target/s390x: implement COMPARE LOGICAL LONG

As CLCL and CLCLE mostly differ by their operands, use a common do_clcl
helper. Another difference is that CLCL is not interruptible.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: fix COMPARE LOGICAL LONG EXTENDED

There are multiple issues with the COMPARE LOGICAL LONG EXTENDED
instruction:
- The test between the two operands is inverted, leading to an inversion
  of the cc values 1 and 2.
- The address and length of an operand continue to be decreased after
  reaching the end of this operand. These values are then wrong write
  back to the registers.
- We should limit the amount of bytes to process, so that interrupts can
  be served correctly.

At the same time rename dest into src1 and src into src3 to match the
operand names and make the code less confusing.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: improve 24-bit and 31-bit lengths read/write

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: improve 24-bit and 31-bit addresses write

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: improve 24-bit and 31-bit addresses read

Improve fix_address to also handle the 24-bit mode. Rename fix_address
to wrap_address to better explain what is changed.

Replace the calls to get_address with x2 = 0 and b2 = 0 by
call to wrap_address, leading to the removal of this function. Rename
get_address_31fix into get_address.

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement MOVE ZONES

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement MOVE WITH OFFSET

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement MOVE NUMERICS

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement MOVE INVERSE

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement COMPARE AND SIGNAL

These functions differ from COMPARE by generating an exception for a
QNaN input. Use the non quiet version of floatXX_compare.

Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement PACK

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement TEST ADDRESSING MODE

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement TEST AND SET

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: implement local-TLB-clearing in IPTE

And at the same time make IPTE SMP aware.

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: remove some Linux assumptions from IPTE

Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: remove dead code in translate.c

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170531220129[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x/cpu_models: Allow some additional feature bits for the "qemu" CPU

Currently we only present the plain z900 feature bits to the guest,
but QEMU already emulates some additional features (but not all of
the next CPU generation, so we can not use the next CPU level as
default yet). Since newer Linux kernels are checking the feature bits
and refuse to work if a required feature is missing, it would be nice
to have a way to present more of the supported features when we are
running with the "qemu" CPU.
This patch now adds the supported features to the "full_feat" bitmap,
so that additional features can be enabled on the command line now,
for example with:

 qemu-system-s390x -cpu qemu,stfle=true,ldisp=true,eimm=true,stckf=true

Acked-by: David Hildenbrand <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
Message-Id: <1495704132[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Re-implement a few EXECUTE target insns directly

While the previous patch is required for proper conformance,
the vast majority of target insns are MVC and XC for implementing
memmove and memset respectively.  The next most common are CLC,
TR, and SVC.

Implementing these (and a few others for which we already have
an implementation) directly is faster than going through full
translation to a TB.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Implement EXECUTE via new TranslationBlock

Previously, helper_ex would construct the insn and then implement
the insn via direct calls other helpers.  This was sufficient to
boot Linux but that is all.

It is easy enough to go the whole nine yards by stashing state for
EXECUTE within the cpu, and then rely on a new TB to be created
that properly and completely interprets the insn.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: End the TB after EXECUTE

This split will be required for implementing EXECUTE properly.
Do this now as a separate step to aid comparison of before and
after TB listings.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Save current ilen during translation

Use this saved value instead of recomputing from next_pc difference.

Reviewed-by: David Hildenbrand <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Implement CSPG

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use atomic operations for COMPARE SWAP PURGE

Also provide the cross-cpu tlb flushing required by the PoO.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Fix EXECUTE with R1==0

The PoO specifies that when R1==0, no ORing into the insn
loaded from storage takes place.  Load a zero for this case.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Fix some helper_ex problems

(1) The OR of the low bits or R1 into INSN were not being done
consistently; it was forgotten along all but the SVC path.
(2) The setting of ILEN was wrong on SVC path for EXRL.
(3) The data load for ICM read too much.

Fix these by consolidating data load at the beginning, using
get_ilen to control the number of bytes loaded, and ORing in
the byte from R1.  Use extract64 from the full aligned insn
to extract arguments.

Pass in ILEN rather than RET as the more natural way to give
the required data along the SVC path.

Modify ENV->CC_OP directly rather than include it in the
functional interface.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_mvcs/mvcp

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_lra

Fix saving exception_index around mmu_translate; eliminate a dead store.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_tprot

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_testblock

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_stctl

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_lctl

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_lctlg

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_trt

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_tre

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_tr

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_unpk

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_cksm

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_clcle

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_mvcle

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_mvcl

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_stam

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_lam

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_mvst

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_mvpg

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_clst

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_srst

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_clm

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_clc

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_mvc

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_xc

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_oc

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use unwind data for helper_nc

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Move helper_ex to end of file

This will avoid needing forward declarations in following patches.

Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use cpu_loop_exit_restore for tlb_fill

Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Add support for the TEST BLOCK instruction

TEST BLOCK was likely once used to execute basic memory
tests, but nowadays it's just a (slow) way to clear a page.

Reviewed-by: Aurelien Jarno <[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
Message-Id: <1495128400[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

Merge remote-tracking branch 'remotes/xtensa/tags/20170606-xtensa' into staging

target/xtensa fixes:

- fix read/write simcall mapping flags and return value;
- use -serial option to direct console output of sim machine to QEMU chardev;
- fix handling of unknown registers in the gdbstub.

# gpg: Signature made Tue 06 Jun 2017 11:46:05 BST
# gpg:                using RSA key 0x51F9CC91F83FA044
# gpg: Good signature from "Max Filippov <[email protected]>"
# gpg:                 aka "Max Filippov <[email protected]>"
# gpg:                 aka "Max Filippov <[email protected]>"
# Primary key fingerprint: 2B67 854B 98E5 327D CDEB  17D8 51F9 CC91 F83F A044

* remotes/xtensa/tags/20170606-xtensa:
  target/xtensa: handle unknown registers in gdbstub
  target/xtensa: support output to chardev console
  target/xtensa: fix return value of read/write simcalls
  target/xtensa: fix mapping direction in read/write simcalls

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/armbru/tags/pull-misc-2017-06-06' into staging

Miscellaneous patches for 2017-06-06

# gpg: Signature made Tue 06 Jun 2017 08:30:43 BST
# gpg:                using RSA key 0x3870B400EB918653
# gpg: Good signature from "Markus Armbruster <[email protected]>"
# gpg:                 aka "Markus Armbruster <[email protected]>"
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-misc-2017-06-06:
  monitor: fix object_del for command-line-created objects
  tests: check-qom-proplist: add checks for cmdline-created objects
  virtio-scsi-test: Use scsi-hd instead of legacy scsi-disk
  block: Clarify documentation of BlockInfo member io-status

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.10-20170606' into staging

ppc patch queue 2017-06-06

Accumulated patches for ppc targets and the pseries machine type.

The big thing in this batch is a start on a substantial cleanup of the
pseries hotplug mechanisms, which were pretty confusing.  For now
these shouldn't cause substantial behavioural changes, but I am hoping
these lead to clearer code and eventually to fixes for the bugs we
have in hotplug handling, particularly when hotplug and migration are
combined.

The remaining patches are mostly bugfixes.

# gpg: Signature made Tue 06 Jun 2017 03:48:50 BST
# gpg:                using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <[email protected]>"
# gpg:                 aka "David Gibson (Red Hat) <[email protected]>"
# gpg:                 aka "David Gibson (ozlabs.org) <[email protected]>"
# gpg:                 aka "David Gibson (kernel.org) <[email protected]>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.10-20170606:
  spapr: Remove some non-useful properties on DRC objects
  spapr: Eliminate spapr_drc_get_type_str()
  spapr: Move configure-connector state into DRC
  spapr: Clean up spapr_dr_connector_by_*()
  spapr: Introduce DRC subclasses
  spapr/drc: don't migrate DRC of cold-plugged CPUs and LMBs
  spapr: Allow boot from vhost-*-scsi backends
  ppc/pnv: check the return value of fdt_setprop()
  spapr_nvram: Check return value from blk_getlength()
  target/ppc: Fixup set_spr error in h_register_process_table
  target-ppc: Fix openpic timer read register offset
  spapr: Make DRC get_index and get_type methods into plain functions
  spapr: Abolish DRC set_configured method
  spapr: Abolish DRC get_fdt method
  spapr: Move DRC RTAS calls into spapr_drc.c
  migration: Mark CPU states dirty before incoming migration/loadvm
  migration: remove register_savevm()

Signed-off-by: Peter Maydell <[email protected]>

target/xtensa: handle unknown registers in gdbstub

Xtensa cores may have registers of types/sizes not supported by the
gdbstub accessors. Ignore writes to such registers and return zero on
read, but always return correct register size, so that gdb on the other
side is able to access all registers in the packet holding unsupported
registers in the middle. This fixes gdb interaction with cores that have
vector/custom TIE registers.

Cc: [email protected]
Signed-off-by: Max Filippov <[email protected]>

target/xtensa: support output to chardev console

In semihosting mode QEMU allows guest to read and write host file
descriptors directly, including descriptors 0..2, a.k.a. stdin, stdout
and stderr. Sometimes it's desirable to have semihosting console
controlled by -serial option, e.g. to connect it to network.

Add semihosting console to xtensa-semi.c, open it in the 'sim' machine
in the presence of -serial option and direct stdout and stderr to it
when it's present.

Signed-off-by: Max Filippov <[email protected]>

target/xtensa: fix return value of read/write simcalls

Return value of read/write simcalls is not calculated correctly in case
of operations crossing page boundary and in case of short reads/writes.
Read and write simcalls should return the size of data actually
read/written or -1 in case of error.

Cc: [email protected]
Signed-off-by: Max Filippov <[email protected]>

target/xtensa: fix mapping direction in read/write simcalls

Read and write simcalls map physical memory to access I/O buffers, but
'read' simcall need to map it for writing and 'write' simcall need to
map it for reading, i.e. the opposite of what they do now. Fix that.

Cc: [email protected]
Signed-off-by: Max Filippov <[email protected]>

Merge remote-tracking branch 'remotes/ehabkost/tags/x86-and-machine-pull-request' into staging

x86 and machine queue, 2017-06-05

# gpg: Signature made Mon 05 Jun 2017 19:58:01 BST
# gpg:                using RSA key 0x2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <[email protected]>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-and-machine-pull-request:
  scripts: Test script to look for -device crashes
  qemu.py: Add QEMUMachine.exitcode() method
  qemu.py: Don't set _popen=None on error/shutdown
  spapr: cleanup spapr_fixup_cpu_numa_dt() usage
  numa: move numa_node from CPUState into target specific classes
  numa: make hmp 'info numa' fetch numa nodes from qmp_query_cpus() result
  numa: make sure that all cpus have has_node_id set if numa is enabled
  numa: move default mapping init to machine
  numa: consolidate cpu_preplug fixups/checks for pc/arm/spapr
  pc: Use "min-[x]level" on compat_props

Signed-off-by: Peter Maydell <[email protected]>

monitor: fix object_del for command-line-created objects

Currently objects specified on the command-line are only partially
cleaned up when 'object_del' is issued in either HMP or QMP: the
object itself is fully finalized, but the QemuOpts are not removed.
This results in the following behavior:

  x86_64-softmmu/qemu-system-x86_64 -monitor stdio \
    -object memory-backend-ram,id=ram1,size=256M

  QEMU 2.7.91 monitor - type 'help' for more information
  (qemu) object_del ram1
  (qemu) object_del ram1
  object 'ram1' not found
  (qemu) object_add memory-backend-ram,id=ram1,size=256M
  Duplicate ID 'ram1' for object
  Try "help object_add" for more information

which can be an issue for use-cases like memory hotplug.

This happens on the HMP side because hmp_object_add() attempts to
create a temporary QemuOpts entry with ID 'ram1', which ends up
conflicting with the command-line-created entry, since it was never
cleaned up during the previous hmp_object_del() call.

We address this by adding a check in user_creatable_del(), which
is called by both qmp_object_del() and hmp_object_del() to handle
the actual object cleanup, to determine whether an option group entry
matching the object's ID is present and removing it if it is.

Note that qmp_object_add() never attempts to create a temporary
QemuOpts entry, so it does not encounter the duplicate ID error,
which is why this isn't generally visible in libvirt.

Cc: "Dr. David Alan Gilbert" <[email protected]>
Cc: Markus Armbruster <[email protected]>
Cc: Eric Blake <[email protected]>
Cc: Daniel Berrange <[email protected]>
Cc: [email protected]
Signed-off-by: Michael Roth <[email protected]>
Reviewed-by: Daniel P. Berrange <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Message-Id: <1496531612[email protected]>
Signed-off-by: Markus Armbruster <[email protected]>

tests: check-qom-proplist: add checks for cmdline-created objects

check-qom-proplist originally added tests for verifying that
object-creation helpers object_new_with_{props,propv} behaved in
similar fashion to the "traditional" method involving setting each
individual property separately after object creation rather than
via a single call.

Another similar "helper" for creating Objects exists in the form of
objects specified via -object command-line parameters. By that
rationale, we extend check-qom-proplist to include similar checks
for command-line-created objects by employing the same
qemu_opts_parse()-based parsing the vl.c employs.

This parser has a side-effect of parsing the object's options into
a QemuOpt structure and registering this in the global QemuOptsList
using the Object's ID. This can conflict with future Object instances
that attempt to use the same ID if we don't ensure this is cleaned
up as part of Object finalization, so we include a FIXME stub to test
for this case, which will then be resolved in a subsequent patch.

Suggested-by: Daniel Berrange <[email protected]>
Cc: "Dr. David Alan Gilbert" <[email protected]>
Cc: Markus Armbruster <[email protected]>
Cc: Eric Blake <[email protected]>
Cc: Daniel Berrange <[email protected]>
Cc: [email protected]
Signed-off-by: Michael Roth <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Message-Id: <1496531612[email protected]>
[Comment formatting tidied up]
Signed-off-by: Markus Armbruster <[email protected]>

virtio-scsi-test: Use scsi-hd instead of legacy scsi-disk

Signed-off-by: Markus Armbruster <[email protected]>
Message-Id: <1494327362[email protected]>
Acked-by: Paolo Bonzini <[email protected]>

block: Clarify documentation of BlockInfo member io-status

Say "SCSI except scsi-generic" instead of "scsi-disk", because
scsi-disk could mean either scsi-disk.c (which is correct) or device
model scsi-disk (which would be incorrect).

Signed-off-by: Markus Armbruster <[email protected]>
Message-Id: <1494327362[email protected]>
Acked-by: Paolo Bonzini <[email protected]>

spapr: Remove some non-useful properties on DRC objects

 * 'connector_type' is easily derived from the 'index' property, so there's
   no point to it (it's also implicit in the QOM type of the DRC)
 * 'isolation-state', 'indicator-state' and 'allocation-state' are
   part of the transaction between qemu and guest during PAPR hotplug
   operations, and outside tools really have no business looking at it
   (especially not changing, and these were RW properties)
 * 'entity-sense' is basically just a weird PAPR encoding of whether there
   is a device connected to this DRC

Strictly speaking removing these properties is breaking the qemu interface.
However, I'm pretty sure no management tools have ever used these.  For
debugging there are better alternatives.  Therefore, I think removing these
broken interfaces is the better option.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Michael Roth <[email protected]>
Acked-by: Michael Roth <[email protected]>

spapr: Eliminate spapr_drc_get_type_str()

This function was used in generating the device tree.  However, now that
we have different QOM types for different DRC types we can easily store
the information we need in the class structure and avoid this specialized
lookup function.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Michael Roth <[email protected]>
Acked-by: Michael Roth <[email protected]>

spapr: Move configure-connector state into DRC

Currently the sPAPRMachineState contains a list of sPAPRConfigureConnector
structures which store intermediate state for the ibm,configure-connector
RTAS call.

This was an attempt to separate this state from the core of the DRC state.
However the configure connector process is intimately tied to the DRC
model, so there's really no point trying to have two levels of interface
here.

Moving the configure-connector state into its corresponding DRC allows
removal of a number of helpers for maintaining the anciliary list.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Michael Roth <[email protected]>
Acked-by: Michael Roth <[email protected]>

spapr: Clean up spapr_dr_connector_by_*()

 * Change names to something less ludicrously verbose
 * Now that we have QOM subclasses for the different DRC types, use a QOM
   typename instead of a PAPR type value parameter

The latter allows removal of the get_type_shift() helper.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Michael Roth <[email protected]>
Acked-by: Michael Roth <[email protected]>

spapr: Introduce DRC subclasses

Currently we only have a single QOM type for all DRCs, but lots of
places where we switch behaviour based on the DRC's PAPR defined type.
This is a poor use of our existing type system.

So, instead create QOM subclasses for each PAPR defined DRC type.  We
also introduce intermediate subclasses for physical and logical DRCs,
a division which will be useful later on.

Instead of being stored in the DRC object itself, the PAPR type is now
stored in the class structure.  There are still many places where we
switch directly on the PAPR type value, but this at least provides the
basis to start to remove those.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Michael Roth <[email protected]>
Acked-by: Michael Roth <[email protected]>

spapr/drc: don't migrate DRC of cold-plugged CPUs and LMBs

As explained in commit 5c0139a8c2f0 ("spapr: fix default DRC state for
coldplugged LMBs"), guests expect cold-plugged LMBs to be pre-allocated
and unisolated. The same goes for cold-plugged CPUs.

While here, let's convert g_assert(false) to the better self documenting
g_assert_not_reached().

Signed-off-by: Greg Kurz <[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Allow boot from vhost-*-scsi backends

The current implementation of spapr_get_fw_dev_path() doesn't take into
consideration vhost-*-scsi devices. This makes said devices unbootable
on PPC as SLOF is unable to work out the path to scan boot disks.

This makes VMs bootable on spapr when using vhost-*-scsi by implementing
a disk path for VHostSCSICommon (which currently includes both
vhost-user-scsi and vhost-scsi).

Signed-off-by: Felipe Franciosi <[email protected]>
Signed-off-by: Mike Cui <[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/pnv: check the return value of fdt_setprop()

Signed-off-by: Cédric Le Goater <[email protected]>
[dwg: Correct typo in commit message]
Signed-off-by: David Gibson <[email protected]>

spapr_nvram: Check return value from blk_getlength()

The blk_getlength() function can return an error value if the
image size cannot be determined. Check for this rather than
ploughing on and trying to g_malloc0() a negative number.
(Spotted by Coverity, CID 1288484.)

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: David Gibson <[email protected]>

target/ppc: Fixup set_spr error in h_register_process_table

set_spr is used in the function h_register_process_table() to update the
LPCR_GTSE and LPCR_UPRT values based on the flags passed by the guest.
The set_spr function takes the last two arguments mask and value used to
mask and set the value of the spr respectively.

The current call site passes these arguments in the wrong order and thus
bot GTSE and UPRT will be set irrespective, which is obviously
incorrect.

Rearrange the function call so that these arguments are passed in the
correct order and the correct behaviour is exhibited.

It is worth noting that this wasn't detected earlier since these were
always both set in all cases where this H_CALL was made.

Fixes: 6de833070ca2 ("target/ppc: Set UPRT and GTSE on all cpus in H_REGISTER_PROCESS_TABLE")
Signed-off-by: Suraj Jitindar Singh <[email protected]>
Signed-off-by: David Gibson <[email protected]>

target-ppc: Fix openpic timer read register offset

openpic_tmr_read() is incorrectly computing register offset of the
TCCR, TBCR, TVPR, and TDR registers when accessing the open pic timer
registers.  Specifically the offset of timer registers for
openpic_tmr_read() is not accounting for the timer frequency reporting
register (TFFR) which is the first register in the "tmr" memory
region.

openpic_tmr_write() *is* correctly computing the offset by adding
0x10f0 to the address prior to computing the register index.  This
patch instead subtracts 0x10 in both the read and write routines and
eliminates some other gratuitous differences between the functions.

Signed-off-by: Aaron Larson <[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Make DRC get_index and get_type methods into plain functions

These two methods only have one implementation, and the spec they're
implementing means any other implementation is unlikely, verging on
impossible.

So replace them with simple functions.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Laurent Vivier <[email protected]>
Tested-by: Daniel Barboza <[email protected]>

spapr: Abolish DRC set_configured method

DRConnectorClass has a set_configured method, however:
  * There is only one implementation, and only ever likely to be one
  * There's exactly one caller, and that's (now) local
  * The implementation is very straightforward

So abolish the method entirely, and just open-code what we need.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Laurent Vivier <[email protected]>
Reviewed-by: Greg Kurz <[email protected]>
Tested-by: Daniel Barboza <[email protected]>

spapr: Abolish DRC get_fdt method

The DRConnectorClass includes a get_fdt method.  However
  * There's only one implementation, and there's only likely to ever be one
  * Both callers are local to spapr_drc
  * Each caller only uses one half of the actual implementation

So abolish get_fdt() entirely, and just open-code what we need.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Laurent Vivier <[email protected]>
Reviewed-by: Greg Kurz <[email protected]>
Tested-by: Daniel Barboza <[email protected]>

spapr: Move DRC RTAS calls into spapr_drc.c

Currently implementations of the RTAS calls related to DRCs are in
spapr_rtas.c.  They belong better in spapr_drc.c - that way they're closer
to related code, and we'll be able to make some more things local.

spapr_rtas.c was intended to contain the RTAS infrastructure and core calls
that don't belong anywhere else, not every RTAS implementation.

Code motion only.

Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Greg Kurz <[email protected]>
Tested-by: Daniel Barboza <[email protected]>

migration: Mark CPU states dirty before incoming migration/loadvm

As a rule, CPU internal state should never be updated when
!cpu->kvm_vcpu_dirty (or the HAX equivalent).  If that is done, then
subsequent calls to cpu_synchronize_state() - usually safe and idempotent -
will clobber state.

However, we routinely do this during a loadvm or incoming migration.
Usually this is called shortly after a reset, which will clear all the cpu
dirty flags with cpu_synchronize_all_post_reset().  Nothing is expected
to set the dirty flags again before the cpu state is loaded from the
incoming stream.

This means that it isn't safe to call cpu_synchronize_state() from a
post_load handler, which is non-obvious and potentially inconvenient.

We could cpu_synchronize_all_state() before the loadvm, but that would be
overkill since a) we expect the state to already be synchronized from the
reset and b) we expect to completely rewrite the state with a call to
cpu_synchronize_all_post_init() at the end of qemu_loadvm_state().

To clear this up, this patch introduces cpu_synchronize_pre_loadvm() and
associated helpers, which simply marks the cpu state as dirty without
actually changing anything.  i.e. it says we want to discard any existing
KVM (or HAX) state and replace it with what we're going to load.

Cc: Juan Quintela <[email protected]>
Cc: Dave Gilbert <[email protected]>
Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Juan Quintela <[email protected]>

migration: remove register_savevm()

We can replace the four remaining calls of register_savevm() by
calls to register_savevm_live(). So we can remove the function and
as we don't allocate anymore the ops pointer with g_new0()
we don't have to free it then.

Signed-off-by: Laurent Vivier <[email protected]>
Reviewed-by: Juan Quintela <[email protected]>
Signed-off-by: David Gibson <[email protected]>

scripts: Test script to look for -device crashes

Test code to check if we can crash QEMU using -device. It will
test all accel/machine/device combinations by default, which may
take a few hours (it's more than 90k test cases). There's a "-r"
option that makes it test a random sample of combinations.

The scripts contains a whitelist for: 1) known error messages
that make QEMU exit cleanly; 2) known QEMU crashes.

This is the behavior when the script finds a failure:

* Known clean (exitcode=1) errors generate DEBUG messages
  (hidden by default)
* Unknown clean (exitcode=1) errors will generate INFO messages
  (visible by default)
* Known crashes generate error messages, but are not fatal
  (unless --strict mode is used)
* Unknown crashes generate fatal error messages

Having an updated whitelist of known clean errors is useful to make the
script less verbose and run faster when in --quick mode, but the
whitelist doesn't need to be always up to date.

Signed-off-by: Eduardo Habkost <[email protected]>
Message-Id: <20170526181200[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

qemu.py: Add QEMUMachine.exitcode() method

Allow the exit code of QEMU to be queried by scripts.

Signed-off-by: Eduardo Habkost <[email protected]>
Message-Id: <20170526181200[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

qemu.py: Don't set _popen=None on error/shutdown

Keep the Popen object around to we can query its exit code later.

To keep the existing 'self._popen is None' checks working, add a
is_running() method, that will check if the process is still running.

Signed-off-by: Eduardo Habkost <[email protected]>
Message-Id: <20170526181200[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

spapr: cleanup spapr_fixup_cpu_numa_dt() usage

even though spapr_fixup_cpu_numa_dt() has no effect on FDT
if numa is disabled, don't call it uselessly. It makes it
obvious at call sites that function is needed only when numa
is enabled.

Signed-off-by: Igor Mammedov <[email protected]>
Message-Id: <1496161442[email protected]>
Reviewed-by: Greg Kurz <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

numa: move numa_node from CPUState into target specific classes

Move vcpu's associated numa_node field out of generic CPUState
into inherited classes that actually care about cpu<->numa mapping,
i.e: ARMCPU, PowerPCCPU, X86CPU.

Signed-off-by: Igor Mammedov <[email protected]>
Message-Id: <1496161442[email protected]>
[ehabkost: s/CPU is belonging to/CPU belongs to/ on comments]
Signed-off-by: Eduardo Habkost <[email protected]>

numa: make hmp 'info numa' fetch numa nodes from qmp_query_cpus() result

HMP command 'info numa' is the last external user that access
CPUState::numa_node field directly. In order to move it to CPU
classes that actually use it, eliminate direct access and use
an alternative approach by using result of qmp_query_cpus(),
which provides topology properties CPU threads are associated
with (including node-id).

Signed-off-by: Igor Mammedov <[email protected]>
Message-Id: <1496161442[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

numa: make sure that all cpus have has_node_id set if numa is enabled

It fixes/add missing _PXM object for non mapped CPU (x86)
and missing fdt node (virt-arm).

It ensures that possible_cpus contains complete mapping if
numa is enabled by the time machine_init() is executed.

As result non completely mapped CPUs:
 1) appear in ACPI/fdt blobs
 2) QMP query-hotpluggable-cpus command shows bound nodes for such CPUs
 3) allows to drop checks for has_node_id in numa only code,
   reducing number of invariants incomplete mapping could produce
 4) moves fixup/implicit node init from runtime numa_cpu_pre_plug()
   (when CPU object is created) to machine_numa_finish_init() which
   helps to fix [1, 2] and make possible_cpus complete source
   of numa mapping available even before CPUs are created.

Signed-off-by: Igor Mammedov <[email protected]>
Message-Id: <1496161442[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

numa: move default mapping init to machine

there is no need use cpu_index_to_instance_props() for setting
default cpu -> node mapping. Generic machine code can do it
without cpu_index by just enabling already preset defaults
in possible_cpus.

PS:
as bonus it makes one less user of cpu_index_to_instance_props()

Signed-off-by: Igor Mammedov <[email protected]>
Message-Id: <1496161442[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

numa: consolidate cpu_preplug fixups/checks for pc/arm/spapr

Signed-off-by: Igor Mammedov <[email protected]>
Reviewed-by: David Gibson <[email protected]>
Message-Id: <1496161442[email protected]>
[ehabkost: Fix indentation]
Signed-off-by: Eduardo Habkost <[email protected]>

pc: Use "min-[x]level" on compat_props

Since the automatic cpuid-level code was introduced in commit
c39c0edf9bb3b968ba95484465a50c7b19f4aa3a ("target-i386: Automatically
set level/xlevel/xlevel2 when needed"), the CPU model tables just define
the default CPUID level code (set using "min-level").  Setting
"[x]level" forces CPUID level to a specific value and disable the
automatic-level logic.

But the PC compat code was not updated and the existing "[x]level"
compat properties broke compatibility for people using features that
triggered the auto-level code.  To keep previous behavior, we should set
"min-[x]level" instead of "[x]level" on compat_props.

This was not a problem for most cases, because old machine-types don't
have full-cpuid-auto-level enabled.  The only common use case it broke
was the CPUID[7] auto-level code, that was already enabled since the
first CPUID[7] feature was introduced (in QEMU 1.4.0).

This causes the regression reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=1454641

Change the PC compat code to use "min-[x]level" instead of "[x]level" on
compat_props, and add new test cases to ensure we don't break this
again.

Reported-by: "Guo, Zhiyi" <[email protected]>
Fixes: c39c0edf9bb ("target-i386: Automatically set level/xlevel/xlevel2 when needed")
Cc: [email protected]
Acked-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20170605' into staging

Queued TCG patches

# gpg: Signature made Mon 05 Jun 2017 17:48:42 BST
# gpg:                using RSA key 0xAD1270CC4DD0279B
# gpg: Good signature from "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"
# Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC  16A4 AD12 70CC 4DD0 279B

* remotes/rth/tags/pull-tcg-20170605: (26 commits)
  target/alpha: Use goto_tb for fallthru between TBs
  target/alpha: Implement WTINT inline
  target/mips: optimize indirect branches
  target/mips: optimize cross-page direct jumps in softmmu
  target/aarch64: optimize indirect branches
  target/aarch64: optimize cross-page direct jumps in softmmu
  target/hppa: Use tcg_gen_lookup_and_goto_ptr
  target/s390: Use tcg_gen_lookup_and_goto_ptr
  tcg/mips: implement goto_ptr
  tcg/arm: Implement goto_ptr
  tcg/arm: Clarify tcg_out_bx for arm4 host
  tcg/s390: Implement goto_ptr
  tcg/sparc: Implement goto_ptr
  tcg/aarch64: Implement goto_ptr
  tcg/ppc: Implement goto_ptr
  tb-hash: improve tb_jmp_cache hash function in user mode
  target/i386: optimize indirect branches
  target/i386: optimize cross-page direct jumps in softmmu
  target/i386: introduce gen_jr helper to generate lookup_and_goto_ptr
  target/arm: optimize indirect branches
  ...

Signed-off-by: Peter Maydell <[email protected]>

target/alpha: Use goto_tb for fallthru between TBs

Signed-off-by: Richard Henderson <[email protected]>

target/alpha: Implement WTINT inline

Signed-off-by: Richard Henderson <[email protected]>

target/mips: optimize indirect branches

Cc: Yongbok Kim <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170430145254[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/mips: optimize cross-page direct jumps in softmmu

Cc: Yongbok Kim <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
Message-Id: <20170430145254[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/aarch64: optimize indirect branches

Measurements:

[Baseline performance is that before applying this and the previous commit]

-                                    NBench, aarch64-softmmu. Host: Intel i7-4790K @ 4.00GHz

 1.7x +-+--------------------------------------------------------------------------------------------------------------+-+
      |                                                                                                                  |
      |   cross                                                                                                          |
 1.6x +cross+jr.................................................####...................................................+-+
      |                                                         #++#                                                     |
      |                                                         #  #                                                     |
 1.5x +-+...................................................*****..#...................................................+-+
      |                                                     *+++*  #                                                     |
      |                                                     *   *  #                                                     |
 1.4x +-+...................................................*...*..#...................................................+-+
      |                                                     *   *  #                                                     |
      |                                     #####           *   *  #                                                     |
 1.3x +-+................................****+++#...........*...*..#...................................................+-+
      |                                  *++*   #           *   *  #                                                     |
      |                                  *  *   #           *   *  #                                                     |
 1.2x +-+................................*..*...#...........*...*..#...................................................+-+
      |                                  *  *   #           *   *  #                                                     |
      |                            ####  *  *   #           *   *  #                                                     |
 1.1x +-+.......................+++#..#..*..*...#...........*...*..#...................................................+-+
      |                         ****  #  *  *   #           *   *  #                                        ****####     |
      |                         *  *  #  *  *   #           *   *  #  ****###   +++####            ****###  *  *   #     |
   1x +-++-++++++-++++****###++-*++*++#++*++*+-+#++****+++++*+++*++#++*++*-+#++*****++#++****###-++*++*-+#++*+-*+++#+-++-+
      |     *****###  *  *  #   *  *  #  *  *   #  *++*###  *   *  #  *  *  #  *   *  #  *  *++#   *  *  #  *  *   #     |
      |     *   *++#  *  *  #   *  *  #  *  *   #  *  *  #  *   *  #  *  *  #  *   *  #  *  *  #   *  *  #  *  *   #     |
 0.9x +-+---*****###--****###---****###--****####--****###--*****###--****###--*****###--****###---****###--****####---+-+
      ASSIGNMENT BITFIELD   FOURFP EMULATION   HUFFMAN   LU DECOMPOSITIONNEURAL NUMERIC SORSTRING SORT    hmean
  png: http://imgur.com/qO9ubtk
NB. cross here represents the previous commit.

-                            SPECint06 (test set), aarch64-linux-user. Host: Intel i7-4790K @ 4.00GHz

 1.5x +-+--------------------------------------------------------------------------------------------------------------+-+
      |                                                                       *****                                      |
      |                                                                       *+++*                           jr         |
      |                                                                       *   *                                      |
 1.4x +-+.....................................................................*...*.....................+++............+-+
      |                                                                       *   *                      |               |
      |                                      *****                            *   *                      |               |
      |                                      *   *                            *   *                    *****             |
 1.3x +-+....................................*...*............................*...*....................*.|.*...........+-+
      |                       +++            *   *                            *   *                    * | *             |
      |                      *****           *   *                            *   *                    *+++*             |
      |                      *   *           *   *                            *   *                    *   *             |
 1.2x +-+....................*...*...........*...*............................*...*...........*****....*...*...........+-+
      |     *****            *   *           *   *                            *   *           *   *    *   *    +++      |
      |     *   *            *   *           *   *                            *   *           *   *    *   *   *****     |
      |     *   *            *   *   *****   *   *                            *   *           *   *    *   *   *   *     |
 1.1x +-+...*...*............*...*...*...*...*...*............................*...*....+++....*...*....*...*...*...*...+-+
      |     *   *            *   *   *   *   *   *                            *   *   *****   *   *    *   *   *   *     |
      |     *   *            *   *   *   *   *   *   *****                    *   *   *   *   *   *    *   *   *   *     |
      |     *   *   *****    *   *   *   *   *   *   *   *   ******           *   *   *   *   *   *    *   *   *   *     |
   1x +-++-+*+++*-++*+++*++++*+-+*+++*-++*+++*-++*+++*+++*++-*++++*-++*****+++*++-*+++*++-*+++*+-+*++++*+++*++-*+++*+-++-+
      |     *   *   *   *    *   *   *   *   *   *   *   *   *    *   *+++*   *   *   *   *   *   *    *   *   *   *     |
      |     *   *   *   *    *   *   *   *   *   *   *   *   *    *   *   *   *   *   *   *   *   *    *   *   *   *     |
      |     *   *   *   *    *   *   *   *   *   *   *   *   *    *   *   *   *   *   *   *   *   *    *   *   *   *     |
 0.9x +-+---*****---*****----*****---*****---*****---*****---******---*****---*****---*****---*****----*****---*****---+-+
         astar   bzip2      gcc   gobmk h264ref   hmmlibquantum      mcf omnetpperlbench   sjengxalancbmk   hmean
  png: http://imgur.com/3Dp4vvq

-                           SPECint06 (train set), aarch64-linux-user. Host: Intel i7-4790K @ 4.00GHz

 1.7x +-+--------------------------------------------------------------------------------------------------------------+-+
      |                                                                                                                  |
      |                                                                                                       jr         |
 1.6x +-+...............................................................................................+++............+-+
      |                                                                                                *****             |
      |                                                                                                *+++*             |
      |                                                                                                *   *             |
 1.5x +-+..............................................................................................*...*...........+-+
      |                                                                        +++                     *   *             |
      |                                                                       *****                    *   *             |
 1.4x +-+.....................................................................*+++*....................*...*...........+-+
      |                                                                       *   *                    *   *             |
      |                                      *****                            *   *                    *   *             |
      |                                      *   *                            *   *   *****            *   *             |
 1.3x +-+....................................*...*............................*...*...*...*............*...*...........+-+
      |                       +++            *   *                            *   *   *   *            *   *             |
      |                      *****           *   *                            *   *   *   *   *****    *   *             |
 1.2x +-+....................*...*...........*...*............................*...*...*...*...*+++*....*...*...*****...+-+
      |                      *   *           *   *                            *   *   *   *   *   *    *   *   *+++*     |
      |     *****            *   *   *****   *   *                            *   *   *   *   *   *    *   *   *   *     |
      |     *   *            *   *   *+++*   *   *                            *   *   *   *   *   *    *   *   *   *     |
 1.1x +-+...*...*............*...*...*...*...*...*............................*...*...*...*...*...*....*...*...*...*...+-+
      |     *   *   *****    *   *   *   *   *   *                    *****   *   *   *   *   *   *    *   *   *   *     |
      |     *   *   *   *    *   *   *   *   *   *    +++    ******   *+++*   *   *   *   *   *   *    *   *   *   *     |
   1x +-+---*****---*****----*****---*****---*****---*****---******---*****---*****---*****---*****----*****---*****---+-+
         astar   bzip2      gcc   gobmk h264ref   hmmlibquantum      mcf omnetpperlbench   sjengxalancbmk   hmean
  png: http://imgur.com/vRrdc9j

Signed-off-by: Emilio G. Cota <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>