summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20160720' into stagingPeter Maydell2016-07-203-1/+34
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes for s390x in the css area. # gpg: Signature made Wed 20 Jul 2016 15:12:43 BST # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20160720: s390x/css: provide a dev_path for css devices s390x/css: sch_handle_start_func() handles resume, too s390x/css: copy CCW format bit from ORB to SCSW Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * s390x/css: provide a dev_path for css devicesCornelia Huck2016-07-202-1/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need to implement the get_dev_path method for the css bus, or else we might end up with two different devices having the same qdev_path. This was noticed when adding two scsi_hd controllers: The SCSIBus code will produce a non-unique dev_path for vmstate usage if the parent bus does not provide the get_dev_path method. We simply use the device's bus id, as this is unique and we won't have any deeper hierarchy from a channel subsystem perspective anyway. Note that we need to disable this for older machine versions, as this changes the migration format. Reported-by: Marc Hartmayer <mhartmay@linux.vnet.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Sascha Silbe <silbe@linux.vnet.ibm.com> Tested-by: Marc Hartmayer <mhartmay@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
| * s390x/css: sch_handle_start_func() handles resume, tooSascha Silbe2016-07-201-0/+4
| | | | | | | | | | | | | | | | | | It's not obvious from the code flow that sch_handle_start_func() gets called for rsch. Add some comments explaining this. Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
| * s390x/css: copy CCW format bit from ORB to SCSWSascha Silbe2016-07-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The CCW Format (F) flag of the Subchannel-Status Word (SCSW) indicates the format of the CCWs "associated with an I/O operation", i.e. the value of CCW-Format Control (F) bit of the Operation-Request Block (ORB). Copy the CCW format bit from the ORB to the SCSW so we correctly indicate the format of the CCWs to the guest. Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160720-1' into ↵Peter Maydell2016-07-202-2/+8
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging usb: xhci assert fix, add usbredir streams property # gpg: Signature made Wed 20 Jul 2016 12:32:09 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20160720-1: usbredir: add streams property xhci: Fix possible side effect from assert() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | usbredir: add streams propertyGerd Hoffmann2016-07-201-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | Enabled by default, can be used to turn off (usb3) streams support. xhci has a such a property too (same name, same default). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1468408474-17648-1-git-send-email-kraxel@redhat.com
| * | xhci: Fix possible side effect from assert()Alexey Kardashevskiy2016-07-201-1/+3
| |/ | | | | | | | | | | | | | | | | | | | | | | A static analysis tool called BEAM detected possible side effect from assert() calling a helper which may change an XHCI ring after every call. This moves xhci_ring_fetch() out of assert() so it will be called with and without enabled debug. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-id: 1468812548-31868-1-git-send-email-aik@ozlabs.ru Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160720-1' into ↵Peter Maydell2016-07-202-6/+7
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging qxl: fix qxl_set_dirty call in qxl_dirty_one_surface # gpg: Signature made Wed 20 Jul 2016 12:28:01 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-vga-20160720-1: qxl: fix qxl_set_dirty call in qxl_dirty_one_surface Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | qxl: fix qxl_set_dirty call in qxl_dirty_one_surfaceGerd Hoffmann2016-07-202-6/+7
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | qxl_set_dirty() expects start and end as range specification. qxl_dirty_one_surface passes 'size' instead of 'offset + size' as end parameter. Fix that. Also use uint64_t everywhere while being at it. Bug was added by "e25139b qxl: set only off-screen surfaces dirty instead of the whole vram" and carried forward unnoticed by "5cdc402 qxl: fix surface migration". Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1468413187-22071-1-git-send-email-kraxel@redhat.com
* | Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2016-07-19' into ↵Peter Maydell2016-07-2033-47/+47
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging QAPI patches for 2016-07-19 # gpg: Signature made Tue 19 Jul 2016 19:35:27 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2016-07-19: net: Use correct type for bool flag qapi: Change Netdev into a flat union block: Simplify drive-mirror block: Simplify block_set_io_throttle qapi: Implement boxed types for commands/events qapi: Plumb in 'boxed' to qapi generator lower levels qapi-event: Simplify visit of non-implicit data qapi: Drop useless gen_err_check() qapi: Add type.is_empty() helper qapi: Hide tag_name data member of variants qapi: Special case c_name() for empty type qapi: Require all branches of flat union enum to be covered net: use Netdev instead of NetClientOptions in client init qapi: change QmpInputVisitor to QSLIST qapi: change QmpOutputVisitor to QSLIST Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | net: Use correct type for bool flagEric Blake2016-07-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | is_netdev is only used as a bool, so make it one. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1468468228-27827-14-git-send-email-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * | qapi: Change Netdev into a flat unionEric Blake2016-07-1933-46/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a mostly-mechanical conversion that creates a new flat union 'Netdev' QAPI type that covers all the branches of the former 'NetClientOptions' simple union, where the branches are now listed in a new 'NetClientDriver' enum rather than generated from the simple union. The existence of a flat union has no change to the command line syntax accepted for new code, and will make it possible for a future patch to switch the QMP command to parse a boxed union for no change to valid QMP; but it does have some ripple effect on the C code when dealing with the new types. While making the conversion, note that the 'NetLegacy' type remains unchanged: it applies only to legacy command line options, and will not be ported to QMP, so it should remain a wrapper around a simple union; to avoid confusion, the type named 'NetClientOptions' is now gone, and we introduce 'NetLegacyOptions' in its place. Then, in the C code, we convert from NetLegacy to Netdev as soon as possible, so that the bulk of the net stack only has to deal with one QAPI type, not two. Note that since the old legacy code always rejected 'hubport', we can just omit that branch from the new 'NetLegacyOptions' simple union. Based on an idea originally by Zoltán Kővágó <DirtY.iCE.hu@gmail.com>: Message-Id: <01a527fbf1a5de880091f98cf011616a78adeeee.1441627176.git.DirtY.iCE.hu@gmail.com> although the sed script in that patch no longer applies due to other changes in the tree since then, and I also did some manual cleanups (such as fixing whitespace to keep checkpatch happy). Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1468468228-27827-13-git-send-email-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Fixup from Eric squashed in] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* | | arm_gicv3: Add assert()s to tell Coverity that offsets are alignedPeter Maydell2016-07-191-0/+4
| |/ |/| | | | | | | | | | | | | | | | | Coverity complains that the GICR_IPRIORITYR case in gicv3_readl() can overflow an array, because it doesn't know that the offsets passed to that function must be word aligned. Add some assert()s which hopefully tell Coverity that this isn't possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1468261372-17508-1-git-send-email-peter.maydell@linaro.org
* | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2016-07-192-5/+47
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * two old patches from prospective GSoC students * i386 -kernel device tree support * Coverity fix * memory usage improvement from Peter * checkpatch fix * g_path_get_dirname cleanup * caching of block status for iSCSI # gpg: Signature made Tue 19 Jul 2016 07:43:41 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: target-i386: Remove redundant HF_SOFTMMU_MASK block/iscsi: allow caching of the allocation map block/iscsi: fix rounding in iscsi_allocationmap_set Move README to markdown cpu-exec: Move down some declarations in cpu_exec() exec: avoid realloc in phys_map_node_reserve checkpatch: consider git extended headers valid patches megasas: remove useless check for cmd->frame compiler: never omit assertions if using a static analysis tool hw/i386: add device tree support Changed malloc to g_malloc, free to g_free in bsd-user/qemu.h use g_path_get_dirname instead of dirname Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | megasas: remove useless check for cmd->framePaolo Bonzini2016-07-171-5/+1
| | | | | | | | | | | | | | | | | | | | | megasas_enqueue_frame always returns with non-NULL cmd->frame. Remove the "else" part as it is dead code. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | hw/i386: add device tree supportAntonio Borneo2016-07-171-0/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With "-dtb" on command-line: - append the device tree blob to the kernel image; - pass the blob's pointer to the kernel through setup_data, as requested by upstream kernel commit da6b737b9ab7 ("x86: Add device tree support"). The device tree blob is passed as-is to the guest; none of its fields is modified nor updated. This is not an issue; the kernel commit above uses the device tree only as an extension to the traditional kernel configuration. To: "Michael S. Tsirkin" <mst@redhat.com> To: Paolo Bonzini <pbonzini@redhat.com> To: Richard Henderson <rth@twiddle.net> To: Eduardo Habkost <ehabkost@redhat.com> Cc: qemu-devel@nongnu.org Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Message-Id: <1459973054-2777-1-git-send-email-borneo.antonio@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | | Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2016-07-192-2/+3
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Tue 19 Jul 2016 03:33:40 BST # gpg: using RSA key 0xEF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: e1000e: fix building without CONFIG_VMXNET3_PCI MAINTAINERS: release Scott from being a rocker maintainer tap: fix memory leak on failure to create a multiqueue tap device net: fix incorrect argument to iov_to_buf net: fix incorrect access to pointer e1000e: fix incorrect access to pointer Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | e1000e: fix building without CONFIG_VMXNET3_PCIJason Wang2016-07-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | e1000e needs net_tx_pkt.o and net_rx_pkt.o too. Cc: Dmitry Fleytman <dmitry.fleytman@ravellosystems.com> Cc: Leonid Bloch <leonid.bloch@ravellosystems.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | e1000e: fix incorrect access to pointerPaolo Bonzini2016-07-181-2/+2
| |/ / | | | | | | | | | | | | | | | | | | | | | This is not dereferencing the pointer, and instead checking only the value of the pointer. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell2016-07-191-6/+18
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # gpg: Signature made Mon 18 Jul 2016 23:53:15 BST # gpg: using RSA key 0x7DEF8106AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/ide-pull-request: block: ignore flush requests when storage is clean tests: in IDE and AHCI tests perform DMA write before flushing ide: set retry_unit for PIO and FLUSH requests ide: refactor retry_unit set and clear into separate function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | ide: set retry_unit for PIO and FLUSH requestsEvgeny Yakovlev2016-07-181-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following sequence of tests discovered a problem in IDE emulation: 1. Send DMA write to IDE device 0 2. Send CMD_FLUSH_CACHE to same IDE device which will be failed by block layer using blkdebug script in tests/ide-test:test_retry_flush When doing DMA request ide/core.c will set s->retry_unit to s->unit in ide_start_dma. When dma completes ide_set_inactive sets retry_unit to -1. After that ide_flush_cache runs and fails thanks to blkdebug. ide_flush_cb calls ide_handle_rw_error which asserts that s->retry_unit == s->unit. But s->retry_unit is still -1 after previous DMA completion and flush does not use anything related to retry. This patch restricts retry unit assertion only to ops that actually use retry logic. Signed-off-by: Evgeny Yakovlev <eyakovlev@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1468870792-7411-3-git-send-email-den@openvz.org CC: Kevin Wolf <kwolf@redhat.com> CC: Max Reitz <mreitz@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Fam Zheng <famz@redhat.com> CC: John Snow <jsnow@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
| * | ide: refactor retry_unit set and clear into separate functionEvgeny Yakovlev2016-07-181-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Code to set and clear state associated with retry in moved into ide_set_retry and ide_clear_retry to make adding retry setups easier. Signed-off-by: Evgeny Yakovlev <eyakovlev@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1468870792-7411-2-git-send-email-den@openvz.org CC: Kevin Wolf <kwolf@redhat.com> CC: Max Reitz <mreitz@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Fam Zheng <famz@redhat.com> CC: John Snow <jsnow@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
* | | Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20160718.0' ↵Peter Maydell2016-07-191-0/+1
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging VFIO update 2016-07-18 One fix for 2.7-rc0 which hides the ARI extended capability, fixing multifunction support in PCIe configurations where the assigned device function topology does not match the host (Alex Williamson) # gpg: Signature made Mon 18 Jul 2016 18:02:27 BST # gpg: using RSA key 0x239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-update-20160718.0: vfio/pci: Hide ARI capability Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | vfio/pci: Hide ARI capabilityAlex Williamson2016-07-181-0/+1
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QEMU supports ARI on downstream ports and assigned devices may support ARI in their extended capabilities. The endpoint ARI capability specifies the next function, such that the OS doesn't need to walk each possible function, however this next function is relative to the host, not the guest. This leads to device discovery issues when we combine separate functions into virtual multi-function packages in a guest. For example, SR-IOV VFs are not enumerated by simply probing the function address space, therefore the ARI next-function field is zero. When we combine multiple VFs together as a multi-function device in the guest, the guest OS identifies ARI is enabled, relies on this next-function field, and stops looking for additional function after the first is found. Long term we should expose the ARI capability to the guest to enable configurations with more than 8 functions per slot, but this requires additional QEMU PCI infrastructure to manage the next-function field for multiple, otherwise independent devices. In the short term, hiding this capability allows equivalent functionality to what we currently have on non-express chipsets. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
* / / virtio-blk: dataplane cleanupCao jin2016-07-181-4/+2
|/ / | | | | | | | | | | | | | | | | | | | | | | No need duplicate the judgment, there is one in function entry. Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1468814749-14510-1-git-send-email-caoj.fnst@cn.fujitsu.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | spapr: Ensure CPU cores are added contiguously and removed in LIFO orderBharata B Rao2016-07-181-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If CPU core addition or removal is allowed in random order leading to holes in the core id range (and hence in the cpu_index range), migration can fail as migration with holes in cpu_index range isn't yet handled correctly. Prevent this situation by enforcing the addition in contiguous order and removal in LIFO order so that we never end up with holes in cpu_index range. Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | vfio/spapr: Remove stale ioctl() callDavid Gibson2016-07-181-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ioctl() call to VFIO_IOMMU_SPAPR_TCE_REMOVE was left over from an earlier version of the code and has since been folded into vfio_spapr_remove_window(). It wasn't caught because although the argument structure has been removed, the libc function remove() means this didn't trigger a compile failure. The ioctl() was also almost certain to fail silently and harmlessly with the bogus argument, so this wasn't caught in testing. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
* | dbdma: reset io->processing flag for unassigned DBDMA channel rw accessesMark Cave-Ayland2016-07-181-0/+1
| | | | | | | | | | | | | | | | Otherwise MacOS 9 hangs upon shutdown. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | dbdma: set FLUSH bit upon reception of flush command for unassigned DBDMA ↵Mark Cave-Ayland2016-07-181-0/+10
| | | | | | | | | | | | | | | | | | | | | | channels This fixes MacOS 9 whereby it continually flushes and polls the status bits until they are set to indicate a successful flush. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | dbdma: fix load_word/store_word value endiannessMark Cave-Ayland2016-07-181-19/+5
| | | | | | | | | | | | | | | | | | | | | | The values to read/write to/from physical memory are copied directly to the physical address with no endian swapping required. Also add some extra information to debugging output while we are here. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | dbdma: fix endian of DBDMA_CMDPTR_LO during branchMark Cave-Ayland2016-07-181-1/+1
| | | | | | | | | | | | | | | | | | The current DBDMA command is stored in little-endian format, so make sure we convert it to match our CPU when updating the DBDMA_CMDPTR_LO register. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | dbdma: add per-channel debugging enabled via DEBUG_DBDMA_CHANMASKMark Cave-Ayland2016-07-181-33/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default large amounts of DBDMA debugging are produced when often it is just 1 or 2 channels that are of interest. Introduce DEBUG_DBDMA_CHANMASK to allow the developer to select the channels of interest at compile time, and then further add the extra channel information to each debug statement where possible. Also clearly mark the start/end of DBDMA_run_bh to allow tracking the bottom half execution. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | dbdma: always define DBDMA_DPRINTF and enable debug with DEBUG_DBDMAMark Cave-Ayland2016-07-181-8/+7
| | | | | | | | | | | | | | | | | | Enabling DBDMA_DPRINTF unconditionally ensures that any errors in debug statements are picked up immediately. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | spapr: fix core unplug crashGreg Kurz2016-07-181-4/+2
|/ | | | | | | | | | | | | | | | | | | | | | | | | | If the host has 8 threads/core and the guest is started with: -smp cores=1,threads=4,maxcpus=12 It is possible to crash QEMU by doing: (qemu) device_add host-spapr-cpu-core,core-id=16,id=foo (qemu) device_del foo Segmentation fault This happens because spapr_core_unplug() assumes cpu_dt_id == core_id. As long as cpu_dt_id is derived from the non-table cpu_index, this is only true when you plug cores with contiguous ids. It is safer to be consistent: the DR connector was created with an index that is immediately written to cc->core_id, and spapr_core_plug() also relies on cc->core_id. Let's use it also in spapr_core_unplug(). Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* Merge remote-tracking branch ↵Peter Maydell2016-07-147-36/+100
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20160714' into staging target-arm queue: * add virtio-mmio transport base address to device path (avoid an assertion failure with multiple virtio-scsi-devices) * revert hw/ptimer commit 5a50307 which causes regressions on SPARC guests * use Neon to accelerate zero-page checking on AArch64 hosts * set the MPIDR for TCG to match how KVM does it (and fit with GICv2/GICv3 restrictions on SGI target lists) * add some missing AArch32 TLBI hypervisor TLB operations * m25p80: Fix QIOR/DIOR handling for Winbond * hw/misc: fix typo in Aspeed SCU hw-strap2 property name * ast2400: pretend DMAs are done for U-boot * ast2400: some minor code cleanups # gpg: Signature made Thu 14 Jul 2016 17:21:30 BST # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20160714: ast2400: externalize revision numbers ast2400: pretend DMAs are done for U-boot ast2400: replace aspeed_smc_is_implemented() hw/misc: fix typo in Aspeed SCU hw-strap2 property name m25p80: Fix QIOR/DIOR handling for Winbond target-arm: Add missed AArch32 TLBI sytem registers hw/arm/virt: tcg: adjust MPIDR like KVM gic: provide defines for v2/v3 targetlist sizes target-arm: Use Neon for zero checking Revert "hw/ptimer: Perform counter wrap around if timer already expired" virtio-mmio: format transport base address in BusClass.get_dev_path Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ast2400: externalize revision numbersCédric Le Goater2016-07-142-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | AST2400_A0_SILICON_REV is defined twice. Fix this by including the definition in the header file as well as the routine to check if a silicon revision is supported. It will useful to reuse in other controllers. Let's add also AST2500_A0_SILICON_REV for future use. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467994016-11678-5-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ast2400: pretend DMAs are done for U-bootCédric Le Goater2016-07-141-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | U-boot does SPI timing calibration using DMA tranfers. To let the initialization continue, we fake success by setting the DMA status of the Interrupt Control Register. For the moment, DMA support is not required as it is not used in normal operation. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467994016-11678-4-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ast2400: replace aspeed_smc_is_implemented()Cédric Le Goater2016-07-141-20/+15
| | | | | | | | | | | | | | | | | | | | | | | | aspeed_smc_is_implemented() filters invalid registers in a peculiar way. Let's remove it and open code the if conditions. It serves the same purpose, the aesthetic is better, and new registers can easily be added. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467994016-11678-3-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/misc: fix typo in Aspeed SCU hw-strap2 property nameCédric Le Goater2016-07-141-1/+1
| | | | | | | | | | | | | | Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467994016-11678-2-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * m25p80: Fix QIOR/DIOR handling for WinbondMarcin Krzeminski2016-07-141-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | Winbond also support continuous read mode, but as an opposite for other flash type read mode clock cycles are included to dummy cycles number. This path add proper handling of read mode byte and update needed dummy cycles. QPI mode and dummy cycles configuration are not supported. Signed-off-by: Marcin Krzeminski <marcin.krzeminski@nokia.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467809036-6986-1-git-send-email-marcin.krzeminski@nokia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/arm/virt: tcg: adjust MPIDR like KVMAndrew Jones2016-07-141-1/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KVM adjusts the MPIDR of guest vcpus based on the architecture of the host, 32-bit vs. 64-bit, and, for 64-bit, also on the type of GIC the guest is using. To be consistent and improve SGI efficiency we make the same adjustments for TCG as 64-bit KVM hosts. We neglect to add consistency with 32-bit KVM hosts, as that would reduce SGI efficiency and KVM is expected to change. As MPIDR is a system register, and thus guest visible, we only make adjustments for current and later versioned machines. Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 1467378129-23302-3-git-send-email-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * Revert "hw/ptimer: Perform counter wrap around if timer already expired"Dmitry Osipenko2016-07-141-7/+2
| | | | | | | | | | | | | | | | | | | | | | | | Software should see timer counter wraparound only after IRQ being triggered. This fixes regression introduced by the commit 5a50307 ("hw/ptimer: Perform counter wrap around if timer already expired"), resulting in monotonic timer jumping backwards on SPARC emulated machine running NetBSD guest OS, as reported by Mark Cave-Ayland. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 20160708132206.2080-1-digetx@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * virtio-mmio: format transport base address in BusClass.get_dev_pathLaszlo Ersek2016-07-141-0/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At the moment the following QEMU command line triggers an assertion failure (minimal reproducer by Cole): qemu-system-aarch64 \ -machine virt-2.6,accel=tcg \ -nodefaults \ -no-user-config \ -nographic -monitor stdio \ -device virtio-scsi-device,id=scsi0 \ -device virtio-scsi-device,id=scsi1 \ -drive file=foo.img,format=raw,if=none,id=d0 \ -device scsi-hd,bus=scsi0.0,drive=d0 \ -drive file=foo.img,format=raw,if=none,id=d1 \ -device scsi-hd,bus=scsi1.0,drive=d1 qemu-system-aarch64: migration/savevm.c:615: vmstate_register_with_alias_id: Assertion `!se->compat || se->instance_id == 0' failed. The reason is that the vmstate sections for the two scsi-hd devices are not uniquely identifiable by name. The direct parent buses of the scsi-hd devices -- scsi0.0 and scsi1.0 -- support the BusClass.get_dev_path member function. scsibus_get_dev_path() formats a device path prefix with the help of its topologically parent bus, and then appends the chan:id:lun triplet to it. For both scsi-hd devices, this triplet is 0:0:0. (Here we use "device path" in the QEMU migration sense, for vmstate section identification, not in the OFW or UEFI device path senses.) The virtio-scsi HBA is plugged into the virtio-mmio bus (implemented by the internal VirtIOMMIOProxy device). This bus class (TYPE_VIRTIO_MMIO_BUS) inherits, as its get_dev_path() member function, the virtio_bus_get_dev_path() method from its parent class (TYPE_VIRTIO_BUS). virtio_bus_get_dev_path() does not format any kind of device address on its own; "virtio addresses" are transport-specific. Therefore virtio_bus_get_dev_path() asks the topologically parent bus of the proxy object (implementing the specific virtio transport) to format the address of the proxy object. (For virtio-pci devices (where the proxy is an instance of VirtIOPCIProxy, plugged into a PCI bus), this ends up in pcibus_get_dev_path().) However, VirtIOMMIOProxy is usually (in practice: always) plugged into "main-system-bus", the singleton TYPE_SYSTEM_BUS object. This BusClass does not support formatting QEMU vmstate device paths at all (as SysBusDevice objects can have zero or more IO ports and zero or more MMIO regions). Hence the formatting request delegated from virtio_bus_get_dev_path() gets answered with NULL. The end result is that the two scsi-hd devices end up with the same device path "0:0:0", which triggers the assert. We can solve this by recognizing that virtio-mmio transports are distinguished from each other by their base addresses in MMIO address space. Implement virtio_mmio_bus_get_dev_path() as follows: (1) The virtio device whose devpath is to be formatted resides on a virtio-mmio bus that is implemented by a VirtIOMMIOProxy object. Ask the parent bus of VirtIOMMIOProxy to format the device path of VirtIOMMIOProxy, as a path prefix. (This is identical to what virtio_bus_get_dev_path() does.) (2) Append the base address of VirtIOMMIOProxy to the device path, such as: - virtio-mmio@000000000a003e00, - virtio-mmio@000000000a003c00. Given that these device paths are placed in the migration stream, step (2) above, if done unconditionally, would break migration. So make that step conditional on a new VirtIOMMIOProxy property, which is enabled for 2.7 machine types and later. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Cole Robinson <crobinso@redhat.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: Kevin Zhao <kevin.zhao@linaro.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Tom Hanson <thomas.hanson@linaro.org> Reported-by: Kevin Zhao <kevin.zhao@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1467739394-28357-1-git-send-email-lersek@redhat.com Fixes: https://bugs.launchpad.net/qemu/+bug/1594239 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream-fwcfg' into ↵Peter Maydell2016-07-142-3/+9
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging * Updated fw_cfg option ROM to include DMA support # gpg: Signature made Thu 14 Jul 2016 14:51:06 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream-fwcfg: Add optionrom compatible with fw_cfg DMA version Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * Add optionrom compatible with fw_cfg DMA versionMarc Marí2016-07-142-3/+9
| | | | | | | | | | | | | | | | | | | | This optionrom is based on linuxboot.S. Signed-off-by: Marc Marí <markmb@redhat.com> Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Message-Id: <1464027093-24073-2-git-send-email-rjones@redhat.com> [Add -fno-toplevel-reorder, support clang without -m16. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/xtensa/tags/20160714-xtensa' into stagingPeter Maydell2016-07-141-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xtensa-related fixes: - fix FLASH interface width for XTFPGA boards. # gpg: Signature made Thu 14 Jul 2016 12:00:05 BST # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20160714-xtensa: target-xtensa: xtfpga: fix FLASH interface width Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target-xtensa: xtfpga: fix FLASH interface widthMax Filippov2016-07-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | FLASH chip on XTFPGA boards is connected with 16-bit-wide interface. Latest U-Boot can see the difference and does not work correctly with 32-bit-wide interface. Set FLASH chip 'width' property to 2. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
* | | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2016-07-143-12/+61
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * SCSI scanner support * fixes to qemu-char and net exit * FreeBSD fixes * Other small bugfixes # gpg: Signature made Wed 13 Jul 2016 12:30:11 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hostmem: detect host backend memory is being used properly hostmem: fix QEMU crash by 'info memdev' char: do not use atexit cleanup handler net: do not use atexit for cleanup slirp: use exit notifier for slirp_smb_cleanup tap: use an exit notifier to call down_script util: Fix MIN_NON_ZERO qemu-sockets: use qapi_free_SocketAddress in cleanup disas: avoid including everything in headers compiled from C++ json-streamer: fix double-free on exiting during a parse main-loop: check return value before using pointer Use "-s" instead of "--quiet" to resolve non-fatal build error on FreeBSD. scsi-bus: Use longer sense buffer with scanners scsi-bus: Add SCSI scanner support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | hostmem: detect host backend memory is being used properlyXiao Guangrong2016-07-132-11/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, we use memory_region_is_mapped() to detect if the host backend memory is being used. This works if the memory is directly mapped into guest's address space, however, it is not true for nvdimm as it uses aliased memory region to map the memory. This is why this bug can happen: https://bugzilla.redhat.com/show_bug.cgi?id=1352769 Fix it by introduce a new filed, is_mapped, to HostMemoryBackend, we set/clear this filed accordingly when the device link/unlink to host backend memory Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | | scsi-bus: Use longer sense buffer with scannersJarkko Lavinen2016-07-121-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Scanners can provide additional sense bytes beyond 18 bytes. VueScan uses 32 bytes alloc length with Request Sense command. Signed-off-by: Jarkko Lavinen <jarkko.lavinen@iki.fi> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>