summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-01-27armv7m: set CFSR.UNDEFINSTR on undefined instructionsMichael Davidsaver
When we take an exception for an undefined instruction, set the appropriate CFSR bit. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-7-git-send-email-peter.maydell@linaro.org [PMM: tweaked commit message, comment] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: honour CCR.STACKALIGN on exception entryMichael Davidsaver
The CCR.STACKALIGN bit controls whether the CPU is supposed to force 8-alignment of the stack pointer on entry to the exception handler. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Message-id: 1485285380-10565-6-git-send-email-peter.maydell@linaro.org [PMM: commit message and comment tweaks] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: implement CCR, CFSR, HFSR, DFSR, BFAR, and MMFARMichael Davidsaver
Implement the v7M system registers CCR, CFSR, HFSR, DFSR, BFAR and MMFAR. For the moment these simply read as written (with some basic handling of RAZ/WI bits and W1C semantics). Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-5-git-send-email-peter.maydell@linaro.org [PMM: drop warning about setting unimplemented CCR bits; tweak commit message; add DFSR] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: add state for v7M CCR, CFSR, HFSR, DFSR, MMFAR, BFARPeter Maydell
Add the structure fields, VMState fields, reset code and macros for the v7M system control registers CCR, CFSR, HFSR, DFSR, MMFAR and BFAR. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-4-git-send-email-peter.maydell@linaro.org
2017-01-27armv7m_nvic: keep a pointer to the CPUMichael Davidsaver
Many NVIC operations access the CPU state, so store a pointer in struct nvic_state rather than fetching it via qemu_get_cpu() every time we need it. As with the arm_gicv3_common code, we currently just call qemu_get_cpu() in the NVIC's realize method, but in future we might want to use a QOM property to pass the CPU to the NVIC. This imposes an ordering requirement that the CPU is realized before the NVIC, but that is always true since both are dealt with in armv7m_init(). Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-3-git-send-email-peter.maydell@linaro.org [PMM: Use qemu_get_cpu(0) rather than first_cpu; expand commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27target/arm: Drop IS_M() macroPeter Maydell
We only use the IS_M() macro in two places, and it's a bit of a namespace grab to put in cpu.h. Drop it in favour of just explicitly calling arm_feature() in the places where it was used. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1485285380-10565-2-git-send-email-peter.maydell@linaro.org
2017-01-27pflash_cfi01: fix per-device sector length in CFI tablePeter Maydell
For configurations of the pflash_cfi01 device which set it up with a device-width not equal to the width (ie where we are emulating multiple narrow flash devices wired up in parallel), we were giving incorrect values in the CFI data table: (1) the sector length entry should specify the sector length for a single device, not the length for the overall collection of devices (2) the number of blocks per device must not be divided by the number of devices because the resulting device size would not match the overall size (3) this then means that the overall write block size must be modified depending on the number of devices because the entry is per device and when the guest writes into the flash it calculates the write size by using the CFI entry (write size per device) multiplied by the number of chips. (It would alternatively be possible to modify the write block size in the CFI table (currently hardcoded at 2048) and leave the overall write block size alone.) This commit corrects these bugs, and adds a hw-compat property to retain the old behaviour on 2.8 and earlier versions. (The only board we have which uses this sort of flash config and has machine versioning is the "virt" board -- the PC uses a single flash device and so behaviour is unaffected whether using old-multiple-chip-handling or not.) Here is a configuration example from the vexpress board: VEXPRESS_FLASH_SIZE = 64M VEXPRESS_FLASH_SECT_SIZE 256K num-blocks = VEXPRESS_FLASH_SIZE / VEXPRESS_FLASH_SECT_SIZE = 256 sector-length = 256K width = 4 device-width = 2 The code will fill the CFI entry with the following entries: num-blocks = 256 sector-length = 128K writeblock_size = 2048 This results in two chips, each with 256 * 128K = 32M device size and a write block size of 2048. A sector erase will be sent to both chips, thus 256K must be erased. When the guest sends a block write command, it will write 4096 bytes data at once (2048 per device). Signed-off-by: David Engraf <david.engraf@sysgo.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: cleaned up and expanded commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: Clear FAULTMASK on return from non-NMI exceptionsMichael Davidsaver
FAULTMASK must be cleared on return from all exceptions other than NMI. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484937883-1068-7-git-send-email-peter.maydell@linaro.org
2017-01-27armv7m: Fix reads of CONTROL register bit 1Michael Davidsaver
The v7m CONTROL register bit 1 is SPSEL, which indicates the stack being used. We were storing this information not in v7m.control but in the separate v7m.other_sp structure field. Unfortunately, the code handling reads of the CONTROL register didn't take account of this, and so if SPSEL was updated by an exception entry or exit then a subsequent guest read of CONTROL would get the wrong value. Using a separate structure field doesn't really gain us anything in efficiency, so drop this unnecessary complexity in favour of simply storing all the bits in v7m.control. This is a migration compatibility break for M profile CPUs only. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484937883-1068-6-git-send-email-peter.maydell@linaro.org [PMM: rewrote commit message; use deposit32(); use FIELD to define constants for masking and shifting of CONTROL register fields ] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27hw/registerfields.h: Pull FIELD etc macros out of hw/register.hPeter Maydell
hw/register.h provides macros like FIELD which make it easy to define shift, mask and length constants for the fields within a register. Unfortunately register.h also includes a lot of other things, some of which will only compile in the softmmu build. Pull the FIELD macro and friends out into a separate header file, so they can be used in places like target/arm files which also get built in the user-only configs. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484937883-1068-5-git-send-email-peter.maydell@linaro.org
2017-01-27armv7m: Explicit error for bad vector tableMichael Davidsaver
Give an explicit error and abort when a load from the vector table fails. Architecturally this should HardFault (which will then immediately fail to load the HardFault vector and go into Lockup). Since we don't model Lockup, just report this guest error via cpu_abort(). This is more helpful than the previous behaviour of reading a zero, which is the address of the reset stack pointer and not a sensible location to jump to. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484937883-1068-4-git-send-email-peter.maydell@linaro.org [PMM: expanded commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: Replace armv7m.hack with unassigned_access handlerMichael Davidsaver
For v7m we need to catch attempts to execute from special addresses at 0xfffffff0 and above. Previously we did this with the aid of a hacky special purpose lump of memory in the address space and a check in translate.c for whether we were translating code at those addresses. We can implement this more cleanly using a CPU unassigned access handler which throws the exception if the unassigned access is for one of the special addresses. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1484937883-1068-3-git-send-email-peter.maydell@linaro.org [PMM: * drop the deletion of the "don't interrupt if PC is magic" code in arm_v7m_cpu_exec_interrupt() -- this is still required * don't generate an exception for unassigned accesses which aren't to the magic address -- although doing this is in theory correct in practice it will break currently working guests which rely on the RAZ/WI behaviour when they touch devices which we haven't modelled. * trigger EXCP_EXCEPTION_EXIT on is_exec, not !is_write ] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27armv7m: MRS/MSR: handle unprivileged accessMichael Davidsaver
The MRS and MSR instruction handling has a number of flaws: * unprivileged accesses should only be able to read CONTROL and the xPSR subfields, and only write APSR (others RAZ/WI) * privileged access should not be able to write xPSR subfields other than APSR * accesses to unimplemented registers should log as guest errors, not abort QEMU Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1484937883-1068-2-git-send-email-peter.maydell@linaro.org [PMM: rewrote commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27aspeed/smc: handle dummy bytes when doing fast reads in command modeCédric Le Goater
When doing fast read, a certain amount of dummy bytes should be sent before the read. This number is configurable in the controler CE0 Control Register and needs to be modeled using fake transfers to the flash module. This only supports command mode. User mode requires more work and a possible extension of the m25p80 device model. Signed-off-by: Cédric Le Goater <clg@kaod.org> Acked-by: Marcin Krzemiński <mar.krzeminski@gmail.com> Message-id: 1484751701-2646-1-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27Merge remote-tracking branch 'remotes/berrange/tags/pull-qio-2017-01-26-1' ↵Peter Maydell
into staging Merge io/ 2017/01/26 # gpg: Signature made Thu 26 Jan 2017 10:26:48 GMT # gpg: using RSA key 0xBE86EBB415104FDF # gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" # gpg: aka "Daniel P. Berrange <berrange@redhat.com>" # Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF * remotes/berrange/tags/pull-qio-2017-01-26-1: io: fix possible double free of task error object Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170126' into stagingPeter Maydell
One compile fix for s390x with kvm enabled. # gpg: Signature made Thu 26 Jan 2017 10:57:55 GMT # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170126: s390x/flic: fix compilation of kvm flic Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Thu 26 Jan 2017 10:19:35 GMT # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: aio-posix: honor is_external in AioContext polling Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-27Merge remote-tracking branch 'remotes/famz/tags/for-upstream' into stagingPeter Maydell
# gpg: Signature made Thu 26 Jan 2017 02:44:47 GMT # gpg: using RSA key 0xCA35624C6A9171C6 # gpg: Good signature from "Fam Zheng <famz@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 5003 7CB7 9706 0F76 F021 AD56 CA35 624C 6A91 71C6 * remotes/famz/tags/for-upstream: test-hbitmap: Add hbitmap_is_serializable() calls hbitmap: Add hbitmap_is_serializable() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-26io: fix possible double free of task error objectDaniel P. Berrange
If a QIOTask has an error set and the calling code uses qio_task_propagate_error() to steal the reference to that Error object, the task would not clear its own reference. This would lead to a double-free when qio_task_free runs, if the caller had (correctly) freed the Error object they now owned. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-01-26aio-posix: honor is_external in AioContext pollingStefan Hajnoczi
AioHandlers marked ->is_external must be skipped when aio_node_check() fails. bdrv_drained_begin() needs this to prevent dataplane from submitting new I/O requests while another thread accesses the device and relies on it being quiesced. This patch fixes the following segfault: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00005577f6127dad in bdrv_io_plug (bs=0x5577f7ae52f0) at qemu/block/io.c:2650 2650 bdrv_io_plug(child->bs); [Current thread is 1 (Thread 0x7ff5c4bd1c80 (LWP 10917))] (gdb) bt #0 0x00005577f6127dad in bdrv_io_plug (bs=0x5577f7ae52f0) at qemu/block/io.c:2650 #1 0x00005577f6114363 in blk_io_plug (blk=0x5577f7b8ba20) at qemu/block/block-backend.c:1561 #2 0x00005577f5d4091d in virtio_blk_handle_vq (s=0x5577f9ada030, vq=0x5577f9b3d2a0) at qemu/hw/block/virtio-blk.c:589 #3 0x00005577f5d4240d in virtio_blk_data_plane_handle_output (vdev=0x5577f9ada030, vq=0x5577f9b3d2a0) at qemu/hw/block/dataplane/virtio-blk.c:158 #4 0x00005577f5d88acd in virtio_queue_notify_aio_vq (vq=0x5577f9b3d2a0) at qemu/hw/virtio/virtio.c:1304 #5 0x00005577f5d8aaaf in virtio_queue_host_notifier_aio_poll (opaque=0x5577f9b3d308) at qemu/hw/virtio/virtio.c:2134 #6 0x00005577f60ca077 in run_poll_handlers_once (ctx=0x5577f79ddbb0) at qemu/aio-posix.c:493 #7 0x00005577f60ca268 in try_poll_mode (ctx=0x5577f79ddbb0, blocking=true) at qemu/aio-posix.c:569 #8 0x00005577f60ca331 in aio_poll (ctx=0x5577f79ddbb0, blocking=true) at qemu/aio-posix.c:601 #9 0x00005577f612722a in bdrv_flush (bs=0x5577f7c20970) at qemu/block/io.c:2403 #10 0x00005577f60c1b2d in bdrv_close (bs=0x5577f7c20970) at qemu/block.c:2322 #11 0x00005577f60c20e7 in bdrv_delete (bs=0x5577f7c20970) at qemu/block.c:2465 #12 0x00005577f60c3ecf in bdrv_unref (bs=0x5577f7c20970) at qemu/block.c:3425 #13 0x00005577f60bf951 in bdrv_root_unref_child (child=0x5577f7a2de70) at qemu/block.c:1361 #14 0x00005577f6112162 in blk_remove_bs (blk=0x5577f7b8ba20) at qemu/block/block-backend.c:491 #15 0x00005577f6111b1b in blk_remove_all_bs () at qemu/block/block-backend.c:245 #16 0x00005577f60c1db6 in bdrv_close_all () at qemu/block.c:2382 #17 0x00005577f5e60cca in main (argc=20, argv=0x7ffea6eb8398, envp=0x7ffea6eb8440) at qemu/vl.c:4684 The key thing is that bdrv_close() uses bdrv_drained_begin() and virtio_queue_host_notifier_aio_poll() must not be called. Thanks to Fam Zheng <famz@redhat.com> for identifying the root cause of this crash. Reported-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Tested-by: Alberto Garcia <berto@igalia.com> Message-id: 20170124095350.16679-1-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-01-26s390x/flic: fix compilation of kvm flicCornelia Huck
2c21ee7 ("migration: extend VMStateInfo") missed a void -> int return conversion for kvm_flic_save(). Fixes: 2c21ee7 ("migration: extend VMStateInfo") Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-01-26test-hbitmap: Add hbitmap_is_serializable() callsMax Reitz
Add calls to hbitmap_is_serializable() (asserting that it returns true) where necessary (i.e. before every series of (de-)serialization function invocations). Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20161115225746.3590-3-mreitz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>
2017-01-26hbitmap: Add hbitmap_is_serializable()Max Reitz
Bitmaps with a granularity of 58 or above can be neither serialized nor deserialized (see the comment in the function added in this series for an explanation). This patch adds a function so that we can check whether a bitmap actually can be (de-)serialized at all, thus avoiding failing the necessary assertion in hbitmap_serialization_granularity(). Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20161115225746.3590-2-mreitz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>
2017-01-25Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
This pull request fixes a 2.9 regression and a long standing bug that can cause 9p clients to hang. Other patches are minor enhancements. # gpg: Signature made Wed 25 Jan 2017 10:12:27 GMT # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@fr.ibm.com>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "Gregory Kurz (Cimai Technology) <gkurz@cimai.com>" # gpg: aka "Gregory Kurz (Meiosys Technology) <gkurz@meiosys.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9pfs: fix offset error in v9fs_xattr_read() 9pfs: local: trivial cosmetic fix in pwritev op 9pfs: fix off-by-one error in PDU free list tests: virtio-9p: improve error reporting 9pfs: add missing coroutine_fn annotations Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-25Merge remote-tracking branch 'remotes/xtensa/tags/20170124-xtensa' into stagingPeter Maydell
target/xtensa updates: - refactor CCOUNT/CCOMPARE (use QEMU timers instead of instruction counting); - support icount; run target/xtensa TCG tests with icount; - implement SMP prerequisites: static vector selection, RUNSTALL and RER/WER. # gpg: Signature made Wed 25 Jan 2017 00:27:51 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170124-xtensa: target-xtensa: implement RER/WER instructions target/xtensa: tests: clean up interrupt tests target/xtensa: tests: add memctl test target/xtensa: implement MEMCTL SR target/xtensa: fix ICACHE/DCACHE options detection target/xtensa: tests: add ccount write tests target/xtensa: tests: replace hardcoded interrupt masks target/xtensa: tests: fix timer tests target/xtensa: tests: run tests with icount target/xtensa: don't continue translation after exception target/xtensa: support icount target/xtensa: refactor CCOUNT/CCOMPARE target/xtensa: implement RUNSTALL target/xtensa: add static vectors selection Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-25Merge remote-tracking branch 'remotes/rth/tags/pull-nios-20170124' into stagingPeter Maydell
nios2 target support # gpg: Signature made Tue 24 Jan 2017 21:11:47 GMT # gpg: using RSA key 0xAD1270CC4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC 16A4 AD12 70CC 4DD0 279B * remotes/rth/tags/pull-nios-20170124: nios2: Add support for Nios-II R1 nios2: Add Altera 10M50 GHRD emulation nios2: Add periodic timer emulation nios2: Add IIC interrupt controller emulation nios2: Add usermode binaries emulation nios2: Add disas entries nios2: Add architecture emulation support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-25Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2017-01-24 # gpg: Signature made Tue 24 Jan 2017 20:27:08 GMT # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: (31 commits) hw/isa/isa-bus: Set category of the "isabus-bridge" device usb: Set category and description of the MTP device gdbstub.c: update old error report statements gdbstub.c: fix GDB connection segfault caused by empty machines scsi-disk: add 'fall through' comment to switch VERIFY cases Drop duplicate display option documentation hw/display/framebuffer.c: Avoid overflow for framebuffers > 4GB win32: use glib gpoll if glib >= 2.50 util/mmap-alloc: refactor a little bit for readability util/mmap-alloc: check parameter before using vfio: remove a duplicated word in comments docs: sync pci-ids.txt disas/cris.c: Fix Coverity warning about unchecked NULL lm32: milkymist-tmu2: fix another integer overflow hw/i386/kvmvapic: Remove dead code in patch_hypercalls() doc/usb2: fix typo qga: fix erroneous argument to strerror block: remove dead check pci-assign: avoid pointless stat qemu-img: remove dead check ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-259pfs: fix offset error in v9fs_xattr_read()Greg Kurz
The current code tries to copy `read_count' bytes starting at offset `offset' from a `read_count`-sized iovec. This causes v9fs_pack() to fail with ENOBUFS. Since the PDU iovec is already partially filled with `offset' bytes, let's skip them when creating `qiov_full' and have v9fs_pack() to copy the whole of it. Moreover, this is consistent with the other places where v9fs_init_qiov_from_pdu() is called. This fixes commit "bcb8998fac16 9pfs: call v9fs_init_qiov_from_pdu before v9fs_pack". Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-01-259pfs: local: trivial cosmetic fix in pwritev opGreg Kurz
Signed-off-by: Greg Kurz <groug@kaod.org>
2017-01-259pfs: fix off-by-one error in PDU free listGreg Kurz
The server can handle MAX_REQ - 1 PDUs at a time and the virtio-9p device has a MAX_REQ sized virtqueue. If the client manages to fill up the virtqueue, pdu_alloc() will fail and the request won't be processed without any notice to the client (it actually causes the linux 9p client to hang). This has been there since the beginning (commit 9f10751365b2 "virtio-9p: Add a virtio 9p device to qemu"), but it needs an agressive workload to run in the guest to show up. We actually allocate MAX_REQ PDUs and I see no reason not to link them all into the free list, so let's fix the init loop. Reported-by: Tuomas Tynkkynen <tuomas@tuxera.com> Suggested-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Greg Kurz <groug@kaod.org>
2017-01-25tests: virtio-9p: improve error reportingGreg Kurz
Signed-off-by: Greg Kurz <groug@kaod.org>
2017-01-259pfs: add missing coroutine_fn annotationsGreg Kurz
Signed-off-by: Greg Kurz <groug@kaod.org>
2017-01-24nios2: Add support for Nios-II R1Marek Vasut
Add remaining bits of the Altera NiosII R1 support into qemu, which is documentation, MAINTAINERS file entry, configure bits, arch_init and configuration files for both linux-user (userland binaries) and softmmu (hardware emulation). Signed-off-by: Marek Vasut <marex@denx.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-Id: <20170118220146.489-8-marex@denx.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-01-24nios2: Add Altera 10M50 GHRD emulationMarek Vasut
Add the Altera 10M50 Nios2 GHRD model. This allows emulating the 10M50 development kit with the Nios2 GHRD loaded in the FPGA. It is possible to boot Linux kernel and run userspace, thus far only from initrd as storage support is not yet implemented. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-Id: <20170118220146.489-7-marex@denx.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-01-24nios2: Add periodic timer emulationChris Wulff
Add the Altera timer model. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-Id: <20170118220146.489-6-marex@denx.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-01-24nios2: Add IIC interrupt controller emulationChris Wulff
Add the Altera Nios2 internal interrupt controller model. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-Id: <20170118220146.489-5-marex@denx.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-01-24nios2: Add usermode binaries emulationMarek Vasut
Add missing bits for qemu-user required for emulating Altera Nios2 userspace binaries. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-Id: <20170118220146.489-4-marex@denx.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-01-24nios2: Add disas entriesMarek Vasut
Add nios2 disassembler support. This patch is composed from binutils files from commit "Opcodes and assembler support for Nios II R2". The files from binutils used in this patch are: include/opcode/nios2.h include/opcode/nios2r1.h include/opcode/nios2r2.h opcodes/nios2-opc.c opcodes/nios2-dis.c Checkpatch says total: 114 errors, 0 warnings, 3609 lines checked , which is caused by a different coding style in those files. These warnings and errors are not addressed To let these files be easily synchronized between binutils and qemu. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Alexander Graf <agraf@suse.de> Message-Id: <20170118220146.489-2-marex@denx.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-01-24nios2: Add architecture emulation supportChris Wulff
Add support for emulating Altera NiosII R1 architecture into qemu. This patch is based on previous work by Chris Wulff from 2012 and updated to latest mainline QEMU. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Cc: Alexander Graf <agraf@suse.de> Message-Id: <20170118220146.489-3-marex@denx.de> [rth: Remove tlb_flush from nios2_cpu_reset.] Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-01-24hw/isa/isa-bus: Set category of the "isabus-bridge" deviceThomas Huth
It has "bridge" in its name, so it should be in the category DEVICE_CATEGORY_BRIDGE. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24usb: Set category and description of the MTP deviceThomas Huth
It's a storage device, so let's classify it accordingly. And while we're at it, also add a short description for people who do not know what MTP means. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24gdbstub.c: update old error report statementsZiyue Yang
Some updates from fprintf(stderr, ...) to error_report. Signed-off-by: Ziyue Yang <skiver.cloud.yzy@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24gdbstub.c: fix GDB connection segfault caused by empty machinesZiyue Yang
This patch is to fix the segmentation fault caused by attaching GDB to a QEMU instance initialized with "-M none" option. The bug can be reproduced by > ./qemu-system-x86_64 -M none -nographic -S -s and attach a GDB to it by > gdb -ex 'target remote :1234 The segmentation fault was originally caused by trying to read the information about CPU when communicating with GDB. However, it's impossible for any control flow to exist on an empty machine, nor can CPU's be hot plugged to an empty machine later by QOM commands. So I think simply disabling GDB connections on empty machines makes sense. Signed-off-by: Ziyue Yang <skiver.cloud.yzy@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24scsi-disk: add 'fall through' comment to switch VERIFY casesPeter Maydell
Commit 166dbda7e131 added some extra cases to a switch() such that the existing code is intended to fall through the new case statements. It's clear from the commit that this is intentional, but less clear to subsequent readers of the code, and not clear at all to static analysis tools like Coverity. Add a /* fall through */ comment to indicate the intent. (Fixes CID 1368287.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24Drop duplicate display option documentationSamuel Thibault
The curses and none possibilities are already documented on a separate line, so documenting it on the sdl line was both unneeded and confusing. Introduced in commit f04ec5afbb7d60a56863add800fd90ceee66f362 Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24hw/display/framebuffer.c: Avoid overflow for framebuffers > 4GBPeter Maydell
Coverity points out that calculating src_len by multiplying src_width by rows could overflow. This can only happen in the implausible case of a framebuffer larger than 4GB, but we may as well fix it, placating Coverity. (CID1005515) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24win32: use glib gpoll if glib >= 2.50Marc-André Lureau
A fix has been committed in upstream glib commit 210a9796f78eb90f76f1bd6a304e9fea05e97617. (See also related bug https://bugzilla.gnome.org/show_bug.cgi?id=764415) It is desirable to use the glib version instead of qemu copy, since it provides more debugging facilities (G_MAIN_POLL_DEBUG etc), and hopefully has a better maintainance. Hopefully, we can drop the qemu copy in a few years. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24util/mmap-alloc: refactor a little bit for readabilityCao jin
1st mmap returns *ptr* which aligns to host page size, | size + align | ------------------------------------------ ptr input param *align* could be 1M, or 2M, or host page size. After QEMU_ALIGN_UP, offset will >= 0 2nd mmap use flag MAP_FIXED, then it return ptr+offset, or else fail. If it success, then we will have something like: | offset | size | -------------------------------------- ptr ptr1 *ptr1* is what we really want to return, it equals ptr+offset. Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24util/mmap-alloc: check parameter before usingCao jin
Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24vfio: remove a duplicated word in commentsCao jin
Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>