aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2017-01-31qxl: switch to constants within BUILD_BUG_ONMichael S. Tsirkin
We are switching BUILD_BUG_ON to verify that it's parameter is a compile-time constant, and it turns out that some gcc versions (specifically gcc (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 20160609) are not smart enough to figure it out for expressions involving local variables. This is harmless but means that the check is ineffective for these platforms. To fix, replace variables with macros. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-01-31ps2: add support for mice with extra/side buttonsFabian Lesniak
This enables the ps2 controller to process mouse events for buttons 4 and 5. Additionally, distinct definitions for the ps2 mouse button state are introduced. The legacy definitions from console.h are not used anymore. Signed-off-by: Fabian Lesniak <fabian@lesniak-it.de> Message-id: 20161206190007.7539-3-fabian@lesniak-it.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-31ppc: switch to constants within BUILD_BUG_ONMichael S. Tsirkin
We are switching BUILD_BUG_ON to verify that it's parameter is a compile-time constant, and it turns out that some gcc versions (specifically gcc (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 20160609) are not smart enough to figure it out for expressions involving local variables. This is harmless but means that the check is ineffective for these platforms. To fix, replace the variable with macros. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> [dwg: Correct a printf format warning] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31spapr: clock should count only if vm is runningLaurent Vivier
This is a port to ppc of the i386 commit: 00f4d64 kvmclock: clock should count only if vm is running We remove timebase_post_load function, and use the VM state change handler to save and restore the guest_timebase (on stop and continue). We keep timebase_pre_save to reduce the clock difference on migration like in: 6053a86 kvmclock: reduce kvmclock difference on migration Time base offset has originally been introduced by commit 98a8b52 spapr: Add support for time base offset migration So while VM is paused, the time is stopped. This allows to have the same result with date (based on Time Base Register) and hwclock (based on "get-time-of-day" RTAS call). Moreover in TCG mode, the Time Base is always paused, so this patch also adjust the behavior between TCG and KVM. VM state field "time_of_the_day_ns" is now useless but we keep it to be able to migrate to older version of the machine. As vmstate_ppc_timebase structure (with timebase_pre_save() and timebase_post_load() functions) was only used by vmstate_spapr, we register the VM state change handler only in ppc_spapr_init(). Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31ppc: Remove unused function cpu_ppc601_rtc_init()Thomas Huth
It is completely unused, thus it can be removed without problems. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31ppc: Prevent inifnite loop in decrementer auto-reload.Roman Kapl
If the DECAR register is set to 0, QEMU tries to reload the decrementer with zero in an inifinite loop. According to PPC documentation, the decrementer is triggered on 1->0 transition, so avoid reloading the decrementer if if is already zero. The problem does not manifest under Linux, but it is valid to set DECAR to zero (and may make sense as part of decrementer initialization when interrupts are disabled). Signed-off-by: Roman Kapl <rka@sysgo.com> [dwg: Fixed style nit] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31ppc: Add ppc_set_compat_all()David Gibson
Once a compatiblity mode is negotiated with the guest, h_client_architecture_support() uses run_on_cpu() to update each CPU to the new mode. We're going to want this logic somewhere else shortly, so make a helper function to do this global update. We put it in target-ppc/compat.c - it makes as much sense at the CPU level as it does at the machine level. We also move the cpu_synchronize_state() into ppc_set_compat(), since it doesn't really make any sense to call that without synchronizing state. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31pseries: Rewrite CAS PVR compatibility logicDavid Gibson
During boot, PAPR guests negotiate CPU model support with the ibm,client-architecture-support mechanism. The logic to implement this in qemu is very convoluted. This cleans it up to be cleaner, using the new ppc_check_compat() call. The new logic for choosing a compatibility mode is: 1. Usually, use the most recent compatibility mode that is a) supported by the guest b) supported by the CPU and c) no later than the maximum allowed (if specified) 2. If no suitable compatibility mode was found, the guest *does* support this CPU explicitly, and no maximum compatibility mode is specified, then use "raw" mode for the current CPU 3. Otherwise, fail the boot. This differs from the results of the old code: the old code preferred using "raw" mode to a compatibility mode, whereas the new code prefers a compatibility mode if available. Using compatibility mode preferentially means that we're more likely to be able to migrate the guest to a similar but not identical host. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31pxb: Restrict to x86David Gibson
The PCI Expander Bridge (PXB) device is essentially a hack to allow different PCIe devices to be assigned to different NUMA nodes on x86. Each PXB is sort-of a separate PCI host bridge, except that its config space is shared with the config space of the main PCI host bridge, rather than being independent. This is only necessary if the platform doesn't (easily) allow truly independent PCI host bridges. AFAIK that's just x86. This patch makes it possible to configure PXB out of the build, and adjusts the default configs so it's only included on x86 targets. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-31prep: add IBM RS/6000 7020 (40p) machine emulationHervé Poussineau
Machine supports both Open Hack'Ware and OpenBIOS. Open Hack'Ware is the default because OpenBIOS is currently unable to boot PReP boot partitions or PReP kernels. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> [dwg: Correct compile failure with KVM located by Thomas Huth] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31prep: add IBM RS/6000 7020 (40p) memory controllerHervé Poussineau
Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [dwg: Added CONFIG_RS6000_MC to ppc64 or it breaks testcases] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31prep: add PReP System I/OHervé Poussineau
This device is a partial duplicate of System I/O device available in hw/ppc/prep.c This new one doesn't have all the Motorola-specific registers. The old one should be deprecated and removed with the 'prep' machine. Partial documentation available at ftp://ftp.software.ibm.com/rs6000/technology/spec/srp1_1.exe section 6.1.5 (I/O Device Mapping) Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31hw/ppc: QOM'ify spapr_vio.cxiaoqiang zhao
Drop the old and empty SysBus init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31hw/ppc: QOM'ify ppce500_spin.cxiaoqiang zhao
Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31hw/ppc: QOM'ify e500.cxiaoqiang zhao
Drop the old SysBus init function and use instance_init Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31hw/gpio: QOM'ify mpc8xxx.cxiaoqiang zhao
* Drop the old SysBus init function and use instance_init * Change mpc8xxx_gpio_reset to a DeviceClass::reset function Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31ppc: Rewrite ppc_get_compat_smt_threads()David Gibson
To continue consolidation of compatibility mode information, this rewrites the ppc_get_compat_smt_threads() function using the table of compatiblity modes in target-ppc/compat.c. It's not a direct replacement, the new ppc_compat_max_threads() function has simpler semantics - it just returns the number of threads the cpu model has, taking into account any compatiblity mode it is in. This no longer takes into account kvmppc_smt_threads() as the previous version did. That check wasn't useful because we check in ppc_cpu_realizefn() that CPUs aren't instantiated with more threads than kvm allows (or if we didn't things will already be broken and this won't make it any worse). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2017-01-31pseries: Add pseries-2.9 machine typeDavid Gibson
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com>
2017-01-31prep: do not use global variable to access nvramHervé Poussineau
Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31hw/ppc/spapr: Fix boot path of usb-host storage devicesThomas Huth
When passing through an USB storage device to a pseries guest, it is currently not possible to automatically boot from the device if the "bootindex" property has been specified, too (e.g. when using "-device nec-usb-xhci -device usb-host,hostbus=1,hostaddr=2,bootindex=0" at the command line). The problem is that QEMU builds a device tree path like "/pci@800000020000000/usb@0/usb-host@1" and passes it to SLOF in the /chosen/qemu,boot-list property. SLOF, however, probes the USB device, recognizes that it is a storage device and thus changes its name to "storage", and additionally adds a child node for the SCSI LUN, so the correct boot path in SLOF is something like "/pci@800000020000000/usb@0/storage@1/disk@101000000000000" instead. So when we detect an USB mass storage device with SCSI interface, we've got to adjust the firmware boot-device path properly that SLOF can automatically boot from the device. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1354177 Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31ppc/spapr: implement H_SIGNAL_SYS_RESETNicholas Piggin
The H_SIGNAL_SYS_RESET hcall allows a guest CPU to raise a system reset exception on CPUs within the same guest -- all CPUs, all-but-self, or a specific CPU (including self). This has not made its way to a PAPR release yet, but we have an hcall number assigned. H_SIGNAL_SYS_RESET = 0x380 Syntax: hcall(uint64 H_SIGNAL_SYS_RESET, int64 target); Generate a system reset NMI on the threads indicated by target. Values for target: -1 = target all online threads including the caller -2 = target all online threads except for the caller All other negative values: reserved Positive values: The thread to be targeted, obtained from the value of the "ibm,ppc-interrupt-server#s" property of the CPU in the OF device tree. Semantics: - Invalid target: return H_Parameter. - Otherwise: Generate a system reset NMI on target thread(s), return H_Success. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-31ppc: Rename cpu_version to compat_pvrDavid Gibson
The 'cpu_version' field in PowerPCCPU is badly named. It's named after the 'cpu-version' device tree property where it is advertised, but that meaning may not be obvious in most places it appears. Worse, it doesn't even really correspond to that device tree property. The property contains either the processor's PVR, or, if the CPU is running in a compatibility mode, a special "logical PVR" representing which mode. Rename the cpu_version field, and a number of related variables to compat_pvr to make this clearer. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Thomas Huth <thuth@redhat.com>
2017-01-31ppc: Clean up and QOMify hypercall emulationDavid Gibson
The pseries machine type is a bit unusual in that it runs a paravirtualized guest. The guest expects to interact with a hypervisor, and qemu emulates the functions of that hypervisor directly, rather than executing hypervisor code within the emulated system. To implement this in TCG, we need to intercept hypercall instructions and direct them to the machine's hypercall handlers, rather than attempting to perform a privilege change within TCG. This is controlled by a global hook - cpu_ppc_hypercall. This cleanup makes the handling a little cleaner and more extensible than a single global variable. Instead, each CPU to have hypercalls intercepted has a pointer set to a QOM object implementing a new virtual hypervisor interface. A method in that interface is called by TCG when it sees a hypercall instruction. It's possible we may want to add other methods in future. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2017-01-31pseries: Make cpu_update during CAS unconditionalDavid Gibson
spapr_h_cas_compose_response() includes a cpu_update parameter which controls whether it includes updated information on the CPUs in the device tree fragment returned from the ibm,client-architecture-support (CAS) call. Providing the updated information is essential when CAS has negotiated compatibility options which require different cpu information to be presented to the guest. However, it should be safe to provide in other cases (it will just override the existing data in the device tree with identical data). This simplifies the code by removing the parameter and always providing the cpu update information. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2017-01-31pseries: Always use core objects for CPU constructionDavid Gibson
Currently the pseries machine has two paths for constructing CPUs. On newer machine type versions, which support cpu hotplug, it constructs cpu core objects, which in turn construct CPU threads. For older machine versions it individually constructs the CPU threads. This division is going to make some future changes to the cpu construction harder, so this patch unifies them. Now cpu core objects are always created. This requires some updates to allow core objects to be created without a full complement of threads (since older versions allowed a number of cpus not a multiple of the threads-per-core). Likewise it needs some changes to the cpu core hot/cold plug path so as not to choke on the old machine types without hotplug support. For good measure, we move the cpu construction to its own subfunction, spapr_init_cpus(). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org>
2017-01-30Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* SCSI max_transfer support for scsi-generic (Eric) * x86 SMI broadcast (Laszlo) * Character device QOMification (Marc-André) * Record/replay improvements (Pavel) * iscsi fixes (Peter L.) * "info mtree -f" command (Peter Xu) * TSC clock rate reporting (Phil) * DEVICE_CATEGORY_CPU (Thomas) * Memory sign-extension fix (Ladi) # gpg: Signature made Fri 27 Jan 2017 17:08:51 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (41 commits) memory: don't sign-extend 32-bit writes chardev: qom-ify vc: use a common prefix for chr callbacks baum: use a common prefix for chr callbacks gtk: overwrite the console.c char driver char: use error_report() spice-char: improve error reporting char: rename TCPChardev and NetChardev char: rename CharDriverState Chardev bt: use qemu_chr_alloc() char: allocate CharDriverState as a single object char: use a feature bit for replay char: introduce generic qemu_chr_get_kind() char: fold single-user functions in caller char: move callbacks in CharDriver char: use a static array for backends char: use a const CharDriver doc: fix spelling char: add qemu_chr_fe_add_watch() Returns description qemu-options: stdio is available on win32 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27xen-platform: add missing disk unplug optionPaul Durrant
The Xen HVM unplug protocol [1] specifies a mechanism to allow guests to request unplug of 'aux' disks (which is stated to mean all IDE disks, except the primary master). This patch adds support for that unplug request. NOTE: The semantics of what happens if unplug of all disks and 'aux' disks is simultaneously requests is not clear. The patch makes that assumption that an 'all' request overrides an 'aux' request. [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=docs/misc/hvm-emulated-unplug.markdown Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> ---- Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: John Snow <jsnow@redhat.com>
2017-01-27xen-platform: add support for unplugging NVMe disks...Paul Durrant
...not just IDE and SCSI. This patch allows the Xen tool-stack to fully support of NVMe as an emulated disk type. See [1] for the relevant tool-stack patch discussion. [1] https://lists.xen.org/archives/html/xen-devel/2017-01/msg01225.html Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-01-27xen-platform: re-structure unplug_disksPaul Durrant
The current code is poorly structured and potentially leads to multiple config space reads when one is sufficient. Also the UNPLUG_ALL_IDE_DISKS flag is mis-named since it also results in SCSI disks being unplugged. This patch renames the flag and re-structures the code to be more efficient, and readable. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-01-27chardev: qom-ifyMarc-André Lureau
Turn Chardev into Object. qemu_chr_alloc() is replaced by the qemu_chardev_new() constructor. It will call qemu_char_open() to open/intialize the chardev with the ChardevCommon *backend settings. The CharDriver::create() callback is turned into a ChardevClass::open() which is called from the newly introduced qemu_chardev_open(). "chardev-gdb" and "chardev-hci" are internal chardev and aren't creatable directly with -chardev. Use a new internal flag to disable them. We may want to use TYPE_USER_CREATABLE interface instead, or perhaps allow -chardev usage. Although in general we keep typename and macros private, unless the type is being used by some other file, in this patch, all types and common helper macros for qemu-char.c are in char.h. This is to help transition now (some types must be declared early, while some aren't shared) and when splitting in several units. This is to be improved later. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27char: rename CharDriverState ChardevMarc-André Lureau
Pick a uniform chardev type name. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27bt: use qemu_chr_alloc()Marc-André Lureau
Use common allocator for CharDriverState. Rename the now untouched parent field. The casts added are temporary, they are replaced with QOM type-safe macros in a later patch in this series. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27char: allocate CharDriverState as a single objectMarc-André Lureau
Use a single allocation for CharDriverState, this avoids extra allocations & pointers, and is a step towards more object-oriented CharDriver. Gtk console is a bit peculiar, gd_vc_chr_set_echo() used to have a temporary VirtualConsole to save the echo bit. Instead now, we consider whether vcd->console is set or not, and restore the echo bit saved in VCDriverState when calling gd_vc_vte_init(). The casts added are temporary, they are replaced with QOM type-safe macros in a later patch in this series. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27char: move callbacks in CharDriverMarc-André Lureau
This makes the code more declarative, and avoids duplicating the information on all instances. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27hw/scsi: Fix debug message of cdb structure in scsi-genericEric Farman
When running with debug enabled, the scsi-generic cdb that is dumped skips byte 0 of the command, which is the opcode. This makes identifying which command is being issued/completed a little difficult. Example: 0x00 0x00 0x01 0x00 0x00 scsi-generic: scsi_read_data 0x0 scsi-generic: Data ready tag=0x0 len=164 scsi-generic: scsi_read_data 0x0 scsi-generic: Command complete 0x0x10a42c60 tag=0x0 status=0 Improve this by adding a message prior to the loop, similar to what exists for scsi-disk. Clean up a few other messages to be more explicit of what is being represented. Example: scsi-generic: Command: data=0x12 0x00 0x00 0x01 0x00 0x00 scsi-generic: scsi_read_data tag=0x0 scsi-generic: Data ready tag=0x0 len=164 scsi-generic: scsi_read_data tag=0x0 scsi-generic: Command complete 0x0x10a452d0 tag=0x0 status=0 Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Message-Id: <20170120162527.66075-2-farman@linux.vnet.ibm.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27Introduce DEVICE_CATEGORY_CPU for CPU devicesThomas Huth
Now that CPUs show up in the help text of "-device ?", we should group them into an appropriate category. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1484917276-7107-1-git-send-email-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27hw/isa/lpc_ich9: negotiate SMI broadcast on pc-q35-2.9+ machine typesLaszlo Ersek
Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20170126014416.11211-4-lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27hw/isa/lpc_ich9: add broadcast SMI featureLaszlo Ersek
The generic edk2 SMM infrastructure prefers EFI_SMM_CONTROL2_PROTOCOL.Trigger() to inject an SMI on each processor. If Trigger() only brings the current processor into SMM, then edk2 handles it in the following ways: (1) If Trigger() is executed by the BSP (which is guaranteed before ExitBootServices(), but is not necessarily true at runtime), then: (a) If edk2 has been configured for "traditional" SMM synchronization, then the BSP sends directed SMIs to the APs with APIC delivery, bringing them into SMM individually. Then the BSP runs the SMI handler / dispatcher. (b) If edk2 has been configured for "relaxed" SMM synchronization, then the APs that are not already in SMM are not brought in, and the BSP runs the SMI handler / dispatcher. (2) If Trigger() is executed by an AP (which is possible after ExitBootServices(), and can be forced e.g. by "taskset -c 1 efibootmgr"), then the AP in question brings in the BSP with a directed SMI, and the BSP runs the SMI handler / dispatcher. The smaller problem with (1a) and (2) is that the BSP and AP synchronization is slow. For example, the "taskset -c 1 efibootmgr" command from (2) can take more than 3 seconds to complete, because efibootmgr accesses non-volatile UEFI variables intensively. The larger problem is that QEMU's current behavior diverges from the behavior usually seen on physical hardware, and that keeps exposing obscure corner cases, race conditions and other instabilities in edk2, which generally expects / prefers a software SMI to affect all CPUs at once. Therefore introduce the "broadcast SMI" feature that causes QEMU to inject the SMI on all VCPUs. While the original posting of this patch <http://lists.nongnu.org/archive/html/qemu-devel/2015-10/msg05658.html> only intended to speed up (2), based on our recent "stress testing" of SMM this patch actually provides functional improvements. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20170126014416.11211-3-lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27hw/isa/lpc_ich9: add SMI feature negotiation via fw_cfgLaszlo Ersek
Introduce the following fw_cfg files: - "etc/smi/supported-features": a little endian uint64_t feature bitmap, presenting the features known by the host to the guest. Read-only for the guest. The content of this file will be determined via bit-granularity ICH9-LPC device properties, to be introduced later. For now, the bitmask is left zeroed. The bits will be set from machine type compat properties and on the QEMU command line, hence this file is not migrated. - "etc/smi/requested-features": a little endian uint64_t feature bitmap, representing the features the guest would like to request. Read-write for the guest. The guest can freely (re)write this file, it has no direct consequence. Initial value is zero. A nonzero value causes the SMI-related fw_cfg files and fields that are under guest influence to be migrated. - "etc/smi/features-ok": contains a uint8_t value, and it is read-only for the guest. When the guest selects the associated fw_cfg key, the guest features are validated against the host features. In case of error, the negotiation doesn't proceed, and the "features-ok" file remains zero. In case of success, the "features-ok" file becomes (uint8_t)1, and the negotiated features are locked down internally (to which no further changes are possible until reset). The initial value is zero. A nonzero value causes the SMI-related fw_cfg files and fields that are under guest influence to be migrated. The C-language fields backing the "supported-features" and "requested-features" files are uint8_t arrays. This is because they carry guest-side representation (our choice is little endian), while VMSTATE_UINT64() assumes / implies host-side endianness for any uint64_t fields. If we migrate a guest between hosts with different endiannesses (which is possible with TCG), then the host-side value is preserved, and the host-side representation is translated. This would be visible to the guest through fw_cfg, unless we used plain byte arrays. So we do. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20170126014416.11211-2-lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27apic: save apic_delivered flagPavel Dovgalyuk
This patch implements saving/restoring of static apic_delivered variable. v8: saving static variable only for one of the APICs Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20170126123429.5412.94368.stgit@PASHA-ISP> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27replay: don't use rtc clock on loadvm phasePavel Dovgalyuk
This patch disables the update of the periodic timer of mc146818rtc in record/replay mode. State of this timer is saved and therefore does not need to be updated in record/replay mode. Read of RTC breaks the replay because all rtc reads have to be the same as in record mode. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20170124071730.4572.41874.stgit@PASHA-ISP> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27icount: update instruction counter on apic patchingPavel Dovgalyuk
kvmvapic patches the code when some instructions are executed. E.g. mov 0xff, 0xfffe0080 is interpreted as push 0xff/call ... This patching is also followed by some side effects (changing apic and guest memory state). Therefore deterministic execution should take this operation into account. This patch decreases icount when original mov instruction is trying to execute. Therefore patching becomes deterministic and can be replayed correctly. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20170124071702.4572.17294.stgit@PASHA-ISP> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-27dma: omap: check dma channel data_typePrasad J Pandit
When setting dma channel 'data_type', if (value & 3) == 3, the set 'data_type' is said to be bad. This also leads to an OOB access in 'omap_dma_transfer_generic', while doing cpu_physical_memory_r/w operations. Add check to avoid it. Reported-by: Jiang Xin <jiangxin1@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170127120528.30959-1-ppandit@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27arm_gicv3: Fix broken logic in ELRSR calculationPeter Maydell
Fix a broken expression in the calculation of ELRSR register bits: instead of "(lr & ICH_LR_EL2_HW) == 1" we want to check for != 0, because the HW bit is not bit 0 so a test for == 1 is always false. Fixes: https://bugs.launchpad.net/bugs/1658506 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 1485255993-6322-1-git-send-email-peter.maydell@linaro.org
2017-01-27hw/char/exynos4210_uart: Drop unused local variable frame_sizePeter Maydell
The frame_size local variable in exynos4210_uart_update_parameters() is calculated but never used (and has been this way since the device was introduced in commit e5a4914efc7). The qemu_chr_fe_ioctl() doesn't need this information (if it really wanted it it could calculate it from the parity/data_bits/stop_bits), so just drop the variable entirely. Fixes: https://bugs.launchpad.net/bugs/1655702 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1484589515-26353-1-git-send-email-peter.maydell@linaro.org
2017-01-27arm: stellaris: make MII accesses complete immediatelyMichael Davidsaver
When the guest attempts to start an MII register access via the MCTL register, clear the START bit, so that when the guest reads it back the register transaction will be signalled as having completed. This avoids the guest spinning as it polls the START bit waiting for it to clear (which it previously never would). The MII registers themselves still aren't implemented, but at least we can avoid guests spending quite so much time busy waiting. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1484938222-1423-1-git-send-email-peter.maydell@linaro.org [PMM: expand commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: Honour CCR.USERSETMPENDMichael Davidsaver
The CCR.USERSETMPEND bit has to be set to permit unprivileged code to write to the Software Triggered Interrupt register; honour this bit rather than letting any code write to the register. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-9-git-send-email-peter.maydell@linaro.org [PMM: Tweak commit message, comment, phrasing of condition] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: implement CCR, CFSR, HFSR, DFSR, BFAR, and MMFARMichael Davidsaver
Implement the v7M system registers CCR, CFSR, HFSR, DFSR, BFAR and MMFAR. For the moment these simply read as written (with some basic handling of RAZ/WI bits and W1C semantics). Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-5-git-send-email-peter.maydell@linaro.org [PMM: drop warning about setting unimplemented CCR bits; tweak commit message; add DFSR] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m_nvic: keep a pointer to the CPUMichael Davidsaver
Many NVIC operations access the CPU state, so store a pointer in struct nvic_state rather than fetching it via qemu_get_cpu() every time we need it. As with the arm_gicv3_common code, we currently just call qemu_get_cpu() in the NVIC's realize method, but in future we might want to use a QOM property to pass the CPU to the NVIC. This imposes an ordering requirement that the CPU is realized before the NVIC, but that is always true since both are dealt with in armv7m_init(). Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-3-git-send-email-peter.maydell@linaro.org [PMM: Use qemu_get_cpu(0) rather than first_cpu; expand commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27pflash_cfi01: fix per-device sector length in CFI tablePeter Maydell
For configurations of the pflash_cfi01 device which set it up with a device-width not equal to the width (ie where we are emulating multiple narrow flash devices wired up in parallel), we were giving incorrect values in the CFI data table: (1) the sector length entry should specify the sector length for a single device, not the length for the overall collection of devices (2) the number of blocks per device must not be divided by the number of devices because the resulting device size would not match the overall size (3) this then means that the overall write block size must be modified depending on the number of devices because the entry is per device and when the guest writes into the flash it calculates the write size by using the CFI entry (write size per device) multiplied by the number of chips. (It would alternatively be possible to modify the write block size in the CFI table (currently hardcoded at 2048) and leave the overall write block size alone.) This commit corrects these bugs, and adds a hw-compat property to retain the old behaviour on 2.8 and earlier versions. (The only board we have which uses this sort of flash config and has machine versioning is the "virt" board -- the PC uses a single flash device and so behaviour is unaffected whether using old-multiple-chip-handling or not.) Here is a configuration example from the vexpress board: VEXPRESS_FLASH_SIZE = 64M VEXPRESS_FLASH_SECT_SIZE 256K num-blocks = VEXPRESS_FLASH_SIZE / VEXPRESS_FLASH_SECT_SIZE = 256 sector-length = 256K width = 4 device-width = 2 The code will fill the CFI entry with the following entries: num-blocks = 256 sector-length = 128K writeblock_size = 2048 This results in two chips, each with 256 * 128K = 32M device size and a write block size of 2048. A sector erase will be sent to both chips, thus 256K must be erased. When the guest sends a block write command, it will write 4096 bytes data at once (2048 per device). Signed-off-by: David Engraf <david.engraf@sysgo.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: cleaned up and expanded commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>