aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2019-10-15target/arm/arm-semi: Implement SH_EXT_STDOUT_STDERR extensionPeter Maydell
SH_EXT_STDOUT_STDERR is a v2.0 semihosting extension: the guest can open ":tt" with a file mode requesting append access in order to open stderr, in addition to the existing "open for read for stdin or write for stdout". Implement this and report it via the :semihosting-features data. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20190916141544.17540-16-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Implement SH_EXT_EXIT_EXTENDED extensionPeter Maydell
SH_EXT_EXIT_EXTENDED is a v2.0 semihosting extension: it indicates that the implementation supports the SYS_EXIT_EXTENDED function. This function allows both A64 and A32/T32 guests to exit with a specified exit status, unlike the older SYS_EXIT function which only allowed this for A64 guests. Implement this extension. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20190916141544.17540-15-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Implement support for semihosting feature detectionPeter Maydell
Version 2.0 of the semihosting specification added support for allowing a guest to detect whether the implementation supported particular features. This works by the guest opening a magic file ":semihosting-features", which contains a fixed set of data with some magic numbers followed by a sequence of bytes with feature flags. The file is expected to behave sensibly for the various semihosting calls which operate on files (SYS_FLEN, SYS_SEEK, etc). Implement this as another kind of guest FD using our function table dispatch mechanism. Initially we report no extended features, so we have just one feature flag byte which is zero. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20190916141544.17540-14-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Factor out implementation of SYS_FLENPeter Maydell
Factor out the implementation of SYS_FLEN via the new function tables. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190916141544.17540-13-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Factor out implementation of SYS_SEEKPeter Maydell
Factor out the implementation of SYS_SEEK via the new function tables. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190916141544.17540-12-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Factor out implementation of SYS_ISTTYPeter Maydell
Factor out the implementation of SYS_ISTTY via the new function tables. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190916141544.17540-11-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Factor out implementation of SYS_READPeter Maydell
Factor out the implementation of SYS_READ via the new function tables. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190916141544.17540-10-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Factor out implementation of SYS_WRITEPeter Maydell
Factor out the implementation of SYS_WRITE via the new function tables. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-9-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Factor out implementation of SYS_CLOSEPeter Maydell
Currently for the semihosting calls which take a file descriptor (SYS_CLOSE, SYS_WRITE, SYS_READ, SYS_ISTTY, SYS_SEEK, SYS_FLEN) we have effectively two implementations, one for real host files and one for when we indirect via the gdbstub. We want to add a third one to deal with the magic :semihosting-features file. Instead of having a three-way if statement in each of these cases, factor out the implementation of the calls to separate functions which we dispatch to via function pointers selected via the GuestFDType for the guest fd. In this commit, we set up the framework for the dispatch, and convert the SYS_CLOSE call to use it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-8-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Use set_swi_errno() in gdbstub callback functionsPeter Maydell
When we are routing semihosting operations through the gdbstub, the work of sorting out the return value and setting errno if necessary is done by callback functions which are invoked by the gdbstub code. Clean up some ifdeffery in those functions by having them call set_swi_errno() to set the semihosting errno. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-7-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Restrict use of TaskState*Peter Maydell
The semihosting code needs accuss to the linux-user only TaskState pointer so it can set the semihosting errno per-thread for linux-user mode. At the moment we do this by having some ifdefs so that we define a 'ts' local in do_arm_semihosting() which is either a real TaskState * or just a CPUARMState *, depending on which mode we're compiling for. This is awkward if we want to refactor do_arm_semihosting() into other functions which might need to be passed the TaskState. Restrict usage of the TaskState local by: * making set_swi_errno() always take the CPUARMState pointer and (for the linux-user version) get TaskState from that * creating a new get_swi_errno() which reads the errno * having the two semihosting calls which need the TaskState for other purposes (SYS_GET_CMDLINE and SYS_HEAPINFO) define a variable with scope restricted to just that code Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-6-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Make semihosting code hand out its own file descriptorsPeter Maydell
Currently the Arm semihosting code returns the guest file descriptors (handles) which are simply the fd values from the host OS or the remote gdbstub. Part of the semihosting 2.0 specification requires that we implement special handling of opening a ":semihosting-features" filename. Guest fds which result from opening the special file won't correspond to host fds, so to ensure that we don't end up with duplicate fds we need to have QEMU code control the allocation of the fd values we give the guest. Add in an abstraction layer which lets us allocate new guest FD values, and translate from a guest FD value back to the host one. This also fixes an odd hole where a semihosting guest could use the semihosting API to read, write or close file descriptors that it had never allocated but which were being used by QEMU itself. (This isn't a security hole, because enabling semihosting permits the guest to do arbitrary file access to the whole host filesystem, and so should only be done if the guest is completely trusted.) Currently the only kind of guest fd is one which maps to a host fd, but in a following commit we will add one which maps to the :semihosting-features magic data. If the guest is migrated with an open semihosting file descriptor then subsequent attempts to use the fd will all fail; this is not a change from the previous situation (where the host fd being used on the source end would not be re-opened on the destination end). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-5-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Correct comment about gdb syscall racesPeter Maydell
In arm_gdb_syscall() we have a comment suggesting a race because the syscall completion callback might not happen before the gdb_do_syscallv() call returns. The comment is correct that the callback may not happen but incorrect about the effects. Correct it and note the important caveat that callers must never do any work of any kind after return from arm_gdb_syscall() that depends on its return value. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-4-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Always set some kind of errno for failed callsPeter Maydell
If we fail a semihosting call we should always set the semihosting errno to something; we were failing to do this for some of the "check inputs for sanity" cases. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-3-peter.maydell@linaro.org
2019-10-15target/arm/arm-semi: Capture errno in softmmu version of set_swi_errno()Peter Maydell
The set_swi_errno() function is called to capture the errno from a host system call, so that we can return -1 from the semihosting function and later allow the guest to get a more specific error code with the SYS_ERRNO function. It comes in two versions, one for user-only and one for softmmu. We forgot to capture the errno in the softmmu version; fix the error. (Semihosting calls directed to gdb are unaffected because they go through a different code path that captures the error return from the gdbstub call in arm_semi_cb() or arm_semi_flen_cb().) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190916141544.17540-2-peter.maydell@linaro.org
2019-10-15ARM: KVM: Check KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 for smp_cpus > 256Eric Auger
Host kernel within [4.18, 5.3] report an erroneous KVM_MAX_VCPUS=512 for ARM. The actual capability to instantiate more than 256 vcpus was fixed in 5.4 with the upgrade of the KVM_IRQ_LINE ABI to support vcpu id encoded on 12 bits instead of 8 and a redistributor consuming a single KVM IO device instead of 2. So let's check this capability when attempting to use more than 256 vcpus within any ARM kvm accelerated machine. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Acked-by: Marc Zyngier <maz@kernel.org> Message-id: 20191003154640.22451-4-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-10-15intc/arm_gic: Support IRQ injection for more than 256 vpusEric Auger
Host kernels that expose the KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 capability allow injection of interrupts along with vcpu ids larger than 255. Let's encode the vpcu id on 12 bits according to the upgraded KVM_IRQ_LINE ABI when needed. Given that we have two callsites that need to assemble the value for kvm_set_irq(), a new helper routine, kvm_arm_set_irq is introduced. Without that patch qemu exits with "kvm_set_irq: Invalid argument" message. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Zenghui Yu <yuzenghui@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Acked-by: Marc Zyngier <maz@kernel.org> Message-id: 20191003154640.22451-3-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-10-10s390x/tcg: MVCL: Exit to main loop if requestedDavid Hildenbrand
MVCL is interruptible and we should check for interrupts and process them after writing back the variables to the registers. Let's check for any exit requests and exit to the main loop. Introduce a new helper function for that: cpu_loop_exit_requested(). When booting Fedora 30, I can see a handful of these exits and it seems to work reliable. Also, Richard explained why this works correctly even when MVCL is called via EXECUTE: (1) TB with EXECUTE runs, at address Ae - env->psw_addr stored with Ae. - helper_ex() runs, memory address Am computed from D2a(X2a,B2a) or from psw.addr+RI2. - env->ex_value stored with memory value modified by R1a (2) TB of executee runs, - env->ex_value stored with 0. - helper_mvcl() runs, using and updating R1b, R1b+1, R2b, R2b+1. (3a) helper_mvcl() completes, - TB of executee continues, psw.addr += ilen. - Next instruction is the one following EXECUTE. (3b) helper_mvcl() exits to main loop, - cpu_loop_exit_restore() unwinds psw.addr = Ae. - Next instruction is the EXECUTE itself... - goto 1. As the PoP mentiones that an interruptible instruction called via EXECUTE should avoid modifying storage/registers that are used by EXECUTE itself, it is fine to retrigger EXECUTE. Cc: Alex Bennée <alex.bennee@linaro.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Paolo Bonzini <pbonzini@redhat.com> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove ILEN_UNWINDRichard Henderson
This setting is no longer used. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-19-richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove ilen argument from trigger_pgm_exceptionRichard Henderson
All but one caller passes ILEN_UNWIND, which is not stored. For the one use case in s390_cpu_tlb_fill, set int_pgm_ilen directly, simply to avoid the assert within do_program_interrupt. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-18-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove ilen argument from trigger_access_exceptionRichard Henderson
The single caller passes ILEN_UNWIND; pass that along to trigger_pgm_exception directly. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-17-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove ILEN_AUTORichard Henderson
This setting is no longer used. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-16-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Rely on unwinding in s390_cpu_virt_mem_rwRichard Henderson
For TCG, we will always call s390_cpu_virt_mem_handle_exc, which will go through the unwinder to set ILEN. For KVM, we do not go through do_program_interrupt, so this argument is unused. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-15-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Rely on unwinding in s390_cpu_tlb_fillRichard Henderson
We currently set ilen to AUTO, then overwrite that during unwinding, then overwrite that for the code access case. This can be simplified to setting ilen to our arbitrary value for the (undefined) code access case, then rely on unwinding to overwrite that with the correct value for the data access case. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-14-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Simplify helper_lraRichard Henderson
We currently call trigger_pgm_exception to set cs->exception_index and env->int_pgm_code and then read the values back and then reset cs->exception_index so that the exception is not delivered. Instead, use the exception type that we already have directly without ever triggering an exception that must be suppressed. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-13-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove fail variable from s390_cpu_tlb_fillRichard Henderson
Now that excp always contains a real exception number, we can use that instead of a separate fail variable. This allows a redundant test to be removed. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-12-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Return exception from translate_pagesRichard Henderson
Do not raise the exception directly within translate_pages, but pass it back so that caller may do so. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-11-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Return exception from mmu_translateRichard Henderson
Do not raise the exception directly within mmu_translate, but pass it back so that caller may do so. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-10-richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove exc argument to mmu_translate_asceRichard Henderson
Now that mmu_translate_asce returns the exception instead of raising it, the argument is unused. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-9-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Return exception from mmu_translate_realRichard Henderson
Do not raise the exception directly within mmu_translate_real, but pass it back so that caller may do so. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-8-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Handle tec in s390_cpu_tlb_fillRichard Henderson
As a step toward moving all excption handling out of mmu_translate, copy handling of the LowCore tec value from trigger_access_exception into s390_cpu_tlb_fill. So far this new plumbing isn't used. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-7-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Push trigger_pgm_exception lower in s390_cpu_tlb_fillRichard Henderson
Delay triggering an exception until the end, after we have determined ultimate success or failure, and also taken into account whether this is a non-faulting probe. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-6-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Use tcg_s390_program_interrupt in TCG helpersRichard Henderson
Replace all uses of s390_program_interrupt within files that are marked CONFIG_TCG. These are necessarily tcg-only. This lets each of these users benefit from the QEMU_NORETURN attribute on tcg_s390_program_interrupt. Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-5-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove ilen parameter from s390_program_interruptRichard Henderson
This is no longer used, and many of the existing uses -- particularly within hw/s390x -- seem questionable. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-4-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Remove ilen parameter from tcg_s390_program_interruptRichard Henderson
Since we begin the operation with an unwind, we have the proper value of ilen immediately available. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20191001171614.8405-3-richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09target/s390x: Add ilen to unwind dataRichard Henderson
Use ILEN_UNWIND to signal that we have in fact that cpu_restore_state will have been called by the time we arrive in do_program_interrupt. Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <20191001171614.8405-2-richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/cpumodel: Add new TCG features to QEMU cpu modelDavid Hildenbrand
We now implement a bunch of new facilities we can properly indicate. ESOP-1/ESOP-2 handling is discussed in the PoP Chafter 3-15 ("Suppression on Protection"). The "Basic suppression-on-protection (SOP) facility" is a core part of z/Architecture without a facility indication. ESOP-2 is indicated by ESOP-1 + Side-effect facility ("ESOP-2"). Besides ESOP-2, the side-effect facility is only relevant for the guarded-storage facility (we don't implement). S390_ESOP: - We indicate DAT exeptions by setting bit 61 of the TEID (TEC) to 1 and bit 60 to zero. We don't trigger ALCP exceptions yet. Also, we set bit 0-51 and bit 62/63 to the right values. S390_ACCESS_EXCEPTION_FS_INDICATION: - The TEID (TEC) properly indicates in bit 52/53 on any access if it was a fetch or a store S390_SIDE_EFFECT_ACCESS_ESOP2: - We have no side-effect accesses (esp., we don't implement the guarded-storage faciliy), we correctly set bit 64 of the TEID (TEC) to 0 (no side-effect). - ESOP2: We properly set bit 56, 60, 61 in the TEID (TEC) to indicate the type of protection. We don't trigger KCP/ALCP exceptions yet. S390_INSTRUCTION_EXEC_PROT: - The MMU properly detects and indicates the exception on instruction fetches - Protected TLB entries will never get PAGE_EXEC set. There is no need to fake the abscence of any of the facilities - without the facilities, some bits of the TEID (TEC) are simply unpredictable. As IEP was added with z14 and we currently implement a z13, add it to the MAX model instead. Acked-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/cpumodel: Prepare for changes of QEMU modelDavid Hildenbrand
Setup the 4.1 compatibility model so we can add new features to the LATEST model. Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Implement Instruction-Execution-Protection FacilityDavid Hildenbrand
IEP support in the mmu is fairly easy. Set the right permissions for TLB entries and properly report an exception. Make sure to handle EDAT-2 by setting bit 56/60/61 of the TEID (TEC) to the right values. Let's keep s390_cpu_get_phys_page_debug() working even if IEP is active. Switch MMU_DATA_LOAD - this has no other effects any more as the ASC to be used is now fully selected outside of mmu_translate(). Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Implement ESOP-2 and access-exception-fetch/store-indication facilityDavid Hildenbrand
We already implement ESOP-1. For ESOP-2, we only have to indicate all protection exceptions properly. Due to EDAT-1, we already indicate DAT exceptions properly. We don't trigger KCP/ALCP/IEP exceptions yet. So all we have to do is set the TEID (TEC) to the right values (bit 56, 60, 61) in case of LAP. We don't have any side-effects (e.g., no guarded-storage facility), therefore, bit 64 of the TEID (TEC) is always 0. We always have to indicate whether it is a fetch or a store for all access exceptions. This is only missing for LAP exceptions. Acked-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Add EDAT2 translation supportDavid Hildenbrand
This only adds basic support to the DAT translation, but no EDAT2 support for TCG. E.g., the gdbstub under kvm uses this function, too, to translate virtual addresses. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Convert to non-recursive page table walkDavid Hildenbrand
A non-recursive implementation allows to make better use of the branch predictor, avoids function calls, and makes the implementation of new features only for a subset of region table levels easier. We can now directly compare our implementation to the KVM gaccess implementation in arch/s390/kvm/gaccess.c:guest_translate(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: DAT table definition overhaulDavid Hildenbrand
Let's use consistent names for the region/section/page table entries and for the macros to extract relevant parts from virtual address. Make them match the definitions in the PoP - e.g., how the relevant bits are actually called. Introduce defines for all bits declared in the PoP. This will come in handy in follow-up patches. Add a note where additional information about s390x and the used definitions can be found. Acked-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Use TARGET_PAGE_MASK in mmu_translate_pte()David Hildenbrand
While ASCE_ORIGIN is not wrong, it is certainly confusing. We want a page frame address. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Inject PGM_ADDRESSING on bogus table addressesDavid Hildenbrand
Let's document how it works and inject PGM_ADDRESSING if reading of table entries fails. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Inject DAT exceptions from a single placeDavid Hildenbrand
Let's return the PGM from the translation functions on error and inject based on that. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Move DAT protection handling out of mmu_translate_asce()David Hildenbrand
We'll reuse the ilen and tec definitions in mmu_translate soon also for all other DAT exceptions we inject. Move it to the caller, where we can later pair it up with other protection checks, like IEP. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-09s390x/mmu: Drop debug logging from MMU codeDavid Hildenbrand
Let's get it out of the way to make some further refactorings easier. Personally, I've never used these debug statements at all. And if I had to debug issues, I used plain GDB instead (debug prints are just way too much noise in the MMU). We might want to introduce tracing at some point instead, so we can able selected events on demand. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-10-07Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-4.2-20191004' ↵Peter Maydell
into staging ppc patch queue 2019-10-04 Here's the next batch of ppc and spapr patches. Includes: * Fist part of a large cleanup to irq infrastructure * Recreate the full FDT at CAS time, instead of making a difficult to follow set of updates. This will help us move towards eliminating CAS reboots altogether * No longer provide RTAS blob to SLOF - SLOF can include it just as well itself, since guests will generally need to relocate it with a call to instantiate-rtas * A number of DFP fixes and cleanups from Mark Cave-Ayland * Assorted bugfixes * Several new small devices for powernv # gpg: Signature made Fri 04 Oct 2019 10:35:57 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-4.2-20191004: (53 commits) ppc/pnv: Remove the XICSFabric Interface from the POWER9 machine spapr: Eliminate SpaprIrq::init hook spapr: Add return value to spapr_irq_check() spapr: Use less cryptic representation of which irq backends are supported xive: Improve irq claim/free path spapr, xics, xive: Better use of assert()s on irq claim/free paths spapr: Handle freeing of multiple irqs in frontend only spapr: Remove unhelpful tracepoints from spapr_irq_free_xics() spapr: Eliminate SpaprIrq:get_nodename method spapr: Simplify spapr_qirq() handling spapr: Fix indexing of XICS irqs spapr: Eliminate nr_irqs parameter to SpaprIrq::init spapr: Clarify and fix handling of nr_irqs spapr: Replace spapr_vio_qirq() helper with spapr_vio_irq_pulse() helper spapr: Fold spapr_phb_lsi_qirq() into its single caller xics: Create sPAPR specific ICS subtype xics: Merge TYPE_ICS_BASE and TYPE_ICS_SIMPLE classes xics: Eliminate reset hook xics: Rename misleading ics_simple_*() functions xics: Eliminate 'reject', 'resend' and 'eoi' class hooks ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-10-04Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* Compilation fix for KVM (Alex) * SMM fix (Dmitry) * VFIO error reporting (Eric) * win32 fixes and workarounds (Marc-André) * qemu-pr-helper crash bugfix (Maxim) * Memory leak fixes (myself) * VMX features (myself) * Record-replay deadlock (Pavel) * i386 CPUID bits (Sebastian) * kconfig tweak (Thomas) * Valgrind fix (Thomas) * Autoconverge test (Yury) # gpg: Signature made Fri 04 Oct 2019 17:57:48 BST # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (29 commits) target/i386/kvm: Silence warning from Valgrind about uninitialized bytes target/i386: work around KVM_GET_MSRS bug for secondary execution controls target/i386: add VMX features vmxcap: correct the name of the variables target/i386: add VMX definitions target/i386: expand feature words to 64 bits target/i386: introduce generic feature dependency mechanism target/i386: handle filtered_features in a new function mark_unavailable_features tests/docker: only enable ubsan for test-clang win32: work around main-loop busy loop on socket/fd event tests: skip serial test on windows util: WSAEWOULDBLOCK on connect should map to EINPROGRESS Fix wrong behavior of cpu_memory_rw_debug() function in SMM memory: allow memory_region_register_iommu_notifier() to fail vfio: Turn the container error into an Error handle i386: Add CPUID bit for CLZERO and XSAVEERPTR docker: test-debug: disable LeakSanitizer lm32: do not leak memory on object_new/object_unref cris: do not leak struct cris_disasm_data mips: fix memory leaks in board initialization ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>