summary refs log tree commit diff stats
path: root/hw/timer/mss-timer.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2019-07-15hw/arm/virt: Fix non-secure flash modeDavid Engraf1-1/+1
Using the whole 128 MiB flash in non-secure mode is not working because virt_flash_fdt() expects the same address for secure_sysmem and sysmem. This is not correctly handled by caller because it forwards NULL for secure_sysmem in non-secure flash mode. Fixed by using sysmem when secure_sysmem is NULL. Signed-off-by: David Engraf <david.engraf@sysgo.com> Message-id: 20190712075002.14326-1-david.engraf@sysgo.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/display/xlnx_dp: Avoid crash when reading empty RX FIFOPhilippe Mathieu-Daudé1-4/+11
In the previous commit we fixed a crash when the guest read a register that pop from an empty FIFO. By auditing the repository, we found another similar use with an easy way to reproduce: $ qemu-system-aarch64 -M xlnx-zcu102 -monitor stdio -S QEMU 4.0.50 monitor - type 'help' for more information (qemu) xp/b 0xfd4a0134 Aborted (core dumped) (gdb) bt #0 0x00007f6936dea57f in raise () at /lib64/libc.so.6 #1 0x00007f6936dd4895 in abort () at /lib64/libc.so.6 #2 0x0000561ad32975ec in xlnx_dp_aux_pop_rx_fifo (s=0x7f692babee70) at hw/display/xlnx_dp.c:431 #3 0x0000561ad3297dc0 in xlnx_dp_read (opaque=0x7f692babee70, offset=77, size=4) at hw/display/xlnx_dp.c:667 #4 0x0000561ad321b896 in memory_region_read_accessor (mr=0x7f692babf620, addr=308, value=0x7ffe05c1db88, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439 #5 0x0000561ad321bd70 in access_with_adjusted_size (addr=308, value=0x7ffe05c1db88, size=1, access_size_min=4, access_size_max=4, access_fn=0x561ad321b858 <memory_region_read_accessor>, mr=0x7f692babf620, attrs=...) at memory.c:569 #6 0x0000561ad321e9d5 in memory_region_dispatch_read1 (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1420 #7 0x0000561ad321ea9d in memory_region_dispatch_read (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1447 #8 0x0000561ad31bd742 in flatview_read_continue (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1, addr1=308, l=1, mr=0x7f692babf620) at exec.c:3385 #9 0x0000561ad31bd895 in flatview_read (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3423 #10 0x0000561ad31bd90b in address_space_read_full (as=0x561ad5bb3020, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3436 #11 0x0000561ad33b1c42 in address_space_read (len=1, buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", attrs=..., addr=4249485620, as=0x561ad5bb3020) at include/exec/memory.h:2131 #12 0x0000561ad33b1c42 in memory_dump (mon=0x561ad59c4530, count=1, format=120, wsize=1, addr=4249485620, is_physical=1) at monitor/misc.c:723 #13 0x0000561ad33b1fc1 in hmp_physical_memory_dump (mon=0x561ad59c4530, qdict=0x561ad6c6fd00) at monitor/misc.c:795 #14 0x0000561ad37b4a9f in handle_hmp_command (mon=0x561ad59c4530, cmdline=0x561ad59d0f22 "/b 0x00000000fd4a0134") at monitor/hmp.c:1082 Fix by checking the FIFO is not empty before popping from it. The datasheet is not clear about the reset value of this register, we choose to return '0'. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20190709113715.7761-4-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/ssi/mss-spi: Avoid crash when reading empty RX FIFOPhilippe Mathieu-Daudé1-1/+7
Reading the RX_DATA register when the RX_FIFO is empty triggers an abort. This can be easily reproduced: $ qemu-system-arm -M emcraft-sf2 -monitor stdio -S QEMU 4.0.50 monitor - type 'help' for more information (qemu) x 0x40001010 Aborted (core dumped) (gdb) bt #1 0x00007f035874f895 in abort () at /lib64/libc.so.6 #2 0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66 #3 0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137 #4 0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168 #5 0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439 #6 0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569 #7 0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420 #8 0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447 #9 0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385 #10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423 #11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436 #12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466 #13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976 #14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730 #15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785 #16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082 From the datasheet "Actel SmartFusion Microcontroller Subsystem User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this register has a reset value of 0. Check the FIFO is not empty before accessing it, else log an error message. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20190709113715.7761-3-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]Philippe Mathieu-Daudé1-0/+4
Both lqspi_read() and lqspi_load_cache() expect a 32-bit aligned address. >From UG1085 datasheet [*] chapter on 'Quad-SPI Controller': Transfer Size Limitations Because of the 32-bit wide TX, RX, and generic FIFO, all APB/AXI transfers must be an integer multiple of 4-bytes. Shorter transfers are not possible. Set MemoryRegionOps.impl values to force 32-bit accesses, this way we are sure we do not access the lqspi_buf[] array out of bound. [*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memoryPhilippe Mathieu-Daudé1-0/+16
Lei Sun found while auditing the code that a CPU write would trigger a NULL pointer dereference. >From UG1085 datasheet [*] AXI writes in this region are ignored and generates an AXI Slave Error (SLVERR). Fix by implementing the write_with_attrs() handler. Return MEMTX_ERROR when the region is accessed (this error maps to an AXI slave error). [*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf Reported-by: Lei Sun <slei.casper@gmail.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrsPhilippe Mathieu-Daudé1-12/+11
In the next commit we will implement the write_with_attrs() handler. To avoid using different APIs, convert the read() handler first. Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15target/arm: report ARMv8-A FP support for AArch32 -cpu maxAlex Bennée1-0/+4
When we converted to using feature bits in 602f6e42cfbf we missed out the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for -cpu max configurations. This caused a regression in the GCC test suite. Fix this by setting the appropriate bits in mvfr1.FPHP to report ARMv8-A with FP support (but not ARMv8.2-FP16). Fixes: https://bugs.launchpad.net/qemu/+bug/1836078 Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190711103737.10017-1-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15Fix build error when VNC is configured outChristophe de Dinechin1-1/+1
In hmp_change(), the variable hmp_mon is only used by code under #ifdef CONFIG_VNC. This results in a build error when VNC is configured out with the default of treating warnings as errors: monitor/hmp-cmds.c: In function ‘hmp_change’: monitor/hmp-cmds.c:1946:17: error: unused variable ‘hmp_mon’ [-Werror=unused-variable] 1946 | MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common); | ^~~~~~~ Signed-off-by: Christophe de Dinechin <dinechin@redhat.com> Message-Id: <20190625123905.25434-1-dinechin@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-07-14tcg: Release mmap_lock on translation faultRichard Henderson2-23/+63
Turn helper_retaddr into a multi-state flag that may now also indicate when we're performing a read on behalf of the translator. In this case, release the mmap_lock before the longjmp back to the main cpu loop, and thereby avoid a failing assert therein. Fixes: https://bugs.launchpad.net/qemu/+bug/1832353 Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-14tcg: Remove duplicate #if !defined(CODE_ACCESS)Richard Henderson1-2/+0
This code block is already surrounded by #ifndef CODE_ACCESS. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-14tcg: Remove cpu_ld*_code_raRichard Henderson1-1/+5
These functions are not used, and are not usable in the context of code generation, because we never have a helper return address to pass in to them. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-14tcg: Introduce set/clear_helper_retaddrRichard Henderson5-37/+57
At present we have a potential error in that helper_retaddr contains data for handle_cpu_signal, but we have not ensured that those stores will be scheduled properly before the operation that may fault. It might be that these races are not in practice observable, due to our use of -fno-strict-aliasing, but better safe than sorry. Adjust all of the setters of helper_retaddr. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-14include/qemu/atomic.h: Add signal_barrierRichard Henderson1-0/+11
We have some potential race conditions vs our user-exec signal handler that will be solved with this barrier. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-14tcg/aarch64: Fix output of extract2 opcodesRichard Henderson1-1/+1
This patch fixes two problems: (1) The inputs to the EXTR insn were reversed, (2) The input constraints use rZ, which means that we need to use the REG0 macro in order to supply XZR for a constant 0 input. Fixes: 464c2969d5d Reported-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-14tcg: Fix constant folding of INDEX_op_extract2_i32Richard Henderson1-2/+2
On a 64-bit host, discard any replications of the 32-bit sign bit when performing the shift and merge. Fixes: https://bugs.launchpad.net/bugs/1834496 Tested-by: Christophe Lyon <christophe.lyon@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-12virtio pmem: remove transitional namesPankaj Gupta1-2/+0
Remove transitional & non transitional names for virtio pmem. Only virtio 1.0 and up is supported. Signed-off-by: Pankaj Gupta <pagupta@redhat.com> Message-Id: <20190712073554.21918-4-pagupta@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2019-07-12virtio pmem: remove memdev null checkPankaj Gupta1-2/+2
Coverity reports that when we're assigning vi->size we handle the "pmem->memdev is NULL" case; but we then pass it into object_get_canonical_path(), which unconditionally dereferences it and will crash if it is NULL. If this pointer can be NULL then we need to do something else here. We are removing 'pmem->memdev' null check here as memdev will never be null in this function. Signed-off-by: Pankaj Gupta <pagupta@redhat.com> Message-Id: <20190712073554.21918-3-pagupta@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2019-07-12virtio pmem: fix wrong mem region conditionPankaj Gupta1-1/+1
Coverity reported memory region returns zero for non-null value. This is because of wrong arguments to '?:' , fixing this. Signed-off-by: Pankaj Gupta <pagupta@redhat.com> Message-Id: <20190712073554.21918-2-pagupta@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2019-07-12tests: acpi: do not skip tests when IASL is not installedIgor Mammedov1-1/+14
tests do binary comparision so we can check tables without IASL. Move IASL condition right before decompilation step and skip it if IASL is not installed. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20190708092410.11167-3-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-12tests: acpi: do not require IASL for dumping AML blobsIgor Mammedov1-6/+4
IASL isn't needed when dumping ACPI tables from guest for rebuild purposes. So move this part out from IASL branch. Makes rebuild-expected-aml.sh work without IASL installed on host. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20190708092410.11167-2-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-12virtio-balloon: fix QEMU 4.0 config size migration incompatibilityStefan Hajnoczi3-3/+29
The virtio-balloon config size changed in QEMU 4.0 even for existing machine types. Migration from QEMU 3.1 to 4.0 can fail in some circumstances with the following error: qemu-system-x86_64: get_pci_config_device: Bad config data: i=0x10 read: a1 device: 1 cmask: ff wmask: c0 w1cmask:0 This happens because the virtio-balloon config size affects the VIRTIO Legacy I/O Memory PCI BAR size. Introduce a qdev property called "qemu-4-0-config-size" and enable it only for the QEMU 4.0 machine types. This way <4.0 machine types use the old size, 4.0 uses the larger size, and >4.0 machine types use the appropriate size depending on enabled virtio-balloon features. Live migration to and from old QEMUs to QEMU 4.1 works again as long as a versioned machine type is specified (do not use just "pc"!). Originally-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20190710141440.27635-1-stefanha@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Tested-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-12pcie: consistent names for function argsMichael S. Tsirkin1-2/+2
The function declarations for pci_cap_slot_get and pci_cap_slot_write_config call the argument "slot_ctl", but the function definitions and all the call sites drop the 'o' and call it "slt_ctl". Let's be consistent. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2019-07-12xio3130_downstream: typo fixMichael S. Tsirkin1-1/+1
slt ctl/status are passed in incorrect order. Fix this up. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2019-07-12file-posix: Use max transfer length/segment count only for SCSI passthroughMaxim Levitsky1-26/+28
Regular kernel block devices (/dev/sda*, /dev/nvme*, etc) don't have max segment size/max segment count hardware requirements exposed to the userspace, but rather the kernel block layer takes care to split the incoming requests that violate these requirements. Allowing the kernel to do the splitting allows qemu to avoid various overheads that arise otherwise from this. This is especially visible in nbd server, exposing as a raw file, a mostly empty qcow2 image over the net. In this case most of the reads by the remote user won't even hit the underlying kernel block device, and therefore most of the overhead will be in the nbd traffic which increases significantly with lower max transfer size. In addition to that even for local block device access the peformance improves a bit due to less traffic between qemu and the kernel when large transfer sizes are used (e.g for image conversion) More info can be found at: https://bugzilla.redhat.com/show_bug.cgi?id=1647104 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Pankaj Gupta <pagupta@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-12iotests: Update 082 expected outputEric Blake1-27/+27
A recent tweak to the '-o help' output for qemu-img needs to be reflected into the iotests expected outputs. Fixes: f7077c98 Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-12xics/kvm: Always set the MASKED bit if interrupt is maskedGreg Kurz1-0/+3
The ics_set_kvm_state_one() function is called either to restore the state of an interrupt source during migration or to set the interrupt source to a default state during reset. Since always, ie. 2013, the code only sets the MASKED bit if the 'current priority' and the 'saved priority' are different. This is likely true when restoring an interrupt that had been previously masked with the ibm,int-off RTAS call. However this is always false in the case of reset since both 'current priority' and 'saved priority' are equal to 0xff, and the MASKED bit is never set. The legacy KVM XICS device gets away with that because it ends updating its internal structure the same way, whether the MASKED bit is set or the priority is 0xff. The XICS-on-XIVE device for POWER9 is different. It sticks to the KVM documentation [1] and _really_ relies on the MASKED bit to correctly set. If not, it will configure the interrupt source in the XIVE HW, even though the guest hasn't configured the interrupt yet. This disturbs the complex logic implemented in XICS-on-XIVE and may result in the loss of subsequent queued events. Always set the MASKED bit if interrupt is masked as expected by the KVM XICS-on-XIVE device. This has no impact on the legacy KVM XICS. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/virtual/kvm/devices/xics.txt Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156217454083.559957.7359208229523652842.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-07-12pseries: Update SLOF firmware imageAlexey Kardashevskiy3-1/+1
This only has a fix for ipv4-after-ipv6 booting problem. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-07-10docs/bitmaps: use QMP lexer instead of jsonJohn Snow1-27/+27
The annotated style json we use in QMP documentation is not strict json and depending on the version of Sphinx (2.0+) or Pygments installed, might cause the build to fail. Use the new QMP lexer. Further, some versions of Sphinx can not apply custom lexers to "code" directives and require the use of "code-block" directives instead, so make that change at this time as well. Tested under: - Sphinx 1.3.6 and Pygments 2.4 - Sphinx 1.7.6 and Pygments 2.2 (Fedora 29 packages) - Sphinx 2.0.1 and Pygments 2.4 - Sphinx 3.0.0+/f396b3a783 and Pygments 2.4 (From Sphinx git c4f44bdd) Reported-by: Aarushi Mehta <mehta.aaru20@gmail.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 20190603214653.29369-4-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2019-07-10sphinx: add qmp_lexerJohn Snow2-2/+45
Sphinx, through Pygments, does not like annotated json examples very much. In some versions of Sphinx (1.7), it will render the non-json portions of code blocks in red, but in newer versions (2.0) it will throw an exception and not highlight the block at all. Though we can suppress this warning, it doesn't bring back highlighting on non-strict json blocks. We can alleviate this by creating a custom lexer for QMP examples that allows us to properly highlight these examples in a robust way, keeping our directionality and elision notations. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Reported-by: Aarushi Mehta <mehta.aaru20@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20190603214653.29369-3-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2019-07-10docs/interop/bitmaps.rst: Fix typosJohn Snow1-2/+2
Pygments and Sphinx get pickier all the time; Sphinx 2.1+ now catches these errors. Signed-off-by: John Snow <jsnow@redhat.com> Reported-by: Aarushi Mehta <mehta.aaru20@gmail.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 20190603214653.29369-2-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2019-07-10gdbstub: revert to previous set_reg behaviourAlex Bennée1-6/+12
The refactoring of handle_set_reg missed the fact we previously had responded with an empty packet when we were not using XML based protocols. This broke the fallback behaviour for architectures that don't have registers defined in QEMU's gdb-xml directory. Revert to the previous behaviour and clean up the commentary for what is going on. Fixes: 62b3320bddd Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: Jon Doron <arilou@gmail.com>
2019-07-10gdbstub: add some notes to the header commentAlex Bennée1-0/+6
Add a link to the remote protocol spec and an SPDX tag. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-07-10tests/tcg: fix diff-out pass to properly report failureAlex Bennée1-1/+5
A side effect of piping the output to head is squash the exit status of the diff command. Fix this by only doing the pipe if the diff failed and then ensuring the status is non-zero. Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2019-07-10tests/tcg: fix up test-i386-fprem.ref generationAlex Bennée1-2/+2
We never shipped the reference data in the source tree because it's quite big (64M). As a result the only option is to generate it locally. Although we have a rule to generate the reference file we missed the dependency and location changes, probably because it's only run for SLOW test runs. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-09Update version for v4.1.0-rc0 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-09Makefile: Fix "make clean" in "unconfigured" source directoryMarkus Armbruster1-0/+1
Recent commit "Makefile: Reuse all's recursion machinery for clean and install" broke targets clean and distclean in the source directory before running configure: $ make clean LD recurse-clean.mo cc: fatal error: no input files compilation terminated. make: *** [rules.mak:118: recurse-clean.mo] Error 1 Root cause is missing .PHONY. Fix that. Fixes: 1338a4b72659ce08eacb9de0205fe16202a22d9c Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-09Revert "hw/block/pflash_cfi02: Reduce I/O accesses to 16-bit"Philippe Mathieu-Daudé1-1/+4
This reverts commit 3ae0343db69c379beb5750b4ed70794bbed51b85. Stephen Checkoway noticed commit 3ae0343db69 is incorrect. This commit state all parallel flashes are limited to 16-bit accesses, however the x32 configuration exists in some models, such the Cypress S29CL032J, which CFI Device Geometry Definition announces: CFI ADDR DATA 0x28,0x29 = 0x0003 (x32-only asynchronous interface) Guests should not be affected by the previous change, because QEMU does not announce itself as x32 capable: /* Flash device interface (8 & 16 bits) */ pfl->cfi_table[0x28] = 0x02; pfl->cfi_table[0x29] = 0x00; Commit 3ae0343db69 does not restrict the bus to 16-bit accesses, but restrict the implementation as 16-bit access max, so a guest 32-bit access will result in 2x 16-bit calls. Now, we have 2 boards that register the flash device in 32-bit access: - PPC: taihu_405ep The CFI id matches the S29AL008J that is a 1MB in x16, while the code QEMU forces it to be 2MB, and checking Linux it expects a 4MB flash. - ARM: Digic4 While the comment says "Samsung K8P3215UQB 64M Bit (4Mx16)", this flash is 32Mb (2MB). Also note the CFI id does not match the comment. To avoid unexpected side effect, we revert commit 3ae0343db69, and will clean the board code later. Reported-by: Stephen Checkoway <stephen.checkoway@oberlin.edu> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-07-09s390x/tcg: move fallthrough annotationCornelia Huck1-1/+1
...so that the compiler properly recognizes it. Reported-by: Stefan Weil <sw@weilnetz.de> Fixes: f180da83c039 ("s390x/tcg: Implement VECTOR LOAD LOGICAL ELEMENT AND ZERO") Message-Id: <20190708125433.16927-3-cohuck@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2019-07-09s390: cpumodel: fix description for the new vector facilityChristian Borntraeger1-1/+1
The new facility is called "Vector-Packed-Decimal-Enhancement Facility" and not "Vector BCD enhancements facility 1". As the shortname might have already found its way into some backports, let's keep vxbeh. Fixes: 54d65de0b525 ("s390x/cpumodel: vector enhancements") Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Message-Id: <20190708150931.93448-1-borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2019-07-09tcg: Fix expansion of INDEX_op_not_vecRichard Henderson1-0/+6
This operation can always be emitted, even if we need to fall back to xor. Adjust the assertions to match. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-09tcg/riscv: Fix RISC-VH host build failureAlistair Francis1-2/+2
Commit 269bd5d8 "cpu: Move the softmmu tlb to CPUNegativeOffsetState' broke the RISC-V host build as there are two variables that are used but not defined. This patch renames the undefined variables mask_off and table_off to the existing (but unused) mask_ofs and table_ofs variables. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <79729cc88ca509e08b5c4aa0aa8a52847af70c0f.1561039316.git.alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-07-08hw/tpm: Only build tpm_ppi.o if any of TPM_TIS/TPM_CRB is builtPhilippe Mathieu-Daudé1-2/+2
The TPM Physical Presence Interface routines are only used by the CRB/TIS interfaces. Do not compile this file if any of them is built. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2019-07-08qcow2: Allow -o compat=v3 during qemu-img amendEric Blake1-3/+3
Commit b76b4f60 allowed '-o compat=v3' as an alias for the less-appealing '-o compat=1.1' for 'qemu-img create' since we want to use the QMP form as much as possible, but forgot to do likewise for qemu-img amend. Also, it doesn't help that '-o help' doesn't list our new preferred spellings. Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-08MAINTAINERS: update RBD block maintainerJason Dillaman1-1/+1
Remove Josh as per his request since he is no longer the upstream RBD tech lead. Add myself as the maintainer since I am the current RBD tech lead. Signed-off-by: Jason Dillaman <dillaman@redhat.com> Reviewed-by: Josh Durgin <jdurgin@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-08block/qcow: Improve error when opening qcow2 files as qcowJohn Snow1-1/+6
Reported-by: radmehrsaeed7@gmail.com Fixes: https://bugs.launchpad.net/bugs/1832914 Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-08virtio-scsi: restart DMA after iothreadStefan Hajnoczi2-4/+4
When the 'cont' command resumes guest execution the vm change state handlers are invoked. Unfortunately there is no explicit ordering between classic qemu_add_vm_change_state_handler() callbacks. When two layers of code both use vm change state handlers, we don't control which handler runs first. virtio-scsi with iothreads hits a deadlock when a failed SCSI command is restarted and completes before the iothread is re-initialized. This patch uses the new qdev_add_vm_change_state_handler() API to guarantee that virtio-scsi's virtio change state handler executes before the SCSI bus children. This way DMA is restarted after the iothread has re-initialized. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-08qdev: add qdev_add_vm_change_state_handler()Stefan Hajnoczi3-0/+67
Children sometimes depend on their parent's vm change state handler having completed. Add a vm change state handler API for devices that guarantees tree depth ordering. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-08vl: add qemu_add_vm_change_state_handler_prio()Stefan Hajnoczi2-12/+49
Add an API for registering vm change state handlers with a well-defined ordering. This is necessary when handlers depend on each other. Small coding style fixes are included to make checkpatch.pl happy. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2019-07-08target/arm/vfp_helper: Call set_fpscr_to_host before updating to FPSCRPhilippe Mathieu-Daudé1-2/+2
In commit e9d652824b0 we extracted the vfp_set_fpscr_to_host() function but failed at calling it in the correct place, we call it after xregs[ARM_VFP_FPSCR] is modified. Fix by calling this function before we update FPSCR. Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com> Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com> Message-id: 20190705124318.1075-1-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-08hw/arm/sbsa-ref: Remove unnecessary check for secure_sysmem == NULLPeter Maydell1-6/+2
In the virt machine, we support TrustZone being either present or absent, and so the code must deal with the secure_sysmem pointer possibly being NULL. In the sbsa-ref machine, TrustZone is always present, but some code and comments copied from virt still treat it as possibly not being present. This causes Coverity to complain (CID 1407287) that we check secure_sysmem for being NULL after an unconditional dereference. Simplify the code so that instead of initializing the variable to NULL, unconditionally assigning it, and then testing it for NULL, we just initialize it correctly in the variable declaration and then assume it to be non-NULL. We also delete a comment which only applied to the non-TrustZone config. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190704142004.7150-1-peter.maydell@linaro.org Tested-by: Radosław Biernacki <radoslaw.biernacki@linaro.org> Reviewed-by: Radosław Biernacki <radoslaw.biernacki@linaro.org>