aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)AuthorFilesLines
2017-04-10target/i386/misc_helper: wrap BQL around another IRQ generatorAlex Bennée1-0/+3
Anything that calls into HW emulation must be protected by the BQL. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-02target-i386: fix "info lapic" segfault on isapcTejaswini Poluri1-0/+4
Start QEMU with "qemu-system-x86_64 -nographic -M isapc -serial none-monitor stdio" and enter "info lapic" at the monitor prompt ⇒ Segmentation fault Signed-off-by: Tejaswini Poluri <tejaswinipoluri3@gmail.com> Message-Id: <1490685583-16987-1-git-send-email-tejaswinipoluri3@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-31hmp: fix "dump-quest-memory" segfaultIwona Kotlarska1-2/+1
Running QEMU with "qemu-system-x86_64 -M none -nographic -m 256" and executing "dump-guest-memory /dev/null 0 8192" results in segfault. Fix by checking if we have CPU. Signed-off-by: Iwona Kotlarska <iwona260909@gmail.com> Message-Id: <20170330050924.22134-1-iwona260909@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixed up title
2017-03-28i386: Don't override -cpu options on -cpu host/maxEduardo Habkost2-4/+11
The existing code for "host" and "max" CPU models overrides every single feature in the CPU object at realize time, even the ones that were explicitly enabled or disabled by the user using "feat=on" or "feat=off", while features set using +feat/-feat are kept. This means "-cpu host,+invtsc" works as expected, while "-cpu host,invtsc=on" doesn't. This was a known bug, already documented in a comment inside x86_cpu_expand_features(). What makes this bug worse now is that libvirt 3.0.0 and newer now use "feat=on|off" instead of +feat/-feat when it detects a QEMU version that supports it (see libvirt commit d47db7b16dd5422c7e487c8c8ee5b181a2f9cd66). Change the feature property getter/setter to set a env->user_features field, to keep track of features that were explicitly changed using QOM properties. Then make the max_features code not override user features when handling "-cpu host" and "-cpu max". This will also allow us to remove the plus_features/minus_features hack in the future, but I plan to do that after 2.9.0 is released. Reported-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170327144815.8043-3-ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Tested-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-28i386: Replace uint32_t* with FeatureWord on feature getter/setterEduardo Habkost1-8/+11
Instead of passing a pointer to the feature property getter and setter functions, pass a FeatureWord enum so they can perform other actions related to the feature flag. This will be used to add a new "user_features" field to keep track of features that were explicitly set by the user. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170327144815.8043-2-ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Tested-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-24tcg/i386: Check the size of instruction being translatedPranith Kumar1-0/+7
This fixes the bug: 'user-to-root privesc inside VM via bad translation caching' reported by Jann Horn here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1122 Reviewed-by: Richard Henderson <rth@twiddle.net> CC: Peter Maydell <peter.maydell@linaro.org> CC: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Message-Id: <20170323175851.14342-1-bobby.prani@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-23target/s390x: Fix broken user modeStefan Weil1-2/+0
Returning NULL from get_max_cpu_model results in a SIGSEGV runtime error. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20170130131517.8092-1-sw@weilnetz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-03-20Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170320' into stagingPeter Maydell3-73/+79
MIPS patches 2017-03-20 Changes: * Fix clang warnings * Fix delay slot detection in gen_msa_branch() * Fix rc4030 interval timer * Fix rc4030 to tranlate memory accesses only when they occur * Fix 4c4030 a mixed declarations and code warning * Update MAINTAINERS file # gpg: Signature made Mon 20 Mar 2017 12:46:01 GMT # gpg: using RSA key 0x2238EB86D5F797C2 # gpg: Good signature from "Yongbok Kim <yongbok.kim@imgtec.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 8600 4CF5 3415 A5D9 4CFA 2B5C 2238 EB86 D5F7 97C2 * remotes/yongbok/tags/mips-20170320: MAINTAINERS: update for MIPS devices dma/rc4030: fix a mixed declarations and code warning dma/rc4030: translate memory accesses only when they occur dma: rc4030: limit interval timer reload value target/mips: fix delay slot detection in gen_msa_branch() target-mips: replace few LOG_DISAS() with trace points target-mips: replace break by goto cp0_unimplemented target-mips: log bad coprocessor0 register accesses with LOG_UNIMP target-mips: remove old & unuseful comments target-mips: fix compiler warnings (clang 5) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20arm: Fix APSR writes via M profile MSRPeter Maydell2-5/+24
Our implementation of writes to the APSR for M-profile via the MSR instruction was badly broken. First and worst, we had the sense wrong on the test of bit 2 of the SYSm field -- this is supposed to request an APSR write if bit 2 is 0 but we were doing it if bit 2 was 1. This bug was introduced in commit 58117c9bb429cd, so hasn't been in a QEMU release. Secondly, the choice of exactly which parts of APSR should be written is defined by bits in the 'mask' field. We were not passing these through from instruction decode, making it impossible to check them in the helper. Pass the mask bits through from the instruction decode to the helper function and process them appropriately; fix the wrong sense of the SYSm bit 2 check. Invalid mask values and invalid combinations of mask and register number are UNPREDICTABLE; we choose to treat them as if the mask values were valid. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1487616072-9226-5-git-send-email-peter.maydell@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-03-20arm: Enforce should-be-1 bits in MRS decodingPeter Maydell1-0/+14
The MRS instruction requires that bits [19..16] are all 1s, and for A/R profile also that bits [7..0] are all 0s. At this point in the decode tree we have checked all of the rest of the instruction but were allowing these to be any value. If these bits are not set then the result is architecturally UNPREDICTABLE, but choosing to UNDEF is more helpful to the user and avoids unexpected odd behaviour if the encodings are used for some purpose in future architecture versions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-4-git-send-email-peter.maydell@linaro.org
2017-03-20arm: Don't decode MRS(banked) or MSR(banked) for M profilePeter Maydell1-2/+4
M profile doesn't have the MSR(banked) and MRS(banked) instructions and uses the encodings for different kinds of M-profile MRS/MSR. Guard the relevant bits of the decode logic to make sure we don't accidentally fall into them by accident on M-profile. (The bit being checked for this (bit 5) is part of the SYSm field on M-profile, but since no currently allocated system registers have encodings with bit 5 of SYSm set, this hasn't been a problem in practice.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-3-git-send-email-peter.maydell@linaro.org
2017-03-20arm: HVC and SMC encodings don't exist for M profilePeter Maydell1-0/+3
M profile doesn't have the HVC or SMC encodings, so make them always UNDEF rather than generating calls to helper functions that assume A/R profile. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-2-git-send-email-peter.maydell@linaro.org
2017-03-20target/mips: fix delay slot detection in gen_msa_branch()Yongbok Kim1-1/+1
It is unnecessary to test R6 from delay/forbidden slot check in gen_msa_branch(). https://bugs.launchpad.net/qemu/+bug/1663287 Reported-by: Brian Campbell <bacam@z273.org.uk> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: replace few LOG_DISAS() with trace pointsPhilippe Mathieu-Daudé2-14/+16
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: replace break by goto cp0_unimplementedPhilippe Mathieu-Daudé1-44/+44
this fixes many warnings like: target/mips/translate.c:6253:13: warning: Value stored to 'rn' is never read rn = "invalid sel"; ^ ~~~~~~~~~~~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: log bad coprocessor0 register accesses with LOG_UNIMPPhilippe Mathieu-Daudé1-6/+6
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: remove old & unuseful commentsPhilippe Mathieu-Daudé1-4/+0
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: fix compiler warnings (clang 5)Philippe Mathieu-Daudé1-4/+12
static code analyzer complain: target/mips/helper.c:453:5: warning: Function call argument is an uninitialized value qemu_log_mask(CPU_LOG_MMU, ^~~~~~~~~~~~~~~~~~~~~~~~~~ 'physical' and 'prot' are uninitialized if 'ret' is not TLBRET_MATCH. Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-18Merge remote-tracking branch 'remotes/xtensa/tags/20170317-xtensa' into stagingPeter Maydell1-13/+36
target/xtensa fixes for 2.9: - fix build failure when FDT support is not enabled; - correctly pass command line arguments to semihosting guests. # gpg: Signature made Fri 17 Mar 2017 18:14:01 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170317-xtensa: target/xtensa: fix semihosting argc/argv implementation target/xtensa: xtfpga: load DTB only when FDT support is enabled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-16makefile: merge GENERATED_HEADERS & GENERATED_SOURCES variablesDaniel P. Berrange1-1/+1
The only functional difference between the GENERATED_HEADERS and GENERATED_SOURCES variables is that 'Makefile' has a dependancy on GENERATED_HEADERS, causing generated header files to be created immediatey at the start of the build process. There is no reason why this early creation should be restricted to the .h files, and not include .c files too. Merge both of the variables into a single GENERATED_FILES variable to make it clear it is for any type of generated file. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 20170228122901.24520-2-berrange@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-03-14Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell3-0/+16
* "x" monitor command fix for KVM (Christian) * MemoryRegion name documentation (David) * mem-prealloc optimization (Jitendra) * -icount/MTTCG fixes (me) * "info mtree" niceness (Peter) * NBD drop_sync buffer overflow (Vladimir/Eric) * small cleanups and bugfixes (Li, Lin, Suramya, Thomas) * fix for "-device kvmclock" w/TCG (Eduardo) * debug output before crashing on KVM_{GET,SET}_MSRS (Eduardo) # gpg: Signature made Tue 14 Mar 2017 13:42:05 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: nbd/client: fix drop_sync [CVE-2017-2630] memory: info mtree check mr range overflow icount: process QEMU_CLOCK_VIRTUAL timers in vCPU thread main-loop: remove now unnecessary optimization cpus: define QEMUTimerListNotifyCB for QEMU system emulation qemu-timer: do not include sysemu/cpus.h from util/qemu-timer.h qemu-timer: fix off-by-one target/nios2: take BQL around interrupt check scsi: mptsas: fix the wrong reading size in fetch request util: Removed unneeded header from path.c configure: add the missing help output for optional features scripts/dump-guest-memory.py: fix int128_get64 on recent gcc kvmclock: Don't crash QEMU if KVM is disabled kvm: Print MSR information if KVM_{GET,SET}_MSRS failed exec: add cpu_synchronize_state to cpu_memory_rw_debug mem-prealloc: reduce large guest start-up and migration time. docs: Add a note about mixing bootindex with "-boot order" memory_region: Fix name comments Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-14qemu-timer: do not include sysemu/cpus.h from util/qemu-timer.hPaolo Bonzini1-0/+1
This dependency is the wrong way, and we will need util/qemu-timer.h from sysemu/cpus.h in the next patch. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-14target/nios2: take BQL around interrupt checkPaolo Bonzini1-0/+3
The interrupt controller does not have its own locking. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-14kvm: Print MSR information if KVM_{GET,SET}_MSRS failedEduardo Habkost1-0/+12
When a KVM_{GET,SET}_MSRS ioctl() fails, it is difficult to find out which MSR caused the problem. Print an error message for debugging, before we trigger the (ret == cpu->kvm_msr_buf->nmsrs) assert. Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309194634.28457-1-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-14target/arm/arm-powerctl: Fix psci info return valuesAndrew Jones1-2/+2
The power state spec section 5.1.5 AFFINITY_INFO defines the affinity info return values as 0 ON 1 OFF 2 ON_PENDING I grepped QEMU for power_state to ensure that no assumptions of OFF=0 were being made. Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 20170303123232.4967-1-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-14target/arm: implement armv8 PMUSERENR (user-mode enable bits)Andrew Baumann1-8/+71
In armv8, this register implements more than a single bit, with fine-grained enables for read access to event counters, cycles counters, and write access to the software increment. This change implements those checks using custom access functions for the relevant registers. Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Message-id: 20170228215801.10472-2-Andrew.Baumann@microsoft.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: move a couple of access functions to be only compiled ifndef CONFIG_USER_ONLY to avoid compiler warnings] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-14target/ppc: fix cpu_ov setting for 32-bitNikunj A Dadhania1-1/+1
A bug was introduced in following commit: dc0ad84 target/ppc: update overflow flags for add/sub As for 32-bit ppc target extracting bit 63 for overflow is not correct. Made it dependent on TARGET_LOG_BITS. This had broken booting MacOS 9.2.1 image Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2017-03-14target/ppc: Fix wrong number of UAMR registerThomas Huth1-1/+1
The SPR UAMR has the number 13, and not 12. (Fortunately it seems like Linux is not using this register yet - only the privileged version with number 29 ... that's why nobody noticed this problem yet) Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-13Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into ↵Peter Maydell3-1/+38
staging x86: Haswell TSX blacklist fix for 2.9 # gpg: Signature made Fri 10 Mar 2017 18:45:08 GMT # gpg: using RSA key 0x2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-pull-request: i386: Change stepping of Haswell to non-blacklisted value i386/kvm: Blacklist TSX on known broken hosts i386: host_vendor_fms() helper function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-11target/xtensa: fix semihosting argc/argv implementationMax Filippov1-13/+36
So far xtensa provides fixed dummy argc/argv for the corresponding semihosting calls. Now that there are semihosting_get_argc and semihosting_get_arg, use them to pass actual command line arguments to guest. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2017-03-10i386: Change stepping of Haswell to non-blacklisted valueEduardo Habkost1-1/+1
glibc blacklists TSX on Haswell CPUs with model==60 and stepping < 4. To make the Haswell CPU model more useful, make those guests actually use TSX by changing CPU stepping to 4. References: * glibc commit 2702856bf45c82cf8e69f2064f5aa15c0ceb6359 https://sourceware.org/git/?p=glibc.git;a=commit;h=2702856bf45c82cf8e69f2064f5aa15c0ceb6359 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309181212.18864-4-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-10i386/kvm: Blacklist TSX on known broken hostsEduardo Habkost1-0/+17
Some Intel CPUs are known to have a broken TSX implementation. A microcode update from Intel disabled TSX on those CPUs, but GET_SUPPORTED_CPUID might be reporting it as supported if the hosts were not updated yet. Manually fixup the GET_SUPPORTED_CPUID data to ensure we will never enable TSX when running on those hosts. Reference: * glibc commit 2702856bf45c82cf8e69f2064f5aa15c0ceb6359: https://sourceware.org/git/?p=glibc.git;a=commit;h=2702856bf45c82cf8e69f2064f5aa15c0ceb6359 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309181212.18864-3-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-10i386: host_vendor_fms() helper functionEduardo Habkost2-0/+20
Helper function for code that needs to check the host CPU vendor/family/model/stepping values. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309181212.18864-2-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-09target/arm/helper: make it clear the EC field is also in hexAlex Bennée1-1/+1
..just like the rest of the displayed ESR register. Otherwise people might scratch their heads if a not obviously hex number is displayed for the EC field. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-09target-i386: defer VMEXIT to do_interruptPaolo Bonzini3-18/+26
Paths through the softmmu code during code generation now need to be audited to check for double locking of tb_lock. In particular, VMEXIT can take tb_lock through cpu_vmexit -> cpu_x86_update_cr4 -> tlb_flush. To avoid this, split VMEXIT delivery in two parts, similar to what is done with exceptions. cpu_vmexit only records the VMEXIT exit code and information, and cc->do_interrupt can then deliver it when it is safe to take the lock. Reported-by: Alexander Boettcher <alexander.boettcher@genode-labs.com> Suggested-by: Richard Henderson <rth@twiddle.net> Tested-by: Alexander Boettcher <alexander.boettcher@genode-labs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-03-09target/mips: hold BQL for timer interruptsYongbok Kim1-3/+18
Hold BQL when accessing timer which can cause interrupts Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2017-03-09target/xtensa: hold BQL for interrupt processingAlex Bennée2-0/+8
Make sure we have the BQL held when processing interrupts. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Max Filippov <jcmvbkbc@gmail.com>
2017-03-09s390x/misc_helper.c: wrap IO instructions in BQLAlex Bennée1-0/+21
Helpers that can trigger IO events (including interrupts) need to be protected by the BQL. I've updated all the helpers that call into an ioinst_handle_* functions. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-09sparc/sparc64: grab BQL before calling cpu_check_irqsAlex Bennée2-0/+16
IRQ modification is part of device emulation and should be done while the BQL is held to prevent races when MTTCG is enabled. This adds assertions in the hw emulation layer and wraps the calls from helpers in the BQL. Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2017-03-09target/i386/cpu.h: declare TCG_GUEST_DEFAULT_MOAlex Bennée1-0/+3
This suppresses the incorrect warning when forcing MTTCG for x86 guests on x86 hosts. A future patch will still warn when TARGET_SUPPORT_MTTCG hasn't been defined for the guest (which is still pending for x86). Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-07Merge remote-tracking branch 'remotes/xtensa/tags/20170306-xtensa' into stagingPeter Maydell3-0/+178
target/xtensa updates: - instantiate local memories in xtensa sim machine; - add two missing include files to xtensa core importing script. # gpg: Signature made Mon 06 Mar 2017 22:32:45 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170306-xtensa: target/xtensa: add two missing headers to core import script target/xtensa: sim: instantiate local memories Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-06Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.9-20170306' ↵Peter Maydell1-45/+32
into staging ppc patch queue for 2017-03-06 Looks like my previous batch wasn't quite the last before hard freeze. This has a handful of bugfixes to go in. They're all genuine bugfixes, though not regressions in some cases. # gpg: Signature made Mon 06 Mar 2017 04:07:48 GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.9-20170306: target/ppc: use helper for excp handling target/ppc: fmadd: add macro for updating flags target/ppc: fmadd check for excp independently spapr: ensure that all threads within core are on the same NUMA node ppc/xics: register reset handlers for the ICP and ICS objects Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-06target/ppc: use helper for excp handlingNikunj A Dadhania1-18/+2
Use the helper routine float[32,64]_maddsub_update_excp() in VSX_MADD macro. Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-06target/ppc: fmadd: add macro for updating flagsNikunj A Dadhania1-31/+30
Adds FPU_MADDSUB_UPDATE macro, this will be used for other routines having float32/16 Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-06target/ppc: fmadd check for excp independentlyNikunj A Dadhania1-8/+12
Current order of checking does not confirm with the spec (ISA 3.0: MultiplyAddDP page-469). Change the order and make them independent of each other. For example: a = infinity, b = zero, c = SNaN, this should set both VXIMZ and VXNAN Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-05qapi: Drop unused non-strict qobject input visitorMarkus Armbruster1-1/+1
The split between tests/test-qobject-input-visitor.c and tests/test-qobject-input-strict.c now makes less sense than ever. The next commit will take care of that. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1488544368-30622-20-git-send-email-armbru@redhat.com>
2017-03-04Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.9-20170303' ↵Peter Maydell12-488/+562
into staging ppc patch queuye for 2017-03-03 This will probably be my last pull request before the hard freeze. It has some new work, but that has all been posted in draft before the soft freeze, so I think it's reasonable to include in qemu-2.9. This batch has: * A substantial amount of POWER9 work * Implements the legacy (hash) MMU for POWER9 * Some more preliminaries for implementing the POWER9 radix MMU * POWER9 has_work * Basic POWER9 compatibility mode handling * Removal of some premature tests * Some cleanups and fixes to the existing MMU code to make the POWER9 work simpler * A bugfix for TCG multiply adds on power * Allow pseries guests to access PCIe extended config space This also includes a code-motion not strictly in ppc code - moving getrampagesize() from ppc code to exec.c. This will make some future VFIO improvements easier, Paolo said it was ok to merge via my tree. # gpg: Signature made Fri 03 Mar 2017 03:20:36 GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.9-20170303: target/ppc: rewrite f[n]m[add,sub] using float64_muladd spapr: Small cleanup of PPC MMU enums spapr_pci: Advertise access to PCIe extended config space target/ppc: Rework hash mmu page fault code and add defines for clarity target/ppc: Move no-execute and guarded page checking into new function target/ppc: Add execute permission checking to access authority check target/ppc: Add Instruction Authority Mask Register Check hw/ppc/spapr: Add POWER9 to pseries cpu models target/ppc/POWER9: Add cpu_has_work function for POWER9 target/ppc/POWER9: Add POWER9 pa-features definition target/ppc/POWER9: Add POWER9 mmu fault handler target/ppc: Don't gen an SDR1 on POWER9 and rework register creation target/ppc: Add patb_entry to sPAPRMachineState target/ppc/POWER9: Add POWERPC_MMU_V3 bit powernv: Don't test POWER9 CPU yet exec, kvm, target-ppc: Move getrampagesize() to common code target/ppc: Add POWER9/ISAv3.00 to compat_table Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-04nios2: avoid anonymous unions in designated initializers.Paolo Bonzini1-18/+18
These cause compilation failures on CentOS 6 or other operating systems with older GCCs. Cc: Richard Henderson <rth@twiddle.net> Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-04hppa: avoid anonymous unions in designated initializers.Paolo Bonzini1-33/+33
These cause compilation failures on CentOS 6 or other operating systems with older GCCs. Cc: Richard Henderson <rth@twiddle.net> Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1488558530-21016-1-git-send-email-pbonzini@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-03x86: Work around SMI migration breakagesDr. David Alan Gilbert3-1/+11
Migration from a 2.3.0 qemu results in a reboot on the receiving QEMU due to a disagreement about SM (System management) interrupts. 2.3.0 didn't have much SMI support, but it did set CPU_INTERRUPT_SMI and this gets into the migration stream, but on 2.3.0 it never got delivered. ~2.4.0 SMI interrupt support was added but was broken - so that when a 2.3.0 stream was received it cleared the CPU_INTERRUPT_SMI but never actually caused an interrupt. The SMI delivery was recently fixed by 68c6efe07a, but the effect now is that an incoming 2.3.0 stream takes the interrupt it had flagged but it's bios can't actually handle it(I think partly due to the original interrupt not being taken during boot?). The consequence is a triple(?) fault and a reboot. Tested from: 2.3.1 -M 2.3.0 2.7.0 -M 2.3.0 2.8.0 -M 2.3.0 2.8.0 -M 2.8.0 This corresponds to RH bugzilla entry 1420679. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20170223133441.16010-1-dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.1 at 2024-11-03 00:33:03 +0000