aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-08-02arm/virt: Add support for GICv2 virtualization extensionsLuc Michel
Add support for GICv2 virtualization extensions by mapping the necessary I/O regions and connecting the maintenance IRQ lines. Declare those additions in the device tree and in the ACPI tables. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-21-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02xlnx-zynqmp: Improve GIC wiring and MMIO mappingLuc Michel
This commit improve the way the GIC is realized and connected in the ZynqMP SoC. The security extensions are enabled only if requested in the machine state. The same goes for the virtualization extensions. All the GIC to APU CPU(s) IRQ lines are now connected, including FIQ, vIRQ and vFIQ. The missing CPU to GIC timers IRQ connections are also added (HYP and SEC timers). The GIC maintenance IRQs are back-wired to the correct GIC PPIs. Finally, the MMIO mappings are reworked to take into account the ZynqMP specifics. The GIC (v)CPU interface is aliased 16 times: * for the first 0x1000 bytes from 0xf9010000 to 0xf901f000 * for the second 0x1000 bytes from 0xf9020000 to 0xf902f000 Mappings of the virtual interface and virtual CPU interface are mapped only when virtualization extensions are requested. The XlnxZynqMPGICRegion struct has been enhanced to be able to catch all this information. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20180727095421.386-20-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Improve tracesLuc Michel
Add some traces to the ARM GIC to catch register accesses (distributor, (v)cpu interface and virtual interface), and to take into account virtualization extensions (print `vcpu` instead of `cpu` when needed). Also add some virtualization extensions specific traces: LR updating and maintenance IRQ generation. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-19-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement maintenance interrupt generationLuc Michel
Implement the maintenance interrupt generation that is part of the GICv2 virtualization extensions. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-18-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement gic_update_virt() functionLuc Michel
Add the gic_update_virt() function to update the vCPU interface states and raise vIRQ and vFIQ as needed. This commit renames gic_update() to gic_update_internal() and generalizes it to handle both cases, with a `virt' parameter to track whether we are updating the CPU or vCPU interfaces. The main difference between CPU and vCPU is the way we select the best IRQ. This part has been split into the gic_get_best_(v)irq functions. For the virt case, the LRs are iterated to find the best candidate. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-17-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement the virtual interface registersLuc Michel
Implement the read and write functions for the virtual interface of the virtualization extensions in the GICv2. One mirror region per CPU is also created, which maps to that specific CPU id. This is required by the GIC architecture specification. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-16-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Wire the vCPU interfaceLuc Michel
Add the read/write functions to handle accesses to the vCPU interface. Those accesses are forwarded to the real CPU interface, with the CPU id being converted to the corresponding vCPU id (vCPU id = CPU id + GIC_NCPU). Signed-off-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180727095421.386-15-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement virtualization extensions in gic_cpu_(read|write)Luc Michel
Implement virtualization extensions in the gic_cpu_read() and gic_cpu_write() functions. Those are the last bits missing to fully support virtualization extensions in the CPU interface path. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-14-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement virtualization extensions in ↵Luc Michel
gic_(deactivate|complete_irq) Implement virtualization extensions in the gic_deactivate_irq() and gic_complete_irq() functions. When the guest writes an invalid vIRQ to V_EOIR or V_DIR, since the GICv2 specification is not entirely clear here, we adopt the behaviour observed on real hardware: * When V_CTRL.EOIMode is false (EOI split is disabled): - In case of an invalid vIRQ write to V_EOIR: -> If some bits are set in H_APR, an invalid vIRQ write to V_EOIR triggers a priority drop, and increments V_HCR.EOICount. -> If V_APR is already cleared, nothing happen - An invalid vIRQ write to V_DIR is ignored. * When V_CTRL.EOIMode is true: - In case of an invalid vIRQ write to V_EOIR: -> If some bits are set in H_APR, an invalid vIRQ write to V_EOIR triggers a priority drop. -> If V_APR is already cleared, nothing happen - An invalid vIRQ write to V_DIR increments V_HCR.EOICount. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180727095421.386-13-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement virtualization extensions in gic_acknowledge_irqLuc Michel
Implement virtualization extensions in the gic_acknowledge_irq() function. This function changes the state of the highest priority IRQ from pending to active. When the current CPU is a vCPU, modifying the state of an IRQ modifies the corresponding LR entry. However if we clear the pending flag before setting the active one, we lose track of the LR entry as it becomes invalid. The next call to gic_get_lr_entry() will fail. To overcome this issue, we call gic_activate_irq() before gic_clear_pending(). This does not change the general behaviour of gic_acknowledge_irq. We also move the SGI case in gic_clear_pending_sgi() to enhance code readability as the virtualization extensions support adds a if-else level. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-12-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement virtualization extensions in ↵Luc Michel
gic_(activate_irq|drop_prio) Implement virtualization extensions in gic_activate_irq() and gic_drop_prio() and in gic_get_prio_from_apr_bits() called by gic_drop_prio(). When the current CPU is a vCPU: - Use GIC_VIRT_MIN_BPR and GIC_VIRT_NR_APRS instead of their non-virt counterparts, - the vCPU APR is stored in the virtual interface, in h_apr. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-11-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Add virtualization enabled IRQ helper functionsLuc Michel
Add some helper functions to gic_internal.h to get or change the state of an IRQ. When the current CPU is not a vCPU, the call is forwarded to the GIC distributor. Otherwise, it acts on the list register matching the IRQ in the current CPU virtual interface. gic_clear_active can have a side effect on the distributor, even in the vCPU case, when the correponding LR has the HW field set. Use those functions in the CPU interface code path to prepare for the vCPU interface implementation. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727095421.386-10-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Refactor secure/ns access check in the CPU interfaceLuc Michel
An access to the CPU interface is non-secure if the current GIC instance implements the security extensions, and the memory access is actually non-secure. Until then, it was checked with tests such as if (s->security_extn && !attrs.secure) { ... } in various places of the CPU interface code. With the implementation of the virtualization extensions, those tests must be updated to take into account whether we are in a vCPU interface or not. This is because the exposed vCPU interface does not implement security extensions. This commits replaces all those tests with a call to the gic_cpu_ns_access() function to check if the current access to the CPU interface is non-secure. This function takes into account whether the current CPU is a vCPU or not. Note that this function is used only in the (v)CPU interface code path. The distributor code path is left unchanged, as the distributor is not exposed to vCPUs at all. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727095421.386-9-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Add virtualization extensions helper macros and functionsLuc Michel
Add some helper macros and functions related to the virtualization extensions to gic_internal.h. The GICH_LR_* macros help extracting specific fields of a list register value. The only tricky one is the priority field as only the MSB are stored. The value must be shifted accordingly to obtain the correct priority value. gic_is_vcpu() and gic_get_vcpu_real_id() help with (v)CPU id manipulation to abstract the fact that vCPU id are in the range [ GIC_NCPU; (GIC_NCPU + num_cpu) [. gic_lr_* and gic_virq_is_valid() help with the list registers. gic_get_lr_entry() returns the LR entry for a given (vCPU, irq) pair. It is meant to be used in contexts where we know for sure that the entry exists, so we assert that entry is actually found, and the caller can avoid the NULL check on the returned pointer. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-8-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Add virtual interface register definitionsLuc Michel
Add the register definitions for the virtual interface of the GICv2. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-7-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Add the virtualization extensions to the GIC stateLuc Michel
Add the necessary parts of the virtualization extensions state to the GIC state. We choose to increase the size of the CPU interfaces state to add space for the vCPU interfaces (the GIC_NCPU_VCPU macro). This way, we'll be able to reuse most of the CPU interface code for the vCPUs. The only exception is the APR value, which is stored in h_apr in the virtual interface state for vCPUs. This is due to some complications with the GIC VMState, for which we don't want to break backward compatibility. APRs being stored in 2D arrays, increasing the second dimension would lead to some ugly VMState description. To avoid that, we keep it in h_apr for vCPUs. The vCPUs are numbered from GIC_NCPU to (GIC_NCPU * 2) - 1. The `gic_is_vcpu` function help to determine if a given CPU id correspond to a physical CPU or a virtual one. For the in-kernel KVM VGIC, since the exposed VGIC does not implement the virtualization extensions, we report an error if the corresponding property is set to true. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-6-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02vmstate.h: Provide VMSTATE_UINT16_SUB_ARRAYLuc Michel
Provide a VMSTATE_UINT16_SUB_ARRAY macro to save a uint16_t sub-array in a VMState. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727095421.386-5-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Remove some dead code and put some functions staticLuc Michel
Some functions are now only used in arm_gic.c, put them static. Some of them where only used by the NVIC implementation and are not used anymore, so remove them. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-4-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Implement GICD_ISACTIVERn and GICD_ICACTIVERn registersLuc Michel
Implement GICD_ISACTIVERn and GICD_ICACTIVERn registers in the GICv2. Those registers allow to set or clear the active state of an IRQ in the distributor. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-3-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02intc/arm_gic: Refactor operations on the distributorLuc Michel
In preparation for the virtualization extensions implementation, refactor the name of the functions and macros that act on the GIC distributor to make that fact explicit. It will be useful to differentiate them from the ones that will act on the virtual interfaces. Signed-off-by: Luc Michel <luc.michel@greensocs.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180727095421.386-2-luc.michel@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02accel/tcg: Check whether TLB entry is RAM consistently with how we set it upPeter Maydell
We set up TLB entries in tlb_set_page_with_attrs(), where we have some logic for determining whether the TLB entry is considered to be RAM-backed, and thus has a valid addend field. When we look at the TLB entry in get_page_addr_code(), we use different logic for determining whether to treat the page as RAM-backed and use the addend field. This is confusing, and in fact buggy, because the code in tlb_set_page_with_attrs() correctly decides that rom_device memory regions not in romd mode are not RAM-backed, but the code in get_page_addr_code() thinks they are RAM-backed. This typically results in "Bad ram pointer" assertion if the guest tries to execute from such a memory region. Fix this by making get_page_addr_code() just look at the TLB_MMIO bit in the code_address field of the TLB, which tlb_set_page_with_attrs() sets if and only if the addend field is not valid for code execution. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180713150945.12348-1-peter.maydell@linaro.org
2018-08-02target/arm: Allow execution from small regionsPeter Maydell
Now that we have full support for small regions, including execution, we can remove the workarounds where we marked all small regions as non-executable for the M-profile MPU and SAU. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Cédric Le Goater <clg@kaod.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180710160013.26559-7-peter.maydell@linaro.org
2018-08-02accel/tcg: Return -1 for execution from MMIO regions in get_page_addr_code()Peter Maydell
Now that all the callers can handle get_page_addr_code() returning -1, remove all the code which tries to handle execution from MMIO regions or small-MMU-region RAM areas. This will mean that we can correctly execute from these areas, rather than ending up either aborting QEMU or delivering an incorrect guest exception. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Cédric Le Goater <clg@kaod.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180710160013.26559-6-peter.maydell@linaro.org
2018-08-02accel/tcg: tb_gen_code(): Create single-insn TB for execution from non-RAMPeter Maydell
If get_page_addr_code() returns -1, this indicates that there is no RAM page we can read a full TB from. Instead we must create a TB which contains a single instruction and which we do not cache, so it is executed only once. Since this means we can now have TBs which are not in any page list, we also need to make tb_phys_invalidate() handle them (by not trying to remove them from a nonexistent page list). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Emilio G. Cota <cota@braap.org> Tested-by: Cédric Le Goater <clg@kaod.org> Message-id: 20180710160013.26559-5-peter.maydell@linaro.org
2018-08-02accel/tcg: Handle get_page_addr_code() returning -1 in tb_check_watchpoint()Peter Maydell
When we support execution from non-RAM MMIO regions, get_page_addr_code() will return -1 to indicate that there is no RAM at the requested address. Handle this in tb_check_watchpoint() -- if the exception happened for a PC which doesn't correspond to RAM then there is no need to invalidate any TBs, because the one-instruction TB will not have been cached. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Cédric Le Goater <clg@kaod.org> Message-id: 20180710160013.26559-4-peter.maydell@linaro.org
2018-08-02accel/tcg: Handle get_page_addr_code() returning -1 in hashtable lookupsPeter Maydell
When we support execution from non-RAM MMIO regions, get_page_addr_code() will return -1 to indicate that there is no RAM at the requested address. Handle this in the cpu-exec TB hashtable lookup code, treating it as "no match found". Note that the call to get_page_addr_code() in tb_lookup_cmp() needs no changes -- a return of -1 will already correctly result in the function returning false. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Emilio G. Cota <cota@braap.org> Tested-by: Cédric Le Goater <clg@kaod.org> Message-id: 20180710160013.26559-3-peter.maydell@linaro.org
2018-08-02accel/tcg: Pass read access type through to io_readx()Peter Maydell
The io_readx() function needs to know whether the load it is doing is an MMU_DATA_LOAD or an MMU_INST_FETCH, so that it can pass the right value to the cpu_transaction_failed() function. Plumb this information through from the softmmu code. This is currently not often going to give the wrong answer, because usually instruction fetches go via get_page_addr_code(). However once we switch over to handling execution from non-RAM by creating single-insn TBs, the path for an insn fetch to generate a bus error will be through cpu_ld*_code() and io_readx(), so without this change we will generate a d-side fault when we should generate an i-side fault. We also have to pass the access type via a CPU struct global down to unassigned_mem_read(), for the benefit of the targets which still use the cpu_unassigned_access() hook (m68k, mips, sparc, xtensa). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Cédric Le Goater <clg@kaod.org> Message-id: 20180710160013.26559-2-peter.maydell@linaro.org
2018-08-02nvic: Change NVIC to support ARMv6-MJulia Suvorova
The differences from ARMv7-M NVIC are: * ARMv6-M only supports up to 32 external interrupts (configurable feature already). The ICTR is reserved. * Active Bit Register is reserved. * ARMv6-M supports 4 priority levels against 256 in ARMv7-M. Signed-off-by: Julia Suvorova <jusual@mail.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02arm: Add ARMv6-M programmer's model supportJulia Suvorova
Forbid stack alignment change. (CCR) Reserve FAULTMASK, BASEPRI registers. Report any fault as a HardFault. Disable MemManage, BusFault and UsageFault, so they always escalated to HardFault. (SHCSR) Signed-off-by: Julia Suvorova <jusual@mail.ru> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20180718095628.26442-1-jusual@mail.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02nvic: Handle ARMv6-M SCS reserved registersJulia Suvorova
Handle SCS reserved registers listed in ARMv6-M ARM D3.6.1. All reserved registers are RAZ/WI. ARM_FEATURE_M_MAIN is used for the checks, because these registers are reserved in ARMv8-M Baseline too. Signed-off-by: Julia Suvorova <jusual@mail.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-02target/arm: Forbid unprivileged mode for M BaselineJulia Suvorova
MSR handling is the only place where CONTROL.nPRIV is modified. Signed-off-by: Julia Suvorova <jusual@mail.ru> Message-id: 20180705222622.17139-1-jusual@mail.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31Update version for v3.0.0-rc3 releasePeter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2018-07-31' ↵Peter Maydell
into staging Monitor patches for 2018-07-31 (3.0.0-rc3) # gpg: Signature made Tue 31 Jul 2018 16:46:16 BST # gpg: using RSA key 3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-monitor-2018-07-31: monitor: temporary fix for dead-lock on event recursion Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31monitor: temporary fix for dead-lock on event recursionMarc-André Lureau
With a Spice port chardev, it is possible to reenter monitor_qapi_event_queue() (when the client disconnects for example). This will dead-lock on monitor_lock. Instead, use some TLS variables to check for recursion and queue the events. Fixes: (gdb) bt #0 0x00007fa69e7217fd in __lll_lock_wait () at /lib64/libpthread.so.0 #1 0x00007fa69e71acf4 in pthread_mutex_lock () at /lib64/libpthread.so.0 #2 0x0000563303567619 in qemu_mutex_lock_impl (mutex=0x563303d3e220 <monitor_lock>, file=0x5633036589a8 "/home/elmarco/src/qq/monitor.c", line=645) at /home/elmarco/src/qq/util/qemu-thread-posix.c:66 #3 0x0000563302fa6c25 in monitor_qapi_event_queue (event=QAPI_EVENT_SPICE_DISCONNECTED, qdict=0x56330602bde0, errp=0x7ffc6ab5e728) at /home/elmarco/src/qq/monitor.c:645 #4 0x0000563303549aca in qapi_event_send_spice_disconnected (server=0x563305afd630, client=0x563305745360, errp=0x563303d8d0f0 <error_abort>) at qapi/qapi-events-ui.c:149 #5 0x00005633033e600f in channel_event (event=3, info=0x5633061b0050) at /home/elmarco/src/qq/ui/spice-core.c:235 #6 0x00007fa69f6c86bb in reds_handle_channel_event (reds=<optimized out>, event=3, info=0x5633061b0050) at reds.c:316 #7 0x00007fa69f6b193b in main_dispatcher_self_handle_channel_event (info=0x5633061b0050, event=3, self=0x563304e088c0) at main-dispatcher.c:197 #8 0x00007fa69f6b193b in main_dispatcher_channel_event (self=0x563304e088c0, event=event@entry=3, info=0x5633061b0050) at main-dispatcher.c:197 #9 0x00007fa69f6d0833 in red_stream_push_channel_event (s=s@entry=0x563305ad8f50, event=event@entry=3) at red-stream.c:414 #10 0x00007fa69f6d086b in red_stream_free (s=0x563305ad8f50) at red-stream.c:388 #11 0x00007fa69f6b7ddc in red_channel_client_finalize (object=0x563304df2360) at red-channel-client.c:347 #12 0x00007fa6a56b7fb9 in g_object_unref () at /lib64/libgobject-2.0.so.0 #13 0x00007fa69f6ba212 in red_channel_client_push (rcc=0x563304df2360) at red-channel-client.c:1341 #14 0x00007fa69f68b259 in red_char_device_send_msg_to_client (client=<optimized out>, msg=0x5633059b6310, dev=0x563304e08bc0) at char-device.c:305 #15 0x00007fa69f68b259 in red_char_device_send_msg_to_clients (msg=0x5633059b6310, dev=0x563304e08bc0) at char-device.c:305 #16 0x00007fa69f68b259 in red_char_device_read_from_device (dev=0x563304e08bc0) at char-device.c:353 #17 0x000056330317d01d in spice_chr_write (chr=0x563304cafe20, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111) at /home/elmarco/src/qq/chardev/spice.c:199 #18 0x00005633034deee7 in qemu_chr_write_buffer (s=0x563304cafe20, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111, offset=0x7ffc6ab5ea70, write_all=false) at /home/elmarco/src/qq/chardev/char.c:112 #19 0x00005633034df054 in qemu_chr_write (s=0x563304cafe20, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111, write_all=false) at /home/elmarco/src/qq/chardev/char.c:147 #20 0x00005633034e1e13 in qemu_chr_fe_write (be=0x563304dbb800, buf=0x563304cc50b0 "{\"timestamp\": {\"seconds\": 1532944763, \"microseconds\": 326636}, \"event\": \"SHUTDOWN\", \"data\": {\"guest\": false}}\r\n", len=111) at /home/elmarco/src/qq/chardev/char-fe.c:42 #21 0x0000563302fa6334 in monitor_flush_locked (mon=0x563304dbb800) at /home/elmarco/src/qq/monitor.c:425 #22 0x0000563302fa6520 in monitor_puts (mon=0x563304dbb800, str=0x563305de7e9e "") at /home/elmarco/src/qq/monitor.c:468 #23 0x0000563302fa680c in qmp_send_response (mon=0x563304dbb800, rsp=0x563304df5730) at /home/elmarco/src/qq/monitor.c:517 #24 0x0000563302fa6905 in qmp_queue_response (mon=0x563304dbb800, rsp=0x563304df5730) at /home/elmarco/src/qq/monitor.c:538 #25 0x0000563302fa6b5b in monitor_qapi_event_emit (event=QAPI_EVENT_SHUTDOWN, qdict=0x563304df5730) at /home/elmarco/src/qq/monitor.c:624 #26 0x0000563302fa6c4b in monitor_qapi_event_queue (event=QAPI_EVENT_SHUTDOWN, qdict=0x563304df5730, errp=0x7ffc6ab5ed00) at /home/elmarco/src/qq/monitor.c:649 #27 0x0000563303548cce in qapi_event_send_shutdown (guest=false, errp=0x563303d8d0f0 <error_abort>) at qapi/qapi-events-run-state.c:58 #28 0x000056330313bcd7 in main_loop_should_exit () at /home/elmarco/src/qq/vl.c:1822 #29 0x000056330313bde3 in main_loop () at /home/elmarco/src/qq/vl.c:1862 #30 0x0000563303143781 in main (argc=3, argv=0x7ffc6ab5f068, envp=0x7ffc6ab5f088) at /home/elmarco/src/qq/vl.c:4644 Note that error report is now moved to the first caller, which may receive an error for a recursed event. This is probably fine (95% of callers use &error_abort, the rest have NULL error and ignore it) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180731150144.14022-1-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [*_no_recurse renamed to *_no_reenter, local variables reordered] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2018-07-31Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-3.0-pull-request' into staging Fix safe_syscall() on ppc64 host Fix mmap() 0 length error case # gpg: Signature made Tue 31 Jul 2018 09:41:07 BST # gpg: using RSA key F30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-3.0-pull-request: linux-user: ppc64: don't use volatile register during safe_syscall tests: add check_invalid_maps to test-mmap linux-user/mmap.c: handle invalid len maps correctly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
Bug fixes. # gpg: Signature made Mon 30 Jul 2018 13:00:39 BST # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: backends/cryptodev: remove dead code timer: remove replay clock probe in deadline calculation i386: implement MSR_SMI_COUNT for TCG i386: do not migrate MSR_SMI_COUNT on machine types <2.12 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180731' into stagingPeter Maydell
fix large guests on s390x # gpg: Signature made Tue 31 Jul 2018 07:47:38 BST # gpg: using RSA key DECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180731: s390x/sclp: fix maxram calculation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-31linux-user: ppc64: don't use volatile register during safe_syscallShivaprasad G Bhat
r11 is a volatile register on PPC as per calling conventions. The safe_syscall code uses it to check if the signal_pending is set during the safe_syscall. When a syscall is interrupted on return from signal handling, the r11 might be corrupted before we retry the syscall leading to a crash. The registers r0-r13 are not to be used here as they have volatile/designated/reserved usages. Change the code to use r14 which is non-volatile. Use SP+16 which is a slot for LR, for save/restore of previous value of r14. SP+16 can be used, as LR is preserved across the syscall. Steps to reproduce: On PPC host, issue `qemu-x86_64 /usr/bin/cc -E -` Attempt Ctrl-C, the issue is reproduced. Reference: https://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi-1.9.html#REG https://openpowerfoundation.org/wp-content/uploads/2016/03/ABI64BitOpenPOWERv1.1_16July2015_pub4.pdf Signed-off-by: Shivaprasad G Bhat <sbhat@linux.vnet.ibm.com> Tested-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <153301568965.30312.10498134581068746871.stgit@dhcp-9-109-246-16> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-07-31tests: add check_invalid_maps to test-mmapAlex Bennée
This adds a test to make sure we fail properly for a 0 length mmap. There are most likely other failure conditions we should also check. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: umarcor <1783362@bugs.launchpad.net> Message-Id: <20180730134321.19898-3-alex.bennee@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-07-31linux-user/mmap.c: handle invalid len maps correctlyAlex Bennée
I've slightly re-organised the check to more closely match the sequence that the kernel uses in do_mmap(). We check for both the zero case (EINVAL) and the overflow length case (ENOMEM). Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: umarcor <1783362@bugs.launchpad.net> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20180730134321.19898-2-alex.bennee@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2018-07-30Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - qemu-img convert -C is now required to enable copy offloading - file-posix: Fix write_zeroes with unmap on block devices (would fall back to explicit writes on recent kernels) - Fix query-blockstats interface for use with -blockdev - Minor fixes and documentation updates # gpg: Signature made Mon 30 Jul 2018 16:08:14 BST # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: qemu-iotests: Test query-blockstats with -drive and -blockdev block/qapi: Include anonymous BBs in query-blockstats block/qapi: Add 'qdev' field to query-blockstats result file-posix: Fix write_zeroes with unmap on block devices block: Fix documentation for BDRV_REQ_MAY_UNMAP iotests: Add test for 'qemu-img convert -C' compatibility qemu-img: Add -C option for convert with copy offloading Revert "qemu-img: Document copy offloading implications with -S and -c" iotests: Don't lock /dev/null in 226 docs: Describe using images in writing iotests file-posix: Handle EINTR in preallocation=full write qcow2: A grammar fix in conflicting cache sizing error message qcow: fix a reference leak Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20180730' into staging target-arm queue: * arm/smmuv3: Fix broken VM state migration * armv7m_nvic: Fix broken VM state migration * hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host() * hw/arm/iotkit: Fix IRQ number for timer1 * hw/misc/tz-mpc: Zero the LUT on initialization, not just reset * target/arm: Remove duplicate 'host' entry in '-cpu ?' output # gpg: Signature made Mon 30 Jul 2018 15:16:01 BST # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180730: target/arm: Remove duplicate 'host' entry in '-cpu ?' output hw/misc/tz-mpc: Zero the LUT on initialization, not just reset hw/arm/iotkit: Fix IRQ number for timer1 armv7m_nvic: Fix m-security subsection name hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host() arm/smmuv3: Fix missing VMSD terminator Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30s390x/sclp: fix maxram calculationChristian Borntraeger
We clamp down ram_size to match the sclp increment size. We do not do the same for maxram_size, which means for large guests with some sizes (e.g. -m 50000) maxram_size differs from ram_size. This can break other code (e.g. CMMA migration) which uses maxram_size to calculate the number of pages and then throws some errors. Fixes: 82fab5c5b90e468f3e9d54c ("s390x/sclp: remove memory hotplug support") Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> CC: qemu-stable@nongnu.org CC: David Hildenbrand <david@redhat.com> Message-Id: <1532959766-53343-1-git-send-email-borntraeger@de.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-07-30target/arm: Remove duplicate 'host' entry in '-cpu ?' outputpull-target-arm-20180730Philippe Mathieu-Daudé
Since 86f0a186d6f the TYPE_ARM_HOST_CPU is only compiled when CONFIG_KVM is enabled. Remove the now redundant special-case introduced in a96c0514ab7, to avoid: $ qemu-system-aarch64 -machine virt -cpu \? | fgrep host host host (only available in KVM mode) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727132311.2777-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30hw/misc/tz-mpc: Zero the LUT on initialization, not just resetPeter Maydell
In the tz-mpc device we allocate a data block for the LUT, which we then clear to zero in the device's reset method. This is conceptually fine, but unfortunately results in a valgrind complaint about use of uninitialized data on startup: ==30906== Conditional jump or move depends on uninitialised value(s) ==30906== at 0x503609: tz_mpc_translate (tz-mpc.c:439) ==30906== by 0x3F3D90: address_space_translate_iommu (exec.c:511) ==30906== by 0x3F3FF8: flatview_do_translate (exec.c:584) ==30906== by 0x3F4292: flatview_translate (exec.c:644) ==30906== by 0x3F2120: address_space_translate (memory.h:1962) ==30906== by 0x3FB753: address_space_ldl_internal (memory_ldst.inc.c:36) ==30906== by 0x3FB8A6: address_space_ldl (memory_ldst.inc.c:80) ==30906== by 0x619037: ldl_phys (memory_ldst_phys.inc.h:25) ==30906== by 0x61985D: arm_cpu_reset (cpu.c:255) ==30906== by 0x98791B: cpu_reset (cpu.c:249) ==30906== by 0x57FFDB: armv7m_reset (armv7m.c:265) ==30906== by 0x7B1775: qemu_devices_reset (reset.c:69) This is because of a reset ordering problem -- the TZ MPC resets after the CPU, but an M-profile CPU's reset function includes memory loads to get the initial PC and SP, which then go through an MPC that hasn't yet been reset. The simplest fix for this is to zero the LUT when we initialize the data, which will result in the MPC's translate function giving the right answers for these early memory accesses. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Thomas Huth <thuth@redhat.com> Message-id: 20180724153616.32352-1-peter.maydell@linaro.org
2018-07-30hw/arm/iotkit: Fix IRQ number for timer1Peter Maydell
A cut-and-paste error meant we were incorrectly wiring up the timer1 IRQ to IRQ3. IRQ3 is the interrupt for timer0 -- move timer0 to IRQ4 where it belongs. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727113854.20283-3-peter.maydell@linaro.org
2018-07-30armv7m_nvic: Fix m-security subsection namePeter Maydell
The vmstate save/load code insists that subsections of a VMState must have names which include their parent VMState's name as a leading substring. Unfortunately it neither documents this nor checks it on device init or state save, but instead fails state load with a confusing error message ("Missing section footer for armv7m_nvic"). Fix the name of the m-security subsection of the NVIC, so that state save/load works correctly for the security-enabled NVIC. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180727113854.20283-2-peter.maydell@linaro.org
2018-07-30hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host()Geert Uytterhoeven
When copy_properties_from_host() ignores the error for an optional property, it frees the error, but fails to reset it. Hence if two or more optional properties are missing, an assertion is triggered: util/error.c:57: error_setv: Assertion `*errp == NULL' failed. Fis this by resetting err to NULL after ignoring the error. Fixes: 9481cf2e5f2f2bb6 ("hw/arm/sysbus-fdt: helpers for clock node generation") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Message-id: 20180725113000.11014-1-geert+renesas@glider.be Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30arm/smmuv3: Fix missing VMSD terminatorDr. David Alan Gilbert
The 'vmstate_smmuv3_queue' is missing the end-of-list marker. Fixes: 10a83cb9887 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20180727135406.15132-1-dgilbert@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: dropped stray blank line] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-30qemu-iotests: Test query-blockstats with -drive and -blockdevKevin Wolf
Make sure that query-blockstats returns information for every BlockBackend that is named or attached to a device model (or both). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-14 10:39:46 +0000