill a PR), so
I think I'll do the same thing for QEMU except I'll do Tuesday/Thursday.


For QEMU we do patches first, pull requests for reviewed stuff.
If you send a pull request out to the list the assumption is
that it's a request to apply it to master immediately.


Yep, that's the same as Linux.  I just send the PR to the RISC-V mailing lists 
marked as an RFC so it doesn't get confused.  If you don't want me to do this 
in QEMU land then it's fine.

[Qemu-devel] [PULL 19/21] target/s390x: Skip wout, cout helpers if op helper does not return

[Richard Henderson]

When op raises an exception, it may not have initialized the output
temps that would be written back by wout or cout.

Reviewed-by: David Hildenbrand 
Signed-off-by: Richard Henderson 
---
 target/s390x/translate.c | 20 +++-
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index 18861cd186..a7bd689337 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -1128,11 +1128,19 @@ struct DisasInsn {
 
 const char *name;
 
+/* Pre-process arguments before HELP_OP.  */
 void (*help_in1)(DisasContext *, DisasFields *, DisasOps *);
 void (*help_in2)(DisasContext *, DisasFields *, DisasOps *);
 void (*help_prep)(DisasContext *, DisasFields *, DisasOps *);
+
+/*
+ * Post-process output after HELP_OP.
+ * Note that these are not called if HELP_OP returns DISAS_NORETURN.
+ */
 void (*help_wout)(DisasContext *, DisasFields *, DisasOps *);
 void (*help_cout)(DisasContext *, DisasOps *);
+
+/* Implement the operation itself.  */
 DisasJumpType (*help_op)(DisasContext *, DisasOps *);
 
 uint64_t data;
@@ -6125,11 +6133,13 @@ static DisasJumpType translate_one(CPUS390XState *env, 
DisasContext *s)
 if (insn->help_op) {
 ret = insn->help_op(s, &o);
 }
-if (insn->help_wout) {
-insn->help_wout(s, &f, &o);
-}
-if (insn->help_cout) {
-insn->help_cout(s, &o);
+if (ret != DISAS_NORETURN) {
+if (insn->help_wout) {
+insn->help_wout(s, &f, &o);
+}
+if (insn->help_cout) {
+insn->help_cout(s, &o);
+}
 }
 
 /* Free any temporaries created by the helpers.  */
-- 
2.17.2

[Qemu-devel] [RFC PATCH v1 2/4] Add migration functions for VFIO devices

[Kirti Wankhede]

- Migration function are implemented for VFIO_DEVICE_TYPE_PCI device.
- Added SaveVMHandlers and implemented all basic functions required for live
  migration.
- Added VM state change handler to know running or stopped state of VM.
- Added migration state change notifier to get notification on migration state
  change. This state is translated to VFIO device state and conveyed to vendor
  driver.

Signed-off-by: Kirti Wankhede 
Reviewed-by: Neo Jia 
---
 hw/vfio/Makefile.objs |   2 +-
 hw/vfio/migration.c   | 716 ++
 include/hw/vfio/vfio-common.h |  23 ++
 3 files changed, 740 insertions(+), 1 deletion(-)
 create mode 100644 hw/vfio/migration.c

diff --git a/hw/vfio/Makefile.objs b/hw/vfio/Makefile.objs
index a2e7a0a7cf02..6206ad47e90e 100644
--- a/hw/vfio/Makefile.objs
+++ b/hw/vfio/Makefile.objs
@@ -1,6 +1,6 @@
 ifeq ($(CONFIG_LINUX), y)
 obj-$(CONFIG_SOFTMMU) += common.o
-obj-$(CONFIG_PCI) += pci.o pci-quirks.o display.o
+obj-$(CONFIG_PCI) += pci.o pci-quirks.o display.o migration.o
 obj-$(CONFIG_VFIO_CCW) += ccw.o
 obj-$(CONFIG_SOFTMMU) += platform.o
 obj-$(CONFIG_VFIO_XGMAC) += calxeda-xgmac.o
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
new file mode 100644
index ..8a4f515226e0
--- /dev/null
+++ b/hw/vfio/migration.c
@@ -0,0 +1,716 @@
+/*
+ * Migration support for VFIO devices
+ *
+ * Copyright NVIDIA, Inc. 2018
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include 
+#include 
+
+#include "hw/vfio/vfio-common.h"
+#include "cpu.h"
+#include "migration/migration.h"
+#include "migration/qemu-file.h"
+#include "migration/register.h"
+#include "migration/blocker.h"
+#include "migration/misc.h"
+#include "qapi/error.h"
+#include "exec/ramlist.h"
+#include "exec/ram_addr.h"
+#include "pci.h"
+
+/*
+ * Flags used as delimiter:
+ * 0x => MSB 32-bit all 1s
+ * 0xef10 => emulated (virtual) function IO
+ * 0x => 16-bits reserved for flags
+ */
+#define VFIO_MIG_FLAG_END_OF_STATE  (0xef11ULL)
+#define VFIO_MIG_FLAG_DEV_CONFIG_STATE  (0xef12ULL)
+#define VFIO_MIG_FLAG_DEV_SETUP_STATE   (0xef13ULL)
+
+static void vfio_migration_region_exit(VFIODevice *vbasedev)
+{
+VFIOMigration *migration = vbasedev->migration;
+
+if (!migration) {
+return;
+}
+
+if (migration->region.buffer.size) {
+vfio_region_exit(&migration->region.buffer);
+vfio_region_finalize(&migration->region.buffer);
+}
+g_free(vbasedev->migration);
+}
+
+static int vfio_migration_region_init(VFIODevice *vbasedev)
+{
+VFIOMigration *migration;
+Object *obj = NULL;
+int ret;
+struct vfio_device_migration_info migration_info = {
+.argsz = sizeof(migration_info),
+.flags = VFIO_MIGRATION_GET_REGION,
+};
+
+/* Migration support added for PCI device only */
+if (vbasedev->type == VFIO_DEVICE_TYPE_PCI) {
+VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
+
+obj = OBJECT(vdev);
+} else
+return -EINVAL;
+
+ret = ioctl(vbasedev->fd, VFIO_DEVICE_MIGRATION_INFO, &migration_info);
+if (ret < 0) {
+error_report("Failed to migration region %s",
+ strerror(errno));
+return ret;
+}
+
+if (!migration_info.size || !migration_info.region_index) {
+error_report("Incorrect migration region params index: %d,size: 
0x%llx",
+ migration_info.region_index, migration_info.size);
+return -EINVAL;
+}
+
+vbasedev->migration = g_new0(VFIOMigration, 1);
+migration = vbasedev->migration;
+
+migration->region.index = migration_info.region_index;
+
+ret = vfio_region_setup(obj, vbasedev,
+&migration->region.buffer,
+migration_info.region_index,
+"migration");
+if (ret != 0) {
+error_report("%s: vfio_region_setup(%d): %s",
+__func__, migration_info.region_index, strerror(-ret));
+goto err;
+}
+
+if (migration->region.buffer.mmaps == NULL) {
+ret = -EINVAL;
+error_report("%s: Migration region (%d) not mappable : %s",
+__func__, migration_info.region_index, strerror(-ret));
+goto err;
+}
+
+ret = vfio_region_mmap(&migration->region.buffer);
+if (ret != 0) {
+error_report("%s: vfio_region_mmap(%d): %s", __func__,
+migration_info.region_index, strerror(-ret));
+goto err;
+}
+assert(migration->region.buffer.mmaps[0].mmap != NULL);
+
+return 0;
+
+err:
+vfio_migration_region_exit(vbasedev);
+return ret;
+}
+
+static int vfio_migration_set_state(VFIODevice *vbasedev, uint32_t state)
+{
+int ret = 0;
+struct vfio_device_migration_info migration_info = {
+.argsz 

[Qemu-devel] [RFC PATCH v1 1/4] VFIO KABI for migration interface

[Kirti Wankhede]

- Added vfio_device_migration_info structure to use interact with vendor
  driver.
- Different flags are used to get or set migration related information
  from/to vendor driver.
Flag VFIO_MIGRATION_PROBE: To query if feature is supported
Flag VFIO_MIGRATION_GET_REGION: To get migration region info
Flag VFIO_MIGRATION_SET_STATE: To convey device state in vendor driver
Flag VFIO_MIGRATION_GET_PENDING: To get pending bytes yet to be migrated
  from vendor driver
Flag VFIO_MIGRATION_GET_BUFFER: On this flag, vendor driver should write
  data to migration region and return number of bytes written in the region
Flag VFIO_MIGRATION_SET_BUFFER: In migration resume path, user space app
  writes to migration region and communicates it to vendor driver with
  this ioctl with this flag.
Flag VFIO_MIGRATION_GET_DIRTY_PFNS: Get bitmap of dirty pages from vendor
  driver from given start address

- Added enum for possible device states.

Signed-off-by: Kirti Wankhede 
Reviewed-by: Neo Jia 
---
 linux-headers/linux/vfio.h | 91 ++
 1 file changed, 91 insertions(+)

diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index 3615a269d378..8e9045ed9aa8 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -602,6 +602,97 @@ struct vfio_device_ioeventfd {
 
 #define VFIO_DEVICE_IOEVENTFD  _IO(VFIO_TYPE, VFIO_BASE + 16)
 
+/**
+ * VFIO_DEVICE_MIGRATION_INFO - _IOW(VFIO_TYPE, VFIO_BASE + 17,
+ *  struct vfio_device_migration_info)
+ * Flag VFIO_MIGRATION_PROBE:
+ *  To query if feature is supported
+ *
+ * Flag VFIO_MIGRATION_GET_REGION:
+ *  To get migration region info
+ *  region_index [output] : region index to be used for migration region
+ *  size [output]: size of migration region
+ *
+ * Flag VFIO_MIGRATION_SET_STATE:
+ *  To set device state in vendor driver
+ *  device_state [input] : User space app sends device state to vendor
+ *   driver on state change
+ *
+ * Flag VFIO_MIGRATION_GET_PENDING:
+ *  To get pending bytes yet to be migrated from vendor driver
+ *  threshold_size [Input] : threshold of buffer in User space app.
+ *  pending_precopy_only [output] : pending data which must be migrated in
+ *  precopy phase or in stopped state, in other words - before target
+ *  vm start
+ *  pending_compatible [output] : pending data which may be migrated in any
+ *   phase
+ *  pending_postcopy_only [output] : pending data which must be migrated in
+ *   postcopy phase or in stopped state, in other words - after source
+ *   vm stop
+ *  Sum of pending_precopy_only, pending_compatible and
+ *  pending_postcopy_only is the whole amount of pending data.
+ *
+ * Flag VFIO_MIGRATION_GET_BUFFER:
+ *  On this flag, vendor driver should write data to migration region and
+ *  return number of bytes written in the region.
+ *  bytes_written [output] : number of bytes written in migration buffer by
+ *  vendor driver
+ *
+ * Flag VFIO_MIGRATION_SET_BUFFER
+ *  In migration resume path, user space app writes to migration region and
+ *  communicates it to vendor driver with this ioctl with this flag.
+ *  bytes_written [Input] : number of bytes written in migration buffer by
+ *  user space app.
+ *
+ * Flag VFIO_MIGRATION_GET_DIRTY_PFNS
+ *  Get bitmap of dirty pages from vendor driver from given start address.
+ *  start_addr [Input] : start address
+ *  pfn_count [Input] : Total pfn count from start_addr for which dirty
+ *  bitmap is requested
+ *  dirty_bitmap [Output] : bitmap memory allocated by user space
+ *   application, vendor driver should return the bitmap with bits set
+ *   only for pages to be marked dirty.
+ * Return: 0 on success, -errno on failure.
+ */
+
+struct vfio_device_migration_info {
+   __u32 argsz;
+   __u32 flags;
+#define VFIO_MIGRATION_PROBE(1 << 0)
+#define VFIO_MIGRATION_GET_REGION   (1 << 1)
+#define VFIO_MIGRATION_SET_STATE(1 << 2)
+#define VFIO_MIGRATION_GET_PENDING  (1 << 3)
+#define VFIO_MIGRATION_GET_BUFFER   (1 << 4)
+#define VFIO_MIGRATION_SET_BUFFER   (1 << 5)
+#define VFIO_MIGRATION_GET_DIRTY_PFNS   (1 << 6)
+__u32 region_index;/* region index */
+__u64 size;/* size */
+__u32 device_state; /* VFIO device state */
+__u64 pending_precopy_only;
+__u64 pending_compatible;
+__u64 pending_postcopy_only;
+__u64 threshold_size;
+__u64 bytes_written;
+__u64 start_addr;
+__u64 pfn_count;
+   __u8  dirty_bitmap[];
+};
+
+enum {
+VFIO_DEVICE_STATE_NONE,
+VFIO_DEVICE_STATE_RUNNING,
+VFIO_DEVICE_STATE_MIGRATION_SETUP,
+VFIO_DEVICE_STATE_MIGRATION_PRECOPY_ACTIVE,
+VFIO_DEVICE_STATE_MIGRATION_STOPNCOPY_ACTIVE

[Qemu-devel] [PULL 17/21] target/s390x: Convert to HAVE_CMPXCHG128 and HAVE_ATOMIC128

[Richard Henderson]

Reviewed-by: David Hildenbrand 
Signed-off-by: Richard Henderson 
---
 target/s390x/mem_helper.c | 92 +--
 1 file changed, 41 insertions(+), 51 deletions(-)

diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
index bacae4f503..e106f61b4e 100644
--- a/target/s390x/mem_helper.c
+++ b/target/s390x/mem_helper.c
@@ -25,6 +25,7 @@
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
 #include "qemu/int128.h"
+#include "qemu/atomic128.h"
 
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/s390x/storage-keys.h"
@@ -1389,7 +1390,7 @@ static void do_cdsg(CPUS390XState *env, uint64_t addr,
 bool fail;
 
 if (parallel) {
-#ifndef CONFIG_ATOMIC128
+#if !HAVE_CMPXCHG128
 cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
 #else
 int mem_idx = cpu_mmu_index(env, false);
@@ -1435,9 +1436,7 @@ void HELPER(cdsg_parallel)(CPUS390XState *env, uint64_t 
addr,
 static uint32_t do_csst(CPUS390XState *env, uint32_t r3, uint64_t a1,
 uint64_t a2, bool parallel)
 {
-#if !defined(CONFIG_USER_ONLY) || defined(CONFIG_ATOMIC128)
 uint32_t mem_idx = cpu_mmu_index(env, false);
-#endif
 uintptr_t ra = GETPC();
 uint32_t fc = extract32(env->regs[0], 0, 8);
 uint32_t sc = extract32(env->regs[0], 8, 8);
@@ -1465,18 +1464,20 @@ static uint32_t do_csst(CPUS390XState *env, uint32_t 
r3, uint64_t a1,
 probe_write(env, a2, 0, mem_idx, ra);
 #endif
 
-/* Note that the compare-and-swap is atomic, and the store is atomic, but
-   the complete operation is not.  Therefore we do not need to assert 
serial
-   context in order to implement this.  That said, restart early if we 
can't
-   support either operation that is supposed to be atomic.  */
+/*
+ * Note that the compare-and-swap is atomic, and the store is atomic,
+ * but the complete operation is not.  Therefore we do not need to
+ * assert serial context in order to implement this.  That said,
+ * restart early if we can't support either operation that is supposed
+ * to be atomic.
+ */
 if (parallel) {
-int mask = 0;
-#if !defined(CONFIG_ATOMIC64)
-mask = -8;
-#elif !defined(CONFIG_ATOMIC128)
-mask = -16;
+uint32_t max = 2;
+#ifdef CONFIG_ATOMIC64
+max = 3;
 #endif
-if (((4 << fc) | (1 << sc)) & mask) {
+if ((HAVE_CMPXCHG128 ? 0 : fc + 2 > max) ||
+(HAVE_ATOMIC128  ? 0 : sc > max)) {
 cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
 }
 }
@@ -1546,16 +1547,7 @@ static uint32_t do_csst(CPUS390XState *env, uint32_t r3, 
uint64_t a1,
 Int128 cv = int128_make128(env->regs[r3 + 1], env->regs[r3]);
 Int128 ov;
 
-if (parallel) {
-#ifdef CONFIG_ATOMIC128
-TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
-ov = helper_atomic_cmpxchgo_be_mmu(env, a1, cv, nv, oi, ra);
-cc = !int128_eq(ov, cv);
-#else
-/* Note that we asserted !parallel above.  */
-g_assert_not_reached();
-#endif
-} else {
+if (!parallel) {
 uint64_t oh = cpu_ldq_data_ra(env, a1 + 0, ra);
 uint64_t ol = cpu_ldq_data_ra(env, a1 + 8, ra);
 
@@ -1567,6 +1559,13 @@ static uint32_t do_csst(CPUS390XState *env, uint32_t r3, 
uint64_t a1,
 
 cpu_stq_data_ra(env, a1 + 0, int128_gethi(nv), ra);
 cpu_stq_data_ra(env, a1 + 8, int128_getlo(nv), ra);
+} else if (HAVE_CMPXCHG128) {
+TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
+ov = helper_atomic_cmpxchgo_be_mmu(env, a1, cv, nv, oi, ra);
+cc = !int128_eq(ov, cv);
+} else {
+/* Note that we asserted !parallel above.  */
+g_assert_not_reached();
 }
 
 env->regs[r3 + 0] = int128_gethi(ov);
@@ -1596,18 +1595,16 @@ static uint32_t do_csst(CPUS390XState *env, uint32_t 
r3, uint64_t a1,
 cpu_stq_data_ra(env, a2, svh, ra);
 break;
 case 4:
-if (parallel) {
-#ifdef CONFIG_ATOMIC128
+if (!parallel) {
+cpu_stq_data_ra(env, a2 + 0, svh, ra);
+cpu_stq_data_ra(env, a2 + 8, svl, ra);
+} else if (HAVE_ATOMIC128) {
 TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
 Int128 sv = int128_make128(svl, svh);
 helper_atomic_sto_be_mmu(env, a2, sv, oi, ra);
-#else
+} else {
 /* Note that we asserted !parallel above.  */
 g_assert_not_reached();
-#endif
-} else {
-cpu_stq_data_ra(env, a2 + 0, svh, ra);
-cpu_stq_data_ra(env, a2 + 8, svl, ra);
 }
 break;
 default:
@@ -2105,21 +2102,18 @@ static uint64_t do_lpq(CPUS390XState *env, uint64_t 
addr, bool p

[Qemu-devel] [RFC PATCH v1 4/4] Make vfio-pci device migration capable.

[Kirti Wankhede]

Call vfio_migration_probe() and vfio_migration_finalize() functions for
vfio-pci device to enable migration for vfio PCI device.
Removed vfio_pci_vmstate structure.

Signed-off-by: Kirti Wankhede 
Reviewed-by: Neo Jia 
---
 hw/vfio/pci.c | 13 ++---
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6cbb8fa0549d..dd833f3f1830 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2835,6 +2835,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
 vdev->vbasedev.ops = &vfio_pci_ops;
 vdev->vbasedev.type = VFIO_DEVICE_TYPE_PCI;
 vdev->vbasedev.dev = &vdev->pdev.qdev;
+vdev->vbasedev.device_state = VFIO_DEVICE_STATE_NONE;
 
 tmp = g_strdup_printf("%s/iommu_group", vdev->vbasedev.sysfsdev);
 len = readlink(tmp, group_path, sizeof(group_path));
@@ -3046,10 +3047,11 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
 }
 }
 
+ret = vfio_migration_probe(&vdev->vbasedev, errp);
+
 vfio_register_err_notifier(vdev);
 vfio_register_req_notifier(vdev);
 vfio_setup_resetfn_quirk(vdev);
-
 return;
 
 out_teardown:
@@ -3085,6 +3087,8 @@ static void vfio_exitfn(PCIDevice *pdev)
 {
 VFIOPCIDevice *vdev = DO_UPCAST(VFIOPCIDevice, pdev, pdev);
 
+vdev->vbasedev.device_state = VFIO_DEVICE_STATE_NONE;
+
 vfio_unregister_req_notifier(vdev);
 vfio_unregister_err_notifier(vdev);
 pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
@@ -3094,6 +3098,7 @@ static void vfio_exitfn(PCIDevice *pdev)
 }
 vfio_teardown_msi(vdev);
 vfio_bars_exit(vdev);
+vfio_migration_finalize(&vdev->vbasedev);
 }
 
 static void vfio_pci_reset(DeviceState *dev)
@@ -3199,11 +3204,6 @@ static Property vfio_pci_dev_properties[] = {
 DEFINE_PROP_END_OF_LIST(),
 };
 
-static const VMStateDescription vfio_pci_vmstate = {
-.name = "vfio-pci",
-.unmigratable = 1,
-};
-
 static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
 {
 DeviceClass *dc = DEVICE_CLASS(klass);
@@ -3211,7 +3211,6 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, 
void *data)
 
 dc->reset = vfio_pci_reset;
 dc->props = vfio_pci_dev_properties;
-dc->vmsd = &vfio_pci_vmstate;
 dc->desc = "VFIO-based PCI device assignment";
 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 pdc->realize = vfio_realize;
-- 
2.7.0

Re: [Qemu-devel] [PATCH] target/mips: Support Toshiba specific three-operand MADD and MADDU

[Fredrik Noring]

Hi Aleksandar,

> A peculiar case of DMULTU would be interesting.

Agreed, DMULTU would be good to test as well. (DMULTU isn't part of the
R5900 ISA, though.)

> It would be nice to implement just a single instruction from MMI, let's
> say PAND, and have a test for it.

Most if not all multimedia instructions operate on 128-bit GPRs, which
means all GPRs need to be extended. I suppose there are several ways to
implement this. The definitions in target/mips/translate.c are:

/* global register indices */
static TCGv cpu_gpr[32], cpu_PC;
static TCGv cpu_HI[MIPS_DSP_ACC], cpu_LO[MIPS_DSP_ACC];

One option is to create a new array such as

static TCGv_i64 mmi_gpr[32];

that represents the upper 64 bits of each GPR. Then cpu_gpr must be of
a 64-bit type too, even when QEMU runs in 32-bit user mode. The R5900
does not implement CP0.Status.UX in hardware, though, so system mode is
64 bits, regardless.

Interestingly, LO and HI are also extended to 128 bits, where the upper
64 bits are used for the I1 pipeline instructions MULT1, etc.

Additionally, a special SA register contains the shift amount used by
the 256-bit funnel shift multimedia instruction QFSRV.

What are your thoughts on making these register extensions in QEMU?

Fredrik

[Qemu-devel] [PULL 11/21] tcg: Add tlb_index and tlb_entry helpers

[Richard Henderson]

Isolate the computation of an index from an address into a
helper before we change that function.

Reviewed-by: Alex Bennée 
Signed-off-by: Richard Henderson 
[ cota: convert tlb_vaddr_to_host; use atomic_read on addr_write ]
Signed-off-by: Emilio G. Cota 
Message-Id: <20181009175129.17888-2-c...@braap.org>
---
 accel/tcg/softmmu_template.h | 64 +---
 include/exec/cpu_ldst.h  | 19 --
 include/exec/cpu_ldst_template.h | 25 +++--
 accel/tcg/cputlb.c   | 60 ++
 4 files changed, 90 insertions(+), 78 deletions(-)

diff --git a/accel/tcg/softmmu_template.h b/accel/tcg/softmmu_template.h
index f060a693d4..09538b5349 100644
--- a/accel/tcg/softmmu_template.h
+++ b/accel/tcg/softmmu_template.h
@@ -111,9 +111,10 @@ static inline DATA_TYPE glue(io_read, SUFFIX)(CPUArchState 
*env,
 WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong addr,
 TCGMemOpIdx oi, uintptr_t retaddr)
 {
-unsigned mmu_idx = get_mmuidx(oi);
-int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-target_ulong tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
+uintptr_t mmu_idx = get_mmuidx(oi);
+uintptr_t index = tlb_index(env, mmu_idx, addr);
+CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
+target_ulong tlb_addr = entry->ADDR_READ;
 unsigned a_bits = get_alignment_bits(get_memop(oi));
 uintptr_t haddr;
 DATA_TYPE res;
@@ -129,7 +130,7 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong 
addr,
 tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
  mmu_idx, retaddr);
 }
-tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
+tlb_addr = entry->ADDR_READ;
 }
 
 /* Handle an IO access.  */
@@ -166,7 +167,7 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong 
addr,
 return res;
 }
 
-haddr = addr + env->tlb_table[mmu_idx][index].addend;
+haddr = addr + entry->addend;
 #if DATA_SIZE == 1
 res = glue(glue(ld, LSUFFIX), _p)((uint8_t *)haddr);
 #else
@@ -179,9 +180,10 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, 
target_ulong addr,
 WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong addr,
 TCGMemOpIdx oi, uintptr_t retaddr)
 {
-unsigned mmu_idx = get_mmuidx(oi);
-int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-target_ulong tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
+uintptr_t mmu_idx = get_mmuidx(oi);
+uintptr_t index = tlb_index(env, mmu_idx, addr);
+CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
+target_ulong tlb_addr = entry->ADDR_READ;
 unsigned a_bits = get_alignment_bits(get_memop(oi));
 uintptr_t haddr;
 DATA_TYPE res;
@@ -197,7 +199,7 @@ WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong 
addr,
 tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
  mmu_idx, retaddr);
 }
-tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
+tlb_addr = entry->ADDR_READ;
 }
 
 /* Handle an IO access.  */
@@ -234,7 +236,7 @@ WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong 
addr,
 return res;
 }
 
-haddr = addr + env->tlb_table[mmu_idx][index].addend;
+haddr = addr + entry->addend;
 res = glue(glue(ld, LSUFFIX), _be_p)((uint8_t *)haddr);
 return res;
 }
@@ -275,9 +277,10 @@ static inline void glue(io_write, SUFFIX)(CPUArchState 
*env,
 void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
TCGMemOpIdx oi, uintptr_t retaddr)
 {
-unsigned mmu_idx = get_mmuidx(oi);
-int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-target_ulong tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
+uintptr_t mmu_idx = get_mmuidx(oi);
+uintptr_t index = tlb_index(env, mmu_idx, addr);
+CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
+target_ulong tlb_addr = entry->addr_write;
 unsigned a_bits = get_alignment_bits(get_memop(oi));
 uintptr_t haddr;
 
@@ -292,7 +295,7 @@ void helper_le_st_name(CPUArchState *env, target_ulong 
addr, DATA_TYPE val,
 tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, MMU_DATA_STORE,
  mmu_idx, retaddr);
 }
-tlb_addr = env->tlb_table[mmu_idx][index].addr_write & 
~TLB_INVALID_MASK;
+tlb_addr = entry->addr_write & ~TLB_INVALID_MASK;
 }
 
 /* Handle an IO access.  */
@@ -313,16 +316,16 @@ void helper_le_st_name(CPUArchState *env, target_ulong 
addr, DATA_TYPE val,
 if (DATA_SIZE > 1
 && unlikely((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1
  >= TARGET_PAGE_SIZE)) {
-int i, index2;
-target_ulong page2, tlb_addr2;
+int i;
+target_ulong page2;
+CPUTLBEntry *entry2;
 do_unaligned_access:
 /* Ensure the secon

[Qemu-devel] [PULL 15/21] target/arm: Check HAVE_CMPXCHG128 at translate time

[Richard Henderson]

Reviewed-by: Emilio G. Cota 
Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/arm/helper-a64.c| 16 
 target/arm/translate-a64.c | 38 ++
 2 files changed, 26 insertions(+), 28 deletions(-)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 6e4e1b8a19..61799d20e1 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -563,9 +563,7 @@ uint64_t HELPER(paired_cmpxchg64_le_parallel)(CPUARMState 
*env, uint64_t addr,
 int mem_idx;
 TCGMemOpIdx oi;
 
-if (!HAVE_CMPXCHG128) {
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-}
+assert(HAVE_CMPXCHG128);
 
 mem_idx = cpu_mmu_index(env, false);
 oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
@@ -635,9 +633,7 @@ uint64_t HELPER(paired_cmpxchg64_be_parallel)(CPUARMState 
*env, uint64_t addr,
 int mem_idx;
 TCGMemOpIdx oi;
 
-if (!HAVE_CMPXCHG128) {
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-}
+assert(HAVE_CMPXCHG128);
 
 mem_idx = cpu_mmu_index(env, false);
 oi = make_memop_idx(MO_BEQ | MO_ALIGN_16, mem_idx);
@@ -663,9 +659,7 @@ void HELPER(casp_le_parallel)(CPUARMState *env, uint32_t 
rs, uint64_t addr,
 int mem_idx;
 TCGMemOpIdx oi;
 
-if (!HAVE_CMPXCHG128) {
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-}
+assert(HAVE_CMPXCHG128);
 
 mem_idx = cpu_mmu_index(env, false);
 oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
@@ -686,9 +680,7 @@ void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t 
rs, uint64_t addr,
 int mem_idx;
 TCGMemOpIdx oi;
 
-if (!HAVE_CMPXCHG128) {
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-}
+assert(HAVE_CMPXCHG128);
 
 mem_idx = cpu_mmu_index(env, false);
 oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 8a24278d79..bb9c4d8ac7 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -37,6 +37,7 @@
 
 #include "trace-tcg.h"
 #include "translate-a64.h"
+#include "qemu/atomic128.h"
 
 static TCGv_i64 cpu_X[32];
 static TCGv_i64 cpu_pc;
@@ -2086,26 +2087,27 @@ static void gen_store_exclusive(DisasContext *s, int 
rd, int rt, int rt2,
get_mem_index(s),
MO_64 | MO_ALIGN | s->be_data);
 tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
-} else if (s->be_data == MO_LE) {
-if (tb_cflags(s->base.tb) & CF_PARALLEL) {
+} else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
+if (!HAVE_CMPXCHG128) {
+gen_helper_exit_atomic(cpu_env);
+s->base.is_jmp = DISAS_NORETURN;
+} else if (s->be_data == MO_LE) {
 gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
 cpu_exclusive_addr,
 cpu_reg(s, rt),
 cpu_reg(s, rt2));
 } else {
-gen_helper_paired_cmpxchg64_le(tmp, cpu_env, 
cpu_exclusive_addr,
-   cpu_reg(s, rt), cpu_reg(s, 
rt2));
-}
-} else {
-if (tb_cflags(s->base.tb) & CF_PARALLEL) {
 gen_helper_paired_cmpxchg64_be_parallel(tmp, cpu_env,
 cpu_exclusive_addr,
 cpu_reg(s, rt),
 cpu_reg(s, rt2));
-} else {
-gen_helper_paired_cmpxchg64_be(tmp, cpu_env, 
cpu_exclusive_addr,
-   cpu_reg(s, rt), cpu_reg(s, 
rt2));
 }
+} else if (s->be_data == MO_LE) {
+gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
+   cpu_reg(s, rt), cpu_reg(s, rt2));
+} else {
+gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
+   cpu_reg(s, rt), cpu_reg(s, rt2));
 }
 } else {
 tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
@@ -2175,14 +2177,18 @@ static void gen_compare_and_swap_pair(DisasContext *s, 
int rs, int rt,
 }
 tcg_temp_free_i64(cmp);
 } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
-TCGv_i32 tcg_rs = tcg_const_i32(rs);
-
-if (s->be_data == MO_LE) {
-gen_helper_casp_le_parallel(cpu_env, tcg_rs, addr, t1, t2);
+if (HAVE_CMPXCHG128) {
+TCGv_i32 tcg_rs = tcg_const_i32(rs);
+if (s->be_data == MO_LE) {
+gen_helper_casp_le_parallel(cpu_env, tcg_rs, addr, t1, t2);
+} else {
+gen_helpe

[Qemu-devel] [PULL 06/21] target/alpha: remove tlb_flush from alpha_cpu_initfn

[Richard Henderson]

From: "Emilio G. Cota" 

As far as I can tell tlb_flush does not need to be called
this early. tlb_flush is eventually called after the CPU
has been realized.

This change paves the way to the introduction of tlb_init,
which will be called from cpu_exec_realizefn.

Reviewed-by: Alex Bennée 
Reviewed-by: Richard Henderson 
Signed-off-by: Emilio G. Cota 
Message-Id: <20181009174557.16125-2-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 target/alpha/cpu.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index b08078e7fc..a953897fcc 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -201,7 +201,6 @@ static void alpha_cpu_initfn(Object *obj)
 CPUAlphaState *env = &cpu->env;
 
 cs->env_ptr = env;
-tlb_flush(cs);
 
 env->lock_addr = -1;
 #if defined(CONFIG_USER_ONLY)
-- 
2.17.2

[Qemu-devel] [PULL 18/21] target/s390x: Split do_cdsg, do_lpq, do_stpq

[Richard Henderson]

Reviewed-by: David Hildenbrand 
Signed-off-by: Richard Henderson 
---
 target/s390x/mem_helper.c | 128 ++
 1 file changed, 61 insertions(+), 67 deletions(-)

diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
index e106f61b4e..b5858d2fa2 100644
--- a/target/s390x/mem_helper.c
+++ b/target/s390x/mem_helper.c
@@ -1380,57 +1380,58 @@ uint32_t HELPER(trXX)(CPUS390XState *env, uint32_t r1, 
uint32_t r2,
 return cc;
 }
 
-static void do_cdsg(CPUS390XState *env, uint64_t addr,
-uint32_t r1, uint32_t r3, bool parallel)
+void HELPER(cdsg)(CPUS390XState *env, uint64_t addr,
+  uint32_t r1, uint32_t r3)
 {
 uintptr_t ra = GETPC();
 Int128 cmpv = int128_make128(env->regs[r1 + 1], env->regs[r1]);
 Int128 newv = int128_make128(env->regs[r3 + 1], env->regs[r3]);
 Int128 oldv;
+uint64_t oldh, oldl;
 bool fail;
 
-if (parallel) {
-#if !HAVE_CMPXCHG128
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-#else
-int mem_idx = cpu_mmu_index(env, false);
-TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
-oldv = helper_atomic_cmpxchgo_be_mmu(env, addr, cmpv, newv, oi, ra);
-fail = !int128_eq(oldv, cmpv);
-#endif
-} else {
-uint64_t oldh, oldl;
+check_alignment(env, addr, 16, ra);
 
-check_alignment(env, addr, 16, ra);
+oldh = cpu_ldq_data_ra(env, addr + 0, ra);
+oldl = cpu_ldq_data_ra(env, addr + 8, ra);
 
-oldh = cpu_ldq_data_ra(env, addr + 0, ra);
-oldl = cpu_ldq_data_ra(env, addr + 8, ra);
-
-oldv = int128_make128(oldl, oldh);
-fail = !int128_eq(oldv, cmpv);
-if (fail) {
-newv = oldv;
-}
-
-cpu_stq_data_ra(env, addr + 0, int128_gethi(newv), ra);
-cpu_stq_data_ra(env, addr + 8, int128_getlo(newv), ra);
+oldv = int128_make128(oldl, oldh);
+fail = !int128_eq(oldv, cmpv);
+if (fail) {
+newv = oldv;
 }
 
+cpu_stq_data_ra(env, addr + 0, int128_gethi(newv), ra);
+cpu_stq_data_ra(env, addr + 8, int128_getlo(newv), ra);
+
 env->cc_op = fail;
 env->regs[r1] = int128_gethi(oldv);
 env->regs[r1 + 1] = int128_getlo(oldv);
 }
 
-void HELPER(cdsg)(CPUS390XState *env, uint64_t addr,
-  uint32_t r1, uint32_t r3)
-{
-do_cdsg(env, addr, r1, r3, false);
-}
-
 void HELPER(cdsg_parallel)(CPUS390XState *env, uint64_t addr,
uint32_t r1, uint32_t r3)
 {
-do_cdsg(env, addr, r1, r3, true);
+uintptr_t ra = GETPC();
+Int128 cmpv = int128_make128(env->regs[r1 + 1], env->regs[r1]);
+Int128 newv = int128_make128(env->regs[r3 + 1], env->regs[r3]);
+int mem_idx;
+TCGMemOpIdx oi;
+Int128 oldv;
+bool fail;
+
+if (!HAVE_CMPXCHG128) {
+cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
+}
+
+mem_idx = cpu_mmu_index(env, false);
+oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
+oldv = helper_atomic_cmpxchgo_be_mmu(env, addr, cmpv, newv, oi, ra);
+fail = !int128_eq(oldv, cmpv);
+
+env->cc_op = fail;
+env->regs[r1] = int128_gethi(oldv);
+env->regs[r1 + 1] = int128_getlo(oldv);
 }
 
 static uint32_t do_csst(CPUS390XState *env, uint32_t r3, uint64_t a1,
@@ -2097,16 +2098,25 @@ uint64_t HELPER(lra)(CPUS390XState *env, uint64_t addr)
 #endif
 
 /* load pair from quadword */
-static uint64_t do_lpq(CPUS390XState *env, uint64_t addr, bool parallel)
+uint64_t HELPER(lpq)(CPUS390XState *env, uint64_t addr)
 {
 uintptr_t ra = GETPC();
 uint64_t hi, lo;
 
-if (!parallel) {
-check_alignment(env, addr, 16, ra);
-hi = cpu_ldq_data_ra(env, addr + 0, ra);
-lo = cpu_ldq_data_ra(env, addr + 8, ra);
-} else if (HAVE_ATOMIC128) {
+check_alignment(env, addr, 16, ra);
+hi = cpu_ldq_data_ra(env, addr + 0, ra);
+lo = cpu_ldq_data_ra(env, addr + 8, ra);
+
+env->retxl = lo;
+return hi;
+}
+
+uint64_t HELPER(lpq_parallel)(CPUS390XState *env, uint64_t addr)
+{
+uintptr_t ra = GETPC();
+uint64_t hi, lo;
+
+if (HAVE_ATOMIC128) {
 int mem_idx = cpu_mmu_index(env, false);
 TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
 Int128 v = helper_atomic_ldo_be_mmu(env, addr, oi, ra);
@@ -2120,27 +2130,23 @@ static uint64_t do_lpq(CPUS390XState *env, uint64_t 
addr, bool parallel)
 return hi;
 }
 
-uint64_t HELPER(lpq)(CPUS390XState *env, uint64_t addr)
-{
-return do_lpq(env, addr, false);
-}
-
-uint64_t HELPER(lpq_parallel)(CPUS390XState *env, uint64_t addr)
-{
-return do_lpq(env, addr, true);
-}
-
 /* store pair to quadword */
-static void do_stpq(CPUS390XState *env, uint64_t addr,
-uint64_t low, uint64_t high, bool parallel)
+void HELPER(stpq)(CPUS390XState *env, uint64_t addr,
+  uint64_t low, uint64_t high)
 {
 uintptr_t ra = GETPC();
 
-if (!parallel) {
-check_alignment(env, addr, 16, ra);
-  

[Qemu-devel] [PULL 13/21] target/i386: Convert to HAVE_CMPXCHG128

[Richard Henderson]

Reviewed-by: Emilio G. Cota 
Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
 target/i386/mem_helper.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/target/i386/mem_helper.c b/target/i386/mem_helper.c
index 30c26b9d9c..6cc53bcb40 100644
--- a/target/i386/mem_helper.c
+++ b/target/i386/mem_helper.c
@@ -23,6 +23,7 @@
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
 #include "qemu/int128.h"
+#include "qemu/atomic128.h"
 #include "tcg.h"
 
 void helper_cmpxchg8b_unlocked(CPUX86State *env, target_ulong a0)
@@ -137,10 +138,7 @@ void helper_cmpxchg16b(CPUX86State *env, target_ulong a0)
 
 if ((a0 & 0xf) != 0) {
 raise_exception_ra(env, EXCP0D_GPF, ra);
-} else {
-#ifndef CONFIG_ATOMIC128
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-#else
+} else if (HAVE_CMPXCHG128) {
 int eflags = cpu_cc_compute_all(env, CC_OP);
 
 Int128 cmpv = int128_make128(env->regs[R_EAX], env->regs[R_EDX]);
@@ -159,7 +157,8 @@ void helper_cmpxchg16b(CPUX86State *env, target_ulong a0)
 eflags &= ~CC_Z;
 }
 CC_SRC = eflags;
-#endif
+} else {
+cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
 }
 }
 #endif
-- 
2.17.2

[Qemu-devel] [PATCH v5 0/3] Bootstrap Python venv and acceptance/functional tests

[Cleber Rosa]

TL;DR
=

Allow acceptance tests to be run with `make check-acceptance`.

Details
===

This introduces a Python virtual environment that will be setup within
the QEMU build directory, that will contain the exact environment that
tests may require.

There's one current caveat: it requires Python 3, as it's based on the
venv module.  This was based on some discussions and perception about
standardizing on Python 3, but can easily be made to accommodate Python
2 as well.

Example of bootstrap and test execution on Travis-CI:

https://travis-ci.org/qemu/qemu/jobs/439331028#L2508

   ...
  VENV/home/travis/build/qemu/qemu/tests/venv
  MKDIR   /home/travis/build/qemu/qemu/tests/results
  PIP /home/travis/build/qemu/qemu/tests/venv-requirements.txt
  AVOCADO tests/acceptance
JOB ID : 920e4fcf55a1782f1ae77bee64b20ccdc2ed
JOB LOG: 
/home/travis/build/qemu/qemu/tests/results/job-2018-10-09T21.42-920e4fc/job.log
 (1/6) 
/home/travis/build/qemu/qemu/tests/acceptance/boot_linux_console.py:BootLinuxConsole.test:
  PASS (3.57 s)
 (2/6) 
/home/travis/build/qemu/qemu/tests/acceptance/version.py:Version.test_qmp_human_info_version:
  PASS (0.04 s)
 (3/6) 
/home/travis/build/qemu/qemu/tests/acceptance/vnc.py:Vnc.test_no_vnc:  PASS 
(0.04 s)
 (4/6) 
/home/travis/build/qemu/qemu/tests/acceptance/vnc.py:Vnc.test_no_vnc_change_password:
  PASS (0.04 s)
 (5/6) 
/home/travis/build/qemu/qemu/tests/acceptance/vnc.py:Vnc.test_vnc_change_password_requires_a_password:
  PASS (0.04 s)
 (6/6) 
/home/travis/build/qemu/qemu/tests/acceptance/vnc.py:Vnc.test_vnc_change_password:
  PASS (0.04 s)
RESULTS: PASS 6 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | 
CANCEL 0
JOB TIME   : 3.90 s
   ...

Changes from v4:


 * Added Python 3 version check and error message when running under
   Python 2.  (Philippe)

 * Added notes about using Avocado from the virtual environment
   without previous activation.  (Phillipe)

Ideas discussed, but not implemented:

 * Instructions to activate/deactivate the venv: the idea is to be
   use the venv as transparently as possible.

 * Move/rename tests/venv-requirements: the ideal, as per the first
   commit is to provide one venv for all Python based tests to run.

 * Changed the Travis package requirements (python3-pip,
   python3.4-venv) from the global setting to the job specific one:
   waiting on further feedback from'Alex Bennée.

Changes from v3:


 * Fixed typo in commit message (s/requiment/requirement/).  (Eric)

Changes from v2:


 * Make the $(TESTS_VENV_DIR) target depend on the
   venv-requirements.txt file, and touch $(TESTS_VENV_DIR) after venv
   runs.  With this, updates on the file are reflected on the
   venv. (Philippe)

 * Run pip with "python -m pip".  It may have been installed reusing
   the system wide packages, and then the script may not be available
   on the venv. (Philippe)

 * Dropped Python version on Travis, and using the version supplied
   by the distro (3.4). (Philippe)

 * Added "python3.4-venv" package requirement on Travis. (Philippe)

 * Added variable (AVOCADO_SHOW) with logging streams to be shown
   while running the acceptance tests.  By default it's set to none,
   the equivalent of the quiet mode used on previous versions.
   (Philippe)

 * On Travis, set the AVOCADO_SHOW variable to "app", so that the
   individual test results can be easily seen.  (Philippe)

Ideas discussed, but not implemented:

  * Run pip with "$(PYTHON) -m pip -q install ..." because it points
to the system wide Python installation. (Philippe)

  * Drop the "--system-site-packages" flag.  Waiting on another round
of tests to determine if they are really the cause of some package
installation problems.

Changes from v1:


 * TESTS_VENV_REQ (the path of "venv-requirements.txt") now points to
   the source path ($SRC_PATH instead of $BUILD_DIR)

 * Create the venv with "--system-site-packages", which allows the
   reuse of packages (and no additional downloads) in case there's a
   package installed system wide providing the same package and
   version.

 * Run Avocado with "python -m avocado".  It may have been installed
   reusing the system wide packages, and then the script may not
   be available on the venv.

 * Improved documentation describing the Python 3, venv and pip
   requirements.

 * Updated avocado-framework requirement to latest released version
   (65.0)

 * (New commit) Added support for running the acceptance tests on
   Travis.

Ideas discussed, but not implemented:

 * Install external packages such as python3-pip on Debian based
   systems, deemed too invasive on developer's systems.

 * Allow the use of Python 2, and consequently the "virtualenv"
   module.

Cleber Rosa (3):
  Bootstrap Python venv for tests
  Acceptance tests: add make rule for running them
  Travis support for the acceptance tests

 .t

[Qemu-devel] [PULL 10/21] cputlb: serialize tlb updates with env->tlb_lock

[Richard Henderson]

From: "Emilio G. Cota" 

Currently we rely on atomic operations for cross-CPU invalidations.
There are two cases that these atomics miss: cross-CPU invalidations
can race with either (1) vCPU threads flushing their TLB, which
happens via memset, or (2) vCPUs calling tlb_reset_dirty on their TLB,
which updates .addr_write with a regular store. This results in
undefined behaviour, since we're mixing regular and atomic ops
on concurrent accesses.

Fix it by using tlb_lock, a per-vCPU lock. All updaters of tlb_table
and the corresponding victim cache now hold the lock.
The readers that do not hold tlb_lock must use atomic reads when
reading .addr_write, since this field can be updated by other threads;
the conversion to atomic reads is done in the next patch.

Note that an alternative fix would be to expand the use of atomic ops.
However, in the case of TLB flushes this would have a huge performance
impact, since (1) TLB flushes can happen very frequently and (2) we
currently use a full memory barrier to flush each TLB entry, and a TLB
has many entries. Instead, acquiring the lock is barely slower than a
full memory barrier since it is uncontended, and with a single lock
acquisition we can flush the entire TLB.

Tested-by: Alex Bennée 
Reviewed-by: Alex Bennée 
Signed-off-by: Emilio G. Cota 
Message-Id: <20181009174557.16125-6-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 include/exec/cpu-defs.h |   3 +
 accel/tcg/cputlb.c  | 155 ++--
 2 files changed, 87 insertions(+), 71 deletions(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index a171ffc1a4..4ff62f32bf 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -24,6 +24,7 @@
 #endif
 
 #include "qemu/host-utils.h"
+#include "qemu/thread.h"
 #include "qemu/queue.h"
 #ifdef CONFIG_TCG
 #include "tcg-target.h"
@@ -142,6 +143,8 @@ typedef struct CPUIOTLBEntry {
 
 #define CPU_COMMON_TLB \
 /* The meaning of the MMU modes is defined in the target code. */   \
+/* tlb_lock serializes updates to tlb_table and tlb_v_table */  \
+QemuSpin tlb_lock;  \
 CPUTLBEntry tlb_table[NB_MMU_MODES][CPU_TLB_SIZE];  \
 CPUTLBEntry tlb_v_table[NB_MMU_MODES][CPU_VTLB_SIZE];   \
 CPUIOTLBEntry iotlb[NB_MMU_MODES][CPU_TLB_SIZE];\
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index f6b388c961..c2a6190674 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -75,6 +75,9 @@ QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 
 void tlb_init(CPUState *cpu)
 {
+CPUArchState *env = cpu->env_ptr;
+
+qemu_spin_init(&env->tlb_lock);
 }
 
 /* flush_all_helper: run fn across all cpus
@@ -129,8 +132,17 @@ static void tlb_flush_nocheck(CPUState *cpu)
 atomic_set(&env->tlb_flush_count, env->tlb_flush_count + 1);
 tlb_debug("(count: %zu)\n", tlb_flush_count());
 
+/*
+ * tlb_table/tlb_v_table updates from any thread must hold tlb_lock.
+ * However, updates from the owner thread (as is the case here; see the
+ * above assert_cpu_is_self) do not need atomic_set because all reads
+ * that do not hold the lock are performed by the same owner thread.
+ */
+qemu_spin_lock(&env->tlb_lock);
 memset(env->tlb_table, -1, sizeof(env->tlb_table));
 memset(env->tlb_v_table, -1, sizeof(env->tlb_v_table));
+qemu_spin_unlock(&env->tlb_lock);
+
 cpu_tb_jmp_cache_clear(cpu);
 
 env->vtlb_index = 0;
@@ -182,6 +194,7 @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, 
run_on_cpu_data data)
 
 tlb_debug("start: mmu_idx:0x%04lx\n", mmu_idx_bitmask);
 
+qemu_spin_lock(&env->tlb_lock);
 for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
 
 if (test_bit(mmu_idx, &mmu_idx_bitmask)) {
@@ -191,6 +204,7 @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, 
run_on_cpu_data data)
 memset(env->tlb_v_table[mmu_idx], -1, sizeof(env->tlb_v_table[0]));
 }
 }
+qemu_spin_unlock(&env->tlb_lock);
 
 cpu_tb_jmp_cache_clear(cpu);
 
@@ -247,19 +261,24 @@ static inline bool tlb_hit_page_anyprot(CPUTLBEntry 
*tlb_entry,
tlb_hit_page(tlb_entry->addr_code, page);
 }
 
-static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong page)
+/* Called with tlb_lock held */
+static inline void tlb_flush_entry_locked(CPUTLBEntry *tlb_entry,
+  target_ulong page)
 {
 if (tlb_hit_page_anyprot(tlb_entry, page)) {
 memset(tlb_entry, -1, sizeof(*tlb_entry));
 }
 }
 
-static inline void tlb_flush_vtlb_page(CPUArchState *env, int mmu_idx,
-   target_ulong page)
+/* Called with tlb_lock held */
+static inline void tlb_flush_vtlb_page_locked(CPUArchState *env, int mmu_idx,
+  target_ulong page)
 {
 int k;
+
+assert_cpu_is_self(ENV_GET_CPU(env));
 for (k = 

[Qemu-devel] [PULL 04/21] tcg: plug holes in struct TCGProfile

[Richard Henderson]

From: "Emilio G. Cota" 

This plugs two 4-byte holes in 64-bit.

Signed-off-by: Emilio G. Cota 
Message-Id: <20181010144853.13005-4-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 tcg/tcg.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/tcg.h b/tcg/tcg.h
index f9f12378e9..d80ef2a883 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -633,8 +633,8 @@ typedef struct TCGProfile {
 int64_t tb_count;
 int64_t op_count; /* total insn count */
 int op_count_max; /* max insn per TB */
-int64_t temp_count;
 int temp_count_max;
+int64_t temp_count;
 int64_t del_op_count;
 int64_t code_in_len;
 int64_t code_out_len;
-- 
2.17.2

[Qemu-devel] [PULL 02/21] tcg: access cpu->icount_decr.u16.high with atomics

[Richard Henderson]

From: "Emilio G. Cota" 

Consistently access u16.high with atomics to avoid
undefined behaviour in MTTCG.

Note that icount_decr.u16.low is only used in icount mode,
so regular accesses to it are OK.

Reviewed-by: Richard Henderson 
Signed-off-by: Emilio G. Cota 
Message-Id: <20181010144853.13005-2-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 accel/tcg/tcg-all.c   | 2 +-
 accel/tcg/translate-all.c | 2 +-
 qom/cpu.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 56dbb56a16..3d25bdcc17 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -51,7 +51,7 @@ static void tcg_handle_interrupt(CPUState *cpu, int mask)
 if (!qemu_cpu_is_self(cpu)) {
 qemu_cpu_kick(cpu);
 } else {
-cpu->icount_decr.u16.high = -1;
+atomic_set(&cpu->icount_decr.u16.high, -1);
 if (use_icount &&
 !cpu->can_do_io
 && (mask & ~old_mask) != 0) {
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index ad5c758246..356dcd0948 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -2341,7 +2341,7 @@ void cpu_interrupt(CPUState *cpu, int mask)
 {
 g_assert(qemu_mutex_iothread_locked());
 cpu->interrupt_request |= mask;
-cpu->icount_decr.u16.high = -1;
+atomic_set(&cpu->icount_decr.u16.high, -1);
 }
 
 /*
diff --git a/qom/cpu.c b/qom/cpu.c
index 92599f3541..20ad54d43f 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -266,7 +266,7 @@ static void cpu_common_reset(CPUState *cpu)
 cpu->mem_io_pc = 0;
 cpu->mem_io_vaddr = 0;
 cpu->icount_extra = 0;
-cpu->icount_decr.u32 = 0;
+atomic_set(&cpu->icount_decr.u32, 0);
 cpu->can_do_io = 1;
 cpu->exception_index = -1;
 cpu->crash_occurred = false;
-- 
2.17.2

[Qemu-devel] [PULL 21/21] cputlb: read CPUTLBEntry.addr_write atomically

[Richard Henderson]

From: "Emilio G. Cota" 

Updates can come from other threads, so readers that do not
take tlb_lock must use atomic_read to avoid undefined
behaviour (UB).

This completes the conversion to tlb_lock. This conversion results
on average in no performance loss, as the following experiments
(run on an Intel i7-6700K CPU @ 4.00GHz) show.

1. aarch64 bootup+shutdown test:

- Before:
 Performance counter stats for 'taskset -c 0 ../img/aarch64/die.sh' (10 runs):

   7487.087786  task-clock (msec) #0.998 CPUs utilized  
  ( +-  0.12% )
31,574,905,303  cycles#4.217 GHz
  ( +-  0.12% )
57,097,908,812  instructions  #1.81  insns per cycle
  ( +-  0.08% )
10,255,415,367  branches  # 1369.747 M/sec  
  ( +-  0.08% )
   173,278,962  branch-misses #1.69% of all branches
  ( +-  0.18% )

   7.504481349 seconds time elapsed 
 ( +-  0.14% )

- After:
 Performance counter stats for 'taskset -c 0 ../img/aarch64/die.sh' (10 runs):

   7462.441328  task-clock (msec) #0.998 CPUs utilized  
  ( +-  0.07% )
31,478,476,520  cycles#4.218 GHz
  ( +-  0.07% )
57,017,330,084  instructions  #1.81  insns per cycle
  ( +-  0.05% )
10,251,929,667  branches  # 1373.804 M/sec  
  ( +-  0.05% )
   173,023,787  branch-misses #1.69% of all branches
  ( +-  0.11% )

   7.474970463 seconds time elapsed 
 ( +-  0.07% )

2. SPEC06int:
  SPEC06int (test set)
   [Y axis: Speedup over master]
  1.15 
+-++--+--+--+--+--+---+--+--+--+--+--+--++-+
   |
  |
   1.1 +-+.+++.+  
tlb-lock-v2 (m+++x)   +-+
   |+++ |   +++
tlb-lock-v3 (spinl|ck) |
   |+++  |  | ++++++ |  
 ||
  1.05 
+-++++....|.+++.|..|.###+++...+++###.+-+
   |  ### ++#| # |# |# ***### +++### +++#+# | 
+++ | #|####|
 1 
+-+++***+#+++#++#++#++#+*+*++##+#++###########+##+#+++-+
   |*+* ##++# ***  #    ***  # * *++# +# *| * # |#   |# 
##|##+## #|
  0.95 
+-+..*.*.##..#.*|*..#...#..#.*|*..#.*.*..#.*|.*.#.*++*.#.*++*+#..##+##.#..++#.#..+-+
   |* * ##  # *|*  #   #  # *|*  # * *  # *++* # *  * # *  * # * |* 
#  ++# ## #  *** #|
   |* * #  ++#  # *+*  #   #  # *|*  # * *  # *  * # *  * # *  * # *++* 
#  #  ++# #  * * #|
   0.9 
+-+..*.*.#...|#..#.*.*..#.++#..#.*|*..#.*.*..#.*..*.#.*..*.#.*..*.#.*..*.#.*.|*.#...|#.#..*.*.#..+-+
   |* * #  ***  # * *  #  |#  # *+*  # * *  # *  * # *  * # *  * # *  * 
# *++* #   |# #  * * #|
  0.85 
+-+..*.*.#..*|*..#.*.*..#.***..#.*.*..#.*.*..#.*..*.#.*..*.#.*..*.#.*..*.#.*..*.#..#..*.*.#..+-+
   |* * #  *+*  # * *  # *|*  # * *  # * *  # *  * # *  * # *  * # *  * 
# *  * # * |* #  * * #|
   |* * #  * *  # * *  # *+*  # * *  # * *  # *  * # *  * # *  * # *  * 
# *  * # * |* #  * * #|
   0.8 
+-+..*.*.#..*.*..#.*.*..#.*.*..#.*.*..#.*.*..#.*..*.#.*..*.#.*..*.#.*..*.#.*..*.#.*++*.#..*.*.#..+-+
   |* * #  * *  # * *  # * *  # * *  # * *  # *  * # *  * # *  * # *  * 
# *  * # *  * #  * * #|
  0.75 
+-+--***##--***###-***###-***###-***###-***###-##-##-##-##-##-##--***##--+-+
 
400.perlben401.bzip2403.gcc429.m445.gob456.hmme45462.libqua464.h26471.omnet473483.xalancbmkgeomean

  png: https://imgur.com/a/BHzpPTW

Notes:
- tlb-lock-v2 corresponds to an implementation with a mutex.
- tlb-lock-v3 corresponds to the current implementation, i.e.
  a spinlock and a single lock acquisition in tlb_set_page_with_attrs.

Signed-off-by: Emilio G. Cota 
Message-Id: <20181016153840.25877-1-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 accel/tcg/softmmu_template.h | 12 ++--
 include/exec/cpu_ldst.h  | 11 ++-
 include/exec/cpu_ldst_template.h |  2 +-
 accel/tcg/cputlb.c   | 19 +--
 4 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/accel/tcg/softmmu_template.h b/accel/tcg/softmmu_template.h
index 09538b5349..b0adea045e 100644
--- a/accel/tcg/softmmu_template.h
+++ b/accel/tcg/softmmu_template.h
@@ -280,7 +280

[Qemu-devel] [RFC PATCH v1 0/4] Add migration support for VFIO device

[Kirti Wankhede]

Add migration support for VFIO device

This Patch set include patches as below:
- Define KABI for VFIO device for migration support.
- Generic migration functionality for VFIO device.
  * This patch set adds functionality only for PCI devices, but can be
extended to other VFIO devices.
  * Added all the basic functions required for pre-copy, stop-and-copy and
resume phases of migration.
  * Added state change notifier and from that notifier function, VFIO
device's state changed is conveyed to VFIO vendor driver.
  * During save setup phase and resume/load setup phase, migration region
is queried from vendor driver and is mmaped by QEMU. This region is
used to read/write data from and to vendor driver.
  * .save_live_pending, .save_live_iterate and .is_active_iterate are
implemented to use QEMU's functionality of iteration during pre-copy
phase.
  * In .save_live_complete_precopy, that is in stop-and-copy phase,
iteration to read data from vendor driver is implemented till pending
bytes returned by vendor driver are not zero.
  * .save_cleanup and .load_cleanup are implemented to unmap migration
region that was setup duing setup phase.
  * Added function to get dirty pages bitmap from vendor driver.
- Add vfio_listerner_log_sync to mark dirty pages.
- Make VFIO PCI device migration capable.

Thanks,
Kirti

Kirti Wankhede (4):
  VFIO KABI for migration interface
  Add migration functions for VFIO devices
  Add vfio_listerner_log_sync to mark dirty pages
  Make vfio-pci device migration capable.

 hw/vfio/Makefile.objs |   2 +-
 hw/vfio/common.c  |  32 ++
 hw/vfio/migration.c   | 716 ++
 hw/vfio/pci.c |  13 +-
 include/hw/vfio/vfio-common.h |  23 ++
 linux-headers/linux/vfio.h|  91 ++
 6 files changed, 869 insertions(+), 8 deletions(-)
 create mode 100644 hw/vfio/migration.c

-- 
2.7.0

[Qemu-devel] [PULL 00/21] tcg patch queue

[Richard Henderson]

The following changes since commit ff56877e911782dedc9a424233fd3f62369c258c:

  Merge remote-tracking branch 'remotes/kraxel/tags/vga-20181015-pull-request' 
into staging (2018-10-15 15:03:45 +0100)

are available in the Git repository at:

  https://github.com/rth7680/qemu.git tags/pull-tcg-20181016

for you to fetch changes up to e3e9d1ea20c75718ce7c528c588a0a497f12f750:

  cputlb: read CPUTLBEntry.addr_write atomically (2018-10-16 10:04:27 -0700)


Queued tcg patches


Emilio G. Cota (10):
  tcg: access cpu->icount_decr.u16.high with atomics
  tcg: fix use of uninitialized variable under CONFIG_PROFILER
  tcg: plug holes in struct TCGProfile
  tcg: distribute tcg_time into TCG contexts
  target/alpha: remove tlb_flush from alpha_cpu_initfn
  target/unicore32: remove tlb_flush from uc32_init_fn
  exec: introduce tlb_init
  cputlb: fix assert_cpu_is_self macro
  cputlb: serialize tlb updates with env->tlb_lock
  cputlb: read CPUTLBEntry.addr_write atomically

Richard Henderson (11):
  tcg: Implement CPU_LOG_TB_NOCHAIN during expansion
  tcg: Add tlb_index and tlb_entry helpers
  tcg: Split CONFIG_ATOMIC128
  target/i386: Convert to HAVE_CMPXCHG128
  target/arm: Convert to HAVE_CMPXCHG128
  target/arm: Check HAVE_CMPXCHG128 at translate time
  target/ppc: Convert to HAVE_CMPXCHG128 and HAVE_ATOMIC128
  target/s390x: Convert to HAVE_CMPXCHG128 and HAVE_ATOMIC128
  target/s390x: Split do_cdsg, do_lpq, do_stpq
  target/s390x: Skip wout, cout helpers if op helper does not return
  target/s390x: Check HAVE_ATOMIC128 and HAVE_CMPXCHG128 at translate

 accel/tcg/atomic_template.h  |  20 +++-
 accel/tcg/softmmu_template.h |  64 +-
 include/exec/cpu-defs.h  |   3 +
 include/exec/cpu_ldst.h  |  30 -
 include/exec/cpu_ldst_template.h |  25 ++--
 include/exec/exec-all.h  |   8 ++
 include/qemu/atomic128.h | 155 
 include/qemu/timer.h |   1 -
 target/ppc/helper.h  |   2 +-
 tcg/tcg.h|  20 ++--
 accel/tcg/cpu-exec.c |   2 +-
 accel/tcg/cputlb.c   | 235 +++-
 accel/tcg/tcg-all.c  |   2 +-
 accel/tcg/translate-all.c|   2 +-
 accel/tcg/user-exec.c|   5 +-
 cpus.c   |   3 +-
 exec.c   |   1 +
 monitor.c|  13 +-
 qom/cpu.c|   2 +-
 target/alpha/cpu.c   |   1 -
 target/arm/helper-a64.c  | 251 +++
 target/arm/translate-a64.c   |  38 +++---
 target/i386/mem_helper.c |   9 +-
 target/ppc/mem_helper.c  |  33 -
 target/ppc/translate.c   | 115 +-
 target/s390x/mem_helper.c| 202 +++
 target/s390x/translate.c |  45 +--
 target/unicore32/cpu.c   |   2 -
 tcg/tcg-op.c |   9 +-
 tcg/tcg.c|  25 +++-
 configure|  19 +++
 31 files changed, 830 insertions(+), 512 deletions(-)
 create mode 100644 include/qemu/atomic128.h

[Qemu-devel] [PULL 01/21] tcg: Implement CPU_LOG_TB_NOCHAIN during expansion

[Richard Henderson]

Rather than test NOCHAIN before linking, do not emit the
goto_tb opcode at all.  We already do this for goto_ptr.

Signed-off-by: Richard Henderson 
---
 accel/tcg/cpu-exec.c | 2 +-
 tcg/tcg-op.c | 9 -
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 6bcb6d99bd..870027d435 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -416,7 +416,7 @@ static inline TranslationBlock *tb_find(CPUState *cpu,
 }
 #endif
 /* See if we can patch the calling TB. */
-if (last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
+if (last_tb) {
 tb_add_jump(last_tb, tb_exit, tb);
 }
 return tb;
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index daa416a143..7a8015c5a9 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -2586,6 +2586,10 @@ void tcg_gen_exit_tb(TranslationBlock *tb, unsigned idx)
seen this numbered exit before, via tcg_gen_goto_tb.  */
 tcg_debug_assert(tcg_ctx->goto_tb_issue_mask & (1 << idx));
 #endif
+/* When not chaining, exit without indicating a link.  */
+if (qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
+val = 0;
+}
 } else {
 /* This is an exit via the exitreq label.  */
 tcg_debug_assert(idx == TB_EXIT_REQUESTED);
@@ -2603,7 +2607,10 @@ void tcg_gen_goto_tb(unsigned idx)
 tcg_debug_assert((tcg_ctx->goto_tb_issue_mask & (1 << idx)) == 0);
 tcg_ctx->goto_tb_issue_mask |= 1 << idx;
 #endif
-tcg_gen_op1i(INDEX_op_goto_tb, idx);
+/* When not chaining, we simply fall through to the "fallback" exit.  */
+if (!qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
+tcg_gen_op1i(INDEX_op_goto_tb, idx);
+}
 }
 
 void tcg_gen_lookup_and_goto_ptr(void)
-- 
2.17.2

[Qemu-devel] [PULL 16/21] target/ppc: Convert to HAVE_CMPXCHG128 and HAVE_ATOMIC128

[Richard Henderson]

Reviewed-by: Emilio G. Cota 
Signed-off-by: Richard Henderson 
---
 target/ppc/helper.h |   2 +-
 target/ppc/mem_helper.c |  33 ++--
 target/ppc/translate.c  | 115 +---
 3 files changed, 88 insertions(+), 62 deletions(-)

diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index ef64248bc4..7a1481fd0b 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -800,7 +800,7 @@ DEF_HELPER_4(dscliq, void, env, fprp, fprp, i32)
 DEF_HELPER_1(tbegin, void, env)
 DEF_HELPER_FLAGS_1(fixup_thrm, TCG_CALL_NO_RWG, void, env)
 
-#if defined(TARGET_PPC64) && defined(CONFIG_ATOMIC128)
+#ifdef TARGET_PPC64
 DEF_HELPER_FLAGS_3(lq_le_parallel, TCG_CALL_NO_WG, i64, env, tl, i32)
 DEF_HELPER_FLAGS_3(lq_be_parallel, TCG_CALL_NO_WG, i64, env, tl, i32)
 DEF_HELPER_FLAGS_5(stq_le_parallel, TCG_CALL_NO_WG,
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index 8f0d86d104..a1485fad9b 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -25,6 +25,7 @@
 #include "exec/cpu_ldst.h"
 #include "tcg.h"
 #include "internal.h"
+#include "qemu/atomic128.h"
 
 //#define DEBUG_OP
 
@@ -215,11 +216,15 @@ target_ulong helper_lscbx(CPUPPCState *env, target_ulong 
addr, uint32_t reg,
 return i;
 }
 
-#if defined(TARGET_PPC64) && defined(CONFIG_ATOMIC128)
+#ifdef TARGET_PPC64
 uint64_t helper_lq_le_parallel(CPUPPCState *env, target_ulong addr,
uint32_t opidx)
 {
-Int128 ret = helper_atomic_ldo_le_mmu(env, addr, opidx, GETPC());
+Int128 ret;
+
+/* We will have raised EXCP_ATOMIC from the translator.  */
+assert(HAVE_ATOMIC128);
+ret = helper_atomic_ldo_le_mmu(env, addr, opidx, GETPC());
 env->retxh = int128_gethi(ret);
 return int128_getlo(ret);
 }
@@ -227,7 +232,11 @@ uint64_t helper_lq_le_parallel(CPUPPCState *env, 
target_ulong addr,
 uint64_t helper_lq_be_parallel(CPUPPCState *env, target_ulong addr,
uint32_t opidx)
 {
-Int128 ret = helper_atomic_ldo_be_mmu(env, addr, opidx, GETPC());
+Int128 ret;
+
+/* We will have raised EXCP_ATOMIC from the translator.  */
+assert(HAVE_ATOMIC128);
+ret = helper_atomic_ldo_be_mmu(env, addr, opidx, GETPC());
 env->retxh = int128_gethi(ret);
 return int128_getlo(ret);
 }
@@ -235,14 +244,22 @@ uint64_t helper_lq_be_parallel(CPUPPCState *env, 
target_ulong addr,
 void helper_stq_le_parallel(CPUPPCState *env, target_ulong addr,
 uint64_t lo, uint64_t hi, uint32_t opidx)
 {
-Int128 val = int128_make128(lo, hi);
+Int128 val;
+
+/* We will have raised EXCP_ATOMIC from the translator.  */
+assert(HAVE_ATOMIC128);
+val = int128_make128(lo, hi);
 helper_atomic_sto_le_mmu(env, addr, val, opidx, GETPC());
 }
 
 void helper_stq_be_parallel(CPUPPCState *env, target_ulong addr,
 uint64_t lo, uint64_t hi, uint32_t opidx)
 {
-Int128 val = int128_make128(lo, hi);
+Int128 val;
+
+/* We will have raised EXCP_ATOMIC from the translator.  */
+assert(HAVE_ATOMIC128);
+val = int128_make128(lo, hi);
 helper_atomic_sto_be_mmu(env, addr, val, opidx, GETPC());
 }
 
@@ -252,6 +269,9 @@ uint32_t helper_stqcx_le_parallel(CPUPPCState *env, 
target_ulong addr,
 {
 bool success = false;
 
+/* We will have raised EXCP_ATOMIC from the translator.  */
+assert(HAVE_CMPXCHG128);
+
 if (likely(addr == env->reserve_addr)) {
 Int128 oldv, cmpv, newv;
 
@@ -271,6 +291,9 @@ uint32_t helper_stqcx_be_parallel(CPUPPCState *env, 
target_ulong addr,
 {
 bool success = false;
 
+/* We will have raised EXCP_ATOMIC from the translator.  */
+assert(HAVE_CMPXCHG128);
+
 if (likely(addr == env->reserve_addr)) {
 Int128 oldv, cmpv, newv;
 
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 881743571b..4e59dd5f42 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -33,6 +33,7 @@
 #include "trace-tcg.h"
 #include "exec/translator.h"
 #include "exec/log.h"
+#include "qemu/atomic128.h"
 
 
 #define CPU_SINGLE_STEP 0x1
@@ -2654,22 +2655,22 @@ static void gen_lq(DisasContext *ctx)
 hi = cpu_gpr[rd];
 
 if (tb_cflags(ctx->base.tb) & CF_PARALLEL) {
-#ifdef CONFIG_ATOMIC128
-TCGv_i32 oi = tcg_temp_new_i32();
-if (ctx->le_mode) {
-tcg_gen_movi_i32(oi, make_memop_idx(MO_LEQ, ctx->mem_idx));
-gen_helper_lq_le_parallel(lo, cpu_env, EA, oi);
+if (HAVE_ATOMIC128) {
+TCGv_i32 oi = tcg_temp_new_i32();
+if (ctx->le_mode) {
+tcg_gen_movi_i32(oi, make_memop_idx(MO_LEQ, ctx->mem_idx));
+gen_helper_lq_le_parallel(lo, cpu_env, EA, oi);
+} else {
+tcg_gen_movi_i32(oi, make_memop_idx(MO_BEQ, ctx->mem_idx));
+gen_helper_lq_be_parallel(lo, cpu_env, EA, oi);
+}
+tcg_temp_free_i32(oi);
+tcg_gen_ld_i64(hi, cpu_env, offs

[Qemu-devel] [RFC PATCH v1 3/4] Add vfio_listerner_log_sync to mark dirty pages

[Kirti Wankhede]

vfio_listerner_log_sync gets list of dirty pages from vendor driver and mark
those pages dirty.

Signed-off-by: Kirti Wankhede 
Reviewed-by: Neo Jia 
---
 hw/vfio/common.c | 32 
 1 file changed, 32 insertions(+)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index fb396cf00ac4..817d93750337 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -697,9 +697,41 @@ static void vfio_listener_region_del(MemoryListener 
*listener,
 }
 }
 
+static void vfio_listerner_log_sync(MemoryListener *listener,
+MemoryRegionSection *section)
+{
+uint64_t start_addr, size, pfn_count;
+VFIOGroup *group;
+VFIODevice *vbasedev;
+
+QLIST_FOREACH(group, &vfio_group_list, next) {
+QLIST_FOREACH(vbasedev, &group->device_list, next) {
+switch (vbasedev->device_state) {
+case VFIO_DEVICE_STATE_MIGRATION_PRECOPY_ACTIVE:
+case VFIO_DEVICE_STATE_MIGRATION_STOPNCOPY_ACTIVE:
+continue;
+
+default:
+return;
+}
+}
+}
+
+start_addr = TARGET_PAGE_ALIGN(section->offset_within_address_space);
+size = int128_get64(section->size);
+pfn_count = size >> TARGET_PAGE_BITS;
+
+QLIST_FOREACH(group, &vfio_group_list, next) {
+QLIST_FOREACH(vbasedev, &group->device_list, next) {
+vfio_get_dirty_page_list(vbasedev, start_addr, pfn_count);
+}
+}
+}
+
 static const MemoryListener vfio_memory_listener = {
 .region_add = vfio_listener_region_add,
 .region_del = vfio_listener_region_del,
+.log_sync = vfio_listerner_log_sync,
 };
 
 static void vfio_listener_release(VFIOContainer *container)
-- 
2.7.0

[Qemu-devel] [PULL 03/21] tcg: fix use of uninitialized variable under CONFIG_PROFILER

[Richard Henderson]

From: "Emilio G. Cota" 

We forgot to initialize n in commit 15fa08f845 ("tcg: Dynamically
allocate TCGOps", 2017-12-29).

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Emilio G. Cota 
Message-Id: <20181010144853.13005-3-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 tcg/tcg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index f27b22bd3c..8f26916b99 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -3430,7 +3430,7 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
 
 #ifdef CONFIG_PROFILER
 {
-int n;
+int n = 0;
 
 QTAILQ_FOREACH(op, &s->ops, link) {
 n++;
-- 
2.17.2

[Qemu-devel] [PULL 14/21] target/arm: Convert to HAVE_CMPXCHG128

[Richard Henderson]

Reviewed-by: Emilio G. Cota 
Signed-off-by: Richard Henderson 
---
 target/arm/helper-a64.c | 259 +---
 1 file changed, 133 insertions(+), 126 deletions(-)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 7f6ad3000b..6e4e1b8a19 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -30,6 +30,7 @@
 #include "exec/exec-all.h"
 #include "exec/cpu_ldst.h"
 #include "qemu/int128.h"
+#include "qemu/atomic128.h"
 #include "tcg.h"
 #include "fpu/softfloat.h"
 #include  /* For crc32 */
@@ -509,189 +510,195 @@ uint64_t HELPER(crc32c_64)(uint64_t acc, uint64_t val, 
uint32_t bytes)
 return crc32c(acc, buf, bytes) ^ 0x;
 }
 
-/* Returns 0 on success; 1 otherwise.  */
-static uint64_t do_paired_cmpxchg64_le(CPUARMState *env, uint64_t addr,
-   uint64_t new_lo, uint64_t new_hi,
-   bool parallel, uintptr_t ra)
+uint64_t HELPER(paired_cmpxchg64_le)(CPUARMState *env, uint64_t addr,
+ uint64_t new_lo, uint64_t new_hi)
 {
-Int128 oldv, cmpv, newv;
+Int128 cmpv = int128_make128(env->exclusive_val, env->exclusive_high);
+Int128 newv = int128_make128(new_lo, new_hi);
+Int128 oldv;
+uintptr_t ra = GETPC();
+uint64_t o0, o1;
 bool success;
 
-cmpv = int128_make128(env->exclusive_val, env->exclusive_high);
-newv = int128_make128(new_lo, new_hi);
-
-if (parallel) {
-#ifndef CONFIG_ATOMIC128
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-#else
-int mem_idx = cpu_mmu_index(env, false);
-TCGMemOpIdx oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
-oldv = helper_atomic_cmpxchgo_le_mmu(env, addr, cmpv, newv, oi, ra);
-success = int128_eq(oldv, cmpv);
-#endif
-} else {
-uint64_t o0, o1;
-
 #ifdef CONFIG_USER_ONLY
-/* ??? Enforce alignment.  */
-uint64_t *haddr = g2h(addr);
+/* ??? Enforce alignment.  */
+uint64_t *haddr = g2h(addr);
 
-helper_retaddr = ra;
-o0 = ldq_le_p(haddr + 0);
-o1 = ldq_le_p(haddr + 1);
-oldv = int128_make128(o0, o1);
+helper_retaddr = ra;
+o0 = ldq_le_p(haddr + 0);
+o1 = ldq_le_p(haddr + 1);
+oldv = int128_make128(o0, o1);
 
-success = int128_eq(oldv, cmpv);
-if (success) {
-stq_le_p(haddr + 0, int128_getlo(newv));
-stq_le_p(haddr + 1, int128_gethi(newv));
-}
-helper_retaddr = 0;
-#else
-int mem_idx = cpu_mmu_index(env, false);
-TCGMemOpIdx oi0 = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
-TCGMemOpIdx oi1 = make_memop_idx(MO_LEQ, mem_idx);
-
-o0 = helper_le_ldq_mmu(env, addr + 0, oi0, ra);
-o1 = helper_le_ldq_mmu(env, addr + 8, oi1, ra);
-oldv = int128_make128(o0, o1);
-
-success = int128_eq(oldv, cmpv);
-if (success) {
-helper_le_stq_mmu(env, addr + 0, int128_getlo(newv), oi1, ra);
-helper_le_stq_mmu(env, addr + 8, int128_gethi(newv), oi1, ra);
-}
-#endif
+success = int128_eq(oldv, cmpv);
+if (success) {
+stq_le_p(haddr + 0, int128_getlo(newv));
+stq_le_p(haddr + 1, int128_gethi(newv));
 }
+helper_retaddr = 0;
+#else
+int mem_idx = cpu_mmu_index(env, false);
+TCGMemOpIdx oi0 = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
+TCGMemOpIdx oi1 = make_memop_idx(MO_LEQ, mem_idx);
+
+o0 = helper_le_ldq_mmu(env, addr + 0, oi0, ra);
+o1 = helper_le_ldq_mmu(env, addr + 8, oi1, ra);
+oldv = int128_make128(o0, o1);
+
+success = int128_eq(oldv, cmpv);
+if (success) {
+helper_le_stq_mmu(env, addr + 0, int128_getlo(newv), oi1, ra);
+helper_le_stq_mmu(env, addr + 8, int128_gethi(newv), oi1, ra);
+}
+#endif
 
 return !success;
 }
 
-uint64_t HELPER(paired_cmpxchg64_le)(CPUARMState *env, uint64_t addr,
-  uint64_t new_lo, uint64_t new_hi)
-{
-return do_paired_cmpxchg64_le(env, addr, new_lo, new_hi, false, GETPC());
-}
-
 uint64_t HELPER(paired_cmpxchg64_le_parallel)(CPUARMState *env, uint64_t addr,
   uint64_t new_lo, uint64_t new_hi)
-{
-return do_paired_cmpxchg64_le(env, addr, new_lo, new_hi, true, GETPC());
-}
-
-static uint64_t do_paired_cmpxchg64_be(CPUARMState *env, uint64_t addr,
-   uint64_t new_lo, uint64_t new_hi,
-   bool parallel, uintptr_t ra)
 {
 Int128 oldv, cmpv, newv;
+uintptr_t ra = GETPC();
 bool success;
+int mem_idx;
+TCGMemOpIdx oi;
 
-/* high and low need to be switched here because this is not actually a
- * 128bit store but two doublewords stored consecutively
- */
-cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
-newv = int128_make128(new_hi, new_lo);
-
-if (parallel) {
-#ifndef CONFIG_ATO

[Qemu-devel] [PATCH v3 31/38] fsdev: Clean up error reporting in qemu_fsdev_add()

[Markus Armbruster]

Calling error_report() from within a function that takes an Error **
argument is suspicious.  qemu_fsdev_add() does that, and its caller
fsdev_init_func() then fails without setting an error.  Its caller
main(), via qemu_opts_foreach(), is fine with it, but clean it up
anyway.

Cc: Greg Kurz 
Signed-off-by: Markus Armbruster 
Acked-by: Greg Kurz 
---
 fsdev/qemu-fsdev-dummy.c |  2 +-
 fsdev/qemu-fsdev.c   | 12 +---
 fsdev/qemu-fsdev.h   |  2 +-
 hw/9pfs/xen-9p-backend.c |  7 ++-
 vl.c |  8 +++-
 5 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/fsdev/qemu-fsdev-dummy.c b/fsdev/qemu-fsdev-dummy.c
index 6dc0fbc4c4..489cd29081 100644
--- a/fsdev/qemu-fsdev-dummy.c
+++ b/fsdev/qemu-fsdev-dummy.c
@@ -15,7 +15,7 @@
 #include "qemu/config-file.h"
 #include "qemu/module.h"
 
-int qemu_fsdev_add(QemuOpts *opts)
+int qemu_fsdev_add(QemuOpts *opts, Error **errp)
 {
 return 0;
 }
diff --git a/fsdev/qemu-fsdev.c b/fsdev/qemu-fsdev.c
index 8a4afbffbd..7a3b87cc9e 100644
--- a/fsdev/qemu-fsdev.c
+++ b/fsdev/qemu-fsdev.c
@@ -30,7 +30,7 @@ static FsDriverTable FsDrivers[] = {
 { .name = "proxy", .ops = &proxy_ops},
 };
 
-int qemu_fsdev_add(QemuOpts *opts)
+int qemu_fsdev_add(QemuOpts *opts, Error **errp)
 {
 int i;
 struct FsDriverListEntry *fsle;
@@ -38,10 +38,9 @@ int qemu_fsdev_add(QemuOpts *opts)
 const char *fsdriver = qemu_opt_get(opts, "fsdriver");
 const char *writeout = qemu_opt_get(opts, "writeout");
 bool ro = qemu_opt_get_bool(opts, "readonly", 0);
-Error *local_err = NULL;
 
 if (!fsdev_id) {
-error_report("fsdev: No id specified");
+error_setg(errp, "fsdev: No id specified");
 return -1;
 }
 
@@ -53,11 +52,11 @@ int qemu_fsdev_add(QemuOpts *opts)
 }
 
 if (i == ARRAY_SIZE(FsDrivers)) {
-error_report("fsdev: fsdriver %s not found", fsdriver);
+error_setg(errp, "fsdev: fsdriver %s not found", fsdriver);
 return -1;
 }
 } else {
-error_report("fsdev: No fsdriver specified");
+error_setg(errp, "fsdev: No fsdriver specified");
 return -1;
 }
 
@@ -76,8 +75,7 @@ int qemu_fsdev_add(QemuOpts *opts)
 }
 
 if (fsle->fse.ops->parse_opts) {
-if (fsle->fse.ops->parse_opts(opts, &fsle->fse, &local_err)) {
-error_report_err(local_err);
+if (fsle->fse.ops->parse_opts(opts, &fsle->fse, errp)) {
 g_free(fsle->fse.fsdev_id);
 g_free(fsle);
 return -1;
diff --git a/fsdev/qemu-fsdev.h b/fsdev/qemu-fsdev.h
index 65e4b1cfab..d9716b4144 100644
--- a/fsdev/qemu-fsdev.h
+++ b/fsdev/qemu-fsdev.h
@@ -38,7 +38,7 @@ typedef struct FsDriverListEntry {
 QTAILQ_ENTRY(FsDriverListEntry) next;
 } FsDriverListEntry;
 
-int qemu_fsdev_add(QemuOpts *opts);
+int qemu_fsdev_add(QemuOpts *opts, Error **errp);
 FsDriverEntry *get_fsdev_fsentry(char *id);
 extern FileOperations local_ops;
 extern FileOperations handle_ops;
diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c
index 6026780f95..3f54a21c76 100644
--- a/hw/9pfs/xen-9p-backend.c
+++ b/hw/9pfs/xen-9p-backend.c
@@ -14,6 +14,7 @@
 #include "hw/9pfs/9p.h"
 #include "hw/xen/xen_backend.h"
 #include "hw/9pfs/xen-9pfs.h"
+#include "qapi/error.h"
 #include "qemu/config-file.h"
 #include "qemu/option.h"
 #include "fsdev/qemu-fsdev.h"
@@ -355,6 +356,7 @@ static int xen_9pfs_free(struct XenDevice *xendev)
 
 static int xen_9pfs_connect(struct XenDevice *xendev)
 {
+Error *err = NULL;
 int i;
 Xen9pfsDev *xen_9pdev = container_of(xendev, Xen9pfsDev, xendev);
 V9fsState *s = &xen_9pdev->state;
@@ -452,7 +454,10 @@ static int xen_9pfs_connect(struct XenDevice *xendev)
 qemu_opt_set(fsdev, "path", xen_9pdev->path, NULL);
 qemu_opt_set(fsdev, "security_model", xen_9pdev->security_model, NULL);
 qemu_opts_set_id(fsdev, s->fsconf.fsdev_id);
-qemu_fsdev_add(fsdev);
+qemu_fsdev_add(fsdev, &err);
+if (err) {
+error_report_err(err);
+}
 v9fs_device_realize_common(s, &xen_9p_transport, NULL);
 
 return 0;
diff --git a/vl.c b/vl.c
index abfe991ed6..2a8ef05aef 100644
--- a/vl.c
+++ b/vl.c
@@ -2249,7 +2249,7 @@ static int chardev_init_func(void *opaque, QemuOpts 
*opts, Error **errp)
 #ifdef CONFIG_VIRTFS
 static int fsdev_init_func(void *opaque, QemuOpts *opts, Error **errp)
 {
-return qemu_fsdev_add(opts);
+return qemu_fsdev_add(opts, errp);
 }
 #endif
 
@@ -4235,10 +4235,8 @@ int main(int argc, char **argv, char **envp)
   chardev_init_func, NULL, &error_fatal);
 
 #ifdef CONFIG_VIRTFS
-if (qemu_opts_foreach(qemu_find_opts("fsdev"),
-  fsdev_init_func, NULL, NULL)) {
-exit(1);
-}
+qemu_opts_foreach(qemu_find_opts("fsdev"),
+  fsdev_init_func, NULL, &error_fatal);
 #endif
 
 if (qemu_opts_foreach(qemu_find_opts("device"),
-- 
2.17.1

[Qemu-devel] [PULL 05/21] tcg: distribute tcg_time into TCG contexts

[Richard Henderson]

From: "Emilio G. Cota" 

When we implemented per-vCPU TCG contexts, we forgot to also
distribute the tcg_time counter, which has remained as a global
accessed without any serialization, leading to potentially missed
counts.

Fix it by distributing the field over the TCG contexts, embedding
it into TCGProfile with a field called "cpu_exec_time", which is more
descriptive than "tcg_time". Add a function to query this value
directly, and for completeness, fill in the field in
tcg_profile_snapshot, even though its callers do not use it.

Signed-off-by: Emilio G. Cota 
Message-Id: <20181010144853.13005-5-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 include/qemu/timer.h |  1 -
 tcg/tcg.h|  2 ++
 cpus.c   |  3 ++-
 monitor.c| 13 ++---
 tcg/tcg.c| 23 +++
 5 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index a005ed2692..dfecd03e28 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -1046,7 +1046,6 @@ static inline int64_t profile_getclock(void)
 return get_clock();
 }
 
-extern int64_t tcg_time;
 extern int64_t dev_time;
 #endif
 
diff --git a/tcg/tcg.h b/tcg/tcg.h
index d80ef2a883..c59f254e27 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -629,6 +629,7 @@ typedef struct TCGOp {
 QEMU_BUILD_BUG_ON(NB_OPS > (1 << 8));
 
 typedef struct TCGProfile {
+int64_t cpu_exec_time;
 int64_t tb_count1;
 int64_t tb_count;
 int64_t op_count; /* total insn count */
@@ -1002,6 +1003,7 @@ int tcg_check_temp_count(void);
 #define tcg_check_temp_count() 0
 #endif
 
+int64_t tcg_cpu_exec_time(void);
 void tcg_dump_info(FILE *f, fprintf_function cpu_fprintf);
 void tcg_dump_op_count(FILE *f, fprintf_function cpu_fprintf);
 
diff --git a/cpus.c b/cpus.c
index 361678e459..cce64874e6 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1425,7 +1425,8 @@ static int tcg_cpu_exec(CPUState *cpu)
 ret = cpu_exec(cpu);
 cpu_exec_end(cpu);
 #ifdef CONFIG_PROFILER
-tcg_time += profile_getclock() - ti;
+atomic_set(&tcg_ctx->prof.cpu_exec_time,
+   tcg_ctx->prof.cpu_exec_time + profile_getclock() - ti);
 #endif
 return ret;
 }
diff --git a/monitor.c b/monitor.c
index b9258a7438..823b5a1099 100644
--- a/monitor.c
+++ b/monitor.c
@@ -83,6 +83,7 @@
 #include "sysemu/cpus.h"
 #include "sysemu/iothread.h"
 #include "qemu/cutils.h"
+#include "tcg/tcg.h"
 
 #if defined(TARGET_S390X)
 #include "hw/s390x/storage-keys.h"
@@ -1966,16 +1967,22 @@ static void hmp_info_numa(Monitor *mon, const QDict 
*qdict)
 
 #ifdef CONFIG_PROFILER
 
-int64_t tcg_time;
 int64_t dev_time;
 
 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 {
+static int64_t last_cpu_exec_time;
+int64_t cpu_exec_time;
+int64_t delta;
+
+cpu_exec_time = tcg_cpu_exec_time();
+delta = cpu_exec_time - last_cpu_exec_time;
+
 monitor_printf(mon, "async time  %" PRId64 " (%0.3f)\n",
dev_time, dev_time / (double)NANOSECONDS_PER_SECOND);
 monitor_printf(mon, "qemu time   %" PRId64 " (%0.3f)\n",
-   tcg_time, tcg_time / (double)NANOSECONDS_PER_SECOND);
-tcg_time = 0;
+   delta, delta / (double)NANOSECONDS_PER_SECOND);
+last_cpu_exec_time = cpu_exec_time;
 dev_time = 0;
 }
 #else
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 8f26916b99..e85133ef05 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -30,6 +30,7 @@
 /* Define to jump the ELF file used to communicate with GDB.  */
 #undef DEBUG_JIT
 
+#include "qemu/error-report.h"
 #include "qemu/cutils.h"
 #include "qemu/host-utils.h"
 #include "qemu/timer.h"
@@ -3361,6 +3362,7 @@ void tcg_profile_snapshot(TCGProfile *prof, bool 
counters, bool table)
 const TCGProfile *orig = &s->prof;
 
 if (counters) {
+PROF_ADD(prof, orig, cpu_exec_time);
 PROF_ADD(prof, orig, tb_count1);
 PROF_ADD(prof, orig, tb_count);
 PROF_ADD(prof, orig, op_count);
@@ -3412,11 +3414,32 @@ void tcg_dump_op_count(FILE *f, fprintf_function 
cpu_fprintf)
 prof.table_op_count[i]);
 }
 }
+
+int64_t tcg_cpu_exec_time(void)
+{
+unsigned int n_ctxs = atomic_read(&n_tcg_ctxs);
+unsigned int i;
+int64_t ret = 0;
+
+for (i = 0; i < n_ctxs; i++) {
+const TCGContext *s = atomic_read(&tcg_ctxs[i]);
+const TCGProfile *prof = &s->prof;
+
+ret += atomic_read(&prof->cpu_exec_time);
+}
+return ret;
+}
 #else
 void tcg_dump_op_count(FILE *f, fprintf_function cpu_fprintf)
 {
 cpu_fprintf(f, "[TCG profiler not compiled]\n");
 }
+
+int64_t tcg_cpu_exec_time(void)
+{
+error_report("%s: TCG profiler not compiled", __func__);
+exit(EXIT_FAILURE);
+}
 #endif
 
 
-- 
2.17.2

[Qemu-devel] [PATCH v3 26/38] ui: Convert vnc_display_init(), init_keyboard_layout() to Error

[Markus Armbruster]

From: Fei Li 

Signed-off-by: Fei Li 
Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
---
 include/ui/console.h |  2 +-
 ui/curses.c  |  6 +++---
 ui/keymaps.c | 11 ++-
 ui/keymaps.h |  2 +-
 ui/sdl.c |  6 +++---
 ui/vnc.c | 15 ++-
 6 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/include/ui/console.h b/include/ui/console.h
index fb969caf70..c17803c530 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -453,7 +453,7 @@ void qemu_display_early_init(DisplayOptions *opts);
 void qemu_display_init(DisplayState *ds, DisplayOptions *opts);
 
 /* vnc.c */
-void vnc_display_init(const char *id);
+void vnc_display_init(const char *id, Error **errp);
 void vnc_display_open(const char *id, Error **errp);
 void vnc_display_add_client(const char *id, int csock, bool skipauth);
 int vnc_display_password(const char *id, const char *password);
diff --git a/ui/curses.c b/ui/curses.c
index 59d819fd4d..f4e7a12f74 100644
--- a/ui/curses.c
+++ b/ui/curses.c
@@ -28,6 +28,7 @@
 #include 
 #endif
 
+#include "qapi/error.h"
 #include "qemu-common.h"
 #include "ui/console.h"
 #include "ui/input.h"
@@ -421,9 +422,8 @@ static void curses_keyboard_setup(void)
 keyboard_layout = "en-us";
 #endif
 if(keyboard_layout) {
-kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
-if (!kbd_layout)
-exit(1);
+kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout,
+  &error_fatal);
 }
 }
 
diff --git a/ui/keymaps.c b/ui/keymaps.c
index b05fb028dc..085889b555 100644
--- a/ui/keymaps.c
+++ b/ui/keymaps.c
@@ -27,6 +27,7 @@
 #include "sysemu/sysemu.h"
 #include "trace.h"
 #include "qemu/error-report.h"
+#include "qapi/error.h"
 
 struct keysym2code {
 uint32_t count;
@@ -81,7 +82,7 @@ static void add_keysym(char *line, int keysym, int keycode, 
kbd_layout_t *k)
 
 static int parse_keyboard_layout(kbd_layout_t *k,
  const name2keysym_t *table,
- const char *language)
+ const char *language, Error **errp)
 {
 int ret;
 FILE *f;
@@ -95,7 +96,7 @@ static int parse_keyboard_layout(kbd_layout_t *k,
 f = filename ? fopen(filename, "r") : NULL;
 g_free(filename);
 if (!f) {
-fprintf(stderr, "Could not read keymap file: '%s'\n", language);
+error_setg(errp, "could not read keymap file: '%s'", language);
 return -1;
 }
 
@@ -114,7 +115,7 @@ static int parse_keyboard_layout(kbd_layout_t *k,
 continue;
 }
 if (!strncmp(line, "include ", 8)) {
-if (parse_keyboard_layout(k, table, line + 8) < 0) {
+if (parse_keyboard_layout(k, table, line + 8, errp) < 0) {
 ret = -1;
 goto out;
 }
@@ -172,13 +173,13 @@ out:
 
 
 kbd_layout_t *init_keyboard_layout(const name2keysym_t *table,
-   const char *language)
+   const char *language, Error **errp)
 {
 kbd_layout_t *k;
 
 k = g_new0(kbd_layout_t, 1);
 k->hash = g_hash_table_new(NULL, NULL);
-if (parse_keyboard_layout(k, table, language) < 0) {
+if (parse_keyboard_layout(k, table, language, errp) < 0) {
 g_hash_table_unref(k->hash);
 g_free(k);
 return NULL;
diff --git a/ui/keymaps.h b/ui/keymaps.h
index 0693588225..98213a4191 100644
--- a/ui/keymaps.h
+++ b/ui/keymaps.h
@@ -53,7 +53,7 @@ typedef struct {
 typedef struct kbd_layout_t kbd_layout_t;
 
 kbd_layout_t *init_keyboard_layout(const name2keysym_t *table,
-   const char *language);
+   const char *language, Error **errp);
 int keysym2scancode(kbd_layout_t *k, int keysym,
 bool shift, bool altgr, bool ctrl);
 int keycode_is_keypad(kbd_layout_t *k, int keycode);
diff --git a/ui/sdl.c b/ui/sdl.c
index a5fd503c25..190b16f575 100644
--- a/ui/sdl.c
+++ b/ui/sdl.c
@@ -29,6 +29,7 @@
 #include 
 #include 
 
+#include "qapi/error.h"
 #include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "ui/console.h"
@@ -917,9 +918,8 @@ static void sdl1_display_init(DisplayState *ds, 
DisplayOptions *o)
 keyboard_layout = "en-us";
 #endif
 if(keyboard_layout) {
-kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
-if (!kbd_layout)
-exit(1);
+kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout,
+  &error_fatal);
 }
 
 g_printerr("Running QEMU with SDL 1.2 is deprecated, and will be removed\n"
diff --git a/ui/vnc.c b/ui/vnc.c
index cf221c83cc..98e3d3b1d8 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -3205,7 +3205,7 @@ static const DisplayChangeListenerOps dcl_ops = {
 .dpy_cursor_define= vnc_dp

[Qemu-devel] [PULL 09/21] cputlb: fix assert_cpu_is_self macro

[Richard Henderson]

From: "Emilio G. Cota" 

Reviewed-by: Richard Henderson 
Reviewed-by: Alex Bennée 
Signed-off-by: Emilio G. Cota 
Message-Id: <20181009174557.16125-5-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 accel/tcg/cputlb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 502eea2850..f6b388c961 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -58,9 +58,9 @@
 } \
 } while (0)
 
-#define assert_cpu_is_self(this_cpu) do { \
+#define assert_cpu_is_self(cpu) do {  \
 if (DEBUG_TLB_GATE) { \
-g_assert(!cpu->created || qemu_cpu_is_self(cpu)); \
+g_assert(!(cpu)->created || qemu_cpu_is_self(cpu));   \
 } \
 } while (0)
 
-- 
2.17.2

[Qemu-devel] [PATCH] hw/acpi/nvdimm: Don't take address of fields in packed structs

[Peter Maydell]

Taking the address of a field in a packed struct is a bad idea, because
it might not be actually aligned enough for that pointer type (and
thus cause a crash on dereference on some host architectures). Newer
versions of clang warn about this. Avoid the bug by not using the
"modify in place" byte swapping functions.

Patch produced with scripts/coccinelle/inplace-byteswaps.cocci.

Signed-off-by: Peter Maydell 
---
Automatically generated patch, tested with "make check" only.

 hw/acpi/nvdimm.c | 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/acpi/nvdimm.c b/hw/acpi/nvdimm.c
index 27eeb6609f5..e53b2cb6819 100644
--- a/hw/acpi/nvdimm.c
+++ b/hw/acpi/nvdimm.c
@@ -581,7 +581,7 @@ static void nvdimm_dsm_func_read_fit(AcpiNVDIMMState 
*state, NvdimmDsmIn *in,
 int size;
 
 read_fit = (NvdimmFuncReadFITIn *)in->arg3;
-le32_to_cpus(&read_fit->offset);
+read_fit->offset = le32_to_cpu(read_fit->offset);
 
 fit = fit_buf->fit;
 
@@ -742,8 +742,8 @@ static void nvdimm_dsm_get_label_data(NVDIMMDevice *nvdimm, 
NvdimmDsmIn *in,
 int size;
 
 get_label_data = (NvdimmFuncGetLabelDataIn *)in->arg3;
-le32_to_cpus(&get_label_data->offset);
-le32_to_cpus(&get_label_data->length);
+get_label_data->offset = le32_to_cpu(get_label_data->offset);
+get_label_data->length = le32_to_cpu(get_label_data->length);
 
 nvdimm_debug("Read Label Data: offset %#x length %#x.\n",
  get_label_data->offset, get_label_data->length);
@@ -781,8 +781,8 @@ static void nvdimm_dsm_set_label_data(NVDIMMDevice *nvdimm, 
NvdimmDsmIn *in,
 
 set_label_data = (NvdimmFuncSetLabelDataIn *)in->arg3;
 
-le32_to_cpus(&set_label_data->offset);
-le32_to_cpus(&set_label_data->length);
+set_label_data->offset = le32_to_cpu(set_label_data->offset);
+set_label_data->length = le32_to_cpu(set_label_data->length);
 
 nvdimm_debug("Write Label Data: offset %#x length %#x.\n",
  set_label_data->offset, set_label_data->length);
@@ -877,9 +877,9 @@ nvdimm_dsm_write(void *opaque, hwaddr addr, uint64_t val, 
unsigned size)
 in = g_new(NvdimmDsmIn, 1);
 cpu_physical_memory_read(dsm_mem_addr, in, sizeof(*in));
 
-le32_to_cpus(&in->revision);
-le32_to_cpus(&in->function);
-le32_to_cpus(&in->handle);
+in->revision = le32_to_cpu(in->revision);
+in->function = le32_to_cpu(in->function);
+in->handle = le32_to_cpu(in->handle);
 
 nvdimm_debug("Revision %#x Handler %#x Function %#x.\n", in->revision,
  in->handle, in->function);
-- 
2.19.0

[Qemu-devel] [PATCH v3 38/38] vpc: Fail open on bad header checksum

[Markus Armbruster]

vpc_open() merely prints a warning when it finds a bad header
checksum.  Turn that into a hard error.

Signed-off-by: Markus Armbruster 
---
 block/vpc.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index bf294abfa7..1729c0cb44 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -284,9 +284,11 @@ static int vpc_open(BlockDriverState *bs, QDict *options, 
int flags,
 
 checksum = be32_to_cpu(footer->checksum);
 footer->checksum = 0;
-if (vpc_checksum(s->footer_buf, HEADER_SIZE) != checksum)
-fprintf(stderr, "block-vpc: The header checksum of '%s' is "
-"incorrect.\n", bs->filename);
+if (vpc_checksum(s->footer_buf, HEADER_SIZE) != checksum) {
+error_setg(errp, "incorrect header checksum");
+ret = -EINVAL;
+goto fail;
+}
 
 /* Write 'checksum' back to footer, or else will leave it with zero. */
 footer->checksum = cpu_to_be32(checksum);
-- 
2.17.1

[Qemu-devel] [PATCH v3 04/38] cpus hw target: Use warn_report() & friends to report warnings

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  Convert a few that are actually warnings to
warn_report().

While there, split a warning consisting of multiple sentences to
conform to conventions spelled out in warn_report()'s contract.

Cc: Alex Bennée 
Cc: Mark Cave-Ayland 
Cc: Alex Williamson 
Cc: Fam Zheng 
Cc: Wei Huang 
Cc: David Gibson 
Signed-off-by: Markus Armbruster 
Acked-by: David Gibson 
Reviewed-by: Alex Bennée 
---
 cpus.c  |  8 
 hw/display/cg3.c|  2 +-
 hw/display/tcx.c|  2 +-
 hw/misc/ivshmem.c   |  4 ++--
 hw/net/virtio-net.c |  8 
 hw/virtio/virtio-pci.c  |  4 ++--
 target/i386/cpu.c   | 17 +
 target/ppc/translate_init.inc.c |  4 ++--
 8 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/cpus.c b/cpus.c
index 361678e459..7804071872 100644
--- a/cpus.c
+++ b/cpus.c
@@ -211,12 +211,12 @@ void qemu_tcg_configure(QemuOpts *opts, Error **errp)
 error_setg(errp, "No MTTCG when icount is enabled");
 } else {
 #ifndef TARGET_SUPPORTS_MTTCG
-error_report("Guest not yet converted to MTTCG - "
- "you may get unexpected results");
+warn_report("Guest not yet converted to MTTCG - "
+"you may get unexpected results");
 #endif
 if (!check_tcg_memory_orders_compatible()) {
-error_report("Guest expects a stronger memory ordering "
- "than the host provides");
+warn_report("Guest expects a stronger memory ordering "
+"than the host provides");
 error_printf("This may cause strange/hard to debug 
errors\n");
 }
 mttcg_enabled = true;
diff --git a/hw/display/cg3.c b/hw/display/cg3.c
index 1c199ab369..e50d97e48c 100644
--- a/hw/display/cg3.c
+++ b/hw/display/cg3.c
@@ -307,7 +307,7 @@ static void cg3_realizefn(DeviceState *dev, Error **errp)
 ret = load_image_mr(fcode_filename, &s->rom);
 g_free(fcode_filename);
 if (ret < 0 || ret > FCODE_MAX_ROM_SIZE) {
-error_report("cg3: could not load prom '%s'", CG3_ROM_FILE);
+warn_report("cg3: could not load prom '%s'", CG3_ROM_FILE);
 }
 }
 
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index b2786ee8d0..66f2459226 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -823,7 +823,7 @@ static void tcx_realizefn(DeviceState *dev, Error **errp)
 ret = load_image_mr(fcode_filename, &s->rom);
 g_free(fcode_filename);
 if (ret < 0 || ret > FCODE_MAX_ROM_SIZE) {
-error_report("tcx: could not load prom '%s'", TCX_ROM_FILE);
+warn_report("tcx: could not load prom '%s'", TCX_ROM_FILE);
 }
 }
 
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 8cb17b9dd4..f88910e55c 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -1288,8 +1288,8 @@ static void ivshmem_realize(PCIDevice *dev, Error **errp)
 IVShmemState *s = IVSHMEM_COMMON(dev);
 
 if (!qtest_enabled()) {
-error_report("ivshmem is deprecated, please use ivshmem-plain"
- " or ivshmem-doorbell instead");
+warn_report("ivshmem is deprecated, please use ivshmem-plain"
+" or ivshmem-doorbell instead");
 }
 
 if (qemu_chr_fe_backend_connected(&s->server_chr) + !!s->shmobj != 1) {
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 4bdd5b8532..385b1a03e9 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -2020,10 +2020,10 @@ static void virtio_net_device_realize(DeviceState *dev, 
Error **errp)
 
 if (n->net_conf.tx && strcmp(n->net_conf.tx, "timer")
&& strcmp(n->net_conf.tx, "bh")) {
-error_report("virtio-net: "
- "Unknown option tx=%s, valid options: \"timer\" \"bh\"",
- n->net_conf.tx);
-error_report("Defaulting to \"bh\"");
+warn_report("virtio-net: "
+"Unknown option tx=%s, valid options: \"timer\" \"bh\"",
+n->net_conf.tx);
+error_printf("Defaulting to \"bh\"");
 }
 
 n->net_conf.tx_queue_size = MIN(virtio_net_max_tx_queue_size(n),
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 3a01fe90f0..a954799267 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1683,8 +1683,8 @@ static void virtio_pci_device_plugged(DeviceState *d, 
Error **errp)
 if (err) {
 /* Notice when a system that supports MSIx can't initialize it */
 if (err != -ENOTSUP) {
-error_report("unable to init msix vectors to %" PRIu32,
- proxy->nvectors);
+warn_report("unable to init msix vectors to %" PRIu32,

[Qemu-devel] [PULL 08/21] exec: introduce tlb_init

[Richard Henderson]

From: "Emilio G. Cota" 

Paves the way for the addition of a per-TLB lock.

Reviewed-by: Alex Bennée 
Reviewed-by: Richard Henderson 
Signed-off-by: Emilio G. Cota 
Message-Id: <20181009174557.16125-4-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 include/exec/exec-all.h | 8 
 accel/tcg/cputlb.c  | 4 
 exec.c  | 1 +
 3 files changed, 13 insertions(+)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 5f78125582..815e5b1e83 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -99,6 +99,11 @@ void cpu_address_space_init(CPUState *cpu, int asidx,
 
 #if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 /* cputlb.c */
+/**
+ * tlb_init - initialize a CPU's TLB
+ * @cpu: CPU whose TLB should be initialized
+ */
+void tlb_init(CPUState *cpu);
 /**
  * tlb_flush_page:
  * @cpu: CPU whose TLB should be flushed
@@ -258,6 +263,9 @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
 void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
  uintptr_t retaddr);
 #else
+static inline void tlb_init(CPUState *cpu)
+{
+}
 static inline void tlb_flush_page(CPUState *cpu, target_ulong addr)
 {
 }
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index f4702ce91f..502eea2850 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -73,6 +73,10 @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > 
sizeof(run_on_cpu_data));
 QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
 
+void tlb_init(CPUState *cpu)
+{
+}
+
 /* flush_all_helper: run fn across all cpus
  *
  * If the wait flag is set then the src cpu's helper will be queued as
diff --git a/exec.c b/exec.c
index d0821e69aa..4fd831ef06 100644
--- a/exec.c
+++ b/exec.c
@@ -965,6 +965,7 @@ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 tcg_target_initialized = true;
 cc->tcg_initialize();
 }
+tlb_init(cpu);
 
 #ifndef CONFIG_USER_ONLY
 if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
-- 
2.17.2

[Qemu-devel] [PULL 07/21] target/unicore32: remove tlb_flush from uc32_init_fn

[Richard Henderson]

From: "Emilio G. Cota" 

As far as I can tell tlb_flush does not need to be called
this early. tlb_flush is eventually called after the CPU
has been realized.

This change paves the way to the introduction of tlb_init,
which will be called from cpu_exec_realizefn.

Cc: Guan Xuetao 
Reviewed-by: Alex Bennée 
Reviewed-by: Richard Henderson 
Signed-off-by: Emilio G. Cota 
Message-Id: <20181009174557.16125-3-c...@braap.org>
Signed-off-by: Richard Henderson 
---
 target/unicore32/cpu.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/unicore32/cpu.c b/target/unicore32/cpu.c
index 68f978d80b..2b49d1ca40 100644
--- a/target/unicore32/cpu.c
+++ b/target/unicore32/cpu.c
@@ -116,8 +116,6 @@ static void uc32_cpu_initfn(Object *obj)
 env->uncached_asr = ASR_MODE_PRIV;
 env->regs[31] = 0x0300;
 #endif
-
-tlb_flush(cs);
 }
 
 static const VMStateDescription vmstate_uc32_cpu = {
-- 
2.17.2

[Qemu-devel] [PATCH v3 25/38] ui/keymaps: Fix handling of erroneous include files

[Markus Armbruster]

While errors in the keyboard layout named with -k are fatal, errors in
included files are reported, but otherwise ignored:

$ cat worst
include bad
include worse
$ ls -l bad worse
ls: cannot access 'bad': No such file or directory
ls: cannot access 'worse': No such file or directory
$ qemu-system-x86_64 -nodefaults -S -monitor stdio -display vnc=:0 -k bad
QEMU 3.0.50 monitor - type 'help' for more information
(qemu) Could not read keymap file: 'bad'
$ qemu-system-x86_64 -nodefaults -S -monitor stdio -display vnc=:0 -k worst
QEMU 3.0.50 monitor - type 'help' for more information
(qemu) Could not read keymap file: 'bad'
Could not read keymap file: 'worse'

Fix that.

Note that parse_keyboard_layout() allocates the keymap, except when
it's parsing an include file.  To keep error handling simple, move the
memory management to its caller init_keyboard_layout().

Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
---
 ui/keymaps.c | 35 +++
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/ui/keymaps.c b/ui/keymaps.c
index 43fe604724..b05fb028dc 100644
--- a/ui/keymaps.c
+++ b/ui/keymaps.c
@@ -79,10 +79,11 @@ static void add_keysym(char *line, int keysym, int keycode, 
kbd_layout_t *k)
 trace_keymap_add(keysym, keycode, line);
 }
 
-static kbd_layout_t *parse_keyboard_layout(const name2keysym_t *table,
-   const char *language,
-   kbd_layout_t *k)
+static int parse_keyboard_layout(kbd_layout_t *k,
+ const name2keysym_t *table,
+ const char *language)
 {
+int ret;
 FILE *f;
 char * filename;
 char line[1024];
@@ -95,12 +96,7 @@ static kbd_layout_t *parse_keyboard_layout(const 
name2keysym_t *table,
 g_free(filename);
 if (!f) {
 fprintf(stderr, "Could not read keymap file: '%s'\n", language);
-return NULL;
-}
-
-if (!k) {
-k = g_new0(kbd_layout_t, 1);
-k->hash = g_hash_table_new(NULL, NULL);
+return -1;
 }
 
 for(;;) {
@@ -118,7 +114,10 @@ static kbd_layout_t *parse_keyboard_layout(const 
name2keysym_t *table,
 continue;
 }
 if (!strncmp(line, "include ", 8)) {
-parse_keyboard_layout(table, line + 8, k);
+if (parse_keyboard_layout(k, table, line + 8) < 0) {
+ret = -1;
+goto out;
+}
 } else {
 int offset = 0;
 while (line[offset] != 0 &&
@@ -164,15 +163,27 @@ static kbd_layout_t *parse_keyboard_layout(const 
name2keysym_t *table,
 }
 }
 }
+
+ret = 0;
+out:
 fclose(f);
-return k;
+return ret;
 }
 
 
 kbd_layout_t *init_keyboard_layout(const name2keysym_t *table,
const char *language)
 {
-return parse_keyboard_layout(table, language, NULL);
+kbd_layout_t *k;
+
+k = g_new0(kbd_layout_t, 1);
+k->hash = g_hash_table_new(NULL, NULL);
+if (parse_keyboard_layout(k, table, language) < 0) {
+g_hash_table_unref(k->hash);
+g_free(k);
+return NULL;
+}
+return k;
 }
 
 
-- 
2.17.1

[Qemu-devel] [PATCH v3 19/38] qom: Clean up error reporting in user_creatable_add_opts_foreach()

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  user_creatable_add_opts_foreach() does that, and then
fails without setting an error.  Its caller main(), via
qemu_opts_foreach(), is fine with it, but clean it up anyway.

Cc: Daniel P. Berrangé 
Signed-off-by: Markus Armbruster 
Reviewed-by: Eric Blake 
Reviewed-by: Marc-André Lureau 
---
 qemu-io.c   |  8 +++-
 qemu-nbd.c  |  8 +++-
 qom/object_interfaces.c |  4 +---
 vl.c| 16 ++--
 4 files changed, 13 insertions(+), 23 deletions(-)

diff --git a/qemu-io.c b/qemu-io.c
index 13829f5e21..6df7731af4 100644
--- a/qemu-io.c
+++ b/qemu-io.c
@@ -620,11 +620,9 @@ int main(int argc, char **argv)
 exit(1);
 }
 
-if (qemu_opts_foreach(&qemu_object_opts,
-  user_creatable_add_opts_foreach,
-  NULL, NULL)) {
-exit(1);
-}
+qemu_opts_foreach(&qemu_object_opts,
+  user_creatable_add_opts_foreach,
+  NULL, &error_fatal);
 
 if (!trace_init_backends()) {
 exit(1);
diff --git a/qemu-nbd.c b/qemu-nbd.c
index 7874bc973c..ca7109652e 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -766,11 +766,9 @@ int main(int argc, char **argv)
 exit(EXIT_FAILURE);
 }
 
-if (qemu_opts_foreach(&qemu_object_opts,
-  user_creatable_add_opts_foreach,
-  NULL, NULL)) {
-exit(EXIT_FAILURE);
-}
+qemu_opts_foreach(&qemu_object_opts,
+  user_creatable_add_opts_foreach,
+  NULL, &error_fatal);
 
 if (!trace_init_backends()) {
 exit(1);
diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
index 941fd63afd..97b79b48bb 100644
--- a/qom/object_interfaces.c
+++ b/qom/object_interfaces.c
@@ -143,7 +143,6 @@ int user_creatable_add_opts_foreach(void *opaque, QemuOpts 
*opts, Error **errp)
 {
 bool (*type_opt_predicate)(const char *, QemuOpts *) = opaque;
 Object *obj = NULL;
-Error *err = NULL;
 const char *type;
 
 type = qemu_opt_get(opts, "qom-type");
@@ -152,9 +151,8 @@ int user_creatable_add_opts_foreach(void *opaque, QemuOpts 
*opts, Error **errp)
 return 0;
 }
 
-obj = user_creatable_add_opts(opts, &err);
+obj = user_creatable_add_opts(opts, errp);
 if (!obj) {
-error_report_err(err);
 return -1;
 }
 object_unref(obj);
diff --git a/vl.c b/vl.c
index 2ef066ad61..bb18f2d995 100644
--- a/vl.c
+++ b/vl.c
@@ -4228,11 +4228,9 @@ int main(int argc, char **argv, char **envp)
 page_size_init();
 socket_init();
 
-if (qemu_opts_foreach(qemu_find_opts("object"),
-  user_creatable_add_opts_foreach,
-  object_create_initial, NULL)) {
-exit(1);
-}
+qemu_opts_foreach(qemu_find_opts("object"),
+  user_creatable_add_opts_foreach,
+  object_create_initial, &error_fatal);
 
 if (qemu_opts_foreach(qemu_find_opts("chardev"),
   chardev_init_func, NULL, NULL)) {
@@ -4363,11 +4361,9 @@ int main(int argc, char **argv, char **envp)
 exit(1);
 }
 
-if (qemu_opts_foreach(qemu_find_opts("object"),
-  user_creatable_add_opts_foreach,
-  object_create_delayed, NULL)) {
-exit(1);
-}
+qemu_opts_foreach(qemu_find_opts("object"),
+  user_creatable_add_opts_foreach,
+  object_create_delayed, &error_fatal);
 
 if (tpm_init() < 0) {
 exit(1);
-- 
2.17.1

[Qemu-devel] [PULL 20/21] target/s390x: Check HAVE_ATOMIC128 and HAVE_CMPXCHG128 at translate

[Richard Henderson]

Reviewed-by: David Hildenbrand 
Signed-off-by: Richard Henderson 
---
 target/s390x/mem_helper.c | 40 +++
 target/s390x/translate.c  | 25 +---
 2 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c
index b5858d2fa2..490c43e6e6 100644
--- a/target/s390x/mem_helper.c
+++ b/target/s390x/mem_helper.c
@@ -1420,9 +1420,7 @@ void HELPER(cdsg_parallel)(CPUS390XState *env, uint64_t 
addr,
 Int128 oldv;
 bool fail;
 
-if (!HAVE_CMPXCHG128) {
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-}
+assert(HAVE_CMPXCHG128);
 
 mem_idx = cpu_mmu_index(env, false);
 oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
@@ -2115,16 +2113,17 @@ uint64_t HELPER(lpq_parallel)(CPUS390XState *env, 
uint64_t addr)
 {
 uintptr_t ra = GETPC();
 uint64_t hi, lo;
+int mem_idx;
+TCGMemOpIdx oi;
+Int128 v;
 
-if (HAVE_ATOMIC128) {
-int mem_idx = cpu_mmu_index(env, false);
-TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
-Int128 v = helper_atomic_ldo_be_mmu(env, addr, oi, ra);
-hi = int128_gethi(v);
-lo = int128_getlo(v);
-} else {
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-}
+assert(HAVE_ATOMIC128);
+
+mem_idx = cpu_mmu_index(env, false);
+oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
+v = helper_atomic_ldo_be_mmu(env, addr, oi, ra);
+hi = int128_gethi(v);
+lo = int128_getlo(v);
 
 env->retxl = lo;
 return hi;
@@ -2145,15 +2144,16 @@ void HELPER(stpq_parallel)(CPUS390XState *env, uint64_t 
addr,
uint64_t low, uint64_t high)
 {
 uintptr_t ra = GETPC();
+int mem_idx;
+TCGMemOpIdx oi;
+Int128 v;
 
-if (HAVE_ATOMIC128) {
-int mem_idx = cpu_mmu_index(env, false);
-TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
-Int128 v = int128_make128(low, high);
-helper_atomic_sto_be_mmu(env, addr, v, oi, ra);
-} else {
-cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-}
+assert(HAVE_ATOMIC128);
+
+mem_idx = cpu_mmu_index(env, false);
+oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);
+v = int128_make128(low, high);
+helper_atomic_sto_be_mmu(env, addr, v, oi, ra);
 }
 
 /* Execute instruction.  This instruction executes an insn modified with
diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index a7bd689337..b5bd56b7ee 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -44,6 +44,7 @@
 #include "trace-tcg.h"
 #include "exec/translator.h"
 #include "exec/log.h"
+#include "qemu/atomic128.h"
 
 
 /* Information that (most) every instruction needs to manipulate.  */
@@ -2040,6 +2041,7 @@ static DisasJumpType op_cdsg(DisasContext *s, DisasOps *o)
 int r3 = get_field(s->fields, r3);
 int d2 = get_field(s->fields, d2);
 int b2 = get_field(s->fields, b2);
+DisasJumpType ret = DISAS_NEXT;
 TCGv_i64 addr;
 TCGv_i32 t_r1, t_r3;
 
@@ -2047,17 +2049,20 @@ static DisasJumpType op_cdsg(DisasContext *s, DisasOps 
*o)
 addr = get_address(s, 0, b2, d2);
 t_r1 = tcg_const_i32(r1);
 t_r3 = tcg_const_i32(r3);
-if (tb_cflags(s->base.tb) & CF_PARALLEL) {
+if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
+gen_helper_cdsg(cpu_env, addr, t_r1, t_r3);
+} else if (HAVE_CMPXCHG128) {
 gen_helper_cdsg_parallel(cpu_env, addr, t_r1, t_r3);
 } else {
-gen_helper_cdsg(cpu_env, addr, t_r1, t_r3);
+gen_helper_exit_atomic(cpu_env);
+ret = DISAS_NORETURN;
 }
 tcg_temp_free_i64(addr);
 tcg_temp_free_i32(t_r1);
 tcg_temp_free_i32(t_r3);
 
 set_cc_static(s);
-return DISAS_NEXT;
+return ret;
 }
 
 static DisasJumpType op_csst(DisasContext *s, DisasOps *o)
@@ -3034,10 +3039,13 @@ static DisasJumpType op_lpd(DisasContext *s, DisasOps 
*o)
 
 static DisasJumpType op_lpq(DisasContext *s, DisasOps *o)
 {
-if (tb_cflags(s->base.tb) & CF_PARALLEL) {
+if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
+gen_helper_lpq(o->out, cpu_env, o->in2);
+} else if (HAVE_ATOMIC128) {
 gen_helper_lpq_parallel(o->out, cpu_env, o->in2);
 } else {
-gen_helper_lpq(o->out, cpu_env, o->in2);
+gen_helper_exit_atomic(cpu_env);
+return DISAS_NORETURN;
 }
 return_low128(o->out2);
 return DISAS_NEXT;
@@ -4414,10 +4422,13 @@ static DisasJumpType op_stmh(DisasContext *s, DisasOps 
*o)
 
 static DisasJumpType op_stpq(DisasContext *s, DisasOps *o)
 {
-if (tb_cflags(s->base.tb) & CF_PARALLEL) {
+if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
+gen_helper_stpq(cpu_env, o->in2, o->out2, o->out);
+} else if (HAVE_ATOMIC128) {
 gen_helper_stpq_parallel(cpu_env, o->in2, o->out2, o->out);
 } else {
-gen_helper_stpq(cpu_env, o->in2, o->out2, o->out);
+gen_helper_exit_atomi

[Qemu-devel] [PATCH v3 28/38] numa: Clean up error reporting in parse_numa()

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  parse_numa() does that, and then fails without setting
an error.  Its caller main(), via qemu_opts_foreach(), is fine with
it, but clean it up anyway.

While there, give parse_numa() internal linkage.

Cc: Eduardo Habkost 
Signed-off-by: Markus Armbruster 
Reviewed-by: Eduardo Habkost 
---
 include/sysemu/numa.h | 1 -
 numa.c| 8 +++-
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/include/sysemu/numa.h b/include/sysemu/numa.h
index 7a0ae751aa..21713b7e2f 100644
--- a/include/sysemu/numa.h
+++ b/include/sysemu/numa.h
@@ -22,7 +22,6 @@ struct NumaNodeMem {
 };
 
 extern NodeInfo numa_info[MAX_NODES];
-int parse_numa(void *opaque, QemuOpts *opts, Error **errp);
 void parse_numa_opts(MachineState *ms);
 void numa_complete_configuration(MachineState *ms);
 void query_numa_node_mem(NumaNodeMem node_mem[]);
diff --git a/numa.c b/numa.c
index 1d7c49ad43..50ec016013 100644
--- a/numa.c
+++ b/numa.c
@@ -215,7 +215,7 @@ end:
 error_propagate(errp, err);
 }
 
-int parse_numa(void *opaque, QemuOpts *opts, Error **errp)
+static int parse_numa(void *opaque, QemuOpts *opts, Error **errp)
 {
 NumaOptions *object = NULL;
 MachineState *ms = MACHINE(opaque);
@@ -239,7 +239,7 @@ int parse_numa(void *opaque, QemuOpts *opts, Error **errp)
 end:
 qapi_free_NumaOptions(object);
 if (err) {
-error_report_err(err);
+error_propagate(errp, err);
 return -1;
 }
 
@@ -444,9 +444,7 @@ void numa_complete_configuration(MachineState *ms)
 
 void parse_numa_opts(MachineState *ms)
 {
-if (qemu_opts_foreach(qemu_find_opts("numa"), parse_numa, ms, NULL)) {
-exit(1);
-}
+qemu_opts_foreach(qemu_find_opts("numa"), parse_numa, ms, &error_fatal);
 }
 
 void qmp_set_numa_node(NumaOptions *cmd, Error **errp)
-- 
2.17.1

[Qemu-devel] [PATCH v3 29/38] tpm: Clean up error reporting in tpm_init_tpmdev()

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  tpm_init_tpmdev() does that, and then fails without
setting an error.  Its caller main(), via tpm_init() and
qemu_opts_foreach(), is fine with it, but clean it up anyway.

Cc: Stefan Berger 
Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Marc-André Lureau 
Reviewed-by: Stefan Berger 
---
 include/sysemu/tpm.h |  2 +-
 stubs/tpm.c  |  3 +--
 tpm.c| 22 +-
 vl.c |  4 +---
 4 files changed, 12 insertions(+), 19 deletions(-)

diff --git a/include/sysemu/tpm.h b/include/sysemu/tpm.h
index 9ae1ab6da3..17a97ed77a 100644
--- a/include/sysemu/tpm.h
+++ b/include/sysemu/tpm.h
@@ -16,7 +16,7 @@
 #include "qom/object.h"
 
 int tpm_config_parse(QemuOptsList *opts_list, const char *optarg);
-int tpm_init(void);
+void tpm_init(void);
 void tpm_cleanup(void);
 
 typedef enum TPMVersion {
diff --git a/stubs/tpm.c b/stubs/tpm.c
index 6729bc8517..80939cd3db 100644
--- a/stubs/tpm.c
+++ b/stubs/tpm.c
@@ -9,9 +9,8 @@
 #include "qapi/qapi-commands-tpm.h"
 #include "sysemu/tpm.h"
 
-int tpm_init(void)
+void tpm_init(void)
 {
-return 0;
 }
 
 void tpm_cleanup(void)
diff --git a/tpm.c b/tpm.c
index 93031723ad..9c9e20bbb7 100644
--- a/tpm.c
+++ b/tpm.c
@@ -89,19 +89,19 @@ static int tpm_init_tpmdev(void *dummy, QemuOpts *opts, 
Error **errp)
 int i;
 
 if (!QLIST_EMPTY(&tpm_backends)) {
-error_report("Only one TPM is allowed.");
+error_setg(errp, "Only one TPM is allowed.");
 return 1;
 }
 
 id = qemu_opts_id(opts);
 if (id == NULL) {
-error_report(QERR_MISSING_PARAMETER, "id");
+error_setg(errp, QERR_MISSING_PARAMETER, "id");
 return 1;
 }
 
 value = qemu_opt_get(opts, "type");
 if (!value) {
-error_report(QERR_MISSING_PARAMETER, "type");
+error_setg(errp, QERR_MISSING_PARAMETER, "type");
 tpm_display_backend_drivers();
 return 1;
 }
@@ -109,8 +109,8 @@ static int tpm_init_tpmdev(void *dummy, QemuOpts *opts, 
Error **errp)
 i = qapi_enum_parse(&TpmType_lookup, value, -1, NULL);
 be = i >= 0 ? tpm_be_find_by_type(i) : NULL;
 if (be == NULL) {
-error_report(QERR_INVALID_PARAMETER_VALUE,
- "type", "a TPM backend type");
+error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
+   "a TPM backend type");
 tpm_display_backend_drivers();
 return 1;
 }
@@ -118,7 +118,7 @@ static int tpm_init_tpmdev(void *dummy, QemuOpts *opts, 
Error **errp)
 /* validate backend specific opts */
 qemu_opts_validate(opts, be->opts, &local_err);
 if (local_err) {
-error_report_err(local_err);
+error_propagate(errp, local_err);
 return 1;
 }
 
@@ -151,14 +151,10 @@ void tpm_cleanup(void)
  * Initialize the TPM. Process the tpmdev command line options describing the
  * TPM backend.
  */
-int tpm_init(void)
+void tpm_init(void)
 {
-if (qemu_opts_foreach(qemu_find_opts("tpmdev"),
-  tpm_init_tpmdev, NULL, NULL)) {
-return -1;
-}
-
-return 0;
+qemu_opts_foreach(qemu_find_opts("tpmdev"),
+  tpm_init_tpmdev, NULL, &error_fatal);
 }
 
 /*
diff --git a/vl.c b/vl.c
index 8e0006d49c..abfe991ed6 100644
--- a/vl.c
+++ b/vl.c
@@ -4359,9 +4359,7 @@ int main(int argc, char **argv, char **envp)
   user_creatable_add_opts_foreach,
   object_create_delayed, &error_fatal);
 
-if (tpm_init() < 0) {
-exit(1);
-}
+tpm_init();
 
 /* init the bluetooth world */
 if (foreach_device_config(DEV_BT, bt_parse))
-- 
2.17.1

[Qemu-devel] [PATCH v3 33/38] blockdev: Convert drive_new() to Error

[Markus Armbruster]

Calling error_report() from within a function that takes an Error **
argument is suspicious.  drive_new() calls error_report() even though
it can run within drive_init_func(), which takes an Error ** argument.
drive_init_func()'s caller main(), via qemu_opts_foreach(), is fine
with it, but clean it up anyway:

* Convert drive_new() to Error

* Update add_init_drive() to report the error received from
  drive_new()

* Make main() pass &error_fatal through qemu_opts_foreach(),
  drive_init_func() to drive_new()

* Make default_drive() pass &error_abort through qemu_opts_foreach(),
  drive_init_func() to drive_new()

Cc: Kevin Wolf 
Cc: Max Reitz 
Signed-off-by: Markus Armbruster 
Reviewed-by: Max Reitz 
Reviewed-by: Philippe Mathieu-Daudé 
---
 blockdev.c| 27 ++-
 device-hotplug.c  |  5 -
 include/sysemu/blockdev.h |  3 ++-
 vl.c  |  8 
 4 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/blockdev.c b/blockdev.c
index a8755bd908..574adbcb7f 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -759,7 +759,8 @@ QemuOptsList qemu_legacy_drive_opts = {
 },
 };
 
-DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
+DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type,
+ Error **errp)
 {
 const char *value;
 BlockBackend *blk;
@@ -808,7 +809,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
 qemu_opt_rename(all_opts, opt_renames[i].from, opt_renames[i].to,
 &local_err);
 if (local_err) {
-error_report_err(local_err);
+error_propagate(errp, local_err);
 return NULL;
 }
 }
@@ -819,7 +820,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
 bool writethrough;
 
 if (bdrv_parse_cache_mode(value, &flags, &writethrough) != 0) {
-error_report("invalid cache option");
+error_setg(errp, "invalid cache option");
 return NULL;
 }
 
@@ -847,7 +848,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
&error_abort);
 qemu_opts_absorb_qdict(legacy_opts, bs_opts, &local_err);
 if (local_err) {
-error_report_err(local_err);
+error_propagate(errp, local_err);
 goto fail;
 }
 
@@ -860,7 +861,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
 media = MEDIA_CDROM;
 read_only = true;
 } else {
-error_report("'%s' invalid media", value);
+error_setg(errp, "'%s' invalid media", value);
 goto fail;
 }
 }
@@ -885,7 +886,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
  type++) {
 }
 if (type == IF_COUNT) {
-error_report("unsupported bus type '%s'", value);
+error_setg(errp, "unsupported bus type '%s'", value);
 goto fail;
 }
 } else {
@@ -902,7 +903,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
 
 if (index != -1) {
 if (bus_id != 0 || unit_id != -1) {
-error_report("index cannot be used with bus and unit");
+error_setg(errp, "index cannot be used with bus and unit");
 goto fail;
 }
 bus_id = drive_index_to_bus_id(type, index);
@@ -921,13 +922,13 @@ DriveInfo *drive_new(QemuOpts *all_opts, 
BlockInterfaceType block_default_type)
 }
 
 if (max_devs && unit_id >= max_devs) {
-error_report("unit %d too big (max is %d)", unit_id, max_devs - 1);
+error_setg(errp, "unit %d too big (max is %d)", unit_id, max_devs - 1);
 goto fail;
 }
 
 if (drive_get(type, bus_id, unit_id) != NULL) {
-error_report("drive with bus=%d, unit=%d (index=%d) exists",
- bus_id, unit_id, index);
+error_setg(errp, "drive with bus=%d, unit=%d (index=%d) exists",
+   bus_id, unit_id, index);
 goto fail;
 }
 
@@ -970,7 +971,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
 if (werror != NULL) {
 if (type != IF_IDE && type != IF_SCSI && type != IF_VIRTIO &&
 type != IF_NONE) {
-error_report("werror is not supported by this bus type");
+error_setg(errp, "werror is not supported by this bus type");
 goto fail;
 }
 qdict_put_str(bs_opts, "werror", werror);
@@ -980,7 +981,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType 
block_default_type)
 if (rerror != NULL) {
 if (type != IF_IDE && type != IF_VIRTIO && type != IF_SCSI &&
 type != IF_NONE) {
-error_report("rerror is not supported by this bus type");
+

[Qemu-devel] [PULL 12/21] tcg: Split CONFIG_ATOMIC128

[Richard Henderson]

GCC7+ will no longer advertise support for 16-byte __atomic operations
if only cmpxchg is supported, as for x86_64.  Fortunately, x86_64 still
has support for __sync_compare_and_swap_16 and we can make use of that.
AArch64 does not have, nor ever has had such support, so open-code it.

Reviewed-by: Emilio G. Cota 
Signed-off-by: Richard Henderson 
---
 accel/tcg/atomic_template.h |  20 -
 include/qemu/atomic128.h| 155 
 tcg/tcg.h   |  16 ++--
 accel/tcg/cputlb.c  |   3 +-
 accel/tcg/user-exec.c   |   5 +-
 configure   |  19 +
 6 files changed, 204 insertions(+), 14 deletions(-)
 create mode 100644 include/qemu/atomic128.h

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index d751bcba48..efde12fdb2 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -100,19 +100,24 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, 
target_ulong addr,
 DATA_TYPE ret;
 
 ATOMIC_TRACE_RMW;
+#if DATA_SIZE == 16
+ret = atomic16_cmpxchg(haddr, cmpv, newv);
+#else
 ret = atomic_cmpxchg__nocheck(haddr, cmpv, newv);
+#endif
 ATOMIC_MMU_CLEANUP;
 return ret;
 }
 
 #if DATA_SIZE >= 16
+#if HAVE_ATOMIC128
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
 ATOMIC_MMU_DECLS;
 DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
 
 ATOMIC_TRACE_LD;
-__atomic_load(haddr, &val, __ATOMIC_RELAXED);
+val = atomic16_read(haddr);
 ATOMIC_MMU_CLEANUP;
 return val;
 }
@@ -124,9 +129,10 @@ void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
 DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
 
 ATOMIC_TRACE_ST;
-__atomic_store(haddr, &val, __ATOMIC_RELAXED);
+atomic16_set(haddr, val);
 ATOMIC_MMU_CLEANUP;
 }
+#endif
 #else
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
ABI_TYPE val EXTRA_ARGS)
@@ -228,19 +234,24 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, 
target_ulong addr,
 DATA_TYPE ret;
 
 ATOMIC_TRACE_RMW;
+#if DATA_SIZE == 16
+ret = atomic16_cmpxchg(haddr, BSWAP(cmpv), BSWAP(newv));
+#else
 ret = atomic_cmpxchg__nocheck(haddr, BSWAP(cmpv), BSWAP(newv));
+#endif
 ATOMIC_MMU_CLEANUP;
 return BSWAP(ret);
 }
 
 #if DATA_SIZE >= 16
+#if HAVE_ATOMIC128
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
 ATOMIC_MMU_DECLS;
 DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
 
 ATOMIC_TRACE_LD;
-__atomic_load(haddr, &val, __ATOMIC_RELAXED);
+val = atomic16_read(haddr);
 ATOMIC_MMU_CLEANUP;
 return BSWAP(val);
 }
@@ -253,9 +264,10 @@ void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
 
 ATOMIC_TRACE_ST;
 val = BSWAP(val);
-__atomic_store(haddr, &val, __ATOMIC_RELAXED);
+atomic16_set(haddr, val);
 ATOMIC_MMU_CLEANUP;
 }
+#endif
 #else
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
ABI_TYPE val EXTRA_ARGS)
diff --git a/include/qemu/atomic128.h b/include/qemu/atomic128.h
new file mode 100644
index 00..fdea225132
--- /dev/null
+++ b/include/qemu/atomic128.h
@@ -0,0 +1,155 @@
+/*
+ * Simple interface for 128-bit atomic operations.
+ *
+ * Copyright (C) 2018 Linaro, Ltd.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ * See docs/devel/atomics.txt for discussion about the guarantees each
+ * atomic primitive is meant to provide.
+ */
+
+#ifndef QEMU_ATOMIC128_H
+#define QEMU_ATOMIC128_H
+
+/*
+ * GCC is a house divided about supporting large atomic operations.
+ *
+ * For hosts that only have large compare-and-swap, a legalistic reading
+ * of the C++ standard means that one cannot implement __atomic_read on
+ * read-only memory, and thus all atomic operations must synchronize
+ * through libatomic.
+ *
+ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80878
+ *
+ * This interpretation is not especially helpful for QEMU.
+ * For softmmu, all RAM is always read/write from the hypervisor.
+ * For user-only, if the guest doesn't implement such an __atomic_read
+ * then the host need not worry about it either.
+ *
+ * Moreover, using libatomic is not an option, because its interface is
+ * built for std::atomic, and requires that *all* accesses to such an
+ * object go through the library.  In our case we do not have an object
+ * in the C/C++ sense, but a view of memory as seen by the guest.
+ * The guest may issue a large atomic operation and then access those
+ * pieces using word-sized accesses.  From the hypervisor, we have no
+ * way to connect those two actions.
+ *
+ * Therefore, special case each platform.
+ */
+
+#if defined(CONFIG_ATOMIC128)
+static inline Int128 atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
+{
+return atomic_cmpxchg__nocheck(ptr, cmp, new);
+}
+# define HAVE_CMPXCHG128 1
+#elif defined(CONFIG_CMPXCHG

[Qemu-devel] [PATCH v3 34/38] vl: Fix exit status for -drive format=help

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
---
 vl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vl.c b/vl.c
index 22beca29d1..89520d8007 100644
--- a/vl.c
+++ b/vl.c
@@ -4397,7 +4397,7 @@ int main(int argc, char **argv, char **envp)
 if (qemu_opts_foreach(qemu_find_opts("drive"), drive_init_func,
   &machine_class->block_default_type, &error_fatal)) {
 /* We printed help */
-exit(1);
+exit(0);
 }
 
 default_drive(default_cdrom, snapshot, machine_class->block_default_type, 
2,
-- 
2.17.1

[Qemu-devel] [PATCH v3 06/38] vfio: Clean up error reporting after previous commit

[Markus Armbruster]

The previous commit changed vfio's warning messages from

vfio warning: DEV-NAME: Could not frobnicate

to

warning: vfio DEV-NAME: Could not frobnicate

To match this change, change error messages from

vfio error: DEV-NAME: On fire

to

vfio DEV-NAME: On fire

Note the loss of "error".  If we think marking error messages that way
is a good idea, we should mark *all* error messages, i.e. make
error_report() print it.

Cc: Alex Williamson 
Signed-off-by: Markus Armbruster 
Acked-by: Alex Williamson 
---
 hw/vfio/pci-quirks.c  | 4 ++--
 hw/vfio/pci.c | 8 
 hw/vfio/platform.c| 2 +-
 include/hw/vfio/vfio-common.h | 1 -
 4 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index 481fd08df7..eae31c74d6 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -1670,7 +1670,7 @@ static void vfio_probe_igd_bar4_quirk(VFIOPCIDevice 
*vdev, int nr)
  * but also no point in us enabling VGA if disabled in hardware.
  */
 if (!(gmch & 0x2) && !vdev->vga && vfio_populate_vga(vdev, &err)) {
-error_reportf_err(err, ERR_PREFIX, vdev->vbasedev.name);
+error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 error_report("IGD device %s failed to enable VGA access, "
  "legacy mode disabled", vdev->vbasedev.name);
 goto out;
@@ -1696,7 +1696,7 @@ static void vfio_probe_igd_bar4_quirk(VFIOPCIDevice 
*vdev, int nr)
 ret = vfio_pci_igd_opregion_init(vdev, opregion, &err);
 if (ret) {
 error_append_hint(&err, "IGD legacy mode disabled\n");
-error_reportf_err(err, ERR_PREFIX, vdev->vbasedev.name);
+error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 goto out;
 }
 
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 0c3d245932..5c7bd96984 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -745,7 +745,7 @@ static void vfio_msi_disable_common(VFIOPCIDevice *vdev)
 
 vfio_intx_enable(vdev, &err);
 if (err) {
-error_reportf_err(err, ERR_PREFIX, vdev->vbasedev.name);
+error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 }
 }
 
@@ -2196,7 +2196,7 @@ static void vfio_pci_post_reset(VFIOPCIDevice *vdev)
 
 vfio_intx_enable(vdev, &err);
 if (err) {
-error_reportf_err(err, ERR_PREFIX, vdev->vbasedev.name);
+error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 }
 
 for (nr = 0; nr < PCI_NUM_REGIONS - 1; ++nr) {
@@ -2830,7 +2830,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
 
 if (stat(vdev->vbasedev.sysfsdev, &st) < 0) {
 error_setg_errno(errp, errno, "no such host device");
-error_prepend(errp, ERR_PREFIX, vdev->vbasedev.sysfsdev);
+error_prepend(errp, VFIO_MSG_PREFIX, vdev->vbasedev.sysfsdev);
 return;
 }
 
@@ -3085,7 +3085,7 @@ out_teardown:
 vfio_teardown_msi(vdev);
 vfio_bars_exit(vdev);
 error:
-error_prepend(errp, ERR_PREFIX, vdev->vbasedev.name);
+error_prepend(errp, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 }
 
 static void vfio_instance_finalize(Object *obj)
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
index baf236ae79..398db38f14 100644
--- a/hw/vfio/platform.c
+++ b/hw/vfio/platform.c
@@ -690,7 +690,7 @@ out:
 }
 
 if (vdev->vbasedev.name) {
-error_prepend(errp, ERR_PREFIX, vdev->vbasedev.name);
+error_prepend(errp, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 } else {
 error_prepend(errp, "vfio error: ");
 }
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 1d7630345b..1b434d02f6 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -31,7 +31,6 @@
 #include 
 #endif
 
-#define ERR_PREFIX "vfio error: %s: "
 #define VFIO_MSG_PREFIX "vfio %s: "
 
 enum {
-- 
2.17.1

[Qemu-devel] [PATCH v3 35/38] vl: Simplify call of parse_name()

[Markus Armbruster]

main() checks for parse_name() failure even though it can't actually
fail.  That's okay.  Simplify it to check by passing &error_fatal,
like the other users of qemu_opts_foreach().

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
---
 vl.c | 6 ++
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/vl.c b/vl.c
index 89520d8007..01d71371c2 100644
--- a/vl.c
+++ b/vl.c
@@ -3973,10 +3973,8 @@ int main(int argc, char **argv, char **envp)
 }
 #endif
 
-if (qemu_opts_foreach(qemu_find_opts("name"),
-  parse_name, NULL, NULL)) {
-exit(1);
-}
+qemu_opts_foreach(qemu_find_opts("name"),
+  parse_name, NULL, &error_fatal);
 
 #ifndef _WIN32
 qemu_opts_foreach(qemu_find_opts("add-fd"),
-- 
2.17.1

[Qemu-devel] [PATCH v3 27/38] vnc: Clean up error reporting in vnc_init_func()

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  vnc_init_func() does that, and then fails without
setting an error.  Its caller main(), via qemu_opts_foreach(), is fine
with it, but clean it up anyway.

While there, drop a "Failed to start VNC server: " error message
prefix that doesn't really add value.

Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
---
 ui/vnc.c | 8 
 vl.c | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index 98e3d3b1d8..0c1b477425 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -4082,13 +4082,13 @@ int vnc_init_func(void *opaque, QemuOpts *opts, Error 
**errp)
 assert(id);
 vnc_display_init(id, &local_err);
 if (local_err) {
-error_report_err(local_err);
-exit(1);
+error_propagate(errp, local_err);
+return -1;
 }
 vnc_display_open(id, &local_err);
 if (local_err != NULL) {
-error_reportf_err(local_err, "Failed to start VNC server: ");
-exit(1);
+error_propagate(errp, local_err);
+return -1;
 }
 return 0;
 }
diff --git a/vl.c b/vl.c
index c053117028..8e0006d49c 100644
--- a/vl.c
+++ b/vl.c
@@ -4526,7 +4526,7 @@ int main(int argc, char **argv, char **envp)
 /* init remote displays */
 #ifdef CONFIG_VNC
 qemu_opts_foreach(qemu_find_opts("vnc"),
-  vnc_init_func, NULL, NULL);
+  vnc_init_func, NULL, &error_fatal);
 #endif
 
 if (using_spice) {
-- 
2.17.1

[Qemu-devel] [PATCH v3 03/38] block: Use warn_report() & friends to report warnings

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  Convert a few that are actually warnings to
warn_report().

While there, split warnings consisting of multiple sentences to
conform to conventions spelled out in warn_report()'s contract, and
improve a rather useless warning in sheepdog.c.

Cc: Kevin Wolf 
Cc: Ronnie Sahlberg 
Cc: Paolo Bonzini 
Cc: Peter Lieven 
Cc: Hitoshi Mitake 
Cc: Liu Yuan 
Signed-off-by: Markus Armbruster 
Reviewed-by: Eric Blake 
---
 block/bochs.c|  8 
 block/cloop.c|  8 
 block/dmg.c  |  8 
 block/iscsi.c|  2 +-
 block/rbd.c  | 12 ++--
 block/sheepdog.c |  2 +-
 block/vvfat.c|  8 
 7 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/block/bochs.c b/block/bochs.c
index 50c630047b..36c1b45bd2 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -112,10 +112,10 @@ static int bochs_open(BlockDriverState *bs, QDict 
*options, int flags,
 }
 
 if (!bdrv_is_read_only(bs)) {
-error_report("Opening bochs images without an explicit read-only=on "
- "option is deprecated. Future versions will refuse to "
- "open the image instead of automatically marking the "
- "image read-only.");
+warn_report("Opening bochs images without an explicit read-only=on "
+"option is deprecated");
+error_printf("Future versions may refuse to open the image "
+ "instead of automatically marking it read-only.\n");
 ret = bdrv_set_read_only(bs, true, errp); /* no write support yet */
 if (ret < 0) {
 return ret;
diff --git a/block/cloop.c b/block/cloop.c
index 2be68987bd..a558e67cb0 100644
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -74,10 +74,10 @@ static int cloop_open(BlockDriverState *bs, QDict *options, 
int flags,
 }
 
 if (!bdrv_is_read_only(bs)) {
-error_report("Opening cloop images without an explicit read-only=on "
- "option is deprecated. Future versions will refuse to "
- "open the image instead of automatically marking the "
- "image read-only.");
+warn_report("Opening cloop images without an explicit read-only=on "
+"option is deprecated");
+error_printf("Future versions may refuse to open the image "
+ "instead of automatically marking it read-only.\n");
 ret = bdrv_set_read_only(bs, true, errp);
 if (ret < 0) {
 return ret;
diff --git a/block/dmg.c b/block/dmg.c
index c9b3c519c4..9fb814460d 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -420,10 +420,10 @@ static int dmg_open(BlockDriverState *bs, QDict *options, 
int flags,
 }
 
 if (!bdrv_is_read_only(bs)) {
-error_report("Opening dmg images without an explicit read-only=on "
- "option is deprecated. Future versions will refuse to "
- "open the image instead of automatically marking the "
- "image read-only.");
+warn_report("Opening dmg images without an explicit read-only=on "
+"option is deprecated");
+error_printf("Future versions may refuse to open the image "
+ "instead of automatically marking it read-only.\n");
 ret = bdrv_set_read_only(bs, true, errp);
 if (ret < 0) {
 return ret;
diff --git a/block/iscsi.c b/block/iscsi.c
index bb69faf34a..73998c2860 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1844,7 +1844,7 @@ static int iscsi_open(BlockDriverState *bs, QDict 
*options, int flags,
 iscsi_set_timeout(iscsi, timeout);
 #else
 if (timeout) {
-error_report("iSCSI: ignoring timeout value for libiscsi <1.15.0");
+warn_report("iSCSI: ignoring timeout value for libiscsi <1.15.0");
 }
 #endif
 
diff --git a/block/rbd.c b/block/rbd.c
index 014c68d629..6e26bac170 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -750,8 +750,8 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict 
*options, int flags,
 /* Take care whenever deciding to actually deprecate; once this ability
  * is removed, we will not be able to open any images with 
legacy-styled
  * backing image strings. */
-error_report("RBD options encoded in the filename as keyvalue pairs "
- "is deprecated");
+warn_report("RBD options encoded in the filename as keyvalue pairs "
+"is deprecated");
 }
 
 /* Remove the processed options from the QDict (the visitor processes
@@ -781,10 +781,10 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict 
*options, int flags,
  * leave as-is */
 if (s->snap != NULL) {
 if (!bdrv_is_read_only(bs)) {
-error_report("Opening rbd snapshots without an explicit "
- "read-only=on option is deprecated. Future versions

[Qemu-devel] [PATCH v3 30/38] spice: Clean up error reporting in add_channel()

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  add_channel() does that, and then exit()s.  Its caller
main(), via qemu_opts_foreach(), is fine with it, but clean it up
anyway.

Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
Reviewed-by: Marc-André Lureau 
---
 ui/spice-core.c | 13 +++--
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/ui/spice-core.c b/ui/spice-core.c
index a4fbbc3898..ebaae24643 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -597,9 +597,9 @@ static int add_channel(void *opaque, const char *name, 
const char *value,
 if (strcmp(name, "tls-channel") == 0) {
 int *tls_port = opaque;
 if (!*tls_port) {
-error_report("spice: tried to setup tls-channel"
- " without specifying a TLS port");
-exit(1);
+error_setg(errp, "spice: tried to setup tls-channel"
+   " without specifying a TLS port");
+return -1;
 }
 security = SPICE_CHANNEL_SECURITY_SSL;
 }
@@ -615,8 +615,9 @@ static int add_channel(void *opaque, const char *name, 
const char *value,
 rc = spice_server_set_channel_security(spice_server, value, security);
 }
 if (rc != 0) {
-error_report("spice: failed to set channel security for %s", value);
-exit(1);
+error_setg(errp, "spice: failed to set channel security for %s",
+   value);
+return -1;
 }
 return 0;
 }
@@ -787,7 +788,7 @@ void qemu_spice_init(void)
 spice_server_set_playback_compression
 (spice_server, qemu_opt_get_bool(opts, "playback-compression", 1));
 
-qemu_opt_foreach(opts, add_channel, &tls_port, NULL);
+qemu_opt_foreach(opts, add_channel, &tls_port, &error_fatal);
 
 spice_server_set_name(spice_server, qemu_name);
 spice_server_set_uuid(spice_server, (unsigned char *)&qemu_uuid);
-- 
2.17.1

[Qemu-devel] [PATCH v3 24/38] vl: Clean up error reporting in device_init_func()

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  device_init_func() does that, and then fails without
setting an error.  Its caller main(), via qemu_opts_foreach(), is fine
with it, but clean it up anyway.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
---
 vl.c | 10 +++---
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/vl.c b/vl.c
index c5bc54f72b..c053117028 100644
--- a/vl.c
+++ b/vl.c
@@ -,12 +,10 @@ static int device_help_func(void *opaque, QemuOpts 
*opts, Error **errp)
 
 static int device_init_func(void *opaque, QemuOpts *opts, Error **errp)
 {
-Error *err = NULL;
 DeviceState *dev;
 
-dev = qdev_device_add(opts, &err);
+dev = qdev_device_add(opts, errp);
 if (!dev) {
-error_report_err(err);
 return -1;
 }
 object_unref(OBJECT(dev));
@@ -4491,10 +4489,8 @@ int main(int argc, char **argv, char **envp)
 
 /* init generic devices */
 rom_set_order_override(FW_CFG_ORDER_OVERRIDE_DEVICE);
-if (qemu_opts_foreach(qemu_find_opts("device"),
-  device_init_func, NULL, NULL)) {
-exit(1);
-}
+qemu_opts_foreach(qemu_find_opts("device"),
+  device_init_func, NULL, &error_fatal);
 
 cpu_synchronize_all_post_init();
 
-- 
2.17.1

[Qemu-devel] [PATCH v3 36/38] block: Clean up bdrv_img_create()'s error reporting

[Markus Armbruster]

bdrv_img_create() takes an Error ** argument and uses it in the
conventional way, except for one place: when qemu_opts_do_parse()
fails, it first reports its error to stderr or the HMP monitor with
error_report_err(), then error_setg()'s a generic error.

When the caller reports that second error similarly, this produces two
consecutive error messages on stderr or the HMP monitor.

When the caller does something else with it, such as send it via QMP,
the first error still goes to stderr or the HMP monitor.  Fortunately,
no such caller exists.

Simply use the first error as is.

Signed-off-by: Markus Armbruster 
---
 block.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/block.c b/block.c
index 5d51419d21..08d64cdc61 100644
--- a/block.c
+++ b/block.c
@@ -4803,9 +4803,6 @@ void bdrv_img_create(const char *filename, const char 
*fmt,
 if (options) {
 qemu_opts_do_parse(opts, options, NULL, &local_err);
 if (local_err) {
-error_report_err(local_err);
-local_err = NULL;
-error_setg(errp, "Invalid options for file format '%s'", fmt);
 goto out;
 }
 }
-- 
2.17.1

[Qemu-devel] [PATCH v3 15/38] numa: Fix QMP command set-numa-node error handling

[Markus Armbruster]

Calling error_report() in a function that takes an Error ** argument
is suspicious.  parse_numa_node() does that, and then exit()s.  It
also passes &error_fatal to machine_set_cpu_numa_node().  Both wrong.
Attempting to configure numa when the machine doesn't support it kills
the VM:

$ qemu-system-x86_64 -nodefaults -S -display none -M none -preconfig -qmp 
stdio
{"QMP": {"version": {"qemu": {"micro": 50, "minor": 0, "major": 3}, 
"package": "v3.0.0-837-gc5e4e49258"}, "capabilities": []}}
{"execute": "qmp_capabilities"}
{"return": {}}
{"execute": "set-numa-node", "arguments": {"type": "node"}}
NUMA is not supported by this machine-type
$ echo $?
1

Messed up when commit 64c2a8f6d3f and 7c88e65d9e9 (v2.10.0) added
incorrect error handling right next to correct examples.  Latent bug
until commit f3be67812c2 (v3.0.0) made it accessible via QMP.  Fairly
harmless in practice, because it's limited to RUN_STATE_PRECONFIG.
The fix is obvious: replace error_report(); exit() by error_setg();
return.

This affects parse_numa_node()'s other caller
numa_complete_configuration(): since it ignores errors, the "NUMA is
not supported by this machine-type" is now ignored, too.  But that
error is as unexpected there as any other.  Change it to abort on
error instead.

Fixes: f3be67812c226162f86ce92634bd913714445420
Cc: Igor Mammedov 
Signed-off-by: Markus Armbruster 
Reviewed-by: Igor Mammedov 
---
 numa.c | 13 +
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/numa.c b/numa.c
index 81542d4ebb..1d7c49ad43 100644
--- a/numa.c
+++ b/numa.c
@@ -60,6 +60,7 @@ NodeInfo numa_info[MAX_NODES];
 static void parse_numa_node(MachineState *ms, NumaNodeOptions *node,
 Error **errp)
 {
+Error *err = NULL;
 uint16_t nodenr;
 uint16List *cpus = NULL;
 MachineClass *mc = MACHINE_GET_CLASS(ms);
@@ -82,8 +83,8 @@ static void parse_numa_node(MachineState *ms, NumaNodeOptions 
*node,
 }
 
 if (!mc->cpu_index_to_instance_props || !mc->get_default_cpu_node_id) {
-error_report("NUMA is not supported by this machine-type");
-exit(1);
+error_setg(errp, "NUMA is not supported by this machine-type");
+return;
 }
 for (cpus = node->cpus; cpus; cpus = cpus->next) {
 CpuInstanceProperties props;
@@ -97,7 +98,11 @@ static void parse_numa_node(MachineState *ms, 
NumaNodeOptions *node,
 props = mc->cpu_index_to_instance_props(ms, cpus->value);
 props.node_id = nodenr;
 props.has_node_id = true;
-machine_set_cpu_numa_node(ms, &props, &error_fatal);
+machine_set_cpu_numa_node(ms, &props, &err);
+if (err) {
+error_propagate(errp, err);
+return;
+}
 }
 
 if (node->has_mem && node->has_memdev) {
@@ -367,7 +372,7 @@ void numa_complete_configuration(MachineState *ms)
 if (ms->ram_slots > 0 && nb_numa_nodes == 0 &&
 mc->auto_enable_numa_with_memhp) {
 NumaNodeOptions node = { };
-parse_numa_node(ms, &node, NULL);
+parse_numa_node(ms, &node, &error_abort);
 }
 
 assert(max_numa_nodeid <= MAX_NODES);
-- 
2.17.1

[Qemu-devel] [PATCH v3 37/38] raw: Convert a warning to warn_report()

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
---
 block/raw-format.c | 17 +
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/block/raw-format.c b/block/raw-format.c
index 6f6dc99b2c..d65fd0ffce 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -29,6 +29,7 @@
 #include "qemu/osdep.h"
 #include "block/block_int.h"
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 #include "qemu/option.h"
 
 typedef struct BDRVRawState {
@@ -436,14 +437,14 @@ static int raw_open(BlockDriverState *bs, QDict *options, 
int flags,
 bs->file->bs->supported_zero_flags);
 
 if (bs->probed && !bdrv_is_read_only(bs)) {
-fprintf(stderr,
-"WARNING: Image format was not specified for '%s' and probing "
-"guessed raw.\n"
-" Automatically detecting the format is dangerous for "
-"raw images, write operations on block 0 will be restricted.\n"
-" Specify the 'raw' format explicitly to remove the "
-"restrictions.\n",
-bs->file->bs->filename);
+warn_report("Image format was not specified for '%s' and probing "
+"guessed raw",
+bs->file->bs->filename);
+error_printf("Automatically detecting the format is dangerous for "
+ "raw images, write\n"
+ "operations on block 0 will be restricted.\n"
+ "Specify the 'raw' format explicitly to remove the "
+ "restrictions.\n");
 }
 
 ret = raw_read_options(options, bs, s, errp);
-- 
2.17.1