Re: [Qemu-devel] [PATCH 2/6] Redesign of pciinit.c (take 2)

[Alexey Korolev]

On 16/03/12 13:55, Kevin O'Connor wrote:
> On Thu, Mar 15, 2012 at 04:29:30PM +1300, Alexey Korolev wrote:
>> On 14/03/12 13:48, Kevin O'Connor wrote:
>>> On Tue, Mar 13, 2012 at 05:45:19PM +1300, Alexey Korolev wrote:
 Added pci_region_entry structure and list operations to pciinit.c
 List is filled with entries during pci_check_devices.
 List is used just for printing space allocation if we were using lists. 
 Next step will resource allocation using mapping functions.
> [...]
>>> -struct {
>>> -u32 addr;
>>> -u32 size;
>>> -int is64;
>>> -} bars[PCI_NUM_REGIONS];
> [...]
>> Yes I see what you mean here.
> Thanks - I do find this patch much easier to understand.  I do have
> some comments on the patch (see below).
>
>>>  The code is being changed -
>>> it's not new code being added and old code being deleted - the patches
>>> need to reflect that.
>> Because of structural changes it is not possible to completely avoid
>> this scenario where new code is added and old deleted.  In this
>> patch series I tried my best to make migration as obvious and safe
>> as possible.  So the existing approach (with your suggestions) for
>> pciinit.c redesign is this:
>> 1. Introduce list operations
>> 2. Introduce pci_region_entry structure and add code which fills this new 
>> structure.
>> We don't modify resource addresses calculations, but we use pci_region_entry 
>> data to do resource assignment.
>> 3. Modify resource addresses calculations to be based on linked lists of 
>> region entries.
>> 4. Remove code which fills the arrays, remove use of arrays for mapping.
>> (note 3&4 could be combined altogether but it will be harder to read then)
> On patch 3/4, neither patch should introduce code that isn't actually
> used nor leave code that isn't used still in.  So, for example, if the
> arrays are still used after patch 3 then it's okay to leave them to
> patch 4, but if they are no longer used at all they should be removed
> within patch 3.
>
>> Could you please have a look at the other parts in this series and
>> let me know if you are happy about this approach, so I won't have to
>> redo patchwork too many times?
> patch 1/6 - I'd prefer to have a list.h with struct
>   hlist_head/hlist_node and container_of before extending to other
>   parts of seabios.  That said, I'm okay with what you have for
>   pciinit - we can introduce list.h afterwards.
Then, it should be a separate patch. It's is better to do this afterwards.
> patch 3/4 - was confusing to me as it added new code in one patch and
>   removed the replaced code in the second patch.
>
> patch 5 - looked okay to me.
>
> Thanks for looking at this - I know it's time consuming.  Given the
> churn in this area I want to make sure there is a good understanding
> before any big changes.
>
> comments on the patch:
> [...]
>> +struct pci_region_entry *
>> +pci_region_create_entry(struct pci_bus *bus, struct pci_device *dev,
>> +   u32 size, int type, int is64bit)
>> +{
>> +struct pci_region_entry *entry= malloc_tmp(sizeof(*entry));
>> +if (!entry) {
>> +warn_noalloc();
>> +return NULL;
> Minor - whitespace.
>
> [...]
>> +static int pci_bios_check_devices(struct pci_bus *busses)
>>  {
>>  dprintf(1, "PCI: check devices\n");
>> +struct pci_region_entry *entry;
>>  
>>  // Calculate resources needed for regular (non-bus) devices.
>>  struct pci_device *pci;
>> @@ -378,19 +419,27 @@ static void pci_bios_check_devices(struct pci_bus 
>> *busses)
>>  struct pci_bus *bus = &busses[pci_bdf_to_bus(pci->bdf)];
>>  int i;
>>  for (i = 0; i < PCI_NUM_REGIONS; i++) {
>> -u32 val, size;
>> +u32 val, size, min_size;
>> +int type, is64bit;
> Minor - I prefer to use C99 inline variable declarations though it
> isn't a requirement.
>
>> +min_size = (type == PCI_REGION_TYPE_IO) ? 
>> (1<> + (1<> +size = (size > min_size) ? size : min_size;
> My only real comment: Why the min_size change?  Is that a fix of some
> sort or is it related to the move to lists?
This is a good question.
The min_size changes are to keep the exactly the same behaviour as the original 
implementation,
when each PCI MEM bar is aligned to 4KB (1< [...]
>>  
>> -
>>  /
>>   * Main setup code
> Minor - whitespace change.
>
> -Kevin

[Qemu-devel] [Bug 959852] [NEW] Build fails: osx 10.7, deprecated CoreAudio APIs

[Hans Simer]

Public bug reported:

Virtual audio driver for darwin is using deprecated APIs.

○ → ./configure --cc=/usr/bin/gcc --disable-darwin-user --disable-bsd-
user --disable-guest-agent


○ → make 
.
.
.
  CCaudio/noaudio.o
  CCaudio/wavaudio.o
  CCaudio/mixeng.o
  CCaudio/coreaudio.o
audio/coreaudio.c: In function ‘isPlaying’:
audio/coreaudio.c:152: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
audio/coreaudio.c: In function ‘coreaudio_init_out’:
audio/coreaudio.c:310: warning: ‘AudioHardwareGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:1270)
audio/coreaudio.c:326: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
audio/coreaudio.c:353: warning: ‘AudioDeviceSetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2675)
audio/coreaudio.c:370: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
audio/coreaudio.c:386: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
audio/coreaudio.c:403: warning: ‘AudioDeviceSetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2675)
audio/coreaudio.c:419: warning: ‘AudioDeviceAddIOProc’ is deprecated (declared 
at /System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2419)
audio/coreaudio.c:431: warning: ‘AudioDeviceRemoveIOProc’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2433)
audio/coreaudio.c: In function ‘coreaudio_fini_out’:
audio/coreaudio.c:456: warning: ‘AudioDeviceRemoveIOProc’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2433)
  CCaudio/wavcapture.o

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/959852

Title:
  Build fails: osx 10.7, deprecated CoreAudio APIs

Status in QEMU:
  New

Bug description:
  Virtual audio driver for darwin is using deprecated APIs.

  ○ → ./configure --cc=/usr/bin/gcc --disable-darwin-user --disable-bsd-
  user --disable-guest-agent

  
  ○ → make 
  .
  .
  .
CCaudio/noaudio.o
CCaudio/wavaudio.o
CCaudio/mixeng.o
CCaudio/coreaudio.o
  audio/coreaudio.c: In function ‘isPlaying’:
  audio/coreaudio.c:152: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
  audio/coreaudio.c: In function ‘coreaudio_init_out’:
  audio/coreaudio.c:310: warning: ‘AudioHardwareGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:1270)
  audio/coreaudio.c:326: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
  audio/coreaudio.c:353: warning: ‘AudioDeviceSetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2675)
  audio/coreaudio.c:370: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
  audio/coreaudio.c:386: warning: ‘AudioDeviceGetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2640)
  audio/coreaudio.c:403: warning: ‘AudioDeviceSetProperty’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2675)
  audio/coreaudio.c:419: warning: ‘AudioDeviceAddIOProc’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2419)
  audio/coreaudio.c:431: warning: ‘AudioDeviceRemoveIOProc’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2433)
  audio/coreaudio.c: In function ‘coreaudio_fini_out’:
  audio/coreaudio.c:456: warning: ‘AudioDeviceRemoveIOProc’ is deprecated 
(declared at 
/System/Library/Frameworks/CoreAudio.framework/Headers/AudioHardware.h:2433)
CCaudio/wavcapture.o

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/959852/+subscriptions

[Qemu-devel] [PATCH] virtio-spec: clarify ro/rw bits and updating rule of virtio-net status field

[Jason Wang]

This patch clarifies VIRTIO_NET_S_LINK_UP as a read-only bit and
VIRTIO_NET_S_ANNOUNCE as a read-writable bit. Also introduce the write 1 to
clear semantics for all read-writable bits of config status field. This could
help to reduce the config status field updating race between host and guest and
also simplify the implementation.

Signed-off-by: Jason Wang 
---
 virtio-0.9.4.lyx |   23 +--
 1 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/virtio-0.9.4.lyx b/virtio-0.9.4.lyx
index 6c7bab1..614ab55 100644
--- a/virtio-0.9.4.lyx
+++ b/virtio-0.9.4.lyx
@@ -58,6 +58,7 @@
 \html_be_strict false
 \author -608949062 "Rusty Russell,,," 
 \author 1531152142 "pbonzini" 
+\author 2090695081 "jason" 
 \end_header
 
 \begin_body
@@ -4013,7 +4014,21 @@ layout Two configuration fields are currently defined.
  The mac address field always exists (though is only valid if VIRTIO_NET_F_MAC
  is set), and the status field only exists if VIRTIO_NET_F_STATUS is set.
  Two bits are currently defined for the status field: VIRTIO_NET_S_LINK_UP
- and VIRTIO_NET_S_ANNOUNCE.
+ 
+\change_inserted 2090695081 1332220873
+(read-only) 
+\change_unchanged
+and VIRTIO_NET_S_ANNOUNCE
+\change_inserted 2090695081 1332220883
+ (read-writable)
+\change_unchanged
+.
+
+\change_inserted 2090695081 1332220901
+ Writing 1 to any read-writable bit of status filed would cause the bit
+ to be cleared.
+
+\change_unchanged
  
 \begin_inset listings
 inline false
@@ -4915,7 +4930,11 @@ Processing this notification involves:
 \end_layout
 
 \begin_layout Enumerate
-Clearing VIRTIO_NET_S_ANNOUNCE bit in the status field.
+Clearing VIRTIO_NET_S_ANNOUNCE bit in the status field
+\change_inserted 2090695081 1332220849
+ (by writing 1 to VIRTIO_NET_S_ANNOUNCE bit)
+\change_unchanged
+.
 \end_layout
 
 \begin_layout Enumerate

[Qemu-devel] [PATCH 03/11 v10] implement cpu_get_memory_mapping()

[Wen Congyang]

Walk cpu's page table and collect all virtual address and physical address 
mapping.
Then, add these mapping into memory mapping list. If the guest does not use 
paging,
it will do nothing. Note: the I/O memory will be skipped.

Signed-off-by: Wen Congyang 
---
 Makefile.target   |1 +
 configure |4 +
 cpu-all.h |   11 ++
 target-i386/arch_memory_mapping.c |  266 +
 4 files changed, 282 insertions(+), 0 deletions(-)
 create mode 100644 target-i386/arch_memory_mapping.c

diff --git a/Makefile.target b/Makefile.target
index ccfa107..85a6a0d 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -87,6 +87,7 @@ libobj-y += helper.o
 ifeq ($(TARGET_BASE_ARCH), i386)
 libobj-y += cpuid.o
 endif
+libobj-$(CONFIG_HAVE_GET_MEMORY_MAPPING) += arch_memory_mapping.o
 libobj-$(TARGET_SPARC64) += vis_helper.o
 libobj-$(CONFIG_NEED_MMU) += mmu.o
 libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
diff --git a/configure b/configure
index 8b4e3c1..8540bbb 100755
--- a/configure
+++ b/configure
@@ -3659,6 +3659,10 @@ case "$target_arch2" in
   fi
 fi
 esac
+case "$target_arch2" in
+  i386|x86_64)
+echo "CONFIG_HAVE_GET_MEMORY_MAPPING=y" >> $config_target_mak
+esac
 if test "$target_arch2" = "ppc64" -a "$fdt" = "yes"; then
   echo "CONFIG_PSERIES=y" >> $config_target_mak
 fi
diff --git a/cpu-all.h b/cpu-all.h
index 9621c3c..390b55b 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -22,6 +22,7 @@
 #include "qemu-common.h"
 #include "qemu-tls.h"
 #include "cpu-common.h"
+#include "memory_mapping.h"
 
 /* some important defines:
  *
@@ -525,4 +526,14 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf);
 int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
 uint8_t *buf, int len, int is_write);
 
+#if defined(CONFIG_HAVE_GET_MEMORY_MAPPING)
+int cpu_get_memory_mapping(MemoryMappingList *list, CPUArchState *env);
+#else
+static inline int cpu_get_memory_mapping(MemoryMappingList *list,
+ CPUArchState *env)
+{
+return -1;
+}
+#endif
+
 #endif /* CPU_ALL_H */
diff --git a/target-i386/arch_memory_mapping.c 
b/target-i386/arch_memory_mapping.c
new file mode 100644
index 000..dd64bec
--- /dev/null
+++ b/target-i386/arch_memory_mapping.c
@@ -0,0 +1,266 @@
+/*
+ * i386 memory mapping
+ *
+ * Copyright Fujitsu, Corp. 2011, 2012
+ *
+ * Authors:
+ * Wen Congyang 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#include "cpu.h"
+#include "cpu-all.h"
+
+/* PAE Paging or IA-32e Paging */
+static void walk_pte(MemoryMappingList *list, target_phys_addr_t 
pte_start_addr,
+ int32_t a20_mask, target_ulong start_line_addr)
+{
+target_phys_addr_t pte_addr, start_paddr;
+uint64_t pte;
+target_ulong start_vaddr;
+int i;
+
+for (i = 0; i < 512; i++) {
+pte_addr = (pte_start_addr + i * 8) & a20_mask;
+pte = ldq_phys(pte_addr);
+if (!(pte & PG_PRESENT_MASK)) {
+/* not present */
+continue;
+}
+
+start_paddr = (pte & ~0xfff) & ~(0x1ULL << 63);
+if (cpu_physical_memory_is_io(start_paddr)) {
+/* I/O region */
+continue;
+}
+
+start_vaddr = start_line_addr | ((i & 0x1fff) << 12);
+memory_mapping_list_add_merge_sorted(list, start_paddr,
+ start_vaddr, 1 << 12);
+}
+}
+
+/* 32-bit Paging */
+static void walk_pte2(MemoryMappingList *list,
+  target_phys_addr_t pte_start_addr, int32_t a20_mask,
+  target_ulong start_line_addr)
+{
+target_phys_addr_t pte_addr, start_paddr;
+uint32_t pte;
+target_ulong start_vaddr;
+int i;
+
+for (i = 0; i < 1024; i++) {
+pte_addr = (pte_start_addr + i * 4) & a20_mask;
+pte = ldl_phys(pte_addr);
+if (!(pte & PG_PRESENT_MASK)) {
+/* not present */
+continue;
+}
+
+start_paddr = pte & ~0xfff;
+if (cpu_physical_memory_is_io(start_paddr)) {
+/* I/O region */
+continue;
+}
+
+start_vaddr = start_line_addr | ((i & 0x3ff) << 12);
+memory_mapping_list_add_merge_sorted(list, start_paddr,
+ start_vaddr, 1 << 12);
+}
+}
+
+/* PAE Paging or IA-32e Paging */
+static void walk_pde(MemoryMappingList *list, target_phys_addr_t 
pde_start_addr,
+ int32_t a20_mask, target_ulong start_line_addr)
+{
+target_phys_addr_t pde_addr, pte_start_addr, start_paddr;
+uint64_t pde;
+target_ulong line_addr, start_vaddr;
+int i;
+
+for (i = 0; i < 512; i++) {
+pde_addr = (pde_start_addr + i * 8) & a20_mask;
+pde = ldq_phys(pde_addr);
+if (!(pde & PG_PRESENT_MASK)) {
+  

[Qemu-devel] [PATCH 11/11 v10] introduce a new monitor command 'dump-guest-memory' to dump guest's memory

[Wen Congyang]

The command's usage:
   dump [-p] protocol [begin] [length]
The supported protocol can be file or fd:
1. file: the protocol starts with "file:", and the following string is
   the file's path.
2. fd: the protocol starts with "fd:", and the following string is the
   fd's name.

Note:
  1. If you want to use gdb to process the core, please specify -p option.
 The reason why the -p option is not default is: guest machine in a
 catastrophic state can have corrupted memory, which we cannot trust.
  2. This command doesn't support the fd that is is associated with a pipe,
 socket, or FIFO(lseek will fail with such fd).
  3. If you don't want to dump all guest's memory, please specify the start
 physical address and the length.

Signed-off-by: Wen Congyang 
---
 Makefile.target  |2 +-
 dump.c   |  841 ++
 elf.h|5 +
 hmp-commands.hx  |   28 ++
 hmp.c|   22 ++
 hmp.h|1 +
 memory_mapping.c |   27 ++
 memory_mapping.h |3 +
 qapi-schema.json |   18 ++
 qmp-commands.hx  |   38 +++
 10 files changed, 984 insertions(+), 1 deletions(-)
 create mode 100644 dump.c

diff --git a/Makefile.target b/Makefile.target
index c3aa5d7..0e179c9 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -219,7 +219,7 @@ obj-$(CONFIG_NO_KVM) += kvm-stub.o
 obj-$(CONFIG_VGA) += vga.o
 obj-y += memory.o savevm.o
 obj-y += memory_mapping.o
-obj-$(CONFIG_HAVE_CORE_DUMP) += arch_dump.o
+obj-$(CONFIG_HAVE_CORE_DUMP) += arch_dump.o dump.o
 LIBS+=-lz
 
 obj-i386-$(CONFIG_KVM) += hyperv.o
diff --git a/dump.c b/dump.c
new file mode 100644
index 000..917bccc
--- /dev/null
+++ b/dump.c
@@ -0,0 +1,841 @@
+/*
+ * QEMU dump
+ *
+ * Copyright Fujitsu, Corp. 2011, 2012
+ *
+ * Authors:
+ * Wen Congyang 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu-common.h"
+#include 
+#include "elf.h"
+#include 
+#include 
+#include "cpu.h"
+#include "cpu-all.h"
+#include "targphys.h"
+#include "monitor.h"
+#include "kvm.h"
+#include "dump.h"
+#include "sysemu.h"
+#include "bswap.h"
+#include "memory_mapping.h"
+#include "error.h"
+#include "qmp-commands.h"
+#include "gdbstub.h"
+
+static inline uint16_t cpu_convert_to_target16(uint16_t val, int endian)
+{
+if (endian == ELFDATA2LSB) {
+val = cpu_to_le16(val);
+} else {
+val = cpu_to_be16(val);
+}
+
+return val;
+}
+
+static inline uint32_t cpu_convert_to_target32(uint32_t val, int endian)
+{
+if (endian == ELFDATA2LSB) {
+val = cpu_to_le32(val);
+} else {
+val = cpu_to_be32(val);
+}
+
+return val;
+}
+
+static inline uint64_t cpu_convert_to_target64(uint64_t val, int endian)
+{
+if (endian == ELFDATA2LSB) {
+val = cpu_to_le64(val);
+} else {
+val = cpu_to_be64(val);
+}
+
+return val;
+}
+
+typedef struct DumpState {
+ArchDumpInfo dump_info;
+MemoryMappingList list;
+uint16_t phdr_num;
+uint32_t sh_info;
+bool have_section;
+bool resume;
+target_phys_addr_t memory_offset;
+write_core_dump_function f;
+void (*cleanup)(void *opaque);
+void *opaque;
+
+RAMBlock *block;
+ram_addr_t start;
+bool has_filter;
+int64_t begin;
+int64_t length;
+} DumpState;
+
+static DumpState *dump_get_current(void)
+{
+static DumpState current_dump;
+
+return ¤t_dump;
+}
+
+static int dump_cleanup(DumpState *s)
+{
+int ret = 0;
+
+memory_mapping_list_free(&s->list);
+s->cleanup(s->opaque);
+if (s->resume) {
+vm_start();
+}
+
+return ret;
+}
+
+static void dump_error(DumpState *s, const char *reason)
+{
+dump_cleanup(s);
+}
+
+static int write_elf64_header(DumpState *s)
+{
+Elf64_Ehdr elf_header;
+int ret;
+int endian = s->dump_info.d_endian;
+
+memset(&elf_header, 0, sizeof(Elf64_Ehdr));
+memcpy(&elf_header, ELFMAG, 4);
+elf_header.e_ident[EI_CLASS] = ELFCLASS64;
+elf_header.e_ident[EI_DATA] = s->dump_info.d_endian;
+elf_header.e_ident[EI_VERSION] = EV_CURRENT;
+elf_header.e_type = cpu_convert_to_target16(ET_CORE, endian);
+elf_header.e_machine = cpu_convert_to_target16(s->dump_info.d_machine,
+   endian);
+elf_header.e_version = cpu_convert_to_target32(EV_CURRENT, endian);
+elf_header.e_ehsize = cpu_convert_to_target16(sizeof(elf_header), endian);
+elf_header.e_phoff = cpu_convert_to_target64(sizeof(Elf64_Ehdr), endian);
+elf_header.e_phentsize = cpu_convert_to_target16(sizeof(Elf64_Phdr),
+ endian);
+elf_header.e_phnum = cpu_convert_to_target16(s->phdr_num, endian);
+if (s->have_section) {
+uint64_t shoff = sizeof(Elf64_Ehdr) + sizeof(Elf64_Phdr) * s->sh_info;
+
+elf_header.e_shoff = cpu_convert_to_target64(shoff, endian);
+   

[Qemu-devel] [PATCH 10/11 v10] make gdb_id() generally avialable

[Wen Congyang]

The following patch also needs this API, so make it generally avialable

Signed-off-by: Wen Congyang 
---
 gdbstub.c |9 -
 gdbstub.h |9 +
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/gdbstub.c b/gdbstub.c
index f4e97f7..7f8ac2f 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1939,15 +1939,6 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 #endif
 }
 
-static inline int gdb_id(CPUArchState *env)
-{
-#if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
-return env->host_tid;
-#else
-return env->cpu_index + 1;
-#endif
-}
-
 static CPUArchState *find_cpu(uint32_t thread_id)
 {
 CPUArchState *env;
diff --git a/gdbstub.h b/gdbstub.h
index b44e275..f82ec70 100644
--- a/gdbstub.h
+++ b/gdbstub.h
@@ -30,6 +30,15 @@ void gdb_register_coprocessor(CPUArchState *env,
   gdb_reg_cb get_reg, gdb_reg_cb set_reg,
   int num_regs, const char *xml, int g_pos);
 
+static inline int gdb_id(CPUArchState *env)
+{
+#if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
+return env->host_tid;
+#else
+return env->cpu_index + 1;
+#endif
+}
+
 #endif
 
 #ifdef CONFIG_USER_ONLY
-- 
1.7.1

[Qemu-devel] [PATCH 09/11 v10] target-i386: add API to get dump info

[Wen Congyang]

Dump info contains: endian, class and architecture. The next
patch will use these information to create vmcore. Note: on
x86 box, the  class is ELFCLASS64 if the memory is larger than 4G.

Signed-off-by: Wen Congyang 
---
 cpu-all.h   |7 +++
 dump.h  |   23 +++
 target-i386/arch_dump.c |   34 ++
 3 files changed, 64 insertions(+), 0 deletions(-)
 create mode 100644 dump.h

diff --git a/cpu-all.h b/cpu-all.h
index cd9b013..d7c5a00 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -23,6 +23,7 @@
 #include "qemu-tls.h"
 #include "cpu-common.h"
 #include "memory_mapping.h"
+#include "dump.h"
 
 /* some important defines:
  *
@@ -553,6 +554,7 @@ int cpu_write_elf64_qemunote(write_core_dump_function f, 
CPUArchState *env,
  target_phys_addr_t *offset, void *opaque);
 int cpu_write_elf32_qemunote(write_core_dump_function f, CPUArchState *env,
  target_phys_addr_t *offset, void *opaque);
+int cpu_get_dump_info(ArchDumpInfo *info);
 #else
 static inline int cpu_write_elf64_note(write_core_dump_function f,
CPUArchState *env, int cpuid,
@@ -583,6 +585,11 @@ static inline int 
cpu_write_elf32_qemunote(write_core_dump_function f,
 {
 return -1;
 }
+
+static inline int cpu_get_dump_info(ArchDumpInfo *info)
+{
+return -1;
+}
 #endif
 
 #endif /* CPU_ALL_H */
diff --git a/dump.h b/dump.h
new file mode 100644
index 000..28340cf
--- /dev/null
+++ b/dump.h
@@ -0,0 +1,23 @@
+/*
+ * QEMU dump
+ *
+ * Copyright Fujitsu, Corp. 2011, 2012
+ *
+ * Authors:
+ * Wen Congyang 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef DUMP_H
+#define DUMP_H
+
+typedef struct ArchDumpInfo {
+int d_machine;  /* Architecture */
+int d_endian;   /* ELFDATA2LSB or ELFDATA2MSB */
+int d_class;/* ELFCLASS32 or ELFCLASS64 */
+} ArchDumpInfo;
+
+#endif
diff --git a/target-i386/arch_dump.c b/target-i386/arch_dump.c
index 1b10dd2..4e6e0d6 100644
--- a/target-i386/arch_dump.c
+++ b/target-i386/arch_dump.c
@@ -13,6 +13,7 @@
 
 #include "cpu.h"
 #include "cpu-all.h"
+#include "dump.h"
 #include "elf.h"
 
 #ifdef TARGET_X86_64
@@ -389,3 +390,36 @@ int cpu_write_elf32_qemunote(write_core_dump_function f, 
CPUArchState *env,
 {
 return cpu_write_qemu_note(f, env, offset, opaque, 0);
 }
+
+int cpu_get_dump_info(ArchDumpInfo *info)
+{
+bool lma = false;
+RAMBlock *block;
+
+#ifdef TARGET_X86_64
+lma = !!(first_cpu->hflags & HF_LMA_MASK);
+#endif
+
+if (lma) {
+info->d_machine = EM_X86_64;
+} else {
+info->d_machine = EM_386;
+}
+info->d_endian = ELFDATA2LSB;
+
+if (lma) {
+info->d_class = ELFCLASS64;
+} else {
+info->d_class = ELFCLASS32;
+
+QLIST_FOREACH(block, &ram_list.blocks, next) {
+if (block->offset + block->length > UINT_MAX) {
+/* The memory size is greater than 4G */
+info->d_class = ELFCLASS64;
+break;
+}
+}
+}
+
+return 0;
+}
-- 
1.7.1

[Qemu-devel] [PATCH 08/11 v10] target-i386: Add API to write cpu status to core file

[Wen Congyang]

The core file has register's value. But it does not include all registers value.
Store the cpu status into QEMU note, and the user can get more information
from vmcore. If you change QEMUCPUState, please count up QEMUCPUSTATE_VERSION.

Signed-off-by: Wen Congyang 
---
 cpu-all.h   |   20 ++
 target-i386/arch_dump.c |  150 +++
 2 files changed, 170 insertions(+), 0 deletions(-)

diff --git a/cpu-all.h b/cpu-all.h
index bc29b43..cd9b013 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -549,6 +549,10 @@ int cpu_write_elf64_note(write_core_dump_function f, 
CPUArchState *env,
  int cpuid, target_phys_addr_t *offset, void *opaque);
 int cpu_write_elf32_note(write_core_dump_function f, CPUArchState *env,
  int cpuid, target_phys_addr_t *offset, void *opaque);
+int cpu_write_elf64_qemunote(write_core_dump_function f, CPUArchState *env,
+ target_phys_addr_t *offset, void *opaque);
+int cpu_write_elf32_qemunote(write_core_dump_function f, CPUArchState *env,
+ target_phys_addr_t *offset, void *opaque);
 #else
 static inline int cpu_write_elf64_note(write_core_dump_function f,
CPUArchState *env, int cpuid,
@@ -563,6 +567,22 @@ static inline int 
cpu_write_elf32_note(write_core_dump_function f,
 {
 return -1;
 }
+
+static inline int cpu_write_elf64_qemunote(write_core_dump_function f,
+   CPUArchState *env,
+   target_phys_addr_t *offset,
+   void *opaque);
+{
+return -1;
+}
+
+static inline int cpu_write_elf32_qemunote(write_core_dump_function f,
+   CPUArchState *env,
+   target_phys_addr_t *offset,
+   void *opaque)
+{
+return -1;
+}
 #endif
 
 #endif /* CPU_ALL_H */
diff --git a/target-i386/arch_dump.c b/target-i386/arch_dump.c
index 4475b92..1b10dd2 100644
--- a/target-i386/arch_dump.c
+++ b/target-i386/arch_dump.c
@@ -239,3 +239,153 @@ int cpu_write_elf32_note(write_core_dump_function f, 
CPUArchState *env,
 
 return 0;
 }
+
+/*
+ * please count up QEMUCPUSTATE_VERSION if you have changed definition of
+ * QEMUCPUState, and modify the tools using this information accordingly.
+ */
+#define QEMUCPUSTATE_VERSION (1)
+
+struct QEMUCPUSegment {
+uint32_t selector;
+uint32_t limit;
+uint32_t flags;
+uint32_t pad;
+uint64_t base;
+};
+
+typedef struct QEMUCPUSegment QEMUCPUSegment;
+
+struct QEMUCPUState {
+uint32_t version;
+uint32_t size;
+uint64_t rax, rbx, rcx, rdx, rsi, rdi, rsp, rbp;
+uint64_t r8, r9, r10, r11, r12, r13, r14, r15;
+uint64_t rip, rflags;
+QEMUCPUSegment cs, ds, es, fs, gs, ss;
+QEMUCPUSegment ldt, tr, gdt, idt;
+uint64_t cr[5];
+};
+
+typedef struct QEMUCPUState QEMUCPUState;
+
+static void copy_segment(QEMUCPUSegment *d, SegmentCache *s)
+{
+d->pad = 0;
+d->selector = s->selector;
+d->limit = s->limit;
+d->flags = s->flags;
+d->base = s->base;
+}
+
+static void qemu_get_cpustate(QEMUCPUState *s, CPUArchState *env)
+{
+memset(s, 0, sizeof(QEMUCPUState));
+
+s->version = QEMUCPUSTATE_VERSION;
+s->size = sizeof(QEMUCPUState);
+
+s->rax = env->regs[R_EAX];
+s->rbx = env->regs[R_EBX];
+s->rcx = env->regs[R_ECX];
+s->rdx = env->regs[R_EDX];
+s->rsi = env->regs[R_ESI];
+s->rdi = env->regs[R_EDI];
+s->rsp = env->regs[R_ESP];
+s->rbp = env->regs[R_EBP];
+#ifdef TARGET_X86_64
+s->r8  = env->regs[8];
+s->r9  = env->regs[9];
+s->r10 = env->regs[10];
+s->r11 = env->regs[11];
+s->r12 = env->regs[12];
+s->r13 = env->regs[13];
+s->r14 = env->regs[14];
+s->r15 = env->regs[15];
+#endif
+s->rip = env->eip;
+s->rflags = env->eflags;
+
+copy_segment(&s->cs, &env->segs[R_CS]);
+copy_segment(&s->ds, &env->segs[R_DS]);
+copy_segment(&s->es, &env->segs[R_ES]);
+copy_segment(&s->fs, &env->segs[R_FS]);
+copy_segment(&s->gs, &env->segs[R_GS]);
+copy_segment(&s->ss, &env->segs[R_SS]);
+copy_segment(&s->ldt, &env->ldt);
+copy_segment(&s->tr, &env->tr);
+copy_segment(&s->gdt, &env->gdt);
+copy_segment(&s->idt, &env->idt);
+
+s->cr[0] = env->cr[0];
+s->cr[1] = env->cr[1];
+s->cr[2] = env->cr[2];
+s->cr[3] = env->cr[3];
+s->cr[4] = env->cr[4];
+}
+
+static inline int cpu_write_qemu_note(write_core_dump_function f, CPUArchState 
*env,
+  target_phys_addr_t *offset, void *opaque,
+  int type)
+{
+QEMUCPUState state;
+Elf64_Nhdr *note64;
+Elf32_Nhdr *note32;
+void *note;
+char *buf;
+int descsz, note_size, name_size = 5, note_head_size;
+const char *name = "QEMU";
+int ret

[Qemu-devel] [PATCH 07/11 v10] target-i386: Add API to write elf notes to core file

[Wen Congyang]

The core file contains register's value. These APIs write registers to
core file, and them will be called in the following patch.

Signed-off-by: Wen Congyang 
---
 Makefile.target |1 +
 configure   |4 +
 cpu-all.h   |   23 +
 target-i386/arch_dump.c |  241 +++
 4 files changed, 269 insertions(+), 0 deletions(-)
 create mode 100644 target-i386/arch_dump.c

diff --git a/Makefile.target b/Makefile.target
index 85a6a0d..c3aa5d7 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -219,6 +219,7 @@ obj-$(CONFIG_NO_KVM) += kvm-stub.o
 obj-$(CONFIG_VGA) += vga.o
 obj-y += memory.o savevm.o
 obj-y += memory_mapping.o
+obj-$(CONFIG_HAVE_CORE_DUMP) += arch_dump.o
 LIBS+=-lz
 
 obj-i386-$(CONFIG_KVM) += hyperv.o
diff --git a/configure b/configure
index 8540bbb..c7d668c 100755
--- a/configure
+++ b/configure
@@ -3678,6 +3678,10 @@ if test "$target_softmmu" = "yes" ; then
   if test "$smartcard_nss" = "yes" ; then
 echo "subdir-$target: subdir-libcacard" >> $config_host_mak
   fi
+  case "$target_arch2" in
+i386|x86_64)
+  echo "CONFIG_HAVE_CORE_DUMP=y" >> $config_target_mak
+  esac
 fi
 if test "$target_user_only" = "yes" ; then
   echo "CONFIG_USER_ONLY=y" >> $config_target_mak
diff --git a/cpu-all.h b/cpu-all.h
index 24c7f77..bc29b43 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -542,4 +542,27 @@ static inline bool cpu_paging_enabled(CPUArchState *env)
 }
 #endif
 
+typedef int (*write_core_dump_function)
+(target_phys_addr_t offset, void *buf, size_t size, void *opaque);
+#if defined(CONFIG_HAVE_CORE_DUMP)
+int cpu_write_elf64_note(write_core_dump_function f, CPUArchState *env,
+ int cpuid, target_phys_addr_t *offset, void *opaque);
+int cpu_write_elf32_note(write_core_dump_function f, CPUArchState *env,
+ int cpuid, target_phys_addr_t *offset, void *opaque);
+#else
+static inline int cpu_write_elf64_note(write_core_dump_function f,
+   CPUArchState *env, int cpuid,
+   target_phys_addr_t *offset, void 
*opaque)
+{
+return -1;
+}
+
+static inline int cpu_write_elf32_note(write_core_dump_function f,
+   CPUArchState *env, int cpuid,
+   target_phys_addr_t *offset, void 
*opaque)
+{
+return -1;
+}
+#endif
+
 #endif /* CPU_ALL_H */
diff --git a/target-i386/arch_dump.c b/target-i386/arch_dump.c
new file mode 100644
index 000..4475b92
--- /dev/null
+++ b/target-i386/arch_dump.c
@@ -0,0 +1,241 @@
+/*
+ * i386 memory mapping
+ *
+ * Copyright Fujitsu, Corp. 2011, 2012
+ *
+ * Authors:
+ * Wen Congyang 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#include "cpu.h"
+#include "cpu-all.h"
+#include "elf.h"
+
+#ifdef TARGET_X86_64
+typedef struct {
+target_ulong r15, r14, r13, r12, rbp, rbx, r11, r10;
+target_ulong r9, r8, rax, rcx, rdx, rsi, rdi, orig_rax;
+target_ulong rip, cs, eflags;
+target_ulong rsp, ss;
+target_ulong fs_base, gs_base;
+target_ulong ds, es, fs, gs;
+} x86_64_user_regs_struct;
+
+typedef struct {
+char pad1[32];
+uint32_t pid;
+char pad2[76];
+x86_64_user_regs_struct regs;
+char pad3[8];
+} x86_64_elf_prstatus;
+
+static int x86_64_write_elf64_note(write_core_dump_function f,
+   CPUArchState *env, int id,
+   target_phys_addr_t *offset, void *opaque)
+{
+x86_64_user_regs_struct regs;
+Elf64_Nhdr *note;
+char *buf;
+int descsz, note_size, name_size = 5;
+const char *name = "CORE";
+int ret;
+
+regs.r15 = env->regs[15];
+regs.r14 = env->regs[14];
+regs.r13 = env->regs[13];
+regs.r12 = env->regs[12];
+regs.r11 = env->regs[11];
+regs.r10 = env->regs[10];
+regs.r9  = env->regs[9];
+regs.r8  = env->regs[8];
+regs.rbp = env->regs[R_EBP];
+regs.rsp = env->regs[R_ESP];
+regs.rdi = env->regs[R_EDI];
+regs.rsi = env->regs[R_ESI];
+regs.rdx = env->regs[R_EDX];
+regs.rcx = env->regs[R_ECX];
+regs.rbx = env->regs[R_EBX];
+regs.rax = env->regs[R_EAX];
+regs.rip = env->eip;
+regs.eflags = env->eflags;
+
+regs.orig_rax = 0; /* FIXME */
+regs.cs = env->segs[R_CS].selector;
+regs.ss = env->segs[R_SS].selector;
+regs.fs_base = env->segs[R_FS].base;
+regs.gs_base = env->segs[R_GS].base;
+regs.ds = env->segs[R_DS].selector;
+regs.es = env->segs[R_ES].selector;
+regs.fs = env->segs[R_FS].selector;
+regs.gs = env->segs[R_GS].selector;
+
+descsz = 336; /* sizeof(prstatus_t) is 336 on x86_64 box */
+note_size = ((sizeof(Elf64_Nhdr) + 3) / 4 + (name_size + 3) / 4 +
+(descsz + 3) / 4) * 4;
+note = g_malloc(note_size);
+
+memset(note, 0, note_size);
+note->n_namesz =

[Qemu-devel] [PATCH 06/11 v10] Add API to get memory mapping without do paging

[Wen Congyang]

crash does not need the virtual address and physical address mapping, and the
mapping does not include the memory that is not referenced by the page table.
crash does not use the virtual address, so we can create the mapping for all
physical memory(virtual address is always 0). This patch provides a API to do
this thing, and it will be used in the following patch.

Signed-off-by: Wen Congyang 
---
 memory_mapping.c |9 +
 memory_mapping.h |3 +++
 2 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/memory_mapping.c b/memory_mapping.c
index b92e2f6..9a2ffe6 100644
--- a/memory_mapping.c
+++ b/memory_mapping.c
@@ -198,3 +198,12 @@ int qemu_get_guest_memory_mapping(MemoryMappingList *list)
 return 0;
 }
 #endif
+
+void qemu_get_guest_simple_memory_mapping(MemoryMappingList *list)
+{
+RAMBlock *block;
+
+QLIST_FOREACH(block, &ram_list.blocks, next) {
+create_new_memory_mapping(list, block->offset, 0, block->length);
+}
+}
diff --git a/memory_mapping.h b/memory_mapping.h
index 4d44641..a583e44 100644
--- a/memory_mapping.h
+++ b/memory_mapping.h
@@ -59,4 +59,7 @@ static inline int 
qemu_get_guest_memory_mapping(MemoryMappingList *list)
 }
 #endif
 
+/* get guest's memory mapping without do paging(virtual address is 0). */
+void qemu_get_guest_simple_memory_mapping(MemoryMappingList *list);
+
 #endif
-- 
1.7.1

[Qemu-devel] [PATCH 05/11 v10] Add API to get memory mapping

[Wen Congyang]

Add API to get all virtual address and physical address mapping.
If the guest doesn't use paging, the virtual address is equal to the phyical
address. The virtual address and physical address mapping is for gdb's user, and
it does not include the memory that is not referenced by the page table. So if
you want to use crash to anaylze the vmcore, please do not specify -p option.
the reason why the -p option is not default explicitly: guest machine in a
catastrophic state can have corrupted memory, which we cannot trust.

Signed-off-by: Wen Congyang 
---
 memory_mapping.c |   34 ++
 memory_mapping.h |   15 +++
 2 files changed, 49 insertions(+), 0 deletions(-)

diff --git a/memory_mapping.c b/memory_mapping.c
index 718f271..b92e2f6 100644
--- a/memory_mapping.c
+++ b/memory_mapping.c
@@ -164,3 +164,37 @@ void memory_mapping_list_init(MemoryMappingList *list)
 list->last_mapping = NULL;
 QTAILQ_INIT(&list->head);
 }
+
+#if defined(CONFIG_HAVE_GET_MEMORY_MAPPING)
+int qemu_get_guest_memory_mapping(MemoryMappingList *list)
+{
+CPUArchState *env;
+RAMBlock *block;
+ram_addr_t offset, length;
+int ret;
+bool paging_mode;
+
+paging_mode = cpu_paging_enabled(first_cpu);
+if (paging_mode) {
+for (env = first_cpu; env != NULL; env = env->next_cpu) {
+ret = cpu_get_memory_mapping(list, env);
+if (ret < 0) {
+return -1;
+}
+}
+return 0;
+}
+
+/*
+ * If the guest doesn't use paging, the virtual address is equal to 
physical
+ * address.
+ */
+QLIST_FOREACH(block, &ram_list.blocks, next) {
+offset = block->offset;
+length = block->length;
+create_new_memory_mapping(list, offset, offset, length);
+}
+
+return 0;
+}
+#endif
diff --git a/memory_mapping.h b/memory_mapping.h
index 836b047..4d44641 100644
--- a/memory_mapping.h
+++ b/memory_mapping.h
@@ -44,4 +44,19 @@ void memory_mapping_list_free(MemoryMappingList *list);
 
 void memory_mapping_list_init(MemoryMappingList *list);
 
+/*
+ * Return value:
+ *0: success
+ *   -1: failed
+ *   -2: unsupported
+ */
+#if defined(CONFIG_HAVE_GET_MEMORY_MAPPING)
+int qemu_get_guest_memory_mapping(MemoryMappingList *list);
+#else
+static inline int qemu_get_guest_memory_mapping(MemoryMappingList *list)
+{
+return -2;
+}
+#endif
+
 #endif
-- 
1.7.1

[Qemu-devel] [PATCH 01/11 v10] Add API to create memory mapping list

[Wen Congyang]

The memory mapping list stores virtual address and physical address mapping.
The virtual address and physical address are contiguous in the mapping.
The folloing patch will use this information to create PT_LOAD in the vmcore.

Signed-off-by: Wen Congyang 
---
 Makefile.target  |1 +
 memory_mapping.c |  166 ++
 memory_mapping.h |   47 +++
 3 files changed, 214 insertions(+), 0 deletions(-)
 create mode 100644 memory_mapping.c
 create mode 100644 memory_mapping.h

diff --git a/Makefile.target b/Makefile.target
index 63cf769..ccfa107 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -217,6 +217,7 @@ obj-$(CONFIG_KVM) += kvm.o kvm-all.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
 obj-$(CONFIG_VGA) += vga.o
 obj-y += memory.o savevm.o
+obj-y += memory_mapping.o
 LIBS+=-lz
 
 obj-i386-$(CONFIG_KVM) += hyperv.o
diff --git a/memory_mapping.c b/memory_mapping.c
new file mode 100644
index 000..718f271
--- /dev/null
+++ b/memory_mapping.c
@@ -0,0 +1,166 @@
+/*
+ * QEMU memory mapping
+ *
+ * Copyright Fujitsu, Corp. 2011, 2012
+ *
+ * Authors:
+ * Wen Congyang 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#include "cpu.h"
+#include "cpu-all.h"
+#include "memory_mapping.h"
+
+static void memory_mapping_list_add_mapping_sorted(MemoryMappingList *list,
+   MemoryMapping *mapping)
+{
+MemoryMapping *p;
+
+QTAILQ_FOREACH(p, &list->head, next) {
+if (p->phys_addr >= mapping->phys_addr) {
+QTAILQ_INSERT_BEFORE(p, mapping, next);
+return;
+}
+}
+QTAILQ_INSERT_TAIL(&list->head, mapping, next);
+}
+
+static void create_new_memory_mapping(MemoryMappingList *list,
+  target_phys_addr_t phys_addr,
+  target_phys_addr_t virt_addr,
+  ram_addr_t length)
+{
+MemoryMapping *memory_mapping;
+
+memory_mapping = g_malloc(sizeof(MemoryMapping));
+memory_mapping->phys_addr = phys_addr;
+memory_mapping->virt_addr = virt_addr;
+memory_mapping->length = length;
+list->last_mapping = memory_mapping;
+list->num++;
+memory_mapping_list_add_mapping_sorted(list, memory_mapping);
+}
+
+static inline bool mapping_contiguous(MemoryMapping *map,
+  target_phys_addr_t phys_addr,
+  target_phys_addr_t virt_addr)
+{
+return phys_addr == map->phys_addr + map->length &&
+   virt_addr == map->virt_addr + map->length;
+}
+
+/*
+ * [map->phys_addr, map->phys_addr + map->length) and
+ * [phys_addr, phys_addr + length) have intersection?
+ */
+static inline bool mapping_have_same_region(MemoryMapping *map,
+target_phys_addr_t phys_addr,
+ram_addr_t length)
+{
+return !(phys_addr + length < map->phys_addr ||
+ phys_addr >= map->phys_addr + map->length);
+}
+
+/*
+ * [map->phys_addr, map->phys_addr + map->length) and
+ * [phys_addr, phys_addr + length) have intersection. The virtual address in 
the
+ * intersection are the same?
+ */
+static inline bool mapping_conflict(MemoryMapping *map,
+target_phys_addr_t phys_addr,
+target_phys_addr_t virt_addr)
+{
+return virt_addr - map->virt_addr != phys_addr - map->phys_addr;
+}
+
+/*
+ * [map->virt_addr, map->virt_addr + map->length) and
+ * [virt_addr, virt_addr + length) have intersection. And the physical address
+ * in the intersection are the same.
+ */
+static inline void mapping_merge(MemoryMapping *map,
+ target_phys_addr_t virt_addr,
+ ram_addr_t length)
+{
+if (virt_addr < map->virt_addr) {
+map->length += map->virt_addr - virt_addr;
+map->virt_addr = virt_addr;
+}
+
+if ((virt_addr + length) >
+(map->virt_addr + map->length)) {
+map->length = virt_addr + length - map->virt_addr;
+}
+}
+
+void memory_mapping_list_add_merge_sorted(MemoryMappingList *list,
+  target_phys_addr_t phys_addr,
+  target_phys_addr_t virt_addr,
+  ram_addr_t length)
+{
+MemoryMapping *memory_mapping, *last_mapping;
+
+if (QTAILQ_EMPTY(&list->head)) {
+create_new_memory_mapping(list, phys_addr, virt_addr, length);
+return;
+}
+
+last_mapping = list->last_mapping;
+if (last_mapping) {
+if (mapping_contiguous(last_mapping, phys_addr, virt_addr)) {
+last_mapping->length += length;
+return;
+}
+}
+
+QTAILQ_FOREACH(memory_mapping, &list->head, next) {
+if (mapp

[Qemu-devel] [PATCH 02/11 v10] Add API to check whether a physical address is I/O address

[Wen Congyang]

This API will be used in the following patch.

Signed-off-by: Wen Congyang 
---
 cpu-common.h |2 ++
 exec.c   |9 +
 2 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/cpu-common.h b/cpu-common.h
index dca5175..fcd50dc 100644
--- a/cpu-common.h
+++ b/cpu-common.h
@@ -71,6 +71,8 @@ void cpu_physical_memory_unmap(void *buffer, 
target_phys_addr_t len,
 void *cpu_register_map_client(void *opaque, void (*callback)(void *opaque));
 void cpu_unregister_map_client(void *cookie);
 
+bool cpu_physical_memory_is_io(target_phys_addr_t phys_addr);
+
 /* Coalesced MMIO regions are areas where write operations can be reordered.
  * This usually implies that write operations are side-effect free.  This 
allows
  * batching which can make a major impact on performance when using
diff --git a/exec.c b/exec.c
index 265e895..4ce2ba7 100644
--- a/exec.c
+++ b/exec.c
@@ -4656,3 +4656,12 @@ bool virtio_is_big_endian(void)
 #undef env
 
 #endif
+
+bool cpu_physical_memory_is_io(target_phys_addr_t phys_addr)
+{
+MemoryRegionSection* section;
+
+section = phys_page_find(phys_addr >> TARGET_PAGE_BITS);
+
+return !is_ram_rom_romd(section);
+}
-- 
1.7.1

[Qemu-devel] [PATCH 04/11 v10] Add API to check whether paging mode is enabled

[Wen Congyang]

This API will be used in the following patch.

Signed-off-by: Wen Congyang 
---
 cpu-all.h |6 ++
 target-i386/arch_memory_mapping.c |7 ++-
 2 files changed, 12 insertions(+), 1 deletions(-)

diff --git a/cpu-all.h b/cpu-all.h
index 390b55b..24c7f77 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -528,12 +528,18 @@ int cpu_memory_rw_debug(CPUArchState *env, target_ulong 
addr,
 
 #if defined(CONFIG_HAVE_GET_MEMORY_MAPPING)
 int cpu_get_memory_mapping(MemoryMappingList *list, CPUArchState *env);
+bool cpu_paging_enabled(CPUArchState *env);
 #else
 static inline int cpu_get_memory_mapping(MemoryMappingList *list,
  CPUArchState *env)
 {
 return -1;
 }
+
+static inline bool cpu_paging_enabled(CPUArchState *env)
+{
+return true;
+}
 #endif
 
 #endif /* CPU_ALL_H */
diff --git a/target-i386/arch_memory_mapping.c 
b/target-i386/arch_memory_mapping.c
index dd64bec..bd50e11 100644
--- a/target-i386/arch_memory_mapping.c
+++ b/target-i386/arch_memory_mapping.c
@@ -233,7 +233,7 @@ static void walk_pml4e(MemoryMappingList *list,
 
 int cpu_get_memory_mapping(MemoryMappingList *list, CPUArchState *env)
 {
-if (!(env->cr[0] & CR0_PG_MASK)) {
+if (!cpu_paging_enabled(env)) {
 /* paging is disabled */
 return 0;
 }
@@ -264,3 +264,8 @@ int cpu_get_memory_mapping(MemoryMappingList *list, 
CPUArchState *env)
 
 return 0;
 }
+
+bool cpu_paging_enabled(CPUArchState *env)
+{
+return env->cr[0] & CR0_PG_MASK;
+}
-- 
1.7.1

[Qemu-devel] [PATCH 00/11 v10] introducing a new, dedicated guest memory dump mechanism

[Wen Congyang]

Hi, all

'virsh dump' can not work when host pci device is used by guest. We have
discussed this issue here:
http://lists.nongnu.org/archive/html/qemu-devel/2011-10/msg00736.html

The last version is here:
http://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg02536.html

We have determined to introduce a new command dump-guest-memory to dump
guest's memory. The core file's format is elf32 or elf64.

Note:
1. The guest should be x86 or x86_64. The other arch is not supported now.
2. If you use old gdb, gdb may crash. I use gdb-7.3.1, and it does not crash.
3. If the OS is in the second kernel, gdb may not work well, and crash can
   work by specifying '--machdep phys_addr=xxx' in the command line. The
   reason is that the second kernel will update the page table, and we can
   not get the page table for the first kernel.
4. The cpu's state is stored in QEMU note. You neet to modify crash to use
   it to calculate phys_base.
5. If the guest OS is 32 bit and the memory size is larger than 4G, the vmcore
   is elf64 format. You should use the gdb which is built with 
--enable-64-bit-bfd.
6. This patchset is based on the upstream tree, and apply one patch that is 
still
   in Luiz Capitulino's tree, because I use the API qemu_get_fd() in this 
patchset.

Changes from v9 to v10:
1. fix some bug
2. addressed Luiz's and Hatayam's comment
3. remove cancel and query command

Changes from v8 to v9:
1. remove async support(it will be reimplemented after QAPI async commands 
support
   is finished)
2. fix some typo error

Changes from v7 to v8:
1. addressed Hatayama's comments

Changes from v6 to v7:
1. addressed Jan's comments
2. fix some bugs
3. store cpu's state into the vmcore

Changes from v5 to v6:
1. allow user to dump a fraction of the memory
2. fix some bugs

Changes from v4 to v5:
1. convert the new command dump to QAPI 

Changes from v3 to v4:
1. support it to run asynchronously
2. add API to cancel dumping and query dumping progress
3. add API to control dumping speed
4. auto cancel dumping when the user resumes vm, and the status is failed.

Changes from v2 to v3:
1. address Jan Kiszka's comment

Changes from v1 to v2:
1. fix virt addr in the vmcore.

Wen Congyang (11):
  Add API to create memory mapping list
  Add API to check whether a physical address is I/O address
  implement cpu_get_memory_mapping()
  Add API to check whether paging mode is enabled
  Add API to get memory mapping
  Add API to get memory mapping without do paging
  target-i386: Add API to write elf notes to core file
  target-i386: Add API to write cpu status to core file
  target-i386: add API to get dump info
  make gdb_id() generally avialable
  introduce a new monitor command 'dump-guest-memory' to dump guest's
memory

 Makefile.target   |3 +
 configure |8 +
 cpu-all.h |   67 +++
 cpu-common.h  |2 +
 dump.c|  841 +
 dump.h|   23 +
 elf.h |5 +
 exec.c|9 +
 gdbstub.c |9 -
 gdbstub.h |9 +
 hmp-commands.hx   |   28 ++
 hmp.c |   22 +
 hmp.h |1 +
 memory_mapping.c  |  236 +++
 memory_mapping.h  |   68 +++
 qapi-schema.json  |   18 +
 qmp-commands.hx   |   38 ++
 target-i386/arch_dump.c   |  425 +++
 target-i386/arch_memory_mapping.c |  271 
 19 files changed, 2074 insertions(+), 9 deletions(-)
 create mode 100644 dump.c
 create mode 100644 dump.h
 create mode 100644 memory_mapping.c
 create mode 100644 memory_mapping.h
 create mode 100644 target-i386/arch_dump.c
 create mode 100644 target-i386/arch_memory_mapping.c

[Qemu-devel] How many floppy can a computer install ? Thank you very much!

[Zhi Hui Li]

Re: [Qemu-devel] Boot failure with MS-Dos 6.22 (due to bad BIOS build?)

[Kevin O'Connor]

On Mon, Mar 19, 2012 at 09:03:09PM +0100, Jan Kiszka wrote:
> On 2012-03-19 01:29, Kevin O'Connor wrote:
> > On Mon, Feb 27, 2012 at 04:25:09PM +0100, Jan Kiszka wrote:
> >>> EAX= EBX= ECX=c934 EDX=0068
> >>> ESI=6801 EDI= EBP=002b ESP=fff5
> > 
> > I traced this down, and it appears to be a stack size issue.  It looks
> > like MSDOS calls "int 0x13" with 229 bytes of stack space during its
> > boot.  On my build gcc generates the handle_13() function with a
> > maximum of 140 bytes of stack space utilized (according to
> > tools/checkstack.py).  On your build, gcc created it with a maximum of
> > 216 bytes.  The entry functions use 42 bytes of stack space.  Add it
> > up and you can see that the additional stack space that gcc used
> > caused %esp to wrap and the stack was corrupted.
> > 
> > I'm not sure how to best work around this.  One way is to sprinkle
> > "noinline" keywords through disk.c.  (It seems like gcc got in trouble
> > on your build by inlining many functions into disk_13().)  Another way
> > would be to jump into the extra stack (the disk code already uses its
> > own stack) earlier in the handle_13 code.
> > 
> > Also, can you see what happens if you change "--param
> > large-stack-frame=4" to "--param large-stack-frame=0" in the build?
> 
> This makes no difference here, still 216 bytes.

I've noticed that if one takes a pointer to a variable on the stack,
gcc seems to do a poor job managing stack space.  I'm guessing the
patch below would fix the issue.  It's a bit ugly though.

-Kevin


diff --git a/src/disk.c b/src/disk.c
index 7a58af4..706b9f4 100644
--- a/src/disk.c
+++ b/src/disk.c
@@ -76,7 +76,7 @@ fillLCHS(struct drive_s *drive_g, u16 *nlc, u16 *nlh, u16 
*nlspt)
 }
 
 // Perform read/write/verify using old-style chs accesses
-static void
+static void noinline
 basic_access(struct bregs *regs, struct drive_s *drive_g, u16 command)
 {
 struct disk_op_s dop;
@@ -119,7 +119,7 @@ basic_access(struct bregs *regs, struct drive_s *drive_g, 
u16 command)
 }
 
 // Perform read/write/verify using new-style "int13ext" accesses.
-static void
+static void noinline
 extended_access(struct bregs *regs, struct drive_s *drive_g, u16 command)
 {
 struct disk_op_s dop;
@@ -201,7 +201,7 @@ disk_1304(struct bregs *regs, struct drive_s *drive_g)
 }
 
 // format disk track
-static void
+static void noinline
 disk_1305(struct bregs *regs, struct drive_s *drive_g)
 {
 debug_stub(regs);
@@ -228,7 +228,7 @@ disk_1305(struct bregs *regs, struct drive_s *drive_g)
 }
 
 // read disk drive parameters
-static void
+static void noinline
 disk_1308(struct bregs *regs, struct drive_s *drive_g)
 {
 u16 ebda_seg = get_ebda_seg();
@@ -329,7 +329,7 @@ disk_1314(struct bregs *regs, struct drive_s *drive_g)
 }
 
 // read disk drive size
-static void
+static void noinline
 disk_1315(struct bregs *regs, struct drive_s *drive_g)
 {
 disk_ret(regs, DISK_RET_SUCCESS);
@@ -463,7 +463,7 @@ disk_1345(struct bregs *regs, struct drive_s *drive_g)
 }
 
 // IBM/MS eject media
-static void
+static void noinline
 disk_1346(struct bregs *regs, struct drive_s *drive_g)
 {
 if (regs->dl < EXTSTART_CD) {

[Qemu-devel] [Bug 938431] Re: Reproducible crash in slirp_remque (qemu 1.0.1)

[Craig Ringer]

This issue appears to be resolved in the *real* current git master, so
this bug can be closed. Now it's just a matter of getting rid of or
updating that mirror.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/938431

Title:
  Reproducible crash in slirp_remque (qemu 1.0.1)

Status in QEMU:
  New

Bug description:
  Heya

  I've been testing some automated data conversion scripts with qemu
  1.0.1. They work fine with qemu-kvm 0.15.1, but on qemu 1.0.1 (from
  the website, built from source using gcc 4.6.1, i686 host), when the
  script runs qemu I see qemu crash in slirp_remque a few seconds after
  it's launched. This crash is consistent and reproducible.

  The qemu guest is SCO OpenServer 5.0.5. I'm using it for some data
  conversion from a legacy application. qemu is launched "-display none
  -monitor stdio" and controlled from a Python script that then connects
  to the VM over usermode port forwards to ftp data to/from the VM and
  send commands over telnet.

  qemu is launched fine with the following command:

  /usr/local/qemu/bin/qemu-system-i386 -display none -vga cirrus -M pc
  -no-acpi -no-hpet -monitor stdio -net
  
user,net=10.0.2.0/24,host=10.0.2.2,dns=10.0.2.3,hostfwd=tcp:127.0.0.1:-10.0.2.1:22,hostfwd=tcp:127.0.0.1:2323-10.0.2.1:23,hostfwd=tcp:127.0.0.1:2121-10.0.2.1:21,hostfwd=tcp:127.0.0.1:2020-10.0.2.1:20
  -net nic,model=pcnet -drive
  file=sco/sco.qcow2,format=qcow2,cache=unsafe,snapshot=on -drive
  file=sco/booksys.qcow2,format=qcow2,cache=unsafe,snapshot=on -snapshot
  > qemu-log

  and images:

  $ for f in *.qcow2; do qemu-img info $f; echo; done
  image: booksys-blank-compressed.qcow2
  file format: qcow2
  virtual size: 4.0G (4294967296 bytes)
  disk size: 696K
  cluster_size: 65536

  image: booksys.qcow2
  file format: qcow2
  virtual size: 4.0G (4294967296 bytes)
  disk size: 140K
  cluster_size: 65536
  backing file: booksys-blank-compressed.qcow2 (actual path: 
booksys-blank-compressed.qcow2)

  image: sco-base-compressed.qcow2
  file format: qcow2
  virtual size: 512M (536870912 bytes)
  disk size: 142M
  cluster_size: 65536

  image: sco.qcow2
  file format: qcow2
  virtual size: 512M (536870912 bytes)
  disk size: 140K
  cluster_size: 65536
  backing file: sco-base-compressed.qcow2 (actual path: 
sco-base-compressed.qcow2)


  
  The VM guest begins booting fine, and nothing of interest appears in the 
monitor log:

  QEMU 1.0,1 monitor - type 'help' for more information
  (qemu)

  After a few seconds the controlling scripts begins trying to ftp into
  the guest over the user-mode port forward on port 2121, and it's at
  this point that qemu crashes with the following backtrace:

  Program received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 0xb63e46e0 (LWP 25453)]
  0xb768753b in slirp_remque (a=0xb90ee408) at slirp/misc.c:39
  39  ((struct quehead *)(element->qh_rlink))->qh_link = element->qh_link;
  (gdb) bt
  #0  0xb768753b in slirp_remque (a=0xb90ee408) at slirp/misc.c:39
  #1  0xb76854ad in if_start (slirp=0xb879beb0) at slirp/if.c:189
  #2  0xb76853b3 in if_output (so=0xb8eb1380, ifm=0xb90eea60) at slirp/if.c:138
  #3  0xb7686bb5 in ip_output (so=0xb8eb1380, m0=0xb90eea60)
  at slirp/ip_output.c:84
  #4  0xb768f59c in tcp_output (tp=0xb906fd48) at slirp/tcp_output.c:456
  #5  0xb7691b9b in tcp_timers (tp=0xb906fd48, timer=0) at slirp/tcp_timer.c:242
  #6  0xb76918d4 in tcp_slowtimo (slirp=0xb879beb0) at slirp/tcp_timer.c:88
  #7  0xb768965a in slirp_select_poll (readfds=0xbf9e3dcc, writefds=0xbf9e3e4c, 
  xfds=0xbf9e3ecc, select_error=0) at slirp/slirp.c:433
  #8  0xb763e2a0 in main_loop_wait (nonblocking=0) at main-loop.c:465
  #9  0xb7633042 in main_loop () at /home/craig/build/qemu-1.0.1/vl.c:1481
  #10 0xb76388a0 in main (argc=20, argv=0xbf9e42d4, envp=0xbf9e4328)
  at /home/craig/build/qemu-1.0.1/vl.c:3485

  (gdb) frame 0
  #0  0xb768753b in slirp_remque (a=0xb90ee408) at slirp/misc.c:39
  39  ((struct quehead *)(element->qh_rlink))->qh_link = element->qh_link;

  A more detailed backtrace, as supplied by "thread apply all bt full",
  follows at the end of this post.

  In case it matters, stdout is redirected to a logfile and stdin is
  attached to the Python script, which hasn't yet written anything to
  the stdin pipe.

  I'll happily post the script, but isn't much good without the OS image
  which is about 150MB and can't be legally redistributed. I'm happy to
  test patches, though, or try anything that's suggested.

  Host info and full backtrace follows:


  $ gcc --version
  gcc (Ubuntu/Linaro 4.6.1-9ubuntu3) 4.6.1
  Copyright (C) 2011 Free Software Foundation, Inc.
  This is free software; see the source for copying conditions.  There is NO
  warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

  $ lsb_release -a
  No LSB modules are available.
  Distributor ID:   Ubuntu
  Description:

Re: [Qemu-devel] [PATCH] Remove PCI class code from virtio balloon device

[David Gibson]

On Mon, Mar 19, 2012 at 11:33:10AM +, Stefan Hajnoczi wrote:
> On Mon, Mar 19, 2012 at 03:59:23PM +1100, David Gibson wrote:
> > Currently the virtio balloon device, when using the virtio-pci interface
> > advertises itself with PCI class code MEMORY_RAM.  This is wrong; the
> > balloon is vaguely related to memory, but is nothing like a PCI memory
> > device in the meaning of the class code, and this code is not required or
> > suggested by the virtio PCI specification.
> > 
> > Worse, this patch causes problems on the pseries machine, because the
> > firmware, seeing this class code, advertises the device as memory in the
> > device tree, and then a guest kernel bug causes it to see this "memory"
> > before the real system memory, leading to a crash in early boot.
> > 
> > This patch fixes the problem by removing the bogus PCI class code on the
> > balloon device.
> > 
> > Cc: Michael S. Tsirkin 
> > Cc: Rusty Russell 
> > 
> > Signed-off-by: David Gibson 
> > ---
> >  hw/virtio-pci.c |2 +-
> >  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> Since this is a guest-visible change we might need to be careful about
> how it's introduced.
> 
> Do we need to keep the old class code for existing machine types?  The
> new class code could be introduced only for 1.1 and later machine types
> if we want to be extra careful about introducing guest-visible
> changes.

So as a general rule, I like to be very careful about user-visible
changes.  But in this case, I don't think we want to be too hesitant.
In particular, it's not just a question of the machine type, but also
of how the guest OS will deal with the PCI class code.

The class code we were using was Just Plain Wrong.  It was not
suggetsed by the virtio spec, and it makes no sense.  It happens that
so far this caused problems only for a guest on a particular machine
type, but there's no reason it couldn't cause (different) problems for
guests on any machine type.

More to the point, it seems reasonably unlikely for existing guests to
rely on the broken behaviour: again, there's no reason they'd think
they need to based on the spec, and the usual way of matching drivers
to PCI devices is with the vendor/device IDs which are correct and not
changed by this patch.

So, unless we have a known example of an existing guest that would be
broken by this change, I think we should implement it ASAP for all
machine types.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson

Re: [Qemu-devel] [PATCH] kvm: Fix dirty tracking with large kernel page size

[David Gibson]

On Mon, Mar 19, 2012 at 11:52:49AM +0100, Andreas Färber wrote:
> Am 19.03.2012 05:57, schrieb David Gibson:
> > If the kernel page size is larger than TARGET_PAGE_SIZE, which
> > happens for example on ppc64 with kernels compiled for 64K pages,
> > the dirty tracking doesn't work.
> > 
> > Cc: Avi Kivity 
> > Cc: Marcelo Tossatti 
> > 
> > Signed-off-by: Benjamin Herrenschmidt 
> > Signed-off-by: David Gibson 
> > ---
> >  kvm-all.c |8 +---
> >  1 files changed, 5 insertions(+), 3 deletions(-)
> > 
> > diff --git a/kvm-all.c b/kvm-all.c
> > index ba2cee1..47adc97 100644
> > --- a/kvm-all.c
> > +++ b/kvm-all.c
> > @@ -350,10 +350,11 @@ static int kvm_set_migration_log(int enable)
> >  static int kvm_get_dirty_pages_log_range(MemoryRegionSection *section,
> >   unsigned long *bitmap)
> >  {
> > -unsigned int i, j;
> > +  unsigned int i, j;
> 
> Unintentional change?

Gah, yes, oops.  Corrected version below.

>From 55bd7c4811415c3b1a4825c4907f56117243836b Mon Sep 17 00:00:00 2001
From: Ben Herrenschmidt 
Date: Tue, 20 Mar 2012 11:22:16 +1100
Subject: [PATCH] kvm: Fix dirty tracking with large kernel page size

If the kernel page size is larger than TARGET_PAGE_SIZE, which
happens for example on ppc64 with kernels compiled for 64K pages,
the dirty tracking doesn't work.

Cc: Avi Kivity 
Cc: Marcelo Tossatti 

Signed-off-by: Benjamin Herrenschmidt 
Signed-off-by: David Gibson 
---
 kvm-all.c |6 --
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/kvm-all.c b/kvm-all.c
index ba2cee1..7e44429 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -354,6 +354,7 @@ static int 
kvm_get_dirty_pages_log_range(MemoryRegionSection *section,
 unsigned long page_number, c;
 target_phys_addr_t addr, addr1;
 unsigned int len = ((section->size / TARGET_PAGE_SIZE) + HOST_LONG_BITS - 
1) / HOST_LONG_BITS;
+unsigned long hpratio = getpagesize() / TARGET_PAGE_SIZE;
 
 /*
  * bitmap-traveling is faster than memory-traveling (for addr...)
@@ -365,10 +366,11 @@ static int 
kvm_get_dirty_pages_log_range(MemoryRegionSection *section,
 do {
 j = ffsl(c) - 1;
 c &= ~(1ul << j);
-page_number = i * HOST_LONG_BITS + j;
+page_number = (i * HOST_LONG_BITS + j) * hpratio;
 addr1 = page_number * TARGET_PAGE_SIZE;
 addr = section->offset_within_region + addr1;
-memory_region_set_dirty(section->mr, addr, TARGET_PAGE_SIZE);
+memory_region_set_dirty(section->mr, addr,
+TARGET_PAGE_SIZE * hpratio);
 } while (c != 0);
 }
 }
-- 
1.7.9.1



-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson

[Qemu-devel] [Bug 938431] Re: Reproducible crash in slirp_remque (qemu 1.0.1)

[Craig Ringer]

Is the GitHub mirror (http://wiki.qemu.org/Download) no long being
updated? It looks like it might not be given the last commit, so it
should really be fixed or removed from that download page and the mirror
deleted.

I used the GitHub mirror because when I tried to clone
git://git.qemu.org/qemu.git at the time I was testing I got a msg along
the lines of "remote respository has no refs". I didn't record the exact
msg, unfortunately, and it seems to be cloning ok now.

The GitHub mirror needs to be updated or deleted.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/938431

Title:
  Reproducible crash in slirp_remque (qemu 1.0.1)

Status in QEMU:
  New

Bug description:
  Heya

  I've been testing some automated data conversion scripts with qemu
  1.0.1. They work fine with qemu-kvm 0.15.1, but on qemu 1.0.1 (from
  the website, built from source using gcc 4.6.1, i686 host), when the
  script runs qemu I see qemu crash in slirp_remque a few seconds after
  it's launched. This crash is consistent and reproducible.

  The qemu guest is SCO OpenServer 5.0.5. I'm using it for some data
  conversion from a legacy application. qemu is launched "-display none
  -monitor stdio" and controlled from a Python script that then connects
  to the VM over usermode port forwards to ftp data to/from the VM and
  send commands over telnet.

  qemu is launched fine with the following command:

  /usr/local/qemu/bin/qemu-system-i386 -display none -vga cirrus -M pc
  -no-acpi -no-hpet -monitor stdio -net
  
user,net=10.0.2.0/24,host=10.0.2.2,dns=10.0.2.3,hostfwd=tcp:127.0.0.1:-10.0.2.1:22,hostfwd=tcp:127.0.0.1:2323-10.0.2.1:23,hostfwd=tcp:127.0.0.1:2121-10.0.2.1:21,hostfwd=tcp:127.0.0.1:2020-10.0.2.1:20
  -net nic,model=pcnet -drive
  file=sco/sco.qcow2,format=qcow2,cache=unsafe,snapshot=on -drive
  file=sco/booksys.qcow2,format=qcow2,cache=unsafe,snapshot=on -snapshot
  > qemu-log

  and images:

  $ for f in *.qcow2; do qemu-img info $f; echo; done
  image: booksys-blank-compressed.qcow2
  file format: qcow2
  virtual size: 4.0G (4294967296 bytes)
  disk size: 696K
  cluster_size: 65536

  image: booksys.qcow2
  file format: qcow2
  virtual size: 4.0G (4294967296 bytes)
  disk size: 140K
  cluster_size: 65536
  backing file: booksys-blank-compressed.qcow2 (actual path: 
booksys-blank-compressed.qcow2)

  image: sco-base-compressed.qcow2
  file format: qcow2
  virtual size: 512M (536870912 bytes)
  disk size: 142M
  cluster_size: 65536

  image: sco.qcow2
  file format: qcow2
  virtual size: 512M (536870912 bytes)
  disk size: 140K
  cluster_size: 65536
  backing file: sco-base-compressed.qcow2 (actual path: 
sco-base-compressed.qcow2)


  
  The VM guest begins booting fine, and nothing of interest appears in the 
monitor log:

  QEMU 1.0,1 monitor - type 'help' for more information
  (qemu)

  After a few seconds the controlling scripts begins trying to ftp into
  the guest over the user-mode port forward on port 2121, and it's at
  this point that qemu crashes with the following backtrace:

  Program received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 0xb63e46e0 (LWP 25453)]
  0xb768753b in slirp_remque (a=0xb90ee408) at slirp/misc.c:39
  39  ((struct quehead *)(element->qh_rlink))->qh_link = element->qh_link;
  (gdb) bt
  #0  0xb768753b in slirp_remque (a=0xb90ee408) at slirp/misc.c:39
  #1  0xb76854ad in if_start (slirp=0xb879beb0) at slirp/if.c:189
  #2  0xb76853b3 in if_output (so=0xb8eb1380, ifm=0xb90eea60) at slirp/if.c:138
  #3  0xb7686bb5 in ip_output (so=0xb8eb1380, m0=0xb90eea60)
  at slirp/ip_output.c:84
  #4  0xb768f59c in tcp_output (tp=0xb906fd48) at slirp/tcp_output.c:456
  #5  0xb7691b9b in tcp_timers (tp=0xb906fd48, timer=0) at slirp/tcp_timer.c:242
  #6  0xb76918d4 in tcp_slowtimo (slirp=0xb879beb0) at slirp/tcp_timer.c:88
  #7  0xb768965a in slirp_select_poll (readfds=0xbf9e3dcc, writefds=0xbf9e3e4c, 
  xfds=0xbf9e3ecc, select_error=0) at slirp/slirp.c:433
  #8  0xb763e2a0 in main_loop_wait (nonblocking=0) at main-loop.c:465
  #9  0xb7633042 in main_loop () at /home/craig/build/qemu-1.0.1/vl.c:1481
  #10 0xb76388a0 in main (argc=20, argv=0xbf9e42d4, envp=0xbf9e4328)
  at /home/craig/build/qemu-1.0.1/vl.c:3485

  (gdb) frame 0
  #0  0xb768753b in slirp_remque (a=0xb90ee408) at slirp/misc.c:39
  39  ((struct quehead *)(element->qh_rlink))->qh_link = element->qh_link;

  A more detailed backtrace, as supplied by "thread apply all bt full",
  follows at the end of this post.

  In case it matters, stdout is redirected to a logfile and stdin is
  attached to the Python script, which hasn't yet written anything to
  the stdin pipe.

  I'll happily post the script, but isn't much good without the OS image
  which is about 150MB and can't be legally redistributed. I'm happy to
  test patches, though, or try anything that's suggested.

  Host info and full backtrace follows:


  

Re: [Qemu-devel] Breakage

[Roy Tam]

2012/3/19 Avi Kivity :
> On 03/19/2012 06:34 AM, Roy Tam wrote:
>> But I get "*** stack smashing detected ***:  terminated" and crash
>> when booting BeOS 5.
>>
>
> Is that a regression?  From what commit?

It seems to be a regression from 0.15.1.
1.0 (mingw) build fails to boot also (a fresh compile just done before
I type this message)

>
> --
> error compiling committee.c: too many arguments to function
>

Re: [Qemu-devel] [PATCH] PNG screendump alternative

[Rafael da Veiga Cabral]

On 03/19/2012 06:10 PM, Anthony Liguori wrote:

On 03/17/2012 05:45 PM, Rafael wrote:

Hi,

I  had already started to work on supporting PNG dump output on
screendump when got to know there was another effort to do the same
(see Add PNG screendump thread from Daniel P. Berrange). Anyway, I'd
like to share my implementation which is a little bit different. It
does not use any resource/lib besides libpng and qemu itself and is
based on qemu-kvm 0.15.1 ppm_save code.

I'm using that for a personal project developed at Mandriva which uses
QMP directly to communicate with qemu VMs rather than using the
libvirt although its usage is considered for the future. There is
something more to show but it is just QMP related and soon I'll have
it done to share.

Comments and suggestions are appreciated.


I think the added value of this is minimal compared to the alternative 
implementation (just run convert on the PPM).


Can you talk a bit more about your use-case any why post-processing 
the PPM isn't a reasonable alternative?




It's because my use-case requires a screenshoot on each second or less. 
It's a functional testing tool based on what is happening on the vm 
screen. The testing stuff  is based on basic image processing of the 
screens. Therefore as screen are grabbed all time the less CPU and Disk 
I/O are required the better,  for example, by changing from PPM to PNG 
at least 2.2 Megas of disk writing are saved on each second. Think about 
a session of 15 minutes or more  (15 * 60 * 2.2).  I've also thought 
that by saving directly from the screen buffer to png should save some 
CPU cycles rather than saving to PPM first and converting it to PNG on 
the qemu runtime.




Regards,

Anthony Liguori



Cheers
Rafael Cabral




Thanks Anthony
Rafael Cabral

[Qemu-devel] [PATCH 01/36] vmstate: Simplify test for CPU_SAVE_VERSION

[Juan Quintela]

Some cpu's definitions define CPU_SAVE_VERSION, others not, but they have
defined cpu_save/load.

Signed-off-by: Juan Quintela 
---
 exec.c |6 --
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/exec.c b/exec.c
index 265e895..9389a61 100644
--- a/exec.c
+++ b/exec.c
@@ -657,7 +657,7 @@ void cpu_exec_init_all(void)
 #endif
 }

-#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
+#if !defined(CONFIG_USER_ONLY)

 static int cpu_common_post_load(void *opaque, int version_id)
 {
@@ -724,11 +724,13 @@ void cpu_exec_init(CPUArchState *env)
 #if defined(CONFIG_USER_ONLY)
 cpu_list_unlock();
 #endif
-#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
+#if !defined(CONFIG_USER_ONLY)
 vmstate_register(NULL, cpu_index, &vmstate_cpu_common, env);
+#if defined(CPU_SAVE_VERSION)
 register_savevm(NULL, "cpu", cpu_index, CPU_SAVE_VERSION,
 cpu_save, cpu_load, env);
 #endif
+#endif
 }

 /* Allocate a new translation block. Flush the translation buffer if
-- 
1.7.7.6

[Qemu-devel] [PATCH 28/36] vmstate: rename machine.c to vmstate-cpu.c

[Juan Quintela]

They only contain vmstate cpu sections nowadays.  Change name to reflect the 
case.

Signed-off-by: Juan Quintela 
---
 Makefile.target|3 ++-
 target-alpha/{machine.c => vmstate-cpu.c}  |0
 target-arm/{machine.c => vmstate-cpu.c}|0
 target-cris/{machine.c => vmstate-cpu.c}   |0
 target-i386/{machine.c => vmstate-cpu.c}   |0
 target-lm32/{machine.c => vmstate-cpu.c}   |0
 target-m68k/{machine.c => vmstate-cpu.c}   |0
 target-microblaze/{machine.c => vmstate-cpu.c} |0
 target-mips/{machine.c => vmstate-cpu.c}   |0
 target-ppc/{machine.c => vmstate-cpu.c}|0
 target-s390x/{machine.c => vmstate-cpu.c}  |0
 target-sh4/{machine.c => vmstate-cpu.c}|0
 target-sparc/{machine.c => vmstate-cpu.c}  |0
 target-xtensa/{machine.c => vmstate-cpu.c} |0
 14 files changed, 2 insertions(+), 1 deletions(-)
 rename target-alpha/{machine.c => vmstate-cpu.c} (100%)
 rename target-arm/{machine.c => vmstate-cpu.c} (100%)
 rename target-cris/{machine.c => vmstate-cpu.c} (100%)
 rename target-i386/{machine.c => vmstate-cpu.c} (100%)
 rename target-lm32/{machine.c => vmstate-cpu.c} (100%)
 rename target-m68k/{machine.c => vmstate-cpu.c} (100%)
 rename target-microblaze/{machine.c => vmstate-cpu.c} (100%)
 rename target-mips/{machine.c => vmstate-cpu.c} (100%)
 rename target-ppc/{machine.c => vmstate-cpu.c} (100%)
 rename target-s390x/{machine.c => vmstate-cpu.c} (100%)
 rename target-sh4/{machine.c => vmstate-cpu.c} (100%)
 rename target-sparc/{machine.c => vmstate-cpu.c} (100%)
 rename target-xtensa/{machine.c => vmstate-cpu.c} (100%)

diff --git a/Makefile.target b/Makefile.target
index 63cf769..0f59106 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -204,7 +204,8 @@ endif #CONFIG_BSD_USER
 # System emulator target
 ifdef CONFIG_SOFTMMU

-obj-y = arch_init.o cpus.o monitor.o machine.o gdbstub.o balloon.o ioport.o
+obj-y = arch_init.o cpus.o monitor.o vmstate-cpu.o gdbstub.o balloon.o
+obj-y += ioport.o
 # virtio has to be here due to weird dependency between PCI and virtio-net.
 # need to fix this properly
 obj-$(CONFIG_NO_PCI) += pci-stub.o
diff --git a/target-alpha/machine.c b/target-alpha/vmstate-cpu.c
similarity index 100%
rename from target-alpha/machine.c
rename to target-alpha/vmstate-cpu.c
diff --git a/target-arm/machine.c b/target-arm/vmstate-cpu.c
similarity index 100%
rename from target-arm/machine.c
rename to target-arm/vmstate-cpu.c
diff --git a/target-cris/machine.c b/target-cris/vmstate-cpu.c
similarity index 100%
rename from target-cris/machine.c
rename to target-cris/vmstate-cpu.c
diff --git a/target-i386/machine.c b/target-i386/vmstate-cpu.c
similarity index 100%
rename from target-i386/machine.c
rename to target-i386/vmstate-cpu.c
diff --git a/target-lm32/machine.c b/target-lm32/vmstate-cpu.c
similarity index 100%
rename from target-lm32/machine.c
rename to target-lm32/vmstate-cpu.c
diff --git a/target-m68k/machine.c b/target-m68k/vmstate-cpu.c
similarity index 100%
rename from target-m68k/machine.c
rename to target-m68k/vmstate-cpu.c
diff --git a/target-microblaze/machine.c b/target-microblaze/vmstate-cpu.c
similarity index 100%
rename from target-microblaze/machine.c
rename to target-microblaze/vmstate-cpu.c
diff --git a/target-mips/machine.c b/target-mips/vmstate-cpu.c
similarity index 100%
rename from target-mips/machine.c
rename to target-mips/vmstate-cpu.c
diff --git a/target-ppc/machine.c b/target-ppc/vmstate-cpu.c
similarity index 100%
rename from target-ppc/machine.c
rename to target-ppc/vmstate-cpu.c
diff --git a/target-s390x/machine.c b/target-s390x/vmstate-cpu.c
similarity index 100%
rename from target-s390x/machine.c
rename to target-s390x/vmstate-cpu.c
diff --git a/target-sh4/machine.c b/target-sh4/vmstate-cpu.c
similarity index 100%
rename from target-sh4/machine.c
rename to target-sh4/vmstate-cpu.c
diff --git a/target-sparc/machine.c b/target-sparc/vmstate-cpu.c
similarity index 100%
rename from target-sparc/machine.c
rename to target-sparc/vmstate-cpu.c
diff --git a/target-xtensa/machine.c b/target-xtensa/vmstate-cpu.c
similarity index 100%
rename from target-xtensa/machine.c
rename to target-xtensa/vmstate-cpu.c
-- 
1.7.7.6

[Qemu-devel] [PATCH 20/36] mips: make tlb an embedded struct instead of a pointer

[Juan Quintela]

Adjust all callers.

Signed-off-by: Juan Quintela 
---
 hw/mips_timer.c  |2 +-
 target-mips/cpu.h|2 +-
 target-mips/helper.c |   30 +-
 target-mips/machine.c|   56 +-
 target-mips/op_helper.c  |   40 +++---
 target-mips/translate.c  |   16 +++
 target-mips/translate_init.c |   24 -
 7 files changed, 89 insertions(+), 81 deletions(-)

diff --git a/hw/mips_timer.c b/hw/mips_timer.c
index 7aa9004..33e4021 100644
--- a/hw/mips_timer.c
+++ b/hw/mips_timer.c
@@ -35,7 +35,7 @@ uint32_t cpu_mips_get_random (CPUMIPSState *env)
 /* Don't return same value twice, so get another value */
 do {
 lfsr = (lfsr >> 1) ^ (-(lfsr & 1u) & 0xd001u);
-idx = lfsr % (env->tlb->nb_tlb - env->CP0_Wired) + env->CP0_Wired;
+idx = lfsr % (env->tlb.nb_tlb - env->CP0_Wired) + env->CP0_Wired;
 } while (idx == prev_idx);
 prev_idx = idx;
 return idx;
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 9450f0c..074882e 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -475,7 +475,7 @@ struct CPUMIPSState {

 CPUMIPSMVPContext mvp;
 #if !defined(CONFIG_USER_ONLY)
-CPUMIPSTLBContext *tlb;
+CPUMIPSTLBContext tlb;
 #endif

 const mips_def_t *cpu_model;
diff --git a/target-mips/helper.c b/target-mips/helper.c
index ddf9cb7..b2f2658 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -69,8 +69,8 @@ int r4k_map_address (CPUMIPSState *env, target_phys_addr_t 
*physical, int *prot,
 uint8_t ASID = env->CP0_EntryHi & 0xFF;
 int i;

-for (i = 0; i < env->tlb->tlb_in_use; i++) {
-r4k_tlb_t *tlb = &env->tlb->mmu.r4k.tlb[i];
+for (i = 0; i < env->tlb.tlb_in_use; i++) {
+r4k_tlb_t *tlb = &env->tlb.mmu.r4k.tlb[i];
 /* 1k pages are not supported. */
 target_ulong mask = tlb->PageMask | ~(TARGET_PAGE_MASK << 1);
 target_ulong tag = address & ~mask;
@@ -124,13 +124,15 @@ static int get_physical_address (CPUMIPSState *env, 
target_phys_addr_t *physical
 *physical = address & 0x;
 *prot = PAGE_READ | PAGE_WRITE;
 } else {
-ret = env->tlb->map_address(env, physical, prot, address, rw, 
access_type);
+ret = env->tlb.map_address(env, physical, prot, address, rw,
+   access_type);
 }
 #if defined(TARGET_MIPS64)
 } else if (address < 0x4000ULL) {
 /* xuseg */
 if (UX && address <= (0x3FFFULL & env->SEGMask)) {
-ret = env->tlb->map_address(env, physical, prot, address, rw, 
access_type);
+ret = env->tlb.map_address(env, physical, prot, address, rw,
+   access_type);
 } else {
 ret = TLBRET_BADADDR;
 }
@@ -138,7 +140,8 @@ static int get_physical_address (CPUMIPSState *env, 
target_phys_addr_t *physical
 /* xsseg */
 if ((supervisor_mode || kernel_mode) &&
 SX && address <= (0x7FFFULL & env->SEGMask)) {
-ret = env->tlb->map_address(env, physical, prot, address, rw, 
access_type);
+ret = env->tlb.map_address(env, physical, prot, address, rw,
+   access_type);
 } else {
 ret = TLBRET_BADADDR;
 }
@@ -155,7 +158,8 @@ static int get_physical_address (CPUMIPSState *env, 
target_phys_addr_t *physical
 /* xkseg */
 if (kernel_mode && KX &&
 address <= (0x7FFFULL & env->SEGMask)) {
-ret = env->tlb->map_address(env, physical, prot, address, rw, 
access_type);
+ret = env->tlb.map_address(env, physical, prot, address, rw,
+   access_type);
 } else {
 ret = TLBRET_BADADDR;
 }
@@ -179,7 +183,8 @@ static int get_physical_address (CPUMIPSState *env, 
target_phys_addr_t *physical
 } else if (address < (int32_t)0xE000UL) {
 /* sseg (kseg2) */
 if (supervisor_mode || kernel_mode) {
-ret = env->tlb->map_address(env, physical, prot, address, rw, 
access_type);
+ret = env->tlb.map_address(env, physical, prot, address, rw,
+   access_type);
 } else {
 ret = TLBRET_BADADDR;
 }
@@ -187,7 +192,8 @@ static int get_physical_address (CPUMIPSState *env, 
target_phys_addr_t *physical
 /* kseg3 */
 /* XXX: debug segment is not emulated */
 if (kernel_mode) {
-ret = env->tlb->map_address(env, physical, prot, address, rw, 
access_type);
+ret = env->tlb.map_address(env, physical, prot, address, rw,
+   access_type);
 } else {
 ret = TLBRET_BADADDR;
 }
@@ -645,19 +651,19 @@ void r4k_invalidate_

[Qemu-devel] [PATCH 13/36] vmstate: port ppc cpu

[Juan Quintela]

Added sdr1_vmstate because storing the value requires calling ppc_store_sdr1().
The position when the function is called also changes (I think it is save).

Signed-off-by: Juan Quintela 
---
 target-ppc/cpu.h |5 +-
 target-ppc/machine.c |  245 ++
 2 files changed, 90 insertions(+), 160 deletions(-)

diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index ca6f1cb..595ffb1 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -1064,6 +1064,9 @@ struct CPUPPCState {
  */
 uint8_t fit_period[4];
 uint8_t wdt_period[4];
+
+/* Fields needed as intermediate for vmstate */
+target_ulong sdr1_vmstate;
 };

 #define SET_FIT_PERIOD(a_, b_, c_, d_)  \
@@ -1219,8 +1222,6 @@ int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t 
val);
 #define cpu_signal_handler cpu_ppc_signal_handler
 #define cpu_list ppc_cpu_list

-#define CPU_SAVE_VERSION 4
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _user
 #define MMU_MODE1_SUFFIX _kernel
diff --git a/target-ppc/machine.c b/target-ppc/machine.c
index d6c2ee4..ca60bc0 100644
--- a/target-ppc/machine.c
+++ b/target-ppc/machine.c
@@ -2,172 +2,101 @@
 #include "hw/boards.h"
 #include "kvm.h"

-void cpu_save(QEMUFile *f, void *opaque)
+static const VMStateDescription vmstate_tlb = {
+.name = "tlb",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_UINTTL(pte0, ppc6xx_tlb_t),
+VMSTATE_UINTTL(pte1, ppc6xx_tlb_t),
+VMSTATE_UINTTL(EPN, ppc6xx_tlb_t),
+VMSTATE_END_OF_LIST()
+}
+};
+
+static bool is_tlb6(void *opaque, int version_id)
 {
-CPUPPCState *env = (CPUPPCState *)opaque;
-unsigned int i, j;
+CPUPPCState *env = opaque;

-for (i = 0; i < 32; i++)
-qemu_put_betls(f, &env->gpr[i]);
-#if !defined(TARGET_PPC64)
-for (i = 0; i < 32; i++)
-qemu_put_betls(f, &env->gprh[i]);
-#endif
-qemu_put_betls(f, &env->lr);
-qemu_put_betls(f, &env->ctr);
-for (i = 0; i < 8; i++)
-qemu_put_be32s(f, &env->crf[i]);
-qemu_put_betls(f, &env->xer);
-qemu_put_betls(f, &env->reserve_addr);
-qemu_put_betls(f, &env->msr);
-for (i = 0; i < 4; i++)
-qemu_put_betls(f, &env->tgpr[i]);
-for (i = 0; i < 32; i++) {
-union {
-float64 d;
-uint64_t l;
-} u;
-u.d = env->fpr[i];
-qemu_put_be64(f, u.l);
-}
-qemu_put_be32s(f, &env->fpscr);
-qemu_put_sbe32s(f, &env->access_type);
-#if defined(TARGET_PPC64)
-qemu_put_betls(f, &env->asr);
-qemu_put_sbe32s(f, &env->slb_nr);
-#endif
-qemu_put_betls(f, &env->spr[SPR_SDR1]);
-for (i = 0; i < 32; i++)
-qemu_put_betls(f, &env->sr[i]);
-for (i = 0; i < 2; i++)
-for (j = 0; j < 8; j++)
-qemu_put_betls(f, &env->DBAT[i][j]);
-for (i = 0; i < 2; i++)
-for (j = 0; j < 8; j++)
-qemu_put_betls(f, &env->IBAT[i][j]);
-qemu_put_sbe32s(f, &env->nb_tlb);
-qemu_put_sbe32s(f, &env->tlb_per_way);
-qemu_put_sbe32s(f, &env->nb_ways);
-qemu_put_sbe32s(f, &env->last_way);
-qemu_put_sbe32s(f, &env->id_tlbs);
-qemu_put_sbe32s(f, &env->nb_pids);
-if (env->tlb.tlb6) {
-// XXX assumes 6xx
-for (i = 0; i < env->nb_tlb; i++) {
-qemu_put_betls(f, &env->tlb.tlb6[i].pte0);
-qemu_put_betls(f, &env->tlb.tlb6[i].pte1);
-qemu_put_betls(f, &env->tlb.tlb6[i].EPN);
-}
-}
-for (i = 0; i < 4; i++)
-qemu_put_betls(f, &env->pb[i]);
-for (i = 0; i < 1024; i++)
-qemu_put_betls(f, &env->spr[i]);
-qemu_put_be32s(f, &env->vscr);
-qemu_put_be64s(f, &env->spe_acc);
-qemu_put_be32s(f, &env->spe_fscr);
-qemu_put_betls(f, &env->msr_mask);
-qemu_put_be32s(f, &env->flags);
-qemu_put_sbe32s(f, &env->error_code);
-qemu_put_be32s(f, &env->pending_interrupts);
-qemu_put_be32s(f, &env->irq_input_state);
-for (i = 0; i < POWERPC_EXCP_NB; i++)
-qemu_put_betls(f, &env->excp_vectors[i]);
-qemu_put_betls(f, &env->excp_prefix);
-qemu_put_betls(f, &env->hreset_excp_prefix);
-qemu_put_betls(f, &env->ivor_mask);
-qemu_put_betls(f, &env->ivpr_mask);
-qemu_put_betls(f, &env->hreset_vector);
-qemu_put_betls(f, &env->nip);
-qemu_put_betls(f, &env->hflags);
-qemu_put_betls(f, &env->hflags_nmsr);
-qemu_put_sbe32s(f, &env->mmu_idx);
-qemu_put_sbe32s(f, &env->power_mode);
+return (env->tlb.tlb6 != NULL);
 }

-int cpu_load(QEMUFile *f, void *opaque, int version_id)
+static void cpu_pre_save(void *opaque)
 {
-CPUPPCState *env = (CPUPPCState *)opaque;
-unsigned int i, j;
-target_ulong sdr1;
+CPUPPCState *env = opaque;
+env->sdr1_vmstate = env->spr[SPR_SDR1];
+}

-for (i = 0; i < 32; i++)
-qemu_get_betls(f, &env->gpr[i]);
+static int cpu_post_load(void *opaque, int version_id)
+{
+CPUPPCState *e

Re: [Qemu-devel] [PATCH] PNG screendump alternative

[Rafael da Veiga Cabral]

On 03/19/2012 05:50 PM, Luiz Capitulino wrote:

On Sat, 17 Mar 2012 19:45:56 -0300
Rafael  wrote:


Hi,

I  had already started to work on supporting PNG dump output on
screendump when got to know there was another effort to do the same
(see Add PNG screendump thread from Daniel P. Berrange). Anyway, I'd
like to share my implementation which is a little bit different. It
does not use any resource/lib besides libpng and qemu itself and is
based on qemu-kvm 0.15.1 ppm_save code.

There are a few problems with this patch. First, it should be against qemu.git
and 0.15.1 is a bit of an old release (we're moving towards 1.1).


Ok, it's old but pretty stable component for my unstable project, but as 
you've mentioned would be a

good try to use 1.1 version and towards.



Also, I'm not sure that we should completely rely on the file extension,
maybe we should have an argument for it...


eg.: screendump - filename=path/file ?
and the ppm format as fallback.



Anyway, I recommend you join the efforts for the new screendump command
along with Marc-Andre and Alon.


Great, by increasing the solution where my proposal fits.


I'm using that for a personal project developed at Mandriva which uses
QMP directly to communicate with qemu VMs rather than using the
libvirt although its usage is considered for the future. There is
something more to show but it is just QMP related and soon I'll have
it done to share.

Comments and suggestions are appreciated.

Cheers
Rafael Cabral



Comments appreciated, thanks Capitulino.
Rafael Cabral

[Qemu-devel] [PATCH 05/36] vmstate: use new style for lm32 cpus

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-lm32/cpu.h |2 --
 target-lm32/machine.c |   14 ++
 2 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/target-lm32/cpu.h b/target-lm32/cpu.h
index a7d9546..136a911 100644
--- a/target-lm32/cpu.h
+++ b/target-lm32/cpu.h
@@ -204,8 +204,6 @@ void cpu_lm32_set_phys_msb_ignore(CPULM32State *env, int 
value);
 #define cpu_gen_code cpu_lm32_gen_code
 #define cpu_signal_handler cpu_lm32_signal_handler

-#define CPU_SAVE_VERSION 1
-
 int cpu_lm32_handle_mmu_fault(CPULM32State *env, target_ulong address, int rw,
   int mmu_idx);
 #define cpu_handle_mmu_fault cpu_lm32_handle_mmu_fault
diff --git a/target-lm32/machine.c b/target-lm32/machine.c
index ed71bc4..24db6c0 100644
--- a/target-lm32/machine.c
+++ b/target-lm32/machine.c
@@ -3,10 +3,10 @@

 const VMStateDescription vmstate_cpu = {
 .name = "cpu",
-.version_id = CPU_SAVE_VERSION,
+.version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
-.fields  = (VMStateField[]) {
+.fields = (VMStateField[]) {
 VMSTATE_UINT32_ARRAY(regs, CPULM32State, 32),
 VMSTATE_UINT32(pc, CPULM32State),
 VMSTATE_UINT32(ie, CPULM32State),
@@ -21,13 +21,3 @@ const VMStateDescription vmstate_cpu = {
 VMSTATE_END_OF_LIST()
 }
 };
-
-void cpu_save(QEMUFile *f, void *opaque)
-{
-vmstate_save_state(f, &vmstate_cpu, opaque);
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-return vmstate_load_state(f, &vmstate_cpu, opaque, version_id);
-}
-- 
1.7.7.6

Re: [Qemu-devel] [RFC/RFA PATCH] qapi: detect extra members inside structs

[Anthony Liguori]

On 03/19/2012 06:45 PM, Michael Roth wrote:

So IMO, returning arguments actually seems easier for both clients and the
server, and is more resilient to downstream changes. It does require a more
formal specification of the protocol though. Basically: "an option/field
may not be supported in older/future versions of QEMU, so it is up to
the client to check in advance by referencing the QAPI schema for their
qemu version or programatically via get_schema()"


The complexity of writing a client using get_schema() is close to staggering :-/


I'm not sure, I mean, take libvirt, you need to marshall up the
arguments anyway and put them into a QMP payload, so in that case the
client developer is aware of the schema that they're coding against,
and also understand the QAPI schema specification, and if the schema
is nested then so is the client version of that "schema".

So, conceptually at least, it seems like it wouldn't be that big a jump
to maintain an internal representation of their schema to
programatically check against the specification they were coding
against, it's just the part where they then need to bake it into the
client implementation that's a bit heavy-handed.


So let's work through a few examples.   Today, you have to maintain a list of 
commands returned from query-commands and check for set membership:


if 'query-netdev2' in commands:
   qmp.query_netdev2(foo)
else:
   qmp.query_netdev()

Pretty simple.  If we have a schema representation, we'll need to be able to 
check for arguments.  That means we need a way to check if a command has an 
argument.  We could do this as nested lists:


if (commands.has_key('query-netdev') and
commands['query-netdev']['args'].has_key('interface')):
   qmp.query_netdev(foo)
else:
   qmp.query_netdev()

This is only really possible in a dynamically typed language, which sucks, but 
let's ignore that for now.  This is a bit more complicated but unfortunately, 
it's not enough.


Because we can add members to structures and structures can be arguments.  So we 
really need a way to say:


1) Do we have the query-netdev command
2) Does it take a parameter called interface of type NetDevArgument
3) Does the NetDevArgument have a member called 'foo'.

But this actually can be arbitrarily deep in terms of complex.  Maybe you make a 
simple query language so you can execute schema queries in a single line.


So you have an interface definition that is the schema that describes an 
unstructured wire protocol and a query language to determine when and how the 
schema changes.  If that doesn't ring a bell to you, congratulations, you've 
invented SOAP.


The interface description in SOAP is WSDL and XPath is the query language. 
Writing a SOAP client is a train wreck.  It's so bad that even in dynamic 
languages, people almost always use code generators.


A good RPC makes the client simple.  If that means we need to take care when 
introducing new interfaces, then it's a small price to pay for avoiding the 
nightmares of an over engineered RPC like SOAP.


Regards,

Anthony Liguori


Thinking about it more the, this does seem to be completely at odds with
any future prospects of a libqmp, so that's a pretty big trade-off...



Regards,

Anthony Liguori

[Qemu-devel] [PATCH 21/36] mips: bump migration version to 4

[Juan Quintela]

bcond state was stored as int32, but it is target_ulong.  Change migration state
to reflect that.

Signed-off-by: Juan Quintela 
---
 target-mips/cpu.h |2 +-
 target-mips/machine.c |   10 --
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 074882e..d2773d6 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -507,7 +507,7 @@ void mips_cpu_list (FILE *f, fprintf_function cpu_fprintf);
 #define cpu_signal_handler cpu_mips_signal_handler
 #define cpu_list mips_cpu_list

-#define CPU_SAVE_VERSION 3
+#define CPU_SAVE_VERSION 4

 /* MMU modes definitions. We carefully match the indices with our
hflags layout. */
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 4a1d2d8..8b9c0fb 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -84,8 +84,7 @@ void cpu_save(QEMUFile *f, void *opaque)
 qemu_put_sbe32s(f, &env->error_code);
 qemu_put_be32s(f, &env->hflags);
 qemu_put_betls(f, &env->btarget);
-i = env->bcond;
-qemu_put_sbe32s(f, &i);
+qemu_put_betls(f, &env->bcond);

 /* Save remaining CP1 registers */
 qemu_put_sbe32s(f, &env->CP0_Index);
@@ -193,9 +192,9 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 CPUMIPSState *env = opaque;
 int i;

-if (version_id != 3)
+if (version_id != 4) {
 return -EINVAL;
-
+}
 /* Load active TC */
 load_tc(f, &env->active_tc);

@@ -236,8 +235,7 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 qemu_get_sbe32s(f, &env->error_code);
 qemu_get_be32s(f, &env->hflags);
 qemu_get_betls(f, &env->btarget);
-qemu_get_sbe32s(f, &i);
-env->bcond = i;
+qemu_get_betls(f, &env->bcond);

 /* Load remaining CP1 registers */
 qemu_get_sbe32s(f, &env->CP0_Index);
-- 
1.7.7.6

[Qemu-devel] [PATCH 14/36] vmstate: introduce VMSTATE_VARRAY_MULTIPLY

[Juan Quintela]

This allows to sent a partial array where the size is another
structure field multiplied by a constant.

Signed-off-by: Juan Quintela 
---
 savevm.c  |6 ++
 vmstate.h |   35 +++
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/savevm.c b/savevm.c
index 4c42076..17927f1 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1519,6 +1519,9 @@ int vmstate_load_state(QEMUFile *f, const 
VMStateDescription *vmsd,
 } else if (field->flags & VMS_VARRAY_UINT8) {
 n_elems = *(uint8_t *)(opaque+field->num_offset);
 }
+if (field->flags & VMS_MULTIPLY_ELEMENTS) {
+n_elems *= field->num;
+}
 if (field->flags & VMS_POINTER) {
 base_addr = *(void **)base_addr + field->start;
 }
@@ -1583,6 +1586,9 @@ void vmstate_save_state(QEMUFile *f, const 
VMStateDescription *vmsd,
 } else if (field->flags & VMS_VARRAY_UINT8) {
 n_elems = *(uint8_t *)(opaque+field->num_offset);
 }
+if (field->flags & VMS_MULTIPLY_ELEMENTS) {
+n_elems *= field->num;
+}
 if (field->flags & VMS_POINTER) {
 base_addr = *(void **)base_addr + field->start;
 }
diff --git a/vmstate.h b/vmstate.h
index b8ac2d0..b0225e9 100644
--- a/vmstate.h
+++ b/vmstate.h
@@ -64,18 +64,19 @@ struct VMStateInfo {
 };

 enum VMStateFlags {
-VMS_SINGLE   = 0x001,
-VMS_POINTER  = 0x002,
-VMS_ARRAY= 0x004,
-VMS_STRUCT   = 0x008,
-VMS_VARRAY_INT32 = 0x010,  /* Array with size in int32_t field*/
-VMS_BUFFER   = 0x020,  /* static sized buffer */
-VMS_ARRAY_OF_POINTER = 0x040,
-VMS_VARRAY_UINT16= 0x080,  /* Array with size in uint16_t field */
-VMS_VBUFFER  = 0x100,  /* Buffer with size in int32_t field */
-VMS_MULTIPLY = 0x200,  /* multiply "size" field by field_size */
-VMS_VARRAY_UINT8 = 0x400,  /* Array with size in uint8_t field*/
-VMS_VARRAY_UINT32= 0x800,  /* Array with size in uint32_t field*/
+VMS_SINGLE= 0x001,
+VMS_POINTER   = 0x002,
+VMS_ARRAY = 0x004,
+VMS_STRUCT= 0x008,
+VMS_VARRAY_INT32  = 0x010,  /* Array with size in int32_t field*/
+VMS_BUFFER= 0x020,  /* static sized buffer */
+VMS_ARRAY_OF_POINTER  = 0x040,
+VMS_VARRAY_UINT16 = 0x080,  /* Array with size in uint16_t field */
+VMS_VBUFFER   = 0x100,  /* Buffer with size in int32_t field */
+VMS_MULTIPLY  = 0x200,  /* multiply "size" field by field_size */
+VMS_VARRAY_UINT8  = 0x400,  /* Array with size in uint8_t field*/
+VMS_VARRAY_UINT32 = 0x800,  /* Array with size in uint32_t field*/
+VMS_MULTIPLY_ELEMENTS = 0x1000,  /* multiply "size" field by field_size */
 };

 typedef struct {
@@ -200,6 +201,16 @@ extern const VMStateDescription vmstate_cpu;
 .offset = vmstate_offset_array(_state, _field, _type, _num), \
 }

+#define VMSTATE_VARRAY_MULTIPLY(_field, _state, _field_num, _multiply, _info, 
_type) { \
+.name   = (stringify(_field)),   \
+.num_offset = vmstate_offset_value(_state, _field_num, uint32_t),\
+.num= (_multiply),   \
+.info   = &(_info),  \
+.size   = sizeof(_type), \
+.flags  = VMS_VARRAY_UINT32|VMS_MULTIPLY_ELEMENTS,   \
+.offset = offsetof(_state, _field),  \
+}
+
 #define VMSTATE_ARRAY_TEST(_field, _state, _num, _test, _info, _type) {\
 .name = (stringify(_field)),  \
 .field_exists = (_test),  \
-- 
1.7.7.6

[Qemu-devel] [PATCH 07/36] vmstate: port cris cpu to vmstate

[Juan Quintela]

Have to define TLBSet struct.
Multidimensional arrays in C are a mess, just unroll them.

Signed-off-by: Juan Quintela 
---
 target-cris/cpu.h |   13 ++---
 target-cris/machine.c |  138 +++--
 2 files changed, 60 insertions(+), 91 deletions(-)

diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index 31899c2..423a527 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -104,6 +104,11 @@

 #define NB_MMU_MODES 2

+typedef struct {
+uint32_t hi;
+uint32_t lo;
+} TLBSet;
+
 typedef struct CPUCRISState {
uint32_t regs[16];
/* P0 - P15 are referred to as special registers in the docs.  */
@@ -157,11 +162,7 @@ typedef struct CPUCRISState {
 *
 * One for I and another for D.
 */
-   struct
-   {
-   uint32_t hi;
-   uint32_t lo;
-   } tlbsets[2][4][16];
+   TLBSet tlbsets[2][4][16];

CPU_COMMON

@@ -219,8 +220,6 @@ enum {
 #define cpu_gen_code cpu_cris_gen_code
 #define cpu_signal_handler cpu_cris_signal_handler

-#define CPU_SAVE_VERSION 1
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _kernel
 #define MMU_MODE1_SUFFIX _user
diff --git a/target-cris/machine.c b/target-cris/machine.c
index 8f9c0dd..1b96265 100644
--- a/target-cris/machine.c
+++ b/target-cris/machine.c
@@ -1,90 +1,60 @@
 #include "hw/hw.h"
 #include "hw/boards.h"

-void cpu_save(QEMUFile *f, void *opaque)
-{
-CPUCRISState *env = opaque;
-int i;
-int s;
-int mmu;
-
-for (i = 0; i < 16; i++)
-qemu_put_be32(f, env->regs[i]);
-for (i = 0; i < 16; i++)
-qemu_put_be32(f, env->pregs[i]);
-
-qemu_put_be32(f, env->pc);
-qemu_put_be32(f, env->ksp);
-
-qemu_put_be32(f, env->dslot);
-qemu_put_be32(f, env->btaken);
-qemu_put_be32(f, env->btarget);
-
-qemu_put_be32(f, env->cc_op);
-qemu_put_be32(f, env->cc_mask);
-qemu_put_be32(f, env->cc_dest);
-qemu_put_be32(f, env->cc_src);
-qemu_put_be32(f, env->cc_result);
-qemu_put_be32(f, env->cc_size);
-qemu_put_be32(f, env->cc_x);
-
-for (s = 0; s < 4; s++) {
-for (i = 0; i < 16; i++)
-qemu_put_be32(f, env->sregs[s][i]);
-}
-
-qemu_put_be32(f, env->mmu_rand_lfsr);
-for (mmu = 0; mmu < 2; mmu++) {
-for (s = 0; s < 4; s++) {
-for (i = 0; i < 16; i++) {
-qemu_put_be32(f, env->tlbsets[mmu][s][i].lo);
-qemu_put_be32(f, env->tlbsets[mmu][s][i].hi);
-}
-}
+static const VMStateDescription vmstate_tlbset = {
+.name = "cpu/tlbset",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_UINT32(lo, TLBSet),
+VMSTATE_UINT32(hi, TLBSet),
+VMSTATE_END_OF_LIST()
 }
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-   CPUCRISState *env = opaque;
-int i;
-int s;
-int mmu;
-
-for (i = 0; i < 16; i++)
-env->regs[i] = qemu_get_be32(f);
-for (i = 0; i < 16; i++)
-env->pregs[i] = qemu_get_be32(f);
-
-env->pc = qemu_get_be32(f);
-env->ksp = qemu_get_be32(f);
-
-env->dslot = qemu_get_be32(f);
-env->btaken = qemu_get_be32(f);
-env->btarget = qemu_get_be32(f);
-
-env->cc_op = qemu_get_be32(f);
-env->cc_mask = qemu_get_be32(f);
-env->cc_dest = qemu_get_be32(f);
-env->cc_src = qemu_get_be32(f);
-env->cc_result = qemu_get_be32(f);
-env->cc_size = qemu_get_be32(f);
-env->cc_x = qemu_get_be32(f);
-
-for (s = 0; s < 4; s++) {
-for (i = 0; i < 16; i++)
-env->sregs[s][i] = qemu_get_be32(f);
-}
-
-env->mmu_rand_lfsr = qemu_get_be32(f);
-for (mmu = 0; mmu < 2; mmu++) {
-for (s = 0; s < 4; s++) {
-for (i = 0; i < 16; i++) {
-env->tlbsets[mmu][s][i].lo = qemu_get_be32(f);
-env->tlbsets[mmu][s][i].hi = qemu_get_be32(f);
-}
-}
+};
+
+const VMStateDescription vmstate_cpu = {
+.name = "cpu",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_UINT32_ARRAY(regs, CPUCRISState, 16),
+VMSTATE_UINT32_ARRAY(pregs, CPUCRISState, 16),
+VMSTATE_UINT32(pc, CPUCRISState),
+VMSTATE_UINT32(ksp, CPUCRISState),
+VMSTATE_INT32(dslot, CPUCRISState),
+VMSTATE_INT32(btaken, CPUCRISState),
+VMSTATE_UINT32(btarget, CPUCRISState),
+VMSTATE_UINT32(cc_op, CPUCRISState),
+VMSTATE_UINT32(cc_mask, CPUCRISState),
+VMSTATE_UINT32(cc_dest, CPUCRISState),
+VMSTATE_UINT32(cc_src, CPUCRISState),
+VMSTATE_UINT32(cc_result, CPUCRISState),
+VMSTATE_INT32(cc_size, CPUCRISState),
+VMSTATE_INT32(cc_x, CPUCRISState),
+VMSTATE_UINT32_ARRAY(sregs[0], CPUCRISState, 16),
+VMSTATE_UINT32_ARRAY(sregs[1], CPUCRISState, 16),
+VMSTATE_U

[Qemu-devel] [PATCH 29/36] vmstate: Add copyright info for alpha processor

[Juan Quintela]

Signed-off-by: Juan Quintela 
Acked-by: Richard Henderson 
---
 target-alpha/vmstate-cpu.c |   15 +++
 1 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/target-alpha/vmstate-cpu.c b/target-alpha/vmstate-cpu.c
index 22c70f3..b94b1e5 100644
--- a/target-alpha/vmstate-cpu.c
+++ b/target-alpha/vmstate-cpu.c
@@ -1,3 +1,18 @@
+/*
+ * Migration support for alpha cpus
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Based on savevm serialization code by:
+ *   Richard Henderson 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
 #include "hw/hw.h"

 static int get_fpcr(QEMUFile *f, void *opaque, size_t size)
-- 
1.7.7.6

[Qemu-devel] [PATCH 10/36] vmstate: introduce float64 arrays

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 savevm.c  |   30 ++
 vmstate.h |4 
 2 files changed, 34 insertions(+), 0 deletions(-)

diff --git a/savevm.c b/savevm.c
index 09a2149..822f078 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1112,6 +1112,36 @@ const VMStateInfo vmstate_info_float32 = {
 .put  = put_float32,
 };

+/* 64 bit float */
+
+typedef union {
+float64 d;
+uint64_t l;
+} VMStateFloat64;
+
+static int get_float64(QEMUFile *f, void *pv, size_t size)
+{
+float64 *v = pv;
+VMStateFloat64 u;
+qemu_get_be64s(f, &u.l);
+*v = u.d;
+return 0;
+}
+
+static void put_float64(QEMUFile *f, void *pv, size_t size)
+{
+float64 *v = pv;
+VMStateFloat64 u;
+u.d = *v;
+qemu_put_be64s(f, &u.l);
+}
+
+const VMStateInfo vmstate_info_float64 = {
+.name = "float64",
+.get  = get_float64,
+.put  = put_float64,
+};
+
 /* timers  */

 static int get_timer(QEMUFile *f, void *pv, size_t size)
diff --git a/vmstate.h b/vmstate.h
index 135c5aa..d3fb88c 100644
--- a/vmstate.h
+++ b/vmstate.h
@@ -131,6 +131,7 @@ extern const VMStateInfo vmstate_info_uint32;
 extern const VMStateInfo vmstate_info_uint64;

 extern const VMStateInfo vmstate_info_float32;
+extern const VMStateInfo vmstate_info_float64;

 extern const VMStateInfo vmstate_info_timer;
 extern const VMStateInfo vmstate_info_buffer;
@@ -564,6 +565,9 @@ extern const VMStateDescription vmstate_cpu;
 #define VMSTATE_FLOAT32_ARRAY(_f, _s, _n) \
 VMSTATE_ARRAY(_f, _s, _n, 0, vmstate_info_float32, float32)

+#define VMSTATE_FLOAT64_ARRAY(_f, _s, _n) \
+VMSTATE_ARRAY(_f, _s, _n, 0, vmstate_info_float64, float64)
+
 #define VMSTATE_BUFFER_V(_f, _s, _v)  \
 VMSTATE_STATIC_BUFFER(_f, _s, _v, NULL, 0, sizeof(typeof_field(_s, _f)))

-- 
1.7.7.6

Re: [Qemu-devel] [PATCH] qmp_output_visitor_cleanup(): fix double free

[Michael Roth]

On Fri, Mar 16, 2012 at 08:16:12PM +0100, Laszlo Ersek wrote:
> Stack entries in QmpOutputVisitor are navigation links (weak references),
> except the bottom (ie. least recently added) entry, which owns the root
> QObject [1]. Make qmp_output_visitor_cleanup() drop the stack entries,
> then release the QObject tree by the root.
> 
> Attempting to serialize an invalid enum inside a dictionary is an example
> for triggering the double free.
> 
> [1] http://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg03276.html
> 
> Signed-off-by: Laszlo Ersek 

Tested-by: Michael Roth 

Looks good. Did you or Paolo want to re-send that test case with a SoB?
I have a test case that triggers this by manually calling error_set(),
but I think yours is better.

> ---
>  qapi/qmp-output-visitor.c |8 +---
>  1 files changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/qapi/qmp-output-visitor.c b/qapi/qmp-output-visitor.c
> index e0697b0..2bce9d5 100644
> --- a/qapi/qmp-output-visitor.c
> +++ b/qapi/qmp-output-visitor.c
> @@ -199,14 +199,16 @@ void qmp_output_visitor_cleanup(QmpOutputVisitor *v)
>  {
>  QStackEntry *e, *tmp;
> 
> +/* The bottom QStackEntry, if any, owns the root QObject. See the
> + * qmp_output_push_obj() invocations in qmp_output_add_obj(). */
> +QObject *root = QTAILQ_EMPTY(&v->stack) ? NULL : qmp_output_first(v);
> +
>  QTAILQ_FOREACH_SAFE(e, &v->stack, node, tmp) {
>  QTAILQ_REMOVE(&v->stack, e, node);
> -if (e->value) {
> -qobject_decref(e->value);
> -}
>  g_free(e);
>  }
> 
> +qobject_decref(root);
>  g_free(v);
>  }
> 
> -- 
> 1.7.1
> 

Re: [Qemu-devel] [PATCH RFC] virtio-pci: add MMIO property

[Anthony Liguori]

On 03/19/2012 06:52 PM, Rusty Russell wrote:

On Mon, 19 Mar 2012 17:13:06 -0500, Anthony Liguori  
wrote:

Maybe just make this a hidden option like x-miio?


x-violate-the-virtio-spec-to-trick-old-linux-drivers-into-working-on-power?


"To configure the device, we use the first I/O region of the PCI
device."

Meh, it does sound a little like we are specifying that it's an PCI I/O
bar.

Let's resurrect the PCI-v2 idea, which is ready to implement now, and a
nice cleanup?  Detach it from the change-of-ring-format idea which is
turning out to be a tarpit.


I think that's a sensible approach.

Regards,

Anthony Liguori


Thanks,
Rusty.

[Qemu-devel] [PATCH 03/36] vmstate: unicore32 don't support cpu migration

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-unicore32/cpu.h |2 --
 1 files changed, 0 insertions(+), 2 deletions(-)

diff --git a/target-unicore32/cpu.h b/target-unicore32/cpu.h
index a3f8589..be85250 100644
--- a/target-unicore32/cpu.h
+++ b/target-unicore32/cpu.h
@@ -134,8 +134,6 @@ int uc32_cpu_signal_handler(int host_signum, void *pinfo, 
void *puc);
 int uc32_cpu_handle_mmu_fault(CPUUniCore32State *env, target_ulong address, 
int rw,
   int mmu_idx);

-#define CPU_SAVE_VERSION 2
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _kernel
 #define MMU_MODE1_SUFFIX _user
-- 
1.7.7.6

[Qemu-devel] [PATCH 09/36] vmstate: introduce float32 arrays

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 savevm.c  |   30 ++
 vmstate.h |5 +
 2 files changed, 35 insertions(+), 0 deletions(-)

diff --git a/savevm.c b/savevm.c
index 12fb209..09a2149 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1082,6 +1082,36 @@ const VMStateInfo vmstate_info_uint16_equal = {
 .put  = put_uint16,
 };

+/* 32 bit float */
+
+typedef union {
+float32 f;
+uint32_t i;
+} VMStateFloat32;
+
+static int get_float32(QEMUFile *f, void *pv, size_t size)
+{
+float32 *v = pv;
+VMStateFloat32 u;
+qemu_get_be32s(f, &u.i);
+*v = u.f;
+return 0;
+}
+
+static void put_float32(QEMUFile *f, void *pv, size_t size)
+{
+float32 *v = pv;
+VMStateFloat32 u;
+u.f = *v;
+qemu_put_be32s(f, &u.i);
+}
+
+const VMStateInfo vmstate_info_float32 = {
+.name = "float32",
+.get  = get_float32,
+.put  = put_float32,
+};
+
 /* timers  */

 static int get_timer(QEMUFile *f, void *pv, size_t size)
diff --git a/vmstate.h b/vmstate.h
index 1a4a60b..135c5aa 100644
--- a/vmstate.h
+++ b/vmstate.h
@@ -130,6 +130,8 @@ extern const VMStateInfo vmstate_info_uint16;
 extern const VMStateInfo vmstate_info_uint32;
 extern const VMStateInfo vmstate_info_uint64;

+extern const VMStateInfo vmstate_info_float32;
+
 extern const VMStateInfo vmstate_info_timer;
 extern const VMStateInfo vmstate_info_buffer;
 extern const VMStateInfo vmstate_info_unused_buffer;
@@ -559,6 +561,9 @@ extern const VMStateDescription vmstate_cpu;
 #define VMSTATE_INT64_ARRAY(_f, _s, _n)   \
 VMSTATE_INT64_ARRAY_V(_f, _s, _n, 0)

+#define VMSTATE_FLOAT32_ARRAY(_f, _s, _n) \
+VMSTATE_ARRAY(_f, _s, _n, 0, vmstate_info_float32, float32)
+
 #define VMSTATE_BUFFER_V(_f, _s, _v)  \
 VMSTATE_STATIC_BUFFER(_f, _s, _v, NULL, 0, sizeof(typeof_field(_s, _f)))

-- 
1.7.7.6

[Qemu-devel] [PATCH 31/36] vmstate: Add copyright info for cris processor

[Juan Quintela]

Signed-off-by: Juan Quintela 
Acked-by: Edgar E. Iglesias 
---
 target-cris/vmstate-cpu.c |   15 +++
 1 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/target-cris/vmstate-cpu.c b/target-cris/vmstate-cpu.c
index 1dbf8b5..47ac170 100644
--- a/target-cris/vmstate-cpu.c
+++ b/target-cris/vmstate-cpu.c
@@ -1,3 +1,18 @@
+/*
+ * Migration support for cris cpus
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Based on savevm serialization code by:
+ *  Edgar E. Iglesias 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
 #include "hw/hw.h"

 static const VMStateDescription vmstate_tlbset = {
-- 
1.7.7.6

[Qemu-devel] [PATCH 18/36] mips_fulong2e: cpu vmstate already registered in cpu_exec_init

[Juan Quintela]

This is the second place that register cpu migration code, it is done
in general in cpu_exec_init(), just remove this call.

Signed-off-by: Juan Quintela 
---
 hw/mips_fulong2e.c |1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

diff --git a/hw/mips_fulong2e.c b/hw/mips_fulong2e.c
index 37dc711..1a8df10 100644
--- a/hw/mips_fulong2e.c
+++ b/hw/mips_fulong2e.c
@@ -284,7 +284,6 @@ static void mips_fulong2e_init(ram_addr_t ram_size, const 
char *boot_device,
 exit(1);
 }

-register_savevm(NULL, "cpu", 0, 3, cpu_save, cpu_load, env);
 qemu_register_reset(main_cpu_reset, env);

 /* fulong 2e has 256M ram. */
-- 
1.7.7.6

[Qemu-devel] [PATCH 27/36] vmstate: remove unneeded includes from target-*/machine.c

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-alpha/machine.c |1 -
 target-arm/machine.c   |1 -
 target-cris/machine.c  |1 -
 target-i386/machine.c  |6 --
 target-lm32/machine.c  |1 -
 target-mips/machine.c  |3 ---
 target-ppc/machine.c   |2 --
 target-sparc/machine.c |4 
 8 files changed, 0 insertions(+), 19 deletions(-)

diff --git a/target-alpha/machine.c b/target-alpha/machine.c
index 8b3b42e..22c70f3 100644
--- a/target-alpha/machine.c
+++ b/target-alpha/machine.c
@@ -1,5 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"

 static int get_fpcr(QEMUFile *f, void *opaque, size_t size)
 {
diff --git a/target-arm/machine.c b/target-arm/machine.c
index 31e49ac..f8ccdd7 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -1,5 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"

 static bool feature_vfp_needed(void *opaque)
 {
diff --git a/target-cris/machine.c b/target-cris/machine.c
index 1b96265..1dbf8b5 100644
--- a/target-cris/machine.c
+++ b/target-cris/machine.c
@@ -1,5 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"

 static const VMStateDescription vmstate_tlbset = {
 .name = "cpu/tlbset",
diff --git a/target-i386/machine.c b/target-i386/machine.c
index c2a8872..0ef12ac 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -1,10 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"
-#include "hw/pc.h"
-#include "hw/isa.h"
-
-#include "cpu.h"
-#include "kvm.h"

 static const VMStateDescription vmstate_segment = {
 .name = "segment",
diff --git a/target-lm32/machine.c b/target-lm32/machine.c
index 24db6c0..132259d 100644
--- a/target-lm32/machine.c
+++ b/target-lm32/machine.c
@@ -1,5 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"

 const VMStateDescription vmstate_cpu = {
 .name = "cpu",
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 8951748..bbfa2a9 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -1,7 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"
-
-#include "cpu.h"

 static const VMStateDescription vmstate_tc = {
 .name = "tc",
diff --git a/target-ppc/machine.c b/target-ppc/machine.c
index ca60bc0..c4547df 100644
--- a/target-ppc/machine.c
+++ b/target-ppc/machine.c
@@ -1,6 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"
-#include "kvm.h"

 static const VMStateDescription vmstate_tlb = {
 .name = "tlb",
diff --git a/target-sparc/machine.c b/target-sparc/machine.c
index 818b11c..b599ac7 100644
--- a/target-sparc/machine.c
+++ b/target-sparc/machine.c
@@ -1,8 +1,4 @@
 #include "hw/hw.h"
-#include "hw/boards.h"
-#include "qemu-timer.h"
-
-#include "cpu.h"

 static const VMStateDescription vmstate_cpu_timer = {
 .name = "cpu_timer",
-- 
1.7.7.6

[Qemu-devel] [PATCH 12/36] vmstate: Introduce VMSTATE_STRUCT_VARRAY_INT32_TEST

[Juan Quintela]

We have an array of structs whose size is an int32 in the same struct that
depends on a test value to know if it is there or not.

Signed-off-by: Juan Quintela 
---
 vmstate.h |   10 ++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/vmstate.h b/vmstate.h
index 5c56f25..b8ac2d0 100644
--- a/vmstate.h
+++ b/vmstate.h
@@ -309,6 +309,16 @@ extern const VMStateDescription vmstate_cpu;
 .offset = offsetof(_state, _field),  \
 }

+#define VMSTATE_STRUCT_VARRAY_INT32_TEST(_field, _state, _field_num, _test, 
_vmsd, _type) { \
+.name   = (stringify(_field)),   \
+.num_offset = vmstate_offset_value(_state, _field_num, int32_t), \
+.vmsd   = &(_vmsd),  \
+.field_exists = (_test), \
+.size   = sizeof(_type), \
+.flags  = VMS_STRUCT|VMS_VARRAY_INT32,   \
+.offset = offsetof(_state, _field),  \
+}
+
 #define VMSTATE_STRUCT_VARRAY_POINTER_INT32(_field, _state, _field_num, _vmsd, 
_type) { \
 .name   = (stringify(_field)),   \
 .version_id = 0, \
-- 
1.7.7.6

[Qemu-devel] [PATCH v4 00/36] VMState port of all cpus

[Juan Quintela]

This repository contains all the changes:

  git://repo.or.cz/qemu/quintela.git vmstate-cpus-v4

[v4]
- rebase to top
- adapt to vmstate.h change
- adapt to CPUState -> CPU$archState rename
- integrate arm changes in the meantime
- add QEMU contributors to the copyright notice of ppc & sparc

[v3]
- rebase to top
- fix sparc/arm/i386 changes in upstream
- all reviews were positive, Anthony, please pull

[v2] Changes since v1

- preserve arm comment that was missing (pbrook)
- add copyright notice to the files that were empty
- new patches:
  * fix formating for i386
  * remove unneeded includes
  * rename machine.c to vmstate.c

Later, Juan.

[v1]

This series port all cpus to use vmstate.
- 1st patch is a fix of vmstate.
- I discussed the arm changes over irc with Peter, he agreed that some
  simplification could be good, but he didn't saw the patches O:-)
- mips: no pci chipset has been ported, so migration don't work there.
  I have embedded a couple of structs to improve vmstate checking.  Notice
  that they were always allocated, so there shouldn't be any problem.
- sparc: I changed the format a little bit to be able to use normal arrays.
- sparc: If we always send the whole register windows, we don't need
  VMSTATE_VARRAY_MULTIPLY.  As that array is quite big (520 elements), I am not
  sure what is best.
- cpsr_vmstate on arm: I am not sure if I could "abuse" uncached_cpsr for that
  purpose?

I have only tested on x86, for the rest, I double checked, but it is
possible that I missed something.  I expect all patches to be
integrated by Anthony in one go.  Architecture maintainers are CC'd
for an ACK/NACK/comments.

Please, review.

PD. Is there an easy way of creating this "CC" list of mail addresses,
or the only way is to edit comments and write it by hand as I did?

Juan Quintela (36):
  vmstate: Simplify test for CPU_SAVE_VERSION
  vmstate: make all architectures export a way to migrate cpu's
  vmstate: unicore32 don't support cpu migration
  vmstate: use new cpu style for x86
  vmstate: use new style for lm32 cpus
  vmstate: make microblaze cpus not migrateable
  vmstate: port cris cpu to vmstate
  vmstate: machine.c is only compiled for !CONFIG_USER_ONLY
  vmstate: introduce float32 arrays
  vmstate: introduce float64 arrays
  vmstate: introduce CPU_DoubleU arrays
  vmstate: Introduce VMSTATE_STRUCT_VARRAY_INT32_TEST
  vmstate: port ppc cpu
  vmstate: introduce VMSTATE_VARRAY_MULTIPLY
  vmstate: define vmstate_info_uinttls
  vmstate: port sparc cpu
  vmstate: make incompatible change for sparc
  mips_fulong2e: cpu vmstate already registered in cpu_exec_init
  mips: make mvp an embedded struct instead of a pointer
  mips: make tlb an embedded struct instead of a pointer
  mips: bump migration version to 4
  vmstate: port mips cpu
  arm: save always 32 fpu registers
  vmstate: port arm cpu
  vmstate: all cpus converted
  vmstate: fix vmstate formating for i386
  vmstate: remove unneeded includes from target-*/machine.c
  vmstate: rename machine.c to vmstate-cpu.c
  vmstate: Add copyright info for alpha processor
  vmstate: Add copyright info for lm32 processor
  vmstate: Add copyright info for cris processor
  vmstate: Add copyright info for arm processor
  vmstate: Add copyright info for i386 processor
  vmstate: Add copyright info for mips processor
  vmstate: Add copyright info for ppc processor
  vmstate: Add copyright info for sparc processor

 Makefile.target|3 +-
 exec.c |7 +-
 hw/hw.h|2 +
 hw/mips_fulong2e.c |1 -
 hw/mips_malta.c|4 +-
 hw/mips_timer.c|2 +-
 hw/sun4u.c |   20 --
 qemu-common.h  |4 -
 savevm.c   |   90 
 target-alpha/{machine.c => vmstate-cpu.c}  |   28 ++-
 target-arm/cpu.h   |5 +-
 target-arm/machine.c   |  233 -
 target-arm/vmstate-cpu.c   |  191 +
 target-cris/cpu.h  |   13 +-
 target-cris/machine.c  |   90 
 target-cris/vmstate-cpu.c  |   74 +++
 target-i386/cpu.h  |2 -
 target-i386/{machine.c => vmstate-cpu.c}   |   64 ---
 target-lm32/cpu.h  |2 -
 target-lm32/{machine.c => vmstate-cpu.c}   |   32 ++--
 target-m68k/vmstate-cpu.c  |   21 ++
 target-microblaze/cpu.h|2 -
 target-microblaze/machine.c|   11 -
 target-microblaze/vmstate-cpu.c|   21 ++
 target-mips/cpu.h  |   11 +-
 target-mips/helper.c   |   30 ++-
 target-mips/machine.c  |  308 
 target-mips/op_helper.c

Re: [Qemu-devel] [RFC/RFA PATCH] qapi: detect extra members inside structs

[Michael Roth]

On Mon, Mar 19, 2012 at 08:29:28PM +0100, Paolo Bonzini wrote:
> I noticed that the QMP input visitor does not detect extra members inside
> structs.  The outermost arguments struct is handled by the QMP type
> checker, but the nested ones go undetected.  That could be a problem
> for complex commands such as "transaction".
> 
> This patch adds such detection to the QMP input visitor.
> 
> Signed-off-by: Paolo Bonzini 
> ---
>   Is this acceptable or just wrong?
> 
>   Other small problems I noticed in running the testsuite:
> why is qemu-ga$(EXESUF) in tests/Makefile and test-qmp-commands

qemu-ga looks like an inadvertant copy/paste. and yah, test-qmp-commands
should be part of make check, might've been left out initially because it
barfs out debug statements. Just sent some patches.

> not run by "make check"?
> 
>  qapi/qmp-input-visitor.c |   19 --
>  qerror.h |3 +++
>  test-qmp-input-visitor.c |   19 +++
>  3 files changed, 39 insertions(+), 2 deletions(-)
> 
> diff --git a/qapi/qmp-input-visitor.c b/qapi/qmp-input-visitor.c
> index e6b6152..416ab90 100644
> --- a/qapi/qmp-input-visitor.c
> +++ b/qapi/qmp-input-visitor.c
> @@ -23,7 +23,8 @@
>  typedef struct StackObject
>  {
>  const QObject *obj;
> -const  QListEntry *entry;
> +const QListEntry *entry;
> +int   left;
>  } StackObject;
> 
>  struct QmpInputVisitor
> @@ -31,6 +32,7 @@ struct QmpInputVisitor
>  Visitor visitor;
>  QObject *obj;
>  StackObject stack[QIV_STACK_SIZE];
> +int left;
>  int nb_stack;
>  };
> 
> @@ -52,8 +54,13 @@ static const QObject *qmp_input_get_object(QmpInputVisitor 
> *qiv,
> 
>  if (qobj) {
>  if (name && qobject_type(qobj) == QTYPE_QDICT) {
> -return qdict_get(qobject_to_qdict(qobj), name);
> +qobj = qdict_get(qobject_to_qdict(qobj), name);
> +if (qobj) {
> +assert(qiv->left > 0);
> +qiv->left--;
> +}
>  } else if (qiv->nb_stack > 0 && qobject_type(qobj) == QTYPE_QLIST) {
> +assert(qiv->left == -1);
>  return qlist_entry_obj(qiv->stack[qiv->nb_stack - 1].entry);
>  }
>  }
> @@ -64,10 +70,12 @@ static const QObject 
> *qmp_input_get_object(QmpInputVisitor *qiv,
>  static void qmp_input_push(QmpInputVisitor *qiv, const QObject *obj, Error 
> **errp)
>  {
>  qiv->stack[qiv->nb_stack].obj = obj;
> +qiv->stack[qiv->nb_stack].left = qiv->left;
>  if (qobject_type(obj) == QTYPE_QLIST) {
>  qiv->stack[qiv->nb_stack].entry = qlist_first(qobject_to_qlist(obj));
>  }
>  qiv->nb_stack++;
> +qiv->left = -1;
> 
>  if (qiv->nb_stack >= QIV_STACK_SIZE) {
>  error_set(errp, QERR_BUFFER_OVERRUN);
> @@ -77,7 +85,12 @@ static void qmp_input_push(QmpInputVisitor *qiv, const 
> QObject *obj, Error **err
> 
>  static void qmp_input_pop(QmpInputVisitor *qiv, Error **errp)
>  {
> +if (qiv->left != -1 && qiv->left != 0) {
> +error_set(errp, QERR_EXTRA_MEMBER);
> +return;
> +}
>  qiv->nb_stack--;
> +qiv->left = qiv->stack[qiv->nb_stack].left;
>  if (qiv->nb_stack < 0) {
>  error_set(errp, QERR_BUFFER_OVERRUN);
>  return;
> @@ -97,6 +110,7 @@ static void qmp_input_start_struct(Visitor *v, void **obj, 
> const char *kind,
>  }
> 
>  qmp_input_push(qiv, qobj, errp);
> +qiv->left = qdict_size(qobject_to_qdict(qobj));
>  if (error_is_set(errp)) {
>  return;
>  }
> diff --git a/qerror.h b/qerror.h
> index e26c635..520cdab 100644
> --- a/qerror.h
> +++ b/qerror.h
> @@ -127,6 +127,9 @@ QError *qobject_to_qerror(const QObject *obj);
>  #define QERR_DUPLICATE_ID \
>  "{ 'class': 'DuplicateId', 'data': { 'id': %s, 'object': %s } }"
> 
> +#define QERR_EXTRA_MEMBER \
> +"{ 'class': 'ExtraInputObjectMember', 'data': {} }"
> +
>  #define QERR_FD_NOT_FOUND \
>  "{ 'class': 'FdNotFound', 'data': { 'name': %s } }"
> 
> diff --git a/test-qmp-input-visitor.c b/test-qmp-input-visitor.c
> index 1996e49..1783759 100644
> --- a/test-qmp-input-visitor.c
> +++ b/test-qmp-input-visitor.c
> @@ -161,6 +161,23 @@ static void visit_type_TestStruct(Visitor *v, TestStruct 
> **obj,
>  visit_end_struct(v, errp);
>  }
> 
> +static void test_visitor_in_struct_extra(TestInputVisitorData *data,
> + const void *unused)
> +{
> +TestStruct *p = NULL;
> +Error *errp = NULL;
> +Visitor *v;
> +
> +v = visitor_input_test_init(data, "{ 'integer': -42, 'boolean': true, 
> 'string': 'foo', 'extra' : [ 123, 456, 'def' ] }");
> +
> +visit_type_TestStruct(v, &p, NULL, &errp);
> +g_assert(error_is_set(&errp));
> +if (p) {
> +g_free(p->string);
> +g_free(p);
> +}
> +}
> +
>  static void test_visitor_in_struct(TestInputVisitorData *data,
> const void *unused)
>  {
> @@ -278,6 +295,8 @@ int main

[Qemu-devel] [PATCH 26/36] vmstate: fix vmstate formating for i386

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-i386/machine.c |   16 
 1 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target-i386/machine.c b/target-i386/machine.c
index 127c44f..c2a8872 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -11,7 +11,7 @@ static const VMStateDescription vmstate_segment = {
 .version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
-.fields  = (VMStateField []) {
+.fields = (VMStateField[]) {
 VMSTATE_UINT32(selector, SegmentCache),
 VMSTATE_UINTTL(base, SegmentCache),
 VMSTATE_UINT32(limit, SegmentCache),
@@ -37,7 +37,7 @@ static const VMStateDescription vmstate_xmm_reg = {
 .version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
-.fields  = (VMStateField []) {
+.fields = (VMStateField[]) {
 VMSTATE_UINT64(XMM_Q(0), XMMReg),
 VMSTATE_UINT64(XMM_Q(1), XMMReg),
 VMSTATE_END_OF_LIST()
@@ -53,7 +53,7 @@ static const VMStateDescription vmstate_ymmh_reg = {
 .version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
-.fields  = (VMStateField []) {
+.fields = (VMStateField[]) {
 VMSTATE_UINT64(XMM_Q(0), XMMReg),
 VMSTATE_UINT64(XMM_Q(1), XMMReg),
 VMSTATE_END_OF_LIST()
@@ -68,7 +68,7 @@ static const VMStateDescription vmstate_mtrr_var = {
 .version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
-.fields  = (VMStateField []) {
+.fields = (VMStateField[]) {
 VMSTATE_UINT64(base, MTRRVar),
 VMSTATE_UINT64(mask, MTRRVar),
 VMSTATE_END_OF_LIST()
@@ -284,7 +284,7 @@ static const VMStateDescription vmstate_async_pf_msr = {
 .version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
-.fields  = (VMStateField []) {
+.fields = (VMStateField []) {
 VMSTATE_UINT64(async_pf_en_msr, CPUX86State),
 VMSTATE_END_OF_LIST()
 }
@@ -302,7 +302,7 @@ static const VMStateDescription vmstate_fpop_ip_dp = {
 .version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
-.fields  = (VMStateField []) {
+.fields = (VMStateField []) {
 VMSTATE_UINT16(fpop, CPUX86State),
 VMSTATE_UINT64(fpip, CPUX86State),
 VMSTATE_UINT64(fpdp, CPUX86State),
@@ -353,7 +353,7 @@ const VMStateDescription vmstate_cpu = {
 .minimum_version_id_old = 3,
 .pre_save = cpu_pre_save,
 .post_load = cpu_post_load,
-.fields  = (VMStateField []) {
+.fields = (VMStateField []) {
 VMSTATE_UINTTL_ARRAY(regs, CPUX86State, CPU_NB_REGS),
 VMSTATE_UINTTL(eip, CPUX86State),
 VMSTATE_UINTTL(eflags, CPUX86State),
@@ -449,7 +449,7 @@ const VMStateDescription vmstate_cpu = {
 VMSTATE_END_OF_LIST()
 /* The above list is not sorted /wrt version numbers, watch out! */
 },
-.subsections = (VMStateSubsection []) {
+.subsections = (VMStateSubsection[]) {
 {
 .vmsd = &vmstate_async_pf_msr,
 .needed = async_pf_msr_needed,
-- 
1.7.7.6

Re: [Qemu-devel] [PATCH 2/2] Expose tsc deadline timer cpuid to guest

[Rik van Riel]

On 03/09/2012 01:27 PM, Liu, Jinsong wrote:


As for 'tsc deadline' feature exposing, my patch (as attached) just obey qemu 
general cpuid exposing method, and also satisfied your target I think.


One question.

Why is TSC_DEADLINE not exposed in the cpuid allowed feature
bits in do_cpuid_ent() in arch/x86/kvm/x86.c ?

/* cpuid 1.ecx */
const u32 kvm_supported_word4_x86_features =
F(XMM3) | F(PCLMULQDQ) | 0 /* DTES64, MONITOR */ |
0 /* DS-CPL, VMX, SMX, EST */ |
0 /* TM2 */ | F(SSSE3) | 0 /* CNXT-ID */ | 0 /* 
Reserved */ |

F(FMA) | F(CX16) | 0 /* xTPR Update, PDCM */ |
0 /* Reserved, DCA */ | F(XMM4_1) |
F(XMM4_2) | F(X2APIC) | F(MOVBE) | F(POPCNT) |
0 /* Reserved*/ | F(AES) | F(XSAVE) | 0 /* OSXSAVE */ | 
F(AVX) |

F(F16C) | F(RDRAND);

Would it make sense to expose F(TSC_DEADLINE) above?

Or is there something truly special about tsc deadline
that means it should be different from everything else?

--
All rights reversed

[Qemu-devel] [PATCH 2/3] qapi: remove print statements from test-qmp-commands

[Michael Roth]

This is necessary for nicer make check integration.

Signed-off-by: Michael Roth 
---
 test-qmp-commands.c |3 ---
 1 files changed, 0 insertions(+), 3 deletions(-)

diff --git a/test-qmp-commands.c b/test-qmp-commands.c
index fa5a7bd..60cbf01 100644
--- a/test-qmp-commands.c
+++ b/test-qmp-commands.c
@@ -46,7 +46,6 @@ static void test_dispatch_cmd(void)
 resp = qmp_dispatch(QOBJECT(req));
 assert(resp != NULL);
 assert(!qdict_haskey(qobject_to_qdict(resp), "error"));
-g_print("\nresp: %s\n", qstring_get_str(qobject_to_json(resp)));
 
 qobject_decref(resp);
 QDECREF(req);
@@ -63,7 +62,6 @@ static void test_dispatch_cmd_error(void)
 resp = qmp_dispatch(QOBJECT(req));
 assert(resp != NULL);
 assert(qdict_haskey(qobject_to_qdict(resp), "error"));
-g_print("\nresp: %s\n", qstring_get_str(qobject_to_json_pretty(resp)));
 
 qobject_decref(resp);
 QDECREF(req);
@@ -92,7 +90,6 @@ static void test_dispatch_cmd_io(void)
 resp = qmp_dispatch(QOBJECT(req));
 assert(resp != NULL);
 assert(!qdict_haskey(qobject_to_qdict(resp), "error"));
-g_print("\nresp: %s\n", qstring_get_str(qobject_to_json_pretty(resp)));
 
 qobject_decref(resp);
 QDECREF(req);
-- 
1.7.4.1

[Qemu-devel] [PATCH 3/3] test: add test-qmp-commands to make check

[Michael Roth]

All the deps are here but the test was never added to the list of tests
for make check

Signed-off-by: Michael Roth 
---
 tests/Makefile |1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/tests/Makefile b/tests/Makefile
index 354fdbb..94ea342 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -3,6 +3,7 @@ export SRC_PATH
 CHECKS = check-qdict check-qfloat check-qint check-qstring check-qlist
 CHECKS += check-qjson test-qmp-output-visitor test-qmp-input-visitor
 CHECKS += test-string-input-visitor test-string-output-visitor test-coroutine
+CHECKS += test-qmp-commands
 CHECKS += $(SRC_PATH)/tests/qemu-iotests-quick.sh
 
 check-qint.o check-qstring.o check-qdict.o check-qlist.o check-qfloat.o 
check-qjson.o test-coroutine.o: $(GENERATED_HEADERS)
-- 
1.7.4.1

[Qemu-devel] [PATCH 1/3] test: remove qemu-ga reference

[Michael Roth]

This was added by mistake a while back.

Signed-off-by: Michael Roth 
---
 tests/Makefile |2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/tests/Makefile b/tests/Makefile
index c78ade1..354fdbb 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -17,7 +17,7 @@ test-coroutine: test-coroutine.o qemu-timer-common.o async.o 
$(coroutine-obj-y)
 
 test-qmp-input-visitor.o test-qmp-output-visitor.o \
 test-string-input-visitor.o test-string-output-visitor.o \
-   test-qmp-commands.o qemu-ga$(EXESUF): QEMU_CFLAGS += -I $(qapi-dir)
+   test-qmp-commands.o: QEMU_CFLAGS += -I $(qapi-dir)
 
 $(qapi-dir)/test-qapi-types.c $(qapi-dir)/test-qapi-types.h :\
 $(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
-- 
1.7.4.1

[Qemu-devel] [PATCH 11/36] vmstate: introduce CPU_DoubleU arrays

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 savevm.c  |   24 
 vmstate.h |4 
 2 files changed, 28 insertions(+), 0 deletions(-)

diff --git a/savevm.c b/savevm.c
index 822f078..4c42076 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1142,6 +1142,30 @@ const VMStateInfo vmstate_info_float64 = {
 .put  = put_float64,
 };

+/* 64 bit CPUDouble */
+
+static int get_cpudouble(QEMUFile *f, void *pv, size_t size)
+{
+CPU_DoubleU *v = pv;
+
+qemu_get_be32s(f, &v->l.upper);
+qemu_get_be32s(f, &v->l.lower);
+return 0;
+}
+
+static void put_cpudouble(QEMUFile *f, void *pv, size_t size)
+{
+CPU_DoubleU *v = pv;
+qemu_put_be32s(f, &v->l.upper);
+qemu_put_be32s(f, &v->l.lower);
+}
+
+const VMStateInfo vmstate_info_cpudouble = {
+.name = "CPU_Double_U",
+.get  = get_cpudouble,
+.put  = put_cpudouble,
+};
+
 /* timers  */

 static int get_timer(QEMUFile *f, void *pv, size_t size)
diff --git a/vmstate.h b/vmstate.h
index d3fb88c..5c56f25 100644
--- a/vmstate.h
+++ b/vmstate.h
@@ -132,6 +132,7 @@ extern const VMStateInfo vmstate_info_uint64;

 extern const VMStateInfo vmstate_info_float32;
 extern const VMStateInfo vmstate_info_float64;
+extern const VMStateInfo vmstate_info_cpudouble;

 extern const VMStateInfo vmstate_info_timer;
 extern const VMStateInfo vmstate_info_buffer;
@@ -568,6 +569,9 @@ extern const VMStateDescription vmstate_cpu;
 #define VMSTATE_FLOAT64_ARRAY(_f, _s, _n) \
 VMSTATE_ARRAY(_f, _s, _n, 0, vmstate_info_float64, float64)

+#define VMSTATE_CPUDOUBLE_ARRAY(_f, _s, _n) \
+VMSTATE_ARRAY(_f, _s, _n, 0, vmstate_info_cpudouble, CPU_DoubleU)
+
 #define VMSTATE_BUFFER_V(_f, _s, _v)  \
 VMSTATE_STATIC_BUFFER(_f, _s, _v, NULL, 0, sizeof(typeof_field(_s, _f)))

-- 
1.7.7.6

[Qemu-devel] [PATCH 15/36] vmstate: define vmstate_info_uinttls

[Juan Quintela]

We are going to define arrays of this type, so we need the integer type.

Signed-off-by: Juan Quintela 
---
 hw/hw.h |2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/hw/hw.h b/hw/hw.h
index e5cb9bf..9dbac88 100644
--- a/hw/hw.h
+++ b/hw/hw.h
@@ -52,11 +52,13 @@ int qemu_boot_set(const char *boot_devices);
 VMSTATE_UINT64_V(_f, _s, _v)
 #define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)\
 VMSTATE_UINT64_ARRAY_V(_f, _s, _n, _v)
+#define vmstate_info_uinttls vmstate_info_uint64
 #else
 #define VMSTATE_UINTTL_V(_f, _s, _v)  \
 VMSTATE_UINT32_V(_f, _s, _v)
 #define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)\
 VMSTATE_UINT32_ARRAY_V(_f, _s, _n, _v)
+#define vmstate_info_uinttls vmstate_info_uint32
 #endif
 #define VMSTATE_UINTTL(_f, _s)\
 VMSTATE_UINTTL_V(_f, _s, 0)
-- 
1.7.7.6

[Qemu-devel] [PATCH 06/36] vmstate: make microblaze cpus not migrateable

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-microblaze/cpu.h |2 --
 target-microblaze/machine.c |   26 ++
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 33b23c2..c7ea041 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -294,8 +294,6 @@ enum {
 #define cpu_gen_code cpu_mb_gen_code
 #define cpu_signal_handler cpu_mb_signal_handler

-#define CPU_SAVE_VERSION 1
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _nommu
 #define MMU_MODE1_SUFFIX _kernel
diff --git a/target-microblaze/machine.c b/target-microblaze/machine.c
index 1be1c35..13abf6a 100644
--- a/target-microblaze/machine.c
+++ b/target-microblaze/machine.c
@@ -1,11 +1,21 @@
+/*
+ * Migration support for microblaze cpus
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
 #include "hw/hw.h"
-#include "hw/boards.h"

-void cpu_save(QEMUFile *f, void *opaque)
-{
-}
+/* To make this architecture migratable, we need to define cpu state
+   here.  Other things need to be done elsewhere */

-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-return 0;
-}
+const VMStateDescription vmstate_cpu = {
+.name = "cpu",
+.unmigratable = 1,
+};
-- 
1.7.7.6

[Qemu-devel] [PATCH 23/36] arm: save always 32 fpu registers

[Juan Quintela]

This way, we fix a bug (we were overwritten the 16 first registers on
load), and we don't need to check for ARM_FEATUR_VPF3, we always send
the 32 registers.

Signed-off-by: Juan Quintela 
---
 target-arm/cpu.h |2 +-
 target-arm/machine.c |   22 ++
 2 files changed, 3 insertions(+), 21 deletions(-)

diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 26c114b..a6e8c7e 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -455,7 +455,7 @@ void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
 #define cpu_signal_handler cpu_arm_signal_handler
 #define cpu_list arm_cpu_list

-#define CPU_SAVE_VERSION 6
+#define CPU_SAVE_VERSION 7

 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _kernel
diff --git a/target-arm/machine.c b/target-arm/machine.c
index f66b8df..9c0f773 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -64,7 +64,7 @@ void cpu_save(QEMUFile *f, void *opaque)
 qemu_put_be32(f, env->features);

 if (arm_feature(env, ARM_FEATURE_VFP)) {
-for (i = 0;  i < 16; i++) {
+for (i = 0;  i < 32; i++) {
 CPU_DoubleU u;
 u.d = env->vfp.regs[i];
 qemu_put_be32(f, u.l.upper);
@@ -77,15 +77,6 @@ void cpu_save(QEMUFile *f, void *opaque)
 /* TODO: Should use proper FPSCR access functions.  */
 qemu_put_be32(f, env->vfp.vec_len);
 qemu_put_be32(f, env->vfp.vec_stride);
-
-if (arm_feature(env, ARM_FEATURE_VFP3)) {
-for (i = 16;  i < 32; i++) {
-CPU_DoubleU u;
-u.d = env->vfp.regs[i];
-qemu_put_be32(f, u.l.upper);
-qemu_put_be32(f, u.l.lower);
-}
-}
 }

 if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
@@ -182,7 +173,7 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 env->features = qemu_get_be32(f);

 if (arm_feature(env, ARM_FEATURE_VFP)) {
-for (i = 0;  i < 16; i++) {
+for (i = 0;  i < 32; i++) {
 CPU_DoubleU u;
 u.l.upper = qemu_get_be32(f);
 u.l.lower = qemu_get_be32(f);
@@ -195,15 +186,6 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 /* TODO: Should use proper FPSCR access functions.  */
 env->vfp.vec_len = qemu_get_be32(f);
 env->vfp.vec_stride = qemu_get_be32(f);
-
-if (arm_feature(env, ARM_FEATURE_VFP3)) {
-for (i = 16;  i < 32; i++) {
-CPU_DoubleU u;
-u.l.upper = qemu_get_be32(f);
-u.l.lower = qemu_get_be32(f);
-env->vfp.regs[i] = u.d;
-}
-}
 }

 if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-- 
1.7.7.6

[Qemu-devel] [PATCH 02/36] vmstate: make all architectures export a way to migrate cpu's

[Juan Quintela]

This makes several changes:
- exports VMStateDescription vmstate_cpu non-static.
- makes sure that every cpu has a vmstate_cpu or cpu_save/load defined
- for the architecture that had nothing, it just register the cpu as 
unmigratable.
- Depending on CPU_SAVE_VERSION we register old/new migration style
- Add copyrights to the new files

Signed-off-by: Juan Quintela 
---
 exec.c  |2 ++
 target-alpha/machine.c  |   12 +---
 target-i386/machine.c   |2 +-
 target-lm32/machine.c   |2 +-
 target-m68k/machine.c   |   21 +
 target-s390x/machine.c  |   14 ++
 target-sh4/machine.c|   21 +
 target-xtensa/machine.c |   14 ++
 vmstate.h   |2 ++
 9 files changed, 61 insertions(+), 29 deletions(-)

diff --git a/exec.c b/exec.c
index 9389a61..c0f9c2e 100644
--- a/exec.c
+++ b/exec.c
@@ -729,6 +729,8 @@ void cpu_exec_init(CPUArchState *env)
 #if defined(CPU_SAVE_VERSION)
 register_savevm(NULL, "cpu", cpu_index, CPU_SAVE_VERSION,
 cpu_save, cpu_load, env);
+#else
+vmstate_register(NULL, cpu_index, &vmstate_cpu, env);
 #endif
 #endif
 }
diff --git a/target-alpha/machine.c b/target-alpha/machine.c
index 1c9edd1..8b3b42e 100644
--- a/target-alpha/machine.c
+++ b/target-alpha/machine.c
@@ -68,20 +68,10 @@ static VMStateField vmstate_cpu_fields[] = {
 VMSTATE_END_OF_LIST()
 };

-static const VMStateDescription vmstate_cpu = {
+const VMStateDescription vmstate_cpu = {
 .name = "cpu",
 .version_id = 1,
 .minimum_version_id = 1,
 .minimum_version_id_old = 1,
 .fields = vmstate_cpu_fields,
 };
-
-void cpu_save(QEMUFile *f, void *opaque)
-{
-vmstate_save_state(f, &vmstate_cpu, opaque);
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-return vmstate_load_state(f, &vmstate_cpu, opaque, version_id);
-}
diff --git a/target-i386/machine.c b/target-i386/machine.c
index a8be058..fc37738 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -346,7 +346,7 @@ static const VMStateDescription 
vmstate_msr_ia32_misc_enable = {
 }
 };

-static const VMStateDescription vmstate_cpu = {
+const VMStateDescription vmstate_cpu = {
 .name = "cpu",
 .version_id = CPU_SAVE_VERSION,
 .minimum_version_id = 3,
diff --git a/target-lm32/machine.c b/target-lm32/machine.c
index 6802e81..ed71bc4 100644
--- a/target-lm32/machine.c
+++ b/target-lm32/machine.c
@@ -1,7 +1,7 @@
 #include "hw/hw.h"
 #include "hw/boards.h"

-static const VMStateDescription vmstate_cpu = {
+const VMStateDescription vmstate_cpu = {
 .name = "cpu",
 .version_id = CPU_SAVE_VERSION,
 .minimum_version_id = 1,
diff --git a/target-m68k/machine.c b/target-m68k/machine.c
index e69de29..7c89d4f 100644
--- a/target-m68k/machine.c
+++ b/target-m68k/machine.c
@@ -0,0 +1,21 @@
+/*
+ * Migration support for m68k cpus
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
+#include "hw/hw.h"
+
+/* To make this architecture migratable, we need to define cpu state
+   here.  Other things need to be done elsewhere */
+
+const VMStateDescription vmstate_cpu = {
+.name = "cpu",
+.unmigratable = 1,
+};
diff --git a/target-s390x/machine.c b/target-s390x/machine.c
index 3e79be6..5a7b219 100644
--- a/target-s390x/machine.c
+++ b/target-s390x/machine.c
@@ -18,13 +18,11 @@
  */

 #include "hw/hw.h"
-#include "hw/boards.h"

-void cpu_save(QEMUFile *f, void *opaque)
-{
-}
+/* To make this architecture migratable, we need to define cpu state
+   here.  Other things need to be done elsewhere */

-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-return 0;
-}
+const VMStateDescription vmstate_cpu = {
+.name = "cpu",
+.unmigratable = 1,
+};
diff --git a/target-sh4/machine.c b/target-sh4/machine.c
index e69de29..b97355d 100644
--- a/target-sh4/machine.c
+++ b/target-sh4/machine.c
@@ -0,0 +1,21 @@
+/*
+ * Migration support for sh4 cpus
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
+#include "hw/hw.h"
+
+/* To make this architecture migratable, we need to define cpu state
+   here.  Other things need to be done elsewhere */
+
+const VMStateDescription vmstate_cpu = {
+.name = "cpu",
+.unmigratable = 1,
+};
diff --git a/target-xtensa/machine.c b/target-xtensa/machine.c
index ddeffb2..3f98330 100644
--- a/target-xtensa/machine.c
+++ b/target-xtensa/machine.c
@@ -26,13 +26,11 @@
  */

 #include "hw/hw.h"
-#include "hw/boards.h"

-void cpu_save(QEMUFile *f, void *opaque)
-{
-}
+/* To make this architecture migratable, we need to define cpu state
+   here.  Other things need to be done elsewhere */

-int cpu_load(QEMUFil

Re: [Qemu-devel] [PATCH RFC] virtio-pci: add MMIO property

[Rusty Russell]

On Mon, 19 Mar 2012 17:13:06 -0500, Anthony Liguori  
wrote:
> > Maybe just make this a hidden option like x-miio?
> 
> x-violate-the-virtio-spec-to-trick-old-linux-drivers-into-working-on-power?

"To configure the device, we use the first I/O region of the PCI
device."

Meh, it does sound a little like we are specifying that it's an PCI I/O
bar.

Let's resurrect the PCI-v2 idea, which is ready to implement now, and a
nice cleanup?  Detach it from the change-of-ring-format idea which is
turning out to be a tarpit.

Thanks,
Rusty.
-- 
  How could I marry someone with more hair than me?  http://baldalex.org

[Qemu-devel] [PATCH 22/36] vmstate: port mips cpu

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-mips/cpu.h |5 +-
 target-mips/machine.c |  465 +++--
 2 files changed, 182 insertions(+), 288 deletions(-)

diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index d2773d6..2475d32 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -37,6 +37,9 @@ struct r4k_tlb_t {
 uint_fast16_t D0:1;
 uint_fast16_t D1:1;
 target_ulong PFN[2];
+/* Fields needed as intermediate for vmstate */
+uint8_t asid_vmstate;
+uint16_t flags_vmstate;
 };

 #if !defined(CONFIG_USER_ONLY)
@@ -507,8 +510,6 @@ void mips_cpu_list (FILE *f, fprintf_function cpu_fprintf);
 #define cpu_signal_handler cpu_mips_signal_handler
 #define cpu_list mips_cpu_list

-#define CPU_SAVE_VERSION 4
-
 /* MMU modes definitions. We carefully match the indices with our
hflags layout. */
 #define MMU_MODE0_SUFFIX _kernel
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 8b9c0fb..8951748 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -3,304 +3,197 @@

 #include "cpu.h"

-static void save_tc(QEMUFile *f, TCState *tc)
-{
-int i;
-
-/* Save active TC */
-for(i = 0; i < 32; i++)
-qemu_put_betls(f, &tc->gpr[i]);
-qemu_put_betls(f, &tc->PC);
-for(i = 0; i < MIPS_DSP_ACC; i++)
-qemu_put_betls(f, &tc->HI[i]);
-for(i = 0; i < MIPS_DSP_ACC; i++)
-qemu_put_betls(f, &tc->LO[i]);
-for(i = 0; i < MIPS_DSP_ACC; i++)
-qemu_put_betls(f, &tc->ACX[i]);
-qemu_put_betls(f, &tc->DSPControl);
-qemu_put_sbe32s(f, &tc->CP0_TCStatus);
-qemu_put_sbe32s(f, &tc->CP0_TCBind);
-qemu_put_betls(f, &tc->CP0_TCHalt);
-qemu_put_betls(f, &tc->CP0_TCContext);
-qemu_put_betls(f, &tc->CP0_TCSchedule);
-qemu_put_betls(f, &tc->CP0_TCScheFBack);
-qemu_put_sbe32s(f, &tc->CP0_Debug_tcstatus);
-}
-
-static void save_fpu(QEMUFile *f, CPUMIPSFPUContext *fpu)
-{
-int i;
-
-for(i = 0; i < 32; i++)
-qemu_put_be64s(f, &fpu->fpr[i].d);
-qemu_put_s8s(f, &fpu->fp_status.float_detect_tininess);
-qemu_put_s8s(f, &fpu->fp_status.float_rounding_mode);
-qemu_put_s8s(f, &fpu->fp_status.float_exception_flags);
-qemu_put_be32s(f, &fpu->fcr0);
-qemu_put_be32s(f, &fpu->fcr31);
-}
-
-void cpu_save(QEMUFile *f, void *opaque)
-{
-CPUMIPSState *env = opaque;
-int i;
-
-/* Save active TC */
-save_tc(f, &env->active_tc);
-
-/* Save active FPU */
-save_fpu(f, &env->active_fpu);
-
-/* Save MVP */
-qemu_put_sbe32s(f, &env->mvp.CP0_MVPControl);
-qemu_put_sbe32s(f, &env->mvp.CP0_MVPConf0);
-qemu_put_sbe32s(f, &env->mvp.CP0_MVPConf1);
-
-/* Save TLB */
-qemu_put_be32s(f, &env->tlb.nb_tlb);
-qemu_put_be32s(f, &env->tlb.tlb_in_use);
-for(i = 0; i < MIPS_TLB_MAX; i++) {
-uint16_t flags = ((env->tlb.mmu.r4k.tlb[i].G << 10) |
-  (env->tlb.mmu.r4k.tlb[i].C0 << 7) |
-  (env->tlb.mmu.r4k.tlb[i].C1 << 4) |
-  (env->tlb.mmu.r4k.tlb[i].V0 << 3) |
-  (env->tlb.mmu.r4k.tlb[i].V1 << 2) |
-  (env->tlb.mmu.r4k.tlb[i].D0 << 1) |
-  (env->tlb.mmu.r4k.tlb[i].D1 << 0));
-uint8_t asid;
-
-qemu_put_betls(f, &env->tlb.mmu.r4k.tlb[i].VPN);
-qemu_put_be32s(f, &env->tlb.mmu.r4k.tlb[i].PageMask);
-asid = env->tlb.mmu.r4k.tlb[i].ASID;
-qemu_put_8s(f, &asid);
-qemu_put_be16s(f, &flags);
-qemu_put_betls(f, &env->tlb.mmu.r4k.tlb[i].PFN[0]);
-qemu_put_betls(f, &env->tlb.mmu.r4k.tlb[i].PFN[1]);
+static const VMStateDescription vmstate_tc = {
+.name = "tc",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_UINTTL_ARRAY(gpr, TCState, 32),
+VMSTATE_UINTTL(PC, TCState),
+VMSTATE_UINTTL_ARRAY(HI, TCState, MIPS_DSP_ACC),
+VMSTATE_UINTTL_ARRAY(LO, TCState, MIPS_DSP_ACC),
+VMSTATE_UINTTL_ARRAY(ACX, TCState, MIPS_DSP_ACC),
+VMSTATE_UINTTL(DSPControl, TCState),
+VMSTATE_INT32(CP0_TCStatus, TCState),
+VMSTATE_INT32(CP0_TCBind, TCState),
+VMSTATE_UINTTL(CP0_TCHalt, TCState),
+VMSTATE_UINTTL(CP0_TCContext, TCState),
+VMSTATE_UINTTL(CP0_TCSchedule, TCState),
+VMSTATE_UINTTL(CP0_TCScheFBack, TCState),
+VMSTATE_INT32(CP0_Debug_tcstatus, TCState),
+VMSTATE_END_OF_LIST()
 }
+};
+
+static const VMStateDescription vmstate_fpu_reg = {
+.name = "fpu_reg",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_UINT64(d, fpr_t),
+VMSTATE_END_OF_LIST()
+}
+};
+
+static const VMStateDescription vmstate_fpu_context = {
+.name = "fpu_context",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMSt

[Qemu-devel] [PATCH 36/36] vmstate: Add copyright info for sparc processor

[Juan Quintela]

v2: Move license to BSD-like as in vl.c
v3: Change copyright dates
v4: add QEMU contributors

Signed-off-by: Juan Quintela 
---
 target-sparc/vmstate-cpu.c |   30 ++
 1 files changed, 30 insertions(+), 0 deletions(-)

diff --git a/target-sparc/vmstate-cpu.c b/target-sparc/vmstate-cpu.c
index b599ac7..0d19e6a 100644
--- a/target-sparc/vmstate-cpu.c
+++ b/target-sparc/vmstate-cpu.c
@@ -1,3 +1,33 @@
+/*
+ * Migration support for sparc cpu
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2004-2011 Blue Swirl 
+ * Copyright (c) 2003-2012 QEMU contributors
+ * Copyright (c) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
 #include "hw/hw.h"

 static const VMStateDescription vmstate_cpu_timer = {
-- 
1.7.7.6

[Qemu-devel] [PATCH 19/36] mips: make mvp an embedded struct instead of a pointer

[Juan Quintela]

Adjust all callers.

Signed-off-by: Juan Quintela 
---
 hw/mips_malta.c  |4 ++--
 target-mips/cpu.h|4 ++--
 target-mips/machine.c|   12 ++--
 target-mips/op_helper.c  |   30 +-
 target-mips/translate.c  |6 +++---
 target-mips/translate_init.c |   14 ++
 6 files changed, 36 insertions(+), 34 deletions(-)

diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index 4752bb2..a1cdab5 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -745,8 +745,8 @@ static int64_t load_kernel (void)

 static void malta_mips_config(CPUMIPSState *env)
 {
-env->mvp->CP0_MVPConf0 |= ((smp_cpus - 1) << CP0MVPC0_PVPE) |
- ((smp_cpus * env->nr_threads - 1) << CP0MVPC0_PTC);
+env->mvp.CP0_MVPConf0 |= ((smp_cpus - 1) << CP0MVPC0_PVPE) |
+  ((smp_cpus * env->nr_threads - 1) << CP0MVPC0_PTC);
 }

 static void main_cpu_reset(void *opaque)
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 7430aa5..9450f0c 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -473,7 +473,7 @@ struct CPUMIPSState {

 CPU_COMMON

-CPUMIPSMVPContext *mvp;
+CPUMIPSMVPContext mvp;
 #if !defined(CONFIG_USER_ONLY)
 CPUMIPSTLBContext *tlb;
 #endif
@@ -675,7 +675,7 @@ static inline int mips_vpe_active(CPUMIPSState *env)
 int active = 1;

 /* Check that the VPE is enabled.  */
-if (!(env->mvp->CP0_MVPControl & (1 << CP0MVPCo_EVP))) {
+if (!(env->mvp.CP0_MVPControl & (1 << CP0MVPCo_EVP))) {
 active = 0;
 }
 /* Check that the VPE is activated.  */
diff --git a/target-mips/machine.c b/target-mips/machine.c
index 23504ba..d5d8865 100644
--- a/target-mips/machine.c
+++ b/target-mips/machine.c
@@ -52,9 +52,9 @@ void cpu_save(QEMUFile *f, void *opaque)
 save_fpu(f, &env->active_fpu);

 /* Save MVP */
-qemu_put_sbe32s(f, &env->mvp->CP0_MVPControl);
-qemu_put_sbe32s(f, &env->mvp->CP0_MVPConf0);
-qemu_put_sbe32s(f, &env->mvp->CP0_MVPConf1);
+qemu_put_sbe32s(f, &env->mvp.CP0_MVPControl);
+qemu_put_sbe32s(f, &env->mvp.CP0_MVPConf0);
+qemu_put_sbe32s(f, &env->mvp.CP0_MVPConf1);

 /* Save TLB */
 qemu_put_be32s(f, &env->tlb->nb_tlb);
@@ -203,9 +203,9 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 load_fpu(f, &env->active_fpu);

 /* Load MVP */
-qemu_get_sbe32s(f, &env->mvp->CP0_MVPControl);
-qemu_get_sbe32s(f, &env->mvp->CP0_MVPConf0);
-qemu_get_sbe32s(f, &env->mvp->CP0_MVPConf1);
+qemu_get_sbe32s(f, &env->mvp.CP0_MVPControl);
+qemu_get_sbe32s(f, &env->mvp.CP0_MVPConf0);
+qemu_get_sbe32s(f, &env->mvp.CP0_MVPConf1);

 /* Load TLB */
 qemu_get_be32s(f, &env->tlb->nb_tlb);
diff --git a/target-mips/op_helper.c b/target-mips/op_helper.c
index 3a20731..860b275 100644
--- a/target-mips/op_helper.c
+++ b/target-mips/op_helper.c
@@ -909,17 +909,17 @@ static void sync_c0_entryhi(CPUMIPSState *cpu, int tc)
 /* CP0 helpers */
 target_ulong helper_mfc0_mvpcontrol (void)
 {
-return env->mvp->CP0_MVPControl;
+return env->mvp.CP0_MVPControl;
 }

 target_ulong helper_mfc0_mvpconf0 (void)
 {
-return env->mvp->CP0_MVPConf0;
+return env->mvp.CP0_MVPConf0;
 }

 target_ulong helper_mfc0_mvpconf1 (void)
 {
-return env->mvp->CP0_MVPConf1;
+return env->mvp.CP0_MVPConf1;
 }

 target_ulong helper_mfc0_random (void)
@@ -1172,13 +1172,14 @@ void helper_mtc0_mvpcontrol (target_ulong arg1)
 if (env->CP0_VPEConf0 & (1 << CP0VPEC0_MVP))
 mask |= (1 << CP0MVPCo_CPA) | (1 << CP0MVPCo_VPC) |
 (1 << CP0MVPCo_EVP);
-if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+if (env->mvp.CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
 mask |= (1 << CP0MVPCo_STLB);
-newval = (env->mvp->CP0_MVPControl & ~mask) | (arg1 & mask);
+}
+newval = (env->mvp.CP0_MVPControl & ~mask) | (arg1 & mask);

 // TODO: Enable/disable shared TLB, enable/disable VPEs.

-env->mvp->CP0_MVPControl = newval;
+env->mvp.CP0_MVPControl = newval;
 }

 void helper_mtc0_vpecontrol (target_ulong arg1)
@@ -1266,9 +1267,10 @@ void helper_mtc0_vpeconf1 (target_ulong arg1)
 uint32_t mask = 0;
 uint32_t newval;

-if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+if (env->mvp.CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
 mask |= (0xff << CP0VPEC1_NCX) | (0xff << CP0VPEC1_NCP2) |
 (0xff << CP0VPEC1_NCP1);
+}
 newval = (env->CP0_VPEConf1 & ~mask) | (arg1 & mask);

 /* UDI not implemented. */
@@ -1325,8 +1327,9 @@ void helper_mtc0_tcbind (target_ulong arg1)
 uint32_t mask = (1 << CP0TCBd_TBE);
 uint32_t newval;

-if (env->mvp->CP0_MVPControl & (1 << CP0MVPCo_VPC))
+if (env->mvp.CP0_MVPControl & (1 << CP0MVPCo_VPC)) {
 mask |= (1 << CP0TCBd_CurVPE);
+}
 newval = (env->active_tc.CP0_TCBind & ~mask) | (arg1 & mask);
 env->active_tc.CP0_TCBind = newval;
 }
@@ -1338,8 +1341,9 @@ void helper_mttc0_tcbind (

[Qemu-devel] [PATCH 25/36] vmstate: all cpus converted

[Juan Quintela]

We don't have any more CPU_SAVEVM_VERSION users, neither
cpu_save/load() ones.

Signed-off-by: Juan Quintela 
---
 exec.c|5 -
 qemu-common.h |4 
 2 files changed, 0 insertions(+), 9 deletions(-)

diff --git a/exec.c b/exec.c
index c0f9c2e..bb6474c 100644
--- a/exec.c
+++ b/exec.c
@@ -726,13 +726,8 @@ void cpu_exec_init(CPUArchState *env)
 #endif
 #if !defined(CONFIG_USER_ONLY)
 vmstate_register(NULL, cpu_index, &vmstate_cpu_common, env);
-#if defined(CPU_SAVE_VERSION)
-register_savevm(NULL, "cpu", cpu_index, CPU_SAVE_VERSION,
-cpu_save, cpu_load, env);
-#else
 vmstate_register(NULL, cpu_index, &vmstate_cpu, env);
 #endif
-#endif
 }

 /* Allocate a new translation block. Flush the translation buffer if
diff --git a/qemu-common.h b/qemu-common.h
index c9e96a8..004b3ab 100644
--- a/qemu-common.h
+++ b/qemu-common.h
@@ -275,10 +275,6 @@ bool tcg_enabled(void);

 void cpu_exec_init_all(void);

-/* CPU save/load.  */
-void cpu_save(QEMUFile *f, void *opaque);
-int cpu_load(QEMUFile *f, void *opaque, int version_id);
-
 /* Unblock cpu */
 void qemu_cpu_kick(void *env);
 void qemu_cpu_kick_self(void);
-- 
1.7.7.6

[Qemu-devel] [PATCH 33/36] vmstate: Add copyright info for i386 processor

[Juan Quintela]

v2: Move license to BSD-like as in vl.c
Add Fabrice copyright from vl.c

Signed-off-by: Juan Quintela 
---
 target-i386/vmstate-cpu.c |   28 
 1 files changed, 28 insertions(+), 0 deletions(-)

diff --git a/target-i386/vmstate-cpu.c b/target-i386/vmstate-cpu.c
index 0ef12ac..3a321e4 100644
--- a/target-i386/vmstate-cpu.c
+++ b/target-i386/vmstate-cpu.c
@@ -1,3 +1,31 @@
+/*
+ * Migration support for x86 cpu
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
 #include "hw/hw.h"

 static const VMStateDescription vmstate_segment = {
-- 
1.7.7.6

Re: [Qemu-devel] [RFC/RFA PATCH] qapi: detect extra members inside structs

[Michael Roth]

On Mon, Mar 19, 2012 at 05:38:54PM -0500, Anthony Liguori wrote:
> On 03/19/2012 05:29 PM, Michael Roth wrote:
> >On Mon, Mar 19, 2012 at 05:43:14PM -0300, Luiz Capitulino wrote:
> >>On Mon, 19 Mar 2012 15:30:26 -0500
> >>Anthony Liguori  wrote:
> >>
> >>>On 03/19/2012 03:22 PM, Eric Blake wrote:
> On 03/19/2012 01:56 PM, Anthony Liguori wrote:
> >>For old clients that could be fine.  But what about old servers? :)
> >
> >Same applies to old server.  If a new client tries to use a new field,
> >if the old server refuses it, then the new client breaks.
> 
> I recently asked this question, and I was told that it is a feature that
> unknown fields attempted by a new client are rejected by an old server:
> https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg00815.html
> >>>
> >>>Unfortunately that's not entirely correct.
> >>>
> >>>The QMP server has a mechanism to validate that the input parameters that 
> >>>are
> >>>passed conform to the spec in qmp-commands.hx, but this spec can only 
> >>>handle
> >>>simple types.  Anywhere where we bypass this check (like we do for 
> >>>transaction),
> >>>the checking is up to the callee which doesn't check.
> >>
> >>Right.
> >>
> >There's no way in QMP to detect whether a server supports a new field.
> >This is why I proposed instituting a policy of never adding/removing
> >fields to structures and why I had advocating use a C version of libqapi
> >in terms of enforcing compatibility rules.
> >
> >I'm not sure if the "server ignores unknown" fields thing is even
> >reasonable to rely upon so maybe we should just draw a line in the sane
> >and make the change you're suggesting...
> 
> For ideal back-compat, I think you want:
> 
> On input to the server, we can add new fields, but such new fields must
> be optional (old clients that omit the fields get the default value,
> rather than a new server rejecting the command due to a missing field).
>    The question arises when you have a new client talking to an old
> server; here, I think it's better to _always_ have the server reject
> things it doesn't recognize, so that clients can use this rejection as a
> feature probe, and then you _do_ have reliable ways of querying whether
> a feature was added, by whether the new argument associated with that
> feature is present.
> >>>
> >>>The problem is that this requires transactional semantics such that if the
> >>>command fails, there are no side effects.  I don't think we're in a 
> >>>position to
> >>>guarantee that.
> >>
> >>IMHO failing with side effects is a bug. Although no command that does that 
> >>comes
> >>to my mind right now.
> >>
> >>>I'd greatly prefer to simply not add new options to existing commands.  
> >>>It's
> >>>simple, maps well to how we do things in C, and is easy to enforce.
> >>
> >>We extensively discussed this some months ago. I honestly don't want to 
> >>repeat
> >>that discussion. So, if there's consensus that adding new commands is better
> >>than extending existing ones, this is fine with me.
> >>
> >>Another solution would be to extend query-commands with arguments info, 
> >>which
> >>is something that I think we will do soon or later...
> >
> >It's doable, we could even just give them QAPI schema, which is valid
> >json and serves as our QMP command documentation anyway. I think that's a
> >complete solution, and makes thing easy on the server/qemu-side. But for a
> >client it may be somewhat of a pain.
> 
> Right, you would need to be able to fully interpret the schema which
> means recursing into each of the types to discover if a field was
> added anywhere. It's down right cruel to expect clients to do this
> IMHO.
> 
> >New field ->  new command is seems easier on the client-side in theory, but 
> >once
> >you go beyond a handful of variations and get to a point where several
> >include the desired option, you basically need to start encoding the
> >option "capability" in the command name, or using versioned commands, so
> >long term it may not scale well. It may also be difficult to ensure commands
> >with a certain name don't lose/gain fields downstream.
> 
> And this is why we should take our time designing commands
> attempting to think through the future use cases.

Well, true, I guess it's worked out for long enough that we shouldn't assume
things would get that bad any time soon.

> 
> >So IMO, returning arguments actually seems easier for both clients and the
> >server, and is more resilient to downstream changes. It does require a more
> >formal specification of the protocol though. Basically: "an option/field
> >may not be supported in older/future versions of QEMU, so it is up to
> >the client to check in advance by referencing the QAPI schema for their
> >qemu version or programatically via get_schema()"
> 
> The complexity of writing a client using get_schema() is close to staggering 
> :-/

I'm not sur

[Qemu-devel] [PATCH 16/36] vmstate: port sparc cpu

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 hw/sun4u.c |   20 --
 target-sparc/cpu.h |9 +-
 target-sparc/machine.c |  474 
 3 files changed, 283 insertions(+), 220 deletions(-)

diff --git a/hw/sun4u.c b/hw/sun4u.c
index 237e20c..c36861c 100644
--- a/hw/sun4u.c
+++ b/hw/sun4u.c
@@ -330,26 +330,6 @@ typedef struct ResetData {
 uint64_t prom_addr;
 } ResetData;

-void cpu_put_timer(QEMUFile *f, CPUTimer *s)
-{
-qemu_put_be32s(f, &s->frequency);
-qemu_put_be32s(f, &s->disabled);
-qemu_put_be64s(f, &s->disabled_mask);
-qemu_put_sbe64s(f, &s->clock_offset);
-
-qemu_put_timer(f, s->qtimer);
-}
-
-void cpu_get_timer(QEMUFile *f, CPUTimer *s)
-{
-qemu_get_be32s(f, &s->frequency);
-qemu_get_be32s(f, &s->disabled);
-qemu_get_be64s(f, &s->disabled_mask);
-qemu_get_sbe64s(f, &s->clock_offset);
-
-qemu_get_timer(f, s->qtimer);
-}
-
 static CPUTimer* cpu_timer_create(const char* name, CPUSPARCState *env,
   QEMUBHFunc *cb, uint32_t frequency,
   uint64_t disabled_mask)
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 1025752..ba9b833 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -374,10 +374,6 @@ struct CPUTimer

 typedef struct CPUTimer CPUTimer;

-struct QEMUFile;
-void cpu_put_timer(struct QEMUFile *f, CPUTimer *s);
-void cpu_get_timer(struct QEMUFile *f, CPUTimer *s);
-
 typedef struct CPUSPARCState CPUSPARCState;

 struct CPUSPARCState {
@@ -509,6 +505,9 @@ struct CPUSPARCState {

 /* Leon3 cache control */
 uint32_t cache_control;
+
+/* Fields needed as intermediate for vmstate */
+uint32_t psr_vmstate;
 };

 #ifndef NO_CPU_IO_DEFS
@@ -596,8 +595,6 @@ int cpu_sparc_signal_handler(int host_signum, void *pinfo, 
void *puc);
 #define cpu_signal_handler cpu_sparc_signal_handler
 #define cpu_list sparc_cpu_list

-#define CPU_SAVE_VERSION 7
-
 /* MMU modes definitions */
 #if defined (TARGET_SPARC64)
 #define MMU_USER_IDX   0
diff --git a/target-sparc/machine.c b/target-sparc/machine.c
index eb4d87f..801ec55 100644
--- a/target-sparc/machine.c
+++ b/target-sparc/machine.c
@@ -4,214 +4,300 @@

 #include "cpu.h"

-void cpu_save(QEMUFile *f, void *opaque)
-{
-CPUSPARCState *env = opaque;
-int i;
-uint32_t tmp;
-
-// if env->cwp == env->nwindows - 1, this will set the ins of the last
-// window as the outs of the first window
-cpu_set_cwp(env, env->cwp);
+static const VMStateDescription vmstate_cpu_timer = {
+.name = "cpu_timer",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_UINT32(frequency, CPUTimer),
+VMSTATE_UINT32(disabled, CPUTimer),
+VMSTATE_UINT64(disabled_mask, CPUTimer),
+VMSTATE_INT64(clock_offset, CPUTimer),
+VMSTATE_TIMER(qtimer, CPUTimer),
+VMSTATE_END_OF_LIST()
+}
+};

-for(i = 0; i < 8; i++)
-qemu_put_betls(f, &env->gregs[i]);
-qemu_put_be32s(f, &env->nwindows);
-for(i = 0; i < env->nwindows * 16; i++)
-qemu_put_betls(f, &env->regbase[i]);
+#define VMSTATE_CPU_TIMER(_f, _s) \
+VMSTATE_STRUCT_POINTER(_f, _s, vmstate_cpu_timer, CPUTimer *)

-/* FPU */
-for (i = 0; i < TARGET_DPREGS; i++) {
-qemu_put_be32(f, env->fpr[i].l.upper);
-qemu_put_be32(f, env->fpr[i].l.lower);
+#if defined(TARGET_SPARC64)
+static const VMStateDescription vmstate_trap_state = {
+.name = "trap_state",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_UINT64(tpc, trap_state),
+VMSTATE_UINT64(tnpc, trap_state),
+VMSTATE_UINT64(tstate, trap_state),
+VMSTATE_UINT32(tt, trap_state),
+VMSTATE_END_OF_LIST()
 }
+};

-qemu_put_betls(f, &env->pc);
-qemu_put_betls(f, &env->npc);
-qemu_put_betls(f, &env->y);
-tmp = cpu_get_psr(env);
-qemu_put_be32(f, tmp);
-qemu_put_betls(f, &env->fsr);
-qemu_put_betls(f, &env->tbr);
-tmp = env->interrupt_index;
-qemu_put_be32(f, tmp);
-qemu_put_be32s(f, &env->pil_in);
-#ifndef TARGET_SPARC64
-qemu_put_be32s(f, &env->wim);
-/* MMU */
-for (i = 0; i < 32; i++)
-qemu_put_be32s(f, &env->mmuregs[i]);
-for (i = 0; i < 4; i++) {
-qemu_put_be64s(f, &env->mxccdata[i]);
-}
-for (i = 0; i < 8; i++) {
-qemu_put_be64s(f, &env->mxccregs[i]);
-}
-qemu_put_be32s(f, &env->mmubpctrv);
-qemu_put_be32s(f, &env->mmubpctrc);
-qemu_put_be32s(f, &env->mmubpctrs);
-qemu_put_be64s(f, &env->mmubpaction);
-for (i = 0; i < 4; i++) {
-qemu_put_be64s(f, &env->mmubpregs[i]);
+static const VMStateDescription vmstate_tlb_entry = {
+.name = "tlb_entry",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMSt

[Qemu-devel] [PATCH 08/36] vmstate: machine.c is only compiled for !CONFIG_USER_ONLY

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-ppc/machine.c |8 
 1 files changed, 0 insertions(+), 8 deletions(-)

diff --git a/target-ppc/machine.c b/target-ppc/machine.c
index 70e2582..d6c2ee4 100644
--- a/target-ppc/machine.c
+++ b/target-ppc/machine.c
@@ -32,7 +32,6 @@ void cpu_save(QEMUFile *f, void *opaque)
 }
 qemu_put_be32s(f, &env->fpscr);
 qemu_put_sbe32s(f, &env->access_type);
-#if !defined(CONFIG_USER_ONLY)
 #if defined(TARGET_PPC64)
 qemu_put_betls(f, &env->asr);
 qemu_put_sbe32s(f, &env->slb_nr);
@@ -62,7 +61,6 @@ void cpu_save(QEMUFile *f, void *opaque)
 }
 for (i = 0; i < 4; i++)
 qemu_put_betls(f, &env->pb[i]);
-#endif
 for (i = 0; i < 1024; i++)
 qemu_put_betls(f, &env->spr[i]);
 qemu_put_be32s(f, &env->vscr);
@@ -72,7 +70,6 @@ void cpu_save(QEMUFile *f, void *opaque)
 qemu_put_be32s(f, &env->flags);
 qemu_put_sbe32s(f, &env->error_code);
 qemu_put_be32s(f, &env->pending_interrupts);
-#if !defined(CONFIG_USER_ONLY)
 qemu_put_be32s(f, &env->irq_input_state);
 for (i = 0; i < POWERPC_EXCP_NB; i++)
 qemu_put_betls(f, &env->excp_vectors[i]);
@@ -81,7 +78,6 @@ void cpu_save(QEMUFile *f, void *opaque)
 qemu_put_betls(f, &env->ivor_mask);
 qemu_put_betls(f, &env->ivpr_mask);
 qemu_put_betls(f, &env->hreset_vector);
-#endif
 qemu_put_betls(f, &env->nip);
 qemu_put_betls(f, &env->hflags);
 qemu_put_betls(f, &env->hflags_nmsr);
@@ -120,7 +116,6 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 }
 qemu_get_be32s(f, &env->fpscr);
 qemu_get_sbe32s(f, &env->access_type);
-#if !defined(CONFIG_USER_ONLY)
 #if defined(TARGET_PPC64)
 qemu_get_betls(f, &env->asr);
 qemu_get_sbe32s(f, &env->slb_nr);
@@ -150,7 +145,6 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 }
 for (i = 0; i < 4; i++)
 qemu_get_betls(f, &env->pb[i]);
-#endif
 for (i = 0; i < 1024; i++)
 qemu_get_betls(f, &env->spr[i]);
 ppc_store_sdr1(env, sdr1);
@@ -161,7 +155,6 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 qemu_get_be32s(f, &env->flags);
 qemu_get_sbe32s(f, &env->error_code);
 qemu_get_be32s(f, &env->pending_interrupts);
-#if !defined(CONFIG_USER_ONLY)
 qemu_get_be32s(f, &env->irq_input_state);
 for (i = 0; i < POWERPC_EXCP_NB; i++)
 qemu_get_betls(f, &env->excp_vectors[i]);
@@ -170,7 +163,6 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 qemu_get_betls(f, &env->ivor_mask);
 qemu_get_betls(f, &env->ivpr_mask);
 qemu_get_betls(f, &env->hreset_vector);
-#endif
 qemu_get_betls(f, &env->nip);
 qemu_get_betls(f, &env->hflags);
 qemu_get_betls(f, &env->hflags_nmsr);
-- 
1.7.7.6

[Qemu-devel] [PATCH 24/36] vmstate: port arm cpu

[Juan Quintela]

Use one subsection for each feature.  This means that we don't need to
bump the version field each time that a new feature gets introduced.

Introduce cpsr_vmstate field, as I am not sure if I can "use"
uncached_cpsr for saving state.

Signed-off-by: Juan Quintela 
---
 target-arm/cpu.h |5 +-
 target-arm/machine.c |  344 ++
 2 files changed, 156 insertions(+), 193 deletions(-)

diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index a6e8c7e..aafb4a7 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -233,6 +233,9 @@ typedef struct CPUARMState {
 } cp[15];
 void *nvic;
 const struct arm_boot_info *boot_info;
+
+/* Fields needed as intermediate for vmstate */
+uint32_t cpsr_vmstate;
 } CPUARMState;

 CPUARMState *cpu_arm_init(const char *cpu_model);
@@ -455,8 +458,6 @@ void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
 #define cpu_signal_handler cpu_arm_signal_handler
 #define cpu_list arm_cpu_list

-#define CPU_SAVE_VERSION 7
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _kernel
 #define MMU_MODE1_SUFFIX _user
diff --git a/target-arm/machine.c b/target-arm/machine.c
index 9c0f773..31e49ac 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -1,215 +1,177 @@
 #include "hw/hw.h"
 #include "hw/boards.h"

-void cpu_save(QEMUFile *f, void *opaque)
+static bool feature_vfp_needed(void *opaque)
 {
-int i;
-CPUARMState *env = (CPUARMState *)opaque;
+CPUARMState *env = opaque;

-for (i = 0; i < 16; i++) {
-qemu_put_be32(f, env->regs[i]);
-}
-qemu_put_be32(f, cpsr_read(env));
-qemu_put_be32(f, env->spsr);
-for (i = 0; i < 6; i++) {
-qemu_put_be32(f, env->banked_spsr[i]);
-qemu_put_be32(f, env->banked_r13[i]);
-qemu_put_be32(f, env->banked_r14[i]);
-}
-for (i = 0; i < 5; i++) {
-qemu_put_be32(f, env->usr_regs[i]);
-qemu_put_be32(f, env->fiq_regs[i]);
-}
-qemu_put_be32(f, env->cp15.c0_cpuid);
-qemu_put_be32(f, env->cp15.c0_cachetype);
-qemu_put_be32(f, env->cp15.c0_cssel);
-qemu_put_be32(f, env->cp15.c1_sys);
-qemu_put_be32(f, env->cp15.c1_coproc);
-qemu_put_be32(f, env->cp15.c1_xscaleauxcr);
-qemu_put_be32(f, env->cp15.c1_scr);
-qemu_put_be32(f, env->cp15.c2_base0);
-qemu_put_be32(f, env->cp15.c2_base1);
-qemu_put_be32(f, env->cp15.c2_control);
-qemu_put_be32(f, env->cp15.c2_mask);
-qemu_put_be32(f, env->cp15.c2_base_mask);
-qemu_put_be32(f, env->cp15.c2_data);
-qemu_put_be32(f, env->cp15.c2_insn);
-qemu_put_be32(f, env->cp15.c3);
-qemu_put_be32(f, env->cp15.c5_insn);
-qemu_put_be32(f, env->cp15.c5_data);
-for (i = 0; i < 8; i++) {
-qemu_put_be32(f, env->cp15.c6_region[i]);
-}
-qemu_put_be32(f, env->cp15.c6_insn);
-qemu_put_be32(f, env->cp15.c6_data);
-qemu_put_be32(f, env->cp15.c7_par);
-qemu_put_be32(f, env->cp15.c9_insn);
-qemu_put_be32(f, env->cp15.c9_data);
-qemu_put_be32(f, env->cp15.c9_pmcr);
-qemu_put_be32(f, env->cp15.c9_pmcnten);
-qemu_put_be32(f, env->cp15.c9_pmovsr);
-qemu_put_be32(f, env->cp15.c9_pmxevtyper);
-qemu_put_be32(f, env->cp15.c9_pmuserenr);
-qemu_put_be32(f, env->cp15.c9_pminten);
-qemu_put_be32(f, env->cp15.c13_fcse);
-qemu_put_be32(f, env->cp15.c13_context);
-qemu_put_be32(f, env->cp15.c13_tls1);
-qemu_put_be32(f, env->cp15.c13_tls2);
-qemu_put_be32(f, env->cp15.c13_tls3);
-qemu_put_be32(f, env->cp15.c15_cpar);
-qemu_put_be32(f, env->cp15.c15_power_control);
-qemu_put_be32(f, env->cp15.c15_diagnostic);
-qemu_put_be32(f, env->cp15.c15_power_diagnostic);
-
-qemu_put_be32(f, env->features);
-
-if (arm_feature(env, ARM_FEATURE_VFP)) {
-for (i = 0;  i < 32; i++) {
-CPU_DoubleU u;
-u.d = env->vfp.regs[i];
-qemu_put_be32(f, u.l.upper);
-qemu_put_be32(f, u.l.lower);
-}
-for (i = 0; i < 16; i++) {
-qemu_put_be32(f, env->vfp.xregs[i]);
-}
+return arm_feature(env, ARM_FEATURE_VFP);
+}

+static const VMStateDescription vmstate_feature_vfp = {
+.name = "feature_vfp",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.fields = (VMStateField[]) {
+VMSTATE_FLOAT64_ARRAY(vfp.regs, CPUARMState, 32),
+VMSTATE_UINT32_ARRAY(vfp.xregs, CPUARMState, 16),
 /* TODO: Should use proper FPSCR access functions.  */
-qemu_put_be32(f, env->vfp.vec_len);
-qemu_put_be32(f, env->vfp.vec_stride);
+VMSTATE_INT32(vfp.vec_len, CPUARMState),
+VMSTATE_INT32(vfp.vec_stride, CPUARMState),
+VMSTATE_END_OF_LIST()
 }
+};

-if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-for (i = 0; i < 16; i++) {
-qemu_put_be64(f, env->iwmmxt.regs[i]);
-}
-for (i = 0; i < 16; i++) {
-qemu_put_be32(f, env->iwmmxt.cregs[i]);
-}
-

[Qemu-devel] [PATCH 35/36] vmstate: Add copyright info for ppc processor

[Juan Quintela]

v2: Move license to BSD-like as in vl.c
v3: change copyright dates
v4: add Fabrice & QEMU contributors

Signed-off-by: Juan Quintela 
---
 target-ppc/vmstate-cpu.c |   30 ++
 1 files changed, 30 insertions(+), 0 deletions(-)

diff --git a/target-ppc/vmstate-cpu.c b/target-ppc/vmstate-cpu.c
index c4547df..3fa6750 100644
--- a/target-ppc/vmstate-cpu.c
+++ b/target-ppc/vmstate-cpu.c
@@ -1,3 +1,33 @@
+/*
+ * Migration support for ppc cpu
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2004-2009 Blue Swirl 
+ * Copyright (c) 2003-2012 QEMU contributors
+ * Copyright (c) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
 #include "hw/hw.h"

 static const VMStateDescription vmstate_tlb = {
-- 
1.7.7.6

[Qemu-devel] [PATCH 34/36] vmstate: Add copyright info for mips processor

[Juan Quintela]

v2: Move license to BSD-like as in vl.c

Signed-off-by: Juan Quintela 
---
 target-mips/vmstate-cpu.c |   29 +
 1 files changed, 29 insertions(+), 0 deletions(-)

diff --git a/target-mips/vmstate-cpu.c b/target-mips/vmstate-cpu.c
index bbfa2a9..1e28b3f 100644
--- a/target-mips/vmstate-cpu.c
+++ b/target-mips/vmstate-cpu.c
@@ -1,3 +1,32 @@
+/*
+ * Migration support for mips cpu
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2003-2008 Thiemo Seufer
+ * Copyright (c) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
 #include "hw/hw.h"

 static const VMStateDescription vmstate_tc = {
-- 
1.7.7.6

Re: [Qemu-devel] [PATCH 2/2] ppc: Use uintptr_t for arguments of ppc_tb_set_jmp_target

[malc]

On Mon, 19 Mar 2012, Andreas F?rber wrote:

> Am 19.03.2012 22:33, schrieb malc:
> > On Mon, 19 Mar 2012, Stefan Weil wrote:
> > 
> >> The previous commit changed function tb_set_jmp_target1 and is needed
> >> for w64 hosts.
> >>
> >> This patch is not needed for w64, but it synchronizes tb_set_jmp_target1
> >> and ppc_tb_set_jmp_target so that both functions have the same signature.

[..snip..]

> > 
> > This should become intptr_t then..
> 
> > That said ppc32 code assumes 32bit addresses, and ppc64 tcg_taget_long
> > wide ones.. IOW needs some thinking.
> 
> Hm? On both host platforms relevant here, Linux and Darwin, long and
> intptr_t should have the same width, on both ppc and ppc64, so no
> practical difference. I was about to add my Acked-by - where do you see
> issues? Or do you just see room for further code improvements elsewhere?
> 
> Andreas

There's AIX and BSDs. long and intpr_t having same width is not the 
issue, the issue is(can be/whatever) careless replacement, for instance
ppc64 defines tb_set_jmp_target in terms of tcg_out_b and it's argument
is tcg_target_long, and quoting[1]

  Elsewhere I have opinioned that the only purpose for having 
  more than one type of integer in your programming language is so that 
  programmers can pick the wrong one.

What i'm saying is - the mere fact that i have to think about the
issue at all is telling.

There's no doubt that x86_64 change is a good thing (fixes win64), here
too many types are involved already, makes me uncomfortable.

[1] http://permalink.gmane.org/gmane.comp.lang.caml.inria/36258

-- 
mailto:av1...@comtv.ru

[Qemu-devel] [PATCH 17/36] vmstate: make incompatible change for sparc

[Juan Quintela]

With this change, we sent arrays as arrays, making state description
much simpler.  The change is incompatible, but as far as I know, sparc
don't care about migration compatibility beteween versions.

Signed-off-by: Juan Quintela 
---
 target-sparc/machine.c |  172 +++-
 1 files changed, 9 insertions(+), 163 deletions(-)

diff --git a/target-sparc/machine.c b/target-sparc/machine.c
index 801ec55..818b11c 100644
--- a/target-sparc/machine.c
+++ b/target-sparc/machine.c
@@ -74,9 +74,9 @@ static int cpu_post_load(void *opaque, int version_id)

 const VMStateDescription vmstate_cpu = {
 .name = "cpu",
-.version_id = 7,
-.minimum_version_id = 7,
-.minimum_version_id_old = 7,
+.version_id = 8,
+.minimum_version_id = 8,
+.minimum_version_id_old = 8,
 .pre_save = cpu_pre_save,
 .post_load = cpu_post_load,
 .fields = (VMStateField[]) {
@@ -106,166 +106,12 @@ const VMStateDescription vmstate_cpu = {
 VMSTATE_UINT64_ARRAY(mmubpregs, CPUSPARCState, 4),
 #else
 VMSTATE_UINT64(lsu, CPUSPARCState),
-VMSTATE_UINT64(immuregs[0], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[0], CPUSPARCState),
-VMSTATE_UINT64(immuregs[1], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[1], CPUSPARCState),
-VMSTATE_UINT64(immuregs[2], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[2], CPUSPARCState),
-VMSTATE_UINT64(immuregs[3], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[3], CPUSPARCState),
-VMSTATE_UINT64(immuregs[4], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[4], CPUSPARCState),
-VMSTATE_UINT64(immuregs[5], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[5], CPUSPARCState),
-VMSTATE_UINT64(immuregs[6], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[6], CPUSPARCState),
-VMSTATE_UINT64(immuregs[7], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[7], CPUSPARCState),
-VMSTATE_UINT64(immuregs[8], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[8], CPUSPARCState),
-VMSTATE_UINT64(immuregs[9], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[9], CPUSPARCState),
-VMSTATE_UINT64(immuregs[10], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[10], CPUSPARCState),
-VMSTATE_UINT64(immuregs[11], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[11], CPUSPARCState),
-VMSTATE_UINT64(immuregs[12], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[12], CPUSPARCState),
-VMSTATE_UINT64(immuregs[13], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[13], CPUSPARCState),
-VMSTATE_UINT64(immuregs[14], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[14], CPUSPARCState),
-VMSTATE_UINT64(immuregs[15], CPUSPARCState),
-VMSTATE_UINT64(dmmuregs[15], CPUSPARCState),
-VMSTATE_STRUCT(itlb[0], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[0], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[1], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[1], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[2], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[2], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[3], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[3], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[4], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[4], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[5], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[5], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[6], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[6], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[7], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[7], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[8], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[8], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[9], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[9], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[10], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[10], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[11], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(dtlb[11], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMSTATE_STRUCT(itlb[12], CPUSPARCState, 0, vmstate_tlb_entry, 
SparcTLBEntry),
-VMS

[Qemu-devel] [PATCH 32/36] vmstate: Add copyright info for arm processor

[Juan Quintela]

Signed-off-by: Juan Quintela 
Acked-by: Andrzej Zaborowski 
---
 target-arm/vmstate-cpu.c |   15 +++
 1 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/target-arm/vmstate-cpu.c b/target-arm/vmstate-cpu.c
index f8ccdd7..65ed6eb 100644
--- a/target-arm/vmstate-cpu.c
+++ b/target-arm/vmstate-cpu.c
@@ -1,3 +1,18 @@
+/*
+ * Migration support for arm cpus
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Based on savevm serialization code by:
+ *  Andrzej Zaborowski 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
 #include "hw/hw.h"

 static bool feature_vfp_needed(void *opaque)
-- 
1.7.7.6

[Qemu-devel] [PATCH 30/36] vmstate: Add copyright info for lm32 processor

[Juan Quintela]

Signed-off-by: Juan Quintela 
Acked-By: Michael Walle 
---
 target-lm32/vmstate-cpu.c |   15 +++
 1 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/target-lm32/vmstate-cpu.c b/target-lm32/vmstate-cpu.c
index 132259d..3867189 100644
--- a/target-lm32/vmstate-cpu.c
+++ b/target-lm32/vmstate-cpu.c
@@ -1,3 +1,18 @@
+/*
+ * Migration support for lm32 cpus
+ *
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * Author(s):
+ *  Juan Quintela 
+ *
+ * Based on savevm serialization code by:
+ *  Michael Walle 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
 #include "hw/hw.h"

 const VMStateDescription vmstate_cpu = {
-- 
1.7.7.6

[Qemu-devel] [PATCH 04/36] vmstate: use new cpu style for x86

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 target-i386/cpu.h |2 --
 target-i386/machine.c |   12 +---
 2 files changed, 1 insertions(+), 13 deletions(-)

diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index a1ed3e7..b2eeb9b 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -964,8 +964,6 @@ uint64_t cpu_get_tsc(CPUX86State *env);
 #define cpu_list_id x86_cpu_list
 #define cpudef_setup   x86_cpudef_setup

-#define CPU_SAVE_VERSION 12
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _kernel
 #define MMU_MODE1_SUFFIX _user
diff --git a/target-i386/machine.c b/target-i386/machine.c
index fc37738..127c44f 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -348,7 +348,7 @@ static const VMStateDescription 
vmstate_msr_ia32_misc_enable = {

 const VMStateDescription vmstate_cpu = {
 .name = "cpu",
-.version_id = CPU_SAVE_VERSION,
+.version_id = 12,
 .minimum_version_id = 3,
 .minimum_version_id_old = 3,
 .pre_save = cpu_pre_save,
@@ -467,13 +467,3 @@ const VMStateDescription vmstate_cpu = {
 }
 }
 };
-
-void cpu_save(QEMUFile *f, void *opaque)
-{
-vmstate_save_state(f, &vmstate_cpu, opaque);
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-return vmstate_load_state(f, &vmstate_cpu, opaque, version_id);
-}
-- 
1.7.7.6

Re: [Qemu-devel] [RFC/RFA PATCH] qapi: detect extra members inside structs

[Anthony Liguori]

On 03/19/2012 05:29 PM, Michael Roth wrote:

On Mon, Mar 19, 2012 at 05:43:14PM -0300, Luiz Capitulino wrote:

On Mon, 19 Mar 2012 15:30:26 -0500
Anthony Liguori  wrote:


On 03/19/2012 03:22 PM, Eric Blake wrote:

On 03/19/2012 01:56 PM, Anthony Liguori wrote:

For old clients that could be fine.  But what about old servers? :)


Same applies to old server.  If a new client tries to use a new field,
if the old server refuses it, then the new client breaks.


I recently asked this question, and I was told that it is a feature that
unknown fields attempted by a new client are rejected by an old server:
https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg00815.html


Unfortunately that's not entirely correct.

The QMP server has a mechanism to validate that the input parameters that are
passed conform to the spec in qmp-commands.hx, but this spec can only handle
simple types.  Anywhere where we bypass this check (like we do for transaction),
the checking is up to the callee which doesn't check.


Right.


There's no way in QMP to detect whether a server supports a new field.
This is why I proposed instituting a policy of never adding/removing
fields to structures and why I had advocating use a C version of libqapi
in terms of enforcing compatibility rules.

I'm not sure if the "server ignores unknown" fields thing is even
reasonable to rely upon so maybe we should just draw a line in the sane
and make the change you're suggesting...


For ideal back-compat, I think you want:

On input to the server, we can add new fields, but such new fields must
be optional (old clients that omit the fields get the default value,
rather than a new server rejecting the command due to a missing field).
   The question arises when you have a new client talking to an old
server; here, I think it's better to _always_ have the server reject
things it doesn't recognize, so that clients can use this rejection as a
feature probe, and then you _do_ have reliable ways of querying whether
a feature was added, by whether the new argument associated with that
feature is present.


The problem is that this requires transactional semantics such that if the
command fails, there are no side effects.  I don't think we're in a position to
guarantee that.


IMHO failing with side effects is a bug. Although no command that does that 
comes
to my mind right now.


I'd greatly prefer to simply not add new options to existing commands.  It's
simple, maps well to how we do things in C, and is easy to enforce.


We extensively discussed this some months ago. I honestly don't want to repeat
that discussion. So, if there's consensus that adding new commands is better
than extending existing ones, this is fine with me.

Another solution would be to extend query-commands with arguments info, which
is something that I think we will do soon or later...


It's doable, we could even just give them QAPI schema, which is valid
json and serves as our QMP command documentation anyway. I think that's a
complete solution, and makes thing easy on the server/qemu-side. But for a
client it may be somewhat of a pain.


Right, you would need to be able to fully interpret the schema which means 
recursing into each of the types to discover if a field was added anywhere. 
It's down right cruel to expect clients to do this IMHO.



New field ->  new command is seems easier on the client-side in theory, but once
you go beyond a handful of variations and get to a point where several
include the desired option, you basically need to start encoding the
option "capability" in the command name, or using versioned commands, so
long term it may not scale well. It may also be difficult to ensure commands
with a certain name don't lose/gain fields downstream.


And this is why we should take our time designing commands attempting to think 
through the future use cases.



So IMO, returning arguments actually seems easier for both clients and the
server, and is more resilient to downstream changes. It does require a more
formal specification of the protocol though. Basically: "an option/field
may not be supported in older/future versions of QEMU, so it is up to
the client to check in advance by referencing the QAPI schema for their
qemu version or programatically via get_schema()"


The complexity of writing a client using get_schema() is close to staggering :-/

Regards,

Anthony Liguori

[Qemu-devel] help with helper functions

[João Corrêa]

Hi Guys,

I'm trying to use some helper functions to instrument translated code, but
I'm getting some segfaults while doing it. Here are some code I've placed:

target-i386/helper.h
DEF_HELPER_1(foo, void, tl)

target-i386/op_helper.c
#ifdef TARGET_X86_64

void foo(target_ulong t0){

}

target-i386/translate.c
static inline void gen_jmp_im(target_ulong pc){
#ifdef TARGET_X86_64
printf("test2\n");
gen_foo(pc);
printf("test3\n");
#endif
tcg_gen_movi_tl(cpu_tmp0, pc);
tcg_gen_st_tl(cpu_tmp0, cpu_env, offsetof(CPUState, eip));
}

What happens is that, test2 is printed but test3 is never printed, what
means that the function gen_foo(pc) never ended.

Attached to this e-mail follows the output generated with valgrind.

Any help will be very useful. Thanks in advance.
João.


valgrind_output
Description: Binary data

Re: [Qemu-devel] [RFC/RFA PATCH] qapi: detect extra members inside structs

[Michael Roth]

On Mon, Mar 19, 2012 at 05:43:14PM -0300, Luiz Capitulino wrote:
> On Mon, 19 Mar 2012 15:30:26 -0500
> Anthony Liguori  wrote:
> 
> > On 03/19/2012 03:22 PM, Eric Blake wrote:
> > > On 03/19/2012 01:56 PM, Anthony Liguori wrote:
> > >>> For old clients that could be fine.  But what about old servers? :)
> > >>
> > >> Same applies to old server.  If a new client tries to use a new field,
> > >> if the old server refuses it, then the new client breaks.
> > >
> > > I recently asked this question, and I was told that it is a feature that
> > > unknown fields attempted by a new client are rejected by an old server:
> > > https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg00815.html
> > 
> > Unfortunately that's not entirely correct.
> > 
> > The QMP server has a mechanism to validate that the input parameters that 
> > are 
> > passed conform to the spec in qmp-commands.hx, but this spec can only 
> > handle 
> > simple types.  Anywhere where we bypass this check (like we do for 
> > transaction), 
> > the checking is up to the callee which doesn't check.
> 
> Right.
> 
> > >> There's no way in QMP to detect whether a server supports a new field.
> > >> This is why I proposed instituting a policy of never adding/removing
> > >> fields to structures and why I had advocating use a C version of libqapi
> > >> in terms of enforcing compatibility rules.
> > >>
> > >> I'm not sure if the "server ignores unknown" fields thing is even
> > >> reasonable to rely upon so maybe we should just draw a line in the sane
> > >> and make the change you're suggesting...
> > >
> > > For ideal back-compat, I think you want:
> > >
> > > On input to the server, we can add new fields, but such new fields must
> > > be optional (old clients that omit the fields get the default value,
> > > rather than a new server rejecting the command due to a missing field).
> > >   The question arises when you have a new client talking to an old
> > > server; here, I think it's better to _always_ have the server reject
> > > things it doesn't recognize, so that clients can use this rejection as a
> > > feature probe, and then you _do_ have reliable ways of querying whether
> > > a feature was added, by whether the new argument associated with that
> > > feature is present.
> > 
> > The problem is that this requires transactional semantics such that if the 
> > command fails, there are no side effects.  I don't think we're in a 
> > position to 
> > guarantee that.
> 
> IMHO failing with side effects is a bug. Although no command that does that 
> comes
> to my mind right now.
> 
> > I'd greatly prefer to simply not add new options to existing commands.  
> > It's 
> > simple, maps well to how we do things in C, and is easy to enforce.
> 
> We extensively discussed this some months ago. I honestly don't want to repeat
> that discussion. So, if there's consensus that adding new commands is better
> than extending existing ones, this is fine with me.
> 
> Another solution would be to extend query-commands with arguments info, which
> is something that I think we will do soon or later...

It's doable, we could even just give them QAPI schema, which is valid
json and serves as our QMP command documentation anyway. I think that's a
complete solution, and makes thing easy on the server/qemu-side. But for a
client it may be somewhat of a pain.

New field -> new command is seems easier on the client-side in theory, but once
you go beyond a handful of variations and get to a point where several
include the desired option, you basically need to start encoding the
option "capability" in the command name, or using versioned commands, so
long term it may not scale well. It may also be difficult to ensure commands
with a certain name don't lose/gain fields downstream.

So IMO, returning arguments actually seems easier for both clients and the
server, and is more resilient to downstream changes. It does require a more
formal specification of the protocol though. Basically: "an option/field
may not be supported in older/future versions of QEMU, so it is up to
the client to check in advance by referencing the QAPI schema for their
qemu version or programatically via get_schema()"

> 

[Qemu-devel] [PATCH] Support utf8 chars in pod docs

[Michael Tokarev]

We've at least one UTF8 char in the qemu texi doc:

 $ grep Tibor qemu-doc.texi
 by Tibor "TS" Schütz.
 $ man ./qemu.1 | grep Tibor
by Tibor "TS" SchA~Xtz.

This patch allows utf8 in man/pod docs.

Initially it was split into two parts and sent on 2012-02-02.
Resending it again (3rd time) now in merged form.  If any
other generalizations of $(POD2MAN) are needed it can be done
in a separate patch.  Current form of $(POD2MAN) is choosen
to be able to easily change it if some implementation does
not support utf8 or resulting output has issues with local
man(1) program/macros.

First, add @documentencoding in scripts/texi2pod.pl:

Currently our texi2pod ignores @documentencoding even if it is set
properly in *.texi files.  This results in a mojibake in documents
generated from qemu.pod (which is generated from qemu-doc.texi by
texi2pod), because the rest of the tools assumes ASCII encoding.

This patch recognizes first @documentencoding in input and places
it at the beginning of output as =encoding directive.

Second, run pod2man with --utf8 option to enable utf8 in manpages:

This option makes no difference for manpages which contains only
ascii chars.  But for manpages with actual UTF8 characters (qemu
docs contains these), this change allows to see real characters
instead of mojibakes or substitutes.

Signed-off-By: Michael Tokarev 
---
 Makefile|9 +
 scripts/texi2pod.pl |9 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 1bc3cb0..8d6b558 100644
--- a/Makefile
+++ b/Makefile
@@ -347,28 +347,29 @@ QMP/qmp-commands.txt: $(SRC_PATH)/qmp-commands.hx
 qemu-img-cmds.texi: $(SRC_PATH)/qemu-img-cmds.hx
$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN  
 $@")
 
+POD2MAN = pod2man --utf8
 qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi
$(call quiet-command, \
  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu.pod && \
- pod2man --section=1 --center=" " --release=" " qemu.pod > $@, \
+ $(POD2MAN) --section=1 --center=" " --release=" " qemu.pod > $@, \
  "  GEN   $@")
 
 qemu-img.1: qemu-img.texi qemu-img-cmds.texi
$(call quiet-command, \
  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-img.pod && \
- pod2man --section=1 --center=" " --release=" " qemu-img.pod > $@, \
+ $(POD2MAN) --section=1 --center=" " --release=" " qemu-img.pod > $@, \
  "  GEN   $@")
 
 fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
$(call quiet-command, \
  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< 
fsdev/virtfs-proxy-helper.pod && \
- pod2man --section=1 --center=" " --release=" " 
fsdev/virtfs-proxy-helper.pod > $@, \
+ $(POD2MAN) --section=1 --center=" " --release=" " 
fsdev/virtfs-proxy-helper.pod > $@, \
  "  GEN   $@")
 
 qemu-nbd.8: qemu-nbd.texi
$(call quiet-command, \
  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-nbd.pod && \
- pod2man --section=8 --center=" " --release=" " qemu-nbd.pod > $@, \
+ $(POD2MAN) --section=8 --center=" " --release=" " qemu-nbd.pod > $@, \
  "  GEN   $@")
 
 dvi: qemu-doc.dvi qemu-tech.dvi
diff --git a/scripts/texi2pod.pl b/scripts/texi2pod.pl
index 9ed056a..94097fb 100755
--- a/scripts/texi2pod.pl
+++ b/scripts/texi2pod.pl
@@ -36,6 +36,7 @@ $fnno = 1;
 $inf = "";
 $ibase = "";
 @ipath = ();
+$encoding = undef;
 
 while ($_ = shift) {
 if (/^-D(.*)$/) {
@@ -97,6 +98,12 @@ while(<$inf>) {
 /^\@setfilename\s+([^.]+)/ and $fn = $1, next;
 /^\@settitle\s+([^.]+)/ and $tl = postprocess($1), next;
 
+# Look for document encoding
+/^\@documentencoding\s+([^.]+)/ and do {
+$encoding = $1 unless defined $encoding;
+next;
+};
+
 # Identify a man title but keep only the one we are interested in.
 /^\@c\s+man\s+title\s+([A-Za-z0-9-]+)\s+(.+)/ and do {
if (exists $defs{$1}) {
@@ -336,6 +343,8 @@ $inf = pop @instack;
 
 die "No filename or title\n" unless defined $fn && defined $tl;
 
+print "=encoding $encoding\n\n" if defined $encoding;
+
 $sects{NAME} = "$fn \- $tl\n";
 $sects{FOOTNOTES} .= "=back\n" if exists $sects{FOOTNOTES};
 
-- 
1.7.9.1

[Qemu-devel] [ANNOUNCE] kvm-kmod-3.3

[Jan Kiszka]

Kernel 3.3 is released, and so is kvm-kmod-3.3 now as well. The
package is available from

http://sourceforge.net/projects/kvm/files/kvm-kmod/3.3/kvm-kmod-3.3.tar.bz2/download

See [1] for further details on kvm-kmod.

KVM changes since kvm-kmod-3.2:
 - more MMU/MMIO speedup
 - CPU feature whitelisting (BMI1/BMI2/FMA/AVX2)
 - cleanups (e.g. the schedule PV-MMU removal)

kvm-kmod changes:
 - fixed build against 2.6.32.40+

Note that the PMU feature of KVM in 3.3 is practically not available
via kvm-kmod as it depends on kernel features only available starting
with 3.3.

Jan

[1] http://www.linux-kvm.org/page/Getting_the_kvm_kernel_modules



signature.asc
Description: OpenPGP digital signature

[Qemu-devel] [PATCHv5 03/11] rewrite iov_* functions

[Michael Tokarev]

This changes implementations of all iov_*
functions, completing the previous step.

All iov_* functions now ensure that this offset
argument is within the iovec (using assertion),
but lets to specify `bytes' value larger than
actual length of the iovec - in this case they
stops at the actual end of iovec.  It is also
suggested to use convinient `-1' value as `bytes'
to mean just this -- "up to the end".

There's one very minor semantic change here: new
requiriment is that `offset' points to inside of
iovec.  This is checked just at the end of functions
(assert()), it does not actually need to be enforced,
but using any of these functions with offset pointing
past the end of iovec is wrong anyway.

Note: the new code in iov.c uses arithmetic with
void pointers.  I thought this is not supported
everywhere and is a GCC extension (indeed, the C
standard does not define void arithmetic).  However,
the original code already use void arith in
iov_from_buf() function:
  (memcpy(..., buf + buf_off,...)
which apparently works well so far (it is this
way in qemu 1.0).  So I left it this way and used
it in other places.

While at it, add a unit-test file test-iov.c,
to check various corner cases with iov_from_buf(),
iov_to_buf() and iov_memset().

Signed-off-by: Michael Tokarev 
---
 iov.c  |   91 ++---
 iov.h  |   12 -
 test-iov.c |  153 
 tests/Makefile |6 ++-
 4 files changed, 206 insertions(+), 56 deletions(-)

diff --git a/iov.c b/iov.c
index bc58cab..9657d28 100644
--- a/iov.c
+++ b/iov.c
@@ -7,6 +7,7 @@
  * Author(s):
  *  Anthony Liguori 
  *  Amit Shah 
+ *  Michael Tokarev 
  *
  * This work is licensed under the terms of the GNU GPL, version 2.  See
  * the COPYING file in the top-level directory.
@@ -17,75 +18,61 @@
 
 #include "iov.h"
 
-size_t iov_from_buf(struct iovec *iov, unsigned int iov_cnt, size_t iov_off,
-const void *buf, size_t size)
+size_t iov_from_buf(struct iovec *iov, unsigned int iov_cnt,
+size_t offset, const void *buf, size_t bytes)
 {
-size_t iovec_off, buf_off;
+size_t done;
 unsigned int i;
-
-iovec_off = 0;
-buf_off = 0;
-for (i = 0; i < iov_cnt && size; i++) {
-if (iov_off < (iovec_off + iov[i].iov_len)) {
-size_t len = MIN((iovec_off + iov[i].iov_len) - iov_off, size);
-
-memcpy(iov[i].iov_base + (iov_off - iovec_off), buf + buf_off, 
len);
-
-buf_off += len;
-iov_off += len;
-size -= len;
+for (i = 0, done = 0; (offset || done < bytes) && i < iov_cnt; i++) {
+if (offset < iov[i].iov_len) {
+size_t len = MIN(iov[i].iov_len - offset, bytes - done);
+memcpy(iov[i].iov_base + offset, buf + done, len);
+done += len;
+offset = 0;
+} else {
+offset -= iov[i].iov_len;
 }
-iovec_off += iov[i].iov_len;
 }
-return buf_off;
+assert(offset == 0);
+return done;
 }
 
-size_t iov_to_buf(const struct iovec *iov, const unsigned int iov_cnt, size_t 
iov_off,
-  void *buf, size_t size)
+size_t iov_to_buf(const struct iovec *iov, const unsigned int iov_cnt,
+  size_t offset, void *buf, size_t bytes)
 {
-uint8_t *ptr;
-size_t iovec_off, buf_off;
+size_t done;
 unsigned int i;
-
-ptr = buf;
-iovec_off = 0;
-buf_off = 0;
-for (i = 0; i < iov_cnt && size; i++) {
-if (iov_off < (iovec_off + iov[i].iov_len)) {
-size_t len = MIN((iovec_off + iov[i].iov_len) - iov_off , size);
-
-memcpy(ptr + buf_off, iov[i].iov_base + (iov_off - iovec_off), 
len);
-
-buf_off += len;
-iov_off += len;
-size -= len;
+for (i = 0, done = 0; (offset || done < bytes) && i < iov_cnt; i++) {
+if (offset < iov[i].iov_len) {
+size_t len = MIN(iov[i].iov_len - offset, bytes - done);
+memcpy(buf + done, iov[i].iov_base + offset, len);
+done += len;
+offset = 0;
+} else {
+offset -= iov[i].iov_len;
 }
-iovec_off += iov[i].iov_len;
 }
-return buf_off;
+assert(offset == 0);
+return done;
 }
 
 size_t iov_memset(const struct iovec *iov, const unsigned int iov_cnt,
- size_t iov_off, int fillc, size_t size)
+  size_t offset, int fillc, size_t bytes)
 {
-size_t iovec_off, buf_off;
+size_t done;
 unsigned int i;
-
-iovec_off = 0;
-buf_off = 0;
-for (i = 0; i < iov_cnt && size; i++) {
-if (iov_off < (iovec_off + iov[i].iov_len)) {
-size_t len = MIN((iovec_off + iov[i].iov_len) - iov_off , size);
-
-memset(iov[i].iov_base + (iov_off - iovec_off), fillc, len);
-
-buf_off += len;
-iov_off += len;
-size -= len;
+for (i = 0, done = 0; (o

Re: [Qemu-devel] [PATCH 2/6] arm: move saturating arithmetic to helper.c

[Peter Maydell]

On 19 March 2012 21:56, Blue Swirl  wrote:
> +#define SIGNBIT (uint32_t)0x8000
> +#define SIGNBIT64 ((uint64_t)1 << 63)

SIGNBIT64 isn't used, I think.

-- PMM

Re: [Qemu-devel] [PATCH RFC] virtio-pci: add MMIO property

[Anthony Liguori]

On 03/19/2012 04:29 PM, Michael S. Tsirkin wrote:

On Mon, Mar 19, 2012 at 04:07:45PM -0500, Anthony Liguori wrote:

On 03/19/2012 03:49 PM, Michael S. Tsirkin wrote:

On Mon, Mar 19, 2012 at 02:19:33PM -0500, Anthony Liguori wrote:

On 03/19/2012 10:56 AM, Michael S. Tsirkin wrote:

Currently virtio-pci is specified so that configuration of the device is
done through a PCI IO space (via BAR 0 of the virtual PCI device).
However, Linux guests happen to use ioread/iowrite/iomap primitives
for access, and these work uniformly across memory/io BARs.

While PCI IO accesses are faster than MMIO on x86 kvm,
MMIO might be helpful on other systems which don't
implement PIO or where PIO is slower than MMIO.

Add a property to make it possible to tweak the BAR type.

Signed-off-by: Michael S. Tsirkin

This is harmless by default but causes segfaults in memory.c
when enabled. Thus an RFC until I figure out what's wrong.


Doesn't this violate the virtio-pci spec?



The point is to change the BAR type depending on the architecture.
IO is fastest on x86 but maybe not on other architectures.


Are we going to document that the BAR is X on architecture Y in the spec?

I think the better way to do this is to use a separate device id
range for MMIO virtio-pci.  You can make the same driver hand both
ranges and that way the device is presented consistently to the
guest regardless of what the architecture is.


Maybe just make this a hidden option like x-miio?


x-violate-the-virtio-spec-to-trick-old-linux-drivers-into-working-on-power?

Really, aren't we just being too clever here?  From a practical perspective, I 
doubt anyone is ever going to support a driver that has *never* been tested on 
the platform just because it was accidentally compiled and happens to be there.


If we just do use a device PCI device id range for this, it's a 1-line patch 
that can be provided via an update to existing guests.


Regards,

Anthony Liguori


This will ensure people dont turn it on by mistake on e.g. x86.


Making the same vendor/device ID have different semantics depending
on a magic flag in QEMU seems like a pretty bad idea to me.

Regards,

Anthony Liguori


We do this with MSI-X so why not the BAR type?


We extend the bar size with MSI-X and use a transport flag to
indicate that it's available, right?

Regards,

Anthony LIguori





---
  hw/virtio-pci.c |   16 ++--
  hw/virtio-pci.h |4 
  2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/hw/virtio-pci.c b/hw/virtio-pci.c
index 28498ec..6f338d2 100644
--- a/hw/virtio-pci.c
+++ b/hw/virtio-pci.c
@@ -655,6 +655,7 @@ void virtio_init_pci(VirtIOPCIProxy *proxy, VirtIODevice 
*vdev)
  {
  uint8_t *config;
  uint32_t size;
+uint8_t bar0_type;

  proxy->vdev = vdev;

@@ -684,8 +685,14 @@ void virtio_init_pci(VirtIOPCIProxy *proxy, VirtIODevice 
*vdev)

  memory_region_init_io(&proxy->bar,&virtio_pci_config_ops, proxy,
"virtio-pci", size);
-pci_register_bar(&proxy->pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO,
-&proxy->bar);
+
+if (proxy->flags&VIRTIO_PCI_FLAG_USE_MMIO) {
+bar0_type = PCI_BASE_ADDRESS_SPACE_MEMORY;
+} else {
+bar0_type = PCI_BASE_ADDRESS_SPACE_IO;
+}
+
+pci_register_bar(&proxy->pci_dev, 0, bar0_type,&proxy->bar);

  if (!kvm_has_many_ioeventfds()) {
  proxy->flags&= ~VIRTIO_PCI_FLAG_USE_IOEVENTFD;
@@ -823,6 +830,7 @@ static Property virtio_blk_properties[] = {
  DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags, 
VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
  DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
  DEFINE_VIRTIO_BLK_FEATURES(VirtIOPCIProxy, host_features),
+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
  DEFINE_PROP_END_OF_LIST(),
  };

@@ -856,6 +864,7 @@ static Property virtio_net_properties[] = {
  DEFINE_PROP_UINT32("x-txtimer", VirtIOPCIProxy, net.txtimer, 
TX_TIMER_INTERVAL),
  DEFINE_PROP_INT32("x-txburst", VirtIOPCIProxy, net.txburst, TX_BURST),
  DEFINE_PROP_STRING("tx", VirtIOPCIProxy, net.tx),
+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
  DEFINE_PROP_END_OF_LIST(),
  };

@@ -888,6 +897,7 @@ static Property virtio_serial_properties[] = {
  DEFINE_PROP_HEX32("class", VirtIOPCIProxy, class_code, 0),
  DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
  DEFINE_PROP_UINT32("max_ports", VirtIOPCIProxy, 
serial.max_virtserial_ports, 31),
+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
  DEFINE_PROP_END_OF_LIST(),
  };

@@ -915,6 +925,7 @@ static TypeInfo virtio_serial_info = {

  static Property virtio_balloon_properties[] = {
  DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
  DEFINE_PROP_END_OF_LIST(),
  };

@@ -969

Re: [Qemu-devel] [PATCH 1/6] arm: move neon_tbl to neon_helper.c

[Peter Maydell]

On 19 March 2012 21:56, Blue Swirl  wrote:
> -DEF_HELPER_4(neon_tbl, i32, i32, i32, i32, i32)
> +DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)

> --- a/target-arm/translate.c
> +++ b/target-arm/translate.c
> @@ -6340,7 +6340,7 @@ static int disas_neon_data_insn(CPUARMState *
> env, DisasContext *s, uint32_t ins
>                 tmp2 = neon_load_reg(rm, 0);
>                 tmp4 = tcg_const_i32(rn);
>                 tmp5 = tcg_const_i32(n);
> -                gen_helper_neon_tbl(tmp2, tmp2, tmp, tmp4, tmp5);
> +                gen_helper_neon_tbl(cpu_env, tmp2, tmp2, tmp, tmp4, tmp5);
>                 tcg_temp_free_i32(tmp);
>                 if (insn & (1 << 6)) {
>                     tmp = neon_load_reg(rd, 1);
> @@ -6349,7 +6349,7 @@ static int disas_neon_data_insn(CPUARMState *
> env, DisasContext *s, uint32_t ins
>                     tcg_gen_movi_i32(tmp, 0);
>                 }
>                 tmp3 = neon_load_reg(rm, 1);
> -                gen_helper_neon_tbl(tmp3, tmp3, tmp, tmp4, tmp5);
> +                gen_helper_neon_tbl(cpu_env, tmp3, tmp3, tmp, tmp4, tmp5);
>                 tcg_temp_free_i32(tmp5);
>                 tcg_temp_free_i32(tmp4);
>                 neon_store_reg(rd, 0, tmp2);

...shouldn't these be
 gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);

?

-- PMM

[Qemu-devel] [PATCHv5 09/11] export iov_send_recv() and use it in iov_send() and iov_recv()

[Michael Tokarev]

Rename do_sendv_recvv() to iov_send_recv(), change its last arg
(do_send) from int to bool, export it in iov.h, and made the two
callers of it (iov_send() and iov_recv()) to be trivial #defines
just adding 5th arg.

iov_send_recv() will be used later.

Signed-off-by: Michael Tokarev 
---
 cutils.c |   17 +++--
 iov.h|   10 +++---
 2 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/cutils.c b/cutils.c
index 2ad5fa3..cb6f638 100644
--- a/cutils.c
+++ b/cutils.c
@@ -376,9 +376,9 @@ int qemu_parse_fd(const char *param)
 return fd;
 }
 
-static ssize_t do_sendv_recvv(int sockfd, struct iovec *iov,
-  size_t offset, size_t bytes,
-  int do_sendv)
+ssize_t iov_send_recv(int sockfd, struct iovec *iov,
+  size_t offset, size_t bytes,
+  bool do_sendv)
 {
 int iovlen;
 ssize_t ret;
@@ -458,14 +458,3 @@ static ssize_t do_sendv_recvv(int sockfd, struct iovec 
*iov,
 last_iov->iov_len += diff;
 return ret;
 }
-
-ssize_t iov_recv(int sockfd, struct iovec *iov, size_t offset, size_t bytes)
-{
-return do_sendv_recvv(sockfd, iov, offset, bytes, 0);
-}
-
-ssize_t iov_send(int sockfd, struct iovec *iov, size_t offset, size_t bytes)
-{
-return do_sendv_recvv(sockfd, iov, offset, bytes, 1);
-}
-
diff --git a/iov.h b/iov.h
index 5aa2f45..9b6a883 100644
--- a/iov.h
+++ b/iov.h
@@ -60,7 +60,7 @@ size_t iov_memset(const struct iovec *iov, const unsigned int 
iov_cnt,
  * `offset' bytes in the beginning of iovec buffer are skipped and
  * next `bytes' bytes are used, which must be within data of iovec.
  *
- *   r = iov_send(sockfd, iov, offset, bytes);
+ *   r = iov_send_recv(sockfd, iov, offset, bytes, true);
  *
  * is logically equivalent to
  *
@@ -69,8 +69,12 @@ size_t iov_memset(const struct iovec *iov, const unsigned 
int iov_cnt,
  *   r = send(sockfd, buf, bytes, 0);
  *   free(buf);
  */
-ssize_t iov_recv(int sockfd, struct iovec *iov, size_t offset, size_t bytes);
-ssize_t iov_send(int sockfd, struct iovec *iov, size_t offset, size_t bytes);
+ssize_t iov_send_recv(int sockfd, struct iovec *iov,
+  size_t offset, size_t bytes, bool do_send);
+#define iov_recv(sockfd, iov, offset, bytes) \
+  iov_send_recv(sockfd, iov, offset, bytes, false)
+#define iov_send(sockfd, iov, offset, bytes) \
+  iov_send_recv(sockfd, iov, offset, bytes, true)
 
 /**
  * Produce a text hexdump of iovec `iov' with `iov_cnt' number of elements
-- 
1.7.9.1

[Qemu-devel] [PATCHv5 04/11] consolidate qemu_iovec_memset{, _skip}() into single function and use existing iov_memset()

[Michael Tokarev]

This patch combines two functions into one, and replaces
the implementation with already existing iov_memset() from
iov.c.

The new prototype of qemu_iovec_memset():
  size_t qemu_iovec_memset(qiov, size_t offset, int fillc, size_t bytes)
It is different from former qemu_iovec_memset_skip(), and
I want to make other functions to be consistent with it
too: first how much to skip, second what, and 3rd how many
of it.  It also returns actual number of bytes filled in,
which may be less than the requested `bytes' if qiov is
smaller than offset+bytes, in the same way iov_memset()
does.

While at it, use utility function iov_memset() from
iov.h in posix-aio-compat.c, where qiov was used.

Signed-off-by: Michael Tokarev 
---
 block/qcow2.c  |4 ++--
 block/qed.c|4 ++--
 cutils.c   |   44 
 linux-aio.c|4 ++--
 posix-aio-compat.c |8 +++-
 qemu-common.h  |5 ++---
 6 files changed, 15 insertions(+), 54 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index 7aece65..941a6a9 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -407,7 +407,7 @@ int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector 
*qiov,
 else
 n1 = bs->total_sectors - sector_num;
 
-qemu_iovec_memset_skip(qiov, 0, 512 * (nb_sectors - n1), 512 * n1);
+qemu_iovec_memset(qiov, 512 * n1, 0, 512 * (nb_sectors - n1));
 
 return n1;
 }
@@ -467,7 +467,7 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState 
*bs, int64_t sector_num,
 }
 } else {
 /* Note: in this case, no need to wait */
-qemu_iovec_memset(&hd_qiov, 0, 512 * cur_nr_sectors);
+qemu_iovec_memset(&hd_qiov, 0, 0, 512 * cur_nr_sectors);
 }
 } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
 /* add AIO support for compressed blocks ? */
diff --git a/block/qed.c b/block/qed.c
index a041d31..6f9325b 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -738,7 +738,7 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t 
pos,
 /* Zero all sectors if reading beyond the end of the backing file */
 if (pos >= backing_length ||
 pos + qiov->size > backing_length) {
-qemu_iovec_memset(qiov, 0, qiov->size);
+qemu_iovec_memset(qiov, 0, 0, qiov->size);
 }
 
 /* Complete now if there are no backing file sectors to read */
@@ -1253,7 +1253,7 @@ static void qed_aio_read_data(void *opaque, int ret,
 
 /* Handle zero cluster and backing file reads */
 if (ret == QED_CLUSTER_ZERO) {
-qemu_iovec_memset(&acb->cur_qiov, 0, acb->cur_qiov.size);
+qemu_iovec_memset(&acb->cur_qiov, 0, 0, acb->cur_qiov.size);
 qed_aio_next_io(acb, 0);
 return;
 } else if (ret != QED_CLUSTER_FOUND) {
diff --git a/cutils.c b/cutils.c
index af308cd..0ddf4c7 100644
--- a/cutils.c
+++ b/cutils.c
@@ -26,6 +26,7 @@
 #include 
 
 #include "qemu_socket.h"
+#include "iov.h"
 
 void pstrcpy(char *buf, int buf_size, const char *str)
 {
@@ -260,47 +261,10 @@ void qemu_iovec_from_buffer(QEMUIOVector *qiov, const 
void *buf, size_t count)
 }
 }
 
-void qemu_iovec_memset(QEMUIOVector *qiov, int c, size_t count)
+size_t qemu_iovec_memset(QEMUIOVector *qiov, size_t offset,
+ int fillc, size_t bytes)
 {
-size_t n;
-int i;
-
-for (i = 0; i < qiov->niov && count; ++i) {
-n = MIN(count, qiov->iov[i].iov_len);
-memset(qiov->iov[i].iov_base, c, n);
-count -= n;
-}
-}
-
-void qemu_iovec_memset_skip(QEMUIOVector *qiov, int c, size_t count,
-size_t skip)
-{
-int i;
-size_t done;
-void *iov_base;
-uint64_t iov_len;
-
-done = 0;
-for (i = 0; (i < qiov->niov) && (done != count); i++) {
-if (skip >= qiov->iov[i].iov_len) {
-/* Skip the whole iov */
-skip -= qiov->iov[i].iov_len;
-continue;
-} else {
-/* Skip only part (or nothing) of the iov */
-iov_base = (uint8_t*) qiov->iov[i].iov_base + skip;
-iov_len = qiov->iov[i].iov_len - skip;
-skip = 0;
-}
-
-if (done + iov_len > count) {
-memset(iov_base, c, count - done);
-break;
-} else {
-memset(iov_base, c, iov_len);
-}
-done += iov_len;
-}
+return iov_memset(qiov->iov, qiov->niov, offset, fillc, bytes);
 }
 
 /*
diff --git a/linux-aio.c b/linux-aio.c
index d2fc2e7..5a46c13 100644
--- a/linux-aio.c
+++ b/linux-aio.c
@@ -64,8 +64,8 @@ static void qemu_laio_process_completion(struct 
qemu_laio_state *s,
 } else if (ret >= 0) {
 /* Short reads mean EOF, pad with zeros. */
 if (laiocb->is_read) {
-qemu_iovec_memset_skip(laiocb->qiov, 0,
-laiocb->qiov->size - ret, ret);
+qemu_iovec_memset(laiocb->qiov, ret, 0,
+

[Qemu-devel] [PATCHv5 07/11] change qemu_iovec_to_buf() to match other to, from_buf functions

[Michael Tokarev]

It now allows specifying offset within qiov to start from and
amount of bytes to copy.  Actual implementation is just a call
to iov_to_buf().

Signed-off-by: Michael Tokarev 
---
 block.c   |2 +-
 block/iscsi.c |2 +-
 block/qcow.c  |2 +-
 block/qcow2.c |2 +-
 block/rbd.c   |2 +-
 block/vdi.c   |2 +-
 cutils.c  |   11 +++
 qemu-common.h |3 ++-
 8 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/block.c b/block.c
index 6e689af..9675b27 100644
--- a/block.c
+++ b/block.c
@@ -3270,7 +3270,7 @@ static BlockDriverAIOCB 
*bdrv_aio_rw_vector(BlockDriverState *bs,
 acb->bh = qemu_bh_new(bdrv_aio_bh_cb, acb);
 
 if (is_write) {
-qemu_iovec_to_buffer(acb->qiov, acb->bounce);
+qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
 acb->ret = bs->drv->bdrv_write(bs, sector_num, acb->bounce, 
nb_sectors);
 } else {
 acb->ret = bs->drv->bdrv_read(bs, sector_num, acb->bounce, nb_sectors);
diff --git a/block/iscsi.c b/block/iscsi.c
index bd3ca11..db589f5 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -223,7 +223,7 @@ iscsi_aio_writev(BlockDriverState *bs, int64_t sector_num,
 /* this will allow us to get rid of 'buf' completely */
 size = nb_sectors * BDRV_SECTOR_SIZE;
 acb->buf = g_malloc(size);
-qemu_iovec_to_buffer(acb->qiov, acb->buf);
+qemu_iovec_to_buf(acb->qiov, 0, acb->buf, size);
 acb->task = iscsi_write10_task(iscsi, iscsilun->lun, acb->buf, size,
   sector_qemu2lun(sector_num, iscsilun),
   fua, 0, iscsilun->block_size,
diff --git a/block/qcow.c b/block/qcow.c
index 562a19c..a367459 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -569,7 +569,7 @@ static coroutine_fn int qcow_co_writev(BlockDriverState 
*bs, int64_t sector_num,
 
 if (qiov->niov > 1) {
 buf = orig_buf = qemu_blockalign(bs, qiov->size);
-qemu_iovec_to_buffer(qiov, buf);
+qemu_iovec_to_buf(qiov, 0, buf, qiov->size);
 } else {
 orig_buf = NULL;
 buf = (uint8_t *)qiov->iov->iov_base;
diff --git a/block/qcow2.c b/block/qcow2.c
index 47940fd..a9569b1 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -609,7 +609,7 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState 
*bs,
 
 assert(hd_qiov.size <=
QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
-qemu_iovec_to_buffer(&hd_qiov, cluster_data);
+qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
 
 qcow2_encrypt_sectors(s, sector_num, cluster_data,
 cluster_data, cur_nr_sectors, 1, &s->aes_encrypt_key);
diff --git a/block/rbd.c b/block/rbd.c
index 46a8579..0191f86 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -644,7 +644,7 @@ static BlockDriverAIOCB *rbd_aio_rw_vector(BlockDriverState 
*bs,
 acb->bh = NULL;
 
 if (write) {
-qemu_iovec_to_buffer(acb->qiov, acb->bounce);
+qemu_iovec_to_buffer(acb->qiov, 0, acb->bounce, qiov->size);
 }
 
 buf = acb->bounce;
diff --git a/block/vdi.c b/block/vdi.c
index 24f4027..30a5e27 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -524,7 +524,7 @@ static VdiAIOCB *vdi_aio_setup(BlockDriverState *bs, 
int64_t sector_num,
 acb->buf = qemu_blockalign(bs, qiov->size);
 acb->orig_buf = acb->buf;
 if (is_write) {
-qemu_iovec_to_buffer(qiov, acb->buf);
+qemu_iovec_to_buf(qiov, 0, acb->buf, qiov->size);
 }
 } else {
 acb->buf = (uint8_t *)qiov->iov->iov_base;
diff --git a/cutils.c b/cutils.c
index 1aeac15..352bc52 100644
--- a/cutils.c
+++ b/cutils.c
@@ -220,15 +220,10 @@ void qemu_iovec_reset(QEMUIOVector *qiov)
 qiov->size = 0;
 }
 
-void qemu_iovec_to_buffer(QEMUIOVector *qiov, void *buf)
+size_t qemu_iovec_to_buf(QEMUIOVector *qiov, size_t offset,
+ void *buf, size_t bytes)
 {
-uint8_t *p = (uint8_t *)buf;
-int i;
-
-for (i = 0; i < qiov->niov; ++i) {
-memcpy(p, qiov->iov[i].iov_base, qiov->iov[i].iov_len);
-p += qiov->iov[i].iov_len;
-}
+return iov_to_buf(qiov->iov, qiov->niov, offset, buf, bytes);
 }
 
 size_t qemu_iovec_from_buf(QEMUIOVector *qiov, size_t offset,
diff --git a/qemu-common.h b/qemu-common.h
index 7208381..547f2a0 100644
--- a/qemu-common.h
+++ b/qemu-common.h
@@ -341,7 +341,8 @@ void qemu_iovec_concat(QEMUIOVector *dst,
QEMUIOVector *src, size_t soffset, size_t sbytes);
 void qemu_iovec_destroy(QEMUIOVector *qiov);
 void qemu_iovec_reset(QEMUIOVector *qiov);
-void qemu_iovec_to_buffer(QEMUIOVector *qiov, void *buf);
+size_t qemu_iovec_to_buf(QEMUIOVector *qiov, size_t offset,
+ void *buf, size_t bytes);
 size_t qemu_iovec_from_buf(QEMUIOVector *qiov, size_t offset,
const void *buf, size_t bytes);
 size_t qemu_iovec_memset(QEMUIOVector *qiov, size_t offset,
-- 
1.7.9.1

[Qemu-devel] [PATCH 6/6] arm: move load and store helpers, switch to AREG0 free mode

[Blue Swirl]

Add an explicit CPUARMState parameter instead of relying on AREG0
and move load and store helpers to helper.c. Remove AREG0 swapping in
tlb_fill(). Remove now empty op_helper.c.

Switch to AREG0 free mode. Use cpu_ld{l,uw}_code in translation
and interrupt handling.

Signed-off-by: Blue Swirl 
---
 Makefile.target|4 +-
 configure  |2 +-
 target-arm/helper.c|   54 +---
 target-arm/op_helper.c |   71 
 target-arm/translate.c |6 ++--
 5 files changed, 56 insertions(+), 81 deletions(-)
 delete mode 100644 target-arm/op_helper.c

diff --git a/Makefile.target b/Makefile.target
index 37fb7ed..971b7eb 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -80,7 +80,7 @@ libobj-y = exec.o translate-all.o cpu-exec.o translate.o
 libobj-y += tcg/tcg.o tcg/optimize.o
 libobj-$(CONFIG_TCG_INTERPRETER) += tci.o
 libobj-y += fpu/softfloat.o
-ifneq ($(TARGET_BASE_ARCH), sparc)
+ifndef CONFIG_TCG_PASS_AREG0
 libobj-y += op_helper.o
 endif
 libobj-y += helper.o
@@ -106,7 +106,7 @@ $(libobj-y): $(GENERATED_HEADERS)

 # HELPER_CFLAGS is used for all the legacy code compiled with static register
 # variables
-ifneq ($(TARGET_BASE_ARCH), sparc)
+ifndef CONFIG_TCG_PASS_AREG0
 op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
 endif
 user-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
diff --git a/configure b/configure
index 8b4e3c1..fe84d61 100755
--- a/configure
+++ b/configure
@@ -3608,7 +3608,7 @@ case "$target_arch2" in
 esac

 case "$target_arch2" in
-  sparc*)
+  sparc*|arm*)
 echo "CONFIG_TCG_PASS_AREG0=y" >> $config_target_mak
   ;;
 esac
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 075e8fa..fee1e82 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -7,6 +7,26 @@
 #endif
 #include "sysemu.h"

+#if !defined(CONFIG_USER_ONLY)
+
+#include "softmmu_exec.h"
+
+#define MMUSUFFIX _mmu
+
+#define SHIFT 0
+#include "softmmu_template.h"
+
+#define SHIFT 1
+#include "softmmu_template.h"
+
+#define SHIFT 2
+#include "softmmu_template.h"
+
+#define SHIFT 3
+#include "softmmu_template.h"
+
+#endif
+
 #define SIGNBIT (uint32_t)0x8000
 #define SIGNBIT64 ((uint64_t)1 << 63)

@@ -1002,7 +1022,7 @@ static void do_interrupt_v7m(CPUARMState *env)
 case EXCP_BKPT:
 if (semihosting_enabled) {
 int nr;
-nr = lduw_code(env->regs[15]) & 0xff;
+nr = cpu_lduw_code(env, env->regs[15]) & 0xff;
 if (nr == 0xab) {
 env->regs[15] += 2;
 env->regs[0] = do_arm_semihosting(env);
@@ -1074,9 +1094,9 @@ void do_interrupt(CPUARMState *env)
 if (semihosting_enabled) {
 /* Check for semihosting interrupt.  */
 if (env->thumb) {
-mask = lduw_code(env->regs[15] - 2) & 0xff;
+mask = cpu_lduw_code(env, env->regs[15] - 2) & 0xff;
 } else {
-mask = ldl_code(env->regs[15] - 4) & 0xff;
+mask = cpu_ldl_code(env, env->regs[15] - 4) & 0xff;
 }
 /* Only intercept calls from privileged modes, to provide some
semblance of security.  */
@@ -1096,7 +1116,7 @@ void do_interrupt(CPUARMState *env)
 case EXCP_BKPT:
 /* See if this is a semihosting syscall.  */
 if (env->thumb && semihosting_enabled) {
-mask = lduw_code(env->regs[15]) & 0xff;
+mask = cpu_lduw_code(env, env->regs[15]) & 0xff;
 if (mask == 0xab
   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 env->regs[15] += 2;
@@ -1543,6 +1563,32 @@ int cpu_arm_handle_mmu_fault (CPUARMState *env,
target_ulong address,
 return 1;
 }

+/* try to fill the TLB and return an exception if error. If retaddr is
+   NULL, it means that the function was called in C code (i.e. not
+   from generated code or from helper.c) */
+void tlb_fill(CPUARMState *env, target_ulong addr, int is_write, int mmu_idx,
+  void *retaddr)
+{
+TranslationBlock *tb;
+unsigned long pc;
+int ret;
+
+ret = cpu_arm_handle_mmu_fault(env, addr, is_write, mmu_idx);
+if (unlikely(ret)) {
+if (retaddr) {
+/* now we have a real cpu fault */
+pc = (unsigned long)retaddr;
+tb = tb_find_pc(pc);
+if (tb) {
+/* the PC is inside the translated code. It means that we have
+   a virtual CPU fault */
+cpu_restore_state(tb, env, pc);
+}
+}
+helper_exception(env, env->exception_index);
+}
+}
+
 target_phys_addr_t cpu_get_phys_page_debug(CPUARMState *env, target_ulong addr)
 {
 uint32_t phys_addr;
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
deleted file mode 100644
index f1933c3..000
--- a/target-arm/op_helper.c
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- *  ARM helper routines
- *
- *  Copyright (c) 2005-2007 CodeSourcery,

[Qemu-devel] [PATCH 3/6] arm: move other arithmetic to helper.c

[Blue Swirl]

Add an explicit CPUARMState parameter instead of relying on AREG0
and move rest of the arithmetic to helper.c.

Signed-off-by: Blue Swirl 
---
 target-arm/helper.c|  146 
 target-arm/helper.h|   24 
 target-arm/op_helper.c |  140 --
 target-arm/translate.c |   78 +-
 4 files changed, 197 insertions(+), 191 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index f01bcb9..3b3d122 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -629,6 +629,152 @@ uint32_t HELPER(abs)(uint32_t x)
 return ((int32_t)x < 0) ? -x : x;
 }

+/* ??? Flag setting arithmetic is awkward because we need to do comparisons.
+   The only way to do that in TCG is a conditional branch, which clobbers
+   all our temporaries.  For now implement these as helper functions.  */
+
+uint32_t HELPER(add_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t result;
+result = a + b;
+env->NF = env->ZF = result;
+env->CF = result < a;
+env->VF = (a ^ b ^ -1) & (a ^ result);
+return result;
+}
+
+uint32_t HELPER(adc_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t result;
+if (!env->CF) {
+result = a + b;
+env->CF = result < a;
+} else {
+result = a + b + 1;
+env->CF = result <= a;
+}
+env->VF = (a ^ b ^ -1) & (a ^ result);
+env->NF = env->ZF = result;
+return result;
+}
+
+uint32_t HELPER(sub_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t result;
+result = a - b;
+env->NF = env->ZF = result;
+env->CF = a >= b;
+env->VF = (a ^ b) & (a ^ result);
+return result;
+}
+
+uint32_t HELPER(sbc_cc)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t result;
+if (!env->CF) {
+result = a - b - 1;
+env->CF = a > b;
+} else {
+result = a - b;
+env->CF = a >= b;
+}
+env->VF = (a ^ b) & (a ^ result);
+env->NF = env->ZF = result;
+return result;
+}
+
+/* Similarly for variable shift instructions.  */
+
+uint32_t HELPER(shl)(CPUARMState *env, uint32_t x, uint32_t i)
+{
+int shift = i & 0xff;
+if (shift >= 32) {
+return 0;
+}
+return x << shift;
+}
+
+uint32_t HELPER(shr)(CPUARMState *env, uint32_t x, uint32_t i)
+{
+int shift = i & 0xff;
+if (shift >= 32) {
+return 0;
+}
+return (uint32_t)x >> shift;
+}
+
+uint32_t HELPER(sar)(CPUARMState *env, uint32_t x, uint32_t i)
+{
+int shift = i & 0xff;
+if (shift >= 32) {
+shift = 31;
+}
+return (int32_t)x >> shift;
+}
+
+uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+{
+int shift = i & 0xff;
+if (shift >= 32) {
+if (shift == 32) {
+env->CF = x & 1;
+} else {
+env->CF = 0;
+}
+return 0;
+} else if (shift != 0) {
+env->CF = (x >> (32 - shift)) & 1;
+return x << shift;
+}
+return x;
+}
+
+uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+{
+int shift = i & 0xff;
+if (shift >= 32) {
+if (shift == 32) {
+env->CF = (x >> 31) & 1;
+} else {
+env->CF = 0;
+}
+return 0;
+} else if (shift != 0) {
+env->CF = (x >> (shift - 1)) & 1;
+return x >> shift;
+}
+return x;
+}
+
+uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+{
+int shift = i & 0xff;
+if (shift >= 32) {
+env->CF = (x >> 31) & 1;
+return (int32_t)x >> 31;
+} else if (shift != 0) {
+env->CF = (x >> (shift - 1)) & 1;
+return (int32_t)x >> shift;
+}
+return x;
+}
+
+uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
+{
+int shift1, shift;
+shift1 = i & 0xff;
+shift = shift1 & 0x1f;
+if (shift == 0) {
+if (shift1 != 0) {
+env->CF = (x >> 31) & 1;
+}
+return x;
+} else {
+env->CF = (x >> (shift - 1)) & 1;
+return ((uint32_t)x >> shift) | (x << (32 - shift));
+}
+}
+
 #if defined(CONFIG_USER_ONLY)

 void do_interrupt (CPUARMState *env)
diff --git a/target-arm/helper.h b/target-arm/helper.h
index e71e8c2..e2ade6f 100644
--- a/target-arm/helper.h
+++ b/target-arm/helper.h
@@ -143,18 +143,18 @@ DEF_HELPER_2(recpe_u32, i32, i32, env)
 DEF_HELPER_2(rsqrte_u32, i32, i32, env)
 DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)

-DEF_HELPER_2(add_cc, i32, i32, i32)
-DEF_HELPER_2(adc_cc, i32, i32, i32)
-DEF_HELPER_2(sub_cc, i32, i32, i32)
-DEF_HELPER_2(sbc_cc, i32, i32, i32)
-
-DEF_HELPER_2(shl, i32, i32, i32)
-DEF_HELPER_2(shr, i32, i32, i32)
-DEF_HELPER_2(sar, i32, i32, i32)
-DEF_HELPER_2(shl_cc, i32, i32, i32)
-DEF_HELPER_2(shr_cc, i32, i32, i32)
-DEF_HELPER_2(sar_cc, i32, i32, i32)
-DEF_HELPER_2(ror_cc, i32, i32, i32)
+DEF_HELPER_3(add_cc, i32, env, i32, i32)
+DEF_HELPER_3(adc_cc, 

[Qemu-devel] [PATCH 5/6] arm: move exception and wfi helpers to helper.c

[Blue Swirl]

Add an explicit CPUARMState parameter instead of relying on AREG0
and move exception and wfi helpers to helper.c. Merge raise_exception()
and helper_exception().

Signed-off-by: Blue Swirl 
---
 target-arm/helper.c|   13 +
 target-arm/helper.h|4 ++--
 target-arm/op_helper.c |   23 +--
 target-arm/translate.c |4 ++--
 4 files changed, 18 insertions(+), 26 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 77415b3..075e8fa 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -775,6 +775,19 @@ uint32_t HELPER(ror_cc)(CPUARMState *env,
uint32_t x, uint32_t i)
 }
 }

+void HELPER(wfi)(CPUARMState *env)
+{
+env->exception_index = EXCP_HLT;
+env->halted = 1;
+cpu_loop_exit(env);
+}
+
+void HELPER(exception)(CPUARMState *env, uint32_t excp)
+{
+env->exception_index = excp;
+cpu_loop_exit(env);
+}
+
 #if defined(CONFIG_USER_ONLY)

 void do_interrupt (CPUARMState *env)
diff --git a/target-arm/helper.h b/target-arm/helper.h
index 3e5f92e..e9f2201 100644
--- a/target-arm/helper.h
+++ b/target-arm/helper.h
@@ -50,8 +50,8 @@ DEF_HELPER_2(usad8, i32, i32, i32)
 DEF_HELPER_1(logicq_cc, i32, i64)

 DEF_HELPER_3(sel_flags, i32, i32, i32, i32)
-DEF_HELPER_1(exception, void, i32)
-DEF_HELPER_0(wfi, void)
+DEF_HELPER_2(exception, void, env, i32)
+DEF_HELPER_1(wfi, void, env)

 DEF_HELPER_3(cpsr_write, void, env, i32, i32)
 DEF_HELPER_1(cpsr_read, i32, env)
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index b1ced67..f1933c3 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -21,14 +21,6 @@
 #include "helper.h"

 #if !defined(CONFIG_USER_ONLY)
-static void raise_exception(int tt)
-{
-env->exception_index = tt;
-cpu_loop_exit(env);
-}
-#endif
-
-#if !defined(CONFIG_USER_ONLY)

 #include "softmmu_exec.h"

@@ -72,21 +64,8 @@ void tlb_fill(CPUARMState *env1, target_ulong addr,
int is_write, int mmu_idx,
 cpu_restore_state(tb, env, pc);
 }
 }
-raise_exception(env->exception_index);
+helper_exception(env, env->exception_index);
 }
 env = saved_env;
 }
 #endif
-
-void HELPER(wfi)(void)
-{
-env->exception_index = EXCP_HLT;
-env->halted = 1;
-cpu_loop_exit(env);
-}
-
-void HELPER(exception)(uint32_t excp)
-{
-env->exception_index = excp;
-cpu_loop_exit(env);
-}
diff --git a/target-arm/translate.c b/target-arm/translate.c
index d654255..643a573 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -208,7 +208,7 @@ static void gen_exception(int excp)
 {
 TCGv tmp = tcg_temp_new_i32();
 tcg_gen_movi_i32(tmp, excp);
-gen_helper_exception(tmp);
+gen_helper_exception(cpu_env, tmp);
 tcg_temp_free_i32(tmp);
 }

@@ -10083,7 +10083,7 @@ static inline void
gen_intermediate_code_internal(CPUARMState *env,
 /* nothing more to generate */
 break;
 case DISAS_WFI:
-gen_helper_wfi();
+gen_helper_wfi(cpu_env);
 break;
 case DISAS_SWI:
 gen_exception(EXCP_SWI);
-- 
1.7.9
From 459a92c3879d590a03fe4b3212e10bc4e4f99d71 Mon Sep 17 00:00:00 2001
Message-Id: 
<459a92c3879d590a03fe4b3212e10bc4e4f99d71.1332193717.git.blauwir...@gmail.com>
In-Reply-To: 
<608dfdd68e634b1913e396e9fded641ec982ae60.1332193717.git.blauwir...@gmail.com>
References: 
<608dfdd68e634b1913e396e9fded641ec982ae60.1332193717.git.blauwir...@gmail.com>
From: Blue Swirl 
Date: Mon, 19 Mar 2012 21:18:35 +
Subject: [PATCH 5/6] arm: move exception and wfi helpers to helper.c

Add an explicit CPUARMState parameter instead of relying on AREG0
and move exception and wfi helpers to helper.c. Merge raise_exception()
and helper_exception().

Signed-off-by: Blue Swirl 
---
 target-arm/helper.c|   13 +
 target-arm/helper.h|4 ++--
 target-arm/op_helper.c |   23 +--
 target-arm/translate.c |4 ++--
 4 files changed, 18 insertions(+), 26 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 77415b3..075e8fa 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -775,6 +775,19 @@ uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, 
uint32_t i)
 }
 }
 
+void HELPER(wfi)(CPUARMState *env)
+{
+env->exception_index = EXCP_HLT;
+env->halted = 1;
+cpu_loop_exit(env);
+}
+
+void HELPER(exception)(CPUARMState *env, uint32_t excp)
+{
+env->exception_index = excp;
+cpu_loop_exit(env);
+}
+
 #if defined(CONFIG_USER_ONLY)
 
 void do_interrupt (CPUARMState *env)
diff --git a/target-arm/helper.h b/target-arm/helper.h
index 3e5f92e..e9f2201 100644
--- a/target-arm/helper.h
+++ b/target-arm/helper.h
@@ -50,8 +50,8 @@ DEF_HELPER_2(usad8, i32, i32, i32)
 DEF_HELPER_1(logicq_cc, i32, i64)
 
 DEF_HELPER_3(sel_flags, i32, i32, i32, i32)
-DEF_HELPER_1(exception, void, i32)
-DEF_HELPER_0(wfi, void)
+DEF_HELPER_2(exception, void, env, i32)
+DEF_HELPER_1(wfi, void, env)
 
 DEF_HELPER_3(cpsr

[Qemu-devel] [PATCH 4/6] arm: move cpsr and banked register access to helper.c

[Blue Swirl]

Add an explicit CPUARMState parameter instead of relying on AREG0
and move cpsr and banked register access to helper.c.

Signed-off-by: Blue Swirl 
---
 target-arm/helper.c|   42 ++
 target-arm/helper.h|8 
 target-arm/op_helper.c |   42 --
 target-arm/translate.c |   12 ++--
 4 files changed, 52 insertions(+), 52 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 3b3d122..77415b3 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -2549,6 +2549,48 @@ void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,

 #endif

+uint32_t HELPER(cpsr_read)(CPUARMState *env)
+{
+return cpsr_read(env) & ~CPSR_EXEC;
+}
+
+void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
+{
+cpsr_write(env, val, mask);
+}
+
+/* Access to user mode registers from privileged modes.  */
+uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
+{
+uint32_t val;
+
+if (regno == 13) {
+val = env->banked_r13[0];
+} else if (regno == 14) {
+val = env->banked_r14[0];
+} else if (regno >= 8
+   && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
+val = env->usr_regs[regno - 8];
+} else {
+val = env->regs[regno];
+}
+return val;
+}
+
+void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
+{
+if (regno == 13) {
+env->banked_r13[0] = val;
+} else if (regno == 14) {
+env->banked_r14[0] = val;
+} else if (regno >= 8
+   && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
+env->usr_regs[regno - 8] = val;
+} else {
+env->regs[regno] = val;
+}
+}
+
 /* Note that signed overflow is undefined in C.  The following routines are
careful to use unsigned types where modulo arithmetic is required.
Failure to do so _will_ break on newer gcc.  */
diff --git a/target-arm/helper.h b/target-arm/helper.h
index e2ade6f..3e5f92e 100644
--- a/target-arm/helper.h
+++ b/target-arm/helper.h
@@ -53,8 +53,8 @@ DEF_HELPER_3(sel_flags, i32, i32, i32, i32)
 DEF_HELPER_1(exception, void, i32)
 DEF_HELPER_0(wfi, void)

-DEF_HELPER_2(cpsr_write, void, i32, i32)
-DEF_HELPER_0(cpsr_read, i32)
+DEF_HELPER_3(cpsr_write, void, env, i32, i32)
+DEF_HELPER_1(cpsr_read, i32, env)

 DEF_HELPER_3(v7m_msr, void, env, i32, i32)
 DEF_HELPER_2(v7m_mrs, i32, env, i32)
@@ -68,8 +68,8 @@ DEF_HELPER_2(get_cp, i32, env, i32)
 DEF_HELPER_2(get_r13_banked, i32, env, i32)
 DEF_HELPER_3(set_r13_banked, void, env, i32, i32)

-DEF_HELPER_1(get_user_reg, i32, i32)
-DEF_HELPER_2(set_user_reg, void, i32, i32)
+DEF_HELPER_2(get_user_reg, i32, env, i32)
+DEF_HELPER_3(set_user_reg, void, env, i32, i32)

 DEF_HELPER_1(vfp_get_fpscr, i32, env)
 DEF_HELPER_2(vfp_set_fpscr, void, env, i32)
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index fc1e7ef..b1ced67 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -90,45 +90,3 @@ void HELPER(exception)(uint32_t excp)
 env->exception_index = excp;
 cpu_loop_exit(env);
 }
-
-uint32_t HELPER(cpsr_read)(void)
-{
-return cpsr_read(env) & ~CPSR_EXEC;
-}
-
-void HELPER(cpsr_write)(uint32_t val, uint32_t mask)
-{
-cpsr_write(env, val, mask);
-}
-
-/* Access to user mode registers from privileged modes.  */
-uint32_t HELPER(get_user_reg)(uint32_t regno)
-{
-uint32_t val;
-
-if (regno == 13) {
-val = env->banked_r13[0];
-} else if (regno == 14) {
-val = env->banked_r14[0];
-} else if (regno >= 8
-   && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
-val = env->usr_regs[regno - 8];
-} else {
-val = env->regs[regno];
-}
-return val;
-}
-
-void HELPER(set_user_reg)(uint32_t regno, uint32_t val)
-{
-if (regno == 13) {
-env->banked_r13[0] = val;
-} else if (regno == 14) {
-env->banked_r14[0] = val;
-} else if (regno >= 8
-   && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
-env->usr_regs[regno - 8] = val;
-} else {
-env->regs[regno] = val;
-}
-}
diff --git a/target-arm/translate.c b/target-arm/translate.c
index 0a41dc8..d654255 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -198,7 +198,7 @@ static void store_reg(DisasContext *s, int reg, TCGv var)
 static inline void gen_set_cpsr(TCGv var, uint32_t mask)
 {
 TCGv tmp_mask = tcg_const_i32(mask);
-gen_helper_cpsr_write(var, tmp_mask);
+gen_helper_cpsr_write(cpu_env, var, tmp_mask);
 tcg_temp_free_i32(tmp_mask);
 }
 /* Set NZCV flags from the high 4 bits of var.  */
@@ -6989,7 +6989,7 @@ static void disas_arm_insn(CPUARMState * env,
DisasContext *s)
 tmp = load_cpu_field(spsr);
 } else {
 tmp = tcg_temp_new_i32();
-gen_helper_cpsr_read(tmp);
+gen_helper_cpsr_read(tmp, cpu_env);
  

[Qemu-devel] [PATCH 2/6] arm: move saturating arithmetic to helper.c

[Blue Swirl]

Add an explicit CPUARMState parameter instead of relying on AREG0
and move saturating arithmetic to helper.c.

Signed-off-by: Blue Swirl 
---
 target-arm/helper.c|  133 +++
 target-arm/helper.h|   20 
 target-arm/op_helper.c |  134 
 target-arm/translate.c |   44 
 4 files changed, 165 insertions(+), 166 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 1314f23..f01bcb9 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -7,6 +7,9 @@
 #endif
 #include "sysemu.h"

+#define SIGNBIT (uint32_t)0x8000
+#define SIGNBIT64 ((uint64_t)1 << 63)
+
 static uint32_t cortexa15_cp15_c0_c1[8] = {
 0x1131, 0x00011011, 0x02010555, 0x,
 0x10201105, 0x2000, 0x0124, 0x02102211
@@ -2466,6 +2469,136 @@ static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
 return res;
 }

+uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t res = a + b;
+if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
+env->QF = 1;
+}
+return res;
+}
+
+uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t res = a + b;
+if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
+env->QF = 1;
+res = ~(((int32_t)a >> 31) ^ SIGNBIT);
+}
+return res;
+}
+
+uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t res = a - b;
+if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
+env->QF = 1;
+res = ~(((int32_t)a >> 31) ^ SIGNBIT);
+}
+return res;
+}
+
+uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
+{
+uint32_t res;
+if (val >= 0x4000) {
+res = ~SIGNBIT;
+env->QF = 1;
+} else if (val <= (int32_t)0xc000) {
+res = SIGNBIT;
+env->QF = 1;
+} else {
+res = val << 1;
+}
+return res;
+}
+
+uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t res = a + b;
+if (res < a) {
+env->QF = 1;
+res = ~0;
+}
+return res;
+}
+
+uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
+{
+uint32_t res = a - b;
+if (res > a) {
+env->QF = 1;
+res = 0;
+}
+return res;
+}
+
+/* Signed saturation.  */
+static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
+{
+int32_t top;
+uint32_t mask;
+
+top = val >> shift;
+mask = (1u << shift) - 1;
+if (top > 0) {
+env->QF = 1;
+return mask;
+} else if (top < -1) {
+env->QF = 1;
+return ~mask;
+}
+return val;
+}
+
+/* Unsigned saturation.  */
+static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
+{
+uint32_t max;
+
+max = (1u << shift) - 1;
+if (val < 0) {
+env->QF = 1;
+return 0;
+} else if (val > max) {
+env->QF = 1;
+return max;
+}
+return val;
+}
+
+/* Signed saturate.  */
+uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
+{
+return do_ssat(env, x, shift);
+}
+
+/* Dual halfword signed saturate.  */
+uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
+{
+uint32_t res;
+
+res = (uint16_t)do_ssat(env, (int16_t)x, shift);
+res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
+return res;
+}
+
+/* Unsigned saturate.  */
+uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
+{
+return do_usat(env, x, shift);
+}
+
+/* Dual halfword unsigned saturate.  */
+uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
+{
+uint32_t res;
+
+res = (uint16_t)do_usat(env, (int16_t)x, shift);
+res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
+return res;
+}
+
 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
diff --git a/target-arm/helper.h b/target-arm/helper.h
index 40529eb..e71e8c2 100644
--- a/target-arm/helper.h
+++ b/target-arm/helper.h
@@ -4,12 +4,12 @@ DEF_HELPER_1(clz, i32, i32)
 DEF_HELPER_1(sxtb16, i32, i32)
 DEF_HELPER_1(uxtb16, i32, i32)

-DEF_HELPER_2(add_setq, i32, i32, i32)
-DEF_HELPER_2(add_saturate, i32, i32, i32)
-DEF_HELPER_2(sub_saturate, i32, i32, i32)
-DEF_HELPER_2(add_usaturate, i32, i32, i32)
-DEF_HELPER_2(sub_usaturate, i32, i32, i32)
-DEF_HELPER_1(double_saturate, i32, s32)
+DEF_HELPER_3(add_setq, i32, env, i32, i32)
+DEF_HELPER_3(add_saturate, i32, env, i32, i32)
+DEF_HELPER_3(sub_saturate, i32, env, i32, i32)
+DEF_HELPER_3(add_usaturate, i32, env, i32, i32)
+DEF_HELPER_3(sub_usaturate, i32, env, i32, i32)
+DEF_HELPER_2(double_saturate, i32, env, s32)
 DEF_HELPER_2(sdiv, s32, s32, s32)
 DEF_HELPER_2(udiv, i32, i32, i32)
 DEF_HELPER_1(rbit, i32, i32)
@@ -40,10 +40,10 @@ PAS_OP(uq)
 PAS_OP(uh)
 #undef P

Re: [Qemu-devel] [PATCH 2/2] ppc: Use uintptr_t for arguments of ppc_tb_set_jmp_target

[Andreas Färber]

Am 19.03.2012 22:33, schrieb malc:
> On Mon, 19 Mar 2012, Stefan Weil wrote:
> 
>> The previous commit changed function tb_set_jmp_target1 and is needed
>> for w64 hosts.
>>
>> This patch is not needed for w64, but it synchronizes tb_set_jmp_target1
>> and ppc_tb_set_jmp_target so that both functions have the same signature.
>>
>> Cc: malc 
>> Signed-off-by: Stefan Weil 
>> ---
>>  exec-all.h |2 +-
>>  tcg/ppc/tcg-target.c   |2 +-
>>  tcg/ppc64/tcg-target.c |2 +-
>>  3 files changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/exec-all.h b/exec-all.h
>> index a6d6519..9ffd778 100644
>> --- a/exec-all.h
>> +++ b/exec-all.h
>> @@ -199,7 +199,7 @@ static inline void tb_set_jmp_target1(uintptr_t 
>> jmp_addr, uintptr_t addr)
>>  /* no need to flush icache explicitly */
>>  }
>>  #elif defined(_ARCH_PPC)
>> -void ppc_tb_set_jmp_target(unsigned long jmp_addr, unsigned long addr);
>> +void ppc_tb_set_jmp_target(uintptr_t jmp_addr, uintptr_t addr);
>>  #define tb_set_jmp_target1 ppc_tb_set_jmp_target
>>  #elif defined(__i386__) || defined(__x86_64__)
>>  static inline void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr)
>> diff --git a/tcg/ppc/tcg-target.c b/tcg/ppc/tcg-target.c
>> index b0aa914..57000e5 100644
>> --- a/tcg/ppc/tcg-target.c
>> +++ b/tcg/ppc/tcg-target.c
>> @@ -1305,7 +1305,7 @@ static void tcg_out_brcond2 (TCGContext *s, const 
>> TCGArg *args,
>>  tcg_out_bc (s, (BC | BI (7, CR_EQ) | BO_COND_TRUE), args[5]);
>>  }
>>  
>> -void ppc_tb_set_jmp_target (unsigned long jmp_addr, unsigned long addr)
>> +void ppc_tb_set_jmp_target (uintptr_t jmp_addr, uintptr_t addr)
>>  {
>>  uint32_t *ptr;
>>  long disp = addr - jmp_addr;
> 
> This should become intptr_t then..

> That said ppc32 code assumes 32bit addresses, and ppc64 tcg_taget_long
> wide ones.. IOW needs some thinking.

Hm? On both host platforms relevant here, Linux and Darwin, long and
intptr_t should have the same width, on both ppc and ppc64, so no
practical difference. I was about to add my Acked-by - where do you see
issues? Or do you just see room for further code improvements elsewhere?

Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

[Qemu-devel] [PATCH 1/6] arm: move neon_tbl to neon_helper.c

[Blue Swirl]

Add an explicit CPUARMState parameter instead of relying on AREG0
and move neon_tbl to neon_helper.c.

Signed-off-by: Blue Swirl 
---
 target-arm/helper.h  |2 +-
 target-arm/neon_helper.c |   22 ++
 target-arm/op_helper.c   |   22 --
 target-arm/translate.c   |4 ++--
 4 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/target-arm/helper.h b/target-arm/helper.h
index 16dd5fc..40529eb 100644
--- a/target-arm/helper.h
+++ b/target-arm/helper.h
@@ -141,7 +141,7 @@ DEF_HELPER_2(recpe_f32, f32, f32, env)
 DEF_HELPER_2(rsqrte_f32, f32, f32, env)
 DEF_HELPER_2(recpe_u32, i32, i32, env)
 DEF_HELPER_2(rsqrte_u32, i32, i32, env)
-DEF_HELPER_4(neon_tbl, i32, i32, i32, i32, i32)
+DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)

 DEF_HELPER_2(add_cc, i32, i32, i32)
 DEF_HELPER_2(adc_cc, i32, i32, i32)
diff --git a/target-arm/neon_helper.c b/target-arm/neon_helper.c
index 1e02d61..e3c08c2 100644
--- a/target-arm/neon_helper.c
+++ b/target-arm/neon_helper.c
@@ -2015,3 +2015,25 @@ void HELPER(neon_zip16)(CPUARMState *env,
uint32_t rd, uint32_t rm)
 env->vfp.regs[rm] = make_float64(m0);
 env->vfp.regs[rd] = make_float64(d0);
 }
+
+uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
+  uint32_t rn, uint32_t maxindex)
+{
+uint32_t val;
+uint32_t tmp;
+int index;
+int shift;
+uint64_t *table;
+table = (uint64_t *)&env->vfp.regs[rn];
+val = 0;
+for (shift = 0; shift < 32; shift += 8) {
+index = (ireg >> shift) & 0xff;
+if (index < maxindex) {
+tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
+val |= tmp << shift;
+} else {
+val |= def & (0xff << shift);
+}
+}
+return val;
+}
diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
index c728432..f4c0123 100644
--- a/target-arm/op_helper.c
+++ b/target-arm/op_helper.c
@@ -31,28 +31,6 @@ static void raise_exception(int tt)
 }
 #endif

-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def,
-  uint32_t rn, uint32_t maxindex)
-{
-uint32_t val;
-uint32_t tmp;
-int index;
-int shift;
-uint64_t *table;
-table = (uint64_t *)&env->vfp.regs[rn];
-val = 0;
-for (shift = 0; shift < 32; shift += 8) {
-index = (ireg >> shift) & 0xff;
-if (index < maxindex) {
-tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-val |= tmp << shift;
-} else {
-val |= def & (0xff << shift);
-}
-}
-return val;
-}
-
 #if !defined(CONFIG_USER_ONLY)

 #include "softmmu_exec.h"
diff --git a/target-arm/translate.c b/target-arm/translate.c
index 81725d1..99de85a 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -6340,7 +6340,7 @@ static int disas_neon_data_insn(CPUARMState *
env, DisasContext *s, uint32_t ins
 tmp2 = neon_load_reg(rm, 0);
 tmp4 = tcg_const_i32(rn);
 tmp5 = tcg_const_i32(n);
-gen_helper_neon_tbl(tmp2, tmp2, tmp, tmp4, tmp5);
+gen_helper_neon_tbl(cpu_env, tmp2, tmp2, tmp, tmp4, tmp5);
 tcg_temp_free_i32(tmp);
 if (insn & (1 << 6)) {
 tmp = neon_load_reg(rd, 1);
@@ -6349,7 +6349,7 @@ static int disas_neon_data_insn(CPUARMState *
env, DisasContext *s, uint32_t ins
 tcg_gen_movi_i32(tmp, 0);
 }
 tmp3 = neon_load_reg(rm, 1);
-gen_helper_neon_tbl(tmp3, tmp3, tmp, tmp4, tmp5);
+gen_helper_neon_tbl(cpu_env, tmp3, tmp3, tmp, tmp4, tmp5);
 tcg_temp_free_i32(tmp5);
 tcg_temp_free_i32(tmp4);
 neon_store_reg(rd, 0, tmp2);
-- 
1.7.9
From 608dfdd68e634b1913e396e9fded641ec982ae60 Mon Sep 17 00:00:00 2001
Message-Id: 
<608dfdd68e634b1913e396e9fded641ec982ae60.1332193717.git.blauwir...@gmail.com>
From: Blue Swirl 
Date: Mon, 19 Mar 2012 20:22:25 +
Subject: [PATCH 1/6] arm: move neon_tbl to neon_helper.c

Add an explicit CPUARMState parameter instead of relying on AREG0
and move neon_tbl to neon_helper.c.

Signed-off-by: Blue Swirl 
---
 target-arm/helper.h  |2 +-
 target-arm/neon_helper.c |   22 ++
 target-arm/op_helper.c   |   22 --
 target-arm/translate.c   |4 ++--
 4 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/target-arm/helper.h b/target-arm/helper.h
index 16dd5fc..40529eb 100644
--- a/target-arm/helper.h
+++ b/target-arm/helper.h
@@ -141,7 +141,7 @@ DEF_HELPER_2(recpe_f32, f32, f32, env)
 DEF_HELPER_2(rsqrte_f32, f32, f32, env)
 DEF_HELPER_2(recpe_u32, i32, i32, env)
 DEF_HELPER_2(rsqrte_u32, i32, i32, env)
-DEF_HELPER_4(neon_tbl, i32, i32, i32, i32, i32)
+DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)
 
 DEF_HELPER_2(add_cc, i32, i32, i32)
 DEF_HELPER_2(adc_cc, i32, i32, i32)
diff --git

[Qemu-devel] [PATCH 0/6] ARM: AREG0 conversion

[Blue Swirl]

Convert ARM to AREG0 free operation. Survives simple tests.

URL git://repo.or.cz/qemu/blueswirl.git
http://repo.or.cz/r/qemu/blueswirl.git

Blue Swirl (6):
  arm: move neon_tbl to neon_helper.c
  arm: move saturating arithmetic to helper.c
  arm: move other arithmetic to helper.c
  arm: move cpsr and banked register access to helper.c
  arm: move exception and wfi helpers to helper.c
  arm: move load and store helpers, switch to AREG0 free mode

 Makefile.target  |4 +-
 configure|2 +-
 target-arm/helper.c  |  388 +-
 target-arm/helper.h  |   60 
 target-arm/neon_helper.c |   22 +++
 target-arm/op_helper.c   |  430 --
 target-arm/translate.c   |  148 
 7 files changed, 513 insertions(+), 541 deletions(-)
 delete mode 100644 target-arm/op_helper.c

-- 
1.7.9

Re: [Qemu-devel] QEMU was not selected for Google Summer of Code this year

[François Revol]

On 19/03/2012 18:28, Andreas Färber wrote:
> Am 16.03.2012 23:11, schrieb François Revol:
>> It should be possible to come up with a project involving QEMU on Haiku
>> if anyone is interested.
>> While there is an existing QEMU port, I'm not sure in what state it
>> currently is.
> 
> Haiku is missing a GLib OptionalPackage, and I have so far not finished
> collecting all the prerequisites to build it from git - to ./autogen.sh
> glib you needs gtk-doc, gtk-doc needs gnome-common or what-not. Also
> HaikuPorts, like many of the ports systems, is collecting recipes to
> build stable versions and stopping there rather than focussing on fixing
> issues upstream, so that the porting doesn't need to be done all over
> again... GLib still doesn't seem to have Haiku support after three+ years.

Welcome to dependency hell.
I'm not guilty for GLib, I usually send things upstream.

François.

[Qemu-devel] [PATCHv5 00/11] cleanup/consolidate iovec functions

[Michael Tokarev]

This is my last attempt.  It is pointless to bother so much
people with so much trivial stuff again and again and again.

This is cleanup/consolidation of iovec-related low-level
routines in qemu.

The plan is to make library functions more understandable,
consistent and useful, and to drop numerous implementations
of the same thing.

The patch changes prototypes of several iov and qiov functions
to match each other, changes types of arguments for some
functions, _swaps_ some function arguments with each other,
and makes use of common code in r/w path.

The result of all these changes.

1. Most qiov-related (qemu_iovec_*) functions now accepts
 'offset' parameter to specify from which (byte) position to
 start operation.  This is added for _memset (removing
 _memset_skip), _from_buffer (allowing to copy a bounce-
 buffer to a middle of qiov).  Typical:

  size_t qemu_iovec_memset(QEMUIOVector *qiov, size_t offset,
   int c, size_t bytes);

2. All functions that accepts this `offset' argument does
 it in a similar manner, following the
   iov, fromwhere, what, bytes
 pattern.  This is consistent with (updated) iov_send()
 and iov_recv() and friends, where `offset' and `bytes'
 arguments were _renamed_, with the following prototypes:

   ssize_t iov_send(sockfd, iov, iov_cnt size_t offset, size_t bytes)

 instead of

   int qemu_sendv(sockfd, iov, int len, int iov_offset)

 See how offset & bytes are used in the same way as for iov_*
 and qemu_iovec_*.   A few callers of these are verified and
 converted.

3. Always use iov_cnt (number of iov entries) together with
  iov, to be able to verify that we don't go past the array.
  iov_send (former qemu_sendv) and iov_recv accepts one extra
  argument now, as are all other derivates (qemu_co_sendv etc).

4. Used size_t instead of various variations for byte counts.
 Including qemu_iovec_copy which used uint64_t(!) type.

5. Function arguments are renamed to better match with their
 actual meaning.  Compare new and original prototype of
 qemu_sendv() above: old prototype with `len' does not
 tell if `len' refers to number of iov elements (as
 regular writev() call) or to number of data bytes.
 Ditto for several usages of `count' for some qemu_iovec_*,
 which is also replaced to `bytes'.

5. One implementation of the code remain. For example,
 qemu_iovec_from_buffer() uses iov_from_buf() directly,
 instead of repeating the same code.

The resulting function usage is much more consistent, the
functions themselves are nice and understandable, which
means they're easier to use and less error-prone.

This patchset also consolidates a few low-level send&recv
functions into one, since both versions were the same
(and were finally calling common function anyway).
This is done by exporting a common send_recv function
with one extra bool argument, and making current send&recv
to be just #defines.

And while at it all, also made some implementations shorter,
cleaner and much easier to read/understand, and add some
code comments.

The read&write consolidation has great potential for the
block layer, as has been demonstrated before.
Unification and generalization of qemu_iovec_* functions
will let to optimize/simplify some more code in block/*,
especially qemu_iovec_memset() and _from_buffer() (this
optimization/simplification is already used in qcow2.c
a bit).

The resulting thing should behave like current/existing
code, there should be no behavor changes, just some
shuffling and a bit of sanity checks.  It has been tested
slightly, by booting different guests out of different
image formats and doing some i/o, after each of the 11
patches, and it all works correctly so far.

Changes since v4:

- added unit tests for iov_from_buf(), iov_to_buf(), iov_memset()
  (in 3/11 "rewrite iov_* functions") and for iov_send_recv()
  (in 11/11 "rewrite iov_send_recv() and move it to iov.c")
  Note: the send_recv() test is unix-specific since it uses
  socketpair(PF_UNIX) and fork() to test actual send/receive.
- after running unit tests, fixed to bugs in iov_from_buf*()
  and iov_send_recv() introduced during countless rewrites
  of the code and rearranges of the patches to be even more
  review-friendly.

Changes since v3:

- rename qemu_sendv(), qemu_sendv_recvv() to iov_send(),
  iov_send_recv() and move them from qemu-common.h and
  cutils.c to iov.h and iov.c.
- add new argument, iov_cnt, to all send/recv-related
  functions (iov_send_recv(), qemu_co_sendv_recv() etc).
  This resulted in a bit more changes in other places,
  some of which, while simple, may still be non-obvious
  (block/nbd.c and block/sheepdog.c).
  Due to the rename above and to introduction of the
  new iov_cnt arg, the function signatures are changed
  so no old code using new function wrongly is possible.
- patch that changes iov_from_buf() & iov_to_buf() is
  split into two halves: prototype changes and rewrite.
- rewrite iov_send_recv() (former qemu_sendv_recvv())
  again, slightly, to

[Qemu-devel] [PATCHv5 06/11] consolidate qemu_iovec_copy() and qemu_iovec_concat() and make them consistent

[Michael Tokarev]

qemu_iovec_concat() is currently a wrapper for
qemu_iovec_copy(), use the former (with extra
"0" arg) in a few places where it is used.

Change skip argument of qemu_iovec_copy() from
uint64_t to size_t, since size of qiov itself
is size_t, so there's no way to skip larger
sizes.  Rename it to soffset, to make it clear
that the offset is applied to src.

Also change the only usage of uint64_t in
hw/9pfs/virtio-9p.c, in v9fs_init_qiov_from_pdu() -
all callers of it actually uses size_t too,
not uint64_t.

One added restriction: as for all other iovec-related
functions, soffset must point inside src.

Order of argumens is already good:
 qemu_iovec_memset(QEMUIOVector *qiov, size_t offset,
   int c, size_t bytes)
vs:
 qemu_iovec_concat(QEMUIOVector *dst,
   QEMUIOVector *src,
   size_t soffset, size_t sbytes)
(note soffset is after _src_ not dst, since it applies to src;
for memset it applies to qiov).

Note that in many places where this function is used,
the previous call is qemu_iovec_reset(), which means
many callers actually want copy (replacing dst content),
not concat.  So we may want to add a wrapper like
qemu_iovec_copy() with the same arguments but which
calls qemu_iovec_reset() before _concat().  This needs
to be done later, so that any current out-of-tree code
which uses _copy().

Signed-off-by: Michael Tokarev 
---
 block.c |4 +-
 block/qcow2.c   |4 +-
 block/qed.c |6 ++--
 cutils.c|   54 ++
 hw/9pfs/virtio-9p.c |8 +++---
 qemu-common.h   |5 +--
 6 files changed, 33 insertions(+), 48 deletions(-)

diff --git a/block.c b/block.c
index b8db395..6e689af 100644
--- a/block.c
+++ b/block.c
@@ -2963,13 +2963,13 @@ static int multiwrite_merge(BlockDriverState *bs, 
BlockRequest *reqs,
 // Add the first request to the merged one. If the requests are
 // overlapping, drop the last sectors of the first request.
 size = (reqs[i].sector - reqs[outidx].sector) << 9;
-qemu_iovec_concat(qiov, reqs[outidx].qiov, size);
+qemu_iovec_concat(qiov, reqs[outidx].qiov, 0, size);
 
 // We should need to add any zeros between the two requests
 assert (reqs[i].sector <= oldreq_last);
 
 // Add the second request
-qemu_iovec_concat(qiov, reqs[i].qiov, reqs[i].qiov->size);
+qemu_iovec_concat(qiov, reqs[i].qiov, 0, reqs[i].qiov->size);
 
 reqs[outidx].nb_sectors = qiov->size >> 9;
 reqs[outidx].qiov = qiov;
diff --git a/block/qcow2.c b/block/qcow2.c
index a24c0dc..47940fd 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -446,7 +446,7 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState 
*bs, int64_t sector_num,
 index_in_cluster = sector_num & (s->cluster_sectors - 1);
 
 qemu_iovec_reset(&hd_qiov);
-qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
+qemu_iovec_concat(&hd_qiov, qiov, bytes_done,
 cur_nr_sectors * 512);
 
 if (!cluster_offset) {
@@ -598,7 +598,7 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState 
*bs,
 assert((cluster_offset & 511) == 0);
 
 qemu_iovec_reset(&hd_qiov);
-qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
+qemu_iovec_concat(&hd_qiov, qiov, bytes_done,
 cur_nr_sectors * 512);
 
 if (s->crypt_method) {
diff --git a/block/qed.c b/block/qed.c
index 6f9325b..a4ef12c 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -1133,7 +1133,7 @@ static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)
 
 acb->cur_nclusters = qed_bytes_to_clusters(s,
 qed_offset_into_cluster(s, acb->cur_pos) + len);
-qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
 
 if (acb->flags & QED_AIOCB_ZERO) {
 /* Skip ahead if the clusters are already zero */
@@ -1179,7 +1179,7 @@ static void qed_aio_write_inplace(QEDAIOCB *acb, uint64_t 
offset, size_t len)
 
 /* Calculate the I/O vector */
 acb->cur_cluster = offset;
-qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
 
 /* Do the actual write */
 qed_aio_write_main(acb, 0);
@@ -1249,7 +1249,7 @@ static void qed_aio_read_data(void *opaque, int ret,
 goto err;
 }
 
-qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
 
 /* Handle zero cluster and backing file reads */
 if (ret == QED_CLUSTER_ZERO) {
diff --git a/cutils.c b/cutils.c
index b4dd844..1aeac15 100644
--- a/cutils.c
+++ b/cutils.c
@@ -172,48 +172,34 @@ void qemu_iovec_add(QEMUIOVector *qiov, void *base, 
size_t len)
 }
 
 /*
- * Copies iovecs from src to the end of dst. It starts copying

Re: [Qemu-devel] [PATCH 2/2] ppc: Use uintptr_t for arguments of ppc_tb_set_jmp_target

[malc]

On Mon, 19 Mar 2012, Stefan Weil wrote:

> The previous commit changed function tb_set_jmp_target1 and is needed
> for w64 hosts.
> 
> This patch is not needed for w64, but it synchronizes tb_set_jmp_target1
> and ppc_tb_set_jmp_target so that both functions have the same signature.
> 
> Cc: malc 
> Signed-off-by: Stefan Weil 
> ---
>  exec-all.h |2 +-
>  tcg/ppc/tcg-target.c   |2 +-
>  tcg/ppc64/tcg-target.c |2 +-
>  3 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/exec-all.h b/exec-all.h
> index a6d6519..9ffd778 100644
> --- a/exec-all.h
> +++ b/exec-all.h
> @@ -199,7 +199,7 @@ static inline void tb_set_jmp_target1(uintptr_t jmp_addr, 
> uintptr_t addr)
>  /* no need to flush icache explicitly */
>  }
>  #elif defined(_ARCH_PPC)
> -void ppc_tb_set_jmp_target(unsigned long jmp_addr, unsigned long addr);
> +void ppc_tb_set_jmp_target(uintptr_t jmp_addr, uintptr_t addr);
>  #define tb_set_jmp_target1 ppc_tb_set_jmp_target
>  #elif defined(__i386__) || defined(__x86_64__)
>  static inline void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr)
> diff --git a/tcg/ppc/tcg-target.c b/tcg/ppc/tcg-target.c
> index b0aa914..57000e5 100644
> --- a/tcg/ppc/tcg-target.c
> +++ b/tcg/ppc/tcg-target.c
> @@ -1305,7 +1305,7 @@ static void tcg_out_brcond2 (TCGContext *s, const 
> TCGArg *args,
>  tcg_out_bc (s, (BC | BI (7, CR_EQ) | BO_COND_TRUE), args[5]);
>  }
>  
> -void ppc_tb_set_jmp_target (unsigned long jmp_addr, unsigned long addr)
> +void ppc_tb_set_jmp_target (uintptr_t jmp_addr, uintptr_t addr)
>  {
>  uint32_t *ptr;
>  long disp = addr - jmp_addr;

This should become intptr_t then..
That said ppc32 code assumes 32bit addresses, and ppc64 tcg_taget_long
wide ones.. IOW needs some thinking.

> diff --git a/tcg/ppc64/tcg-target.c b/tcg/ppc64/tcg-target.c
> index 409a1ac..c286322 100644
> --- a/tcg/ppc64/tcg-target.c
> +++ b/tcg/ppc64/tcg-target.c
> @@ -1233,7 +1233,7 @@ static void tcg_out_brcond (TCGContext *s, TCGCond cond,
>  tcg_out_bc (s, tcg_to_bc[cond], label_index);
>  }
>  
> -void ppc_tb_set_jmp_target (unsigned long jmp_addr, unsigned long addr)
> +void ppc_tb_set_jmp_target (uintptr_t jmp_addr, uintptr_t addr)
>  {
>  TCGContext s;
>  unsigned long patch_size;
> 

-- 
mailto:av1...@comtv.ru

Re: [Qemu-devel] [PATCH RFC] virtio-pci: add MMIO property

[Michael S. Tsirkin]

On Mon, Mar 19, 2012 at 04:07:45PM -0500, Anthony Liguori wrote:
> On 03/19/2012 03:49 PM, Michael S. Tsirkin wrote:
> >On Mon, Mar 19, 2012 at 02:19:33PM -0500, Anthony Liguori wrote:
> >>On 03/19/2012 10:56 AM, Michael S. Tsirkin wrote:
> >>>Currently virtio-pci is specified so that configuration of the device is
> >>>done through a PCI IO space (via BAR 0 of the virtual PCI device).
> >>>However, Linux guests happen to use ioread/iowrite/iomap primitives
> >>>for access, and these work uniformly across memory/io BARs.
> >>>
> >>>While PCI IO accesses are faster than MMIO on x86 kvm,
> >>>MMIO might be helpful on other systems which don't
> >>>implement PIO or where PIO is slower than MMIO.
> >>>
> >>>Add a property to make it possible to tweak the BAR type.
> >>>
> >>>Signed-off-by: Michael S. Tsirkin
> >>>
> >>>This is harmless by default but causes segfaults in memory.c
> >>>when enabled. Thus an RFC until I figure out what's wrong.
> >>
> >>Doesn't this violate the virtio-pci spec?
> >>
> >
> >The point is to change the BAR type depending on the architecture.
> >IO is fastest on x86 but maybe not on other architectures.
> 
> Are we going to document that the BAR is X on architecture Y in the spec?
> 
> I think the better way to do this is to use a separate device id
> range for MMIO virtio-pci.  You can make the same driver hand both
> ranges and that way the device is presented consistently to the
> guest regardless of what the architecture is.

Maybe just make this a hidden option like x-miio?
This will ensure people dont turn it on by mistake on e.g. x86.

> >>Making the same vendor/device ID have different semantics depending
> >>on a magic flag in QEMU seems like a pretty bad idea to me.
> >>
> >>Regards,
> >>
> >>Anthony Liguori
> >
> >We do this with MSI-X so why not the BAR type?
> 
> We extend the bar size with MSI-X and use a transport flag to
> indicate that it's available, right?
> 
> Regards,
> 
> Anthony LIguori
> 
> >
> >>>
> >>>---
> >>>  hw/virtio-pci.c |   16 ++--
> >>>  hw/virtio-pci.h |4 
> >>>  2 files changed, 18 insertions(+), 2 deletions(-)
> >>>
> >>>diff --git a/hw/virtio-pci.c b/hw/virtio-pci.c
> >>>index 28498ec..6f338d2 100644
> >>>--- a/hw/virtio-pci.c
> >>>+++ b/hw/virtio-pci.c
> >>>@@ -655,6 +655,7 @@ void virtio_init_pci(VirtIOPCIProxy *proxy, 
> >>>VirtIODevice *vdev)
> >>>  {
> >>>  uint8_t *config;
> >>>  uint32_t size;
> >>>+uint8_t bar0_type;
> >>>
> >>>  proxy->vdev = vdev;
> >>>
> >>>@@ -684,8 +685,14 @@ void virtio_init_pci(VirtIOPCIProxy *proxy, 
> >>>VirtIODevice *vdev)
> >>>
> >>>  memory_region_init_io(&proxy->bar,&virtio_pci_config_ops, proxy,
> >>>"virtio-pci", size);
> >>>-pci_register_bar(&proxy->pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO,
> >>>-&proxy->bar);
> >>>+
> >>>+if (proxy->flags&   VIRTIO_PCI_FLAG_USE_MMIO) {
> >>>+bar0_type = PCI_BASE_ADDRESS_SPACE_MEMORY;
> >>>+} else {
> >>>+bar0_type = PCI_BASE_ADDRESS_SPACE_IO;
> >>>+}
> >>>+
> >>>+pci_register_bar(&proxy->pci_dev, 0, bar0_type,&proxy->bar);
> >>>
> >>>  if (!kvm_has_many_ioeventfds()) {
> >>>  proxy->flags&= ~VIRTIO_PCI_FLAG_USE_IOEVENTFD;
> >>>@@ -823,6 +830,7 @@ static Property virtio_blk_properties[] = {
> >>>  DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags, 
> >>> VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
> >>>  DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
> >>>  DEFINE_VIRTIO_BLK_FEATURES(VirtIOPCIProxy, host_features),
> >>>+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
> >>>VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
> >>>  DEFINE_PROP_END_OF_LIST(),
> >>>  };
> >>>
> >>>@@ -856,6 +864,7 @@ static Property virtio_net_properties[] = {
> >>>  DEFINE_PROP_UINT32("x-txtimer", VirtIOPCIProxy, net.txtimer, 
> >>> TX_TIMER_INTERVAL),
> >>>  DEFINE_PROP_INT32("x-txburst", VirtIOPCIProxy, net.txburst, 
> >>> TX_BURST),
> >>>  DEFINE_PROP_STRING("tx", VirtIOPCIProxy, net.tx),
> >>>+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
> >>>VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
> >>>  DEFINE_PROP_END_OF_LIST(),
> >>>  };
> >>>
> >>>@@ -888,6 +897,7 @@ static Property virtio_serial_properties[] = {
> >>>  DEFINE_PROP_HEX32("class", VirtIOPCIProxy, class_code, 0),
> >>>  DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
> >>>  DEFINE_PROP_UINT32("max_ports", VirtIOPCIProxy, 
> >>> serial.max_virtserial_ports, 31),
> >>>+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
> >>>VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
> >>>  DEFINE_PROP_END_OF_LIST(),
> >>>  };
> >>>
> >>>@@ -915,6 +925,7 @@ static TypeInfo virtio_serial_info = {
> >>>
> >>>  static Property virtio_balloon_properties[] = {
> >>>  DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
> >>>+DEFINE_PROP_BIT("mmio", VirtIOPCIProxy, flags, 
> >>>VIRTIO_PCI_FLAG_USE_MMIO_BIT, false),
> >>>  DEFINE_PROP_END_OF_LIST(),
> >>>  };
> >>>

[Qemu-devel] [PATCHv5 01/11] virtio-serial-bus: use correct lengths in control_out() message

[Michael Tokarev]

Original code has one thing to process (cur_len), requests to
convert from iovec to buf another thing (len which is actually max_len),
and processes something else (copied).  Whole thing is very difficult
to understand, even if it does a right thing.  The iov_to_buf()
conversion in this case will always return cur_len, because it is
the length of the iovec it was asked to process, and the size we
asked to convert is the same or larger, and iov_to_buf() will stop
at reaching either iov or buf.

Make the code saner by doing the only sane thing: dropping `copied'
which is always the same as `cur_len' but just introduces questions.

Signed-off-by: Michael Tokarev 
---
 hw/virtio-serial-bus.c |6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index e22940e..abe48ec 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -454,7 +454,7 @@ static void control_out(VirtIODevice *vdev, VirtQueue *vq)
 len = 0;
 buf = NULL;
 while (virtqueue_pop(vq, &elem)) {
-size_t cur_len, copied;
+size_t cur_len;
 
 cur_len = iov_size(elem.out_sg, elem.out_num);
 /*
@@ -467,9 +467,9 @@ static void control_out(VirtIODevice *vdev, VirtQueue *vq)
 buf = g_malloc(cur_len);
 len = cur_len;
 }
-copied = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, len);
+iov_to_buf(elem.out_sg, elem.out_num, buf, 0, cur_len);
 
-handle_control_message(vser, buf, copied);
+handle_control_message(vser, buf, cur_len);
 virtqueue_push(vq, &elem, 0);
 }
 g_free(buf);
-- 
1.7.9.1

Re: [Qemu-devel] [PATCHv5 00/11] cleanup/consolidate iovec functions

[Michael Tokarev]

I pushed it all to git://git.corpit.ru/qemu.git mjt-iov

Note there was a bug in last change of unit-test (in the
last patch), -- again because I had to rewrite it so much
times:

--- b/test-iov.c
+++ a/test-iov.c
@@ -223 +223 @@ static void test_io(void)
-   iov_memset(iov, niov, 0, j & 255, -1);
+   iov_memset(iov, niov, 0, 0xff, -1);


it is correct in the git tree but wrong in the last patch
(right value is 0xff, it is checked in other place to
ensure no "other" bytes are touched).

/mjt

[Qemu-devel] [PATCHv5 11/11] rewrite iov_send_recv() and move it to iov.c

[Michael Tokarev]

Make it much more understandable, add a missing
iov_cnt argument (number of iovs in the iov), and
add comments to it.

The new implementation has been extensively tested
by splitting a large buffer into many small
randomly-sized chunks, sending it over socket to
another, slow process and verifying the receiving
data is the same.

Also add a unit test for iov_send_recv(), sending/
receiving data between two processes over a socketpair
using random vectors and random sizes.

Signed-off-by: Michael Tokarev 
---
 cutils.c|   83 -
 iov.c   |  103 +++
 iov.h   |   15 ---
 qemu-coroutine-io.c |2 +-
 test-iov.c  |  103 +++
 5 files changed, 216 insertions(+), 90 deletions(-)

diff --git a/cutils.c b/cutils.c
index cb6f638..e2bc1b8 100644
--- a/cutils.c
+++ b/cutils.c
@@ -375,86 +375,3 @@ int qemu_parse_fd(const char *param)
 }
 return fd;
 }
-
-ssize_t iov_send_recv(int sockfd, struct iovec *iov,
-  size_t offset, size_t bytes,
-  bool do_sendv)
-{
-int iovlen;
-ssize_t ret;
-size_t diff;
-struct iovec *last_iov;
-
-/* last_iov is inclusive, so count from one.  */
-iovlen = 1;
-last_iov = iov;
-bytes += offset;
-
-while (last_iov->iov_len < bytes) {
-bytes -= last_iov->iov_len;
-
-last_iov++;
-iovlen++;
-}
-
-diff = last_iov->iov_len - bytes;
-last_iov->iov_len -= diff;
-
-while (iov->iov_len <= offset) {
-offset -= iov->iov_len;
-
-iov++;
-iovlen--;
-}
-
-iov->iov_base = (char *) iov->iov_base + offset;
-iov->iov_len -= offset;
-
-{
-#if defined CONFIG_IOVEC && defined CONFIG_POSIX
-struct msghdr msg;
-memset(&msg, 0, sizeof(msg));
-msg.msg_iov = iov;
-msg.msg_iovlen = iovlen;
-
-do {
-if (do_sendv) {
-ret = sendmsg(sockfd, &msg, 0);
-} else {
-ret = recvmsg(sockfd, &msg, 0);
-}
-} while (ret == -1 && errno == EINTR);
-#else
-struct iovec *p = iov;
-ret = 0;
-while (iovlen > 0) {
-int rc;
-if (do_sendv) {
-rc = send(sockfd, p->iov_base, p->iov_len, 0);
-} else {
-rc = qemu_recv(sockfd, p->iov_base, p->iov_len, 0);
-}
-if (rc == -1) {
-if (errno == EINTR) {
-continue;
-}
-if (ret == 0) {
-ret = -1;
-}
-break;
-}
-if (rc == 0) {
-break;
-}
-ret += rc;
-iovlen--, p++;
-}
-#endif
-}
-
-/* Undo the changes above */
-iov->iov_base = (char *) iov->iov_base - offset;
-iov->iov_len += offset;
-last_iov->iov_len += diff;
-return ret;
-}
diff --git a/iov.c b/iov.c
index 9657d28..7cc08f0 100644
--- a/iov.c
+++ b/iov.c
@@ -18,6 +18,14 @@
 
 #include "iov.h"
 
+#ifdef _WIN32
+# include 
+# include 
+#else
+# include 
+# include 
+#endif
+
 size_t iov_from_buf(struct iovec *iov, unsigned int iov_cnt,
 size_t offset, const void *buf, size_t bytes)
 {
@@ -87,6 +95,101 @@ size_t iov_size(const struct iovec *iov, const unsigned int 
iov_cnt)
 return len;
 }
 
+/* helper function for iov_send_recv() */
+static ssize_t
+do_send_recv(int sockfd, struct iovec *iov, unsigned iov_cnt, bool do_send)
+{
+#if defined CONFIG_IOVEC && defined CONFIG_POSIX
+ssize_t ret;
+struct msghdr msg;
+memset(&msg, 0, sizeof(msg));
+msg.msg_iov = iov;
+msg.msg_iovlen = iov_cnt;
+do {
+ret = do_send
+? sendmsg(sockfd, &msg, 0)
+: recvmsg(sockfd, &msg, 0);
+} while (ret < 0 && errno == EINTR);
+return ret;
+#else
+/* else send piece-by-piece */
+/*XXX Note: windows has WSASend() and WSARecv() */
+unsigned i;
+size_t count = 0;
+for (i = 0; i < iov_cnt; ++i) {
+ssize_t r = do_send
+? send(sockfd, iov[i].iov_base, iov[i].iov_len, 0)
+: recv(sockfd, iov[i].iov_base, iov[i].iov_len, 0);
+if (r > 0) {
+ret += r;
+} else if (!r) {
+break;
+} else if (errno == EINTR) {
+continue;
+} else {
+/* else it is some "other" error,
+ * only return if there was no data processed. */
+if (ret == 0) {
+return -1;
+}
+break;
+}
+}
+return count;
+#endif
+}
+
+ssize_t iov_send_recv(int sockfd, struct iovec *iov, unsigned iov_cnt,
+  size_t offset, size_t bytes,
+  bool do_send)
+{
+ssize_t ret;
+unsigned si, ei;/* start and end