summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* s390x/pci: search for subregion inside the BARsPierre Morel2017-12-141-19/+25
| | | | | | | | | | | | | | | | | | | | When dispatching memory access to PCI BAR region, we must look for possible subregions, used by the PCI device to map different memory areas inside the same PCI BAR. Since the data offset we received is calculated starting at the region start address we need to adjust the offset for the subregion. The data offset inside the subregion is calculated by substracting the subregion's starting address from the data offset in the region. The access to the MSIX region is now handled in a generic way, we do not need the specific trap_msix() function anymore. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Reviewed-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Message-Id: <1512046530-17773-8-git-send-email-pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/pci: move the memory region write from pcistgPierre Morel2017-12-141-10/+17
| | | | | | | | | | | | | Let's move the memory region write from pcistg into a dedicated function. This allows us to prepare a later patch searching for subregions inside of the memory region. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Reviewed-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <1512046530-17773-7-git-send-email-pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/pci: move the memory region read from pcilgPierre Morel2017-12-141-4/+11
| | | | | | | | | | | Let's move the memory region read from pcilg into a dedicated function. This allows us to prepare a later patch. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Reviewed-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <1512046530-17773-6-git-send-email-pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/pci: rework PCI STORE BLOCKPierre Morel2017-12-143-25/+41
| | | | | | | | | | | | | | | | | | Enhance the fault detection. Fixup the precedence to check the destination path existance before checking for the source accessibility. Add the maxstbl entry to both the Query PCI Function Group response and the PCIBusDevice structure. Initialize the maxstbl to 128 per default until we get the actual data from the hardware. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Reviewed-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Message-Id: <1512046530-17773-5-git-send-email-pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/pci: rework PCI LOADPierre Morel2017-12-141-11/+14
| | | | | | | | | Enhance the fault detection, correction of the fault reporting. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Reviewed-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Message-Id: <1512046530-17773-4-git-send-email-pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/pci: rework PCI STOREPierre Morel2017-12-142-16/+29
| | | | | | | | | Enhance the fault detection, correction of the fault reporting. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Reviewed-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Message-Id: <1512046530-17773-3-git-send-email-pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/pci: factor out endianess conversionPierre Morel2017-12-141-26/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | There are two places where the same endianness conversion is done. Let's factor this out into a static function. Note that the conversion must always be done for data in a register: The S390 BE guest converted date to le before issuing the instruction. After interception in a BE host: ZPCI VFIO using pwrite must make the conversion back for the BE kernel. Kernel will do BE to le translation when loading the register for the real instruction. After interception in a le host: TCG stores a BE register in le, swapping bytes. But since the data in the register was already le it is now BE ZPCI VFIO must convert it to le before writing to the PCI memory. In both cases ZPCI VFIO must swap the bytes from the register. Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Reviewed-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Message-Id: <1512046530-17773-2-git-send-email-pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x: handle exceptions during s390_cpu_virt_mem_rw() correctly (TCG)David Hildenbrand2017-12-141-0/+7
| | | | | | | | | | | | | | | | | s390_cpu_virt_mem_rw() must always return, so callers can react on an exception (e.g. see ioinst_handle_stcrw()). However, for TCG we always have to exit the cpu loop (and restore the cpu state before that) if we injected a program interrupt. So let's introduce and use s390_cpu_virt_mem_handle_exc() in code that is not purely KVM. Directly pass the retaddr we already have available in these functions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20171130162744.25442-8-david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/pci: pass the retaddr to all PCI instructionsDavid Hildenbrand2017-12-142-47/+52
| | | | | | | | | | | | | | | | | Once we wire up TCG, we will need the retaddr to correctly inject program interrupts. As we want to get rid of the function program_interrupt(), convert PCI code too. For KVM, we can simply use RA_IGNORED. Convert program_interrupt() to s390_program_interrupt() directly, making use of the passed address. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20171130162744.25442-6-david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x/tcg: rip out dead tpi codeDavid Hildenbrand2017-12-141-6/+0
| | | | | | | | | | | It is broken and not even wired up. We'll add a new handler soon, but that will live somewhere else. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20171130162744.25442-4-david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* s390x: introduce 2.12 compat machineCornelia Huck2017-12-141-1/+16
| | | | | | Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20171214' into ↵Peter Maydell2017-12-141-22/+0
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging HMP pull 2017-12-14 # gpg: Signature made Thu 14 Dec 2017 12:46:41 GMT # gpg: using RSA key 0x0516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-hmp-20171214: tests: test-hmp: print command execution result hmp-commands: Remove the deprecated usb_add and usb_del Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hmp-commands: Remove the deprecated usb_add and usb_delThomas Huth2017-12-141-22/+0
| | | | | | | | | | | | | | | | | | | | | | | | It's easy to use device_add and device_del as replacement instead. The usb_add and usb_del commands are deprecated since QEMU 2.10, and nobody complained that they are still needed, so let's get rid of them now to make the HMP interface a little bit less overloaded. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1512073140-17672-1-git-send-email-thuth@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2017-12-148-163/+1050
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20171213' into staging target-arm queue: * xilinx_spips: set reset values correctly * MAINTAINERS: fix an email address * hw/display/tc6393xb: limit irq handler index to TC6393XB_GPIOS * nvic: Make systick banked for v8M * refactor get_phys_addr() so we can return the right format PAR for ATS operations * implement v8M TT instruction * fix some minor v8M bugs * Implement reset for GICv3 ITS * xlnx-zcu102: Add support for the ZynqMP QSPI # gpg: Signature made Wed 13 Dec 2017 18:01:31 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20171213: (43 commits) xilinx_spips: Use memset instead of a for loop to zero registers xilinx_spips: Set all of the reset values xilinx_spips: Update the QSPI Mod ID reset value MAINTAINERS: replace the unavailable email address hw/display/tc6393xb: limit irq handler index to TC6393XB_GPIOS nvic: Make systick banked nvic: Make nvic_sysreg_ns_ops work with any MemoryRegion target/arm: Extend PAR format determination target/arm: Remove fsr argument from get_phys_addr() and arm_tlb_fill() target/arm: Ignore fsr from get_phys_addr() in do_ats_write() target/arm: Use ARMMMUFaultInfo in deliver_fault() target/arm: Convert get_phys_addr_pmsav8() to not return FSC values target/arm: Convert get_phys_addr_pmsav7() to not return FSC values target/arm: Convert get_phys_addr_pmsav5() to not return FSC values target/arm: Convert get_phys_addr_lpae() to not return FSC values target/arm: Convert get_phys_addr_v6() to not return FSC values target/arm: Convert get_phys_addr_v5() to not return FSC values target/arm: Remove fsr argument from arm_ld*_ptw() target/arm: Provide fault type enum and FSR conversion functions target/arm: Implement TT instruction ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Use memset instead of a for loop to zero registersAlistair Francis2017-12-131-8/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use memset() instead of a for loop to zero all of the registers. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: c076e907f355923864cb1afde31b938ffb677778.1513104804.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Set all of the reset valuesAlistair Francis2017-12-131-5/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Following the ZynqMP register spec let's ensure that all reset values are set. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 19836f3e0a298b13343c5a59c87425355e7fd8bd.1513104804.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Update the QSPI Mod ID reset valueAlistair Francis2017-12-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the reset value to match the latest ZynqMP register spec. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: c03e51d041db7f055596084891aeb1e856e32b9f.1513104804.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/display/tc6393xb: limit irq handler index to TC6393XB_GPIOSPrasad J Pandit2017-12-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ctz32() routine could return a value greater than TC6393XB_GPIOS=16, because the device has 24 GPIO level bits but we only implement 16 outgoing lines. This could lead to an OOB array access. Mask 'level' to avoid it. Reported-by: Moguofang <moguofang@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20171212041539.25700-1-ppandit@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | nvic: Make systick bankedPeter Maydell2017-12-131-13/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For the v8M security extension, there should be two systick devices, which use separate banked systick exceptions. The register interface is banked in the same way as for other banked registers, including the existence of an NS alias region for secure code to access the nonsecure timer. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1512154296-5652-3-git-send-email-peter.maydell@linaro.org
| * | nvic: Make nvic_sysreg_ns_ops work with any MemoryRegionPeter Maydell2017-12-131-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Generalize nvic_sysreg_ns_ops so that we can pass it an arbitrary MemoryRegion which it will use as the underlying register implementation to apply the NS-alias behaviour to. We'll want this so we can do the same with systick. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1512154296-5652-2-git-send-email-peter.maydell@linaro.org
| * | hw/intc/arm_gicv3_its: Implement full resetEric Auger2017-12-131-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Voiding the ITS caches is not supposed to happen via individual register writes. So we introduced a dedicated ITS KVM device ioctl to perform a cold reset of the ITS: KVM_DEV_ARM_VGIC_GRP_CTRL/KVM_DEV_ARM_ITS_CTRL_RESET. Let's use this latter if the kernel supports it. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1511883692-11511-5-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/intc/arm_gicv3_its: Implement a minimalist resetEric Auger2017-12-131-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At the moment the ITS is not properly reset and this causes various bugs on save/restore. We implement a minimalist reset through individual register writes but for kernel versions before v4.15 this fails voiding the vITS cache. We cannot claim we have a comprehensive reset (hence the error message) but that's better than nothing. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1511883692-11511-3-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/intc/arm_gicv3_its: Don't call post_load on resetEric Auger2017-12-132-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the very beginning, post_load() was called from common reset. This is not standard and obliged to discriminate the reset case from the restore case using the iidr value. Let's get rid of that call. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1511883692-11511-2-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xlnx-zcu102: Add support for the ZynqMP QSPIFrancisco Iglesias2017-12-132-0/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the ZynqMP QSPI (consisting of the Generic QSPI and Legacy QSPI) and connect Numonyx n25q512a11 flashes to it. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20171126231634.9531-14-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Add support for the ZynqMP Generic QSPIFrancisco Iglesias2017-12-131-47/+532
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the Zynq Ultrascale MPSoc Generic QSPI. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-13-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Don't set TX FIFO UNDERFLOW at cmd doneFrancisco Iglesias2017-12-131-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't set TX FIFO UNDERFLOW interrupt after transmitting the commands. Also update interrupts after reading out the interrupt status. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Acked-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-12-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Add support for 4 byte addresses in the LQSPIFrancisco Iglesias2017-12-131-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for 4 byte addresses in the LQSPI and correct LQSPI_CFG_SEP_BUS. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-11-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Add support for zero pumpingFrancisco Iglesias2017-12-131-7/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for zero pumping according to the transfer size register. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-10-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Make tx/rx_data_bytes more generic and reusableFrancisco Iglesias2017-12-131-27/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make tx/rx_data_bytes more generic so they can be reused (when adding support for the Zynqmp Generic QSPI). Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-9-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Add support for RX discard and RX drainFrancisco Iglesias2017-12-131-18/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the RX discard and RX drain functionality. Also transmit one byte per dummy cycle (to the flash memories) with commands that require these. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-8-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Update striping to be big-endian bit orderFrancisco Iglesias2017-12-131-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update striping functionality to be big-endian bit order (as according to the Zynq-7000 Technical Reference Manual). Output thereafter the even bits into the flash memory connected to the lower QSPI bus and the odd bits into the flash memory connected to the upper QSPI bus. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Acked-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-7-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | xilinx_spips: Move FlashCMD, XilinxQSPIPS and XilinxSPIPSClassFrancisco Iglesias2017-12-131-35/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the FlashCMD enum, XilinxQSPIPS and XilinxSPIPSClass structures to the header for consistency (struct XilinxSPIPS is found there). Also move out a define and remove two double included headers (while touching the code). Finally, add 4 byte address commands to the FlashCMD enum. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-6-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | m25p80: Add support for n25q512a11 and n25q512a13Francisco Iglesias2017-12-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for Micron (Numonyx) n25q512a11 and n25q512a13 flashes. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Acked-by: Marcin Krzemiński <mar.krzeminski@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-5-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | m25p80: Add support for BRRD/BRWR and BULK_ERASE (0x60)Francisco Iglesias2017-12-131-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the bank address register access commands (BRRD/BRWR) and the BULK_ERASE (0x60) command. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Acked-by: Marcin Krzemiński <mar.krzeminski@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-4-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | m25p80: Add support for SST READ ID 0x90/0xAB commandsFrancisco Iglesias2017-12-131-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for SST READ ID 0x90/0xAB commands for reading out the flash manufacturer ID and device ID. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20171126231634.9531-3-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | m25p80: Add support for continuous read out of RDSR and READ_FSRFrancisco Iglesias2017-12-131-1/+38
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for continuous read out of the RDSR and READ_FSR status registers until the chip select is deasserted. This feature is supported by amongst others 1 or more flashtypes manufactured by Numonyx (Micron), Windbond, SST, Gigadevice, Eon and Macronix. Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Acked-by: Marcin Krzemiński<mar.krzeminski@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20171126231634.9531-2-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | vfio-pci: Remove unused fields from VFIOMSIXInfoAlexey Kardashevskiy2017-12-131-2/+0
| | | | | | | | | | | | | | | | | | When support for multiple mappings per a region were added, this was left behind, let's finish and remove unused bits. Fixes: db0da029a185 ("vfio: Generalize region support") Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* | vfio/spapr: Allow fallback to SPAPR TCE IOMMU v1Alexey Kardashevskiy2017-12-131-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The vfio_iommu_spapr_tce driver advertises kernel's support for v1 and v2 IOMMU support, however it is not always possible to use the requested IOMMU type. For example, a pseries host platform does not support dynamic DMA windows so v2 cannot initialize and QEMU fails to start. This adds a fallback to the v1 IOMMU if v2 cannot be used. Fixes: 318f67ce1371 ("vfio: spapr: Add DMA memory preregistering (SPAPR IOMMU v2)") Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* | vfio/common: init giommu_list and hostwin_list of vfio containerLiu, Yi L2017-12-131-0/+2
| | | | | | | | | | | | | | | | The init of giommu_list and hostwin_list is missed during container initialization. Signed-off-by: Liu, Yi L <yi.l.liu@linux.intel.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* | vfio: Fix vfio-kvm group registrationAlex Williamson2017-12-131-0/+1
|/ | | | | | | | | | | | | | | | | | | | | | | Commit 8c37faa475f3 ("vfio-pci, ppc64/spapr: Reorder group-to-container attaching") moved registration of groups with the vfio-kvm device from vfio_get_group() to vfio_connect_container(), but it missed the case where a group is attached to an existing container and takes an early exit. Perhaps this is a less common case on ppc64/spapr, but on x86 (without viommu) all groups are connected to the same container and thus only the first group gets registered with the vfio-kvm device. This becomes a problem if we then hot-unplug the devices associated with that first group and we end up with KVM being misinformed about any vfio connections that might remain. Fix by including the call to vfio_kvm_device_add_group() in this early exit path. Fixes: 8c37faa475f3 ("vfio-pci, ppc64/spapr: Reorder group-to-container attaching") Cc: qemu-stable@nongnu.org # qemu-2.10+ Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Tested-by: Peter Xu <peterx@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* vhost-scsi: add missing virtqueue_size parameterEric Farman2017-12-051-0/+2
| | | | | | | | | | | | | | | | | Commit 5c0919d02066 ("virtio-scsi: Add virtqueue_size parameter allowing virtqueue size to be set.") introduced a new parameter to virtio-scsi. Later, commit 920036106044 ("vhost-user-scsi: add missing virtqueue_size param") added that parameter to the new vhost-user-scsi interface but neglected the existing vhost-scsi interface it was built on. Apply the same change to vhost-scsi, so that we can boot a guest with a device defined. This also avoids crashing a guest when hotplugging a vhost-scsi device. Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Message-id: 20171201151538.6844-2-farman@linux.vnet.ibm.com Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2017-12-043-6/+33
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pc, pci, virtio: fixes for rc3 A bunch of fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 01 Dec 2017 17:06:33 GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: pc: fix crash on attempted cpu unplug virtio: check VirtQueue Vring object is set vhost: fix error check in vhost_verify_ring_mappings() dump-guest-memory.py: fix No symbol "vmcoreinfo_find" vhost: restore avail index from vring used index on disconnection virtio: Add queue interface to restore avail index from vring used index i386/msi: Correct mask of destination ID in MSI address Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * pc: fix crash on attempted cpu unplugIgor Mammedov2017-12-011-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when qemu is started with '-no-acpi' CLI option, an attempt to unplug a CPU using device_del results in null pointer dereference at: #0 object_get_class #1 pc_machine_device_unplug_request_cb #2 qmp_marshal_device_del which is caused by pcms->acpi_dev == NULL due to ACPI support being disabled. Considering that ACPI support is necessary for unplug to work, check that it's enabled and fail unplug request gracefully if no acpi device were found. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio: check VirtQueue Vring object is setPrasad J Pandit2017-12-011-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | A guest could attempt to use an uninitialised VirtQueue object or unset Vring.align leading to a arithmetic exception. Add check to avoid it. Reported-by: Zhangboxian <zhangboxian@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
| * vhost: fix error check in vhost_verify_ring_mappings()Greg Kurz2017-12-011-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit f1f9e6c5 "vhost: adapt vhost_verify_ring_mappings() to virtio 1 ring layout", we check the mapping of each part (descriptor table, available ring and used ring) of each virtqueue separately. The checking of a part is done by the vhost_verify_ring_part_mapping() function: it returns either 0 on success or a negative errno if the part cannot be mapped at the same place. Unfortunately, the vhost_verify_ring_mappings() function checks its return value the other way round. It means that we either: - only verify the descriptor table of the first virtqueue, and if it is valid we ignore all the other mappings - or ignore all broken mappings until we reach a valid one ie, we only raise an error if all mappings are broken, and we consider all mappings are valid otherwise (false success), which is obviously wrong. This patch ensures that vhost_verify_ring_mappings() only returns success if ALL mappings are okay. Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost: restore avail index from vring used index on disconnectionMaxime Coquelin2017-12-011-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | vhost_virtqueue_stop() gets avail index value from the backend, except if the backend is not responding. It happens when the backend crashes, and in this case, internal state of the virtio queue is inconsistent, making packets to corrupt the vring state. With a Linux guest, it results in following error message on backend reconnection: [ 22.444905] virtio_net virtio0: output.0:id 0 is not a head! [ 22.446746] net enp0s3: Unexpected TXQ (0) queue failure: -5 [ 22.476360] net enp0s3: Unexpected TXQ (0) queue failure: -5 Fixes: 283e2c2adcb8 ("net: virtio-net discards TX data after link down") Cc: qemu-stable@nongnu.org Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio: Add queue interface to restore avail index from vring used indexMaxime Coquelin2017-12-011-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In case of backend crash, it is not possible to restore internal avail index from the backend value as vhost_get_vring_base callback fails. This patch provides a new interface to restore internal avail index from the vring used index, as done by some vhost-user backend on reconnection. Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | spapr: Include "pre-plugged" DIMMS in ram size calculation at resetDavid Gibson2017-12-041-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At guest reset time, we allocate a hash page table (HPT) for the guest based on the guest's RAM size. If dynamic HPT resizing is not available we use the maximum RAM size, if it is we use the current RAM size. But the "current RAM size" calculation is incorrect - we just use the "base" ram_size from the machine structure. This doesn't include any pluggable DIMMs that are already plugged at reset time. This means that if you try to start a 'pseries' machine with a DIMM specified on the command line that's much larger than the "base" RAM size, then the guest will get a woefully inadequate HPT. This can lead to a guest freeze during boot as it runs out of HPT space during initial MMU setup. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org> Tested-by: Greg Kurz <groug@kaod.org>
* | pseries: fix TCG migrationLaurent Vivier2017-11-301-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | Migration of pseries is broken with TCG because QEMU tries to restore KVM MMU state unconditionally. The result is a SIGSEGV in kvm_vm_ioctl(): #0 kvm_vm_ioctl (s=0x0, type=-2146390353) at qemu/accel/kvm/kvm-all.c:2032 #1 0x00000001003e3e2c in kvmppc_configure_v3_mmu (cpu=<optimized out>, radix=<optimized out>, gtse=<optimized out>, proc_tbl=<optimized out>) at qemu/target/ppc/kvm.c:396 #2 0x00000001002f8b88 in spapr_post_load (opaque=0x1019103c0, version_id=<optimized out>) at qemu/hw/ppc/spapr.c:1578 #3 0x000000010059e4cc in vmstate_load_state (f=0x106230000, vmsd=0x1009479e0 <vmstate_spapr>, opaque=0x1019103c0, version_id=<optimized out>) at qemu/migration/vmstate.c:165 #4 0x00000001005987e0 in vmstate_load (f=<optimized out>, se=<optimized out>) at qemu/migration/savevm.c:748 This patch fixes the problem by not calling the KVM function with the TCG mode. Fixes: d39c90f5f3 ("spapr: Fix migration of Radix guests") Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* virtio-net: don't touch virtqueue if vm is stoppedJason Wang2017-11-281-1/+2
| | | | | | | | | | | | | | | | | | | | | Guest state should not be touched if VM is stopped, unfortunately we didn't check running state and tried to drain tx queue unconditionally in virtio_net_set_status(). A crash was then noticed as a migration destination when user type quit after virtqueue state is loaded but before region cache is initialized. In this case, virtio_net_drop_tx_queue_data() tries to access the uninitialized region cache. Fix this by only dropping tx queue data when vm is running. Fixes: 283e2c2adcb80 ("net: virtio-net discards TX data after link down") Cc: Yuri Benditovich <yuri.benditovich@daynix.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>