aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2015-01-15vt82c686: avoid out-of-bounds readPaolo Bonzini
superio_ioport_readb can read the 256th element of the array. Coverity reports an out-of-bounds write in superio_ioport_writeb, but it does not show the corresponding out-of-bounds read because it cannot prove that it can happen. Fix the root cause of the problem (zhanghailang's patch instead fixes the logic in superio_ioport_writeb). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Cc: qemu-stable@nongnu.org
2015-01-14Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
Mostly bugfixes and cleanups from qemu-devel. Yet another small patch from the record/replay series, and a few SCSI and i386 patches as well. # gpg: Signature made Wed 14 Jan 2015 09:39:14 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: cpus: consistently use QEMU_CLOCK_VIRTUAL_RT for icount_warp_rt timer qemu-timer: rename timer_init to timer_init_tl scsi: fix cancellation when I/O was completed but DMA was not. rules.mak: Fix module build hw/scsi/lsi53c895a: add support for additional diag / debug registers qemu-common.h: optimise muldiv64 if int128 is available target-i386: do not memcpy in and out of xmm_regs target-i386: fix movntsd on big-endian hosts vl.c: fix regression when reading memory size from config file vl: Don't silently change topology when all -smp options were set vl: fix max_cpus check vl: Avoid unnecessary 'if' nesting 9pfs: changed to use event_notifier instead of qemu_pipe vl.c: fix regression when reading machine type from config file char: restore stdio echo on resume from suspend. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-14scsi: fix cancellation when I/O was completed but DMA was not.Paolo Bonzini
Commit d577646 (scsi: Introduce scsi_req_cancel_complete, 2014-09-25) was supposed to have no semantic change, but it missed a case. When r->aiocb has already been NULLed, but DMA was not complete and the SCSI layer was waiting for scsi_req_continue, after the patch the SCSI layer will not call the .cancel callback of SCSIBusInfo. Fixes: d5776465ee9a55815792efa34d79de240f4ffd99 Cc: qemu-stable@nongnu.org Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-14hw/scsi/lsi53c895a: add support for additional diag / debug registersPeter Lieven
Some ancient Linux kernels read from registers 0x09 and 0x3c-3f during boot. According to the spec these registers are for diag and debug purposes only. If they are absend qemu aborts on read. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-13Merge remote-tracking branch 'remotes/sstabellini/xen-2015-01-13' into stagingPeter Maydell
* remotes/sstabellini/xen-2015-01-13: xen-hvm: increase maxmem before calling xc_domain_populate_physmap xen-pt: Fix PCI devices re-attach failed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-13NVMe: Set correct VS Value for 1.1 Compliant ControllersAnubhav Rakshit
According to NVMe specifications Bits 15:08 represent Minor Version number. Signed-off-by: Anubhav Rakshit <anubhav.rakshit@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-13nvme: Fix get/set number of queues featureAlex Friedman
According to the specification, the low 16 bits should contain the number of I/O submission queues, and the high 16 bits should contain the number of I/O completion queues. Signed-off-by: Alex Friedman <alex@e8storage.com> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-13ide: Implement VPD response for ATAPIJohn Snow
SCSI devices have multiple kinds of queries they need to respond to, as defined in the "cmd inquiry" section in MMC-6 and SPC-3. Relevent sections: MMC-6 revision 2g: Non-VPD response data and pointer to SPC-3; Section 6.8 "Inquiry Command" SPC-3 revision 23: Inquiry command and error handling: Section 6.4 "INQUIRY command" VPD data pages format: Section 7.6 "Vital product data parameters" We implement these Vital Product Data queries for SCSI, but not for ATAPI through IDE. The result is that if you are looking for the WWN identifier via tools such as sg3_utils, you will be unable to query our CD/DVD rom device to obtain it. This patch adds the minimum number of mandatory responses as defined by SPC-3, which include the "supported pages" response (page 0x00) and the "Device Identification" response (page 0x83). It also correctly responds when it receives a request for an illegal page to improve error output from related tools. The Device ID page contains an arbitrary list of identification strings of various formats; the ID strings included in this patch were chosen to mimic those provided by the libata driver when emulating this SCSI query (model, serial, and wwn when present.) Example: # libata emulated response [root@localhost ~]# sg_inq --id /dev/sda VPD INQUIRY: Device Identification page Designation descriptor number 1, descriptor length: 24 designator_type: vendor specific [0x0], code_set: ASCII associated with the addressed logical unit vendor specific: QM00001 Designation descriptor number 2, descriptor length: 72 designator_type: T10 vendor identification, code_set: ASCII associated with the addressed logical unit vendor id: ATA vendor specific: QEMU HARDDISK QM00001 # QEMU generated ATAPI response, with WWN [root@localhost ~]# sg_inq --id /dev/sr0 VPD INQUIRY: Device Identification page Designation descriptor number 1, descriptor length: 24 designator_type: vendor specific [0x0], code_set: ASCII associated with the addressed logical unit vendor specific: QM00005 Designation descriptor number 2, descriptor length: 72 designator_type: T10 vendor identification, code_set: ASCII associated with the addressed logical unit vendor id: ATA vendor specific: QEMU DVD-ROM QM00005 Designation descriptor number 3, descriptor length: 12 designator_type: NAA, code_set: Binary associated with the addressed logical unit NAA 5, IEEE Company_id: 0xc50 Vendor Specific Identifier: 0x15ea71bb [0x5000c50015ea71bb] See also: hw/scsi/scsi-disk.c, scsi_disk_emulate_inquiry() Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-13block: Split BLOCK_OP_TYPE_COMMIT to BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}Fam Zheng
Like BLOCK_OP_TYPE_BACKUP_SOURCE and BLOCK_OP_TYPE_BACKUP_TARGET, block-commit involves two asymmetric devices. This change is not user-visible (yet), because commit only works with device names. But once we enable backing reference in blockdev-add, or specifying node-name in block-commit command, we don't want the user to start two commit jobs on the same backing chain, which will corrupt things because of the final bdrv_swap. Before we have per category blockers, splitting this type is still better. [Resolved virtio-blk dataplane conflict by replacing BLOCK_OP_TYPE_COMMIT with both BLOCK_OP_TYPE_COMMIT_{SOURCE, TARGET}. They are safe since the block job runs in the same AioContext as the dataplane IOThread. --Stefan] Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-13xen-pt: Fix PCI devices re-attach failedLiang Li
Use the 'xl pci-attach $DomU $BDF' command to attach more than one PCI devices to the guest, then detach the devices with 'xl pci-detach $DomU $BDF', after that, re-attach these PCI devices again, an error message will be reported like following: libxl: error: libxl_qmp.c:287:qmp_handle_error_response: receive an error message from QMP server: Duplicate ID 'pci-pt-03_10.1' for device. If using the 'address_space_memory' as the parameter of 'memory_listener_register', 'xen_pt_region_del' will not be called if the memory region's name is not 'xen-pci-pt-*' when the devices is detached. This will cause the device's related QemuOpts object not be released properly. Using the device's address space can avoid such issue, because the calling count of 'xen_pt_region_add' when attaching and the calling count of 'xen_pt_region_del' when detaching is the same, so all the memory region ref and unref by the 'xen_pt_region_add' and 'xen_pt_region_del' can be released properly. Signed-off-by: Liang Li <liang.z.li@intel.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Longtao Pang <longtaox.pang@intel.com>
2015-01-12Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Mon 12 Jan 2015 10:27:41 GMT using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: hw/net/xen_nic.c: Set 'netdev->mac' to NULL after free it hw/net/xen_nic.c: Need free 'netdev->nic' in net_free() instead of net_disconnect() hw/net/xen_nic.c: Free 'netdev->txs' when map 'netdev->rxs' fails net: remove all cleanup methods from NIC NetClientInfos Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-12hw/net/xen_nic.c: Set 'netdev->mac' to NULL after free itChen Gang
Since net_init() checks whether 'netdev->mac' is NULL, before alloc it; net_release() also need set 'netdev->mac' to NULL after free it. Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-12hw/net/xen_nic.c: Need free 'netdev->nic' in net_free() instead of ↵Chen Gang
net_disconnect() net_init() and net_free() are pairs, net_connect() and net_disconnect() are pairs. net_init() creates 'netdev->nic', so also need free it in net_free(). Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-12hw/net/xen_nic.c: Free 'netdev->txs' when map 'netdev->rxs' failsChen Gang
When map 'netdev->rxs' fails, need free the original resource, or will cause resource leak. Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-12net: remove all cleanup methods from NIC NetClientInfosPaolo Bonzini
All NICs have a cleanup function that, in most cases, zeroes the pointer to the NICState. In some cases, it frees data belonging to the NIC. However, this function is never called except when exiting from QEMU. It is not necessary to NULL pointers and free data here; the right place to do that would be in the device's unrealize function, after calling qemu_del_nic. Zeroing the NIC multiple times is also wrong for multiqueue devices. This cleanup function gets in the way of making the NetClientStates for the NIC hold an object_ref reference to the object, so get rid of it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-01-12s390: implement pci instructionsFrank Blaschka
This patch implements the s390 pci instructions in qemu. It allows to access and drive pci devices attached to the s390 pci bus. Because of platform constrains devices using IO BARs are not supported. Also a device has to support MSI/MSI-X to run on s390. Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-01-12s390: Add PCI bus supportFrank Blaschka
This patch implements a pci bus for s390x together with infrastructure to generate and handle hotplug events, to configure/unconfigure via sclp instruction, to do iommu translations and provide s390 support for MSI/MSI-X notification processing. Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-01-12s390x/ccw: fix oddity in machine class initCornelia Huck
ccw_machine_class_init() uses ',' instead of ';' while initializing the class' fields. This is almost certainly a copy/paste error and, while legal C, rather on the unusual side. Just use ';' everywhere. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-01-10Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150109.0' ↵Peter Maydell
into staging VFIO fixes: - Fix 32bit overflow in handling large PCI BARs (Alex Williamson) - Fix interrupt shutdown ordering (Alex Williamson) # gpg: Signature made Fri 09 Jan 2015 16:23:42 GMT using RSA key ID 3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" * remotes/awilliam/tags/vfio-update-20150109.0: vfio-pci: Fix interrupt disabling vfio-pci: Fix BAR size overflow Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-10Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc: resizeable ROM blocks This makes ROM blocks resizeable. This infrastructure is required for other functionality we have queued. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 08 Jan 2015 11:19:24 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: acpi-build: make ROMs RAM blocks resizeable memory: API to allocate resizeable RAM MR arch_init: support resizing on incoming migration exec: qemu_ram_alloc_resizeable, qemu_ram_resize exec: split length -> used_length/max_length exec: cpu_physical_memory_set/clear_dirty_range memory: add memory_region_set_size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-10Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' ↵Peter Maydell
into staging Patch queue for ppc - 2015-01-07 New year's release. This time's highlights: - E500: More RAM support - pseries: New SLOF release - Migration fixes - Simplify USB spawning logic, removes support for explicit usb=off - TCG: Simple untansactional TM emulation # gpg: Signature made Wed 07 Jan 2015 15:19:37 GMT using RSA key ID 03FEDC60 # gpg: Good signature from "Alexander Graf <agraf@suse.de>" # gpg: aka "Alexander Graf <alex@csgraf.de>" * remotes/agraf/tags/signed-ppc-for-upstream: (37 commits) hw/ppc/mac_newworld: simplify usb controller creation logic hw/ppc/spapr: simplify usb controller creation logic hw/ppc/mac_newworld: QOMified mac99 machines hw/usb: simplified usb_enabled hw/machine: added machine_usb wrapper hw/ppc: modified the condition for usb controllers to be created for some ppc machines target-ppc: Cast ssize_t to size_t before printing with %zx target-ppc: Mark SR() and gen_sync_exception() as !CONFIG_USER_ONLY PPC: e500: Fix GPIO controller interrupt number target-ppc: Introduce Privileged TM Noops target-ppc: Introduce tcheck target-ppc: Introduce TM Noops target-ppc: Introduce tbegin target-ppc: Introduce TEXASRU Bit Fields target-ppc: Power8 Supports Transactional Memory target-ppc: Introduce tm_enabled Bit to CPU State target-ppc: Introduce Feature Flag for Transactional Memory target-ppc: Introduce Instruction Type for Transactional Memory pseries: Update SLOF firmware image to 20141202 PPC: Fix crash on spapr_tce_table_finalize() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-099pfs: changed to use event_notifier instead of qemu_pipeSeokYeon Hwang
Changed to use event_notifier instead of qemu_pipe. It is necessary for porting 9pfs to Windows and MacOS. Signed-off-by: SeokYeon Hwang <syeon.hwang@samsung.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-09Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/rng-for-2.3' into ↵Peter Maydell
staging Fixes an init-time check for parameter validity # gpg: Signature made Mon 05 Jan 2015 08:34:05 GMT using RSA key ID 854083B6 # gpg: Good signature from "Amit Shah <amit@amitshah.net>" # gpg: aka "Amit Shah <amit@kernel.org>" # gpg: aka "Amit Shah <amitshah@gmx.net>" * remotes/amit-virtio-rng/tags/rng-for-2.3: virtio-rng: fix check for period_ms validity Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-09Merge remote-tracking branch 'remotes/amit/tags/for-2.3' into stagingPeter Maydell
Migration fix for virtio-serial devices on bi-endian targets by David Gibson. # gpg: Signature made Mon 05 Jan 2015 07:26:07 GMT using RSA key ID 854083B6 # gpg: Good signature from "Amit Shah <amit@amitshah.net>" # gpg: aka "Amit Shah <amit@kernel.org>" # gpg: aka "Amit Shah <amitshah@gmx.net>" * remotes/amit/tags/for-2.3: virtio-serial: Don't keep a persistent copy of config space virtio_serial: Don't use vser->config.max_nr_ports internally Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-09Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
More migration fixes and more record/replay preparations. Also moves the sdhci-pci device id to make space for the rocker device. # gpg: Signature made Sat 03 Jan 2015 08:22:36 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: pci: move REDHAT_SDHCI device ID to make room for Rocker block/iscsi: fix uninitialized variable pckbd: set bits 2-3-6-7 of the output port by default serial: refine serial_thr_ipending_needed gen-icount: check cflags instead of use_icount global translate: check cflags instead of use_icount global cpu-exec: add a new CF_USE_ICOUNT cflag target-ppc: pass DisasContext to SPR generator functions atomic: fix position of volatile qualifier Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-09vfio-pci: Fix interrupt disablingAlex Williamson
When disabling MSI/X interrupts the disable functions will leave the device in INTx mode (when available). This matches how hardware operates, INTx is enabled unless MSI/X is enabled (DisINTx is handled separately). Therefore when we really want to disable all interrupts, such as when removing the device, and we start with the device in MSI/X mode, we need to pass through INTx on our way to being completely quiesced. In well behaved situations, the guest driver will have shutdown the device and it will start vfio_exitfn() in INTx mode, producing the desired result. If hot-unplug causes the guest to crash, we may get the device in MSI/X state, which will leave QEMU with a bogus handler installed. Fix this by re-ordering our disable routine so that it should always finish in VFIO_INT_NONE state, which is what all callers expect. Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2015-01-09vfio-pci: Fix BAR size overflowAlex Williamson
We use an unsigned int when working with the PCI BAR size, which can obviously overflow if the BAR is 4GB or larger. This needs to change to a fixed length uint64_t. A similar issue is possible, though even more unlikely, when mapping the region above an MSI-X table. The start of the MSI-X vector table must be below 4GB, but the end, and therefore the start of the next mapping region, could still land at 4GB. Suggested-by: Nishank Trivedi <nishank.trivedi@netapp.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Don Slutz <dslutz@verizon.com> Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2015-01-09Merge remote-tracking branch 'remotes/mwalle/tags/lm32-fixes/20141229' into ↵Peter Maydell
staging lm32: milkymist fixes and MAINTAINER update # gpg: Signature made Tue 30 Dec 2014 16:54:15 GMT using DSA key ID 3F98A378 # gpg: Can't check signature: public key not found * remotes/mwalle/tags/lm32-fixes/20141229: MAINTAINERS: add myself to lm32 and milkymist milkymist: softmmu: fix event handling Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-08hw/ppc/mac_newworld: simplify usb controller creation logicMarcel Apfelbaum
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-id: 1420550957-22337-7-git-send-email-marcel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-08hw/ppc/spapr: simplify usb controller creation logicMarcel Apfelbaum
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-id: 1420550957-22337-6-git-send-email-marcel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-08hw/ppc/mac_newworld: QOMified mac99 machinesMarcel Apfelbaum
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-id: 1420550957-22337-5-git-send-email-marcel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-08hw/usb: simplified usb_enabledMarcel Apfelbaum
The argument is not longer used and the implementation uses now QOM instead of QemuOpts. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-id: 1420550957-22337-4-git-send-email-marcel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-08hw/machine: added machine_usb wrapperMarcel Apfelbaum
Following QOM convention, object properties should not be accessed directly. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-id: 1420550957-22337-3-git-send-email-marcel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-08hw/ppc: modified the condition for usb controllers to be created for some ↵Marcel Apfelbaum
ppc machines Some ppc machines create a default usb controller based on a 'machine condition'. Until now the logic was: create the usb controller if: - the usb option was supplied in cli and value is true or - the usb option was absent and both set_defaults and the machine condition were true. Modified the logic to: Create the usb controller if: - the machine condition is true and defaults are enabled or - the usb option is supplied and true. The main for this is to simplify the usb_enabled method. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-id: 1420550957-22337-2-git-send-email-marcel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-08acpi-build: make ROMs RAM blocks resizeableMichael S. Tsirkin
Use resizeable ram API so we can painlessly extend ROMs in the future. Note: migration is not affected, as we are not actually changing the used length for RAM, which is the part that's migrated. Use this in acpi: reserve x16 more RAM space. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-07hw/ppc/mac_newworld: simplify usb controller creation logicMarcel Apfelbaum
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07hw/ppc/spapr: simplify usb controller creation logicMarcel Apfelbaum
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07hw/ppc/mac_newworld: QOMified mac99 machinesMarcel Apfelbaum
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07hw/usb: simplified usb_enabledMarcel Apfelbaum
The argument is not longer used and the implementation uses now QOM instead of QemuOpts. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07hw/machine: added machine_usb wrapperMarcel Apfelbaum
Following QOM convention, object properties should not be accessed directly. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07hw/ppc: modified the condition for usb controllers to be created for some ↵Marcel Apfelbaum
ppc machines Some ppc machines create a default usb controller based on a 'machine condition'. Until now the logic was: create the usb controller if: - the usb option was supplied in cli and value is true or - the usb option was absent and both set_defaults and the machine condition were true. Modified the logic to: Create the usb controller if: - the machine condition is true and defaults are enabled or - the usb option is supplied and true. The main for this is to simplify the usb_enabled method. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07target-ppc: Cast ssize_t to size_t before printing with %zxPeter Maydell
The mingw32 compiler complains about trying to print variables of type ssize_t with the %z format string specifier. Since we're printing it as unsigned hex anyway, cast to size_t to silence the warning. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07PPC: e500: Fix GPIO controller interrupt numberAmit Tomar
The GPIO controller lives at IRQ 47, not 43 on real hardware. This is a problem because IRQ 43 is occupied by the I2C controller which we want to implement next, so we'd have a conflict on that IRQ number. Move the GPIO controller to IRQ 47 where it belongs. Signed-off-by: Amit Singh Tomar <amit.tomar@freescale.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07PPC: Fix crash on spapr_tce_table_finalize()David Gibson
spapr_tce_table_finalize() can SEGV if the object was not previously realized. In particular this can be triggered by running qemu-system-ppc -device spapr-tce-table,? The basic problem is that we have mismatched initialization versus finalization: spapr_tce_table_finalize() is attempting to undo things that are done in spapr_tce_table_realize(), not an instance_init function. Therefore, replace spapr_tce_table_finalize() with spapr_tce_table_unrealize(). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Cc: qemu-stable@nongnu.org Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07ppc: do not use get_clock_realtime()Paolo Bonzini
Use the external qemu-timer API instead. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07spapr: Fix stale HTAB during live migration (TCG)Samuel Mendoza-Jonas
If a TCG guest reboots during a running migration HTAB entries are not marked dirty, and the destination boots with an invalid HTAB. When a reboot occurs, explicitly mark the current HTAB dirty after clearing it. Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07spapr: Fix integer overflow during migration (TCG)Samuel Mendoza-Jonas
The n_valid and n_invalid fields are unsigned short integers but it is possible to have more than 65535 entries in a contiguous hunk, overflowing the field. This results in an incorrect HTAB being sent to the destination during migration. Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07spapr: Fix stale HTAB during live migration (KVM)Samuel Mendoza-Jonas
If a guest reboots during a running migration, changes to the hash page table are not necessarily updated on the destination. Opening a new file descriptor to the HTAB forces the migration handler to resend the entire table. Signed-off-by: Samuel Mendoza-Jonas <sam.mj@au1.ibm.com> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07PPC: e500 pci host: Add support for ATMUsAlexander Graf
The e500 PCI controller has configurable windows that allow a guest OS to selectively map parts of the PCI bus space to CPU address space and to selectively map parts of the CPU address space for DMA requests into PCI visible address ranges. So far, we've simply assumed that this mapping is 1:1 and ignored it. However, the PCICSRBAR (CCSR mapped in PCI bus space) always has to live inside the first 32bits of address space. This means if we always treat all mappings as 1:1, this map will collide with our RAM map from the CPU's point of view. So this patch adds proper ATMU support which allows us to keep the PCICSRBAR below 32bits local to the PCI bus and have another, different window to PCI BARs at the upper end of address space. We leverage this on e500plat though, mpc8544ds stays virtually 1:1 like it was before, but now also goes via ATMU. With this patch, I can run guests with lots of RAM and not coincidently access MSI-X mappings while I really want to access RAM. Signed-off-by: Alexander Graf <agraf@suse.de>
2015-01-07PPC: mpc8554ds: Tell user about exceeding RAM limitsAlexander Graf
The mpc8544ds board only supports up to 3GB of RAM due to its limited address space. When the user requests more, abort and tell him that he should use less. Signed-off-by: Alexander Graf <agraf@suse.de>