[PATCH 1/2] s390x: fix memleaks in cpu_finalize

2020-02-15 Thread pannengyuan
From: Pan Nengyuan 

This patch fix memleaks when we call tests/qtest/cpu-plug-test on s390x. The 
leak stack is as follow:

Direct leak of 48 byte(s) in 1 object(s) allocated from:
#0 0x7fb43c7cd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
#1 0x7fb43be2149d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
#2 0x558ba96da716 in timer_new_full 
/mnt/sdb/qemu-new/qemu/include/qemu/timer.h:530
#3 0x558ba96da716 in timer_new 
/mnt/sdb/qemu-new/qemu/include/qemu/timer.h:551
#4 0x558ba96da716 in timer_new_ns 
/mnt/sdb/qemu-new/qemu/include/qemu/timer.h:569
#5 0x558ba96da716 in s390_cpu_initfn 
/mnt/sdb/qemu-new/qemu/target/s390x/cpu.c:285
#6 0x558ba9c969ab in object_init_with_type 
/mnt/sdb/qemu-new/qemu/qom/object.c:372
#7 0x558ba9c9eb5f in object_initialize_with_type 
/mnt/sdb/qemu-new/qemu/qom/object.c:516
#8 0x558ba9c9f053 in object_new_with_type 
/mnt/sdb/qemu-new/qemu/qom/object.c:684
#9 0x558ba967ede6 in s390x_new_cpu 
/mnt/sdb/qemu-new/qemu/hw/s390x/s390-virtio-ccw.c:64
#10 0x558ba99764b3 in hmp_cpu_add 
/mnt/sdb/qemu-new/qemu/hw/core/machine-hmp-cmds.c:57
#11 0x558ba9b1c27f in handle_hmp_command 
/mnt/sdb/qemu-new/qemu/monitor/hmp.c:1082
#12 0x558ba96c1b02 in qmp_human_monitor_command 
/mnt/sdb/qemu-new/qemu/monitor/misc.c:142

Reported-by: Euler Robot 
Signed-off-by: Pan Nengyuan 
---
 target/s390x/cpu.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index cf84d307c6..fff793a4eb 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -294,6 +294,10 @@ static void s390_cpu_finalize(Object *obj)
 
 qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
 g_free(cpu->irqstate);
+timer_del(cpu->env.tod_timer);
+timer_del(cpu->env.cpu_timer);
+timer_free(cpu->env.tod_timer);
+timer_free(cpu->env.cpu_timer);
 #endif
 }
 
-- 
2.18.2




[PATCH 2/2] hw: move timer_new from init() into realize() to avoid memleaks

2020-02-15 Thread pannengyuan
From: Pan Nengyuan 

There are some memleaks when we call 'device_list_properties'. This patch move 
timer_new from init into realize to fix it.
Meanwhile, do the null check in mos6522_reset() to avoid null deref if we move 
timer_new into realize().

Reported-by: Euler Robot 
Signed-off-by: Pan Nengyuan 
---
 hw/arm/pxa2xx.c| 17 +++--
 hw/arm/spitz.c |  8 +++-
 hw/arm/strongarm.c | 18 --
 hw/misc/mos6522.c  | 14 --
 hw/timer/cadence_ttc.c | 16 +++-
 5 files changed, 53 insertions(+), 20 deletions(-)

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index b33f8f1351..56a36202d7 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -1134,18 +1134,22 @@ static void pxa2xx_rtc_init(Object *obj)
 s->last_rtcpicr = 0;
 s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);
 
+sysbus_init_irq(dev, &s->rtc_irq);
+
+memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,
+  "pxa2xx-rtc", 0x1);
+sysbus_init_mmio(dev, &s->iomem);
+}
+
+static void pxa2xx_rtc_realize(DeviceState *dev, Error **errp)
+{
+PXA2xxRTCState *s = PXA2XX_RTC(dev);
 s->rtc_hz= timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick,s);
 s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);
 s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);
 s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);
 s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);
 s->rtc_pi= timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick,s);
-
-sysbus_init_irq(dev, &s->rtc_irq);
-
-memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,
-  "pxa2xx-rtc", 0x1);
-sysbus_init_mmio(dev, &s->iomem);
 }
 
 static int pxa2xx_rtc_pre_save(void *opaque)
@@ -1203,6 +1207,7 @@ static void pxa2xx_rtc_sysbus_class_init(ObjectClass 
*klass, void *data)
 
 dc->desc = "PXA2xx RTC Controller";
 dc->vmsd = &vmstate_pxa2xx_rtc_regs;
+dc->realize = pxa2xx_rtc_realize;
 }
 
 static const TypeInfo pxa2xx_rtc_sysbus_info = {
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index e001088103..cbfa6934cf 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -524,11 +524,16 @@ static void spitz_keyboard_init(Object *obj)
 
 spitz_keyboard_pre_map(s);
 
-s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);
 qdev_init_gpio_in(dev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
 qdev_init_gpio_out(dev, s->sense, SPITZ_KEY_SENSE_NUM);
 }
 
+static void spitz_keyboard_realize(DeviceState *dev, Error **errp)
+{
+SpitzKeyboardState *s = SPITZ_KEYBOARD(dev);
+s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);
+}
+
 /* LCD backlight controller */
 
 #define LCDTG_RESCTL   0x00
@@ -1115,6 +1120,7 @@ static void spitz_keyboard_class_init(ObjectClass *klass, 
void *data)
 DeviceClass *dc = DEVICE_CLASS(klass);
 
 dc->vmsd = &vmstate_spitz_kbd;
+dc->realize = spitz_keyboard_realize;
 }
 
 static const TypeInfo spitz_keyboard_info = {
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index cd8a99aaf2..3010d765bb 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -399,9 +399,6 @@ static void strongarm_rtc_init(Object *obj)
 s->last_rcnr = (uint32_t) mktimegm(&tm);
 s->last_hz = qemu_clock_get_ms(rtc_clock);
 
-s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);
-s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);
-
 sysbus_init_irq(dev, &s->rtc_irq);
 sysbus_init_irq(dev, &s->rtc_hz_irq);
 
@@ -410,6 +407,13 @@ static void strongarm_rtc_init(Object *obj)
 sysbus_init_mmio(dev, &s->iomem);
 }
 
+static void strongarm_rtc_realize(DeviceState *dev, Error **errp)
+{
+StrongARMRTCState *s = STRONGARM_RTC(dev);
+s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);
+s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);
+}
+
 static int strongarm_rtc_pre_save(void *opaque)
 {
 StrongARMRTCState *s = opaque;
@@ -451,6 +455,7 @@ static void strongarm_rtc_sysbus_class_init(ObjectClass 
*klass, void *data)
 
 dc->desc = "StrongARM RTC Controller";
 dc->vmsd = &vmstate_strongarm_rtc_regs;
+dc->realize = strongarm_rtc_realize;
 }
 
 static const TypeInfo strongarm_rtc_sysbus_info = {
@@ -1240,15 +1245,16 @@ static void strongarm_uart_init(Object *obj)
   "uart", 0x1);
 sysbus_init_mmio(dev, &s->iomem);
 sysbus_init_irq(dev, &s->irq);
-
-s->rx_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, 
strongarm_uart_rx_to, s);
-s->tx_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, strongarm_uart_tx, s);
 }
 
 static void strongarm_uart_realize(DeviceState *dev, Error **errp)
 {
 StrongARMUARTState *s = STRONGARM_UART(dev);
 
+s->rx_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+   strongarm_uart_rx_to,

Re: [PATCH 1/2] s390x: fix memleaks in cpu_finalize

2020-02-15 Thread Pan Nengyuan


On 2/15/2020 4:32 PM, pannengy...@huawei.com wrote:

I'm sorry for the mail's subject, it's a single patch.
[PATCH 1/2]  --->  [PATCH]

> From: Pan Nengyuan 
> 
> This patch fix memleaks when we call tests/qtest/cpu-plug-test on s390x. The 
> leak stack is as follow:
> 
> Direct leak of 48 byte(s) in 1 object(s) allocated from:
> #0 0x7fb43c7cd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
> #1 0x7fb43be2149d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
> #2 0x558ba96da716 in timer_new_full 
> /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:530
> #3 0x558ba96da716 in timer_new 
> /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:551
> #4 0x558ba96da716 in timer_new_ns 
> /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:569
> #5 0x558ba96da716 in s390_cpu_initfn 
> /mnt/sdb/qemu-new/qemu/target/s390x/cpu.c:285
> #6 0x558ba9c969ab in object_init_with_type 
> /mnt/sdb/qemu-new/qemu/qom/object.c:372
> #7 0x558ba9c9eb5f in object_initialize_with_type 
> /mnt/sdb/qemu-new/qemu/qom/object.c:516
> #8 0x558ba9c9f053 in object_new_with_type 
> /mnt/sdb/qemu-new/qemu/qom/object.c:684
> #9 0x558ba967ede6 in s390x_new_cpu 
> /mnt/sdb/qemu-new/qemu/hw/s390x/s390-virtio-ccw.c:64
> #10 0x558ba99764b3 in hmp_cpu_add 
> /mnt/sdb/qemu-new/qemu/hw/core/machine-hmp-cmds.c:57
> #11 0x558ba9b1c27f in handle_hmp_command 
> /mnt/sdb/qemu-new/qemu/monitor/hmp.c:1082
> #12 0x558ba96c1b02 in qmp_human_monitor_command 
> /mnt/sdb/qemu-new/qemu/monitor/misc.c:142
> 
> Reported-by: Euler Robot 
> Signed-off-by: Pan Nengyuan 
> ---
>  target/s390x/cpu.c | 4 
>  1 file changed, 4 insertions(+)
> 
> diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
> index cf84d307c6..fff793a4eb 100644
> --- a/target/s390x/cpu.c
> +++ b/target/s390x/cpu.c
> @@ -294,6 +294,10 @@ static void s390_cpu_finalize(Object *obj)
>  
>  qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
>  g_free(cpu->irqstate);
> +timer_del(cpu->env.tod_timer);
> +timer_del(cpu->env.cpu_timer);
> +timer_free(cpu->env.tod_timer);
> +timer_free(cpu->env.cpu_timer);
>  #endif
>  }
>  
> 



Re: [PATCH 2/2] hw: move timer_new from init() into realize() to avoid memleaks

2020-02-15 Thread Pan Nengyuan


On 2/15/2020 4:37 PM, pannengy...@huawei.com wrote:

I'm sorry for the mail's subject, it's a single patch.
[PATCH 2/2]  --->  [PATCH]

> From: Pan Nengyuan 
> 
> There are some memleaks when we call 'device_list_properties'. This patch 
> move timer_new from init into realize to fix it.
> Meanwhile, do the null check in mos6522_reset() to avoid null deref if we 
> move timer_new into realize().
> 
> Reported-by: Euler Robot 
> Signed-off-by: Pan Nengyuan 
> ---
>  hw/arm/pxa2xx.c| 17 +++--
>  hw/arm/spitz.c |  8 +++-
>  hw/arm/strongarm.c | 18 --
>  hw/misc/mos6522.c  | 14 --
>  hw/timer/cadence_ttc.c | 16 +++-
>  5 files changed, 53 insertions(+), 20 deletions(-)
> 
> diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
> index b33f8f1351..56a36202d7 100644
> --- a/hw/arm/pxa2xx.c
> +++ b/hw/arm/pxa2xx.c
> @@ -1134,18 +1134,22 @@ static void pxa2xx_rtc_init(Object *obj)
>  s->last_rtcpicr = 0;
>  s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);
>  
> +sysbus_init_irq(dev, &s->rtc_irq);
> +
> +memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,
> +  "pxa2xx-rtc", 0x1);
> +sysbus_init_mmio(dev, &s->iomem);
> +}
> +
> +static void pxa2xx_rtc_realize(DeviceState *dev, Error **errp)
> +{
> +PXA2xxRTCState *s = PXA2XX_RTC(dev);
>  s->rtc_hz= timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick,s);
>  s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);
>  s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);
>  s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);
>  s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);
>  s->rtc_pi= timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick,s);
> -
> -sysbus_init_irq(dev, &s->rtc_irq);
> -
> -memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,
> -  "pxa2xx-rtc", 0x1);
> -sysbus_init_mmio(dev, &s->iomem);
>  }
>  
>  static int pxa2xx_rtc_pre_save(void *opaque)
> @@ -1203,6 +1207,7 @@ static void pxa2xx_rtc_sysbus_class_init(ObjectClass 
> *klass, void *data)
>  
>  dc->desc = "PXA2xx RTC Controller";
>  dc->vmsd = &vmstate_pxa2xx_rtc_regs;
> +dc->realize = pxa2xx_rtc_realize;
>  }
>  
>  static const TypeInfo pxa2xx_rtc_sysbus_info = {
> diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
> index e001088103..cbfa6934cf 100644
> --- a/hw/arm/spitz.c
> +++ b/hw/arm/spitz.c
> @@ -524,11 +524,16 @@ static void spitz_keyboard_init(Object *obj)
>  
>  spitz_keyboard_pre_map(s);
>  
> -s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);
>  qdev_init_gpio_in(dev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
>  qdev_init_gpio_out(dev, s->sense, SPITZ_KEY_SENSE_NUM);
>  }
>  
> +static void spitz_keyboard_realize(DeviceState *dev, Error **errp)
> +{
> +SpitzKeyboardState *s = SPITZ_KEYBOARD(dev);
> +s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);
> +}
> +
>  /* LCD backlight controller */
>  
>  #define LCDTG_RESCTL 0x00
> @@ -1115,6 +1120,7 @@ static void spitz_keyboard_class_init(ObjectClass 
> *klass, void *data)
>  DeviceClass *dc = DEVICE_CLASS(klass);
>  
>  dc->vmsd = &vmstate_spitz_kbd;
> +dc->realize = spitz_keyboard_realize;
>  }
>  
>  static const TypeInfo spitz_keyboard_info = {
> diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
> index cd8a99aaf2..3010d765bb 100644
> --- a/hw/arm/strongarm.c
> +++ b/hw/arm/strongarm.c
> @@ -399,9 +399,6 @@ static void strongarm_rtc_init(Object *obj)
>  s->last_rcnr = (uint32_t) mktimegm(&tm);
>  s->last_hz = qemu_clock_get_ms(rtc_clock);
>  
> -s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);
> -s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);
> -
>  sysbus_init_irq(dev, &s->rtc_irq);
>  sysbus_init_irq(dev, &s->rtc_hz_irq);
>  
> @@ -410,6 +407,13 @@ static void strongarm_rtc_init(Object *obj)
>  sysbus_init_mmio(dev, &s->iomem);
>  }
>  
> +static void strongarm_rtc_realize(DeviceState *dev, Error **errp)
> +{
> +StrongARMRTCState *s = STRONGARM_RTC(dev);
> +s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);
> +s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);
> +}
> +
>  static int strongarm_rtc_pre_save(void *opaque)
>  {
>  StrongARMRTCState *s = opaque;
> @@ -451,6 +455,7 @@ static void strongarm_rtc_sysbus_class_init(ObjectClass 
> *klass, void *data)
>  
>  dc->desc = "StrongARM RTC Controller";
>  dc->vmsd = &vmstate_strongarm_rtc_regs;
> +dc->realize = strongarm_rtc_realize;
>  }
>  
>  static const TypeInfo strongarm_rtc_sysbus_info = {
> @@ -1240,15 +1245,16 @@ static void strongarm_uart_init(Object *obj)
>"uart", 0x1);
>  sysbus_init_mmio(dev, &s->iomem);
>  sysbus_init_irq(dev, &s->irq);
> -
> -s->rx

RE: [RFC v3 14/25] intel_iommu: add virtual command capability support

2020-02-15 Thread Liu, Yi L
> From: Peter Xu < pet...@redhat.com >
> Sent: Thursday, February 13, 2020 11:09 PM
> To: Liu, Yi L 
> Subject: Re: [RFC v3 14/25] intel_iommu: add virtual command capability 
> support
> 
> On Thu, Feb 13, 2020 at 09:31:10AM -0500, Peter Xu wrote:
> 
> [...]
> 
> > > > Apart of this: also I just noticed (when reading the latter part of
> > > > the series) that the time that a pasid table walk can consume will
> > > > depend on this value too.  I'd suggest to make this as small as we
> > > > can, as long as it satisfies the usage.  We can even bump it in the
> > > > future.
> > >
> > > I see. This looks to be an optimization. right? Instead of modify the
> > > value of this macro,  I think we can do this optimization by tracking
> > > the allocated PASIDs in QEMU. Thus, the pasid table walk  would be more
> > > efficient and also no dependency on the VTD_MAX_HPASID. Does it make
> > > sense to you? :-)
> >
> > Yeah sounds good. :)
> 
> Just to make sure it's safe even for when the global allocation is not
> happening (full emulation devices?  Do they need the PASID table walk
> too?). 

I'd say no. For full emulation devices, just needs to ensure the pasid cache
is latest (do what guest told). Even the invalidation flushes too much cache,
it just affects the performance but no correctness issue.  This is different
with passthru devices, if unbind too much, it means some passthru devices
may encounter DMA  fault later.

> Anyway, be careful to not miss some valid PASID entries, or we
> can still use the MIN(PASID_MAX, CONTEXT_ENTRY_SIZE) to be safe as a
> first version.  Thanks,

Agreed. First version to ensure 100% safe.

Regards,
Yi Liu


RE: [RFC v3 16/25] intel_iommu: add PASID cache management infrastructure

2020-02-15 Thread Liu, Yi L


> -Original Message-
> From: Peter Xu 
> Sent: Thursday, February 13, 2020 11:14 PM
> To: Liu, Yi L 
> Subject: Re: [RFC v3 16/25] intel_iommu: add PASID cache management
> infrastructure
> 
> On Thu, Feb 13, 2020 at 02:59:37AM +, Liu, Yi L wrote:
> > > - Remove the vtd_pasid_as check right below because it's not needed.
> > >
> > > >
> > > >
> > > > > > +if (vtd_pasid_as &&
> > >
> >
> > yes, it is. In current series vtd_add_find_pasid_as() doesn’t check the
> > result of vtd_pasid_as mem allocation, so no need to check vtd_pasid_as
> > here either. However, it might be better to check the allocation result
> > or it will result in issue if allocation failed. What's your preference
> > here?
> 
> That should not be needed, because IIRC g_malloc0() will directly
> coredump if allocation fails.  Even if not, it'll coredump in
> vtd_add_find_pasid_as() soon when accessing the NULL pointer.

Cool, thanks for this message. Then I'll follow your suggestion  to  remove
the vtd_pasid_as check.

Regards,
Yi Liu


RE: [RFC 2/2] pci-expender-bus:Add pcie-root-port to pxb-pcie under arm.

2020-02-15 Thread miaoyubo

> -Original Message-
> From: Daniel P. Berrangé [mailto:berra...@redhat.com]
> Sent: Friday, February 14, 2020 6:25 PM
> To: miaoyubo 
> Cc: peter.mayd...@linaro.org; shannon.zha...@gmail.com;
> imamm...@redhat.com; qemu-devel@nongnu.org; Xiexiangyou
> ; m...@redhat.com
> Subject: Re: [RFC 2/2] pci-expender-bus:Add pcie-root-port to pxb-pcie under
> arm.
> 
> On Fri, Feb 14, 2020 at 07:25:43AM +, miaoyubo wrote:
> >
> > > -Original Message-
> > > From: Daniel P. Berrangé [mailto:berra...@redhat.com]
> > > Sent: Thursday, February 13, 2020 9:52 PM
> > > To: miaoyubo 
> > > Cc: peter.mayd...@linaro.org; shannon.zha...@gmail.com;
> > > imamm...@redhat.com; qemu-devel@nongnu.org; Xiexiangyou
> > > ; m...@redhat.com
> > > Subject: Re: [RFC 2/2] pci-expender-bus:Add pcie-root-port to
> > > pxb-pcie under arm.
> > >
> > > On Thu, Feb 13, 2020 at 03:49:52PM +0800, Yubo Miao wrote:
> > > > From: miaoyubo 
> > > >
> > > > Since devices could not directly plugged into pxb-pcie, under arm,
> > > > one pcie-root port is plugged into pxb-pcie. Due to the bus for
> > > > each pxb-pcie is defined as 2 in acpi dsdt tables(one for
> > > > pxb-pcie, one for pcie-root-port), only one device could be plugged into
> one pxb-pcie.
> > >
> > > What is the cause of this arm specific requirement for pxb-pcie and
> > > more importantly can be fix it so that we don't need this patch ?
> > > I think it is highly undesirable to have such a per-arch difference
> > > in configuration of the pxb-pcie device. It means any mgmt app which
> > > already supports pxb-pcie will be broken and need to special case arm.
> > >
> >
> > Thanks for your reply, Without this patch, the pxb-pcie is also
> > useable, however, one extra pcie-root-port or pci-bridge or something
> > else need to be defined by mgmt. app. This patch will could be abandoned.
> 
> That's not really answering my question. IIUC, this pxb-pcie device works fine
> on x86_64, and I want to know why it doesn't work on arm ?
> Requiring different setups by the mgmt apps is not at all nice because it will
> inevitably lead to broken arm setups. x86_64 gets far more testing & usage,
> developers won't realize arm is different.
> 
>

Thanks for replying. Currently, on x86_64, pxb-pcie devices is presented in 
acpi tables but on arm, It is not, only one main host bridge is presented for 
arm in acpi dsdt tables. That's why pxb-pcie works on x86_64 but doesn't work 
on arm. The patch 1/2 do the work to present and allocate resources for 
pxb-pcie in arm.
For x86_64, if one device is going to be plugged into pxb-pcie, one extra 
pcie-root-port or pci-bridge have to be defined and plugged on pxb-pcie, then 
the device is plugged on the pcie-root-port or pci-bridge.
This patch 2/2 just auto defined one pcie-root-port for arm. If this patch 
abandoned, the usage of pxb-pcie would be the same with x86_64, therefore, to 
keep the same step for x86 and arm, this patch 2/2 could be abandonded.

 
> 
> Regards,
> Daniel
> --
> |: https://berrange.com  -o-
> https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o-
> https://fstop138.berrange.com :|
> |: https://entangle-photo.org-o-
> https://www.instagram.com/dberrange :|

Regards,
Miao


Re: [PATCH 3/5] hw/display/artist: Delay some variables initialization

2020-02-15 Thread Sven Schnelle
On Fri, Feb 14, 2020 at 01:13:00AM +0100, Philippe Mathieu-Daudé wrote:
> We want to have an early exit path. Delay some initializations
> before the variables are used.
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  hw/display/artist.c | 10 +-
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/display/artist.c b/hw/display/artist.c
> index 47f0e9f0bc..97c811b35e 100644
> --- a/hw/display/artist.c
> +++ b/hw/display/artist.c
> @@ -557,90 +557,90 @@ static void fill_window(ARTISTState *s, int startx, int 
> starty,
>  static void draw_line(ARTISTState *s, int x1, int y1, int x2, int y2,
>bool update_start, int skip_pix, int max_pix)
>  {
>  struct vram_buffer *buf;
> -uint8_t color = artist_get_color(s);
> +uint8_t color;
>  int dx, dy, t, e, x, y, incy, diago, horiz;
>  bool c1;
>  uint8_t *p;
>  
>  trace_artist_draw_line(x1, y1, x2, y2);
>  
>  if (update_start) {
>  s->vram_start = (x2 << 16) | y2;
>  }
>  
> -buf = &s->vram_buffer[ARTIST_BUFFER_AP];
> -
> -c1 = false;
> -
>  if (x2 > x1) {
>  dx = x2 - x1;
>  } else {
>  dx = x1 - x2;
>  }
>  if (y2 > y1) {
>  dy = y2 - y1;
>  } else {
>  dy = y1 - y2;
>  }
> +
> +c1 = false;
>  if (dy > dx) {
>  t = y2;
>  y2 = x2;
>  x2 = t;
>  
>  t = y1;
>  y1 = x1;
>  x1 = t;
>  
>  t = dx;
>  dx = dy;
>  dy = t;
>  
>  c1 = true;
>  }
>  
>  if (x1 > x2) {
>  t = y2;
>  y2 = y1;
>  y1 = t;
>  
>  t = x1;
>  x1 = x2;
>  x2 = t;
>  }
>  
>  horiz = dy << 1;
>  diago = (dy - dx) << 1;
>  e = (dy << 1) - dx;
>  
>  if (y1 <= y2) {
>  incy = 1;
>  } else {
>  incy = -1;
>  }
>  x = x1;
>  y = y1;
> +color = artist_get_color(s);
> +buf = &s->vram_buffer[ARTIST_BUFFER_AP];
>  
>  do {
>  if (c1) {
>  p = buf->data + x * s->width + y;
>  } else {
>  p = buf->data + y * s->width + x;
>  }
>  
>  if (skip_pix > 0) {
>  skip_pix--;
>  } else {
>  artist_rop8(s, p, color);
>  }
>  
>  if (e > 0) {
>  artist_invalidate_lines(buf, y, 1);
>  y  += incy;
>  e  += diago;
>  } else {
>  e += horiz;
>  }
>  x++;
>  } while (x <= x2 && (max_pix == -1 || --max_pix > 0));
>  }
> -- 
> 2.21.1
> 

Acked-by: Sven Schnelle 



Re: [PATCH 5/5] hw/display/artist: Remove dead code (CID 1419388 & 1419389)

2020-02-15 Thread Sven Schnelle
On Fri, Feb 14, 2020 at 01:13:02AM +0100, Philippe Mathieu-Daudé wrote:
> Coverity reports:
> 
>   *** CID 1419388:  Control flow issues  (DEADCODE)
>   /hw/display/artist.c: 739 in draw_line_xy()
>   733 if (endy < 0) {
>   734 endy = 0;
>   735 }
>   736
>   737
>   738 if (endx < 0) {
>   >>> CID 1419388:  Control flow issues  (DEADCODE)
>   >>> Execution cannot reach this statement: "return;".
>   739 return;
>   740 }
>   741
>   742 if (endy < 0) {
>   743 return;
>   744 }
> 
>   *** CID 1419389:  Control flow issues  (DEADCODE)
>   /hw/display/artist.c: 743 in draw_line_xy()
>   737
>   738 if (endx < 0) {
>   739 return;
>   740 }
>   741
>   742 if (endy < 0) {
>   >>> CID 1419389:  Control flow issues  (DEADCODE)
>   >>> Execution cannot reach this statement: "return;".
>   743 return;
>   744 }
>   745
>   746 trace_artist_draw_line(startx, starty, endx, endy);
>   747 draw_line(s, startx, starty, endx, endy, false, -1, -1);
>   748 }
> 
> Fixes: Covertiy CID 1419388 and 1419389 (commit 4765384ce33)
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  hw/display/artist.c | 9 -
>  1 file changed, 9 deletions(-)
> 
> diff --git a/hw/display/artist.c b/hw/display/artist.c
> index 5492079116..753dbb9a77 100644
> --- a/hw/display/artist.c
> +++ b/hw/display/artist.c
> @@ -690,59 +690,50 @@ static void draw_line_size(ARTISTState *s, bool 
> update_start)
>  static void draw_line_xy(ARTISTState *s, bool update_start)
>  {
>  
>  int startx = artist_get_x(s->vram_start);
>  int starty = artist_get_y(s->vram_start);
>  int sizex = artist_get_x(s->blockmove_size);
>  int sizey = artist_get_y(s->blockmove_size);
>  int linexy = s->line_xy >> 16;
>  int endx, endy;
>  
>  endx = startx;
>  endy = starty;
>  
>  if (sizex > 0) {
>  endx = startx + linexy;
>  }
>  
>  if (sizex < 0) {
>  endx = startx;
>  startx -= linexy;
>  }
>  
>  if (sizey > 0) {
>  endy = starty + linexy;
>  }
>  
>  if (sizey < 0) {
>  endy = starty;
>  starty -= linexy;
>  }
>  
>  if (startx < 0) {
>  startx = 0;
>  }
>  
>  if (endx < 0) {
>  endx = 0;
>  }
>  
>  if (starty < 0) {
>  starty = 0;
>  }
>  
>  if (endy < 0) {
>  endy = 0;
>  }
>  
> -
> -if (endx < 0) {
> -return;
> -}
> -
> -if (endy < 0) {
> -return;
> -}
> -
>  draw_line(s, startx, starty, endx, endy, false, -1, -1);
>  }
>  
> -- 
> 2.21.1
> 

Acked-by: Sven Schnelle 



Re: [PATCH 2/5] hw/display/artist: Remove pointless initialization

2020-02-15 Thread Sven Schnelle
On Fri, Feb 14, 2020 at 01:12:59AM +0100, Philippe Mathieu-Daudé wrote:
> We are initializating incy inconditionally:
> 
> if (y1 <= y2) {
> incy = 1;
> } else {
> incy = -1;
> }
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  hw/display/artist.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/hw/display/artist.c b/hw/display/artist.c
> index abacb0e27d..47f0e9f0bc 100644
> --- a/hw/display/artist.c
> +++ b/hw/display/artist.c
> @@ -557,91 +557,90 @@ static void fill_window(ARTISTState *s, int startx, int 
> starty,
>  static void draw_line(ARTISTState *s, int x1, int y1, int x2, int y2,
>bool update_start, int skip_pix, int max_pix)
>  {
>  struct vram_buffer *buf;
>  uint8_t color = artist_get_color(s);
>  int dx, dy, t, e, x, y, incy, diago, horiz;
>  bool c1;
>  uint8_t *p;
>  
>  trace_artist_draw_line(x1, y1, x2, y2);
>  
>  if (update_start) {
>  s->vram_start = (x2 << 16) | y2;
>  }
>  
>  buf = &s->vram_buffer[ARTIST_BUFFER_AP];
>  
>  c1 = false;
> -incy = 1;
>  
>  if (x2 > x1) {
>  dx = x2 - x1;
>  } else {
>  dx = x1 - x2;
>  }
>  if (y2 > y1) {
>  dy = y2 - y1;
>  } else {
>  dy = y1 - y2;
>  }
>  if (dy > dx) {
>  t = y2;
>  y2 = x2;
>  x2 = t;
>  
>  t = y1;
>  y1 = x1;
>  x1 = t;
>  
>  t = dx;
>  dx = dy;
>  dy = t;
>  
>  c1 = true;
>  }
>  
>  if (x1 > x2) {
>  t = y2;
>  y2 = y1;
>  y1 = t;
>  
>  t = x1;
>  x1 = x2;
>  x2 = t;
>  }
>  
>  horiz = dy << 1;
>  diago = (dy - dx) << 1;
>  e = (dy << 1) - dx;
>  
>  if (y1 <= y2) {
>  incy = 1;
>  } else {
>  incy = -1;
>  }
>  x = x1;
>  y = y1;
>  
>  do {
>  if (c1) {
>  p = buf->data + x * s->width + y;
>  } else {
>  p = buf->data + y * s->width + x;
>  }
>  
>  if (skip_pix > 0) {
>  skip_pix--;
>  } else {
>  artist_rop8(s, p, color);
>  }
>  
>  if (e > 0) {
>  artist_invalidate_lines(buf, y, 1);
>  y  += incy;
>  e  += diago;
>  } else {
>  e += horiz;
>  }
>  x++;
>  } while (x <= x2 && (max_pix == -1 || --max_pix > 0));
>  }
> -- 
> 2.21.1
> 

Acked-by: Sven Schnelle 



Re: [PATCH 1/5] hw/display/artist: Move trace event to draw_line()

2020-02-15 Thread Sven Schnelle
On Fri, Feb 14, 2020 at 01:12:58AM +0100, Philippe Mathieu-Daudé wrote:
> Instead of emitting the trace event before each call to
> draw_line(), call it once at draw_line() entrance.
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  hw/display/artist.c | 6 +-
>  1 file changed, 1 insertion(+), 5 deletions(-)
> 
> diff --git a/hw/display/artist.c b/hw/display/artist.c
> index 65be9e3554..abacb0e27d 100644
> --- a/hw/display/artist.c
> +++ b/hw/display/artist.c
> @@ -557,90 +557,91 @@ static void fill_window(ARTISTState *s, int startx, int 
> starty,
>  static void draw_line(ARTISTState *s, int x1, int y1, int x2, int y2,
>bool update_start, int skip_pix, int max_pix)
>  {
>  struct vram_buffer *buf;
>  uint8_t color = artist_get_color(s);
>  int dx, dy, t, e, x, y, incy, diago, horiz;
>  bool c1;
>  uint8_t *p;
>  
> +trace_artist_draw_line(x1, y1, x2, y2);
>  
>  if (update_start) {
>  s->vram_start = (x2 << 16) | y2;
>  }
>  
>  buf = &s->vram_buffer[ARTIST_BUFFER_AP];
>  
>  c1 = false;
>  incy = 1;
>  
>  if (x2 > x1) {
>  dx = x2 - x1;
>  } else {
>  dx = x1 - x2;
>  }
>  if (y2 > y1) {
>  dy = y2 - y1;
>  } else {
>  dy = y1 - y2;
>  }
>  if (dy > dx) {
>  t = y2;
>  y2 = x2;
>  x2 = t;
>  
>  t = y1;
>  y1 = x1;
>  x1 = t;
>  
>  t = dx;
>  dx = dy;
>  dy = t;
>  
>  c1 = true;
>  }
>  
>  if (x1 > x2) {
>  t = y2;
>  y2 = y1;
>  y1 = t;
>  
>  t = x1;
>  x1 = x2;
>  x2 = t;
>  }
>  
>  horiz = dy << 1;
>  diago = (dy - dx) << 1;
>  e = (dy << 1) - dx;
>  
>  if (y1 <= y2) {
>  incy = 1;
>  } else {
>  incy = -1;
>  }
>  x = x1;
>  y = y1;
>  
>  do {
>  if (c1) {
>  p = buf->data + x * s->width + y;
>  } else {
>  p = buf->data + y * s->width + x;
>  }
>  
>  if (skip_pix > 0) {
>  skip_pix--;
>  } else {
>  artist_rop8(s, p, color);
>  }
>  
>  if (e > 0) {
>  artist_invalidate_lines(buf, y, 1);
>  y  += incy;
>  e  += diago;
>  } else {
>  e += horiz;
>  }
>  x++;
>  } while (x <= x2 && (max_pix == -1 || --max_pix > 0));
>  }
> @@ -648,13 +649,12 @@ static void draw_line(ARTISTState *s, int x1, int y1, 
> int x2, int y2,
>  static void draw_line_pattern_start(ARTISTState *s)
>  {
>  
>  int startx = artist_get_x(s->vram_start);
>  int starty = artist_get_y(s->vram_start);
>  int endx = artist_get_x(s->blockmove_size);
>  int endy = artist_get_y(s->blockmove_size);
>  int pstart = s->line_pattern_start >> 16;
>  
> -trace_artist_draw_line(startx, starty, endx, endy);
>  draw_line(s, startx, starty, endx, endy, false, -1, pstart);
>  s->line_pattern_skip = pstart;
>  }
> @@ -662,15 +662,14 @@ static void draw_line_pattern_start(ARTISTState *s)
>  static void draw_line_pattern_next(ARTISTState *s)
>  {
>  
>  int startx = artist_get_x(s->vram_start);
>  int starty = artist_get_y(s->vram_start);
>  int endx = artist_get_x(s->blockmove_size);
>  int endy = artist_get_y(s->blockmove_size);
>  int line_xy = s->line_xy >> 16;
>  
> -trace_artist_draw_line(startx, starty, endx, endy);
>  draw_line(s, startx, starty, endx, endy, false, s->line_pattern_skip,
>s->line_pattern_skip + line_xy);
>  s->line_pattern_skip += line_xy;
>  s->image_bitmap_op ^= 2;
>  }
> @@ -678,84 +677,81 @@ static void draw_line_pattern_next(ARTISTState *s)
>  static void draw_line_size(ARTISTState *s, bool update_start)
>  {
>  
>  int startx = artist_get_x(s->vram_start);
>  int starty = artist_get_y(s->vram_start);
>  int endx = artist_get_x(s->line_size);
>  int endy = artist_get_y(s->line_size);
>  
> -trace_artist_draw_line(startx, starty, endx, endy);
>  draw_line(s, startx, starty, endx, endy, update_start, -1, -1);
>  }
>  
>  static void draw_line_xy(ARTISTState *s, bool update_start)
>  {
>  
>  int startx = artist_get_x(s->vram_start);
>  int starty = artist_get_y(s->vram_start);
>  int sizex = artist_get_x(s->blockmove_size);
>  int sizey = artist_get_y(s->blockmove_size);
>  int linexy = s->line_xy >> 16;
>  int endx, endy;
>  
>  endx = startx;
>  endy = starty;
>  
>  if (sizex > 0) {
>  endx = startx + linexy;
>  }
>  
>  if (sizex < 0) {
>  endx = startx;
>  startx -= linexy;
>  }
>  
>  if (sizey > 0) {
>  endy = starty + linexy;
>  }
>  
>  if (sizey < 0) {
>  endy = starty;
>  starty -= linexy;
>  }
>  
>  if (startx < 0) {
>  startx = 0;
>  }
>  
>  if (endx < 0) {
>

Re: [PATCH] net: tulip: check frame size and r/w data length

2020-02-15 Thread Sven Schnelle
Hi,

thanks for your patch.

On Tue, Feb 11, 2020 at 01:09:30PM +0530, P J P wrote:
> From: Prasad J Pandit 
> diff --git a/hw/net/tulip.c b/hw/net/tulip.c
> index cfac2719d3..aca2a3f17f 100644
> --- a/hw/net/tulip.c
> +++ b/hw/net/tulip.c
> @@ -164,27 +164,35 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct 
> tulip_descriptor *desc)
>  int len2 = (desc->control >> RDES1_BUF2_SIZE_SHIFT) & 
> RDES1_BUF2_SIZE_MASK;
>  int len;
>  
> -if (s->rx_frame_len && len1) {
> -if (s->rx_frame_len > len1) {
> -len = len1;
> -} else {
> -len = s->rx_frame_len;
> -}
> -pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
> -(s->rx_frame_size - s->rx_frame_len), len);
> -s->rx_frame_len -= len;
> +if (!len1 || !len2 || !s->rx_frame_len) {
> +return;

I haven't tested the patch yet, but would that work if the guest OS passes
only one buffer to the card? I.e. len1 = x, and len2 = 0 because only
buffer 1 is available?

Regards
Sven



Re: [PATCH 1/2] s390x: fix memleaks in cpu_finalize

2020-02-15 Thread Philippe Mathieu-Daudé

Hi Pan,

On 2/15/20 9:32 AM, pannengy...@huawei.com wrote:

From: Pan Nengyuan 

This patch fix memleaks when we call tests/qtest/cpu-plug-test on s390x. The 
leak stack is as follow:

Direct leak of 48 byte(s) in 1 object(s) allocated from:
 #0 0x7fb43c7cd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
 #1 0x7fb43be2149d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
 #2 0x558ba96da716 in timer_new_full 
/mnt/sdb/qemu-new/qemu/include/qemu/timer.h:530
 #3 0x558ba96da716 in timer_new 
/mnt/sdb/qemu-new/qemu/include/qemu/timer.h:551
 #4 0x558ba96da716 in timer_new_ns 
/mnt/sdb/qemu-new/qemu/include/qemu/timer.h:569
 #5 0x558ba96da716 in s390_cpu_initfn 
/mnt/sdb/qemu-new/qemu/target/s390x/cpu.c:285
 #6 0x558ba9c969ab in object_init_with_type 
/mnt/sdb/qemu-new/qemu/qom/object.c:372
 #7 0x558ba9c9eb5f in object_initialize_with_type 
/mnt/sdb/qemu-new/qemu/qom/object.c:516
 #8 0x558ba9c9f053 in object_new_with_type 
/mnt/sdb/qemu-new/qemu/qom/object.c:684
 #9 0x558ba967ede6 in s390x_new_cpu 
/mnt/sdb/qemu-new/qemu/hw/s390x/s390-virtio-ccw.c:64
 #10 0x558ba99764b3 in hmp_cpu_add 
/mnt/sdb/qemu-new/qemu/hw/core/machine-hmp-cmds.c:57
 #11 0x558ba9b1c27f in handle_hmp_command 
/mnt/sdb/qemu-new/qemu/monitor/hmp.c:1082
 #12 0x558ba96c1b02 in qmp_human_monitor_command 
/mnt/sdb/qemu-new/qemu/monitor/misc.c:142

Reported-by: Euler Robot 
Signed-off-by: Pan Nengyuan 
---
  target/s390x/cpu.c | 4 
  1 file changed, 4 insertions(+)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index cf84d307c6..fff793a4eb 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -294,6 +294,10 @@ static void s390_cpu_finalize(Object *obj)
  
  qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);

  g_free(cpu->irqstate);
+timer_del(cpu->env.tod_timer);
+timer_del(cpu->env.cpu_timer);


Similarly to your other cleanups, shouldn't we move the timer_new_ns() 
into a realize() function, then do the timer_del() in unrealize()?



+timer_free(cpu->env.tod_timer);
+timer_free(cpu->env.cpu_timer);


The timer_free() is correct.


  #endif
  }
  






Re: [PATCH v2] Handle gdb.MemoryError exception in dump-guest-memory.py

2020-02-15 Thread Marc-André Lureau
Hi

On Sat, Feb 15, 2020 at 1:34 AM Kevin Buettner  wrote:
>
> [Included a "Signed-off-by" line in this version.]
>
> I recently investigated a bug in which the dump-guest-memory.py script
> sees a gdb.MemoryError exception while attempting to dump memory
> obtained from a QEMU core dump.  (And, yes, dump-guest-core=on was
> specified in the -machine option of the QEMU invocation.)
>
> It turns out that memory region in question is not being placed in the
> core dump and, after stepping through the kernel core dumping code
> responsible for making this decision, it looks reasonable to me to not
> include that region in the core dump.  The region in question consists
> of all zeros and, according to the kernel's logic, has never been
> written to.
>
> This commit makes a small change to the dump-guest-memory script to
> cause inaccessible memory to be dumped as zeroes.  This avoids the
> exception and places the correct values in the guest memory dump.
>
> Signed-off-by: Kevin Buettner 
> ---
>  scripts/dump-guest-memory.py | 7 ++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/scripts/dump-guest-memory.py b/scripts/dump-guest-memory.py
> index 4177261d33..fbdfba458b 100644
> --- a/scripts/dump-guest-memory.py
> +++ b/scripts/dump-guest-memory.py
> @@ -539,7 +539,12 @@ shape and this command should mostly work."""
>
>  while left > 0:
>  chunk_size = min(TARGET_PAGE_SIZE, left)
> -chunk = qemu_core.read_memory(cur, chunk_size)
> +try:
> +chunk = qemu_core.read_memory(cur, chunk_size)
> +except gdb.MemoryError:
> +# Consider blocks of memory absent from a core file
> +# as being zeroed.
> +chunk = bytes(chunk_size)

That seems reasonable, but it will silently ignore any other memory error.

Keith Seitz also looked at this bug, and he was wondering if BFD
shouldn't treat the missing section differently:
https://bugzilla.redhat.com/show_bug.cgi?id=151#c6

Keith, what do you think?

thanks




Re: [PATCH v2 01/30] configure: Allow user to specify sphinx-build binary

2020-02-15 Thread Markus Armbruster
Peter Maydell  writes:

> On Fri, 14 Feb 2020 at 17:18, Markus Armbruster  wrote:
>> I decided I prefer this as a separate patch, between PATCH 01 and 02.
>>
>> Hmm, maybe I should squash the last hunk into PATCH 01.
>>
>>
>> From 10d174a9f811708807fb60a610e88084f282c222 Mon Sep 17 00:00:00 2001
>> From: Markus Armbruster 
>> Date: Fri, 14 Feb 2020 07:33:43 +0100
>> Subject: [PATCH] configure: Pick sphinx-build-3 when available
>>
>> The next commit will require a sphinx-build that uses Python 3.  On
>> some systems, sphinx-build is fine, on others you need to use
>> sphinx-build-3.  To keep things working out of the box on both kinds
>> of systems, try sphinx-build-3, then sphinx-build.
>>
>> Signed-off-by: Markus Armbruster 
>> ---
>>  configure | 15 +--
>>  1 file changed, 13 insertions(+), 2 deletions(-)
>>
>> diff --git a/configure b/configure
>> index 14172909f0..4cbeb06b86 100755
>> --- a/configure
>> +++ b/configure
>> @@ -584,7 +584,6 @@ query_pkg_config() {
>>  }
>>  pkg_config=query_pkg_config
>>  sdl2_config="${SDL2_CONFIG-${cross_prefix}sdl2-config}"
>> -sphinx_build=sphinx-build
>>
>>  # If the user hasn't specified ARFLAGS, default to 'rv', just as make does.
>>  ARFLAGS="${ARFLAGS-rv}"
>> @@ -903,6 +902,7 @@ fi
>>
>>  : ${make=${MAKE-make}}
>>  : ${install=${INSTALL-install}}
>> +
>>  # We prefer python 3.x. A bare 'python' is traditionally
>>  # python 2.x, but some distros have it as python 3.x, so
>>  # we check that too
>
>
> Stray whitespace change.

I added the blank line to separate the Python check from its
surroundings on both sides.  I'll drop it.

>> @@ -915,6 +915,17 @@ do
>>  break
>>  fi
>>  done
>> +
>> +sphinx_build=
>> +for binary in sphinx-build-3 sphinx-build
>> +do
>> +if has "$binary"
>> +then
>> +sphinx_build=$(command -v "$binary")
>> +break
>> +fi
>> +done
>> +
>>  : ${smbd=${SMBD-/usr/sbin/smbd}}
>>
>>  # Default objcc to clang if available, otherwise use CC
>> @@ -4803,7 +4814,7 @@ has_sphinx_build() {
>>  # sphinx-build doesn't exist at all or if it is too old.
>>  mkdir -p "$TMPDIR1/sphinx"
>>  touch "$TMPDIR1/sphinx/index.rst"
>> -$sphinx_build -c "$source_path/docs" -b html "$TMPDIR1/sphinx" 
>> "$TMPDIR1/sphinx/out" >/dev/null 2>&1
>> +"$sphinx_build" -c "$source_path/docs" -b html "$TMPDIR1/sphinx" 
>> "$TMPDIR1/sphinx/out" >/dev/null 2>&1
>>  }
>>
>>  # Check if tools are available to build documentation.
>> --
>> 2.21.1
>
> Otherwise
> Reviewed-by: Peter Maydell 

Thanks!




Re: QEMU Sockets Networking Backend Multicast Networking Fix

2020-02-15 Thread Markus Armbruster
Jason, please have a look.

Faisal Al-Humaimidi  writes:

> Hello QEMU developers,
>
> I have noticed a bug in the `mcast` option of the `socket` networking
> backend, where I simply cannot join a multicast group (tested in Windows 10
> with QEMU 4.2.0 release). I have found a fix to the problem. The problem
> was mainly due to the fact that QEMU was binding to the multicast address,
> and not the local address or the default INADDR_ANY (0.0.0.0) if no local
> address is used.
>
> Here's the patch text (as well as attached with this email), that outlines
> my fix:
>
> ```
> diff -uarN qemu-4.2.0.original/net/socket.c qemu-4.2.0.modified/net/socket.c
> --- qemu-4.2.0.original/net/socket.c 2019-12-12 10:20:48.0 -0800
> +++ qemu-4.2.0.modified/net/socket.c 2020-02-14 10:30:16.395973453 -0800
> @@ -253,6 +253,15 @@
>  goto fail;
>  }
>
> +/* Preserve the multicast address, and bind to a non-multicast group
> (e.g. a
> + * local address).
> + */
> +struct in_addr group_addr = mcastaddr->sin_addr;
> +if (localaddr) {
> +mcastaddr->sin_addr = *localaddr;
> +} else {
> +mcastaddr->sin_addr.s_addr = htonl(INADDR_ANY);
> +}
>  ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
>  if (ret < 0) {
>  error_setg_errno(errp, errno, "can't bind ip=%s to socket",
> @@ -260,7 +269,10 @@
>  goto fail;
>  }
>
> -/* Add host to multicast group */
> +/* Restore the multicast address. */
> +mcastaddr->sin_addr = group_addr;
> +
> +/* Add host to multicast group. */
>  imr.imr_multiaddr = mcastaddr->sin_addr;
>  if (localaddr) {
>  imr.imr_interface = *localaddr;
> @@ -277,7 +289,7 @@
>  goto fail;
>  }
>
> -/* Force mcast msgs to loopback (eg. several QEMUs in same host */
> +/* Force mcast msgs to loopback (eg. several QEMUs in same host). */
>  loop = 1;
>  ret = qemu_setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
>&loop, sizeof(loop));
> @@ -287,7 +299,7 @@
>  goto fail;
>  }
>
> -/* If a bind address is given, only send packets from that address */
> +/* If a bind address is given, only send packets from that address. */
>  if (localaddr != NULL) {
>  ret = qemu_setsockopt(fd, IPPROTO_IP, IP_MULTICAST_IF,
>localaddr, sizeof(*localaddr));
> ```
>
> Regards,
> Faisal Al-Humaimidi




Re: [PATCH 2/2] hw: move timer_new from init() into realize() to avoid memleaks

2020-02-15 Thread Philippe Mathieu-Daudé

On 2/15/20 9:37 AM, pannengy...@huawei.com wrote:

From: Pan Nengyuan 

There are some memleaks when we call 'device_list_properties'. This patch move 
timer_new from init into realize to fix it.
Meanwhile, do the null check in mos6522_reset() to avoid null deref if we move 
timer_new into realize().

Reported-by: Euler Robot 
Signed-off-by: Pan Nengyuan 
---
  hw/arm/pxa2xx.c| 17 +++--
  hw/arm/spitz.c |  8 +++-
  hw/arm/strongarm.c | 18 --
  hw/misc/mos6522.c  | 14 --
  hw/timer/cadence_ttc.c | 16 +++-
  5 files changed, 53 insertions(+), 20 deletions(-)

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index b33f8f1351..56a36202d7 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -1134,18 +1134,22 @@ static void pxa2xx_rtc_init(Object *obj)
  s->last_rtcpicr = 0;
  s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);
  
+sysbus_init_irq(dev, &s->rtc_irq);

+
+memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,
+  "pxa2xx-rtc", 0x1);
+sysbus_init_mmio(dev, &s->iomem);
+}
+
+static void pxa2xx_rtc_realize(DeviceState *dev, Error **errp)
+{
+PXA2xxRTCState *s = PXA2XX_RTC(dev);
  s->rtc_hz= timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick,s);
  s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);
  s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);
  s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);
  s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);
  s->rtc_pi= timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick,s);
-
-sysbus_init_irq(dev, &s->rtc_irq);
-
-memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,
-  "pxa2xx-rtc", 0x1);
-sysbus_init_mmio(dev, &s->iomem);
  }
  
  static int pxa2xx_rtc_pre_save(void *opaque)

@@ -1203,6 +1207,7 @@ static void pxa2xx_rtc_sysbus_class_init(ObjectClass 
*klass, void *data)
  
  dc->desc = "PXA2xx RTC Controller";

  dc->vmsd = &vmstate_pxa2xx_rtc_regs;
+dc->realize = pxa2xx_rtc_realize;
  }
  
  static const TypeInfo pxa2xx_rtc_sysbus_info = {

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index e001088103..cbfa6934cf 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -524,11 +524,16 @@ static void spitz_keyboard_init(Object *obj)
  
  spitz_keyboard_pre_map(s);
  
-s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);

  qdev_init_gpio_in(dev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
  qdev_init_gpio_out(dev, s->sense, SPITZ_KEY_SENSE_NUM);
  }
  
+static void spitz_keyboard_realize(DeviceState *dev, Error **errp)

+{
+SpitzKeyboardState *s = SPITZ_KEYBOARD(dev);
+s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);
+}
+
  /* LCD backlight controller */
  
  #define LCDTG_RESCTL	0x00

@@ -1115,6 +1120,7 @@ static void spitz_keyboard_class_init(ObjectClass *klass, 
void *data)
  DeviceClass *dc = DEVICE_CLASS(klass);
  
  dc->vmsd = &vmstate_spitz_kbd;

+dc->realize = spitz_keyboard_realize;
  }
  
  static const TypeInfo spitz_keyboard_info = {

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index cd8a99aaf2..3010d765bb 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -399,9 +399,6 @@ static void strongarm_rtc_init(Object *obj)
  s->last_rcnr = (uint32_t) mktimegm(&tm);
  s->last_hz = qemu_clock_get_ms(rtc_clock);
  
-s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);

-s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);
-
  sysbus_init_irq(dev, &s->rtc_irq);
  sysbus_init_irq(dev, &s->rtc_hz_irq);
  
@@ -410,6 +407,13 @@ static void strongarm_rtc_init(Object *obj)

  sysbus_init_mmio(dev, &s->iomem);
  }
  
+static void strongarm_rtc_realize(DeviceState *dev, Error **errp)

+{
+StrongARMRTCState *s = STRONGARM_RTC(dev);
+s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);
+s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);
+}
+
  static int strongarm_rtc_pre_save(void *opaque)
  {
  StrongARMRTCState *s = opaque;
@@ -451,6 +455,7 @@ static void strongarm_rtc_sysbus_class_init(ObjectClass 
*klass, void *data)
  
  dc->desc = "StrongARM RTC Controller";

  dc->vmsd = &vmstate_strongarm_rtc_regs;
+dc->realize = strongarm_rtc_realize;
  }
  
  static const TypeInfo strongarm_rtc_sysbus_info = {

@@ -1240,15 +1245,16 @@ static void strongarm_uart_init(Object *obj)
"uart", 0x1);
  sysbus_init_mmio(dev, &s->iomem);
  sysbus_init_irq(dev, &s->irq);
-
-s->rx_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, 
strongarm_uart_rx_to, s);
-s->tx_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, strongarm_uart_tx, s);
  }
  
  static void strongarm_uart_realize(DeviceState *dev, Error **errp)

  {
  StrongARMUARTState *s = STRONGARM_UART

Re: [PATCH 1/2] s390x: fix memleaks in cpu_finalize

2020-02-15 Thread Pan Nengyuan



On 2/15/2020 6:28 PM, Philippe Mathieu-Daudé wrote:
> Hi Pan,
> 
> On 2/15/20 9:32 AM, pannengy...@huawei.com wrote:
>> From: Pan Nengyuan 
>>
>> This patch fix memleaks when we call tests/qtest/cpu-plug-test on s390x. The 
>> leak stack is as follow:
>>
>> Direct leak of 48 byte(s) in 1 object(s) allocated from:
>>  #0 0x7fb43c7cd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
>>  #1 0x7fb43be2149d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
>>  #2 0x558ba96da716 in timer_new_full 
>> /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:530
>>  #3 0x558ba96da716 in timer_new 
>> /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:551
>>  #4 0x558ba96da716 in timer_new_ns 
>> /mnt/sdb/qemu-new/qemu/include/qemu/timer.h:569
>>  #5 0x558ba96da716 in s390_cpu_initfn 
>> /mnt/sdb/qemu-new/qemu/target/s390x/cpu.c:285
>>  #6 0x558ba9c969ab in object_init_with_type 
>> /mnt/sdb/qemu-new/qemu/qom/object.c:372
>>  #7 0x558ba9c9eb5f in object_initialize_with_type 
>> /mnt/sdb/qemu-new/qemu/qom/object.c:516
>>  #8 0x558ba9c9f053 in object_new_with_type 
>> /mnt/sdb/qemu-new/qemu/qom/object.c:684
>>  #9 0x558ba967ede6 in s390x_new_cpu 
>> /mnt/sdb/qemu-new/qemu/hw/s390x/s390-virtio-ccw.c:64
>>  #10 0x558ba99764b3 in hmp_cpu_add 
>> /mnt/sdb/qemu-new/qemu/hw/core/machine-hmp-cmds.c:57
>>  #11 0x558ba9b1c27f in handle_hmp_command 
>> /mnt/sdb/qemu-new/qemu/monitor/hmp.c:1082
>>  #12 0x558ba96c1b02 in qmp_human_monitor_command 
>> /mnt/sdb/qemu-new/qemu/monitor/misc.c:142
>>
>> Reported-by: Euler Robot 
>> Signed-off-by: Pan Nengyuan 
>> ---
>>   target/s390x/cpu.c | 4 
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
>> index cf84d307c6..fff793a4eb 100644
>> --- a/target/s390x/cpu.c
>> +++ b/target/s390x/cpu.c
>> @@ -294,6 +294,10 @@ static void s390_cpu_finalize(Object *obj)
>>     qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
>>   g_free(cpu->irqstate);
>> +    timer_del(cpu->env.tod_timer);
>> +    timer_del(cpu->env.cpu_timer);
> 
> Similarly to your other cleanups, shouldn't we move the timer_new_ns() into a 
> realize() function, then do the timer_del() in unrealize()?

Sure, I have no problem with that. I will change and repost it.

Thanks.

> 
>> +    timer_free(cpu->env.tod_timer);
>> +    timer_free(cpu->env.cpu_timer);
> 
> The timer_free() is correct.
> 
>>   #endif
>>   }
>>  
> 
> .



Build for qemu-sh4 broken since 2445971604c

2020-02-15 Thread John Paul Adrian Glaubitz
Hi!

Currently trying to build qemu-sh4 in static configuration fails with:

make[1]: Entering directory '/root/qemu/slirp'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/root/qemu/slirp'
  CC  sh4-linux-user/tcg/tcg-op-gvec.o
/root/qemu/tcg/tcg-op-gvec.c:298:25: error: unknown type name 
‘gen_helper_gvec_5_ptr’; did you mean ‘gen_helper_gvec_4_ptr’?
  298 | gen_helper_gvec_5_ptr *fn)
  | ^
  | gen_helper_gvec_4_ptr
make[1]: *** [/root/qemu/rules.mak:69: tcg/tcg-op-gvec.o] Error 1
make: *** [Makefile:497: sh4-linux-user/all] Error 2

This seems to have been introduced with:

commit 2445971604c1cfd3ec484457159f4ac300fb04d2
Author: Richard Henderson 
Date:   Tue Feb 11 16:31:38 2020 -0800

tcg: Add tcg_gen_gvec_5_ptr

Extend the vector generator infrastructure to handle
5 vector arguments.

Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Alex Bennée 
Reviewed-by: Taylor Simpson 
Signed-off-by: Richard Henderson 

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer - glaub...@debian.org
`. `'   Freie Universitaet Berlin - glaub...@physik.fu-berlin.de
  `-GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913



[PULL 07/18] qga/qapi-schema.json: Fix indent level on doc comments

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

The current doc generation doesn't care much about indentation levels,
but we would like to switch to an rST format, and rST does care about
indentation.

Make the doc comments more strongly consistent about indentation
for multiline constructs like:

@arg: description line 1
  description line 2

Returns: line one
 line 2

so that there is always exactly one space after the colon, and
subsequent lines align with the first.

This commit is a purely whitespace change, and it does not alter the
generated .texi files (because the texi generation code strips away
all the extra whitespace).  This does mean that we end up with some
over-length lines.

Note that when the documentation for an argument fits on a single
line like this:

@arg: one line only

then stray extra spaces after the ':' don't affect the rST output, so
I have not attempted to methodically fix them, though the preference
is a single space here too.

Signed-off-by: Peter Maydell 
Reviewed-by: Markus Armbruster 
Message-Id: <20200213175647.17628-6-peter.mayd...@linaro.org>
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qga/qapi-schema.json | 62 ++--
 1 file changed, 31 insertions(+), 31 deletions(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index 23ce6af597..7661b2b3b4 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -416,7 +416,7 @@
 # Returns: GuestFsfreezeStatus ("thawed", "frozen", etc., as defined below)
 #
 # Note: This may fail to properly report the current state as a result of
-# some other guest processes having issued an fs freeze/thaw.
+#   some other guest processes having issued an fs freeze/thaw.
 #
 # Since: 0.15.0
 ##
@@ -431,13 +431,13 @@
 # unfreeze.
 #
 # Note: On Windows, the command is implemented with the help of a
-# Volume Shadow-copy Service DLL helper. The frozen state is limited
-# for up to 10 seconds by VSS.
+#   Volume Shadow-copy Service DLL helper. The frozen state is limited
+#   for up to 10 seconds by VSS.
 #
 # Returns: Number of file systems currently frozen. On error, all filesystems
-# will be thawed. If no filesystems are frozen as a result of this call,
-# then @guest-fsfreeze-status will remain "thawed" and calling
-# @guest-fsfreeze-thaw is not necessary.
+#  will be thawed. If no filesystems are frozen as a result of this 
call,
+#  then @guest-fsfreeze-status will remain "thawed" and calling
+#  @guest-fsfreeze-thaw is not necessary.
 #
 # Since: 0.15.0
 ##
@@ -455,7 +455,7 @@
 #   Invalid mount points are ignored.
 #
 # Returns: Number of file systems currently frozen. On error, all filesystems
-# will be thawed.
+#  will be thawed.
 #
 # Since: 2.2
 ##
@@ -511,12 +511,12 @@
 # Discard (or "trim") blocks which are not in use by the filesystem.
 #
 # @minimum:
-#   Minimum contiguous free range to discard, in bytes. Free ranges
-#   smaller than this may be ignored (this is a hint and the guest
-#   may not respect it).  By increasing this value, the fstrim
-#   operation will complete more quickly for filesystems with badly
-#   fragmented free space, although not all blocks will be discarded.
-#   The default value is zero, meaning "discard every free block".
+#   Minimum contiguous free range to discard, in bytes. Free ranges
+#   smaller than this may be ignored (this is a hint and the guest
+#   may not respect it).  By increasing this value, the fstrim
+#   operation will complete more quickly for filesystems with badly
+#   fragmented free space, although not all blocks will be discarded.
+#   The default value is zero, meaning "discard every free block".
 #
 # Returns: A @GuestFilesystemTrimResponse which contains the
 #  status of all trimmed paths. (since 2.4)
@@ -693,7 +693,7 @@
 # @ip-addresses: List of addresses assigned to @name
 #
 # @statistics: various statistic counters related to @name
-# (since 2.11)
+#  (since 2.11)
 #
 # Since: 1.1
 ##
@@ -743,7 +743,7 @@
 # This is a read-only operation.
 #
 # Returns: The list of all VCPUs the guest knows about. Each VCPU is put on the
-# list exactly once, but their order is unspecified.
+#  list exactly once, but their order is unspecified.
 #
 # Since: 1.5
 ##
@@ -937,8 +937,8 @@
 # This is a read-only operation.
 #
 # Returns: The list of all memory blocks the guest knows about.
-# Each memory block is put on the list exactly once, but their order
-# is unspecified.
+#  Each memory block is put on the list exactly once, but their order
+#  is unspecified.
 #
 # Since: 2.3
 ##
@@ -971,9 +971,9 @@
 # @response: the result of memory block operation.
 #
 # @error-code: the error number.
-#   When memory block operation fails, we assign the value of
-#   'errno' to this member, it indicates what goes wrong.
-#   When the

[PULL 06/18] qga/qapi-schema.json: Fix missing '-' in GuestDiskBusType doc comment

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

The doc comment for GuestDiskBusType doesn't match up with the
enumeration because of a missing hyphen in 'file-backed-virtual'.
This means the docs are rendered wrongly:
   "virtual"
   Win virtual bus type "file-backed" virtual: Win file-backed bus type

   "file-backed-virtual"
   Not documented

Add the missing hyphen.

Signed-off-by: Peter Maydell 
Reviewed-by: Eric Blake 
Reviewed-by: Markus Armbruster 
Message-Id: <20200213175647.17628-5-peter.mayd...@linaro.org>
Signed-off-by: Markus Armbruster 
---
 qga/qapi-schema.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index fb4605cc19..23ce6af597 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -809,7 +809,7 @@
 # @sas: Win serial-attaches SCSI bus type
 # @mmc: Win multimedia card (MMC) bus type
 # @virtual: Win virtual bus type
-# @file-backed virtual: Win file-backed bus type
+# @file-backed-virtual: Win file-backed bus type
 #
 # Since: 2.2; 'Unknown' and all entries below since 2.4
 ##
-- 
2.21.1




[PULL 00/18] QAPI patches for 2020-02-15

2020-02-15 Thread Markus Armbruster
The following changes since commit 517c84cef759a453cfb8f51498aebc909a5f3b39:

  Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200213-pull-request' 
into staging (2020-02-13 18:55:57 +)

are available in the Git repository at:

  git://repo.or.cz/qemu/armbru.git tags/pull-qapi-2020-02-15

for you to fetch changes up to bb5ccf225e81d2801c03e63d16c371f0617270e8:

  qapi: Delete all the "foo: dropped in n.n" notes (2020-02-15 11:41:50 +0100)


QAPI patches for 2020-02-15

* QAPI schema doc comment fixes and cleanups, most of them in
  preparation of the upcoming switch to rST

* A Make dependency typo fix

* configure improvements for sphinx-build


Andrea Bolognani (1):
  qapi: Expand documentation for LostTickPolicy

Markus Armbruster (1):
  configure: Pick sphinx-build-3 when available

Peter Maydell (16):
  configure: Allow user to specify sphinx-build binary
  configure: Check that sphinx-build is using Python 3
  Makefile: Fix typo in dependency list for interop manpages
  qga/qapi-schema.json: Fix missing '-' in GuestDiskBusType doc comment
  qga/qapi-schema.json: Fix indent level on doc comments
  qga/qapi-schema.json: minor format fixups for rST
  qapi/block-core.json: Use literal block for ascii art
  qapi: Fix incorrect "Not documented" claims in QMP documentation
  qapi: Fix indent level on doc comments in json files
  qapi: Remove hardcoded tabs
  qapi/ui.json: Put input-send-event body text in the right place
  qapi/ui.json: Avoid `...' Texinfo style quoting
  qapi: Use explicit bulleted lists
  qapi: Add blank lines before bulleted lists
  qapi/migration.json: Replace _this_ with *this*
  qapi: Delete all the "foo: dropped in n.n" notes

 docs/conf.py |   10 +
 configure|   32 +-
 Makefile |4 +-
 qapi/block-core.json | 1139 +++---
 qapi/block.json  |   47 +-
 qapi/char.json   |   10 +-
 qapi/dump.json   |4 +-
 qapi/introspect.json |   12 +-
 qapi/job.json|   32 +-
 qapi/machine-target.json |   18 +-
 qapi/machine.json|   14 +-
 qapi/migration.json  |  206 -
 qapi/misc-target.json|8 +-
 qapi/misc.json   |  166 +++
 qapi/net.json|   26 +-
 qapi/qdev.json   |   10 +-
 qapi/qom.json|4 +-
 qapi/rocker.json |   12 +-
 qapi/run-state.json  |   34 +-
 qapi/sockets.json|8 +-
 qapi/tpm.json|4 +-
 qapi/trace.json  |   15 +-
 qapi/transaction.json|4 +-
 qapi/ui.json |  117 ++---
 qga/qapi-schema.json |  156 ---
 25 files changed, 1070 insertions(+), 1022 deletions(-)

-- 
2.21.1




[PULL 03/18] configure: Pick sphinx-build-3 when available

2020-02-15 Thread Markus Armbruster
The next commit will require a sphinx-build that uses Python 3.  On
some systems, sphinx-build is fine, on others you need to use
sphinx-build-3.  To keep things working out of the box on both kinds
of systems, try sphinx-build-3, then sphinx-build.

Signed-off-by: Markus Armbruster 
Message-Id: <87a75lqe8e@dusky.pond.sub.org>
Reviewed-by: Peter Maydell 
---
 configure | 14 --
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index 14172909f0..9f7bded369 100755
--- a/configure
+++ b/configure
@@ -584,7 +584,6 @@ query_pkg_config() {
 }
 pkg_config=query_pkg_config
 sdl2_config="${SDL2_CONFIG-${cross_prefix}sdl2-config}"
-sphinx_build=sphinx-build
 
 # If the user hasn't specified ARFLAGS, default to 'rv', just as make does.
 ARFLAGS="${ARFLAGS-rv}"
@@ -915,6 +914,17 @@ do
 break
 fi
 done
+
+sphinx_build=
+for binary in sphinx-build-3 sphinx-build
+do
+if has "$binary"
+then
+sphinx_build=$(command -v "$binary")
+break
+fi
+done
+
 : ${smbd=${SMBD-/usr/sbin/smbd}}
 
 # Default objcc to clang if available, otherwise use CC
@@ -4803,7 +4813,7 @@ has_sphinx_build() {
 # sphinx-build doesn't exist at all or if it is too old.
 mkdir -p "$TMPDIR1/sphinx"
 touch "$TMPDIR1/sphinx/index.rst"
-$sphinx_build -c "$source_path/docs" -b html "$TMPDIR1/sphinx" 
"$TMPDIR1/sphinx/out" >/dev/null 2>&1
+"$sphinx_build" -c "$source_path/docs" -b html "$TMPDIR1/sphinx" 
"$TMPDIR1/sphinx/out" >/dev/null 2>&1
 }
 
 # Check if tools are available to build documentation.
-- 
2.21.1




[PULL 08/18] qga/qapi-schema.json: minor format fixups for rST

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

We would like to switch the doc comments to rST format, and rST
requires a blank line before the start of a bulleted or enumerated
list. Two places in qapi-schema.json were missing this blank line.

Some places were using an indented line as a sort of single-item
bulleted list, which in the Texinfo output comes out all run
onto a single line; use a real bulleted list instead.

Some places unnecessarily indented lists, which confuses rST.

guest-fstrim:minimum's documentation was indented the
right amount to share a line with @minimum, but wasn't
actually doing so.

The indent on the bulleted list in the guest-set-vcpus
Returns section meant rST misindented it.

Changes to the generated Texinfo are very minor (the new
bulleted lists, and a few extra blank lines).

Signed-off-by: Peter Maydell 
Message-Id: <20200213175647.17628-7-peter.mayd...@linaro.org>
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qga/qapi-schema.json | 94 
 1 file changed, 51 insertions(+), 43 deletions(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index 7661b2b3b4..f6fcb59f34 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -510,8 +510,7 @@
 #
 # Discard (or "trim") blocks which are not in use by the filesystem.
 #
-# @minimum:
-#   Minimum contiguous free range to discard, in bytes. Free ranges
+# @minimum: Minimum contiguous free range to discard, in bytes. Free ranges
 #   smaller than this may be ignored (this is a hint and the guest
 #   may not respect it).  By increasing this value, the fstrim
 #   operation will complete more quickly for filesystems with badly
@@ -546,7 +545,8 @@
 # (or set its status to "shutdown") due to other reasons.
 #
 # The following errors may be returned:
-#  If suspend to disk is not supported, Unsupported
+#
+# - If suspend to disk is not supported, Unsupported
 #
 # Notes: It's strongly recommended to issue the guest-sync command before
 #sending commands when the guest resumes
@@ -575,12 +575,14 @@
 #
 # This command does NOT return a response on success. There are two options
 # to check for success:
-#   1. Wait for the SUSPEND QMP event from QEMU
-#   2. Issue the query-status QMP command to confirm the VM status is
-#  "suspended"
+#
+# 1. Wait for the SUSPEND QMP event from QEMU
+# 2. Issue the query-status QMP command to confirm the VM status is
+#"suspended"
 #
 # The following errors may be returned:
-#  If suspend to ram is not supported, Unsupported
+#
+# - If suspend to ram is not supported, Unsupported
 #
 # Notes: It's strongly recommended to issue the guest-sync command before
 #sending commands when the guest resumes
@@ -607,12 +609,14 @@
 #
 # This command does NOT return a response on success. There are two options
 # to check for success:
-#   1. Wait for the SUSPEND QMP event from QEMU
-#   2. Issue the query-status QMP command to confirm the VM status is
-#  "suspended"
+#
+# 1. Wait for the SUSPEND QMP event from QEMU
+# 2. Issue the query-status QMP command to confirm the VM status is
+#"suspended"
 #
 # The following errors may be returned:
-#  If hybrid suspend is not supported, Unsupported
+#
+# - If hybrid suspend is not supported, Unsupported
 #
 # Notes: It's strongly recommended to issue the guest-sync command before
 #sending commands when the guest resumes
@@ -767,18 +771,22 @@
 # Returns: The length of the initial sublist that has been successfully
 #  processed. The guest agent maximizes this value. Possible cases:
 #
-#  - 0:  if the @vcpus list was empty on input. Guest state
-#has not been changed. Otherwise,
-#  - Error:  processing the first node of @vcpus failed for the
-#reason returned. Guest state has not been changed.
-#Otherwise,
-#  - < length(@vcpus): more than zero initial nodes have been 
processed,
-#but not the entire @vcpus list. Guest state has
-#changed accordingly. To retrieve the error
-#(assuming it persists), repeat the call with the
-#successfully processed initial sublist removed.
-#Otherwise,
-#  - length(@vcpus): call successful.
+#  - 0:
+#if the @vcpus list was empty on input. Guest state
+#has not been changed. Otherwise,
+#  - Error:
+#processing the first node of @vcpus failed for the
+#reason returned. Guest state has not been changed.
+#Otherwise,
+#  - < length(@vcpus):
+#more than zero initial nodes have been processed,
+#but not the entire @vcpus list. Guest state has
+#changed accordingly. To retrieve the error
+#(

[PULL 01/18] qapi: Expand documentation for LostTickPolicy

2020-02-15 Thread Markus Armbruster
From: Andrea Bolognani 

The current documentation is fairly terse and not easy to decode
for someone who's not intimately familiar with the inner workings
of timer devices. Expand on it by providing a somewhat verbose
description of what behavior each policy will result in, as seen
from both the guest OS and host point of view.

Signed-off-by: Andrea Bolognani 
Message-Id: <20200211183744.210298-1-abolo...@redhat.com>
Reviewed-by: Ján Tomko 
Reviewed-by: Andrew Jones 
Signed-off-by: Markus Armbruster 
---
 qapi/misc.json | 28 
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/qapi/misc.json b/qapi/misc.json
index 33b94e3589..cd7445d29f 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -163,17 +163,29 @@
 ##
 # @LostTickPolicy:
 #
-# Policy for handling lost ticks in timer devices.
+# Policy for handling lost ticks in timer devices.  Ticks end up getting
+# lost when, for example, the guest is paused.
 #
-# @discard: throw away the missed tick(s) and continue with future injection
-#   normally.  Guest time may be delayed, unless the OS has explicit
-#   handling of lost ticks
+# @discard: throw away the missed ticks and continue with future injection
+#   normally.  The guest OS will see the timer jump ahead by a
+#   potentially quite significant amount all at once, as if the
+#   intervening chunk of time had simply not existed; needless to
+#   say, such a sudden jump can easily confuse a guest OS which is
+#   not specifically prepared to deal with it.  Assuming the guest
+#   OS can deal correctly with the time jump, the time in the guest
+#   and in the host should now match.
 #
-# @delay: continue to deliver ticks at the normal rate.  Guest time will be
-# delayed due to the late tick
+# @delay: continue to deliver ticks at the normal rate.  The guest OS will
+# not notice anything is amiss, as from its point of view time will
+# have continued to flow normally.  The time in the guest should now
+# be behind the time in the host by exactly the amount of time during
+# which ticks have been missed.
 #
-# @slew: deliver ticks at a higher rate to catch up with the missed tick. The
-#guest time should not be delayed once catchup is complete.
+# @slew: deliver ticks at a higher rate to catch up with the missed ticks.
+#The guest OS will not notice anything is amiss, as from its point
+#of view time will have continued to flow normally.  Once the timer
+#has managed to catch up with all the missing ticks, the time in
+#the guest and in the host should match.
 #
 # Since: 2.0
 ##
-- 
2.21.1




[PULL 18/18] qapi: Delete all the "foo: dropped in n.n" notes

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

A handful of QAPI doc comments include lines like
"ppcemb: dropped in 3.1". The doc comment parser will just
put these into whatever the preceding section was; sometimes
that's "Notes", and sometimes it's some random other section,
as with "NetClientDriver" where the "'dump': dropped in 2.12"
line ends up in the "Since:" section.

This tends to render wrongly, more so in the upcoming rST
generator, but sometimes even in the Texinfo, as in the case
of QKeyCode:
   ac_bookmarks
   since 2.10 altgr, altgr_r: dropped in 2.10

Since commit 3264ffced3 (v4.2.0), we have a better place to tell
users about deprecated and deleted functionality --
qemu-deprecated.texi.  These "dropped in" remarks all predate it, and
other feature drops of that vintage are not documented anywhere, so
moving these to qemu-deprecated.texi makes little sense.  Drop them
instead.

Signed-off-by: Peter Maydell 
Message-Id: <20200213175647.17628-19-peter.mayd...@linaro.org>
Reviewed-by: Markus Armbruster 
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/machine.json | 2 --
 qapi/net.json | 4 
 qapi/ui.json  | 1 -
 3 files changed, 7 deletions(-)

diff --git a/qapi/machine.json b/qapi/machine.json
index 704b2b0fe3..6c11e3cf3a 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -20,8 +20,6 @@
 #prefix to produce the corresponding QEMU executable name. This
 #is true even for "qemu-system-x86_64".
 #
-# ppcemb: dropped in 3.1
-#
 # Since: 3.0
 ##
 { 'enum' : 'SysEmuTarget',
diff --git a/qapi/net.json b/qapi/net.json
index 80dcf0df06..1cb9a7d782 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -446,8 +446,6 @@
 # Available netdev drivers.
 #
 # Since: 2.7
-#
-# 'dump': dropped in 2.12
 ##
 { 'enum': 'NetClientDriver',
   'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
@@ -493,8 +491,6 @@
 # @opts: device type specific properties (legacy)
 #
 # Since: 1.2
-#
-# 'vlan': dropped in 3.0
 ##
 { 'struct': 'NetLegacy',
   'data': {
diff --git a/qapi/ui.json b/qapi/ui.json
index 89126da395..e16e98a060 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -779,7 +779,6 @@
 # @ac_forward: since 2.10
 # @ac_refresh: since 2.10
 # @ac_bookmarks: since 2.10
-# altgr, altgr_r: dropped in 2.10
 #
 # @muhenkan: since 2.12
 # @katakanahiragana: since 2.12
-- 
2.21.1




[PULL 14/18] qapi/ui.json: Avoid `...' Texinfo style quoting

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

Avoid Texinfo style quoting with `...', because we would like to
switch the doc comments to rST format, and rST treats it as a syntax
error. Use '...' instead, as we do in other doc comments. This looks
OK in Texinfo, and rST formats it as paired-quotation-marks.

Signed-off-by: Peter Maydell 
Reviewed-by: Markus Armbruster 
Message-Id: <20200213175647.17628-13-peter.mayd...@linaro.org>
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/ui.json | 24 
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/qapi/ui.json b/qapi/ui.json
index e8b8b708c7..088a8680ef 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -12,16 +12,16 @@
 #
 # Sets the password of a remote display session.
 #
-# @protocol: `vnc' to modify the VNC server password
-#`spice' to modify the Spice server password
+# @protocol: 'vnc' to modify the VNC server password
+#'spice' to modify the Spice server password
 #
 # @password: the new password
 #
 # @connected: how to handle existing clients when changing the
-# password.  If nothing is specified, defaults to `keep'
-# `fail' to fail the command if clients are connected
-# `disconnect' to disconnect existing clients
-# `keep' to maintain existing clients
+# password.  If nothing is specified, defaults to 'keep'
+# 'fail' to fail the command if clients are connected
+# 'disconnect' to disconnect existing clients
+# 'keep' to maintain existing clients
 #
 # Returns: Nothing on success
 #  If Spice is not enabled, DeviceNotFound
@@ -43,16 +43,16 @@
 #
 # Expire the password of a remote display server.
 #
-# @protocol: the name of the remote display protocol `vnc' or `spice'
+# @protocol: the name of the remote display protocol 'vnc' or 'spice'
 #
 # @time: when to expire the password.
-#`now' to expire the password immediately
-#`never' to cancel password expiration
-#`+INT' where INT is the number of seconds from now (integer)
-#`INT' where INT is the absolute time in seconds
+#'now' to expire the password immediately
+#'never' to cancel password expiration
+#'+INT' where INT is the number of seconds from now (integer)
+#'INT' where INT is the absolute time in seconds
 #
 # Returns: Nothing on success
-#  If @protocol is `spice' and Spice is not active, DeviceNotFound
+#  If @protocol is 'spice' and Spice is not active, DeviceNotFound
 #
 # Since: 0.14.0
 #
-- 
2.21.1




[PULL 02/18] configure: Allow user to specify sphinx-build binary

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

Currently we insist on using 'sphinx-build' from the $PATH;
allow the user to specify the binary to use. This will be
more useful as we become pickier about the capabilities
we require (eg needing a Python 3 sphinx-build).

Signed-off-by: Peter Maydell 
Reviewed-by: Alex Bennée 
Reviewed-by: Wainer dos Santos Moschetta 
Message-Id: <20200213175647.17628-2-peter.mayd...@linaro.org>
Signed-off-by: Markus Armbruster 
---
 configure | 10 +-
 Makefile  |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index 16f94cd96b..14172909f0 100755
--- a/configure
+++ b/configure
@@ -584,6 +584,7 @@ query_pkg_config() {
 }
 pkg_config=query_pkg_config
 sdl2_config="${SDL2_CONFIG-${cross_prefix}sdl2-config}"
+sphinx_build=sphinx-build
 
 # If the user hasn't specified ARFLAGS, default to 'rv', just as make does.
 ARFLAGS="${ARFLAGS-rv}"
@@ -975,6 +976,8 @@ for opt do
   ;;
   --python=*) python="$optarg"
   ;;
+  --sphinx-build=*) sphinx_build="$optarg"
+  ;;
   --gcov=*) gcov_tool="$optarg"
   ;;
   --smbd=*) smbd="$optarg"
@@ -1677,6 +1680,7 @@ Advanced options (experts only):
   --make=MAKE  use specified make [$make]
   --install=INSTALLuse specified install [$install]
   --python=PYTHON  use specified python [$python]
+  --sphinx-build=SPHINXuse specified sphinx-build [$sphinx_build]
   --smbd=SMBD  use specified smbd [$smbd]
   --with-git=GIT   use specified git [$git]
   --static enable static build [$static]
@@ -4799,7 +4803,7 @@ has_sphinx_build() {
 # sphinx-build doesn't exist at all or if it is too old.
 mkdir -p "$TMPDIR1/sphinx"
 touch "$TMPDIR1/sphinx/index.rst"
-sphinx-build -c "$source_path/docs" -b html "$TMPDIR1/sphinx" 
"$TMPDIR1/sphinx/out" >/dev/null 2>&1
+$sphinx_build -c "$source_path/docs" -b html "$TMPDIR1/sphinx" 
"$TMPDIR1/sphinx/out" >/dev/null 2>&1
 }
 
 # Check if tools are available to build documentation.
@@ -6474,6 +6478,9 @@ echo "QEMU_LDFLAGS  $QEMU_LDFLAGS"
 echo "make  $make"
 echo "install   $install"
 echo "python$python ($python_version)"
+if test "$docs" != "no"; then
+echo "sphinx-build  $sphinx_build"
+fi
 echo "slirp support $slirp $(echo_version $slirp $slirp_version)"
 if test "$slirp" != "no" ; then
 echo "smbd  $smbd"
@@ -7506,6 +7513,7 @@ echo "INSTALL_DATA=$install -c -m 0644" >> 
$config_host_mak
 echo "INSTALL_PROG=$install -c -m 0755" >> $config_host_mak
 echo "INSTALL_LIB=$install -c -m 0644" >> $config_host_mak
 echo "PYTHON=$python" >> $config_host_mak
+echo "SPHINX_BUILD=$sphinx_build" >> $config_host_mak
 echo "CC=$cc" >> $config_host_mak
 if $iasl -h > /dev/null 2>&1; then
   echo "IASL=$iasl" >> $config_host_mak
diff --git a/Makefile b/Makefile
index f0e1a2fc1d..430bbad055 100644
--- a/Makefile
+++ b/Makefile
@@ -1030,7 +1030,7 @@ sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html \
 # Note the use of different doctree for each (manual, builder) tuple;
 # this works around Sphinx not handling parallel invocation on
 # a single doctree: https://github.com/sphinx-doc/sphinx/issues/2946
-build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" sphinx-build 
$(if $(V),,-q) -W -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d 
.doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 
,"SPHINX","$(MANUAL_BUILDDIR)/$1")
+build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" $(SPHINX_BUILD) 
$(if $(V),,-q) -W -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d 
.doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 
,"SPHINX","$(MANUAL_BUILDDIR)/$1")
 # We assume all RST files in the manual's directory are used in it
 manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) \
   $(wildcard $(SRC_PATH)/docs/$1/*.rst.inc) \
-- 
2.21.1




[PULL 15/18] qapi: Use explicit bulleted lists

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

A JSON block comment like this:
 Returns: nothing on success
  If @node is not a valid block device, DeviceNotFound
  If @name is not found, GenericError with an explanation

renders like this:

 Returns: nothing on success If node is not a valid block device,
 DeviceNotFound If name is not found, GenericError with an explanation

because whitespace is not significant.

Use an actual bulleted list, so that the formatting is correct.

Signed-off-by: Peter Maydell 
Message-Id: <20200213175647.17628-14-peter.mayd...@linaro.org>
Message-Id: <20200213175647.17628-15-peter.mayd...@linaro.org>
Message-Id: <20200213175647.17628-16-peter.mayd...@linaro.org>
[Three commits squashed into one]
Reviewed-by: Markus Armbruster 
Signed-off-by: Markus Armbruster 
---
 qapi/block-core.json | 108 +--
 qapi/block.json  |  33 ++---
 qapi/misc.json   |  36 +++
 qapi/tpm.json|   4 +-
 qapi/ui.json |  63 +
 5 files changed, 119 insertions(+), 125 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 31f7a1281c..082aca3f69 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1326,8 +1326,8 @@
 #
 # @size:  new image size in bytes
 #
-# Returns: nothing on success
-#  If @device is not a valid block device, DeviceNotFound
+# Returns: - nothing on success
+#  - If @device is not a valid block device, DeviceNotFound
 #
 # Since: 0.14.0
 #
@@ -1510,8 +1510,8 @@
 #
 # For the arguments, see the documentation of BlockdevSnapshotSync.
 #
-# Returns: nothing on success
-#  If @device is not a valid block device, DeviceNotFound
+# Returns: - nothing on success
+#  - If @device is not a valid block device, DeviceNotFound
 #
 # Since: 0.14.0
 #
@@ -1586,9 +1586,8 @@
 #when specifying the string or the image chain may
 #not be able to be reopened again.
 #
-# Returns: Nothing on success
-#
-#  If "device" does not exist or cannot be determined, DeviceNotFound
+# Returns: - Nothing on success
+#  - If "device" does not exist or cannot be determined, DeviceNotFound
 #
 # Since: 2.1
 ##
@@ -1674,9 +1673,9 @@
 #list without user intervention.
 #Defaults to true. (Since 3.1)
 #
-# Returns: Nothing on success
-#  If @device does not exist, DeviceNotFound
-#  Any other error returns a GenericError.
+# Returns: - Nothing on success
+#  - If @device does not exist, DeviceNotFound
+#  - Any other error returns a GenericError.
 #
 # Since: 1.3
 #
@@ -1704,8 +1703,8 @@
 # The operation can be stopped before it has completed using the
 # block-job-cancel command.
 #
-# Returns: nothing on success
-#  If @device is not a valid block device, GenericError
+# Returns: - nothing on success
+#  - If @device is not a valid block device, GenericError
 #
 # Since: 1.6
 #
@@ -1730,8 +1729,8 @@
 # The operation can be stopped before it has completed using the
 # block-job-cancel command.
 #
-# Returns: nothing on success
-#  If @device is not a valid block device, DeviceNotFound
+# Returns: - nothing on success
+#  - If @device is not a valid block device, DeviceNotFound
 #
 # Since: 2.3
 #
@@ -1925,8 +1924,8 @@
 # format of the mirror image, default is to probe if mode='existing',
 # else the format of the source.
 #
-# Returns: nothing on success
-#  If @device is not a valid block device, GenericError
+# Returns: - nothing on success
+#  - If @device is not a valid block device, GenericError
 #
 # Since: 1.3
 #
@@ -2097,9 +2096,9 @@
 #
 # Create a dirty bitmap with a name on the node, and start tracking the writes.
 #
-# Returns: nothing on success
-#  If @node is not a valid block device or node, DeviceNotFound
-#  If @name is already taken, GenericError with an explanation
+# Returns: - nothing on success
+#  - If @node is not a valid block device or node, DeviceNotFound
+#  - If @name is already taken, GenericError with an explanation
 #
 # Since: 2.4
 #
@@ -2120,10 +2119,10 @@
 # with block-dirty-bitmap-add. If the bitmap is persistent, remove it from its
 # storage too.
 #
-# Returns: nothing on success
-#  If @node is not a valid block device or node, DeviceNotFound
-#  If @name is not found, GenericError with an explanation
-#  if @name is frozen by an operation, GenericError
+# Returns: - nothing on success
+#  - If @node is not a valid block device or node, DeviceNotFound
+#  - If @name is not found, GenericError with an explanation
+#  - if @name is frozen by an operation, GenericError
 #
 # Since: 2.4
 #
@@ -2144,9 +2143,9 @@
 # backup from this point in time forward will only backup clusters
 # modified after this clear operation.
 #
-# Returns: nothing on success
-#  If @node is

[PULL 05/18] Makefile: Fix typo in dependency list for interop manpages

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

Fix a typo in the dependency list for the manpages built from the
'interop' manual, which meant we were accidentally not including
the .hx file in the dependency list.

Fixes: e13c59fa4414215500e6
Signed-off-by: Peter Maydell 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200213175647.17628-4-peter.mayd...@linaro.org>
Signed-off-by: Markus Armbruster 
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 430bbad055..b5a7377cb1 100644
--- a/Makefile
+++ b/Makefile
@@ -1059,7 +1059,7 @@ $(MANUAL_BUILDDIR)/system/index.html: $(call 
manual-deps,system)
 $(call define-manpage-rule,interop,\
qemu-ga.8 qemu-img.1 qemu-nbd.8 qemu-trace-stap.1\
virtiofsd.1 virtfs-proxy-helper.1,\
-   $(SRC_PATH/qemu-img-cmds.hx))
+   $(SRC_PATH)/qemu-img-cmds.hx)
 
 $(call define-manpage-rule,system,qemu-block-drivers.7)
 
-- 
2.21.1




[PULL 17/18] qapi/migration.json: Replace _this_ with *this*

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

The MigrationInfo::setup-time documentation is the only place where we
use _this_ inline markup for emphasis, commonly rendered in italics.
We would like to switch the doc comments to rST format, but rST
doesn't recognize that markup and emits literal underscores.

Switch to *this* instead.  Changes markup to strong emphasis with
Texinfo, commonly rendered as bold.  With rST, it will go right back
to emphasis / italics.

rST also uses **this** for strong (commonly rendered bold) where
Texinfo uses *this*. We have one place in the doc comments
which uses strong/bold markup, in qapi/introspect.json:
Note: the QAPI schema is also used to help define *internal*

When we switch to rST that will be rendered as emphasis / italics.
Markus (who wrote that) thinks that using emphasis / italics
there is an improvement, so we leave that markup alone.

Signed-off-by: Peter Maydell 
Reviewed-by: Markus Armbruster 
Message-Id: <20200213175647.17628-18-peter.mayd...@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé 
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/migration.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 11033b7a8e..52f3429969 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -178,8 +178,8 @@
 # expected downtime in milliseconds for the guest in last 
walk
 # of the dirty bitmap. (since 1.3)
 #
-# @setup-time: amount of setup time in milliseconds _before_ the
-#  iterations begin but _after_ the QMP command is issued. This is 
designed
+# @setup-time: amount of setup time in milliseconds *before* the
+#  iterations begin but *after* the QMP command is issued. This is 
designed
 #  to provide an accounting of any activities (such as RDMA 
pinning) which
 #  may be expensive, but do not actually occur during the iterative
 #  migration rounds themselves. (since 1.6)
-- 
2.21.1




[PULL 12/18] qapi: Remove hardcoded tabs

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

There are some stray hardcoded tabs in some of our json files;
remove them.

Signed-off-by: Peter Maydell 
Reviewed-by: Markus Armbruster 
Message-Id: <20200213175647.17628-11-peter.mayd...@linaro.org>
Signed-off-by: Markus Armbruster 
---
 qapi/block-core.json | 4 ++--
 qapi/migration.json  | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index c62b7db281..31f7a1281c 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2938,8 +2938,8 @@
 '*pr-manager': 'str',
 '*locking': 'OnOffAuto',
 '*aio': 'BlockdevAioOptions',
-   '*drop-cache': {'type': 'bool',
-   'if': 'defined(CONFIG_LINUX)'},
+'*drop-cache': {'type': 'bool',
+'if': 'defined(CONFIG_LINUX)'},
 '*x-check-cache-dropped': 'bool' },
   'features': [ { 'name': 'dynamic-auto-read-only',
   'if': 'defined(CONFIG_POSIX)' } ] }
diff --git a/qapi/migration.json b/qapi/migration.json
index aa160e9e42..11033b7a8e 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -98,7 +98,7 @@
 ##
 { 'struct': 'CompressionStats',
   'data': {'pages': 'int', 'busy': 'int', 'busy-rate': 'number',
-  'compressed-size': 'int', 'compression-rate': 'number' } }
+   'compressed-size': 'int', 'compression-rate': 'number' } }
 
 ##
 # @MigrationStatus:
@@ -713,7 +713,7 @@
 '*multifd-channels': 'int',
 '*xbzrle-cache-size': 'size',
 '*max-postcopy-bandwidth': 'size',
-   '*max-cpu-throttle': 'int' } }
+'*max-cpu-throttle': 'int' } }
 
 ##
 # @migrate-set-parameters:
@@ -845,7 +845,7 @@
 '*block-incremental': 'bool' ,
 '*multifd-channels': 'uint8',
 '*xbzrle-cache-size': 'size',
-   '*max-postcopy-bandwidth': 'size',
+'*max-postcopy-bandwidth': 'size',
 '*max-cpu-throttle':'uint8'} }
 
 ##
-- 
2.21.1




[PULL 16/18] qapi: Add blank lines before bulleted lists

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

We would like to switch the doc comments to rST format. rST
insists on a blank line before and after a bulleted list, but our
Texinfo doc generator did not. Add some extra blank lines in the doc
comments so they're acceptable rST input.

Signed-off-by: Peter Maydell 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200213175647.17628-17-peter.mayd...@linaro.org>
Reviewed-by: Markus Armbruster 
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/block-core.json | 1 +
 qapi/char.json   | 2 ++
 qapi/trace.json  | 1 +
 qapi/ui.json | 1 +
 4 files changed, 5 insertions(+)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 082aca3f69..13dad62f44 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -4757,6 +4757,7 @@
 #
 # Once the tray opens, a DEVICE_TRAY_MOVED event is emitted. There are cases in
 # which no such event will be generated, these include:
+#
 # - if the guest has locked the tray, @force is false and the guest does not
 #   respond to the eject request
 # - if the BlockBackend denoted by @device does not have a guest device 
attached
diff --git a/qapi/char.json b/qapi/char.json
index 8a9f1e7509..6907b2bfdb 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -133,6 +133,7 @@
 # @data: data to write
 #
 # @format: data encoding (default 'utf8').
+#
 #  - base64: data must be base64 encoded text.  Its binary
 #decoding gets written.
 #  - utf8: data's UTF-8 encoding is written
@@ -167,6 +168,7 @@
 # @size: how many bytes to read at most
 #
 # @format: data encoding (default 'utf8').
+#
 #  - base64: the data read is returned in base64 encoding.
 #  - utf8: the data read is interpreted as UTF-8.
 #Bug: can screw up when the buffer contains invalid UTF-8
diff --git a/qapi/trace.json b/qapi/trace.json
index 4955e5a750..47c68f04da 100644
--- a/qapi/trace.json
+++ b/qapi/trace.json
@@ -53,6 +53,7 @@
 # Returns: a list of @TraceEventInfo for the matching events
 #
 #  An event is returned if:
+#
 #  - its name matches the @name pattern, and
 #  - if @vcpu is given, the event has the "vcpu" property.
 #
diff --git a/qapi/ui.json b/qapi/ui.json
index e4bd3d8ea7..89126da395 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -934,6 +934,7 @@
 # Input event union.
 #
 # @type: the input type, one of:
+#
 #- 'key': Input event of Keyboard
 #- 'btn': Input event of pointer buttons
 #- 'rel': Input event of relative pointer motion
-- 
2.21.1




[PULL 13/18] qapi/ui.json: Put input-send-event body text in the right place

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

In the doc comment for input-send-event, there is a multi-line
chunk of text ("The @device...take precedence") which is intended
to be the main body text describing the event. However it has
been placed after the arguments and Returns: section, which
means that the parser actually thinks that this text is
part of the "Returns" section text.

Move the body text up to the top so that the parser correctly
classifies it as body.

Signed-off-by: Peter Maydell 
Reviewed-by: Markus Armbruster 
Message-Id: <20200213175647.17628-12-peter.mayd...@linaro.org>
Signed-off-by: Markus Armbruster 
---
 qapi/ui.json | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/qapi/ui.json b/qapi/ui.json
index ba873e1e29..e8b8b708c7 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -949,13 +949,6 @@
 #
 # Send input event(s) to guest.
 #
-# @device: display device to send event(s) to.
-# @head: head to send event(s) to, in case the
-#display device supports multiple scanouts.
-# @events: List of InputEvent union.
-#
-# Returns: Nothing on success.
-#
 # The @device and @head parameters can be used to send the input event
 # to specific input devices in case (a) multiple input devices of the
 # same kind are added to the virtual machine and (b) you have
@@ -967,6 +960,13 @@
 # are admissible, but devices with input routing config take
 # precedence.
 #
+# @device: display device to send event(s) to.
+# @head: head to send event(s) to, in case the
+#display device supports multiple scanouts.
+# @events: List of InputEvent union.
+#
+# Returns: Nothing on success.
+#
 # Since: 2.6
 #
 # Note: The consoles are visible in the qom tree, under
-- 
2.21.1




[PULL 09/18] qapi/block-core.json: Use literal block for ascii art

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

The ascii-art graph in the BlockLatencyHistogramInfo documentation
doesn't render correctly, because the whitespace is collapsed.

Use the '|' format that emits a literal 'example' block so the graph
is displayed correctly.

Strictly the Texinfo generated is still wrong because each line
goes into its own @example environment, but it renders better
than what we had before.

Fixing this rendering is a necessary prerequisite for the upcoming rST
generator, which otherwise complains about the inconsistent
indentation in the ascii-art graph.

Signed-off-by: Peter Maydell 
Message-Id: <20200213175647.17628-8-peter.mayd...@linaro.org>
Reviewed-by: Markus Armbruster 
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/block-core.json | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index ef94a29686..db9ca688d4 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -550,13 +550,13 @@
 #For the example above, @bins may be something like [3, 1, 5, 2],
 #and corresponding histogram looks like:
 #
-#5|   *
-#4|   *
-#3| * *
-#2| * **
-#1| ****
-# +--
-# 10   50   100
+# |  5|   *
+# |  4|   *
+# |  3| * *
+# |  2| * **
+# |  1| ****
+# |   +--
+# |   10   50   100
 #
 # Since: 4.0
 ##
-- 
2.21.1




[PULL 10/18] qapi: Fix incorrect "Not documented" claims in QMP documentation

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

Some qapi doc comments have forgotten the ':' after the
@argument, like this:

# @filename Filename for the new image file
# @size Size of the virtual disk in bytes

The result is that these are parsed as part of the body
text and appear as a run-on line:
  filename Filename for the new image file size Size of the virtual disk in 
bytes"
followed by
  filename: string
Not documented
  size: int
Not documented

in the 'Members' section.

Correct the formatting.

Signed-off-by: Peter Maydell 
Reviewed-by: Markus Armbruster 
Message-Id: <20200213175647.17628-9-peter.mayd...@linaro.org>
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/block-core.json | 236 +--
 1 file changed, 118 insertions(+), 118 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index db9ca688d4..c617bc2af6 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -3235,9 +3235,9 @@
 ##
 # @SshHostKeyCheckMode:
 #
-# @none Don't check the host key at all
-# @hash Compare the host key with a given hash
-# @known_hosts  Check the host key against the known_hosts file
+# @none: Don't check the host key at all
+# @hash: Compare the host key with a given hash
+# @known_hosts: Check the host key against the known_hosts file
 #
 # Since: 2.12
 ##
@@ -3247,8 +3247,8 @@
 ##
 # @SshHostKeyCheckHashType:
 #
-# @md5  The given hash is an md5 hash
-# @sha1 The given hash is an sha1 hash
+# @md5: The given hash is an md5 hash
+# @sha1: The given hash is an sha1 hash
 #
 # Since: 2.12
 ##
@@ -3258,8 +3258,8 @@
 ##
 # @SshHostKeyHash:
 #
-# @type The hash algorithm used for the hash
-# @hash The expected hash value
+# @type: The hash algorithm used for the hash
+# @hash: The expected hash value
 #
 # Since: 2.12
 ##
@@ -4265,13 +4265,13 @@
 #
 # Driver specific image creation options for file.
 #
-# @filename Filename for the new image file
-# @size Size of the virtual disk in bytes
-# @preallocationPreallocation mode for the new image (default: off;
-#   allowed values: off,
-#   falloc (if defined CONFIG_POSIX_FALLOCATE),
-#   full (if defined CONFIG_POSIX))
-# @nocowTurn off copy-on-write (valid only on btrfs; default: off)
+# @filename: Filename for the new image file
+# @size: Size of the virtual disk in bytes
+# @preallocation: Preallocation mode for the new image (default: off;
+# allowed values: off,
+# falloc (if defined CONFIG_POSIX_FALLOCATE),
+# full (if defined CONFIG_POSIX))
+# @nocow: Turn off copy-on-write (valid only on btrfs; default: off)
 #
 # Since: 2.12
 ##
@@ -4286,12 +4286,12 @@
 #
 # Driver specific image creation options for gluster.
 #
-# @location Where to store the new image file
-# @size Size of the virtual disk in bytes
-# @preallocationPreallocation mode for the new image (default: off;
-#   allowed values: off,
-#   falloc (if defined CONFIG_GLUSTERFS_FALLOCATE),
-#   full (if defined CONFIG_GLUSTERFS_ZEROFILL))
+# @location: Where to store the new image file
+# @size: Size of the virtual disk in bytes
+# @preallocation: Preallocation mode for the new image (default: off;
+# allowed values: off,
+# falloc (if defined CONFIG_GLUSTERFS_FALLOCATE),
+# full (if defined CONFIG_GLUSTERFS_ZEROFILL))
 #
 # Since: 2.12
 ##
@@ -4305,11 +4305,11 @@
 #
 # Driver specific image creation options for LUKS.
 #
-# @file Node to create the image format on
-# @size Size of the virtual disk in bytes
-# @preallocationPreallocation mode for the new image
-#   (since: 4.2)
-#   (default: off; allowed values: off, metadata, falloc, full)
+# @file: Node to create the image format on
+# @size: Size of the virtual disk in bytes
+# @preallocation: Preallocation mode for the new image
+# (since: 4.2)
+# (default: off; allowed values: off, metadata, falloc, full)
 #
 # Since: 2.12
 ##
@@ -4324,8 +4324,8 @@
 #
 # Driver specific image creation options for NFS.
 #
-# @location Where to store the new image file
-# @size Size of the virtual disk in bytes
+# @location: Where to store the new image file
+# @size: Size of the virtual disk in bytes
 #
 # Since: 2.12
 ##
@@ -4338,9 +4338,9 @@
 #
 # Driver specific image creation options for parallels.
 #
-# @file Node to create the image format on
-# @size Size of the virtual disk in bytes
-# @cluster-size Cluster size in bytes (default: 1 MB)
+# @file: Node to create the image format on
+# @size: Size of the virtual disk in bytes
+# @cluster-size: Cluster size in bytes (default: 1 MB)
 #
 # Since: 2.12
 ##
@@ -4354,11

[PULL 04/18] configure: Check that sphinx-build is using Python 3

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

Currently configure's has_sphinx_build() check simply runs a dummy
sphinx-build and either passes or fails.  This means that "no
sphinx-build at all" and "sphinx-build exists but is too old" are
both reported the same way.

Further, we want to assume that all the Python we write is running
with at least Python 3.5; configure checks that for our scripts, but
Sphinx extensions run with whatever Python version sphinx-build
itself is using.

Add a check to our conf.py which makes sphinx-build fail if it would
be running our extensions with an old Python, and handle this
in configure so we can report failure helpfully to the user.
This will mean that configure --enable-docs will fail like this
if the sphinx-build provided is not suitable:

Warning: sphinx-build exists but it is either too old or uses too old a Python 
version

ERROR: User requested feature docs
   configure was not able to find it.
   Install texinfo, Perl/perl-podlators and a Python 3 version of 
python-sphinx

(As usual, the default is to simply not build the docs, as we would
if sphinx-build wasn't present at all.)

Signed-off-by: Peter Maydell 
Reviewed-by: Alex Bennée 
Reviewed-by: Wainer dos Santos Moschetta 
Message-Id: <20200213175647.17628-3-peter.mayd...@linaro.org>
Signed-off-by: Markus Armbruster 
---
 docs/conf.py | 10 ++
 configure| 12 ++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index ee7faa6b4e..7588bf192e 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -28,6 +28,16 @@
 
 import os
 import sys
+import sphinx
+from sphinx.errors import VersionRequirementError
+
+# Make Sphinx fail cleanly if using an old Python, rather than obscurely
+# failing because some code in one of our extensions doesn't work there.
+# Unfortunately this doesn't display very neatly (there's an unavoidable
+# Python backtrace) but at least the information gets printed...
+if sys.version_info < (3,5):
+raise VersionRequirementError(
+"QEMU requires a Sphinx that uses Python 3.5 or better\n")
 
 # The per-manual conf.py will set qemu_docdir for a single-manual build;
 # otherwise set it here if this is an entire-manual-set build.
diff --git a/configure b/configure
index 9f7bded369..7a826cbd26 100755
--- a/configure
+++ b/configure
@@ -4818,11 +4818,19 @@ has_sphinx_build() {
 
 # Check if tools are available to build documentation.
 if test "$docs" != "no" ; then
-  if has makeinfo && has pod2man && has_sphinx_build; then
+  if has_sphinx_build; then
+sphinx_ok=yes
+  else
+sphinx_ok=no
+  fi
+  if has makeinfo && has pod2man && test "$sphinx_ok" = "yes"; then
 docs=yes
   else
 if test "$docs" = "yes" ; then
-  feature_not_found "docs" "Install texinfo, Perl/perl-podlators and 
python-sphinx"
+  if has $sphinx_build && test "$sphinx_ok" != "yes"; then
+echo "Warning: $sphinx_build exists but it is either too old or uses 
too old a Python version" >&2
+  fi
+  feature_not_found "docs" "Install texinfo, Perl/perl-podlators and a 
Python 3 version of python-sphinx"
 fi
 docs=no
   fi
-- 
2.21.1




[PULL 11/18] qapi: Fix indent level on doc comments in json files

2020-02-15 Thread Markus Armbruster
From: Peter Maydell 

The current doc generation doesn't care much about indentation levels,
but we would like to switch to an rST format, and rST does care about
indentation.

Make the doc comments more strongly consistent about indentation
for multiline constructs like:

@arg: description line 1
  description line 2

Returns: line one
 line 2

so that there is always exactly one space after the colon, and
subsequent lines align with the first.

This commit is a purely whitespace change, and it does not alter the
generated .texi files (because the texi generation code strips away
all the extra whitespace).  This does mean that we end up with some
over-length lines.

Note that when the documentation for an argument fits on a single
line like this:

@arg: one line only

then stray extra spaces after the ':' don't affect the rST output, so
I have not attempted to methodically fix them, though the preference
is a single space here too.

Signed-off-by: Peter Maydell 
Message-Id: <20200213175647.17628-10-peter.mayd...@linaro.org>
Reviewed-by: Markus Armbruster 
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/block-core.json | 776 +++
 qapi/block.json  |  14 +-
 qapi/char.json   |   8 +-
 qapi/dump.json   |   4 +-
 qapi/introspect.json |  12 +-
 qapi/job.json|  32 +-
 qapi/machine-target.json |  18 +-
 qapi/machine.json|  12 +-
 qapi/migration.json  | 198 +-
 qapi/misc-target.json|   8 +-
 qapi/misc.json   | 102 ++---
 qapi/net.json|  22 +-
 qapi/qdev.json   |  10 +-
 qapi/qom.json|   4 +-
 qapi/rocker.json |  12 +-
 qapi/run-state.json  |  34 +-
 qapi/sockets.json|   8 +-
 qapi/trace.json  |  14 +-
 qapi/transaction.json|   4 +-
 qapi/ui.json |  36 +-
 20 files changed, 664 insertions(+), 664 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index c617bc2af6..c62b7db281 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -162,7 +162,7 @@
 # @backing-image: info of the backing image (since 1.6)
 #
 # @format-specific: structure supplying additional format-specific
-# information (since 1.7)
+#   information (since 1.7)
 #
 # Since: 1.3
 #
@@ -708,7 +708,7 @@
 # Get a list of BlockInfo for all virtual block devices.
 #
 # Returns: a list of @BlockInfo describing each virtual block device. Filter
-# nodes that were created implicitly are skipped over.
+#  nodes that were created implicitly are skipped over.
 #
 # Since: 0.14.0
 #
@@ -1352,8 +1352,8 @@
 # @existing: QEMU should look for an existing image file.
 #
 # @absolute-paths: QEMU should create a new image with absolute paths
-# for the backing file. If there is no backing file available, the new
-# image will not be backed either.
+#  for the backing file. If there is no backing file 
available, the new
+#  image will not be backed either.
 #
 # Since: 1.1
 ##
@@ -1370,8 +1370,8 @@
 # @node-name: graph node name to generate the snapshot from (Since 2.0)
 #
 # @snapshot-file: the target of the new overlay image. If the file
-# exists, or if it is a device, the overlay will be created in the
-# existing file/device. Otherwise, a new file will be created.
+# exists, or if it is a device, the overlay will be created in 
the
+# existing file/device. Otherwise, a new file will be created.
 #
 # @snapshot-node-name: the graph node name of the new image (Since 2.0)
 #
@@ -1456,8 +1456,8 @@
 #a node name is autogenerated. (Since: 4.2)
 #
 # Note: @on-source-error and @on-target-error only affect background
-# I/O.  If an error occurs during a guest write request, the device's
-# rerror/werror actions will be used.
+#   I/O.  If an error occurs during a guest write request, the device's
+#   rerror/werror actions will be used.
 #
 # Since: 4.2
 ##
@@ -1578,13 +1578,13 @@
 #   to verify "image-node-name" is in the chain
 #   described by "device".
 #
-# @device:  The device name or node-name of the root node that owns
-#   image-node-name.
+# @device: The device name or node-name of the root node that owns
+#  image-node-name.
 #
-# @backing-file:The string to write as the backing file.  This
-#   string is not validated, so care should be taken
-#   when specifying the string or the image chain may
-#   not be able to be reopened again.
+# @backing-file: The string to write as the backing file.  This
+#string is not validated, so care should be taken
+#when specifying the string or the image chain may
+#not be able to be reopened again.
 #
 # Returns: Nothing on success
 #
@@ -1605,7 +1605,7 @@
 # @job-id: identifier for the newly-created bloc

[PATCH v2 0/2] hw/arm/xilinx_zynq: Fix USB port instantiation

2020-02-15 Thread Guenter Roeck
USB ports on Xilinx Zync must be instantiated as TYPE_CHIPIDEA to work.
Linux expects and checks various chipidea registers, which do not exist
with the basic ehci emulation. This patch series fixes the problem.

The first patch in the series fixes the actual problem.

The second patch removes the now obsolete explicit Xilinx
support from the EHCI code.

v2: Introduced summary


Guenter Roeck (2):
  hw/arm/xilinx_zynq: Fix USB port instantiation
  hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx,ps7-usb class

 hw/arm/xilinx_zynq.c |  5 +++--
 hw/usb/hcd-ehci-sysbus.c | 17 -
 2 files changed, 3 insertions(+), 19 deletions(-)



[PATCH v2 1/2] hw/arm/xilinx_zynq: Fix USB port instantiation

2020-02-15 Thread Guenter Roeck
USB ports on Xilinx Zync must be instantiated as TYPE_CHIPIDEA to work.
Linux expects and checks various chipidea registers, which do not exist
with the basic ehci emulation. This patch series fixes the problem.

Without this patch, USB ports fail to instantiate under Linux.

ci_hdrc ci_hdrc.0: doesn't support host
ci_hdrc ci_hdrc.0: no supported roles

With this patch, USB ports are instantiated, and it is possible
to boot from USB drive.

ci_hdrc ci_hdrc.0: EHCI Host Controller
ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
usb 1-1: new full-speed USB device number 2 using ci_hdrc
usb 1-1: not running at top speed; connect to a high speed hub
usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 
512, setting to 64
usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 
512, setting to 64
usb-storage 1-1:1.0: USB Mass Storage device detected
scsi host0: usb-storage 1-1:1.0

Signed-off-by: Guenter Roeck 
---
v2: No change

 hw/arm/xilinx_zynq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index 3a0fa5b23f..b4a8b2f2c6 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -29,6 +29,7 @@
 #include "hw/loader.h"
 #include "hw/misc/zynq-xadc.h"
 #include "hw/ssi/ssi.h"
+#include "hw/usb/chipidea.h"
 #include "qemu/error-report.h"
 #include "hw/sd/sdhci.h"
 #include "hw/char/cadence_uart.h"
@@ -228,8 +229,8 @@ static void zynq_init(MachineState *machine)
 zynq_init_spi_flashes(0xE0007000, pic[81-IRQ_OFFSET], false);
 zynq_init_spi_flashes(0xE000D000, pic[51-IRQ_OFFSET], true);
 
-sysbus_create_simple("xlnx,ps7-usb", 0xE0002000, pic[53-IRQ_OFFSET]);
-sysbus_create_simple("xlnx,ps7-usb", 0xE0003000, pic[76-IRQ_OFFSET]);
+sysbus_create_simple(TYPE_CHIPIDEA, 0xE0002000, pic[53 - IRQ_OFFSET]);
+sysbus_create_simple(TYPE_CHIPIDEA, 0xE0003000, pic[76 - IRQ_OFFSET]);
 
 cadence_uart_create(0xE000, pic[59 - IRQ_OFFSET], serial_hd(0));
 cadence_uart_create(0xE0001000, pic[82 - IRQ_OFFSET], serial_hd(1));
-- 
2.17.1




[PATCH v2 2/2] hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx, ps7-usb class

2020-02-15 Thread Guenter Roeck
Xilinx USB devices are now instantiated through TYPE_CHIPIDEA,
and xlnx support in the EHCI code is no longer needed.

Signed-off-by: Guenter Roeck 
---
v2: No change

 hw/usb/hcd-ehci-sysbus.c | 17 -
 1 file changed, 17 deletions(-)

diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 62612c9f5b..b5a014f968 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -114,22 +114,6 @@ static const TypeInfo ehci_platform_type_info = {
 .class_init= ehci_platform_class_init,
 };
 
-static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
-{
-SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
-DeviceClass *dc = DEVICE_CLASS(oc);
-
-set_bit(DEVICE_CATEGORY_USB, dc->categories);
-sec->capsbase = 0x100;
-sec->opregbase = 0x140;
-}
-
-static const TypeInfo ehci_xlnx_type_info = {
-.name  = "xlnx,ps7-usb",
-.parent= TYPE_SYS_BUS_EHCI,
-.class_init= ehci_xlnx_class_init,
-};
-
 static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
 {
 SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
@@ -266,7 +250,6 @@ static void ehci_sysbus_register_types(void)
 {
 type_register_static(&ehci_type_info);
 type_register_static(&ehci_platform_type_info);
-type_register_static(&ehci_xlnx_type_info);
 type_register_static(&ehci_exynos4210_type_info);
 type_register_static(&ehci_tegra2_type_info);
 type_register_static(&ehci_ppc4xx_type_info);
-- 
2.17.1




[PULL 4/5] monitor: Move qmp_query_qmp_schema to qmp-cmds-control.c

2020-02-15 Thread Markus Armbruster
From: Kevin Wolf 

monitor/misc.c contains code that works only in the system emulator, so
it can't be linked to tools like a storage daemon. In order to make
schema introspection available for tools, move the function to
monitor/qmp-cmds-control.c, which can be linked into the storage daemon.

Signed-off-by: Kevin Wolf 
Reviewed-by: Markus Armbruster 
Message-Id: <20200129102239.31435-5-kw...@redhat.com>
Signed-off-by: Markus Armbruster 
---
 monitor/monitor-internal.h |  3 +++
 monitor/misc.c | 16 
 monitor/qmp-cmds-control.c | 16 
 3 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
index 4d402ded85..3e6baba88f 100644
--- a/monitor/monitor-internal.h
+++ b/monitor/monitor-internal.h
@@ -180,4 +180,7 @@ void help_cmd(Monitor *mon, const char *name);
 void handle_hmp_command(MonitorHMP *mon, const char *cmdline);
 int hmp_compare_cmd(const char *name, const char *list);
 
+void qmp_query_qmp_schema(QDict *qdict, QObject **ret_data,
+ Error **errp);
+
 #endif
diff --git a/monitor/misc.c b/monitor/misc.c
index 4c4e47fdc4..6c41293102 100644
--- a/monitor/misc.c
+++ b/monitor/misc.c
@@ -75,7 +75,6 @@
 #include "qapi/qapi-init-commands.h"
 #include "qapi/error.h"
 #include "qapi/qmp-event.h"
-#include "qapi/qapi-introspect.h"
 #include "sysemu/cpus.h"
 #include "qemu/cutils.h"
 #include "tcg/tcg.h"
@@ -232,21 +231,6 @@ static void hmp_info_help(Monitor *mon, const QDict *qdict)
 help_cmd(mon, "info");
 }
 
-/*
- * Minor hack: generated marshalling suppressed for this command
- * ('gen': false in the schema) so we can parse the JSON string
- * directly into QObject instead of first parsing it with
- * visit_type_SchemaInfoList() into a SchemaInfoList, then marshal it
- * to QObject with generated output marshallers, every time.  Instead,
- * we do it in test-qobject-input-visitor.c, just to make sure
- * qapi-gen.py's output actually conforms to the schema.
- */
-static void qmp_query_qmp_schema(QDict *qdict, QObject **ret_data,
- Error **errp)
-{
-*ret_data = qobject_from_qlit(&qmp_schema_qlit);
-}
-
 static void monitor_init_qmp_commands(void)
 {
 /*
diff --git a/monitor/qmp-cmds-control.c b/monitor/qmp-cmds-control.c
index d5f21f90e6..5cd9bb817c 100644
--- a/monitor/qmp-cmds-control.c
+++ b/monitor/qmp-cmds-control.c
@@ -29,6 +29,7 @@
 #include "qapi/error.h"
 #include "qapi/qapi-commands-control.h"
 #include "qapi/qapi-emit-events.h"
+#include "qapi/qapi-introspect.h"
 
 /*
  * Accept QMP capabilities in @list for @mon.
@@ -151,3 +152,18 @@ EventInfoList *qmp_query_events(Error **errp)
 
 return ev_list;
 }
+
+/*
+ * Minor hack: generated marshalling suppressed for this command
+ * ('gen': false in the schema) so we can parse the JSON string
+ * directly into QObject instead of first parsing it with
+ * visit_type_SchemaInfoList() into a SchemaInfoList, then marshal it
+ * to QObject with generated output marshallers, every time.  Instead,
+ * we do it in test-qobject-input-visitor.c, just to make sure
+ * qapi-gen.py's output actually conforms to the schema.
+ */
+void qmp_query_qmp_schema(QDict *qdict, QObject **ret_data,
+ Error **errp)
+{
+*ret_data = qobject_from_qlit(&qmp_schema_qlit);
+}
-- 
2.21.1




[PULL 5/5] qemu-doc: Clarify extent of build platform support

2020-02-15 Thread Markus Armbruster
Supporting a build platform beyond its end of life makes no sense.
Spell that out just to be clear.

Signed-off-by: Markus Armbruster 
Message-Id: <20200213084335.15100-1-arm...@redhat.com>
Reviewed-by: Daniel P. Berrangé 
Reviewed-by: Eduardo Habkost 
---
 qemu-doc.texi | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/qemu-doc.texi b/qemu-doc.texi
index a1ef6b6484..33b9597b1d 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -2880,10 +2880,11 @@ lifetime distros will be assumed to ship similar 
software versions.
 
 For distributions with long-lifetime releases, the project will aim to support
 the most recent major version at all times. Support for the previous major
-version will be dropped 2 years after the new major version is released. For
-the purposes of identifying supported software versions, the project will look
-at RHEL, Debian, Ubuntu LTS, and SLES distros. Other long-lifetime distros will
-be assumed to ship similar software versions.
+version will be dropped 2 years after the new major version is released,
+or when it reaches ``end of life''. For the purposes of identifying
+supported software versions, the project will look at RHEL, Debian,
+Ubuntu LTS, and SLES distros. Other long-lifetime distros will be
+assumed to ship similar software versions.
 
 @section Windows
 
-- 
2.21.1




[PULL 1/5] monitor: Move monitor option parsing to monitor/monitor.c

2020-02-15 Thread Markus Armbruster
From: Kevin Wolf 

Both the system emulators and tools with QMP support (specifically, the
planned storage daemon) will need to parse monitor options, so move that
code to monitor/monitor.c, which can be linked into binaries that aren't
a system emulator.

Signed-off-by: Kevin Wolf 
Reviewed-by: Markus Armbruster 
Message-Id: <20200129102239.31435-2-kw...@redhat.com>
Signed-off-by: Markus Armbruster 
---
 include/monitor/monitor.h |  3 +++
 include/sysemu/sysemu.h   |  1 -
 monitor/monitor.c | 48 +++
 vl.c  | 45 +---
 4 files changed, 52 insertions(+), 45 deletions(-)

diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
index a81eeff5f8..b7bdd2bb2a 100644
--- a/include/monitor/monitor.h
+++ b/include/monitor/monitor.h
@@ -10,12 +10,15 @@ typedef struct MonitorHMP MonitorHMP;
 
 #define QMP_REQ_QUEUE_LEN_MAX 8
 
+extern QemuOptsList qemu_mon_opts;
+
 bool monitor_cur_is_qmp(void);
 
 void monitor_init_globals(void);
 void monitor_init_globals_core(void);
 void monitor_init_qmp(Chardev *chr, bool pretty);
 void monitor_init_hmp(Chardev *chr, bool use_readline);
+int monitor_init_opts(QemuOpts *opts, Error **errp);
 void monitor_cleanup(void);
 
 int monitor_suspend(Monitor *mon);
diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index 7956e9054a..c0678c1ca3 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -125,7 +125,6 @@ extern QemuOptsList qemu_netdev_opts;
 extern QemuOptsList qemu_nic_opts;
 extern QemuOptsList qemu_net_opts;
 extern QemuOptsList qemu_global_opts;
-extern QemuOptsList qemu_mon_opts;
 extern QemuOptsList qemu_semihosting_config_opts;
 
 #endif
diff --git a/monitor/monitor.c b/monitor/monitor.c
index 12898b6448..c1a6c4460f 100644
--- a/monitor/monitor.c
+++ b/monitor/monitor.c
@@ -609,6 +609,54 @@ void monitor_init_globals_core(void)
NULL);
 }
 
+int monitor_init_opts(QemuOpts *opts, Error **errp)
+{
+Chardev *chr;
+bool qmp;
+bool pretty = false;
+const char *chardev;
+const char *mode;
+
+mode = qemu_opt_get(opts, "mode");
+if (mode == NULL) {
+mode = "readline";
+}
+if (strcmp(mode, "readline") == 0) {
+qmp = false;
+} else if (strcmp(mode, "control") == 0) {
+qmp = true;
+} else {
+error_setg(errp, "unknown monitor mode \"%s\"", mode);
+return -1;
+}
+
+if (!qmp && qemu_opt_get(opts, "pretty")) {
+warn_report("'pretty' is deprecated for HMP monitors, it has no effect 
"
+"and will be removed in future versions");
+}
+if (qemu_opt_get_bool(opts, "pretty", 0)) {
+pretty = true;
+}
+
+chardev = qemu_opt_get(opts, "chardev");
+if (!chardev) {
+error_report("chardev is required");
+exit(1);
+}
+chr = qemu_chr_find(chardev);
+if (chr == NULL) {
+error_setg(errp, "chardev \"%s\" not found", chardev);
+return -1;
+}
+
+if (qmp) {
+monitor_init_qmp(chr, pretty);
+} else {
+monitor_init_hmp(chr, true);
+}
+return 0;
+}
+
 QemuOptsList qemu_mon_opts = {
 .name = "mon",
 .implied_opt_name = "chardev",
diff --git a/vl.c b/vl.c
index b0ee318f99..794f2e5733 100644
--- a/vl.c
+++ b/vl.c
@@ -2127,50 +2127,7 @@ static int fsdev_init_func(void *opaque, QemuOpts *opts, 
Error **errp)
 
 static int mon_init_func(void *opaque, QemuOpts *opts, Error **errp)
 {
-Chardev *chr;
-bool qmp;
-bool pretty = false;
-const char *chardev;
-const char *mode;
-
-mode = qemu_opt_get(opts, "mode");
-if (mode == NULL) {
-mode = "readline";
-}
-if (strcmp(mode, "readline") == 0) {
-qmp = false;
-} else if (strcmp(mode, "control") == 0) {
-qmp = true;
-} else {
-error_setg(errp, "unknown monitor mode \"%s\"", mode);
-return -1;
-}
-
-if (!qmp && qemu_opt_get(opts, "pretty")) {
-warn_report("'pretty' is deprecated for HMP monitors, it has no effect 
"
-"and will be removed in future versions");
-}
-if (qemu_opt_get_bool(opts, "pretty", 0)) {
-pretty = true;
-}
-
-chardev = qemu_opt_get(opts, "chardev");
-if (!chardev) {
-error_report("chardev is required");
-exit(1);
-}
-chr = qemu_chr_find(chardev);
-if (chr == NULL) {
-error_setg(errp, "chardev \"%s\" not found", chardev);
-return -1;
-}
-
-if (qmp) {
-monitor_init_qmp(chr, pretty);
-} else {
-monitor_init_hmp(chr, true);
-}
-return 0;
+return monitor_init_opts(opts, errp);
 }
 
 static void monitor_parse(const char *optarg, const char *mode, bool pretty)
-- 
2.21.1




[PULL 3/5] monitor: Collect "control" command handlers in qmp-cmds.control.c

2020-02-15 Thread Markus Armbruster
From: Kevin Wolf 

Move all of the QMP commands handlers to implement the 'control' module
(qapi/control.json) that can be shared between the system emulator and
tools such as a storage daemon to a new file monitor/qmp-cmds-control.c.

Signed-off-by: Kevin Wolf 
Reviewed-by: Markus Armbruster 
Message-Id: <20200129102239.31435-4-kw...@redhat.com>
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 monitor/misc.c | 110 --
 monitor/qmp-cmds-control.c | 153 +
 monitor/qmp-cmds.c |  14 
 monitor/Makefile.objs  |   3 +-
 4 files changed, 155 insertions(+), 125 deletions(-)
 create mode 100644 monitor/qmp-cmds-control.c

diff --git a/monitor/misc.c b/monitor/misc.c
index b4303d42d0..4c4e47fdc4 100644
--- a/monitor/misc.c
+++ b/monitor/misc.c
@@ -72,7 +72,6 @@
 #include "qapi/qapi-commands-misc.h"
 #include "qapi/qapi-commands-qom.h"
 #include "qapi/qapi-commands-trace.h"
-#include "qapi/qapi-emit-events.h"
 #include "qapi/qapi-init-commands.h"
 #include "qapi/error.h"
 #include "qapi/qmp-event.h"
@@ -233,58 +232,6 @@ static void hmp_info_help(Monitor *mon, const QDict *qdict)
 help_cmd(mon, "info");
 }
 
-static void query_commands_cb(QmpCommand *cmd, void *opaque)
-{
-CommandInfoList *info, **list = opaque;
-
-if (!cmd->enabled) {
-return;
-}
-
-info = g_malloc0(sizeof(*info));
-info->value = g_malloc0(sizeof(*info->value));
-info->value->name = g_strdup(cmd->name);
-info->next = *list;
-*list = info;
-}
-
-CommandInfoList *qmp_query_commands(Error **errp)
-{
-CommandInfoList *list = NULL;
-MonitorQMP *mon;
-
-assert(monitor_is_qmp(cur_mon));
-mon = container_of(cur_mon, MonitorQMP, common);
-
-qmp_for_each_command(mon->commands, query_commands_cb, &list);
-
-return list;
-}
-
-EventInfoList *qmp_query_events(Error **errp)
-{
-/*
- * TODO This deprecated command is the only user of
- * QAPIEvent_str() and QAPIEvent_lookup[].  When the command goes,
- * they should go, too.
- */
-EventInfoList *info, *ev_list = NULL;
-QAPIEvent e;
-
-for (e = 0 ; e < QAPI_EVENT__MAX ; e++) {
-const char *event_name = QAPIEvent_str(e);
-assert(event_name != NULL);
-info = g_malloc0(sizeof(*info));
-info->value = g_malloc0(sizeof(*info->value));
-info->value->name = g_strdup(event_name);
-
-info->next = ev_list;
-ev_list = info;
-}
-
-return ev_list;
-}
-
 /*
  * Minor hack: generated marshalling suppressed for this command
  * ('gen': false in the schema) so we can parse the JSON string
@@ -323,63 +270,6 @@ static void monitor_init_qmp_commands(void)
  qmp_marshal_qmp_capabilities, QCO_ALLOW_PRECONFIG);
 }
 
-/*
- * Accept QMP capabilities in @list for @mon.
- * On success, set mon->qmp.capab[], and return true.
- * On error, set @errp, and return false.
- */
-static bool qmp_caps_accept(MonitorQMP *mon, QMPCapabilityList *list,
-Error **errp)
-{
-GString *unavailable = NULL;
-bool capab[QMP_CAPABILITY__MAX];
-
-memset(capab, 0, sizeof(capab));
-
-for (; list; list = list->next) {
-if (!mon->capab_offered[list->value]) {
-if (!unavailable) {
-unavailable = g_string_new(QMPCapability_str(list->value));
-} else {
-g_string_append_printf(unavailable, ", %s",
-  QMPCapability_str(list->value));
-}
-}
-capab[list->value] = true;
-}
-
-if (unavailable) {
-error_setg(errp, "Capability %s not available", unavailable->str);
-g_string_free(unavailable, true);
-return false;
-}
-
-memcpy(mon->capab, capab, sizeof(capab));
-return true;
-}
-
-void qmp_qmp_capabilities(bool has_enable, QMPCapabilityList *enable,
-  Error **errp)
-{
-MonitorQMP *mon;
-
-assert(monitor_is_qmp(cur_mon));
-mon = container_of(cur_mon, MonitorQMP, common);
-
-if (mon->commands == &qmp_commands) {
-error_set(errp, ERROR_CLASS_COMMAND_NOT_FOUND,
-  "Capabilities negotiation is already complete, command "
-  "ignored");
-return;
-}
-
-if (!qmp_caps_accept(mon, enable, errp)) {
-return;
-}
-
-mon->commands = &qmp_commands;
-}
-
 /* Set the current CPU defined by the user. Callers must hold BQL. */
 int monitor_set_cpu(int cpu_index)
 {
diff --git a/monitor/qmp-cmds-control.c b/monitor/qmp-cmds-control.c
new file mode 100644
index 00..d5f21f90e6
--- /dev/null
+++ b/monitor/qmp-cmds-control.c
@@ -0,0 +1,153 @@
+/*
+ * QMP commands related to the monitor (common to sysemu and tools)
+ *
+ * Copyright (c) 2003-2004 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentati

[PULL 0/5] Monitor patches for 2020-02-15

2020-02-15 Thread Markus Armbruster
The following changes since commit b29c3e23f64938784c42ef9fca896829e3c19120:

  Merge remote-tracking branch 
'remotes/juanquintela/tags/pull-migration-pull-request' into staging 
(2020-02-14 17:57:15 +)

are available in the Git repository at:

  git://repo.or.cz/qemu/armbru.git tags/pull-monitor-2020-02-15

for you to fetch changes up to 6fce5a08f89d4ebf197fca838d60239482db957f:

  qemu-doc: Clarify extent of build platform support (2020-02-15 12:44:28 +0100)


Monitor patches for 2020-02-15

* Refactoring in preparation for qemu-storage-daemon

* A doc clarification that's admittedly not about the monitor


Kevin Wolf (4):
  monitor: Move monitor option parsing to monitor/monitor.c
  qapi: Split control.json off misc.json
  monitor: Collect "control" command handlers in qmp-cmds.control.c
  monitor: Move qmp_query_qmp_schema to qmp-cmds-control.c

Markus Armbruster (1):
  qemu-doc: Clarify extent of build platform support

 qemu-doc.texi  |   9 +-
 qapi/control.json  | 218 +
 qapi/misc.json | 212 ---
 qapi/qapi-schema.json  |   1 +
 include/monitor/monitor.h  |   3 +
 include/sysemu/sysemu.h|   1 -
 monitor/monitor-internal.h |   4 +
 monitor/hmp-cmds.c |   1 +
 monitor/misc.c | 127 +-
 monitor/monitor.c  |  48 ++
 monitor/qmp-cmds-control.c | 169 +++
 monitor/qmp-cmds.c |  15 +---
 monitor/qmp.c  |   2 +-
 tests/qtest/qmp-test.c |   2 +-
 ui/gtk.c   |   1 +
 vl.c   |  45 +-
 monitor/Makefile.objs  |   3 +-
 qapi/Makefile.objs |   6 +-
 18 files changed, 460 insertions(+), 407 deletions(-)
 create mode 100644 qapi/control.json
 create mode 100644 monitor/qmp-cmds-control.c

Kevin Wolf (4):
  monitor: Move monitor option parsing to monitor/monitor.c
  qapi: Split control.json off misc.json
  monitor: Collect "control" command handlers in qmp-cmds.control.c
  monitor: Move qmp_query_qmp_schema to qmp-cmds-control.c

Markus Armbruster (1):
  qemu-doc: Clarify extent of build platform support

 qemu-doc.texi  |   9 +-
 qapi/control.json  | 218 +
 qapi/misc.json | 212 
 qapi/qapi-schema.json  |   1 +
 include/monitor/monitor.h  |   3 +
 include/sysemu/sysemu.h|   1 -
 monitor/monitor-internal.h |   4 +
 monitor/hmp-cmds.c |   1 +
 monitor/misc.c | 127 +
 monitor/monitor.c  |  48 
 monitor/qmp-cmds-control.c | 169 
 monitor/qmp-cmds.c |  15 +--
 monitor/qmp.c  |   2 +-
 tests/qtest/qmp-test.c |   2 +-
 ui/gtk.c   |   1 +
 vl.c   |  45 +---
 monitor/Makefile.objs  |   3 +-
 qapi/Makefile.objs |   6 +-
 18 files changed, 460 insertions(+), 407 deletions(-)
 create mode 100644 qapi/control.json
 create mode 100644 monitor/qmp-cmds-control.c

-- 
2.21.1




[PULL 2/5] qapi: Split control.json off misc.json

2020-02-15 Thread Markus Armbruster
From: Kevin Wolf 

misc.json contains definitions that are related to the system emulator,
so it can't be used for other tools like the storage daemon. This patch
moves basic functionality that is shared between all tools (and mostly
related to the monitor itself) into a new control.json, which could be
used in tools as well.

Signed-off-by: Kevin Wolf 
Reviewed-by: Markus Armbruster 
Message-Id: <20200129102239.31435-3-kw...@redhat.com>
[Commit message tweaked]
Signed-off-by: Markus Armbruster 
---
 qapi/control.json  | 218 +
 qapi/misc.json | 212 
 qapi/qapi-schema.json  |   1 +
 monitor/monitor-internal.h |   1 +
 monitor/hmp-cmds.c |   1 +
 monitor/misc.c |   1 +
 monitor/qmp-cmds.c |   1 +
 monitor/qmp.c  |   2 +-
 tests/qtest/qmp-test.c |   2 +-
 ui/gtk.c   |   1 +
 qapi/Makefile.objs |   6 +-
 11 files changed, 229 insertions(+), 217 deletions(-)
 create mode 100644 qapi/control.json

diff --git a/qapi/control.json b/qapi/control.json
new file mode 100644
index 00..c1ed12a850
--- /dev/null
+++ b/qapi/control.json
@@ -0,0 +1,218 @@
+# -*- Mode: Python -*-
+#
+
+##
+# = QMP monitor control
+##
+
+##
+# @qmp_capabilities:
+#
+# Enable QMP capabilities.
+#
+# Arguments:
+#
+# @enable:   An optional list of QMPCapability values to enable.  The
+#client must not enable any capability that is not
+#mentioned in the QMP greeting message.  If the field is not
+#provided, it means no QMP capabilities will be enabled.
+#(since 2.12)
+#
+# Example:
+#
+# -> { "execute": "qmp_capabilities",
+#  "arguments": { "enable": [ "oob" ] } }
+# <- { "return": {} }
+#
+# Notes: This command is valid exactly when first connecting: it must be
+# issued before any other command will be accepted, and will fail once the
+# monitor is accepting other commands. (see qemu docs/interop/qmp-spec.txt)
+#
+# The QMP client needs to explicitly enable QMP capabilities, otherwise
+# all the QMP capabilities will be turned off by default.
+#
+# Since: 0.13
+#
+##
+{ 'command': 'qmp_capabilities',
+  'data': { '*enable': [ 'QMPCapability' ] },
+  'allow-preconfig': true }
+
+##
+# @QMPCapability:
+#
+# Enumeration of capabilities to be advertised during initial client
+# connection, used for agreeing on particular QMP extension behaviors.
+#
+# @oob:   QMP ability to support out-of-band requests.
+# (Please refer to qmp-spec.txt for more information on OOB)
+#
+# Since: 2.12
+#
+##
+{ 'enum': 'QMPCapability',
+  'data': [ 'oob' ] }
+
+##
+# @VersionTriple:
+#
+# A three-part version number.
+#
+# @major:  The major version number.
+#
+# @minor:  The minor version number.
+#
+# @micro:  The micro version number.
+#
+# Since: 2.4
+##
+{ 'struct': 'VersionTriple',
+  'data': {'major': 'int', 'minor': 'int', 'micro': 'int'} }
+
+
+##
+# @VersionInfo:
+#
+# A description of QEMU's version.
+#
+# @qemu:The version of QEMU.  By current convention, a micro
+#   version of 50 signifies a development branch.  A micro version
+#   greater than or equal to 90 signifies a release candidate for
+#   the next minor version.  A micro version of less than 50
+#   signifies a stable release.
+#
+# @package: QEMU will always set this field to an empty string.  Downstream
+#   versions of QEMU should set this to a non-empty string.  The
+#   exact format depends on the downstream however it highly
+#   recommended that a unique name is used.
+#
+# Since: 0.14.0
+##
+{ 'struct': 'VersionInfo',
+  'data': {'qemu': 'VersionTriple', 'package': 'str'} }
+
+##
+# @query-version:
+#
+# Returns the current version of QEMU.
+#
+# Returns:  A @VersionInfo object describing the current version of QEMU.
+#
+# Since: 0.14.0
+#
+# Example:
+#
+# -> { "execute": "query-version" }
+# <- {
+#   "return":{
+#  "qemu":{
+# "major":0,
+# "minor":11,
+# "micro":5
+#  },
+#  "package":""
+#   }
+#}
+#
+##
+{ 'command': 'query-version', 'returns': 'VersionInfo',
+  'allow-preconfig': true }
+
+##
+# @CommandInfo:
+#
+# Information about a QMP command
+#
+# @name: The command name
+#
+# Since: 0.14.0
+##
+{ 'struct': 'CommandInfo', 'data': {'name': 'str'} }
+
+##
+# @query-commands:
+#
+# Return a list of supported QMP commands by this server
+#
+# Returns: A list of @CommandInfo for all supported commands
+#
+# Since: 0.14.0
+#
+# Example:
+#
+# -> { "execute": "query-commands" }
+# <- {
+#  "return":[
+# {
+#"name":"query-balloon"
+# },
+# {
+#"name":"system_powerdown"
+# }
+#  ]
+#}
+#
+# Note: This example has been shortened as the real response is too long.
+#
+##
+{ 'command': 'query-commands', 'returns': ['CommandIn

hw/net/rocker: Dubious code in tx_consume()

2020-02-15 Thread Philippe Mathieu-Daudé

Hi Jiri,

I am trying to understand this code Scott Feldman added in commit 
dc488f88806:


 157 static int tx_consume(Rocker *r, DescInfo *info)
 158 {
 ...
 212 if (tlvs[ROCKER_TLV_TX_TSO_MSS]) {
 213 tx_tso_mss = rocker_tlv_get_le16(tlvs[ROCKER_TLV_TX_TSO_MSS]);
 214 }
 ...
 252 if (iovcnt) {
 253 /* XXX perform Tx offloads */
 254 /* XXX   silence compiler for now */
 255 tx_l3_csum_off += tx_tso_mss = tx_tso_hdr_len = 0;
 256 }

Nobody complained TSO_MSS is not implemented during almost 5 years.
Can we remove this code?

Thanks,

Phil.




Re: Build for qemu-sh4 broken since 2445971604c

2020-02-15 Thread Philippe Mathieu-Daudé

Hi John,

On 2/15/20 11:53 AM, John Paul Adrian Glaubitz wrote:

Hi!

Currently trying to build qemu-sh4 in static configuration fails with:

make[1]: Entering directory '/root/qemu/slirp'
make[1]: Nothing to be done for 'all'.
make[1]: Leaving directory '/root/qemu/slirp'
   CC  sh4-linux-user/tcg/tcg-op-gvec.o
/root/qemu/tcg/tcg-op-gvec.c:298:25: error: unknown type name 
‘gen_helper_gvec_5_ptr’; did you mean ‘gen_helper_gvec_4_ptr’?
   298 | gen_helper_gvec_5_ptr *fn)
   | ^
   | gen_helper_gvec_4_ptr
make[1]: *** [/root/qemu/rules.mak:69: tcg/tcg-op-gvec.o] Error 1
make: *** [Makefile:497: sh4-linux-user/all] Error 2


I believe your build directory is out of date and might have dangling 
old files.



This seems to have been introduced with:

commit 2445971604c1cfd3ec484457159f4ac300fb04d2
Author: Richard Henderson 
Date:   Tue Feb 11 16:31:38 2020 -0800

 tcg: Add tcg_gen_gvec_5_ptr
 
 Extend the vector generator infrastructure to handle

 5 vector arguments.
 
 Reviewed-by: Philippe Mathieu-Daudé 

 Reviewed-by: Alex Bennée 
 Reviewed-by: Taylor Simpson 
 Signed-off-by: Richard Henderson 


If you look the content of this commit, the new type is properly declared:

--- a/include/tcg/tcg-op-gvec.h
+++ b/include/tcg/tcg-op-gvec.h
@@ -83,6 +83,13 @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, 
uint32_t bofs,

 uint32_t maxsz, int32_t data,
 gen_helper_gvec_4_ptr *fn);

 uint32_t maxsz, int32_t data,
 gen_helper_gvec_4_ptr *fn);

+typedef void gen_helper_gvec_5_ptr(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr,
+   TCGv_ptr, TCGv_ptr, TCGv_i32);
+void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
+uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
+uint32_t oprsz, uint32_t maxsz, int32_t data,
+gen_helper_gvec_5_ptr *fn);
+

BTW what capstone configuration are you using?
Is that --disable-capstone or another?

Regards,

Phil.




Re: Build for qemu-sh4 broken since 2445971604c

2020-02-15 Thread Philippe Mathieu-Daudé
On Sat, Feb 15, 2020 at 2:53 PM Philippe Mathieu-Daudé
 wrote:
>
> Hi John,
>
> On 2/15/20 11:53 AM, John Paul Adrian Glaubitz wrote:
> > Hi!
> >
> > Currently trying to build qemu-sh4 in static configuration fails with:
> >
> > make[1]: Entering directory '/root/qemu/slirp'
> > make[1]: Nothing to be done for 'all'.
> > make[1]: Leaving directory '/root/qemu/slirp'
> >CC  sh4-linux-user/tcg/tcg-op-gvec.o
> > /root/qemu/tcg/tcg-op-gvec.c:298:25: error: unknown type name 
> > ‘gen_helper_gvec_5_ptr’; did you mean ‘gen_helper_gvec_4_ptr’?
> >298 | gen_helper_gvec_5_ptr *fn)
> >| ^
> >| gen_helper_gvec_4_ptr
> > make[1]: *** [/root/qemu/rules.mak:69: tcg/tcg-op-gvec.o] Error 1
> > make: *** [Makefile:497: sh4-linux-user/all] Error 2
>
> I believe your build directory is out of date and might have dangling
> old files.

FYI the CI job succeeds:
https://travis-ci.org/qemu/qemu/jobs/650567444#L3193

> > This seems to have been introduced with:
> >
> > commit 2445971604c1cfd3ec484457159f4ac300fb04d2
> > Author: Richard Henderson 
> > Date:   Tue Feb 11 16:31:38 2020 -0800
> >
> >  tcg: Add tcg_gen_gvec_5_ptr
> >
> >  Extend the vector generator infrastructure to handle
> >  5 vector arguments.
> >
> >  Reviewed-by: Philippe Mathieu-Daudé 
> >  Reviewed-by: Alex Bennée 
> >  Reviewed-by: Taylor Simpson 
> >  Signed-off-by: Richard Henderson 
>
> If you look the content of this commit, the new type is properly declared:
>
> --- a/include/tcg/tcg-op-gvec.h
> +++ b/include/tcg/tcg-op-gvec.h
> @@ -83,6 +83,13 @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs,
> uint32_t bofs,
>   uint32_t maxsz, int32_t data,
>   gen_helper_gvec_4_ptr *fn);
>
>   uint32_t maxsz, int32_t data,
>   gen_helper_gvec_4_ptr *fn);
>
> +typedef void gen_helper_gvec_5_ptr(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr,
> +   TCGv_ptr, TCGv_ptr, TCGv_i32);
> +void tcg_gen_gvec_5_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
> +uint32_t cofs, uint32_t eofs, TCGv_ptr ptr,
> +uint32_t oprsz, uint32_t maxsz, int32_t data,
> +gen_helper_gvec_5_ptr *fn);
> +
>
> BTW what capstone configuration are you using?
> Is that --disable-capstone or another?

OK I understood, Debian provide capstone.a:
https://packages.debian.org/sid/sh4/libcapstone-dev/filelist

and our CI job on Travis is based on Ubuntu, so using --static works:
https://travis-ci.org/qemu/qemu/jobs/650567444

Fedora capstone-devel package only provide a shared library.




Re: Build for qemu-sh4 broken since 2445971604c

2020-02-15 Thread John Paul Adrian Glaubitz
On 2/15/20 2:53 PM, Philippe Mathieu-Daudé wrote:
> On 2/15/20 11:53 AM, John Paul Adrian Glaubitz wrote:
>> Hi!
>>
>> Currently trying to build qemu-sh4 in static configuration fails with:
>>
>> make[1]: Entering directory '/root/qemu/slirp'
>> make[1]: Nothing to be done for 'all'.
>> make[1]: Leaving directory '/root/qemu/slirp'
>>    CC  sh4-linux-user/tcg/tcg-op-gvec.o
>> /root/qemu/tcg/tcg-op-gvec.c:298:25: error: unknown type name 
>> ‘gen_helper_gvec_5_ptr’; did you mean ‘gen_helper_gvec_4_ptr’?
>>    298 | gen_helper_gvec_5_ptr *fn)
>>    | ^
>>    | gen_helper_gvec_4_ptr
>> make[1]: *** [/root/qemu/rules.mak:69: tcg/tcg-op-gvec.o] Error 1
>> make: *** [Makefile:497: sh4-linux-user/all] Error 2
> 
> I believe your build directory is out of date and might have dangling old 
> files.
Yes, this seems to have been the problem, thanks.

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer - glaub...@debian.org
`. `'   Freie Universitaet Berlin - glaub...@physik.fu-berlin.de
  `-GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913



QAPI schema for desired state of LUKS keyslots (was: [PATCH 02/13] qcrypto-luks: implement encryption key management)

2020-02-15 Thread Markus Armbruster
Review of this patch led to a lengthy QAPI schema design discussion.
Let me try to condense it into a concrete proposal.

This is about the QAPI schema, and therefore about QMP.  The
human-friendly interface is out of scope.  Not because it's not
important (it clearly is!), only because we need to *focus* to have a
chance at success.

I'm going to include a few design options.  I'll mark them "Option:".

The proposed "amend" interface takes a specification of desired state,
and figures out how to get from here to there by itself.  LUKS keyslots
are one part of desired state.

We commonly have eight LUKS keyslots.  Each keyslot is either active or
inactive.  An active keyslot holds a secret.

Goal: a QAPI type for specifying desired state of LUKS keyslots.

Proposal:

{ 'enum': 'LUKSKeyslotState',
  'data': [ 'active', 'inactive' ] }

{ 'struct': 'LUKSKeyslotActive',
  'data': { 'secret': 'str',
'*iter-time': 'int } }

{ 'struct': 'LUKSKeyslotInactive',
  'data': { '*old-secret': 'str' } }

{ 'union': 'LUKSKeyslotAmend',
  'base': { '*keyslot': 'int',
'state': 'LUKSKeyslotState' }
  'discriminator': 'state',
  'data': { 'active': 'LUKSKeyslotActive',
'inactive': 'LUKSKeyslotInactive' } }

LUKSKeyslotAmend specifies desired state for a set of keyslots.

Four cases:

* @state is "active"

  Desired state is active holding the secret given by @secret.  Optional
  @iter-time tweaks key stretching.

  The keyslot is chosen either by the user or by the system, as follows:

  - @keyslot absent

One inactive keyslot chosen by the system.  If none exists, error.

  - @keyslot present

The keyslot given by @keyslot.

If it's already active holding @secret, no-op.  Rationale: the
current state is the desired state.

If it's already active holding another secret, error.  Rationale:
update in place is unsafe.

Option: delete the "already active holding @secret" case.  Feels
inelegant to me.  Okay if it makes things substantially simpler.

* @state is "inactive"

  Desired state is inactive.

  Error if the current state has active keyslots, but the desired state
  has none.

  The user choses the keyslot by number and/or by the secret it holds,
  as follows:

  - @keyslot absent, @old-secret present

All active keyslots holding @old-secret.  If none exists, error.

  - @keyslot present, @old-secret absent

The keyslot given by @keyslot.

If it's already inactive, no-op.  Rationale: the current state is
the desired state.

  - both @keyslot and @old-secret present

The keyslot given by keyslot.

If it's inactive or holds a secret other than @old-secret, error.

Option: error regardless of @old-secret, if that makes things
simpler.

  - neither @keyslot not @old-secret present

All keyslots.  Note that this will error out due to "desired state
has no active keyslots" unless the current state has none, either.

Option: error out unconditionally.

Note that LUKSKeyslotAmend can specify only one desired state for
commonly just one keyslot.  Rationale: this satisfies practical needs.
An array of LUKSKeyslotAmend could specify desired state for all
keyslots.  However, multiple array elements could then apply to the same
slot.  We'd have to specify how to resolve such conflicts, and we'd have
to code up conflict detection.  Not worth it.

Examples:

* Add a secret to some free keyslot:

  { "state": "active", "secret": "CIA/GRU/MI6" }

* Deactivate all keyslots holding a secret:

  { "state": "inactive", "old-secret": "CIA/GRU/MI6" }

* Add a secret to a specific keyslot:

  { "state": "active", "secret": "CIA/GRU/MI6", "keyslot": 0 }

* Deactivate a specific keyslot:

  { "state": "inactive", "keyslot": 0 }

  Possibly less dangerous:

  { "state": "inactive", "keyslot": 0, "old-secret": "CIA/GRU/MI6" }

Option: Make use of Max's patches to support optional union tag with
default value to let us default @state to "active".  I doubt this makes
much of a difference in QMP.  A human-friendly interface should probably
be higher level anyway (Daniel pointed to cryptsetup).

Option: LUKSKeyslotInactive member @old-secret could also be named
@secret.  I don't care.

Option: delete @keyslot.  It provides low-level slot access.
Complicates the interface.  Fine if we need lov-level slot access.  Do
we?

I apologize for the time it has taken me to write this.

Comments?




[PATCH 1/2] hw/ipmi/bmc: Delay timer_new_ns() from init to realize to avoid memleaks

2020-02-15 Thread Philippe Mathieu-Daudé
In commit f3a508eb4e the Euler Robot reported calling timer_new()
in instance_init() can leak heap memory. The easier fix is to
delay the timer creation at instance realize(). Similarly move
timer_del() into a new instance unrealize() method.

This case was found with the following coccinelle script:

@ match @
identifier instance_init;
typedef Object;
identifier obj;
expression val, scale;
identifier clock_type, callback, opaque;
position pos;
@@
static void instance_init(Object *obj)
{
  <...
(
  val = timer_new@pos(clock_type, scale, callback, opaque);
|
  val = timer_new_ns@pos(clock_type, callback, opaque);
|
  val = timer_new_us@pos(clock_type, callback, opaque);
|
  val = timer_new_ms@pos(clock_type, callback, opaque);
)
  ...>
}

@ script:python @
f << match.instance_init;
p << match.pos;
@@
print "check %s:%s:%s in %s()" % (p[0].file, p[0].line, p[0].column, f)

Signed-off-by: Philippe Mathieu-Daudé 
---
Cc: Pan Nengyuan 
---
 hw/ipmi/ipmi_bmc_extern.c | 12 ++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index f9a13e0a44..9144ac6c38 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -463,6 +463,15 @@ static void ipmi_bmc_extern_realize(DeviceState *dev, 
Error **errp)
 
 qemu_chr_fe_set_handlers(&ibe->chr, can_receive, receive,
  chr_event, NULL, ibe, NULL, true);
+
+ibe->extern_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, extern_timeout, ibe);
+}
+
+static void ipmi_bmc_extern_unrealize(DeviceState *dev, Error **errp)
+{
+IPMIBmcExtern *ibe = IPMI_BMC_EXTERN(dev);
+
+timer_del(ibe->extern_timer);
 }
 
 static int ipmi_bmc_extern_post_migrate(void *opaque, int version_id)
@@ -502,7 +511,6 @@ static void ipmi_bmc_extern_init(Object *obj)
 {
 IPMIBmcExtern *ibe = IPMI_BMC_EXTERN(obj);
 
-ibe->extern_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, extern_timeout, ibe);
 vmstate_register(NULL, 0, &vmstate_ipmi_bmc_extern, ibe);
 }
 
@@ -510,7 +518,6 @@ static void ipmi_bmc_extern_finalize(Object *obj)
 {
 IPMIBmcExtern *ibe = IPMI_BMC_EXTERN(obj);
 
-timer_del(ibe->extern_timer);
 timer_free(ibe->extern_timer);
 }
 
@@ -528,6 +535,7 @@ static void ipmi_bmc_extern_class_init(ObjectClass *oc, 
void *data)
 bk->handle_reset = ipmi_bmc_extern_handle_reset;
 dc->hotpluggable = false;
 dc->realize = ipmi_bmc_extern_realize;
+dc->unrealize = ipmi_bmc_extern_unrealize;
 device_class_set_props(dc, ipmi_bmc_extern_properties);
 }
 
-- 
2.21.1




[PATCH 2/2] hw/sd/sd: Delay timer_new_ns() from init to realize to avoid memleaks

2020-02-15 Thread Philippe Mathieu-Daudé
In commit f3a508eb4e the Euler Robot reported calling timer_new()
in instance_init() can leak heap memory. The easier fix is to
delay the timer creation at instance realize(). Similarly move
timer_del() into a new instance unrealize() method.

This case was found with the following coccinelle script:

@ match @
identifier instance_init;
typedef Object;
identifier obj;
expression val, scale;
identifier clock_type, callback, opaque;
position pos;
@@
static void instance_init(Object *obj)
{
  <...
(
  val = timer_new@pos(clock_type, scale, callback, opaque);
|
  val = timer_new_ns@pos(clock_type, callback, opaque);
|
  val = timer_new_us@pos(clock_type, callback, opaque);
|
  val = timer_new_ms@pos(clock_type, callback, opaque);
)
  ...>
}

@ script:python @
f << match.instance_init;
p << match.pos;
@@
print "check %s:%s:%s in %s()" % (p[0].file, p[0].line, p[0].column, f)

Signed-off-by: Philippe Mathieu-Daudé 
---
Cc: Pan Nengyuan 
---
 hw/sd/sd.c | 12 ++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 71a9af09ab..d72cf3de2a 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -2058,14 +2058,12 @@ static void sd_instance_init(Object *obj)
 SDState *sd = SD_CARD(obj);
 
 sd->enable = true;
-sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
 }
 
 static void sd_instance_finalize(Object *obj)
 {
 SDState *sd = SD_CARD(obj);
 
-timer_del(sd->ocr_power_timer);
 timer_free(sd->ocr_power_timer);
 }
 
@@ -2098,6 +2096,15 @@ static void sd_realize(DeviceState *dev, Error **errp)
 }
 blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
 }
+
+sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
+}
+
+static void sd_unrealize(DeviceState *dev, Error **errp)
+{
+SDState *sd = SD_CARD(dev);
+
+timer_del(sd->ocr_power_timer);
 }
 
 static Property sd_properties[] = {
@@ -2118,6 +2125,7 @@ static void sd_class_init(ObjectClass *klass, void *data)
 SDCardClass *sc = SD_CARD_CLASS(klass);
 
 dc->realize = sd_realize;
+dc->unrealize = sd_unrealize;
 device_class_set_props(dc, sd_properties);
 dc->vmsd = &sd_vmstate;
 dc->reset = sd_reset;
-- 
2.21.1




[PATCH 0/2] hw: Delay timer_new() from init to realize to avoid memleaks

2020-02-15 Thread Philippe Mathieu-Daudé
After reviewing various patches from Pan Nengyuan fixing errors
reported Huawei's Euler Robot, I wrote this tiny coccinelle script
to find all occurences of this pattern:

@ match @
identifier instance_init;
typedef Object;
identifier obj;
expression val, scale;
identifier clock_type, callback, opaque;
position pos;
@@
static void instance_init(Object *obj)
{
  <...
(
  val = timer_new@pos(clock_type, scale, callback, opaque);
|
  val = timer_new_ns@pos(clock_type, callback, opaque);
|
  val = timer_new_us@pos(clock_type, callback, opaque);
|
  val = timer_new_ms@pos(clock_type, callback, opaque);
)
  ...>
}

@ script:python @
f << match.instance_init;
p << match.pos;
@@
print "check %s:%s:%s in %s()" % (p[0].file, p[0].line, p[0].column, f)

The script produces:

  $ docker run --rm -v $PWD:$PWD -w $PWD philmd/coccinelle \
 --macro-file scripts/cocci-macro-file.h \
 --sp-file scripts/coccinelle/init_timer_new.cocci
  init_defs_builtins: /usr/lib/coccinelle/standard.h
  init_defs: scripts/cocci-macro-file.h
  check hw/ipmi/ipmi_bmc_extern.c:505:24 in ipmi_bmc_extern_init()
  check hw/misc/mos6522.c:489:25 in mos6522_init()
  check hw/rtc/pl031.c:194:15 in pl031_init()
  check hw/arm/pxa2xx.c:1137:19 in pxa2xx_rtc_init()
  check target/s390x/cpu.c:283:8 in s390_cpu_initfn()
  check hw/sd/sd.c:2061:26 in sd_instance_init()
  check hw/arm/spitz.c:527:18 in spitz_keyboard_init()
  check hw/arm/strongarm.c:402:19 in strongarm_rtc_init()
  check hw/arm/strongarm.c:1244:26 in strongarm_uart_init()

Pan fixed most of the occurences. This series fixes the last two.

Philippe Mathieu-Daudé (2):
  hw/ipmi/bmc: Delay timer_new_ns() from init to realize to avoid
memleaks
  hw/sd/sd: Delay timer_new_ns() from init to realize to avoid memleaks

 hw/ipmi/ipmi_bmc_extern.c | 12 ++--
 hw/sd/sd.c| 12 ++--
 2 files changed, 20 insertions(+), 4 deletions(-)

-- 
2.21.1




[PATCH 3/3] tools/virtiofsd/fuse_lowlevel: Fix fuse_out_header.error value

2020-02-15 Thread Philippe Mathieu-Daudé
Fix warning reported by Clang static code analyzer:

CC  tools/virtiofsd/fuse_lowlevel.o
  tools/virtiofsd/fuse_lowlevel.c:195:9: warning: Value stored to 'error' is 
never read
  error = -ERANGE;
  ^   ~~~

Fixes: 2de121f01e
Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé 
---
RFC because untested
---
 tools/virtiofsd/fuse_lowlevel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/virtiofsd/fuse_lowlevel.c b/tools/virtiofsd/fuse_lowlevel.c
index 704c0369b2..2dd36ec03b 100644
--- a/tools/virtiofsd/fuse_lowlevel.c
+++ b/tools/virtiofsd/fuse_lowlevel.c
@@ -192,7 +192,7 @@ int fuse_send_reply_iov_nofree(fuse_req_t req, int error, 
struct iovec *iov,
 
 if (error <= -1000 || error > 0) {
 fuse_log(FUSE_LOG_ERR, "fuse: bad error value: %i\n", error);
-error = -ERANGE;
+out.error = -ERANGE;
 }
 
 iov[0].iov_base = &out;
-- 
2.21.1




[PATCH 1/3] tools/virtiofsd/passthrough_ll: Remove unneeded variable assignment

2020-02-15 Thread Philippe Mathieu-Daudé
Fix warning reported by Clang static code analyzer:

CC  tools/virtiofsd/passthrough_ll.o
  tools/virtiofsd/passthrough_ll.c:1083:5: warning: Value stored to 'saverr' is 
never read
  saverr = ENOMEM;
  ^~~

Fixes: 7c6b66027
Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé 
---
 tools/virtiofsd/passthrough_ll.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index c635fc8820..e9e71d5fc2 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -1080,8 +1080,6 @@ static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t 
parent,
 return;
 }
 
-saverr = ENOMEM;
-
 saverr = lo_change_cred(req, &old);
 if (saverr) {
 goto out;
-- 
2.21.1




[PATCH 0/3] tools/virtiofsd: Fix warning reported by Clang static code analyzer

2020-02-15 Thread Philippe Mathieu-Daudé



Philippe Mathieu-Daudé (3):
  tools/virtiofsd/passthrough_ll: Remove unneeded variable assignment
  tools/virtiofsd/passthrough_ll: Remove unneeded variable assignment
  tools/virtiofsd/fuse_lowlevel: Fix fuse_out_header.error value

 tools/virtiofsd/fuse_lowlevel.c  | 2 +-
 tools/virtiofsd/passthrough_ll.c | 6 +-
 2 files changed, 2 insertions(+), 6 deletions(-)

-- 
2.21.1




[PATCH 2/3] tools/virtiofsd/passthrough_ll: Remove unneeded variable assignment

2020-02-15 Thread Philippe Mathieu-Daudé
Fix warning reported by Clang static code analyzer:

CC  tools/virtiofsd/passthrough_ll.o
  tools/virtiofsd/passthrough_ll.c:925:9: warning: Value stored to 'newfd' is 
never read
  newfd = -1;
  ^   ~~
  tools/virtiofsd/passthrough_ll.c:942:9: warning: Value stored to 'newfd' is 
never read
  newfd = -1;
  ^   ~~

Fixes: 7c6b66027
Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé 
---
 tools/virtiofsd/passthrough_ll.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index e9e71d5fc2..b38e0e4d84 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -922,7 +922,6 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, 
const char *name,
 inode = lo_find(lo, &e->attr);
 if (inode) {
 close(newfd);
-newfd = -1;
 } else {
 inode = calloc(1, sizeof(struct lo_inode));
 if (!inode) {
@@ -938,8 +937,7 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, 
const char *name,
 g_atomic_int_set(&inode->refcount, 2);
 
 inode->nlookup = 1;
-inode->fd = newfd;
-newfd = -1;
+inode->fd = -1;
 inode->key.ino = e->attr.st_ino;
 inode->key.dev = e->attr.st_dev;
 pthread_mutex_init(&inode->plock_mutex, NULL);
-- 
2.21.1




[PATCH 3/3] hw/block/pflash_cfi02: Remove unneeded variable assignment

2020-02-15 Thread Philippe Mathieu-Daudé
Fix warning reported by Clang static code analyzer:

CC  hw/block/pflash_cfi02.o
  hw/block/pflash_cfi02.c:311:5: warning: Value stored to 'ret' is never read
  ret = -1;
  ^ ~~

Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/block/pflash_cfi02.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/block/pflash_cfi02.c b/hw/block/pflash_cfi02.c
index 7c4744c020..12f18d401a 100644
--- a/hw/block/pflash_cfi02.c
+++ b/hw/block/pflash_cfi02.c
@@ -308,7 +308,6 @@ static uint64_t pflash_read(void *opaque, hwaddr offset, 
unsigned int width)
 hwaddr boff;
 uint64_t ret;
 
-ret = -1;
 /* Lazy reset to ROMD mode after a certain amount of read accesses */
 if (!pfl->rom_mode && pfl->wcycle == 0 &&
 ++pfl->read_counter > PFLASH_LAZY_ROMD_THRESHOLD) {
-- 
2.21.1




[PATCH 0/3] hw: Remove unneeded variable assignment

2020-02-15 Thread Philippe Mathieu-Daudé
Fix few warnings reported by Clang static code analyzer.

Philippe Mathieu-Daudé (3):
  block/qcow2-bitmap: Remove unneeded variable assignment
  hw/display/qxl: Remove unneeded variable assignment
  hw/block/pflash_cfi02: Remove unneeded variable assignment

 block/qcow2-bitmap.c| 1 -
 hw/block/pflash_cfi02.c | 1 -
 hw/display/qxl.c| 2 +-
 3 files changed, 1 insertion(+), 3 deletions(-)

-- 
2.21.1




[PATCH 2/3] hw/display/qxl: Remove unneeded variable assignment

2020-02-15 Thread Philippe Mathieu-Daudé
Fix warning reported by Clang static code analyzer:

  hw/display/qxl.c:1634:14: warning: Value stored to 'orig_io_port' during its 
initialization is never read
  uint32_t orig_io_port = io_port;
   ^~~~   ~~~

Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/display/qxl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 64884da708..21a43a1d5e 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1631,7 +1631,7 @@ static void ioport_write(void *opaque, hwaddr addr,
 PCIQXLDevice *d = opaque;
 uint32_t io_port = addr;
 qxl_async_io async = QXL_SYNC;
-uint32_t orig_io_port = io_port;
+uint32_t orig_io_port;
 
 if (d->guest_bug && io_port != QXL_IO_RESET) {
 return;
-- 
2.21.1




[PATCH 1/3] block/qcow2-bitmap: Remove unneeded variable assignment

2020-02-15 Thread Philippe Mathieu-Daudé
Fix warning reported by Clang static code analyzer:

CC  block/qcow2-bitmap.o
  block/qcow2-bitmap.c:650:5: warning: Value stored to 'ret' is never read
  ret = -EINVAL;
  ^ ~~~

Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé 
---
 block/qcow2-bitmap.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
index d41f5d049b..82c9f3 100644
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -647,7 +647,6 @@ static Qcow2BitmapList *bitmap_list_load(BlockDriverState 
*bs, uint64_t offset,
 return bm_list;
 
 broken_dir:
-ret = -EINVAL;
 error_setg(errp, "Broken bitmap directory");
 
 fail:
-- 
2.21.1




[PATCH] hw/misc/iotkit-secctl: Fix writing to 'PPC Interrupt Clear' register

2020-02-15 Thread Philippe Mathieu-Daudé
Fix warning reported by Clang static code analyzer:

CC  hw/misc/iotkit-secctl.o
  hw/misc/iotkit-secctl.c:343:9: warning: Value stored to 'value' is never read
  value &= 0x00f000f3;
  ^~~

Fixes: b3717c23e1c
Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/misc/iotkit-secctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
index 609869821a..0d5556dd17 100644
--- a/hw/misc/iotkit-secctl.c
+++ b/hw/misc/iotkit-secctl.c
@@ -340,7 +340,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, 
hwaddr addr,
 qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
 break;
 case A_SECPPCINTCLR:
-value &= 0x00f000f3;
+s->secppcintstat = ~value & 0x00f000f3;
 foreach_ppc(s, iotkit_secctl_ppc_update_irq_clear);
 break;
 case A_SECPPCINTEN:
-- 
2.21.1




[PATCH] configure: Avoid compiling system tools on user build by default

2020-02-15 Thread Philippe Mathieu-Daudé
User-mode does not need the sytem tools. Do not build them by
default if user specified --disable-system.

Signed-off-by: Philippe Mathieu-Daudé 
---
 configure | 11 ++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/configure b/configure
index 16f94cd96b..557ca4bd04 100755
--- a/configure
+++ b/configure
@@ -455,7 +455,7 @@ guest_agent_ntddscsi="no"
 guest_agent_msi=""
 vss_win32_sdk=""
 win_sdk="no"
-want_tools="yes"
+want_tools=""
 libiscsi=""
 libnfs=""
 coroutine=""
@@ -2199,6 +2199,15 @@ else
 echo big/little test failed
 fi
 
+##
+# system tools
+if test "$want_tools" != "yes" && test "$softmmu" = "no"; then
+want_tools=no
+fi
+if test -z "$want_tools"; then
+want_tools=yes
+fi
+
 ##
 # cocoa implies not SDL or GTK
 # (the cocoa UI code currently assumes it is always the active UI
-- 
2.21.1




Re: [PATCH v3 12/13] hw/arm/raspi: Use a unique raspi_machine_class_init() method

2020-02-15 Thread Philippe Mathieu-Daudé
On Thu, Feb 13, 2020 at 3:16 PM Philippe Mathieu-Daudé
 wrote:
> On 2/13/20 2:59 PM, Peter Maydell wrote:
> > On Sat, 8 Feb 2020 at 16:57, Philippe Mathieu-Daudé  wrote:
> >>
> >> With the exception of the ignore_memory_transaction_failures
> >> flag set for the raspi2, both machine_class_init() methods
> >> are now identical. Merge them to keep a unique method.
> >>
> >> Signed-off-by: Philippe Mathieu-Daudé 
> >> ---
> >>   hw/arm/raspi.c | 31 ++-
> >>   1 file changed, 6 insertions(+), 25 deletions(-)
> >>
> >> diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
> >> index 0537fc0a2d..bee6ca0a08 100644
> >> --- a/hw/arm/raspi.c
> >> +++ b/hw/arm/raspi.c
> >> @@ -294,7 +294,7 @@ static void raspi_machine_init(MachineState *machine)
> >>   setup_boot(machine, version, machine->ram_size - vcram_size);
> >>   }
> >>
> >> -static void raspi2_machine_class_init(ObjectClass *oc, void *data)
> >> +static void raspi_machine_class_init(ObjectClass *oc, void *data)
> >>   {
> >>   MachineClass *mc = MACHINE_CLASS(oc);
> >>   RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
> >> @@ -311,41 +311,22 @@ static void raspi2_machine_class_init(ObjectClass 
> >> *oc, void *data)
> >>   mc->min_cpus = BCM283X_NCPUS;
> >>   mc->default_cpus = BCM283X_NCPUS;
> >>   mc->default_ram_size = board_ram_size(board_rev);
> >> -mc->ignore_memory_transaction_failures = true;
> >> +if (board_version(board_rev) == 2) {
> >> +mc->ignore_memory_transaction_failures = true;
> >> +}
> >>   };
> >
> > This isn't really the correct condition here. What we want is:
> >   * for the board named 'raspi2' which was introduced before
> > we added the transaction-failure support to Arm CPU emulation,
> > disable signaling transaction failures
> >   * for any other board, leave it enabled (whether that new
> > board is BCM2836 based or anything else)
> >
> > (This kind of follows on from my remark on patch 3: we should
> > be suspicious of anything that's conditional on board_version();
> > it should probably be testing something else.)
> >
> > The natural way to implement this is to have the .class_data
> > be a pointer to a struct which is in an array and defines
> > relevant per-class stuff, the same way we do in
> > bcm2836_register_types(). That way the struct can indicate
> > both the board revision number and also "is this a legacy
> > board that needs transaction-failures disabled?".
>
> IIUC Igor insists explaining that he doesn't accept anymore a
> ".class_data pointer to a struct which is in an array and defines
> relevant per-class stuff" and we should not use this pattern anymore.
>
> > The other approach here, as discussed on IRC, is that if
> > we're confident we really have all the devices in the SoC
> > either present or stubbed out with unimplemented-device
> > then we could disable ignore_memory_transaction_failures
> > for raspi2. (The flag is only there because I didn't want
> > to try to do the auditing and fielding of potential bug
> > reports if I changed the behaviour of a bunch of our
> > existing not-very-maintained board models: the real
> > correct behaviour in almost all cases would be to allow
> > transaction failures and just make sure we have stub devices
> > as needed.)
>
> Yes, the plan is to add all the unimplemented peripherals (patches
> ready, but out of scope of this series) and remove this flag.

I found my 'ready' patch, it is already merged as commit 00cbd5bd74b1 =)

hw/arm/bcm2835: Add various unimplemented peripherals

Base addresses and sizes taken from the "BCM2835 ARM Peripherals"
datasheet from February 06 2012:
https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

I'm successfully running U-boot and Linux on raspi0/1/2/3 so I guess
it is safe to remove ignore_memory_transaction_failures for the
raspi2.
It might be insufficient to run proprietary firmware (on the raspi2),
I have no idea if people use QEMU for that.

> > That said, this does give the right answer for our current boards,
> > so I'm ok with taking this series if you want to address this
> > in a followup patch.
>
> If you are OK, I prefer to address this in a later series than delaying
> this one more longer.
>
> Thanks!
>
>



[PATCH 07/12] hw/arm/bcm2836: Introduce BCM283XClass::core_count

2020-02-15 Thread Philippe Mathieu-Daudé
The BCM2835 has only one core. Introduce the core_count field to
be able to use values different than BCM283X_NCPUS (4).

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/bcm2836.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 683d04d6ea..3b95ad11e9 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -21,6 +21,7 @@ typedef struct BCM283XClass {
 DeviceClass parent_class;
 /*< public >*/
 const char *cpu_type;
+int core_count;
 hwaddr peri_base; /* Peripheral base address seen by the CPU */
 hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
 int clusterid;
@@ -37,7 +38,7 @@ static void bcm2836_init(Object *obj)
 BCM283XClass *bc = BCM283X_GET_CLASS(obj);
 int n;
 
-for (n = 0; n < BCM283X_NCPUS; n++) {
+for (n = 0; n < bc->core_count; n++) {
 object_initialize_child(obj, "cpu[*]", &s->cpu[n].core,
 sizeof(s->cpu[n].core), bc->cpu_type,
 &error_abort, NULL);
@@ -107,7 +108,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
 qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 
-for (n = 0; n < BCM283X_NCPUS; n++) {
+for (n = 0; n < bc->core_count; n++) {
 /* TODO: this should be converted to a property of ARM_CPU */
 s->cpu[n].core.mp_affinity = (bc->clusterid << 8) | n;
 
@@ -173,6 +174,7 @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 BCM283XClass *bc = BCM283X_CLASS(oc);
 
 bc->cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");
+bc->core_count = BCM283X_NCPUS;
 bc->peri_base = 0x3f00;
 bc->ctrl_base = 0x4000;
 bc->clusterid = 0xf;
@@ -187,6 +189,7 @@ static void bcm2837_class_init(ObjectClass *oc, void *data)
 BCM283XClass *bc = BCM283X_CLASS(oc);
 
 bc->cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
+bc->core_count = BCM283X_NCPUS;
 bc->peri_base = 0x3f00;
 bc->ctrl_base = 0x4000;
 bc->clusterid = 0x0;
-- 
2.21.1




[PATCH 02/12] hw/arm/raspi: Avoid using TypeInfo::class_data pointer

2020-02-15 Thread Philippe Mathieu-Daudé
Using class_data pointer to create a MachineClass is not
the recommended way anymore. The correct way is to open-code
the MachineClass::fields in the class_init() method.

This partly reverts commit a03bde3674e.

Suggested-by: Igor Mammedov 
Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/raspi.c | 32 ++--
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 221356933e..81cc5824c4 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -309,13 +309,9 @@ static void raspi_machine_init(MachineState *machine)
 setup_boot(machine, version, machine->ram_size - vcram_size);
 }
 
-static void raspi_machine_class_init(ObjectClass *oc, void *data)
+static void raspi_machine_class_common_init(MachineClass *mc,
+uint32_t board_rev)
 {
-MachineClass *mc = MACHINE_CLASS(oc);
-RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
-uint32_t board_rev = (uint32_t)(uintptr_t)data;
-
-rmc->board_rev = board_rev;
 mc->desc = g_strdup_printf("Raspberry Pi %s", board_type(board_rev));
 mc->init = raspi_machine_init;
 mc->block_default_type = IF_SD;
@@ -326,18 +322,34 @@ static void raspi_machine_class_init(ObjectClass *oc, 
void *data)
 mc->default_ram_size = board_ram_size(board_rev);
 };
 
+static void raspi2_machine_class_init(ObjectClass *oc, void *data)
+{
+RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+rmc->board_rev = 0xa21041;
+raspi_machine_class_common_init(MACHINE_CLASS(oc), rmc->board_rev);
+};
+
+#ifdef TARGET_AARCH64
+static void raspi3_machine_class_init(ObjectClass *oc, void *data)
+{
+RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+rmc->board_rev = 0xa02082;
+raspi_machine_class_common_init(MACHINE_CLASS(oc), rmc->board_rev);
+};
+#endif /* TARGET_AARCH64 */
+
 static const TypeInfo raspi_machine_types[] = {
 {
 .name   = MACHINE_TYPE_NAME("raspi2"),
 .parent = TYPE_RASPI_MACHINE,
-.class_init = raspi_machine_class_init,
-.class_data = (void *)0xa21041,
+.class_init = raspi2_machine_class_init,
 #ifdef TARGET_AARCH64
 }, {
 .name   = MACHINE_TYPE_NAME("raspi3"),
 .parent = TYPE_RASPI_MACHINE,
-.class_init = raspi_machine_class_init,
-.class_data = (void *)0xa02082,
+.class_init = raspi3_machine_class_init,
 #endif
 }, {
 .name   = TYPE_RASPI_MACHINE,
-- 
2.21.1




[PATCH 00/12] hw/arm: Add raspi0 and raspi1 machines

2020-02-15 Thread Philippe Mathieu-Daudé
This series addresses suggestions from Igor and Peter on the
raspi machines, then add the raspi0 and raspi1.

Philippe Mathieu-Daudé (12):
  hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
  hw/arm/raspi: Avoid using TypeInfo::class_data pointer
  hw/arm/raspi: Introduce RaspiProcessorId enum
  hw/arm/raspi: Remove use of the 'version' value in the board code
  hw/arm/bcm2836: Restrict BCM283XClass declaration to C source
  hw/arm/bcm2836: QOM'ify more by adding class_init() to each SoC type
  hw/arm/bcm2836: Introduce BCM283XClass::core_count
  hw/arm/bcm2836: Only provide "enabled-cpus" property to multicore SoCs
  hw/arm/bcm2836: Split out common realize() code
  hw/arm/bcm2836: Introduce the BCM2835 SoC
  hw/arm/raspi: Add the Raspberry Pi B+ machine
  hw/arm/raspi: Add the Raspberry Pi Zero machine

 include/hw/arm/bcm2836.h |  13 +--
 hw/arm/bcm2836.c | 192 ++-
 hw/arm/raspi.c   | 145 ++---
 3 files changed, 220 insertions(+), 130 deletions(-)

-- 
2.21.1




[PATCH 01/12] hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2

2020-02-15 Thread Philippe Mathieu-Daudé
Commit 1c3db49d39 added the raspi3, which uses the same peripherals
than the raspi2 (but with different ARM cores). The raspi3 was
introduced without the ignore_memory_transaction_failures flag.
Almost 2 years later, the machine is usable running U-Boot and
Linux.
In commit 00cbd5bd74 we mapped a lot of unimplemented devices,
commit d442d95f added thermal block and commit 0e5bbd7406 the
system timer.
As we are happy with the raspi3, let's remove this flag on the
raspi2.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/raspi.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 90ad9b8115..221356933e 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -324,9 +324,6 @@ static void raspi_machine_class_init(ObjectClass *oc, void 
*data)
 mc->no_cdrom = 1;
 mc->default_cpus = mc->min_cpus = mc->max_cpus = cores_count(board_rev);
 mc->default_ram_size = board_ram_size(board_rev);
-if (board_version(board_rev) == 2) {
-mc->ignore_memory_transaction_failures = true;
-}
 };
 
 static const TypeInfo raspi_machine_types[] = {
-- 
2.21.1




[PATCH 03/12] hw/arm/raspi: Introduce RaspiProcessorId enum

2020-02-15 Thread Philippe Mathieu-Daudé
As we only support a reduced set of the REV_CODE_PROCESSOR id
encoded in the board revision, define the PROCESSOR_ID values
as an enum. We can simplify the board_soc_type and cores_count
methods.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/raspi.c | 45 +
 1 file changed, 21 insertions(+), 24 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 81cc5824c4..aa0a7e6276 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -69,16 +69,33 @@ FIELD(REV_CODE, MANUFACTURER,  16, 4);
 FIELD(REV_CODE, MEMORY_SIZE,   20, 3);
 FIELD(REV_CODE, STYLE, 23, 1);
 
+typedef enum RaspiProcessorId {
+PROCESSOR_ID_BCM2836 = 1,
+PROCESSOR_ID_BCM2837 = 2,
+} RaspiProcessorId;
+
+static const struct {
+const char *type;
+int cores_count;
+} soc_property[] = {
+[PROCESSOR_ID_BCM2836] = {TYPE_BCM2836, BCM283X_NCPUS},
+[PROCESSOR_ID_BCM2837] = {TYPE_BCM2837, BCM283X_NCPUS},
+};
+
 static uint64_t board_ram_size(uint32_t board_rev)
 {
 assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
 return 256 * MiB << FIELD_EX32(board_rev, REV_CODE, MEMORY_SIZE);
 }
 
-static int board_processor_id(uint32_t board_rev)
+static RaspiProcessorId board_processor_id(uint32_t board_rev)
 {
+int proc_id = FIELD_EX32(board_rev, REV_CODE, PROCESSOR);;
+
 assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
-return FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
+assert(proc_id < ARRAY_SIZE(soc_property) && soc_property[proc_id].type);
+
+return proc_id;
 }
 
 static int board_version(uint32_t board_rev)
@@ -88,32 +105,12 @@ static int board_version(uint32_t board_rev)
 
 static const char *board_soc_type(uint32_t board_rev)
 {
-static const char *soc_types[] = {
-NULL, TYPE_BCM2836, TYPE_BCM2837,
-};
-int proc_id = board_processor_id(board_rev);
-
-if (proc_id >= ARRAY_SIZE(soc_types) || !soc_types[proc_id]) {
-error_report("Unsupported processor id '%d' (board revision: 0x%x)",
- proc_id, board_rev);
-exit(1);
-}
-return soc_types[proc_id];
+return soc_property[board_processor_id(board_rev)].type;
 }
 
 static int cores_count(uint32_t board_rev)
 {
-static const int soc_cores_count[] = {
-0, BCM283X_NCPUS, BCM283X_NCPUS,
-};
-int proc_id = board_processor_id(board_rev);
-
-if (proc_id >= ARRAY_SIZE(soc_cores_count) || !soc_cores_count[proc_id]) {
-error_report("Unsupported processor id '%d' (board revision: 0x%x)",
- proc_id, board_rev);
-exit(1);
-}
-return soc_cores_count[proc_id];
+return soc_property[board_processor_id(board_rev)].cores_count;
 }
 
 static const char *board_type(uint32_t board_rev)
-- 
2.21.1




[PATCH 08/12] hw/arm/bcm2836: Only provide "enabled-cpus" property to multicore SoCs

2020-02-15 Thread Philippe Mathieu-Daudé
It makes no sense to set enabled-cpus=0 on single core SoCs.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/bcm2836.c | 15 +++
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 3b95ad11e9..caaa4b625e 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -32,6 +32,9 @@ typedef struct BCM283XClass {
 #define BCM283X_GET_CLASS(obj) \
 OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
 
+static Property bcm2836_enabled_cores_property =
+DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus, 0);
+
 static void bcm2836_init(Object *obj)
 {
 BCM283XState *s = BCM283X(obj);
@@ -43,6 +46,10 @@ static void bcm2836_init(Object *obj)
 sizeof(s->cpu[n].core), bc->cpu_type,
 &error_abort, NULL);
 }
+if (bc->core_count) {
+qdev_property_add_static(DEVICE(obj), &bcm2836_enabled_cores_property);
+qdev_prop_set_uint32(DEVICE(obj), "enabled-cpus", bc->core_count);
+}
 
 sysbus_init_child_obj(obj, "control", &s->control, sizeof(s->control),
   TYPE_BCM2836_CONTROL);
@@ -154,12 +161,6 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 }
 
-static Property bcm2836_props[] = {
-DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
-   BCM283X_NCPUS),
-DEFINE_PROP_END_OF_LIST()
-};
-
 static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
 DeviceClass *dc = DEVICE_CLASS(oc);
@@ -179,7 +180,6 @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 bc->ctrl_base = 0x4000;
 bc->clusterid = 0xf;
 dc->realize = bcm2836_realize;
-device_class_set_props(dc, bcm2836_props);
 };
 
 #ifdef TARGET_AARCH64
@@ -194,7 +194,6 @@ static void bcm2837_class_init(ObjectClass *oc, void *data)
 bc->ctrl_base = 0x4000;
 bc->clusterid = 0x0;
 dc->realize = bcm2836_realize;
-device_class_set_props(dc, bcm2836_props);
 };
 #endif
 
-- 
2.21.1




[PATCH 04/12] hw/arm/raspi: Remove use of the 'version' value in the board code

2020-02-15 Thread Philippe Mathieu-Daudé
We expected the 'version' ID to match the board processor ID,
but this is not always true (for example boards with revision
id 0xa02042/0xa22042 are Raspberry Pi 2 with a BCM2837 SoC).
This was not important because we were not modelling them, but
since the recent refactor now allow to model these boards, it
is safer to check the processor id directly. Remove the version
check.

Suggested-by: Peter Maydell 
Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/raspi.c | 37 -
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index aa0a7e6276..38829195c5 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -98,11 +98,6 @@ static RaspiProcessorId board_processor_id(uint32_t 
board_rev)
 return proc_id;
 }
 
-static int board_version(uint32_t board_rev)
-{
-return board_processor_id(board_rev) + 1;
-}
-
 static const char *board_soc_type(uint32_t board_rev)
 {
 return soc_property[board_processor_id(board_rev)].type;
@@ -201,7 +196,8 @@ static void reset_secondary(ARMCPU *cpu, const struct 
arm_boot_info *info)
 cpu_set_pc(cs, info->smp_loader_start);
 }
 
-static void setup_boot(MachineState *machine, int version, size_t ram_size)
+static void setup_boot(MachineState *machine, RaspiProcessorId processor_id,
+   size_t ram_size)
 {
 static struct arm_boot_info binfo;
 int r;
@@ -210,12 +206,13 @@ static void setup_boot(MachineState *machine, int 
version, size_t ram_size)
 binfo.ram_size = ram_size;
 binfo.nb_cpus = machine->smp.cpus;
 
-if (version <= 2) {
-/* The rpi1 and 2 require some custom setup code to run in Secure
- * mode before booting a kernel (to set up the SMC vectors so
- * that we get a no-op SMC; this is used by Linux to call the
+if (processor_id <= PROCESSOR_ID_BCM2836) {
+/*
+ * The BCM2835 and BCM2836 require some custom setup code to run
+ * in Secure mode before booting a kernel (to set up the SMC vectors
+ * so that we get a no-op SMC; this is used by Linux to call the
  * firmware for some cache maintenance operations.
- * The rpi3 doesn't need this.
+ * The BCM2837 doesn't need this.
  */
 binfo.board_setup_addr = BOARDSETUP_ADDR;
 binfo.write_board_setup = write_board_setup;
@@ -223,10 +220,10 @@ static void setup_boot(MachineState *machine, int 
version, size_t ram_size)
 binfo.secure_boot = true;
 }
 
-/* Pi2 and Pi3 requires SMP setup */
-if (version >= 2) {
+/* BCM2836 and BCM2837 requires SMP setup */
+if (processor_id >= PROCESSOR_ID_BCM2836) {
 binfo.smp_loader_start = SMPBOOT_ADDR;
-if (version == 2) {
+if (processor_id == PROCESSOR_ID_BCM2836) {
 binfo.write_secondary_boot = write_smpboot;
 } else {
 binfo.write_secondary_boot = write_smpboot64;
@@ -238,7 +235,13 @@ static void setup_boot(MachineState *machine, int version, 
size_t ram_size)
  * the normal Linux boot process
  */
 if (machine->firmware) {
-hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : 
FIRMWARE_ADDR_2;
+hwaddr firmware_addr;
+
+if (processor_id == PROCESSOR_ID_BCM2837) {
+firmware_addr = FIRMWARE_ADDR_3;
+} else {
+firmware_addr = FIRMWARE_ADDR_2;
+}
 /* load the firmware image (typically kernel.img) */
 r = load_image_targphys(machine->firmware, firmware_addr,
 ram_size - firmware_addr);
@@ -259,7 +262,6 @@ static void raspi_machine_init(MachineState *machine)
 RaspiMachineClass *mc = RASPI_MACHINE_GET_CLASS(machine);
 RaspiMachineState *s = RASPI_MACHINE(machine);
 uint32_t board_rev = mc->board_rev;
-int version = board_version(board_rev);
 uint64_t ram_size = board_ram_size(board_rev);
 uint32_t vcram_size;
 DriveInfo *di;
@@ -303,7 +305,8 @@ static void raspi_machine_init(MachineState *machine)
 
 vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",
   &error_abort);
-setup_boot(machine, version, machine->ram_size - vcram_size);
+setup_boot(machine, board_processor_id(mc->board_rev),
+   machine->ram_size - vcram_size);
 }
 
 static void raspi_machine_class_common_init(MachineClass *mc,
-- 
2.21.1




[PATCH 05/12] hw/arm/bcm2836: Restrict BCM283XClass declaration to C source

2020-02-15 Thread Philippe Mathieu-Daudé
No code out of bcm2836.c uses (or requires) this declarations.
Move it locally to the C source file.

Signed-off-by: Philippe Mathieu-Daudé 
---
 include/hw/arm/bcm2836.h | 12 
 hw/arm/bcm2836.c | 14 ++
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index 92a6544816..acc75bf553 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -42,16 +42,4 @@ typedef struct BCM283XState {
 BCM2835PeripheralState peripherals;
 } BCM283XState;
 
-typedef struct BCM283XInfo BCM283XInfo;
-
-typedef struct BCM283XClass {
-DeviceClass parent_class;
-const BCM283XInfo *info;
-} BCM283XClass;
-
-#define BCM283X_CLASS(klass) \
-OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
-#define BCM283X_GET_CLASS(obj) \
-OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
-
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 38e2941bab..24109fef1d 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -16,6 +16,15 @@
 #include "hw/arm/raspi_platform.h"
 #include "hw/sysbus.h"
 
+typedef struct BCM283XInfo BCM283XInfo;
+
+typedef struct BCM283XClass {
+/*< private >*/
+DeviceClass parent_class;
+/*< public >*/
+const BCM283XInfo *info;
+} BCM283XClass;
+
 struct BCM283XInfo {
 const char *name;
 const char *cpu_type;
@@ -24,6 +33,11 @@ struct BCM283XInfo {
 int clusterid;
 };
 
+#define BCM283X_CLASS(klass) \
+OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
+#define BCM283X_GET_CLASS(obj) \
+OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
+
 static const BCM283XInfo bcm283x_socs[] = {
 {
 .name = TYPE_BCM2836,
-- 
2.21.1




[PATCH 06/12] hw/arm/bcm2836: QOM'ify more by adding class_init() to each SoC type

2020-02-15 Thread Philippe Mathieu-Daudé
Remove usage of TypeInfo::class_data. Instead fill the fields in
the corresponding class_init().

Cc: Igor Mammedov 
Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/bcm2836.c | 109 ++-
 1 file changed, 51 insertions(+), 58 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 24109fef1d..683d04d6ea 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -16,57 +16,30 @@
 #include "hw/arm/raspi_platform.h"
 #include "hw/sysbus.h"
 
-typedef struct BCM283XInfo BCM283XInfo;
-
 typedef struct BCM283XClass {
 /*< private >*/
 DeviceClass parent_class;
 /*< public >*/
-const BCM283XInfo *info;
-} BCM283XClass;
-
-struct BCM283XInfo {
-const char *name;
 const char *cpu_type;
 hwaddr peri_base; /* Peripheral base address seen by the CPU */
 hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
 int clusterid;
-};
+} BCM283XClass;
 
 #define BCM283X_CLASS(klass) \
 OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
 #define BCM283X_GET_CLASS(obj) \
 OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
 
-static const BCM283XInfo bcm283x_socs[] = {
-{
-.name = TYPE_BCM2836,
-.cpu_type = ARM_CPU_TYPE_NAME("cortex-a7"),
-.peri_base = 0x3f00,
-.ctrl_base = 0x4000,
-.clusterid = 0xf,
-},
-#ifdef TARGET_AARCH64
-{
-.name = TYPE_BCM2837,
-.cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
-.peri_base = 0x3f00,
-.ctrl_base = 0x4000,
-.clusterid = 0x0,
-},
-#endif
-};
-
 static void bcm2836_init(Object *obj)
 {
 BCM283XState *s = BCM283X(obj);
 BCM283XClass *bc = BCM283X_GET_CLASS(obj);
-const BCM283XInfo *info = bc->info;
 int n;
 
 for (n = 0; n < BCM283X_NCPUS; n++) {
 object_initialize_child(obj, "cpu[*]", &s->cpu[n].core,
-sizeof(s->cpu[n].core), info->cpu_type,
+sizeof(s->cpu[n].core), bc->cpu_type,
 &error_abort, NULL);
 }
 
@@ -85,7 +58,6 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
 BCM283XState *s = BCM283X(dev);
 BCM283XClass *bc = BCM283X_GET_CLASS(dev);
-const BCM283XInfo *info = bc->info;
 Object *obj;
 Error *err = NULL;
 int n;
@@ -119,7 +91,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->peripherals), 0,
-info->peri_base, 1);
+bc->peri_base, 1);
 
 /* bcm2836 interrupt controller (and mailboxes, etc.) */
 object_property_set_bool(OBJECT(&s->control), true, "realized", &err);
@@ -128,7 +100,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 return;
 }
 
-sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, info->ctrl_base);
+sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, bc->ctrl_base);
 
 sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 0,
 qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-irq", 0));
@@ -137,11 +109,11 @@ static void bcm2836_realize(DeviceState *dev, Error 
**errp)
 
 for (n = 0; n < BCM283X_NCPUS; n++) {
 /* TODO: this should be converted to a property of ARM_CPU */
-s->cpu[n].core.mp_affinity = (info->clusterid << 8) | n;
+s->cpu[n].core.mp_affinity = (bc->clusterid << 8) | n;
 
 /* set periphbase/CBAR value for CPU-local registers */
 object_property_set_int(OBJECT(&s->cpu[n].core),
-info->peri_base,
+bc->peri_base,
 "reset-cbar", &err);
 if (err) {
 error_propagate(errp, err);
@@ -190,38 +162,59 @@ static Property bcm2836_props[] = {
 static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
 DeviceClass *dc = DEVICE_CLASS(oc);
-BCM283XClass *bc = BCM283X_CLASS(oc);
 
-bc->info = data;
-dc->realize = bcm2836_realize;
-device_class_set_props(dc, bcm2836_props);
 /* Reason: Must be wired up in code (see raspi_init() function) */
 dc->user_creatable = false;
 }
 
-static const TypeInfo bcm283x_type_info = {
-.name = TYPE_BCM283X,
-.parent = TYPE_DEVICE,
-.instance_size = sizeof(BCM283XState),
-.instance_init = bcm2836_init,
-.class_size = sizeof(BCM283XClass),
-.abstract = true,
+static void bcm2836_class_init(ObjectClass *oc, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(oc);
+BCM283XClass *bc = BCM283X_CLASS(oc);
+
+bc->cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");
+bc->peri_base = 0x3f00;
+bc->ctrl_base = 0x4000;
+bc->clusterid = 0xf;
+dc->realize = bcm2836_realize;
+device_class_set_props(dc, bcm2836_props);
 };
 
-static void bcm2836_register_types(void)
+#ifdef TARGET_AARCH64
+static void bcm2837_class_init(ObjectClass *oc, void *data)
 {
-int i;
+Device

[PATCH 12/12] hw/arm/raspi: Add the Raspberry Pi Zero machine

2020-02-15 Thread Philippe Mathieu-Daudé
Add a Raspberry Pi Zero machine.

  $ qemu-system-arm -M raspi0 -serial stdio \
  -kernel raspberrypi/firmware/boot/kernel.img \
  -dtb raspberrypi/firmware/boot/bcm2708-rpi-zero-w.dtb \
  -append 'printk.time=0 earlycon=pl011,0x20201000 console=ttyAMA0'
  [0.00] Booting Linux on physical CPU 0x0
  [0.00] Linux version 4.19.69+ (dom@buildbot) (gcc version 4.9.3 
(crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1261 Tue Sep 3 20:21:01 BST 
2019
  [0.00] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), 
cr=00c5387d
  [0.00] CPU: VIPT aliasing data cache, unknown instruction cache
  [0.00] OF: fdt: Machine model: Raspberry Pi Zero W
  [0.00] earlycon: pl11 at MMIO 0x20201000 (options '')
  [0.00] bootconsole [pl11] enabled
  [0.00] Memory policy: Data cache writeback
  [0.00] cma: Reserved 8 MiB at 0x1b80
  [0.00] random: get_random_bytes called from start_kernel+0x8c/0x49c 
with crng_init=0
  [0.00] Built 1 zonelists, mobility grouping on.  Total pages: 113680
  [0.00] Kernel command line: printk.time=0 earlycon=pl011,0x20201000 
console=ttyAMA0 root=/dev/mmcblk0 rootwait
  Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
  Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
  Memory: 434380K/458752K available (6971K kernel code, 635K rwdata, 2080K 
rodata, 464K init, 797K bss, 16180K reserved, 8192K cma-reserved)
  Virtual kernel memory layout:
  vector  : 0x - 0x1000   (   4 kB)
  fixmap  : 0xffc0 - 0xfff0   (3072 kB)
  vmalloc : 0xdc80 - 0xff80   ( 560 MB)
  lowmem  : 0xc000 - 0xdc00   ( 448 MB)
  modules : 0xbf00 - 0xc000   (  16 MB)
.text : 0x(ptrval) - 0x(ptrval)   (6973 kB)
.init : 0x(ptrval) - 0x(ptrval)   ( 464 kB)
.data : 0x(ptrval) - 0x(ptrval)   ( 636 kB)
 .bss : 0x(ptrval) - 0x(ptrval)   ( 798 kB)
  SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
  ftrace: allocating 25193 entries in 74 pages
  NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
  sched_clock: 32 bits at 1000kHz, resolution 1000ns, wraps every 
2147483647500ns
  clocksource: timer: mask: 0x max_cycles: 0x, max_idle_ns: 
1911260446275 ns
  bcm2835: system timer (irq = 27)
  Console: colour dummy device 80x30
  ...

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/raspi.c | 13 +
 1 file changed, 13 insertions(+)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 7f7d0ee926..68114de173 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -324,6 +324,15 @@ static void raspi_machine_class_common_init(MachineClass 
*mc,
 mc->default_ram_size = board_ram_size(board_rev);
 };
 
+static void raspi0_machine_class_init(ObjectClass *oc, void *data)
+{
+MachineClass *mc = MACHINE_CLASS(oc);
+RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+rmc->board_rev = 0x9000c1;
+raspi_machine_class_common_init(mc, rmc->board_rev);
+};
+
 static void raspi1_machine_class_init(ObjectClass *oc, void *data)
 {
 MachineClass *mc = MACHINE_CLASS(oc);
@@ -353,6 +362,10 @@ static void raspi3_machine_class_init(ObjectClass *oc, 
void *data)
 
 static const TypeInfo raspi_machine_types[] = {
 {
+.name   = MACHINE_TYPE_NAME("raspi0"),
+.parent = TYPE_RASPI_MACHINE,
+.class_init = raspi0_machine_class_init,
+}, {
 .name   = MACHINE_TYPE_NAME("raspi1"),
 .parent = TYPE_RASPI_MACHINE,
 .class_init = raspi1_machine_class_init,
-- 
2.21.1




[PATCH 09/12] hw/arm/bcm2836: Split out common realize() code

2020-02-15 Thread Philippe Mathieu-Daudé
The realize() function is clearly composed of two parts,
each described by a comment:

  void realize()
  {
 /* common peripherals from bcm2835 */
 ...
 /* bcm2836 interrupt controller (and mailboxes, etc.) */
 ...
   }

Split the two part, so we can reuse the common part with other
SoCs from this family.

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/bcm2836.c | 23 +++
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index caaa4b625e..2b6fe31139 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -51,8 +51,10 @@ static void bcm2836_init(Object *obj)
 qdev_prop_set_uint32(DEVICE(obj), "enabled-cpus", bc->core_count);
 }
 
-sysbus_init_child_obj(obj, "control", &s->control, sizeof(s->control),
-  TYPE_BCM2836_CONTROL);
+if (bc->ctrl_base) {
+sysbus_init_child_obj(obj, "control", &s->control,
+  sizeof(s->control), TYPE_BCM2836_CONTROL);
+}
 
 sysbus_init_child_obj(obj, "peripherals", &s->peripherals,
   sizeof(s->peripherals), TYPE_BCM2835_PERIPHERALS);
@@ -62,13 +64,12 @@ static void bcm2836_init(Object *obj)
   "vcram-size", &error_abort);
 }
 
-static void bcm2836_realize(DeviceState *dev, Error **errp)
+static void bcm283x_common_realize(DeviceState *dev, Error **errp)
 {
 BCM283XState *s = BCM283X(dev);
 BCM283XClass *bc = BCM283X_GET_CLASS(dev);
 Object *obj;
 Error *err = NULL;
-int n;
 
 /* common peripherals from bcm2835 */
 
@@ -100,6 +101,20 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
 sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->peripherals), 0,
 bc->peri_base, 1);
+}
+
+static void bcm2836_realize(DeviceState *dev, Error **errp)
+{
+BCM283XState *s = BCM283X(dev);
+BCM283XClass *bc = BCM283X_GET_CLASS(dev);
+Error *err = NULL;
+int n;
+
+bcm283x_common_realize(dev, &err);
+if (err) {
+error_propagate(errp, err);
+return;
+}
 
 /* bcm2836 interrupt controller (and mailboxes, etc.) */
 object_property_set_bool(OBJECT(&s->control), true, "realized", &err);
-- 
2.21.1




[PATCH 11/12] hw/arm/raspi: Add the Raspberry Pi B+ machine

2020-02-15 Thread Philippe Mathieu-Daudé
  $ qemu-system-arm -M raspi1 -serial stdio \
  -kernel raspberrypi/firmware/boot/kernel.img \
  -dtb raspberrypi/firmware/boot/bcm2708-rpi-b.dtb \
  -append 'printk.time=0 earlycon=pl011,0x20201000 console=ttyAMA0'
  [0.00] Booting Linux on physical CPU 0x0
  [0.00] Linux version 4.19.69+ (dom@buildbot) (gcc version 4.9.3 
(crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1261 Tue Sep 3 20:21:01 BST 
2019
  [0.00] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), 
cr=00c5387d
  [0.00] CPU: VIPT aliasing data cache, unknown instruction cache
  [0.00] OF: fdt: Machine model: Raspberry Pi Model B
  [0.00] earlycon: pl11 at MMIO 0x20201000 (options '')
  [0.00] bootconsole [pl11] enabled
  [0.00] Memory policy: Data cache writeback
  [0.00] cma: Reserved 8 MiB at 0x1b80
  [0.00] random: get_random_bytes called from start_kernel+0x8c/0x49c 
with crng_init=0
  [0.00] Built 1 zonelists, mobility grouping on.  Total pages: 113680
  [0.00] Kernel command line: printk.time=0 earlycon=pl011,0x20201000 
console=ttyAMA0
  Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
  Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
  Memory: 434380K/458752K available (6971K kernel code, 635K rwdata, 2080K 
rodata, 464K init, 797K bss, 16180K reserved, 8192K cma-reserved)
  ...

Signed-off-by: Philippe Mathieu-Daudé 
---
 hw/arm/raspi.c | 13 +
 1 file changed, 13 insertions(+)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 6db2bf5bbe..7f7d0ee926 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -324,6 +324,15 @@ static void raspi_machine_class_common_init(MachineClass 
*mc,
 mc->default_ram_size = board_ram_size(board_rev);
 };
 
+static void raspi1_machine_class_init(ObjectClass *oc, void *data)
+{
+MachineClass *mc = MACHINE_CLASS(oc);
+RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+rmc->board_rev = 0x900032;
+raspi_machine_class_common_init(mc, rmc->board_rev);
+};
+
 static void raspi2_machine_class_init(ObjectClass *oc, void *data)
 {
 RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
@@ -344,6 +353,10 @@ static void raspi3_machine_class_init(ObjectClass *oc, 
void *data)
 
 static const TypeInfo raspi_machine_types[] = {
 {
+.name   = MACHINE_TYPE_NAME("raspi1"),
+.parent = TYPE_RASPI_MACHINE,
+.class_init = raspi1_machine_class_init,
+}, {
 .name   = MACHINE_TYPE_NAME("raspi2"),
 .parent = TYPE_RASPI_MACHINE,
 .class_init = raspi2_machine_class_init,
-- 
2.21.1




[PATCH 10/12] hw/arm/bcm2836: Introduce the BCM2835 SoC

2020-02-15 Thread Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé 
---
 include/hw/arm/bcm2836.h |  1 +
 hw/arm/bcm2836.c | 40 
 hw/arm/raspi.c   |  2 ++
 3 files changed, 43 insertions(+)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index acc75bf553..3d46469a73 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -24,6 +24,7 @@
  * them, code using these devices should always handle them via the
  * BCM283x base class, so they have no BCM2836(obj) etc macros.
  */
+#define TYPE_BCM2835 "bcm2835"
 #define TYPE_BCM2836 "bcm2836"
 #define TYPE_BCM2837 "bcm2837"
 
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 2b6fe31139..bce5f8a866 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -103,6 +103,31 @@ static void bcm283x_common_realize(DeviceState *dev, Error 
**errp)
 bc->peri_base, 1);
 }
 
+static void bcm2835_realize(DeviceState *dev, Error **errp)
+{
+BCM283XState *s = BCM283X(dev);
+Error *err = NULL;
+
+bcm283x_common_realize(dev, &err);
+if (err) {
+error_propagate(errp, err);
+return;
+}
+
+object_property_set_bool(OBJECT(&s->cpu[0].core), true,
+ "realized", &err);
+if (err) {
+error_propagate(errp, err);
+return;
+}
+
+/* Connect irq/fiq outputs from the interrupt controller. */
+sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 0,
+qdev_get_gpio_in(DEVICE(&s->cpu[0].core), ARM_CPU_IRQ));
+sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
+qdev_get_gpio_in(DEVICE(&s->cpu[0].core), ARM_CPU_FIQ));
+}
+
 static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
 BCM283XState *s = BCM283X(dev);
@@ -184,6 +209,17 @@ static void bcm283x_class_init(ObjectClass *oc, void *data)
 dc->user_creatable = false;
 }
 
+static void bcm2835_class_init(ObjectClass *oc, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(oc);
+BCM283XClass *bc = BCM283X_CLASS(oc);
+
+bc->cpu_type = ARM_CPU_TYPE_NAME("arm1176");
+bc->core_count = 1;
+bc->peri_base = 0x2000;
+dc->realize = bcm2835_realize;
+};
+
 static void bcm2836_class_init(ObjectClass *oc, void *data)
 {
 DeviceClass *dc = DEVICE_CLASS(oc);
@@ -214,6 +250,10 @@ static void bcm2837_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo bcm283x_types[] = {
 {
+.name   = TYPE_BCM2835,
+.parent = TYPE_BCM283X,
+.class_init = bcm2835_class_init,
+}, {
 .name   = TYPE_BCM2836,
 .parent = TYPE_BCM283X,
 .class_init = bcm2836_class_init,
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 38829195c5..6db2bf5bbe 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -70,6 +70,7 @@ FIELD(REV_CODE, MEMORY_SIZE,   20, 3);
 FIELD(REV_CODE, STYLE, 23, 1);
 
 typedef enum RaspiProcessorId {
+PROCESSOR_ID_BCM2835 = 0,
 PROCESSOR_ID_BCM2836 = 1,
 PROCESSOR_ID_BCM2837 = 2,
 } RaspiProcessorId;
@@ -78,6 +79,7 @@ static const struct {
 const char *type;
 int cores_count;
 } soc_property[] = {
+[PROCESSOR_ID_BCM2835] = {TYPE_BCM2835, 1},
 [PROCESSOR_ID_BCM2836] = {TYPE_BCM2836, BCM283X_NCPUS},
 [PROCESSOR_ID_BCM2837] = {TYPE_BCM2837, BCM283X_NCPUS},
 };
-- 
2.21.1




[PATCH 1/8] tests/acceptance/boot_linux_console: Use raspi console model as key

2020-02-15 Thread Philippe Mathieu-Daudé
Python dictionary are not that expensive. Use a key makes the
code easier to review.

Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/acceptance/boot_linux_console.py | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 34d37eba3b..8cfc758d42 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -347,14 +347,14 @@ def test_arm_emcraft_sf2(self):
 self.vm.launch()
 self.wait_for_console_pattern('init started: BusyBox')
 
-def do_test_arm_raspi2(self, uart_id):
+def do_test_arm_raspi2(self, uart_model):
 """
 The kernel can be rebuilt using the kernel source referenced
 and following the instructions on the on:
 https://www.raspberrypi.org/documentation/linux/kernel/building.md
 """
 serial_kernel_cmdline = {
-0: 'earlycon=pl011,0x3f201000 console=ttyAMA0',
+'pl011': 'earlycon=pl011,0x3f201000 console=ttyAMA0',
 }
 deb_url = ('http://archive.raspberrypi.org/debian/'
'pool/main/r/raspberrypi-firmware/'
@@ -366,7 +366,7 @@ def do_test_arm_raspi2(self, uart_id):
 
 self.vm.set_console()
 kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-   serial_kernel_cmdline[uart_id])
+   serial_kernel_cmdline[uart_model])
 self.vm.add_args('-kernel', kernel_path,
  '-dtb', dtb_path,
  '-append', kernel_command_line)
@@ -380,7 +380,7 @@ def test_arm_raspi2_uart0(self):
 :avocado: tags=machine:raspi2
 :avocado: tags=device:pl011
 """
-self.do_test_arm_raspi2(0)
+self.do_test_arm_raspi2('pl011')
 
 def test_arm_exynos4210_initrd(self):
 """
-- 
2.21.1




[PATCH 2/8] tests/acceptance/boot_linux_console: Add raspi version=2 parameter

2020-02-15 Thread Philippe Mathieu-Daudé
We want to tests different Raspberry Pi machines. Refactor to
take the board version as argument.

Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/acceptance/boot_linux_console.py | 21 +++--
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 8cfc758d42..a1b6e70d3f 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -347,26 +347,34 @@ def test_arm_emcraft_sf2(self):
 self.vm.launch()
 self.wait_for_console_pattern('init started: BusyBox')
 
-def do_test_arm_raspi2(self, uart_model):
+def do_test_arm_raspi(self, version, uart_model):
 """
 The kernel can be rebuilt using the kernel source referenced
 and following the instructions on the on:
 https://www.raspberrypi.org/documentation/linux/kernel/building.md
 """
 serial_kernel_cmdline = {
-'pl011': 'earlycon=pl011,0x3f201000 console=ttyAMA0',
+'pl011': {
+2: 'earlycon=pl011,0x3f201000 console=ttyAMA0',
+},
+}
+kernel = {
+2: '/boot/kernel7.img',
+}
+dtb = {
+2: '/boot/bcm2709-rpi-2-b.dtb',
 }
 deb_url = ('http://archive.raspberrypi.org/debian/'
'pool/main/r/raspberrypi-firmware/'
'raspberrypi-kernel_1.20190215-1_armhf.deb')
 deb_hash = 'cd284220b32128c5084037553db3c482426f3972'
 deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-kernel_path = self.extract_from_deb(deb_path, '/boot/kernel7.img')
-dtb_path = self.extract_from_deb(deb_path, '/boot/bcm2709-rpi-2-b.dtb')
+kernel_path = self.extract_from_deb(deb_path, kernel[version])
+dtb_path = self.extract_from_deb(deb_path, dtb[version])
 
 self.vm.set_console()
 kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-   serial_kernel_cmdline[uart_model])
+   serial_kernel_cmdline[uart_model][version])
 self.vm.add_args('-kernel', kernel_path,
  '-dtb', dtb_path,
  '-append', kernel_command_line)
@@ -378,9 +386,10 @@ def test_arm_raspi2_uart0(self):
 """
 :avocado: tags=arch:arm
 :avocado: tags=machine:raspi2
+:avocado: tags=cpu:cortex-a7
 :avocado: tags=device:pl011
 """
-self.do_test_arm_raspi2('pl011')
+self.do_test_arm_raspi(2, 'pl011')
 
 def test_arm_exynos4210_initrd(self):
 """
-- 
2.21.1




[PATCH 0/8] hw/arm: Add raspi[0123] acceptance tests

2020-02-15 Thread Philippe Mathieu-Daudé
- Add raspi0/raspi1 Linux boot tests
- Add raspi2/raspi3 U-Boot tests
- Add bcm2835 framebuffer test

I'll send another series moving these tests from boot_linux_console.py
to machine_arm_raspi.py, but this doesn't affect the review.

raspi0/raspi1 are based on "hw/arm: Add raspi0 and raspi1 machines".
Based-on: <20200215191543.3235-1-f4...@amsat.org>

Philippe Mathieu-Daudé (8):
  tests/acceptance/boot_linux_console: Use raspi console model as key
  tests/acceptance/boot_linux_console: Add raspi version=2 parameter
  tests/acceptance/boot_linux_console: Test the raspi1 console
  tests/acceptance/boot_linux_console: Test the raspi0 console
  tests/acceptance/boot_linux_console: Test the raspi1 AUX console
  tests/boot_linux_console: Test booting U-Boot on the Raspberry Pi 2
  tests/boot_linux_console: Test booting U-Boot on the Raspberry Pi 3
  tests/acceptance: Count Raspberry Pi logos displayed on framebuffer

 tests/acceptance/boot_linux_console.py | 207 +++--
 1 file changed, 195 insertions(+), 12 deletions(-)

-- 
2.21.1




[PATCH 4/8] tests/acceptance/boot_linux_console: Test the raspi0 console

2020-02-15 Thread Philippe Mathieu-Daudé
  $ avocado --show=app,console run -t machine:raspi0 tests/acceptance/
  JOB ID : af8e017486290758bff39c986934134199af3556
  JOB LOG: avocado/job-results/job-2020-02-05T23.53-af8e017/job.log
   (1/1) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi0_uart0:
  console: [0.00] Booting Linux on physical CPU 0x0
  console: [0.00] Linux version 4.14.98+ (dom@dom-XPS-13-9370) (gcc 
version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1200 Tue Feb 12 
20:11:02 GMT 2019
  console: [0.00] CPU: ARMv6-compatible processor [410fb767] revision 7 
(ARMv7), cr=00c5387d
  console: [0.00] CPU: VIPT aliasing data cache, unknown instruction 
cache
  console: [0.00] OF: fdt: Machine model: Raspberry Pi Zero W
  console: [0.00] earlycon: pl11 at MMIO 0x20201000 (options '')
  console: [0.00] bootconsole [pl11] enabled
  console: [0.00] Memory policy: Data cache writeback
  console: [0.00] cma: Reserved 8 MiB at 0x1b80
  console: [0.00] Built 1 zonelists, mobility grouping on.  Total 
pages: 113680
  console: [0.00] Kernel command line: printk.time=0 
earlycon=pl011,0x20201000 console=ttyAMA0
  PASS (12.59 s)
  RESULTS: PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | 
CANCEL 0
  JOB TIME   : 12.88 s

Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/acceptance/boot_linux_console.py | 12 
 1 file changed, 12 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index c8eabae695..bd3f0fc852 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -355,15 +355,18 @@ def do_test_arm_raspi(self, version, uart_model):
 """
 serial_kernel_cmdline = {
 'pl011': {
+0: 'earlycon=pl011,0x20201000 console=ttyAMA0',
 1: 'earlycon=pl011,0x20201000 console=ttyAMA0',
 2: 'earlycon=pl011,0x3f201000 console=ttyAMA0',
 },
 }
 kernel = {
+0: '/boot/kernel.img',
 1: '/boot/kernel.img',
 2: '/boot/kernel7.img',
 }
 dtb = {
+0: '/boot/bcm2708-rpi-0-w.dtb',
 1: '/boot/bcm2708-rpi-b.dtb',
 2: '/boot/bcm2709-rpi-2-b.dtb',
 }
@@ -385,6 +388,15 @@ def do_test_arm_raspi(self, version, uart_model):
 console_pattern = 'Kernel command line: %s' % kernel_command_line
 self.wait_for_console_pattern(console_pattern)
 
+def test_arm_raspi0_uart0(self):
+"""
+:avocado: tags=arch:arm
+:avocado: tags=machine:raspi0
+:avocado: tags=cpu:arm1176
+:avocado: tags=device:pl011
+"""
+self.do_test_arm_raspi(0, 'pl011')
+
 def test_arm_raspi1_uart0(self):
 """
 :avocado: tags=arch:arm
-- 
2.21.1




[PATCH 3/8] tests/acceptance/boot_linux_console: Test the raspi1 console

2020-02-15 Thread Philippe Mathieu-Daudé
  $ avocado --show=app,console run -t machine:raspi1 tests/acceptance/
  JOB ID : c49310d4a21444f03789cd2c443d8c54a29ffd0a
  JOB LOG: avocado/job-results/job-2020-02-05T23.52-c49310d/job.log
   (1/1) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi1_uart0:
  console: [0.00] Booting Linux on physical CPU 0x0
  console: [0.00] Linux version 4.14.98+ (dom@dom-XPS-13-9370) (gcc 
version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1200 Tue Feb 12 
20:11:02 GMT 2019
  console: [0.00] CPU: ARMv6-compatible processor [410fb767] revision 7 
(ARMv7), cr=00c5387d
  console: [0.00] CPU: VIPT aliasing data cache, unknown instruction 
cache
  console: [0.00] OF: fdt: Machine model: Raspberry Pi Model B
  console: [0.00] earlycon: pl11 at MMIO 0x20201000 (options '')
  console: [0.00] bootconsole [pl11] enabled
  console: [0.00] Memory policy: Data cache writeback
  console: [0.00] cma: Reserved 8 MiB at 0x1b80
  console: [0.00] Built 1 zonelists, mobility grouping on.  Total 
pages: 113680
  console: [0.00] Kernel command line: printk.time=0 
earlycon=pl011,0x20201000 console=ttyAMA0
  PASS (12.93 s)
  RESULTS: PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | 
CANCEL 0
  JOB TIME   : 13.18 s

Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/acceptance/boot_linux_console.py | 12 
 1 file changed, 12 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index a1b6e70d3f..c8eabae695 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -355,13 +355,16 @@ def do_test_arm_raspi(self, version, uart_model):
 """
 serial_kernel_cmdline = {
 'pl011': {
+1: 'earlycon=pl011,0x20201000 console=ttyAMA0',
 2: 'earlycon=pl011,0x3f201000 console=ttyAMA0',
 },
 }
 kernel = {
+1: '/boot/kernel.img',
 2: '/boot/kernel7.img',
 }
 dtb = {
+1: '/boot/bcm2708-rpi-b.dtb',
 2: '/boot/bcm2709-rpi-2-b.dtb',
 }
 deb_url = ('http://archive.raspberrypi.org/debian/'
@@ -382,6 +385,15 @@ def do_test_arm_raspi(self, version, uart_model):
 console_pattern = 'Kernel command line: %s' % kernel_command_line
 self.wait_for_console_pattern(console_pattern)
 
+def test_arm_raspi1_uart0(self):
+"""
+:avocado: tags=arch:arm
+:avocado: tags=machine:raspi1
+:avocado: tags=cpu:arm1176
+:avocado: tags=device:pl011
+"""
+self.do_test_arm_raspi(1, 'pl011')
+
 def test_arm_raspi2_uart0(self):
 """
 :avocado: tags=arch:arm
-- 
2.21.1




[PATCH 5/8] tests/acceptance/boot_linux_console: Test the raspi1 AUX console

2020-02-15 Thread Philippe Mathieu-Daudé
  $ avocado --show=app,console run -t device:bcm2835_aux tests/acceptance/
  JOB ID : a8846d69d52da701681b1d17f80ef299009fd078
  JOB LOG: avocado/job-results/job-2020-02-05T23.44-a8846d6/job.log
   (1/3) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi0_uart1:
  console: [0.00] Booting Linux on physical CPU 0x0
  console: [0.00] Linux version 4.14.98+ (dom@dom-XPS-13-9370) (gcc 
version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1200 Tue Feb 12 
20:11:02 GMT 2019
  console: [0.00] CPU: ARMv6-compatible processor [410fb767] revision 7 
(ARMv7), cr=00c5387d
  console: [0.00] CPU: VIPT aliasing data cache, unknown instruction 
cache
  console: [0.00] OF: fdt: Machine model: Raspberry Pi Zero W
  console: [0.00] earlycon: uart8250 at MMIO32 0x20215040 (options '')
  console: [0.00] bootconsole [uart8250] enabled
  console: [0.00] Memory policy: Data cache writeback
  console: [0.00] cma: Reserved 8 MiB at 0x1b80
  console: [0.00] Built 1 zonelists, mobility grouping on.  Total 
pages: 113680
  console: [0.00] Kernel command line: printk.time=0 
earlycon=uart8250,mmio32,0x20215040 console=ttyS1,115200
  PASS (13.31 s)
   (2/3) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi1_uart1:
  console: [0.00] Booting Linux on physical CPU 0x0
  console: [0.00] Linux version 4.14.98+ (dom@dom-XPS-13-9370) (gcc 
version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1200 Tue Feb 12 
20:11:02 GMT 2019
  console: [0.00] CPU: ARMv6-compatible processor [410fb767] revision 7 
(ARMv7), cr=00c5387d
  console: [0.00] CPU: VIPT aliasing data cache, unknown instruction 
cache
  console: [0.00] OF: fdt: Machine model: Raspberry Pi Model B
  console: [0.00] earlycon: uart8250 at MMIO32 0x20215040 (options '')
  console: [0.00] bootconsole [uart8250] enabled
  console: [0.00] Memory policy: Data cache writeback
  console: [0.00] cma: Reserved 8 MiB at 0x1b80
  console: [0.00] Built 1 zonelists, mobility grouping on.  Total 
pages: 113680
  console: [0.00] Kernel command line: printk.time=0 
earlycon=uart8250,mmio32,0x20215040 console=ttyS1,115200
  PASS (13.39 s)
   (3/3) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi2_uart1:
  console: [0.00] Booting Linux on physical CPU 0xf00
  console: [0.00] Linux version 4.14.98-v7+ (dom@dom-XPS-13-9370) (gcc 
version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1200 SMP Tue Feb 
12 20:27:48 GMT 2019
  console: [0.00] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), 
cr=10c5387d
  console: [0.00] CPU: div instructions available: patching division 
code
  console: [0.00] CPU: PIPT / VIPT nonaliasing data cache, VIPT 
aliasing instruction cache
  console: [0.00] OF: fdt: Machine model: Raspberry Pi 2 Model B
  console: [0.00] earlycon: uart8250 at MMIO32 0x3f215040 (options '')
  console: [0.00] bootconsole [uart8250] enabled
  console: [0.00] Memory policy: Data cache writealloc
  console: [0.00] cma: Reserved 8 MiB at 0x3b80
  console: [0.00] percpu: Embedded 17 pages/cpu @baf2e000 s38720 r8192 
d22720 u69632
  console: [0.00] Built 1 zonelists, mobility grouping on.  Total 
pages: 243600
  console: [0.00] Kernel command line: printk.time=0 
earlycon=uart8250,mmio32,0x3f215040 console=ttyS1,115200
  PASS (12.46 s)
  RESULTS: PASS 3 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | 
CANCEL 0
  JOB TIME   : 39.60 s

Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/acceptance/boot_linux_console.py | 37 +-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index bd3f0fc852..3d442b6cd1 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -359,6 +359,14 @@ def do_test_arm_raspi(self, version, uart_model):
 1: 'earlycon=pl011,0x20201000 console=ttyAMA0',
 2: 'earlycon=pl011,0x3f201000 console=ttyAMA0',
 },
+'bcm2835_aux': {
+0: 'earlycon=uart8250,mmio32,0x20215040 console=ttyS1,115200',
+1: 'earlycon=uart8250,mmio32,0x20215040 console=ttyS1,115200',
+2: 'earlycon=uart8250,mmio32,0x3f215040 console=ttyS1,115200',
+},
+}
+uart_id = {
+'pl011': 0, 'bcm2835_aux': 1,
 }
 kernel = {
 0: '/boot/kernel.img',
@@ -378,7 +386,7 @@ def do_test_arm_raspi(self, version, uart_model):
 kernel_path = self.extract_from_deb(deb_path, kernel[version])
 dtb_path = self.extract_from_deb(deb_path, dtb[version])
 
-self.vm.set_console()
+self.vm.set_console(co

[PATCH 6/8] tests/boot_linux_console: Test booting U-Boot on the Raspberry Pi 2

2020-02-15 Thread Philippe Mathieu-Daudé
This test runs U-Boot on the Raspberry Pi 2.
It is very simple and fast:

  $ avocado --show=app,console run -t raspi2 -t u-boot tests/acceptance/
  JOB LOG: avocado/job-results/job-2020-01-20T23.40-2424777/job.log
   (1/1) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi2_uboot:
  console: MMC:   sdhci@7e30: 0
  console: Loading Environment from FAT... Card did not respond to voltage 
select!
  console: In:serial
  console: Out:   vidconsole
  console: Err:   vidconsole
  console: Net:   No ethernet found.
  console: starting USB...
  console: USB0:   Port not available.
  console: Hit any key to stop autoboot:  0
  console: U-Boot>
  console: U-Boot> bdinfo
  console: arch_number = 0x
  console: boot_params = 0x0100
  console: DRAM bank   = 0x
  console: -> start= 0x
  console: -> size = 0x3c00
  console: baudrate= 115200 bps
  console: TLB addr= 0x3bff
  console: relocaddr   = 0x3bf64000
  console: reloc off   = 0x3bf5c000
  console: irq_sp  = 0x3bb5fec0
  console: sp start= 0x3bb5feb0
  console: Early malloc usage: 2a4 / 400
  console: fdt_blob= 0x3bfbdfb0
  console: U-Boot> version
  console: U-Boot 2019.01+dfsg-7 (May 14 2019 - 02:07:44 +)
  console: gcc (Debian 8.3.0-7) 8.3.0
  console: GNU ld (GNU Binutils for Debian) 2.31.1
  console: U-Boot> reset
  console: resetting ...
  PASS (0.46 s)

U-Boot is built by the Debian project, see:
https://wiki.debian.org/InstallingDebianOn/Allwinner#Creating_a_bootable_SD_Card_with_u-boot

Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/acceptance/boot_linux_console.py | 28 ++
 1 file changed, 28 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 3d442b6cd1..3b1952b2df 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -16,6 +16,7 @@
 from avocado import skipUnless
 from avocado_qemu import Test
 from avocado_qemu import exec_command_and_wait_for_pattern
+from avocado_qemu import interrupt_interactive_console_until_pattern
 from avocado_qemu import wait_for_console_pattern
 from avocado.utils import process
 from avocado.utils import archive
@@ -575,6 +576,33 @@ def test_arm_cubieboard_sata(self):
 exec_command_and_wait_for_pattern(self, 'reboot',
 'reboot: Restarting system')
 
+def test_arm_raspi2_uboot(self):
+"""
+:avocado: tags=arch:arm
+:avocado: tags=machine:raspi2
+:avocado: tags=u-boot
+"""
+deb_url = ('https://snapshot.debian.org/archive/debian/'
+   '20190514T084354Z/pool/main/u/u-boot/'
+   'u-boot-rpi_2019.01%2Bdfsg-7_armhf.deb')
+deb_hash = 'ad858cf3afe623b6c3fa2e20dcdd1768fcb9ae83'
+deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+uboot_path = '/usr/lib/u-boot/rpi_2/uboot.elf'
+uboot_path = self.extract_from_deb(deb_path, uboot_path)
+
+self.vm.set_console()
+self.vm.add_args('-kernel', uboot_path,
+ # VideoCore starts CPU with only 1 core enabled
+ '-global', 'bcm2836.enabled-cpus=1',
+ '-no-reboot')
+self.vm.launch()
+interrupt_interactive_console_until_pattern(self,
+   'Hit any key to stop autoboot:',
+   'Config file not found')
+exec_command_and_wait_for_pattern(self, 'bdinfo', 'U-Boot')
+exec_command_and_wait_for_pattern(self, 'version', 'U-Boot')
+exec_command_and_wait_for_pattern(self, 'reset', 'resetting ...')
+
 def test_s390x_s390_ccw_virtio(self):
 """
 :avocado: tags=arch:s390x
-- 
2.21.1




[PATCH 7/8] tests/boot_linux_console: Test booting U-Boot on the Raspberry Pi 3

2020-02-15 Thread Philippe Mathieu-Daudé
This test runs U-Boot on the Raspberry Pi 3.
It is very simple and fast:

  $ avocado --show=app,console run -t raspi3 -t u-boot tests/acceptance/
  JOB LOG: avocado/job-results/job-2020-01-20T23.40-2424777/job.log
   (1/1) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_aarch64_raspi3_uboot:
  console: MMC:   mmc@7e202000: 0, sdhci@7e30: 1
  console: Loading Environment from FAT... WARNING at 
drivers/mmc/bcm2835_sdhost.c:410/bcm2835_send_command()!
  console: WARNING at drivers/mmc/bcm2835_sdhost.c:410/bcm2835_send_command()!
  console: Card did not respond to voltage select!
  console: In:serial
  console: Out:   vidconsole
  console: Err:   vidconsole
  console: Net:   No ethernet found.
  console: starting USB...
  console: Bus usb@7e98: Port not available.
  console: Hit any key to stop autoboot:  0
  console: U-Boot>
  console: U-Boot>
  console: U-Boot> bdinfo
  console: arch_number = 0x
  console: boot_params = 0x0100
  console: DRAM bank   = 0x
  console: -> start= 0x
  console: -> size = 0x3c00
  console: baudrate= 115200 bps
  console: TLB addr= 0x3bff
  console: relocaddr   = 0x3bf57000
  console: reloc off   = 0x3bed7000
  console: irq_sp  = 0x3bb52dd0
  console: sp start= 0x3bb52dd0
  console: FB base = 0x
  console: Early malloc usage: 7b0 / 2000
  console: fdt_blob= 0x3bfbf200
  console: U-Boot> version
  console: U-Boot 2020.01+dfsg-1 (Jan 08 2020 - 08:19:44 +)
  console: gcc (Debian 9.2.1-22) 9.2.1 20200104
  console: GNU ld (GNU Binutils for Debian) 2.33.1
  console: U-Boot> reset
  console: resetting ...
  PASS (1.79 s)

U-Boot is built by the Debian project, see:
https://wiki.debian.org/InstallingDebianOn/Allwinner#Creating_a_bootable_SD_Card_with_u-boot

Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/acceptance/boot_linux_console.py | 25 +
 1 file changed, 25 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 3b1952b2df..989db7d461 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -603,6 +603,31 @@ def test_arm_raspi2_uboot(self):
 exec_command_and_wait_for_pattern(self, 'version', 'U-Boot')
 exec_command_and_wait_for_pattern(self, 'reset', 'resetting ...')
 
+def test_aarch64_raspi3_uboot(self):
+"""
+:avocado: tags=arch:aarch64
+:avocado: tags=machine:raspi3
+:avocado: tags=u-boot
+"""
+deb_url = ('https://snapshot.debian.org/archive/debian/'
+   '20200108T145233Z/pool/main/u/u-boot/'
+   'u-boot-rpi_2020.01%2Bdfsg-1_arm64.deb')
+deb_hash = 'f394386e02469d52f2eb3c07a2325b1c95aeb00b'
+deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+uboot_path = '/usr/lib/u-boot/rpi_3/u-boot.bin'
+uboot_path = self.extract_from_deb(deb_path, uboot_path)
+
+self.vm.set_console(console_index=1)
+self.vm.add_args('-kernel', uboot_path,
+ '-no-reboot')
+self.vm.launch()
+interrupt_interactive_console_until_pattern(self,
+   'Hit any key to stop autoboot:',
+   'Config file not found')
+exec_command_and_wait_for_pattern(self, 'bdinfo', 'U-Boot')
+exec_command_and_wait_for_pattern(self, 'version', 'U-Boot')
+exec_command_and_wait_for_pattern(self, 'reset', 'resetting ...')
+
 def test_s390x_s390_ccw_virtio(self):
 """
 :avocado: tags=arch:s390x
-- 
2.21.1




[PATCH 8/8] tests/acceptance: Count Raspberry Pi logos displayed on framebuffer

2020-02-15 Thread Philippe Mathieu-Daudé
Add a test that verifies that each core properly displays the
Raspberry Pi logo on the framebuffer device.

We simply follow the OpenCV "Template Matching with Multiple Objects"
tutorial, replacing Lionel Messi by a raspberrry:
https://docs.opencv.org/4.2.0/d4/dc6/tutorial_py_template_matching.html

When OpenCV and NumPy are installed, this test can be run using:

  $ avocado --show=app,framebuffer run -t device:bcm2835-fb tests/acceptance/
  JOB ID : 9bbbc54c0a6fa180348d0b5305507f76852b4da2
  JOB LOG: avocado/job-results/job-2020-01-31T23.48-9bbbc54/job.log
   (1/1) 
tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi2_framebuffer_logo:
  framebuffer: found raspberry at position (x, y) = (0, 0)
  framebuffer: found raspberry at position (x, y) = (71, 0)
  framebuffer: found raspberry at position (x, y) = (142, 0)
  framebuffer: found raspberry at position (x, y) = (213, 0)
  PASS (11.06 s)
  RESULTS: PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | 
CANCEL 0
  JOB TIME   : 11.39 s

Signed-off-by: Philippe Mathieu-Daudé 
---
The resulting match can be visualised at https://pasteboard.co/ISzNHtx.png
---
 tests/acceptance/boot_linux_console.py | 62 ++
 1 file changed, 62 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py 
b/tests/acceptance/boot_linux_console.py
index 989db7d461..7c960051a6 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -12,6 +12,7 @@
 import lzma
 import gzip
 import shutil
+import logging
 
 from avocado import skipUnless
 from avocado_qemu import Test
@@ -22,6 +23,19 @@
 from avocado.utils import archive
 
 
+NUMPY_AVAILABLE = True
+try:
+import numpy as np
+except ImportError:
+NUMPY_AVAILABLE = False
+
+CV2_AVAILABLE = True
+try:
+import cv2
+except ImportError:
+CV2_AVAILABLE = False
+
+
 class BootLinuxConsole(Test):
 """
 Boots a Linux kernel and checks that the console is operational and the
@@ -451,6 +465,54 @@ def test_arm_raspi2_uart1(self):
 """
 self.do_test_arm_raspi(2, 'bcm2835_aux')
 
+@skipUnless(NUMPY_AVAILABLE, 'Python NumPy not installed')
+@skipUnless(CV2_AVAILABLE, 'Python OpenCV not installed')
+def test_arm_raspi2_framebuffer_logo(self):
+"""
+:avocado: tags=arch:arm
+:avocado: tags=machine:raspi2
+:avocado: tags=device:bcm2835-fb
+"""
+screendump_path = os.path.join(self.workdir, 'screendump.pbm')
+rpilogo_url = ('https://github.com/raspberrypi/linux/raw/'
+   'raspberrypi-kernel_1.20190517-1/'
+   'drivers/video/logo/logo_linux_clut224.ppm')
+rpilogo_hash = 'fff3cc20c6030acce0953147f9baac43f44ed6b0'
+rpilogo_path = self.fetch_asset(rpilogo_url, asset_hash=rpilogo_hash)
+deb_url = ('http://archive.raspberrypi.org/debian/'
+   'pool/main/r/raspberrypi-firmware/'
+   'raspberrypi-kernel_1.20190215-1_armhf.deb')
+deb_hash = 'cd284220b32128c5084037553db3c482426f3972'
+deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+kernel_path = self.extract_from_deb(deb_path, '/boot/kernel7.img')
+dtb_path = self.extract_from_deb(deb_path, '/boot/bcm2709-rpi-2-b.dtb')
+
+self.vm.set_console()
+kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+   'earlycon=pl011,0x3f201000 console=ttyAMA0')
+self.vm.add_args('-kernel', kernel_path,
+ '-dtb', dtb_path,
+ '-append', kernel_command_line)
+self.vm.launch()
+framebuffer_ready = 'Console: switching to colour frame buffer device'
+wait_for_console_pattern(self, framebuffer_ready)
+self.vm.command('human-monitor-command', command_line='stop')
+self.vm.command('human-monitor-command',
+command_line='screendump %s' % screendump_path)
+logger = logging.getLogger('framebuffer')
+
+cpu_cores_count = 4
+match_threshold = 0.95
+screendump_bgr = cv2.imread(screendump_path, cv2.IMREAD_COLOR)
+rpilogo_bgr = cv2.imread(rpilogo_path, cv2.IMREAD_COLOR)
+result = cv2.matchTemplate(screendump_bgr, rpilogo_bgr,
+   cv2.TM_CCOEFF_NORMED)
+loc = np.where(result >= match_threshold)
+rpilogo_count = 0
+for rpilogo_count, pt in enumerate(zip(*loc[::-1]), start=1):
+logger.debug('found raspberry at position (x, y) = %s', pt)
+self.assertGreaterEqual(rpilogo_count, cpu_cores_count)
+
 def test_arm_exynos4210_initrd(self):
 """
 :avocado: tags=arch:arm
-- 
2.21.1




Re: [PATCH 1/4] hw/hppa/dino: Add comments with register name

2020-02-15 Thread Helge Deller
On 14.02.20 00:41, Philippe Mathieu-Daudé wrote:
> Add a comment with the name of each register in the 0x800-0x833 range.
>
> Signed-off-by: Philippe Mathieu-Daudé 

Acked-by: Helge Deller 

> ---
>  hw/hppa/dino.c | 24 
>  1 file changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/hw/hppa/dino.c b/hw/hppa/dino.c
> index 9797a7f0d9..c237ad3b1b 100644
> --- a/hw/hppa/dino.c
> +++ b/hw/hppa/dino.c
> @@ -85,18 +85,18 @@
>
>  #define DINO800_REGS ((DINO_TLTIM - DINO_GMASK) / 4)
>  static const uint32_t reg800_keep_bits[DINO800_REGS] = {
> -MAKE_64BIT_MASK(0, 1),
> -MAKE_64BIT_MASK(0, 7),
> -MAKE_64BIT_MASK(0, 7),
> -MAKE_64BIT_MASK(0, 8),
> -MAKE_64BIT_MASK(0, 7),
> -MAKE_64BIT_MASK(0, 9),
> -MAKE_64BIT_MASK(0, 32),
> -MAKE_64BIT_MASK(0, 8),
> -MAKE_64BIT_MASK(0, 30),
> -MAKE_64BIT_MASK(0, 25),
> -MAKE_64BIT_MASK(0, 22),
> -MAKE_64BIT_MASK(0, 9),
> +MAKE_64BIT_MASK(0, 1),  /* GMASK */
> +MAKE_64BIT_MASK(0, 7),  /* PAMR */
> +MAKE_64BIT_MASK(0, 7),  /* PAPR */
> +MAKE_64BIT_MASK(0, 8),  /* DAMODE */
> +MAKE_64BIT_MASK(0, 7),  /* PCICMD */
> +MAKE_64BIT_MASK(0, 9),  /* PCISTS */
> +MAKE_64BIT_MASK(0, 32), /* Undefined */
> +MAKE_64BIT_MASK(0, 8),  /* MLTIM */
> +MAKE_64BIT_MASK(0, 30), /* BRDG_FEAT */
> +MAKE_64BIT_MASK(0, 25), /* PCIROR */
> +MAKE_64BIT_MASK(0, 22), /* PCIWOR */
> +MAKE_64BIT_MASK(0, 9),  /* TLTIM */
>  };
>
>  typedef struct DinoState {
>




Re: [PATCH 2/4] hw/hppa/dino: Fix reg800_keep_bits[] overrun (CID 1419393 & 1419394)

2020-02-15 Thread Helge Deller
On 14.02.20 00:41, Philippe Mathieu-Daudé wrote:
>
> Fixes: Covertiy CID 1419393 and 1419394 (commit 18092598a5)
> Signed-off-by: Philippe Mathieu-Daudé 

Acked-by: Helge Deller 

> ---
>  hw/hppa/dino.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/hw/hppa/dino.c b/hw/hppa/dino.c
> index c237ad3b1b..8868e31793 100644
> --- a/hw/hppa/dino.c
> +++ b/hw/hppa/dino.c
> @@ -83,7 +83,7 @@
>  #define DINO_PCI_HOST_BRIDGE(obj) \
>  OBJECT_CHECK(DinoState, (obj), TYPE_DINO_PCI_HOST_BRIDGE)
>
> -#define DINO800_REGS ((DINO_TLTIM - DINO_GMASK) / 4)
> +#define DINO800_REGS (1 + (DINO_TLTIM - DINO_GMASK) / 4)
>  static const uint32_t reg800_keep_bits[DINO800_REGS] = {
>  MAKE_64BIT_MASK(0, 1),  /* GMASK */
>  MAKE_64BIT_MASK(0, 7),  /* PAMR */
> @@ -96,6 +96,7 @@ static const uint32_t reg800_keep_bits[DINO800_REGS] = {
>  MAKE_64BIT_MASK(0, 30), /* BRDG_FEAT */
>  MAKE_64BIT_MASK(0, 25), /* PCIROR */
>  MAKE_64BIT_MASK(0, 22), /* PCIWOR */
> +MAKE_64BIT_MASK(0, 32), /* Undocumented */
>  MAKE_64BIT_MASK(0, 9),  /* TLTIM */
>  };
>
>




Re: [RFC PATCH 3/4] hw/hppa/dino: Fix PCIROR register access bitmask

2020-02-15 Thread Helge Deller
On 14.02.20 00:41, Philippe Mathieu-Daudé wrote:
> Only 24 bits of the PCIROR register are documented
> (see pp. 37 of datasheet referenced in this file header).
>
> Signed-off-by: Philippe Mathieu-Daudé 

Acked-by: Helge Deller 

> ---
>  hw/hppa/dino.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/hppa/dino.c b/hw/hppa/dino.c
> index 8868e31793..be799aad43 100644
> --- a/hw/hppa/dino.c
> +++ b/hw/hppa/dino.c
> @@ -94,7 +94,7 @@ static const uint32_t reg800_keep_bits[DINO800_REGS] = {
>  MAKE_64BIT_MASK(0, 32), /* Undefined */
>  MAKE_64BIT_MASK(0, 8),  /* MLTIM */
>  MAKE_64BIT_MASK(0, 30), /* BRDG_FEAT */
> -MAKE_64BIT_MASK(0, 25), /* PCIROR */
> +MAKE_64BIT_MASK(0, 24), /* PCIROR */
>  MAKE_64BIT_MASK(0, 22), /* PCIWOR */
>  MAKE_64BIT_MASK(0, 32), /* Undocumented */
>  MAKE_64BIT_MASK(0, 9),  /* TLTIM */
>




Re: [RFC PATCH 4/4] hw/hppa/dino: Do not accept accesses to registers 0x818 and 0x82c

2020-02-15 Thread Helge Deller
On 14.02.20 00:41, Philippe Mathieu-Daudé wrote:
> Register 0x818 is documented as 'undefined', and register
> 0x82c is not documented. Refuse their access.
>
> Signed-off-by: Philippe Mathieu-Daudé 

Acked-by: Helge Deller 



> ---
>  hw/hppa/dino.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/hw/hppa/dino.c b/hw/hppa/dino.c
> index be799aad43..2b1b38c58a 100644
> --- a/hw/hppa/dino.c
> +++ b/hw/hppa/dino.c
> @@ -181,7 +181,9 @@ static bool dino_chip_mem_valid(void *opaque, hwaddr addr,
>  case DINO_IO_ADDR_EN:
>  case DINO_PCI_IO_DATA:
>  case DINO_TOC_ADDR:
> -case DINO_GMASK ... DINO_TLTIM:
> +case DINO_GMASK ... DINO_PCISTS:
> +case DINO_MLTIM ... DINO_PCIWOR:
> +case DINO_TLTIM:
>  ret = true;
>  break;
>  case DINO_PCI_IO_DATA + 2:
>




[Bug 1863441] [NEW] cmd_mode_sense always reports 0x70, no CDROM present

2020-02-15 Thread Benjamin David Lunt
Public bug reported:

cmd_mode_sense
  
https://git.qemu.org/?p=qemu.git;a=blob;f=hw/ide/atapi.c;hb=refs/heads/master#l852
always reports 0x70 in byte 2 returned, indicating no CD-ROM present.

If CD-ROM is present, should report 0x01 (or 0x11).
If CD-ROM absent, should report 0x70.

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1863441

Title:
  cmd_mode_sense always reports 0x70, no CDROM present

Status in QEMU:
  New

Bug description:
  cmd_mode_sense

https://git.qemu.org/?p=qemu.git;a=blob;f=hw/ide/atapi.c;hb=refs/heads/master#l852
  always reports 0x70 in byte 2 returned, indicating no CD-ROM present.

  If CD-ROM is present, should report 0x01 (or 0x11).
  If CD-ROM absent, should report 0x70.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1863441/+subscriptions



Re: [PATCH v2 07/30] qapi/block-core.json: Use literal block for ascii art

2020-02-15 Thread Philippe Mathieu-Daudé
Hi Aleksandar,

On Fri, Feb 14, 2020 at 12:04 AM Aleksandar Markovic
 wrote:
>
> 6:59 PM Čet, 13.02.2020. Peter Maydell  је 
> написао/ла:
> >
> > The ascii-art graph
>
> Just out of couriousity, are unicode characters allowed in rst files?

I remember 2 years ago a blind developer thanked the QEMU community to
still restrict commits to 80 characters, because while 4K display are
available, he and other visually impaired developers cloud still
browse the QEMU codebase with their refreshable Braille display (which
was 80 cels). I don't know how many visually impaired developers are
following this project. A quick google returns " There is no concept
of Unicode in Braille. In that sense Braille is similar to old 8-bit
code pages which represented different symbols in different languages
for the same symbol code."
(https://superuser.com/questions/629443/represent-unicode-characters-in-braille).

(I'm Cc'ing Samuel who cares about Braille displays.)

>
> The boxes could've been rendered in a much more beautifull way using "lines 
> and corners" group of unicode characters.
>
> Aleksandar



Re: [PATCH v2 07/30] qapi/block-core.json: Use literal block for ascii art

2020-02-15 Thread Aleksandar Markovic
9:56 PM Sub, 15.02.2020. Philippe Mathieu-Daudé 
је написао/ла:
>
> Hi Aleksandar,
>
> On Fri, Feb 14, 2020 at 12:04 AM Aleksandar Markovic
>  wrote:
> >
> > 6:59 PM Čet, 13.02.2020. Peter Maydell  је
написао/ла:
> > >
> > > The ascii-art graph
> >
> > Just out of couriousity, are unicode characters allowed in rst files?
>
> I remember 2 years ago a blind developer thanked the QEMU community to
> still restrict commits to 80 characters, because while 4K display are
> available, he and other visually impaired developers cloud still
> browse the QEMU codebase with their refreshable Braille display (which
> was 80 cels). I don't know how many visually impaired developers are
> following this project. A quick google returns " There is no concept
> of Unicode in Braille. In that sense Braille is similar to old 8-bit
> code pages which represented different symbols in different languages
> for the same symbol code."
> (
https://superuser.com/questions/629443/represent-unicode-characters-in-braille
).
>
> (I'm Cc'ing Samuel who cares about Braille displays.)
>

Got it.
> >
> > The boxes could've been rendered in a much more beautifull way using
"lines and corners" group of unicode characters.
> >
> > Aleksandar


[Bug 1863445] Re: assertion failed at translate-all.c:2523 with version 3.1.1

2020-02-15 Thread Ayman Khamouma
in order to reproduce the bug:
```
qemu-mipsel -g 1234 ch67
```

and then juste launch (after installing r2):

```
r2 -a mips -b 32 -d gdb://127.0.0.1:1234
```

qemu will crash

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1863445

Title:
  assertion failed at translate-all.c:2523 with version 3.1.1

Status in QEMU:
  New

Bug description:
  I was trying to debug a userspace binary with radare2 and met the
  following assertion in qemu:

  ```
  qemu-mipsel: /builddir/build/BUILD/qemu-3.1.1/accel/tcg/translate-all.c:2523: 
page_check_range: Assertion `start < ((target_ulong)1 << 
L1_MAP_ADDR_SPACE_BITS)' failed.
  qemu:handle_cpu_signal received signal outside vCPU context @ 
pc=0x7fd1c11c5987
  ```

  ```
  # qemu-mipsel --version   

  qemu-mipsel version 3.1.1 (qemu-3.1.1-2.fc30)
  Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
  ```

  not much to add. seems like qemu is not properly checking for valid
  addresses

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1863445/+subscriptions



[Bug 1863445] Re: assertion failed at translate-all.c:2523 with version 3.1.1

2020-02-15 Thread Ayman Khamouma
** Attachment added: "debuged binary"
   
https://bugs.launchpad.net/qemu/+bug/1863445/+attachment/5328542/+files/ch67.zip

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1863445

Title:
  assertion failed at translate-all.c:2523 with version 3.1.1

Status in QEMU:
  New

Bug description:
  I was trying to debug a userspace binary with radare2 and met the
  following assertion in qemu:

  ```
  qemu-mipsel: /builddir/build/BUILD/qemu-3.1.1/accel/tcg/translate-all.c:2523: 
page_check_range: Assertion `start < ((target_ulong)1 << 
L1_MAP_ADDR_SPACE_BITS)' failed.
  qemu:handle_cpu_signal received signal outside vCPU context @ 
pc=0x7fd1c11c5987
  ```

  ```
  # qemu-mipsel --version   

  qemu-mipsel version 3.1.1 (qemu-3.1.1-2.fc30)
  Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
  ```

  not much to add. seems like qemu is not properly checking for valid
  addresses

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1863445/+subscriptions



[Bug 1863445] [NEW] assertion failed at translate-all.c:2523 with version 3.1.1

2020-02-15 Thread Ayman Khamouma
Public bug reported:

I was trying to debug a userspace binary with radare2 and met the
following assertion in qemu:

```
qemu-mipsel: /builddir/build/BUILD/qemu-3.1.1/accel/tcg/translate-all.c:2523: 
page_check_range: Assertion `start < ((target_ulong)1 << 
L1_MAP_ADDR_SPACE_BITS)' failed.
qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x7fd1c11c5987
```

```
# qemu-mipsel --version 
  
qemu-mipsel version 3.1.1 (qemu-3.1.1-2.fc30)
Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
```

not much to add. seems like qemu is not properly checking for valid
addresses

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1863445

Title:
  assertion failed at translate-all.c:2523 with version 3.1.1

Status in QEMU:
  New

Bug description:
  I was trying to debug a userspace binary with radare2 and met the
  following assertion in qemu:

  ```
  qemu-mipsel: /builddir/build/BUILD/qemu-3.1.1/accel/tcg/translate-all.c:2523: 
page_check_range: Assertion `start < ((target_ulong)1 << 
L1_MAP_ADDR_SPACE_BITS)' failed.
  qemu:handle_cpu_signal received signal outside vCPU context @ 
pc=0x7fd1c11c5987
  ```

  ```
  # qemu-mipsel --version   

  qemu-mipsel version 3.1.1 (qemu-3.1.1-2.fc30)
  Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
  ```

  not much to add. seems like qemu is not properly checking for valid
  addresses

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1863445/+subscriptions



[Bug 1863445] Re: assertion failed at translate-all.c:2523 with version 3.1.1

2020-02-15 Thread Ayman Khamouma
tested on fedora 30:
```
uname -a
Linux bigfoot.home.ak42.io 5.4.18-100.fc30.x86_64 #1 SMP Fri Feb 7 14:37:00 UTC 
2020 x86_64 x86_64 x86_64 GNU/Linux
```

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1863445

Title:
  assertion failed at translate-all.c:2523 with version 3.1.1

Status in QEMU:
  New

Bug description:
  I was trying to debug a userspace binary with radare2 and met the
  following assertion in qemu:

  ```
  qemu-mipsel: /builddir/build/BUILD/qemu-3.1.1/accel/tcg/translate-all.c:2523: 
page_check_range: Assertion `start < ((target_ulong)1 << 
L1_MAP_ADDR_SPACE_BITS)' failed.
  qemu:handle_cpu_signal received signal outside vCPU context @ 
pc=0x7fd1c11c5987
  ```

  ```
  # qemu-mipsel --version   

  qemu-mipsel version 3.1.1 (qemu-3.1.1-2.fc30)
  Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
  ```

  not much to add. seems like qemu is not properly checking for valid
  addresses

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1863445/+subscriptions



Re: [PATCH 0/4] hw/hppa/dino: Fix Coverity 1419393 & 1419394

2020-02-15 Thread Richard Henderson
On 2/13/20 3:41 PM, Philippe Mathieu-Daudé wrote:
> Easy fix for the overrun reported by Coverity.
> 
> Last 2 patches are RFC because I haven't tested them,
> I simply took note while reviewing the datasheet (I
> also checked the errata).
> 
> Philippe Mathieu-Daudé (4):
>   hw/hppa/dino: Add comments with register name
>   hw/hppa/dino: Fix reg800_keep_bits[] overrun (CID 1419393 & 1419394)
>   hw/hppa/dino: Fix bitmask for the PCIROR register
>   hw/hppa/dino: Do not accept accesses to registers 0x818 and 0x82c
> 
>  hw/hppa/dino.c | 31 +--
>  1 file changed, 17 insertions(+), 14 deletions(-)
> 

Queued to tgt-hppa.


r~



  1   2   >