[PATCH 22/24] tests/: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 tests/avocado/acpi-bits.py  |  4 ++--
 tests/avocado/acpi-bits/bits-tests/testacpi.py2 |  4 ++--
 tests/decode/err_pattern_group_ident2.decode|  2 +-
 tests/docker/common.rc  |  2 +-
 tests/migration/guestperf-batch.py  |  2 +-
 tests/migration/guestperf.py|  2 +-
 tests/plugin/mem.c  |  2 +-
 tests/qapi-schema/bad-if-not.json   |  2 +-
 tests/qemu-iotests/029  |  2 +-
 tests/qemu-iotests/040  |  8 
 tests/qemu-iotests/046  |  2 +-
 tests/qemu-iotests/059  |  2 +-
 tests/qemu-iotests/061  |  2 +-
 tests/qemu-iotests/071  |  2 +-
 tests/qemu-iotests/197  |  2 +-
 tests/qemu-iotests/215  |  2 +-
 tests/qemu-iotests/298  |  2 +-
 tests/qemu-iotests/pylintrc |  2 +-
 tests/qtest/ahci-test.c |  2 +-
 tests/qtest/bcm2835-dma-test.c  |  2 +-
 tests/qtest/bios-tables-test.c  |  2 +-
 tests/qtest/ds1338-test.c   |  2 +-
 tests/qtest/fuzz/generic_fuzz.c |  4 ++--
 tests/qtest/libqos/qgraph.c |  4 ++--
 tests/qtest/libqos/qgraph_internal.h|  2 +-
 tests/qtest/libqos/virtio-gpio.c|  2 +-
 tests/qtest/libqtest.c  |  4 ++--
 tests/qtest/migration-test.c|  6 +++---
 tests/qtest/npcm7xx_timer-test.c|  2 +-
 tests/qtest/tpm-emu.c   |  2 +-
 tests/qtest/tpm-tests.c |  2 +-
 tests/qtest/tpm-tests.h |  2 +-
 tests/qtest/tpm-tis-i2c-test.c  |  2 +-
 tests/qtest/tpm-tis-util.c  |  2 +-
 tests/qtest/vhost-user-blk-test.c   |  2 +-
 tests/qtest/virtio-net-test.c   |  2 +-
 tests/qtest/vmgenid-test.c  |  2 +-
 tests/tsan/suppressions.tsan|  2 +-
 tests/uefi-test-tools/Makefile  |  2 +-
 tests/unit/check-qjson.c|  2 +-
 tests/unit/test-aio.c   |  2 +-
 tests/unit/test-bdrv-graph-mod.c| 12 ++--
 tests/unit/test-crypto-secret.c |  2 +-
 tests/unit/test-qobject-input-visitor.c |  2 +-
 tests/unit/test-throttle.c  |  4 ++--
 tests/unit/test-util-filemonitor.c  |  2 +-
 tests/unit/test-xs-node.c   |  2 +-
 tests/vm/Makefile.include   |  2 +-
 tests/vm/ubuntuvm.py|  2 +-
 49 files changed, 65 insertions(+), 65 deletions(-)

diff --git a/tests/avocado/acpi-bits.py b/tests/avocado/acpi-bits.py
index 3ed286dcbd..bb3f818689 100644
--- a/tests/avocado/acpi-bits.py
+++ b/tests/avocado/acpi-bits.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
 # group: rw quick
-# Exercize QEMU generated ACPI/SMBIOS tables using biosbits,
+# Exercise QEMU generated ACPI/SMBIOS tables using biosbits,
 # https://biosbits.org/
 #
@@ -367,5 +367,5 @@ def tearDown(self):
 
 def test_acpi_smbios_bits(self):
-"""The main test case implementaion."""
+"""The main test case implementation."""
 
 iso_file = os.path.join(self._workDir,
diff --git a/tests/avocado/acpi-bits/bits-tests/testacpi.py2 
b/tests/avocado/acpi-bits/bits-tests/testacpi.py2
index f818a9cce6..7bf9075c1b 100644
--- a/tests/avocado/acpi-bits/bits-tests/testacpi.py2
+++ b/tests/avocado/acpi-bits/bits-tests/testacpi.py2
@@ -274,6 +274,6 @@ def test_rsdp():
 # Checksum the first 20 bytes per ACPI 1.0
 csum = sum(ord(c) for c in data[:20]) % 0x100
-testsuite.test('ACPI 1.0 table first 20 bytes cummulative checksum must 
equal 0', csum == 0)
-testsuite.print_detail("Cummulative checksum = {} (Expected 
0)".format(csum))
+testsuite.test('ACPI 1.0 table first 20 bytes cumulative checksum must 
equal 0', csum == 0)
+testsuite.print_detail("Cumulative checksum = {} (Expected 
0)".format(csum))
 
 test_table_checksum(data)
diff --git a/tests/decode/err_pattern_group_ident2.decode 
b/tests/decode/err_pattern_group_ident2.decode
index bc859233b1..0abb7513e9 100644
--- a/tests/decode/err_pattern_group_ident2.decode
+++ b/tests/decode/err_pattern_group_ident2.decode
@@ -8,4 +8,4 @@
   top     
   sub1     %sub1
-# comments are suposed to be indented
+# comments are supposed to be indented
 }
diff --git a/tests/docker/common.rc b/tests/docker/common.rc
index 9a33df2832..a611e6adf9 100755
--- a/tests/docker/common.rc
+++ b/tests/docker/common.rc
@@ -13,5 +13,5 @@
 
 # This might be set by ENV of a docker container... it is always

[PATCH 14/24] hw/tpm: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/tpm/tpm_tis.h| 2 +-
 hw/tpm/tpm_tis_common.c | 2 +-
 hw/tpm/tpm_tis_i2c.c| 4 ++--
 hw/tpm/tpm_tis_isa.c| 2 +-
 hw/tpm/tpm_tis_sysbus.c | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/tpm/tpm_tis.h b/hw/tpm/tpm_tis.h
index 6f29a508dd..6f14896b97 100644
--- a/hw/tpm/tpm_tis.h
+++ b/hw/tpm/tpm_tis.h
@@ -20,5 +20,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 #ifndef TPM_TPM_TIS_H
diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c
index c07c179dbc..279ce436b5 100644
--- a/hw/tpm/tpm_tis_common.c
+++ b/hw/tpm/tpm_tis_common.c
@@ -21,5 +21,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 #include "qemu/osdep.h"
diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c
index b695fd3a46..4ecea7fa3e 100644
--- a/hw/tpm/tpm_tis_i2c.c
+++ b/hw/tpm/tpm_tis_i2c.c
@@ -14,5 +14,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  *
  */
@@ -508,5 +508,5 @@ static void tpm_tis_i2c_realizefn(DeviceState *dev, Error 
**errp)
 
 /*
- * Get the backend pointer. It is not initialized propery during
+ * Get the backend pointer. It is not initialized properly during
  * device_class_set_props
  */
diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c
index 91e3792248..0367401586 100644
--- a/hw/tpm/tpm_tis_isa.c
+++ b/hw/tpm/tpm_tis_isa.c
@@ -20,5 +20,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 6724b3d4f6..2fc550f119 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -20,5 +20,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 
-- 
2.39.2

[PATCH 15/24] hw/usb hw/ide hw/i2c: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/i2c/pm_smbus.c   | 2 +-
 hw/i2c/pmbus_device.c   | 2 +-
 hw/i2c/smbus_slave.c| 2 +-
 hw/ide/ahci_internal.h  | 4 ++--
 hw/ide/cmd646.c | 2 +-
 hw/ide/core.c   | 2 +-
 hw/usb/ccid-card-emulated.c | 2 +-
 hw/usb/hcd-ehci.c   | 6 +++---
 hw/usb/hcd-ohci.c   | 2 +-
 hw/usb/quirks.h | 2 +-
 hw/usb/redirect.c   | 2 +-
 hw/usb/trace-events | 2 +-
 hw/usb/xen-usb.c| 2 +-
 13 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c
index d7eae548cb..9ad6a47739 100644
--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -1,5 +1,5 @@
 /*
  * PC SMBus implementation
- * splitted from acpi.c
+ * split from acpi.c
  *
  * Copyright (c) 2006 Fabrice Bellard
diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index 44fe4eddbb..426f72ac60 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -1624,5 +1624,5 @@ static int pmbus_write_data(SMBusDevice *smd, uint8_t 
*buf, uint8_t len)
 
 passthrough:
-/* Unimplimented registers get passed to the device */
+/* Unimplemented registers get passed to the device */
 default:
 if (pmdc->write_data) {
diff --git a/hw/i2c/smbus_slave.c b/hw/i2c/smbus_slave.c
index feb3ec6333..2ef2c7c5f6 100644
--- a/hw/i2c/smbus_slave.c
+++ b/hw/i2c/smbus_slave.c
@@ -3,5 +3,5 @@
  *
  * This code is a helper for SMBus device emulation.  It implements an
- * I2C device inteface and runs the SMBus protocol from the device
+ * I2C device interface and runs the SMBus protocol from the device
  * point of view and maps those to simple calls to emulate.
  *
diff --git a/hw/ide/ahci_internal.h b/hw/ide/ahci_internal.h
index 2480455372..c244bbd8be 100644
--- a/hw/ide/ahci_internal.h
+++ b/hw/ide/ahci_internal.h
@@ -62,5 +62,5 @@ enum AHCIHostReg {
 AHCI_HOST_REG_IRQ_STAT   = 2,  /* IS: interrupt status */
 AHCI_HOST_REG_PORTS_IMPL = 3,  /* PI: bitmap of implemented ports */
-AHCI_HOST_REG_VERSION= 4,  /* VS: AHCI spec. version compliancy */
+AHCI_HOST_REG_VERSION= 4,  /* VS: AHCI spec. version compliance */
 AHCI_HOST_REG_CCC_CTL= 5,  /* CCC_CTL: CCC Control */
 AHCI_HOST_REG_CCC_PORTS  = 6,  /* CCC_PORTS: CCC Ports */
@@ -68,5 +68,5 @@ enum AHCIHostReg {
 AHCI_HOST_REG_EM_CTL = 8,  /* EM_CTL: Enclosure Mgmt Control */
 AHCI_HOST_REG_CAP2   = 9,  /* CAP2: host capabilities, extended */
-AHCI_HOST_REG_BOHC   = 10, /* BOHC: firmare/os handoff ctrl & status */
+AHCI_HOST_REG_BOHC   = 10, /* BOHC: firmware/os handoff ctrl & status 
*/
 AHCI_HOST_REG__COUNT = 11
 };
diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index cabe9048b1..c0bcfa4414 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -258,5 +258,5 @@ static void pci_cmd646_ide_realize(PCIDevice *dev, Error 
**errp)
 pci_conf[CNTRL] = CNTRL_EN_CH0; // enable IDE0
 if (d->secondary) {
-/* XXX: if not enabled, really disable the seconday IDE controller */
+/* XXX: if not enabled, really disable the secondary IDE controller */
 pci_conf[CNTRL] |= CNTRL_EN_CH1; /* enable IDE1 */
 }
diff --git a/hw/ide/core.c b/hw/ide/core.c
index de48ff9f86..ee116891ed 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1699,5 +1699,5 @@ static bool cmd_set_features(IDEState *s, uint8_t cmd)
 put_le16(identify_data + 88, 0x3f);
 break;
-case 0x02: /* sigle word dma mode*/
+case 0x02: /* single word dma mode */
 put_le16(identify_data + 62, 0x07 | (1 << (val + 8)));
 put_le16(identify_data + 63, 0x07);
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index c328660075..3ee9c73b87 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -519,5 +519,5 @@ static void emulated_realize(CCIDCardState *base, Error 
**errp)
 }
 
-/* TODO: a passthru backened that works on local machine. third card 
type?*/
+/* TODO: a passthru backend that works on local machine. third card type?*/
 if (card->backend == BACKEND_CERTIFICATES) {
 if (card->cert1 != NULL && card->cert2 != NULL && card->cert3 != NULL) 
{
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index c930c60921..19b4534c20 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1465,5 +1465,5 @@ static int ehci_process_itd(EHCIState *ehci,
 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
 } else {
-DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
+DPRINTF("ISOCH: attempt to address non-iso endpoint\n");
 ehci->ipacket.status = USB_RET_NAK;
 ehci->ipacket.actual_length = 0;
@@ -1514,5 +1514,5 @@ static int ehci_process_itd(EHCIState *ehci,
 
 /*  This state is the entry point for asynchronous schedule
- *  processing.  Entry

[PATCH 13/24] hw/pci: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/pci-bridge/cxl_downstream.c  | 2 +-
 hw/pci-bridge/pci_expander_bridge.c | 2 +-
 hw/pci-host/bonito.c| 2 +-
 hw/pci-host/designware.c| 4 ++--
 hw/pci-host/dino.c  | 2 +-
 hw/pci-host/gpex-acpi.c | 2 +-
 hw/pci-host/gt64120.c   | 4 ++--
 hw/pci-host/pnv_phb.c   | 2 +-
 hw/pci-host/pnv_phb3.c  | 2 +-
 hw/pci-host/pnv_phb3_msi.c  | 2 +-
 hw/pci-host/pnv_phb4.c  | 6 +++---
 hw/pci/pcie_aer.c   | 2 +-
 hw/pci/shpc.c   | 2 +-
 13 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index 54f507318f..5a2b749c8e 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -43,5 +43,5 @@ static void latch_registers(CXLDownstreamPort *dsp)
 }
 
-/* TODO: Look at sharing this code acorss all CXL port types */
+/* TODO: Look at sharing this code across all CXL port types */
 static void cxl_dsp_dvsec_write_config(PCIDevice *dev, uint32_t addr,
   uint32_t val, int len)
diff --git a/hw/pci-bridge/pci_expander_bridge.c 
b/hw/pci-bridge/pci_expander_bridge.c
index 613857b601..535889f7c2 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -264,5 +264,5 @@ static int pxb_map_irq_fn(PCIDevice *pci_dev, int pin)
 /*
  * First carry out normal swizzle to handle
- * multple root ports on a pxb instance.
+ * multiple root ports on a pxb instance.
  */
 pin = pci_swizzle_map_irq_fn(pci_dev, pin);
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 4701481b9b..ee6cb85e97 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -63,5 +63,5 @@
 #endif
 
-/* from linux soure code. include/asm-mips/mips-boards/bonito64.h*/
+/* from linux source code. include/asm-mips/mips-boards/bonito64.h*/
 #define BONITO_BOOT_BASE0x1fc0
 #define BONITO_BOOT_SIZE0x0010
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index 388d252ee2..e325514372 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -489,5 +489,5 @@ static void designware_pcie_root_realize(PCIDevice *dev, 
Error **errp)
 /*
  * If no inbound iATU windows are configured, HW defaults to
- * letting inbound TLPs to pass in. We emulate that by exlicitly
+ * letting inbound TLPs to pass in. We emulate that by explicitly
  * configuring first inbound window to cover all of target's
  * address space.
@@ -504,5 +504,5 @@ static void designware_pcie_root_realize(PCIDevice *dev, 
Error **errp)
   root, "pcie-msi", 0x4);
 /*
- * We initially place MSI interrupt I/O region a adress 0 and
+ * We initially place MSI interrupt I/O region a address 0 and
  * disable it. It'll be later moved to correct offset and enabled
  * in designware_pcie_root_update_msi_mapping() as a part of
diff --git a/hw/pci-host/dino.c b/hw/pci-host/dino.c
index e8eaebca54..82503229fa 100644
--- a/hw/pci-host/dino.c
+++ b/hw/pci-host/dino.c
@@ -1,4 +1,4 @@
 /*
- * HP-PARISC Dino PCI chipset emulation, as in B160L and similiar machines
+ * HP-PARISC Dino PCI chipset emulation, as in B160L and similar machines
  *
  * (C) 2017-2019 by Helge Deller 
diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index 7c7316bc96..87ba074254 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -178,5 +178,5 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
 
 /*
- * Resources defined for PXBs are composed by the folling parts:
+ * Resources defined for PXBs are composed by the following parts:
  * 1. The resources the pci-brige/pcie-root-port need.
  * 2. The resources the devices behind pxb need.
diff --git a/hw/pci-host/gt64120.c b/hw/pci-host/gt64120.c
index 82c15edb46..143bf053d7 100644
--- a/hw/pci-host/gt64120.c
+++ b/hw/pci-host/gt64120.c
@@ -332,7 +332,7 @@ static void gt64120_update_pci_cfgdata_mapping(GT64120State 
*s)
  * The setting of the MByteSwap bit and MWordSwap bit in the PCI Internal
  * Command Register determines how data transactions from the CPU to/from
- * PCI are handled along with the setting of the Endianess bit in the CPU
+ * PCI are handled along with the setting of the Endianness bit in the CPU
  * Configuration Register. See:
- * - Table 16: 32-bit PCI Transaction Endianess
+ * - Table 16: 32-bit PCI Transaction Endianness
  * - Table 158: PCI_0 Command, Offset: 0xc00
  */
diff --git a/hw/pci-host/pnv_phb.c b/hw/pci-host/pnv_phb.c
index 82332d7a05..157c00782c 100644
--- a/hw/pci-host/pnv_phb.c
+++ b/hw/pci-host/pnv_phb.c
@@ -26,5 +26,5 @@
  * Otherwise use object_typename[index] as QOM id.
  *
- * This helper does both operations at the same time 

[PATCH 19/24] hw/other: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/acpi/aml-build.c  |  6 +++---
 hw/acpi/hmat.c   |  2 +-
 hw/acpi/nvdimm.c |  2 +-
 hw/block/hd-geometry.c   |  4 ++--
 hw/block/pflash_cfi01.c  |  2 +-
 hw/char/cadence_uart.c   |  2 +-
 hw/char/imx_serial.c |  2 +-
 hw/char/serial.c |  2 +-
 hw/core/generic-loader.c |  4 ++--
 hw/core/machine.c|  2 +-
 hw/core/qdev-properties-system.c |  2 +-
 hw/cpu/a15mpcore.c   |  2 +-
 hw/cxl/cxl-events.c  |  2 +-
 hw/cxl/cxl-mailbox-utils.c   |  4 ++--
 hw/dma/omap_dma.c|  4 ++--
 hw/input/hid.c   |  2 +-
 hw/input/tsc2005.c   | 16 
 hw/intc/loongarch_extioi.c   |  2 +-
 hw/intc/loongson_liointc.c   |  2 +-
 hw/intc/omap_intc.c  |  2 +-
 hw/intc/pnv_xive.c   |  2 +-
 hw/intc/spapr_xive.c |  2 +-
 hw/intc/spapr_xive_kvm.c |  6 +++---
 hw/intc/xive.c   |  2 +-
 hw/intc/xive2.c  |  6 +++---
 hw/ipmi/ipmi_bmc_extern.c|  2 +-
 hw/mem/cxl_type3.c   |  6 +++---
 hw/misc/imx7_ccm.c   |  2 +-
 hw/misc/mac_via.c|  2 +-
 hw/misc/stm32f2xx_syscfg.c   |  4 ++--
 hw/misc/trace-events |  2 +-
 hw/misc/zynq_slcr.c  |  2 +-
 hw/nvme/ctrl.c   |  6 +++---
 hw/nvram/eeprom_at24c.c  |  2 +-
 hw/nvram/fw_cfg.c|  2 +-
 hw/rtc/exynos4210_rtc.c  |  2 +-
 hw/rx/rx62n.c|  2 +-
 hw/scsi/lsi53c895a.c |  2 +-
 hw/scsi/mfi.h|  2 +-
 hw/sd/sd.c   |  2 +-
 hw/sd/sdhci.c|  2 +-
 hw/sensor/isl_pmbus_vr.c |  2 +-
 hw/sensor/max34451.c |  2 +-
 hw/sh4/sh7750_regs.h | 26 +-
 hw/smbios/smbios.c   |  2 +-
 hw/ssi/xilinx_spips.c|  6 +++---
 hw/ssi/xlnx-versal-ospi.c|  2 +-
 hw/timer/etraxfs_timer.c |  2 +-
 hw/timer/renesas_tmr.c   |  2 +-
 hw/virtio/virtio-crypto.c|  4 ++--
 hw/virtio/virtio-mem.c   |  2 +-
 hw/virtio/virtio.c   |  2 +-
 52 files changed, 89 insertions(+), 89 deletions(-)

diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index ea331a20d1..af66bde0f5 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -313,5 +313,5 @@ build_prepend_package_length(GArray *package, unsigned 
length, bool incl_self)
  * PkgLength is the length of the inclusive length of the data
  * and PkgLength's length itself when used for terms with
- * explitit length.
+ * explicit length.
  */
 length += length_bytes;
@@ -681,5 +681,5 @@ Aml *aml_store(Aml *val, Aml *target)
  * pattern.
  *
- * Returns: The newly allocated and composed according to patter Aml object.
+ * Returns: The newly allocated and composed according to pattern Aml object.
  */
 static Aml *
@@ -2160,5 +2160,5 @@ void build_fadt(GArray *tbl, BIOSLinker *linker, const 
AcpiFadtData *f,
 build_append_int_noprefix(tbl, f->minor_ver, 1);
 } else {
-build_append_int_noprefix(tbl, 0, 3); /* Reserved upto ACPI 5.0 */
+build_append_int_noprefix(tbl, 0, 3); /* Reserved up to ACPI 5.0 */
 }
 build_append_int_noprefix(tbl, 0, 8); /* X_FIRMWARE_CTRL */
diff --git a/hw/acpi/hmat.c b/hw/acpi/hmat.c
index 3a6d51282a..2d5e199ba9 100644
--- a/hw/acpi/hmat.c
+++ b/hw/acpi/hmat.c
@@ -83,5 +83,5 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info 
*hmat_lb,
 /* Length in bytes for entire structure */
 uint32_t lb_length
-= 32 /* Table length upto and including Entry Base Unit */
+= 32 /* Table length up to and including Entry Base Unit */
 + 4 * num_initiator /* Initiator Proximity Domain List */
 + 4 * num_target /* Target Proximity Domain List */
diff --git a/hw/acpi/nvdimm.c b/hw/acpi/nvdimm.c
index a3b25a92f3..fe03ce87e0 100644
--- a/hw/acpi/nvdimm.c
+++ b/hw/acpi/nvdimm.c
@@ -1098,5 +1098,5 @@ static void nvdimm_build_common_dsm(Aml *dev,
  * DSDT tables revision number. If revision number is < 2, integer
  * size is 32 bits, otherwise it is 64 bits.
- * Because of this CreateField() canot be used if RLEN < Integer Size.
+ * Because of this CreateField() cannot be used if RLEN < Integer Size.
  *
  * Also please note that APCI ASL operator SizeOf() doesn't support
diff --git a/hw/block/hd-geometry.c b/hw/block/hd-geometry.c
index dae13ab14d..2b0af4430f 100644
--- a/hw/block/hd-geometry.c
+++ b/hw/block/hd-geometry.c
@@ -51,5 +51,5 @@ struct partition {
 } QEMU_PACKED;
 
-/* try to guess the disk logical geometry from the MSDOS partition table.
+/* try to guess the disk logical geometry from the MS-DOS partition table.
Return 0 if OK, -1 if could not guess */
 static int g

[PATCH 06/24] docs: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 docs/devel/qapi-code-gen.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/qapi-code-gen.rst b/docs/devel/qapi-code-gen.rst
index 7f78183cd4..b0852da97b 100644
--- a/docs/devel/qapi-code-gen.rst
+++ b/docs/devel/qapi-code-gen.rst
@@ -1368,5 +1368,5 @@ anymore, optional return or event data members that can't 
be sent
 anymore, and return or event data member (enumeration) values that
 can't be sent anymore makes no difference to clients, except for
-introspection.  The latter can conceivably confuse clients, so tread
+introspection.  The latter can conceivably confuse clients, so treat
 carefully.
 
-- 
2.39.2

[PATCH 12/24] hw/net: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/net/cadence_gem.c  | 10 +-
 hw/net/dp8393x.c  |  2 +-
 hw/net/e1000_regs.h   |  2 +-
 hw/net/e1000x_regs.h  |  2 +-
 hw/net/fsl_etsec/rings.c  |  2 +-
 hw/net/igb_regs.h |  4 ++--
 hw/net/mcf_fec.c  |  2 +-
 hw/net/rocker/rocker_fp.c |  2 +-
 hw/net/rtl8139.c  |  2 +-
 hw/net/smc91c111.c|  2 +-
 hw/net/sungem.c   |  2 +-
 hw/net/sunhme.c   |  2 +-
 hw/net/virtio-net.c   |  6 +++---
 hw/net/vmxnet3.c  |  2 +-
 hw/net/vmxnet3.h  |  2 +-
 15 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 42ea2411a2..f445d8bb5e 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -82,6 +82,6 @@
 #define GEM_SVLAN (0x00C0 / 4) /* Stacked VLAN reg */
 #define GEM_MODID (0x00FC / 4) /* Module ID reg */
-#define GEM_OCTTXLO   (0x0100 / 4) /* Octects transmitted Low reg */
-#define GEM_OCTTXHI   (0x0104 / 4) /* Octects transmitted High reg */
+#define GEM_OCTTXLO   (0x0100 / 4) /* Octets transmitted Low reg */
+#define GEM_OCTTXHI   (0x0104 / 4) /* Octets transmitted High reg */
 #define GEM_TXCNT (0x0108 / 4) /* Error-free Frames transmitted */
 #define GEM_TXBCNT(0x010C / 4) /* Error-free Broadcast Frames */
@@ -102,6 +102,6 @@
 #define GEM_DEFERTXCNT(0x0148 / 4) /* Deferred Transmission Frames */
 #define GEM_CSENSECNT (0x014C / 4) /* Carrier Sense Error Counter */
-#define GEM_OCTRXLO   (0x0150 / 4) /* Octects Received register Low */
-#define GEM_OCTRXHI   (0x0154 / 4) /* Octects Received register High */
+#define GEM_OCTRXLO   (0x0150 / 4) /* Octets Received register Low */
+#define GEM_OCTRXHI   (0x0154 / 4) /* Octets Received register High */
 #define GEM_RXCNT (0x0158 / 4) /* Error-free Frames Received */
 #define GEM_RXBROADCNT(0x015C / 4) /* Error-free Broadcast Frames RX */
@@ -955,5 +955,5 @@ static ssize_t gem_receive(NetClientState *nc, const 
uint8_t *buf, size_t size)
 maf = gem_mac_address_filter(s, buf);
 if (maf == GEM_RX_REJECT) {
-return size;  /* no, drop siliently b/c it's not an error */
+return size;  /* no, drop silently b/c it's not an error */
 }
 
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index a596f7fbc6..c6f5fb7dce 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -552,5 +552,5 @@ static uint64_t dp8393x_read(void *opaque, hwaddr addr, 
unsigned int size)
 }
 break;
-/* All other registers have no special contraints */
+/* All other registers have no special constraints */
 default:
 val = s->regs[reg];
diff --git a/hw/net/e1000_regs.h b/hw/net/e1000_regs.h
index 8a4ce82034..39f4882510 100644
--- a/hw/net/e1000_regs.h
+++ b/hw/net/e1000_regs.h
@@ -131,5 +131,5 @@
 #define E1000_GCR2  0x05B64 /* 3GIO Control Register 2 */
 #define E1000_FFLT_DBG  0x05F04 /* Debug Register */
-#define E1000_HICR  0x08F00 /* Host Inteface Control */
+#define E1000_HICR  0x08F00 /* Host Interface Control */
 
 #define E1000_RXMTRL 0x0B634 /* Time sync Rx EtherType and Msg Type - RW */
diff --git a/hw/net/e1000x_regs.h b/hw/net/e1000x_regs.h
index 13760c66d3..cd896fc0ca 100644
--- a/hw/net/e1000x_regs.h
+++ b/hw/net/e1000x_regs.h
@@ -840,5 +840,5 @@ union e1000_rx_desc_packet_split {
 #define E1000_RXD_STAT_IXSM 0x04/* Ignore checksum */
 #define E1000_RXD_STAT_VP   0x08/* IEEE VLAN Packet */
-#define E1000_RXD_STAT_UDPCS0x10/* UDP xsum caculated */
+#define E1000_RXD_STAT_UDPCS0x10/* UDP xsum calculated */
 #define E1000_RXD_STAT_TCPCS0x20/* TCP xsum calculated */
 #define E1000_RXD_STAT_IPCS 0x40/* IP xsum calculated */
diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c
index 788463f1b6..e6c3bf5361 100644
--- a/hw/net/fsl_etsec/rings.c
+++ b/hw/net/fsl_etsec/rings.c
@@ -366,5 +366,5 @@ void etsec_walk_tx_ring(eTSEC *etsec, int ring_nbr)
 
 /* Save the Buffer Descriptor Pointers to last bd that was not
- * succesfully closed */
+ * successfully closed */
 etsec->regs[TBPTR0 + ring_nbr].value = bd_addr;
 
diff --git a/hw/net/igb_regs.h b/hw/net/igb_regs.h
index 82ff195dfc..d6e0405d0a 100644
--- a/hw/net/igb_regs.h
+++ b/hw/net/igb_regs.h
@@ -365,5 +365,5 @@ union e1000_adv_rx_desc {
 #define E1000_VT_MSGTYPE_CTS 0x2000
 #define E1000_VT_MSGINFO_SHIFT 16
-/* bits 23:16 are used for exra info for certain messages */
+/* bits 23:16 are used for extra info for certain messages */
 #define E1000_VT_MSGINFO_MASK (0xFF << E1000_VT_MSGINFO_SHIFT)
 
@@ -491,5 +491,5 @@ union e1000_adv_rx_desc {
 
 #define E1000_VT_MSGINFO_SHIFT16
-/* bits 23:16 are used for exra info for certain messages */
+/* bits 23:16 are used for extra info for certain messages */
 #define E1000_VT_MSGINFO_MASK (0xFF << E1000

[PATCH 23/24] qga/: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 qga/channel-posix.c   | 2 +-
 qga/commands-posix-ssh.c  | 2 +-
 qga/commands-posix.c  | 2 +-
 qga/commands-win32.c  | 4 ++--
 qga/main.c| 2 +-
 qga/vss-win32/install.cpp | 4 ++--
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/qga/channel-posix.c b/qga/channel-posix.c
index 0c5175d957..465d688ecb 100644
--- a/qga/channel-posix.c
+++ b/qga/channel-posix.c
@@ -153,5 +153,5 @@ static gboolean ga_channel_open(GAChannel *c, const gchar 
*path,
 /*
  * In the default state channel sends echo of every command to a
- * client. The client programm doesn't expect this and raises an
+ * client. The client program doesn't expect this and raises an
  * error. Suppress echo by resetting ECHO terminal flag.
  */
diff --git a/qga/commands-posix-ssh.c b/qga/commands-posix-ssh.c
index f3a580b8cc..236f80de44 100644
--- a/qga/commands-posix-ssh.c
+++ b/qga/commands-posix-ssh.c
@@ -383,5 +383,5 @@ test_add_keys(void)
 g_assert(err == NULL);
 
-/*  key2 came first, and should'nt be duplicated */
+/*  key2 came first, and shouldn't be duplicated */
 test_authorized_keys_equal("algo key2 comments\n"
"algo key1 comments");
diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index def857d773..6169bbf7a0 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -3250,5 +3250,5 @@ GuestUserList *qmp_guest_get_users(Error **errp)
 #endif
 
-/* Replace escaped special characters with theire real values. The replacement
+/* Replace escaped special characters with their real values. The replacement
  * is done in place -- returned value is in the original string.
  */
diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index d23875264f..6beae659b7 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -488,5 +488,5 @@ static GuestDiskBusType win2qemu[] = {
 [BusTypeFileBackedVirtual] = GUEST_DISK_BUS_TYPE_FILE_BACKED_VIRTUAL,
 /*
- * BusTypeSpaces currently is not suported
+ * BusTypeSpaces currently is not supported
  */
 [BusTypeSpaces] = GUEST_DISK_BUS_TYPE_UNKNOWN,
@@ -2260,5 +2260,5 @@ static char *ga_get_win_product_name(Error **errp)
 }
 if (err != ERROR_SUCCESS) {
-error_setg_win32(errp, err, "failed to retrive ProductName");
+error_setg_win32(errp, err, "failed to retrieve ProductName");
 goto fail;
 }
diff --git a/qga/main.c b/qga/main.c
index 002161a0cc..8668b9f3d3 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -1334,5 +1334,5 @@ static bool check_is_frozen(GAState *s)
  * marked as frozen. this could be a stale value (a non-qemu-ga process
  * or reboot may have since unfrozen them), but better to require an
- * uneeded unfreeze than to risk hanging on start-up
+ * unneeded unfreeze than to risk hanging on start-up
  */
 struct stat st;
diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp
index ae38662a62..84944133f7 100644
--- a/qga/vss-win32/install.cpp
+++ b/qga/vss-win32/install.cpp
@@ -344,5 +344,5 @@ STDAPI COMRegister(void)
_bstr_t("")));
 
-/* Setup roles of the applicaion */
+/* Setup roles of the application */
 
 chk(getNameByStringSID(administratorsGroupSID, buffer, &bufferLen));
@@ -440,5 +440,5 @@ STDAPI DllRegisterServer(void)
 }
 
-/* Add this module to registery */
+/* Add this module to registry */
 
 sprintf(key, "CLSID\\%s", g_szClsid);
-- 
2.39.2

[PATCH 02/24] bsd-user: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 bsd-user/errno_defs.h| 2 +-
 bsd-user/freebsd/target_os_siginfo.h | 2 +-
 bsd-user/freebsd/target_os_stack.h   | 4 ++--
 bsd-user/freebsd/target_os_user.h| 2 +-
 bsd-user/qemu.h  | 2 +-
 bsd-user/signal-common.h | 4 ++--
 bsd-user/signal.c| 6 +++---
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/bsd-user/errno_defs.h b/bsd-user/errno_defs.h
index f3e8ac3488..abe70119d9 100644
--- a/bsd-user/errno_defs.h
+++ b/bsd-user/errno_defs.h
@@ -150,5 +150,5 @@
 
 /* Internal errors: */
-#define TARGET_EJUSTRETURN  254 /* Just return without 
modifing regs */
+#define TARGET_EJUSTRETURN  254 /* Just return without 
modifying regs */
 #define TARGET_ERESTART 255 /* Restart syscall */
 
diff --git a/bsd-user/freebsd/target_os_siginfo.h 
b/bsd-user/freebsd/target_os_siginfo.h
index 4573738752..6c282d8502 100644
--- a/bsd-user/freebsd/target_os_siginfo.h
+++ b/bsd-user/freebsd/target_os_siginfo.h
@@ -73,5 +73,5 @@ typedef struct target_siginfo {
 } _mesgp;
 
-/* SIGPOLL -- Not really genreated in FreeBSD ??? */
+/* SIGPOLL -- Not really generated in FreeBSD ??? */
 struct {
 int _band;  /* POLL_IN, POLL_OUT, POLL_MSG */
diff --git a/bsd-user/freebsd/target_os_stack.h 
b/bsd-user/freebsd/target_os_stack.h
index 0590133291..d15fc3263f 100644
--- a/bsd-user/freebsd/target_os_stack.h
+++ b/bsd-user/freebsd/target_os_stack.h
@@ -26,5 +26,5 @@
 
 /*
- * The inital FreeBSD stack is as follows:
+ * The initial FreeBSD stack is as follows:
  * (see kern/kern_exec.c exec_copyout_strings() )
  *
@@ -60,5 +60,5 @@ static inline int setup_initial_stack(struct bsd_binprm *bprm,
 p -= sizeof(struct target_ps_strings);
 
-/* Add machine depedent sigcode. */
+/* Add machine dependent sigcode. */
 p -= TARGET_SZSIGCODE;
 if (setup_sigtramp(p, (unsigned)offsetof(struct target_sigframe, sf_uc),
diff --git a/bsd-user/freebsd/target_os_user.h 
b/bsd-user/freebsd/target_os_user.h
index f036a32343..1ca7b5ab17 100644
--- a/bsd-user/freebsd/target_os_user.h
+++ b/bsd-user/freebsd/target_os_user.h
@@ -27,5 +27,5 @@ struct target_priority {
 uint8_t pri_class;  /* Scheduling class. */
 uint8_t pri_level;  /* Normal priority level. */
-uint8_t pri_native; /* Priority before propogation. */
+uint8_t pri_native; /* Priority before propagation. */
 uint8_t pri_user;   /* User priority based on p_cpu and p_nice. */
 };
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 8f2d6a3c78..470d0337d5 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -119,5 +119,5 @@ extern const char *qemu_uname_release;
  * TARGET_ARG_MAX defines the number of bytes allocated for arguments
  * and envelope for the new program. 256k should suffice for a reasonable
- * maxiumum env+arg in 32-bit environments, bump it up to 512k for !ILP32
+ * maximum env+arg in 32-bit environments, bump it up to 512k for !ILP32
  * platforms.
  */
diff --git a/bsd-user/signal-common.h b/bsd-user/signal-common.h
index 6f90345bb2..c044e81165 100644
--- a/bsd-user/signal-common.h
+++ b/bsd-user/signal-common.h
@@ -50,9 +50,9 @@ void target_to_host_sigset(sigset_t *d, const target_sigset_t 
*s);
  * host_to_target_siginfo_noswap() and tswap_siginfo(); it does not appear
  * either within host siginfo_t or in target_siginfo structures which we get
- * from the guest userspace program. Linux kenrels use this internally, but BSD
+ * from the guest userspace program. Linux kernels use this internally, but BSD
  * kernels don't do this, but its a useful abstraction.
  *
  * The linux-user version of this uses the top 16 bits, but FreeBSD's SI_USER
- * and other signal indepenent SI_ codes have bit 16 set, so we only use the 
top
+ * and other signal independent SI_ codes have bit 16 set, so we only use the 
top
  * byte instead.
  *
diff --git a/bsd-user/signal.c b/bsd-user/signal.c
index f4e078ee1d..6e77dd0b4d 100644
--- a/bsd-user/signal.c
+++ b/bsd-user/signal.c
@@ -45,5 +45,5 @@ static inline int sas_ss_flags(TaskState *ts, unsigned long 
sp)
 
 /*
- * The BSD ABIs use the same singal numbers across all the CPU architectures, 
so
+ * The BSD ABIs use the same signal numbers across all the CPU architectures, 
so
  * (unlike Linux) these functions are just the identity mapping. This might not
  * be true for XyzBSD running on AbcBSD, which doesn't currently work.
@@ -242,5 +242,5 @@ static inline void 
host_to_target_siginfo_noswap(target_siginfo_t *tinfo,
 /*
  * Unsure that this can actually be generated, and our support for
- * capsicum is somewhere between weak and non-existant, but if we get
+ * capsicum is somewhere between weak and non-existent, but if we get
  * one, then we know what to save.
  */
@@ -320,5 +320,5 @@ int block_signals(void)
  

[PATCH 24/24] misc/other: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 accel/tcg/tb-maint.c   | 2 +-
 backends/tpm/tpm_ioctl.h   | 2 +-
 chardev/char-socket.c  | 6 +++---
 chardev/char.c | 2 +-
 contrib/plugins/cache.c| 2 +-
 contrib/plugins/lockstep.c | 2 +-
 crypto/afalg.c | 2 +-
 crypto/block-luks.c| 6 +++---
 crypto/der.c   | 2 +-
 crypto/der.h   | 6 +++---
 linux-user/flatload.c  | 2 +-
 linux-user/syscall.c   | 4 ++--
 nbd/client-connection.c| 2 +-
 net/checksum.c | 4 ++--
 net/filter.c   | 4 ++--
 net/vhost-vdpa.c   | 8 
 semihosting/config.c   | 2 +-
 semihosting/syscalls.c | 4 ++--
 softmmu/icount.c   | 2 +-
 softmmu/ioport.c   | 2 +-
 20 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index c406b2f7b7..32ae8af61c 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1,4 +1,4 @@
 /*
- * Translation Block Maintaince
+ * Translation Block Maintenance
  *
  *  Copyright (c) 2003 Fabrice Bellard
diff --git a/backends/tpm/tpm_ioctl.h b/backends/tpm/tpm_ioctl.h
index b1d31768a6..1933ab6855 100644
--- a/backends/tpm/tpm_ioctl.h
+++ b/backends/tpm/tpm_ioctl.h
@@ -239,5 +239,5 @@ struct ptm_lockstorage {
 struct {
 ptm_res tpm_result;
-} resp; /* reponse */
+} resp; /* response */
 } u;
 };
diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index e8e3a743d5..73947da188 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -711,5 +711,5 @@ static void tcp_chr_telnet_init(Chardev *chr)
 if (!s->is_tn3270) {
 init->buflen = 12;
-/* Prep the telnet negotion to put telnet in binary,
+/* Prep the telnet negotiation to put telnet in binary,
  * no echo, single char mode */
 IACSET(init->buf, 0xff, 0xfb, 0x01);  /* IAC WILL ECHO */
@@ -719,5 +719,5 @@ static void tcp_chr_telnet_init(Chardev *chr)
 } else {
 init->buflen = 21;
-/* Prep the TN3270 negotion based on RFC1576 */
+/* Prep the TN3270 negotiation based on RFC1576 */
 IACSET(init->buf, 0xff, 0xfd, 0x19);  /* IAC DO EOR */
 IACSET(init->buf, 0xff, 0xfb, 0x19);  /* IAC WILL EOR */
@@ -1299,5 +1299,5 @@ static bool qmp_chardev_validate_socket(ChardevSocket 
*sock,
 }
 
-/* Validate any options which have a dependancy on client vs server */
+/* Validate any options which have a dependency on client vs server */
 if (!sock->has_server || sock->server) {
 if (sock->has_reconnect) {
diff --git a/chardev/char.c b/chardev/char.c
index 661ad8176a..996a024c7a 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -1116,5 +1116,5 @@ ChardevReturn *qmp_chardev_change(const char *id, 
ChardevBackend *backend,
 }
 
-/* change successfull, clean up */
+/* change successful, clean up */
 chr_new->handover_yank_instance = false;
 
diff --git a/contrib/plugins/cache.c b/contrib/plugins/cache.c
index 5036213f1b..dea4a56c8d 100644
--- a/contrib/plugins/cache.c
+++ b/contrib/plugins/cache.c
@@ -351,5 +351,5 @@ static int in_cache(Cache *cache, uint64_t addr)
  * @addr: The address of the requested memory location
  *
- * Returns true if the requsted data is hit in the cache and false when missed.
+ * Returns true if the requested data is hit in the cache and false when 
missed.
  * The cache is updated on miss for the next access.
  */
diff --git a/contrib/plugins/lockstep.c b/contrib/plugins/lockstep.c
index 3614c3564c..850f7b2941 100644
--- a/contrib/plugins/lockstep.c
+++ b/contrib/plugins/lockstep.c
@@ -109,5 +109,5 @@ static void report_divergance(ExecState *us, ExecState 
*them)
 /*
  * If we have diverged before did we get back on track or are we
- * totally loosing it?
+ * totally losing it?
  */
 if (divergence_log) {
diff --git a/crypto/afalg.c b/crypto/afalg.c
index 348301e703..52a491dbb5 100644
--- a/crypto/afalg.c
+++ b/crypto/afalg.c
@@ -74,5 +74,5 @@ qcrypto_afalg_comm_alloc(const char *type, const char *name,
 
 afalg = g_new0(QCryptoAFAlg, 1);
-/* initilize crypto API socket */
+/* initialize crypto API socket */
 afalg->opfd = -1;
 afalg->tfmfd = qcrypto_afalg_socket_bind(type, name, errp);
diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index 2f59c3a625..8430217d6e 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -245,5 +245,5 @@ qcrypto_block_luks_has_format(const uint8_t *buf,
  * When calculating ESSIV IVs, the cipher length used by ESSIV
  * may be different from the cipher length used for the block
- * encryption, becauses dm-crypt uses the hash digest length
+ * encryption, because dm-crypt uses the hash digest length
  * as the key size. ie, if you have AES 128 as the block cipher
  * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as
@@ -394,5 +394,5 @@ qcrypto_block_luks_from_disk_endian(QCryptoBlockLUKSHeader 
*hdr)
 
 /*

[PATCH 21/24] scripts/: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 scripts/checkpatch.pl | 2 +-
 scripts/ci/gitlab-pipeline-status | 2 +-
 scripts/codeconverter/codeconverter/qom_macros.py | 2 +-
 scripts/oss-fuzz/minimize_qtest_trace.py  | 8 
 scripts/performance/topN_callgrind.py | 2 +-
 scripts/performance/topN_perf.py  | 2 +-
 scripts/qapi/gen.py   | 2 +-
 scripts/replay-dump.py| 2 +-
 scripts/simplebench/bench_block_job.py| 2 +-
 9 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index eeaec436eb..1ad9ccb74b 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1622,5 +1622,5 @@ sub process {
qr/%[-+ 
*.0-9]*([hljztL]|ll|hh)?(x|X|"\s*PRI[xX][^"]*"?)/;
 
-   # don't consider groups splitted by [.:/ ], 
like 2A.20:12ab
+   # don't consider groups split by [.:/ ], like 
2A.20:12ab
my $tmpline = $rawline;
$tmpline =~ s/($hex[.:\/ ])+$hex//g;
diff --git a/scripts/ci/gitlab-pipeline-status 
b/scripts/ci/gitlab-pipeline-status
index 924db327ff..e3343b0510 100755
--- a/scripts/ci/gitlab-pipeline-status
+++ b/scripts/ci/gitlab-pipeline-status
@@ -29,5 +29,5 @@ class CommunicationFailure(Exception):
 
 class NoPipelineFound(Exception):
-"""Communication is successfull but pipeline is not found."""
+"""Communication is successful but pipeline is not found."""
 
 
diff --git a/scripts/codeconverter/codeconverter/qom_macros.py 
b/scripts/codeconverter/codeconverter/qom_macros.py
index 2d2f2055a3..2b0c8224a1 100644
--- a/scripts/codeconverter/codeconverter/qom_macros.py
+++ b/scripts/codeconverter/codeconverter/qom_macros.py
@@ -143,5 +143,5 @@ def make_structname(self) -> str:
 
 def strip_typedef(self) -> Patch:
-"""generate patch that will strip typedef from the struct declartion
+"""generate patch that will strip typedef from the struct declaration
 
 The caller is responsible for readding the typedef somewhere else.
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py 
b/scripts/oss-fuzz/minimize_qtest_trace.py
index 20825768c2..d1f3990c16 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -3,5 +3,5 @@
 
 """
-This takes a crashing qtest trace and tries to remove superflous operations
+This takes a crashing qtest trace and tries to remove superfluous operations
 """
 
@@ -39,5 +39,5 @@ def usage():
 
 -M1: enable a loop around the remove minimizer, which may help decrease some
- timing dependant instructions. Off by default.
+ timing dependent instructions. Off by default.
 -M2: try setting bits in operand of write/out to zero. Off by default.
 
@@ -178,5 +178,5 @@ def remove_lines(newtrace, outpath):
 # from length/2^n bytes to the left does not work, try to move the 
pivot
 # to the right side, then add one to n, until length/2^n == 0. The idea
-# is to prune unneccessary bytes from long writes, while accommodating
+# is to prune unnecessary bytes from long writes, while accommodating
 # arbitrary MemoryRegion access sizes and alignments.
 
@@ -293,5 +293,5 @@ def minimize_trace(inpath, outpath):
 while(old_len > len(newtrace)):
 old_len = len(newtrace)
-print("trace lenth = ", old_len)
+print("trace length = ", old_len)
 remove_lines(newtrace, outpath)
 if not M1 and not M2:
diff --git a/scripts/performance/topN_callgrind.py 
b/scripts/performance/topN_callgrind.py
index 67c59197af..f3f05fce55 100755
--- a/scripts/performance/topN_callgrind.py
+++ b/scripts/performance/topN_callgrind.py
@@ -5,5 +5,5 @@
 #  topN_callgrind.py [-h] [-n]   -- \
 #[] \
-#[]
+#[]
 #
 #  [-h] - Print the script arguments help message.
diff --git a/scripts/performance/topN_perf.py b/scripts/performance/topN_perf.py
index 07be195fc8..7b19e6a742 100755
--- a/scripts/performance/topN_perf.py
+++ b/scripts/performance/topN_perf.py
@@ -5,5 +5,5 @@
 #  topN_perf.py [-h] [-n]   -- \
 #[] \
-#[]
+#[]
 #
 #  [-h] - Print the script arguments help message.
diff --git a/scripts/qapi/gen.py b/scripts/qapi/gen.py
index 70bc576a10..bf5716b5f3 100644
--- a/scripts/qapi/gen.py
+++ b/scripts/qapi/gen.py
@@ -82,5 +82,5 @@ def write(self, output_dir: str) -> None:
 os.makedirs(odir, exist_ok=True)
 
-# use os.open for O_CREAT to create and read a non-existant file
+# use os.open for O_CREAT to create and read a non-existent file
 fd = os.open(pathname, os.O_RDWR | os.O_CREAT, 0o666)
 with os.fdopen(fd, 'r+', encoding='utf-8') as fp:
diff --git a/scripts/replay-dump.py b/scripts/replay-dump.py
index 3ba97a6

[PATCH 11/24] hexagon: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 target/hexagon/README   |  2 +-
 target/hexagon/fma_emu.c|  2 +-
 target/hexagon/idef-parser/README.rst   |  2 +-
 target/hexagon/idef-parser/idef-parser.h|  2 +-
 target/hexagon/idef-parser/parser-helpers.c |  6 +++---
 target/hexagon/imported/alu.idef|  8 
 target/hexagon/imported/macros.def  |  2 +-
 target/hexagon/imported/mmvec/ext.idef  | 10 +-
 tests/tcg/hexagon/fpstuff.c |  2 +-
 tests/tcg/hexagon/test_clobber.S|  2 +-
 10 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/target/hexagon/README b/target/hexagon/README
index 43811178e9..e757bcb64a 100644
--- a/target/hexagon/README
+++ b/target/hexagon/README
@@ -240,5 +240,5 @@ helper_funcs_generated.c.inc.  There are also several 
helpers used for debugging
 VLIW packet semantics differ from serial semantics in that all input operands
 are read, then the operations are performed, then all the results are written.
-For exmaple, this packet performs a swap of registers r0 and r1
+For example, this packet performs a swap of registers r0 and r1
 { r0 = r1; r1 = r0 }
 Note that the result is different if the instructions are executed serially.
diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index d3b45d494f..05a56d8c10 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -416,5 +416,5 @@ static SUFFIX accum_round_##SUFFIX(Accum a, float_status * 
fp_status) \
  * Theoretically, we only need to shift a maximum of one to the left if we 
\
  * shifted out lots of bits from B, or if we had no shift / 1 shift sticky 
\
- * shoudl be 0  \
+ * should be 0  \
  */ \
 while ((int128_getlo(a.mant) & (1ULL << MANTBITS)) == 0) { \
diff --git a/target/hexagon/idef-parser/README.rst 
b/target/hexagon/idef-parser/README.rst
index debeddfde5..d0aa34309b 100644
--- a/target/hexagon/idef-parser/README.rst
+++ b/target/hexagon/idef-parser/README.rst
@@ -441,5 +441,5 @@ interested part of the grammar.
 Run-time errors can be divided between lexing and parsing errors, lexing errors
 are hard to detect, since the ``var`` token will catch everything which is not
-catched by other tokens, but easy to fix, because most of the time a simple
+caught by other tokens, but easy to fix, because most of the time a simple
 regex editing will be enough.
 
diff --git a/target/hexagon/idef-parser/idef-parser.h 
b/target/hexagon/idef-parser/idef-parser.h
index d23e71f13b..3faa1deecd 100644
--- a/target/hexagon/idef-parser/idef-parser.h
+++ b/target/hexagon/idef-parser/idef-parser.h
@@ -74,5 +74,5 @@ typedef struct HexTmp {
 
 /**
- * Enum of the possible immediated, an immediate is a value which is known
+ * Enum of the possible immediate, an immediate is a value which is known
  * at tinycode generation time, e.g. an integer value, not a TCGv
  */
diff --git a/target/hexagon/idef-parser/parser-helpers.c 
b/target/hexagon/idef-parser/parser-helpers.c
index 7b5ebafec2..ec43343801 100644
--- a/target/hexagon/idef-parser/parser-helpers.c
+++ b/target/hexagon/idef-parser/parser-helpers.c
@@ -460,5 +460,5 @@ static bool try_find_variable(Context *c, YYLTYPE *locp,
 }
 
-/* Calls `try_find_variable` and asserts succcess. */
+/* Calls `try_find_variable` and asserts success. */
 static void find_variable(Context *c, YYLTYPE *locp,
   HexValue *dst,
@@ -550,5 +550,5 @@ HexValue gen_bin_cmp(Context *c,
 break;
 default:
-fprintf(stderr, "Error in evalutating immediateness!");
+fprintf(stderr, "Error in evaluating immediateness!");
 abort();
 }
@@ -1165,5 +1165,5 @@ void gen_rdeposit_op(Context *c,
 /*
  * Otherwise if the width is not known, we fallback on reimplementing
- * desposit in TCG.
+ * deposit in TCG.
  */
 HexValue begin_m = *begin;
diff --git a/target/hexagon/imported/alu.idef b/target/hexagon/imported/alu.idef
index 58477ae40a..12d2aac5d4 100644
--- a/target/hexagon/imported/alu.idef
+++ b/target/hexagon/imported/alu.idef
@@ -293,14 +293,14 @@ 
Q6INSN(A4_combineii,"Rdd32=combine(#s8,#U6)",ATTRIBS(),"Set two small immediates
 
 Q6INSN(A2_combine_hh,"Rd32=combine(Rt.H32,Rs.H32)",ATTRIBS(),
-"Combine two halfs into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(1,RsV);})
+"Combine two halves into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(1,RsV);})
 
 Q6INSN(A2_combine_hl,"Rd32=combine(Rt.H32,Rs.L32)",ATTRIBS(),
-"Combine two halfs into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(0,RsV);})
+"Combine two halves into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(0,RsV);})
 
 Q6INSN(A2_combine_lh,"Rd32=combine(Rt.L32,Rs.H32)",ATTRIBS(),
-"Combine two halfs into a register", {RdV = (fGETUHALF(0,RtV)<<16) | 
fGETUHALF(1,RsV);})
+"Combine two halves into a register", {RdV = (fGETUHALF(0,RtV)<<16) | 
fGETUHALF(1,RsV);})
 
 Q6INSN(A2_combine

[PATCH 17/24] xen: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/xen/xen_pvdev.c | 2 +-
 include/hw/xen/interface/arch-x86/xen-x86_64.h | 2 +-
 include/hw/xen/interface/arch-x86/xen.h| 2 +-
 include/hw/xen/interface/event_channel.h   | 2 +-
 include/hw/xen/interface/grant_table.h | 2 +-
 include/hw/xen/interface/hvm/hvm_op.h  | 2 +-
 include/hw/xen/interface/io/blkif.h| 6 +++---
 include/hw/xen/interface/io/fbif.h | 2 +-
 include/hw/xen/interface/io/kbdif.h| 2 +-
 include/hw/xen/interface/memory.h  | 2 +-
 include/hw/xen/interface/physdev.h | 4 ++--
 include/hw/xen/interface/xen.h | 4 ++--
 12 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/hw/xen/xen_pvdev.c b/hw/xen/xen_pvdev.c
index be1504b82c..c5ad71e8dc 100644
--- a/hw/xen/xen_pvdev.c
+++ b/hw/xen/xen_pvdev.c
@@ -90,5 +90,5 @@ char *xenstore_read_str(const char *base, const char *node)
 if (str != NULL) {
 /* move to qemu-allocated memory to make sure
- * callers can savely g_free() stuff. */
+ * callers can safely g_free() stuff. */
 ret = g_strdup(str);
 free(str);
diff --git a/include/hw/xen/interface/arch-x86/xen-x86_64.h 
b/include/hw/xen/interface/arch-x86/xen-x86_64.h
index 40aed14366..eae96f4f67 100644
--- a/include/hw/xen/interface/arch-x86/xen-x86_64.h
+++ b/include/hw/xen/interface/arch-x86/xen-x86_64.h
@@ -107,5 +107,5 @@
  *   RING2 -> RING3 kernel mode.
  *   RING3 -> RING3 user mode.
- * However RING0 indicates that the guest kernel should return to iteself
+ * However RING0 indicates that the guest kernel should return to itself
  * directly with
  *  orb   $3,1*8(%rsp)
diff --git a/include/hw/xen/interface/arch-x86/xen.h 
b/include/hw/xen/interface/arch-x86/xen.h
index 7acd94c8eb..efa67d1499 100644
--- a/include/hw/xen/interface/arch-x86/xen.h
+++ b/include/hw/xen/interface/arch-x86/xen.h
@@ -140,5 +140,5 @@ typedef unsigned long xen_ulong_t;
  * interrupt. On x86/64, since rings 1 and 2 are unavailable, we allocate
  * privilege levels as follows:
- *  Level == 0: Noone may enter
+ *  Level == 0: No one may enter
  *  Level == 1: Kernel may enter
  *  Level == 2: Kernel may enter
diff --git a/include/hw/xen/interface/event_channel.h 
b/include/hw/xen/interface/event_channel.h
index 73c9f38ce1..9073d3852f 100644
--- a/include/hw/xen/interface/event_channel.h
+++ b/include/hw/xen/interface/event_channel.h
@@ -320,5 +320,5 @@ typedef struct evtchn_set_priority evtchn_set_priority_t;
  * ` HYPERVISOR_event_channel_op_compat(struct evtchn_op *op)
  * `
- * Superceded by new event_channel_op() hypercall since 0x00030202.
+ * Superseded by new event_channel_op() hypercall since 0x00030202.
  */
 struct evtchn_op {
diff --git a/include/hw/xen/interface/grant_table.h 
b/include/hw/xen/interface/grant_table.h
index 7934d7b718..f8e4398ecd 100644
--- a/include/hw/xen/interface/grant_table.h
+++ b/include/hw/xen/interface/grant_table.h
@@ -625,5 +625,5 @@ DEFINE_XEN_GUEST_HANDLE(gnttab_cache_flush_t);
   * GNTMAP_contains_pte subflag:
   *  0 => This map request contains a host virtual address.
-  *  1 => This map request contains the machine addess of the PTE to update.
+  *  1 => This map request contains the machine address of the PTE to update.
   */
 #define _GNTMAP_contains_pte(4)
diff --git a/include/hw/xen/interface/hvm/hvm_op.h 
b/include/hw/xen/interface/hvm/hvm_op.h
index 870ec52060..188960da7e 100644
--- a/include/hw/xen/interface/hvm/hvm_op.h
+++ b/include/hw/xen/interface/hvm/hvm_op.h
@@ -355,5 +355,5 @@ struct xen_hvm_altp2m_op {
 /* Get the active vcpu p2m index */
 #define HVMOP_altp2m_get_p2m_idx  14
-/* Set the "Supress #VE" bit for a range of pages */
+/* Set the "Suppress #VE" bit for a range of pages */
 #define HVMOP_altp2m_set_suppress_ve_multi 15
 /* Set visibility for a given altp2m view */
diff --git a/include/hw/xen/interface/io/blkif.h 
b/include/hw/xen/interface/io/blkif.h
index 4cdba79aba..507d5170db 100644
--- a/include/hw/xen/interface/io/blkif.h
+++ b/include/hw/xen/interface/io/blkif.h
@@ -60,5 +60,5 @@
  * values are encoded in decimal.  Integer value ranges listed below are
  * expressed as fixed sized integer types capable of storing the conversion
- * of a properly formated node string, without loss of information.
+ * of a properly formatted node string, without loss of information.
  *
  * Any specified default value is in effect if the corresponding XenBus node
@@ -259,5 +259,5 @@
  *
  *  NOTE: Because of implementation bugs in some frontends this must be
- *set to 512, unless the frontend advertizes a non-zero value
+ *set to 512, unless the frontend advertises a non-zero value
  *in its "feature-large-sector-size" xenbus node. (See below).
  *
@@ -416,5 +416,5 @@
  * (9) Linux implementation doesn't have a limit on the maximum number of
  * grants that can be persistently mapped i

[PATCH 07/24] i386: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 host/include/i386/host/cpuinfo.h | 2 +-
 hw/i386/acpi-build.c | 4 ++--
 hw/i386/amd_iommu.c  | 4 ++--
 hw/i386/intel_iommu.c| 4 ++--
 hw/i386/kvm/xen_xenstore.c   | 2 +-
 hw/i386/kvm/xenstore_impl.c  | 2 +-
 hw/i386/pc.c | 4 ++--
 include/hw/i386/topology.h   | 2 +-
 target/i386/cpu.c| 4 ++--
 target/i386/cpu.h| 4 ++--
 target/i386/hax/hax-interface.h  | 4 ++--
 target/i386/hax/hax-windows.c| 2 +-
 target/i386/kvm/kvm.c| 4 ++--
 target/i386/kvm/xen-emu.c| 2 +-
 target/i386/machine.c| 4 ++--
 target/i386/tcg/translate.c  | 8 
 tests/tcg/i386/system/boot.S | 2 +-
 tests/tcg/i386/x86.csv   | 2 +-
 18 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/host/include/i386/host/cpuinfo.h b/host/include/i386/host/cpuinfo.h
index 073d0a426f..6e46939132 100644
--- a/host/include/i386/host/cpuinfo.h
+++ b/host/include/i386/host/cpuinfo.h
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for x86.
+ * Host specific cpu identification for x86.
  */
 
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index bb12b0ad43..1afcef5937 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -780,5 +780,5 @@ static Aml *initialize_route(Aml *route, const char 
*link_name,
  * Returns an array of 128 routes, one for each device,
  * based on device location.
- * The main goal is to equaly distribute the interrupts
+ * The main goal is to equally distribute the interrupts
  * over the 4 existing ACPI links (works only for i440fx).
  * The hash function is  (slot + pin) & 3 -> "LNK[D|A|B|C]".
@@ -2080,5 +2080,5 @@ build_srat(GArray *table_data, BIOSLinker *linker, 
MachineState *machine)
 
 /*
- * Insert DMAR scope for PCI bridges and endpoint devcie
+ * Insert DMAR scope for PCI bridges and endpoint device
  */
 static void
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 9c77304438..c98a3c6e11 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -260,5 +260,5 @@ static void amdvi_log_command_error(AMDVIState *s, hwaddr 
addr)
 PCI_STATUS_SIG_TARGET_ABORT);
 }
-/* log an illegal comand event
+/* log an illegal command event
  *   @addr : address of illegal command
  */
@@ -768,5 +768,5 @@ static void amdvi_mmio_write(void *opaque, hwaddr addr, 
uint64_t val,
 case AMDVI_MMIO_COMMAND_BASE:
 amdvi_mmio_reg_write(s, size, val, addr);
-/* FIXME - make sure System Software has finished writing incase
+/* FIXME - make sure System Software has finished writing in case
  * it writes in chucks less than 8 bytes in a robust way.As for
  * now, this hacks works for the linux driver
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 3ca71df369..6b3fe12428 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -53,5 +53,5 @@
 /*
  * PCI bus number (or SID) is not reliable since the device is usaully
- * initalized before guest can configure the PCI bridge
+ * initialized before guest can configure the PCI bridge
  * (SECONDARY_BUS_NUMBER).
  */
@@ -1695,5 +1695,5 @@ static bool vtd_switch_address_space(VTDAddressSpace *as)
  *
  * We enable per as memory region (iommu_ir_fault) for catching
- * the tranlsation for interrupt range through PASID + PT.
+ * the translation for interrupt range through PASID + PT.
  */
 if (pt && as->pasid != PCI_NO_PASID) {
diff --git a/hw/i386/kvm/xen_xenstore.c b/hw/i386/kvm/xen_xenstore.c
index 133d89e953..660d0b72f9 100644
--- a/hw/i386/kvm/xen_xenstore.c
+++ b/hw/i386/kvm/xen_xenstore.c
@@ -1157,5 +1157,5 @@ static unsigned int copy_to_ring(XenXenstoreState *s, 
uint8_t *ptr,
 /*
  * This matches the barrier in copy_to_ring() (or the guest's
- * equivalent) betweem writing the data to the ring and updating
+ * equivalent) between writing the data to the ring and updating
  * rsp_prod. It protects against the pathological case (which
  * again I think never happened except on Alpha) where our
diff --git a/hw/i386/kvm/xenstore_impl.c b/hw/i386/kvm/xenstore_impl.c
index d9732b567e..1d134a6866 100644
--- a/hw/i386/kvm/xenstore_impl.c
+++ b/hw/i386/kvm/xenstore_impl.c
@@ -1437,5 +1437,5 @@ static void save_node(gpointer key, gpointer value, 
gpointer opaque)
  * If we already wrote this node, refer to the previous copy.
  * There's no rename/move in XenStore, so all we need to find
- * it is the tx_id of the transation in which it exists. Which
+ * it is the tx_id of the transaction in which it exists. Which
  * may be the root tx.
  */
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 3109d5e0e0..405db3aef9 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -434,5 +434,5 @@ static uint64_t ioport80_read(void *opaque, hwaddr addr, 
unsigned size)
 }
 
-/* MSDOS compatibility mod

[PATCH 08/24] mips: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/mips/malta.c |  2 +-
 target/mips/cpu-defs.c.inc  |  2 +-
 target/mips/tcg/msa_helper.c| 12 ++--
 target/mips/tcg/mxu_translate.c |  6 +++---
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index f9618fa5f5..16e9c4773f 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -628,5 +628,5 @@ static void bl_setup_gt64120_jump_kernel(void **p, uint64_t 
run_addr,
 };
 
-/* Bus endianess is always reversed */
+/* Bus endianness is always reversed */
 #if TARGET_BIG_ENDIAN
 #define cpu_to_gt32(x) (x)
diff --git a/target/mips/cpu-defs.c.inc b/target/mips/cpu-defs.c.inc
index 03185d9aa0..c0c389c59a 100644
--- a/target/mips/cpu-defs.c.inc
+++ b/target/mips/cpu-defs.c.inc
@@ -1046,5 +1046,5 @@ static void mvp_init(CPUMIPSState *env)
 }
 
-/* MVPConf1 implemented, TLB sharable, no gating storage support,
+/* MVPConf1 implemented, TLB shareable, no gating storage support,
programmable cache partitioning implemented, number of allocatable
and shareable TLB entries, MVP has allocatable TCs, 2 VPEs
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index 29b31d70fe..6e93a19a93 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -803,7 +803,7 @@ void helper_msa_bset_d(CPUMIPSState *env, uint32_t wd, 
uint32_t ws, uint32_t wt)
  * | HADD_S.W  | Vector Signed Horizontal Add (word)  |
  * | HADD_S.D  | Vector Signed Horizontal Add (doubleword)|
- * | HADD_U.H  | Vector Unigned Horizontal Add (halfword) |
- * | HADD_U.W  | Vector Unigned Horizontal Add (word) |
- * | HADD_U.D  | Vector Unigned Horizontal Add (doubleword)   |
+ * | HADD_U.H  | Vector Unsigned Horizontal Add (halfword)|
+ * | HADD_U.W  | Vector Unsigned Horizontal Add (word)|
+ * | HADD_U.D  | Vector Unsigned Horizontal Add (doubleword)  |
  * +---+--+
  */
@@ -3452,7 +3452,7 @@ void helper_msa_mulv_d(CPUMIPSState *env,
  * | HSUB_S.W  | Vector Signed Horizontal Subtract (word) |
  * | HSUB_S.D  | Vector Signed Horizontal Subtract (doubleword)   |
- * | HSUB_U.H  | Vector Unigned Horizontal Subtract (halfword)|
- * | HSUB_U.W  | Vector Unigned Horizontal Subtract (word)|
- * | HSUB_U.D  | Vector Unigned Horizontal Subtract (doubleword)  |
+ * | HSUB_U.H  | Vector Unsigned Horizontal Subtract (halfword)   |
+ * | HSUB_U.W  | Vector Unsigned Horizontal Subtract (word)   |
+ * | HSUB_U.D  | Vector Unsigned Horizontal Subtract (doubleword) |
  * | SUBS_S.B  | Vector Signed Saturated Subtract (of Signed) (byte)  |
  * | SUBS_S.H  | Vector Signed Saturated Subtract (of Signed) (halfword)  |
diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index e662acd5df..cfcd8ac9bc 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -2978,5 +2978,5 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
  *to 16-bit and put results as packed 16-bit data
  *into XRa and XRd.
- *aptn2 manages action add or subract of pairs of data.
+ *aptn2 manages action add or subtract of pairs of data.
  *
  *  Q8ACCE XRa, XRb, XRc, XRd, aptn2
@@ -2985,5 +2985,5 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
  *to 16-bit and accumulate results as packed 16-bit data
  *into XRa and XRd.
- *aptn2 manages action add or subract of pairs of data.
+ *aptn2 manages action add or subtract of pairs of data.
  */
 static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
@@ -4057,5 +4057,5 @@ static void gen_mxu_s32sfl(DisasContext *ctx)
 /*
  *  Q8SAD XRa, XRd, XRb, XRc
- *Typical SAD opration for motion estimation.
+ *Typical SAD operation for motion estimation.
  */
 static void gen_mxu_q8sad(DisasContext *ctx)
-- 
2.39.2

[PATCH 04/24] util: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 util/cpuinfo-aarch64.c | 4 ++--
 util/cpuinfo-i386.c| 4 ++--
 util/cpuinfo-ppc.c | 2 +-
 util/main-loop.c   | 2 +-
 util/oslib-posix.c | 2 +-
 util/qdist.c   | 2 +-
 util/qemu-sockets.c| 2 +-
 util/rcu.c | 2 +-
 8 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/util/cpuinfo-aarch64.c b/util/cpuinfo-aarch64.c
index ababc39550..7d39f47e3b 100644
--- a/util/cpuinfo-aarch64.c
+++ b/util/cpuinfo-aarch64.c
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for AArch64.
+ * Host specific cpu identification for AArch64.
  */
 
@@ -34,5 +34,5 @@ static bool sysctl_for_bool(const char *name)
  * We might in the future ask for properties not present in older kernels,
  * but we're only asking about static properties, all of which should be
- * 'int'.  So we shouln't see ENOMEM (val too small), or any of the other
+ * 'int'.  So we shouldn't see ENOMEM (val too small), or any of the other
  * more exotic errors.
  */
diff --git a/util/cpuinfo-i386.c b/util/cpuinfo-i386.c
index 3a7b7e0ad1..b2ed65bb10 100644
--- a/util/cpuinfo-i386.c
+++ b/util/cpuinfo-i386.c
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for x86.
+ * Host specific cpu identification for x86.
  */
 
@@ -75,5 +75,5 @@ unsigned __attribute__((constructor)) cpuinfo_init(void)
  *
  * AMD has provided an even stronger guarantee that processors
- * with AVX provide 16-byte atomicity for all cachable,
+ * with AVX provide 16-byte atomicity for all cacheable,
  * naturally aligned single loads and stores, e.g. MOVDQU.
  *
diff --git a/util/cpuinfo-ppc.c b/util/cpuinfo-ppc.c
index 7212afa45d..1ea3db0ac8 100644
--- a/util/cpuinfo-ppc.c
+++ b/util/cpuinfo-ppc.c
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for ppc.
+ * Host specific cpu identification for ppc.
  */
 
diff --git a/util/main-loop.c b/util/main-loop.c
index 014c795916..797b640c41 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -48,5 +48,5 @@
 /*
  * Disable CFI checks.
- * We are going to call a signal hander directly. Such handler may or may not
+ * We are going to call a signal handler directly. Such handler may or may not
  * have been defined in our binary, so there's no guarantee that the pointer
  * used to set the handler is a cfi-valid pointer. Since the handlers are
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 760390b31e..4d583da7ce 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -672,5 +672,5 @@ void qemu_free_stack(void *stack, size_t sz)
 /*
  * Disable CFI checks.
- * We are going to call a signal hander directly. Such handler may or may not
+ * We are going to call a signal handler directly. Such handler may or may not
  * have been defined in our binary, so there's no guarantee that the pointer
  * used to set the handler is a cfi-valid pointer. Since the handlers are
diff --git a/util/qdist.c b/util/qdist.c
index 5f75e24c29..ef3566b03a 100644
--- a/util/qdist.c
+++ b/util/qdist.c
@@ -211,5 +211,5 @@ void qdist_bin__internal(struct qdist *to, const struct 
qdist *from, size_t n)
 /*
  * To avoid double-counting we capture [left, right) ranges, except for
- * the righmost bin, which captures a [left, right] range.
+ * the rightmost bin, which captures a [left, right] range.
  */
 while (j < from->n && (from->entries[j].x < right || i == n - 1)) {
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 892d33f5e6..83e84b1186 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -930,5 +930,5 @@ static int unix_listen_saddr(UnixSocketAddress *saddr,
 if (pathbuf != NULL) {
 /*
- * This dummy fd usage silences the mktemp() unsecure warning.
+ * This dummy fd usage silences the mktemp() insecure warning.
  * Using mkstemp() doesn't make things more secure here
  * though.  bind() complains about existing files, so we have
diff --git a/util/rcu.c b/util/rcu.c
index 30a7e22026..e587bcc483 100644
--- a/util/rcu.c
+++ b/util/rcu.c
@@ -356,5 +356,5 @@ void drain_call_rcu(void)
  * Note that since we have only one global queue of the RCU callbacks,
  * we also end up waiting for most of RCU callbacks that were registered
- * on the other threads, but this is a side effect that shoudn't be
+ * on the other threads, but this is a side effect that shouldn't be
  * assumed.
  */
-- 
2.39.2

[PATCH 05/24] tcg: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 tcg/aarch64/tcg-target.c.inc | 2 +-
 tcg/arm/tcg-target.c.inc | 4 ++--
 tcg/riscv/tcg-target.c.inc   | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 35ca80cd56..5471523f4c 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -3087,5 +3087,5 @@ static void tcg_target_qemu_prologue(TCGContext *s)
 /*
  * Note that XZR cannot be encoded in the address base register slot,
- * as that actaully encodes SP.  Depending on the guest, we may need
+ * as that actually encodes SP.  Depending on the guest, we may need
  * to zero-extend the guest address via the address index register slot,
  * therefore we need to load even a zero guest base into a register.
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 83e286088f..3a14f52c51 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1217,5 +1217,5 @@ static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg 
*args,
 case TCG_COND_GTU:
 case TCG_COND_GEU:
-/* We perform a conditional comparision.  If the high half is
+/* We perform a conditional comparison.  If the high half is
equal, then overwrite the flags with the comparison of the
low half.  The resulting flags cover the whole.  */
@@ -1251,5 +1251,5 @@ static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg 
*args,
 /*
  * Note that TCGReg references Q-registers.
- * Q-regno = 2 * D-regno, so shift left by 1 whlie inserting.
+ * Q-regno = 2 * D-regno, so shift left by 1 while inserting.
  */
 static uint32_t encode_vd(TCGReg rd)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index eeaeb6b6e3..e9e5968823 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -70,5 +70,5 @@ static const char * const 
tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
 static const int tcg_target_reg_alloc_order[] = {
 /* Call saved registers */
-/* TCG_REG_S0 reservered for TCG_AREG0 */
+/* TCG_REG_S0 reserved for TCG_AREG0 */
 TCG_REG_S1,
 TCG_REG_S2,
@@ -261,5 +261,5 @@ typedef enum {
 OPC_ADD_UW = 0x083b,
 
-/* Zbb: Bit manipulation extension, basic bit manipulaton */
+/* Zbb: Bit manipulation extension, basic bit manipulation */
 OPC_ANDN   = 0x40007033,
 OPC_CLZ= 0x60001013,
-- 
2.39.2

Re: [PATCH v2 00/24] tree-wide spelling fixes

[Michael Tokarev]

This is interesting.

So, I forgot to remove old, already sent patches from the work dir
(usually I remove whole thing but didn't do that now).  So I had
2 patch series in the same dir, one old already sent and applied,
and one new.  And did git send-email series/* - which obviously
included both.

But the fun part is the References: headers and hence threading.

I used git format-patch --cover-letter $since-commit.  Git created the
cover letter with Message-Id 20230823055155.1917375-1-...@tls.msk.ru.
And used this Id in References: header of the *first* patch.

But in all subsequent patches 2..24, it used *another* ID in the
References: header, the one taken from the *old* cover letter,
which it replaced when generating the new cover.

Obviously I did not edit the messages, did not specify anything
more fancy besides --cover-letter, - the only issue was that I
had another 4-file patch series in the same dir.

This smells like an.. interesting bug in git.. :)

/mjt

Re: [RFC PATCH] docs/style: permit inline loop variables

[Markus Armbruster]

Peter Maydell  writes:

> On Tue, 22 Aug 2023 at 16:50, Alex Bennée  wrote:
>> I've already wasted enough of my time debugging aliased variables in
>> deeply nested loops.
>
> In theory we could try to enable -Wshadow and deal with
> all the existing cases of aliasing, which would then
> allow us to turn it into an error and catch your bugs :-)

In practice, a quick compile with -Wshadow -Wno-error=shadow coughs up
almost 6000 warnings.  There are duplicates since we compile many files
multiple times, so I piped through sort -u | wc -l, and got about 1200.

> Anyway, I think declaration-in-for-loop is OK and we
> already have quite a lot of instances of it.

Acked-by: Markus Armbruster 

[PATCH 18/24] audio: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 audio/mixeng.h| 2 +-
 hw/audio/fmopl.c  | 8 
 hw/audio/fmopl.h  | 2 +-
 hw/audio/gusemu_hal.c | 4 ++--
 hw/audio/intel-hda-defs.h | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/audio/mixeng.h b/audio/mixeng.h
index f9de7cffeb..a5f56d2c26 100644
--- a/audio/mixeng.h
+++ b/audio/mixeng.h
@@ -39,5 +39,5 @@ typedef void (t_sample) (struct st_sample *dst, const void 
*src, int samples);
 typedef void (f_sample) (void *dst, const struct st_sample *src, int samples);
 
-/* indices: [stereo][signed][swap endiannes][8, 16 or 32-bits] */
+/* indices: [stereo][signed][swap endianness][8, 16 or 32-bits] */
 extern t_sample *mixeng_conv[2][2][2][3];
 extern f_sample *mixeng_clip[2][2][2][3];
diff --git a/hw/audio/fmopl.c b/hw/audio/fmopl.c
index 8a71a569fa..a63ad0f04d 100644
--- a/hw/audio/fmopl.c
+++ b/hw/audio/fmopl.c
@@ -356,5 +356,5 @@ static void set_algorithm( OPL_CH *CH)
 }
 
-/* -- frequency counter for operater update -- */
+/* -- frequency counter for operator update -- */
 static inline void CALC_FCSLOT(OPL_CH *CH,OPL_SLOT *SLOT)
 {
@@ -641,5 +641,5 @@ static int OPLOpenTable( void )
}
 
-   /* make sinwave table (total level offet) */
+   /* make sinwave table (total level offset) */
/* degree 0 = degree 180   = off */
SIN_TABLE[0] = SIN_TABLE[SIN_ENT/2] = &TL_TABLE[EG_ENT-1];
@@ -1076,5 +1076,5 @@ FM_OPL *OPLCreate(int clock, int rate)
FM_OPL *OPL;
int state_size;
-   int max_ch = 9; /* normaly 9 channels */
+   int max_ch = 9; /* normally 9 channels */
 
if( OPL_LockTable() ==-1) return NULL;
@@ -1093,5 +1093,5 @@ FM_OPL *OPLCreate(int clock, int rate)
OPL->rate  = rate;
OPL->max_ch = max_ch;
-   /* init grobal tables */
+   /* init global tables */
OPL_initialize(OPL);
/* reset chip */
diff --git a/hw/audio/fmopl.h b/hw/audio/fmopl.h
index e008e72d7a..89086b93f4 100644
--- a/hw/audio/fmopl.h
+++ b/hw/audio/fmopl.h
@@ -70,5 +70,5 @@ typedef struct fm_opl_f {
OPL_CH *P_CH;   /* pointer of CH */
int max_ch; /* maximum channel   */
-   /* Rhythm sention */
+   /* Rhythm section */
uint8_t rhythm; /* Rhythm mode , key flag */
/* time tables */
diff --git a/hw/audio/gusemu_hal.c b/hw/audio/gusemu_hal.c
index 5b9a14ee21..f159978b49 100644
--- a/hw/audio/gusemu_hal.c
+++ b/hw/audio/gusemu_hal.c
@@ -155,5 +155,5 @@ unsigned int gus_read(GUSEmuState * state, int port, int 
size)
 {
 int offset = 2 * (GUSregb(FunkSelReg3x3) & 0x0f);
-offset += ((int) GUSregb(VoiceSelReg3x2) & 0x1f) << 5; /* = 
Voice*32 + Funktion*2 */
+offset += ((int) GUSregb(VoiceSelReg3x2) & 0x1f) << 5; /* = 
Voice*32 + Function*2 */
 value_read = GUSregw(offset);
 }
@@ -354,5 +354,5 @@ void gus_write(GUSEmuState * state, int port, int size, 
unsigned int data)
 break;  /* reset flag active? */
 offset = 2 * (GUSregb(FunkSelReg3x3) & 0x0f);
-offset += (GUSregb(VoiceSelReg3x2) & 0x1f) << 5; /*  = 
Voice*32 + Funktion*2 */
+offset += (GUSregb(VoiceSelReg3x2) & 0x1f) << 5; /*  = 
Voice*32 + Function*2 */
 GUSregw(offset) = (uint16_t) ((GUSregw(offset) & readmask) 
| writedata);
 }
diff --git a/hw/audio/intel-hda-defs.h b/hw/audio/intel-hda-defs.h
index 2e37e5b874..261bdb48ff 100644
--- a/hw/audio/intel-hda-defs.h
+++ b/hw/audio/intel-hda-defs.h
@@ -419,5 +419,5 @@ enum {
 #define AC_UNSOL_RES_CP_READY  (1<<0)  /* content protection */
 
-/* Pin widget capabilies */
+/* Pin widget capabilities */
 #define AC_PINCAP_IMP_SENSE(1<<0)  /* impedance sense capable */
 #define AC_PINCAP_TRIG_REQ (1<<1)  /* trigger required */
@@ -484,5 +484,5 @@ enum {
 #define AC_PWRST_D30x03
 
-/* Processing capabilies */
+/* Processing capabilities */
 #define AC_PCAP_BENIGN (1<<0)
 #define AC_PCAP_NUM_COEF   (0xff<<8)
-- 
2.39.2

[PATCH 11/24] hexagon: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 target/hexagon/README   |  2 +-
 target/hexagon/fma_emu.c|  2 +-
 target/hexagon/idef-parser/README.rst   |  2 +-
 target/hexagon/idef-parser/idef-parser.h|  2 +-
 target/hexagon/idef-parser/parser-helpers.c |  6 +++---
 target/hexagon/imported/alu.idef|  8 
 target/hexagon/imported/macros.def  |  2 +-
 target/hexagon/imported/mmvec/ext.idef  | 10 +-
 tests/tcg/hexagon/fpstuff.c |  2 +-
 tests/tcg/hexagon/test_clobber.S|  2 +-
 10 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/target/hexagon/README b/target/hexagon/README
index 43811178e9..e757bcb64a 100644
--- a/target/hexagon/README
+++ b/target/hexagon/README
@@ -240,5 +240,5 @@ helper_funcs_generated.c.inc.  There are also several 
helpers used for debugging
 VLIW packet semantics differ from serial semantics in that all input operands
 are read, then the operations are performed, then all the results are written.
-For exmaple, this packet performs a swap of registers r0 and r1
+For example, this packet performs a swap of registers r0 and r1
 { r0 = r1; r1 = r0 }
 Note that the result is different if the instructions are executed serially.
diff --git a/target/hexagon/fma_emu.c b/target/hexagon/fma_emu.c
index d3b45d494f..05a56d8c10 100644
--- a/target/hexagon/fma_emu.c
+++ b/target/hexagon/fma_emu.c
@@ -416,5 +416,5 @@ static SUFFIX accum_round_##SUFFIX(Accum a, float_status * 
fp_status) \
  * Theoretically, we only need to shift a maximum of one to the left if we 
\
  * shifted out lots of bits from B, or if we had no shift / 1 shift sticky 
\
- * shoudl be 0  \
+ * should be 0  \
  */ \
 while ((int128_getlo(a.mant) & (1ULL << MANTBITS)) == 0) { \
diff --git a/target/hexagon/idef-parser/README.rst 
b/target/hexagon/idef-parser/README.rst
index debeddfde5..d0aa34309b 100644
--- a/target/hexagon/idef-parser/README.rst
+++ b/target/hexagon/idef-parser/README.rst
@@ -441,5 +441,5 @@ interested part of the grammar.
 Run-time errors can be divided between lexing and parsing errors, lexing errors
 are hard to detect, since the ``var`` token will catch everything which is not
-catched by other tokens, but easy to fix, because most of the time a simple
+caught by other tokens, but easy to fix, because most of the time a simple
 regex editing will be enough.
 
diff --git a/target/hexagon/idef-parser/idef-parser.h 
b/target/hexagon/idef-parser/idef-parser.h
index d23e71f13b..3faa1deecd 100644
--- a/target/hexagon/idef-parser/idef-parser.h
+++ b/target/hexagon/idef-parser/idef-parser.h
@@ -74,5 +74,5 @@ typedef struct HexTmp {
 
 /**
- * Enum of the possible immediated, an immediate is a value which is known
+ * Enum of the possible immediate, an immediate is a value which is known
  * at tinycode generation time, e.g. an integer value, not a TCGv
  */
diff --git a/target/hexagon/idef-parser/parser-helpers.c 
b/target/hexagon/idef-parser/parser-helpers.c
index 7b5ebafec2..ec43343801 100644
--- a/target/hexagon/idef-parser/parser-helpers.c
+++ b/target/hexagon/idef-parser/parser-helpers.c
@@ -460,5 +460,5 @@ static bool try_find_variable(Context *c, YYLTYPE *locp,
 }
 
-/* Calls `try_find_variable` and asserts succcess. */
+/* Calls `try_find_variable` and asserts success. */
 static void find_variable(Context *c, YYLTYPE *locp,
   HexValue *dst,
@@ -550,5 +550,5 @@ HexValue gen_bin_cmp(Context *c,
 break;
 default:
-fprintf(stderr, "Error in evalutating immediateness!");
+fprintf(stderr, "Error in evaluating immediateness!");
 abort();
 }
@@ -1165,5 +1165,5 @@ void gen_rdeposit_op(Context *c,
 /*
  * Otherwise if the width is not known, we fallback on reimplementing
- * desposit in TCG.
+ * deposit in TCG.
  */
 HexValue begin_m = *begin;
diff --git a/target/hexagon/imported/alu.idef b/target/hexagon/imported/alu.idef
index 58477ae40a..12d2aac5d4 100644
--- a/target/hexagon/imported/alu.idef
+++ b/target/hexagon/imported/alu.idef
@@ -293,14 +293,14 @@ 
Q6INSN(A4_combineii,"Rdd32=combine(#s8,#U6)",ATTRIBS(),"Set two small immediates
 
 Q6INSN(A2_combine_hh,"Rd32=combine(Rt.H32,Rs.H32)",ATTRIBS(),
-"Combine two halfs into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(1,RsV);})
+"Combine two halves into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(1,RsV);})
 
 Q6INSN(A2_combine_hl,"Rd32=combine(Rt.H32,Rs.L32)",ATTRIBS(),
-"Combine two halfs into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(0,RsV);})
+"Combine two halves into a register", {RdV = (fGETUHALF(1,RtV)<<16) | 
fGETUHALF(0,RsV);})
 
 Q6INSN(A2_combine_lh,"Rd32=combine(Rt.L32,Rs.H32)",ATTRIBS(),
-"Combine two halfs into a register", {RdV = (fGETUHALF(0,RtV)<<16) | 
fGETUHALF(1,RsV);})
+"Combine two halves into a register", {RdV = (fGETUHALF(0,RtV)<<16) | 
fGETUHALF(1,RsV);})
 
 Q6INSN(A2_combine

Re: [PATCH trivial for-8.1 0/3] trivial-patches for 2023-08-07

[Michael Tokarev]

07.08.2023 13:56, Michael Tokarev wrote:


   https://gitlab.com/mjt0k/qemu.git tags/trivial-patches-pull


This is what happens when one does development in ENOCOFFEE mode.. :)

Obviously these 3 patches together with the cover letter should not have been
sent to the mailing list, it's an old stuff already applied.

Please excuse me for the noize.

/mjt

[PATCH 07/24] i386: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 host/include/i386/host/cpuinfo.h | 2 +-
 hw/i386/acpi-build.c | 4 ++--
 hw/i386/amd_iommu.c  | 4 ++--
 hw/i386/intel_iommu.c| 4 ++--
 hw/i386/kvm/xen_xenstore.c   | 2 +-
 hw/i386/kvm/xenstore_impl.c  | 2 +-
 hw/i386/pc.c | 4 ++--
 include/hw/i386/topology.h   | 2 +-
 target/i386/cpu.c| 4 ++--
 target/i386/cpu.h| 4 ++--
 target/i386/hax/hax-interface.h  | 4 ++--
 target/i386/hax/hax-windows.c| 2 +-
 target/i386/kvm/kvm.c| 4 ++--
 target/i386/kvm/xen-emu.c| 2 +-
 target/i386/machine.c| 4 ++--
 target/i386/tcg/translate.c  | 8 
 tests/tcg/i386/system/boot.S | 2 +-
 tests/tcg/i386/x86.csv   | 2 +-
 18 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/host/include/i386/host/cpuinfo.h b/host/include/i386/host/cpuinfo.h
index 073d0a426f..6e46939132 100644
--- a/host/include/i386/host/cpuinfo.h
+++ b/host/include/i386/host/cpuinfo.h
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for x86.
+ * Host specific cpu identification for x86.
  */
 
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index bb12b0ad43..1afcef5937 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -780,5 +780,5 @@ static Aml *initialize_route(Aml *route, const char 
*link_name,
  * Returns an array of 128 routes, one for each device,
  * based on device location.
- * The main goal is to equaly distribute the interrupts
+ * The main goal is to equally distribute the interrupts
  * over the 4 existing ACPI links (works only for i440fx).
  * The hash function is  (slot + pin) & 3 -> "LNK[D|A|B|C]".
@@ -2080,5 +2080,5 @@ build_srat(GArray *table_data, BIOSLinker *linker, 
MachineState *machine)
 
 /*
- * Insert DMAR scope for PCI bridges and endpoint devcie
+ * Insert DMAR scope for PCI bridges and endpoint device
  */
 static void
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 9c77304438..c98a3c6e11 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -260,5 +260,5 @@ static void amdvi_log_command_error(AMDVIState *s, hwaddr 
addr)
 PCI_STATUS_SIG_TARGET_ABORT);
 }
-/* log an illegal comand event
+/* log an illegal command event
  *   @addr : address of illegal command
  */
@@ -768,5 +768,5 @@ static void amdvi_mmio_write(void *opaque, hwaddr addr, 
uint64_t val,
 case AMDVI_MMIO_COMMAND_BASE:
 amdvi_mmio_reg_write(s, size, val, addr);
-/* FIXME - make sure System Software has finished writing incase
+/* FIXME - make sure System Software has finished writing in case
  * it writes in chucks less than 8 bytes in a robust way.As for
  * now, this hacks works for the linux driver
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 3ca71df369..6b3fe12428 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -53,5 +53,5 @@
 /*
  * PCI bus number (or SID) is not reliable since the device is usaully
- * initalized before guest can configure the PCI bridge
+ * initialized before guest can configure the PCI bridge
  * (SECONDARY_BUS_NUMBER).
  */
@@ -1695,5 +1695,5 @@ static bool vtd_switch_address_space(VTDAddressSpace *as)
  *
  * We enable per as memory region (iommu_ir_fault) for catching
- * the tranlsation for interrupt range through PASID + PT.
+ * the translation for interrupt range through PASID + PT.
  */
 if (pt && as->pasid != PCI_NO_PASID) {
diff --git a/hw/i386/kvm/xen_xenstore.c b/hw/i386/kvm/xen_xenstore.c
index 133d89e953..660d0b72f9 100644
--- a/hw/i386/kvm/xen_xenstore.c
+++ b/hw/i386/kvm/xen_xenstore.c
@@ -1157,5 +1157,5 @@ static unsigned int copy_to_ring(XenXenstoreState *s, 
uint8_t *ptr,
 /*
  * This matches the barrier in copy_to_ring() (or the guest's
- * equivalent) betweem writing the data to the ring and updating
+ * equivalent) between writing the data to the ring and updating
  * rsp_prod. It protects against the pathological case (which
  * again I think never happened except on Alpha) where our
diff --git a/hw/i386/kvm/xenstore_impl.c b/hw/i386/kvm/xenstore_impl.c
index d9732b567e..1d134a6866 100644
--- a/hw/i386/kvm/xenstore_impl.c
+++ b/hw/i386/kvm/xenstore_impl.c
@@ -1437,5 +1437,5 @@ static void save_node(gpointer key, gpointer value, 
gpointer opaque)
  * If we already wrote this node, refer to the previous copy.
  * There's no rename/move in XenStore, so all we need to find
- * it is the tx_id of the transation in which it exists. Which
+ * it is the tx_id of the transaction in which it exists. Which
  * may be the root tx.
  */
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 3109d5e0e0..405db3aef9 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -434,5 +434,5 @@ static uint64_t ioport80_read(void *opaque, hwaddr addr, 
unsigned size)
 }
 
-/* MSDOS compatibility mod

[PATCH 22/24] tests/: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 tests/avocado/acpi-bits.py  |  4 ++--
 tests/avocado/acpi-bits/bits-tests/testacpi.py2 |  4 ++--
 tests/decode/err_pattern_group_ident2.decode|  2 +-
 tests/docker/common.rc  |  2 +-
 tests/migration/guestperf-batch.py  |  2 +-
 tests/migration/guestperf.py|  2 +-
 tests/plugin/mem.c  |  2 +-
 tests/qapi-schema/bad-if-not.json   |  2 +-
 tests/qemu-iotests/029  |  2 +-
 tests/qemu-iotests/040  |  8 
 tests/qemu-iotests/046  |  2 +-
 tests/qemu-iotests/059  |  2 +-
 tests/qemu-iotests/061  |  2 +-
 tests/qemu-iotests/071  |  2 +-
 tests/qemu-iotests/197  |  2 +-
 tests/qemu-iotests/215  |  2 +-
 tests/qemu-iotests/298  |  2 +-
 tests/qemu-iotests/pylintrc |  2 +-
 tests/qtest/ahci-test.c |  2 +-
 tests/qtest/bcm2835-dma-test.c  |  2 +-
 tests/qtest/bios-tables-test.c  |  2 +-
 tests/qtest/ds1338-test.c   |  2 +-
 tests/qtest/fuzz/generic_fuzz.c |  4 ++--
 tests/qtest/libqos/qgraph.c |  4 ++--
 tests/qtest/libqos/qgraph_internal.h|  2 +-
 tests/qtest/libqos/virtio-gpio.c|  2 +-
 tests/qtest/libqtest.c  |  4 ++--
 tests/qtest/migration-test.c|  6 +++---
 tests/qtest/npcm7xx_timer-test.c|  2 +-
 tests/qtest/tpm-emu.c   |  2 +-
 tests/qtest/tpm-tests.c |  2 +-
 tests/qtest/tpm-tests.h |  2 +-
 tests/qtest/tpm-tis-i2c-test.c  |  2 +-
 tests/qtest/tpm-tis-util.c  |  2 +-
 tests/qtest/vhost-user-blk-test.c   |  2 +-
 tests/qtest/virtio-net-test.c   |  2 +-
 tests/qtest/vmgenid-test.c  |  2 +-
 tests/tsan/suppressions.tsan|  2 +-
 tests/uefi-test-tools/Makefile  |  2 +-
 tests/unit/check-qjson.c|  2 +-
 tests/unit/test-aio.c   |  2 +-
 tests/unit/test-bdrv-graph-mod.c| 12 ++--
 tests/unit/test-crypto-secret.c |  2 +-
 tests/unit/test-qobject-input-visitor.c |  2 +-
 tests/unit/test-throttle.c  |  4 ++--
 tests/unit/test-util-filemonitor.c  |  2 +-
 tests/unit/test-xs-node.c   |  2 +-
 tests/vm/Makefile.include   |  2 +-
 tests/vm/ubuntuvm.py|  2 +-
 49 files changed, 65 insertions(+), 65 deletions(-)

diff --git a/tests/avocado/acpi-bits.py b/tests/avocado/acpi-bits.py
index 3ed286dcbd..bb3f818689 100644
--- a/tests/avocado/acpi-bits.py
+++ b/tests/avocado/acpi-bits.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
 # group: rw quick
-# Exercize QEMU generated ACPI/SMBIOS tables using biosbits,
+# Exercise QEMU generated ACPI/SMBIOS tables using biosbits,
 # https://biosbits.org/
 #
@@ -367,5 +367,5 @@ def tearDown(self):
 
 def test_acpi_smbios_bits(self):
-"""The main test case implementaion."""
+"""The main test case implementation."""
 
 iso_file = os.path.join(self._workDir,
diff --git a/tests/avocado/acpi-bits/bits-tests/testacpi.py2 
b/tests/avocado/acpi-bits/bits-tests/testacpi.py2
index f818a9cce6..7bf9075c1b 100644
--- a/tests/avocado/acpi-bits/bits-tests/testacpi.py2
+++ b/tests/avocado/acpi-bits/bits-tests/testacpi.py2
@@ -274,6 +274,6 @@ def test_rsdp():
 # Checksum the first 20 bytes per ACPI 1.0
 csum = sum(ord(c) for c in data[:20]) % 0x100
-testsuite.test('ACPI 1.0 table first 20 bytes cummulative checksum must 
equal 0', csum == 0)
-testsuite.print_detail("Cummulative checksum = {} (Expected 
0)".format(csum))
+testsuite.test('ACPI 1.0 table first 20 bytes cumulative checksum must 
equal 0', csum == 0)
+testsuite.print_detail("Cumulative checksum = {} (Expected 
0)".format(csum))
 
 test_table_checksum(data)
diff --git a/tests/decode/err_pattern_group_ident2.decode 
b/tests/decode/err_pattern_group_ident2.decode
index bc859233b1..0abb7513e9 100644
--- a/tests/decode/err_pattern_group_ident2.decode
+++ b/tests/decode/err_pattern_group_ident2.decode
@@ -8,4 +8,4 @@
   top     
   sub1     %sub1
-# comments are suposed to be indented
+# comments are supposed to be indented
 }
diff --git a/tests/docker/common.rc b/tests/docker/common.rc
index 9a33df2832..a611e6adf9 100755
--- a/tests/docker/common.rc
+++ b/tests/docker/common.rc
@@ -13,5 +13,5 @@
 
 # This might be set by ENV of a docker container... it is always

[PATCH 19/24] hw/other: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/acpi/aml-build.c  |  6 +++---
 hw/acpi/hmat.c   |  2 +-
 hw/acpi/nvdimm.c |  2 +-
 hw/block/hd-geometry.c   |  4 ++--
 hw/block/pflash_cfi01.c  |  2 +-
 hw/char/cadence_uart.c   |  2 +-
 hw/char/imx_serial.c |  2 +-
 hw/char/serial.c |  2 +-
 hw/core/generic-loader.c |  4 ++--
 hw/core/machine.c|  2 +-
 hw/core/qdev-properties-system.c |  2 +-
 hw/cpu/a15mpcore.c   |  2 +-
 hw/cxl/cxl-events.c  |  2 +-
 hw/cxl/cxl-mailbox-utils.c   |  4 ++--
 hw/dma/omap_dma.c|  4 ++--
 hw/input/hid.c   |  2 +-
 hw/input/tsc2005.c   | 16 
 hw/intc/loongarch_extioi.c   |  2 +-
 hw/intc/loongson_liointc.c   |  2 +-
 hw/intc/omap_intc.c  |  2 +-
 hw/intc/pnv_xive.c   |  2 +-
 hw/intc/spapr_xive.c |  2 +-
 hw/intc/spapr_xive_kvm.c |  6 +++---
 hw/intc/xive.c   |  2 +-
 hw/intc/xive2.c  |  6 +++---
 hw/ipmi/ipmi_bmc_extern.c|  2 +-
 hw/mem/cxl_type3.c   |  6 +++---
 hw/misc/imx7_ccm.c   |  2 +-
 hw/misc/mac_via.c|  2 +-
 hw/misc/stm32f2xx_syscfg.c   |  4 ++--
 hw/misc/trace-events |  2 +-
 hw/misc/zynq_slcr.c  |  2 +-
 hw/nvme/ctrl.c   |  6 +++---
 hw/nvram/eeprom_at24c.c  |  2 +-
 hw/nvram/fw_cfg.c|  2 +-
 hw/rtc/exynos4210_rtc.c  |  2 +-
 hw/rx/rx62n.c|  2 +-
 hw/scsi/lsi53c895a.c |  2 +-
 hw/scsi/mfi.h|  2 +-
 hw/sd/sd.c   |  2 +-
 hw/sd/sdhci.c|  2 +-
 hw/sensor/isl_pmbus_vr.c |  2 +-
 hw/sensor/max34451.c |  2 +-
 hw/sh4/sh7750_regs.h | 26 +-
 hw/smbios/smbios.c   |  2 +-
 hw/ssi/xilinx_spips.c|  6 +++---
 hw/ssi/xlnx-versal-ospi.c|  2 +-
 hw/timer/etraxfs_timer.c |  2 +-
 hw/timer/renesas_tmr.c   |  2 +-
 hw/virtio/virtio-crypto.c|  4 ++--
 hw/virtio/virtio-mem.c   |  2 +-
 hw/virtio/virtio.c   |  2 +-
 52 files changed, 89 insertions(+), 89 deletions(-)

diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index ea331a20d1..af66bde0f5 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -313,5 +313,5 @@ build_prepend_package_length(GArray *package, unsigned 
length, bool incl_self)
  * PkgLength is the length of the inclusive length of the data
  * and PkgLength's length itself when used for terms with
- * explitit length.
+ * explicit length.
  */
 length += length_bytes;
@@ -681,5 +681,5 @@ Aml *aml_store(Aml *val, Aml *target)
  * pattern.
  *
- * Returns: The newly allocated and composed according to patter Aml object.
+ * Returns: The newly allocated and composed according to pattern Aml object.
  */
 static Aml *
@@ -2160,5 +2160,5 @@ void build_fadt(GArray *tbl, BIOSLinker *linker, const 
AcpiFadtData *f,
 build_append_int_noprefix(tbl, f->minor_ver, 1);
 } else {
-build_append_int_noprefix(tbl, 0, 3); /* Reserved upto ACPI 5.0 */
+build_append_int_noprefix(tbl, 0, 3); /* Reserved up to ACPI 5.0 */
 }
 build_append_int_noprefix(tbl, 0, 8); /* X_FIRMWARE_CTRL */
diff --git a/hw/acpi/hmat.c b/hw/acpi/hmat.c
index 3a6d51282a..2d5e199ba9 100644
--- a/hw/acpi/hmat.c
+++ b/hw/acpi/hmat.c
@@ -83,5 +83,5 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info 
*hmat_lb,
 /* Length in bytes for entire structure */
 uint32_t lb_length
-= 32 /* Table length upto and including Entry Base Unit */
+= 32 /* Table length up to and including Entry Base Unit */
 + 4 * num_initiator /* Initiator Proximity Domain List */
 + 4 * num_target /* Target Proximity Domain List */
diff --git a/hw/acpi/nvdimm.c b/hw/acpi/nvdimm.c
index a3b25a92f3..fe03ce87e0 100644
--- a/hw/acpi/nvdimm.c
+++ b/hw/acpi/nvdimm.c
@@ -1098,5 +1098,5 @@ static void nvdimm_build_common_dsm(Aml *dev,
  * DSDT tables revision number. If revision number is < 2, integer
  * size is 32 bits, otherwise it is 64 bits.
- * Because of this CreateField() canot be used if RLEN < Integer Size.
+ * Because of this CreateField() cannot be used if RLEN < Integer Size.
  *
  * Also please note that APCI ASL operator SizeOf() doesn't support
diff --git a/hw/block/hd-geometry.c b/hw/block/hd-geometry.c
index dae13ab14d..2b0af4430f 100644
--- a/hw/block/hd-geometry.c
+++ b/hw/block/hd-geometry.c
@@ -51,5 +51,5 @@ struct partition {
 } QEMU_PACKED;
 
-/* try to guess the disk logical geometry from the MSDOS partition table.
+/* try to guess the disk logical geometry from the MS-DOS partition table.
Return 0 if OK, -1 if could not guess */
 static int g

[PATCH 14/24] hw/tpm: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/tpm/tpm_tis.h| 2 +-
 hw/tpm/tpm_tis_common.c | 2 +-
 hw/tpm/tpm_tis_i2c.c| 4 ++--
 hw/tpm/tpm_tis_isa.c| 2 +-
 hw/tpm/tpm_tis_sysbus.c | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/tpm/tpm_tis.h b/hw/tpm/tpm_tis.h
index 6f29a508dd..6f14896b97 100644
--- a/hw/tpm/tpm_tis.h
+++ b/hw/tpm/tpm_tis.h
@@ -20,5 +20,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 #ifndef TPM_TPM_TIS_H
diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c
index c07c179dbc..279ce436b5 100644
--- a/hw/tpm/tpm_tis_common.c
+++ b/hw/tpm/tpm_tis_common.c
@@ -21,5 +21,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 #include "qemu/osdep.h"
diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c
index b695fd3a46..4ecea7fa3e 100644
--- a/hw/tpm/tpm_tis_i2c.c
+++ b/hw/tpm/tpm_tis_i2c.c
@@ -14,5 +14,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  *
  */
@@ -508,5 +508,5 @@ static void tpm_tis_i2c_realizefn(DeviceState *dev, Error 
**errp)
 
 /*
- * Get the backend pointer. It is not initialized propery during
+ * Get the backend pointer. It is not initialized properly during
  * device_class_set_props
  */
diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c
index 91e3792248..0367401586 100644
--- a/hw/tpm/tpm_tis_isa.c
+++ b/hw/tpm/tpm_tis_isa.c
@@ -20,5 +20,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 6724b3d4f6..2fc550f119 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -20,5 +20,5 @@
  *
  * TPM TIS for TPM 2 implementation following TCG PC Client Platform
- * TPM Profile (PTP) Specification, Familiy 2.0, Revision 00.43
+ * TPM Profile (PTP) Specification, Family 2.0, Revision 00.43
  */
 
-- 
2.39.2

[PATCH 10/24] riscv: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/riscv/microchip_pfsoc.c|  2 +-
 hw/riscv/virt.c   |  4 ++--
 include/hw/riscv/riscv_hart.h |  2 +-
 target/riscv/cpu.h|  2 +-
 target/riscv/cpu_bits.h   |  4 ++--
 target/riscv/csr.c|  4 ++--
 target/riscv/debug.c  | 10 +-
 target/riscv/insn_trans/trans_rvf.c.inc   |  4 ++--
 target/riscv/insn_trans/trans_rvv.c.inc   |  4 ++--
 target/riscv/insn_trans/trans_rvzfh.c.inc |  4 ++--
 target/riscv/monitor.c|  2 +-
 11 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index e81bbd12df..b775aa8946 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -660,5 +660,5 @@ static void 
microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
 
 /*
- * Map 513 MiB high memory, the mimimum required high memory size, because
+ * Map 513 MiB high memory, the minimum required high memory size, because
  * HSS will do memory test against the high memory address range regardless
  * of physical memory installed.
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 99c4e6314b..a5ac3ab777 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -67,5 +67,5 @@
 #if VIRT_IMSIC_GROUP_MAX_SIZE < \
 IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
-#error "Can't accomodate single IMSIC group in address space"
+#error "Can't accommodate single IMSIC group in address space"
 #endif
 
@@ -73,5 +73,5 @@
 VIRT_IMSIC_GROUP_MAX_SIZE)
 #if 0x400 < VIRT_IMSIC_MAX_SIZE
-#error "Can't accomodate all IMSIC groups in address space"
+#error "Can't accommodate all IMSIC groups in address space"
 #endif
 
diff --git a/include/hw/riscv/riscv_hart.h b/include/hw/riscv/riscv_hart.h
index bbc21cdc9a..912b4a2682 100644
--- a/include/hw/riscv/riscv_hart.h
+++ b/include/hw/riscv/riscv_hart.h
@@ -4,5 +4,5 @@
  * Copyright (c) 2017 SiFive, Inc.
  *
- * Holds the state of a heterogenous array of RISC-V harts
+ * Holds the state of a heterogeneous array of RISC-V harts
  *
  * This program is free software; you can redistribute it and/or modify it
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 6ea22e0eea..6316cbcc23 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -350,5 +350,5 @@ struct CPUArchState {
 target_ulong upmbase;
 
-/* CSRs for execution enviornment configuration */
+/* CSRs for execution environment configuration */
 uint64_t menvcfg;
 uint64_t mstateen[SMSTATEEN_MAX_COUNT];
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 59f0ffd9e1..31a8d80990 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -657,5 +657,5 @@ typedef enum {
 #define PGSHIFT 12
 
-/* Default Reset Vector adress */
+/* Default Reset Vector address */
 #define DEFAULT_RSTVEC  0x1000
 
@@ -741,5 +741,5 @@ typedef enum RISCVException {
 #define PM_INSN 0x0004ULL
 
-/* Execution enviornment configuration bits */
+/* Execution environment configuration bits */
 #define MENVCFG_FIOM   BIT(0)
 #define MENVCFG_CBIE   (3UL << 4)
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index ea7585329e..26bc1f0ff1 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -3217,5 +3217,5 @@ static int write_hvipriox(CPURISCVState *env, int 
first_index,
 }
 
-/* Fill-up priority arrary */
+/* Fill-up priority array */
 for (i = 0; i < num_irqs; i++) {
 if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
@@ -3886,5 +3886,5 @@ static inline RISCVException 
riscv_csrrw_check(CPURISCVState *env,
 !env->virt_enabled) {
 /*
- * We are in HS mode. Add 1 to the effective privledge level to
+ * We are in HS mode. Add 1 to the effective privilege level to
  * allow us to access the Hypervisor CSRs.
  */
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index 75ee1c4971..211f5921b6 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -575,5 +575,5 @@ static void riscv_itrigger_update_count(CPURISCVState *env)
 /*
  * Record last icount, so that we can evaluate the executed instructions
- * since last priviledge mode change or timer expire.
+ * since last privilege mode change or timer expire.
  */
 int64_t last_icount = env->last_icount, current_icount;
@@ -589,5 +589,5 @@ static void riscv_itrigger_update_count(CPURISCVState *env)
 }
 /*
- * Only when priviledge is changed or itrigger timer expires,
+ * Only when privilege is changed or itrigger timer expires,
  * the count field in itrigger tdata1 register is updated.
  * And the count field in itrigger only contains remaining value.
@@ -595,6 +59

[PATCH 20/24] include/: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 include/block/block_int-common.h | 2 +-
 include/chardev/char-fe.h| 4 ++--
 include/crypto/akcipher.h| 2 +-
 include/crypto/ivgen.h   | 4 ++--
 include/elf.h| 4 ++--
 include/hw/acpi/aml-build.h  | 2 +-
 include/hw/acpi/pc-hotplug.h | 2 +-
 include/hw/acpi/vmgenid.h| 2 +-
 include/hw/boards.h  | 6 +++---
 include/hw/char/avr_usart.h  | 2 +-
 include/hw/clock.h   | 2 +-
 include/hw/core/tcg-cpu-ops.h| 2 +-
 include/hw/cxl/cxl_device.h  | 2 +-
 include/hw/hyperv/vmbus.h| 2 +-
 include/hw/i2c/npcm7xx_smbus.h   | 2 +-
 include/hw/misc/auxbus.h | 2 +-
 include/hw/misc/macio/pmu.h  | 2 +-
 include/hw/net/mii.h | 2 +-
 include/hw/pci-host/dino.h   | 2 +-
 include/hw/pci/pcie_aer.h| 2 +-
 include/hw/ssi/xilinx_spips.h| 2 +-
 include/hw/virtio/virtio-net.h   | 2 +-
 include/io/channel-socket.h  | 4 ++--
 include/io/task.h| 2 +-
 include/qemu/iova-tree.h | 4 ++--
 include/qemu/yank.h  | 2 +-
 include/sysemu/cryptodev-vhost.h | 2 +-
 include/sysemu/cryptodev.h   | 6 +++---
 include/sysemu/iothread.h| 2 +-
 include/sysemu/stats.h   | 2 +-
 include/sysemu/tpm_backend.h | 2 +-
 include/tcg/helper-info.h| 2 +-
 include/tcg/tcg.h| 4 ++--
 include/ui/kbd-state.h   | 2 +-
 include/ui/spice-display.h   | 2 +-
 include/user/safe-syscall.h  | 2 +-
 36 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 74195c3004..e09d277328 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -419,5 +419,5 @@ struct BlockDriver {
 /**
  * Called to inform the driver that the set of cumulative set of used
- * permissions for @bs has changed to @perm, and the set of sharable
+ * permissions for @bs has changed to @perm, and the set of shareable
  * permission to @shared. The driver can use this to propagate changes to
  * its children (i.e. request permissions only if a parent actually needs
diff --git a/include/chardev/char-fe.h b/include/chardev/char-fe.h
index 8c420fa36e..82a2a92602 100644
--- a/include/chardev/char-fe.h
+++ b/include/chardev/char-fe.h
@@ -79,5 +79,5 @@ bool qemu_chr_fe_backend_open(CharBackend *be);
  * @opaque: an opaque pointer for the callbacks
  * @context: a main loop context or NULL for the default
- * @set_open: whether to call qemu_chr_fe_set_open() implicitely when
+ * @set_open: whether to call qemu_chr_fe_set_open() implicitly when
  * any of the handler is non-NULL
  * @sync_state: whether to issue event callback with updated state
@@ -139,5 +139,5 @@ void qemu_chr_fe_disconnect(CharBackend *be);
  * qemu_chr_fe_wait_connected:
  *
- * Wait for characted backend to be connected, return < 0 on error or
+ * Wait for character backend to be connected, return < 0 on error or
  * if no associated Chardev.
  */
diff --git a/include/crypto/akcipher.h b/include/crypto/akcipher.h
index 214e58ca47..8756105f22 100644
--- a/include/crypto/akcipher.h
+++ b/include/crypto/akcipher.h
@@ -31,5 +31,5 @@ typedef struct QCryptoAkCipher QCryptoAkCipher;
  * @opts: the asymmetric key algorithm and related options
  *
- * Determine if asymmetric key cipher decribed with @opts is
+ * Determine if asymmetric key cipher described with @opts is
  * supported by the current configured build
  *
diff --git a/include/crypto/ivgen.h b/include/crypto/ivgen.h
index e41521519c..a09d5732da 100644
--- a/include/crypto/ivgen.h
+++ b/include/crypto/ivgen.h
@@ -33,5 +33,5 @@
  *
  * 
- *   Encrypting block data with initialiation vectors
+ *   Encrypting block data with initialization vectors
  *   
  * uint8_t *data = data to encrypt...
@@ -148,5 +148,5 @@ QCryptoIVGen *qcrypto_ivgen_new(QCryptoIVGenAlgorithm alg,
  * @errp: pointer to a NULL-initialized error object
  *
- * Calculate a new initialiation vector for the data
+ * Calculate a new initialization vector for the data
  * to be stored in sector @sector. The IV will be
  * written into the buffer @iv of size @niv.
diff --git a/include/elf.h b/include/elf.h
index ec9755e73b..e7259ec366 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -1126,7 +1126,7 @@ typedef struct {
 #define EFA_PARISC_2_0  0x0214 /* PA-RISC 2.0 big-endian.  */
 
-/* Additional section indeces.  */
+/* Additional section indices.  */
 
-#define SHN_PARISC_ANSI_COMMON  0xff00   /* Section for tenatively declared
+#define SHN_PARISC_ANSI_COMMON  0xff00   /* Section for tentatively declared
   symbols in ANSI C.  */
 #define SHN_PARISC_HUGE_COMMON  0xff01   /* Common blocks in huge model.  */
diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
index d1fb08514b..ff2a310270 100644
--- a/include/hw/acpi/aml-build.h
+++ b/include/hw/acp

[PATCH 09/24] ppc: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 host/include/ppc/host/cpuinfo.h |  2 +-
 hw/ppc/ppc.c|  2 +-
 hw/ppc/prep_systemio.c  |  2 +-
 hw/ppc/spapr.c  |  8 
 hw/ppc/spapr_hcall.c|  2 +-
 hw/ppc/spapr_nvdimm.c   |  4 ++--
 hw/ppc/spapr_pci_vfio.c |  2 +-
 include/hw/ppc/openpic.h|  2 +-
 include/hw/ppc/spapr.h  |  2 +-
 target/ppc/cpu-models.h |  4 ++--
 target/ppc/cpu.h|  2 +-
 target/ppc/cpu_init.c   |  4 ++--
 target/ppc/excp_helper.c| 14 +++---
 target/ppc/power8-pmu-regs.c.inc|  4 ++--
 target/ppc/translate/vmx-impl.c.inc |  6 +++---
 15 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/host/include/ppc/host/cpuinfo.h b/host/include/ppc/host/cpuinfo.h
index 29ee7f9ef8..38b8eabe2a 100644
--- a/host/include/ppc/host/cpuinfo.h
+++ b/host/include/ppc/host/cpuinfo.h
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for ppc.
+ * Host specific cpu identification for ppc.
  */
 
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 0e0a3d93c3..6c46204428 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -714,5 +714,5 @@ target_ulong cpu_ppc_load_decr(CPUPPCState *env)
 
 /*
- * If large decrementer is enabled then the decrementer is signed extened
+ * If large decrementer is enabled then the decrementer is signed extended
  * to 64 bits, otherwise it is a 32 bit value.
  */
diff --git a/hw/ppc/prep_systemio.c b/hw/ppc/prep_systemio.c
index 5a56f155f5..c96cefb13d 100644
--- a/hw/ppc/prep_systemio.c
+++ b/hw/ppc/prep_systemio.c
@@ -40,5 +40,5 @@
 OBJECT_DECLARE_SIMPLE_TYPE(PrepSystemIoState, PREP_SYSTEMIO)
 
-/* Bit as defined in PowerPC Reference Plaform v1.1, sect. 6.1.5, p. 132 */
+/* Bit as defined in PowerPC Reference Platform v1.1, sect. 6.1.5, p. 132 */
 #define PREP_BIT(n) (1 << (7 - (n)))
 
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 1c8b8d57a7..298b4cebf0 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2552,5 +2552,5 @@ static void spapr_set_vsmt_mode(SpaprMachineState *spapr, 
Error **errp)
 }
 
-/* Detemine the VSMT mode to use: */
+/* Determine the VSMT mode to use: */
 if (vsmt_user) {
 if (spapr->vsmt < smp_threads) {
@@ -3088,5 +3088,5 @@ static int spapr_kvm_type(MachineState *machine, const 
char *vm_type)
 /*
  * The use of g_ascii_strcasecmp() for 'hv' and 'pr' is to
- * accomodate the 'HV' and 'PV' formats that exists in the
+ * accommodate the 'HV' and 'PV' formats that exists in the
  * wild. The 'auto' mode is being introduced already as
  * lower-case, thus we don't need to bother checking for
@@ -4322,5 +4322,5 @@ spapr_cpu_index_to_props(MachineState *machine, unsigned 
cpu_index)
 MachineClass *mc = MACHINE_GET_CLASS(machine);
 
-/* make sure possible_cpu are intialized */
+/* make sure possible_cpu are initialized */
 mc->possible_cpu_arch_ids(machine);
 /* get CPU core slot containing thread that matches cpu_index */
@@ -5013,5 +5013,5 @@ static void spapr_machine_2_12_class_options(MachineClass 
*mc)
 /* We depend on kvm_enabled() to choose a default value for the
  * hpt-max-page-size capability. Of course we can't do it here
- * because this is too early and the HW accelerator isn't initialzed
+ * because this is too early and the HW accelerator isn't initialized
  * yet. Postpone this to machine init (see default_caps_with_cpu()).
  */
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 9b1f225d4a..d69867583d 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1559,5 +1559,5 @@ static void hypercall_register_types(void)
  h_get_cpu_characteristics);
 
-/* "debugger" hcalls (also used by SLOF). Note: We do -not- differenciate
+/* "debugger" hcalls (also used by SLOF). Note: We do -not- differentiate
  * here between the "CI" and the "CACHE" variants, they will use whatever
  * mapping attributes qemu is using. When using KVM, the kernel will
diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
index a8688243a6..4e34545dcf 100644
--- a/hw/ppc/spapr_nvdimm.c
+++ b/hw/ppc/spapr_nvdimm.c
@@ -378,5 +378,5 @@ static target_ulong h_scm_bind_mem(PowerPCCPU *cpu, 
SpaprMachineState *spapr,
 /*
  * Currently continue token should be zero qemu has already bound
- * everything and this hcall doesnt return H_BUSY.
+ * everything and this hcall doesn't return H_BUSY.
  */
 if (continue_token > 0) {
@@ -589,5 +589,5 @@ void spapr_nvdimm_finish_flushes(void)
  * the pending BHs has gotten out running in the reset path,
  * finally reaching here. Other code path being guest
- * h_client_architecture_support, thats early boot up.
+ * h_client_architecture_support, that's early boot up.
  */
 nvdimms = nvdi

[PATCH 24/24] misc/other: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 accel/tcg/tb-maint.c   | 2 +-
 backends/tpm/tpm_ioctl.h   | 2 +-
 chardev/char-socket.c  | 6 +++---
 chardev/char.c | 2 +-
 contrib/plugins/cache.c| 2 +-
 contrib/plugins/lockstep.c | 2 +-
 crypto/afalg.c | 2 +-
 crypto/block-luks.c| 6 +++---
 crypto/der.c   | 2 +-
 crypto/der.h   | 6 +++---
 linux-user/flatload.c  | 2 +-
 linux-user/syscall.c   | 4 ++--
 nbd/client-connection.c| 2 +-
 net/checksum.c | 4 ++--
 net/filter.c   | 4 ++--
 net/vhost-vdpa.c   | 8 
 semihosting/config.c   | 2 +-
 semihosting/syscalls.c | 4 ++--
 softmmu/icount.c   | 2 +-
 softmmu/ioport.c   | 2 +-
 20 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index c406b2f7b7..32ae8af61c 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1,4 +1,4 @@
 /*
- * Translation Block Maintaince
+ * Translation Block Maintenance
  *
  *  Copyright (c) 2003 Fabrice Bellard
diff --git a/backends/tpm/tpm_ioctl.h b/backends/tpm/tpm_ioctl.h
index b1d31768a6..1933ab6855 100644
--- a/backends/tpm/tpm_ioctl.h
+++ b/backends/tpm/tpm_ioctl.h
@@ -239,5 +239,5 @@ struct ptm_lockstorage {
 struct {
 ptm_res tpm_result;
-} resp; /* reponse */
+} resp; /* response */
 } u;
 };
diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index e8e3a743d5..73947da188 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -711,5 +711,5 @@ static void tcp_chr_telnet_init(Chardev *chr)
 if (!s->is_tn3270) {
 init->buflen = 12;
-/* Prep the telnet negotion to put telnet in binary,
+/* Prep the telnet negotiation to put telnet in binary,
  * no echo, single char mode */
 IACSET(init->buf, 0xff, 0xfb, 0x01);  /* IAC WILL ECHO */
@@ -719,5 +719,5 @@ static void tcp_chr_telnet_init(Chardev *chr)
 } else {
 init->buflen = 21;
-/* Prep the TN3270 negotion based on RFC1576 */
+/* Prep the TN3270 negotiation based on RFC1576 */
 IACSET(init->buf, 0xff, 0xfd, 0x19);  /* IAC DO EOR */
 IACSET(init->buf, 0xff, 0xfb, 0x19);  /* IAC WILL EOR */
@@ -1299,5 +1299,5 @@ static bool qmp_chardev_validate_socket(ChardevSocket 
*sock,
 }
 
-/* Validate any options which have a dependancy on client vs server */
+/* Validate any options which have a dependency on client vs server */
 if (!sock->has_server || sock->server) {
 if (sock->has_reconnect) {
diff --git a/chardev/char.c b/chardev/char.c
index 661ad8176a..996a024c7a 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -1116,5 +1116,5 @@ ChardevReturn *qmp_chardev_change(const char *id, 
ChardevBackend *backend,
 }
 
-/* change successfull, clean up */
+/* change successful, clean up */
 chr_new->handover_yank_instance = false;
 
diff --git a/contrib/plugins/cache.c b/contrib/plugins/cache.c
index 5036213f1b..dea4a56c8d 100644
--- a/contrib/plugins/cache.c
+++ b/contrib/plugins/cache.c
@@ -351,5 +351,5 @@ static int in_cache(Cache *cache, uint64_t addr)
  * @addr: The address of the requested memory location
  *
- * Returns true if the requsted data is hit in the cache and false when missed.
+ * Returns true if the requested data is hit in the cache and false when 
missed.
  * The cache is updated on miss for the next access.
  */
diff --git a/contrib/plugins/lockstep.c b/contrib/plugins/lockstep.c
index 3614c3564c..850f7b2941 100644
--- a/contrib/plugins/lockstep.c
+++ b/contrib/plugins/lockstep.c
@@ -109,5 +109,5 @@ static void report_divergance(ExecState *us, ExecState 
*them)
 /*
  * If we have diverged before did we get back on track or are we
- * totally loosing it?
+ * totally losing it?
  */
 if (divergence_log) {
diff --git a/crypto/afalg.c b/crypto/afalg.c
index 348301e703..52a491dbb5 100644
--- a/crypto/afalg.c
+++ b/crypto/afalg.c
@@ -74,5 +74,5 @@ qcrypto_afalg_comm_alloc(const char *type, const char *name,
 
 afalg = g_new0(QCryptoAFAlg, 1);
-/* initilize crypto API socket */
+/* initialize crypto API socket */
 afalg->opfd = -1;
 afalg->tfmfd = qcrypto_afalg_socket_bind(type, name, errp);
diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index 2f59c3a625..8430217d6e 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -245,5 +245,5 @@ qcrypto_block_luks_has_format(const uint8_t *buf,
  * When calculating ESSIV IVs, the cipher length used by ESSIV
  * may be different from the cipher length used for the block
- * encryption, becauses dm-crypt uses the hash digest length
+ * encryption, because dm-crypt uses the hash digest length
  * as the key size. ie, if you have AES 128 as the block cipher
  * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as
@@ -394,5 +394,5 @@ qcrypto_block_luks_from_disk_endian(QCryptoBlockLUKSHeader 
*hdr)
 
 /*

[PATCH 21/24] scripts/: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 scripts/checkpatch.pl | 2 +-
 scripts/ci/gitlab-pipeline-status | 2 +-
 scripts/codeconverter/codeconverter/qom_macros.py | 2 +-
 scripts/oss-fuzz/minimize_qtest_trace.py  | 8 
 scripts/performance/topN_callgrind.py | 2 +-
 scripts/performance/topN_perf.py  | 2 +-
 scripts/qapi/gen.py   | 2 +-
 scripts/replay-dump.py| 2 +-
 scripts/simplebench/bench_block_job.py| 2 +-
 9 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index eeaec436eb..1ad9ccb74b 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1622,5 +1622,5 @@ sub process {
qr/%[-+ 
*.0-9]*([hljztL]|ll|hh)?(x|X|"\s*PRI[xX][^"]*"?)/;
 
-   # don't consider groups splitted by [.:/ ], 
like 2A.20:12ab
+   # don't consider groups split by [.:/ ], like 
2A.20:12ab
my $tmpline = $rawline;
$tmpline =~ s/($hex[.:\/ ])+$hex//g;
diff --git a/scripts/ci/gitlab-pipeline-status 
b/scripts/ci/gitlab-pipeline-status
index 924db327ff..e3343b0510 100755
--- a/scripts/ci/gitlab-pipeline-status
+++ b/scripts/ci/gitlab-pipeline-status
@@ -29,5 +29,5 @@ class CommunicationFailure(Exception):
 
 class NoPipelineFound(Exception):
-"""Communication is successfull but pipeline is not found."""
+"""Communication is successful but pipeline is not found."""
 
 
diff --git a/scripts/codeconverter/codeconverter/qom_macros.py 
b/scripts/codeconverter/codeconverter/qom_macros.py
index 2d2f2055a3..2b0c8224a1 100644
--- a/scripts/codeconverter/codeconverter/qom_macros.py
+++ b/scripts/codeconverter/codeconverter/qom_macros.py
@@ -143,5 +143,5 @@ def make_structname(self) -> str:
 
 def strip_typedef(self) -> Patch:
-"""generate patch that will strip typedef from the struct declartion
+"""generate patch that will strip typedef from the struct declaration
 
 The caller is responsible for readding the typedef somewhere else.
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py 
b/scripts/oss-fuzz/minimize_qtest_trace.py
index 20825768c2..d1f3990c16 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -3,5 +3,5 @@
 
 """
-This takes a crashing qtest trace and tries to remove superflous operations
+This takes a crashing qtest trace and tries to remove superfluous operations
 """
 
@@ -39,5 +39,5 @@ def usage():
 
 -M1: enable a loop around the remove minimizer, which may help decrease some
- timing dependant instructions. Off by default.
+ timing dependent instructions. Off by default.
 -M2: try setting bits in operand of write/out to zero. Off by default.
 
@@ -178,5 +178,5 @@ def remove_lines(newtrace, outpath):
 # from length/2^n bytes to the left does not work, try to move the 
pivot
 # to the right side, then add one to n, until length/2^n == 0. The idea
-# is to prune unneccessary bytes from long writes, while accommodating
+# is to prune unnecessary bytes from long writes, while accommodating
 # arbitrary MemoryRegion access sizes and alignments.
 
@@ -293,5 +293,5 @@ def minimize_trace(inpath, outpath):
 while(old_len > len(newtrace)):
 old_len = len(newtrace)
-print("trace lenth = ", old_len)
+print("trace length = ", old_len)
 remove_lines(newtrace, outpath)
 if not M1 and not M2:
diff --git a/scripts/performance/topN_callgrind.py 
b/scripts/performance/topN_callgrind.py
index 67c59197af..f3f05fce55 100755
--- a/scripts/performance/topN_callgrind.py
+++ b/scripts/performance/topN_callgrind.py
@@ -5,5 +5,5 @@
 #  topN_callgrind.py [-h] [-n]   -- \
 #[] \
-#[]
+#[]
 #
 #  [-h] - Print the script arguments help message.
diff --git a/scripts/performance/topN_perf.py b/scripts/performance/topN_perf.py
index 07be195fc8..7b19e6a742 100755
--- a/scripts/performance/topN_perf.py
+++ b/scripts/performance/topN_perf.py
@@ -5,5 +5,5 @@
 #  topN_perf.py [-h] [-n]   -- \
 #[] \
-#[]
+#[]
 #
 #  [-h] - Print the script arguments help message.
diff --git a/scripts/qapi/gen.py b/scripts/qapi/gen.py
index 70bc576a10..bf5716b5f3 100644
--- a/scripts/qapi/gen.py
+++ b/scripts/qapi/gen.py
@@ -82,5 +82,5 @@ def write(self, output_dir: str) -> None:
 os.makedirs(odir, exist_ok=True)
 
-# use os.open for O_CREAT to create and read a non-existant file
+# use os.open for O_CREAT to create and read a non-existent file
 fd = os.open(pathname, os.O_RDWR | os.O_CREAT, 0o666)
 with os.fdopen(fd, 'r+', encoding='utf-8') as fp:
diff --git a/scripts/replay-dump.py b/scripts/replay-dump.py
index 3ba97a6

[PATCH 12/24] hw/net: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/net/cadence_gem.c  | 10 +-
 hw/net/dp8393x.c  |  2 +-
 hw/net/e1000_regs.h   |  2 +-
 hw/net/e1000x_regs.h  |  2 +-
 hw/net/fsl_etsec/rings.c  |  2 +-
 hw/net/igb_regs.h |  4 ++--
 hw/net/mcf_fec.c  |  2 +-
 hw/net/rocker/rocker_fp.c |  2 +-
 hw/net/rtl8139.c  |  2 +-
 hw/net/smc91c111.c|  2 +-
 hw/net/sungem.c   |  2 +-
 hw/net/sunhme.c   |  2 +-
 hw/net/virtio-net.c   |  6 +++---
 hw/net/vmxnet3.c  |  2 +-
 hw/net/vmxnet3.h  |  2 +-
 15 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 42ea2411a2..f445d8bb5e 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -82,6 +82,6 @@
 #define GEM_SVLAN (0x00C0 / 4) /* Stacked VLAN reg */
 #define GEM_MODID (0x00FC / 4) /* Module ID reg */
-#define GEM_OCTTXLO   (0x0100 / 4) /* Octects transmitted Low reg */
-#define GEM_OCTTXHI   (0x0104 / 4) /* Octects transmitted High reg */
+#define GEM_OCTTXLO   (0x0100 / 4) /* Octets transmitted Low reg */
+#define GEM_OCTTXHI   (0x0104 / 4) /* Octets transmitted High reg */
 #define GEM_TXCNT (0x0108 / 4) /* Error-free Frames transmitted */
 #define GEM_TXBCNT(0x010C / 4) /* Error-free Broadcast Frames */
@@ -102,6 +102,6 @@
 #define GEM_DEFERTXCNT(0x0148 / 4) /* Deferred Transmission Frames */
 #define GEM_CSENSECNT (0x014C / 4) /* Carrier Sense Error Counter */
-#define GEM_OCTRXLO   (0x0150 / 4) /* Octects Received register Low */
-#define GEM_OCTRXHI   (0x0154 / 4) /* Octects Received register High */
+#define GEM_OCTRXLO   (0x0150 / 4) /* Octets Received register Low */
+#define GEM_OCTRXHI   (0x0154 / 4) /* Octets Received register High */
 #define GEM_RXCNT (0x0158 / 4) /* Error-free Frames Received */
 #define GEM_RXBROADCNT(0x015C / 4) /* Error-free Broadcast Frames RX */
@@ -955,5 +955,5 @@ static ssize_t gem_receive(NetClientState *nc, const 
uint8_t *buf, size_t size)
 maf = gem_mac_address_filter(s, buf);
 if (maf == GEM_RX_REJECT) {
-return size;  /* no, drop siliently b/c it's not an error */
+return size;  /* no, drop silently b/c it's not an error */
 }
 
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index a596f7fbc6..c6f5fb7dce 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -552,5 +552,5 @@ static uint64_t dp8393x_read(void *opaque, hwaddr addr, 
unsigned int size)
 }
 break;
-/* All other registers have no special contraints */
+/* All other registers have no special constraints */
 default:
 val = s->regs[reg];
diff --git a/hw/net/e1000_regs.h b/hw/net/e1000_regs.h
index 8a4ce82034..39f4882510 100644
--- a/hw/net/e1000_regs.h
+++ b/hw/net/e1000_regs.h
@@ -131,5 +131,5 @@
 #define E1000_GCR2  0x05B64 /* 3GIO Control Register 2 */
 #define E1000_FFLT_DBG  0x05F04 /* Debug Register */
-#define E1000_HICR  0x08F00 /* Host Inteface Control */
+#define E1000_HICR  0x08F00 /* Host Interface Control */
 
 #define E1000_RXMTRL 0x0B634 /* Time sync Rx EtherType and Msg Type - RW */
diff --git a/hw/net/e1000x_regs.h b/hw/net/e1000x_regs.h
index 13760c66d3..cd896fc0ca 100644
--- a/hw/net/e1000x_regs.h
+++ b/hw/net/e1000x_regs.h
@@ -840,5 +840,5 @@ union e1000_rx_desc_packet_split {
 #define E1000_RXD_STAT_IXSM 0x04/* Ignore checksum */
 #define E1000_RXD_STAT_VP   0x08/* IEEE VLAN Packet */
-#define E1000_RXD_STAT_UDPCS0x10/* UDP xsum caculated */
+#define E1000_RXD_STAT_UDPCS0x10/* UDP xsum calculated */
 #define E1000_RXD_STAT_TCPCS0x20/* TCP xsum calculated */
 #define E1000_RXD_STAT_IPCS 0x40/* IP xsum calculated */
diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c
index 788463f1b6..e6c3bf5361 100644
--- a/hw/net/fsl_etsec/rings.c
+++ b/hw/net/fsl_etsec/rings.c
@@ -366,5 +366,5 @@ void etsec_walk_tx_ring(eTSEC *etsec, int ring_nbr)
 
 /* Save the Buffer Descriptor Pointers to last bd that was not
- * succesfully closed */
+ * successfully closed */
 etsec->regs[TBPTR0 + ring_nbr].value = bd_addr;
 
diff --git a/hw/net/igb_regs.h b/hw/net/igb_regs.h
index 82ff195dfc..d6e0405d0a 100644
--- a/hw/net/igb_regs.h
+++ b/hw/net/igb_regs.h
@@ -365,5 +365,5 @@ union e1000_adv_rx_desc {
 #define E1000_VT_MSGTYPE_CTS 0x2000
 #define E1000_VT_MSGINFO_SHIFT 16
-/* bits 23:16 are used for exra info for certain messages */
+/* bits 23:16 are used for extra info for certain messages */
 #define E1000_VT_MSGINFO_MASK (0xFF << E1000_VT_MSGINFO_SHIFT)
 
@@ -491,5 +491,5 @@ union e1000_adv_rx_desc {
 
 #define E1000_VT_MSGINFO_SHIFT16
-/* bits 23:16 are used for exra info for certain messages */
+/* bits 23:16 are used for extra info for certain messages */
 #define E1000_VT_MSGINFO_MASK (0xFF << E1000

[PATCH 23/24] qga/: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 qga/channel-posix.c   | 2 +-
 qga/commands-posix-ssh.c  | 2 +-
 qga/commands-posix.c  | 2 +-
 qga/commands-win32.c  | 4 ++--
 qga/main.c| 2 +-
 qga/vss-win32/install.cpp | 4 ++--
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/qga/channel-posix.c b/qga/channel-posix.c
index 0c5175d957..465d688ecb 100644
--- a/qga/channel-posix.c
+++ b/qga/channel-posix.c
@@ -153,5 +153,5 @@ static gboolean ga_channel_open(GAChannel *c, const gchar 
*path,
 /*
  * In the default state channel sends echo of every command to a
- * client. The client programm doesn't expect this and raises an
+ * client. The client program doesn't expect this and raises an
  * error. Suppress echo by resetting ECHO terminal flag.
  */
diff --git a/qga/commands-posix-ssh.c b/qga/commands-posix-ssh.c
index f3a580b8cc..236f80de44 100644
--- a/qga/commands-posix-ssh.c
+++ b/qga/commands-posix-ssh.c
@@ -383,5 +383,5 @@ test_add_keys(void)
 g_assert(err == NULL);
 
-/*  key2 came first, and should'nt be duplicated */
+/*  key2 came first, and shouldn't be duplicated */
 test_authorized_keys_equal("algo key2 comments\n"
"algo key1 comments");
diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index def857d773..6169bbf7a0 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -3250,5 +3250,5 @@ GuestUserList *qmp_guest_get_users(Error **errp)
 #endif
 
-/* Replace escaped special characters with theire real values. The replacement
+/* Replace escaped special characters with their real values. The replacement
  * is done in place -- returned value is in the original string.
  */
diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index d23875264f..6beae659b7 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -488,5 +488,5 @@ static GuestDiskBusType win2qemu[] = {
 [BusTypeFileBackedVirtual] = GUEST_DISK_BUS_TYPE_FILE_BACKED_VIRTUAL,
 /*
- * BusTypeSpaces currently is not suported
+ * BusTypeSpaces currently is not supported
  */
 [BusTypeSpaces] = GUEST_DISK_BUS_TYPE_UNKNOWN,
@@ -2260,5 +2260,5 @@ static char *ga_get_win_product_name(Error **errp)
 }
 if (err != ERROR_SUCCESS) {
-error_setg_win32(errp, err, "failed to retrive ProductName");
+error_setg_win32(errp, err, "failed to retrieve ProductName");
 goto fail;
 }
diff --git a/qga/main.c b/qga/main.c
index 002161a0cc..8668b9f3d3 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -1334,5 +1334,5 @@ static bool check_is_frozen(GAState *s)
  * marked as frozen. this could be a stale value (a non-qemu-ga process
  * or reboot may have since unfrozen them), but better to require an
- * uneeded unfreeze than to risk hanging on start-up
+ * unneeded unfreeze than to risk hanging on start-up
  */
 struct stat st;
diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp
index ae38662a62..84944133f7 100644
--- a/qga/vss-win32/install.cpp
+++ b/qga/vss-win32/install.cpp
@@ -344,5 +344,5 @@ STDAPI COMRegister(void)
_bstr_t("")));
 
-/* Setup roles of the applicaion */
+/* Setup roles of the application */
 
 chk(getNameByStringSID(administratorsGroupSID, buffer, &bufferLen));
@@ -440,5 +440,5 @@ STDAPI DllRegisterServer(void)
 }
 
-/* Add this module to registery */
+/* Add this module to registry */
 
 sprintf(key, "CLSID\\%s", g_szClsid);
-- 
2.39.2

[PATCH 13/24] hw/pci: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/pci-bridge/cxl_downstream.c  | 2 +-
 hw/pci-bridge/pci_expander_bridge.c | 2 +-
 hw/pci-host/bonito.c| 2 +-
 hw/pci-host/designware.c| 4 ++--
 hw/pci-host/dino.c  | 2 +-
 hw/pci-host/gpex-acpi.c | 2 +-
 hw/pci-host/gt64120.c   | 4 ++--
 hw/pci-host/pnv_phb.c   | 2 +-
 hw/pci-host/pnv_phb3.c  | 2 +-
 hw/pci-host/pnv_phb3_msi.c  | 2 +-
 hw/pci-host/pnv_phb4.c  | 6 +++---
 hw/pci/pcie_aer.c   | 2 +-
 hw/pci/shpc.c   | 2 +-
 13 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index 54f507318f..5a2b749c8e 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -43,5 +43,5 @@ static void latch_registers(CXLDownstreamPort *dsp)
 }
 
-/* TODO: Look at sharing this code acorss all CXL port types */
+/* TODO: Look at sharing this code across all CXL port types */
 static void cxl_dsp_dvsec_write_config(PCIDevice *dev, uint32_t addr,
   uint32_t val, int len)
diff --git a/hw/pci-bridge/pci_expander_bridge.c 
b/hw/pci-bridge/pci_expander_bridge.c
index 613857b601..535889f7c2 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -264,5 +264,5 @@ static int pxb_map_irq_fn(PCIDevice *pci_dev, int pin)
 /*
  * First carry out normal swizzle to handle
- * multple root ports on a pxb instance.
+ * multiple root ports on a pxb instance.
  */
 pin = pci_swizzle_map_irq_fn(pci_dev, pin);
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 4701481b9b..ee6cb85e97 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -63,5 +63,5 @@
 #endif
 
-/* from linux soure code. include/asm-mips/mips-boards/bonito64.h*/
+/* from linux source code. include/asm-mips/mips-boards/bonito64.h*/
 #define BONITO_BOOT_BASE0x1fc0
 #define BONITO_BOOT_SIZE0x0010
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index 388d252ee2..e325514372 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -489,5 +489,5 @@ static void designware_pcie_root_realize(PCIDevice *dev, 
Error **errp)
 /*
  * If no inbound iATU windows are configured, HW defaults to
- * letting inbound TLPs to pass in. We emulate that by exlicitly
+ * letting inbound TLPs to pass in. We emulate that by explicitly
  * configuring first inbound window to cover all of target's
  * address space.
@@ -504,5 +504,5 @@ static void designware_pcie_root_realize(PCIDevice *dev, 
Error **errp)
   root, "pcie-msi", 0x4);
 /*
- * We initially place MSI interrupt I/O region a adress 0 and
+ * We initially place MSI interrupt I/O region a address 0 and
  * disable it. It'll be later moved to correct offset and enabled
  * in designware_pcie_root_update_msi_mapping() as a part of
diff --git a/hw/pci-host/dino.c b/hw/pci-host/dino.c
index e8eaebca54..82503229fa 100644
--- a/hw/pci-host/dino.c
+++ b/hw/pci-host/dino.c
@@ -1,4 +1,4 @@
 /*
- * HP-PARISC Dino PCI chipset emulation, as in B160L and similiar machines
+ * HP-PARISC Dino PCI chipset emulation, as in B160L and similar machines
  *
  * (C) 2017-2019 by Helge Deller 
diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index 7c7316bc96..87ba074254 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -178,5 +178,5 @@ void acpi_dsdt_add_gpex(Aml *scope, struct GPEXConfig *cfg)
 
 /*
- * Resources defined for PXBs are composed by the folling parts:
+ * Resources defined for PXBs are composed by the following parts:
  * 1. The resources the pci-brige/pcie-root-port need.
  * 2. The resources the devices behind pxb need.
diff --git a/hw/pci-host/gt64120.c b/hw/pci-host/gt64120.c
index 82c15edb46..143bf053d7 100644
--- a/hw/pci-host/gt64120.c
+++ b/hw/pci-host/gt64120.c
@@ -332,7 +332,7 @@ static void gt64120_update_pci_cfgdata_mapping(GT64120State 
*s)
  * The setting of the MByteSwap bit and MWordSwap bit in the PCI Internal
  * Command Register determines how data transactions from the CPU to/from
- * PCI are handled along with the setting of the Endianess bit in the CPU
+ * PCI are handled along with the setting of the Endianness bit in the CPU
  * Configuration Register. See:
- * - Table 16: 32-bit PCI Transaction Endianess
+ * - Table 16: 32-bit PCI Transaction Endianness
  * - Table 158: PCI_0 Command, Offset: 0xc00
  */
diff --git a/hw/pci-host/pnv_phb.c b/hw/pci-host/pnv_phb.c
index 82332d7a05..157c00782c 100644
--- a/hw/pci-host/pnv_phb.c
+++ b/hw/pci-host/pnv_phb.c
@@ -26,5 +26,5 @@
  * Otherwise use object_typename[index] as QOM id.
  *
- * This helper does both operations at the same time 

[PATCH 15/24] hw/usb hw/ide hw/i2c: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/i2c/pm_smbus.c   | 2 +-
 hw/i2c/pmbus_device.c   | 2 +-
 hw/i2c/smbus_slave.c| 2 +-
 hw/ide/ahci_internal.h  | 4 ++--
 hw/ide/cmd646.c | 2 +-
 hw/ide/core.c   | 2 +-
 hw/usb/ccid-card-emulated.c | 2 +-
 hw/usb/hcd-ehci.c   | 6 +++---
 hw/usb/hcd-ohci.c   | 2 +-
 hw/usb/quirks.h | 2 +-
 hw/usb/redirect.c   | 2 +-
 hw/usb/trace-events | 2 +-
 hw/usb/xen-usb.c| 2 +-
 13 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/hw/i2c/pm_smbus.c b/hw/i2c/pm_smbus.c
index d7eae548cb..9ad6a47739 100644
--- a/hw/i2c/pm_smbus.c
+++ b/hw/i2c/pm_smbus.c
@@ -1,5 +1,5 @@
 /*
  * PC SMBus implementation
- * splitted from acpi.c
+ * split from acpi.c
  *
  * Copyright (c) 2006 Fabrice Bellard
diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index 44fe4eddbb..426f72ac60 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -1624,5 +1624,5 @@ static int pmbus_write_data(SMBusDevice *smd, uint8_t 
*buf, uint8_t len)
 
 passthrough:
-/* Unimplimented registers get passed to the device */
+/* Unimplemented registers get passed to the device */
 default:
 if (pmdc->write_data) {
diff --git a/hw/i2c/smbus_slave.c b/hw/i2c/smbus_slave.c
index feb3ec6333..2ef2c7c5f6 100644
--- a/hw/i2c/smbus_slave.c
+++ b/hw/i2c/smbus_slave.c
@@ -3,5 +3,5 @@
  *
  * This code is a helper for SMBus device emulation.  It implements an
- * I2C device inteface and runs the SMBus protocol from the device
+ * I2C device interface and runs the SMBus protocol from the device
  * point of view and maps those to simple calls to emulate.
  *
diff --git a/hw/ide/ahci_internal.h b/hw/ide/ahci_internal.h
index 2480455372..c244bbd8be 100644
--- a/hw/ide/ahci_internal.h
+++ b/hw/ide/ahci_internal.h
@@ -62,5 +62,5 @@ enum AHCIHostReg {
 AHCI_HOST_REG_IRQ_STAT   = 2,  /* IS: interrupt status */
 AHCI_HOST_REG_PORTS_IMPL = 3,  /* PI: bitmap of implemented ports */
-AHCI_HOST_REG_VERSION= 4,  /* VS: AHCI spec. version compliancy */
+AHCI_HOST_REG_VERSION= 4,  /* VS: AHCI spec. version compliance */
 AHCI_HOST_REG_CCC_CTL= 5,  /* CCC_CTL: CCC Control */
 AHCI_HOST_REG_CCC_PORTS  = 6,  /* CCC_PORTS: CCC Ports */
@@ -68,5 +68,5 @@ enum AHCIHostReg {
 AHCI_HOST_REG_EM_CTL = 8,  /* EM_CTL: Enclosure Mgmt Control */
 AHCI_HOST_REG_CAP2   = 9,  /* CAP2: host capabilities, extended */
-AHCI_HOST_REG_BOHC   = 10, /* BOHC: firmare/os handoff ctrl & status */
+AHCI_HOST_REG_BOHC   = 10, /* BOHC: firmware/os handoff ctrl & status 
*/
 AHCI_HOST_REG__COUNT = 11
 };
diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index cabe9048b1..c0bcfa4414 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -258,5 +258,5 @@ static void pci_cmd646_ide_realize(PCIDevice *dev, Error 
**errp)
 pci_conf[CNTRL] = CNTRL_EN_CH0; // enable IDE0
 if (d->secondary) {
-/* XXX: if not enabled, really disable the seconday IDE controller */
+/* XXX: if not enabled, really disable the secondary IDE controller */
 pci_conf[CNTRL] |= CNTRL_EN_CH1; /* enable IDE1 */
 }
diff --git a/hw/ide/core.c b/hw/ide/core.c
index de48ff9f86..ee116891ed 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1699,5 +1699,5 @@ static bool cmd_set_features(IDEState *s, uint8_t cmd)
 put_le16(identify_data + 88, 0x3f);
 break;
-case 0x02: /* sigle word dma mode*/
+case 0x02: /* single word dma mode */
 put_le16(identify_data + 62, 0x07 | (1 << (val + 8)));
 put_le16(identify_data + 63, 0x07);
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index c328660075..3ee9c73b87 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -519,5 +519,5 @@ static void emulated_realize(CCIDCardState *base, Error 
**errp)
 }
 
-/* TODO: a passthru backened that works on local machine. third card 
type?*/
+/* TODO: a passthru backend that works on local machine. third card type?*/
 if (card->backend == BACKEND_CERTIFICATES) {
 if (card->cert1 != NULL && card->cert2 != NULL && card->cert3 != NULL) 
{
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index c930c60921..19b4534c20 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1465,5 +1465,5 @@ static int ehci_process_itd(EHCIState *ehci,
 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
 } else {
-DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
+DPRINTF("ISOCH: attempt to address non-iso endpoint\n");
 ehci->ipacket.status = USB_RET_NAK;
 ehci->ipacket.actual_length = 0;
@@ -1514,5 +1514,5 @@ static int ehci_process_itd(EHCIState *ehci,
 
 /*  This state is the entry point for asynchronous schedule
- *  processing.  Entry

[PATCH 03/24] ui: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 ui/cocoa.m| 2 +-
 ui/keymaps.h  | 2 +-
 ui/sdl2-2d.c  | 2 +-
 ui/sdl2.c | 2 +-
 ui/vnc-enc-zrle.c.inc | 2 +-
 ui/vnc-enc-zywrle.h   | 4 ++--
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/ui/cocoa.m b/ui/cocoa.m
index 0c2153d17c..4d8989c4eb 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -2046,5 +2046,5 @@ static void cocoa_display_init(DisplayState *ds, 
DisplayOptions *opts)
 /*
  * Create the menu entries which depend on QEMU state (for consoles
- * and removeable devices). These make calls back into QEMU functions,
+ * and removable devices). These make calls back into QEMU functions,
  * which is OK because at this point we know that the second thread
  * holds the iothread lock and is synchronously waiting for us to
diff --git a/ui/keymaps.h b/ui/keymaps.h
index 6473405485..3d52c0882a 100644
--- a/ui/keymaps.h
+++ b/ui/keymaps.h
@@ -45,5 +45,5 @@ typedef struct {
 #define SCANCODE_UP 0x80
 
-/* Additional modifiers to use if not catched another way. */
+/* Additional modifiers to use if not caught another way. */
 #define SCANCODE_SHIFT  0x100
 #define SCANCODE_CTRL   0x200
diff --git a/ui/sdl2-2d.c b/ui/sdl2-2d.c
index bfebbdeaea..06468cd493 100644
--- a/ui/sdl2-2d.c
+++ b/ui/sdl2-2d.c
@@ -151,5 +151,5 @@ bool sdl2_2d_check_format(DisplayChangeListener *dcl,
 /*
  * We let SDL convert for us a few more formats than,
- * the native ones. Thes are the ones I have tested.
+ * the native ones. These are the ones I have tested.
  */
 return (format == PIXMAN_x8r8g8b8 ||
diff --git a/ui/sdl2.c b/ui/sdl2.c
index 0d91b555e3..ea4a92cd36 100644
--- a/ui/sdl2.c
+++ b/ui/sdl2.c
@@ -861,5 +861,5 @@ static void sdl2_display_init(DisplayState *ds, 
DisplayOptions *o)
 #endif
 #ifndef CONFIG_WIN32
-/* QEMU uses its own low level keyboard hook procecure on Windows */
+/* QEMU uses its own low level keyboard hook procedure on Windows */
 SDL_SetHint(SDL_HINT_GRAB_KEYBOARD, "1");
 #endif
diff --git a/ui/vnc-enc-zrle.c.inc b/ui/vnc-enc-zrle.c.inc
index c107d8affc..a8ca37d05e 100644
--- a/ui/vnc-enc-zrle.c.inc
+++ b/ui/vnc-enc-zrle.c.inc
@@ -111,5 +111,5 @@ static void ZRLE_ENCODE_TILE(VncState *vs, ZRLE_PIXEL 
*data, int w, int h,
 *end = ~*(end-1); /* one past the end is different so the while loop ends 
*/
 
-/* Real limit is 127 but we wan't a way to know if there is more than 127 
*/
+/* Real limit is 127 but we want a way to know if there is more than 127 */
 palette_init(palette, 256, ZRLE_BPP);
 
diff --git a/ui/vnc-enc-zywrle.h b/ui/vnc-enc-zywrle.h
index e661ec117d..64fbc90ee7 100644
--- a/ui/vnc-enc-zywrle.h
+++ b/ui/vnc-enc-zywrle.h
@@ -486,5 +486,5 @@ static inline void wavelet(int *buf, int width, int height, 
int level)
 /*
   RGB <=> YUV conversion stuffs.
-  YUV coversion is explained as following formula in strict meaning:
+  YUV conversion is explained as following formula in strict meaning:
   Y =  0.299R + 0.587G + 0.114B (   0<=Y<=255)
   U = -0.169R - 0.331G + 0.500B (-128<=U<=127)
@@ -540,5 +540,5 @@ static inline void wavelet(int *buf, int width, int height, 
int level)
 
  So, we must transfer each sub images individually in strict meaning.
- But at least ZRLE meaning, following one decompositon image is same as
+ But at least ZRLE meaning, following one decomposition image is same as
  avobe individual sub image. I use this format.
  (Strictly saying, transfer order is reverse(Hxy->Hy->Hx->L)
-- 
2.39.2

[PATCH 17/24] xen: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/xen/xen_pvdev.c | 2 +-
 include/hw/xen/interface/arch-x86/xen-x86_64.h | 2 +-
 include/hw/xen/interface/arch-x86/xen.h| 2 +-
 include/hw/xen/interface/event_channel.h   | 2 +-
 include/hw/xen/interface/grant_table.h | 2 +-
 include/hw/xen/interface/hvm/hvm_op.h  | 2 +-
 include/hw/xen/interface/io/blkif.h| 6 +++---
 include/hw/xen/interface/io/fbif.h | 2 +-
 include/hw/xen/interface/io/kbdif.h| 2 +-
 include/hw/xen/interface/memory.h  | 2 +-
 include/hw/xen/interface/physdev.h | 4 ++--
 include/hw/xen/interface/xen.h | 4 ++--
 12 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/hw/xen/xen_pvdev.c b/hw/xen/xen_pvdev.c
index be1504b82c..c5ad71e8dc 100644
--- a/hw/xen/xen_pvdev.c
+++ b/hw/xen/xen_pvdev.c
@@ -90,5 +90,5 @@ char *xenstore_read_str(const char *base, const char *node)
 if (str != NULL) {
 /* move to qemu-allocated memory to make sure
- * callers can savely g_free() stuff. */
+ * callers can safely g_free() stuff. */
 ret = g_strdup(str);
 free(str);
diff --git a/include/hw/xen/interface/arch-x86/xen-x86_64.h 
b/include/hw/xen/interface/arch-x86/xen-x86_64.h
index 40aed14366..eae96f4f67 100644
--- a/include/hw/xen/interface/arch-x86/xen-x86_64.h
+++ b/include/hw/xen/interface/arch-x86/xen-x86_64.h
@@ -107,5 +107,5 @@
  *   RING2 -> RING3 kernel mode.
  *   RING3 -> RING3 user mode.
- * However RING0 indicates that the guest kernel should return to iteself
+ * However RING0 indicates that the guest kernel should return to itself
  * directly with
  *  orb   $3,1*8(%rsp)
diff --git a/include/hw/xen/interface/arch-x86/xen.h 
b/include/hw/xen/interface/arch-x86/xen.h
index 7acd94c8eb..efa67d1499 100644
--- a/include/hw/xen/interface/arch-x86/xen.h
+++ b/include/hw/xen/interface/arch-x86/xen.h
@@ -140,5 +140,5 @@ typedef unsigned long xen_ulong_t;
  * interrupt. On x86/64, since rings 1 and 2 are unavailable, we allocate
  * privilege levels as follows:
- *  Level == 0: Noone may enter
+ *  Level == 0: No one may enter
  *  Level == 1: Kernel may enter
  *  Level == 2: Kernel may enter
diff --git a/include/hw/xen/interface/event_channel.h 
b/include/hw/xen/interface/event_channel.h
index 73c9f38ce1..9073d3852f 100644
--- a/include/hw/xen/interface/event_channel.h
+++ b/include/hw/xen/interface/event_channel.h
@@ -320,5 +320,5 @@ typedef struct evtchn_set_priority evtchn_set_priority_t;
  * ` HYPERVISOR_event_channel_op_compat(struct evtchn_op *op)
  * `
- * Superceded by new event_channel_op() hypercall since 0x00030202.
+ * Superseded by new event_channel_op() hypercall since 0x00030202.
  */
 struct evtchn_op {
diff --git a/include/hw/xen/interface/grant_table.h 
b/include/hw/xen/interface/grant_table.h
index 7934d7b718..f8e4398ecd 100644
--- a/include/hw/xen/interface/grant_table.h
+++ b/include/hw/xen/interface/grant_table.h
@@ -625,5 +625,5 @@ DEFINE_XEN_GUEST_HANDLE(gnttab_cache_flush_t);
   * GNTMAP_contains_pte subflag:
   *  0 => This map request contains a host virtual address.
-  *  1 => This map request contains the machine addess of the PTE to update.
+  *  1 => This map request contains the machine address of the PTE to update.
   */
 #define _GNTMAP_contains_pte(4)
diff --git a/include/hw/xen/interface/hvm/hvm_op.h 
b/include/hw/xen/interface/hvm/hvm_op.h
index 870ec52060..188960da7e 100644
--- a/include/hw/xen/interface/hvm/hvm_op.h
+++ b/include/hw/xen/interface/hvm/hvm_op.h
@@ -355,5 +355,5 @@ struct xen_hvm_altp2m_op {
 /* Get the active vcpu p2m index */
 #define HVMOP_altp2m_get_p2m_idx  14
-/* Set the "Supress #VE" bit for a range of pages */
+/* Set the "Suppress #VE" bit for a range of pages */
 #define HVMOP_altp2m_set_suppress_ve_multi 15
 /* Set visibility for a given altp2m view */
diff --git a/include/hw/xen/interface/io/blkif.h 
b/include/hw/xen/interface/io/blkif.h
index 4cdba79aba..507d5170db 100644
--- a/include/hw/xen/interface/io/blkif.h
+++ b/include/hw/xen/interface/io/blkif.h
@@ -60,5 +60,5 @@
  * values are encoded in decimal.  Integer value ranges listed below are
  * expressed as fixed sized integer types capable of storing the conversion
- * of a properly formated node string, without loss of information.
+ * of a properly formatted node string, without loss of information.
  *
  * Any specified default value is in effect if the corresponding XenBus node
@@ -259,5 +259,5 @@
  *
  *  NOTE: Because of implementation bugs in some frontends this must be
- *set to 512, unless the frontend advertizes a non-zero value
+ *set to 512, unless the frontend advertises a non-zero value
  *in its "feature-large-sector-size" xenbus node. (See below).
  *
@@ -416,5 +416,5 @@
  * (9) Linux implementation doesn't have a limit on the maximum number of
  * grants that can be persistently mapped i

[PATCH 01/24] block: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 block.c  | 2 +-
 block/block-copy.c   | 4 ++--
 block/export/vduse-blk.c | 2 +-
 block/export/vhost-user-blk-server.c | 2 +-
 block/export/vhost-user-blk-server.h | 2 +-
 block/file-posix.c   | 8 
 block/graph-lock.c   | 2 +-
 block/io.c   | 2 +-
 block/linux-aio.c| 2 +-
 block/mirror.c   | 2 +-
 block/qcow2-refcount.c   | 2 +-
 block/vhdx.c | 2 +-
 block/vhdx.h | 4 ++--
 13 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/block.c b/block.c
index a307c151a8..90d2dde828 100644
--- a/block.c
+++ b/block.c
@@ -7583,5 +7583,5 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, 
AioContext *ctx,
  * Recursion phase: go through all nodes of the graph.
  * Take care of checking that all nodes support changing AioContext
- * and drain them, builing a linear list of callbacks to run if everything
+ * and drain them, building a linear list of callbacks to run if everything
  * is successful (the transaction itself).
  */
diff --git a/block/block-copy.c b/block/block-copy.c
index e13d7bc6b6..1c60368d72 100644
--- a/block/block-copy.c
+++ b/block/block-copy.c
@@ -68,5 +68,5 @@ typedef struct BlockCopyCallState {
 
 /*
- * Fields that report information about return values and erros.
+ * Fields that report information about return values and errors.
  * Protected by lock in BlockCopyState.
  */
@@ -463,5 +463,5 @@ static coroutine_fn int block_copy_task_run(AioTaskPool 
*pool,
  * s->len only to cover last cluster when s->len is not aligned to clusters.
  *
- * No sync here: nor bitmap neighter intersecting requests handling, only copy.
+ * No sync here: neither bitmap nor intersecting requests handling, only copy.
  *
  * @method is an in-out argument, so that copy_range can be either extended to
diff --git a/block/export/vduse-blk.c b/block/export/vduse-blk.c
index 83b05548e7..172f73cef4 100644
--- a/block/export/vduse-blk.c
+++ b/block/export/vduse-blk.c
@@ -139,5 +139,5 @@ static void vduse_blk_enable_queue(VduseDev *dev, 
VduseVirtq *vq)
 aio_set_fd_handler(vblk_exp->export.ctx, vduse_queue_get_fd(vq),
on_vduse_vq_kick, NULL, NULL, NULL, vq);
-/* Make sure we don't miss any kick afer reconnecting */
+/* Make sure we don't miss any kick after reconnecting */
 eventfd_write(vduse_queue_get_fd(vq), 1);
 }
diff --git a/block/export/vhost-user-blk-server.c 
b/block/export/vhost-user-blk-server.c
index f7b5073605..fe2cee3a78 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -1,4 +1,4 @@
 /*
- * Sharing QEMU block devices via vhost-user protocal
+ * Sharing QEMU block devices via vhost-user protocol
  *
  * Parts of the code based on nbd/server.c.
diff --git a/block/export/vhost-user-blk-server.h 
b/block/export/vhost-user-blk-server.h
index fcf46fc8a5..77fb5c0131 100644
--- a/block/export/vhost-user-blk-server.h
+++ b/block/export/vhost-user-blk-server.h
@@ -1,4 +1,4 @@
 /*
- * Sharing QEMU block devices via vhost-user protocal
+ * Sharing QEMU block devices via vhost-user protocol
  *
  * Copyright (c) Coiby Xu .
diff --git a/block/file-posix.c b/block/file-posix.c
index b16e9c21a1..4757914ac0 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1160,7 +1160,7 @@ static int raw_reopen_prepare(BDRVReopenState *state,
  * raw_reconfigure_getfd(). But it wants updated "perm", when in
  * bdrv_reopen_multiple() .bdrv_reopen_prepare() callback called prior to
- * permission update. Happily, permission update is always a part (a 
seprate
- * stage) of bdrv_reopen_multiple() so we can rely on this fact and
- * reconfigure fd in raw_check_perm().
+ * permission update. Happily, permission update is always a part
+ * (a separate stage) of bdrv_reopen_multiple() so we can rely on this
+ * fact and reconfigure fd in raw_check_perm().
  */
 
@@ -3375,5 +3375,5 @@ static void raw_account_discard(BDRVRawState *s, uint64_t 
nbytes, int ret)
  * zones is an array of zone descriptors to hold zone information on reply;
  * offset can be any byte within the entire size of the device;
- * nr_zones is the maxium number of sectors the command should operate on.
+ * nr_zones is the maximum number of sectors the command should operate on.
  */
 #if defined(CONFIG_BLKZONED)
diff --git a/block/graph-lock.c b/block/graph-lock.c
index 5e66f01ae8..f357a2c0b1 100644
--- a/block/graph-lock.c
+++ b/block/graph-lock.c
@@ -96,5 +96,5 @@ static uint32_t reader_count(void)
 QEMU_LOCK_GUARD(&aio_context_list_lock);
 
-/* rd can temporarly be negative, but the total will *always* be >= 0 */
+/* rd can temporarily be negative, but the total will *always* be >= 0 */
 rd = orphaned_reader_count;
 Q

[PATCH 08/24] mips: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/mips/malta.c |  2 +-
 target/mips/cpu-defs.c.inc  |  2 +-
 target/mips/tcg/msa_helper.c| 12 ++--
 target/mips/tcg/mxu_translate.c |  6 +++---
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index f9618fa5f5..16e9c4773f 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -628,5 +628,5 @@ static void bl_setup_gt64120_jump_kernel(void **p, uint64_t 
run_addr,
 };
 
-/* Bus endianess is always reversed */
+/* Bus endianness is always reversed */
 #if TARGET_BIG_ENDIAN
 #define cpu_to_gt32(x) (x)
diff --git a/target/mips/cpu-defs.c.inc b/target/mips/cpu-defs.c.inc
index 03185d9aa0..c0c389c59a 100644
--- a/target/mips/cpu-defs.c.inc
+++ b/target/mips/cpu-defs.c.inc
@@ -1046,5 +1046,5 @@ static void mvp_init(CPUMIPSState *env)
 }
 
-/* MVPConf1 implemented, TLB sharable, no gating storage support,
+/* MVPConf1 implemented, TLB shareable, no gating storage support,
programmable cache partitioning implemented, number of allocatable
and shareable TLB entries, MVP has allocatable TCs, 2 VPEs
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index 29b31d70fe..6e93a19a93 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -803,7 +803,7 @@ void helper_msa_bset_d(CPUMIPSState *env, uint32_t wd, 
uint32_t ws, uint32_t wt)
  * | HADD_S.W  | Vector Signed Horizontal Add (word)  |
  * | HADD_S.D  | Vector Signed Horizontal Add (doubleword)|
- * | HADD_U.H  | Vector Unigned Horizontal Add (halfword) |
- * | HADD_U.W  | Vector Unigned Horizontal Add (word) |
- * | HADD_U.D  | Vector Unigned Horizontal Add (doubleword)   |
+ * | HADD_U.H  | Vector Unsigned Horizontal Add (halfword)|
+ * | HADD_U.W  | Vector Unsigned Horizontal Add (word)|
+ * | HADD_U.D  | Vector Unsigned Horizontal Add (doubleword)  |
  * +---+--+
  */
@@ -3452,7 +3452,7 @@ void helper_msa_mulv_d(CPUMIPSState *env,
  * | HSUB_S.W  | Vector Signed Horizontal Subtract (word) |
  * | HSUB_S.D  | Vector Signed Horizontal Subtract (doubleword)   |
- * | HSUB_U.H  | Vector Unigned Horizontal Subtract (halfword)|
- * | HSUB_U.W  | Vector Unigned Horizontal Subtract (word)|
- * | HSUB_U.D  | Vector Unigned Horizontal Subtract (doubleword)  |
+ * | HSUB_U.H  | Vector Unsigned Horizontal Subtract (halfword)   |
+ * | HSUB_U.W  | Vector Unsigned Horizontal Subtract (word)   |
+ * | HSUB_U.D  | Vector Unsigned Horizontal Subtract (doubleword) |
  * | SUBS_S.B  | Vector Signed Saturated Subtract (of Signed) (byte)  |
  * | SUBS_S.H  | Vector Signed Saturated Subtract (of Signed) (halfword)  |
diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index e662acd5df..cfcd8ac9bc 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -2978,5 +2978,5 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
  *to 16-bit and put results as packed 16-bit data
  *into XRa and XRd.
- *aptn2 manages action add or subract of pairs of data.
+ *aptn2 manages action add or subtract of pairs of data.
  *
  *  Q8ACCE XRa, XRb, XRc, XRd, aptn2
@@ -2985,5 +2985,5 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
  *to 16-bit and accumulate results as packed 16-bit data
  *into XRa and XRd.
- *aptn2 manages action add or subract of pairs of data.
+ *aptn2 manages action add or subtract of pairs of data.
  */
 static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
@@ -4057,5 +4057,5 @@ static void gen_mxu_s32sfl(DisasContext *ctx)
 /*
  *  Q8SAD XRa, XRd, XRb, XRc
- *Typical SAD opration for motion estimation.
+ *Typical SAD operation for motion estimation.
  */
 static void gen_mxu_q8sad(DisasContext *ctx)
-- 
2.39.2

[PATCH 04/24] util: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 util/cpuinfo-aarch64.c | 4 ++--
 util/cpuinfo-i386.c| 4 ++--
 util/cpuinfo-ppc.c | 2 +-
 util/main-loop.c   | 2 +-
 util/oslib-posix.c | 2 +-
 util/qdist.c   | 2 +-
 util/qemu-sockets.c| 2 +-
 util/rcu.c | 2 +-
 8 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/util/cpuinfo-aarch64.c b/util/cpuinfo-aarch64.c
index ababc39550..7d39f47e3b 100644
--- a/util/cpuinfo-aarch64.c
+++ b/util/cpuinfo-aarch64.c
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for AArch64.
+ * Host specific cpu identification for AArch64.
  */
 
@@ -34,5 +34,5 @@ static bool sysctl_for_bool(const char *name)
  * We might in the future ask for properties not present in older kernels,
  * but we're only asking about static properties, all of which should be
- * 'int'.  So we shouln't see ENOMEM (val too small), or any of the other
+ * 'int'.  So we shouldn't see ENOMEM (val too small), or any of the other
  * more exotic errors.
  */
diff --git a/util/cpuinfo-i386.c b/util/cpuinfo-i386.c
index 3a7b7e0ad1..b2ed65bb10 100644
--- a/util/cpuinfo-i386.c
+++ b/util/cpuinfo-i386.c
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for x86.
+ * Host specific cpu identification for x86.
  */
 
@@ -75,5 +75,5 @@ unsigned __attribute__((constructor)) cpuinfo_init(void)
  *
  * AMD has provided an even stronger guarantee that processors
- * with AVX provide 16-byte atomicity for all cachable,
+ * with AVX provide 16-byte atomicity for all cacheable,
  * naturally aligned single loads and stores, e.g. MOVDQU.
  *
diff --git a/util/cpuinfo-ppc.c b/util/cpuinfo-ppc.c
index 7212afa45d..1ea3db0ac8 100644
--- a/util/cpuinfo-ppc.c
+++ b/util/cpuinfo-ppc.c
@@ -1,5 +1,5 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for ppc.
+ * Host specific cpu identification for ppc.
  */
 
diff --git a/util/main-loop.c b/util/main-loop.c
index 014c795916..797b640c41 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -48,5 +48,5 @@
 /*
  * Disable CFI checks.
- * We are going to call a signal hander directly. Such handler may or may not
+ * We are going to call a signal handler directly. Such handler may or may not
  * have been defined in our binary, so there's no guarantee that the pointer
  * used to set the handler is a cfi-valid pointer. Since the handlers are
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 760390b31e..4d583da7ce 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -672,5 +672,5 @@ void qemu_free_stack(void *stack, size_t sz)
 /*
  * Disable CFI checks.
- * We are going to call a signal hander directly. Such handler may or may not
+ * We are going to call a signal handler directly. Such handler may or may not
  * have been defined in our binary, so there's no guarantee that the pointer
  * used to set the handler is a cfi-valid pointer. Since the handlers are
diff --git a/util/qdist.c b/util/qdist.c
index 5f75e24c29..ef3566b03a 100644
--- a/util/qdist.c
+++ b/util/qdist.c
@@ -211,5 +211,5 @@ void qdist_bin__internal(struct qdist *to, const struct 
qdist *from, size_t n)
 /*
  * To avoid double-counting we capture [left, right) ranges, except for
- * the righmost bin, which captures a [left, right] range.
+ * the rightmost bin, which captures a [left, right] range.
  */
 while (j < from->n && (from->entries[j].x < right || i == n - 1)) {
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 892d33f5e6..83e84b1186 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -930,5 +930,5 @@ static int unix_listen_saddr(UnixSocketAddress *saddr,
 if (pathbuf != NULL) {
 /*
- * This dummy fd usage silences the mktemp() unsecure warning.
+ * This dummy fd usage silences the mktemp() insecure warning.
  * Using mkstemp() doesn't make things more secure here
  * though.  bind() complains about existing files, so we have
diff --git a/util/rcu.c b/util/rcu.c
index 30a7e22026..e587bcc483 100644
--- a/util/rcu.c
+++ b/util/rcu.c
@@ -356,5 +356,5 @@ void drain_call_rcu(void)
  * Note that since we have only one global queue of the RCU callbacks,
  * we also end up waiting for most of RCU callbacks that were registered
- * on the other threads, but this is a side effect that shoudn't be
+ * on the other threads, but this is a side effect that shouldn't be
  * assumed.
  */
-- 
2.39.2

[PATCH 16/24] hw/display: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 hw/display/bochs-display.c | 2 +-
 hw/display/qxl.c   | 2 +-
 hw/display/ssd0303.c   | 2 +-
 hw/display/ssd0323.c   | 2 +-
 hw/display/xlnx_dp.c   | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/display/bochs-display.c b/hw/display/bochs-display.c
index e7ec268184..9138e98c3b 100644
--- a/hw/display/bochs-display.c
+++ b/hw/display/bochs-display.c
@@ -165,5 +165,5 @@ static int bochs_display_get_mode(BochsDisplayState *s,
 switch (vbe[VBE_DISPI_INDEX_BPP]) {
 case 16:
-/* best effort: support native endianess only */
+/* best effort: support native endianness only */
 mode->format = PIXMAN_r5g6b5;
 mode->bytepp = 2;
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index f1c0eb7dfc..af941fb0c2 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1545,5 +1545,5 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, 
int loadvm,
 }
 
-/* return 1 if surface destoy was initiated (in QXL_ASYNC case) or
+/* return 1 if surface destroy was initiated (in QXL_ASYNC case) or
  * done (in QXL_SYNC case), 0 otherwise. */
 static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async)
diff --git a/hw/display/ssd0303.c b/hw/display/ssd0303.c
index d67b0ad7b5..32b32a3044 100644
--- a/hw/display/ssd0303.c
+++ b/hw/display/ssd0303.c
@@ -9,5 +9,5 @@
 
 /* The controller can support a variety of different displays, but we only
-   implement one.  Most of the commends relating to brightness and geometry
+   implement one.  Most of the commands relating to brightness and geometry
setup are ignored. */
 
diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c
index ab229d32b7..09b1bbed0a 100644
--- a/hw/display/ssd0323.c
+++ b/hw/display/ssd0323.c
@@ -9,5 +9,5 @@
 
 /* The controller can support a variety of different displays, but we only
-   implement one.  Most of the commends relating to brightness and geometry
+   implement one.  Most of the commands relating to brightness and geometry
setup are ignored. */
 
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index b0828d65aa..822355ecc6 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -381,5 +381,5 @@ static void xlnx_dp_audio_callback(void *opaque, int avail)
 {
 /*
- * Get some data from the DPDMA and compute these datas.
+ * Get some data from the DPDMA and compute these data.
  * Then wait for QEMU's audio subsystem to call this callback.
  */
-- 
2.39.2

[PATCH 06/24] docs: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 docs/devel/qapi-code-gen.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/qapi-code-gen.rst b/docs/devel/qapi-code-gen.rst
index 7f78183cd4..b0852da97b 100644
--- a/docs/devel/qapi-code-gen.rst
+++ b/docs/devel/qapi-code-gen.rst
@@ -1368,5 +1368,5 @@ anymore, optional return or event data members that can't 
be sent
 anymore, and return or event data member (enumeration) values that
 can't be sent anymore makes no difference to clients, except for
-introspection.  The latter can conceivably confuse clients, so tread
+introspection.  The latter can conceivably confuse clients, so treat
 carefully.
 
-- 
2.39.2

[PATCH 02/24] bsd-user: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 bsd-user/errno_defs.h| 2 +-
 bsd-user/freebsd/target_os_siginfo.h | 2 +-
 bsd-user/freebsd/target_os_stack.h   | 4 ++--
 bsd-user/freebsd/target_os_user.h| 2 +-
 bsd-user/qemu.h  | 2 +-
 bsd-user/signal-common.h | 4 ++--
 bsd-user/signal.c| 6 +++---
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/bsd-user/errno_defs.h b/bsd-user/errno_defs.h
index f3e8ac3488..abe70119d9 100644
--- a/bsd-user/errno_defs.h
+++ b/bsd-user/errno_defs.h
@@ -150,5 +150,5 @@
 
 /* Internal errors: */
-#define TARGET_EJUSTRETURN  254 /* Just return without 
modifing regs */
+#define TARGET_EJUSTRETURN  254 /* Just return without 
modifying regs */
 #define TARGET_ERESTART 255 /* Restart syscall */
 
diff --git a/bsd-user/freebsd/target_os_siginfo.h 
b/bsd-user/freebsd/target_os_siginfo.h
index 4573738752..6c282d8502 100644
--- a/bsd-user/freebsd/target_os_siginfo.h
+++ b/bsd-user/freebsd/target_os_siginfo.h
@@ -73,5 +73,5 @@ typedef struct target_siginfo {
 } _mesgp;
 
-/* SIGPOLL -- Not really genreated in FreeBSD ??? */
+/* SIGPOLL -- Not really generated in FreeBSD ??? */
 struct {
 int _band;  /* POLL_IN, POLL_OUT, POLL_MSG */
diff --git a/bsd-user/freebsd/target_os_stack.h 
b/bsd-user/freebsd/target_os_stack.h
index 0590133291..d15fc3263f 100644
--- a/bsd-user/freebsd/target_os_stack.h
+++ b/bsd-user/freebsd/target_os_stack.h
@@ -26,5 +26,5 @@
 
 /*
- * The inital FreeBSD stack is as follows:
+ * The initial FreeBSD stack is as follows:
  * (see kern/kern_exec.c exec_copyout_strings() )
  *
@@ -60,5 +60,5 @@ static inline int setup_initial_stack(struct bsd_binprm *bprm,
 p -= sizeof(struct target_ps_strings);
 
-/* Add machine depedent sigcode. */
+/* Add machine dependent sigcode. */
 p -= TARGET_SZSIGCODE;
 if (setup_sigtramp(p, (unsigned)offsetof(struct target_sigframe, sf_uc),
diff --git a/bsd-user/freebsd/target_os_user.h 
b/bsd-user/freebsd/target_os_user.h
index f036a32343..1ca7b5ab17 100644
--- a/bsd-user/freebsd/target_os_user.h
+++ b/bsd-user/freebsd/target_os_user.h
@@ -27,5 +27,5 @@ struct target_priority {
 uint8_t pri_class;  /* Scheduling class. */
 uint8_t pri_level;  /* Normal priority level. */
-uint8_t pri_native; /* Priority before propogation. */
+uint8_t pri_native; /* Priority before propagation. */
 uint8_t pri_user;   /* User priority based on p_cpu and p_nice. */
 };
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 8f2d6a3c78..470d0337d5 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -119,5 +119,5 @@ extern const char *qemu_uname_release;
  * TARGET_ARG_MAX defines the number of bytes allocated for arguments
  * and envelope for the new program. 256k should suffice for a reasonable
- * maxiumum env+arg in 32-bit environments, bump it up to 512k for !ILP32
+ * maximum env+arg in 32-bit environments, bump it up to 512k for !ILP32
  * platforms.
  */
diff --git a/bsd-user/signal-common.h b/bsd-user/signal-common.h
index 6f90345bb2..c044e81165 100644
--- a/bsd-user/signal-common.h
+++ b/bsd-user/signal-common.h
@@ -50,9 +50,9 @@ void target_to_host_sigset(sigset_t *d, const target_sigset_t 
*s);
  * host_to_target_siginfo_noswap() and tswap_siginfo(); it does not appear
  * either within host siginfo_t or in target_siginfo structures which we get
- * from the guest userspace program. Linux kenrels use this internally, but BSD
+ * from the guest userspace program. Linux kernels use this internally, but BSD
  * kernels don't do this, but its a useful abstraction.
  *
  * The linux-user version of this uses the top 16 bits, but FreeBSD's SI_USER
- * and other signal indepenent SI_ codes have bit 16 set, so we only use the 
top
+ * and other signal independent SI_ codes have bit 16 set, so we only use the 
top
  * byte instead.
  *
diff --git a/bsd-user/signal.c b/bsd-user/signal.c
index f4e078ee1d..6e77dd0b4d 100644
--- a/bsd-user/signal.c
+++ b/bsd-user/signal.c
@@ -45,5 +45,5 @@ static inline int sas_ss_flags(TaskState *ts, unsigned long 
sp)
 
 /*
- * The BSD ABIs use the same singal numbers across all the CPU architectures, 
so
+ * The BSD ABIs use the same signal numbers across all the CPU architectures, 
so
  * (unlike Linux) these functions are just the identity mapping. This might not
  * be true for XyzBSD running on AbcBSD, which doesn't currently work.
@@ -242,5 +242,5 @@ static inline void 
host_to_target_siginfo_noswap(target_siginfo_t *tinfo,
 /*
  * Unsure that this can actually be generated, and our support for
- * capsicum is somewhere between weak and non-existant, but if we get
+ * capsicum is somewhere between weak and non-existent, but if we get
  * one, then we know what to save.
  */
@@ -320,5 +320,5 @@ int block_signals(void)
  

[PATCH v2 00/24] tree-wide spelling fixes

[Michael Tokarev]

This is a v2 of large tree-wide spelling patch set.
Mostly fixes spelling errors in comments, but also in
some messages too, in documentation, in trace event
formats and so on.

I tried to group the fixes into more-or-less reasonable
chunks, but due to large amount of changes it's a trade-
off, - either individual patches are large, or there are
just too many of them.

First version has been postd before, available here:
https://lists.nongnu.org/archive/html/qemu-devel/2023-07/msg03006.html

I renamed individual patches (to have grouping at the beginning
of the subject line), dropped patches which has been reviewed
and applied, and addressed some other review comments.

It is still a large series, 508 changes in 336 files.

Please review.  I plan to send a pull request via a trivial-patches
tree.

Michael Tokarev (24):
  block: spelling fixes
  bsd-user: spelling fixes
  ui: spelling fixes
  util: spelling fixes
  tcg: spelling fixes
  docs: spelling fixes
  i386: spelling fixes
  mips: spelling fixes
  ppc: spelling fixes
  riscv: spelling fixes
  hexagon: spelling fixes
  hw/net: spelling fixes
  hw/pci: spelling fixes
  hw/tpm: spelling fixes
  hw/usb hw/ide hw/i2c: spelling fixes
  hw/display: spelling fixes
  xen: spelling fixes
  audio: spelling fixes
  hw/other: spelling fixes
  include/: spelling fixes
  scripts/: spelling fixes
  tests/: spelling fixes
  qga/: spelling fixes
  misc/other: spelling fixes

 accel/tcg/tb-maint.c  |  2 +-
 audio/mixeng.h|  2 +-
 backends/tpm/tpm_ioctl.h  |  2 +-
 block.c   |  2 +-
 block/block-copy.c|  4 +--
 block/export/vduse-blk.c  |  2 +-
 block/export/vhost-user-blk-server.c  |  2 +-
 block/export/vhost-user-blk-server.h  |  2 +-
 block/file-posix.c|  8 +++---
 block/graph-lock.c|  2 +-
 block/io.c|  2 +-
 block/linux-aio.c |  2 +-
 block/mirror.c|  2 +-
 block/qcow2-refcount.c|  2 +-
 block/vhdx.c  |  2 +-
 block/vhdx.h  |  4 +--
 bsd-user/errno_defs.h |  2 +-
 bsd-user/freebsd/target_os_siginfo.h  |  2 +-
 bsd-user/freebsd/target_os_stack.h|  4 +--
 bsd-user/freebsd/target_os_user.h |  2 +-
 bsd-user/qemu.h   |  2 +-
 bsd-user/signal-common.h  |  4 +--
 bsd-user/signal.c |  6 ++---
 chardev/char-socket.c |  6 ++---
 chardev/char.c|  2 +-
 contrib/plugins/cache.c   |  2 +-
 contrib/plugins/lockstep.c|  2 +-
 crypto/afalg.c|  2 +-
 crypto/block-luks.c   |  6 ++---
 crypto/der.c  |  2 +-
 crypto/der.h  |  6 ++---
 docs/devel/qapi-code-gen.rst  |  2 +-
 host/include/i386/host/cpuinfo.h  |  2 +-
 host/include/ppc/host/cpuinfo.h   |  2 +-
 hw/acpi/aml-build.c   |  6 ++---
 hw/acpi/hmat.c|  2 +-
 hw/acpi/nvdimm.c  |  2 +-
 hw/audio/fmopl.c  |  8 +++---
 hw/audio/fmopl.h  |  2 +-
 hw/audio/gusemu_hal.c |  4 +--
 hw/audio/intel-hda-defs.h |  4 +--
 hw/block/hd-geometry.c|  4 +--
 hw/block/pflash_cfi01.c   |  2 +-
 hw/char/cadence_uart.c|  2 +-
 hw/char/imx_serial.c  |  2 +-
 hw/char/serial.c  |  2 +-
 hw/core/generic-loader.c  |  4 +--
 hw/core/machine.c |  2 +-
 hw/core/qdev-properties-system.c  |  2 +-
 hw/cpu/a15mpcore.c|  2 +-
 hw/cxl/cxl-events.c   |  2 +-
 hw/cxl/cxl-mailbox-utils.c|  4 +--
 hw/display/bochs-display.c|  2 +-
 hw/display/qxl.c  |  2 +-
 hw/display/ssd0303.c  |  2 +-
 hw/display/ssd0323.c  |  2 +-
 hw/display/xlnx_dp.c  |  2 +-
 hw/dma/omap_dma.c |  4 +--
 hw/i2c/pm_smbus.c |  2 +-
 hw/i2c/pmbus_device.c |  2 +-
 hw/i2c/smbus_slave.c  |  2 +-
 hw/i386/acpi-build.c  |  4 +--
 hw/i386/amd_iommu.c   |  4 +--
 hw/i386/intel_iommu.c |  4 +--
 hw/i3

[PATCH 05/24] tcg: spelling fixes

[Michael Tokarev]

Signed-off-by: Michael Tokarev 
---
 tcg/aarch64/tcg-target.c.inc | 2 +-
 tcg/arm/tcg-target.c.inc | 4 ++--
 tcg/riscv/tcg-target.c.inc   | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 35ca80cd56..5471523f4c 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -3087,5 +3087,5 @@ static void tcg_target_qemu_prologue(TCGContext *s)
 /*
  * Note that XZR cannot be encoded in the address base register slot,
- * as that actaully encodes SP.  Depending on the guest, we may need
+ * as that actually encodes SP.  Depending on the guest, we may need
  * to zero-extend the guest address via the address index register slot,
  * therefore we need to load even a zero guest base into a register.
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 83e286088f..3a14f52c51 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1217,5 +1217,5 @@ static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg 
*args,
 case TCG_COND_GTU:
 case TCG_COND_GEU:
-/* We perform a conditional comparision.  If the high half is
+/* We perform a conditional comparison.  If the high half is
equal, then overwrite the flags with the comparison of the
low half.  The resulting flags cover the whole.  */
@@ -1251,5 +1251,5 @@ static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg 
*args,
 /*
  * Note that TCGReg references Q-registers.
- * Q-regno = 2 * D-regno, so shift left by 1 whlie inserting.
+ * Q-regno = 2 * D-regno, so shift left by 1 while inserting.
  */
 static uint32_t encode_vd(TCGReg rd)
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index eeaeb6b6e3..e9e5968823 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -70,5 +70,5 @@ static const char * const 
tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
 static const int tcg_target_reg_alloc_order[] = {
 /* Call saved registers */
-/* TCG_REG_S0 reservered for TCG_AREG0 */
+/* TCG_REG_S0 reserved for TCG_AREG0 */
 TCG_REG_S1,
 TCG_REG_S2,
@@ -261,5 +261,5 @@ typedef enum {
 OPC_ADD_UW = 0x083b,
 
-/* Zbb: Bit manipulation extension, basic bit manipulaton */
+/* Zbb: Bit manipulation extension, basic bit manipulation */
 OPC_ANDN   = 0x40007033,
 OPC_CLZ= 0x60001013,
-- 
2.39.2

[PATCH v4 02/10] linux-user: Exit not abort in die_with_backtrace

[Richard Henderson]

This line is supposed to be unreachable, but if we're going to
have it at all, SIGABRT via abort() is subject to the same signal
peril that created this function in the first place.

We can _exit immediately without peril.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index e1cd111a1b..57fbf2f58b 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -718,7 +718,7 @@ void die_with_signal(int sig)
 sigsuspend(&act.sa_mask);
 
 /* unreachable */
-abort();
+_exit(EXIT_FAILURE);
 }
 
 static G_NORETURN
-- 
2.34.1

[PATCH v4 05/10] linux-user: Only register handlers for core_dump_signal by default

[Richard Henderson]

The set of fatal signals is really immaterial.  If one arrives,
and is unhandled, then the qemu process dies and the parent gets
the correct signal.

It is only for those signals which we would like to perform a
guest core dump instead of a host core dump that we need to catch.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 43 ++-
 1 file changed, 14 insertions(+), 29 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 529fea8bba..73f40699ad 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -489,26 +489,6 @@ void target_to_host_siginfo(siginfo_t *info, const 
target_siginfo_t *tinfo)
 info->si_value.sival_ptr = (void *)(long)sival_ptr;
 }
 
-static int fatal_signal (int sig)
-{
-switch (sig) {
-case TARGET_SIGCHLD:
-case TARGET_SIGURG:
-case TARGET_SIGWINCH:
-/* Ignored by default.  */
-return 0;
-case TARGET_SIGCONT:
-case TARGET_SIGSTOP:
-case TARGET_SIGTSTP:
-case TARGET_SIGTTIN:
-case TARGET_SIGTTOU:
-/* Job control signals.  */
-return 0;
-default:
-return 1;
-}
-}
-
 /* returns 1 if given signal should dump core if not handled */
 static int core_dump_signal(int sig)
 {
@@ -608,8 +588,9 @@ void signal_init(void)
SIGSEGV and SIGBUS, to detect exceptions.  We can not just
trap all signals because it affects syscall interrupt
behavior.  But do trap all default-fatal signals.  */
-if (fatal_signal (i))
+if (core_dump_signal(i)) {
 sigaction(host_sig, &act, NULL);
+}
 }
 }
 
@@ -999,7 +980,6 @@ int do_sigaction(int sig, const struct target_sigaction 
*act,
  struct target_sigaction *oact, abi_ulong ka_restorer)
 {
 struct target_sigaction *k;
-struct sigaction act1;
 int host_sig;
 int ret = 0;
 
@@ -1059,22 +1039,27 @@ int do_sigaction(int sig, const struct target_sigaction 
*act,
 return 0;
 }
 if (host_sig != SIGSEGV && host_sig != SIGBUS) {
+struct sigaction act1;
+
 sigfillset(&act1.sa_mask);
 act1.sa_flags = SA_SIGINFO;
-if (k->sa_flags & TARGET_SA_RESTART)
-act1.sa_flags |= SA_RESTART;
-/* NOTE: it is important to update the host kernel signal
-   ignore state to avoid getting unexpected interrupted
-   syscalls */
 if (k->_sa_handler == TARGET_SIG_IGN) {
+/*
+ * It is important to update the host kernel signal ignore
+ * state to avoid getting unexpected interrupted syscalls.
+ */
 act1.sa_sigaction = (void *)SIG_IGN;
 } else if (k->_sa_handler == TARGET_SIG_DFL) {
-if (fatal_signal (sig))
+if (core_dump_signal(sig)) {
 act1.sa_sigaction = host_signal_handler;
-else
+} else {
 act1.sa_sigaction = (void *)SIG_DFL;
+}
 } else {
 act1.sa_sigaction = host_signal_handler;
+if (k->sa_flags & TARGET_SA_RESTART) {
+act1.sa_flags |= SA_RESTART;
+}
 }
 ret = sigaction(host_sig, &act1, NULL);
 }
-- 
2.34.1

[PATCH v4 01/10] linux-user: Split out die_with_signal

[Richard Henderson]

Because we trap so many signals for use by the guest,
we have to take extra steps to exit properly.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 52 -
 1 file changed, 28 insertions(+), 24 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 748a98f3e5..e1cd111a1b 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -694,6 +694,33 @@ void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 }
 
 /* abort execution with signal */
+static G_NORETURN
+void die_with_signal(int sig)
+{
+struct sigaction act = {
+.sa_handler = SIG_DFL,
+};
+
+/*
+ * The proper exit code for dying from an uncaught signal is -.
+ * The kernel doesn't allow exit() or _exit() to pass a negative value.
+ * To get the proper exit code we need to actually die from an uncaught
+ * signal.  Here the default signal handler is installed, we send
+ * the signal and we wait for it to arrive.
+ */
+sigfillset(&act.sa_mask);
+sigaction(sig, &act, NULL);
+
+kill(getpid(), sig);
+
+/* Make sure the signal isn't masked (reusing the mask inside of act). */
+sigdelset(&act.sa_mask, sig);
+sigsuspend(&act.sa_mask);
+
+/* unreachable */
+abort();
+}
+
 static G_NORETURN
 void dump_core_and_abort(CPUArchState *cpu_env, int target_sig)
 {
@@ -701,7 +728,6 @@ void dump_core_and_abort(CPUArchState *cpu_env, int 
target_sig)
 CPUArchState *env = cpu->env_ptr;
 TaskState *ts = (TaskState *)cpu->opaque;
 int host_sig, core_dumped = 0;
-struct sigaction act;
 
 host_sig = target_to_host_signal(target_sig);
 trace_user_dump_core_and_abort(env, target_sig, host_sig);
@@ -725,29 +751,7 @@ void dump_core_and_abort(CPUArchState *cpu_env, int 
target_sig)
 }
 
 preexit_cleanup(cpu_env, 128 + target_sig);
-
-/* The proper exit code for dying from an uncaught signal is
- * -.  The kernel doesn't allow exit() or _exit() to pass
- * a negative value.  To get the proper exit code we need to
- * actually die from an uncaught signal.  Here the default signal
- * handler is installed, we send ourself a signal and we wait for
- * it to arrive. */
-sigfillset(&act.sa_mask);
-act.sa_handler = SIG_DFL;
-act.sa_flags = 0;
-sigaction(host_sig, &act, NULL);
-
-/* For some reason raise(host_sig) doesn't send the signal when
- * statically linked on x86-64. */
-kill(getpid(), host_sig);
-
-/* Make sure the signal isn't masked (just reuse the mask inside
-of act) */
-sigdelset(&act.sa_mask, host_sig);
-sigsuspend(&act.sa_mask);
-
-/* unreachable */
-abort();
+die_with_signal(host_sig);
 }
 
 /* queue a signal so that it will be send to the virtual CPU as soon
-- 
2.34.1

[PATCH v4 07/10] linux-user: Remap SIGPROF when CONFIG_GPROF

[Richard Henderson]

Protect the host's use of SIGPROF by remapping TARGET_SIGPROF
to one of the RT signals.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 9d16e3c8c5..b8913968cc 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -523,8 +523,15 @@ static void signal_table_init(void)
  * multiplexed over a single host signal.
  * Attempts for configure "missing" signals via sigaction will be
  * silently ignored.
+ *
+ * If the host is using gprof, treat SIGPROF the same way.
  */
-for (hsig = SIGRTMIN; hsig <= SIGRTMAX; hsig++) {
+hsig = SIGRTMIN;
+#ifdef CONFIG_GPROF
+host_to_target_signal_table[SIGPROF] = 0;
+host_to_target_signal_table[hsig++] = TARGET_SIGPROF;
+#endif
+for (; hsig <= SIGRTMAX; hsig++) {
 tsig = hsig - SIGRTMIN + TARGET_SIGRTMIN;
 if (tsig <= TARGET_NSIG) {
 host_to_target_signal_table[hsig] = tsig;
-- 
2.34.1

[PATCH v4 06/10] linux-user: Map unsupported signals to an out-of-bounds value

[Richard Henderson]

Do not return a valid signal number in one domain
when given an invalid signal number in the other domain.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 72 -
 1 file changed, 38 insertions(+), 34 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 73f40699ad..9d16e3c8c5 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -45,9 +45,8 @@ abi_ulong default_sigreturn;
 abi_ulong default_rt_sigreturn;
 
 /*
- * System includes define _NSIG as SIGRTMAX + 1,
- * but qemu (like the kernel) defines TARGET_NSIG as TARGET_SIGRTMAX
- * and the first signal is SIGHUP defined as 1
+ * System includes define _NSIG as SIGRTMAX + 1, but qemu (like the kernel)
+ * defines TARGET_NSIG as TARGET_SIGRTMAX and the first signal is 1.
  * Signal number 0 is reserved for use as kill(pid, 0), to test whether
  * a process exists without sending it a signal.
  */
@@ -58,7 +57,6 @@ static uint8_t host_to_target_signal_table[_NSIG] = {
 #define MAKE_SIG_ENTRY(sig) [sig] = TARGET_##sig,
 MAKE_SIGNAL_LIST
 #undef MAKE_SIG_ENTRY
-/* next signals stay the same */
 };
 
 static uint8_t target_to_host_signal_table[TARGET_NSIG + 1];
@@ -66,18 +64,24 @@ static uint8_t target_to_host_signal_table[TARGET_NSIG + 1];
 /* valid sig is between 1 and _NSIG - 1 */
 int host_to_target_signal(int sig)
 {
-if (sig < 1 || sig >= _NSIG) {
+if (sig < 1) {
 return sig;
 }
+if (sig >= _NSIG) {
+return TARGET_NSIG + 1;
+}
 return host_to_target_signal_table[sig];
 }
 
 /* valid sig is between 1 and TARGET_NSIG */
 int target_to_host_signal(int sig)
 {
-if (sig < 1 || sig > TARGET_NSIG) {
+if (sig < 1) {
 return sig;
 }
+if (sig > TARGET_NSIG) {
+return _NSIG;
+}
 return target_to_host_signal_table[sig];
 }
 
@@ -508,48 +512,48 @@ static int core_dump_signal(int sig)
 
 static void signal_table_init(void)
 {
-int host_sig, target_sig, count;
+int hsig, tsig, count;
 
 /*
  * Signals are supported starting from TARGET_SIGRTMIN and going up
- * until we run out of host realtime signals.
- * glibc at least uses only the lower 2 rt signals and probably
- * nobody's using the upper ones.
- * it's why SIGRTMIN (34) is generally greater than __SIGRTMIN (32)
- * To fix this properly we need to do manual signal delivery multiplexed
- * over a single host signal.
+ * until we run out of host realtime signals.  Glibc uses the lower 2
+ * RT signals and (hopefully) nobody uses the upper ones.
+ * This is why SIGRTMIN (34) is generally greater than __SIGRTMIN (32).
+ * To fix this properly we would need to do manual signal delivery
+ * multiplexed over a single host signal.
  * Attempts for configure "missing" signals via sigaction will be
  * silently ignored.
  */
-for (host_sig = SIGRTMIN; host_sig <= SIGRTMAX; host_sig++) {
-target_sig = host_sig - SIGRTMIN + TARGET_SIGRTMIN;
-if (target_sig <= TARGET_NSIG) {
-host_to_target_signal_table[host_sig] = target_sig;
+for (hsig = SIGRTMIN; hsig <= SIGRTMAX; hsig++) {
+tsig = hsig - SIGRTMIN + TARGET_SIGRTMIN;
+if (tsig <= TARGET_NSIG) {
+host_to_target_signal_table[hsig] = tsig;
 }
 }
 
-/* generate signal conversion tables */
-for (target_sig = 1; target_sig <= TARGET_NSIG; target_sig++) {
-target_to_host_signal_table[target_sig] = _NSIG; /* poison */
-}
-for (host_sig = 1; host_sig < _NSIG; host_sig++) {
-if (host_to_target_signal_table[host_sig] == 0) {
-host_to_target_signal_table[host_sig] = host_sig;
-}
-target_sig = host_to_target_signal_table[host_sig];
-if (target_sig <= TARGET_NSIG) {
-target_to_host_signal_table[target_sig] = host_sig;
+/* Invert the mapping that has already been assigned. */
+for (hsig = 1; hsig < _NSIG; hsig++) {
+tsig = host_to_target_signal_table[hsig];
+if (tsig) {
+assert(target_to_host_signal_table[tsig] == 0);
+target_to_host_signal_table[tsig] = hsig;
 }
 }
 
-if (trace_event_get_state_backends(TRACE_SIGNAL_TABLE_INIT)) {
-for (target_sig = 1, count = 0; target_sig <= TARGET_NSIG; 
target_sig++) {
-if (target_to_host_signal_table[target_sig] == _NSIG) {
-count++;
-}
+/* Map everything else out-of-bounds. */
+for (hsig = 1; hsig < _NSIG; hsig++) {
+if (host_to_target_signal_table[hsig] == 0) {
+host_to_target_signal_table[hsig] = TARGET_NSIG + 1;
 }
-trace_signal_table_init(count);
 }
+for (count = 0, tsig = 1; tsig <= TARGET_NSIG; tsig++) {
+if (target_to_host_signal_table[tsig] == 0) {
+target_to_host_signal_table[tsig] = _NSIG;
+count++;
+}
+}
+
+trace_signal_table_init

[PATCH v4 08/10] linux-user: Simplify signal_init

[Richard Henderson]

Install the host signal handler at the same time we are
probing the target signals for SIG_IGN/SIG_DFL.  Ignore
unmapped target signals.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 47 +
 1 file changed, 22 insertions(+), 25 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index b8913968cc..a6917eadd8 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -566,10 +566,7 @@ static void signal_table_init(void)
 void signal_init(void)
 {
 TaskState *ts = (TaskState *)thread_cpu->opaque;
-struct sigaction act;
-struct sigaction oact;
-int i;
-int host_sig;
+struct sigaction act, oact;
 
 /* initialize signal conversion tables */
 signal_table_init();
@@ -580,28 +577,28 @@ void signal_init(void)
 sigfillset(&act.sa_mask);
 act.sa_flags = SA_SIGINFO;
 act.sa_sigaction = host_signal_handler;
-for(i = 1; i <= TARGET_NSIG; i++) {
-#ifdef CONFIG_GPROF
-if (i == TARGET_SIGPROF) {
-continue;
-}
-#endif
-host_sig = target_to_host_signal(i);
-sigaction(host_sig, NULL, &oact);
-if (oact.sa_sigaction == (void *)SIG_IGN) {
-sigact_table[i - 1]._sa_handler = TARGET_SIG_IGN;
-} else if (oact.sa_sigaction == (void *)SIG_DFL) {
-sigact_table[i - 1]._sa_handler = TARGET_SIG_DFL;
-}
-/* If there's already a handler installed then something has
-   gone horribly wrong, so don't even try to handle that case.  */
-/* Install some handlers for our own use.  We need at least
-   SIGSEGV and SIGBUS, to detect exceptions.  We can not just
-   trap all signals because it affects syscall interrupt
-   behavior.  But do trap all default-fatal signals.  */
-if (core_dump_signal(i)) {
-sigaction(host_sig, &act, NULL);
+
+/*
+ * A parent process may configure ignored signals, but all other
+ * signals are default.  For any target signals that have no host
+ * mapping, set to ignore.  For all core_dump_signal, install our
+ * host signal handler so that we may invoke dump_core_and_abort.
+ * This includes SIGSEGV and SIGBUS, which are also need our signal
+ * handler for paging and exceptions.
+ */
+for (int tsig = 1; tsig <= TARGET_NSIG; tsig++) {
+int hsig = target_to_host_signal(tsig);
+abi_ptr thand = TARGET_SIG_IGN;
+
+if (hsig < _NSIG) {
+struct sigaction *iact = core_dump_signal(tsig) ? &act : NULL;
+
+sigaction(hsig, iact, &oact);
+if (oact.sa_sigaction != (void *)SIG_IGN) {
+thand = TARGET_SIG_DFL;
+}
 }
+sigact_table[tsig - 1]._sa_handler = thand;
 }
 }
 
-- 
2.34.1

[PATCH v4 03/10] linux-user: Use die_with_signal with abort

[Richard Henderson]

Describe the convoluted way by which we can see

ERROR:../alt/accel/tcg/cpu-exec.c:532:cpu_exec_longjmp_cleanup: assertion 
failed: (cpu == current_cpu)
Bail out! ERROR:../alt/accel/tcg/cpu-exec.c:532:cpu_exec_longjmp_cleanup: 
assertion failed: (cpu == current_cpu)

for encountering an an abort() in qemu source.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 12 
 1 file changed, 12 insertions(+)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 57fbf2f58b..a77d003de6 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -721,6 +721,18 @@ void die_with_signal(int sig)
 _exit(EXIT_FAILURE);
 }
 
+/*
+ * The system abort() will raise SIGABRT, which will get caught and deferred
+ * by host_signal_handler.  Returning into system abort will try harder.
+ * Eventually, on x86, it will execute HLT, which raises SIGSEGV.  This goes
+ * back into host_signal_handler, through a different path which may longjmp
+ * back to the main loop.  This often explodes.
+ */
+void abort(void)
+{
+die_with_signal(SIGABRT);
+}
+
 static G_NORETURN
 void dump_core_and_abort(CPUArchState *cpu_env, int target_sig)
 {
-- 
2.34.1

[PATCH v4 04/10] linux-user: Detect and report host crashes

[Richard Henderson]

From: Helge Deller 

If there is an internal program error in the qemu source code which
raises SIGSEGV or SIGBUS, we currently assume the signal belongs to
the guest.

With an artificial error introduced, we will now print

QEMU internal SIGSEGV {si_code=1, si_addr=(nil)}
QEMU v8.1.50 target x86_64 running /usr/bin/cat
QEMU backtrace:
./qemu-x86_64(+0xf83d9) [0x55c48587a3d9]
./qemu-x86_64(+0xf8663) [0x55c48587a663]
/lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f39eee42520]
./qemu-x86_64(+0x1132fa) [0x55c4858952fa]
./qemu-x86_64(+0x11396f) [0x55c48589596f]
./qemu-x86_64(+0x1140ef) [0x55c4858960ef]
./qemu-x86_64(+0x115796) [0x55c485897796]
./qemu-x86_64(+0x11f9dd) [0x55c4858a19dd]
./qemu-x86_64(+0x3f8da) [0x55c4857c18da]
./qemu-x86_64(+0xf3bfb) [0x55c485875bfb]
/lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f39eee29d90]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f39eee29e40]
./qemu-x86_64(+0x39075) [0x55c4857bb075]
Aborted

Signed-off-by: Helge Deller 
Message-Id: <20230812164314.352131-1-del...@gmx.de>
[rth: Use in_code_gen_buffer and die_with_signal]
Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 53 -
 1 file changed, 47 insertions(+), 6 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index a77d003de6..529fea8bba 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -23,6 +23,7 @@
 
 #include 
 #include 
+#include 
 
 #include "qemu.h"
 #include "user-internals.h"
@@ -32,6 +33,7 @@
 #include "signal-common.h"
 #include "host-signal.h"
 #include "user/safe-syscall.h"
+#include "tcg/tcg.h"
 
 static struct target_sigaction sigact_table[TARGET_NSIG];
 
@@ -797,6 +799,33 @@ static inline void rewind_if_in_safe_syscall(void *puc)
 }
 }
 
+static G_NORETURN
+void die_with_backtrace(siginfo_t *info)
+{
+void *array[20];
+int size;
+
+fprintf(stderr,
+"QEMU internal SIG%s {si_code=%d, si_addr=%p}\n"
+"QEMU v" QEMU_VERSION " target " UNAME_MACHINE " running %s\n",
+sigabbrev_np(info->si_signo), info->si_code, info->si_addr,
+exec_path);
+
+size = backtrace(array, ARRAY_SIZE(array));
+if (size) {
+char **strings = backtrace_symbols(array, size);
+if (strings) {
+fprintf(stderr, "QEMU backtrace:\n");
+for (int i = 0; i < size; ++i) {
+fprintf(stderr, "%s\n", strings[i]);
+}
+free(strings);
+}
+}
+
+abort();
+}
+
 static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
 {
 CPUArchState *env = thread_cpu->env_ptr;
@@ -832,16 +861,28 @@ static void host_signal_handler(int host_sig, siginfo_t 
*info, void *puc)
 is_write = host_signal_write(info, uc);
 access_type = adjust_signal_pc(&pc, is_write);
 
+/* If this was a write to a TB protected page, restart. */
+if (is_write
+&& host_sig == SIGSEGV
+&& info->si_code == SEGV_ACCERR
+&& h2g_valid(host_addr)
+&& handle_sigsegv_accerr_write(cpu, sigmask, pc, guest_addr)) {
+return;
+}
+
+/*
+ * If the access was not on behalf of the guest, within the executable
+ * mapping of the generated code buffer, then it is a host bug.
+ */
+if (access_type != MMU_INST_FETCH
+&& !in_code_gen_buffer((void *)(pc - tcg_splitwx_diff))) {
+die_with_backtrace(info);
+}
+
 if (host_sig == SIGSEGV) {
 bool maperr = true;
 
 if (info->si_code == SEGV_ACCERR && h2g_valid(host_addr)) {
-/* If this was a write to a TB protected page, restart. */
-if (is_write &&
-handle_sigsegv_accerr_write(cpu, sigmask, pc, guest_addr)) 
{
-return;
-}
-
 /*
  * With reserved_va, the whole address space is PROT_NONE,
  * which means that we may get ACCERR when we want MAPERR.
-- 
2.34.1

[PATCH v4 00/10] linux-user: Detect and report host crashes

[Richard Henderson]

More signal cleanups.  Mostly tested by temporarily adding an
abort, divide by zero, undefined instruction, null dereference,
within the implementation of a guest syscall to induce an error.


r~


Helge Deller (1):
  linux-user: Detect and report host crashes

Richard Henderson (9):
  linux-user: Split out die_with_signal
  linux-user: Exit not abort in die_with_backtrace
  linux-user: Use die_with_signal with abort
  linux-user: Only register handlers for core_dump_signal by default
  linux-user: Map unsupported signals to an out-of-bounds value
  linux-user: Remap SIGPROF when CONFIG_GPROF
  linux-user: Simplify signal_init
  linux-user: Split out host_sig{segv,bus}_handler
  linux-user: Detect and report host SIGILL, SIGFPE, SIGTRAP

 linux-user/signal.c | 400 ++--
 1 file changed, 240 insertions(+), 160 deletions(-)

-- 
2.34.1

[PATCH v4 10/10] linux-user: Detect and report host SIGILL, SIGFPE, SIGTRAP

[Richard Henderson]

These signals, when not spoofed via kill(), are always bugs.
Use die_with_backtrace to report this sensibly.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 68ceb2e4bd..6d13b5c210 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -904,7 +904,8 @@ static void host_signal_handler(int host_sig, siginfo_t 
*info, void *puc)
 
 /*
  * Non-spoofed SIGSEGV and SIGBUS are synchronous, and need special
- * handling wrt signal blocking and unwinding.
+ * handling wrt signal blocking and unwinding.  Non-spoofed SIGILL,
+ * SIGFPE, SIGTRAP are always host bugs.
  */
 if (info->si_code > 0) {
 switch (host_sig) {
@@ -916,6 +917,10 @@ static void host_signal_handler(int host_sig, siginfo_t 
*info, void *puc)
 host_sigbus_handler(cpu, info, uc);
 sync_sig = true;
 break;
+case SIGILL:
+case SIGFPE:
+case SIGTRAP:
+die_with_backtrace(info);
 }
 }
 
-- 
2.34.1

[PATCH v4 09/10] linux-user: Split out host_sig{segv,bus}_handler

[Richard Henderson]

Make host_signal_handler slightly easier to read.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 145 ++--
 1 file changed, 85 insertions(+), 60 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index a6917eadd8..68ceb2e4bd 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -815,6 +815,80 @@ void die_with_backtrace(siginfo_t *info)
 abort();
 }
 
+static void host_sigsegv_handler(CPUState *cpu, siginfo_t *info,
+ host_sigcontext *uc)
+{
+uintptr_t host_addr = (uintptr_t)info->si_addr;
+/*
+ * Convert forcefully to guest address space: addresses outside
+ * reserved_va are still valid to report via SEGV_MAPERR.
+ */
+bool is_valid = h2g_valid(host_addr);
+abi_ptr guest_addr = h2g_nocheck(host_addr);
+uintptr_t pc = host_signal_pc(uc);
+bool is_write = host_signal_write(info, uc);
+MMUAccessType access_type = adjust_signal_pc(&pc, is_write);
+bool maperr;
+
+/* If this was a write to a TB protected page, restart. */
+if (is_write
+&& is_valid
+&& info->si_code == SEGV_ACCERR
+&& handle_sigsegv_accerr_write(cpu, host_signal_mask(uc),
+   pc, guest_addr)) {
+return;
+}
+
+/*
+ * If the access was not on behalf of the guest, within the executable
+ * mapping of the generated code buffer, then it is a host bug.
+ */
+if (access_type != MMU_INST_FETCH
+&& !in_code_gen_buffer((void *)(pc - tcg_splitwx_diff))) {
+die_with_backtrace(info);
+}
+
+maperr = true;
+if (is_valid && info->si_code == SEGV_ACCERR) {
+/*
+ * With reserved_va, the whole address space is PROT_NONE,
+ * which means that we may get ACCERR when we want MAPERR.
+ */
+if (page_get_flags(guest_addr) & PAGE_VALID) {
+maperr = false;
+} else {
+info->si_code = SEGV_MAPERR;
+}
+}
+
+sigprocmask(SIG_SETMASK, host_signal_mask(uc), NULL);
+cpu_loop_exit_sigsegv(cpu, guest_addr, access_type, maperr, pc);
+}
+
+static void host_sigbus_handler(CPUState *cpu, siginfo_t *info,
+host_sigcontext *uc)
+{
+uintptr_t pc = host_signal_pc(uc);
+bool is_write = host_signal_write(info, uc);
+MMUAccessType access_type = adjust_signal_pc(&pc, is_write);
+
+/*
+ * If the access was not on behalf of the guest, within the executable
+ * mapping of the generated code buffer, then it is a host bug.
+ */
+if (!in_code_gen_buffer((void *)(pc - tcg_splitwx_diff))) {
+die_with_backtrace(info);
+}
+
+if (info->si_code == BUS_ADRALN) {
+uintptr_t host_addr = (uintptr_t)info->si_addr;
+abi_ptr guest_addr = h2g_nocheck(host_addr);
+
+sigprocmask(SIG_SETMASK, host_signal_mask(uc), NULL);
+cpu_loop_exit_sigbus(cpu, guest_addr, access_type, pc);
+}
+}
+
 static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
 {
 CPUArchState *env = thread_cpu->env_ptr;
@@ -826,73 +900,23 @@ static void host_signal_handler(int host_sig, siginfo_t 
*info, void *puc)
 int guest_sig;
 uintptr_t pc = 0;
 bool sync_sig = false;
-void *sigmask = host_signal_mask(uc);
+void *sigmask;
 
 /*
  * Non-spoofed SIGSEGV and SIGBUS are synchronous, and need special
  * handling wrt signal blocking and unwinding.
  */
-if ((host_sig == SIGSEGV || host_sig == SIGBUS) && info->si_code > 0) {
-MMUAccessType access_type;
-uintptr_t host_addr;
-abi_ptr guest_addr;
-bool is_write;
-
-host_addr = (uintptr_t)info->si_addr;
-
-/*
- * Convert forcefully to guest address space: addresses outside
- * reserved_va are still valid to report via SEGV_MAPERR.
- */
-guest_addr = h2g_nocheck(host_addr);
-
-pc = host_signal_pc(uc);
-is_write = host_signal_write(info, uc);
-access_type = adjust_signal_pc(&pc, is_write);
-
-/* If this was a write to a TB protected page, restart. */
-if (is_write
-&& host_sig == SIGSEGV
-&& info->si_code == SEGV_ACCERR
-&& h2g_valid(host_addr)
-&& handle_sigsegv_accerr_write(cpu, sigmask, pc, guest_addr)) {
+if (info->si_code > 0) {
+switch (host_sig) {
+case SIGSEGV:
+/* Only returns on handle_sigsegv_accerr_write success. */
+host_sigsegv_handler(cpu, info, uc);
 return;
+case SIGBUS:
+host_sigbus_handler(cpu, info, uc);
+sync_sig = true;
+break;
 }
-
-/*
- * If the access was not on behalf of the guest, within the executable
- * mapping of the generated code buffer, then it is a host bug.
- */
-if (access_type != MMU_INST_FETCH
-&& 

Re: [PATCH v2 08/58] i386/tdx: Adjust the supported CPUID based on TDX restrictions

[Xiaoyao Li]

On 8/22/2023 7:00 AM, Isaku Yamahata wrote:

On Fri, Aug 18, 2023 at 05:49:51AM -0400,
Xiaoyao Li  wrote:


diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 56cb826f6125..3198bc9fd5fb 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c

...

+static inline uint32_t host_cpuid_reg(uint32_t function,
+  uint32_t index, int reg)
+{
+uint32_t eax, ebx, ecx, edx;
+uint32_t ret = 0;
+
+host_cpuid(function, index, &eax, &ebx, &ecx, &edx);
+
+switch (reg) {
+case R_EAX:
+ret |= eax;
+break;
+case R_EBX:
+ret |= ebx;
+break;
+case R_ECX:
+ret |= ecx;
+break;
+case R_EDX:
+ret |= edx;


Nitpick: "|" isn't needed as we initialize ret = 0 above. Just '='.


Will fix it in next version.

thanks!

[ANNOUNCE] QEMU 8.1.0 is now available

[Michael Roth]

Hello,

On behalf of the QEMU Team, I'd like to announce the availability of
the QEMU 8.1.0 release. This release contains 2900+ commits from 250
authors.

You can grab the tarball from our download page here:

  https://www.qemu.org/download/#source

The full list of changes are available at:

  https://wiki.qemu.org/ChangeLog/8.1

Highlights include:

 * VFIO: improved live migration support, no longer an experimental feature
 * GTK GUI now supports multi-touch events
 * ARM, PowerPC, and RISC-V can now use AES acceleration on host processor
 * PCIe: new QMP commands to inject CXL General Media events, DRAM events and
   Memory Module events

 * ARM: KVM VMs on a host which supports MTE (the Memory Tagging Extension)
   can now use MTE in the guest
 * ARM: emulation support for bpim2u (Banana Pi BPI-M2 Ultra) board and
   neoverse-v1 (Cortex Neoverse-V1) CPU
 * ARM: new architectural feature support for: FEAT_PAN3 (SCTLR_ELx.EPAN),
   FEAT_LSE2 (Large System Extensions v2), and experimental support for
   FEAT_RME (Realm Management Extensions)
 * Hexagon: new instruction support for v68/v73 scalar, and v68/v69 HVX
 * Hexagon: gdbstub support for HVX
 * MIPS: emulation support for Ingenic XBurstR1/XBurstR2 CPUs, and MXU
   instructions
 * PowerPC: TCG SMT support, allowing pseries and powernv to run with up to 8
   threads per core
 * PowerPC: emulation support for Power9 DD2.2 CPU model, and perf sampling
   support for POWER CPUs
 * RISC-V: ISA extension support for BF16/Zfa, and disassembly support
   for Zcm*/Z*inx/XVentanaCondOps/Xthead
 * RISC-V: CPU emulation support for Veyron V1
 * RISC-V: numerous KVM/emulation fixes and enhancements 
 * s390: instruction emulation fixes for LDER, LCBB, LOCFHR, MXDB, MXDBR,
   EPSW, MDEB, MDEBR, MVCRL, LRA, CKSM, CLM, ICM, MC, STIDP, EXECUTE, and
   CLGEBR(A)
 * SPARC: updated target/sparc to use tcg_gen_lookup_and_goto_ptr() for
   improved performance
 * Tricore: emulation support for TC37x CPU that supports ISA v1.6.2
   instructions
 * Tricore: instruction emulation of POPCNT.W, LHA, CRC32L.W, CRC32.B,
   SHUFFLE, SYSCALL, and DISABLE
 * x86: CPU model support for GraniteRapids

 * and lots more...

Thank you to everyone involved!

Re: [PATCH] target/loongarch: cpu: Implement get_arch_id callback

[bibo mao]

在 2023/8/23 09:14, gaosong 写道:
> 在 2023/8/22 下午8:26, Bibo Mao 写道:
>> Implement the callback for getting the architecture-dependent CPU
>> ID, the cpu ID is physical id described in ACPI MADT table, this
>> will be used for cpu hotplug.
>>
>> Signed-off-by: Bibo Mao 
>> Change-Id: I53bcfb9f4279e491f33e8b99a9102534ad53409e
>> ---
> 
> Drop Chang-Id.
sure, will fix in next version.

Regards
Bibo Mao
> 
> Otherwise
> Reviewed-by: Song Gao 
> 
> Thanks.
> Song Gao
> 
>>   hw/loongarch/virt.c    | 2 ++
>>   target/loongarch/cpu.c | 8 
>>   target/loongarch/cpu.h | 1 +
>>   3 files changed, 11 insertions(+)
>>
>> diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
>> index e19b042ce8..6f6b577749 100644
>> --- a/hw/loongarch/virt.c
>> +++ b/hw/loongarch/virt.c
>> @@ -815,6 +815,8 @@ static void loongarch_init(MachineState *machine)
>>   cpu = cpu_create(machine->cpu_type);
>>   cpu->cpu_index = i;
>>   machine->possible_cpus->cpus[i].cpu = OBJECT(cpu);
>> +    lacpu = LOONGARCH_CPU(cpu);
>> +    lacpu->phy_id = machine->possible_cpus->cpus[i].arch_id;
>>   }
>>   fdt_add_cpu_nodes(lams);
>>   diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
>> index ad93ecac92..7be3769672 100644
>> --- a/target/loongarch/cpu.c
>> +++ b/target/loongarch/cpu.c
>> @@ -690,6 +690,13 @@ static struct TCGCPUOps loongarch_tcg_ops = {
>>   static const struct SysemuCPUOps loongarch_sysemu_ops = {
>>   .get_phys_page_debug = loongarch_cpu_get_phys_page_debug,
>>   };
>> +
>> +static int64_t loongarch_cpu_get_arch_id(CPUState *cs)
>> +{
>> +    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
>> +
>> +    return cpu->phy_id;
>> +}
>>   #endif
>>     static gchar *loongarch_gdb_arch_name(CPUState *cs)
>> @@ -715,6 +722,7 @@ static void loongarch_cpu_class_init(ObjectClass *c, 
>> void *data)
>>   cc->set_pc = loongarch_cpu_set_pc;
>>   cc->get_pc = loongarch_cpu_get_pc;
>>   #ifndef CONFIG_USER_ONLY
>> +    cc->get_arch_id = loongarch_cpu_get_arch_id;
>>   dc->vmsd = &vmstate_loongarch_cpu;
>>   cc->sysemu_ops = &loongarch_sysemu_ops;
>>   #endif
>> diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
>> index fa371ca8ba..033081593c 100644
>> --- a/target/loongarch/cpu.h
>> +++ b/target/loongarch/cpu.h
>> @@ -371,6 +371,7 @@ struct ArchCPU {
>>   CPUNegativeOffsetState neg;
>>   CPULoongArchState env;
>>   QEMUTimer timer;
>> +    uint32_t  phy_id;
>>     /* 'compatible' string for this CPU for Linux device trees */
>>   const char *dtb_compatible;
>>
> 

[PATCH v11 7/9] gfxstream + rutabaga: meson support

[Gurchetan Singh]

- Add meson detection of rutabaga_gfx
- Build virtio-gpu-rutabaga.c + associated vga/pci files when
  present

Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Tested-by: Emmanouil Pitsidianakis 
Reviewed-by: Emmanouil Pitsidianakis 
---
v3: Fix alignment issues (Akihiko)

 hw/display/meson.build| 22 ++
 meson.build   |  7 +++
 meson_options.txt |  2 ++
 scripts/meson-buildoptions.sh |  3 +++
 4 files changed, 34 insertions(+)

diff --git a/hw/display/meson.build b/hw/display/meson.build
index 413ba4ab24..e362d625dd 100644
--- a/hw/display/meson.build
+++ b/hw/display/meson.build
@@ -79,6 +79,13 @@ if config_all_devices.has_key('CONFIG_VIRTIO_GPU')
  if_true: [files('virtio-gpu-gl.c', 
'virtio-gpu-virgl.c'), pixman, virgl])
 hw_display_modules += {'virtio-gpu-gl': virtio_gpu_gl_ss}
   endif
+
+  if rutabaga.found()
+virtio_gpu_rutabaga_ss = ss.source_set()
+virtio_gpu_rutabaga_ss.add(when: ['CONFIG_VIRTIO_GPU', rutabaga],
+   if_true: [files('virtio-gpu-rutabaga.c'), 
pixman])
+hw_display_modules += {'virtio-gpu-rutabaga': virtio_gpu_rutabaga_ss}
+  endif
 endif
 
 if config_all_devices.has_key('CONFIG_VIRTIO_PCI')
@@ -95,6 +102,12 @@ if config_all_devices.has_key('CONFIG_VIRTIO_PCI')
  if_true: [files('virtio-gpu-pci-gl.c'), pixman])
 hw_display_modules += {'virtio-gpu-pci-gl': virtio_gpu_pci_gl_ss}
   endif
+  if rutabaga.found()
+virtio_gpu_pci_rutabaga_ss = ss.source_set()
+virtio_gpu_pci_rutabaga_ss.add(when: ['CONFIG_VIRTIO_GPU', 
'CONFIG_VIRTIO_PCI', rutabaga],
+   if_true: 
[files('virtio-gpu-pci-rutabaga.c'), pixman])
+hw_display_modules += {'virtio-gpu-pci-rutabaga': 
virtio_gpu_pci_rutabaga_ss}
+  endif
 endif
 
 if config_all_devices.has_key('CONFIG_VIRTIO_VGA')
@@ -113,6 +126,15 @@ if config_all_devices.has_key('CONFIG_VIRTIO_VGA')
   virtio_vga_gl_ss.add(when: 'CONFIG_ACPI', if_true: files('acpi-vga.c'),
 if_false: files('acpi-vga-stub.c'))
   hw_display_modules += {'virtio-vga-gl': virtio_vga_gl_ss}
+
+  if rutabaga.found()
+virtio_vga_rutabaga_ss = ss.source_set()
+virtio_vga_rutabaga_ss.add(when: ['CONFIG_VIRTIO_VGA', rutabaga],
+   if_true: [files('virtio-vga-rutabaga.c'), 
pixman])
+virtio_vga_rutabaga_ss.add(when: 'CONFIG_ACPI', if_true: 
files('acpi-vga.c'),
+if_false: 
files('acpi-vga-stub.c'))
+hw_display_modules += {'virtio-vga-rutabaga': virtio_vga_rutabaga_ss}
+  endif
 endif
 
 system_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_lcdc.c'))
diff --git a/meson.build b/meson.build
index 98e68ef0b1..293f388e53 100644
--- a/meson.build
+++ b/meson.build
@@ -1069,6 +1069,12 @@ if not get_option('virglrenderer').auto() or have_system 
or have_vhost_user_gpu
dependencies: virgl))
   endif
 endif
+rutabaga = not_found
+if not get_option('rutabaga_gfx').auto() or have_system or have_vhost_user_gpu
+  rutabaga = dependency('rutabaga_gfx_ffi',
+ method: 'pkg-config',
+ required: get_option('rutabaga_gfx'))
+endif
 blkio = not_found
 if not get_option('blkio').auto() or have_block
   blkio = dependency('blkio',
@@ -4272,6 +4278,7 @@ summary_info += {'libtasn1':  tasn1}
 summary_info += {'PAM':   pam}
 summary_info += {'iconv support': iconv}
 summary_info += {'virgl support': virgl}
+summary_info += {'rutabaga support':  rutabaga}
 summary_info += {'blkio support': blkio}
 summary_info += {'curl support':  curl}
 summary_info += {'Multipath support': mpathpersist}
diff --git a/meson_options.txt b/meson_options.txt
index aaea5ddd77..dea3bf7d9c 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -224,6 +224,8 @@ option('vmnet', type : 'feature', value : 'auto',
description: 'vmnet.framework network backend support')
 option('virglrenderer', type : 'feature', value : 'auto',
description: 'virgl rendering support')
+option('rutabaga_gfx', type : 'feature', value : 'auto',
+   description: 'rutabaga_gfx support')
 option('png', type : 'feature', value : 'auto',
description: 'PNG support with libpng')
 option('vnc', type : 'feature', value : 'auto',
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 9da3fe299b..9a95b4f782 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -154,6 +154,7 @@ meson_options_help() {
   printf "%s\n" '  rbd Ceph block device driver'
   printf "%s\n" '  rdmaEnable RDMA-based migration'
   printf "%s\n" '  replication replication support'
+  printf "%s\n" '  rutabaga-gfxrutabaga_gfx support'
   printf "%s\n" '  sdl SDL user interface'
   printf "%s\n" '  sdl-image

[PATCH v11 8/9] gfxstream + rutabaga: enable rutabaga

[Gurchetan Singh]

This change enables rutabaga to receive virtio-gpu-3d hypercalls
when it is active.

Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Tested-by: Emmanouil Pitsidianakis 
Reviewed-by: Emmanouil Pitsidianakis 
---
v3: Whitespace fix (Akihiko)
v9: reorder virtio_gpu_have_udmabuf() after checking if rutabaga
is enabled to avoid spurious warnings (Akihiko)

 hw/display/virtio-gpu-base.c | 3 ++-
 hw/display/virtio-gpu.c  | 5 +++--
 softmmu/qdev-monitor.c   | 3 +++
 softmmu/vl.c | 1 +
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index 4f2b0ba1f3..50c5373b65 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -223,7 +223,8 @@ virtio_gpu_base_get_features(VirtIODevice *vdev, uint64_t 
features,
 {
 VirtIOGPUBase *g = VIRTIO_GPU_BASE(vdev);
 
-if (virtio_gpu_virgl_enabled(g->conf)) {
+if (virtio_gpu_virgl_enabled(g->conf) ||
+virtio_gpu_rutabaga_enabled(g->conf)) {
 features |= (1 << VIRTIO_GPU_F_VIRGL);
 }
 if (virtio_gpu_edid_enabled(g->conf)) {
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 3e658f1fef..fe094addef 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1361,8 +1361,9 @@ void virtio_gpu_device_realize(DeviceState *qdev, Error 
**errp)
 VirtIOGPU *g = VIRTIO_GPU(qdev);
 
 if (virtio_gpu_blob_enabled(g->parent_obj.conf)) {
-if (!virtio_gpu_have_udmabuf()) {
-error_setg(errp, "cannot enable blob resources without udmabuf");
+if (!virtio_gpu_rutabaga_enabled(g->parent_obj.conf) &&
+!virtio_gpu_have_udmabuf()) {
+error_setg(errp, "need rutabaga or udmabuf for blob resources");
 return;
 }
 
diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
index 74f4e41338..1b8005ae55 100644
--- a/softmmu/qdev-monitor.c
+++ b/softmmu/qdev-monitor.c
@@ -86,6 +86,9 @@ static const QDevAlias qdev_alias_table[] = {
 { "virtio-gpu-pci", "virtio-gpu", QEMU_ARCH_VIRTIO_PCI },
 { "virtio-gpu-gl-device", "virtio-gpu-gl", QEMU_ARCH_VIRTIO_MMIO },
 { "virtio-gpu-gl-pci", "virtio-gpu-gl", QEMU_ARCH_VIRTIO_PCI },
+{ "virtio-gpu-rutabaga-device", "virtio-gpu-rutabaga",
+  QEMU_ARCH_VIRTIO_MMIO },
+{ "virtio-gpu-rutabaga-pci", "virtio-gpu-rutabaga", QEMU_ARCH_VIRTIO_PCI },
 { "virtio-input-host-device", "virtio-input-host", QEMU_ARCH_VIRTIO_MMIO },
 { "virtio-input-host-ccw", "virtio-input-host", QEMU_ARCH_VIRTIO_CCW },
 { "virtio-input-host-pci", "virtio-input-host", QEMU_ARCH_VIRTIO_PCI },
diff --git a/softmmu/vl.c b/softmmu/vl.c
index b0b96f67fa..2f98eefdf3 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -216,6 +216,7 @@ static struct {
 { .driver = "ati-vga",  .flag = &default_vga   },
 { .driver = "vhost-user-vga",   .flag = &default_vga   },
 { .driver = "virtio-vga-gl",.flag = &default_vga   },
+{ .driver = "virtio-vga-rutabaga",  .flag = &default_vga   },
 };
 
 static QemuOptsList qemu_rtc_opts = {
-- 
2.42.0.rc1.204.g551eb34607-goog

[PATCH v11 1/9] virtio: Add shared memory capability

[Gurchetan Singh]

From: "Dr. David Alan Gilbert" 

Define a new capability type 'VIRTIO_PCI_CAP_SHARED_MEMORY_CFG' to allow
defining shared memory regions with sizes and offsets of 2^32 and more.
Multiple instances of the capability are allowed and distinguished
by a device-specific 'id'.

Signed-off-by: Dr. David Alan Gilbert 
Signed-off-by: Antonio Caggiano 
Reviewed-by: Gurchetan Singh 
Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Acked-by: Huang Rui 
Tested-by: Huang Rui 
Reviewed-by: Akihiko Odaki 
---
 hw/virtio/virtio-pci.c | 18 ++
 include/hw/virtio/virtio-pci.h |  4 
 2 files changed, 22 insertions(+)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index edbc0daa18..da8c9ea12d 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1435,6 +1435,24 @@ static int virtio_pci_add_mem_cap(VirtIOPCIProxy *proxy,
 return offset;
 }
 
+int virtio_pci_add_shm_cap(VirtIOPCIProxy *proxy,
+   uint8_t bar, uint64_t offset, uint64_t length,
+   uint8_t id)
+{
+struct virtio_pci_cap64 cap = {
+.cap.cap_len = sizeof cap,
+.cap.cfg_type = VIRTIO_PCI_CAP_SHARED_MEMORY_CFG,
+};
+
+cap.cap.bar = bar;
+cap.cap.length = cpu_to_le32(length);
+cap.length_hi = cpu_to_le32(length >> 32);
+cap.cap.offset = cpu_to_le32(offset);
+cap.offset_hi = cpu_to_le32(offset >> 32);
+cap.cap.id = id;
+return virtio_pci_add_mem_cap(proxy, &cap.cap);
+}
+
 static uint64_t virtio_pci_common_read(void *opaque, hwaddr addr,
unsigned size)
 {
diff --git a/include/hw/virtio/virtio-pci.h b/include/hw/virtio/virtio-pci.h
index ab2051b64b..5a3f182f99 100644
--- a/include/hw/virtio/virtio-pci.h
+++ b/include/hw/virtio/virtio-pci.h
@@ -264,4 +264,8 @@ unsigned virtio_pci_optimal_num_queues(unsigned 
fixed_queues);
 void virtio_pci_set_guest_notifier_fd_handler(VirtIODevice *vdev, VirtQueue 
*vq,
   int n, bool assign,
   bool with_irqfd);
+
+int virtio_pci_add_shm_cap(VirtIOPCIProxy *proxy, uint8_t bar, uint64_t offset,
+   uint64_t length, uint8_t id);
+
 #endif
-- 
2.42.0.rc1.204.g551eb34607-goog

[PATCH v11 9/9] docs/system: add basic virtio-gpu documentation

[Gurchetan Singh]

This adds basic documentation for virtio-gpu.

Suggested-by: Akihiko Odaki 
Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Tested-by: Emmanouil Pitsidianakis 
Reviewed-by: Emmanouil Pitsidianakis 
---
v2: - Incorporated suggestions by Akihiko Odaki
- Listed the currently supported capset_names (Bernard)

v3: - Incorporated suggestions by Akihiko Odaki and Alyssa Ross

v4: - Incorporated suggestions by Akihiko Odaki

v5: - Removed pci suffix from examples
- Verified that -device virtio-gpu-rutabaga works.  Strangely
  enough, I don't remember changing anything, and I remember
  it not working.  I did rebase to top of tree though.
- Fixed meson examples in crosvm docs

v8: - Remove different links for "rutabaga_gfx" and
  "gfxstream-enabled rutabaga" (Akihiko)

v11: - GPL-2.0-or-later license (Phillippe)

 docs/system/device-emulation.rst   |   1 +
 docs/system/devices/virtio-gpu.rst | 112 +
 2 files changed, 113 insertions(+)
 create mode 100644 docs/system/devices/virtio-gpu.rst

diff --git a/docs/system/device-emulation.rst b/docs/system/device-emulation.rst
index 4491c4cbf7..1167f3a9f2 100644
--- a/docs/system/device-emulation.rst
+++ b/docs/system/device-emulation.rst
@@ -91,6 +91,7 @@ Emulated Devices
devices/nvme.rst
devices/usb.rst
devices/vhost-user.rst
+   devices/virtio-gpu.rst
devices/virtio-pmem.rst
devices/vhost-user-rng.rst
devices/canokey.rst
diff --git a/docs/system/devices/virtio-gpu.rst 
b/docs/system/devices/virtio-gpu.rst
new file mode 100644
index 00..21465e4ce2
--- /dev/null
+++ b/docs/system/devices/virtio-gpu.rst
@@ -0,0 +1,112 @@
+..
+   SPDX-License-Identifier: GPL-2.0-or-later
+
+virtio-gpu
+==
+
+This document explains the setup and usage of the virtio-gpu device.
+The virtio-gpu device paravirtualizes the GPU and display controller.
+
+Linux kernel support
+
+
+virtio-gpu requires a guest Linux kernel built with the
+``CONFIG_DRM_VIRTIO_GPU`` option.
+
+QEMU virtio-gpu variants
+
+
+QEMU virtio-gpu device variants come in the following form:
+
+ * ``virtio-vga[-BACKEND]``
+ * ``virtio-gpu[-BACKEND][-INTERFACE]``
+ * ``vhost-user-vga``
+ * ``vhost-user-pci``
+
+**Backends:** QEMU provides a 2D virtio-gpu backend, and two accelerated
+backends: virglrenderer ('gl' device label) and rutabaga_gfx ('rutabaga'
+device label).  There is a vhost-user backend that runs the graphics stack
+in a separate process for improved isolation.
+
+**Interfaces:** QEMU further categorizes virtio-gpu device variants based
+on the interface exposed to the guest. The interfaces can be classified
+into VGA and non-VGA variants. The VGA ones are prefixed with virtio-vga
+or vhost-user-vga while the non-VGA ones are prefixed with virtio-gpu or
+vhost-user-gpu.
+
+The VGA ones always use the PCI interface, but for the non-VGA ones, the
+user can further pick between MMIO or PCI. For MMIO, the user can suffix
+the device name with -device, though vhost-user-gpu does not support MMIO.
+For PCI, the user can suffix it with -pci. Without these suffixes, the
+platform default will be chosen.
+
+virtio-gpu 2d
+-
+
+The default 2D backend only performs 2D operations. The guest needs to
+employ a software renderer for 3D graphics.
+
+Typically, the software renderer is provided by `Mesa`_ or `SwiftShader`_.
+Mesa's implementations (LLVMpipe, Lavapipe and virgl below) work out of box
+on typical modern Linux distributions.
+
+.. parsed-literal::
+-device virtio-gpu
+
+.. _Mesa: https://www.mesa3d.org/
+.. _SwiftShader: https://github.com/google/swiftshader
+
+virtio-gpu virglrenderer
+
+
+When using virgl accelerated graphics mode in the guest, OpenGL API calls
+are translated into an intermediate representation (see `Gallium3D`_). The
+intermediate representation is communicated to the host and the
+`virglrenderer`_ library on the host translates the intermediate
+representation back to OpenGL API calls.
+
+.. parsed-literal::
+-device virtio-gpu-gl
+
+.. _Gallium3D: https://www.freedesktop.org/wiki/Software/gallium/
+.. _virglrenderer: https://gitlab.freedesktop.org/virgl/virglrenderer/
+
+virtio-gpu rutabaga
+---
+
+virtio-gpu can also leverage rutabaga_gfx to provide `gfxstream`_
+rendering and `Wayland display passthrough`_.  With the gfxstream rendering
+mode, GLES and Vulkan calls are forwarded to the host with minimal
+modification.
+
+The crosvm book provides directions on how to build a `gfxstream-enabled
+rutabaga`_ and launch a `guest Wayland proxy`_.
+
+This device does require host blob support (``hostmem`` field below). The
+``hostmem`` field specifies the size of virtio-gpu host memory window.
+This is typically between 256M and 8G.
+
+At least one capset (see colon separated ``capset_names`` below) must be
+specified when starting the device.  The currently supported
+``capset_names`` are ``gfxstr

[PATCH v11 3/9] virtio-gpu: hostmem

[Gurchetan Singh]

From: Gerd Hoffmann 

Use VIRTIO_GPU_SHM_ID_HOST_VISIBLE as id for virtio-gpu.

Signed-off-by: Antonio Caggiano 
Tested-by: Alyssa Ross 
Acked-by: Michael S. Tsirkin 
---
 hw/display/virtio-gpu-pci.c| 14 ++
 hw/display/virtio-gpu.c|  1 +
 hw/display/virtio-vga.c| 33 -
 include/hw/virtio/virtio-gpu.h |  5 +
 4 files changed, 44 insertions(+), 9 deletions(-)

diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c
index 93f214ff58..da6a99f038 100644
--- a/hw/display/virtio-gpu-pci.c
+++ b/hw/display/virtio-gpu-pci.c
@@ -33,6 +33,20 @@ static void virtio_gpu_pci_base_realize(VirtIOPCIProxy 
*vpci_dev, Error **errp)
 DeviceState *vdev = DEVICE(g);
 int i;
 
+if (virtio_gpu_hostmem_enabled(g->conf)) {
+vpci_dev->msix_bar_idx = 1;
+vpci_dev->modern_mem_bar_idx = 2;
+memory_region_init(&g->hostmem, OBJECT(g), "virtio-gpu-hostmem",
+   g->conf.hostmem);
+pci_register_bar(&vpci_dev->pci_dev, 4,
+ PCI_BASE_ADDRESS_SPACE_MEMORY |
+ PCI_BASE_ADDRESS_MEM_PREFETCH |
+ PCI_BASE_ADDRESS_MEM_TYPE_64,
+ &g->hostmem);
+virtio_pci_add_shm_cap(vpci_dev, 4, 0, g->conf.hostmem,
+   VIRTIO_GPU_SHM_ID_HOST_VISIBLE);
+}
+
 virtio_pci_force_virtio_1(vpci_dev);
 if (!qdev_realize(vdev, BUS(&vpci_dev->bus), errp)) {
 return;
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index bbd5c6561a..48ef0d9fad 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1509,6 +1509,7 @@ static Property virtio_gpu_properties[] = {
  256 * MiB),
 DEFINE_PROP_BIT("blob", VirtIOGPU, parent_obj.conf.flags,
 VIRTIO_GPU_FLAG_BLOB_ENABLED, false),
+DEFINE_PROP_SIZE("hostmem", VirtIOGPU, parent_obj.conf.hostmem, 0),
 DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/display/virtio-vga.c b/hw/display/virtio-vga.c
index e6fb0aa876..c8552ff760 100644
--- a/hw/display/virtio-vga.c
+++ b/hw/display/virtio-vga.c
@@ -115,17 +115,32 @@ static void virtio_vga_base_realize(VirtIOPCIProxy 
*vpci_dev, Error **errp)
 pci_register_bar(&vpci_dev->pci_dev, 0,
  PCI_BASE_ADDRESS_MEM_PREFETCH, &vga->vram);
 
-/*
- * Configure virtio bar and regions
- *
- * We use bar #2 for the mmio regions, to be compatible with stdvga.
- * virtio regions are moved to the end of bar #2, to make room for
- * the stdvga mmio registers at the start of bar #2.
- */
-vpci_dev->modern_mem_bar_idx = 2;
-vpci_dev->msix_bar_idx = 4;
 vpci_dev->modern_io_bar_idx = 5;
 
+if (!virtio_gpu_hostmem_enabled(g->conf)) {
+/*
+ * Configure virtio bar and regions
+ *
+ * We use bar #2 for the mmio regions, to be compatible with stdvga.
+ * virtio regions are moved to the end of bar #2, to make room for
+ * the stdvga mmio registers at the start of bar #2.
+ */
+vpci_dev->modern_mem_bar_idx = 2;
+vpci_dev->msix_bar_idx = 4;
+} else {
+vpci_dev->msix_bar_idx = 1;
+vpci_dev->modern_mem_bar_idx = 2;
+memory_region_init(&g->hostmem, OBJECT(g), "virtio-gpu-hostmem",
+   g->conf.hostmem);
+pci_register_bar(&vpci_dev->pci_dev, 4,
+ PCI_BASE_ADDRESS_SPACE_MEMORY |
+ PCI_BASE_ADDRESS_MEM_PREFETCH |
+ PCI_BASE_ADDRESS_MEM_TYPE_64,
+ &g->hostmem);
+virtio_pci_add_shm_cap(vpci_dev, 4, 0, g->conf.hostmem,
+   VIRTIO_GPU_SHM_ID_HOST_VISIBLE);
+}
+
 if (!(vpci_dev->flags & VIRTIO_PCI_FLAG_PAGE_PER_VQ)) {
 /*
  * with page-per-vq=off there is no padding space we can use
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 8377c365ef..de4f624e94 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -108,12 +108,15 @@ enum virtio_gpu_base_conf_flags {
 (_cfg.flags & (1 << VIRTIO_GPU_FLAG_BLOB_ENABLED))
 #define virtio_gpu_context_init_enabled(_cfg) \
 (_cfg.flags & (1 << VIRTIO_GPU_FLAG_CONTEXT_INIT_ENABLED))
+#define virtio_gpu_hostmem_enabled(_cfg) \
+(_cfg.hostmem > 0)
 
 struct virtio_gpu_base_conf {
 uint32_t max_outputs;
 uint32_t flags;
 uint32_t xres;
 uint32_t yres;
+uint64_t hostmem;
 };
 
 struct virtio_gpu_ctrl_command {
@@ -137,6 +140,8 @@ struct VirtIOGPUBase {
 int renderer_blocked;
 int enable;
 
+MemoryRegion hostmem;
+
 struct virtio_gpu_scanout scanout[VIRTIO_GPU_MAX_SCANOUTS];
 
 int enabled_output_bitmask;
-- 
2.42.0.rc1.204.g551eb34607-goog

[PATCH v11 6/9] gfxstream + rutabaga: add initial support for gfxstream

[Gurchetan Singh]

This adds initial support for gfxstream and cross-domain.  Both
features rely on virtio-gpu blob resources and context types, which
are also implemented in this patch.

gfxstream has a long and illustrious history in Android graphics
paravirtualization.  It has been powering graphics in the Android
Studio Emulator for more than a decade, which is the main developer
platform.

Originally conceived by Jesse Hall, it was first known as "EmuGL" [a].
The key design characteristic was a 1:1 threading model and
auto-generation, which fit nicely with the OpenGLES spec.  It also
allowed easy layering with ANGLE on the host, which provides the GLES
implementations on Windows or MacOS enviroments.

gfxstream has traditionally been maintained by a single engineer, and
between 2015 to 2021, the goldfish throne passed to Frank Yang.
Historians often remark this glorious reign ("pax gfxstreama" is the
academic term) was comparable to that of Augustus and both Queen
Elizabeths.  Just to name a few accomplishments in a resplendent
panoply: higher versions of GLES, address space graphics, snapshot
support and CTS compliant Vulkan [b].

One major drawback was the use of out-of-tree goldfish drivers.
Android engineers didn't know much about DRM/KMS and especially TTM so
a simple guest to host pipe was conceived.

Luckily, virtio-gpu 3D started to emerge in 2016 due to the work of
the Mesa/virglrenderer communities.  In 2018, the initial virtio-gpu
port of gfxstream was done by Cuttlefish enthusiast Alistair Delva.
It was a symbol compatible replacement of virglrenderer [c] and named
"AVDVirglrenderer".  This implementation forms the basis of the
current gfxstream host implementation still in use today.

cross-domain support follows a similar arc.  Originally conceived by
Wayland aficionado David Reveman and crosvm enjoyer Zach Reizner in
2018, it initially relied on the downstream "virtio-wl" device.

In 2020 and 2021, virtio-gpu was extended to include blob resources
and multiple timelines by yours truly, features gfxstream/cross-domain
both require to function correctly.

Right now, we stand at the precipice of a truly fantastic possibility:
the Android Emulator powered by upstream QEMU and upstream Linux
kernel.  gfxstream will then be packaged properfully, and app
developers can even fix gfxstream bugs on their own if they encounter
them.

It's been quite the ride, my friends.  Where will gfxstream head next,
nobody really knows.  I wouldn't be surprised if it's around for
another decade, maintained by a new generation of Android graphics
enthusiasts.

Technical details:
  - Very simple initial display integration: just used Pixman
  - Largely, 1:1 mapping of virtio-gpu hypercalls to rutabaga function
calls

Next steps for Android VMs:
  - The next step would be improving display integration and UI interfaces
with the goal of the QEMU upstream graphics being in an emulator
release [d].

Next steps for Linux VMs for display virtualization:
  - For widespread distribution, someone needs to package Sommelier or the
wayland-proxy-virtwl [e] ideally into Debian main. In addition, newer
versions of the Linux kernel come with DRM_VIRTIO_GPU_KMS option,
which allows disabling KMS hypercalls.  If anyone cares enough, it'll
probably be possible to build a custom VM variant that uses this display
virtualization strategy.

[a] https://android-review.googlesource.com/c/platform/development/+/34470
[b] 
https://android-review.googlesource.com/q/topic:%22vulkan-hostconnection-start%22
[c] 
https://android-review.googlesource.com/c/device/generic/goldfish-opengl/+/761927
[d] https://developer.android.com/studio/releases/emulator
[e] https://github.com/talex5/wayland-proxy-virtwl

Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Tested-by: Emmanouil Pitsidianakis 
Reviewed-by: Emmanouil Pitsidianakis 
---
v1: Incorported various suggestions by Akihiko Odaki and Bernard Berschow
- Removed GET_VIRTIO_GPU_GL / GET_RUTABAGA macros
- Used error_report(..)
- Used g_autofree to fix leaks on error paths
- Removed unnecessary casts
- added virtio-gpu-pci-rutabaga.c + virtio-vga-rutabaga.c files

v2: Incorported various suggestions by Akihiko Odaki, Marc-André Lureau and
Bernard Berschow:
- Parenthesis in CHECK macro
- CHECK_RESULT(result, ..) --> CHECK(!result, ..)
- delay until g->parent_obj.enable = 1
- Additional cast fixes
- initialize directly in virtio_gpu_rutabaga_realize(..)
- add debug callback to hook into QEMU error's APIs

v3: Incorporated feedback from Akihiko Odaki and Alyssa Ross:
- Autodetect Wayland socket when not explicitly specified
- Fix map_blob error paths
- Add comment why we need both `res` and `resource` in create blob
- Cast and whitespace fixes
- Big endian check comes before virtio_gpu_rutabaga_init().
- VirtIOVGARUTABAGA --> VirtIOVGARutabaga

v4: Incorporated feedback from Akihiko Odaki and Alyssa Ross:

[PATCH v11 5/9] gfxstream + rutabaga prep: added need defintions, fields, and options

[Gurchetan Singh]

This modifies the common virtio-gpu.h file have the fields and
defintions needed by gfxstream/rutabaga, by VirtioGpuRutabaga.

Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Tested-by: Emmanouil Pitsidianakis 
Reviewed-by: Emmanouil Pitsidianakis 
---
v1: void *rutabaga --> struct rutabaga *rutabaga (Akihiko)
have a separate rutabaga device instead of using GL device (Bernard)

v2: VirtioGpuRutabaga --> VirtIOGPURutabaga (Akihiko)
move MemoryRegionInfo into VirtIOGPURutabaga (Akihiko)
remove 'ctx' field (Akihiko)
remove 'rutabaga_active'

v6: remove command from commit message, refer to docs instead (Manos)

 include/hw/virtio/virtio-gpu.h | 28 
 1 file changed, 28 insertions(+)

diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 55973e112f..e2a07e68d9 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -38,6 +38,9 @@ OBJECT_DECLARE_SIMPLE_TYPE(VirtIOGPUGL, VIRTIO_GPU_GL)
 #define TYPE_VHOST_USER_GPU "vhost-user-gpu"
 OBJECT_DECLARE_SIMPLE_TYPE(VhostUserGPU, VHOST_USER_GPU)
 
+#define TYPE_VIRTIO_GPU_RUTABAGA "virtio-gpu-rutabaga-device"
+OBJECT_DECLARE_SIMPLE_TYPE(VirtIOGPURutabaga, VIRTIO_GPU_RUTABAGA)
+
 struct virtio_gpu_simple_resource {
 uint32_t resource_id;
 uint32_t width;
@@ -94,6 +97,7 @@ enum virtio_gpu_base_conf_flags {
 VIRTIO_GPU_FLAG_DMABUF_ENABLED,
 VIRTIO_GPU_FLAG_BLOB_ENABLED,
 VIRTIO_GPU_FLAG_CONTEXT_INIT_ENABLED,
+VIRTIO_GPU_FLAG_RUTABAGA_ENABLED,
 };
 
 #define virtio_gpu_virgl_enabled(_cfg) \
@@ -108,6 +112,8 @@ enum virtio_gpu_base_conf_flags {
 (_cfg.flags & (1 << VIRTIO_GPU_FLAG_BLOB_ENABLED))
 #define virtio_gpu_context_init_enabled(_cfg) \
 (_cfg.flags & (1 << VIRTIO_GPU_FLAG_CONTEXT_INIT_ENABLED))
+#define virtio_gpu_rutabaga_enabled(_cfg) \
+(_cfg.flags & (1 << VIRTIO_GPU_FLAG_RUTABAGA_ENABLED))
 #define virtio_gpu_hostmem_enabled(_cfg) \
 (_cfg.hostmem > 0)
 
@@ -232,6 +238,28 @@ struct VhostUserGPU {
 bool backend_blocked;
 };
 
+#define MAX_SLOTS 4096
+
+struct MemoryRegionInfo {
+int used;
+MemoryRegion mr;
+uint32_t resource_id;
+};
+
+struct rutabaga;
+
+struct VirtIOGPURutabaga {
+struct VirtIOGPU parent_obj;
+
+struct MemoryRegionInfo memory_regions[MAX_SLOTS];
+char *capset_names;
+char *wayland_socket_path;
+char *wsi;
+bool headless;
+uint32_t num_capsets;
+struct rutabaga *rutabaga;
+};
+
 #define VIRTIO_GPU_FILL_CMD(out) do {   \
 size_t s;   \
 s = iov_to_buf(cmd->elem.out_sg, cmd->elem.out_num, 0,  \
-- 
2.42.0.rc1.204.g551eb34607-goog

[PATCH v11 4/9] virtio-gpu: blob prep

[Gurchetan Singh]

From: Antonio Caggiano 

This adds preparatory functions needed to:

 - decode blob cmds
 - tracking iovecs

Signed-off-by: Antonio Caggiano 
Signed-off-by: Dmitry Osipenko 
Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Tested-by: Emmanouil Pitsidianakis 
Reviewed-by: Emmanouil Pitsidianakis 
---
 hw/display/virtio-gpu.c  | 10 +++---
 include/hw/virtio/virtio-gpu-bswap.h | 18 ++
 include/hw/virtio/virtio-gpu.h   |  5 +
 3 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 48ef0d9fad..3e658f1fef 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -33,15 +33,11 @@
 
 #define VIRTIO_GPU_VM_VERSION 1
 
-static struct virtio_gpu_simple_resource*
-virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id);
 static struct virtio_gpu_simple_resource *
 virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t resource_id,
bool require_backing,
const char *caller, uint32_t *error);
 
-static void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
-   struct virtio_gpu_simple_resource *res);
 static void virtio_gpu_reset_bh(void *opaque);
 
 void virtio_gpu_update_cursor_data(VirtIOGPU *g,
@@ -116,7 +112,7 @@ static void update_cursor(VirtIOGPU *g, struct 
virtio_gpu_update_cursor *cursor)
   cursor->resource_id ? 1 : 0);
 }
 
-static struct virtio_gpu_simple_resource *
+struct virtio_gpu_simple_resource *
 virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id)
 {
 struct virtio_gpu_simple_resource *res;
@@ -904,8 +900,8 @@ void virtio_gpu_cleanup_mapping_iov(VirtIOGPU *g,
 g_free(iov);
 }
 
-static void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
-   struct virtio_gpu_simple_resource *res)
+void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
+struct virtio_gpu_simple_resource *res)
 {
 virtio_gpu_cleanup_mapping_iov(g, res->iov, res->iov_cnt);
 res->iov = NULL;
diff --git a/include/hw/virtio/virtio-gpu-bswap.h 
b/include/hw/virtio/virtio-gpu-bswap.h
index 9124108485..dd1975e2d4 100644
--- a/include/hw/virtio/virtio-gpu-bswap.h
+++ b/include/hw/virtio/virtio-gpu-bswap.h
@@ -63,10 +63,28 @@ virtio_gpu_create_blob_bswap(struct 
virtio_gpu_resource_create_blob *cblob)
 {
 virtio_gpu_ctrl_hdr_bswap(&cblob->hdr);
 le32_to_cpus(&cblob->resource_id);
+le32_to_cpus(&cblob->blob_mem);
 le32_to_cpus(&cblob->blob_flags);
+le32_to_cpus(&cblob->nr_entries);
+le64_to_cpus(&cblob->blob_id);
 le64_to_cpus(&cblob->size);
 }
 
+static inline void
+virtio_gpu_map_blob_bswap(struct virtio_gpu_resource_map_blob *mblob)
+{
+virtio_gpu_ctrl_hdr_bswap(&mblob->hdr);
+le32_to_cpus(&mblob->resource_id);
+le64_to_cpus(&mblob->offset);
+}
+
+static inline void
+virtio_gpu_unmap_blob_bswap(struct virtio_gpu_resource_unmap_blob *ublob)
+{
+virtio_gpu_ctrl_hdr_bswap(&ublob->hdr);
+le32_to_cpus(&ublob->resource_id);
+}
+
 static inline void
 virtio_gpu_scanout_blob_bswap(struct virtio_gpu_set_scanout_blob *ssb)
 {
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index de4f624e94..55973e112f 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -257,6 +257,9 @@ void virtio_gpu_base_fill_display_info(VirtIOGPUBase *g,
 void virtio_gpu_base_generate_edid(VirtIOGPUBase *g, int scanout,
struct virtio_gpu_resp_edid *edid);
 /* virtio-gpu.c */
+struct virtio_gpu_simple_resource *
+virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id);
+
 void virtio_gpu_ctrl_response(VirtIOGPU *g,
   struct virtio_gpu_ctrl_command *cmd,
   struct virtio_gpu_ctrl_hdr *resp,
@@ -275,6 +278,8 @@ int virtio_gpu_create_mapping_iov(VirtIOGPU *g,
   uint32_t *niov);
 void virtio_gpu_cleanup_mapping_iov(VirtIOGPU *g,
 struct iovec *iov, uint32_t count);
+void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
+struct virtio_gpu_simple_resource *res);
 void virtio_gpu_process_cmdq(VirtIOGPU *g);
 void virtio_gpu_device_realize(DeviceState *qdev, Error **errp);
 void virtio_gpu_reset(VirtIODevice *vdev);
-- 
2.42.0.rc1.204.g551eb34607-goog

[PATCH v11 0/9] rutabaga_gfx + gfxstream

[Gurchetan Singh]

From: Gurchetan Singh 

Changes since v10:
- Licensing and comment fixes

- Official "release commits" issued for rutabaga_gfx_ffi,
  gfxstream, aemu-base.  For example, see crrev.com/c/4778941

- The release commits can make packaging easier, though once
  again all known users will likely just build from sources
  anyways

How to build both rutabaga and gfxstream guest/host libs:

https://crosvm.dev/book/appendix/rutabaga_gfx.html

Branch containing this patch series:

https://gitlab.freedesktop.org/gurchetansingh/qemu-gfxstream/-/commits/qemu-gfxstream-v11

Antonio Caggiano (2):
  virtio-gpu: CONTEXT_INIT feature
  virtio-gpu: blob prep

Dr. David Alan Gilbert (1):
  virtio: Add shared memory capability

Gerd Hoffmann (1):
  virtio-gpu: hostmem

Gurchetan Singh (5):
  gfxstream + rutabaga prep: added need defintions, fields, and options
  gfxstream + rutabaga: add initial support for gfxstream
  gfxstream + rutabaga: meson support
  gfxstream + rutabaga: enable rutabaga
  docs/system: add basic virtio-gpu documentation

 docs/system/device-emulation.rst |1 +
 docs/system/devices/virtio-gpu.rst   |  112 +++
 hw/display/meson.build   |   22 +
 hw/display/virtio-gpu-base.c |6 +-
 hw/display/virtio-gpu-pci-rutabaga.c |   50 ++
 hw/display/virtio-gpu-pci.c  |   14 +
 hw/display/virtio-gpu-rutabaga.c | 1121 ++
 hw/display/virtio-gpu.c  |   16 +-
 hw/display/virtio-vga-rutabaga.c |   53 ++
 hw/display/virtio-vga.c  |   33 +-
 hw/virtio/virtio-pci.c   |   18 +
 include/hw/virtio/virtio-gpu-bswap.h |   18 +
 include/hw/virtio/virtio-gpu.h   |   41 +
 include/hw/virtio/virtio-pci.h   |4 +
 meson.build  |7 +
 meson_options.txt|2 +
 scripts/meson-buildoptions.sh|3 +
 softmmu/qdev-monitor.c   |3 +
 softmmu/vl.c |1 +
 19 files changed, 1506 insertions(+), 19 deletions(-)
 create mode 100644 docs/system/devices/virtio-gpu.rst
 create mode 100644 hw/display/virtio-gpu-pci-rutabaga.c
 create mode 100644 hw/display/virtio-gpu-rutabaga.c
 create mode 100644 hw/display/virtio-vga-rutabaga.c

-- 
2.42.0.rc1.204.g551eb34607-goog

[PATCH v11 2/9] virtio-gpu: CONTEXT_INIT feature

[Gurchetan Singh]

From: Antonio Caggiano 

The feature can be enabled when a backend wants it.

Signed-off-by: Antonio Caggiano 
Reviewed-by: Marc-André Lureau 
Signed-off-by: Gurchetan Singh 
Tested-by: Alyssa Ross 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Akihiko Odaki 
---
 hw/display/virtio-gpu-base.c   | 3 +++
 include/hw/virtio/virtio-gpu.h | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index ca1fb7b16f..4f2b0ba1f3 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -232,6 +232,9 @@ virtio_gpu_base_get_features(VirtIODevice *vdev, uint64_t 
features,
 if (virtio_gpu_blob_enabled(g->conf)) {
 features |= (1 << VIRTIO_GPU_F_RESOURCE_BLOB);
 }
+if (virtio_gpu_context_init_enabled(g->conf)) {
+features |= (1 << VIRTIO_GPU_F_CONTEXT_INIT);
+}
 
 return features;
 }
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 390c4642b8..8377c365ef 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -93,6 +93,7 @@ enum virtio_gpu_base_conf_flags {
 VIRTIO_GPU_FLAG_EDID_ENABLED,
 VIRTIO_GPU_FLAG_DMABUF_ENABLED,
 VIRTIO_GPU_FLAG_BLOB_ENABLED,
+VIRTIO_GPU_FLAG_CONTEXT_INIT_ENABLED,
 };
 
 #define virtio_gpu_virgl_enabled(_cfg) \
@@ -105,6 +106,8 @@ enum virtio_gpu_base_conf_flags {
 (_cfg.flags & (1 << VIRTIO_GPU_FLAG_DMABUF_ENABLED))
 #define virtio_gpu_blob_enabled(_cfg) \
 (_cfg.flags & (1 << VIRTIO_GPU_FLAG_BLOB_ENABLED))
+#define virtio_gpu_context_init_enabled(_cfg) \
+(_cfg.flags & (1 << VIRTIO_GPU_FLAG_CONTEXT_INIT_ENABLED))
 
 struct virtio_gpu_base_conf {
 uint32_t max_outputs;
-- 
2.42.0.rc1.204.g551eb34607-goog

Re: [PATCH] target/loongarch: cpu: Implement get_arch_id callback

[gaosong]

在 2023/8/22 下午8:26, Bibo Mao 写道:

Implement the callback for getting the architecture-dependent CPU
ID, the cpu ID is physical id described in ACPI MADT table, this
will be used for cpu hotplug.

Signed-off-by: Bibo Mao 
Change-Id: I53bcfb9f4279e491f33e8b99a9102534ad53409e
---


Drop Chang-Id.

Otherwise
Reviewed-by: Song Gao 

Thanks.
Song Gao


  hw/loongarch/virt.c| 2 ++
  target/loongarch/cpu.c | 8 
  target/loongarch/cpu.h | 1 +
  3 files changed, 11 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index e19b042ce8..6f6b577749 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -815,6 +815,8 @@ static void loongarch_init(MachineState *machine)
  cpu = cpu_create(machine->cpu_type);
  cpu->cpu_index = i;
  machine->possible_cpus->cpus[i].cpu = OBJECT(cpu);
+lacpu = LOONGARCH_CPU(cpu);
+lacpu->phy_id = machine->possible_cpus->cpus[i].arch_id;
  }
  fdt_add_cpu_nodes(lams);
  
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c

index ad93ecac92..7be3769672 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -690,6 +690,13 @@ static struct TCGCPUOps loongarch_tcg_ops = {
  static const struct SysemuCPUOps loongarch_sysemu_ops = {
  .get_phys_page_debug = loongarch_cpu_get_phys_page_debug,
  };
+
+static int64_t loongarch_cpu_get_arch_id(CPUState *cs)
+{
+LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+
+return cpu->phy_id;
+}
  #endif
  
  static gchar *loongarch_gdb_arch_name(CPUState *cs)

@@ -715,6 +722,7 @@ static void loongarch_cpu_class_init(ObjectClass *c, void 
*data)
  cc->set_pc = loongarch_cpu_set_pc;
  cc->get_pc = loongarch_cpu_get_pc;
  #ifndef CONFIG_USER_ONLY
+cc->get_arch_id = loongarch_cpu_get_arch_id;
  dc->vmsd = &vmstate_loongarch_cpu;
  cc->sysemu_ops = &loongarch_sysemu_ops;
  #endif
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index fa371ca8ba..033081593c 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -371,6 +371,7 @@ struct ArchCPU {
  CPUNegativeOffsetState neg;
  CPULoongArchState env;
  QEMUTimer timer;
+uint32_t  phy_id;
  
  /* 'compatible' string for this CPU for Linux device trees */

  const char *dtb_compatible;

[PATCH] target/arm: Fix bug in memory translation for executable Realm memory pages

[Matti Schulze]

This patch fixes a bug in the memory translation for target/arm.
If in realm space, e.g., R-EL2 executing code from an executable 
memory page currently results in a level 3 permission fault. 
As we cannot access secure memory from an insecure space, 
QEMU checks on each memory translation if the in_space is secure va 
!ptw->in_secure. 
If this is the case we always set the NS bit in the memory attributes
to prevent ever reading secure memory from an insecure space.
This collides with FEAT_RME, since if the system is in realm space,
!ptw->in_secure also applies, and thus QEMU sets the NS bit, 
meaning that the memory will be translated into insecure space.
Fetching the instruction from this memory space leads to a fault, 
as you cannot execute NS instructions from a realm context.
To fix this we introduce the ptw->in_realm variable mirroring the
behavior for in_secure and only set the NS bit if both do not apply.

Signed-off-by: Matti Schulze 
---
 target/arm/cpu.h |  6 ++
 target/arm/ptw.c | 17 +++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 88e5accda6..ff7f8f511d 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2436,6 +2436,12 @@ static inline bool arm_space_is_secure(ARMSecuritySpace 
space)
 return space == ARMSS_Secure || space == ARMSS_Root;
 }
 
+/* Return true if @space is Realm space */
+static inline bool arm_space_is_realm(ARMSecuritySpace space)
+{
+return space == ARMSS_Realm;
+}
+
 /* Return the ARMSecuritySpace for @secure, assuming !RME or EL[0-2]. */
 static inline ARMSecuritySpace arm_secure_to_space(bool secure)
 {
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 8f94100c61..db1b5a7fbd 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -58,6 +58,13 @@ typedef struct S1Translate {
  * this field is updated accordingly.
  */
 bool in_secure;
+/*
+ * in_realm: whether the translation regime is Realm
+ * This is always requal to arm_space_in_realm(in_space).
+ * If a Realm ptw is "downgraded" to a NonSecure by an NSTable bit
+ * this field is updated accordingly.
+ */
+bool in_realm;
 /*
  * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
  * accesses will not update the guest page table access flags
@@ -535,6 +542,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate 
*ptw,
 .in_mmu_idx = s2_mmu_idx,
 .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
 .in_secure = arm_space_is_secure(s2_space),
+.in_realm = arm_space_is_realm(s2_space),
 .in_space = s2_space,
 .in_debug = true,
 };
@@ -724,7 +732,7 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t 
old_val,
 fi->s2addr = ptw->out_virt;
 fi->stage2 = true;
 fi->s1ptw = true;
-fi->s1ns = !ptw->in_secure;
+fi->s1ns = !ptw->in_secure && !ptw->in_realm;
 return 0;
 }
 
@@ -1767,6 +1775,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, 
S1Translate *ptw,
 QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
 ptw->in_ptw_idx += 1;
 ptw->in_secure = false;
+ptw->in_realm = false;
 ptw->in_space = ARMSS_NonSecure;
 }
 
@@ -1872,7 +1881,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, 
S1Translate *ptw,
  */
 attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 
14));
 if (!regime_is_stage2(mmu_idx)) {
-attrs |= !ptw->in_secure << 5; /* NS */
+attrs |= (!ptw->in_secure && !ptw->in_realm) << 5; /* NS */
 if (!param.hpd) {
 attrs |= extract64(tableattrs, 0, 2) << 53; /* XN, PXN */
 /*
@@ -3139,6 +3148,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, 
S1Translate *ptw,
 ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
 ptw->in_secure = ipa_secure;
 ptw->in_space = ipa_space;
+ptw->in_realm = arm_space_is_realm(ipa_space);
 ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
 
 /*
@@ -3371,6 +3381,7 @@ bool get_phys_addr_with_secure(CPUARMState *env, 
target_ulong address,
 S1Translate ptw = {
 .in_mmu_idx = mmu_idx,
 .in_secure = is_secure,
+.in_realm = false,
 .in_space = arm_secure_to_space(is_secure),
 };
 return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
@@ -3443,6 +3454,7 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
 ptw.in_space = ss;
 ptw.in_secure = arm_space_is_secure(ss);
+ptw.in_realm = arm_space_is_realm(ss);
 return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
 }
 
@@ -3457,6 +3469,7 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, 
vaddr addr,
 .in_mmu_idx = mmu_idx,
 .in_space = ss,
 .in_secure = arm_space_is_secure(ss),
+.in_realm

Re: [PATCH qemu 2/2] dump: Only use the makedumpfile flattened format when necessary

[Stephen Brennan]

Stephen Brennan  writes:
> Marc-André Lureau  writes:
>> I am a bit reluctant to change the dump format by default. But since the
>> flatten format is more "complicated" than the "normal" format, perhaps we
>> can assume all users will handle it.
>>
>> The change is probably late for 8.1 though..
>
> Thank you for your review and testing!
>
> I totally understand the concern about making the change by default. I
> do believe that nobody should notice too much because the normal format
> should be easier to work with, and more broadly compatible. I don't know
> of any tool which deals with the flattened format that can't handle the
> normal format, except for "makedumpfile -R" itself.
>
> If it's a blocker, I can go ahead and add a new flag to the command to
> enable the behavior. However there are a few good justifications not to
> add a new flag. I think it's going to be difficult to explain the
> difference between the two formats in documentation, as the
> implementation of the formats is a bit "into the weeds". The libvirt API
> also specifies each format separately (kdump-zlib, kdump-lzo,
> kdump-snappy) and so adding several new options there would be
> unfortunate for end-users as well.
>
> At the end of the day, it's your judgment call, and I'll implement it
> how you prefer.

I just wanted to check back on this to clarify the next step. Are you
satisfied with this and waiting to apply it until the right time? Or
would you prefer me to send a new version making this opt-in?

Thanks,
Stephen

Re: [PATCH] tcg: Unify TCG_TARGET_HAS_extr[lh]_i64_i32

[Richard Henderson]

On 8/22/23 15:05, Philippe Mathieu-Daudé wrote:

On 22/8/23 19:51, Richard Henderson wrote:

Replace the separate defines with TCG_TARGET_HAS_extr_i64_i32,
so that the two parts of backend-specific type changing cannot
be out of sync.

Reported-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
  include/tcg/tcg-opc.h    | 4 ++--
  include/tcg/tcg.h    | 3 +--
  tcg/aarch64/tcg-target.h | 3 +--
  tcg/i386/tcg-target.h    | 3 +--
  tcg/loongarch64/tcg-target.h | 3 +--
  tcg/mips/tcg-target.h    | 3 +--
  tcg/ppc/tcg-target.h | 3 +--
  tcg/riscv/tcg-target.h   | 3 +--
  tcg/s390x/tcg-target.h   | 3 +--
  tcg/sparc64/tcg-target.h | 3 +--
  tcg/tci/tcg-target.h | 3 +--
  tcg/tcg-op.c | 4 ++--
  tcg/tcg.c    | 3 +--
  13 files changed, 15 insertions(+), 26 deletions(-)


Clever than what I was thinking of, thanks!

Reviewed-by: Philippe Mathieu-Daudé 



Queued to tcg-next.


r~

Re: [PATCH v7 10/12] virtio-sound: implement audio output (TX)

[Philippe Mathieu-Daudé]

Hi Emmanouil,

On 22/8/23 21:18, Emmanouil Pitsidianakis wrote:

Handle output IO messages in the transmit (TX) virtqueue.

It allocates a VirtIOSoundPCMBlock for each IO message and copies the
data buffer to it. When the IO buffer is written to the host's sound
card, the guest will be notified that it has been consumed.

The lifetime of an IO message is:

1. Guest sends IO message to TX virtqueue.
2. QEMU adds it to the appropriate stream's IO buffer queue.
3. Sometime later, the host audio backend calls the output callback,
virtio_snd_pcm_out_cb(), which is defined with an AUD_open_out()
call. The callback gets an available number of bytes the backend can
receive. Then it writes data from the IO buffer queue to the backend.
If at any time a buffer is exhausted, it is returned to the guest as
completed.
4. If the guest releases the stream, its buffer queue is flushed by
attempting to write any leftover data to the audio backend and
releasing all IO messages back to the guest. This is how according to
the spec the guest knows the release was successful.

Signed-off-by: Emmanouil Pitsidianakis 
---
  hw/virtio/trace-events |   2 +
  hw/virtio/virtio-snd.c | 250 -
  include/hw/virtio/virtio-snd.h |  11 ++
  3 files changed, 259 insertions(+), 4 deletions(-)

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 60ab62a80d..3b95e745c2 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -171,3 +171,5 @@ virtio_snd_handle_pcm_release(uint32_t stream) 
"VIRTIO_SND_PCM_RELEASE called fo
  virtio_snd_handle_code(uint32_t val, const char *code) "ctrl code msg val = 
%"PRIu32" == %s"
  virtio_snd_handle_chmap_info(void) "VIRTIO_SND_CHMAP_INFO called"
  virtio_snd_handle_event(void) "event queue callback called"
+virtio_snd_pcm_stream_flush(uint32_t stream) "flushing stream %"PRIu32
+virtio_snd_handle_xfer(void) "tx/rx queue callback called"




+/*
+ * The tx virtqueue handler. Makes the buffers available to their respective
+ * streams for consumption.
+ *
+ * @vdev: VirtIOSound device
+ * @vq: tx virtqueue
+ */
+static void virtio_snd_handle_tx(VirtIODevice *vdev, VirtQueue *vq)
+{
+VirtIOSound *s = VIRTIO_SND(vdev);
+VirtIOSoundPCMStream *stream = NULL;
+VirtQueueElement *elem;
+size_t sz;
+virtio_snd_pcm_xfer hdr;
+virtio_snd_pcm_status resp = { 0 };
+
+trace_virtio_snd_handle_xfer();


Maybe ...


+for (;;) {
+elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
+if (!elem) {
+break;
+}
+/* get the message hdr object */
+sz = iov_to_buf(elem->out_sg,
+elem->out_num,
+0,
+&hdr,
+sizeof(hdr));
+if (sz != sizeof(hdr)
+|| hdr.stream_id >= s->snd_conf.streams
+|| !s->pcm->streams[hdr.stream_id]) {
+goto tx_err;
+}


... it is more useful displaying the callback stream index here?

   trace_virtio_snd_handle_xfer(hdr.stream_id);


+
+stream = s->pcm->streams[hdr.stream_id];
+if (stream->direction != VIRTIO_SND_D_OUTPUT) {
+goto tx_err;
+}
+
+WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
+virtio_snd_pcm_read_write(stream,
+vq,
+elem,
+hdr.stream_id == VIRTIO_SND_D_INPUT);
+
+resp.status = VIRTIO_SND_S_OK;
+iov_from_buf(elem->in_sg,
+ elem->in_num,
+ 0,
+ &resp,
+ sizeof(resp));
+}
+continue;
+
+tx_err:
+WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
+resp.status = VIRTIO_SND_S_BAD_MSG;
+iov_from_buf(elem->in_sg,
+ elem->in_num,
+ 0,
+ &resp,
+ sizeof(resp));
+}
+}
+
+/*
+ * Notify vq about virtio_snd_pcm_status responses.
+ * Buffer responses must be notified separately later.
+ */
+virtio_notify(VIRTIO_DEVICE(s), vq);
+}

Re: [PATCH v3 2/3] linux-user: Exit not abort in die_with_backtrace

[Philippe Mathieu-Daudé]

On 22/8/23 22:34, Richard Henderson wrote:

This line is supposed to be unreachable, but if we're going to
have it at all, SIGABRT via abort() is subject to the same signal
peril that created this function in the first place.


:)

Reviewed-by: Philippe Mathieu-Daudé 


We can _exit immediately without peril.

Signed-off-by: Richard Henderson 
---
  linux-user/signal.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

Re: [PATCH v3 1/3] linux-user: Split out die_with_signal

[Philippe Mathieu-Daudé]

On 22/8/23 22:34, Richard Henderson wrote:

Because we trap so many signals for use by the guest,
we have to take extra steps to exit properly.

Signed-off-by: Richard Henderson 
---
  linux-user/signal.c | 52 -
  1 file changed, 28 insertions(+), 24 deletions(-)


Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH] tcg: Unify TCG_TARGET_HAS_extr[lh]_i64_i32

[Philippe Mathieu-Daudé]

On 22/8/23 19:51, Richard Henderson wrote:

Replace the separate defines with TCG_TARGET_HAS_extr_i64_i32,
so that the two parts of backend-specific type changing cannot
be out of sync.

Reported-by: Philippe Mathieu-Daudé 
Signed-off-by: Richard Henderson 
---
  include/tcg/tcg-opc.h| 4 ++--
  include/tcg/tcg.h| 3 +--
  tcg/aarch64/tcg-target.h | 3 +--
  tcg/i386/tcg-target.h| 3 +--
  tcg/loongarch64/tcg-target.h | 3 +--
  tcg/mips/tcg-target.h| 3 +--
  tcg/ppc/tcg-target.h | 3 +--
  tcg/riscv/tcg-target.h   | 3 +--
  tcg/s390x/tcg-target.h   | 3 +--
  tcg/sparc64/tcg-target.h | 3 +--
  tcg/tci/tcg-target.h | 3 +--
  tcg/tcg-op.c | 4 ++--
  tcg/tcg.c| 3 +--
  13 files changed, 15 insertions(+), 26 deletions(-)


Clever than what I was thinking of, thanks!

Reviewed-by: Philippe Mathieu-Daudé 

Re: [PATCH 1/7] tcg/tcg-op: Document bswap16() byte pattern

[Philippe Mathieu-Daudé]

On 22/8/23 19:29, Richard Henderson wrote:

On 8/22/23 10:22, Philippe Mathieu-Daudé wrote:

 } else {
 tcg_gen_shli_i32(t1, arg, 8);   /*  t1 = xab. (IZ=0) */
 /*   .ab. (IZ=1) */
 }

 tcg_gen_or_i32(ret, t0, t1);    /* ret = ..ba (IZ=1 or 
OZ=1) */
 /* = ssba 
(OS=1) */
 /* = xxba (no 
flag)  */


Clearer with xaba for no flag?


Right :)


Otherwise it looks ok.


Thanks!

Re: [PATCH 21/22] Implement shmat(2) and shmdt(2)

[Richard Henderson]

On 8/22/23 12:54, Warner Losh wrote:

As a practical matter, they both consume about the same resources until the 
MAP_ANON
region starts to get populated with data...

With PROT_NONE, I think they would have the same effect. If it is to be a 
backing store for
something like malloc, then MAP_ANON would be best. If you are replacing it 
with a lot of
things, like a mix of files, devices and/or anon memory, then MAP_GUARD and 
replace it
with MAP_FIXED later. Most likely you'll want MAP_GUARD to reserve the area, 
and then
MAP_FIXED to use it for mmap'd memory, shared memory, executable pages, etc.

Does that tell you what you need to know?


Yes.

The reserved_va area is replaced with a mix of files, anon, etc, based on whatever the 
guest requires.  So it might be reasonable to adjust bsd-user/mmap.c to use MAP_GUARD for 
managing the reserved_va area instead of MAP_ANON.  No rush, of course.



r~

[PATCH v3 1/3] linux-user: Split out die_with_signal

[Richard Henderson]

Because we trap so many signals for use by the guest,
we have to take extra steps to exit properly.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 52 -
 1 file changed, 28 insertions(+), 24 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 748a98f3e5..e1cd111a1b 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -694,6 +694,33 @@ void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 }
 
 /* abort execution with signal */
+static G_NORETURN
+void die_with_signal(int sig)
+{
+struct sigaction act = {
+.sa_handler = SIG_DFL,
+};
+
+/*
+ * The proper exit code for dying from an uncaught signal is -.
+ * The kernel doesn't allow exit() or _exit() to pass a negative value.
+ * To get the proper exit code we need to actually die from an uncaught
+ * signal.  Here the default signal handler is installed, we send
+ * the signal and we wait for it to arrive.
+ */
+sigfillset(&act.sa_mask);
+sigaction(sig, &act, NULL);
+
+kill(getpid(), sig);
+
+/* Make sure the signal isn't masked (reusing the mask inside of act). */
+sigdelset(&act.sa_mask, sig);
+sigsuspend(&act.sa_mask);
+
+/* unreachable */
+abort();
+}
+
 static G_NORETURN
 void dump_core_and_abort(CPUArchState *cpu_env, int target_sig)
 {
@@ -701,7 +728,6 @@ void dump_core_and_abort(CPUArchState *cpu_env, int 
target_sig)
 CPUArchState *env = cpu->env_ptr;
 TaskState *ts = (TaskState *)cpu->opaque;
 int host_sig, core_dumped = 0;
-struct sigaction act;
 
 host_sig = target_to_host_signal(target_sig);
 trace_user_dump_core_and_abort(env, target_sig, host_sig);
@@ -725,29 +751,7 @@ void dump_core_and_abort(CPUArchState *cpu_env, int 
target_sig)
 }
 
 preexit_cleanup(cpu_env, 128 + target_sig);
-
-/* The proper exit code for dying from an uncaught signal is
- * -.  The kernel doesn't allow exit() or _exit() to pass
- * a negative value.  To get the proper exit code we need to
- * actually die from an uncaught signal.  Here the default signal
- * handler is installed, we send ourself a signal and we wait for
- * it to arrive. */
-sigfillset(&act.sa_mask);
-act.sa_handler = SIG_DFL;
-act.sa_flags = 0;
-sigaction(host_sig, &act, NULL);
-
-/* For some reason raise(host_sig) doesn't send the signal when
- * statically linked on x86-64. */
-kill(getpid(), host_sig);
-
-/* Make sure the signal isn't masked (just reuse the mask inside
-of act) */
-sigdelset(&act.sa_mask, host_sig);
-sigsuspend(&act.sa_mask);
-
-/* unreachable */
-abort();
+die_with_signal(host_sig);
 }
 
 /* queue a signal so that it will be send to the virtual CPU as soon
-- 
2.34.1

[PATCH v3 0/3] linux-user: Detect and report host crashes

[Richard Henderson]

Supercedes: 20230812164314.352131-1-del...@gmx.de
("[PATCH] Fix signal handler to detect crashes in qemu-linux-user")

Fixes the issues I pointed out vs Helge's v2.


r~


Helge Deller (1):
  linux-user: Detect and report host crashes

Richard Henderson (2):
  linux-user: Split out die_with_signal
  linux-user: Exit not abort in die_with_backtrace

 linux-user/signal.c | 106 +++-
 1 file changed, 76 insertions(+), 30 deletions(-)

-- 
2.34.1

[PATCH v3 2/3] linux-user: Exit not abort in die_with_backtrace

[Richard Henderson]

This line is supposed to be unreachable, but if we're going to
have it at all, SIGABRT via abort() is subject to the same signal
peril that created this function in the first place.

We can _exit immediately without peril.

Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index e1cd111a1b..57fbf2f58b 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -718,7 +718,7 @@ void die_with_signal(int sig)
 sigsuspend(&act.sa_mask);
 
 /* unreachable */
-abort();
+_exit(EXIT_FAILURE);
 }
 
 static G_NORETURN
-- 
2.34.1

[PATCH v3 3/3] linux-user: Detect and report host crashes

[Richard Henderson]

From: Helge Deller 

If there is an internal program error in the qemu source code which
raises SIGSEGV or SIGBUS, we currently assume the signal belongs to
the guest.

With an artificial error introduced, we will now print

QEMU internal SIGSEGV {si_code=1, si_addr=(nil)}
QEMU v8.1.50 target x86_64 running /usr/bin/cat
QEMU backtrace:
./qemu-x86_64(+0xf83d9) [0x55c48587a3d9]
./qemu-x86_64(+0xf8663) [0x55c48587a663]
/lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f39eee42520]
./qemu-x86_64(+0x1132fa) [0x55c4858952fa]
./qemu-x86_64(+0x11396f) [0x55c48589596f]
./qemu-x86_64(+0x1140ef) [0x55c4858960ef]
./qemu-x86_64(+0x115796) [0x55c485897796]
./qemu-x86_64(+0x11f9dd) [0x55c4858a19dd]
./qemu-x86_64(+0x3f8da) [0x55c4857c18da]
./qemu-x86_64(+0xf3bfb) [0x55c485875bfb]
/lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f39eee29d90]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f39eee29e40]
./qemu-x86_64(+0x39075) [0x55c4857bb075]
Segmentation fault

Signed-off-by: Helge Deller 
Message-Id: <20230812164314.352131-1-del...@gmx.de>
[rth: Use in_code_gen_buffer and die_with_signal]
Signed-off-by: Richard Henderson 
---
 linux-user/signal.c | 54 -
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index 57fbf2f58b..1ffd1354c3 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -23,6 +23,7 @@
 
 #include 
 #include 
+#include 
 
 #include "qemu.h"
 #include "user-internals.h"
@@ -32,6 +33,7 @@
 #include "signal-common.h"
 #include "host-signal.h"
 #include "user/safe-syscall.h"
+#include "tcg/tcg.h"
 
 static struct target_sigaction sigact_table[TARGET_NSIG];
 
@@ -785,6 +787,34 @@ static inline void rewind_if_in_safe_syscall(void *puc)
 }
 }
 
+static G_NORETURN
+void die_with_backtrace(siginfo_t *info)
+{
+void *array[20];
+int size;
+
+fprintf(stderr,
+"QEMU internal SIG%s {si_code=%d, si_addr=%p}\n"
+"QEMU v" QEMU_VERSION " target " UNAME_MACHINE " running %s\n",
+sigabbrev_np(info->si_signo), info->si_code, info->si_addr,
+exec_path);
+
+size = backtrace(array, ARRAY_SIZE(array));
+if (size) {
+char **strings = backtrace_symbols(array, size);
+if (strings) {
+fprintf(stderr, "QEMU backtrace:\n");
+for (int i = 0; i < size; ++i) {
+fprintf(stderr, "%s\n", strings[i]);
+}
+free(strings);
+}
+}
+
+preexit_cleanup(thread_cpu->env_ptr, TARGET_SIGKILL);
+die_with_signal(info->si_signo);
+}
+
 static void host_signal_handler(int host_sig, siginfo_t *info, void *puc)
 {
 CPUArchState *env = thread_cpu->env_ptr;
@@ -820,16 +850,28 @@ static void host_signal_handler(int host_sig, siginfo_t 
*info, void *puc)
 is_write = host_signal_write(info, uc);
 access_type = adjust_signal_pc(&pc, is_write);
 
+/* If this was a write to a TB protected page, restart. */
+if (is_write
+&& host_sig == SIGSEGV
+&& info->si_code == SEGV_ACCERR
+&& h2g_valid(host_addr)
+&& handle_sigsegv_accerr_write(cpu, sigmask, pc, guest_addr)) {
+return;
+}
+
+/*
+ * If the access was not on behalf of the guest, within the executable
+ * mapping of the generated code buffer, then it is a host bug.
+ */
+if (access_type != MMU_INST_FETCH
+&& !in_code_gen_buffer((void *)(pc - tcg_splitwx_diff))) {
+die_with_backtrace(info);
+}
+
 if (host_sig == SIGSEGV) {
 bool maperr = true;
 
 if (info->si_code == SEGV_ACCERR && h2g_valid(host_addr)) {
-/* If this was a write to a TB protected page, restart. */
-if (is_write &&
-handle_sigsegv_accerr_write(cpu, sigmask, pc, guest_addr)) 
{
-return;
-}
-
 /*
  * With reserved_va, the whole address space is PROT_NONE,
  * which means that we may get ACCERR when we want MAPERR.
-- 
2.34.1

Re: [PATCH v2 0/3] block: align CoR requests to subclusters

[John Snow]

On Tue, Aug 22, 2023 at 1:33 PM Andrey Drobyshev
 wrote:
>
> On 8/16/23 12:22, Andrey Drobyshev wrote:
> > On 7/31/23 17:51, Andrey Drobyshev wrote:
> >> On 7/24/23 16:11, Andrey Drobyshev wrote:
> >>> On 7/11/23 20:25, Andrey Drobyshev wrote:
>  v1 --> v2:
>   * Fixed line indentation;
>   * Fixed wording in a comment;
>   * Added R-b.
> 
>  v1: 
>  https://lists.nongnu.org/archive/html/qemu-block/2023-06/msg00606.html
> 
>  Andrey Drobyshev (3):
>    block: add subcluster_size field to BlockDriverInfo
>    block/io: align requests to subcluster_size
>    tests/qemu-iotests/197: add testcase for CoR with subclusters
> 
>   block.c  |  7 +
>   block/io.c   | 50 ++--
>   block/mirror.c   |  8 +++---
>   block/qcow2.c|  1 +
>   include/block/block-common.h |  5 
>   include/block/block-io.h |  8 +++---
>   tests/qemu-iotests/197   | 29 +
>   tests/qemu-iotests/197.out   | 24 +
>   8 files changed, 99 insertions(+), 33 deletions(-)
> 
> >>>
> >>> Ping
> >>
> >> Another ping
> >
> > Yet another friendly ping
>
> One more friendly ping

Looks like Stefan gave you an R-B for the series; do we just need an
ACK by the block maintainers at this point or is there someone
specific you're hoping will review this?

--js

Re: [PATCH 21/22] Implement shmat(2) and shmdt(2)

[Warner Losh]

On Tue, Aug 22, 2023 at 12:11 PM Richard Henderson <
richard.hender...@linaro.org> wrote:

> On 8/22/23 11:03, Warner Losh wrote:
> > Hmm, bug with linux-user as well, because here we should
> re-establish the reserved_va
> > reservation.
> >
> >
> > ... of the shared memory region we just detached? Right?
>
> Correct.
>
> On a related note, on FreeBSD is there any practical difference between
>
>  PROT_NONE, MAP_ANON
> and
>  PROT_NONE, MAP_GUARD
>
> for large memory regions?
>

They do different things. MAP_ANON maps the memory without a backing
device. This means it allocates the VA space right away, but lazily
allocates
the backing pages as the pages are dirtied.

MAP_GUARD creates the VA mapping, but never maps any pages to those
pages (well, until it's remapped). Any read/write/exec access to MAP_GUARD
pages results in a SIGSEGV.


> I ask since FreeBSD doesn't have MAP_NORESERVE, which Linux uses to avoid
> allocation of
> gigabytes
>

Yea. It sounds like MAP_NORESERVE is what FreeBSD's default behavior is: We
don't
allocate backing store in the swap areas until there's memory pressure. You
can safely
allocate GB of space with MAP_ANON and get similar behavior to the
MAP_NORESERVE.

MAP_GUARD could be used if you wanted to reserve the VA space, but didn't
want to assign
anything to the VA space until later.

As a practical matter, they both consume about the same resources until the
MAP_ANON
region starts to get populated with data...

With PROT_NONE, I think they would have the same effect. If it is to be a
backing store for
something like malloc, then MAP_ANON would be best. If you are replacing it
with a lot of
things, like a mix of files, devices and/or anon memory, then MAP_GUARD and
replace it
with MAP_FIXED later. Most likely you'll want MAP_GUARD to reserve the
area, and then
MAP_FIXED to use it for mmap'd memory, shared memory, executable pages, etc.

Does that tell you what you need to know?

Warner


> r~
>

Re: [PATCH v2 4/4] iotests: test the zoned format feature for qcow2 file

[Stefan Hajnoczi]

On Mon, Aug 14, 2023 at 04:58:02PM +0800, Sam Li wrote:
> The zoned format feature can be tested by:
> $ tests/qemu-iotests/check zoned-qcow2
> 
> Signed-off-by: Sam Li 
> ---
>  tests/qemu-iotests/tests/zoned-qcow2 | 135 ++
>  tests/qemu-iotests/tests/zoned-qcow2.out | 140 +++
>  2 files changed, 275 insertions(+)
>  create mode 100755 tests/qemu-iotests/tests/zoned-qcow2
>  create mode 100644 tests/qemu-iotests/tests/zoned-qcow2.out

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH v2 3/4] qcow2: add zoned emulation capability

[Stefan Hajnoczi]

On Mon, Aug 14, 2023 at 04:58:01PM +0800, Sam Li wrote:
> By adding zone operations and zoned metadata, the zoned emulation
> capability enables full emulation support of zoned device using
> a qcow2 file. The zoned device metadata includes zone type,
> zoned device state and write pointer of each zone, which is stored
> to an array of unsigned integers.
> 
> Each zone of a zoned device makes state transitions following
> the zone state machine. The zone state machine mainly describes
> five states, IMPLICIT OPEN, EXPLICIT OPEN, FULL, EMPTY and CLOSED.
> READ ONLY and OFFLINE states will generally be affected by device
> internal events. The operations on zones cause corresponding state
> changing.
> 
> Zoned devices have a limit on zone resources, which puts constraints on
> write operations into zones.
> 
> Signed-off-by: Sam Li 
> ---
>  block/qcow2.c  | 676 -
>  block/qcow2.h  |   2 +
>  docs/interop/qcow2.txt |   2 +
>  3 files changed, 678 insertions(+), 2 deletions(-)
> 
> diff --git a/block/qcow2.c b/block/qcow2.c
> index c1077c4a4a..5ccf79cbe7 100644
> --- a/block/qcow2.c
> +++ b/block/qcow2.c
> @@ -194,6 +194,164 @@ qcow2_extract_crypto_opts(QemuOpts *opts, const char 
> *fmt, Error **errp)
>  return cryptoopts_qdict;
>  }
>  
> +#define QCOW2_ZT_IS_CONV(wp)(wp & 1ULL << 59)
> +
> +static inline int qcow2_get_wp(uint64_t wp)
> +{
> +/* clear state and type information */
> +return ((wp << 5) >> 5);
> +}
> +
> +static inline int qcow2_get_zs(uint64_t wp)
> +{
> +return (wp >> 60);
> +}
> +
> +static inline void qcow2_set_wp(uint64_t *wp, BlockZoneState zs)
> +{
> +uint64_t addr = qcow2_get_wp(*wp);
> +addr |= ((uint64_t)zs << 60);
> +*wp = addr;
> +}
> +
> +/*
> + * File wp tracking: reset zone, finish zone and append zone can
> + * change the value of write pointer. All zone operations will change
> + * the state of that/those zone.
> + * */
> +static inline void qcow2_wp_tracking_helper(int index, uint64_t wp) {
> +/* format: operations, the wp. */
> +printf("wps[%d]: 0x%x\n", index, qcow2_get_wp(wp)>>BDRV_SECTOR_BITS);
> +}
> +
> +/*
> + * Perform a state assignment and a flush operation that writes the new wp
> + * value to the dedicated location of the disk file.
> + */
> +static int qcow2_write_wp_at(BlockDriverState *bs, uint64_t *wp,
> + uint32_t index, BlockZoneState zs) {
> +BDRVQcow2State *s = bs->opaque;
> +int ret;
> +
> +qcow2_set_wp(wp, zs);
> +ret = bdrv_pwrite(bs->file, s->zoned_header.zonedmeta_offset
> ++ sizeof(uint64_t) * index, sizeof(uint64_t), wp, 0);
> +
> +if (ret < 0) {
> +goto exit;

Should *wp be restored to its original value to undo the effect of
qcow2_set_wp()?

> +}
> +qcow2_wp_tracking_helper(index, *wp);
> +return ret;
> +
> +exit:
> +error_report("Failed to write metadata with file");
> +return ret;
> +}
> +
> +static int qcow2_check_active(BlockDriverState *bs)

Please rename this to qcow2_check_active_zones() to avoid confusion with
other uses "active" in qcow2.

> +{
> +BDRVQcow2State *s = bs->opaque;
> +
> +if (!s->zoned_header.max_active_zones) {
> +return 0;
> +}
> +
> +if (s->nr_zones_exp_open + s->nr_zones_imp_open + s->nr_zones_closed
> +< s->zoned_header.max_active_zones) {
> +return 0;
> +}
> +
> +return -1;
> +}

(This function could return a bool instead of 0/-1 since it doesn't
really need an int.)

> +
> +static int qcow2_check_open(BlockDriverState *bs)

qcow2_check_open_zones() or, even better, qcow2_can_open_zone().

> +{
> +BDRVQcow2State *s = bs->opaque;
> +int ret;
> +
> +if (!s->zoned_header.max_open_zones) {
> +return 0;
> +}
> +
> +if (s->nr_zones_exp_open + s->nr_zones_imp_open
> +< s->zoned_header.max_open_zones) {
> +return 0;
> +}
> +
> +if(s->nr_zones_imp_open) {
> +ret = qcow2_check_active(bs);
> +if (ret == 0) {
> +/* TODO: it takes O(n) time complexity (n = nr_zones).
> + * Optimizations required. */

One solution is to keep an implicitly open list. Then this operation is
O(1).

> +/* close one implicitly open zones to make it available */
> +for (int i = s->zoned_header.zone_nr_conv;
> +i < bs->bl.nr_zones; ++i) {
> +uint64_t *wp = &s->wps->wp[i];
> +if (qcow2_get_zs(*wp) == BLK_ZS_IOPEN) {
> +ret = qcow2_write_wp_at(bs, wp, i, BLK_ZS_CLOSED);

I'm wondering if it's correct to store the zone state persistently in
the qcow2 file. If the guest or QEMU crashes, then zones will be left in
states like EOPEN. Since the guest software will have forgotten about
explicitly opened zones, the guest would need to recover zone states.
I'm not sure if existing software is designed to do that.

Damien: Should the zone state be persistent?

> + 

Re: [PATCH 0/9] Replace remaining target_ulong in system-mode accel

[Michael Tokarev]

22.08.2023 22:33, Michael Tokarev wrote:

22.08.2023 22:02, timothee.coca...@gmail.com wrote:

Hi,

Maybe its too late for the 8.1 window, but I noticed that this patchset
fixes a segfault in qemu-system-ppc (and other 32 bits archs ?) introduced by
commit fb2c53c.
Therefore maybe it would be relevant to get merge it before 8.2.


It's definitely too later for 8.1.0 (which has been tagged earlier today,
and it has been too later at -rc4 already).  But it's not too late for
8.1.1 stable series, so a fix can be applied to stable-8.1 (Cc'ing
qemu-stable@).

It seems I can reproduce the crash.


The sigsegv (reported testcase) seems to be fixed by commit 7/9:

Author: Anton Johansson via 
Date:   Mon Aug 7 17:57:04 2023 +0200

include/exec: Widen tlb_hit/tlb_hit_page()

tlb_addr is changed from target_ulong to uint64_t to match the type of
a CPUTLBEntry value, and the addressed is changed to vaddr.

Signed-off-by: Anton Johansson 
Reviewed-by: Richard Henderson 

/mjt

Re: [PATCH 21/21] block: Mark bdrv_add/del_child() and caller GRAPH_WRLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:20PM +0200, Kevin Wolf wrote:
> The functions read the parents list in the generic block layer, so we
> need to hold the graph lock already there. The BlockDriver
> implementations actually modify the graph, so it has to be a writer
> lock.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  include/block/block-global-state.h |  8 +---
>  include/block/block_int-common.h   |  9 +
>  block/quorum.c | 23 ++-
>  blockdev.c | 17 +++--
>  4 files changed, 27 insertions(+), 30 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH 20/21] block: Mark bdrv_unref_child() GRAPH_WRLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:19PM +0200, Kevin Wolf wrote:
> Instead of taking the writer lock internally, require callers to already
> hold it when calling bdrv_unref_child(). These callers will typically
> already hold the graph lock once the locking work is completed, which
> means that they can't call functions that take it internally.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  include/block/block-global-state.h |  7 ++-
>  block.c| 11 +++
>  block/blklogwrites.c   |  4 
>  block/blkverify.c  |  2 ++
>  block/qcow2.c  |  4 +++-
>  block/quorum.c |  6 ++
>  block/replication.c|  3 +++
>  block/snapshot.c   |  2 ++
>  block/vmdk.c   | 11 +++
>  tests/unit/test-bdrv-drain.c   |  8 ++--
>  10 files changed, 50 insertions(+), 8 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH 19/21] block: Mark bdrv_root_unref_child() GRAPH_WRLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:18PM +0200, Kevin Wolf wrote:
> Instead of taking the writer lock internally, require callers to already
> hold it when calling bdrv_root_unref_child(). These callers will
> typically already hold the graph lock once the locking work is
> completed, which means that they can't call functions that take it
> internally.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  include/block/block_int-global-state.h | 2 +-
>  block.c| 6 +++---
>  block/block-backend.c  | 3 +++
>  blockjob.c | 2 ++
>  4 files changed, 9 insertions(+), 4 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH 07/12] target/ppc: Use generic hrev64_i64() in BRH / BSWAP16x8 opcodes

[Daniel Henrique Barboza]

On 8/22/23 09:53, Philippe Mathieu-Daudé wrote:

Signed-off-by: Philippe Mathieu-Daudé 
---



Reviewed-by: Daniel Henrique Barboza 


  target/ppc/translate.c  | 10 +-
  target/ppc/translate/vsx-impl.c.inc | 19 ++-
  2 files changed, 3 insertions(+), 26 deletions(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 74796ec7ba..91a9ec2d1c 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -6435,15 +6435,7 @@ static void gen_brw(DisasContext *ctx)
  /* brh */
  static void gen_brh(DisasContext *ctx)
  {
-TCGv_i64 mask = tcg_constant_i64(0x00ff00ff00ff00ffull);
-TCGv_i64 t1 = tcg_temp_new_i64();
-TCGv_i64 t2 = tcg_temp_new_i64();
-
-tcg_gen_shri_i64(t1, cpu_gpr[rS(ctx->opcode)], 8);
-tcg_gen_and_i64(t2, t1, mask);
-tcg_gen_and_i64(t1, cpu_gpr[rS(ctx->opcode)], mask);
-tcg_gen_shli_i64(t1, t1, 8);
-tcg_gen_or_i64(cpu_gpr[rA(ctx->opcode)], t1, t2);
+tcg_gen_hrev64_i64(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)]);
  }
  #endif
  
diff --git a/target/ppc/translate/vsx-impl.c.inc b/target/ppc/translate/vsx-impl.c.inc

index 0f5b0056f1..639ab7f1bc 100644
--- a/target/ppc/translate/vsx-impl.c.inc
+++ b/target/ppc/translate/vsx-impl.c.inc
@@ -154,23 +154,8 @@ static void gen_lxvdsx(DisasContext *ctx)
  static void gen_bswap16x8(TCGv_i64 outh, TCGv_i64 outl,
TCGv_i64 inh, TCGv_i64 inl)
  {
-TCGv_i64 mask = tcg_constant_i64(0x00FF00FF00FF00FF);
-TCGv_i64 t0 = tcg_temp_new_i64();
-TCGv_i64 t1 = tcg_temp_new_i64();
-
-/* outh = ((inh & mask) << 8) | ((inh >> 8) & mask) */
-tcg_gen_and_i64(t0, inh, mask);
-tcg_gen_shli_i64(t0, t0, 8);
-tcg_gen_shri_i64(t1, inh, 8);
-tcg_gen_and_i64(t1, t1, mask);
-tcg_gen_or_i64(outh, t0, t1);
-
-/* outl = ((inl & mask) << 8) | ((inl >> 8) & mask) */
-tcg_gen_and_i64(t0, inl, mask);
-tcg_gen_shli_i64(t0, t0, 8);
-tcg_gen_shri_i64(t1, inl, 8);
-tcg_gen_and_i64(t1, t1, mask);
-tcg_gen_or_i64(outl, t0, t1);
+tcg_gen_hrev64_i64(outh, inh);
+tcg_gen_hrev64_i64(outl, inl);
  }
  
  static void gen_bswap32x4(TCGv_i64 outh, TCGv_i64 outl,

Re: [PATCH 17/21] block: Take graph rdlock in bdrv_drop_intermediate()

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:16PM +0200, Kevin Wolf wrote:
> The function reads the parents list, so it needs to hold the graph lock.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  block.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/block.c b/block.c
> index 7df8780d6e..a82389f742 100644
> --- a/block.c
> +++ b/block.c
> @@ -5934,9 +5934,11 @@ int bdrv_drop_intermediate(BlockDriverState *top, 
> BlockDriverState *base,
>  backing_file_str = base->filename;
>  }
>  
> +bdrv_graph_rdlock_main_loop();
>  QLIST_FOREACH(c, &top->parents, next_parent) {
>  updated_children = g_slist_prepend(updated_children, c);
>  }
> +bdrv_graph_rdunlock_main_loop();

This is GLOBAL_STATE_CODE, so why take the read lock? I thought nothing
can modify the graph here. If it could, then stashing the parents in the
updated_children probably wouldn't be safe anyway.

>  
>  /*
>   * It seems correct to pass detach_subchain=true here, but it triggers
> -- 
> 2.41.0
> 


signature.asc
Description: PGP signature

Re: [PATCH 0/9] Replace remaining target_ulong in system-mode accel

[Michael Tokarev]

22.08.2023 22:02, timothee.coca...@gmail.com wrote:

Hi,

Maybe its too late for the 8.1 window, but I noticed that this patchset
fixes a segfault in qemu-system-ppc (and other 32 bits archs ?) introduced by
commit fb2c53c.
Therefore maybe it would be relevant to get merge it before 8.2.


It's definitely too later for 8.1.0 (which has been tagged earlier today,
and it has been too later at -rc4 already).  But it's not too late for
8.1.1 stable series, so a fix can be applied to stable-8.1 (Cc'ing
qemu-stable@).

It seems I can reproduce the crash.

Thanks,

/mjt

Re: [PATCH 16/21] block: Mark bdrv_parent_cb_change_media() GRAPH_RDLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:15PM +0200, Kevin Wolf wrote:
> The function reads the parents list, so it needs to hold the graph lock.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  block.c | 6 +-
>  1 file changed, 5 insertions(+), 1 deletion(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH 15/21] block: Mark bdrv_child_perm() GRAPH_RDLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:14PM +0200, Kevin Wolf wrote:
> This adds GRAPH_RDLOCK annotations to declare that callers of
> bdrv_child_perm() need to hold a reader lock for the graph because
> some implementations access the children list of a node.
> 
> The callers of bdrv_child_perm() conveniently already hold the lock.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  include/block/block_int-common.h | 10 +-
>  block.c  | 11 ++-
>  block/copy-before-write.c| 10 +-
>  3 files changed, 16 insertions(+), 15 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH 14/21] block: Mark bdrv_get_cumulative_perm() and callers GRAPH_RDLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:13PM +0200, Kevin Wolf wrote:
> The function reads the parents list, so it needs to hold the graph lock.
> 
> This happens to result in BlockDriver.bdrv_set_perm() to be called with
> the graph lock held. For consistency, make it the same for all of the
> BlockDriver callbacks for updating permissions and annotate the function
> pointers with GRAPH_RDLOCK_PTR.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  include/block/block_int-common.h   |  9 ---
>  include/block/block_int-global-state.h |  4 +--
>  block.c| 35 --
>  blockdev.c |  6 +
>  4 files changed, 40 insertions(+), 14 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH v2 1/9] nvdimm: Reject writing label data to ROM instead of crashing QEMU

[Stefan Hajnoczi]

On Tue, Aug 22, 2023 at 01:44:49PM +0200, David Hildenbrand wrote:
> Currently, when using a true R/O NVDIMM (ROM memory backend) with a label
> area, the VM can easily crash QEMU by trying to write to the label area,
> because the ROM memory is mmap'ed without PROT_WRITE.
> 
> [root@vm-0 ~]# ndctl disable-region region0
> disabled 1 region
> [root@vm-0 ~]# ndctl zero-labels nmem0
> -> QEMU segfaults
> 
> Let's remember whether we have a ROM memory backend and properly
> reject the write request:
> 
> [root@vm-0 ~]# ndctl disable-region region0
> disabled 1 region
> [root@vm-0 ~]# ndctl zero-labels nmem0
> zeroed 0 nmem
> 
> In comparison, on a system with a R/W NVDIMM:
> 
> [root@vm-0 ~]# ndctl disable-region region0
> disabled 1 region
> [root@vm-0 ~]# ndctl zero-labels nmem0
> zeroed 1 nmem
> 
> For ACPI, just return "unsupported", like if no label exists. For spapr,
> return "H_P2", similar to when no label area exists.
> 
> Could we rely on the "unarmed" property? Maybe, but it looks cleaner to
> only disallow what certainly cannot work.
> 
> After all "unarmed=on" primarily means: cannot accept persistent writes. In
> theory, there might be setups where devices with "unarmed=on" set could
> be used to host non-persistent data (temporary files, system RAM, ...); for
> example, in Linux, admins can overwrite the "readonly" setting and still
> write to the device -- which will work as long as we're not using ROM.
> Allowing writing label data in such configurations can make sense.
> 
> Fixes: dbd730e85987 ("nvdimm: check -object memory-backend-file, readonly=on 
> option")
> Signed-off-by: David Hildenbrand 
> ---
>  hw/acpi/nvdimm.c| 11 ---
>  hw/mem/nvdimm.c | 10 +++---
>  hw/ppc/spapr_nvdimm.c   |  3 ++-
>  include/hw/mem/nvdimm.h |  6 ++
>  4 files changed, 23 insertions(+), 7 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH 13/21] block: Mark bdrv_parent_perms_conflict() and callers GRAPH_RDLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:12PM +0200, Kevin Wolf wrote:
> The function reads the parents list, so it needs to hold the graph lock.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  include/block/block_int-common.h|  6 ++---
>  include/block/block_int-global-state.h  |  8 +++---
>  include/sysemu/block-backend-global-state.h |  4 +--
>  block.c | 28 +
>  block/block-backend.c   | 26 ++-
>  block/crypto.c  |  6 +++--
>  block/mirror.c  |  8 ++
>  block/vmdk.c|  2 ++
>  tests/unit/test-bdrv-graph-mod.c|  4 +++
>  9 files changed, 66 insertions(+), 26 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature

Re: [PATCH 12/21] block: Mark bdrv_attach_child() GRAPH_WRLOCK

[Stefan Hajnoczi]

On Thu, Aug 17, 2023 at 02:50:11PM +0200, Kevin Wolf wrote:
> Instead of taking the writer lock internally, require callers to already
> hold it when calling bdrv_attach_child_common(). These callers will
> typically already hold the graph lock once the locking work is
> completed, which means that they can't call functions that take it
> internally.
> 
> Signed-off-by: Kevin Wolf 
> ---
>  include/block/block-global-state.h | 14 --
>  block.c|  7 +++
>  block/quorum.c |  2 ++
>  block/replication.c|  6 ++
>  tests/unit/test-bdrv-drain.c   | 14 ++
>  tests/unit/test-bdrv-graph-mod.c   | 10 ++
>  6 files changed, 43 insertions(+), 10 deletions(-)

Reviewed-by: Stefan Hajnoczi 


signature.asc
Description: PGP signature