Alexander Graf [Wed, 7 Sep 2011 11:47:22 +0000 (13:47 +0200)]
openpic: Unfold write_IRQreg
The helper function write_IRQreg was always called with a specific argument on
the type of register to access. Inside the function we were simply doing a
switch on that constant argument again. It's a lot easier to just unfold this
into two separate functions and call each individually.
Alexander Graf [Wed, 7 Sep 2011 11:41:54 +0000 (13:41 +0200)]
openpic: Unfold read_IRQreg
The helper function read_IRQreg was always called with a specific argument on
the type of register to access. Inside the function we were simply doing a
switch on that constant argument again. It's a lot easier to just unfold this
into two separate functions and call each individually.
Stefan Hajnoczi [Mon, 5 Sep 2011 03:02:29 +0000 (03:02 +0000)]
ppc405: use RAM_ADDR_FMT instead of %08lx
The RAM_ADDR_FMT macro hides the type of ram_addr_t so that format
strings can be safely used. Make sure to use RAM_ADDR_FMT so that the
build works on 32-bit hosts with Xen enabled. Whether Xen should affect
ppc TCG targets is questionable but a separate issue.
Paolo Bonzini [Wed, 24 Aug 2011 05:28:52 +0000 (05:28 +0000)]
vscsi: send the CHECK_CONDITION status down together with autosense data
I introduced this bug in commit 05751d3 (vscsi: always use get_sense,
2011-08-03) because at the time there was no way to expose a sense
condition to SLOF and Linux manages to work around the bug. However,
the bug becomes evident now that SCSI devices also report unit
attention on reset.
SLOF also has problems dealing with unit attention conditions, so
it still will not boot even with this fix (just like OpenBIOS).
IBM folks are aware of their part of the bug. :-)
This patch adds support for the H_REMOVE_BULK hypercall on the pseries
machine. Strictly speaking this isn't necessarym since the kernel will
only attempt to use this if hcall-bulk is advertised in the device tree,
which previously it was not.
Adding this support may give a marginal performance increase, but more
importantly it reduces the differences between the emulated machine and
an existing PowerVM or kvm system, both of which already implement
hcall-bulk.
David Gibson [Wed, 31 Aug 2011 15:45:10 +0000 (15:45 +0000)]
Implement POWER7's CFAR in TCG
This patch implements support for the CFAR SPR on POWER7 (Come From
Address Register), which snapshots the PC value at the time of a branch or
an rfid. The latest powerpc-next kernel also catches it and can show it in
xmon or in the signal frames.
This works well enough to let recent kernels boot (which otherwise oops
on the CFAR access). It hasn't been tested enough to be confident that the
CFAR values are actually accurate, but one thing at a time.
Scott Wood [Wed, 31 Aug 2011 11:26:56 +0000 (11:26 +0000)]
kvm: ppc: booke206: use MMU API
Share the TLB array with KVM. This allows us to set the initial TLB
both on initial boot and reset, is useful for debugging, and could
eventually be used to support migration.
For some time we've had a nicely defined macro with the filename for our
firmware image. However we didn't actually use it in the place we're
supposed to. This patch fixes it.
David Gibson [Wed, 10 Aug 2011 14:44:20 +0000 (14:44 +0000)]
pseries: Add real mode debugging hcalls
PAPR systems support several hypercalls intended for use in real mode
debugging tools. These implement reads and writes to arbitrary guest
physical addresses. This is useful for real mode software because it
allows access to IO addresses and memory outside the RMA without going
through the somewhat involved process of setting up the hash page table
and enabling translation.
We want these so that when we add real IO devices, the SLOF firmware can
boot from them without having to enter virtual mode.
In the current emulation of the load-and-reserve (lwarx) and
store-conditional (stwcx.) instructions, the internal reservation
mechanism is taken into account, however each CPU has its own
reservation information and this information is not synchronized between
CPUs to perform proper synchronization.
The following test case with 2 CPUs shows that the semantics of the
"lwarx" and "stwcx." instructions are not preserved by the emulation.
The test case does the following :
- CPU0: reserve a memory location
- CPU1: reserve the same memory location
- CPU0: perform stwcx. on the location
The last store-conditional operation succeeds while it is supposed to
fail since the reservation was supposed to be lost at the second reserve
operation.
This (one line) patch fixes this problem in a very simple manner by
removing the reservation of a CPU every time it is scheduled (in
cpu_exec()). While this is a harsh workaround, it does not affect the
guest code much because reservations are usually held for a very short
time, that is an lwarx is almost always followed by an stwcx. a few
instructions below. Therefore, in most cases, the reservation will be
taken and consumed before a CPU switch occurs. However in the rare case
where a CPU switch does occur between the lwarx and its corresponding
stwcx. this patch solves a potential erroneous behavior of the
synchronization instructions.
David Gibson [Wed, 3 Aug 2011 21:02:19 +0000 (21:02 +0000)]
pseries: More complete WIMG validation in H_ENTER code
Currently our implementation of the H_ENTER hypercall, which inserts a
mapping in the hash page table assumes that only ordinary memory is ever
mapped, and only permits mapping attribute bits accordingly (WIMG==0010).
However, we intend to start adding emulated IO to the pseries platform
(and real IO with PCI passthrough on kvm) which means this simple test
will no longer suffice.
This patch extends the h_enter validation code to check if the given
address is a RAM address. If it is it enforces WIMG==0010, otherwise
it assumes that it is an IO mapping and instead enforces WIMG=010x.
David Gibson [Wed, 3 Aug 2011 21:02:18 +0000 (21:02 +0000)]
pseries: interrupt controller should not have a 'reg' property
The interrupt controller presented in the device tree for the pseries
machine is manipulated by the guest only through hypervisor calls. It
has no real or emulated registers for the guest to access.
However, it currently has a bogus 'reg' property advertising a register
window. Moreover, this property has an invalid format, being a 32-bit
zero, when the #address-cells property on the root bus indicates that it
needs a 64-bit address. Since the guest never attempts to manipulate
the node directly, it works, but it is ugly and can cause warnings when
manipulating the device tree in other tools (such as future firmware
versions).
This patch, therefore, corrects the problem by entirely removing the
interrupt-controller node's 'reg' property.
David Gibson [Wed, 3 Aug 2011 21:02:17 +0000 (21:02 +0000)]
pseries: Add a phandle to the xicp interrupt controller device tree node
Future devices we will be adding to the pseries machine (e.g. PCI) will
need nodes in the device tree which explicitly reference the top-level
interrupt controller via interrupt-parent or interrupt-map properties.
In order to do this, the interrupt controller node needs an assigned
phandle. This patch adds the appropriate property, in preparation.
David Gibson [Wed, 3 Aug 2011 21:02:14 +0000 (21:02 +0000)]
pseries: Bugfixes for interrupt numbering in XICS code
The implementation of the XICS interrupt controller contains several
(difficult to trigger) bugs due to the fact that we were not 100%
consistent with which irq numbering we used. In most places, global
numbers were used as handled by the presentation layer, however a few
functions took "local" numberings, that is the source number within
the interrupt source controller which is offset from the global
number. In most cases the function and its caller agreed on this, but
in a few cases it didn't.
This patch cleans this up by always using global numbering.
Translation to the local number is now always and only done when we
look up the individual interrupt source state structure. This should
remove the existing bugs and with luck reduce the chances of
re-introducing such bugs.
Alexander Graf [Tue, 9 Aug 2011 16:07:13 +0000 (18:07 +0200)]
PPC: SPAPR: Use KVM function for time info
One of the things we can't fake on PPC is the timer speed. So
we need to extract the frequency information from the host and
put it back into the guest device tree.
Luckily, we already have functions for that from the non-pseries
targets, so all we need to do is to connect the dots and the guest
suddenly gets to know its real timer speeds.
Alexander Graf [Tue, 9 Aug 2011 15:57:37 +0000 (17:57 +0200)]
PPC: Enable to use PAPR with PR style KVM
When running PR style KVM, we need to tell the kernel that we want
to run in PAPR mode now. This means that we need to pass some more
register information down and enable papr mode. We also need to align
the HTAB to htab_size boundary.
Using this patch, -M pseries works with kvm even on non-hv kvm
implementations, as long as the preceding kernel patches are in.
Alexander Graf [Wed, 10 Aug 2011 12:21:41 +0000 (14:21 +0200)]
PPC: Add new target config for pseries
We only support -M pseries when certain prerequisites are met, such
as a PPC64 guest and libfdt. To only gather these requirements in
a single place, this patch introduces a new CONFIG_PSERIES variable
that gets set when all prerequisites are met.
Alexander Graf [Sat, 23 Jul 2011 08:56:40 +0000 (10:56 +0200)]
MPC8544DS: Generate CPU nodes on init
With this patch, we generate CPU nodes in the machine initialization, giving
us the freedom to generate as many nodes as we want and as the machine supports,
but only those.
This is a first step towards a much cleaner device tree generation
infrastructure, where we would not require precompiled dtb blobs anymore.
Alexander Graf [Sat, 23 Jul 2011 08:54:11 +0000 (10:54 +0200)]
device tree: give dt more size
We currently load a device tree blob and then just take its size x2 to
account for modifications we do inside. While this is nice and great,
it fails when we have a small device tree as blob and lots of nodes added
in machine init code.
So for now, just make it 20k bigger than it was before. We maybe want to
be more clever about this later.
Alexander Graf [Sat, 23 Jul 2011 08:52:00 +0000 (10:52 +0200)]
device tree: dont fail operations
When we screw up and issue an FDT command that doesn't work, we really need to
know immediately and usually can't continue to create the machine. To make sure
we don't need to add error checking in all device tree modification code users,
we can just add the fail checks to the qemu abstract functions.
Alexander Graf [Fri, 22 Jul 2011 11:32:29 +0000 (13:32 +0200)]
PPC: E500: Add PV spinning code
CPUs that are not the boot CPU need to run in spinning code to check if they
should run off to execute and if so where to jump to. This usually happens
by leaving secondary CPUs looping and checking if some variable in memory
changed.
In an environment like Qemu however we can be more clever. We can just export
the spin table the primary CPU modifies as MMIO region that would event based
wake up the respective secondary CPUs. That saves us quite some cycles while
the secondary CPUs are not up yet.
So this patch adds a PV device that simply exports the spinning table into the
guest and thus allows the primary CPU to wake up secondary ones.
Alexander Graf [Thu, 21 Jul 2011 01:02:31 +0000 (03:02 +0200)]
PPC: E500: Remove unneeded CPU nodes
We should only keep CPU nodes in the device tree around that we really have
virtual CPUs for. So remove all superfluous entries that we just keep there
in case someone wants to create a lot of vCPUs.
Alexander Graf [Thu, 21 Jul 2011 00:54:51 +0000 (02:54 +0200)]
PPC: KVM: Add stubs for kvm helper functions
We have a bunch of helper functions that don't have any stubs for them in case
we don't have CONFIG_KVM enabled. That didn't bite us so far, because gcc can
optimize them out pretty well, but we should really provide them.
Alexander Graf [Wed, 20 Jul 2011 23:52:57 +0000 (01:52 +0200)]
device tree: add nop_node
We have a qemu internal abstraction layer on FDT. While I'm not fully convinced
we need it at all, it's missing the nop_node functionality that we now need
on e500. So let's add it and think about the general future of that API later.
Alexander Graf [Wed, 20 Jul 2011 23:42:58 +0000 (01:42 +0200)]
PPC: E500: Generate IRQ lines for many CPUs
Now that we can generate multiple envs for all our virtual CPUs, we
also need to tell the MPIC that we have multiple CPUs connected and
connect them all to the respective virtual interrupt lines.
Alexander Graf [Wed, 20 Jul 2011 23:41:16 +0000 (01:41 +0200)]
PPC: E500: create multiple envs
When creating a VM, we should go through smp_cpus and create a virtual CPU for
every CPU the user requested. This patch adds support for that and moves some
code around to make that more convenient.
Alexander Graf [Wed, 20 Jul 2011 23:39:46 +0000 (01:39 +0200)]
PPC: Bump MPIC up to 32 supported CPUs
The MPIC emulation is now capable of handling up to 32 CPUs. Reflect that in
the code exporting the numbers out and fix an integer overflow while at it.
Alexander Graf [Sat, 23 Jul 2011 09:27:53 +0000 (11:27 +0200)]
PPC: MPIC: Fix CI bit definitions
The bit definitions for critical interrupt routing are in PowerPC order
(most significant bit is 0), while we end up shifting it with normal bit
order. Turn the numbers around so we actually end up fetching the
right ones.
Alexander Graf [Sat, 23 Jul 2011 09:09:23 +0000 (11:09 +0200)]
PPC: MPIC: Remove read functionality for WO registers
The IPI dispatch registers are write only according to every MPIC
spec I have found. So instead of pretending you could read back something
from them, better not handle them at all.
Alexander Graf [Sat, 23 Jul 2011 09:05:35 +0000 (11:05 +0200)]
PPC: Set MPIC IDE for IPI to 0
We use the IDE register with IPIs as a mask to keep track which processors
have already acknowledged the respective interrupt. So we need to initialize
it to 0 to make sure that it doesn't accidently fire an IPI on CPU0 when the
first IPI is triggered.
Alexander Graf [Wed, 20 Jul 2011 23:36:44 +0000 (01:36 +0200)]
PPC: Fix IPI support in MPIC
The current IPI support in the MPIC code is incomplete and doesn't work. This
code adds proper support for IPIs in MPIC by using the IDE register to remember
which CPUs IPIs are still outstanding to. New triggers through the IPI trigger
register only add to the list of CPUs we want to IPI.
Alexander Graf [Wed, 20 Jul 2011 23:35:15 +0000 (01:35 +0200)]
PPC: Extend MPIC MMIO range
The MPIC exports a page for each CPU that it controls. To support more than
one CPU, we need to also reserve the MMIO space according to the amount of
CPUs we want to support.
Alexander Graf [Wed, 20 Jul 2011 23:33:29 +0000 (01:33 +0200)]
PPC: Add CPU local MMIO regions to MPIC
The MPIC exports a register set for each CPU connected to it. They can all
be accessed through specific registers or using a shadow page that is mapped
differently depending on which CPU accesses it.
This patch implements the shadow map, making it possible for guests to access
the CPU local registers using the same address on each CPU.
Paolo Bonzini [Thu, 26 May 2011 09:52:44 +0000 (11:52 +0200)]
spapr: proper qdevification
Right now the spapr devices cannot be instantiated with -device,
because the IRQs need to be passed to the spapr_*_create functions.
Do this instead in the bus's init wrapper.
This is particularly important with the conversion from scsi-disk
to scsi-{cd,hd} that Markus made. After his patches, if you
specify a scsi-cd device attached to an if=none drive, the default
VSCSI controller will not be created and, without qdevification,
you will not be able to add yours.
Stefan Hajnoczi [Fri, 30 Sep 2011 10:39:11 +0000 (11:39 +0100)]
qed: fix use-after-free during l2 cache commit
QED's metadata caching strategy allows two parallel requests to race for
metadata lookup. The first one to complete will populate the metadata
cache and the second one will drop the data it just read in favor of the
cached data.
There is a use-after-free in qed_read_l2_table_cb() and
qed_commit_l2_update() where l2_table->offset was used after the
l2_table may have been freed due to a metadata lookup race. Fix this by
keeping the l2_offset in a local variable and not reaching into the
possibly freed l2_table.
Blue Swirl [Wed, 21 Sep 2011 18:13:16 +0000 (18:13 +0000)]
Move GETPC from dyngen-exec.h to exec-all.h
GETPC() can be used even from outside of helper code. Move the macro to
a more accessible location. Avoid a compile warning from redefining it in exec.c.
Jan Kiszka [Thu, 29 Sep 2011 16:52:11 +0000 (18:52 +0200)]
tcg-i386: Introduce limited deposit support
x86 cannot provide an optimized generic deposit implementation. But at
least for a few special cases, namely for writing bits 0..7, 8..15, and
0..15, versions using only a single instruction are feasible.
Introducing such limited support improves emulating 16-bit x86 code on
x86, but also rarer cases where 32-bit or 64-bit code accesses bytes or
words.
Peter Maydell [Mon, 26 Sep 2011 15:56:55 +0000 (16:56 +0100)]
softfloat: Reinstate accidentally disabled target-specific NaN handling
Include config.h in softfloat.c, so that the target specific ifdefs in
softfloat-specialize.h are evaluated correctly. This was accidentally
broken in commit 789ec7ce2 when config-target.h was removed from
softfloat.h, and means that most targets will have been returning the
wrong results for calculations involving NaNs.
Thomas Huth [Tue, 27 Sep 2011 09:20:38 +0000 (11:20 +0200)]
slirp: Fix packet expiration
The two new variables "arp_requested" and "expiration_date" in the mbuf
structure have been added after the variable-sized "m_dat_" array. The
variables have to be added before the m_dat_ array instead.
Without this patch, the expiration_date gets clobbered by code that
accesses the m_dat_ array.
I experienced this problem with the code in slirp/tftp.c: The
tftp_send_data() function created a new packet with the m_get()
function (which fills-in a default expiration_date value). Then the
TFTP code cleared the data section of the packet, which accidentially
also cleared the expiration_date. This zeroed expiration_date then
finally causes the packet to be discarded during if_start(), so that
TFTP packets were not transmitted anymore.
The only non-obvious part is pic_poll_read which used
"addr1 >> 7" to detect whether one referred to either
the master or slave PIC. Instead, test this directly.
Avi Kivity [Mon, 12 Sep 2011 10:00:05 +0000 (13:00 +0300)]
mips_malta: move i8259 initialization after piix4 initialization
i8259 is an ISA device (or at least, depends on the ISA infrastructure to
register its ioport); and the ISA bus is supplied by piix4. Later patches
make this dependency explicit.
Use qemu_irq_proxy() to stop the cycle by adding an extra layer of
indirection.
projects / qemu.git / log