date:20171121

Signed-off-by: Alexey Kardashevskiy 
---
 hw/vfio/pci.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index c5e168e..06dcf99 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -93,8 +93,6 @@ typedef struct VFIOMSIXInfo {
 uint16_t entries;
 uint32_t table_offset;
 uint32_t pba_offset;
-MemoryRegion mmap_mem;
-void *mmap;
 unsigned long *pending;
 } VFIOMSIXInfo;
 
-- 
2.11.0

[Qemu-devel] [PATCH] x86/cpu: Enable new SSE/AVX/AVX512 cpu features

2017-11-21 Thread Yang Zhong

Intel IceLake cpu has added new cpu features,AVX512_VBMI2/GFNI/
VAES/VPCLMULQDQ/AVX512_VNNI/AVX512_BITALG. Those new cpu features
need expose to guest VM.

The bit definition:
CPUID.(EAX=7,ECX=0):ECX[bit 06] AVX512_VBMI2
CPUID.(EAX=7,ECX=0):ECX[bit 08] GFNI
CPUID.(EAX=7,ECX=0):ECX[bit 09] VAES
CPUID.(EAX=7,ECX=0):ECX[bit 10] VPCLMULQDQ
CPUID.(EAX=7,ECX=0):ECX[bit 11] AVX512_VNNI
CPUID.(EAX=7,ECX=0):ECX[bit 12] AVX512_BITALG

The release document ref below link:
https://software.intel.com/sites/default/files/managed/c5/15/\
architecture-instruction-set-extensions-programming-reference.pdf

Signed-off-by: Yang Zhong 
---
 target/i386/cpu.c | 6 +++---
 target/i386/cpu.h | 6 ++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 045d661..a67ced2 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -437,9 +437,9 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 [FEAT_7_0_ECX] = {
 .feat_names = {
 NULL, "avx512vbmi", "umip", "pku",
-"ospke", NULL, NULL, NULL,
-NULL, NULL, NULL, NULL,
-NULL, NULL, "avx512-vpopcntdq", NULL,
+"ospke", NULL, "avx512vbmi2", NULL,
+"gfni", "vaes", "vpclmulqdq", "avx512vnni",
+"avx512bitalg", NULL, "avx512-vpopcntdq", NULL,
 "la57", NULL, NULL, NULL,
 NULL, NULL, "rdpid", NULL,
 NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index b086b15..cdbf8b0 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -635,6 +635,12 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
 #define CPUID_7_0_ECX_UMIP (1U << 2)
 #define CPUID_7_0_ECX_PKU  (1U << 3)
 #define CPUID_7_0_ECX_OSPKE(1U << 4)
+#define CPUID_7_0_ECX_VBMI2(1U << 6) /* Additional VBMI Instrs */
+#define CPUID_7_0_ECX_GFNI (1U << 8)
+#define CPUID_7_0_ECX_VAES (1U << 9)
+#define CPUID_7_0_ECX_VPCLMULQDQ (1U << 10)
+#define CPUID_7_0_ECX_AVX512VNNI (1U << 11)
+#define CPUID_7_0_ECX_AVX512BITALG (1U << 12)
 #define CPUID_7_0_ECX_AVX512_VPOPCNTDQ (1U << 14) /* POPCNT for vectors of 
DW/QW */
 #define CPUID_7_0_ECX_LA57 (1U << 16)
 #define CPUID_7_0_ECX_RDPID(1U << 22)
-- 
1.9.1

Re: [Qemu-devel] [PATCH] iotests: fix 075 and 078

2017-11-21 Thread Lukáš Doktor

Dne 22.11.2017 v 01:16 John Snow napsal(a):
> Both of these tests are for formats which now stipulate that they are
> read-only. Adjust the tests to match.
> 
> Signed-off-by: John Snow 
> ---
>  tests/qemu-iotests/075 | 18 +-
>  tests/qemu-iotests/078 | 14 +++---
>  2 files changed, 16 insertions(+), 16 deletions(-)

Reviewed-by: Lukáš Doktor  

Yep, fixes the issue with "Opening cloop images without an explicit 
read-only=on option is deprecated. Future versions will refuse to open the 
image instead of automatically marking the image read-only.".

Lukáš



signature.asc
Description: OpenPGP digital signature

[Qemu-devel] [PATCH] Remove MemoryRegionSection check code from sparc_cpu_get_phys_page_debug()

2017-11-21 Thread Jean-Christophe Dubois

This code is preventing the MMU debug code from displaying virtual
mappings of IO devices (anything that is not located in the RAM).

Before this patch, Qemu would output 0x (-1) as the
physical address corresponding to a IO device virtual address.

With this patch the intended physical adresse is displayed.

Signed-off-by: Jean-Christophe Dubois 
---
 target/sparc/mmu_helper.c | 6 --
 1 file changed, 6 deletions(-)

diff --git a/target/sparc/mmu_helper.c b/target/sparc/mmu_helper.c
index d5b6c1e48c..f2d2250e7a 100644
--- a/target/sparc/mmu_helper.c
+++ b/target/sparc/mmu_helper.c
@@ -857,18 +857,12 @@ hwaddr sparc_cpu_get_phys_page_debug(CPUState *cs, vaddr 
addr)
 CPUSPARCState *env = >env;
 hwaddr phys_addr;
 int mmu_idx = cpu_mmu_index(env, false);
-MemoryRegionSection section;
 
 if (cpu_sparc_get_phys_page(env, _addr, addr, 2, mmu_idx) != 0) {
 if (cpu_sparc_get_phys_page(env, _addr, addr, 0, mmu_idx) != 0) {
 return -1;
 }
 }
-section = memory_region_find(get_system_memory(), phys_addr, 1);
-memory_region_unref(section.mr);
-if (!int128_nz(section.size)) {
-return -1;
-}
 return phys_addr;
 }
 #endif
-- 
2.14.1

[Qemu-devel] [Bug 1733720] Re: raspi2 with multiple CPU's #1

2017-11-21 Thread Ken Dickey

Sorry again, "MPIDR"

Gotta learn to type!

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1733720

Title:
  raspi2 with multiple CPU's #1

Status in QEMU:
  Invalid

Bug description:
  Greetings,

  I am running a small program for raspi2 (from
  http://wiki.osdev.org/ARM_RaspberryPi_Tutorial_C).

  This code writes "Hello World", but the output ir repeated 4 times.

  My thought was that this is emulating a 4 cpu core system.

  However, when I check the MPIDR registed for CPU number, it always
  returns 1.

  I git cloned github.com/qemu/qemu.git, made & installed on Acer ARM
  CB5-311 under Crouton/ubuntu.

  
  ./qemu.sh 
  

  Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> uname -a
  Linux localhost 3.10.18 #1 SMP Mon Nov 13 16:34:10 PST 2017 armv7l armv7l 
armv7l GNU/Linux

  Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> qemu-system-arm --version
  QEMU emulator version 2.10.91 (v2.11.0-rc1-dirty)
  Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

  =
  static inline uint32_t read_mpdir(void)
  {
uint32_t id;

asm volatile("mrc p15, 0, %[id], c0, c0, 0 @ read MIDR\n\t"
   : [id] "=r" (id));
return id;
  }
  ==
  void kernel_main(uint32_t r0, uint32_t r1, uint32_t atags)
  {
// Declare as unused
(void) r0;
(void) r1;
(void) atags;

  uint32_t cpu_id;

  cpu_id = read_mpdir() & 0x03;

  uart_putc( "01234"[cpu_id] ); /* output is "" */

  if (cpu_id == 0) { /* code never executes 8^( */ }

  == qemu.sh
  qemu-system-arm -m 256 -M raspi2 -no-reboot -serial stdio  -kernel myos.elf

  Thanks much,
  -KenD

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1733720/+subscriptions

[Qemu-devel] [Bug 1733720] Re: raspi2 with multiple CPU's #1

2017-11-21 Thread Ken Dickey

NOT A BUG

Reviewed the code and found the problem.

asm volatile("mrc p15, 0, %[id], c0, c0, 0 @ read MIDR\n\t" ...

I miscopied the code above; MIDR should have been MIPDR ( 5 )

I now get:

Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> ./qemu.sh 
0H312ello, kernel World!

Sorry about the bogus report!
-KenD

** Changed in: qemu
   Status: New => Invalid

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1733720

Title:
  raspi2 with multiple CPU's #1

Status in QEMU:
  Invalid

Bug description:
  Greetings,

  I am running a small program for raspi2 (from
  http://wiki.osdev.org/ARM_RaspberryPi_Tutorial_C).

  This code writes "Hello World", but the output ir repeated 4 times.

  My thought was that this is emulating a 4 cpu core system.

  However, when I check the MPIDR registed for CPU number, it always
  returns 1.

  I git cloned github.com/qemu/qemu.git, made & installed on Acer ARM
  CB5-311 under Crouton/ubuntu.

  
  ./qemu.sh 
  

  Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> uname -a
  Linux localhost 3.10.18 #1 SMP Mon Nov 13 16:34:10 PST 2017 armv7l armv7l 
armv7l GNU/Linux

  Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> qemu-system-arm --version
  QEMU emulator version 2.10.91 (v2.11.0-rc1-dirty)
  Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

  =
  static inline uint32_t read_mpdir(void)
  {
uint32_t id;

asm volatile("mrc p15, 0, %[id], c0, c0, 0 @ read MIDR\n\t"
   : [id] "=r" (id));
return id;
  }
  ==
  void kernel_main(uint32_t r0, uint32_t r1, uint32_t atags)
  {
// Declare as unused
(void) r0;
(void) r1;
(void) atags;

  uint32_t cpu_id;

  cpu_id = read_mpdir() & 0x03;

  uart_putc( "01234"[cpu_id] ); /* output is "" */

  if (cpu_id == 0) { /* code never executes 8^( */ }

  == qemu.sh
  qemu-system-arm -m 256 -M raspi2 -no-reboot -serial stdio  -kernel myos.elf

  Thanks much,
  -KenD

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1733720/+subscriptions

[Qemu-devel] [PATCH qemu] vfio: Allow configuration without INTx

On some platforms INTx may not be enabled on a KVM host (one such
example is IBM pHyp hypervisor and this is intentional). However
the PCI_INTERRUPT_PIN is not 0 so QEMU tries initializing INTx, fails as
(!vdev->pdev->irq) in the VFIO's vfio_intx_enable() and this is
a fatal error.

This adds a debug switch - "x-no-intx" - in order to allow broken INTx
configuration.

Signed-off-by: Alexey Kardashevskiy 
---

In practice, test teams run PR KVM under HV KVM and there INTx is enabled
on all levels so having this as a debug switch is enough.
---
 hw/vfio/pci.h | 1 +
 hw/vfio/pci.c | 8 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 502a575..c5e168e 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -141,6 +141,7 @@ typedef struct VFIOPCIDevice {
 bool has_flr;
 bool has_pm_reset;
 bool rom_read_failed;
+bool no_intx;
 bool no_kvm_intx;
 bool no_kvm_msi;
 bool no_kvm_msix;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index c977ee3..c9caf6a 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2869,7 +2869,12 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
 pci_device_set_intx_routing_notifier(>pdev, vfio_intx_update);
 ret = vfio_intx_enable(vdev, errp);
 if (ret) {
-goto out_teardown;
+if (vdev->no_intx) {
+error_report_err(*errp);
+*errp = NULL;
+} else {
+goto out_teardown;
+}
 }
 }
 
@@ -2986,6 +2991,7 @@ static Property vfio_pci_dev_properties[] = {
 DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice, features,
 VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, false),
 DEFINE_PROP_BOOL("x-no-mmap", VFIOPCIDevice, vbasedev.no_mmap, false),
+DEFINE_PROP_BOOL("x-no-intx", VFIOPCIDevice, no_intx, false),
 DEFINE_PROP_BOOL("x-no-kvm-intx", VFIOPCIDevice, no_kvm_intx, false),
 DEFINE_PROP_BOOL("x-no-kvm-msi", VFIOPCIDevice, no_kvm_msi, false),
 DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
-- 
2.11.0

[Qemu-devel] [PATCH qemu] vfio/spapr: Allow fallback to SPAPR TCE IOMMU v1

The vfio_iommu_spapr_tce driver always advertises v1 and v2 IOMMU support,
however PR KVM (a special version of KVM designed to work in
a paravirtualized system; these days used for nested virtualizaion) only
supports the "pseries" platform which does not support v2. Since there is
no way to choose the IOMMU version in QEMU, it fails to start.

This adds a fallback to the v1 IOMMU if v2 cannot be used.

Signed-off-by: Alexey Kardashevskiy 
---
 hw/vfio/common.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 7b2924c..cd81cc9 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -1040,6 +1040,11 @@ static int vfio_connect_container(VFIOGroup *group, 
AddressSpace *as,
 v2 ? VFIO_SPAPR_TCE_v2_IOMMU : VFIO_SPAPR_TCE_IOMMU;
 ret = ioctl(fd, VFIO_SET_IOMMU, container->iommu_type);
 if (ret) {
+container->iommu_type = VFIO_SPAPR_TCE_IOMMU;
+v2 = false;
+ret = ioctl(fd, VFIO_SET_IOMMU, container->iommu_type);
+}
+if (ret) {
 error_setg_errno(errp, errno, "failed to set iommu for container");
 ret = -errno;
 goto free_container_exit;
-- 
2.11.0

Re: [Qemu-devel] [PATCH v2 4/7] s390x/pci: rework PCI STORE BLOCK

2017-11-21 Thread Yi Min Zhao




在 2017/11/22 上午2:07, Pierre Morel 写道:

On 21/11/2017 11:42, Cornelia Huck wrote:

On Thu, 16 Nov 2017 18:51:52 +0100
Pierre Morel  wrote:


Enhance the fault detection.

Fixup the precedence to check the destination path existance
before checking for the source accessibility.

Add the maxstbl entry to both the Query PCI Function Group
response and the PCIBusDevice structure.

Initialize the maxstbl to 128 per default until we get
the actual data from the hardware.

Signed-off-by: Pierre Morel 
Reviewed-by: Yi Min Zhao 
---
  hw/s390x/s390-pci-bus.h  |  1 +
  hw/s390x/s390-pci-inst.c | 62 
+---

  hw/s390x/s390-pci-inst.h |  2 +-
  3 files changed, 40 insertions(+), 25 deletions(-)


@@ -700,8 +685,33 @@ int pcistb_service_call(S390CPU *cpu, uint8_t 
r1, uint8_t r3, uint64_t gaddr,

  break;
  }
  +    if (pcias > 5) {
+    DPRINTF("pcistb invalid space\n");
+    setcc(cpu, ZPCI_PCI_LS_ERR);
+    s390_set_status_code(env, r1, ZPCI_PCI_ST_INVAL_AS);
+    return 0;
+    }
+
+    /* Verify the address, offset and length */
+    /* offset must be a multiple of 8 */
+    if (offset % 8) {
+    goto addressing_error;
+    }
+    /* Length must be greater than 8, a multiple of 8, not greater 
maxstbl */


"not greater than maxstlb"


Better I know but greater that 80 characters, this is why I preferred 
broken English.

What do I do ? break the line or English ?

less than?





+    if ((len <= 8) || (len % 8) || (len > pbdev->maxstbl)) {
+    goto addressing_error;
+    }
+    /* Do not cross a 4K-byte boundary */
+    if (((offset & 0xfff) + len) > 0x1000) {
+    goto addressing_error;
+    }
+    /* Guest address must be double word aligned */
+    if (gaddr & 0x07UL) {
+    goto addressing_error;
+    }
+
  mr = pbdev->pdev->io_regions[pcias].memory;
-    if (!memory_region_access_valid(mr, env->regs[r3], len, true)) {
+    if (!memory_region_access_valid(mr, offset, len, true)) {
  program_interrupt(env, PGM_OPERAND, 6);
  return 0;
  }


Looks good.

[Qemu-devel] Why qemu with kvm enabled can boot kernel even if identity page map is not set correctly?

2017-11-21 Thread Ding Fei

Hi all. Firstly, sorry if it's the wrong place to ask such a question!

In the early stages of boot process, kernel need identity mapped page
setup when switching gdt

[https://github.com/torvalds/linux/blob/ed30b147e1f6e396e70a52dbb6c7d66befedd786/arch/x86/kernel/head_64.S#L133-L137]

as code here

[https://github.com/torvalds/linux/blob/ed30b147e1f6e396e70a52dbb6c7d66befedd786/arch/x86/kernel/head64.c#L98-L138]

implies. That's why the first few entries of early_dynamic_pgts are
set to map the kernel text range [_text, _end].
But as we discussed about the role of these entries, we delete them

[https://github.com/torvalds/linux/blob/ed30b147e1f6e396e70a52dbb6c7d66befedd786/arch/x86/kernel/head64.c#L98-L138]

and recompile the kernel, then test it on qemu. Without '-enable-kvm'
option the kernel won't boot as we expected,
but with kvm option on, the kernel can boot and everything runs well,
really to our surprise.

So I guess there are something under the hood done by kvm, which
doesn't obey the rules of
how a real physical machine behaves.

I've setup a debug environment that the page table mis-configed kernel
runs inside qemu, which nested inside
vmware workstation with EPT enabled, and gdb on the host to debug the
kernel kvm of vmware kernel.

But without any luck I've spent a whole day try to catch what is
happening inside kvm, I still can't figure out the
real magic point that jump through the broken page table. It seems
that the code just jumps randomly.

Can anyone confirm what we've observed? Is it designed to be like that?
Any details or explanation would be really appreciated!

--
Best Regards

Ding Fei
E-mail: danix...@gmail.com

[Qemu-devel] [Bug 1733720] [NEW] raspi2 with multiple CPU's #1

2017-11-21 Thread Ken Dickey

Public bug reported:

Greetings,

I am running a small program for raspi2 (from
http://wiki.osdev.org/ARM_RaspberryPi_Tutorial_C).

This code writes "Hello World", but the output ir repeated 4 times.

My thought was that this is emulating a 4 cpu core system.

However, when I check the MPIDR registed for CPU number, it always
returns 1.

I git cloned github.com/qemu/qemu.git, made & installed on Acer ARM
CB5-311 under Crouton/ubuntu.


./qemu.sh 


Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> uname -a
Linux localhost 3.10.18 #1 SMP Mon Nov 13 16:34:10 PST 2017 armv7l armv7l 
armv7l GNU/Linux

Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> qemu-system-arm --version
QEMU emulator version 2.10.91 (v2.11.0-rc1-dirty)
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

=
static inline uint32_t read_mpdir(void)
{
  uint32_t id;
  
  asm volatile("mrc p15, 0, %[id], c0, c0, 0 @ read MIDR\n\t"
   : [id] "=r" (id));
  return id;
}
==
void kernel_main(uint32_t r0, uint32_t r1, uint32_t atags)
{
// Declare as unused
(void) r0;
(void) r1;
(void) atags;

uint32_t cpu_id;

cpu_id = read_mpdir() & 0x03;

uart_putc( "01234"[cpu_id] ); /* output is "" */

if (cpu_id == 0) { /* code never executes 8^( */ }

== qemu.sh
qemu-system-arm -m 256 -M raspi2 -no-reboot -serial stdio  -kernel myos.elf

Thanks much,
-KenD

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1733720

Title:
  raspi2 with multiple CPU's #1

Status in QEMU:
  New

Bug description:
  Greetings,

  I am running a small program for raspi2 (from
  http://wiki.osdev.org/ARM_RaspberryPi_Tutorial_C).

  This code writes "Hello World", but the output ir repeated 4 times.

  My thought was that this is emulating a 4 cpu core system.

  However, when I check the MPIDR registed for CPU number, it always
  returns 1.

  I git cloned github.com/qemu/qemu.git, made & installed on Acer ARM
  CB5-311 under Crouton/ubuntu.

  
  ./qemu.sh 
  

  Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> uname -a
  Linux localhost 3.10.18 #1 SMP Mon Nov 13 16:34:10 PST 2017 armv7l armv7l 
armv7l GNU/Linux

  Linux:armv7l: ~/Downloads/RaspiTest/BareBones >>> qemu-system-arm --version
  QEMU emulator version 2.10.91 (v2.11.0-rc1-dirty)
  Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers

  =
  static inline uint32_t read_mpdir(void)
  {
uint32_t id;

asm volatile("mrc p15, 0, %[id], c0, c0, 0 @ read MIDR\n\t"
   : [id] "=r" (id));
return id;
  }
  ==
  void kernel_main(uint32_t r0, uint32_t r1, uint32_t atags)
  {
// Declare as unused
(void) r0;
(void) r1;
(void) atags;

  uint32_t cpu_id;

  cpu_id = read_mpdir() & 0x03;

  uart_putc( "01234"[cpu_id] ); /* output is "" */

  if (cpu_id == 0) { /* code never executes 8^( */ }

  == qemu.sh
  qemu-system-arm -m 256 -M raspi2 -no-reboot -serial stdio  -kernel myos.elf

  Thanks much,
  -KenD

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1733720/+subscriptions

Re: [Qemu-devel] [PATCH 00/12] Add MVME3100 PPC SBC

2017-11-21 Thread Michael Davidsaver

On 11/21/2017 10:12 PM, David Gibson wrote:
...
> I've applied several patches from this series to ppc-for-2.12, others
> I've commented on.  If you could address the comments and rebase
> what's left on ppc-for-2.12, that would be great.

Will do.



signature.asc
Description: OpenPGP digital signature

Re: [Qemu-devel] [PATCH 03/12] e500: note possible bug with host bridge

2017-11-21 Thread Michael Davidsaver

On 11/21/2017 09:46 PM, David Gibson wrote:
> On Sun, Nov 19, 2017 at 09:24:11PM -0600, Michael Davidsaver wrote:
>> Signed-off-by: Michael Davidsaver 
> 
> I'm not sure if you're saying you think there is a hardware bug which
> we're faithfully emulating, or a software bug.

I mean that the emulation is incorrect in that it just sets
config[PCI_HEADER_TYPE]==PCI_HEADER_TYPE_BRIDGE but does none of the
other initialization of the base-pci-bridge class.

I specifically observed Linux being confused by the fact that the
primary, secondary, and subordinate bus registers don't work right
because they're actually the BAR2 address register.

Further, it seems odd that a host bridge would identify itself as a
pci-to-pci bridge.  The mpc8540 doesn't.  The mpc8544 docs aren't clear,
and I don't have a real one to test.  My inclination is to remove the
line changing PCI_HEADER_TYPE, but I'm hesitant about breaking things.
Especially since this doesn't trigger mis-behavior in Linux or RTEMS.

>> ---
>>  hw/pci-host/ppce500.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
>> index f2d108bc8a..0e2833bd98 100644
>> --- a/hw/pci-host/ppce500.c
>> +++ b/hw/pci-host/ppce500.c
>> @@ -424,6 +424,9 @@ static void e500_pcihost_bridge_realize(PCIDevice *d, 
>> Error **errp)
>>  MemoryRegion *ccsr_mr = sysbus_mmio_get_region(ccsr, 0);
>>  
>>  pci_config_set_class(d->config, PCI_CLASS_BRIDGE_PCI);
>> +/* BUG? identifies as PCI_HEADER_TYPE_BRIDGE but uses
>> + * standard device config read/write
>> + */
>>  d->config[PCI_HEADER_TYPE] =
>>  (d->config[PCI_HEADER_TYPE] & PCI_HEADER_TYPE_MULTI_FUNCTION) |
>>  PCI_HEADER_TYPE_BRIDGE;
> 

signature.asc
Description: OpenPGP digital signature

[Qemu-devel] [PULL 3/3] ppc: fix VTB migration

From: Laurent Vivier 

Migration of a system under stress (for example, with
"stress-ng --numa 2") triggers on the destination
some kernel watchdog messages like:

NMI watchdog: BUG: soft lockup - CPU#0 stuck for 3489660870s!
NMI watchdog: BUG: soft lockup - CPU#1 stuck for 3489660884s!

This problem appears with the changes introduced by
42043e4 spapr: clock should count only if vm is running

I think this commit only triggers the problem.

Kernel computes the soft lockup duration using the
Virtual Timebase register (VTB), not using the Timebase
Register (TBR, the one 42043e4 stops).

It appears VTB is not migrated, so this patch adds it in
the list of the SPRs to migrate, and fixes the problem.

For the migration, I've tested a migration from qemu-2.8.0 and
pseries-2.8.0 to a patched master (qemu-2.11.0-rc1). The received
VTB is 0 (as is it not initialized by qemu-2.8.0), but the value
seems to be ignored by KVM and a non zero VTB is used by the kernel.
I have no explanation for that, but as the original problem appears
only with SMP system under stress I suspect some problems in KVM
(I think because VTB is shared by all threads of a core).

Signed-off-by: Laurent Vivier 
Signed-off-by: David Gibson 
---
 target/ppc/translate_init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/ppc/translate_init.c b/target/ppc/translate_init.c
index b9c49c22f2..4e11e6f489 100644
--- a/target/ppc/translate_init.c
+++ b/target/ppc/translate_init.c
@@ -8081,10 +8081,10 @@ static void gen_spr_power8_ebb(CPUPPCState *env)
 /* Virtual Time Base */
 static void gen_spr_vtb(CPUPPCState *env)
 {
-spr_register(env, SPR_VTB, "VTB",
+spr_register_kvm(env, SPR_VTB, "VTB",
  SPR_NOACCESS, SPR_NOACCESS,
  _read_tbl, SPR_NOACCESS,
- 0x);
+ KVM_REG_PPC_VTB, 0x);
 }
 
 static void gen_spr_power8_fscr(CPUPPCState *env)
-- 
2.14.3

[Qemu-devel] [PULL 2/3] spapr: Implement bug in spapr-vty device to be compatible with PowerVM

The spapr-vty device implements the PAPR defined virtual console,
which is also implemented by IBM's proprietary PowerVM hypervisor.

PowerVM's implementation has a bug where it inserts an extra \0 after
every \r going to the guest.  Because of that Linux's guest side
driver has a workaround which strips \0 characters that appear
immediately after a \r.

That means that when running under qemu, sending a binary stream from
host to guest via spapr-vty which happens to include a \r\0 sequence
will get corrupted by that workaround.

To deal with that, this patch duplicates PowerVM's bug, inserting an
extra \0 after each \r.  Ugly, but the best option available.

Signed-off-by: David Gibson 
Reviewed-by: Thomas Huth 
Reviewed-by: Greg Kurz 
---
 hw/char/spapr_vty.c | 18 ++
 1 file changed, 18 insertions(+)

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 0fa416ca6b..6748334ded 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -58,6 +58,24 @@ static int vty_getchars(VIOsPAPRDevice *sdev, uint8_t *buf, 
int max)
 
 while ((n < max) && (dev->out != dev->in)) {
 buf[n++] = dev->buf[dev->out++ % VTERM_BUFSIZE];
+
+/* PowerVM's vty implementation has a bug where it inserts a
+ * \0 after every \r going to the guest.  Existing guests have
+ * a workaround for this which removes every \0 immediately
+ * following a \r, so here we make ourselves bug-for-bug
+ * compatible, so that the guest won't drop a real \0-after-\r
+ * that happens to occur in a binary stream. */
+if (buf[n - 1] == '\r') {
+if (n < max) {
+buf[n++] = '\0';
+} else {
+/* No room for the extra \0, roll back and try again
+ * next time */
+dev->out--;
+n--;
+break;
+}
+}
 }
 
 qemu_chr_fe_accept_input(>chardev);
-- 
2.14.3

[Qemu-devel] [PULL 0/3] ppc-for-2.11 queue 20171122

The following changes since commit a15d835f00dce270fd3194e83d9910f4b5b44ac0:

  Update version for v2.11.0-rc2 release (2017-11-21 17:50:36 +)

are available in the Git repository at:

  git://github.com/dgibson/qemu.git tags/ppc-for-2.11-20171122

for you to fetch changes up to 6dd836f5d32b989e18c6dda655a26f4d73a52f6a:

  ppc: fix VTB migration (2017-11-22 15:28:37 +1100)


ppc patch queue 2017-11-22

Several more fixes to merge for qemu-2.11.


David Gibson (1):
  spapr: Implement bug in spapr-vty device to be compatible with PowerVM

Laurent Vivier (1):
  ppc: fix VTB migration

Thomas Huth (1):
  hw/ppc/spapr: Fix virtio-scsi bootindex handling for LUNs >= 256

 hw/char/spapr_vty.c | 18 ++
 hw/ppc/spapr.c  |  4 
 target/ppc/translate_init.c |  4 ++--
 3 files changed, 24 insertions(+), 2 deletions(-)

[Qemu-devel] [PULL 1/3] hw/ppc/spapr: Fix virtio-scsi bootindex handling for LUNs >= 256

From: Thomas Huth 

LUNs >= 256 have to be encoded with the so-called "flat space
addressing method" for virtio-scsi, where an additional bit has to
be set. SLOF already took care of this with the following commit:

 https://git.qemu.org/?p=SLOF.git;a=commitdiff;h=f72a37713fea47da
 (see https://bugzilla.redhat.com/show_bug.cgi?id=1431584 for details)

But QEMU does not use this encoding yet for device tree paths
that have to be handed over to SLOF to deal with the "bootindex"
property, so SLOF currently fails to boot from virtio-scsi devices
with LUNs >= 256 in the right boot order. Fix it by using the bit
to indicate the "flat space addressing method" for LUNs >= 256.

Signed-off-by: Thomas Huth 
Signed-off-by: David Gibson 
---
 hw/ppc/spapr.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 6285f7211f..4d0a84f3ec 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2663,6 +2663,10 @@ static char *spapr_get_fw_dev_path(FWPathProvider *p, 
BusState *bus,
  * swap 0100 or 10 << or 20 << ( target lun-id -- srplun )
  */
 unsigned id = 0x100 | (d->id << 16) | d->lun;
+if (d->lun >= 256) {
+/* Use the LUN "flat space addressing method" */
+id |= 0x4000;
+}
 return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
(uint64_t)id << 32);
 } else if (usb) {
-- 
2.14.3

Re: [Qemu-devel] [PATCH 08/12] e500: add mpc8540 i2c controller to ccsr

On Sun, Nov 19, 2017 at 09:24:16PM -0600, Michael Davidsaver wrote:
> Signed-off-by: Michael Davidsaver 

You're adding what seems to be a fairly specific device to the general
e500 init - this again suggests that it should be split, putting
creation of devices under control of individual machines.

> ---
>  hw/ppc/e500.c | 8 
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
> index 6f77844303..bef7d313d4 100644
> --- a/hw/ppc/e500.c
> +++ b/hw/ppc/e500.c
> @@ -861,6 +861,14 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  qdev_init_nofail(dev);
>  ccsr_addr_space = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
>  
> +dev = qdev_create(NULL, "mpc8540-i2c");
> +object_property_add_child(qdev_get_machine(), "i2c[*]",
> +  OBJECT(dev), NULL);
> +qdev_init_nofail(dev);
> +s = SYS_BUS_DEVICE(dev);
> +memory_region_add_subregion(ccsr_addr_space, 0x3000,
> +sysbus_mmio_get_region(s, 0));
> +
>  mpicdev = ppce500_init_mpic(machine, params, ccsr_addr_space, irqs);
>  
>  /* Serial */

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [PATCH 09/12] nvram: add AT24Cx i2c eeprom

On Sun, Nov 19, 2017 at 09:24:17PM -0600, Michael Davidsaver wrote:
> Signed-off-by: Michael Davidsaver 

Applied to ppc-for-2.12.

> ---
>  hw/nvram/Makefile.objs  |   1 +
>  hw/nvram/eeprom_at24c.c | 205 
> 
>  2 files changed, 206 insertions(+)
>  create mode 100644 hw/nvram/eeprom_at24c.c
> 
> diff --git a/hw/nvram/Makefile.objs b/hw/nvram/Makefile.objs
> index c018f6b2ff..0f4ee71dcb 100644
> --- a/hw/nvram/Makefile.objs
> +++ b/hw/nvram/Makefile.objs
> @@ -1,5 +1,6 @@
>  common-obj-$(CONFIG_DS1225Y) += ds1225y.o
>  common-obj-y += eeprom93xx.o
> +common-obj-y += eeprom_at24c.o
>  common-obj-y += fw_cfg.o
>  common-obj-y += chrp_nvram.o
>  common-obj-$(CONFIG_MAC_NVRAM) += mac_nvram.o
> diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
> new file mode 100644
> index 00..efa3621ac6
> --- /dev/null
> +++ b/hw/nvram/eeprom_at24c.c
> @@ -0,0 +1,205 @@
> +/*
> + * *AT24C* series I2C EEPROM
> + *
> + * Copyright (c) 2015 Michael Davidsaver
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2.  See
> + * the LICENSE file in the top-level directory.
> + */
> +
> +#include 
> +
> +#include "qemu/osdep.h"
> +#include "qapi/error.h"
> +#include "hw/hw.h"
> +#include "hw/i2c/i2c.h"
> +#include "sysemu/block-backend.h"
> +
> +/* #define DEBUG_AT24C */
> +
> +#ifdef DEBUG_AT24C
> +#define DPRINTK(FMT, ...) printf(TYPE_AT24C_EE " : " FMT, ## __VA_ARGS__)
> +#else
> +#define DPRINTK(FMT, ...) do {} while (0)
> +#endif
> +
> +#define ERR(FMT, ...) fprintf(stderr, TYPE_AT24C_EE " : " FMT, \
> +## __VA_ARGS__)
> +
> +#define TYPE_AT24C_EE "at24c-eeprom"
> +#define AT24C_EE(obj) OBJECT_CHECK(EEPROMState, (obj), TYPE_AT24C_EE)
> +
> +typedef struct EEPROMState {
> +I2CSlave parent_obj;
> +
> +/* address counter */
> +uint16_t cur;
> +/* total size in bytes */
> +uint32_t rsize;
> +bool writable;
> +/* cells changed since last START? */
> +bool changed;
> +/* during WRITE, # of address bytes transfered */
> +uint8_t haveaddr;
> +
> +uint8_t *mem;
> +
> +BlockBackend *blk;
> +} EEPROMState;
> +
> +static
> +int at24c_eeprom_event(I2CSlave *s, enum i2c_event event)
> +{
> +EEPROMState *ee = container_of(s, EEPROMState, parent_obj);
> +
> +switch (event) {
> +case I2C_START_SEND:
> +case I2C_START_RECV:
> +case I2C_FINISH:
> +ee->haveaddr = 0;
> +DPRINTK("clear\n");
> +if (ee->blk && ee->changed) {
> +int len = blk_pwrite(ee->blk, 0, ee->mem, ee->rsize, 0);
> +if (len != ee->rsize) {
> +ERR(TYPE_AT24C_EE
> +" : failed to write backing file\n");
> +}
> +DPRINTK("Wrote to backing file\n");
> +}
> +ee->changed = false;
> +break;
> +case I2C_NACK:
> +break;
> +}
> +return 0;
> +}
> +
> +static
> +int at24c_eeprom_recv(I2CSlave *s)
> +{
> +EEPROMState *ee = AT24C_EE(s);
> +int ret;
> +
> +ret = ee->mem[ee->cur];
> +
> +ee->cur = (ee->cur + 1u) % ee->rsize;
> +DPRINTK("Recv %02x %c\n", ret, ret);
> +
> +return ret;
> +}
> +
> +static
> +int at24c_eeprom_send(I2CSlave *s, uint8_t data)
> +{
> +EEPROMState *ee = AT24C_EE(s);
> +
> +if (ee->haveaddr < 2) {
> +ee->cur <<= 8;
> +ee->cur |= data;
> +ee->haveaddr++;
> +if (ee->haveaddr == 2) {
> +ee->cur %= ee->rsize;
> +DPRINTK("Set pointer %04x\n", ee->cur);
> +}
> +
> +} else {
> +if (ee->writable) {
> +DPRINTK("Send %02x\n", data);
> +ee->mem[ee->cur] = data;
> +ee->changed = true;
> +} else {
> +DPRINTK("Send error %02x read-only\n", data);
> +}
> +ee->cur = (ee->cur + 1u) % ee->rsize;
> +
> +}
> +
> +return 0;
> +}
> +
> +static
> +int at24c_eeprom_init(I2CSlave *i2c)
> +{
> +EEPROMState *ee = AT24C_EE(i2c);
> +
> +ee->mem = g_malloc0(ee->rsize);
> +
> +if (ee->blk) {
> +int64_t len = blk_getlength(ee->blk);
> +
> +if (len != ee->rsize) {
> +ERR(TYPE_AT24C_EE " : Backing file size %lu != %u\n",
> +(unsigned long)len, (unsigned)ee->rsize);
> +exit(1);
> +}
> +
> +if (blk_set_perm(ee->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
> + BLK_PERM_ALL, _fatal) < 0)
> +{
> +ERR(TYPE_AT24C_EE
> +" : Backing file incorrect permission\n");
> +exit(1);
> +}
> +}
> +return 0;
> +}
> +
> +static
> +void at24c_eeprom_reset(DeviceState *state)
> +{
> +EEPROMState *ee = AT24C_EE(state);
> +
> +ee->changed = false;
> +ee->cur = 0;
> +ee->haveaddr = 0;
> +
> +memset(ee->mem, 0, ee->rsize);
> +
> +if (ee->blk) {
> +int len = blk_pread(ee->blk, 0,

Re: [Qemu-devel] [PATCH 00/12] Add MVME3100 PPC SBC

On Sun, Nov 19, 2017 at 09:24:08PM -0600, Michael Davidsaver wrote:
> This series adds simulation of MVME3100 powerpc SBCs, originally from 
> Motorola,
> and now sold by Artesyn[1].  There are two variants differing in CPU
> speed and memory size.
> 
> I've been working on this sporadically for the past 2 year.  Recently I've
> finished all the features which I have in mind.  If this series is accepted
> there is a continuation which adds VME bus.  I've found it
> useful in software compatibility testing.  I wonder if there is
> any interest at large?
> 
> 
> There are two main parts of this series.  1-5 are changing code common
> with the "ppce500" and "mpc8544ds" boards, with the remainder being
> additions.
> 
> The changes are to how the CCSR region is handled in order to support
> the CCSRBAR register which allows the whole region to be relocated.
> Also added are a couple of memory and clock configuration registers
> which RTEMS guests read.
> 
> #3 is actually a minor issue I found recently with the mpc8544 PCI host 
> bridge,
> which I'm uncertain how to address.  The host bridge device 0:0 identifies
> itself as a bridge, but doesn't properly implement the bridge config 
> registers.
> This confuses Linux, which then does a full re-enumeration (successfully).
> 
> The rest are additions of an I2C controller, an I2C eeprom, an I2C RTC,
> and new board code.
> 
> My testing has been almost exclusively with an RTEMS guest[2].
> Though I have recently done a little with Linux.
> 
> RTEMS guests (and Linux too for now) require a stub bootloader[3] to
> put the system in the same state as the real bootloader.
> RTEMS has an unfortunately strong dependence on bootloader
> provided configuration (eg. it doesn't re-enumerate the PCI bus).

I've applied several patches from this series to ppc-for-2.12, others
I've commented on.  If you could address the comments and rebase
what's left on ppc-for-2.12, that would be great.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [PATCH 01/12] e500: add board config options

On Sun, Nov 19, 2017 at 09:24:09PM -0600, Michael Davidsaver wrote:
> allow board code to skip common NIC and guest image setup
> and configure decrementor frequency.
> Existing boards unchanged.
> 
> Signed-off-by: Michael Davidsaver 

So, it's spelled "decrementer".

Other than that, the patch looks correct.  However having a big common
function for overall init with a pile of ad-hoc configuration
parameters is usually not a great way to go.  I think what we want
instead is to eliminate ppce500_init(), instead doing the setup logic
separately in each of the e500 machines.   The large common slabs of
code can be helpers in e500.c, but the overall logic - including most
of the things controlled by the current params - would be under the
individual machine's control.

> ---
>  hw/ppc/e500.c  | 8 ++--
>  hw/ppc/e500.h  | 3 +++
>  hw/ppc/e500plat.c  | 1 +
>  hw/ppc/mpc8544ds.c | 1 +
>  4 files changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
> index 5cf0dabef3..9e7e1b29c4 100644
> --- a/hw/ppc/e500.c
> +++ b/hw/ppc/e500.c
> @@ -826,7 +826,7 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  env->mpic_iack = params->ccsrbar_base +
>   MPC8544_MPIC_REGS_OFFSET + 0xa0;
>  
> -ppc_booke_timers_init(cpu, 4, PPC_TIMER_E500);
> +ppc_booke_timers_init(cpu, params->decrementor_freq, PPC_TIMER_E500);
>  
>  /* Register reset handler */
>  if (!i) {
> @@ -899,7 +899,7 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  if (!pci_bus)
>  printf("couldn't create PCI controller!\n");
>  
> -if (pci_bus) {
> +if (pci_bus && !params->tsec_nic) {
>  /* Register network interfaces. */
>  for (i = 0; i < nb_nics; i++) {
>  pci_nic_init_nofail(_table[i], pci_bus, "virtio", NULL);
> @@ -948,6 +948,10 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  sysbus_mmio_get_region(s, 0));
>  }
>  
> +if (params->skip_load) {
> +return;
> +}
> +
>  /* Load kernel. */
>  if (machine->kernel_filename) {
>  kernel_base = cur_base;
> diff --git a/hw/ppc/e500.h b/hw/ppc/e500.h
> index 70ba1d8f4f..40f72f2de2 100644
> --- a/hw/ppc/e500.h
> +++ b/hw/ppc/e500.h
> @@ -22,6 +22,9 @@ typedef struct PPCE500Params {
>  hwaddr pci_mmio_base;
>  hwaddr pci_mmio_bus_base;
>  hwaddr spin_base;
> +uint32_t decrementor_freq; /* in Hz */
> +bool skip_load;
> +bool tsec_nic;
>  } PPCE500Params;
>  
>  void ppce500_init(MachineState *machine, PPCE500Params *params);
> diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
> index e59e80fb9e..3d07987bd1 100644
> --- a/hw/ppc/e500plat.c
> +++ b/hw/ppc/e500plat.c
> @@ -47,6 +47,7 @@ static void e500plat_init(MachineState *machine)
>  .pci_mmio_base = 0xCULL,
>  .pci_mmio_bus_base = 0xE000ULL,
>  .spin_base = 0xFEF00ULL,
> +.decrementor_freq = 4,
>  };
>  
>  /* Older KVM versions don't support EPR which breaks guests when we 
> announce
> diff --git a/hw/ppc/mpc8544ds.c b/hw/ppc/mpc8544ds.c
> index 1717953ec7..6d9931c475 100644
> --- a/hw/ppc/mpc8544ds.c
> +++ b/hw/ppc/mpc8544ds.c
> @@ -40,6 +40,7 @@ static void mpc8544ds_init(MachineState *machine)
>  .pci_mmio_bus_base = 0xC000ULL,
>  .pci_pio_base = 0xE100ULL,
>  .spin_base = 0xEF00ULL,
> +.decrementor_freq = 4,
>  };
>  
>  if (machine->ram_size > 0xc000) {

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [PATCH 06/12] i2c: add mpc8540 i2c controller

On Sun, Nov 19, 2017 at 09:24:14PM -0600, Michael Davidsaver wrote:
> Signed-off-by: Michael Davidsaver 

I can't speak to the accuracy of the emulation, but it's presumably
better than nothing at all.  Therefore, applied to ppc-for-2.12.

> ---
>  hw/i2c/Makefile.objs |   1 +
>  hw/i2c/mpc8540_i2c.c | 287 
> +++
>  2 files changed, 288 insertions(+)
>  create mode 100644 hw/i2c/mpc8540_i2c.c
> 
> diff --git a/hw/i2c/Makefile.objs b/hw/i2c/Makefile.objs
> index 0594dea3ae..79af1dd901 100644
> --- a/hw/i2c/Makefile.objs
> +++ b/hw/i2c/Makefile.objs
> @@ -9,3 +9,4 @@ common-obj-$(CONFIG_IMX_I2C) += imx_i2c.o
>  common-obj-$(CONFIG_ASPEED_SOC) += aspeed_i2c.o
>  obj-$(CONFIG_OMAP) += omap_i2c.o
>  obj-$(CONFIG_PPC4XX) += ppc4xx_i2c.o
> +obj-$(CONFIG_E500) += mpc8540_i2c.o
> diff --git a/hw/i2c/mpc8540_i2c.c b/hw/i2c/mpc8540_i2c.c
> new file mode 100644
> index 00..884052cc9b
> --- /dev/null
> +++ b/hw/i2c/mpc8540_i2c.c
> @@ -0,0 +1,287 @@
> +/*
> + * MPC8540 I2C bus interface
> + * As described in
> + * MPC8540 PowerQUICC III Integrated Host Processor Reference Manual, Rev. 1
> + * Part 2 chapter 11
> + *
> + * Copyright (c) 2015 Michael Davidsaver
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2.  See
> + * the LICENSE file in the top-level directory.
> + */
> +#include "qemu/osdep.h"
> +#include "qemu/log.h"
> +#include "hw/hw.h"
> +#include "hw/registerfields.h"
> +#include "hw/i2c/i2c.h"
> +#include "hw/sysbus.h"
> +
> +/* #define DEBUG_LVL 0 */
> +
> +#ifdef DEBUG_LVL
> +#define DPRINTK(LVL, FMT, ...) do { if ((LVL) <= DEBUG_LVL) { \
> +printf(TYPE_MPC8540_I2C " : " FMT, ## __VA_ARGS__); } } while (0)
> +#else
> +#define DPRINTK(LVL, FMT, ...) do {} while (0)
> +#endif
> +
> +#define LOG(MSK, FMT, ...) qemu_log_mask(MSK, TYPE_MPC8540_I2C \
> +" : " FMT, ## __VA_ARGS__)
> +
> +#define TYPE_MPC8540_I2C "mpc8540-i2c"
> +#define MPC8540_I2C(obj) OBJECT_CHECK(I2CState, (obj), TYPE_MPC8540_I2C)
> +
> +/* offsets relative to CCSR offset 0x3000 */
> +#define R_I2CADR (0)
> +#define R_I2CFDR (4)
> +#define R_I2CCR  (8)
> +#define R_I2CSR  (0xc)
> +#define R_I2CDR  (0x10)
> +#define R_I2CDFSRR (0x14)
> +
> +FIELD(I2CCR, MEN, 7, 1)
> +FIELD(I2CCR, MIEN, 6, 1)
> +FIELD(I2CCR, MSTA, 5, 1)
> +FIELD(I2CCR, MTX, 4, 1)
> +FIELD(I2CCR, TXAK, 3, 1)
> +FIELD(I2CCR, RSTA, 2, 1)
> +FIELD(I2CCR, BCST, 0, 1)
> +
> +FIELD(I2CSR, MCF, 7, 1)
> +FIELD(I2CSR, MAAS, 6, 1)
> +FIELD(I2CSR, MBB, 5, 1)
> +FIELD(I2CSR, MAL, 4, 1)
> +FIELD(I2CSR, BCSTM, 3, 1)
> +FIELD(I2CSR, SRW, 2, 1)
> +FIELD(I2CSR, MIF, 1, 1)
> +FIELD(I2CSR, RXAK, 0, 1)
> +
> +typedef struct I2CState {
> +SysBusDevice parent_obj;
> +
> +I2CBus *bus;
> +
> +uint8_t ctrl, sts;
> +uint8_t freq, filt;
> +/* Reads are pipelined, this is the next data value */
> +uint8_t dbuf;
> +
> +qemu_irq irq;
> +
> +MemoryRegion mmio;
> +} I2CState;
> +
> +#define I2CCR(BIT) FIELD_EX32(i2c->ctrl, I2CCR, BIT)
> +#define I2CSR(BIT) FIELD_EX32(i2c->sts, I2CSR, BIT)
> +
> +#define I2CSR_SET(BIT, VAL) do {\
> +i2c->sts = FIELD_DP32(i2c->sts, I2CSR, BIT, VAL);\
> +} while (0)
> +
> +static
> +void mpc8540_update_irq(I2CState *i2c)
> +{
> +int ena = i2c->ctrl & 0x40,
> +sts = i2c->sts & 0x02,
> +act = !!(ena && sts);
> +
> +DPRINTK(1, "IRQ %c ena %c sts %c\n",
> +act ? 'X' : '_',
> +ena ? 'X' : '_',
> +sts ? 'X' : '_');
> +
> +qemu_set_irq(i2c->irq, act);
> +}
> +
> +static
> +uint64_t mpc8540_i2c_read(void *opaque, hwaddr addr, unsigned size)
> +{
> +I2CState *i2c = opaque;
> +uint32_t val, offset = addr;
> +
> +switch (offset) {
> +case R_I2CADR: /* ADDR */
> +val = 0;
> +break;
> +case R_I2CFDR: /* Freq Div. */
> +val = i2c->freq;
> +break;
> +case R_I2CCR: /* CONTROL */
> +val = i2c->ctrl & ~0x06;
> +break;
> +case R_I2CSR: /* STATUS */
> +val = i2c->sts;
> +break;
> +case R_I2CDR: /* DATA */
> +/* Reads are "pipelined" and so return the previous value of the
> + * register
> + */
> +val = i2c->dbuf;
> +if (I2CCR(MEN) && I2CSR(MBB)) { /* enabled and busy */
> +if (!i2c_bus_busy(i2c->bus) || I2CCR(MTX)) {
> +LOG(LOG_GUEST_ERROR, "Read during addr or tx\n");
> +i2c->dbuf = 0xff;
> +} else {
> +int ret = i2c_recv(i2c->bus);
> +i2c->dbuf = (uint8_t)ret;
> +DPRINTK(0, "READ %02x ('%c')\n", i2c->dbuf, (char)i2c->dbuf);
> +I2CSR_SET(MIF, 1);
> +I2CSR_SET(RXAK, 0);
> +mpc8540_update_irq(i2c);
> +}
> +} else {
> +i2c->dbuf = 0xff;
> +LOG(LOG_GUEST_ERROR, "Read when not enabled or busy\n");
> +}
> +break;
> +case R_I2CDFSRR: /* FILTER

Re: [Qemu-devel] [PATCH 02/12] e500: consolidate mpc8540 guts with e500-ccsr

On Sun, Nov 19, 2017 at 09:24:10PM -0600, Michael Davidsaver wrote:
> Preparation for adding more MPC control
> registers.
> 
> Use e500 SVR to enable part specific registers.
> Only the mpc8544 reset register at present.
> 
> Expose CCSR as SysBusDevice region to eliminate
> e500-ccsr.h.
> 
> Track CCSR base address within device, and map on reset,
> in preparation for CCSRBAR.
> 
> Signed-off-by: Michael Davidsaver 

Applied to ppc-for-2.12.

> ---
>  hw/pci-host/ppce500.c |  10 ++--
>  hw/ppc/Makefile.objs  |   3 +-
>  hw/ppc/e500-ccsr.h|  17 --
>  hw/ppc/e500.c |  37 +---
>  hw/ppc/e500_ccsr.c| 152 
> ++
>  hw/ppc/mpc8544_guts.c | 143 ---
>  6 files changed, 162 insertions(+), 200 deletions(-)
>  delete mode 100644 hw/ppc/e500-ccsr.h
>  create mode 100644 hw/ppc/e500_ccsr.c
>  delete mode 100644 hw/ppc/mpc8544_guts.c
> 
> diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
> index 39cd24464d..f2d108bc8a 100644
> --- a/hw/pci-host/ppce500.c
> +++ b/hw/pci-host/ppce500.c
> @@ -16,7 +16,6 @@
>  
>  #include "qemu/osdep.h"
>  #include "hw/hw.h"
> -#include "hw/ppc/e500-ccsr.h"
>  #include "hw/pci/pci.h"
>  #include "hw/pci/pci_host.h"
>  #include "qemu/bswap.h"
> @@ -420,16 +419,17 @@ static const VMStateDescription vmstate_ppce500_pci = {
>  static void e500_pcihost_bridge_realize(PCIDevice *d, Error **errp)
>  {
>  PPCE500PCIBridgeState *b = PPC_E500_PCI_BRIDGE(d);
> -PPCE500CCSRState *ccsr = CCSR(container_get(qdev_get_machine(),
> -  "/e500-ccsr"));
> +SysBusDevice *ccsr = SYS_BUS_DEVICE(container_get(qdev_get_machine(),
> +  "/e500-ccsr"));
> +MemoryRegion *ccsr_mr = sysbus_mmio_get_region(ccsr, 0);
>  
>  pci_config_set_class(d->config, PCI_CLASS_BRIDGE_PCI);
>  d->config[PCI_HEADER_TYPE] =
>  (d->config[PCI_HEADER_TYPE] & PCI_HEADER_TYPE_MULTI_FUNCTION) |
>  PCI_HEADER_TYPE_BRIDGE;
>  
> -memory_region_init_alias(>bar0, OBJECT(ccsr), "e500-pci-bar0", 
> >ccsr_space,
> - 0, int128_get64(ccsr->ccsr_space.size));
> +memory_region_init_alias(>bar0, OBJECT(ccsr), "e500-pci-bar0", 
> ccsr_mr,
> + 0, memory_region_size(ccsr_mr));
>  pci_register_bar(d, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, >bar0);
>  }
>  
> diff --git a/hw/ppc/Makefile.objs b/hw/ppc/Makefile.objs
> index 7efc686748..c1a63d0c39 100644
> --- a/hw/ppc/Makefile.objs
> +++ b/hw/ppc/Makefile.objs
> @@ -24,6 +24,7 @@ obj-$(CONFIG_MAC) += mac_oldworld.o
>  obj-$(CONFIG_MAC) += mac_newworld.o
>  # e500
>  obj-$(CONFIG_E500) += e500.o mpc8544ds.o e500plat.o
> -obj-$(CONFIG_E500) += mpc8544_guts.o ppce500_spin.o
> +obj-$(CONFIG_E500) += ppce500_spin.o
> +obj-$(CONFIG_E500) += e500_ccsr.o
>  # PowerPC 440 Xilinx ML507 reference board.
>  obj-$(CONFIG_XILINX) += virtex_ml507.o
> diff --git a/hw/ppc/e500-ccsr.h b/hw/ppc/e500-ccsr.h
> deleted file mode 100644
> index 12a2ba4b97..00
> --- a/hw/ppc/e500-ccsr.h
> +++ /dev/null
> @@ -1,17 +0,0 @@
> -#ifndef E500_CCSR_H
> -#define E500_CCSR_H
> -
> -#include "hw/sysbus.h"
> -
> -typedef struct PPCE500CCSRState {
> -/*< private >*/
> -SysBusDevice parent;
> -/*< public >*/
> -
> -MemoryRegion ccsr_space;
> -} PPCE500CCSRState;
> -
> -#define TYPE_CCSR "e500-ccsr"
> -#define CCSR(obj) OBJECT_CHECK(PPCE500CCSRState, (obj), TYPE_CCSR)
> -
> -#endif /* E500_CCSR_H */
> diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
> index 9e7e1b29c4..474a46a985 100644
> --- a/hw/ppc/e500.c
> +++ b/hw/ppc/e500.c
> @@ -15,10 +15,10 @@
>   */
>  
>  #include "qemu/osdep.h"
> +#include "qemu/log.h"
>  #include "qapi/error.h"
>  #include "qemu-common.h"
>  #include "e500.h"
> -#include "e500-ccsr.h"
>  #include "net/net.h"
>  #include "qemu/config-file.h"
>  #include "hw/hw.h"
> @@ -795,7 +795,6 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  CPUPPCState *firstenv = NULL;
>  MemoryRegion *ccsr_addr_space;
>  SysBusDevice *s;
> -PPCE500CCSRState *ccsr;
>  
>  irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
>  irqs[0] = g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
> @@ -854,11 +853,9 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  dev = qdev_create(NULL, "e500-ccsr");
>  object_property_add_child(qdev_get_machine(), "e500-ccsr",
>OBJECT(dev), NULL);
> +qdev_prop_set_uint32(dev, "base", params->ccsrbar_base);
>  qdev_init_nofail(dev);
> -ccsr = CCSR(dev);
> -ccsr_addr_space = >ccsr_space;
> -memory_region_add_subregion(address_space_mem, params->ccsrbar_base,
> -ccsr_addr_space);
> +ccsr_addr_space = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
>  
>  mpicdev = ppce500_init_mpic(machine,

Re: [Qemu-devel] [PATCH 04/12] e500: additional CCSR registers

On Sun, Nov 19, 2017 at 09:24:12PM -0600, Michael Davidsaver wrote:
> Add CCSRBAR to allow CCSR region to be relocated.
> Guest memory size introspection.
> Dummy RAM error controls.
> Guest clock introspection.
> 
> Signed-off-by: Michael Davidsaver 

Looks fine from the POV of someone who doesn't know details about
e500.

Reviewed-by: David Gibson 

> ---
>  hw/ppc/e500.c  |  2 ++
>  hw/ppc/e500.h  |  1 +
>  hw/ppc/e500_ccsr.c | 72 
> --
>  hw/ppc/e500plat.c  |  1 +
>  hw/ppc/mpc8544ds.c |  1 +
>  5 files changed, 75 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
> index 474a46a985..057be1751b 100644
> --- a/hw/ppc/e500.c
> +++ b/hw/ppc/e500.c
> @@ -853,7 +853,9 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  dev = qdev_create(NULL, "e500-ccsr");
>  object_property_add_child(qdev_get_machine(), "e500-ccsr",
>OBJECT(dev), NULL);
> +qdev_prop_set_uint32(dev, "porpllsr", params->porpllsr);
>  qdev_prop_set_uint32(dev, "base", params->ccsrbar_base);
> +qdev_prop_set_uint32(dev, "ram-size", ram_size);
>  qdev_init_nofail(dev);
>  ccsr_addr_space = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
>  
> diff --git a/hw/ppc/e500.h b/hw/ppc/e500.h
> index 40f72f2de2..1f39095dfa 100644
> --- a/hw/ppc/e500.h
> +++ b/hw/ppc/e500.h
> @@ -22,6 +22,7 @@ typedef struct PPCE500Params {
>  hwaddr pci_mmio_base;
>  hwaddr pci_mmio_bus_base;
>  hwaddr spin_base;
> +uint32_t porpllsr; /* value of PORPLLSR register */
>  uint32_t decrementor_freq; /* in Hz */
>  bool skip_load;
>  bool tsec_nic;
> diff --git a/hw/ppc/e500_ccsr.c b/hw/ppc/e500_ccsr.c
> index 1b586c3f42..c58b17f06b 100644
> --- a/hw/ppc/e500_ccsr.c
> +++ b/hw/ppc/e500_ccsr.c
> @@ -31,6 +31,16 @@
>  
>  /* E500_ denotes registers common to all */
>  
> +#define E500_CCSRBAR (0)
> +
> +#define E500_CS0_BNDS(0x2000)
> +
> +#define E500_CS0_CONFIG  (0x2080)
> +
> +#define E500_ERR_DETECT  (0x2e40)
> +#define E500_ERR_DISABLE (0x2e44)
> +
> +#define E500_PORPLLSR(0xE)
>  #define E500_PVR (0xE00A0)
>  #define E500_SVR (0xE00A4)
>  
> @@ -44,7 +54,11 @@ typedef struct {
>  
>  MemoryRegion iomem;
>  
> -uint32_t defbase;
> +uint32_t defbase, base;
> +uint32_t ram_size;
> +uint32_t merrd;
> +
> +uint32_t porpllsr;
>  } CCSRState;
>  
>  #define TYPE_E500_CCSR "e500-ccsr"
> @@ -53,10 +67,28 @@ typedef struct {
>  static uint64_t e500_ccsr_read(void *opaque, hwaddr addr,
>unsigned size)
>  {
> +CCSRState *ccsr = opaque;
>  PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
>  CPUPPCState *env = >env;
>  
>  switch (addr) {
> +case E500_CCSRBAR:
> +return ccsr->base >> 12;
> +case E500_CS0_BNDS:
> +/* we model all RAM in a single chip with addresses [0, ram_size) */
> +return (ccsr->ram_size - 1) >> 24;
> +case E500_CS0_CONFIG:
> +return 1 << 31;
> +case E500_ERR_DETECT:
> +return 0; /* (errors not modeled) */
> +case E500_ERR_DISABLE:
> +return ccsr->merrd;
> +case E500_PORPLLSR:
> +if (!ccsr->porpllsr) {
> +qemu_log_mask(LOG_UNIMP,
> +  "Machine does not provide valid PORPLLSR\n");
> +}
> +return ccsr->porpllsr;
>  case E500_PVR:
>  return env->spr[SPR_PVR];
>  case E500_SVR:
> @@ -72,10 +104,22 @@ static uint64_t e500_ccsr_read(void *opaque, hwaddr addr,
>  static void e500_ccsr_write(void *opaque, hwaddr addr,
> uint64_t value, unsigned size)
>  {
> +CCSRState *ccsr = opaque;
>  PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
>  CPUPPCState *env = >env;
>  uint32_t svr = env->spr[SPR_E500_SVR] >> 16;
>  
> +switch (addr) {
> +case E500_CCSRBAR:
> +value &= 0x000fff00;
> +ccsr->base = value << 12;
> +sysbus_mmio_map(SYS_BUS_DEVICE(ccsr), 0, ccsr->base);
> +return;
> +case E500_ERR_DISABLE:
> +ccsr->merrd = value & 0xd;
> +return;
> +}
> +
>  switch (svr) {
>  case 0: /* generic.  assumed to be mpc8544ds or e500plat board */
>  case 0x8034: /* mpc8544 */
> @@ -104,11 +148,20 @@ static const MemoryRegionOps e500_ccsr_ops = {
>  }
>  };
>  
> +static int e500_ccsr_post_load(void *opaque, int version_id)
> +{
> +CCSRState *ccsr = opaque;
> +
> +sysbus_mmio_map(SYS_BUS_DEVICE(ccsr), 0, ccsr->base);
> +return 0;
> +}
> +
>  static void e500_ccsr_reset(DeviceState *dev)
>  {
>  CCSRState *ccsr = E500_CCSR(dev);
>  
> -sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, ccsr->defbase);
> +ccsr->base = ccsr->defbase;
> +e500_ccsr_post_load(ccsr, 1);
>  }
>  
>  static void e500_ccsr_initfn(Object *obj)
> @@ -123,15 +176,30 @@ static void

Re: [Qemu-devel] [PATCH 05/12] e500: name openpic and pci host bridge

On Sun, Nov 19, 2017 at 09:24:13PM -0600, Michael Davidsaver wrote:
> Signed-off-by: Michael Davidsaver 

Applied to ppc-for-2.12.

> ---
>  hw/ppc/e500.c | 4 
>  1 file changed, 4 insertions(+)
> 
> diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
> index 057be1751b..6f77844303 100644
> --- a/hw/ppc/e500.c
> +++ b/hw/ppc/e500.c
> @@ -685,6 +685,8 @@ static DeviceState *ppce500_init_mpic_qemu(PPCE500Params 
> *params,
>  int i, j, k;
>  
>  dev = qdev_create(NULL, TYPE_OPENPIC);
> +object_property_add_child(qdev_get_machine(), "pic", OBJECT(dev),
> +  _fatal);
>  qdev_prop_set_uint32(dev, "model", params->mpic_version);
>  qdev_prop_set_uint32(dev, "nb_cpus", smp_cpus);
>  
> @@ -876,6 +878,8 @@ void ppce500_init(MachineState *machine, PPCE500Params 
> *params)
>  
>  /* PCI */
>  dev = qdev_create(NULL, "e500-pcihost");
> +object_property_add_child(qdev_get_machine(), "pci-host", OBJECT(dev),
> +  _abort);
>  qdev_prop_set_uint32(dev, "first_slot", params->pci_first_slot);
>  qdev_prop_set_uint32(dev, "first_pin_irq", pci_irq_nrs[0]);
>  qdev_init_nofail(dev);

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [PATCH 03/12] e500: note possible bug with host bridge

On Sun, Nov 19, 2017 at 09:24:11PM -0600, Michael Davidsaver wrote:
> Signed-off-by: Michael Davidsaver 

I'm not sure if you're saying you think there is a hardware bug which
we're faithfully emulating, or a software bug.

> ---
>  hw/pci-host/ppce500.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
> index f2d108bc8a..0e2833bd98 100644
> --- a/hw/pci-host/ppce500.c
> +++ b/hw/pci-host/ppce500.c
> @@ -424,6 +424,9 @@ static void e500_pcihost_bridge_realize(PCIDevice *d, 
> Error **errp)
>  MemoryRegion *ccsr_mr = sysbus_mmio_get_region(ccsr, 0);
>  
>  pci_config_set_class(d->config, PCI_CLASS_BRIDGE_PCI);
> +/* BUG? identifies as PCI_HEADER_TYPE_BRIDGE but uses
> + * standard device config read/write
> + */
>  d->config[PCI_HEADER_TYPE] =
>  (d->config[PCI_HEADER_TYPE] & PCI_HEADER_TYPE_MULTI_FUNCTION) |
>  PCI_HEADER_TYPE_BRIDGE;

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [PATCH 10/12] timer: add ds1375 RTC

On Sun, Nov 19, 2017 at 09:24:18PM -0600, Michael Davidsaver wrote:
> only basic functionality implemented (read time and sram).
> no set time or alarms.
> 
> Signed-off-by: Michael Davidsaver 

I know there about a zillion different Dallas/Maxim sram/rtc chips,
many of which have a lot of similarities.  Is it possible to share any
code with the existing hw/timer/ds1338.c?

> ---
>  default-configs/ppc-softmmu.mak |   1 +
>  hw/timer/Makefile.objs  |   1 +
>  hw/timer/ds1375-i2c.c   | 293 
> 
>  3 files changed, 295 insertions(+)
>  create mode 100644 hw/timer/ds1375-i2c.c
> 
> diff --git a/default-configs/ppc-softmmu.mak b/default-configs/ppc-softmmu.mak
> index bb225c6e46..04bfa79154 100644
> --- a/default-configs/ppc-softmmu.mak
> +++ b/default-configs/ppc-softmmu.mak
> @@ -52,3 +52,4 @@ CONFIG_SERIAL_ISA=y
>  CONFIG_MC146818RTC=y
>  CONFIG_ISA_TESTDEV=y
>  CONFIG_RS6000_MC=y
> +CONFIG_DS1375=y
> diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
> index 8c19eac3b6..6521d47367 100644
> --- a/hw/timer/Makefile.objs
> +++ b/hw/timer/Makefile.objs
> @@ -4,6 +4,7 @@ common-obj-$(CONFIG_ARM_V7M) += armv7m_systick.o
>  common-obj-$(CONFIG_A9_GTIMER) += a9gtimer.o
>  common-obj-$(CONFIG_CADENCE) += cadence_ttc.o
>  common-obj-$(CONFIG_DS1338) += ds1338.o
> +common-obj-$(CONFIG_DS1375) += ds1375-i2c.o
>  common-obj-$(CONFIG_HPET) += hpet.o
>  common-obj-$(CONFIG_I8254) += i8254_common.o i8254.o
>  common-obj-$(CONFIG_M48T59) += m48t59.o
> diff --git a/hw/timer/ds1375-i2c.c b/hw/timer/ds1375-i2c.c
> new file mode 100644
> index 00..dba9cc05c4
> --- /dev/null
> +++ b/hw/timer/ds1375-i2c.c
> @@ -0,0 +1,293 @@
> +/*
> + * Dallas/Maxim ds1375 I2C RTC w/ SRAM
> + *
> + * Copyright (c) 2017 Michael Davidsaver
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2.  See
> + * the LICENSE file in the top-level directory.
> + *
> + * Only basic functionality is modeled (time and user SRAM).
> + * Alarms not modeled.
> + */
> +#include "qemu/osdep.h"
> +#include "qemu-common.h"
> +#include "qemu/log.h"
> +#include "qemu/timer.h"
> +#include "qemu/bcd.h"
> +#include "hw/hw.h"
> +#include "hw/registerfields.h"
> +#include "hw/i2c/i2c.h"
> +
> +#define DEBUG_DS1375
> +
> +#ifdef DEBUG_DS1375
> +#define DPRINTK(FMT, ...) printf(TYPE_DS1375 " : " FMT, ## __VA_ARGS__)
> +#else
> +#define DPRINTK(FMT, ...) do {} while (0)
> +#endif
> +
> +#define LOG(MSK, FMT, ...) qemu_log_mask(MSK, TYPE_DS1375 " : " FMT, \
> +## __VA_ARGS__)
> +
> +#define TYPE_DS1375 "ds1375"
> +#define DS1375(obj) OBJECT_CHECK(DS1375State, (obj), TYPE_DS1375)
> +
> +#define DS1375_REGSIZE 0x20
> +
> +#define R_SEC   (0x0)
> +#define R_MIN   (0x1)
> +#define R_HOUR  (0x2)
> +#define R_WDAY  (0x3)
> +#define R_DATE  (0x4)
> +#define R_MONTH (0x5)
> +#define R_YEAR  (0x6)
> +#define R_A1SEC   (0x7)
> +#define R_A1MIN   (0x8)
> +#define R_A1HOUR  (0x9)
> +#define R_A1DAY   (0xa)
> +#define R_A2SEC   (0xb)
> +#define R_A2MIN   (0xc)
> +#define R_A2HOUR  (0xd)
> +#define R_CTRL  (0xe)
> +#define R_STS   (0xf)
> +
> +FIELD(HOUR, SET12, 6, 1)
> +FIELD(HOUR, HOUR24, 0, 6)
> +FIELD(HOUR, AMPM, 5, 1)
> +FIELD(HOUR, HOUR12, 0, 5)
> +
> +FIELD(MONTH, MONTH, 0, 5)
> +FIELD(MONTH, CENTURY, 7, 1)
> +
> +FIELD(CTRL, ECLK, 7, 1)
> +FIELD(CTRL, CLKSEL, 5, 2)
> +FIELD(CTRL, RS, 3, 2)
> +FIELD(CTRL, INTCN, 2, 1)
> +FIELD(CTRL, A2IE, 1, 1)
> +FIELD(CTRL, A1IE, 0, 1)
> +
> +typedef struct DS1375State {
> +I2CSlave parent_obj;
> +
> +/* register address counter */
> +uint8_t addr;
> +/* when writing, whether the address has been sent */
> +bool addrd;
> +
> +int time_offset;
> +
> +uint8_t regs[DS1375_REGSIZE];
> +} DS1375State;
> +
> +/* update current time register if clock enabled */
> +static
> +void ds1375_latch(DS1375State *ds)
> +{
> +struct tm now;
> +
> +if (!ARRAY_FIELD_EX32(ds->regs, CTRL, ECLK)) {
> +return;
> +}
> +
> +qemu_get_timedate(, ds->time_offset);
> +
> +DPRINTK("Current Time %3u/%2u/%u %2u:%2u:%2u (wday %u)\n",
> +now.tm_year, now.tm_mon, now.tm_mday,
> +now.tm_hour, now.tm_min, now.tm_sec,
> +now.tm_wday);
> +
> +/* ensure unused bits are zero */
> +memset(ds->regs, 0, R_YEAR + 1);
> +
> +ds->regs[R_SEC] = to_bcd(now.tm_sec);
> +ds->regs[R_MIN] = to_bcd(now.tm_min);
> +
> +if (ARRAY_FIELD_EX32(ds->regs, HOUR, SET12) == 0) {
> +/* 24 hour */
> +ARRAY_FIELD_DP32(ds->regs, HOUR, HOUR24, to_bcd(now.tm_hour));
> +} else {
> +/* 12 hour am/pm */
> +ARRAY_FIELD_DP32(ds->regs, HOUR, AMPM, now.tm_hour >= 12);
> +ARRAY_FIELD_DP32(ds->regs, HOUR, HOUR12, to_bcd(now.tm_hour % 12u));
> +}
> +
> +ds->regs[R_WDAY] = now.tm_wday; /* day of the week */
> +ds->regs[R_DATE] = to_bcd(now.tm_mday);
> +
> +ARRAY_FIELD_DP32(ds->regs, MONTH, MONTH, to_bcd(now.tm_mon +

Re: [Qemu-devel] [ANNOUNCE] QEMU 2.11.0-rc2 is now available

2017-11-21 Thread Michael Roth

Quoting Christian Borntraeger (2017-11-21 15:38:32)
> forgot to cc qemu-devel
> 
> On 11/21/2017 10:37 PM, Christian Borntraeger wrote:
> > a quick heads up . Rc2 now triggers
> > +qemu-img: block/block-backend.c:2088: blk_root_drained_end: Assertion 
> > `blk->quiesce_counter' failed.
> > for several qemu iotests. 
> > 
> > I have not looked into any details.

It looks to be due to:

4afeffc8572f40d8844b946a30c00b10da4442b1
blockjob: do not allow coroutine double entry or entry-after-completion

> > 
> > Christian
> > 
> > On 11/21/2017 08:08 PM, Michael Roth wrote:
> >> Hello,
> >>
> >> On behalf of the QEMU Team, I'd like to announce the availability of the
> >> third release candidate for the QEMU 2.11 release.  This release is meant
> >> for testing purposes and should not be used in a production environment.
> >>
> >>   http://download.qemu-project.org/qemu-2.11.0-rc2.tar.xz
> >>   http://download.qemu-project.org/qemu-2.11.0-rc2.tar.xz.sig
> >>
> >> You can help improve the quality of the QEMU 2.11 release by testing this
> >> release and reporting bugs on Launchpad:
> >>
> >>   https://bugs.launchpad.net/qemu/
> >>
> >> The release plan, as well a documented known issues for release
> >> candidates, are available at:
> >>
> >>   http://wiki.qemu.org/Planning/2.11
> >>
> >> Please add entries to the ChangeLog for the 2.11 release below:
> >>
> >>   http://wiki.qemu.org/ChangeLog/2.11
> >>
> >> Changes since rc1:
> >>
> >> a15d835f00: Update version for v2.11.0-rc2 release (Peter Maydell)
> >> d975301dc8: qemu-iotest: add test for blockjob coroutine race condition 
> >> (Jeff Cody)
> >> a2339699c3: qemu-iotests: add option in common.qemu for mismatch only 
> >> (Jeff Cody)
> >> 6133b39f3c: coroutine: abort if we try to schedule or enter a pending 
> >> coroutine (Jeff Cody)
> >> 4afeffc857: blockjob: do not allow coroutine double entry or 
> >> entry-after-completion (Jeff Cody)
> >> 7c3d1917fd: build: disarm the TCG unit test trap (Daniel P. Berrange)
> >> 2807746ff1: iotests: Fix 176 on 32-bit host (Eric Blake)
> >> 50a3efb0f0: block: Close a BlockDriverState completely even when bs->drv 
> >> is NULL (Alberto Garcia)
> >> 70a5afedd6: block: Error out on load_vm with active dirty bitmaps (Kevin 
> >> Wolf)
> >> 2b624fe079: block: Add errp to bdrv_all_goto_snapshot() (Kevin Wolf)
> >> 0b62bcbc61: block: Add errp to bdrv_snapshot_goto() (Kevin Wolf)
> >> 1f4ad7d3b8: block: Don't request I/O permission with BDRV_O_NO_IO (Kevin 
> >> Wolf)
> >> dacaa16238: block: Don't use BLK_PERM_CONSISTENT_READ for format probing 
> >> (Kevin Wolf)
> >> 70b7fba987: Use HTTPS for qemu.org and other domains (Stefan Hajnoczi)
> >> 1b3bbc6887: Use qemu.org domain name (Stefan Hajnoczi)
> >> d0dead3b6d: scripts/make-release: ship u-boot source as a tarball (Michael 
> >> Roth)
> >> 34d49937e4: accel/tcg: Handle atomic accesses to notdirty memory correctly 
> >> (Peter Maydell)
> >> 2726627197: exec.c: Factor out before/after actions for notdirty memory 
> >> writes (Peter Maydell)
> >> df83eabd52: qga: replace GetIfEntry with GetIfEntry2 for interface stats 
> >> (ZhiPeng Lu)
> >> 6cbf1ec85c: pc-bios/s390-ccw.img: update image (Cornelia Huck)
> >> f516511ea8: linux-user: Fix calculation of auxv length (Peter Maydell)
> >> b350ae138f: hw/arm: Silence xlnx-ep108 deprecation warning during tests 
> >> (Thomas Huth)
> >> b6e70d1d7f: hw/arm/aspeed: Unlock SCU when running kernel (Joel Stanley)
> >> 50cd71b0d3: arm: check regime, not current state, for ATS write PAR format 
> >> (Peter Maydell)
> >> 2b75ef01ca: nvic: Fix ARMv7M MPU_RBAR reads (Peter Maydell)
> >> 96a8b92ed8: target/arm: Report GICv3 sysregs present in ID registers if 
> >> needed (Peter Maydell)
> >> b11ce33fe0: Revert "cpu-exec: don't overwrite exception_index" (Peter 
> >> Maydell)
> >> 8775d91a0f: pc-bios/s390-ccw: Fix problem with invalid virtio-scsi LUN 
> >> when rebooting (Thomas Huth)
> >> 7337c6eb98: s390x/tcg: fix DIAG 308 with > 1 VCPU (MTTCG) (David 
> >> Hildenbrand)
> >> dc0bbef5e6: s390x: fix storing CPU status (again) (David Hildenbrand)
> >> c527e0afcd: hw/net/vmxnet3: Fix code to work on big endian hosts, too 
> >> (Thomas Huth)
> >> 0dacea92d2: net: Transmit zero UDP checksum as 0x (Ed Swierk)
> >> ebc2327f07: MAINTAINERS: Add missing entry for eepro100 emulation (Stefan 
> >> Weil)
> >> 8f8e8053d9: hw/net/eepro100: Fix endianness problem on big endian hosts 
> >> (Thomas Huth)
> >> 2ec405524e: Revert "Add new PCI ID for i82559a" (Jason Wang)
> >> 4d36623520: colo-compare: fix the dangerous assignment (Mao Zhongyi)
> >> 8251248394: spapr: reset DRCs after devices (Greg Kurz)
> >> 7abd43baec: target/ppc: Update setting of cpu features to account for 
> >> compat modes (Suraj Jitindar Singh)
> >> c0012e9a22: iotests: Make 087 pass without AIO enabled (Max Reitz)
> >> 5e003f17ec: block: Make bdrv_next() keep strong references (Max Reitz)
> >> 08546bcfb2: qcow2: Fix overly broad madvise() (Max Reitz)
> >> 4efb1f7c61: qcow2: Refuse to

Re: [Qemu-devel] [PATCH for-2.12 v3 2/3] spapr/rtas: fix reboot of a a SMP TCG guest

On Mon, Nov 20, 2017 at 11:03:46AM +0100, Cédric Le Goater wrote:
> Just like for hot unplug CPUs, when a guest is rebooted, the secondary
> CPUs can be awaken by the decrementer and start entering SLOF at the
> same time the boot CPU is.
> 
> To be safe, let's disable on the secondaries all the exceptions which
> can cause an exit while the CPU is in power-saving mode.
> 
> Based on previous work from Nikunj A Dadhania 
> 
> Signed-off-by: Cédric Le Goater 

Reviewed-by: David Gibson 

but not applying pending an update on 1/3.

> ---
> 
> Changes in v3:
> 
>  - used the cpu_ppc_papr_pece_bits() helper 
> 
>  hw/ppc/spapr_cpu_core.c | 7 +++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
> index 3a4c17401226..4ba8563d49e4 100644
> --- a/hw/ppc/spapr_cpu_core.c
> +++ b/hw/ppc/spapr_cpu_core.c
> @@ -35,6 +35,13 @@ static void spapr_cpu_reset(void *opaque)
>  cs->halted = 1;
>  
>  env->spr[SPR_HIOR] = 0;
> +
> +/* Disable Power-saving mode Exit Cause exceptions for the CPU.
> + * This can cause issues when rebooting the guest if a secondary
> + * is awaken */
> +if (cs != first_cpu) {
> +env->spr[SPR_LPCR] &= ~cpu_ppc_papr_pece_bits(env);
> +}
>  }
>  
>  static void spapr_cpu_destroy(PowerPCCPU *cpu)

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [PATCH for-2.12 v3 1/3] spapr/rtas: disable the decrementer interrupt when a CPU is unplugged

On Mon, Nov 20, 2017 at 11:03:45AM +0100, Cédric Le Goater wrote:
> When a CPU is stopped with the 'stop-self' RTAS call, its state
> 'halted' is switched to 1 and, in this case, the MSR is not taken into
> account anymore in the cpu_has_work() routine. Only the pending
> hardware interrupts are checked with their LPCR:PECE* enablement bit.
> 
> If the DECR timer fires after 'stop-self' is called and before the CPU
> 'stop' state is reached, the nearly-dead CPU will have some work to do
> and the guest will crash. This case happens very frequently with the
> not yet upstream P9 XIVE exploitation mode. In XICS mode, the DECR is
> occasionally fired but after 'stop' state, so no work is to be done
> and the guest survives.
> 
> I suspect there is a race between the QEMU mainloop triggering the
> timers and the TCG CPU thread but I could not quite identify the root
> cause. To be safe, let's disable in the LPCR all the exceptions which
> can cause an exit while the CPU is in power-saving mode and reenable
> them when the CPU is started.
> 
> For this purpose, we introduce a little helper routine to calculate
> the PECE bits for a processor variant. We could also use the mask
> value LPCR_PECE_L_MASK for the P8 and P9 processors. bit 47 and 48 are
> reserved on P7 but it is still compatible.
> 
> Signed-off-by: Cédric Le Goater 

I'm not thrilled about addressing this without 100% knowing what's
going on, but this seems like a sensible change in any case, so I'm ok
with applying something like this.

A detail however..

[snip]
>  #if !defined(CONFIG_USER_ONLY)
> +
> +target_ulong cpu_ppc_papr_pece_bits(CPUPPCState *env)
> +{
> +switch (env->mmu_model) {
> +case POWERPC_MMU_3_00:
> +return LPCR_PDEE | LPCR_HDEE | LPCR_EEE | LPCR_DEE | LPCR_OEE;
> +default:
> +/* P7 and P8 has slightly different PECE bits, mostly because P8 adds
> + * bit 47 and 48 which are reserved on P7. Here we set them all, 
> which
> + * will work as expected for both implementations
> + */
> +return LPCR_P8_PECE0 | LPCR_P8_PECE1 | LPCR_P8_PECE2 | LPCR_P8_PECE3 
> |
> +LPCR_P8_PECE4;
> +}
> +}

..since we're working in this area, might as well clean up this
inappropriate use of mmu_model.  Two options which I'd be ok with:

1) Add a pece_bits field to the PowerPCCPUClass, correctly initialized
for the various processors.

2) A similar helper but using ppc_check_compat() to check the arch
level, instead of using env->mmu_model.
-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

[Qemu-devel] [PATCH v4 3/4] hw/block: Use errp directly rather than local_err

Cc: John Snow 
Cc: Kevin Wolf 
Cc: Max Reitz 
Cc: Keith Busch 
Cc: Stefan Hajnoczi 
Cc: "Michael S. Tsirkin" 
Cc: Paolo Bonzini 
Cc: Gerd Hoffmann 
Cc: Markus Armbruster 

Signed-off-by: Mao Zhongyi 
Reviewed-by: Stefan Hajnoczi 
---
 hw/block/fdc.c| 17 ++---
 hw/block/nvme.c   |  7 ++-
 hw/block/virtio-blk.c | 18 ++
 hw/ide/qdev.c | 12 
 hw/scsi/scsi-disk.c   | 13 -
 hw/usb/dev-storage.c  |  9 +++--
 6 files changed, 25 insertions(+), 51 deletions(-)

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 67f78ac..7b7dd41 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -473,16 +473,13 @@ static void fd_revalidate(FDrive *drv)
 static void fd_change_cb(void *opaque, bool load, Error **errp)
 {
 FDrive *drive = opaque;
-Error *local_err = NULL;
 
 if (!load) {
 blk_set_perm(drive->blk, 0, BLK_PERM_ALL, _abort);
 } else {
-blkconf_apply_backend_options(drive->conf,
-  blk_is_read_only(drive->blk), false,
-  _err);
-if (local_err) {
-error_propagate(errp, local_err);
+if (!blkconf_apply_backend_options(drive->conf,
+   blk_is_read_only(drive->blk), false,
+   errp)) {
 return;
 }
 }
@@ -522,7 +519,6 @@ static void floppy_drive_realize(DeviceState *qdev, Error 
**errp)
 FloppyDrive *dev = FLOPPY_DRIVE(qdev);
 FloppyBus *bus = FLOPPY_BUS(qdev->parent_bus);
 FDrive *drive;
-Error *local_err = NULL;
 int ret;
 
 if (dev->unit == -1) {
@@ -568,10 +564,9 @@ static void floppy_drive_realize(DeviceState *qdev, Error 
**errp)
 dev->conf.rerror = BLOCKDEV_ON_ERROR_AUTO;
 dev->conf.werror = BLOCKDEV_ON_ERROR_AUTO;
 
-blkconf_apply_backend_options(>conf, blk_is_read_only(dev->conf.blk),
-  false, _err);
-if (local_err) {
-error_propagate(errp, local_err);
+if (!blkconf_apply_backend_options(>conf,
+   blk_is_read_only(dev->conf.blk),
+   false, errp)) {
 return;
 }
 
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index e530ba7..e529e88 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -928,7 +928,6 @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
 int i;
 int64_t bs_size;
 uint8_t *pci_conf;
-Error *local_err = NULL;
 
 if (!n->conf.blk) {
 error_setg(errp, "drive property not set");
@@ -947,10 +946,8 @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
 return;
 }
 blkconf_blocksizes(>conf);
-blkconf_apply_backend_options(>conf, blk_is_read_only(n->conf.blk),
-  false, _err);
-if (local_err) {
-error_propagate(errp, local_err);
+if (!blkconf_apply_backend_options(>conf, blk_is_read_only(n->conf.blk),
+   false, errp)) {
 return;
 }
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 05d1440..ae3356f 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -913,7 +913,6 @@ static void virtio_blk_device_realize(DeviceState *dev, 
Error **errp)
 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 VirtIOBlock *s = VIRTIO_BLK(dev);
 VirtIOBlkConf *conf = >conf;
-Error *err = NULL;
 unsigned i;
 
 if (!conf->conf.blk) {
@@ -930,19 +929,16 @@ static void virtio_blk_device_realize(DeviceState *dev, 
Error **errp)
 }
 
 blkconf_serial(>conf, >serial);
-blkconf_apply_backend_options(>conf,
-  blk_is_read_only(conf->conf.blk), true,
-  );
-if (err) {
-error_propagate(errp, err);
+if (!blkconf_apply_backend_options(>conf,
+   blk_is_read_only(conf->conf.blk), true,
+   errp)) {
 return;
 }
 s->original_wce = blk_enable_write_cache(conf->conf.blk);
-blkconf_geometry(>conf, NULL, 65535, 255, 255, );
-if (err) {
-error_propagate(errp, err);
+if (!blkconf_geometry(>conf, NULL, 65535, 255, 255, errp)) {
 return;
 }
+
 blkconf_blocksizes(>conf);
 
 virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK,
@@ -955,9 +951,7 @@ static void virtio_blk_device_realize(DeviceState *dev, 
Error **errp)
 for (i = 0; i < conf->num_queues; i++) {
 virtio_add_queue(vdev, 128, virtio_blk_handle_output);
 }
-virtio_blk_data_plane_create(vdev, conf, >dataplane, );
-if (err != NULL) {
-error_propagate(errp, err);
+

[Qemu-devel] [PATCH v4 4/4] dev-storage: Fix the unusual function name

The function name of usb_msd_{realize,unrealize}_*,
usb_msd_class_initfn_* are unusual. Rename it to
usb_msd_*_{realize,unrealize}, usb_msd_class_*_initfn.

Cc: Gerd Hoffmann 

Signed-off-by: Mao Zhongyi 
Reviewed-by: Philippe Mathieu-Daudé 
---
 hw/usb/dev-storage.c | 20 ++--
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index a9bcc67..9722ac8 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -596,7 +596,7 @@ static void usb_msd_unrealize_storage(USBDevice *dev, Error 
**errp)
 object_unref(OBJECT(>bus));
 }
 
-static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
+static void usb_msd_storage_realize(USBDevice *dev, Error **errp)
 {
 MSDState *s = USB_STORAGE_DEV(dev);
 BlockBackend *blk = s->conf.blk;
@@ -643,14 +643,14 @@ static void usb_msd_realize_storage(USBDevice *dev, Error 
**errp)
 s->scsi_dev = scsi_dev;
 }
 
-static void usb_msd_unrealize_bot(USBDevice *dev, Error **errp)
+static void usb_msd_bot_unrealize(USBDevice *dev, Error **errp)
 {
 MSDState *s = USB_STORAGE_DEV(dev);
 
 object_unref(OBJECT(>bus));
 }
 
-static void usb_msd_realize_bot(USBDevice *dev, Error **errp)
+static void usb_msd_bot_realize(USBDevice *dev, Error **errp)
 {
 MSDState *s = USB_STORAGE_DEV(dev);
 DeviceState *d = DEVICE(dev);
@@ -764,12 +764,12 @@ static void usb_msd_class_initfn_common(ObjectClass 
*klass, void *data)
 dc->vmsd = _usb_msd;
 }
 
-static void usb_msd_class_initfn_storage(ObjectClass *klass, void *data)
+static void usb_msd_class_storage_initfn(ObjectClass *klass, void *data)
 {
 DeviceClass *dc = DEVICE_CLASS(klass);
 USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 
-uc->realize = usb_msd_realize_storage;
+uc->realize = usb_msd_storage_realize;
 uc->unrealize = usb_msd_unrealize_storage;
 dc->props = msd_properties;
 }
@@ -828,26 +828,26 @@ static void usb_msd_instance_init(Object *obj)
 object_property_set_int(obj, -1, "bootindex", NULL);
 }
 
-static void usb_msd_class_initfn_bot(ObjectClass *klass, void *data)
+static void usb_msd_class_bot_initfn(ObjectClass *klass, void *data)
 {
 USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 
-uc->realize = usb_msd_realize_bot;
-uc->unrealize = usb_msd_unrealize_bot;
+uc->realize = usb_msd_bot_realize;
+uc->unrealize = usb_msd_bot_unrealize;
 uc->attached_settable = true;
 }
 
 static const TypeInfo msd_info = {
 .name  = "usb-storage",
 .parent= TYPE_USB_STORAGE,
-.class_init= usb_msd_class_initfn_storage,
+.class_init= usb_msd_class_storage_initfn,
 .instance_init = usb_msd_instance_init,
 };
 
 static const TypeInfo bot_info = {
 .name  = "usb-bot",
 .parent= TYPE_USB_STORAGE,
-.class_init= usb_msd_class_initfn_bot,
+.class_init= usb_msd_class_bot_initfn,
 };
 
 static void usb_msd_register_types(void)
-- 
2.9.4

[Qemu-devel] [PATCH v4 2/4] hw/block: Fix the return type

When the function no success value to transmit, it usually make the
function return void. It has turned out not to be a success, because
it means that the extra local_err variable and error_propagate() will
be needed. It leads to cumbersome code, therefore, transmit success/
failure in the return value is worth.

So fix the return type of blkconf_apply_backend_options(),
blkconf_geometry() and virtio_blk_data_plane_create() to avoid it.

Cc: John Snow 
Cc: Kevin Wolf 
Cc: Max Reitz 
Cc: Stefan Hajnoczi 

Signed-off-by: Mao Zhongyi 
Reviewed-by: Stefan Hajnoczi 
---
 hw/block/block.c| 15 +--
 hw/block/dataplane/virtio-blk.c | 12 +++-
 hw/block/dataplane/virtio-blk.h |  2 +-
 include/hw/block/block.h|  4 ++--
 4 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/hw/block/block.c b/hw/block/block.c
index 27878d0..b0269c8 100644
--- a/hw/block/block.c
+++ b/hw/block/block.c
@@ -51,7 +51,7 @@ void blkconf_blocksizes(BlockConf *conf)
 }
 }
 
-void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
+bool blkconf_apply_backend_options(BlockConf *conf, bool readonly,
bool resizable, Error **errp)
 {
 BlockBackend *blk = conf->blk;
@@ -76,7 +76,7 @@ void blkconf_apply_backend_options(BlockConf *conf, bool 
readonly,
 
 ret = blk_set_perm(blk, perm, shared_perm, errp);
 if (ret < 0) {
-return;
+return false;
 }
 
 switch (conf->wce) {
@@ -99,9 +99,11 @@ void blkconf_apply_backend_options(BlockConf *conf, bool 
readonly,
 
 blk_set_enable_write_cache(blk, wce);
 blk_set_on_error(blk, rerror, werror);
+
+return true;
 }
 
-void blkconf_geometry(BlockConf *conf, int *ptrans,
+bool blkconf_geometry(BlockConf *conf, int *ptrans,
   unsigned cyls_max, unsigned heads_max, unsigned secs_max,
   Error **errp)
 {
@@ -129,15 +131,16 @@ void blkconf_geometry(BlockConf *conf, int *ptrans,
 if (conf->cyls || conf->heads || conf->secs) {
 if (conf->cyls < 1 || conf->cyls > cyls_max) {
 error_setg(errp, "cyls must be between 1 and %u", cyls_max);
-return;
+return false;
 }
 if (conf->heads < 1 || conf->heads > heads_max) {
 error_setg(errp, "heads must be between 1 and %u", heads_max);
-return;
+return false;
 }
 if (conf->secs < 1 || conf->secs > secs_max) {
 error_setg(errp, "secs must be between 1 and %u", secs_max);
-return;
+return false;
 }
 }
+return true;
 }
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 5556f0e..f6fc639 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -76,7 +76,7 @@ static void notify_guest_bh(void *opaque)
 }
 
 /* Context: QEMU global mutex held */
-void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
+bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
   VirtIOBlockDataPlane **dataplane,
   Error **errp)
 {
@@ -91,11 +91,11 @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, 
VirtIOBlkConf *conf,
 error_setg(errp,
"device is incompatible with iothread "
"(transport does not support notifiers)");
-return;
+return false;
 }
 if (!virtio_device_ioeventfd_enabled(vdev)) {
 error_setg(errp, "ioeventfd is required for iothread");
-return;
+return false;
 }
 
 /* If dataplane is (re-)enabled while the guest is running there could
@@ -103,12 +103,12 @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, 
VirtIOBlkConf *conf,
  */
 if (blk_op_is_blocked(conf->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
 error_prepend(errp, "cannot start virtio-blk dataplane: ");
-return;
+return false;
 }
 }
 /* Don't try if transport does not support notifiers. */
 if (!virtio_device_ioeventfd_enabled(vdev)) {
-return;
+return false;
 }
 
 s = g_new0(VirtIOBlockDataPlane, 1);
@@ -126,6 +126,8 @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, 
VirtIOBlkConf *conf,
 s->batch_notify_vqs = bitmap_new(conf->num_queues);
 
 *dataplane = s;
+
+return true;
 }
 
 /* Context: QEMU global mutex held */
diff --git a/hw/block/dataplane/virtio-blk.h b/hw/block/dataplane/virtio-blk.h
index db3f47b..5e18bb9 100644
--- a/hw/block/dataplane/virtio-blk.h
+++ b/hw/block/dataplane/virtio-blk.h
@@ -19,7 +19,7 @@
 
 typedef struct VirtIOBlockDataPlane VirtIOBlockDataPlane;
 
-void virtio_blk_data_plane_create(VirtIODevice

[Qemu-devel] [PATCH v4 0/4] Convert to realize and improve error handling

This series mainly implements the conversions of ide, floppy and nvme
device to realize. Add some error handling messages and remove the local
variable local_err, use errp to propagate the error directly. Also
fix the unusual function name.

v4:
  -rebased it on top of block-next branch

v3:
  -patch1: update the test output in 051  [John Snow]
  -patch2: update the test putput in 172  [John Snow]

v2:
  -use bool as the return type instead of int. [Markus Armbruster & Stefan 
Hajnoczi]

Cc: Kevin Wolf 
Cc: Max Reitz 
Cc: Keith Busch 
Cc: Stefan Hajnoczi 
Cc: "Michael S. Tsirkin" 
Cc: Paolo Bonzini 
Cc: Gerd Hoffmann 
Cc: Markus Armbruster 

Mao Zhongyi (4):
  hw/block/nvme: Convert to realize
  hw/block: Fix the return type
  hw/block: Use errp directly rather than local_err
  dev-storage: Fix the unusual function name

 hw/block/block.c| 15 +--
 hw/block/dataplane/virtio-blk.c | 12 +++-
 hw/block/dataplane/virtio-blk.h |  2 +-
 hw/block/fdc.c  | 17 ++---
 hw/block/nvme.c | 23 +++
 hw/block/virtio-blk.c   | 18 ++
 hw/ide/qdev.c   | 12 
 hw/scsi/scsi-disk.c | 13 -
 hw/usb/dev-storage.c| 29 +
 include/hw/block/block.h|  4 ++--
 10 files changed, 63 insertions(+), 82 deletions(-)

-- 
2.9.4

[Qemu-devel] [PATCH v4 1/4] hw/block/nvme: Convert to realize

Convert nvme_init() to realize and rename it to nvme_realize().

Cc: John Snow 
Cc: Keith Busch 
Cc: Kevin Wolf 
Cc: Max Reitz 
Cc: Markus Armbruster 

Signed-off-by: Mao Zhongyi 
---
 hw/block/nvme.c | 18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 441e21e..e530ba7 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -920,7 +920,7 @@ static const MemoryRegionOps nvme_cmb_ops = {
 },
 };
 
-static int nvme_init(PCIDevice *pci_dev)
+static void nvme_realize(PCIDevice *pci_dev, Error **errp)
 {
 NvmeCtrl *n = NVME(pci_dev);
 NvmeIdCtrl *id = >id_ctrl;
@@ -931,24 +931,27 @@ static int nvme_init(PCIDevice *pci_dev)
 Error *local_err = NULL;
 
 if (!n->conf.blk) {
-return -1;
+error_setg(errp, "drive property not set");
+return;
 }
 
 bs_size = blk_getlength(n->conf.blk);
 if (bs_size < 0) {
-return -1;
+error_setg(errp, "could not get backing file size");
+return;
 }
 
 blkconf_serial(>conf, >serial);
 if (!n->serial) {
-return -1;
+error_setg(errp, "serial property not set");
+return;
 }
 blkconf_blocksizes(>conf);
 blkconf_apply_backend_options(>conf, blk_is_read_only(n->conf.blk),
   false, _err);
 if (local_err) {
-error_report_err(local_err);
-return -1;
+error_propagate(errp, local_err);
+return;
 }
 
 pci_conf = pci_dev->config;
@@ -1046,7 +1049,6 @@ static int nvme_init(PCIDevice *pci_dev)
 cpu_to_le64(n->ns_size >>
 id_ns->lbaf[NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas)].ds);
 }
-return 0;
 }
 
 static void nvme_exit(PCIDevice *pci_dev)
@@ -1081,7 +1083,7 @@ static void nvme_class_init(ObjectClass *oc, void *data)
 DeviceClass *dc = DEVICE_CLASS(oc);
 PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
 
-pc->init = nvme_init;
+pc->realize = nvme_realize;
 pc->exit = nvme_exit;
 pc->class_id = PCI_CLASS_STORAGE_EXPRESS;
 pc->vendor_id = PCI_VENDOR_ID_INTEL;
-- 
2.9.4

Re: [Qemu-devel] [PATCH v5 1/4] vhost-user: add new vhost user messages to support virtio config space

2017-11-21 Thread Liu, Changpeng



> -Original Message-
> From: Michael S. Tsirkin [mailto:m...@redhat.com]
> Sent: Tuesday, November 21, 2017 4:45 AM
> To: Stefan Hajnoczi 
> Cc: Liu, Changpeng ; qemu-devel@nongnu.org;
> pbonz...@redhat.com; marcandre.lur...@redhat.com; fel...@nutanix.com;
> Harris, James R 
> Subject: Re: [PATCH v5 1/4] vhost-user: add new vhost user messages to support
> virtio config space
> 
> On Mon, Nov 20, 2017 at 04:26:31PM +, Stefan Hajnoczi wrote:
> > On Fri, Nov 17, 2017 at 04:44:37AM +0800, Changpeng Liu wrote:
> > > Add VHOST_USER_GET_CONFIG/VHOST_USER_SET_CONFIG messages which
> can be
> > > used for live migration of vhost user devices, also vhost user devices
> > > can benefit from the messages to get/set virtio config space from/to the
> > > I/O target. For the purpose to support virtio config space change,
> > > VHOST_USER_SET_CONFIG_FD message is added as the event notifier
> > > in case virtio config space change in the I/O target.
> > >
> > > Signed-off-by: Changpeng Liu 
> > > ---
> > >  docs/interop/vhost-user.txt   | 39 
> > >  hw/virtio/vhost-user.c| 98
> +++
> > >  hw/virtio/vhost.c | 63 +
> > >  include/hw/virtio/vhost-backend.h |  8 
> > >  include/hw/virtio/vhost.h | 16 +++
> > >  5 files changed, 224 insertions(+)
> > >
> > > diff --git a/docs/interop/vhost-user.txt b/docs/interop/vhost-user.txt
> > > index 954771d..1b98388 100644
> > > --- a/docs/interop/vhost-user.txt
> > > +++ b/docs/interop/vhost-user.txt
> > > @@ -116,6 +116,16 @@ Depending on the request type, payload can be:
> > >  - 3: IOTLB invalidate
> > >  - 4: IOTLB access fail
> > >
> > > + * Virtio device config space
> > > +   ---
> > > +   | offset | size | payload |
> > > +   ---
> > > +
> > > +   Offset: a 32-bit offset of virtio device's configuration space
> >
> > s/of/in the/
> >
> > > +   Size: a 32-bit size of configuration space that master wanted to 
> > > change
> >
> > Is this also used for GET_CONFIG?  If yes, I suggest "a 32-bit
> > configuration space access size in bytes".
> >
> > Please mention that Size must be <= 256 bytes.
> >
> > > +   Payload: a 256-bytes array holding the contents of the virtio
> > > +   device's configuration space
> >
> > What about bytes outside the [offset, offset+size) range?  I guess they
> > must be 0 and are ignored by the master/slave.
> >
> > Would it be cleaner to make Payload a variable-sized field with Size
> > bytes?  That way it's not necessary to transfer 0s and memcpy() a subset
> > of the payload array.
> >
> > > +
> > >  In QEMU the vhost-user message is implemented with the following struct:
> > >
> > >  typedef struct VhostUserMsg {
> > > @@ -129,6 +139,7 @@ typedef struct VhostUserMsg {
> > >  VhostUserMemory memory;
> > >  VhostUserLog log;
> > >  struct vhost_iotlb_msg iotlb;
> > > +VhostUserConfig config;
> > >  };
> > >  } QEMU_PACKED VhostUserMsg;
> > >
> > > @@ -596,6 +607,34 @@ Master message types
> > >and expect this message once (per VQ) during device configuration
> > >(ie. before the master starts the VQ).
> > >
> > > + * VHOST_USER_GET_CONFIG
> > > +  Id: 24
> > > +  Equivalent ioctl: N/A
> > > +  Master payload: virtio device config space
> > > +
> > > +  Submitted by the vhost-user master to fetch the contents of the 
> > > virtio
> > > +  device configuration space. The vhost-user master may cache the 
> > > contents
> > > +  to avoid repeated VHOST_USER_GET_CONFIG calls.
> > > +
> > > +* VHOST_USER_SET_CONFIG
> > > +  Id: 25
> > > +  Equivalent ioctl: N/A
> > > +  Master payload: virtio device config space
> > > +
> > > +  Submitted by the vhost-user master when the Guest changes the 
> > > virtio
> > > +  device configuration space and also can be used for live migration
> > > +  on the destination host.
> >
> > There might be security issues if the vhost slave cannot tell whether
> > SET_CONFIG is coming from the guest driver or from the master process
> > (live migration).  Typically certain fields are read-only for the guest
> > driver.  Maybe those fields need to be set by the master after live
> > migration.
> >
> > One way to solve this is adding a flags field to the message.  A special
> > flag can be used for live migration so the slave knows that this
> > SET_CONFIG message is allowed to write to read-only fields.
> >
> > It's also worth documenting that slaves MUST NOT accept SET_CONFIG for
> > read-only configuration space fields unless the live migration bit is
> > set.  Hopefully this will remind implementors to think through the
> > security issues.
> 
> Live migrations is supposed to be migrating guest writeable state too.
> If you mean migrating

Re: [Qemu-devel] [PATCH v5 1/4] vhost-user: add new vhost user messages to support virtio config space

2017-11-21 Thread Liu, Changpeng



> -Original Message-
> From: Stefan Hajnoczi [mailto:stefa...@gmail.com]
> Sent: Tuesday, November 21, 2017 12:27 AM
> To: Liu, Changpeng 
> Cc: qemu-devel@nongnu.org; pbonz...@redhat.com; m...@redhat.com;
> marcandre.lur...@redhat.com; fel...@nutanix.com; Harris, James R
> 
> Subject: Re: [PATCH v5 1/4] vhost-user: add new vhost user messages to support
> virtio config space
> 
> On Fri, Nov 17, 2017 at 04:44:37AM +0800, Changpeng Liu wrote:
> > Add VHOST_USER_GET_CONFIG/VHOST_USER_SET_CONFIG messages which can
> be
> > used for live migration of vhost user devices, also vhost user devices
> > can benefit from the messages to get/set virtio config space from/to the
> > I/O target. For the purpose to support virtio config space change,
> > VHOST_USER_SET_CONFIG_FD message is added as the event notifier
> > in case virtio config space change in the I/O target.
> >
> > Signed-off-by: Changpeng Liu 
> > ---
> >  docs/interop/vhost-user.txt   | 39 
> >  hw/virtio/vhost-user.c| 98 
> > +++
> >  hw/virtio/vhost.c | 63 +
> >  include/hw/virtio/vhost-backend.h |  8 
> >  include/hw/virtio/vhost.h | 16 +++
> >  5 files changed, 224 insertions(+)
> >
> > diff --git a/docs/interop/vhost-user.txt b/docs/interop/vhost-user.txt
> > index 954771d..1b98388 100644
> > --- a/docs/interop/vhost-user.txt
> > +++ b/docs/interop/vhost-user.txt
> > @@ -116,6 +116,16 @@ Depending on the request type, payload can be:
> >  - 3: IOTLB invalidate
> >  - 4: IOTLB access fail
> >
> > + * Virtio device config space
> > +   ---
> > +   | offset | size | payload |
> > +   ---
> > +
> > +   Offset: a 32-bit offset of virtio device's configuration space
> 
> s/of/in the/
> 
> > +   Size: a 32-bit size of configuration space that master wanted to change
> 
> Is this also used for GET_CONFIG?  If yes, I suggest "a 32-bit
> configuration space access size in bytes".
ok.
> 
> Please mention that Size must be <= 256 bytes.
> 
> > +   Payload: a 256-bytes array holding the contents of the virtio
> > +   device's configuration space
> 
> What about bytes outside the [offset, offset+size) range?  I guess they
> must be 0 and are ignored by the master/slave.
> 
> Would it be cleaner to make Payload a variable-sized field with Size
> bytes?  That way it's not necessary to transfer 0s and memcpy() a subset
> of the payload array.
sounds good, but for vhost-blk driver it can call get_config for the whole 
virtio_blk_config space.
> 
> > +
> >  In QEMU the vhost-user message is implemented with the following struct:
> >
> >  typedef struct VhostUserMsg {
> > @@ -129,6 +139,7 @@ typedef struct VhostUserMsg {
> >  VhostUserMemory memory;
> >  VhostUserLog log;
> >  struct vhost_iotlb_msg iotlb;
> > +VhostUserConfig config;
> >  };
> >  } QEMU_PACKED VhostUserMsg;
> >
> > @@ -596,6 +607,34 @@ Master message types
> >and expect this message once (per VQ) during device configuration
> >(ie. before the master starts the VQ).
> >
> > + * VHOST_USER_GET_CONFIG
> > +  Id: 24
> > +  Equivalent ioctl: N/A
> > +  Master payload: virtio device config space
> > +
> > +  Submitted by the vhost-user master to fetch the contents of the 
> > virtio
> > +  device configuration space. The vhost-user master may cache the 
> > contents
> > +  to avoid repeated VHOST_USER_GET_CONFIG calls.
> > +
> > +* VHOST_USER_SET_CONFIG
> > +  Id: 25
> > +  Equivalent ioctl: N/A
> > +  Master payload: virtio device config space
> > +
> > +  Submitted by the vhost-user master when the Guest changes the virtio
> > +  device configuration space and also can be used for live migration
> > +  on the destination host.
> 
> There might be security issues if the vhost slave cannot tell whether
> SET_CONFIG is coming from the guest driver or from the master process
> (live migration).  Typically certain fields are read-only for the guest
> driver.  Maybe those fields need to be set by the master after live
> migration.
> 
> One way to solve this is adding a flags field to the message.  A special
> flag can be used for live migration so the slave knows that this
> SET_CONFIG message is allowed to write to read-only fields.
> 
Ok.
> It's also worth documenting that slaves MUST NOT accept SET_CONFIG for
> read-only configuration space fields unless the live migration bit is
> set.  Hopefully this will remind implementors to think through the
> security issues.

Re: [Qemu-devel] [PATCH qemu] fdc: Exit if ISA controller does not support DMA

On 07/11/17 11:58, John Snow wrote:
> 
> 
> On 10/26/2017 02:46 AM, Alexey Kardashevskiy wrote:
>> A "powernv" machine type defines an ISA bus but it does not add any DMA
>> controller to it so it is possible to hit assert(fdctrl->dma) by
>> adding "-machine powernv -device isa-fdc".
>>
>> This replaces assert() with an error message.
>>
>> Signed-off-by: Alexey Kardashevskiy 
>> ---
>>
>> Is it a must for ISA to have DMA controllers?
>>
>>
>> ---
>>  hw/block/fdc.c | 5 -
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/block/fdc.c b/hw/block/fdc.c
>> index 67f78ac702..ed8b367572 100644
>> --- a/hw/block/fdc.c
>> +++ b/hw/block/fdc.c
>> @@ -2700,7 +2700,10 @@ static void isabus_fdc_realize(DeviceState *dev, 
>> Error **errp)
>>  fdctrl->dma_chann = isa->dma;
>>  if (fdctrl->dma_chann != -1) {
>>  fdctrl->dma = isa_get_dma(isa_bus_from_device(isadev), isa->dma);
>> -assert(fdctrl->dma);
>> +if (!fdctrl->dma) {
>> +error_setg(errp, "ISA controller does not support DMA, 
>> exiting");
>> +return;
>> +}
>>  }
>>  
>>  qdev_set_legacy_instance_id(dev, isa->iobase, 2);
>>
> 
> I've been MIA for a little while, so I'm out of the loop -- but I am not
> sure this is entirely the right way to fix this problem. I think it is
> more the case that certain boards should not be able to ask for certain
> types of devices, and we should prohibit e.g. powernv from being able to
> ask for an ISA floppy disk controller.
> 
> (It doesn't seem to have an ISA DMA controller by default, but I have no
> idea if that means it can't EVER have one...)
> 
> Papering over this by making it a soft error when we fail to execute
> isa_get_dma and then assuming in retrospect it's because the machine
> type we're on cannot have an ISA DMA controller seems a little
> wrong-headed. It also leaves side-effects from isa_register_portio_list
> and isa_init_irq, so we can't just bail here -- it's only marginally
> better than the assert() it's doing.
> 
> That said, I am not really sure what the right thing to do is ... I
> suspect the "right thing" is to express the dependency that isa-fdc
> requires an ISA DMA controller -- and maybe that check happens here when
> isa_get_dma fails and we have to unwind the realize function, but we
> need to do it gracefully.
> 
> Give me a day to think about it, but I do want to make sure this is in
> the next release.


The day has passed, any news? :)


-- 
Alexey

Re: [Qemu-devel] [PATCH v5 1/4] vhost-user: add new vhost user messages to support virtio config space

2017-11-21 Thread Liu, Changpeng



> -Original Message-
> From: Paolo Bonzini [mailto:pbonz...@redhat.com]
> Sent: Tuesday, November 21, 2017 8:16 AM
> To: Michael S. Tsirkin ; Stefan Hajnoczi 
> Cc: Liu, Changpeng ; qemu-devel@nongnu.org;
> marcandre.lur...@redhat.com; fel...@nutanix.com; Harris, James R
> 
> Subject: Re: [PATCH v5 1/4] vhost-user: add new vhost user messages to support
> virtio config space
> 
> On 20/11/2017 21:44, Michael S. Tsirkin wrote:
> > Live migrations is supposed to be migrating guest writeable state too.
> > If you mean migrating RO fields like size, then
> > I don't think it's a good idea to reuse SET_CONFIG for that.
> > SET_CONFIG should obey exactly the virtio semantics.
> >
> > And I agree, it should say that slave must treat it as a write,
> > and get config as a read according to virtio semantics.
> >
> > If someone needs to pass configuration from qemu to
> > slave, let's add specific messages with precisely defined semantics.
> 
> Fair enough, but I'd add nevertheless a 32-bit flags field to both
> GET_CONFIG and SET_CONFIG, and document that the slave MUST check that
> it is zero and otherwise fail.
Ok.
> 
> Paolo

Re: [Qemu-devel] [PATCH v3 0/6] Convert to realize and improve error handling


Hi, Kevin

On 11/10/2017 10:25 PM, Kevin Wolf wrote:

Am 19.09.2017 um 01:59 hat John Snow geschrieben:

On 09/18/2017 10:05 AM, Mao Zhongyi wrote:

This series mainly implements the conversions of ide, floppy and nvme
device to realize. Add some error handling messages and remove the local
variable local_err, use errp to propagate the error directly. Also
fix the unusual function name.


I've staged patches one and two here for my IDE pull request.

I think patches 3-6 here would belong to Kevin.


Sorry, I completely missed this.


That's all right.


Thanks, applied patch 3 (nvme) to the block-next branch. I did not take
patches 4 and 5 because patch 5 doesn't apply cleanly any more, and
honestly I think the result is uglier than before.


I will rebase the patches right away.

Thanks,
Mao


Patch 6 is for Gerd.
Kevin

Re: [Qemu-devel] [PATCH] iotests: fix 075 and 078

2017-11-21 Thread Eric Blake

On 11/21/2017 06:16 PM, John Snow wrote:
> Both of these tests are for formats which now stipulate that they are
> read-only. Adjust the tests to match.
> 
> Signed-off-by: John Snow 
> ---
>  tests/qemu-iotests/075 | 18 +-
>  tests/qemu-iotests/078 | 14 +++---
>  2 files changed, 16 insertions(+), 16 deletions(-)
> 

Reviewed-by: Eric Blake 

Safe for 2.11, although now that -rc2 is out, it's also okay if this
slips into 2.12.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.   +1-919-301-3266
Virtualization:  qemu.org | libvirt.org



signature.asc
Description: OpenPGP digital signature

Re: [Qemu-devel] [PATCH v6 00/26] tcg: generic vector operations

2017-11-21 Thread no-reply

Hi,

This series failed build test on s390x host. Please find the details below.

Subject: [Qemu-devel] [PATCH v6 00/26] tcg: generic vector operations
Type: series
Message-id: 20171121212534.5177-1-richard.hender...@linaro.org

=== TEST SCRIPT BEGIN ===
#!/bin/bash
# Testing script will be invoked under the git checkout with
# HEAD pointing to a commit that has the patches applied on top of "base"
# branch
set -e
echo "=== ENV ==="
env
echo "=== PACKAGES ==="
rpm -qa
echo "=== TEST BEGIN ==="
CC=$HOME/bin/cc
INSTALL=$PWD/install
BUILD=$PWD/build
echo -n "Using CC: "
realpath $CC
mkdir -p $BUILD $INSTALL
SRC=$PWD
cd $BUILD
$SRC/configure --cc=$CC --prefix=$INSTALL
make -j4
# XXX: we need reliable clean up
# make check -j4 V=1
make install
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 * [new tag] patchew/20171121212534.5177-1-richard.hender...@linaro.org 
-> patchew/20171121212534.5177-1-richard.hender...@linaro.org
Switched to a new branch 'test'
25cb597 tcg/aarch64: Add vector operations
3f5327e tcg/i386: Add vector operations/expansions for mul/extend
9842ec4 target/arm: Use vector infrastructure for aa64 widening shifts
5baa8f3 tcg: Add generic vector ops for extension
f31da52 target/arm: Use vector infrastructure for aa64 multiplies
32e5841 tcg: Add generic vector ops for multiplication
02b126c tcg/i386: Add vector operations/expansions for shift/cmp/interleave
bd28e62 target/arm: Use vector infrastructure for aa64 compares
c1bffde tcg: Add generic vector ops for comparisons
c6dfe9f target/arm: Use vector infrastructure for aa64 constant shifts
692cd85 tcg: Add generic vector ops for constant shifts
77a9e02 target/arm: Use vector infrastructure for aa64 zip/uzp/trn/xtn
8b8ba00 tcg: Add generic vector ops for interleave
e5c9bc0 tcg: Add tcg_expand_vec_op and tcg-target.opc.h
8f26874 tcg/i386: Add vector operations
2895593 target/arm: Use vector infrastructure for aa64 dup/movi
75b6cdb target/arm: Use vector infrastructure for aa64 mov/not/neg
01af1be target/arm: Use vector infrastructure for aa64 add/sub/logic
f368c49 target/arm: Align vector registers
0870bb2 tcg: Add tcg_signed_cond
0ac77ec tcg: Allow multiple word entries into the constant pool
729ef74 tcg: Add generic vector expanders
b0b5925 tcg: Add types and basic operations for host vectors
cfb2262 tcg: Generalize TCGOp parameters
17d3aaf tcg: Dynamically allocate TCGOps
795ee71 tcg: Remove TCGV_UNUSED* and TCGV_IS_UNUSED*

=== OUTPUT BEGIN ===
=== ENV ===
XDG_SESSION_ID=101459
SHELL=/bin/sh
USER=fam
PATCHEW=/home/fam/patchew/patchew-cli -s http://patchew.org --nodebug
PATH=/usr/bin:/bin
PWD=/var/tmp/patchew-tester-tmp-w75fwes8/src
LANG=en_US.UTF-8
HOME=/home/fam
SHLVL=2
LOGNAME=fam
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1012/bus
XDG_RUNTIME_DIR=/run/user/1012
_=/usr/bin/env
=== PACKAGES ===
gpg-pubkey-873529b8-54e386ff
xz-libs-5.2.2-2.fc24.s390x
libxshmfence-1.2-3.fc24.s390x
giflib-4.1.6-15.fc24.s390x
trousers-lib-0.3.13-6.fc24.s390x
ncurses-base-6.0-6.20160709.fc25.noarch
gmp-6.1.1-1.fc25.s390x
libidn-1.33-1.fc25.s390x
slang-2.3.0-7.fc25.s390x
pkgconfig-0.29.1-1.fc25.s390x
alsa-lib-1.1.1-2.fc25.s390x
yum-metadata-parser-1.1.4-17.fc25.s390x
python3-slip-dbus-0.6.4-4.fc25.noarch
python2-cssselect-0.9.2-1.fc25.noarch
createrepo_c-libs-0.10.0-6.fc25.s390x
initscripts-9.69-1.fc25.s390x
parted-3.2-21.fc25.s390x
flex-2.6.0-3.fc25.s390x
colord-libs-1.3.4-1.fc25.s390x
python-osbs-client-0.33-3.fc25.noarch
perl-Pod-Simple-3.35-1.fc25.noarch
python2-simplejson-3.10.0-1.fc25.s390x
brltty-5.4-2.fc25.s390x
librados2-10.2.4-2.fc25.s390x
tcp_wrappers-7.6-83.fc25.s390x
libcephfs_jni1-10.2.4-2.fc25.s390x
nettle-devel-3.3-1.fc25.s390x
bzip2-devel-1.0.6-21.fc25.s390x
libuuid-2.28.2-2.fc25.s390x
python3-dnf-1.1.10-6.fc25.noarch
texlive-kpathsea-doc-svn41139-33.fc25.1.noarch
openssh-7.4p1-4.fc25.s390x
texlive-kpathsea-bin-svn40473-33.20160520.fc25.1.s390x
texlive-graphics-svn41015-33.fc25.1.noarch
texlive-dvipdfmx-def-svn40328-33.fc25.1.noarch
texlive-mfware-svn40768-33.fc25.1.noarch
texlive-texlive-scripts-svn41433-33.fc25.1.noarch
texlive-euro-svn22191.1.1-33.fc25.1.noarch
texlive-etex-svn37057.0-33.fc25.1.noarch
texlive-iftex-svn29654.0.2-33.fc25.1.noarch
texlive-palatino-svn31835.0-33.fc25.1.noarch
texlive-texlive-docindex-svn41430-33.fc25.1.noarch
texlive-xunicode-svn30466.0.981-33.fc25.1.noarch
texlive-koma-script-svn41508-33.fc25.1.noarch
texlive-pst-grad-svn15878.1.06-33.fc25.1.noarch
texlive-pst-blur-svn15878.2.0-33.fc25.1.noarch
texlive-jknapltx-svn19440.0-33.fc25.1.noarch
texinfo-6.1-4.fc25.s390x
openssl-devel-1.0.2k-1.fc25.s390x
jansson-2.10-2.fc25.s390x
fedora-repos-25-4.noarch
perl-Errno-1.25-387.fc25.s390x
acl-2.2.52-13.fc25.s390x
systemd-pam-231-17.fc25.s390x
NetworkManager-libnm-1.4.4-5.fc25.s390x
poppler-0.45.0-5.fc25.s390x
ccache-3.3.4-1.fc25.s390x
valgrind-3.12.0-9.fc25.s390x
perl-open-1.10-387.fc25.noarch
libgcc-6.4.1-1.fc25.s390x

[Qemu-devel] [PATCH] iotests: fix 075 and 078

Both of these tests are for formats which now stipulate that they are
read-only. Adjust the tests to match.

Signed-off-by: John Snow 
---
 tests/qemu-iotests/075 | 18 +-
 tests/qemu-iotests/078 | 14 +++---
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/tests/qemu-iotests/075 b/tests/qemu-iotests/075
index 770d51c6cb..caa30d4743 100755
--- a/tests/qemu-iotests/075
+++ b/tests/qemu-iotests/075
@@ -48,56 +48,56 @@ offsets_offset=136
 echo
 echo "== check that the first sector can be read =="
 _use_sample_img simple-pattern.cloop.bz2
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 echo
 echo "== check that the last sector can be read =="
 _use_sample_img simple-pattern.cloop.bz2
-$QEMU_IO -c "read $((1024 * 1024 - 512)) 512" $TEST_IMG 2>&1 | _filter_qemu_io 
| _filter_testdir
+$QEMU_IO -r -c "read $((1024 * 1024 - 512)) 512" $TEST_IMG 2>&1 | 
_filter_qemu_io | _filter_testdir
 
 echo
 echo "== block_size must be a multiple of 512 =="
 _use_sample_img simple-pattern.cloop.bz2
 poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x02\x01"
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 echo
 echo "== block_size cannot be zero =="
 _use_sample_img simple-pattern.cloop.bz2
 poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x00\x00"
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 echo
 echo "== huge block_size ==="
 _use_sample_img simple-pattern.cloop.bz2
 poke_file "$TEST_IMG" "$block_size_offset" "\xff\xff\xfe\x00"
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 echo
 echo "== offsets_size overflow ==="
 _use_sample_img simple-pattern.cloop.bz2
 poke_file "$TEST_IMG" "$n_blocks_offset" "\xff\xff\xff\xff"
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 echo
 echo "== refuse images that require too many offsets ==="
 _use_sample_img simple-pattern.cloop.bz2
 poke_file "$TEST_IMG" "$n_blocks_offset" "\x04\x00\x00\x01"
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 echo
 echo "== refuse images with non-monotonically increasing offsets =="
 _use_sample_img simple-pattern.cloop.bz2
 poke_file "$TEST_IMG" "$offsets_offset" "\x00\x00\x00\x00\xff\xff\xff\xff"
 poke_file "$TEST_IMG" $((offsets_offset + 8)) 
"\x00\x00\x00\x00\xff\xfe\x00\x00"
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 echo
 echo "== refuse images with invalid compressed block size =="
 _use_sample_img simple-pattern.cloop.bz2
 poke_file "$TEST_IMG" "$offsets_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
 poke_file "$TEST_IMG" $((offsets_offset + 8)) 
"\xff\xff\xff\xff\xff\xff\xff\xff"
-$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
+$QEMU_IO -r -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
 
 # success, all done
 echo "*** done"
diff --git a/tests/qemu-iotests/078 b/tests/qemu-iotests/078
index f333e9ac84..a106c26f6b 100755
--- a/tests/qemu-iotests/078
+++ b/tests/qemu-iotests/078
@@ -48,41 +48,41 @@ disk_size_offset=$((0x58))
 echo
 echo "== Read from a valid image =="
 _use_sample_img empty.bochs.bz2
-{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
+{ $QEMU_IO -r -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
 
 echo
 echo "== Negative catalog size =="
 _use_sample_img empty.bochs.bz2
 poke_file "$TEST_IMG" "$catalog_size_offset" "\xff\xff\xff\xff"
-{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
+{ $QEMU_IO -r -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
 
 echo
 echo "== Overflow for catalog size * sizeof(uint32_t) =="
 _use_sample_img empty.bochs.bz2
 poke_file "$TEST_IMG" "$catalog_size_offset" "\x00\x00\x00\x40"
-{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
+{ $QEMU_IO -r -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
 
 echo
 echo "== Too small catalog bitmap for image size =="
 _use_sample_img empty.bochs.bz2
 poke_file "$TEST_IMG" "$disk_size_offset" "\x00\xc0\x0f\x00\x00\x00\x00\x7f"
-{ $QEMU_IO -c "read 2T 4k" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
+{ $QEMU_IO -r -c "read 2T 4k" $TEST_IMG; } 2>&1 | _filter_qemu_io | 
_filter_testdir
 
 _use_sample_img empty.bochs.bz2

Re: [Qemu-devel] [Qemu-block] segfault in parallel blockjobs (iotest 30)

CC Jeff Cody

... who may or may not be preoccupied with Thanksgiving travel now.

Convenient URL for reading past replies:
https://lists.nongnu.org/archive/html/qemu-devel/2017-11/msg03844.html

On 11/21/2017 10:31 AM, Alberto Garcia wrote:
> On Tue 21 Nov 2017 04:18:13 PM CET, Anton Nefedov wrote:
> 
 Or, perhaps another approach, keep BlockJob referenced while it is
 paused (by block_job_pause/resume_all()). That should prevent it
 from deleting the BB.
>>>
>>> Yes, I tried this and it actually solves the issue. But I still think
>>> that the problem is that block jobs are allowed to finish when they
>>> are paused.
>>
>> Agree, but
>>
>>> Adding block_job_pause_point(>common) at the end of stream_run()
>>> fixes the problem too.
>>
>> would be a nice fix, but it only works unless the job is already
>> deferred, right?
> 
> Right, I didn't mean to propose it as the proper solution (it would
> still leave mirror job vulnerable because it's already paused by the
> time it calls defer_to_main_loop()).
> 
>> This:
>>
>>  >> keep BlockJob referenced while it is
>>  >> paused (by block_job_pause/resume_all()). That should prevent it from
>>  >> deleting the BB.
>>
>> looks kind of hacky; maybe referencing in block_job_pause() (and not
>> just pause_all) seems more correct? I think it didn't work for me
>> right away though. But I can look more.
> 
> You have to be careful when you unref the block job because you may
> destroy it, and therefore block_job_next() in block_job_resume_all()
> would be using freed memory.
> 
> Berto
>

Re: [Qemu-devel] [PATCH for-2.12 0/4] qmp dirty bitmap API

On 11/21/2017 12:23 PM, Kevin Wolf wrote:
> Am 17.11.2017 um 22:35 hat John Snow geschrieben:
> usage is like this:
>
> 1. we have dirty bitmap bitmap0 for incremental backup.
>
> 2. prepare image fleecing (create temporary image with backing=our_disk)
> 3. in qmp transaction:
>     - disable bitmap0
>     - create bitmap1
>     - start image fleecing (backup sync=none our_disk -> temp_disk)
 This could probably just be its own command, though:

 block-job-fleece node=foobar bitmap=bitmap0 etc=etera etc=etera

 Could handle forking the bitmap. I'm not sure what the arguments would
 look like, but we could name the NBD export here, too. (Assuming the
 server is already started and we just need to create the share.)

 Then, we can basically do what mirror does:

 (1) Cancel
 (2) Complete

 Cancel would instruct QEMU to keep the bitmap changes (i.e. roll back),
 and Complete would instruct QEMU to discard the changes.

 This way we don't need to expose commands like split or merge that will
 almost always be dangerous to use over QMP.

 In fact, a fleecing job would be really convenient even without a
 bitmap, because it'd still be nice to have a convenience command for it.
 Using an existing infrastructure and understood paradigm is just a bonus.
>>>
>>> 1. If I understand correctly, Kevin and Max said in their report in
>>> Prague about new block-job approach,
>>>   using filter nodes, so I'm not sure that this is a good Idea to
>>> introduce now new old-style block-job, where we can
>>>   do without it.
>>
>> We could do without it, but it might be a lot better to have everything
>> wrapped up in a command that's easy to digest instead of releasing 10
>> smaller commands that have to be executed in a very specific way in
>> order to work correctly.
>>
>> I'm thinking about the complexity of error checking here with all the
>> smaller commands, versus error checking on a larger workflow we
>> understand and can quality test better.
>>
>> I'm not sure that filter nodes becoming the new normal for block jobs
>> precludes our ability to use the job-management API as a handle for
>> managing the lifetime of a long-running task like fleecing, but I'll
>> check with Max and Kevin about this.
> 
> We have a general tendency at least in the block layer, but in fact I
> think in qemu in general, to switch from exposing high-level
> functionality to exposing lower-level operations via QAPI.
> 

I am aware of that, yeah. I worry about going too far to the other
extreme in some cases. Even at the API level where we don't care about
the feelings of, or the ease-of-use by a robot, if a certain action
requires several API commands to be issued in a very specific order,
that increases our test matrix and it increases the complexity in the
management API.

There's a middle ground, I think.

"Fleecing" is one of those cases where we can already fleece today with
component commands, but a composite command that encapsulates that
functionality would be helpful.

In this case, I worry about adding low-level commands for bitmaps that
will almost always be incorrect to use except in conjunction with other
commands -- and even then generally only useful when issued via
transaction specifically.

(You might be able to make the case to me that we should add these
commands but ONLY as transaction primitives, foregoing their traditional
standalone QMP command counterparts.)

If I capitulate and let the more targeted primitives into QEMU instead
of an encompassing job, it means a higher number of QMP commands
overall, more tests, and more interfaces to test and maintain.

Maybe I am being wrong-headed, but I actually think a new job would
actually give us less to maintain, test and verify than several new
primitives would, especially when considering that these primitives will
in general only be used by transactions with other commands anyway, it
increases the evidence that the right paradigm here is a new job, not
more transaction primitives.

...maybe. I won't draw a line in the sand, but it's an approach I would
like you to consider.

> If we expose high-level commands, then every new use case will require a
> change in both qemu and libvirt. With low-level commands, often libvirt
> already has all of the required tools to implement what it needs.
> 

I am receptive to how "big" commands often need to change frequently,
though. Primitives certainly have a purity of design about them that
larger job commands do not possess.

> So I do see good reasons for exposing low-level commands.
> 
> 
> On another note, I would double check before adding a new block job type
> that this is the right way to go. We have recently noticed that many, if
> not all, of the existing block jobs (at least mirror, commit and backup)
> are so similar that they implement the same things multiple times and
> are just lacking different

[Qemu-devel] qemu-iotest 059 vmdk failure

The last sub-test in 059, which uses an AFL fuzzer image to test for how
a large L1 table of a specific size is handled has a slight regression.

Previously, QEMU expects -EFBIG to come out the vmdk_open call. Now, we
get -EINVAL. Not too ominous.

Now, QEMU actually allocates the L1 table (1.6GB) and gets a little
further, only to eventually trip up here:

#0  vmdk_read_cid (bs=0x55d4c5a0, parent=0, pcid=0x55d5786c) at
/home/bos/jhuston/src/qemu/block/vmdk.c:272
#1  0x555947cb in vmdk_open (bs=0x55d4c5a0,
options=0x55d509b0, flags=65536, errp=0x7fffd950)
at /home/bos/jhuston/src/qemu/block/vmdk.c:989

where p_name is NULL, so we return -EINVAL back up the stack. We get all
the way through vmdk_open_sparse --> vmdk_open_vmdk4 before we
eventually catch an error in the header and return a fairly nondescript
EINVAL which doesn't tell the end user much.

We don't error out earlier because the vmdk_add_extent function checks
to see if we are exceeding 512*1024*1024 ... entries, which means that
later when we get to vmdk_init_tables, we do multiply this number by
four again, so our actual maximum L1 table size in terms of bytes is
2GiB, not 512MiB.

(Maybe you knew that, I didn't, enjoy useless facts. The comment in code
seemed to suggest the size was a literal size in bytes, but it's treated
more as the number of L1 entries, which is different.)

Anyway, this still seems slightly silly that we don't catch obviously
bogus images a little sooner, so I wanna rewind and see why we don't get
-EFBIG anymore.

The output changes as of 9877860e which adds the p_name check, so we
appear to actually be failing even earlier, just not before we
apparently load up a 2GB L1 table from a file that clocks in at less
than 1KB.

(Wait, why does that work? Am I tracing this wrong? -EOUTTATIME)

Anyway, we can fix this by amending the reference test output, or we
might want to shore up the vmdk input validation a bit.

Not a regression, and the test was broken in v2.10 anyway, so not
critical to fix during rc phase, I think.

Anyway, I need to go prepare some food for Thanksgiving, so I won't come
back to this one for a few days. If it's not important to anyone else,
I'll get back around to it eventually.

--js

Re: [Qemu-devel] [PATCH] ppc: fix VTB migration

On Tue, Nov 21, 2017 at 09:16:43PM +0100, Laurent Vivier wrote:
> Migration of a system under stress (for example, with
> "stress-ng --numa 2") triggers on the destination
> some kernel watchdog messages like:
> 
> NMI watchdog: BUG: soft lockup - CPU#0 stuck for 3489660870s!
> NMI watchdog: BUG: soft lockup - CPU#1 stuck for 3489660884s!
> 
> This problem appears with the changes introduced by
> 42043e4 spapr: clock should count only if vm is running
> 
> I think this commit only triggers the problem.
> 
> Kernel computes the soft lockup duration using the
> Virtual Timebase register (VTB), not using the Timebase
> Register (TBR, the one 42043e4 stops).
> 
> It appears VTB is not migrated, so this patch adds it in
> the list of the SPRs to migrate, and fixes the problem.
> 
> For the migration, I've tested a migration from qemu-2.8.0 and
> pseries-2.8.0 to a patched master (qemu-2.11.0-rc1). The received
> VTB is 0 (as is it not initialized by qemu-2.8.0), but the value
> seems to be ignored by KVM and a non zero VTB is used by the kernel.
> I have no explanation for that, but as the original problem appears
> only with SMP system under stress I suspect some problems in KVM
> (I think because VTB is shared by all threads of a core).
> 
> Signed-off-by: Laurent Vivier 

Applied to ppc-for-2.11, thanks.

> ---
>  target/ppc/translate_init.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/target/ppc/translate_init.c b/target/ppc/translate_init.c
> index b9c49c22f2..4e11e6f489 100644
> --- a/target/ppc/translate_init.c
> +++ b/target/ppc/translate_init.c
> @@ -8081,10 +8081,10 @@ static void gen_spr_power8_ebb(CPUPPCState *env)
>  /* Virtual Time Base */
>  static void gen_spr_vtb(CPUPPCState *env)
>  {
> -spr_register(env, SPR_VTB, "VTB",
> +spr_register_kvm(env, SPR_VTB, "VTB",
>   SPR_NOACCESS, SPR_NOACCESS,
>   _read_tbl, SPR_NOACCESS,
> - 0x);
> + KVM_REG_PPC_VTB, 0x);
>  }
>  
>  static void gen_spr_power8_fscr(CPUPPCState *env)

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [Qemu-devel] [PATCH v6 00/26] tcg: generic vector operations

2017-11-21 Thread no-reply

Hi,

This series failed automatic build test. Please find the testing commands and
their output below. If you have docker installed, you can probably reproduce it
locally.

Subject: [Qemu-devel] [PATCH v6 00/26] tcg: generic vector operations
Type: series
Message-id: 20171121212534.5177-1-richard.hender...@linaro.org

=== TEST SCRIPT BEGIN ===
#!/bin/bash
set -e
git submodule update --init dtc
# Let docker tests dump environment info
export SHOW_ENV=1
export J=8
time make docker-test-quick@centos6
time make docker-test-build@min-glib
time make docker-test-mingw@fedora
time make docker-test-block@fedora
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
25cb597f1f tcg/aarch64: Add vector operations
3f5327e6d4 tcg/i386: Add vector operations/expansions for mul/extend
9842ec4914 target/arm: Use vector infrastructure for aa64 widening shifts
5baa8f3688 tcg: Add generic vector ops for extension
f31da52954 target/arm: Use vector infrastructure for aa64 multiplies
32e58411b7 tcg: Add generic vector ops for multiplication
02b126c0de tcg/i386: Add vector operations/expansions for shift/cmp/interleave
bd28e62249 target/arm: Use vector infrastructure for aa64 compares
c1bffde42b tcg: Add generic vector ops for comparisons
c6dfe9f8f3 target/arm: Use vector infrastructure for aa64 constant shifts
692cd8553b tcg: Add generic vector ops for constant shifts
77a9e02822 target/arm: Use vector infrastructure for aa64 zip/uzp/trn/xtn
8b8ba000ae tcg: Add generic vector ops for interleave
e5c9bc047b tcg: Add tcg_expand_vec_op and tcg-target.opc.h
8f2687485e tcg/i386: Add vector operations
2895593422 target/arm: Use vector infrastructure for aa64 dup/movi
75b6cdbaa6 target/arm: Use vector infrastructure for aa64 mov/not/neg
01af1be046 target/arm: Use vector infrastructure for aa64 add/sub/logic
f368c49794 target/arm: Align vector registers
0870bb2a3c tcg: Add tcg_signed_cond
0ac77ecb27 tcg: Allow multiple word entries into the constant pool
729ef7471e tcg: Add generic vector expanders
b0b5925754 tcg: Add types and basic operations for host vectors
cfb22624a4 tcg: Generalize TCGOp parameters
17d3aaf14a tcg: Dynamically allocate TCGOps
795ee71296 tcg: Remove TCGV_UNUSED* and TCGV_IS_UNUSED*

=== OUTPUT BEGIN ===
Submodule 'dtc' (git://git.qemu-project.org/dtc.git) registered for path 'dtc'
Cloning into '/var/tmp/patchew-tester-tmp-5gdjpuh6/src/dtc'...
Submodule path 'dtc': checked out '558cd81bdd432769b59bff01240c44f82cfb1a9d'
  BUILD   centos6
make[1]: Entering directory '/var/tmp/patchew-tester-tmp-5gdjpuh6/src'
  GEN 
/var/tmp/patchew-tester-tmp-5gdjpuh6/src/docker-src.2017-11-21-17.20.00.19187/qemu.tar
Cloning into 
'/var/tmp/patchew-tester-tmp-5gdjpuh6/src/docker-src.2017-11-21-17.20.00.19187/qemu.tar.vroot'...
done.
Checking out files:  44% (2539/5669)   
Checking out files:  45% (2552/5669)   
Checking out files:  46% (2608/5669)   
Checking out files:  47% (2665/5669)   
Checking out files:  48% (2722/5669)   
Checking out files:  49% (2778/5669)   
Checking out files:  50% (2835/5669)   
Checking out files:  51% (2892/5669)   
Checking out files:  52% (2948/5669)   
Checking out files:  53% (3005/5669)   
Checking out files:  54% (3062/5669)   
Checking out files:  55% (3118/5669)   
Checking out files:  56% (3175/5669)   
Checking out files:  57% (3232/5669)   
Checking out files:  58% (3289/5669)   
Checking out files:  59% (3345/5669)   
Checking out files:  60% (3402/5669)   
Checking out files:  61% (3459/5669)   
Checking out files:  62% (3515/5669)   
Checking out files:  63% (3572/5669)   
Checking out files:  64% (3629/5669)   
Checking out files:  65% (3685/5669)   
Checking out files:  66% (3742/5669)   
Checking out files:  67% (3799/5669)   
Checking out files:  68% (3855/5669)   
Checking out files:  69% (3912/5669)   
Checking out files:  70% (3969/5669)   
Checking out files:  71% (4025/5669)   
Checking out files:  72% (4082/5669)   
Checking out files:  73% (4139/5669)   
Checking out files:  74% (4196/5669)   
Checking out files:  75% (4252/5669)   
Checking out files:  76% (4309/5669)   
Checking out files:  77% (4366/5669)   
Checking out files:  78% (4422/5669)   
Checking out files:  79% (4479/5669)   
Checking out files:  80% (4536/5669)   
Checking out files:  81% (4592/5669)   
Checking out files:  82% (4649/5669)   
Checking out files:  83% (4706/5669)   
Checking out files:  84% (4762/5669)   
Checking out files:  84% (4774/5669)   
Checking out files:  85% (4819/5669)   
Checking out files:  86% (4876/5669)   
Checking out files:  87% (4933/5669)   
Checking out files:  88% (4989/5669)   
Checking out files:  89% (5046/5669)   
Checking out files:  90% (5103/5669)   
Checking out files:  91% (5159/5669)   
Checking out files:  92% (5216/5669)   
Checking out files:  93% (5273/5669)   
Checking out files:  94% (5329/5669)   
Checking out files:  95% (5386/5669)   
Checking out files:  96% (5443/5669)   
Checking out files:  97%

Re: [Qemu-devel] [PATCH v6 00/26] tcg: generic vector operations

2017-11-21 Thread no-reply

Hi,

This series seems to have some coding style problems. See output below for
more information:

Subject: [Qemu-devel] [PATCH v6 00/26] tcg: generic vector operations
Type: series
Message-id: 20171121212534.5177-1-richard.hender...@linaro.org

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
failed=1
echo
fi
n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 * [new tag]   
patchew/20171121212534.5177-1-richard.hender...@linaro.org -> 
patchew/20171121212534.5177-1-richard.hender...@linaro.org
Switched to a new branch 'test'
25cb597f1f tcg/aarch64: Add vector operations
3f5327e6d4 tcg/i386: Add vector operations/expansions for mul/extend
9842ec4914 target/arm: Use vector infrastructure for aa64 widening shifts
5baa8f3688 tcg: Add generic vector ops for extension
f31da52954 target/arm: Use vector infrastructure for aa64 multiplies
32e58411b7 tcg: Add generic vector ops for multiplication
02b126c0de tcg/i386: Add vector operations/expansions for shift/cmp/interleave
bd28e62249 target/arm: Use vector infrastructure for aa64 compares
c1bffde42b tcg: Add generic vector ops for comparisons
c6dfe9f8f3 target/arm: Use vector infrastructure for aa64 constant shifts
692cd8553b tcg: Add generic vector ops for constant shifts
77a9e02822 target/arm: Use vector infrastructure for aa64 zip/uzp/trn/xtn
8b8ba000ae tcg: Add generic vector ops for interleave
e5c9bc047b tcg: Add tcg_expand_vec_op and tcg-target.opc.h
8f2687485e tcg/i386: Add vector operations
2895593422 target/arm: Use vector infrastructure for aa64 dup/movi
75b6cdbaa6 target/arm: Use vector infrastructure for aa64 mov/not/neg
01af1be046 target/arm: Use vector infrastructure for aa64 add/sub/logic
f368c49794 target/arm: Align vector registers
0870bb2a3c tcg: Add tcg_signed_cond
0ac77ecb27 tcg: Allow multiple word entries into the constant pool
729ef7471e tcg: Add generic vector expanders
b0b5925754 tcg: Add types and basic operations for host vectors
cfb22624a4 tcg: Generalize TCGOp parameters
17d3aaf14a tcg: Dynamically allocate TCGOps
795ee71296 tcg: Remove TCGV_UNUSED* and TCGV_IS_UNUSED*

=== OUTPUT BEGIN ===
Checking PATCH 1/26: tcg: Remove TCGV_UNUSED* and TCGV_IS_UNUSED*...
Checking PATCH 2/26: tcg: Dynamically allocate TCGOps...
ERROR: line over 90 characters
#64: FILE: include/qemu/queue.h:430:
+ (var) && ((prev_var) = (*(((struct headname 
*)((var)->field.tqe_prev))->tqh_last)), 1); \

ERROR: spaces prohibited around that ':' (ctx:WxW)
#538: FILE: tcg/tcg.h:575:
+unsigned life   : 16;   /* 32 */
 ^

total: 2 errors, 0 warnings, 520 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 3/26: tcg: Generalize TCGOp parameters...
ERROR: spaces prohibited around that ':' (ctx:WxW)
#110: FILE: tcg/tcg.h:570:
+unsigned param1 : 4;/* 12 */
 ^

ERROR: spaces prohibited around that ':' (ctx:WxW)
#111: FILE: tcg/tcg.h:571:
+unsigned param2 : 4;/* 16 */
 ^

ERROR: Macros with complex values should be enclosed in parenthesis
#119: FILE: tcg/tcg.h:583:
+#define TCGOP_CALLI(X)(X)->param1

ERROR: Macros with complex values should be enclosed in parenthesis
#120: FILE: tcg/tcg.h:584:
+#define TCGOP_CALLO(X)(X)->param2

total: 4 errors, 0 warnings, 92 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 4/26: tcg: Add types and basic operations for host vectors...
ERROR: externs should be avoided in .c files
#137: FILE: tcg/tcg-op-vec.c:37:
+extern TCGv_i32 TCGV_LOW_link_error(TCGv_i64);

ERROR: externs should be avoided in .c files
#138: FILE: tcg/tcg-op-vec.c:38:
+extern TCGv_i32 TCGV_HIGH_link_error(TCGv_i64);

ERROR: Macros with complex values should be enclosed in parenthesis
#535: FILE: tcg/tcg-opc.h:209:
+#define IMPLVEC  TCG_OPF_VECTOR | IMPL(TCG_TARGET_MAYBE_vec)

WARNING: line over 80 characters
#538: FILE: tcg/tcg-opc.h:212:
+DEF(movi_vec, 1, 0, 0, TCG_OPF_VECTOR | TCG_OPF_NOT_PRESENT) /* vecl defines 
const args */

ERROR: Macros with complex values should be enclosed in parenthesis
#800: FILE: tcg/tcg.h:615:
+#define TCGOP_VECL(X) (X)->param1

ERROR: Macros with complex values should be enclosed in parenthesis
#801: FILE: tcg/tcg.h:616:
+#define TCGOP_VECE(X) (X)->param2

total: 5 errors, 1

[Qemu-devel] qemu iotest 020 failing for vmdk after 2b7731938d9