aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2017-05-11virt-arm: add node-id property to CPUIgor Mammedov
it will allow switching from cpu_index to property based numa mapping in follow up patches. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Andrew Jones <drjones@redhat.com> Message-Id: <1494415802-227633-5-git-send-email-imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-05-11pc: add node-id property to CPUIgor Mammedov
it will allow switching from cpu_index to property based numa mapping in follow up patches. PS: patch changes default value of CPUState::numa_node from 0 to CPU_UNSET_NUMA_NODE_ID. The only place for x86 that would affected is monitor's 'infor numa' command which uses that field. However legacy 0 value is still preserved by pc_cpu_pre_plug() in this patch if user/numa.c hasn't set it explicitly, so there is no change in behavior. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1494415802-227633-4-git-send-email-imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-05-11hw/arm/virt: extract mp-affinity calculation in separate functionIgor Mammedov
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1493816238-33120-3-git-send-email-imammedo@redhat.com> Reviewed-by: Andrew Jones <drjones@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-05-11i386: rewrite way CPUID index is validatedDaniel P. Berrange
Change the nested if statements into a flat format, to make it clearer what validation / capping is being performed on different CPUID index values. NB this changes behaviour when "index > env->cpuid_xlevel2". This won't have any guest-visible effect because no there is no CPUID[0xC0000001] feature supported by TCG, and KVM code will never call cpu_x86_cpuid() with such an index value. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <20170509132736.10071-2-berrange@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-05-09Merge remote-tracking branch 'armbru/tags/pull-qapi-2017-05-04-v3' into stagingStefan Hajnoczi
QAPI patches for 2017-05-04 # gpg: Signature made Tue 09 May 2017 03:16:12 AM EDT # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * armbru/tags/pull-qapi-2017-05-04-v3: (28 commits) qmp-shell: improve help qmp-shell: don't show version greeting if unavailable qmp-shell: Cope with query-commands error qmp-shell: add -N option to skip negotiate qmp-shell: add persistent command history qobject-input-visitor: Catch misuse of end_struct vs. end_list qapi: Document intended use of @name within alternate visits qobject-input-visitor: Document full_name_nth() qmp: Improve QMP dispatch error messages sockets: Delete unused helper socket_address_crumple() sockets: Limit SocketAddressLegacy to external interfaces sockets: Rename SocketAddressFlat to SocketAddress sockets: Rename SocketAddress to SocketAddressLegacy qapi: New QAPI_CLONE_MEMBERS() sockets: Prepare inet_parse() for flattened SocketAddress sockets: Prepare vsock_parse() for flattened SocketAddress test-qga: Actually test 0xff sync bytes fdc-test: Avoid deprecated 'change' command QemuOpts: Simplify qemu_opts_to_qdict() block: Simplify bdrv_append_temp_snapshot() logic ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-09qobject: Use simpler QDict/QList scalar insertion macrosEric Blake
We now have macros in place to make it less verbose to add a scalar to QDict and QList, so use them. Patch created mechanically via: spatch --sp-file scripts/coccinelle/qobject.cocci \ --macro-file scripts/cocci-macro-file.h --dir . --in-place then touched up manually to fix a couple of '?:' back to original spacing, as well as avoiding a long line in monitor.c. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20170427215821.19397-7-eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-05-08Merge remote-tracking branch 'bonzini/tags/for-upstream' into stagingStefan Hajnoczi
A large set of small patches. I have not included yet vhost-user-scsi, but it'll come in the next pull request. * use GDB XML register description for x86 * use _Static_assert in QEMU_BUILD_BUG_ON * add "R:" to MAINTAINERS and get_maintainers * checkpatch improvements * dump threading fixes * first part of vhost-user-scsi support * QemuMutex tracing * vmw_pvscsi and megasas fixes * sgabios module update * use Rev3 (ACPI 2.0) FADT * deprecate -hdachs * improve -accel documentation * hax fix * qemu-char GSource bugfix # gpg: Signature made Fri 05 May 2017 06:10:40 AM EDT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * bonzini/tags/for-upstream: (21 commits) vhost-scsi: create a vhost-scsi-common abstraction libvhost-user: replace vasprintf() to fix build get_maintainer: add subsystem to reviewer output get_maintainer: --r (list reviewer) is on by default get_maintainer: it's '--pattern-depth', not '-pattern-depth' get_maintainer: Teach get_maintainer.pl about the new "R:" tag MAINTAINERS: Add "R:" tag for self-appointed reviewers Fix the -accel parameter and the documentation for 'hax' dump: Acquire BQL around vm_start() in dump thread hax: Fix memory mapping de-duplication logic checkpatch: Disallow glib asserts in main code trace: add qemu mutex lock and unlock trace events vmw_pvscsi: check message ring page count at initialisation sgabios: update for "fix wrong video attrs for int 10h,ah==13h" scsi: avoid an off-by-one error in megasas_mmio_write vl: deprecate the "-hdachs" option use _Static_assert in QEMU_BUILD_BUG_ON target/i386: Add GDB XML register description support char: Fix removing wrong GSource that be found by fd_in_tag hw/i386: Build-time assertion on pc/q35 reset register being identical. ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-05Merge remote-tracking branch 'shorne/tags/pull-or-20170504' into stagingStefan Hajnoczi
Openrisc Features and Fixes for qemu 2.10 # gpg: Signature made Thu 04 May 2017 01:41:45 AM BST # gpg: using RSA key 0xC3B31C2D5E6627E4 # gpg: Good signature from "Stafford Horne <shorne@gmail.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: D9C4 7354 AEF8 6C10 3A25 EFF1 C3B3 1C2D 5E66 27E4 * shorne/tags/pull-or-20170504: target/openrisc: Support non-busy idle state using PMR SPR target/openrisc: Remove duplicate features property target/openrisc: Implement full vmstate serialization migration: Add VMSTATE_STRUCT_2DARRAY() target/openrisc: implement shadow registers migration: Add VMSTATE_UINTTL_2DARRAY() target/openrisc: add numcores and coreid support target/openrisc: Fixes for memory debugging target/openrisc: Implement EPH bit target/openrisc: Implement EVBAR register MAINTAINERS: Add myself as openrisc maintainer Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-05hax: Fix memory mapping de-duplication logicYu Ning
hax_update_mapping() avoids unnecessary and potentially expensive calls to HAX_VM_IOCTL_SET_RAM by computing the net result (i.e. effective mapping changes) of each MemoryRegion transaction, with the help of a linked list of HAXMapping objects. However, when processing a new mapping that overlaps with an existing mapping in the list, it fails to handle the case where the start address of the new mapping is above that of the existing mapping in the guest physical address space. This happens when QEMU is launched with "-machine q35 -enable-hax", which involves the following MemoryRegion transaction for digging the VGA hole: region_del: 0x00000000->0x08000000 VA 05fa0000 ('pc.ram') region_add: 0x00000000->0x000a0000 VA 05fa0000 ('pc.ram') region_add: 0x000a0000->0x000c0000 VA 00000000 ('vga-lowmem') region_add: 0x000c0000->0x08000000 VA 06060000 ('pc.ram') where the third MemoryRegion is MMIO and is ignored. The current de-duplication logic handles the last MemoryRegion incorrectly and produces the following result: hax_mapping_dump_list updates: + 0x000c0000->0x08000000 VA 0x06060000 - 0x07fe0000->0x08000000 VA 0x0df80000 which is why VGA emulation does not work for Q35. With this patch, one can see VGA output as Q35 boots up. Note that Q35 support also requires a change to HAXM kernel module, which is not available in the current HAXM release (6.1.2). + Add a warning if the input MemoryRegion is a ROM device, which is not supported by HAXM kernel module at this time. Signed-off-by: Yu Ning <yu.ning@linux.intel.com> Message-Id: <20170428072723.7036-1-yu.ning@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-05-05target/i386: Add GDB XML register description supportAbdallah Bouassida
This patch implements XML target description support for X86 and X86-64 architectures in the GDB stub, as the way with ARM and PowerPC: - gdb-xml/32bit-core.xml & gdb-xml/64bit-core.xml: Adding the XML target description files, these files are picked from GDB source code. - configure: Define gdb_xml_files for X86 targets. - target/i386/cpu.c: Define gdb_core_xml_file and gdb_arch_name to add XML awareness for this architecture, modify the gdb_num_core_regs to fit the registers number defined in each XML file. Signed-off-by: Abdallah Bouassida <abdallah.bouassida@lauterbach.com> Message-Id: <2b3c8119-1602-28c7-eab4-296593877103@lauterbach.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-05-04target/openrisc: Support non-busy idle state using PMR SPRStafford Horne
The OpenRISC architecture has the Power Management Register (PMR) special purpose register to manage cpu power states. The interesting modes are: * Doze Mode (DME) - Stop cpu except timer & pic - wake on interrupt * Sleep Mode (SME) - Stop cpu and all units - wake on interrupt * Suspend Model (SUME) - Stop cpu and all units - wake on reset The linux kernel will set DME when idle. This patch implements the PMR SPR and halts the qemu cpu when there is a change to DME or SME. This means that openrisc qemu in no longer peggs a host cpu at 100%. In order for this to work we need to kick the CPU when timers are expired. Update the cpu timer to kick the cpu upon each timer event. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-05-04target/openrisc: Remove duplicate features propertyStafford Horne
The features property has stored the exact same thing as the cpucfgr spr. Remove the feature enum and property as it is not needed. In order to preserve the behavior or keeping features accross reset this patch moves cpucfgr into the non reset region of the state struct. Since the cpucfgr is read only this means we only need to sset cpucfgr once during class init. Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-05-04target/openrisc: Implement full vmstate serializationStafford Horne
Previously serialization did not persist the tlb, timer, pic and other key state items. This meant snapshotting and restoring a running os would crash. After adding these I am able to take snapshots of a running linux os and restore at a later time. I am currently not trying to maintain capatibility with older versions as I do not believe this really worked before or anyone used it. Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-05-04target/openrisc: implement shadow registersStafford Horne
Shadow registers are part of the openrisc spec along with sr[cid], as part of the fast context switching feature. When exceptions occur, instead of having to save registers to the stack if enabled the CID will increment and a new set of registers will be available. This patch only implements shadow registers which can be used as extra scratch registers via the mfspr and mtspr if required. This is implemented in a way where it would be easy to add on the fast context switching, currently cid is hardcoded to 0. This is need for openrisc linux smp kernels to boot correctly. Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-05-04target/openrisc: add numcores and coreid supportStafford Horne
These are used to identify the processor in SMP system. Their definition has been defined in verilog cores but it not yet part of the spec but it will be soon. The proposal for this is available: https://openrisc.io/proposals/core-identifier-and-number-of-cores Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-05-04target/openrisc: Fixes for memory debuggingStafford Horne
When debugging in gdb you might want to inspect instructions in mapped pages or in exception vectors like 0x800 etc. This was previously not possible in qemu since the *get_phys_page_debug() routine only looked into the data tlb. Change to fall back to look into instruction tlb and plain physical pages. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-04-26target/ppc: Style fixesDavid Gibson
This makes a small step fixing one of many style problems that exist in the older ppc code. This removes spaces between function (or macro) name and the following '('. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26e500,book3s: mfspr 259: Register mapped/aliased SPRG3 user readBernhard Kaindl
This patch registers mfspr 259 for Book3S and e500 family cores following this research: mfspr 259 provides read-only mapped user access to SPRG3(SPR 275) according to: - PowerISA 2.02, Book III (documents implementation starting with POWER4+ @ p20) - IBM PowerPC 970MP RISC Microprocessor User's Manual v2.1, page 48 - Amit Singh: "Mac OS X Internals: A Systems Approach" on 970 and 970FX cores: He demonstrates mfspr 259 reading TLS data from Mac OS X on G5 on page 588 - NXP documents it in the Core Reference Manuals of: e500, e500mc and e5500 - getcpu() of the 32 & 64-bit Book3S Linux vDSOs use it to read the core number mfspr 259 does not appear to be implemented in these cores according to: - 74xx series: MPC7410/MPC7400 and MPC7450 RISC Microprocessor Reference Manuals - 4xx series: PPC440 Processor User's Manual, Revision 1.09 by AMCC - 750 series: IBM PowerPC 750CL RISC Microprocessor User's Manual - e200 series: e200z4 Power Architectureâ Core Reference Manual Implementation: gen_spr_usprg3() is called from init_proc_book3s_common() (covers the 970 and POWER cores) and init_proc_e500() (covers the e500 family) to register spr_read_ureg() in the same way which it already provides the mapped SPR access for SPR_USPRG4-7 in gen_spr_usprgh() for cores which have the same read-only mapped SPRG register access for SPRG4-7. Verified using Linux by pinning a thread to a core and checking sched_getcpu() using qemu-system-ppc64 -M pseries -cpu POWER8 using MTTCG on a x86_64 host. Signed-off-by: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com> Reviewed-by: Stefan Resch <stefan.resch@thalesgroup.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Flush TLB on write to PIDRSuraj Jitindar Singh
The PIDR (process id register) is used to store the id of the currently running process, which is used to select the process table entry used to perform address translation. This means that when we write to this register all the translations in the TLB become outdated as they are for a previously running process. Thus when this register is written to we need to invalidate the TLB entries to ensure stale entries aren't used to to perform translation for the new process, which would result in at best segfaults or alternatively just random memory being accessed. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [dwg: Fixed compile error for 32-bit targets] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Fix size of struct PPCElfPrstatusAnton Blanchard
gdb refuses to parse QEMU memory dumps because struct PPCElfPrstatus is the wrong size. Fix it. Signed-off-by: Anton Blanchard <anton@samba.org> Fixes: e62fbc54d459 ("target-ppc: dump-guest-memory support") Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26ppc/xics: introduce an 'intc' backlink under PowerPCCPUCédric Le Goater
Today, the ICPState array of the sPAPR machine is indexed with 'cpu_index' of the CPUState. This numbering of CPUs is internal to QEMU and the guest only knows about what is exposed in the device tree, that is the 'cpu_dt_id'. This is why sPAPR uses the helper xics_get_cpu_index_by_dt_id() to do the mapping in a couple of places. To provide a more generic XICS layer, we need to abstract the IRQ 'server' number and remove any assumption made on its nature. It should not be used as a 'cpu_index' for lookups like xics_cpu_setup() and xics_cpu_destroy() do. To reach that goal, we choose to introduce a generic 'intc' backlink under PowerPCCPU, and let the machine core init routine do the ICPState lookup. The resulting object is passed on to xics_cpu_setup() which does the store under PowerPCCPU. The IRQ 'server' number in XICS is now generic. sPAPR uses 'cpu_dt_id' and PowerNV will use 'PIR' number. This also has the benefit of simplifying the sPAPR hcall routines which do not need to do any ICPState lookups anymore. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Add ibm,processor-radix-AP-encodings for TCGSuraj Jitindar Singh
The ibm,processor-radix-AP-encodings device tree property of the cpu node is used to specify the radix mode supported page sizes of the processor to the guest os. Contained in the top 3 bits of the msb is the actual page size (AP) encoding associated with the corresponding radix mode supported page size. Add this property for a TCG guest, note the TCG code is capable of translating any format so just add the 4 default page sizes. The ibm,processor-radix-AP-encodings device tree property is defined as: One to n cells in ascending order of radix mode supported page sizes encoded as BE ints (32bit on ppc) in the form: 0bxxxyyyyyyyyyyyyyyyyyyyyyyyyyyyyy - 0bxxx -> AP encoding - 0byyyyyyyyyyyyyyyyyyyyyyyyyyyyy -> supported page size encoded as a shift Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target-ppc/kvm: Enable in-kernel TCE acceleration for multi-tceAlexey Kardashevskiy
This enables in-kernel handling of H_PUT_TCE_INDIRECT and H_STUFF_TCE hypercalls. The host kernel support is there since v4.6, in particular d3695aa4f452 ("KVM: PPC: Add support for multiple-TCE hcalls"). H_PUT_TCE is already accelerated and does not need any special enablement. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Implement H_REGISTER_PROCESS_TABLE H_CALLSuraj Jitindar Singh
The H_REGISTER_PROCESS_TABLE H_CALL is used by a guest to indicate to the hypervisor where in memory its process table is and how translation should be performed using this process table. Provide the implementation of this H_CALL for a guest. We first check for invalid flags, then parse the flags to determine the operation, and then check the other parameters for valid values based on the operation (register new table/deregister table/maintain registration). The process table is then stored in the appropriate location and registered with the hypervisor (if running under KVM), and the LPCR_[UPRT/GTSE] bits are updated as required. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> [dwg: Correct missing prototype and uninitialized variable] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target-ppc: support KVM_CAP_PPC_MMU_RADIX, KVM_CAP_PPC_MMU_HASH_V3Sam Bobroff
Query and cache the value of two new KVM capabilities that indicate KVM's support for new radix and hash modes of the MMU. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26spapr: Add ibm,processor-radix-AP-encodings to the device treeSam Bobroff
Use the new ioctl, KVM_PPC_GET_RMMU_INFO, to fetch radix MMU information from KVM and present the page encodings in the device tree under ibm,processor-radix-AP-encodings. This provides page size information to the guest which is necessary for it to use radix mode. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> [dwg: Compile fix for 32-bit targets, style nit fix] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target-ppc: kvm: make use of KVM_CREATE_SPAPR_TCE_64Alexey Kardashevskiy
KVM_CAP_SPAPR_TCE capability allows creating TCE tables in KVM which allows having in-kernel acceleration for H_PUT_TCE_xxx hypercalls. However it only supports 32bit DMA windows at zero bus offset. There is a new KVM_CAP_SPAPR_TCE_64 capability which supports 64bit window size, variable page size and bus offset. This makes use of the new capability. The kernel headers are already updated as the kernel support went in to v4.6. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Improve accuracy of guest HTM availability on P8sSam Bobroff
On Power8 hosts it is currently theoretically possible for QEMU/KVM-HV guests to receive a ibm,pa-features property indicating that HTM support is available when it is not. The situation would occur if the platform firmware of a Power8 host cleared the HTM bit of the ibm,pa-features property. QEMU would query KVM for the availability of HTM, which will return no support, but workaround code in kvm_arch_init_vcpu() would then re-enable it because KVM_HV is in use and the processor is P8. This patch adjusts the workaround in kvm_arch_init_vcpu() so that it does not enable HTM (in the above case) unless the host kernel indicates to the QEMU process, via the auxiliary vector, that userspace can use HTM (via the HWCAP2 bit KVM_FEATURE2_HTM). The reason to use the value from the auxiliary vector is that it is set based only on what the host kernel found in the ibm,pa-features HTM bit at boot time. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-25s390x/misc_helper.c: wrap s390_virtio_hypercall in BQLAurelien Jarno
s390_virtio_hypercall can trigger IO events and interrupts, most notably when using virtio-ccw devices. Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Fixes: 278f5e98c647 ("s390x/misc_helper.c: wrap IO instructions in BQL") Signed-off-by: Alexander Graf <agraf@suse.de>
2017-04-25target-s390x: Mask the SIGP order_code to 8bit.Philipp Kern
According to "CPU Signaling and Response", "Signal-Processor Orders", the order field is bit position 56-63. Without this, the Linux guest kernel is sometimes unable to stop emulation and enters an infinite loop of "XXX unknown sigp: 0xffffffff00000005". Signed-off-by: Philipp Kern <phil@philkern.de> Reviewed-by: Thomas Huth <thuth@tuxfamily.org> [agraf: add comment according to email] Signed-off-by: Alexander Graf <agraf@suse.de>
2017-04-21target/openrisc: Implement EPH bitTim 'mithro' Ansell
Exception Prefix High (EPH) control bit of the Supervision Register (SR). The significant bits (31-12) of the vector offset address for each exception depend on the setting of the Supervision Register (SR)'s EPH bit and the Exception Vector Base Address Register (EVBAR). If SR[EPH] is set, the vector offset is logically ORed with the offset 0xF0000000. This means if EPH is; * 0 - Exceptions vectors start at EVBAR * 1 - Exception vectors start at EVBAR | 0xF0000000 Signed-off-by: Tim 'mithro' Ansell <mithro@mithis.com> Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-04-21target/openrisc: Implement EVBAR registerTim 'mithro' Ansell
Exception Vector Base Address Register (EVBAR) - This optional register can be used to apply an offset to the exception vector addresses. The significant bits (31-12) of the vector offset address for each exception depend on the setting of the Supervision Register (SR)'s EPH bit and the Exception Vector Base Address Register (EVBAR). Its presence is indicated by the EVBARP bit in the CPU Configuration Register (CPUCFGR). Signed-off-by: Tim 'mithro' Ansell <mithro@mithis.com> Signed-off-by: Stafford Horne <shorne@gmail.com>
2017-04-21Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170421' into stagingPeter Maydell
The first batch of s390x changes for 2.10: - the new compat machine - several cleanups and optimizations - introspection for css ids # gpg: Signature made Fri 21 Apr 2017 08:36:25 BST # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170421: s390x: Drop useless casts s390x: register I/O adapters per ISC during init s390x/flic: cache flic in s390_get_flic s390x: initialize flic before I/O subsystems s390x: use enum for adapter type and standardize its naming s390x/css: consolidate the devno property for ccw devices s390x/css: provide introspection for virtual subchannel and device busid s390x/css: introduce read-only property type for device ids s390x/pci: make printf always compile in debug output s390x/kvm: make printf always compile in debug output s390x: introduce 2.10 compat machine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-21Merge remote-tracking branch 'remotes/armbru/tags/pull-qdev-2017-04-21' into ↵Peter Maydell
staging qdev patches for 2017-04-21 # gpg: Signature made Fri 21 Apr 2017 06:37:19 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qdev-2017-04-21: qdev: remove cannot_destroy_with_object_finalize_yet versatile: remove cannot_destroy_with_object_finalize_yet ppc: remove cannot_destroy_with_object_finalize_yet arm: remove remaining cannot_destroy_with_object_finalize_yet Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-21s390x: Drop useless castsEric Blake
An upcoming Coccinelle cleanup script wanted to reformat the casts present in this file - but on closer look, we don't need the casts at all because C automatically converts void* to any other pointer. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20170405194741.18956-4-eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x/kvm: make printf always compile in debug outputDanil Antonov
Wrapped printf calls inside debug macros (DPRINTF) in `if` statement. This will ensure that printf function will always compile even if debug output is turned off and, in turn, will prevent bitrot of the format strings. Signed-off-by: Danil Antonov <g.danil.anto@gmail.com> Message-Id: <CA+KKJYAhsuTodm3s2rK65hR=-Xi5+Z7Q+M2nJYZQf2wa44HfOg@mail.gmail.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21ppc: remove cannot_destroy_with_object_finalize_yetLaurent Vivier
This removes the assert(kvm_enabled()) from kvmppc_host_cpu_initfn() This assert can never be triggered as the function is only registered when KVM is available (see also 4c315c2 "qdev: Protect device-list-properties against broken devices"). So we can remove the cannot_destroy_with_object_finalize_yet from kvmppc_host_cpu_class_init() without fear and beyond reproach. (as it has already be done for i386 with 771a13e "i386: Unset cannot_destroy_with_object_finalize_yet on "host" model" and e435601 "target-i386: Remove assert(kvm_enabled()) from host_x86_cpu_initfn()") Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20170414083717.13641-3-lvivier@redhat.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-04-20arm: Remove workarounds for old M-profile exception return implementationPeter Maydell
Now that we've rewritten M-profile exception return so that the magic PC values are not visible to other parts of QEMU, we can delete the special casing of them elsewhere. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-10-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Implement M profile exception return properlyPeter Maydell
On M profile, return from exceptions happen when code in Handler mode executes one of the following function call return instructions: * POP or LDM which loads the PC * LDR to PC * BX register and the new PC value is 0xFFxxxxxx. QEMU tries to implement this by not treating the instruction specially but then catching the attempt to execute from the magic address value. This is not ideal, because: * there are guest visible differences from the architecturally specified behaviour (for instance jumping to 0xFFxxxxxx via a different instruction should not cause an exception return but it will in the QEMU implementation) * we have to account for it in various places (like refusing to take an interrupt if the PC is at a magic value, and making sure that the MPU doesn't deny execution at the magic value addresses) Drop these hacks, and instead implement exception return the way the architecture specifies -- by having the relevant instructions check for the magic value and raise the 'do an exception return' QEMU internal exception immediately. The effect on the generated code is minor: bx lr, old code (and new code for Thread mode): TCG: mov_i32 tmp5,r14 movi_i32 tmp6,$0xfffffffffffffffe and_i32 pc,tmp5,tmp6 movi_i32 tmp6,$0x1 and_i32 tmp5,tmp5,tmp6 st_i32 tmp5,env,$0x218 exit_tb $0x0 set_label $L0 exit_tb $0x7f2aabd61993 x86_64 generated code: 0x7f2aabe87019: mov %ebx,%ebp 0x7f2aabe8701b: and $0xfffffffffffffffe,%ebp 0x7f2aabe8701e: mov %ebp,0x3c(%r14) 0x7f2aabe87022: and $0x1,%ebx 0x7f2aabe87025: mov %ebx,0x218(%r14) 0x7f2aabe8702c: xor %eax,%eax 0x7f2aabe8702e: jmpq 0x7f2aabe7c016 bx lr, new code when in Handler mode: TCG: mov_i32 tmp5,r14 movi_i32 tmp6,$0xfffffffffffffffe and_i32 pc,tmp5,tmp6 movi_i32 tmp6,$0x1 and_i32 tmp5,tmp5,tmp6 st_i32 tmp5,env,$0x218 movi_i32 tmp5,$0xffffffffff000000 brcond_i32 pc,tmp5,geu,$L1 exit_tb $0x0 set_label $L1 movi_i32 tmp5,$0x8 call exception_internal,$0x0,$0,env,tmp5 x86_64 generated code: 0x7fe8fa1264e3: mov %ebp,%ebx 0x7fe8fa1264e5: and $0xfffffffffffffffe,%ebx 0x7fe8fa1264e8: mov %ebx,0x3c(%r14) 0x7fe8fa1264ec: and $0x1,%ebp 0x7fe8fa1264ef: mov %ebp,0x218(%r14) 0x7fe8fa1264f6: cmp $0xff000000,%ebx 0x7fe8fa1264fc: jae 0x7fe8fa126509 0x7fe8fa126502: xor %eax,%eax 0x7fe8fa126504: jmpq 0x7fe8fa122016 0x7fe8fa126509: mov %r14,%rdi 0x7fe8fa12650c: mov $0x8,%esi 0x7fe8fa126511: mov $0x56095dbeccf5,%r10 0x7fe8fa12651b: callq *%r10 which is a difference of one cmp/branch-not-taken. This will be lost in the noise of having to exit generated code and look up the next TB anyway. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-9-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Track M profile handler mode state in TB flagsPeter Maydell
For M profile exception-return handling we'd like to generate different code for some instructions depending on whether we are in Handler mode or Thread mode. This isn't the same as "are we privileged or user", so we need an extra bit in the TB flags to distinguish. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-8-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Abstract out "are we singlestepping" test to utility functionPeter Maydell
We now test for "are we singlestepping" in several places and it's not a trivial check because we need to care about both architectural singlestep and QEMU gdbstub singlestep. We're also about to add another place that needs to make this check, so pull the condition out into a function. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-7-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Move condition-failed codepath generation out of if()Peter Maydell
Move the code to generate the "condition failed" instruction codepath out of the if (singlestepping) {} else {}. This will allow adding support for handling a new is_jmp type which can't be neatly split into "singlestepping case" versus "not singlestepping case". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-6-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Move gen_set_condexec() and gen_set_pc_im() up in the filePeter Maydell
Move the utility routines gen_set_condexec() and gen_set_pc_im() up in the file, as we will want to use them from a function placed earlier in the file than their current location. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-5-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Factor out "generate right kind of step exception"Peter Maydell
We currently have two places that do: if (dc->ss_active) { gen_step_complete_exception(dc); } else { gen_exception_internal(EXCP_DEBUG); } Factor this out into its own function, as we're about to add a third place that needs the same logic. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-4-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Thumb shift operations should not permit interworking branchesPeter Maydell
In Thumb mode, the only instructions which can cause an interworking branch by writing the PC are BLX, BX, BXJ, LDR, POP and LDM. Unlike ARM mode, data processing instructions which target the PC do not cause interworking branches. When we added support for doing interworking branches on writes to PC from data processing instructions in commit 21aeb3430ce7ba, we accidentally changed a Thumb instruction to have interworking branch behaviour for writes to PC. (MOV, MOVS register-shifted register, encoding T2; this is the standard encoding for LSL/LSR/ASR/ROR (register).) For this encoding, behaviour with Rd == R15 is specified as UNPREDICTABLE, so allowing an interworking branch is within spec, but it's confusing and differs from our handling of this class of UNPREDICTABLE for other Thumb ALU operations. Make it perform a simple (non-interworking) branch like the others. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-3-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Don't implement BXJ on M-profile CPUsPeter Maydell
For M-profile CPUs, the BXJ instruction does not exist at all, and the encoding should always UNDEF. We were accidentally implementing it to behave like A-profile BXJ; correct the error. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-2-git-send-email-peter.maydell@linaro.org
2017-04-20arm/kvm: Remove trailing newlines from error_report()Ishani Chugh
Signed-off-by: Ishani Chugh <chugh.ishani@research.iiit.ac.in> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1491629987-6826-1-git-send-email-chugh.ishani@research.iiit.ac.in Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20target/arm: Add assertion about FSC format for syndrome registersPeter Maydell
In tlb_fill() we construct a syndrome register value from a fault status register value which is filled in by arm_tlb_fill(). arm_tlb_fill() returns FSR values which might be in the format used with short-format page descriptors, or the format used with long-format (LPAE) descriptors. The syndrome register always uses LPAE-format FSR status codes. It isn't actually possible to end up delivering a syndrome register value to the guest for a fault which is reported with a short-format FSR (that kind of stage 1 fault will only happen for an AArch32 translation regime which doesn't have a syndrome register, and can never be redirected to an AArch64 or Hyp exception level). Add an assertion which checks this, and adjust the code so that we construct a syndrome with an invalid status code, rather than allowing set bits in the FSR input to randomly corrupt other fields in the syndrome. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1491486152-24304-1-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Move excnames[] array into arm_log_exceptions()Peter Maydell
The excnames[] array is defined in internals.h because we used to use it from two different source files for handling logging of AArch32 and AArch64 exception entry. Refactoring means that it's now used only in arm_log_exception() in helper.c, so move the array into that function. Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491821097-5647-1-git-send-email-peter.maydell@linaro.org
2017-04-20target/arm: Add missing entries to excnames[] for log stringsPeter Maydell
Recent changes have added new EXCP_ values to ARM but forgot to update the excnames[] array which is used to provide human-readable strings when printing information about the exception for debug logging. Add the missing entries, and add a comment to the list of #defines to help avoid the mistake being repeated in future. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1491486340-25988-1-git-send-email-peter.maydell@linaro.org