Peter Maydell [Tue, 8 Mar 2016 10:25:50 +0000 (10:25 +0000)]
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
# gpg: Signature made Tue 08 Mar 2016 07:46:08 GMT using RSA key ID 398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <[email protected]>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211
* remotes/jasowang/tags/net-pull-request:
net: check packet payload length
filter-buffer: Add status_changed callback processing
filter: Add 'status' property for filter object
rocker: allow user to specify rocker world by property
rocker: add name field into WorldOps ale let world specify its name
rocker: return -ENOMEM in case of some world alloc fails
rocker: forbid to change world type
net: netmap: probe netmap interface for virtio-net header
net: simplify net_init_tap_one logic
MAINTAINERS: Add entries for include/net/ files
net: filter: correctly remove filter from the list during finalization
net: ne2000: check ring buffer control registers
While computing IP checksum, 'net_checksum_calculate' reads
payload length from the packet. It could exceed the given 'data'
buffer size. Add a check to avoid it.
While the status of filter-buffer changing from 'on' to 'off',
it need to release all the buffered packets, and delete the related
timer, while switch from 'off' to 'on', it need to resume the release
packets timer.
Here, we extract the process of setup timer into a new helper,
which will be used in the new status_changed callback.
net: netmap: probe netmap interface for virtio-net header
Previous implementation of has_ufo, has_vnet_hdr, has_vnet_hdr_len, etc.
did not really probe for virtio-net header support for the netmap
interface attached to the backend. These callbacks were correct for
VALE ports, but incorrect for hardware NICs, pipes, monitors, etc.
This patch fixes the implementation to work properly with all kinds
of netmap ports.
Paolo Bonzini [Thu, 25 Feb 2016 23:05:57 +0000 (00:05 +0100)]
net: simplify net_init_tap_one logic
net_init_tap_one receives in vhostfdname a fd name from vhostfd= or
vhostfds=, or NULL if there is no vhostfd=/vhostfds=. It is simpler
to just check vhostfdname, than it is to check for vhostfd= or
vhostfds=. This also calms down Coverity, which otherwise thinks
that monitor_fd_param could dereference a NULL vhostfdname.
Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
bytes to process network packets. Registers PSTART & PSTOP
define ring buffer size & location. Setting these registers
to invalid values could lead to infinite loop or OOB r/w
access issues. Add check to avoid it.
Peter Maydell [Tue, 8 Mar 2016 04:53:36 +0000 (04:53 +0000)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
* RAMBlock vs. MemoryRegion cleanups from Fam
* mru_section optimization from Fam
* memory.txt improvements from Peter and Xiaoqiang
* i8257 fix from Hervé
* -daemonize fix
* Cleanups and small fixes from Alex, Praneith, Wei
# gpg: Signature made Mon 07 Mar 2016 17:08:59 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <[email protected]>"
# gpg: aka "Paolo Bonzini <[email protected]>"
* remotes/bonzini/tags/for-upstream:
scsi-bus: Remove tape command from scsi_req_xfer
kvm/irqchip: use bitmap utility for gsi tracking
MAINTAINERS: Add entry for include/sysemu/kvm*.h
doc/memory.txt: correct description of MemoryRegionOps fields
doc/memory.txt: correct a logic error
icount: possible options for sleep are on or off
exec: Introduce AddressSpaceDispatch.mru_section
exec: Factor out section_covers_addr
exec: Pass RAMBlock pointer to qemu_ram_free
memory: Drop MemoryRegion.ram_addr
memory: Implement memory_region_get_ram_addr with mr->ram_block
memory: Move assignment to ram_block to memory_region_init_*
exec: Return RAMBlock pointer from allocating functions
i8257: fix Terminal Count status
log: do not log if QEMU is daemonized but without -D
Alex Pyrgiotis [Mon, 7 Mar 2016 15:50:22 +0000 (15:50 +0000)]
scsi-bus: Remove tape command from scsi_req_xfer
Remove the RECOVER_BUFFERED_DATA command from the list of commands that
are handled by scsi_req_xfer(). Given that this command is
tape-specific, it should be handled only by scsi_stream_req_xfer().
Peter Maydell [Fri, 26 Feb 2016 08:40:51 +0000 (16:40 +0800)]
doc/memory.txt: correct description of MemoryRegionOps fields
Probably what happened was that when the API was being designed it
started off with an 'aligned' field, and then later the field name
and semantics were changed but the docs weren't updated to match.
Similarly, cpu_register_io_memory() does not exist anymore, so
clarify the documentation for .old_mmio.
Fam Zheng [Tue, 1 Mar 2016 06:18:24 +0000 (14:18 +0800)]
exec: Introduce AddressSpaceDispatch.mru_section
Under heavy workloads the lookup will likely end up with the same
MemoryRegionSection from last time. Using a pointer to cache the result,
like ram_list.mru_block, significantly reduces cost of
address_space_translate.
During address space topology update, as->dispatch will be reallocated
so the pointer is invalidated automatically.
Perf reports a visible drop on the cpu usage, because phys_page_find is
not called. Before:
Fam Zheng [Tue, 1 Mar 2016 06:18:19 +0000 (14:18 +0800)]
memory: Move assignment to ram_block to memory_region_init_*
We don't force "const" qualifiers with pointers in QEMU, but it's still
good to keep a clean function interface. Assigning to mr->ram_block is
in this sense ugly - one initializer mutating its owning object's state.
Move it to memory_region_init_*, where mr->ram_addr is assigned.
Hervé Poussineau [Thu, 25 Feb 2016 12:45:32 +0000 (13:45 +0100)]
i8257: fix Terminal Count status
When a DMA transfer is done (ie all bytes have been transfered), the corresponding
Terminal Count bit must be set in the status register.
This bit is already cleared in i8257_read_cont and i8257_write_cont when required.
This fixes (at least) floppy transfer in IBM 40p firmware, which checks in DMA
controller if everything went fine.
Paolo Bonzini [Mon, 29 Feb 2016 11:18:40 +0000 (12:18 +0100)]
log: do not log if QEMU is daemonized but without -D
Commit 96c33a4 ("log: Redirect stderr to logfile if deamonized",
2016-02-22) wanted to move stderr of a daemonized QEMU to the file
specified with -D.
However, if -D was not passed, the patch had the side effect of not
redirecting stderr to /dev/null. This happened because qemu_logfile
was set to stderr rather than the expected value of NULL. The fix
is simply in the "if" condition of do_qemu_set_log; the "if" for
closing the file is also changed to match.
Peter Maydell [Sun, 6 Mar 2016 11:53:27 +0000 (11:53 +0000)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2016-03-04' into staging
QAPI patches for 2016-03-04
# gpg: Signature made Sat 05 Mar 2016 09:47:19 GMT using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <[email protected]>"
# gpg: aka "Markus Armbruster <[email protected]>"
* remotes/armbru/tags/pull-qapi-2016-03-04:
qapi: Drop useless 'data' member of unions
chardev: Drop useless ChardevDummy type
qapi: Avoid use of 'data' member of QAPI unions
ui: Shorten references into InputEvent
util: Shorten references into SocketAddress
chardev: Shorten references into ChardevBackend
qapi: Update docs to match recent generator changes
qapi-visit: Expose visit_type_FOO_members()
qapi: Rename 'fields' to 'members' in generated C code
qapi: Rename 'fields' to 'members' in generator
qapi-dealloc: Reduce use outside of generated code
qmp-shell: fix pretty printing of JSON responses
Eric Blake [Thu, 3 Mar 2016 16:16:52 +0000 (09:16 -0700)]
qapi: Drop useless 'data' member of unions
We started moving away from the use of the 'void *data' member
in the C union corresponding to a QAPI union back in commit 544a373; recent commits have gotten rid of other uses. Now
that it is completely unused, we can remove the member itself
as well as the FIXME comment. Update the testsuite to drop the
negative test union-clash-data.
Eric Blake [Fri, 4 Mar 2016 15:42:40 +0000 (08:42 -0700)]
chardev: Drop useless ChardevDummy type
Commit d0d7708b made ChardevDummy be an empty wrapper type around
ChardevCommon. But there is no technical reason for this indirection,
so simplify the code by directly using the base type.
Also change the fallback assignment to assign u.null rather than
u.data, since a future patch will remove the data member of the C
struct generated for QAPI unions.
Eric Blake [Thu, 3 Mar 2016 16:16:50 +0000 (09:16 -0700)]
qapi: Avoid use of 'data' member of QAPI unions
QAPI code generators currently create a 'void *data' member as
part of the anonymous union embedded in the C struct corresponding
to a QAPI union. However, directly assigning to this member of
the union feels a bit fishy, when we can assign to another member
of the struct instead.
Eric Blake [Thu, 3 Mar 2016 16:16:49 +0000 (09:16 -0700)]
ui: Shorten references into InputEvent
An upcoming patch will alter how simple unions, like InputEvent, are
laid out, which will impact all lines of the form 'evt->u.XXX'
(expanding it to the longer 'evt->u.XXX.data'). For better
legibility in that patch, and less need for line wrapping, it's better
to use a temporary variable to reduce the effect of a layout change to
just the variable initializations, rather than every reference within
an InputEvent.
There was one instance in hid.c:hid_pointer_event() where the code
was referring to evt->u.rel inside the case label where evt->u.abs
is the correct name; thankfully, both members of the union have the
same type, so it happened to work, but it is now cleaner.
Eric Blake [Thu, 3 Mar 2016 16:16:48 +0000 (09:16 -0700)]
util: Shorten references into SocketAddress
An upcoming patch will alter how simple unions, like SocketAddress,
are laid out, which will impact all lines of the form 'addr->u.XXX'
(expanding it to the longer 'addr->u.XXX.data'). For better
legibility in that patch, and less need for line wrapping, it's better
to use a temporary variable to reduce the effect of a layout change to
just the variable initializations, rather than every reference within
a SocketAddress. Also, take advantage of some C99 initialization where
it makes sense (simplifying g_new0() to g_new()).
Eric Blake [Thu, 3 Mar 2016 16:16:47 +0000 (09:16 -0700)]
chardev: Shorten references into ChardevBackend
An upcoming patch will alter how simple unions, like ChardevBackend,
are laid out, which will impact all lines of the form 'backend->u.XXX'
(expanding it to the longer 'backend->u.XXX.data'). For better
legibility in that patch, and less need for line wrapping, it's better
to use a temporary variable to reduce the effect of a layout change to
just the variable initializations, rather than every reference within
a ChardevBackend. It doesn't hurt that this also makes the code more
consistent: some clients touched here already had a temporary variable
but weren't using it.
Eric Blake [Thu, 3 Mar 2016 16:16:46 +0000 (09:16 -0700)]
qapi: Update docs to match recent generator changes
Several commits have been changing the generator, but not updating
the docs to match:
- The implicit tag member is named "type", not "kind". Screwed up in
commit 39a1815.
- Commit 9f08c8ec made list types lazy, and thereby dropped
UserDefOneList if nothing explicitly uses the list type.
- Commit 51e72bc1 switched the parameter order with 'name' occurring
earlier.
- Commit e65d89bf changed the layout of UserDefOneList.
- Prefer the term 'member' over 'field'.
- We now expose visit_type_FOO_members() for objects.
- etc.
Rework the examples to show slightly more output (we don't want to
show too much; that's what the testsuite is for), and regenerate the
output to match all recent changes. Also, rearrange output to show
.h files before .c (understanding the interface first often makes
the implementation easier to follow).
Eric Blake [Thu, 3 Mar 2016 16:16:45 +0000 (09:16 -0700)]
qapi-visit: Expose visit_type_FOO_members()
Dan Berrange reported a case where he needs to work with a
QCryptoBlockOptions union type using the OptsVisitor, but only
visit one of the branches of that type (the discriminator is not
visited directly, but learned externally). When things were
boxed, it was easy: just visit the variant directly, which took
care of both allocating the variant and visiting its members, then
store that pointer in the union type. But now that things are
unboxed, we need a way to visit the members without allocation,
done by exposing visit_type_FOO_members() to the user.
Before the patch, we had quite a bit of code associated with
object_members_seen to make sure that a declaration of the helper
was in scope before any use of the function. But now that the
helper is public and declared in the header, the .c file no
longer needs to worry about topological sorting (the helper is
always in scope), which leads to some nice cleanups.
Eric Blake [Thu, 3 Mar 2016 16:16:44 +0000 (09:16 -0700)]
qapi: Rename 'fields' to 'members' in generated C code
C types and JSON objects don't have fields, but members. We
shouldn't gratuitously invent terminology. This patch is a
strict renaming of static genarated functions, plus the naming
of the dummy filler member for empty structs, before the next
patch exposes some of that naming to the rest of the code base.
Eric Blake [Thu, 3 Mar 2016 16:16:43 +0000 (09:16 -0700)]
qapi: Rename 'fields' to 'members' in generator
C types and JSON objects don't have fields, but members. We
shouldn't gratuitously invent terminology. This patch is a
strict renaming of generator code internals (including testsuite
comments), before later patches rename C interfaces.
Eric Blake [Tue, 23 Feb 2016 21:14:33 +0000 (14:14 -0700)]
qapi-dealloc: Reduce use outside of generated code
No need to roll our own use of the dealloc visitors when we can
just directly use the qapi_free_FOO() functions that do what we
want in one line.
In net.c, inline net_visit() into its remaining lone caller.
After this patch, test-visitor-serialization.c is the only
non-generated file that needs to use a dealloc visitor, because
it is testing low level aspects of the visitor interface.
Pretty printing of JSON responses is important to be able to understand
large responses from query commands in particular. Unfortunately this
was broken during the addition of the verbose flag in
This is because that change turned the python data structure into a
formatted JSON string before the pretty print was given it. So we're
just pretty printing a string, which is a no-op.
The original pretty printer would output python objects.
This fixes the problem by switching to outputting pretty formatted JSON
text instead. This has the added benefit that the pretty printed output
is now valid JSON text. Due to the way the verbose flag was handled, the
pretty printing now applies to the command sent, as well as its response:
Peter Maydell [Fri, 4 Mar 2016 11:46:32 +0000 (11:46 +0000)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160304' into staging
target-arm queue:
* Correct handling of writes to CPSR from gdbstub in user mode
* virt: lift maximum RAM limit to 255GB
* sdhci: implement reset
* virt: if booting in Secure mode, provide secure-only RAM, make first
flash device secure-only, and assume the EL3 boot rom will handle PSCI
* bcm2835: use explicit endianness accessors rather than ldl/stl_phys
* support big-endian in system mode for ARM
* implement SETEND instruction
* arm_gic: implement the GICv2 GICC_DIR register
* fix SRS bug: only trap from S-EL1 to EL3 if specified mode is Mon
* remotes/pmaydell/tags/pull-target-arm-20160304: (30 commits)
target-arm: Only trap SRS from S-EL1 if specified mode is MON
hw/intc/arm_gic.c: Implement GICv2 GICC_DIR
arm: boot: Support big-endian elfs
loader: Add data swap option to load-elf
loader: load_elf(): Add doc comment
loader: add API to load elf header
target-arm: implement BE32 mode in system emulation
target-arm: implement setend
target-arm: introduce tbflag for endianness
target-arm: a64: Add endianness support
target-arm: introduce disas flag for endianness
target-arm: pass DisasContext to gen_aa32_ld*/st*
target-arm: implement SCTLR.EE
linux-user: arm: handle CPSR.E correctly in strex emulation
linux-user: arm: set CPSR.E/SCTLR.E0E correctly for BE mode
arm: cpu: handle BE32 user-mode as BE
target-arm: cpu: Move cpu_is_big_endian to header
target-arm: implement SCTLR.B, drop bswap_code
linux-user: arm: pass env to get_user_code_*
linux-user: arm: fix coding style for some linux-user signal functions
...
target-arm: Only trap SRS from S-EL1 if specified mode is MON
Commit cbc0326b6fb9 caused SRS instructions executed from Secure
EL1 to trap to EL3 even if the specified mode was not monitor mode.
According to the ARMv8 Architecture reference manual [F6.1.203], ALL
of the following conditions need to be met for SRS to trap to EL3:
* It is executed at Secure PL1.
* The specified mode is monitor mode.
* EL3 is using AArch64.
Correct the condition governing the trap to EL3 to check the
specified mode.
Peter Maydell [Fri, 4 Mar 2016 11:30:22 +0000 (11:30 +0000)]
hw/intc/arm_gic.c: Implement GICv2 GICC_DIR
The GICv2 introduces a new CPU interface register GICC_DIR, which
allows an OS to split the "priority drop" and "deactivate interrupt"
parts of interrupt completion. Implement this register.
(Note that the register is at offset 0x1000 in the CPU interface,
which means it is on a different 4K page from all the other registers.)
Support ARM big-endian ELF files in system-mode emulation. When loading
an elf, determine the endianness mode expected by the elf, and set the
relevant CPU state accordingly.
With this, big-endian modes are now fully supported via system-mode LE,
so there is no need to restrict the elf loading to the TARGET
endianness so the ifdeffery on TARGET_WORDS_BIGENDIAN goes away.
Some CPUs are of an opposite data-endianness to other components in the
system. Sometimes elfs have the data sections layed out with this CPU
data-endianness accounting for when loaded via the CPU, so byte swaps
(relative to other system components) will occur.
The leading example, is ARM's BE32 mode, which is is basically LE with
address manipulation on half-word and byte accesses to access the
hw/byte reversed address. This means that word data is invariant
across LE and BE32. This also means that instructions are still LE.
The expectation is that the elf will be loaded via the CPU in this
endianness scheme, which means the data in the elf is reversed at
compile time.
As QEMU loads via the system memory directly, rather than the CPU, we
need a mechanism to reverse elf data endianness to implement this
possibility.
Add an API to load an elf header header from a file. Populates a
buffer with the header contents, as well as a boolean for whether the
elf is 64b or not. Both arguments are optional.
Paolo Bonzini [Fri, 4 Mar 2016 11:30:21 +0000 (11:30 +0000)]
target-arm: implement BE32 mode in system emulation
System emulation only has a little-endian target; BE32 mode
is implemented by adjusting the low bits of the address
for every byte and halfword load and store. 64-bit accesses
flip the low and high words.
Paolo Bonzini [Fri, 4 Mar 2016 11:30:20 +0000 (11:30 +0000)]
target-arm: introduce disas flag for endianness
Introduce a disas flag for setting the CPU data endianness. This allows
control of the endianness from the CPU state rather than hard-coding it
to TARGET_WORDS_BIGENDIAN.
Signed-off-by: Paolo Bonzini <[email protected]>
[ PC changes:
* Split off as new patch from original:
"target-arm: introduce tbflag for CPSR.E"
* Wrote commit message from scratch
] Reviewed-by: Peter Maydell <[email protected]> Signed-off-by: Peter Crosthwaite <[email protected]> Signed-off-by: Peter Maydell <[email protected]>
Implement SCTLR.EE bit which controls data endianess for exceptions
and page table translations. SCTLR.EE is mirrored to the CPSR.E bit
on exception entry.
Paolo Bonzini [Fri, 4 Mar 2016 11:30:19 +0000 (11:30 +0000)]
linux-user: arm: handle CPSR.E correctly in strex emulation
Now that CPSR.E is set correctly, prepare for when setend will be able
to change it; bswap data in and out of strex manually by comparing
SCTLR.B, CPSR.E and TARGET_WORDS_BIGENDIAN (we do not have the luxury
of using TCGMemOps).
endian with address manipulations on subword accesses (to give the
illusion of BE). But user-mode cannot tell the difference and is
already implemented as straight BE. So handle the difference in the
endianess query, where USER mode is BE and system is not.
There is a CPU data endianness test that is used to drive the
virtio_big_endian test.
Move this up to the header so it can be more generally used for endian
tests. The KVM specific cpu_syncronize_state call is left behind in the
virtio specific function.
Rename it arm_cpu-data_is_big_endian() to more accurately capture that
this is for data accesses only.
Paolo Bonzini [Fri, 4 Mar 2016 11:30:19 +0000 (11:30 +0000)]
target-arm: implement SCTLR.B, drop bswap_code
bswap_code is a CPU property of sorts ("is the iside endianness the
opposite way round to TARGET_WORDS_BIGENDIAN?") but it is not the
actual CPU state involved here which is SCTLR.B (set for BE32
binaries, clear for BE8).
Replace bswap_code with SCTLR.B, and pass that to arm_ld*_code.
The next patches will make data fetches honor both SCTLR.B and
CPSR.E appropriately.
Signed-off-by: Paolo Bonzini <[email protected]>
[PC changes:
* rebased on master (Jan 2016)
* s/TARGET_USER_ONLY/CONFIG_USER_ONLY
* Use bswap_code() for disas_set_info() instead of raw sctlr_b
] Signed-off-by: Peter Crosthwaite <[email protected]> Reviewed-by: Peter Maydell <[email protected]> Signed-off-by: Peter Maydell <[email protected]>
Andrew Baumann [Fri, 4 Mar 2016 11:30:18 +0000 (11:30 +0000)]
bcm2835_mbox/property: replace ldl_phys/stl_phys with endian-specific accesses
PMM pointed out that ldl_phys and stl_phys are dependent on the CPU's
endianness, whereas device model code should be independent of
it. This changes the relevant Raspberry Pi devices to explicitly call
the little-endian variants.
Peter Maydell [Fri, 4 Mar 2016 11:30:18 +0000 (11:30 +0000)]
hw/arm/virt: Assume EL3 boot rom will handle PSCI if one is provided
If the user passes us an EL3 boot rom, then it is going to want to
implement the PSCI interface itself. In this case, disable QEMU's
internal PSCI implementation so it does not get in the way, and
instead start all CPUs in an SMP configuration at once (the boot
rom will catch them all and pen up the secondaries until needed).
The boot rom code is also responsible for editing the device tree
to include any necessary information about its own PSCI implementation
before eventually passing it to a NonSecure guest.
(This "start all CPUs at once" approach is what both ARM Trusted
Firmware and UEFI expect, since it is what the ARM Foundation Model
does; the other approach would be to provide some emulated hardware
for "start the secondaries" but this is simplest.)
This is a compatibility break, but I don't believe that anybody
was using a secure boot ROM with an SMP configuration. Such a setup
would be somewhat broken since there was nothing preventing nonsecure
guest code from calling the QEMU PSCI function to start up a secondary
core in a way that completely bypassed the secure world.
Peter Maydell [Fri, 4 Mar 2016 11:30:18 +0000 (11:30 +0000)]
hw/arm/virt: Make first flash device Secure-only if booting secure
If the virt board is started with the 'secure' property set to
request a Secure setup, then make the first flash device be
visible only to the Secure world.
This is a breaking change, but I don't expect it to be noticed
by anybody, because running TZ-aware guests isn't common and
those guests are generally going to be booting from the flash
and implicitly expecting their Non-secure guests to not touch it.
Peter Maydell [Fri, 4 Mar 2016 11:30:17 +0000 (11:30 +0000)]
hw/arm/virt: Load bios image to MemoryRegion, not physaddr
If we're loading a BIOS image into the first flash device,
load it into the flash's memory region specifically, not
into the physical address where the flash resides. This will
make a difference when the flash might be in the Secure
address space rather than the Nonsecure one.
Peter Maydell [Fri, 4 Mar 2016 11:30:17 +0000 (11:30 +0000)]
loader: Add load_image_mr() to load ROM image to a MemoryRegion
Add a new function load_image_mr(), which behaves like
load_image_targphys() except that it loads the ROM image to
a specified MemoryRegion rather than to a specified physical
address. This is useful when a ROM blob needs to be loaded
to a particular flash or ROM device but the address of that
device in the machine's address space is not known. (For
instance, ROMs in devices, or ROMs which might exist in
a different address space to the system address space.)
Peter Maydell [Fri, 4 Mar 2016 11:30:17 +0000 (11:30 +0000)]
hw/arm/virt: Provide a secure-only RAM if booting in Secure mode
If we're booting in Secure mode, provide a secure-only RAM
(just 16MB) so that secure firmware has somewhere to run
from that won't be accessible to the Non-secure guest.
Peter Maydell [Fri, 4 Mar 2016 11:30:17 +0000 (11:30 +0000)]
sdhci: Implement DeviceClass reset
The sdhci device was missing a DeviceClass reset method;
implement it. Poweron reset looks the same as reset commanded
by the guest via the device registers, apart from modelling of
the rpi 'pending insert interrupt on powerup' quirk.
Peter Maydell [Fri, 4 Mar 2016 11:30:17 +0000 (11:30 +0000)]
sd.c: Handle NULL block backend in sd_get_inserted()
The sd.c SD card emulation code can be in a state where the
SDState BlockBackend pointer is NULL; this is treated as
"card not present". Add a missing check to sd_get_inserted()
so that we don't segfault in this situation.
(This could be provoked by the guest writing to the SDHCI
register to do a reset on a xilinx-zynq-a9 board; it will
also happen at startup when sdhci implements its DeviceClass
reset method.)
Peter Maydell [Fri, 4 Mar 2016 11:30:16 +0000 (11:30 +0000)]
virt: Lift the maximum RAM limit from 30GB to 255GB
The virt board restricts guests to only 30GB of RAM. This is a
hangover from the vexpress-a15 board, and there's no inherent reason
for it. 30GB is smaller than you might reasonably want to provision
a VM for on a beefy server machine. Raise the limit to 255GB.
We choose 255GB because the available space we currently have
below the 1TB boundary is up to the 512GB mark, but we don't
want to paint ourselves into a corner by assigning it all to
RAM. So we make half of it available for RAM, with the 256GB..512GB
range available for future non-RAM expansion purposes.
If we need to provide more RAM to VMs in the future then we need to:
* allocate a second bank of RAM starting at 2TB and working up
* fix the DT and ACPI table generation code in QEMU to correctly
report two split lumps of RAM to the guest
* fix KVM in the host kernel to allow guests with >40 bit address spaces
The last of these is obviously the trickiest, but it seems
reasonable to assume that anybody configuring a VM with a quarter
of a terabyte of RAM will be doing it on a host with more than a
terabyte of physical address space.
Peter Maydell [Fri, 4 Mar 2016 11:30:16 +0000 (11:30 +0000)]
target-arm: Correct handling of writes to CPSR mode bits from gdb in usermode
In helper.c the expression
(env->uncached_cpsr & CPSR_M) != CPSR_USER
is always true; the right hand side was supposed to be ARM_CPU_MODE_USR
(an error in commit cb01d391).
Since the incorrect expression was always true, this just meant that
commit cb01d391 had no effect.
However simply changing the RHS here would reveal a logic error: if
the mode is USR we wish to completely ignore the attempt to set the
mode bits, which means that we must clear the CPSR_M bits from mask
to avoid the uncached_cpsr bits being updated at the end of the
function.
Move the condition into the correct place in the code, fix its RHS
constant, and add a comment about the fact that we must be doing a
gdbstub write if we're in user mode.
Peter Maydell [Thu, 3 Mar 2016 13:13:35 +0000 (13:13 +0000)]
Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/rng-for-2.6-1' into staging
rng:
- implement a request queue for rng-random so multiple guest requests
don't result in vq buffers getting forgotten
- remove unused request cancellation code
- a VM with multiple vq buffers, when migrated, could get in a situation
where not all buffers are handed back to the guest. This is now
fixed.
* remotes/amit-virtio-rng/tags/rng-for-2.6-1:
virtio-rng: ask for more data if queue is not fully drained
rng: add request queue support to rng-random
rng: move request queue cleanup from RngEgd to RngBackend
rng: move request queue from RngEgd to RngBackend
rng: remove the unused request cancellation code
MAINTAINERS: Add an entry for the include/sysemu/rng*.h files
Ladi Prosek [Thu, 3 Mar 2016 08:37:18 +0000 (09:37 +0100)]
rng: add request queue support to rng-random
Requests are now created in the RngBackend parent class and the
code path is shared by both rng-egd and rng-random.
This commit fixes the rng-random implementation which processed
only one request at a time and simply discarded all but the most
recent one. In the guest this manifested as delayed completion
of reads from virtio-rng, i.e. a read was completed only after
another read was issued.
By switching rng-random to use the same request queue as rng-egd,
the unsafe stack-based allocation of the entropy buffer is
eliminated and replaced with g_malloc.
Ladi Prosek [Thu, 3 Mar 2016 08:37:17 +0000 (09:37 +0100)]
rng: move request queue cleanup from RngEgd to RngBackend
RngBackend is now in charge of cleaning up the linked list on
instance finalization. It also exposes a function to finalize
individual RngRequest instances, called by its child classes.
Peter Maydell [Tue, 1 Mar 2016 15:54:03 +0000 (15:54 +0000)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
# gpg: Signature made Tue 01 Mar 2016 15:48:04 GMT using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg: aka "Stefan Hajnoczi <[email protected]>"
* remotes/stefanha/tags/tracing-pull-request:
trace: Add a proper API to manage auto-generated events from the 'tcg' property
trace: Add 'vcpu' event property to trace guest vCPU
typedefs: Add CPUState
trace: Add helper function to cast event arguments
tcg: Move definition of type TCGv
tcg: Add type for vCPU pointers
trace: Remove unnecessary intermediate event copies
trace: Extend API to manage event arguments
vl: fix tracing initialization
trace: use addresses instead of offsets in memory tracepoints
trace: split subpage MMIOs into their own trace events.
trace: docs: "simple" backend does support strings
trace: drop trailing empty strings
Lluís Vilanova [Thu, 25 Feb 2016 16:43:38 +0000 (17:43 +0100)]
trace: Add 'vcpu' event property to trace guest vCPU
This property identifies events that trace vCPU-specific information.
It adds a "CPUState*" argument to events with the property, identifying
the vCPU raising the event. TCG translation events also have a
"TCGv_env" implicit argument that is later used as the "CPUState*"
argument at execution time.
Lluís Vilanova [Thu, 25 Feb 2016 16:43:15 +0000 (17:43 +0100)]
tcg: Add type for vCPU pointers
Adds the 'TCGv_env' type for pointers to 'CPUArchState' objects. The
tracing infrastructure later needs to differentiate between regular
pointers and pointers to vCPUs.
Also changes all targets to use the new 'TCGv_env' type instead of the
generic 'TCGv_ptr'. As of now, the change is merely cosmetic ('TCGv_env'
translates into 'TCGv_ptr'), but that could change in the future to
enforce the difference.
Note that a 'TCGv_env' type (for 'CPUState') is not added, since all
helpers currently receive the architecture-specific
pointer ('CPUArchState').
trace: use addresses instead of offsets in memory tracepoints
When memory_region_ops tracepoints are enabled, calculate and record the
absolute address being accessed. Otherwise, we only get offsets into the
memory region instead of addresses.
[Fixed "offset" -> "addr" in trace event format strings.
--Stefan]
trace: split subpage MMIOs into their own trace events.
Previously, a single MMIO could trigger the memory_region_ops tracepoint twice:
once on its way into subpage ops, then later on its way into the model's ops.
Also, the fields previously called "addr" are actually offsets into the memory
region. Rename them to "offset" while we're editing the tracepoint definitions.
Greg Kurz [Mon, 11 Jan 2016 17:30:36 +0000 (18:30 +0100)]
trace: drop trailing empty strings
Also fix a typo in the virtio_balloon_handle_output() trace while here.
[The double-quoting was a limitation of the old tracetool.sh script.
The modern tracetool.py script does not require double-quotes at the end
of the line. See commit cf85cf8e972f3ad79f203be4edb7968d6e052293
("trace: Format strings must begin/end with double quotes").
--Stefan]
Peter Maydell [Tue, 1 Mar 2016 13:09:55 +0000 (13:09 +0000)]
Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20160301' into staging
Assorted fixes, cleanups and enhancements.
# gpg: Signature made Tue 01 Mar 2016 11:45:12 GMT using RSA key ID C6F02FAF
# gpg: Good signature from "Cornelia Huck <[email protected]>"
# gpg: aka "Cornelia Huck <[email protected]>"
* remotes/cohuck/tags/s390x-20160301:
s390x/css: only suspend when enabled by orb
MAINTAINERS: Remove entry for hw/s390x/s390-virtio-bus.[ch]
MAINTAINERS: Remove the old s390-virtio machine
s390x/pci: use PCI_MSIX_FLAGS on retrieving the MSIX entries
s390x/css: Use static initialization for channel_subsys fields
s390x/css: Allocate channel_subsys statically
s390x/pci: fix reg/dereg irq functions
s390x/css: introduce indicator refcounting interfaces
s390x/virtio: old machine leftovers
watchdog/diag288: avoid race condition on expired watchdog
s390x: remove {kvm_}s390_virtio_irq()
s390x: fix debug statement in trigger_page_fault()
s390x/kvm: sync fprs via kvm_run
linux-headers: update against kvm/next
projects / qemu.git / log