aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2019-09-03memory: Single byte swap along the I/O pathTony Nguyen1-6/+4
Now that MemOp has been pushed down into the memory API, and callers are encoding endianness, we can collapse byte swaps along the I/O path into the accelerator and target independent adjust_endianness. Collapsing byte swaps along the I/O path enables additional endian inversion logic, e.g. SPARC64 Invert Endian TTE bit, with redundant byte swaps cancelling out. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Message-Id: <911ff31af11922a9afba9b7ce128af8b8b80f316.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-09-03memory: Access MemoryRegion with endiannessTony Nguyen4-13/+19
Preparation for collapsing the two byte swaps adjust_endianness and handle_bswap into the former. Call memory_region_dispatch_{read|write} with endianness encoded into the "MemOp op" operand. This patch does not change any behaviour as memory_region_dispatch_{read|write} is yet to handle the endianness. Once it does handle endianness, callers with byte swaps can collapse them into adjust_endianness. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Message-Id: <8066ab3eb037c0388dfadfe53c5118429dd1de3a.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-09-03hw/s390x: Hard code size with MO_{8|16|32|64}Tony Nguyen1-2/+1
Temporarily no-op size_memop was introduced to aid the conversion of memory_region_dispatch_{read|write} operand "unsigned size" into "MemOp op". Now size_memop is implemented, again hard coded size but with MO_{8|16|32|64}. This is more expressive and avoids size_memop calls. Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <76dc97273a8eb5e10170ffc16526863df808f487.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-09-03hw/vfio: Access MemoryRegion with MemOpTony Nguyen1-2/+4
The memory_region_dispatch_{read|write} operand "unsigned size" is being converted into a "MemOp op". Convert interfaces by using no-op size_memop. After all interfaces are converted, size_memop will be implemented and the memory_region_dispatch_{read|write} operand "unsigned size" will be converted into a "MemOp op". As size_memop is a no-op, this patch does not change any behaviour. Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <e70ff5814ac3656974180db6375397c43b0bc8b8.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-09-03hw/virtio: Access MemoryRegion with MemOpTony Nguyen1-2/+5
The memory_region_dispatch_{read|write} operand "unsigned size" is being converted into a "MemOp op". Convert interfaces by using no-op size_memop. After all interfaces are converted, size_memop will be implemented and the memory_region_dispatch_{read|write} operand "unsigned size" will be converted into a "MemOp op". As size_memop is a no-op, this patch does not change any behaviour. Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <ebf1f78029d5ac1de1739a11d679740a87a1f02f.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-09-03hw/intc/armv7m_nic: Access MemoryRegion with MemOpTony Nguyen1-4/+8
The memory_region_dispatch_{read|write} operand "unsigned size" is being converted into a "MemOp op". Convert interfaces by using no-op size_memop. After all interfaces are converted, size_memop will be implemented and the memory_region_dispatch_{read|write} operand "unsigned size" will be converted into a "MemOp op". As size_memop is a no-op, this patch does not change any behaviour. Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <21113bae2f54b45176701e0bf595937031368ae6.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-09-03hw/s390x: Access MemoryRegion with MemOpTony Nguyen1-3/+5
The memory_region_dispatch_{read|write} operand "unsigned size" is being converted into a "MemOp op". Convert interfaces by using no-op size_memop. After all interfaces are converted, size_memop will be implemented and the memory_region_dispatch_{read|write} operand "unsigned size" will be converted into a "MemOp op". As size_memop is a no-op, this patch does not change any behaviour. Signed-off-by: Tony Nguyen <tony.nguyen@bt.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <2f41da26201fb9b0339c2b7fde34df864f7f9ea8.1566466906.git.tony.nguyen@bt.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-08-27xen-bus: Avoid rewriting identical values to xenstoreAnthony PERARD1-4/+7
When QEMU receives a xenstore watch event suggesting that the "state" of the frontend changed, it records this in its own state but it also re-write the value back into xenstore even so there were no change. This triggers an unnecessary xenstore watch event which QEMU will process again (and maybe the frontend as well). Also QEMU could potentially write an already old value. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Paul Durrant <paul.durrant@citrix.com> Message-Id: <20190823101534.465-3-anthony.perard@citrix.com>
2019-08-27xen-bus: Fix backend state transition on device resetAnthony PERARD1-3/+20
When a frontend wants to reset its state and the backend one, it starts with setting "Closing", then waits for the backend (QEMU) to do the same. But when QEMU is setting "Closing" to its state, it triggers an event (xenstore watch) that re-execute xen_device_backend_changed() and set the backend state to "Closed". QEMU should wait for the frontend to set "Closed" before doing the same. Before setting "Closed" to the backend_state, we are also going to check if there is a frontend. If that the case, when the backend state is set to "Closing" the frontend should react and sets its state to "Closing" then "Closed". The backend should wait for that to happen. Fixes: b6af8926fb858c4f1426e5acb2cfc1f0580ec98a Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Paul Durrant <paul.durrant@citrix.com> Message-Id: <20190823101534.465-2-anthony.perard@citrix.com>
2019-08-27xen: cleanup IOREQ server on exitIgor Druzhinin1-0/+2
Device model is supposed to destroy IOREQ server for itself. Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com> Acked-by: Paul Durrant <paul.durrant@citrix.com> Message-Id: <1564428563-1006-1-git-send-email-igor.druzhinin@citrix.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2019-08-23Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell1-1/+1
staging Pull request # gpg: Signature made Thu 22 Aug 2019 16:52:45 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: vhost-user-scsi: prevent using uninitialized vqs util/async: hold AioContext ref to prevent use-after-free Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22vhost-user-scsi: prevent using uninitialized vqsRaphael Norwitz1-1/+1
Of the 3 virtqueues, seabios only sets cmd, leaving ctrl and event without a physical address. This can cause vhost_verify_ring_part_mapping to return ENOMEM, causing the following logs: qemu-system-x86_64: Unable to map available ring for ring 0 qemu-system-x86_64: Verify ring failure on region 0 The qemu commit e6cc11d64fc998c11a4dfcde8fda3fc33a74d844 has already resolved the issue for vhost scsi devices but the fix was never applied to vhost-user scsi devices. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1560299717-177734-1-git-send-email-raphael.norwitz@nutanix.com Message-Id: <1560299717-177734-1-git-send-email-raphael.norwitz@nutanix.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2019-08-22Merge remote-tracking branch 'remotes/kraxel/tags/vga-20190822-pull-request' ↵Peter Maydell4-18/+126
into staging vga: a collection of ati fixes/improvements. # gpg: Signature made Thu 22 Aug 2019 09:04:52 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20190822-pull-request: ati-vga: Implement dummy VBlank IRQ ati-vga: Add limited support for big endian frame buffer aperture ati-vga: Attempt to handle CRTC offset not exact multiple of stride ati-vga: Fix hardware cursor image offset ati-vga: Fix cursor color with guest_hwcursor=true ati-vga: Fix GPIO_MONID register write ati-vga: Add some register definitions for debugging ati-vga: Add registers for getting apertures Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22Merge remote-tracking branch 'remotes/kraxel/tags/usb-20190822-pull-request' ↵Peter Maydell3-21/+59
into staging usb: bugfixes and minor improvements. # gpg: Signature made Thu 22 Aug 2019 07:52:32 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20190822-pull-request: ehci: fix queue->dev null ptr dereference usb: reword -usb command-line option and mention xHCI xhci: Add No Op Command usb-redir: merge interrupt packets usbredir: fix buffer-overflow on vmload Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2019-08-21' ↵Peter Maydell22-19/+488
into staging Monitor patches for 2019-08-21 # gpg: Signature made Wed 21 Aug 2019 16:35:07 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-monitor-2019-08-21: monitor/qmp: Update comment for commit 4eaca8de268 qdev: Collect HMP handlers command handlers in qdev-monitor.c qapi: Move query-target from misc.json to machine.json hw/core: Move cpu.c, cpu.h from qom/ to hw/core/ Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22ati-vga: Implement dummy VBlank IRQBALATON Zoltan4-0/+55
The MacOS driver exits if the card does not have an interrupt. If we set PCI_INTERRUPT_PIN to 1 then it enables VBlank interrupts and it boots but the mouse pointer cannot be moved. This patch implements a dummy VBlank interrupt triggered by a 60 Hz timer. With this the pointer now moves but MacOS still hangs somewhere before completely finishing boot. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <89364275f2fb5f85ee73c0e76528aa91691a499a.1565907489.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-22ehci: fix queue->dev null ptr dereferenceGerd Hoffmann1-0/+3
In case we don't have a device for an active queue, just skip processing the queue (same we do for inactive queues) and log a guest bug. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20190821085319.13711-1-kraxel@redhat.com
2019-08-21Merge remote-tracking branch ↵Peter Maydell7-16/+14
'remotes/vivier2/tags/trivial-branch-pull-request' into staging Various trivial fixes # gpg: Signature made Wed 21 Aug 2019 12:19:11 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-pull-request: hw/display: Compile various display devices as common object hw/display/sm501: Remove unused include spapr_events: Rewrite a fall through comment vl: Rewrite a fall through comment target/ppc: Rewrite a fall through comment hw/ipmi: Rewrite a fall through comment hw/dma/omap_dma: Move switch 'fall through' comment to correct place json: Move switch 'fall through' comment to correct place hw/net/e1000: Fix erroneous comment .gitignore: ignore some vhost-user* related files configure: fix sdl detection using sdl2-config configure: remove obsoleted $sparc_cpu variable misc: fix naming scheme of compatiblity arrays test: Use g_strndup instead of plain strndup Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-21Merge remote-tracking branch ↵Peter Maydell13-32/+115
'remotes/kraxel/tags/audio-20190821-pull-request' into staging audio: second batch of -audiodev support, adding support for multiple backends. # gpg: Signature made Wed 21 Aug 2019 09:40:37 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/audio-20190821-pull-request: audio: fix memory leak reported by ASAN audio: use size_t where makes sense audio: remove read and write pcm_ops paaudio: fix playback glitches audio: do not run each backend in audio_run audio: remove audio_MIN, audio_MAX paaudio: properly disconnect streams in fini_* paaudio: do not move stream when sink/source name is specified audio: audiodev= parameters no longer optional when -audiodev present paaudio: prepare for multiple audiodev audio: add audiodev properties to frontends audio: add audiodev property to vnc and wav_capture audio: basic support for multi backend audio audio: reduce glob_audio_state usage audio: Add missing fall through comments Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-21Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-4.2-20190821' ↵Peter Maydell22-117/+799
into staging ppc patch queue for 2019-08-21 First ppc and spapr pull request for qemu-4.2. Includes: * Some TCG emulation fixes and performance improvements * Support for the mffsl instruction in TCG * Added missing DPDES SPR * Some enhancements to the emulation of the XIVE interrupt controller * Cleanups to spapr MSI management * Some new suspend/resume infrastructure and a draft suspend implementation for spapr * New spapr hypercall for TPM communication (will be needed for secure guests under an Ultravisor) * Fix several memory leaks And a few other assorted fixes. # gpg: Signature made Wed 21 Aug 2019 08:24:44 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-4.2-20190821: (42 commits) ppc: Fix emulated single to double denormalized conversions ppc: Fix emulated INFINITY and NAN conversions ppc: conform to processor User's Manual for xscvdpspn ppc: Add support for 'mffsl' instruction target/ppc: Add Directed Privileged Door-bell Exception State (DPDES) SPR spapr/xive: Mask the EAS when allocating an IRQ spapr: Implement better workaround in spapr-vty device spapr/irq: Drop spapr_irq_msi_reset() spapr/pci: Free MSIs during reset spapr/pci: Consolidate de-allocation of MSIs ppc: remove idle_timer logic spapr: Implement ibm,suspend-me i386: use machine class ->wakeup method machine: Add wakeup method to MachineClass ppc/xive: Improve 'info pic' support ppc/xive: Provide silent escalation support ppc/xive: Provide unconditional escalation support ppc/xive: Provide escalation support ppc/xive: Provide backlog support ppc/xive: Implement TM_PULL_OS_CTX special command ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-21qapi: Move query-target from misc.json to machine.jsonMarkus Armbruster1-0/+10
Move query-target and its return type TargetInfo from misc.json to machine.json, where they are covered by MAINTAINERS section "Machine core". Also move its implementation from arch_init.c to hw/core/machine-qmp-cmds, where it is likewise covered. All users of SysEmuTarget are now in machine.json. Move it there from common.json. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190709152053.16670-3-armbru@redhat.com>
2019-08-21hw/core: Move cpu.c, cpu.h from qom/ to hw/core/Markus Armbruster21-19/+478
Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190709152053.16670-2-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> [Rebased onto merge commit 95a9457fd44; missed instances of qom/cpu.h in comments replaced]
2019-08-21hw/display: Compile various display devices as common objectPhilippe Mathieu-Daudé1-9/+9
Various display devices are not target-specific and can be compiled once for all the targets. After this commit, the 'make world' target is reduced by 54 objects Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20190812113739.16587-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21hw/display/sm501: Remove unused includePhilippe Mathieu-Daudé1-1/+0
The "cpu.h" include makes devices target-specific. Since it is not used, remove it, so the device become generic (we can now compile it once for all targets). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20190812113739.16587-2-philmd@redhat.com> [lv: fix conflict with 650d103d3ea9 ("Include hw/hw.h exactly where needed")] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21spapr_events: Rewrite a fall through commentPhilippe Mathieu-Daudé1-1/+1
GCC9 is confused by this comment when building with CFLAG -Wimplicit-fallthrough=2: CC ppc64-softmmu/hw/ppc/spapr_rtc.o hw/ppc/spapr_events.c: In function ‘rtas_event_log_to_source’: hw/ppc/spapr_events.c:312:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 312 | if (spapr_ovec_test(spapr->ov5_cas, OV5_HP_EVT)) { | ^ hw/ppc/spapr_events.c:317:5: note: here 317 | case RTAS_LOG_TYPE_EPOW: | ^~~~ cc1: all warnings being treated as errors Rewrite the comment using 'fall through' which is recognized by GCC and static analyzers. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190719131425.10835-8-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21ati-vga: Add limited support for big endian frame buffer apertureBALATON Zoltan3-1/+12
Set frame buffer endianness according to requested endianness for frame buffer apertures. We set frame buffer to big endian if any of the two apertures are set to big endian. Using different endianness for the two apertures is not implemented. This fixes inverted colors with MacOS and Xorg frame buffer driver but some Linux drivers may have endianness issues even on real hardware so this may not fix all cases. MorphOS uses aper0 in LE, Linux uses aper0 in BE and MacOS uses aper1 in BE but not sure about others or if MacOS also may need aper0 in which case we'll need a more complex fix but MacOS has other problems yet so for now this might work. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: e2a7ec7af3fc30523213bcd27832ccad34323f2c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Attempt to handle CRTC offset not exact multiple of strideBALATON Zoltan1-7/+15
MacOS uses non-0 offset so it needs this and the resulting vbe_start_addr seems correct but picture is still broken with OpenBIOS after FCode runs but that maybe due to firmware problems now. After boot, picture is now correct. It also occured to me that these CRTC regs are also present in VGA so I wonder if they should be shared in case some drivers try to poke them via VGA regs or these are a separate set of regs for extended mode. Added a comment noting this but drivers I've tried so far program the card accessing ati regs so I did not attempt to change it. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 1c6fce457ef7e6f889e38dc0423791be92310a62.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix hardware cursor image offsetBALATON Zoltan1-5/+3
The crtc_offset is not needed, cur_offset is relative to the start of vram not the start of displayed area. This fixes broken pointer image with MacOS that uses non-0 crtc_offset. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: e6acb1fa3ca980dc948045443e5986e2aa79bf7c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix cursor color with guest_hwcursor=trueBALATON Zoltan1-1/+1
Fixes: a38127414bd007c5b6ae64c664d9e8839393277e Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: d99f9e07923a74932dbb15e93dd50aa8d2816b19.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix GPIO_MONID register writeBALATON Zoltan1-4/+7
Also update bitbang_i2c state when output bits are changed while enable bits are set. This fixes EDID access by the ATI FCode ROM. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 292e70a92b7fbfd9a4120d433dbdcfda4e5f6c3c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Add some register definitions for debuggingBALATON Zoltan2-0/+8
Add names for AMCGPIO regs to make it easier to identify these in trace output. This is where rage128p has the DDC from the DVI port among others but because we don't implement the flat panel controller we don't want to connect an EDID here to make sure drivers use the VGA output instead. But since these are often probed by drivers it helps to see what happens by logging these registers by name. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 31ff69ca6959d090869907774faa1af7d2c02b2b.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Add registers for getting aperturesBALATON Zoltan3-0/+25
Some drivers (e.g. Linux radeon drm and MacOS) access these to find apertures to access card. Try to implement these but not sure these are correct yet. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: b2df13655feecd63c0049ec45fd87d1026f67091.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21hw/ipmi: Rewrite a fall through commentPhilippe Mathieu-Daudé1-2/+1
GCC9 is confused by this comment when building with CFLAG -Wimplicit-fallthrough=2: hw/ipmi/ipmi_bmc_extern.c: In function ‘addchar’: hw/ipmi/ipmi_bmc_extern.c:178:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 178 | ch |= 0x10; | ~~~^~~~~~~ hw/ipmi/ipmi_bmc_extern.c:181:5: note: here 181 | default: | ^~~~~~~ cc1: all warnings being treated as errors make: *** [rules.mak:69: hw/ipmi/ipmi_bmc_extern.o] Error 1 Rewrite the comment using 'fall through' which is recognized by GCC and static analyzers. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Corey Minyard <cminyard@mvista.com> Message-Id: <20190719131425.10835-5-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21hw/dma/omap_dma: Move switch 'fall through' comment to correct placePhilippe Mathieu-Daudé1-1/+1
Reported by GCC9 when building with CFLAG -Wimplicit-fallthrough=2: CC hw/dma/omap_dma.o hw/dma/omap_dma.c: In function ‘omap_dma_write’: hw/dma/omap_dma.c:1532:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 1532 | if (s->model <= omap_dma_3_1) | ^ hw/dma/omap_dma.c:1534:5: note: here 1534 | case 0x400: | ^~~~ cc1: all warnings being treated as errors Correctly place the 'fall through' comment. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20190719131425.10835-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21hw/net/e1000: Fix erroneous commentPhilippe Mathieu-Daudé1-1/+1
Missed during the QOM convertion in 9af21dbee14. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20190715102210.31365-1-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21xhci: Add No Op CommandHikaru Nishida1-0/+3
This commit adds No Op Command (23) to xHC for verifying the operation of the Command Ring mechanisms. No Op Command is defined in XHCI spec (4.6.2) and just reports Command Completion Event with Completion Code == Success. Before this commit, No Op Command is not implemented so xHC reports Command Completion Event with Completion Code == TRB Error. This commit fixes this behaviour to report Completion Code correctly. Signed-off-by: Hikaru Nishida <hikarupsp@gmail.com> Message-id: 20190720060427.50457-1-hikarupsp@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21usb-redir: merge interrupt packetsMartin Cerveny1-21/+48
Interrupt packets (limited by wMaxPacketSize) should be buffered and merged by algorithm described in USB spec. (see usb_20.pdf/5.7.3 Interrupt Transfer Packet Size Constraints). Signed-off-by: Martin Cerveny <M.Cerveny@computer.org> Message-id: 20190724125859.14624-2-M.Cerveny@computer.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21usbredir: fix buffer-overflow on vmloadMarc-André Lureau1-0/+5
If interface_count is NO_INTERFACE_INFO, let's not access the arrays out-of-bounds. ==994==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000243930 at pc 0x5642068086a8 bp 0x7f0b6f9ffa50 sp 0x7f0b6f9ffa40 READ of size 1 at 0x625000243930 thread T0 #0 0x5642068086a7 in usbredir_check_bulk_receiving /home/elmarco/src/qemu/hw/usb/redirect.c:1503 #1 0x56420681301c in usbredir_post_load /home/elmarco/src/qemu/hw/usb/redirect.c:2154 #2 0x5642068a56c2 in vmstate_load_state /home/elmarco/src/qemu/migration/vmstate.c:168 #3 0x56420688e2ac in vmstate_load /home/elmarco/src/qemu/migration/savevm.c:829 #4 0x5642068980cb in qemu_loadvm_section_start_full /home/elmarco/src/qemu/migration/savevm.c:2211 #5 0x564206899645 in qemu_loadvm_state_main /home/elmarco/src/qemu/migration/savevm.c:2395 #6 0x5642068998cf in qemu_loadvm_state /home/elmarco/src/qemu/migration/savevm.c:2467 #7 0x56420685f3e9 in process_incoming_migration_co /home/elmarco/src/qemu/migration/migration.c:449 #8 0x564207106c47 in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:115 #9 0x7f0c0604e37f (/lib64/libc.so.6+0x4d37f) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Liam Merwick <liam.merwick@oracle.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190807084048.4258-1-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21misc: fix naming scheme of compatiblity arraysMarc-André Lureau1-1/+1
Since merge 31ed41889e6e13699871040fe089a2884dca46cb ("Merge remote-tracking branch 'remotes/elmarco/tags/machine-props-pull-request' into staging"), the compat arrays are in lowercase. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20190708204909.10891-1-marcandre.lureau@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21spapr/xive: Mask the EAS when allocating an IRQCédric Le Goater1-1/+4
If an IRQ is allocated and not configured, such as a MSI requested by a PCI driver, it can be saved in its default state and possibly later on restored using the same state. If not initially MASKED, KVM will try to find a matching priority/target tuple for the interrupt and fail to restore the VM because 0/0 is not a valid target. When allocating a IRQ number, the EAS should be set to a sane default : VALID and MASKED. Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190813164420.9829-1-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement better workaround in spapr-vty devicePaul Mackerras1-18/+12
Linux guest kernels have code which scans the string of characters returned from the H_GET_TERM_CHAR hypercall and removes any \0 character which comes immediately after a \r character. This is to work around a bug which was present in some ancient versions of PowerVM. In order to avoid the corruption of the console byte stream that this introduced, commit 6c3bc244d3cb ("spapr: Implement bug in spapr-vty device to be compatible with PowerVM") added a workaround which adds a \0 character after every \r character. Unfortunately, this corrupts the console byte stream for those operating systems, such as AIX, which don't remove the null bytes. We can avoid triggering the Linux kernel workaround if we avoid returning a buffer which contains a \0 after a \r. We can do that by breaking out of the loop in vty_getchars() if we are about to insert a \0 and the previous character in the buffer is a \r. That means we return the characters up to the \r for the current H_GET_TERM_CHAR, and the characters starting with the \0 for the next one. With this workaround, we don't insert any spurious characters and we avoid triggering the Linux kernel workaround, so the guest will receive an uncorrupted stream whether or not they have the workaround. Fixes: 6c3bc244d3cb ("spapr: Implement bug in spapr-vty device to be compatible with PowerVM") Signed-off-by: Paul Mackerras <paulus@ozlabs.org> Message-Id: <20190731043653.shdi5sizjp4t65op@oak.ozlabs.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr/irq: Drop spapr_irq_msi_reset()Greg Kurz2-9/+2
PHBs already take care of clearing the MSIs from the bitmap during reset or unplug. No need to do this globally from the machine code. Rather add an assert to ensure that PHBs have acted as expected. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156415228966.1064338.190189424190233355.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> [dwg: Fix crash in qtest case where spapr->irq_map can be NULL at the new assert()] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr/pci: Free MSIs during resetGreg Kurz1-0/+2
When the machine is reset, the MSI bitmap is cleared but the allocated MSIs are not freed. Some operating systems, such as AIX, can detect the previous configuration and assert. Empty the MSI cache, this performs the needed cleanup. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156415228410.1064338.4486161194061636096.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr/pci: Consolidate de-allocation of MSIsGreg Kurz1-9/+15
When freeing MSIs, we need to: - remove them from the machine's MSI bitmap - remove them from the IC backend - remove them from the PHB's MSI cache This is currently open coded in two places in rtas_ibm_change_msi(), and we're about to need this in spapr_phb_reset() as well. Instead of duplicating this code again, make it a destroy function for the PHB's MSI cache. Removing an MSI device from the cache will call the destroy function internally. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156415227855.1064338.5657793835271464648.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement ibm,suspend-meNicholas Piggin2-0/+39
This has been useful to modify and test the Linux pseries suspend code but it requires modification to the guest to call it (due to being gated by other unimplemented features). It is not otherwise used by Linux yet, but work is slowly progressing there. This allows a (lightly modified) guest kernel to suspend with `echo mem > /sys/power/state` and be resumed with system_wakeup monitor command. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190722061752.22114-2-npiggin@gmail.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21i386: use machine class ->wakeup methodNicholas Piggin1-0/+8
Move the i386 suspend_wakeup logic out of the fallback path, and into the new ->wakeup method. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190722061752.22114-1-npiggin@gmail.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Improve 'info pic' supportCédric Le Goater3-7/+51
Provide a better output of the XIVE END structures including the escalation information and extend the PowerNV machine 'info pic' command with a dump of the END EAS table used for escalations. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-9-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Provide silent escalation supportCédric Le Goater1-0/+8
When the 's' bit is set the escalation is said to be 'silent' or 'silent/gather'. In such configuration, the notification sequence is skipped and only the escalation sequence is performed. This is used to configure all the EQs of a vCPU to escalate on a single EQ which will then target the hypervisor. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-8-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Provide unconditional escalation supportCédric Le Goater1-9/+35
When the 'u' bit is set the escalation is said to be 'unconditional' which means that the ESe PQ bits are not used. Introduce a xive_router_end_es_notify() routine to share code with the ESn notification. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-7-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Provide escalation supportCédric Le Goater1-0/+16
If the XIVE presenter can not find the NVT dispatched on any of the HW threads, it can not deliver the interrupt. XIVE offers an escalation mechanism to handle such scenarios and inform the hypervisor that an action should be taken. Escalation is configured by setting the 'e' bit and the EAS in word 4 & 5 to let the HW look for the escalation END on which to trigger a new event. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-6-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>