aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2016-07-05block/qdev: Fix NULL access when using BB twiceKevin Wolf1-1/+1
BlockBackend has only a single pointer to its guest device, so it makes sure that only a single guest device is attached to it. device-add returns an error if you try to attach a second device to a BB. In order to make the error message nicer, -device that manually connects to a if=none block device get a different message than -drive that implicitly creates a guest device. The if=... option is stored in DriveInfo. However, since blockdev-add exists, not every BlockBackend has a DriveInfo any more. Check that it exists before we dereference it. QMP reproducer resulting in a segfault: {"execute":"blockdev-add","arguments":{"options":{"id":"disk","driver":"file","filename":"/tmp/test.img"}}} {"execute":"device_add","arguments":{"driver":"virtio-blk-pci","drive":"disk"}} {"execute":"device_add","arguments":{"driver":"virtio-blk-pci","drive":"disk"}} Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-07-05block: Switch transfer length bounds to byte-basedEric Blake2-10/+11
Sector-based limits are awkward to think about; in our on-going quest to move to byte-based interfaces, convert max_transfer_length and opt_transfer_length. Rename them (dropping the _length suffix) so that the compiler will help us catch the change in semantics across any rebased code, and improve the documentation. Use unsigned values, so that we don't have to worry about negative values and so that bit-twiddling is easier; however, we are still constrained by 2^31 of signed int in most APIs. When a value comes from an external source (iscsi and raw-posix), sanitize the results to ensure that opt_transfer is a power of 2. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-07-05block: Give nonzero result to blk_get_max_transfer_length()Eric Blake2-8/+7
Making all callers special-case 0 as unlimited is awkward, and we DO have a hard maximum of BDRV_REQUEST_MAX_SECTORS given our current block layer API limits. In the case of scsi, this means that we now always advertise a limit to the guest, even in cases where the underlying layers previously use 0 for no inherent limit beyond the block layer. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-07-05scsi: Advertise limits by blocksize, not 512Eric Blake1-1/+2
s->blocksize may be larger than 512, in which case our tweaks to max_xfer_len and opt_xfer_len must be scaled appropriately. CC: qemu-stable@nongnu.org Reported-by: Fam Zheng <famz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-07-05Merge remote-tracking branch 'remotes/kraxel/tags/pull-ipxe-20160704-1' into ↵Peter Maydell2-0/+2
staging ipxe: update submodule from 4e03af8ec to 041863191 e1000e+vmxnet3: add boot rom # gpg: Signature made Mon 04 Jul 2016 07:25:46 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-ipxe-20160704-1: build: add pc-bios to config-host.mak deps ipxe: add new roms to BLOBS ipxe: update prebuilt binaries vmxnet3: add boot rom e1000e: add boot rom ipxe: add vmxnet3 rom ipxe: add e1000e rom ipxe: update submodule from 4e03af8ec to 041863191 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-05ppc/hash64: Add proper real mode translation supportBenjamin Herrenschmidt1-0/+7
This adds proper support for translating real mode addresses based on the combination of HV and LPCR bits. This handles HRMOR offset for hypervisor real mode, and both RMA and VRMA modes for guest real mode. PAPR mode adjusts the offsets appropriately to match the RMA used in TCG, but we need to limit to the max supported by the implementation (16G). This includes some fixes by Cédric Le Goater <clg@kaod.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> [dwg: Adjusted for differences in my version of the prereq patches] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-05ppc: simplify ppc_hash64_hpte_page_shift_noslb()Cédric Le Goater1-2/+2
The segment page shift parameter is never used. Let's remove it. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-05spapr_pci/spapr_pci_vfio: Support Dynamic DMA Windows (DDW)Alexey Kardashevskiy5-19/+363
This adds support for Dynamic DMA Windows (DDW) option defined by the SPAPR specification which allows to have additional DMA window(s) The "ddw" property is enabled by default on a PHB but for compatibility the pseries-2.6 machine and older disable it. This also creates a single DMA window for the older machines to maintain backward migration. This implements DDW for PHB with emulated and VFIO devices. The host kernel support is required. The advertised IOMMU page sizes are 4K and 64K; 16M pages are supported but not advertised by default, in order to enable them, the user has to specify "pgsz" property for PHB and enable huge pages for RAM. The existing linux guests try creating one additional huge DMA window with 64K or 16MB pages and map the entire guest RAM to. If succeeded, the guest switches to dma_direct_ops and never calls TCE hypercalls (H_PUT_TCE,...) again. This enables VFIO devices to use the entire RAM and not waste time on map/unmap later. This adds a "dma64_win_addr" property which is a bus address for the 64bit window and by default set to 0x800.0000.0000.0000 as this is what the modern POWER8 hardware uses and this allows having emulated and VFIO devices on the same bus. This adds 4 RTAS handlers: * ibm,query-pe-dma-window * ibm,create-pe-dma-window * ibm,remove-pe-dma-window * ibm,reset-pe-dma-window These are registered from type_init() callback. These RTAS handlers are implemented in a separate file to avoid polluting spapr_iommu.c with PCI. This changes sPAPRPHBState::dma_liobn to an array to allow 2 LIOBNs and updates all references to dma_liobn. However this does not add 64bit LIOBN to the migration stream as in fact even 32bit LIOBN is rather pointless there (as it is a PHB property and the management software can/should pass LIOBNs via CLI) but we keep it for the backward migration support. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-05vfio/spapr: Create DMA window dynamically (SPAPR IOMMU v2)Alexey Kardashevskiy3-10/+143
New VFIO_SPAPR_TCE_v2_IOMMU type supports dynamic DMA window management. This adds ability to VFIO common code to dynamically allocate/remove DMA windows in the host kernel when new VFIO container is added/removed. This adds a helper to vfio_listener_region_add which makes VFIO_IOMMU_SPAPR_TCE_CREATE ioctl and adds just created IOMMU into the host IOMMU list; the opposite action is taken in vfio_listener_region_del. When creating a new window, this uses heuristic to decide on the TCE table levels number. This should cause no guest visible change in behavior. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [dwg: Added some casts to prevent printf() warnings on certain targets where the kernel headers' __u64 doesn't match uint64_t or PRIx64] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-05vfio: Add host side DMA window capabilitiesAlexey Kardashevskiy1-16/+44
There are going to be multiple IOMMUs per a container. This moves the single host IOMMU parameter set to a list of VFIOHostDMAWindow. This should cause no behavioral change and will be used later by the SPAPR TCE IOMMU v2 which will also add a vfio_host_win_del() helper. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-05vfio: spapr: Add DMA memory preregistering (SPAPR IOMMU v2)Alexey Kardashevskiy4-9/+177
This makes use of the new "memory registering" feature. The idea is to provide the userspace ability to notify the host kernel about pages which are going to be used for DMA. Having this information, the host kernel can pin them all once per user process, do locked pages accounting (once) and not spent time on doing that in real time with possible failures which cannot be handled nicely in some cases. This adds a prereg memory listener which listens on address_space_memory and notifies a VFIO container about memory which needs to be pinned/unpinned. VFIO MMIO regions (i.e. "skip dump" regions) are skipped. The feature is only enabled for SPAPR IOMMU v2. The host kernel changes are required. Since v2 does not need/support VFIO_IOMMU_ENABLE, this does not call it when v2 is detected and enabled. This enforces guest RAM blocks to be host page size aligned; however this is not new as KVM already requires memory slots to be host page size aligned. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> [dwg: Fix compile error on 32-bit host] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-05spapr_iommu: Realloc guest visible TCE table when starting/stopping listeningAlexey Kardashevskiy2-6/+12
The sPAPR TCE tables manage 2 copies when VFIO is using an IOMMU - a guest view of the table and a hardware TCE table. If there is no VFIO presense in the address space, then just the guest view is used, if this is the case, it is allocated in the KVM. However since there is no support yet for VFIO in KVM TCE hypercalls, when we start using VFIO, we need to move the guest view from KVM to the userspace; and we need to do this for every IOMMU on a bus with VFIO devices. This implements the callbacks for the sPAPR IOMMU - notify_started() reallocated the guest view to the user space, notify_stopped() does the opposite. This removes explicit spapr_tce_set_need_vfio() call from PCI hotplug path as the new callbacks do this better - they notify IOMMU at the exact moment when the configuration is changed, and this also includes the case of PCI hot unplug. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-05spapr: Ensure thread0 of CPU core is always realized firstBharata B Rao1-13/+16
During CPU core realization, we create all the thread objects and parent them to the core object in a loop. However, the realization of thread objects is done separately by walking the threads of a core using object_child_foreach(). With this, there is no guarantee on the order in which the child thread objects get realized. Since CPU device tree properties are currently derived from the CPU thread object, we assume thread0 of the core to be the representative thread of the core when creating device tree properties for the core. If thread0 is not the first thread that gets realized, then we would end up having an incorrect dt_id for the core and this causes hotplug failures from the guest. Fix this by realizing each thread object by walking the core's thread object list thereby ensuring that thread0 and other threads are always realized in the correct order. Future TODO: CPU DT nodes are per-core properties and we should ideally base the creation of CPU DT nodes on core objects rather than the thread objects. Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-04ast2400: create SPI flash slavesCédric Le Goater1-0/+31
A set of SPI flash slaves is attached under the flash controllers of the palmetto platform. "n25q256a" flash modules are used for the BMC and "mx25l25635e" for the host. These types are common in the OpenPower ecosystem. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-9-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04ast2400: add SPI flash slavesCédric Le Goater2-3/+152
Each controller on the ast2400 has a memory range on which it maps its flash module slaves. Each slave is assigned a memory segment for its mapping that can be changed at bootime with the Segment Address Register. This is not supported in the current implementation so we are using the defaults provided by the specs. Each SPI flash slave can then be accessed in two modes: Command and User. When in User mode, accesses to the memory segment of the slaves are translated in SPI transfers. When in Command mode, the HW generates the SPI commands automatically and the memory segment is accessed as if doing a MMIO. Other SPI controllers call that mode linear addressing mode. For this purpose, we are adding below each crontoller an array of structs gathering for each SPI flash module, a segment rank, a MemoryRegion to handle the memory accesses and the associated SPI slave device, which should be a m25p80. Only the User mode is supported for now but we are preparing ground for the Command mode. The framework is sufficient to support Linux. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-8-git-send-email-clg@kaod.org [PMM: Use g_new0() rather than g_malloc0()] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04ast2400: add SMC controllers (FMC and SPI)Cédric Le Goater3-1/+361
The Aspeed AST2400 soc includes a static memory controller for the BMC which supports NOR, NAND and SPI flash memory modules. This controller has two modes : the SMC for the legacy interface which supports only one module and the FMC for the new interface which supports up to five modules. The AST2400 also includes a SPI only controller used for the host firmware, commonly called BIOS on Intel. It can be used in three mode : a SPI master, SPI slave and SPI pass-through Below is the initial framework for the SMC controller (FMC mode only) and the SPI controller: the sysbus object, MMIO for registers configuration and controls. Each controller has a SPI bus and a configurable number of CS lines for SPI flash slaves. The differences between the controllers are small, so they are abstracted using indirections on the register numbers. Only SPI flash modules are supported. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-7-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added one missing error_propagate] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04m25p80: qdev-ify drive propertyPaolo Bonzini5-17/+37
This allows specifying the property via -drive if=none and creating the flash device with -device. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-6-git-send-email-clg@kaod.org [clg: added an extra fix for sabrelite_init() keeping the test on flash_dev did not seem necessary. ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04m25p80: change cur_addr to 32 bit integerPaolo Bonzini1-7/+8
The maximum amount of storage that can be addressed by the m25p80 command set is 4 GiB. However, cur_addr is currently a 64-bit integer. To avoid further problems related to sign extension of signed 32-bit integer expressions, change cur_addr to a 32 bit integer. Preserve migration format by adding a dummy 4-byte field in place of the (big-endian) high four bytes in the formerly 64-bit cur_addr field. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-5-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04m25p80: avoid out of bounds accessesPaolo Bonzini1-9/+7
s->cur_addr can be made to point outside s->storage, either by writing a value >= 128 to s->ear (because s->ear * MAX_3BYTES_SIZE is a signed integer and sign-extends into the 64-bit cur_addr), or just by writing an address beyond the size of the flash being emulated. Avoid the sign extension to make the code cleaner, and on top of that mask s->cur_addr to s->size. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-4-git-send-email-clg@kaod.org Reviewed by: Marcin Krzeminski <marcin.krzeminski@nokia.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04m25p80: do not put iovec on the stackPaolo Bonzini1-9/+14
When doing a read-modify-write cycle, QEMU uses the iovec after returning from blk_aio_pwritev. m25p80 puts the iovec on the stack of blk_aio_pwritev's caller, which causes trouble in this case. This has been a problem since commit 243e6f6 ("m25p80: Switch to byte-based block access", 2016-05-12) started doing writes at a smaller granularity than 512 bytes. In principle however it could have broken before when using -drive if=mtd,cache=none on a disk with 4K native sectors. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04ssi: change ssi_slave_init to be a realize opsCédric Le Goater9-41/+31
This enables qemu to handle late inits and report errors. All the SSI slave routine names were changed accordingly. Code was modified to handle errors when possible (m25p80 and ssi-sd) Tested with the m25p80 slave object. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-2-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04xilinx_zynq: Connect devcfg to the Zynq machine modelPeter Crosthwaite1-0/+6
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 85f39c9a13569b1113dacac3b952b0af54fc1260.1467053537.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04dma: Add Xilinx Zynq devcfg device modelAlistair Francis2-0/+401
Add a minimal model for the devcfg device which is part of Zynq. This model supports DMA capabilities and interrupt generation. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 83df49d8fa2d203a421ca71620809e4b04754e65.1467053537.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04register: Add block initialise helperPeter Crosthwaite1-0/+45
Add a helper that will scan a static RegisterAccessInfo Array and populate a container MemoryRegion with registers as defined. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 347b810b2799e413c98d5bbeca97bcb1557946c3.1467053537.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04register: QOMifyPeter Crosthwaite1-0/+23
QOMify registers as a child of TYPE_DEVICE. This allows registers to define GPIOs. Define an init helper that will do QOM initialisation. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 2545f71db26bf5586ca0c08a3e3cf1b217450552.1467053537.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04register: Add Memory API glueAlistair Francis1-0/+59
Add memory io handlers that glue the register API to the memory API. Just translation functions at this stage. Although it does allow for devices to be created without all-in-one mmio r/w handlers. This patch also adds the RegisterInfoArray struct, which allows all of the individual RegisterInfo structs to be grouped into a single memory region. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: f7704d8ac6ac0f469ed35401f8151a38bd01468b.1467053537.git.alistair.francis@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04register: Add Register APIAlistair Francis2-0/+161
This API provides some encapsulation of registers and factors out some common functionality to common code. Bits of device state (usually MMIO registers) often have all sorts of access restrictions and semantics associated with them. This API allows you to define what those restrictions are on a bit-by-bit basis. Helper functions are then used to access the register which observe the semantics defined by the RegisterAccessInfo struct. Some features: Bits can be marked as read_only (ro field) Bits can be marked as write-1-clear (w1c field) Bits can be marked as reserved (rsvd field) Reset values can be defined (reset) Bits can be marked clear on read (cor) Pre and post action callbacks can be added to read and write ops Verbose debugging info can be enabled/disabled Useful for defining device register spaces in a data driven way. Cuts down on a lot of the verbosity and repetition in the switch-case blocks in the standard foo_mmio_read/write functions. Also useful for automated generation of device models from hardware design sources. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 40d62c7e1bf6e63bb4193ec46b15092a7d981e59.1467053537.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04hw/arm/virt: mark the PCIe host controller as DMA coherent in the DTArd Biesheuvel1-0/+1
Since QEMU performs cacheable accesses to guest memory when doing DMA as part of the implementation of emulated PCI devices, guest drivers should use cacheable accesses as well when running under KVM. Since this essentially means that emulated PCI devices are DMA coherent, set the 'dma-coherent' DT property on the PCIe host controller DT node. This brings the DT description into line with the ACPI description, which already marks the PCI bridge as cache coherent (see commit bc64b96c984abf). Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Message-id: 1467134090-5099-1-git-send-email-ard.biesheuvel@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04armv7m_nvic: Use qemu_get_cpu(0) instead of current_cpuAndrey Smirnov1-4/+4
Starting QEMU with -S results in current_cpu containing its initial value of NULL. It is however possible to connect to such QEMU instance and query various CPU registers, one example being CPUID, and doing that results in QEMU segfaulting. Using qemu_get_cpu(0) seem reasonable enough given that ARMv7M architecture is a single core architecture. Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04imx: Use memory_region_init_rom() for ROMsPeter Maydell3-13/+12
The imx boards were all incorrectly creating ROMs using memory_region_init_rom_device() with a NULL ops pointer. This will cause QEMU to abort if the guest tries to write to the ROM. Switch to the new memory_region_init_rom() instead. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1467122287-24974-3-git-send-email-peter.maydell@linaro.org
2016-07-01Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell1-100/+100
Only trivial fixes. # gpg: Signature made Fri 01 Jul 2016 13:39:06 BST # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <gkurz@fr.ibm.com>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "Gregory Kurz (Cimai Technology) <gkurz@cimai.com>" # gpg: aka "Gregory Kurz (Meiosys Technology) <gkurz@meiosys.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9p: synth: drop v9fs_ prefix 9p: don't include <sys/uio.h> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-019p: synth: drop v9fs_ prefixGreg Kurz1-100/+100
To have shorter lines and be consistent with other fs devices. Acked-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2016-07-01Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.7-20160701' ↵Peter Maydell13-538/+618
into staging ppc patch queue 2016-07-01 Here's the current ppc patch queue. This is a fairly large batch, containing: * A number of further preliminary patches towards full hypervisor mode emulation * Some further fixes / cleanups for the recently merged device_add based CPU hotplug * Preliminary patches towards supporting a native (rather than paravirtualized) XICS device. This will be needed to emulate a physical Power machine, including hypervisor capabilities * Assorted bug fixes # gpg: Signature made Fri 01 Jul 2016 06:56:35 BST # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.7-20160701: (23 commits) qmp: fix spapr example of query-hotpluggable-cpus spapr: drop duplicate variable in spapr_core_release() spapr: do proper error propagation in spapr_cpu_core_realize_child() spapr: drop reference on child object during core realization spapr: Restore support for 970MP and POWER8NVL CPU cores target-ppc: gen_pause for instructions: yield, mdoio, mdoom, miso ppc/xics: Replace "icp" with "xics" in most places ppc/xics: Implement H_IPOLL using an accessor ppc/xics: Move SPAPR specific code to a separate file ppc/xics: Rename existing xics to xics_spapr ppc: Fix 64K pages support in full emulation target-ppc: Eliminate redundant and incorrect function booke206_page_size_to_tlb spapr: Restore support for older PowerPC CPU cores spapr: fix write-past-end-of-array error in cpu core device init code hw/ppc/spapr: Add some missing hcall function set strings ppc: Print HSRR0/HSRR1 in "info registers" ppc: LPCR is a HV resource ppc: Initial HDEC support ppc: Enforce setting MSR:EE,IR and DR when MSR:PR is set ppc: Fix conditions for delivering external interrupts to a guest ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-01spapr: drop duplicate variable in spapr_core_release()Greg Kurz1-2/+1
Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01spapr: do proper error propagation in spapr_cpu_core_realize_child()Greg Kurz1-5/+7
This patch changes spapr_cpu_core_realize_child() to have a local error pointer and use error_propagate() as it is supposed to be done. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01spapr: drop reference on child object during core realizationGreg Kurz1-0/+1
When a core is being realized, we create a child object for each thread of the core. The child is first initialized with object_initialize() which sets its ref count to 1, and then added to the core with object_property_add_child() which bumps the ref count to 2. When the core gets released, object_unparent() decreases the ref count to 1, and we g_free() the object: we hence loose the reference on an unfinalized object. This is likely to cause random crashes. Let's drop the extra reference as soon as we don't need it, after the thread is added to the core. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01spapr: Restore support for 970MP and POWER8NVL CPU coresBharata B Rao1-2/+18
Introduction of core based CPU hotplug for PowerPC sPAPR didn't add support for 970MP and POWER8NVL based core types. Add support for the same. While we are here, add support for explicit specification of POWER5+_v2.1 core type. Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01ppc/xics: Replace "icp" with "xics" in most placesBenjamin Herrenschmidt8-145/+150
The "ICP" is a different object than the "XICS". For historical reasons, we have a number of places where we name a variable "icp" while it contains a XICSState pointer. There *is* an ICPState structure too so this makes the code really confusing. This is a mechanical replacement of all those instances to use the name "xics" instead. There should be no functional change. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> [spapr_cpu_init has been moved to spapr_cpu_core.c, change there] Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01ppc/xics: Implement H_IPOLL using an accessorBenjamin Herrenschmidt2-3/+12
None of the other presenter functions directly mucks with the internal state, so don't do it there either. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01ppc/xics: Move SPAPR specific code to a separate fileBenjamin Herrenschmidt3-409/+442
Leave the core ICP/ICS logic in xics.c and move the top level class wrapper, hypercall and RTAS handlers to xics_spapr.c Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> [add cpu.h in xics_spapr.c, move set_nr_irqs and set_nr_servers to xics_spapr.c] Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01ppc/xics: Rename existing xics to xics_spaprBenjamin Herrenschmidt6-33/+35
The common class doesn't change, the KVM one is sPAPR specific. Rename variables and functions to xics_spapr. Retain the type name as "xics" to preserve migration for existing sPAPR guests. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01target-ppc: Eliminate redundant and incorrect function booke206_page_size_to_tlbAaron Larson3-7/+4
Eliminate redundant and incorrect booke206_page_size_to_tlb function from ppce500_spin.c in preference to previously existing but newly exported definition from e500.c Defect analysis: The booke206_page_size_to_tlb function in e500.c was updated in commit 2bd9543 "ppc: booke206: use MAV=2.0 TSIZE definition, fix 4G pages" to reflect a change in the definition of MAS1_TSIZE_SHIFT from 8 (corresponding to a min TLB page size of 4kb) to a value of 7 (TLB page size 2k). The booke206_page_size_to_tlb() function defined in ppce500_spin.c was never updated to reflect the change in MAS1_TSIZE_SHIFT. In http://lists.nongnu.org/archive/html/qemu-ppc/2016-06/msg00533.html, Scott Wood suggested this "root cause" explanation: SW> The patch that changed MAS1_TSIZE_SHIFT from 8 to 7 was around the SW> same time as the patch that added this code, which is probably why SW> adjusting it got missed. Commit 2bd9543cd3 did update the SW> equivalent code in ppce500_mpc8544ds.c, which now resides in SW> hw/ppc/e500.c and has been changed to not assume a power-of-2 SW> size. The ppce500_spin version should be eliminated. Signed-off-by: Aaron Larson <alarson@ddci.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01spapr: Restore support for older PowerPC CPU coresBharata B Rao1-1/+8
Introduction of core based CPU hotplug for PowerPC sPAPR didn't add support for 970 and POWER5+ based core types. Add support for the same. Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01spapr: fix write-past-end-of-array error in cpu core device init codeGreg Kurz1-2/+1
This fixes a potential QEMU crash introduced by commit 3b542549661. Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01hw/ppc/spapr: Add some missing hcall function set stringsThomas Huth1-0/+3
Add "hcall-sprg0" (for H_SET_SPRG0), "hcall-copy" (for H_PAGE_INIT) and "hcall-debug" (for H_LOGICAL_CI_LOAD/STORE) to the property "ibm,hypertas-functions" to indicate that we support these hypercalls. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-07-01ppc: Initial HDEC supportBenjamin Herrenschmidt1-5/+12
The current behaviour isn't completely right, as for the DEC, we don't properly re-arm when wrapping around, but I will fix this in a separate patch. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> [clg: fixed checkpatch.pl errors ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-06-30intel_iommu: Throw hw_error on notify_startedAlex Williamson1-0/+12
We don't currently support the MemoryRegionIOMMUOps notifier, so throw an error should a device require it. Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Peter Xu <peterx@redhat.com> Tested-by: Peter Xu <peterx@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-06-30memory: Add MemoryRegionIOMMUOps.notify_started/stopped callbacksAlexey Kardashevskiy1-2/+3
The IOMMU driver may change behavior depending on whether a notifier client is present. In the case of POWER, this represents a change in the visibility of the IOTLB, for other drivers such as intel-iommu and future AMD-Vi emulation, notifier support is not yet enabled and this provides the opportunity to flag that incompatibility. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Peter Xu <peterx@redhat.com> Tested-by: Peter Xu <peterx@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> [new log & extracted from [PATCH qemu v17 12/12] spapr_iommu, vfio, memory: Notify IOMMU about starting/stopping listening] Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-06-30vfio/pci: Hide SR-IOV capabilityAlex Williamson2-10/+40
The kernel currently exposes the SR-IOV capability as read-only through vfio-pci. This is sufficient to protect the host kernel, but has the potential to confuse guests without further virtualization. In particular, OVMF tries to size the VF BARs and comes up with absurd results, ending with an assert. There's not much point in adding virtualization to a read-only capability, so we simply hide it for now. If the kernel ever enables SR-IOV virtualization, we should easily be able to test it through VF BAR sizing or explicit flags. Testing whether we should parse extended capabilities is also pulled into the function to keep these assumptions in one place. Tested-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2016-06-30vfio: add pcie extended capability supportChen Fan1-1/+71
For vfio pcie device, we could expose the extended capability on PCIE bus. due to add a new pcie capability at the tail of the chain, in order to avoid config space overwritten, we introduce a copy config for parsing extended caps. and rebuild the pcie extended config space. Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
generated by cgit v1.1 at 2025-01-18 05:02:50 +0000