Re: [Qemu-devel] [RFC PATCH v2.1 08/12] spapr: Add CPU type specific core devices

2016-04-08 Thread Michael Roth
Quoting David Gibson (2016-04-03 19:13:54)
> On Fri, Apr 01, 2016 at 11:42:23AM +0530, Bharata B Rao wrote:
> > On Fri, Apr 01, 2016 at 04:08:44PM +1100, David Gibson wrote:
> > > On Thu, Mar 31, 2016 at 02:09:17PM +0530, Bharata B Rao wrote:
> > > > Introduce core devices for each CPU type supported by sPAPR. These
> > > > core devices are derived from the base spapr-cpu-core device type.
> > > > 
> > > > TODO:
> > > > - Add core types for other remaining CPU types
> > > > - Handle CPU model alias correctly
> > > > 
> > > > Signed-off-by: Bharata B Rao 
> > > > ---
> > > >  hw/ppc/spapr.c  |   3 +-
> > > >  hw/ppc/spapr_cpu_core.c | 118 
> > > > 
> > > >  include/hw/ppc/spapr.h  |   1 +
> > > >  include/hw/ppc/spapr_cpu_core.h |  36 
> > > >  4 files changed, 156 insertions(+), 2 deletions(-)
> > > > 
> > > > diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> > > > index 64c4acc..45ac5dc 100644
> > > > --- a/hw/ppc/spapr.c
> > > > +++ b/hw/ppc/spapr.c
> > > > @@ -1614,8 +1614,7 @@ static void spapr_boot_set(void *opaque, const 
> > > > char *boot_device,
> > > >  machine->boot_order = g_strdup(boot_device);
> > > >  }
> > > >  
> > > > -static void spapr_cpu_init(sPAPRMachineState *spapr, PowerPCCPU *cpu,
> > > > -   Error **errp)
> > > > +void spapr_cpu_init(sPAPRMachineState *spapr, PowerPCCPU *cpu, Error 
> > > > **errp)
> > > >  {
> > > >  CPUPPCState *env = &cpu->env;
> > > >  
> > > > diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
> > > > index 8cbe2a5..3751a54 100644
> > > > --- a/hw/ppc/spapr_cpu_core.c
> > > > +++ b/hw/ppc/spapr_cpu_core.c
> > > > @@ -22,9 +22,127 @@ static const TypeInfo spapr_cpu_core_type_info = {
> > > >  .instance_size = sizeof(sPAPRCPUCore),
> > > >  };
> > > >  
> > > > +#define DEFINE_SPAPR_CPU_CORE(_name)   
> > > > \
> > > > +static void
> > > > \
> > > > +glue(_name, _spapr_cpu_core_create_threads)(DeviceState *dev, int 
> > > > threads, \
> > > > +Error **errp)  
> > > > \
> > > > +{  
> > > > \
> > > > +int i; 
> > > > \
> > > > +Error *local_err = NULL;   
> > > > \
> > > > +sPAPRCPUCore *sc = SPAPR_CPU_CORE(OBJECT(dev));
> > > > \
> > > > +glue(_name, sPAPRCPUCore) * core = 
> > > > \
> > > > + glue(_name, _SPAPR_CPU_CORE)(OBJECT(dev));
> > > > \
> > > > +   
> > > > \
> > > > +for (i = 0; i < threads; i++) {
> > > > \
> > > > +char id[32];   
> > > > \
> > > > +   
> > > > \
> > > > +object_initialize(&sc->threads[i], sizeof(sc->threads[i]), 
> > > > \
> > > > +  object_class_get_name(core->cpu));   
> > > > \
> > > > +snprintf(id, sizeof(id), "thread[%d]", i); 
> > > > \
> > > > +object_property_add_child(OBJECT(core), id, 
> > > > OBJECT(&sc->threads[i]),   \
> > > > +  &local_err); 
> > > > \
> > > > +if (local_err) {   
> > > > \
> > > > +goto err;  
> > > > \
> > > > +}  
> > > > \
> > > > +}  
> > > > \
> > > > +return;
> > > > \
> > > > +   
> > > > \
> > > > +err:   
> > > > \
> > > > +while (--i) {  
> > > > \
> > > > +object_unparent(OBJECT(&sc->threads[i]));  
> > > > \
> > > > +}  
> > > > \
> > > > +error_propagate(errp, local_err);  
> > > > \
> > > > +}  
> > > > \
> > > > +

Re: [Qemu-devel] best way to implement emulation of AArch64 tagged addresses

2016-04-08 Thread Thomas Hanson
Looking at tcg_out_tlb_load():
If I'm reading the pseudo-assembler of the function names correctly, it
looks like in the i386 code we're already masking the address being
checked:
tgen_arithi(s, ARITH_AND + trexw, r1, TARGET_PAGE_MASK | (aligned ?
s_mask : 0), 0);
where  TARGET_PAGE_MASK is a simple all-1's mask in the appropriate upper
bits.

Can we just poke some 0's into that mask in the tag locations?  And, of
course, do the same when creating the TLB entry.

Unless of course we're in the case of (TARGET_LONG_BITS >
TCG_TARGET_REG_BITS) (that would be 64 bit on 32 bit right?) when addrhi
gets tested separately. Then we'd have to do the shift as above.

MIPS logic appears similar on a quick read.  In the sparc code I'm not
seeing a pre-existing mask  but it's getting late and my eyes are giving
out.  Those are the only tcg_out_tlb_load() versions I can find.


As to frequency I'm assuming that there are far fewer tagged pointers than
untagged.  But then again I haven't seen a good use case for tagged
pointers.  Would love to hear one.

On 8 April 2016 at 12:10, Richard Henderson  wrote:

> On 04/08/2016 10:20 AM, Tom Hanson wrote:
> > Is it an option to mask off the tag bits in all cases? Is there any case
> > it which those bits are valid address bits?
>
> It's not impossible to mask off bits in the address -- we do that for
> running
> 32-bit on 64-bit all of the time.  It's all a question of how well the
> average
> program will perform, I suppose.
>
> For instance.  Are there more tagged addresses than non-tagged addresses?
> If
> we mask off bits, that will affect *every* memory operation.  If tagged
> addresses are rare, then that is a waste.  If tagged addresses are common,
> however, then we may well spend too much time ping-ponging in the TLB.
>
> The fastest method I can think of to ignore high order bits is to shift the
> address comparator left.  The TLB comparator would be stored pre-shifted,
> so
> this would add only one insn on the fast path.  Or perhaps zero in the
> case of
> an arm/aarch64 host, where the compare insn itself can perform the shift.
>
> Of course, a double-word shift would be completely out of the question when
> doing 64-bit on 32-bit emulation.  But we don't need that -- just shift the
> high part of the address left to discard bits, leaving a funny looking
> hole in
> the middle of the comparator.
>
> This is simple enough that it should be relatively easy to patch up all of
> the
> tcg backends to match, if we decide to go with it.
>
>
> r~
>
>


Re: [Qemu-devel] [RFC PATCH v2.1 09/12] spapr: convert boot CPUs into CPU core devices

2016-04-08 Thread Michael Roth
Quoting Bharata B Rao (2016-03-31 03:39:18)
> Introduce sPAPRMachineClass.dr_cpu_enabled to indicate support for
> CPU core hotplug. Initialize boot time CPUs as core deivces and prevent
> topologies that result in partially filled cores. Both of these are done
> only if CPU core hotplug is supported.
> 
> Note: An unrelated change in the call to xics_system_init() is done
> in this patch as it makes sense to use the local variable smt introduced
> in this patch instead of kvmppc_smt_threads() call here.
> 
> Signed-off-by: Bharata B Rao 
> ---
>  hw/ppc/spapr.c  | 73 
> +++--
>  hw/ppc/spapr_cpu_core.c | 45 +
>  include/hw/ppc/spapr.h  |  2 ++
>  include/hw/ppc/spapr_cpu_core.h |  3 ++
>  4 files changed, 113 insertions(+), 10 deletions(-)
> 
> diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> index 45ac5dc..1ead043 100644
> --- a/hw/ppc/spapr.c
> +++ b/hw/ppc/spapr.c
> @@ -64,6 +64,7 @@
> 
>  #include "hw/compat.h"
>  #include "qemu-common.h"
> +#include "hw/ppc/spapr_cpu_core.h"
> 
>  #include 
> 
> @@ -1614,6 +1615,10 @@ static void spapr_boot_set(void *opaque, const char 
> *boot_device,
>  machine->boot_order = g_strdup(boot_device);
>  }
> 
> +/*
> + * TODO: Check if some of these can be moved to rtas_start_cpu() where
> + * a few other things required for hotplugged CPUs are being done.
> + */
>  void spapr_cpu_init(sPAPRMachineState *spapr, PowerPCCPU *cpu, Error **errp)
>  {
>  CPUPPCState *env = &cpu->env;
> @@ -1644,6 +1649,7 @@ void spapr_cpu_init(sPAPRMachineState *spapr, 
> PowerPCCPU *cpu, Error **errp)
>  xics_cpu_setup(spapr->icp, cpu);
> 
>  qemu_register_reset(spapr_cpu_reset, cpu);
> +spapr_cpu_reset(cpu);
>  }
> 
>  /*
> @@ -1727,7 +1733,6 @@ static void ppc_spapr_init(MachineState *machine)
>  const char *kernel_filename = machine->kernel_filename;
>  const char *kernel_cmdline = machine->kernel_cmdline;
>  const char *initrd_filename = machine->initrd_filename;
> -PowerPCCPU *cpu;
>  PCIHostState *phb;
>  int i;
>  MemoryRegion *sysmem = get_system_memory();
> @@ -1741,6 +1746,22 @@ static void ppc_spapr_init(MachineState *machine)
>  long load_limit, fw_size;
>  bool kernel_le = false;
>  char *filename;
> +int smt = kvmppc_smt_threads();
> +int spapr_cores = smp_cpus / smp_threads;
> +int spapr_max_cores = max_cpus / smp_threads;
> +
> +if (smc->dr_cpu_enabled) {
> +if (smp_cpus % smp_threads) {
> +error_report("smp_cpus (%u) must be multiple of threads (%u)",
> + smp_cpus, smp_threads);
> +exit(1);
> +}
> +if (max_cpus % smp_threads) {
> +error_report("max_cpus (%u) must be multiple of threads (%u)",
> + max_cpus, smp_threads);
> +exit(1);
> +}
> +}
> 
>  msi_supported = true;
> 
> @@ -1787,8 +1808,7 @@ static void ppc_spapr_init(MachineState *machine)
> 
>  /* Set up Interrupt Controller before we create the VCPUs */
>  spapr->icp = xics_system_init(machine,
> -  DIV_ROUND_UP(max_cpus * 
> kvmppc_smt_threads(),
> -   smp_threads),
> +  DIV_ROUND_UP(max_cpus * smt, smp_threads),
>XICS_IRQS, &error_fatal);
> 
>  if (smc->dr_lmb_enabled) {
> @@ -1799,13 +1819,34 @@ static void ppc_spapr_init(MachineState *machine)
>  if (machine->cpu_model == NULL) {
>  machine->cpu_model = kvm_enabled() ? "host" : "POWER7";
>  }
> -for (i = 0; i < smp_cpus; i++) {
> -cpu = cpu_ppc_init(machine->cpu_model);
> -if (cpu == NULL) {
> -error_report("Unable to find PowerPC CPU definition");
> -exit(1);
> +
> +if (smc->dr_cpu_enabled) {
> +spapr->cores = g_new0(Object *, spapr_max_cores);
> +
> +for (i = 0; i < spapr_max_cores; i++) {
> +int core_dt_id = i * smt;
> +
> +if (i < spapr_cores) {

Is there any reason to not just have the for() loop stop at spapr_cores?
Maybe I missed something in the subsequent patches, but it seems like we
never end up doing anything beyond i < spapr_cores.

> +char *type = spapr_get_cpu_core_type(machine->cpu_model);
> +Object *core  = object_new(type);
> +
> +g_free(type);
> +object_property_set_int(core, smp_threads, "threads",
> +&error_fatal);
> +object_property_set_int(core, core_dt_id, CPU_CORE_PROP_CORE,
> +&error_fatal);
> +object_property_set_bool(core, true, "realized", 
> &error_fatal);
> +}
>  }
> -spapr_cpu_init(spapr, cpu, &error_fatal);
> +} else {
> +for (i = 0; i < smp_cpus; i++) {
> + 

Re: [Qemu-devel] [RFC PATCH v2.1 11/12] xics, xics_kvm: Handle CPU unplug correctly

2016-04-08 Thread Michael Roth
Quoting David Gibson (2016-04-05 19:43:46)
> On Tue, Apr 05, 2016 at 07:24:39PM -0500, Michael Roth wrote:
> > Quoting Bharata B Rao (2016-03-31 03:39:20)
> > > XICS is setup for each CPU during initialization. Provide a routine
> > > to undo the same when CPU is unplugged. While here, move ss->cs management
> > > into xics from xics_kvm since there is nothing KVM specific in it.
> > > Also ensure xics reset doesn't set irq for CPUs that are already 
> > > unplugged.
> > > 
> > > This allows reboot of a VM that has undergone CPU hotplug and unplug
> > > to work correctly.
> > > 
> > > Signed-off-by: Bharata B Rao 
> > > Reviewed-by: David Gibson 
> > > ---
> > >  hw/intc/xics.c| 14 ++
> > >  hw/intc/xics_kvm.c|  8 
> > >  include/hw/ppc/xics.h |  1 +
> > >  3 files changed, 19 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/hw/intc/xics.c b/hw/intc/xics.c
> > > index 213a370..9fdb551 100644
> > > --- a/hw/intc/xics.c
> > > +++ b/hw/intc/xics.c
> > > @@ -45,6 +45,18 @@ static int get_cpu_index_by_dt_id(int cpu_dt_id)
> > >  return -1;
> > >  }
> > > 
> > > +void xics_cpu_destroy(XICSState *icp, PowerPCCPU *cpu)
> > > +{
> > > +CPUState *cs = CPU(cpu);
> > > +ICPState *ss = &icp->ss[cs->cpu_index];
> > > +
> > 
> > If the following assertion is false, I think you'd get an OOB before you
> > reached it due to the assignment above.
> 
> It should be ok.  The assignment above will compute an out of bounds
> address, but it doesn't dereference it.

Ahh, right. I was thinking there was an actual access for some reason.

I might still prefer moving the assignment after the assert from a
stylistic standpoint, in case other variables get introduced in the
future that rely on *ss. Just a nit though.

> 
> > > +assert(cs->cpu_index < icp->nr_servers);
> > > +assert(cs == ss->cs);
> > > +
> > > +ss->output = NULL;
> > > +ss->cs = NULL;
> > > +}
> > > +
> > 
> 
> -- 
> David Gibson| I'll have my music baroque, and my code
> david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
> | _way_ _around_!
> http://www.ozlabs.org/~dgibson




Re: [Qemu-devel] [RFC PATCH v2.1 08/12] spapr: Add CPU type specific core devices

2016-04-08 Thread Michael Roth
Quoting Bharata B Rao (2016-03-31 03:39:17)
> Introduce core devices for each CPU type supported by sPAPR. These
> core devices are derived from the base spapr-cpu-core device type.
> 
> TODO:
> - Add core types for other remaining CPU types
> - Handle CPU model alias correctly
> 
> Signed-off-by: Bharata B Rao 
> ---
>  hw/ppc/spapr.c  |   3 +-
>  hw/ppc/spapr_cpu_core.c | 118 
> 
>  include/hw/ppc/spapr.h  |   1 +
>  include/hw/ppc/spapr_cpu_core.h |  36 
>  4 files changed, 156 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> index 64c4acc..45ac5dc 100644
> --- a/hw/ppc/spapr.c
> +++ b/hw/ppc/spapr.c
> @@ -1614,8 +1614,7 @@ static void spapr_boot_set(void *opaque, const char 
> *boot_device,
>  machine->boot_order = g_strdup(boot_device);
>  }
> 
> -static void spapr_cpu_init(sPAPRMachineState *spapr, PowerPCCPU *cpu,
> -   Error **errp)
> +void spapr_cpu_init(sPAPRMachineState *spapr, PowerPCCPU *cpu, Error **errp)
>  {
>  CPUPPCState *env = &cpu->env;
> 
> diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
> index 8cbe2a5..3751a54 100644
> --- a/hw/ppc/spapr_cpu_core.c
> +++ b/hw/ppc/spapr_cpu_core.c
> @@ -22,9 +22,127 @@ static const TypeInfo spapr_cpu_core_type_info = {
>  .instance_size = sizeof(sPAPRCPUCore),
>  };
> 
> +#define DEFINE_SPAPR_CPU_CORE(_name) 
>   \
> +static void  
>   \
> +glue(_name, _spapr_cpu_core_create_threads)(DeviceState *dev, int threads,   
>   \
> +Error **errp)
>   \
> +{
>   \
> +int i;   
>   \
> +Error *local_err = NULL; 
>   \
> +sPAPRCPUCore *sc = SPAPR_CPU_CORE(OBJECT(dev));  
>   \
> +glue(_name, sPAPRCPUCore) * core =   
>   \
> + glue(_name, _SPAPR_CPU_CORE)(OBJECT(dev));  
>   \
> + 
>   \
> +for (i = 0; i < threads; i++) {  
>   \
> +char id[32]; 
>   \
> + 
>   \
> +object_initialize(&sc->threads[i], sizeof(sc->threads[i]),   
>   \
> +  object_class_get_name(core->cpu)); 
>   \
> +snprintf(id, sizeof(id), "thread[%d]", i);   
>   \
> +object_property_add_child(OBJECT(core), id, OBJECT(&sc->threads[i]), 
>   \
> +  &local_err);   
>   \
> +if (local_err) { 
>   \
> +goto err;
>   \
> +}
>   \
> +}
>   \
> +return;  
>   \
> + 
>   \
> +err: 
>   \
> +while (--i) {
>   \
> +object_unparent(OBJECT(&sc->threads[i]));
>   \
> +}
>   \
> +error_propagate(errp, local_err);
>   \
> +}
>   \
> + 
>   \
> +static int   
>   \
> +glue(_name, _spapr_cpu_core_realize_child)(Object *child, void *opaque)  
>   \
> +{
>   \
> +Error **errp = opaque;   
>   \
> +sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
>   \
> +CPUState *cs = CPU(child);   
>   \
> +PowerPCCPU *cpu = POWERPC_CPU(cs);   
>   \
> + 
>   \
> +object_property_set_bool(child, true, "realized", errp); 
>   \
> +if (*errp) { 

[Qemu-devel] [Bug 1563887] Re: qemu-system-ppc64 freezes on starting image on ppc64le

2016-04-08 Thread Alberto Salvia Novella
** Changed in: linux (Ubuntu)
   Importance: Undecided => High

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1563887

Title:
  qemu-system-ppc64 freezes on starting image on ppc64le

Status in QEMU:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed
Status in livecd-rootfs package in Ubuntu:
  Invalid
Status in qemu package in Ubuntu:
  Confirmed

Bug description:
  qemu-system-ppc64 running on Ubuntu 16.04 beta-2 fails to start an
  image as part of the certification process. This on an IBM ppc64le in
  PowerVM mode running Ubuntu 16.04 beta-2 deployed by MAAS 1.9.1. There
  is no error output.

  ubuntu@alpine01:~/kvm$ qemu-system-ppc64 -m 256 -display none -nographic -net 
nic -net user,net=10.0.0.0/8,host=10.0.0.1,hostfwd=tcp::-:22 -machine 
pseries -drive file=xenial-server-cloudimg-ppc64el-disk1.img,if=virtio -drive 
file=seed.iso,if=virtio
  WARNING: Image format was not specified for 'seed.iso' and probing guessed 
raw.
   Automatically detecting the format is dangerous for raw images, 
write operations on block 0 will be restricted.
   Specify the 'raw' format explicitly to remove the restrictions.

  SLOF **
  QEMU Starting
   Build Date = Jan 29 2016 18:58:37
   FW Version = buildd@ release 20151103
   Press "s" to enter Open Firmware.

  Populating /vdevice methods
  Populating /vdevice/vty@7100
  Populating /vdevice/nvram@7101
  Populating /vdevice/l-lan@7102
  Populating /vdevice/v-scsi@7103
     SCSI: Looking for devices
    8200 CD-ROM   : "QEMU QEMU CD-ROM  2.5+"
  Populating /pci@8002000
   00 1800 (D) : 1af4 1001virtio [ block ]
   00 1000 (D) : 1af4 1001virtio [ block ]
   00 0800 (D) : 106b 003fserial bus [ usb-ohci ]
   00  (D) : 1234 qemu vga
  No NVRAM common partition, re-initializing...
  Installing QEMU fb

  Scanning USB
    OHCI: initializing
  USB Keyboard
  USB mouse
  No console specified using screen & keyboard

    Welcome to Open Firmware

    Copyright (c) 2004, 2011 IBM Corporation All rights reserved.
    This program and the accompanying materials are made available
    under the terms of the BSD License available at
    http://www.opensource.org/licenses/bsd-license.php

  Trying to load:  from: /pci@8002000/scsi@3 ...
  E3404: Not a bootable device!
  Trying to load:  from: /pci@8002000/scsi@2 ...   Successfully loaded
  Linux ppc64le
  #31-Ubuntu SMP F

  ProblemType: Bug
  DistroRelease: Ubuntu 16.04
  Package: qemu-system-ppc 1:2.5+dfsg-5ubuntu6
  ProcVersionSignature: Ubuntu 4.4.0-16.32-generic 4.4.6
  Uname: Linux 4.4.0-16-generic ppc64le
  ApportVersion: 2.20-0ubuntu3
  Architecture: ppc64el
  Date: Wed Mar 30 14:10:01 2016
  KvmCmdLine:
   COMMAND STAT  EUID  RUID   PID  PPID %CPU COMMAND
   kvm-irqfd-clean S<   0 0  1172 2  0.0 [kvm-irqfd-clean]
   qemu-nbdSsl  0 0 13467 1  0.0 qemu-nbd -c /dev/nbd0 
xenial-server-cloudimg-ppc64el-disk1.img
   qemu-system-ppc Sl+   1000  1000 18973 18896  101 qemu-system-ppc64 -m 256 
-display none -nographic -net nic -net 
user,net=10.0.0.0/8,host=10.0.0.1,hostfwd=tcp::-:22 -machine pseries -drive 
file=xenial-server-cloudimg-ppc64el-disk1.img,if=virtio -drive 
file=seed.iso,if=virtio
  Lsusb: Error: command ['lsusb'] failed with exit code 1:
  ProcEnviron:
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinux-4.4.0-16-generic 
root=UUID=92d820c8-ab25-497b-9b1e-f1435992bbf3 ro
  ProcLoadAvg: 1.08 0.94 0.58 2/616 19571
  ProcLocks:
   1: POSIX  ADVISORY  WRITE 886 00:13:381 0 EOF
   2: POSIX  ADVISORY  WRITE 1339 00:13:528 0 EOF
   3: FLOCK  ADVISORY  WRITE 1284 00:13:522 0 EOF
   4: POSIX  ADVISORY  WRITE 2281 00:13:563 0 EOF
   5: POSIX  ADVISORY  WRITE 1331 00:13:536 0 EOF
  ProcSwaps:
   Filename TypeSizeUsedPriority
   /swap.img   file 8388544 0   -1
  ProcVersion: Linux version 4.4.0-16-generic (buildd@bos01-ppc64el-001) (gcc 
version 5.3.1 20160320 (Ubuntu/Linaro/IBM 5.3.1-12ubuntu4) ) #32-Ubuntu SMP Thu 
Mar 24 22:31:14 UTC 2016
  SourcePackage: qemu
  UpgradeStatus: No upgrade log present (probably fresh install)
  bootlist:
   /pci@8002011/pci1014,034A@0/sas/disk@4068402c40
   
/pci@8002018/ethernet@0:speed=auto,duplex=auto,csarch,000.000.000.000,,000.000.000.000,000.000.000.000,5,5,000.000.000.000,512
   
/pci@8002018/ethernet@0,1:speed=auto,duplex=auto,csarch,000.000.000.000,,000.000.000.000,000.000.000.000,5,5,000.000.000.000,512
   
/pci@8002018/ethernet@0,2:speed=auto,duplex=auto,csarch,000.000.000.000,,000.

[Qemu-devel] [PATCH 07/18] nbd: Treat flags vs. command type as separate fields

2016-04-08 Thread Eric Blake
Current upstream NBD documents that requests have a 16-bit flags,
followed by a 16-bit type integer; although older versions mentioned
only a 32-bit field with masking to find flags.  Since the protocol
is in network order (big-endian over the wire), the ABI is unchanged;
but dealing with the flags as a separate field rather than masking
will make it easier to add support for upcoming NBD extensions that
increase the number of both flags and commands.

Improve some comments in nbd.h based on the current upstream
NBD protocol (https://github.com/yoe/nbd/blob/master/doc/proto.md),
and touch some nearby code to keep checkpatch.pl happy.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h | 18 --
 nbd/nbd-internal.h  |  4 ++--
 block/nbd-client.c  |  9 +++--
 nbd/client.c| 17 ++---
 nbd/server.c| 35 +++
 5 files changed, 46 insertions(+), 37 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index 3f047bf..2c61901 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -1,4 +1,5 @@
 /*
+ *  Copyright (C) 2016 Red Hat, Inc.
  *  Copyright (C) 2005  Anthony Liguori 
  *
  *  Network Block Device
@@ -27,7 +28,8 @@

 struct nbd_request {
 uint32_t magic;
-uint32_t type;
+uint16_t flags;
+uint16_t type;
 uint64_t handle;
 uint64_t from;
 uint32_t len;
@@ -39,6 +41,8 @@ struct nbd_reply {
 uint64_t handle;
 } QEMU_PACKED;

+/* Transmission (export) flags: sent from server to client during handshake,
+   but describe what will happen during transmission */
 #define NBD_FLAG_HAS_FLAGS  (1 << 0)/* Flags are there */
 #define NBD_FLAG_READ_ONLY  (1 << 1)/* Device is read-only */
 #define NBD_FLAG_SEND_FLUSH (1 << 2)/* Send FLUSH */
@@ -46,10 +50,12 @@ struct nbd_reply {
 #define NBD_FLAG_ROTATIONAL (1 << 4)/* Use elevator algorithm - 
rotational media */
 #define NBD_FLAG_SEND_TRIM  (1 << 5)/* Send TRIM (discard) */

-/* New-style global flags. */
+/* New-style handshake (global) flags, sent from server to client, and
+   control what will happen during handshake phase. */
 #define NBD_FLAG_FIXED_NEWSTYLE (1 << 0)/* Fixed newstyle protocol. */

-/* New-style client flags. */
+/* New-style client flags, sent from client to server to control what happens
+   during handshake phase. */
 #define NBD_FLAG_C_FIXED_NEWSTYLE   (1 << 0)/* Fixed newstyle protocol. */

 /* Reply types. */
@@ -60,10 +66,10 @@ struct nbd_reply {
 #define NBD_REP_ERR_INVALID ((UINT32_C(1) << 31) | 3) /* Invalid length. */
 #define NBD_REP_ERR_TLS_REQD((UINT32_C(1) << 31) | 5) /* TLS required */

+/* Request flags, sent from client to server during transmission phase */
+#define NBD_CMD_FLAG_FUA(1 << 0)

-#define NBD_CMD_MASK_COMMAND   0x
-#define NBD_CMD_FLAG_FUA   (1 << 16)
-
+/* Supported request types */
 enum {
 NBD_CMD_READ = 0,
 NBD_CMD_WRITE = 1,
diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
index 3791535..b663bf3 100644
--- a/nbd/nbd-internal.h
+++ b/nbd/nbd-internal.h
@@ -52,10 +52,10 @@
 /* This is all part of the "official" NBD API.
  *
  * The most up-to-date documentation is available at:
- * https://github.com/yoe/nbd/blob/master/doc/proto.txt
+ * https://github.com/yoe/nbd/blob/master/doc/proto.md
  */

-#define NBD_REQUEST_SIZE(4 + 4 + 8 + 8 + 4)
+#define NBD_REQUEST_SIZE(4 + 2 + 2 + 8 + 8 + 4)
 #define NBD_REPLY_SIZE  (4 + 4 + 8)
 #define NBD_REQUEST_MAGIC   0x25609513
 #define NBD_REPLY_MAGIC 0x67446698
diff --git a/block/nbd-client.c b/block/nbd-client.c
index 878e879..285025d 100644
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -1,6 +1,7 @@
 /*
  * QEMU Block driver for  NBD
  *
+ * Copyright (C) 2016 Red Hat, Inc.
  * Copyright (C) 2008 Bull S.A.S.
  * Author: Laurent Vivier 
  *
@@ -252,7 +253,7 @@ static int nbd_co_writev_1(BlockDriverState *bs, int64_t 
sector_num,

 if ((*flags & BDRV_REQ_FUA) && (client->nbdflags & NBD_FLAG_SEND_FUA)) {
 *flags &= ~BDRV_REQ_FUA;
-request.type |= NBD_CMD_FLAG_FUA;
+request.flags |= NBD_CMD_FLAG_FUA;
 }

 request.from = sector_num * 512;
@@ -376,11 +377,7 @@ void nbd_client_attach_aio_context(BlockDriverState *bs,
 void nbd_client_close(BlockDriverState *bs)
 {
 NbdClientSession *client = nbd_get_client_session(bs);
-struct nbd_request request = {
-.type = NBD_CMD_DISC,
-.from = 0,
-.len = 0
-};
+struct nbd_request request = { .type = NBD_CMD_DISC };

 if (client->ioc == NULL) {
 return;
diff --git a/nbd/client.c b/nbd/client.c
index 00f9244..7fd6059 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -1,4 +1,5 @@
 /*
+ *  Copyright (C) 2016 Red Hat, Inc.
  *  Copyright (C) 2005  Anthony Liguori 
  *
  *  Network Block Device Client Side
@@ -688,14 +689,16 @@ ssize_t nbd_send_request(QIOChannel *ioc, struct 
nbd_reque

[Qemu-devel] [PATCH 09/18] nbd: Share common reply-sending code in server

2016-04-08 Thread Eric Blake
Rather than open-coding NBD_REP_SERVER, reuse the code we
already have by adding a length parameter.  The code gets
longer because of added comments, but the refactoring will
make adding NBD_OPT_GO in a later patch easier.

Signed-off-by: Eric Blake 
---
 nbd/server.c | 59 +--
 1 file changed, 29 insertions(+), 30 deletions(-)

diff --git a/nbd/server.c b/nbd/server.c
index c8666ab..69724c9 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -192,12 +192,15 @@ static ssize_t nbd_negotiate_drop_sync(QIOChannel *ioc, 
size_t size)

 */

-static int nbd_negotiate_send_rep(QIOChannel *ioc, uint32_t type, uint32_t opt)
+/* Send a reply header, including length, but no payload.
+ * Return -errno to kill connection, 0 to continue negotiation */
+static int nbd_negotiate_send_rep_len(QIOChannel *ioc, uint32_t type,
+  uint32_t opt, uint32_t len)
 {
 uint64_t magic;
-uint32_t len;

-TRACE("Reply opt=%" PRIx32 " type=%" PRIx32, type, opt);
+TRACE("Reply opt=%" PRIx32 " type=%" PRIx32 " len=%" PRIu32,
+  type, opt, len);

 magic = cpu_to_be64(NBD_REP_MAGIC);
 if (nbd_negotiate_write(ioc, &magic, sizeof(magic)) != sizeof(magic)) {
@@ -214,7 +217,7 @@ static int nbd_negotiate_send_rep(QIOChannel *ioc, uint32_t 
type, uint32_t opt)
 LOG("write failed (rep type)");
 return -EINVAL;
 }
-len = cpu_to_be32(0);
+len = cpu_to_be32(len);
 if (nbd_negotiate_write(ioc, &len, sizeof(len)) != sizeof(len)) {
 LOG("write failed (rep data length)");
 return -EINVAL;
@@ -222,39 +225,35 @@ static int nbd_negotiate_send_rep(QIOChannel *ioc, 
uint32_t type, uint32_t opt)
 return 0;
 }

+/* Send a reply header with default 0 length.
+ * Return -errno to kill connection, 0 to continue negotiation */
+static int nbd_negotiate_send_rep(QIOChannel *ioc, uint32_t type, uint32_t opt)
+{
+return nbd_negotiate_send_rep_len(ioc, type, opt, 0);
+}
+
+/* Send an NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
+ * Return -errno to kill connection, 0 to continue negotiation */
 static int nbd_negotiate_send_rep_list(QIOChannel *ioc, NBDExport *exp)
 {
-uint64_t magic, name_len;
-uint32_t opt, type, len;
+uint32_t len;
+int rc;

 TRACE("Advertising export name '%s'", exp->name ? exp->name : "");
-name_len = strlen(exp->name);
-magic = cpu_to_be64(NBD_REP_MAGIC);
-if (nbd_negotiate_write(ioc, &magic, sizeof(magic)) != sizeof(magic)) {
-LOG("write failed (magic)");
-return -EINVAL;
- }
-opt = cpu_to_be32(NBD_OPT_LIST);
-if (nbd_negotiate_write(ioc, &opt, sizeof(opt)) != sizeof(opt)) {
-LOG("write failed (opt)");
-return -EINVAL;
-}
-type = cpu_to_be32(NBD_REP_SERVER);
-if (nbd_negotiate_write(ioc, &type, sizeof(type)) != sizeof(type)) {
-LOG("write failed (reply type)");
-return -EINVAL;
-}
-len = cpu_to_be32(name_len + sizeof(len));
-if (nbd_negotiate_write(ioc, &len, sizeof(len)) != sizeof(len)) {
-LOG("write failed (length)");
-return -EINVAL;
-}
-len = cpu_to_be32(name_len);
+len = strlen(exp->name);
+rc = nbd_negotiate_send_rep_len(ioc, NBD_REP_SERVER, NBD_OPT_LIST,
+len + sizeof(len));
+if (rc < 0) {
+return rc;
+}
+
+len = cpu_to_be32(len);
 if (nbd_negotiate_write(ioc, &len, sizeof(len)) != sizeof(len)) {
-LOG("write failed (length)");
+LOG("write failed (name length)");
 return -EINVAL;
 }
-if (nbd_negotiate_write(ioc, exp->name, name_len) != name_len) {
+len = be32_to_cpu(len);
+if (nbd_negotiate_write(ioc, exp->name, len) != len) {
 LOG("write failed (buffer)");
 return -EINVAL;
 }
-- 
2.5.5




[Qemu-devel] [RFC PATCH 17/18] nbd: Implement NBD_CMD_WRITE_ZEROES on server

2016-04-08 Thread Eric Blake
RFC because there is still discussion on the NBD list about
adding an NBD_OPT_ to let the client suggest server defaults
related to scanning for zeroes during NBD_CMD_WRITE, which may
tweak this patch.

Upstream NBD protocol recently added the ability to efficiently
write zeroes without having to send the zeroes over the wire,
along with a flag to control whether the client wants a hole.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h |  5 -
 nbd/server.c| 63 ++---
 2 files changed, 64 insertions(+), 4 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index 4c57754..a1d955c 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -70,6 +70,7 @@ typedef struct nbd_reply nbd_reply;
 #define NBD_FLAG_SEND_FUA   (1 << 3)/* Send FUA (Force Unit 
Access) */
 #define NBD_FLAG_ROTATIONAL (1 << 4)/* Use elevator algorithm - 
rotational media */
 #define NBD_FLAG_SEND_TRIM  (1 << 5)/* Send TRIM (discard) */
+#define NBD_FLAG_SEND_WRITE_ZEROES (1 << 6) /* Send WRITE_ZEROES */
 #define NBD_FLAG_SEND_CLOSE (1 << 8)/* Send CLOSE */

 /* New-style handshake (global) flags, sent from server to client, and
@@ -92,7 +93,8 @@ typedef struct nbd_reply nbd_reply;
 #define NBD_REP_ERR_UNKNOWN ((UINT32_C(1) << 31) | 6) /* Export unknown */

 /* Request flags, sent from client to server during transmission phase */
-#define NBD_CMD_FLAG_FUA(1 << 0)
+#define NBD_CMD_FLAG_FUA(1 << 0) /* 'force unit access' during write */
+#define NBD_CMD_FLAG_NO_HOLE(1 << 1) /* don't punch hole on zero run */

 /* Supported request types */
 enum {
@@ -101,6 +103,7 @@ enum {
 NBD_CMD_DISC = 2,
 NBD_CMD_FLUSH = 3,
 NBD_CMD_TRIM = 4,
+NBD_CMD_WRITE_ZEROES = 5,
 NBD_CMD_CLOSE = 7,
 };

diff --git a/nbd/server.c b/nbd/server.c
index 2a6eaf2..09af915 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -625,7 +625,8 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)
 int rc;
 const uint16_t myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
   NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA |
-  NBD_FLAG_SEND_CLOSE);
+  NBD_FLAG_SEND_CLOSE |
+  NBD_FLAG_SEND_WRITE_ZEROES);
 bool oldStyle;
 size_t len;

@@ -1088,7 +1089,7 @@ static ssize_t nbd_co_receive_request(NBDRequest *req, 
struct nbd_request *reque
 goto out;
 }

-if (request->flags & ~NBD_CMD_FLAG_FUA) {
+if (request->flags & ~(NBD_CMD_FLAG_FUA | NBD_CMD_FLAG_NO_HOLE)) {
 LOG("unsupported flags (got 0x%x)", request->flags);
 return -EINVAL;
 }
@@ -1102,7 +1103,13 @@ static ssize_t nbd_co_receive_request(NBDRequest *req, 
struct nbd_request *reque
 TRACE("Decoding type");

 command = request->type;
-if (command == NBD_CMD_READ || command == NBD_CMD_WRITE) {
+if (request->flags & NBD_CMD_FLAG_NO_HOLE &&
+!(command == NBD_CMD_WRITE || command == NBD_CMD_WRITE_ZEROES)) {
+LOG("NO_HOLE flag valid only with write operation");
+return -EINVAL;
+}
+if (command == NBD_CMD_READ || command == NBD_CMD_WRITE ||
+command == NBD_CMD_WRITE_ZEROES) {
 if (request->len > NBD_MAX_BUFFER_SIZE) {
 LOG("len (%" PRIu32" ) is larger than max len (%u)",
 request->len, NBD_MAX_BUFFER_SIZE);
@@ -1143,6 +1150,7 @@ static void nbd_trip(void *opaque)
 struct nbd_reply reply;
 ssize_t ret;
 uint32_t command;
+int flags;

 TRACE("Reading request.");
 if (client->closing) {
@@ -1221,6 +1229,9 @@ static void nbd_trip(void *opaque)

 TRACE("Writing to device");

+/* FIXME: if the client passes NBD_CMD_FLAG_NO_HOLE, can we
+ * make that override a server that is set to look for
+ * holes? */
 ret = blk_write(exp->blk,
 (request.from + exp->dev_offset) / BDRV_SECTOR_SIZE,
 req->data, request.len / BDRV_SECTOR_SIZE);
@@ -1243,6 +1254,52 @@ static void nbd_trip(void *opaque)
 goto out;
 }
 break;
+case NBD_CMD_WRITE_ZEROES:
+TRACE("Request type is WRITE_ZEROES");
+
+if (exp->nbdflags & NBD_FLAG_READ_ONLY) {
+TRACE("Server is read-only, return error");
+reply.error = EROFS;
+goto error_reply;
+}
+
+TRACE("Writing to device");
+
+flags = 0;
+if (request.flags & NBD_CMD_FLAG_FUA) {
+flags |= BDRV_REQ_FUA;
+}
+if (!(request.flags & NBD_CMD_FLAG_NO_HOLE)) {
+/* FIXME: should this depend on whether the server is set to
+   look for holes? */
+flags |= BDRV_REQ_MAY_UNMAP;
+}
+ret = blk_write_zeroes(exp->blk,
+   ((request.from + exp->dev_offset) /
+  

[Qemu-devel] [PATCH 11/18] nbd: Let client skip portions of server reply

2016-04-08 Thread Eric Blake
The server has a nice helper function nbd_negotiate_drop_sync()
which lets it easily ignore fluff from the client (such as the
payload to an unknown option request).  We can't quite make it
common, since it depends on nbd_negotiate_read() which handles
coroutine magic, but we can copy the idea into the client where
we have places where we want to ignore data (such as the
description tacked on the end of NBD_REP_SERVER).

Signed-off-by: Eric Blake 
---
 nbd/client.c | 45 -
 1 file changed, 32 insertions(+), 13 deletions(-)

diff --git a/nbd/client.c b/nbd/client.c
index 07b8d2e..b2dfc11 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -75,6 +75,32 @@ static QTAILQ_HEAD(, NBDExport) exports = 
QTAILQ_HEAD_INITIALIZER(exports);

 */

+/* Discard length bytes from channel.  Return -errno on failure, or
+ * the amount of bytes consumed. */
+static ssize_t drop_sync(QIOChannel *ioc, size_t size)
+{
+ssize_t ret, dropped = size;
+char small[1024];
+char *buffer;
+
+buffer = sizeof(small) < size ? small : g_malloc(MIN(65536, size));
+while (size > 0) {
+ret = read_sync(ioc, buffer, MIN(65536, size));
+if (ret < 0) {
+goto cleanup;
+}
+assert(ret <= size);
+size -= ret;
+}
+ret = dropped;
+
+ cleanup:
+if (buffer != small) {
+g_free(buffer);
+}
+return ret;
+}
+
 /* Send an option request. Return 0 if successful, -1 with errp set if
  * it is impossible to continue. */
 static int nbd_send_option_request(QIOChannel *ioc, uint32_t opt,
@@ -255,18 +281,11 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 }
 (*name)[namelen] = '\0';
 len -= namelen;
-if (len) {
-char *buf = g_malloc(len + 1);
-if (read_sync(ioc, buf, len) != len) {
-error_setg(errp, "failed to read export description");
-g_free(*name);
-g_free(buf);
-*name = NULL;
-return -1;
-}
-buf[len] = '\0';
-TRACE("Ignoring export description: %s", buf);
-g_free(buf);
+if (drop_sync(ioc, len) != len) {
+error_setg(errp, "failed to read export description");
+g_free(*name);
+*name = NULL;
+return -1;
 }
 } else {
 error_setg(errp, "Unexpected reply type %" PRIx32 " expected %x",
@@ -539,7 +558,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char 
*name, uint32_t *flags,
 goto fail;
 }

-if (read_sync(ioc, &buf, 124) != 124) {
+if (drop_sync(ioc, 124) != 124) {
 error_setg(errp, "Failed to read reserved block");
 goto fail;
 }
-- 
2.5.5




[Qemu-devel] [PATCH 16/18] nbd: Support NBD_CMD_CLOSE

2016-04-08 Thread Eric Blake
NBD_CMD_DISC is annoying: the server is not required to reply,
so the client has no choice but to disconnect once it has sent
the message; but depending on timing, the server can see the
disconnect prior to reading the request, and treat things as
an abrupt exit rather than a clean shutdown (which may affect
whether the server properly fsync()s data to disk, and so on).
The new NBD_CMD_CLOSE adds another round of handshake, where
the client waits for the server's action before closing, to
make sure both parties know that it was a clean close rather
than an accidental early disconnect.

In nbd-client.c, nbd_client_close() is called after we have
already exited the normal coroutine context used by all the
other transmission phase handlers, so the code is a bit more
complex to build up a coroutine just for the purpose of waiting
for the server's response.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h |  4 +++-
 block/nbd-client.c  | 45 -
 nbd/server.c| 19 +--
 3 files changed, 64 insertions(+), 4 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index d261dbc..4c57754 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -70,6 +70,7 @@ typedef struct nbd_reply nbd_reply;
 #define NBD_FLAG_SEND_FUA   (1 << 3)/* Send FUA (Force Unit 
Access) */
 #define NBD_FLAG_ROTATIONAL (1 << 4)/* Use elevator algorithm - 
rotational media */
 #define NBD_FLAG_SEND_TRIM  (1 << 5)/* Send TRIM (discard) */
+#define NBD_FLAG_SEND_CLOSE (1 << 8)/* Send CLOSE */

 /* New-style handshake (global) flags, sent from server to client, and
control what will happen during handshake phase. */
@@ -99,7 +100,8 @@ enum {
 NBD_CMD_WRITE = 1,
 NBD_CMD_DISC = 2,
 NBD_CMD_FLUSH = 3,
-NBD_CMD_TRIM = 4
+NBD_CMD_TRIM = 4,
+NBD_CMD_CLOSE = 7,
 };

 #define NBD_DEFAULT_PORT   10809
diff --git a/block/nbd-client.c b/block/nbd-client.c
index 285025d..f013084 100644
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -374,6 +374,29 @@ void nbd_client_attach_aio_context(BlockDriverState *bs,
false, nbd_reply_ready, NULL, bs);
 }

+typedef struct NbdCloseCo {
+BlockDriverState *bs;
+nbd_request request;
+nbd_reply reply;
+bool done;
+} NbdCloseCo;
+
+static void coroutine_fn nbd_client_close_co(void *opaque)
+{
+NbdCloseCo *closeco = opaque;
+NbdClientSession *client = nbd_get_client_session(closeco->bs);
+ssize_t ret;
+
+nbd_coroutine_start(client, &closeco->request);
+ret = nbd_co_send_request(closeco->bs, &closeco->request, NULL, 0);
+if (ret >= 0) {
+nbd_co_receive_reply(client, &closeco->request, &closeco->reply,
+ NULL, 0);
+}
+nbd_coroutine_end(client, &closeco->request);
+closeco->done = true;
+}
+
 void nbd_client_close(BlockDriverState *bs)
 {
 NbdClientSession *client = nbd_get_client_session(bs);
@@ -383,8 +406,28 @@ void nbd_client_close(BlockDriverState *bs)
 return;
 }

-nbd_send_request(client->ioc, &request);
+if (client->nbdflags & NBD_FLAG_SEND_CLOSE) {
+/* Newer server, wants us to wait for reply before we close */
+Coroutine *co;
+NbdCloseCo closeco = {
+.bs = bs,
+.request = { .type = NBD_CMD_CLOSE },
+};
+AioContext *aio_context;

+g_assert(!qemu_in_coroutine());
+aio_context = bdrv_get_aio_context(bs);
+co = qemu_coroutine_create(nbd_client_close_co);
+qemu_coroutine_enter(co, &closeco);
+while (!closeco.done) {
+aio_poll(aio_context, true);
+}
+} else {
+/* Older server, send request, but no reply will come */
+nbd_send_request(client->ioc, &request);
+}
+
+/* Regardless of any received errors, the connection is done. */
 nbd_teardown_connection(bs);
 }

diff --git a/nbd/server.c b/nbd/server.c
index e68e83c..2a6eaf2 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -624,7 +624,8 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)
 char buf[8 + 8 + 8 + 128];
 int rc;
 const uint16_t myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
-  NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
+  NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA |
+  NBD_FLAG_SEND_CLOSE);
 bool oldStyle;
 size_t len;

@@ -1244,7 +1245,21 @@ static void nbd_trip(void *opaque)
 break;
 case NBD_CMD_DISC:
 TRACE("Request type is DISCONNECT");
-errno = 0;
+goto out;
+case NBD_CMD_CLOSE:
+TRACE("Request type is CLOSE");
+if (request.flags || request.from || request.len) {
+LOG("bad parameters, skipping flush");
+reply.error = EINVAL;
+} else {
+ret = blk_co_flush(exp->blk);
+if (ret < 0

[Qemu-devel] [RFC PATCH 18/18] nbd: Implement NBD_CMD_WRITE_ZEROES on client

2016-04-08 Thread Eric Blake
RFC because there is still discussion on the NBD list about
adding an NBD_OPT_ to let the client suggest server defaults
related to scanning for zeroes during NBD_CMD_WRITE, which may
tweak this patch.

Upstream NBD protocol recently added the ability to efficiently
write zeroes without having to send the zeroes over the wire,
along with a flag to control whether the client wants a hole.

The generic block code takes care of falling back to the obvious
write lots of zeroes if we return -ENOTSUP because the server
does not have WRITE_ZEROES.

Signed-off-by: Eric Blake 
---
 block/nbd-client.h |  2 ++
 block/nbd-client.c | 34 ++
 block/nbd.c| 23 +++
 3 files changed, 59 insertions(+)

diff --git a/block/nbd-client.h b/block/nbd-client.h
index bc7aec0..2fe6654 100644
--- a/block/nbd-client.h
+++ b/block/nbd-client.h
@@ -47,6 +47,8 @@ void nbd_client_close(BlockDriverState *bs);
 int nbd_client_co_discard(BlockDriverState *bs, int64_t sector_num,
   int nb_sectors);
 int nbd_client_co_flush(BlockDriverState *bs);
+int nbd_client_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,
+   int nb_sectors, int *flags);
 int nbd_client_co_writev(BlockDriverState *bs, int64_t sector_num,
  int nb_sectors, QEMUIOVector *qiov, int *flags);
 int nbd_client_co_readv(BlockDriverState *bs, int64_t sector_num,
diff --git a/block/nbd-client.c b/block/nbd-client.c
index f013084..4be83a8 100644
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -291,6 +291,40 @@ int nbd_client_co_readv(BlockDriverState *bs, int64_t 
sector_num,
 return nbd_co_readv_1(bs, sector_num, nb_sectors, qiov, offset);
 }

+int nbd_client_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,
+   int nb_sectors, int *flags)
+{
+ssize_t ret;
+NbdClientSession *client = nbd_get_client_session(bs);
+struct nbd_request request = { .type = NBD_CMD_WRITE_ZEROES };
+struct nbd_reply reply;
+
+if (!(client->nbdflags & NBD_FLAG_SEND_WRITE_ZEROES)) {
+return -ENOTSUP;
+}
+
+if ((*flags & BDRV_REQ_FUA) && (client->nbdflags & NBD_FLAG_SEND_FUA)) {
+*flags &= ~BDRV_REQ_FUA;
+request.flags |= NBD_CMD_FLAG_FUA;
+}
+if (!(*flags & BDRV_REQ_MAY_UNMAP)) {
+request.flags |= NBD_CMD_FLAG_NO_HOLE;
+}
+
+request.from = sector_num * 512;
+request.len = nb_sectors * 512;
+
+nbd_coroutine_start(client, &request);
+ret = nbd_co_send_request(bs, &request, NULL, 0);
+if (ret < 0) {
+reply.error = -ret;
+} else {
+nbd_co_receive_reply(client, &request, &reply, NULL, 0);
+}
+nbd_coroutine_end(client, &request);
+return -reply.error;
+}
+
 int nbd_client_co_writev(BlockDriverState *bs, int64_t sector_num,
  int nb_sectors, QEMUIOVector *qiov, int *flags)
 {
diff --git a/block/nbd.c b/block/nbd.c
index f7ea3b3..f5119c0 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -355,6 +355,26 @@ static int nbd_co_readv(BlockDriverState *bs, int64_t 
sector_num,
 return nbd_client_co_readv(bs, sector_num, nb_sectors, qiov);
 }

+static int nbd_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,
+   int nb_sectors, BdrvRequestFlags orig_flags)
+{
+int flags = orig_flags;
+int ret;
+
+ret = nbd_client_co_write_zeroes(bs, sector_num, nb_sectors, &flags);
+if (ret < 0) {
+return ret;
+}
+
+/* The flag wasn't sent to the server, so we need to emulate it with an
+ * explicit flush */
+if (flags & BDRV_REQ_FUA) {
+ret = nbd_client_co_flush(bs);
+}
+
+return ret;
+}
+
 static int nbd_co_writev_flags(BlockDriverState *bs, int64_t sector_num,
int nb_sectors, QEMUIOVector *qiov, int flags)
 {
@@ -476,6 +496,7 @@ static BlockDriver bdrv_nbd = {
 .bdrv_parse_filename= nbd_parse_filename,
 .bdrv_file_open = nbd_open,
 .bdrv_co_readv  = nbd_co_readv,
+.bdrv_co_write_zeroes   = nbd_co_write_zeroes,
 .bdrv_co_writev = nbd_co_writev,
 .bdrv_co_writev_flags   = nbd_co_writev_flags,
 .supported_write_flags  = BDRV_REQ_FUA,
@@ -496,6 +517,7 @@ static BlockDriver bdrv_nbd_tcp = {
 .bdrv_parse_filename= nbd_parse_filename,
 .bdrv_file_open = nbd_open,
 .bdrv_co_readv  = nbd_co_readv,
+.bdrv_co_write_zeroes   = nbd_co_write_zeroes,
 .bdrv_co_writev = nbd_co_writev,
 .bdrv_co_writev_flags   = nbd_co_writev_flags,
 .supported_write_flags  = BDRV_REQ_FUA,
@@ -516,6 +538,7 @@ static BlockDriver bdrv_nbd_unix = {
 .bdrv_parse_filename= nbd_parse_filename,
 .bdrv_file_open = nbd_open,
 .bdrv_co_readv  = nbd_co_readv,
+.bdrv_co_write_zeroes   = nbd_co_write_zeroes,
 .

[Qemu-devel] [PATCH 03/18] nbd: More debug typo fixes, use correct formats

2016-04-08 Thread Eric Blake
Clean up some debug message oddities missed earlier; this includes
both typos, and recognizing that %d is not necessarily compatible
with uint32_t.

Signed-off-by: Eric Blake 
---
 nbd/client.c | 41 ++---
 nbd/server.c | 44 +++-
 2 files changed, 45 insertions(+), 40 deletions(-)

diff --git a/nbd/client.c b/nbd/client.c
index 48f2a21..42e4e52 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -109,25 +109,27 @@ static int nbd_handle_reply_err(QIOChannel *ioc, uint32_t 
opt, uint32_t type,

 switch (type) {
 case NBD_REP_ERR_UNSUP:
-TRACE("server doesn't understand request %d, attempting fallback",
-  opt);
+TRACE("server doesn't understand request %" PRIx32
+  ", attempting fallback", opt);
 result = 0;
 goto cleanup;

 case NBD_REP_ERR_POLICY:
-error_setg(errp, "Denied by server for option %x", opt);
+error_setg(errp, "Denied by server for option %" PRIx32, opt);
 break;

 case NBD_REP_ERR_INVALID:
-error_setg(errp, "Invalid data length for option %x", opt);
+error_setg(errp, "Invalid data length for option %" PRIx32, opt);
 break;

 case NBD_REP_ERR_TLS_REQD:
-error_setg(errp, "TLS negotiation required before option %x", opt);
+error_setg(errp, "TLS negotiation required before option %" PRIx32,
+   opt);
 break;

 default:
-error_setg(errp, "Unknown error code when asking for option %x", opt);
+error_setg(errp, "Unknown error code when asking for option %" PRIx32,
+   opt);
 break;
 }

@@ -165,7 +167,7 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 }
 opt = be32_to_cpu(opt);
 if (opt != NBD_OPT_LIST) {
-error_setg(errp, "Unexpected option type %x expected %x",
+error_setg(errp, "Unexpected option type %" PRIx32 " expected %x",
opt, NBD_OPT_LIST);
 return -1;
 }
@@ -207,7 +209,7 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 return -1;
 }
 if (namelen > 255) {
-error_setg(errp, "export name length too long %d", namelen);
+error_setg(errp, "export name length too long %" PRIu32, namelen);
 return -1;
 }

@@ -234,7 +236,7 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 g_free(buf);
 }
 } else {
-error_setg(errp, "Unexpected reply type %x expected %x",
+error_setg(errp, "Unexpected reply type %" PRIx32 " expected %x",
type, NBD_REP_SERVER);
 return -1;
 }
@@ -349,7 +351,7 @@ static QIOChannel *nbd_receive_starttls(QIOChannel *ioc,
 }
 opt = be32_to_cpu(opt);
 if (opt != NBD_OPT_STARTTLS) {
-error_setg(errp, "Unexpected option type %x expected %x",
+error_setg(errp, "Unexpected option type %" PRIx32 " expected %x",
opt, NBD_OPT_STARTTLS);
 return NULL;
 }
@@ -361,7 +363,7 @@ static QIOChannel *nbd_receive_starttls(QIOChannel *ioc,
 }
 type = be32_to_cpu(type);
 if (type != NBD_REP_ACK) {
-error_setg(errp, "Server rejected request to start TLS %x",
+error_setg(errp, "Server rejected request to start TLS %" PRIx32,
type);
 return NULL;
 }
@@ -373,7 +375,7 @@ static QIOChannel *nbd_receive_starttls(QIOChannel *ioc,
 }
 length = be32_to_cpu(length);
 if (length != 0) {
-error_setg(errp, "Start TLS reponse was not zero %x",
+error_setg(errp, "Start TLS response was not zero %" PRIu32,
length);
 return NULL;
 }
@@ -384,7 +386,7 @@ static QIOChannel *nbd_receive_starttls(QIOChannel *ioc,
 return NULL;
 }
 data.loop = g_main_loop_new(g_main_context_default(), FALSE);
-TRACE("Starting TLS hanshake");
+TRACE("Starting TLS handshake");
 qio_channel_tls_handshake(tioc,
   nbd_tls_handshake,
   &data,
@@ -474,7 +476,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char 
*name, uint32_t *flags,
 }
 globalflags = be16_to_cpu(globalflags);
 *flags = globalflags << 16;
-TRACE("Global flags are %x", globalflags);
+TRACE("Global flags are %" PRIx32, globalflags);
 if (globalflags & NBD_FLAG_FIXED_NEWSTYLE) {
 fixedNewStyle = true;
 TRACE("Server supports fixed new style");
@@ -550,7 +552,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char 
*name, uint32_t *flags,
 }
 exportflags = be16_to_cpu(exportflags);
 *flags |= exportflags;
-TRACE("Export flags are %x", exportflags);
+TRACE("Export flags are %" PRIx16, exportflags);
 } else if (magic == NBD_CLIENT_MAGIC) {
 if (

[Qemu-devel] [PATCH 15/18] nbd: Implement NBD_OPT_GO on server

2016-04-08 Thread Eric Blake
NBD_OPT_EXPORT_NAME is lousy: it requires us to close the connection
rather than report an error.  Upstream NBD recently added NBD_OPT_GO
as the improved version of the option that does what we want, along
with NBD_OPT_INFO that returns the same information but does not
transition to transmission phase.

Signed-off-by: Eric Blake 
---
 nbd/server.c | 122 ---
 1 file changed, 109 insertions(+), 13 deletions(-)

diff --git a/nbd/server.c b/nbd/server.c
index 379df8c..e68e83c 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -233,17 +233,19 @@ static int nbd_negotiate_send_rep(QIOChannel *ioc, 
uint32_t type, uint32_t opt)
 return nbd_negotiate_send_rep_len(ioc, type, opt, 0);
 }

-/* Send an NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
+/* Send the common part of an NBD_REP_SERVER reply for the given option,
+ * and include extra_len in the advertised payload.
  * Return -errno to kill connection, 0 to continue negotiation */
-static int nbd_negotiate_send_rep_list(QIOChannel *ioc, NBDExport *exp)
+static int nbd_negotiate_send_rep_server(QIOChannel *ioc, NBDExport *exp,
+ uint32_t opt, uint32_t extra_len)
 {
 uint32_t len;
 int rc;

 TRACE("Advertising export name '%s'", exp->name ? exp->name : "");
 len = strlen(exp->name);
-rc = nbd_negotiate_send_rep_len(ioc, NBD_REP_SERVER, NBD_OPT_LIST,
-len + sizeof(len));
+rc = nbd_negotiate_send_rep_len(ioc, NBD_REP_SERVER, opt,
+len + sizeof(len) + extra_len);
 if (rc < 0) {
 return rc;
 }
@@ -261,6 +263,15 @@ static int nbd_negotiate_send_rep_list(QIOChannel *ioc, 
NBDExport *exp)
 return 0;
 }

+/* Send an NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
+ * Return -errno to kill connection, 0 to continue negotiation. */
+static int nbd_negotiate_send_rep_list(QIOChannel *ioc, NBDExport *exp)
+{
+return nbd_negotiate_send_rep_server(ioc, exp, NBD_OPT_LIST, 0);
+}
+
+/* Send a sequence of replies to NBD_OPT_LIST.
+ * Return -errno to kill connection, 0 to continue negotiation. */
 static int nbd_negotiate_handle_list(NBDClient *client, uint32_t length)
 {
 NBDExport *exp;
@@ -283,6 +294,8 @@ static int nbd_negotiate_handle_list(NBDClient *client, 
uint32_t length)
 return nbd_negotiate_send_rep(client->ioc, NBD_REP_ACK, NBD_OPT_LIST);
 }

+/* Send a reply to NBD_OPT_EXPORT_NAME.
+ * Return -errno to kill connection, 0 to end negotiation. */
 static int nbd_negotiate_handle_export_name(NBDClient *client, uint32_t length)
 {
 int rc = -EINVAL;
@@ -318,6 +331,73 @@ fail:
 }


+/* Handle NBD_OPT_INFO and NBD_OPT_GO.
+ * Return -errno to kill connection, 0 if ready for next option, and 1
+ * to move into transmission phase.  */
+static int nbd_negotiate_handle_info(NBDClient *client, uint32_t length,
+ uint32_t opt, uint16_t myflags)
+{
+int rc;
+char name[NBD_MAX_NAME_SIZE + 1];
+NBDExport *exp;
+uint64_t size;
+uint16_t flags;
+
+/* Client sends:
+[20 ..  xx]   export name (length bytes)
+ */
+TRACE("Checking length");
+if (length >= sizeof(name)) {
+if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
+return -EIO;
+}
+return nbd_negotiate_send_rep(client->ioc, NBD_REP_ERR_INVALID, opt);
+}
+if (nbd_negotiate_read(client->ioc, name, length) != length) {
+LOG("read failed");
+return -EIO;
+}
+name[length] = '\0';
+
+TRACE("Client requested info on export '%s'", name);
+
+exp = nbd_export_find(name);
+if (!exp) {
+return nbd_negotiate_send_rep(client->ioc, NBD_REP_ERR_UNKNOWN, opt);
+}
+
+QEMU_BUILD_BUG_ON(NBD_FINAL_REPLY_SIZE != sizeof(size) + sizeof(flags));
+rc = nbd_negotiate_send_rep_server(client->ioc, exp, opt,
+   NBD_FINAL_REPLY_SIZE);
+if (rc < 0) {
+return rc;
+}
+
+assert((exp->nbdflags & ~65535) == 0);
+size = cpu_to_be64(exp->size);
+flags = cpu_to_be16(exp->nbdflags | myflags);
+
+if (nbd_negotiate_write(client->ioc, &size, sizeof(size)) !=
+sizeof(size)) {
+LOG("write failed");
+return -EIO;
+}
+if (nbd_negotiate_write(client->ioc, &flags, sizeof(flags)) !=
+sizeof(flags)) {
+LOG("write failed");
+return -EIO;
+}
+
+if (opt == NBD_OPT_GO) {
+client->exp = exp;
+QTAILQ_INSERT_TAIL(&client->exp->clients, client, next);
+nbd_export_get(client->exp);
+rc = 1;
+}
+return rc;
+}
+
+
 static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client,
  uint32_t length)
 {
@@ -366,7 +446,10 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient 
*client,
 }


-static int nbd_negotiate_options(NBDClient *cl

[Qemu-devel] [PATCH 10/18] nbd: Share common option-sending code in client

2016-04-08 Thread Eric Blake
Rather than open-coding each option request, it's easier to
have common helper functions do the work.  That in turn requires
having convenient packed types for handling option requests
and replies.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h |  29 +-
 nbd/nbd-internal.h  |   2 +-
 nbd/client.c| 250 ++--
 3 files changed, 129 insertions(+), 152 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index 42fd670..155196e 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -26,20 +26,41 @@
 #include "io/channel-socket.h"
 #include "crypto/tlscreds.h"

+/* Handshake phase structs */
+
+struct nbd_option {
+uint64_t magic; /* NBD_OPTS_MAGIC */
+uint32_t option; /* NBD_OPT_* */
+uint32_t length;
+} QEMU_PACKED;
+typedef struct nbd_option nbd_option;
+
+struct nbd_opt_reply {
+uint64_t magic; /* NBD_REP_MAGIC */
+uint32_t option; /* NBD_OPT_* */
+uint32_t type; /* NBD_REP_* */
+uint32_t length;
+} QEMU_PACKED;
+typedef struct nbd_opt_reply nbd_opt_reply;
+
+/* Transmission phase structs */
+
 struct nbd_request {
-uint32_t magic;
-uint16_t flags;
-uint16_t type;
+uint32_t magic; /* NBD_REQUEST_MAGIC */
+uint16_t flags; /* NBD_CMD_FLAG_* */
+uint16_t type; /* NBD_CMD_* */
 uint64_t handle;
 uint64_t from;
 uint32_t len;
 } QEMU_PACKED;
+typedef struct nbd_request nbd_request;

 struct nbd_reply {
-uint32_t magic;
+uint32_t magic; /* NBD_REPLY_MAGIC */
 uint32_t error;
 uint64_t handle;
 } QEMU_PACKED;
+typedef struct nbd_reply nbd_reply;

 /* Transmission (export) flags: sent from server to client during handshake,
but describe what will happen during transmission */
diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
index b663bf3..b78d249 100644
--- a/nbd/nbd-internal.h
+++ b/nbd/nbd-internal.h
@@ -61,7 +61,7 @@
 #define NBD_REPLY_MAGIC 0x67446698
 #define NBD_OPTS_MAGIC  0x49484156454F5054LL
 #define NBD_CLIENT_MAGIC0x420281861253LL
-#define NBD_REP_MAGIC   0x3e889045565a9LL
+#define NBD_REP_MAGIC   0x0003e889045565a9LL

 #define NBD_SET_SOCK_IO(0xab, 0)
 #define NBD_SET_BLKSIZE _IO(0xab, 1)
diff --git a/nbd/client.c b/nbd/client.c
index 7fd6059..07b8d2e 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -75,64 +75,123 @@ static QTAILQ_HEAD(, NBDExport) exports = 
QTAILQ_HEAD_INITIALIZER(exports);

 */

+/* Send an option request. Return 0 if successful, -1 with errp set if
+ * it is impossible to continue. */
+static int nbd_send_option_request(QIOChannel *ioc, uint32_t opt,
+   uint32_t len, const char *data,
+   Error **errp)
+{
+nbd_option req;
+QEMU_BUILD_BUG_ON(sizeof(req) != 16);

-/* If type represents success, return 1 without further action.
- * If type represents an error reply, consume the rest of the packet on ioc.
- * Then return 0 for unsupported (so the client can fall back to
- * other approaches), or -1 with errp set for other errors.
+if (len == -1) {
+req.length = len = strlen(data);
+}
+TRACE("Sending option request %"PRIu32", len %"PRIu32, opt, len);
+
+stq_be_p(&req.magic, NBD_OPTS_MAGIC);
+stl_be_p(&req.option, opt);
+stl_be_p(&req.length, len);
+
+if (write_sync(ioc, &req, sizeof(req)) != sizeof(req)) {
+error_setg(errp, "Failed to send option request header");
+return -1;
+}
+
+if (len && write_sync(ioc, (char *) data, len) != len) {
+error_setg(errp, "Failed to send option request data");
+return -1;
+}
+
+return 0;
+}
+
+/* Receive the header of an option reply, which should match the given
+ * opt.  Read through the length field, but NOT the length bytes of
+ * payload. Return 0 if successful, -1 with errp set if it is
+ * impossible to continue. */
+static int nbd_receive_option_reply(QIOChannel *ioc, uint32_t opt,
+nbd_opt_reply *reply, Error **errp)
+{
+QEMU_BUILD_BUG_ON(sizeof(*reply) != 20);
+if (read_sync(ioc, reply, sizeof(*reply)) != sizeof(*reply)) {
+error_setg(errp, "failed to read option reply");
+return -1;
+}
+be64_to_cpus(&reply->magic);
+be32_to_cpus(&reply->option);
+be32_to_cpus(&reply->type);
+be32_to_cpus(&reply->length);
+
+TRACE("Received option reply %"PRIu32", type %"PRIu32", len %"PRIu32,
+  reply->option, reply->type, reply->length);
+
+if (reply->magic != NBD_REP_MAGIC) {
+error_setg(errp, "Unexpected option reply magic");
+return -1;
+}
+if (reply->option != opt) {
+error_setg(errp, "Unexpected option type %x expected %x",
+   reply->option, opt);
+return -1;
+}
+return 0;
+}
+
+/* If reply represents success, return 1 without further action.
+ * If reply represents an error, consume the optional payload of
+ 

[Qemu-devel] [PATCH 14/18] nbd: Implement NBD_OPT_GO on client

2016-04-08 Thread Eric Blake
NBD_OPT_EXPORT_NAME is lousy: it doesn't have any sane error
reporting.  Upstream NBD recently added NBD_OPT_GO as the
improved version of the option that does what we want: it
reports sane errors on failures (including when a server
requires TLS but does not have NBD_OPT_GO!), and on success
it concludes with the same data as NBD_OPT_EXPORT_NAME sends.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h |  1 +
 nbd/nbd-internal.h  |  7 +
 nbd/client.c| 86 +++--
 3 files changed, 92 insertions(+), 2 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index 35c0ea3..d261dbc 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -88,6 +88,7 @@ typedef struct nbd_reply nbd_reply;
 #define NBD_REP_ERR_POLICY  ((UINT32_C(1) << 31) | 2) /* Server denied */
 #define NBD_REP_ERR_INVALID ((UINT32_C(1) << 31) | 3) /* Invalid length. */
 #define NBD_REP_ERR_TLS_REQD((UINT32_C(1) << 31) | 5) /* TLS required */
+#define NBD_REP_ERR_UNKNOWN ((UINT32_C(1) << 31) | 6) /* Export unknown */

 /* Request flags, sent from client to server during transmission phase */
 #define NBD_CMD_FLAG_FUA(1 << 0)
diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
index b78d249..ddba1d0 100644
--- a/nbd/nbd-internal.h
+++ b/nbd/nbd-internal.h
@@ -55,8 +55,13 @@
  * https://github.com/yoe/nbd/blob/master/doc/proto.md
  */

+/* Size of all NBD_OPT_*, without payload */
 #define NBD_REQUEST_SIZE(4 + 2 + 2 + 8 + 8 + 4)
+/* Size of all NBD_REP_* sent in answer to most NBD_OPT_*, without payload */
 #define NBD_REPLY_SIZE  (4 + 4 + 8)
+/* Size of reply to NBD_OPT_EXPORT_NAME, without trailing zeroes */
+#define NBD_FINAL_REPLY_SIZE(8 + 2)
+
 #define NBD_REQUEST_MAGIC   0x25609513
 #define NBD_REPLY_MAGIC 0x67446698
 #define NBD_OPTS_MAGIC  0x49484156454F5054LL
@@ -80,6 +85,8 @@
 #define NBD_OPT_LIST(3)
 #define NBD_OPT_PEEK_EXPORT (4)
 #define NBD_OPT_STARTTLS(5)
+#define NBD_OPT_INFO(6)
+#define NBD_OPT_GO  (7)

 /* NBD errors are based on errno numbers, so there is a 1:1 mapping,
  * but only a limited set of errno values is specified in the protocol.
diff --git a/nbd/client.c b/nbd/client.c
index 507ddc1..af17d4c 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -215,6 +215,11 @@ static int nbd_handle_reply_err(QIOChannel *ioc, 
nbd_opt_reply *reply,
reply->option);
 break;

+case NBD_REP_ERR_UNKNOWN:
+error_setg(errp, "Requested export not available for option %" PRIx32,
+   reply->option);
+break;
+
 default:
 error_setg(errp, "Unknown error code when asking for option %" PRIx32,
reply->option);
@@ -299,6 +304,67 @@ static int nbd_receive_list(QIOChannel *ioc, const char 
*want, Error **errp)
 }


+/* Returns -1 if NBD_OPT_GO proves the export cannot be used, 0 if
+ * NBD_OPT_GO is unsupported (fall back to NBD_OPT_LIST and
+ * NBD_OPT_EXPORT_NAME in that case), and > 0 if the export is good to
+ * go (with the server data at the same point as it would be right
+ * after sending NBD_OPT_EXPORT_NAME). */
+static int nbd_opt_go(QIOChannel *ioc, const char *wantname, Error **errp)
+{
+nbd_opt_reply reply;
+uint32_t len;
+uint32_t namelen;
+int error;
+char buf[NBD_MAX_NAME_SIZE];
+
+TRACE("Attempting NBD_OPT_GO for export '%s'", wantname);
+if (nbd_send_option_request(ioc, NBD_OPT_GO, -1, wantname, errp) < 0) {
+return -1;
+}
+
+TRACE("Reading export info");
+if (nbd_receive_option_reply(ioc, NBD_OPT_GO, &reply, errp) < 0) {
+return -1;
+}
+error = nbd_handle_reply_err(ioc, &reply, errp);
+if (error <= 0) {
+return error;
+}
+len = reply.length;
+
+if (reply.type != NBD_REP_SERVER) {
+error_setg(errp, "unexpected reply type %" PRIx32 ", expected %x",
+   reply.type, NBD_REP_SERVER);
+return -1;
+}
+
+if (len < sizeof(namelen) + NBD_FINAL_REPLY_SIZE ||
+len > sizeof(namelen) + sizeof(buf) + NBD_FINAL_REPLY_SIZE) {
+error_setg(errp, "reply with %" PRIu32 " bytes is unexpected size",
+   len);
+return -1;
+}
+
+if (read_sync(ioc, &namelen, sizeof(namelen)) != sizeof(namelen)) {
+error_setg(errp, "failed to read namelen");
+return -1;
+}
+be32_to_cpus(&namelen);
+if (len != sizeof(namelen) + namelen + NBD_FINAL_REPLY_SIZE) {
+error_setg(errp, "namelen %" PRIu32 " is unexpected size",
+   len);
+return -1;
+}
+
+if (read_sync(ioc, buf, namelen) != namelen) {
+error_setg(errp, "failed to read name");
+return -1;
+}
+
+TRACE("export is good to go");
+return 1;
+}
+
 /* Return -1 on failure, 0 if wantname is an available export. */
 static int nbd_receive_query_exports(QIOChannel *ioc,
   

[Qemu-devel] [PATCH 01/18] nbd: Don't kill server on client that doesn't request TLS

2016-04-08 Thread Eric Blake
Upstream NBD is documenting that servers MAY choose to operate
in a conditional mode, where it is up to the client whether to
use TLS.  For qemu's case, we want to always be in FORCEDTLS
mode, because of the risk of man-in-the-middle attacks, and since
we never export more than one device; likewise, the qemu client
will ALWAYS send NBD_OPT_STARTTLS as its first option.  But now
that SELECTIVETLS servers exist, it is feasible to encounter a
(non-qemu) client that does not do NBD_OPT_STARTTLS first, but
rather wants to take advantage of the conditional modes it might
find elsewhere.

Since we require TLS, we are within our rights to drop connections
on any client that doesn't negotiate it right away, or which
attempts to negotiate it incorrectly, without violating the intent
of the NBD Protocol.  However, it's better to allow the client to
continue trying, on the grounds that maybe the client will get the
hint to send NBD_OPT_STARTTLS.

Signed-off-by: Eric Blake 
---
 nbd/server.c | 10 --
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/nbd/server.c b/nbd/server.c
index 2a4dd10..e7e4881 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -451,9 +451,12 @@ static int nbd_negotiate_options(NBDClient *client)

 default:
 TRACE("Option 0x%x not permitted before TLS", clientflags);
+if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
+return -EIO;
+}
 nbd_negotiate_send_rep(client->ioc, NBD_REP_ERR_TLS_REQD,
clientflags);
-return -EINVAL;
+break;
 }
 } else if (fixedNewstyle) {
 switch (clientflags) {
@@ -471,6 +474,9 @@ static int nbd_negotiate_options(NBDClient *client)
 return nbd_negotiate_handle_export_name(client, length);

 case NBD_OPT_STARTTLS:
+if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
+return -EIO;
+}
 if (client->tlscreds) {
 TRACE("TLS already enabled");
 nbd_negotiate_send_rep(client->ioc, NBD_REP_ERR_INVALID,
@@ -480,7 +486,7 @@ static int nbd_negotiate_options(NBDClient *client)
 nbd_negotiate_send_rep(client->ioc, NBD_REP_ERR_POLICY,
clientflags);
 }
-return -EINVAL;
+break;
 default:
 TRACE("Unsupported option 0x%x", clientflags);
 if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
-- 
2.5.5




[Qemu-devel] [PATCH 13/18] nbd: Support shorter handshake

2016-04-08 Thread Eric Blake
The NBD Protocol allows the server and client to mutually agree
on a shorter handshake (omit the 124 bytes of reserved 0), via
the server advertising NBD_FLAG_NO_ZEROES and the client
acknowledging with NBD_FLAG_C_NO_ZEROES (only possible in
newstyle, whether or not it is fixed newstyle).  It doesn't
shave much off the wire, but we might as well implement it.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h |  6 --
 nbd/client.c|  8 +++-
 nbd/server.c| 15 +++
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index 155196e..35c0ea3 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -73,11 +73,13 @@ typedef struct nbd_reply nbd_reply;

 /* New-style handshake (global) flags, sent from server to client, and
control what will happen during handshake phase. */
-#define NBD_FLAG_FIXED_NEWSTYLE (1 << 0)/* Fixed newstyle protocol. */
+#define NBD_FLAG_FIXED_NEWSTYLE   (1 << 0) /* Fixed newstyle protocol. */
+#define NBD_FLAG_NO_ZEROES(1 << 1) /* End handshake without zeroes. */

 /* New-style client flags, sent from client to server to control what happens
during handshake phase. */
-#define NBD_FLAG_C_FIXED_NEWSTYLE   (1 << 0)/* Fixed newstyle protocol. */
+#define NBD_FLAG_C_FIXED_NEWSTYLE (1 << 0) /* Fixed newstyle protocol. */
+#define NBD_FLAG_C_NO_ZEROES  (1 << 1) /* End handshake without zeroes. */

 /* Reply types. */
 #define NBD_REP_ACK (1) /* Data sending finished. */
diff --git a/nbd/client.c b/nbd/client.c
index d4e37d5..507ddc1 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -409,6 +409,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char 
*name, uint32_t *flags,
 char buf[256];
 uint64_t magic, s;
 int rc;
+bool zeroes = true;

 TRACE("Receiving negotiation tlscreds=%p hostname=%s.",
   tlscreds, hostname ? hostname : "");
@@ -475,6 +476,11 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char 
*name, uint32_t *flags,
 TRACE("Server supports fixed new style");
 clientflags |= NBD_FLAG_C_FIXED_NEWSTYLE;
 }
+if (globalflags & NBD_FLAG_NO_ZEROES) {
+zeroes = false;
+TRACE("Server supports no zeroes");
+clientflags |= NBD_FLAG_C_NO_ZEROES;
+}
 /* client requested flags */
 clientflags = cpu_to_be32(clientflags);
 if (write_sync(ioc, &clientflags, sizeof(clientflags)) !=
@@ -558,7 +564,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char 
*name, uint32_t *flags,
 goto fail;
 }

-if (drop_sync(ioc, 124) != 124) {
+if (zeroes && drop_sync(ioc, 124) != 124) {
 error_setg(errp, "Failed to read reserved block");
 goto fail;
 }
diff --git a/nbd/server.c b/nbd/server.c
index 69724c9..379df8c 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -78,6 +78,7 @@ struct NBDClient {
 int refcount;
 void (*close)(NBDClient *client);

+bool no_zeroes;
 NBDExport *exp;
 QCryptoTLSCreds *tlscreds;
 char *tlsaclname;
@@ -396,6 +397,11 @@ static int nbd_negotiate_options(NBDClient *client)
 fixedNewstyle = true;
 flags &= ~NBD_FLAG_C_FIXED_NEWSTYLE;
 }
+if (flags & NBD_FLAG_C_NO_ZEROES) {
+TRACE("Client supports no zeroes at handshake end");
+client->no_zeroes = true;
+flags &= ~NBD_FLAG_C_NO_ZEROES;
+}
 if (flags != 0) {
 TRACE("Unknown client flags 0x%" PRIx32 " received", flags);
 return -EIO;
@@ -527,6 +533,7 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)
 const uint16_t myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
   NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
 bool oldStyle;
+size_t len;

 /* Old style negotiation header without options
 [ 0 ..   7]   passwd   ("NBDMAGIC")
@@ -543,7 +550,7 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)
 options sent
 [18 ..  25]   size
 [26 ..  27]   export flags
-[28 .. 151]   reserved (0)
+[28 .. 151]   reserved (0, omit if no_zeroes)
  */

 qio_channel_set_blocking(client->ioc, false, NULL);
@@ -560,7 +567,7 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)
 stw_be_p(buf + 26, client->exp->nbdflags | myflags);
 } else {
 stq_be_p(buf + 8, NBD_OPTS_MAGIC);
-stw_be_p(buf + 16, NBD_FLAG_FIXED_NEWSTYLE);
+stw_be_p(buf + 16, NBD_FLAG_FIXED_NEWSTYLE | NBD_FLAG_NO_ZEROES);
 }

 if (oldStyle) {
@@ -585,8 +592,8 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)

 stq_be_p(buf + 18, client->exp->size);
 stw_be_p(buf + 26, client->exp->nbdflags | myflags);
-if (nbd_negotiate_write(client->ioc, buf + 18, sizeof(buf) - 18) !=
-sizeof(buf) - 18) {
+len = client->no_zeroes ? 10 :

[Qemu-devel] [PATCH 12/18] nbd: Less allocation during NBD_OPT_LIST

2016-04-08 Thread Eric Blake
Since we know that the maximum name we are willing to accept
is small enough to stack-allocate, rework the iteration over
NBD_OPT_LIST responses to reuse a stack buffer rather than
allocating every time.  Furthermore, we don't even have to
allocate if we know the server's length doesn't match what
we are searching for.

Not fixed here: Upstream NBD Protocol recently added this
clarification:
https://github.com/yoe/nbd/blob/18918eb/doc/proto.md#conventions

 Where this document refers to a string, then unless otherwise
 stated, that string is a sequence of UTF-8 code points, which
 is not NUL terminated, MUST NOT contain NUL characters, SHOULD
 be no longer than 256 bytes and MUST be no longer than 4096
 bytes. This applies to export names and error messages (amongst
 others).

To be fully compliant to that, we need to bump our export name
limit from 255 to at least 256, and need to decide whether we
can bump it higher (bumping it all the way to 4096 is annoying
in that we could no longer safely stack-allocate a worst-case
string, so we may still want to take the leeway offered by SHOULD
to force a reasonable smaller limit).

Signed-off-by: Eric Blake 
---
 nbd/client.c | 130 +--
 1 file changed, 65 insertions(+), 65 deletions(-)

diff --git a/nbd/client.c b/nbd/client.c
index b2dfc11..d4e37d5 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -230,14 +230,17 @@ static int nbd_handle_reply_err(QIOChannel *ioc, 
nbd_opt_reply *reply,
 return result;
 }

-static int nbd_receive_list(QIOChannel *ioc, char **name, Error **errp)
+/* Return -1 if unrecoverable error occurs, 0 if NBD_OPT_LIST is
+ * unsupported, 1 if iteration is done, 2 to keep looking, and 3 if
+ * this entry matches want. */
+static int nbd_receive_list(QIOChannel *ioc, const char *want, Error **errp)
 {
 nbd_opt_reply reply;
 uint32_t len;
 uint32_t namelen;
+char name[NBD_MAX_NAME_SIZE + 1];
 int error;

-*name = NULL;
 if (nbd_receive_option_reply(ioc, NBD_OPT_LIST, &reply, errp) < 0) {
 return -1;
 }
@@ -252,97 +255,94 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 error_setg(errp, "length too long for option end");
 return -1;
 }
-} else if (reply.type == NBD_REP_SERVER) {
-if (len < sizeof(namelen) || len > NBD_MAX_BUFFER_SIZE) {
-error_setg(errp, "incorrect option length %"PRIu32, len);
-return -1;
-}
-if (read_sync(ioc, &namelen, sizeof(namelen)) != sizeof(namelen)) {
-error_setg(errp, "failed to read option name length");
-return -1;
-}
-namelen = be32_to_cpu(namelen);
-len -= sizeof(namelen);
-if (len < namelen) {
-error_setg(errp, "incorrect option name length");
-return -1;
-}
-if (namelen > NBD_MAX_NAME_SIZE) {
-error_setg(errp, "export name length too long %" PRIu32, namelen);
-return -1;
-}
-
-*name = g_new0(char, namelen + 1);
-if (read_sync(ioc, *name, namelen) != namelen) {
-error_setg(errp, "failed to read export name");
-g_free(*name);
-*name = NULL;
-return -1;
-}
-(*name)[namelen] = '\0';
-len -= namelen;
-if (drop_sync(ioc, len) != len) {
-error_setg(errp, "failed to read export description");
-g_free(*name);
-*name = NULL;
-return -1;
-}
-} else {
+return 1;
+} else if (reply.type != NBD_REP_SERVER) {
 error_setg(errp, "Unexpected reply type %" PRIx32 " expected %x",
reply.type, NBD_REP_SERVER);
 return -1;
 }
-return 1;
+
+if (len < sizeof(namelen) || len > NBD_MAX_BUFFER_SIZE) {
+error_setg(errp, "incorrect option length %"PRIu32, len);
+return -1;
+}
+if (read_sync(ioc, &namelen, sizeof(namelen)) != sizeof(namelen)) {
+error_setg(errp, "failed to read option name length");
+return -1;
+}
+namelen = be32_to_cpu(namelen);
+len -= sizeof(namelen);
+if (len < namelen) {
+error_setg(errp, "incorrect option name length");
+return -1;
+}
+if (namelen != strlen(want)) {
+if (drop_sync(ioc, len) != len) {
+error_setg(errp, "failed to skip export name with wrong length");
+return -1;
+}
+return 2;
+}
+
+assert(namelen < sizeof(name));
+if (read_sync(ioc, name, namelen) != namelen) {
+error_setg(errp, "failed to read export name");
+return -1;
+}
+name[namelen] = '\0';
+len -= namelen;
+if (drop_sync(ioc, len) != len) {
+error_setg(errp, "failed to read export description");
+return -1;
+}
+return strcmp(name, want) == 0 ? 3 : 2;
 }


+/* Return -1 on failure, 0 if wantname is an available ex

[Qemu-devel] [PATCH 06/18] nbd: Avoid magic number for NBD max name size

2016-04-08 Thread Eric Blake
Declare a constant and use that when determining if an export
name fits within the constraints we are willing to support.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h | 2 ++
 nbd/client.c| 2 +-
 nbd/server.c| 4 ++--
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index b86a976..3f047bf 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -76,6 +76,8 @@ enum {

 /* Maximum size of a single READ/WRITE data buffer */
 #define NBD_MAX_BUFFER_SIZE (32 * 1024 * 1024)
+/* Maximum size of an export name */
+#define NBD_MAX_NAME_SIZE 255

 ssize_t nbd_wr_syncv(QIOChannel *ioc,
  struct iovec *iov,
diff --git a/nbd/client.c b/nbd/client.c
index c834587..00f9244 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -210,7 +210,7 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 error_setg(errp, "incorrect option name length");
 return -1;
 }
-if (namelen > 255) {
+if (namelen > NBD_MAX_NAME_SIZE) {
 error_setg(errp, "export name length too long %" PRIu32, namelen);
 return -1;
 }
diff --git a/nbd/server.c b/nbd/server.c
index a10294e..5414c49 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -285,13 +285,13 @@ static int nbd_negotiate_handle_list(NBDClient *client, 
uint32_t length)
 static int nbd_negotiate_handle_export_name(NBDClient *client, uint32_t length)
 {
 int rc = -EINVAL;
-char name[256];
+char name[NBD_MAX_NAME_SIZE + 1];

 /* Client sends:
 [20 ..  xx]   export name (length bytes)
  */
 TRACE("Checking length");
-if (length > 255) {
+if (length >= sizeof(name)) {
 LOG("Bad length received");
 goto fail;
 }
-- 
2.5.5




[Qemu-devel] [PATCH 04/18] nbd: Detect servers that send unexpected error values

2016-04-08 Thread Eric Blake
Add some debugging to flag servers that are not compliant to
the NBD protocol.

Signed-off-by: Eric Blake 
---
 nbd/client.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nbd/client.c b/nbd/client.c
index 42e4e52..c834587 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -33,8 +33,10 @@ static int nbd_errno_to_system_errno(int err)
 return ENOMEM;
 case NBD_ENOSPC:
 return ENOSPC;
+default:
+TRACE("Squashing unexpected error %d to EINVAL", err);
+/* fallthrough */
 case NBD_EINVAL:
-default:
 return EINVAL;
 }
 }
-- 
2.5.5




[Qemu-devel] [PATCH 08/18] nbd: Limit nbdflags to 16 bits

2016-04-08 Thread Eric Blake
Rather than asserting that nbdflags is within range, just give
it the correct type to begin with :)  nbdflags corresponds to
the per-export portion of NBD Protocol "transmission flags", which
is 16 bits in response to NBD_OPT_EXPORT_NAME and NBD_OPT_GO.

Signed-off-by: Eric Blake 
---
 include/block/nbd.h |  2 +-
 nbd/server.c| 10 --
 qemu-nbd.c  |  2 +-
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index 2c61901..42fd670 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -105,7 +105,7 @@ typedef struct NBDExport NBDExport;
 typedef struct NBDClient NBDClient;

 NBDExport *nbd_export_new(BlockBackend *blk, off_t dev_offset, off_t size,
-  uint32_t nbdflags, void (*close)(NBDExport *),
+  uint16_t nbdflags, void (*close)(NBDExport *),
   Error **errp);
 void nbd_export_close(NBDExport *exp);
 void nbd_export_get(NBDExport *exp);
diff --git a/nbd/server.c b/nbd/server.c
index 93c077e..c8666ab 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -63,7 +63,7 @@ struct NBDExport {
 char *name;
 off_t dev_offset;
 off_t size;
-uint32_t nbdflags;
+uint16_t nbdflags;
 QTAILQ_HEAD(, NBDClient) clients;
 QTAILQ_ENTRY(NBDExport) next;

@@ -525,8 +525,8 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)
 NBDClient *client = data->client;
 char buf[8 + 8 + 8 + 128];
 int rc;
-const int myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
- NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
+const uint16_t myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
+  NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
 bool oldStyle;

 /* Old style negotiation header without options
@@ -556,7 +556,6 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)

 oldStyle = client->exp != NULL && !client->tlscreds;
 if (oldStyle) {
-assert ((client->exp->nbdflags & ~65535) == 0);
 stq_be_p(buf + 8, NBD_CLIENT_MAGIC);
 stq_be_p(buf + 16, client->exp->size);
 stw_be_p(buf + 26, client->exp->nbdflags | myflags);
@@ -585,7 +584,6 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData 
*data)
 goto fail;
 }

-assert ((client->exp->nbdflags & ~65535) == 0);
 stq_be_p(buf + 18, client->exp->size);
 stw_be_p(buf + 26, client->exp->nbdflags | myflags);
 if (nbd_negotiate_write(client->ioc, buf + 18, sizeof(buf) - 18) !=
@@ -807,7 +805,7 @@ static void nbd_eject_notifier(Notifier *n, void *data)
 }

 NBDExport *nbd_export_new(BlockBackend *blk, off_t dev_offset, off_t size,
-  uint32_t nbdflags, void (*close)(NBDExport *),
+  uint16_t nbdflags, void (*close)(NBDExport *),
   Error **errp)
 {
 NBDExport *exp = g_malloc0(sizeof(NBDExport));
diff --git a/qemu-nbd.c b/qemu-nbd.c
index c2e4d3f..8880ac3 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -454,7 +454,7 @@ int main(int argc, char **argv)
 BlockBackend *blk;
 BlockDriverState *bs;
 off_t dev_offset = 0;
-uint32_t nbdflags = 0;
+uint16_t nbdflags = 0;
 bool disconnect = false;
 const char *bindto = "0.0.0.0";
 const char *port = NULL;
-- 
2.5.5




[Qemu-devel] [PATCH 02/18] nbd: Don't fail handshake on NBD_OPT_LIST descriptions

2016-04-08 Thread Eric Blake
The NBD Protocol states that NBD_REP_SERVER may set
'length > sizeof(namelen) + namelen'; in which case the rest
of the packet is a UTF-8 description of the export.  While we
don't know of any NBD servers that send this description yet,
we had better consume the data so we don't choke when we start
to talk to such a server.

Also, a (buggy/malicious) server that replies with length <
sizeof(namelen) would cause us to block waiting for bytes that
the server is not sending, and one that replies with super-huge
lengths could cause us to temporarily allocate up to 4G memory.
Sanity check things before blindly reading incorrectly.

Signed-off-by: Eric Blake 
---
 nbd/client.c | 23 +--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/nbd/client.c b/nbd/client.c
index 6777e58..48f2a21 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -192,13 +192,18 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 return -1;
 }
 } else if (type == NBD_REP_SERVER) {
+if (len < sizeof(namelen) || len > NBD_MAX_BUFFER_SIZE) {
+error_setg(errp, "incorrect option length");
+return -1;
+}
 if (read_sync(ioc, &namelen, sizeof(namelen)) != sizeof(namelen)) {
 error_setg(errp, "failed to read option name length");
 return -1;
 }
 namelen = be32_to_cpu(namelen);
-if (len != (namelen + sizeof(namelen))) {
-error_setg(errp, "incorrect option mame length");
+len -= sizeof(namelen);
+if (len < namelen) {
+error_setg(errp, "incorrect option name length");
 return -1;
 }
 if (namelen > 255) {
@@ -214,6 +219,20 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, 
Error **errp)
 return -1;
 }
 (*name)[namelen] = '\0';
+len -= namelen;
+if (len) {
+char *buf = g_malloc(len + 1);
+if (read_sync(ioc, buf, len) != len) {
+error_setg(errp, "failed to read export description");
+g_free(*name);
+g_free(buf);
+*name = NULL;
+return -1;
+}
+buf[len] = '\0';
+TRACE("Ignoring export description: %s", buf);
+g_free(buf);
+}
 } else {
 error_setg(errp, "Unexpected reply type %x expected %x",
type, NBD_REP_SERVER);
-- 
2.5.5




[Qemu-devel] [PATCH 05/18] nbd: Reject unknown request flags

2016-04-08 Thread Eric Blake
The NBD protocol says that clients should not send a command flag
that has not been negotiated (whether by the client requesting an
option during a handshake, or because we advertise support for the
flag in response to NBD_OPT_EXPORT_NAME), and that servers should
reject invalid flags with EINVAL.  We were silently ignoring the
flags instead.  The client can't rely on our behavior, since it is
their fault for passing the bad flag in the first place, but it's
better to be robust up front than to possibly behave differently
than the client was expecting with the attempted flag.

Signed-off-by: Eric Blake 
---
 nbd/server.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/nbd/server.c b/nbd/server.c
index 81afae2..a10294e 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -984,6 +984,11 @@ static ssize_t nbd_co_receive_request(NBDRequest *req, 
struct nbd_request *reque
 goto out;
 }

+if (request->type & ~NBD_CMD_MASK_COMMAND & ~NBD_CMD_FLAG_FUA) {
+LOG("unsupported flags (got 0x%x)",
+request->type & ~NBD_CMD_MASK_COMMAND);
+return -EINVAL;
+}
 if ((request->from + request->len) < request->from) {
 LOG("integer overflow detected! "
 "you're probably being attacked");
-- 
2.5.5




[Qemu-devel] [RFC PATCH 00/18] NBD protocol additions

2016-04-08 Thread Eric Blake
This series is for qemu 2.7, and will probably need some rework
especially since some of it is trying to implement features
that are still marked experimental in upstream NBD.

Included are some interoperability bug fixes, code cleanups, then
added support both client-side and server-side for:
NBD_FLAG_C_NO_ZEROES
NBD_CMD_WRITE_ZEROES
NBD_CMD_CLOSE
NBD_OPT_INFO
NBD_OPT_GO

Still to come:
improvements to NBD_CMD_WRITE_ZEROES
support for NBD_OPT_STRUCTURED_REPLY
strawman implementations to help with discussions towards
 NBD_CMD_BLOCK_STATUS
proposal I'm still working up to teach NBD servers to advertise
 minimum/preferred/maximum block sizes

This posting is tied to this particular version of the NBD protocol:
https://github.com/yoe/nbd/blob/18918eb/doc/proto.md
plus this email about NBD_CMD_CLOSE:
https://sourceforge.net/p/nbd/mailman/message/35000466/

I performed testing by temporarily turning on DEBUG_NBD while
compiling, then connecting variations on:
  ./qemu-nbd -f raw -x foo file
  ./qemu-io -f raw nbd://localhost:10809/foo
and watching the traces on both screen (both for startup negotiation,
and for various 'write -z', 'discard', and 'q' commands in qemu-io).
I intentionally tested all three combinations of:
old client, new server
new client, old server
new client, new server
to make sure that either side gracefully handles unknown
advertisements when the other side is newer, and correctly falls
back to older usage when the other side is too old.

I'm posting now so that others may compile my work and help with
cross-project testing (such as qemu client to Alex's NBDGO
server), which in turn will help us move experimental extensions
into final form in the NBD protocol.

Also available as a tag at this location:
git fetch git://repo.or.cz/qemu/ericb.git nbd-flags-v2

Tag is named v2 because patches 1 and 2 in this grouping have
been previously posted for inclusion in qemu 2.6

Eric Blake (18):
  nbd: Don't kill server on client that doesn't request TLS
  nbd: Don't fail handshake on NBD_OPT_LIST descriptions
  nbd: More debug typo fixes, use correct formats
  nbd: Detect servers that send unexpected error values
  nbd: Reject unknown request flags
  nbd: Avoid magic number for NBD max name size
  nbd: Treat flags vs. command type as separate fields
  nbd: Limit nbdflags to 16 bits
  nbd: Share common reply-sending code in server
  nbd: Share common option-sending code in client
  nbd: Let client skip portions of server reply
  nbd: Less allocation during NBD_OPT_LIST
  nbd: Support shorter handshake
  nbd: Implement NBD_OPT_GO on client
  nbd: Implement NBD_OPT_GO on server
  nbd: Support NBD_CMD_CLOSE
  nbd: Implement NBD_CMD_WRITE_ZEROES on server
  nbd: Implement NBD_CMD_WRITE_ZEROES on client

 block/nbd-client.h  |   2 +
 include/block/nbd.h |  61 --
 nbd/nbd-internal.h  |  13 +-
 block/nbd-client.c  |  88 -
 block/nbd.c |  23 +++
 nbd/client.c| 522 ++--
 nbd/server.c| 356 ++-
 qemu-nbd.c  |   2 +-
 8 files changed, 744 insertions(+), 323 deletions(-)

-- 
2.5.5




Re: [Qemu-devel] [PATCH v2 06/13] qemu-thread: add simple test-and-set spinlock

2016-04-08 Thread Sergey Fedorov
On 09/04/16 00:31, Richard Henderson wrote:
> On 04/08/2016 02:26 PM, Paolo Bonzini wrote:
>>
>> On 08/04/2016 23:24, Alex Bennée wrote:
 Except that quite a lot of hosts can only (efficiently) do atomic 
 operations on
 a minimum of 4 byte quantities.  I'd rather continue to use int here.
>>> I suspect bool == unsigned int underneath. But having true/false and 0/1 
>>> mixed up
>>> gets confusing even if they are equivalent.
>> Sometimes sizeof(bool) == 1.
> sizeof(bool) == 1 everywhere except MacOSX, where it's 4.
>

Hm, that's too strange:

$ gcc a.c
a.c: In function ‘main’:
a.c:6:5: warning: format ‘%d’ expects argument of type ‘int’, but
argument 2 has type ‘long unsigned int’ [-Wformat=]
 printf("%d\n", sizeof(bool));
 ^
$ ./a.out
1


Kind regards,
Sergey



Re: [Qemu-devel] [PATCH v2 06/13] qemu-thread: add simple test-and-set spinlock

2016-04-08 Thread Richard Henderson
On 04/08/2016 02:26 PM, Paolo Bonzini wrote:
> 
> 
> On 08/04/2016 23:24, Alex Bennée wrote:
>>> Except that quite a lot of hosts can only (efficiently) do atomic 
>>> operations on
>>> a minimum of 4 byte quantities.  I'd rather continue to use int here.
>>
>> I suspect bool == unsigned int underneath. But having true/false and 0/1 
>> mixed up
>> gets confusing even if they are equivalent.
> 
> Sometimes sizeof(bool) == 1.

sizeof(bool) == 1 everywhere except MacOSX, where it's 4.


r~




Re: [Qemu-devel] [PATCH v2 06/13] qemu-thread: add simple test-and-set spinlock

2016-04-08 Thread Paolo Bonzini


On 08/04/2016 23:24, Alex Bennée wrote:
> > Except that quite a lot of hosts can only (efficiently) do atomic 
> > operations on
> > a minimum of 4 byte quantities.  I'd rather continue to use int here.
> 
> I suspect bool == unsigned int underneath. But having true/false and 0/1 
> mixed up
> gets confusing even if they are equivalent.

Sometimes sizeof(bool) == 1.

Paolo



Re: [Qemu-devel] [PATCH v2 06/13] qemu-thread: add simple test-and-set spinlock

2016-04-08 Thread Alex Bennée

Richard Henderson  writes:

> On 04/08/2016 06:02 AM, Alex Bennée wrote:
>>> > +typedef struct QemuSpin {
>>> > +int value;
>> If we are throwing true and false around as the only two values can we
>> use bool here and be consistent when setting/clearing.
>>
>
> Except that quite a lot of hosts can only (efficiently) do atomic operations 
> on
> a minimum of 4 byte quantities.  I'd rather continue to use int here.

I suspect bool == unsigned int underneath. But having true/false and 0/1 mixed 
up
gets confusing even if they are equivalent.

>
>
> r~


--
Alex Bennée



[Qemu-devel] [PATCH 48/50] cpu: move exec-all.h inclusion out of cpu.h

2016-04-08 Thread Paolo Bonzini
exec-all.h contains TCG-specific definitions.  It is not needed outside
TCG-specific files such as translate.c, exec.c or *helper.c.

One generic function had snuck into include/exec/exec-all.h; move it to
include/qom/cpu.h.

Signed-off-by: Paolo Bonzini 
---
 bsd-user/main.c|  1 +
 bsd-user/qemu.h|  1 +
 cpu-exec-common.c  |  1 +
 cpu-exec.c |  1 +
 cpus.c |  1 +
 cputlb.c   |  1 +
 disas/tci.c|  1 +
 exec.c |  1 +
 gdbstub.c  |  1 +
 hw/i386/kvmvapic.c |  1 +
 hw/misc/mips_itu.c |  1 +
 hw/ppc/spapr_hcall.c   |  1 +
 hw/sh4/sh7750.c|  1 +
 include/exec/exec-all.h|  9 -
 include/qom/cpu.h  | 10 ++
 linux-user/main.c  |  1 +
 linux-user/qemu.h  |  1 +
 monitor.c  |  1 +
 target-alpha/cpu.c |  1 +
 target-alpha/cpu.h |  2 --
 target-alpha/fpu_helper.c  |  1 +
 target-alpha/helper.c  |  1 +
 target-alpha/int_helper.c  |  1 +
 target-alpha/mem_helper.c  |  1 +
 target-alpha/sys_helper.c  |  1 +
 target-alpha/translate.c   |  1 +
 target-alpha/vax_helper.c  |  1 +
 target-arm/arm_ldst.h  |  1 +
 target-arm/cpu.c   |  1 +
 target-arm/cpu.h   |  2 --
 target-arm/helper-a64.c|  1 +
 target-arm/helper.c|  1 +
 target-arm/op_helper.c |  1 +
 target-arm/psci.c  |  1 +
 target-arm/translate-a64.c |  1 +
 target-arm/translate.c |  1 +
 target-cris/cpu.c  |  1 +
 target-cris/cpu.h  |  2 --
 target-cris/helper.c   |  1 +
 target-cris/mmu.c  |  1 +
 target-cris/op_helper.c|  1 +
 target-cris/translate.c|  1 +
 target-i386/bpt_helper.c   |  1 +
 target-i386/cpu.c  |  1 +
 target-i386/cpu.h  |  2 --
 target-i386/excp_helper.c  |  1 +
 target-i386/fpu_helper.c   |  1 +
 target-i386/helper.c   |  1 +
 target-i386/int_helper.c   |  1 +
 target-i386/machine.c  |  3 +++
 target-i386/mem_helper.c   |  1 +
 target-i386/misc_helper.c  |  1 +
 target-i386/mpx_helper.c   |  1 +
 target-i386/seg_helper.c   |  1 +
 target-i386/svm_helper.c   |  1 +
 target-i386/translate.c|  1 +
 target-lm32/cpu.c  |  1 +
 target-lm32/cpu.h  |  2 --
 target-lm32/helper.c   |  1 +
 target-lm32/op_helper.c|  1 +
 target-lm32/translate.c|  1 +
 target-m68k/cpu.c  |  1 +
 target-m68k/cpu.h  |  2 --
 target-m68k/helper.c   |  1 +
 target-m68k/m68k-semi.c|  1 +
 target-m68k/op_helper.c|  1 +
 target-m68k/translate.c|  1 +
 target-microblaze/cpu.c|  1 +
 target-microblaze/cpu.h|  2 --
 target-microblaze/helper.c |  1 +
 target-microblaze/mmu.c|  1 +
 target-microblaze/op_helper.c  |  1 +
 target-microblaze/translate.c  |  1 +
 target-mips/cpu.c  |  1 +
 target-mips/cpu.h  |  2 --
 target-mips/helper.c   |  1 +
 target-mips/mips-semi.c|  1 +
 target-mips/msa_helper.c   |  1 +
 target-mips/op_helper.c|  1 +
 target-mips/translate.c|  1 +
 target-moxie/cpu.c |  1 +
 target-moxie/cpu.h |  1 -
 target-openrisc/cpu.c  |  1 +
 target-openrisc/cpu.h  |  2 --
 target-openrisc/exception.c|  1 +
 target-openrisc/interrupt.c|  1 +
 target-openrisc/interrupt_helper.c |  1 +
 target-openrisc/mmu.c  |  1 +
 target-openrisc/mmu_helper.c   |  1 +
 target-openrisc/sys_helper.c   |  1 +
 target-ppc/cpu.h   |  2 --
 target-ppc/excp_helper.c   |  1 +
 target-ppc/int_helper.c|  1 +
 target-ppc/machine.c   |  2 ++
 target-ppc/mem_helper.c|  2 ++
 target-ppc/misc_helper.c   |  1 +
 target-ppc/mmu-hash32.c|  1 +
 target-ppc/mmu-hash64.c|  1 +
 target-ppc/mmu_helper.c|  1 +
 target-ppc/timebase_helper.c   |  1 +
 target-ppc/translate.c |  1 +
 target-s390x/cc_helper.c   |  1 +
 target-s390x/cpu.c |  1 +
 target-s390x/cpu.h |  2 --
 target-s390x/fpu_helper.c  |  1 +
 target-s390x/gdbstub.c |  1 +
 target-s390x/helper.c  |  1 +
 target-s390x/int_helper.c  |  1 +
 target-s390x/mem_helper.c  |  1 +
 target-s390x/misc_h

[Qemu-devel] [PATCH 50/50] hw: clean up hw/hw.h includes

2016-04-08 Thread Paolo Bonzini
Include qom/object.h and exec/memory.h instead of exec/ioport.h;
exec/ioport.h was almost everywhere required only for those two
includes, not for the content of the header itself.

Remove block/aio.h, everybody is already including it through
another path.

With this change, include/hw/hw.h is freed from qemu-common.h.

Signed-off-by: Paolo Bonzini 
---
 exec.c| 1 +
 hw/gpio/gpio_key.c| 1 +
 include/exec/ioport.h | 4 
 include/hw/hw.h   | 4 ++--
 include/hw/isa/isa.h  | 2 +-
 5 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/exec.c b/exec.c
index 29877b0..64956a4 100644
--- a/exec.c
+++ b/exec.c
@@ -41,6 +41,7 @@
 #else /* !CONFIG_USER_ONLY */
 #include "hw/hw.h"
 #include "exec/memory.h"
+#include "exec/ioport.h"
 #include "sysemu/dma.h"
 #include "exec/address-spaces.h"
 #include "sysemu/xen-mapcache.h"
diff --git a/hw/gpio/gpio_key.c b/hw/gpio/gpio_key.c
index ef28772..b34aa49 100644
--- a/hw/gpio/gpio_key.c
+++ b/hw/gpio/gpio_key.c
@@ -24,6 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
+#include "qemu/timer.h"
 
 #define TYPE_GPIOKEY "gpio-key"
 #define GPIOKEY(obj) OBJECT_CHECK(GPIOKEYState, (obj), TYPE_GPIOKEY)
diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index 6a9639c..a298b89 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -24,10 +24,6 @@
 #ifndef IOPORT_H
 #define IOPORT_H
 
-#include "qemu-common.h"
-#include "qom/object.h"
-#include "exec/memory.h"
-
 #define MAX_IOPORTS (64 * 1024)
 #define IOPORTS_MASK(MAX_IOPORTS - 1)
 
diff --git a/include/hw/hw.h b/include/hw/hw.h
index 029b1e8..3669ebd 100644
--- a/include/hw/hw.h
+++ b/include/hw/hw.h
@@ -7,9 +7,9 @@
 #endif
 
 #include "exec/cpu-common.h"
-#include "exec/ioport.h"
+#include "qom/object.h"
+#include "exec/memory.h"
 #include "hw/irq.h"
-#include "block/aio.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
 
diff --git a/include/hw/isa/isa.h b/include/hw/isa/isa.h
index ffb2ea7..c87fbad 100644
--- a/include/hw/isa/isa.h
+++ b/include/hw/isa/isa.h
@@ -3,8 +3,8 @@
 
 /* ISA bus */
 
-#include "exec/ioport.h"
 #include "exec/memory.h"
+#include "exec/ioport.h"
 #include "hw/qdev.h"
 
 #define ISA_NUM_IRQS 16
-- 
1.8.3.1




[Qemu-devel] [PATCH 46/50] hw: explicitly include qemu/log.h

2016-04-08 Thread Paolo Bonzini
Move the inclusion out of hw/hw.h, most files do not need it.

Signed-off-by: Paolo Bonzini 
---
 hw/arm/ast2400.c   | 1 +
 hw/arm/nseries.c   | 1 +
 hw/arm/palmetto-bmc.c  | 1 +
 hw/arm/pxa2xx_gpio.c   | 1 +
 hw/arm/stellaris.c | 1 +
 hw/arm/strongarm.c | 1 +
 hw/arm/xlnx-ep108.c| 1 +
 hw/audio/pl041.c   | 1 +
 hw/block/m25p80.c  | 1 +
 hw/block/pflash_cfi01.c| 1 +
 hw/char/bcm2835_aux.c  | 1 +
 hw/char/cadence_uart.c | 4 
 hw/char/digic-uart.c   | 1 +
 hw/char/imx_serial.c   | 1 +
 hw/char/pl011.c| 1 +
 hw/char/stm32f2xx_usart.c  | 1 +
 hw/display/bcm2835_fb.c| 1 +
 hw/display/cg3.c   | 1 +
 hw/display/pl110.c | 1 +
 hw/display/virtio-gpu.c| 1 +
 hw/dma/bcm2835_dma.c   | 1 +
 hw/dma/pl080.c | 1 +
 hw/dma/pl330.c | 1 +
 hw/dma/rc4030.c| 1 +
 hw/gpio/imx_gpio.c | 1 +
 hw/gpio/pl061.c| 1 +
 hw/i2c/imx_i2c.c   | 1 +
 hw/i2c/versatile_i2c.c | 1 +
 hw/input/pl050.c   | 1 +
 hw/intc/allwinner-a10-pic.c| 1 +
 hw/intc/arm_gic.c  | 1 +
 hw/intc/arm_gicv2m.c   | 1 +
 hw/intc/armv7m_nvic.c  | 1 +
 hw/intc/bcm2835_ic.c   | 1 +
 hw/intc/bcm2836_control.c  | 1 +
 hw/intc/i8259.c| 1 +
 hw/intc/imx_avic.c | 1 +
 hw/intc/openpic.c  | 1 +
 hw/intc/pl190.c| 1 +
 hw/misc/arm11scu.c | 1 +
 hw/misc/arm_integrator_debug.c | 1 +
 hw/misc/arm_l2x0.c | 1 +
 hw/misc/arm_sysctl.c   | 1 +
 hw/misc/bcm2835_mbox.c | 1 +
 hw/misc/bcm2835_property.c | 1 +
 hw/misc/imx25_ccm.c| 1 +
 hw/misc/imx31_ccm.c| 1 +
 hw/misc/imx6_ccm.c | 1 +
 hw/misc/imx_ccm.c  | 1 +
 hw/misc/macio/cuda.c   | 1 +
 hw/misc/macio/mac_dbdma.c  | 1 +
 hw/misc/mips_cmgcr.c   | 1 +
 hw/misc/mips_cpc.c | 1 +
 hw/misc/mips_itu.c | 1 +
 hw/misc/stm32f2xx_syscfg.c | 1 +
 hw/misc/zynq-xadc.c| 1 +
 hw/misc/zynq_slcr.c| 1 +
 hw/net/allwinner_emac.c| 1 +
 hw/net/fsl_etsec/etsec.c   | 1 +
 hw/net/fsl_etsec/rings.c   | 2 +-
 hw/net/imx_fec.c   | 1 +
 hw/net/lan9118.c   | 1 +
 hw/net/spapr_llan.c| 1 +
 hw/pci-host/apb.c  | 1 +
 hw/pci-host/versatile.c| 1 +
 hw/ppc/spapr.c | 1 +
 hw/ppc/spapr_hcall.c   | 1 +
 hw/ppc/spapr_iommu.c   | 1 +
 hw/ppc/spapr_rtas.c| 1 +
 hw/ppc/spapr_vio.c | 1 +
 hw/sd/pl181.c  | 1 +
 hw/sd/sd.c | 1 +
 hw/sd/sdhci.c  | 1 +
 hw/ssi/pl022.c | 1 +
 hw/timer/allwinner-a10-pit.c   | 1 +
 hw/timer/arm_timer.c   | 1 +
 hw/timer/digic-timer.c | 1 +
 hw/timer/imx_epit.c| 1 +
 hw/timer/imx_gpt.c | 1 +
 hw/timer/pl031.c   | 1 +
 hw/timer/stm32f2xx_timer.c | 1 +
 hw/watchdog/wdt_diag288.c  | 1 +
 include/hw/hw.h| 1 -
 monitor.c  | 1 +
 vl.c   | 1 +
 85 files changed, 87 insertions(+), 2 deletions(-)

diff --git a/hw/arm/ast2400.c b/hw/arm/ast2400.c
index 03f9938..5510a8a 100644
--- a/hw/arm/ast2400.c
+++ b/hw/arm/ast2400.c
@@ -17,6 +17,7 @@
 #include "exec/address-spaces.h"
 #include "hw/arm/ast2400.h"
 #include "hw/char/serial.h"
+#include "qemu/log.h"
 
 #define AST2400_UART_5_BASE  0x00184000
 #define AST2400_IOMEM_SIZE   0x0020
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index 43a78c2..6ed3dd3 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -37,6 +37,7 @@
 #include "hw/loader.h"
 #include "sysemu/block-backend.h"
 #include "hw/sysbus.h"
+#include "qemu/log.h"
 #include "exec/address-spaces.h"
 
 /* Nokia N8x0 support */
diff --git a/hw/arm/palmetto-bmc.c b/hw/arm/palmetto-bmc.c
index 89ebd92..a51d960 100644
--- a/hw/arm/palmetto-bmc.c
+++ b/hw/arm/palmetto-bmc.c
@@ -17,6 +17,7 @@
 #include "hw/arm/arm.h"
 #include "hw/arm/ast2400.h"
 #include "hw/boards.h"
+#include "qemu/log.h"
 
 static struct arm_boot_info palmetto_bmc_binfo = {
 .loader_start = AST2400_SDRAM_BASE,
diff --git a/hw/arm/pxa2xx_gpio.c b/hw/arm/pxa2xx_gpio.c
index 8c9626e..576a8eb 100644
--- a/hw/arm/pxa2xx_gpio.c
+++ b/hw/arm/pxa2xx_gpio.c
@@ -12,6 +12,7 @@
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "hw/arm/pxa.h"
+#include "qemu/log.h"
 
 #define PXA2XX_GPIO_BANKS  4
 
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index c1766f8..54f7010 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -17,6 +17,7 @@
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
 #include "hw/boards.h"
+#include "qemu/log.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"

[Qemu-devel] [PATCH 47/50] exec: extract exec/tb-context.h

2016-04-08 Thread Paolo Bonzini
TCG backends do not need most of exec-all.h; extract what they actually
need to a separate file or move it directly to tcg.h.  The next patch
will stop including exec-all.h from everywhere.

Signed-off-by: Paolo Bonzini 
---
 include/exec/exec-all.h   | 47 +--
 include/exec/tb-context.h | 46 ++
 tcg/optimize.c|  2 +-
 tcg/tcg-common.c  |  2 ++
 tcg/tcg.h | 22 ++
 5 files changed, 72 insertions(+), 47 deletions(-)
 create mode 100644 include/exec/tb-context.h

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 7362095..bcc678a 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -21,6 +21,7 @@
 #define _EXEC_ALL_H_
 
 #include "qemu-common.h"
+#include "exec/tb-context.h"
 
 /* allow to see translation results - the slowdown should be negligible, so we 
leave it */
 #define DEBUG_DISAS
@@ -40,30 +41,6 @@ typedef ram_addr_t tb_page_addr_t;
 #define DISAS_UPDATE  2 /* cpu state was modified dynamically */
 #define DISAS_TB_JUMP 3 /* only pc was modified statically */
 
-struct TranslationBlock;
-typedef struct TranslationBlock TranslationBlock;
-
-/* XXX: make safe guess about sizes */
-#define MAX_OP_PER_INSTR 266
-
-#if HOST_LONG_BITS == 32
-#define MAX_OPC_PARAM_PER_ARG 2
-#else
-#define MAX_OPC_PARAM_PER_ARG 1
-#endif
-#define MAX_OPC_PARAM_IARGS 5
-#define MAX_OPC_PARAM_OARGS 1
-#define MAX_OPC_PARAM_ARGS (MAX_OPC_PARAM_IARGS + MAX_OPC_PARAM_OARGS)
-
-/* A Call op needs up to 4 + 2N parameters on 32-bit archs,
- * and up to 4 + N parameters on 64-bit archs
- * (N = number of input arguments + output arguments).  */
-#define MAX_OPC_PARAM (4 + (MAX_OPC_PARAM_PER_ARG * MAX_OPC_PARAM_ARGS))
-#define OPC_BUF_SIZE 640
-#define OPC_MAX_SIZE (OPC_BUF_SIZE - MAX_OP_PER_INSTR)
-
-#define OPPARAM_BUF_SIZE (OPC_BUF_SIZE * MAX_OPC_PARAM)
-
 #include "qemu/log.h"
 
 void gen_intermediate_code(CPUArchState *env, struct TranslationBlock *tb);
@@ -211,9 +188,6 @@ static inline void tlb_flush_by_mmuidx(CPUState *cpu, ...)
 
 #define CODE_GEN_ALIGN   16 /* must be >= of the size of a icache line 
*/
 
-#define CODE_GEN_PHYS_HASH_BITS 15
-#define CODE_GEN_PHYS_HASH_SIZE (1 << CODE_GEN_PHYS_HASH_BITS)
-
 /* Estimated block size for TB allocation.  */
 /* ??? The following is based on a 2015 survey of x86_64 host output.
Better would seem to be some sort of dynamically sized TB array,
@@ -273,25 +247,6 @@ struct TranslationBlock {
 struct TranslationBlock *jmp_first;
 };
 
-#include "qemu/thread.h"
-
-typedef struct TBContext TBContext;
-
-struct TBContext {
-
-TranslationBlock *tbs;
-TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
-int nb_tbs;
-/* any access to the tbs or the page table must use this lock */
-QemuMutex tb_lock;
-
-/* statistics */
-int tb_flush_count;
-int tb_phys_invalidate_count;
-
-int tb_invalidated_flag;
-};
-
 void tb_free(TranslationBlock *tb);
 void tb_flush(CPUState *cpu);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
diff --git a/include/exec/tb-context.h b/include/exec/tb-context.h
new file mode 100644
index 000..c06204a
--- /dev/null
+++ b/include/exec/tb-context.h
@@ -0,0 +1,46 @@
+/*
+ * Internal structs that QEMU exports to TCG
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see .
+ */
+
+#ifndef QEMU_TB_CONTEXT_H_
+#define QEMU_TB_CONTEXT_H_
+
+#include "qemu/thread.h"
+
+#define CODE_GEN_PHYS_HASH_BITS 15
+#define CODE_GEN_PHYS_HASH_SIZE (1 << CODE_GEN_PHYS_HASH_BITS)
+
+typedef struct TranslationBlock TranslationBlock;
+typedef struct TBContext TBContext;
+
+struct TBContext {
+
+TranslationBlock *tbs;
+TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
+int nb_tbs;
+/* any access to the tbs or the page table must use this lock */
+QemuMutex tb_lock;
+
+/* statistics */
+int tb_flush_count;
+int tb_phys_invalidate_count;
+
+int tb_invalidated_flag;
+};
+
+#endif
diff --git a/tcg/optimize.c b/tcg/optimize.c
index 701f552..1d867f4 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -25,7 +25,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "cpu.h"
+#include "exec/cpu-common.h"
 #include "tc

[Qemu-devel] [PATCH 49/50] hw: remove pio_addr_t

2016-04-08 Thread Paolo Bonzini
pio_addr_t is almost unused, because these days I/O ports are simply
accessed through the address space.  cpu_{in,out}[bwl] themselves are
almost unused; monitor.c and xen-hvm.c could use address_space_read/write
directly, since they have an integer size at hand.  This leaves qtest as
the only user of those functions.

Not the other hand even portio_* functions use this type; the only
interesting use of pio_addr_t thus is include/hw/sysbus.h.  I guess I
could move it there, but I don't see much benefit in that either.  Using
uint32_t is enough and avoids the need to include ioport.h everywhere.

Signed-off-by: Paolo Bonzini 
---
 hw/core/sysbus.c  |  4 ++--
 include/exec/ioport.h | 15 ++-
 include/hw/sysbus.h   |  4 ++--
 ioport.c  | 12 ++--
 xen-hvm.c |  8 
 5 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index a7dbe2b..c0f560b 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -190,9 +190,9 @@ MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int 
n)
 return dev->mmio[n].memory;
 }
 
-void sysbus_init_ioports(SysBusDevice *dev, pio_addr_t ioport, pio_addr_t size)
+void sysbus_init_ioports(SysBusDevice *dev, uint32_t ioport, uint32_t size)
 {
-pio_addr_t i;
+uint32_t i;
 
 for (i = 0; i < size; i++) {
 assert(dev->num_pio < QDEV_MAX_PIO);
diff --git a/include/exec/ioport.h b/include/exec/ioport.h
index 3bd6722..6a9639c 100644
--- a/include/exec/ioport.h
+++ b/include/exec/ioport.h
@@ -28,9 +28,6 @@
 #include "qom/object.h"
 #include "exec/memory.h"
 
-typedef uint32_t pio_addr_t;
-#define FMT_pioaddr PRIx32
-
 #define MAX_IOPORTS (64 * 1024)
 #define IOPORTS_MASK(MAX_IOPORTS - 1)
 
@@ -49,12 +46,12 @@ typedef struct MemoryRegionPortio {
 extern const MemoryRegionOps unassigned_io_ops;
 #endif
 
-void cpu_outb(pio_addr_t addr, uint8_t val);
-void cpu_outw(pio_addr_t addr, uint16_t val);
-void cpu_outl(pio_addr_t addr, uint32_t val);
-uint8_t cpu_inb(pio_addr_t addr);
-uint16_t cpu_inw(pio_addr_t addr);
-uint32_t cpu_inl(pio_addr_t addr);
+void cpu_outb(uint32_t addr, uint8_t val);
+void cpu_outw(uint32_t addr, uint16_t val);
+void cpu_outl(uint32_t addr, uint32_t val);
+uint8_t cpu_inb(uint32_t addr);
+uint16_t cpu_inw(uint32_t addr);
+uint32_t cpu_inl(uint32_t addr);
 
 typedef struct PortioList {
 const struct MemoryRegionPortio *ports;
diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index cc1dba4..a495937 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -72,7 +72,7 @@ struct SysBusDevice {
 MemoryRegion *memory;
 } mmio[QDEV_MAX_MMIO];
 int num_pio;
-pio_addr_t pio[QDEV_MAX_PIO];
+uint32_t pio[QDEV_MAX_PIO];
 };
 
 typedef int FindSysbusDeviceFunc(SysBusDevice *sbdev, void *opaque);
@@ -81,7 +81,7 @@ void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion 
*memory);
 MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n);
 void sysbus_init_irq(SysBusDevice *dev, qemu_irq *p);
 void sysbus_pass_irq(SysBusDevice *dev, SysBusDevice *target);
-void sysbus_init_ioports(SysBusDevice *dev, pio_addr_t ioport, pio_addr_t 
size);
+void sysbus_init_ioports(SysBusDevice *dev, uint32_t ioport, uint32_t size);
 
 
 bool sysbus_has_irq(SysBusDevice *dev, int n);
diff --git a/ioport.c b/ioport.c
index 901a997..94e08ab 100644
--- a/ioport.c
+++ b/ioport.c
@@ -55,14 +55,14 @@ const MemoryRegionOps unassigned_io_ops = {
 .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-void cpu_outb(pio_addr_t addr, uint8_t val)
+void cpu_outb(uint32_t addr, uint8_t val)
 {
 trace_cpu_out(addr, 'b', val);
 address_space_write(&address_space_io, addr, MEMTXATTRS_UNSPECIFIED,
 &val, 1);
 }
 
-void cpu_outw(pio_addr_t addr, uint16_t val)
+void cpu_outw(uint32_t addr, uint16_t val)
 {
 uint8_t buf[2];
 
@@ -72,7 +72,7 @@ void cpu_outw(pio_addr_t addr, uint16_t val)
 buf, 2);
 }
 
-void cpu_outl(pio_addr_t addr, uint32_t val)
+void cpu_outl(uint32_t addr, uint32_t val)
 {
 uint8_t buf[4];
 
@@ -82,7 +82,7 @@ void cpu_outl(pio_addr_t addr, uint32_t val)
 buf, 4);
 }
 
-uint8_t cpu_inb(pio_addr_t addr)
+uint8_t cpu_inb(uint32_t addr)
 {
 uint8_t val;
 
@@ -92,7 +92,7 @@ uint8_t cpu_inb(pio_addr_t addr)
 return val;
 }
 
-uint16_t cpu_inw(pio_addr_t addr)
+uint16_t cpu_inw(uint32_t addr)
 {
 uint8_t buf[2];
 uint16_t val;
@@ -103,7 +103,7 @@ uint16_t cpu_inw(pio_addr_t addr)
 return val;
 }
 
-uint32_t cpu_inl(pio_addr_t addr)
+uint32_t cpu_inl(uint32_t addr)
 {
 uint8_t buf[4];
 uint32_t val;
diff --git a/xen-hvm.c b/xen-hvm.c
index 039680a..76dd76f 100644
--- a/xen-hvm.c
+++ b/xen-hvm.c
@@ -725,7 +725,7 @@ static ioreq_t *cpu_get_ioreq(XenIOState *state)
 return NULL;
 }
 
-static uint32_t do_inp(pio_addr_t addr, unsigned long size)
+static uint32_t do_inp(uint32_t addr, unsigned long size)
 {
 switch (size) {

[Qemu-devel] [PATCH 44/50] arm: move arm_log_exception into .c file

2016-04-08 Thread Paolo Bonzini
Avoid need for qemu/log.h inclusion, and make the function static too.

Signed-off-by: Paolo Bonzini 
---
 target-arm/helper.c| 15 +++
 target-arm/internals.h | 15 ---
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 09638b2..41abdff 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -5815,6 +5815,21 @@ static void do_v7m_exception_exit(CPUARMState *env)
pointer.  */
 }
 
+static void arm_log_exception(int idx)
+{
+if (qemu_loglevel_mask(CPU_LOG_INT)) {
+const char *exc = NULL;
+
+if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
+exc = excnames[idx];
+}
+if (!exc) {
+exc = "unknown";
+}
+qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
+}
+}
+
 void arm_v7m_cpu_do_interrupt(CPUState *cs)
 {
 ARMCPU *cpu = ARM_CPU(cs);
diff --git a/target-arm/internals.h b/target-arm/internals.h
index 2e70272..c484700 100644
--- a/target-arm/internals.h
+++ b/target-arm/internals.h
@@ -72,21 +72,6 @@ static const char * const excnames[] = {
 [EXCP_SEMIHOST] = "Semihosting call",
 };
 
-static inline void arm_log_exception(int idx)
-{
-if (qemu_loglevel_mask(CPU_LOG_INT)) {
-const char *exc = NULL;
-
-if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
-exc = excnames[idx];
-}
-if (!exc) {
-exc = "unknown";
-}
-qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
-}
-}
-
 /* Scale factor for generic timers, ie number of ns per tick.
  * This gives a 62.5MHz timer.
  */
-- 
1.8.3.1





[Qemu-devel] [PATCH 43/50] qemu-common: push cpu.h inclusion out of qemu-common.h

2016-04-08 Thread Paolo Bonzini
Signed-off-by: Paolo Bonzini 
---
 arch_init.c  |  2 ++
 cpus.c   |  3 ++-
 exec.c   |  2 +-
 gdbstub.c|  2 +-
 hw/arm/nseries.c |  1 +
 hw/arm/pxa2xx_gpio.c |  1 +
 hw/core/nmi.c|  5 +
 hw/display/cg3.c |  1 +
 hw/i386/kvm/apic.c   |  2 ++
 hw/i386/kvm/clock.c  |  1 +
 hw/i386/kvmvapic.c   |  2 ++
 hw/intc/apic.c   |  2 ++
 hw/intc/apic_common.c|  2 ++
 hw/intc/arm_gic_kvm.c|  2 ++
 hw/intc/armv7m_nvic.c|  1 +
 hw/intc/openpic_kvm.c|  2 ++
 hw/intc/s390_flic_kvm.c  |  2 ++
 hw/misc/mips_cpc.c   |  1 +
 hw/misc/mips_itu.c   |  1 +
 hw/ppc/ppc4xx_devs.c |  1 +
 hw/ppc/prep.c|  1 +
 hw/ppc/virtex_ml507.c|  1 +
 hw/xtensa/pic_cpu.c  |  1 +
 include/disas/disas.h|  2 ++
 include/exec/gdbstub.h   |  2 ++
 include/exec/hwaddr.h|  2 ++
 include/hw/arm/digic.h   |  1 +
 include/hw/arm/virt-acpi-build.h |  1 +
 include/hw/arm/virt.h|  1 +
 include/hw/hw.h  |  1 -
 include/hw/sd/sd.h   |  2 ++
 include/hw/xen/xen.h |  7 ---
 include/qemu-common.h|  5 -
 include/sysemu/kvm.h |  1 +
 ioport.c |  2 ++
 memory.c |  2 ++
 migration/ram.c  |  2 ++
 migration/savevm.c   |  1 +
 monitor.c|  2 ++
 qtest.c  |  2 ++
 scripts/tracetool/format/tcg_helper_c.py |  1 +
 target-alpha/gdbstub.c   |  1 +
 target-alpha/machine.c   |  2 ++
 target-arm/gdbstub.c |  1 +
 target-arm/gdbstub64.c   |  1 +
 target-arm/kvm-stub.c|  1 +
 target-arm/kvm32.c   |  2 +-
 target-arm/kvm64.c   |  2 +-
 target-arm/machine.c |  2 ++
 target-cris/gdbstub.c|  1 +
 target-cris/machine.c|  2 ++
 target-i386/gdbstub.c|  1 +
 target-i386/kvm-stub.c   |  1 +
 target-i386/kvm.c|  2 +-
 target-i386/machine.c|  2 ++
 target-lm32/gdbstub.c|  1 +
 target-lm32/machine.c|  2 ++
 target-m68k/gdbstub.c|  1 +
 target-microblaze/gdbstub.c  |  1 +
 target-mips/cpu.h| 18 ++
 target-mips/gdbstub.c|  1 +
 target-mips/helper.c | 17 +
 target-mips/kvm.c|  2 +-
 target-mips/machine.c|  2 ++
 target-moxie/machine.c   |  2 ++
 target-openrisc/gdbstub.c|  1 +
 target-openrisc/machine.c|  2 ++
 target-ppc/gdbstub.c |  1 +
 target-ppc/kvm-stub.c|  1 +
 target-ppc/kvm.c |  2 +-
 target-ppc/machine.c |  2 ++
 target-s390x/gdbstub.c   |  1 +
 target-s390x/kvm.c   |  2 +-
 target-sh4/gdbstub.c |  1 +
 target-sparc/gdbstub.c   |  1 +
 target-sparc/machine.c   |  2 ++
 target-xtensa/gdbstub.c  |  1 +
 tcg/optimize.c   |  3 +--
 tcg/tcg-op.c |  2 ++
 tcg/tcg.h|  1 +
 80 files changed, 131 insertions(+), 36 deletions(-)

diff --git a/arch_init.c b/arch_init.c
index e3bb1b3..07f047f 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -22,6 +22,8 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/arch_init.h"
 #include "hw/pci/pci.h"
diff --git a/cpus.c b/cpus.c
index cbeb1f6..7b6ebeb 100644
--- a/cpus.c
+++ b/cpus.c
@@ -24,7 +24,8 @@
 
 /* Needed early for CONFIG_BSD etc. */
 #include "qemu/osdep.h"
-
+#include "qemu-common.h"
+#include "cpu.h"
 #include "monitor/monitor.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/error-report.h"
diff --git a/exec.c b/exec.c
index fbfa02e..dee542b 100644
--- a/exec.c
+++ b/exec.c
@@ -28,10 +28,10 @@
 #include "hw/qdev-core.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/boards.h"
+#include "hw/xen/xen.h"
 #endif
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
-#include "hw/xen/xen.

[Qemu-devel] [PATCH 41/50] s390x: move stuff out of cpu.h

2016-04-08 Thread Paolo Bonzini
Signed-off-by: Paolo Bonzini 
---
 hw/s390x/css.c  |   4 +-
 hw/s390x/s390-skeys.c   |   1 +
 hw/s390x/s390-virtio-ccw.c  |   4 +-
 hw/s390x/virtio-ccw.c   |   5 +-
 hw/s390x/virtio-ccw.h   |   3 +-
 {hw => include/hw}/s390x/css.h  |  31 +++-
 {target-s390x => include/hw/s390x}/ioinst.h |  16 +---
 target-s390x/cpu.h  | 117 ++--
 target-s390x/helper.c   |   1 +
 target-s390x/interrupt.c|  64 +++
 target-s390x/ioinst.c   |   2 +-
 11 files changed, 131 insertions(+), 117 deletions(-)
 rename {hw => include/hw}/s390x/css.h (76%)
 rename {target-s390x => include/hw/s390x}/ioinst.h (87%)

diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 3a1d919..1675a19 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -14,8 +14,8 @@
 #include "qemu/bitops.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
-#include "ioinst.h"
-#include "css.h"
+#include "hw/s390x/ioinst.h"
+#include "hw/s390x/css.h"
 #include "trace.h"
 #include "hw/s390x/s390_flic.h"
 
diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
index 6528ffe..d772cfc 100644
--- a/hw/s390x/s390-skeys.c
+++ b/hw/s390x/s390-skeys.c
@@ -15,6 +15,7 @@
 #include "migration/qemu-file.h"
 #include "hw/s390x/storage-keys.h"
 #include "qemu/error-report.h"
+#include "sysemu/kvm.h"
 
 #define S390_SKEYS_BUFFER_SIZE 131072  /* Room for 128k storage keys */
 #define S390_SKEYS_SAVE_FLAG_EOS 0x01
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index e3df9c7..8bbaccb 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -18,8 +18,8 @@
 #include "s390-virtio.h"
 #include "hw/s390x/sclp.h"
 #include "hw/s390x/s390_flic.h"
-#include "ioinst.h"
-#include "css.h"
+#include "hw/s390x/ioinst.h"
+#include "hw/s390x/css.h"
 #include "virtio-ccw.h"
 #include "qemu/config-file.h"
 #include "s390-pci-bus.h"
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index d51642d..a1c1ed9 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -16,6 +16,7 @@
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "net/net.h"
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-serial.h"
@@ -28,8 +29,8 @@
 #include "hw/s390x/adapter.h"
 #include "hw/s390x/s390_flic.h"
 
-#include "ioinst.h"
-#include "css.h"
+#include "hw/s390x/ioinst.h"
+#include "hw/s390x/css.h"
 #include "virtio-ccw.h"
 #include "trace.h"
 
diff --git a/hw/s390x/virtio-ccw.h b/hw/s390x/virtio-ccw.h
index 66c831b..86b9edb 100644
--- a/hw/s390x/virtio-ccw.h
+++ b/hw/s390x/virtio-ccw.h
@@ -24,7 +24,8 @@
 #include 
 #include 
 
-#include "css.h"
+#include 
+#include 
 
 #define VIRTUAL_CSSID 0xfe
 
diff --git a/hw/s390x/css.h b/include/hw/s390x/css.h
similarity index 76%
rename from hw/s390x/css.h
rename to include/hw/s390x/css.h
index a320eea..98b2e2c 100644
--- a/hw/s390x/css.h
+++ b/include/hw/s390x/css.h
@@ -14,7 +14,7 @@
 
 #include "hw/s390x/adapter.h"
 #include "hw/s390x/s390_flic.h"
-#include "ioinst.h"
+#include "hw/s390x/ioinst.h"
 
 /* Channel subsystem constants. */
 #define MAX_SCHID 65535
@@ -67,6 +67,7 @@ typedef struct CMBE {
 uint32_t reserved[7];
 } QEMU_PACKED CMBE;
 
+typedef struct SubchDev SubchDev;
 struct SubchDev {
 /* channel-subsystem related things: */
 uint8_t cssid;
@@ -123,4 +124,32 @@ void css_adapter_interrupt(uint8_t isc);
 #define CSS_IO_ADAPTER_VIRTIO 1
 int css_register_io_adapter(uint8_t type, uint8_t isc, bool swap,
 bool maskable, uint32_t *id);
+
+#ifndef CONFIG_USER_ONLY
+SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid,
+ uint16_t schid);
+bool css_subch_visible(SubchDev *sch);
+void css_conditional_io_interrupt(SubchDev *sch);
+int css_do_stsch(SubchDev *sch, SCHIB *schib);
+bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid);
+int css_do_msch(SubchDev *sch, const SCHIB *schib);
+int css_do_xsch(SubchDev *sch);
+int css_do_csch(SubchDev *sch);
+int css_do_hsch(SubchDev *sch);
+int css_do_ssch(SubchDev *sch, ORB *orb);
+int css_do_tsch_get_irb(SubchDev *sch, IRB *irb, int *irb_len);
+void css_do_tsch_update_subch(SubchDev *sch);
+int css_do_stcrw(CRW *crw);
+void css_undo_stcrw(CRW *crw);
+int css_do_tpi(IOIntCode *int_code, int lowcore);
+int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t 
l_chpid,
+ int rfmt, void *buf);
+void css_do_schm(uint8_t mbk, int update, int dct, uint64_t mbo);
+int css_enable_mcsse(void);
+int css_enable_mss(void);
+int css_do_rsch(SubchDev *sch);
+int css_do_rchp(uint8_t cssid, uint8_t chpid);
+bool css_present(uint8_t cssid);
+#endif
+
 #endif
diff --git a/target-s390x/ioinst.h b/include/hw/s390x/ioinst.h
similarity index 87%
rename fr

[Qemu-devel] [PATCH 42/50] acpi: do not use TARGET_PAGE_SIZE

2016-04-08 Thread Paolo Bonzini
This is a #define used by the CPU.  NVDIMM can just use 4K
unconditionally.

Signed-off-by: Paolo Bonzini 
---
 hw/acpi/nvdimm.c | 22 +++---
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/acpi/nvdimm.c b/hw/acpi/nvdimm.c
index 9531340..fb925dc 100644
--- a/hw/acpi/nvdimm.c
+++ b/hw/acpi/nvdimm.c
@@ -378,17 +378,19 @@ struct NvdimmDsmIn {
 uint32_t function;
 /* the remaining size in the page is used by arg3. */
 union {
-uint8_t arg3[0];
+uint8_t arg3[4084];
 };
 } QEMU_PACKED;
 typedef struct NvdimmDsmIn NvdimmDsmIn;
+QEMU_BUILD_BUG_ON(sizeof(NvdimmDsmIn) != 4096);
 
 struct NvdimmDsmOut {
 /* the size of buffer filled by QEMU. */
 uint32_t len;
-uint8_t data[0];
+uint8_t data[4092];
 } QEMU_PACKED;
 typedef struct NvdimmDsmOut NvdimmDsmOut;
+QEMU_BUILD_BUG_ON(sizeof(NvdimmDsmOut) != 4096);
 
 struct NvdimmDsmFunc0Out {
 /* the size of buffer filled by QEMU. */
@@ -424,8 +426,8 @@ nvdimm_dsm_write(void *opaque, hwaddr addr, uint64_t val, 
unsigned size)
  * can change its content while we are doing DSM emulation. Avoid
  * this by copying DSM memory to QEMU local memory.
  */
-in = g_malloc(TARGET_PAGE_SIZE);
-cpu_physical_memory_read(dsm_mem_addr, in, TARGET_PAGE_SIZE);
+in = g_new(NvdimmDsmIn, 1);
+cpu_physical_memory_read(dsm_mem_addr, in, sizeof(*in));
 
 le32_to_cpus(&in->revision);
 le32_to_cpus(&in->function);
@@ -475,7 +477,7 @@ void nvdimm_init_acpi_state(AcpiNVDIMMState *state, 
MemoryRegion *io,
 memory_region_add_subregion(io, NVDIMM_ACPI_IO_BASE, &state->io_mr);
 
 state->dsm_mem = g_array_new(false, true /* clear */, 1);
-acpi_data_push(state->dsm_mem, TARGET_PAGE_SIZE);
+acpi_data_push(state->dsm_mem, sizeof(NvdimmDsmIn));
 fw_cfg_add_file(fw_cfg, NVDIMM_DSM_MEM_FILE, state->dsm_mem->data,
 state->dsm_mem->len);
 }
@@ -608,7 +610,7 @@ static void nvdimm_build_ssdt(GSList *device_list, GArray 
*table_offsets,
 aml_append(dev, aml_operation_region("NPIO", AML_SYSTEM_IO,
aml_int(NVDIMM_ACPI_IO_BASE), NVDIMM_ACPI_IO_LEN));
 aml_append(dev, aml_operation_region("NRAM", AML_SYSTEM_MEMORY,
-   aml_name(NVDIMM_ACPI_MEM_ADDR), TARGET_PAGE_SIZE));
+   aml_name(NVDIMM_ACPI_MEM_ADDR), sizeof(NvdimmDsmIn)));
 
 /*
  * DSM notifier:
@@ -642,8 +644,7 @@ static void nvdimm_build_ssdt(GSList *device_list, GArray 
*table_offsets,
 aml_append(field, aml_named_field("FUNC",
sizeof(typeof_field(NvdimmDsmIn, function)) * BITS_PER_BYTE));
 aml_append(field, aml_named_field("ARG3",
-   (TARGET_PAGE_SIZE - offsetof(NvdimmDsmIn, arg3)) *
-BITS_PER_BYTE));
+   (sizeof(NvdimmDsmIn) - offsetof(NvdimmDsmIn, arg3)) * 
BITS_PER_BYTE));
 aml_append(dev, field);
 
 /*
@@ -659,8 +660,7 @@ static void nvdimm_build_ssdt(GSList *device_list, GArray 
*table_offsets,
 aml_append(field, aml_named_field("RLEN",
sizeof(typeof_field(NvdimmDsmOut, len)) * BITS_PER_BYTE));
 aml_append(field, aml_named_field("ODAT",
-   (TARGET_PAGE_SIZE - offsetof(NvdimmDsmOut, data)) *
- BITS_PER_BYTE));
+   (sizeof(NvdimmDsmOut) - offsetof(NvdimmDsmOut, data)) * 
BITS_PER_BYTE));
 aml_append(dev, field);
 
 nvdimm_build_common_dsm(dev);
@@ -678,7 +678,7 @@ static void nvdimm_build_ssdt(GSList *device_list, GArray 
*table_offsets,
 mem_addr_offset = build_append_named_dword(table_data,
NVDIMM_ACPI_MEM_ADDR);
 
-bios_linker_loader_alloc(linker, NVDIMM_DSM_MEM_FILE, TARGET_PAGE_SIZE,
+bios_linker_loader_alloc(linker, NVDIMM_DSM_MEM_FILE, sizeof(NvdimmDsmIn),
  false /* high memory */);
 bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,
NVDIMM_DSM_MEM_FILE, table_data,
-- 
1.8.3.1





[Qemu-devel] [PATCH 40/50] dma: do not depend on kvm_enabled()

2016-04-08 Thread Paolo Bonzini
Memory barriers are needed also by Xen and, when the ioeventfd
bugs are fixed, by TCG as well.

sysemu/kvm.h is not anymore needed in sysemu/dma.h, move it to
the actual users.

Signed-off-by: Paolo Bonzini 
---
 hw/intc/arm_gicv2m.c | 1 +
 hw/ppc/e500plat.c| 1 +
 hw/ppc/spapr_hcall.c | 1 +
 hw/ppc/spapr_rtas.c  | 1 +
 include/sysemu/dma.h | 5 +
 5 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv2m.c b/hw/intc/arm_gicv2m.c
index e8b5177..589d315 100644
--- a/hw/intc/arm_gicv2m.c
+++ b/hw/intc/arm_gicv2m.c
@@ -29,6 +29,7 @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/pci/msi.h"
+#include "sysemu/kvm.h"
 
 #define TYPE_ARM_GICV2M "arm-gicv2m"
 #define ARM_GICV2M(obj) OBJECT_CHECK(ARMGICv2mState, (obj), TYPE_ARM_GICV2M)
diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index b00565c..94b4545 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -14,6 +14,7 @@
 #include "e500.h"
 #include "hw/boards.h"
 #include "sysemu/device_tree.h"
+#include "sysemu/kvm.h"
 #include "hw/pci/pci.h"
 #include "hw/ppc/openpic.h"
 #include "kvm_ppc.h"
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 8f40602..4426a50 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -7,6 +7,7 @@
 #include "mmu-hash64.h"
 #include "cpu-models.h"
 #include "trace.h"
+#include "sysemu/kvm.h"
 #include "kvm_ppc.h"
 
 struct SPRSyncState {
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 2db2292..5352767 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -31,6 +31,7 @@
 #include "hw/qdev.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/cpus.h"
+#include "sysemu/kvm.h"
 
 #include "hw/ppc/spapr.h"
 #include "hw/ppc/spapr_vio.h"
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index b0fbb9b..8a06f7a 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -15,7 +15,6 @@
 #include "hw/hw.h"
 #include "block/block.h"
 #include "block/accounting.h"
-#include "sysemu/kvm.h"
 
 typedef struct ScatterGatherEntry ScatterGatherEntry;
 
@@ -67,9 +66,7 @@ static inline void dma_barrier(AddressSpace *as, DMADirection 
dir)
  * use lighter barriers based on the direction of the
  * transfer, the DMA context, etc...
  */
-if (kvm_enabled()) {
-smp_mb();
-}
+smp_mb();
 }
 
 /* Checks that the given range of addresses is valid for DMA.  This is
-- 
1.8.3.1





[Qemu-devel] [PATCH 37/50] qemu-common: stop including qemu/bswap.h from qemu-common.h

2016-04-08 Thread Paolo Bonzini
Move it to the actual users.  There are still a few includes of
qemu/bswap.h in headers; removing them is left for future work.

Signed-off-by: Paolo Bonzini 
---
 audio/mixeng.c | 1 +
 block/bochs.c  | 1 +
 block/cloop.c  | 1 +
 block/parallels.c  | 1 +
 block/qcow.c   | 1 +
 block/qcow2-cluster.c  | 1 +
 block/qcow2-refcount.c | 1 +
 block/qcow2-snapshot.c | 1 +
 block/qcow2.c  | 1 +
 block/qed-table.c  | 1 +
 block/qed.c| 1 +
 block/vdi.c| 1 +
 block/vhdx-endian.c| 1 +
 block/vhdx-log.c   | 1 +
 block/vhdx.c   | 1 +
 block/vmdk.c   | 1 +
 block/vpc.c| 1 +
 block/vvfat.c  | 1 +
 crypto/afsplit.c   | 1 +
 crypto/block-luks.c| 1 +
 device_tree.c  | 1 +
 hw/arm/nseries.c   | 1 +
 hw/block/hd-geometry.c | 1 +
 hw/bt/hci-csr.c| 1 +
 hw/bt/l2cap.c  | 1 +
 include/qemu-common.h  | 2 --
 io/channel-websock.c   | 1 +
 nbd/nbd-internal.h | 1 +
 qemu-nbd.c | 1 +
 tests/ide-test.c   | 1 +
 ui/vnc-ws.c| 1 +
 31 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/audio/mixeng.c b/audio/mixeng.c
index 981b97a..b4b3a4a 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -24,6 +24,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
+#include "qemu/bswap.h"
 #include "audio.h"
 
 #define AUDIO_CAP "mixeng"
diff --git a/block/bochs.c b/block/bochs.c
index af8b7ab..42d7c33 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -27,6 +27,7 @@
 #include "qemu-common.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
+#include "qemu/bswap.h"
 
 /**/
 
diff --git a/block/cloop.c b/block/cloop.c
index a84f140..f5d3123 100644
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -26,6 +26,7 @@
 #include "qemu-common.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
+#include "qemu/bswap.h"
 #include 
 
 /* Maximum compressed block size */
diff --git a/block/parallels.c b/block/parallels.c
index 324ed43..5be8165 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -33,6 +33,7 @@
 #include "block/block_int.h"
 #include "sysemu/block-backend.h"
 #include "qemu/module.h"
+#include "qemu/bswap.h"
 #include "qemu/bitmap.h"
 #include "qapi/util.h"
 
diff --git a/block/qcow.c b/block/qcow.c
index 60ddb12..f70dc58 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -28,6 +28,7 @@
 #include "block/block_int.h"
 #include "sysemu/block-backend.h"
 #include "qemu/module.h"
+#include "qemu/bswap.h"
 #include 
 #include "qapi/qmp/qerror.h"
 #include "crypto/cipher.h"
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 31ecc10..892e0fb 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -29,6 +29,7 @@
 #include "qemu-common.h"
 #include "block/block_int.h"
 #include "block/qcow2.h"
+#include "qemu/bswap.h"
 #include "trace.h"
 
 int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index ca6094f..7fa972a 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -28,6 +28,7 @@
 #include "block/block_int.h"
 #include "block/qcow2.h"
 #include "qemu/range.h"
+#include "qemu/bswap.h"
 
 static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size);
 static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 5f4a17e..242fb21 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -26,6 +26,7 @@
 #include "qapi/error.h"
 #include "block/block_int.h"
 #include "block/qcow2.h"
+#include "qemu/bswap.h"
 #include "qemu/error-report.h"
 #include "qemu/cutils.h"
 
diff --git a/block/qcow2.c b/block/qcow2.c
index 056525c..5e457ae 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -36,6 +36,7 @@
 #include "trace.h"
 #include "qemu/option_int.h"
 #include "qemu/cutils.h"
+#include "qemu/bswap.h"
 
 /*
   Differences with QCOW:
diff --git a/block/qed-table.c b/block/qed-table.c
index 802945f..c841ad1 100644
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -16,6 +16,7 @@
 #include "trace.h"
 #include "qemu/sockets.h" /* for EINPROGRESS on Windows */
 #include "qed.h"
+#include "qemu/bswap.h"
 
 typedef struct {
 GenericCB gencb;
diff --git a/block/qed.c b/block/qed.c
index 0af5274..b07d5bb 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -15,6 +15,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/timer.h"
+#include "qemu/bswap.h"
 #include "trace.h"
 #include "qed.h"
 #include "qapi/qmp/qerror.h"
diff --git a/block/vdi.c b/block/vdi.c
index 75d4819..49b87b6 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -54,6 +54,7 @@
 #include "block/block_int.h"
 #include "sysemu/block-backend.h"
 #include "qemu/module.h"
+#include "qemu/bswap.h"
 #include "migration/migration.h"
 #include "qemu/coroutine.h"
 #include "qemu/cutils.h"
diff --git a/block/vhdx-endian.c b/block/vhdx-endian.

[Qemu-devel] [PATCH 30/50] explicitly include linux/kvm.h

2016-04-08 Thread Paolo Bonzini
Signed-off-by: Paolo Bonzini 
---
 hw/i386/kvm/i8254.c  | 1 +
 hw/i386/kvm/pci-assign.c | 1 +
 hw/vfio/common.c | 3 +++
 3 files changed, 5 insertions(+)

diff --git a/hw/i386/kvm/i8254.c b/hw/i386/kvm/i8254.c
index a4462e5..734992e 100644
--- a/hw/i386/kvm/i8254.c
+++ b/hw/i386/kvm/i8254.c
@@ -29,6 +29,7 @@
 #include "hw/timer/i8254.h"
 #include "hw/timer/i8254_internal.h"
 #include "sysemu/kvm.h"
+#include "linux/kvm.h"
 
 #define KVM_PIT_REINJECT_BIT 0
 
diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index bf425a2..db2cbd2 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -33,6 +33,7 @@
 #include "sysemu/sysemu.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/msi.h"
+#include "linux/kvm.h"
 #include "kvm_i386.h"
 #include "hw/pci/pci-assign.h"
 
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index f27db36..88154a1 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -30,6 +30,9 @@
 #include "hw/hw.h"
 #include "qemu/error-report.h"
 #include "sysemu/kvm.h"
+#ifdef CONFIG_KVM
+#include "linux/kvm.h"
+#endif
 #include "trace.h"
 
 struct vfio_group_head vfio_group_list =
-- 
1.8.3.1





[Qemu-devel] [PATCH 26/50] ppc: use PowerPCCPU instead of CPUPPCState

2016-04-08 Thread Paolo Bonzini
This changes a cpu.h dependency for hw/ppc/ppc.h into a cpu-qom.h
dependency.  For it to compile we also need to clean up a few unused
definitions.

Signed-off-by: Paolo Bonzini 
---
 hw/ppc/ppc.c| 20 +-
 include/hw/ppc/ppc.h| 24 +++-
 target-ppc/translate_init.c | 92 +++--
 3 files changed, 63 insertions(+), 73 deletions(-)

diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 38ff2e1..cdf9f25 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -164,9 +164,9 @@ static void ppc6xx_set_irq(void *opaque, int pin, int level)
 }
 }
 
-void ppc6xx_irq_init(CPUPPCState *env)
+void ppc6xx_irq_init(PowerPCCPU *cpu)
 {
-PowerPCCPU *cpu = ppc_env_get_cpu(env);
+CPUPPCState *env = &cpu->env;
 
 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc6xx_set_irq, cpu,
   PPC6xx_INPUT_NB);
@@ -251,9 +251,9 @@ static void ppc970_set_irq(void *opaque, int pin, int level)
 }
 }
 
-void ppc970_irq_init(CPUPPCState *env)
+void ppc970_irq_init(PowerPCCPU *cpu)
 {
-PowerPCCPU *cpu = ppc_env_get_cpu(env);
+CPUPPCState *env = &cpu->env;
 
 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc970_set_irq, cpu,
   PPC970_INPUT_NB);
@@ -287,9 +287,9 @@ static void power7_set_irq(void *opaque, int pin, int level)
 }
 }
 
-void ppcPOWER7_irq_init(CPUPPCState *env)
+void ppcPOWER7_irq_init(PowerPCCPU *cpu)
 {
-PowerPCCPU *cpu = ppc_env_get_cpu(env);
+CPUPPCState *env = &cpu->env;
 
 env->irq_inputs = (void **)qemu_allocate_irqs(&power7_set_irq, cpu,
   POWER7_INPUT_NB);
@@ -372,9 +372,9 @@ static void ppc40x_set_irq(void *opaque, int pin, int level)
 }
 }
 
-void ppc40x_irq_init(CPUPPCState *env)
+void ppc40x_irq_init(PowerPCCPU *cpu)
 {
-PowerPCCPU *cpu = ppc_env_get_cpu(env);
+CPUPPCState *env = &cpu->env;
 
 env->irq_inputs = (void **)qemu_allocate_irqs(&ppc40x_set_irq,
   cpu, PPC40x_INPUT_NB);
@@ -436,9 +436,9 @@ static void ppce500_set_irq(void *opaque, int pin, int 
level)
 }
 }
 
-void ppce500_irq_init(CPUPPCState *env)
+void ppce500_irq_init(PowerPCCPU *cpu)
 {
-PowerPCCPU *cpu = ppc_env_get_cpu(env);
+CPUPPCState *env = &cpu->env;
 
 env->irq_inputs = (void **)qemu_allocate_irqs(&ppce500_set_irq,
   cpu, PPCE500_INPUT_NB);
diff --git a/include/hw/ppc/ppc.h b/include/hw/ppc/ppc.h
index 14efd0c..5617dc4 100644
--- a/include/hw/ppc/ppc.h
+++ b/include/hw/ppc/ppc.h
@@ -1,6 +1,8 @@
 #ifndef HW_PPC_H
 #define HW_PPC_H 1
 
+#include "target-ppc/cpu-qom.h"
+
 void ppc_set_irq(PowerPCCPU *cpu, int n_IRQ, int level);
 
 /* PowerPC hardware exceptions management helpers */
@@ -64,17 +66,21 @@ clk_setup_cb ppc_40x_timers_init (CPUPPCState *env, 
uint32_t freq,
 void ppc40x_core_reset(PowerPCCPU *cpu);
 void ppc40x_chip_reset(PowerPCCPU *cpu);
 void ppc40x_system_reset(PowerPCCPU *cpu);
-void PREP_debug_write (void *opaque, uint32_t addr, uint32_t val);
-
-extern CPUWriteMemoryFunc * const PPC_io_write[];
-extern CPUReadMemoryFunc * const PPC_io_read[];
 void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val);
 
-void ppc40x_irq_init (CPUPPCState *env);
-void ppce500_irq_init (CPUPPCState *env);
-void ppc6xx_irq_init (CPUPPCState *env);
-void ppc970_irq_init (CPUPPCState *env);
-void ppcPOWER7_irq_init (CPUPPCState *env);
+#if defined(CONFIG_USER_ONLY)
+static inline void ppc40x_irq_init(PowerPCCPU *cpu) {}
+static inline void ppc6xx_irq_init(PowerPCCPU *cpu) {}
+static inline void ppc970_irq_init(PowerPCCPU *cpu) {}
+static inline void ppcPOWER7_irq_init(PowerPCCPU *cpu) {}
+static inline void ppce500_irq_init(PowerPCCPU *cpu) {}
+#else
+void ppc40x_irq_init(PowerPCCPU *cpu);
+void ppce500_irq_init(PowerPCCPU *cpu);
+void ppc6xx_irq_init(PowerPCCPU *cpu);
+void ppc970_irq_init(PowerPCCPU *cpu);
+void ppcPOWER7_irq_init(PowerPCCPU *cpu);
+#endif
 
 /* PPC machines for OpenBIOS */
 enum {
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index f515725..954195f 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -31,29 +31,13 @@
 #include "qemu/error-report.h"
 #include "qapi/visitor.h"
 #include "hw/qdev-properties.h"
+#include "hw/ppc/ppc.h"
 
 //#define PPC_DUMP_CPU
 //#define PPC_DEBUG_SPR
 //#define PPC_DUMP_SPR_ACCESSES
 /* #define USE_APPLE_GDB */
 
-/* For user-mode emulation, we don't emulate any IRQ controller */
-#if defined(CONFIG_USER_ONLY)
-#define PPC_IRQ_INIT_FN(name) \
-static inline void glue(glue(ppc, name),_irq_init) (CPUPPCState *env) \
-{ \
-}
-#else
-#define PPC_IRQ_INIT_FN(name) \
-void glue(glue(ppc, name),_i

[Qemu-devel] [PATCH 36/50] cpu: move endian-dependent load/store functions to cpu-all.h

2016-04-08 Thread Paolo Bonzini
Disentangle cpu-common.h and memory.h from NEED_CPU_H.  Prototypes are
not defined for !NEED_CPU_H, so remove them from poison.h too.  Only
macros need poisoning.

Signed-off-by: Paolo Bonzini 
---
 include/exec/cpu-all.h| 25 +
 include/exec/cpu-common.h | 10 --
 include/exec/memory.h | 17 -
 include/exec/poison.h |  8 
 4 files changed, 25 insertions(+), 35 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 08e5093..3911576 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -165,6 +165,31 @@ extern unsigned long reserved_va;
 
 #define GUEST_ADDR_MAX (reserved_va ? reserved_va : \
 (1ul << TARGET_VIRT_ADDR_SPACE_BITS) - 1)
+#else
+
+#include "exec/hwaddr.h"
+uint32_t lduw_phys(AddressSpace *as, hwaddr addr);
+uint32_t ldl_phys(AddressSpace *as, hwaddr addr);
+uint64_t ldq_phys(AddressSpace *as, hwaddr addr);
+void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val);
+void stw_phys(AddressSpace *as, hwaddr addr, uint32_t val);
+void stl_phys(AddressSpace *as, hwaddr addr, uint32_t val);
+void stq_phys(AddressSpace *as, hwaddr addr, uint64_t val);
+
+uint32_t address_space_lduw(AddressSpace *as, hwaddr addr,
+MemTxAttrs attrs, MemTxResult *result);
+uint32_t address_space_ldl(AddressSpace *as, hwaddr addr,
+MemTxAttrs attrs, MemTxResult *result);
+uint64_t address_space_ldq(AddressSpace *as, hwaddr addr,
+MemTxAttrs attrs, MemTxResult *result);
+void address_space_stl_notdirty(AddressSpace *as, hwaddr addr, uint32_t val,
+MemTxAttrs attrs, MemTxResult *result);
+void address_space_stw(AddressSpace *as, hwaddr addr, uint32_t val,
+MemTxAttrs attrs, MemTxResult *result);
+void address_space_stl(AddressSpace *as, hwaddr addr, uint32_t val,
+MemTxAttrs attrs, MemTxResult *result);
+void address_space_stq(AddressSpace *as, hwaddr addr, uint64_t val,
+MemTxAttrs attrs, MemTxResult *result);
 #endif
 
 /* page related stuff */
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 4f59034..04eade5 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -109,16 +109,6 @@ void stl_be_phys(AddressSpace *as, hwaddr addr, uint32_t 
val);
 void stq_le_phys(AddressSpace *as, hwaddr addr, uint64_t val);
 void stq_be_phys(AddressSpace *as, hwaddr addr, uint64_t val);
 
-#ifdef NEED_CPU_H
-uint32_t lduw_phys(AddressSpace *as, hwaddr addr);
-uint32_t ldl_phys(AddressSpace *as, hwaddr addr);
-uint64_t ldq_phys(AddressSpace *as, hwaddr addr);
-void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val);
-void stw_phys(AddressSpace *as, hwaddr addr, uint32_t val);
-void stl_phys(AddressSpace *as, hwaddr addr, uint32_t val);
-void stq_phys(AddressSpace *as, hwaddr addr, uint64_t val);
-#endif
-
 void cpu_physical_memory_write_rom(AddressSpace *as, hwaddr addr,
const uint8_t *buf, int len);
 void cpu_flush_icache_range(hwaddr start, int len);
diff --git a/include/exec/memory.h b/include/exec/memory.h
index e2a3e99..7fb9188 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -1292,23 +1292,6 @@ void address_space_stq_le(AddressSpace *as, hwaddr addr, 
uint64_t val,
 void address_space_stq_be(AddressSpace *as, hwaddr addr, uint64_t val,
 MemTxAttrs attrs, MemTxResult *result);
 
-#ifdef NEED_CPU_H
-uint32_t address_space_lduw(AddressSpace *as, hwaddr addr,
-MemTxAttrs attrs, MemTxResult *result);
-uint32_t address_space_ldl(AddressSpace *as, hwaddr addr,
-MemTxAttrs attrs, MemTxResult *result);
-uint64_t address_space_ldq(AddressSpace *as, hwaddr addr,
-MemTxAttrs attrs, MemTxResult *result);
-void address_space_stl_notdirty(AddressSpace *as, hwaddr addr, uint32_t val,
-MemTxAttrs attrs, MemTxResult *result);
-void address_space_stw(AddressSpace *as, hwaddr addr, uint32_t val,
-MemTxAttrs attrs, MemTxResult *result);
-void address_space_stl(AddressSpace *as, hwaddr addr, uint32_t val,
-MemTxAttrs attrs, MemTxResult *result);
-void address_space_stq(AddressSpace *as, hwaddr addr, uint64_t val,
-MemTxAttrs attrs, MemTxResult *result);
-#endif
-
 /* address_space_translate: translate an address range into an address space
  * into a MemoryRegion and an address range into that section.  Should be
  * called from an RCU critical section, to avoid that the last reference
diff --git a/include/exec/poison.h b/include/exec/poison.h
index a4b1eca..3ca7929 100644
--- a/include/exec/poison.h
+++ b/include/exec/poison.h
@@ -37,14 +37,6 @@
 
 #pragma GCC poison CPUArchState
 
-#prag

[Qemu-devel] [PATCH 35/50] hw: cannot include hw/hw.h from user emulation

2016-04-08 Thread Paolo Bonzini
All qdev definitions are available from other headers, user-mode
emulation does not need hw/hw.h.

By considering system emulation only, it is simpler to disentangle
hw/hw.h from NEED_CPU_H.

Signed-off-by: Paolo Bonzini 
---
 exec.c | 21 +++--
 include/hw/hw.h|  5 +++--
 include/hw/ppc/openpic.h   |  2 +-
 kvm-stub.c |  1 -
 target-i386/cpu.c  |  2 +-
 target-s390x/cpu.c |  3 ++-
 target-s390x/mem_helper.c  |  3 +++
 target-s390x/misc_helper.c |  2 +-
 8 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/exec.c b/exec.c
index c4f9036..fbfa02e 100644
--- a/exec.c
+++ b/exec.c
@@ -25,23 +25,23 @@
 #include "qemu/cutils.h"
 #include "cpu.h"
 #include "tcg.h"
-#include "hw/hw.h"
+#include "hw/qdev-core.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/boards.h"
 #endif
-#include "hw/qdev.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
 #include "hw/xen/xen.h"
 #include "qemu/timer.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
-#include "exec/memory.h"
-#include "sysemu/dma.h"
-#include "exec/address-spaces.h"
 #if defined(CONFIG_USER_ONLY)
 #include 
 #else /* !CONFIG_USER_ONLY */
+#include "hw/hw.h"
+#include "exec/memory.h"
+#include "sysemu/dma.h"
+#include "exec/address-spaces.h"
 #include "sysemu/xen-mapcache.h"
 #include "trace.h"
 #endif
@@ -641,7 +641,6 @@ void cpu_exec_exit(CPUState *cpu)
 void cpu_exec_init(CPUState *cpu, Error **errp)
 {
 CPUClass *cc = CPU_GET_CLASS(cpu);
-int cpu_index;
 Error *local_err = NULL;
 
 cpu->as = NULL;
@@ -668,7 +667,7 @@ void cpu_exec_init(CPUState *cpu, Error **errp)
 #if defined(CONFIG_USER_ONLY)
 cpu_list_lock();
 #endif
-cpu_index = cpu->cpu_index = cpu_get_free_index(&local_err);
+cpu->cpu_index = cpu_get_free_index(&local_err);
 if (local_err) {
 error_propagate(errp, local_err);
 #if defined(CONFIG_USER_ONLY)
@@ -678,14 +677,16 @@ void cpu_exec_init(CPUState *cpu, Error **errp)
 }
 QTAILQ_INSERT_TAIL(&cpus, cpu, node);
 #if defined(CONFIG_USER_ONLY)
+(void) cc;
 cpu_list_unlock();
-#endif
+#else
 if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {
-vmstate_register(NULL, cpu_index, &vmstate_cpu_common, cpu);
+vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);
 }
 if (cc->vmsd != NULL) {
-vmstate_register(NULL, cpu_index, cc->vmsd, cpu);
+vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);
 }
+#endif
 }
 
 #if defined(CONFIG_USER_ONLY)
diff --git a/include/hw/hw.h b/include/hw/hw.h
index 0456fc3..29931d1 100644
--- a/include/hw/hw.h
+++ b/include/hw/hw.h
@@ -3,10 +3,11 @@
 #define QEMU_HW_H
 
 
-#if !defined(CONFIG_USER_ONLY) && !defined(NEED_CPU_H)
-#include "exec/cpu-common.h"
+#ifdef CONFIG_USER_ONLY
+#error Cannot include hw/hw.h from user emulation
 #endif
 
+#include "exec/cpu-common.h"
 #include "exec/ioport.h"
 #include "hw/irq.h"
 #include "block/aio.h"
diff --git a/include/hw/ppc/openpic.h b/include/hw/ppc/openpic.h
index 1cf188d..afe950b 100644
--- a/include/hw/ppc/openpic.h
+++ b/include/hw/ppc/openpic.h
@@ -2,7 +2,7 @@
 #define __OPENPIC_H__
 
 #include "qemu-common.h"
-#include "hw/qdev.h"
+#include "hw/qdev-core.h"
 #include "qom/cpu.h"
 
 #define TYPE_OPENPIC "openpic"
diff --git a/kvm-stub.c b/kvm-stub.c
index b962b24..63735a8 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -12,7 +12,6 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "hw/hw.h"
 #include "cpu.h"
 #include "sysemu/kvm.h"
 
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index ddae932..fdef6ed 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -34,7 +34,6 @@
 #include "qapi/visitor.h"
 #include "sysemu/arch_init.h"
 
-#include "hw/hw.h"
 #if defined(CONFIG_KVM)
 #include 
 #endif
@@ -43,6 +42,7 @@
 #include "hw/qdev-properties.h"
 #ifndef CONFIG_USER_ONLY
 #include "exec/address-spaces.h"
+#include "hw/hw.h"
 #include "hw/xen/xen.h"
 #include "hw/i386/apic_internal.h"
 #endif
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 4bfff34..e665165 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -30,10 +30,11 @@
 #include "qemu/cutils.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
-#include "hw/hw.h"
 #include "trace.h"
 #include "qapi/visitor.h"
+#include "migration/vmstate.h"
 #ifndef CONFIG_USER_ONLY
+#include "hw/hw.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
 #include "hw/s390x/sclp.h"
diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
index 7078622..9d206a9 100644
--- a/target-s390x/mem_helper.c
+++ b/target-s390x/mem_helper.c
@@ -22,7 +22,10 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
+
+#if !defined(CONFIG_USER_ONLY)
 #include "hw/s390x/storage-keys.h"
+#endif
 
 /*/
 /* Softmmu support */
diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_help

[Qemu-devel] [PATCH 28/50] explicitly include qom/cpu.h

2016-04-08 Thread Paolo Bonzini
exec/cpu-all.h includes qom/cpu.h.  Explicit inclusion
will keep things working when cpu.h will not be included
indirectly almost everywhere (either directly or through
qemu-common.h).

Signed-off-by: Paolo Bonzini 
---
 hw/acpi/piix4.c  | 1 +
 hw/arm/collie.c  | 1 +
 hw/cpu/a9mpcore.c| 1 +
 hw/isa/lpc_ich9.c| 1 +
 include/hw/ppc/openpic.h | 1 +
 5 files changed, 5 insertions(+)

diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index 16abdf1..b3e3bb3 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -39,6 +39,7 @@
 #include "hw/acpi/memory_hotplug.h"
 #include "hw/acpi/acpi_dev_interface.h"
 #include "hw/xen/xen.h"
+#include "qom/cpu.h"
 
 //#define DEBUG
 
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index 8bb308a..2e69531 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -18,6 +18,7 @@
 #include "hw/block/flash.h"
 #include "sysemu/block-backend.h"
 #include "exec/address-spaces.h"
+#include "qom/cpu.h"
 
 static struct arm_boot_info collie_binfo = {
 .loader_start = SA_SDCS0,
diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index 5459ae8..f17f292 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -11,6 +11,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/cpu/a9mpcore.h"
+#include "qom/cpu.h"
 
 static void a9mp_priv_set_irq(void *opaque, int irq, int level)
 {
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index 99cd3ba..4f8ca45 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -47,6 +47,7 @@
 #include "hw/pci/pci_bus.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
+#include "qom/cpu.h"
 
 static int ich9_lpc_sci_irq(ICH9LPCState *lpc);
 
diff --git a/include/hw/ppc/openpic.h b/include/hw/ppc/openpic.h
index ee67098..1cf188d 100644
--- a/include/hw/ppc/openpic.h
+++ b/include/hw/ppc/openpic.h
@@ -3,6 +3,7 @@
 
 #include "qemu-common.h"
 #include "hw/qdev.h"
+#include "qom/cpu.h"
 
 #define TYPE_OPENPIC "openpic"
 
-- 
1.8.3.1





[Qemu-devel] [PATCH 25/50] mips: use MIPSCPU instead of CPUMIPSState

2016-04-08 Thread Paolo Bonzini
This changes a cpu.h dependency into a cpu-qom.h dependency.

Signed-off-by: Paolo Bonzini 
---
 hw/mips/cps.c | 7 ---
 hw/mips/cputimer.c| 4 +++-
 hw/mips/mips_fulong2e.c   | 4 ++--
 hw/mips/mips_int.c| 3 ++-
 hw/mips/mips_jazz.c   | 4 ++--
 hw/mips/mips_malta.c  | 5 ++---
 hw/mips/mips_mipssim.c| 4 ++--
 hw/mips/mips_r4k.c| 4 ++--
 include/hw/mips/cpudevs.h | 7 +--
 9 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/hw/mips/cps.c b/hw/mips/cps.c
index 1bafbbb..61208f8 100644
--- a/hw/mips/cps.c
+++ b/hw/mips/cps.c
@@ -81,11 +81,12 @@ static void mips_cps_realize(DeviceState *dev, Error **errp)
 error_setg(errp, "%s: CPU initialization failed\n",  __func__);
 return;
 }
-env = &cpu->env;
 
 /* Init internal devices */
-cpu_mips_irq_init_cpu(env);
-cpu_mips_clock_init(env);
+cpu_mips_irq_init_cpu(cpu);
+cpu_mips_clock_init(cpu);
+
+env = &cpu->env;
 if (cpu_mips_itu_supported(env)) {
 itu_present = true;
 /* Attach ITC Tag to the VP */
diff --git a/hw/mips/cputimer.c b/hw/mips/cputimer.c
index efb227d..8a166b3 100644
--- a/hw/mips/cputimer.c
+++ b/hw/mips/cputimer.c
@@ -151,8 +151,10 @@ static void mips_timer_cb (void *opaque)
 env->CP0_Count--;
 }
 
-void cpu_mips_clock_init (CPUMIPSState *env)
+void cpu_mips_clock_init (MIPSCPU *cpu)
 {
+CPUMIPSState *env = &cpu->env;
+
 /*
  * If we're in KVM mode, don't create the periodic timer, that is handled 
in
  * kernel.
diff --git a/hw/mips/mips_fulong2e.c b/hw/mips/mips_fulong2e.c
index bdb716e7..889cdc7 100644
--- a/hw/mips/mips_fulong2e.c
+++ b/hw/mips/mips_fulong2e.c
@@ -334,8 +334,8 @@ static void mips_fulong2e_init(MachineState *machine)
 }
 
 /* Init internal devices */
-cpu_mips_irq_init_cpu(env);
-cpu_mips_clock_init(env);
+cpu_mips_irq_init_cpu(cpu);
+cpu_mips_clock_init(cpu);
 
 /* North bridge, Bonito --> IP2 */
 pci_bus = bonito_init((qemu_irq *)&(env->irq[2]));
diff --git a/hw/mips/mips_int.c b/hw/mips/mips_int.c
index 59081f9..48192d2 100644
--- a/hw/mips/mips_int.c
+++ b/hw/mips/mips_int.c
@@ -58,8 +58,9 @@ static void cpu_mips_irq_request(void *opaque, int irq, int 
level)
 }
 }
 
-void cpu_mips_irq_init_cpu(CPUMIPSState *env)
+void cpu_mips_irq_init_cpu(MIPSCPU *cpu)
 {
+CPUMIPSState *env = &cpu->env;
 qemu_irq *qi;
 int i;
 
diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index ac7c641..73f6c9f 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -201,8 +201,8 @@ static void mips_jazz_init(MachineState *machine,
 }
 
 /* Init CPU internal devices */
-cpu_mips_irq_init_cpu(env);
-cpu_mips_clock_init(env);
+cpu_mips_irq_init_cpu(cpu);
+cpu_mips_clock_init(cpu);
 
 /* Chipset */
 rc4030 = rc4030_init(&dmas, &rc4030_dma_mr);
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index fa769e5..5c8ba44 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -923,11 +923,10 @@ static void create_cpu_without_cps(const char *cpu_model,
 fprintf(stderr, "Unable to find CPU definition\n");
 exit(1);
 }
-env = &cpu->env;
 
 /* Init internal devices */
-cpu_mips_irq_init_cpu(env);
-cpu_mips_clock_init(env);
+cpu_mips_irq_init_cpu(cpu);
+cpu_mips_clock_init(cpu);
 qemu_register_reset(main_cpu_reset, cpu);
 }
 
diff --git a/hw/mips/mips_mipssim.c b/hw/mips/mips_mipssim.c
index a2c2a16..1b91195 100644
--- a/hw/mips/mips_mipssim.c
+++ b/hw/mips/mips_mipssim.c
@@ -216,8 +216,8 @@ mips_mipssim_init(MachineState *machine)
 }
 
 /* Init CPU internal devices. */
-cpu_mips_irq_init_cpu(env);
-cpu_mips_clock_init(env);
+cpu_mips_irq_init_cpu(cpu);
+cpu_mips_clock_init(cpu);
 
 /* Register 64 KB of ISA IO space at 0x1fd0. */
 memory_region_init_alias(isa, NULL, "isa_mmio",
diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index 21aca98..16a59c7 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -267,8 +267,8 @@ void mips_r4k_init(MachineState *machine)
 }
 
 /* Init CPU internal devices */
-cpu_mips_irq_init_cpu(env);
-cpu_mips_clock_init(env);
+cpu_mips_irq_init_cpu(cpu);
+cpu_mips_clock_init(cpu);
 
 /* ISA bus: IO space at 0x1400, mem space at 0x1000 */
 memory_region_init_alias(isa_io, NULL, "isa-io",
diff --git a/include/hw/mips/cpudevs.h b/include/hw/mips/cpudevs.h
index b2626f2..8673daa 100644
--- a/include/hw/mips/cpudevs.h
+++ b/include/hw/mips/cpudevs.h
@@ -1,5 +1,8 @@
 #ifndef HW_MIPS_CPUDEVS_H
 #define HW_MIPS_CPUDEVS_H
+
+#include "target-mips/cpu-qom.h"
+
 /* Definitions for MIPS CPU internal devices.  */
 
 /* mips_addr.c */
@@ -9,9 +12,9 @@ uint64_t cpu_mips_kvm_um_phys_to_kseg0(void *opaque, uint64_t 
addr);
 
 
 /* mips_int.c */
-void cpu_mips_irq_init_cpu(CPUMI

[Qemu-devel] [PATCH 33/50] hw: do not use VMSTATE_*TL

2016-04-08 Thread Paolo Bonzini
Reserve this to CPU state serialization.

Luckily, they were only used by sPAPR devices and these are ppc64
only.  So there is no change to migration format.

Signed-off-by: Paolo Bonzini 
---
 hw/net/spapr_llan.c| 8 
 hw/ppc/spapr_vio.c | 2 +-
 include/hw/ppc/spapr_vio.h | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index a647f25..db97da3 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -106,9 +106,9 @@ typedef struct VIOsPAPRVLANDevice {
 NICConf nicconf;
 NICState *nic;
 bool isopen;
-target_ulong buf_list;
+hwaddr buf_list;
 uint32_t add_buf_ptr, use_buf_ptr, rx_bufs;
-target_ulong rxq_ptr;
+hwaddr rxq_ptr;
 uint32_t compat_flags; /* Compatability flags for migration */
 RxBufPool *rx_pool[RX_MAX_POOLS];  /* Receive buffer descriptor pools */
 } VIOsPAPRVLANDevice;
@@ -765,11 +765,11 @@ static const VMStateDescription vmstate_spapr_llan = {
 VMSTATE_SPAPR_VIO(sdev, VIOsPAPRVLANDevice),
 /* LLAN state */
 VMSTATE_BOOL(isopen, VIOsPAPRVLANDevice),
-VMSTATE_UINTTL(buf_list, VIOsPAPRVLANDevice),
+VMSTATE_UINT64(buf_list, VIOsPAPRVLANDevice),
 VMSTATE_UINT32(add_buf_ptr, VIOsPAPRVLANDevice),
 VMSTATE_UINT32(use_buf_ptr, VIOsPAPRVLANDevice),
 VMSTATE_UINT32(rx_bufs, VIOsPAPRVLANDevice),
-VMSTATE_UINTTL(rxq_ptr, VIOsPAPRVLANDevice),
+VMSTATE_UINT64(rxq_ptr, VIOsPAPRVLANDevice),
 
 VMSTATE_END_OF_LIST()
 },
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 8aa021f..6b20b40 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -584,7 +584,7 @@ const VMStateDescription vmstate_spapr_vio = {
 VMSTATE_UINT32_EQUAL(irq, VIOsPAPRDevice),
 
 /* General VIO device state */
-VMSTATE_UINTTL(signal_state, VIOsPAPRDevice),
+VMSTATE_UINT64(signal_state, VIOsPAPRDevice),
 VMSTATE_UINT64(crq.qladdr, VIOsPAPRDevice),
 VMSTATE_UINT32(crq.qsize, VIOsPAPRDevice),
 VMSTATE_UINT32(crq.qnext, VIOsPAPRDevice),
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index c9733e7..5f8b042 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -61,7 +61,7 @@ struct VIOsPAPRDevice {
 DeviceState qdev;
 uint32_t reg;
 uint32_t irq;
-target_ulong signal_state;
+uint64_t signal_state;
 VIOsPAPR_CRQ crq;
 AddressSpace as;
 MemoryRegion mrroot;
-- 
1.8.3.1





[Qemu-devel] [PATCH 34/50] hw: move CPU state serialization to migration/cpu.h

2016-04-08 Thread Paolo Bonzini
Remove usage of NEED_CPU_H from hw/hw.h.

Signed-off-by: Paolo Bonzini 
---
 include/hw/hw.h   | 49 ---
 include/migration/cpu.h   | 48 ++
 target-alpha/machine.c|  1 +
 target-arm/machine.c  |  1 +
 target-cris/machine.c |  1 +
 target-i386/machine.c |  1 +
 target-lm32/machine.c |  1 +
 target-mips/machine.c |  2 +-
 target-moxie/machine.c|  1 +
 target-openrisc/machine.c |  1 +
 target-ppc/machine.c  |  1 +
 target-sparc/machine.c|  1 +
 12 files changed, 58 insertions(+), 50 deletions(-)
 create mode 100644 include/migration/cpu.h

diff --git a/include/hw/hw.h b/include/hw/hw.h
index 2cb69d5..0456fc3 100644
--- a/include/hw/hw.h
+++ b/include/hw/hw.h
@@ -14,28 +14,6 @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 
-#ifdef NEED_CPU_H
-#if TARGET_LONG_BITS == 64
-#define qemu_put_betl qemu_put_be64
-#define qemu_get_betl qemu_get_be64
-#define qemu_put_betls qemu_put_be64s
-#define qemu_get_betls qemu_get_be64s
-#define qemu_put_sbetl qemu_put_sbe64
-#define qemu_get_sbetl qemu_get_sbe64
-#define qemu_put_sbetls qemu_put_sbe64s
-#define qemu_get_sbetls qemu_get_sbe64s
-#else
-#define qemu_put_betl qemu_put_be32
-#define qemu_get_betl qemu_get_be32
-#define qemu_put_betls qemu_put_be32s
-#define qemu_get_betls qemu_get_be32s
-#define qemu_put_sbetl qemu_put_sbe32
-#define qemu_get_sbetl qemu_get_sbe32
-#define qemu_put_sbetls qemu_put_sbe32s
-#define qemu_get_sbetls qemu_get_sbe32s
-#endif
-#endif
-
 typedef void QEMUResetHandler(void *opaque);
 
 void qemu_register_reset(QEMUResetHandler *func, void *opaque);
@@ -43,31 +21,4 @@ void qemu_unregister_reset(QEMUResetHandler *func, void 
*opaque);
 
 void QEMU_NORETURN hw_error(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
 
-#ifdef NEED_CPU_H
-#if TARGET_LONG_BITS == 64
-#define VMSTATE_UINTTL_V(_f, _s, _v)  \
-VMSTATE_UINT64_V(_f, _s, _v)
-#define VMSTATE_UINTTL_EQUAL_V(_f, _s, _v)\
-VMSTATE_UINT64_EQUAL_V(_f, _s, _v)
-#define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)\
-VMSTATE_UINT64_ARRAY_V(_f, _s, _n, _v)
-#define vmstate_info_uinttl vmstate_info_uint64
-#else
-#define VMSTATE_UINTTL_V(_f, _s, _v)  \
-VMSTATE_UINT32_V(_f, _s, _v)
-#define VMSTATE_UINTTL_EQUAL_V(_f, _s, _v)\
-VMSTATE_UINT32_EQUAL_V(_f, _s, _v)
-#define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)\
-VMSTATE_UINT32_ARRAY_V(_f, _s, _n, _v)
-#define vmstate_info_uinttl vmstate_info_uint32
-#endif
-#define VMSTATE_UINTTL(_f, _s)\
-VMSTATE_UINTTL_V(_f, _s, 0)
-#define VMSTATE_UINTTL_EQUAL(_f, _s)  \
-VMSTATE_UINTTL_EQUAL_V(_f, _s, 0)
-#define VMSTATE_UINTTL_ARRAY(_f, _s, _n)  \
-VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, 0)
-
-#endif
-
 #endif
diff --git a/include/migration/cpu.h b/include/migration/cpu.h
new file mode 100644
index 000..f3abbab
--- /dev/null
+++ b/include/migration/cpu.h
@@ -0,0 +1,48 @@
+/* Declarations for use for CPU state serialization.  */
+#ifndef MIGRATION_CPU_H
+#define MIGRATION_CPU_H
+
+#if TARGET_LONG_BITS == 64
+#define qemu_put_betl qemu_put_be64
+#define qemu_get_betl qemu_get_be64
+#define qemu_put_betls qemu_put_be64s
+#define qemu_get_betls qemu_get_be64s
+#define qemu_put_sbetl qemu_put_sbe64
+#define qemu_get_sbetl qemu_get_sbe64
+#define qemu_put_sbetls qemu_put_sbe64s
+#define qemu_get_sbetls qemu_get_sbe64s
+
+#define VMSTATE_UINTTL_V(_f, _s, _v)  \
+VMSTATE_UINT64_V(_f, _s, _v)
+#define VMSTATE_UINTTL_EQUAL_V(_f, _s, _v)\
+VMSTATE_UINT64_EQUAL_V(_f, _s, _v)
+#define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)\
+VMSTATE_UINT64_ARRAY_V(_f, _s, _n, _v)
+#define vmstate_info_uinttl vmstate_info_uint64
+#else
+#define qemu_put_betl qemu_put_be32
+#define qemu_get_betl qemu_get_be32
+#define qemu_put_betls qemu_put_be32s
+#define qemu_get_betls qemu_get_be32s
+#define qemu_put_sbetl qemu_put_sbe32
+#define qemu_get_sbetl qemu_get_sbe32
+#define qemu_put_sbetls qemu_put_sbe32s
+#define qemu_get_sbetls qemu_get_sbe32s
+
+#define VMSTATE_UINTTL_V(_f, _s, _v)  \
+VMSTATE_UINT32_V(_f, _s, _v)
+#define VMSTATE_UINTTL_EQUAL_V(_f, _s, _v)\
+VMSTATE_UINT32_EQUAL_V(_f, _s, _v)
+#define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)\
+VMSTATE_UINT32_ARRAY_V(_f, _s, _n, _v)
+#define vmstate_info_uinttl vmstate_info_uint32
+#endif
+
+#define VMSTATE_UINTTL(_f, _s)\
+VMSTATE_UINTTL_V(_f, _s, 0)
+#define VMSTATE_UINTTL_EQUAL(_f, _s)  \
+VMSTATE_UINTTL_EQUAL_V(_f, _s, 0)
+#define VMSTATE_UINTTL_ARRAY(_f, _

[Qemu-devel] [PATCH 38/50] qemu-common: stop including qemu/host-utils.h from qemu-common.h

2016-04-08 Thread Paolo Bonzini
Move it to the actual users.  There are some inclusions of
qemu/host-utils.h in headers, but they are all necessary.

Signed-off-by: Paolo Bonzini 
---
 audio/noaudio.c | 1 +
 audio/wavaudio.c| 2 +-
 contrib/ivshmem-server/ivshmem-server.c | 1 +
 hw/acpi/core.c  | 6 ++
 hw/bt/sdp.c | 1 +
 hw/display/tc6393xb.c   | 1 +
 include/exec/cpu-defs.h | 1 +
 include/hw/acpi/acpi.h  | 7 ---
 include/qemu-common.h   | 1 -
 include/qemu/timer.h| 1 -
 page_cache.c| 1 +
 slirp/slirp.h   | 1 +
 stubs/slirp.c   | 1 +
 tests/libqos/malloc.c   | 1 +
 util/buffer.c   | 1 +
 15 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/audio/noaudio.c b/audio/noaudio.c
index b360c19..9ca9eaf 100644
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -23,6 +23,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
+#include "qemu/host-utils.h"
 #include "audio.h"
 #include "qemu/timer.h"
 
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index 345952e..341eec3 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -22,7 +22,7 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
-#include "hw/hw.h"
+#include "qemu/host-utils.h"
 #include "qemu/timer.h"
 #include "audio.h"
 
diff --git a/contrib/ivshmem-server/ivshmem-server.c 
b/contrib/ivshmem-server/ivshmem-server.c
index 172db78..bf4ee0b 100644
--- a/contrib/ivshmem-server/ivshmem-server.c
+++ b/contrib/ivshmem-server/ivshmem-server.c
@@ -7,6 +7,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
+#include "qemu/host-utils.h"
 #include "qemu/sockets.h"
 
 #include 
diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 7925a1a..f0808c1 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -491,6 +491,12 @@ void acpi_pm_tmr_update(ACPIREGS *ar, bool enable)
 }
 }
 
+static inline int64_t acpi_pm_tmr_get_clock(void)
+{
+return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), PM_TIMER_FREQUENCY,
+NANOSECONDS_PER_SECOND);
+}
+
 void acpi_pm_tmr_calc_overflow_time(ACPIREGS *ar)
 {
 int64_t d = acpi_pm_tmr_get_clock();
diff --git a/hw/bt/sdp.c b/hw/bt/sdp.c
index be26009..f67b3b8 100644
--- a/hw/bt/sdp.c
+++ b/hw/bt/sdp.c
@@ -19,6 +19,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
+#include "qemu/host-utils.h"
 #include "hw/bt.h"
 
 struct bt_l2cap_sdp_state_s {
diff --git a/hw/display/tc6393xb.c b/hw/display/tc6393xb.c
index da3cece..92f7120 100644
--- a/hw/display/tc6393xb.c
+++ b/hw/display/tc6393xb.c
@@ -12,6 +12,7 @@
  */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "qemu/host-utils.h"
 #include "hw/hw.h"
 #include "hw/devices.h"
 #include "hw/block/flash.h"
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 854e7e3..5f4e303 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -23,6 +23,7 @@
 #error cpu.h included from common code
 #endif
 
+#include "qemu/host-utils.h"
 #include "qemu/queue.h"
 #include "tcg-target.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/include/hw/acpi/acpi.h b/include/hw/acpi/acpi.h
index e0978c8..dc6ee00 100644
--- a/include/hw/acpi/acpi.h
+++ b/include/hw/acpi/acpi.h
@@ -150,13 +150,6 @@ void acpi_pm_tmr_init(ACPIREGS *ar, acpi_update_sci_fn 
update_sci,
   MemoryRegion *parent);
 void acpi_pm_tmr_reset(ACPIREGS *ar);
 
-#include "qemu/timer.h"
-static inline int64_t acpi_pm_tmr_get_clock(void)
-{
-return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), PM_TIMER_FREQUENCY,
-NANOSECONDS_PER_SECOND);
-}
-
 /* PM1a_EVT: piix and ich9 don't implement PM1b. */
 uint16_t acpi_pm1_evt_get_sts(ACPIREGS *ar);
 void acpi_pm1_evt_power_down(ACPIREGS *ar);
diff --git a/include/qemu-common.h b/include/qemu-common.h
index dc041fc..cd3139b 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -21,7 +21,6 @@
 #define TFR(expr) do { if ((expr) != -1) break; } while (errno == EINTR)
 
 #include "qemu/option.h"
-#include "qemu/host-utils.h"
 
 /* FIXME: Remove NEED_CPU_H.  */
 #ifdef NEED_CPU_H
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index 309f3d0..d97ddfb 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -3,7 +3,6 @@
 
 #include "qemu-common.h"
 #include "qemu/notify.h"
-#include "qemu/host-utils.h"
 #include "sysemu/cpus.h"
 
 #define NANOSECONDS_PER_SECOND 10LL
diff --git a/page_cache.c b/page_cache.c
index cb8a69e..37a66e4 100644
--- a/page_cache.c
+++ b/page_cache.c
@@ -16,6 +16,7 @@
 #include 
 
 #include "qemu-common.h"
+#include "qemu/host-utils.h"
 #include "migration/page_cache.h"
 
 #ifdef DEBUG_CACHE
diff --git a/slirp/slirp.h b/slirp/slirp.h
index c99ebb9..223da91 100644
--- a/slirp/slirp.h
+++ b/slirp/slirp.h
@@ -1,6 +1,7 @@
 #ifndef __COMMON_H__
 #define __COMMON_H

[Qemu-devel] [PATCH 22/50] m68k: include cpu-qom.h in files that require M68KCPU

2016-04-08 Thread Paolo Bonzini
This will keep things working when cpu.h will not be included
indirectly almost everywhere (either directly or through
qemu-common.h).

Signed-off-by: Paolo Bonzini 
---
 include/hw/m68k/mcf.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/hw/m68k/mcf.h b/include/hw/m68k/mcf.h
index fbc8dc2..0f0d228 100644
--- a/include/hw/m68k/mcf.h
+++ b/include/hw/m68k/mcf.h
@@ -2,6 +2,8 @@
 #define HW_MCF_H
 /* Motorola ColdFire device prototypes.  */
 
+#include "target-m68k/cpu-qom.h"
+
 struct MemoryRegion;
 
 /* mcf_uart.c */
-- 
1.8.3.1





[Qemu-devel] [PATCH 31/50] apic: move target-dependent definitions to cpu.h

2016-04-08 Thread Paolo Bonzini
Signed-off-by: Paolo Bonzini 
---
 hw/intc/ioapic.c   | 1 +
 include/hw/i386/apic.h | 5 -
 target-i386/cpu.h  | 7 +++
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index 378e663..4f42b91 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -24,6 +24,7 @@
 #include "monitor/monitor.h"
 #include "hw/hw.h"
 #include "hw/i386/pc.h"
+#include "hw/i386/apic.h"
 #include "hw/i386/ioapic.h"
 #include "hw/i386/ioapic_internal.h"
 #include "include/hw/pci/msi.h"
diff --git a/include/hw/i386/apic.h b/include/hw/i386/apic.h
index 51eb6d3..ea48ea9 100644
--- a/include/hw/i386/apic.h
+++ b/include/hw/i386/apic.h
@@ -18,15 +18,10 @@ void cpu_set_apic_tpr(DeviceState *s, uint8_t val);
 uint8_t cpu_get_apic_tpr(DeviceState *s);
 void apic_init_reset(DeviceState *s);
 void apic_sipi(DeviceState *s);
-void apic_handle_tpr_access_report(DeviceState *d, target_ulong ip,
-   TPRAccess access);
 void apic_poll_irq(DeviceState *d);
 void apic_designate_bsp(DeviceState *d, bool bsp);
 
 /* pc.c */
 DeviceState *cpu_get_current_apic(void);
 
-/* cpu.c */
-bool cpu_is_bsp(X86CPU *cpu);
-
 #endif
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 9614c88..2200aeb 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1455,7 +1455,11 @@ void do_interrupt_x86_hardirq(CPUX86State *env, int 
intno, int is_hw);
 void do_smm_enter(X86CPU *cpu);
 void cpu_smm_update(X86CPU *cpu);
 
+/* apic.c */
 void cpu_report_tpr_access(CPUX86State *env, TPRAccess access);
+void apic_handle_tpr_access_report(DeviceState *d, target_ulong ip,
+   TPRAccess access);
+
 
 /* Change the value of a KVM-specific default
  *
@@ -1481,4 +1485,7 @@ void enable_compat_apic_id_mode(void);
 void x86_cpu_dump_local_apic_state(CPUState *cs, FILE *f,
fprintf_function cpu_fprintf, int flags);
 
+/* cpu.c */
+bool cpu_is_bsp(X86CPU *cpu);
+
 #endif /* CPU_I386_H */
-- 
1.8.3.1





[Qemu-devel] [PATCH 17/50] target-sparc: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make SPARCCPU an opaque type within cpu-qom.h, and move all definitions
of private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-sparc/cpu-qom.h | 37 +
 target-sparc/cpu.h | 38 +-
 2 files changed, 38 insertions(+), 37 deletions(-)

diff --git a/target-sparc/cpu-qom.h b/target-sparc/cpu-qom.h
index 174dfd3..f63af72 100644
--- a/target-sparc/cpu-qom.h
+++ b/target-sparc/cpu-qom.h
@@ -51,41 +51,6 @@ typedef struct SPARCCPUClass {
 void (*parent_reset)(CPUState *cpu);
 } SPARCCPUClass;
 
-/**
- * SPARCCPU:
- * @env: #CPUSPARCState
- *
- * A SPARC CPU.
- */
-typedef struct SPARCCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUSPARCState env;
-} SPARCCPU;
-
-static inline SPARCCPU *sparc_env_get_cpu(CPUSPARCState *env)
-{
-return container_of(env, SPARCCPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(sparc_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(SPARCCPU, env)
-
-#ifndef CONFIG_USER_ONLY
-extern const struct VMStateDescription vmstate_sparc_cpu;
-#endif
-
-void sparc_cpu_do_interrupt(CPUState *cpu);
-void sparc_cpu_dump_state(CPUState *cpu, FILE *f,
-  fprintf_function cpu_fprintf, int flags);
-hwaddr sparc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-int sparc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int sparc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-void QEMU_NORETURN sparc_cpu_do_unaligned_access(CPUState *cpu,
- vaddr addr, int is_write,
- int is_user, uintptr_t 
retaddr);
+typedef struct SPARCCPU SPARCCPU;
 
 #endif
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index dc46122..55981b5 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -3,6 +3,7 @@
 
 #include "qemu-common.h"
 #include "qemu/bswap.h"
+#include "cpu-qom.h"
 
 #define ALIGNED_ONLY
 
@@ -506,7 +507,42 @@ struct CPUSPARCState {
 uint32_t cache_control;
 };
 
-#include "cpu-qom.h"
+/**
+ * SPARCCPU:
+ * @env: #CPUSPARCState
+ *
+ * A SPARC CPU.
+ */
+struct SPARCCPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUSPARCState env;
+};
+
+static inline SPARCCPU *sparc_env_get_cpu(CPUSPARCState *env)
+{
+return container_of(env, SPARCCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(sparc_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(SPARCCPU, env)
+
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_sparc_cpu;
+#endif
+
+void sparc_cpu_do_interrupt(CPUState *cpu);
+void sparc_cpu_dump_state(CPUState *cpu, FILE *f,
+  fprintf_function cpu_fprintf, int flags);
+hwaddr sparc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int sparc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int sparc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+void QEMU_NORETURN sparc_cpu_do_unaligned_access(CPUState *cpu,
+ vaddr addr, int is_write,
+ int is_user, uintptr_t 
retaddr);
 
 #ifndef NO_CPU_IO_DEFS
 /* cpu_init.c */
-- 
1.8.3.1





[Qemu-devel] [PATCH 39/50] gdbstub: remove includes from gdbstub-xml.c

2016-04-08 Thread Paolo Bonzini
gdbstub-xml.c defines a bunch of arrays of strings; there is no
need to include anything.

Signed-off-by: Paolo Bonzini 
---
 scripts/feature_to_c.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/scripts/feature_to_c.sh b/scripts/feature_to_c.sh
index fb1f336..0994d95 100644
--- a/scripts/feature_to_c.sh
+++ b/scripts/feature_to_c.sh
@@ -36,9 +36,6 @@ for input; do
   arrayname=xml_feature_`echo $input | sed 's,.*/,,; s/[-.]/_/g'`
 
   ${AWK:-awk} 'BEGIN { n = 0
-  printf "#include \"qemu/osdep.h\"\n"
-  printf "#include \"qemu-common.h\"\n"
-  printf "#include \"exec/gdbstub.h\"\n"
   print "static const char '$arrayname'[] = {"
   for (i = 0; i < 255; i++)
 _ord_[sprintf("%c", i)] = i
-- 
1.8.3.1





[Qemu-devel] [PATCH 27/50] arm: remove useless cpu.h inclusion

2016-04-08 Thread Paolo Bonzini
Signed-off-by: Paolo Bonzini 
---
 include/hw/arm/digic.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/hw/arm/digic.h b/include/hw/arm/digic.h
index a739d6a..aaefe0b 100644
--- a/include/hw/arm/digic.h
+++ b/include/hw/arm/digic.h
@@ -18,8 +18,6 @@
 #ifndef HW_ARM_DIGIC_H
 #define HW_ARM_DIGIC_H
 
-#include "cpu.h"
-
 #include "hw/timer/digic-timer.h"
 #include "hw/char/digic-uart.h"
 
-- 
1.8.3.1





[Qemu-devel] [PATCH 32/50] include: poison symbols in osdep.h

2016-04-08 Thread Paolo Bonzini
Ensure that all target-independent files ignore poisoned symbols,
and fix the fallout.

Signed-off-by: Paolo Bonzini 
---
 hw/core/Makefile.objs  |  2 +-
 include/exec/cpu-common.h  |  4 
 include/exec/helper-head.h | 23 +--
 include/qemu/osdep.h   |  2 ++
 scripts/create_config  |  2 +-
 5 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/hw/core/Makefile.objs b/hw/core/Makefile.objs
index abb3560..70951d4 100644
--- a/hw/core/Makefile.objs
+++ b/hw/core/Makefile.objs
@@ -4,7 +4,7 @@ common-obj-y += fw-path-provider.o
 # irq.o needed for qdev GPIO handling:
 common-obj-y += irq.o
 common-obj-y += hotplug.o
-common-obj-y += nmi.o
+obj-y += nmi.o
 
 common-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
 common-obj-$(CONFIG_XILINX_AXI) += stream.o
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 9e839e5..4f59034 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -7,10 +7,6 @@
 #include "exec/hwaddr.h"
 #endif
 
-#ifndef NEED_CPU_H
-#include "exec/poison.h"
-#endif
-
 #include "qemu/bswap.h"
 #include "qemu/queue.h"
 #include "qemu/fprintf-fn.h"
diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
index ec79043..74f8f03 100644
--- a/include/exec/helper-head.h
+++ b/include/exec/helper-head.h
@@ -33,17 +33,9 @@
 #define dh_alias_s64 i64
 #define dh_alias_f32 i32
 #define dh_alias_f64 i64
-#ifdef TARGET_LONG_BITS
-# if TARGET_LONG_BITS == 32
-#  define dh_alias_tl i32
-# else
-#  define dh_alias_tl i64
-# endif
-#endif
 #define dh_alias_ptr ptr
 #define dh_alias_void void
 #define dh_alias_noreturn noreturn
-#define dh_alias_env ptr
 #define dh_alias(t) glue(dh_alias_, t)
 
 #define dh_ctype_i32 uint32_t
@@ -53,13 +45,24 @@
 #define dh_ctype_s64 int64_t
 #define dh_ctype_f32 float32
 #define dh_ctype_f64 float64
-#define dh_ctype_tl target_ulong
 #define dh_ctype_ptr void *
 #define dh_ctype_void void
 #define dh_ctype_noreturn void QEMU_NORETURN
-#define dh_ctype_env CPUArchState *
 #define dh_ctype(t) dh_ctype_##t
 
+#ifdef NEED_CPU_H
+# ifdef TARGET_LONG_BITS
+#  if TARGET_LONG_BITS == 32
+#   define dh_alias_tl i32
+#  else
+#   define dh_alias_tl i64
+#  endif
+# endif
+# define dh_alias_env ptr
+# define dh_ctype_tl target_ulong
+# define dh_ctype_env CPUArchState *
+#endif
+
 /* We can't use glue() here because it falls foul of C preprocessor
recursive expansion rules.  */
 #define dh_retvar_decl0_void void
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 408783f..7fe7b76 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -30,6 +30,8 @@
 #include "config-host.h"
 #ifdef NEED_CPU_H
 #include "config-target.h"
+#else
+#include "exec/poison.h"
 #endif
 #include "qemu/compiler.h"
 
diff --git a/scripts/create_config b/scripts/create_config
index 9cb176f..b2d2ebb 100755
--- a/scripts/create_config
+++ b/scripts/create_config
@@ -52,7 +52,7 @@ case $line in
 done
 echo "NULL"
 ;;
- CONFIG_*=y) # configuration
+ CONFIG_*='$(CONFIG_SOFTMMU)'|CONFIG_*=y) # configuration
 name=${line%=*}
 echo "#define $name 1"
 ;;
-- 
1.8.3.1





[Qemu-devel] [PATCH 14/50] target-ppc: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make PowerPCCPU an opaque type within cpu-qom.h, and move all definitions
of private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  Conversely, move all definitions needed to define
a class to cpu-qom.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-ppc/cpu-qom.h | 161 ++
 target-ppc/cpu.h | 164 ---
 2 files changed, 163 insertions(+), 162 deletions(-)

diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index bab501f..49c71fa 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -38,6 +38,117 @@
 OBJECT_GET_CLASS(PowerPCCPUClass, (obj), TYPE_POWERPC_CPU)
 
 typedef struct PowerPCCPU PowerPCCPU;
+typedef struct CPUPPCState CPUPPCState;
+typedef struct ppc_tb_t ppc_tb_t;
+typedef struct ppc_dcr_t ppc_dcr_t;
+
+/*/
+/* MMU model */
+typedef enum powerpc_mmu_t powerpc_mmu_t;
+enum powerpc_mmu_t {
+POWERPC_MMU_UNKNOWN= 0x,
+/* Standard 32 bits PowerPC MMU*/
+POWERPC_MMU_32B= 0x0001,
+/* PowerPC 6xx MMU with software TLB   */
+POWERPC_MMU_SOFT_6xx   = 0x0002,
+/* PowerPC 74xx MMU with software TLB  */
+POWERPC_MMU_SOFT_74xx  = 0x0003,
+/* PowerPC 4xx MMU with software TLB   */
+POWERPC_MMU_SOFT_4xx   = 0x0004,
+/* PowerPC 4xx MMU with software TLB and zones protections */
+POWERPC_MMU_SOFT_4xx_Z = 0x0005,
+/* PowerPC MMU in real mode only   */
+POWERPC_MMU_REAL   = 0x0006,
+/* Freescale MPC8xx MMU model  */
+POWERPC_MMU_MPC8xx = 0x0007,
+/* BookE MMU model */
+POWERPC_MMU_BOOKE  = 0x0008,
+/* BookE 2.06 MMU model*/
+POWERPC_MMU_BOOKE206   = 0x0009,
+/* PowerPC 601 MMU model (specific BATs format)*/
+POWERPC_MMU_601= 0x000A,
+#if defined(TARGET_PPC64)
+#define POWERPC_MMU_64   0x0001
+#define POWERPC_MMU_1TSEG0x0002
+#define POWERPC_MMU_AMR  0x0004
+/* 64 bits PowerPC MMU */
+POWERPC_MMU_64B= POWERPC_MMU_64 | 0x0001,
+/* Architecture 2.03 and later (has LPCR) */
+POWERPC_MMU_2_03   = POWERPC_MMU_64 | 0x0002,
+/* Architecture 2.06 variant   */
+POWERPC_MMU_2_06   = POWERPC_MMU_64 | POWERPC_MMU_1TSEG
+ | POWERPC_MMU_AMR | 0x0003,
+/* Architecture 2.06 "degraded" (no 1T segments)   */
+POWERPC_MMU_2_06a  = POWERPC_MMU_64 | POWERPC_MMU_AMR
+ | 0x0003,
+/* Architecture 2.07 variant   */
+POWERPC_MMU_2_07   = POWERPC_MMU_64 | POWERPC_MMU_1TSEG
+ | POWERPC_MMU_AMR | 0x0004,
+/* Architecture 2.07 "degraded" (no 1T segments)   */
+POWERPC_MMU_2_07a  = POWERPC_MMU_64 | POWERPC_MMU_AMR
+ | 0x0004,
+#endif /* defined(TARGET_PPC64) */
+};
+
+/*/
+/* Exception model   */
+typedef enum powerpc_excp_t powerpc_excp_t;
+enum powerpc_excp_t {
+POWERPC_EXCP_UNKNOWN   = 0,
+/* Standard PowerPC exception model */
+POWERPC_EXCP_STD,
+/* PowerPC 40x exception model  */
+POWERPC_EXCP_40x,
+/* PowerPC 601 exception model  */
+POWERPC_EXCP_601,
+/* PowerPC 602 exception model  */
+POWERPC_EXCP_602,
+/* PowerPC 603 exception model  */
+POWERPC_EXCP_603,
+/* PowerPC 603e exception model */
+POWERPC_EXCP_603E,
+/* PowerPC G2 exception model   */
+POWERPC_EXCP_G2,
+/* PowerPC 604 exception model  */
+POWERPC_EXCP_604,
+/* PowerPC 7x0 exception model  */
+POWERPC_EXCP_7x0,
+/* PowerPC 7x5 exception model  */
+POWERPC_EXCP_7x5,
+/* PowerPC 74xx exception model */
+POWERPC_EXCP_74xx,
+/* BookE exception model*/
+POWERPC_EXCP_BOOKE,
+#if defined(TARGET_PPC64)
+/* PowerPC 970 exception model  */
+POWERPC_EXCP_970,
+/* POWER7 exception model   */
+POWERPC_EXCP_POWER7,
+/* POWER8 exception model   */
+POWERPC_EXCP_POWER8,
+#endif /* defined(TARGET_PPC64) */
+};
+
+/*/
+/* Input pins model

[Qemu-devel] [PATCH 45/50] mips: move CP0 functions out of cpu.h

2016-04-08 Thread Paolo Bonzini
These are here for historical reasons: they are needed from both gdbstub.c
and op_helper.c, and the latter was compiled with fixed AREG0.  It is
not needed anymore, so uninline them.

Signed-off-by: Paolo Bonzini 
---
 target-mips/cpu.h| 113 ++-
 target-mips/helper.c | 108 
 2 files changed, 112 insertions(+), 109 deletions(-)

diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 0636327..951267a 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -1035,115 +1035,10 @@ static inline void compute_hflags(CPUMIPSState *env)
 }
 }
 
-#ifndef CONFIG_USER_ONLY
-static inline void cpu_mips_tlb_flush(CPUMIPSState *env, int flush_global)
-{
-MIPSCPU *cpu = mips_env_get_cpu(env);
-
-/* Flush qemu's TLB and discard all shadowed entries.  */
-tlb_flush(CPU(cpu), flush_global);
-env->tlb->tlb_in_use = env->tlb->nb_tlb;
-}
-
-/* Called for updates to CP0_Status.  */
-static inline void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu, int tc)
-{
-int32_t tcstatus, *tcst;
-uint32_t v = cpu->CP0_Status;
-uint32_t cu, mx, asid, ksu;
-uint32_t mask = ((1 << CP0TCSt_TCU3)
-   | (1 << CP0TCSt_TCU2)
-   | (1 << CP0TCSt_TCU1)
-   | (1 << CP0TCSt_TCU0)
-   | (1 << CP0TCSt_TMX)
-   | (3 << CP0TCSt_TKSU)
-   | (0xff << CP0TCSt_TASID));
-
-cu = (v >> CP0St_CU0) & 0xf;
-mx = (v >> CP0St_MX) & 0x1;
-ksu = (v >> CP0St_KSU) & 0x3;
-asid = env->CP0_EntryHi & 0xff;
-
-tcstatus = cu << CP0TCSt_TCU0;
-tcstatus |= mx << CP0TCSt_TMX;
-tcstatus |= ksu << CP0TCSt_TKSU;
-tcstatus |= asid;
-
-if (tc == cpu->current_tc) {
-tcst = &cpu->active_tc.CP0_TCStatus;
-} else {
-tcst = &cpu->tcs[tc].CP0_TCStatus;
-}
-
-*tcst &= ~mask;
-*tcst |= tcstatus;
-compute_hflags(cpu);
-}
-
-static inline void cpu_mips_store_status(CPUMIPSState *env, target_ulong val)
-{
-uint32_t mask = env->CP0_Status_rw_bitmask;
-target_ulong old = env->CP0_Status;
-
-if (env->insn_flags & ISA_MIPS32R6) {
-bool has_supervisor = extract32(mask, CP0St_KSU, 2) == 0x3;
-#if defined(TARGET_MIPS64)
-uint32_t ksux = (1 << CP0St_KX) & val;
-ksux |= (ksux >> 1) & val; /* KX = 0 forces SX to be 0 */
-ksux |= (ksux >> 1) & val; /* SX = 0 forces UX to be 0 */
-val = (val & ~(7 << CP0St_UX)) | ksux;
-#endif
-if (has_supervisor && extract32(val, CP0St_KSU, 2) == 0x3) {
-mask &= ~(3 << CP0St_KSU);
-}
-mask &= ~(((1 << CP0St_SR) | (1 << CP0St_NMI)) & val);
-}
-
-env->CP0_Status = (old & ~mask) | (val & mask);
-#if defined(TARGET_MIPS64)
-if ((env->CP0_Status ^ old) & (old & (7 << CP0St_UX))) {
-/* Access to at least one of the 64-bit segments has been disabled */
-cpu_mips_tlb_flush(env, 1);
-}
-#endif
-if (env->CP0_Config3 & (1 << CP0C3_MT)) {
-sync_c0_status(env, env, env->current_tc);
-} else {
-compute_hflags(env);
-}
-}
-
-static inline void cpu_mips_store_cause(CPUMIPSState *env, target_ulong val)
-{
-uint32_t mask = 0x00C00300;
-uint32_t old = env->CP0_Cause;
-int i;
-
-if (env->insn_flags & ISA_MIPS32R2) {
-mask |= 1 << CP0Ca_DC;
-}
-if (env->insn_flags & ISA_MIPS32R6) {
-mask &= ~((1 << CP0Ca_WP) & val);
-}
-
-env->CP0_Cause = (env->CP0_Cause & ~mask) | (val & mask);
-
-if ((old ^ env->CP0_Cause) & (1 << CP0Ca_DC)) {
-if (env->CP0_Cause & (1 << CP0Ca_DC)) {
-cpu_mips_stop_count(env);
-} else {
-cpu_mips_start_count(env);
-}
-}
-
-/* Set/reset software interrupts */
-for (i = 0 ; i < 2 ; i++) {
-if ((old ^ env->CP0_Cause) & (1 << (CP0Ca_IP + i))) {
-cpu_mips_soft_irq(env, i, env->CP0_Cause & (1 << (CP0Ca_IP + i)));
-}
-}
-}
-#endif
+void cpu_mips_tlb_flush(CPUMIPSState *env, int flush_global);
+void sync_c0_status(CPUMIPSState *env, CPUMIPSState *cpu, int tc);
+void cpu_mips_store_status(CPUMIPSState *env, target_ulong val);
+void cpu_mips_store_cause(CPUMIPSState *env, target_ulong val);
 
 void QEMU_NORETURN do_raise_exception_err(CPUMIPSState *env, uint32_t 
exception,
   int error_code, uintptr_t pc);
diff --git a/target-mips/helper.c b/target-mips/helper.c
index 0fabfec..ac5771e 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -221,6 +221,114 @@ static int get_physical_address (CPUMIPSState *env, 
hwaddr *physical,
 }
 return ret;
 }
+
+void cpu_mips_tlb_flush(CPUMIPSState *env, int flush_global)
+{
+MIPSCPU *cpu = mips_env_get_cpu(env);
+
+/* Flush qemu's TLB and discard all shadowed entries.  */
+tlb_flush(CPU(cpu), flush_global);
+env->tlb->tlb_in_use = env->tlb->nb_tlb;
+}
+
+/* 

[Qemu-devel] [PATCH 29/50] explicitly include hw/qdev-core.h

2016-04-08 Thread Paolo Bonzini
exec/cpu-all.h includes qom/cpu.h, which includes hw/qdev-core.h.
Explicit inclusion will keep things working when cpu.h will not be
included indirectly almost everywhere (either directly or through
qemu-common.h).

Signed-off-by: Paolo Bonzini 
---
 bootdevice.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bootdevice.c b/bootdevice.c
index 2e83ff0..bb9c08e 100644
--- a/bootdevice.c
+++ b/bootdevice.c
@@ -28,6 +28,7 @@
 #include "qapi/visitor.h"
 #include "qemu/error-report.h"
 #include "hw/hw.h"
+#include "hw/qdev-core.h"
 
 typedef struct FWBootEntry FWBootEntry;
 
-- 
1.8.3.1





[Qemu-devel] [PATCH 19/50] target-unicore32: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make UniCore32CPU an opaque type within cpu-qom.h, and move all
definitions of private methods, as well as all type definitions that
require knowledge of the layout to cpu.h.  This helps making files
independent of NEED_CPU_H if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-unicore32/cpu-qom.h | 29 +
 target-unicore32/cpu.h | 31 ++-
 2 files changed, 31 insertions(+), 29 deletions(-)

diff --git a/target-unicore32/cpu-qom.h b/target-unicore32/cpu-qom.h
index e554f1f..bc68e78 100644
--- a/target-unicore32/cpu-qom.h
+++ b/target-unicore32/cpu-qom.h
@@ -36,33 +36,6 @@ typedef struct UniCore32CPUClass {
 DeviceRealize parent_realize;
 } UniCore32CPUClass;
 
-/**
- * UniCore32CPU:
- * @env: #CPUUniCore32State
- *
- * A UniCore32 CPU.
- */
-typedef struct UniCore32CPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUUniCore32State env;
-} UniCore32CPU;
-
-static inline UniCore32CPU *uc32_env_get_cpu(CPUUniCore32State *env)
-{
-return container_of(env, UniCore32CPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(uc32_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(UniCore32CPU, env)
-
-void uc32_cpu_do_interrupt(CPUState *cpu);
-bool uc32_cpu_exec_interrupt(CPUState *cpu, int int_req);
-void uc32_cpu_dump_state(CPUState *cpu, FILE *f,
- fprintf_function cpu_fprintf, int flags);
-hwaddr uc32_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+typedef struct UniCore32CPU UniCore32CPU;
 
 #endif
diff --git a/target-unicore32/cpu.h b/target-unicore32/cpu.h
index 9c1fbf9..22a0aef 100644
--- a/target-unicore32/cpu.h
+++ b/target-unicore32/cpu.h
@@ -20,6 +20,7 @@
 #define CPUArchStatestruct CPUUniCore32State
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
 
@@ -71,6 +72,35 @@ typedef struct CPUUniCore32State {
 
 } CPUUniCore32State;
 
+/**
+ * UniCore32CPU:
+ * @env: #CPUUniCore32State
+ *
+ * A UniCore32 CPU.
+ */
+struct UniCore32CPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUUniCore32State env;
+};
+
+static inline UniCore32CPU *uc32_env_get_cpu(CPUUniCore32State *env)
+{
+return container_of(env, UniCore32CPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(uc32_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(UniCore32CPU, env)
+
+void uc32_cpu_do_interrupt(CPUState *cpu);
+bool uc32_cpu_exec_interrupt(CPUState *cpu, int int_req);
+void uc32_cpu_dump_state(CPUState *cpu, FILE *f,
+ fprintf_function cpu_fprintf, int flags);
+hwaddr uc32_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+
 #define ASR_M   (0x1f)
 #define ASR_MODE_USER   (0x10)
 #define ASR_MODE_INTR   (0x12)
@@ -134,7 +164,6 @@ static inline int cpu_mmu_index(CPUUniCore32State *env, 
bool ifetch)
 }
 
 #include "exec/cpu-all.h"
-#include "cpu-qom.h"
 #include "exec/exec-all.h"
 
 int uc32_cpu_exec(CPUState *s);
-- 
1.8.3.1





[Qemu-devel] [PATCH 16/50] target-sh4: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make SuperHCPU an opaque type within cpu-qom.h, and move all definitions
of private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-sh4/cpu-qom.h | 31 +--
 target-sh4/cpu.h | 32 +++-
 2 files changed, 32 insertions(+), 31 deletions(-)

diff --git a/target-sh4/cpu-qom.h b/target-sh4/cpu-qom.h
index 6341238..01abb20 100644
--- a/target-sh4/cpu-qom.h
+++ b/target-sh4/cpu-qom.h
@@ -60,35 +60,6 @@ typedef struct SuperHCPUClass {
 uint32_t cvr;
 } SuperHCPUClass;
 
-/**
- * SuperHCPU:
- * @env: #CPUSH4State
- *
- * A SuperH CPU.
- */
-typedef struct SuperHCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUSH4State env;
-} SuperHCPU;
-
-static inline SuperHCPU *sh_env_get_cpu(CPUSH4State *env)
-{
-return container_of(env, SuperHCPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(sh_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(SuperHCPU, env)
-
-void superh_cpu_do_interrupt(CPUState *cpu);
-bool superh_cpu_exec_interrupt(CPUState *cpu, int int_req);
-void superh_cpu_dump_state(CPUState *cpu, FILE *f,
-   fprintf_function cpu_fprintf, int flags);
-hwaddr superh_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-int superh_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int superh_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+typedef struct SuperHCPU SuperHCPU;
 
 #endif
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index 3b23e96..0acb60c 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -20,6 +20,7 @@
 #define _CPU_SH4_H
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 
 #define TARGET_LONG_BITS 32
 
@@ -187,7 +188,36 @@ typedef struct CPUSH4State {
 memory_content **movcal_backup_tail;
 } CPUSH4State;
 
-#include "cpu-qom.h"
+/**
+ * SuperHCPU:
+ * @env: #CPUSH4State
+ *
+ * A SuperH CPU.
+ */
+struct SuperHCPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUSH4State env;
+};
+
+static inline SuperHCPU *sh_env_get_cpu(CPUSH4State *env)
+{
+return container_of(env, SuperHCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(sh_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(SuperHCPU, env)
+
+void superh_cpu_do_interrupt(CPUState *cpu);
+bool superh_cpu_exec_interrupt(CPUState *cpu, int int_req);
+void superh_cpu_dump_state(CPUState *cpu, FILE *f,
+   fprintf_function cpu_fprintf, int flags);
+hwaddr superh_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int superh_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int superh_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 void sh4_translate_init(void);
 SuperHCPU *cpu_sh4_init(const char *cpu_model);
-- 
1.8.3.1





[Qemu-devel] [PATCH 20/50] target-xtensa: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make XtensaCPU an opaque type within cpu-qom.h, and move all definitions
of private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  Conversely, move all definitions needed to
define a class to cpu-qom.h.  This helps making files independent of
NEED_CPU_H if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-xtensa/cpu-qom.h | 193 ++-
 target-xtensa/cpu.h | 194 +---
 2 files changed, 194 insertions(+), 193 deletions(-)

diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index f5d9b9f..e7de30e 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -40,6 +40,163 @@
 #define XTENSA_CPU_GET_CLASS(obj) \
 OBJECT_GET_CLASS(XtensaCPUClass, (obj), TYPE_XTENSA_CPU)
 
+enum {
+/* Additional instructions */
+XTENSA_OPTION_CODE_DENSITY,
+XTENSA_OPTION_LOOP,
+XTENSA_OPTION_EXTENDED_L32R,
+XTENSA_OPTION_16_BIT_IMUL,
+XTENSA_OPTION_32_BIT_IMUL,
+XTENSA_OPTION_32_BIT_IMUL_HIGH,
+XTENSA_OPTION_32_BIT_IDIV,
+XTENSA_OPTION_MAC16,
+XTENSA_OPTION_MISC_OP_NSA,
+XTENSA_OPTION_MISC_OP_MINMAX,
+XTENSA_OPTION_MISC_OP_SEXT,
+XTENSA_OPTION_MISC_OP_CLAMPS,
+XTENSA_OPTION_COPROCESSOR,
+XTENSA_OPTION_BOOLEAN,
+XTENSA_OPTION_FP_COPROCESSOR,
+XTENSA_OPTION_MP_SYNCHRO,
+XTENSA_OPTION_CONDITIONAL_STORE,
+XTENSA_OPTION_ATOMCTL,
+XTENSA_OPTION_DEPBITS,
+
+/* Interrupts and exceptions */
+XTENSA_OPTION_EXCEPTION,
+XTENSA_OPTION_RELOCATABLE_VECTOR,
+XTENSA_OPTION_UNALIGNED_EXCEPTION,
+XTENSA_OPTION_INTERRUPT,
+XTENSA_OPTION_HIGH_PRIORITY_INTERRUPT,
+XTENSA_OPTION_TIMER_INTERRUPT,
+
+/* Local memory */
+XTENSA_OPTION_ICACHE,
+XTENSA_OPTION_ICACHE_TEST,
+XTENSA_OPTION_ICACHE_INDEX_LOCK,
+XTENSA_OPTION_DCACHE,
+XTENSA_OPTION_DCACHE_TEST,
+XTENSA_OPTION_DCACHE_INDEX_LOCK,
+XTENSA_OPTION_IRAM,
+XTENSA_OPTION_IROM,
+XTENSA_OPTION_DRAM,
+XTENSA_OPTION_DROM,
+XTENSA_OPTION_XLMI,
+XTENSA_OPTION_HW_ALIGNMENT,
+XTENSA_OPTION_MEMORY_ECC_PARITY,
+
+/* Memory protection and translation */
+XTENSA_OPTION_REGION_PROTECTION,
+XTENSA_OPTION_REGION_TRANSLATION,
+XTENSA_OPTION_MMU,
+XTENSA_OPTION_CACHEATTR,
+
+/* Other */
+XTENSA_OPTION_WINDOWED_REGISTER,
+XTENSA_OPTION_PROCESSOR_INTERFACE,
+XTENSA_OPTION_MISC_SR,
+XTENSA_OPTION_THREAD_POINTER,
+XTENSA_OPTION_PROCESSOR_ID,
+XTENSA_OPTION_DEBUG,
+XTENSA_OPTION_TRACE_PORT,
+};
+
+#define MAX_NAREG 64
+#define MAX_NINTERRUPT 32
+#define MAX_NLEVEL 6
+#define MAX_NNMI 1
+#define MAX_NCCOMPARE 3
+#define MAX_TLB_WAY_SIZE 8
+#define MAX_NDBREAK 2
+
+enum {
+/* Static vectors */
+EXC_RESET,
+EXC_MEMORY_ERROR,
+
+/* Dynamic vectors */
+EXC_WINDOW_OVERFLOW4,
+EXC_WINDOW_UNDERFLOW4,
+EXC_WINDOW_OVERFLOW8,
+EXC_WINDOW_UNDERFLOW8,
+EXC_WINDOW_OVERFLOW12,
+EXC_WINDOW_UNDERFLOW12,
+EXC_IRQ,
+EXC_KERNEL,
+EXC_USER,
+EXC_DOUBLE,
+EXC_DEBUG,
+EXC_MAX
+};
+
+typedef enum {
+INTTYPE_LEVEL,
+INTTYPE_EDGE,
+INTTYPE_NMI,
+INTTYPE_SOFTWARE,
+INTTYPE_TIMER,
+INTTYPE_DEBUG,
+INTTYPE_WRITE_ERR,
+INTTYPE_PROFILING,
+INTTYPE_MAX
+} interrupt_type;
+
+typedef struct xtensa_tlb {
+unsigned nways;
+const unsigned way_size[10];
+bool varway56;
+unsigned nrefillentries;
+} xtensa_tlb;
+
+typedef struct XtensaGdbReg {
+int targno;
+int type;
+int group;
+unsigned size;
+} XtensaGdbReg;
+
+typedef struct XtensaGdbRegmap {
+int num_regs;
+int num_core_regs;
+/* PC + a + ar + sr + ur */
+XtensaGdbReg reg[1 + 16 + 64 + 256 + 256];
+} XtensaGdbRegmap;
+
+typedef struct XtensaConfig {
+const char *name;
+uint64_t options;
+XtensaGdbRegmap gdb_regmap;
+unsigned nareg;
+int excm_level;
+int ndepc;
+uint32_t vecbase;
+uint32_t exception_vector[EXC_MAX];
+unsigned ninterrupt;
+unsigned nlevel;
+uint32_t interrupt_vector[MAX_NLEVEL + MAX_NNMI + 1];
+uint32_t level_mask[MAX_NLEVEL + MAX_NNMI + 1];
+uint32_t inttype_mask[INTTYPE_MAX];
+struct {
+uint32_t level;
+interrupt_type inttype;
+} interrupt[MAX_NINTERRUPT];
+unsigned nccompare;
+uint32_t timerint[MAX_NCCOMPARE];
+unsigned nextint;
+unsigned extint[MAX_NINTERRUPT];
+
+unsigned debug_level;
+unsigned nibreak;
+unsigned ndbreak;
+
+uint32_t configid[2];
+
+uint32_t clock_freq_khz;
+
+xtensa_tlb itlb;
+xtensa_tlb dtlb;
+} XtensaConfig;
+
 /**
  * XtensaCPUClass:
  * @parent_realize: The parent class' realize handler.
@@ -59,40 +216,6 @@ typedef struct XtensaCPUClass {
 const XtensaConfig *config;
 } XtensaCPUClass;
 
-/**
- * XtensaCPU:
- * @env: #CPUXtensaState
- *
- * An Xtensa CPU.
- */
-typedef struct XtensaCPU {
-/*< privat

[Qemu-devel] [PATCH 21/50] arm: include cpu-qom.h in files that require ARMCPU

2016-04-08 Thread Paolo Bonzini
This will keep things working when cpu.h will not be included
indirectly almost everywhere (either directly or through
qemu-common.h).

Signed-off-by: Paolo Bonzini 
---
 hw/arm/stm32f205_soc.c  | 1 -
 hw/arm/strongarm.h  | 1 +
 include/hw/arm/arm.h| 2 +-
 include/hw/arm/exynos4210.h | 1 +
 include/hw/arm/omap.h   | 1 +
 include/hw/arm/pxa.h| 1 +
 6 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index a5ea1e2..9c1dafb 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -25,7 +25,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "cpu.h"
 #include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
diff --git a/hw/arm/strongarm.h b/hw/arm/strongarm.h
index 2893f94..cd32bbd 100644
--- a/hw/arm/strongarm.h
+++ b/hw/arm/strongarm.h
@@ -2,6 +2,7 @@
 #define _STRONGARM_H
 
 #include "exec/memory.h"
+#include "target-arm/cpu-qom.h"
 
 #define SA_CS0  0x
 #define SA_CS1  0x0800
diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index b2517f9..8b49a98 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -12,9 +12,9 @@
 #define ARM_MISC_H 1
 
 #include "exec/memory.h"
+#include "target-arm/cpu-qom.h"
 #include "hw/irq.h"
 #include "qemu/notify.h"
-#include "cpu.h"
 
 typedef enum {
 ARM_ENDIANNESS_UNKNOWN = 0,
diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index 5c1820f..b6d929d 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -28,6 +28,7 @@
 
 #include "qemu-common.h"
 #include "exec/memory.h"
+#include "target-arm/cpu-qom.h"
 
 #define EXYNOS4210_NCPUS2
 
diff --git a/include/hw/arm/omap.h b/include/hw/arm/omap.h
index 0ad5fb8..f026c8d 100644
--- a/include/hw/arm/omap.h
+++ b/include/hw/arm/omap.h
@@ -20,6 +20,7 @@
 #include "exec/memory.h"
 # define hw_omap_h "omap.h"
 #include "hw/irq.h"
+#include "target-arm/cpu-qom.h"
 
 # define OMAP_EMIFS_BASE   0x
 # define OMAP2_Q0_BASE 0x
diff --git a/include/hw/arm/pxa.h b/include/hw/arm/pxa.h
index 259b852..074feac 100644
--- a/include/hw/arm/pxa.h
+++ b/include/hw/arm/pxa.h
@@ -10,6 +10,7 @@
 # define PXA_H "pxa.h"
 
 #include "exec/memory.h"
+#include "target-arm/cpu-qom.h"
 
 /* Interrupt numbers */
 # define PXA2XX_PIC_SSP3   0
-- 
1.8.3.1





[Qemu-devel] [PATCH 15/50] target-s390x: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make S390XCPU an opaque type within cpu-qom.h, and move all definitions
of private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-s390x/cpu-qom.h | 45 +
 target-s390x/cpu.h | 47 ++-
 2 files changed, 47 insertions(+), 45 deletions(-)

diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index 681e370..66b5d18 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -55,49 +55,6 @@ typedef struct S390CPUClass {
 void (*initial_cpu_reset)(CPUState *cpu);
 } S390CPUClass;
 
-/**
- * S390CPU:
- * @env: #CPUS390XState.
- *
- * An S/390 CPU.
- */
-typedef struct S390CPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUS390XState env;
-int64_t id;
-/* needed for live migration */
-void *irqstate;
-uint32_t irqstate_saved_size;
-} S390CPU;
-
-static inline S390CPU *s390_env_get_cpu(CPUS390XState *env)
-{
-return container_of(env, S390CPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(s390_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(S390CPU, env)
-
-#ifndef CONFIG_USER_ONLY
-extern const struct VMStateDescription vmstate_s390_cpu;
-#endif
-
-void s390_cpu_do_interrupt(CPUState *cpu);
-bool s390_cpu_exec_interrupt(CPUState *cpu, int int_req);
-void s390_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
- int flags);
-int s390_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
-  int cpuid, void *opaque);
-
-hwaddr s390_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-hwaddr s390_cpu_get_phys_addr_debug(CPUState *cpu, vaddr addr);
-int s390_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int s390_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-void s390_cpu_gdb_init(CPUState *cs);
-void s390x_cpu_debug_excp_handler(CPUState *cs);
+typedef struct S390CPU S390CPU;
 
 #endif
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 6d97c08..760eadf 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -23,6 +23,7 @@
 #define CPU_S390X_H
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 
 #define TARGET_LONG_BITS 64
 
@@ -171,7 +172,51 @@ static inline CPU_DoubleU *get_freg(CPUS390XState *cs, int 
nr)
 return &cs->vregs[nr][0];
 }
 
-#include "cpu-qom.h"
+/**
+ * S390CPU:
+ * @env: #CPUS390XState.
+ *
+ * An S/390 CPU.
+ */
+struct S390CPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUS390XState env;
+int64_t id;
+/* needed for live migration */
+void *irqstate;
+uint32_t irqstate_saved_size;
+};
+
+static inline S390CPU *s390_env_get_cpu(CPUS390XState *env)
+{
+return container_of(env, S390CPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(s390_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(S390CPU, env)
+
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_s390_cpu;
+#endif
+
+void s390_cpu_do_interrupt(CPUState *cpu);
+bool s390_cpu_exec_interrupt(CPUState *cpu, int int_req);
+void s390_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+ int flags);
+int s390_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
+  int cpuid, void *opaque);
+
+hwaddr s390_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+hwaddr s390_cpu_get_phys_addr_debug(CPUState *cpu, vaddr addr);
+int s390_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int s390_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+void s390_cpu_gdb_init(CPUState *cs);
+void s390x_cpu_debug_excp_handler(CPUState *cs);
+
 #include 
 
 /* distinguish between 24 bit and 31 bit addressing */
-- 
1.8.3.1





[Qemu-devel] [PATCH 12/50] target-mips: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make MIPSCPU an opaque type within cpu-qom.h, and move all definitions of
private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-mips/cpu-qom.h | 37 +
 target-mips/cpu.h | 38 +-
 2 files changed, 38 insertions(+), 37 deletions(-)

diff --git a/target-mips/cpu-qom.h b/target-mips/cpu-qom.h
index 4d6f9de..3f5bf23 100644
--- a/target-mips/cpu-qom.h
+++ b/target-mips/cpu-qom.h
@@ -51,41 +51,6 @@ typedef struct MIPSCPUClass {
 void (*parent_reset)(CPUState *cpu);
 } MIPSCPUClass;
 
-/**
- * MIPSCPU:
- * @env: #CPUMIPSState
- *
- * A MIPS CPU.
- */
-typedef struct MIPSCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUMIPSState env;
-} MIPSCPU;
-
-static inline MIPSCPU *mips_env_get_cpu(CPUMIPSState *env)
-{
-return container_of(env, MIPSCPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(mips_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(MIPSCPU, env)
-
-#ifndef CONFIG_USER_ONLY
-extern const struct VMStateDescription vmstate_mips_cpu;
-#endif
-
-void mips_cpu_do_interrupt(CPUState *cpu);
-bool mips_cpu_exec_interrupt(CPUState *cpu, int int_req);
-void mips_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
- int flags);
-hwaddr mips_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-int mips_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int mips_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-void mips_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
-  int is_write, int is_user, uintptr_t 
retaddr);
+typedef struct MIPSCPU MIPSCPU;
 
 #endif
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 866924d..078fabc 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -8,6 +8,7 @@
 #define CPUArchState struct CPUMIPSState
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 #include "mips-defs.h"
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
@@ -615,7 +616,42 @@ struct CPUMIPSState {
 MemoryRegion *itc_tag; /* ITC Configuration Tags */
 };
 
-#include "cpu-qom.h"
+/**
+ * MIPSCPU:
+ * @env: #CPUMIPSState
+ *
+ * A MIPS CPU.
+ */
+struct MIPSCPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUMIPSState env;
+};
+
+static inline MIPSCPU *mips_env_get_cpu(CPUMIPSState *env)
+{
+return container_of(env, MIPSCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(mips_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(MIPSCPU, env)
+
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_mips_cpu;
+#endif
+
+void mips_cpu_do_interrupt(CPUState *cpu);
+bool mips_cpu_exec_interrupt(CPUState *cpu, int int_req);
+void mips_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+ int flags);
+hwaddr mips_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int mips_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int mips_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+void mips_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
+  int is_write, int is_user, uintptr_t 
retaddr);
 
 #if !defined(CONFIG_USER_ONLY)
 int no_mmu_map_address (CPUMIPSState *env, hwaddr *physical, int *prot,
-- 
1.8.3.1





[Qemu-devel] [PATCH 13/50] target-ppc: do not use target_ulong in cpu-qom.h

2016-04-08 Thread Paolo Bonzini
Bring the PowerPCCPUClass handle_mmu_fault method type into line with
the one in CPUState.

Using vaddr also makes the cpu-qom.h file target independent.

Signed-off-by: Paolo Bonzini 
---
 target-ppc/cpu-qom.h| 3 +--
 target-ppc/mmu-hash32.c | 2 +-
 target-ppc/mmu-hash32.h | 2 +-
 target-ppc/mmu-hash64.c | 2 +-
 target-ppc/mmu-hash64.h | 2 +-
 5 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index eb822a3..bab501f 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -73,8 +73,7 @@ typedef struct PowerPCCPUClass {
 void (*init_proc)(CPUPPCState *env);
 int  (*check_pow)(CPUPPCState *env);
 #if defined(CONFIG_SOFTMMU)
-int (*handle_mmu_fault)(PowerPCCPU *cpu, target_ulong eaddr, int rwx,
-int mmu_idx);
+int (*handle_mmu_fault)(PowerPCCPU *cpu, vaddr eaddr, int rwx, int 
mmu_idx);
 #endif
 bool (*interrupts_big_endian)(PowerPCCPU *cpu);
 } PowerPCCPUClass;
diff --git a/target-ppc/mmu-hash32.c b/target-ppc/mmu-hash32.c
index 39abb2f..06ce4d6 100644
--- a/target-ppc/mmu-hash32.c
+++ b/target-ppc/mmu-hash32.c
@@ -383,7 +383,7 @@ static hwaddr ppc_hash32_pte_raddr(target_ulong sr, 
ppc_hash_pte32_t pte,
 return (rpn & ~mask) | (eaddr & mask);
 }
 
-int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr, int rwx,
+int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
 int mmu_idx)
 {
 CPUState *cs = CPU(cpu);
diff --git a/target-ppc/mmu-hash32.h b/target-ppc/mmu-hash32.h
index afbb9dd..aaceacd 100644
--- a/target-ppc/mmu-hash32.h
+++ b/target-ppc/mmu-hash32.h
@@ -5,7 +5,7 @@
 
 hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash);
 hwaddr ppc_hash32_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr);
-int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, target_ulong address, int rw,
+int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, vaddr address, int rw,
 int mmu_idx);
 
 /*
diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
index 72c4ab5..5184626 100644
--- a/target-ppc/mmu-hash64.c
+++ b/target-ppc/mmu-hash64.c
@@ -589,7 +589,7 @@ unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu,
 return 0;
 }
 
-int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr,
+int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr,
 int rwx, int mmu_idx)
 {
 CPUState *cs = CPU(cpu);
diff --git a/target-ppc/mmu-hash64.h b/target-ppc/mmu-hash64.h
index 9bf8b9b..6423b9f 100644
--- a/target-ppc/mmu-hash64.h
+++ b/target-ppc/mmu-hash64.h
@@ -9,7 +9,7 @@ void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU 
*cpu);
 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
   target_ulong esid, target_ulong vsid);
 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr);
-int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, target_ulong address, int rw,
+int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr address, int rw,
 int mmu_idx);
 void ppc_hash64_store_hpte(PowerPCCPU *cpu, target_ulong index,
target_ulong pte0, target_ulong pte1);
-- 
1.8.3.1





[Qemu-devel] [PATCH 24/50] alpha: include cpu-qom.h in files that require AlphaCPU

2016-04-08 Thread Paolo Bonzini
This will keep things working when cpu.h will not be included
indirectly almost everywhere (either directly or through
qemu-common.h).

Signed-off-by: Paolo Bonzini 
---
 hw/alpha/alpha_sys.h | 1 +
 hw/alpha/pci.c   | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/alpha/alpha_sys.h b/hw/alpha/alpha_sys.h
index e11025b..fcaeb2b 100644
--- a/hw/alpha/alpha_sys.h
+++ b/hw/alpha/alpha_sys.h
@@ -3,6 +3,7 @@
 #ifndef HW_ALPHA_H
 #define HW_ALPHA_H 1
 
+#include "target-alpha/cpu-qom.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_host.h"
 #include "hw/ide.h"
diff --git a/hw/alpha/pci.c b/hw/alpha/pci.c
index 5baa0ea..8dde637 100644
--- a/hw/alpha/pci.c
+++ b/hw/alpha/pci.c
@@ -8,7 +8,6 @@
 
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "cpu.h"
 #include "alpha_sys.h"
 #include "qemu/log.h"
 #include "sysemu/sysemu.h"
-- 
1.8.3.1





[Qemu-devel] [PATCH 23/50] sh4: include cpu-qom.h in files that require SuperHCPU

2016-04-08 Thread Paolo Bonzini
This will keep things working when cpu.h will not be included
indirectly almost everywhere (either directly or through
qemu-common.h).

Signed-off-by: Paolo Bonzini 
---
 include/hw/sh4/sh.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/hw/sh4/sh.h b/include/hw/sh4/sh.h
index e61de9a..070312d 100644
--- a/include/hw/sh4/sh.h
+++ b/include/hw/sh4/sh.h
@@ -3,6 +3,7 @@
 /* Definitions for SH board emulation.  */
 
 #include "hw/sh4/sh_intc.h"
+#include "target-sh4/cpu-qom.h"
 
 #define A7ADDR(x) ((x) & 0x1fff)
 #define P4ADDR(x) ((x) | 0xe000)
-- 
1.8.3.1





[Qemu-devel] [PATCH 08/50] target-i386: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make X86CPU an opaque type within cpu-qom.h, and move all definitions of
private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-i386/cpu-qom.h | 97 +-
 target-i386/cpu.h | 98 ++-
 2 files changed, 98 insertions(+), 97 deletions(-)

diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 2ca7b9e..5dde658 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -67,101 +67,6 @@ typedef struct X86CPUClass {
 void (*parent_reset)(CPUState *cpu);
 } X86CPUClass;
 
-/**
- * X86CPU:
- * @env: #CPUX86State
- * @migratable: If set, only migratable flags will be accepted when "enforce"
- * mode is used, and only migratable flags will be included in the "host"
- * CPU model.
- *
- * An x86 CPU.
- */
-typedef struct X86CPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUX86State env;
-
-bool hyperv_vapic;
-bool hyperv_relaxed_timing;
-int hyperv_spinlock_attempts;
-char *hyperv_vendor_id;
-bool hyperv_time;
-bool hyperv_crash;
-bool hyperv_reset;
-bool hyperv_vpindex;
-bool hyperv_runtime;
-bool hyperv_synic;
-bool hyperv_stimer;
-bool check_cpuid;
-bool enforce_cpuid;
-bool expose_kvm;
-bool migratable;
-bool host_features;
-int64_t apic_id;
-
-/* if true the CPUID code directly forward host cache leaves to the guest 
*/
-bool cache_info_passthrough;
-
-/* Features that were filtered out because of missing host capabilities */
-uint32_t filtered_features[FEATURE_WORDS];
-
-/* Enable PMU CPUID bits. This can't be enabled by default yet because
- * it doesn't have ABI stability guarantees, as it passes all PMU CPUID
- * bits returned by GET_SUPPORTED_CPUID (that depend on host CPU and kernel
- * capabilities) directly to the guest.
- */
-bool enable_pmu;
-
-/* in order to simplify APIC support, we leave this pointer to the
-   user */
-struct DeviceState *apic_state;
-struct MemoryRegion *cpu_as_root, *cpu_as_mem, *smram;
-Notifier machine_done;
-} X86CPU;
-
-static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
-{
-return container_of(env, X86CPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(x86_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(X86CPU, env)
-
-#ifndef CONFIG_USER_ONLY
-extern struct VMStateDescription vmstate_x86_cpu;
-#endif
-
-/**
- * x86_cpu_do_interrupt:
- * @cpu: vCPU the interrupt is to be handled by.
- */
-void x86_cpu_do_interrupt(CPUState *cpu);
-bool x86_cpu_exec_interrupt(CPUState *cpu, int int_req);
-
-int x86_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cpu,
- int cpuid, void *opaque);
-int x86_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cpu,
- int cpuid, void *opaque);
-int x86_cpu_write_elf64_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
- void *opaque);
-int x86_cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
- void *opaque);
-
-void x86_cpu_get_memory_mapping(CPUState *cpu, MemoryMappingList *list,
-Error **errp);
-
-void x86_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
-int flags);
-
-hwaddr x86_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-
-int x86_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int x86_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-
-void x86_cpu_exec_enter(CPUState *cpu);
-void x86_cpu_exec_exit(CPUState *cpu);
+typedef struct X86CPU X86CPU;
 
 #endif
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 732eb6d..9614c88 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -20,6 +20,7 @@
 #define CPU_I386_H
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 #include "standard-headers/asm-x86/hyperv.h"
 
 #ifdef TARGET_X86_64
@@ -1028,7 +1029,102 @@ typedef struct CPUX86State {
 TPRAccess tpr_access_type;
 } CPUX86State;
 
-#include "cpu-qom.h"
+/**
+ * X86CPU:
+ * @env: #CPUX86State
+ * @migratable: If set, only migratable flags will be accepted when "enforce"
+ * mode is used, and only migratable flags will be included in the "host"
+ * CPU model.
+ *
+ * An x86 CPU.
+ */
+struct X86CPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUX86State env;
+
+bool hyperv_vapic;
+bool hyperv_relaxed_timing;
+int hyperv_spinlock_attempts;
+char *hyperv_vendor_id;
+bool hyperv_time;
+bool hyperv_crash;
+bool hyperv_reset;
+bool hyperv_vpindex;
+bool hyperv_runtime;
+bool hyperv_synic;
+bool hyperv_stimer;
+bool check_cpuid;
+bool enforce_cpuid;
+bool e

[Qemu-devel] [PATCH 18/50] target-tricore: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make TriCoreCPU an opaque type within cpu-qom.h, and move all definitions
of private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-tricore/cpu-qom.h | 28 +---
 target-tricore/cpu.h | 30 +-
 2 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/target-tricore/cpu-qom.h b/target-tricore/cpu-qom.h
index 66c9664..399c98f 100644
--- a/target-tricore/cpu-qom.h
+++ b/target-tricore/cpu-qom.h
@@ -39,32 +39,6 @@ typedef struct TriCoreCPUClass {
 void (*parent_reset)(CPUState *cpu);
 } TriCoreCPUClass;
 
-/**
- * TriCoreCPU:
- * @env: #CPUTriCoreState
- *
- * A TriCore CPU.
- */
-typedef struct TriCoreCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUTriCoreState env;
-} TriCoreCPU;
-
-static inline TriCoreCPU *tricore_env_get_cpu(CPUTriCoreState *env)
-{
-return TRICORE_CPU(container_of(env, TriCoreCPU, env));
-}
-
-#define ENV_GET_CPU(e) CPU(tricore_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(TriCoreCPU, env)
-
-hwaddr tricore_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-void tricore_cpu_dump_state(CPUState *cpu, FILE *f,
-fprintf_function cpu_fprintf, int flags);
-
+typedef struct TriCoreCPU TriCoreCPU;
 
 #endif /*QEMU_TRICORE_CPU_QOM_H */
diff --git a/target-tricore/cpu.h b/target-tricore/cpu.h
index 90045a9..cd350b4 100644
--- a/target-tricore/cpu.h
+++ b/target-tricore/cpu.h
@@ -21,6 +21,7 @@
 
 #include "tricore-defs.h"
 #include "qemu-common.h"
+#include "cpu-qom.h"
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
 
@@ -198,6 +199,34 @@ struct CPUTriCoreState {
 struct QEMUTimer *timer; /* Internal timer */
 };
 
+/**
+ * TriCoreCPU:
+ * @env: #CPUTriCoreState
+ *
+ * A TriCore CPU.
+ */
+struct TriCoreCPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUTriCoreState env;
+};
+
+static inline TriCoreCPU *tricore_env_get_cpu(CPUTriCoreState *env)
+{
+return TRICORE_CPU(container_of(env, TriCoreCPU, env));
+}
+
+#define ENV_GET_CPU(e) CPU(tricore_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(TriCoreCPU, env)
+
+hwaddr tricore_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+void tricore_cpu_dump_state(CPUState *cpu, FILE *f,
+fprintf_function cpu_fprintf, int flags);
+
+
 #define MASK_PCXI_PCPN 0xff00
 #define MASK_PCXI_PIE  0x0080
 #define MASK_PCXI_UL   0x0040
@@ -341,7 +370,6 @@ void psw_write(CPUTriCoreState *env, uint32_t val);
 
 void fpu_set_state(CPUTriCoreState *env);
 
-#include "cpu-qom.h"
 #define MMU_USER_IDX 2
 
 void tricore_cpu_list(FILE *f, fprintf_function cpu_fprintf);
-- 
1.8.3.1





[Qemu-devel] [PATCH 07/50] target-cris: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make CRISCPU an opaque type within cpu-qom.h, and move all definitions of
private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-cris/cpu-qom.h | 40 +---
 target-cris/cpu.h | 41 -
 2 files changed, 41 insertions(+), 40 deletions(-)

diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index df4c0b5..7556e9f 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -50,44 +50,6 @@ typedef struct CRISCPUClass {
 uint32_t vr;
 } CRISCPUClass;
 
-/**
- * CRISCPU:
- * @env: #CPUCRISState
- *
- * A CRIS CPU.
- */
-typedef struct CRISCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUCRISState env;
-} CRISCPU;
-
-static inline CRISCPU *cris_env_get_cpu(CPUCRISState *env)
-{
-return container_of(env, CRISCPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(cris_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(CRISCPU, env)
-
-#ifndef CONFIG_USER_ONLY
-extern const struct VMStateDescription vmstate_cris_cpu;
-#endif
-
-void cris_cpu_do_interrupt(CPUState *cpu);
-void crisv10_cpu_do_interrupt(CPUState *cpu);
-bool cris_cpu_exec_interrupt(CPUState *cpu, int int_req);
-
-void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
- int flags);
-
-hwaddr cris_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-
-int crisv10_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int cris_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+typedef struct CRISCPU CRISCPU;
 
 #endif
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index 415cf91..e3411687 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -21,6 +21,7 @@
 #define CPU_CRIS_H
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 
 #define TARGET_LONG_BITS 32
 
@@ -171,7 +172,45 @@ typedef struct CPUCRISState {
 void *load_info;
 } CPUCRISState;
 
-#include "cpu-qom.h"
+/**
+ * CRISCPU:
+ * @env: #CPUCRISState
+ *
+ * A CRIS CPU.
+ */
+struct CRISCPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUCRISState env;
+};
+
+static inline CRISCPU *cris_env_get_cpu(CPUCRISState *env)
+{
+return container_of(env, CRISCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(cris_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(CRISCPU, env)
+
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_cris_cpu;
+#endif
+
+void cris_cpu_do_interrupt(CPUState *cpu);
+void crisv10_cpu_do_interrupt(CPUState *cpu);
+bool cris_cpu_exec_interrupt(CPUState *cpu, int int_req);
+
+void cris_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+ int flags);
+
+hwaddr cris_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+
+int crisv10_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int cris_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int cris_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 CRISCPU *cpu_cris_init(const char *cpu_model);
 int cpu_cris_exec(CPUState *cpu);
-- 
1.8.3.1





[Qemu-devel] [PATCH 10/50] target-m68k: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make M68KCPU an opaque type within cpu-qom.h, and move all definitions of
private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-m68k/cpu-qom.h | 34 +-
 target-m68k/cpu.h | 36 ++--
 2 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/target-m68k/cpu-qom.h b/target-m68k/cpu-qom.h
index c28e55d..9885bba 100644
--- a/target-m68k/cpu-qom.h
+++ b/target-m68k/cpu-qom.h
@@ -47,38 +47,6 @@ typedef struct M68kCPUClass {
 void (*parent_reset)(CPUState *cpu);
 } M68kCPUClass;
 
-/**
- * M68kCPU:
- * @env: #CPUM68KState
- *
- * A Motorola 68k CPU.
- */
-typedef struct M68kCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUM68KState env;
-} M68kCPU;
-
-static inline M68kCPU *m68k_env_get_cpu(CPUM68KState *env)
-{
-return container_of(env, M68kCPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(m68k_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(M68kCPU, env)
-
-void m68k_cpu_do_interrupt(CPUState *cpu);
-bool m68k_cpu_exec_interrupt(CPUState *cpu, int int_req);
-void m68k_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
- int flags);
-hwaddr m68k_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-int m68k_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-
-void m68k_cpu_exec_enter(CPUState *cs);
-void m68k_cpu_exec_exit(CPUState *cs);
+typedef struct M68kCPU M68kCPU;
 
 #endif
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index 48b4c87..57c2c8d 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -26,7 +26,7 @@
 
 #include "qemu-common.h"
 #include "exec/cpu-defs.h"
-
+#include "cpu-qom.h"
 #include "fpu/softfloat.h"
 
 #define MAX_QREGS 32
@@ -109,7 +109,39 @@ typedef struct CPUM68KState {
 uint32_t features;
 } CPUM68KState;
 
-#include "cpu-qom.h"
+/**
+ * M68kCPU:
+ * @env: #CPUM68KState
+ *
+ * A Motorola 68k CPU.
+ */
+struct M68kCPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUM68KState env;
+};
+
+static inline M68kCPU *m68k_env_get_cpu(CPUM68KState *env)
+{
+return container_of(env, M68kCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(m68k_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(M68kCPU, env)
+
+void m68k_cpu_do_interrupt(CPUState *cpu);
+bool m68k_cpu_exec_interrupt(CPUState *cpu, int int_req);
+void m68k_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+ int flags);
+hwaddr m68k_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int m68k_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int m68k_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+
+void m68k_cpu_exec_enter(CPUState *cs);
+void m68k_cpu_exec_exit(CPUState *cs);
 
 void m68k_tcg_init(void);
 void m68k_cpu_init_gdb(M68kCPU *cpu);
-- 
1.8.3.1





[Qemu-devel] [PATCH 05/50] target-alpha: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make AlphaCPU an opaque type within cpu-qom.h, and move all definitions
of private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-alpha/cpu-qom.h | 40 +---
 target-alpha/cpu.h | 42 +-
 2 files changed, 42 insertions(+), 40 deletions(-)

diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index cf5264a..bae4945 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -47,44 +47,6 @@ typedef struct AlphaCPUClass {
 void (*parent_reset)(CPUState *cpu);
 } AlphaCPUClass;
 
-/**
- * AlphaCPU:
- * @env: #CPUAlphaState
- *
- * An Alpha CPU.
- */
-typedef struct AlphaCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUAlphaState env;
-
-/* This alarm doesn't exist in real hardware; we wish it did.  */
-QEMUTimer *alarm_timer;
-} AlphaCPU;
-
-static inline AlphaCPU *alpha_env_get_cpu(CPUAlphaState *env)
-{
-return container_of(env, AlphaCPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(alpha_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(AlphaCPU, env)
-
-#ifndef CONFIG_USER_ONLY
-extern const struct VMStateDescription vmstate_alpha_cpu;
-#endif
-
-void alpha_cpu_do_interrupt(CPUState *cpu);
-bool alpha_cpu_exec_interrupt(CPUState *cpu, int int_req);
-void alpha_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
-  int flags);
-hwaddr alpha_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-int alpha_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int alpha_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-void alpha_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
-   int is_write, int is_user, uintptr_t 
retaddr);
+typedef struct AlphaCPU AlphaCPU;
 
 #endif
diff --git a/target-alpha/cpu.h b/target-alpha/cpu.h
index 420f2a5..8353bda 100644
--- a/target-alpha/cpu.h
+++ b/target-alpha/cpu.h
@@ -21,6 +21,7 @@
 #define __CPU_ALPHA_H__
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 
 #define TARGET_LONG_BITS 64
 #define ALIGNED_ONLY
@@ -284,12 +285,51 @@ struct CPUAlphaState {
 int implver;
 };
 
+/**
+ * AlphaCPU:
+ * @env: #CPUAlphaState
+ *
+ * An Alpha CPU.
+ */
+struct AlphaCPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPUAlphaState env;
+
+/* This alarm doesn't exist in real hardware; we wish it did.  */
+QEMUTimer *alarm_timer;
+};
+
+static inline AlphaCPU *alpha_env_get_cpu(CPUAlphaState *env)
+{
+return container_of(env, AlphaCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(alpha_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(AlphaCPU, env)
+
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_alpha_cpu;
+#endif
+
+void alpha_cpu_do_interrupt(CPUState *cpu);
+bool alpha_cpu_exec_interrupt(CPUState *cpu, int int_req);
+void alpha_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+  int flags);
+hwaddr alpha_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int alpha_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int alpha_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+void alpha_cpu_do_unaligned_access(CPUState *cpu, vaddr addr,
+   int is_write, int is_user, uintptr_t 
retaddr);
+
 #define cpu_list alpha_cpu_list
 #define cpu_exec cpu_alpha_exec
 #define cpu_signal_handler cpu_alpha_signal_handler
 
 #include "exec/cpu-all.h"
-#include "cpu-qom.h"
 
 enum {
 FEATURE_ASN= 0x0001,
-- 
1.8.3.1





[Qemu-devel] [PATCH 11/50] target-microblaze: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make MicroBlazeCPU an opaque type within cpu-qom.h, and move all
definitions of private methods, as well as all type definitions that
require knowledge of the layout to cpu.h.  This helps making files
independent of NEED_CPU_H if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-microblaze/cpu-qom.h | 44 +---
 target-microblaze/cpu.h | 45 -
 2 files changed, 45 insertions(+), 44 deletions(-)

diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index 34f6273..1a61db7 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -47,48 +47,6 @@ typedef struct MicroBlazeCPUClass {
 void (*parent_reset)(CPUState *cpu);
 } MicroBlazeCPUClass;
 
-/**
- * MicroBlazeCPU:
- * @env: #CPUMBState
- *
- * A MicroBlaze CPU.
- */
-typedef struct MicroBlazeCPU {
-/*< private >*/
-CPUState parent_obj;
-
-/*< public >*/
-
-/* Microblaze Configuration Settings */
-struct {
-bool stackprot;
-uint32_t base_vectors;
-uint8_t use_fpu;
-bool use_mmu;
-bool dcache_writeback;
-bool endi;
-char *version;
-uint8_t pvr;
-} cfg;
-
-CPUMBState env;
-} MicroBlazeCPU;
-
-static inline MicroBlazeCPU *mb_env_get_cpu(CPUMBState *env)
-{
-return container_of(env, MicroBlazeCPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(mb_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(MicroBlazeCPU, env)
-
-void mb_cpu_do_interrupt(CPUState *cs);
-bool mb_cpu_exec_interrupt(CPUState *cs, int int_req);
-void mb_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
-   int flags);
-hwaddr mb_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-int mb_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+typedef struct MicroBlazeCPU MicroBlazeCPU;
 
 #endif
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 2f7335e..4c4db7f 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -20,6 +20,7 @@
 #define CPU_MICROBLAZE_H
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 
 #define TARGET_LONG_BITS 32
 
@@ -274,7 +275,49 @@ struct CPUMBState {
 } pvr;
 };
 
-#include "cpu-qom.h"
+/**
+ * MicroBlazeCPU:
+ * @env: #CPUMBState
+ *
+ * A MicroBlaze CPU.
+ */
+struct MicroBlazeCPU {
+/*< private >*/
+CPUState parent_obj;
+
+/*< public >*/
+
+/* Microblaze Configuration Settings */
+struct {
+bool stackprot;
+uint32_t base_vectors;
+uint8_t use_fpu;
+bool use_mmu;
+bool dcache_writeback;
+bool endi;
+char *version;
+uint8_t pvr;
+} cfg;
+
+CPUMBState env;
+};
+
+static inline MicroBlazeCPU *mb_env_get_cpu(CPUMBState *env)
+{
+return container_of(env, MicroBlazeCPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(mb_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(MicroBlazeCPU, env)
+
+void mb_cpu_do_interrupt(CPUState *cs);
+bool mb_cpu_exec_interrupt(CPUState *cs, int int_req);
+void mb_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+   int flags);
+hwaddr mb_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int mb_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int mb_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
 void mb_tcg_init(void);
 MicroBlazeCPU *cpu_mb_init(const char *cpu_model);
-- 
1.8.3.1





[Qemu-devel] [PATCH 02/50] include: move CPU-related definitions out of qemu-common.h

2016-04-08 Thread Paolo Bonzini
Signed-off-by: Paolo Bonzini 
---
 include/qemu-common.h  | 24 
 include/qemu/timer.h   |  1 +
 include/qom/cpu.h  |  9 +
 include/sysemu/cpus.h  | 13 +
 stubs/cpu-get-icount.c |  1 +
 translate-common.c |  1 +
 vl.c   |  1 +
 7 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/include/qemu-common.h b/include/qemu-common.h
index 163bcbb..f0d74076 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -23,17 +23,6 @@
 #include "qemu/option.h"
 #include "qemu/host-utils.h"
 
-void cpu_ticks_init(void);
-
-/* icount */
-void configure_icount(QemuOpts *opts, Error **errp);
-extern int use_icount;
-extern int icount_align_option;
-/* drift information for info jit command */
-extern int64_t max_delay;
-extern int64_t max_advance;
-void dump_drift_info(FILE *f, fprintf_function cpu_fprintf);
-
 #include "qemu/bswap.h"
 
 /* FIXME: Remove NEED_CPU_H.  */
@@ -100,19 +89,6 @@ bool tcg_enabled(void);
 
 void cpu_exec_init_all(void);
 
-/* Unblock cpu */
-void qemu_cpu_kick_self(void);
-
-/* work queue */
-struct qemu_work_item {
-struct qemu_work_item *next;
-void (*func)(void *data);
-void *data;
-int done;
-bool free;
-};
-
-
 /**
  * Sends a (part of) iovec down a socket, yielding when the socket is full, or
  * Receives data into a (part of) iovec from a socket,
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index 471969a..309f3d0 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -4,6 +4,7 @@
 #include "qemu-common.h"
 #include "qemu/notify.h"
 #include "qemu/host-utils.h"
+#include "sysemu/cpus.h"
 
 #define NANOSECONDS_PER_SECOND 10LL
 
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index b7a10f7..ab38ce1 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -222,6 +222,15 @@ struct kvm_run;
 #define TB_JMP_CACHE_BITS 12
 #define TB_JMP_CACHE_SIZE (1 << TB_JMP_CACHE_BITS)
 
+/* work queue */
+struct qemu_work_item {
+struct qemu_work_item *next;
+void (*func)(void *data);
+void *data;
+int done;
+bool free;
+};
+
 /**
  * CPUState:
  * @cpu_index: CPU index (informative).
diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index 3d1e5ba..fe992a8 100644
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -7,6 +7,19 @@ void qemu_init_cpu_loop(void);
 void resume_all_vcpus(void);
 void pause_all_vcpus(void);
 void cpu_stop_current(void);
+void cpu_ticks_init(void);
+
+void configure_icount(QemuOpts *opts, Error **errp);
+extern int use_icount;
+extern int icount_align_option;
+
+/* drift information for info jit command */
+extern int64_t max_delay;
+extern int64_t max_advance;
+void dump_drift_info(FILE *f, fprintf_function cpu_fprintf);
+
+/* Unblock cpu */
+void qemu_cpu_kick_self(void);
 
 void cpu_synchronize_all_states(void);
 void cpu_synchronize_all_post_reset(void);
diff --git a/stubs/cpu-get-icount.c b/stubs/cpu-get-icount.c
index 3a6f2ab..2e8b63b 100644
--- a/stubs/cpu-get-icount.c
+++ b/stubs/cpu-get-icount.c
@@ -1,6 +1,7 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/timer.h"
+#include "sysemu/cpus.h"
 
 int use_icount;
 
diff --git a/translate-common.c b/translate-common.c
index ffbfe85..5e989cd 100644
--- a/translate-common.c
+++ b/translate-common.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qom/cpu.h"
+#include "sysemu/cpus.h"
 
 uintptr_t qemu_real_host_page_size;
 intptr_t qemu_real_host_page_mask;
diff --git a/vl.c b/vl.c
index 3629336..b83d275 100644
--- a/vl.c
+++ b/vl.c
@@ -87,6 +87,7 @@ int main(int argc, char **argv)
 #include "sysemu/dma.h"
 #include "audio/audio.h"
 #include "migration/migration.h"
+#include "sysemu/cpus.h"
 #include "sysemu/kvm.h"
 #include "qapi/qmp/qjson.h"
 #include "qemu/option.h"
-- 
1.8.3.1





[Qemu-devel] [PATCH 04/50] cpu: make cpu-qom.h only include-able from cpu.h

2016-04-08 Thread Paolo Bonzini
Make cpu-qom.h so that it is only included from cpu.h.  Then there
is no need for it to include cpu.h again.

Later we will make cpu-qom.h target independent and we will _want_
to include it from elsewhere, but for now reduce the number of cases
to handle.

Signed-off-by: Paolo Bonzini 
---
 target-alpha/cpu-qom.h | 1 -
 target-arm/psci.c  | 1 -
 target-i386/cpu-qom.h  | 1 -
 target-lm32/cpu-qom.h  | 1 -
 target-ppc/cpu-qom.h   | 1 -
 target-s390x/cpu-qom.h | 1 -
 target-sparc/cpu-qom.h | 1 -
 target-unicore32/cpu-qom.h | 1 -
 target-xtensa/cpu-qom.h| 1 -
 9 files changed, 9 deletions(-)

diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index b01c6c8..cf5264a 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -21,7 +21,6 @@
 #define QEMU_ALPHA_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 
 #define TYPE_ALPHA_CPU "alpha-cpu"
 
diff --git a/target-arm/psci.c b/target-arm/psci.c
index c55487f..2b624b9 100644
--- a/target-arm/psci.c
+++ b/target-arm/psci.c
@@ -17,7 +17,6 @@
  */
 #include "qemu/osdep.h"
 #include 
-#include 
 #include 
 #include 
 #include 
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index cb75017..2ca7b9e 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -21,7 +21,6 @@
 #define QEMU_I386_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 #include "qemu/notify.h"
 
 #ifdef TARGET_X86_64
diff --git a/target-lm32/cpu-qom.h b/target-lm32/cpu-qom.h
index 77bc7b2..54989e4 100644
--- a/target-lm32/cpu-qom.h
+++ b/target-lm32/cpu-qom.h
@@ -21,7 +21,6 @@
 #define QEMU_LM32_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 
 #define TYPE_LM32_CPU "lm32-cpu"
 
diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index 7d5e2b3..eb822a3 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -21,7 +21,6 @@
 #define QEMU_PPC_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 
 #ifdef TARGET_PPC64
 #define TYPE_POWERPC_CPU "powerpc64-cpu"
diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index 1c90933..681e370 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -21,7 +21,6 @@
 #define QEMU_S390_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 
 #define TYPE_S390_CPU "s390-cpu"
 
diff --git a/target-sparc/cpu-qom.h b/target-sparc/cpu-qom.h
index 5096b10..174dfd3 100644
--- a/target-sparc/cpu-qom.h
+++ b/target-sparc/cpu-qom.h
@@ -21,7 +21,6 @@
 #define QEMU_SPARC_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 
 #ifdef TARGET_SPARC64
 #define TYPE_SPARC_CPU "sparc64-cpu"
diff --git a/target-unicore32/cpu-qom.h b/target-unicore32/cpu-qom.h
index ea65b83..e554f1f 100644
--- a/target-unicore32/cpu-qom.h
+++ b/target-unicore32/cpu-qom.h
@@ -12,7 +12,6 @@
 #define QEMU_UC32_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 
 #define TYPE_UNICORE32_CPU "unicore32-cpu"
 
diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index 2258224..f5d9b9f 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -30,7 +30,6 @@
 #define QEMU_XTENSA_CPU_QOM_H
 
 #include "qom/cpu.h"
-#include "cpu.h"
 
 #define TYPE_XTENSA_CPU "xtensa-cpu"
 
-- 
1.8.3.1





[Qemu-devel] [PATCH 06/50] target-arm: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make ARMCPU an opaque type within cpu-qom.h, and move all definitions of
private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-arm/cpu-qom.h | 178 +-
 target-arm/cpu.h | 179 ++-
 2 files changed, 179 insertions(+), 178 deletions(-)

diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 1061c08..3991173 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -22,6 +22,8 @@
 
 #include "qom/cpu.h"
 
+struct arm_boot_info;
+
 #define TYPE_ARM_CPU "arm-cpu"
 
 #define ARM_CPU_CLASS(klass) \
@@ -47,145 +49,7 @@ typedef struct ARMCPUClass {
 void (*parent_reset)(CPUState *cpu);
 } ARMCPUClass;
 
-/**
- * ARMCPU:
- * @env: #CPUARMState
- *
- * An ARM CPU core.
- */
-typedef struct ARMCPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPUARMState env;
-
-/* Coprocessor information */
-GHashTable *cp_regs;
-/* For marshalling (mostly coprocessor) register state between the
- * kernel and QEMU (for KVM) and between two QEMUs (for migration),
- * we use these arrays.
- */
-/* List of register indexes managed via these arrays; (full KVM style
- * 64 bit indexes, not CPRegInfo 32 bit indexes)
- */
-uint64_t *cpreg_indexes;
-/* Values of the registers (cpreg_indexes[i]'s value is cpreg_values[i]) */
-uint64_t *cpreg_values;
-/* Length of the indexes, values, reset_values arrays */
-int32_t cpreg_array_len;
-/* These are used only for migration: incoming data arrives in
- * these fields and is sanity checked in post_load before copying
- * to the working data structures above.
- */
-uint64_t *cpreg_vmstate_indexes;
-uint64_t *cpreg_vmstate_values;
-int32_t cpreg_vmstate_array_len;
-
-/* Timers used by the generic (architected) timer */
-QEMUTimer *gt_timer[NUM_GTIMERS];
-/* GPIO outputs for generic timer */
-qemu_irq gt_timer_outputs[NUM_GTIMERS];
-
-/* MemoryRegion to use for secure physical accesses */
-MemoryRegion *secure_memory;
-
-/* 'compatible' string for this CPU for Linux device trees */
-const char *dtb_compatible;
-
-/* PSCI version for this CPU
- * Bits[31:16] = Major Version
- * Bits[15:0] = Minor Version
- */
-uint32_t psci_version;
-
-/* Should CPU start in PSCI powered-off state? */
-bool start_powered_off;
-/* CPU currently in PSCI powered-off state */
-bool powered_off;
-/* CPU has security extension */
-bool has_el3;
-
-/* CPU has memory protection unit */
-bool has_mpu;
-/* PMSAv7 MPU number of supported regions */
-uint32_t pmsav7_dregion;
-
-/* PSCI conduit used to invoke PSCI methods
- * 0 - disabled, 1 - smc, 2 - hvc
- */
-uint32_t psci_conduit;
-
-/* [QEMU_]KVM_ARM_TARGET_* constant for this CPU, or
- * QEMU_KVM_ARM_TARGET_NONE if the kernel doesn't support this CPU type.
- */
-uint32_t kvm_target;
-
-/* KVM init features for this CPU */
-uint32_t kvm_init_features[7];
-
-/* Uniprocessor system with MP extensions */
-bool mp_is_up;
-
-/* The instance init functions for implementation-specific subclasses
- * set these fields to specify the implementation-dependent values of
- * various constant registers and reset values of non-constant
- * registers.
- * Some of these might become QOM properties eventually.
- * Field names match the official register names as defined in the
- * ARMv7AR ARM Architecture Reference Manual. A reset_ prefix
- * is used for reset values of non-constant registers; no reset_
- * prefix means a constant register.
- */
-uint32_t midr;
-uint32_t revidr;
-uint32_t reset_fpsid;
-uint32_t mvfr0;
-uint32_t mvfr1;
-uint32_t mvfr2;
-uint32_t ctr;
-uint32_t reset_sctlr;
-uint32_t id_pfr0;
-uint32_t id_pfr1;
-uint32_t id_dfr0;
-uint32_t pmceid0;
-uint32_t pmceid1;
-uint32_t id_afr0;
-uint32_t id_mmfr0;
-uint32_t id_mmfr1;
-uint32_t id_mmfr2;
-uint32_t id_mmfr3;
-uint32_t id_mmfr4;
-uint32_t id_isar0;
-uint32_t id_isar1;
-uint32_t id_isar2;
-uint32_t id_isar3;
-uint32_t id_isar4;
-uint32_t id_isar5;
-uint64_t id_aa64pfr0;
-uint64_t id_aa64pfr1;
-uint64_t id_aa64dfr0;
-uint64_t id_aa64dfr1;
-uint64_t id_aa64afr0;
-uint64_t id_aa64afr1;
-uint64_t id_aa64isar0;
-uint64_t id_aa64isar1;
-uint64_t id_aa64mmfr0;
-uint64_t id_aa64mmfr1;
-uint32_t dbgdidr;
-uint32_t clidr;
-uint64_t mp_affinity; /* MP ID without feature bits */
-/* The elements of this array are the CCSIDR values for each cache,
- * in the order L1DCache, L1ICache, L2DCache, L2ICac

[Qemu-devel] [PATCH 03/50] log: do not use CONFIG_USER_ONLY

2016-04-08 Thread Paolo Bonzini
This decouples logging further from config-target.h

Signed-off-by: Paolo Bonzini 
---
 bsd-user/main.c|  1 +
 include/qemu/log.h | 17 ++---
 linux-user/main.c  |  1 +
 util/log.c | 12 ++--
 4 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 27854c1..058eaca 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -849,6 +849,7 @@ int main(int argc, char **argv)
 }
 
 /* init debug */
+qemu_log_needs_buffers();
 qemu_set_log_filename(log_file);
 if (log_mask) {
 int mask;
diff --git a/include/qemu/log.h b/include/qemu/log.h
index c52f136..234fa81 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -104,21 +104,8 @@ typedef struct QEMULogItem {
 
 extern const QEMULogItem qemu_log_items[];
 
-/* This is the function that actually does the work of
- * changing the log level; it should only be accessed via
- * the qemu_set_log() wrapper.
- */
-void do_qemu_set_log(int log_flags, bool use_own_buffers);
-
-static inline void qemu_set_log(int log_flags)
-{
-#ifdef CONFIG_USER_ONLY
-do_qemu_set_log(log_flags, true);
-#else
-do_qemu_set_log(log_flags, false);
-#endif
-}
-
+void qemu_set_log(int log_flags);
+void qemu_log_needs_buffers(void);
 void qemu_set_log_filename(const char *filename);
 void qemu_set_dfilter_ranges(const char *ranges);
 bool qemu_log_in_addr_range(uint64_t addr);
diff --git a/linux-user/main.c b/linux-user/main.c
index 5f3ec97..2b7fa9c 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3760,6 +3760,7 @@ static void handle_arg_log(const char *arg)
 qemu_print_log_usage(stdout);
 exit(EXIT_FAILURE);
 }
+qemu_log_needs_buffers();
 qemu_set_log(mask);
 }
 
diff --git a/util/log.c b/util/log.c
index 1857730..5ad72c1 100644
--- a/util/log.c
+++ b/util/log.c
@@ -42,8 +42,10 @@ void qemu_log(const char *fmt, ...)
 va_end(ap);
 }
 
+static bool log_uses_own_buffers;
+
 /* enable or disable low levels log */
-void do_qemu_set_log(int log_flags, bool use_own_buffers)
+void qemu_set_log(int log_flags)
 {
 qemu_loglevel = log_flags;
 #ifdef CONFIG_TRACE_LOG
@@ -70,7 +72,7 @@ void do_qemu_set_log(int log_flags, bool use_own_buffers)
 qemu_logfile = stderr;
 }
 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
-if (use_own_buffers) {
+if (log_uses_own_buffers) {
 static char logfile_buf[4096];
 
 setvbuf(qemu_logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
@@ -89,6 +91,12 @@ void do_qemu_set_log(int log_flags, bool use_own_buffers)
 qemu_log_close();
 }
 }
+
+void qemu_log_needs_buffers(void)
+{
+log_uses_own_buffers = true;
+}
+
 /*
  * Allow the user to include %d in their logfile which will be
  * substituted with the current PID. This is useful for debugging many
-- 
1.8.3.1





[Qemu-devel] [PATCH for-2.7 00/49] NEED_CPU_H / cpu.h / hw/hw.h cleanups

2016-04-08 Thread Paolo Bonzini
(CCs only on cover letter due to huge series).

I am sending this now because of vacation coming soon (yay!).
This series removes usage of NEED_CPU_H from several central
include files in QEMU, most notably hw/hw.h and qemu-common.h.
Definitions conditional on NEED_CPU_H remain only in disas/disas.h,
exec/gdbstub.h, exec/helper-head.h and exec/log.h.

The interesting patches are interspersed with other miscellaenous
cleanups that I won't really dwell on in the cover letter.  Most
of them are just making indirect inclusions explicit.

Patches 5 to 27 make sure that target-independent code can access
QOM objects for the CPU through an opaque type.  This is useful
because often target-independent code uses a target-specific header
file that happens to use pointers to ARMCPU* or similar.  The
target-independent code itself does not use the pointed-to object,
but the very presenece of the ARMCPU* name means that all users of
that header have to bring in cpu.h.  By providing the opaque type,
a much smaller API can be exposed to all these users in hw/.

Patches 34 to 37 remove NEED_CPU_H from hw/hw.h, exec/memory.h
and exec/cpu-common.h.

Patches 38 and 39 remove two nested inclusions from qemu-common.h.
This should make Markus's patch to remove unnecessary qemu-common.h
inclusions even more effective.

Patches 42 and 43 disentangle qemu-common.h and cpu.h, so that all
users of the latter have to be explicit.  This has the biggest
effect on reducing include pollution (the next offender is now
exec/cpu-common.h).

Patches 46 to 50 remove more nested inclusions, and especially:
1) the inclusion of the (TCG-specific) exec-all.h header from
cpu.h, so that non-TCG functions cannot anymore creep into
exec-all.h; 2) indirect qemu-common.h inclusion in hw/hw.h.

At the end, hw/hw.h includes 13 fewer headers indirectly compared
to before when NEED_CPU_H is not defined, and 27 fewer headers
when NEED_CPU_H is defined.  This was found with the script of
patch 1, which produces the following statistics:

Compiled 3979 files | After: 4006 (nmi.o now built per 
target)
3773 files include qemu-common.h| After: 3702 (-71)
1658 files include hw/hw.h  | After: 1589 (-69)
3101 files include cpu.h| After: 2337 (-764, -25%!)
3800 files include qapi-types.h | After: 3811 (+11, mostly from 
nmi.c)
 844 files include generated-tracers.h  | After: 844
1270 files include qapi/error.h | After: 1297 (+27, from nmi.c)
1996 files include block/aio.h  | After: 1647 (-349, -18%)
3544 files include qom/object.h | After: 3514 (-30)
3451 files include exec/memory.h| After: 3540 (+89, from indirect 
inclusions)
3840 files include fpu/softfloat.h  | After: 3701 (-139)
3783 files include qemu/bswap.h | After: 3644 (-139)
|
osdep.h:| After: (adds exec/poison.h)
linesbytes   files   source | linesbytes   files   source
174  49443   QEMU   | 226  52174   QEMU
17460440677  157 total  | 17512440950  158 total
|
qemu-common.h:  | After:
linesbytes   files   source | linesbytes   files   source
7037 160007  14  QEMU   | 5919 132798  12  QEMU
24323595740  168 total  | 23205568531  166 total
|
hw/hw.h:| After:
linesbytes   files   source | linesbytes   files   source
9714 228659  36  QEMU   | 8458 201740  24  QEMU
27052665298  192 total  | 25796638379  180 total
|
target-i386/cpu.h:  | After:
linesbytes   files   source | linesbytes   files   source
11259270041  41  QEMU   | 10981263615  39  QEMU
28597706680  197 total  | 28319700254  195 total
|
hw/hw.h + NEED_CPU_H:   | After:
linesbytes   files   source | linesbytes   files   source
12340294661  50  QEMU   | 8407 201467  23  QEMU
29678731300  206 total  | 25745638106  179 total

The next objectives should be removing unnecessary inclusions from/of
qemu-common.h (or delete it altogether) and exec/cpu-common.h.

Paolo

Paolo Bonzini (50):
  scripts: add script to build QEMU and analyze inclusions
  include: move CPU-related definitions out of qemu-common.h
  log: do not use CONFIG_USER_ONLY
  cpu: make cpu-qom.h only include-able from cpu.h
  target-alpha: make cpu-qom.h not target specific
  target-arm: make cpu-qom.

[Qemu-devel] [PATCH 09/50] target-lm32: make cpu-qom.h not target specific

2016-04-08 Thread Paolo Bonzini
Make LM32CPU an opaque type within cpu-qom.h, and move all definitions of
private methods, as well as all type definitions that require knowledge
of the layout to cpu.h.  This helps making files independent of NEED_CPU_H
if they only need to pass around CPU pointers.

Signed-off-by: Paolo Bonzini 
---
 target-lm32/cpu-qom.h | 41 +
 target-lm32/cpu.h | 44 ++--
 2 files changed, 43 insertions(+), 42 deletions(-)

diff --git a/target-lm32/cpu-qom.h b/target-lm32/cpu-qom.h
index 54989e4..b423d25 100644
--- a/target-lm32/cpu-qom.h
+++ b/target-lm32/cpu-qom.h
@@ -47,45 +47,6 @@ typedef struct LM32CPUClass {
 void (*parent_reset)(CPUState *cpu);
 } LM32CPUClass;
 
-/**
- * LM32CPU:
- * @env: #CPULM32State
- *
- * A LatticeMico32 CPU.
- */
-typedef struct LM32CPU {
-/*< private >*/
-CPUState parent_obj;
-/*< public >*/
-
-CPULM32State env;
-
-uint32_t revision;
-uint8_t num_interrupts;
-uint8_t num_breakpoints;
-uint8_t num_watchpoints;
-uint32_t features;
-} LM32CPU;
-
-static inline LM32CPU *lm32_env_get_cpu(CPULM32State *env)
-{
-return container_of(env, LM32CPU, env);
-}
-
-#define ENV_GET_CPU(e) CPU(lm32_env_get_cpu(e))
-
-#define ENV_OFFSET offsetof(LM32CPU, env)
-
-#ifndef CONFIG_USER_ONLY
-extern const struct VMStateDescription vmstate_lm32_cpu;
-#endif
-
-void lm32_cpu_do_interrupt(CPUState *cpu);
-bool lm32_cpu_exec_interrupt(CPUState *cs, int int_req);
-void lm32_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
- int flags);
-hwaddr lm32_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-int lm32_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
-int lm32_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+typedef struct LM32CPU LM32CPU;
 
 #endif
diff --git a/target-lm32/cpu.h b/target-lm32/cpu.h
index f220fc0..22ffa68 100644
--- a/target-lm32/cpu.h
+++ b/target-lm32/cpu.h
@@ -25,6 +25,7 @@
 #define CPUArchState struct CPULM32State
 
 #include "qemu-common.h"
+#include "cpu-qom.h"
 #include "exec/cpu-defs.h"
 struct CPULM32State;
 typedef struct CPULM32State CPULM32State;
@@ -180,6 +181,47 @@ struct CPULM32State {
 
 };
 
+/**
+ * LM32CPU:
+ * @env: #CPULM32State
+ *
+ * A LatticeMico32 CPU.
+ */
+struct LM32CPU {
+/*< private >*/
+CPUState parent_obj;
+/*< public >*/
+
+CPULM32State env;
+
+uint32_t revision;
+uint8_t num_interrupts;
+uint8_t num_breakpoints;
+uint8_t num_watchpoints;
+uint32_t features;
+};
+
+static inline LM32CPU *lm32_env_get_cpu(CPULM32State *env)
+{
+return container_of(env, LM32CPU, env);
+}
+
+#define ENV_GET_CPU(e) CPU(lm32_env_get_cpu(e))
+
+#define ENV_OFFSET offsetof(LM32CPU, env)
+
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_lm32_cpu;
+#endif
+
+void lm32_cpu_do_interrupt(CPUState *cpu);
+bool lm32_cpu_exec_interrupt(CPUState *cs, int int_req);
+void lm32_cpu_dump_state(CPUState *cpu, FILE *f, fprintf_function cpu_fprintf,
+ int flags);
+hwaddr lm32_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+int lm32_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+int lm32_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+
 typedef enum {
 LM32_WP_DISABLED = 0,
 LM32_WP_READ,
@@ -193,8 +235,6 @@ static inline lm32_wp_t lm32_wp_type(uint32_t dc, int idx)
 return (dc >> (idx+1)*2) & 0x3;
 }
 
-#include "cpu-qom.h"
-
 LM32CPU *cpu_lm32_init(const char *cpu_model);
 int cpu_lm32_exec(CPUState *cpu);
 /* you can call this signal handler from your SIGBUS and SIGSEGV
-- 
1.8.3.1





[Qemu-devel] [PATCH 01/50] scripts: add script to build QEMU and analyze inclusions

2016-04-08 Thread Paolo Bonzini
Signed-off-by: Paolo Bonzini 
---
 scripts/analyze-inclusions | 89 ++
 1 file changed, 89 insertions(+)
 create mode 100644 scripts/analyze-inclusions

diff --git a/scripts/analyze-inclusions b/scripts/analyze-inclusions
new file mode 100644
index 000..e241bd4
--- /dev/null
+++ b/scripts/analyze-inclusions
@@ -0,0 +1,89 @@
+#! /bin/sh
+#
+# Copyright (C) 2016 Red Hat, Inc.
+#
+# Author: Paolo Bonzini 
+#
+# Print statistics about header file inclusions.
+# The script configures and builds QEMU itself in a "+build"
+# subdirectory which is left around when the script exits.
+# To run the statistics on a pre-existing "+build" directory,
+# pass "--no-build" as the first argument on the command line.
+# Any other command line is passed directly to "make" (so
+# you can for example pass a "-j" argument suitable for your
+# system).
+#
+# Inspired by a post by Markus Armbruster.
+
+mkdir -p +build
+cd +build
+if test "x$1" != "x--no-build"; then
+  test -f Makefile && make distclean
+  ../configure
+  make "$@"
+fi
+
+QEMU_CFLAGS=$(sed -n s/^QEMU_CFLAGS=//p config-host.mak)
+QEMU_INCLUDES=$(sed -n s/^QEMU_INCLUDES=//p config-host.mak | \
+sed 's/$(SRC_PATH)/../g' )
+CFLAGS=$(sed -n s/^CFLAGS=//p config-host.mak)
+
+grep_include() {
+  find . -name "*.d" | xargs grep -l "$@" | wc -l
+}
+
+echo Found $(find . -name "*.d" | wc -l) object files
+echo $(grep_include -F 'include/qemu-common.h') files include qemu-common.h
+echo $(grep_include -F 'hw/hw.h') files include hw/hw.h
+echo $(grep_include 'target-[a-z0-9]*/cpu\.h') files include cpu.h
+echo $(grep_include -F 'qapi-types.h') files include qapi-types.h
+echo $(grep_include -F 'trace/generated-tracers.h') files include 
generated-tracers.h
+echo $(grep_include -F 'qapi/error.h') files include qapi/error.h
+echo $(grep_include -F 'qom/object.h') files include qom/object.h
+echo $(grep_include -F 'block/aio.h') files include block/aio.h
+echo $(grep_include -F 'exec/memory.h') files include exec/memory.h
+echo $(grep_include -F 'fpu/softfloat.h') files include fpu/softfloat.h
+echo $(grep_include -F 'qemu/bswap.h') files include qemu/bswap.h
+echo
+
+awk1='
+/^# / { file = $3;next }
+NR>1 { bytes[file]+=length; lines[file]++ }
+END { for(i in lines) print i,lines[i],bytes[i] }'
+
+awk2='
+{tot_l+=$2;tot_b+=$3;tot_f++}
+/\/usr.*\/glib/ {glib_l+=$2;glib_b+=$3;glib_f++;next}
+/\/usr/ {sys_l+=$2;sys_b+=$3;sys_f++;next}
+{qemu_l+=$2;qemu_b+=$3;qemu_f++;next}
+END {
+  printf "%s\t %s\t %s\t %s\n", "lines", "bytes", "files", "source"
+  printf "%s\t %s\t %s\t %s\n", qemu_l, qemu_b, qemu_f, "QEMU"
+  printf "%s\t %s\t %s\t %s\n", sys_l, sys_b, sys_f, "system"
+  printf "%s\t %s\t %s\t %s\n", glib_l, glib_b, glib_f, "glib"
+  printf "%s\t %s\t %s\t %s\n", tot_l, tot_b, tot_f, "total"
+}'
+
+analyze() {
+  cc $QEMU_CFLAGS $QEMU_INCLUDES $CFLAGS  -E -o - "$@" | \
+awk "$awk1" | awk "$awk2"
+  echo
+}
+
+echo osdep.h:
+analyze ../include/qemu/osdep.h
+
+echo qemu-common.h:
+analyze  -include ../include/qemu/osdep.h ../include/qemu-common.h
+
+echo hw/hw.h:
+analyze -include ../include/qemu/osdep.h ../include/hw/hw.h
+
+echo trace/generated-tracers.h:
+analyze -include ../include/qemu/osdep.h trace/generated-tracers.h
+
+echo target-i386/cpu.h:
+analyze -DNEED_CPU_H -I../target-i386 -Ii386-softmmu -include 
../include/qemu/osdep.h ../target-i386/cpu.h
+
+echo hw/hw.h + NEED_CPU_H:
+analyze -DNEED_CPU_H -I../target-i386 -Ii386-softmmu -include 
../include/qemu/osdep.h ../include/hw/hw.h
-- 
1.8.3.1





Re: [Qemu-devel] [PULL v2 00/40] ivshmem: Fixes, cleanups, device model split

2016-04-08 Thread Markus Armbruster
I updated http://qemu-project.org/ChangeLog/2.6.



[Qemu-devel] [Bug 1568107] [NEW] setup_rt_frame: not implemented

2016-04-08 Thread PeteVine
Public bug reported:

Trying to run this binary
(https://github.com/ethcore/parity/releases/download/v1.0.1/parity_linux_1.0.1-0_amd64.deb)
under qemu-x86_64 on ARM, ends like this:

$ qemu-x86_64 parity --pruning fast

setup_rt_frame: not implemented
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1568107

Title:
  setup_rt_frame: not implemented

Status in QEMU:
  New

Bug description:
  Trying to run this binary
  
(https://github.com/ethcore/parity/releases/download/v1.0.1/parity_linux_1.0.1-0_amd64.deb)
  under qemu-x86_64 on ARM, ends like this:

  $ qemu-x86_64 parity --pruning fast

  setup_rt_frame: not implemented
  qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  Segmentation fault

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1568107/+subscriptions



Re: [Qemu-devel] [PATCH v2 10/13] tb hash: hash phys_pc, pc, and flags with xxhash

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> For some workloads such as arm bootup, tb_phys_hash is performance-critical.
> The is due to the high frequency of accesses to the hash table, originated
> by (frequent) TLB flushes that wipe out the cpu-private tb_jmp_cache's.
> More info:
>   https://lists.nongnu.org/archive/html/qemu-devel/2016-03/msg05098.html
> 
> To dig further into this I modified an arm image booting debian jessie to
> immediately shut down after boot. Analysis revealed that quite a bit of time
> is unnecessarily spent in tb_phys_hash: the cause is poor hashing that
> results in very uneven loading of chains in the hash table's buckets;
> the longest observed chain had ~550 elements.
> 
> The appended addresses this with two changes:
> 
> 1) Use xxhash as the hash table's hash function. xxhash is a fast,
>high-quality hashing function.
> 
> 2) Feed the hashing function with not just tb_phys, but also pc and flags.

Reviewed-by: Richard Henderson 


r~



Re: [Qemu-devel] [PATCH v2 09/13] exec: add tb_hash_func5, derived from xxhash

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> +#include 

Should already be done by 

> +/*
> + * Note : although _rotl exists for minGW (GCC under windows), performance
> + * seems poor.
> + */
> +#if defined(_MSC_VER)
> +#  define XXH_rotl32(x, r) _rotl(x, r)
> +#else
> +#  define XXH_rotl32(x, r) ((x << r) | (x >> (32 - r)))
> +#endif

Please use rol32 from 

> +static inline
> +uint32_t tb_hash_func5(uint64_t a0, uint64_t b0, uint32_t e, int seed)
> +{

Is there really any point in passing in "seed" anymore?
We certainly don't want different values passed in...


r~



Re: [Qemu-devel] [PATCH v2 08/13] qemu-thread: optimize spin_lock for uncontended locks

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
>  static inline void qemu_spin_lock(QemuSpin *spin)
>  {
> -do {
> +while (atomic_xchg(&spin->value, true)) {
>  while (atomic_read(&spin->value)) {
>  cpu_relax();
>  }
> -} while (atomic_xchg(&spin->value, true));
> +}
>  }

And merge this one as well, please.  It's a good improvement, but there's
little point to keeping these separate.


r~



Re: [Qemu-devel] [PATCH v2 07/13] qemu-thread: call cpu_relax() while spinning

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
>  do {
> -while (atomic_read(&spin->value));
> +while (atomic_read(&spin->value)) {
> +cpu_relax();
> +}

Please just merge this with the previous patch.


r~



Re: [Qemu-devel] [PATCH v2 06/13] qemu-thread: add simple test-and-set spinlock

2016-04-08 Thread Richard Henderson
On 04/08/2016 06:02 AM, Alex Bennée wrote:
>> > +typedef struct QemuSpin {
>> > +int value;
> If we are throwing true and false around as the only two values can we
> use bool here and be consistent when setting/clearing.
> 

Except that quite a lot of hosts can only (efficiently) do atomic operations on
a minimum of 4 byte quantities.  I'd rather continue to use int here.


r~



Re: [Qemu-devel] [PATCH v2 06/13] qemu-thread: add simple test-and-set spinlock

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> +while (atomic_read(&spin->value));

I really really don't like ; snuggled up behind loop conditions.
Isn't this where you want to use pause, anyway?


r~



Re: [Qemu-devel] [PATCH v2 05/13] include/processor.h: define cpu_relax()

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> Taken from the linux kernel.
> 
> Signed-off-by: Emilio G. Cota 
> ---
>  include/qemu/processor.h | 28 
>  1 file changed, 28 insertions(+)
>  create mode 100644 include/qemu/processor.h

Reviewed-by: Richard Henderson  


> +#if defined(__i386__) || defined(__x86_64__)
> +#define cpu_relax() asm volatile("rep; nop" ::: "memory")
> +#endif

Not that it matters much, but for the record there's an ICC inspired builtin in
 for this: _mm_pause().  But so long as we're always using gcc or
clang, that's probably just an extra dependency to worry about.


r~



Re: [Qemu-devel] [PATCH v2 04/13] seqlock: rename write_lock/unlock to write_begin/end

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> It is a more appropriate name, now that the mutex embedded
> in the seqlock is gone.
> 
> Reviewed-by: Alex Bennée 
> Signed-off-by: Emilio G. Cota 
> ---
>  cpus.c | 28 ++--
>  include/qemu/seqlock.h |  4 ++--
>  2 files changed, 16 insertions(+), 16 deletions(-)


Reviewed-by: Richard Henderson 


r~



Re: [Qemu-devel] [PATCH v2 03/13] seqlock: remove optional mutex

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> This option is unused; besides, it bloats the struct when not needed.
> Let's just let writers define their own locks elsewhere.
> 
> Reviewed-by: Alex Bennée 
> Signed-off-by: Emilio G. Cota 
> ---
>  cpus.c |  2 +-
>  include/qemu/seqlock.h | 10 +-
>  2 files changed, 2 insertions(+), 10 deletions(-)


Reviewed-by: Richard Henderson 


r~



Re: [Qemu-devel] [PATCH v2 02/13] compiler.h: add QEMU_ALIGNED() to enforce struct alignment

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> Signed-off-by: Emilio G. Cota 
> ---
>  include/qemu/compiler.h | 2 ++
>  1 file changed, 2 insertions(+)


Reviewed-by: Richard Henderson 


r~



Re: [Qemu-devel] [PATCH v2 01/13] translate-all: add missing fold of tb_ctx into tcg_ctx

2016-04-08 Thread Richard Henderson
On 04/07/2016 10:32 AM, Emilio G. Cota wrote:
> Since 5e5f07e08 "TCG: Move translation block variables
> to new context inside tcg_ctx: tb_ctx" on Feb 1 2013, compilation
> of usermode + TB_DEBUG_CHECK has been broken. Fix it.
> 
> Signed-off-by: Emilio G. Cota 
> ---
>  translate-all.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Richard Henderson 


r~



Re: [Qemu-devel] best way to implement emulation of AArch64 tagged addresses

2016-04-08 Thread Peter Maydell
On 8 April 2016 at 18:20, Tom Hanson  wrote:
> On Mon, 2016-04-04 at 10:56 -0700, Richard Henderson wrote:
>> On 04/04/2016 09:31 AM, Peter Maydell wrote:
>> > On 4 April 2016 at 17:28, Richard Henderson  wrote:
>> >> On 04/04/2016 08:51 AM, Peter Maydell wrote:
>> >>> In particular I think if you just do the relevant handling of the tag
>> >>> bits in target-arm's get_phys_addr() and its subroutines then this
>> >>> should work ok, with the exceptions that:
>> >>>* the QEMU TLB code will think that [tag A + address X] and
>> >>>  [tag B + address X] are different virtual addresses and they will
>> >>>  miss each other in the TLB
>> >>
>> >>
>> >> Yep.  Not only miss, but actively contend with each other.
>> >
>> > Yes. Can we avoid that, or do we just have to live with it? I guess
>> > if the TCG fast path is doing a compare on full insn+tag then we
>> > pretty much have to live with it.
>>
>> We have to live with it.  Implementing a more complex hashing algorithm in 
>> the
>> fast path is probably a non-starter.
>>
>> Hopefully if one is using multiple tags, they'll still be in the victim cache
>> and so you won't have to fall back to the full tlb lookup.

> It seems like the "best" solution would be to mask the tag in the TLB
> and it feels like it should be possible.  BUT I need to dig into the
> code more.
>
> Is it an option to mask off the tag bits in all cases? Is there any case
> it which those bits are valid address bits?

The problem, as Richard says, is that our fast path for guest
loads/stores is a bit of inline assembly that basically fishes
the right entry out of the TLB and compares it against the
input address (ie whatever the guest address to the load is
including the tag). A comparison match means we take the fast
path and do an inline access to the backing guest RAM. A mismatch
means we take the slow path (for TLB misses, IO devices, and
various other cases). Since the guest address that the fast
path sees includes the tag bits, if the TLB entry doesn't
include the tag bits then we'd need to do an extra mask operation
in the fast path, which is (a) not good for performance and
(b) would require modifying nine different TCG backends.

For a rarely used feature this is much too much effort (and
it slows down all the code that doesn't use tags for an
uncertain benefit to the code that does use them).

(If you're curious about the inline assembly, it's generated
by functions like tlb_out_tlb_load() in
tcg/i386/tcg-target.inc.c for the x86 backend; similarly for
the various other backends.)

thanks
-- PMM



Re: [Qemu-devel] best way to implement emulation of AArch64 tagged addresses

2016-04-08 Thread Richard Henderson
On 04/08/2016 10:20 AM, Tom Hanson wrote:
> Is it an option to mask off the tag bits in all cases? Is there any case
> it which those bits are valid address bits?

It's not impossible to mask off bits in the address -- we do that for running
32-bit on 64-bit all of the time.  It's all a question of how well the average
program will perform, I suppose.

For instance.  Are there more tagged addresses than non-tagged addresses?  If
we mask off bits, that will affect *every* memory operation.  If tagged
addresses are rare, then that is a waste.  If tagged addresses are common,
however, then we may well spend too much time ping-ponging in the TLB.

The fastest method I can think of to ignore high order bits is to shift the
address comparator left.  The TLB comparator would be stored pre-shifted, so
this would add only one insn on the fast path.  Or perhaps zero in the case of
an arm/aarch64 host, where the compare insn itself can perform the shift.

Of course, a double-word shift would be completely out of the question when
doing 64-bit on 32-bit emulation.  But we don't need that -- just shift the
high part of the address left to discard bits, leaving a funny looking hole in
the middle of the comparator.

This is simple enough that it should be relatively easy to patch up all of the
tcg backends to match, if we decide to go with it.


r~




Re: [Qemu-devel] [PATCH] MAINTAINERS: Block layer core, qcow2 and blkdebug

2016-04-08 Thread Kevin Wolf
Am 08.04.2016 um 19:29 hat Max Reitz geschrieben:
> As agreed with Kevin and already practiced for a while, I am adding
> myself as co-maintainer of the block layer core, qcow2 and blkdebug.
> 
> Signed-off-by: Max Reitz 

Thanks, applied to the block branch.

Kevin



[Qemu-devel] [PATCH] MAINTAINERS: Block layer core, qcow2 and blkdebug

2016-04-08 Thread Max Reitz
As agreed with Kevin and already practiced for a while, I am adding
myself as co-maintainer of the block layer core, qcow2 and blkdebug.

Signed-off-by: Max Reitz 
---
 MAINTAINERS | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 9277fbf..980d8e0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -985,6 +985,7 @@ F: tests/intel-hda-test.c
 
 Block layer core
 M: Kevin Wolf 
+M: Max Reitz 
 L: qemu-bl...@nongnu.org
 S: Supported
 F: block*
@@ -1568,6 +1569,7 @@ F: block/win32-aio.c
 
 qcow2
 M: Kevin Wolf 
+M: Max Reitz 
 L: qemu-bl...@nongnu.org
 S: Supported
 F: block/qcow2*
@@ -1580,6 +1582,7 @@ F: block/qcow.c
 
 blkdebug
 M: Kevin Wolf 
+M: Max Reitz 
 L: qemu-bl...@nongnu.org
 S: Supported
 F: block/blkdebug.c
-- 
2.8.0




Re: [Qemu-devel] best way to implement emulation of AArch64 tagged addresses

2016-04-08 Thread Tom Hanson
On Mon, 2016-04-04 at 10:56 -0700, Richard Henderson wrote:
> On 04/04/2016 09:31 AM, Peter Maydell wrote:
> > On 4 April 2016 at 17:28, Richard Henderson  wrote:
> >> On 04/04/2016 08:51 AM, Peter Maydell wrote:
> >>> In particular I think if you just do the relevant handling of the tag
> >>> bits in target-arm's get_phys_addr() and its subroutines then this
> >>> should work ok, with the exceptions that:
> >>>* the QEMU TLB code will think that [tag A + address X] and
> >>>  [tag B + address X] are different virtual addresses and they will
> >>>  miss each other in the TLB
> >>
> >>
> >> Yep.  Not only miss, but actively contend with each other.
> >
> > Yes. Can we avoid that, or do we just have to live with it? I guess
> > if the TCG fast path is doing a compare on full insn+tag then we
> > pretty much have to live with it.
> 
> We have to live with it.  Implementing a more complex hashing algorithm in 
> the 
> fast path is probably a non-starter.
> 
> Hopefully if one is using multiple tags, they'll still be in the victim cache 
> and so you won't have to fall back to the full tlb lookup.
> 
> 
> r~

It seems like the "best" solution would be to mask the tag in the TLB
and it feels like it should be possible.  BUT I need to dig into the
code more.

Is it an option to mask off the tag bits in all cases? Is there any case
it which those bits are valid address bits?

-TWH




Re: [Qemu-devel] [Qemu-block] [PATCH 0/7] next round of qemu-iotests fixes

2016-04-08 Thread Sascha Silbe
Dear Max,

Max Reitz  writes:

> On 05.04.2016 11:21, Sascha Silbe wrote:
>> With these fixes, qemu-iotests complete successfully on my test
>> systems (s390x, x86_64) when used with QCOW2 or raw image formats.
>> 
>> These are purely bug fixes for tests and most are trivial, so they
>> should be safe even for hard freeze.
>
> Thanks, applied everything except for patch 6 to my block tree:
>
> https://github.com/XanClic/qemu/commits/block

Thanks!

I've cooked up patches for the remaining /tmp usage and documenting the
minimum block speed speed; will send them out next week.

Sascha
-- 
Softwareentwicklung Sascha Silbe, Niederhofenstraße 5/1, 71229 Leonberg
https://se-silbe.de/
USt-IdNr. DE281696641




[Qemu-devel] [PATCH v3 for-2.7 5/8] block: Drop bdrv_new_root()

2016-04-08 Thread Max Reitz
It is unused now, so we may just as well drop it.

Signed-off-by: Max Reitz 
Reviewed-by: Alberto Garcia 
Reviewed-by: Kevin Wolf 
---
 block.c   | 5 -
 include/block/block.h | 1 -
 2 files changed, 6 deletions(-)

diff --git a/block.c b/block.c
index bb029dd..1b2c870 100644
--- a/block.c
+++ b/block.c
@@ -222,11 +222,6 @@ void bdrv_register(BlockDriver *bdrv)
 QLIST_INSERT_HEAD(&bdrv_drivers, bdrv, list);
 }
 
-BlockDriverState *bdrv_new_root(void)
-{
-return bdrv_new();
-}
-
 BlockDriverState *bdrv_new(void)
 {
 BlockDriverState *bs;
diff --git a/include/block/block.h b/include/block/block.h
index 762984e..31fcd07 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -198,7 +198,6 @@ BlockDriver *bdrv_find_format(const char *format_name);
 int bdrv_create(BlockDriver *drv, const char* filename,
 QemuOpts *opts, Error **errp);
 int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp);
-BlockDriverState *bdrv_new_root(void);
 BlockDriverState *bdrv_new(void);
 void bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top);
 void bdrv_replace_in_backing_chain(BlockDriverState *old,
-- 
2.8.0




  1   2   3   >