Introduce a configurable poll-weight parameter for adaptive polling
in IOThread. This parameter replaces the hardcoded POLL_WEIGHT_SHIFT
constant, allowing runtime control over how much the most recent
event interval affects the next polling duration calculation.
The poll-weight parameter uses a shift value where larger values
decrease the weight of the current interval, enabling more gradual
adjustments. When set to 0, a default value of 3 is used (meaning
the current interval contributes approximately 1/8 to the weighted
average).
This patch also removes the hardcoded default value checks from
adjust_polling_time(). Instead, poll-grow, poll-shrink, and
poll-weight now use default values initialized in iothread.c
during IOThread creation.
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260423195918.661299-4-jhkim@linux.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Improve adaptive polling by updating each AioHandler's poll.ns
every loop iteration using weighted averages. This reduces CPU
consumption while minimizing performance impact.
Background:
Starting from QEMU 10.0, poll.ns was introduced per event handler
to mitigate excessive fluctuations in IOThread polling times
observed in earlier versions (QEMU 9.x). However, the current
design has limitations:
1. poll.ns is updated only when an event occurs, making it
difficult to treat block_ns as a reliable event interval.
2. The IOThread's next polling time is determined by the maximum
poll.ns among all AioHandlers, meaning idle AioHandlers with
high poll.ns can have an outsized impact on polling duration.
3. For io_uring, idle AioHandlers are cleared after
POLL_IDLE_INTERVAL_NS (7s), but for ppoll/epoll there is no
such mechanism, leading to increased CPU consumption from idle
nodes.
Implementation:
This patch treats block_ns as an event interval and updates each
AioHandler's poll.ns in every loop iteration:
- Active handlers (with events): poll.ns is updated using a
weighted average of the current block_ns and previous poll.ns,
smoothing out adjustments and preventing excessive fluctuations.
- Inactive handlers (no events): poll.ns accumulates block_ns
without weighting, allowing rapid isolation of idle nodes. When
poll.ns exceeds poll_max_ns, it resets to 0, preventing
sporadically active handlers from unnecessarily prolonging
iothread polling.
- The iothread polling duration is set based on the largest poll.ns
among active handlers. The shrink divider defaults to 2, matching
the grow rate, to reduce frequent poll_ns resets for slow devices.
The implementation renames poll_idle_timeout to last_dispatch_timestamp
for use as an active handler identifier.
Testing:
POLL_WEIGHT_SHIFT=3 (12.5% weight) was selected based on testing
comparing baseline vs weight=2/3 across various workloads:
Performance results (RHEL 10.1 + QEMU 10.0.0, FCP/FICON, 1-8 iothreads,
numjobs 1/4/8 averaged):
| poll-weight=2 | poll-weight=3
--------------------|--------------------|-----------------
Throughput avg | -2.4% (all tests) | -2.2% (all tests)
CPU consumption avg | -10.9% (all tests) | -9.4% (all tests)
Both configurations achieve ~10% CPU reduction with minimal throughput
impact (~2%). Weight=3 is chosen as default for slightly better
throughput while maintaining substantial CPU savings.
Additional validation testing on s390x SSD with fio (bs=8k, iodepth=8,
numjobs=1) shows how poll_weight affects polling time (poll.ns)
behavior:
RandRead workload:
+-------------+-----------+-----------+-------------+-------------+
| poll_weight | #samples | Mean (ns) | 50th % (ns) | 90th % (ns) |
+-------------+-----------+-----------+-------------+-------------+
| 1 | 4.79M | 8,034 | 5,116 | 20,509 |
| 2 | 5.01M | 12,584 | 11,078 | 24,693 |
| 3 | 5.01M | 15,647 | 14,863 | 28,695 |
| 4 | 5.12M | 16,430 | 15,556 | 30,848 |
| 5 | 5.14M | 16,461 | 15,306 | 32,123 |
+-------------+-----------+-----------+-------------+-------------+
RandWrite workload:
+-------------+-----------+-----------+-------------+-------------+
| poll_weight | #samples | Mean (ns) | 50th % (ns) | 90th % (ns) |
+-------------+-----------+-----------+-------------+-------------+
| 1 | 6.37M | 2,049 | 1,262 | 4,301 |
| 2 | 7.46M | 4,118 | 3,226 | 7,476 |
| 3 | 7.97M | 7,034 | 5,984 | 11,645 |
| 4 | 7.96M | 12,789 | 11,362 | 20,040 |
| 5 | 7.82M | 22,992 | 20,644 | 32,768 |
+-------------+-----------+-----------+-------------+-------------+
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Message-ID: <20260423195918.661299-3-jhkim@linux.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Nodes are no longer added to poll_aio_handlers when adaptive polling is
disabled, preventing unnecessary try_poll_mode() calls. This avoids
iterating over all nodes to compute max_ns unnecessarily when polling
is disabled.
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20260423195918.661299-2-jhkim@linux.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
linux-user: Pull request
This patch series adds myself as linux-user maintainer, and includes some
patches which have piled up for linux-user during the last few weeks.
Please apply.
Thanks!
Helge
* tag 'linux-user-next-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user: Flush errors by using exit() instead of _exit() in error path
linux-user: Use abi_int for imr_ifindex in ip_mreqn struct
linux-user: Fix CLONE_PARENT_SETTID when using fork-like clone
linux-user: Add getsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW
linux-user: Add setsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW
linux-user: Define SO_TIMESTAMP*_NEW and SO_RCVTIMEIO_NEW
linux-user/mips: sync k0 TLS for EF_MIPS_MACH_OCTEON userlands
linux-user/strace: Use pointer type for read and write values
linux-user/arm/nwfpe: Use thread-local storage for qemufpa
linux-user/arm/nwfpe: Replace user_registers with current_cpu
linux-user: Don't define target_stat64 struct for loongarch64
linux-user: fix off-by-one in host_to_target_for_each_rtattr()
linux-user/ppc: Fix ppc64 rt_sigframe stack offset
MAINTAINERS: Add myself as maintainer for linux-user
[I have confirmed with Laurent, the current maintainer, that he would
like Helge to help.
-- Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Conflicts:
MAINTAINERS
Pierrick's email address changed.
target-arm queue:
docs/system: add FEAT_AA32 and FEAT_AA64 to emulation list
hw/arm: Add the i.MX 8MM EVK(Evaluation Kit) board
target/arm: Build M-profile helper code once only
hw/arm: Remove hw_error() for the unimplemented CM_LMBUSCNT register
hw: Move ARM_SYSCTL_GPIO definitions to arm sysctl specific header
target/arm: Allow 'aarch64=off' to be set for TCG CPUs
target/arm: Allow some sysregs to not have to be an exact match for migration
hw/arm/raspi4b: NOP all DTB nodes when removing unimplemented devices
hw/arm/fsl-imx6ul: Implement LCDIF display device
target/arm: Refactor syndrome value code to use registerfields
target/arm: Report the register in WFxT syndromes
# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmnvWqUZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3sXqD/0Rz/TCbnO82o1Pdgeq2ZJM
# n9JdErd55w0LVepMZT4Hmq/V3W1Om65MGluRjUEdKK1+uB9l7wgHWxnJRPp1+pe4
# EGg0rXxio1Z81CCMV6jQrlG+uKCn15gMpTXvGYGbd+8xXGMrCmsfVQxAU8BLyiRk
# CcpOOdWqVtdq6F+yjzYBnz0PtLnbWt/x7hlcBAxOZZKjdH2t/zyDKMMMxPt2V8TS
# XsJOgAk/ugmGZop2X4lwmtaJFelTb7g3XDkeh2fkdbkl0Jf8jFe4tVTirbc1RhSE
# WHoH/yP3rE0oA16b6uXtU5rSFrW3WlNglIasidnDIrjX9NdImD68FDEaDJ2MBuS0
# esy0+of/jqpy1rFBUP5KRtg4MJMstLRIlGxWQtQfoBK5uF5kT0SI2kAnipPIwN49
# IrRfEVM3V7m83+BksfP0+anM85W92kPtwZQfey7oXGJ9jOWbLYRShWphE6k2UI3y
# jU2bWiVdNF1qwUIEh5NHUJKw9rJI5Uz9msxT/U5VRnV78GC8sPf2+YXZmPOqbRFo
# j4QuSNuEnQ2OxBzzneZFYzllLZhVU0CQjD5ax5xJ4Cj4o99eOlyMS3aopWDuVHxJ
# TUJDXC349NeyzSwJgjdwH64lR+qfFeuU4jyI9yisNsYG1LbIEenXX8ww2LXI3eoh
# s/VEjZo5wZ1e5RSAoP41dw==
# =MSX5
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 27 Apr 2026 08:46:29 EDT
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]
# gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* tag 'pull-target-arm-20260427' of https://gitlab.com/pm215/qemu: (63 commits)
target/arm: report register in WFIT syndromes
target/arm: remove old syndrome defines
target/arm: use syndrome helpers to query VNCR bit
target/arm: use syndrome helpers in merge_syn_data_abort
target/arm: make hvf use syndrome helpers for decode
target/arm: make whpx use syndrome helpers for decode
target/arm: use syndrome helpers to set SAME_EL EC bit
target/arm: use syndrome helpers in arm_cpu_do_interrupt_aarch32_hyp
target/arm: migrate check_hcr_el2_trap to use syndrome helper
target/arm: migrate memory op syndromes to registerfields
target/arm: migrate gcs syndromes to registerfields
target/arm: migrate wfx syndromes to registerfields
target/arm: migrate debug syndromes to registerfields
target/arm: migrate fault syndromes to registerfields
target/arm: migrate Granule Protection traps to registerfields
target/arm: migrate BXJ trap syndromes to registerfields
target/arm: migrate BTI trap syndromes to registerfields
target/arm: migrate PAC trap syndromes to registerfields
target/arm: migrate SME trap syndromes to registerfields
target/arm: migrate eret trap syndromes to registerfields
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* Bump the minimum GCC version to v10.4
* Make SMM code ready for the QEMU universal binary
* Convert TABs to spaces according to QEMU's coding style
* Fix use of pthread_get_name_np on OpenBSD
* Silence some warnings from pylint in the functional tests
* Fix a regression in the "register-array" device
* malloc cleanups
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmnvMekACgkQLtnXdP5w
# LbWojQ//W/6wgTiE07I4LkG4CNhC8K9kYZHePmq933V4aAAp8lsrTqods+bfbxZd
# ByWoXsDfkgzeWgn3mqrAUWq6rLJfGJ8NGcTFmg++BX0Oi8Y+1aQEG59wc5V/Ak+c
# 7yjyhSHorvyuYP70rx5HaIT/VbGFMzZrIRRUS8tY31W24+Y+rvwz3t+dsJi0m9Jx
# Gl64ZTbrADf7qo7RNBNV/ucw5k+b/armXNKcjIhGKxgSrSkog5g+MkSzB9aizWRU
# 3rNssfG3XXb+Adq9CGQw0knPu/gD10TclMex/yfZ61OEZ7yMjYwYQVrmjLL8S+ZE
# wDeUn6KyY7cG2APPJN5XzS8V6KvQ1z6Zigd9010LDAVn2nIGdEobYrnv5Fj5DcOA
# 1oNlnS7PRXxRIBycMba589S/TrOBTk8B9zDH+VCMmmJR3EKFO8e9ZKtXwU2ywVk2
# j2ay8desNVj+Ntso5CRUDmTtWJXLsKMZLFhzK1I7p/Upjue5drWd7GiT7rsZItde
# bMS6oEZM+LOpT/7kK3cndt2+km/6yYho5oVmpeugVW0rgT96uOXOyQuBtoT5S/7S
# uigqrzPYnogf7OvyqOhUeLyGm3I2itr/jNxDOCgf/53Zi85jLsgAJBn+Cxt4Hrym
# iAUpxbw1yfqT1UW4CrLpNdStFY443mhu9otFhpTYxbQ3T30nZGM=
# =zqWg
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 27 Apr 2026 05:52:41 EDT
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5
* tag 'pull-request-2026-04-27' of https://gitlab.com/thuth/qemu:
tests/functional/ppc/test_ppe42: Fix warning from the latest version of pylint
target/xtensa: Replace malloc() with g_strdup_printf()
hw/i386/fw_cfg: Use g_new() and g_new0() instead of g_malloc()
hw/core/register: add register_array_get_owner
tests/functional/qemu_test: Silence warnings from pylint in tesseract.py
util: fix use of pthread_get_name_np on OpenBSD
target: convert TABS indentation to spaces for consistency
target/i386/tcg/sysemu: Allow 32-bit SMM code to be used in the 64-bit binary
target/i386/tcg/sysemu: Move target specific SMM code to separate functions
meson.build: Bump the minimum GCC version to v10.4
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Instantiate LCDIF as a child object of the i.MX6UL SoC in init and
realize it in the SoC realize path before MMIO/IRQ hookup.
Also make FSL_IMX6UL select CONFIG_IMX6UL_LCDIF and map the LCDIF
region with a 16 KiB size to match the SoC memory map.
Signed-off-by: Yucai Liu <1486344514@qq.com>
Message-id: 20260412110240.93116-3-yangyanglan718@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Implement a basic i.MX6UL LCDIF controller model with MMIO registers,
frame-done interrupt behavior, and framebuffer-backed display updates
for RGB565 and XRGB8888 input formats.
Place the LCDIF device under hw/display and build it via a dedicated
CONFIG_IMX6UL_LCDIF symbol. Model register fields with
registerfields.h helpers and provide migration support via vmstate.
Signed-off-by: Yucai Liu <1486344514@qq.com>
Message-id: 20260412110240.93116-2-yangyanglan718@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
fdt_node_offset_by_compatible(fdt, -1, compat) only finds the first match.
If the blob has more than one node with the same compatible string, extra
nodes will remain active. Remove all the matching nodes, using the same
loop as imx8mp-evk.c does for this purpose.
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Message-id: 20260420162114.308519-1-osama.abdelkader@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
We want to remove AArch32 DBGDTRTX which was erroneously exposed.
This was attempted by 655659a74a ("target/arm: Correct encoding
of Debug Communications Channel registers") but it was discovered
that the removal of this debug register broke forward migration on
TCG. Now we have the cpreg migration tolerance infrastructure, we
can declare one for the DBGDTRTX. This allow to revert the reinstate
patch.
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260420140552.104369-7-eric.auger@redhat.com
[PMM: revised comment, included note about when we can drop
the workaround]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
KVM_REG_ARM_VENDOR_HYP_BMAP_2 pseudo FW register is exposed
from v6.15 onwards. Backward migration from a >= v6.15 to an older
kernel would fail without cpreg migration tolerance definition
for this register. If the register is present on source but not
on destination, its value must be checked to make sure it matches
the reset value, ie. 0, meaning no service is exposed to the guest,
hence the choice of a ToleranceOnlySrcTestValue migration
tolerance.
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260420140552.104369-6-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Before linux v6.13 those registers were erroneously unconditionally
exposed and this was fixed by commits:
- 0fcb4eea5345 ("KVM: arm64: Hide TCR2_EL1 from userspace when
disabled for guests")
- a68cddbe47ef ("KVM: arm64: Hide S1PIE registers from userspace
when disabled for guests")
in v6.13.
This means if we migrate from an old kernel host to a >= 6.13 kernel
host, migration currently fails.
Declare cpreg migration tolerance for those registers.
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260420140552.104369-5-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
We introduce a datatype for a tolerance with respect to a given
cpreg migration issue. The tolerance applies to a given cpreg kvm index,
and can be of different types:
a) mismatch in cpreg indexes
- ToleranceNotOnBothEnds (cpreg index is allowed to be only present
on one end)
- ToleranceOnlySrcTestValue (cpreg index is allowed to be only
present in source if its value @mask field matches @value)
b) mismatch in cpreg values
- ToleranceDiffInMask (value differences are allowed only within a mask)
- ToleranceFieldLT (incoming field value must be less than a given value)
- ToleranceFieldGT (incoming field value must be greater than a given value)
A QLIST of such tolerances can be populated using a new helper:
arm_register_cpreg_mig_tolerance() and arm_cpu_match_cpreg_mig_tolerance()
allows to check whether a tolerance exists for a given kvm index and its
criterion is matched.
callers for those helpers will be introduced in subsequent patches.
Only registration of migration tolerances related to cpreg index
mismatch is currently allowed.
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260420140552.104369-2-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Allow the 'aarch64=off' property, which is currently KVM-only, to
be set for TCG CPUs also.
Note that we don't permit it on the qemu-aarch64 user-mode binary:
this makes no sense as that executable can only handle AArch64
syscalls (and it would also assert at startup since it doesn't
compile in the A32-specific GDB xml files like arm-neon.xml).
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260416165353.589569-3-peter.maydell@linaro.org
If we create a normally-AArch64 CPU and configure it with
aarch64=off, this will by default leave all the AArch64 ID register
values in its ARMISARegisters struct untouched. That in turn means
that tests of cpu_isar_feature(aa64_something, cpu) will return true.
Until now we have had a design policy that you shouldn't check an
aa64_ feature unless you know that the CPU has AArch64; but this is
quite fragile as it's easy to forget and only causes a problem in the
corner case where AArch64 was turned off. In particular, when we
extend the ability to disable AArch64 from only KVM to also TCG there
are many more aa64 feature check points which we would otherwise have
to audit for whether they needed to be guarded with a check on
ARM_FEATURE_AARCH64.
Instead, make the CPU realize function zero out all the 64-bit ID
registers if a TCG CPU doesn't have AArch64; this will make aa64_
feature tests generally return false.
We only do this for TCG because only TCG really needs it, and for
KVM it might be confusing to have QEMU's idea of the ID registers
be different from KVM's.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260416165353.589569-2-peter.maydell@linaro.org
include/hw/arm/primecell.h used to be more expansive, but now the
only thing it defines is the ARM_SYSCTL_GPIO_* constants for the GPIO
lines for the arm-sysctl system-control device used on the Realview,
Versatile and Versatile Express boards.
Replace it with a header file specific to that device.
virt.c and vmapple.c included primecell.h despite not using the
constants it defined; there we can simply drop the include entirely.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260416172627.690396-1-peter.maydell@linaro.org
When writing to this register, QEMU currently aborts:
$ echo "readl 0x10000018" | ./qemu-system-arm -audiodev none,id=snd0 \
-M integratorcp,accel=qtest,audiodev=snd0 -display none -qtest stdio
[I 0.000000] OPENED
[R +0.001907] readl 0x10000018
qemu: hardware error: integratorcm_read: CM_LMBUSCNT
[...]
Aborted (core dumped)
This is bad, a guest should ideally never be able to kill QEMU like this.
Now, according to the "Intergrator/CP User Guide" from:
https://developer.arm.com/documentation/dui0159/b/porting-integrator-ap-and-im-pd1/registers
"The Integrator/AP CM_LMBUSCNT has been removed."
That means this register does not seem to be implemented on real CP boards
at all, only for older AP boards. Thus it should be fine if we simply
ignore this register in QEMU and handle it like all other unimplemented
registers in the "default" handler of the case statement.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3407
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260420064933.64765-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
