[Qemu-devel] [PATCH V10 3/3] tests: add a unit test for the vmgenid device.

2014-12-14 Thread Gal Hammer
Signed-off-by: Gal Hammer 

---
 tests/Makefile   |  2 ++
 tests/vmgenid-test.c | 48 
 2 files changed, 50 insertions(+)
 create mode 100644 tests/vmgenid-test.c

diff --git a/tests/Makefile b/tests/Makefile
index 16f0e4c..612441a 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -64,6 +64,7 @@ gcov-files-check-qom-interface-y = qom/object.c
 check-unit-$(CONFIG_POSIX) += tests/test-vmstate$(EXESUF)
 check-unit-y += tests/test-qemu-opts$(EXESUF)
 gcov-files-test-qemu-opts-y = qom/test-qemu-opts.c
+check-qtest-i386-y += tests/vmgenid-test$(EXESUF)
 
 check-block-$(CONFIG_POSIX) += tests/qemu-iotests-quick.sh
 
@@ -351,6 +352,7 @@ tests/usb-hcd-xhci-test$(EXESUF): tests/usb-hcd-xhci-test.o 
$(libqos-usb-obj-y)
 tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o qemu-char.o 
qemu-timer.o $(qtest-obj-y)
 tests/qemu-iotests/socket_scm_helper$(EXESUF): 
tests/qemu-iotests/socket_scm_helper.o
 tests/test-qemu-opts$(EXESUF): tests/test-qemu-opts.o libqemuutil.a 
libqemustub.a
+tests/vmgenid-test$(EXESUF): tests/vmgenid-test.o
 
 ifeq ($(CONFIG_POSIX),y)
 LIBS += -lutil
diff --git a/tests/vmgenid-test.c b/tests/vmgenid-test.c
new file mode 100644
index 000..d9c3e29
--- /dev/null
+++ b/tests/vmgenid-test.c
@@ -0,0 +1,48 @@
+/*
+ * QTest testcase for VM Generation ID
+ *
+ * Copyright (c) 2014 Red Hat, Inc.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include 
+#include "libqtest.h"
+
+static void vmgenid_test(void)
+{
+static const uint8_t expected[16] = {
+0x32, 0x4e, 0x6e, 0xaf, 0xd1, 0xd1, 0x4b, 0xf6,
+0xbf, 0x41, 0xb9, 0xbb, 0x6c, 0x91, 0xfb, 0x87
+};
+uint8_t guid[16];
+uint32_t i;
+
+// Emulate the ACPI _INI method (tells the device where the physical
+// memory was "allocated".
+writel(0xfedf, 0x0001f000);
+   
+// Skip the ACPI ADDR method and read the GUID directly from memory.
+for (i = 0; i < 16; i++) {
+guid[i] = readb(0x0001f000 + i);
+} 
+
+g_assert_cmpuint(sizeof(guid), ==, sizeof(expected));
+g_assert(memcmp(guid, expected, sizeof(guid)) == 0);
+}
+
+int main(int argc, char **argv)
+{
+int ret;
+
+g_test_init(&argc, &argv, NULL);
+qtest_add_func("/vmgenid/vmgenid", vmgenid_test);
+
+qtest_start("-global vmgenid.uuid=324e6eaf-d1d1-4bf6-bf41-b9bb6c91fb87");
+ret = g_test_run();
+
+qtest_end();
+
+return ret;
+}
-- 
1.9.3




[Qemu-devel] [PATCH V10 2/3] i386: Add a Virtual Machine Generation ID device

2014-12-14 Thread Gal Hammer
Based on Microsoft's sepecifications (paper can be dowloaded from
http://go.microsoft.com/fwlink/?LinkId=260709), add a device
description to the SSDT ACPI table and its implementation.

The GUID is set using a global "vmgenid.uuid" parameter.

Signed-off-by: Gal Hammer 

---
 default-configs/i386-softmmu.mak |  1 +
 default-configs/x86_64-softmmu.mak   |  1 +
 hw/acpi/core.c   |  8 +++
 hw/acpi/ich9.c   |  8 +++
 hw/acpi/piix4.c  |  8 +++
 hw/i386/acpi-build.c | 26 ++
 hw/i386/acpi-dsdt.dsl|  4 +++-
 hw/i386/pc.c |  8 +++
 hw/i386/q35-acpi-dsdt.dsl|  5 -
 hw/i386/ssdt-misc.dsl| 43 
 hw/isa/lpc_ich9.c|  1 +
 hw/misc/Makefile.objs|  1 +
 include/hw/acpi/acpi.h   |  2 ++
 include/hw/acpi/acpi_dev_interface.h |  4 
 include/hw/acpi/ich9.h   |  2 ++
 include/hw/i386/pc.h |  3 +++
 16 files changed, 123 insertions(+), 2 deletions(-)

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index 8e08841..bd33c75 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -45,3 +45,4 @@ CONFIG_IOAPIC=y
 CONFIG_ICC_BUS=y
 CONFIG_PVPANIC=y
 CONFIG_MEM_HOTPLUG=y
+CONFIG_VMGENID=y
diff --git a/default-configs/x86_64-softmmu.mak 
b/default-configs/x86_64-softmmu.mak
index 66557ac..006fc7c 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -45,3 +45,4 @@ CONFIG_IOAPIC=y
 CONFIG_ICC_BUS=y
 CONFIG_PVPANIC=y
 CONFIG_MEM_HOTPLUG=y
+CONFIG_VMGENID=y
diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 51913d6..d4597c6 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -28,6 +28,8 @@
 #include "qapi-visit.h"
 #include "qapi-event.h"
 
+#define ACPI_VM_GENERATION_ID_CHANGED_STATUS 1
+
 struct acpi_table_header {
 uint16_t _length; /* our length, not actual part of the hdr */
   /* allows easier parsing for fw_cfg clients */
@@ -683,3 +685,9 @@ void acpi_update_sci(ACPIREGS *regs, qemu_irq irq)
(regs->pm1.evt.en & ACPI_BITMASK_TIMER_ENABLE) &&
!(pm1a_sts & ACPI_BITMASK_TIMER_STATUS));
 }
+
+void acpi_vm_generation_id_changed(ACPIREGS *acpi_regs, qemu_irq irq)
+{
+acpi_regs->gpe.sts[0] |= ACPI_VM_GENERATION_ID_CHANGED_STATUS;
+acpi_update_sci(acpi_regs, irq);
+}
diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index ea991a3..12a9387 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -307,3 +307,11 @@ void ich9_pm_ospm_status(AcpiDeviceIf *adev, 
ACPIOSTInfoList ***list)
 
 acpi_memory_ospm_status(&s->pm.acpi_memory_hotplug, list);
 }
+
+void ich9_vm_generation_id_changed(AcpiDeviceIf *adev)
+{
+ICH9LPCState *s = ICH9_LPC_DEVICE(adev);
+ICH9LPCPMRegs *pm = &s->pm;
+
+acpi_vm_generation_id_changed(&pm->acpi_regs, pm->irq);
+}
diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 481a16c..41b6eb6 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -574,6 +574,13 @@ static void piix4_ospm_status(AcpiDeviceIf *adev, 
ACPIOSTInfoList ***list)
 acpi_memory_ospm_status(&s->acpi_memory_hotplug, list);
 }
 
+static void piix4_vm_generation_id_changed(AcpiDeviceIf *adev)
+{
+PIIX4PMState *s = PIIX4_PM(adev);
+
+acpi_vm_generation_id_changed(&s->ar, s->irq);
+}
+
 static Property piix4_pm_properties[] = {
 DEFINE_PROP_UINT32("smb_io_base", PIIX4PMState, smb_io_base, 0),
 DEFINE_PROP_UINT8(ACPI_PM_PROP_S3_DISABLED, PIIX4PMState, disable_s3, 0),
@@ -611,6 +618,7 @@ static void piix4_pm_class_init(ObjectClass *klass, void 
*data)
 hc->plug = piix4_device_plug_cb;
 hc->unplug_request = piix4_device_unplug_request_cb;
 adevc->ospm_status = piix4_ospm_status;
+adevc->vm_generation_id_changed = piix4_vm_generation_id_changed;
 }
 
 static const TypeInfo piix4_pm_info = {
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index a4d0c0c..f20a6a5 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -257,6 +257,7 @@ static void acpi_get_pci_info(PcPciInfo *info)
 #define ACPI_BUILD_TABLE_FILE "etc/acpi/tables"
 #define ACPI_BUILD_RSDP_FILE "etc/acpi/rsdp"
 #define ACPI_BUILD_TPMLOG_FILE "etc/tpm/log"
+#define ACPI_BUILD_VMGENID_FILE "etc/vm-generation-id"
 
 static void
 build_header(GArray *linker, GArray *table_data,
@@ -1068,6 +1069,8 @@ build_ssdt(GArray *table_data, GArray *linker,
 {
 MachineState *machine = MACHINE(qdev_get_machine());
 uint32_t nr_mem = machine->ram_slots;
+uint32_t vm_gid_physical_address;
+uint32_t vm_gid_offset = 0;
 unsigned acpi_cpus = guest_info->apic_id_limit;
 int ssdt_start = table_data->len;
 uint8_t *ssdt_ptr;
@@ -1096,6 +1099,21 @@ build_ssdt(GArray *table_data, GArray *linker,
 ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml),

[Qemu-devel] [PATCH V10 0/3] Virtual Machine Generation ID

2014-12-14 Thread Gal Hammer
Hi,

Resending patches after the release of version 2.2.

Please note that this patch set doesn't include the *.hex.generated
files and the binary ACPI tables (make check will fail).

Thanks,

Gal.

VX - Fixed typos in docs and a few clarification.

V9 - Add a unit test.
   - Rebased to version 2.2.
   - Removed hex.generated the binary files from patch.

V8 - Add a device's description file.
   - GUID is stored in fw cfg file and the guest writes the
 physical address to the device (reduces vmexits).

V7 - Move the device's description back to the static SSDT table.
   - The GUID is store in a "hard coded" physical address and not
 in the ACPI table itself.
   - ACPI notification is triggered when the GUID is changed.

V6 - include the pre-compiled ASL file
   - remove an empty line at end of files.

V5 - Move device's description to SSDT table (dynamic).

V4 - Fix a typo in error message string.
   - Move device's description from DSDT back to SSDT table.

V3 - Remove "-uuid" command line parameter.
   - Move device's description from SSDT to DSDT table.
   - Add new "vmgenid" sysbus device.

Gal Hammer (3):
  docs: vm generation id device's description
  i386: Add a Virtual Machine Generation ID device
  tests: add a unit test for the vmgenid device.

 default-configs/i386-softmmu.mak |  1 +
 default-configs/x86_64-softmmu.mak   |  1 +
 docs/specs/vmgenid.txt   | 38 
 hw/acpi/core.c   |  8 ++
 hw/acpi/ich9.c   |  8 ++
 hw/acpi/piix4.c  |  8 ++
 hw/i386/acpi-build.c | 26 +++
 hw/i386/acpi-dsdt.dsl|  4 ++-
 hw/i386/pc.c |  8 ++
 hw/i386/q35-acpi-dsdt.dsl|  5 +++-
 hw/i386/ssdt-misc.dsl| 43 
 hw/isa/lpc_ich9.c|  1 +
 hw/misc/Makefile.objs|  1 +
 include/hw/acpi/acpi.h   |  2 ++
 include/hw/acpi/acpi_dev_interface.h |  4 +++
 include/hw/acpi/ich9.h   |  2 ++
 include/hw/i386/pc.h |  3 +++
 tests/Makefile   |  2 ++
 tests/vmgenid-test.c | 48 
 19 files changed, 211 insertions(+), 2 deletions(-)
 create mode 100644 docs/specs/vmgenid.txt
 create mode 100644 tests/vmgenid-test.c

-- 
1.9.3




[Qemu-devel] [PATCH V10 1/3] docs: vm generation id device's description

2014-12-14 Thread Gal Hammer
Signed-off-by: Gal Hammer 

---
 docs/specs/vmgenid.txt | 38 ++
 1 file changed, 38 insertions(+)
 create mode 100644 docs/specs/vmgenid.txt

diff --git a/docs/specs/vmgenid.txt b/docs/specs/vmgenid.txt
new file mode 100644
index 000..656d598
--- /dev/null
+++ b/docs/specs/vmgenid.txt
@@ -0,0 +1,38 @@
+VIRTUAL MACHINE GENERATION ID
+=
+
+Copyright (C) 2014 Red Hat, Inc.
+
+This work is licensed under the terms of the GNU GPL, version 2 or later.
+See the COPYING file in the top-level directory.
+
+===
+
+The VM generation ID (vmgenid) device is an emulated device which
+exposes a 128-bit, cryptographically random, integer value identifier.
+This allows management applications (e.g. libvirt) to notify the guest
+operating system when the virtual machine is executed with a different
+configuration (e.g. snapshot execution or creation from a template).
+
+This is specified on the web at: http://go.microsoft.com/fwlink/?LinkId=260709
+
+---
+
+The vmgenid device is a sysbus device with the following ACPI ID:
+"QEMU0002".
+
+The device adds a "vmgenid.uuid" property, which can be modified using
+the -global command line argument or the QMP interface.
+
+The device uses a fixed memory resource: 0xfedf-0xfedf0003. The
+guest is expected to write the physical address of the GUID's buffer
+to that memory resource. This allows the device to modify the GUID if
+requested by the management application. Current device's implementation
+supports a 32-bit address.
+
+According to the specification, any change to the GUID executes an
+ACPI notification. The vmgenid device triggers the GPE._E00 which
+executes the ACPI Notify operation.
+
+Although not specified in Microsoft's document, it is assumed that the
+device is expected to use the little-endian system.
-- 
1.9.3




Re: [Qemu-devel] [PATCH] NetKVM: fix for indirectc mode when vring is full

2014-12-14 Thread Yan Vugenfirer
Thanks!

The fix is correct, but I am not sure this patch is needed.
This is a frozen part of the code with XP and Windows 2003 support for NetKVM 
only.

The library that is used for newer OSes and other drivers has this fix: 
https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/264f1b6c86f5eeca5e2c9fbd24e3de8dbd0bee1d

In the NetKVM driver code itself we are testing for those conditions before 
calling to add_buf (check ParaNdis_DoSubmitPacket function in 
https://github.com/YanVugenfirer/kvm-guest-drivers-windows/blob/stable/NetKVM/NDIS5/Common/ParaNdis-Common.c#L1528).

Best regads,
Yan.

> On Dec 10, 2014, at 9:28 AM, Ting Wang  wrote:
> 
> In function vring_add_indirect, there is no limiti
> about free entry in vring. If vring is full,
> vq->num_free will be less than zero, and
> the address of vq->vring.desc becomes illegal.
> 
> Signed-off-by: Ting Wang 
> ---
> NetKVM/NDIS5/VirtIO/VirtIORing.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/NetKVM/NDIS5/VirtIO/VirtIORing.c 
> b/NetKVM/NDIS5/VirtIO/VirtIORing.c
> index 90ace4c..0f3783c 100644
> --- a/NetKVM/NDIS5/VirtIO/VirtIORing.c
> +++ b/NetKVM/NDIS5/VirtIO/VirtIORing.c
> @@ -150,7 +150,7 @@ static int vring_add_buf(struct virtqueue *_vq,
> return -1;
> }
> 
> -if (va_indirect)
> +if (va_indirect && (out + in) > 1 && vq->num_free)
> {
> int ret = vring_add_indirect(_vq, sg, out, in, va_indirect, 
> phys_indirect);
> if (ret >= 0)
> -- 
> 1.8.5
> 
> 




[Qemu-devel] [Bug 1025244] Re: qcow2 image increasing disk size above the virtual limit

2014-12-14 Thread Michael Tokarev
Looking at what?  At the lack of problems as comment #14 says?

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1025244

Title:
  qcow2 image increasing disk size above the virtual limit

Status in QEMU:
  New
Status in qemu-kvm package in Ubuntu:
  Triaged

Bug description:
  Using qemu/kvm, qcow2 images, ext4 file systems on both guest and host
   Host and Guest: Ubuntu server 12.04 64bit
  To create an image I did this:

  qemu-img create -f qcow2 -o preallocation=metadata ubuntu-pdc-vda.img 
10737418240 (not sure about the exact bytes, but around this)
  ls -l ubuntu-pdc-vda.img
  fallocate -l theSizeInBytesFromAbove ubuntu-pdc-vda.img

  The problem is that the image is growing progressively and has
  obviously no limit, although I gave it one. The root filesystem's
  image is the same case:

  qemu-img info ubuntu-pdc-vda.img
   image: ubuntu-pdc-vda.img
   file format: qcow2
   virtual size: 10G (10737418240 bytes)
   disk size: 14G
   cluster_size: 65536

  and for confirmation:
   du -sh ubuntu-pdc-vda.img
   15G ubuntu-pdc-vda.img

  I made a test and saw that when I delete something from the guest, the real 
size of the image is not decreasing (I read it is normal). OK, but when I write 
something again, it doesn't use the freed space, but instead grows the image. 
So for example:
   1. The initial physical size of the image is 1GB.
   2. I copy 1GB of data in the guest. It's physical size becomes 2GB.
   3. I delete this data (1GB). The physical size of the image remains 2GB.
   4. I copy another 1GB of data to the guest.
   5. The physical size of the image becomes 3GB.
   6. And so on with no limit. It doesn't care if the virtual size is less.

  Is this normal - the real/physical size of the image to be larger than
  the virtual limit???

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1025244/+subscriptions



[Qemu-devel] requesting for creating user name

2014-12-14 Thread Pankaj Gupta
Hi,

kindly help me ...

Kindly create an user id for the my name to access QEMU materials.
 Preferred user ID: Pankajusic


​Thanks for the support.​

-- 
Thanks with Regards:
Pankaj Kumar Gupta
Hyderabad, Telangana
cell: *+91-9035486588*


Re: [Qemu-devel] [PATCH 0/2] target-xtensa: translator optimizations

2014-12-14 Thread Richard Henderson
On 12/13/2014 06:21 PM, Max Filippov wrote:
> Max Filippov (2):
>   target-xtensa: record available window in TB flags
>   target-xtensa: don't generate dead code
> 
>  target-xtensa/cpu.h   |  12 +
>  target-xtensa/helper.h|   2 +-
>  target-xtensa/op_helper.c |  29 +-
>  target-xtensa/translate.c | 661 
> --
>  4 files changed, 363 insertions(+), 341 deletions(-)

Reviewed-by: Richard Henderson 

Nice improvement.


r~



Re: [Qemu-devel] [PATCH v4] qemu-log: add log category for MMU info

2014-12-14 Thread Richard Henderson
On 12/13/2014 08:48 AM, Antony Pavlov wrote:
> Running barebox on qemu-system-mips* with '-d unimp' overloads
> stderr by very very many mips_cpu_handle_mmu_fault() messages:
> 
>   mips_cpu_handle_mmu_fault address=b80003fd ret 0 physical 180003fd 
> prot 3
>   mips_cpu_handle_mmu_fault address=a0800884 ret 0 physical 00800884 
> prot 3
>   mips_cpu_handle_mmu_fault pc a080cd80 ad b80003fd rw 0 mmu_idx 0
> 
> So it's very difficult to find LOG_UNIMP message.
> 
> The mips_cpu_handle_mmu_fault() messages appear on enabling ANY
> logging! It's not very handy.
> 
> Adding separate log category for *_cpu_handle_mmu_fault()
> logging fixes the problem.
> 
> Signed-off-by: Antony Pavlov 
> Acked-by: Alexander Graf 
> ---

Reviewed-by: Richard Henderson 


r~



[Qemu-devel] [Query] : Is instruction fetch from non ram mapped region supported ?

2014-12-14 Thread Gaurav Sharma
Hi,
I just wanted to know if instruction fetch from non ram mapped region
supported in qemu ?
I looked at the code as how TLB is being formed and maintained, and my
understanding of the code confirms the same.
Just wanted to cross-check if that is correct ?

Thanks,
Gaurav


Re: [Qemu-devel] [Query] : Is instruction fetch from non ram mapped region supported ?

2014-12-14 Thread Peter Maydell
On 14 December 2014 at 20:56, Gaurav Sharma  wrote:
> I just wanted to know if instruction fetch from non ram mapped region
> supported in qemu ?

No. If you try it you'll probably hit the "Trying to execute code
outside RAM or ROM" fatal error in get_page_addr_code().
(The region can be device-for-writing, like the flash ROM devices,
but for reading it has to be backed by host RAM.)

-- PMM



[Qemu-devel] [Bug 498035] Re: qemu hangs on shutdown or reboot (XP guest)

2014-12-14 Thread Edwin Drood
My Two Cents.

I am using Xubuntu 14.04 recent install -- all updates.

I created a WIN7 x64 VM (fresh clean install) with most Windows updates
-- nothing else.

Note:  I use a script (command line startup) of "qemu-system-x86_64"

Inside Windows 7, I shutdown a few services that I thought I did not
need (incl. POWER Service)

I had an occasional BSOD when shutting down.  very quick, minor
annoyance.  Was able to slect start normally in Windows next boot --
only happened once every 10 or so times.

BUT  I was able to shutdown quickly every time.

I discovered that I had to enable the POWER service to activate the
virtual soundcard HW hda (to play audio).

since I have enabled the POWER service, I cannot shutdown normally.  The
"Shutting Down..." appears forever (or until occasional BSOD).

This does not cause any undue processor load and I am able to do a
normal "quit" of the VM using telnet into the monitor.  (issuing "quit"
from the monitor is like yanking out the power-cord of the VM)  I see no
problems from doing this.  Windows thinks it is shut-down clean enough.

It is possible that when I issue the "quit" in the monitor after about
10 seconds of shutdown, I may not get any more BSOD at all.

I have tried playing with the Windows Power configuration settings and
have found nothing to solve the issue.

Other than this minor annoyance, everything is working great!  (because
it is running so well, I probably won't be running a trace or debugging
the dump file in Windows.  If anybody wants, I can share my startup
script that launches the VM.  I am not going to use any virt manager
from the GUI.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/498035

Title:
  qemu hangs on shutdown or reboot (XP guest)

Status in QEMU:
  Incomplete

Bug description:
  When I shut down or reboot my Windows XP guest, about half the time,
  it hangs at the point where it says "Windows is shutting down...".  At
  that point qemu is using 100% of one host CPU, about 85% user, 15%
  system.  (Core 2 Quad 2.66GHz)

  This is the command line I use to start qemu:

  qemu-system-x86_64 -hda winxp.img -k en-us -m 2048 -smp 2 -vnc :3100
  -usbdevice tablet -boot c -enable-kvm &

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/498035/+subscriptions



Re: [Qemu-devel] Bug in s390 instruction emulation

2014-12-14 Thread Paolo Bonzini


On 13/12/2014 23:10, Torbjörn Granlund wrote:
> I wrote:
> 
>   The s390 instruction emulation makes GMP fail most of its tests.
>   I have isolated one of the problems:
>   
>   How to reproduce:
>   
>   gcc m.c x.s
>   ./a.out
>   
>   Correct output on actual hardware:
>   
>   
>   Incorrect output using QEMU 2.2.0 rc4:
>   0
>   
>   File m.c:
>   #include 
>   int foo();
>   int main() { printf("%x\n", foo()); return 0; }
>   
>   File x.s:
>   .text
>   .align  8
>   .globl  foo
>   .type   foo,@function
>   foo:lghi%r2, 0
>   lghi%r3, 1
>   slgr%r2, %r3
>   slbgr   %r3, %r3
>   slbgr   %r2, %r2
>   br  %r14
>   
> Turns out that all failures except 3 are due to subb borrow handling
> code which (almost) never works when there is borrow-in.  A minimal fix
> is quite simple:
> 
> *** /home/tege/qemu/qemu-2.2.0/target-s390x/.~/cc_helper.c.~1~Tue Dec 
>  9 15:45:44 2014
> --- /home/tege/qemu/qemu-2.2.0/target-s390x/cc_helper.c   Sat Dec 13 
> 22:47:11 2014
> ***
> *** 182,184 
>   /* We had borrow-in if normal subtraction isn't equal.  */
> ! int borrow_in = ar - (a1 - a2);
>   int borrow_out;
> --- 182,184 
>   /* We had borrow-in if normal subtraction isn't equal.  */
> ! int borrow_in = (a1 - a2) - ar;
>   int borrow_out;
> 
> There is at least one more instruction emulation error which I have not
> yet isolated [two test failures].  And then EX is not implemented for
> logical operations [one test failure].
> 
> This latter problem is adequately reported by qemu:
> qemu: fatal: EXECUTE on instruction prefix 0xd400 not implemented
> qemu: fatal: EXECUTE on instruction prefix 0xd600 not implemented

Something like this?

diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
index 5a55de8..4de3fc2 100644
--- a/target-s390x/mem_helper.c
+++ b/target-s390x/mem_helper.c
@@ -490,10 +490,18 @@ uint32_t HELPER(ex)(CPUS390XState *env, uint32_t cc, 
uint64_t v1,
 helper_mvc(env, l, get_address(env, 0, b1, d1),
get_address(env, 0, b2, d2));
 break;
+case 0x400:
+cc = helper_nc(env, l, get_address(env, 0, b1, d1),
+get_address(env, 0, b2, d2));
+break;
 case 0x500:
 cc = helper_clc(env, l, get_address(env, 0, b1, d1),
 get_address(env, 0, b2, d2));
 break;
+case 0x600:
+cc = helper_oc(env, l, get_address(env, 0, b1, d1),
+get_address(env, 0, b2, d2));
+break;
 case 0x700:
 cc = helper_xc(env, l, get_address(env, 0, b1, d1),
get_address(env, 0, b2, d2));

Paolo



[Qemu-devel] [PULL 0/3] Collected target-i386 patches

2014-12-14 Thread Richard Henderson
I'm sure I haven't gotten all of them that have been outstanding
over the last couple of months, but at least here's a couple.


r~


The following changes since commit 99c9c3cb24e566258a0a141178934f9cb5198842:

  Merge remote-tracking branch 
'remotes/mjt/tags/pull-trivial-patches-2014-12-11' into staging (2014-12-11 
18:27:02 +)

are available in the git repository at:

  git://github.com/rth7680/qemu.git tags/x86-next-20141214

for you to fetch changes up to c4d4525c38cd93cc5d1a743976eb25ac571d435f:

  target-i386: fix icount processing for repz instructions (2014-12-14 16:48:38 
-0600)


Collected x86 patches


Dmitry Poletaev (2):
  target-i386: Wrong conversion infinity from float80 to int32/int64
  target-i386: fbld instruction doesn't set minus sign

Pavel Dovgalyuk (1):
  target-i386: fix icount processing for repz instructions

 target-i386/fpu_helper.c | 22 --
 target-i386/translate.c  | 16 ++--
 2 files changed, 34 insertions(+), 4 deletions(-)



[Qemu-devel] [PULL 1/3] target-i386: Wrong conversion infinity from float80 to int32/int64

2014-12-14 Thread Richard Henderson
From: Dmitry Poletaev 

Signed-off-by: Dmitry Poletaev 
Signed-off-by: Richard Henderson 
---
 target-i386/fpu_helper.c | 20 +++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/target-i386/fpu_helper.c b/target-i386/fpu_helper.c
index 1d4eee3..8768e1c 100644
--- a/target-i386/fpu_helper.c
+++ b/target-i386/fpu_helper.c
@@ -251,16 +251,34 @@ int32_t helper_fist_ST0(CPUX86State *env)
 int32_t helper_fistl_ST0(CPUX86State *env)
 {
 int32_t val;
+signed char old_exp_flags;
+
+old_exp_flags = get_float_exception_flags(&env->fp_status);
+set_float_exception_flags(0, &env->fp_status);
 
 val = floatx80_to_int32(ST0, &env->fp_status);
+if (get_float_exception_flags(&env->fp_status) & float_flag_invalid) {
+val = 0x8000;
+}
+set_float_exception_flags(get_float_exception_flags(&env->fp_status)
+| old_exp_flags, &env->fp_status);
 return val;
 }
 
 int64_t helper_fistll_ST0(CPUX86State *env)
 {
 int64_t val;
+signed char old_exp_flags;
 
-val = floatx80_to_int64(ST0, &env->fp_status);
+old_exp_flags = get_float_exception_flags(&env->fp_status);
+set_float_exception_flags(0, &env->fp_status);
+
+val = floatx80_to_int32(ST0, &env->fp_status);
+if (get_float_exception_flags(&env->fp_status) & float_flag_invalid) {
+val = 0x8000ULL;
+}
+set_float_exception_flags(get_float_exception_flags(&env->fp_status)
+| old_exp_flags, &env->fp_status);
 return val;
 }
 
-- 
2.1.0




[Qemu-devel] [PULL 2/3] target-i386: fbld instruction doesn't set minus sign

2014-12-14 Thread Richard Henderson
From: Dmitry Poletaev 

Signed-off-by: Dmitry Poletaev 
Signed-off-by: Richard Henderson 
---
 target-i386/fpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target-i386/fpu_helper.c b/target-i386/fpu_helper.c
index 8768e1c..30d34d5 100644
--- a/target-i386/fpu_helper.c
+++ b/target-i386/fpu_helper.c
@@ -639,7 +639,7 @@ void helper_fbld_ST0(CPUX86State *env, target_ulong ptr)
 }
 tmp = int64_to_floatx80(val, &env->fp_status);
 if (cpu_ldub_data(env, ptr + 9) & 0x80) {
-floatx80_chs(tmp);
+tmp = floatx80_chs(tmp);
 }
 fpush(env);
 ST0 = tmp;
-- 
2.1.0




[Qemu-devel] [PULL 3/3] target-i386: fix icount processing for repz instructions

2014-12-14 Thread Richard Henderson
From: Pavel Dovgalyuk 

TCG generates optimized code for i386 repz instructions in single step mode.
It means that when ecx becomes 0, execution of the string instruction breaks
immediately without an additional iteration for ecx==0 (which will only check
ecx and set the flags). Omitting this iteration leads to different
instructions counting in singlestep mode and in normal execution.
This patch disables optimization of this last iteration for icount mode
which should be deterministic.

v2: inverted the condition and formatted the comment

Signed-off-by: Pavel Dovgalyuk 
Signed-off-by: Richard Henderson 
---
 target-i386/translate.c | 16 ++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/target-i386/translate.c b/target-i386/translate.c
index 782f7d2..6243e36 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -115,6 +115,7 @@ typedef struct DisasContext {
 int tf; /* TF cpu flag */
 int singlestep_enabled; /* "hardware" single step enabled */
 int jmp_opt; /* use direct block chaining for direct jumps */
+int repz_opt; /* optimize jumps within repz instructions */
 int mem_index; /* select memory access functions */
 uint64_t flags; /* all execution flags */
 struct TranslationBlock *tb;
@@ -1215,7 +1216,7 @@ static inline void gen_repz_ ## op(DisasContext *s, 
TCGMemOp ot,  \
 gen_op_add_reg_im(s->aflag, R_ECX, -1);   \
 /* a loop would cause two single step exceptions if ECX = 1   \
before rep string_insn */  \
-if (!s->jmp_opt)  \
+if (s->repz_opt)  \
 gen_op_jz_ecx(s->aflag, l2);  \
 gen_jmp(s, cur_eip);  \
 }
@@ -1233,7 +1234,7 @@ static inline void gen_repz_ ## op(DisasContext *s, 
TCGMemOp ot,  \
 gen_op_add_reg_im(s->aflag, R_ECX, -1);   \
 gen_update_cc_op(s);  \
 gen_jcc1(s, (JCC_Z << 1) | (nz ^ 1), l2); \
-if (!s->jmp_opt)  \
+if (s->repz_opt)  \
 gen_op_jz_ecx(s->aflag, l2);  \
 gen_jmp(s, cur_eip);  \
 }
@@ -7951,6 +7952,17 @@ static inline void gen_intermediate_code_internal(X86CPU 
*cpu,
 || (flags & HF_SOFTMMU_MASK)
 #endif
 );
+/* Do not optimize repz jumps at all in icount mode, because
+   rep movsS instructions are execured with different paths
+   in !repz_opt and repz_opt modes. The first one was used
+   always except single step mode. And this setting
+   disables jumps optimization and control paths become
+   equivalent in run and single step modes.
+   Now there will be no jump optimization for repz in
+   record/replay modes and there will always be an
+   additional step for ecx=0 when icount is enabled.
+ */
+dc->repz_opt = !dc->jmp_opt && !use_icount;
 #if 0
 /* check addseg logic */
 if (!dc->addseg && (dc->vm86 || !dc->pe || !dc->code32))
-- 
2.1.0




[Qemu-devel] [PATCH v13 1/3] spapr_pci: Make find_phb()/find_dev() public

2014-12-14 Thread Gavin Shan
From: Alexey Kardashevskiy 

This makes find_phb()/find_dev() public and changed its names
to spapr_pci_find_phb()/spapr_pci_find_dev() as they are going to
be used from other parts of QEMU such as VFIO DDW (dynamic DMA window)
or VFIO PCI error injection or VFIO EEH handling - in all these
cases there are RTAS calls which are addressed to BUID+config_addr
in IEEE1275 format.

Signed-off-by: Alexey Kardashevskiy 
Signed-off-by: Gavin Shan 
---
 hw/ppc/spapr_pci.c  | 22 +++---
 include/hw/pci-host/spapr.h |  4 
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 21b95b3..3d70efe 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -47,7 +47,7 @@
 #define RTAS_TYPE_MSI   1
 #define RTAS_TYPE_MSIX  2
 
-static sPAPRPHBState *find_phb(sPAPREnvironment *spapr, uint64_t buid)
+sPAPRPHBState *spapr_pci_find_phb(sPAPREnvironment *spapr, uint64_t buid)
 {
 sPAPRPHBState *sphb;
 
@@ -61,10 +61,10 @@ static sPAPRPHBState *find_phb(sPAPREnvironment *spapr, 
uint64_t buid)
 return NULL;
 }
 
-static PCIDevice *find_dev(sPAPREnvironment *spapr, uint64_t buid,
-   uint32_t config_addr)
+PCIDevice *spapr_pci_find_dev(sPAPREnvironment *spapr, uint64_t buid,
+  uint32_t config_addr)
 {
-sPAPRPHBState *sphb = find_phb(spapr, buid);
+sPAPRPHBState *sphb = spapr_pci_find_phb(spapr, buid);
 PCIHostState *phb = PCI_HOST_BRIDGE(sphb);
 int bus_num = (config_addr >> 16) & 0xFF;
 int devfn = (config_addr >> 8) & 0xFF;
@@ -95,7 +95,7 @@ static void finish_read_pci_config(sPAPREnvironment *spapr, 
uint64_t buid,
 return;
 }
 
-pci_dev = find_dev(spapr, buid, addr);
+pci_dev = spapr_pci_find_dev(spapr, buid, addr);
 addr = rtas_pci_cfgaddr(addr);
 
 if (!pci_dev || (addr % size) || (addr >= pci_config_size(pci_dev))) {
@@ -162,7 +162,7 @@ static void finish_write_pci_config(sPAPREnvironment 
*spapr, uint64_t buid,
 return;
 }
 
-pci_dev = find_dev(spapr, buid, addr);
+pci_dev = spapr_pci_find_dev(spapr, buid, addr);
 addr = rtas_pci_cfgaddr(addr);
 
 if (!pci_dev || (addr % size) || (addr >= pci_config_size(pci_dev))) {
@@ -280,9 +280,9 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, 
sPAPREnvironment *spapr,
 }
 
 /* Fins sPAPRPHBState */
-phb = find_phb(spapr, buid);
+phb = spapr_pci_find_phb(spapr, buid);
 if (phb) {
-pdev = find_dev(spapr, buid, config_addr);
+pdev = spapr_pci_find_dev(spapr, buid, config_addr);
 }
 if (!phb || !pdev) {
 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
@@ -381,9 +381,9 @@ static void 
rtas_ibm_query_interrupt_source_number(PowerPCCPU *cpu,
 spapr_pci_msi *msi;
 
 /* Find sPAPRPHBState */
-phb = find_phb(spapr, buid);
+phb = spapr_pci_find_phb(spapr, buid);
 if (phb) {
-pdev = find_dev(spapr, buid, config_addr);
+pdev = spapr_pci_find_dev(spapr, buid, config_addr);
 }
 if (!phb || !pdev) {
 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
@@ -530,7 +530,7 @@ static void spapr_phb_realize(DeviceState *dev, Error 
**errp)
 return;
 }
 
-if (find_phb(spapr, sphb->buid)) {
+if (spapr_pci_find_phb(spapr, sphb->buid)) {
 error_setg(errp, "PCI host bridges must have unique BUIDs");
 return;
 }
diff --git a/include/hw/pci-host/spapr.h b/include/hw/pci-host/spapr.h
index 4ea2a0d..3892f1a 100644
--- a/include/hw/pci-host/spapr.h
+++ b/include/hw/pci-host/spapr.h
@@ -122,4 +122,8 @@ void spapr_pci_msi_init(sPAPREnvironment *spapr, hwaddr 
addr);
 
 void spapr_pci_rtas_init(void);
 
+sPAPRPHBState *spapr_pci_find_phb(sPAPREnvironment *spapr, uint64_t buid);
+PCIDevice *spapr_pci_find_dev(sPAPREnvironment *spapr, uint64_t buid,
+  uint32_t config_addr);
+
 #endif /* __HW_SPAPR_PCI_H__ */
-- 
1.8.3.2




[Qemu-devel] [PATCH v13 2/3] sPAPR: Implement EEH RTAS calls

2014-12-14 Thread Gavin Shan
The emulation for EEH RTAS requests from guest isn't covered
by QEMU yet and the patch implements them.

The patch defines constants used by EEH RTAS calls and adds
callback sPAPRPHBClass::eeh_handler, which is going to be used
this way:

  * RTAS calls are received in spapr_pci.c, sanity check is done
there.
  * RTAS handlers handle what they can. If there is something it
cannot handle and sPAPRPHBClass::eeh_handler callback is defined,
it is called.
  * sPAPRPHBClass::eeh_handler is only implemented for VFIO now. It
does ioctl() to the IOMMU container fd to complete the call. Error
codes from that ioctl() are transferred back to the guest.

[aik: defined RTAS tokens for EEH RTAS calls]
Signed-off-by: Gavin Shan 
---
 hw/ppc/spapr_pci.c  | 246 
 include/hw/pci-host/spapr.h |   7 ++
 include/hw/ppc/spapr.h  |  43 +++-
 3 files changed, 294 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 3d70efe..3bb1971 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -406,6 +406,233 @@ static void 
rtas_ibm_query_interrupt_source_number(PowerPCCPU *cpu,
 rtas_st(rets, 2, 1);/* 0 == level; 1 == edge */
 }
 
+static int rtas_handle_eeh_request(sPAPREnvironment *spapr,
+   uint64_t buid, uint32_t req, uint32_t opt)
+{
+sPAPRPHBState *sphb = spapr_pci_find_phb(spapr, buid);
+sPAPRPHBClass *info = SPAPR_PCI_HOST_BRIDGE_GET_CLASS(sphb);
+
+if (!sphb || !info->eeh_handler) {
+return -ENOENT;
+}
+
+return info->eeh_handler(sphb, req, opt);
+}
+
+static void rtas_ibm_set_eeh_option(PowerPCCPU *cpu,
+sPAPREnvironment *spapr,
+uint32_t token, uint32_t nargs,
+target_ulong args, uint32_t nret,
+target_ulong rets)
+{
+uint32_t addr, option;
+uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);
+int ret;
+
+if ((nargs != 4) || (nret != 1)) {
+goto param_error_exit;
+}
+
+addr = rtas_ld(args, 0);
+option = rtas_ld(args, 3);
+switch (option) {
+case RTAS_EEH_ENABLE:
+if (!spapr_pci_find_dev(spapr, buid, addr)) {
+goto param_error_exit;
+}
+break;
+case RTAS_EEH_DISABLE:
+case RTAS_EEH_THAW_IO:
+case RTAS_EEH_THAW_DMA:
+break;
+default:
+goto param_error_exit;
+}
+
+ret = rtas_handle_eeh_request(spapr, buid,
+  RTAS_EEH_REQ_SET_OPTION, option);
+if (ret >= 0) {
+rtas_st(rets, 0, RTAS_OUT_SUCCESS);
+return;
+}
+
+param_error_exit:
+rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+}
+
+static void rtas_ibm_get_config_addr_info2(PowerPCCPU *cpu,
+   sPAPREnvironment *spapr,
+   uint32_t token, uint32_t nargs,
+   target_ulong args, uint32_t nret,
+   target_ulong rets)
+{
+uint32_t addr, option;
+uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);
+sPAPRPHBState *sphb = spapr_pci_find_phb(spapr, buid);
+sPAPRPHBClass *info = SPAPR_PCI_HOST_BRIDGE_GET_CLASS(sphb);
+PCIDevice *pdev;
+
+if (!sphb || !info->eeh_handler) {
+goto param_error_exit;
+}
+
+if ((nargs != 4) || (nret != 2)) {
+goto param_error_exit;
+}
+
+addr = rtas_ld(args, 0);
+option = rtas_ld(args, 3);
+if (option != RTAS_GET_PE_ADDR && option != RTAS_GET_PE_MODE) {
+goto param_error_exit;
+}
+
+pdev = spapr_pci_find_dev(spapr, buid, addr);
+if (!pdev) {
+goto param_error_exit;
+}
+
+/*
+ * For now, we always have bus level PE whose address
+ * has format "00BBSS00". The guest OS might regard
+ * PE address 0 as invalid. We avoid that simply by
+ * extending it with one.
+ */
+rtas_st(rets, 0, RTAS_OUT_SUCCESS);
+if (option == RTAS_GET_PE_ADDR) {
+rtas_st(rets, 1, (pci_bus_num(pdev->bus) << 16) + 1);
+} else {
+rtas_st(rets, 1, RTAS_PE_MODE_SHARED);
+}
+
+return;
+
+param_error_exit:
+rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+}
+
+static void rtas_ibm_read_slot_reset_state2(PowerPCCPU *cpu,
+sPAPREnvironment *spapr,
+uint32_t token, uint32_t nargs,
+target_ulong args, uint32_t nret,
+target_ulong rets)
+{
+uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);
+int ret;
+
+if ((nargs != 3) || (nret != 4 && nret != 5)) {
+goto param_error_exit;
+}
+
+ret = rtas_handle_eeh_request(spapr, buid, RTAS_EEH_REQ_GET_STAT

[Qemu-devel] [PATCH v13 3/3] sPAPR: Implement sPAPRPHBClass::eeh_handler

2014-12-14 Thread Gavin Shan
The patch implements sPAPRPHBClass::eeh_handler so that the
EEH RTAS requests can be routed to VFIO for further handling.

Signed-off-by: Gavin Shan 
---
 hw/misc/vfio.c  |  1 +
 hw/ppc/spapr_pci_vfio.c | 56 +
 2 files changed, 57 insertions(+)

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index fd318a1..26ad165 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -4460,6 +4460,7 @@ int vfio_container_ioctl(AddressSpace *as, int32_t 
groupid,
 switch (req) {
 case VFIO_CHECK_EXTENSION:
 case VFIO_IOMMU_SPAPR_TCE_GET_INFO:
+case VFIO_EEH_PE_OP:
 break;
 default:
 /* Return an error on unknown requests */
diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
index d3bddf2..032431f 100644
--- a/hw/ppc/spapr_pci_vfio.c
+++ b/hw/ppc/spapr_pci_vfio.c
@@ -71,6 +71,61 @@ static void spapr_phb_vfio_finish_realize(sPAPRPHBState 
*sphb, Error **errp)
 spapr_tce_get_iommu(tcet));
 }
 
+static int spapr_phb_vfio_eeh_handler(sPAPRPHBState *sphb, int req, int opt)
+{
+sPAPRPHBVFIOState *svphb = SPAPR_PCI_VFIO_HOST_BRIDGE(sphb);
+struct vfio_eeh_pe_op op = { .argsz = sizeof(op) };
+int cmd;
+
+switch (req) {
+case RTAS_EEH_REQ_SET_OPTION:
+switch (opt) {
+case RTAS_EEH_DISABLE:
+cmd = VFIO_EEH_PE_DISABLE;
+break;
+case RTAS_EEH_ENABLE:
+cmd = VFIO_EEH_PE_ENABLE;
+break;
+case RTAS_EEH_THAW_IO:
+cmd = VFIO_EEH_PE_UNFREEZE_IO;
+break;
+case RTAS_EEH_THAW_DMA:
+cmd = VFIO_EEH_PE_UNFREEZE_DMA;
+break;
+default:
+return -EINVAL;
+}
+break;
+case RTAS_EEH_REQ_GET_STATE:
+cmd = VFIO_EEH_PE_GET_STATE;
+break;
+case RTAS_EEH_REQ_RESET:
+switch (opt) {
+case RTAS_SLOT_RESET_DEACTIVATE:
+cmd = VFIO_EEH_PE_RESET_DEACTIVATE;
+break;
+case RTAS_SLOT_RESET_HOT:
+cmd = VFIO_EEH_PE_RESET_HOT;
+break;
+case RTAS_SLOT_RESET_FUNDAMENTAL:
+cmd = VFIO_EEH_PE_RESET_FUNDAMENTAL;
+break;
+default:
+return -EINVAL;
+}
+break;
+case RTAS_EEH_REQ_CONFIGURE:
+cmd = VFIO_EEH_PE_CONFIGURE;
+break;
+default:
+ return -EINVAL;
+}
+
+op.op = cmd;
+return vfio_container_ioctl(&svphb->phb.iommu_as, svphb->iommugroupid,
+VFIO_EEH_PE_OP, &op);
+}
+
 static void spapr_phb_vfio_reset(DeviceState *qdev)
 {
 /* Do nothing */
@@ -84,6 +139,7 @@ static void spapr_phb_vfio_class_init(ObjectClass *klass, 
void *data)
 dc->props = spapr_phb_vfio_properties;
 dc->reset = spapr_phb_vfio_reset;
 spc->finish_realize = spapr_phb_vfio_finish_realize;
+spc->eeh_handler = spapr_phb_vfio_eeh_handler;
 }
 
 static const TypeInfo spapr_phb_vfio_info = {
-- 
1.8.3.2




[Qemu-devel] [PATCH v13 0/3] EEH Support for VFIO Devices

2014-12-14 Thread Gavin Shan
The series of patches adds support EEH for VFIO PCI devices on sPAPR platform.
It requires corresponding host kernel support, which was merged during 3.17
merge window. This patchset has been rebased to Alex Graf's QEMU repository:

   git://github.com/agraf/qemu.git (branch: ppc-next)

The implementations notes are below. Please consider for merging!

* RTAS calls are received in spapr_pci.c, sanity check is done there. RTAS
  handlers handle what they can. If there is something it cannot handle and
  sPAPRPHBClass::eeh_handler callback is defined, it is called.
* sPAPRPHBClass::eeh_handler is only implemented for VFIO now. It does ioctl()
  to the IOMMU container fd to complete the call. Error codes from that ioctl()
  are transferred back to the guest.

Changelog
=
v10 -> v11:
* Don't explicitly set struct vfio_eeh_pe_op::flags to 0.
* rtas_handle_eeh_request() checks the validity of sPAPRPHBState and
  sPAPRPHBClass::eeh_handler.
* The first level functions set the RTAS call return value.
* Replace "if (...)" with "switch (...)".
v11 -> v12:
* RTAS call returns RTAS_OUT_NO_ERRORS_FOUND on success because we
  don't support it yet.
* Add one more patch from Alexey to make find_phb() and find_dev()
  phblic.
* Rebase to Alex Graf's QEMU repository.
v12 -> v13:
* Rebase to Alex Graf's QEMU repository ("ppc-next" branch).
* Drop the patch for header file (vfio.h) changes, which was merged
  to QEMU repository by commit a9fd1654 ("linux-headers: update to 
3.17-rc7").
* Retested on Emulex adapter and EEH errors are recovered successfully.

Alexey Kardashevskiy (1):
  spapr_pci: Make find_phb()/find_dev() public

Gavin Shan (2):
  sPAPR: Implement EEH RTAS calls
  sPAPR: Implement sPAPRPHBClass::eeh_handler

 hw/misc/vfio.c  |   1 +
 hw/ppc/spapr_pci.c  | 268 ++--
 hw/ppc/spapr_pci_vfio.c |  56 +
 include/hw/pci-host/spapr.h |  11 ++
 include/hw/ppc/spapr.h  |  43 ++-
 5 files changed, 366 insertions(+), 13 deletions(-)

-- 
1.8.3.2




Re: [Qemu-devel] [RFC PATCH] hw/arm/virt: Add support for NUMA on ARM64

2014-12-14 Thread Shannon Zhao
On 2014/12/8 21:49, Peter Maydell wrote:
> On 2 December 2014 at 12:56, Shannon Zhao  wrote:
>> Add support for NUMA on ARM64. Tested successfully running a guest
>> Linux kernel with the following patch applied:
> 
> I'm still hoping for review from somebody who better understands
> how QEMU and NUMA should interact, but in the meantime some comments
> at a code level:
> 
>>  hw/arm/boot.c |   25 
>>  hw/arm/virt.c |  120 
>> +---
>>  2 files changed, 113 insertions(+), 32 deletions(-)
>>
>> diff --git a/hw/arm/boot.c b/hw/arm/boot.c
>> index 0014c34..c20fee4 100644
>> --- a/hw/arm/boot.c
>> +++ b/hw/arm/boot.c
>> @@ -335,7 +335,6 @@ static int load_dtb(hwaddr addr, const struct 
>> arm_boot_info *binfo,
>>  {
>>  void *fdt = NULL;
>>  int size, rc;
>> -uint32_t acells, scells;
>>
>>  if (binfo->dtb_filename) {
>>  char *filename;
>> @@ -369,30 +368,6 @@ static int load_dtb(hwaddr addr, const struct 
>> arm_boot_info *binfo,
>>  return 0;
>>  }
>>
>> -acells = qemu_fdt_getprop_cell(fdt, "/", "#address-cells");
>> -scells = qemu_fdt_getprop_cell(fdt, "/", "#size-cells");
>> -if (acells == 0 || scells == 0) {
>> -fprintf(stderr, "dtb file invalid (#address-cells or #size-cells 
>> 0)\n");
>> -goto fail;
>> -}
>> -
>> -if (scells < 2 && binfo->ram_size >= (1ULL << 32)) {
>> -/* This is user error so deserves a friendlier error message
>> - * than the failure of setprop_sized_cells would provide
>> - */
>> -fprintf(stderr, "qemu: dtb file not compatible with "
>> -"RAM size > 4GB\n");
>> -goto fail;
>> -}
>> -
>> -rc = qemu_fdt_setprop_sized_cells(fdt, "/memory", "reg",
>> -  acells, binfo->loader_start,
>> -  scells, binfo->ram_size);
>> -if (rc < 0) {
>> -fprintf(stderr, "couldn't set /memory/reg\n");
>> -goto fail;
>> -}
>> -
> 
> This patchset seems to be moving the initialization of a lot of
> the dtb from this generic code into the virt board. That doesn't
> seem right to me -- why would NUMA support be specific to the
> virt board? I would expect support for this to be in the generic
> code (possibly controlled with a board option for "I support NUMA").
> As it is your patch will break support for every other
> board that uses device trees, because they rely on this code
> which you've deleted here.
> 

Good suggestion. Will fix this :-)

>>  if (binfo->kernel_cmdline && *binfo->kernel_cmdline) {
>>  rc = qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
>>   binfo->kernel_cmdline);
>> diff --git a/hw/arm/virt.c b/hw/arm/virt.c
>> index 78f618d..9d18a91 100644
>> --- a/hw/arm/virt.c
>> +++ b/hw/arm/virt.c
>> @@ -170,8 +170,6 @@ static void create_fdt(VirtBoardInfo *vbi)
>>   * to fill in necessary properties later
>>   */
>>  qemu_fdt_add_subnode(fdt, "/chosen");
>> -qemu_fdt_add_subnode(fdt, "/memory");
>> -qemu_fdt_setprop_string(fdt, "/memory", "device_type", "memory");
>>
>>  /* Clock node, for the benefit of the UART. The kernel device tree
>>   * binding documentation claims the PL011 node clock properties are
>> @@ -235,6 +233,116 @@ static void fdt_add_psci_node(const VirtBoardInfo *vbi)
>>  qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn);
>>  }
>>
>> +static int virt_memory_init(MachineState *machine,
>> +MemoryRegion *system_memory,
>> +const VirtBoardInfo *vbi)
>> +{
>> +MemoryRegion *ram = g_new(MemoryRegion, 1);
>> +CPUState *cpu;
>> +int min_cpu = 0, max_cpu = 0;
>> +int i, j, count, len;
>> +uint32_t acells, scells;
>> +
>> +acells = qemu_fdt_getprop_cell(vbi->fdt, "/", "#address-cells");
>> +scells = qemu_fdt_getprop_cell(vbi->fdt, "/", "#size-cells");
>> +if (acells == 0 || scells == 0) {
>> +fprintf(stderr, "dtb file invalid (#address-cells or #size-cells 
>> 0)\n");
>> +goto fail;
>> +}
>> +
>> +if (scells < 2 && machine->ram_size >= (1ULL << 32)) {
>> +/* This is user error so deserves a friendlier error message
>> + * than the failure of setprop_sized_cells would provide
>> + */
>> +fprintf(stderr, "qemu: dtb file not compatible with "
>> +"RAM size > 4GB\n");
>> +goto fail;
>> +}
>> +
>> +memory_region_allocate_system_memory(ram, NULL, "mach-virt.ram",
>> + machine->ram_size);
>> +memory_region_add_subregion(system_memory, vbi->memmap[VIRT_MEM].base, 
>> ram);
>> +
>> +hwaddr mem_base = vbi->memmap[VIRT_MEM].base;
>> +
>> +if (!nb_numa_nodes) {
>> +qemu_fdt_add_subnode(vbi->fdt, "/memory");
>> +qemu_fdt_setprop_string(vbi->fdt, "/memory", "device_type", 
>> "m

Re: [Qemu-devel] [PATCH 0/2] target-xtensa: translator optimizations

2014-12-14 Thread Max Filippov
On Sun, Dec 14, 2014 at 9:28 PM, Richard Henderson  wrote:
> On 12/13/2014 06:21 PM, Max Filippov wrote:
>> Max Filippov (2):
>>   target-xtensa: record available window in TB flags
>>   target-xtensa: don't generate dead code
>>
>>  target-xtensa/cpu.h   |  12 +
>>  target-xtensa/helper.h|   2 +-
>>  target-xtensa/op_helper.c |  29 +-
>>  target-xtensa/translate.c | 661 
>> --
>>  4 files changed, 363 insertions(+), 341 deletions(-)
>
> Reviewed-by: Richard Henderson 
>
> Nice improvement.

Thanks for the review, Richard.

-- Max



Re: [Qemu-devel] [PATCH 1/1] virtio: fix feature bit checks

2014-12-14 Thread Fam Zheng
On Fri, 12/12 10:13, Cornelia Huck wrote:
> On Fri, 12 Dec 2014 11:08:21 +0200
> "Michael S. Tsirkin"  wrote:
> 
> > On Fri, Dec 12, 2014 at 10:01:46AM +0100, Cornelia Huck wrote:
> > > Several places check against the feature bit number instead of against
> > > the feature bit. Fix them.
> > > 
> > > Reported-by: Thomas Huth 
> > > Signed-off-by: Cornelia Huck 
> > 
> > Cc: stable?
> 
> Hm, yeah. Can you add it?

Ccing qemu-sta...@nongnu.org

Fam



[Qemu-devel] [PATCH v2 0/3] tests: Add check-block to "make check"

2014-12-14 Thread Fam Zheng
qemu-iotests contains useful tests that have a nice coverage of block layer
code. Adding check-block (which calls tests/qemu-iotests-quick.sh) to "make
check" is good for developers' self-testing.

v2: Address comments from reviewing of v1:
Remove 091 from quick group. (Kevin)
Add Max's rev-by in patch 2. (Max)
Allow overriding TEST_DIR, and leave "-c writeback" out in patch 3.
(Markus, Kevin)



Fam Zheng (3):
  qemu-iotests: Remove 091 from quick group
  qemu-iotests: Speed up make check-block
  tests/Makefile: Add check-block to make check

 tests/Makefile  | 2 +-
 tests/qemu-iotests-quick.sh | 2 +-
 tests/qemu-iotests/check| 1 +
 tests/qemu-iotests/group| 2 +-
 4 files changed, 4 insertions(+), 3 deletions(-)

-- 
1.9.3




[Qemu-devel] [PATCH v2 1/3] qemu-iotests: Remove 091 from quick group

2014-12-14 Thread Fam Zheng
For the purpose of allowing running quick group on tmpfs.

Signed-off-by: Fam Zheng 
---
 tests/qemu-iotests/group | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index a4742c6..08099b9 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -97,7 +97,7 @@
 088 rw auto quick
 089 rw auto quick
 090 rw auto quick
-091 rw auto quick
+091 rw auto
 092 rw auto quick
 095 rw auto quick
 097 rw auto backing
-- 
1.9.3




[Qemu-devel] [PATCH v2 2/3] qemu-iotests: Speed up make check-block

2014-12-14 Thread Fam Zheng
Using /tmp, which is usually mounted as tmpfs, the quick group can be
quicker.

On my laptop (Lenovo T430s with Fedora 20), this reduces the time from
50s to 30s.

Signed-off-by: Fam Zheng 
Reviewed-by: Max Reitz 
---
 tests/qemu-iotests-quick.sh | 2 +-
 tests/qemu-iotests/check| 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/qemu-iotests-quick.sh b/tests/qemu-iotests-quick.sh
index 12af731..0e554bb 100755
--- a/tests/qemu-iotests-quick.sh
+++ b/tests/qemu-iotests-quick.sh
@@ -3,6 +3,6 @@
 cd tests/qemu-iotests
 
 ret=0
-./check -T -qcow2 -g quick || ret=1
+TEST_DIR=${TEST_DIR:-/tmp/qemu-iotests-quick-$$} ./check -T -qcow2 -g quick || 
ret=1
 
 exit $ret
diff --git a/tests/qemu-iotests/check b/tests/qemu-iotests/check
index 8ca4011..baeae80 100755
--- a/tests/qemu-iotests/check
+++ b/tests/qemu-iotests/check
@@ -238,6 +238,7 @@ QEMU_NBD  -- $QEMU_NBD
 IMGFMT-- $FULL_IMGFMT_DETAILS
 IMGPROTO  -- $FULL_IMGPROTO_DETAILS
 PLATFORM  -- $FULL_HOST_DETAILS
+TEST_DIR  -- $TEST_DIR
 SOCKET_SCM_HELPER -- $SOCKET_SCM_HELPER
 
 EOF
-- 
1.9.3




[Qemu-devel] [PATCH v2 3/3] tests/Makefile: Add check-block to make check

2014-12-14 Thread Fam Zheng
Signed-off-by: Fam Zheng 
---
 tests/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/Makefile b/tests/Makefile
index 16f0e4c..f430b18 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -463,7 +463,7 @@ check-qapi-schema: $(patsubst %,check-%, 
$(check-qapi-schema-y))
 check-qtest: $(patsubst %,check-qtest-%, $(QTEST_TARGETS))
 check-unit: $(patsubst %,check-%, $(check-unit-y))
 check-block: $(patsubst %,check-%, $(check-block-y))
-check: check-qapi-schema check-unit check-qtest
+check: check-qapi-schema check-unit check-qtest check-block
 check-clean:
$(MAKE) -C tests/tcg clean
rm -rf $(check-unit-y) tests/*.o $(QEMU_IOTESTS_HELPERS-y)
-- 
1.9.3