Re: [Qemu-devel] [PATCH v4 for-4.0 4/7] libvhost-user: Support tracking inflight I/O in shared memory

2019-01-14 Thread Jason Wang



On 2019/1/11 下午2:10, Yongji Xie wrote:

On Fri, 11 Jan 2019 at 11:56, Jason Wang  wrote:


On 2019/1/9 下午7:27, elohi...@gmail.com wrote:

From: Xie Yongji 

This patch adds support for VHOST_USER_GET_INFLIGHT_FD and
VHOST_USER_SET_INFLIGHT_FD message to set/get shared memory
to/from qemu. Then we maintain a "bitmap" of all descriptors in
the shared memory for each queue to track inflight I/O.

Signed-off-by: Xie Yongji 
Signed-off-by: Zhang Yu 
---
   Makefile  |   2 +-
   contrib/libvhost-user/libvhost-user.c | 258 --
   contrib/libvhost-user/libvhost-user.h |  29 +++
   3 files changed, 268 insertions(+), 21 deletions(-)

diff --git a/Makefile b/Makefile
index dd53965f77..b5c9092605 100644
--- a/Makefile
+++ b/Makefile
@@ -473,7 +473,7 @@ Makefile: $(version-obj-y)
   # Build libraries

   libqemuutil.a: $(util-obj-y) $(trace-obj-y) $(stub-obj-y)
-libvhost-user.a: $(libvhost-user-obj-y)
+libvhost-user.a: $(libvhost-user-obj-y) $(util-obj-y) $(stub-obj-y)

   ##

diff --git a/contrib/libvhost-user/libvhost-user.c 
b/contrib/libvhost-user/libvhost-user.c
index 23bd52264c..e73ce04619 100644
--- a/contrib/libvhost-user/libvhost-user.c
+++ b/contrib/libvhost-user/libvhost-user.c
@@ -41,6 +41,8 @@
   #endif

   #include "qemu/atomic.h"
+#include "qemu/osdep.h"
+#include "qemu/memfd.h"

   #include "libvhost-user.h"

@@ -53,6 +55,18 @@
   _min1 < _min2 ? _min1 : _min2; })
   #endif

+/* Round number down to multiple */
+#define ALIGN_DOWN(n, m) ((n) / (m) * (m))
+
+/* Round number up to multiple */
+#define ALIGN_UP(n, m) ALIGN_DOWN((n) + (m) - 1, (m))
+
+/* Align each region to cache line size in inflight buffer */
+#define INFLIGHT_ALIGNMENT 64
+
+/* The version of inflight buffer */
+#define INFLIGHT_VERSION 1
+
   #define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64)

   /* The version of the protocol we support */
@@ -66,6 +80,20 @@
   }   \
   } while (0)

+static inline
+bool has_feature(uint64_t features, unsigned int fbit)
+{
+assert(fbit < 64);
+return !!(features & (1ULL << fbit));
+}
+
+static inline
+bool vu_has_feature(VuDev *dev,
+unsigned int fbit)
+{
+return has_feature(dev->features, fbit);
+}
+
   static const char *
   vu_request_to_string(unsigned int req)
   {
@@ -100,6 +128,8 @@ vu_request_to_string(unsigned int req)
   REQ(VHOST_USER_POSTCOPY_ADVISE),
   REQ(VHOST_USER_POSTCOPY_LISTEN),
   REQ(VHOST_USER_POSTCOPY_END),
+REQ(VHOST_USER_GET_INFLIGHT_FD),
+REQ(VHOST_USER_SET_INFLIGHT_FD),
   REQ(VHOST_USER_MAX),
   };
   #undef REQ
@@ -890,6 +920,41 @@ vu_check_queue_msg_file(VuDev *dev, VhostUserMsg *vmsg)
   return true;
   }

+static int
+vu_check_queue_inflights(VuDev *dev, VuVirtq *vq)
+{
+int i = 0;
+
+if (!has_feature(dev->protocol_features,
+VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD)) {
+return 0;
+}
+
+if (unlikely(!vq->inflight)) {
+return -1;
+}
+
+vq->used_idx = vq->vring.used->idx;
+vq->inflight_num = 0;
+for (i = 0; i < vq->vring.num; i++) {
+if (vq->inflight->desc[i] == 0) {
+continue;
+}
+
+vq->inflight_desc[vq->inflight_num++] = i;
+vq->inuse++;
+}
+vq->shadow_avail_idx = vq->last_avail_idx = vq->inuse + vq->used_idx;
+
+/* in case of I/O hang after reconnecting */
+if (eventfd_write(vq->kick_fd, 1) ||
+eventfd_write(vq->call_fd, 1)) {
+return -1;
+}
+
+return 0;
+}
+
   static bool
   vu_set_vring_kick_exec(VuDev *dev, VhostUserMsg *vmsg)
   {
@@ -925,6 +990,10 @@ vu_set_vring_kick_exec(VuDev *dev, VhostUserMsg *vmsg)
  dev->vq[index].kick_fd, index);
   }

+if (vu_check_queue_inflights(dev, >vq[index])) {
+vu_panic(dev, "Failed to check inflights for vq: %d\n", index);
+}
+
   return false;
   }

@@ -1215,6 +1284,117 @@ vu_set_postcopy_end(VuDev *dev, VhostUserMsg *vmsg)
   return true;
   }

+static bool
+vu_get_inflight_fd(VuDev *dev, VhostUserMsg *vmsg)
+{
+int fd;
+void *addr;
+uint64_t mmap_size;
+
+if (vmsg->size != sizeof(vmsg->payload.inflight)) {
+vu_panic(dev, "Invalid get_inflight_fd message:%d", vmsg->size);
+vmsg->payload.inflight.mmap_size = 0;
+return true;
+}
+
+DPRINT("set_inflight_fd num_queues: %"PRId16"\n",
+   vmsg->payload.inflight.num_queues);
+
+mmap_size = vmsg->payload.inflight.num_queues *
+ALIGN_UP(sizeof(VuVirtqInflight), INFLIGHT_ALIGNMENT);
+
+addr = qemu_memfd_alloc("vhost-inflight", mmap_size,
+F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
+, NULL);
+
+if (!addr) {
+vu_panic(dev, "Failed to alloc vhost inflight area");
+

Re: [Qemu-devel] [PATCH v2 2/3] migration: fix memory leak when updating tls-creds and tls-hostname

2019-01-14 Thread Peter Xu
On Fri, Jan 11, 2019 at 02:37:31PM +0800, guangrong.x...@gmail.com wrote:
> From: Xiao Guangrong 
> 
> If we update parameter, tls-creds and tls-hostname, these string
> values are duplicated to local variables in migrate_params_test_apply()
> by using g_strdup(), however these new allocated memory are missed to
> be freed
> 
> Actually, they are not used to check anything, we can directly skip
> them
> 
> Signed-off-by: Xiao Guangrong 
> ---
>  migration/migration.c | 10 --
>  1 file changed, 10 deletions(-)
> 
> diff --git a/migration/migration.c b/migration/migration.c
> index a82d594f29..fb39d7bec1 100644
> --- a/migration/migration.c
> +++ b/migration/migration.c
> @@ -1145,16 +1145,6 @@ static void 
> migrate_params_test_apply(MigrateSetParameters *params,
>  dest->cpu_throttle_increment = params->cpu_throttle_increment;
>  }
>  
> -if (params->has_tls_creds) {
> -assert(params->tls_creds->type == QTYPE_QSTRING);
> -dest->tls_creds = g_strdup(params->tls_creds->u.s);
> -}
> -
> -if (params->has_tls_hostname) {
> -assert(params->tls_hostname->type == QTYPE_QSTRING);
> -dest->tls_hostname = g_strdup(params->tls_hostname->u.s);
> -}
> -

Hi, Guangrong,

The memleak seems to be correct here but before that I'm even a bit
confused on why we need to copy the whole parameter list here instead
of checking against a MigrateSetParameters* in migrate_params_check().
Could anyone shed some light?  CC Markus too.

Thanks,

>  if (params->has_max_bandwidth) {
>  dest->max_bandwidth = params->max_bandwidth;
>  }
> -- 
> 2.14.5
> 

Regards,

-- 
Peter Xu



Re: [Qemu-devel] [PATCH v3 0/2] intel-iommu: add support for 5-level virtual IOMMU.

2019-01-14 Thread Yu Zhang
On Mon, Jan 14, 2019 at 11:02:28PM -0500, Michael S. Tsirkin wrote:
> On Wed, Dec 12, 2018 at 09:05:37PM +0800, Yu Zhang wrote:
> > Intel's upcoming processors will extend maximum linear address width to
> > 57 bits, and introduce 5-level paging for CPU. Meanwhile, the platform
> > will also extend the maximum guest address width for IOMMU to 57 bits,
> > thus introducing the 5-level paging for 2nd level translation(See chapter
> > 3 in Intel Virtualization Technology for Directed I/O). 
> > 
> > This patch series extends the current logic to support a wider address 
> > width.
> > A 5-level paging capable IOMMU(for 2nd level translation) can be rendered
> > with configuration "device intel-iommu,x-aw-bits=57".
> > 
> > Also, kvm-unit-tests were updated to verify this patch series. Patch for
> > the test was sent out at: https://www.spinics.net/lists/kvm/msg177425.html.
> > 
> > Note: this patch series checks the existance of 5-level paging in the host
> > and in the guest, and rejects configurations for 57-bit IOVA if either check
> > fails(VTD-d hardware shall not support 57-bit IOVA on platforms without CPU
> > 5-level paging). However, current vIOMMU implementation still lacks logic to
> > check against the physical IOMMU capability, future enhancements are 
> > expected
> > to do this.
> > 
> > Changes in V3: 
> > - Address comments from Peter Xu: squash the 3rd patch in v2 into the 2nd
> >   patch in this version.
> > - Added "Reviewed-by: Peter Xu "
> > 
> > Changes in V2: 
> > - Address comments from Peter Xu: add haw member in vtd_page_walk_info.
> > - Address comments from Peter Xu: only searches for 4K/2M/1G mappings in
> > iotlb are meaningful. 
> > - Address comments from Peter Xu: cover letter changes(e.g. mention the test
> > patch in kvm-unit-tests).
> > - Coding style changes.
> > ---
> > Cc: "Michael S. Tsirkin"  
> > Cc: Igor Mammedov  
> > Cc: Marcel Apfelbaum 
> > Cc: Paolo Bonzini  
> > Cc: Richard Henderson  
> > Cc: Eduardo Habkost 
> > Cc: Peter Xu 
> 
> 
> OK is this going anywhere?
> How about dropping cpu flags probing for now, you can
> always revisit it later.
> Will make it maybe a bit less user friendly but OTOH
> uncontriversial...

Thanks Michael, and sorry for the late reply.

Sure. For patch 2/2, I'd like to drop the cpu check.

And we are working on another patch to check the host capability.
This is supposed to be done by sysfs similar to Peter's previous
suggestion. One exception is that our plan is to use the minimal
capability of all host VT-d hardware. For example, allow 4-level
vIOMMU as long as there is a VT-d hardware do not support 5-level,
in case we offered a 5-level vIOMMU, yet to find later a hotplugged
device is binded to a 4-level VT-d hardware. This patch is not ready
yet, because we also would like to cover the requirement of scalable
mode. So for now, I'm more inclined to just drop the cpu check and
add some TODO comments.

And as to 1/2, I am proposing to address the initialization problem
by resetting the haw in vIOMMU in pc_machine_done() in my another
reply. If you are OK with this direction, I'll send out the patch after
testing. :-)

B.R.
Yu

> 
> > ---
> > 
> > Yu Zhang (2):
> >   intel-iommu: differentiate host address width from IOVA address width.
> >   intel-iommu: extend VTD emulation to allow 57-bit IOVA address width.
> > 
> >  hw/i386/acpi-build.c   |  2 +-
> >  hw/i386/intel_iommu.c  | 96 
> > +-
> >  hw/i386/intel_iommu_internal.h | 10 -
> >  include/hw/i386/intel_iommu.h  | 10 +++--
> >  4 files changed, 81 insertions(+), 37 deletions(-)
> > 
> > -- 
> > 1.9.1
> 



Re: [Qemu-devel] -device foo, help shouldn't be allowed for devices where -device foo is forbidden

2019-01-14 Thread Markus Armbruster
Peter Maydell  writes:

> On Mon, 14 Jan 2019 at 16:59, Thomas Huth  wrote:
>>
>> On 2019-01-14 17:31, Peter Maydell wrote:
>> > We prohibit -device foo for non-pluggable devices:
>> > $ ./build/all/x86_64-softmmu/qemu-system-x86_64 -device i8257
>> > qemu-system-x86_64: -device i8257: Parameter 'driver' expects
>> > pluggable device type
>> >
>> > And we suppress them from "-device help" output too.
>> >
>> > But we still allow the user to do this:
>> >
>> > $ ./build/all/x86_64-softmmu/qemu-system-x86_64 -device i8257,help
>> > i8257 options:
>> >   dshift=
>> >   base=
>> >   pageh-base=
>> >   page-base=
>>
>> Could this still be sometimes useful, e.g. when a device is configured
>> with the "-global" parameter?

That's exactly why we provide this help.  Admittedly obscure.

> Hmm, good point: some of the properties are usefully human
> changeable even for built-in devices. But a lot of them
> are not, if you look at the iotkit example.
> Perhaps a useful compromise would be filtering out the
> "child<" properties? (these are all created via
> object_property_add_child() and user changes to them seem
> unlikely to be ever something that would work).

As long as "seem unlikely to be ever" actually means "are not going to
be", no objection.  I doubt it's worth the effort, though.

A worthier goal would be getting -global to provide help.  Sadly, that
doesn't seem practical in the current state of things.



Re: [Qemu-devel] [PATCH] blk: postpone request execution on a context protected with "drained section"

2019-01-14 Thread Denis Plotnikov
ping ping ping ping

On 09.01.2019 11:18, Denis Plotnikov wrote:
> ping ping!!!
> 
> On 18.12.2018 11:53, Denis Plotnikov wrote:
>> ping ping
>>
>> On 14.12.2018 14:54, Denis Plotnikov wrote:
>>>
>>>
>>> On 13.12.2018 15:20, Kevin Wolf wrote:
 Am 13.12.2018 um 12:07 hat Denis Plotnikov geschrieben:
> On 12.12.2018 15:24, Kevin Wolf wrote:
>> Am 11.12.2018 um 17:55 hat Denis Plotnikov geschrieben:
 Why involve the AioContext at all? This could all be kept at the
 BlockBackend level without extending the layering violation that
 aio_disable_external() is.

 BlockBackends get notified when their root node is drained, so 
 hooking
 things up there should be as easy, if not even easier than in
 AioContext.
>>>
>>> Just want to make sure that I understood correctly what you meant by
>>> "BlockBackends get notified". Did you mean that bdrv_drain_end calls
>>> child's role callback blk_root_drained_end by calling
>>> bdrv_parent_drained_end?
>>
>> Yes, blk_root_drained_begin/end calls are all you need. Specifically,
>> their adjustments to blk->quiesce_counter that are already there, 
>> and in
>> the 'if (--blk->quiesce_counter == 0)' block of 
>> blk_root_drained_end()
>> we can resume the queued requests.
> Sounds it should be so, but it doesn't work that way and that's why:
> when doing mirror we may resume postponed coroutines too early when 
> the
> underlying bs is protected from writing at and thus we encounter the
> assert on a write request execution at bdrv_co_write_req_prepare when
> resuming the postponed coroutines.
>
> The thing is that the bs is protected for writing before execution of
> bdrv_replace_node at mirror_exit_common and bdrv_replace_node calls
> bdrv_replace_child_noperm which, in turn, calls 
> child->role->drained_end
> where one of the callbacks is blk_root_drained_end which check
> if(--blk->quiesce_counter == 0) and runs the postponed requests
> (coroutines) if the coundition is true.

 Hm, so something is messed up with the drain sections in the mirror
 driver. We have:

  bdrv_drained_begin(target_bs);
  bdrv_replace_node(to_replace, target_bs, _err);
  bdrv_drained_end(target_bs);

 Obviously, the intention was to keep the BlockBackend drained during
 bdrv_replace_node(). So how could blk->quiesce_counter ever get to 0
 inside bdrv_replace_node() when target_bs is drained?

 Looking at bdrv_replace_child_noperm(), it seems that the function has
 a bug: Even if old_bs and new_bs are both drained, the quiesce_counter
 for the parent reaches 0 for a moment because we call .drained_end for
 the old child first and .drained_begin for the new one later.

 So it seems the fix would be to reverse the order and first call
 .drained_begin for the new child and then .drained_end for the old
 child. Sounds like a good new testcase for tests/test-bdrv-drain.c, 
 too.
>>> Yes, it's true, but it's not enough...
>>> In mirror_exit_common() we actively manipulate with block driver states.
>>> When we replaced a node in the snippet you showed we can't allow the 
>>> postponed coroutines to run because the block tree isn't ready to 
>>> receive the requests yet.
>>> To be ready, we need to insert a proper block driver state to the 
>>> block backend which is done here
>>>
>>>  blk_remove_bs(bjob->blk);
>>>  blk_set_perm(bjob->blk, 0, BLK_PERM_ALL, _abort);
>>>  blk_insert_bs(bjob->blk, mirror_top_bs, _abort); << << << <<
>>>
>>>  bs_opaque->job = NULL;
>>>
>>>  bdrv_drained_end(src);
>>>
>>> If the tree isn't ready and we resume the coroutines, we'll end up 
>>> with the request landed in a wrong block driver state.
>>>
>>> So, we explicitly should stop all activities on all the driver states
>>> and its parents and allow the activities when everything is ready to go.
>>>
>>> Why explicitly, because the block driver states may belong to 
>>> different block backends at the moment of the manipulation beginning.
>>>
>>> So, it seems we need to disable all their contexts until the 
>>> manipulation ends.
>>>
>>> Please, correct me if I'm wrong.
>>>

> In seems that if the external requests disabled on the context we 
> can't
> rely on anything or should check where the underlying bs and its
> underlying nodes are ready to receive requests which sounds quite
> complicated.
> Please correct me if still don't understand something in that routine.

 I think the reason why reyling on aio_disable_external() works is 
 simply
 because src is also drained, which keeps external events in the
 AioContext disabled despite the bug in draining the target node.

 The bug would become apparent even with aio_disable_external() if we
 didn't drain src, or even if 

Re: [Qemu-devel] [PATCH 03/10] vhost-net: compile it for all targets

2019-01-14 Thread Paolo Bonzini
On 15/01/19 04:50, Michael S. Tsirkin wrote:
> On Thu, Nov 15, 2018 at 07:42:20PM +0100, Paolo Bonzini wrote:
>> On 15/11/2018 15:31, Paolo Bonzini wrote:
>>> Currently vhost-net is compiled only for KVM-enabled targets.  This is
>>> not needed anymore because ioeventfd is supported and emulated by the
>>> memory core.  Compile it and vhost-user-test for all targets.
>>> While at it, fix the annoying typo CONFIG_VHOST_NET_USED.
>>>
>>> Signed-off-by: Paolo Bonzini 
>>> ---
>>>  configure  | 13 +
>>>  include/exec/poison.h  |  1 -
>>>  net/net.c  |  2 +-
>>>  tests/Makefile.include |  5 +
>>>  4 files changed, 7 insertions(+), 14 deletions(-)
>>>
>>> diff --git a/configure b/configure
>>> index 5b1d83ea26..d8317e1832 100755
>>> --- a/configure
>>> +++ b/configure
>>> @@ -6512,8 +6512,11 @@ fi
>>>  if test "$vhost_scsi" = "yes" ; then
>>>echo "CONFIG_VHOST_SCSI=y" >> $config_host_mak
>>>  fi
>>> -if test "$vhost_net" = "yes" -a "$vhost_user" = "yes"; then
>>> -  echo "CONFIG_VHOST_NET_USED=y" >> $config_host_mak
>>> +if test "$vhost_net" = "yes" ; then
>>> +  echo "CONFIG_VHOST_NET=y" >> $config_host_mak
>>> +  if test "$vhost_user" = "yes"; then
>>> +echo "CONFIG_VHOST_NET_USER=y" >> $config_host_mak
>>> +  fi
>>>  fi
>>>  if test "$vhost_crypto" = "yes" ; then
>>>echo "CONFIG_VHOST_CRYPTO=y" >> $config_host_mak
>>> @@ -7275,12 +7278,6 @@ if supported_xen_target $target; then
>>>  fi
>>>  if supported_kvm_target $target; then
>>>  echo "CONFIG_KVM=y" >> $config_target_mak
>>> -if test "$vhost_net" = "yes" ; then
>>> -echo "CONFIG_VHOST_NET=y" >> $config_target_mak
>>> -if test "$vhost_user" = "yes" ; then
>>> -echo "CONFIG_VHOST_USER_NET_TEST_$target_name=y" >> 
>>> $config_host_mak
>>> -fi
>>> -fi
>>>  fi
>>>  if supported_hax_target $target; then
>>>  echo "CONFIG_HAX=y" >> $config_target_mak
>>> diff --git a/include/exec/poison.h b/include/exec/poison.h
>>> index 32d53789f8..b158632791 100644
>>> --- a/include/exec/poison.h
>>> +++ b/include/exec/poison.h
>>> @@ -85,7 +85,6 @@
>>>  #pragma GCC poison CONFIG_XTENSA_DIS
>>>  
>>>  #pragma GCC poison CONFIG_LINUX_USER
>>> -#pragma GCC poison CONFIG_VHOST_NET
>>>  #pragma GCC poison CONFIG_KVM
>>>  #pragma GCC poison CONFIG_SOFTMMU
>>>  
>>> diff --git a/net/net.c b/net/net.c
>>> index 07c194a8f6..95a74add6c 100644
>>> --- a/net/net.c
>>> +++ b/net/net.c
>>> @@ -955,7 +955,7 @@ static int (* const 
>>> net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
>>>  [NET_CLIENT_DRIVER_BRIDGE]= net_init_bridge,
>>>  #endif
>>>  [NET_CLIENT_DRIVER_HUBPORT]   = net_init_hubport,
>>> -#ifdef CONFIG_VHOST_NET_USED
>>> +#ifdef CONFIG_VHOST_NET_USER
>>>  [NET_CLIENT_DRIVER_VHOST_USER] = net_init_vhost_user,
>>>  #endif
>>>  #ifdef CONFIG_L2TPV3
>>> diff --git a/tests/Makefile.include b/tests/Makefile.include
>>> index fb0b449c02..03a64ce9c8 100644
>>> --- a/tests/Makefile.include
>>> +++ b/tests/Makefile.include
>>> @@ -204,10 +204,7 @@ check-qtest-i386-$(CONFIG_USB_XHCI_NEC) += 
>>> tests/usb-hcd-xhci-test$(EXESUF)
>>>  check-qtest-i386-y += tests/cpu-plug-test$(EXESUF)
>>>  check-qtest-i386-y += tests/q35-test$(EXESUF)
>>>  check-qtest-i386-y += tests/vmgenid-test$(EXESUF)
>>> -check-qtest-i386-$(CONFIG_VHOST_USER_NET_TEST_i386) += 
>>> tests/vhost-user-test$(EXESUF)
>>> -ifeq ($(CONFIG_VHOST_USER_NET_TEST_i386),)
>>> -check-qtest-x86_64-$(CONFIG_VHOST_USER_NET_TEST_x86_64) += 
>>> tests/vhost-user-test$(EXESUF)
>>> -endif
>>> +check-qtest-i386-$(CONFIG_VHOST_NET_USER) += tests/vhost-user-test$(EXESUF)
>>>  check-qtest-i386-$(CONFIG_TPM_CRB) += tests/tpm-crb-swtpm-test$(EXESUF)
>>>  check-qtest-i386-$(CONFIG_TPM_CRB) += tests/tpm-crb-test$(EXESUF)
>>>  check-qtest-i386-$(CONFIG_TPM_TIS) += tests/tpm-tis-swtpm-test$(EXESUF)
>>>
>>
>> FWIW this is unfortunately not that simple.  Patchew will surely notice.
>> :)  I will post v2 when I get reviews for everything else.
> 
> So with the header split this can now go in I guess?
> Want to repost?

Yes.  I'll do it later today after testing.

Paolo



Re: [Qemu-devel] [PATCH v3 1/2] intel-iommu: differentiate host address width from IOVA address width.

2019-01-14 Thread Yu Zhang
On Fri, Dec 28, 2018 at 11:29:41PM -0200, Eduardo Habkost wrote:
> On Fri, Dec 28, 2018 at 10:32:59AM +0800, Yu Zhang wrote:
> > On Thu, Dec 27, 2018 at 01:14:11PM -0200, Eduardo Habkost wrote:
> > > On Wed, Dec 26, 2018 at 01:30:00PM +0800, Yu Zhang wrote:
> > > > On Tue, Dec 25, 2018 at 11:56:19AM -0500, Michael S. Tsirkin wrote:
> > > > > On Sat, Dec 22, 2018 at 09:11:26AM +0800, Yu Zhang wrote:
> > > > > > On Fri, Dec 21, 2018 at 02:02:28PM -0500, Michael S. Tsirkin wrote:
> > > > > > > On Sat, Dec 22, 2018 at 01:37:58AM +0800, Yu Zhang wrote:
> > > > > > > > On Fri, Dec 21, 2018 at 12:04:49PM -0500, Michael S. Tsirkin 
> > > > > > > > wrote:
> > > > > > > > > On Sat, Dec 22, 2018 at 12:09:44AM +0800, Yu Zhang wrote:
> > > > > > > > > > Well, my understanding of the vt-d spec is that the address 
> > > > > > > > > > limitation in
> > > > > > > > > > DMAR are referring to the same concept of 
> > > > > > > > > > CPUID.MAXPHYSADDR. I do not think
> > > > > > > > > > there's any different in the native scenario. :)
> > > > > > > > > 
> > > > > > > > > I think native machines exist on which the two values are 
> > > > > > > > > different.
> > > > > > > > > Is that true?
> > > > > > > > 
> > > > > > > > I think the answer is not. My understanding is that HAW(host 
> > > > > > > > address wdith) is
> > > > > > > > the maximum physical address width a CPU can detects(by 
> > > > > > > > cpuid.0x8008).
> > > > > > > > 
> > > > > > > > I agree there are some addresses the CPU does not touch, but 
> > > > > > > > they are still in
> > > > > > > > the physical address space, and there's only one physical 
> > > > > > > > address space...
> > > > > > > > 
> > > > > > > > B.R.
> > > > > > > > Yu
> > > > > > > 
> > > > > > > Ouch I thought we are talking about the virtual address size.
> > > > > > > I think I did have a box where VTD's virtual address size was
> > > > > > > smaller than CPU's.
> > > > > > > For physical one - we just need to make it as big as max supported
> > > > > > > memory right?
> > > > > > 
> > > > > > Well, my understanding of the physical one is the maximum physical 
> > > > > > address
> > > > > > width. Sorry, this explain seems nonsense... I mean, it's not just 
> > > > > > about
> > > > > > the max supported memory, but also covers MMIO. It shall be 
> > > > > > detectable
> > > > > > from cpuid, or ACPI's DMAR table, instead of calculated by the max 
> > > > > > memory
> > > > > > size. One common usage of this value is to tell the paging 
> > > > > > structure entries(
> > > > > > CPU's or IOMMU's) which bits shall be reserved. There are also some 
> > > > > > registers
> > > > > > e.g. apic base reg etc, whose contents are physical addresses, 
> > > > > > therefore also
> > > > > > need to follow the similar requirement for the reserved bits.
> > > > > > 
> > > > > > So I think the correct direction might be to define this property 
> > > > > > in the
> > > > > > machine status level, instead of the CPU level. Is this reasonable 
> > > > > > to you?
> > > > > 
> > > > > At that level yes. But isn't this already specified by 
> > > > > "pci-hole64-end"?
> > > > 
> > > > But this value is set by guest firmware? Will PCI hotplug change this 
> > > > address?
> > > > 
> > > > @Eduardo, do you have any plan to calculate the phys-bits by 
> > > > "pci-hole64-end"?
> > > > Or introduce another property, say "max-phys-bits" in machine status?
> > > 
> > > I agree it may make sense to make the machine code control
> > > phys-bits instead of the CPU object.  A machine property sounds
> > > like the simplest solution.
> > > 
> > > But I don't think we can have a meaningful discussion about
> > > implementation if we don't agree about the command-line
> > > interface.  We must decide what will happen to the CPU and iommu
> > > physical address width in cases like:
> > 
> > Thanks, Eduardo.
> > 
> > What about we just use "-machine phys-bits=52", and remove the
> > "phys-bits" from CPU parameter?
> 
> Maybe we can deprecate it, but we can't remove it immediately.
> We still need to decide what to do on the cases below, while the
> option is still available.

I saw the ACPI DMAR is ininitialized in acpi_build(), which is called
by pc_machine_done(). I guess this is done after the initialization of
vCPU and vIOMMU.

So I am wondering, instead of moving "phys-bits" from X86CPU into the
MachineState, maybe we could:

1> Define a "phys_bits" in MachineState or PCMachineState(not sure which
one is more suitable).

2> Set ms->phys_bits in x86_cpu_realizefn().

3> Since DMAR is created after vCPU creation, we can build DMAR table
with ms->phys_bits.

4> Also, we can reset the hardware address width for vIOMMU(and the
vtd_paging_entry_rsvd_field array) in pc_machine_done(), based on the value
of ms->phys_bits, or from ACPI DMAR table(from spec point of view, address
width limitation of IOMMU shall come from DMAR, yet I have not figured out
any simple approach to probe the ACPI property). 

This way, 

Re: [Qemu-devel] [PATCH v2] hw/misc/ivshmem: Remove deprecated "ivshmem" legacy device

2019-01-14 Thread Thomas Huth
On 2019-01-14 19:08, Michael S. Tsirkin wrote:
> On Mon, Jan 14, 2019 at 04:04:10PM -0200, Eduardo Habkost wrote:
>> On Wed, Dec 19, 2018 at 03:56:30PM +0100, Markus Armbruster wrote:
>>> Thomas Huth  writes:
>>>
 It's been marked as deprecated in QEMU v2.6.0 already, so really nobody
 should use the legacy "ivshmem" device anymore (but use ivshmem-plain or
 ivshmem-doorbell instead). Time to remove the deprecated device now.

 Belatedly also update a mention of the deprecated "ivshmem" in the file
 docs/specs/ivshmem-spec.txt to "ivshmem-doorbell". Missed in commit
 5400c02b90b ("ivshmem: Split ivshmem-plain, ivshmem-doorbell off ivshmem").

 Signed-off-by: Thomas Huth 
>>>
>>> Reviewed-by: Markus Armbruster 
>>
>> Who should merge this?
> 
> I can do it.

Thanks, but since there is no dedicated maintainer for ivshmem, I've
already put it in my PULL request yesterday.

 Thomas



Re: [Qemu-devel] [PATCH V8 5/5] hostmem-file: add 'sync' option

2019-01-14 Thread Yi Zhang
On 2019-01-14 at 22:31:45 -0500, Michael S. Tsirkin wrote:
> On Wed, Jan 02, 2019 at 01:26:34PM +0800, Zhang Yi wrote:
> > This option controls will mmap the memory backend file with MAP_SYNC flag,
> > which can ensure filesystem metadata consistent even after a system crash
> > or power failure, if MAP_SYNC flag is supported by the host kernel(Linux
> > kernel 4.15 and later) and the backend is a file supporting DAX (e.g.,
> > file on ext4/xfs file system mounted with '-o dax').
> > 
> > It can take one of following values:
> >  - on:  try to pass MAP_SYNC to mmap(2); if MAP_SYNC is not supported or
> > 'share=off' or 'pmem!=on', QEMU will not pass this flags to
> > mmap(2)
> >  - off: default, never pass MAP_SYNC to mmap(2)
> > 
> > Signed-off-by: Haozhong Zhang 
> > Signed-off-by: Zhang Yi 
> 
> 
> So we introduce all of the above complexity and then I am pretty sure go
> on and teach management tools to just always, without exception, set
> sync=on to avoid data corruption.
> 
> So how about we give up on a bit of flexibility, and just say
> pmem=on forces MAP_SYNC?
> 
> OTOH if you really really want a fast memory then why set pmem=on at
> all?

Indeed, All my concern is that we do need to pass the sync to a type of
pmem which didn't backend on a dax aware file. Anyway, I will drop the
sync option, and let it on while we set pmem, Thanks your suggestion.
Michael.

> 
> Or, if you have some data that shows how disabling synchronous
> pagefaults helps performance a lot, maybe we should introduce
> a "crash-unsafe" flag.
> 
> 
> 
> > ---
> >  backends/hostmem-file.c   | 28 
> >  docs/nvdimm.txt   | 23 ++-
> >  exec.c|  2 +-
> >  include/exec/memory.h |  4 
> >  include/exec/ram_addr.h   |  1 +
> >  include/qemu/mmap-alloc.h |  1 +
> >  qemu-options.hx   | 19 ++-
> >  util/mmap-alloc.c |  4 ++--
> >  8 files changed, 77 insertions(+), 5 deletions(-)
> > 
> > diff --git a/backends/hostmem-file.c b/backends/hostmem-file.c
> > index 0dd7a90..3d39032 100644
> > --- a/backends/hostmem-file.c
> > +++ b/backends/hostmem-file.c
> > @@ -36,6 +36,7 @@ struct HostMemoryBackendFile {
> >  uint64_t align;
> >  bool discard_data;
> >  bool is_pmem;
> > +bool sync;
> >  };
> >  
> >  static void
> > @@ -62,6 +63,7 @@ file_backend_memory_alloc(HostMemoryBackend *backend, 
> > Error **errp)
> >   path,
> >   backend->size, fb->align,
> >   (backend->share ? RAM_SHARED : 0) |
> > + (fb->sync ? RAM_SYNC : 0) |
> >   (fb->is_pmem ? RAM_PMEM : 0),
> >   fb->mem_path, errp);
> >  g_free(path);
> > @@ -136,6 +138,29 @@ static void file_memory_backend_set_align(Object *o, 
> > Visitor *v,
> >  error_propagate(errp, local_err);
> >  }
> >  
> > +static bool file_memory_backend_get_sync(Object *o, Error **errp)
> > +{
> > +return MEMORY_BACKEND_FILE(o)->sync;
> > +}
> > +
> > +static void file_memory_backend_set_sync(
> > +Object *obj, bool value, Error **errp)
> > +{
> > +HostMemoryBackend *backend = MEMORY_BACKEND(obj);
> > +HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(obj);
> > +
> > +if (host_memory_backend_mr_inited(backend)) {
> > +error_setg(errp, "cannot change property sync of %s",
> > +   object_get_typename(obj));
> > +goto out;
> > +}
> > +
> > +fb->sync = value;
> > +
> > + out:
> > +return;
> > +}
> > +
> >  static bool file_memory_backend_get_pmem(Object *o, Error **errp)
> >  {
> >  return MEMORY_BACKEND_FILE(o)->is_pmem;
> > @@ -203,6 +228,9 @@ file_backend_class_init(ObjectClass *oc, void *data)
> >  object_class_property_add_bool(oc, "pmem",
> >  file_memory_backend_get_pmem, file_memory_backend_set_pmem,
> >  _abort);
> > +object_class_property_add_bool(oc, "sync",
> > +file_memory_backend_get_sync, file_memory_backend_set_sync,
> > +_abort);
> >  }
> >  
> >  static void file_backend_instance_finalize(Object *o)
> > diff --git a/docs/nvdimm.txt b/docs/nvdimm.txt
> > index 5f158a6..30db458 100644
> > --- a/docs/nvdimm.txt
> > +++ b/docs/nvdimm.txt
> > @@ -142,11 +142,32 @@ backend of vNVDIMM:
> >  Guest Data Persistence
> >  --
> >  
> > +vNVDIMM is designed and implemented to guarantee the guest data
> > +persistence on the backends even on the host crash and power
> > +failures. However, there are still some requirements and limitations
> > +as explained below.
> > +
> >  Though QEMU supports multiple types of vNVDIMM backends on Linux,
> > -currently the only one that can guarantee the guest write persistence
> > +if MAP_SYNC is not supported by the host kernel and the backends,
> > +the only backend that can guarantee the guest write 

Re: [Qemu-devel] [PATCH v4 for-4.0 2/7] vhost-user: Support transferring inflight buffer between qemu and backend

2019-01-14 Thread Yongji Xie
On Tue, 15 Jan 2019 at 06:25, Michael S. Tsirkin  wrote:
>
> On Wed, Jan 09, 2019 at 07:27:23PM +0800, elohi...@gmail.com wrote:
> > @@ -382,6 +397,30 @@ If VHOST_USER_PROTOCOL_F_SLAVE_SEND_FD protocol 
> > feature is negotiated,
> >  slave can send file descriptors (at most 8 descriptors in each message)
> >  to master via ancillary data using this fd communication channel.
> >
> > +Inflight I/O tracking
> > +-
> > +
> > +To support slave reconnecting, slave need to track inflight I/O in a
> > +shared memory. VHOST_USER_GET_INFLIGHT_FD and VHOST_USER_SET_INFLIGHT_FD
> > +are used to transfer the memory between master and slave. And to encourage
> > +consistency, we provide a recommended format for this memory:
>
> I think we should make a stronger statement and actually
> just say what the format is. Not recommend it weakly.
>

Okey, will do it.

> > +
> > +offsetwidthdescription
> > +0x0  0x400region for queue0
> > +0x4000x400region for queue1
> > +0x8000x400region for queue2
> > +...  ...  ...
> > +
> > +For each virtqueue, we have a 1024 bytes region.
>
>
> Why is the size hardcoded? Why not a function of VQ size?
>

Sorry, I didn't get your point. Should the region's size be fixed? Do
you mean we need to document a function for the region's size?

>
> > The region's format is like:
> > +
> > +offset   widthdescription
> > +0x0  0x1  descriptor 0 is in use or not
> > +0x1  0x1  descriptor 1 is in use or not
> > +0x2  0x1  descriptor 2 is in use or not
> > +...  ...  ...
> > +
> > +For each descriptor, we use one byte to specify whether it's in use or not.
> > +
> >  Protocol features
> >  -
> >
>
> I think that it's a good idea to have a version in this region.
> Otherwise how are you going to handle compatibility when
> this needs to be extended?
>

I have put the version into the message's payload: VhostUserInflight. Is it OK?

Thanks,
Yongji



Re: [Qemu-devel] [PATCH v3 2/5] virtio-pmem: Add virtio pmem driver

2019-01-14 Thread Pankaj Gupta


> > This patch adds virtio-pmem driver for KVM guest.
> > 
> > Guest reads the persistent memory range information from
> > Qemu over VIRTIO and registers it on nvdimm_bus. It also
> > creates a nd_region object with the persistent memory
> > range information so that existing 'nvdimm/pmem' driver
> > can reserve this into system memory map. This way
> > 'virtio-pmem' driver uses existing functionality of pmem
> > driver to register persistent memory compatible for DAX
> > capable filesystems.
> > 
> > This also provides function to perform guest flush over
> > VIRTIO from 'pmem' driver when userspace performs flush
> > on DAX memory range.
> > 
> > Signed-off-by: Pankaj Gupta 
> > ---
> >  drivers/nvdimm/virtio_pmem.c |  84 ++
> >  drivers/virtio/Kconfig   |  10 
> >  drivers/virtio/Makefile  |   1 +
> >  drivers/virtio/pmem.c| 124
> >  +++
> >  include/linux/virtio_pmem.h  |  60 +++
> >  include/uapi/linux/virtio_ids.h  |   1 +
> >  include/uapi/linux/virtio_pmem.h |  10 
> 
> As with any uapi change, you need to CC the virtio dev
> mailing list (subscribers only, sorry about that).

Sure, will add virtio dev mailing list while sending v4.

Thanks,
Pankaj

> 
> 
> >  7 files changed, 290 insertions(+)
> >  create mode 100644 drivers/nvdimm/virtio_pmem.c
> >  create mode 100644 drivers/virtio/pmem.c
> >  create mode 100644 include/linux/virtio_pmem.h
> >  create mode 100644 include/uapi/linux/virtio_pmem.h
> > 
> > diff --git a/drivers/nvdimm/virtio_pmem.c b/drivers/nvdimm/virtio_pmem.c
> > new file mode 100644
> > index 000..2a1b1ba
> > --- /dev/null
> > +++ b/drivers/nvdimm/virtio_pmem.c
> > @@ -0,0 +1,84 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/*
> > + * virtio_pmem.c: Virtio pmem Driver
> > + *
> > + * Discovers persistent memory range information
> > + * from host and provides a virtio based flushing
> > + * interface.
> > + */
> > +#include 
> > +#include "nd.h"
> > +
> > + /* The interrupt handler */
> > +void host_ack(struct virtqueue *vq)
> > +{
> > +   unsigned int len;
> > +   unsigned long flags;
> > +   struct virtio_pmem_request *req, *req_buf;
> > +   struct virtio_pmem *vpmem = vq->vdev->priv;
> > +
> > +   spin_lock_irqsave(>pmem_lock, flags);
> > +   while ((req = virtqueue_get_buf(vq, )) != NULL) {
> > +   req->done = true;
> > +   wake_up(>host_acked);
> > +
> > +   if (!list_empty(>req_list)) {
> > +   req_buf = list_first_entry(>req_list,
> > +   struct virtio_pmem_request, list);
> > +   list_del(>req_list);
> > +   req_buf->wq_buf_avail = true;
> > +   wake_up(_buf->wq_buf);
> > +   }
> > +   }
> > +   spin_unlock_irqrestore(>pmem_lock, flags);
> > +}
> > +EXPORT_SYMBOL_GPL(host_ack);
> > +
> > + /* The request submission function */
> > +int virtio_pmem_flush(struct nd_region *nd_region)
> > +{
> > +   int err;
> > +   unsigned long flags;
> > +   struct scatterlist *sgs[2], sg, ret;
> > +   struct virtio_device *vdev = nd_region->provider_data;
> > +   struct virtio_pmem *vpmem = vdev->priv;
> > +   struct virtio_pmem_request *req;
> > +
> > +   might_sleep();
> > +   req = kmalloc(sizeof(*req), GFP_KERNEL);
> > +   if (!req)
> > +   return -ENOMEM;
> > +
> > +   req->done = req->wq_buf_avail = false;
> > +   strcpy(req->name, "FLUSH");
> > +   init_waitqueue_head(>host_acked);
> > +   init_waitqueue_head(>wq_buf);
> > +   sg_init_one(, req->name, strlen(req->name));
> > +   sgs[0] = 
> > +   sg_init_one(, >ret, sizeof(req->ret));
> > +   sgs[1] = 
> > +
> > +   spin_lock_irqsave(>pmem_lock, flags);
> > +   err = virtqueue_add_sgs(vpmem->req_vq, sgs, 1, 1, req, GFP_ATOMIC);
> > +   if (err) {
> > +   dev_err(>dev, "failed to send command to virtio pmem 
> > device\n");
> > +
> > +   list_add_tail(>req_list, >list);
> > +   spin_unlock_irqrestore(>pmem_lock, flags);
> > +
> > +   /* When host has read buffer, this completes via host_ack */
> > +   wait_event(req->wq_buf, req->wq_buf_avail);
> > +   spin_lock_irqsave(>pmem_lock, flags);
> > +   }
> > +   virtqueue_kick(vpmem->req_vq);
> > +   spin_unlock_irqrestore(>pmem_lock, flags);
> > +
> > +   /* When host has read buffer, this completes via host_ack */
> > +   wait_event(req->host_acked, req->done);
> > +   err = req->ret;
> > +   kfree(req);
> > +
> > +   return err;
> > +};
> > +EXPORT_SYMBOL_GPL(virtio_pmem_flush);
> > +MODULE_LICENSE("GPL");
> > diff --git a/drivers/virtio/Kconfig b/drivers/virtio/Kconfig
> > index 3589764..9f634a2 100644
> > --- a/drivers/virtio/Kconfig
> > +++ b/drivers/virtio/Kconfig
> > @@ -42,6 +42,16 @@ config VIRTIO_PCI_LEGACY
> >  
> >   If unsure, say Y.
> >  
> > +config VIRTIO_PMEM
> > +   tristate "Support for virtio pmem driver"
> > +   depends on VIRTIO
> > +   depends on 

Re: [Qemu-devel] [PULL 00/44] pci, pc, virtio: fixes, features

2019-01-14 Thread Peter Xu
On Mon, Jan 14, 2019 at 08:35:11PM -0500, Michael S. Tsirkin wrote:
> The following changes since commit 89bd861c2b470e3fb45596945509079c72af3ac2:
> 
>   Merge remote-tracking branch 'remotes/ehabkost/tags/x86-next-pull-request' 
> into staging (2019-01-14 17:35:00 +)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream
> 
> for you to fetch changes up to b421506a3ac2f1b2a4f18d6f423a92dfa16e2645:
> 
>   acpi: update expected files (2019-01-14 19:31:05 -0500)
> 
> 
> pci, pc, virtio: fixes, features
> 
> tpm physical presence interface
> rsc support in virtio net
> ivshmem is removed
> misc cleanups and fixes all over the place

Hi, Michael,

Do you want to review/queue some VT-d patches that I posted recently?

[PATCH 0/5] intel_iommu: misc fixes for error exposed after error_report_once()
(https://patchwork.kernel.org/cover/10751913/, patch 5 dropped though)

They fix some bugs that were recently exposed.  Currently only the
first two patches got acked-by from Jason.

They don't worth to block the pull but IMHO they fix real problems so
just to make sure they won't fall through the cracks.

Thanks!

-- 
Peter Xu



Re: [Qemu-devel] [PATCH v3 0/5] kvm "virtio pmem" device

2019-01-14 Thread Pankaj Gupta


> > > >
> > > > On Mon, Jan 14, 2019 at 02:15:40AM -0500, Pankaj Gupta wrote:
> > > > >
> > > > > > > Until you have images (and hence host page cache) shared between
> > > > > > > multiple guests. People will want to do this, because it means
> > > > > > > they
> > > > > > > only need a single set of pages in host memory for executable
> > > > > > > binaries rather than a set of pages per guest. Then you have
> > > > > > > multiple guests being able to detect residency of the same set of
> > > > > > > pages. If the guests can then, in any way, control eviction of
> > > > > > > the
> > > > > > > pages from the host cache, then we have a guest-to-guest
> > > > > > > information
> > > > > > > leak channel.
> > > > > >
> > > > > > I don't think we should ever be considering something that would
> > > > > > allow a
> > > > > > guest to evict page's from the host's pagecache [1].  The guest
> > > > > > should
> > > > > > be able to kick its own references to the host's pagecache out of
> > > > > > its
> > > > > > own pagecache, but not be able to influence whether the host or
> > > > > > another
> > > > > > guest has a read-only mapping cached.
> > > > > >
> > > > > > [1] Unless the guest is allowed to modify the host's file;
> > > > > > obviously
> > > > > > truncation, holepunching, etc are going to evict pages from the
> > > > > > host's
> > > > > > page cache.
> > > > >
> > > > > This is so correct. Guest does not not evict host page cache pages
> > > > > directly.
> > > >
> > > > They don't right now.
> > > >
> > > > But someone is going to end up asking for discard to work so that
> > > > the guest can free unused space in the underlying spares image (i.e.
> > > > make use of fstrim or mount -o discard) because they have workloads
> > > > that have bursts of space usage and they need to trim the image
> > > > files afterwards to keep their overall space usage under control.
> > > >
> > > > And then
> > > 
> > > ...we reject / push back on that patch citing the above concern.
> > 
> > So at what point do we draw the line?
> > 
> > We're allowing writable DAX mappings, but as I've pointed out that
> > means we are going to be allowing  a potential information leak via
> > files with shared extents to be directly mapped and written to.
> > 
> > But we won't allow useful admin operations that allow better
> > management of host side storage space similar to how normal image
> > files are used by guests because it's an information leak vector?
> > 
> > That's splitting some really fine hairs there...
> 
> May I summarize that th security implications need to
> be documented?
> 
> In fact that would make a fine security implications section
> in the device specification.

This is a very good suggestion. 

I will document the security implications in details in device specification
with details of what all filesystem features we don't support and why.

Best regards,
Pankaj

> 
> 
> 
> 
> 
> > > > > In case of virtio-pmem & DAX, guest clears guest page cache
> > > > > exceptional entries.
> > > > > Its solely decision of host to take action on the host page cache
> > > > > pages.
> > > > >
> > > > > In case of virtio-pmem, guest does not modify host file directly i.e
> > > > > don't
> > > > > perform hole punch & truncation operation directly on host file.
> > > >
> > > > ... this will no longer be true, and the nuclear landmine in this
> > > > driver interface will have been armed
> > > 
> > > I agree with the need to be careful when / if explicit cache control
> > > is added, but that's not the case today.
> > 
> > "if"?
> > 
> > I expect it to be "when", not if. Expect the worst, plan for it now.
> > 
> > Cheers,
> > 
> > Dave.
> > --
> > Dave Chinner
> > da...@fromorbit.com
> 
> 



Re: [Qemu-devel] [PATCH v3 0/5] kvm "virtio pmem" device

2019-01-14 Thread Pankaj Gupta


> > > On Mon, Jan 14, 2019 at 02:15:40AM -0500, Pankaj Gupta wrote:
> > > >
> > > > > > Until you have images (and hence host page cache) shared between
> > > > > > multiple guests. People will want to do this, because it means they
> > > > > > only need a single set of pages in host memory for executable
> > > > > > binaries rather than a set of pages per guest. Then you have
> > > > > > multiple guests being able to detect residency of the same set of
> > > > > > pages. If the guests can then, in any way, control eviction of the
> > > > > > pages from the host cache, then we have a guest-to-guest
> > > > > > information
> > > > > > leak channel.
> > > > >
> > > > > I don't think we should ever be considering something that would
> > > > > allow a
> > > > > guest to evict page's from the host's pagecache [1].  The guest
> > > > > should
> > > > > be able to kick its own references to the host's pagecache out of its
> > > > > own pagecache, but not be able to influence whether the host or
> > > > > another
> > > > > guest has a read-only mapping cached.
> > > > >
> > > > > [1] Unless the guest is allowed to modify the host's file; obviously
> > > > > truncation, holepunching, etc are going to evict pages from the
> > > > > host's
> > > > > page cache.
> > > >
> > > > This is so correct. Guest does not not evict host page cache pages
> > > > directly.
> > >
> > > They don't right now.
> > >
> > > But someone is going to end up asking for discard to work so that
> > > the guest can free unused space in the underlying spares image (i.e.
> > > make use of fstrim or mount -o discard) because they have workloads
> > > that have bursts of space usage and they need to trim the image
> > > files afterwards to keep their overall space usage under control.
> > >
> > > And then
> > 
> > ...we reject / push back on that patch citing the above concern.
> 
> So at what point do we draw the line?
> 
> We're allowing writable DAX mappings, but as I've pointed out that
> means we are going to be allowing  a potential information leak via
> files with shared extents to be directly mapped and written to.
> 
> But we won't allow useful admin operations that allow better
> management of host side storage space similar to how normal image
> files are used by guests because it's an information leak vector?

First of all Thank you for all the useful discussions. 
I am summarizing here:

- We have to live with the limitation to not support fstrim and 
  mount -o discard options with virtio-pmem as they will evict 
  host page cache pages. We cannot allow this for virtio-pmem
  for security reasons. These filesystem commands will just zero out 
  unused pages currently.

- If alot of space is unused and not freed guest can request host 
  Administrator for truncating the host backing image. 
  We are also planning to support qcow2 sparse image format at 
  host side with virtio-pmem.

- There is no existing solution for Qemu persistent memory 
  emulation with write support currently. This solution provides 
  us the paravartualized way of emulating persistent memory. It 
  does not emulate of ACPI structures instead it just uses VIRTIO 
  for communication between guest & host. It is fast because of its
  asynchronous nature and it works well. This makes use of at guest 
  side libnvdimm API's 
  
- If disk size freeing problem with guest files trim truncate is 
  very important for users, they can still use real hardware which 
  will provide them both (advance disk features & page cache by pass).

Considering all the above reasons I think this feature is useful
from virtualization point of view. As Dave rightly said we should
be careful and I think now we are careful with the security implications
of this device. 

Thanks again for all the inputs.

Best regards,
Pankaj  


> 
> That's splitting some really fine hairs there...
> 
> > > > In case of virtio-pmem & DAX, guest clears guest page cache exceptional
> > > > entries.
> > > > Its solely decision of host to take action on the host page cache
> > > > pages.
> > > >
> > > > In case of virtio-pmem, guest does not modify host file directly i.e
> > > > don't
> > > > perform hole punch & truncation operation directly on host file.
> > >
> > > ... this will no longer be true, and the nuclear landmine in this
> > > driver interface will have been armed
> > 
> > I agree with the need to be careful when / if explicit cache control
> > is added, but that's not the case today.
> 
> "if"?
> 
> I expect it to be "when", not if. Expect the worst, plan for it now.
> 
> Cheers,
> 
> Dave.
> --
> Dave Chinner
> da...@fromorbit.com
> 



Re: [Qemu-devel] [PULLv3 00/65] slirp updates

2019-01-14 Thread no-reply
Patchew URL: 
https://patchew.org/QEMU/20190114225306.21569-1-samuel.thiba...@ens-lyon.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20190114225306.21569-1-samuel.thiba...@ens-lyon.org
Subject: [Qemu-devel] [PULLv3 00/65] slirp updates
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
017fc2f slirp: check data length while emulating ident function
e87d727 slirp: Mark debugging calls as unlikely
aa49d8f slirp: call into g_debug() for DEBUG macros
01dbc97 slirp: set G_LOG_DOMAIN
8a5a5ed build-sys: use a separate slirp-obj-y && slirp.mo
13d5ea9 slirp: add clock_get_ns() callback
753120f slirp: factor out guestfwd addition checks
2634d85 slirp: replace DEBUG_ARGS with DEBUG_ARG
4ba0640 slirp: remove remaining DEBUG blocks
6df5752 slirp: use %p for pointers format
25e8eec slirp: introduce SLIRP_DEBUG environment variable
e6ba465 slirp: always build with debug statements
17daeeb slirp: no need to make DPRINTF conditional on DEBUG
212865f slirp: replace a DEBUG block with WITH_ICMP_ERROR_MSG
99583b0 slirp: replace some fprintf() with DEBUG_MISC
9dc44cc slirp: replace a fprintf with g_critical()
284b5e8 slirp: use virtual time for packet expiration
17a297b slirp: rename exec_list
495e28c slirp: drop ex_chardev = do_pty == 3;$

ERROR: code indent should never use tabs
#35: FILE: slirp/misc.h:12:
+^Iint ex_chardev;$

total: 2 errors, 0 warnings, 40 lines checked

Patch 3/65 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

4/65 Checking commit 6ba5031c5183 (slirp: use a dedicated field for chardev 
pointer)
ERROR: code indent should never use tabs
#77: FILE: slirp/misc.c:53:
+^I*ex_ptr = g_new0(struct ex_list, 1);$

ERROR: code indent should never use tabs
#82: FILE: slirp/misc.c:56:
+^Iif (chardev) {$

ERROR: code indent should never use tabs
#83: FILE: slirp/misc.c:57:
+^I^I(*ex_ptr)->ex_chardev = chardev;$

ERROR: code indent should never use tabs
#84: FILE: slirp/misc.c:58:
+^I} else {$

ERROR: code indent should never use tabs
#85: FILE: slirp/misc.c:59:
+^I^I(*ex_ptr)->ex_exec = g_strdup(cmdline);$

ERROR: code indent should never use tabs
#86: FILE: slirp/misc.c:60:
+^I}$

ERROR: code indent should never use tabs
#99: FILE: slirp/misc.h:12:
+^Ivoid *ex_chardev;$

total: 7 errors, 0 warnings, 100 lines checked

Patch 4/65 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

5/65 Checking commit e20771fed78b (slirp: remove unused EMU_RSH)
6/65 Checking commit e1ddac489c29 (slirp: rename /extra/chardev)
ERROR: "foo * bar" should be "foo *bar"
#39: FILE: slirp/socket.h:70:
+  void * chardev;

total: 1 errors, 0 warnings, 28 lines checked

Patch 6/65 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

7/65 Checking commit 2da06b131f4d (slirp: move internal function declarations)
8/65 Checking commit 89c3eaf69442 (slirp: remove Monitor dependency, return a 
string for info)
9/65 Checking commit c5d60a6957a3 (slirp: fix slirp_add_exec() leaks)
ERROR: code indent should never use tabs
#22: FILE: slirp/misc.h:15:
+^Ichar *ex_exec;  /* Command line of what to exec */$

total: 1 errors, 0 warnings, 22 lines checked

Patch 9/65 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

10/65 Checking commit ac8b25d5141e (slirp: replace the poor-man string split 
with g_strsplit())
ERROR: code indent should never use tabs
#26: FILE: slirp/misc.c:91:
+^Ichar **argv;$

ERROR: code indent should never use tabs
#27: FILE: slirp/misc.c:92:
+^Iint ret;$

total: 2 errors, 0 warnings, 33 lines checked

Patch 10/65 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

11/65 Checking commit cf883deeb016 (slirp: remove dead declarations)
12/65 Checking commit e577000b30a7 (slirp: add tftp tracing)
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#57: 
new file mode 100644

total: 0 errors, 1 warnings, 33 lines checked

Patch 12/65 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
13/65 Checking commit 251a687b9b7a (slirp: move socket pair creation in helper 
function)
ERROR: code indent should never use tabs
#102: FILE: slirp/misc.c:136:
+^Iint opt, c, sp[2];$

ERROR: code indent should never use tabs
#154: FILE: slirp/misc.c:151:

Re: [Qemu-devel] [PATCH v3 0/2] intel-iommu: add support for 5-level virtual IOMMU.

2019-01-14 Thread Michael S. Tsirkin
On Wed, Dec 12, 2018 at 09:05:37PM +0800, Yu Zhang wrote:
> Intel's upcoming processors will extend maximum linear address width to
> 57 bits, and introduce 5-level paging for CPU. Meanwhile, the platform
> will also extend the maximum guest address width for IOMMU to 57 bits,
> thus introducing the 5-level paging for 2nd level translation(See chapter
> 3 in Intel Virtualization Technology for Directed I/O). 
> 
> This patch series extends the current logic to support a wider address width.
> A 5-level paging capable IOMMU(for 2nd level translation) can be rendered
> with configuration "device intel-iommu,x-aw-bits=57".
> 
> Also, kvm-unit-tests were updated to verify this patch series. Patch for
> the test was sent out at: https://www.spinics.net/lists/kvm/msg177425.html.
> 
> Note: this patch series checks the existance of 5-level paging in the host
> and in the guest, and rejects configurations for 57-bit IOVA if either check
> fails(VTD-d hardware shall not support 57-bit IOVA on platforms without CPU
> 5-level paging). However, current vIOMMU implementation still lacks logic to
> check against the physical IOMMU capability, future enhancements are expected
> to do this.
> 
> Changes in V3: 
> - Address comments from Peter Xu: squash the 3rd patch in v2 into the 2nd
>   patch in this version.
> - Added "Reviewed-by: Peter Xu "
> 
> Changes in V2: 
> - Address comments from Peter Xu: add haw member in vtd_page_walk_info.
> - Address comments from Peter Xu: only searches for 4K/2M/1G mappings in
> iotlb are meaningful. 
> - Address comments from Peter Xu: cover letter changes(e.g. mention the test
> patch in kvm-unit-tests).
> - Coding style changes.
> ---
> Cc: "Michael S. Tsirkin"  
> Cc: Igor Mammedov  
> Cc: Marcel Apfelbaum 
> Cc: Paolo Bonzini  
> Cc: Richard Henderson  
> Cc: Eduardo Habkost 
> Cc: Peter Xu 


OK is this going anywhere?
How about dropping cpu flags probing for now, you can
always revisit it later.
Will make it maybe a bit less user friendly but OTOH
uncontriversial...

> ---
> 
> Yu Zhang (2):
>   intel-iommu: differentiate host address width from IOVA address width.
>   intel-iommu: extend VTD emulation to allow 57-bit IOVA address width.
> 
>  hw/i386/acpi-build.c   |  2 +-
>  hw/i386/intel_iommu.c  | 96 
> +-
>  hw/i386/intel_iommu_internal.h | 10 -
>  include/hw/i386/intel_iommu.h  | 10 +++--
>  4 files changed, 81 insertions(+), 37 deletions(-)
> 
> -- 
> 1.9.1



Re: [Qemu-devel] [PATCH] vhost-user: fix qemu crash caused by failed backend

2019-01-14 Thread Michael S. Tsirkin
On Tue, Oct 02, 2018 at 01:54:25PM +0400, Marc-André Lureau wrote:
> Hi
> 
> On Thu, Sep 27, 2018 at 7:37 PM Liang Li  wrote:
> >
> > During live migration, when stopping vhost-user device, 'vhost_dev_stop'
> > will be called, 'vhost_dev_stop' will call a batch of 'vhost_user_read'
> > and 'vhost_user_write'. If a previous 'vhost_user_read' or 
> > 'vhost_user_write'
> > failed because the vhost user backend failed, the 'CHR_EVENT_CLOSED' event
> > will be triggerd, followed by the call chain 
> > chr_closed_bh()->vhost_user_stop()->
> > vhost_net_cleanup()->vhost_dev_cleanup()
> >
> > vhost_dev_cleanup will clear vhost_dev struct, so the later 
> > 'vhost_user_read'
> > or 'vhost_user_read' will reference null pointer and cause qemu crash
> 
> Do you have a backtrace to help understand the issue?
> thanks

Marc-André, Maxime any input on this patch?
I agree flags like break_down don't exactly look elegant ...


> >
> > Signed-off-by: Liang Li 
> > ---
> >  hw/net/vhost_net.c|  6 ++
> >  hw/virtio/vhost-user.c| 15 +--
> >  include/hw/virtio/vhost.h |  1 +
> >  include/net/vhost_net.h   |  1 +
> >  net/vhost-user.c  |  3 +++
> >  5 files changed, 24 insertions(+), 2 deletions(-)
> >
> > diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
> > index e037db6..77994e9 100644
> > --- a/hw/net/vhost_net.c
> > +++ b/hw/net/vhost_net.c
> > @@ -113,6 +113,11 @@ uint64_t vhost_net_get_features(struct vhost_net *net, 
> > uint64_t features)
> >  features);
> >  }
> >
> > +void vhost_net_mark_break_down(struct vhost_net *net)
> > +{
> > +net->dev.break_down = true;
> > +}
> > +
> >  void vhost_net_ack_features(struct vhost_net *net, uint64_t features)
> >  {
> >  net->dev.acked_features = net->dev.backend_features;
> > @@ -156,6 +161,7 @@ struct vhost_net *vhost_net_init(VhostNetOptions 
> > *options)
> >  net->dev.max_queues = 1;
> >  net->dev.nvqs = 2;
> >  net->dev.vqs = net->vqs;
> > +net->dev.break_down = false;
> >
> >  if (backend_kernel) {
> >  r = vhost_net_get_fd(options->net_backend);
> > diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
> > index b041343..1394719 100644
> > --- a/hw/virtio/vhost-user.c
> > +++ b/hw/virtio/vhost-user.c
> > @@ -213,14 +213,20 @@ static bool ioeventfd_enabled(void)
> >  static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
> >  {
> >  struct vhost_user *u = dev->opaque;
> > -CharBackend *chr = u->user->chr;
> > +CharBackend *chr;
> >  uint8_t *p = (uint8_t *) msg;
> >  int r, size = VHOST_USER_HDR_SIZE;
> >
> > +if (dev->break_down) {
> > +goto fail;
> > +}
> > +
> > +chr = u->user->chr;
> >  r = qemu_chr_fe_read_all(chr, p, size);
> >  if (r != size) {
> >  error_report("Failed to read msg header. Read %d instead of %d."
> >   " Original request %d.", r, size, msg->hdr.request);
> > +dev->break_down = true;
> >  goto fail;
> >  }
> >
> > @@ -299,9 +305,12 @@ static int vhost_user_write(struct vhost_dev *dev, 
> > VhostUserMsg *msg,
> >  int *fds, int fd_num)
> >  {
> >  struct vhost_user *u = dev->opaque;
> > -CharBackend *chr = u->user->chr;
> > +CharBackend *chr;
> >  int ret, size = VHOST_USER_HDR_SIZE + msg->hdr.size;
> >
> > +if (dev->break_down) {
> > +return -1;
> > +}
> >  /*
> >   * For non-vring specific requests, like VHOST_USER_SET_MEM_TABLE,
> >   * we just need send it once in the first time. For later such
> > @@ -312,6 +321,7 @@ static int vhost_user_write(struct vhost_dev *dev, 
> > VhostUserMsg *msg,
> >  return 0;
> >  }
> >
> > +chr = u->user->chr;
> >  if (qemu_chr_fe_set_msgfds(chr, fds, fd_num) < 0) {
> >  error_report("Failed to set msg fds.");
> >  return -1;
> > @@ -319,6 +329,7 @@ static int vhost_user_write(struct vhost_dev *dev, 
> > VhostUserMsg *msg,
> >
> >  ret = qemu_chr_fe_write_all(chr, (const uint8_t *) msg, size);
> >  if (ret != size) {
> > +dev->break_down = true;
> >  error_report("Failed to write msg."
> >   " Wrote %d instead of %d.", ret, size);
> >  return -1;
> > diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
> > index a7f449f..86d0dc5 100644
> > --- a/include/hw/virtio/vhost.h
> > +++ b/include/hw/virtio/vhost.h
> > @@ -74,6 +74,7 @@ struct vhost_dev {
> >  bool started;
> >  bool log_enabled;
> >  uint64_t log_size;
> > +bool break_down;
> >  Error *migration_blocker;
> >  const VhostOps *vhost_ops;
> >  void *opaque;
> > diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
> > index 77e4739..06f2c08 100644
> > --- a/include/net/vhost_net.h
> > +++ b/include/net/vhost_net.h
> > @@ -27,6 +27,7 @@ void vhost_net_cleanup(VHostNetState *net);
> >
> >  uint64_t vhost_net_get_features(VHostNetState *net, uint64_t 

Re: [Qemu-devel] [PATCH v1 2/5] vl.c: add -smp, dies=* command line support

2019-01-14 Thread Xu, Like
> -Original Message-
> From: Eduardo Habkost [mailto:ehabk...@redhat.com]
> Sent: Tuesday, January 15, 2019 4:52 AM
> To: Like Xu 
> Cc: qemu-devel@nongnu.org; Xu, Like ;
> imamm...@redhat.com; drjo...@redhat.com; Michael S. Tsirkin
> ; Marcelo Tosatti ; Marcel
> Apfelbaum ; Paolo Bonzini
> ; Peter Crosthwaite
> ; Richard Henderson 
> Subject: Re: [Qemu-devel] [PATCH v1 2/5] vl.c: add -smp,dies=* command
> line support
> 
> On Mon, Jan 14, 2019 at 08:24:56PM +0800, Like Xu wrote:
> > This patch updates the check rules on legeacy -smp parse from user
> > command and it's designed to obey the same restrictions as
> socket/core/thread model.
> >
> > Signed-off-by: Like Xu 
> 
> This would require the documentation for -smp to be updated.
> qemu-options.hx still says that "cores=" is the number of cores per socket.
[Xu, Like] I'll add more docs in next version and thanks.
> 
> Also, I'm not completely sure we should change the meaning of "cores="
> and smp_cores to be per-die instead of per-socket.  Most machines won't
> have any code for tracking dies, so we probably shouldn't make the extra
> complexity affect all machines.[1]
[Xu, Like] I'd prefer to apply die level in a general way without extra affect.
> 
> What would be the disadvantages of a simple -machine "dies-per-socket"
> option, specific for PC?
[Xu, Like] It may not be a good choice to cut up cpu topo parser logic and
die level is so generic that any machine provided by qemu as far as I know
could benefit from potential socket/die/core/thread model.
> 
> Keeping core-id and smp_cores per-socket instead of per-die also seems
> necessary to keep backwards compatibility on the interface for identifying
> CPU hotplug slots.  Igor, what do you think?
[Xu, Like] The compatibility issue on hotplug from MCP challenge is still being 
evaluated and Igor, what do you think :D ? 
> 
> 
> [1] I would even argue that the rest of the -smp options belong
> to the machine object, and topology rules should be
> machine-specific, but cleaning this up will require
> additional work.
[Xu, Like] I agree and Intel may have another
two cpu topo levels named module and tile from SDM spec for packaging
and that should be machine-specific as proposal if any. However
the die level I believe is much more generic just like core or thread.
> 
> > ---
> >  hmp.c |  3 +++
> >  hw/core/machine.c | 12 
> >  vl.c  | 33 -
> >  3 files changed, 35 insertions(+), 13 deletions(-)
> >
> > diff --git a/hmp.c b/hmp.c
> > index 80aa5ab..05ac133 100644
> > --- a/hmp.c
> > +++ b/hmp.c
> > @@ -3013,6 +3013,9 @@ void hmp_hotpluggable_cpus(Monitor *mon,
> const QDict *qdict)
> >  if (c->has_socket_id) {
> >  monitor_printf(mon, "socket-id: \"%" PRIu64 "\"\n", c-
> >socket_id);
> >  }
> > +if (c->has_die_id) {
> > +monitor_printf(mon, "die-id: \"%" PRIu64 "\"\n", 
> > c->die_id);
> > +}
> >  if (c->has_core_id) {
> >  monitor_printf(mon, "core-id: \"%" PRIu64 "\"\n", 
> > c->core_id);
> >  }
> > diff --git a/hw/core/machine.c b/hw/core/machine.c index
> > 95dc7c3..05bc545 100644
> > --- a/hw/core/machine.c
> > +++ b/hw/core/machine.c
> > @@ -601,6 +601,11 @@ void
> machine_set_cpu_numa_node(MachineState *machine,
> >  return;
> >  }
> >
> > +if (props->has_die_id && !slot->props.has_die_id) {
> > +error_setg(errp, "die-id is not supported");
> > +return;
> > +}
> > +
> >  if (props->has_socket_id && !slot->props.has_socket_id) {
> >  error_setg(errp, "socket-id is not supported");
> >  return;
> > @@ -615,6 +620,10 @@ void
> machine_set_cpu_numa_node(MachineState *machine,
> >  continue;
> >  }
> >
> > +if (props->has_die_id && props->die_id != slot->props.die_id) {
> > +continue;
> > +}
> > +
> >  if (props->has_socket_id && props->socket_id != slot-
> >props.socket_id) {
> >  continue;
> >  }
> > @@ -849,6 +858,9 @@ static char *cpu_slot_to_string(const CPUArchId
> *cpu)
> >  if (cpu->props.has_socket_id) {
> >  g_string_append_printf(s, "socket-id: %"PRId64, cpu-
> >props.socket_id);
> >  }
> > +if (cpu->props.has_die_id) {
> > +g_string_append_printf(s, "die-id: %"PRId64, cpu->props.die_id);
> > +}
> >  if (cpu->props.has_core_id) {
> >  if (s->len) {
> >  g_string_append_printf(s, ", "); diff --git a/vl.c b/vl.c
> > index 9b8ea3f..72be689 100644
> > --- a/vl.c
> > +++ b/vl.c
> > @@ -169,6 +169,7 @@ int win2k_install_hack = 0;  int singlestep = 0;
> > int smp_cpus;  unsigned int max_cpus;
> > +int smp_dies = 1;
> >  int smp_cores = 1;
> >  int smp_threads = 1;
> >  int acpi_enabled = 1;
> > @@ -1208,6 +1209,9 @@ static QemuOptsList qemu_smp_opts = {
> >  .name = 

Re: [Qemu-devel] [PATCH 03/10] vhost-net: compile it for all targets

2019-01-14 Thread Michael S. Tsirkin
On Thu, Nov 15, 2018 at 07:42:20PM +0100, Paolo Bonzini wrote:
> On 15/11/2018 15:31, Paolo Bonzini wrote:
> > Currently vhost-net is compiled only for KVM-enabled targets.  This is
> > not needed anymore because ioeventfd is supported and emulated by the
> > memory core.  Compile it and vhost-user-test for all targets.
> > While at it, fix the annoying typo CONFIG_VHOST_NET_USED.
> > 
> > Signed-off-by: Paolo Bonzini 
> > ---
> >  configure  | 13 +
> >  include/exec/poison.h  |  1 -
> >  net/net.c  |  2 +-
> >  tests/Makefile.include |  5 +
> >  4 files changed, 7 insertions(+), 14 deletions(-)
> > 
> > diff --git a/configure b/configure
> > index 5b1d83ea26..d8317e1832 100755
> > --- a/configure
> > +++ b/configure
> > @@ -6512,8 +6512,11 @@ fi
> >  if test "$vhost_scsi" = "yes" ; then
> >echo "CONFIG_VHOST_SCSI=y" >> $config_host_mak
> >  fi
> > -if test "$vhost_net" = "yes" -a "$vhost_user" = "yes"; then
> > -  echo "CONFIG_VHOST_NET_USED=y" >> $config_host_mak
> > +if test "$vhost_net" = "yes" ; then
> > +  echo "CONFIG_VHOST_NET=y" >> $config_host_mak
> > +  if test "$vhost_user" = "yes"; then
> > +echo "CONFIG_VHOST_NET_USER=y" >> $config_host_mak
> > +  fi
> >  fi
> >  if test "$vhost_crypto" = "yes" ; then
> >echo "CONFIG_VHOST_CRYPTO=y" >> $config_host_mak
> > @@ -7275,12 +7278,6 @@ if supported_xen_target $target; then
> >  fi
> >  if supported_kvm_target $target; then
> >  echo "CONFIG_KVM=y" >> $config_target_mak
> > -if test "$vhost_net" = "yes" ; then
> > -echo "CONFIG_VHOST_NET=y" >> $config_target_mak
> > -if test "$vhost_user" = "yes" ; then
> > -echo "CONFIG_VHOST_USER_NET_TEST_$target_name=y" >> 
> > $config_host_mak
> > -fi
> > -fi
> >  fi
> >  if supported_hax_target $target; then
> >  echo "CONFIG_HAX=y" >> $config_target_mak
> > diff --git a/include/exec/poison.h b/include/exec/poison.h
> > index 32d53789f8..b158632791 100644
> > --- a/include/exec/poison.h
> > +++ b/include/exec/poison.h
> > @@ -85,7 +85,6 @@
> >  #pragma GCC poison CONFIG_XTENSA_DIS
> >  
> >  #pragma GCC poison CONFIG_LINUX_USER
> > -#pragma GCC poison CONFIG_VHOST_NET
> >  #pragma GCC poison CONFIG_KVM
> >  #pragma GCC poison CONFIG_SOFTMMU
> >  
> > diff --git a/net/net.c b/net/net.c
> > index 07c194a8f6..95a74add6c 100644
> > --- a/net/net.c
> > +++ b/net/net.c
> > @@ -955,7 +955,7 @@ static int (* const 
> > net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
> >  [NET_CLIENT_DRIVER_BRIDGE]= net_init_bridge,
> >  #endif
> >  [NET_CLIENT_DRIVER_HUBPORT]   = net_init_hubport,
> > -#ifdef CONFIG_VHOST_NET_USED
> > +#ifdef CONFIG_VHOST_NET_USER
> >  [NET_CLIENT_DRIVER_VHOST_USER] = net_init_vhost_user,
> >  #endif
> >  #ifdef CONFIG_L2TPV3
> > diff --git a/tests/Makefile.include b/tests/Makefile.include
> > index fb0b449c02..03a64ce9c8 100644
> > --- a/tests/Makefile.include
> > +++ b/tests/Makefile.include
> > @@ -204,10 +204,7 @@ check-qtest-i386-$(CONFIG_USB_XHCI_NEC) += 
> > tests/usb-hcd-xhci-test$(EXESUF)
> >  check-qtest-i386-y += tests/cpu-plug-test$(EXESUF)
> >  check-qtest-i386-y += tests/q35-test$(EXESUF)
> >  check-qtest-i386-y += tests/vmgenid-test$(EXESUF)
> > -check-qtest-i386-$(CONFIG_VHOST_USER_NET_TEST_i386) += 
> > tests/vhost-user-test$(EXESUF)
> > -ifeq ($(CONFIG_VHOST_USER_NET_TEST_i386),)
> > -check-qtest-x86_64-$(CONFIG_VHOST_USER_NET_TEST_x86_64) += 
> > tests/vhost-user-test$(EXESUF)
> > -endif
> > +check-qtest-i386-$(CONFIG_VHOST_NET_USER) += tests/vhost-user-test$(EXESUF)
> >  check-qtest-i386-$(CONFIG_TPM_CRB) += tests/tpm-crb-swtpm-test$(EXESUF)
> >  check-qtest-i386-$(CONFIG_TPM_CRB) += tests/tpm-crb-test$(EXESUF)
> >  check-qtest-i386-$(CONFIG_TPM_TIS) += tests/tpm-tis-swtpm-test$(EXESUF)
> > 
> 
> FWIW this is unfortunately not that simple.  Patchew will surely notice.
> :)  I will post v2 when I get reviews for everything else.
> 
> Paolo


So with the header split this can now go in I guess?
Want to repost?

-- 
MST



Re: [Qemu-devel] [PATCH V8 3/5] util/mmap-alloc: support MAP_SYNC in qemu_ram_mmap()

2019-01-14 Thread Michael S. Tsirkin
On Tue, Jan 15, 2019 at 10:49:45AM +0800, Yi Zhang wrote:
> On 2019-01-14 at 17:07:02 -0200, Eduardo Habkost wrote:
> > On Wed, Jan 02, 2019 at 01:26:15PM +0800, Zhang Yi wrote:
> > > When a file supporting DAX is used as vNVDIMM backend, mmap it with
> > > MAP_SYNC flag in addition which can ensure file system metadata
> > > synced in each guest writes to the backend file, without other QEMU
> > > actions (e.g., periodic fsync() by QEMU).
> > > 
> > > Signed-off-by: Haozhong Zhang 
> > > Signed-off-by: Zhang Yi 
> > > ---
> > >  include/qemu/osdep.h | 16 
> > >  util/mmap-alloc.c| 12 +++-
> > >  2 files changed, 27 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
> > > index 3bf48bc..bb1eba1 100644
> > > --- a/include/qemu/osdep.h
> > > +++ b/include/qemu/osdep.h
> > > @@ -410,6 +410,22 @@ void qemu_anon_ram_free(void *ptr, size_t size);
> > >  #  define QEMU_VMALLOC_ALIGN getpagesize()
> > >  #endif
> > >  
> > > +/*
> > > + * MAP_SHARED_VALIDATE and MAP_SYNC are introduced in Linux kernel
> > > + * 4.15, so they may not be defined when compiling on older kernels.
> > > + */
> > > +#ifdef CONFIG_LINUX
> > > +
> > > +#include 
> > > +
> > > +#ifndef MAP_SYNC
> > > +#define MAP_SYNC 0x0
> > > +#endif
> > > +
> > > +#else  /* !CONFIG_LINUX */
> > > +#define MAP_SYNC  0x0
> > > +#endif /* CONFIG_LINUX */
> > > +
> > >  #ifdef CONFIG_POSIX
> > >  struct qemu_signalfd_siginfo {
> > >  uint32_t ssi_signo;   /* Signal number */
> > > diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
> > > index 8f0a740..a9d5e56 100644
> > > --- a/util/mmap-alloc.c
> > > +++ b/util/mmap-alloc.c
> > > @@ -99,6 +99,8 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align, 
> > > uint32_t flags)
> > >  void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, 
> > > -1, 0);
> > >  #endif
> > >  bool shared = flags & RAM_SHARED;
> > > +bool is_pmem = flags & RAM_PMEM;
> > > +int mmap_xflags = 0;
> > >  size_t offset;
> > >  void *ptr1;
> > >  
> > > @@ -109,13 +111,21 @@ void *qemu_ram_mmap(int fd, size_t size, size_t 
> > > align, uint32_t flags)
> > >  assert(is_power_of_2(align));
> > >  /* Always align to host page size */
> > >  assert(align >= getpagesize());
> > > +if (shared && is_pmem) {
> > > +mmap_xflags |= MAP_SYNC;
> > > +}
> > >  
> > >  offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
> > > + retry_mmap_fd:
> > >  ptr1 = mmap(ptr + offset, size, PROT_READ | PROT_WRITE,
> > >  MAP_FIXED |
> > >  (fd == -1 ? MAP_ANONYMOUS : 0) |
> > > -(shared ? MAP_SHARED : MAP_PRIVATE),
> > > +(shared ? MAP_SHARED : MAP_PRIVATE) | mmap_xflags,
> > >  fd, 0);
> > > +if ((ptr1 == MAP_FAILED) && (mmap_xflags & MAP_SYNC)) {
> > > +mmap_xflags &= ~MAP_SYNC;
> > > +goto retry_mmap_fd;
> > 
> > Do we have use cases where using pmem=on without MAP_SYNC isn't
> > going to cause problems?  If not, shouldn't we at least print a
> Yes, we have a case that direct use dax device but not a files on
> dax aware file system, we prefer to don't set the MAP_SYNC if user
> haven't much knowledge about that. it may took some potencial 
> performance issues with MAP_SYNC.

I think you will have to be quite a bit more specific.

If there's a performance / functionality tradeoff here
then hiding it behind an option with an inscrutable name
isn't a good idea. Neither is ignoring failures silently.



> > warning here?  Otherwise, won't we still need an option for cases
> > that require MAP_SYNC to be working?
> > 
> > > +}
> > 
> > -- 
> > Eduardo



Re: [Qemu-devel] [PATCH V8 5/5] hostmem-file: add 'sync' option

2019-01-14 Thread Michael S. Tsirkin
On Wed, Jan 02, 2019 at 01:26:34PM +0800, Zhang Yi wrote:
> This option controls will mmap the memory backend file with MAP_SYNC flag,
> which can ensure filesystem metadata consistent even after a system crash
> or power failure, if MAP_SYNC flag is supported by the host kernel(Linux
> kernel 4.15 and later) and the backend is a file supporting DAX (e.g.,
> file on ext4/xfs file system mounted with '-o dax').
> 
> It can take one of following values:
>  - on:  try to pass MAP_SYNC to mmap(2); if MAP_SYNC is not supported or
> 'share=off' or 'pmem!=on', QEMU will not pass this flags to
>   mmap(2)
>  - off: default, never pass MAP_SYNC to mmap(2)
> 
> Signed-off-by: Haozhong Zhang 
> Signed-off-by: Zhang Yi 


So we introduce all of the above complexity and then I am pretty sure go
on and teach management tools to just always, without exception, set
sync=on to avoid data corruption.

So how about we give up on a bit of flexibility, and just say
pmem=on forces MAP_SYNC?

OTOH if you really really want a fast memory then why set pmem=on at
all?

Or, if you have some data that shows how disabling synchronous
pagefaults helps performance a lot, maybe we should introduce
a "crash-unsafe" flag.



> ---
>  backends/hostmem-file.c   | 28 
>  docs/nvdimm.txt   | 23 ++-
>  exec.c|  2 +-
>  include/exec/memory.h |  4 
>  include/exec/ram_addr.h   |  1 +
>  include/qemu/mmap-alloc.h |  1 +
>  qemu-options.hx   | 19 ++-
>  util/mmap-alloc.c |  4 ++--
>  8 files changed, 77 insertions(+), 5 deletions(-)
> 
> diff --git a/backends/hostmem-file.c b/backends/hostmem-file.c
> index 0dd7a90..3d39032 100644
> --- a/backends/hostmem-file.c
> +++ b/backends/hostmem-file.c
> @@ -36,6 +36,7 @@ struct HostMemoryBackendFile {
>  uint64_t align;
>  bool discard_data;
>  bool is_pmem;
> +bool sync;
>  };
>  
>  static void
> @@ -62,6 +63,7 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error 
> **errp)
>   path,
>   backend->size, fb->align,
>   (backend->share ? RAM_SHARED : 0) |
> + (fb->sync ? RAM_SYNC : 0) |
>   (fb->is_pmem ? RAM_PMEM : 0),
>   fb->mem_path, errp);
>  g_free(path);
> @@ -136,6 +138,29 @@ static void file_memory_backend_set_align(Object *o, 
> Visitor *v,
>  error_propagate(errp, local_err);
>  }
>  
> +static bool file_memory_backend_get_sync(Object *o, Error **errp)
> +{
> +return MEMORY_BACKEND_FILE(o)->sync;
> +}
> +
> +static void file_memory_backend_set_sync(
> +Object *obj, bool value, Error **errp)
> +{
> +HostMemoryBackend *backend = MEMORY_BACKEND(obj);
> +HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(obj);
> +
> +if (host_memory_backend_mr_inited(backend)) {
> +error_setg(errp, "cannot change property sync of %s",
> +   object_get_typename(obj));
> +goto out;
> +}
> +
> +fb->sync = value;
> +
> + out:
> +return;
> +}
> +
>  static bool file_memory_backend_get_pmem(Object *o, Error **errp)
>  {
>  return MEMORY_BACKEND_FILE(o)->is_pmem;
> @@ -203,6 +228,9 @@ file_backend_class_init(ObjectClass *oc, void *data)
>  object_class_property_add_bool(oc, "pmem",
>  file_memory_backend_get_pmem, file_memory_backend_set_pmem,
>  _abort);
> +object_class_property_add_bool(oc, "sync",
> +file_memory_backend_get_sync, file_memory_backend_set_sync,
> +_abort);
>  }
>  
>  static void file_backend_instance_finalize(Object *o)
> diff --git a/docs/nvdimm.txt b/docs/nvdimm.txt
> index 5f158a6..30db458 100644
> --- a/docs/nvdimm.txt
> +++ b/docs/nvdimm.txt
> @@ -142,11 +142,32 @@ backend of vNVDIMM:
>  Guest Data Persistence
>  --
>  
> +vNVDIMM is designed and implemented to guarantee the guest data
> +persistence on the backends even on the host crash and power
> +failures. However, there are still some requirements and limitations
> +as explained below.
> +
>  Though QEMU supports multiple types of vNVDIMM backends on Linux,
> -currently the only one that can guarantee the guest write persistence
> +if MAP_SYNC is not supported by the host kernel and the backends,
> +the only backend that can guarantee the guest write persistence
>  is the device DAX on the real NVDIMM device (e.g., /dev/dax0.0), to
>  which all guest access do not involve any host-side kernel cache.
>  
> +mmap(2) flag MAP_SYNC is added since Linux kernel 4.15. On such
> +systems, QEMU can mmap(2) the backend with MAP_SYNC, which can ensure
> +filesystem metadata consistent even after a system crash or power
> +failure. Besides the host kernel support, enabling MAP_SYNC in QEMU
> +also requires:
> +
> + - the backend is a file supporting DAX, e.g., a file on an ext4 or

[Qemu-devel] [Bug 1785698] Re: Solaris build error: unknown type name ‘gcry_error_t’

2019-01-14 Thread WHR
libutil should not be linked on Solaris, see
https://bugs.launchpad.net/qemu/+bug/1777252

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1785698

Title:
  Solaris build error: unknown type name ‘gcry_error_t’

Status in QEMU:
  New

Bug description:
  Building qemu 2.12.0 on a Sun Oracle Enterprise M3000 SPARC64 VII,
  Solaris 10 Update 11, opencsw toolchain and gcc 7.3.0, gmake fails
  with a bunch of related errors all in cypher-gcrypt.c:

  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:262:32: error: 
‘gcry_cipher_hd_t’ undeclared (first use in this function); did you mean 
‘gcry_cipher_info’?
   err = gcry_cipher_encrypt((gcry_cipher_hd_t)ctx, dst, length, src, 
length);^~~~
  gcry_cipher_info
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:262:49: error: 
expected ‘)’ before ‘ctx’
   err = gcry_cipher_encrypt((gcry_cipher_hd_t)ctx, dst, length, src, 
length); ^~~
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:262:11: error: too few 
arguments to function ‘gcry_cipher_encrypt’
   err = gcry_cipher_encrypt((gcry_cipher_hd_t)ctx, dst, length, src, 
length);   ^~~
  In file included from 
/export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:25:0,
   from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:
  /usr/include/gcrypt.h:566:5: note: declared here
   int gcry_cipher_encrypt (GcryCipherHd h,
   ^~~
  In file included from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:0:
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c: In function 
‘qcrypto_gcrypt_xts_decrypt’:
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:271:5: error: unknown 
type name ‘gcry_error_t’; did you mean ‘g_error’?
   gcry_error_t err;
   ^~~~
   g_error
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:272:32: error: 
‘gcry_cipher_hd_t’ undeclared (first use in this function); did you mean 
‘gcry_cipher_info’?
   err = gcry_cipher_decrypt((gcry_cipher_hd_t)ctx, dst, length, src, 
length);^~~~
  gcry_cipher_info
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:272:49: error: 
expected ‘)’ before ‘ctx’
   err = gcry_cipher_decrypt((gcry_cipher_hd_t)ctx, dst, length, src, 
length); ^~~
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:272:11: error: too few 
arguments to function ‘gcry_cipher_decrypt’
   err = gcry_cipher_decrypt((gcry_cipher_hd_t)ctx, dst, length, src, 
length);   ^~~
  In file included from 
/export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:25:0,
   from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:
  /usr/include/gcrypt.h:571:5: note: declared here
   int gcry_cipher_decrypt (GcryCipherHd h,
   ^~~
  In file included from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:0:
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c: In function 
‘qcrypto_gcrypt_cipher_encrypt’:
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:284:5: error: unknown 
type name ‘gcry_error_t’; did you mean ‘g_error’?
   gcry_error_t err;
   ^~~~
   g_error
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:293:21: warning: 
passing argument 1 of ‘xts_encrypt’ makes pointer from integer without a cast 
[-Wint-conversion]
   xts_encrypt(ctx->handle, ctx->tweakhandle,
   ^~~
  In file included from 
/export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:22:0,
   from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:
  /export/home/denber/qemu-2.12.0/include/crypto/xts.h:73:6: note: expected 
‘const void *’ but argument is of type ‘int’
   void xts_encrypt(const void *datactx,
    ^~~
  In file included from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:0:
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:293:34: warning: 
passing argument 2 of ‘xts_encrypt’ makes pointer from integer without a cast 
[-Wint-conversion]
   xts_encrypt(ctx->handle, ctx->tweakhandle,
    ^~~
  In file included from 
/export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:22:0,
   from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:
  /export/home/denber/qemu-2.12.0/include/crypto/xts.h:73:6: note: expected 
‘const void *’ but argument is of type ‘int’
   void xts_encrypt(const void *datactx,
    ^~~
  In file included from /export/home/denber/qemu-2.12.0/crypto/cipher.c:153:0:
  /export/home/denber/qemu-2.12.0/crypto/cipher-gcrypt.c:298:35: warning: 
passing argument 1 of ‘gcry_cipher_encrypt’ 

Re: [Qemu-devel] Questions about VFIO enabling MSIX vector

2019-01-14 Thread Heyi Guo

Hi Alex,

Really appreciate your comments. I have some more questions below.


On 2019/1/15 0:07, Alex Williamson wrote:

On Sat, 12 Jan 2019 10:30:40 +0800
Heyi Guo  wrote:


Hi folks,

I have some questions about vfio_msix_vector_do_use() in
hw/vfio/pci.c, could you help to explain?

We can see that when guest tries to enable one specific MSIX vector
by unmasking MSIX Vector Control, the access will be trapped and then
into function vfio_msix_vector_do_use(). And we may go to the below
branch in line 525:


520 /*
521  * We don't want to have the host allocate all possible MSI vectors
522  * for a device if they're not in use, so we shutdown and incrementally
523  * increase them as needed.
524  */
525  if (vdev->nr_vectors < nr + 1) {
526  vfio_disable_irqindex(>vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
527  vdev->nr_vectors = nr + 1;
528  ret = vfio_enable_vectors(vdev, true);
529  if (ret) {
530  error_report("vfio: failed to enable vectors, %d", ret);
531  }

Here all MSIX vectors will be disabled first and then enabled, with
one more MSIX. The comment is there but I still don't quite
understand. It makes sense for not allocating all possible MSI
vectors, but why shall we shutdown the whole MSI when being requested
to enable one specific vector? Can't we just enable the user
specified vector indexed by "nr"?

What internal kernel API would vfio-pci make use of to achieve that?
We can't know the intentions of the guest and we have a limited set of
tools to manage the MSI-X state in the host kernel.  It's generally the
case that MSI-X vectors are only manipulated during driver setup and
shutdown, so while the current behavior isn't necessarily efficient, it
works within the constraints and generally doesn't have a runtime impact
on performance.  We also recognize that this behavior may change in the
future depending on more dynamic internal host kernel interfaces, thus
we export the VFIO_IRQ_INFO_NORESIZE flag to indicate to userspace
whether this procedure is required.


I tried to enable the specified MSIX vector only, and finally understood the 
original QEMU code after always getting EINVAL from ioctl->VFIO_DEVICE_SET_IRQS.
Then I tried to allocate all MSIX vectors in vfio_msix_enable(), not only MSIX vector 0. 
The change works, but it definitely doesn't follow the comment in the code "We don't 
want to have the host allocate all possible MSI vectors for a device if they're not in 
use". May I ask what the side effect is if we really allocate all possible vectors 
at the beginning?





What's more, on ARM64 systems with GIC ITS, the kernel will issue an
ITS discard command when disabling a MSI vector, which will drop
currently pending MSI interrupt. If device driver in guest system
enables some MSIs first and interrupts may come at any time, and then
it tries to enable other MSIs, is it possible for the above code to
cause interrupts missing?

Interrupt reconfiguration is generally during driver setup or teardown
when the device is considered idle or lost interrupts are not a
concern.  If you have a device which manipulates interrupt
configuration runtime, you can expect that lost interrupts won't be the
only problem,

On physical machine, if the driver enables vector 0 first, and then vector 1 
later, will the vector 0 interrupt be lost for some possibility? In my opinion 
the manipulation of vector 1 should not affect the interrupt of vector 0, isn't 
it? But if this is possible in virtual world, what do we consider it as? A bug 
to be fixed in future, or a known limitation of virtualization that won't be 
fixed and all driver developers should pay attention to it?

Thanks,

Heyi


it's also likely to experience much more overhead in the
interrupt manipulation path under assignment than on bare metal.  This
is another reason that well behaved drivers generally use relatively
static interrupt configurations initialized at driver setup time.
Thanks,

Alex

.







Re: [Qemu-devel] [PATCH V8 5/5] hostmem-file: add 'sync' option

2019-01-14 Thread Michael S. Tsirkin
On Tue, Jan 15, 2019 at 11:13:35AM +0800, Yi Zhang wrote:
> On 2019-01-14 at 17:39:38 -0200, Eduardo Habkost wrote:
> > On Wed, Jan 02, 2019 at 01:26:34PM +0800, Zhang Yi wrote:
> > > This option controls will mmap the memory backend file with MAP_SYNC flag,
> > > which can ensure filesystem metadata consistent even after a system crash
> > > or power failure, if MAP_SYNC flag is supported by the host kernel(Linux
> > > kernel 4.15 and later) and the backend is a file supporting DAX (e.g.,
> > > file on ext4/xfs file system mounted with '-o dax').
> > > 
> > > It can take one of following values:
> > >  - on:  try to pass MAP_SYNC to mmap(2); if MAP_SYNC is not supported or
> > > 'share=off' or 'pmem!=on', QEMU will not pass this flags to
> > >   mmap(2)
> > >  - off: default, never pass MAP_SYNC to mmap(2)
> > > 
> > > Signed-off-by: Haozhong Zhang 
> > > Signed-off-by: Zhang Yi 
> > > ---
> > [...]
> > > +vNVDIMM is designed and implemented to guarantee the guest data
> > > +persistence on the backends even on the host crash and power
> > > +failures. However, there are still some requirements and limitations
> > > +as explained below.
> > > +
> > >  Though QEMU supports multiple types of vNVDIMM backends on Linux,
> > > -currently the only one that can guarantee the guest write persistence
> > > +if MAP_SYNC is not supported by the host kernel and the backends,
> > > +the only backend that can guarantee the guest write persistence
> > >  is the device DAX on the real NVDIMM device (e.g., /dev/dax0.0), to
> > >  which all guest access do not involve any host-side kernel cache.
> > >  
> > > +mmap(2) flag MAP_SYNC is added since Linux kernel 4.15. On such
> > > +systems, QEMU can mmap(2) the backend with MAP_SYNC, which can ensure
> > > +filesystem metadata consistent even after a system crash or power
> > > +failure. Besides the host kernel support, enabling MAP_SYNC in QEMU
> > > +also requires:
> > > +
> > > + - the backend is a file supporting DAX, e.g., a file on an ext4 or
> > > +   xfs file system mounted with '-o dax',
> > > +
> > > + - 'sync' option of memory-backend-file is on, and
> > > +
> > > + - 'share' option of memory-backend-file is 'on'.
> > > +
> > > + - 'pmem' option of memory-backend-file is 'on'
> > 
> > I miss one piece of information here: are there any negative
> > side-effects of enabling MAP_SYNC on a pmem=on backend?  Could it
> > affect performance?  If it has no negative effects, why don't we
> > try to always enable it whenever possible?
> > 
> > 
> > > +
> > >  When using other types of backends, it's suggested to set 'unarmed'
> > >  option of '-device nvdimm' to 'on', which sets the unarmed flag of the
> > >  guest NVDIMM region mapping structure.  This unarmed flag indicates
> > [...]
> > > diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
> > > index a9d5e56..33a7639 100644
> > > --- a/util/mmap-alloc.c
> > > +++ b/util/mmap-alloc.c
> > > @@ -99,7 +99,7 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align, 
> > > uint32_t flags)
> > >  void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, 
> > > -1, 0);
> > >  #endif
> > >  bool shared = flags & RAM_SHARED;
> > > -bool is_pmem = flags & RAM_PMEM;
> > > +bool is_pmemsync = (flags & RAM_PMEM) && (flags & RAM_SYNC);
> > 
> > You seem to be reverting what you did on patch 3/5.  In patch
> > 3/5, you were setting MAP_SYNC automatically on all pmem=on
> > backends.  Now, you are only setting MAP_SYNC only if sync=on is
> > set explicitly.
> > 
> > I don't know which behavior is better (see question above), but
> > it's better to start with the right behavior in the first place.
> > 
> > Also, I don't think we should clear MAP_SYNC silently if sync=on
> > was explicitly requested in the command-line.  If sync=on was
> > set, we should do exactly as told, and require MAP_SYNC.  If we
> > still want to support use cases where MAP_SYNC is desired but
> > optional (do we?), we can make 'sync' a OnOffAuto option.
> Actually, I did this on previous version.
> see https://patchwork.kernel.org/patch/10725671/ 
> 
> Michael said that we should limit that option as it is only valided
> on a dax aware file system, to avoid the potencial performance issues
> we set it off by-defualt, and let a well-know user decides they wanna
> performance or stability.

However I am still unconvinced that the separate sync flag is helpful.
Why don't we set MAP_SYNC unconditionally when pmem is set?

It's a separate question what should happen on an old kernel. Maybe we
want a flag that says "fail unless persistence can be guaranteed".
Even then it's definitely not "sync".






> > 
> > 
> > >  int mmap_xflags = 0;
> > >  size_t offset;
> > >  void *ptr1;
> > > @@ -111,7 +111,7 @@ void *qemu_ram_mmap(int fd, size_t size, size_t 
> > > align, uint32_t flags)
> > >  assert(is_power_of_2(align));
> > >  /* Always align to host page size */
> > >  assert(align >= getpagesize());
> > > -

Re: [Qemu-devel] [PATCH V8 2/5] util/mmap-alloc: switch qemu_ram_mmap() to 'flags' parameter

2019-01-14 Thread Michael S. Tsirkin
On Tue, Jan 15, 2019 at 10:39:14AM +0800, Yi Zhang wrote:
> > It's needed for this series but yes, this ifdefery belongs in
> > a more central header. Maybe qemu/osdep.h
> > And it needs documentation and be a separate patch.
> Agree, Thank Michael's explanation, better to doing this in a separate
> patch series.

Separate patch, does not have to be a separate series.





Re: [Qemu-devel] [PATCH V8 5/5] hostmem-file: add 'sync' option

2019-01-14 Thread Yi Zhang
On 2019-01-14 at 17:39:38 -0200, Eduardo Habkost wrote:
> On Wed, Jan 02, 2019 at 01:26:34PM +0800, Zhang Yi wrote:
> > This option controls will mmap the memory backend file with MAP_SYNC flag,
> > which can ensure filesystem metadata consistent even after a system crash
> > or power failure, if MAP_SYNC flag is supported by the host kernel(Linux
> > kernel 4.15 and later) and the backend is a file supporting DAX (e.g.,
> > file on ext4/xfs file system mounted with '-o dax').
> > 
> > It can take one of following values:
> >  - on:  try to pass MAP_SYNC to mmap(2); if MAP_SYNC is not supported or
> > 'share=off' or 'pmem!=on', QEMU will not pass this flags to
> > mmap(2)
> >  - off: default, never pass MAP_SYNC to mmap(2)
> > 
> > Signed-off-by: Haozhong Zhang 
> > Signed-off-by: Zhang Yi 
> > ---
> [...]
> > +vNVDIMM is designed and implemented to guarantee the guest data
> > +persistence on the backends even on the host crash and power
> > +failures. However, there are still some requirements and limitations
> > +as explained below.
> > +
> >  Though QEMU supports multiple types of vNVDIMM backends on Linux,
> > -currently the only one that can guarantee the guest write persistence
> > +if MAP_SYNC is not supported by the host kernel and the backends,
> > +the only backend that can guarantee the guest write persistence
> >  is the device DAX on the real NVDIMM device (e.g., /dev/dax0.0), to
> >  which all guest access do not involve any host-side kernel cache.
> >  
> > +mmap(2) flag MAP_SYNC is added since Linux kernel 4.15. On such
> > +systems, QEMU can mmap(2) the backend with MAP_SYNC, which can ensure
> > +filesystem metadata consistent even after a system crash or power
> > +failure. Besides the host kernel support, enabling MAP_SYNC in QEMU
> > +also requires:
> > +
> > + - the backend is a file supporting DAX, e.g., a file on an ext4 or
> > +   xfs file system mounted with '-o dax',
> > +
> > + - 'sync' option of memory-backend-file is on, and
> > +
> > + - 'share' option of memory-backend-file is 'on'.
> > +
> > + - 'pmem' option of memory-backend-file is 'on'
> 
> I miss one piece of information here: are there any negative
> side-effects of enabling MAP_SYNC on a pmem=on backend?  Could it
> affect performance?  If it has no negative effects, why don't we
> try to always enable it whenever possible?
> 
> 
> > +
> >  When using other types of backends, it's suggested to set 'unarmed'
> >  option of '-device nvdimm' to 'on', which sets the unarmed flag of the
> >  guest NVDIMM region mapping structure.  This unarmed flag indicates
> [...]
> > diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
> > index a9d5e56..33a7639 100644
> > --- a/util/mmap-alloc.c
> > +++ b/util/mmap-alloc.c
> > @@ -99,7 +99,7 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align, 
> > uint32_t flags)
> >  void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 
> > 0);
> >  #endif
> >  bool shared = flags & RAM_SHARED;
> > -bool is_pmem = flags & RAM_PMEM;
> > +bool is_pmemsync = (flags & RAM_PMEM) && (flags & RAM_SYNC);
> 
> You seem to be reverting what you did on patch 3/5.  In patch
> 3/5, you were setting MAP_SYNC automatically on all pmem=on
> backends.  Now, you are only setting MAP_SYNC only if sync=on is
> set explicitly.
> 
> I don't know which behavior is better (see question above), but
> it's better to start with the right behavior in the first place.
> 
> Also, I don't think we should clear MAP_SYNC silently if sync=on
> was explicitly requested in the command-line.  If sync=on was
> set, we should do exactly as told, and require MAP_SYNC.  If we
> still want to support use cases where MAP_SYNC is desired but
> optional (do we?), we can make 'sync' a OnOffAuto option.
Actually, I did this on previous version.
see https://patchwork.kernel.org/patch/10725671/ 

Michael said that we should limit that option as it is only valided
on a dax aware file system, to avoid the potencial performance issues
we set it off by-defualt, and let a well-know user decides they wanna
performance or stability.
> 
> 
> >  int mmap_xflags = 0;
> >  size_t offset;
> >  void *ptr1;
> > @@ -111,7 +111,7 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align, 
> > uint32_t flags)
> >  assert(is_power_of_2(align));
> >  /* Always align to host page size */
> >  assert(align >= getpagesize());
> > -if (shared && is_pmem) {
> > +if (shared && is_pmemsync) {
> >  mmap_xflags |= MAP_SYNC;
> >  }
> >  
> > -- 
> > 2.7.4
> > 
> > 
> 
> -- 
> Eduardo



Re: [Qemu-devel] [PATCH v2 09/12] tests/tcg/mips: Test R5900 three-operand MADDU1

2019-01-14 Thread Aleksandar Markovic
On Monday, January 14, 2019, Fredrik Noring  wrote:

> Hi Aleksandar,
>
> > Awesome!
> >
> > I am especially happy with your choice of naming "mmr" (MultiMedia
> > Registers) for these fieilds, since that is what they really are (and
> they
> > are certainly not "gprs"). Right on the money!
>
> Great, thanks!
>
> > > For HI1 and LO1 only? I'm asking since HI0 and LO0 are implemented with
> > > the DSP array anyway, for all ISAs.
> >
> > I leave it to your judgement. If you are not sure (or you find the
> current
> > implementation too sensitive or contrieved to touch), you can leave
> HI1/LO1
> > fields implementation as it is now. My motivation was avoiding usage of
> the
> > same data fields for two relatively independant purposes.
>
> I think the change is simple, but what should we call the new variables?
>
> /* global register indices */
> static TCGv cpu_gpr[32], cpu_PC;
> static TCGv cpu_HI[MIPS_DSP_ACC], cpu_LO[MIPS_DSP_ACC];
> static TCGv cpu_HI1, cpu_LO1;/* Upper half of 128-bit TX79 HI and LO */
>
> Something like the last line?
>
>
Correct.


> By the way, what are your thoughts on "[PATCH v2 3/6] target/mips: Fix
> HI[ac] and LO[ac] 32-bit truncation with MIPS64 DSP ASE"?
>
> https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg01287.html
>
>
Still taking a closer look. Didn't forget.


> > Outstanding! I salute your including PCPYUD and PCPYLD in this group -
> they
> > too can be considered "basic R/W access to mmr".
>
> Good, many thanks!
>
> > The goal right now is to prepare basic stuff related to SA register, even
> > though there is possibly no immediate any application use case. However,
> > this will make potential future development considerably easier, so
> please
> > include handling of this register and these instructions.
>
> Done, although I have some minor clean-ups left to do. I have checked with
> R5900 hardware to match the implementation defined value of the SA
> register.
>
> I will post MFSA, MTSA, MTSAB and MTSAH in v2 of this patch series.
>
>
Magnificent!


> > Regarding segments:
> >
> > +int rs = extract32(ctx->opcode, 21, 5);
> > +int rt = extract32(ctx->opcode, 16, 5);
> > +int rd = extract32(ctx->opcode, 11, 5);
> >
> > Please include them in gen_XXX() functions, rather than in decode_XXX()
> > functions. This will leave decode_XXX() functions with a single
> > responsibility of detecting what instruction is about to be processed,
> > which is cleaner from logical decomposition point of view (even if it
> would
> > sometimes result in the repetition of some code segments - logical
> > decomposition is of far greater importance).
>
> Done!
>
> Fredrik
>


Re: [Qemu-devel] [PATCH V8 3/5] util/mmap-alloc: support MAP_SYNC in qemu_ram_mmap()

2019-01-14 Thread Yi Zhang
On 2019-01-14 at 17:07:02 -0200, Eduardo Habkost wrote:
> On Wed, Jan 02, 2019 at 01:26:15PM +0800, Zhang Yi wrote:
> > When a file supporting DAX is used as vNVDIMM backend, mmap it with
> > MAP_SYNC flag in addition which can ensure file system metadata
> > synced in each guest writes to the backend file, without other QEMU
> > actions (e.g., periodic fsync() by QEMU).
> > 
> > Signed-off-by: Haozhong Zhang 
> > Signed-off-by: Zhang Yi 
> > ---
> >  include/qemu/osdep.h | 16 
> >  util/mmap-alloc.c| 12 +++-
> >  2 files changed, 27 insertions(+), 1 deletion(-)
> > 
> > diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
> > index 3bf48bc..bb1eba1 100644
> > --- a/include/qemu/osdep.h
> > +++ b/include/qemu/osdep.h
> > @@ -410,6 +410,22 @@ void qemu_anon_ram_free(void *ptr, size_t size);
> >  #  define QEMU_VMALLOC_ALIGN getpagesize()
> >  #endif
> >  
> > +/*
> > + * MAP_SHARED_VALIDATE and MAP_SYNC are introduced in Linux kernel
> > + * 4.15, so they may not be defined when compiling on older kernels.
> > + */
> > +#ifdef CONFIG_LINUX
> > +
> > +#include 
> > +
> > +#ifndef MAP_SYNC
> > +#define MAP_SYNC 0x0
> > +#endif
> > +
> > +#else  /* !CONFIG_LINUX */
> > +#define MAP_SYNC  0x0
> > +#endif /* CONFIG_LINUX */
> > +
> >  #ifdef CONFIG_POSIX
> >  struct qemu_signalfd_siginfo {
> >  uint32_t ssi_signo;   /* Signal number */
> > diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
> > index 8f0a740..a9d5e56 100644
> > --- a/util/mmap-alloc.c
> > +++ b/util/mmap-alloc.c
> > @@ -99,6 +99,8 @@ void *qemu_ram_mmap(int fd, size_t size, size_t align, 
> > uint32_t flags)
> >  void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 
> > 0);
> >  #endif
> >  bool shared = flags & RAM_SHARED;
> > +bool is_pmem = flags & RAM_PMEM;
> > +int mmap_xflags = 0;
> >  size_t offset;
> >  void *ptr1;
> >  
> > @@ -109,13 +111,21 @@ void *qemu_ram_mmap(int fd, size_t size, size_t 
> > align, uint32_t flags)
> >  assert(is_power_of_2(align));
> >  /* Always align to host page size */
> >  assert(align >= getpagesize());
> > +if (shared && is_pmem) {
> > +mmap_xflags |= MAP_SYNC;
> > +}
> >  
> >  offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
> > + retry_mmap_fd:
> >  ptr1 = mmap(ptr + offset, size, PROT_READ | PROT_WRITE,
> >  MAP_FIXED |
> >  (fd == -1 ? MAP_ANONYMOUS : 0) |
> > -(shared ? MAP_SHARED : MAP_PRIVATE),
> > +(shared ? MAP_SHARED : MAP_PRIVATE) | mmap_xflags,
> >  fd, 0);
> > +if ((ptr1 == MAP_FAILED) && (mmap_xflags & MAP_SYNC)) {
> > +mmap_xflags &= ~MAP_SYNC;
> > +goto retry_mmap_fd;
> 
> Do we have use cases where using pmem=on without MAP_SYNC isn't
> going to cause problems?  If not, shouldn't we at least print a
Yes, we have a case that direct use dax device but not a files on
dax aware file system, we prefer to don't set the MAP_SYNC if user
haven't much knowledge about that. it may took some potencial 
performance issues with MAP_SYNC.
> warning here?  Otherwise, won't we still need an option for cases
> that require MAP_SYNC to be working?
> 
> > +}
> 
> -- 
> Eduardo



[Qemu-devel] MTTCG qemu-softmmu aborted on watchpoint hit by atomic instruction

2019-01-14 Thread Max Filippov
Hello,

I tried to debug guest application on SMP xtensa softmmu QEMU
through the gdbserver and found that QEMU aborts when guest
uses atomic operation to modify memory location watched by the
debugger. It exits with the following message:

ERROR: cpus.c:1848:qemu_mutex_lock_iothread_impl: assertion failed:
(!qemu_mutex_iothread_locked())

and the reason is that io_writex invoked from the atomic operation
calls qemu_mutex_lock_iothread but doesn't have a chance to call
qemu_mutex_unlock_iothread, because it exits the cpu loop at the
following place:

#0  __libc_siglongjmp (env=0x5628c720, val=1) at longjmp.c:28
#1  0x5577ef24 in cpu_loop_exit (cpu=0x5628c660) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/accel/tcg/cpu-exec-common.c:68
#2  0x556e23dd in check_watchpoint (offset=3700, len=4,
attrs=..., flags=2) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/exec.c:2762
#3  0x556e2603 in watch_mem_write (opaque=0x0, addr=14687860,
val=1, size=4, attrs=...) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/exec.c:2815
#4  0x55744f8e in memory_region_write_with_attrs_accessor
(mr=0x561c6c00 , addr=14687860,
value=0x7fffecfcb348, size=4, shift=0, mask=4294967295, attrs=...) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/memory.c:529
#5  0x557450ad in access_with_adjusted_size (addr=14687860,
value=0x7fffecfcb348, size=4, access_size_min=1, access_size_max=8,
access_fn=0x55744ea1 ,
mr=0x561c6c00 , attrs=...)
at /home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/memory.c:570
#6  0x55747d2c in memory_region_dispatch_write
(mr=0x561c6c00 , addr=14687860, data=1, size=4,
attrs=...) at /home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/memory.c:1459
#7  0x5576075e in io_writex (env=0x56294910,
iotlbentry=0x5629de50, mmu_idx=0, val=1, addr=3504348788,
retaddr=140737170398881, recheck=false, size=4) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/accel/tcg/cputlb.c:795
#8  0x55762652 in io_writel (env=0x56294910, mmu_idx=0,
index=1, val=1, addr=3504348788, retaddr=140737170398881,
recheck=false) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/accel/tcg/softmmu_template.h:273
#9  0x557627fe in helper_le_stl_mmu (env=0x56294910,
addr=3504348788, val=1, oi=32, retaddr=140737170398881) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/accel/tcg/softmmu_template.h:310
#10 0x7fffed0c5ea1 in code_gen_buffer ()
#11 0x5577dc59 in cpu_tb_exec (cpu=0x5628c660,
itb=0x7fffed0c5d40 ) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/accel/tcg/cpu-exec.c:171
#12 0x5577dfa1 in cpu_exec_step_atomic (cpu=0x5628c660) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/accel/tcg/cpu-exec.c:259
#13 0x5572ab43 in qemu_tcg_cpu_thread_fn (arg=0x5628c660)
at /home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/cpus.c:1751
#14 0x55a6052e in qemu_thread_start (args=0x562ad9f0) at
/home/jcmvbkbc/ws/m/awt/emu/xtensa/qemu/util/qemu-thread-posix.c:498
#15 0x752f5494 in start_thread (arg=0x7fffecfcc700) at
pthread_create.c:333
#16 0x75037acf in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:97


It doesn't look like an xtensa-specific issue, any idea how to fix it?

-- 
Thanks.
-- Max



Re: [Qemu-devel] [PATCH V8 2/5] util/mmap-alloc: switch qemu_ram_mmap() to 'flags' parameter

2019-01-14 Thread Yi Zhang
On 2019-01-14 at 14:04:25 -0500, Michael S. Tsirkin wrote:
> On Mon, Jan 14, 2019 at 04:50:36PM -0200, Eduardo Habkost wrote:
> > On Wed, Jan 02, 2019 at 01:26:06PM +0800, Zhang Yi wrote:
> > > As more flag parameters besides the existing 'shared' are going to be
> > > added to qemu_ram_mmap(), let's switch 'shared' to a 'flags' parameter
> > > in advance, so as to ease the further additions.
> > > 
> > > Signed-off-by: Haozhong Zhang 
> > > Signed-off-by: Zhang Yi 
> > > ---
> > >  exec.c|  7 ---
> > >  include/exec/memory.h | 22 --
> > >  include/qemu/mmap-alloc.h | 19 ++-
> > >  util/mmap-alloc.c |  8 +---
> > >  util/oslib-posix.c|  9 -
> > >  5 files changed, 51 insertions(+), 14 deletions(-)
> > > 
> > > diff --git a/exec.c b/exec.c
> > > index bb6170d..e92a7da 100644
> > > --- a/exec.c
> > > +++ b/exec.c
> > > @@ -1810,6 +1810,7 @@ static void *file_ram_alloc(RAMBlock *block,
> > >  ram_addr_t memory,
> > >  int fd,
> > >  bool truncate,
> > > +uint32_t flags,
> > >  Error **errp)
> > 
> > I suggest documenting on the commit message why you are changing
> > file_ram_alloc() too.  The commit message mentions only
> > qemu_ram_mmap().
> > 
> > >  {
> > >  void *area;
> > > @@ -1859,8 +1860,7 @@ static void *file_ram_alloc(RAMBlock *block,
> > >  perror("ftruncate");
> > >  }
> > >  
> > > -area = qemu_ram_mmap(fd, memory, block->mr->align,
> > > - block->flags & RAM_SHARED);
> > > +area = qemu_ram_mmap(fd, memory, block->mr->align, flags);
> > >  if (area == MAP_FAILED) {
> > >  error_setg_errno(errp, errno,
> > >   "unable to map backing store for guest RAM");
> > > @@ -2279,7 +2279,8 @@ RAMBlock *qemu_ram_alloc_from_fd(ram_addr_t size, 
> > > MemoryRegion *mr,
> > >  new_block->used_length = size;
> > >  new_block->max_length = size;
> > >  new_block->flags = ram_flags;
> > > -new_block->host = file_ram_alloc(new_block, size, fd, !file_size, 
> > > errp);
> > > +new_block->host = file_ram_alloc(new_block, size, fd, !file_size,
> > > +ram_flags, errp);
> > >  if (!new_block->host) {
> > >  g_free(new_block);
> > >  return NULL;
> > > diff --git a/include/exec/memory.h b/include/exec/memory.h
> > > index 667466b..6e30c23 100644
> > > --- a/include/exec/memory.h
> > > +++ b/include/exec/memory.h
> > > @@ -103,28 +103,38 @@ struct IOMMUNotifier {
> > >  };
> > >  typedef struct IOMMUNotifier IOMMUNotifier;
> > >  
> > > +#ifdef __CHECKER__
> > > +#define QEMU_BITWISE __attribute__((bitwise))
> > > +#define QEMU_FORCE   __attribute__((force))
> > > +#else
> > > +#define QEMU_BITWISE
> > > +#define QEMU_FORCE
> > > +#endif
> > > +
> > 
> > I assume this is a sparse feature?
> > 
> > Why is it part of this patch?  I suggest doing this in a separate
> > patch series and in a common header file, so other developers
> > have a better chance to review it and decide how to use this
> > sparse feature in QEMU.
> 
> It's needed for this series but yes, this ifdefery belongs in
> a more central header. Maybe qemu/osdep.h
> And it needs documentation and be a separate patch.
Agree, Thank Michael's explanation, better to doing this in a separate
patch series.
> 
> 
> > 
> > > +typedef unsigned QEMU_BITWISE QemuMmapFlags;
> > > +
> > >  /* RAM is pre-allocated and passed into qemu_ram_alloc_from_ptr */
> > > -#define RAM_PREALLOC   (1 << 0)
> > > +#define RAM_PREALLOC ((QEMU_FORCE QemuMmapFlags) (1 << 0))
> > >  
> > >  /* RAM is mmap-ed with MAP_SHARED */
> > > -#define RAM_SHARED (1 << 1)
> > > +#define RAM_SHARED ((QEMU_FORCE QemuMmapFlags) (1 << 1))
> > >  
> > >  /* Only a portion of RAM (used_length) is actually used, and migrated.
> > >   * This used_length size can change across reboots.
> > >   */
> > > -#define RAM_RESIZEABLE (1 << 2)
> > > +#define RAM_RESIZEABLE ((QEMU_FORCE QemuMmapFlags) (1 << 2))
> > >  
> > >  /* UFFDIO_ZEROPAGE is available on this RAMBlock to atomically
> > >   * zero the page and wake waiting processes.
> > >   * (Set during postcopy)
> > >   */
> > > -#define RAM_UF_ZEROPAGE (1 << 3)
> > > +#define RAM_UF_ZEROPAGE ((QEMU_FORCE QemuMmapFlags) (1 << 3))
> > >  
> > >  /* RAM can be migrated */
> > > -#define RAM_MIGRATABLE (1 << 4)
> > > +#define RAM_MIGRATABLE ((QEMU_FORCE QemuMmapFlags) (1 << 4))
> > >  
> > >  /* RAM is a persistent kind memory */
> > > -#define RAM_PMEM (1 << 5)
> > > +#define RAM_PMEM ((QEMU_FORCE QemuMmapFlags) (1 << 5))
> > >  
> > >  static inline void iommu_notifier_init(IOMMUNotifier *n, IOMMUNotify fn,
> > > IOMMUNotifierFlag flags,
> > > diff --git a/include/qemu/mmap-alloc.h b/include/qemu/mmap-alloc.h
> > > index 50385e3..6fe6ed4 100644
> > > --- 

Re: [Qemu-devel] [PATCH] vhost-user-blk: enable discard/write zeroes features

2019-01-14 Thread Liu, Changpeng



> -Original Message-
> From: Stefan Hajnoczi [mailto:stefa...@gmail.com]
> Sent: Monday, January 14, 2019 6:42 PM
> To: Liu, Changpeng 
> Cc: qemu-devel@nongnu.org; stefa...@redhat.com; m...@redhat.com;
> sgaz...@redhat.com
> Subject: Re: [Qemu-devel] [PATCH] vhost-user-blk: enable discard/write zeroes
> features
> 
> On Mon, Jan 14, 2019 at 03:35:17PM +0800, Changpeng Liu wrote:
> > Linux commit 1f23816b8 "virtio_blk: add discard and write zeroes support"
> > added the support in the Guest kernel, while here enable the feature bits
> > support with vhost-user-blk driver.  Also enable the test example utility
> > with DISCARD command support.
> 
> The commit message mentions write zeroes but this patch only covers
> discard.  Will you send a separate patch for write zeros?
Not really, I don't have such plan at first, I can add it in next version.
> 
> > Signed-off-by: Changpeng Liu 
> 
> CCed Stefano, who is working on hw/block/virtio-blk.c emulation support.
> 
> > @@ -157,6 +161,29 @@ vub_writev(VubReq *req, struct iovec *iov, uint32_t
> iovcnt)
> >  return rc;
> >  }
> >
> > +static int
> > +vub_discard(VubReq *req, struct iovec *iov, uint32_t iovcnt)
> > +{
> > +if (iovcnt != 1) {
> 
> This is a virtio specification violation.  The iovec layout is
> intentionally not part of the specification, leaving the guest driver
> free to choose its preferred layout.
> 
> The device backend must accept any layout, including splitting a struct
> across iovecs or even many small iovecs of just 1 byte!
I see, the original intention here is just using 1 descriptor, which is 16 
bytes.
> 
> > +fprintf(stderr, "Invalid Discard IOV count\n");
> > +return -1;
> > +}
> > +
> > +#if defined(__linux__) && defined(BLKDISCARD)
> > +VubDev *vdev_blk = req->vdev_blk;
> > +struct virtio_blk_discard_write_zeroes *desc =
> > +   (struct virtio_blk_discard_write_zeroes 
> > *)iov->iov_base;
> 
> Missing input size check.  Even if this example isn't used in
> production, it's important to validate inputs since other people will
> implement their vhost-user backend based on this example.
> 
> Please check that sizeof(*desc) bytes are really available before
> accessing it.
Ok, will fix it.
> 
> > +case VIRTIO_BLK_T_DISCARD: {
> > +int rc;
> > +rc = vub_discard(req, >out_sg[1], out_num);
> > +if (rc == 0) {
> >  req->in->status = VIRTIO_BLK_S_OK;
> > -req->size = elem->in_sg[0].iov_len;
> > -vub_req_complete(req);
> > -break;
> > -}
> > -default: {
> > +} else {
> >  req->in->status = VIRTIO_BLK_S_UNSUPP;
> 
> Is there no IOERR case?  BLKDISCARD can probably fail due to an I/O
> error and that shouldn't be reported as UNSUPP.
Yes, should include both UNSUPP and ERR status here, will fix it.
> 
> > @@ -454,7 +492,7 @@ vub_get_blocksize(int fd)
> >
> >  #if defined(__linux__) && defined(BLKSSZGET)
> >  if (ioctl(fd, BLKSSZGET, ) == 0) {
> > -return blocklen;
> > +return blocksize;
> >  }
> >  #endif
> 
> Unrelated bug fix?  Please submit a separate patch.
Ok.
> 
> Do you know why the patchew, Travis, etc continuous integration systems
> didn't detect the compile error?  Please ensure that
> contrib/vhost-user-blk/ is covered by CI.
I don't include the header file before, so it will return hardcoded 512 bytes, 
which works for most devices.



Re: [Qemu-devel] Meaning of "-smp threads" on mips_malta

2019-01-14 Thread Aleksandar Markovic
On Monday, January 14, 2019, Eduardo Habkost  wrote:

> Hi,
>
> I'm trying to refactor the SMP topology code in QEMU


>
Eduardo, I truly appreciate your interest in details of Malta
implementations, but before I answer your questions, could you please
outline the motivation and the current concept of your envisioned
refactoring of SMP, so that I have some picture of the whole context?

Sincerely, Aleksandar



>
> and I found
> some suspicious code on mips_malta.c:
>
> static void malta_mips_config(MIPSCPU *cpu)
> {
> CPUMIPSState *env = >env;
> CPUState *cs = CPU(cpu);
>
> env->mvp->CP0_MVPConf0 |= ((smp_cpus - 1) << CP0MVPC0_PVPE) |
>  ((smp_cpus * cs->nr_threads - 1) << CP0MVPC0_PTC);
> }
>
>
> The (smp_cpus * cs->nr_threads) expression here doesn't make
> sense to me (because smp_cpus is already supposed to be a
> multiple of smp_threads), and seems to indicate that the code has
> some unusual assumptions about the semantics of the -smp option.
>
> So, I'd like to know: do all the examples below make sense for
> Malta?
>
>  -smp 1
>  -smp 2
>  -smp 2,threads=1
>  -smp 2,threads=2
>  -smp 1,threads=2 [*]
>  -smp 2,threads=3 [*]
>
> The generic -smp parsing code considers the last 2 entries
> above[*] to be invalid.  If they make sense for Malta, we need to
> find a way to fix that.  Replacing "-smp threads=..." with a
> "-cpu" or "-machine" option seems like the best alternative.
>
> --
> Eduardo
>
>


Re: [Qemu-devel] [PATCH v1 1/5] cpu: introduce die, the new cpu toppolgy emulation level

2019-01-14 Thread Xu, Like
> -Original Message-
> From: Eric Blake [mailto:ebl...@redhat.com]
> Sent: Tuesday, January 15, 2019 4:08 AM
> To: Like Xu ; qemu-devel@nongnu.org
> Cc: drjo...@redhat.com; Peter Crosthwaite
> ; Eduardo Habkost ;
> Michael S. Tsirkin ; Xu, Like ;
> Marcelo Tosatti ; Paolo Bonzini
> ; imamm...@redhat.com; Richard Henderson
> 
> Subject: Re: [Qemu-devel] [PATCH v1 1/5] cpu: introduce die, the new cpu
> toppolgy emulation level
> 
> On 1/14/19 6:24 AM, Like Xu wrote:
> > Following codes on smp_cores, the smp_dies/nr_dies/die-id is added to
> > machine and CPUState. In addition to enable_cpuid_0xb,
> enable_cpuid_0x1f
> > is introduced to track wether host is a new MCP macine or just ignored.
> 
> s/wether/whether/, s/macine/machine/
[Xu, Like] Sorry for typos and inconvenience.
> 
> > The number for die level_type on Intel is 5 while core type keeps 2.
> >
> > Signed-off-by: Like Xu 
> > ---
> >  cpus.c| 1 +
> >  include/qom/cpu.h | 1 +
> >  include/sysemu/cpus.h | 1 +
> >  qapi/misc.json| 1 +
> >  target/i386/cpu.h | 5 +
> >  5 files changed, 9 insertions(+)
> >
> 
> > +++ b/qapi/misc.json
> > @@ -3229,6 +3229,7 @@
> >  { 'struct': 'CpuInstanceProperties',
> >'data': { '*node-id': 'int',
> >  '*socket-id': 'int',
> > +'*die-id': 'int',
> 
> Missing documentation of the new field, including a '(since 4.0)' tag.
[Xu, Like] Let me add more docs in next version and thanks.
> 
> >  '*core-id': 'int',
> >  '*thread-id': 'int'
> >}
> 
> 
> --
> Eric Blake, Principal Software Engineer
> Red Hat, Inc.   +1-919-301-3226
> Virtualization:  qemu.org | libvirt.org



Re: [Qemu-devel] [PATCH v3 0/5] kvm "virtio pmem" device

2019-01-14 Thread Michael S. Tsirkin
On Tue, Jan 15, 2019 at 09:21:32AM +1100, Dave Chinner wrote:
> On Mon, Jan 14, 2019 at 01:35:57PM -0800, Dan Williams wrote:
> > On Mon, Jan 14, 2019 at 1:25 PM Dave Chinner  wrote:
> > >
> > > On Mon, Jan 14, 2019 at 02:15:40AM -0500, Pankaj Gupta wrote:
> > > >
> > > > > > Until you have images (and hence host page cache) shared between
> > > > > > multiple guests. People will want to do this, because it means they
> > > > > > only need a single set of pages in host memory for executable
> > > > > > binaries rather than a set of pages per guest. Then you have
> > > > > > multiple guests being able to detect residency of the same set of
> > > > > > pages. If the guests can then, in any way, control eviction of the
> > > > > > pages from the host cache, then we have a guest-to-guest information
> > > > > > leak channel.
> > > > >
> > > > > I don't think we should ever be considering something that would 
> > > > > allow a
> > > > > guest to evict page's from the host's pagecache [1].  The guest should
> > > > > be able to kick its own references to the host's pagecache out of its
> > > > > own pagecache, but not be able to influence whether the host or 
> > > > > another
> > > > > guest has a read-only mapping cached.
> > > > >
> > > > > [1] Unless the guest is allowed to modify the host's file; obviously
> > > > > truncation, holepunching, etc are going to evict pages from the host's
> > > > > page cache.
> > > >
> > > > This is so correct. Guest does not not evict host page cache pages 
> > > > directly.
> > >
> > > They don't right now.
> > >
> > > But someone is going to end up asking for discard to work so that
> > > the guest can free unused space in the underlying spares image (i.e.
> > > make use of fstrim or mount -o discard) because they have workloads
> > > that have bursts of space usage and they need to trim the image
> > > files afterwards to keep their overall space usage under control.
> > >
> > > And then
> > 
> > ...we reject / push back on that patch citing the above concern.
> 
> So at what point do we draw the line?
> 
> We're allowing writable DAX mappings, but as I've pointed out that
> means we are going to be allowing  a potential information leak via
> files with shared extents to be directly mapped and written to.
> 
> But we won't allow useful admin operations that allow better
> management of host side storage space similar to how normal image
> files are used by guests because it's an information leak vector?
> 
> That's splitting some really fine hairs there...

May I summarize that th security implications need to
be documented?

In fact that would make a fine security implications section
in the device specification.





> > > > In case of virtio-pmem & DAX, guest clears guest page cache exceptional 
> > > > entries.
> > > > Its solely decision of host to take action on the host page cache pages.
> > > >
> > > > In case of virtio-pmem, guest does not modify host file directly i.e 
> > > > don't
> > > > perform hole punch & truncation operation directly on host file.
> > >
> > > ... this will no longer be true, and the nuclear landmine in this
> > > driver interface will have been armed
> > 
> > I agree with the need to be careful when / if explicit cache control
> > is added, but that's not the case today.
> 
> "if"?
> 
> I expect it to be "when", not if. Expect the worst, plan for it now.
> 
> Cheers,
> 
> Dave.
> -- 
> Dave Chinner
> da...@fromorbit.com



Re: [Qemu-devel] [PATCH v5 4/4] i386: allow to load initrd below 4G for recent linux

2019-01-14 Thread Li Zhijian

Hi Eduardo


On 1/15/19 01:53, Eduardo Habkost wrote:

+if (protocol >= 0x20c &&
+lduw_p(header+0x236) & XLF_CAN_BE_LOADED_ABOVE_4G) {
+/*
+ * Linux has supported initrd up to 4 GB for a very long time (2007,
+ * long before XLF_CAN_BE_LOADED_ABOVE_4G which was added in 2013),
+ * though it only sets initrd_max to 2 GB to "work around bootloader
+ * bugs". Luckily, QEMU firmware(which does something like bootloader)
+ * has supported this.
+ *
+ * It's believed that if XLF_CAN_BE_LOADED_ABOVE_4G is set, initrd can
+ * be loaded into any address.
+ *
+ * In addition, initrd_max is uint32_t simply because QEMU doesn't
+ * support the 64-bit boot protocol (specifically the ext_ramdisk_image
+ * field).
+ *
+ * Therefore here just limit initrd_max to UINT32_MAX simply as well.
+ *
+ * FIXME: it's possible that linux protocol within [0x208, 0x20c]
+ * supports up to 4G initrd as well.

I don't understand what exactly this FIXME comment is
documenting.  What exactly needs to be fixed?


XLF_CAN_BE_LOADED_ABOVE_4G is one of the indicators, actually as comments said,
linux has supported up to 4 GB initrd since linux-2.26(protocol version 0x208).


I just want to comment that linux with protocol within [0x208, 0x20c] supports 
up to 4 GB initrd as well.

Is documenting with FIXME appropriate?


Thanks






Re: [Qemu-devel] [PATCH v5 4/4] i386: allow to load initrd below 4G for recent linux

2019-01-14 Thread Michael S. Tsirkin
On Tue, Jan 15, 2019 at 09:35:09AM +0800, Li Zhijian wrote:
> Hi Eduardo
> 
> 
> On 1/15/19 01:53, Eduardo Habkost wrote:
> 
> +if (protocol >= 0x20c &&
> +lduw_p(header+0x236) & XLF_CAN_BE_LOADED_ABOVE_4G) {
> +/*
> + * Linux has supported initrd up to 4 GB for a very long 
> time (2007,
> + * long before XLF_CAN_BE_LOADED_ABOVE_4G which was added in 
> 2013),
> + * though it only sets initrd_max to 2 GB to "work around 
> bootloader
> + * bugs". Luckily, QEMU firmware(which does something like 
> bootloader)
> + * has supported this.
> + *
> + * It's believed that if XLF_CAN_BE_LOADED_ABOVE_4G is set, 
> initrd can
> + * be loaded into any address.
> + *
> + * In addition, initrd_max is uint32_t simply because QEMU 
> doesn't
> + * support the 64-bit boot protocol (specifically the 
> ext_ramdisk_image
> + * field).
> + *
> + * Therefore here just limit initrd_max to UINT32_MAX simply 
> as well.
> + *
> + * FIXME: it's possible that linux protocol within [0x208, 
> 0x20c]
> + * supports up to 4G initrd as well.
> 
> I don't understand what exactly this FIXME comment is
> documenting.  What exactly needs to be fixed?
> 
> 
> XLF_CAN_BE_LOADED_ABOVE_4G is one of the indicators, actually as comments 
> said,
> linux has supported up to 4 GB initrd since linux-2.26(protocol version 
> 0x208).
> 
> 
> I just want to comment that linux with protocol within [0x208, 0x20c] 
> supports up to 4 GB initrd as well.
> 
> Is documenting with FIXME appropriate?
> 
> 
> Thanks
> 
> 


Fixme should say what is missing in the qemu implementation.
E.g.

/*
 * Bar 2010 and up can actually be supported using foo.
 * FIXME: make use of foo to support bar.
 */


-- 
MST



[Qemu-devel] [PULL 02/44] msix: make pba size math more uniform

2019-01-14 Thread Michael S. Tsirkin
From: Dongli Zhang 

In msix_exclusive_bar the bar_pba_size is more than what the pba is
expected to have, although this never affects the bar size.

Specifically, the math in msix_init_exclusive_bar allocates too much
memory in some cases.

For example consider nentries = 8.  msix_exclusive_bar will give us
bar_pba_size = 16.  So 16 bytes.  However 8 bytes would be enough - this
is all that the spec requires.

So in practice bar_pba_size sometimes allocates an extra 8 bytes but
never more.

Since each MSIX entry size is 16 bytes, and since we make sure that
table+pba is a power of two, this always leaves a multiple of 16 bytes
for the PBA, so extra 8 bytes have no effect.

However, its ugly to have pba size temporary variable have an incorrect
value.  For consistency switch to the formula used in msix_init.

Signed-off-by: Dongli Zhang 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/pci/msix.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci/msix.c b/hw/pci/msix.c
index c7bdbeda9e..4e336416a7 100644
--- a/hw/pci/msix.c
+++ b/hw/pci/msix.c
@@ -345,7 +345,7 @@ int msix_init_exclusive_bar(PCIDevice *dev, unsigned short 
nentries,
 char *name;
 uint32_t bar_size = 4096;
 uint32_t bar_pba_offset = bar_size / 2;
-uint32_t bar_pba_size = (nentries / 8 + 1) * 8;
+uint32_t bar_pba_size = QEMU_ALIGN_UP(nentries, 64) / 8;
 
 /*
  * Migration compatibility dictates that this remains a 4k
-- 
MST




[Qemu-devel] [PULL 07/44] util: check the return value of fcntl in qemu_set_{block, nonblock}

2019-01-14 Thread Michael S. Tsirkin
From: Li Qiang 

Assert that the return value is not an error. This is like commit
7e6478e7d4f for qemu_set_cloexec.

Signed-off-by: Li Qiang 
Reviewed-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 util/oslib-posix.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index c1bee2a581..4ce1ba9ca4 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -233,14 +233,18 @@ void qemu_set_block(int fd)
 {
 int f;
 f = fcntl(fd, F_GETFL);
-fcntl(fd, F_SETFL, f & ~O_NONBLOCK);
+assert(f != -1);
+f = fcntl(fd, F_SETFL, f & ~O_NONBLOCK);
+assert(f != -1);
 }
 
 void qemu_set_nonblock(int fd)
 {
 int f;
 f = fcntl(fd, F_GETFL);
-fcntl(fd, F_SETFL, f | O_NONBLOCK);
+assert(f != -1);
+f = fcntl(fd, F_SETFL, f | O_NONBLOCK);
+assert(f != -1);
 }
 
 int socket_set_fast_reuse(int fd)
-- 
MST




[Qemu-devel] [PULL 06/44] vhost-user: fix ioeventfd_enabled

2019-01-14 Thread Michael S. Tsirkin
From: Li Qiang 

Currently, the vhost-user-test assumes the eventfd is available.
However it's not true because the accel is qtest. So the
'vhost_set_vring_file' will not add fds to the msg and the server
side of vhost-user-test will be broken. The bug is in 'ioeventfd_enabled'.
We should make this function return true if not using kvm accel.

Signed-off-by: Li Qiang 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/vhost-user.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index e09bed0e4a..564a31d12c 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -207,7 +207,7 @@ struct vhost_user {
 
 static bool ioeventfd_enabled(void)
 {
-return kvm_enabled() && kvm_eventfds_enabled();
+return !kvm_enabled() || kvm_eventfds_enabled();
 }
 
 static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
-- 
MST




[Qemu-devel] [PULL 13/44] tests: smbios: fetch whole table in one step instead of reading it step by step

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

replace a bunch of ACPI_READ_ARRAY/ACPI_READ_FIELD macro, that read
SMBIOS table field by field with one memread() to fetch whole table
at once and drop no longer used ACPI_READ_ARRAY/ACPI_READ_FIELD macro.

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/acpi-utils.h   | 17 -
 tests/bios-tables-test.c | 15 +--
 2 files changed, 1 insertion(+), 31 deletions(-)

diff --git a/tests/acpi-utils.h b/tests/acpi-utils.h
index 1aa00db2b6..cb7183e057 100644
--- a/tests/acpi-utils.h
+++ b/tests/acpi-utils.h
@@ -30,23 +30,6 @@ typedef struct {
 bool tmp_files_retain;   /* do not delete the temp asl/aml */
 } AcpiSdtTable;
 
-#define ACPI_READ_FIELD(qts, field, addr)\
-do { \
-qtest_memread(qts, addr, , sizeof(field)); \
-addr += sizeof(field);   \
-} while (0)
-
-#define ACPI_READ_ARRAY_PTR(qts, arr, length, addr)  \
-do { \
-int idx; \
-for (idx = 0; idx < length; ++idx) { \
-ACPI_READ_FIELD(qts, arr[idx], addr);\
-}\
-} while (0)
-
-#define ACPI_READ_ARRAY(qts, arr, addr) \
-ACPI_READ_ARRAY_PTR(qts, arr, sizeof(arr) / sizeof(arr[0]), addr)
-
 #define ACPI_ASSERT_CMP(actual, expected) do { \
 char ACPI_ASSERT_CMP_str[5] = {}; \
 memcpy(ACPI_ASSERT_CMP_str, , 4); \
diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index 8fdd1c173a..dcd6be8bbd 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -406,32 +406,19 @@ static bool smbios_ep_table_ok(test_data *data)
 struct smbios_21_entry_point *ep_table = >smbios_ep_table;
 uint32_t addr = data->smbios_ep_addr;
 
-ACPI_READ_ARRAY(data->qts, ep_table->anchor_string, addr);
+qtest_memread(data->qts, addr, ep_table, sizeof(*ep_table));
 if (memcmp(ep_table->anchor_string, "_SM_", 4)) {
 return false;
 }
-ACPI_READ_FIELD(data->qts, ep_table->checksum, addr);
-ACPI_READ_FIELD(data->qts, ep_table->length, addr);
-ACPI_READ_FIELD(data->qts, ep_table->smbios_major_version, addr);
-ACPI_READ_FIELD(data->qts, ep_table->smbios_minor_version, addr);
-ACPI_READ_FIELD(data->qts, ep_table->max_structure_size, addr);
-ACPI_READ_FIELD(data->qts, ep_table->entry_point_revision, addr);
-ACPI_READ_ARRAY(data->qts, ep_table->formatted_area, addr);
-ACPI_READ_ARRAY(data->qts, ep_table->intermediate_anchor_string, addr);
 if (memcmp(ep_table->intermediate_anchor_string, "_DMI_", 5)) {
 return false;
 }
-ACPI_READ_FIELD(data->qts, ep_table->intermediate_checksum, addr);
-ACPI_READ_FIELD(data->qts, ep_table->structure_table_length, addr);
 if (ep_table->structure_table_length == 0) {
 return false;
 }
-ACPI_READ_FIELD(data->qts, ep_table->structure_table_address, addr);
-ACPI_READ_FIELD(data->qts, ep_table->number_of_structures, addr);
 if (ep_table->number_of_structures == 0) {
 return false;
 }
-ACPI_READ_FIELD(data->qts, ep_table->smbios_bcd_revision, addr);
 if (acpi_calc_checksum((uint8_t *)ep_table, sizeof *ep_table) ||
 acpi_calc_checksum((uint8_t *)ep_table + 0x10,
sizeof *ep_table - 0x10)) {
-- 
MST




[Qemu-devel] [PULL 05/44] tests: vhost-user-test: initialize 'fd' in chr_read

2019-01-14 Thread Michael S. Tsirkin
From: Li Qiang 

Currently when processing VHOST_USER_SET_VRING_CALL
if 'qemu_chr_fe_get_msgfds' get no fd, the 'fd' will
be a stack uninitialized value.

Signed-off-by: Li Qiang 
Reviewed-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/vhost-user-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/vhost-user-test.c b/tests/vhost-user-test.c
index 54982f68e7..84e50d84e7 100644
--- a/tests/vhost-user-test.c
+++ b/tests/vhost-user-test.c
@@ -309,7 +309,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int 
size)
 CharBackend *chr = >chr;
 VhostUserMsg msg;
 uint8_t *p = (uint8_t *) 
-int fd;
+int fd = -1;
 
 if (s->test_fail) {
 qemu_chr_fe_disconnect(chr);
-- 
MST




[Qemu-devel] [PULL 15/44] tests: acpi: use AcpiSdtTable::aml instead of AcpiSdtTable::header::signature

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

AcpiSdtTable::header::signature is the only remained field from
AcpiTableHeader structure used by tests. Instead of using packed
structure to access signature, just read it directly from table
blob and remove no longer used AcpiSdtTable::header / union and
keep only AcpiSdtTable::aml byte array.

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/acpi-utils.h   |  6 +-
 tests/bios-tables-test.c | 20 +---
 2 files changed, 10 insertions(+), 16 deletions(-)

diff --git a/tests/acpi-utils.h b/tests/acpi-utils.h
index cb7183e057..ef388bbf12 100644
--- a/tests/acpi-utils.h
+++ b/tests/acpi-utils.h
@@ -13,15 +13,11 @@
 #ifndef TEST_ACPI_UTILS_H
 #define TEST_ACPI_UTILS_H
 
-#include "hw/acpi/acpi-defs.h"
 #include "libqtest.h"
 
 /* DSDT and SSDTs format */
 typedef struct {
-union {
-AcpiTableHeader *header;
-uint8_t *aml;/* aml bytecode from guest */
-};
+uint8_t *aml;/* aml bytecode from guest */
 uint32_t aml_len;
 gchar *aml_file;
 gchar *asl;/* asl code generated from aml */
diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index 9139decc68..0bf7164590 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -44,6 +44,11 @@ static const char *iasl = stringify(CONFIG_IASL);
 static const char *iasl;
 #endif
 
+static bool compare_signature(const AcpiSdtTable *sdt, const char *signature)
+{
+   return !memcmp(sdt->aml, signature, 4);
+}
+
 static void cleanup_table_descriptor(AcpiSdtTable *table)
 {
 g_free(table->aml);
@@ -130,7 +135,7 @@ static void test_acpi_fadt_table(test_data *data)
 uint8_t *fadt_aml = table.aml;
 uint32_t fadt_len = table.aml_len;
 
-ACPI_ASSERT_CMP(table.header->signature, "FACP");
+g_assert(compare_signature(, "FACP"));
 
 /* Since DSDT/FACS isn't in RSDT, add them to ASL test list manually */
 acpi_fetch_table(data->qts, , _len,
@@ -169,7 +174,7 @@ static void dump_aml_files(test_data *data, bool rebuild)
 
 if (rebuild) {
 aml_file = g_strdup_printf("%s/%s/%.4s%s", data_dir, data->machine,
-   (gchar *)>header->signature, ext);
+   sdt->aml, ext);
 fd = g_open(aml_file, O_WRONLY|O_TRUNC|O_CREAT,
 S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH);
 } else {
@@ -187,11 +192,6 @@ static void dump_aml_files(test_data *data, bool rebuild)
 }
 }
 
-static bool compare_signature(AcpiSdtTable *sdt, const char *signature)
-{
-   return !memcmp(>header->signature, signature, 4);
-}
-
 static bool load_asl(GArray *sdts, AcpiSdtTable *sdt)
 {
 AcpiSdtTable *temp;
@@ -290,7 +290,7 @@ static GArray *load_expected_aml(test_data *data)
 
 try_again:
 aml_file = g_strdup_printf("%s/%s/%.4s%s", data_dir, data->machine,
-   (gchar *)>header->signature, ext);
+   sdt->aml, ext);
 if (getenv("V")) {
 fprintf(stderr, "Looking for expected file '%s'\n", aml_file);
 }
@@ -350,14 +350,12 @@ static void test_acpi_asl(test_data *data)
 fprintf(stderr,
 "Warning! iasl couldn't parse the expected aml\n");
 } else {
-uint32_t signature = cpu_to_le32(exp_sdt->header->signature);
 sdt->tmp_files_retain = true;
 exp_sdt->tmp_files_retain = true;
 fprintf(stderr,
 "acpi-test: Warning! %.4s mismatch. "
 "Actual [asl:%s, aml:%s], Expected [asl:%s, 
aml:%s].\n",
-(gchar *),
-sdt->asl_file, sdt->aml_file,
+exp_sdt->aml, sdt->asl_file, sdt->aml_file,
 exp_sdt->asl_file, exp_sdt->aml_file);
 if (getenv("V")) {
 const char *diff_cmd = getenv("DIFF");
-- 
MST




[Qemu-devel] [Bug 1811653] Re: usbredir slow when multi bulk packet per second

2019-01-14 Thread feihu
** Description changed:

  QEMU Ver: all version
  Client: virt-viewer with spice
  Guest VM: win7
  Bug description:
    Use Qemu 2.1 or later with usbredir, When I redirect a bulk usb-device from 
virt-viewer client,the bulk-usb-device driver or app in GuestVM will send 50 
bulk-urb per times.
    In VM, using the usblyzer to monitor the usb packet, it show these 50 
bulk-urb packet (24576 bytes per urb) send in 1ms, But in the QEMU VM log, It 
shows as below
  =
  2019-01-14T08:27:26.096809Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.105680Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.108219Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.116742Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.119242Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.129851Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.132349Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.141248Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.144932Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.154035Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  =
  
   It shows that the bulk packet is single thread send and recv, per bulk
  packet will use 10-20ms, all 50 bulk-packets will use 500~1000ms, so the
  in the VM, bulk-urb will timeout always!
  
    How to send the bulk packet by multithread to speedup the bulk-urb send and 
recv, for example:
  
   bulk-out ep 86 stream 0 len 49152 id 1
   bulk-out ep 86 stream 0 len 49152 id 2
   bulk-out ep 86 stream 0 len 49152 id 3
   bulk-out ep 86 stream 0 len 49152 id 4
   bulk-out ...
   bulk-out ep 86 stream 0 len 49152 id 50
  ...
   bulk-in status 0 ep 86 stream 0 len 49152 id 1
   bulk-in status 0 ep 86 stream 0 len 49152 id 2
   bulk-in status 0 ep 86 stream 0 len 49152 id 3
   bulk-in status 0 ep 86 stream 0 len 49152 id 4
-  bulk-out ...
+  bulk-in ...
   bulk-in status 0 ep 86 stream 0 len 49152 id 50
  

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1811653

Title:
  usbredir slow when multi bulk packet per second

Status in QEMU:
  New

Bug description:
  QEMU Ver: all version
  Client: virt-viewer with spice
  Guest VM: win7
  Bug description:
    Use Qemu 2.1 or later with usbredir, When I redirect a bulk usb-device from 
virt-viewer client,the bulk-usb-device driver or app in GuestVM will send 50 
bulk-urb per times.
    In VM, using the usblyzer to monitor the usb packet, it show these 50 
bulk-urb packet (24576 bytes per urb) send in 1ms, But in the QEMU VM log, It 
shows as below
  =
  2019-01-14T08:27:26.096809Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.105680Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.108219Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.116742Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.119242Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.129851Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.132349Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.141248Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.144932Z qemu-kvm: usb-redir: bulk-out ep 86 stream 0 len 
49152 id 2114122112 0x7f0ffa300b40
  2019-01-14T08:27:26.154035Z qemu-kvm: usb-redir: bulk-in status 0 ep 86 
stream 0 len 49152 id 2114122112 0x7f0ffa300b40
  =

   It shows that the bulk packet is single thread send and recv, per
  bulk packet will use 10-20ms, all 50 bulk-packets will use 500~1000ms,
  so the in the VM, bulk-urb will timeout always!

    How to send the bulk packet by multithread to speedup the bulk-urb send and 
recv, for example:
  
   bulk-out ep 86 stream 0 len 49152 id 1
   bulk-out ep 86 stream 0 len 49152 id 2
   bulk-out ep 86 stream 0 len 49152 id 3
   bulk-out ep 86 

[Qemu-devel] [PULL 26/44] virtio: split vhost scsi bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h | 19 
 hw/virtio/vhost-scsi-pci.c | 97 ++
 hw/virtio/virtio-pci.c | 61 
 hw/virtio/Makefile.objs|  1 +
 4 files changed, 98 insertions(+), 80 deletions(-)
 create mode 100644 hw/virtio/vhost-scsi-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index ce6c194f1c..b14d83a454 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -24,16 +24,11 @@
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
 
-#ifdef CONFIG_VHOST_SCSI
-#include "hw/virtio/vhost-scsi.h"
-#endif
-
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
 typedef struct VirtIOBlkPCI VirtIOBlkPCI;
 typedef struct VirtIOSCSIPCI VirtIOSCSIPCI;
 typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIONetPCI VirtIONetPCI;
-typedef struct VHostSCSIPCI VHostSCSIPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -204,20 +199,6 @@ struct VirtIOSCSIPCI {
 VirtIOSCSI vdev;
 };
 
-#ifdef CONFIG_VHOST_SCSI
-/*
- * vhost-scsi-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VHOST_SCSI_PCI "vhost-scsi-pci-base"
-#define VHOST_SCSI_PCI(obj) \
-OBJECT_CHECK(VHostSCSIPCI, (obj), TYPE_VHOST_SCSI_PCI)
-
-struct VHostSCSIPCI {
-VirtIOPCIProxy parent_obj;
-VHostSCSI vdev;
-};
-#endif
-
 /*
  * virtio-blk-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/vhost-scsi-pci.c b/hw/virtio/vhost-scsi-pci.c
new file mode 100644
index 00..523f7cb3ce
--- /dev/null
+++ b/hw/virtio/vhost-scsi-pci.c
@@ -0,0 +1,97 @@
+/*
+ * Vhost scsi PCI bindings
+ *
+ * Copyright IBM, Corp. 2011
+ *
+ * Authors:
+ *  Stefan Hajnoczi   
+ *
+ * Changes for QEMU mainline + tcm_vhost kernel upstream:
+ *  Nicholas Bellinger 
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+
+#include "standard-headers/linux/virtio_pci.h"
+#include "hw/virtio/vhost-scsi.h"
+#include "qapi/error.h"
+#include "virtio-pci.h"
+
+typedef struct VHostSCSIPCI VHostSCSIPCI;
+
+/*
+ * vhost-scsi-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VHOST_SCSI_PCI "vhost-scsi-pci-base"
+#define VHOST_SCSI_PCI(obj) \
+OBJECT_CHECK(VHostSCSIPCI, (obj), TYPE_VHOST_SCSI_PCI)
+
+struct VHostSCSIPCI {
+VirtIOPCIProxy parent_obj;
+VHostSCSI vdev;
+};
+
+static Property vhost_scsi_pci_properties[] = {
+DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
+   DEV_NVECTORS_UNSPECIFIED),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vhost_scsi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VHostSCSIPCI *dev = VHOST_SCSI_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
+
+if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
+vpci_dev->nvectors = vs->conf.num_queues + 3;
+}
+
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static void vhost_scsi_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+k->realize = vhost_scsi_pci_realize;
+set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+dc->props = vhost_scsi_pci_properties;
+pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
+pcidev_k->revision = 0x00;
+pcidev_k->class_id = PCI_CLASS_STORAGE_SCSI;
+}
+
+static void vhost_scsi_pci_instance_init(Object *obj)
+{
+VHostSCSIPCI *dev = VHOST_SCSI_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VHOST_SCSI);
+object_property_add_alias(obj, "bootindex", OBJECT(>vdev),
+  "bootindex", _abort);
+}
+
+static const VirtioPCIDeviceTypeInfo vhost_scsi_pci_info = {
+.base_name = TYPE_VHOST_SCSI_PCI,
+.generic_name  = "vhost-scsi-pci",
+.transitional_name = "vhost-scsi-pci-transitional",
+.non_transitional_name = "vhost-scsi-pci-non-transitional",
+.instance_size = sizeof(VHostSCSIPCI),
+.instance_init = vhost_scsi_pci_instance_init,
+.class_init= vhost_scsi_pci_class_init,
+};
+
+static void vhost_scsi_pci_register(void)
+{
+virtio_pci_types_register(_scsi_pci_info);
+}
+
+type_init(vhost_scsi_pci_register)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 13cb13274e..b2ed6b3942 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2130,64 +2130,6 @@ static const VirtioPCIDeviceTypeInfo 

[Qemu-devel] [PULL 08/44] tests: acpi: use AcpiSdtTable::aml in consistent way

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

Currently in the 1st case we store table body fetched from QEMU in
AcpiSdtTable::aml minus it's header but in the 2nd case when we
load reference aml from disk, it holds whole blob including header.
More over in the 1st case, we read header in separate AcpiSdtTable::header
structure and then jump over hoops to fixup tables and combine both.

Treat AcpiSdtTable::aml as whole table blob approach in both cases
and when fetching tables from QEMU, first get table length and then
fetch whole table into AcpiSdtTable::aml instead if doing it field
by field.

As result
 * AcpiSdtTable::aml is used in consistent manner
 * FADT fixups use offsets from spec instead of being shifted by
   header length
 * calculating checksums and dumping blobs becomes simpler

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/acpi-utils.h   |  6 ++--
 tests/bios-tables-test.c | 62 +++-
 2 files changed, 27 insertions(+), 41 deletions(-)

diff --git a/tests/acpi-utils.h b/tests/acpi-utils.h
index c5b0e12aa2..1b0e80d45c 100644
--- a/tests/acpi-utils.h
+++ b/tests/acpi-utils.h
@@ -18,8 +18,10 @@
 
 /* DSDT and SSDTs format */
 typedef struct {
-AcpiTableHeader header;
-gchar *aml;/* aml bytecode from guest */
+union {
+AcpiTableHeader *header;
+uint8_t *aml;/* aml bytecode from guest */
+};
 gsize aml_len;
 gchar *aml_file;
 gchar *asl;/* asl code generated from aml */
diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index d455b2abfc..3f20bbd24e 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -163,29 +163,23 @@ static void sanitize_fadt_ptrs(test_data *data)
 for (i = 0; i < data->tables->len; i++) {
 AcpiSdtTable *sdt = _array_index(data->tables, AcpiSdtTable, i);
 
-if (memcmp(>header.signature, "FACP", 4)) {
+if (memcmp(>header->signature, "FACP", 4)) {
 continue;
 }
 
 /* check original FADT checksum before sanitizing table */
-g_assert(!(uint8_t)(
-acpi_calc_checksum((uint8_t *)sdt, sizeof(AcpiTableHeader)) +
-acpi_calc_checksum((uint8_t *)sdt->aml, sdt->aml_len)
-));
+g_assert(!acpi_calc_checksum(sdt->aml, sdt->aml_len));
 
-/* sdt->aml field offset := spec offset - header size */
-memset(sdt->aml + 0, 0, 4); /* sanitize FIRMWARE_CTRL(36) ptr */
-memset(sdt->aml + 4, 0, 4); /* sanitize DSDT(40) ptr */
-if (sdt->header.revision >= 3) {
-memset(sdt->aml + 96, 0, 8); /* sanitize X_FIRMWARE_CTRL(132) ptr 
*/
-memset(sdt->aml + 104, 0, 8); /* sanitize X_DSDT(140) ptr */
+memset(sdt->aml + 36, 0, 4); /* sanitize FIRMWARE_CTRL ptr */
+memset(sdt->aml + 40, 0, 4); /* sanitize DSDT ptr */
+if (sdt->header->revision >= 3) {
+memset(sdt->aml + 132, 0, 8); /* sanitize X_FIRMWARE_CTRL ptr */
+memset(sdt->aml + 140, 0, 8); /* sanitize X_DSDT ptr */
 }
 
 /* update checksum */
-sdt->header.checksum = 0;
-sdt->header.checksum -=
-acpi_calc_checksum((uint8_t *)sdt, sizeof(AcpiTableHeader)) +
-acpi_calc_checksum((uint8_t *)sdt->aml, sdt->aml_len);
+sdt->header->checksum = 0;
+sdt->header->checksum -= acpi_calc_checksum(sdt->aml, sdt->aml_len);
 break;
 }
 }
@@ -212,30 +206,23 @@ static void test_acpi_facs_table(test_data *data)
  */
 static void fetch_table(QTestState *qts, AcpiSdtTable *sdt_table, uint32_t 
addr)
 {
-uint8_t checksum;
-
-memset(sdt_table, 0, sizeof(*sdt_table));
-ACPI_READ_TABLE_HEADER(qts, _table->header, addr);
-
-sdt_table->aml_len = le32_to_cpu(sdt_table->header.length)
- - sizeof(AcpiTableHeader);
+qtest_memread(qts, addr + 4 /* Length of ACPI table */,
+  _table->aml_len, 4);
+sdt_table->aml_len = le32_to_cpu(sdt_table->aml_len);
 sdt_table->aml = g_malloc0(sdt_table->aml_len);
-ACPI_READ_ARRAY_PTR(qts, sdt_table->aml, sdt_table->aml_len, addr);
+/* get whole table */
+qtest_memread(qts, addr, sdt_table->aml, sdt_table->aml_len);
 
-checksum = acpi_calc_checksum((uint8_t *)sdt_table,
-  sizeof(AcpiTableHeader)) +
-   acpi_calc_checksum((uint8_t *)sdt_table->aml,
-  sdt_table->aml_len);
-g_assert(!checksum);
+g_assert(!acpi_calc_checksum(sdt_table->aml, sdt_table->aml_len));
 }
 
 static void test_acpi_dsdt_table(test_data *data)
 {
-AcpiSdtTable dsdt_table;
+AcpiSdtTable dsdt_table = {};
 uint32_t addr = le32_to_cpu(data->dsdt_addr);
 
 fetch_table(data->qts, _table, addr);
-ACPI_ASSERT_CMP(dsdt_table.header.signature, "DSDT");
+ACPI_ASSERT_CMP(dsdt_table.header->signature, "DSDT");
 
 

[Qemu-devel] [PULL 03/44] hw/misc/ivshmem: Remove deprecated "ivshmem" legacy device

2019-01-14 Thread Michael S. Tsirkin
From: Thomas Huth 

It's been marked as deprecated in QEMU v2.6.0 already, so really nobody
should use the legacy "ivshmem" device anymore (but use ivshmem-plain or
ivshmem-doorbell instead). Time to remove the deprecated device now.

Belatedly also update a mention of the deprecated "ivshmem" in the file
docs/specs/ivshmem-spec.txt to "ivshmem-doorbell". Missed in commit
5400c02b90b ("ivshmem: Split ivshmem-plain, ivshmem-doorbell off ivshmem").

Signed-off-by: Thomas Huth 
Reviewed-by: Markus Armbruster 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 docs/specs/ivshmem-spec.txt |   8 +-
 hw/i386/pc_piix.c   |   1 -
 hw/misc/ivshmem.c   | 210 +---
 tests/ivshmem-test.c|  67 
 qemu-deprecated.texi|   5 -
 scripts/device-crash-test   |   1 -
 6 files changed, 34 insertions(+), 258 deletions(-)

diff --git a/docs/specs/ivshmem-spec.txt b/docs/specs/ivshmem-spec.txt
index a1f5499796..042f7eae22 100644
--- a/docs/specs/ivshmem-spec.txt
+++ b/docs/specs/ivshmem-spec.txt
@@ -17,12 +17,16 @@ get interrupted by its peers.
 
 There are two basic configurations:
 
-- Just shared memory: -device ivshmem-plain,memdev=HMB,...
+- Just shared memory:
+
+  -device ivshmem-plain,memdev=HMB,...
 
   This uses host memory backend HMB.  It should have option "share"
   set.
 
-- Shared memory plus interrupts: -device ivshmem,chardev=CHR,vectors=N,...
+- Shared memory plus interrupts:
+
+  -device ivshmem-doorbell,chardev=CHR,vectors=N,...
 
   An ivshmem server must already be running on the host.  The device
   connects to the server's UNIX domain socket via character device
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 5088e2f492..63c84e3827 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -715,7 +715,6 @@ static void pc_i440fx_1_2_machine_options(MachineClass *m)
 PC_CPU_MODEL_IDS("1.2.0")
 { "nec-usb-xhci", "msi", "off" },
 { "nec-usb-xhci", "msix", "off" },
-{ "ivshmem", "use64", "0" },
 { "qxl", "revision", "3" },
 { "qxl-vga", "revision", "3" },
 { "VGA", "mmio", "off" },
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 8213659602..c7b6bbc974 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -112,13 +112,6 @@ typedef struct IVShmemState {
 /* migration stuff */
 OnOffAuto master;
 Error *migration_blocker;
-
-/* legacy cruft */
-char *role;
-char *shmobj;
-char *sizearg;
-size_t legacy_size;
-uint32_t not_legacy_32bit;
 } IVShmemState;
 
 /* registers for the Inter-VM shared memory device */
@@ -529,17 +522,6 @@ static void process_msg_shmem(IVShmemState *s, int fd, 
Error **errp)
 
 size = buf.st_size;
 
-/* Legacy cruft */
-if (s->legacy_size != SIZE_MAX) {
-if (size < s->legacy_size) {
-error_setg(errp, "server sent only %zd bytes of shared memory",
-   (size_t)buf.st_size);
-close(fd);
-return;
-}
-size = s->legacy_size;
-}
-
 /* mmap the region and map into the BAR2 */
 memory_region_init_ram_from_fd(>server_bar2, OBJECT(s),
"ivshmem.bar2", size, true, fd, _err);
@@ -882,8 +864,6 @@ static void ivshmem_common_realize(PCIDevice *dev, Error 
**errp)
 IVShmemState *s = IVSHMEM_COMMON(dev);
 Error *err = NULL;
 uint8_t *pci_conf;
-uint8_t attr = PCI_BASE_ADDRESS_SPACE_MEMORY |
-PCI_BASE_ADDRESS_MEM_PREFETCH;
 Error *local_err = NULL;
 
 /* IRQFD requires MSI */
@@ -903,10 +883,6 @@ static void ivshmem_common_realize(PCIDevice *dev, Error 
**errp)
 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
  >ivshmem_mmio);
 
-if (s->not_legacy_32bit) {
-attr |= PCI_BASE_ADDRESS_MEM_TYPE_64;
-}
-
 if (s->hostmem != NULL) {
 IVSHMEM_DPRINTF("using hostmem\n");
 
@@ -964,7 +940,11 @@ static void ivshmem_common_realize(PCIDevice *dev, Error 
**errp)
 }
 
 vmstate_register_ram(s->ivshmem_bar2, DEVICE(s));
-pci_register_bar(PCI_DEVICE(s), 2, attr, s->ivshmem_bar2);
+pci_register_bar(PCI_DEVICE(s), 2,
+ PCI_BASE_ADDRESS_SPACE_MEMORY |
+ PCI_BASE_ADDRESS_MEM_PREFETCH |
+ PCI_BASE_ADDRESS_MEM_TYPE_64,
+ s->ivshmem_bar2);
 }
 
 static void ivshmem_exit(PCIDevice *dev)
@@ -1084,13 +1064,6 @@ static Property ivshmem_plain_properties[] = {
 DEFINE_PROP_END_OF_LIST(),
 };
 
-static void ivshmem_plain_init(Object *obj)
-{
-IVShmemState *s = IVSHMEM_PLAIN(obj);
-
-s->not_legacy_32bit = 1;
-}
-
 static void ivshmem_plain_realize(PCIDevice *dev, Error **errp)
 {
 IVShmemState *s = IVSHMEM_COMMON(dev);
@@ -1122,7 +1095,6 @@ static const TypeInfo ivshmem_plain_info = {
 .name  = TYPE_IVSHMEM_PLAIN,
 .parent= TYPE_IVSHMEM_COMMON,
 .instance_size = 

[Qemu-devel] [PULL 27/44] virtio: split virtio scsi bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Notice that we can't still run tests with it disabled.  Both cdrom-test and
drive_del-test use virtio-scsi without checking if it is enabled.

Reviewed-by: Thomas Huth 
Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h  |  14 -
 hw/virtio/virtio-pci.c  |  71 
 hw/virtio/virtio-scsi-pci.c | 107 
 hw/virtio/Makefile.objs |   1 +
 tests/Makefile.include  |   2 +-
 5 files changed, 109 insertions(+), 86 deletions(-)
 create mode 100644 hw/virtio/virtio-scsi-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index b14d83a454..d00f6d6b9d 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -19,14 +19,12 @@
 #include "hw/virtio/virtio-blk.h"
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-serial.h"
-#include "hw/virtio/virtio-scsi.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
 typedef struct VirtIOBlkPCI VirtIOBlkPCI;
-typedef struct VirtIOSCSIPCI VirtIOSCSIPCI;
 typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIONetPCI VirtIONetPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
@@ -187,18 +185,6 @@ static inline void 
virtio_pci_disable_modern(VirtIOPCIProxy *proxy)
 proxy->disable_modern = true;
 }
 
-/*
- * virtio-scsi-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_SCSI_PCI "virtio-scsi-pci-base"
-#define VIRTIO_SCSI_PCI(obj) \
-OBJECT_CHECK(VirtIOSCSIPCI, (obj), TYPE_VIRTIO_SCSI_PCI)
-
-struct VirtIOSCSIPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOSCSI vdev;
-};
-
 /*
  * virtio-blk-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index b2ed6b3942..da812b7844 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -22,7 +22,6 @@
 #include "hw/virtio/virtio-blk.h"
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-serial.h"
-#include "hw/virtio/virtio-scsi.h"
 #include "hw/pci/pci.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@@ -2061,75 +2060,6 @@ static const VirtioPCIDeviceTypeInfo virtio_blk_pci_info 
= {
 .class_init= virtio_blk_pci_class_init,
 };
 
-/* virtio-scsi-pci */
-
-static Property virtio_scsi_pci_properties[] = {
-DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
-VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
-DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
-   DEV_NVECTORS_UNSPECIFIED),
-DEFINE_PROP_END_OF_LIST(),
-};
-
-static void virtio_scsi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
-{
-VirtIOSCSIPCI *dev = VIRTIO_SCSI_PCI(vpci_dev);
-DeviceState *vdev = DEVICE(>vdev);
-VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
-DeviceState *proxy = DEVICE(vpci_dev);
-char *bus_name;
-
-if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
-vpci_dev->nvectors = vs->conf.num_queues + 3;
-}
-
-/*
- * For command line compatibility, this sets the virtio-scsi-device bus
- * name as before.
- */
-if (proxy->id) {
-bus_name = g_strdup_printf("%s.0", proxy->id);
-virtio_device_set_child_bus_name(VIRTIO_DEVICE(vdev), bus_name);
-g_free(bus_name);
-}
-
-qdev_set_parent_bus(vdev, BUS(_dev->bus));
-object_property_set_bool(OBJECT(vdev), true, "realized", errp);
-}
-
-static void virtio_scsi_pci_class_init(ObjectClass *klass, void *data)
-{
-DeviceClass *dc = DEVICE_CLASS(klass);
-VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
-PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
-
-k->realize = virtio_scsi_pci_realize;
-set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
-dc->props = virtio_scsi_pci_properties;
-pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
-pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
-pcidev_k->revision = 0x00;
-pcidev_k->class_id = PCI_CLASS_STORAGE_SCSI;
-}
-
-static void virtio_scsi_pci_instance_init(Object *obj)
-{
-VirtIOSCSIPCI *dev = VIRTIO_SCSI_PCI(obj);
-
-virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
-TYPE_VIRTIO_SCSI);
-}
-
-static const VirtioPCIDeviceTypeInfo virtio_scsi_pci_info = {
-.base_name  = TYPE_VIRTIO_SCSI_PCI,
-.generic_name   = "virtio-scsi-pci",
-.transitional_name  = "virtio-scsi-pci-transitional",
-.non_transitional_name  = "virtio-scsi-pci-non-transitional",
-.instance_size = sizeof(VirtIOSCSIPCI),
-.instance_init = virtio_scsi_pci_instance_init,
-.class_init= virtio_scsi_pci_class_init,
-};
-
 /* virtio-serial-pci */
 
 static void virtio_serial_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
@@ -2315,7 +2245,6 @@ static void 

[Qemu-devel] [PULL 11/44] tests: acpi: reuse fetch_table() for fetching FACS and DSDT

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

It allows to remove a bit more of code duplication and
reuse common utility to get ACPI tables from guest (modulo RSDP).

While at it, consolidate signature checking into fetch_table() instead
of open-codding it.

Considering FACS is special and doesn't have checksum, make checksum
validation optin, the same goes for signature verification.

PS:
By pure accident, patch also fixes FACS not being tested against
reference table since it wasn't added to data::tables list.
But we managed not to regress it since reference file was added
by commit
   (d25979380 acpi unit-test: add test files)
back in 2013

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/bios-tables-test.c | 78 
 1 file changed, 30 insertions(+), 48 deletions(-)

diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index 8082adce41..0f6dd844c5 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -28,9 +28,6 @@ typedef struct {
 const char *variant;
 uint32_t rsdp_addr;
 uint8_t rsdp_table[36 /* ACPI 2.0+ RSDP size */];
-uint32_t dsdt_addr;
-uint32_t facs_addr;
-AcpiFacsDescriptorRev1 facs_table;
 GArray *tables;
 uint32_t smbios_ep_addr;
 struct smbios_21_entry_point smbios_ep_table;
@@ -76,11 +73,18 @@ static void free_test_data(test_data *data)
 }
 
 /** fetch_table
- *   load ACPI table at @addr into table descriptor @sdt_table
- *   and check that header checksum matches actual one.
+ *   load ACPI table at @addr_ptr offset pointer into table descriptor
+ *   @sdt_table and check that signature/checksum matches actual one.
  */
-static void fetch_table(QTestState *qts, AcpiSdtTable *sdt_table, uint32_t 
addr)
+static void fetch_table(QTestState *qts, AcpiSdtTable *sdt_table,
+uint8_t *addr_ptr, const char *sig,
+bool verify_checksum)
 {
+uint32_t addr;
+
+memcpy(, addr_ptr , sizeof(addr));
+addr = le32_to_cpu(addr);
+
 qtest_memread(qts, addr + 4 /* Length of ACPI table */,
   _table->aml_len, 4);
 sdt_table->aml_len = le32_to_cpu(sdt_table->aml_len);
@@ -88,7 +92,12 @@ static void fetch_table(QTestState *qts, AcpiSdtTable 
*sdt_table, uint32_t addr)
 /* get whole table */
 qtest_memread(qts, addr, sdt_table->aml, sdt_table->aml_len);
 
-g_assert(!acpi_calc_checksum(sdt_table->aml, sdt_table->aml_len));
+if (sig) {
+ACPI_ASSERT_CMP(sdt_table->header->signature, sig);
+}
+if (verify_checksum) {
+g_assert(!acpi_calc_checksum(sdt_table->aml, sdt_table->aml_len));
+}
 }
 
 static void test_acpi_rsdp_address(test_data *data)
@@ -123,15 +132,13 @@ static void test_acpi_rsdp_table(test_data *data)
 
 static void test_acpi_rsdt_table(test_data *data)
 {
-uint32_t addr = acpi_get_rsdt_address(data->rsdp_table);
 const int entry_size = 4 /* 32-bit Entry size */;
 const int tables_off = 36 /* 1st Entry */;
 AcpiSdtTable rsdt = {};
 int i, table_len, table_nr;
-uint32_t *entry;
 
-fetch_table(data->qts, , addr);
-ACPI_ASSERT_CMP(rsdt.header->signature, "RSDT");
+fetch_table(data->qts, , >rsdp_table[16 /* RsdtAddress */],
+"RSDT", true);
 
 /* Load all tables and add to test list directly RSDT referenced tables */
 table_len = le32_to_cpu(rsdt.header->length);
@@ -139,9 +146,8 @@ static void test_acpi_rsdt_table(test_data *data)
 for (i = 0; i < table_nr; i++) {
 AcpiSdtTable ssdt_table = {};
 
-entry = (uint32_t *)(rsdt.aml + tables_off + i * entry_size);
-addr = le32_to_cpu(*entry);
-fetch_table(data->qts, _table, addr);
+fetch_table(data->qts, _table,
+rsdt.aml + tables_off + i * entry_size, NULL, true);
 
 /* Add table to ASL test tables list */
 g_array_append_val(data->tables, ssdt_table);
@@ -152,12 +158,18 @@ static void test_acpi_rsdt_table(test_data *data)
 static void test_acpi_fadt_table(test_data *data)
 {
 /* FADT table is 1st */
-AcpiSdtTable *fadt = _array_index(data->tables, typeof(*fadt), 0);
+AcpiSdtTable table = g_array_index(data->tables, typeof(table), 0);
+uint8_t *fadt_aml = table.aml;
 
-ACPI_ASSERT_CMP(fadt->header->signature, "FACP");
+ACPI_ASSERT_CMP(table.header->signature, "FACP");
 
-memcpy(>facs_addr, fadt->aml + 36 /* FIRMWARE_CTRL */, 4);
-memcpy(>dsdt_addr, fadt->aml + 40 /* DSDT */, 4);
+/* Since DSDT/FACS isn't in RSDT, add them to ASL test list manually */
+fetch_table(data->qts, , fadt_aml + 36 /* FIRMWARE_CTRL */,
+"FACS", false);
+g_array_append_val(data->tables, table);
+
+fetch_table(data->qts, , fadt_aml + 40 /* DSDT */, "DSDT", true);
+g_array_append_val(data->tables, table);
 }
 
 static void sanitize_fadt_ptrs(test_data *data)
@@ -189,34 +201,6 @@ static void 

[Qemu-devel] [PULL 10/44] tests: acpi: simplify rsdt handling

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

RSDT referenced tables always have length at offset 4 and checksum at
offset 9, that's enough for reusing fetch_table() and replacing custom
RSDT fetching code with it.
While at it
 * merge fetch_rsdt_referenced_tables() into test_acpi_rsdt_table()
 * drop test_data::rsdt_table/rsdt_tables_addr/rsdt_tables_nr since
   we need this data only for duration of test_acpi_rsdt_table() to
   fetch other tables and use locals instead.

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/bios-tables-test.c | 133 ---
 1 file changed, 53 insertions(+), 80 deletions(-)

diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index b2a40bbda3..8082adce41 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -28,12 +28,9 @@ typedef struct {
 const char *variant;
 uint32_t rsdp_addr;
 uint8_t rsdp_table[36 /* ACPI 2.0+ RSDP size */];
-AcpiRsdtDescriptorRev1 rsdt_table;
 uint32_t dsdt_addr;
 uint32_t facs_addr;
 AcpiFacsDescriptorRev1 facs_table;
-uint32_t *rsdt_tables_addr;
-int rsdt_tables_nr;
 GArray *tables;
 uint32_t smbios_ep_addr;
 struct smbios_21_entry_point smbios_ep_table;
@@ -50,33 +47,50 @@ static const char *iasl = stringify(CONFIG_IASL);
 static const char *iasl;
 #endif
 
+static void cleanup_table_descriptor(AcpiSdtTable *table)
+{
+g_free(table->aml);
+if (table->aml_file &&
+!table->tmp_files_retain &&
+g_strstr_len(table->aml_file, -1, "aml-")) {
+unlink(table->aml_file);
+}
+g_free(table->aml_file);
+g_free(table->asl);
+if (table->asl_file &&
+!table->tmp_files_retain) {
+unlink(table->asl_file);
+}
+g_free(table->asl_file);
+}
+
 static void free_test_data(test_data *data)
 {
-AcpiSdtTable *temp;
 int i;
 
-g_free(data->rsdt_tables_addr);
-
 for (i = 0; i < data->tables->len; ++i) {
-temp = _array_index(data->tables, AcpiSdtTable, i);
-g_free(temp->aml);
-if (temp->aml_file &&
-!temp->tmp_files_retain &&
-g_strstr_len(temp->aml_file, -1, "aml-")) {
-unlink(temp->aml_file);
-}
-g_free(temp->aml_file);
-g_free(temp->asl);
-if (temp->asl_file &&
-!temp->tmp_files_retain) {
-unlink(temp->asl_file);
-}
-g_free(temp->asl_file);
+cleanup_table_descriptor(_array_index(data->tables, AcpiSdtTable, 
i));
 }
 
 g_array_free(data->tables, true);
 }
 
+/** fetch_table
+ *   load ACPI table at @addr into table descriptor @sdt_table
+ *   and check that header checksum matches actual one.
+ */
+static void fetch_table(QTestState *qts, AcpiSdtTable *sdt_table, uint32_t 
addr)
+{
+qtest_memread(qts, addr + 4 /* Length of ACPI table */,
+  _table->aml_len, 4);
+sdt_table->aml_len = le32_to_cpu(sdt_table->aml_len);
+sdt_table->aml = g_malloc0(sdt_table->aml_len);
+/* get whole table */
+qtest_memread(qts, addr, sdt_table->aml, sdt_table->aml_len);
+
+g_assert(!acpi_calc_checksum(sdt_table->aml, sdt_table->aml_len));
+}
+
 static void test_acpi_rsdp_address(test_data *data)
 {
 uint32_t off = acpi_find_rsdp_address(data->qts);
@@ -109,36 +123,30 @@ static void test_acpi_rsdp_table(test_data *data)
 
 static void test_acpi_rsdt_table(test_data *data)
 {
-AcpiRsdtDescriptorRev1 *rsdt_table = >rsdt_table;
 uint32_t addr = acpi_get_rsdt_address(data->rsdp_table);
-uint32_t *tables;
-int tables_nr;
-uint8_t checksum;
-uint32_t rsdt_table_length;
+const int entry_size = 4 /* 32-bit Entry size */;
+const int tables_off = 36 /* 1st Entry */;
+AcpiSdtTable rsdt = {};
+int i, table_len, table_nr;
+uint32_t *entry;
 
-/* read the header */
-ACPI_READ_TABLE_HEADER(data->qts, rsdt_table, addr);
-ACPI_ASSERT_CMP(rsdt_table->signature, "RSDT");
+fetch_table(data->qts, , addr);
+ACPI_ASSERT_CMP(rsdt.header->signature, "RSDT");
 
-rsdt_table_length = le32_to_cpu(rsdt_table->length);
+/* Load all tables and add to test list directly RSDT referenced tables */
+table_len = le32_to_cpu(rsdt.header->length);
+table_nr = (table_len - tables_off) / entry_size;
+for (i = 0; i < table_nr; i++) {
+AcpiSdtTable ssdt_table = {};
 
-/* compute the table entries in rsdt */
-tables_nr = (rsdt_table_length - sizeof(AcpiRsdtDescriptorRev1)) /
-sizeof(uint32_t);
-g_assert(tables_nr > 0);
+entry = (uint32_t *)(rsdt.aml + tables_off + i * entry_size);
+addr = le32_to_cpu(*entry);
+fetch_table(data->qts, _table, addr);
 
-/* get the addresses of the tables pointed by rsdt */
-tables = g_new0(uint32_t, tables_nr);
-ACPI_READ_ARRAY_PTR(data->qts, tables, tables_nr, addr);
-
-checksum = acpi_calc_checksum((uint8_t 

[Qemu-devel] [PULL 19/44] virtio: split virtio input host bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

For consistency with other devices, rename
virtio_host_{initfn,pci_info} to virtio_input_host_{initfn,info}.

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 default-configs/virtio.mak|  1 +
 hw/virtio/virtio-pci.h| 14 -
 hw/virtio/virtio-input-host-pci.c | 48 +++
 hw/virtio/virtio-pci.c| 23 ---
 hw/virtio/Makefile.objs   |  1 +
 5 files changed, 50 insertions(+), 37 deletions(-)
 create mode 100644 hw/virtio/virtio-input-host-pci.c

diff --git a/default-configs/virtio.mak b/default-configs/virtio.mak
index 1304849018..5ae4a61018 100644
--- a/default-configs/virtio.mak
+++ b/default-configs/virtio.mak
@@ -12,3 +12,4 @@ CONFIG_VIRTIO_RNG=y
 CONFIG_SCSI=y
 CONFIG_VIRTIO_SCSI=y
 CONFIG_VIRTIO_SERIAL=y
+CONFIG_VIRTIO_INPUT_HOST=$(CONFIG_LINUX)
diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index 2109d002df..fb10afe160 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -50,7 +50,6 @@ typedef struct VHostUserBlkPCI VHostUserBlkPCI;
 typedef struct VirtIORngPCI VirtIORngPCI;
 typedef struct VirtIOInputPCI VirtIOInputPCI;
 typedef struct VirtIOInputHIDPCI VirtIOInputHIDPCI;
-typedef struct VirtIOInputHostPCI VirtIOInputHostPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -359,19 +358,6 @@ struct VirtIOInputHIDPCI {
 VirtIOInputHID vdev;
 };
 
-#ifdef CONFIG_LINUX
-
-#define TYPE_VIRTIO_INPUT_HOST_PCI "virtio-input-host-pci-base"
-#define VIRTIO_INPUT_HOST_PCI(obj) \
-OBJECT_CHECK(VirtIOInputHostPCI, (obj), TYPE_VIRTIO_INPUT_HOST_PCI)
-
-struct VirtIOInputHostPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOInputHost vdev;
-};
-
-#endif
-
 /*
  * virtio-gpu-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-input-host-pci.c 
b/hw/virtio/virtio-input-host-pci.c
new file mode 100644
index 00..725a51ad30
--- /dev/null
+++ b/hw/virtio/virtio-input-host-pci.c
@@ -0,0 +1,48 @@
+/*
+ * Virtio input host PCI Bindings
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * (at your option) any later version.  See the COPYING file in the
+ * top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "virtio-pci.h"
+#include "hw/virtio/virtio-input.h"
+
+typedef struct VirtIOInputHostPCI VirtIOInputHostPCI;
+
+#define TYPE_VIRTIO_INPUT_HOST_PCI "virtio-input-host-pci-base"
+#define VIRTIO_INPUT_HOST_PCI(obj) \
+OBJECT_CHECK(VirtIOInputHostPCI, (obj), TYPE_VIRTIO_INPUT_HOST_PCI)
+
+struct VirtIOInputHostPCI {
+VirtIOPCIProxy parent_obj;
+VirtIOInputHost vdev;
+};
+
+static void virtio_host_initfn(Object *obj)
+{
+VirtIOInputHostPCI *dev = VIRTIO_INPUT_HOST_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VIRTIO_INPUT_HOST);
+}
+
+static const VirtioPCIDeviceTypeInfo virtio_input_host_pci_info = {
+.base_name = TYPE_VIRTIO_INPUT_HOST_PCI,
+.generic_name  = "virtio-input-host-pci",
+.transitional_name = "virtio-input-host-pci-transitional",
+.non_transitional_name = "virtio-input-host-pci-non-transitional",
+.parent= TYPE_VIRTIO_INPUT_PCI,
+.instance_size = sizeof(VirtIOInputHostPCI),
+.instance_init = virtio_host_initfn,
+};
+
+static void virtio_input_host_pci_register(void)
+{
+virtio_pci_types_register(_input_host_pci_info);
+}
+
+type_init(virtio_input_host_pci_register)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 4312d95fe9..d951f278a2 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2707,26 +2707,6 @@ static const VirtioPCIDeviceTypeInfo 
virtio_tablet_pci_info = {
 .instance_init = virtio_tablet_initfn,
 };
 
-#ifdef CONFIG_LINUX
-static void virtio_host_initfn(Object *obj)
-{
-VirtIOInputHostPCI *dev = VIRTIO_INPUT_HOST_PCI(obj);
-
-virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
-TYPE_VIRTIO_INPUT_HOST);
-}
-
-static const VirtioPCIDeviceTypeInfo virtio_host_pci_info = {
-.base_name = TYPE_VIRTIO_INPUT_HOST_PCI,
-.generic_name  = "virtio-input-host-pci",
-.transitional_name = "virtio-input-host-pci-transitional",
-.non_transitional_name = "virtio-input-host-pci-non-transitional",
-.parent= TYPE_VIRTIO_INPUT_PCI,
-.instance_size = sizeof(VirtIOInputHostPCI),
-.instance_init = virtio_host_initfn,
-};
-#endif
-
 /* virtio-pci-bus */
 
 static void virtio_pci_bus_new(VirtioBusState *bus, size_t bus_size,
@@ -2785,9 +2765,6 @@ static void virtio_pci_register_types(void)
 virtio_pci_types_register(_keyboard_pci_info);
 virtio_pci_types_register(_mouse_pci_info);
 virtio_pci_types_register(_tablet_pci_info);
-#ifdef CONFIG_LINUX
-

[Qemu-devel] [PULL 00/44] pci, pc, virtio: fixes, features

2019-01-14 Thread Michael S. Tsirkin
The following changes since commit 89bd861c2b470e3fb45596945509079c72af3ac2:

  Merge remote-tracking branch 'remotes/ehabkost/tags/x86-next-pull-request' 
into staging (2019-01-14 17:35:00 +)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream

for you to fetch changes up to b421506a3ac2f1b2a4f18d6f423a92dfa16e2645:

  acpi: update expected files (2019-01-14 19:31:05 -0500)


pci, pc, virtio: fixes, features

tpm physical presence interface
rsc support in virtio net
ivshmem is removed
misc cleanups and fixes all over the place

Signed-off-by: Michael S. Tsirkin 


David Hildenbrand (1):
  pci/pcie: stop plug/unplug if the slot is locked

Dongli Zhang (1):
  msix: make pba size math more uniform

Eduardo Habkost (2):
  globals: Allow global properties to be optional
  virtio: Make disable-legacy/disable-modern compat properties optional

Fei Li (1):
  hw/misc/edu: add msi_uninit() for pci_edu_uninit()

Igor Mammedov (8):
  tests: acpi: use AcpiSdtTable::aml in consistent way
  tests: acpi: make sure FADT is fetched only once
  tests: acpi: simplify rsdt handling
  tests: acpi: reuse fetch_table() for fetching FACS and DSDT
  tests: acpi: reuse fetch_table() in vmgenid-test
  tests: smbios: fetch whole table in one step instead of reading it step 
by step
  tests: acpi: squash sanitize_fadt_ptrs() into test_acpi_fadt_table()
  tests: acpi: use AcpiSdtTable::aml instead of 
AcpiSdtTable::header::signature

Jian Wang (1):
  qemu: avoid memory leak while remove disk

Juan Quintela (16):
  virtio: split vhost vsock bits from virtio-pci
  virtio: split virtio input host bits from virtio-pci
  virtio: split virtio input bits from virtio-pci
  virtio: split virtio rng bits from virtio-pci
  virtio: split virtio balloon bits from virtio-pci
  virtio: split virtio 9p bits from virtio-pci
  virtio: split vhost user blk bits from virtio-pci
  virtio: split vhost user scsi bits from virtio-pci
  virtio: split vhost scsi bits from virtio-pci
  virtio: split virtio scsi bits from virtio-pci
  virtio: split virtio blk bits from virtio-pci
  virtio: split virtio net bits from virtio-pci
  virtio: split virtio serial bits from virtio-pci
  virtio: split virtio gpu bits from virtio-pci.h
  virtio: split virtio crypto bits from virtio-pci.h
  virtio: virtio 9p really requires CONFIG_VIRTFS to work

Li Qiang (3):
  tests: vhost-user-test: initialize 'fd' in chr_read
  vhost-user: fix ioeventfd_enabled
  util: check the return value of fcntl in qemu_set_{block, nonblock}

Marc-André Lureau (3):
  tpm: add a "ppi" boolean property
  acpi: add ACPI memory clear interface
  tpm: clear RAM when "memory overwrite" requested

Michael S. Tsirkin (1):
  acpi: update expected files

Stefan Berger (3):
  tpm: allocate/map buffer for TPM Physical Presence interface
  acpi: expose TPM/PPI configuration parameters to firmware via fw_cfg
  acpi: build TPM Physical Presence interface

Thomas Huth (1):
  hw/misc/ivshmem: Remove deprecated "ivshmem" legacy device

Yang Zhong (1):
  hw: acpi: Fix memory hotplug AML generation error

Yuri Benditovich (2):
  virtio-net: support RSC v4/v6 tcp traffic for Windows HCK
  virtio-net: changed VIRTIO_NET_F_RSC_EXT to be 61

 docs/specs/ivshmem-spec.txt   |   8 +-
 docs/specs/tpm.txt| 104 +
 default-configs/virtio.mak|   3 +-
 hw/tpm/tpm_ppi.h  |  46 +++
 hw/virtio/virtio-pci.h| 234 ---
 include/hw/acpi/tpm.h |  21 +
 include/hw/pci/pcie.h |   2 +
 include/hw/qdev-core.h|   3 +
 include/hw/virtio/virtio-net.h|  83 
 include/net/eth.h |   2 +
 tests/acpi-utils.h|  44 +--
 hw/acpi/memory_hotplug.c  |  10 +-
 hw/acpi/tpm.c | 459 +
 hw/block/vhost-user-blk.c |   7 +-
 hw/core/machine.c |   7 +-
 hw/display/virtio-gpu-pci.c   |  14 +
 hw/display/virtio-vga.c   |   1 +
 hw/i386/acpi-build.c  |  29 +-
 hw/i386/pc_piix.c |   1 -
 hw/misc/edu.c |   1 +
 hw/misc/ivshmem.c | 210 +-
 hw/net/virtio-net.c   | 667 ++-
 hw/pci/msix.c |   2 +-
 hw/pci/pcie.c |  25 +-
 hw/pci/pcie_port.c|   1 +
 hw/scsi/vhost-scsi.c  |   3 +-
 hw/scsi/vhost-user-scsi.c |   3 +-
 hw/tpm/tpm_crb.c  |  13 +
 hw/tpm/tpm_ppi.c  |  53 +++
 hw/tpm/tpm_tis.c  |  13 +
 hw/virtio/vhost-scsi-pci.c|  97 +
 

[Qemu-devel] [PULL 18/44] virtio: split vhost vsock bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h  | 18 
 hw/virtio/vhost-vsock-pci.c | 86 +
 hw/virtio/virtio-pci.c  | 53 ---
 hw/virtio/Makefile.objs |  3 ++
 4 files changed, 89 insertions(+), 71 deletions(-)
 create mode 100644 hw/virtio/vhost-vsock-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index 29b4216107..2109d002df 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -37,9 +37,6 @@
 #ifdef CONFIG_VHOST_SCSI
 #include "hw/virtio/vhost-scsi.h"
 #endif
-#ifdef CONFIG_VHOST_VSOCK
-#include "hw/virtio/vhost-vsock.h"
-#endif
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
 typedef struct VirtIOBlkPCI VirtIOBlkPCI;
@@ -55,7 +52,6 @@ typedef struct VirtIOInputPCI VirtIOInputPCI;
 typedef struct VirtIOInputHIDPCI VirtIOInputHIDPCI;
 typedef struct VirtIOInputHostPCI VirtIOInputHostPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
-typedef struct VHostVSockPCI VHostVSockPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
 /* virtio-pci-bus */
@@ -388,20 +384,6 @@ struct VirtIOGPUPCI {
 VirtIOGPU vdev;
 };
 
-#ifdef CONFIG_VHOST_VSOCK
-/*
- * vhost-vsock-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VHOST_VSOCK_PCI "vhost-vsock-pci-base"
-#define VHOST_VSOCK_PCI(obj) \
-OBJECT_CHECK(VHostVSockPCI, (obj), TYPE_VHOST_VSOCK_PCI)
-
-struct VHostVSockPCI {
-VirtIOPCIProxy parent_obj;
-VHostVSock vdev;
-};
-#endif
-
 /*
  * virtio-crypto-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/vhost-vsock-pci.c b/hw/virtio/vhost-vsock-pci.c
new file mode 100644
index 00..6f43ca35fb
--- /dev/null
+++ b/hw/virtio/vhost-vsock-pci.c
@@ -0,0 +1,86 @@
+/*
+ * Vhost vsock PCI Bindings
+ *
+ * Copyright 2015 Red Hat, Inc.
+ *
+ * Authors:
+ *  Stefan Hajnoczi 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * (at your option) any later version.  See the COPYING file in the
+ * top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "virtio-pci.h"
+#include "hw/virtio/vhost-vsock.h"
+
+typedef struct VHostVSockPCI VHostVSockPCI;
+
+/*
+ * vhost-vsock-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VHOST_VSOCK_PCI "vhost-vsock-pci-base"
+#define VHOST_VSOCK_PCI(obj) \
+OBJECT_CHECK(VHostVSockPCI, (obj), TYPE_VHOST_VSOCK_PCI)
+
+struct VHostVSockPCI {
+VirtIOPCIProxy parent_obj;
+VHostVSock vdev;
+};
+
+/* vhost-vsock-pci */
+
+static Property vhost_vsock_pci_properties[] = {
+DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 3),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vhost_vsock_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VHostVSockPCI *dev = VHOST_VSOCK_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static void vhost_vsock_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+k->realize = vhost_vsock_pci_realize;
+set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+dc->props = vhost_vsock_pci_properties;
+pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_VSOCK;
+pcidev_k->revision = 0x00;
+pcidev_k->class_id = PCI_CLASS_COMMUNICATION_OTHER;
+}
+
+static void vhost_vsock_pci_instance_init(Object *obj)
+{
+VHostVSockPCI *dev = VHOST_VSOCK_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VHOST_VSOCK);
+}
+
+static const VirtioPCIDeviceTypeInfo vhost_vsock_pci_info = {
+.base_name = TYPE_VHOST_VSOCK_PCI,
+.generic_name  = "vhost-vsock-pci",
+.transitional_name = "vhost-vsock-pci-transitional",
+.non_transitional_name = "vhost-vsock-pci-non-transitional",
+.instance_size = sizeof(VHostVSockPCI),
+.instance_init = vhost_vsock_pci_instance_init,
+.class_init= vhost_vsock_pci_class_init,
+};
+
+static void virtio_pci_vhost_register(void)
+{
+virtio_pci_types_register(_vsock_pci_info);
+}
+
+type_init(virtio_pci_vhost_register)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index d05066deb8..4312d95fe9 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2357,56 +2357,6 @@ static const VirtioPCIDeviceTypeInfo 
vhost_user_scsi_pci_info = {
 };
 #endif
 
-/* vhost-vsock-pci */
-
-#ifdef CONFIG_VHOST_VSOCK
-static Property vhost_vsock_pci_properties[] = {
-DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 3),
-DEFINE_PROP_END_OF_LIST(),
-};
-
-static void vhost_vsock_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
-{
-VHostVSockPCI 

[Qemu-devel] [PULL 14/44] tests: acpi: squash sanitize_fadt_ptrs() into test_acpi_fadt_table()

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

some parts of sanitize_fadt_ptrs() do redundant job
  - locating FADT
  - checking original checksum

There is no need to do it as test_acpi_fadt_table() already does that,
so drop duplicate code and move remaining fixup code into
test_acpi_fadt_table().

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/bios-tables-test.c | 39 ++-
 1 file changed, 10 insertions(+), 29 deletions(-)

diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index dcd6be8bbd..9139decc68 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -128,6 +128,7 @@ static void test_acpi_fadt_table(test_data *data)
 /* FADT table is 1st */
 AcpiSdtTable table = g_array_index(data->tables, typeof(table), 0);
 uint8_t *fadt_aml = table.aml;
+uint32_t fadt_len = table.aml_len;
 
 ACPI_ASSERT_CMP(table.header->signature, "FACP");
 
@@ -139,35 +140,17 @@ static void test_acpi_fadt_table(test_data *data)
 acpi_fetch_table(data->qts, , _len,
  fadt_aml + 40 /* DSDT */, "DSDT", true);
 g_array_append_val(data->tables, table);
-}
 
-static void sanitize_fadt_ptrs(test_data *data)
-{
-/* fixup pointers in FADT */
-int i;
-
-for (i = 0; i < data->tables->len; i++) {
-AcpiSdtTable *sdt = _array_index(data->tables, AcpiSdtTable, i);
-
-if (memcmp(>header->signature, "FACP", 4)) {
-continue;
-}
-
-/* check original FADT checksum before sanitizing table */
-g_assert(!acpi_calc_checksum(sdt->aml, sdt->aml_len));
-
-memset(sdt->aml + 36, 0, 4); /* sanitize FIRMWARE_CTRL ptr */
-memset(sdt->aml + 40, 0, 4); /* sanitize DSDT ptr */
-if (sdt->header->revision >= 3) {
-memset(sdt->aml + 132, 0, 8); /* sanitize X_FIRMWARE_CTRL ptr */
-memset(sdt->aml + 140, 0, 8); /* sanitize X_DSDT ptr */
-}
-
-/* update checksum */
-sdt->header->checksum = 0;
-sdt->header->checksum -= acpi_calc_checksum(sdt->aml, sdt->aml_len);
-break;
+memset(fadt_aml + 36, 0, 4); /* sanitize FIRMWARE_CTRL ptr */
+memset(fadt_aml + 40, 0, 4); /* sanitize DSDT ptr */
+if (fadt_aml[8 /* FADT Major Version */] >= 3) {
+memset(fadt_aml + 132, 0, 8); /* sanitize X_FIRMWARE_CTRL ptr */
+memset(fadt_aml + 140, 0, 8); /* sanitize X_DSDT ptr */
 }
+
+/* update checksum */
+fadt_aml[9 /* Checksum */] = 0;
+fadt_aml[9 /* Checksum */] -= acpi_calc_checksum(fadt_aml, fadt_len);
 }
 
 static void dump_aml_files(test_data *data, bool rebuild)
@@ -541,8 +524,6 @@ static void test_acpi_one(const char *params, test_data 
*data)
 test_acpi_rsdt_table(data);
 test_acpi_fadt_table(data);
 
-sanitize_fadt_ptrs(data);
-
 if (iasl) {
 if (getenv(ACPI_REBUILD_EXPECTED_AML)) {
 dump_aml_files(data, true);
-- 
MST




[Qemu-devel] [PULL 22/44] virtio: split virtio balloon bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Thomas Huth 
Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h | 14 -
 hw/virtio/virtio-balloon-pci.c | 95 ++
 hw/virtio/virtio-pci.c | 61 +-
 hw/virtio/Makefile.objs|  1 +
 tests/Makefile.include |  2 +-
 5 files changed, 98 insertions(+), 75 deletions(-)
 create mode 100644 hw/virtio/virtio-balloon-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index a8b2e491c8..a2988ef309 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -20,7 +20,6 @@
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-scsi.h"
-#include "hw/virtio/virtio-balloon.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
@@ -39,7 +38,6 @@
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
 typedef struct VirtIOBlkPCI VirtIOBlkPCI;
 typedef struct VirtIOSCSIPCI VirtIOSCSIPCI;
-typedef struct VirtIOBalloonPCI VirtIOBalloonPCI;
 typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIONetPCI VirtIONetPCI;
 typedef struct VHostSCSIPCI VHostSCSIPCI;
@@ -264,18 +262,6 @@ struct VirtIOBlkPCI {
 VirtIOBlock vdev;
 };
 
-/*
- * virtio-balloon-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_BALLOON_PCI "virtio-balloon-pci-base"
-#define VIRTIO_BALLOON_PCI(obj) \
-OBJECT_CHECK(VirtIOBalloonPCI, (obj), TYPE_VIRTIO_BALLOON_PCI)
-
-struct VirtIOBalloonPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOBalloon vdev;
-};
-
 /*
  * virtio-serial-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-balloon-pci.c b/hw/virtio/virtio-balloon-pci.c
new file mode 100644
index 00..2a213bbb38
--- /dev/null
+++ b/hw/virtio/virtio-balloon-pci.c
@@ -0,0 +1,95 @@
+/*
+ * Virtio balloon PCI Bindings
+ *
+ * Copyright IBM, Corp. 2007
+ * Copyright (c) 2009 CodeSourcery
+ *
+ * Authors:
+ *  Anthony Liguori   
+ *  Paul Brook
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+
+#include "virtio-pci.h"
+#include "hw/virtio/virtio-balloon.h"
+#include "qapi/error.h"
+
+typedef struct VirtIOBalloonPCI VirtIOBalloonPCI;
+
+/*
+ * virtio-balloon-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_BALLOON_PCI "virtio-balloon-pci-base"
+#define VIRTIO_BALLOON_PCI(obj) \
+OBJECT_CHECK(VirtIOBalloonPCI, (obj), TYPE_VIRTIO_BALLOON_PCI)
+
+struct VirtIOBalloonPCI {
+VirtIOPCIProxy parent_obj;
+VirtIOBalloon vdev;
+};
+static Property virtio_balloon_pci_properties[] = {
+DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void virtio_balloon_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VirtIOBalloonPCI *dev = VIRTIO_BALLOON_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+
+if (vpci_dev->class_code != PCI_CLASS_OTHERS &&
+vpci_dev->class_code != PCI_CLASS_MEMORY_RAM) { /* qemu < 1.1 */
+vpci_dev->class_code = PCI_CLASS_OTHERS;
+}
+
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static void virtio_balloon_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+k->realize = virtio_balloon_pci_realize;
+set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+dc->props = virtio_balloon_pci_properties;
+pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_BALLOON;
+pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
+pcidev_k->class_id = PCI_CLASS_OTHERS;
+}
+
+static void virtio_balloon_pci_instance_init(Object *obj)
+{
+VirtIOBalloonPCI *dev = VIRTIO_BALLOON_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VIRTIO_BALLOON);
+object_property_add_alias(obj, "guest-stats", OBJECT(>vdev),
+  "guest-stats", _abort);
+object_property_add_alias(obj, "guest-stats-polling-interval",
+  OBJECT(>vdev),
+  "guest-stats-polling-interval", _abort);
+}
+
+static const VirtioPCIDeviceTypeInfo virtio_balloon_pci_info = {
+.base_name = TYPE_VIRTIO_BALLOON_PCI,
+.generic_name  = "virtio-balloon-pci",
+.transitional_name = "virtio-balloon-pci-transitional",
+.non_transitional_name = "virtio-balloon-pci-non-transitional",
+.instance_size = sizeof(VirtIOBalloonPCI),
+.instance_init = virtio_balloon_pci_instance_init,
+.class_init= 

[Qemu-devel] [PULL 25/44] virtio: split vhost user scsi bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h  |  11 
 hw/virtio/vhost-user-scsi-pci.c | 103 
 hw/virtio/virtio-pci.c  |  60 ---
 hw/virtio/Makefile.objs |   1 +
 4 files changed, 104 insertions(+), 71 deletions(-)
 create mode 100644 hw/virtio/vhost-user-scsi-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index acbbe5c4e8..ce6c194f1c 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -23,7 +23,6 @@
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
-#include "hw/virtio/vhost-user-scsi.h"
 
 #ifdef CONFIG_VHOST_SCSI
 #include "hw/virtio/vhost-scsi.h"
@@ -35,7 +34,6 @@ typedef struct VirtIOSCSIPCI VirtIOSCSIPCI;
 typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIONetPCI VirtIONetPCI;
 typedef struct VHostSCSIPCI VHostSCSIPCI;
-typedef struct VHostUserSCSIPCI VHostUserSCSIPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -220,15 +218,6 @@ struct VHostSCSIPCI {
 };
 #endif
 
-#define TYPE_VHOST_USER_SCSI_PCI "vhost-user-scsi-pci-base"
-#define VHOST_USER_SCSI_PCI(obj) \
-OBJECT_CHECK(VHostUserSCSIPCI, (obj), TYPE_VHOST_USER_SCSI_PCI)
-
-struct VHostUserSCSIPCI {
-VirtIOPCIProxy parent_obj;
-VHostUserSCSI vdev;
-};
-
 /*
  * virtio-blk-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/vhost-user-scsi-pci.c b/hw/virtio/vhost-user-scsi-pci.c
new file mode 100644
index 00..46f7193cc7
--- /dev/null
+++ b/hw/virtio/vhost-user-scsi-pci.c
@@ -0,0 +1,103 @@
+/*
+ * Vhost user scsi PCI Bindings
+ *
+ * Copyright (c) 2016 Nutanix Inc. All rights reserved.
+ *
+ * Author:
+ *  Felipe Franciosi 
+ *
+ * This work is largely based on the "vhost-scsi" implementation by:
+ *  Stefan Hajnoczi
+ *  Nicholas Bellinger 
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+
+#include "standard-headers/linux/virtio_pci.h"
+#include "hw/virtio/vhost-user-scsi.h"
+#include "hw/virtio/virtio.h"
+#include "hw/virtio/virtio-scsi.h"
+#include "hw/pci/pci.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "hw/pci/msi.h"
+#include "hw/pci/msix.h"
+#include "hw/loader.h"
+#include "sysemu/kvm.h"
+#include "virtio-pci.h"
+
+typedef struct VHostUserSCSIPCI VHostUserSCSIPCI;
+
+#define TYPE_VHOST_USER_SCSI_PCI "vhost-user-scsi-pci-base"
+#define VHOST_USER_SCSI_PCI(obj) \
+OBJECT_CHECK(VHostUserSCSIPCI, (obj), TYPE_VHOST_USER_SCSI_PCI)
+
+struct VHostUserSCSIPCI {
+VirtIOPCIProxy parent_obj;
+VHostUserSCSI vdev;
+};
+
+static Property vhost_user_scsi_pci_properties[] = {
+DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
+   DEV_NVECTORS_UNSPECIFIED),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vhost_user_scsi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VHostUserSCSIPCI *dev = VHOST_USER_SCSI_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
+
+if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
+vpci_dev->nvectors = vs->conf.num_queues + 3;
+}
+
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static void vhost_user_scsi_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+k->realize = vhost_user_scsi_pci_realize;
+set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+dc->props = vhost_user_scsi_pci_properties;
+pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
+pcidev_k->revision = 0x00;
+pcidev_k->class_id = PCI_CLASS_STORAGE_SCSI;
+}
+
+static void vhost_user_scsi_pci_instance_init(Object *obj)
+{
+VHostUserSCSIPCI *dev = VHOST_USER_SCSI_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VHOST_USER_SCSI);
+object_property_add_alias(obj, "bootindex", OBJECT(>vdev),
+  "bootindex", _abort);
+}
+
+static const VirtioPCIDeviceTypeInfo vhost_user_scsi_pci_info = {
+.base_name = TYPE_VHOST_USER_SCSI_PCI,
+.generic_name  = "vhost-user-scsi-pci",
+.transitional_name = "vhost-user-scsi-pci-transitional",
+.non_transitional_name = "vhost-user-scsi-pci-non-transitional",
+.instance_size = sizeof(VHostUserSCSIPCI),
+.instance_init = vhost_user_scsi_pci_instance_init,
+.class_init= vhost_user_scsi_pci_class_init,

[Qemu-devel] [PULL 01/44] pci/pcie: stop plug/unplug if the slot is locked

2019-01-14 Thread Michael S. Tsirkin
From: David Hildenbrand 

We better stop right away. For now, errors would be partially ignored
(so the guest might get informed or the device might get unplugged),
although actual plug/unplug will be reported as failed to the user.

While at it, properly move the check to the pre_plug handler for the plug
case, as we can test the slot state before the device will be realized.

Reviewed-by: Igor Mammedov 
Reviewed-by: David Gibson 
Signed-off-by: David Hildenbrand 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 include/hw/pci/pcie.h |  2 ++
 hw/pci/pcie.c | 25 +
 hw/pci/pcie_port.c|  1 +
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index cd318646a2..5b82a0d244 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -132,6 +132,8 @@ void pcie_ari_init(PCIDevice *dev, uint16_t offset, 
uint16_t nextfn);
 void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num);
 void pcie_ats_init(PCIDevice *dev, uint16_t offset);
 
+void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
+   Error **errp);
 void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
Error **errp);
 void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 2d3d8a047b..230478faab 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -391,10 +391,10 @@ static void pcie_cap_slot_event(PCIDevice *dev, 
PCIExpressHotPlugEvent event)
 }
 
 static void pcie_cap_slot_plug_common(PCIDevice *hotplug_dev, DeviceState *dev,
-  uint8_t **exp_cap, Error **errp)
+  Error **errp)
 {
-*exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
-uint16_t sltsta = pci_get_word(*exp_cap + PCI_EXP_SLTSTA);
+uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
+uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
 
 PCIE_DEV_PRINTF(PCI_DEVICE(dev), "hotplug state: 0x%x\n", sltsta);
 if (sltsta & PCI_EXP_SLTSTA_EIS) {
@@ -405,14 +405,19 @@ static void pcie_cap_slot_plug_common(PCIDevice 
*hotplug_dev, DeviceState *dev,
 }
 }
 
+void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
+   Error **errp)
+{
+pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, errp);
+}
+
 void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
Error **errp)
 {
-uint8_t *exp_cap;
+PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
+uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
 PCIDevice *pci_dev = PCI_DEVICE(dev);
 
-pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, _cap, errp);
-
 /* Don't send event when device is enabled during qemu machine creation:
  * it is present on boot, no hotplug event is necessary. We do send an
  * event when the device is disabled later. */
@@ -458,11 +463,15 @@ static void pcie_unplug_device(PCIBus *bus, PCIDevice 
*dev, void *opaque)
 void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
  DeviceState *dev, Error **errp)
 {
-uint8_t *exp_cap;
+Error *local_err = NULL;
 PCIDevice *pci_dev = PCI_DEVICE(dev);
 PCIBus *bus = pci_get_bus(pci_dev);
 
-pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, _cap, errp);
+pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, _err);
+if (local_err) {
+error_propagate(errp, local_err);
+return;
+}
 
 /* In case user cancel the operation of multi-function hot-add,
  * remove the function that is unexposed to guest individually,
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index bc07abc31b..a30291ef54 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -154,6 +154,7 @@ static void pcie_slot_class_init(ObjectClass *oc, void 
*data)
 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 
 dc->props = pcie_slot_props;
+hc->pre_plug = pcie_cap_slot_pre_plug_cb;
 hc->plug = pcie_cap_slot_plug_cb;
 hc->unplug = pcie_cap_slot_unplug_cb;
 hc->unplug_request = pcie_cap_slot_unplug_request_cb;
-- 
MST




[Qemu-devel] [PULL 24/44] virtio: split vhost user blk bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Thomas Huth 
Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h |  18 --
 hw/virtio/vhost-user-blk-pci.c | 103 +
 hw/virtio/virtio-pci.c |  62 
 hw/virtio/Makefile.objs|   1 +
 4 files changed, 104 insertions(+), 80 deletions(-)
 create mode 100644 hw/virtio/vhost-user-blk-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index 94af08410a..acbbe5c4e8 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -24,9 +24,6 @@
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
 #include "hw/virtio/vhost-user-scsi.h"
-#if defined(CONFIG_VHOST_USER) && defined(CONFIG_LINUX)
-#include "hw/virtio/vhost-user-blk.h"
-#endif
 
 #ifdef CONFIG_VHOST_SCSI
 #include "hw/virtio/vhost-scsi.h"
@@ -39,7 +36,6 @@ typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIONetPCI VirtIONetPCI;
 typedef struct VHostSCSIPCI VHostSCSIPCI;
 typedef struct VHostUserSCSIPCI VHostUserSCSIPCI;
-typedef struct VHostUserBlkPCI VHostUserBlkPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -233,20 +229,6 @@ struct VHostUserSCSIPCI {
 VHostUserSCSI vdev;
 };
 
-#if defined(CONFIG_VHOST_USER) && defined(CONFIG_LINUX)
-/*
- * vhost-user-blk-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VHOST_USER_BLK_PCI "vhost-user-blk-pci-base"
-#define VHOST_USER_BLK_PCI(obj) \
-OBJECT_CHECK(VHostUserBlkPCI, (obj), TYPE_VHOST_USER_BLK_PCI)
-
-struct VHostUserBlkPCI {
-VirtIOPCIProxy parent_obj;
-VHostUserBlk vdev;
-};
-#endif
-
 /*
  * virtio-blk-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/vhost-user-blk-pci.c b/hw/virtio/vhost-user-blk-pci.c
new file mode 100644
index 00..ca66c217a7
--- /dev/null
+++ b/hw/virtio/vhost-user-blk-pci.c
@@ -0,0 +1,103 @@
+/*
+ * Vhost user blk PCI Bindings
+ *
+ * Copyright(C) 2017 Intel Corporation.
+ *
+ * Authors:
+ *  Changpeng Liu 
+ *
+ * Largely based on the "vhost-user-scsi.c" and "vhost-scsi.c" implemented by:
+ * Felipe Franciosi 
+ * Stefan Hajnoczi 
+ * Nicholas Bellinger 
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+
+#include "standard-headers/linux/virtio_pci.h"
+#include "hw/virtio/virtio.h"
+#include "hw/virtio/vhost-user-blk.h"
+#include "hw/pci/pci.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "virtio-pci.h"
+
+typedef struct VHostUserBlkPCI VHostUserBlkPCI;
+
+/*
+ * vhost-user-blk-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VHOST_USER_BLK_PCI "vhost-user-blk-pci-base"
+#define VHOST_USER_BLK_PCI(obj) \
+OBJECT_CHECK(VHostUserBlkPCI, (obj), TYPE_VHOST_USER_BLK_PCI)
+
+struct VHostUserBlkPCI {
+VirtIOPCIProxy parent_obj;
+VHostUserBlk vdev;
+};
+
+static Property vhost_user_blk_pci_properties[] = {
+DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),
+DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
+   DEV_NVECTORS_UNSPECIFIED),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vhost_user_blk_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VHostUserBlkPCI *dev = VHOST_USER_BLK_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+
+if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
+vpci_dev->nvectors = dev->vdev.num_queues + 1;
+}
+
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static void vhost_user_blk_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+
+set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+dc->props = vhost_user_blk_pci_properties;
+k->realize = vhost_user_blk_pci_realize;
+pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_BLOCK;
+pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
+pcidev_k->class_id = PCI_CLASS_STORAGE_SCSI;
+}
+
+static void vhost_user_blk_pci_instance_init(Object *obj)
+{
+VHostUserBlkPCI *dev = VHOST_USER_BLK_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VHOST_USER_BLK);
+object_property_add_alias(obj, "bootindex", OBJECT(>vdev),
+  "bootindex", _abort);
+}
+
+static const VirtioPCIDeviceTypeInfo vhost_user_blk_pci_info = {
+.base_name   = TYPE_VHOST_USER_BLK_PCI,
+.generic_name= "vhost-user-blk-pci",
+.transitional_name   = "vhost-user-blk-pci-transitional",
+.non_transitional_name   = 

[Qemu-devel] [PULL 21/44] virtio: split virtio rng bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h | 14 --
 hw/virtio/virtio-pci.c | 54 ---
 hw/virtio/virtio-rng-pci.c | 88 ++
 hw/virtio/Makefile.objs|  1 +
 tests/Makefile.include |  2 +-
 5 files changed, 90 insertions(+), 69 deletions(-)
 create mode 100644 hw/virtio/virtio-rng-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index f1c75b0a89..a8b2e491c8 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -18,7 +18,6 @@
 #include "hw/pci/msi.h"
 #include "hw/virtio/virtio-blk.h"
 #include "hw/virtio/virtio-net.h"
-#include "hw/virtio/virtio-rng.h"
 #include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-scsi.h"
 #include "hw/virtio/virtio-balloon.h"
@@ -46,7 +45,6 @@ typedef struct VirtIONetPCI VirtIONetPCI;
 typedef struct VHostSCSIPCI VHostSCSIPCI;
 typedef struct VHostUserSCSIPCI VHostUserSCSIPCI;
 typedef struct VHostUserBlkPCI VHostUserBlkPCI;
-typedef struct VirtIORngPCI VirtIORngPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -319,18 +317,6 @@ typedef struct V9fsPCIState {
 
 #endif
 
-/*
- * virtio-rng-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_RNG_PCI "virtio-rng-pci-base"
-#define VIRTIO_RNG_PCI(obj) \
-OBJECT_CHECK(VirtIORngPCI, (obj), TYPE_VIRTIO_RNG_PCI)
-
-struct VirtIORngPCI {
-VirtIOPCIProxy parent_obj;
-VirtIORNG vdev;
-};
-
 /*
  * virtio-input-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 185db53bc0..2e3eafd8b2 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2546,59 +2546,6 @@ static const VirtioPCIDeviceTypeInfo virtio_net_pci_info 
= {
 .class_init= virtio_net_pci_class_init,
 };
 
-/* virtio-rng-pci */
-
-static void virtio_rng_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
-{
-VirtIORngPCI *vrng = VIRTIO_RNG_PCI(vpci_dev);
-DeviceState *vdev = DEVICE(>vdev);
-Error *err = NULL;
-
-qdev_set_parent_bus(vdev, BUS(_dev->bus));
-object_property_set_bool(OBJECT(vdev), true, "realized", );
-if (err) {
-error_propagate(errp, err);
-return;
-}
-
-object_property_set_link(OBJECT(vrng),
- OBJECT(vrng->vdev.conf.rng), "rng",
- NULL);
-}
-
-static void virtio_rng_pci_class_init(ObjectClass *klass, void *data)
-{
-DeviceClass *dc = DEVICE_CLASS(klass);
-VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
-PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
-
-k->realize = virtio_rng_pci_realize;
-set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-
-pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
-pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_RNG;
-pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
-pcidev_k->class_id = PCI_CLASS_OTHERS;
-}
-
-static void virtio_rng_initfn(Object *obj)
-{
-VirtIORngPCI *dev = VIRTIO_RNG_PCI(obj);
-
-virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
-TYPE_VIRTIO_RNG);
-}
-
-static const VirtioPCIDeviceTypeInfo virtio_rng_pci_info = {
-.base_name = TYPE_VIRTIO_RNG_PCI,
-.generic_name  = "virtio-rng-pci",
-.transitional_name = "virtio-rng-pci-transitional",
-.non_transitional_name = "virtio-rng-pci-non-transitional",
-.instance_size = sizeof(VirtIORngPCI),
-.instance_init = virtio_rng_initfn,
-.class_init= virtio_rng_pci_class_init,
-};
-
 /* virtio-pci-bus */
 
 static void virtio_pci_bus_new(VirtioBusState *bus, size_t bus_size,
@@ -2651,7 +2598,6 @@ static void virtio_pci_register_types(void)
 type_register_static(_pci_info);
 
 /* Implementations: */
-virtio_pci_types_register(_rng_pci_info);
 #ifdef CONFIG_VIRTFS
 virtio_pci_types_register(_9p_pci_info);
 #endif
diff --git a/hw/virtio/virtio-rng-pci.c b/hw/virtio/virtio-rng-pci.c
new file mode 100644
index 00..6cc6374289
--- /dev/null
+++ b/hw/virtio/virtio-rng-pci.c
@@ -0,0 +1,88 @@
+/*
+ * Virtio rng PCI Bindings
+ *
+ * Copyright 2012 Red Hat, Inc.
+ * Copyright 2012 Amit Shah 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * (at your option) any later version.  See the COPYING file in the
+ * top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "virtio-pci.h"
+#include "hw/virtio/virtio-rng.h"
+#include "qapi/error.h"
+
+typedef struct VirtIORngPCI VirtIORngPCI;
+
+/*
+ * virtio-rng-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_RNG_PCI "virtio-rng-pci-base"
+#define VIRTIO_RNG_PCI(obj) \
+OBJECT_CHECK(VirtIORngPCI, (obj), TYPE_VIRTIO_RNG_PCI)
+
+struct VirtIORngPCI {
+VirtIOPCIProxy parent_obj;
+VirtIORNG vdev;
+};
+
+static void 

[Qemu-devel] [PULL 35/44] virtio: Make disable-legacy/disable-modern compat properties optional

2019-01-14 Thread Michael S. Tsirkin
From: Eduardo Habkost 

The disable-legacy and disable-modern properties apply only to
some virtio-pci devices.  Make those properties optional.

This fixes the crash introduced by commit f6e501a28ef9 ("virtio: Provide
version-specific variants of virtio PCI devices"):

  $ qemu-system-x86_64 -machine pc-i440fx-2.6 \
-device virtio-net-pci-non-transitional
  Unexpected error in object_property_find() at qom/object.c:1092:
  qemu-system-x86_64: -device virtio-net-pci-non-transitional: can't apply \
  global virtio-pci.disable-modern=on: Property '.disable-modern' not found
  Aborted (core dumped)

Reported-by: Thomas Huth 
Fixes: f6e501a28ef9 ("virtio: Provide version-specific variants of virtio PCI 
devices")
Signed-off-by: Eduardo Habkost 
Reviewed-by: Cornelia Huck 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/core/machine.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 95dc7c3913..f0c0ae6be8 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -91,8 +91,9 @@ const size_t hw_compat_2_7_len = G_N_ELEMENTS(hw_compat_2_7);
 
 GlobalProperty hw_compat_2_6[] = {
 { "virtio-mmio", "format_transport_address", "off" },
-{ "virtio-pci", "disable-modern", "on" },
-{ "virtio-pci", "disable-legacy", "off" },
+/* Optional because not all virtio-pci devices support legacy mode */
+{ "virtio-pci", "disable-modern", "on",  .optional = true },
+{ "virtio-pci", "disable-legacy", "off", .optional = true },
 };
 const size_t hw_compat_2_6_len = G_N_ELEMENTS(hw_compat_2_6);
 
-- 
MST




[Qemu-devel] [PULL 04/44] qemu: avoid memory leak while remove disk

2019-01-14 Thread Michael S. Tsirkin
From: Jian Wang 

Memset vhost_dev to zero in the vhost_dev_cleanup function.
This causes dev.vqs to be NULL, so that
vqs does not free up space when calling the g_free function.
This will result in a memory leak. But you can't release vqs
directly in the vhost_dev_cleanup function, because vhost_net
will also call this function, and vhost_net's vqs is assigned by array.
In order to solve this problem, we first save the pointer of vqs,
and release the space of vqs after vhost_dev_cleanup is called.

Signed-off-by: Jian Wang 
Reviewed-by: Stefan Hajnoczi 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/block/vhost-user-blk.c | 7 +--
 hw/scsi/vhost-scsi.c  | 3 ++-
 hw/scsi/vhost-user-scsi.c | 3 ++-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 1451940845..c3af28fad4 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -250,6 +250,7 @@ static void vhost_user_blk_device_realize(DeviceState *dev, 
Error **errp)
 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 VHostUserBlk *s = VHOST_USER_BLK(vdev);
 VhostUserState *user;
+struct vhost_virtqueue *vqs = NULL;
 int i, ret;
 
 if (!s->chardev.chr) {
@@ -288,6 +289,7 @@ static void vhost_user_blk_device_realize(DeviceState *dev, 
Error **errp)
 s->dev.vqs = g_new(struct vhost_virtqueue, s->dev.nvqs);
 s->dev.vq_index = 0;
 s->dev.backend_features = 0;
+vqs = s->dev.vqs;
 
 vhost_dev_set_config_notifier(>dev, _ops);
 
@@ -314,7 +316,7 @@ static void vhost_user_blk_device_realize(DeviceState *dev, 
Error **errp)
 vhost_err:
 vhost_dev_cleanup(>dev);
 virtio_err:
-g_free(s->dev.vqs);
+g_free(vqs);
 virtio_cleanup(vdev);
 
 vhost_user_cleanup(user);
@@ -326,10 +328,11 @@ static void vhost_user_blk_device_unrealize(DeviceState 
*dev, Error **errp)
 {
 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 VHostUserBlk *s = VHOST_USER_BLK(dev);
+struct vhost_virtqueue *vqs = s->dev.vqs;
 
 vhost_user_blk_set_status(vdev, 0);
 vhost_dev_cleanup(>dev);
-g_free(s->dev.vqs);
+g_free(vqs);
 virtio_cleanup(vdev);
 
 if (s->vhost_user) {
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 7f21b4f9d6..61e2e57da9 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -215,6 +215,7 @@ static void vhost_scsi_unrealize(DeviceState *dev, Error 
**errp)
 {
 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 VHostSCSICommon *vsc = VHOST_SCSI_COMMON(dev);
+struct vhost_virtqueue *vqs = vsc->dev.vqs;
 
 migrate_del_blocker(vsc->migration_blocker);
 error_free(vsc->migration_blocker);
@@ -223,7 +224,7 @@ static void vhost_scsi_unrealize(DeviceState *dev, Error 
**errp)
 vhost_scsi_set_status(vdev, 0);
 
 vhost_dev_cleanup(>dev);
-g_free(vsc->dev.vqs);
+g_free(vqs);
 
 virtio_scsi_common_unrealize(dev, errp);
 }
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c
index 2e1ba4a87b..6728878a52 100644
--- a/hw/scsi/vhost-user-scsi.c
+++ b/hw/scsi/vhost-user-scsi.c
@@ -121,12 +121,13 @@ static void vhost_user_scsi_unrealize(DeviceState *dev, 
Error **errp)
 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 VHostUserSCSI *s = VHOST_USER_SCSI(dev);
 VHostSCSICommon *vsc = VHOST_SCSI_COMMON(s);
+struct vhost_virtqueue *vqs = vsc->dev.vqs;
 
 /* This will stop the vhost backend. */
 vhost_user_scsi_set_status(vdev, 0);
 
 vhost_dev_cleanup(>dev);
-g_free(vsc->dev.vqs);
+g_free(vqs);
 
 virtio_scsi_common_unrealize(dev, errp);
 
-- 
MST




[Qemu-devel] [PULL 23/44] virtio: split virtio 9p bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Acked-by: Greg Kurz 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h| 20 -
 hw/virtio/virtio-9p-pci.c | 88 +++
 hw/virtio/virtio-pci.c| 54 
 hw/virtio/Makefile.objs   |  1 +
 tests/Makefile.include|  2 +-
 5 files changed, 90 insertions(+), 75 deletions(-)
 create mode 100644 hw/virtio/virtio-9p-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index a2988ef309..94af08410a 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -28,9 +28,6 @@
 #include "hw/virtio/vhost-user-blk.h"
 #endif
 
-#ifdef CONFIG_VIRTFS
-#include "hw/9pfs/virtio-9p.h"
-#endif
 #ifdef CONFIG_VHOST_SCSI
 #include "hw/virtio/vhost-scsi.h"
 #endif
@@ -286,23 +283,6 @@ struct VirtIONetPCI {
 VirtIONet vdev;
 };
 
-/*
- * virtio-9p-pci: This extends VirtioPCIProxy.
- */
-
-#ifdef CONFIG_VIRTFS
-
-#define TYPE_VIRTIO_9P_PCI "virtio-9p-pci-base"
-#define VIRTIO_9P_PCI(obj) \
-OBJECT_CHECK(V9fsPCIState, (obj), TYPE_VIRTIO_9P_PCI)
-
-typedef struct V9fsPCIState {
-VirtIOPCIProxy parent_obj;
-V9fsVirtioState vdev;
-} V9fsPCIState;
-
-#endif
-
 /*
  * virtio-input-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-9p-pci.c b/hw/virtio/virtio-9p-pci.c
new file mode 100644
index 00..7bf1130966
--- /dev/null
+++ b/hw/virtio/virtio-9p-pci.c
@@ -0,0 +1,88 @@
+/*
+ * Virtio 9p PCI Bindings
+ *
+ * Copyright IBM, Corp. 2010
+ *
+ * Authors:
+ *  Anthony Liguori   
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+
+#include "virtio-pci.h"
+#include "hw/9pfs/virtio-9p.h"
+
+/*
+ * virtio-9p-pci: This extends VirtioPCIProxy.
+ */
+
+#define TYPE_VIRTIO_9P_PCI "virtio-9p-pci-base"
+#define VIRTIO_9P_PCI(obj) \
+OBJECT_CHECK(V9fsPCIState, (obj), TYPE_VIRTIO_9P_PCI)
+
+typedef struct V9fsPCIState {
+VirtIOPCIProxy parent_obj;
+V9fsVirtioState vdev;
+} V9fsPCIState;
+
+static void virtio_9p_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+V9fsPCIState *dev = VIRTIO_9P_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static Property virtio_9p_pci_properties[] = {
+DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
+VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
+DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void virtio_9p_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+
+k->realize = virtio_9p_pci_realize;
+pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_9P;
+pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
+pcidev_k->class_id = 0x2;
+set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+dc->props = virtio_9p_pci_properties;
+}
+
+static void virtio_9p_pci_instance_init(Object *obj)
+{
+V9fsPCIState *dev = VIRTIO_9P_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VIRTIO_9P);
+}
+
+static const VirtioPCIDeviceTypeInfo virtio_9p_pci_info = {
+.base_name  = TYPE_VIRTIO_9P_PCI,
+.generic_name   = "virtio-9p-pci",
+.transitional_name  = "virtio-9p-pci-transitional",
+.non_transitional_name  = "virtio-9p-pci-non-transitional",
+.instance_size = sizeof(V9fsPCIState),
+.instance_init = virtio_9p_pci_instance_init,
+.class_init= virtio_9p_pci_class_init,
+};
+
+static void virtio_9p_pci_register(void)
+{
+virtio_pci_types_register(_9p_pci_info);
+}
+
+type_init(virtio_9p_pci_register)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index a01c9dd46f..a62006c72c 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1077,57 +1077,6 @@ static void virtio_pci_vmstate_change(DeviceState *d, 
bool running)
 }
 }
 
-#ifdef CONFIG_VIRTFS
-static void virtio_9p_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
-{
-V9fsPCIState *dev = VIRTIO_9P_PCI(vpci_dev);
-DeviceState *vdev = DEVICE(>vdev);
-
-qdev_set_parent_bus(vdev, BUS(_dev->bus));
-object_property_set_bool(OBJECT(vdev), true, "realized", errp);
-}
-
-static Property virtio_9p_pci_properties[] = {
-DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
-VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
-DEFINE_PROP_UINT32("vectors", 

[Qemu-devel] [PULL 31/44] virtio: split virtio gpu bits from virtio-pci.h

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h  | 14 --
 hw/display/virtio-gpu-pci.c | 14 ++
 hw/display/virtio-vga.c |  1 +
 3 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index d4491e2544..2f7605590d 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -17,11 +17,9 @@
 
 #include "hw/pci/msi.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
-typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
 /* virtio-pci-bus */
@@ -184,18 +182,6 @@ static inline void 
virtio_pci_disable_modern(VirtIOPCIProxy *proxy)
  */
 #define TYPE_VIRTIO_INPUT_PCI "virtio-input-pci"
 
-/*
- * virtio-gpu-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_GPU_PCI "virtio-gpu-pci"
-#define VIRTIO_GPU_PCI(obj) \
-OBJECT_CHECK(VirtIOGPUPCI, (obj), TYPE_VIRTIO_GPU_PCI)
-
-struct VirtIOGPUPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOGPU vdev;
-};
-
 /*
  * virtio-crypto-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c
index faf76a8bc4..bdcd33c925 100644
--- a/hw/display/virtio-gpu-pci.c
+++ b/hw/display/virtio-gpu-pci.c
@@ -19,6 +19,20 @@
 #include "hw/virtio/virtio-pci.h"
 #include "hw/virtio/virtio-gpu.h"
 
+typedef struct VirtIOGPUPCI VirtIOGPUPCI;
+
+/*
+ * virtio-gpu-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_GPU_PCI "virtio-gpu-pci"
+#define VIRTIO_GPU_PCI(obj) \
+OBJECT_CHECK(VirtIOGPUPCI, (obj), TYPE_VIRTIO_GPU_PCI)
+
+struct VirtIOGPUPCI {
+VirtIOPCIProxy parent_obj;
+VirtIOGPU vdev;
+};
+
 static Property virtio_gpu_pci_properties[] = {
 DEFINE_VIRTIO_GPU_PCI_PROPERTIES(VirtIOPCIProxy),
 DEFINE_PROP_END_OF_LIST(),
diff --git a/hw/display/virtio-vga.c b/hw/display/virtio-vga.c
index 8db4d916f2..1e48009b74 100644
--- a/hw/display/virtio-vga.c
+++ b/hw/display/virtio-vga.c
@@ -3,6 +3,7 @@
 #include "hw/pci/pci.h"
 #include "vga_int.h"
 #include "hw/virtio/virtio-pci.h"
+#include "hw/virtio/virtio-gpu.h"
 #include "qapi/error.h"
 
 /*
-- 
MST




[Qemu-devel] [PULL 37/44] tpm: add a "ppi" boolean property

2019-01-14 Thread Michael S. Tsirkin
From: Marc-André Lureau 

The following patches implement the TPM Physical Presence Interface,
make use of a new memory region and a fw_cfg entry. Enable PPI by
default with >=4.0 machine type, to avoid migration issues.

Signed-off-by: Marc-André Lureau 
Reviewed-by: Igor Mammedov 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Michael S. Tsirkin 
Tested-by: Stefan Berger 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/core/machine.c | 2 ++
 hw/tpm/tpm_crb.c  | 3 +++
 hw/tpm/tpm_tis.c  | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index f0c0ae6be8..2629515363 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -28,6 +28,8 @@ GlobalProperty hw_compat_3_1[] = {
 { "pcie-root-port", "x-width", "1" },
 { "memory-backend-file", "x-use-canonical-path-for-ramblock-id", "true" },
 { "memory-backend-memfd", "x-use-canonical-path-for-ramblock-id", "true" },
+{ "tpm-crb", "ppi", "false" },
+{ "tpm-tis", "ppi", "false" },
 };
 const size_t hw_compat_3_1_len = G_N_ELEMENTS(hw_compat_3_1);
 
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index a92dd50437..d5b0ac5920 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -41,6 +41,8 @@ typedef struct CRBState {
 MemoryRegion cmdmem;
 
 size_t be_buffer_size;
+
+bool ppi_enabled;
 } CRBState;
 
 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB)
@@ -221,6 +223,7 @@ static const VMStateDescription vmstate_tpm_crb = {
 
 static Property tpm_crb_properties[] = {
 DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe),
+DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true),
 DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c
index 2563d7501f..1698d83cd3 100644
--- a/hw/tpm/tpm_tis.c
+++ b/hw/tpm/tpm_tis.c
@@ -81,6 +81,8 @@ typedef struct TPMState {
 TPMVersion be_tpm_version;
 
 size_t be_buffer_size;
+
+bool ppi_enabled;
 } TPMState;
 
 #define TPM(obj) OBJECT_CHECK(TPMState, (obj), TYPE_TPM_TIS)
@@ -954,6 +956,7 @@ static const VMStateDescription vmstate_tpm_tis = {
 static Property tpm_tis_properties[] = {
 DEFINE_PROP_UINT32("irq", TPMState, irq_num, TPM_TIS_IRQ),
 DEFINE_PROP_TPMBE("tpmdev", TPMState, be_driver),
+DEFINE_PROP_BOOL("ppi", TPMState, ppi_enabled, true),
 DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
MST




[Qemu-devel] [PULL 17/44] virtio-net: changed VIRTIO_NET_F_RSC_EXT to be 61

2019-01-14 Thread Michael S. Tsirkin
From: Yuri Benditovich 

Allocated feature bit changed in spec draft per TC request.

Signed-off-by: Yuri Benditovich 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/net/virtio-net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 9e5fb1ed62..3f319ef723 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -66,7 +66,7 @@
 #if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
 
 #define VIRTIO_NET_HDR_F_RSC_INFO  4 /* rsc_ext data in csum_ fields */
-#define VIRTIO_NET_F_RSC_EXT   38
+#define VIRTIO_NET_F_RSC_EXT   61
 
 static inline __virtio16 *virtio_net_rsc_ext_num_packets(
 struct virtio_net_hdr *hdr)
-- 
MST




[Qemu-devel] [PULL 09/44] tests: acpi: make sure FADT is fetched only once

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

Whole FADT is fetched as part of RSDT referenced tables in
fetch_rsdt_referenced_tables() albeit a bit later than when FADT
is partially parsed in fadt_fetch_facs_and_dsdt_ptrs().
However there is no reason for calling fetch_rsdt_referenced_tables()
so late, just move it right after we fetched RSDT and before
fadt_fetch_facs_and_dsdt_ptrs(). That way we can reuse whole FADT
fetched by fetch_rsdt_referenced_tables() and avoid duplicate
custom fields fetching in fadt_fetch_facs_and_dsdt_ptrs().

While at it rename fadt_fetch_facs_and_dsdt_ptrs() to
test_acpi_fadt_table(). The follow up patch will merge
fadt_fetch_facs_and_dsdt_ptrs() into test_acpi_rsdt_table(),
so that we would end up calling only test_acpi_FOO_table()
for consistency for tables that require special processing.

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/bios-tables-test.c | 19 ---
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index 3f20bbd24e..b2a40bbda3 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -141,18 +141,15 @@ static void test_acpi_rsdt_table(test_data *data)
 data->rsdt_tables_nr = tables_nr;
 }
 
-static void fadt_fetch_facs_and_dsdt_ptrs(test_data *data)
+static void test_acpi_fadt_table(test_data *data)
 {
-uint32_t addr;
-AcpiTableHeader hdr;
+/* FADT table is 1st */
+AcpiSdtTable *fadt = _array_index(data->tables, typeof(*fadt), 0);
 
-/* FADT table comes first */
-addr = le32_to_cpu(data->rsdt_tables_addr[0]);
-ACPI_READ_TABLE_HEADER(data->qts, , addr);
-ACPI_ASSERT_CMP(hdr.signature, "FACP");
+ACPI_ASSERT_CMP(fadt->header->signature, "FACP");
 
-ACPI_READ_FIELD(data->qts, data->facs_addr, addr);
-ACPI_READ_FIELD(data->qts, data->dsdt_addr, addr);
+memcpy(>facs_addr, fadt->aml + 36 /* FIRMWARE_CTRL */, 4);
+memcpy(>dsdt_addr, fadt->aml + 40 /* DSDT */, 4);
 }
 
 static void sanitize_fadt_ptrs(test_data *data)
@@ -628,10 +625,10 @@ static void test_acpi_one(const char *params, test_data 
*data)
 test_acpi_rsdp_address(data);
 test_acpi_rsdp_table(data);
 test_acpi_rsdt_table(data);
-fadt_fetch_facs_and_dsdt_ptrs(data);
+fetch_rsdt_referenced_tables(data);
+test_acpi_fadt_table(data);
 test_acpi_facs_table(data);
 test_acpi_dsdt_table(data);
-fetch_rsdt_referenced_tables(data);
 
 sanitize_fadt_ptrs(data);
 
-- 
MST




[Qemu-devel] [PULL 32/44] virtio: split virtio crypto bits from virtio-pci.h

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h| 14 --
 hw/virtio/virtio-crypto-pci.c | 14 ++
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index 2f7605590d..bd223a6e3b 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -17,10 +17,8 @@
 
 #include "hw/pci/msi.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-crypto.h"
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
-typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
 /* virtio-pci-bus */
 
@@ -182,18 +180,6 @@ static inline void 
virtio_pci_disable_modern(VirtIOPCIProxy *proxy)
  */
 #define TYPE_VIRTIO_INPUT_PCI "virtio-input-pci"
 
-/*
- * virtio-crypto-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_CRYPTO_PCI "virtio-crypto-pci"
-#define VIRTIO_CRYPTO_PCI(obj) \
-OBJECT_CHECK(VirtIOCryptoPCI, (obj), TYPE_VIRTIO_CRYPTO_PCI)
-
-struct VirtIOCryptoPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOCrypto vdev;
-};
-
 /* Virtio ABI version, if we increment this, we break the guest driver. */
 #define VIRTIO_PCI_ABI_VERSION  0
 
diff --git a/hw/virtio/virtio-crypto-pci.c b/hw/virtio/virtio-crypto-pci.c
index 8cc3fa3ef7..90a6e0dc2e 100644
--- a/hw/virtio/virtio-crypto-pci.c
+++ b/hw/virtio/virtio-crypto-pci.c
@@ -19,6 +19,20 @@
 #include "hw/virtio/virtio-crypto.h"
 #include "qapi/error.h"
 
+typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
+
+/*
+ * virtio-crypto-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_CRYPTO_PCI "virtio-crypto-pci"
+#define VIRTIO_CRYPTO_PCI(obj) \
+OBJECT_CHECK(VirtIOCryptoPCI, (obj), TYPE_VIRTIO_CRYPTO_PCI)
+
+struct VirtIOCryptoPCI {
+VirtIOPCIProxy parent_obj;
+VirtIOCrypto vdev;
+};
+
 static Property virtio_crypto_pci_properties[] = {
 DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
 VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
-- 
MST




[Qemu-devel] [PULL 20/44] virtio: split virtio input bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h   |  22 -
 hw/virtio/virtio-input-pci.c | 157 +++
 hw/virtio/virtio-pci.c   | 113 -
 hw/virtio/Makefile.objs  |   1 +
 4 files changed, 158 insertions(+), 135 deletions(-)
 create mode 100644 hw/virtio/virtio-input-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index fb10afe160..f1c75b0a89 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -23,7 +23,6 @@
 #include "hw/virtio/virtio-scsi.h"
 #include "hw/virtio/virtio-balloon.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-input.h"
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
 #include "hw/virtio/vhost-user-scsi.h"
@@ -48,8 +47,6 @@ typedef struct VHostSCSIPCI VHostSCSIPCI;
 typedef struct VHostUserSCSIPCI VHostUserSCSIPCI;
 typedef struct VHostUserBlkPCI VHostUserBlkPCI;
 typedef struct VirtIORngPCI VirtIORngPCI;
-typedef struct VirtIOInputPCI VirtIOInputPCI;
-typedef struct VirtIOInputHIDPCI VirtIOInputHIDPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -338,25 +335,6 @@ struct VirtIORngPCI {
  * virtio-input-pci: This extends VirtioPCIProxy.
  */
 #define TYPE_VIRTIO_INPUT_PCI "virtio-input-pci"
-#define VIRTIO_INPUT_PCI(obj) \
-OBJECT_CHECK(VirtIOInputPCI, (obj), TYPE_VIRTIO_INPUT_PCI)
-
-struct VirtIOInputPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOInput vdev;
-};
-
-#define TYPE_VIRTIO_INPUT_HID_PCI "virtio-input-hid-pci"
-#define TYPE_VIRTIO_KEYBOARD_PCI  "virtio-keyboard-pci"
-#define TYPE_VIRTIO_MOUSE_PCI "virtio-mouse-pci"
-#define TYPE_VIRTIO_TABLET_PCI"virtio-tablet-pci"
-#define VIRTIO_INPUT_HID_PCI(obj) \
-OBJECT_CHECK(VirtIOInputHIDPCI, (obj), TYPE_VIRTIO_INPUT_HID_PCI)
-
-struct VirtIOInputHIDPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOInputHID vdev;
-};
 
 /*
  * virtio-gpu-pci: This extends VirtioPCIProxy.
diff --git a/hw/virtio/virtio-input-pci.c b/hw/virtio/virtio-input-pci.c
new file mode 100644
index 00..2c1397842b
--- /dev/null
+++ b/hw/virtio/virtio-input-pci.c
@@ -0,0 +1,157 @@
+/*
+ * Virtio input PCI Bindings
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * (at your option) any later version.  See the COPYING file in the
+ * top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "virtio-pci.h"
+#include "hw/virtio/virtio-input.h"
+
+typedef struct VirtIOInputPCI VirtIOInputPCI;
+typedef struct VirtIOInputHIDPCI VirtIOInputHIDPCI;
+
+/*
+ * virtio-input-pci: This extends VirtioPCIProxy.
+ */
+#define VIRTIO_INPUT_PCI(obj) \
+OBJECT_CHECK(VirtIOInputPCI, (obj), TYPE_VIRTIO_INPUT_PCI)
+
+struct VirtIOInputPCI {
+VirtIOPCIProxy parent_obj;
+VirtIOInput vdev;
+};
+
+#define TYPE_VIRTIO_INPUT_HID_PCI "virtio-input-hid-pci"
+#define TYPE_VIRTIO_KEYBOARD_PCI  "virtio-keyboard-pci"
+#define TYPE_VIRTIO_MOUSE_PCI "virtio-mouse-pci"
+#define TYPE_VIRTIO_TABLET_PCI"virtio-tablet-pci"
+#define VIRTIO_INPUT_HID_PCI(obj) \
+OBJECT_CHECK(VirtIOInputHIDPCI, (obj), TYPE_VIRTIO_INPUT_HID_PCI)
+
+struct VirtIOInputHIDPCI {
+VirtIOPCIProxy parent_obj;
+VirtIOInputHID vdev;
+};
+
+static Property virtio_input_pci_properties[] = {
+DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void virtio_input_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+VirtIOInputPCI *vinput = VIRTIO_INPUT_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+virtio_pci_force_virtio_1(vpci_dev);
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static void virtio_input_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+
+dc->props = virtio_input_pci_properties;
+k->realize = virtio_input_pci_realize;
+set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
+
+pcidev_k->class_id = PCI_CLASS_INPUT_OTHER;
+}
+
+static void virtio_input_hid_kbd_pci_class_init(ObjectClass *klass, void *data)
+{
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+
+pcidev_k->class_id = PCI_CLASS_INPUT_KEYBOARD;
+}
+
+static void virtio_input_hid_mouse_pci_class_init(ObjectClass *klass,
+  void *data)
+{
+PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+
+pcidev_k->class_id = PCI_CLASS_INPUT_MOUSE;
+}
+
+static void virtio_keyboard_initfn(Object *obj)
+{
+VirtIOInputHIDPCI *dev = VIRTIO_INPUT_HID_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+

[Qemu-devel] [PULL 12/44] tests: acpi: reuse fetch_table() in vmgenid-test

2019-01-14 Thread Michael S. Tsirkin
From: Igor Mammedov 

Move fetch_table() into acpi-utils.c renaming it to acpi_fetch_table()
and reuse it in vmgenid-test that reads RSDT and then tables it references,
to find and parse VMGNEID SSDT.
While at it wrap RSDT referenced tables enumeration into FOREACH macro
(similar to what we do with QLIST_FOREACH & co) to reuse it with bios and
vmgenid tests.

Signed-off-by: Igor Mammedov 
Acked-by: Thomas Huth 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 tests/acpi-utils.h   | 23 +--
 tests/acpi-utils.c   | 35 +-
 tests/bios-tables-test.c | 55 --
 tests/vmgenid-test.c | 64 +---
 4 files changed, 67 insertions(+), 110 deletions(-)

diff --git a/tests/acpi-utils.h b/tests/acpi-utils.h
index 1b0e80d45c..1aa00db2b6 100644
--- a/tests/acpi-utils.h
+++ b/tests/acpi-utils.h
@@ -22,7 +22,7 @@ typedef struct {
 AcpiTableHeader *header;
 uint8_t *aml;/* aml bytecode from guest */
 };
-gsize aml_len;
+uint32_t aml_len;
 gchar *aml_file;
 gchar *asl;/* asl code generated from aml */
 gsize asl_len;
@@ -47,19 +47,6 @@ typedef struct {
 #define ACPI_READ_ARRAY(qts, arr, addr) \
 ACPI_READ_ARRAY_PTR(qts, arr, sizeof(arr) / sizeof(arr[0]), addr)
 
-#define ACPI_READ_TABLE_HEADER(qts, table, addr) \
-do { \
-ACPI_READ_FIELD(qts, (table)->signature, addr);  \
-ACPI_READ_FIELD(qts, (table)->length, addr); \
-ACPI_READ_FIELD(qts, (table)->revision, addr);   \
-ACPI_READ_FIELD(qts, (table)->checksum, addr);   \
-ACPI_READ_ARRAY(qts, (table)->oem_id, addr); \
-ACPI_READ_ARRAY(qts, (table)->oem_table_id, addr);   \
-ACPI_READ_FIELD(qts, (table)->oem_revision, addr);   \
-ACPI_READ_ARRAY(qts, (table)->asl_compiler_id, addr);\
-ACPI_READ_FIELD(qts, (table)->asl_compiler_revision, addr); \
-} while (0)
-
 #define ACPI_ASSERT_CMP(actual, expected) do { \
 char ACPI_ASSERT_CMP_str[5] = {}; \
 memcpy(ACPI_ASSERT_CMP_str, , 4); \
@@ -73,11 +60,17 @@ typedef struct {
 } while (0)
 
 
+#define ACPI_FOREACH_RSDT_ENTRY(table, table_len, entry_ptr, entry_size) \
+for (entry_ptr = table + 36 /* 1st Entry */; \
+ entry_ptr < table + table_len;  \
+ entry_ptr += entry_size)
 
 uint8_t acpi_calc_checksum(const uint8_t *data, int len);
 uint32_t acpi_find_rsdp_address(QTestState *qts);
-uint32_t acpi_get_rsdt_address(uint8_t *rsdp_table);
 uint64_t acpi_get_xsdt_address(uint8_t *rsdp_table);
 void acpi_parse_rsdp_table(QTestState *qts, uint32_t addr, uint8_t 
*rsdp_table);
+void acpi_fetch_table(QTestState *qts, uint8_t **aml, uint32_t *aml_len,
+  const uint8_t *addr_ptr, const char *sig,
+  bool verify_checksum);
 
 #endif  /* TEST_ACPI_UTILS_H */
diff --git a/tests/acpi-utils.c b/tests/acpi-utils.c
index 17abcc43a4..cc33b460ab 100644
--- a/tests/acpi-utils.c
+++ b/tests/acpi-utils.c
@@ -51,14 +51,6 @@ uint32_t acpi_find_rsdp_address(QTestState *qts)
 return off;
 }
 
-uint32_t acpi_get_rsdt_address(uint8_t *rsdp_table)
-{
-uint32_t rsdt_physical_address;
-
-memcpy(_physical_address, _table[16 /* RsdtAddress offset */], 
4);
-return le32_to_cpu(rsdt_physical_address);
-}
-
 uint64_t acpi_get_xsdt_address(uint8_t *rsdp_table)
 {
 uint64_t xsdt_physical_address;
@@ -92,3 +84,30 @@ void acpi_parse_rsdp_table(QTestState *qts, uint32_t addr, 
uint8_t *rsdp_table)
 
 ACPI_ASSERT_CMP64(*((uint64_t *)(rsdp_table)), "RSD PTR ");
 }
+
+/** acpi_fetch_table
+ *  load ACPI table at @addr_ptr offset pointer into buffer and return it in
+ *  @aml, its length in @aml_len and check that signature/checksum matches
+ *  actual one.
+ */
+void acpi_fetch_table(QTestState *qts, uint8_t **aml, uint32_t *aml_len,
+  const uint8_t *addr_ptr, const char *sig,
+  bool verify_checksum)
+{
+uint32_t addr, len;
+
+memcpy(, addr_ptr , sizeof(addr));
+addr = le32_to_cpu(addr);
+qtest_memread(qts, addr + 4, , 4); /* Length of ACPI table */
+*aml_len = le32_to_cpu(len);
+*aml = g_malloc0(*aml_len);
+/* get whole table */
+qtest_memread(qts, addr, *aml, *aml_len);
+
+if (sig) {
+ACPI_ASSERT_CMP(**aml, sig);
+}
+if (verify_checksum) {
+g_assert(!acpi_calc_checksum(*aml, *aml_len));
+}
+}
diff --git a/tests/bios-tables-test.c b/tests/bios-tables-test.c
index 0f6dd844c5..8fdd1c173a 100644
--- a/tests/bios-tables-test.c
+++ b/tests/bios-tables-test.c
@@ -72,34 +72,6 @@ static void free_test_data(test_data *data)
 g_array_free(data->tables, true);
 }
 
-/** fetch_table
- *   load 

[Qemu-devel] [PULL 40/44] acpi: build TPM Physical Presence interface

2019-01-14 Thread Michael S. Tsirkin
From: Stefan Berger 

The TPM Physical Presence interface consists of an ACPI part, a shared
memory part, and code in the firmware. Users can send messages to the
firmware by writing a code into the shared memory through invoking the
ACPI code. When a reboot happens, the firmware looks for the code and
acts on it by sending sequences of commands to the TPM.

This patch adds the ACPI code. It is similar to the one in EDK2 but doesn't
assume that SMIs are necessary to use. It uses a similar datastructure for
the shared memory as EDK2 does so that EDK2 and SeaBIOS could both make use
of it. I extended the shared memory data structure with an array of 256
bytes, one for each code that could be implemented. The array contains
flags describing the individual codes. This decouples the ACPI implementation
from the firmware implementation.

The underlying TCG specification is accessible from the following page.

https://trustedcomputinggroup.org/tcg-physical-presence-interface-specification/

This patch implements version 1.30.

Signed-off-by: Stefan Berger 
[ Marc-André - ACPI code improvements and windows fixes ]
Signed-off-by: Marc-André Lureau 
Acked-by: Michael S. Tsirkin 
Reviewed-by: Igor Mammedov 
Reviewed-by: Michael S. Tsirkin 
Tested-by: Stefan Berger 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 docs/specs/tpm.txt|  83 +
 include/hw/acpi/tpm.h |  12 ++
 hw/acpi/tpm.c | 404 ++
 hw/i386/acpi-build.c  |  12 +-
 stubs/tpm.c   |   5 +
 hw/acpi/Makefile.objs |   1 +
 6 files changed, 514 insertions(+), 3 deletions(-)
 create mode 100644 hw/acpi/tpm.c

diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt
index e4bb094700..424d1511fc 100644
--- a/docs/specs/tpm.txt
+++ b/docs/specs/tpm.txt
@@ -76,6 +76,89 @@ URL:
 
 https://trustedcomputinggroup.org/tcg-acpi-specification/
 
+== ACPI PPI Interface ==
+
+QEMU supports the Physical Presence Interface (PPI) for TPM 1.2 and TPM 2. This
+interface requires ACPI and firmware support. The specification can be found at
+the following URL:
+
+https://trustedcomputinggroup.org/resource/tcg-physical-presence-interface-specification/
+
+PPI enables a system administrator (root) to request a modification to the
+TPM upon reboot. The PPI specification defines the operation requests and the
+actions the firmware has to take. The system administrator passes the operation
+request number to the firmware through an ACPI interface which writes this
+number to a memory location that the firmware knows. Upon reboot, the firmware
+finds the number and sends commands to the the TPM. The firmware writes the TPM
+result code and the operation request number to a memory location that ACPI can
+read from and pass the result on to the administrator.
+
+The PPI specification defines a set of mandatory and optional operations for
+the firmware to implement. The ACPI interface also allows an administrator to
+list the supported operations. In QEMU the ACPI code is generated by QEMU, yet
+the firmware needs to implement support on a per-operations basis, and
+different firmwares may support a different subset. Therefore, QEMU introduces
+the virtual memory device for PPI where the firmware can indicate which
+operations it supports and ACPI can enable the ones that are supported and
+disable all others. This interface lies in main memory and has the following
+layout:
+
+ +--+++---+
+ |  Field   | Length | Offset | Description   |
+ +--+++---+
+ | func |  0x100 |  0x000 | Firmware sets values for each supported   |
+ |  ||| operation. See defined values below.  |
+ +--+++---+
+ | ppin |   0x1  |  0x100 | SMI interrupt to use. Set by firmware.|
+ |  ||| Not supported.|
+ +--+++---+
+ | ppip |   0x4  |  0x101 | ACPI function index to pass to SMM code.  |
+ |  ||| Set by ACPI. Not supported.   |
+ +--+++---+
+ | pprp |   0x4  |  0x105 | Result of last executed operation. Set by |
+ |  ||| firmware. See function index 5 for values.|
+ +--+++---+
+ | pprq |   0x4  |  0x109 | Operation request number to execute. See  |
+ |  ||| 'Physical Presence Interface Operation|
+ |  ||| Summary' tables in specs. Set by ACPI.|
+ +--+++---+
+ | pprm |   0x4  |  0x10d | Operation request optional parameter. |
+ |  |

[Qemu-devel] [PULL 33/44] virtio: virtio 9p really requires CONFIG_VIRTFS to work

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Signed-off-by: Juan Quintela 
Reviewed-by: Greg Kurz 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 default-configs/virtio.mak | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/default-configs/virtio.mak b/default-configs/virtio.mak
index 5ae4a61018..ecb4420e74 100644
--- a/default-configs/virtio.mak
+++ b/default-configs/virtio.mak
@@ -1,7 +1,7 @@
 CONFIG_VHOST_USER_SCSI=$(call land,$(CONFIG_VHOST_USER),$(CONFIG_LINUX))
 CONFIG_VHOST_USER_BLK=$(call land,$(CONFIG_VHOST_USER),$(CONFIG_LINUX))
 CONFIG_VIRTIO=y
-CONFIG_VIRTIO_9P=y
+CONFIG_VIRTIO_9P=$(CONFIG_VIRTFS)
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_VIRTIO_CRYPTO=y
-- 
MST




[Qemu-devel] [PULL 16/44] virtio-net: support RSC v4/v6 tcp traffic for Windows HCK

2019-01-14 Thread Michael S. Tsirkin
From: Yuri Benditovich 

This commit adds implementation of RX packets
coalescing, compatible with requirements of Windows
Hardware compatibility kit.

The device enables feature VIRTIO_NET_F_RSC_EXT in
host features if it supports extended RSC functionality
as defined in the specification.
This feature requires at least one of VIRTIO_NET_F_GUEST_TSO4,
VIRTIO_NET_F_GUEST_TSO6. Windows guest driver acks
this feature only if VIRTIO_NET_F_CTRL_GUEST_OFFLOADS
is also present.

If the guest driver acks VIRTIO_NET_F_RSC_EXT feature,
the device coalesces TCPv4 and TCPv6 packets (if
respective VIRTIO_NET_F_GUEST_TSO feature is on,
populates extended RSC information in virtio header
and sets VIRTIO_NET_HDR_F_RSC_INFO bit in header flags.
The device does not recalculate checksums in the coalesced
packet, so they are not valid.

In this case:
All the data packets in a tcp connection are cached
to a single buffer in every receive interval, and will
be sent out via a timer, the 'virtio_net_rsc_timeout'
controls the interval, this value may impact the
performance and response time of tcp connection,
5(50us) is an experience value to gain a performance
improvement, since the whql test sends packets every 100us,
so '30(300us)' passes the test case, it is the default
value as well, tune it via the command line parameter
'rsc_interval' within 'virtio-net-pci' device, for example,
to launch a guest with interval set as '50':

'virtio-net-pci,netdev=hostnet1,bus=pci.0,id=net1,mac=00,
guest_rsc_ext=on,rsc_interval=50'

The timer will only be triggered if the packets pool is not empty,
and it'll drain off all the cached packets.

'NetRscChain' is used to save the segments of IPv4/6 in a
VirtIONet device.

A new segment becomes a 'Candidate' as well as it passed sanity check,
the main handler of TCP includes TCP window update, duplicated
ACK check and the real data coalescing.

An 'Candidate' segment means:
1. Segment is within current window and the sequence is the expected one.
2. 'ACK' of the segment is in the valid window.

Sanity check includes:
1. Incorrect version in IP header
2. An IP options or IP fragment
3. Not a TCP packet
4. Sanity size check to prevent buffer overflow attack.
5. An ECN packet

Even though, there might more cases should be considered such as
ip identification other flags, while it breaks the test because
windows set it to the same even it's not a fragment.

Normally it includes 2 typical ways to handle a TCP control flag,
'bypass' and 'finalize', 'bypass' means should be sent out directly,
while 'finalize' means the packets should also be bypassed, but this
should be done after search for the same connection packets in the
pool and drain all of them out, this is to avoid out of order fragment.

All the 'SYN' packets will be bypassed since this always begin a new'
connection, other flags such 'URG/FIN/RST/CWR/ECE' will trigger a
finalization, because this normally happens upon a connection is going
to be closed, an 'URG' packet also finalize current coalescing unit.

Statistics can be used to monitor the basic coalescing status, the
'out of order' and 'out of window' means how many retransmitting packets,
thus describe the performance intuitively.

Difference between ip v4 and v6 processing:
 Fragment length in ipv4 header includes itself, while it's not
 included for ipv6, thus means ipv6 can carry a real 65535 payload.

Note that main goal of implementing this feature in software
is to create reference setup for certification tests. In such
setups guest migration is not required, so the coalesced packets
not yet delivered to the guest will be lost in case of migration.

Signed-off-by: Wei Xu 
Signed-off-by: Yuri Benditovich 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 include/hw/virtio/virtio-net.h |  83 
 include/net/eth.h  |   2 +
 hw/net/virtio-net.c| 667 -
 3 files changed, 751 insertions(+), 1 deletion(-)

diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index 4d7f3c82ca..c7ec1a755f 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -44,6 +44,83 @@ typedef struct virtio_net_conf
 uint8_t duplex;
 } virtio_net_conf;
 
+/* Coalesced packets type & status */
+typedef enum {
+RSC_COALESCE,   /* Data been coalesced */
+RSC_FINAL,  /* Will terminate current connection */
+RSC_NO_MATCH,   /* No matched in the buffer pool */
+RSC_BYPASS, /* Packet to be bypass, not tcp, tcp ctrl, etc */
+RSC_CANDIDATE/* Data want to be coalesced */
+} CoalesceStatus;
+
+typedef struct VirtioNetRscStat {
+uint32_t received;
+uint32_t coalesced;
+uint32_t over_size;
+uint32_t cache;
+uint32_t empty_cache;
+uint32_t no_match_cache;
+uint32_t win_update;
+uint32_t no_match;
+uint32_t tcp_syn;
+uint32_t tcp_ctrl_drain;
+uint32_t dup_ack;

[Qemu-devel] [PULL 29/44] virtio: split virtio net bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Thomas Huth 
Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h | 14 --
 hw/virtio/virtio-net-pci.c | 98 ++
 hw/virtio/virtio-pci.c | 59 ---
 hw/virtio/Makefile.objs|  1 +
 tests/Makefile.include |  2 +-
 5 files changed, 100 insertions(+), 74 deletions(-)
 create mode 100644 hw/virtio/virtio-net-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index b805c02c11..8bfd4b9601 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -16,7 +16,6 @@
 #define QEMU_VIRTIO_PCI_H
 
 #include "hw/pci/msi.h"
-#include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-gpu.h"
@@ -24,7 +23,6 @@
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
 typedef struct VirtIOSerialPCI VirtIOSerialPCI;
-typedef struct VirtIONetPCI VirtIONetPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -195,18 +193,6 @@ struct VirtIOSerialPCI {
 VirtIOSerial vdev;
 };
 
-/*
- * virtio-net-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_NET_PCI "virtio-net-pci-base"
-#define VIRTIO_NET_PCI(obj) \
-OBJECT_CHECK(VirtIONetPCI, (obj), TYPE_VIRTIO_NET_PCI)
-
-struct VirtIONetPCI {
-VirtIOPCIProxy parent_obj;
-VirtIONet vdev;
-};
-
 /*
  * virtio-input-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-net-pci.c b/hw/virtio/virtio-net-pci.c
new file mode 100644
index 00..db07ab9e21
--- /dev/null
+++ b/hw/virtio/virtio-net-pci.c
@@ -0,0 +1,98 @@
+/*
+ * Virtio net PCI Bindings
+ *
+ * Copyright IBM, Corp. 2007
+ * Copyright (c) 2009 CodeSourcery
+ *
+ * Authors:
+ *  Anthony Liguori   
+ *  Paul Brook
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+
+#include "hw/virtio/virtio-net.h"
+#include "virtio-pci.h"
+#include "qapi/error.h"
+
+typedef struct VirtIONetPCI VirtIONetPCI;
+
+/*
+ * virtio-net-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_NET_PCI "virtio-net-pci-base"
+#define VIRTIO_NET_PCI(obj) \
+OBJECT_CHECK(VirtIONetPCI, (obj), TYPE_VIRTIO_NET_PCI)
+
+struct VirtIONetPCI {
+VirtIOPCIProxy parent_obj;
+VirtIONet vdev;
+};
+
+static Property virtio_net_properties[] = {
+DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
+VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
+DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 3),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void virtio_net_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+DeviceState *qdev = DEVICE(vpci_dev);
+VirtIONetPCI *dev = VIRTIO_NET_PCI(vpci_dev);
+DeviceState *vdev = DEVICE(>vdev);
+
+virtio_net_set_netclient_name(>vdev, qdev->id,
+  object_get_typename(OBJECT(qdev)));
+qdev_set_parent_bus(vdev, BUS(_dev->bus));
+object_property_set_bool(OBJECT(vdev), true, "realized", errp);
+}
+
+static void virtio_net_pci_class_init(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+VirtioPCIClass *vpciklass = VIRTIO_PCI_CLASS(klass);
+
+k->romfile = "efi-virtio.rom";
+k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+k->device_id = PCI_DEVICE_ID_VIRTIO_NET;
+k->revision = VIRTIO_PCI_ABI_VERSION;
+k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
+dc->props = virtio_net_properties;
+vpciklass->realize = virtio_net_pci_realize;
+}
+
+static void virtio_net_pci_instance_init(Object *obj)
+{
+VirtIONetPCI *dev = VIRTIO_NET_PCI(obj);
+
+virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
+TYPE_VIRTIO_NET);
+object_property_add_alias(obj, "bootindex", OBJECT(>vdev),
+  "bootindex", _abort);
+}
+
+static const VirtioPCIDeviceTypeInfo virtio_net_pci_info = {
+.base_name = TYPE_VIRTIO_NET_PCI,
+.generic_name  = "virtio-net-pci",
+.transitional_name = "virtio-net-pci-transitional",
+.non_transitional_name = "virtio-net-pci-non-transitional",
+.instance_size = sizeof(VirtIONetPCI),
+.instance_init = virtio_net_pci_instance_init,
+.class_init= virtio_net_pci_class_init,
+};
+
+static void virtio_net_pci_register(void)
+{
+virtio_pci_types_register(_net_pci_info);
+}
+
+type_init(virtio_net_pci_register)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 859b03ae5b..c3e3791b70 100644
--- 

[Qemu-devel] [PULL 34/44] globals: Allow global properties to be optional

2019-01-14 Thread Michael S. Tsirkin
From: Eduardo Habkost 

Making some global properties optional will let us simplify
compat code when a given property works on most (but not all)
subclasses of a given type.

Device types will be able to opt out from optional compat
properties by simply not registering those properties.

Signed-off-by: Eduardo Habkost 
Reviewed-by: Cornelia Huck 
Reviewed-by: Marc-André Lureau 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 include/hw/qdev-core.h | 3 +++
 qom/object.c   | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 9614f76ae6..0a84c42756 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -250,6 +250,8 @@ struct PropertyInfo {
 /**
  * GlobalProperty:
  * @used: Set to true if property was used when initializing a device.
+ * @optional: If set to true, GlobalProperty will be skipped without errors
+ *if the property doesn't exist.
  *
  * An error is fatal for non-hotplugged devices, when the global is applied.
  */
@@ -258,6 +260,7 @@ typedef struct GlobalProperty {
 const char *property;
 const char *value;
 bool used;
+bool optional;
 } GlobalProperty;
 
 static inline void
diff --git a/qom/object.c b/qom/object.c
index 4e5226ca12..b8c732063b 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -385,6 +385,9 @@ void object_apply_global_props(Object *obj, const GPtrArray 
*props, Error **errp
 if (object_dynamic_cast(obj, p->driver) == NULL) {
 continue;
 }
+if (p->optional && !object_property_find(obj, p->property, NULL)) {
+continue;
+}
 p->used = true;
 object_property_parse(obj, p->value, p->property, );
 if (err != NULL) {
-- 
MST




[Qemu-devel] [PULL 41/44] acpi: add ACPI memory clear interface

2019-01-14 Thread Michael S. Tsirkin
From: Marc-André Lureau 

The interface is described in the "TCG Platform Reset Attack
Mitigation Specification", chapter 6 "ACPI _DSM Function". According
to Laszlo, it's not so easy to implement in OVMF, he suggested to do
it in qemu instead.

See specification documentation for more details, and next commit for
memory clear on reset handling.

The underlying TCG specification is accessible from the following
page.

https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification-version-1-0/

This patch implements version 1.0.

Signed-off-by: Marc-André Lureau 
Reviewed-by: Michael S. Tsirkin 
Reviewed-by: Igor Mammedov 
Tested-by: Stefan Berger 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 docs/specs/tpm.txt |  2 ++
 hw/acpi/tpm.c  | 55 ++
 2 files changed, 57 insertions(+)

diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt
index 424d1511fc..5d8c26b1ad 100644
--- a/docs/specs/tpm.txt
+++ b/docs/specs/tpm.txt
@@ -135,6 +135,8 @@ layout:
  +--+++---+
  | next_step|   0x1  |  0x159 | Operation to execute after reboot by  |
  |  ||| firmware. Used by firmware.   |
+ +--+++---+
+ | movv |   0x1  |  0x15a | Memory overwrite variable |
  +--+++---+
 
The following values are supported for the 'func' field. They correspond
diff --git a/hw/acpi/tpm.c b/hw/acpi/tpm.c
index 9f205378f2..b96459e45b 100644
--- a/hw/acpi/tpm.c
+++ b/hw/acpi/tpm.c
@@ -53,6 +53,16 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev)
 pprq = aml_name("PPRQ");
 pprm = aml_name("PPRM");
 
+aml_append(dev,
+   aml_operation_region(
+   "TPP3", AML_SYSTEM_MEMORY,
+   aml_int(TPM_PPI_ADDR_BASE +
+   0x15a /* movv, docs/specs/tpm.txt */),
+   0x1));
+field = aml_field("TPP3", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE);
+aml_append(field, aml_named_field("MOVV", 8));
+aml_append(dev, field);
+
 /*
  * DerefOf in Windows is broken with SYSTEM_MEMORY.  Use a dynamic
  * operation region inside of a method for getting FUNC[op].
@@ -399,6 +409,51 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev)
 aml_append(ifctx, aml_return(aml_buffer(1, zerobyte)));
 }
 aml_append(method, ifctx);
+
+/*
+ * "TCG Platform Reset Attack Mitigation Specification 1.00",
+ * Chapter 6 "ACPI _DSM Function"
+ */
+ifctx = aml_if(
+aml_equal(uuid,
+  aml_touuid("376054ED-CC13-4675-901C-4756D7F2D45D")));
+{
+/* standard DSM query function */
+ifctx2 = aml_if(aml_equal(function, zero));
+{
+uint8_t byte_list[1] = { 0x03 }; /* functions 1-2 supported */
+
+aml_append(ifctx2,
+   aml_return(aml_buffer(sizeof(byte_list),
+ byte_list)));
+}
+aml_append(ifctx, ifctx2);
+
+/*
+ * TCG Platform Reset Attack Mitigation Specification 1.0 Ch.6
+ *
+ * Arg 2 (Integer): Function Index = 1
+ * Arg 3 (Package): Arguments = Package: Type: Integer
+ *  Operation Value of the Request
+ * Returns: Type: Integer
+ *  0: Success
+ *  1: General Failure
+ */
+ifctx2 = aml_if(aml_equal(function, one));
+{
+aml_append(ifctx2,
+   aml_store(aml_derefof(aml_index(arguments, zero)),
+ op));
+{
+aml_append(ifctx2, aml_store(op, aml_name("MOVV")));
+
+/* 0: success */
+aml_append(ifctx2, aml_return(zero));
+}
+}
+aml_append(ifctx, ifctx2);
+}
+aml_append(method, ifctx);
 }
 aml_append(dev, method);
 }
-- 
MST




[Qemu-devel] [PULL 28/44] virtio: split virtio blk bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Reviewed-by: Thomas Huth 
Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h  | 14 --
 hw/virtio/virtio-pci.c  | 61 -
 hw/virtio/Makefile.objs |  1 +
 tests/Makefile.include  |  4 +--
 4 files changed, 3 insertions(+), 77 deletions(-)

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index d00f6d6b9d..b805c02c11 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -16,7 +16,6 @@
 #define QEMU_VIRTIO_PCI_H
 
 #include "hw/pci/msi.h"
-#include "hw/virtio/virtio-blk.h"
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-bus.h"
@@ -24,7 +23,6 @@
 #include "hw/virtio/virtio-crypto.h"
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
-typedef struct VirtIOBlkPCI VirtIOBlkPCI;
 typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIONetPCI VirtIONetPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
@@ -185,18 +183,6 @@ static inline void 
virtio_pci_disable_modern(VirtIOPCIProxy *proxy)
 proxy->disable_modern = true;
 }
 
-/*
- * virtio-blk-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_BLK_PCI "virtio-blk-pci-base"
-#define VIRTIO_BLK_PCI(obj) \
-OBJECT_CHECK(VirtIOBlkPCI, (obj), TYPE_VIRTIO_BLK_PCI)
-
-struct VirtIOBlkPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOBlock vdev;
-};
-
 /*
  * virtio-serial-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index da812b7844..859b03ae5b 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -19,7 +19,6 @@
 
 #include "standard-headers/linux/virtio_pci.h"
 #include "hw/virtio/virtio.h"
-#include "hw/virtio/virtio-blk.h"
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-serial.h"
 #include "hw/pci/pci.h"
@@ -2001,65 +2000,6 @@ void virtio_pci_types_register(const 
VirtioPCIDeviceTypeInfo *t)
 }
 }
 
-/* virtio-blk-pci */
-
-static Property virtio_blk_pci_properties[] = {
-DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),
-DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
-VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
-DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
-   DEV_NVECTORS_UNSPECIFIED),
-DEFINE_PROP_END_OF_LIST(),
-};
-
-static void virtio_blk_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
-{
-VirtIOBlkPCI *dev = VIRTIO_BLK_PCI(vpci_dev);
-DeviceState *vdev = DEVICE(>vdev);
-
-if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
-vpci_dev->nvectors = dev->vdev.conf.num_queues + 1;
-}
-
-qdev_set_parent_bus(vdev, BUS(_dev->bus));
-object_property_set_bool(OBJECT(vdev), true, "realized", errp);
-}
-
-static void virtio_blk_pci_class_init(ObjectClass *klass, void *data)
-{
-DeviceClass *dc = DEVICE_CLASS(klass);
-VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
-PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
-
-set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
-dc->props = virtio_blk_pci_properties;
-k->realize = virtio_blk_pci_realize;
-pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
-pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_BLOCK;
-pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
-pcidev_k->class_id = PCI_CLASS_STORAGE_SCSI;
-}
-
-static void virtio_blk_pci_instance_init(Object *obj)
-{
-VirtIOBlkPCI *dev = VIRTIO_BLK_PCI(obj);
-
-virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
-TYPE_VIRTIO_BLK);
-object_property_add_alias(obj, "bootindex", OBJECT(>vdev),
-  "bootindex", _abort);
-}
-
-static const VirtioPCIDeviceTypeInfo virtio_blk_pci_info = {
-.base_name  = TYPE_VIRTIO_BLK_PCI,
-.generic_name   = "virtio-blk-pci",
-.transitional_name  = "virtio-blk-pci-transitional",
-.non_transitional_name  = "virtio-blk-pci-non-transitional",
-.instance_size = sizeof(VirtIOBlkPCI),
-.instance_init = virtio_blk_pci_instance_init,
-.class_init= virtio_blk_pci_class_init,
-};
-
 /* virtio-serial-pci */
 
 static void virtio_serial_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
@@ -2244,7 +2184,6 @@ static void virtio_pci_register_types(void)
 type_register_static(_pci_info);
 
 /* Implementations: */
-virtio_pci_types_register(_blk_pci_info);
 virtio_pci_types_register(_serial_pci_info);
 virtio_pci_types_register(_net_pci_info);
 }
diff --git a/hw/virtio/Makefile.objs b/hw/virtio/Makefile.objs
index 012b6f74a7..557ad06231 100644
--- a/hw/virtio/Makefile.objs
+++ b/hw/virtio/Makefile.objs
@@ -22,6 +22,7 @@ obj-$(CONFIG_VIRTIO_RNG) += virtio-rng-pci.o
 obj-$(CONFIG_VIRTIO_BALLOON) += virtio-balloon-pci.o
 obj-$(CONFIG_VIRTIO_9P) += virtio-9p-pci.o
 obj-$(CONFIG_VIRTIO_SCSI) += virtio-scsi-pci.o

[Qemu-devel] [PULL 38/44] tpm: allocate/map buffer for TPM Physical Presence interface

2019-01-14 Thread Michael S. Tsirkin
From: Stefan Berger 

Implement a virtual memory device for the TPM Physical Presence interface.
The memory is located at 0xFED45000 and used by ACPI to send messages to the
firmware (BIOS) and by the firmware to provide parameters for each one of
the supported codes.

This interface should be used by all TPM devices on x86 and can be
added by calling tpm_ppi_init_io().

Note: bios_linker cannot be used to allocate the PPI memory region,
since the reserved memory should stay stable across reboots, and might
be needed before the ACPI tables are installed.

Signed-off-by: Stefan Berger 
Signed-off-by: Marc-André Lureau 
Reviewed-by: Igor Mammedov 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Michael S. Tsirkin 
Tested-by: Stefan Berger 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/tpm/tpm_ppi.h  | 36 
 include/hw/acpi/tpm.h |  6 ++
 hw/tpm/tpm_crb.c  |  7 +++
 hw/tpm/tpm_ppi.c  | 31 +++
 hw/tpm/tpm_tis.c  |  7 +++
 hw/tpm/Makefile.objs  |  1 +
 6 files changed, 88 insertions(+)
 create mode 100644 hw/tpm/tpm_ppi.h
 create mode 100644 hw/tpm/tpm_ppi.c

diff --git a/hw/tpm/tpm_ppi.h b/hw/tpm/tpm_ppi.h
new file mode 100644
index 00..c5e555fe2c
--- /dev/null
+++ b/hw/tpm/tpm_ppi.h
@@ -0,0 +1,36 @@
+/*
+ * TPM Physical Presence Interface
+ *
+ * Copyright (C) 2018 IBM Corporation
+ *
+ * Authors:
+ *  Stefan Berger
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#ifndef TPM_TPM_PPI_H
+#define TPM_TPM_PPI_H
+
+#include "hw/acpi/tpm.h"
+#include "exec/address-spaces.h"
+
+typedef struct TPMPPI {
+MemoryRegion ram;
+uint8_t *buf;
+} TPMPPI;
+
+/**
+ * tpm_ppi_init:
+ * @tpmppi: a TPMPPI
+ * @m: the address-space / MemoryRegion to use
+ * @addr: the address of the PPI region
+ * @obj: the owner object
+ *
+ * Register the TPM PPI memory region at @addr on the given address
+ * space for the object @obj.
+ **/
+void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m,
+  hwaddr addr, Object *obj);
+
+#endif /* TPM_TPM_PPI_H */
diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h
index 3580ffd50c..b8796df916 100644
--- a/include/hw/acpi/tpm.h
+++ b/include/hw/acpi/tpm.h
@@ -188,4 +188,10 @@ REG32(CRB_DATA_BUFFER, 0x80)
 #define TPM2_START_METHOD_MMIO  6
 #define TPM2_START_METHOD_CRB   7
 
+/*
+ * Physical Presence Interface
+ */
+#define TPM_PPI_ADDR_SIZE   0x400
+#define TPM_PPI_ADDR_BASE   0xFED45000
+
 #endif /* HW_ACPI_TPM_H */
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index d5b0ac5920..012ec686d4 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -29,6 +29,7 @@
 #include "sysemu/reset.h"
 #include "tpm_int.h"
 #include "tpm_util.h"
+#include "tpm_ppi.h"
 #include "trace.h"
 
 typedef struct CRBState {
@@ -43,6 +44,7 @@ typedef struct CRBState {
 size_t be_buffer_size;
 
 bool ppi_enabled;
+TPMPPI ppi;
 } CRBState;
 
 #define CRB(obj) OBJECT_CHECK(CRBState, (obj), TYPE_TPM_CRB)
@@ -294,6 +296,11 @@ static void tpm_crb_realize(DeviceState *dev, Error **errp)
 memory_region_add_subregion(get_system_memory(),
 TPM_CRB_ADDR_BASE + sizeof(s->regs), >cmdmem);
 
+if (s->ppi_enabled) {
+tpm_ppi_init(>ppi, get_system_memory(),
+ TPM_PPI_ADDR_BASE, OBJECT(s));
+}
+
 qemu_register_reset(tpm_crb_reset, dev);
 }
 
diff --git a/hw/tpm/tpm_ppi.c b/hw/tpm/tpm_ppi.c
new file mode 100644
index 00..cf17779c20
--- /dev/null
+++ b/hw/tpm/tpm_ppi.c
@@ -0,0 +1,31 @@
+/*
+ * tpm_ppi.c - TPM Physical Presence Interface
+ *
+ * Copyright (C) 2018 IBM Corporation
+ *
+ * Authors:
+ *  Stefan Berger 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+
+#include "qapi/error.h"
+#include "cpu.h"
+#include "sysemu/memory_mapping.h"
+#include "migration/vmstate.h"
+#include "tpm_ppi.h"
+
+void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m,
+  hwaddr addr, Object *obj)
+{
+tpmppi->buf = g_malloc0(HOST_PAGE_ALIGN(TPM_PPI_ADDR_SIZE));
+memory_region_init_ram_device_ptr(>ram, obj, "tpm-ppi",
+  TPM_PPI_ADDR_SIZE, tpmppi->buf);
+vmstate_register_ram(>ram, DEVICE(obj));
+
+memory_region_add_subregion(m, addr, >ram);
+}
diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c
index 1698d83cd3..02d9d5c911 100644
--- a/hw/tpm/tpm_tis.c
+++ b/hw/tpm/tpm_tis.c
@@ -31,6 +31,7 @@
 #include "sysemu/tpm_backend.h"
 #include "tpm_int.h"
 #include "tpm_util.h"
+#include "tpm_ppi.h"
 #include "trace.h"
 
 #define TPM_TIS_NUM_LOCALITIES  5 /* per spec */
@@ -83,6 +84,7 @@ typedef struct TPMState {
 size_t be_buffer_size;
 
 bool ppi_enabled;
+TPMPPI ppi;
 } TPMState;
 
 #define TPM(obj) 

[Qemu-devel] [PULL 36/44] hw/misc/edu: add msi_uninit() for pci_edu_uninit()

2019-01-14 Thread Michael S. Tsirkin
From: Fei Li 

Let's supplement the msi_uninit() when failing to realize
the pci edu device.

Reported-by: Markus Armbruster 
Signed-off-by: Fei Li 
Reviewed-by: Marcel Apfelbaum 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Peter Xu 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/misc/edu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/misc/edu.c b/hw/misc/edu.c
index cdcf550dd7..ceaf688bfb 100644
--- a/hw/misc/edu.c
+++ b/hw/misc/edu.c
@@ -377,6 +377,7 @@ static void pci_edu_uninit(PCIDevice *pdev)
 qemu_mutex_destroy(>thr_mutex);
 
 timer_del(>dma_timer);
+msi_uninit(pdev);
 }
 
 static void edu_obj_uint64(Object *obj, Visitor *v, const char *name,
-- 
MST




[Qemu-devel] [PULL 42/44] tpm: clear RAM when "memory overwrite" requested

2019-01-14 Thread Michael S. Tsirkin
From: Marc-André Lureau 

Note: the "Platform Reset Attack Mitigation" specification isn't
explicit about NVDIMM, since they could have different usages. It uses
the term "system memory" generally (and also "volatile memory RAM" in
its introduction). For initial support, I propose to consider
non-volatile memory as not being subject to the memory clear. There is
an on-going discussion in the TCG "pcclientwg" working group for
future revisions.

CPU cache clearing is done unconditionally in edk2 since commit
d20ae95a13e851 (edk2-stable201811).

Signed-off-by: Marc-André Lureau 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Michael S. Tsirkin 
Tested-by: Stefan Berger 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/tpm/tpm_ppi.h| 10 ++
 hw/tpm/tpm_crb.c|  3 +++
 hw/tpm/tpm_ppi.c| 22 ++
 hw/tpm/tpm_tis.c|  3 +++
 hw/tpm/trace-events |  3 +++
 5 files changed, 41 insertions(+)

diff --git a/hw/tpm/tpm_ppi.h b/hw/tpm/tpm_ppi.h
index c5e555fe2c..d33ef27de6 100644
--- a/hw/tpm/tpm_ppi.h
+++ b/hw/tpm/tpm_ppi.h
@@ -33,4 +33,14 @@ typedef struct TPMPPI {
 void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m,
   hwaddr addr, Object *obj);
 
+/**
+ * tpm_ppi_reset:
+ * @tpmppi: a TPMPPI
+ *
+ * Function to call on machine reset. It will check if the "Memory
+ * overwrite" variable is set, and perform a memory clear on volatile
+ * memory if requested.
+ **/
+void tpm_ppi_reset(TPMPPI *tpmppi);
+
 #endif /* TPM_TPM_PPI_H */
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index 012ec686d4..3087acc4ab 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -233,6 +233,9 @@ static void tpm_crb_reset(void *dev)
 {
 CRBState *s = CRB(dev);
 
+if (s->ppi_enabled) {
+tpm_ppi_reset(>ppi);
+}
 tpm_backend_reset(s->tpmbe);
 
 memset(s->regs, 0, sizeof(s->regs));
diff --git a/hw/tpm/tpm_ppi.c b/hw/tpm/tpm_ppi.c
index cf17779c20..cd8205f212 100644
--- a/hw/tpm/tpm_ppi.c
+++ b/hw/tpm/tpm_ppi.c
@@ -16,8 +16,30 @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "sysemu/memory_mapping.h"
+#include "sysemu/reset.h"
 #include "migration/vmstate.h"
 #include "tpm_ppi.h"
+#include "trace.h"
+
+void tpm_ppi_reset(TPMPPI *tpmppi)
+{
+if (tpmppi->buf[0x15a /* movv, docs/specs/tpm.txt */] & 0x1) {
+GuestPhysBlockList guest_phys_blocks;
+GuestPhysBlock *block;
+
+guest_phys_blocks_init(_phys_blocks);
+guest_phys_blocks_append(_phys_blocks);
+QTAILQ_FOREACH(block, _phys_blocks.head, next) {
+trace_tpm_ppi_memset(block->host_addr,
+ block->target_end - block->target_start);
+memset(block->host_addr, 0,
+   block->target_end - block->target_start);
+memory_region_set_dirty(block->mr, 0,
+block->target_end - block->target_start);
+}
+guest_phys_blocks_free(_phys_blocks);
+}
+}
 
 void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m,
   hwaddr addr, Object *obj)
diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c
index 02d9d5c911..fd6bb9b59a 100644
--- a/hw/tpm/tpm_tis.c
+++ b/hw/tpm/tpm_tis.c
@@ -872,6 +872,9 @@ static void tpm_tis_reset(DeviceState *dev)
 s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->be_driver),
 TPM_TIS_BUFFER_MAX);
 
+if (s->ppi_enabled) {
+tpm_ppi_reset(>ppi);
+}
 tpm_backend_reset(s->be_driver);
 
 s->active_locty = TPM_TIS_NO_LOCALITY;
diff --git a/hw/tpm/trace-events b/hw/tpm/trace-events
index 25bee0cecf..920d32ad55 100644
--- a/hw/tpm/trace-events
+++ b/hw/tpm/trace-events
@@ -51,3 +51,6 @@ tpm_tis_mmio_write_init_abort(void) "Initiating abort"
 tpm_tis_mmio_write_lowering_irq(void) "Lowering IRQ"
 tpm_tis_mmio_write_data2send(uint32_t value, unsigned size) "Data to send to 
TPM: 0x%08x (size=%d)"
 tpm_tis_pre_save(uint8_t locty, uint32_t rw_offset) "locty: %d, rw_offset = %u"
+
+# hw/tpm/tpm_ppi.c
+tpm_ppi_memset(uint8_t *ptr, size_t size) "memset: %p %zu"
-- 
MST




[Qemu-devel] [PULL 39/44] acpi: expose TPM/PPI configuration parameters to firmware via fw_cfg

2019-01-14 Thread Michael S. Tsirkin
From: Stefan Berger 

To avoid having to hard code the base address of the PPI virtual
memory device we introduce a fw_cfg file etc/tpm/config that holds the
base address of the PPI device, the version of the PPI interface and
the version of the attached TPM.

Signed-off-by: Stefan Berger 
[ Marc-André: renamed to etc/tpm/config, made it static, document it ]
Signed-off-by: Marc-André Lureau 
Acked-by: Michael S. Tsirkin 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Michael S. Tsirkin 
Tested-by: Stefan Berger 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 docs/specs/tpm.txt| 19 +++
 include/hw/acpi/tpm.h |  3 +++
 hw/i386/acpi-build.c  | 19 +++
 3 files changed, 41 insertions(+)

diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt
index 1af82bba86..e4bb094700 100644
--- a/docs/specs/tpm.txt
+++ b/docs/specs/tpm.txt
@@ -34,6 +34,25 @@ The CRB interface makes a memory mapped IO region in the 
area 0xfed4 -
 QEMU files related to TPM CRB interface:
  - hw/tpm/tpm_crb.c
 
+= fw_cfg interface =
+
+The bios/firmware may read the "etc/tpm/config" fw_cfg entry for
+configuring the guest appropriately.
+
+The entry of 6 bytes has the following content, in little-endian:
+
+#define TPM_VERSION_UNSPEC  0
+#define TPM_VERSION_1_2 1
+#define TPM_VERSION_2_0 2
+
+#define TPM_PPI_VERSION_NONE0
+#define TPM_PPI_VERSION_1_301
+
+struct FwCfgTPMConfig {
+uint32_t tpmppi_address; /* PPI memory location */
+uint8_t tpm_version; /* TPM version */
+uint8_t tpmppi_version;  /* PPI version */
+};
 
 = ACPI Interface =
 
diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h
index b8796df916..a6109a97fc 100644
--- a/include/hw/acpi/tpm.h
+++ b/include/hw/acpi/tpm.h
@@ -194,4 +194,7 @@ REG32(CRB_DATA_BUFFER, 0x80)
 #define TPM_PPI_ADDR_SIZE   0x400
 #define TPM_PPI_ADDR_BASE   0xFED45000
 
+#define TPM_PPI_VERSION_NONE0
+#define TPM_PPI_VERSION_1_301
+
 #endif /* HW_ACPI_TPM_H */
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 14f757fc36..9898247705 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -119,6 +119,12 @@ typedef struct AcpiBuildPciBusHotplugState {
 bool pcihp_bridge_en;
 } AcpiBuildPciBusHotplugState;
 
+typedef struct FwCfgTPMConfig {
+uint32_t tpmppi_address;
+uint8_t tpm_version;
+uint8_t tpmppi_version;
+} QEMU_PACKED FwCfgTPMConfig;
+
 static void init_common_fadt_data(Object *o, AcpiFadtData *data)
 {
 uint32_t io = object_property_get_uint(o, ACPI_PM_PROP_PM_IO_BASE, NULL);
@@ -2847,6 +2853,8 @@ void acpi_setup(void)
 AcpiBuildTables tables;
 AcpiBuildState *build_state;
 Object *vmgenid_dev;
+TPMIf *tpm;
+static FwCfgTPMConfig tpm_config;
 
 if (!pcms->fw_cfg) {
 ACPI_BUILD_DPRINTF("No fw cfg. Bailing out.\n");
@@ -2881,6 +2889,17 @@ void acpi_setup(void)
 fw_cfg_add_file(pcms->fw_cfg, ACPI_BUILD_TPMLOG_FILE,
 tables.tcpalog->data, acpi_data_len(tables.tcpalog));
 
+tpm = tpm_find();
+if (tpm && object_property_get_bool(OBJECT(tpm), "ppi", _abort)) {
+tpm_config = (FwCfgTPMConfig) {
+.tpmppi_address = cpu_to_le32(TPM_PPI_ADDR_BASE),
+.tpm_version = tpm_get_version(tpm),
+.tpmppi_version = TPM_PPI_VERSION_NONE
+};
+fw_cfg_add_file(pcms->fw_cfg, "etc/tpm/config",
+_config, sizeof tpm_config);
+}
+
 vmgenid_dev = find_vmgenid_dev();
 if (vmgenid_dev) {
 vmgenid_add_fw_cfg(VMGENID(vmgenid_dev), pcms->fw_cfg,
-- 
MST




[Qemu-devel] [PULL 30/44] virtio: split virtio serial bits from virtio-pci

2019-01-14 Thread Michael S. Tsirkin
From: Juan Quintela 

Virtio console and qga tests also depend on CONFIG_VIRTIO_SERIAL.

Reviewed-by: Thomas Huth 
Reviewed-by: Laurent Vivier 
Signed-off-by: Juan Quintela 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio/virtio-pci.h|  14 -
 hw/virtio/virtio-pci.c|  79 ---
 hw/virtio/virtio-serial-pci.c | 115 ++
 hw/virtio/Makefile.objs   |   1 +
 tests/Makefile.include|   6 +-
 5 files changed, 119 insertions(+), 96 deletions(-)
 create mode 100644 hw/virtio/virtio-serial-pci.c

diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index 8bfd4b9601..d4491e2544 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -16,13 +16,11 @@
 #define QEMU_VIRTIO_PCI_H
 
 #include "hw/pci/msi.h"
-#include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-gpu.h"
 #include "hw/virtio/virtio-crypto.h"
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
-typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIOGPUPCI VirtIOGPUPCI;
 typedef struct VirtIOCryptoPCI VirtIOCryptoPCI;
 
@@ -181,18 +179,6 @@ static inline void 
virtio_pci_disable_modern(VirtIOPCIProxy *proxy)
 proxy->disable_modern = true;
 }
 
-/*
- * virtio-serial-pci: This extends VirtioPCIProxy.
- */
-#define TYPE_VIRTIO_SERIAL_PCI "virtio-serial-pci-base"
-#define VIRTIO_SERIAL_PCI(obj) \
-OBJECT_CHECK(VirtIOSerialPCI, (obj), TYPE_VIRTIO_SERIAL_PCI)
-
-struct VirtIOSerialPCI {
-VirtIOPCIProxy parent_obj;
-VirtIOSerial vdev;
-};
-
 /*
  * virtio-input-pci: This extends VirtioPCIProxy.
  */
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index c3e3791b70..b282109343 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -19,7 +19,6 @@
 
 #include "standard-headers/linux/virtio_pci.h"
 #include "hw/virtio/virtio.h"
-#include "hw/virtio/virtio-serial.h"
 #include "hw/pci/pci.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@@ -1999,81 +1998,6 @@ void virtio_pci_types_register(const 
VirtioPCIDeviceTypeInfo *t)
 }
 }
 
-/* virtio-serial-pci */
-
-static void virtio_serial_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
-{
-VirtIOSerialPCI *dev = VIRTIO_SERIAL_PCI(vpci_dev);
-DeviceState *vdev = DEVICE(>vdev);
-DeviceState *proxy = DEVICE(vpci_dev);
-char *bus_name;
-
-if (vpci_dev->class_code != PCI_CLASS_COMMUNICATION_OTHER &&
-vpci_dev->class_code != PCI_CLASS_DISPLAY_OTHER && /* qemu 0.10 */
-vpci_dev->class_code != PCI_CLASS_OTHERS) {/* qemu-kvm  */
-vpci_dev->class_code = PCI_CLASS_COMMUNICATION_OTHER;
-}
-
-/* backwards-compatibility with machines that were created with
-   DEV_NVECTORS_UNSPECIFIED */
-if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
-vpci_dev->nvectors = dev->vdev.serial.max_virtserial_ports + 1;
-}
-
-/*
- * For command line compatibility, this sets the virtio-serial-device bus
- * name as before.
- */
-if (proxy->id) {
-bus_name = g_strdup_printf("%s.0", proxy->id);
-virtio_device_set_child_bus_name(VIRTIO_DEVICE(vdev), bus_name);
-g_free(bus_name);
-}
-
-qdev_set_parent_bus(vdev, BUS(_dev->bus));
-object_property_set_bool(OBJECT(vdev), true, "realized", errp);
-}
-
-static Property virtio_serial_pci_properties[] = {
-DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
-VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
-DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
-DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),
-DEFINE_PROP_END_OF_LIST(),
-};
-
-static void virtio_serial_pci_class_init(ObjectClass *klass, void *data)
-{
-DeviceClass *dc = DEVICE_CLASS(klass);
-VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
-PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
-k->realize = virtio_serial_pci_realize;
-set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
-dc->props = virtio_serial_pci_properties;
-pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
-pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_CONSOLE;
-pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
-pcidev_k->class_id = PCI_CLASS_COMMUNICATION_OTHER;
-}
-
-static void virtio_serial_pci_instance_init(Object *obj)
-{
-VirtIOSerialPCI *dev = VIRTIO_SERIAL_PCI(obj);
-
-virtio_instance_init_common(obj, >vdev, sizeof(dev->vdev),
-TYPE_VIRTIO_SERIAL);
-}
-
-static const VirtioPCIDeviceTypeInfo virtio_serial_pci_info = {
-.base_name = TYPE_VIRTIO_SERIAL_PCI,
-.generic_name  = "virtio-serial-pci",
-.transitional_name = "virtio-serial-pci-transitional",
-.non_transitional_name = "virtio-serial-pci-non-transitional",
-.instance_size = sizeof(VirtIOSerialPCI),
-.instance_init = virtio_serial_pci_instance_init,
-.class_init= 

[Qemu-devel] [PULL 43/44] hw: acpi: Fix memory hotplug AML generation error

2019-01-14 Thread Michael S. Tsirkin
From: Yang Zhong 

When using the generated memory hotplug AML, the iasl
compiler would give the following error:

dsdt.dsl 266: Return (MOST (_UID, Arg0, Arg1, Arg2))
Error 6080 - Called method returns no value ^

Signed-off-by: Yang Zhong 
Reviewed-by: Igor Mammedov 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
---
 hw/acpi/memory_hotplug.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/acpi/memory_hotplug.c b/hw/acpi/memory_hotplug.c
index 8c7c1013f3..921cad2c5e 100644
--- a/hw/acpi/memory_hotplug.c
+++ b/hw/acpi/memory_hotplug.c
@@ -686,15 +686,15 @@ void build_memory_hotplug_aml(Aml *table, uint32_t nr_mem,
 
 method = aml_method("_OST", 3, AML_NOTSERIALIZED);
 s = MEMORY_SLOT_OST_METHOD;
-aml_append(method, aml_return(aml_call4(
-s, aml_name("_UID"), aml_arg(0), aml_arg(1), aml_arg(2)
-)));
+aml_append(method,
+   aml_call4(s, aml_name("_UID"), aml_arg(0),
+ aml_arg(1), aml_arg(2)));
 aml_append(dev, method);
 
 method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
 s = MEMORY_SLOT_EJECT_METHOD;
-aml_append(method, aml_return(aml_call2(
-   s, aml_name("_UID"), aml_arg(0;
+aml_append(method,
+   aml_call2(s, aml_name("_UID"), aml_arg(0)));
 aml_append(dev, method);
 
 aml_append(dev_container, dev);
-- 
MST




[Qemu-devel] [PULL 44/44] acpi: update expected files

2019-01-14 Thread Michael S. Tsirkin
Update expected files affected by:
hw: acpi: Fix memory hotplug AML generation error

Signed-off-by: Michael S. Tsirkin 
---
 tests/data/acpi/pc/DSDT.dimmpxm  | Bin 6790 -> 6784 bytes
 tests/data/acpi/pc/DSDT.memhp| Bin 6496 -> 6490 bytes
 tests/data/acpi/q35/DSDT.dimmpxm | Bin 9474 -> 9468 bytes
 tests/data/acpi/q35/DSDT.memhp   | Bin 9180 -> 9174 bytes
 tests/data/acpi/q35/DSDT.mmio64  | Bin 8947 -> 8945 bytes
 5 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/tests/data/acpi/pc/DSDT.dimmpxm b/tests/data/acpi/pc/DSDT.dimmpxm
index 
f6ec911b1180a409e61ef8d50279ab6dba7f1bdd..ad2800de672534dc87012f03e27b19671a330083
 100644
GIT binary patch
delta 159
zcmZoOZ7}6>33dr-kYZq96xzsD#lz#{6QdU&>=f_o5#T&|qL9euB|H|)jJ}ia@_VZY
z#`_0{F#7_D_)t%mjLa+%{&-g}14dsU0TzjF@}2A_K%~O`0^Sn1Ox@n8XPH@s=#v

delta 151
zcmZoLZ8PO^33dr-lVV_CG~CEl#lz&}ySa@gjG57Y@?Cy!HKBO_;1K2|zCbcQ)YBy+
nGfPAu-qp*1afvUG1Pets`A_x{AX@2e0dFbXrf!xKOyUFp_>(Mp

diff --git a/tests/data/acpi/pc/DSDT.memhp b/tests/data/acpi/pc/DSDT.memhp
index 
e31ef502968b14e2146cb1a1328dc0ce555b1d7f..9e75ac96e15730f245ff6730bd28127ad827119a
 100644
GIT binary patch
delta 159
zcmaE0bjyg#CDfA$$zpHKha88@_S3+Hgz+PfFCCSaaJu1

diff --git a/tests/data/acpi/q35/DSDT.dimmpxm b/tests/data/acpi/q35/DSDT.dimmpxm
index 
3837792dec13c4c77c66b140f68959d86a09de8e..7177116a21969fa3649053ec83a8704b0d84b9c5
 100644
GIT binary patch
delta 145
zcmZqj`s2yv66_N4M}>ib@$g126FDXypUn<(Va$xalcy_ss|d#X2Zu2G0*UxgPnV3$
lED`>AS1$ubUmyV%iEi?p%%Mc2!b?30x*_zNe(Z1ON^VDcS%4

delta 151
zcmez4+2qCL66_Mfq{_g+_;4eai5!!Y?`8+NFlI*o$L^t_P{zk0AbVY9oTqbTlqbR@x01+4}3IG5A

delta 151
zcmccSe#f25CDfA$$#<};*};VdQ0Ipb@MSr0VV*TS}p_t

diff --git a/tests/data/acpi/q35/DSDT.mmio64 b/tests/data/acpi/q35/DSDT.mmio64
index 
a058ff2ee31a22a55b5b198bc1531c7f20b243f6..f60ee77fb4d655e77c7ef1e8c205d741cc288939
 100644
GIT binary patch
delta 62
zcmezD`q7okCDK;iw#*lp+(G

-- 
MST




[Qemu-devel] [PATCH v1 2/8] RISC-V: Mark mstatus.fs dirty

2019-01-14 Thread Alistair Francis
From: Richard Henderson 

Modifed from Richard Henderson's patch [1] to integrate
with the new control and status register implementation.

[1] https://lists.nongnu.org/archive/html/qemu-devel/2018-03/msg07034.html

Note: the f* CSRs already mark mstatus.FS dirty using
env->mstatus |= mstatus.FS so the bug in the first
spin of this patch has been fixed in a prior commit.

Cc: Sagar Karandikar 
Cc: Bastian Koppelmann 
Cc: Palmer Dabbelt 
Cc: Alistair Francis 
Cc: Richard Henderson 
Signed-off-by: Michael Clark 
Reviewed-by: Michael Clark 
Signed-off-by: Alistair Francis 

Co-authored-by: Richard Henderson 
Co-authored-by: Michael Clark 
---
 target/riscv/csr.c   | 12 
 target/riscv/translate.c | 40 +++-
 2 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 5e7e7d16b8..5714147689 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -317,18 +317,6 @@ static int write_mstatus(CPURISCVState *env, int csrno, 
target_ulong val)
 
 mstatus = (mstatus & ~mask) | (val & mask);
 
-/* Note: this is a workaround for an issue where mstatus.FS
-   does not report dirty after floating point operations
-   that modify floating point state. This workaround is
-   technically compliant with the RISC-V Privileged
-   specification as it is legal to return only off, or dirty.
-   at the expense of extra floating point save/restore. */
-
-/* FP is always dirty or off */
-if (mstatus & MSTATUS_FS) {
-mstatus |= MSTATUS_FS;
-}
-
 int dirty = ((mstatus & MSTATUS_FS) == MSTATUS_FS) |
 ((mstatus & MSTATUS_XS) == MSTATUS_XS);
 mstatus = set_field(mstatus, MSTATUS_SD, dirty);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 3d07d651b6..0581b3c1f7 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -651,6 +651,31 @@ static void gen_store(DisasContext *ctx, uint32_t opc, int 
rs1, int rs2,
 tcg_temp_free(dat);
 }
 
+#ifndef CONFIG_USER_ONLY
+/* The states of mstatus_fs are:
+ * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
+ * We will have already diagnosed disabled state,
+ * and need to turn initial/clean into dirty.
+ */
+static void mark_fs_dirty(DisasContext *ctx)
+{
+TCGv tmp;
+if (ctx->mstatus_fs == MSTATUS_FS) {
+return;
+}
+/* Remember the state change for the rest of the TB.  */
+ctx->mstatus_fs = MSTATUS_FS;
+
+tmp = tcg_temp_new();
+tcg_gen_ld_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
+tcg_gen_ori_tl(tmp, tmp, MSTATUS_FS);
+tcg_gen_st_tl(tmp, cpu_env, offsetof(CPURISCVState, mstatus));
+tcg_temp_free(tmp);
+}
+#else
+static inline void mark_fs_dirty(DisasContext *ctx) { }
+#endif
+
 static void gen_fp_load(DisasContext *ctx, uint32_t opc, int rd,
 int rs1, target_long imm)
 {
@@ -679,6 +704,8 @@ static void gen_fp_load(DisasContext *ctx, uint32_t opc, 
int rd,
 break;
 }
 tcg_temp_free(t0);
+
+mark_fs_dirty(ctx);
 }
 
 static void gen_fp_store(DisasContext *ctx, uint32_t opc, int rs1,
@@ -944,6 +971,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
  int rs1, int rs2, int rm)
 {
 TCGv t0 = NULL;
+bool fp_output = true;
 
 if (ctx->mstatus_fs == 0) {
 goto do_illegal;
@@ -1006,6 +1034,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 }
 gen_set_gpr(rd, t0);
 tcg_temp_free(t0);
+fp_output = false;
 break;
 
 case OPC_RISC_FCVT_W_S:
@@ -1035,6 +1064,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 }
 gen_set_gpr(rd, t0);
 tcg_temp_free(t0);
+fp_output = false;
 break;
 
 case OPC_RISC_FCVT_S_W:
@@ -1085,6 +1115,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 }
 gen_set_gpr(rd, t0);
 tcg_temp_free(t0);
+fp_output = false;
 break;
 
 case OPC_RISC_FMV_S_X:
@@ -1177,6 +1208,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 }
 gen_set_gpr(rd, t0);
 tcg_temp_free(t0);
+fp_output = false;
 break;
 
 case OPC_RISC_FCVT_W_D:
@@ -1206,6 +1238,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 }
 gen_set_gpr(rd, t0);
 tcg_temp_free(t0);
+fp_output = false;
 break;
 
 case OPC_RISC_FCVT_D_W:
@@ -1254,6 +1287,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 default:
 goto do_illegal;
 }
+fp_output = false;
 break;
 
 #if defined(TARGET_RISCV64)
@@ -1271,7 +1305,11 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t 
opc, int rd,
 tcg_temp_free(t0);
 }
 gen_exception_illegal(ctx);
-break;
+return;
+}
+
+if 

[Qemu-devel] [PATCH v1 7/8] RISC-V: Add misa.MAFD checks to translate

2019-01-14 Thread Alistair Francis
From: Michael Clark 

Add misa checks for M, A, F and D extensions and if they are
not present generate illegal instructions. This improves
emulation accurary for harts with a limited set of extensions.

Cc: Palmer Dabbelt 
Cc: Sagar Karandikar 
Cc: Bastian Koppelmann 
Cc: Alistair Francis 
Cc: Emilio G. Cota 
Signed-off-by: Michael Clark 
Signed-off-by: Alistair Francis 
---
 target/riscv/translate.c | 158 +++
 1 file changed, 158 insertions(+)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 7ebea308b4..8593c2170a 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -291,24 +291,42 @@ static void gen_arith(DisasContext *ctx, uint32_t opc, 
int rd, int rs1,
 tcg_gen_and_tl(source1, source1, source2);
 break;
 CASE_OP_32_64(OPC_RISC_MUL):
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 tcg_gen_mul_tl(source1, source1, source2);
 break;
 case OPC_RISC_MULH:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 tcg_gen_muls2_tl(source2, source1, source1, source2);
 break;
 case OPC_RISC_MULHSU:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 gen_mulhsu(source1, source1, source2);
 break;
 case OPC_RISC_MULHU:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 tcg_gen_mulu2_tl(source2, source1, source1, source2);
 break;
 #if defined(TARGET_RISCV64)
 case OPC_RISC_DIVW:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 tcg_gen_ext32s_tl(source1, source1);
 tcg_gen_ext32s_tl(source2, source2);
 /* fall through to DIV */
 #endif
 case OPC_RISC_DIV:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 /* Handle by altering args to tcg_gen_div to produce req'd results:
  * For overflow: want source1 in source1 and 1 in source2
  * For div by zero: want -1 in source1 and 1 in source2 -> -1 result */
@@ -340,11 +358,17 @@ static void gen_arith(DisasContext *ctx, uint32_t opc, 
int rd, int rs1,
 break;
 #if defined(TARGET_RISCV64)
 case OPC_RISC_DIVUW:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 tcg_gen_ext32u_tl(source1, source1);
 tcg_gen_ext32u_tl(source2, source2);
 /* fall through to DIVU */
 #endif
 case OPC_RISC_DIVU:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 cond1 = tcg_temp_new();
 zeroreg = tcg_const_tl(0);
 resultopt1 = tcg_temp_new();
@@ -364,11 +388,17 @@ static void gen_arith(DisasContext *ctx, uint32_t opc, 
int rd, int rs1,
 break;
 #if defined(TARGET_RISCV64)
 case OPC_RISC_REMW:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 tcg_gen_ext32s_tl(source1, source1);
 tcg_gen_ext32s_tl(source2, source2);
 /* fall through to REM */
 #endif
 case OPC_RISC_REM:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 cond1 = tcg_temp_new();
 cond2 = tcg_temp_new();
 zeroreg = tcg_const_tl(0);
@@ -396,11 +426,17 @@ static void gen_arith(DisasContext *ctx, uint32_t opc, 
int rd, int rs1,
 break;
 #if defined(TARGET_RISCV64)
 case OPC_RISC_REMUW:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 tcg_gen_ext32u_tl(source1, source1);
 tcg_gen_ext32u_tl(source2, source2);
 /* fall through to REMU */
 #endif
 case OPC_RISC_REMU:
+if (!has_ext(ctx, RVM)) {
+goto do_illegal;
+}
 cond1 = tcg_temp_new();
 zeroreg = tcg_const_tl(0);
 resultopt1 = tcg_temp_new();
@@ -418,6 +454,7 @@ static void gen_arith(DisasContext *ctx, uint32_t opc, int 
rd, int rs1,
 tcg_temp_free(zeroreg);
 tcg_temp_free(resultopt1);
 break;
+do_illegal:
 default:
 gen_exception_illegal(ctx);
 return;
@@ -698,13 +735,20 @@ static void gen_fp_load(DisasContext *ctx, uint32_t opc, 
int rd,
 
 switch (opc) {
 case OPC_RISC_FLW:
+if (!has_ext(ctx, RVF)) {
+goto do_illegal;
+}
 tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEUL);
 /* RISC-V requires NaN-boxing of narrower width floating point values 
*/
 tcg_gen_ori_i64(cpu_fpr[rd], cpu_fpr[rd], 0xULL);
 break;
 case OPC_RISC_FLD:
+if (!has_ext(ctx, RVD)) {
+goto do_illegal;
+}
 tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEQ);
 break;
+do_illegal:
 default:
 gen_exception_illegal(ctx);
 break;
@@ -730,11 +774,18 @@ static void gen_fp_store(DisasContext *ctx, uint32_t opc, 
int rs1,
 
 switch (opc) {
 case OPC_RISC_FSW:
+if 

[Qemu-devel] [PATCH v1 8/8] RISC-V: Add misa runtime write support

2019-01-14 Thread Alistair Francis
From: Michael Clark 

This patch adds support for writing misa. misa is validated based
on rules in the ISA specification. 'E' is mutually exclusive with
all other extensions. 'D' depends on 'F' so 'D' bit is dropped
if 'F' is not present. A conservative approach to consistency is
taken by flushing the translation cache on misa writes. misa_mask
is added to the CPU struct to store the original set of extensions.

Cc: Palmer Dabbelt 
Cc: Sagar Karandikar 
Cc: Bastian Koppelmann 
Cc: Alistair Francis 
Signed-off-by: Michael Clark 
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu.c  |  2 +-
 target/riscv/cpu.h  |  4 ++-
 target/riscv/cpu_bits.h | 11 +
 target/riscv/csr.c  | 54 -
 4 files changed, 68 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 28d7e5302f..cc3ddc0ae4 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -88,7 +88,7 @@ typedef struct RISCVCPUInfo {
 
 static void set_misa(CPURISCVState *env, target_ulong misa)
 {
-env->misa = misa;
+env->misa_mask = env->misa = misa;
 }
 
 static void set_versions(CPURISCVState *env, int user_ver, int priv_ver)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index a97435bd7b..5c2aebf132 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -86,7 +86,8 @@
so a cpu features bitfield is required, likewise for optional PMP support */
 enum {
 RISCV_FEATURE_MMU,
-RISCV_FEATURE_PMP
+RISCV_FEATURE_PMP,
+RISCV_FEATURE_MISA
 };
 
 #define USER_VERSION_2_02_0 0x00020200
@@ -118,6 +119,7 @@ struct CPURISCVState {
 target_ulong user_ver;
 target_ulong priv_ver;
 target_ulong misa;
+target_ulong misa_mask;
 
 uint32_t features;
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 5439f4719e..7afcb2468d 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -311,10 +311,21 @@
 #define MSTATUS32_SD0x8000
 #define MSTATUS64_SD0x8000ULL
 
+#define MISA32_MXL  0xC000
+#define MISA64_MXL  0xC000ULL
+
+#define MXL_RV321
+#define MXL_RV642
+#define MXL_RV128   3
+
 #if defined(TARGET_RISCV32)
 #define MSTATUS_SD MSTATUS32_SD
+#define MISA_MXL MISA32_MXL
+#define MXL_VAL MXL_RV32
 #elif defined(TARGET_RISCV64)
 #define MSTATUS_SD MSTATUS64_SD
+#define MISA_MXL MISA64_MXL
+#define MXL_VAL MXL_RV64
 #endif
 
 /* sstatus CSR bits */
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index e2bd374f09..e72fcf1265 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -332,6 +332,58 @@ static int read_misa(CPURISCVState *env, int csrno, 
target_ulong *val)
 return 0;
 }
 
+static int write_misa(CPURISCVState *env, int csrno, target_ulong val)
+{
+if (!riscv_feature(env, RISCV_FEATURE_MISA)) {
+/* drop write to misa */
+return 0;
+}
+
+/* 'I' or 'E' must be present */
+if (!(val & (RVI | RVE))) {
+/* It is not, drop write to misa */
+return 0;
+}
+
+/* 'E' excludes all other extensions */
+if (val & RVE) {
+/* when we support 'E' we can do "val = RVE;" however
+ * for now we just drop writes if 'E' is present.
+ */
+return 0;
+}
+
+/* Mask extensions that are not supported by this hart */
+val &= env->misa_mask;
+
+/* Mask extensions that are not supported by QEMU */
+val &= (RVI | RVE | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
+
+/* 'D' depends on 'F', so clear 'D' if 'F' is not present */
+if ((val & RVD) && !(val & RVF)) {
+val &= ~RVD;
+}
+
+/* Suppress 'C' if next instruction is not aligned
+ * TODO: this should check next_pc
+ */
+if ((val & RVC) && (GETPC() & ~3) != 0) {
+val &= ~RVC;
+}
+
+/* misa.MXL writes are not supported by QEMU */
+val = (env->misa & MISA_MXL) | (val & ~MISA_MXL);
+
+/* flush translation cache */
+if (val != env->misa) {
+tb_flush(CPU(riscv_env_get_cpu(env)));
+}
+
+env->misa = val;
+
+return 0;
+}
+
 static int read_medeleg(CPURISCVState *env, int csrno, target_ulong *val)
 {
 *val = env->medeleg;
@@ -810,7 +862,7 @@ static riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 
 /* Machine Trap Setup */
 [CSR_MSTATUS] = { any,  read_mstatus, write_mstatus },
-[CSR_MISA] ={ any,  read_misa   },
+[CSR_MISA] ={ any,  read_misa,write_misa},
 [CSR_MIDELEG] = { any,  read_mideleg, write_mideleg },
 [CSR_MEDELEG] = { any,  read_medeleg, write_medeleg },
 [CSR_MIE] = { any,  read_mie, write_mie },
-- 
2.19.1




[Qemu-devel] [PATCH v1 6/8] RISC-V: Add misa to DisasContext

2019-01-14 Thread Alistair Francis
From: Michael Clark 

gen methods should access state from DisasContext. Add misa
field to the DisasContext struct and remove CPURISCVState
argument from all gen methods.

Cc: Palmer Dabbelt 
Cc: Sagar Karandikar 
Cc: Bastian Koppelmann 
Cc: Alistair Francis 
Cc: Emilio G. Cota 
Signed-off-by: Michael Clark 
Reviewed-by: Richard Henderson 
Signed-off-by: Alistair Francis 
---
 target/riscv/translate.c | 75 +---
 1 file changed, 40 insertions(+), 35 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 833adf1d6f..7ebea308b4 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -46,6 +46,7 @@ typedef struct DisasContext {
 target_ulong priv_ver;
 uint32_t opcode;
 uint32_t mstatus_fs;
+uint32_t misa;
 uint32_t mem_idx;
 /* Remember the rounding mode encoded in the previous fp instruction,
which we have already installed into env->fp_status.  Or -1 for
@@ -75,6 +76,11 @@ static const int tcg_memop_lookup[8] = {
 #define CASE_OP_32_64(X) case X
 #endif
 
+static inline bool has_ext(DisasContext *ctx, uint32_t ext)
+{
+return ctx->misa & ext;
+}
+
 static void generate_exception(DisasContext *ctx, int excp)
 {
 tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
@@ -506,14 +512,13 @@ static void gen_arith_imm(DisasContext *ctx, uint32_t 
opc, int rd,
 tcg_temp_free(source1);
 }
 
-static void gen_jal(CPURISCVState *env, DisasContext *ctx, int rd,
-target_ulong imm)
+static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
 {
 target_ulong next_pc;
 
 /* check misaligned: */
 next_pc = ctx->base.pc_next + imm;
-if (!riscv_has_ext(env, RVC)) {
+if (!has_ext(ctx, RVC)) {
 if ((next_pc & 0x3) != 0) {
 gen_exception_inst_addr_mis(ctx);
 return;
@@ -527,8 +532,8 @@ static void gen_jal(CPURISCVState *env, DisasContext *ctx, 
int rd,
 ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_jalr(CPURISCVState *env, DisasContext *ctx, uint32_t opc,
- int rd, int rs1, target_long imm)
+static void gen_jalr(DisasContext *ctx, uint32_t opc, int rd, int rs1,
+ target_long imm)
 {
 /* no chaining with JALR */
 TCGLabel *misaligned = NULL;
@@ -540,7 +545,7 @@ static void gen_jalr(CPURISCVState *env, DisasContext *ctx, 
uint32_t opc,
 tcg_gen_addi_tl(cpu_pc, cpu_pc, imm);
 tcg_gen_andi_tl(cpu_pc, cpu_pc, (target_ulong)-2);
 
-if (!riscv_has_ext(env, RVC)) {
+if (!has_ext(ctx, RVC)) {
 misaligned = gen_new_label();
 tcg_gen_andi_tl(t0, cpu_pc, 0x2);
 tcg_gen_brcondi_tl(TCG_COND_NE, t0, 0x0, misaligned);
@@ -565,8 +570,8 @@ static void gen_jalr(CPURISCVState *env, DisasContext *ctx, 
uint32_t opc,
 tcg_temp_free(t0);
 }
 
-static void gen_branch(CPURISCVState *env, DisasContext *ctx, uint32_t opc,
-   int rs1, int rs2, target_long bimm)
+static void gen_branch(DisasContext *ctx, uint32_t opc, int rs1, int rs2,
+   target_long bimm)
 {
 TCGLabel *l = gen_new_label();
 TCGv source1, source2;
@@ -603,7 +608,7 @@ static void gen_branch(CPURISCVState *env, DisasContext 
*ctx, uint32_t opc,
 
 gen_goto_tb(ctx, 1, ctx->pc_succ_insn);
 gen_set_label(l); /* branch taken */
-if (!riscv_has_ext(env, RVC) && ((ctx->base.pc_next + bimm) & 0x3)) {
+if (!has_ext(ctx, RVC) && ((ctx->base.pc_next + bimm) & 0x3)) {
 /* misaligned */
 gen_exception_inst_addr_mis(ctx);
 } else {
@@ -1314,8 +1319,8 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 }
 }
 
-static void gen_system(CPURISCVState *env, DisasContext *ctx, uint32_t opc,
-  int rd, int rs1, int csr)
+static void gen_system(DisasContext *ctx, uint32_t opc, int rd, int rs1,
+   int csr)
 {
 TCGv source1, csr_store, dest, rs1_pass, imm_rs1;
 source1 = tcg_temp_new();
@@ -1361,7 +1366,7 @@ static void gen_system(CPURISCVState *env, DisasContext 
*ctx, uint32_t opc,
 gen_exception_illegal(ctx);
 break;
 case 0x102: /* SRET */
-if (riscv_has_ext(env, RVS)) {
+if (has_ext(ctx, RVS)) {
 gen_helper_sret(cpu_pc, cpu_env, cpu_pc);
 tcg_gen_exit_tb(NULL, 0); /* no chaining */
 ctx->base.is_jmp = DISAS_NORETURN;
@@ -1506,7 +1511,7 @@ static void decode_RV32_64C0(DisasContext *ctx)
 }
 }
 
-static void decode_RV32_64C1(CPURISCVState *env, DisasContext *ctx)
+static void decode_RV32_64C1(DisasContext *ctx)
 {
 uint8_t funct3 = extract32(ctx->opcode, 13, 3);
 uint8_t rd_rs1 = GET_C_RS1(ctx->opcode);
@@ -1526,7 +1531,7 @@ static void decode_RV32_64C1(CPURISCVState *env, 
DisasContext *ctx)
   GET_C_IMM(ctx->opcode));
 #else
 /* C.JAL(RV32) -> jal x1, offset[11:1] */
-gen_jal(env, 

[Qemu-devel] [PATCH v1 1/8] RISC-V: Split out mstatus_fs from tb_flags

2019-01-14 Thread Alistair Francis
From: Richard Henderson 

Cc: Sagar Karandikar 
Cc: Bastian Koppelmann 
Cc: Palmer Dabbelt 
Cc: Alistair Francis 
Cc: Richard Henderson 
Signed-off-by: Michael Clark 
Reviewed-by: Michael Clark 
Signed-off-by: Alistair Francis 
---
 target/riscv/cpu.h   |  6 +++---
 target/riscv/translate.c | 10 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 743f02c8b9..681341f5d5 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -275,8 +275,8 @@ void QEMU_NORETURN do_raise_exception_err(CPURISCVState 
*env,
 target_ulong cpu_riscv_get_fflags(CPURISCVState *env);
 void cpu_riscv_set_fflags(CPURISCVState *env, target_ulong);
 
-#define TB_FLAGS_MMU_MASK  3
-#define TB_FLAGS_FP_ENABLE MSTATUS_FS
+#define TB_FLAGS_MMU_MASK   3
+#define TB_FLAGS_MSTATUS_FS MSTATUS_FS
 
 static inline void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
 target_ulong *cs_base, uint32_t *flags)
@@ -284,7 +284,7 @@ static inline void cpu_get_tb_cpu_state(CPURISCVState *env, 
target_ulong *pc,
 *pc = env->pc;
 *cs_base = 0;
 #ifdef CONFIG_USER_ONLY
-*flags = TB_FLAGS_FP_ENABLE;
+*flags = TB_FLAGS_MSTATUS_FS;
 #else
 *flags = cpu_mmu_index(env, 0) | (env->mstatus & MSTATUS_FS);
 #endif
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 312bf298b3..3d07d651b6 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -44,7 +44,7 @@ typedef struct DisasContext {
 /* pc_succ_insn points to the instruction following base.pc_next */
 target_ulong pc_succ_insn;
 uint32_t opcode;
-uint32_t flags;
+uint32_t mstatus_fs;
 uint32_t mem_idx;
 /* Remember the rounding mode encoded in the previous fp instruction,
which we have already installed into env->fp_status.  Or -1 for
@@ -656,7 +656,7 @@ static void gen_fp_load(DisasContext *ctx, uint32_t opc, 
int rd,
 {
 TCGv t0;
 
-if (!(ctx->flags & TB_FLAGS_FP_ENABLE)) {
+if (ctx->mstatus_fs == 0) {
 gen_exception_illegal(ctx);
 return;
 }
@@ -686,7 +686,7 @@ static void gen_fp_store(DisasContext *ctx, uint32_t opc, 
int rs1,
 {
 TCGv t0;
 
-if (!(ctx->flags & TB_FLAGS_FP_ENABLE)) {
+if (ctx->mstatus_fs == 0) {
 gen_exception_illegal(ctx);
 return;
 }
@@ -945,7 +945,7 @@ static void gen_fp_arith(DisasContext *ctx, uint32_t opc, 
int rd,
 {
 TCGv t0 = NULL;
 
-if (!(ctx->flags & TB_FLAGS_FP_ENABLE)) {
+if (ctx->mstatus_fs == 0) {
 goto do_illegal;
 }
 
@@ -1818,8 +1818,8 @@ static void riscv_tr_init_disas_context(DisasContextBase 
*dcbase, CPUState *cs)
 DisasContext *ctx = container_of(dcbase, DisasContext, base);
 
 ctx->pc_succ_insn = ctx->base.pc_first;
-ctx->flags = ctx->base.tb->flags;
 ctx->mem_idx = ctx->base.tb->flags & TB_FLAGS_MMU_MASK;
+ctx->mstatus_fs = ctx->base.tb->flags & TB_FLAGS_MSTATUS_FS;
 ctx->frm = -1;  /* unknown rounding mode */
 }
 
-- 
2.19.1




[Qemu-devel] [PATCH v1 4/8] RISC-V: Use riscv prefix consistently on cpu helpers

2019-01-14 Thread Alistair Francis
From: Michael Clark 

* Add riscv prefix to raise_exception function
* Add riscv prefix to CSR read/write functions
* Add riscv prefix to signal handler function
* Add riscv prefix to get fflags function
* Remove redundant declaration of riscv_cpu_init
  and rename cpu_riscv_init to riscv_cpu_init
* rename riscv_set_mode to riscv_cpu_set_mode

Cc: Sagar Karandikar 
Cc: Bastian Koppelmann 
Cc: Palmer Dabbelt 
Cc: Alistair Francis 
Signed-off-by: Michael Clark 
Signed-off-by: Alistair Francis 
---
 linux-user/riscv/signal.c |  4 ++--
 target/riscv/cpu.h| 21 ++---
 target/riscv/cpu_helper.c | 10 +-
 target/riscv/csr.c|  8 
 target/riscv/fpu_helper.c |  6 +++---
 target/riscv/op_helper.c  | 28 ++--
 6 files changed, 38 insertions(+), 39 deletions(-)

diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
index f598d41891..83ecc6f799 100644
--- a/linux-user/riscv/signal.c
+++ b/linux-user/riscv/signal.c
@@ -83,7 +83,7 @@ static void setup_sigcontext(struct target_sigcontext *sc, 
CPURISCVState *env)
 __put_user(env->fpr[i], >fpr[i]);
 }
 
-uint32_t fcsr = csr_read_helper(env, CSR_FCSR); /*riscv_get_fcsr(env);*/
+uint32_t fcsr = riscv_csr_read(env, CSR_FCSR);
 __put_user(fcsr, >fcsr);
 }
 
@@ -159,7 +159,7 @@ static void restore_sigcontext(CPURISCVState *env, struct 
target_sigcontext *sc)
 
 uint32_t fcsr;
 __get_user(fcsr, >fcsr);
-csr_write_helper(env, fcsr, CSR_FCSR);
+riscv_csr_write(env, CSR_FCSR, fcsr);
 }
 
 static void restore_ucontext(CPURISCVState *env, struct target_ucontext *uc)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 681341f5d5..a97435bd7b 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -256,7 +256,7 @@ int riscv_cpu_handle_mmu_fault(CPUState *cpu, vaddr 
address, int size,
 char *riscv_isa_string(RISCVCPU *cpu);
 void riscv_cpu_list(FILE *f, fprintf_function cpu_fprintf);
 
-#define cpu_signal_handler cpu_riscv_signal_handler
+#define cpu_signal_handler riscv_cpu_signal_handler
 #define cpu_list riscv_cpu_list
 #define cpu_mmu_index riscv_cpu_mmu_index
 
@@ -264,16 +264,15 @@ void riscv_cpu_list(FILE *f, fprintf_function 
cpu_fprintf);
 uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value);
 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
 #endif
-void riscv_set_mode(CPURISCVState *env, target_ulong newpriv);
+void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
 
 void riscv_translate_init(void);
-RISCVCPU *cpu_riscv_init(const char *cpu_model);
-int cpu_riscv_signal_handler(int host_signum, void *pinfo, void *puc);
-void QEMU_NORETURN do_raise_exception_err(CPURISCVState *env,
-  uint32_t exception, uintptr_t pc);
+int riscv_cpu_signal_handler(int host_signum, void *pinfo, void *puc);
+void QEMU_NORETURN riscv_raise_exception(CPURISCVState *env,
+ uint32_t exception, uintptr_t pc);
 
-target_ulong cpu_riscv_get_fflags(CPURISCVState *env);
-void cpu_riscv_set_fflags(CPURISCVState *env, target_ulong);
+target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
+void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
 
 #define TB_FLAGS_MMU_MASK   3
 #define TB_FLAGS_MSTATUS_FS MSTATUS_FS
@@ -293,13 +292,13 @@ static inline void cpu_get_tb_cpu_state(CPURISCVState 
*env, target_ulong *pc,
 int riscv_csrrw(CPURISCVState *env, int csrno, target_ulong *ret_value,
 target_ulong new_value, target_ulong write_mask);
 
-static inline void csr_write_helper(CPURISCVState *env, target_ulong val,
-int csrno)
+static inline void riscv_csr_write(CPURISCVState *env, int csrno,
+   target_ulong val)
 {
 riscv_csrrw(env, csrno, NULL, val, MAKE_64BIT_MASK(0, TARGET_LONG_BITS));
 }
 
-static inline target_ulong csr_read_helper(CPURISCVState *env, int csrno)
+static inline target_ulong riscv_csr_read(CPURISCVState *env, int csrno)
 {
 target_ulong val = 0;
 riscv_csrrw(env, csrno, , 0, 0);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index f257050f12..f49e98ed59 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -93,7 +93,7 @@ uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, 
uint32_t value)
 return old;
 }
 
-void riscv_set_mode(CPURISCVState *env, target_ulong newpriv)
+void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
 {
 if (newpriv > PRV_M) {
 g_assert_not_reached();
@@ -366,7 +366,7 @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 g_assert_not_reached();
 }
 env->badaddr = addr;
-do_raise_exception_err(env, cs->exception_index, retaddr);
+riscv_raise_exception(env, cs->exception_index, retaddr);
 }
 
 /* called by qemu's softmmu to fill the qemu tlb */
@@ -378,7 +378,7 @@ void tlb_fill(CPUState 

[Qemu-devel] [PATCH v1 5/8] RISC-V: Add priv_ver to DisasContext

2019-01-14 Thread Alistair Francis
The gen methods should access state from DisasContext. Add priv_ver
field to the DisasContext struct.

Signed-off-by: Alistair Francis 
---
 target/riscv/translate.c | 9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 0581b3c1f7..833adf1d6f 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -43,6 +43,7 @@ typedef struct DisasContext {
 DisasContextBase base;
 /* pc_succ_insn points to the instruction following base.pc_next */
 target_ulong pc_succ_insn;
+target_ulong priv_ver;
 uint32_t opcode;
 uint32_t mstatus_fs;
 uint32_t mem_idx;
@@ -1330,7 +1331,7 @@ static void gen_system(CPURISCVState *env, DisasContext 
*ctx, uint32_t opc,
 #ifndef CONFIG_USER_ONLY
 /* Extract funct7 value and check whether it matches SFENCE.VMA */
 if ((opc == OPC_RISC_ECALL) && ((csr >> 5) == 9)) {
-if (env->priv_ver == PRIV_VERSION_1_10_0) {
+if (ctx->priv_ver == PRIV_VERSION_1_10_0) {
 /* sfence.vma */
 /* TODO: handle ASID specific fences */
 gen_helper_tlb_flush(cpu_env);
@@ -1384,7 +1385,7 @@ static void gen_system(CPURISCVState *env, DisasContext 
*ctx, uint32_t opc,
 gen_helper_wfi(cpu_env);
 break;
 case 0x104: /* SFENCE.VM */
-if (env->priv_ver <= PRIV_VERSION_1_09_1) {
+if (ctx->priv_ver <= PRIV_VERSION_1_09_1) {
 gen_helper_tlb_flush(cpu_env);
 } else {
 gen_exception_illegal(ctx);
@@ -1851,13 +1852,15 @@ static void decode_opc(CPURISCVState *env, DisasContext 
*ctx)
 }
 }
 
-static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState 
*cpu)
 {
 DisasContext *ctx = container_of(dcbase, DisasContext, base);
+CPURISCVState *env = cpu->env_ptr;
 
 ctx->pc_succ_insn = ctx->base.pc_first;
 ctx->mem_idx = ctx->base.tb->flags & TB_FLAGS_MMU_MASK;
 ctx->mstatus_fs = ctx->base.tb->flags & TB_FLAGS_MSTATUS_FS;
+ctx->priv_ver = env->priv_ver;
 ctx->frm = -1;  /* unknown rounding mode */
 }
 
-- 
2.19.1




[Qemu-devel] [PATCH v1 3/8] RISC-V: Implement mstatus.TSR/TW/TVM

2019-01-14 Thread Alistair Francis
From: Michael Clark 

This adds the necessary minimum to support S-mode
virtualization for priv ISA >= v1.10

Cc: Sagar Karandikar 
Cc: Bastian Koppelmann 
Cc: Palmer Dabbelt 
Cc: Alistair Francis 
Cc: Matthew Suozzo 
Signed-off-by: Michael Clark 
Signed-off-by: Alistair Francis 

Co-authored-by: Matthew Suozzo 
Co-authored-by: Michael Clark 
---
 target/riscv/csr.c   | 17 +
 target/riscv/op_helper.c | 25 +
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 5714147689..390d3a9a56 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -305,7 +305,8 @@ static int write_mstatus(CPURISCVState *env, int csrno, 
target_ulong val)
 }
 mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
 MSTATUS_SPP | MSTATUS_FS | MSTATUS_MPRV | MSTATUS_SUM |
-MSTATUS_MPP | MSTATUS_MXR;
+MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
+MSTATUS_TW;
 }
 
 /* silenty discard mstatus.mpp writes for unsupported modes */
@@ -642,7 +643,11 @@ static int read_satp(CPURISCVState *env, int csrno, 
target_ulong *val)
 if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
 *val = 0;
 } else if (env->priv_ver >= PRIV_VERSION_1_10_0) {
-*val = env->satp;
+if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
+return -1;
+} else {
+*val = env->satp;
+}
 } else {
 *val = env->sptbr;
 }
@@ -663,8 +668,12 @@ static int write_satp(CPURISCVState *env, int csrno, 
target_ulong val)
 validate_vm(env, get_field(val, SATP_MODE)) &&
 ((val ^ env->satp) & (SATP_MODE | SATP_ASID | SATP_PPN)))
 {
-tlb_flush(CPU(riscv_env_get_cpu(env)));
-env->satp = val;
+if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
+return -1;
+} else {
+tlb_flush(CPU(riscv_env_get_cpu(env)));
+env->satp = val;
+}
 }
 return 0;
 }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 81bd1a77ea..77c79ba36e 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -82,6 +82,11 @@ target_ulong helper_sret(CPURISCVState *env, target_ulong 
cpu_pc_deb)
 do_raise_exception_err(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
 }
 
+if (env->priv_ver >= PRIV_VERSION_1_10_0 &&
+get_field(env->mstatus, MSTATUS_TSR)) {
+do_raise_exception_err(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+}
+
 target_ulong mstatus = env->mstatus;
 target_ulong prev_priv = get_field(mstatus, MSTATUS_SPP);
 mstatus = set_field(mstatus,
@@ -125,16 +130,28 @@ void helper_wfi(CPURISCVState *env)
 {
 CPUState *cs = CPU(riscv_env_get_cpu(env));
 
-cs->halted = 1;
-cs->exception_index = EXCP_HLT;
-cpu_loop_exit(cs);
+if (env->priv == PRV_S &&
+env->priv_ver >= PRIV_VERSION_1_10_0 &&
+get_field(env->mstatus, MSTATUS_TW)) {
+do_raise_exception_err(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+} else {
+cs->halted = 1;
+cs->exception_index = EXCP_HLT;
+cpu_loop_exit(cs);
+}
 }
 
 void helper_tlb_flush(CPURISCVState *env)
 {
 RISCVCPU *cpu = riscv_env_get_cpu(env);
 CPUState *cs = CPU(cpu);
-tlb_flush(cs);
+if (env->priv == PRV_S &&
+env->priv_ver >= PRIV_VERSION_1_10_0 &&
+get_field(env->mstatus, MSTATUS_TVM)) {
+do_raise_exception_err(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+} else {
+tlb_flush(cs);
+}
 }
 
 #endif /* !CONFIG_USER_ONLY */
-- 
2.19.1




[Qemu-devel] [PATCH v1 0/8] Upstream RISC-V fork patches, part 3

2019-01-14 Thread Alistair Francis


Alistair Francis (1):
  RISC-V: Add priv_ver to DisasContext

Michael Clark (5):
  RISC-V: Implement mstatus.TSR/TW/TVM
  RISC-V: Use riscv prefix consistently on cpu helpers
  RISC-V: Add misa to DisasContext
  RISC-V: Add misa.MAFD checks to translate
  RISC-V: Add misa runtime write support

Richard Henderson (2):
  RISC-V: Split out mstatus_fs from tb_flags
  RISC-V: Mark mstatus.fs dirty

 linux-user/riscv/signal.c |   4 +-
 target/riscv/cpu.c|   2 +-
 target/riscv/cpu.h|  31 ++--
 target/riscv/cpu_bits.h   |  11 ++
 target/riscv/cpu_helper.c |  10 +-
 target/riscv/csr.c|  91 +---
 target/riscv/fpu_helper.c |   6 +-
 target/riscv/op_helper.c  |  47 --
 target/riscv/translate.c  | 292 --
 9 files changed, 388 insertions(+), 106 deletions(-)

-- 
2.19.1




[Qemu-devel] [PULL 62/65] slirp: set G_LOG_DOMAIN

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

We are moving to g_log() facilities to log errors and probably debug
messages too. Let's have the "Slirp" prefix on messages slirp produces.

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 slirp/Makefile.objs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/slirp/Makefile.objs b/slirp/Makefile.objs
index 21653f69e9..959558c732 100644
--- a/slirp/Makefile.objs
+++ b/slirp/Makefile.objs
@@ -28,3 +28,5 @@ slirp.mo-objs = \
udp.o \
udp6.o \
$(NULL)
+
+slirp.mo-cflags = -DG_LOG_DOMAIN=\"Slirp\"
-- 
2.20.1




[Qemu-devel] [PULL 56/65] slirp: use %p for pointers format

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

This fixes some compilation warnings on mingw64.

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 slirp/ip6_icmp.c   | 2 +-
 slirp/ip6_input.c  | 2 +-
 slirp/ip6_output.c | 4 ++--
 slirp/udp6.c   | 6 +++---
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/slirp/ip6_icmp.c b/slirp/ip6_icmp.c
index 595a62c8d4..bce075913c 100644
--- a/slirp/ip6_icmp.c
+++ b/slirp/ip6_icmp.c
@@ -390,7 +390,7 @@ void icmp6_input(struct mbuf *m)
 int hlen = sizeof(struct ip6);
 
 DEBUG_CALL("icmp6_input");
-DEBUG_ARG("m = %lx", (long) m);
+DEBUG_ARG("m = %p", m);
 DEBUG_ARG("m_len = %d", m->m_len);
 
 if (ntohs(ip->ip_pl) < ICMP6_MINLEN) {
diff --git a/slirp/ip6_input.c b/slirp/ip6_input.c
index ac2e3ea882..ab656a0a9d 100644
--- a/slirp/ip6_input.c
+++ b/slirp/ip6_input.c
@@ -31,7 +31,7 @@ void ip6_input(struct mbuf *m)
 }
 
 DEBUG_CALL("ip6_input");
-DEBUG_ARG("m = %lx", (long)m);
+DEBUG_ARG("m = %p", m);
 DEBUG_ARG("m_len = %d", m->m_len);
 
 if (m->m_len < sizeof(struct ip6)) {
diff --git a/slirp/ip6_output.c b/slirp/ip6_output.c
index 762cbfe89c..52c88ad691 100644
--- a/slirp/ip6_output.c
+++ b/slirp/ip6_output.c
@@ -19,8 +19,8 @@ int ip6_output(struct socket *so, struct mbuf *m, int fast)
 struct ip6 *ip = mtod(m, struct ip6 *);
 
 DEBUG_CALL("ip6_output");
-DEBUG_ARG("so = %lx", (long)so);
-DEBUG_ARG("m = %lx", (long)m);
+DEBUG_ARG("so = %p", so);
+DEBUG_ARG("m = %p", m);
 
 /* Fill IPv6 header */
 ip->ip_v = IP6VERSION;
diff --git a/slirp/udp6.c b/slirp/udp6.c
index 473ba1586e..8cdb1892e2 100644
--- a/slirp/udp6.c
+++ b/slirp/udp6.c
@@ -20,7 +20,7 @@ void udp6_input(struct mbuf *m)
 struct sockaddr_in6 lhost;
 
 DEBUG_CALL("udp6_input");
-DEBUG_ARG("m = %lx", (long)m);
+DEBUG_ARG("m = %p", m);
 
 if (slirp->restricted) {
 goto bad;
@@ -144,8 +144,8 @@ int udp6_output(struct socket *so, struct mbuf *m,
 struct udphdr *uh;
 
 DEBUG_CALL("udp6_output");
-DEBUG_ARG("so = %lx", (long)so);
-DEBUG_ARG("m = %lx", (long)m);
+DEBUG_ARG("so = %p", so);
+DEBUG_ARG("m = %p", m);
 
 /* adjust for header */
 m->m_data -= sizeof(struct udphdr);
-- 
2.20.1




[Qemu-devel] [PULL 55/65] slirp: introduce SLIRP_DEBUG environment variable

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

Learn to read SLIRP_DEBUG=call,misc,error (all or help also handled)
to set the slirp_debug flags.

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 slirp/misc.c  |  8 
 slirp/slirp.c | 15 +++
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/slirp/misc.c b/slirp/misc.c
index e30d2ceb2a..a0f104be5e 100644
--- a/slirp/misc.c
+++ b/slirp/misc.c
@@ -11,14 +11,6 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 
-#ifdef DEBUG
-#define SLIRP_DEBUG (DBG_CALL | DBG_MISC | DBG_ERROR)
-#else
-#define SLIRP_DEBUG 0
-#endif
-
-int slirp_debug = SLIRP_DEBUG;
-
 inline void
 insque(void *a, void *b)
 {
diff --git a/slirp/slirp.c b/slirp/slirp.c
index ce5f571d0f..0b70cb9fb6 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -35,6 +35,8 @@
 #include 
 #endif
 
+int slirp_debug;
+
 /* Define to 1 if you want KEEPALIVE timers */
 bool slirp_do_keepalive;
 
@@ -250,6 +252,7 @@ int get_dns6_addr(struct in6_addr *pdns6_addr, uint32_t 
*scope_id)
 static void slirp_init_once(void)
 {
 static int initialized;
+const char *debug;
 #ifdef _WIN32
 WSADATA Data;
 #endif
@@ -266,6 +269,18 @@ static void slirp_init_once(void)
 
 loopback_addr.s_addr = htonl(INADDR_LOOPBACK);
 loopback_mask = htonl(IN_CLASSA_NET);
+
+debug = g_getenv("SLIRP_DEBUG");
+if (debug) {
+const GDebugKey keys[] = {
+{ "call", DBG_CALL },
+{ "misc", DBG_MISC },
+{ "error", DBG_ERROR },
+};
+slirp_debug = g_parse_debug_string(debug, keys, G_N_ELEMENTS(keys));
+}
+
+
 }
 
 static void slirp_state_save(QEMUFile *f, void *opaque);
-- 
2.20.1




[Qemu-devel] [PULL 53/65] slirp: no need to make DPRINTF conditional on DEBUG

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

DEBUG_CALL is already handled conditionally.

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 slirp/bootp.c | 7 ++-
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/slirp/bootp.c b/slirp/bootp.c
index 5ab6692038..4c9a77eb98 100644
--- a/slirp/bootp.c
+++ b/slirp/bootp.c
@@ -36,11 +36,7 @@
 
 static const uint8_t rfc1533_cookie[] = { RFC1533_COOKIE };
 
-#ifdef DEBUG
 #define DPRINTF(fmt, ...) DEBUG_CALL(fmt, ##__VA_ARGS__)
-#else
-#define DPRINTF(fmt, ...) do{}while(0)
-#endif
 
 static BOOTPClient *get_new_addr(Slirp *slirp, struct in_addr *paddr,
  const uint8_t *macaddr)
@@ -166,8 +162,9 @@ static void bootp_reply(Slirp *slirp, const struct bootp_t 
*bp)
 DPRINTF("bootp packet op=%d msgtype=%d", bp->bp_op, dhcp_msg_type);
 if (preq_addr.s_addr != htonl(0L))
 DPRINTF(" req_addr=%08" PRIx32 "\n", ntohl(preq_addr.s_addr));
-else
+else {
 DPRINTF("\n");
+}
 
 if (dhcp_msg_type == 0)
 dhcp_msg_type = DHCPREQUEST; /* Force reply for old BOOTP clients */
-- 
2.20.1




[Qemu-devel] [PULL 48/65] slirp: rename exec_list

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

This list is not only used to handle command to execute on guest
connection, it can also redirect to an arbitrary object, such as a
chardev. Let's rename the struct and the field to "guestfwd".

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 slirp/misc.c  |  6 +++---
 slirp/misc.h  |  6 +++---
 slirp/slirp.c | 18 +-
 slirp/slirp.h |  2 +-
 slirp/tcp_input.c |  6 +++---
 slirp/tcp_subr.c  |  4 ++--
 6 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/slirp/misc.c b/slirp/misc.c
index 2d092624d3..526cefa0f1 100644
--- a/slirp/misc.c
+++ b/slirp/misc.c
@@ -36,10 +36,10 @@ remque(void *a)
   element->qh_rlink = NULL;
 }
 
-int add_exec(struct ex_list **ex_ptr, void *chardev, const char *cmdline,
+int add_exec(struct gfwd_list **ex_ptr, void *chardev, const char *cmdline,
  struct in_addr addr, int port)
 {
-   struct ex_list *tmp_ptr;
+   struct gfwd_list *tmp_ptr;
 
/* First, check if the port is "bound" */
for (tmp_ptr = *ex_ptr; tmp_ptr; tmp_ptr = tmp_ptr->ex_next) {
@@ -49,7 +49,7 @@ int add_exec(struct ex_list **ex_ptr, void *chardev, const 
char *cmdline,
}
 
tmp_ptr = *ex_ptr;
-   *ex_ptr = g_new0(struct ex_list, 1);
+   *ex_ptr = g_new0(struct gfwd_list, 1);
(*ex_ptr)->ex_fport = port;
(*ex_ptr)->ex_addr = addr;
if (chardev) {
diff --git a/slirp/misc.h b/slirp/misc.h
index 0bc5e74bc5..1df707c052 100644
--- a/slirp/misc.h
+++ b/slirp/misc.h
@@ -8,12 +8,12 @@
 #ifndef MISC_H
 #define MISC_H
 
-struct ex_list {
+struct gfwd_list {
void *ex_chardev;
struct in_addr ex_addr; /* Server address */
int ex_fport;   /* Port to telnet to */
char *ex_exec;  /* Command line of what to exec */
-   struct ex_list *ex_next;
+   struct gfwd_list *ex_next;
 };
 
 #define EMU_NONE 0x0
@@ -51,7 +51,7 @@ struct slirp_quehead {
 
 void slirp_insque(void *, void *);
 void slirp_remque(void *);
-int add_exec(struct ex_list **, void *, const char *, struct in_addr, int);
+int add_exec(struct gfwd_list **, void *, const char *, struct in_addr, int);
 int fork_exec(struct socket *so, const char *ex);
 
 #endif
diff --git a/slirp/slirp.c b/slirp/slirp.c
index 591dd1fcb4..e860750f72 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -345,9 +345,9 @@ Slirp *slirp_init(int restricted, bool in_enabled, struct 
in_addr vnetwork,
 
 void slirp_cleanup(Slirp *slirp)
 {
-struct ex_list *e, *next;
+struct gfwd_list *e, *next;
 
-for (e = slirp->exec_list; e; e = next) {
+for (e = slirp->guestfwd_list; e; e = next) {
 next = e->ex_next;
 g_free(e->ex_exec);
 g_free(e);
@@ -760,7 +760,7 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int 
pkt_len)
 struct ethhdr *reh = (struct ethhdr *)arp_reply;
 struct slirp_arphdr *rah = (struct slirp_arphdr *)(arp_reply + ETH_HLEN);
 int ar_op;
-struct ex_list *ex_ptr;
+struct gfwd_list *ex_ptr;
 
 if (!slirp->in_enabled) {
 return;
@@ -780,7 +780,7 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int 
pkt_len)
 if (ah->ar_tip == slirp->vnameserver_addr.s_addr ||
 ah->ar_tip == slirp->vhost_addr.s_addr)
 goto arp_ok;
-for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
+for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = 
ex_ptr->ex_next) {
 if (ex_ptr->ex_addr.s_addr == ah->ar_tip)
 goto arp_ok;
 }
@@ -1052,7 +1052,7 @@ int slirp_add_exec(Slirp *slirp, void *chardev, const 
char *cmdline,
 return -1;
 }
 
-return add_exec(>exec_list, chardev, cmdline, *guest_addr,
+return add_exec(>guestfwd_list, chardev, cmdline, *guest_addr,
 htons(guest_port));
 }
 
@@ -1423,9 +1423,9 @@ static const VMStateDescription vmstate_slirp = {
 static void slirp_state_save(QEMUFile *f, void *opaque)
 {
 Slirp *slirp = opaque;
-struct ex_list *ex_ptr;
+struct gfwd_list *ex_ptr;
 
-for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
+for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
 if (ex_ptr->ex_chardev) {
 struct socket *so;
 so = slirp_find_ctl_socket(slirp, ex_ptr->ex_addr,
@@ -1445,7 +1445,7 @@ static void slirp_state_save(QEMUFile *f, void *opaque)
 static int slirp_state_load(QEMUFile *f, void *opaque, int version_id)
 {
 Slirp *slirp = opaque;
-struct ex_list *ex_ptr;
+struct gfwd_list *ex_ptr;
 
 while (qemu_get_byte(f)) {
 int ret;
@@ -1460,7 +1460,7 @@ static int slirp_state_load(QEMUFile *f, void *opaque, 
int version_id)
 slirp->vnetwork_addr.s_addr) {
 return -EINVAL;
 }
-for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
+

[Qemu-devel] [PULL 50/65] slirp: replace a fprintf with g_critical()

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

Reduce dependency on QEMU. QEMU could use a custom glib log handler if
it wants to redirect/filter it.

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 slirp/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/slirp/socket.c b/slirp/socket.c
index 677fd20c9d..08a065f6a7 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -285,7 +285,7 @@ err:
 
 sofcantrcvmore(so);
 tcp_sockclosed(sototcpcb(so));
-fprintf(stderr, "soreadbuf buffer to small");
+g_critical("soreadbuf buffer too small");
 return -1;
 }
 
-- 
2.20.1




[Qemu-devel] [PULL 61/65] build-sys: use a separate slirp-obj-y && slirp.mo

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

This will allow to have cflags for the whole slirp.mo -objs.
It makes it possible to build tests that links only with
slirp-obj-y (and not the whole common-obj).

It is also a step towards building slirp as a shared library, although
this requires a bit more thoughts to build with
net/slirp.o (CONFIG_SLIRP would need to be 'm') and other build issues.

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 Makefile|  5 +++--
 Makefile.objs   |  3 +--
 Makefile.target |  5 -
 slirp/Makefile.objs | 35 ++-
 4 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/Makefile b/Makefile
index a9ac16d94e..dccba1dca2 100644
--- a/Makefile
+++ b/Makefile
@@ -379,7 +379,8 @@ dummy := $(call unnest-vars,, \
 ui-obj-m \
 audio-obj-y \
 audio-obj-m \
-trace-obj-y)
+trace-obj-y \
+slirp-obj-y)
 
 include $(SRC_PATH)/tests/Makefile.include
 
@@ -452,7 +453,7 @@ CAP_CFLAGS += -DCAPSTONE_HAS_X86
 subdir-capstone: .git-submodule-status
$(call quiet-command,$(MAKE) -C $(SRC_PATH)/capstone CAPSTONE_SHARED=no 
BUILDDIR="$(BUILD_DIR)/capstone" CC="$(CC)" AR="$(AR)" LD="$(LD)" 
RANLIB="$(RANLIB)" CFLAGS="$(CAP_CFLAGS)" $(SUBDIR_MAKEFLAGS) 
$(BUILD_DIR)/capstone/$(LIBCAPSTONE))
 
-$(SUBDIR_RULES): libqemuutil.a $(common-obj-y) $(chardev-obj-y) \
+$(SUBDIR_RULES): libqemuutil.a $(common-obj-y) $(chardev-obj-y) $(slirp-obj-y) 
\
$(qom-obj-y) $(crypto-aes-obj-$(CONFIG_USER_ONLY))
 
 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
diff --git a/Makefile.objs b/Makefile.objs
index 2121120492..67a054b08a 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -17,6 +17,7 @@ util-obj-y += $(QAPI_MODULES:%=qapi/qapi-events-%.o)
 util-obj-y += qapi/qapi-introspect.o
 
 chardev-obj-y = chardev/
+slirp-obj-$(CONFIG_SLIRP) = slirp/
 
 ###
 # block-obj-y is code used by both qemu system emulation and qemu-img
@@ -79,8 +80,6 @@ common-obj-y += vl.o
 vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS)
 common-obj-$(CONFIG_TPM) += tpm.o
 
-common-obj-$(CONFIG_SLIRP) += slirp/
-
 common-obj-y += backends/
 common-obj-y += chardev/
 
diff --git a/Makefile.target b/Makefile.target
index 44ec4b630c..39f72e81be 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -165,6 +165,7 @@ target-obj-y :=
 block-obj-y :=
 common-obj-y :=
 chardev-obj-y :=
+slirp-obj-y :=
 include $(SRC_PATH)/Makefile.objs
 dummy := $(call unnest-vars,,target-obj-y)
 target-obj-y-save := $(target-obj-y)
@@ -177,7 +178,8 @@ dummy := $(call unnest-vars,.., \
qom-obj-y \
io-obj-y \
common-obj-y \
-   common-obj-m)
+   common-obj-m \
+   slirp-obj-y)
 target-obj-y := $(target-obj-y-save)
 all-obj-y += $(common-obj-y)
 all-obj-y += $(target-obj-y)
@@ -186,6 +188,7 @@ all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y) $(chardev-obj-y)
 all-obj-$(CONFIG_USER_ONLY) += $(crypto-aes-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(crypto-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(io-obj-y)
+all-obj-$(CONFIG_SOFTMMU) += $(slirp-obj-y)
 
 $(QEMU_PROG_BUILD): config-devices.mak
 
diff --git a/slirp/Makefile.objs b/slirp/Makefile.objs
index 28049b03cd..21653f69e9 100644
--- a/slirp/Makefile.objs
+++ b/slirp/Makefile.objs
@@ -1,5 +1,30 @@
-common-obj-y = cksum.o if.o ip_icmp.o ip6_icmp.o ip6_input.o ip6_output.o \
-   ip_input.o ip_output.o dnssearch.o dhcpv6.o
-common-obj-y += slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o
-common-obj-y += tcp_subr.o tcp_timer.o udp.o udp6.o bootp.o tftp.o arp_table.o 
\
-ndp_table.o ncsi.o
+slirp-obj-y = slirp.mo
+
+slirp.mo-objs = \
+   arp_table.o \
+   bootp.o \
+   cksum.o \
+   dhcpv6.o \
+   dnssearch.o \
+   if.o \
+   ip6_icmp.o \
+   ip6_input.o \
+   ip6_output.o \
+   ip_icmp.o \
+   ip_input.o \
+   ip_output.o \
+   mbuf.o \
+   misc.o \
+   ncsi.o \
+   ndp_table.o \
+   sbuf.o \
+   slirp.o \
+   socket.o \
+   tcp_input.o \
+   tcp_output.o \
+   tcp_subr.o \
+   tcp_timer.o \
+   tftp.o \
+   udp.o \
+   udp6.o \
+   $(NULL)
-- 
2.20.1




[Qemu-devel] [PULL 43/65] glib-compat: add g_spawn_async_with_fds() fallback

2019-01-14 Thread Samuel Thibault
From: Marc-André Lureau 

Signed-off-by: Marc-André Lureau 
Signed-off-by: Samuel Thibault 
---
 include/glib-compat.h | 56 +++
 1 file changed, 56 insertions(+)

diff --git a/include/glib-compat.h b/include/glib-compat.h
index fdf95a255d..8a078c5288 100644
--- a/include/glib-compat.h
+++ b/include/glib-compat.h
@@ -83,6 +83,62 @@ static inline gboolean g_strv_contains_qemu(const gchar 
*const *strv,
 }
 #define g_strv_contains(a, b) g_strv_contains_qemu(a, b)
 
+#if !GLIB_CHECK_VERSION(2, 58, 0)
+typedef struct QemuGSpawnFds {
+GSpawnChildSetupFunc child_setup;
+gpointer user_data;
+gint stdin_fd;
+gint stdout_fd;
+gint stderr_fd;
+} QemuGSpawnFds;
+
+static inline void
+qemu_gspawn_fds_setup(gpointer user_data)
+{
+QemuGSpawnFds *q = (QemuGSpawnFds *)user_data;
+
+dup2(q->stdin_fd, 0);
+dup2(q->stdout_fd, 1);
+dup2(q->stderr_fd, 2);
+q->child_setup(q->user_data);
+}
+#endif
+
+static inline gboolean
+g_spawn_async_with_fds_qemu(const gchar *working_directory,
+gchar **argv,
+gchar **envp,
+GSpawnFlags flags,
+GSpawnChildSetupFunc child_setup,
+gpointer user_data,
+GPid *child_pid,
+gint stdin_fd,
+gint stdout_fd,
+gint stderr_fd,
+GError **error)
+{
+#if GLIB_CHECK_VERSION(2, 58, 0)
+return g_spawn_async_with_fds(working_directory, argv, envp, flags,
+  child_setup, user_data,
+  child_pid, stdin_fd, stdout_fd, stderr_fd,
+  error);
+#else
+QemuGSpawnFds setup = {
+.child_setup = child_setup,
+.user_data = user_data,
+.stdin_fd = stdin_fd,
+.stdout_fd = stdout_fd,
+.stderr_fd = stderr_fd,
+};
+
+return g_spawn_async(working_directory, argv, envp, flags,
+ qemu_gspawn_fds_setup, ,
+ child_pid, error);
+#endif
+}
+
+#define g_spawn_async_with_fds(wd, argv, env, f, c, d, p, ifd, ofd, efd, err) \
+g_spawn_async_with_fds_qemu(wd, argv, env, f, c, d, p, ifd, ofd, efd, err)
 
 #if defined(_WIN32) && !GLIB_CHECK_VERSION(2, 50, 0)
 /*
-- 
2.20.1




Re: [Qemu-devel] [PATCH v2 3/3] util: check the return value of fcntl in qemu_set_{block, nonblock}

2019-01-14 Thread Michael S. Tsirkin
On Wed, Jan 02, 2019 at 03:07:24PM +0100, Thomas Huth wrote:
> On 2018-12-15 13:03, Li Qiang wrote:
> > Assert that the return value is not an error. This is like commit
> > 7e6478e7d4f for qemu_set_cloexec.
> > 
> > Signed-off-by: Li Qiang 
> > ---
> >  util/oslib-posix.c | 8 ++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/util/oslib-posix.c b/util/oslib-posix.c
> > index c1bee2a581..4ce1ba9ca4 100644
> > --- a/util/oslib-posix.c
> > +++ b/util/oslib-posix.c
> > @@ -233,14 +233,18 @@ void qemu_set_block(int fd)
> >  {
> >  int f;
> >  f = fcntl(fd, F_GETFL);
> > -fcntl(fd, F_SETFL, f & ~O_NONBLOCK);
> > +assert(f != -1);
> > +f = fcntl(fd, F_SETFL, f & ~O_NONBLOCK);
> > +assert(f != -1);
> >  }
> >  
> >  void qemu_set_nonblock(int fd)
> >  {
> >  int f;
> >  f = fcntl(fd, F_GETFL);
> > -fcntl(fd, F_SETFL, f | O_NONBLOCK);
> > +assert(f != -1);
> > +f = fcntl(fd, F_SETFL, f | O_NONBLOCK);
> > +assert(f != -1);
> >  }
> 
> Reviewed-by: Thomas Huth 
> 
> Michael, could you take this patch series through your vhost tree? Or
> shall I pick them up for the qtests tree? In the latter case, please
> provide an ACK for the second patch.

Did not see it merged so I merged it.




  1   2   3   4   5   6   >