]> Git Repo - qemu.git/log
qemu.git
8 years agoarm: virt: Fix segmentation fault when specifying an unsupported CPU
Shannon Zhao [Fri, 20 Jan 2017 11:15:08 +0000 (11:15 +0000)]
arm: virt: Fix segmentation fault when specifying an unsupported CPU

Using -cpu cortex-a9 (or any other unsupported CPU) with the virt
board will cause QEMU to segmentation fault.  This bug was introduced
in commit 9ac4ef77, which incorrectly added a NULL terminator when
converting the VirtBoardInfo array into a simple array of strings
defining the valid CPUs. The cpuname_valid() loop already has
a termination condition based on ARRAY_SIZE, so the NULL is
spurious and causes the strcmp() to segfault if we reach it.
Delete the NULL.

Signed-off-by: Shannon Zhao <[email protected]>
Message-id: 1484619334[email protected]
[PMM: expanded commit message]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed: use first FMC flash as a boot ROM
Cédric Le Goater [Fri, 20 Jan 2017 11:15:08 +0000 (11:15 +0000)]
aspeed: use first FMC flash as a boot ROM

Create a ROM region, using the default size of the mapping window for
the CE0 FMC flash module, and fill it with the flash content.

This is a little hacky but until we can boot from a MMIO region, it
seems difficult to do anything else.

Signed-off-by: Cédric Le Goater <[email protected]>
Reviewed-by: Joel Stanley <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: extend tests for Command mode
Cédric Le Goater [Fri, 20 Jan 2017 11:15:08 +0000 (11:15 +0000)]
aspeed/smc: extend tests for Command mode

The Aspeed SMC controllers have a mode (Command mode) in which
accesses to the flash content are no different than doing MMIOs. The
controller generates all the necessary commands to load (or store)
data in memory.

So add a couple of tests doing direct reads and writes on the AHB bus.

Signed-off-by: Cédric Le Goater <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: reset flash after each test
Cédric Le Goater [Fri, 20 Jan 2017 11:15:08 +0000 (11:15 +0000)]
aspeed/smc: reset flash after each test

Let's make sure when each test is run that the flash object is in an
initial state and did not keep configuration from the previous tests.

Signed-off-by: Cédric Le Goater <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: handle SPI flash Command mode
Cédric Le Goater [Fri, 20 Jan 2017 11:15:08 +0000 (11:15 +0000)]
aspeed/smc: handle SPI flash Command mode

The Aspeed SMC controllers have a mode (Command mode) in which
accesses to the flash content are no different than doing MMIOs. The
controller generates all the necessary commands to load (or store)
data in memory.

However, accesses are restricted to the segment window assigned the
the flash module by the controller. This window is defined by the
Segment Address Register.

Signed-off-by: Cédric Le Goater <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Message-id: 1483979087[email protected]
[PMM: Deleted now-unused aspeed_smc_is_usermode() function]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: adjust the size of the register region
Cédric Le Goater [Fri, 20 Jan 2017 11:15:08 +0000 (11:15 +0000)]
aspeed/smc: adjust the size of the register region

The SPI controller of the AST2400 SoC has less registers. So we can
adjust the size of the memory region holding the registers depending
on the controller type. We can also remove the guest_error logging
which is useless as the range of the region is strict enough.

Signed-off-by: Cédric Le Goater <[email protected]>
Reviewed-by: Joel Stanley <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: unfold the AspeedSMCController array
Cédric Le Goater [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
aspeed/smc: unfold the AspeedSMCController array

This is getting difficult to read. Also add a 'has_dma' field for each
controller type.

Signed-off-by: Cédric Le Goater <[email protected]>
Reviewed-by: Joel Stanley <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: autostrap CE0/1 configuration
Cédric Le Goater [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
aspeed/smc: autostrap CE0/1 configuration

On the AST2500 SoC, the FMC controller flash type is fixed to SPI for
CE0 and CE1 and 4BYTE mode is autodetected for CE0.

On the AST2400 SoC, the FMC controller flash type and 4BYTE mode are
strapped with register SCU70. We use the default settings from the
palmetto-bmc machine for now.

Signed-off-by: Cédric Le Goater <[email protected]>
Reviewed-by: Joel Stanley <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: rework the prototype of the AspeedSMCFlash helper routines
Cédric Le Goater [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
aspeed/smc: rework the prototype of the AspeedSMCFlash helper routines

Change the routines prototype to use a 'AspeedSMCFlash *' instead of
'AspeedSMCState *'. The result will help in making future changes
clearer.

Also change aspeed_smc_update_cs() which uselessly loops on all slave
devices to update their status.

Signed-off-by: Cédric Le Goater <[email protected]>
Reviewed-by: Joel Stanley <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: remove call to aspeed_smc_update_cs() in reset function
Cédric Le Goater [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
aspeed/smc: remove call to aspeed_smc_update_cs() in reset function

Instead, we can simply set the irq level when unselecting the slave
devices. This change prepares ground for a subsequent cleanup of the
aspeed_smc_update_cs() routine which uselessly loops on all slaves to
update their status.

Signed-off-by: Cédric Le Goater <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoaspeed/smc: remove call to reset in realize function
Cédric Le Goater [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
aspeed/smc: remove call to reset in realize function

This is useless as reset will be called later on.

Signed-off-by: Cédric Le Goater <[email protected]>
Acked-by: Marcin Krzemiński <[email protected]>
Message-id: 1483979087[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agotarget/arm: Implement DBGVCR32_EL2 system register
Peter Maydell [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
target/arm: Implement DBGVCR32_EL2 system register

The DBGVCR_EL2 system register is needed to run a 32-bit
EL1 guest under a Linux EL2 64-bit hypervisor. Its only
purpose is to provide AArch64 with access to the state of
the DBGVCR AArch32 register. Since we only have a dummy
DBGVCR, implement a corresponding dummy DBGVCR32_EL2.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
8 years agotarget/arm: Handle VIRQ and VFIQ in arm_cpu_do_interrupt_aarch32()
Peter Maydell [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
target/arm: Handle VIRQ and VFIQ in arm_cpu_do_interrupt_aarch32()

To run a VM in 32-bit EL1 our AArch32 interrupt handling code
needs to be able to cope with VIRQ and VFIQ exceptions.
These behave like IRQ and FIQ except that we don't need to try
to route them to Monitor mode.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
8 years agoblock: m25p80: Improve 1GiB Micron flash definition
Marcin Krzeminski [Fri, 20 Jan 2017 11:15:07 +0000 (11:15 +0000)]
block: m25p80: Improve 1GiB Micron flash definition

n25q00 and mt25q01 devices share the same JEDEC ID. The difference
between those two devices is number of dies and one bit in extended
JEDEC bytes. This commit adds proper entry for both devices by
introduction the number of dies and and new 25q00 entries.

Signed-off-by: Marcin Krzeminski <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Message-id: 20170108083854[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoblock: m25p80: Introduce die erase command
Marcin Krzeminski [Fri, 20 Jan 2017 11:15:06 +0000 (11:15 +0000)]
block: m25p80: Introduce die erase command

Modern big flash NOR devices consist of more than one die.
Some of them do not support chip erase and instead have a die
erase command that can erase one die only. This commit adds
support for defining the number of dies in the chip, and adds
support for die erase command.

The NOR flash model is not strict, so no option to
disable chip erase has been added.

Signed-off-by: Marcin Krzeminski <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Message-id: 20170108083854[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoblock: m25p80: Add Quad Page Program 4byte
Marcin Krzeminski [Fri, 20 Jan 2017 11:15:06 +0000 (11:15 +0000)]
block: m25p80: Add Quad Page Program 4byte

Some flash chips have additional page program opcode that
takes only 4 byte address. This commit adds support
for such command in Qemu.

Signed-off-by: Marcin Krzeminski <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Message-id: 20170108083854[email protected]
Signed-off-by: Peter Maydell <[email protected]>
8 years agoarm: Uniquely name imx25 I2C buses.
Alastair D'Silva [Fri, 20 Jan 2017 11:15:06 +0000 (11:15 +0000)]
arm: Uniquely name imx25 I2C buses.

The imx25 chip provides 3 i2c buses, but they have all been named
"i2c", which makes it difficult to predict which bus a device will
be connected to when specified on the command line.

This patch addresses the issue by naming the buses uniquely:
  i2c-bus.0 i2c-bus.1 i2c-bus.2

Signed-off-by: Alastair D'Silva <[email protected]>
Message-id: 20170105043430[email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
8 years agovirtio-ccw: fix ring sizing
Michael S. Tsirkin [Thu, 12 Jan 2017 21:26:22 +0000 (23:26 +0200)]
virtio-ccw: fix ring sizing

Current code seems to assume ring size is
always decreased but this is not required by spec:
what spec says is just that size can not exceed
the maximum. Fix it up.

Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <1484256243[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: merge msix init functions
Yi Min Zhao [Tue, 13 Dec 2016 10:31:25 +0000 (18:31 +0800)]
s390x/pci: merge msix init functions

Currently there're two functions, s390_pci_setup_msix() and
s390_pci_msix_init(), for msix initialization, and being called once
for each zpci device plugging. Let's integrate them.

Moreover msix is mandatory in s390 architecture. So we ensure the pci
device being plugged supports msix. For vfio (which is the only tested
setup so far), nothing changes.

Signed-off-by: Yi Min Zhao <[email protected]>
Reviewed-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: handle PCIBridge bus number
Pierre Morel [Wed, 23 Nov 2016 06:26:34 +0000 (14:26 +0800)]
s390x/pci: handle PCIBridge bus number

The PCI bus number is usually set by the host during the enumeration.

In the s390 architecture we neither get a Device Tree nor have an
enumeration understanding bridge devices.

Let's fake the enumeration on reset and set the PCI_PRIMARY_BUS,
PCI_SECONDARY_BUS and PCI_SUBORDINATE_BUS config entries for the
bridges.

Let's add the configuration of these three config entries on bridge hot
plug.

The bus number is calculated based on a new entry, bus_num of the
S390pciState device.

This commit is inspired by what spapr pci does.

Signed-off-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: use hashtable to look up zpci via fh
Yi Min Zhao [Wed, 9 Nov 2016 13:30:50 +0000 (21:30 +0800)]
s390x/pci: use hashtable to look up zpci via fh

After PCI multibus is supported, more than 32 PCI devices could be
plugged. The current implementation of s390_pci_find_dev_by_fh()
appears low performance if there's a huge number of PCI devices
plugged. Therefore we introduce a hashtable using idx as key to store
zpci device's pointer on account of translating fh to idx very easily.

Signed-off-by: Yi Min Zhao <[email protected]>
Reviewed-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: PCI multibus bridge handling
Pierre Morel [Mon, 24 Oct 2016 12:50:35 +0000 (14:50 +0200)]
s390x/pci: PCI multibus bridge handling

When the hotplug handler detects a PCI bridge, the secondary bus has
been initialized by the core PCI code. We give the secondary bus the
bridge name and associate to it the IOMMU handling and
hotplug/hotunplug callbacks.

Signed-off-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: optimize calling s390_get_phb()
Yi Min Zhao [Wed, 23 Nov 2016 03:08:29 +0000 (11:08 +0800)]
s390x/pci: optimize calling s390_get_phb()

A function may recursively call device search functions or may call
serveral different device search function. Passing the S390pciState to
search functions as an argument instead of looking up it inside the
search functions lowers the number of calling s390_get_phb().

Signed-off-by: Yi Min Zhao <[email protected]>
Reviewed-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: change the device array to a list
Pierre Morel [Tue, 15 Nov 2016 07:51:38 +0000 (15:51 +0800)]
s390x/pci: change the device array to a list

In order to support a greater number of devices we use a QTAILQ
list of devices instead of a limited array.

This leads us to change:
- every lookup function s390_pci_find_xxx() for QTAILQ
- the FH_MASK_INDEX to index up to 65536 devices

Signed-off-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: dynamically allocate iommu
Yi Min Zhao [Thu, 8 Dec 2016 05:03:18 +0000 (13:03 +0800)]
s390x/pci: dynamically allocate iommu

When initializing a PCI device, an address space is required during PCI
core initialization and before the call to the embedding object hotplug
callback. To provide this AS, we allocate a S390PCIIOMMU object
containing this AS. Initialization of S390PCIIOMMU object is done
before the PCI device is completely created. So that we cannot
associate the IOMMU with the device at the moment. To track the IOMMU
object, we use g_hash functions with the PCI device's bus address as a
key to provide an array of pointers indexed by the PCI device's devfn
to the allocated IOMMU.

Signed-off-by: Yi Min Zhao <[email protected]>
Reviewed-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/pci: make S390PCIIOMMU inherit Object
Yi Min Zhao [Thu, 8 Dec 2016 05:02:24 +0000 (13:02 +0800)]
s390x/pci: make S390PCIIOMMU inherit Object

Currently S390PCIIOMMU is a normal struct. Let's make it inherit Object
in order to take advantage of QOM. In addition, we move some stuff
related to IOMMU from S390PCIBusDevice to S390PCIIOMMU.

Signed-off-by: Yi Min Zhao <[email protected]>
Acked-by: Pierre Morel <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x/kvm: use kvm_gsi_routing_enabled in flic
Fei Li [Fri, 25 Nov 2016 06:59:07 +0000 (07:59 +0100)]
s390x/kvm: use kvm_gsi_routing_enabled in flic

Let's use kvm_gsi_routing_enabled() to check if kvm supports
KVM_CAP_IRQ_ROUTING in order to avoid a needless ioctl invocation.

Signed-off-by: Fei Li <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agos390x: add compat machine for 2.9
Cornelia Huck [Wed, 30 Nov 2016 14:52:46 +0000 (15:52 +0100)]
s390x: add compat machine for 2.9

Signed-off-by: Cornelia Huck <[email protected]>
Acked-by: Christian Borntraeger <[email protected]>
8 years agos390x: remove double compat statement
Christian Borntraeger [Tue, 10 Jan 2017 13:44:31 +0000 (14:44 +0100)]
s390x: remove double compat statement

We chain our compat handler via the CCW_COMPAT macros and via the
class_init function. (e.g. ccw_machine_2_7_class_options calls
ccw_machine_2_8_class_options). As all class_init functions in that
chain call SET_MACHINE_COMPAT for their compat settings, and
SET_MACHINE_COMPAT will append there is no need to do that again.

Signed-off-by: Christian Borntraeger <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>
8 years agotap: fix memory leak on failure in net_init_tap()
Peter Maydell [Tue, 10 Jan 2017 19:21:54 +0000 (19:21 +0000)]
tap: fix memory leak on failure in net_init_tap()

Commit 091a6b2ac fixed most of the memory leaks in failure
paths in net_init_tap() reported by Coverity (CID 1356216),
but missed one. Fix it by deferring the allocation of
fds and vhost_fds until after the error check.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
8 years agohw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize
Alex Kompel [Fri, 6 Jan 2017 23:48:27 +0000 (15:48 -0800)]
hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to initialize

object_property_set_bool(OBJECT(dev), true, "realized", &err) in
pci_nic_init_nofail may release the object if device fails to
initialize which leads to use-after-free in error handling block.
qdev_init_nofail does the same thing while holding the reference.

(gdb) run -net nic
qemu-system-x86_64: failed to find romfile "efi-e1000.rom"

Program received signal SIGSEGV, Segmentation fault.
object_unparent (obj=0x7fffe96a0010) at qom/object.c:440
440     in qom/object.c
(gdb) bt
<nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>,
default_devaddr=<optimized out>) at hw/pci/pci.c:1812
pci_bus=0x5555567ed990) at hw/i386/pc.c:1634
pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e
"i440FX-pcihost") at hw/i386/pc_piix.c:241
out>, envp=<optimized out>) at vl.c:4481

Signed-off-by: Alex Kompel <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
8 years agohw/net/dp8393x: Avoid unintentional sign extensions on addresses
Peter Maydell [Mon, 9 Jan 2017 18:43:57 +0000 (18:43 +0000)]
hw/net/dp8393x: Avoid unintentional sign extensions on addresses

The dp8393x has several 32-bit values which are formed by concatenating
two 16 bit device register values. Attempting to do these inline
with ((s->reg[HI] << 16) | s->reg[LO]) can result in an unintended
sign extension because "x << 16" is of type 'int' even though s->reg
is unsigned, and so if the expression is used in a context where
it is cast to uint64_t the value is incorrectly sign-extended.
Fix this by using accessor functions with a uint32_t return type;
this also makes the code a bit easier to read.

This should fix Coverity issues 1307765130776613077671307768.

(To avoid having a ctda read function only used in a DPRINTF,
we move the DPRINTF down slightly so it can use the ttda function.)

Reviewed-by: Laurent Vivier <[email protected]>
Tested-by: Laurent Vivier <[email protected]>
Reviewed-by: Hervé Poussineau <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
8 years agom68k: QOMify the MCF Fast Ethernet Controller device
Thomas Huth [Sun, 8 Jan 2017 11:51:55 +0000 (12:51 +0100)]
m68k: QOMify the MCF Fast Ethernet Controller device

When running qemu-system-m68k with the "-net" parameter (for example
simply "-net nic -net user"), there is currently a confusing warning
message saying:

 Warning: requested NIC (anonymous, model mcf_fec) was not created
 (not supported by this machine?)

This seems to happen because the MCF NIC has never been adapted to
the currently expected QEMU device behavior. Thus let's QOMify the
NIC now to get rid of the warning message.

Signed-off-by: Thomas Huth <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
8 years agonet: optimize checksum computation
Ladi Prosek [Fri, 6 Jan 2017 08:08:53 +0000 (09:08 +0100)]
net: optimize checksum computation

Very simple loop optimization with a significant performance impact.

Microbenchmark results, modern x86-64:

buffer size | speed up
------------+---------
1500        | 1.7x
64          | 1.5x
8           | 1.15x

Microbenchmark results, POWER7:

buffer size | speed up
------------+---------
1500        | 5x
64          | 3.3x
8           | 1.13x

There is a lot of room for further improvement at the expense of
code complexity - aligned multibyte reads, LE/BE considerations,
architecture-specific optimizations, etc. This patch still keeps
things simple and readable.

Signed-off-by: Ladi Prosek <[email protected]>
Reviewed-by: Dmitry Fleytman <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
8 years agodocs: Fix description of the sentence
Zhang Chen [Thu, 1 Dec 2016 06:55:57 +0000 (14:55 +0800)]
docs: Fix description of the sentence

Say it in another way to make it easier to understand.

Signed-off-by: Zhang Chen <[email protected]>
Signed-off-by: Eric Blake <[email protected]>
Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
8 years agoRevert "win32: don't run subprocess tests on Mingw32 platform"
Marc-André Lureau [Wed, 4 Jan 2017 20:57:22 +0000 (21:57 +0100)]
Revert "win32: don't run subprocess tests on Mingw32 platform"

This reverts commit 7ad9339e372fcd12d584684d7f52ac259604a4f4.

The error "Failed to execute helper program (No such file or directory)"
is due to broken glib installation, missing windows gspawn helpers.

Signed-off-by: Marc-André Lureau <[email protected]>
Message-Id: <20170104205722[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agohax: add Darwin support
Vincent Palatin [Tue, 10 Jan 2017 10:59:58 +0000 (11:59 +0100)]
hax: add Darwin support

Re-add the MacOSX/Darwin support:
Use the Intel HAX is kernel-based hardware acceleration module
(similar to KVM on Linux).

Based on the original "target/i386: Add Intel HAX to android emulator" patch
from David Chou <[email protected]> from  emu-2.2-release branch in
the external/qemu-android repository.

Signed-off-by: Vincent Palatin <[email protected]>
Message-Id: <81b85c3032da902e73e77302af508b4b1a7c0ead.1484045952[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoPlumb the HAXM-based hardware acceleration support
Vincent Palatin [Tue, 10 Jan 2017 10:59:57 +0000 (11:59 +0100)]
Plumb the HAXM-based hardware acceleration support

Use the Intel HAX is kernel-based hardware acceleration module for
Windows (similar to KVM on Linux).

Based on the "target/i386: Add Intel HAX to android emulator" patch
from David Chou <[email protected]>

Signed-off-by: Vincent Palatin <[email protected]>
Message-Id: <7b9cae28a0c379ab459c7a8545c9a39762bd394f.1484045952[email protected]>
[Drop hax_populate_ram stub. - Paolo]
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agotarget/i386: Add Intel HAX files
Vincent Palatin [Tue, 10 Jan 2017 10:59:56 +0000 (11:59 +0100)]
target/i386: Add Intel HAX files

That's a forward port of the core HAX interface code from the
emu-2.2-release branch in the external/qemu-android repository as used by
the Android emulator.

The original commit was "target/i386: Add Intel HAX to android emulator"
saying:
"""
  Backport of 2b3098ff27bab079caab9b46b58546b5036f5c0c
  from studio-1.4-dev into emu-master-dev

    Intel HAX (harware acceleration) will enhance android emulator performance
    in Windows and Mac OS X in the systems powered by Intel processors with
    "Intel Hardware Accelerated Execution Manager" package installed when
    user runs android emulator with Intel target.

Signed-off-by: David Chou <[email protected]>
"""

It has been modified to build and run along with the current code base.
The formatting has been fixed to go through scripts/checkpatch.pl,
and the DPRINTF macros have been updated to get the instanciations checked by
the compiler.

The FPU registers saving/restoring has been updated to match the current
QEMU registers layout.

The implementation has been simplified by doing the following modifications:
- removing the code for supporting the hardware without Unrestricted Guest (UG)
  mode (including all the code to fallback on TCG emulation).
- not including the Darwin support (which is not yet debugged/tested).
- simplifying the initialization by removing the leftovers from the Android
  specific code, then trimming down the remaining logic.
- removing the unused MemoryListener callbacks.

Signed-off-by: Vincent Palatin <[email protected]>
Message-Id: <e1023837f8d0e4c470f6c4a3bf643971b2bca5be.1484045952[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agokvm: move cpu synchronization code
Vincent Palatin [Tue, 10 Jan 2017 10:59:55 +0000 (11:59 +0100)]
kvm: move cpu synchronization code

Move the generic cpu_synchronize_ functions to the common hw_accel.h header,
in order to prepare for the addition of a second hardware accelerator.

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Vincent Palatin <[email protected]>
Message-Id: <f5c3cffe8d520011df1c2e5437bb814989b48332.1484045952[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
8 years agoKVM: PPC: eliminate unnecessary duplicate constants
Paolo Bonzini [Thu, 19 Jan 2017 21:06:37 +0000 (22:06 +0100)]
KVM: PPC: eliminate unnecessary duplicate constants

These are not needed since linux-headers/ provides up-to-date definitions.
The constants are in linux-headers/asm-powerpc/kvm.h.

The sole users, hw/intc/xics_kvm.c and target/ppc/kvm.c, include asm/kvm.h
via sysemu/kvm.h->linux/kvm.h.

Signed-off-by: Paolo Bonzini <[email protected]>
8 years agovirtio: force VIRTIO_F_IOMMU_PLATFORM
Jason Wang [Tue, 17 Jan 2017 04:01:00 +0000 (12:01 +0800)]
virtio: force VIRTIO_F_IOMMU_PLATFORM

We allow vhost to clear VIRITO_F_IOMMU_PLATFORM which is wrong since
VIRTIO_F_IOMMU_PLATFORM is mandatory for security. Fixing this by
enforce it after vdc->get_features().

Signed-off-by: Jason Wang <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agovirtio: fix up max size checks
Michael S. Tsirkin [Wed, 18 Jan 2017 19:32:22 +0000 (21:32 +0200)]
virtio: fix up max size checks

Coverity reports that ARRAY_SIZE(elem->out_sg) (and all the others too)
is wrong because elem->out_sg is a pointer.

However, the check is not in the right place and the max_size argument
of virtqueue_map_iovec can be removed.  The check on in_num/out_num
should be moved to qemu_get_virtqueue_element instead, before the call
to virtqueue_alloc_element.

Cc: [email protected]
Reported-by: Paolo Bonzini <[email protected]>
Fixes: 3724650db07057333879484c8bc7d900b5c1bf8e ("virtio: introduce virtqueue_alloc_element")
Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Cornelia Huck <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/artyom/tags/pull-sun4v-20170118' into staging
Peter Maydell [Thu, 19 Jan 2017 18:34:13 +0000 (18:34 +0000)]
Merge remote-tracking branch 'remotes/artyom/tags/pull-sun4v-20170118' into staging

add OpenSPARC T1 emulation

# gpg: Signature made Wed 18 Jan 2017 22:25:47 GMT
# gpg:                using RSA key 0x3360C3F7411A125F
# gpg: Good signature from "Artyom Tarasenko <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 2AD8 6149 17F4 B2D7 05C0  BB12 3360 C3F7 411A 125F

* remotes/artyom/tags/pull-sun4v-20170118: (30 commits)
  target-sparc: fix up niagara machine
  target-sparc: move common cpu initialisation routines to sparc64.c
  target-sparc: implement sun4v RTC
  target-sparc: add ST_BLKINIT_ ASIs for UA2005+ CPUs
  target-sparc: store the UA2005 entries in sun4u format
  target-sparc: implement UA2005 ASI_MMU (0x21)
  target-sparc: add more registers to dump_mmu
  target-sparc: implement auto-demapping for UA2005 CPUs
  target-sparc: allow 256M sized pages
  target-sparc: simplify ultrasparc_tsb_pointer
  target-sparc: implement UA2005 TSB Pointers
  target-sparc: use SparcV9MMU type for sparc64 I/D-MMUs
  target-sparc: replace the last tlb entry when no free entries left
  target-sparc: ignore writes to UA2005 CPU mondo queue register
  target-sparc: allow priveleged ASIs in hyperprivileged mode
  target-sparc: use direct address translation in hyperprivileged mode
  target-sparc: fix immediate UA2005 traps
  target-sparc: implement UA2005 rdhpstate and wrhpstate instructions
  target-sparc: implement UA2005 GL register
  target-sparc: implement UA2005 hypervisor traps
  ...

Signed-off-by: Peter Maydell <[email protected]>
8 years agoerror: Report certain hints on stderr when no monitor
Marc-André Lureau [Thu, 5 Jan 2017 13:59:57 +0000 (14:59 +0100)]
error: Report certain hints on stderr when no monitor

Hints printed with error_printf_unless_qmp() are suppressed outside
monitor context.  Reproducer:

    $ qemu-system-x86_64 -m 1Z
    qemu-system-x86_64: -m 1Z: Parameter 'size' expects a size

Print to stderr instead.  The reproducer now additionally prints:

    You may use k, M, G or T suffixes for kilobytes, megabytes, gigabytes and terabytes.

Signed-off-by: Marc-André Lureau <[email protected]>
Message-Id: <20170105135957[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
[Commit message tweaked]
Signed-off-by: Markus Armbruster <[email protected]>
8 years agoerror: error_setg_errno(): errno gets preserved
Sascha Silbe [Wed, 27 Jul 2016 09:24:26 +0000 (11:24 +0200)]
error: error_setg_errno(): errno gets preserved

C11 allows errno to be clobbered by pretty much any library function
call, so in general callers need to take care to save errno before
calling other functions.

However, for error reporting functions this is rather awkward and can
make the code on the caller side more complicated than
necessary. error_setg_errno() already takes care of preserving errno
and some functions rely on that, so just promise that we continue to
do so in the future.

Signed-off-by: Sascha Silbe <[email protected]>
Message-Id: <1469611466[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Signed-off-by: Markus Armbruster <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-tcg-20170117' into staging
Peter Maydell [Thu, 19 Jan 2017 13:36:21 +0000 (13:36 +0000)]
Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20170117' into staging

tcg/i386 fixes

# gpg: Signature made Tue 17 Jan 2017 22:58:04 GMT
# gpg:                using RSA key 0xAD1270CC4DD0279B
# gpg: Good signature from "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"
# Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC  16A4 AD12 70CC 4DD0 279B

* remotes/rth/tags/pull-tcg-20170117:
  tcg/i386: Always use TZCNT when available
  Revert "tcg/i386: Rely on undefined/undocumented behaviour of BSF/BSR"

Signed-off-by: Peter Maydell <[email protected]>
8 years agotarget-sparc: fix up niagara machine
Artyom Tarasenko [Thu, 29 Sep 2016 12:46:45 +0000 (14:46 +0200)]
target-sparc: fix up niagara machine

Remove the Niagara stub implementation from sun4u.c and add a machine,
compatible with Legion simulator from the OpenSPARC T1 project.

The machine uses the firmware supplied with the OpenSPARC T1 project,
http://download.oracle.com/technetwork/systems/opensparc/OpenSPARCT1_Arch.1.5.tar.bz2
in the directory S10image/, and is able to boot the supplied Solaris 10 image.

Note that for compatibility with the naming conventions for SPARC machines
the new machine name is lowercase niagara.

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: move common cpu initialisation routines to sparc64.c
Artyom Tarasenko [Thu, 29 Sep 2016 12:02:19 +0000 (14:02 +0200)]
target-sparc: move common cpu initialisation routines to sparc64.c

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: implement sun4v RTC
Artyom Tarasenko [Wed, 2 Mar 2016 14:26:08 +0000 (15:26 +0100)]
target-sparc: implement sun4v RTC

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: add ST_BLKINIT_ ASIs for UA2005+ CPUs
Artyom Tarasenko [Wed, 2 Nov 2016 09:37:44 +0000 (10:37 +0100)]
target-sparc: add ST_BLKINIT_ ASIs for UA2005+ CPUs

In OpenSPARC T1+ TWINX ASIs in store instructions are aliased
with Block Initializing Store ASIs.

"UltraSPARC T1 Supplement Draft D2.1, 14 May 2007" describes them
in the chapter "5.9 Block Initializing Store ASIs"

Integer stores of all sizes are allowed with these ASIs.

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: store the UA2005 entries in sun4u format
Artyom Tarasenko [Fri, 3 Jun 2016 19:45:05 +0000 (21:45 +0200)]
target-sparc: store the UA2005 entries in sun4u format

According to chapter 13.3 of the
UltraSPARC T1 Supplement to the UltraSPARC Architecture 2005,
only the sun4u format is available for data-access loads.

Store UA2005 entries in the sun4u format to simplify processing.

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: implement UA2005 ASI_MMU (0x21)
Artyom Tarasenko [Mon, 18 Apr 2016 09:52:43 +0000 (11:52 +0200)]
target-sparc: implement UA2005 ASI_MMU (0x21)

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: add more registers to dump_mmu
Artyom Tarasenko [Sat, 16 Apr 2016 19:57:49 +0000 (21:57 +0200)]
target-sparc: add more registers to dump_mmu

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: implement auto-demapping for UA2005 CPUs
Artyom Tarasenko [Fri, 15 Apr 2016 20:21:43 +0000 (22:21 +0200)]
target-sparc: implement auto-demapping for UA2005 CPUs

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: allow 256M sized pages
Artyom Tarasenko [Thu, 3 Mar 2016 13:03:41 +0000 (14:03 +0100)]
target-sparc: allow 256M sized pages

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: simplify ultrasparc_tsb_pointer
Artyom Tarasenko [Thu, 23 Jun 2016 18:48:22 +0000 (20:48 +0200)]
target-sparc: simplify ultrasparc_tsb_pointer

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: implement UA2005 TSB Pointers
Artyom Tarasenko [Tue, 9 Feb 2016 09:58:49 +0000 (10:58 +0100)]
target-sparc: implement UA2005 TSB Pointers

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: use SparcV9MMU type for sparc64 I/D-MMUs
Artyom Tarasenko [Tue, 9 Feb 2016 11:07:48 +0000 (12:07 +0100)]
target-sparc: use SparcV9MMU type for sparc64 I/D-MMUs

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: replace the last tlb entry when no free entries left
Artyom Tarasenko [Tue, 26 Jan 2016 13:42:50 +0000 (14:42 +0100)]
target-sparc: replace the last tlb entry when no free entries left

Implement the behavior described in the chapter 13.9.11 of
UltraSPARC T1™ Supplement to the UltraSPARC Architecture 2005:

"If a TLB Data-In replacement is attempted with all TLB
entries locked and valid, the last TLB entry (entry 63) is
replaced."

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: ignore writes to UA2005 CPU mondo queue register
Artyom Tarasenko [Mon, 18 Apr 2016 13:30:48 +0000 (15:30 +0200)]
target-sparc: ignore writes to UA2005 CPU mondo queue register

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: allow priveleged ASIs in hyperprivileged mode
Artyom Tarasenko [Thu, 9 Jun 2016 09:03:33 +0000 (11:03 +0200)]
target-sparc: allow priveleged ASIs in hyperprivileged mode

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: use direct address translation in hyperprivileged mode
Artyom Tarasenko [Thu, 9 Jun 2016 08:16:03 +0000 (10:16 +0200)]
target-sparc: use direct address translation in hyperprivileged mode

Please note that QEMU doesn't impelement Real->Physical address
translation. The "Real Address" is always the "Physical Address".

Suggested-by: Richard Henderson <[email protected]>
Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: fix immediate UA2005 traps
Artyom Tarasenko [Wed, 8 Jun 2016 12:17:36 +0000 (14:17 +0200)]
target-sparc: fix immediate UA2005 traps

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: implement UA2005 rdhpstate and wrhpstate instructions
Artyom Tarasenko [Wed, 8 Jun 2016 12:14:36 +0000 (14:14 +0200)]
target-sparc: implement UA2005 rdhpstate and wrhpstate instructions

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: implement UA2005 GL register
Artyom Tarasenko [Tue, 7 Jun 2016 16:34:49 +0000 (18:34 +0200)]
target-sparc: implement UA2005 GL register

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: implement UA2005 hypervisor traps
Artyom Tarasenko [Tue, 7 Jun 2016 16:33:53 +0000 (18:33 +0200)]
target-sparc: implement UA2005 hypervisor traps

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: hypervisor mode takes over nucleus mode
Artyom Tarasenko [Wed, 2 Mar 2016 13:53:38 +0000 (14:53 +0100)]
target-sparc: hypervisor mode takes over nucleus mode

Accordinf to UA2005, 9.3.3 "Address Space Identifiers",

"In hyperprivileged mode, all instruction fetches and loads and stores with implicit
ASIs use a physical address, regardless of the value of TL".

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: implement UltraSPARC-T1 Strand status ASR
Artyom Tarasenko [Wed, 2 Mar 2016 13:45:19 +0000 (14:45 +0100)]
target-sparc: implement UltraSPARC-T1 Strand status ASR

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: implement UA2005 scratchpad registers
Artyom Tarasenko [Wed, 2 Mar 2016 13:36:20 +0000 (14:36 +0100)]
target-sparc: implement UA2005 scratchpad registers

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: simplify replace_tlb_entry by using TTE_PGSIZE
Artyom Tarasenko [Wed, 2 Mar 2016 13:01:20 +0000 (14:01 +0100)]
target-sparc: simplify replace_tlb_entry by using TTE_PGSIZE

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: on UA2005 don't deliver Interrupt_level_n IRQs in hypervisor mode
Artyom Tarasenko [Sun, 12 Jun 2016 20:19:43 +0000 (22:19 +0200)]
target-sparc: on UA2005 don't deliver Interrupt_level_n IRQs in hypervisor mode

As described in Chapter 5.7.6 of the UltraSPARC Architecture 2005,
outstanding disrupting exceptions that are destined for privileged mode can only
cause a trap when the virtual processor is in nonprivileged or privileged mode and
PSTATE.ie = 1. At all other times, they are held pending.

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: add UltraSPARC T1 TLB #defines
Artyom Tarasenko [Fri, 10 Jun 2016 08:44:15 +0000 (10:44 +0200)]
target-sparc: add UltraSPARC T1 TLB #defines

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: add UA2005 TTE bit #defines
Artyom Tarasenko [Wed, 2 Mar 2016 12:22:27 +0000 (13:22 +0100)]
target-sparc: add UA2005 TTE bit #defines

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: use explicit mmu register pointers
Artyom Tarasenko [Mon, 8 Feb 2016 21:40:34 +0000 (22:40 +0100)]
target-sparc: use explicit mmu register pointers

Use explicit register pointers while accessing D/I-MMU registers.
Call cpu_unassigned_access on access to missing registers.

Signed-off-by: Artyom Tarasenko <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
8 years agotarget-sparc: store cpu super- and hypervisor flags in TB
Artyom Tarasenko [Tue, 1 Nov 2016 20:57:01 +0000 (21:57 +0100)]
target-sparc: store cpu super- and hypervisor flags in TB

Suggested-by: Richard Henderson <[email protected]>
Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agotarget-sparc: ignore MMU-faults if MMU is disabled in hypervisor mode
Artyom Tarasenko [Mon, 23 Jan 2012 13:31:21 +0000 (14:31 +0100)]
target-sparc: ignore MMU-faults if MMU is disabled in hypervisor mode

while IMMU/DMMU is disabled
- ignore MMU-faults in hypervisorv mode or if CPU doesn't have hypervisor
- signal TT_INSN_REAL_TRANSLATION_MISS/TT_DATA_REAL_TRANSLATION_MISS otherwise

Signed-off-by: Artyom Tarasenko <[email protected]>
8 years agovhost: drop VHOST_F_DEVICE_IOTLB
Michael S. Tsirkin [Fri, 13 Jan 2017 16:27:21 +0000 (18:27 +0200)]
vhost: drop VHOST_F_DEVICE_IOTLB

Upstream does not have it, uses VIRTIO_F_IOMMU_PLATFORM
to signal support instead.

Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agoupdate-linux-headers.sh: support __bitwise
Michael S. Tsirkin [Fri, 13 Jan 2017 16:18:35 +0000 (18:18 +0200)]
update-linux-headers.sh: support __bitwise

In 4.10, Linux is switching from __bitwise__ to use __bitwise
exclusively. Update our script accordingly.

Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agovirtio_crypto: header update
Michael S. Tsirkin [Fri, 13 Jan 2017 16:16:12 +0000 (18:16 +0200)]
virtio_crypto: header update

Update header from latest linux driver.  Session creation structs gain
padding to make them same size. Formatting cleanups.

Signed-off-by: Michael S. Tsirkin <[email protected]>
Tested-by: Gonglei <[email protected]>
Reviewed-by: Gonglei <[email protected]>
8 years agopci_regs: update to latest linux
Michael S. Tsirkin [Fri, 13 Jan 2017 16:12:44 +0000 (18:12 +0200)]
pci_regs: update to latest linux

this drops a duplicate definition of
PCI_EXT_CAP_ATS_SIZEOF

Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agovirtio-mmio: switch to linux headers
Michael S. Tsirkin [Thu, 12 Jan 2017 22:14:55 +0000 (00:14 +0200)]
virtio-mmio: switch to linux headers

Switch to virtio_mmio.h from Linux - will make it
easier to implement virtio 1.

Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agovirtio_mmio: add standard header file
Michael S. Tsirkin [Thu, 12 Jan 2017 21:58:13 +0000 (23:58 +0200)]
virtio_mmio: add standard header file

Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agovirtio: drop an obsolete comment
Michael S. Tsirkin [Thu, 12 Jan 2017 21:19:40 +0000 (23:19 +0200)]
virtio: drop an obsolete comment

virtio core has code to revert queue number
to maximum on reset. Drop TODO to add that.

Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
8 years agofw-cfg: bump "x-file-slots" to 0x20 for 2.9+ machine types
Laszlo Ersek [Thu, 12 Jan 2017 18:24:17 +0000 (19:24 +0100)]
fw-cfg: bump "x-file-slots" to 0x20 for 2.9+ machine types

More precisely, the "x-file-slots" count is bumped for all machine types
that:
(a) use fw_cfg, and
(b) are not versioned (hence migration is not expected to work for them
    across QEMU releases anyway), or have version 2.9.

This affects machine types implemented in the following source files:

- "hw/arm/virt.c". The "virt-*" machine type is versioned, and the <= 2.8
  versions already depend on HW_COMPAT_2_8 (see commit e353aac51b944).
  Therefore adding the "x-file-slots" compat values to HW_COMPAT_2_8
  suffices.

- "hw/i386/pc.c". The "pc-i440fx-*" (including "pc-*") and "pc-q35-*"
  machine types are versioned. Modifying HW_COMPAT_2_8 is sufficient here
  too (see commit "pc: Add 2.9 machine-types"). The "isapc" machtype is
  not versioned. The "xenfv" machine type, which uses fw_cfg for direct
  kernel booting, is also not versioned.

- "hw/ppc/mac_newworld.c". The "mac99" machine type is not versioned.

- "hw/ppc/mac_oldworld.c". The "g3beige" machine type is not versioned.

- "hw/sparc/sun4m.c". None of the 9 machine types defined in this file
  appear versioned.

- "hw/sparc64/sun4u.c". None of the 3 machine types defined in this file
  appear versioned.

Cc: "Gabriel L. Somlo" <[email protected]>
Cc: "Michael S. Tsirkin" <[email protected]>
Cc: Alexander Graf <[email protected]>
Cc: Anthony Perard <[email protected]>
Cc: Artyom Tarasenko <[email protected]>
Cc: David Gibson <[email protected]>
Cc: Eduardo Habkost <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Cc: Igor Mammedov <[email protected]>
Cc: Mark Cave-Ayland <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Cc: Peter Maydell <[email protected]>
Cc: Stefano Stabellini <[email protected]>
Signed-off-by: Laszlo Ersek <[email protected]>
Acked-by: Gabriel Somlo <[email protected]>
Tested-by: Gabriel Somlo <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Eduardo Habkost <[email protected]>
8 years agopc: Add 2.9 machine-types
Eduardo Habkost [Thu, 12 Jan 2017 18:24:16 +0000 (19:24 +0100)]
pc: Add 2.9 machine-types

Cc: "Michael S. Tsirkin" <[email protected]>
Cc: Laszlo Ersek <[email protected]>
Cc: Igor Mammedov <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
Reviewed-by: Laszlo Ersek <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Acked-by: Gabriel Somlo <[email protected]>
Tested-by: Gabriel Somlo <[email protected]>
Cc: Gabriel Somlo <[email protected]>
Signed-off-by: Laszlo Ersek <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Eduardo Habkost <[email protected]>
8 years agofw-cfg: turn FW_CFG_FILE_SLOTS into a device property
Laszlo Ersek [Thu, 12 Jan 2017 18:24:15 +0000 (19:24 +0100)]
fw-cfg: turn FW_CFG_FILE_SLOTS into a device property

We'd like to raise the value of FW_CFG_FILE_SLOTS. Doing it naively could
lead to problems with backward migration: a more recent QEMU (running an
older machine type) would allow the guest, in fw_cfg_select(), to select a
high key value that is unavailable in the same machine type implemented by
the older (target) QEMU. On the target host, fw_cfg_data_read() for
example could dereference nonexistent entries.

As first step, size the FWCfgState.entries[*] and FWCfgState.entry_order
arrays dynamically. All three array sizes will be influenced by the new
field FWCfgState.file_slots (and matching device property).

Make the following changes:

- Replace the FW_CFG_FILE_SLOTS macro with FW_CFG_FILE_SLOTS_MIN (minimum
  count of fw_cfg file slots) in the header file. The value remains 0x10.

- Replace all uses of FW_CFG_FILE_SLOTS with a helper function called
  fw_cfg_file_slots(), returning the new property.

- Eliminate the macro FW_CFG_MAX_ENTRY, and replace all its uses with a
  helper function called fw_cfg_max_entry().

- In the MMIO- and IO-mapped realize functions both, allocate all three
  arrays dynamically, based on the new property.

- The new property defaults to FW_CFG_FILE_SLOTS_MIN. This is going to be
  customized in the following patches.

Cc: "Gabriel L. Somlo" <[email protected]>
Cc: "Michael S. Tsirkin" <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Cc: Igor Mammedov <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Signed-off-by: Laszlo Ersek <[email protected]>
Acked-by: Gabriel Somlo <[email protected]>
Tested-by: Gabriel Somlo <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Eduardo Habkost <[email protected]>
8 years agofw-cfg: support writeable blobs
Michael S. Tsirkin [Thu, 12 Jan 2017 18:24:14 +0000 (19:24 +0100)]
fw-cfg: support writeable blobs

Useful to send guest data back to QEMU.

Changes from Laszlo Ersek <[email protected]>:
- rebase the patch from Michael Tsirkin's original postings at [1] and [2]
  to the following patches:
  - loader: Allow a custom AddressSpace when loading ROMs
  - loader: Add AddressSpace loading support to uImages
  - loader: fix handling of custom address spaces when adding ROM blobs
- reject such writes immediately that would exceed the end of the array,
  rather than performing a partial write before setting the error bit: see
  the (len != dma.length) condition
- document the write interface

[1] http://lists.nongnu.org/archive/html/qemu-devel/2016-02/msg04968.html
[2] http://lists.nongnu.org/archive/html/qemu-devel/2016-03/msg02735.html

Cc: "Gabriel L. Somlo" <[email protected]>
Cc: "Michael S. Tsirkin" <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Cc: Igor Mammedov <[email protected]>
Cc: Michael Walle <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Cc: Peter Maydell <[email protected]>
Cc: Shannon Zhao <[email protected]>
Cc: [email protected]
Signed-off-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Laszlo Ersek <[email protected]>
Reviewed-by: Marcel Apfelbaum <[email protected]>
Acked-by: Gabriel Somlo <[email protected]>
Tested-by: Gabriel Somlo <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Eduardo Habkost <[email protected]>
8 years agovhost_net: device IOTLB support
Jason Wang [Wed, 11 Jan 2017 04:32:12 +0000 (12:32 +0800)]
vhost_net: device IOTLB support

This patches implements Device IOTLB support for vhost kernel. This is
done through:

1) switch to use dma helpers when map/unmap vrings from vhost codes
2) introduce a set of VhostOps to:
   - setting up device IOTLB request callback
   - processing device IOTLB request
   - processing device IOTLB invalidation
2) kernel support for Device IOTLB API:

- allow vhost-net to query the IOMMU IOTLB entry through eventfd
- enable the ability for qemu to update a specified mapping of vhost
- through ioctl.
- enable the ability to invalidate a specified range of iova for the
  device IOTLB of vhost through ioctl. In x86/intel_iommu case this is
  triggered through iommu memory region notifier from device IOTLB
  invalidation descriptor processing routine.

With all the above, kernel vhost_net can co-operate with userspace
IOMMU. For vhost-user, the support could be easily done on top by
implementing the VhostOps.

Cc: Michael S. Tsirkin <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agovirtio: disable notifications again after poll succeeded
Stefan Hajnoczi [Thu, 12 Jan 2017 11:46:11 +0000 (11:46 +0000)]
virtio: disable notifications again after poll succeeded

While AioContext is in polling mode virtqueue notifications are not
necessary.  Some device virtqueue handlers enable notifications.  Make
sure they stay disabled to avoid unnecessary vmexits.

Signed-off-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Tested-by: Richard Henderson <[email protected]>
Tested-by: Laszlo Ersek <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agoRevert "virtio: turn vq->notification into a nested counter"
Stefan Hajnoczi [Thu, 12 Jan 2017 11:46:10 +0000 (11:46 +0000)]
Revert "virtio: turn vq->notification into a nested counter"

This reverts commit aff8fd18f1786fc5af259a9bc0077727222f51ca.

Both virtio-net and virtio-crypto do not balance
virtio_queue_set_notification() enable and disable calls.  This makes
the notifications_disabled counter unreliable and Doug Goldstein
reported the following assertion failure:

  #3  0x00007ffff44d1c62 in __GI___assert_fail (
      assertion=assertion@entry=0x555555ae8e8a "vq->notification_disabled > 0",
      file=file@entry=0x555555ae89c0 "/home/doug/work/qemu/hw/virtio/virtio.c",
      line=line@entry=215,
      function=function@entry=0x555555ae9630 <__PRETTY_FUNCTION__.43707>
      "virtio_queue_set_notification") at assert.c:101
  #4  0x00005555557f25d6 in virtio_queue_set_notification (vq=0x55555666aa90,
      enable=enable@entry=1) at /home/doug/work/qemu/hw/virtio/virtio.c:215
  #5  0x00005555557dc311 in virtio_net_has_buffers (q=<optimized out>,
      q=<optimized out>, bufsize=102)
      at /home/doug/work/qemu/hw/net/virtio-net.c:1008
  #6  virtio_net_receive (nc=<optimized out>, buf=0x555557386b88 "", size=102)
      at /home/doug/work/qemu/hw/net/virtio-net.c:1148
  #7  0x00005555559cad33 in nc_sendv_compat (flags=<optimized out>, iovcnt=1,
      iov=0x7fffead746d0, nc=0x55555788b340) at net/net.c:705
  #8  qemu_deliver_packet_iov (sender=<optimized out>, flags=<optimized out>,
      iov=0x7fffead746d0, iovcnt=1, opaque=0x55555788b340) at net/net.c:732
  #9  0x00005555559cd929 in qemu_net_queue_deliver (size=<optimized out>,
      data=<optimized out>, flags=<optimized out>, sender=<optimized out>,
      queue=0x55555788b550) at net/queue.c:164
  #10 qemu_net_queue_flush (queue=0x55555788b550) at net/queue.c:261

This patch is safe to revert since it's just an optimization for
virtqueue polling.  The next patch will improve the situation again
without resorting to nesting.

Reported-by: Doug Goldstein <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Tested-by: Richard Henderson <[email protected]>
Tested-by: Laszlo Ersek <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agovirtio-net: enable ioeventfd even if vhost=off
Paolo Bonzini [Wed, 11 Jan 2017 08:38:15 +0000 (09:38 +0100)]
virtio-net: enable ioeventfd even if vhost=off

virtio-net-pci does not enable ioeventfd for historical reasons (and
nobody ever checked whether it should be revisited).  Note that other
backends do enable ioeventfd for virtio-net.

However, it has a major effect on performance.  On Windows, throughput is
_multiplied_ by 2 or 3 on TCP_STREAM (on small packets it is "only" a 30%
improvement) and a little less so on TCP_MAERTS albeit still very much
statistically significant.  Latency also has a single digit improvement.

This is not visible when using vhost, which forces ioeventfd=on, but it
is substantial without vhost.  In addition, also on Windows and with the
RHEL 7.3 kernel, APICv seems to slow down virtio-net performance a bit,
but the penalty with this patch goes from -25% to -7%.

Signed-off-by: Paolo Bonzini <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
8 years agotcg/i386: Always use TZCNT when available
Richard Henderson [Tue, 17 Jan 2017 20:02:08 +0000 (12:02 -0800)]
tcg/i386: Always use TZCNT when available

I think this is cleaner than sometimes using BSF.

Signed-off-by: Richard Henderson <[email protected]>
8 years agoRevert "tcg/i386: Rely on undefined/undocumented behaviour of BSF/BSR"
Richard Henderson [Tue, 17 Jan 2017 19:38:22 +0000 (11:38 -0800)]
Revert "tcg/i386: Rely on undefined/undocumented behaviour of BSF/BSR"

This reverts commit 4ac76910734209dab83ddd3795f08fc7889ef463.

This fixes
  http://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg03062.html

While I think we could get away with relying on the undocumented
behaviour, the tcg constraint system isn't powerful enough to
properly describe the required (non-)overlap conditions.

Reported-by: Eduardo Habkost <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
Peter Maydell [Tue, 17 Jan 2017 16:54:09 +0000 (16:54 +0000)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

# gpg: Signature made Mon 16 Jan 2017 13:44:46 GMT
# gpg:                using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg:                 aka "Stefan Hajnoczi <[email protected]>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/tracing-pull-request:
  trace: Add event "guest_cpu_exit"
  trace: Fix dynamic event state on vCPU hot-unplug
  trace: Lock vCPU list when initializing dynamic tracing state
  trace-events: spelling fix

Signed-off-by: Peter Maydell <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-01-16' into staging
Peter Maydell [Tue, 17 Jan 2017 13:53:50 +0000 (13:53 +0000)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-01-16' into staging

QAPI patches for 2017-01-16

# gpg: Signature made Mon 16 Jan 2017 09:26:49 GMT
# gpg:                using RSA key 0x3870B400EB918653
# gpg: Good signature from "Markus Armbruster <[email protected]>"
# gpg:                 aka "Markus Armbruster <[email protected]>"
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-qapi-2017-01-16: (180 commits)
  build-sys: add qapi doc generation targets
  build-sys: add txt documentation rules
  build-sys: use a generic TEXI2MAN rule
  build-sys: remove dvi doc generation
  build-sys: use --no-split for info
  docs: add qemu logo to pdf
  qapi: add qapi2texi script
  qmp-events: move 'MIGRATION_PASS' doc to schema
  qmp-events: move 'DUMP_COMPLETED' doc to schema
  qmp-events: move 'MEM_UNPLUG_ERROR' doc to schema
  qmp-events: move 'VSERPORT_CHANGE' doc to schema
  qmp-events: move 'QUORUM_REPORT_BAD' doc to schema
  qmp-events: move 'QUORUM_FAILURE' doc to schema
  qmp-events: move 'GUEST_PANICKED' doc to schema
  qmp-events: move 'BALLOON_CHANGE' doc to schema
  qmp-events: move 'ACPI_DEVICE_OST' doc to schema
  qmp-events: move 'MIGRATION' doc to schema
  qmp-events: move 'SPICE_MIGRATE_COMPLETED' doc to schema
  qmp-events: move 'SPICE_DISCONNECTED' doc to schema
  qmp-events: move 'SPICE_INITIALIZED' doc to schema
  ...

Signed-off-by: Peter Maydell <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Tue, 17 Jan 2017 11:20:27 +0000 (11:20 +0000)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

# gpg: Signature made Mon 16 Jan 2017 13:38:52 GMT
# gpg:                using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg:                 aka "Stefan Hajnoczi <[email protected]>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  async: optimize aio_bh_poll
  aio: document locking
  aio-win32: remove walking_handlers, protecting AioHandler list with list_lock
  aio-posix: remove walking_handlers, protecting AioHandler list with list_lock
  aio: tweak walking in dispatch phase
  aio-posix: split aio_dispatch_handlers out of aio_dispatch
  qemu-thread: optimize QemuLockCnt with futexes on Linux
  aio: make ctx->list_lock a QemuLockCnt, subsuming ctx->walking_bh
  qemu-thread: introduce QemuLockCnt
  aio: rename bh_lock to list_lock
  block: get rid of bdrv_io_unplugged_begin/end

Signed-off-by: Peter Maydell <[email protected]>
8 years agoMerge remote-tracking branch 'remotes/stsquad/tags/pull-tcg-common-tlb-reset-20170113...
Peter Maydell [Mon, 16 Jan 2017 18:23:02 +0000 (18:23 +0000)]
Merge remote-tracking branch 'remotes/stsquad/tags/pull-tcg-common-tlb-reset-20170113-r1' into staging

This is the same as the v3 posted except a re-base and a few extra signoffs

# gpg: Signature made Fri 13 Jan 2017 14:26:46 GMT
# gpg:                using RSA key 0xFBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <[email protected]>"
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* remotes/stsquad/tags/pull-tcg-common-tlb-reset-20170113-r1:
  cputlb: drop flush_global flag from tlb_flush
  cpu_common_reset: wrap TCG specific code in tcg_enabled()
  qom/cpu: move tlb_flush to cpu_common_reset

Signed-off-by: Peter Maydell <[email protected]>
8 years agoramblock-notifier: new
Paolo Bonzini [Tue, 20 Dec 2016 16:31:36 +0000 (00:31 +0800)]
ramblock-notifier: new

This adds a notify interface of ram block additions and removals.

Signed-off-by: Paolo Bonzini <[email protected]>
8 years agochar: fix ctrl-a b not working
Marc-André Lureau [Tue, 10 Jan 2017 11:06:21 +0000 (12:06 +0100)]
char: fix ctrl-a b not working

CharDriverState.be should be updated to point to the current
associated backend.

Fix the regression introduced in the "mux" chardev from commit
a4afa548fc6dd9842ed86639b4d37d4d1c4ad480.

https://bugs.launchpad.net/bugs/1654137

Signed-off-by: Marc-André Lureau <[email protected]>
Message-Id: <20170110110621[email protected]>
Cc: [email protected]
Signed-off-by: Paolo Bonzini <[email protected]>
This page took 0.092198 seconds and 4 git commands to generate.