aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-05-17qdev: Replace cannot_instantiate_with_device_add_yet with !user_creatableEduardo Habkost
cannot_instantiate_with_device_add_yet was introduced by commit efec3dd631d94160288392721a5f9c39e50fb2bc to replace no_user. It was supposed to be a temporary measure. When it was introduced, we had 54 cannot_instantiate_with_device_add_yet=true lines in the code. Today (3 years later) this number has not shrunk: we now have 57 cannot_instantiate_with_device_add_yet=true lines. I think it is safe to say it is not a temporary measure, and we won't see the flag go away soon. Instead of a long field name that misleads people to believe it is temporary, replace it a shorter and less misleading field: user_creatable. Except for code comments, changes were generated using the following Coccinelle patch: @@ expression DC; @@ ( -DC->cannot_instantiate_with_device_add_yet = false; +DC->user_creatable = true; | -DC->cannot_instantiate_with_device_add_yet = true; +DC->user_creatable = false; ) @@ typedef ObjectClass; expression dc; identifier class, data; @@ static void device_class_init(ObjectClass *class, void *data) { ... dc->hotpluggable = true; +dc->user_creatable = true; ... } @@ @@ struct DeviceClass { ... -bool cannot_instantiate_with_device_add_yet; +bool user_creatable; ... } @@ expression DC; @@ ( -!DC->cannot_instantiate_with_device_add_yet +DC->user_creatable | -DC->cannot_instantiate_with_device_add_yet +!DC->user_creatable ) Cc: Alistair Francis <alistair.francis@xilinx.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Marcel Apfelbaum <marcel@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Thomas Huth <thuth@redhat.com> Acked-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Acked-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170503203604.31462-2-ehabkost@redhat.com> [ehabkost: kept "TODO remove once we're there" comment] Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-05-17Merge remote-tracking branch 'sstabellini/tags/xen-20170516-tag' into stagingStefan Hajnoczi
Xen 2017/05/16 # gpg: Signature made Tue 16 May 2017 08:18:32 PM BST # gpg: using RSA key 0x894F8F4870E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" # gpg: aka "Stefano Stabellini <sstabellini@kernel.org>" # Primary key fingerprint: D04E 33AB A51F 67BA 07D3 0AEA 894F 8F48 70E1 AE90 * sstabellini/tags/xen-20170516-tag: xen: call qemu_set_cloexec instead of fcntl xen/9pfs: fix two resource leaks on error paths, discovered by Coverity configure: Remove -lxencall for Xen detection xen/mapcache: store dma information in revmapcache entries for debugging Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-17Merge remote-tracking branch 'jtc/tags/block-pull-request' into stagingStefan Hajnoczi
# gpg: Signature made Tue 16 May 2017 04:47:09 PM BST # gpg: using RSA key 0xBDBE7B27C0DE3057 # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>" # gpg: aka "Jeffrey Cody <jeff@codyprime.org>" # gpg: aka "Jeffrey Cody <codyprime@gmail.com>" # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98 D624 BDBE 7B27 C0DE 3057 * jtc/tags/block-pull-request: curl: do not do aio_poll when waiting for a free CURLState curl: convert readv to coroutines curl: convert CURLAIOCB to byte values curl: split curl_find_state/curl_init_state curl: avoid recursive locking of BDRVCURLState mutex curl: never invoke callbacks with s->mutex held curl: strengthen assertion in curl_clean_state block: curl: Allow passing cookies via QCryptoSecret Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-16xen: call qemu_set_cloexec instead of fcntlStefano Stabellini
Use the common utility function, which contains checks on return values and first calls F_GETFD as recommended by POSIX.1-2001, instead of manually calling fcntl. CID: 1374831 Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> CC: anthony.perard@citrix.com CC: groug@kaod.org CC: aneesh.kumar@linux.vnet.ibm.com CC: Eric Blake <eblake@redhat.com>
2017-05-16xen/9pfs: fix two resource leaks on error paths, discovered by CoverityStefano Stabellini
CID: 1374836 Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> CC: anthony.perard@citrix.com CC: groug@kaod.org CC: aneesh.kumar@linux.vnet.ibm.com
2017-05-16configure: Remove -lxencall for Xen detectionAnthony PERARD
QEMU does not depends on libxencall, it was added because it was a missing link dependency of libxendevicemodel, but now the later should be built properly. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-05-16xen/mapcache: store dma information in revmapcache entries for debuggingStefano Stabellini
The Xen mapcache is able to create long term mappings, they are called "locked" mappings. The third parameter of the xen_map_cache call specifies if a mapping is a "locked" mapping. >From the QEMU point of view there are two kinds of long term mappings: [a] device memory mappings, such as option roms and video memory [b] dma mappings, created by dma_memory_map & friends After certain operations, ballooning a VM in particular, Xen asks QEMU kindly to destroy all mappings. However, certainly [a] mappings are present and cannot be removed. That's not a problem as they are not affected by balloonning. The *real* problem is that if there are any mappings of type [b], any outstanding dma operations could fail. This is a known shortcoming. In other words, when Xen asks QEMU to destroy all mappings, it is an error if any [b] mappings exist. However today we have no way of distinguishing [a] from [b]. Because of that, we cannot even print a decent warning. This patch introduces a new "dma" bool field to MapCacheRev entires, to remember if a given mapping is for dma or is a long term device memory mapping. When xen_invalidate_map_cache is called, we print a warning if any [b] mappings exist. We ignore [a] mappings. Mappings created by qemu_map_ram_ptr are assumed to be [a], while mappings created by address_space_map->qemu_ram_ptr_length are assumed to be [b]. The goal of the patch is to make debugging and system understanding easier. Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2017-05-16curl: do not do aio_poll when waiting for a free CURLStatePaolo Bonzini
Instead, put the CURLAIOCB on a wait list and yield; curl_clean_state will wake the corresponding coroutine. Because of CURL's callback-based structure, we cannot easily convert everything to CoMutex/CoQueue; keeping the QemuMutex is simpler. However, CoQueue is a simple wrapper around a linked list, so we can easily use QSIMPLEQ and open-code a CoQueue, protected by the BDRVCURLState QemuMutex instead of a CoMutex. Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 20170515100059.15795-8-pbonzini@redhat.com Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16curl: convert readv to coroutinesPaolo Bonzini
This is pretty simple. The bottom half goes away because, unlike bdrv_aio_readv, coroutine-based read can return immediately without yielding. However, for simplicity I kept the former bottom half handler in a separate function. Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 20170515100059.15795-7-pbonzini@redhat.com Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16curl: convert CURLAIOCB to byte valuesPaolo Bonzini
This is in preparation for the conversion from bdrv_aio_readv to bdrv_co_preadv, and it also requires changing some of the size_t values to uint64_t. This was broken before for disks > 2TB, but now it would break at 4GB. Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 20170515100059.15795-6-pbonzini@redhat.com Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16curl: split curl_find_state/curl_init_statePaolo Bonzini
If curl_easy_init fails, a CURLState is left with s->in_use = 1. Split curl_init_state in two, so that we can distinguish the two failures and call curl_clean_state if needed. While at it, simplify curl_find_state, removing a dummy loop. The aio_poll loop is moved to the sole caller that needs it. Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 20170515100059.15795-5-pbonzini@redhat.com Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16block/win32: fix 'ret not initialized' warningGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 20170516074256.24731-1-kraxel@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-16curl: avoid recursive locking of BDRVCURLState mutexPaolo Bonzini
The curl driver has a ugly hack where, if it cannot find an empty CURLState, it just uses aio_poll to wait for one to be empty. This is probably buggy when used together with dataplane, and the simplest way to fix it is to use coroutines instead. A more immediate effect of the bug however is that it can cause a recursive call to curl_readv_bh_cb and recursively taking the BDRVCURLState mutex. This causes a deadlock. The fix is to unlock the mutex around aio_poll, but for cleanliness we should also take the mutex around all calls to curl_init_state, even if reaching the unlock/lock pair is impossible. The same is true for curl_clean_state. Reported-by: Kun Wei <kuwei@redhat.com> Tested-by: Richard W.M. Jones <rjones@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20170515100059.15795-4-pbonzini@redhat.com Cc: qemu-stable@nongnu.org Cc: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16curl: never invoke callbacks with s->mutex heldPaolo Bonzini
All curl callbacks go through curl_multi_do, and hence are called with s->mutex held. Note that with comments, and make curl_read_cb drop the lock before invoking the callback. Likewise for curl_find_buf, where the callback can be invoked by the caller. Cc: qemu-stable@nongnu.org Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 20170515100059.15795-3-pbonzini@redhat.com Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16curl: strengthen assertion in curl_clean_statePaolo Bonzini
curl_clean_state should only be called after all AIOCBs have been completed. This is not so obvious for the call from curl_detach_aio_context, so assert that. Cc: qemu-stable@nongnu.org Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 20170515100059.15795-2-pbonzini@redhat.com Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16fix mingw build failureGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170516052439.16214-1-kraxel@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-16maintainers: Add myself as a NetBSD reviewerKamil Rytarowski
I volunteer to review NetBSD patches. Adding myself will help to not miss some of them. Restore NetBSD as a maintained host. All patches to make qemu/pkgsrc building have been emitted to review. Signed-off-by: Kamil Rytarowski <n54@gmx.com> Message-id: 20170513022143.2838-1-n54@gmx.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-16block: curl: Allow passing cookies via QCryptoSecretPeter Krempa
Since cookies can contain sensitive data (session ID, etc ...) it is desired to hide them from the prying eyes of users. Add a possibility to pass them via the secret infrastructure. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1447413 Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Message-id: f4a22cdebdd0bca6a13a43a2a6deead7f2ec4bb3.1493906281.git.pkrempa@redhat.com Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-05-16Merge remote-tracking branch 'gkurz/tags/security-fix-for-2.10' into stagingStefan Hajnoczi
Fix for CVE-2017-7493. # gpg: Signature made Mon 15 May 2017 07:48:20 PM BST # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@fr.ibm.com>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "Gregory Kurz (Cimai Technology) <gkurz@cimai.com>" # gpg: aka "Gregory Kurz (Meiosys Technology) <gkurz@meiosys.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * gkurz/tags/security-fix-for-2.10: 9pfs: local: forbid client access to metadata (CVE-2017-7493) Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-16Merge remote-tracking branch 'aurel32/tags/pull-target-sh4-20170513' into ↵Stefan Hajnoczi
staging Queued target/sh4 patches # gpg: Signature made Sat 13 May 2017 10:25:41 AM BST # gpg: using RSA key 0xBA9C78061DDD8C9B # gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>" # gpg: aka "Aurelien Jarno <aurelien@jarno.fr>" # gpg: aka "Aurelien Jarno <aurel32@debian.org>" # Primary key fingerprint: 7746 2642 A9EF 94FD 0F77 196D BA9C 7806 1DDD 8C9B * aurel32/tags/pull-target-sh4-20170513: target/sh4: use cpu_loop_exit_restore target/sh4: trap unaligned accesses target/sh4: movua.l is an SH4-A only instruction target/sh4: implement tas.b using atomic helper target/sh4: generate fences for SH4 target/sh4: optimize gen_write_sr using extract op target/sh4: optimize gen_store_fpr64 target/sh4: fold ctx->bstate = BS_BRANCH into gen_conditional_jump target/sh4: only save flags state at the end of the TB target/sh4: fix BS_EXCP exit target/sh4: fix BS_STOP exit target/sh4: move DELAY_SLOT_TRUE flag into a separate global target/sh4: do not include DELAY_SLOT_TRUE in the TB state target/sh4: get rid of DELAY_SLOT_CLEARME target/sh4: split ctx->flags into ctx->tbflags and ctx->envflags Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-16Merge remote-tracking branch 'rth/tags/pull-s390-20170512' into stagingStefan Hajnoczi
Queued target/s390 patches # gpg: Signature made Sat 13 May 2017 12:33:08 AM BST # gpg: using RSA key 0xAD1270CC4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC 16A4 AD12 70CC 4DD0 279B * rth/tags/pull-s390-20170512: target/s390x: implement serialization in BRANCH CONDITION target/s390x: fix SIGNAL PROCESSOR return value target/s390x: mask the SIGP order_code using SIGP_ORDER_MASK target/s390x: Use atomic operations for LOAD AND OP target/s390x: Use atomic operations for COMPARE SWAP target/s390x: Implement LOAD PAIR DISJOINT target/s390x: Diagnose specification exception for atomics target/s390x: Implement LOAD PROGRAM PARAMETER target/s390x: Implement STORE FACILITIES LIST EXTENDED Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-15Merge remote-tracking branch 'kraxel/tags/pull-usb-20170512-1' into stagingStefan Hajnoczi
usb: bugfixes, doc update # gpg: Signature made Fri 12 May 2017 01:20:29 PM BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * kraxel/tags/pull-usb-20170512-1: hw/usb/dev-serial: Do not try to set vendorid or productid properties xhci: relax link check usb-hub: clear PORT_STAT_SUSPEND on wakeup xhci: fix logging usb-redir: fix stack overflow in usbredir_log_data qemu-doc: Update to use the new way of attaching USB devices Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-15Merge remote-tracking branch 'kraxel/tags/pull-ui-20170512-1' into stagingStefan Hajnoczi
ui: add egl-headless ui: some vnc cleanups ui: absolute events for input-linux # gpg: Signature made Fri 12 May 2017 12:50:07 PM BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * kraxel/tags/pull-ui-20170512-1: vnc: replace hweight_long() with ctpopl() vnc: simple clean up opengl: add egl-headless display egl: explicitly ask for core context egl-helpers: add missing error check egl-helpers: fix display init for x11 egl-helpers: drop support for gles and debug logging virtio-gpu: move virtio_gpu_gl_block ui: input-linux: Add absolute event support ui: Support non-zero minimum values for absolute input axes Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-159pfs: local: forbid client access to metadata (CVE-2017-7493)Greg Kurz
When using the mapped-file security mode, we shouldn't let the client mess with the metadata. The current code already tries to hide the metadata dir from the client by skipping it in local_readdir(). But the client can still access or modify it through several other operations. This can be used to escalate privileges in the guest. Affected backend operations are: - local_mknod() - local_mkdir() - local_open2() - local_symlink() - local_link() - local_unlinkat() - local_renameat() - local_rename() - local_name_to_path() Other operations are safe because they are only passed a fid path, which is computed internally in local_name_to_path(). This patch converts all the functions listed above to fail and return EINVAL when being passed the name of the metadata dir. This may look like a poor choice for errno, but there's no such thing as an illegal path name on Linux and I could not think of anything better. This fixes CVE-2017-7493. Reported-by: Leo Gaspard <leo@gaspard.io> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-05-15Merge remote-tracking branch 'ehabkost/tags/x86-and-machine-pull-request' ↵Stefan Hajnoczi
into staging x86 and machine queue, 2017-05-11 Highlights: * New "-numa cpu" option * NUMA distance configuration * migration/i386 vmstatification # gpg: Signature made Thu 11 May 2017 08:16:07 PM BST # gpg: using RSA key 0x2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # gpg: Note: This key has expired! # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * ehabkost/tags/x86-and-machine-pull-request: (29 commits) migration/i386: Remove support for pre-0.12 formats vmstatification: i386 FPReg migration/i386: Remove old non-softfloat 64bit FP support tests: check -numa node,cpu=props_list usecase numa: add '-numa cpu,...' option for property based node mapping numa: remove node_cpu bitmaps as they are no longer used numa: use possible_cpus for not mapped CPUs check machine: call machine init from wrapper numa: remove no longer need numa_post_machine_init() tests: numa: add case for QMP command query-cpus QMP: include CpuInstanceProperties into query_cpus output output virt-arm: get numa node mapping from possible_cpus instead of numa_get_node_for_cpu() spapr: get numa node mapping from possible_cpus instead of numa_get_node_for_cpu() pc: get numa node mapping from possible_cpus instead of numa_get_node_for_cpu() numa: do default mapping based on possible_cpus instead of node_cpu bitmaps numa: mirror cpu to node mapping in MachineState::possible_cpus numa: add check that board supports cpu_index to node mapping virt-arm: add node-id property to CPU pc: add node-id property to CPU spapr: add node-id property to sPAPR core ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-15Merge remote-tracking branch 'kraxel/tags/pull-vga-20170511-1' into stagingStefan Hajnoczi
make display updates thread safe, batch #2 # gpg: Signature made Thu 11 May 2017 03:41:51 PM BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * kraxel/tags/pull-vga-20170511-1: vga: fix display update region calculation sm501: make display updates thread safe tcx: make display updates thread safe cg3: make display updates thread safe Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-15Merge remote-tracking branch 'dgibson/tags/ppc-for-2.10-20170511' into stagingStefan Hajnoczi
ppc patch queue for 2017-05-11 This pull request supersedes the one from yesterday (20170510), fixing an important style bug in one patch, and adding an extra couple of simple patches. Highlights of this set: * Some fixes for POWER9 * TCG support for POWER9 radix MMU * VGA rom for Mac machine types * Fixes for the XICS interrupt controller * MTTCG support for ppc targets As suggested by Paolo, I've tried to add the Docker tests to my standard pre-pull-request tests. I haven't wholly suceeded; this has been tested with some of the Docker images, but others I haven't managed due to problems that as best I can tell are not due to problems in this patch series. I'll continue working on this for future pull requests. Specifically, 'travis', 'fedora', and 'centos6' seem to work. 'min-glib' jammed while gtesting moxie, which seems very unlikely to be caused by this series. 'ubuntu', 'debian' and 'debian-bootstrap' hit build errors almost immediately that look like problems with the container configuration, and 'debian-*-cross' hit build errors later on which also look like missing dependencies from the container. # gpg: Signature made Thu 11 May 2017 05:13:46 AM BST # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * dgibson/tags/ppc-for-2.10-20170511: (23 commits) target/ppc: Avoid printing wrong aliases in CPU help text pnv: Fix build failures on some host platforms target/ppc: Allow workarounds for POWER9 DD1 spapr: Don't accidentally advertise HTM support on POWER9 ppc: xics: fix compilation with CentOS 6 target/ppc: Enable RADIX mmu mode for pseries TCG guest target/ppc: Implement ISA V3.00 radix page fault handler target/ppc: Change tlbie invalid fields for POWER9 support target/ppc: Update tlbie to check privilege level based on GTSE target/ppc: Set UPRT and GTSE on all cpus in H_REGISTER_PROCESS_TABLE ppc: add qemu_vga.ndrv ROM to fw_cfg interface for NewWorld Macs ppc: add qemu_vga.ndrv ROM to fw_cfg interface for OldWorld Macs Add QemuMacDrivers qemu_vga.ndrv revision d4e7d7a built as submodule Add QemuMacDrivers as submodule ppc/xics: preserve P and Q bits for KVM IRQs ppc/xics: Fix stale irq->status bits after get target/ppc: do not reset reserve_addr in exec_enter tcg: enable MTTCG by default for PPC64 on x86 cpus: Fix CPU unplug for MTTCG target/ppc: Generate fence operations ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-13target/sh4: use cpu_loop_exit_restoreAurelien Jarno
Use cpu_loop_exit_restore when using cpu_restore_state and cpu_loop_exit together. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: trap unaligned accessesAurelien Jarno
SH4 requires that memory accesses are naturally aligned, except for the SH4-A movua.l instructions which can do unaligned loads. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: movua.l is an SH4-A only instructionAurelien Jarno
At the same time change the comment describing the instruction the same way than other instruction, so that the code is easier to read and search. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: implement tas.b using atomic helperAurelien Jarno
We only emulate UP SH4, however as the tas.b instruction is used in the GNU libc, this improve linux-user emulation. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: generate fences for SH4Aurelien Jarno
synco is a SH4-A only instruction. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: optimize gen_write_sr using extract opAurelien Jarno
This doesn't change the generated code on x86, but optimizes it on most RISC architectures and makes the code simpler to read. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: optimize gen_store_fpr64Aurelien Jarno
Using extr and avoiding intermediate temps. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: fold ctx->bstate = BS_BRANCH into gen_conditional_jumpAurelien Jarno
Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: only save flags state at the end of the TBAurelien Jarno
There is no need to save flags when entering and exiting the delay slot. They can be saved only when reaching the end of the TB. If the TB is interrupted before by an exception, they will be restored using restore_state_to_opc. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: fix BS_EXCP exitAurelien Jarno
In case of exception, there is no need to call tcg_gen_exit_tb as the exception helper won't return. Also fix a few cases where BS_BRANCH is called instead of BS_EXCP. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: fix BS_STOP exitAurelien Jarno
When stopping the translation because the state has changed, goto_tb should not be used as it might link TB with different flags. Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: move DELAY_SLOT_TRUE flag into a separate globalAurelien Jarno
Instead of using one bit of the env flags to store the condition of the next delay slot, use a separate global. It simplifies reading and writing the flags variable and also removes some confusion between ctx->envflags and env->flags. Note that the global is first transfered to a temp in order to be able to discard the global before the brcond. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: do not include DELAY_SLOT_TRUE in the TB stateAurelien Jarno
DELAY_SLOT_TRUE is used as a dynamic condition for the branch after the delay slot instruction. It is not used in code generation, so there is no need to including in the TB state. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: get rid of DELAY_SLOT_CLEARMEAurelien Jarno
Now that ctx->flags has been split, it becomes clear that DELAY_SLOT_CLEARME has not impact on the code generation: in both case ctx->envflags is cleared, either by clearing all the flags, or by setting it to 0. This is left-over from pre-TCG era. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-13target/sh4: split ctx->flags into ctx->tbflags and ctx->envflagsAurelien Jarno
There is a confusion (and not only in the SH4 target) between tb->flags, env->flags and ctx->flags. To avoid it, split ctx->flags into ctx->tbflags and ctx->envflags. ctx->tbflags stays unchanged during the whole TB translation, while ctx->envflags evolves and is kept in sync with env->flags using TCG instructions. ctx->envflags now only contains the part that of env->flags that is contained in the TB state, i.e. the DELAY_SLOT* flags. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2017-05-12target/s390x: implement serialization in BRANCH CONDITIONAurelien Jarno
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-Id: <20170509082800.10756-4-aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-05-12target/s390x: fix SIGNAL PROCESSOR return valueAurelien Jarno
The SIGNAL PROCESSOR helper returns its value through the CC register. set_cc_static should be called just after the helper. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-Id: <20170509082800.10756-3-aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-05-12target/s390x: mask the SIGP order_code using SIGP_ORDER_MASKAurelien Jarno
For that move the definition from kvm.c to cpu.h Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-Id: <20170509082800.10756-2-aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-05-12target/s390x: Use atomic operations for LOAD AND OPRichard Henderson
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-05-12target/s390x: Use atomic operations for COMPARE SWAPRichard Henderson
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-05-12target/s390x: Implement LOAD PAIR DISJOINTEric Bischoff
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Eric Bischoff <ebischoff@nerim.net> Message-Id: <20170228120134.7921-1-ebischoff@suse.com> [rth: Combine the two via insn->data; free the address temps.] Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-05-12target/s390x: Diagnose specification exception for atomicsRichard Henderson
All of the interlocked access facility instructions raise a specification exception for unaligned accesses. Do this by using the (previously unused) unaligned_access hook. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-05-12target/s390x: Implement LOAD PROGRAM PARAMETERMiroslav Benes
Linux arch/s390/kernel/head(64).S uses LPP instruction if it is available in facilities list provided by stfl/stfle instruction. This is the case of newer z/System generations and their qemu definition. The description of LPP is at http://www-01.ibm.com/support/docview.wss?uid=isg26fcd1cc32246f4c8852574ce0044734a Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Miroslav Benes <mbenes@suse.cz> Message-Id: <20170227085353.20787-1-mbenes@suse.cz> Signed-off-by: Richard Henderson <rth@twiddle.net>
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-01 17:15:02 +0000