Does memory hotplug work when VFIO device already attached

2020-05-16 Thread Simon
Hi,

I am trying do memory hotplug(add new memory DIMM)  in an VM attached with
VFIO device (host running with 4.9 kernel). What I observed is weird:
If my original VM is 10G (already occupies 10G RSS at host), and hotplug
add 30G DIMM to qemu,  the RSS of qemu keeps growing until nearly 39G and
suddenly drops down to 10G or ever lower. Then the RSS grows again towards
40G. The free of host keeps decreasing and it triggers OOM at last.

My question is: is this scenario valid and ever supported? (maybe some bugs
in my environment).  Is there any known problem to Qemu memory hotplug
(attached VFIO device)?

Thanks,
- Simon


Re: [PATCH Kernel v21 0/8] Add UAPIs to support migration for VFIO devices

2020-05-16 Thread Kirti Wankhede



On 5/16/2020 5:17 AM, Tian, Kevin wrote:

Hi, Kirti,

Will you send out a new version in Qemu side, or previous v16 still applies?



v16 doesn't work as now migration capability is added to iommu info 
chain. I'll send out new version of QEMU side tomorrow, though I'm not 
able to update QEMU side patches with all review comments on those 
patches. Still I'll send out QEMU patches which are compatible with v21 
and will cover rest of the comments in later revision.


Thanks,
Kirti


Thanks
Kevin


From: Kirti Wankhede
Sent: Saturday, May 16, 2020 5:13 AM

Hi,

This patch set adds:
* IOCTL VFIO_IOMMU_DIRTY_PAGES to get dirty pages bitmap with
   respect to IOMMU container rather than per device. All pages pinned by
   vendor driver through vfio_pin_pages external API has to be marked as
   dirty during  migration. When IOMMU capable device is present in the
   container and all pages are pinned and mapped, then all pages are marked
   dirty.
   When there are CPU writes, CPU dirty page tracking can identify dirtied
   pages, but any page pinned by vendor driver can also be written by
   device. As of now there is no device which has hardware support for
   dirty page tracking. So all pages which are pinned should be considered
   as dirty.
   This ioctl is also used to start/stop dirty pages tracking for pinned and
   unpinned pages while migration is active.

* Updated IOCTL VFIO_IOMMU_UNMAP_DMA to get dirty pages bitmap
before
   unmapping IO virtual address range.
   With vIOMMU, during pre-copy phase of migration, while CPUs are still
   running, IO virtual address unmap can happen while device still keeping
   reference of guest pfns. Those pages should be reported as dirty before
   unmap, so that VFIO user space application can copy content of those
   pages from source to destination.

* Patch 8 detect if IOMMU capable device driver is smart to report pages
   to be marked dirty by pinning pages using vfio_pin_pages() API.


Yet TODO:
Since there is no device which has hardware support for system memmory
dirty bitmap tracking, right now there is no other API from vendor driver
to VFIO IOMMU module to report dirty pages. In future, when such
hardware
support will be implemented, an API will be required such that vendor
driver could report dirty pages to VFIO module during migration phases.

Adding revision history from previous QEMU patch set to understand KABI
changes done till now

v20 -> v21
- Added checkin for GET_BITMAP ioctl for vfio_dma boundaries.
- Updated unmap ioctl function - as suggested by Alex.
- Updated comments in DIRTY_TRACKING ioctl definition - as suggested by
   Cornelia.

v19 -> v20
- Fixed ioctl to get dirty bitmap to get bitmap of multiple vfio_dmas
- Fixed unmap ioctl to get dirty bitmap of multiple vfio_dmas.
- Removed flag definition from migration capability.

v18 -> v19
- Updated migration capability with supported page sizes bitmap for dirty
   page tracking and  maximum bitmap size supported by kernel module.
- Added patch to calculate and cache pgsize_bitmap when iommu-

domain_list

   is updated.
- Removed extra buffers added in previous version for bitmap manipulation
   and optimised the code.

v17 -> v18
- Add migration capability to the capability chain for
VFIO_IOMMU_GET_INFO
   ioctl
- Updated UMAP_DMA ioctl to return bitmap of multiple vfio_dma

v16 -> v17
- Fixed errors reported by kbuild test robot  on i386

v15 -> v16
- Minor edits and nit picks (Auger Eric)
- On copying bitmap to user, re-populated bitmap only for pinned pages,
   excluding unmapped pages and CPU dirtied pages.
- Patches are on tag: next-20200318 and 1-3 patches from Yan's series
   https://lkml.org/lkml/2020/3/12/1255

v14 -> v15
- Minor edits and nit picks.
- In the verification of user allocated bitmap memory, added check of
maximum size.
- Patches are on tag: next-20200318 and 1-3 patches from Yan's series
   https://lkml.org/lkml/2020/3/12/1255

v13 -> v14
- Added struct vfio_bitmap to kabi. updated structure
   vfio_iommu_type1_dirty_bitmap_get and vfio_iommu_type1_dma_unmap.
- All small changes suggested by Alex.
- Patches are on tag: next-20200318 and 1-3 patches from Yan's series
   https://lkml.org/lkml/2020/3/12/1255

v12 -> v13
- Changed bitmap allocation in vfio_iommu_type1 to per vfio_dma
- Changed VFIO_IOMMU_DIRTY_PAGES ioctl behaviour to be per vfio_dma
range.
- Changed vfio_iommu_type1_dirty_bitmap structure to have separate data
   field.

v11 -> v12
- Changed bitmap allocation in vfio_iommu_type1.
- Remove atomicity of ref_count.
- Updated comments for migration device state structure about error
   reporting.
- Nit picks from v11 reviews

v10 -> v11
- Fix pin pages API to free vpfn if it is marked as unpinned tracking page.
- Added proposal to detect if IOMMU capable device calls external pin pages
   API to mark pages dirty.
- Nit picks from v10 reviews

v9 -> v10:
- Updated existing VFIO_IOMMU_UNMAP_DMA ioctl to get dirty pages
bitmap
   during unmap while 

Re: [PATCH Kernel v21 5/8] vfio iommu: Implementation of ioctl for dirty pages tracking

2020-05-16 Thread Kirti Wankhede

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1;
t=1589656095; bh=+tZ0dBYIJDY6PHAfvMYygljkbJgDRKM2mXYJTiJ5LAU=;
h=X-PGP-Universal:Subject:To:CC:References:X-Nvconfidentiality:From:
 Message-ID:Date:User-Agent:MIME-Version:In-Reply-To:
 X-Originating-IP:X-ClientProxiedBy:Content-Type:Content-Language:
 Content-Transfer-Encoding;
b=AIbO+yRdmNHn4LV2XE0br8vquXdgTLtrWscElXmWTZiSzrFeRqlATyPGsHleQF3QU
 nBcXsRa9tsbQOwgPkyh0nhMBzcV+q6CoKMw4c3CmRhkSXWG6XnQepdpEF4WDC5VJ1j
 /kxVKDvmS/WIGEMLowaG/lra0BpLqY9FQLPkCc2up9t94NJ15nHzMx+poYTeVeomWq
 x3b9j+KGJesMojeYHF4p02v5kpaquce7dYmP7FjlUMTdEZTgbB46FMu/GynDs3ZPLp
 5Jj51SmTeTP/0NR8+K7XjbAFdNc/ux1RzpNITw6FFJ7kmcIImwoKGPat0qKhpN2P6u
 J2ThfIZtvw0wg==


On 5/16/2020 4:03 AM, Alex Williamson wrote:

On Sat, 16 May 2020 02:43:20 +0530
Kirti Wankhede  wrote:






+static int vfio_iova_dirty_bitmap(u64 __user *bitmap, struct vfio_iommu *iommu,
+ dma_addr_t iova, size_t size, size_t pgsize)
+{
+   struct vfio_dma *dma;
+   unsigned long pgshift = __ffs(pgsize);
+   int ret;
+
+   /*
+* GET_BITMAP request must fully cover vfio_dma mappings.  Multiple
+* vfio_dma mappings may be clubbed by specifying large ranges, but
+* there must not be any previous mappings bisected by the range.
+* An error will be returned if these conditions are not met.
+*/
+   dma = vfio_find_dma(iommu, iova, 1);
+   if (dma && dma->iova != iova)
+   return -EINVAL;
+
+   dma = vfio_find_dma(iommu, iova + size - 1, 0);
+   if (dma && dma->iova + dma->size != iova + size)
+   return -EINVAL;
+
+   dma = vfio_find_dma(iommu, iova, size);
+
+   while (dma && (dma->iova >= iova) &&
+   (dma->iova + dma->size <= iova + size)) {


Thanks for doing this!  Unfortunately I think I've mislead you :(
But I think there was a bug here in the last version as well, so maybe
it's all for the better ;)

vfio_find_dma() does not guarantee to find the first dma in the range
(ie. the lowest iova), it only guarantees to find a dma in the range.
Since we have a tree structure, as we descend the nodes we might find
multiple nodes within the range.  vfio_find_dma() only returns the first
occurrence it finds, so we can't assume that other matching nodes are
next in the tree or that their iovas are greater than the iova of the
node we found.

All the other use cases of vfio_find_dma() are looking for specific
pages or boundaries or checking for the existence of a conflict or are
removing all of the instances within the range, which is probably the
example that was used in the v20 version of this patch, since it was
quite similar to vfio_dma_do_unmap() but tried to adjust the size to
get the next match rather than removing the entry.  That could
potentially lead to an entire unexplored half of the tree making our
bitmap incomplete.

So I think my initial suggestion[1] on the previous version is probably
the way we should go.  Sorry!  OTOH, it would have been a nasty bug to
find later, it's a subtle semantic that's easy to overlook.  Thanks,

Alex

[1]https://lore.kernel.org/kvm/20200514212720.479cc...@x1.home/



Ok. Got your point.

Replacing
dma = vfio_find_dma(iommu, iova, size);

with below should work

for (n = rb_first(>dma_list); n; n = rb_next(n)) {
struct vfio_dma *ldma = rb_entry(n, struct vfio_dma, node);

if (ldma->iova >= iova)
break;
}

dma = n ? rb_entry(n, struct vfio_dma, node) : NULL;

Should I update all patches with v22 version? or Is it fine to update 
this patch with v21 only?


Thanks,
Kirti




Re: [PATCH v3 18/18] MAINTAINERS: Change Aleksandar Rikalo's email address

2020-05-16 Thread Philippe Mathieu-Daudé

On 5/16/20 7:45 PM, Aleksandar Markovic wrote:

Aleksandar Rikalo want to use a different email address


"wants"?


from now on.

Signed-off-by: Aleksandar Markovic 
---
  .mailmap|  3 ++-
  MAINTAINERS | 12 ++--
  2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/.mailmap b/.mailmap
index 6412067bde..e3628c7a66 100644
--- a/.mailmap
+++ b/.mailmap
@@ -42,7 +42,8 @@ Justin Terry (VM)  Justin Terry (VM) via 
Qemu-devel  

  Aleksandar Markovic  

  Aleksandar Markovic  
-Aleksandar Rikalo  
+Aleksandar Rikalo  
+Aleksandar Rikalo  
  Anthony Liguori  Anthony Liguori 
  James Hogan  
  Leif Lindholm  
diff --git a/MAINTAINERS b/MAINTAINERS
index 1f84e3ae2c..8d5562c5c7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -212,7 +212,7 @@ F: disas/microblaze.c
  MIPS TCG CPUs
  M: Aleksandar Markovic 
  R: Aurelien Jarno 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
  S: Maintained
  F: target/mips/
  F: default-configs/*mips*
@@ -1041,7 +1041,7 @@ MIPS Machines
  -
  Jazz
  M: Hervé Poussineau 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
  S: Maintained
  F: hw/mips/mips_jazz.c
  F: hw/display/jazz_led.c
@@ -1062,7 +1062,7 @@ F: tests/acceptance/machine_mips_malta.py
  
  Mipssim

  M: Aleksandar Markovic 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
  S: Odd Fixes
  F: hw/mips/mips_mipssim.c
  F: hw/net/mipsnet.c
@@ -1070,7 +1070,7 @@ F: hw/net/mipsnet.c
  R4000
  M: Aleksandar Markovic 
  R: Aurelien Jarno 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
  S: Obsolete
  F: hw/mips/mips_r4k.c
  
@@ -1085,7 +1085,7 @@ F: include/hw/isa/vt82c686.h
  
  Boston

  M: Paul Burton 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
  S: Maintained
  F: hw/core/loader-fit.c
  F: hw/mips/boston.c
@@ -2582,7 +2582,7 @@ F: disas/i386.c
  MIPS TCG target
  M: Aleksandar Markovic 
  R: Aurelien Jarno 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
  S: Maintained
  F: tcg/mips/
  



Reviewed-by: Philippe Mathieu-Daudé 




Re: [PATCH v3 17/18] hw/mips: Add some logging for bad register offset cases

2020-05-16 Thread Philippe Mathieu-Daudé

On 5/16/20 7:45 PM, Aleksandar Markovic wrote:

Log the cases where a guest attempts read or write using bad
register offset.

Signed-off-by: Aleksandar Markovic 
CC: Philippe Mathieu-Daudé 
---
  hw/mips/mips_malta.c | 14 ++
  1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index e4c4de1b4e..88869b828e 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -427,10 +427,9 @@ static uint64_t malta_fpga_read(void *opaque, hwaddr addr,
  break;
  
  default:

-#if 0
-printf("malta_fpga_read: Bad register offset 0x" TARGET_FMT_lx "\n",
-   addr);
-#endif
+qemu_log_mask(LOG_GUEST_ERROR,
+  "malta_fpga_read: Bad register offset 0x"
+  TARGET_FMT_lx "\n", addr);
  break;
  }
  return val;
@@ -515,10 +514,9 @@ static void malta_fpga_write(void *opaque, hwaddr addr,
  break;
  
  default:

-#if 0
-printf("malta_fpga_write: Bad register offset 0x" TARGET_FMT_lx "\n",
-   addr);
-#endif
+qemu_log_mask(LOG_GUEST_ERROR,
+  "malta_fpga_write: Bad register offset 0x"
+  TARGET_FMT_lx "\n", addr);
  break;
  }
  }



Reviewed-by: Philippe Mathieu-Daudé 
Tested-by: Philippe Mathieu-Daudé 



[PATCH v3 18/18] MAINTAINERS: Change Aleksandar Rikalo's email address

2020-05-16 Thread Aleksandar Markovic
Aleksandar Rikalo want to use a different email address
from now on.

Signed-off-by: Aleksandar Markovic 
---
 .mailmap|  3 ++-
 MAINTAINERS | 12 ++--
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/.mailmap b/.mailmap
index 6412067bde..e3628c7a66 100644
--- a/.mailmap
+++ b/.mailmap
@@ -42,7 +42,8 @@ Justin Terry (VM)  Justin Terry (VM) 
via Qemu-devel  

 Aleksandar Markovic  

 Aleksandar Markovic  
-Aleksandar Rikalo  
+Aleksandar Rikalo  
+Aleksandar Rikalo  
 Anthony Liguori  Anthony Liguori 
 James Hogan  
 Leif Lindholm  
diff --git a/MAINTAINERS b/MAINTAINERS
index 1f84e3ae2c..8d5562c5c7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -212,7 +212,7 @@ F: disas/microblaze.c
 MIPS TCG CPUs
 M: Aleksandar Markovic 
 R: Aurelien Jarno 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
 S: Maintained
 F: target/mips/
 F: default-configs/*mips*
@@ -1041,7 +1041,7 @@ MIPS Machines
 -
 Jazz
 M: Hervé Poussineau 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
 S: Maintained
 F: hw/mips/mips_jazz.c
 F: hw/display/jazz_led.c
@@ -1062,7 +1062,7 @@ F: tests/acceptance/machine_mips_malta.py
 
 Mipssim
 M: Aleksandar Markovic 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
 S: Odd Fixes
 F: hw/mips/mips_mipssim.c
 F: hw/net/mipsnet.c
@@ -1070,7 +1070,7 @@ F: hw/net/mipsnet.c
 R4000
 M: Aleksandar Markovic 
 R: Aurelien Jarno 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
 S: Obsolete
 F: hw/mips/mips_r4k.c
 
@@ -1085,7 +1085,7 @@ F: include/hw/isa/vt82c686.h
 
 Boston
 M: Paul Burton 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
 S: Maintained
 F: hw/core/loader-fit.c
 F: hw/mips/boston.c
@@ -2582,7 +2582,7 @@ F: disas/i386.c
 MIPS TCG target
 M: Aleksandar Markovic 
 R: Aurelien Jarno 
-R: Aleksandar Rikalo 
+R: Aleksandar Rikalo 
 S: Maintained
 F: tcg/mips/
 
-- 
2.20.1




[PATCH v3 16/18] target/mips: fpu: Refactor conversion from ieee to mips exception flags

2020-05-16 Thread Aleksandar Markovic
The original coversion function is used for regular and MSA floating
point instructions handling. Since there are some nuanced differences
between regular and MSA floatin point excetion handling, provide two
instances of the conversion function, rather than just a common one.
Inline both of these function instances for the sake of performance.
Improve variable naming in surrounding code for clarity.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 55 +++-
 target/mips/internal.h   |  1 -
 target/mips/msa_helper.c | 77 +++-
 3 files changed, 82 insertions(+), 51 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index dbb8ca5692..7a3a61cab3 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -189,43 +189,48 @@ void helper_ctc1(CPUMIPSState *env, target_ulong arg1, 
uint32_t fs, uint32_t rt)
 }
 }
 
-int ieee_ex_to_mips(int xcpt)
+static inline int ieee_to_mips_xcpt(int ieee_xcpt)
 {
-int ret = 0;
-if (xcpt) {
-if (xcpt & float_flag_invalid) {
-ret |= FP_INVALID;
-}
-if (xcpt & float_flag_overflow) {
-ret |= FP_OVERFLOW;
-}
-if (xcpt & float_flag_underflow) {
-ret |= FP_UNDERFLOW;
-}
-if (xcpt & float_flag_divbyzero) {
-ret |= FP_DIV0;
-}
-if (xcpt & float_flag_inexact) {
-ret |= FP_INEXACT;
-}
+int mips_xcpt = 0;
+
+if (ieee_xcpt & float_flag_invalid) {
+mips_xcpt |= FP_INVALID;
+}
+if (ieee_xcpt & float_flag_overflow) {
+mips_xcpt |= FP_OVERFLOW;
 }
-return ret;
+if (ieee_xcpt & float_flag_underflow) {
+mips_xcpt |= FP_UNDERFLOW;
+}
+if (ieee_xcpt & float_flag_divbyzero) {
+mips_xcpt |= FP_DIV0;
+}
+if (ieee_xcpt & float_flag_inexact) {
+mips_xcpt |= FP_INEXACT;
+}
+
+return mips_xcpt;
 }
 
 static inline void update_fcr31(CPUMIPSState *env, uintptr_t pc)
 {
-int tmp = ieee_ex_to_mips(get_float_exception_flags(
-  >active_fpu.fp_status));
+int ieee_exception_flags = get_float_exception_flags(
+   >active_fpu.fp_status);
+int mips_exception_flags = 0;
+
+if (ieee_exception_flags) {
+mips_exception_flags = ieee_to_mips_xcpt(ieee_exception_flags);
+}
 
-SET_FP_CAUSE(env->active_fpu.fcr31, tmp);
+SET_FP_CAUSE(env->active_fpu.fcr31, mips_exception_flags);
 
-if (tmp) {
+if (mips_exception_flags)  {
 set_float_exception_flags(0, >active_fpu.fp_status);
 
-if (GET_FP_ENABLE(env->active_fpu.fcr31) & tmp) {
+if (GET_FP_ENABLE(env->active_fpu.fcr31) & mips_exception_flags) {
 do_raise_exception(env, EXCP_FPE, pc);
 } else {
-UPDATE_FP_FLAGS(env->active_fpu.fcr31, tmp);
+UPDATE_FP_FLAGS(env->active_fpu.fcr31, mips_exception_flags);
 }
 }
 }
diff --git a/target/mips/internal.h b/target/mips/internal.h
index 1bf274b3ef..684356e309 100644
--- a/target/mips/internal.h
+++ b/target/mips/internal.h
@@ -224,7 +224,6 @@ uint32_t float_class_s(uint32_t arg, float_status *fst);
 uint64_t float_class_d(uint64_t arg, float_status *fst);
 
 extern unsigned int ieee_rm[];
-int ieee_ex_to_mips(int xcpt);
 void update_pagemask(CPUMIPSState *env, target_ulong arg1, int32_t *pagemask);
 
 static inline void restore_rounding_mode(CPUMIPSState *env)
diff --git a/target/mips/msa_helper.c b/target/mips/msa_helper.c
index 4065cfe4f7..c520405929 100644
--- a/target/mips/msa_helper.c
+++ b/target/mips/msa_helper.c
@@ -5419,54 +5419,81 @@ static inline void check_msacsr_cause(CPUMIPSState 
*env, uintptr_t retaddr)
 #define CLEAR_IS_INEXACT   2
 #define RECIPROCAL_INEXACT 4
 
-static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
+
+static inline int ieee_to_mips_xcpt_msa(int ieee_xcpt)
 {
-int ieee_ex;
+int mips_xcpt = 0;
 
-int c;
+if (ieee_xcpt & float_flag_invalid) {
+mips_xcpt |= FP_INVALID;
+}
+if (ieee_xcpt & float_flag_overflow) {
+mips_xcpt |= FP_OVERFLOW;
+}
+if (ieee_xcpt & float_flag_underflow) {
+mips_xcpt |= FP_UNDERFLOW;
+}
+if (ieee_xcpt & float_flag_divbyzero) {
+mips_xcpt |= FP_DIV0;
+}
+if (ieee_xcpt & float_flag_inexact) {
+mips_xcpt |= FP_INEXACT;
+}
+
+return mips_xcpt;
+}
+
+static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
+{
+int ieee_exception_flags;
+int mips_exception_flags = 0;
 int cause;
 int enable;
 
-ieee_ex = get_float_exception_flags(>active_tc.msa_fp_status);
+ieee_exception_flags = get_float_exception_flags(
+   >active_tc.msa_fp_status);
 
 /* QEMU softfloat does not signal all underflow cases */
 if (denormal) {
-ieee_ex |= 

[PATCH v3 15/18] target/mips: fpu: Name better paired-single variables

2020-05-16 Thread Aleksandar Markovic
Use consistently 'l' and 'h' for low and high halves.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 62 
 1 file changed, 31 insertions(+), 31 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 56ba49104e..dbb8ca5692 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1059,14 +1059,14 @@ uint32_t helper_float_recip1_s(CPUMIPSState *env, 
uint32_t fst0)
 
 uint64_t helper_float_recip1_ps(CPUMIPSState *env, uint64_t fdt0)
 {
-uint32_t fst2;
+uint32_t fstl2;
 uint32_t fsth2;
 
-fst2 = float32_div(float32_one, fdt0 & 0X,
-   >active_fpu.fp_status);
+fstl2 = float32_div(float32_one, fdt0 & 0X,
+>active_fpu.fp_status);
 fsth2 = float32_div(float32_one, fdt0 >> 32, >active_fpu.fp_status);
 update_fcr31(env, GETPC());
-return ((uint64_t)fsth2 << 32) | fst2;
+return ((uint64_t)fsth2 << 32) | fstl2;
 }
 
 uint64_t helper_float_rsqrt1_d(CPUMIPSState *env, uint64_t fdt0)
@@ -1091,15 +1091,15 @@ uint32_t helper_float_rsqrt1_s(CPUMIPSState *env, 
uint32_t fst0)
 
 uint64_t helper_float_rsqrt1_ps(CPUMIPSState *env, uint64_t fdt0)
 {
-uint32_t fst2;
+uint32_t fstl2;
 uint32_t fsth2;
 
-fst2 = float32_sqrt(fdt0 & 0X, >active_fpu.fp_status);
+fstl2 = float32_sqrt(fdt0 & 0X, >active_fpu.fp_status);
 fsth2 = float32_sqrt(fdt0 >> 32, >active_fpu.fp_status);
-fst2 = float32_div(float32_one, fst2, >active_fpu.fp_status);
+fstl2 = float32_div(float32_one, fstl2, >active_fpu.fp_status);
 fsth2 = float32_div(float32_one, fsth2, >active_fpu.fp_status);
 update_fcr31(env, GETPC());
-return ((uint64_t)fsth2 << 32) | fst2;
+return ((uint64_t)fsth2 << 32) | fstl2;
 }
 
 uint64_t helper_float_rint_d(CPUMIPSState *env, uint64_t fs)
@@ -1367,19 +1367,19 @@ uint32_t helper_float_recip2_s(CPUMIPSState *env, 
uint32_t fst0, uint32_t fst2)
 
 uint64_t helper_float_recip2_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t 
fdt2)
 {
-uint32_t fst0 = fdt0 & 0X;
+uint32_t fstl0 = fdt0 & 0X;
 uint32_t fsth0 = fdt0 >> 32;
-uint32_t fst2 = fdt2 & 0X;
+uint32_t fstl2 = fdt2 & 0X;
 uint32_t fsth2 = fdt2 >> 32;
 
-fst2 = float32_mul(fst0, fst2, >active_fpu.fp_status);
+fstl2 = float32_mul(fstl0, fstl2, >active_fpu.fp_status);
 fsth2 = float32_mul(fsth0, fsth2, >active_fpu.fp_status);
-fst2 = float32_chs(float32_sub(fst2, float32_one,
+fstl2 = float32_chs(float32_sub(fstl2, float32_one,
>active_fpu.fp_status));
 fsth2 = float32_chs(float32_sub(fsth2, float32_one,
>active_fpu.fp_status));
 update_fcr31(env, GETPC());
-return ((uint64_t)fsth2 << 32) | fst2;
+return ((uint64_t)fsth2 << 32) | fstl2;
 }
 
 uint64_t helper_float_rsqrt2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
@@ -1404,51 +1404,51 @@ uint32_t helper_float_rsqrt2_s(CPUMIPSState *env, 
uint32_t fst0, uint32_t fst2)
 
 uint64_t helper_float_rsqrt2_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t 
fdt2)
 {
-uint32_t fst0 = fdt0 & 0X;
+uint32_t fstl0 = fdt0 & 0X;
 uint32_t fsth0 = fdt0 >> 32;
-uint32_t fst2 = fdt2 & 0X;
+uint32_t fstl2 = fdt2 & 0X;
 uint32_t fsth2 = fdt2 >> 32;
 
-fst2 = float32_mul(fst0, fst2, >active_fpu.fp_status);
+fstl2 = float32_mul(fstl0, fstl2, >active_fpu.fp_status);
 fsth2 = float32_mul(fsth0, fsth2, >active_fpu.fp_status);
-fst2 = float32_sub(fst2, float32_one, >active_fpu.fp_status);
+fstl2 = float32_sub(fstl2, float32_one, >active_fpu.fp_status);
 fsth2 = float32_sub(fsth2, float32_one, >active_fpu.fp_status);
-fst2 = float32_chs(float32_div(fst2, FLOAT_TWO32,
+fstl2 = float32_chs(float32_div(fstl2, FLOAT_TWO32,
>active_fpu.fp_status));
 fsth2 = float32_chs(float32_div(fsth2, FLOAT_TWO32,
>active_fpu.fp_status));
 update_fcr31(env, GETPC());
-return ((uint64_t)fsth2 << 32) | fst2;
+return ((uint64_t)fsth2 << 32) | fstl2;
 }
 
 uint64_t helper_float_addr_ps(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt1)
 {
-uint32_t fst0 = fdt0 & 0X;
+uint32_t fstl0 = fdt0 & 0X;
 uint32_t fsth0 = fdt0 >> 32;
-uint32_t fst1 = fdt1 & 0X;
+uint32_t fstl1 = fdt1 & 0X;
 uint32_t fsth1 = fdt1 >> 32;
-uint32_t fst2;
+uint32_t fstl2;
 uint32_t fsth2;
 
-fst2 = float32_add(fst0, fsth0, >active_fpu.fp_status);
-fsth2 = float32_add(fst1, fsth1, >active_fpu.fp_status);
+fstl2 = float32_add(fstl0, fsth0, >active_fpu.fp_status);
+fsth2 = float32_add(fstl1, fsth1, >active_fpu.fp_status);
 update_fcr31(env, GETPC());
-return ((uint64_t)fsth2 << 32) | fst2;
+return ((uint64_t)fsth2 << 

[PATCH v3 17/18] hw/mips: Add some logging for bad register offset cases

2020-05-16 Thread Aleksandar Markovic
Log the cases where a guest attempts read or write using bad
register offset.

Signed-off-by: Aleksandar Markovic 
CC: Philippe Mathieu-Daudé 
---
 hw/mips/mips_malta.c | 14 ++
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index e4c4de1b4e..88869b828e 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -427,10 +427,9 @@ static uint64_t malta_fpga_read(void *opaque, hwaddr addr,
 break;
 
 default:
-#if 0
-printf("malta_fpga_read: Bad register offset 0x" TARGET_FMT_lx "\n",
-   addr);
-#endif
+qemu_log_mask(LOG_GUEST_ERROR,
+  "malta_fpga_read: Bad register offset 0x"
+  TARGET_FMT_lx "\n", addr);
 break;
 }
 return val;
@@ -515,10 +514,9 @@ static void malta_fpga_write(void *opaque, hwaddr addr,
 break;
 
 default:
-#if 0
-printf("malta_fpga_write: Bad register offset 0x" TARGET_FMT_lx "\n",
-   addr);
-#endif
+qemu_log_mask(LOG_GUEST_ERROR,
+  "malta_fpga_write: Bad register offset 0x"
+  TARGET_FMT_lx "\n", addr);
 break;
 }
 }
-- 
2.20.1




[PATCH v3 14/18] target/mips: fpu: Remove now unused FLOAT_RINT macro

2020-05-16 Thread Aleksandar Markovic
After demacroing RINT., this macro is not needed anymore.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 13 -
 1 file changed, 13 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index dae1331f23..56ba49104e 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1102,19 +1102,6 @@ uint64_t helper_float_rsqrt1_ps(CPUMIPSState *env, 
uint64_t fdt0)
 return ((uint64_t)fsth2 << 32) | fst2;
 }
 
-#define FLOAT_RINT(name, bits)  \
-uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env, \
- uint ## bits ## _t fs) \
-{   \
-uint ## bits ## _t fdret;   \
-\
-fdret = float ## bits ## _round_to_int(fs, >active_fpu.fp_status); \
-update_fcr31(env, GETPC()); \
-return fdret;   \
-}
-
-#undef FLOAT_RINT
-
 uint64_t helper_float_rint_d(CPUMIPSState *env, uint64_t fs)
 {
 uint64_t fdret;
-- 
2.20.1




[PATCH v3 12/18] target/mips: fpu: Remove now unused FLOAT_CLASS macro

2020-05-16 Thread Aleksandar Markovic
After demacroing CLASS., this macro is not needed anymore.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 39 ---
 1 file changed, 39 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index b3903f5357..e227e53f70 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1128,45 +1128,6 @@ FLOAT_RINT(rint_d, 64)
 #define FLOAT_CLASS_POSITIVE_SUBNORMAL 0x100
 #define FLOAT_CLASS_POSITIVE_ZERO  0x200
 
-#define FLOAT_CLASS(name, bits)  \
-uint ## bits ## _t float_ ## name(uint ## bits ## _t arg,\
-  float_status *status)  \
-{\
-if (float ## bits ## _is_signaling_nan(arg, status)) {   \
-return FLOAT_CLASS_SIGNALING_NAN;\
-} else if (float ## bits ## _is_quiet_nan(arg, status)) {\
-return FLOAT_CLASS_QUIET_NAN;\
-} else if (float ## bits ## _is_neg(arg)) {  \
-if (float ## bits ## _is_infinity(arg)) {\
-return FLOAT_CLASS_NEGATIVE_INFINITY;\
-} else if (float ## bits ## _is_zero(arg)) { \
-return FLOAT_CLASS_NEGATIVE_ZERO;\
-} else if (float ## bits ## _is_zero_or_denormal(arg)) { \
-return FLOAT_CLASS_NEGATIVE_SUBNORMAL;   \
-} else { \
-return FLOAT_CLASS_NEGATIVE_NORMAL;  \
-}\
-} else { \
-if (float ## bits ## _is_infinity(arg)) {\
-return FLOAT_CLASS_POSITIVE_INFINITY;\
-} else if (float ## bits ## _is_zero(arg)) { \
-return FLOAT_CLASS_POSITIVE_ZERO;\
-} else if (float ## bits ## _is_zero_or_denormal(arg)) { \
-return FLOAT_CLASS_POSITIVE_SUBNORMAL;   \
-} else { \
-return FLOAT_CLASS_POSITIVE_NORMAL;  \
-}\
-}\
-}\
- \
-uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env,  \
- uint ## bits ## _t arg) \
-{\
-return float_ ## name(arg, >active_fpu.fp_status);  \
-}
-
-#undef FLOAT_CLASS
-
 uint64_t float_class_d(uint64_t arg, float_status *status)
 {
 if (float64_is_signaling_nan(arg, status)) {
-- 
2.20.1




[PATCH v3 13/18] target/mips: fpu: Demacro RINT.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 20 ++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index e227e53f70..dae1331f23 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1113,10 +1113,26 @@ uint ## bits ## _t helper_float_ ## name(CPUMIPSState 
*env, \
 return fdret;   \
 }
 
-FLOAT_RINT(rint_s, 32)
-FLOAT_RINT(rint_d, 64)
 #undef FLOAT_RINT
 
+uint64_t helper_float_rint_d(CPUMIPSState *env, uint64_t fs)
+{
+uint64_t fdret;
+
+fdret = float64_round_to_int(fs, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return fdret;
+}
+
+uint32_t helper_float_rint_s(CPUMIPSState *env, uint32_t fs)
+{
+uint32_t fdret;
+
+fdret = float32_round_to_int(fs, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return fdret;
+}
+
 #define FLOAT_CLASS_SIGNALING_NAN  0x001
 #define FLOAT_CLASS_QUIET_NAN  0x002
 #define FLOAT_CLASS_NEGATIVE_INFINITY  0x004
-- 
2.20.1




[PATCH v3 11/18] target/mips: fpu: Demacro CLASS.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 70 ++--
 1 file changed, 68 insertions(+), 2 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index e8e50e4bc0..b3903f5357 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1165,10 +1165,76 @@ uint ## bits ## _t helper_float_ ## name(CPUMIPSState 
*env,  \
 return float_ ## name(arg, >active_fpu.fp_status);  \
 }
 
-FLOAT_CLASS(class_s, 32)
-FLOAT_CLASS(class_d, 64)
 #undef FLOAT_CLASS
 
+uint64_t float_class_d(uint64_t arg, float_status *status)
+{
+if (float64_is_signaling_nan(arg, status)) {
+return FLOAT_CLASS_SIGNALING_NAN;
+} else if (float64_is_quiet_nan(arg, status)) {
+return FLOAT_CLASS_QUIET_NAN;
+} else if (float64_is_neg(arg)) {
+if (float64_is_infinity(arg)) {
+return FLOAT_CLASS_NEGATIVE_INFINITY;
+} else if (float64_is_zero(arg)) {
+return FLOAT_CLASS_NEGATIVE_ZERO;
+} else if (float64_is_zero_or_denormal(arg)) {
+return FLOAT_CLASS_NEGATIVE_SUBNORMAL;
+} else {
+return FLOAT_CLASS_NEGATIVE_NORMAL;
+}
+} else {
+if (float64_is_infinity(arg)) {
+return FLOAT_CLASS_POSITIVE_INFINITY;
+} else if (float64_is_zero(arg)) {
+return FLOAT_CLASS_POSITIVE_ZERO;
+} else if (float64_is_zero_or_denormal(arg)) {
+return FLOAT_CLASS_POSITIVE_SUBNORMAL;
+} else {
+return FLOAT_CLASS_POSITIVE_NORMAL;
+}
+}
+}
+
+uint64_t helper_float_class_d(CPUMIPSState *env, uint64_t arg)
+{
+return float_class_d(arg, >active_fpu.fp_status);
+}
+
+uint32_t float_class_s(uint32_t arg, float_status *status)
+{
+if (float32_is_signaling_nan(arg, status)) {
+return FLOAT_CLASS_SIGNALING_NAN;
+} else if (float32_is_quiet_nan(arg, status)) {
+return FLOAT_CLASS_QUIET_NAN;
+} else if (float32_is_neg(arg)) {
+if (float32_is_infinity(arg)) {
+return FLOAT_CLASS_NEGATIVE_INFINITY;
+} else if (float32_is_zero(arg)) {
+return FLOAT_CLASS_NEGATIVE_ZERO;
+} else if (float32_is_zero_or_denormal(arg)) {
+return FLOAT_CLASS_NEGATIVE_SUBNORMAL;
+} else {
+return FLOAT_CLASS_NEGATIVE_NORMAL;
+}
+} else {
+if (float32_is_infinity(arg)) {
+return FLOAT_CLASS_POSITIVE_INFINITY;
+} else if (float32_is_zero(arg)) {
+return FLOAT_CLASS_POSITIVE_ZERO;
+} else if (float32_is_zero_or_denormal(arg)) {
+return FLOAT_CLASS_POSITIVE_SUBNORMAL;
+} else {
+return FLOAT_CLASS_POSITIVE_NORMAL;
+}
+}
+}
+
+uint32_t helper_float_class_s(CPUMIPSState *env, uint32_t arg)
+{
+return float_class_s(arg, >active_fpu.fp_status);
+}
+
 /* binary operations */
 
 uint64_t helper_float_add_d(CPUMIPSState *env,
-- 
2.20.1




[PATCH v3 07/18] target/mips: fpu: Demacro MSUB.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 40 +++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index c070081cbc..e37fc4075d 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1495,7 +1495,6 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,  
   \
 update_fcr31(env, GETPC());  \
 return ((uint64_t)fsth0 << 32) | fst0;   \
 }
-FLOAT_FMA(msub, float_muladd_negate_c)
 FLOAT_FMA(nmadd, float_muladd_negate_result)
 FLOAT_FMA(nmsub, float_muladd_negate_result | float_muladd_negate_c)
 #undef FLOAT_FMA
@@ -1539,6 +1538,45 @@ uint64_t helper_float_madd_ps(CPUMIPSState *env, 
uint64_t fdt0,
 return ((uint64_t)fsth0 << 32) | fstl0;
 }
 
+uint64_t helper_float_msub_d(CPUMIPSState *env, uint64_t fst0,
+ uint64_t fst1, uint64_t fst2)
+{
+fst0 = float64_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float64_sub(fst0, fst2, >active_fpu.fp_status);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint32_t helper_float_msub_s(CPUMIPSState *env, uint32_t fst0,
+ uint32_t fst1, uint32_t fst2)
+{
+fst0 = float32_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float32_sub(fst0, fst2, >active_fpu.fp_status);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint64_t helper_float_msub_ps(CPUMIPSState *env, uint64_t fdt0,
+  uint64_t fdt1, uint64_t fdt2)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t fstl2 = fdt2 & 0X;
+uint32_t fsth2 = fdt2 >> 32;
+
+fstl0 = float32_mul(fstl0, fstl1, >active_fpu.fp_status);
+fstl0 = float32_sub(fstl0, fstl2, >active_fpu.fp_status);
+fsth0 = float32_mul(fsth0, fsth1, >active_fpu.fp_status);
+fsth0 = float32_sub(fsth0, fsth2, >active_fpu.fp_status);
+
+update_fcr31(env, GETPC());
+return ((uint64_t)fsth0 << 32) | fstl0;
+}
+
 
 #define FLOAT_FMADDSUB(name, bits, muladd_arg)  \
 uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env, \
-- 
2.20.1




[PATCH v3 10/18] target/mips: fpu: Remove now unused UNFUSED_FMA and FLOAT_FMA macros

2020-05-16 Thread Aleksandar Markovic
After demacroing ., these macros
are not needed anymore.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 50 
 1 file changed, 50 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 927bac24ac..e8e50e4bc0 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1446,56 +1446,6 @@ FLOAT_MINMAX(mina_d, 64, minnummag)
 #undef FLOAT_MINMAX
 
 /* ternary operations */
-#define UNFUSED_FMA(prefix, a, b, c, flags)  \
-{\
-a = prefix##_mul(a, b, >active_fpu.fp_status);  \
-if ((flags) & float_muladd_negate_c) {   \
-a = prefix##_sub(a, c, >active_fpu.fp_status);  \
-} else { \
-a = prefix##_add(a, c, >active_fpu.fp_status);  \
-}\
-if ((flags) & float_muladd_negate_result) {  \
-a = prefix##_chs(a); \
-}\
-}
-
-/* FMA based operations */
-#define FLOAT_FMA(name, type)\
-uint64_t helper_float_ ## name ## _d(CPUMIPSState *env,  \
- uint64_t fdt0, uint64_t fdt1,   \
- uint64_t fdt2)  \
-{\
-UNFUSED_FMA(float64, fdt0, fdt1, fdt2, type);\
-update_fcr31(env, GETPC());  \
-return fdt0; \
-}\
- \
-uint32_t helper_float_ ## name ## _s(CPUMIPSState *env,  \
- uint32_t fst0, uint32_t fst1,   \
- uint32_t fst2)  \
-{\
-UNFUSED_FMA(float32, fst0, fst1, fst2, type);\
-update_fcr31(env, GETPC());  \
-return fst0; \
-}\
- \
-uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env, \
-  uint64_t fdt0, uint64_t fdt1,  \
-  uint64_t fdt2) \
-{\
-uint32_t fst0 = fdt0 & 0X;   \
-uint32_t fsth0 = fdt0 >> 32; \
-uint32_t fst1 = fdt1 & 0X;   \
-uint32_t fsth1 = fdt1 >> 32; \
-uint32_t fst2 = fdt2 & 0X;   \
-uint32_t fsth2 = fdt2 >> 32; \
- \
-UNFUSED_FMA(float32, fst0, fst1, fst2, type);\
-UNFUSED_FMA(float32, fsth0, fsth1, fsth2, type); \
-update_fcr31(env, GETPC());  \
-return ((uint64_t)fsth0 << 32) | fst0;   \
-}
-#undef FLOAT_FMA
 
 uint64_t helper_float_madd_d(CPUMIPSState *env, uint64_t fst0,
  uint64_t fst1, uint64_t fst2)
-- 
2.20.1




[PATCH v3 09/18] target/mips: fpu: Demacro NMSUB.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 44 +++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index d4c065f281..927bac24ac 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1495,7 +1495,6 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,  
   \
 update_fcr31(env, GETPC());  \
 return ((uint64_t)fsth0 << 32) | fst0;   \
 }
-FLOAT_FMA(nmsub, float_muladd_negate_result | float_muladd_negate_c)
 #undef FLOAT_FMA
 
 uint64_t helper_float_madd_d(CPUMIPSState *env, uint64_t fst0,
@@ -1619,6 +1618,49 @@ uint64_t helper_float_nmadd_ps(CPUMIPSState *env, 
uint64_t fdt0,
 return ((uint64_t)fsth0 << 32) | fstl0;
 }
 
+uint64_t helper_float_nmsub_d(CPUMIPSState *env, uint64_t fst0,
+ uint64_t fst1, uint64_t fst2)
+{
+fst0 = float64_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float64_sub(fst0, fst2, >active_fpu.fp_status);
+fst0 = float64_chs(fst0);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint32_t helper_float_nmsub_s(CPUMIPSState *env, uint32_t fst0,
+ uint32_t fst1, uint32_t fst2)
+{
+fst0 = float32_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float32_sub(fst0, fst2, >active_fpu.fp_status);
+fst0 = float32_chs(fst0);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint64_t helper_float_nmsub_ps(CPUMIPSState *env, uint64_t fdt0,
+  uint64_t fdt1, uint64_t fdt2)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t fstl2 = fdt2 & 0X;
+uint32_t fsth2 = fdt2 >> 32;
+
+fstl0 = float32_mul(fstl0, fstl1, >active_fpu.fp_status);
+fstl0 = float32_sub(fstl0, fstl2, >active_fpu.fp_status);
+fstl0 = float32_chs(fstl0);
+fsth0 = float32_mul(fsth0, fsth1, >active_fpu.fp_status);
+fsth0 = float32_sub(fsth0, fsth2, >active_fpu.fp_status);
+fsth0 = float32_chs(fsth0);
+
+update_fcr31(env, GETPC());
+return ((uint64_t)fsth0 << 32) | fstl0;
+}
+
 
 #define FLOAT_FMADDSUB(name, bits, muladd_arg)  \
 uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env, \
-- 
2.20.1




[PATCH v3 01/18] target/mips: fpu: Demacro ADD.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 38 +-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 5287c86c61..984f3f4dfb 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1208,12 +1208,48 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState 
*env,   \
 return ((uint64_t)wth2 << 32) | wt2;   \
 }
 
-FLOAT_BINOP(add)
 FLOAT_BINOP(sub)
 FLOAT_BINOP(mul)
 FLOAT_BINOP(div)
 #undef FLOAT_BINOP
 
+uint64_t helper_float_add_d(CPUMIPSState *env,
+uint64_t fdt0, uint64_t fdt1)
+{
+uint64_t dt2;
+
+dt2 = float64_add(fdt0, fdt1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return dt2;
+}
+
+uint32_t helper_float_add_s(CPUMIPSState *env,
+uint32_t fst0, uint32_t fst1)
+{
+uint32_t wt2;
+
+wt2 = float32_sub(fst0, fst1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return wt2;
+}
+
+uint64_t helper_float_add_ps(CPUMIPSState *env,
+ uint64_t fdt0, uint64_t fdt1)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t wtl2;
+uint32_t wth2;
+
+wtl2 = float32_add(fstl0, fstl1, >active_fpu.fp_status);
+wth2 = float32_add(fsth0, fsth1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return ((uint64_t)wth2 << 32) | wtl2;
+}
+
+
 /* MIPS specific binary operations */
 uint64_t helper_float_recip2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
 {
-- 
2.20.1




[PATCH v3 05/18] target/mips: fpu: Remove now unused macro FLOAT_BINOP

2020-05-16 Thread Aleksandar Markovic
After demacroing ., this macro is not
needed anymore.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 39 ---
 1 file changed, 39 deletions(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 2759c9989d..a3a39681f8 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1170,45 +1170,6 @@ FLOAT_CLASS(class_d, 64)
 #undef FLOAT_CLASS
 
 /* binary operations */
-#define FLOAT_BINOP(name)  \
-uint64_t helper_float_ ## name ## _d(CPUMIPSState *env,\
- uint64_t fdt0, uint64_t fdt1) \
-{  \
-uint64_t dt2;  \
-   \
-dt2 = float64_ ## name(fdt0, fdt1, >active_fpu.fp_status);\
-update_fcr31(env, GETPC());\
-return dt2;\
-}  \
-   \
-uint32_t helper_float_ ## name ## _s(CPUMIPSState *env,\
- uint32_t fst0, uint32_t fst1) \
-{  \
-uint32_t wt2;  \
-   \
-wt2 = float32_ ## name(fst0, fst1, >active_fpu.fp_status);\
-update_fcr31(env, GETPC());\
-return wt2;\
-}  \
-   \
-uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,   \
-  uint64_t fdt0,   \
-  uint64_t fdt1)   \
-{  \
-uint32_t fst0 = fdt0 & 0X; \
-uint32_t fsth0 = fdt0 >> 32;   \
-uint32_t fst1 = fdt1 & 0X; \
-uint32_t fsth1 = fdt1 >> 32;   \
-uint32_t wt2;  \
-uint32_t wth2; \
-   \
-wt2 = float32_ ## name(fst0, fst1, >active_fpu.fp_status); \
-wth2 = float32_ ## name(fsth0, fsth1, >active_fpu.fp_status);  \
-update_fcr31(env, GETPC());\
-return ((uint64_t)wth2 << 32) | wt2;   \
-}
-
-#undef FLOAT_BINOP
 
 uint64_t helper_float_add_d(CPUMIPSState *env,
 uint64_t fdt0, uint64_t fdt1)
-- 
2.20.1




[PATCH v3 08/18] target/mips: fpu: Demacro NMADD.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 44 +++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index e37fc4075d..d4c065f281 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1495,7 +1495,6 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,  
   \
 update_fcr31(env, GETPC());  \
 return ((uint64_t)fsth0 << 32) | fst0;   \
 }
-FLOAT_FMA(nmadd, float_muladd_negate_result)
 FLOAT_FMA(nmsub, float_muladd_negate_result | float_muladd_negate_c)
 #undef FLOAT_FMA
 
@@ -1577,6 +1576,49 @@ uint64_t helper_float_msub_ps(CPUMIPSState *env, 
uint64_t fdt0,
 return ((uint64_t)fsth0 << 32) | fstl0;
 }
 
+uint64_t helper_float_nmadd_d(CPUMIPSState *env, uint64_t fst0,
+ uint64_t fst1, uint64_t fst2)
+{
+fst0 = float64_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float64_add(fst0, fst2, >active_fpu.fp_status);
+fst0 = float64_chs(fst0);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint32_t helper_float_nmadd_s(CPUMIPSState *env, uint32_t fst0,
+ uint32_t fst1, uint32_t fst2)
+{
+fst0 = float32_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float32_add(fst0, fst2, >active_fpu.fp_status);
+fst0 = float32_chs(fst0);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint64_t helper_float_nmadd_ps(CPUMIPSState *env, uint64_t fdt0,
+  uint64_t fdt1, uint64_t fdt2)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t fstl2 = fdt2 & 0X;
+uint32_t fsth2 = fdt2 >> 32;
+
+fstl0 = float32_mul(fstl0, fstl1, >active_fpu.fp_status);
+fstl0 = float32_add(fstl0, fstl2, >active_fpu.fp_status);
+fstl0 = float32_chs(fstl0);
+fsth0 = float32_mul(fsth0, fsth1, >active_fpu.fp_status);
+fsth0 = float32_add(fsth0, fsth2, >active_fpu.fp_status);
+fsth0 = float32_chs(fsth0);
+
+update_fcr31(env, GETPC());
+return ((uint64_t)fsth0 << 32) | fstl0;
+}
+
 
 #define FLOAT_FMADDSUB(name, bits, muladd_arg)  \
 uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env, \
-- 
2.20.1




[PATCH v3 06/18] target/mips: fpu: Demacro MADD.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 41 +++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index a3a39681f8..c070081cbc 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1495,12 +1495,51 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState 
*env, \
 update_fcr31(env, GETPC());  \
 return ((uint64_t)fsth0 << 32) | fst0;   \
 }
-FLOAT_FMA(madd, 0)
 FLOAT_FMA(msub, float_muladd_negate_c)
 FLOAT_FMA(nmadd, float_muladd_negate_result)
 FLOAT_FMA(nmsub, float_muladd_negate_result | float_muladd_negate_c)
 #undef FLOAT_FMA
 
+uint64_t helper_float_madd_d(CPUMIPSState *env, uint64_t fst0,
+ uint64_t fst1, uint64_t fst2)
+{
+fst0 = float64_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float64_add(fst0, fst2, >active_fpu.fp_status);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint32_t helper_float_madd_s(CPUMIPSState *env, uint32_t fst0,
+ uint32_t fst1, uint32_t fst2)
+{
+fst0 = float32_mul(fst0, fst1, >active_fpu.fp_status);
+fst0 = float32_add(fst0, fst2, >active_fpu.fp_status);
+
+update_fcr31(env, GETPC());
+return fst0;
+}
+
+uint64_t helper_float_madd_ps(CPUMIPSState *env, uint64_t fdt0,
+  uint64_t fdt1, uint64_t fdt2)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t fstl2 = fdt2 & 0X;
+uint32_t fsth2 = fdt2 >> 32;
+
+fstl0 = float32_mul(fstl0, fstl1, >active_fpu.fp_status);
+fstl0 = float32_add(fstl0, fstl2, >active_fpu.fp_status);
+fsth0 = float32_mul(fsth0, fsth1, >active_fpu.fp_status);
+fsth0 = float32_add(fsth0, fsth2, >active_fpu.fp_status);
+
+update_fcr31(env, GETPC());
+return ((uint64_t)fsth0 << 32) | fstl0;
+}
+
+
 #define FLOAT_FMADDSUB(name, bits, muladd_arg)  \
 uint ## bits ## _t helper_float_ ## name(CPUMIPSState *env, \
  uint ## bits ## _t fs, \
-- 
2.20.1




[PATCH v3 02/18] target/mips: fpu: Demacro SUB.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 37 -
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 984f3f4dfb..715a872cae 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1208,7 +1208,6 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,  
 \
 return ((uint64_t)wth2 << 32) | wt2;   \
 }
 
-FLOAT_BINOP(sub)
 FLOAT_BINOP(mul)
 FLOAT_BINOP(div)
 #undef FLOAT_BINOP
@@ -1249,6 +1248,42 @@ uint64_t helper_float_add_ps(CPUMIPSState *env,
 return ((uint64_t)wth2 << 32) | wtl2;
 }
 
+uint64_t helper_float_sub_d(CPUMIPSState *env,
+uint64_t fdt0, uint64_t fdt1)
+{
+uint64_t dt2;
+
+dt2 = float64_sub(fdt0, fdt1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return dt2;
+}
+
+uint32_t helper_float_sub_s(CPUMIPSState *env,
+uint32_t fst0, uint32_t fst1)
+{
+uint32_t wt2;
+
+wt2 = float32_sub(fst0, fst1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return wt2;
+}
+
+uint64_t helper_float_sub_ps(CPUMIPSState *env,
+ uint64_t fdt0, uint64_t fdt1)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t wtl2;
+uint32_t wth2;
+
+wtl2 = float32_sub(fstl0, fstl1, >active_fpu.fp_status);
+wth2 = float32_sub(fsth0, fsth1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return ((uint64_t)wth2 << 32) | wtl2;
+}
+
 
 /* MIPS specific binary operations */
 uint64_t helper_float_recip2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
-- 
2.20.1




[PATCH v3 04/18] target/mips: fpu: Demacro DIV.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 37 -
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 449e945166..2759c9989d 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1208,7 +1208,6 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,  
 \
 return ((uint64_t)wth2 << 32) | wt2;   \
 }
 
-FLOAT_BINOP(div)
 #undef FLOAT_BINOP
 
 uint64_t helper_float_add_d(CPUMIPSState *env,
@@ -1319,6 +1318,42 @@ uint64_t helper_float_mul_ps(CPUMIPSState *env,
 return ((uint64_t)wth2 << 32) | wtl2;
 }
 
+uint64_t helper_float_div_d(CPUMIPSState *env,
+uint64_t fdt0, uint64_t fdt1)
+{
+uint64_t dt2;
+
+dt2 = float64_div(fdt0, fdt1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return dt2;
+}
+
+uint32_t helper_float_div_s(CPUMIPSState *env,
+uint32_t fst0, uint32_t fst1)
+{
+uint32_t wt2;
+
+wt2 = float32_div(fst0, fst1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return wt2;
+}
+
+uint64_t helper_float_div_ps(CPUMIPSState *env,
+ uint64_t fdt0, uint64_t fdt1)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t wtl2;
+uint32_t wth2;
+
+wtl2 = float32_div(fstl0, fstl1, >active_fpu.fp_status);
+wth2 = float32_div(fsth0, fsth1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return ((uint64_t)wth2 << 32) | wtl2;
+}
+
 
 /* MIPS specific binary operations */
 uint64_t helper_float_recip2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
-- 
2.20.1




[PATCH v3 03/18] target/mips: fpu: Demacro MUL.

2020-05-16 Thread Aleksandar Markovic
This is just a cosmetic change to enable tools like gcov, gdb,
callgrind, etc. to better display involved source code.

Signed-off-by: Aleksandar Markovic 
---
 target/mips/fpu_helper.c | 37 -
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/target/mips/fpu_helper.c b/target/mips/fpu_helper.c
index 715a872cae..449e945166 100644
--- a/target/mips/fpu_helper.c
+++ b/target/mips/fpu_helper.c
@@ -1208,7 +1208,6 @@ uint64_t helper_float_ ## name ## _ps(CPUMIPSState *env,  
 \
 return ((uint64_t)wth2 << 32) | wt2;   \
 }
 
-FLOAT_BINOP(mul)
 FLOAT_BINOP(div)
 #undef FLOAT_BINOP
 
@@ -1284,6 +1283,42 @@ uint64_t helper_float_sub_ps(CPUMIPSState *env,
 return ((uint64_t)wth2 << 32) | wtl2;
 }
 
+uint64_t helper_float_mul_d(CPUMIPSState *env,
+uint64_t fdt0, uint64_t fdt1)
+{
+uint64_t dt2;
+
+dt2 = float64_mul(fdt0, fdt1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return dt2;
+}
+
+uint32_t helper_float_mul_s(CPUMIPSState *env,
+uint32_t fst0, uint32_t fst1)
+{
+uint32_t wt2;
+
+wt2 = float32_mul(fst0, fst1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return wt2;
+}
+
+uint64_t helper_float_mul_ps(CPUMIPSState *env,
+ uint64_t fdt0, uint64_t fdt1)
+{
+uint32_t fstl0 = fdt0 & 0X;
+uint32_t fsth0 = fdt0 >> 32;
+uint32_t fstl1 = fdt1 & 0X;
+uint32_t fsth1 = fdt1 >> 32;
+uint32_t wtl2;
+uint32_t wth2;
+
+wtl2 = float32_mul(fstl0, fstl1, >active_fpu.fp_status);
+wth2 = float32_mul(fsth0, fsth1, >active_fpu.fp_status);
+update_fcr31(env, GETPC());
+return ((uint64_t)wth2 << 32) | wtl2;
+}
+
 
 /* MIPS specific binary operations */
 uint64_t helper_float_recip2_d(CPUMIPSState *env, uint64_t fdt0, uint64_t fdt2)
-- 
2.20.1




[PATCH v3 00/18] target/mips: FPU and other cleanups and improvements

2020-05-16 Thread Aleksandar Markovic
This series contains mostly cosmetic FPU cleanups aimed to
make source code recognition easier for tools like gdb, gcov,
calgrind, and others.

There is also a patch that refactors conversion from ieee to
mips fp exception flags. This refactoring will improve the
performance of almost all fp-related mips instructions, albait
very modestly (less that one percent).

There is a patch that introduces some logging in mips_malta.c.

Finally, there is a change of Aleksandar Rikalo's email.

v2->v3:

  - changed Malta patch to perform logging
  - added change of Aleksandar Rikalo's email

v1->v2:

  - added more demacroing


Aleksandar Markovic (18):
  target/mips: fpu: Demacro ADD.
  target/mips: fpu: Demacro SUB.
  target/mips: fpu: Demacro MUL.
  target/mips: fpu: Demacro DIV.
  target/mips: fpu: Remove now unused macro FLOAT_BINOP
  target/mips: fpu: Demacro MADD.
  target/mips: fpu: Demacro MSUB.
  target/mips: fpu: Demacro NMADD.
  target/mips: fpu: Demacro NMSUB.
  target/mips: fpu: Remove now unused UNFUSED_FMA and FLOAT_FMA macros
  target/mips: fpu: Demacro CLASS.
  target/mips: fpu: Remove now unused FLOAT_CLASS macro
  target/mips: fpu: Demacro RINT.
  target/mips: fpu: Remove now unused FLOAT_RINT macro
  target/mips: fpu: Name better paired-single variables
  target/mips: fpu: Refactor conversion from ieee to mips exception
flags
  hw/mips: Add some logging for bad register offset cases
  MAINTAINERS: Change Aleksandar Rikalo's email address

 .mailmap |   3 +-
 MAINTAINERS  |  12 +-
 hw/mips/mips_malta.c |  14 +-
 target/mips/fpu_helper.c | 658 +++
 target/mips/internal.h   |   1 -
 target/mips/msa_helper.c |  77 +++--
 6 files changed, 519 insertions(+), 246 deletions(-)

-- 
2.20.1




Re: [PATCH] linux-user/arm: Reset CPSR_E when entering a signal handler

2020-05-16 Thread Richard Henderson
On 5/16/20 5:58 AM, Peter Maydell wrote:
> On Sat, 16 May 2020 at 05:12, Richard Henderson
>  wrote:
>>
>> On 5/15/20 2:25 PM, Peter Maydell wrote:
 You also need to call arm_rebuild_hflags() after modifying CPSR_E
 otherwise the change doesn't take effect.
>>>
>>> Hmm. I was expecting cpsr_write() to take care of that if we
>>> updated a cpsr flag that was in the hflags, but it looks like
>>> the rebuild_hflags() is in the HELPER() wrapper but not in
>>> cpsr_write() itself. Richard, does anything go wrong if
>>> cpsr_write() proper does the hflags rebuild ?
>>
>> We wind up rebuilding hflags multiple times, is all.
>>
>> Most of the time we call cpsr_write we also do something else that also
>> requires a rebuild.  So we do it once after all updates.
> 
> The downside is that it leaves a trap which makes it really
> easy to introduce bugs where hflags aren't rebuilt: as
> a caller of cpsr_write() I don't really want to have to
> care which cpsr flags happen to be in the hflags or not,
> and it's particularly awkward that simply fixing which
> flags belong in CPSR_USER suddenly means that a call
> that happened to be OK before is now buggy.

I don't see any way around that.

As I said, if we put the rebuild in cpsr_write, then we should also rearrange
the code that calls cpsr_write to assume that's where the rebuild gets done.


r~



Re: [PATCH v2] NetBSD/arm build fix

2020-05-16 Thread Richard Henderson
On 5/16/20 8:41 AM, Nick Hudson wrote:
> Fix building on NetBSD/arm by extracting the FSR value from the
> correct siginfo_t field.
> 
> Signed-off-by: Nick Hudson 
> ---
>  accel/tcg/user-exec.c | 16 +---
>  1 file changed, 13 insertions(+), 3 deletions(-)

Reviewed-by: Richard Henderson 

Queued to tcg-next.


r~



[PATCH v2] NetBSD/arm build fix

2020-05-16 Thread Nick Hudson
Fix building on NetBSD/arm by extracting the FSR value from the
correct siginfo_t field.

Signed-off-by: Nick Hudson 
---
 accel/tcg/user-exec.c | 16 +---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 52359949df..bc391eb454 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -517,6 +517,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
 
 #if defined(__NetBSD__)
 #include 
+#include 
 #endif
 
 int cpu_signal_handler(int host_signum, void *pinfo,
@@ -525,10 +526,12 @@ int cpu_signal_handler(int host_signum, void *pinfo,
 siginfo_t *info = pinfo;
 #if defined(__NetBSD__)
 ucontext_t *uc = puc;
+siginfo_t *si = pinfo;
 #else
 ucontext_t *uc = puc;
 #endif
 unsigned long pc;
+uint32_t fsr;
 int is_write;
 
 #if defined(__NetBSD__)
@@ -539,10 +542,17 @@ int cpu_signal_handler(int host_signum, void *pinfo,
 pc = uc->uc_mcontext.arm_pc;
 #endif
 
-/* error_code is the FSR value, in which bit 11 is WnR (assuming a v6 or
- * later processor; on v5 we will always report this as a read).
+#ifdef __NetBSD__
+fsr = si->si_trap;
+#else
+fsr = uc->uc_mcontext.error_code;
+#endif
+/*
+ * In the FSR, bit 11 is WnR, assuming a v6 or
+ * later processor.  On v5 we will always report
+ * this as a read, which will fail later.
  */
-is_write = extract32(uc->uc_mcontext.error_code, 11, 1);
+is_write = extract32(fsr, 11, 1);
 return handle_cpu_signal(pc, info, is_write, >uc_sigmask);
 }
 
-- 
2.17.1




[Bug 1772165] Re: arm raspi2/raspi3 emulation has no USB support

2020-05-16 Thread Doug Rabson
I think this PDF describes the same OTC controller as the rpi one:

http://rockchip.fr/RK312X%20TRM/chapter-26-usb-otg-2-0.pdf

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1772165

Title:
  arm raspi2/raspi3 emulation has no USB support

Status in QEMU:
  Confirmed

Bug description:
  Using Qemu 2.12.0 on ArchLinux.

  Trying to emulate arm device with `qemu-system-arm` and attach usb
  device for unput using

  ` -usb -device usb-host,bus=001,vendorid=0x1d6b,productid=0x0002 `

  # lsusb returns

  Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
  Bus 001 Device 014: ID 13d3:3487 IMC Networks 
  Bus 001 Device 004: ID 0457:11af Silicon Integrated Systems Corp. 
  Bus 001 Device 003: ID 0bda:57e6 Realtek Semiconductor Corp. 
  Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
  Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

  # qemu returns
  qemu-system-arm: -device usb-host,bus=001,vendorid=0x1d6b,productid=0x0002: 
Bus '001' not found

  
  Tried with connecting external usb keyboard but that didn't seem to work 
either.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1772165/+subscriptions



Re: [PATCH] ati-vga: Do not allow unaligned access via index register

2020-05-16 Thread BALATON Zoltan

On Sat, 16 May 2020, Alexander Bulekov wrote:

On 200516 1513, BALATON Zoltan wrote:

According to docs bits 1 and 0 of MM_INDEX are hard coded to 0 so
unaligned access via this register should not be possible.
This also fixes problems reported in bug #1878134.

Signed-off-by: BALATON Zoltan 
---


Hi Zoltan,
I applied this patch and confirmed that I cannot reproduce the crash in #1878134
Thanks!

Acked-by: Alexander Bulekov 


Thanks, so that should be Tested-by I think but I don't care much about 
tags so whatever works for me.


Regards,
BALATON Zoltan


 hw/display/ati.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/ati.c b/hw/display/ati.c
index f4c4542751..2ee23173b2 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -531,7 +531,7 @@ static void ati_mm_write(void *opaque, hwaddr addr,
 }
 switch (addr) {
 case MM_INDEX:
-s->regs.mm_index = data;
+s->regs.mm_index = data & ~3;
 break;
 case MM_DATA ... MM_DATA + 3:
 /* indexed access to regs or memory */
--
2.21.3









Patch to fix missing Exec field in qemu.desktop

2020-05-16 Thread Victor Lavaud via



Sent with ProtonMail Secure Email.

From 207a1a34accdc5b563d29484292829a4193c35f8 Mon Sep 17 00:00:00 2001
From: Victor Lavaud 
Date: Sat, 16 May 2020 16:33:00 +0200
Subject: [PATCH] Fix missing Exec field in qemu.desktop

Signed-off-by: Victor Lavaud 
---
 ui/qemu.desktop | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/qemu.desktop b/ui/qemu.desktop
index 20f09f56be..1b9f02a0cc 100644
--- a/ui/qemu.desktop
+++ b/ui/qemu.desktop
@@ -6,3 +6,4 @@ Type=Application
 Terminal=false
 Keywords=Emulators;Virtualization;KVM;
 NoDisplay=true
+Exec=qemu
-- 
2.26.2



publickey - victor.lavaud@protonmail.com - 0x54FBFBBD.asc
Description: application/pgp-keys


signature.asc
Description: OpenPGP digital signature


Re: [PATCH 1/1] 9pfs: include linux/limits.h for XATTR_SIZE_MAX

2020-05-16 Thread Dan Robertson
On Sat, May 16, 2020 at 01:30:23PM +0200, Greg Kurz wrote:
> Applied to 9p-next with R-b and Fixes tags, thanks.

Great! Thanks for the feedback everyone.

Cheers,

 - Dan


signature.asc
Description: PGP signature


Re: [PATCH] ati-vga: Do not allow unaligned access via index register

2020-05-16 Thread Alexander Bulekov
On 200516 1513, BALATON Zoltan wrote:
> According to docs bits 1 and 0 of MM_INDEX are hard coded to 0 so
> unaligned access via this register should not be possible.
> This also fixes problems reported in bug #1878134.
> 
> Signed-off-by: BALATON Zoltan 
> ---

Hi Zoltan,
I applied this patch and confirmed that I cannot reproduce the crash in #1878134
Thanks!

Acked-by: Alexander Bulekov 

>  hw/display/ati.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/display/ati.c b/hw/display/ati.c
> index f4c4542751..2ee23173b2 100644
> --- a/hw/display/ati.c
> +++ b/hw/display/ati.c
> @@ -531,7 +531,7 @@ static void ati_mm_write(void *opaque, hwaddr addr,
>  }
>  switch (addr) {
>  case MM_INDEX:
> -s->regs.mm_index = data;
> +s->regs.mm_index = data & ~3;
>  break;
>  case MM_DATA ... MM_DATA + 3:
>  /* indexed access to regs or memory */
> -- 
> 2.21.3
> 
> 



[Bug 1878136] Re: Assertion failures in ati_reg_read_offs/ati_reg_write_offs

2020-05-16 Thread Alexander Bulekov
*** This bug is a duplicate of bug 1878134 ***
https://bugs.launchpad.net/bugs/1878134

** This bug has been marked a duplicate of bug 1878134
   Assertion failures in ati_reg_read_offs/ati_reg_write_offs

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1878136

Title:
   Assertion failures in ati_reg_read_offs/ati_reg_write_offs

Status in QEMU:
  New

Bug description:
  Hello,
  While fuzzing, I found inputs that trigger assertion failures in
  ati_reg_read_offs/ati_reg_write_offs

  uint32_t extract32(uint32_t, int, int): Assertion `start >= 0 &&
  length > 0 && length <= 32 - start' failed

  #3 0x76866092 in __GI___assert_fail (assertion=0x56e760c0  
"start >= 0 && length > 0 && length <= 32 - start", file=0x56e76120  
"/home/alxndr/Development/qemu/include/qemu/bitops.h", line=0x12c, 
function=0x56e76180 <__PRETTY_FUNCTION__.extract32> "uint32_t 
extract32(uint32_t, int, int)") at assert.c:101
  #4 0x5653d8a7 in ati_mm_read (opaque=, addr=0x1a, 
size=) at 
/home/alxndr/Development/qemu/include/qemu/log-for-trace.h:29
  #5 0x5653c825 in ati_mm_read (opaque=, addr=0x4, 
size=) at /home/alxndr/Development/qemu/hw/display/ati.c:289
  #6 0x5601446e in memory_region_read_accessor (mr=0x6314dc20, 
addr=, value=, size=, 
shift=, mask=, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:434
  #7 0x56001a70 in access_with_adjusted_size (addr=, 
value=, size=, access_size_min=, 
access_size_max=, access_fn=, mr=0x6314dc20, 
attrs=...) at /home/alxndr/Development/qemu/memory.c:544
  #8 0x56001a70 in memory_region_dispatch_read1 (mr=0x6314dc20, 
addr=0x4, pval=, size=0x4, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:1396

  I can reproduce it in qemu 5.0 built with using:
  cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -device ati-vga -nographic -qtest stdio -monitor none -serial none
  outl 0xcf8 0x80001018
  outl 0xcfc 0xe200
  outl 0xcf8 0x8000101c
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x8000fa20
  write 0xe204 0x1 0x1a
  readq 0xe200
  EOF

  Similarly for ati_reg_write_offs:
  cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -device ati-vga -nographic -qtest stdio -monitor none -serial none
  outl 0xcf8 0x80001018
  outl 0xcfc 0xe200
  outl 0xcf8 0x8000101c
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x8000fa20
  write 0xe200 0x8 0x6a006a00
  EOF

  I also attached the traces to this launchpad report, in case the
  formatting is broken:

  qemu-system-i386 -M pc-q35-5.0 -device ati-vga -nographic -qtest stdio
  -monitor none -serial none < attachment

  Please let me know if I can provide any further info.
  -Alex

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1878136/+subscriptions



[PATCH] virtio-crypto: Convert DPRINTF to trace event

2020-05-16 Thread teachk
From: Hou Weiying 

Signed-off-by: Hou Weiying 
---
 hw/virtio/trace-events| 12 
 hw/virtio/virtio-crypto.c | 26 ++
 include/hw/virtio/virtio-crypto.h | 11 ---
 3 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index e83500bee9..f7c20f211a 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -73,3 +73,15 @@ virtio_iommu_get_domain(uint32_t domain_id) "Alloc domain=%d"
 virtio_iommu_put_domain(uint32_t domain_id) "Free domain=%d"
 virtio_iommu_translate_out(uint64_t virt_addr, uint64_t phys_addr, uint32_t 
sid) "0x%"PRIx64" -> 0x%"PRIx64 " for sid=%d"
 virtio_iommu_report_fault(uint8_t reason, uint32_t flags, uint32_t endpoint, 
uint64_t addr) "FAULT reason=%d flags=%d endpoint=%d address =0x%"PRIx64
+
+# virtio-crypto.c
+virtio_crypto_cipher_session_helper_cipher_alg_and_direction(uint32_t 
cipher_alg, uint8_t direction) "cipher_alg=%" PRIu32 ", info->direction=%" 
PRIu32
+virtio_crypto_cipher_session_helper_keylen(uint32_t keylen) "keylen=%" PRIu32
+virtio_crypto_create_sym_session_auth_keylen(uint32_t auth_keylen) 
"auth_keylen=%" PRIu32
+virtio_crypto_create_sym_session_session_id(int64_t session_id) "create 
session_id=%" PRIu64 " successfully"
+virtio_crypto_sym_op_helper_src_len(uint32_t src_len) "src_len=%" PRIu32
+virtio_crypto_sym_op_helper_dst_len(uint32_t dst_len) "dst_len=%" PRIu32
+virtio_crypto_sym_op_helper_hash_result_len(uint32_t hash_result_len) 
"hash_result_len=%" PRIu32
+virtio_crypto_handle_close_session(uint64_t session_id) "close session id %" 
PRIu64
+virtio_crypto_sym_op_helper_iv_len(uint32_t iv_len) "iv_len %" PRIu32
+virtio_crypto_sym_op_helper_aad_len(uint32_t aad_len) "aad_len %" PRIu32
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index bd9165c565..676948a4dd 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -24,6 +24,7 @@
 #include "hw/virtio/virtio-access.h"
 #include "standard-headers/linux/virtio_ids.h"
 #include "sysemu/cryptodev-vhost.h"
+#include "trace.h"
 
 #define VIRTIO_CRYPTO_VM_VERSION 1
 
@@ -49,8 +50,9 @@ virtio_crypto_cipher_session_helper(VirtIODevice *vdev,
 info->cipher_alg = ldl_le_p(_para->algo);
 info->key_len = ldl_le_p(_para->keylen);
 info->direction = ldl_le_p(_para->op);
-DPRINTF("cipher_alg=%" PRIu32 ", info->direction=%" PRIu32 "\n",
- info->cipher_alg, info->direction);
+trace_virtio_crypto_cipher_session_helper_cipher_alg_and_direction(
+info->cipher_alg, info->direction);
+
 
 if (info->key_len > vcrypto->conf.max_cipher_key_len) {
 error_report("virtio-crypto length of cipher key is too big: %u",
@@ -60,7 +62,7 @@ virtio_crypto_cipher_session_helper(VirtIODevice *vdev,
 /* Get cipher key */
 if (info->key_len > 0) {
 size_t s;
-DPRINTF("keylen=%" PRIu32 "\n", info->key_len);
+trace_virtio_crypto_cipher_session_helper_keylen(info->key_len);
 
 info->cipher_key = g_malloc(info->key_len);
 s = iov_to_buf(*iov, num, 0, info->cipher_key, info->key_len);
@@ -130,7 +132,8 @@ virtio_crypto_create_sym_session(VirtIOCrypto *vcrypto,
 }
 /* get auth key */
 if (info.auth_key_len > 0) {
-DPRINTF("auth_keylen=%" PRIu32 "\n", info.auth_key_len);
+trace_virtio_crypto_create_sym_session_auth_keylen(
+info.auth_key_len);
 info.auth_key = g_malloc(info.auth_key_len);
 s = iov_to_buf(iov, out_num, 0, info.auth_key,
info.auth_key_len);
@@ -165,8 +168,7 @@ virtio_crypto_create_sym_session(VirtIOCrypto *vcrypto,
  vcrypto->cryptodev,
  , queue_index, _err);
 if (session_id >= 0) {
-DPRINTF("create session_id=%" PRIu64 " successfully\n",
-session_id);
+trace_virtio_crypto_create_sym_session_session_id(session_id);
 
 ret = session_id;
 } else {
@@ -193,7 +195,7 @@ virtio_crypto_handle_close_session(VirtIOCrypto *vcrypto,
 Error *local_err = NULL;
 
 session_id = ldq_le_p(_sess_req->session_id);
-DPRINTF("close session, id=%" PRIu64 "\n", session_id);
+trace_virtio_crypto_handle_close_session(session_id);
 
 ret = cryptodev_backend_sym_close_session(
   vcrypto->cryptodev, session_id, queue_id, _err);
@@ -474,7 +476,7 @@ virtio_crypto_sym_op_helper(VirtIODevice *vdev,
 op_info->len_to_cipher = len_to_cipher;
 /* Handle the initilization vector */
 if (op_info->iv_len > 0) {
-DPRINTF("iv_len=%" PRIu32 "\n", op_info->iv_len);
+trace_virtio_crypto_sym_op_helper_iv_len(op_info->iv_len);
 op_info->iv = op_info->data + curr_size;
 
 s = iov_to_buf(iov, out_num, 0, op_info->iv, op_info->iv_len);
@@ -488,7 +490,7 @@ 

[PATCH] virtio-crypto: Convert DPRINTF to trace event

2020-05-16 Thread teachk
From: Hou Weiying 

Signed-off-by: Hou Weiying 
---
 hw/virtio/trace-events| 12 
 hw/virtio/virtio-crypto.c | 26 ++
 include/hw/virtio/virtio-crypto.h | 11 ---
 3 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index e83500bee9..f7c20f211a 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -73,3 +73,15 @@ virtio_iommu_get_domain(uint32_t domain_id) "Alloc domain=%d"
 virtio_iommu_put_domain(uint32_t domain_id) "Free domain=%d"
 virtio_iommu_translate_out(uint64_t virt_addr, uint64_t phys_addr, uint32_t 
sid) "0x%"PRIx64" -> 0x%"PRIx64 " for sid=%d"
 virtio_iommu_report_fault(uint8_t reason, uint32_t flags, uint32_t endpoint, 
uint64_t addr) "FAULT reason=%d flags=%d endpoint=%d address =0x%"PRIx64
+
+# virtio-crypto.c
+virtio_crypto_cipher_session_helper_cipher_alg_and_direction(uint32_t 
cipher_alg, uint8_t direction) "cipher_alg=%" PRIu32 ", info->direction=%" 
PRIu32
+virtio_crypto_cipher_session_helper_keylen(uint32_t keylen) "keylen=%" PRIu32
+virtio_crypto_create_sym_session_auth_keylen(uint32_t auth_keylen) 
"auth_keylen=%" PRIu32
+virtio_crypto_create_sym_session_session_id(int64_t session_id) "create 
session_id=%" PRIu64 " successfully"
+virtio_crypto_sym_op_helper_src_len(uint32_t src_len) "src_len=%" PRIu32
+virtio_crypto_sym_op_helper_dst_len(uint32_t dst_len) "dst_len=%" PRIu32
+virtio_crypto_sym_op_helper_hash_result_len(uint32_t hash_result_len) 
"hash_result_len=%" PRIu32
+virtio_crypto_handle_close_session(uint64_t session_id) "close session id %" 
PRIu64
+virtio_crypto_sym_op_helper_iv_len(uint32_t iv_len) "iv_len %" PRIu32
+virtio_crypto_sym_op_helper_aad_len(uint32_t aad_len) "aad_len %" PRIu32
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index bd9165c565..676948a4dd 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -24,6 +24,7 @@
 #include "hw/virtio/virtio-access.h"
 #include "standard-headers/linux/virtio_ids.h"
 #include "sysemu/cryptodev-vhost.h"
+#include "trace.h"
 
 #define VIRTIO_CRYPTO_VM_VERSION 1
 
@@ -49,8 +50,9 @@ virtio_crypto_cipher_session_helper(VirtIODevice *vdev,
 info->cipher_alg = ldl_le_p(_para->algo);
 info->key_len = ldl_le_p(_para->keylen);
 info->direction = ldl_le_p(_para->op);
-DPRINTF("cipher_alg=%" PRIu32 ", info->direction=%" PRIu32 "\n",
- info->cipher_alg, info->direction);
+trace_virtio_crypto_cipher_session_helper_cipher_alg_and_direction(
+info->cipher_alg, info->direction);
+
 
 if (info->key_len > vcrypto->conf.max_cipher_key_len) {
 error_report("virtio-crypto length of cipher key is too big: %u",
@@ -60,7 +62,7 @@ virtio_crypto_cipher_session_helper(VirtIODevice *vdev,
 /* Get cipher key */
 if (info->key_len > 0) {
 size_t s;
-DPRINTF("keylen=%" PRIu32 "\n", info->key_len);
+trace_virtio_crypto_cipher_session_helper_keylen(info->key_len);
 
 info->cipher_key = g_malloc(info->key_len);
 s = iov_to_buf(*iov, num, 0, info->cipher_key, info->key_len);
@@ -130,7 +132,8 @@ virtio_crypto_create_sym_session(VirtIOCrypto *vcrypto,
 }
 /* get auth key */
 if (info.auth_key_len > 0) {
-DPRINTF("auth_keylen=%" PRIu32 "\n", info.auth_key_len);
+trace_virtio_crypto_create_sym_session_auth_keylen(
+info.auth_key_len);
 info.auth_key = g_malloc(info.auth_key_len);
 s = iov_to_buf(iov, out_num, 0, info.auth_key,
info.auth_key_len);
@@ -165,8 +168,7 @@ virtio_crypto_create_sym_session(VirtIOCrypto *vcrypto,
  vcrypto->cryptodev,
  , queue_index, _err);
 if (session_id >= 0) {
-DPRINTF("create session_id=%" PRIu64 " successfully\n",
-session_id);
+trace_virtio_crypto_create_sym_session_session_id(session_id);
 
 ret = session_id;
 } else {
@@ -193,7 +195,7 @@ virtio_crypto_handle_close_session(VirtIOCrypto *vcrypto,
 Error *local_err = NULL;
 
 session_id = ldq_le_p(_sess_req->session_id);
-DPRINTF("close session, id=%" PRIu64 "\n", session_id);
+trace_virtio_crypto_handle_close_session(session_id);
 
 ret = cryptodev_backend_sym_close_session(
   vcrypto->cryptodev, session_id, queue_id, _err);
@@ -474,7 +476,7 @@ virtio_crypto_sym_op_helper(VirtIODevice *vdev,
 op_info->len_to_cipher = len_to_cipher;
 /* Handle the initilization vector */
 if (op_info->iv_len > 0) {
-DPRINTF("iv_len=%" PRIu32 "\n", op_info->iv_len);
+trace_virtio_crypto_sym_op_helper_iv_len(op_info->iv_len);
 op_info->iv = op_info->data + curr_size;
 
 s = iov_to_buf(iov, out_num, 0, op_info->iv, op_info->iv_len);
@@ -488,7 +490,7 @@ 

Re: [Bug 1878134] [NEW] Assertion failures in ati_reg_read_offs/ati_reg_write_offs

2020-05-16 Thread BALATON Zoltan
Sent patch that should fix this:
https://patchew.org/QEMU/20200516132352.39e93745...@zero.eik.bme.hu/

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1878134

Title:
  Assertion failures in ati_reg_read_offs/ati_reg_write_offs

Status in QEMU:
  New

Bug description:
  Hello,
  While fuzzing, I found inputs that trigger assertion failures in
  ati_reg_read_offs/ati_reg_write_offs

  uint32_t extract32(uint32_t, int, int): Assertion `start >= 0 &&
  length > 0 && length <= 32 - start' failed

  #3  0x76866092 in __GI___assert_fail (assertion=0x56e760c0  
"start >= 0 && length > 0 && length <= 32 - start", file=0x56e76120  
"/home/alxndr/Development/qemu/include/qemu/bitops.h", line=0x12c, 
function=0x56e76180 <__PRETTY_FUNCTION__.extract32> "uint32_t 
extract32(uint32_t, int, int)") at assert.c:101
  #4  0x5653d8a7 in ati_mm_read (opaque=, addr=0x1a, 
size=) at 
/home/alxndr/Development/qemu/include/qemu/log-for-trace.h:29
  #5  0x5653c825 in ati_mm_read (opaque=, addr=0x4, 
size=) at /home/alxndr/Development/qemu/hw/display/ati.c:289
  #6  0x5601446e in memory_region_read_accessor (mr=0x6314dc20, 
addr=, value=, size=, 
shift=, mask=, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:434
  #7  0x56001a70 in access_with_adjusted_size (addr=, 
value=, size=, access_size_min=, 
access_size_max=, access_fn=, mr=0x6314dc20, 
attrs=...) at /home/alxndr/Development/qemu/memory.c:544
  #8  0x56001a70 in memory_region_dispatch_read1 (mr=0x6314dc20, 
addr=0x4, pval=, size=0x4, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:1396

  
  I can reproduce it in qemu 5.0 built with using:
  cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -device ati-vga -nographic -qtest stdio -monitor none -serial none
  outl 0xcf8 0x80001018
  outl 0xcfc 0xe200
  outl 0xcf8 0x8000101c
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x8000fa20
  write 0xe204 0x1 0x1a
  readq 0xe200
  EOF

  Similarly for ati_reg_write_offs:
  cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -device ati-vga -nographic -qtest stdio -monitor none -serial none
  outl 0xcf8 0x80001018
  outl 0xcfc 0xe200
  outl 0xcf8 0x8000101c
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x8000fa20
  write 0xe200 0x8 0x6a006a00
  EOF

  I also attached the traces to this launchpad report, in case the
  formatting is broken:

  qemu-system-i386 -M pc-q35-5.0 -device ati-vga -nographic -qtest stdio
  -monitor none -serial none < attachment

  Please let me know if I can provide any further info.
  -Alex

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1878134/+subscriptions



[PATCH] ati-vga: Do not allow unaligned access via index register

2020-05-16 Thread BALATON Zoltan
According to docs bits 1 and 0 of MM_INDEX are hard coded to 0 so
unaligned access via this register should not be possible.
This also fixes problems reported in bug #1878134.

Signed-off-by: BALATON Zoltan 
---
 hw/display/ati.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/ati.c b/hw/display/ati.c
index f4c4542751..2ee23173b2 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -531,7 +531,7 @@ static void ati_mm_write(void *opaque, hwaddr addr,
 }
 switch (addr) {
 case MM_INDEX:
-s->regs.mm_index = data;
+s->regs.mm_index = data & ~3;
 break;
 case MM_DATA ... MM_DATA + 3:
 /* indexed access to regs or memory */
-- 
2.21.3




Re: [PATCH] linux-user/arm: Reset CPSR_E when entering a signal handler

2020-05-16 Thread Peter Maydell
On Sat, 16 May 2020 at 05:12, Richard Henderson
 wrote:
>
> On 5/15/20 2:25 PM, Peter Maydell wrote:
> >> You also need to call arm_rebuild_hflags() after modifying CPSR_E
> >> otherwise the change doesn't take effect.
> >
> > Hmm. I was expecting cpsr_write() to take care of that if we
> > updated a cpsr flag that was in the hflags, but it looks like
> > the rebuild_hflags() is in the HELPER() wrapper but not in
> > cpsr_write() itself. Richard, does anything go wrong if
> > cpsr_write() proper does the hflags rebuild ?
>
> We wind up rebuilding hflags multiple times, is all.
>
> Most of the time we call cpsr_write we also do something else that also
> requires a rebuild.  So we do it once after all updates.

The downside is that it leaves a trap which makes it really
easy to introduce bugs where hflags aren't rebuilt: as
a caller of cpsr_write() I don't really want to have to
care which cpsr flags happen to be in the hflags or not,
and it's particularly awkward that simply fixing which
flags belong in CPSR_USER suddenly means that a call
that happened to be OK before is now buggy.

thanks
-- PMM



Re: [PATCH v6 00/16] acpi: i386 tweaks

2020-05-16 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20200515150421.25479-1-kra...@redhat.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20200515150421.25479-1-kra...@redhat.com
Subject: [PATCH v6 00/16] acpi: i386 tweaks
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
9adb28d acpi: q35: drop _SB.PCI0.ISA.LPCD opregion.
646a108 acpi: drop build_piix4_pm()
6324bba acpi: drop serial/parallel enable bits from dsdt
4a8ceb8 acpi: simplify build_isa_devices_aml()
d8ccc6f acpi: factor out fw_cfg_add_acpi_dsdt()
e0c5fc4 acpi: move aml builder code for i8042 (kbd+mouse) device
4eb0cc0 floppy: move cmos_get_fd_drive_type() from pc
71d56fa floppy: make isa_fdc_get_drive_max_chs static
c895a16 acpi: move aml builder code for floppy device
41e32d4 acpi: move aml builder code for parallel device
fe41881 acpi: parallel: don't use _STA method
bcb5ae4 acpi: move aml builder code for serial device
49e11f9 acpi: serial: don't use _STA method
6e7ae5d acpi: rtc: use a single crs range
e1b1294 acpi: move aml builder code for rtc device
10fc2d4 qtest: allow DSDT acpi table changes

=== OUTPUT BEGIN ===
1/16 Checking commit 10fc2d45a6fa (qtest: allow DSDT acpi table changes)
2/16 Checking commit e1b1294da937 (acpi: move aml builder code for rtc device)
3/16 Checking commit 6e7ae5d0138b (acpi: rtc: use a single crs range)
4/16 Checking commit 49e11f9e91f4 (acpi: serial: don't use _STA method)
5/16 Checking commit bcb5ae4dd8b1 (acpi: move aml builder code for serial 
device)
6/16 Checking commit fe4188155acf (acpi: parallel: don't use _STA method)
7/16 Checking commit 41e32d4b35c3 (acpi: move aml builder code for parallel 
device)
8/16 Checking commit c895a1614849 (acpi: move aml builder code for floppy 
device)
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#245: 
new file mode 100644

total: 0 errors, 1 warnings, 221 lines checked

Patch 8/16 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
9/16 Checking commit 71d56fa8b146 (floppy: make isa_fdc_get_drive_max_chs 
static)
10/16 Checking commit 4eb0cc051852 (floppy: move cmos_get_fd_drive_type() from 
pc)
ERROR: Missing Signed-off-by: line(s)

total: 1 errors, 0 warnings, 82 lines checked

Patch 10/16 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

11/16 Checking commit e0c5fc44de76 (acpi: move aml builder code for i8042 
(kbd+mouse) device)
12/16 Checking commit d8ccc6f08dcd (acpi: factor out fw_cfg_add_acpi_dsdt())
13/16 Checking commit 4a8ceb8d9dd9 (acpi: simplify build_isa_devices_aml())
14/16 Checking commit 6324bbac2984 (acpi: drop serial/parallel enable bits from 
dsdt)
15/16 Checking commit 646a108f5ece (acpi: drop build_piix4_pm())
16/16 Checking commit 9adb28d40ad3 (acpi: q35: drop _SB.PCI0.ISA.LPCD opregion.)
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20200515150421.25479-1-kra...@redhat.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

Re: [PATCH 0/4] RISC-V multi-socket support

2020-05-16 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20200516063746.18296-1-anup.pa...@wdc.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20200516063746.18296-1-anup.pa...@wdc.com
Subject: [PATCH 0/4] RISC-V multi-socket support
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
9031755 hw/riscv: virt: Allow creating multiple sockets
67e9547 hw/riscv: Allow creating multiple instances of PLIC
2999a11 hw/riscv: spike: Allow creating multiple sockets
b563a80 hw/riscv: Allow creating multiple instances of CLINT

=== OUTPUT BEGIN ===
1/4 Checking commit b563a8089a7a (hw/riscv: Allow creating multiple instances 
of CLINT)
2/4 Checking commit 2999a1101f27 (hw/riscv: spike: Allow creating multiple 
sockets)
ERROR: braces {} are necessary for all arms of this statement
#202: FILE: hw/riscv/spike.c:194:
+if ((smp_cpus / s->num_socs) < SPIKE_CPUS_PER_SOCKET_MIN)
[...]

ERROR: braces {} are necessary for all arms of this statement
#206: FILE: hw/riscv/spike.c:198:
+if (SPIKE_SOCKETS_MAX < s->num_socs)
[...]

ERROR: braces {} are necessary for all arms of this statement
#212: FILE: hw/riscv/spike.c:204:
+if (i == (s->num_socs - 1))
[...]
+else
[...]

WARNING: line over 80 characters
#248: FILE: hw/riscv/spike.c:299:
+htif_mm_init(system_memory, mask_rom, >soc[0].harts[0].env, 
serial_hd(0));

WARNING: line over 80 characters
#266: FILE: hw/riscv/spike.c:322:
+object_initialize_child(OBJECT(machine), "soc", >soc[0], 
sizeof(s->soc[0]),

WARNING: line over 80 characters
#284: FILE: hw/riscv/spike.c:386:
+htif_mm_init(system_memory, mask_rom, >soc[0].harts[0].env, 
serial_hd(0));

WARNING: line over 80 characters
#302: FILE: hw/riscv/spike.c:414:
+object_initialize_child(OBJECT(machine), "soc", >soc[0], 
sizeof(s->soc[0]),

WARNING: line over 80 characters
#329: FILE: hw/riscv/spike.c:497:
+htif_mm_init(system_memory, mask_rom, >soc[0].harts[0].env, 
serial_hd(0));

total: 3 errors, 5 warnings, 322 lines checked

Patch 2/4 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

3/4 Checking commit 67e95477fcbe (hw/riscv: Allow creating multiple instances 
of PLIC)
4/4 Checking commit 90317551d9da (hw/riscv: virt: Allow creating multiple 
sockets)
ERROR: spaces required around that '*' (ctx:VxV)
#32: FILE: hw/riscv/virt.c:63:
+[VIRT_PLIC] ={  0xc00, VIRT_PLIC_SIZE(VIRT_CPUS_MAX*2) },
^

WARNING: line over 80 characters
#295: FILE: hw/riscv/virt.c:343:
+qemu_fdt_setprop_cell(fdt, name, "interrupt-parent", 
plic_virtio_phandle);

ERROR: braces {} are necessary for all arms of this statement
#478: FILE: hw/riscv/virt.c:497:
+if ((smp_cpus / s->num_socs) < VIRT_CPUS_PER_SOCKET_MIN)
[...]

ERROR: braces {} are necessary for all arms of this statement
#482: FILE: hw/riscv/virt.c:501:
+if (VIRT_SOCKETS_MAX < s->num_socs)
[...]

ERROR: braces {} are necessary for all arms of this statement
#497: FILE: hw/riscv/virt.c:508:
+if (i == (s->num_socs - 1))
[...]
+else
[...]

total: 4 errors, 1 warnings, 638 lines checked

Patch 4/4 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20200516063746.18296-1-anup.pa...@wdc.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

[Bug 1877384] Re: 9pfs file create with mapped-xattr can fail on overlayfs

2020-05-16 Thread Christian Schoenebeck
Yes, that compile error with QEMU + recent kernel headers is a bit
annoying, and AFAICS it is not fixed in Debian yet.

Would you mind writing a test case for this bug that you fixed, to
prevent this accidentally being broken in future again?

Please note that 9pfs is currently only been taken care of by 2 people,
and both only on a side channel. The 9pfs code base is complex and error
prone to edge cases like this one, so active assistance would be very
much appreciated!

If you might consider writing a test case, I would give you quick, easy
and short instructions how to compile the 9pfs test cases, and which
source files to touch. There is no guest OS installation required for
the test cases.

Thanks!

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1877384

Title:
  9pfs file create with mapped-xattr can fail on overlayfs

Status in QEMU:
  New

Bug description:
  QEMU Version: 3.1.0 as packaged in debian buster, but the code appears to do 
the same in master.
  qemu command-line: qemu-system-x86_64 -m 1G -nographic -nic 
"user,model=virtio-net-pci,tftp=$(pwd),net=10.0.2.0/24,host=10.0.2.2" -fsdev 
local,id=fs,path=$thisdir/..,security_model=mapped-xattr -device 
virtio-9p-pci,fsdev=fs,mount_tag=fs -drive 
"file=$rootdisk,if=virtio,format=raw" -kernel "$kernel" -initrd "$initrd" 
-append "$append"

  
  I'm using CI that runs in a Docker container and runs a qemu VM with code and 
results shared via virtio 9p.
  The 9p fsdev is configured with security_model=mapped-xattr
  When the test code attempts to create a log file in an existing directory, 
open with O_CREAT fails with -ENOENT.

  The relevant strace excerpt is:

  28791 openat(11, ".", O_RDONLY|O_NOFOLLOW|O_PATH|O_DIRECTORY) = 20
  28791 openat(20, "src", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW|O_DIRECTORY) 
= 21
  28791 fcntl(21, F_SETFL, O_RDONLY|O_DIRECTORY) = 0
  28791 close(20) = 0
  28791 openat(21, "client.log", 
O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW, 0600) = 20
  28791 fcntl(20, F_SETFL, O_WRONLY|O_CREAT|O_NONBLOCK|O_NOFOLLOW) = 0
  28791 lsetxattr("/proc/self/fd/21/client.log", "user.virtfs.uid", "\0\0\0", 
4, 0) = -1 ENOENT (No such file or directory)

  My hypothesis for what's going wrong is since the Docker container's
  overlayfs copies-up on writes, when it opens the file it's created a
  new version of the `src` directory containing a `client.log`, but this
  new src directory isn't accessible by file descriptor 20 and the
  lsetxattr call is instead attempting to set attributes on the path in
  the old `src` directory.

  Looking at the code, a fix would be to change `hw/9pfs/9p-local.c` and
  change `local_open2` to instead of calling `local_set_xattrat` to set
  the xattrs by directory file descriptor and file name, to have a
  version of local_set_xattrat` which uses `fsetxattr` to set the virtfs
  attributes instead of the `fsetxattrat_nofollow` helper.

  This reliably happened for me in CI, but I don't have access to the CI
  host or the time to strip the test down to make a minimal test case,
  and had difficulty reproducing the error on other machines.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1877384/+subscriptions



Re: Null-pointer dereference through virtio-balloon

2020-05-16 Thread Philippe Mathieu-Daudé
+David (virtio-balloon maintainer)

On Mon, May 11, 2020 at 6:42 AM Alexander Bulekov  wrote:
>
> Hello,
> While fuzzing, I found an input that triggers a null-ptr dereference in
> aio_bh_enqueue, through virtio-balloon. Based on the stacktrace below,
> I am not positive that this is specific to virtio-balloon, however
> I have not encountered the same issue for any of the other virtio
> devices I am fuzzing.
>
> AddressSanitizer: SEGV on unknown address 0x
>
> #0 0x55ee5b93eb28 in aio_bh_enqueue util/async.c:69:27
> #1 0x55ee5b93eb28 in qemu_bh_schedule util/async.c:181:5
> #2 0x55ee5ae71465 in virtio_queue_notify hw/virtio/virtio.c:2364:9
> #3 0x55ee5b51142d in virtio_mmio_write hw/virtio/virtio-mmio.c:369:13
> #4 0x55ee5ad0d2d6 in memory_region_write_accessor memory.c:483:5
> #5 0x55ee5ad0cc7f in access_with_adjusted_size memory.c:544:18
> #6 0x55ee5ad0cc7f in memory_region_dispatch_write memory.c:1476:16
> #7 0x55ee5ac221d3 in flatview_write_continue exec.c:3137:23
> #8 0x55ee5ac1ab97 in flatview_write exec.c:3177:14
> #9 0x55ee5ac1ab97 in address_space_write exec.c:3268:18
>
> I can reproduce it in a qemu 5.0 build using:
> cat << EOF | qemu-system-i386 -M pc-q35-5.0 -M 
> microvm,x-option-roms=off,pit=off,pic=off,isa-serial=off,rtc=off -nographic 
> -device virtio-balloon-device,free-page-hint=true,deflate-on-oom=true 
> -nographic -monitor none -display none -serial none -qtest stdio
> write 0xce30 0x24 
> 0x030003000300030003000300030003000300
> EOF

If you start QEMU this way, you get a warning:

qemu-system-i386: -device
virtio-balloon-device,free-page-hint=true,deflate-on-oom=true:
iothread is missing

if (s->iothread) {
s->free_page_bh =
aio_bh_new(iothread_get_aio_context(s->iothread), ...
...
} else {
...
   virtio_error(vdev, "iothread is missing");
}

Shouldn't we call error_setg(errp, "iothread is missing") and return instead?

>
>
> I also uploaded the above trace, in case the formatting is broken:
>
> curl https://paste.debian.net/plain/1146094 | qemu-system-i386 -M pc-q35-5.0 
> -M microvm,x-option-roms=off,pit=off,pic=off,isa-serial=off,rtc=off 
> -nographic -device 
> virtio-balloon-device,free-page-hint=true,deflate-on-oom=true -nographic 
> -monitor none -display none -serial none -qtest stdio
>
> Please let me know if I can provide any further info.
> -Alex
>




Re: [Bug 1878134] [NEW] Assertion failures in ati_reg_read_offs/ati_reg_write_offs

2020-05-16 Thread BALATON Zoltan
On Fri, 15 May 2020, Launchpad Bug Tracker wrote:
> You have been subscribed to a public bug by Philippe Mathieu-Daudé (philmd):
>
> Hello,
> While fuzzing, I found inputs that trigger assertion failures in
> ati_reg_read_offs/ati_reg_write_offs
>
> uint32_t extract32(uint32_t, int, int): Assertion `start >= 0 && length
>> 0 && length <= 32 - start' failed
>
> #3  0x76866092 in __GI___assert_fail (assertion=0x56e760c0  
> "start >= 0 && length > 0 && length <= 32 - start", file=0x56e76120  
> "/home/alxndr/Development/qemu/include/qemu/bitops.h", line=0x12c, 
> function=0x56e76180 <__PRETTY_FUNCTION__.extract32> "uint32_t 
> extract32(uint32_t, int, int)") at assert.c:101
> #4  0x5653d8a7 in ati_mm_read (opaque=, addr=0x1a, 
> size=) at 
> /home/alxndr/Development/qemu/include/qemu/log-for-trace.h:29
> #5  0x5653c825 in ati_mm_read (opaque=, addr=0x4, 
> size=) at /home/alxndr/Development/qemu/hw/display/ati.c:289
> #6  0x5601446e in memory_region_read_accessor (mr=0x6314dc20, 
> addr=, value=, size=, 
> shift=, mask=, attrs=...) at 
> /home/alxndr/Development/qemu/memory.c:434
> #7  0x56001a70 in access_with_adjusted_size (addr=, 
> value=, size=, access_size_min=, 
> access_size_max=, access_fn=, 
> mr=0x6314dc20, attrs=...) at /home/alxndr/Development/qemu/memory.c:544
> #8  0x56001a70 in memory_region_dispatch_read1 (mr=0x6314dc20, 
> addr=0x4, pval=, size=0x4, attrs=...) at 
> /home/alxndr/Development/qemu/memory.c:1396

Here's a stack trace with --enable debug which is more useful:

#4  0x55b39464 in extract32 (value=0, start=16, length=32) at 
/home/balaton/src/qemu/include/qemu/bitops.h:300
#5  0x55b3a45f in ati_reg_read_offs (reg=0, offs=2, size=4) at 
hw/display/ati.c:269
#6  0x55b3a9f1 in ati_mm_read (opaque=0x56f35610, addr=26, size=4) 
at hw/display/ati.c:299
#7  0x55b3a988 in ati_mm_read (opaque=0x56f35610, addr=4, size=4) 
at hw/display/ati.c:290

It's trying to do an indexed read via MM_DATA reg of the middle of reg 
0x18 BIOS_2_SCRATCH which ends up calling ati_reg_read_offs with out of 
bound values. Maybe we should clamp size somewhere.

Regards,
BALATON Zoltan

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1878134

Title:
  Assertion failures in ati_reg_read_offs/ati_reg_write_offs

Status in QEMU:
  New

Bug description:
  Hello,
  While fuzzing, I found inputs that trigger assertion failures in
  ati_reg_read_offs/ati_reg_write_offs

  uint32_t extract32(uint32_t, int, int): Assertion `start >= 0 &&
  length > 0 && length <= 32 - start' failed

  #3  0x76866092 in __GI___assert_fail (assertion=0x56e760c0  
"start >= 0 && length > 0 && length <= 32 - start", file=0x56e76120  
"/home/alxndr/Development/qemu/include/qemu/bitops.h", line=0x12c, 
function=0x56e76180 <__PRETTY_FUNCTION__.extract32> "uint32_t 
extract32(uint32_t, int, int)") at assert.c:101
  #4  0x5653d8a7 in ati_mm_read (opaque=, addr=0x1a, 
size=) at 
/home/alxndr/Development/qemu/include/qemu/log-for-trace.h:29
  #5  0x5653c825 in ati_mm_read (opaque=, addr=0x4, 
size=) at /home/alxndr/Development/qemu/hw/display/ati.c:289
  #6  0x5601446e in memory_region_read_accessor (mr=0x6314dc20, 
addr=, value=, size=, 
shift=, mask=, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:434
  #7  0x56001a70 in access_with_adjusted_size (addr=, 
value=, size=, access_size_min=, 
access_size_max=, access_fn=, mr=0x6314dc20, 
attrs=...) at /home/alxndr/Development/qemu/memory.c:544
  #8  0x56001a70 in memory_region_dispatch_read1 (mr=0x6314dc20, 
addr=0x4, pval=, size=0x4, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:1396

  
  I can reproduce it in qemu 5.0 built with using:
  cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -device ati-vga -nographic -qtest stdio -monitor none -serial none
  outl 0xcf8 0x80001018
  outl 0xcfc 0xe200
  outl 0xcf8 0x8000101c
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x8000fa20
  write 0xe204 0x1 0x1a
  readq 0xe200
  EOF

  Similarly for ati_reg_write_offs:
  cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -device ati-vga -nographic -qtest stdio -monitor none -serial none
  outl 0xcf8 0x80001018
  outl 0xcfc 0xe200
  outl 0xcf8 0x8000101c
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x8000fa20
  write 0xe200 0x8 0x6a006a00
  EOF

  I also attached the traces to this launchpad report, in case the
  formatting is broken:

  qemu-system-i386 -M pc-q35-5.0 -device ati-vga -nographic -qtest stdio
  -monitor none -serial none < attachment

  Please let me know if I can provide any further info.
  -Alex

To manage notifications about this bug go to:

Re: [PATCH 1/1] 9pfs: include linux/limits.h for XATTR_SIZE_MAX

2020-05-16 Thread Greg Kurz
On Fri, 15 May 2020 20:30:15 +
Dan Robertson  wrote:

> linux/limits.h should be included for the XATTR_SIZE_MAX definition used
> by v9fs_xattrcreate.
> 
> Signed-off-by: Dan Robertson 
> ---

Applied to 9p-next with R-b and Fixes tags, thanks.

>  hw/9pfs/9p.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> index a2a14b5979..68c2df7333 100644
> --- a/hw/9pfs/9p.c
> +++ b/hw/9pfs/9p.c
> @@ -28,6 +28,7 @@
>  #include "sysemu/qtest.h"
>  #include "qemu/xxhash.h"
>  #include 
> +#include 
>  
>  int open_fd_hw;
>  int total_open_fd;
> 




Re: [PATCH 00/10] softfloat: misc cleanups

2020-05-16 Thread no-reply
Patchew URL: 
https://patchew.org/QEMU/20200515190153.6017-1-richard.hender...@linaro.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20200515190153.6017-1-richard.hender...@linaro.org
Subject: [PATCH 00/10] softfloat: misc cleanups
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
d6c1572 softfloat: Return bool from all classification predicates
d5219e0 softfloat: Inline floatx80 compare specializations
174c114 softfloat: Inline float128 compare specializations
5359fcf softfloat: Inline float64 compare specializations
dfbd82c softfloat: Inline float32 compare specializations
4800e27 softfloat: Name compare relation enum
7fa3297 softfloat: Name rounding mode enum
7cd2649 softfloat: Change tininess_before_rounding to bool
e7c55dd softfloat: Replace flag with bool
a611c6d softfloat: Use post test for floatN_mul

=== OUTPUT BEGIN ===
1/10 Checking commit a611c6d2a057 (softfloat: Use post test for floatN_mul)
2/10 Checking commit e7c55dd7e0d5 (softfloat: Replace flag with bool)
3/10 Checking commit 7cd2649f0ce0 (softfloat: Change tininess_before_rounding 
to bool)
ERROR: space prohibited before that close parenthesis ')'
#67: FILE: fpu/softfloat.c:3877:
+  || (zExp < 0 )

total: 1 errors, 0 warnings, 143 lines checked

Patch 3/10 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

4/10 Checking commit 7fa3297e0cfe (softfloat: Name rounding mode enum)
5/10 Checking commit 4800e2753ad9 (softfloat: Name compare relation enum)
6/10 Checking commit dfbd82cf4b75 (softfloat: Inline float32 compare 
specializations)
7/10 Checking commit 5359fcfe6a48 (softfloat: Inline float64 compare 
specializations)
8/10 Checking commit 174c1143cfd1 (softfloat: Inline float128 compare 
specializations)
9/10 Checking commit d5219e08fe69 (softfloat: Inline floatx80 compare 
specializations)
10/10 Checking commit d6c1572c791c (softfloat: Return bool from all 
classification predicates)
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20200515190153.6017-1-richard.hender...@linaro.org/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

Re: [PATCH 1/1] 9pfs: include linux/limits.h for XATTR_SIZE_MAX

2020-05-16 Thread Christian Schoenebeck
On Freitag, 15. Mai 2020 22:30:15 CEST Dan Robertson wrote:
> linux/limits.h should be included for the XATTR_SIZE_MAX definition used
> by v9fs_xattrcreate.
> 
> Signed-off-by: Dan Robertson 
> ---
>  hw/9pfs/9p.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> index a2a14b5979..68c2df7333 100644
> --- a/hw/9pfs/9p.c
> +++ b/hw/9pfs/9p.c
> @@ -28,6 +28,7 @@
>  #include "sysemu/qtest.h"
>  #include "qemu/xxhash.h"
>  #include 
> +#include 
> 
>  int open_fd_hw;
>  int total_open_fd;

Usually I would say that should be wrapped in some OS conditional way, but as 
usage of XATTR_SIZE_MAX is currently not in 9p code either, it's Ok for now.

Reviewed-by: Christian Schoenebeck 

Best regards,
Christian Schoenebeck





Re: [PATCH v2 2/9] target/riscv: Don't overwrite the reset vector

2020-05-16 Thread Bin Meng
On Sat, May 16, 2020 at 3:51 AM Alistair Francis  wrote:
>
> On Thu, May 14, 2020 at 9:54 PM Bin Meng  wrote:
> >
> > On Fri, May 15, 2020 at 5:51 AM Alistair Francis  
> > wrote:
> > >
> > > On Thu, May 14, 2020 at 10:54 AM Philippe Mathieu-Daudé
> > >  wrote:
> > > >
> > > > On 5/7/20 9:13 PM, Alistair Francis wrote:
> > > > > If the reset vector is set in the init function don't set it again in
> > > > > realise.
> > > >
> > > > typo "realize".
> > >
> > > It's not a typo, just correct English :)
> > >
> > > I have changed it.
> > >
> > > >
> > > > >
> > > > > Signed-off-by: Alistair Francis 
> > > > > ---
> > > > >   target/riscv/cpu.c | 20 +++-
> > > > >   1 file changed, 11 insertions(+), 9 deletions(-)
> > > > >
> > > > > diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> > > > > index 059d71f2c7..8f837edf8d 100644
> > > > > --- a/target/riscv/cpu.c
> > > > > +++ b/target/riscv/cpu.c
> > > > > @@ -111,6 +111,14 @@ static void set_feature(CPURISCVState *env, int 
> > > > > feature)
> > > > >   env->features |= (1ULL << feature);
> > > > >   }
> > > > >
> > > > > +static int get_resetvec(CPURISCVState *env)
> > > > > +{
> > > > > +#ifndef CONFIG_USER_ONLY
> > > > > +return env->resetvec;
> > > > > +#endif
> > > > > +return 0;
> > > >
> > > > Don't you get an error about double return? Maybe use #else?
> > >
> > > Apparently not, I have changed it though.
> > >
> > > Alistair
> > >
> > > >
> > > > > +}
> > > > > +
> > > > >   static void set_resetvec(CPURISCVState *env, int resetvec)
> > > > >   {
> > > > >   #ifndef CONFIG_USER_ONLY
> > > > > @@ -123,7 +131,6 @@ static void riscv_any_cpu_init(Object *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RVXLEN | RVI | RVM | RVA | RVF | RVD | RVC | RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_11_0);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   }
> > > > >
> > > > >   #if defined(TARGET_RISCV32)
> > > > > @@ -140,7 +147,6 @@ static void rv32gcsu_priv1_09_1_cpu_init(Object 
> > > > > *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RV32 | RVI | RVM | RVA | RVF | RVD | RVC | RVS | 
> > > > > RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_09_1);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   set_feature(env, RISCV_FEATURE_MMU);
> > > > >   set_feature(env, RISCV_FEATURE_PMP);
> > > > >   }
> > > > > @@ -150,7 +156,6 @@ static void rv32gcsu_priv1_10_0_cpu_init(Object 
> > > > > *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RV32 | RVI | RVM | RVA | RVF | RVD | RVC | RVS | 
> > > > > RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_10_0);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   set_feature(env, RISCV_FEATURE_MMU);
> > > > >   set_feature(env, RISCV_FEATURE_PMP);
> > > > >   }
> > > > > @@ -160,7 +165,6 @@ static void rv32imacu_nommu_cpu_init(Object *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RV32 | RVI | RVM | RVA | RVC | RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_10_0);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   set_feature(env, RISCV_FEATURE_PMP);
> > > > >   }
> > > > >
> > > > > @@ -169,7 +173,6 @@ static void rv32imafcu_nommu_cpu_init(Object *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RV32 | RVI | RVM | RVA | RVF | RVC | RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_10_0);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   set_feature(env, RISCV_FEATURE_PMP);
> > > > >   }
> > > > >
> > > > > @@ -187,7 +190,6 @@ static void rv64gcsu_priv1_09_1_cpu_init(Object 
> > > > > *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RV64 | RVI | RVM | RVA | RVF | RVD | RVC | RVS | 
> > > > > RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_09_1);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   set_feature(env, RISCV_FEATURE_MMU);
> > > > >   set_feature(env, RISCV_FEATURE_PMP);
> > > > >   }
> > > > > @@ -197,7 +199,6 @@ static void rv64gcsu_priv1_10_0_cpu_init(Object 
> > > > > *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RV64 | RVI | RVM | RVA | RVF | RVD | RVC | RVS | 
> > > > > RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_10_0);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   set_feature(env, RISCV_FEATURE_MMU);
> > > > >   set_feature(env, RISCV_FEATURE_PMP);
> > > > >   }
> > > > > @@ -207,7 +208,6 @@ static void rv64imacu_nommu_cpu_init(Object *obj)
> > > > >   CPURISCVState *env = _CPU(obj)->env;
> > > > >   set_misa(env, RV64 | RVI | RVM | RVA | RVC | RVU);
> > > > >   set_priv_version(env, PRIV_VERSION_1_10_0);
> > > > > -set_resetvec(env, DEFAULT_RSTVEC);
> > > > >   set_feature(env, 

Re: [PATCH v6 00/16] acpi: i386 tweaks

2020-05-16 Thread no-reply
Patchew URL: https://patchew.org/QEMU/20200515150421.25479-1-kra...@redhat.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20200515150421.25479-1-kra...@redhat.com
Subject: [PATCH v6 00/16] acpi: i386 tweaks
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Switched to a new branch 'test'
69ff2b9 acpi: q35: drop _SB.PCI0.ISA.LPCD opregion.
0e608e1 acpi: drop build_piix4_pm()
79bb41f acpi: drop serial/parallel enable bits from dsdt
3d483e1 acpi: simplify build_isa_devices_aml()
c9db35e acpi: factor out fw_cfg_add_acpi_dsdt()
4d0c5ba acpi: move aml builder code for i8042 (kbd+mouse) device
db9a5fa floppy: move cmos_get_fd_drive_type() from pc
3d99a4d floppy: make isa_fdc_get_drive_max_chs static
50ec383 acpi: move aml builder code for floppy device
ca585c0 acpi: move aml builder code for parallel device
db438d0 acpi: parallel: don't use _STA method
6a5550d acpi: move aml builder code for serial device
585d308 acpi: serial: don't use _STA method
6390dcb acpi: rtc: use a single crs range
730eda7 acpi: move aml builder code for rtc device
0f58dfa qtest: allow DSDT acpi table changes

=== OUTPUT BEGIN ===
1/16 Checking commit 0f58dfaf03d2 (qtest: allow DSDT acpi table changes)
2/16 Checking commit 730eda75f32f (acpi: move aml builder code for rtc device)
3/16 Checking commit 6390dcbc7606 (acpi: rtc: use a single crs range)
4/16 Checking commit 585d308b5a73 (acpi: serial: don't use _STA method)
5/16 Checking commit 6a5550d61069 (acpi: move aml builder code for serial 
device)
6/16 Checking commit db438d094684 (acpi: parallel: don't use _STA method)
7/16 Checking commit ca585c07c338 (acpi: move aml builder code for parallel 
device)
8/16 Checking commit 50ec383087f1 (acpi: move aml builder code for floppy 
device)
WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
#245: 
new file mode 100644

total: 0 errors, 1 warnings, 221 lines checked

Patch 8/16 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
9/16 Checking commit 3d99a4dae716 (floppy: make isa_fdc_get_drive_max_chs 
static)
10/16 Checking commit db9a5fa00fa3 (floppy: move cmos_get_fd_drive_type() from 
pc)
ERROR: Missing Signed-off-by: line(s)

total: 1 errors, 0 warnings, 82 lines checked

Patch 10/16 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

11/16 Checking commit 4d0c5bab6dae (acpi: move aml builder code for i8042 
(kbd+mouse) device)
12/16 Checking commit c9db35eb2c73 (acpi: factor out fw_cfg_add_acpi_dsdt())
13/16 Checking commit 3d483e1810c7 (acpi: simplify build_isa_devices_aml())
14/16 Checking commit 79bb41f701f3 (acpi: drop serial/parallel enable bits from 
dsdt)
15/16 Checking commit 0e608e189800 (acpi: drop build_piix4_pm())
16/16 Checking commit 69ff2b91c86b (acpi: q35: drop _SB.PCI0.ISA.LPCD opregion.)
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20200515150421.25479-1-kra...@redhat.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

[PATCH v2 05/11] ui/gtk: remove unused variable ignore_keys

2020-05-16 Thread Volker Rümelin
Since the removal of GTK2 code in commit 89d85cde75 the code
around ignore_keys is unused. See commit 1a01716a30 "gtk: Avoid
accel key leakage into guest on console switch" why it was only
needed for GTK2.

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Volker Rümelin 
---
 ui/gtk.c | 9 -
 1 file changed, 9 deletions(-)

diff --git a/ui/gtk.c b/ui/gtk.c
index 0e9503a0d1..354dd90e18 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -168,8 +168,6 @@ struct GtkDisplayState {
 
 bool external_pause_update;
 
-bool ignore_keys;
-
 DisplayOptions *opts;
 };
 
@@ -1095,14 +1093,8 @@ static gboolean gd_text_key_down(GtkWidget *widget,
 static gboolean gd_key_event(GtkWidget *widget, GdkEventKey *key, void *opaque)
 {
 VirtualConsole *vc = opaque;
-GtkDisplayState *s = vc->s;
 int qcode;
 
-if (s->ignore_keys) {
-s->ignore_keys = (key->type == GDK_KEY_PRESS);
-return TRUE;
-}
-
 #ifdef WIN32
 /* on windows, we ought to ignore the reserved key event? */
 if (key->hardware_keycode == 0xff)
@@ -1204,7 +1196,6 @@ static void gd_menu_switch_vc(GtkMenuItem *item, void 
*opaque)
 gtk_notebook_set_current_page(nb, page);
 gtk_widget_grab_focus(vc->focus);
 }
-s->ignore_keys = false;
 }
 
 static void gd_accel_switch_vc(void *opaque)
-- 
2.26.1




[PATCH v2 09/11] ui/gtk: don't pass on win keys without keyboard grab

2020-05-16 Thread Volker Rümelin
Without keyboard grab Windows currently handles the two win keys
and the key events are also sent to the guest. This is undesir-
able. Only one program should handle key events. This patch ap-
plies commit c68f74b02e "win32: do not handle win keys when the
keyboard is not grabbed" from project spice-gtk to ui/gtk.c to
fix this problem.

Signed-off-by: Volker Rümelin 
---
 ui/gtk.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ui/gtk.c b/ui/gtk.c
index 354dd90e18..1d51e14bb5 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -1095,10 +1095,17 @@ static gboolean gd_key_event(GtkWidget *widget, 
GdkEventKey *key, void *opaque)
 VirtualConsole *vc = opaque;
 int qcode;
 
-#ifdef WIN32
+#ifdef G_OS_WIN32
 /* on windows, we ought to ignore the reserved key event? */
 if (key->hardware_keycode == 0xff)
 return false;
+
+if (!vc->s->kbd_owner) {
+if (key->hardware_keycode == VK_LWIN ||
+key->hardware_keycode == VK_RWIN) {
+return FALSE;
+}
+}
 #endif
 
 if (key->keyval == GDK_KEY_Pause
-- 
2.26.1




[PATCH v2 11/11] ui: increase min required GTK version to 3.22.0

2020-05-16 Thread Volker Rümelin
Based on a mail on the qemu-devel mailing list at
https://lists.nongnu.org/archive/html/qemu-devel/2020-05/msg02909.html
and some internet research the GTK3 versions on supported
platforms are:

RHEL-7.4: 3.22.10
RHEL-7.5: 3.22.26
Debian (Stretch): 3.22.11
Debian (Buster): 3.24.5
OpenBSD (Ports): 3.22.30
FreeBSD (Ports): 3.22.29
OpenSUSE Leap 15: 3.22.30
SLE12-SP2: Unknown
SLE15: 3.22.30
Ubuntu (Bionic): 3.22.30
Ubuntu (Focal): 3.24.18
macOS (Homebrew): 3.22.30

This justifies increasing the minimum required GTK version in
QEMU to 3.22.0.

Signed-off-by: Volker Rümelin 
---
 configure |  2 +-
 ui/gtk.c  | 91 +--
 2 files changed, 9 insertions(+), 84 deletions(-)

diff --git a/configure b/configure
index 26084fc53a..2fc05c4465 100755
--- a/configure
+++ b/configure
@@ -2897,7 +2897,7 @@ fi
 if test "$gtk" != "no"; then
 gtkpackage="gtk+-3.0"
 gtkx11package="gtk+-x11-3.0"
-gtkversion="3.14.0"
+gtkversion="3.22.0"
 if $pkg_config --exists "$gtkpackage >= $gtkversion"; then
 gtk_cflags=$($pkg_config --cflags $gtkpackage)
 gtk_libs=$($pkg_config --libs $gtkpackage)
diff --git a/ui/gtk.c b/ui/gtk.c
index 68a5b901c7..d4b49bd7da 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -490,12 +490,7 @@ static void gd_refresh(DisplayChangeListener *dcl)
 
 static GdkDevice *gd_get_pointer(GdkDisplay *dpy)
 {
-#if GTK_CHECK_VERSION(3, 20, 0)
 return gdk_seat_get_pointer(gdk_display_get_default_seat(dpy));
-#else
-return gdk_device_manager_get_client_pointer(
-gdk_display_get_device_manager(dpy));
-#endif
 }
 
 static void gd_mouse_set(DisplayChangeListener *dcl,
@@ -877,27 +872,18 @@ static gboolean gd_motion_event(GtkWidget *widget, 
GdkEventMotion *motion,
 
 if (!qemu_input_is_absolute() && s->ptr_owner == vc) {
 GdkScreen *screen = gtk_widget_get_screen(vc->gfx.drawing_area);
+GdkDisplay *dpy = gtk_widget_get_display(widget);
+GdkWindow *win = gtk_widget_get_window(widget);
+GdkMonitor *monitor = gdk_display_get_monitor_at_window(dpy, win);
+GdkRectangle geometry;
 int screen_width, screen_height;
 
 int x = (int)motion->x_root;
 int y = (int)motion->y_root;
 
-#if GTK_CHECK_VERSION(3, 22, 0)
-{
-GdkDisplay *dpy = gtk_widget_get_display(widget);
-GdkWindow *win = gtk_widget_get_window(widget);
-GdkMonitor *monitor = gdk_display_get_monitor_at_window(dpy, win);
-GdkRectangle geometry;
-gdk_monitor_get_geometry(monitor, );
-screen_width = geometry.width;
-screen_height = geometry.height;
-}
-#else
-{
-screen_width = gdk_screen_get_width(screen);
-screen_height = gdk_screen_get_height(screen);
-}
-#endif
+gdk_monitor_get_geometry(monitor, );
+screen_width = geometry.width;
+screen_height = geometry.height;
 
 /* In relative mode check to see if client pointer hit
  * one of the screen edges, and if so move it back by
@@ -1026,13 +1012,8 @@ static const guint16 *gd_get_keymap(size_t *maplen)
 #ifdef GDK_WINDOWING_WIN32
 if (GDK_IS_WIN32_DISPLAY(dpy)) {
 trace_gd_keymap_windowing("win32");
-#if GTK_CHECK_VERSION(3, 22, 0)
 *maplen = qemu_input_map_atset1_to_qcode_len;
 return qemu_input_map_atset1_to_qcode;
-#else
-*maplen = qemu_input_map_win32_to_qcode_len;
-return qemu_input_map_win32_to_qcode;
-#endif
 }
 #endif
 
@@ -1080,7 +1061,7 @@ static int gd_map_keycode(int scancode)
 
 static int gd_get_keycode(GdkEventKey *key)
 {
-#if defined G_OS_WIN32 && GTK_CHECK_VERSION(3, 22, 0)
+#ifdef G_OS_WIN32
 int scancode = gdk_event_get_scancode((GdkEvent *)key);
 
 /* translate Windows native scancodes to atset1 keycodes */
@@ -1437,7 +1418,6 @@ static void gd_menu_zoom_fit(GtkMenuItem *item, void 
*opaque)
 gd_update_full_redraw(vc);
 }
 
-#if GTK_CHECK_VERSION(3, 20, 0)
 static void gd_grab_update(VirtualConsole *vc, bool kbd, bool ptr)
 {
 GdkDisplay *display = gtk_widget_get_display(vc->gfx.drawing_area);
@@ -1461,32 +1441,6 @@ static void gd_grab_update(VirtualConsole *vc, bool kbd, 
bool ptr)
 gdk_seat_ungrab(seat);
 }
 }
-#else
-static void gd_grab_devices(VirtualConsole *vc, bool grab,
-GdkInputSource source, GdkEventMask mask,
-GdkCursor *cursor)
-{
-GdkDisplay *display = gtk_widget_get_display(vc->gfx.drawing_area);
-GdkDeviceManager *mgr = gdk_display_get_device_manager(display);
-GList *devs = gdk_device_manager_list_devices(mgr, GDK_DEVICE_TYPE_MASTER);
-GList *tmp = devs;
-
-for (tmp = devs; tmp; tmp = tmp->next) {
-GdkDevice *dev = tmp->data;
-if (gdk_device_get_source(dev) != source) {
-continue;
-}
-if (grab) {
-GdkWindow 

[PATCH v2 07/11] ui/sdl2: start in full screen with grab enabled

2020-05-16 Thread Volker Rümelin
QEMU with SDL 1.2 display used to enable keyboard and mouse grab-
bing when started in full screen. The SDL 2.0 code tries to do
the same but fails to enable grabbing because sdl_grab_start(0)
returns early. To do it's work the sdl_grab_start() function
needs a pointer to a sdl2_console structure.

Signed-off-by: Volker Rümelin 
---
 ui/sdl2.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/ui/sdl2.c b/ui/sdl2.c
index 79c1ea29d2..b23a8f0a8e 100644
--- a/ui/sdl2.c
+++ b/ui/sdl2.c
@@ -881,17 +881,16 @@ static void sdl2_display_init(DisplayState *ds, 
DisplayOptions *o)
 SDL_SetWindowIcon(sdl2_console[0].real_window, icon);
 }
 
-gui_grab = 0;
-if (gui_fullscreen) {
-sdl_grab_start(0);
-}
-
 mouse_mode_notifier.notify = sdl_mouse_mode_change;
 qemu_add_mouse_mode_change_notifier(_mode_notifier);
 
 sdl_cursor_hidden = SDL_CreateCursor(, , 8, 1, 0, 0);
 sdl_cursor_normal = SDL_GetCursor();
 
+if (gui_fullscreen) {
+sdl_grab_start(_console[0]);
+}
+
 atexit(sdl_cleanup);
 }
 
-- 
2.26.1




[PATCH v2 10/11] ui/gtk: use native keyboard scancodes on Windows

2020-05-16 Thread Volker Rümelin
Since GTK 3.22 the function gdk_event_get_scancode() is
available. On Windows this function returns keyboard scancodes
and some extended flags. These raw keyboard scancodes are much
better suited for this use case than the half-cooked win32
virtual-key codes because scancodes report the key position on
the keyboard and the positions are independent of national
language settings.

Signed-off-by: Volker Rümelin 
---
 ui/gtk.c | 33 +
 1 file changed, 29 insertions(+), 4 deletions(-)

diff --git a/ui/gtk.c b/ui/gtk.c
index 1d51e14bb5..68a5b901c7 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -1026,8 +1026,13 @@ static const guint16 *gd_get_keymap(size_t *maplen)
 #ifdef GDK_WINDOWING_WIN32
 if (GDK_IS_WIN32_DISPLAY(dpy)) {
 trace_gd_keymap_windowing("win32");
+#if GTK_CHECK_VERSION(3, 22, 0)
+*maplen = qemu_input_map_atset1_to_qcode_len;
+return qemu_input_map_atset1_to_qcode;
+#else
 *maplen = qemu_input_map_win32_to_qcode_len;
 return qemu_input_map_win32_to_qcode;
+#endif
 }
 #endif
 
@@ -1073,6 +1078,25 @@ static int gd_map_keycode(int scancode)
 return keycode_map[scancode];
 }
 
+static int gd_get_keycode(GdkEventKey *key)
+{
+#if defined G_OS_WIN32 && GTK_CHECK_VERSION(3, 22, 0)
+int scancode = gdk_event_get_scancode((GdkEvent *)key);
+
+/* translate Windows native scancodes to atset1 keycodes */
+switch (scancode & (KF_EXTENDED | 0xff)) {
+case 0x145: /* NUMLOCK */
+return scancode & 0xff;
+}
+
+return scancode & KF_EXTENDED ?
+0xe000 | (scancode & 0xff) : scancode & 0xff;
+
+#else
+return key->hardware_keycode;
+#endif
+}
+
 static gboolean gd_text_key_down(GtkWidget *widget,
  GdkEventKey *key, void *opaque)
 {
@@ -1084,7 +1108,7 @@ static gboolean gd_text_key_down(GtkWidget *widget,
 } else if (key->length) {
 kbd_put_string_console(con, key->string, key->length);
 } else {
-int qcode = gd_map_keycode(key->hardware_keycode);
+int qcode = gd_map_keycode(gd_get_keycode(key));
 kbd_put_qcode_console(con, qcode, false);
 }
 return TRUE;
@@ -1093,7 +1117,7 @@ static gboolean gd_text_key_down(GtkWidget *widget,
 static gboolean gd_key_event(GtkWidget *widget, GdkEventKey *key, void *opaque)
 {
 VirtualConsole *vc = opaque;
-int qcode;
+int keycode, qcode;
 
 #ifdef G_OS_WIN32
 /* on windows, we ought to ignore the reserved key event? */
@@ -1121,9 +1145,10 @@ static gboolean gd_key_event(GtkWidget *widget, 
GdkEventKey *key, void *opaque)
 return TRUE;
 }
 
-qcode = gd_map_keycode(key->hardware_keycode);
+keycode = gd_get_keycode(key);
+qcode = gd_map_keycode(keycode);
 
-trace_gd_key_event(vc->label, key->hardware_keycode, qcode,
+trace_gd_key_event(vc->label, keycode, qcode,
(key->type == GDK_KEY_PRESS) ? "down" : "up");
 
 qkbd_state_key_event(vc->gfx.kbd, qcode,
-- 
2.26.1




[PATCH v2 03/11] ui/gkt: release all keys on grab-broken-event

2020-05-16 Thread Volker Rümelin
There is no way to grab the Ctrl-Alt-Del key combination on
Windows. This key combination will leave all three keys in a
stuck condition. This patch uses the grab-broken-event to
release the keys.

Signed-off-by: Volker Rümelin 
---
 ui/gtk.c | 21 +
 1 file changed, 21 insertions(+)

diff --git a/ui/gtk.c b/ui/gtk.c
index a0b10a1403..655b26de38 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -1142,6 +1142,25 @@ static gboolean gd_key_event(GtkWidget *widget, 
GdkEventKey *key, void *opaque)
 return TRUE;
 }
 
+static gboolean gd_grab_broken_event(GtkWidget *widget,
+ GdkEventGrabBroken *event, void *opaque)
+{
+#ifdef CONFIG_WIN32
+/*
+ * On Windows the Ctrl-Alt-Del key combination can't be grabbed. This
+ * key combination leaves all three keys in a stuck condition. We use
+ * the grab-broken-event to release all keys.
+ */
+if (event->keyboard) {
+VirtualConsole *vc = opaque;
+GtkDisplayState *s = vc->s;
+
+gtk_release_modifiers(s);
+}
+#endif
+return TRUE;
+}
+
 static gboolean gd_event(GtkWidget *widget, GdkEvent *event, void *opaque)
 {
 if (event->type == GDK_MOTION_NOTIFY) {
@@ -1910,6 +1929,8 @@ static void gd_connect_vc_gfx_signals(VirtualConsole *vc)
  G_CALLBACK(gd_focus_out_event), vc);
 g_signal_connect(vc->gfx.drawing_area, "configure-event",
  G_CALLBACK(gd_configure), vc);
+g_signal_connect(vc->gfx.drawing_area, "grab-broken-event",
+ G_CALLBACK(gd_grab_broken_event), vc);
 } else {
 g_signal_connect(vc->gfx.drawing_area, "key-press-event",
  G_CALLBACK(gd_text_key_down), vc);
-- 
2.26.1




[PATCH v2 06/11] ui/sdl2: fix handling of AltGr key on Windows

2020-05-16 Thread Volker Rümelin
Wire up the keyboard hooking code on Windows to fix the AltGr
key and improve keyboard grabbing.

Signed-off-by: Volker Rümelin 
---
 ui/sdl2.c | 24 
 1 file changed, 24 insertions(+)

diff --git a/ui/sdl2.c b/ui/sdl2.c
index 61c7956da3..79c1ea29d2 100644
--- a/ui/sdl2.c
+++ b/ui/sdl2.c
@@ -30,6 +30,7 @@
 #include "ui/sdl2.h"
 #include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
+#include "ui/win32-kbd-hook.h"
 
 static int sdl2_num_outputs;
 static struct sdl2_console *sdl2_console;
@@ -220,6 +221,7 @@ static void sdl_grab_start(struct sdl2_console *scon)
 }
 SDL_SetWindowGrab(scon->real_window, SDL_TRUE);
 gui_grab = 1;
+win32_kbd_set_grab(true);
 sdl_update_caption(scon);
 }
 
@@ -227,6 +229,7 @@ static void sdl_grab_end(struct sdl2_console *scon)
 {
 SDL_SetWindowGrab(scon->real_window, SDL_FALSE);
 gui_grab = 0;
+win32_kbd_set_grab(false);
 sdl_show_cursor(scon);
 sdl_update_caption(scon);
 }
@@ -325,6 +328,19 @@ static int get_mod_state(void)
 }
 }
 
+static void *sdl2_win32_get_hwnd(struct sdl2_console *scon)
+{
+#ifdef CONFIG_WIN32
+SDL_SysWMinfo info;
+
+SDL_VERSION();
+if (SDL_GetWindowWMInfo(scon->real_window, )) {
+return info.info.win.window;
+}
+#endif
+return NULL;
+}
+
 static void handle_keydown(SDL_Event *ev)
 {
 int win;
@@ -544,6 +560,11 @@ static void handle_windowevent(SDL_Event *ev)
 sdl2_redraw(scon);
 break;
 case SDL_WINDOWEVENT_FOCUS_GAINED:
+win32_kbd_set_grab(gui_grab);
+if (qemu_console_is_graphic(scon->dcl.con)) {
+win32_kbd_set_window(sdl2_win32_get_hwnd(scon));
+}
+/* fall through */
 case SDL_WINDOWEVENT_ENTER:
 if (!gui_grab && (qemu_input_is_absolute() || absolute_enabled)) {
 absolute_mouse_grab(scon);
@@ -558,6 +579,9 @@ static void handle_windowevent(SDL_Event *ev)
 scon->ignore_hotkeys = get_mod_state();
 break;
 case SDL_WINDOWEVENT_FOCUS_LOST:
+if (qemu_console_is_graphic(scon->dcl.con)) {
+win32_kbd_set_window(NULL);
+}
 if (gui_grab && !gui_fullscreen) {
 sdl_grab_end(scon);
 }
-- 
2.26.1




[PATCH v2 04/11] ui/gtk: remove unused code

2020-05-16 Thread Volker Rümelin
This code was last used before commit 2ec78706d1 "ui: convert
GTK and SDL1 frontends to keycodemapdb".

Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Volker Rümelin 
---
 ui/gtk.c | 9 -
 1 file changed, 9 deletions(-)

diff --git a/ui/gtk.c b/ui/gtk.c
index 655b26de38..0e9503a0d1 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -112,15 +112,6 @@
 # define VTE_CHECK_VERSION(a, b, c) 0
 #endif
 
-/* Some older mingw versions lack this constant or have
- * it conditionally defined */
-#ifdef _WIN32
-# ifndef MAPVK_VK_TO_VSC
-#  define MAPVK_VK_TO_VSC 0
-# endif
-#endif
-
-
 #define HOTKEY_MODIFIERS(GDK_CONTROL_MASK | GDK_MOD1_MASK)
 
 static const guint16 *keycode_map;
-- 
2.26.1




[PATCH v2 01/11] ui/win32-kbd-hook: handle AltGr in a hook procedure

2020-05-16 Thread Volker Rümelin
Import win32 keyboard hooking code from project spice-gtk. This
patch removes the extra left control key up/down input events
inserted by Windows for the right alt key up/down input events
with international keyboard layouts. Additionally there's some
code to grab the keyboard.

The next patches will use this code.

Only Windows needs this.

Signed-off-by: Volker Rümelin 
---
 include/ui/win32-kbd-hook.h |  14 +
 stubs/Makefile.objs |   1 +
 stubs/win32-kbd-hook.c  |  18 +++
 ui/Makefile.objs|   3 ++
 ui/win32-kbd-hook.c | 102 
 5 files changed, 138 insertions(+)
 create mode 100644 include/ui/win32-kbd-hook.h
 create mode 100644 stubs/win32-kbd-hook.c
 create mode 100644 ui/win32-kbd-hook.c

diff --git a/include/ui/win32-kbd-hook.h b/include/ui/win32-kbd-hook.h
new file mode 100644
index 00..4bd9f00f97
--- /dev/null
+++ b/include/ui/win32-kbd-hook.h
@@ -0,0 +1,14 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef UI_WIN32_KBD_HOOK_H
+#define UI_WIN32_KBD_HOOK_H
+
+void win32_kbd_set_window(void *hwnd);
+void win32_kbd_set_grab(bool grab);
+
+#endif
diff --git a/stubs/Makefile.objs b/stubs/Makefile.objs
index 45be5dc0ed..6a9e3135e8 100644
--- a/stubs/Makefile.objs
+++ b/stubs/Makefile.objs
@@ -32,6 +32,7 @@ stub-obj-y += trace-control.o
 stub-obj-y += uuid.o
 stub-obj-y += vm-stop.o
 stub-obj-y += vmstate.o
+stub-obj-y += win32-kbd-hook.o
 stub-obj-y += fd-register.o
 stub-obj-y += qmp_memory_device.o
 stub-obj-y += target-monitor-defs.o
diff --git a/stubs/win32-kbd-hook.c b/stubs/win32-kbd-hook.c
new file mode 100644
index 00..1a084b081a
--- /dev/null
+++ b/stubs/win32-kbd-hook.c
@@ -0,0 +1,18 @@
+/*
+ * Win32 keyboard hook stubs
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * (at your option) any later version.  See the COPYING file in the
+ * top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "ui/win32-kbd-hook.h"
+
+void win32_kbd_set_window(void *hwnd)
+{
+}
+
+void win32_kbd_set_grab(bool grab)
+{
+}
diff --git a/ui/Makefile.objs b/ui/Makefile.objs
index e6da6ff047..504b196479 100644
--- a/ui/Makefile.objs
+++ b/ui/Makefile.objs
@@ -15,6 +15,9 @@ common-obj-$(CONFIG_SPICE) += spice-core.o spice-input.o 
spice-display.o
 common-obj-$(CONFIG_COCOA) += cocoa.o
 common-obj-$(CONFIG_VNC) += $(vnc-obj-y)
 common-obj-$(call lnot,$(CONFIG_VNC)) += vnc-stubs.o
+ifneq (,$(findstring m,$(CONFIG_SDL)$(CONFIG_GTK)))
+common-obj-$(CONFIG_WIN32) += win32-kbd-hook.o
+endif
 
 # ui-sdl module
 common-obj-$(CONFIG_SDL) += sdl.mo
diff --git a/ui/win32-kbd-hook.c b/ui/win32-kbd-hook.c
new file mode 100644
index 00..1ac237db9e
--- /dev/null
+++ b/ui/win32-kbd-hook.c
@@ -0,0 +1,102 @@
+/*
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * (at your option) any later version.  See the COPYING file in the
+ * top-level directory.
+ *
+ * The win32 keyboard hooking code was imported from project spice-gtk.
+ */
+
+#include "qemu/osdep.h"
+#include "sysemu/sysemu.h"
+#include "ui/win32-kbd-hook.h"
+
+static Notifier win32_unhook_notifier;
+static HHOOK win32_keyboard_hook;
+static HWND win32_window;
+static DWORD win32_grab;
+
+static LRESULT CALLBACK keyboard_hook_cb(int code, WPARAM wparam, LPARAM 
lparam)
+{
+if  (win32_window && code == HC_ACTION && win32_window == GetFocus()) {
+KBDLLHOOKSTRUCT *hooked = (KBDLLHOOKSTRUCT *)lparam;
+
+if (wparam != WM_KEYUP) {
+DWORD dwmsg = (hooked->flags << 24) |
+  ((hooked->scanCode & 0xff) << 16) | 1;
+
+switch (hooked->vkCode) {
+case VK_CAPITAL:
+/* fall through */
+case VK_SCROLL:
+/* fall through */
+case VK_NUMLOCK:
+/* fall through */
+case VK_LSHIFT:
+/* fall through */
+case VK_RSHIFT:
+/* fall through */
+case VK_RCONTROL:
+/* fall through */
+case VK_LMENU:
+/* fall through */
+case VK_RMENU:
+break;
+
+case VK_LCONTROL:
+/*
+ * When pressing AltGr, an extra VK_LCONTROL with a special
+ * scancode with bit 9 set is sent. Let's ignore the extra
+ * VK_LCONTROL, as that will make AltGr misbehave.
+ */
+if (hooked->scanCode & 0x200) {
+return 1;
+}
+break;
+
+default:
+if (win32_grab) {
+SendMessage(win32_window, wparam, hooked->vkCode, dwmsg);
+return 1;
+}
+break;
+}
+
+} else {
+switch 

[PATCH v2 08/11] ui/sdl2-input: use trace-events to debug key events

2020-05-16 Thread Volker Rümelin
Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Volker Rümelin 
---
 ui/sdl2-input.c | 3 +++
 ui/trace-events | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/ui/sdl2-input.c b/ui/sdl2-input.c
index 1f9fe831b3..f068382209 100644
--- a/ui/sdl2-input.c
+++ b/ui/sdl2-input.c
@@ -27,6 +27,7 @@
 #include "ui/console.h"
 #include "ui/input.h"
 #include "ui/sdl2.h"
+#include "trace.h"
 
 void sdl2_process_key(struct sdl2_console *scon,
   SDL_KeyboardEvent *ev)
@@ -38,6 +39,8 @@ void sdl2_process_key(struct sdl2_console *scon,
 return;
 }
 qcode = qemu_input_map_usb_to_qcode[ev->keysym.scancode];
+trace_sdl2_process_key(ev->keysym.scancode, qcode,
+   ev->type == SDL_KEYDOWN ? "down" : "up");
 qkbd_state_key_event(scon->kbd, qcode, ev->type == SDL_KEYDOWN);
 
 if (!qemu_console_is_graphic(con)) {
diff --git a/ui/trace-events b/ui/trace-events
index 0dcda393c1..5367fd3f16 100644
--- a/ui/trace-events
+++ b/ui/trace-events
@@ -75,6 +75,9 @@ input_event_abs(int conidx, const char *axis, int value) "con 
%d, axis %s, value
 input_event_sync(void) ""
 input_mouse_mode(int absolute) "absolute %d"
 
+# sdl2-input.c
+sdl2_process_key(int sdl_scancode, int qcode, const char *action) "translated 
SDL scancode %d to QKeyCode %d (%s)"
+
 # spice-display.c
 qemu_spice_add_memslot(int qid, uint32_t slot_id, unsigned long virt_start, 
unsigned long virt_end, int async) "%d %u: host virt 0x%lx - 0x%lx async=%d"
 qemu_spice_del_memslot(int qid, uint32_t gid, uint32_t slot_id) "%d gid=%u 
sid=%u"
-- 
2.26.1




[PATCH v2 02/11] ui/gtk: fix handling of AltGr key on Windows

2020-05-16 Thread Volker Rümelin
Wire up the keyboard hooking code on Windows to fix the AltGr
key and improve keyboard grabbing.

Signed-off-by: Volker Rümelin 
---
 ui/gtk.c | 30 +-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/ui/gtk.c b/ui/gtk.c
index 83f2f5d49b..a0b10a1403 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -38,6 +38,10 @@
 
 #include "ui/console.h"
 #include "ui/gtk.h"
+#ifdef G_OS_WIN32
+#include 
+#endif
+#include "ui/win32-kbd-hook.h"
 
 #include 
 #include 
@@ -428,6 +432,16 @@ static void gd_widget_reparent(GtkWidget *from, GtkWidget 
*to,
 g_object_unref(G_OBJECT(widget));
 }
 
+static void *gd_win32_get_hwnd(VirtualConsole *vc)
+{
+#ifdef G_OS_WIN32
+return gdk_win32_window_get_impl_hwnd(
+gtk_widget_get_window(vc->window ? vc->window : vc->s->window));
+#else
+return NULL;
+#endif
+}
+
 /** DisplayState Callbacks **/
 
 static void gd_update(DisplayChangeListener *dcl,
@@ -1451,6 +1465,7 @@ static void gd_grab_keyboard(VirtualConsole *vc, const 
char *reason)
 }
 }
 
+win32_kbd_set_grab(true);
 #if GTK_CHECK_VERSION(3, 20, 0)
 gd_grab_update(vc, true, vc->s->ptr_owner == vc);
 #else
@@ -1472,6 +1487,7 @@ static void gd_ungrab_keyboard(GtkDisplayState *s)
 }
 s->kbd_owner = NULL;
 
+win32_kbd_set_grab(false);
 #if GTK_CHECK_VERSION(3, 20, 0)
 gd_grab_update(vc, false, vc->s->ptr_owner == vc);
 #else
@@ -1614,12 +1630,22 @@ static gboolean gd_leave_event(GtkWidget *widget, 
GdkEventCrossing *crossing,
 return TRUE;
 }
 
+static gboolean gd_focus_in_event(GtkWidget *widget,
+  GdkEventFocus *event, gpointer opaque)
+{
+VirtualConsole *vc = opaque;
+
+win32_kbd_set_window(gd_win32_get_hwnd(vc));
+return TRUE;
+}
+
 static gboolean gd_focus_out_event(GtkWidget *widget,
-   GdkEventCrossing *crossing, gpointer opaque)
+   GdkEventFocus *event, gpointer opaque)
 {
 VirtualConsole *vc = opaque;
 GtkDisplayState *s = vc->s;
 
+win32_kbd_set_window(NULL);
 gtk_release_modifiers(s);
 return TRUE;
 }
@@ -1878,6 +1904,8 @@ static void gd_connect_vc_gfx_signals(VirtualConsole *vc)
  G_CALLBACK(gd_enter_event), vc);
 g_signal_connect(vc->gfx.drawing_area, "leave-notify-event",
  G_CALLBACK(gd_leave_event), vc);
+g_signal_connect(vc->gfx.drawing_area, "focus-in-event",
+ G_CALLBACK(gd_focus_in_event), vc);
 g_signal_connect(vc->gfx.drawing_area, "focus-out-event",
  G_CALLBACK(gd_focus_out_event), vc);
 g_signal_connect(vc->gfx.drawing_area, "configure-event",
-- 
2.26.1




[PATCH v2 00/11] Patches for ui/gtk and ui/sdl

2020-05-16 Thread Volker Rümelin
It's rather difficult to test qemu patches in guests on Windows with important 
keys missing. These patches mainly fix the guest keyboard on Windows.

With best regards,
Volker

v2:
- ui/win32-kbd-hook: handle AltGr in a hook procedure
  The boilerplate now mentions where the code comes from.
  Stub functions added for non Windows platforms.

- ui/gtk: fix handling of AltGr key on Windows
- ui/sdl2: fix handling of AltGr key on Windows
  Nearly all #ifdefs were removed.

- ui/gkt: release all keys on grab-broken-event
  Comment added.

- ui/gtk: remove unused variable ignore_keys
- ui/sdl2: start in full screen with grab enabled
- ui/gtk: don't pass on win keys without keyboard grab
  Improved commit message.

- ui: increase min required GTK version to 3.22.0
  New patch. Slightly different compared to Daniel's suggestion.

Volker Rümelin (11):
  ui/win32-kbd-hook: handle AltGr in a hook procedure
  ui/gtk: fix handling of AltGr key on Windows
  ui/gkt: release all keys on grab-broken-event
  ui/gtk: remove unused code
  ui/gtk: remove unused variable ignore_keys
  ui/sdl2: fix handling of AltGr key on Windows
  ui/sdl2: start in full screen with grab enabled
  ui/sdl2-input: use trace-events to debug key events
  ui/gtk: don't pass on win keys without keyboard grab
  ui/gtk: use native keyboard scancodes on Windows
  ui: increase min required GTK version to 3.22.0

 configure   |   2 +-
 include/ui/win32-kbd-hook.h |  14 +++
 stubs/Makefile.objs |   1 +
 stubs/win32-kbd-hook.c  |  18 
 ui/Makefile.objs    |   3 +
 ui/gtk.c    | 194 +---
 ui/sdl2-input.c |   3 +
 ui/sdl2.c   |  33 +-
 ui/trace-events |   3 +
 ui/win32-kbd-hook.c | 102 +++
 10 files changed, 264 insertions(+), 109 deletions(-)
 create mode 100644 include/ui/win32-kbd-hook.h
 create mode 100644 stubs/win32-kbd-hook.c
 create mode 100644 ui/win32-kbd-hook.c

-- 
2.26.1




[PATCH 4/4] hw/riscv: virt: Allow creating multiple sockets

2020-05-16 Thread Anup Patel
We extend RISC-V virt machine to allow creating a multi-socket machine.
Each RISC-V virt machine socket is a set of HARTs, a CLINT instance,
and a PLIC instance. Other peripherals are shared between all RISC-V
virt machine sockets. We also update RISC-V virt machine device tree
to treat each socket as a NUMA node.

The number of sockets in RISC-V virt machine can be specified using
the "sockets=" sub-option of QEMU "-smp" command-line option. By
default, only one socket RISC-V virt machine will be created.

Currently, we only allow creating upto maximum 4 sockets with minimum
2 HARTs per socket. In future, this limits can be changed.

Signed-off-by: Anup Patel 
---
 hw/riscv/virt.c | 495 ++--
 include/hw/riscv/virt.h |  12 +-
 2 files changed, 283 insertions(+), 224 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index f40efcb193..205224c01c 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -60,7 +60,7 @@ static const struct MemmapEntry {
 [VIRT_TEST] ={   0x10,0x1000 },
 [VIRT_RTC] = {   0x101000,0x1000 },
 [VIRT_CLINT] =   {  0x200,   0x1 },
-[VIRT_PLIC] ={  0xc00, 0x400 },
+[VIRT_PLIC] ={  0xc00, VIRT_PLIC_SIZE(VIRT_CPUS_MAX*2) },
 [VIRT_UART0] =   { 0x1000, 0x100 },
 [VIRT_VIRTIO] =  { 0x10001000,0x1000 },
 [VIRT_FLASH] =   { 0x2000, 0x400 },
@@ -183,10 +183,15 @@ static void create_fdt(RISCVVirtState *s, const struct 
MemmapEntry *memmap,
 uint64_t mem_size, const char *cmdline)
 {
 void *fdt;
-int cpu, i;
-uint32_t *cells;
-char *nodename;
-uint32_t plic_phandle, test_phandle, phandle = 1;
+int i, cpu, socket;
+uint32_t *clint_cells, *plic_cells;
+unsigned long clint_addr, plic_addr;
+uint32_t plic_phandle[VIRT_SOCKETS_MAX];
+uint32_t cpu_phandle, intc_phandle, test_phandle;
+uint32_t phandle = 1, plic_mmio_phandle = 1;
+uint32_t plic_pcie_phandle = 1, plic_virtio_phandle = 1;
+char *name, *cpu_name, *core_name, *intc_name;
+char *clint_name, *plic_name, *clust_name;
 hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
 hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
 
@@ -207,231 +212,231 @@ static void create_fdt(RISCVVirtState *s, const struct 
MemmapEntry *memmap,
 qemu_fdt_setprop_cell(fdt, "/soc", "#size-cells", 0x2);
 qemu_fdt_setprop_cell(fdt, "/soc", "#address-cells", 0x2);
 
-nodename = g_strdup_printf("/memory@%lx",
+name = g_strdup_printf("/memory@%lx",
 (long)memmap[VIRT_DRAM].base);
-qemu_fdt_add_subnode(fdt, nodename);
-qemu_fdt_setprop_cells(fdt, nodename, "reg",
+qemu_fdt_add_subnode(fdt, name);
+qemu_fdt_setprop_cells(fdt, name, "reg",
 memmap[VIRT_DRAM].base >> 32, memmap[VIRT_DRAM].base,
 mem_size >> 32, mem_size);
-qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
-g_free(nodename);
+qemu_fdt_setprop_string(fdt, name, "device_type", "memory");
+g_free(name);
 
 qemu_fdt_add_subnode(fdt, "/cpus");
 qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
   SIFIVE_CLINT_TIMEBASE_FREQ);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
+qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
+
+for (socket = (s->num_socs - 1); socket >= 0; socket--) {
+clust_name = g_strdup_printf("/cpus/cpu-map/cluster0%d", socket);
+qemu_fdt_add_subnode(fdt, clust_name);
+
+plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+clint_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+
+for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
+cpu_phandle = phandle++;
 
-for (cpu = s->soc.num_harts - 1; cpu >= 0; cpu--) {
-int cpu_phandle = phandle++;
-int intc_phandle;
-nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
-char *intc = g_strdup_printf("/cpus/cpu@%d/interrupt-controller", cpu);
-char *isa = riscv_isa_string(>soc.harts[cpu]);
-qemu_fdt_add_subnode(fdt, nodename);
+cpu_name = g_strdup_printf("/cpus/cpu@%d",
+s->soc[socket].hartid_base + cpu);
+qemu_fdt_add_subnode(fdt, cpu_name);
 #if defined(TARGET_RISCV32)
-qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv32");
+qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv32");
 #else
-qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv48");
+qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv48");
 #endif
-qemu_fdt_setprop_string(fdt, nodename, "riscv,isa", isa);
-qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv");
-qemu_fdt_setprop_string(fdt, nodename, "status", "okay");
-

Re: [PATCH v2 0/8] s390: Extended-Length SCCB & DIAGNOSE 0x318

2020-05-16 Thread no-reply
Patchew URL: 
https://patchew.org/QEMU/20200515222032.18838-1-wall...@linux.ibm.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20200515222032.18838-1-wall...@linux.ibm.com
Subject: [PATCH v2 0/8] s390: Extended-Length SCCB & DIAGNOSE 0x318
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
f8cb821 s390: guest support for diagnose 0x318
6b87c59 s390/kvm: header sync for diag318
af06627 s390/sclp: add extended-length sccb support for kvm guest
39b848c s390/sclp: use cpu offset to locate cpu entries
1dd8e02 s390/sclp: read sccb from mem based on sccb length
aad956d s390/sclp: rework sclp boundary and length checks
428b1e4 s390/sclp: check sccb len before filling in data
850e1b8 s390/sclp: get machine once during read scp/cpu info

=== OUTPUT BEGIN ===
1/8 Checking commit 850e1b88729f (s390/sclp: get machine once during read 
scp/cpu info)
2/8 Checking commit 428b1e46e016 (s390/sclp: check sccb len before filling in 
data)
WARNING: line over 80 characters
#23: FILE: hw/s390x/sclp.c:78:
+if (be16_to_cpu(sccb->h.length) < (sizeof(ReadInfo) + cpu_count * 
sizeof(CPUEntry))) {

ERROR: line over 90 characters
#48: FILE: hw/s390x/sclp.c:137:
+if (be16_to_cpu(sccb->h.length) < (sizeof(ReadCpuInfo) + cpu_count * 
sizeof(CPUEntry))) {

total: 1 errors, 1 warnings, 45 lines checked

Patch 2/8 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

3/8 Checking commit aad956d5ac92 (s390/sclp: rework sclp boundary and length 
checks)
4/8 Checking commit 1dd8e02af7b2 (s390/sclp: read sccb from mem based on sccb 
length)
5/8 Checking commit 39b848c3be15 (s390/sclp: use cpu offset to locate cpu 
entries)
6/8 Checking commit af06627cc5fb (s390/sclp: add extended-length sccb support 
for kvm guest)
WARNING: line over 80 characters
#91: FILE: hw/s390x/sclp.c:137:
+warn_report("insufficient sccb size to store full read scp info 
response");

WARNING: line over 80 characters
#115: FILE: target/s390x/cpu_features_def.inc.h:100:
+DEF_FEAT(EXTENDED_LENGTH_SCCB, "els", STFL, 140, "Extended-length SCCB 
facility")

total: 0 errors, 2 warnings, 76 lines checked

Patch 6/8 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
7/8 Checking commit 6b87c5992768 (s390/kvm: header sync for diag318)
8/8 Checking commit f8cb821134a7 (s390: guest support for diagnose 0x318)
ERROR: line over 90 characters
#226: FILE: target/s390x/cpu_features_def.inc.h:125:
+/* Features exposed via SCLP SCCB Facilities byte 134 (bit numbers relative to 
byte-134) */

WARNING: line over 80 characters
#227: FILE: target/s390x/cpu_features_def.inc.h:126:
+DEF_FEAT(DIAG_318, "diag_318", SCLP_FAC134, 0, "Control program name and 
version codes")

total: 1 errors, 1 warnings, 262 lines checked

Patch 8/8 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20200515222032.18838-1-wall...@linux.ibm.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

[PATCH 0/4] RISC-V multi-socket support

2020-05-16 Thread Anup Patel
This series adds multi-socket support for RISC-V virt machine and
RISC-V spike machine. The multi-socket support will help us improve
various RISC-V operating systems, firmwares, and bootloader to
support RISC-V NUMA systems.

These patch can be found in riscv_multi_socket_v1 branch at:
https://github.com/avpatel/qemu.git

To try this patches, we will need:
1. OpenSBI multi-PLIC and multi-CLINT support which can be found in
   multi_plic_clint_v1 branch at:
   https://github.com/avpatel/opensbi.git
2. Linux multi-PLIC improvements support which can be found in
   plic_imp_v1 branch at:
   https://github.com/avpatel/linux.git

Anup Patel (4):
  hw/riscv: Allow creating multiple instances of CLINT
  hw/riscv: spike: Allow creating multiple sockets
  hw/riscv: Allow creating multiple instances of PLIC
  hw/riscv: virt: Allow creating multiple sockets

 hw/riscv/sifive_clint.c |  20 +-
 hw/riscv/sifive_e.c |   4 +-
 hw/riscv/sifive_plic.c  |  24 +-
 hw/riscv/sifive_u.c |   4 +-
 hw/riscv/spike.c| 210 --
 hw/riscv/virt.c | 495 ++--
 include/hw/riscv/sifive_clint.h |   7 +-
 include/hw/riscv/sifive_plic.h  |  12 +-
 include/hw/riscv/spike.h|   8 +-
 include/hw/riscv/virt.h |  12 +-
 10 files changed, 458 insertions(+), 338 deletions(-)

-- 
2.25.1




[PATCH 1/4] hw/riscv: Allow creating multiple instances of CLINT

2020-05-16 Thread Anup Patel
We extend CLINT emulation to allow multiple instances of CLINT in
a QEMU RISC-V machine. To achieve this, we remove first HART id
zero assumption from CLINT emulation.

Signed-off-by: Anup Patel 
---
 hw/riscv/sifive_clint.c | 20 
 hw/riscv/sifive_e.c |  2 +-
 hw/riscv/sifive_u.c |  2 +-
 hw/riscv/spike.c|  6 +++---
 hw/riscv/virt.c |  2 +-
 include/hw/riscv/sifive_clint.h |  7 ---
 6 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/hw/riscv/sifive_clint.c b/hw/riscv/sifive_clint.c
index e933d35092..7d713fd743 100644
--- a/hw/riscv/sifive_clint.c
+++ b/hw/riscv/sifive_clint.c
@@ -78,7 +78,7 @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, 
unsigned size)
 SiFiveCLINTState *clint = opaque;
 if (addr >= clint->sip_base &&
 addr < clint->sip_base + (clint->num_harts << 2)) {
-size_t hartid = (addr - clint->sip_base) >> 2;
+size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -91,7 +91,8 @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, 
unsigned size)
 }
 } else if (addr >= clint->timecmp_base &&
 addr < clint->timecmp_base + (clint->num_harts << 3)) {
-size_t hartid = (addr - clint->timecmp_base) >> 3;
+size_t hartid = clint->hartid_base +
+((addr - clint->timecmp_base) >> 3);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -128,7 +129,7 @@ static void sifive_clint_write(void *opaque, hwaddr addr, 
uint64_t value,
 
 if (addr >= clint->sip_base &&
 addr < clint->sip_base + (clint->num_harts << 2)) {
-size_t hartid = (addr - clint->sip_base) >> 2;
+size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -141,7 +142,8 @@ static void sifive_clint_write(void *opaque, hwaddr addr, 
uint64_t value,
 return;
 } else if (addr >= clint->timecmp_base &&
 addr < clint->timecmp_base + (clint->num_harts << 3)) {
-size_t hartid = (addr - clint->timecmp_base) >> 3;
+size_t hartid = clint->hartid_base +
+((addr - clint->timecmp_base) >> 3);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -185,6 +187,7 @@ static const MemoryRegionOps sifive_clint_ops = {
 };
 
 static Property sifive_clint_properties[] = {
+DEFINE_PROP_UINT32("hartid-base", SiFiveCLINTState, hartid_base, 0),
 DEFINE_PROP_UINT32("num-harts", SiFiveCLINTState, num_harts, 0),
 DEFINE_PROP_UINT32("sip-base", SiFiveCLINTState, sip_base, 0),
 DEFINE_PROP_UINT32("timecmp-base", SiFiveCLINTState, timecmp_base, 0),
@@ -226,13 +229,13 @@ type_init(sifive_clint_register_types)
 /*
  * Create CLINT device.
  */
-DeviceState *sifive_clint_create(hwaddr addr, hwaddr size, uint32_t num_harts,
-uint32_t sip_base, uint32_t timecmp_base, uint32_t time_base,
-bool provide_rdtime)
+DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
+uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
+uint32_t timecmp_base, uint32_t time_base, bool provide_rdtime)
 {
 int i;
 for (i = 0; i < num_harts; i++) {
-CPUState *cpu = qemu_get_cpu(i);
+CPUState *cpu = qemu_get_cpu(hartid_base + i);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
 continue;
@@ -246,6 +249,7 @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size, 
uint32_t num_harts,
 }
 
 DeviceState *dev = qdev_create(NULL, TYPE_SIFIVE_CLINT);
+qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
 qdev_prop_set_uint32(dev, "num-harts", num_harts);
 qdev_prop_set_uint32(dev, "sip-base", sip_base);
 qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index b53109521e..1c3b37d0ba 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -163,7 +163,7 @@ static void riscv_sifive_e_soc_realize(DeviceState *dev, 
Error **errp)
 SIFIVE_E_PLIC_CONTEXT_STRIDE,
 memmap[SIFIVE_E_PLIC].size);
 sifive_clint_create(memmap[SIFIVE_E_CLINT].base,
-memmap[SIFIVE_E_CLINT].size, ms->smp.cpus,
+memmap[SIFIVE_E_CLINT].size, 0, ms->smp.cpus,
 SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
 create_unimplemented_device("riscv.sifive.e.aon",
 memmap[SIFIVE_E_AON].base, memmap[SIFIVE_E_AON].size);
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index bed10fcfa8..22997fbf13 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -601,7 +601,7 @@ static 

[PATCH 3/4] hw/riscv: Allow creating multiple instances of PLIC

2020-05-16 Thread Anup Patel
We extend PLIC emulation to allow multiple instances of PLIC in
a QEMU RISC-V machine. To achieve this, we remove first HART id
zero assumption from PLIC emulation.

Signed-off-by: Anup Patel 
---
 hw/riscv/sifive_e.c|  2 +-
 hw/riscv/sifive_plic.c | 24 +---
 hw/riscv/sifive_u.c|  2 +-
 hw/riscv/virt.c|  2 +-
 include/hw/riscv/sifive_plic.h | 12 +++-
 5 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index 1c3b37d0ba..bd122e71ae 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -152,7 +152,7 @@ static void riscv_sifive_e_soc_realize(DeviceState *dev, 
Error **errp)
 
 /* MMIO */
 s->plic = sifive_plic_create(memmap[SIFIVE_E_PLIC].base,
-(char *)SIFIVE_E_PLIC_HART_CONFIG,
+(char *)SIFIVE_E_PLIC_HART_CONFIG, 0,
 SIFIVE_E_PLIC_NUM_SOURCES,
 SIFIVE_E_PLIC_NUM_PRIORITIES,
 SIFIVE_E_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/sifive_plic.c b/hw/riscv/sifive_plic.c
index c1e04cbb98..f88bb48053 100644
--- a/hw/riscv/sifive_plic.c
+++ b/hw/riscv/sifive_plic.c
@@ -352,6 +352,7 @@ static const MemoryRegionOps sifive_plic_ops = {
 
 static Property sifive_plic_properties[] = {
 DEFINE_PROP_STRING("hart-config", SiFivePLICState, hart_config),
+DEFINE_PROP_UINT32("hartid-base", SiFivePLICState, hartid_base, 0),
 DEFINE_PROP_UINT32("num-sources", SiFivePLICState, num_sources, 0),
 DEFINE_PROP_UINT32("num-priorities", SiFivePLICState, num_priorities, 0),
 DEFINE_PROP_UINT32("priority-base", SiFivePLICState, priority_base, 0),
@@ -400,10 +401,12 @@ static void parse_hart_config(SiFivePLICState *plic)
 }
 hartid++;
 
-/* store hart/mode combinations */
 plic->num_addrs = addrid;
+plic->num_harts = hartid;
+
+/* store hart/mode combinations */
 plic->addr_config = g_new(PLICAddr, plic->num_addrs);
-addrid = 0, hartid = 0;
+addrid = 0, hartid = plic->hartid_base;
 p = plic->hart_config;
 while ((c = *p++)) {
 if (c == ',') {
@@ -429,8 +432,6 @@ static void sifive_plic_irq_request(void *opaque, int irq, 
int level)
 
 static void sifive_plic_realize(DeviceState *dev, Error **errp)
 {
-MachineState *ms = MACHINE(qdev_get_machine());
-unsigned int smp_cpus = ms->smp.cpus;
 SiFivePLICState *plic = SIFIVE_PLIC(dev);
 int i;
 
@@ -451,8 +452,8 @@ static void sifive_plic_realize(DeviceState *dev, Error 
**errp)
  * lost a interrupt in the case a PLIC is attached. The SEIP bit must be
  * hardware controlled when a PLIC is attached.
  */
-for (i = 0; i < smp_cpus; i++) {
-RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(i));
+for (i = 0; i < plic->num_harts; i++) {
+RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(plic->hartid_base + i));
 if (riscv_cpu_claim_interrupts(cpu, MIP_SEIP) < 0) {
 error_report("SEIP already claimed");
 exit(1);
@@ -488,16 +489,17 @@ type_init(sifive_plic_register_types)
  * Create PLIC device.
  */
 DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
-uint32_t num_sources, uint32_t num_priorities,
-uint32_t priority_base, uint32_t pending_base,
-uint32_t enable_base, uint32_t enable_stride,
-uint32_t context_base, uint32_t context_stride,
-uint32_t aperture_size)
+uint32_t hartid_base, uint32_t num_sources,
+uint32_t num_priorities, uint32_t priority_base,
+uint32_t pending_base, uint32_t enable_base,
+uint32_t enable_stride, uint32_t context_base,
+uint32_t context_stride, uint32_t aperture_size)
 {
 DeviceState *dev = qdev_create(NULL, TYPE_SIFIVE_PLIC);
 assert(enable_stride == (enable_stride & -enable_stride));
 assert(context_stride == (context_stride & -context_stride));
 qdev_prop_set_string(dev, "hart-config", hart_config);
+qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
 qdev_prop_set_uint32(dev, "num-sources", num_sources);
 qdev_prop_set_uint32(dev, "num-priorities", num_priorities);
 qdev_prop_set_uint32(dev, "priority-base", priority_base);
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index 22997fbf13..69dbd7980b 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -585,7 +585,7 @@ static void riscv_sifive_u_soc_realize(DeviceState *dev, 
Error **errp)
 
 /* MMIO */
 s->plic = sifive_plic_create(memmap[SIFIVE_U_PLIC].base,
-plic_hart_config,
+plic_hart_config, 0,
 SIFIVE_U_PLIC_NUM_SOURCES,
 SIFIVE_U_PLIC_NUM_PRIORITIES,
 SIFIVE_U_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index dcb8a83b35..f40efcb193 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -585,7 +585,7 @@ static void riscv_virt_board_init(MachineState *machine)
 
 /* MMIO */
 s->plic = sifive_plic_create(memmap[VIRT_PLIC].base,
-plic_hart_config,
+plic_hart_config, 0,
 VIRT_PLIC_NUM_SOURCES,
   

[PATCH 2/4] hw/riscv: spike: Allow creating multiple sockets

2020-05-16 Thread Anup Patel
We extend RISC-V spike machine to allow creating a multi-socket machine.
Each RISC-V spike machine socket is a set of HARTs and a CLINT instance.
Other peripherals are shared between all RISC-V spike machine sockets.
We also update RISC-V spike machine device tree to treat each socket as
a NUMA node.

The number of sockets in RISC-V spike machine can be specified using
the "sockets=" sub-option of QEMU "-smp" command-line option. By
default, only one socket RISC-V spike machine will be created.

Currently, we only allow creating upto maximum 4 sockets with minimum
2 HARTs per socket. In future, this limits can be changed.

Signed-off-by: Anup Patel 
---
 hw/riscv/spike.c | 206 ---
 include/hw/riscv/spike.h |   8 +-
 2 files changed, 133 insertions(+), 81 deletions(-)

diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index d5e0103d89..f63c57a87c 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -64,9 +64,11 @@ static void create_fdt(SpikeState *s, const struct 
MemmapEntry *memmap,
 uint64_t mem_size, const char *cmdline)
 {
 void *fdt;
-int cpu;
-uint32_t *cells;
-char *nodename;
+int cpu, socket;
+uint32_t *clint_cells;
+unsigned long clint_addr;
+uint32_t cpu_phandle, intc_phandle, phandle = 1;
+char *name, *clint_name, *clust_name, *core_name, *cpu_name, *intc_name;
 
 fdt = s->fdt = create_device_tree(>fdt_size);
 if (!fdt) {
@@ -88,68 +90,85 @@ static void create_fdt(SpikeState *s, const struct 
MemmapEntry *memmap,
 qemu_fdt_setprop_cell(fdt, "/soc", "#size-cells", 0x2);
 qemu_fdt_setprop_cell(fdt, "/soc", "#address-cells", 0x2);
 
-nodename = g_strdup_printf("/memory@%lx",
-(long)memmap[SPIKE_DRAM].base);
-qemu_fdt_add_subnode(fdt, nodename);
-qemu_fdt_setprop_cells(fdt, nodename, "reg",
+name = g_strdup_printf("/memory@%lx", (long)memmap[SPIKE_DRAM].base);
+qemu_fdt_add_subnode(fdt, name);
+qemu_fdt_setprop_cells(fdt, name, "reg",
 memmap[SPIKE_DRAM].base >> 32, memmap[SPIKE_DRAM].base,
 mem_size >> 32, mem_size);
-qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
-g_free(nodename);
+qemu_fdt_setprop_string(fdt, name, "device_type", "memory");
+g_free(name);
 
 qemu_fdt_add_subnode(fdt, "/cpus");
 qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
 SIFIVE_CLINT_TIMEBASE_FREQ);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
+qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
 
-for (cpu = s->soc.num_harts - 1; cpu >= 0; cpu--) {
-nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
-char *intc = g_strdup_printf("/cpus/cpu@%d/interrupt-controller", cpu);
-char *isa = riscv_isa_string(>soc.harts[cpu]);
-qemu_fdt_add_subnode(fdt, nodename);
+for (socket = (s->num_socs - 1); socket >= 0; socket--) {
+clust_name = g_strdup_printf("/cpus/cpu-map/cluster0%d", socket);
+qemu_fdt_add_subnode(fdt, clust_name);
+
+clint_cells =  g_new0(uint32_t, s->soc[socket].num_harts * 4);
+
+for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
+cpu_phandle = phandle++;
+
+cpu_name = g_strdup_printf("/cpus/cpu@%d",
+s->soc[socket].hartid_base + cpu);
+qemu_fdt_add_subnode(fdt, cpu_name);
 #if defined(TARGET_RISCV32)
-qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv32");
+qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv32");
 #else
-qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv48");
+qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv48");
 #endif
-qemu_fdt_setprop_string(fdt, nodename, "riscv,isa", isa);
-qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv");
-qemu_fdt_setprop_string(fdt, nodename, "status", "okay");
-qemu_fdt_setprop_cell(fdt, nodename, "reg", cpu);
-qemu_fdt_setprop_string(fdt, nodename, "device_type", "cpu");
-qemu_fdt_add_subnode(fdt, intc);
-qemu_fdt_setprop_cell(fdt, intc, "phandle", 1);
-qemu_fdt_setprop_string(fdt, intc, "compatible", "riscv,cpu-intc");
-qemu_fdt_setprop(fdt, intc, "interrupt-controller", NULL, 0);
-qemu_fdt_setprop_cell(fdt, intc, "#interrupt-cells", 1);
-g_free(isa);
-g_free(intc);
-g_free(nodename);
-}
+name = riscv_isa_string(>soc[socket].harts[cpu]);
+qemu_fdt_setprop_string(fdt, cpu_name, "riscv,isa", name);
+g_free(name);
+qemu_fdt_setprop_string(fdt, cpu_name, "compatible", "riscv");
+qemu_fdt_setprop_string(fdt, cpu_name, "status", "okay");
+qemu_fdt_setprop_cell(fdt, cpu_name, "reg",
+s->soc[socket].hartid_base + cpu);
+qemu_fdt_setprop_string(fdt, cpu_name,