Re: Questionable aspects of QEMU Error's design

2020-04-27 Thread Vladimir Sementsov-Ogievskiy

27.04.2020 18:36, Markus Armbruster wrote:

Markus Armbruster  writes:


Markus Armbruster  writes:


QEMU's Error was patterned after GLib's GError.  Differences include:

[...]

* Return value conventions

   Common: non-void functions return a distinct error value on failure
   when such a value can be defined.  Patterns:

   - Functions returning non-null pointers on success return null pointer
 on failure.

   - Functions returning non-negative integers on success return a
 negative error code on failure.

   Different: GLib discourages void functions, because these lead to
   awkward error checking code.  We have tons of them, and tons of
   awkward error checking code:

 Error *err = NULL;
 frobnicate(arg, );
 if (err) {
 ... recover ...
 error_propagate(errp, err);
 }

   instead of

 if (!frobnicate(arg, errp))
 ... recover ...
 }

   Can also lead to pointless creation of Error objects.

   I consider this a design mistake.  Can we still fix it?  We have more
   than 2000 void functions taking an Error ** parameter...

   Transforming code that receives and checks for errors with Coccinelle
   shouldn't be hard.  Transforming code that returns errors seems more
   difficult.  We need to transform explicit and implicit return to
   either return true or return false, depending on what we did to the
   @errp parameter on the way to the return.  Hmm.

[...]

To figure out what functions with an Error ** parameter return, I used
Coccinelle to find such function definitions and print the return types.
Summary of results:

2155 void
 873 signed integer
 494 pointer
 153 bool
  33 unsigned integer
   6 enum
-
3714 total

I then used Coccinelle to find checked calls of void functions (passing
_fatal or _abort is not considered "checking" here).  These
calls become simpler if we make the functions return a useful value.  I
found a bit under 600 direct calls, and some 50 indirect calls.

Most frequent direct calls:

 127 object_property_set_bool
  27 qemu_opts_absorb_qdict
  16 visit_type_str
  14 visit_type_int
  10 visit_type_uint32

Let's have a closer look at object_property_set() & friends.  Out of
almost 1000 calls, some 150 are checked.  While I'm sure many of the
unchecked calls can't actually fail, I am concerned some unchecked calls
can.

If we adopt the convention to return a value that indicates success /
failure, we should consider converting object.h to it sooner rather than
later.

Please understand these are rough numbers from quick & dirty scripts.


FYI, I'm working on converting QemuOpts, QAPI visitors and QOM.  I keep
running into bugs.  So far:

 [PATCH v2 for-5.1 0/9] qemu-option: Fix corner cases and clean up
 [PATCH for-5.1 0/5] qobject: Minor spring cleaning
 [PATCH v2 00/14] Miscellaneous error handling fixes
 [PATCH 0/4] Subject: [PATCH 0/4] smbus: SPD fixes
 [PATCH 0/3] fuzz: Probably there is a better way to do this
 [PATCH v2 00/15] qapi: Spring cleaning
 [PATCH 00/11] More miscellaneous error handling fixes

I got another one coming for QOM and qdev before I can post the
conversion.

Vladimir, since the conversion will mess with error_propagate(), I'd
like to get it in before your auto-propagation work.



OK, just let me know when to regenerate the series, it's not hard.

--
Best regards,
Vladimir



Re: [PATCH v4 0/7] dwc-hsotg (aka dwc2) USB host controller emulation

2020-04-27 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20200428022232.18875-1-pauld...@gmail.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Subject: [PATCH v4 0/7] dwc-hsotg (aka dwc2) USB host controller emulation
Message-id: 20200428022232.18875-1-pauld...@gmail.com
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
7e9c355 raspi2 acceptance test: add test for dwc-hsotg (dwc2) USB host
7810c04 wire in the dwc-hsotg (dwc2) USB host controller emulation
d3304bb usb: add short-packet handling to usb-storage driver
5b9f15d dwc-hsotg (dwc2) USB host controller emulation
b0e11f4 dwc-hsotg (dwc2) USB host controller state definitions
9dfd325 dwc-hsotg (dwc2) USB host controller register definitions
4b2f1ec raspi: add BCM2835 SOC MPHI emulation

=== OUTPUT BEGIN ===
1/7 Checking commit 4b2f1ec1b069 (raspi: add BCM2835 SOC MPHI emulation)
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#63: 
new file mode 100644

total: 0 errors, 1 warnings, 288 lines checked

Patch 1/7 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
2/7 Checking commit 9dfd32515a0c (dwc-hsotg (dwc2) USB host controller register 
definitions)
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#16: 
new file mode 100644

WARNING: architecture specific defines should be avoided
#58: FILE: include/hw/usb/dwc2-regs.h:38:
+#ifndef __DWC2_HW_H__

ERROR: code indent should never use tabs
#61: FILE: include/hw/usb/dwc2-regs.h:41:
+#define HSOTG_REG(x)^I(x)$

ERROR: code indent should never use tabs
#63: FILE: include/hw/usb/dwc2-regs.h:43:
+#define GOTGCTL^I^I^I^IHSOTG_REG(0x000)$

ERROR: code indent should never use tabs
#64: FILE: include/hw/usb/dwc2-regs.h:44:
+#define GOTGCTL_CHIRPEN^I^I^IBIT(27)$

ERROR: code indent should never use tabs
#65: FILE: include/hw/usb/dwc2-regs.h:45:
+#define GOTGCTL_MULT_VALID_BC_MASK^I(0x1f << 22)$

ERROR: code indent should never use tabs
#66: FILE: include/hw/usb/dwc2-regs.h:46:
+#define GOTGCTL_MULT_VALID_BC_SHIFT^I22$

ERROR: code indent should never use tabs
#67: FILE: include/hw/usb/dwc2-regs.h:47:
+#define GOTGCTL_OTGVER^I^I^IBIT(20)$

ERROR: code indent should never use tabs
#68: FILE: include/hw/usb/dwc2-regs.h:48:
+#define GOTGCTL_BSESVLD^I^I^IBIT(19)$

ERROR: code indent should never use tabs
#69: FILE: include/hw/usb/dwc2-regs.h:49:
+#define GOTGCTL_ASESVLD^I^I^IBIT(18)$

ERROR: code indent should never use tabs
#70: FILE: include/hw/usb/dwc2-regs.h:50:
+#define GOTGCTL_DBNC_SHORT^I^IBIT(17)$

ERROR: code indent should never use tabs
#71: FILE: include/hw/usb/dwc2-regs.h:51:
+#define GOTGCTL_CONID_B^I^I^IBIT(16)$

ERROR: code indent should never use tabs
#72: FILE: include/hw/usb/dwc2-regs.h:52:
+#define GOTGCTL_DBNCE_FLTR_BYPASS^IBIT(15)$

ERROR: code indent should never use tabs
#73: FILE: include/hw/usb/dwc2-regs.h:53:
+#define GOTGCTL_DEVHNPEN^I^IBIT(11)$

ERROR: code indent should never use tabs
#74: FILE: include/hw/usb/dwc2-regs.h:54:
+#define GOTGCTL_HSTSETHNPEN^I^IBIT(10)$

ERROR: code indent should never use tabs
#75: FILE: include/hw/usb/dwc2-regs.h:55:
+#define GOTGCTL_HNPREQ^I^I^IBIT(9)$

ERROR: code indent should never use tabs
#76: FILE: include/hw/usb/dwc2-regs.h:56:
+#define GOTGCTL_HSTNEGSCS^I^IBIT(8)$

ERROR: code indent should never use tabs
#77: FILE: include/hw/usb/dwc2-regs.h:57:
+#define GOTGCTL_SESREQ^I^I^IBIT(1)$

ERROR: code indent should never use tabs
#78: FILE: include/hw/usb/dwc2-regs.h:58:
+#define GOTGCTL_SESREQSCS^I^IBIT(0)$

ERROR: code indent should never use tabs
#80: FILE: include/hw/usb/dwc2-regs.h:60:
+#define GOTGINT^I^I^I^IHSOTG_REG(0x004)$

ERROR: code indent should never use tabs
#81: FILE: include/hw/usb/dwc2-regs.h:61:
+#define GOTGINT_DBNCE_DONE^I^IBIT(19)$

ERROR: code indent should never use tabs
#82: FILE: include/hw/usb/dwc2-regs.h:62:
+#define GOTGINT_A_DEV_TOUT_CHG^I^IBIT(18)$

ERROR: code indent should never use tabs
#83: FILE: include/hw/usb/dwc2-regs.h:63:
+#define GOTGINT_HST_NEG_DET^I^IBIT(17)$

ERROR: code indent should never use tabs
#84: FILE: include/hw/usb/dwc2-regs.h:64:
+#define GOTGINT_HST_NEG_SUC_STS_CHNG^IBIT(9)$

ERROR: code indent should never use tabs
#85: FILE: include/hw/usb/dwc2-regs.h:65:
+#define GOTGINT_SES_REQ_SUC_STS_CHNG^IBIT(8)$

ERROR: code indent should never use tabs
#86: FILE: include/hw/usb/dwc2-regs.h:66:
+#define GOTGINT_SES_END_DET^I^IBIT(2)$

ERROR: code indent should never use tabs
#88: FILE: include/hw/usb/dwc2-regs.h:68:
+#define GAHBCFG^I^I^I^IHSOTG_REG(0x008)$

ERROR: code indent should never use tabs
#89: FILE: 

Re: [PATCH] hax: Dynamic allocate vcpu state structure

2020-04-27 Thread Colin Xu



And this one. 3 patches for HAX.

Thanks in advance.
--
Best Regards,
Colin Xu

On Mon, 20 Apr 2020, Colin Xu wrote:



Looks good to me.

Reviewed-by: Colin Xu 

--
Best Regards,
Colin Xu

On Mon, 6 Apr 2020, WangBowen wrote:


Dynamic allocating vcpu state structure according to smp value to be
more precise and safe. Previously it will alloccate array of fixed size
HAX_MAX_VCPU.

This is achieved by using g_new0 to dynamic allocate the array. The
allocated size is obtained from smp.max_cpus in MachineState. Also, the
size is compared with HAX_MAX_VCPU when creating the vm. The reason for
choosing dynamic array over linked list is because the status is visited
by index all the time.

This will lead to QEMU checking whether the smp value is larger than the
HAX_MAX_VCPU when creating vm, if larger, the process will terminate,
otherwise it will allocate array of size smp to store the status.

Signed-off-by: WangBowen 
---
target/i386/hax-all.c  | 25 +++--
target/i386/hax-i386.h |  5 +++--
2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/target/i386/hax-all.c b/target/i386/hax-all.c
index a8b6e5aeb8..a22adec5da 100644
--- a/target/i386/hax-all.c
+++ b/target/i386/hax-all.c
@@ -232,10 +232,10 @@ int hax_init_vcpu(CPUState *cpu)
return ret;
}

-struct hax_vm *hax_vm_create(struct hax_state *hax)
+struct hax_vm *hax_vm_create(struct hax_state *hax, int max_cpus)
{
struct hax_vm *vm;
-int vm_id = 0, ret;
+int vm_id = 0, ret, i;

if (hax_invalid_fd(hax->fd)) {
return NULL;
@@ -259,6 +259,17 @@ struct hax_vm *hax_vm_create(struct hax_state *hax)
goto error;
}

+if (max_cpus > HAX_MAX_VCPU) {
+fprintf(stderr, "Maximum VCPU number QEMU supported is %d\n", 
HAX_MAX_VCPU);

+goto error;
+}
+
+vm->numvcpus = max_cpus;
+vm->vcpus = g_new0(struct hax_vcpu_state *, vm->numvcpus);
+for (i = 0; i < vm->numvcpus; i++) {
+vm->vcpus[i] = NULL;
+}
+
hax->vm = vm;
return vm;

@@ -272,12 +283,14 @@ int hax_vm_destroy(struct hax_vm *vm)
{
int i;

-for (i = 0; i < HAX_MAX_VCPU; i++)
+for (i = 0; i < vm->numvcpus; i++)
if (vm->vcpus[i]) {
fprintf(stderr, "VCPU should be cleaned before vm clean\n");
return -1;
}
hax_close_fd(vm->fd);
+vm->numvcpus = 0;
+g_free(vm->vcpus);
g_free(vm);
hax_global.vm = NULL;
return 0;
@@ -292,7 +305,7 @@ static void hax_handle_interrupt(CPUState *cpu, int 
mask)

}
}

-static int hax_init(ram_addr_t ram_size)
+static int hax_init(ram_addr_t ram_size, int max_cpus)
{
struct hax_state *hax = NULL;
struct hax_qemu_version qversion;
@@ -324,7 +337,7 @@ static int hax_init(ram_addr_t ram_size)
goto error;
}

-hax->vm = hax_vm_create(hax);
+hax->vm = hax_vm_create(hax, max_cpus);
if (!hax->vm) {
fprintf(stderr, "Failed to create HAX VM\n");
ret = -EINVAL;
@@ -352,7 +365,7 @@ static int hax_init(ram_addr_t ram_size)

static int hax_accel_init(MachineState *ms)
{
-int ret = hax_init(ms->ram_size);
+int ret = hax_init(ms->ram_size, (int)ms->smp.max_cpus);

if (ret && (ret != -ENOSPC)) {
fprintf(stderr, "No accelerator found.\n");
diff --git a/target/i386/hax-i386.h b/target/i386/hax-i386.h
index 54e9d8b057..7d988f81da 100644
--- a/target/i386/hax-i386.h
+++ b/target/i386/hax-i386.h
@@ -47,7 +47,8 @@ struct hax_state {
struct hax_vm {
hax_fd fd;
int id;
-struct hax_vcpu_state *vcpus[HAX_MAX_VCPU];
+int numvcpus;
+struct hax_vcpu_state **vcpus;
};

#ifdef NEED_CPU_H
@@ -58,7 +59,7 @@ int valid_hax_tunnel_size(uint16_t size);
/* Host specific functions */
int hax_mod_version(struct hax_state *hax, struct hax_module_version 
*version);

int hax_inject_interrupt(CPUArchState *env, int vector);
-struct hax_vm *hax_vm_create(struct hax_state *hax);
+struct hax_vm *hax_vm_create(struct hax_state *hax, int max_cpus);
int hax_vcpu_run(struct hax_vcpu_state *vcpu);
int hax_vcpu_create(int id);
int hax_sync_vcpu_state(CPUArchState *env, struct vcpu_state_t *state,
--
2.24.1








Re: [PATCH] hax: Add hax max vcpu IOCTL and support 64 vcpu

2020-04-27 Thread Colin Xu

Hi Paolo,

Would you also help queue this one for PULL?

--
Best Regards,
Colin Xu

On Mon, 20 Apr 2020, Colin Xu wrote:


Looks good to me.

Reviewed-by: Colin Xu 

--
Best Regards,
Colin Xu

On Fri, 10 Apr 2020, WangBowen wrote:


This commit tried to obtain max vcpu of haxm driver by calling
HAX_IOCTL_CAP_MAX_VCPU before creating the vm so that if using hax as
the accelerator and the smp value is larger than the haxm driver
supported max value, the program will terminate. Previously, it will
create vm and vcpu one by one until haxm reports error. Also, the
maximum vcpu value in qemu for haxm is updated from 0x10 to 0x40 in
hax-i386.h.

This patch resolves the issue by calling hax device ioctl
HAX_IOCTL_CAP_MAX_VCPU in hax_init and store the min(haxm max, qemu max)
in hax_state structure. The value will be compared with smp value in
vm_create. (ioctl naming credit to KVM)

This commit results in if ioctl doesn't exist or occur error, it will
continue running but output warning, if smp value is larger than the
min(hax max,qemu max), it will terminate and output error message.

Signed-off-by: WangBowen 
---
target/i386/hax-all.c |  7 +--
target/i386/hax-i386.h|  4 +++-
target/i386/hax-posix.c   | 29 +
target/i386/hax-posix.h   |  1 +
target/i386/hax-windows.c | 32 
target/i386/hax-windows.h |  2 ++
6 files changed, 72 insertions(+), 3 deletions(-)

diff --git a/target/i386/hax-all.c b/target/i386/hax-all.c
index a22adec5da..eadfa7c881 100644
--- a/target/i386/hax-all.c
+++ b/target/i386/hax-all.c
@@ -259,8 +259,9 @@ struct hax_vm *hax_vm_create(struct hax_state *hax, int 
max_cpus)

goto error;
}

-if (max_cpus > HAX_MAX_VCPU) {
-fprintf(stderr, "Maximum VCPU number QEMU supported is %d\n", 
HAX_MAX_VCPU);

+if (max_cpus > hax->hax_max_vcpu) {
+fprintf(stderr, "Maximum VCPU number QEMU and HAXM driver 
supported is %d\n",

+hax->hax_max_vcpu);
goto error;
}

@@ -332,6 +333,8 @@ static int hax_init(ram_addr_t ram_size, int max_cpus)
goto error;
}

+hax->hax_max_vcpu = hax_max_vcpus_support(hax);
+
if (!hax_version_support(hax)) {
ret = -EINVAL;
goto error;
diff --git a/target/i386/hax-i386.h b/target/i386/hax-i386.h
index 7d988f81da..1ffa8df63a 100644
--- a/target/i386/hax-i386.h
+++ b/target/i386/hax-i386.h
@@ -38,9 +38,10 @@ struct hax_state {
struct hax_vm *vm;
uint64_t mem_quota;
bool supports_64bit_ramblock;
+int hax_max_vcpu;
};

-#define HAX_MAX_VCPU 0x10
+#define HAX_MAX_VCPU 0x40
#define MAX_VM_ID 0x40
#define MAX_VCPU_ID 0x40

@@ -74,6 +75,7 @@ int hax_notify_qemu_version(hax_fd vm_fd, struct 
hax_qemu_version *qversion);
int hax_set_ram(uint64_t start_pa, uint32_t size, uint64_t host_va, int 
flags);


/* Common host function */
+int hax_max_vcpus_support(struct hax_state *hax);
int hax_host_create_vm(struct hax_state *hax, int *vm_id);
hax_fd hax_host_open_vm(struct hax_state *hax, int vm_id);
int hax_host_create_vcpu(hax_fd vm_fd, int vcpuid);
diff --git a/target/i386/hax-posix.c b/target/i386/hax-posix.c
index a5426a6dac..a4f9dce55e 100644
--- a/target/i386/hax-posix.c
+++ b/target/i386/hax-posix.c
@@ -163,6 +163,35 @@ int hax_host_create_vm(struct hax_state *hax, int 
*vmid)

return ret;
}

+int hax_max_vcpus_support(struct hax_state *hax)
+{
+int ret;
+int vcpu_num = 0;
+
+if (hax_invalid_fd(hax->fd)) {
+return vcpu_num;
+}
+
+ret = ioctl(hax->fd, HAX_IOCTL_CAP_MAX_VCPU, _num);
+
+if (ret == 0 && vcpu_num > 0) {
+if (vcpu_num != HAX_MAX_VCPU) {
+fprintf(stderr, "Warning: HAXM driver and QEMU are 
inconsistent"

+" in max vcpu number, HAXM driver: %d, QEMU: %d,"
+" refers to the smaller one.\n", vcpu_num, 
HAX_MAX_VCPU);

+if (vcpu_num > HAX_MAX_VCPU) {
+vcpu_num = HAX_MAX_VCPU;
+}
+}
+} else {
+vcpu_num = HAX_MAX_VCPU;
+fprintf(stderr, "Warning: HAXM driver doesn't support 
HAX_IOCTL_CAP_MAX_VCPU,"

+" will refer to max value defined in QEMU\n");
+}
+
+return vcpu_num;
+}
+
hax_fd hax_host_open_vm(struct hax_state *hax, int vm_id)
{
hax_fd fd;
diff --git a/target/i386/hax-posix.h b/target/i386/hax-posix.h
index fb7c64426d..42e58f6fa5 100644
--- a/target/i386/hax-posix.h
+++ b/target/i386/hax-posix.h
@@ -38,6 +38,7 @@ static inline void hax_close_fd(hax_fd fd)
#define HAX_IOCTL_CREATE_VM _IOWR(0, 0x21, uint32_t)
#define HAX_IOCTL_DESTROY_VM _IOW(0, 0x22, uint32_t)
#define HAX_IOCTL_CAPABILITY _IOR(0, 0x23, struct hax_capabilityinfo)
+#define HAX_IOCTL_CAP_MAX_VCPU _IOR(0, 0x25, uint32_t)

#define HAX_VM_IOCTL_VCPU_CREATE _IOWR(0, 0x80, uint32_t)
#define HAX_VM_IOCTL_ALLOC_RAM _IOWR(0, 0x81, struct hax_alloc_ram_info)
diff --git a/target/i386/hax-windows.c b/target/i386/hax-windows.c
index 5729ad9b48..c7816e1950 100644

Re: [PATCH v2] [Qemu-devel] target/i386: HAX: Enable ROM/ROM device memory region support

2020-04-27 Thread Colin Xu



Hi Paolo,

Would you please queue this one?
--
Best Regards,
Colin Xu

On Mon, 30 Mar 2020, Colin Xu wrote:


Looks good to me.

Reviewed-by: Colin Xu 

On 2020-03-30 11:25, hang.y...@linux.intel.com wrote:

From: Hang Yuan 

Add ROM and ROM device memory region support in HAX. Their memory region is
read only and write access will generate EPT violation. The violation will be
handled in the HAX kernel with the following patch.

https://github.com/intel/haxm/commit/33ceea09a1655fca12c47f1e112b1d269357ff28

v2: fix coding style problems

Signed-off-by: Hang Yuan 
---
  target/i386/hax-mem.c | 11 ---
  1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/target/i386/hax-mem.c b/target/i386/hax-mem.c
index 6bb5a24917..a8bfd37977 100644
--- a/target/i386/hax-mem.c
+++ b/target/i386/hax-mem.c
@@ -175,13 +175,10 @@ static void hax_process_section(MemoryRegionSection 
*section, uint8_t flags)
  uint64_t host_va;
  uint32_t max_mapping_size;

-/* We only care about RAM and ROM regions */
-if (!memory_region_is_ram(mr)) {
-if (memory_region_is_romd(mr)) {
-/* HAXM kernel module does not support ROMD yet  */
-warn_report("Ignoring ROMD region 0x%016" PRIx64 "->0x%016" PRIx64,
-start_pa, start_pa + size);
-}
+/* We only care about RAM/ROM regions and ROM device */
+if (memory_region_is_rom(mr) || (memory_region_is_romd(mr))) {
+flags |= HAX_RAM_INFO_ROM;
+} else if (!memory_region_is_ram(mr)) {
  return;
  }



--
Best Regards,
Colin Xu







Re: [PATCH 0/3] account for NVDIMM nodes during SRAT generation

2020-04-27 Thread no-reply
Patchew URL: 
https://patchew.org/QEMU/20200428012810.10877-1-vishal.l.ve...@intel.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Subject: [PATCH 0/3] account for NVDIMM nodes during SRAT generation
Message-id: 20200428012810.10877-1-vishal.l.ve...@intel.com
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Switched to a new branch 'test'
34c59d3 tests/acpi: update expected SRAT files
dcc96eb hw/acpi-build: account for NVDIMM numa nodes in SRAT
08b7ee5 diffs-allowed: add the SRAT AML to diffs-allowed

=== OUTPUT BEGIN ===
1/3 Checking commit 08b7ee5e7ddf (diffs-allowed: add the SRAT AML to 
diffs-allowed)
2/3 Checking commit dcc96eb97d46 (hw/acpi-build: account for NVDIMM numa nodes 
in SRAT)
ERROR: Do not add expected files together with tests, follow instructions in 
tests/qtest/bios-tables-test.c: both 
tests/qtest/bios-tables-test-allowed-diff.h and hw/i386/acpi-build.c found

ERROR: Do not add expected files together with tests, follow instructions in 
tests/qtest/bios-tables-test.c: both 
tests/qtest/bios-tables-test-allowed-diff.h and hw/i386/acpi-build.c found

total: 2 errors, 0 warnings, 32 lines checked

Patch 2/3 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

3/3 Checking commit 34c59d3a0232 (tests/acpi: update expected SRAT files)
ERROR: Do not add expected files together with tests, follow instructions in 
tests/qtest/bios-tables-test.c: both tests/data/acpi/pc/SRAT.dimmpxm and 
hw/i386/acpi-build.c found

ERROR: Do not add expected files together with tests, follow instructions in 
tests/qtest/bios-tables-test.c: both tests/data/acpi/q35/SRAT.dimmpxm and 
hw/i386/acpi-build.c found

ERROR: Do not add expected files together with tests, follow instructions in 
tests/qtest/bios-tables-test.c: both 
tests/qtest/bios-tables-test-allowed-diff.h and hw/i386/acpi-build.c found

ERROR: Do not add expected files together with tests, follow instructions in 
tests/qtest/bios-tables-test.c: both 
tests/qtest/bios-tables-test-allowed-diff.h and hw/i386/acpi-build.c found

total: 4 errors, 0 warnings, 1 lines checked

Patch 3/3 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20200428012810.10877-1-vishal.l.ve...@intel.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

[PATCH v4 5/7] usb: add short-packet handling to usb-storage driver

2020-04-27 Thread Paul Zimmerman
The dwc-hsotg (dwc2) USB host depends on a short packet to
indicate the end of an IN transfer. The usb-storage driver
currently doesn't provide this, so fix it.

I have tested this change rather extensively using a PC
emulation with xhci, ehci, and uhci controllers, and have
not observed any regressions.

Signed-off-by: Paul Zimmerman 
---
 hw/usb/dev-storage.c | 15 ++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 5c4b57b06b..ae3c550042 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -229,6 +229,9 @@ static void usb_msd_copy_data(MSDState *s, USBPacket *p)
 usb_packet_copy(p, scsi_req_get_buf(s->req) + s->scsi_off, len);
 s->scsi_len -= len;
 s->scsi_off += len;
+if (len > s->data_len) {
+len = s->data_len;
+}
 s->data_len -= len;
 if (s->scsi_len == 0 || s->data_len == 0) {
 scsi_req_continue(s->req);
@@ -303,6 +306,9 @@ static void usb_msd_command_complete(SCSIRequest *req, 
uint32_t status, size_t r
 if (s->data_len) {
 int len = (p->iov.size - p->actual_length);
 usb_packet_skip(p, len);
+if (len > s->data_len) {
+len = s->data_len;
+}
 s->data_len -= len;
 }
 if (s->data_len == 0) {
@@ -469,6 +475,9 @@ static void usb_msd_handle_data(USBDevice *dev, USBPacket 
*p)
 int len = p->iov.size - p->actual_length;
 if (len) {
 usb_packet_skip(p, len);
+if (len > s->data_len) {
+len = s->data_len;
+}
 s->data_len -= len;
 if (s->data_len == 0) {
 s->mode = USB_MSDM_CSW;
@@ -528,13 +537,17 @@ static void usb_msd_handle_data(USBDevice *dev, USBPacket 
*p)
 int len = p->iov.size - p->actual_length;
 if (len) {
 usb_packet_skip(p, len);
+if (len > s->data_len) {
+len = s->data_len;
+}
 s->data_len -= len;
 if (s->data_len == 0) {
 s->mode = USB_MSDM_CSW;
 }
 }
 }
-if (p->actual_length < p->iov.size) {
+if (p->actual_length < p->iov.size && (p->short_not_ok ||
+s->scsi_len >= p->ep->max_packet_size)) {
 DPRINTF("Deferring packet %p [wait data-in]\n", p);
 s->packet = p;
 p->status = USB_RET_ASYNC;
-- 
2.17.1




[PATCH v4 7/7] raspi2 acceptance test: add test for dwc-hsotg (dwc2) USB host

2020-04-27 Thread Paul Zimmerman
Add a check for functional dwc-hsotg (dwc2) USB host emulation to
the Raspi 2 acceptance test

Signed-off-by: Paul Zimmerman 
---
 tests/acceptance/boot_linux_console.py | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index f825cd9ef5..efa4803642 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -373,13 +373,18 @@ class BootLinuxConsole(Test):
 
 self.vm.set_console()
 kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-   serial_kernel_cmdline[uart_id])
+   serial_kernel_cmdline[uart_id] +
+   ' root=/dev/mmcblk0p2 rootwait ' +
+   'dwc_otg.fiq_fsm_enable=0')
 self.vm.add_args('-kernel', kernel_path,
  '-dtb', dtb_path,
- '-append', kernel_command_line)
+ '-append', kernel_command_line,
+ '-device', 'usb-kbd')
 self.vm.launch()
 console_pattern = 'Kernel command line: %s' % kernel_command_line
 self.wait_for_console_pattern(console_pattern)
+console_pattern = 'Product: QEMU USB Keyboard'
+self.wait_for_console_pattern(console_pattern)
 
 def test_arm_raspi2_uart0(self):
 """
-- 
2.17.1




[PATCH v4 4/7] dwc-hsotg (dwc2) USB host controller emulation

2020-04-27 Thread Paul Zimmerman
Add the dwc-hsotg (dwc2) USB host controller emulation code.
Based on hw/usb/hcd-ehci.c and hw/usb/hcd-ohci.c.

Note that to use this with the dwc-otg driver in the Raspbian
kernel, you must pass the option "dwc_otg.fiq_fsm_enable=0" on
the kernel command line.

Emulation of slave mode and of descriptor-DMA mode has not been
implemented yet. These modes are seldom used.

I have used some on-line sources of information while developing
this emulation, including:

http://www.capital-micro.com/PDF/CME-M7_Family_User_Guide_EN.pdf
which has a pretty complete description of the controller starting
on page 370.

https://sourceforge.net/p/wive-ng/wive-ng-mt/ci/master/tree/docs/DataSheets/RT3050_5x_V2.0_081408_0902.pdf
which has a description of the controller registers starting on
page 130.

Thanks to Felippe Mathieu-Daude for providing a cleaner method
of implementing the memory regions for the controller registers.

Signed-off-by: Paul Zimmerman 
---
 hw/usb/Kconfig   |5 +
 hw/usb/Makefile.objs |1 +
 hw/usb/hcd-dwc2.c| 1378 ++
 hw/usb/trace-events  |   47 ++
 4 files changed, 1431 insertions(+)
 create mode 100644 hw/usb/hcd-dwc2.c

diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
index 464348ba14..d4d8c37c28 100644
--- a/hw/usb/Kconfig
+++ b/hw/usb/Kconfig
@@ -46,6 +46,11 @@ config USB_MUSB
 bool
 select USB
 
+config USB_DWC2
+bool
+default y
+select USB
+
 config TUSB6010
 bool
 select USB_MUSB
diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
index 66835e5bf7..fa5c3fa1b8 100644
--- a/hw/usb/Makefile.objs
+++ b/hw/usb/Makefile.objs
@@ -12,6 +12,7 @@ common-obj-$(CONFIG_USB_EHCI_SYSBUS) += hcd-ehci-sysbus.o
 common-obj-$(CONFIG_USB_XHCI) += hcd-xhci.o
 common-obj-$(CONFIG_USB_XHCI_NEC) += hcd-xhci-nec.o
 common-obj-$(CONFIG_USB_MUSB) += hcd-musb.o
+common-obj-$(CONFIG_USB_DWC2) += hcd-dwc2.o
 
 common-obj-$(CONFIG_TUSB6010) += tusb6010.o
 common-obj-$(CONFIG_IMX)  += chipidea.o
diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c
new file mode 100644
index 00..59c2caa6c6
--- /dev/null
+++ b/hw/usb/hcd-dwc2.c
@@ -0,0 +1,1378 @@
+/*
+ * dwc-hsotg (dwc2) USB host controller emulation
+ *
+ * Based on hw/usb/hcd-ehci.c and hw/usb/hcd-ohci.c
+ *
+ * Note that to use this emulation with the dwc-otg driver in the
+ * Raspbian kernel, you must pass the option "dwc_otg.fiq_fsm_enable=0"
+ * on the kernel command line.
+ *
+ * Some useful documentation used to develop this emulation can be
+ * found online (as of April 2020) at:
+ *
+ * http://www.capital-micro.com/PDF/CME-M7_Family_User_Guide_EN.pdf
+ * which has a pretty complete description of the controller starting
+ * on page 370.
+ *
+ * 
https://sourceforge.net/p/wive-ng/wive-ng-mt/ci/master/tree/docs/DataSheets/RT3050_5x_V2.0_081408_0902.pdf
+ * which has a description of the controller registers starting on
+ * page 130.
+ *
+ * Copyright (c) 2020 Paul Zimmerman 
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "hw/usb/dwc2-regs.h"
+#include "hw/usb/hcd-dwc2.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+#include "qemu/error-report.h"
+#include "qemu/main-loop.h"
+#include "hw/qdev-properties.h"
+
+#define USB_HZ_FS   1200
+#define USB_HZ_HS   9600
+#define USB_FRMINTVL12000
+
+/* nifty macros from Arnon's EHCI version  */
+#define get_field(data, field) \
+(((data) & field##_MASK) >> field##_SHIFT)
+
+#define set_field(data, newval, field) do { \
+uint32_t val = *(data); \
+val &= ~field##_MASK; \
+val |= ((newval) << field##_SHIFT) & field##_MASK; \
+*(data) = val; \
+} while (0)
+
+#define get_bit(data, bitmask) \
+(!!((data) & (bitmask)))
+
+/* update irq line */
+static inline void dwc2_update_irq(DWC2State *s)
+{
+static int oldlevel;
+int level = 0;
+
+if ((s->gintsts & s->gintmsk) && (s->gahbcfg & GAHBCFG_GLBL_INTR_EN)) {
+level = 1;
+}
+if (level != oldlevel) {
+oldlevel = level;
+trace_usb_dwc2_update_irq(level);
+qemu_set_irq(s->irq, level);
+}
+}
+
+/* flag interrupt condition */
+static inline void dwc2_raise_global_irq(DWC2State *s, uint32_t intr)
+{
+if (!(s->gintsts & intr)) {
+s->gintsts |= intr;
+trace_usb_dwc2_raise_global_irq(intr);
+dwc2_update_irq(s);
+}
+}
+
+static inline void dwc2_lower_global_irq(DWC2State *s, uint32_t intr)
+{
+if (s->gintsts & intr) 

[PATCH v4 6/7] wire in the dwc-hsotg (dwc2) USB host controller emulation

2020-04-27 Thread Paul Zimmerman
Wire the dwc-hsotg (dwc2) emulation into Qemu

Signed-off-by: Paul Zimmerman 
---
 hw/arm/bcm2835_peripherals.c | 21 -
 include/hw/arm/bcm2835_peripherals.h |  3 ++-
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index 5e2c832d95..3b554cfac0 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -128,6 +128,13 @@ static void bcm2835_peripherals_init(Object *obj)
 sysbus_init_child_obj(obj, "mphi", >mphi, sizeof(s->mphi),
   TYPE_BCM2835_MPHI);
 
+/* DWC2 */
+sysbus_init_child_obj(obj, "dwc2", >dwc2, sizeof(s->dwc2),
+  TYPE_DWC2_USB);
+
+object_property_add_const_link(OBJECT(>dwc2), "dma-mr",
+   OBJECT(>gpu_bus_mr), _abort);
+
 object_property_add_const_link(OBJECT(>gpio), "sdbus-sdhci",
OBJECT(>sdhci.sdbus), _abort);
 object_property_add_const_link(OBJECT(>gpio), "sdbus-sdhost",
@@ -385,6 +392,19 @@ static void bcm2835_peripherals_realize(DeviceState *dev, 
Error **errp)
 qdev_get_gpio_in_named(DEVICE(>ic), BCM2835_IC_GPU_IRQ,
INTERRUPT_HOSTPORT));
 
+/* DWC2 */
+object_property_set_bool(OBJECT(>dwc2), true, "realized", );
+if (err) {
+error_propagate(errp, err);
+return;
+}
+
+memory_region_add_subregion(>peri_mr, USB_OTG_OFFSET,
+sysbus_mmio_get_region(SYS_BUS_DEVICE(>dwc2), 0));
+sysbus_connect_irq(SYS_BUS_DEVICE(>dwc2), 0,
+qdev_get_gpio_in_named(DEVICE(>ic), BCM2835_IC_GPU_IRQ,
+   INTERRUPT_USB));
+
 create_unimp(s, >armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 
0x40);
 create_unimp(s, >cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
 create_unimp(s, >a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
@@ -398,7 +418,6 @@ static void bcm2835_peripherals_realize(DeviceState *dev, 
Error **errp)
 create_unimp(s, >otp, "bcm2835-otp", OTP_OFFSET, 0x80);
 create_unimp(s, >dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
 create_unimp(s, >ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
-create_unimp(s, >dwc2, "dwc-usb2", USB_OTG_OFFSET, 0x1000);
 create_unimp(s, >sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 }
 
diff --git a/include/hw/arm/bcm2835_peripherals.h 
b/include/hw/arm/bcm2835_peripherals.h
index 7a7a8f6141..48a0ad1633 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -27,6 +27,7 @@
 #include "hw/sd/bcm2835_sdhost.h"
 #include "hw/gpio/bcm2835_gpio.h"
 #include "hw/timer/bcm2835_systmr.h"
+#include "hw/usb/hcd-dwc2.h"
 #include "hw/misc/unimp.h"
 
 #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
@@ -67,7 +68,7 @@ typedef struct BCM2835PeripheralState {
 UnimplementedDeviceState ave0;
 UnimplementedDeviceState bscsl;
 UnimplementedDeviceState smi;
-UnimplementedDeviceState dwc2;
+DWC2State dwc2;
 UnimplementedDeviceState sdramc;
 } BCM2835PeripheralState;
 
-- 
2.17.1




[PATCH v4 2/7] dwc-hsotg (dwc2) USB host controller register definitions

2020-04-27 Thread Paul Zimmerman
Import the dwc-hsotg (dwc2) register definitions file from the
Linux kernel. This is a copy of drivers/usb/dwc2/hw.h from the
mainline Linux kernel, the only changes being two instances of
'u32' changed to 'uint32_t' to  allow it to compile.

Signed-off-by: Paul Zimmerman 
---
 include/hw/usb/dwc2-regs.h | 895 +
 1 file changed, 895 insertions(+)
 create mode 100644 include/hw/usb/dwc2-regs.h

diff --git a/include/hw/usb/dwc2-regs.h b/include/hw/usb/dwc2-regs.h
new file mode 100644
index 00..96dc07fb6f
--- /dev/null
+++ b/include/hw/usb/dwc2-regs.h
@@ -0,0 +1,895 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause)
+/*
+ * hw.h - DesignWare HS OTG Controller hardware definitions
+ *
+ * Copyright 2004-2013 Synopsys, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *notice, this list of conditions, and the following disclaimer,
+ *without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *notice, this list of conditions and the following disclaimer in the
+ *documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *to endorse or promote products derived from this software without
+ *specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation; either version 2 of the License, or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __DWC2_HW_H__
+#define __DWC2_HW_H__
+
+#define HSOTG_REG(x)   (x)
+
+#define GOTGCTLHSOTG_REG(0x000)
+#define GOTGCTL_CHIRPENBIT(27)
+#define GOTGCTL_MULT_VALID_BC_MASK (0x1f << 22)
+#define GOTGCTL_MULT_VALID_BC_SHIFT22
+#define GOTGCTL_OTGVER BIT(20)
+#define GOTGCTL_BSESVLDBIT(19)
+#define GOTGCTL_ASESVLDBIT(18)
+#define GOTGCTL_DBNC_SHORT BIT(17)
+#define GOTGCTL_CONID_BBIT(16)
+#define GOTGCTL_DBNCE_FLTR_BYPASS  BIT(15)
+#define GOTGCTL_DEVHNPEN   BIT(11)
+#define GOTGCTL_HSTSETHNPENBIT(10)
+#define GOTGCTL_HNPREQ BIT(9)
+#define GOTGCTL_HSTNEGSCS  BIT(8)
+#define GOTGCTL_SESREQ BIT(1)
+#define GOTGCTL_SESREQSCS  BIT(0)
+
+#define GOTGINTHSOTG_REG(0x004)
+#define GOTGINT_DBNCE_DONE BIT(19)
+#define GOTGINT_A_DEV_TOUT_CHG BIT(18)
+#define GOTGINT_HST_NEG_DETBIT(17)
+#define GOTGINT_HST_NEG_SUC_STS_CHNG   BIT(9)
+#define GOTGINT_SES_REQ_SUC_STS_CHNG   BIT(8)
+#define GOTGINT_SES_END_DETBIT(2)
+
+#define GAHBCFGHSOTG_REG(0x008)
+#define GAHBCFG_AHB_SINGLE BIT(23)
+#define GAHBCFG_NOTI_ALL_DMA_WRIT  BIT(22)
+#define GAHBCFG_REM_MEM_SUPP   BIT(21)
+#define GAHBCFG_P_TXF_EMP_LVL  BIT(8)
+#define GAHBCFG_NP_TXF_EMP_LVL BIT(7)
+#define GAHBCFG_DMA_EN BIT(5)
+#define GAHBCFG_HBSTLEN_MASK   (0xf << 1)
+#define GAHBCFG_HBSTLEN_SHIFT  1
+#define GAHBCFG_HBSTLEN_SINGLE 0
+#define GAHBCFG_HBSTLEN_INCR   1
+#define GAHBCFG_HBSTLEN_INCR4  3
+#define GAHBCFG_HBSTLEN_INCR8  5
+#define GAHBCFG_HBSTLEN_INCR16 7
+#define GAHBCFG_GLBL_INTR_EN   BIT(0)
+#define GAHBCFG_CTRL_MASK  (GAHBCFG_P_TXF_EMP_LVL | \
+GAHBCFG_NP_TXF_EMP_LVL | \
+GAHBCFG_DMA_EN | \
+GAHBCFG_GLBL_INTR_EN)
+
+#define GUSBCFGHSOTG_REG(0x00C)
+#define GUSBCFG_FORCEDEVMODE   BIT(30)
+#define GUSBCFG_FORCEHOSTMODE  BIT(29)
+#define GUSBCFG_TXENDDELAY BIT(28)
+#define 

[PATCH v4 3/7] dwc-hsotg (dwc2) USB host controller state definitions

2020-04-27 Thread Paul Zimmerman
Add the dwc-hsotg (dwc2) USB host controller state definitions.
Mostly based on hw/usb/hcd-ehci.h.

Signed-off-by: Paul Zimmerman 
---
 hw/usb/hcd-dwc2.h | 173 ++
 1 file changed, 173 insertions(+)
 create mode 100644 hw/usb/hcd-dwc2.h

diff --git a/hw/usb/hcd-dwc2.h b/hw/usb/hcd-dwc2.h
new file mode 100644
index 00..7d7ea604a4
--- /dev/null
+++ b/hw/usb/hcd-dwc2.h
@@ -0,0 +1,173 @@
+/*
+ * dwc-hsotg (dwc2) USB host controller state definitions
+ *
+ * Based on hw/usb/hcd-ehci.h
+ *
+ * Copyright (c) 2020 Paul Zimmerman 
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef HW_USB_DWC2_H
+#define HW_USB_DWC2_H
+
+#include "qemu/timer.h"
+#include "hw/irq.h"
+#include "hw/sysbus.h"
+#include "hw/usb.h"
+#include "sysemu/dma.h"
+
+#define DWC2_MMIO_SIZE  0x11000
+
+#define DWC2_NB_CHAN8   /* Number of host channels */
+#define DWC2_MAX_XFER_SIZE  65536   /* Max transfer size expected in HCTSIZ */
+
+typedef struct DWC2Packet DWC2Packet;
+typedef struct DWC2State DWC2State;
+
+enum async_state {
+DWC2_ASYNC_NONE = 0,
+DWC2_ASYNC_INITIALIZED,
+DWC2_ASYNC_INFLIGHT,
+DWC2_ASYNC_FINISHED,
+};
+
+struct DWC2Packet {
+USBPacket packet;
+uint32_t devadr;
+uint32_t epnum;
+uint32_t epdir;
+uint32_t mps;
+uint32_t pid;
+uint32_t index;
+uint32_t pcnt;
+uint32_t len;
+int32_t async;
+bool small;
+bool needs_service;
+};
+
+struct DWC2State {
+SysBusDevice parent_obj;
+USBBus bus;
+qemu_irq irq;
+MemoryRegion *dma_mr;
+AddressSpace dma_as;
+MemoryRegion container;
+MemoryRegion hsotg;
+MemoryRegion fifos;
+
+union {
+#define DWC2_GLBREG_SIZE0x70
+uint32_t glbreg[DWC2_GLBREG_SIZE / sizeof(uint32_t)];
+struct {
+uint32_t gotgctl;   /* 00 */
+uint32_t gotgint;   /* 04 */
+uint32_t gahbcfg;   /* 08 */
+uint32_t gusbcfg;   /* 0c */
+uint32_t grstctl;   /* 10 */
+uint32_t gintsts;   /* 14 */
+uint32_t gintmsk;   /* 18 */
+uint32_t grxstsr;   /* 1c */
+uint32_t grxstsp;   /* 20 */
+uint32_t grxfsiz;   /* 24 */
+uint32_t gnptxfsiz; /* 28 */
+uint32_t gnptxsts;  /* 2c */
+uint32_t gi2cctl;   /* 30 */
+uint32_t gpvndctl;  /* 34 */
+uint32_t ggpio; /* 38 */
+uint32_t guid;  /* 3c */
+uint32_t gsnpsid;   /* 40 */
+uint32_t ghwcfg1;   /* 44 */
+uint32_t ghwcfg2;   /* 48 */
+uint32_t ghwcfg3;   /* 4c */
+uint32_t ghwcfg4;   /* 50 */
+uint32_t glpmcfg;   /* 54 */
+uint32_t gpwrdn;/* 58 */
+uint32_t gdfifocfg; /* 5c */
+uint32_t gadpctl;   /* 60 */
+uint32_t grefclk;   /* 64 */
+uint32_t gintmsk2;  /* 68 */
+uint32_t gintsts2;  /* 6c */
+};
+};
+
+union {
+#define DWC2_FSZREG_SIZE0x04
+uint32_t fszreg[DWC2_FSZREG_SIZE / sizeof(uint32_t)];
+struct {
+uint32_t hptxfsiz;  /* 100 */
+};
+};
+
+union {
+#define DWC2_HREG0_SIZE 0x44
+uint32_t hreg0[DWC2_HREG0_SIZE / sizeof(uint32_t)];
+struct {
+uint32_t hcfg;  /* 400 */
+uint32_t hfir;  /* 404 */
+uint32_t hfnum; /* 408 */
+uint32_t rsvd0; /* 40c */
+uint32_t hptxsts;   /* 410 */
+uint32_t haint; /* 414 */
+uint32_t haintmsk;  /* 418 */
+uint32_t hflbaddr;  /* 41c */
+uint32_t rsvd1[8];  /* 420-43c */
+uint32_t hprt0; /* 440 */
+};
+};
+
+#define DWC2_HREG1_SIZE (0x20 * DWC2_NB_CHAN)
+uint32_t hreg1[DWC2_HREG1_SIZE / sizeof(uint32_t)];
+
+#define hcchar(_ch) hreg1[((_ch) << 3) + 0] /* 500, 520, ... */
+#define hcsplt(_ch) hreg1[((_ch) << 3) + 1] /* 504, 524, ... */
+#define hcint(_ch)  hreg1[((_ch) << 3) + 2] /* 508, 528, ... */
+#define hcintmsk(_ch)   hreg1[((_ch) << 3) + 3] /* 50c, 52c, ... */
+#define hctsiz(_ch) hreg1[((_ch) << 3) + 4] /* 510, 530, ... */
+#define hcdma(_ch)  hreg1[((_ch) << 3) + 5] /* 514, 534, ... */
+#define hcdmab(_ch) hreg1[((_ch) << 3) + 7] /* 51c, 

[PATCH v4 0/7] dwc-hsotg (aka dwc2) USB host controller emulation

2020-04-27 Thread Paul Zimmerman
This patch series adds emulation for the dwc-hsotg USB controller,
which is used on the Raspberry Pi 3 and earlier, as well as a number
of other development boards. The main benefit for Raspberry Pi is that
this enables networking on these boards, since the network adapter is
attached via USB.

The emulation is working quite well, I have tested with USB network,
mass storage, mouse, keyboard, and tablet. I have tested with the dwc2
driver in the upstream Linux kernel, and with the dwc-otg driver in the
Raspbian kernel.

One remaining issue is that USB host passthrough does not work. I tried
connecting to a USB stick on the host, but the device generates babble
errors and does not work. This is because the dwc-hsotg controller only
has one root port, so a full-speed dev-hub device is always connected
to it, and high-speed USB devices on the host do not work at full-speed
on the guest. (I have WIP code to add high-speed support to dev-hub to
fix this.)

The patch series also includes a very basic emulation of the MPHI
device on the Raspberry Pi SOC, which provides the FIQ interrupt that
is used by the dwc-otg driver in the Raspbian kernel. But that driver
still does not work in full FIQ mode, so it is necessary to add a
parameter to the kernel command line ("dwc_otg.fiq_fsm_enable=0") to
make it work.

I have used some online sources of information while developing this
emulation, including:

http://www.capital-micro.com/PDF/CME-M7_Family_User_Guide_EN.pdf
which has a pretty complete description of the controller starting
on page 370.

https://sourceforge.net/p/wive-ng/wive-ng-mt/ci/master/tree/docs/DataSheets/RT3050_5x_V2.0_081408_0902.pdf
which has a description of the controller registers starting on
page 130.

Changes v3-v4:
  - Reworked the memory region / register access code according to
an example patch from Felippe Mathieu-Daudé.
  - Moved the Makefile/Kconfig changes for this file into this
patch, per Felipe.
  - Fixed a missing DEFINE_PROP_END_OF_LIST() in dwc2_usb_properties.

Changes v2-v3:
  - Fixed the high-speed frame time emulation so that high-speed
mouse/tablet will work correctly once we have high-speed hub
support.
  - Added a "usb_version" property to the dwc-hsotg controller, to
allow choosing whether the controller emulates a USB 1 full-speed
host or a USB 2 high-speed host.
  - Added a test for a working dwc-hsotg controller to the raspi2
acceptance test, requested by Philippe M.
  - Added #defines for the register array sizes, instead of hard-
coding them in multiple places.
  - Removed the NB_PORTS #define and the associated iteration code,
since the controller only supports a single root port.
  - Removed some unused fields from the controller state struct.
  - Added pointers to some online documentation to the top of
hcd-dwc2.c, requested by Peter M.
  - Reworked the init/realize code to remove some confusing function
names, requested by Peter M.
  - Added VMStateDescription structs for the controller and MPHI
state, requested by Peter M (untested).

Changes v1-v2:
  - Fixed checkpatch errors/warnings, except for dwc2-regs.h since
that is a direct import from the Linux kernel.
  - Switched from debug printfs to tracepoints in hcd-dwc2.c, on the
advice of Gerd. I just dropped the debug prints in bcm2835_mphi.c,
since I didn't consider them very useful.
  - Updated a couple of the commit messages with more info.

Thanks for your time,
Paul

---

Paul Zimmerman (7):
  raspi: add BCM2835 SOC MPHI emulation
  dwc-hsotg (dwc2) USB host controller register definitions
  dwc-hsotg (dwc2) USB host controller state definitions
  dwc-hsotg (dwc2) USB host controller emulation
  usb: add short-packet handling to usb-storage driver
  wire in the dwc-hsotg (dwc2) USB host controller emulation
  raspi2 acceptance test: add test for dwc-hsotg (dwc2) USB host

 hw/arm/bcm2835_peripherals.c   |   38 +-
 hw/misc/Makefile.objs  |1 +
 hw/misc/bcm2835_mphi.c |  190 
 hw/usb/Kconfig |5 +
 hw/usb/Makefile.objs   |1 +
 hw/usb/dev-storage.c   |   15 +-
 hw/usb/hcd-dwc2.c  | 1378 
 hw/usb/hcd-dwc2.h  |  173 +++
 hw/usb/trace-events|   47 +
 include/hw/arm/bcm2835_peripherals.h   |5 +-
 include/hw/misc/bcm2835_mphi.h |   48 +
 include/hw/usb/dwc2-regs.h |  895 +++
 tests/acceptance/boot_linux_console.py |9 +-
 13 files changed, 2800 insertions(+), 5 deletions(-)
 create mode 100644 hw/misc/bcm2835_mphi.c
 create mode 100644 hw/usb/hcd-dwc2.c
 create mode 100644 hw/usb/hcd-dwc2.h
 create mode 100644 include/hw/misc/bcm2835_mphi.h
 create mode 100644 include/hw/usb/dwc2-regs.h

-- 
2.17.1




[PATCH v4 1/7] raspi: add BCM2835 SOC MPHI emulation

2020-04-27 Thread Paul Zimmerman
Add BCM2835 SOC MPHI (Message-based Parallel Host Interface)
emulation. It is very basic, only providing the FIQ interrupt
needed to allow the dwc-otg USB host controller driver in the
Raspbian kernel to function.

Signed-off-by: Paul Zimmerman 
---
 hw/arm/bcm2835_peripherals.c |  17 +++
 hw/misc/Makefile.objs|   1 +
 hw/misc/bcm2835_mphi.c   | 190 +++
 include/hw/arm/bcm2835_peripherals.h |   2 +
 include/hw/misc/bcm2835_mphi.h   |  48 +++
 5 files changed, 258 insertions(+)
 create mode 100644 hw/misc/bcm2835_mphi.c
 create mode 100644 include/hw/misc/bcm2835_mphi.h

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index edcaa4916d..5e2c832d95 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -124,6 +124,10 @@ static void bcm2835_peripherals_init(Object *obj)
 sysbus_init_child_obj(obj, "gpio", >gpio, sizeof(s->gpio),
   TYPE_BCM2835_GPIO);
 
+/* Mphi */
+sysbus_init_child_obj(obj, "mphi", >mphi, sizeof(s->mphi),
+  TYPE_BCM2835_MPHI);
+
 object_property_add_const_link(OBJECT(>gpio), "sdbus-sdhci",
OBJECT(>sdhci.sdbus), _abort);
 object_property_add_const_link(OBJECT(>gpio), "sdbus-sdhost",
@@ -368,6 +372,19 @@ static void bcm2835_peripherals_realize(DeviceState *dev, 
Error **errp)
 return;
 }
 
+/* Mphi */
+object_property_set_bool(OBJECT(>mphi), true, "realized", );
+if (err) {
+error_propagate(errp, err);
+return;
+}
+
+memory_region_add_subregion(>peri_mr, MPHI_OFFSET,
+sysbus_mmio_get_region(SYS_BUS_DEVICE(>mphi), 0));
+sysbus_connect_irq(SYS_BUS_DEVICE(>mphi), 0,
+qdev_get_gpio_in_named(DEVICE(>ic), BCM2835_IC_GPU_IRQ,
+   INTERRUPT_HOSTPORT));
+
 create_unimp(s, >armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 
0x40);
 create_unimp(s, >cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
 create_unimp(s, >a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index 68aae2eabb..91085cc21b 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -57,6 +57,7 @@ common-obj-$(CONFIG_OMAP) += omap_l4.o
 common-obj-$(CONFIG_OMAP) += omap_sdrc.o
 common-obj-$(CONFIG_OMAP) += omap_tap.o
 common-obj-$(CONFIG_RASPI) += bcm2835_mbox.o
+common-obj-$(CONFIG_RASPI) += bcm2835_mphi.o
 common-obj-$(CONFIG_RASPI) += bcm2835_property.o
 common-obj-$(CONFIG_RASPI) += bcm2835_rng.o
 common-obj-$(CONFIG_RASPI) += bcm2835_thermal.o
diff --git a/hw/misc/bcm2835_mphi.c b/hw/misc/bcm2835_mphi.c
new file mode 100644
index 00..66fc4a9cd3
--- /dev/null
+++ b/hw/misc/bcm2835_mphi.c
@@ -0,0 +1,190 @@
+/*
+ * BCM2835 SOC MPHI emulation
+ *
+ * Very basic emulation, only providing the FIQ interrupt needed to
+ * allow the dwc-otg USB host controller driver in the Raspbian kernel
+ * to function.
+ *
+ * Copyright (c) 2020 Paul Zimmerman 
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/misc/bcm2835_mphi.h"
+#include "migration/vmstate.h"
+#include "qemu/error-report.h"
+#include "qemu/main-loop.h"
+
+static inline void mphi_raise_irq(BCM2835MphiState *s)
+{
+qemu_set_irq(s->irq, 1);
+}
+
+static inline void mphi_lower_irq(BCM2835MphiState *s)
+{
+qemu_set_irq(s->irq, 0);
+}
+
+static uint64_t mphi_reg_read(void *ptr, hwaddr addr, unsigned size)
+{
+BCM2835MphiState *s = ptr;
+uint32_t reg = s->regbase + addr;
+uint32_t val = 0;
+
+switch (reg) {
+case 0x28:  /* outdda */
+val = s->outdda;
+break;
+case 0x2c:  /* outddb */
+val = s->outddb;
+break;
+case 0x4c:  /* ctrl */
+val = s->ctrl;
+val |= 1 << 17;
+break;
+case 0x50:  /* intstat */
+val = s->intstat;
+break;
+case 0x1f0: /* swirq_set */
+val = s->swirq_set;
+break;
+case 0x1f4: /* swirq_clr */
+val = s->swirq_clr;
+break;
+default:
+break;
+}
+
+return val;
+}
+
+static void mphi_reg_write(void *ptr, hwaddr addr, uint64_t val, unsigned size)
+{
+BCM2835MphiState *s = ptr;
+uint32_t reg = s->regbase + addr;
+int do_irq = 0;
+
+val &= 0x;
+
+switch (reg) {
+case 0x28:  /* outdda */
+s->outdda = val;
+break;
+case 0x2c:  /* outddb */

[virtio-comment] Request vote for the patch: Cross-device resource sharing

2020-04-27 Thread David Stevens
Request for a vote.

Fixes: https://github.com/oasis-tcs/virtio-spec/issues/76

Thanks,
David

On Fri, Mar 20, 2020 at 3:41 PM Gerd Hoffmann  wrote:
>
> On Thu, Mar 19, 2020 at 11:18:21AM +0900, David Stevens wrote:
> > Hi all,
> >
> > This is the next iteration of patches for adding support for sharing
> > resources between different virtio devices. The corresponding Linux
> > implementation is [1].
> >
> > In addition to these patches, the most recent virtio-video patchset
> > includes a patch for importing objects into that device [2].
>
> Looks good to me.
>
> So, open a github issue to kick the TC vote process and get this merged?
> (see virtio-spec/.github/PULL_REQUEST_TEMPLATE.md).
>
> cheers,
>   Gerd
>



[PATCH 3/3] tests/acpi: update expected SRAT files

2020-04-27 Thread Vishal Verma
Update the expected SRAT files for the change to account for NVDIMM numa
nodes in the SRAT.

AML Diff:
  --- /tmp/asl-V49YJ0.dsl   2020-04-27 18:50:52.680043327 -0600
  +++ /tmp/asl-48AZJ0.dsl   2020-04-27 18:50:52.679043344 -0600
  @@ -3,7 +3,7 @@
* AML/ASL+ Disassembler version 20190509 (64-bit version)
* Copyright (c) 2000 - 2019 Intel Corporation
*
  - * Disassembly of tests/data/acpi/pc/SRAT.dimmpxm, Mon Apr 27 18:50:52 2020
  + * Disassembly of /tmp/aml-U3BZJ0, Mon Apr 27 18:50:52 2020
*
* ACPI Data Table [SRAT]
*
  @@ -13,7 +13,7 @@
   [000h    4]Signature : "SRAT"[System Resource 
Affinity Table]
   [004h 0004   4] Table Length : 0188
   [008h 0008   1] Revision : 01
  -[009h 0009   1] Checksum : 80
  +[009h 0009   1] Checksum : 68
   [00Ah 0010   6]   Oem ID : "BOCHS "
   [010h 0016   8] Oem Table ID : "BXPCSRAT"
   [018h 0024   4] Oem Revision : 0001
  @@ -140,15 +140,15 @@
   [138h 0312   1]Subtable Type : 01 [Memory Affinity]
   [139h 0313   1]   Length : 28

  -[13Ah 0314   4] Proximity Domain : 
  +[13Ah 0314   4] Proximity Domain : 0002
   [13Eh 0318   2]Reserved1 : 
  -[140h 0320   8] Base Address : 
  -[148h 0328   8]   Address Length : 
  +[140h 0320   8] Base Address : 00010800
  +[148h 0328   8]   Address Length : 0800
   [150h 0336   4]Reserved2 : 
  -[154h 0340   4]Flags (decoded below) : 
  - Enabled : 0
  +[154h 0340   4]Flags (decoded below) : 0005
  + Enabled : 1
  Hot Pluggable : 0
  -Non-Volatile : 0
  +Non-Volatile : 1
   [158h 0344   8]Reserved3 : 

   [160h 0352   1]Subtable Type : 01 [Memory Affinity]
  @@ -167,7 +167,7 @@

   Raw Table Data: Length 392 (0x188)

  -: 53 52 41 54 88 01 00 00 01 80 42 4F 43 48 53 20  // SRAT..BOCHS
  +: 53 52 41 54 88 01 00 00 01 68 42 4F 43 48 53 20  // SRAT.hBOCHS
   0010: 42 58 50 43 53 52 41 54 01 00 00 00 42 58 50 43  // 
BXPCSRATBXPC
   0020: 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  // 

   0030: 00 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00  // 

  @@ -186,9 +186,9 @@
   0100: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  // 

   0110: 01 28 03 00 00 00 00 00 00 00 00 06 00 00 00 00  // 
.(..
   0120: 00 00 00 02 00 00 00 00 00 00 00 00 01 00 00 00  // 

  -0130: 00 00 00 00 00 00 00 00 01 28 00 00 00 00 00 00  // 
.(..
  -0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // 

  -0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // 

  +0130: 00 00 00 00 00 00 00 00 01 28 02 00 00 00 00 00  // 
.(..
  +0140: 00 00 00 08 01 00 00 00 00 00 00 08 00 00 00 00  // 

  +0150: 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00  // 

   0160: 01 28 03 00 00 00 00 00 00 00 00 00 01 00 00 00  // 
.(..
   0170: 00 00 00 F8 00 00 00 00 00 00 00 00 03 00 00 00  // 

   0180: 00 00 00 00 00 00 00 00  // 

Signed-off-by: Vishal Verma 
---
 tests/data/acpi/pc/SRAT.dimmpxm | Bin 392 -> 392 bytes
 tests/data/acpi/q35/SRAT.dimmpxm| Bin 392 -> 392 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 3 files changed, 1 deletion(-)

diff --git a/tests/data/acpi/pc/SRAT.dimmpxm b/tests/data/acpi/pc/SRAT.dimmpxm
index 
f5c0267ea24bb404b6b4e687390140378fbdc3f1..5a13c61b9041c6045c29643bf93a111fb1c0c76a
 100644
GIT binary patch
delta 51
scmeBR?qKE$4ss0XU}Rum%-G0fz$nec00kUCF%aN@Pz(

delta 51
icmeBR?qKE$4ss0XU}RumY}m+Uz$ndt8%z#mGzI{_tp$hx

diff --git a/tests/data/acpi/q35/SRAT.dimmpxm b/tests/data/acpi/q35/SRAT.dimmpxm
index 
f5c0267ea24bb404b6b4e687390140378fbdc3f1..5a13c61b9041c6045c29643bf93a111fb1c0c76a
 100644
GIT binary patch
delta 51
scmeBR?qKE$4ss0XU}Rum%-G0fz$nec00kUCF%aN@Pz(

delta 51
icmeBR?qKE$4ss0XU}RumY}m+Uz$ndt8%z#mGzI{_tp$hx

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h 
b/tests/qtest/bios-tables-test-allowed-diff.h
index 83d3ea5032..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/pc/SRAT.dimmpxm",
-- 
2.25.4




[PATCH 1/3] diffs-allowed: add the SRAT AML to diffs-allowed

2020-04-27 Thread Vishal Verma
In anticipation of a change to the SRAT generation in qemu, add the AML
file to diffs-allowed.

Signed-off-by: Vishal Verma 
---
 tests/qtest/bios-tables-test-allowed-diff.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h 
b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..83d3ea5032 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,2 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/pc/SRAT.dimmpxm",
-- 
2.25.4




[PATCH 2/3] hw/acpi-build: account for NVDIMM numa nodes in SRAT

2020-04-27 Thread Vishal Verma
NVDIMMs can belong to their own proximity domains, as described by the
NFIT. In such cases, the SRAT needs to have Memory Affinity structures
in the SRAT for these NVDIMMs, otherwise Linux doesn't populate node
data structures properly during NUMA initialization. See the following
for an example failure case.

https://lore.kernel.org/linux-nvdimm/20200416225438.15208-1-vishal.l.ve...@intel.com/

Fix this by adding device address range and node information from
NVDIMMs to the SRAT in build_srat().

The relevant command line options to exercise this are below. Nodes 0-1
contain CPUs and regular memory, and nodes 2-3 are the NVDIMM address
space.

  -numa node,nodeid=0,mem=2048M,
  -numa node,nodeid=1,mem=2048M,
  -numa node,nodeid=2,mem=0,
  -object 
memory-backend-file,id=nvmem0,share,mem-path=nvdimm-0,size=16384M,align=128M
  -device nvdimm,memdev=nvmem0,id=nv0,label-size=2M,node=2
  -numa node,nodeid=3,mem=0,
  -object 
memory-backend-file,id=nvmem1,share,mem-path=nvdimm-1,size=16384M,align=128M
  -device nvdimm,memdev=nvmem1,id=nv1,label-size=2M,node=3

Cc: Jingqi Liu 
Cc: Michael S. Tsirkin 
Signed-off-by: Vishal Verma 
---
 hw/i386/acpi-build.c | 20 
 1 file changed, 20 insertions(+)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 23c77eeb95..b0da67de0e 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -48,6 +48,7 @@
 #include "migration/vmstate.h"
 #include "hw/mem/memory-device.h"
 #include "hw/mem/nvdimm.h"
+#include "qemu/nvdimm-utils.h"
 #include "sysemu/numa.h"
 #include "sysemu/reset.h"
 
@@ -2429,6 +2430,25 @@ build_srat(GArray *table_data, BIOSLinker *linker, 
MachineState *machine)
   MEM_AFFINITY_ENABLED);
 }
 }
+
+if (machine->nvdimms_state->is_enabled) {
+GSList *device_list = nvdimm_get_device_list();
+
+for (; device_list; device_list = device_list->next) {
+DeviceState *dev = device_list->data;
+int node = object_property_get_int(OBJECT(dev), PC_DIMM_NODE_PROP,
+   NULL);
+uint64_t addr = object_property_get_uint(OBJECT(dev),
+ PC_DIMM_ADDR_PROP, NULL);
+uint64_t size = object_property_get_uint(OBJECT(dev),
+ PC_DIMM_SIZE_PROP, NULL);
+
+numamem = acpi_data_push(table_data, sizeof *numamem);
+build_srat_memory(numamem, addr, size, node,
+  MEM_AFFINITY_ENABLED | 
MEM_AFFINITY_NON_VOLATILE);
+}
+}
+
 slots = (table_data->len - numa_start) / sizeof *numamem;
 for (; slots < pcms->numa_nodes + 2; slots++) {
 numamem = acpi_data_push(table_data, sizeof *numamem);
-- 
2.25.4




[PATCH 0/3] account for NVDIMM nodes during SRAT generation

2020-04-27 Thread Vishal Verma
On the command line, one can specify a NUMA node for NVDIMM devices. If
we set up the topology to give NVDIMMs their own nodes, i.e. not
containing any CPUs or regular memory, qemu doesn't populate SRAT memory
affinity structures for these nodes. However the NFIT does reference
those proximity domains.

As a result, Linux, while parsing the SRAT, fails to initialize node
related structures for these nodes, and they never end up in the
nodes_possible map. When these are onlined at a later point (via
hotplug), this causes problems.

I've followed the instructions in bios-tables-test.c to update the
expected SRAT binary, and the tests (make check) pass. Patches 1 and 3
are the relevant ones for the binary update.

Patch 2 is the main patch which changes SRAT generation.

Vishal Verma (3):
  diffs-allowed: add the SRAT AML to diffs-allowed
  hw/acpi-build: account for NVDIMM numa nodes in SRAT
  tests/acpi: update expected SRAT files

 hw/i386/acpi-build.c |  20 
 tests/data/acpi/pc/SRAT.dimmpxm  | Bin 392 -> 392 bytes
 tests/data/acpi/q35/SRAT.dimmpxm | Bin 392 -> 392 bytes
 3 files changed, 20 insertions(+)

-- 
2.25.4




Re: [PATCH v5 0/4] introduction of migration_version attribute for VFIO live migration

2020-04-27 Thread Yan Zhao
On Mon, Apr 27, 2020 at 11:37:43PM +0800, Dr. David Alan Gilbert wrote:
> * Yan Zhao (yan.y.z...@intel.com) wrote:
> > On Sat, Apr 25, 2020 at 03:10:49AM +0800, Dr. David Alan Gilbert wrote:
> > > * Yan Zhao (yan.y.z...@intel.com) wrote:
> > > > On Tue, Apr 21, 2020 at 08:08:49PM +0800, Tian, Kevin wrote:
> > > > > > From: Yan Zhao
> > > > > > Sent: Tuesday, April 21, 2020 10:37 AM
> > > > > > 
> > > > > > On Tue, Apr 21, 2020 at 06:56:00AM +0800, Alex Williamson wrote:
> > > > > > > On Sun, 19 Apr 2020 21:24:57 -0400
> > > > > > > Yan Zhao  wrote:
> > > > > > >
> > > > > > > > On Fri, Apr 17, 2020 at 07:24:57PM +0800, Cornelia Huck wrote:
> > > > > > > > > On Fri, 17 Apr 2020 05:52:02 -0400
> > > > > > > > > Yan Zhao  wrote:
> > > > > > > > >
> > > > > > > > > > On Fri, Apr 17, 2020 at 04:44:50PM +0800, Cornelia Huck 
> > > > > > > > > > wrote:
> > > > > > > > > > > On Mon, 13 Apr 2020 01:52:01 -0400
> > > > > > > > > > > Yan Zhao  wrote:
> > > > > > > > > > >
> > > > > > > > > > > > This patchset introduces a migration_version attribute 
> > > > > > > > > > > > under sysfs
> > > > > > of VFIO
> > > > > > > > > > > > Mediated devices.
> > > > > > > > > > > >
> > > > > > > > > > > > This migration_version attribute is used to check 
> > > > > > > > > > > > migration
> > > > > > compatibility
> > > > > > > > > > > > between two mdev devices.
> > > > > > > > > > > >
> > > > > > > > > > > > Currently, it has two locations:
> > > > > > > > > > > > (1) under mdev_type node,
> > > > > > > > > > > > which can be used even before device creation, but 
> > > > > > > > > > > > only for
> > > > > > mdev
> > > > > > > > > > > > devices of the same mdev type.
> > > > > > > > > > > > (2) under mdev device node,
> > > > > > > > > > > > which can only be used after the mdev devices are 
> > > > > > > > > > > > created, but
> > > > > > the src
> > > > > > > > > > > > and target mdev devices are not necessarily be of 
> > > > > > > > > > > > the same
> > > > > > mdev type
> > > > > > > > > > > > (The second location is newly added in v5, in order to 
> > > > > > > > > > > > keep
> > > > > > consistent
> > > > > > > > > > > > with the migration_version node for migratable 
> > > > > > > > > > > > pass-though
> > > > > > devices)
> > > > > > > > > > >
> > > > > > > > > > > What is the relationship between those two attributes?
> > > > > > > > > > >
> > > > > > > > > > (1) is for mdev devices specifically, and (2) is provided 
> > > > > > > > > > to keep the
> > > > > > same
> > > > > > > > > > sysfs interface as with non-mdev cases. so (2) is for both 
> > > > > > > > > > mdev
> > > > > > devices and
> > > > > > > > > > non-mdev devices.
> > > > > > > > > >
> > > > > > > > > > in future, if we enable vfio-pci vendor ops, (i.e. a 
> > > > > > > > > > non-mdev device
> > > > > > > > > > is binding to vfio-pci, but is able to register migration 
> > > > > > > > > > region and do
> > > > > > > > > > migration transactions from a vendor provided affiliate 
> > > > > > > > > > driver),
> > > > > > > > > > the vendor driver would export (2) directly, under device 
> > > > > > > > > > node.
> > > > > > > > > > It is not able to provide (1) as there're no mdev devices 
> > > > > > > > > > involved.
> > > > > > > > >
> > > > > > > > > Ok, creating an alternate attribute for non-mdev devices 
> > > > > > > > > makes sense.
> > > > > > > > > However, wouldn't that rather be a case (3)? The change here 
> > > > > > > > > only
> > > > > > > > > refers to mdev devices.
> > > > > > > > >
> > > > > > > > as you pointed below, (3) and (2) serve the same purpose.
> > > > > > > > and I think a possible usage is to migrate between a non-mdev 
> > > > > > > > device and
> > > > > > > > an mdev device. so I think it's better for them both to use (2) 
> > > > > > > > rather
> > > > > > > > than creating (3).
> > > > > > >
> > > > > > > An mdev type is meant to define a software compatible interface, 
> > > > > > > so in
> > > > > > > the case of mdev->mdev migration, doesn't migrating to a 
> > > > > > > different type
> > > > > > > fail the most basic of compatibility tests that we expect 
> > > > > > > userspace to
> > > > > > > perform?  IOW, if two mdev types are migration compatible, it 
> > > > > > > seems a
> > > > > > > prerequisite to that is that they provide the same software 
> > > > > > > interface,
> > > > > > > which means they should be the same mdev type.
> > > > > > >
> > > > > > > In the hybrid cases of mdev->phys or phys->mdev, how does a
> > > > > > management
> > > > > > > tool begin to even guess what might be compatible?  Are we 
> > > > > > > expecting
> > > > > > > libvirt to probe ever device with this attribute in the system?  
> > > > > > > Is
> > > > > > > there going to be a new class hierarchy created to enumerate all
> > > > > > > possible migrate-able devices?
> > > > > > >
> > > > > > yes, management tool needs to guess and test migration compatible
> > > > > > between two devices. But I think it's 

[PATCH v23 QEMU 5/5] virtio-balloon: Provide an interface for free page reporting

2020-04-27 Thread Alexander Duyck
From: Alexander Duyck 

Add support for free page reporting. The idea is to function very similar
to how the balloon works in that we basically end up madvising the page as
not being used. However we don't really need to bother with any deflate
type logic since the page will be faulted back into the guest when it is
read or written to.

This provides a new way of letting the guest proactively report free
pages to the hypervisor, so the hypervisor can reuse them. In contrast to
inflate/deflate that is triggered via the hypervisor explicitly.

Acked-by: David Hildenbrand 
Signed-off-by: Alexander Duyck 
---
 hw/virtio/virtio-balloon.c |   69 
 include/hw/virtio/virtio-balloon.h |2 +
 2 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 1666132a24c1..53abba290274 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -321,6 +321,67 @@ static void balloon_stats_set_poll_interval(Object *obj, 
Visitor *v,
 balloon_stats_change_timer(s, 0);
 }
 
+static void virtio_balloon_handle_report(VirtIODevice *vdev, VirtQueue *vq)
+{
+VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
+VirtQueueElement *elem;
+
+while ((elem = virtqueue_pop(vq, sizeof(VirtQueueElement {
+unsigned int i;
+
+/*
+ * When we discard the page it has the effect of removing the page
+ * from the hypervisor itself and causing it to be zeroed when it
+ * is returned to us. So we must not discard the page if it is
+ * accessible by another device or process, or if the guest is
+ * expecting it to retain a non-zero value.
+ */
+if (qemu_balloon_is_inhibited() || dev->poison_val) {
+goto skip_element;
+}
+
+for (i = 0; i < elem->in_num; i++) {
+void *addr = elem->in_sg[i].iov_base;
+size_t size = elem->in_sg[i].iov_len;
+ram_addr_t ram_offset;
+RAMBlock *rb;
+
+/*
+ * There is no need to check the memory section to see if
+ * it is ram/readonly/romd like there is for handle_output
+ * below. If the region is not meant to be written to then
+ * address_space_map will have allocated a bounce buffer
+ * and it will be freed in address_space_unmap and trigger
+ * and unassigned_mem_write before failing to copy over the
+ * buffer. If more than one bad descriptor is provided it
+ * will return NULL after the first bounce buffer and fail
+ * to map any resources.
+ */
+rb = qemu_ram_block_from_host(addr, false, _offset);
+if (!rb) {
+trace_virtio_balloon_bad_addr(elem->in_addr[i]);
+continue;
+}
+
+/*
+ * For now we will simply ignore unaligned memory regions, or
+ * regions that overrun the end of the RAMBlock.
+ */
+if (!QEMU_IS_ALIGNED(ram_offset | size, qemu_ram_pagesize(rb)) ||
+(ram_offset + size) > qemu_ram_get_used_length(rb)) {
+continue;
+}
+
+ram_block_discard_range(rb, ram_offset, size);
+}
+
+skip_element:
+virtqueue_push(vq, elem, 0);
+virtio_notify(vdev, vq);
+g_free(elem);
+}
+}
+
 static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
 {
 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
@@ -841,6 +902,12 @@ static void virtio_balloon_device_realize(DeviceState 
*dev, Error **errp)
 virtio_error(vdev, "iothread is missing");
 }
 }
+
+if (virtio_has_feature(s->host_features, VIRTIO_BALLOON_F_REPORTING)) {
+s->reporting_vq = virtio_add_queue(vdev, 32,
+   virtio_balloon_handle_report);
+}
+
 reset_stats(s);
 }
 
@@ -945,6 +1012,8 @@ static Property virtio_balloon_properties[] = {
 VIRTIO_BALLOON_F_FREE_PAGE_HINT, false),
 DEFINE_PROP_BIT("page-poison", VirtIOBalloon, host_features,
 VIRTIO_BALLOON_F_PAGE_POISON, true),
+DEFINE_PROP_BIT("free-page-reporting", VirtIOBalloon, host_features,
+VIRTIO_BALLOON_F_REPORTING, false),
 /* QEMU 4.0 accidentally changed the config size even when free-page-hint
  * is disabled, resulting in QEMU 3.1 migration incompatibility.  This
  * property retains this quirk for QEMU 4.1 machine types.
diff --git a/include/hw/virtio/virtio-balloon.h 
b/include/hw/virtio/virtio-balloon.h
index 3ca2a78e1aca..28fd2b396087 100644
--- a/include/hw/virtio/virtio-balloon.h
+++ b/include/hw/virtio/virtio-balloon.h
@@ -42,7 +42,7 @@ enum virtio_balloon_free_page_hint_status {
 
 typedef struct VirtIOBalloon {
 VirtIODevice parent_obj;
-VirtQueue *ivq, *dvq, *svq, *free_page_vq;
+VirtQueue *ivq, 

[PATCH v23 QEMU 4/5] virtio-balloon: Implement support for page poison reporting feature

2020-04-27 Thread Alexander Duyck
From: Alexander Duyck 

We need to make certain to advertise support for page poison reporting if
we want to actually get data on if the guest will be poisoning pages.

Add a value for reporting the poison value being used if page poisoning is
enabled in the guest. With this we can determine if we will need to skip
free page reporting when it is enabled in the future.

The value currently has no impact on existing balloon interfaces. In the
case of existing balloon interfaces the onus is on the guest driver to
reapply whatever poison is in place.

When we add free page reporting the poison value is used to determine if
we can perform in-place page reporting. The expectation is that a reported
page will already contain the value specified by the poison, and the
reporting of the page should not change that value.

Acked-by: David Hildenbrand 
Signed-off-by: Alexander Duyck 
---
 hw/virtio/virtio-balloon.c |   29 +
 include/hw/virtio/virtio-balloon.h |1 +
 2 files changed, 30 insertions(+)

diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index a209706b4d8d..1666132a24c1 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -634,6 +634,7 @@ static void virtio_balloon_get_config(VirtIODevice *vdev, 
uint8_t *config_data)
 
 config.num_pages = cpu_to_le32(dev->num_pages);
 config.actual = cpu_to_le32(dev->actual);
+config.poison_val = cpu_to_le32(dev->poison_val);
 
 if (dev->free_page_hint_status == FREE_PAGE_HINT_S_REQUESTED) {
 config.free_page_hint_cmd_id =
@@ -683,6 +684,14 @@ static ram_addr_t get_current_ram_size(void)
 return size;
 }
 
+static bool virtio_balloon_page_poison_support(void *opaque)
+{
+VirtIOBalloon *s = opaque;
+VirtIODevice *vdev = VIRTIO_DEVICE(s);
+
+return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_PAGE_POISON);
+}
+
 static void virtio_balloon_set_config(VirtIODevice *vdev,
   const uint8_t *config_data)
 {
@@ -697,6 +706,10 @@ static void virtio_balloon_set_config(VirtIODevice *vdev,
 qapi_event_send_balloon_change(vm_ram_size -
 ((ram_addr_t) dev->actual << 
VIRTIO_BALLOON_PFN_SHIFT));
 }
+dev->poison_val = 0;
+if (virtio_balloon_page_poison_support(dev)) {
+dev->poison_val = le32_to_cpu(config.poison_val);
+}
 trace_virtio_balloon_set_config(dev->actual, oldactual);
 }
 
@@ -755,6 +768,17 @@ static const VMStateDescription 
vmstate_virtio_balloon_free_page_hint = {
 }
 };
 
+static const VMStateDescription vmstate_virtio_balloon_page_poison = {
+.name = "vitio-balloon-device/page-poison",
+.version_id = 1,
+.minimum_version_id = 1,
+.needed = virtio_balloon_page_poison_support,
+.fields = (VMStateField[]) {
+VMSTATE_UINT32(poison_val, VirtIOBalloon),
+VMSTATE_END_OF_LIST()
+}
+};
+
 static const VMStateDescription vmstate_virtio_balloon_device = {
 .name = "virtio-balloon-device",
 .version_id = 1,
@@ -767,6 +791,7 @@ static const VMStateDescription 
vmstate_virtio_balloon_device = {
 },
 .subsections = (const VMStateDescription * []) {
 _virtio_balloon_free_page_hint,
+_virtio_balloon_page_poison,
 NULL
 }
 };
@@ -854,6 +879,8 @@ static void virtio_balloon_device_reset(VirtIODevice *vdev)
 g_free(s->stats_vq_elem);
 s->stats_vq_elem = NULL;
 }
+
+s->poison_val = 0;
 }
 
 static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
@@ -916,6 +943,8 @@ static Property virtio_balloon_properties[] = {
 VIRTIO_BALLOON_F_DEFLATE_ON_OOM, false),
 DEFINE_PROP_BIT("free-page-hint", VirtIOBalloon, host_features,
 VIRTIO_BALLOON_F_FREE_PAGE_HINT, false),
+DEFINE_PROP_BIT("page-poison", VirtIOBalloon, host_features,
+VIRTIO_BALLOON_F_PAGE_POISON, true),
 /* QEMU 4.0 accidentally changed the config size even when free-page-hint
  * is disabled, resulting in QEMU 3.1 migration incompatibility.  This
  * property retains this quirk for QEMU 4.1 machine types.
diff --git a/include/hw/virtio/virtio-balloon.h 
b/include/hw/virtio/virtio-balloon.h
index 108cff97e71a..3ca2a78e1aca 100644
--- a/include/hw/virtio/virtio-balloon.h
+++ b/include/hw/virtio/virtio-balloon.h
@@ -70,6 +70,7 @@ typedef struct VirtIOBalloon {
 uint32_t host_features;
 
 bool qemu_4_0_config_size;
+uint32_t poison_val;
 } VirtIOBalloon;
 
 #endif




[PATCH v23 QEMU 2/5] linux-headers: update to contain virito-balloon free page reporting

2020-04-27 Thread Alexander Duyck
From: Alexander Duyck 

Sync the latest upstream changes for free page reporting. To be
replaced by a full linux header sync.

Signed-off-by: Alexander Duyck 
---
 include/standard-headers/linux/virtio_balloon.h |1 +
 1 file changed, 1 insertion(+)

diff --git a/include/standard-headers/linux/virtio_balloon.h 
b/include/standard-headers/linux/virtio_balloon.h
index af0a6b59dab2..af3b7a1fa263 100644
--- a/include/standard-headers/linux/virtio_balloon.h
+++ b/include/standard-headers/linux/virtio_balloon.h
@@ -36,6 +36,7 @@
 #define VIRTIO_BALLOON_F_DEFLATE_ON_OOM2 /* Deflate balloon on OOM */
 #define VIRTIO_BALLOON_F_FREE_PAGE_HINT3 /* VQ to report free pages */
 #define VIRTIO_BALLOON_F_PAGE_POISON   4 /* Guest is using page poisoning */
+#define VIRTIO_BALLOON_F_REPORTING 5 /* Page reporting virtqueue */
 
 /* Size of a PFN in the balloon interface. */
 #define VIRTIO_BALLOON_PFN_SHIFT 12




[PATCH v23 QEMU 3/5] virtio-balloon: Replace free page hinting references to 'report' with 'hint'

2020-04-27 Thread Alexander Duyck
From: Alexander Duyck 

In an upcoming patch a feature named Free Page Reporting is about to be
added. In order to avoid any confusion we should drop the use of the word
'report' when referring to Free Page Hinting. So what this patch does is go
through and replace all instances of 'report' with 'hint" when we are
referring to free page hinting.

Acked-by: David Hildenbrand 
Signed-off-by: Alexander Duyck 
---
 hw/virtio/virtio-balloon.c |   78 ++--
 include/hw/virtio/virtio-balloon.h |   20 +
 2 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index a4729f7fc930..a209706b4d8d 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -466,21 +466,21 @@ static bool get_free_page_hints(VirtIOBalloon *dev)
 ret = false;
 goto out;
 }
-if (id == dev->free_page_report_cmd_id) {
-dev->free_page_report_status = FREE_PAGE_REPORT_S_START;
+if (id == dev->free_page_hint_cmd_id) {
+dev->free_page_hint_status = FREE_PAGE_HINT_S_START;
 } else {
 /*
  * Stop the optimization only when it has started. This
  * avoids a stale stop sign for the previous command.
  */
-if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
-dev->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
+if (dev->free_page_hint_status == FREE_PAGE_HINT_S_START) {
+dev->free_page_hint_status = FREE_PAGE_HINT_S_STOP;
 }
 }
 }
 
 if (elem->in_num) {
-if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
+if (dev->free_page_hint_status == FREE_PAGE_HINT_S_START) {
 qemu_guest_free_page_hint(elem->in_sg[0].iov_base,
   elem->in_sg[0].iov_len);
 }
@@ -506,11 +506,11 @@ static void virtio_ballloon_get_free_page_hints(void 
*opaque)
 qemu_mutex_unlock(>free_page_lock);
 virtio_notify(vdev, vq);
   /*
-   * Start to poll the vq once the reporting started. Otherwise, continue
+   * Start to poll the vq once the hinting started. Otherwise, continue
* only when there are entries on the vq, which need to be given back.
*/
 } while (continue_to_get_hints ||
- dev->free_page_report_status == FREE_PAGE_REPORT_S_START);
+ dev->free_page_hint_status == FREE_PAGE_HINT_S_START);
 virtio_queue_set_notification(vq, 1);
 }
 
@@ -531,14 +531,14 @@ static void virtio_balloon_free_page_start(VirtIOBalloon 
*s)
 return;
 }
 
-if (s->free_page_report_cmd_id == UINT_MAX) {
-s->free_page_report_cmd_id =
-   VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
+if (s->free_page_hint_cmd_id == UINT_MAX) {
+s->free_page_hint_cmd_id =
+   VIRTIO_BALLOON_FREE_PAGE_HINT_CMD_ID_MIN;
 } else {
-s->free_page_report_cmd_id++;
+s->free_page_hint_cmd_id++;
 }
 
-s->free_page_report_status = FREE_PAGE_REPORT_S_REQUESTED;
+s->free_page_hint_status = FREE_PAGE_HINT_S_REQUESTED;
 virtio_notify_config(vdev);
 }
 
@@ -546,18 +546,18 @@ static void virtio_balloon_free_page_stop(VirtIOBalloon 
*s)
 {
 VirtIODevice *vdev = VIRTIO_DEVICE(s);
 
-if (s->free_page_report_status != FREE_PAGE_REPORT_S_STOP) {
+if (s->free_page_hint_status != FREE_PAGE_HINT_S_STOP) {
 /*
  * The lock also guarantees us that the
  * virtio_ballloon_get_free_page_hints exits after the
- * free_page_report_status is set to S_STOP.
+ * free_page_hint_status is set to S_STOP.
  */
 qemu_mutex_lock(>free_page_lock);
 /*
- * The guest hasn't done the reporting, so host sends a notification
- * to the guest to actively stop the reporting.
+ * The guest isn't done hinting, so send a notification
+ * to the guest to actively stop the hinting.
  */
-s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
+s->free_page_hint_status = FREE_PAGE_HINT_S_STOP;
 qemu_mutex_unlock(>free_page_lock);
 virtio_notify_config(vdev);
 }
@@ -567,15 +567,15 @@ static void virtio_balloon_free_page_done(VirtIOBalloon 
*s)
 {
 VirtIODevice *vdev = VIRTIO_DEVICE(s);
 
-s->free_page_report_status = FREE_PAGE_REPORT_S_DONE;
+s->free_page_hint_status = FREE_PAGE_HINT_S_DONE;
 virtio_notify_config(vdev);
 }
 
 static int
-virtio_balloon_free_page_report_notify(NotifierWithReturn *n, void *data)
+virtio_balloon_free_page_hint_notify(NotifierWithReturn *n, void *data)
 {
 VirtIOBalloon *dev = container_of(n, VirtIOBalloon,
-  free_page_report_notify);
+  free_page_hint_notify);
 VirtIODevice *vdev = 

[PATCH v23 QEMU 0/5] virtio-balloon: add support for page poison reporting and free page reporting

2020-04-27 Thread Alexander Duyck
This series provides an asynchronous means of reporting free guest pages
to QEMU through virtio-balloon so that the memory associated with those
pages can be dropped and reused by other processes and/or guests on the
host. Using this it is possible to avoid unnecessary I/O to disk and
greatly improve performance in the case of memory overcommit on the host.

I originally submitted this patch series back on February 11th 2020[1],
but at that time I was focused primarily on the kernel portion of this
patch set. However as of April 7th those patches are now included in
Linus's kernel tree[2] and so I am submitting the QEMU pieces for
inclusion.

[1]: 
https://lore.kernel.org/lkml/20200211224416.29318.44077.stgit@localhost.localdomain/
[2]: 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0c504f154718904ae49349147e3b7e6ae91ffdc

Changes from v17:
Fixed typo in patch 1 title
Addressed white-space issues reported via checkpatch
Added braces {} for two if statements to match expected coding style

Changes from v18:
Updated patches 2 and 3 based on input from dhildenb
Added comment to patch 2 describing what keeps us from reporting a bad page
Added patch to address issue with ROM devices being directly writable

Changes from v19:
Added std-headers change to match changes pushed for linux kernel headers
Added patch to remove "report" from page hinting code paths
Updated comment to better explain why we disable hints w/ page poisoning
Removed code that was modifying config size for poison vs hinting
Dropped x-page-poison property
Added code to bounds check the reported region vs the RAM block
Dropped patch for ROM devices as that was already pulled in by Paolo

Changes from v20:
Rearranged patches to push Linux header sync patches to front
Removed association between free page hinting and VIRTIO_BALLOON_F_PAGE_POISON
Added code to enable VIRTIO_BALLOON_F_PAGE_POISON if page reporting is enabled
Fixed possible resource leak if poison or qemu_balloon_is_inhibited return true

Changes from v21:
Added ack for patch 3
Rewrote patch description for page poison reporting feature
Made page-poison independent property and set to enabled by default
Added logic to migrate poison_val
Added several comments in code to better explain features
Switched free-page-reporting property to disabled by default

Changes from v22:
Added ack for patches 4 & 5
Added additional comment fixes in patch 3 to remove "reporting" reference
Renamed rvq in patch 5 to reporting_vq to improve readability
Moved call adding reporting_vq to after free_page_vq to fix VQ ordering

---

Alexander Duyck (5):
  linux-headers: Update to allow renaming of free_page_report_cmd_id
  linux-headers: update to contain virito-balloon free page reporting
  virtio-balloon: Replace free page hinting references to 'report' with 
'hint'
  virtio-balloon: Implement support for page poison reporting feature
  virtio-balloon: Provide an interface for free page reporting


 hw/virtio/virtio-balloon.c  |  176 ++-
 include/hw/virtio/virtio-balloon.h  |   23 ++-
 include/standard-headers/linux/virtio_balloon.h |   12 +-
 3 files changed, 159 insertions(+), 52 deletions(-)

--



[PATCH v23 QEMU 1/5] linux-headers: Update to allow renaming of free_page_report_cmd_id

2020-04-27 Thread Alexander Duyck
From: Alexander Duyck 

Sync to the latest upstream changes for free page hinting. To be
replaced by a full linux header sync.

Signed-off-by: Alexander Duyck 
---
 include/standard-headers/linux/virtio_balloon.h |   11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/standard-headers/linux/virtio_balloon.h 
b/include/standard-headers/linux/virtio_balloon.h
index 9375ca2a70de..af0a6b59dab2 100644
--- a/include/standard-headers/linux/virtio_balloon.h
+++ b/include/standard-headers/linux/virtio_balloon.h
@@ -47,8 +47,15 @@ struct virtio_balloon_config {
uint32_t num_pages;
/* Number of pages we've actually got in balloon. */
uint32_t actual;
-   /* Free page report command id, readonly by guest */
-   uint32_t free_page_report_cmd_id;
+   /*
+* Free page hint command id, readonly by guest.
+* Was previously name free_page_report_cmd_id so we
+* need to carry that name for legacy support.
+*/
+   union {
+   uint32_t free_page_hint_cmd_id;
+   uint32_t free_page_report_cmd_id;   /* deprecated */
+   };
/* Stores PAGE_POISON if page poisoning is in use */
uint32_t poison_val;
 };




Re: [PATCH v1 08/11] hw/arm: versal: Add support for SD

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:23 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Add support for SD.
>
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal.c | 31 +++
>  include/hw/arm/xlnx-versal.h | 12 
>  2 files changed, 43 insertions(+)
>
> diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
> index c8a296e2e0..e263bdf77a 100644
> --- a/hw/arm/xlnx-versal.c
> +++ b/hw/arm/xlnx-versal.c
> @@ -210,6 +210,36 @@ static void versal_create_admas(Versal *s, qemu_irq *pic)
>  }
>  }
>
> +#define SDHCI_CAPABILITIES  0x280737ec6481 /* Same as on ZynqMP.  */
> +static void versal_create_sds(Versal *s, qemu_irq *pic)
> +{
> +int i;
> +
> +for (i = 0; i < ARRAY_SIZE(s->pmc.iou.sd); i++) {
> +DeviceState *dev;
> +MemoryRegion *mr;
> +
> +sysbus_init_child_obj(OBJECT(s), "sd[*]",
> +  >pmc.iou.sd[i], sizeof(s->pmc.iou.sd[i]),
> +  TYPE_SYSBUS_SDHCI);
> +dev = DEVICE(>pmc.iou.sd[i]);
> +
> +object_property_set_uint(OBJECT(dev),
> + 3, "sd-spec-version", _fatal);
> +object_property_set_uint(OBJECT(dev), SDHCI_CAPABILITIES, "capareg",
> + _fatal);
> +object_property_set_uint(OBJECT(dev), UHS_I, "uhs", _fatal);
> +qdev_init_nofail(dev);
> +
> +mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
> +memory_region_add_subregion(>mr_ps,
> +MM_PMC_SD0 + i * MM_PMC_SD0_SIZE, mr);
> +
> +sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
> +   pic[VERSAL_SD0_IRQ_0 + i * 2]);
> +}
> +}
> +
>  /* This takes the board allocated linear DDR memory and creates aliases
>   * for each split DDR range/aperture on the Versal address map.
>   */
> @@ -292,6 +322,7 @@ static void versal_realize(DeviceState *dev, Error **errp)
>  versal_create_uarts(s, pic);
>  versal_create_gems(s, pic);
>  versal_create_admas(s, pic);
> +versal_create_sds(s, pic);
>  versal_map_ddr(s);
>  versal_unimp(s);
>
> diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
> index 426b66449d..e11693e29d 100644
> --- a/include/hw/arm/xlnx-versal.h
> +++ b/include/hw/arm/xlnx-versal.h
> @@ -14,6 +14,7 @@
>
>  #include "hw/sysbus.h"
>  #include "hw/arm/boot.h"
> +#include "hw/sd/sdhci.h"
>  #include "hw/intc/arm_gicv3.h"
>  #include "hw/char/pl011.h"
>  #include "hw/dma/xlnx-zdma.h"
> @@ -26,6 +27,7 @@
>  #define XLNX_VERSAL_NR_UARTS   2
>  #define XLNX_VERSAL_NR_GEMS2
>  #define XLNX_VERSAL_NR_ADMAS   8
> +#define XLNX_VERSAL_NR_SDS 2
>  #define XLNX_VERSAL_NR_IRQS192
>
>  typedef struct Versal {
> @@ -58,6 +60,13 @@ typedef struct Versal {
>  } iou;
>  } lpd;
>
> +/* The Platform Management Controller subsystem.  */
> +struct {
> +struct {
> +SDHCIState sd[XLNX_VERSAL_NR_SDS];
> +} iou;
> +} pmc;
> +
>  struct {
>  MemoryRegion *mr_ddr;
>  uint32_t psci_conduit;
> @@ -80,6 +89,7 @@ typedef struct Versal {
>  #define VERSAL_GEM1_IRQ_0  58
>  #define VERSAL_GEM1_WAKE_IRQ_0 59
>  #define VERSAL_ADMA_IRQ_0  60
> +#define VERSAL_SD0_IRQ_0   126
>
>  /* Architecturally reserved IRQs suitable for virtualization.  */
>  #define VERSAL_RSVD_IRQ_FIRST 111
> @@ -129,6 +139,8 @@ typedef struct Versal {
>  #define MM_FPD_CRF  0xfd1aU
>  #define MM_FPD_CRF_SIZE 0x14
>
> +#define MM_PMC_SD0  0xf104U
> +#define MM_PMC_SD0_SIZE 0x1
>  #define MM_PMC_CRP  0xf126U
>  #define MM_PMC_CRP_SIZE 0x1
>  #endif
> --
> 2.20.1
>
>



Re: [PATCH v1 07/11] hw/arm: versal: Embedd the APUs into the SoC type

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:20 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Embedd the APUs into the SoC type.
>
> Suggested-by: Peter Maydell 
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal-virt.c|  4 ++--
>  hw/arm/xlnx-versal.c | 19 +--
>  include/hw/arm/xlnx-versal.h |  2 +-
>  3 files changed, 8 insertions(+), 17 deletions(-)
>
> diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
> index 8a608074d1..d7be1ad494 100644
> --- a/hw/arm/xlnx-versal-virt.c
> +++ b/hw/arm/xlnx-versal-virt.c
> @@ -469,9 +469,9 @@ static void versal_virt_init(MachineState *machine)
>  s->binfo.get_dtb = versal_virt_get_dtb;
>  s->binfo.modify_dtb = versal_virt_modify_dtb;
>  if (machine->kernel_filename) {
> -arm_load_kernel(s->soc.fpd.apu.cpu[0], machine, >binfo);
> +arm_load_kernel(>soc.fpd.apu.cpu[0], machine, >binfo);
>  } else {
> -AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
> +AddressSpace *as = arm_boot_address_space(>soc.fpd.apu.cpu[0],
>>binfo);
>  /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 
> (NULL).
>   * Offset things by 4K.  */
> diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
> index ebd2dc51be..c8a296e2e0 100644
> --- a/hw/arm/xlnx-versal.c
> +++ b/hw/arm/xlnx-versal.c
> @@ -31,19 +31,11 @@ static void versal_create_apu_cpus(Versal *s)
>
>  for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
>  Object *obj;
> -char *name;
> -
> -obj = object_new(XLNX_VERSAL_ACPU_TYPE);
> -if (!obj) {
> -error_report("Unable to create apu.cpu[%d] of type %s",
> - i, XLNX_VERSAL_ACPU_TYPE);
> -exit(EXIT_FAILURE);
> -}
> -
> -name = g_strdup_printf("apu-cpu[%d]", i);
> -object_property_add_child(OBJECT(s), name, obj, _fatal);
> -g_free(name);
>
> +object_initialize_child(OBJECT(s), "apu-cpu[*]",
> +>fpd.apu.cpu[i], 
> sizeof(s->fpd.apu.cpu[i]),
> +XLNX_VERSAL_ACPU_TYPE, _abort, NULL);
> +obj = OBJECT(>fpd.apu.cpu[i]);
>  object_property_set_int(obj, s->cfg.psci_conduit,
>  "psci-conduit", _abort);
>  if (i) {
> @@ -57,7 +49,6 @@ static void versal_create_apu_cpus(Versal *s)
>  object_property_set_link(obj, OBJECT(>fpd.apu.mr), "memory",
>   _abort);
>  object_property_set_bool(obj, true, "realized", _fatal);
> -s->fpd.apu.cpu[i] = ARM_CPU(obj);
>  }
>  }
>
> @@ -95,7 +86,7 @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
>  }
>
>  for (i = 0; i < nr_apu_cpus; i++) {
> -DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
> +DeviceState *cpudev = DEVICE(>fpd.apu.cpu[i]);
>  int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
>  qemu_irq maint_irq;
>  int ti;
> diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
> index 94b7826fd4..426b66449d 100644
> --- a/include/hw/arm/xlnx-versal.h
> +++ b/include/hw/arm/xlnx-versal.h
> @@ -36,7 +36,7 @@ typedef struct Versal {
>  struct {
>  struct {
>  MemoryRegion mr;
> -ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
> +ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
>  GICv3State gic;
>  } apu;
>  } fpd;
> --
> 2.20.1
>
>



Re: [PATCH v1 06/11] hw/arm: versal: Embedd the ADMAs into the SoC type

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:22 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Embedd the ADMAs into the SoC type.
>
> Suggested-by: Peter Maydell 
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal.c | 14 +++---
>  include/hw/arm/xlnx-versal.h |  3 ++-
>  2 files changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
> index e424aa789e..ebd2dc51be 100644
> --- a/hw/arm/xlnx-versal.c
> +++ b/hw/arm/xlnx-versal.c
> @@ -203,18 +203,18 @@ static void versal_create_admas(Versal *s, qemu_irq 
> *pic)
>  DeviceState *dev;
>  MemoryRegion *mr;
>
> -dev = qdev_create(NULL, "xlnx.zdma");
> -s->lpd.iou.adma[i] = SYS_BUS_DEVICE(dev);
> -object_property_set_int(OBJECT(s->lpd.iou.adma[i]), 128, "bus-width",
> -_abort);
> -object_property_add_child(OBJECT(s), name, OBJECT(dev), 
> _fatal);
> +sysbus_init_child_obj(OBJECT(s), name,
> +  >lpd.iou.adma[i], 
> sizeof(s->lpd.iou.adma[i]),
> +  TYPE_XLNX_ZDMA);
> +dev = DEVICE(>lpd.iou.adma[i]);
> +object_property_set_int(OBJECT(dev), 128, "bus-width", _abort);
>  qdev_init_nofail(dev);
>
> -mr = sysbus_mmio_get_region(s->lpd.iou.adma[i], 0);
> +mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
>  memory_region_add_subregion(>mr_ps,
>  MM_ADMA_CH0 + i * MM_ADMA_CH0_SIZE, mr);
>
> -sysbus_connect_irq(s->lpd.iou.adma[i], 0, pic[VERSAL_ADMA_IRQ_0 + 
> i]);
> +sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[VERSAL_ADMA_IRQ_0 + 
> i]);
>  g_free(name);
>  }
>  }
> diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
> index 01da736a5b..94b7826fd4 100644
> --- a/include/hw/arm/xlnx-versal.h
> +++ b/include/hw/arm/xlnx-versal.h
> @@ -16,6 +16,7 @@
>  #include "hw/arm/boot.h"
>  #include "hw/intc/arm_gicv3.h"
>  #include "hw/char/pl011.h"
> +#include "hw/dma/xlnx-zdma.h"
>  #include "hw/net/cadence_gem.h"
>
>  #define TYPE_XLNX_VERSAL "xlnx-versal"
> @@ -53,7 +54,7 @@ typedef struct Versal {
>  struct {
>  PL011State uart[XLNX_VERSAL_NR_UARTS];
>  CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
> -SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
> +XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
>  } iou;
>  } lpd;
>
> --
> 2.20.1
>
>



Re: [PATCH v1 03/11] hw/arm: versal-virt: Fix typo xlnx-ve -> xlnx-versal

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:20 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Fix typo xlnx-ve -> xlnx-versal.
>
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal-virt.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
> index 878a275140..8a608074d1 100644
> --- a/hw/arm/xlnx-versal-virt.c
> +++ b/hw/arm/xlnx-versal-virt.c
> @@ -440,7 +440,7 @@ static void versal_virt_init(MachineState *machine)
>  psci_conduit = QEMU_PSCI_CONDUIT_SMC;
>  }
>
> -sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", >soc,
> +sysbus_init_child_obj(OBJECT(machine), "xlnx-versal", >soc,
>sizeof(s->soc), TYPE_XLNX_VERSAL);
>  object_property_set_link(OBJECT(>soc), OBJECT(machine->ram),
>   "ddr", _abort);
> --
> 2.20.1
>
>



Re: [PATCH v1 05/11] hw/arm: versal: Embedd the GEMs into the SoC type

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:20 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Embedd the GEMs into the SoC type.
>
> Suggested-by: Peter Maydell 
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal.c | 15 ---
>  include/hw/arm/xlnx-versal.h |  3 ++-
>  2 files changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
> index dbde03b7e6..e424aa789e 100644
> --- a/hw/arm/xlnx-versal.c
> +++ b/hw/arm/xlnx-versal.c
> @@ -170,25 +170,26 @@ static void versal_create_gems(Versal *s, qemu_irq *pic)
>  DeviceState *dev;
>  MemoryRegion *mr;
>
> -dev = qdev_create(NULL, "cadence_gem");
> -s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
> -object_property_add_child(OBJECT(s), name, OBJECT(dev), 
> _fatal);
> +sysbus_init_child_obj(OBJECT(s), name,
> +  >lpd.iou.gem[i], sizeof(s->lpd.iou.gem[i]),
> +  TYPE_CADENCE_GEM);
> +dev = DEVICE(>lpd.iou.gem[i]);
>  if (nd->used) {
>  qemu_check_nic_model(nd, "cadence_gem");
>  qdev_set_nic_properties(dev, nd);
>  }
> -object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
> +object_property_set_int(OBJECT(dev),
>  2, "num-priority-queues",
>  _abort);
> -object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
> +object_property_set_link(OBJECT(dev),
>   OBJECT(>mr_ps), "dma",
>   _abort);
>  qdev_init_nofail(dev);
>
> -mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
> +mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
>  memory_region_add_subregion(>mr_ps, addrs[i], mr);
>
> -sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
> +sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
>  g_free(name);
>  }
>  }
> diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
> index a3dfd064b3..01da736a5b 100644
> --- a/include/hw/arm/xlnx-versal.h
> +++ b/include/hw/arm/xlnx-versal.h
> @@ -16,6 +16,7 @@
>  #include "hw/arm/boot.h"
>  #include "hw/intc/arm_gicv3.h"
>  #include "hw/char/pl011.h"
> +#include "hw/net/cadence_gem.h"
>
>  #define TYPE_XLNX_VERSAL "xlnx-versal"
>  #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
> @@ -51,7 +52,7 @@ typedef struct Versal {
>
>  struct {
>  PL011State uart[XLNX_VERSAL_NR_UARTS];
> -SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
> +CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
>  SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
>  } iou;
>  } lpd;
> --
> 2.20.1
>
>



Re: [PATCH v1 04/11] hw/arm: versal: Embedd the UARTs into the SoC type

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:17 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Embedd the UARTs into the SoC type.
>
> Suggested-by: Peter Maydell 
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal.c | 12 ++--
>  include/hw/arm/xlnx-versal.h |  3 ++-
>  2 files changed, 8 insertions(+), 7 deletions(-)
>
> diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
> index cc696e44c0..dbde03b7e6 100644
> --- a/hw/arm/xlnx-versal.c
> +++ b/hw/arm/xlnx-versal.c
> @@ -21,7 +21,6 @@
>  #include "kvm_arm.h"
>  #include "hw/misc/unimp.h"
>  #include "hw/arm/xlnx-versal.h"
> -#include "hw/char/pl011.h"
>
>  #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
>  #define GEM_REVISION0x40070106
> @@ -144,16 +143,17 @@ static void versal_create_uarts(Versal *s, qemu_irq 
> *pic)
>  DeviceState *dev;
>  MemoryRegion *mr;
>
> -dev = qdev_create(NULL, TYPE_PL011);
> -s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
> +sysbus_init_child_obj(OBJECT(s), name,
> +  >lpd.iou.uart[i], 
> sizeof(s->lpd.iou.uart[i]),
> +  TYPE_PL011);
> +dev = DEVICE(>lpd.iou.uart[i]);
>  qdev_prop_set_chr(dev, "chardev", serial_hd(i));
> -object_property_add_child(OBJECT(s), name, OBJECT(dev), 
> _fatal);
>  qdev_init_nofail(dev);
>
> -mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);
> +mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
>  memory_region_add_subregion(>mr_ps, addrs[i], mr);
>
> -sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);
> +sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
>  g_free(name);
>  }
>  }
> diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
> index 6c0a692b2f..a3dfd064b3 100644
> --- a/include/hw/arm/xlnx-versal.h
> +++ b/include/hw/arm/xlnx-versal.h
> @@ -15,6 +15,7 @@
>  #include "hw/sysbus.h"
>  #include "hw/arm/boot.h"
>  #include "hw/intc/arm_gicv3.h"
> +#include "hw/char/pl011.h"
>
>  #define TYPE_XLNX_VERSAL "xlnx-versal"
>  #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
> @@ -49,7 +50,7 @@ typedef struct Versal {
>  MemoryRegion mr_ocm;
>
>  struct {
> -SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];
> +PL011State uart[XLNX_VERSAL_NR_UARTS];
>  SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
>  SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
>  } iou;
> --
> 2.20.1
>
>



Re: [PATCH 1/1] target/riscv: fix VS interrupts forwarding to HS

2020-04-27 Thread Alistair Francis
On Sat, Apr 18, 2020 at 11:01 AM Jose Martins  wrote:
>
> When vs interrupts (2, 6, 10) are enabled, pending and not delegated
> in hideleg, they are not always forwarded to hs mode after a return to
> vs mode. This happens independently of the state of spie and sie on
> the hs-level sstatus before the return. Instead, the vs-level status
> sie state seems to be controlling if the interrupt is forward to hs or
> not. This is both because, in riscv_cpu_local_irq_pending, vs
> interrupts are ignored when checking for hs pending interrupts and
> also because hs interrupts might not be considered enabled after
> jumping to vs mode if the spie (which implicitly is copied to sie) is
> not set when sret is executed. From what I could gather, the spec does
> not preclude hs mode from receiving vs interrupts if they are not
> delegated in hideleg (although this is true for m mode, but guaranteed
> by hardwiring the corresponding bits in mideleg). Also, it clearly
> states that: "Interrupts for higher-privilege modes, y>x, are always
> globally enabled regardless of the setting of the global yIE bit for
> the higher-privilege mode.", so hs_mstatus_sie must be set whenever
> virt is enabled. After solving the previous issue, the problem remains
> that when such interrupts are delegated in hideleg, there is still the
> need to check it when calculating pending_hs_irq, otherwise, we're
> still "forcing an hs except" when the interrupt should be forwarded to
> vs. I believe the following patch will fix this issue:
>
> Signed-off-by: Jose Martins 

Thanks for the patch!

I'm a little confused, do you mind explaining some things to me below.

> ---
>  target/riscv/cpu_helper.c | 7 +++
>  1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> index d3ba9efb02..9962ee4690 100644
> --- a/target/riscv/cpu_helper.c
> +++ b/target/riscv/cpu_helper.c
> @@ -43,8 +43,7 @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
>  target_ulong mstatus_sie = get_field(env->mstatus, MSTATUS_SIE);
>  target_ulong hs_mstatus_sie = get_field(env->mstatus_hs, MSTATUS_SIE);
>
> -target_ulong pending = env->mip & env->mie &
> -   ~(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP);
> +target_ulong pending = env->mip & env->mie;

If the Hypervisor sets the V* interrupts why does it then want to
receive the interrupt itself?

>  target_ulong vspending = (env->mip & env->mie &
>(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP));
>
> @@ -52,11 +51,11 @@ static int riscv_cpu_local_irq_pending(CPURISCVState *env)
>(env->priv == PRV_M && mstatus_mie);
>  target_ulong sie= env->priv < PRV_S ||
>(env->priv == PRV_S && mstatus_sie);
> -target_ulong hs_sie = env->priv < PRV_S ||
> +target_ulong hs_sie = riscv_cpu_virt_enabled(env) || env->priv < PRV_S ||
>(env->priv == PRV_S && hs_mstatus_sie);

Isn't hs_sie only ever accessed if riscv_cpu_virt_enabled(env)?
Doesn't this just set hs_sie to always be 1?

>
>  if (riscv_cpu_virt_enabled(env)) {
> -target_ulong pending_hs_irq = pending & -hs_sie;
> +target_ulong pending_hs_irq = pending & ~env->hideleg & -hs_sie;

This change looks good.

Alistair

>
>  if (pending_hs_irq) {
>  riscv_cpu_set_force_hs_excep(env, FORCE_HS_EXCEP);
> --
> 2.17.1
>



[PATCH RFC v3 1/3] target/arm: Implement SVE2 AESMC, AESIMC

2020-04-27 Thread Stephen Long
Signed-off-by: Stephen Long 
---
 target/arm/crypto_helper.c | 36 +---
 target/arm/sve.decode  | 10 ++
 target/arm/translate-sve.c | 20 
 3 files changed, 51 insertions(+), 15 deletions(-)

diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
index f800266727..ae2ea018af 100644
--- a/target/arm/crypto_helper.c
+++ b/target/arm/crypto_helper.c
@@ -14,6 +14,7 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "crypto/aes.h"
+#include "tcg/tcg-gvec-desc.h"
 
 union CRYPTO_STATE {
 uint8_tbytes[16];
@@ -54,7 +55,7 @@ void HELPER(crypto_aese)(void *vd, void *vm, uint32_t decrypt)
 rd[1] = st.l[1];
 }
 
-void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t decrypt)
+void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t desc)
 {
 static uint32_t const mc[][256] = { {
 /* MixColumns lookup table */
@@ -190,23 +191,28 @@ void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t 
decrypt)
 0xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
 } };
 
-uint64_t *rd = vd;
-uint64_t *rm = vm;
-union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
-int i;
+intptr_t i, opr_sz = simd_oprsz(desc);
+intptr_t decrypt = simd_data(desc);
 
-assert(decrypt < 2);
+for (i = 0; i < opr_sz; i += 16) {
+uint64_t *rd = vd + i;
+uint64_t *rm = vm + i;
+union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
+int i;
 
-for (i = 0; i < 16; i += 4) {
-CR_ST_WORD(st, i >> 2) =
-mc[decrypt][CR_ST_BYTE(st, i)] ^
-rol32(mc[decrypt][CR_ST_BYTE(st, i + 1)], 8) ^
-rol32(mc[decrypt][CR_ST_BYTE(st, i + 2)], 16) ^
-rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
-}
+assert(decrypt < 2);
 
-rd[0] = st.l[0];
-rd[1] = st.l[1];
+for (i = 0; i < 16; i += 4) {
+CR_ST_WORD(st, i >> 2) =
+mc[decrypt][CR_ST_BYTE(st, i)] ^
+rol32(mc[decrypt][CR_ST_BYTE(st, i + 1)], 8) ^
+rol32(mc[decrypt][CR_ST_BYTE(st, i + 2)], 16) ^
+rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
+}
+
+rd[0] = st.l[0];
+rd[1] = st.l[1];
+}
 }
 
 /*
diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index de3768c24a..f58eb04d11 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -92,6 +92,10 @@
 # Named instruction formats.  These are generally used to
 # reduce the amount of duplication between instruction patterns.
 
+# One operand with unused vector element size
+@rdn_e0  .. ... . . rd:5 \
+_esz rn=%reg_movprfx esz=0
+
 # Two operand with unused vector element size
 @pd_pn_e0     ... rn:4 . rd:4   _esz esz=0
 
@@ -1419,3 +1423,9 @@ STNT1_zprz  1110010 .. 00 . 001 ... . . \
 # SVE2 32-bit scatter non-temporal store (vector plus scalar)
 STNT1_zprz  1110010 .. 10 . 001 ... . . \
 @rprr_scatter_store xs=0 esz=2 scale=0
+
+ SVE2 Crypto Extensions
+
+## SVE2 crypto unary operations
+AESMC   01000101 00 1011100 0 0 .   @rdn_e0
+AESIMC  01000101 00 1011100 1 0 .   @rdn_e0
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index 86c3d0ed11..6523621d21 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -7956,3 +7956,23 @@ static bool trans_SQRDCMLAH_(DisasContext *s, 
arg_CMLA_ *a)
 };
 return do_sve2__fn(s, a->rd, a->rn, a->rm, a->ra, fns[a->esz], a->rot);
 }
+
+#define DO_SVE2_AES_CRYPTO(NAME, name, DECRYPT) \
+static bool trans_##NAME(DisasContext *s, arg_rr_esz *a)\
+{   \
+if (!dc_isar_feature(aa64_sve2_aes, s)) {   \
+return false;   \
+}   \
+if (sve_access_check(s)) {  \
+unsigned vsz = vec_full_reg_size(s);\
+tcg_gen_gvec_2_ool(vec_full_reg_offset(s, a->rd),   \
+   vec_full_reg_offset(s, a->rn),   \
+   vsz, vsz, DECRYPT, gen_helper_crypto_##name);\
+}   \
+return true;\
+}
+
+DO_SVE2_AES_CRYPTO(AESMC, aesmc, 0)
+DO_SVE2_AES_CRYPTO(AESIMC, aesmc, 1)
+DO_SVE2_AES_CRYPTO(AESE, aese, 0)
+DO_SVE2_AES_CRYPTO(AESD, aese, 1)
-- 
2.17.1




[PATCH RFC v3 3/3] target/arm: Implement SVE2 SM4EKEY, RAX1

2020-04-27 Thread Stephen Long
Signed-off-by: Stephen Long 
---
 target/arm/crypto_helper.c | 12 
 target/arm/helper-sve.h|  1 +
 target/arm/helper.h|  2 ++
 target/arm/sve.decode  |  4 
 target/arm/sve_helper.c|  8 
 target/arm/translate-sve.c | 30 ++
 6 files changed, 57 insertions(+)

diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
index 45740c1bfd..0720b3b98f 100644
--- a/target/arm/crypto_helper.c
+++ b/target/arm/crypto_helper.c
@@ -705,3 +705,15 @@ void HELPER(crypto_sm4ekey)(void *vd, void *vn, void* vm)
 rd[0] = d.l[0];
 rd[1] = d.l[1];
 }
+
+void HELPER(crypto_rax1)(void *vd, void *vn, void *vm, uint32_t desc)
+{
+intptr_t i, opr_sz = simd_oprsz(desc) / 8;
+uint64_t *d = vd, *n = vn, *m = vm;
+
+for (i = 0; i < opr_sz; ++i) {
+uint64_t nn = n[i];
+uint64_t mm = m[i];
+d[i] = nn ^ rol64(mm, 1);
+}
+}
diff --git a/target/arm/helper-sve.h b/target/arm/helper-sve.h
index 7eef4eb476..059003c26e 100644
--- a/target/arm/helper-sve.h
+++ b/target/arm/helper-sve.h
@@ -2692,3 +2692,4 @@ DEF_HELPER_FLAGS_6(fmmla_s, TCG_CALL_NO_RWG, void, ptr, 
ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_6(fmmla_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, ptr, 
i32)
 
 DEF_HELPER_FLAGS_3(sve2_sm4e, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_sm4ekey, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
diff --git a/target/arm/helper.h b/target/arm/helper.h
index 37f489412c..c74cea76a2 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -537,6 +537,8 @@ DEF_HELPER_FLAGS_3(crypto_sm3partw2, TCG_CALL_NO_RWG, void, 
ptr, ptr, ptr)
 DEF_HELPER_FLAGS_2(crypto_sm4e, TCG_CALL_NO_RWG, void, ptr, ptr)
 DEF_HELPER_FLAGS_3(crypto_sm4ekey, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
 
+DEF_HELPER_FLAGS_4(crypto_rax1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+
 DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
 
diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index 1cb5792bb1..278530ca83 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -1435,3 +1435,7 @@ AESIMC  01000101 00 1011100 1 0 .   
@rdn_e0
 AESE01000101 00 10001 0 11100 0 . .  @pd5_pn5_e0
 AESD01000101 00 10001 0 11100 1 . .  @pd5_pn5_e0
 SM4E01000101 00 10001 1 11100 0 . .  @pd5_pn5_e0
+
+## SVE2 crypto constructive binary operations
+SM4EKEY 01000101 00 1 . 0 0 . .  @rd_rn_rm_e0
+RAX101000101 00 1 . 0 1 . .  @rd_rn_rm_e0
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index b3a7594981..3b560e702a 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -7524,3 +7524,11 @@ void HELPER(sve2_sm4e)(void *vd, void *vn, uint32_t desc)
 HELPER(crypto_sm4e)(vd + i, vn + i);
 }
 }
+
+void HELPER(sve2_sm4ekey)(void *vd, void *vn, void *vm, uint32_t desc)
+{
+intptr_t i, opr_sz = simd_oprsz(desc);
+for (i = 0; i < opr_sz; i += 16) {
+HELPER(crypto_sm4ekey)(vd + i, vn + i, vm + i);
+}
+}
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index 4253955471..affe41779b 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -7990,3 +7990,33 @@ static bool trans_SM4E(DisasContext *s, arg_rr_esz *a)
 }
 return true;
 }
+
+static bool trans_SM4EKEY(DisasContext *s, arg_rrr_esz *a)
+{
+if (!dc_isar_feature(aa64_sve2_sm4, s)) {
+return false;
+}
+if (sve_access_check(s)) {
+unsigned vsz = vec_full_reg_size(s);
+tcg_gen_gvec_3_ool(vec_full_reg_offset(s, a->rd),
+   vec_full_reg_offset(s, a->rn),
+   vec_full_reg_offset(s, a->rm),
+   vsz, vsz, 0, gen_helper_sve2_sm4ekey);
+}
+return true;
+}
+
+static bool trans_RAX1(DisasContext *s, arg_rrr_esz *a)
+{
+if (!dc_isar_feature(aa64_sve2_sm4, s)) {
+return false;
+}
+if (sve_access_check(s)) {
+unsigned vsz = vec_full_reg_size(s);
+tcg_gen_gvec_3_ool(vec_full_reg_offset(s, a->rd),
+   vec_full_reg_offset(s, a->rn),
+   vec_full_reg_offset(s, a->rm),
+   vsz, vsz, 0, gen_helper_crypto_rax1);
+}
+return true;
+}
-- 
2.17.1




[PATCH RFC v3 2/3] target/arm: Implement SVE2 AESE, AESD, SM4E

2020-04-27 Thread Stephen Long
Signed-off-by: Stephen Long 
---
 target/arm/cpu.h   |  5 +
 target/arm/crypto_helper.c | 38 ++
 target/arm/helper-sve.h|  2 ++
 target/arm/sve.decode  |  6 ++
 target/arm/sve_helper.c|  8 
 target/arm/translate-sve.c | 14 ++
 6 files changed, 57 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index d41c4a08c0..8b1dc38b9c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3880,6 +3880,11 @@ static inline bool isar_feature_aa64_sve2_f64mm(const 
ARMISARegisters *id)
 return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, F64MM) != 0;
 }
 
+static inline bool isar_feature_aa64_sve2_sm4(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, SM4) != 0;
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
index ae2ea018af..45740c1bfd 100644
--- a/target/arm/crypto_helper.c
+++ b/target/arm/crypto_helper.c
@@ -30,29 +30,35 @@ union CRYPTO_STATE {
 #define CR_ST_WORD(state, i)   (state.words[i])
 #endif
 
-void HELPER(crypto_aese)(void *vd, void *vm, uint32_t decrypt)
+void HELPER(crypto_aese)(void *vd, void *vm, uint32_t desc)
 {
 static uint8_t const * const sbox[2] = { AES_sbox, AES_isbox };
 static uint8_t const * const shift[2] = { AES_shifts, AES_ishifts };
-uint64_t *rd = vd;
-uint64_t *rm = vm;
-union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
-union CRYPTO_STATE st = { .l = { rd[0], rd[1] } };
-int i;
 
-assert(decrypt < 2);
+intptr_t i, opr_sz = simd_oprsz(desc);
+intptr_t decrypt = simd_data(desc);
 
-/* xor state vector with round key */
-rk.l[0] ^= st.l[0];
-rk.l[1] ^= st.l[1];
+for (i = 0; i < opr_sz; i += 16) {
+uint64_t *rd = vd + i;
+uint64_t *rm = vm + i;
+union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
+union CRYPTO_STATE st = { .l = { rd[0], rd[1] } };
+int i;
 
-/* combine ShiftRows operation and sbox substitution */
-for (i = 0; i < 16; i++) {
-CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, shift[decrypt][i])];
-}
+assert(decrypt < 2);
+
+/* xor state vector with round key */
+rk.l[0] ^= st.l[0];
+rk.l[1] ^= st.l[1];
+
+/* combine ShiftRows operation and sbox substitution */
+for (i = 0; i < 16; i++) {
+CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, 
shift[decrypt][i])];
+}
 
-rd[0] = st.l[0];
-rd[1] = st.l[1];
+rd[0] = st.l[0];
+rd[1] = st.l[1];
+}
 }
 
 void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t desc)
diff --git a/target/arm/helper-sve.h b/target/arm/helper-sve.h
index 51ad60e5c3..7eef4eb476 100644
--- a/target/arm/helper-sve.h
+++ b/target/arm/helper-sve.h
@@ -2690,3 +2690,5 @@ DEF_HELPER_FLAGS_5(sve2_sqrdcmlah__d, TCG_CALL_NO_RWG,
 
 DEF_HELPER_FLAGS_6(fmmla_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, ptr, 
i32)
 DEF_HELPER_FLAGS_6(fmmla_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, ptr, 
i32)
+
+DEF_HELPER_FLAGS_3(sve2_sm4e, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index f58eb04d11..1cb5792bb1 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -98,6 +98,7 @@
 
 # Two operand with unused vector element size
 @pd_pn_e0     ... rn:4 . rd:4   _esz esz=0
+@pd5_pn5_e0   .. rn:5 rd:5  _esz esz=0
 
 # Two operand
 @pd_pn   esz:2 ..  ... rn:4 . rd:4  _esz
@@ -1429,3 +1430,8 @@ STNT1_zprz  1110010 .. 10 . 001 ... . . \
 ## SVE2 crypto unary operations
 AESMC   01000101 00 1011100 0 0 .   @rdn_e0
 AESIMC  01000101 00 1011100 1 0 .   @rdn_e0
+
+## SVE2 crpyto destructive binary operations
+AESE01000101 00 10001 0 11100 0 . .  @pd5_pn5_e0
+AESD01000101 00 10001 0 11100 1 . .  @pd5_pn5_e0
+SM4E01000101 00 10001 1 11100 0 . .  @pd5_pn5_e0
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index cd5c6f7fb0..b3a7594981 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -7516,3 +7516,11 @@ void HELPER(fmmla_d)(void *vd, void *va, void *vn, void 
*vm,
 d[3] = float64_add(a[3], float64_add(p0, p1, status), status);
 }
 }
+
+void HELPER(sve2_sm4e)(void *vd, void *vn, uint32_t desc)
+{
+intptr_t i, opr_sz = simd_oprsz(desc);
+for (i = 0; i < opr_sz; i += 16) {
+HELPER(crypto_sm4e)(vd + i, vn + i);
+}
+}
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index 6523621d21..4253955471 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -7976,3 +7976,17 @@ DO_SVE2_AES_CRYPTO(AESMC, aesmc, 0)
 DO_SVE2_AES_CRYPTO(AESIMC, aesmc, 1)
 DO_SVE2_AES_CRYPTO(AESE, 

[PATCH RFC v3 0/3] target/arm: Implement SVE2 Crypto Extensions

2020-04-27 Thread Stephen Long
Modified some of the crypto functions in crypto_helper.c to take in a
desc parameter.

Didn't add a desc parameter to SM4E and SM4EKEY since it is used in
translate-a64.c and the functions in there need crypto_sm4e and
crypto_sm4ekey to stay the same type (i.e. take 2 or 3 parameters)

Stephen Long (3):
  target/arm: Implement SVE2 AESMC, AESIMC
  target/arm: Implement SVE2 AESE, AESD, SM4E
  target/arm: Implement SVE2 SM4EKEY, RAX1

 target/arm/cpu.h   |  5 +++
 target/arm/crypto_helper.c | 86 --
 target/arm/helper-sve.h|  3 ++
 target/arm/helper.h|  2 +
 target/arm/sve.decode  | 20 +
 target/arm/sve_helper.c| 16 +++
 target/arm/translate-sve.c | 64 
 7 files changed, 165 insertions(+), 31 deletions(-)

-- 
2.17.1




Re: About hardfloat in ppc

2020-04-27 Thread Yonggang Luo
I am confusing why only  inexact  are set then we can use hard-float.
And PPC always clearing inexact  flag before calling to soft-float
funcitons. so we can not
optimize it with hard-float.
I need some resouces about ineact flag and why always clearing inexcat in
PPC FP simualtion.
I am looking for two possible solution:
1. do not clear inexact flag in PPC simulation
2. even the inexact are cleared, we can still use alternative hard-float.

But now I am the beginner, Have no clue about all the things.

On Mon, Apr 27, 2020 at 7:10 PM Alex Bennée  wrote:

>
> BALATON Zoltan  writes:
>
> > On Mon, 27 Apr 2020, Alex Bennée wrote:
> >> 罗勇刚(Yonggang Luo)  writes:
> >>> Because ppc fpu-helper are always clearing float_flag_inexact,
> >>> So is that possible to optimize the performance when
> float_flag_inexact
> >>> are cleared?
> >>
> >> There was some discussion about this in the last thread about enabling
> >> hardfloat for PPC. See the thread:
> >>
> >>  Subject: [RFC PATCH v2] target/ppc: Enable hardfloat for PPC
> >>  Date: Tue, 18 Feb 2020 18:10:16 +0100
> >>  Message-Id: <20200218171702.979f0746...@zero.eik.bme.hu>
> >
> > I've answered this already with link to that thread here:
> >
> > On Fri, 10 Apr 2020, BALATON Zoltan wrote:
> > : Date: Fri, 10 Apr 2020 20:04:53 +0200 (CEST)
> > : From: BALATON Zoltan 
> > : To: "罗勇刚(Yonggang Luo)" 
> > : Cc: qemu-devel@nongnu.org, Mark Cave-Ayland, John Arbuckle,
> qemu-...@nongnu.org, Paul Clarke, Howard Spoelstra, David Gibson
> > : Subject: Re: [RFC PATCH v2] target/ppc: Enable hardfloat for PPC
> > :
> > : On Fri, 10 Apr 2020, 罗勇刚(Yonggang Luo) wrote:
> > :> Are this stable now? I'd like to see hard float to be landed:)
> > :
> > : If you want to see hardfloat for PPC then you should read the
> > replies to : this patch which can be found here:
> > :
> > : http://patchwork.ozlabs.org/patch/1240235/
> > :
> > : to understand what's needed then try to implement the solution with
> > FP : exceptions cached in a global that maybe could work. I won't be
> > able to : do that as said here:
> > :
> > : https://lists.nongnu.org/archive/html/qemu-ppc/2020-03/msg6.html
> > :
> > : because I don't have time to learn all the details needed. I think :
> > others are in the same situation so unless somebody puts in the :
> > necessary effort this won't change.
> >
> > Which also had a proposed solution to the problem that you could try
> > to implement, in particular see this message:
> >
> >
> http://patchwork.ozlabs.org/project/qemu-devel/patch/20200218171702.979f0746...@zero.eik.bme.hu/#2375124
> >
> > amd Richard's reply immediately below that. In short to optimise FPU
> > emulation we would either find a way to compute inexact flag quickly
> > without reading the FPU status (this may not be possible) or somehow
> > get status from the FPU but the obvious way of claring the flag and
> > reading them after each operation is too slow. So maybe using
> > exceptions and only clearing when actually there's a change could be
> > faster.
> >
> > As to how to use exceptions see this message in above thread:
> >
> > https://lists.nongnu.org/archive/html/qemu-ppc/2020-03/msg5.html
> >
> > But that's only to show how to hook in an exception handler what it
> > does needs to be implemented. Then tested and benchmarked.
> >
> > I still don't know where are the extensive PPC floating point tests to
> > use for checking results though as that was never answered.
>
> Specifically for PPC we don't have them. We use the softfloat test cases
> to exercise our softfloat/hardfloat code as part of "make
> check-softfloat". You can also re-build fp-bench for each guest target
> to measure raw throughput.
>
> >> However in short the problem is if the float_flag_inexact is clear you
> >> must use softfloat so you can properly calculate the inexact status. We
> >> can't take advantage of the inexact stickiness without loosing the
> >> fidelity of the calculation.
> >
> > I still don't get why can't we use hardware via exception handler to
> > detect flags for us and why do we only use hardfloat in some corner
> > cases. If reading the status is too costly then we could mirror it in
> > a global which is set by an FP exception handler. Shouldn't that be
> > faster? Is there a reason that can't work?
>
> It would work but it would be slow. Almost every FP operation sets
> the inexact flag so it would generate an exception and exceptions take
> time to process.
>
> For the guests where we use hardfloat operations with inexact already
> latched is not a corner case - it is the common case which is why it
> helps.
>
> >
> > Regards,
> > BALATON Zoltan
>
>
> --
> Alex Bennée
>


-- 
 此致
礼
罗勇刚
Yours
sincerely,
Yonggang Luo


Re: [PATCH] linux-user/riscv: Fix target_ucontext and target_sigcontext

2020-04-27 Thread no-reply
Patchew URL: 
https://patchew.org/QEMU/20200427201120.1500504-1-aman...@gmail.com/



Hi,

This series failed the asan build test. Please find the testing commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
export ARCH=x86_64
make docker-image-fedora V=1 NETWORK=1
time make docker-test-debug@fedora TARGET_LIST=x86_64-softmmu J=14 NETWORK=1
=== TEST SCRIPT END ===

PASS 32 test-opts-visitor /visitor/opts/range/beyond
PASS 33 test-opts-visitor /visitor/opts/dict/unvisited
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-coroutine -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-coroutine" 
==6188==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
==6188==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 
0x7fff736dc000; bottom 0x7f097d896000; size: 0x00f5f5e46000 (1056392372224)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 3 endianness-test /x86_64/endianness/combine/pc
---
PASS 1 fdc-test /x86_64/fdc/cmos
PASS 2 fdc-test /x86_64/fdc/no_media_on_start
PASS 3 fdc-test /x86_64/fdc/read_without_media
==6198==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 4 fdc-test /x86_64/fdc/media_change
PASS 5 fdc-test /x86_64/fdc/sense_interrupt
PASS 6 fdc-test /x86_64/fdc/relative_seek
---
PASS 11 test-aio /aio/event/wait
PASS 12 test-aio /aio/event/flush
PASS 13 test-aio /aio/event/wait/no-flush-cb
==6213==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 14 test-aio /aio/timer/schedule
PASS 15 test-aio /aio/coroutine/queue-chaining
PASS 16 test-aio /aio-gsource/flush
---
PASS 11 fdc-test /x86_64/fdc/read_no_dma_18
PASS 28 test-aio /aio-gsource/timer/schedule
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-aio-multithread -m=quick -k --tap < /dev/null | 
./scripts/tap-driver.pl --test-name="test-aio-multithread" 
==6218==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 test-aio-multithread /aio/multi/lifecycle
PASS 2 test-aio-multithread /aio/multi/schedule
PASS 3 test-aio-multithread /aio/multi/mutex/contended
PASS 12 fdc-test /x86_64/fdc/read_no_dma_19
PASS 13 fdc-test /x86_64/fdc/fuzz-registers
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img 
tests/qtest/ide-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="ide-test" 
==6245==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 ide-test /x86_64/ide/identify
PASS 4 test-aio-multithread /aio/multi/mutex/handoff
==6251==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 2 ide-test /x86_64/ide/flush
PASS 5 test-aio-multithread /aio/multi/mutex/mcs
==6262==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 3 ide-test /x86_64/ide/bmdma/simple_rw
==6273==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 4 ide-test /x86_64/ide/bmdma/trim
PASS 6 test-aio-multithread /aio/multi/mutex/pthread
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-throttle -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-throttle" 
==6282==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 test-throttle /throttle/leak_bucket
PASS 2 test-throttle /throttle/compute_wait
PASS 3 test-throttle /throttle/init
---
PASS 14 test-throttle /throttle/config/max
PASS 15 test-throttle /throttle/config/iops_size
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-thread-pool -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-thread-pool" 
==6286==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 test-thread-pool /thread-pool/submit
PASS 2 test-thread-pool /thread-pool/submit-aio
PASS 3 test-thread-pool /thread-pool/submit-co
PASS 4 test-thread-pool /thread-pool/submit-many
==6279==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 5 test-thread-pool /thread-pool/cancel
PASS 6 test-thread-pool /thread-pool/cancel-async
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-hbitmap -m=quick -k --tap < /dev/null | 

Re: [PATCH] linux-user/riscv: Fix target_ucontext and target_sigcontext

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 1:11 PM Amanieu d'Antras  wrote:
>
> These now match the field layout used by the kernel.
>
> Signed-off-by: Amanieu d'Antras 

Thanks for the patch!

Unfortunately this fixed has already been applied to the RISC-V tree
(https://github.com/alistair23/qemu/tree/riscv-to-apply) and will be
merged once the 5.1 development window opens up.

Alistair

> ---
>  linux-user/riscv/signal.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
> index 83ecc6f799..2b15e32a7b 100644
> --- a/linux-user/riscv/signal.c
> +++ b/linux-user/riscv/signal.c
> @@ -32,7 +32,7 @@
>  struct target_sigcontext {
>  abi_long pc;
>  abi_long gpr[31]; /* x0 is not present, so all offsets must be -1 */
> -uint64_t fpr[32];
> +uint64_t fpr[32] __attribute__((aligned(16)));
>  uint32_t fcsr;
>  }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
>
> @@ -40,8 +40,9 @@ struct target_ucontext {
>  unsigned long uc_flags;
>  struct target_ucontext *uc_link;
>  target_stack_t uc_stack;
> -struct target_sigcontext uc_mcontext;
>  target_sigset_t uc_sigmask;
> +char __unused[1024 / 8 - sizeof(target_sigset_t)];
> +struct target_sigcontext uc_mcontext;
>  };
>
>  struct target_rt_sigframe {
> --
> 2.26.1
>
>



Re: [PATCH 0/2] virt: Set tpm-tis-device ppi property to off by default

2020-04-27 Thread Stefan Berger

On 4/27/20 10:31 AM, Eric Auger wrote:

Instead of using a compat in the mach-virt machine to force
PPI off for all virt machines (PPI not supported by the
tpm-tis-device device), let's simply change the default value
in the sysbus device.


There is no change in behavior on any arm machine due to this patch, 
right? So backporting would not be necessary?



   Stefan





Re: [PATCH v1 02/11] hw/arm: versal: Move misplaced comment

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:25 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Move misplaced comment.
>
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
> index c73b2fe755..cc696e44c0 100644
> --- a/hw/arm/xlnx-versal.c
> +++ b/hw/arm/xlnx-versal.c
> @@ -36,7 +36,6 @@ static void versal_create_apu_cpus(Versal *s)
>
>  obj = object_new(XLNX_VERSAL_ACPU_TYPE);
>  if (!obj) {
> -/* Secondary CPUs start in PSCI powered-down state */
>  error_report("Unable to create apu.cpu[%d] of type %s",
>   i, XLNX_VERSAL_ACPU_TYPE);
>  exit(EXIT_FAILURE);
> @@ -49,6 +48,7 @@ static void versal_create_apu_cpus(Versal *s)
>  object_property_set_int(obj, s->cfg.psci_conduit,
>  "psci-conduit", _abort);
>  if (i) {
> +/* Secondary CPUs start in PSCI powered-down state */
>  object_property_set_bool(obj, true,
>   "start-powered-off", _abort);
>  }
> --
> 2.20.1
>
>



Re: [PATCH v1 01/11] hw/arm: versal: Remove inclusion of arm_gicv3_common.h

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 11:17 AM Edgar E. Iglesias
 wrote:
>
> From: "Edgar E. Iglesias" 
>
> Remove inclusion of arm_gicv3_common.h, this already gets
> included via xlnx-versal.h.
>
> Signed-off-by: Edgar E. Iglesias 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/arm/xlnx-versal.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
> index 94460f2343..c73b2fe755 100644
> --- a/hw/arm/xlnx-versal.c
> +++ b/hw/arm/xlnx-versal.c
> @@ -20,7 +20,6 @@
>  #include "hw/arm/boot.h"
>  #include "kvm_arm.h"
>  #include "hw/misc/unimp.h"
> -#include "hw/intc/arm_gicv3_common.h"
>  #include "hw/arm/xlnx-versal.h"
>  #include "hw/char/pl011.h"
>
> --
> 2.20.1
>
>



[PATCH] linux-user/riscv: Fix target_ucontext and target_sigcontext

2020-04-27 Thread Amanieu d'Antras
These now match the field layout used by the kernel.

Signed-off-by: Amanieu d'Antras 
---
 linux-user/riscv/signal.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
index 83ecc6f799..2b15e32a7b 100644
--- a/linux-user/riscv/signal.c
+++ b/linux-user/riscv/signal.c
@@ -32,7 +32,7 @@
 struct target_sigcontext {
 abi_long pc;
 abi_long gpr[31]; /* x0 is not present, so all offsets must be -1 */
-uint64_t fpr[32];
+uint64_t fpr[32] __attribute__((aligned(16)));
 uint32_t fcsr;
 }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
 
@@ -40,8 +40,9 @@ struct target_ucontext {
 unsigned long uc_flags;
 struct target_ucontext *uc_link;
 target_stack_t uc_stack;
-struct target_sigcontext uc_mcontext;
 target_sigset_t uc_sigmask;
+char __unused[1024 / 8 - sizeof(target_sigset_t)];
+struct target_sigcontext uc_mcontext;
 };
 
 struct target_rt_sigframe {
-- 
2.26.1




Re: [PATCH v2 0/2] hw/pci/pcie: Forbid hot-plug if it's disabled on the slot

2020-04-27 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20200427182440.92433-1-jus...@redhat.com/



Hi,

This series failed the docker-quick@centos7 build test. Please find the testing 
commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
make docker-image-centos7 V=1 NETWORK=1
time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
=== TEST SCRIPT END ===

  TESTcheck-unit: tests/test-qht
socket_accept failed: Resource temporarily unavailable
**
ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake:
 assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
/tmp/qemu-test/src/tests/qtest/libqtest.c:166: kill_qemu() tried to terminate 
QEMU process but encountered exit status 1 (expected 0)
ERROR - Bail out! 
ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake:
 assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
make: *** [check-qtest-aarch64] Error 1
make: *** Waiting for unfinished jobs
  TESTiotest-qcow2: 022
  TESTcheck-unit: tests/test-qht-par
---
  TESTiotest-qcow2: 039
socket_accept failed: Resource temporarily unavailable
**
ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake:
 assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
/tmp/qemu-test/src/tests/qtest/libqtest.c:166: kill_qemu() tried to terminate 
QEMU process but encountered exit status 1 (expected 0)
ERROR - Bail out! 
ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake:
 assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
make: *** [check-qtest-x86_64] Error 1
  TESTiotest-qcow2: 040
  TESTiotest-qcow2: 041
  TESTiotest-qcow2: 042
---
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', 
'--label', 'com.qemu.instance.uuid=c66f60264261441e87b973b137ab56d7', '-u', 
'1003', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=', 
'-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 
'SHOW_ENV=1', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', 
'/home/patchew2/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', 
'/var/tmp/patchew-tester-tmp-ksshgsdx/src/docker-src.2020-04-27-15.54.25.26190:/var/tmp/qemu:z,ro',
 'qemu:centos7', '/var/tmp/qemu/run', 'test-quick']' returned non-zero exit 
status 2.
filter=--filter=label=com.qemu.instance.uuid=c66f60264261441e87b973b137ab56d7
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-ksshgsdx/src'
make: *** [docker-run-test-quick@centos7] Error 2

real16m11.272s
user0m9.880s


The full log is available at
http://patchew.org/logs/20200427182440.92433-1-jus...@redhat.com/testing.docker-quick@centos7/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

Re: [PATCH v20 3/4] qcow2: add zstd cluster compression

2020-04-27 Thread Denis Plotnikov




On 27.04.2020 15:35, Max Reitz wrote:

On 21.04.20 10:11, Denis Plotnikov wrote:

zstd significantly reduces cluster compression time.
It provides better compression performance maintaining
the same level of the compression ratio in comparison with
zlib, which, at the moment, is the only compression
method available.

The performance test results:
Test compresses and decompresses qemu qcow2 image with just
installed rhel-7.6 guest.
Image cluster size: 64K. Image on disk size: 2.2G

The test was conducted with brd disk to reduce the influence
of disk subsystem to the test results.
The results is given in seconds.

compress cmd:
   time ./qemu-img convert -O qcow2 -c -o compression_type=[zlib|zstd]
   src.img [zlib|zstd]_compressed.img
decompress cmd
   time ./qemu-img convert -O qcow2
   [zlib|zstd]_compressed.img uncompressed.img

compression   decompression
  zlib   zstd   zlib zstd

real 65.5   16.3 (-75 %)1.9  1.6 (-16 %)
user 65.0   15.85.3  2.5
sys   3.30.22.0  2.0

Both ZLIB and ZSTD gave the same compression ratio: 1.57
compressed image size in both cases: 1.4G

Signed-off-by: Denis Plotnikov 
Reviewed-by: Vladimir Sementsov-Ogievskiy 
Reviewed-by: Alberto Garcia 
QAPI part:
Acked-by: Markus Armbruster 
---
  docs/interop/qcow2.txt |   1 +
  configure  |   2 +-
  qapi/block-core.json   |   3 +-
  block/qcow2-threads.c  | 157 +
  block/qcow2.c  |   7 ++
  5 files changed, 168 insertions(+), 2 deletions(-)

[...]


diff --git a/block/qcow2-threads.c b/block/qcow2-threads.c
index 7dbaf53489..0525718704 100644
--- a/block/qcow2-threads.c
+++ b/block/qcow2-threads.c
@@ -28,6 +28,11 @@
  #define ZLIB_CONST
  #include 
  
+#ifdef CONFIG_ZSTD

+#include 
+#include 
+#endif
+
  #include "qcow2.h"
  #include "block/thread-pool.h"
  #include "crypto.h"
@@ -166,6 +171,148 @@ static ssize_t qcow2_zlib_decompress(void *dest, size_t 
dest_size,
  return ret;
  }
  
+#ifdef CONFIG_ZSTD

+
+/*
+ * qcow2_zstd_compress()
+ *
+ * Compress @src_size bytes of data using zstd compression method
+ *
+ * @dest - destination buffer, @dest_size bytes
+ * @src - source buffer, @src_size bytes
+ *
+ * Returns: compressed size on success
+ *  -ENOMEM destination buffer is not enough to store compressed data
+ *  -EIOon any other error
+ */
+static ssize_t qcow2_zstd_compress(void *dest, size_t dest_size,
+   const void *src, size_t src_size)
+{
+ssize_t ret;
+ZSTD_outBuffer output = { dest, dest_size, 0 };
+ZSTD_inBuffer input = { src, src_size, 0 };

Minor style note: I think it’d be nicer to use designated initializers here.


+ZSTD_CCtx *cctx = ZSTD_createCCtx();
+
+if (!cctx) {
+return -EIO;
+}
+/*
+ * Use the zstd streamed interface for symmetry with decompression,
+ * where streaming is essential since we don't record the exact
+ * compressed size.
+ *
+ * In the loop, we try to compress all the data into one zstd frame.
+ * ZSTD_compressStream2 potentially can finish a frame earlier
+ * than the full input data is consumed. That's why we are looping
+ * until all the input data is consumed.
+ */
+while (input.pos < input.size) {
+size_t zstd_ret;
+/*
+ * ZSTD spec: "You must continue calling ZSTD_compressStream2()
+ * with ZSTD_e_end until it returns 0, at which point you are
+ * free to start a new frame". We assume that "start a new frame"
+ * means call ZSTD_compressStream2 in the very beginning or when
+ * ZSTD_compressStream2 has returned with 0.
+ */
+do {
+zstd_ret = ZSTD_compressStream2(cctx, , , ZSTD_e_end);

The spec makes it sound to me like ZSTD_e_end will always complete in a
single call if there’s enough space in the output buffer.  So the only
team we have to loop would be when there isn’t enough space anyway:

It says this about ZSTD_e_end:

flush operation is the same, and follows same rules as calling
ZSTD_compressStream2() with ZSTD_e_flush.

Those rules being:

Note that, if `output->size` is too small, a single invocation with
ZSTD_e_flush might not be enough (return code > 0).

So it seems like it will only return a value > 0 if the output buffer is
definitely too small.

The spec also notes that the return value is greater than 0 if:

0 if some data still present within internal buffer (the value is

minimal estimation of remaining size),

So it’s a minimum estimate.  That’s another point that heavily implies
to me that if the return value were less than what’s left in the buffer,
the function wouldn’t return but still try to write it out, until it
realizes that there isn’t enough space in the output 

Re: [RFC PATCH] qom: Implement qom-get HMP command

2020-04-27 Thread Dr. David Alan Gilbert
* Cédric Le Goater (c...@kaod.org) wrote:
> From: "Dr. David Alan Gilbert" 
> 
> Reimplement it based on qmp_qom_get() to avoid converting QObjects back
> to strings.


I'd love to see this or something similar in;  what does it's output
look like for structures - I think that was the main problem people
complained about last time, although IMHO even a version that couldn't
do structures nicely would be better than nothing.

Dave

> 
> Inspired-by: Paolo Bonzini 
> Signed-off-by: Andreas Färber 
> 
> Slight fix for bit-rot:
> Signed-off-by: Dr. David Alan Gilbert 
> [clg: updates for QEMU 5.0 ]
> Signed-off-by: Cédric Le Goater 
> ---
> 
>  I would like to restart the discussion on qom-get command to understand
>  what was the conclusion and see if things have changed since.
> 
>  Thanks,
> 
>  C.
> 
>  include/monitor/hmp.h |  1 +
>  qom/qom-hmp-cmds.c| 23 +++
>  hmp-commands.hx   | 13 +
>  3 files changed, 37 insertions(+)
> 
> diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
> index e33ca5a911a5..c986cfd28bc3 100644
> --- a/include/monitor/hmp.h
> +++ b/include/monitor/hmp.h
> @@ -96,6 +96,7 @@ void hmp_info_memdev(Monitor *mon, const QDict *qdict);
>  void hmp_info_numa(Monitor *mon, const QDict *qdict);
>  void hmp_info_memory_devices(Monitor *mon, const QDict *qdict);
>  void hmp_qom_list(Monitor *mon, const QDict *qdict);
> +void hmp_qom_get(Monitor *mon, const QDict *qdict);
>  void hmp_qom_set(Monitor *mon, const QDict *qdict);
>  void hmp_info_qom_tree(Monitor *mon, const QDict *dict);
>  void object_add_completion(ReadLineState *rs, int nb_args, const char *str);
> diff --git a/qom/qom-hmp-cmds.c b/qom/qom-hmp-cmds.c
> index cd08233a4cfe..b14cf6e785f4 100644
> --- a/qom/qom-hmp-cmds.c
> +++ b/qom/qom-hmp-cmds.c
> @@ -40,6 +40,29 @@ void hmp_qom_list(Monitor *mon, const QDict *qdict)
>  hmp_handle_error(mon, err);
>  }
>  
> +void hmp_qom_get(Monitor *mon, const QDict *qdict)
> +{
> +const char *path = qdict_get_str(qdict, "path");
> +const char *property = qdict_get_str(qdict, "property");
> +Error *err = NULL;
> +Object *obj;
> +char *value;
> +
> +obj = object_resolve_path(path, NULL);
> +if (obj == NULL) {
> +error_set(, ERROR_CLASS_DEVICE_NOT_FOUND,
> +  "Device '%s' not found", path);
> +hmp_handle_error(mon, err);
> +return;
> +}
> +value = object_property_print(obj, property, true, );
> +if (err == NULL) {
> +monitor_printf(mon, "%s\n", value);
> +g_free(value);
> +}
> +hmp_handle_error(mon, err);
> +}
> +
>  void hmp_qom_set(Monitor *mon, const QDict *qdict)
>  {
>  const char *path = qdict_get_str(qdict, "path");
> diff --git a/hmp-commands.hx b/hmp-commands.hx
> index 7f0f3974ad90..4e39b9caed3e 100644
> --- a/hmp-commands.hx
> +++ b/hmp-commands.hx
> @@ -1790,6 +1790,19 @@ SRST
>Print QOM properties of object at location *path*
>  ERST
>  
> +{
> +.name   = "qom-get",
> +.args_type  = "path:s,property:s",
> +.params = "path property",
> +.help   = "print QOM property",
> +.cmd= hmp_qom_get,
> +},
> +
> +SRST
> +``qom-get``  *path* *property*
> +  Print QOM property *property* of object at location *path*
> +ERST
> +
>  {
>  .name   = "qom-set",
>  .args_type  = "path:s,property:s,value:s",
> -- 
> 2.25.1
> 
--
Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK




Re: [RFC PATCH v1 20/26] kvm: vmi: intercept live migration

2020-04-27 Thread Dr. David Alan Gilbert
* Adalbert Lazăr (ala...@bitdefender.com) wrote:
> From: Marian Rotariu 
> 
> It is possible that the introspection tool has made some changes inside
> the introspected VM which can make the guest crash if the introspection
> connection is suddenly closed.
> 
> When the live migration starts, for now, the introspection tool is
> signaled to remove its hooks from the introspected VM.
> 
> CC: Juan Quintela 
> CC: "Dr. David Alan Gilbert" 
> Signed-off-by: Marian Rotariu 
> Signed-off-by: Adalbert Lazăr 

OK, so this isn't too intrusive to the migration code; and other than
renaming 'start_live_migration_thread' to
'start_outgoing_migration_thread' I think I'd be OK with this,

but it might depend what your overall aim is.

For example, you might be better intercepting each migration_state
change in your notifier, that's much finer grain than just the start of
migration.

The other thing I worry about is that there doesn't seem to be much
guard against odd orderings of things - for example, what happens
if the introspection client was to issue the  INTERCEPT_MIGRATE command
twice while a migration was already running?  Or before an actual
incoming channel connetion had happened?

Dave

> ---
>  accel/kvm/vmi.c| 31 +++
>  include/sysemu/vmi-intercept.h |  1 +
>  migration/migration.c  | 18 +++---
>  migration/migration.h  |  2 ++
>  4 files changed, 45 insertions(+), 7 deletions(-)
> 
> diff --git a/accel/kvm/vmi.c b/accel/kvm/vmi.c
> index 90906478b4..ea7191e48d 100644
> --- a/accel/kvm/vmi.c
> +++ b/accel/kvm/vmi.c
> @@ -21,6 +21,8 @@
>  #include "chardev/char.h"
>  #include "chardev/char-fe.h"
>  #include "migration/vmstate.h"
> +#include "migration/migration.h"
> +#include "migration/misc.h"
>  
>  #include "sysemu/vmi-intercept.h"
>  #include "sysemu/vmi-handshake.h"
> @@ -58,6 +60,7 @@ typedef struct VMIntrospection {
>  int64_t vm_start_time;
>  
>  Notifier machine_ready;
> +Notifier migration_state_change;
>  bool created_from_command_line;
>  
>  bool kvmi_hooked;
> @@ -74,9 +77,11 @@ static const char *action_string[] = {
>  "suspend",
>  "resume",
>  "force-reset",
> +"migrate",
>  };
>  
>  static bool suspend_pending;
> +static bool migrate_pending;
>  
>  #define TYPE_VM_INTROSPECTION "introspection"
>  
> @@ -88,6 +93,15 @@ static bool suspend_pending;
>  static Error *vm_introspection_init(VMIntrospection *i);
>  static void vm_introspection_reset(void *opaque);
>  
> +static void migration_state_notifier(Notifier *notifier, void *data)
> +{
> +MigrationState *s = data;
> +
> +if (migration_has_failed(s)) {
> +migrate_pending = false;
> +}
> +}
> +
>  static void machine_ready(Notifier *notifier, void *data)
>  {
>  VMIntrospection *i = container_of(notifier, VMIntrospection, 
> machine_ready);
> @@ -144,6 +158,9 @@ static void complete(UserCreatable *uc, Error **errp)
>  
>  ic->uniq = i;
>  
> +i->migration_state_change.notify = migration_state_notifier;
> +add_migration_state_change_notifier(>migration_state_change);
> +
>  qemu_register_reset(vm_introspection_reset, i);
>  }
>  
> @@ -478,6 +495,9 @@ static void 
> continue_with_the_intercepted_action(VMIntrospection *i)
>  case VMI_INTERCEPT_SUSPEND:
>  vm_stop(RUN_STATE_PAUSED);
>  break;
> +case VMI_INTERCEPT_MIGRATE:
> +start_live_migration_thread(migrate_get_current());
> +break;
>  default:
>  error_report("VMI: %s: unexpected action %d",
>   __func__, i->intercepted_action);
> @@ -571,9 +591,9 @@ static void chr_event_open(VMIntrospection *i)
>  {
>  Error *local_err = NULL;
>  
> -if (suspend_pending) {
> -info_report("VMI: %s: too soon (suspend=%d)",
> -__func__, suspend_pending);
> +if (suspend_pending || migrate_pending) {
> +info_report("VMI: %s: too soon (suspend=%d, migrate=%d)",
> +__func__, suspend_pending, migrate_pending);
>  maybe_disable_socket_reconnect(i);
>  qemu_chr_fe_disconnect(>sock);
>  return;
> @@ -608,7 +628,7 @@ static void chr_event_close(VMIntrospection *i)
>  cancel_unhook_timer(i);
>  cancel_handshake_timer(i);
>  
> -if (suspend_pending) {
> +if (suspend_pending || migrate_pending) {
>  maybe_disable_socket_reconnect(i);
>  
>  if (i->intercepted_action != VMI_INTERCEPT_NONE) {
> @@ -680,6 +700,9 @@ static bool record_intercept_action(VMI_intercept_command 
> action)
>  break;
>  case VMI_INTERCEPT_FORCE_RESET:
>  break;
> +case VMI_INTERCEPT_MIGRATE:
> +migrate_pending = true;
> +break;
>  default:
>  return false;
>  }
> diff --git a/include/sysemu/vmi-intercept.h b/include/sysemu/vmi-intercept.h
> index ef591b49e7..b4a9a3faa7 100644
> --- a/include/sysemu/vmi-intercept.h
> +++ 

Re: [PATCH v3 13/18] target/arm: Update contiguous first-fault and no-fault loads

2020-04-27 Thread Peter Maydell
On Mon, 27 Apr 2020 at 17:45, Richard Henderson
 wrote:
> We *can* indicate fault from MemSingleNF for any reason whatsoever, or no
> reason whatsoever.
>
> > // Implementation may suppress NF load for any reason
> > if ConstrainUnpredictableBool(Unpredictable_NONFAULT) then
> >   return (bits(8*size) UNKNOWN, TRUE);
>
> What I'm trying to talk about above, is the third statement in MemSingleNF,
>
> > // Non-fault load from Device memory must not be performed externally
> > if memaddrdesc.memattrs.memtype == MemType_Device then
> >   return (bits(8*size) UNKNOWN, TRUE);
>
> and the reason we can't actually test MemType_Device here.
>
> If you have better wording for that, I'm all ears.  But I don't think there's
> an actual bug here.

Oh, the comment didn't say you were relying on the operation being
allowed to return 'fail' for any reason; in particular the line about
"Normal memory [...] should access the bus" implies the opposite.
(I also missed the distinction here between "indicate fault" and "fault".)

But in that case you have the opposite problem, I think -- just because
something's backed by host memory doesn't mean the guest didn't
map it as Device: that case the architecture says must be indicated
as 'fault' but this code won't do it.

I would suggest something like:

+ * From this point on, all memory operations are MemSingleNF.
+ *
+ * Per the MemSingleNF pseudocode, a no-fault load from Device memory
+ * must not actually hit the bus -- it returns (UNKNOWN, FAULT) instead.
+ *
+ * Unfortuately we do not have access to the memory attributes from the PTE
+ * to tell Device memory from Normal memory. So we make a mostly
+ * correct check, and indicate (UNKNOWN, FAULT) for any MMIO.
+ * This gives the right answer for the common cases of "Normal memory,
+ * backed by host RAM" and "Device memory, backed by MMIO".
+ * The architecture allows us to suppress an NF load and return
+ * (UNKNOWN, FAULT) for any reason), so our behaviour (indicate
+ * fault) for the corner case of "Normal memory, backed by MMIO" is
+ * permitted. The case we get wrong is "Device memory, backed by
+ * host RAM", which we should return (UNKNOWN, FAULT) for but do not.
+ *
+ * Similarly, CPU_BP breakpoints would raise exceptions, and so
+ * return (UNKNOWN, FAULT).  For simplicity, we consider gdb and
+ * architectural breakpoints the same.

assuming my understanding is correct...

thanks
-- PMM



[PATCH v2 2/2] hw/pci/pcie: Replace PCI_DEVICE() casts with existing variable

2020-04-27 Thread Julia Suvorova
A little cleanup is possible because of hotplug_pdev introduction.

Signed-off-by: Julia Suvorova 
---
 hw/pci/pcie.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 6b48d04d2c..abc99b6eff 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -449,7 +449,7 @@ void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, 
DeviceState *dev,
 pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
PCI_EXP_LNKSTA_DLLLA);
 }
-pcie_cap_slot_event(PCI_DEVICE(hotplug_dev),
+pcie_cap_slot_event(hotplug_pdev,
 PCI_EXP_HP_EV_PDC | PCI_EXP_HP_EV_ABP);
 }
 }
@@ -490,7 +490,7 @@ void pcie_cap_slot_unplug_request_cb(HotplugHandler 
*hotplug_dev,
 return;
 }
 
-pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, _err);
+pcie_cap_slot_plug_common(hotplug_pdev, dev, _err);
 if (local_err) {
 error_propagate(errp, local_err);
 return;
@@ -509,7 +509,7 @@ void pcie_cap_slot_unplug_request_cb(HotplugHandler 
*hotplug_dev,
 return;
 }
 
-pcie_cap_slot_push_attention_button(PCI_DEVICE(hotplug_dev));
+pcie_cap_slot_push_attention_button(hotplug_pdev);
 }
 
 /* pci express slot for pci express root/downstream port
-- 
2.25.3




[PATCH v1 11/11] hw/arm: versal-virt: Add support for the RTC

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Add support for the RTC.

Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal-virt.c | 22 ++
 1 file changed, 22 insertions(+)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 0afee48672..7e749e1926 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -283,6 +283,27 @@ static void fdt_add_sd_nodes(VersalVirt *s)
 }
 }
 
+static void fdt_add_rtc_node(VersalVirt *s)
+{
+const char compat[] = "xlnx,zynqmp-rtc";
+const char interrupt_names[] = "alarm\0sec";
+char *name = g_strdup_printf("/rtc@%x", MM_PMC_RTC);
+
+qemu_fdt_add_subnode(s->fdt, name);
+
+qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+   GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_ALARM_IRQ,
+   GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+   GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_SECONDS_IRQ,
+   GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+qemu_fdt_setprop(s->fdt, name, "interrupt-names",
+ interrupt_names, sizeof(interrupt_names));
+qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+ 2, MM_PMC_RTC, 2, MM_PMC_RTC_SIZE);
+qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
+g_free(name);
+}
+
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
 Error *err = NULL;
@@ -496,6 +517,7 @@ static void versal_virt_init(MachineState *machine)
 fdt_add_timer_nodes(s);
 fdt_add_zdma_nodes(s);
 fdt_add_sd_nodes(s);
+fdt_add_rtc_node(s);
 fdt_add_cpu_nodes(s, psci_conduit);
 fdt_add_clk_node(s, "/clk125", 12500, s->phandle.clk_125Mhz);
 fdt_add_clk_node(s, "/clk25", 2500, s->phandle.clk_25Mhz);
-- 
2.20.1




[PATCH v2 1/2] hw/pci/pcie: Forbid hot-plug if it's disabled on the slot

2020-04-27 Thread Julia Suvorova
Raise an error when trying to hot-plug/unplug a device through QMP to a device
with disabled hot-plug capability. This makes the device behaviour more
consistent and provides an explanation of the failure in the case of
asynchronous unplug.

Signed-off-by: Julia Suvorova 
---
v2:
* Change error text [Igor, Michael]
* Move cleanup to a separate patch [Marcel]

 hw/pci/pcie.c | 19 +++
 1 file changed, 19 insertions(+)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 0eb3a2a5d2..6b48d04d2c 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -415,6 +415,7 @@ void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, 
DeviceState *dev,
 {
 PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
 uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
+uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
 PCIDevice *pci_dev = PCI_DEVICE(dev);
 
 /* Don't send event when device is enabled during qemu machine creation:
@@ -430,6 +431,13 @@ void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, 
DeviceState *dev,
 return;
 }
 
+/* Check if hot-plug is disabled on the slot */
+if ((sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
+error_setg(errp, "Hot-plug failed: unsupported by the port device 
'%s'",
+ DEVICE(hotplug_pdev)->id);
+return;
+}
+
 /* To enable multifunction hot-plug, we just ensure the function
  * 0 added last. When function 0 is added, we set the sltsta and
  * inform OS via event notification.
@@ -470,6 +478,17 @@ void pcie_cap_slot_unplug_request_cb(HotplugHandler 
*hotplug_dev,
 Error *local_err = NULL;
 PCIDevice *pci_dev = PCI_DEVICE(dev);
 PCIBus *bus = pci_get_bus(pci_dev);
+PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
+uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
+uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
+
+/* Check if hot-unplug is disabled on the slot */
+if ((sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
+error_setg(errp, "Hot-unplug failed: "
+ "unsupported by the port device '%s'",
+ DEVICE(hotplug_pdev)->id);
+return;
+}
 
 pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, _err);
 if (local_err) {
-- 
2.25.3




[PATCH v2 0/2] hw/pci/pcie: Forbid hot-plug if it's disabled on the slot

2020-04-27 Thread Julia Suvorova
Julia Suvorova (2):
  hw/pci/pcie: Forbid hot-plug if it's disabled on the slot
  hw/pci/pcie: Replace PCI_DEVICE() casts with existing variable

 hw/pci/pcie.c | 25 ++---
 1 file changed, 22 insertions(+), 3 deletions(-)

-- 
2.25.3




[PATCH v1 02/11] hw/arm: versal: Move misplaced comment

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Move misplaced comment.

Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index c73b2fe755..cc696e44c0 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -36,7 +36,6 @@ static void versal_create_apu_cpus(Versal *s)
 
 obj = object_new(XLNX_VERSAL_ACPU_TYPE);
 if (!obj) {
-/* Secondary CPUs start in PSCI powered-down state */
 error_report("Unable to create apu.cpu[%d] of type %s",
  i, XLNX_VERSAL_ACPU_TYPE);
 exit(EXIT_FAILURE);
@@ -49,6 +48,7 @@ static void versal_create_apu_cpus(Versal *s)
 object_property_set_int(obj, s->cfg.psci_conduit,
 "psci-conduit", _abort);
 if (i) {
+/* Secondary CPUs start in PSCI powered-down state */
 object_property_set_bool(obj, true,
  "start-powered-off", _abort);
 }
-- 
2.20.1




[PATCH v1 10/11] hw/arm: versal-virt: Add support for SD

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Add support for SD.

Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal-virt.c | 46 +++
 1 file changed, 46 insertions(+)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index d7be1ad494..0afee48672 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -20,6 +20,7 @@
 #include "hw/arm/sysbus-fdt.h"
 #include "hw/arm/fdt.h"
 #include "cpu.h"
+#include "hw/qdev-properties.h"
 #include "hw/arm/xlnx-versal.h"
 
 #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
@@ -256,6 +257,32 @@ static void fdt_add_zdma_nodes(VersalVirt *s)
 }
 }
 
+static void fdt_add_sd_nodes(VersalVirt *s)
+{
+const char clocknames[] = "clk_xin\0clk_ahb";
+const char compat[] = "arasan,sdhci-8.9a";
+int i;
+
+for (i = ARRAY_SIZE(s->soc.pmc.iou.sd) - 1; i >= 0; i--) {
+uint64_t addr = MM_PMC_SD0 + MM_PMC_SD0_SIZE * i;
+char *name = g_strdup_printf("/sdhci@%" PRIx64, addr);
+
+qemu_fdt_add_subnode(s->fdt, name);
+
+qemu_fdt_setprop_cells(s->fdt, name, "clocks",
+   s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
+qemu_fdt_setprop(s->fdt, name, "clock-names",
+ clocknames, sizeof(clocknames));
+qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+   GIC_FDT_IRQ_TYPE_SPI, VERSAL_SD0_IRQ_0 + i * 2,
+   GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+ 2, addr, 2, MM_PMC_SD0_SIZE);
+qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
+g_free(name);
+}
+}
+
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
 Error *err = NULL;
@@ -411,10 +438,23 @@ static void create_virtio_regions(VersalVirt *s)
 }
 }
 
+static void sd_plugin_card(SDHCIState *sd, DriveInfo *di)
+{
+BlockBackend *blk = di ? blk_by_legacy_dinfo(di) : NULL;
+DeviceState *card;
+
+card = qdev_create(qdev_get_child_bus(DEVICE(sd), "sd-bus"), TYPE_SD_CARD);
+object_property_add_child(OBJECT(sd), "card[*]", OBJECT(card),
+  _fatal);
+qdev_prop_set_drive(card, "drive", blk, _fatal);
+object_property_set_bool(OBJECT(card), true, "realized", _fatal);
+}
+
 static void versal_virt_init(MachineState *machine)
 {
 VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
 int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
+int i;
 
 /*
  * If the user provides an Operating System to be loaded, we expect them
@@ -455,6 +495,7 @@ static void versal_virt_init(MachineState *machine)
 fdt_add_gic_nodes(s);
 fdt_add_timer_nodes(s);
 fdt_add_zdma_nodes(s);
+fdt_add_sd_nodes(s);
 fdt_add_cpu_nodes(s, psci_conduit);
 fdt_add_clk_node(s, "/clk125", 12500, s->phandle.clk_125Mhz);
 fdt_add_clk_node(s, "/clk25", 2500, s->phandle.clk_25Mhz);
@@ -464,6 +505,11 @@ static void versal_virt_init(MachineState *machine)
 memory_region_add_subregion_overlap(get_system_memory(),
 0, >soc.fpd.apu.mr, 0);
 
+/* Plugin SD cards.  */
+for (i = 0; i < ARRAY_SIZE(s->soc.pmc.iou.sd); i++) {
+sd_plugin_card(>soc.pmc.iou.sd[i], drive_get_next(IF_SD));
+}
+
 s->binfo.ram_size = machine->ram_size;
 s->binfo.loader_start = 0x0;
 s->binfo.get_dtb = versal_virt_get_dtb;
-- 
2.20.1




[PATCH v1 06/11] hw/arm: versal: Embedd the ADMAs into the SoC type

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Embedd the ADMAs into the SoC type.

Suggested-by: Peter Maydell 
Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal.c | 14 +++---
 include/hw/arm/xlnx-versal.h |  3 ++-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index e424aa789e..ebd2dc51be 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -203,18 +203,18 @@ static void versal_create_admas(Versal *s, qemu_irq *pic)
 DeviceState *dev;
 MemoryRegion *mr;
 
-dev = qdev_create(NULL, "xlnx.zdma");
-s->lpd.iou.adma[i] = SYS_BUS_DEVICE(dev);
-object_property_set_int(OBJECT(s->lpd.iou.adma[i]), 128, "bus-width",
-_abort);
-object_property_add_child(OBJECT(s), name, OBJECT(dev), _fatal);
+sysbus_init_child_obj(OBJECT(s), name,
+  >lpd.iou.adma[i], sizeof(s->lpd.iou.adma[i]),
+  TYPE_XLNX_ZDMA);
+dev = DEVICE(>lpd.iou.adma[i]);
+object_property_set_int(OBJECT(dev), 128, "bus-width", _abort);
 qdev_init_nofail(dev);
 
-mr = sysbus_mmio_get_region(s->lpd.iou.adma[i], 0);
+mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 memory_region_add_subregion(>mr_ps,
 MM_ADMA_CH0 + i * MM_ADMA_CH0_SIZE, mr);
 
-sysbus_connect_irq(s->lpd.iou.adma[i], 0, pic[VERSAL_ADMA_IRQ_0 + i]);
+sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[VERSAL_ADMA_IRQ_0 + i]);
 g_free(name);
 }
 }
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 01da736a5b..94b7826fd4 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -16,6 +16,7 @@
 #include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/char/pl011.h"
+#include "hw/dma/xlnx-zdma.h"
 #include "hw/net/cadence_gem.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
@@ -53,7 +54,7 @@ typedef struct Versal {
 struct {
 PL011State uart[XLNX_VERSAL_NR_UARTS];
 CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
-SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
+XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
 } iou;
 } lpd;
 
-- 
2.20.1




[PATCH v1 08/11] hw/arm: versal: Add support for SD

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Add support for SD.

Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal.c | 31 +++
 include/hw/arm/xlnx-versal.h | 12 
 2 files changed, 43 insertions(+)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index c8a296e2e0..e263bdf77a 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -210,6 +210,36 @@ static void versal_create_admas(Versal *s, qemu_irq *pic)
 }
 }
 
+#define SDHCI_CAPABILITIES  0x280737ec6481 /* Same as on ZynqMP.  */
+static void versal_create_sds(Versal *s, qemu_irq *pic)
+{
+int i;
+
+for (i = 0; i < ARRAY_SIZE(s->pmc.iou.sd); i++) {
+DeviceState *dev;
+MemoryRegion *mr;
+
+sysbus_init_child_obj(OBJECT(s), "sd[*]",
+  >pmc.iou.sd[i], sizeof(s->pmc.iou.sd[i]),
+  TYPE_SYSBUS_SDHCI);
+dev = DEVICE(>pmc.iou.sd[i]);
+
+object_property_set_uint(OBJECT(dev),
+ 3, "sd-spec-version", _fatal);
+object_property_set_uint(OBJECT(dev), SDHCI_CAPABILITIES, "capareg",
+ _fatal);
+object_property_set_uint(OBJECT(dev), UHS_I, "uhs", _fatal);
+qdev_init_nofail(dev);
+
+mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+memory_region_add_subregion(>mr_ps,
+MM_PMC_SD0 + i * MM_PMC_SD0_SIZE, mr);
+
+sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+   pic[VERSAL_SD0_IRQ_0 + i * 2]);
+}
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -292,6 +322,7 @@ static void versal_realize(DeviceState *dev, Error **errp)
 versal_create_uarts(s, pic);
 versal_create_gems(s, pic);
 versal_create_admas(s, pic);
+versal_create_sds(s, pic);
 versal_map_ddr(s);
 versal_unimp(s);
 
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 426b66449d..e11693e29d 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -14,6 +14,7 @@
 
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
+#include "hw/sd/sdhci.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/char/pl011.h"
 #include "hw/dma/xlnx-zdma.h"
@@ -26,6 +27,7 @@
 #define XLNX_VERSAL_NR_UARTS   2
 #define XLNX_VERSAL_NR_GEMS2
 #define XLNX_VERSAL_NR_ADMAS   8
+#define XLNX_VERSAL_NR_SDS 2
 #define XLNX_VERSAL_NR_IRQS192
 
 typedef struct Versal {
@@ -58,6 +60,13 @@ typedef struct Versal {
 } iou;
 } lpd;
 
+/* The Platform Management Controller subsystem.  */
+struct {
+struct {
+SDHCIState sd[XLNX_VERSAL_NR_SDS];
+} iou;
+} pmc;
+
 struct {
 MemoryRegion *mr_ddr;
 uint32_t psci_conduit;
@@ -80,6 +89,7 @@ typedef struct Versal {
 #define VERSAL_GEM1_IRQ_0  58
 #define VERSAL_GEM1_WAKE_IRQ_0 59
 #define VERSAL_ADMA_IRQ_0  60
+#define VERSAL_SD0_IRQ_0   126
 
 /* Architecturally reserved IRQs suitable for virtualization.  */
 #define VERSAL_RSVD_IRQ_FIRST 111
@@ -129,6 +139,8 @@ typedef struct Versal {
 #define MM_FPD_CRF  0xfd1aU
 #define MM_FPD_CRF_SIZE 0x14
 
+#define MM_PMC_SD0  0xf104U
+#define MM_PMC_SD0_SIZE 0x1
 #define MM_PMC_CRP  0xf126U
 #define MM_PMC_CRP_SIZE 0x1
 #endif
-- 
2.20.1




[PATCH v1 09/11] hw/arm: versal: Add support for the RTC

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

hw/arm: versal: Add support for the RTC.

Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal.c | 21 +
 include/hw/arm/xlnx-versal.h |  8 
 2 files changed, 29 insertions(+)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index e263bdf77a..321171bcce 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -240,6 +240,26 @@ static void versal_create_sds(Versal *s, qemu_irq *pic)
 }
 }
 
+static void versal_create_rtc(Versal *s, qemu_irq *pic)
+{
+SysBusDevice *sbd;
+MemoryRegion *mr;
+
+sysbus_init_child_obj(OBJECT(s), "rtc", >pmc.rtc, sizeof(s->pmc.rtc),
+  TYPE_XLNX_ZYNQMP_RTC);
+sbd = SYS_BUS_DEVICE(>pmc.rtc);
+qdev_init_nofail(DEVICE(sbd));
+
+mr = sysbus_mmio_get_region(sbd, 0);
+memory_region_add_subregion(>mr_ps, MM_PMC_RTC, mr);
+
+/*
+ * TODO: Connect the ALARM and SECONDS interrupts once our RTC model
+ * supports them.
+ */
+sysbus_connect_irq(sbd, 1, pic[VERSAL_RTC_APB_ERR_IRQ]);
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -323,6 +343,7 @@ static void versal_realize(DeviceState *dev, Error **errp)
 versal_create_gems(s, pic);
 versal_create_admas(s, pic);
 versal_create_sds(s, pic);
+versal_create_rtc(s, pic);
 versal_map_ddr(s);
 versal_unimp(s);
 
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index e11693e29d..9c9f47ba9d 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -19,6 +19,7 @@
 #include "hw/char/pl011.h"
 #include "hw/dma/xlnx-zdma.h"
 #include "hw/net/cadence_gem.h"
+#include "hw/rtc/xlnx-zynqmp-rtc.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
@@ -65,6 +66,8 @@ typedef struct Versal {
 struct {
 SDHCIState sd[XLNX_VERSAL_NR_SDS];
 } iou;
+
+XlnxZynqMPRTC rtc;
 } pmc;
 
 struct {
@@ -89,7 +92,10 @@ typedef struct Versal {
 #define VERSAL_GEM1_IRQ_0  58
 #define VERSAL_GEM1_WAKE_IRQ_0 59
 #define VERSAL_ADMA_IRQ_0  60
+#define VERSAL_RTC_APB_ERR_IRQ 121
 #define VERSAL_SD0_IRQ_0   126
+#define VERSAL_RTC_ALARM_IRQ   142
+#define VERSAL_RTC_SECONDS_IRQ 143
 
 /* Architecturally reserved IRQs suitable for virtualization.  */
 #define VERSAL_RSVD_IRQ_FIRST 111
@@ -143,4 +149,6 @@ typedef struct Versal {
 #define MM_PMC_SD0_SIZE 0x1
 #define MM_PMC_CRP  0xf126U
 #define MM_PMC_CRP_SIZE 0x1
+#define MM_PMC_RTC  0xf12a
+#define MM_PMC_RTC_SIZE 0x1
 #endif
-- 
2.20.1




[PATCH v1 05/11] hw/arm: versal: Embedd the GEMs into the SoC type

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Embedd the GEMs into the SoC type.

Suggested-by: Peter Maydell 
Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal.c | 15 ---
 include/hw/arm/xlnx-versal.h |  3 ++-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index dbde03b7e6..e424aa789e 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -170,25 +170,26 @@ static void versal_create_gems(Versal *s, qemu_irq *pic)
 DeviceState *dev;
 MemoryRegion *mr;
 
-dev = qdev_create(NULL, "cadence_gem");
-s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
-object_property_add_child(OBJECT(s), name, OBJECT(dev), _fatal);
+sysbus_init_child_obj(OBJECT(s), name,
+  >lpd.iou.gem[i], sizeof(s->lpd.iou.gem[i]),
+  TYPE_CADENCE_GEM);
+dev = DEVICE(>lpd.iou.gem[i]);
 if (nd->used) {
 qemu_check_nic_model(nd, "cadence_gem");
 qdev_set_nic_properties(dev, nd);
 }
-object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
+object_property_set_int(OBJECT(dev),
 2, "num-priority-queues",
 _abort);
-object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
+object_property_set_link(OBJECT(dev),
  OBJECT(>mr_ps), "dma",
  _abort);
 qdev_init_nofail(dev);
 
-mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
+mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 memory_region_add_subregion(>mr_ps, addrs[i], mr);
 
-sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
+sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
 g_free(name);
 }
 }
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index a3dfd064b3..01da736a5b 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -16,6 +16,7 @@
 #include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/char/pl011.h"
+#include "hw/net/cadence_gem.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
@@ -51,7 +52,7 @@ typedef struct Versal {
 
 struct {
 PL011State uart[XLNX_VERSAL_NR_UARTS];
-SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
+CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
 SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
 } iou;
 } lpd;
-- 
2.20.1




[PATCH v1 03/11] hw/arm: versal-virt: Fix typo xlnx-ve -> xlnx-versal

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Fix typo xlnx-ve -> xlnx-versal.

Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal-virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 878a275140..8a608074d1 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -440,7 +440,7 @@ static void versal_virt_init(MachineState *machine)
 psci_conduit = QEMU_PSCI_CONDUIT_SMC;
 }
 
-sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", >soc,
+sysbus_init_child_obj(OBJECT(machine), "xlnx-versal", >soc,
   sizeof(s->soc), TYPE_XLNX_VERSAL);
 object_property_set_link(OBJECT(>soc), OBJECT(machine->ram),
  "ddr", _abort);
-- 
2.20.1




[PATCH v1 07/11] hw/arm: versal: Embedd the APUs into the SoC type

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Embedd the APUs into the SoC type.

Suggested-by: Peter Maydell 
Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal-virt.c|  4 ++--
 hw/arm/xlnx-versal.c | 19 +--
 include/hw/arm/xlnx-versal.h |  2 +-
 3 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 8a608074d1..d7be1ad494 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -469,9 +469,9 @@ static void versal_virt_init(MachineState *machine)
 s->binfo.get_dtb = versal_virt_get_dtb;
 s->binfo.modify_dtb = versal_virt_modify_dtb;
 if (machine->kernel_filename) {
-arm_load_kernel(s->soc.fpd.apu.cpu[0], machine, >binfo);
+arm_load_kernel(>soc.fpd.apu.cpu[0], machine, >binfo);
 } else {
-AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
+AddressSpace *as = arm_boot_address_space(>soc.fpd.apu.cpu[0],
   >binfo);
 /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).
  * Offset things by 4K.  */
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index ebd2dc51be..c8a296e2e0 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -31,19 +31,11 @@ static void versal_create_apu_cpus(Versal *s)
 
 for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
 Object *obj;
-char *name;
-
-obj = object_new(XLNX_VERSAL_ACPU_TYPE);
-if (!obj) {
-error_report("Unable to create apu.cpu[%d] of type %s",
- i, XLNX_VERSAL_ACPU_TYPE);
-exit(EXIT_FAILURE);
-}
-
-name = g_strdup_printf("apu-cpu[%d]", i);
-object_property_add_child(OBJECT(s), name, obj, _fatal);
-g_free(name);
 
+object_initialize_child(OBJECT(s), "apu-cpu[*]",
+>fpd.apu.cpu[i], sizeof(s->fpd.apu.cpu[i]),
+XLNX_VERSAL_ACPU_TYPE, _abort, NULL);
+obj = OBJECT(>fpd.apu.cpu[i]);
 object_property_set_int(obj, s->cfg.psci_conduit,
 "psci-conduit", _abort);
 if (i) {
@@ -57,7 +49,6 @@ static void versal_create_apu_cpus(Versal *s)
 object_property_set_link(obj, OBJECT(>fpd.apu.mr), "memory",
  _abort);
 object_property_set_bool(obj, true, "realized", _fatal);
-s->fpd.apu.cpu[i] = ARM_CPU(obj);
 }
 }
 
@@ -95,7 +86,7 @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
 }
 
 for (i = 0; i < nr_apu_cpus; i++) {
-DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
+DeviceState *cpudev = DEVICE(>fpd.apu.cpu[i]);
 int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
 qemu_irq maint_irq;
 int ti;
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 94b7826fd4..426b66449d 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -36,7 +36,7 @@ typedef struct Versal {
 struct {
 struct {
 MemoryRegion mr;
-ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
+ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
 GICv3State gic;
 } apu;
 } fpd;
-- 
2.20.1




[PATCH v1 04/11] hw/arm: versal: Embedd the UARTs into the SoC type

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Embedd the UARTs into the SoC type.

Suggested-by: Peter Maydell 
Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal.c | 12 ++--
 include/hw/arm/xlnx-versal.h |  3 ++-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index cc696e44c0..dbde03b7e6 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -21,7 +21,6 @@
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/xlnx-versal.h"
-#include "hw/char/pl011.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define GEM_REVISION0x40070106
@@ -144,16 +143,17 @@ static void versal_create_uarts(Versal *s, qemu_irq *pic)
 DeviceState *dev;
 MemoryRegion *mr;
 
-dev = qdev_create(NULL, TYPE_PL011);
-s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
+sysbus_init_child_obj(OBJECT(s), name,
+  >lpd.iou.uart[i], sizeof(s->lpd.iou.uart[i]),
+  TYPE_PL011);
+dev = DEVICE(>lpd.iou.uart[i]);
 qdev_prop_set_chr(dev, "chardev", serial_hd(i));
-object_property_add_child(OBJECT(s), name, OBJECT(dev), _fatal);
 qdev_init_nofail(dev);
 
-mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);
+mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 memory_region_add_subregion(>mr_ps, addrs[i], mr);
 
-sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);
+sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
 g_free(name);
 }
 }
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 6c0a692b2f..a3dfd064b3 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -15,6 +15,7 @@
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
+#include "hw/char/pl011.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
@@ -49,7 +50,7 @@ typedef struct Versal {
 MemoryRegion mr_ocm;
 
 struct {
-SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];
+PL011State uart[XLNX_VERSAL_NR_UARTS];
 SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
 SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
 } iou;
-- 
2.20.1




[PATCH v1 00/11] hw/arm: versal: Add SD and the RTC

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

This series starts with some basic cleaning, continues with embedding
devices into the Versal SoC (as suggested by Peter in another review).
We then connect SD and the RTC to the Versal SoC and hook it all up
into the Versal Virt board.

Cheers,
Edgar

Edgar E. Iglesias (11):
  hw/arm: versal: Remove inclusion of arm_gicv3_common.h
  hw/arm: versal: Move misplaced comment
  hw/arm: versal-virt: Fix typo xlnx-ve -> xlnx-versal
  hw/arm: versal: Embedd the UARTs into the SoC type
  hw/arm: versal: Embedd the GEMs into the SoC type
  hw/arm: versal: Embedd the ADMAs into the SoC type
  hw/arm: versal: Embedd the APUs into the SoC type
  hw/arm: versal: Add support for SD
  hw/arm: versal: Add support for the RTC
  hw/arm: versal-virt: Add support for SD
  hw/arm: versal-virt: Add support for the RTC

 hw/arm/xlnx-versal-virt.c|  74 +-
 hw/arm/xlnx-versal.c | 115 ---
 include/hw/arm/xlnx-versal.h |  31 --
 3 files changed, 177 insertions(+), 43 deletions(-)

-- 
2.20.1




[PATCH v1 01/11] hw/arm: versal: Remove inclusion of arm_gicv3_common.h

2020-04-27 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

Remove inclusion of arm_gicv3_common.h, this already gets
included via xlnx-versal.h.

Signed-off-by: Edgar E. Iglesias 
---
 hw/arm/xlnx-versal.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 94460f2343..c73b2fe755 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -20,7 +20,6 @@
 #include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
-#include "hw/intc/arm_gicv3_common.h"
 #include "hw/arm/xlnx-versal.h"
 #include "hw/char/pl011.h"
 
-- 
2.20.1




Re: [PATCH v4 24/30] qcow2: Clear the L2 bitmap when allocating a compressed cluster

2020-04-27 Thread Alberto Garcia
On Mon 27 Apr 2020 09:49:00 AM CEST, Max Reitz wrote:
>> The point is this: Consider 'write -P 0xff 0 64k', then 'write -z 16k
>> 16k', then 'read 0 64k'. For normal clusters, we can just do a
>> scatter-gather iov read of read 0-16k and 32-64k, plus a memset of
>> 16-32k. But for compressed clusters, we have to read and decompress
>> the entire 64k, AND also memset 16k-32k. But if zeroing after reading
>> is not that expensive, then the same technique for normal clusters is
>> fine (instead of a scatter-gather read of 48k, just read the whole
>> 64k cluster before doing the memset).
>
> It would also mean letting qcow2_co_preadv_part() special-handle such
> cases, i.e., whenever the whole clusters is compressed, it needs to
> read it as a whole, regardless of the subcluster status, and then
> memset() all areas to zero that are all-zero subclusters.  Otherwise
> we’d read and decompress the whole buffer twice (once for 0 to 16k,
> once for 32k to 64k).

This is actually a good reason against adding subcluster allocation to
compressed clusters.

I wouldn't like to complicate the code for this use case, so we either
don't support it at all, or we support it with the problem that you
mention (decompressing the whole buffer more than once if the cluster
contains holes).

> Not sure how bad the complexity is on the write side for not letting
> zero writes just zero the subcluster

It is not bad, I just have to check the cluster type and return
-ENOTSUP.

Berto



Re: [PATCH] e1000e: Added ICR clearing by corresponding IMS bit.

2020-04-27 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20200427152148.283771-1-and...@daynix.com/



Hi,

This series failed the docker-quick@centos7 build test. Please find the testing 
commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
make docker-image-centos7 V=1 NETWORK=1
time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
=== TEST SCRIPT END ===

  TESTiotest-qcow2: 158
socket_accept failed: Resource temporarily unavailable
**
ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake:
 assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
/tmp/qemu-test/src/tests/qtest/libqtest.c:166: kill_qemu() tried to terminate 
QEMU process but encountered exit status 1 (expected 0)
ERROR - Bail out! 
ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake:
 assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
make: *** [check-qtest-aarch64] Error 1
make: *** Waiting for unfinished jobs
  TESTiotest-qcow2: 159
Could not access KVM kernel module: No such file or directory
---
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', 
'--label', 'com.qemu.instance.uuid=64e45f41b19b4eaebe20debcee6f7f36', '-u', 
'1003', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=', 
'-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 
'SHOW_ENV=1', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', 
'/home/patchew2/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', 
'/var/tmp/patchew-tester-tmp-q3q6urn6/src/docker-src.2020-04-27-13.56.36.8589:/var/tmp/qemu:z,ro',
 'qemu:centos7', '/var/tmp/qemu/run', 'test-quick']' returned non-zero exit 
status 2.
filter=--filter=label=com.qemu.instance.uuid=64e45f41b19b4eaebe20debcee6f7f36
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-q3q6urn6/src'
make: *** [docker-run-test-quick@centos7] Error 2

real12m46.958s
user0m9.139s


The full log is available at
http://patchew.org/logs/20200427152148.283771-1-and...@daynix.com/testing.docker-quick@centos7/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

Re: [PATCH] virtiofsd: Show submounts

2020-04-27 Thread Dr. David Alan Gilbert
* Max Reitz (mre...@redhat.com) wrote:
> Currently, setup_mounts() bind-mounts the shared directory without
> MS_REC.  This makes all submounts disappear.
> 
> Pass MS_REC so that the guest can see submounts again.

Thanks!

> Fixes: 3ca8a2b1c83eb185c232a4e87abbb65495263756

Should this actually be 5baa3b8e95064c2434bd9e2f312edd5e9ae275dc ?

> Signed-off-by: Max Reitz 
> ---
>  tools/virtiofsd/passthrough_ll.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/virtiofsd/passthrough_ll.c 
> b/tools/virtiofsd/passthrough_ll.c
> index 4c35c95b25..9d7f863e66 100644
> --- a/tools/virtiofsd/passthrough_ll.c
> +++ b/tools/virtiofsd/passthrough_ll.c
> @@ -2643,7 +2643,7 @@ static void setup_mounts(const char *source)
>  int oldroot;
>  int newroot;
>  
> -if (mount(source, source, NULL, MS_BIND, NULL) < 0) {
> +if (mount(source, source, NULL, MS_BIND | MS_REC, NULL) < 0) {
>  fuse_log(FUSE_LOG_ERR, "mount(%s, %s, MS_BIND): %m\n", source, 
> source);
>  exit(1);
>  }

Do we want MS_SLAVE to pick up future mounts that might happenf rom the
host?
What's the interaction between this and the MS_REC|MS_SLAVE that we have
a few lines above for / ?

Dave

> -- 
> 2.25.3
> 
--
Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK




Re: [PATCH] e1000e: Added ICR clearing by corresponding IMS bit.

2020-04-27 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20200427152148.283771-1-and...@daynix.com/



Hi,

This series failed the asan build test. Please find the testing commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
export ARCH=x86_64
make docker-image-fedora V=1 NETWORK=1
time make docker-test-debug@fedora TARGET_LIST=x86_64-softmmu J=14 NETWORK=1
=== TEST SCRIPT END ===

PASS 31 test-opts-visitor /visitor/opts/range/unvisited
PASS 32 test-opts-visitor /visitor/opts/range/beyond
PASS 33 test-opts-visitor /visitor/opts/dict/unvisited
==6243==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 4 fdc-test /x86_64/fdc/media_change
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-coroutine -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-coroutine" 
PASS 5 fdc-test /x86_64/fdc/sense_interrupt
---
PASS 8 fdc-test /x86_64/fdc/verify
PASS 9 fdc-test /x86_64/fdc/media_insert
PASS 10 fdc-test /x86_64/fdc/read_no_dma_1
==6253==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 test-coroutine /basic/no-dangling-access
PASS 2 test-coroutine /basic/lifecycle
==6253==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 
0x7ffef1ae3000; bottom 0x7ff887c01000; size: 0x000669ee2000 (27547017216)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 3 test-coroutine /basic/yield
---
PASS 12 test-aio /aio/event/flush
PASS 13 test-aio /aio/event/wait/no-flush-cb
PASS 14 test-aio /aio/timer/schedule
==6269==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 11 fdc-test /x86_64/fdc/read_no_dma_18
PASS 15 test-aio /aio/coroutine/queue-chaining
PASS 16 test-aio /aio-gsource/flush
---
PASS 28 test-aio /aio-gsource/timer/schedule
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-aio-multithread -m=quick -k --tap < /dev/null | 
./scripts/tap-driver.pl --test-name="test-aio-multithread" 
PASS 1 test-aio-multithread /aio/multi/lifecycle
==6274==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 2 test-aio-multithread /aio/multi/schedule
PASS 12 fdc-test /x86_64/fdc/read_no_dma_19
PASS 13 fdc-test /x86_64/fdc/fuzz-registers
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img 
tests/qtest/ide-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="ide-test" 
PASS 3 test-aio-multithread /aio/multi/mutex/contended
==6296==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 ide-test /x86_64/ide/identify
==6307==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 2 ide-test /x86_64/ide/flush
==6313==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 3 ide-test /x86_64/ide/bmdma/simple_rw
==6319==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 4 ide-test /x86_64/ide/bmdma/trim
==6325==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 4 test-aio-multithread /aio/multi/mutex/handoff
PASS 5 test-aio-multithread /aio/multi/mutex/mcs
PASS 6 test-aio-multithread /aio/multi/mutex/pthread
---
PASS 6 test-throttle /throttle/detach_attach
PASS 7 test-throttle /throttle/config_functions
PASS 8 test-throttle /throttle/accounting
==6342==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 9 test-throttle /throttle/groups
PASS 10 test-throttle /throttle/config/enabled
PASS 11 test-throttle /throttle/config/conflicting
---
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-thread-pool -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-thread-pool" 
PASS 1 test-thread-pool /thread-pool/submit
PASS 2 test-thread-pool /thread-pool/submit-aio
==6346==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 3 test-thread-pool /thread-pool/submit-co
PASS 4 test-thread-pool /thread-pool/submit-many
PASS 5 test-thread-pool /thread-pool/cancel
==6413==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 6 test-thread-pool /thread-pool/cancel-async
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-hbitmap 

Re: [PATCH v3 13/18] target/arm: Update contiguous first-fault and no-fault loads

2020-04-27 Thread Richard Henderson
On 4/27/20 9:32 AM, Peter Maydell wrote:
 + * From this point on, all memory operations are MemSingleNF.
 + *
 + * Per the MemSingleNF pseudocode, a no-fault load from Device memory
 + * must not actually hit the bus -- it returns (UNKNOWN, FAULT) 
 instead.
 + * If you map non-RAM with Normal memory attributes and do a NF
 + * load then it should access the bus -- but doing so is illegal.
 + *
 + * While we do not have access to the memory attributes from the PTE
 + * to tell Device memory from Normal memory, we can validly assume 
 that
 + * non-RAM has been mapped as Device memory.  Thus we indicate fault
 + * on all MMIO.
>>>
>>> I still don't understand why this is right. All non-RAM is MMIO
>>> but not all MMIO is non-RAM; so you might have something that's
>>> MMIO (at least for the moment) and has been mapped Normal. That
>>> shouldn't fault.
>>
>> Everything that must go through the slow path has TLB_MMIO set.
> 
> Yes. But not everything that goes through the slow path is Device memory.
> We can (should) fault on all accesses to Device memory, but we can't
> fault on all accesses that are slow-pathed, because some of them could
> be entirely valid Normal memory.

We *can* indicate fault from MemSingleNF for any reason whatsoever, or no
reason whatsoever.

> // Implementation may suppress NF load for any reason
> if ConstrainUnpredictableBool(Unpredictable_NONFAULT) then
>   return (bits(8*size) UNKNOWN, TRUE);

What I'm trying to talk about above, is the third statement in MemSingleNF,

> // Non-fault load from Device memory must not be performed externally
> if memaddrdesc.memattrs.memtype == MemType_Device then
>   return (bits(8*size) UNKNOWN, TRUE);

and the reason we can't actually test MemType_Device here.

If you have better wording for that, I'm all ears.  But I don't think there's
an actual bug here.


r~



Re: [PATCH v3 13/18] target/arm: Update contiguous first-fault and no-fault loads

2020-04-27 Thread Peter Maydell
On Mon, 27 Apr 2020 at 17:16, Richard Henderson
 wrote:
>
> On 4/27/20 4:03 AM, Peter Maydell wrote:
> > On Wed, 22 Apr 2020 at 05:33, Richard Henderson
> >  wrote:
> >>
> >> With sve_cont_ldst_pages, the differences between first-fault and no-fault
> >> are minimal, so unify the routines.  With cpu_probe_watchpoint, we are able
> >> to make progress through pages with TLB_WATCHPOINT set when the watchpoint
> >> does not actually fire.
> >>
> >> Signed-off-by: Richard Henderson 
> >
> >
> >>  /*
> >> - * Perform one normal read, which will fault or not.
> >> - * But it is likely to bring the page into the tlb.
> >> + * From this point on, all memory operations are MemSingleNF.
> >> + *
> >> + * Per the MemSingleNF pseudocode, a no-fault load from Device memory
> >> + * must not actually hit the bus -- it returns (UNKNOWN, FAULT) 
> >> instead.
> >> + * If you map non-RAM with Normal memory attributes and do a NF
> >> + * load then it should access the bus -- but doing so is illegal.
> >> + *
> >> + * While we do not have access to the memory attributes from the PTE
> >> + * to tell Device memory from Normal memory, we can validly assume 
> >> that
> >> + * non-RAM has been mapped as Device memory.  Thus we indicate fault
> >> + * on all MMIO.
> >
> > I still don't understand why this is right. All non-RAM is MMIO
> > but not all MMIO is non-RAM; so you might have something that's
> > MMIO (at least for the moment) and has been mapped Normal. That
> > shouldn't fault.
>
> Everything that must go through the slow path has TLB_MMIO set.

Yes. But not everything that goes through the slow path is Device memory.
We can (should) fault on all accesses to Device memory, but we can't
fault on all accesses that are slow-pathed, because some of them could
be entirely valid Normal memory.

> What you're thinking of, romd, has TLB_MMIO set on the write comparator but 
> not
> the read comparator.

True when the romd device is in 'romd mode', ie mr->romd_mode is
true. Otherwise memory_region_is_romd() returns false and
tlb_set_page_with_attrs() treats it like normal MMIO, because
both read and write must take the slow path. (For flash this
happens when it is put into programming mode and reads from
the memory region are no longer simple reads from the backing
host RAM.)

thanks
-- PMM



Re: [PATCH v3 13/18] target/arm: Update contiguous first-fault and no-fault loads

2020-04-27 Thread Richard Henderson
On 4/27/20 4:03 AM, Peter Maydell wrote:
> On Wed, 22 Apr 2020 at 05:33, Richard Henderson
>  wrote:
>>
>> With sve_cont_ldst_pages, the differences between first-fault and no-fault
>> are minimal, so unify the routines.  With cpu_probe_watchpoint, we are able
>> to make progress through pages with TLB_WATCHPOINT set when the watchpoint
>> does not actually fire.
>>
>> Signed-off-by: Richard Henderson 
> 
> 
>>  /*
>> - * Perform one normal read, which will fault or not.
>> - * But it is likely to bring the page into the tlb.
>> + * From this point on, all memory operations are MemSingleNF.
>> + *
>> + * Per the MemSingleNF pseudocode, a no-fault load from Device memory
>> + * must not actually hit the bus -- it returns (UNKNOWN, FAULT) instead.
>> + * If you map non-RAM with Normal memory attributes and do a NF
>> + * load then it should access the bus -- but doing so is illegal.
>> + *
>> + * While we do not have access to the memory attributes from the PTE
>> + * to tell Device memory from Normal memory, we can validly assume that
>> + * non-RAM has been mapped as Device memory.  Thus we indicate fault
>> + * on all MMIO.
> 
> I still don't understand why this is right. All non-RAM is MMIO
> but not all MMIO is non-RAM; so you might have something that's
> MMIO (at least for the moment) and has been mapped Normal. That
> shouldn't fault.

Everything that must go through the slow path has TLB_MMIO set.

What you're thinking of, romd, has TLB_MMIO set on the write comparator but not
the read comparator.

Have another browse through tlb_set_page_with_attrs, lines 859-893, and the
uses of is_romd.



r~



Re: [PATCH 0/4] arm: Implement ARMv8.2-TTS2UXN

2020-04-27 Thread Edgar E. Iglesias
On Mon, Mar 30, 2020 at 10:03:56PM +0100, Peter Maydell wrote:
> This is obviously not 5.0 material, but I figured it would be better
> to push it out for review now rather than hang on to it and forget...
> 
> TTS2UXN is an ARMv8.2 extension which changes the 'XN' field in stage
> 2 translation table descriptors from just bit [54] to bits [54:53],
> allowing stage 2 to control execution permissions separately for EL0
> and EL1.
> 
> For QEMU this had the potential to be awkward, because it means that
> the stage 2 translation now depends on whether it's being used
> for an EL0 or an EL1 stage 1 access (the address doesn't change
> but the access permissions do). Fortunately, although we allocated
> a QEMU TLB/MMU index for Stage 2, we never actually look anything
> up in the TLB. So patch 1 turns ARMMMUIdx_Stage2 into a 'NOTLB'
> index (ie one without a QEMU TLB), thus avoiding the complication
> of splitting it into separate Stage2-for-EL0 and Stage2-for-EL1
> indexes. Once we've done that the actual implementation is pretty
> trivial -- we just need to plumb an extra 's1_is_el0' argument
> into get_phys_addr_lpae(), and then use it to decide what to do.

Hi Peter,

The whole series looks good to me:

Reviewed-by: Edgar E. Iglesias 

Cheers,
Edgar



> 
> Peter Maydell (4):
>   target/arm: Don't use a TLB for ARMMMUIdx_Stage2
>   target/arm: Use enum constant in get_phys_addr_lpae() call
>   target/arm: Add new 's1_is_el0' argument to get_phys_addr_lpae()
>   target/arm: Implement ARMv8.2-TTS2UXN
> 
>  target/arm/cpu-param.h |   2 +-
>  target/arm/cpu.h   |  36 ++--
>  target/arm/cpu.c   |   1 +
>  target/arm/cpu64.c |   2 +
>  target/arm/helper.c| 183 -
>  5 files changed, 107 insertions(+), 117 deletions(-)
> 
> -- 
> 2.20.1
> 
> 



Re: [PATCH v3 04/18] accel/tcg: Add probe_access_flags

2020-04-27 Thread Richard Henderson
On 4/27/20 3:48 AM, Peter Maydell wrote:
> probe_access() handles watchpoints. Why doesn't probe_access_flags()
> have to do that?

Because we are explicitly deferring that work to the caller.  That's a good
fraction of the point of the new interface.

>> +/* Handle clean RAM pages.  */
>> +if (flags & TLB_NOTDIRTY) {
>> +notdirty_write(env_cpu(env), addr, 1, iotlbentry, retaddr);
>> +}
>> +
>> +/* Handle watchpoints.  */
>> +if (flags & TLB_WATCHPOINT) {
>> +int wp_access = (access_type == MMU_DATA_STORE
>> + ? BP_MEM_WRITE : BP_MEM_READ);
>> +cpu_check_watchpoint(env_cpu(env), addr, size,
>> + iotlbentry->attrs, wp_access, retaddr);
>> +}
> 
> The old code checked for watchpoints first, and then handled notdirty-writes,
> which seems like the more correct order. Why has the new
> version switched them around?

Not an intentional change, but I shouldn't think it would matter in the end.

> The probe_access_internal() doc comment doesn't say that it
> guarantees to set host to NULL for the TLB_MMIO/TLB_INVALID_MASK
> cases, but we implicitly rely on it here.

Eh?  probe_access_internal doesn't have a doc comment.  Call that a bug if you
like, but you seem to be talking about something else.

>> +void *probe_access(CPUArchState *env, target_ulong addr, int size,
>> +   MMUAccessType access_type, int mmu_idx, uintptr_t 
>> retaddr)
>> +{
>> +void *host;
>> +
>> +g_assert(-(addr | TARGET_PAGE_MASK) >= size);
>> +probe_access_flags(env, addr, access_type, mmu_idx, false, , 
>> retaddr);
>> +return host;
> 
> The old code returned NULL for a zero size; the new version does not.

Granted.

> The old code passed size into cc->tlb_fill; the new version does not.
> The old code passed size into page_check_range(); the new version does not.

This is the user-only version, and size is not used for tlb_fill.  It is only
trivially used in page_change_range; we have just verified that addr+size does
not cross a page boundary.


r~



Re: [PATCH v22 QEMU 3/5] virtio-balloon: Replace free page hinting references to 'report' with 'hint'

2020-04-27 Thread David Hildenbrand
On 27.04.20 17:57, Alexander Duyck wrote:
> On Mon, Apr 27, 2020 at 8:11 AM David Hildenbrand  wrote:
>>
>> On 27.04.20 17:08, Alexander Duyck wrote:
>>> On Mon, Apr 27, 2020 at 1:15 AM David Hildenbrand  wrote:

 There is only one wrong comment remaining I think. Something like

 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
 index a1d6fb52c8..1b2127c04c 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
 @@ -554,8 +554,8 @@ static void 
 virtio_balloon_free_page_stop(VirtIOBalloon *s)
   */
  qemu_mutex_lock(>free_page_lock);
  /*
 - * The guest hasn't done the reporting, so host sends a 
 notification
 - * to the guest to actively stop the reporting.
 + * The guest isn't done with hinting, so the host sends a 
 notification
 + * to the guest to actively stop the hinting.
>>>
>>> I'll probably tweak it slightly and drop the "with". So the comment will 
>>> read:
>>> /*
>>>  * The guest isn't done hinting, so host sends a notification
>>
>> I always feel like "so host sends" sounds wrong ("the host"). But I am
>> not a native speaker.
> 
> Actually it might read better to get rid of "the host" entirely to
> make it more of an imperative statement rather than a declarative one.
> Maybe something more like:
> /*
>  * The guest isn't done hinting, so send a notification
>  * to the guest to actively stop the hinting.
>  */
> 

Sounds good :)

-- 
Thanks,

David / dhildenb




Re: [PATCH v22 QEMU 3/5] virtio-balloon: Replace free page hinting references to 'report' with 'hint'

2020-04-27 Thread Alexander Duyck
On Mon, Apr 27, 2020 at 8:11 AM David Hildenbrand  wrote:
>
> On 27.04.20 17:08, Alexander Duyck wrote:
> > On Mon, Apr 27, 2020 at 1:15 AM David Hildenbrand  wrote:
> >>
> >> There is only one wrong comment remaining I think. Something like
> >>
> >> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> >> index a1d6fb52c8..1b2127c04c 100644
> >> --- a/hw/virtio/virtio-balloon.c
> >> +++ b/hw/virtio/virtio-balloon.c
> >> @@ -554,8 +554,8 @@ static void 
> >> virtio_balloon_free_page_stop(VirtIOBalloon *s)
> >>   */
> >>  qemu_mutex_lock(>free_page_lock);
> >>  /*
> >> - * The guest hasn't done the reporting, so host sends a 
> >> notification
> >> - * to the guest to actively stop the reporting.
> >> + * The guest isn't done with hinting, so the host sends a 
> >> notification
> >> + * to the guest to actively stop the hinting.
> >
> > I'll probably tweak it slightly and drop the "with". So the comment will 
> > read:
> > /*
> >  * The guest isn't done hinting, so host sends a notification
>
> I always feel like "so host sends" sounds wrong ("the host"). But I am
> not a native speaker.

Actually it might read better to get rid of "the host" entirely to
make it more of an imperative statement rather than a declarative one.
Maybe something more like:
/*
 * The guest isn't done hinting, so send a notification
 * to the guest to actively stop the hinting.
 */



Re: [PATCH v7 00/10] block: Fix resize (extending) of short overlays

2020-04-27 Thread Kevin Wolf
Am 24.04.2020 um 14:54 hat Kevin Wolf geschrieben:
> v7:
> - Allocate smaller zero buffer [Vladimir]
> - Added missing error_setg_errno() [Max]
> - Code cleanup in the iotest, enabled mapping for 'metadata' [Vladimir]
> - Don't assign to errp twice [Eric]

Thanks for the review, applied to the block branch.

Kevin




Re: [PATCH v5 0/4] introduction of migration_version attribute for VFIO live migration

2020-04-27 Thread Dr. David Alan Gilbert
* Yan Zhao (yan.y.z...@intel.com) wrote:
> On Sat, Apr 25, 2020 at 03:10:49AM +0800, Dr. David Alan Gilbert wrote:
> > * Yan Zhao (yan.y.z...@intel.com) wrote:
> > > On Tue, Apr 21, 2020 at 08:08:49PM +0800, Tian, Kevin wrote:
> > > > > From: Yan Zhao
> > > > > Sent: Tuesday, April 21, 2020 10:37 AM
> > > > > 
> > > > > On Tue, Apr 21, 2020 at 06:56:00AM +0800, Alex Williamson wrote:
> > > > > > On Sun, 19 Apr 2020 21:24:57 -0400
> > > > > > Yan Zhao  wrote:
> > > > > >
> > > > > > > On Fri, Apr 17, 2020 at 07:24:57PM +0800, Cornelia Huck wrote:
> > > > > > > > On Fri, 17 Apr 2020 05:52:02 -0400
> > > > > > > > Yan Zhao  wrote:
> > > > > > > >
> > > > > > > > > On Fri, Apr 17, 2020 at 04:44:50PM +0800, Cornelia Huck wrote:
> > > > > > > > > > On Mon, 13 Apr 2020 01:52:01 -0400
> > > > > > > > > > Yan Zhao  wrote:
> > > > > > > > > >
> > > > > > > > > > > This patchset introduces a migration_version attribute 
> > > > > > > > > > > under sysfs
> > > > > of VFIO
> > > > > > > > > > > Mediated devices.
> > > > > > > > > > >
> > > > > > > > > > > This migration_version attribute is used to check 
> > > > > > > > > > > migration
> > > > > compatibility
> > > > > > > > > > > between two mdev devices.
> > > > > > > > > > >
> > > > > > > > > > > Currently, it has two locations:
> > > > > > > > > > > (1) under mdev_type node,
> > > > > > > > > > > which can be used even before device creation, but 
> > > > > > > > > > > only for
> > > > > mdev
> > > > > > > > > > > devices of the same mdev type.
> > > > > > > > > > > (2) under mdev device node,
> > > > > > > > > > > which can only be used after the mdev devices are 
> > > > > > > > > > > created, but
> > > > > the src
> > > > > > > > > > > and target mdev devices are not necessarily be of the 
> > > > > > > > > > > same
> > > > > mdev type
> > > > > > > > > > > (The second location is newly added in v5, in order to 
> > > > > > > > > > > keep
> > > > > consistent
> > > > > > > > > > > with the migration_version node for migratable pass-though
> > > > > devices)
> > > > > > > > > >
> > > > > > > > > > What is the relationship between those two attributes?
> > > > > > > > > >
> > > > > > > > > (1) is for mdev devices specifically, and (2) is provided to 
> > > > > > > > > keep the
> > > > > same
> > > > > > > > > sysfs interface as with non-mdev cases. so (2) is for both 
> > > > > > > > > mdev
> > > > > devices and
> > > > > > > > > non-mdev devices.
> > > > > > > > >
> > > > > > > > > in future, if we enable vfio-pci vendor ops, (i.e. a non-mdev 
> > > > > > > > > device
> > > > > > > > > is binding to vfio-pci, but is able to register migration 
> > > > > > > > > region and do
> > > > > > > > > migration transactions from a vendor provided affiliate 
> > > > > > > > > driver),
> > > > > > > > > the vendor driver would export (2) directly, under device 
> > > > > > > > > node.
> > > > > > > > > It is not able to provide (1) as there're no mdev devices 
> > > > > > > > > involved.
> > > > > > > >
> > > > > > > > Ok, creating an alternate attribute for non-mdev devices makes 
> > > > > > > > sense.
> > > > > > > > However, wouldn't that rather be a case (3)? The change here 
> > > > > > > > only
> > > > > > > > refers to mdev devices.
> > > > > > > >
> > > > > > > as you pointed below, (3) and (2) serve the same purpose.
> > > > > > > and I think a possible usage is to migrate between a non-mdev 
> > > > > > > device and
> > > > > > > an mdev device. so I think it's better for them both to use (2) 
> > > > > > > rather
> > > > > > > than creating (3).
> > > > > >
> > > > > > An mdev type is meant to define a software compatible interface, so 
> > > > > > in
> > > > > > the case of mdev->mdev migration, doesn't migrating to a different 
> > > > > > type
> > > > > > fail the most basic of compatibility tests that we expect userspace 
> > > > > > to
> > > > > > perform?  IOW, if two mdev types are migration compatible, it seems 
> > > > > > a
> > > > > > prerequisite to that is that they provide the same software 
> > > > > > interface,
> > > > > > which means they should be the same mdev type.
> > > > > >
> > > > > > In the hybrid cases of mdev->phys or phys->mdev, how does a
> > > > > management
> > > > > > tool begin to even guess what might be compatible?  Are we expecting
> > > > > > libvirt to probe ever device with this attribute in the system?  Is
> > > > > > there going to be a new class hierarchy created to enumerate all
> > > > > > possible migrate-able devices?
> > > > > >
> > > > > yes, management tool needs to guess and test migration compatible
> > > > > between two devices. But I think it's not the problem only for
> > > > > mdev->phys or phys->mdev. even for mdev->mdev, management tool needs
> > > > > to
> > > > > first assume that the two mdevs have the same type of parent devices
> > > > > (e.g.their pciids are equal). otherwise, it's still enumerating
> > > > > possibilities.
> > > > > 
> > > > > on the other hand, for two mdevs,
> > 

Re: Questionable aspects of QEMU Error's design

2020-04-27 Thread Markus Armbruster
Markus Armbruster  writes:

> Markus Armbruster  writes:
>
>> QEMU's Error was patterned after GLib's GError.  Differences include:
> [...]
>> * Return value conventions
>>
>>   Common: non-void functions return a distinct error value on failure
>>   when such a value can be defined.  Patterns:
>>
>>   - Functions returning non-null pointers on success return null pointer
>> on failure.
>>
>>   - Functions returning non-negative integers on success return a
>> negative error code on failure.
>>
>>   Different: GLib discourages void functions, because these lead to
>>   awkward error checking code.  We have tons of them, and tons of
>>   awkward error checking code:
>>
>> Error *err = NULL;
>> frobnicate(arg, );
>> if (err) {
>> ... recover ...
>> error_propagate(errp, err);
>> }
>>
>>   instead of
>>
>> if (!frobnicate(arg, errp))
>> ... recover ...
>> }
>>
>>   Can also lead to pointless creation of Error objects.
>>
>>   I consider this a design mistake.  Can we still fix it?  We have more
>>   than 2000 void functions taking an Error ** parameter...
>>
>>   Transforming code that receives and checks for errors with Coccinelle
>>   shouldn't be hard.  Transforming code that returns errors seems more
>>   difficult.  We need to transform explicit and implicit return to
>>   either return true or return false, depending on what we did to the
>>   @errp parameter on the way to the return.  Hmm.
> [...]
>
> To figure out what functions with an Error ** parameter return, I used
> Coccinelle to find such function definitions and print the return types.
> Summary of results:
>
>2155 void
> 873 signed integer
> 494 pointer
> 153 bool
>  33 unsigned integer
>   6 enum
>-
>3714 total
>
> I then used Coccinelle to find checked calls of void functions (passing
> _fatal or _abort is not considered "checking" here).  These
> calls become simpler if we make the functions return a useful value.  I
> found a bit under 600 direct calls, and some 50 indirect calls.
>
> Most frequent direct calls:
>
> 127 object_property_set_bool
>  27 qemu_opts_absorb_qdict
>  16 visit_type_str
>  14 visit_type_int
>  10 visit_type_uint32
>
> Let's have a closer look at object_property_set() & friends.  Out of
> almost 1000 calls, some 150 are checked.  While I'm sure many of the
> unchecked calls can't actually fail, I am concerned some unchecked calls
> can.
>
> If we adopt the convention to return a value that indicates success /
> failure, we should consider converting object.h to it sooner rather than
> later.
>
> Please understand these are rough numbers from quick & dirty scripts.

FYI, I'm working on converting QemuOpts, QAPI visitors and QOM.  I keep
running into bugs.  So far:

[PATCH v2 for-5.1 0/9] qemu-option: Fix corner cases and clean up
[PATCH for-5.1 0/5] qobject: Minor spring cleaning
[PATCH v2 00/14] Miscellaneous error handling fixes
[PATCH 0/4] Subject: [PATCH 0/4] smbus: SPD fixes
[PATCH 0/3] fuzz: Probably there is a better way to do this
[PATCH v2 00/15] qapi: Spring cleaning
[PATCH 00/11] More miscellaneous error handling fixes

I got another one coming for QOM and qdev before I can post the
conversion.

Vladimir, since the conversion will mess with error_propagate(), I'd
like to get it in before your auto-propagation work.




[PATCH RFC v2 3/3] target/arm: Implement SVE2 SM4EKEY, RAX1

2020-04-27 Thread Stephen Long
Signed-off-by: Stephen Long 
---
 target/arm/helper-sve.h|  3 +++
 target/arm/sve.decode  |  4 
 target/arm/sve_helper.c| 20 
 target/arm/translate-sve.c | 30 ++
 4 files changed, 57 insertions(+)

diff --git a/target/arm/helper-sve.h b/target/arm/helper-sve.h
index 6cd6fdfae1..e509137e4a 100644
--- a/target/arm/helper-sve.h
+++ b/target/arm/helper-sve.h
@@ -2697,3 +2697,6 @@ DEF_HELPER_FLAGS_3(sve2_aesimc, TCG_CALL_NO_RWG, void, 
ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sve2_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sve2_aesd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sve2_sm4e, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(sve2_sm4ekey, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(sve2_rax1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index 1cb5792bb1..278530ca83 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -1435,3 +1435,7 @@ AESIMC  01000101 00 1011100 1 0 .   
@rdn_e0
 AESE01000101 00 10001 0 11100 0 . .  @pd5_pn5_e0
 AESD01000101 00 10001 0 11100 1 . .  @pd5_pn5_e0
 SM4E01000101 00 10001 1 11100 0 . .  @pd5_pn5_e0
+
+## SVE2 crypto constructive binary operations
+SM4EKEY 01000101 00 1 . 0 0 . .  @rd_rn_rm_e0
+RAX101000101 00 1 . 0 1 . .  @rd_rn_rm_e0
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index 4204659276..8307abc401 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -7542,3 +7542,23 @@ void HELPER(sve2_sm4e)(void *vd, void *vn, uint32_t desc)
 HELPER(crypto_sm4e)(vd + i, vn + i);
 }
 }
+
+void HELPER(sve2_sm4ekey)(void *vd, void *vn, void *vm, uint32_t desc)
+{
+intptr_t i, opr_sz = simd_oprsz(desc);
+for (i = 0; i < opr_sz; i += 16) {
+HELPER(crypto_sm4ekey)(vd + i, vn + i, vm + i);
+}
+}
+
+void HELPER(sve2_rax1)(void *vd, void *vn, void *vm, uint32_t desc)
+{
+intptr_t i, opr_sz = simd_oprsz(desc) / 8;
+uint64_t *d = vd, *n = vn, *m = vm;
+
+for (i = 0; i < opr_sz; ++i) {
+uint64_t nn = n[i];
+uint64_t mm = m[i];
+d[i] = nn ^ rol64(mm, 1);
+}
+}
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index 6b26d8c512..2baa51b2b2 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -7990,3 +7990,33 @@ static bool trans_SM4E(DisasContext *s, arg_rr_esz *a)
 }
 return true;
 }
+
+static bool trans_SM4EKEY(DisasContext *s, arg_rrr_esz *a)
+{
+if (!dc_isar_feature(aa64_sve2_sm4, s)) {
+return false;
+}
+if (sve_access_check(s)) {
+unsigned vsz = vec_full_reg_size(s);
+tcg_gen_gvec_3_ool(vec_full_reg_offset(s, a->rd),
+   vec_full_reg_offset(s, a->rn),
+   vec_full_reg_offset(s, a->rm),
+   vsz, vsz, 0, gen_helper_sve2_sm4ekey);
+}
+return true;
+}
+
+static bool trans_RAX1(DisasContext *s, arg_rrr_esz *a)
+{
+if (!dc_isar_feature(aa64_sve2_sm4, s)) {
+return false;
+}
+if (sve_access_check(s)) {
+unsigned vsz = vec_full_reg_size(s);
+tcg_gen_gvec_3_ool(vec_full_reg_offset(s, a->rd),
+   vec_full_reg_offset(s, a->rn),
+   vec_full_reg_offset(s, a->rm),
+   vsz, vsz, 0, gen_helper_sve2_rax1);
+}
+return true;
+}
-- 
2.17.1




[PATCH RFC v2 1/3] target/arm: Implement SVE2 AESMC, AESIMC

2020-04-27 Thread Stephen Long
Signed-off-by: Stephen Long 
---
 target/arm/helper-sve.h|  3 +++
 target/arm/sve.decode  | 10 ++
 target/arm/sve_helper.c| 15 +++
 target/arm/translate-sve.c | 18 ++
 4 files changed, 46 insertions(+)

diff --git a/target/arm/helper-sve.h b/target/arm/helper-sve.h
index 51ad60e5c3..340fe07801 100644
--- a/target/arm/helper-sve.h
+++ b/target/arm/helper-sve.h
@@ -2690,3 +2690,6 @@ DEF_HELPER_FLAGS_5(sve2_sqrdcmlah__d, TCG_CALL_NO_RWG,
 
 DEF_HELPER_FLAGS_6(fmmla_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, ptr, 
i32)
 DEF_HELPER_FLAGS_6(fmmla_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, ptr, 
i32)
+
+DEF_HELPER_FLAGS_3(sve2_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sve2_aesimc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index de3768c24a..f58eb04d11 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -92,6 +92,10 @@
 # Named instruction formats.  These are generally used to
 # reduce the amount of duplication between instruction patterns.
 
+# One operand with unused vector element size
+@rdn_e0  .. ... . . rd:5 \
+_esz rn=%reg_movprfx esz=0
+
 # Two operand with unused vector element size
 @pd_pn_e0     ... rn:4 . rd:4   _esz esz=0
 
@@ -1419,3 +1423,9 @@ STNT1_zprz  1110010 .. 00 . 001 ... . . \
 # SVE2 32-bit scatter non-temporal store (vector plus scalar)
 STNT1_zprz  1110010 .. 10 . 001 ... . . \
 @rprr_scatter_store xs=0 esz=2 scale=0
+
+ SVE2 Crypto Extensions
+
+## SVE2 crypto unary operations
+AESMC   01000101 00 1011100 0 0 .   @rdn_e0
+AESIMC  01000101 00 1011100 1 0 .   @rdn_e0
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index cd5c6f7fb0..5c3dee048d 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -7516,3 +7516,18 @@ void HELPER(fmmla_d)(void *vd, void *va, void *vn, void 
*vm,
 d[3] = float64_add(a[3], float64_add(p0, p1, status), status);
 }
 }
+
+#define DO_SVE2_AES_CRYPTO(NAME, FN)\
+void HELPER(NAME)(void *vd, void *vn, uint32_t desc)\
+{   \
+intptr_t i, opr_sz = simd_oprsz(desc);  \
+intptr_t decrypt = simd_data(desc); \
+for (i = 0; i < opr_sz; i += 16) {  \
+HELPER(FN)(vd + i, vn + i, decrypt);\
+}   \
+}
+
+DO_SVE2_AES_CRYPTO(sve2_aesmc, crypto_aesmc);
+DO_SVE2_AES_CRYPTO(sve2_aesimc, crypto_aesmc);
+
+#undef DO_SVE2_AES_CRYPTO
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index 86c3d0ed11..f70b7f44e3 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -7956,3 +7956,21 @@ static bool trans_SQRDCMLAH_(DisasContext *s, 
arg_CMLA_ *a)
 };
 return do_sve2__fn(s, a->rd, a->rn, a->rm, a->ra, fns[a->esz], a->rot);
 }
+
+#define DO_SVE2_AES_CRYPTO(NAME, name, DECRYPT) \
+static bool trans_##NAME(DisasContext *s, arg_rr_esz *a)\
+{   \
+if (!dc_isar_feature(aa64_sve2_aes, s)) {   \
+return false;   \
+}   \
+if (sve_access_check(s)) {  \
+unsigned vsz = vec_full_reg_size(s);\
+tcg_gen_gvec_2_ool(vec_full_reg_offset(s, a->rd),   \
+   vec_full_reg_offset(s, a->rn),   \
+   vsz, vsz, DECRYPT, gen_helper_sve2_##name);  \
+}   \
+return true;\
+}
+
+DO_SVE2_AES_CRYPTO(AESMC, aesmc, 0)
+DO_SVE2_AES_CRYPTO(AESIMC, aesimc, 1)
-- 
2.17.1




[PATCH RFC v2 0/3] target/arm: Implement SVE2 Crypto Extensions

2020-04-27 Thread Stephen Long
Used one macro to cover the helper functions for
SVE2 AESC, AESIMC, AESE, AESD.

No macro was used to implement the helper functions for
SM4E, SM4EKEY, RAX1.

Stephen Long (3):
  target/arm: Implement SVE2 AESMC, AESIMC
  target/arm: Implement SVE2 AESE, AESD, SM4E
  target/arm: Implement SVE2 SM4EKEY, RAX1

 target/arm/cpu.h   |  5 +++
 target/arm/helper-sve.h| 10 ++
 target/arm/sve.decode  | 20 
 target/arm/sve_helper.c| 46 +++
 target/arm/translate-sve.c | 64 ++
 5 files changed, 145 insertions(+)

-- 
2.17.1




[PATCH RFC v2 2/3] target/arm: Implement SVE2 AESE, AESD, SM4E

2020-04-27 Thread Stephen Long
Signed-off-by: Stephen Long 
---
 target/arm/cpu.h   |  5 +
 target/arm/helper-sve.h|  4 
 target/arm/sve.decode  |  6 ++
 target/arm/sve_helper.c| 11 +++
 target/arm/translate-sve.c | 16 
 5 files changed, 42 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index d41c4a08c0..8b1dc38b9c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3880,6 +3880,11 @@ static inline bool isar_feature_aa64_sve2_f64mm(const 
ARMISARegisters *id)
 return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, F64MM) != 0;
 }
 
+static inline bool isar_feature_aa64_sve2_sm4(const ARMISARegisters *id)
+{
+return FIELD_EX64(id->id_aa64zfr0, ID_AA64ZFR0, SM4) != 0;
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
diff --git a/target/arm/helper-sve.h b/target/arm/helper-sve.h
index 340fe07801..6cd6fdfae1 100644
--- a/target/arm/helper-sve.h
+++ b/target/arm/helper-sve.h
@@ -2693,3 +2693,7 @@ DEF_HELPER_FLAGS_6(fmmla_d, TCG_CALL_NO_RWG, void, ptr, 
ptr, ptr, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_3(sve2_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(sve2_aesimc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_3(sve2_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sve2_aesd, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(sve2_sm4e, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index f58eb04d11..1cb5792bb1 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -98,6 +98,7 @@
 
 # Two operand with unused vector element size
 @pd_pn_e0     ... rn:4 . rd:4   _esz esz=0
+@pd5_pn5_e0   .. rn:5 rd:5  _esz esz=0
 
 # Two operand
 @pd_pn   esz:2 ..  ... rn:4 . rd:4  _esz
@@ -1429,3 +1430,8 @@ STNT1_zprz  1110010 .. 10 . 001 ... . . \
 ## SVE2 crypto unary operations
 AESMC   01000101 00 1011100 0 0 .   @rdn_e0
 AESIMC  01000101 00 1011100 1 0 .   @rdn_e0
+
+## SVE2 crpyto destructive binary operations
+AESE01000101 00 10001 0 11100 0 . .  @pd5_pn5_e0
+AESD01000101 00 10001 0 11100 1 . .  @pd5_pn5_e0
+SM4E01000101 00 10001 1 11100 0 . .  @pd5_pn5_e0
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index 5c3dee048d..4204659276 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -7530,4 +7530,15 @@ void HELPER(NAME)(void *vd, void *vn, uint32_t desc) 
   \
 DO_SVE2_AES_CRYPTO(sve2_aesmc, crypto_aesmc);
 DO_SVE2_AES_CRYPTO(sve2_aesimc, crypto_aesmc);
 
+DO_SVE2_AES_CRYPTO(sve2_aese, crypto_aese);
+DO_SVE2_AES_CRYPTO(sve2_aesd, crypto_aese);
+
 #undef DO_SVE2_AES_CRYPTO
+
+void HELPER(sve2_sm4e)(void *vd, void *vn, uint32_t desc)
+{
+intptr_t i, opr_sz = simd_oprsz(desc);
+for (i = 0; i < opr_sz; i += 16) {
+HELPER(crypto_sm4e)(vd + i, vn + i);
+}
+}
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index f70b7f44e3..6b26d8c512 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -7974,3 +7974,19 @@ static bool trans_##NAME(DisasContext *s, arg_rr_esz *a) 
   \
 
 DO_SVE2_AES_CRYPTO(AESMC, aesmc, 0)
 DO_SVE2_AES_CRYPTO(AESIMC, aesimc, 1)
+DO_SVE2_AES_CRYPTO(AESE, aese, 0)
+DO_SVE2_AES_CRYPTO(AESD, aesd, 1)
+
+static bool trans_SM4E(DisasContext *s, arg_rr_esz *a)
+{
+if (!dc_isar_feature(aa64_sve2_sm4, s)) {
+return false;
+}
+if (sve_access_check(s)) {
+unsigned vsz = vec_full_reg_size(s);
+tcg_gen_gvec_2_ool(vec_full_reg_offset(s, a->rd),
+   vec_full_reg_offset(s, a->rn),
+   vsz, vsz, 0, gen_helper_sve2_sm4e);
+}
+return true;
+}
-- 
2.17.1




Re: [PATCH 0/5] QEMU Gating CI

2020-04-27 Thread Daniel P . Berrangé
On Mon, Apr 27, 2020 at 04:41:38PM +0200, Philippe Mathieu-Daudé wrote:
> On 4/27/20 4:28 PM, Cleber Rosa wrote:
> > On Mon, 27 Apr 2020 12:51:36 +0200
> > Philippe Mathieu-Daudé  wrote:
> > 
> > > On 4/27/20 7:12 AM, Cleber Rosa wrote:
> > > > On Thu, 23 Apr 2020 23:28:21 +0200
> > > > Philippe Mathieu-Daudé  wrote:
> > > [...]
> > > > > In some cases custom runners are acceptable. These runners won't be
> > > > > "gating" but can post informative log and status.
> > > > > 
> > > > 
> > > > Well, I have the feeling that some people maintaining those runners
> > > > will *not* want to have them as "informational" only.  If they
> > > > invest a good amount of time on them, I believe they'll want to
> > > > reap the benefits such as other not breaking the code they rely on.
> > > >   If their system is not gating, they lose that and may find
> > > > breakage that CI did not catch.  Again, I don't think "easily
> > > > accessible" hardware should be the only criteria for
> > > > gating/non-gating status.
> > > > 
> > > > For instance, would you consider, say, a "Raspberry Pi 4 Model
> > > > B", running KVM jobs to be a reproducible runner?  Would you blame a
> > > > developer that breaks a Gating CI job on such a platform and says
> > > > that he can not reproduce it?
> > > 
> > > I'm not sure I understood the problem, as I'd answer "yes" but I
> > > guess you expect me to say "no"?
> > > 
> > 
> > What I mean is: would you blame such a developer for *not* having a
> > machine himself/herself that he/she can try to reproduce the failure?
> > And would you consider a "Raspberry Pi 4 Model B" an easily available
> > hardware?
> 
> My view on this is if someone merged code in mainstream QEMU and maintains
> it, and if it is not easy to reproduce the setup (for a bug reported by a CI
> script), then it is the responsibility of the maintainer to resolve it.
> Either by providing particular access to the hardware, or be ready to spend
> a long debugging session over email and multiple time zones.
> 
> If it is not possible, then this specific code/setup can not claim for
> gating CI, and eventually mainstream isn't the best place for it.

I'd caution to be wary about using gating CI as a big stick for hitting
contributors with. The more rules we put in place whicih contributors
have to follow before their work gets accepted for merge, the less likely
someone is to have a positive experiance contributing to the project, or
even be willing to try. This view of gating CI requirements was a negative
aspect of contributing to the OpenStack project, which drove people away.
There was pushback against contributing work because it lacked CI, but
there was often no viable way for to actually provide CI in a feasible
timeframe, especially for stuff only testable in physical hardware and
not VMs. Even if you work for a big company, it doesn't make it easy to
magic up money to spend on hardware & hosting to provide CI, as corporate
beaurcracy & priorities will get in your way.

I'd really encourage the more nuanced approach of thinking in terms of
tiered support levels:

  - Tier 1: features that we have gating CI tests for. Will always work.

  - Tier 2: features that we have non-gating CI test for. Should work at
time of release, but may be broken for periods in git master.

  - Tier 3: features that we don't have CI tests for. Compile tested only,
relying on end user manual testing, so may or may not work
at any time or in release.

Obviously tier 1 is the gold standard that we would like everything to
achieve but we'll never achieve that reality unless we cull 90% of QEMU's
code. I don't think that's in the best interests of our users, because
clearly stuff in Tier 2 and Tier 3 is still useful for a large portion of
our end users - not least because Tier 3 is the level everything is at
right now in QEMU unless using a downstream vendor's packages.

The tier levels and CI are largely around setting reasonable quality
expectations. Right now we often have a problem that poeople want to
re-factor code but are afraid of breaking existing functionality that
guests rely on. This causes delays in merging code or causes people to
not even attempt the refactoring in the first place. This harms our
forward progress in QEMU.

With gating CI, we are declaring that contributors should feel free to
refactor anything as long as it passes gating CI. IOW, contributors only
have to care about Tier 1 features continuing to work. It would be nice
if refactoring does not breaks stuff in Tier 2 / 3, but if it does, then
that is acceptable collatoral damage. We would not block the merge on
stuff that is Tier 2 / 3.

Based on what I experianced in OpenStack the other big challenge is
deciding when something can be promoted from Tier 2 to Tier 1. They
had the official gating CI (for Tier 1) being maintained by the core
project infrastructure team. Any CI provided by third party companies
was 

Re: [PATCH 0/5] QEMU Gating CI

2020-04-27 Thread Cleber Rosa
On Mon, 27 Apr 2020 16:41:38 +0200
Philippe Mathieu-Daudé  wrote:

> On 4/27/20 4:28 PM, Cleber Rosa wrote:
> > 
> > What I mean is: would you blame such a developer for *not* having a
> > machine himself/herself that he/she can try to reproduce the
> > failure? And would you consider a "Raspberry Pi 4 Model B" an
> > easily available hardware?
> 
> My view on this is if someone merged code in mainstream QEMU and 
> maintains it, and if it is not easy to reproduce the setup (for a bug 
> reported by a CI script), then it is the responsibility of the 
> maintainer to resolve it. Either by providing particular access to
> the hardware, or be ready to spend a long debugging session over
> email and multiple time zones.
> 

Right, the "easy to reproduce" has a lot to with access to hardware,
and a lot to do with access to the same or reproducible setup.  And
yes, if I maintain platform/job "foobar" that was once upgraded to
gating status, has since then fallen behind and doesn't allow users to
easily reproduce it, it all falls unto the maintainer to resolve issues.

I'd even say that people having access to identical hardware could
proactively challenge a given job status as gating if they fail to
reproduce it with the provided documentation/scripts.

> If it is not possible, then this specific code/setup can not claim
> for gating CI, and eventually mainstream isn't the best place for it.
> 
> >> [...]
> 

IIUC, we're in agreement. :)

Thanks,
- CLeber.




Re: [PATCH v3 0/3] RISC-V Spike machine improvements

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 1:07 AM Anup Patel  wrote:
>
> This series improves QEMU Spike machine to:
> 1. Allow loading OpenBI firmware using -bios option
> 2. Allow more than one CPUs
>
> Changes since v2:
>  - Rebased on QEMU v5.0-rc4
>
> Changes since v1:
>  - Rebased on QEMU master (commit 2ac031d171ccd18c973014d9978b4a63f0ad5fb0)

Applied to the RISC-V tree for 5.1.

Alistair

>
> Anup Patel (3):
>   hw/riscv: Add optional symbol callback ptr to riscv_load_firmware()
>   hw/riscv/spike: Allow loading firmware separately using -bios option
>   hw/riscv/spike: Allow more than one CPUs
>
>  hw/riscv/boot.c | 13 -
>  hw/riscv/sifive_u.c |  2 +-
>  hw/riscv/spike.c| 26 --
>  hw/riscv/virt.c |  2 +-
>  include/hw/riscv/boot.h |  6 --
>  5 files changed, 38 insertions(+), 11 deletions(-)
>
> --
> 2.25.1
>
>



Re: [PATCH v3 1/3] hw/riscv: Add optional symbol callback ptr to riscv_load_firmware()

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 1:09 AM Anup Patel  wrote:
>
> This patch adds an optional function pointer, "sym_cb", to
> riscv_load_firmware() which provides the possibility to access
> the symbol table during kernel loading.
>
> The pointer is ignored, if supplied with flat (non-elf) firmware image.
>
> The Spike board requires it locate the HTIF symbols from firmware ELF
> passed via "-bios" option.
>
> Signed-off-by: Anup Patel 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/riscv/boot.c | 13 -
>  hw/riscv/sifive_u.c |  2 +-
>  hw/riscv/virt.c |  2 +-
>  include/hw/riscv/boot.h |  6 --
>  4 files changed, 14 insertions(+), 9 deletions(-)
>
> diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
> index b8e765277d..726300a171 100644
> --- a/hw/riscv/boot.c
> +++ b/hw/riscv/boot.c
> @@ -36,7 +36,8 @@
>
>  void riscv_find_and_load_firmware(MachineState *machine,
>const char *default_machine_firmware,
> -  hwaddr firmware_load_addr)
> +  hwaddr firmware_load_addr,
> +  symbol_fn_t sym_cb)
>  {
>  char *firmware_filename = NULL;
>
> @@ -76,7 +77,7 @@ void riscv_find_and_load_firmware(MachineState *machine,
>
>  if (firmware_filename) {
>  /* If not "none" load the firmware */
> -riscv_load_firmware(firmware_filename, firmware_load_addr);
> +riscv_load_firmware(firmware_filename, firmware_load_addr, sym_cb);
>  g_free(firmware_filename);
>  }
>  }
> @@ -96,12 +97,14 @@ char *riscv_find_firmware(const char *firmware_filename)
>  }
>
>  target_ulong riscv_load_firmware(const char *firmware_filename,
> - hwaddr firmware_load_addr)
> + hwaddr firmware_load_addr,
> + symbol_fn_t sym_cb)
>  {
>  uint64_t firmware_entry, firmware_start, firmware_end;
>
> -if (load_elf(firmware_filename, NULL, NULL, NULL, _entry,
> - _start, _end, NULL, 0, EM_RISCV, 1, 0) > 
> 0) {
> +if (load_elf_ram_sym(firmware_filename, NULL, NULL, NULL,
> + _entry, _start, _end, 
> NULL,
> + 0, EM_RISCV, 1, 0, NULL, true, sym_cb) > 0) {
>  return firmware_entry;
>  }
>
> diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
> index 56351c4faa..54bb9eb1bf 100644
> --- a/hw/riscv/sifive_u.c
> +++ b/hw/riscv/sifive_u.c
> @@ -345,7 +345,7 @@ static void riscv_sifive_u_init(MachineState *machine)
>  create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline);
>
>  riscv_find_and_load_firmware(machine, BIOS_FILENAME,
> - memmap[SIFIVE_U_DRAM].base);
> + memmap[SIFIVE_U_DRAM].base, NULL);
>
>  if (machine->kernel_filename) {
>  uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
> diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
> index 85ec9e22aa..24f851e895 100644
> --- a/hw/riscv/virt.c
> +++ b/hw/riscv/virt.c
> @@ -507,7 +507,7 @@ static void riscv_virt_board_init(MachineState *machine)
>  mask_rom);
>
>  riscv_find_and_load_firmware(machine, BIOS_FILENAME,
> - memmap[VIRT_DRAM].base);
> + memmap[VIRT_DRAM].base, NULL);
>
>  if (machine->kernel_filename) {
>  uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
> diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
> index df80051fbc..474a940ad5 100644
> --- a/include/hw/riscv/boot.h
> +++ b/include/hw/riscv/boot.h
> @@ -24,10 +24,12 @@
>
>  void riscv_find_and_load_firmware(MachineState *machine,
>const char *default_machine_firmware,
> -  hwaddr firmware_load_addr);
> +  hwaddr firmware_load_addr,
> +  symbol_fn_t sym_cb);
>  char *riscv_find_firmware(const char *firmware_filename);
>  target_ulong riscv_load_firmware(const char *firmware_filename,
> - hwaddr firmware_load_addr);
> + hwaddr firmware_load_addr,
> + symbol_fn_t sym_cb);
>  target_ulong riscv_load_kernel(const char *kernel_filename,
> symbol_fn_t sym_cb);
>  hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
> --
> 2.25.1
>
>



Re: [virtio-dev] Re: [PATCH v22 QEMU 0/5] virtio-balloon: add support for page poison reporting and free page reporting

2020-04-27 Thread Alexander Duyck
On Mon, Apr 27, 2020 at 1:21 AM David Hildenbrand  wrote:
>
> Except one minor nit, looks good to me. We'll have to take care of
> compat handling regarding patch #4 as soon as we have 5.0 compat
> machines in place.

I will clean up the one comment and submit later today if there is no
other follow-up.

Thanks.

- Alex



Re: [PATCH v22 QEMU 3/5] virtio-balloon: Replace free page hinting references to 'report' with 'hint'

2020-04-27 Thread David Hildenbrand
On 27.04.20 17:08, Alexander Duyck wrote:
> On Mon, Apr 27, 2020 at 1:15 AM David Hildenbrand  wrote:
>>
>> There is only one wrong comment remaining I think. Something like
>>
>> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
>> index a1d6fb52c8..1b2127c04c 100644
>> --- a/hw/virtio/virtio-balloon.c
>> +++ b/hw/virtio/virtio-balloon.c
>> @@ -554,8 +554,8 @@ static void virtio_balloon_free_page_stop(VirtIOBalloon 
>> *s)
>>   */
>>  qemu_mutex_lock(>free_page_lock);
>>  /*
>> - * The guest hasn't done the reporting, so host sends a notification
>> - * to the guest to actively stop the reporting.
>> + * The guest isn't done with hinting, so the host sends a 
>> notification
>> + * to the guest to actively stop the hinting.
> 
> I'll probably tweak it slightly and drop the "with". So the comment will read:
> /*
>  * The guest isn't done hinting, so host sends a notification

I always feel like "so host sends" sounds wrong ("the host"). But I am
not a native speaker.

>  * to the guest to actively stop the hinting.
>  */
> 
> There is one other spot left which is support for migration. The name
> for the VMStateDescription is
> "virtio-balloon-device/free-page-report". I am assuming I cannot
> rename that. Otherwise all other references to report on the balloon
> interface refer to reporting errors from what I can tell.

Yeah, that has to stay for migration to keep working.


-- 
Thanks,

David / dhildenb




Re: [PATCH v3 2/3] hw/riscv/spike: Allow loading firmware separately using -bios option

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 1:08 AM Anup Patel  wrote:
>
> This patch extends Spike machine support to allow loading OpenSBI
> firmware (fw_jump.elf) separately using -bios option.
>
> Signed-off-by: Anup Patel 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/riscv/spike.c | 24 +++-
>  1 file changed, 23 insertions(+), 1 deletion(-)
>
> diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
> index 5053fe4590..b0395e227c 100644
> --- a/hw/riscv/spike.c
> +++ b/hw/riscv/spike.c
> @@ -45,6 +45,12 @@
>
>  #include 
>
> +#if defined(TARGET_RISCV32)
> +# define BIOS_FILENAME "opensbi-riscv32-spike-fw_jump.elf"
> +#else
> +# define BIOS_FILENAME "opensbi-riscv64-spike-fw_jump.elf"
> +#endif
> +
>  static const struct MemmapEntry {
>  hwaddr base;
>  hwaddr size;
> @@ -183,8 +189,24 @@ static void spike_board_init(MachineState *machine)
>  memory_region_add_subregion(system_memory, memmap[SPIKE_MROM].base,
>  mask_rom);
>
> +riscv_find_and_load_firmware(machine, BIOS_FILENAME,
> + memmap[SPIKE_DRAM].base,
> + htif_symbol_callback);
> +
>  if (machine->kernel_filename) {
> -riscv_load_kernel(machine->kernel_filename, htif_symbol_callback);
> +uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
> +  htif_symbol_callback);
> +
> +if (machine->initrd_filename) {
> +hwaddr start;
> +hwaddr end = riscv_load_initrd(machine->initrd_filename,
> +   machine->ram_size, kernel_entry,
> +   );
> +qemu_fdt_setprop_cell(s->fdt, "/chosen",
> +  "linux,initrd-start", start);
> +qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
> +  end);
> +}
>  }
>
>  /* reset vector */
> --
> 2.25.1
>
>



Re: [PATCH v3 3/3] hw/riscv/spike: Allow more than one CPUs

2020-04-27 Thread Alistair Francis
On Mon, Apr 27, 2020 at 1:09 AM Anup Patel  wrote:
>
> Currently, the upstream Spike ISA simulator allows more than
> one CPUs so we update QEMU Spike machine on similar lines to
> allow more than one CPUs.
>
> The maximum number of CPUs for QEMU Spike machine is kept
> same as QEMU Virt machine.
>
> Signed-off-by: Anup Patel 

Reviewed-by: Alistair Francis 

Alistair

> ---
>  hw/riscv/spike.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
> index b0395e227c..1799b9291c 100644
> --- a/hw/riscv/spike.c
> +++ b/hw/riscv/spike.c
> @@ -472,7 +472,7 @@ static void spike_machine_init(MachineClass *mc)
>  {
>  mc->desc = "RISC-V Spike Board";
>  mc->init = spike_board_init;
> -mc->max_cpus = 1;
> +mc->max_cpus = 8;
>  mc->is_default = true;
>  mc->default_cpu_type = SPIKE_V1_10_0_CPU;
>  }
> --
> 2.25.1
>
>



Re: [PATCH v22 QEMU 3/5] virtio-balloon: Replace free page hinting references to 'report' with 'hint'

2020-04-27 Thread Alexander Duyck
On Mon, Apr 27, 2020 at 1:15 AM David Hildenbrand  wrote:
>
> There is only one wrong comment remaining I think. Something like
>
> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> index a1d6fb52c8..1b2127c04c 100644
> --- a/hw/virtio/virtio-balloon.c
> +++ b/hw/virtio/virtio-balloon.c
> @@ -554,8 +554,8 @@ static void virtio_balloon_free_page_stop(VirtIOBalloon 
> *s)
>   */
>  qemu_mutex_lock(>free_page_lock);
>  /*
> - * The guest hasn't done the reporting, so host sends a notification
> - * to the guest to actively stop the reporting.
> + * The guest isn't done with hinting, so the host sends a 
> notification
> + * to the guest to actively stop the hinting.

I'll probably tweak it slightly and drop the "with". So the comment will read:
/*
 * The guest isn't done hinting, so host sends a notification
 * to the guest to actively stop the hinting.
 */

There is one other spot left which is support for migration. The name
for the VMStateDescription is
"virtio-balloon-device/free-page-report". I am assuming I cannot
rename that. Otherwise all other references to report on the balloon
interface refer to reporting errors from what I can tell.



[PATCH] e1000e: Added ICR clearing by corresponding IMS bit.

2020-04-27 Thread andrew
From: Andrew Melnychenko 

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1707441
Added ICR clearing if there is IMS bit - according to the note by
section 13.3.27 of the 8257X developers manual.

Signed-off-by: Andrew Melnychenko 
---
 hw/net/e1000e_core.c | 9 +
 hw/net/trace-events  | 1 +
 2 files changed, 10 insertions(+)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index d5676871fa..8878b7ef00 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -2624,6 +2624,15 @@ e1000e_mac_icr_read(E1000ECore *core, int index)
 e1000e_clear_ims_bits(core, core->mac[IAM]);
 }
 
+/*
+ * PCIe* GbE Controllers Open Source Software Developer’s Manual
+ * 13.3.27 Interrupt Cause Read Register
+ */
+if (core->mac[ICR] & core->mac[IMS]) {
+trace_e1000e_irq_icr_clear_icr_bit_ims(core->mac[ICR], core->mac[IMS]);
+core->mac[ICR] = 0;
+}
+
 trace_e1000e_irq_icr_read_exit(core->mac[ICR]);
 e1000e_update_interrupt_state(core);
 return ret;
diff --git a/hw/net/trace-events b/hw/net/trace-events
index e18f883cfd..46e40fcfa9 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -237,6 +237,7 @@ e1000e_irq_icr_read_entry(uint32_t icr) "Starting ICR read. 
Current ICR: 0x%x"
 e1000e_irq_icr_read_exit(uint32_t icr) "Ending ICR read. Current ICR: 0x%x"
 e1000e_irq_icr_clear_zero_ims(void) "Clearing ICR on read due to zero IMS"
 e1000e_irq_icr_clear_iame(void) "Clearing ICR on read due to IAME"
+e1000e_irq_icr_clear_icr_bit_ims(uint32_t icr, uint32_t ims) "Clearing ICR on 
read due corresponding IMS bit: 0x%x & 0x%x"
 e1000e_irq_iam_clear_eiame(uint32_t iam, uint32_t cause) "Clearing IMS due to 
EIAME, IAM: 0x%X, cause: 0x%X"
 e1000e_irq_icr_clear_eiac(uint32_t icr, uint32_t eiac) "Clearing ICR bits due 
to EIAC, ICR: 0x%X, EIAC: 0x%X"
 e1000e_irq_ims_clear_set_imc(uint32_t val) "Clearing IMS bits due to IMC write 
0x%x"
-- 
2.24.1




[PATCH v2 2/9] block/io: refactor bdrv_co_ioctl: move aio stuff to corresponding block

2020-04-27 Thread Vladimir Sementsov-Ogievskiy
Signed-off-by: Vladimir Sementsov-Ogievskiy 
Reviewed-by: Stefan Hajnoczi 
---
 block/io.c | 23 +++
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/block/io.c b/block/io.c
index 94ab8eaa0f..880871e691 100644
--- a/block/io.c
+++ b/block/io.c
@@ -3125,31 +3125,38 @@ int bdrv_pdiscard(BdrvChild *child, int64_t offset, 
int64_t bytes)
 
 int bdrv_co_ioctl(BlockDriverState *bs, int req, void *buf)
 {
+int ret;
 BlockDriver *drv = bs->drv;
-CoroutineIOCompletion co = {
-.coroutine = qemu_coroutine_self(),
-};
-BlockAIOCB *acb;
 
 bdrv_inc_in_flight(bs);
+
 if (!drv || (!drv->bdrv_aio_ioctl && !drv->bdrv_co_ioctl)) {
-co.ret = -ENOTSUP;
+ret = -ENOTSUP;
 goto out;
 }
 
 if (drv->bdrv_co_ioctl) {
-co.ret = drv->bdrv_co_ioctl(bs, req, buf);
+ret = drv->bdrv_co_ioctl(bs, req, buf);
 } else {
+CoroutineIOCompletion co = {
+.coroutine = qemu_coroutine_self(),
+};
+BlockAIOCB *acb;
+
 acb = drv->bdrv_aio_ioctl(bs, req, buf, bdrv_co_io_em_complete, );
 if (!acb) {
-co.ret = -ENOTSUP;
+ret = -ENOTSUP;
 goto out;
 }
+
 qemu_coroutine_yield();
+ret = co.ret;
 }
+
 out:
 bdrv_dec_in_flight(bs);
-return co.ret;
+
+return ret;
 }
 
 void *qemu_blockalign(BlockDriverState *bs, size_t size)
-- 
2.21.0




[PATCH v2 7/9] block/io: add bdrv_do_pwrite_zeroes

2020-04-27 Thread Vladimir Sementsov-Ogievskiy
We'll need a bdrv_co_pwrite_zeroes version without inc/dec in_flight to
be used in further implementation of bdrv_make_zero.

Signed-off-by: Vladimir Sementsov-Ogievskiy 
Reviewed-by: Stefan Hajnoczi 
---
 block/io.c | 23 +++
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/block/io.c b/block/io.c
index 1cb6f433e5..e6a8ead46c 100644
--- a/block/io.c
+++ b/block/io.c
@@ -2016,8 +2016,10 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
 return ret;
 }
 
-int coroutine_fn bdrv_co_pwrite_zeroes(BdrvChild *child, int64_t offset,
-   int bytes, BdrvRequestFlags flags)
+/* To be called between exactly one pair of bdrv_inc/dec_in_flight() */
+static int coroutine_fn
+bdrv_do_pwrite_zeroes(BdrvChild *child, int64_t offset, int bytes,
+  BdrvRequestFlags flags)
 {
 trace_bdrv_co_pwrite_zeroes(child->bs, offset, bytes, flags);
 
@@ -2025,8 +2027,21 @@ int coroutine_fn bdrv_co_pwrite_zeroes(BdrvChild *child, 
int64_t offset,
 flags &= ~BDRV_REQ_MAY_UNMAP;
 }
 
-return bdrv_co_pwritev(child, offset, bytes, NULL,
-   BDRV_REQ_ZERO_WRITE | flags);
+return bdrv_do_pwritev_part(child, offset, bytes, NULL, 0,
+BDRV_REQ_ZERO_WRITE | flags);
+}
+
+int coroutine_fn
+bdrv_co_pwrite_zeroes(BdrvChild *child, int64_t offset, int bytes,
+  BdrvRequestFlags flags)
+{
+int ret;
+
+bdrv_inc_in_flight(child->bs);
+ret = bdrv_do_pwrite_zeroes(child, offset, bytes, flags);
+bdrv_dec_in_flight(child->bs);
+
+return ret;
 }
 
 typedef struct RwCo {
-- 
2.21.0




[PATCH v2 4/9] block/io: move bdrv_rw_co_entry and friends down

2020-04-27 Thread Vladimir Sementsov-Ogievskiy
We are going to use bdrv_co_pwritev_part and bdrv_co_preadv_part in
bdrv_rw_co_entry, so move it down.

Note: Comment formatting was changed to conform to coding style and
function order was changed. Otherwise the code is unmodified.

Signed-off-by: Vladimir Sementsov-Ogievskiy 
Reviewed-by: Stefan Hajnoczi 
---
 block/io.c | 361 +++--
 1 file changed, 181 insertions(+), 180 deletions(-)

diff --git a/block/io.c b/block/io.c
index 1134f8144a..061f3f2590 100644
--- a/block/io.c
+++ b/block/io.c
@@ -891,186 +891,6 @@ static int bdrv_check_byte_request(BlockDriverState *bs, 
int64_t offset,
 return 0;
 }
 
-typedef struct RwCo {
-BdrvChild *child;
-int64_t offset;
-QEMUIOVector *qiov;
-bool is_write;
-int ret;
-BdrvRequestFlags flags;
-} RwCo;
-
-static void coroutine_fn bdrv_rw_co_entry(void *opaque)
-{
-RwCo *rwco = opaque;
-
-if (!rwco->is_write) {
-rwco->ret = bdrv_co_preadv(rwco->child, rwco->offset,
-   rwco->qiov->size, rwco->qiov,
-   rwco->flags);
-} else {
-rwco->ret = bdrv_co_pwritev(rwco->child, rwco->offset,
-rwco->qiov->size, rwco->qiov,
-rwco->flags);
-}
-aio_wait_kick();
-}
-
-/*
- * Process a vectored synchronous request using coroutines
- */
-static int bdrv_prwv_co(BdrvChild *child, int64_t offset,
-QEMUIOVector *qiov, bool is_write,
-BdrvRequestFlags flags)
-{
-Coroutine *co;
-RwCo rwco = {
-.child = child,
-.offset = offset,
-.qiov = qiov,
-.is_write = is_write,
-.ret = NOT_DONE,
-.flags = flags,
-};
-
-if (qemu_in_coroutine()) {
-/* Fast-path if already in coroutine context */
-bdrv_rw_co_entry();
-} else {
-co = qemu_coroutine_create(bdrv_rw_co_entry, );
-bdrv_coroutine_enter(child->bs, co);
-BDRV_POLL_WHILE(child->bs, rwco.ret == NOT_DONE);
-}
-return rwco.ret;
-}
-
-int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
-   int bytes, BdrvRequestFlags flags)
-{
-QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
-
-return bdrv_prwv_co(child, offset, , true,
-BDRV_REQ_ZERO_WRITE | flags);
-}
-
-/*
- * Completely zero out a block device with the help of bdrv_pwrite_zeroes.
- * The operation is sped up by checking the block status and only writing
- * zeroes to the device if they currently do not return zeroes. Optional
- * flags are passed through to bdrv_pwrite_zeroes (e.g. BDRV_REQ_MAY_UNMAP,
- * BDRV_REQ_FUA).
- *
- * Returns < 0 on error, 0 on success. For error codes see bdrv_write().
- */
-int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags)
-{
-int ret;
-int64_t target_size, bytes, offset = 0;
-BlockDriverState *bs = child->bs;
-
-target_size = bdrv_getlength(bs);
-if (target_size < 0) {
-return target_size;
-}
-
-for (;;) {
-bytes = MIN(target_size - offset, BDRV_REQUEST_MAX_BYTES);
-if (bytes <= 0) {
-return 0;
-}
-ret = bdrv_block_status(bs, offset, bytes, , NULL, NULL);
-if (ret < 0) {
-return ret;
-}
-if (ret & BDRV_BLOCK_ZERO) {
-offset += bytes;
-continue;
-}
-ret = bdrv_pwrite_zeroes(child, offset, bytes, flags);
-if (ret < 0) {
-return ret;
-}
-offset += bytes;
-}
-}
-
-int bdrv_preadv(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
-{
-int ret;
-
-ret = bdrv_prwv_co(child, offset, qiov, false, 0);
-if (ret < 0) {
-return ret;
-}
-
-return qiov->size;
-}
-
-/* See bdrv_pwrite() for the return codes */
-int bdrv_pread(BdrvChild *child, int64_t offset, void *buf, int bytes)
-{
-QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-
-if (bytes < 0) {
-return -EINVAL;
-}
-
-return bdrv_preadv(child, offset, );
-}
-
-int bdrv_pwritev(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
-{
-int ret;
-
-ret = bdrv_prwv_co(child, offset, qiov, true, 0);
-if (ret < 0) {
-return ret;
-}
-
-return qiov->size;
-}
-
-/* Return no. of bytes on success or < 0 on error. Important errors are:
-  -EIO generic I/O error (may happen for all errors)
-  -ENOMEDIUM   No media inserted.
-  -EINVAL  Invalid offset or number of bytes
-  -EACCES  Trying to write a read-only device
-*/
-int bdrv_pwrite(BdrvChild *child, int64_t offset, const void *buf, int bytes)
-{
-QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-
-if (bytes < 0) {
-return -EINVAL;
-}
-
-return bdrv_pwritev(child, offset, );
-}
-
-/*
- * Writes to the file and ensures that no writes are reordered across this
- * request 

[PATCH v2 9/9] block/io: expand in_flight inc/dec section: bdrv_make_zero

2020-04-27 Thread Vladimir Sementsov-Ogievskiy
It's safer to expand in_flight request to start before enter to
coroutine in synchronous wrappers and end after BDRV_POLL_WHILE loop.
Note that qemu_coroutine_enter may only schedule the coroutine in some
circumstances.

bdrv_make_zero update includes refactoring: move the whole loop into
coroutine, which has additional benefit of not create/enter new
coroutine on each iteration.

Signed-off-by: Vladimir Sementsov-Ogievskiy 
---
 block/io.c | 54 +++---
 1 file changed, 51 insertions(+), 3 deletions(-)

diff --git a/block/io.c b/block/io.c
index 3bc0daec33..cd5374e6c7 100644
--- a/block/io.c
+++ b/block/io.c
@@ -2740,8 +2740,11 @@ int bdrv_is_allocated_above(BlockDriverState *top, 
BlockDriverState *base,
  * BDRV_REQ_FUA).
  *
  * Returns < 0 on error, 0 on success. For error codes see bdrv_write().
+ *
+ * To be called between exactly one pair of bdrv_inc/dec_in_flight()
  */
-int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags)
+static int coroutine_fn
+bdrv_do_make_zero(BdrvChild *child, BdrvRequestFlags flags)
 {
 int ret;
 int64_t target_size, bytes, offset = 0;
@@ -2757,7 +2760,8 @@ int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags 
flags)
 if (bytes <= 0) {
 return 0;
 }
-ret = bdrv_block_status(bs, offset, bytes, , NULL, NULL);
+ret = bdrv_co_block_status(bs, true, false,
+   offset, bytes, , NULL, NULL);
 if (ret < 0) {
 return ret;
 }
@@ -2765,7 +2769,7 @@ int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags 
flags)
 offset += bytes;
 continue;
 }
-ret = bdrv_pwrite_zeroes(child, offset, bytes, flags);
+ret = bdrv_do_pwrite_zeroes(child, offset, bytes, flags);
 if (ret < 0) {
 return ret;
 }
@@ -2773,6 +2777,50 @@ int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags 
flags)
 }
 }
 
+typedef struct BdrvDoMakeZeroData {
+BdrvChild *child;
+BdrvRequestFlags flags;
+int ret;
+bool done;
+} BdrvDoMakeZeroData;
+
+/* To be called between exactly one pair of bdrv_inc/dec_in_flight() */
+static void coroutine_fn bdrv_make_zero_co_entry(void *opaque)
+{
+BdrvDoMakeZeroData *data = opaque;
+
+data->ret = bdrv_do_make_zero(data->child, data->flags);
+data->done = true;
+aio_wait_kick();
+}
+
+int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags)
+{
+int ret;
+
+bdrv_inc_in_flight(child->bs);
+
+if (qemu_in_coroutine()) {
+/* Fast-path if already in coroutine context */
+ret = bdrv_do_make_zero(child, flags);
+} else {
+BdrvDoMakeZeroData data = {
+.child = child,
+.flags = flags,
+.done = false,
+};
+Coroutine *co = qemu_coroutine_create(bdrv_make_zero_co_entry, );
+
+bdrv_coroutine_enter(child->bs, co);
+BDRV_POLL_WHILE(child->bs, !data.done);
+ret = data.ret;
+}
+
+bdrv_dec_in_flight(child->bs);
+
+return ret;
+}
+
 typedef struct BdrvVmstateCo {
 BlockDriverState*bs;
 QEMUIOVector*qiov;
-- 
2.21.0




Re: [PATCH 0/5] QEMU Gating CI

2020-04-27 Thread Philippe Mathieu-Daudé

On 4/27/20 4:28 PM, Cleber Rosa wrote:

On Mon, 27 Apr 2020 12:51:36 +0200
Philippe Mathieu-Daudé  wrote:


On 4/27/20 7:12 AM, Cleber Rosa wrote:

On Thu, 23 Apr 2020 23:28:21 +0200
Philippe Mathieu-Daudé  wrote:

[...]

In some cases custom runners are acceptable. These runners won't be
"gating" but can post informative log and status.



Well, I have the feeling that some people maintaining those runners
will *not* want to have them as "informational" only.  If they
invest a good amount of time on them, I believe they'll want to
reap the benefits such as other not breaking the code they rely on.
  If their system is not gating, they lose that and may find
breakage that CI did not catch.  Again, I don't think "easily
accessible" hardware should be the only criteria for
gating/non-gating status.

For instance, would you consider, say, a "Raspberry Pi 4 Model
B", running KVM jobs to be a reproducible runner?  Would you blame a
developer that breaks a Gating CI job on such a platform and says
that he can not reproduce it?


I'm not sure I understood the problem, as I'd answer "yes" but I
guess you expect me to say "no"?



What I mean is: would you blame such a developer for *not* having a
machine himself/herself that he/she can try to reproduce the failure?
And would you consider a "Raspberry Pi 4 Model B" an easily available
hardware?


My view on this is if someone merged code in mainstream QEMU and 
maintains it, and if it is not easy to reproduce the setup (for a bug 
reported by a CI script), then it is the responsibility of the 
maintainer to resolve it. Either by providing particular access to the 
hardware, or be ready to spend a long debugging session over email and 
multiple time zones.


If it is not possible, then this specific code/setup can not claim for 
gating CI, and eventually mainstream isn't the best place for it.



[...]





[PATCH v2 6/9] block/io: expand in_flight inc/dec section: block-status

2020-04-27 Thread Vladimir Sementsov-Ogievskiy
It's safer to expand in_flight request to start before enter to
coroutine in synchronous wrappers and end after BDRV_POLL_WHILE loop.
Note that qemu_coroutine_enter may only schedule the coroutine in some
circumstances.

block-status requests are complex, they involve querying different
block driver states across backing chain. Let's expand only in_flight
section for the top bs, keeping other sections as is.

Signed-off-by: Vladimir Sementsov-Ogievskiy 
---
 block/io.c | 65 ++
 1 file changed, 51 insertions(+), 14 deletions(-)

diff --git a/block/io.c b/block/io.c
index a91d8c1e21..1cb6f433e5 100644
--- a/block/io.c
+++ b/block/io.c
@@ -2303,6 +2303,10 @@ int coroutine_fn 
bdrv_co_block_status_from_backing(BlockDriverState *bs,
  * _ZERO where possible; otherwise, the result favors larger 'pnum',
  * with a focus on accurate BDRV_BLOCK_ALLOCATED.
  *
+ * If 'inc_in_flight' is true, in_flight counter will be increased for bs 
during
+ * the operation. All nested block_status calls will increase the counter for
+ * corresponding bs anyway.
+ *
  * If 'offset' is beyond the end of the disk image the return value is
  * BDRV_BLOCK_EOF and 'pnum' is set to 0.
  *
@@ -2321,7 +2325,7 @@ int coroutine_fn 
bdrv_co_block_status_from_backing(BlockDriverState *bs,
  * set to the host mapping and BDS corresponding to the guest offset.
  */
 static int coroutine_fn bdrv_co_block_status(BlockDriverState *bs,
- bool want_zero,
+ bool want_zero, bool 
inc_in_flight,
  int64_t offset, int64_t bytes,
  int64_t *pnum, int64_t *map,
  BlockDriverState **file)
@@ -2372,7 +2376,9 @@ static int coroutine_fn 
bdrv_co_block_status(BlockDriverState *bs,
 goto early_out;
 }
 
-bdrv_inc_in_flight(bs);
+if (inc_in_flight) {
+bdrv_inc_in_flight(bs);
+}
 
 /* Round out to request_alignment boundaries */
 align = bs->bl.request_alignment;
@@ -2409,7 +2415,7 @@ static int coroutine_fn 
bdrv_co_block_status(BlockDriverState *bs,
 
 if (ret & BDRV_BLOCK_RAW) {
 assert(ret & BDRV_BLOCK_OFFSET_VALID && local_file);
-ret = bdrv_co_block_status(local_file, want_zero, local_map,
+ret = bdrv_co_block_status(local_file, want_zero, true, local_map,
*pnum, pnum, _map, _file);
 goto out;
 }
@@ -2436,7 +2442,7 @@ static int coroutine_fn 
bdrv_co_block_status(BlockDriverState *bs,
 int64_t file_pnum;
 int ret2;
 
-ret2 = bdrv_co_block_status(local_file, want_zero, local_map,
+ret2 = bdrv_co_block_status(local_file, want_zero, true, local_map,
 *pnum, _pnum, NULL, NULL);
 if (ret2 >= 0) {
 /* Ignore errors.  This is just providing extra information, it
@@ -2459,7 +2465,9 @@ static int coroutine_fn 
bdrv_co_block_status(BlockDriverState *bs,
 }
 
 out:
-bdrv_dec_in_flight(bs);
+if (inc_in_flight) {
+bdrv_dec_in_flight(bs);
+}
 if (ret >= 0 && offset + *pnum == total_size) {
 ret |= BDRV_BLOCK_EOF;
 }
@@ -2473,9 +2481,15 @@ early_out:
 return ret;
 }
 
+/*
+ * If 'inc_in_flight' is true, in_flight counter will be increased for bs 
during
+ * the operation. All block_status calls to the backing chain of bs will
+ * increase the counter for corresponding bs anyway.
+ */
 static int coroutine_fn bdrv_co_block_status_above(BlockDriverState *bs,
BlockDriverState *base,
bool want_zero,
+   bool inc_in_flight,
int64_t offset,
int64_t bytes,
int64_t *pnum,
@@ -2488,11 +2502,13 @@ static int coroutine_fn 
bdrv_co_block_status_above(BlockDriverState *bs,
 
 assert(bs != base);
 for (p = bs; p != base; p = backing_bs(p)) {
-ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map,
-   file);
+ret = bdrv_co_block_status(p, want_zero, inc_in_flight,
+   offset, bytes, pnum, map, file);
 if (ret < 0) {
 break;
 }
+inc_in_flight = true;
+
 if (ret & BDRV_BLOCK_ZERO && ret & BDRV_BLOCK_EOF && !first) {
 /*
  * Reading beyond the end of the file continues to read
@@ -2514,15 +2530,16 @@ static int coroutine_fn 
bdrv_co_block_status_above(BlockDriverState *bs,
 }
 
 static int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs,
+ bool inc_in_flight,
   

[PATCH v2 0/9] block/io: safer inc/dec in_flight sections

2020-04-27 Thread Vladimir Sementsov-Ogievskiy
Hi all!

This is inspired by Kevin's
"block: Fix blk->in_flight during blk_wait_while_drained()" series.

So, like it's now done for block-backends, let's expand
in_flight-protected sections for bdrv_ interfaces, including
coroutine_enter and BDRV_POLL_WHILE loop into these sections.

v2:
01: drop coroutine_fn from bdrv_is_allocated_above declaration
02-04: add Stefan's r-b
05: improve commit message
fix typo in bdrv_do_pdiscard name
add more "To be called between exactly one pair of 
bdrv_inc/dec_in_flight()" comments
drop unused bs variable
fix bdrv_pdiscard_co_entry to use bdrv_do_pdiscard
06: similarly to 05, add additional comment to bdrv_is_allocated_above_co_entry
07-08: add Stefan's r-b
09: add "To be called between exactly one pair of bdrv_inc/dec_in_flight()" for 
bdrv_make_zero_co_entry

Vladimir Sementsov-Ogievskiy (9):
  block/io: refactor bdrv_is_allocated_above to run only one coroutine
  block/io: refactor bdrv_co_ioctl: move aio stuff to corresponding
block
  block/io: move flush and pdiscard stuff down
  block/io: move bdrv_rw_co_entry and friends down
  block/io: expand in_flight inc/dec section: simple cases
  block/io: expand in_flight inc/dec section: block-status
  block/io: add bdrv_do_pwrite_zeroes
  block/io: move bdrv_make_zero under block-status
  block/io: expand in_flight inc/dec section: bdrv_make_zero

 block/io.c | 789 +++--
 1 file changed, 525 insertions(+), 264 deletions(-)

-- 
2.21.0




Re: [PATCH 04/11] s390x/pci: Fix harmless mistake in zpci's property fid's setter

2020-04-27 Thread Markus Armbruster
Matthew Rosato  writes:

> On 4/24/20 3:20 PM, Markus Armbruster wrote:
>> s390_pci_set_fid() sets zpci->fid_defined to true even when
>> visit_type_uint32() failed.  Reproducer: "-device zpci,fid=junk".
>> Harmless in practice, because qdev_device_add() then fails, throwing
>> away @zpci.  Fix it anyway.
>>
>> Cc: Matthew Rosato 
>> Cc: Cornelia Huck 
>> Signed-off-by: Markus Armbruster 
>> ---
>>   hw/s390x/s390-pci-bus.c | 4 +++-
>>   1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
>> index ed8be124da..19ee1f02bb 100644
>> --- a/hw/s390x/s390-pci-bus.c
>> +++ b/hw/s390x/s390-pci-bus.c
>> @@ -1276,7 +1276,9 @@ static void s390_pci_set_fid(Object *obj, Visitor *v, 
>> const char *name,
>>   return;
>>   }
>>   -visit_type_uint32(v, name, ptr, errp);
>> +if (!visit_type_uint32(v, name, ptr, errp)) {
>> +return;
>> +}
>
> Hi Markus,
>
> Am I missing something here (a preceding patch maybe?) -- 
> visit_type_uint32 is a void function.  A quick look, no other callers
> are checking it for a return value either...
>
> The error value might get set in visit_type_uintN though.  Taking a
> hint from other places that handle this sort of case (ex:
> cpu_max_set_sve_max_vq), maybe something like:
>
> Error *err = NULL;
> ...
> visit_type_uint32(v, name, ptr, );
> if (err) {
>   error_propogate(errp, err);
>   return;
> }
> zpci->fid_defined = true;
>
> Instead?

This patch crept into this series by mistake.  It indeed depends on
other work I haven't published, yet.  Thanks, and sorry for wasting your
time!




  1   2   3   >