qemu.git
5 years agotarget/i386: fix pcmpxstrx substring search
Joseph Myers [Thu, 10 Aug 2017 21:40:41 +0000 (21:40 +0000)] 
target/i386: fix pcmpxstrx substring search

One of the cases of the SSE4.2 pcmpestri / pcmpestrm / pcmpistri /
pcmpistrm instructions does a substring search.  The implementation of
this case in the pcmpxstrx helper is incorrect.  The operation in this
case is a search for a string (argument d to the helper) in another
string (argument s to the helper); if a copy of d at a particular
position would run off the end of s, the resulting output bit should
be 0 whether or not the strings match in the region where they
overlap, but the QEMU implementation was wrongly comparing only up to
the point where s ends and counting it as a match if an initial
segment of d matched a terminal segment of s.  Here, "run off the end
of s" means that some byte of d would overlap some byte outside of s;
thus, if d has zero length, it is considered to match everywhere,
including after the end of s.  This patch fixes the implementation to
correspond with the proper instruction semantics.  This fixes four gcc
test failures in my GCC 6-based testing.

Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Message-Id: <alpine.DEB.2.20.1708102139310.8101@digraph.polyomino.org.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agotarget/i386: fix packusdw in-place operation
Joseph Myers [Thu, 10 Aug 2017 00:24:23 +0000 (00:24 +0000)] 
target/i386: fix packusdw in-place operation

The SSE4.1 packusdw instruction combines source and destination
vectors of signed 32-bit integers into a single vector of unsigned
16-bit integers, with unsigned saturation.  When the source and
destination are the same register, this means each 32-bit element of
that register is used twice as an input, to produce two of the 16-bit
output elements, and so if the operation is carried out
element-by-element in-place, no matter what the order in which it is
applied to the elements, the first element's operation will overwrite
some future input.  The helper for packssdw avoids this issue by
computing the result in a local temporary and copying it to the
destination at the end; this patch fixes the packusdw helper to do
likewise.  This fixes three gcc test failures in my GCC 6-based
testing.

Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Message-Id: <alpine.DEB.2.20.1708100023050.9262@digraph.polyomino.org.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agotarget/i386: set rip_offset for further SSE instructions
Joseph Myers [Tue, 8 Aug 2017 23:51:29 +0000 (23:51 +0000)] 
target/i386: set rip_offset for further SSE instructions

It turns out that my recent fix to set rip_offset when emulating some
SSE4.1 instructions needs generalizing to cover a wider class of
instructions.  Specifically, every instruction in the sse_op_table7
table, coming from various instruction set extensions, has an 8-bit
immediate operand that comes after any memory operand, and so needs
rip_offset set for correctness if there is a memory operand that is
rip-relative, and my patch only set it for a subset of those
instructions.  This patch moves the rip_offset setting to cover the
wider class of instructions, so fixing 9 further gcc testsuite
failures in my GCC 6-based testing.  (I do not know whether there
might be still further classes of instructions missing this setting.)

Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Message-Id: <alpine.DEB.2.20.1708082350340.23380@digraph.polyomino.org.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agotarget/i386: fix pmovsx/pmovzx in-place operations
Joseph Myers [Tue, 8 Aug 2017 20:21:01 +0000 (20:21 +0000)] 
target/i386: fix pmovsx/pmovzx in-place operations

The SSE4.1 pmovsx* and pmovzx* instructions take packed 1-byte, 2-byte
or 4-byte inputs and sign-extend or zero-extend them to a wider vector
output.  The associated helpers for these instructions do the
extension on each element in turn, starting with the lowest.  If the
input and output are the same register, this means that all the input
elements after the first have been overwritten before they are read.
This patch makes the helpers extend starting with the highest element,
not the lowest, to avoid such overwriting.  This fixes many GCC test
failures (161 in the gcc testsuite in my GCC 6-based testing) when
testing with a default CPU setting enabling those instructions.

Signed-off-by: Joseph Myers <joseph@codesourcery.com>
Message-Id: <alpine.DEB.2.20.1708082018390.23380@digraph.polyomino.org.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging
Peter Maydell [Tue, 19 Sep 2017 09:13:50 +0000 (10:13 +0100)] 
Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Tue 19 Sep 2017 01:10:40 BST
# gpg:                using RSA key 0x7DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  hw/block/fdc: Convert to realize
  hw/ide: Convert DeviceClass init to realize
  AHCI: remove DPRINTF macro
  AHCI: pretty-print FIS to buffer instead of stderr
  AHCI: Rework IRQ constants
  AHCI: Replace DPRINTF with trace-events
  IDE: replace DEBUG_AIO with trace events
  ATAPI: Replace DEBUG_IDE_ATAPI with tracing events
  IDE: add tracing for data ports
  IDE: Add register hints to tracing
  IDE: replace DEBUG_IDE with tracing system
  hw/ide/microdrive: Mark the dscm1xxxx device with user_creatable = false
  ide: ahci: unparent children buses before freeing their memory

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/block/fdc: Convert to realize
Mao Zhongyi [Mon, 18 Sep 2017 14:05:14 +0000 (22:05 +0800)] 
hw/block/fdc: Convert to realize

Convert floppy_drive_init() to realize and rename it to
floppy_drive_realize().

Cc: John Snow <jsnow@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 87119b34f32e2acf7166165fb5d8e6fca787b3bc.1505737465.git.maozy.fnst@cn.fujitsu.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agohw/ide: Convert DeviceClass init to realize
Mao Zhongyi [Mon, 18 Sep 2017 14:05:13 +0000 (22:05 +0800)] 
hw/ide: Convert DeviceClass init to realize

Replace init with realize in IDEDeviceClass, which has errp
as a parameter. So all the implementations now use error_setg
instead of error_report for reporting error.

Cc: John Snow <jsnow@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: c4d27b4b5d9e37468e63e35214ce4833ca271542.1505737465.git.maozy.fnst@cn.fujitsu.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoAHCI: remove DPRINTF macro
John Snow [Mon, 18 Sep 2017 19:01:27 +0000 (15:01 -0400)] 
AHCI: remove DPRINTF macro

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20170901001502.29915-10-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoAHCI: pretty-print FIS to buffer instead of stderr
John Snow [Mon, 18 Sep 2017 19:01:26 +0000 (15:01 -0400)] 
AHCI: pretty-print FIS to buffer instead of stderr

The current FIS printing routines dump the FIS to screen. adjust this
such that it dumps to buffer instead, then use this ability to have
FIS dump mechanisms via trace-events instead of compiled defines.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20170901001502.29915-9-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoAHCI: Rework IRQ constants
John Snow [Mon, 18 Sep 2017 19:01:26 +0000 (15:01 -0400)] 
AHCI: Rework IRQ constants

Create a new enum so that we can name the IRQ bits, which will make debugging
them a little nicer if we can print them out. Not handled in this patch, but
this will make it possible to get a nice debug printf detailing exactly which
status bits are set, as it can be multiple at any given time.

As a consequence of this patch, it is no longer possible to set multiple IRQ
codes at once, but nothing was utilizing this ability anyway.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20170901001502.29915-8-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoAHCI: Replace DPRINTF with trace-events
John Snow [Mon, 18 Sep 2017 19:01:26 +0000 (15:01 -0400)] 
AHCI: Replace DPRINTF with trace-events

There are a few hangers-on that will be dealt with individually
in forthcoming patches.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20170901001502.29915-7-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoIDE: replace DEBUG_AIO with trace events
John Snow [Mon, 18 Sep 2017 19:01:26 +0000 (15:01 -0400)] 
IDE: replace DEBUG_AIO with trace events

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20170901001502.29915-6-jsnow@redhat.com
[Edited enum conditional for Clang --js]
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoATAPI: Replace DEBUG_IDE_ATAPI with tracing events
John Snow [Mon, 18 Sep 2017 19:01:26 +0000 (15:01 -0400)] 
ATAPI: Replace DEBUG_IDE_ATAPI with tracing events

As part of the ongoing effort to modernize the tracing facilities for
the IDE family of devices, remove PRINTFs in the ATAPI device with
actual tracing events.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20170901001502.29915-5-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoIDE: add tracing for data ports
John Snow [Mon, 18 Sep 2017 19:01:26 +0000 (15:01 -0400)] 
IDE: add tracing for data ports

To be used sparingly, but still interesting in the case of small
firmwares designed to reproduce bugs in QEMU IDE.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20170901001502.29915-4-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoIDE: Add register hints to tracing
John Snow [Mon, 18 Sep 2017 19:01:25 +0000 (15:01 -0400)] 
IDE: Add register hints to tracing

Name the registers for tracing purposes.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20170901001502.29915-3-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoIDE: replace DEBUG_IDE with tracing system
John Snow [Mon, 18 Sep 2017 19:01:25 +0000 (15:01 -0400)] 
IDE: replace DEBUG_IDE with tracing system

Remove the DEBUG_IDE preprocessor definition with something more
appropriately flexible, using the trace-events subsystem.

This will be less prone to bitrot and will more effectively allow
us to target just the functions we care about.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20170901001502.29915-2-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agohw/ide/microdrive: Mark the dscm1xxxx device with user_creatable = false
Thomas Huth [Mon, 18 Sep 2017 19:01:25 +0000 (15:01 -0400)] 
hw/ide/microdrive: Mark the dscm1xxxx device with user_creatable = false

QEMU currently aborts with an assertion message when the user is trying
to remove a dscm1xxxx again:

$ aarch64-softmmu/qemu-system-aarch64 -S -M integratorcp -nographic
QEMU 2.9.93 monitor - type 'help' for more information
(qemu) device_add dscm1xxxx,id=xyz
(qemu) device_del xyz
**
ERROR:qemu/qdev-monitor.c:872:qdev_unplug: assertion failed: (hotplug_ctrl)
Aborted (core dumped)

Looks like this device has to be wired up in code and is not meant
to be hot-pluggable, so let's mark it with user_creatable = false.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1503543783-17192-1-git-send-email-thuth@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoide: ahci: unparent children buses before freeing their memory
Igor Mammedov [Mon, 18 Sep 2017 19:01:25 +0000 (15:01 -0400)] 
ide: ahci: unparent children buses before freeing their memory

Fixes read after freeing error reported
  https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg04243.html
  Message-Id: <59a56959-ca12-ea75-33fa-ff07eba1b090@redhat.com>

ich9-ahci device creates ide buses and attaches them as QOM children
at realize time, however it forgets to properly clean them up
at unrealize time and frees memory containing these children,
with following call-chain:

   qdev_device_add()
     object_property_set_bool('realized', true)
       device_set_realized()
          ...
          pci_qdev_realize() -> pci_ich9_ahci_realize() -> ahci_realize()
               ...
               s->dev = g_new0(AHCIDevice, ports);
               ...
                  AHCIDevice *ad = &s->dev[i];
                  ide_bus_new(&ad->port, sizeof(ad->port), qdev, i, 1);
                  ^^^ creates bus in memory allocated by above gnew()
                      and adds it as child propety to ahci device
          ...
          hotplug_handler_plug(); -> goto post_realize_fail;
          pci_qdev_unrealize() -> pci_ich9_uninit() -> ahci_uninit()
              ...
               g_free(s->dev);
               ^^^ free memory that holds children busses

          return with error from device_set_realized()

As result later when qdev_device_add() tries to unparent ich9-ahci
after failed device_set_realized(),
    object_unparent() -> object_property_del_child()
iterates over existing QOM children including buses added by
ide_bus_new() and tries to unparent them, which causes access to
freed memory where they where located.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1503938085-169486-1-git-send-email-imammedo@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/kraxel/tags/audio-20170918-pull-request' into...
Peter Maydell [Mon, 18 Sep 2017 11:40:54 +0000 (12:40 +0100)] 
Merge remote-tracking branch 'remotes/kraxel/tags/audio-20170918-pull-request' into staging

audio: bugfixes for wm8750 and intel-hda.

# gpg: Signature made Mon 18 Sep 2017 12:15:26 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/audio-20170918-pull-request:
  audio: intel-hda: do not use old_mmio accesses
  wm8750: add record buffer underrun check

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoaudio: intel-hda: do not use old_mmio accesses
Matt Parker [Sun, 27 Aug 2017 19:20:38 +0000 (20:20 +0100)] 
audio: intel-hda: do not use old_mmio accesses

intel-hda is currently using the old_mmio accessors for io.
This updates the device to use .read and .write accessors instead.

Signed-off-by: Matt Parker <mtparkr@gmail.com>
Message-id: 20170827192038.28930-1-mtparkr@gmail.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agowm8750: add record buffer underrun check
Gerd Hoffmann [Fri, 1 Sep 2017 13:14:09 +0000 (15:14 +0200)] 
wm8750: add record buffer underrun check

Reported-by: niuguoxiang@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20170901131409.6712-1-kraxel@redhat.com

5 years agoqemu.py: Fix syntax error
Kevin Wolf [Mon, 18 Sep 2017 05:25:24 +0000 (07:25 +0200)] 
qemu.py: Fix syntax error

Python requires parentheses around multiline expression. This fixes the
breakage of all Python-based qemu-iotests cases that was introduced in
commit dab91d9aa0.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 20170918052524.4045-1-kwolf@redhat.com
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-tcg-20170917' into staging
Peter Maydell [Sun, 17 Sep 2017 15:24:48 +0000 (16:24 +0100)] 
Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20170917' into staging

tcg queued patches

# gpg: Signature made Sun 17 Sep 2017 16:03:28 BST
# gpg:                using RSA key 0x64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20170917:
  tcg/mips: Fully convert tcg_target_op_def
  tcg/sparc: Fully convert tcg_target_op_def
  tcg/ppc: Fully convert tcg_target_op_def
  tcg/arm: Fully convert tcg_target_op_def
  tcg/aarch64: Fully convert tcg_target_op_def
  tcg: Fix types in tcg_regset_{set,reset}_reg
  tcg: Remove tcg_regset_set32
  tcg: Remove tcg_regset_{or,and,andnot,not}
  tcg: Remove tcg_regset_set
  tcg: Remove tcg_regset_clear
  tcg: Add tcg_op_supported
  accel/tcg: move USER code to user-exec.c
  accel/tcg: move atomic_template.h to accel/tcg/
  accel/tcg: move tcg-runtime to accel/tcg/
  accel/tcg: move user-exec to accel/tcg/
  accel/tcg: move softmmu_template.h to accel/tcg/
  tcg/ppc: disable atomic write check on ppc32

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotcg/mips: Fully convert tcg_target_op_def
Richard Henderson [Thu, 14 Sep 2017 04:32:38 +0000 (21:32 -0700)] 
tcg/mips: Fully convert tcg_target_op_def

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg/sparc: Fully convert tcg_target_op_def
Richard Henderson [Thu, 14 Sep 2017 03:50:36 +0000 (06:50 +0300)] 
tcg/sparc: Fully convert tcg_target_op_def

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg/ppc: Fully convert tcg_target_op_def
Richard Henderson [Thu, 14 Sep 2017 02:29:32 +0000 (02:29 +0000)] 
tcg/ppc: Fully convert tcg_target_op_def

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg/arm: Fully convert tcg_target_op_def
Richard Henderson [Thu, 14 Sep 2017 00:38:44 +0000 (17:38 -0700)] 
tcg/arm: Fully convert tcg_target_op_def

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg/aarch64: Fully convert tcg_target_op_def
Richard Henderson [Mon, 11 Sep 2017 17:27:34 +0000 (10:27 -0700)] 
tcg/aarch64: Fully convert tcg_target_op_def

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg: Fix types in tcg_regset_{set,reset}_reg
Richard Henderson [Mon, 11 Sep 2017 19:50:42 +0000 (12:50 -0700)] 
tcg: Fix types in tcg_regset_{set,reset}_reg

There was a potential problem here with an ILP32 host
with 64 host registers.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg: Remove tcg_regset_set32
Richard Henderson [Mon, 11 Sep 2017 19:44:30 +0000 (12:44 -0700)] 
tcg: Remove tcg_regset_set32

It's not even clear what the interface REG and VAL32 were supposed to mean.
All uses had REG = 0 and VAL32 was the bitset assigned to the destination.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg: Remove tcg_regset_{or,and,andnot,not}
Richard Henderson [Mon, 11 Sep 2017 19:08:13 +0000 (12:08 -0700)] 
tcg: Remove tcg_regset_{or,and,andnot,not}

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg: Remove tcg_regset_set
Richard Henderson [Mon, 11 Sep 2017 18:58:44 +0000 (11:58 -0700)] 
tcg: Remove tcg_regset_set

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg: Remove tcg_regset_clear
Richard Henderson [Mon, 11 Sep 2017 18:25:55 +0000 (11:25 -0700)] 
tcg: Remove tcg_regset_clear

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg: Add tcg_op_supported
Richard Henderson [Thu, 17 Aug 2017 14:43:20 +0000 (07:43 -0700)] 
tcg: Add tcg_op_supported

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoaccel/tcg: move USER code to user-exec.c
Philippe Mathieu-Daudé [Tue, 12 Sep 2017 21:19:34 +0000 (18:19 -0300)] 
accel/tcg: move USER code to user-exec.c

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170912211934.20919-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoaccel/tcg: move atomic_template.h to accel/tcg/
Philippe Mathieu-Daudé [Mon, 11 Sep 2017 21:33:27 +0000 (18:33 -0300)] 
accel/tcg: move atomic_template.h to accel/tcg/

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20170911213328.9701-5-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoaccel/tcg: move tcg-runtime to accel/tcg/
Philippe Mathieu-Daudé [Mon, 11 Sep 2017 21:33:26 +0000 (18:33 -0300)] 
accel/tcg: move tcg-runtime to accel/tcg/

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170911213328.9701-4-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoaccel/tcg: move user-exec to accel/tcg/
Philippe Mathieu-Daudé [Mon, 11 Sep 2017 21:33:25 +0000 (18:33 -0300)] 
accel/tcg: move user-exec to accel/tcg/

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170911213328.9701-3-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoaccel/tcg: move softmmu_template.h to accel/tcg/
Thomas Huth [Mon, 11 Sep 2017 21:33:24 +0000 (18:33 -0300)] 
accel/tcg: move softmmu_template.h to accel/tcg/

The header is only used by accel/tcg/cputlb.c so we can
move it to the accel/tcg/ folder, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
[PMD: reword commit title to match series]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170911213328.9701-2-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg/ppc: disable atomic write check on ppc32
Philippe Mathieu-Daudé [Mon, 11 Sep 2017 20:49:36 +0000 (17:49 -0300)] 
tcg/ppc: disable atomic write check on ppc32

This fixes building for ppc64 on ppc32 (changed in 5964fca8a12c):

tcg/ppc/tcg-target.inc.c: In function 'tb_target_set_jmp_target':
include/qemu/compiler.h:86:30: error: static assertion failed: \
  "not expecting: sizeof(*(uint64_t *)jmp_addr) > ATOMIC_REG_SIZE"
QEMU_BUILD_BUG_ON(sizeof(*ptr) > ATOMIC_REG_SIZE); \
^
tcg/ppc/tcg-target.inc.c:1377:9: note: in expansion of macro 'atomic_set'
atomic_set((uint64_t *)jmp_addr, pair);
^

Suggested-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170911204936.5020-1-f4bug@amsat.org>
[rth: Added commentary requested by pmm.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into...
Peter Maydell [Sat, 16 Sep 2017 13:36:16 +0000 (14:36 +0100)] 
Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging

Python queue, 2017-09-15

# gpg: Signature made Sat 16 Sep 2017 00:14:01 BST
# gpg:                using RSA key 0x2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/python-next-pull-request:
  qemu.py: include debug information on launch error
  qemu.py: improve message on negative exit code
  qemu.py: use os.path.null instead of /dev/null
  qemu.py: avoid writing to stdout/stderr
  qemu.py: fix is_running() return before first launch()
  qtest.py: Few pylint/style fixes
  qmp.py: Avoid overriding a builtin object
  qmp.py: Avoid "has_key" usage
  qmp.py: Use object-based class for QEMUMonitorProtocol
  qmp.py: Couple of pylint/style fixes
  qemu.py: Use custom exceptions rather than Exception
  qemu.py: Simplify QMP key-conversion
  qemu.py: Use iteritems rather than keys()
  qemu|qtest: Avoid dangerous arguments
  qemu.py: Pylint/style fixes

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
Peter Maydell [Sat, 16 Sep 2017 11:36:53 +0000 (12:36 +0100)] 
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

# gpg: Signature made Fri 15 Sep 2017 18:39:41 BST
# gpg:                using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/tracing-pull-request:
  trace: Immediately apply per-vCPU state changes if a vCPU is being created

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoqemu.py: include debug information on launch error
Amador Pahim [Fri, 1 Sep 2017 11:28:21 +0000 (13:28 +0200)] 
qemu.py: include debug information on launch error

When launching a VM, if an exception happens and the VM is not
initiated, it might be useful to see the qemu command line and
the qemu command output.

This patch creates that message. Notice that self._iolog needs to be
cleaned up in the beginning of the launch() to make sure we will not
expose the qemu log from a previous launch if the current one fails.

Signed-off-by: Amador Pahim <apahim@redhat.com>
Message-Id: <20170901112829.2571-6-apahim@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: improve message on negative exit code
Amador Pahim [Fri, 1 Sep 2017 11:28:20 +0000 (13:28 +0200)] 
qemu.py: improve message on negative exit code

The current message shows 'self._args', which contains only part of the
options used in the Qemu command line.

This patch makes the qemu full args list an instance variable and then
uses it in the negative exit code message.

Message was moved outside the 'if is_running' block to make sure it will
be logged if the VM finishes before the call to shutdown().

Signed-off-by: Amador Pahim <apahim@redhat.com>
Message-Id: <20170901112829.2571-5-apahim@redhat.com>
[ehabkost: removed superfluous parenthesis]
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: use os.path.null instead of /dev/null
Amador Pahim [Fri, 1 Sep 2017 11:28:19 +0000 (13:28 +0200)] 
qemu.py: use os.path.null instead of /dev/null

For increased portability, let's use os.path.devnull.

Signed-off-by: Amador Pahim <apahim@redhat.com>
Message-Id: <20170901112829.2571-4-apahim@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: avoid writing to stdout/stderr
Amador Pahim [Fri, 1 Sep 2017 11:28:18 +0000 (13:28 +0200)] 
qemu.py: avoid writing to stdout/stderr

This module should not write directly to stdout/stderr. Instead, it
should either raise exceptions or just log the messages and let the
callers handle them and decide what to do. For example, scripts could
choose to send the log messages stderr or/and write them to a file if
verbose or debugging mode is enabled.

This patch replaces the writes to stderr by an exception in the
send_fd_scm() when _socket_scm_helper is not set or not present. In the
same method, the subprocess Popen will now redirect the stdout/stderr to
logging.debug instead of writing to system stderr. As consequence, since
the Popen.communicate() is now used (in order to get the stdout), the
further call to wait() became redundant and was replaced by
Popen.returncode.

The shutdown() message on negative exit code will now be logged
to logging.warn instead of written to system stderr.

Signed-off-by: Amador Pahim <apahim@redhat.com>
Message-Id: <20170901112829.2571-3-apahim@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: fix is_running() return before first launch()
Amador Pahim [Fri, 1 Sep 2017 11:28:17 +0000 (13:28 +0200)] 
qemu.py: fix is_running() return before first launch()

is_running() returns None when called before the first time we
call launch():

    >>> import qemu
    >>> vm = qemu.QEMUMachine('qemu-system-x86_64')
    >>> vm.is_running()
    >>>

It should return False instead. This patch fixes that.

For consistence, this patch removes the parenthesis from the
second clause as it's not really needed.

Signed-off-by: Amador Pahim <apahim@redhat.com>
Message-Id: <20170901112829.2571-2-apahim@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqtest.py: Few pylint/style fixes
Lukáš Doktor [Fri, 18 Aug 2017 14:26:13 +0000 (16:26 +0200)] 
qtest.py: Few pylint/style fixes

No actual code changes, just few pylint/style fixes.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-Id: <20170818142613.32394-11-ldoktor@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqmp.py: Avoid overriding a builtin object
Lukáš Doktor [Fri, 18 Aug 2017 14:26:12 +0000 (16:26 +0200)] 
qmp.py: Avoid overriding a builtin object

The "id" is a builtin method to get object's identity and should not be
overridden. This might bring some issues in case someone was directly
calling "cmd(..., id=id)" but I haven't found such usage on brief search
for "cmd\(.*id=".

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20170818142613.32394-10-ldoktor@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqmp.py: Avoid "has_key" usage
Lukáš Doktor [Fri, 18 Aug 2017 14:26:11 +0000 (16:26 +0200)] 
qmp.py: Avoid "has_key" usage

The "has_key" is deprecated in favor of "__in__" operator.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170818142613.32394-9-ldoktor@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqmp.py: Use object-based class for QEMUMonitorProtocol
Lukáš Doktor [Fri, 18 Aug 2017 14:26:10 +0000 (16:26 +0200)] 
qmp.py: Use object-based class for QEMUMonitorProtocol

There is no need to define QEMUMonitorProtocol as old-style class.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20170818142613.32394-8-ldoktor@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqmp.py: Couple of pylint/style fixes
Lukáš Doktor [Fri, 18 Aug 2017 14:26:09 +0000 (16:26 +0200)] 
qmp.py: Couple of pylint/style fixes

No actual code changes, just initializing attributes earlier to avoid
AttributeError on early introspection, a few pylint/style fixes and
docstring clarifications.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170818142613.32394-7-ldoktor@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: Use custom exceptions rather than Exception
Lukáš Doktor [Fri, 18 Aug 2017 14:26:08 +0000 (16:26 +0200)] 
qemu.py: Use custom exceptions rather than Exception

The naked Exception should not be widely used. It makes sense to be a
bit more specific and use better-suited custom exceptions. As a benefit
we can store the full reply in the exception in case someone needs it
when catching the exception.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20170818142613.32394-6-ldoktor@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: Simplify QMP key-conversion
Lukáš Doktor [Fri, 18 Aug 2017 14:26:07 +0000 (16:26 +0200)] 
qemu.py: Simplify QMP key-conversion

The QMP key conversion consist of '_'s to be replaced with '-'s, which
can easily be done by a single `str.replace` method which is faster and
does not require `string` module import.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20170818142613.32394-5-ldoktor@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: Use iteritems rather than keys()
Lukáš Doktor [Fri, 18 Aug 2017 14:26:06 +0000 (16:26 +0200)] 
qemu.py: Use iteritems rather than keys()

Let's avoid creating an in-memory list of keys and query for each value
and use `iteritems` which is an iterator of key-value pairs.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170818142613.32394-4-ldoktor@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu|qtest: Avoid dangerous arguments
Lukáš Doktor [Fri, 18 Aug 2017 14:26:05 +0000 (16:26 +0200)] 
qemu|qtest: Avoid dangerous arguments

The list object is mutable in python and potentially might modify other
object's arguments when used as default argument. Reproducer:

    >>> vm1 = QEMUMachine("qemu")
    >>> vm2 = QEMUMachine("qemu")
    >>> vm1._wrapper.append("foo")
    >>> print vm2._wrapper
    ['foo']

In this case the `args` is actually copied so it would be safe to keep
it, but it's not a good practice to keep it. The same issue applies in
inherited qtest module.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-Id: <20170818142613.32394-3-ldoktor@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoqemu.py: Pylint/style fixes
Lukáš Doktor [Fri, 18 Aug 2017 14:26:04 +0000 (16:26 +0200)] 
qemu.py: Pylint/style fixes

No actual code changes, just several pylint/style fixes and docstring
clarifications.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20170818142613.32394-2-ldoktor@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20170915' into staging
Peter Maydell [Fri, 15 Sep 2017 21:34:08 +0000 (22:34 +0100)] 
Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20170915' into staging

pull-seccomp-20170915

# gpg: Signature made Fri 15 Sep 2017 09:21:15 BST
# gpg:                using RSA key 0xDF32E7C0F0FFF9A2
# gpg: Good signature from "Eduardo Otubo (Senior Software Engineer) <otubo@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: D67E 1B50 9374 86B4 0723  DBAB DF32 E7C0 F0FF F9A2

* remotes/otubo/tags/pull-seccomp-20170915:
  buildsys: Move seccomp cflags/libs to per object
  seccomp: add resourcecontrol argument to command line
  seccomp: add spawn argument to command line
  seccomp: add elevateprivileges argument to command line
  seccomp: add obsolete argument to command line
  seccomp: changing from whitelist to blacklist

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/huth/tags/check-20170915' into staging
Peter Maydell [Fri, 15 Sep 2017 19:29:44 +0000 (20:29 +0100)] 
Merge remote-tracking branch 'remotes/huth/tags/check-20170915' into staging

Some fixes and improvements for various qtests by Eric and me.

# gpg: Signature made Fri 15 Sep 2017 08:37:21 BST
# gpg:                using RSA key 0x2ED9D774FE702DB5
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>"
# gpg:                 aka "Thomas Huth <thuth@redhat.com>"
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>"
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>"
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* remotes/huth/tags/check-20170915:
  qtest: Avoid passing raw strings through hmp()
  libqtest: Remove dead qtest_instances variable
  numa-test: Use hmp()
  qtest: Don't perform side effects inside assertion
  test-qga: Kill broken and dead QGA_TEST_SIDE_EFFECTING code
  tests: Fix broken ivshmem-server-msi/-irq tests
  tests/libqtest: Use a proper error message if QTEST_QEMU_BINARY is missing
  tests/test-hmp: Remove puv3 and tricore_testboard from the blacklist
  tests: Introduce generic device hot-plug/hot-unplug functions

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.11-20170915' into staging
Peter Maydell [Fri, 15 Sep 2017 18:00:16 +0000 (19:00 +0100)] 
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.11-20170915' into staging

ppc patch queue 2017-09-15

Here's the current batch of accumulated ppc patches.  These are all
pretty simple bugfixes or cleanups, no big new features here.

# gpg: Signature made Fri 15 Sep 2017 04:50:00 BST
# gpg:                using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.11-20170915:
  ppc/kvm: use kvm_vm_check_extension() in kvmppc_is_pr()
  spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()
  spapr_cpu_core: cleaning up qdev_get_machine() calls
  spapr_pci: don't create 64-bit MMIO window if we don't need to
  spapr_pci: convert sprintf() to g_strdup_printf()
  spapr_cpu_core: fail gracefully with non-pseries machine types
  xics: fix several error leaks
  vfio, spapr: Fix levels calculation
  spapr_pci: handle FDT creation errors with _FDT()
  spapr_pci: use the common _FDT() helper
  spapr: fix CAS-generated reset
  ppc/xive: fix OV5_XIVE_EXPLOIT bits
  spapr: only update SDR1 once per-cpu during CAS
  spapr_pci: use g_strdup_printf()
  spapr_pci: drop useless check in spapr_populate_pci_child_dt()
  spapr_pci: drop useless check in spapr_phb_vfio_get_loc_code()
  hw/ppc/spapr.c: cleaning up qdev_get_machine() calls
  net: Add SunGEM device emulation as found on Apple UniNorth

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotrace: Immediately apply per-vCPU state changes if a vCPU is being created
Lluís Vilanova [Tue, 12 Sep 2017 22:50:25 +0000 (01:50 +0300)] 
trace: Immediately apply per-vCPU state changes if a vCPU is being created

Right now, function trace_event_set_vcpu_state_dynamic() asynchronously enables
events in the case a vCPU is executing TCG code. If the vCPU is being created
this makes some events like "guest_cpu_enter" to not be traced.

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Reviewed-by: Emilio G. Cota <cota@braap.org>
Message-id: 150525662577.19850.13767570977540117247.stgit@frigg.lan
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agobuildsys: Move seccomp cflags/libs to per object
Fam Zheng [Thu, 7 Sep 2017 08:53:16 +0000 (16:53 +0800)] 
buildsys: Move seccomp cflags/libs to per object

Like many other libraries, libseccomp cflags and libs should only apply
to the building of necessary objects. Do so in the usual way with the
help of per object variables.

Signed-off-by: Fam Zheng <famz@redhat.com>
5 years agoseccomp: add resourcecontrol argument to command line
Eduardo Otubo [Mon, 13 Mar 2017 21:18:51 +0000 (22:18 +0100)] 
seccomp: add resourcecontrol argument to command line

This patch adds [,resourcecontrol=deny] to `-sandbox on' option. It
blacklists all process affinity and scheduler priority system calls to
avoid any bigger of the process.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>
5 years agoseccomp: add spawn argument to command line
Eduardo Otubo [Mon, 13 Mar 2017 21:16:01 +0000 (22:16 +0100)] 
seccomp: add spawn argument to command line

This patch adds [,spawn=deny] argument to `-sandbox on' option. It
blacklists fork and execve system calls, avoiding Qemu to spawn new
threads or processes.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>
5 years agoseccomp: add elevateprivileges argument to command line
Eduardo Otubo [Mon, 13 Mar 2017 21:13:27 +0000 (22:13 +0100)] 
seccomp: add elevateprivileges argument to command line

This patch introduces the new argument
[,elevateprivileges=allow|deny|children] to the `-sandbox on'. It allows
or denies Qemu process to elevate its privileges by blacklisting all
set*uid|gid system calls. The 'children' option will let forks and
execves run unprivileged.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>
5 years agoseccomp: add obsolete argument to command line
Eduardo Otubo [Wed, 1 Mar 2017 22:17:29 +0000 (23:17 +0100)] 
seccomp: add obsolete argument to command line

This patch introduces the argument [,obsolete=allow] to the `-sandbox on'
option. It allows Qemu to run safely on old system that still relies on
old system calls.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>
5 years agoseccomp: changing from whitelist to blacklist
Eduardo Otubo [Tue, 28 Feb 2017 20:13:12 +0000 (21:13 +0100)] 
seccomp: changing from whitelist to blacklist

This patch changes the default behavior of the seccomp filter from
whitelist to blacklist. By default now all system calls are allowed and
a small black list of definitely forbidden ones was created.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>
5 years agoqtest: Avoid passing raw strings through hmp()
Eric Blake [Mon, 11 Sep 2017 17:20:14 +0000 (12:20 -0500)] 
qtest: Avoid passing raw strings through hmp()

hmp() passes its string argument through the sprintf() family;
with a proper attribute, gcc -Wformat warns us when we do something
dangerous like passing a non-constant format string.  Fortunately,
all our strings were safe, but checking whether the string can
contain an unintended % is easy to avoid and therefore worth doing.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agolibqtest: Remove dead qtest_instances variable
Eric Blake [Mon, 11 Sep 2017 17:19:49 +0000 (12:19 -0500)] 
libqtest: Remove dead qtest_instances variable

Prior to commit 063c23d9, we were tracking a list of parallel
qtest objects, in order to safely clean up a SIGABRT handler
only after the last connection quits.  But when we switched to
more of glib's infrastructure, the list became dead code that
is never assigned to.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agonuma-test: Use hmp()
Eric Blake [Mon, 11 Sep 2017 17:19:47 +0000 (12:19 -0500)] 
numa-test: Use hmp()

Don't open-code something that has a convenient helper available.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agoqtest: Don't perform side effects inside assertion
Eric Blake [Mon, 11 Sep 2017 17:19:46 +0000 (12:19 -0500)] 
qtest: Don't perform side effects inside assertion

Assertions should be separate from the side effects, since in
theory, g_assert() can be disabled (in practice, we can't really
ever do that).

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agotest-qga: Kill broken and dead QGA_TEST_SIDE_EFFECTING code
Eric Blake [Mon, 11 Sep 2017 17:19:45 +0000 (12:19 -0500)] 
test-qga: Kill broken and dead QGA_TEST_SIDE_EFFECTING code

Back when the test was introduced, in commit 62c39b307, the
test was set up to run qemu-ga directly on the host performing
the test, and defaults to limiting itself to safe commands.  At
the time, it was envisioned that setting QGA_TEST_SIDE_EFFECTING
in the environment could cover a few more commands, while noting
the potential danger of those side effects running in the host.

But this has NEVER been tested: if you enable the environment
variable, the test WILL fail.  One obvious reason: if you are not
running as root, you'll probably get a permission failure when
trying to freeze the file systems, or when changing system time.
Less obvious: if you run the test as root (wow, you're brave), you
could end up hanging if the test tries to log things to a
temporarily frozen filesystem.  But the cutest reason of all: if
you get past the above hurdles, the test uses invalid JSON in
test_qga_fstrim() (missing '' around the dictionary key 'minimum'),
and will thus fail an assertion in qmp_fd().

Rather than leave this untested time-bomb in place, rip it out.
Hopefully, as originally envisioned, we can find an opportunity
to test an actual sandboxed guest where the guest-agent has
full permissions and will not unduly affect the host running
the test - if so, 'git revert' can be used if desired, for
salvaging any useful parts of this attempt.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agotests: Fix broken ivshmem-server-msi/-irq tests
Thomas Huth [Tue, 29 Aug 2017 17:03:51 +0000 (19:03 +0200)] 
tests: Fix broken ivshmem-server-msi/-irq tests

Broken with commit b4ba67d9a7025 ("libqos: Change PCI accessors to take
opaque BAR handle") a while ago, but nobody noticed since the tests are
not run by default: The msix_pba_bar is not correctly initialized
anymore if bir_pba has the same value as bir_table. With this fix,
"make check SPEED=slow" should work fine again.

Fixes: b4ba67d9a702507793c2724e56f98e9b0f7be02b
Tested-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agotests/libqtest: Use a proper error message if QTEST_QEMU_BINARY is missing
Thomas Huth [Mon, 28 Aug 2017 10:25:45 +0000 (12:25 +0200)] 
tests/libqtest: Use a proper error message if QTEST_QEMU_BINARY is missing

The user can currently still cause an abort() if running certain tests
(like the prom-env-test) without setting the QTEST_QEMU_BINARY first.
A similar problem has been fixed with commit 7c933ad61b8f3f51337
already, but forgot to also take care of the qtest_get_arch() function,
so let's introduce a proper wrapper around getenv("QTEST_QEMU_BINARY")
that can be used in both locations now.

Buglink: https://bugs.launchpad.net/qemu/+bug/1713434
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agotests/test-hmp: Remove puv3 and tricore_testboard from the blacklist
Thomas Huth [Thu, 24 Aug 2017 05:00:11 +0000 (07:00 +0200)] 
tests/test-hmp: Remove puv3 and tricore_testboard from the blacklist

The problem with puv3 has been fixed with 0ac241bcf9f9d99a252a352a162f
('unicore32: abort when entering "x 0" on the monitor') and the problem
with tricore_testboard has been fixed with b190f477e29c7cd03a8fee49c96d
('qemu-system-tricore: segfault when entering "x 0" on the monitor').

Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agotests: Introduce generic device hot-plug/hot-unplug functions
Thomas Huth [Tue, 15 Aug 2017 06:58:54 +0000 (08:58 +0200)] 
tests: Introduce generic device hot-plug/hot-unplug functions

A lot of tests provide code for adding and removing a device via the
device_add and device_del QMP commands. Maintaining this code in so many
places is cumbersome and error-prone (some of the code parts check the
responses for device deletion in an incorrect way, for example, we've got
to deal with both, error code and DEVICE_DEL event here). So let's provide
some proper generic functions for adding and removing a device instead.

The code for correctly unplugging a device has been taken from a patch
from Peter Xu.

Reviewed-by: Peter Xu <peterx@redhat.com>
Tested-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agoppc/kvm: use kvm_vm_check_extension() in kvmppc_is_pr()
Greg Kurz [Thu, 14 Sep 2017 10:48:04 +0000 (12:48 +0200)] 
ppc/kvm: use kvm_vm_check_extension() in kvmppc_is_pr()

If the host has both KVM PR and KVM HV loaded and we pass:

-machine pseries,accel=kvm,kvm-type=PR

the kvmppc_is_pr() returns false instead of true. Since the helper
is mostly used as fallback, it doesn't have any real impact with
recent kernels. A notable exception is the workaround to allow
migration between compatible hosts with different PVRs (eg, POWER8
and POWER8E), since KVM still doesn't provide a way to check if a
specific PVR is supported (see commit c363a37a450f for details).

According to the official KVM API documentation [1], KVM_PPC_GET_PVINFO
is "vm ioctl", but we check it as a global ioctl. The following function
in KVM is hence called with kvm == NULL and considers we're in HV mode.

int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
{
int r;
/* Assume we're using HV mode when the HV module is loaded */
int hv_enabled = kvmppc_hv_ops ? 1 : 0;

if (kvm) {
/*
 * Hooray - we know which VM type we're running on. Depend on
 * that rather than the guess above.
 */
hv_enabled = is_kvmppc_hv_enabled(kvm);
}

Let's use kvm_vm_check_extension() to fix the issue.

[1] https://www.kernel.org/doc/Documentation/virtual/kvm/api.txt

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()
Greg Kurz [Tue, 12 Sep 2017 18:48:05 +0000 (20:48 +0200)] 
spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()

QTAILQ_FOREACH_SAFE() must be used when removing the current element
inside the loop block.

This fixes a user-after-free error introduced by commit 56258174238eb
and reported by Coverity (CID 1381017).

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_cpu_core: cleaning up qdev_get_machine() calls
Greg Kurz [Tue, 12 Sep 2017 06:51:21 +0000 (08:51 +0200)] 
spapr_cpu_core: cleaning up qdev_get_machine() calls

This patch removes the qdev_get_machine() calls that are made
in spapr_cpu_core.c in situations where we can get an existing
pointer for the MachineState by either passing it as an argument
to the function or by using other already available pointers.

Credits to Daniel Henrique Barboza for the idea and the changelog
text.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: don't create 64-bit MMIO window if we don't need to
Greg Kurz [Mon, 11 Sep 2017 10:14:19 +0000 (12:14 +0200)] 
spapr_pci: don't create 64-bit MMIO window if we don't need to

When running a pseries-2.2 or older machine type, we get the following
lines in info mtree:

address-space: memory
...
ffffffffffffffff-ffffffffffffffff (prio 0, i/o): alias
 pci@800000020000000.mmio64-alias @pci@800000020000000.mmio
  ffffffffffffffff-ffffffffffffffff

address-space: cpu-memory
...
ffffffffffffffff-ffffffffffffffff (prio 0, i/o): alias
 pci@800000020000000.mmio64-alias @pci@800000020000000.mmio
  ffffffffffffffff-ffffffffffffffff

The same thing occurs when running a pseries-2.7 with

    -global spapr-pci-host-bridge.mem_win_size=2147483648

This happens because we always create a 64-bit MMIO window, even if
we didn't explicitely requested it (ie, mem64_win_size == 0) and the
32-bit window is below 2GiB. It doesn't seem to have an impact on the
guest though because spapr_populate_pci_dt() doesn't advertise the
bogus windows when mem64_win_size == 0.

Since these memory regions don't induce any state, we can safely
choose to not create them when their address is equal to -1,
without breaking migration from existing setups.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: convert sprintf() to g_strdup_printf()
Greg Kurz [Mon, 11 Sep 2017 10:14:12 +0000 (12:14 +0200)] 
spapr_pci: convert sprintf() to g_strdup_printf()

In order to follow a QEMU common practice.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_cpu_core: fail gracefully with non-pseries machine types
Greg Kurz [Mon, 11 Sep 2017 20:52:06 +0000 (22:52 +0200)] 
spapr_cpu_core: fail gracefully with non-pseries machine types

Since commit 7cca3e466eb0 ("ppc: spapr: Move VCPU ID calculation into
sPAPR"), QEMU aborts when started with a *-spapr-cpu-core device and
a non-pseries machine.

Let's rely on the already existing call to object_dynamic_cast() instead
of using the SPAPR_MACHINE() macro.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoxics: fix several error leaks
Greg Kurz [Mon, 11 Sep 2017 22:04:40 +0000 (00:04 +0200)] 
xics: fix several error leaks

If object_property_get_link() fails then it allocates an error, which
must be freed before returning. The error_get_pretty() function is
merely an accessor to the error message and doesn't free anything.

The error.h header indicates how to do it right:

 * Pass an existing error to the caller with the message modified:
 *     error_propagate(errp, err);
 *     error_prepend(errp, "Could not frobnicate '%s': ", name);

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agovfio, spapr: Fix levels calculation
Alexey Kardashevskiy [Tue, 12 Sep 2017 02:53:07 +0000 (12:53 +1000)] 
vfio, spapr: Fix levels calculation

The existing tries to round up the number of pages but @pages is always
calculated as the rounded up value minus one  which makes ctz64() always
return 0 and have create.levels always set 1.

This removes wrong "-1" and allows having more than 1 levels. This becomes
handy for >128GB guests with standard 64K pages as this requires blocks
with zone order 9 and the popular limit of CONFIG_FORCE_MAX_ZONEORDER=9
means that only blocks up to order 8 are allowed.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: handle FDT creation errors with _FDT()
Greg Kurz [Sat, 9 Sep 2017 15:06:33 +0000 (17:06 +0200)] 
spapr_pci: handle FDT creation errors with _FDT()

libfdt failures when creating the FDT should cause QEMU to terminate.

Let's use the _FDT() macro which does just that instead of propagating
the error to the caller. spapr_populate_pci_child_dt() no longer needs
to return a value in this case.

Note that, on the way, this get rids of the following nonsensical lines:

    g_assert(!ret);
    if (ret) {

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: use the common _FDT() helper
Greg Kurz [Sat, 9 Sep 2017 15:06:25 +0000 (17:06 +0200)] 
spapr_pci: use the common _FDT() helper

All other users in hw/ppc already consider an error when building
the FDT to be fatal, even on hotplug paths. There's no valid reason
for spapr_pci to behave differently. So let's used the common _FDT()
helper which terminates QEMU when libfdt fails.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: fix CAS-generated reset
Cédric Le Goater [Fri, 8 Sep 2017 14:33:43 +0000 (16:33 +0200)] 
spapr: fix CAS-generated reset

The OV5_MMU_RADIX_300 requires special handling in the CAS negotiation
process. It is cleared from the option vector of the guest before
evaluating the changes and re-added later. But, when testing for a
possible CAS reset :

    spapr->cas_reboot = spapr_ovec_diff(ov5_updates,
                                        ov5_cas_old, spapr->ov5_cas);

the bit OV5_MMU_RADIX_300 will each time be seen as removed from the
previous OV5 set, hence generating a reset loop.

Fix this problem by also clearing the same bit in the ov5_cas_old set.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoppc/xive: fix OV5_XIVE_EXPLOIT bits
Cédric Le Goater [Fri, 8 Sep 2017 14:33:42 +0000 (16:33 +0200)] 
ppc/xive: fix OV5_XIVE_EXPLOIT bits

On POWER9, the Client Architecture Support (CAS) negotiation process
determines whether the guest operates in XIVE Legacy compatibility or
in XIVE exploitation mode. Now that we have initial guest support for
the XIVE interrupt controller, let's fix the bits definition which have
evolved in the latest specs.

The platform advertises the XIVE Exploitation Mode support using the
property "ibm,arch-vec-5-platform-support-vec-5", byte 23 bits 0-1 :

 - 0b00 XIVE legacy mode Only
 - 0b01 XIVE exploitation mode Only
 - 0b10 XIVE legacy or exploitation mode

The OS asks for XIVE Exploitation Mode support using the property
"ibm,architecture-vec-5", byte 23 bits 0-1:

 - 0b00 XIVE legacy mode Only
 - 0b01 XIVE exploitation mode Only

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: only update SDR1 once per-cpu during CAS
Greg Kurz [Mon, 4 Sep 2017 21:46:55 +0000 (23:46 +0200)] 
spapr: only update SDR1 once per-cpu during CAS

Commit b55d295e3ec9 added the possibility to support HPT resizing with KVM.
In the case of PR, we need to pass the userspace address of the HPT to KVM
using the SDR1 slot.
This is handled by kvmppc_update_sdr1() which uses CPU_FOREACH() to update
all CPUs. It is hence not needed to call kvmppc_update_sdr1() for each CPU.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: use g_strdup_printf()
Greg Kurz [Sat, 9 Sep 2017 15:06:18 +0000 (17:06 +0200)] 
spapr_pci: use g_strdup_printf()

Building strings with g_strdup_printf() instead of snprintf() is
a QEMU common practice.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: drop useless check in spapr_populate_pci_child_dt()
Greg Kurz [Sat, 9 Sep 2017 15:06:10 +0000 (17:06 +0200)] 
spapr_pci: drop useless check in spapr_populate_pci_child_dt()

spapr_phb_get_loc_code() either returns a non-null pointer, or aborts
if g_strdup_printf() failed to allocate memory.

Signed-off-by: Greg Kurz <groug@kaod.org>
[dwg: Grammatical fix to commit message]
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: drop useless check in spapr_phb_vfio_get_loc_code()
Greg Kurz [Sat, 9 Sep 2017 15:06:02 +0000 (17:06 +0200)] 
spapr_pci: drop useless check in spapr_phb_vfio_get_loc_code()

g_strdup_printf() either returns a non-null pointer, or aborts if it
failed to allocate memory.

Signed-off-by: Greg Kurz <groug@kaod.org>
[dwg: Grammatical fix to commit message]
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agohw/ppc/spapr.c: cleaning up qdev_get_machine() calls
Daniel Henrique Barboza [Wed, 6 Sep 2017 18:43:05 +0000 (15:43 -0300)] 
hw/ppc/spapr.c: cleaning up qdev_get_machine() calls

This patch removes the qdev_get_machine() calls that are made in
spapr.c in situations where we can get an existing pointer for
the MachineState by either passing it as an argument to the function
or by using other already available pointers.

The following changes were made:

- spapr_node0_size: static function that is called two times:
at spapr_setup_hpt_and_vrma and ppc_spapr_init. In both cases we can
pass an existing MachineState pointer to it.

- spapr_build_fdt: MachineState pointer can be retrieved from
the existing sPAPRMachineState pointer.

- spapr_boot_set: the opaque in the first arg is a sPAPRMachineState
pointer as we can see inside ppc_spapr_init:

    qemu_register_boot_set(spapr_boot_set, spapr);

We can get a MachineState pointer from it.

- spapr_machine_device_plug and spapr_machine_device_unplug_request: the
MachineState, sPAPRMachineState, MachineClass and sPAPRMachineClass pointers
can all be retrieved from the HotplugHandler pointer.

Signed-off-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agonet: Add SunGEM device emulation as found on Apple UniNorth
Benjamin Herrenschmidt [Wed, 6 Sep 2017 18:19:55 +0000 (19:19 +0100)] 
net: Add SunGEM device emulation as found on Apple UniNorth

This adds a simplistic emulation of the Sun GEM ethernet controller
found in Apple ASICs.

Currently we only support the Apple UniNorth 1.x variant, but the
other Apple or Sun variants should mostly be a matter of adding
PCI IDs options.

We have a very primitive emulation of a single Broadcom 5201 PHY
which is supported by the MacOS driver.

This model brings out-of-the-box networking to MacOS 9, and all
versions of OS X I tried with the mac99 platform.

Further improvements from Mark:
- Remove sungem.h file, moving constants into sungem.c as required
- Switch to using tracepoints for debugging
- Split register blocks into separate memory regions
- Use arrays in SunGEMState to hold register values
- Add state-saving support

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20170914' into...
Peter Maydell [Thu, 14 Sep 2017 17:54:09 +0000 (18:54 +0100)] 
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20170914' into staging

target-arm queue:
 * v7M: various code cleanups
 * v7M: set correct BFSR bits on bus fault
 * v7M: clear exclusive monitor on reset and exception entry/exit
 * v7M: don't apply priority mask to negative priorities
 * zcu102: support 'secure' and 'virtualization' machine properties
 * aarch64: fix ERET single stepping
 * gpex: implement PCI INTx routing
 * mps2-an511: fix UART overflow interrupt line wiring

# gpg: Signature made Thu 14 Sep 2017 18:50:48 BST
# gpg:                using RSA key 0x3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20170914:
  mps2-an511: Fix wiring of UART overflow interrupt lines
  hw/pci-host/gpex: Implement PCI INTx routing
  hw/arm/virt: Set INTx/gsi mapping
  hw/pci-host/gpex: Set INTx index/gsi mapping
  target/arm: Avoid an extra temporary for store_exclusive
  AArch64: Fix single stepping of ERET instruction
  xlnx-zcu102: Mark the EP108 machine as deprecated
  xlnx-zcu102: Add a machine level virtualization property
  xlnx-zcu102: Add a machine level secure property
  xlnx-zcu102: Manually create the machines
  xlnx-ep108: Rename to ZCU102
  target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
  target/arm: Add and use defines for EXCRET constants
  target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
  nvic: Don't apply group priority mask to negative priorities
  target/arm: Get PRECISERR and IBUSERR the right way round
  target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
  target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agomps2-an511: Fix wiring of UART overflow interrupt lines
Peter Maydell [Thu, 14 Sep 2017 17:43:19 +0000 (18:43 +0100)] 
mps2-an511: Fix wiring of UART overflow interrupt lines

Fix an error that meant we were wiring every UART's overflow
interrupts into the same inputs 0 and 1 of the OR gate,
rather than giving each its own input.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org

5 years agohw/pci-host/gpex: Implement PCI INTx routing
Pranavkumar Sawargaonkar [Thu, 14 Sep 2017 17:43:19 +0000 (18:43 +0100)] 
hw/pci-host/gpex: Implement PCI INTx routing

Now we are able to retrieve the gsi from the INTx pin, let's
enable intx_to_irq routing. From that point on, irqfd becomes
usable along with INTx when assigning a PCIe device.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/arm/virt: Set INTx/gsi mapping
Pranavkumar Sawargaonkar [Thu, 14 Sep 2017 17:43:19 +0000 (18:43 +0100)] 
hw/arm/virt: Set INTx/gsi mapping

Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
needed for INTx/gsi routing.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/pci-host/gpex: Set INTx index/gsi mapping
Pranavkumar Sawargaonkar [Thu, 14 Sep 2017 17:43:18 +0000 (18:43 +0100)] 
hw/pci-host/gpex: Set INTx index/gsi mapping

To implement INTx to gsi routing we need to pass the gpex host
bridge the gsi associated to each INTx index. Let's introduce
irq_num array and gpex_set_irq_num setter function.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotarget/arm: Avoid an extra temporary for store_exclusive
Richard Henderson [Thu, 14 Sep 2017 17:43:18 +0000 (18:43 +0100)] 
target/arm: Avoid an extra temporary for store_exclusive

Instead of copying addr to a local temp, reuse the value (which we
have just compared as equal) already saved in cpu_exclusive_addr.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>