aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2018-04-16i386: Don't automatically enable FEAT_KVM_HINTS bitsEduardo Habkost
The assumption in the cpu->max_features code is that anything enabled on GET_SUPPORTED_CPUID should be enabled on "-cpu host". This shouldn't be the case for FEAT_KVM_HINTS. This adds a new FeatureWordInfo::no_autoenable_flags field, that can be used to prevent FEAT_KVM_HINTS bits to be enabled automatically. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180410211534.26079-1-ehabkost@redhat.com> Tested-by: Wanpeng Li <wanpengli@tencent.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-04-15m68k: fix exception stack frame for 68000Pavel Dovgalyuk
68000 CPUs do not save format in the exception stack frame. This patch adds feature checking to prevent format saving for 68000. m68k_ret() already includes this modification, this patch fixes the exception processing function too. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20180413133041.29509.59064.stgit@pasha-VirtualBox> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-04-11icount: fix cpu_restore_state_from_tb for non-tb-exit casesPavel Dovgalyuk
In icount mode, instructions that access io memory spaces in the middle of the translation block invoke TB recompilation. After recompilation, such instructions become last in the TB and are allowed to access io memory spaces. When the code includes instruction like i386 'xchg eax, 0xffffd080' which accesses APIC, QEMU goes into an infinite loop of the recompilation. This instruction includes two memory accesses - one read and one write. After the first access, APIC calls cpu_report_tpr_access, which restores the CPU state to get the current eip. But cpu_restore_state_from_tb resets the cpu->can_do_io flag which makes the second memory access invalid. Therefore the second memory access causes a recompilation of the block. Then these operations repeat again and again. This patch moves resetting cpu->can_do_io flag from cpu_restore_state_from_tb to cpu_loop_exit* functions. It also adds a parameter for cpu_restore_state which controls restoring icount. There is no need to restore icount when we only query CPU state without breaking the TB. Restoring it in such cases leads to the incorrect flow of the virtual time. In most cases new parameter is true (icount should be recalculated). But there are two cases in i386 and openrisc when the CPU state is only queried without the need to break the TB. This patch fixes both of these cases. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Message-Id: <20180409091320.12504.35329.stgit@pasha-VirtualBox> [rth: Make can_do_io setting unconditional; move from cpu_exec; make cpu_loop_exit_{noexc,restore} call cpu_loop_exit.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2018-04-10Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.12-20180410' ↵Peter Maydell
into staging ppc patch queue 2018-04-10 Here's a rather late pull request with a handful of fixes for 2.12. These have been blocked for some time, because I wasn't able to complete my usual test set due to the SCSI problem fixed in 37c5174 "scsi-disk: Don't enlarge min_io_size to max_io_size". Since we're in hard freeze, these are all bugfixes. Most are also regressions, although in one case it's only a "regression" because a longstanding bug has been exposed by a new machine type (sam460ex) in the testcases. There are also a couple of sam460ex fixes that aren't regressions since the board didn't exist before. On the flipside though, they're low risk because they only touch board specific code for a board that doesn't exist in any released version. # gpg: Signature made Tue 10 Apr 2018 08:13:52 BST # gpg: using RSA key 6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.12-20180410: roms/u-boot-sam460ex: Change to qemu git mirror and update sam460ex: Fix timer frequency and clock multipliers tests/boot-serial: Test the sam460ex board spapr: Initialize reserved areas list in FDT in H_CAS handler target/ppc: Fix backwards migration of msr_mask hw/misc/macio: Fix crash when listing device properties of macio device target/ppc: Initialize lazy_tlb_flush correctly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10tcg: Introduce tcg_set_insn_start_paramRichard Henderson
The parameters for tcg_gen_insn_start are target_ulong, which may be split into two TCGArg parameters for storage in the opcode on 32-bit hosts. Fixes the ARM target and its direct use of tcg_set_insn_param, which would set the wrong argument in the 64-on-32 case. Cc: qemu-stable@nongnu.org Reported-by: alarson@ddci.com Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180410003558.2470-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10target/arm: Report unsupported MPU region sizes more clearlyPeter Maydell
Currently our PMSAv7 and ARMv7M MPU implementation cannot handle MPU region sizes smaller than our TARGET_PAGE_SIZE. However we report that in a slightly confusing way: DRSR[3]: No support for MPU (sub)region alignment of 9 bits. Minimum is 10 The problem is not the alignment of the region, but its size; tweak the error message to say so: DRSR[3]: No support for MPU (sub)region size of 512 bytes. Minimum is 1024. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180405172554.27401-1-peter.maydell@linaro.org
2018-04-10target-arm: Check undefined opcodes for SWP in A32 decoderOnur Sahin
Make sure we are not treating architecturally Undefined instructions as a SWP, by verifying the opcodes as per section A8.8.229 of ARMv7-A specification. Bits [21:20] must be zero for this to be a SWP or SWPB. We also choose to UNDEF for the architecturally UNPREDICTABLE case of bits [11:8] not being zero. Signed-off-by: Onur Sahin <onursahin08@gmail.com> [PMM: tweaked commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10target/ppc: Fix backwards migration of msr_maskDavid Gibson
21b786f "PowerPC: Add TS bits into msr_mask" added the transaction states to msr_mask for recent POWER CPUs to allow correct migration of machines that are in certain interim transactional memory states. This was correct, but unfortunately breaks backwards of pseries-2.7 and earlier machine types which (stupidly) transferred the msr_mask in the migration stream and failed if it wasn't equal on each end. This works around the problem by masking out the new MSR bits in the compatibility code to send the msr_mask on old machine types. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org> Tested-by: Greg Kurz <groug@kaod.org> Tested-by: Lukáš Doktor <ldoktor@redhat.com>
2018-04-10target/ppc: Initialize lazy_tlb_flush correctlyDavid Gibson
ppc_tr_init_disas_context() correctly sets lazy_tlb_flush to true on certain CPU models. However, it leaves it uninitialized, instead of setting it to false on all others. It wasn't caught before now because we didn't have examples in the tests that exercised this path. However it can now be caught using clang's undefined behaviour sanitizer and the sam460ex board. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-04-09Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180409' into stagingPeter Maydell
Fixes for s390x: kvm, vfio-ccw, ipl code, bios. Includes a rebuild of s390-ccw.img and s390-netboot.img. # gpg: Signature made Mon 09 Apr 2018 16:08:19 BST # gpg: using RSA key DECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180409: s390x: load_psw() should only exchange the PSW for KVM s390x/mmu: don't overwrite pending exception in mmu translate vfio-ccw: fix memory leaks in vfio_ccw_realize() pc-bios/s390: update images s390: Do not pass inofficial IPL type to the guest s390: Ensure IPL from SCSI works as expected s390: Refactor IPL parameter block generation s390x/kvm: call cpu_synchronize_state() on every kvm_arch_handle_exit() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-09Add missing bit for SSE instr in VEX decodingEugene Minibaev
The 2-byte VEX prefix imples a leading 0Fh opcode byte. Signed-off-by: Eugene Minibaev <mail@kitsu.me> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-04-09i386/hyperv: error out if features requested but unsupportedRoman Kagan
In order to guarantee compatibility on migration, QEMU should have complete control over the features it announces to the guest via CPUID. However, for a number of Hyper-V-related cpu properties, if the corresponding feature is not supported by the underlying KVM, the propery is silently ignored and the feature is not announced to the guest. Refuse to start with an error instead. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-Id: <20180330170209.20627-3-rkagan@virtuozzo.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-04-09i386/hyperv: add hv-frequencies cpu propertyRoman Kagan
In order to guarantee compatibility on migration, QEMU should have complete control over the features it announces to the guest via CPUID. However, the availability of Hyper-V frequency MSRs (HV_X64_MSR_TSC_FREQUENCY and HV_X64_MSR_APIC_FREQUENCY) depends solely on the support for them in the underlying KVM. Introduce "hv-frequencies" cpu property (off by default) which gives QEMU full control over whether these MSRs are announced. While at this, drop the redundant check of the cpu tsc frequency, and decouple this feature from hv-time. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180330170209.20627-2-rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-04-09target/i386: WHPX: set CPUID_EXT_HYPERVISOR bitJustin Terry (VM)
Implements the CPUID trap for CPUID 1 to include the CPUID_EXT_HYPERVISOR flag in the ECX results. This was preventing some older linux kernels from booting when trying to access MSR's that dont make sense when virtualized. Signed-off-by: Justin Terry (VM) <juterry@microsoft.com> Message-Id: <20180326170658.606-1-juterry@microsoft.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-04-09s390x: load_psw() should only exchange the PSW for KVMDavid Hildenbrand
Let's simplify it a bit. On some weird circumstances we would have tried to recompute watchpoints when running under KVM. load_psw() is called from do_restart_interrupt() during a SIGP RESTART if the target CPU is STOPPED. Let's touch watchpoints only in the TCG case - where they are used for PER emulation. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20180409113019.14568-3-david@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-04-09s390x/mmu: don't overwrite pending exception in mmu translateDavid Hildenbrand
If we already triggered another exception, don't overwrite it with a protection exception. Only applies to old KVM instances without the virtual memory access IOCTL in KVM. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20180409113019.14568-2-david@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-04-09s390x/kvm: call cpu_synchronize_state() on every kvm_arch_handle_exit()David Hildenbrand
Manually having to use cpu_synchronize_state() is error prone. And as Christian Borntraeger discovered, e.g. handle_diag() is currently missing a cpu_synchronize_state(), as decode_basedisp_s() uses a general purpose register value internally. So let's do an overall cpu_synchronize_state(), which fixes at least the one mentioned BUG. We will clean up the superfluous cpu_synchronize_state() calls later. We now also call it (although maybe not neded) for - KVM_EXIT_S390_RESET -> s390_reipl_request() - KVM_EXIT_DEBUG -> kvm_arch_handle_debug_exit() - unmanagable/unimplemented intercepts - ICPT_CPU_STOP -> do_stop_interrupt() -> cpu gets halted - Scenarios where we inject an operation exception - handle_stsi() I don't think any of these are performance critical. Especially as we have all information directly contained in kvm_run, there are no additional IOCTLs to issue on modern kernels. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20180406093552.13016-1-david@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-04-05target/i386: Fix andn instructionAlexandro Sanchez Bach
In commit 7073fbada733c8d10992f00772c9b9299d740e9b, the `andn` instruction was implemented via `tcg_gen_andc` but passes the operands in the wrong order: - X86 defines `andn dest,src1,src2` as: dest = ~src1 & src2 - TCG defines `andc dest,src1,src2` as: dest = src1 & ~src2 The following simple test shows the issue: #include <stdio.h> #include <stdint.h> int main(void) { uint32_t ret = 0; __asm ( "mov $0xFF00, %%ecx\n" "mov $0x0F0F, %%eax\n" "andn %%ecx, %%eax, %%ecx\n" "mov %%ecx, %0\n" : "=r" (ret)); printf("%08X\n", ret); return 0; } This patch fixes the problem by simply swapping the order of the two last arguments in `tcg_gen_andc_tl`. Reported-by: Alexandro Sanchez Bach <alexandro@phi.nz> Signed-off-by: Alexandro Sanchez Bach <alexandro@phi.nz> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-04-02sev/i386: fix memory leak in sev_guest_init()Greg Kurz
The string returned by object_property_get_str() is dynamically allocated. Fixes: d8575c6c0242b Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <152231462116.69730.14119625999092384450.stgit@bahia.lan> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-03-29RISC-V: Workaround for critical mstatus.FS bugMichael Clark
This change is a workaround for a bug where mstatus.FS is not correctly reporting dirty after operations that modify floating point registers. This a critical bug or RISC-V in QEMU as it results in floating point register file corruption when running SMP Linux due to task migration and possibly uniprocessor Linux if more than one process is using the FPU. This workaround will return dirty if mstatus.FS is switched from off to initial or clean. According to the specification it is legal for an implementation to return only off, or dirty. Cc: Palmer Dabbelt <palmer@sifive.com> Cc: Sagar Karandikar <sagark@eecs.berkeley.edu> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Alex Bennée <alex.bennee@linaro.org> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Michael Clark <mjc@sifive.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-03-28RISC-V: Convert cpu definition to future modelMichael Clark
- Model borrowed from target/sh4/cpu.c - Rewrote riscv_cpu_list to use object_class_get_list - Dropped 'struct RISCVCPUInfo' and used TypeInfo array - Replaced riscv_cpu_register_types with DEFINE_TYPES - Marked base class as abstract - Fixes -cpu list Cc: Igor Mammedov <imammedo@redhat.com> Cc: Sagar Karandikar <sagark@eecs.berkeley.edu> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Michael Clark <mjc@sifive.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2018-03-27Merge remote-tracking branch 'remotes/ericb/tags/pull-qapi-2018-03-27-v2' ↵Peter Maydell
into staging qapi patches for 2018-03-27, 2.12-rc1 - Marc-André Lureau: qmp-test: fix response leak - Eric Blake: tests: Silence false positive warning on generated test name - Laurent Vivier: 0/4 (partial) coccinelle: re-run scripts from scripst/coccinelle - Peter Xu: 0/8 Monitor: some oob related patches (fixes, new param, tests) - Satheesh Rajendran: hmp.c: Revert hmp_info_cpus output format change # gpg: Signature made Tue 27 Mar 2018 16:18:36 BST # gpg: using RSA key A7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" # gpg: aka "[jpeg image of size 6874]" # Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A * remotes/ericb/tags/pull-qapi-2018-03-27-v2: hmp.c: Revert hmp_info_cpus output format change tests: qmp-test: add test for new "x-oob" tests: Add parameter to qtest_init_without_qmp_handshake monitor: new parameter "x-oob" qmp: cleanup qmp queues properly tests: add oob-test for qapi-schema tests: let qapi-schema tests detect oob qapi: restrict allow-oob value to be "true" qmp: fix qmp_capabilities error regression qdict: remove useless cast error: Remove NULL checks on error_propagate() calls error: Strip trailing '\n' from error string arguments (again again) tests: Silence false positive warning on generated test name qmp-test: fix response leak Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-27error: Strip trailing '\n' from error string arguments (again again)Laurent Vivier
Re-run Coccinelle script scripts/coccinelle/err-bad-newline.cocci, and found new error_report() occurrences with '\n'. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20180323143202.28879-3-lvivier@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2018-03-27Merge remote-tracking branch 'remotes/xtensa/tags/20180326-xtensa' into stagingPeter Maydell
target/xtensa fixes for 2.12: - add .inc. to non-top level source file names under target/xtensa; - fix #include <xtensa-isa.h> in the import_core.sh script; - remove stray linux-user/xtensa/syscall.h; - fix timers test. # gpg: Signature made Mon 26 Mar 2018 22:40:20 BST # gpg: using RSA key 51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20180326-xtensa: target/xtensa: fix timers test linux-user/xtensa: remove stray syscall.h target/xtensa/import_core.sh: fix #include <xtensa-isa.h> target/xtensa: add .inc. to non-top level source file names Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-27Merge remote-tracking branch 'remotes/rth/tags/pull-hppa-20180327' into stagingPeter Maydell
Fix glibc 2.27 for hppa-linux-user # gpg: Signature made Mon 26 Mar 2018 17:48:19 BST # gpg: using RSA key 64DF38E8AF7E215F # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-hppa-20180327: target/hppa: Include priv level in user-only iaoq Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-26target/xtensa: fix timers testMax Filippov
The value of CCOUNT special register is calculated as time elapsed since CCOUNT == 0 multiplied by the core frequency. In icount mode time increment between consecutive instructions that don't involve time warps is constant, but unless the result of multiplication of this constant by the core frequency is a whole number the CCOUNT increment between these instructions may not be constant. E.g. with icount=7 each instruction takes 128ns, with core clock of 10MHz CCOUNT values for consecutive instructions are: 502: (128 * 502 * 10000000) / 1000000000 = 642.56 503: (128 * 503 * 10000000) / 1000000000 = 643.84 504: (128 * 504 * 10000000) / 1000000000 = 645.12 I.e.the CCOUNT increments depend on the absolute time. This results in varying CCOUNT differences for consecutive instructions in tests that involve time warps and don't set CCOUNT explicitly. Change frequency of the core used in tests so that clock cycle takes exactly 64ns. Change icount power used in tests to 6, so that each instruction takes exactly 1 clock cycle. With these changes CCOUNT increments only depend on the number of executed instructions and that's what timer tests expect, so they work correctly. Longer story: http://lists.nongnu.org/archive/html/qemu-devel/2018-03/msg04326.html Cc: Pavel Dovgaluk <Pavel.Dovgaluk@ispras.ru> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-03-26target/xtensa/import_core.sh: fix #include <xtensa-isa.h>Max Filippov
Change #include <xtensa-isa.h> to #include "xtensa-isa.h" in imported files to make references to local files consistent. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-03-26target/xtensa: add .inc. to non-top level source file namesMax Filippov
Fix definitions of existing cores and core importing script to follow the rule of naming non-top level source files. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-03-26target/hppa: Include priv level in user-only iaoqRichard Henderson
A recent glibc change relies on the fact that the iaoq must be 3, and computes an address based on that. QEMU had been ignoring the priv level for user-only, which produced an incorrect address. Reported-by: John David Anglin <dave.anglin@bell.net> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2018-03-26WHPX improve vcpu_post_run perfJustin Terry (VM)
This removes the additional call to WHvGetVirtualProcessorRegisters in whpx_vcpu_post_run now that the WHV_VP_EXIT_CONTEXT is returned in all WHV_RUN_VP_EXIT_CONTEXT structures. Signed-off-by: Justin Terry (VM) <juterry@microsoft.com> Message-Id: <1521039163-138-4-git-send-email-juterry@microsoft.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-03-26WHPX fix WHvSetPartitionProperty in PropertyCodeJustin Terry (VM)
This fixes a breaking change to WHvSetPartitionProperty to pass the 'in' PropertyCode on function invocation introduced in Windows Insider SDK 17110. Usage of this indicates the PropertyCode of the opaque PropertyBuffer passed in on function invocation. Also fixes the removal of the PropertyCode parameter from the WHV_PARTITION_PROPERTY struct as it is now passed to the function directly. Signed-off-by: Justin Terry (VM) <juterry@microsoft.com> Message-Id: <1521039163-138-3-git-send-email-juterry@microsoft.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-03-26WHPX fix WHvGetCapability out WrittenSizeInBytesJustin Terry (VM)
This fixes a breaking change to WHvGetCapability to include the 'out' WrittenSizeInBytes introduced in Windows Insider SDK 17110. This specifies on return the safe length to read into the WHV_CAPABILITY structure passed to the call. Signed-off-by: Justin Terry (VM) <juterry@microsoft.com> Message-Id: <1521039163-138-2-git-send-email-juterry@microsoft.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-03-23target/arm: Always set FAR to a known unknown value for debug exceptionsPeter Maydell
For debug exceptions due to breakpoints or the BKPT instruction which are taken to AArch32, the Fault Address Register is architecturally UNKNOWN. We were using that as license to simply not set env->exception.vaddress, but this isn't correct, because it will expose to the guest whatever old value was in that field when arm_cpu_do_interrupt_aarch32() writes it to the guest IFSR. That old value might be a FAR for a previous guest EL2 or secure exception, in which case we shouldn't show it to an EL1 or non-secure exception handler. It might also be a non-deterministic value, which is bad for record-and-replay. Clear env->exception.vaddress before taking breakpoint debug exceptions, to avoid this minor information leak. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-5-peter.maydell@linaro.org
2018-03-23target/arm: Set FSR for BKPT, BRK when raising exceptionPeter Maydell
Now that we have a helper function specifically for the BRK and BKPT instructions, we can set the exception.fsr there rather than in arm_cpu_do_interrupt_aarch32(). This allows us to use our new arm_debug_exception_fsr() helper. In particular this fixes a bug where we were hardcoding the short-form IFSR value, which is wrong if the target exception level has LPAE enabled. Fixes: https://bugs.launchpad.net/qemu/+bug/1756927 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-4-peter.maydell@linaro.org
2018-03-23target/arm: Factor out code to calculate FSR for debug exceptionsPeter Maydell
When a debug exception is taken to AArch32, it appears as a Prefetch Abort, and the Instruction Fault Status Register (IFSR) must be set. The IFSR has two possible formats, depending on whether LPAE is in use. Factor out the code in arm_debug_excp_handler() which picks an FSR value into its own utility function, update it to use arm_fi_to_lfsc() and arm_fi_to_sfsc() rather than hard-coded constants, and use the correct condition to select long or short format. In particular this fixes a bug where we could select the short format because we're at EL0 and the EL1 translation regime is not using LPAE, but then route the debug exception to EL2 because of MDCR_EL2.TDE and hand EL2 the wrong format FSR. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-3-peter.maydell@linaro.org
2018-03-23target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRKPeter Maydell
The MDCR_EL2.TDE bit allows the exception level targeted by debug exceptions to be set to EL2 for code executing at EL0. We handle this in the arm_debug_target_el() function, but this is only used for hardware breakpoint and watchpoint exceptions, not for the exception generated when the guest executes an AArch32 BKPT or AArch64 BRK instruction. We don't have enough information for a translate-time equivalent of arm_debug_target_el(), so instead make BKPT and BRK call a special purpose helper which can do the routing, rather than the generic exception_with_syndrome helper. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-2-peter.maydell@linaro.org
2018-03-23arm/translate-a64: treat DISAS_UPDATE as variant of DISAS_EXITVictor Kamensky
In OE project 4.15 linux kernel boot hang was observed under single cpu aarch64 qemu. Kernel code was in a loop waiting for vtimer arrival, spinning in TC generated blocks, while interrupt was pending unprocessed. This happened because when qemu tried to handle vtimer interrupt target had interrupts disabled, as result flag indicating TCG exit, cpu->icount_decr.u16.high, was cleared but arm_cpu_exec_interrupt function did not call arm_cpu_do_interrupt to process interrupt. Later when target reenabled interrupts, it happened without exit into main loop, so following code that waited for result of interrupt execution run in infinite loop. To solve the problem instructions that operate on CPU sys state (i.e enable/disable interrupt), and marked as DISAS_UPDATE, should be considered as DISAS_EXIT variant, and should be forced to exit back to main loop so qemu will have a chance processing pending CPU state updates, including pending interrupts. This change brings consistency with how DISAS_UPDATE is treated in aarch32 case. CC: Peter Maydell <peter.maydell@linaro.org> CC: Alex Bennée <alex.bennee@linaro.org> CC: qemu-stable@nongnu.org Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Victor Kamensky <kamensky@cisco.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1521526368-1996-1-git-send-email-kamensky@cisco.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-23s390x/cpumodel: fix feature groups and breakage of MSA8Christian Borntraeger
Since commit 46a99c9f73c7 ("s390x/cpumodel: model PTFF subfunctions for Multiple-epoch facility") -cpu help no longer shows the MSA8 feature group. Turns out that we forgot to add the new MEPOCH_PTFF group enum. Fixes: 46a99c9f73c7 ("s390x/cpumodel: model PTFF subfunctions for Multiple-epoch facility") Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2018-03-20Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20180320' into ↵Peter Maydell
staging HMP fixes for 2.12 # gpg: Signature made Tue 20 Mar 2018 12:39:24 GMT # gpg: using RSA key 0516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-hmp-20180320: hmp: free sev info HMP: Initialize err before using Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-20Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier/tags/m68k-for-2.12-pull-request' into staging # gpg: Signature made Tue 20 Mar 2018 09:07:55 GMT # gpg: using RSA key F30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier/tags/m68k-for-2.12-pull-request: target/m68k: add a mechanism to automatically free TCGv target/m68k: add DisasContext parameter to gen_extend() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-20Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/machine-next-pull-request' into staging Machine and x86 queue, 2018-03-19 * cpu_model/cpu_type cleanups * x86: Fix on Intel Processor Trace CPUID checks # gpg: Signature made Mon 19 Mar 2018 20:07:14 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/machine-next-pull-request: i386: Disable Intel PT if packets IP payloads have LIP values cpu: drop unnecessary NULL check and cpu_common_class_by_name() cpu: get rid of unused cpu_init() defines Use cpu_create(type) instead of cpu_init(cpu_model) cpu: add CPU_RESOLVING_TYPE macro tests: add machine 'none' with -cpu test nios2: 10m50_devboard: replace cpu_model with cpu_type Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-20hmp: free sev infoMarc-André Lureau
Found thanks to ASAN: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7efe20417a38 in __interceptor_calloc (/lib64/libasan.so.4+0xdea38) #1 0x7efe1f7b2f75 in g_malloc0 ../glib/gmem.c:124 #2 0x7efe1f7b3249 in g_malloc0_n ../glib/gmem.c:355 #3 0x558272879162 in sev_get_info /home/elmarco/src/qemu/target/i386/sev.c:414 #4 0x55827285113b in hmp_info_sev /home/elmarco/src/qemu/target/i386/monitor.c:684 #5 0x5582724043b8 in handle_hmp_command /home/elmarco/src/qemu/monitor.c:3333 Fixes: 63036314 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180319175823.22111-1-marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2018-03-20RISC-V: Fix riscv_isa_string memory size bugMichael Clark
This version uses a constant size memory buffer sized for the maximum possible ISA string length. It also uses g_new instead of g_new0, uses more efficient logic to append extensions and adds manual zero termination of the string. Cc: Palmer Dabbelt <palmer@sifive.com> Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Clark <mjc@sifive.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [PMM: Use qemu_tolower() rather than tolower()] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-03-20target/m68k: add a mechanism to automatically free TCGvLaurent Vivier
SRC_EA() and gen_extend() can return either a temporary TCGv or a memory allocated one. Mark them when they are allocated, and free them automatically at end of the instruction translation. We want to free locally allocated TCGv to avoid overflow in sequence like: 0xc00ae406: movel %fp@(-132),%fp@(-268) 0xc00ae40c: movel %fp@(-128),%fp@(-264) 0xc00ae412: movel %fp@(-20),%fp@(-212) 0xc00ae418: movel %fp@(-16),%fp@(-208) 0xc00ae41e: movel %fp@(-60),%fp@(-220) 0xc00ae424: movel %fp@(-56),%fp@(-216) 0xc00ae42a: movel %fp@(-124),%fp@(-252) 0xc00ae430: movel %fp@(-120),%fp@(-248) 0xc00ae436: movel %fp@(-12),%fp@(-260) 0xc00ae43c: movel %fp@(-8),%fp@(-256) 0xc00ae442: movel %fp@(-52),%fp@(-276) 0xc00ae448: movel %fp@(-48),%fp@(-272) ... That can fill a lot of TCGv entries in a sequence, especially since 15fa08f845 ("tcg: Dynamically allocate TCGOps") we have no limit to fill the TCGOps cache and we can fill the entire TCG variables array and overflow it. Suggested-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20180319113544.704-3-laurent@vivier.eu>
2018-03-20target/m68k: add DisasContext parameter to gen_extend()Laurent Vivier
This parameter will be needed to manage automatic release of temporary allocated TCG variables. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20180319113544.704-2-laurent@vivier.eu>
2018-03-19i386: Disable Intel PT if packets IP payloads have LIP valuesLuwei Kang
Intel processor trace should be disabled when CPUID.(EAX=14H,ECX=0H).ECX.[bit31] is set. Generated packets which contain IP payloads will have LIP values when this bit is set, or IP payloads will have RIP values. Currently, The information of CPUID 14H is constant to make live migration safty and this bit is always 0 in guest even if host support LIP values. Guest sees the bit is 0 will expect IP payloads with RIP values, but the host CPU will generate IP payloads with LIP values if this bit is set in HW. To make sure the value of IP payloads correctly, Intel PT should be disabled when bit[31] is set. Signed-off-by: Luwei Kang <luwei.kang@intel.com> Message-Id: <1520969191-18162-1-git-send-email-luwei.kang@intel.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-03-19qapi: Replace qobject_to_X(o) by qobject_to(X, o)Max Reitz
This patch was generated using the following Coccinelle script: @@ expression Obj; @@ ( - qobject_to_qnum(Obj) + qobject_to(QNum, Obj) | - qobject_to_qstring(Obj) + qobject_to(QString, Obj) | - qobject_to_qdict(Obj) + qobject_to(QDict, Obj) | - qobject_to_qlist(Obj) + qobject_to(QList, Obj) | - qobject_to_qbool(Obj) + qobject_to(QBool, Obj) ) and a bit of manual fix-up for overly long lines and three places in tests/check-qjson.c that Coccinelle did not find. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Message-Id: <20180224154033.29559-4-mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: swap order from qobject_to(o, X), rebase to master, also a fix to latent false-positive compiler complaint about hw/i386/acpi-build.c] Signed-off-by: Eric Blake <eblake@redhat.com>
2018-03-19cpu: drop unnecessary NULL check and cpu_common_class_by_name()Igor Mammedov
both do nothing as for the first all callers parse_cpu_model() and qmp_query_cpu_model_() should provide non NULL value, so just abort if it's not so. While at it drop cpu_common_class_by_name() which is not need any more as every target has CPUClass::class_by_name callback by now, though abort in case a new arch will forget to define one. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1518013857-4372-1-git-send-email-imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-03-19cpu: get rid of unused cpu_init() definesIgor Mammedov
cpu_init(cpu_model) were replaced by cpu_create(cpu_type) so no users are left, remove it. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> (ppc) Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1518000027-274608-6-git-send-email-imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-03-19cpu: add CPU_RESOLVING_TYPE macroIgor Mammedov
it will be used for providing to cpu name resolving class for parsing cpu model for system and user emulation code. Along with change add target to null-machine tests, so that when switch to CPU_RESOLVING_TYPE happens, it would ensure that null-machine usecase still works. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> (m68k) Acked-by: David Gibson <david@gibson.dropbear.id.au> (ppc) Acked-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> (tricore) Message-Id: <1518000027-274608-4-git-send-email-imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> [ehabkost: Added macro to riscv too] Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-28 20:22:30 +0000