summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-03-01target/ppc: SDR1 is a hypervisor resourceDavid Gibson2-9/+19
At present the SDR1 register - the base of the system's hashed page table (HPT) - is represented as an SPR with supervisor read and write permission. However, on CPUs which have a hypervisor mode, the SDR1 is a hypervisor only resource. Change the permission checking on the SPR to reflect this. Now that this is done, we don't need to check for an external HPT executing mtsdr1: an external HPT only applies when we're emulating the behaviour of a hypervisor, rather than modelling the CPU's hypervisor mode internally, so if we're permitted to execute mtsdr1, we don't have an external HPT. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
2017-03-01target/ppc: Merge cpu_ppc_set_vhyp() with cpu_ppc_set_papr()David Gibson3-11/+5
cpu_ppc_set_papr() sets up various aspects of CPU state for use with PAPR paravirtualized guests. However, it doesn't set the virtual hypervisor, so callers must also call cpu_ppc_set_vhyp() so that PAPR hypercalls are handled properly. This is a bit silly, so fold setting the virtual hypervisor into cpu_ppc_set_papr(). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
2017-03-01pseries: Minor cleanups to HPT management hypercallsDavid Gibson1-30/+28
* Standardize on 'ptex' instead of 'pte_index' for HPTE index variables for consistency and brevity * Avoid variables named 'index'; shadowing index(3) from libc can lead to surprising bugs if the variable is removed, because compiler errors might not appear for remaining references * Clarify index calculations in h_enter() - we have two cases, H_EXACT where the exact HPTE slot is given, and !H_EXACT where we search for an empty slot within the hash bucket. Make the calculation more consistent between the cases. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
2017-03-01target/ppc: Fix KVM-HV HPTE accessorsDavid Gibson5-84/+73
When a 'pseries' guest is running with KVM-HV, the guest's hashed page table (HPT) is stored within the host kernel, so it is not directly accessible to qemu. Most of the time, qemu doesn't need to access it: we're using the hardware MMU, and KVM itself implements the guest hypercalls for manipulating the HPT. However, qemu does need access to the in-KVM HPT to implement get_phys_page_debug() for the benefit of the gdbstub, and maybe for other debug operations. To allow this, 7c43bca "target-ppc: Fix page table lookup with kvm enabled" added kvmppc_hash64_read_pteg() to target/ppc/kvm.c to read in a batch of HPTEs from the KVM table. Unfortunately, there are a couple of problems with this: First, the name of the function implies it always reads a whole PTEG from the HPT, but in fact in some cases it's used to grab individual HPTEs (which ends up pulling 8 HPTEs, not aligned to a PTEG from the kernel). Second, and more importantly, the code to read the HPTEs from KVM is simply wrong, in general. The data from the fd that KVM provides is designed mostly for compact migration rather than this sort of one-off access, and so needs some decoding for this purpose. The current code will work in some cases, but if there are invalid HPTEs then it will not get sane results. This patch rewrite the HPTE reading function to have a simpler interface (just read n HPTEs into a caller provided buffer), and to correctly decode the stream from the kernel. For consistency we also clean up the similar function for altering HPTEs within KVM (introduced in c138593 "target-ppc: Update ppc_hash64_store_hpte to support updating in-kernel htab"). Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01sysemu: support up to 1024 vCPUsGreg Kurz1-1/+1
Some systems can already provide more than 255 hardware threads. Bumping the QEMU limit to 1024 seems reasonable: - it has no visible overhead in top; - the limit itself has no effect on hot paths. Cc: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01target/ppc: introduce helper_update_ov_legacyNikunj A Dadhania1-21/+13
Removes duplicate code and will be useful for consolidating flags Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01spapr: generate DT node namesLaurent Vivier1-14/+276
When DT node names for PCI devices are generated by SLOF, they are generated according to the type of the device (for instance, ethernet for virtio-net-pci device). Node name for hotplugged devices is generated by QEMU. This patch adds the mechanic to QEMU to create the node name according to the device type too. The data structure has been roughly copied from OpenBIOS/OpenHackware, node names from SLOF. Example: Hotplugging some PCI cards with QEMU monitor: device_add virtio-tablet-pci device_add virtio-serial-pci device_add virtio-mouse-pci device_add virtio-scsi-pci device_add virtio-gpu-pci device_add ne2k_pci device_add nec-usb-xhci device_add intel-hda What we can see in linux device tree: for dir in /proc/device-tree/pci@800000020000000/*@*/; do echo $dir cat $dir/name echo done WITHOUT this patch: /proc/device-tree/pci@800000020000000/pci@0/ pci /proc/device-tree/pci@800000020000000/pci@1/ pci /proc/device-tree/pci@800000020000000/pci@2/ pci /proc/device-tree/pci@800000020000000/pci@3/ pci /proc/device-tree/pci@800000020000000/pci@4/ pci /proc/device-tree/pci@800000020000000/pci@5/ pci /proc/device-tree/pci@800000020000000/pci@6/ pci /proc/device-tree/pci@800000020000000/pci@7/ pci WITH this patch: /proc/device-tree/pci@800000020000000/communication-controller@1/ communication-controller /proc/device-tree/pci@800000020000000/display@4/ display /proc/device-tree/pci@800000020000000/ethernet@5/ ethernet /proc/device-tree/pci@800000020000000/input-controller@0/ input-controller /proc/device-tree/pci@800000020000000/mouse@2/ mouse /proc/device-tree/pci@800000020000000/multimedia-device@7/ multimedia-device /proc/device-tree/pci@800000020000000/scsi@3/ scsi /proc/device-tree/pci@800000020000000/usb-xhci@6/ usb-xhci Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01PCI: add missing classes in pci_ids.h to build device treeLaurent Vivier1-9/+103
To allow QEMU to add PCI entries in device tree, we must have a more exhaustive list of PCI class IDs. This patch synchronizes as much as possible with pci_ids.h and add some missing IDs from SLOF. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01target/ppc: optimize gen_write_xer()Nikunj A Dadhania1-6/+3
Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-01target/ppc: move cpu_[read, write]_xer to cpu.cNikunj A Dadhania3-12/+39
Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-02-28vhost-user: delay vhost_user_stopMarc-André Lureau1-7/+46
Since commit b0a335e351103bf92f3f9d0bd5759311be8156ac, a socket write may trigger a disconnect events, calling vhost_user_stop() and clearing all the vhost_dev strutures holding data that vhost.c functions expect to remain valid. Delay the cleanup to keep the vhost_dev structure valid during the vhost.c functions. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170227104956.24729-1-marcandre.lureau@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell11-87/+289
This pull request brings: - a fix to a minor bug reported by Coverity - throttling support in the local backend (command line only) # gpg: Signature made Tue 28 Feb 2017 09:32:30 GMT # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: throttle: factor out duplicate code fsdev: add IO throttle support to fsdev devices 9pfs: fix v9fs_lock error case Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell13-15/+44
staging trivial patches for 2017-02-28 # gpg: Signature made Tue 28 Feb 2017 06:43:55 GMT # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: syscall: fixed mincore(2) not failing with ENOMEM hw/acpi/tco.c: fix tco timer stop lm32: milkymist-tmu2: fix a third integer overflow qemu-options.hx: add missing id=chr0 chardev argument in vhost-user example Update copyright year tests/prom-env: Enable the test for the sun4u machine, too cadence_gem: Remove unused parameter debug message register: fix incorrect read mask ide: remove undefined behavior in ide-test CODING_STYLE: Mention preferred comment form hw/core/register: Mark the device with cannot_instantiate_with_device_add_yet hw/core/or-irq: Mark the device with cannot_instantiate_with_device_add_yet softfloat: Use correct type in float64_to_uint64_round_to_zero() target/s390x: Fix typo Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28Merge remote-tracking branch ↵Peter Maydell26-331/+1897
'remotes/pmaydell/tags/pull-target-arm-20170228' into staging target-arm queue: * raspi2: implement RNG module * raspi2: implement new SD card controller (but don't wire it up) * sdhci: bugfixes for block transfers * virt: fix cpu object reference leak * Add missing fp_access_check() to aarch64 crypto instructions * cputlb: Don't assume do_unassigned_access() never returns * virt: Add a user option to disallow ITS instantiation * i.MX timers: fix reset handling * ARMv7M NVIC: rewrite to fix broken priority handling and masking * exynos: Fix proper mapping of CPUs by providing real cluster ID * exynos: Fix Linux kernel division by zero for PLLs # gpg: Signature made Tue 28 Feb 2017 12:40:51 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20170228: (27 commits) hw/arm/exynos: Fix proper mapping of CPUs by providing real cluster ID hw/arm/exynos: Fix Linux kernel division by zero for PLLs bcm2835_sdhost: add bcm2835 sdhost controller armv7m: Allow SHCSR writes to change pending and active bits armv7m: Raise correct kind of UsageFault for attempts to execute ARM code armv7m: Check exception return consistency armv7m: Extract "exception taken" code into functions armv7m: VECTCLRACTIVE and VECTRESET are UNPREDICTABLE armv7m: Simpler and faster exception start armv7m: Remove unused armv7m_nvic_acknowledge_irq() return value armv7m: Escalate exceptions to HardFault if necessary arm: gic: Remove references to NVIC armv7m: Fix condition check for taking exceptions armv7m: Rewrite NVIC to not use any GIC code armv7m: Implement reading and writing of PRIGROUP armv7m: Rename nvic_state to NVICState ARM i.MX timers: fix reset handling hw/arm/virt: Add a user option to disallow ITS instantiation cputlb: Don't assume do_unassigned_access() never returns Add missing fp_access_check() to aarch64 crypto instructions ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into stagingPeter Maydell2-10/+10
# gpg: Signature made Tue 28 Feb 2017 04:34:34 GMT # gpg: using RSA key 0xBDBE7B27C0DE3057 # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>" # gpg: aka "Jeffrey Cody <jeff@codyprime.org>" # gpg: aka "Jeffrey Cody <codyprime@gmail.com>" # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98 D624 BDBE 7B27 C0DE 3057 * remotes/cody/tags/block-pull-request: iscsi: add missing colons to the qapi docs block/mirror: fix broken sparseness detection Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28Merge remote-tracking branch 'remotes/rth/tags/pull-axp-20170228' into stagingPeter Maydell2-0/+4
Enable MTTCG for Alpha guest # gpg: Signature made Tue 28 Feb 2017 00:43:17 GMT # gpg: using RSA key 0xAD1270CC4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC 16A4 AD12 70CC 4DD0 279B * remotes/rth/tags/pull-axp-20170228: target/alpha: Enable MTTCG by default Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28hw/arm/exynos: Fix proper mapping of CPUs by providing real cluster IDKrzysztof Kozlowski1-0/+12
The Exynos4210 has cluster ID 0x9 in its MPIDR register (raw value 0x8000090x). If this cluster ID is not provided, then Linux kernel cannot map DeviceTree nodes to MPIDR values resulting in kernel warning and lack of any secondary CPUs: DT missing boot CPU MPIDR[23:0], fall back to default cpu_logical_map ... smp: Bringing up secondary CPUs ... smp: Brought up 1 node, 1 CPU SMP: Total of 1 processors activated (24.00 BogoMIPS). Provide a cluster ID so Linux will see proper MPIDR and will try to bring the secondary CPU online. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Message-id: 20170226200142.31169-2-krzk@kernel.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28hw/arm/exynos: Fix Linux kernel division by zero for PLLsKrzysztof Kozlowski3-1/+171
Without any clock controller, the Linux kernel was hitting division by zero during boot or with clk_summary: [ 0.000000] [<c031054c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14) [ 0.000000] [<c030ba6c>] (show_stack) from [<c05b2660>] (dump_stack+0x88/0x9c) [ 0.000000] [<c05b2660>] (dump_stack) from [<c05b11a4>] (Ldiv0+0x8/0x10) [ 0.000000] [<c05b11a4>] (Ldiv0) from [<c06ad1e0>] (samsung_pll45xx_recalc_rate+0x58/0x74) [ 0.000000] [<c06ad1e0>] (samsung_pll45xx_recalc_rate) from [<c0692ec0>] (clk_register+0x39c/0x63c) [ 0.000000] [<c0692ec0>] (clk_register) from [<c125d360>] (samsung_clk_register_pll+0x2e0/0x3d4) [ 0.000000] [<c125d360>] (samsung_clk_register_pll) from [<c125d7e8>] (exynos4_clk_init+0x1b0/0x5e4) [ 0.000000] [<c125d7e8>] (exynos4_clk_init) from [<c12335f4>] (of_clk_init+0x17c/0x210) [ 0.000000] [<c12335f4>] (of_clk_init) from [<c1204700>] (time_init+0x24/0x2c) [ 0.000000] [<c1204700>] (time_init) from [<c1200b2c>] (start_kernel+0x24c/0x38c) [ 0.000000] [<c1200b2c>] (start_kernel) from [<4020807c>] (0x4020807c) Provide stub for clock controller returning reset values for PLLs. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Message-id: 20170226200142.31169-1-krzk@kernel.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28bcm2835_sdhost: add bcm2835 sdhost controllerClement Deschamps3-0/+478
This adds the BCM2835 SDHost controller from Arasan. Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr> Message-id: 20170224164021.9066-2-clement.deschamps@antfield.fr Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28armv7m: Allow SHCSR writes to change pending and active bitsPeter Maydell1-2/+11
Implement the NVIC SHCSR write behaviour which allows pending and active status of some exceptions to be changed. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Raise correct kind of UsageFault for attempts to execute ARM codePeter Maydell4-2/+12
M profile doesn't implement ARM, and the architecturally required behaviour for attempts to execute with the Thumb bit clear is to generate a UsageFault with the CFSR INVSTATE bit set. We were incorrectly implementing this as generating an UNDEFINSTR UsageFault; fix this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Check exception return consistencyPeter Maydell3-13/+123
Implement the exception return consistency checks described in the v7M pseudocode ExceptionReturn(). Inspired by a patch from Michael Davidsaver's series, but this is a reimplementation from scratch based on the ARM ARM pseudocode. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Extract "exception taken" code into functionsPeter Maydell1-50/+68
Extract the code from the tail end of arm_v7m_do_interrupt() which enters the exception handler into a pair of utility functions v7m_exception_taken() and v7m_push_stack(), which correspond roughly to the pseudocode PushStack() and ExceptionTaken(). This also requires us to move the arm_v7m_load_vector() utility routine up so we can call it. Handling illegal exception returns has some cases where we want to take a UsageFault either on an existing stack frame or with a new stack frame but with a specific LR value, so we want to be able to call these without having to go via arm_v7m_cpu_do_interrupt(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: VECTCLRACTIVE and VECTRESET are UNPREDICTABLEMichael Davidsaver1-2/+6
The VECTCLRACTIVE and VECTRESET bits in the AIRCR are both documented as UNPREDICTABLE if you write a 1 to them when the processor is not halted in Debug state (ie stopped and under the control of an external JTAG debugger). Since we don't implement Debug state or emulated JTAG these bits are always UNPREDICTABLE for us. Instead of logging them as unimplemented we can simply log writes as guest errors and ignore them. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> [PMM: change extracted from another patch; commit message constructed from scratch] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Simpler and faster exception startMichael Davidsaver1-6/+9
All the places in armv7m_cpu_do_interrupt() which pend an exception in the NVIC are doing so for synchronous exceptions. We know that we will always take some exception in this case, so we can just acknowledge it immediately, rather than returning and then immediately being called again because the NVIC has raised its outbound IRQ line. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> [PMM: tweaked commit message; added DEBUG to the set of exceptions we handle immediately, since it is synchronous when it results from the BKPT instruction] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Remove unused armv7m_nvic_acknowledge_irq() return valuePeter Maydell3-5/+3
Having armv7m_nvic_acknowledge_irq() return the new value of env->v7m.exception and its one caller assign the return value back to env->v7m.exception is pointless. Just make the return type void instead. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Escalate exceptions to HardFault if necessaryMichael Davidsaver2-2/+53
The v7M exception architecture requires that if a synchronous exception cannot be taken immediately (because it is disabled or at too low a priority) then it should be escalated to HardFault (and the HardFault exception is then taken). Implement this escalation logic. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> [PMM: extracted from another patch] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28arm: gic: Remove references to NVICMichael Davidsaver3-46/+15
Now that the NVIC is its own separate implementation, we can clean up the GIC code by removing REV_NVIC and conditionals which use it. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Fix condition check for taking exceptionsPeter Maydell3-8/+23
The M profile condition for when we can take a pending exception or interrupt is not the same as that for A/R profile. The code originally copied from the A/R profile version of the cpu_exec_interrupt function only worked by chance for the very simple case of exceptions being masked by PRIMASK. Replace it with a call to a function in the NVIC code that correctly compares the priority of the pending exception against the current execution priority of the CPU. [Michael Davidsaver's patchset had a patch to do something similar but the implementation ended up being a rewrite.] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Rewrite NVIC to not use any GIC codeMichael Davidsaver2-144/+609
Despite some superficial similarities of register layout, the M-profile NVIC is really very different from the A-profile GIC. Our current attempt to reuse the GIC code means that we have significant bugs in our NVIC. Implement the NVIC as an entirely separate device, to give us somewhere we can get the behaviour correct. This initial commit does not attempt to implement exception priority escalation, since the GIC-based code didn't either. It does fix a few bugs in passing: * ICSR.RETTOBASE polarity was wrong and didn't account for internal exceptions * ICSR.VECTPENDING was 16 too high if the pending exception was for an external interrupt * UsageFault, BusFault and MemFault were not disabled on reset as they are supposed to be Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> [PMM: reworked, various bugs and stylistic cleanups] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Implement reading and writing of PRIGROUPPeter Maydell1-6/+8
Add a state field for the v7M PRIGROUP register and implent reading and writing it. The current NVIC doesn't honour the values written, but the new version will. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28armv7m: Rename nvic_state to NVICStatePeter Maydell1-22/+22
Rename the nvic_state struct to NVICState, to match our naming conventions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-02-28ARM i.MX timers: fix reset handlingKurban Mallachiev1-8/+25
The i.MX timer device can be reset by writing to the SWR bit of the CR register. This has to behave differently from hard (power-on) reset because it does not reset all of the bits in the CR register. We were incorrectly implementing soft reset and hard reset the same way, and in addition had a logic error which meant that we were clearing the bits that soft-reset is supposed to preserve and not touching the bits that soft-reset clears. This was not correct behaviour for either kind of reset. Separate out the soft reset and hard reset code paths, and correct the handling of reset of the CR register so that it is correct in both cases. Signed-off-by: Kurban Mallachiev <mallachiev@ispras.ru> [PMM: rephrased commit message, spacing on operators; use bool rather than int for is_soft_reset] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28hw/arm/virt: Add a user option to disallow ITS instantiationEric Auger2-2/+30
In 2.9 ITS will block save/restore and migration use cases. As such, let's introduce a user option that allows to turn its instantiation off, along with GICv3. With the "its" option turned false, migration will be possible, obviously at the expense of MSI support (with GICv3). Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 1487681108-14452-1-git-send-email-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28cputlb: Don't assume do_unassigned_access() never returnsPeter Maydell1-8/+7
In get_page_addr_code(), if the guest PC doesn't correspond to RAM then we currently run the CPU's do_unassigned_access() hook if it has one, and otherwise we give up and exit QEMU with a more-or-less useful message. This code assumes that the do_unassigned_access hook will never return, because if it does then we'll plough on attempting to use a non-RAM TLB entry to get a RAM address and will abort() in qemu_ram_addr_from_host_nofail(). Unfortunately some CPU implementations of this hook do return: Microblaze, SPARC and the ARM v7M. Change the code to call report_bad_exec() if the hook returns, as well as if it didn't have one. This means we can tidy it up to use the cpu_unassigned_access() function which wraps the "get the CPU class and call the hook if it has one" work, since we aren't trying to distinguish "no hook" from "hook existed and returned" any more. This brings the handling of this hook into line with the handling used for data accesses, where "hook returned" is treated the same as "no hook existed" and gets you the default behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-28Add missing fp_access_check() to aarch64 crypto instructionsNick Reilly1-0/+12
The aarch64 crypto instructions for AES and SHA are missing the check for if the FPU is enabled. Signed-off-by: Nick Reilly <nreilly@blackberry.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28hw/arm/virt: fix cpu object reference leakIgor Mammedov1-0/+1
object_new(FOO) returns an object with ref_cnt == 1 and following object_property_set_bool(cpuobj, true, "realized", NULL) set parent of cpuobj to '/machine/unattached' which makes ref_cnt == 2. Since machvirt_init() doesn't take ownership of cpuobj returned by object_new() it should explicitly drop reference to cpuobj when dangling pointer is about to go out of scope like it's done pc_new_cpu() to avoid object leak. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-id: 1487253461-269218-1-git-send-email-imammedo@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28sd: sdhci: Remove block count enable check in single block transfersPrasad J Pandit1-5/+1
In SDHCI protocol, the 'Block count enable' bit of the Transfer Mode register is relevant only in multi block transfers. We need not check it in single block transfers. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170214185225.7994-5-ppandit@redhat.com Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28sd: sdhci: conditionally invoke multi block transferPrasad J Pandit1-1/+5
In sdhci_write invoke multi block transfer if it is enabled in the transfer mode register 's->trnmod'. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170214185225.7994-4-ppandit@redhat.com Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28sd: sdhci: check transfer mode register in multi block transferPrasad J Pandit1-5/+5
In the SDHCI protocol, the transfer mode register value is used during multi block transfer to check if block count register is enabled and should be updated. Transfer mode register could be set such that, block count register would not be updated, thus leading to an infinite loop. Add check to avoid it. Reported-by: Wjjzhang <wjjzhang@tencent.com> Reported-by: Jiang Xin <jiangxin1@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170214185225.7994-3-ppandit@redhat.com Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28sd: sdhci: mask transfer mode register valuePrasad J Pandit1-1/+2
In SDHCI protocol, the transfer mode register is defined to be of 6 bits. Mask its value with '0x0037' so that an invalid value could not be assigned. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 20170214185225.7994-2-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28bcm2835_rng: Use qcrypto_random_bytes() rather than rand()Peter Maydell1-1/+26
Switch to using qcrypto_random_bytes() rather than rand() as our source of randomness for the BCM2835 RNG. If qcrypto_random_bytes() fails, we don't want to return the guest a non-random value in case they're really using it for cryptographic purposes, so the best we can do is a fatal error. This shouldn't happen unless something's broken, though. In theory we could implement this device's full FIFO and interrupt semantics and then just stop filling the FIFO. That's a lot of work, though, and doesn't really give a very nice diagnostic to the user since the guest will just seem to hang. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
2017-02-28target-arm: Implement BCM2835 hardware RNGMarcin Chojnacki5-0/+169
Recent vanilla Raspberry Pi kernels started to make use of the hardware random number generator in BCM2835 SoC. As a result, those kernels wouldn't work anymore under QEMU but rather just freeze during the boot process. This patch implements a trivial BCM2835 compatible RNG, and adds it as a peripheral to BCM2835 platform, which allows to boot a vanilla Raspberry Pi kernel under Qemu. Changes since v1: * Prevented guest from writing [31..20] bits in rng_status * Removed redundant minimum_version_id_old * Added field entries for the state * Changed realize function to reset Signed-off-by: Marcin Chojnacki <marcinch7@gmail.com> Message-id: 20170210210857.47893-1-marcinch7@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28Merge remote-tracking branch ↵Peter Maydell5-61/+395
'remotes/vivier2/tags/linux-user-for-upstream-pull-request' into staging # gpg: Signature made Mon 27 Feb 2017 22:15:47 GMT # gpg: using RSA key 0xF30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-upstream-pull-request: syscall: fixed mincore(2) not failing with ENOMEM linux-user: fix do_rt_sigreturn on m68k linux userspace emulation linux-user: correctly manage SR in ucontext linux-user: Add signal handling support for x86_64 linux-user: Add sockopts for IPv6 ping and IPv6 traceroute linux-user: fix fork() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28throttle: factor out duplicate codePradeep Jagadeesh3-153/+102
This patch removes the redundant throttle code that was present in block and fsdev device files. Now the common code is moved to a single file. Signed-off-by: Pradeep Jagadeesh <pradeep.jagadeesh@huawei.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> (fix indent nit, Greg Kurz) Signed-off-by: Greg Kurz <groug@kaod.org>
2017-02-28fsdev: add IO throttle support to fsdev devicesPradeep Jagadeesh9-3/+258
This patchset adds the throttle support for the 9p-local driver. For now this functionality can be enabled only through qemu cli options. QMP interface and support to other drivers need further extensions. To make it simple for other 9p drivers, the throttle code has been put in separate files. Signed-off-by: Pradeep Jagadeesh <pradeep.jagadeesh@huawei.com> Reviewed-by: Alberto Garcia <berto@igalia.com> (pass extra NULL CoMutex * argument to qemu_co_queue_wait(), added options to qemu-options.hx, Greg Kurz) Signed-off-by: Greg Kurz <groug@kaod.org>
2017-02-289pfs: fix v9fs_lock error casePaolo Bonzini1-8/+6
In this case, we are marshaling an error status instead of the errno value. Reorganize the out and out_nofid labels to look like all the other cases. Coverity reports this because the "err = -ENOENT" and "err = -EINVAL" assignments above are dead, overwritten by the call to pdu_marshal. (Coverity issues CID1348512 and CID1348513) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (also open-coded the success path since locking is a nop for us, Greg Kurz) Signed-off-by: Greg Kurz <groug@kaod.org>
2017-02-28Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell3-32/+98
staging # gpg: Signature made Mon 27 Feb 2017 16:33:23 GMT # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: tests-aio-multithread: use atomic_read properly iscsi: do not use aio_context_acquire/release nfs: do not use aio_context_acquire/release curl: do not use aio_context_acquire/release Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28syscall: fixed mincore(2) not failing with ENOMEMFranklin \"Snaipe\" Mathieu1-3/+8
The current implementation of the mincore(2) syscall sets errno to EFAULT when the region identified by the first two parameters is invalid. This goes against the man page specification, where mincore(2) should only fail with EFAULT when the third parameter is an invalid address; and fail with ENOMEM when the checked region does not point to mapped memory. Signed-off-by: Franklin "Snaipe" Mathieu <snaipe@diacritic.io> Cc: Riku Voipio <riku.voipio@linaro.org> Cc: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-02-28hw/acpi/tco.c: fix tco timer stopIgor Pavlikevich1-0/+1
TCO timer does not actually stop Signed-off-by: Igor Pavlikevich <ipavlikevich@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>