Commit Graph

20739 Commits

Author SHA1 Message Date
Jannik Vogel a9db473231 Check for GL debug extensions before use 2018-07-01 14:50:50 -07:00
Jannik Vogel 0f190369d3 Switch from GLEW to epoxy 2018-07-01 14:21:53 -07:00
Matt Borgerson 0523deaa93 nv2a: Recycle FIFO command queue memory
This patch adds an additional "retired" queue in which FIFO command
entry objects are placed after execution. This queue of objects is then
returned to the pusher's new "available" queue for re-use.

This improves the performance of the system by avoiding the costly
overhead associated with the general-purpose use of `malloc` and `free`
for previous allocation of FIFO command queue objects.
2018-06-28 10:17:57 -07:00
Matt Borgerson ae19795682 Add xbox hardware directory to hw/Makefile.objs 2018-06-26 17:07:42 -07:00
Matt Borgerson 6eb2e9ac93 Update Xbox Makefile.objs 2018-06-26 17:07:42 -07:00
Matt Borgerson dc57d0e3c0 Add offscreen GL code 2018-06-26 17:07:41 -07:00
Matt Borgerson 584dbda1d6 Fix and refactor NV2A code
This patch does the following:
- Fixes up things for Qemu 2.x compat
- Factors out the high-level NV2A blocks into separate files
- Updates g-lru-cache for latest glib compat (github.com/chergert/glrucache@c10af24)
- Changes texture hashing algorithm from FNV to xxH v0.6.5
2018-06-26 17:07:41 -07:00
Matt Borgerson cff0d97e35 Add SDL2 gamepad based XID emulation 2018-06-26 17:07:41 -07:00
Matt Borgerson 6629cc354a Fix keyboard based XID emulation 2018-06-26 17:07:41 -07:00
Matt Borgerson 20414991be Fix Xbox ACI/APU code 2018-06-26 17:07:41 -07:00
Matt Borgerson a87f67f143 Fix Xbox SuperIO code 2018-06-26 17:07:41 -07:00
Matt Borgerson 5e1deea596 Fix Xbox ACPI code 2018-06-26 17:07:41 -07:00
Matt Borgerson fcc596cb7f Fix Xbox DSP code 2018-06-26 17:07:41 -07:00
Matt Borgerson 6f2eafa9bb Fix NVNet code 2018-06-26 17:07:41 -07:00
Matt Borgerson 65c5afbeac Fix Xbox SMBus devices 2018-06-26 17:07:41 -07:00
Matt Borgerson 3486a4f1f4 Fix basic Chihiro machine init (IDE still needs fixing) 2018-06-26 17:07:41 -07:00
Matt Borgerson 8e24af7bda Fix basic Xbox machine init 2018-06-26 17:07:41 -07:00
Matt Borgerson 7aa5985eba [Core Change] Port AC97 factorization from XQEMU 1.x 2018-06-26 17:07:40 -07:00
Matt Borgerson 9ced180a0c [Core Change] Port smbus_eeprom_init_single from XQEMU 1.x
This patch is necessary to initialize a single EEPROM at a specific I2C
address.
2018-06-26 17:07:40 -07:00
Matt Borgerson 7ea10931d1 [Core Change] Port HDD locking from XQEMU 1.x 2018-06-26 17:07:40 -07:00
Matt Borgerson 68b54a7cc9 [Core Change] Fix PM timer at 3.375 MHz for Xbox compat 2018-06-26 17:07:40 -07:00
Matt Borgerson 70de2f76b0 [Core Change] Fix TSC timer at 733 MHz for Xbox compat 2018-06-26 17:07:33 -07:00
Matt Borgerson 410702189f [Core Change] Fix PIC interrupt delivery by unmasking LINT0 in APIC for BSP 2018-06-26 15:09:46 -07:00
Matt Borgerson 6338bfae98 [Core Change] Port i8259 fixes from XQEMU 1.x
32cba22 i8259: in edge triggered mode apparently a training edge should cancel the interrupt
ad6aef5 nforce chipset seems to allow setting irq0-3 to level triggered
2018-06-26 15:09:42 -07:00
Matt Borgerson 0ed317ff4b [Core Change] Port USB fixes from XQEMU 1.x
commit 761d06bab6
Author: espes <espes@pequalsnp.com>
Date:   Thu Sep 5 01:45:37 2013 +1000

ohci: fix handling of transfer underruns

See:
https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devices/USB/DevOHCI.cpp#L2343
https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devices/USB/DevOHCI.cpp#L2363

commit d532051a8e
Author: espes <espes@pequalsnp.com>
Date:   Mon Oct 19 17:38:38 2015 +1100

usb hub: don't return an overrun when there's no new status
2018-06-26 15:09:35 -07:00
Matt Borgerson 3f557e6d45 Add hw/xbox sources from XQEMU 1.x @ 4d9107e 2018-06-26 15:08:01 -07:00
Jason Wang aebbdbee55 vhost: do not verify ring mappings when IOMMU is enabled
When IOMMU is enabled, we store virtqueue metadata as iova (though it
may has _phys suffix) and access them through dma helpers. Any
translation failures could be reported by IOMMU.

In this case, trying to validate iova against gpa won't work and will
cause a false error reporting. So this patch bypasses the ring
verification if IOMMU is enabled which is similar to the behavior
before 0ca1fd2d68 that calls vhost_memory_map() which is a nop when
IOMMU is enabled.

Fixes: 0ca1fd2d68 ("vhost: Simplify ring verification checks")
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2018-04-16 19:11:38 +03:00
Peter Maydell 6670b494fd hw/char/cmsdk-apb-uart.c: Correctly clear INTSTATUS bits on writes
The CMSDK APB UART INTSTATUS register bits are all write-one-to-clear.
We were getting this correct for the TXO and RXO bits (which need
special casing because their state lives in the STATE register),
but had forgotten to handle the normal bits for RX and TX which
we do store in our s->intstatus field.

Perform the W1C operation on the bits in s->intstatus too.

Fixes: https://bugs.launchpad.net/qemu/+bug/1760262
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180410134203.17552-1-peter.maydell@linaro.org
2018-04-11 17:00:49 +01:00
Peter Maydell 6523eaca37 Handle read-modify-write i/o with icount
-----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJazUOrAAoJEGTfOOivfiFf9IkIALqO7vtUL5Oj6rs0M0OCpG3Q
 VEWw/2xxLdfEorijWN/UcSft2uxoEZbpK2bmkvmj9RoxKbXAwt2Vh9j4ANuPJM81
 e4k61aOG3MTMzpwZ5kFvaT0ixAcPylVyi9u7JZNNbOhSetUqAOcPd7m6qhoFMKfs
 W+8J4KZsJj9OT2I/X71QI6TfrVzmiMlTtzyhFTYxPr+UiTfADBuw/tDBpEQTJYVE
 ooTZJEQMR4B1MkvFU9s6Q5WIVRF0dxwqtfdmCRzUBFWY1Yz5ZJoQl34RBT3/mBHk
 WOaty6jICooEgKPmpECxLYBCS9gUqH1nt2SpCHCvgnVhX7o+beAyrLXYGGCKRhE=
 =J6yr
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20180411' into staging

Handle read-modify-write i/o with icount

# gpg: Signature made Wed 11 Apr 2018 00:07:23 BST
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20180411:
  icount: fix cpu_restore_state_from_tb for non-tb-exit cases

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-11 14:23:56 +01:00
Peter Maydell 9d2a090639 Block layer patches
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJazM/UAAoJEH8JsnLIjy/WOawP/3Y7LeEcINgDmGUc5qjmmsuT
 MQ9E3rFK14FWUjpqj+eXVuHPLIeTZRP6BFsoAh0oS1PkgxSbZkznjO0DeuNAbtZj
 RgUqRjq74UZeTqmCJ/J4bvDVgkA+h/xIf8Sp8lnV8ILaLzzy1JZNj/y8W+E3r9fQ
 9zadVAhvpr0P60wCzPKqCZh5EKovf79uWxccdKonE5dweK1emzyM1W9jkoI0Acr8
 MJ6P54I/xh8yc/3kavDpFJaUI9wEXOqRvhykQYJCjsCk6EOjy841kkx/01bx4Tty
 IhItPR9l4rgELezj/nqRYwp+sFkmdpmycuOuVvD1p4ScvE9ExG19rnGY3YQhZSUw
 oTUFhRNcCqaP2kmaQgwzMgXgQcfpNa3HX5E9gou85MMabfF51xWTgngj5d0iWtYT
 HrjbeBNLh+nijpodSergMD7/3jownabKGn3YgHekx2bZqTraw7LiMz52lFYpax/0
 xOmDrxglTCNPODUgs10I8D1vPEgmInnDjYlTw4KSR/ZeD8bg1FaROVs2gTq3xFx7
 p2iOQmKknmYEwfQMYKbyHES43bbyyqBMhSvKGJUCut1eNtWLIUiyBeWC90jLRKHN
 /TLo1hWBywhKEO+L/4cYoK/nEU2e9gq2i+c23dzaaICbdvYQJYJHo+irXFlK8rRo
 ImrG952WiKuNXL0NQBEo
 =EvpH
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches

# gpg: Signature made Tue 10 Apr 2018 15:53:08 BST
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  qemu-iotests: update 185 output
  commit/stream: Reset delay_ns
  qemu-iotests: Remove _supported_fmt dmg
  iotests: blacklist bochs and cloop for 205 and 208
  iotests.py: improve verify_image_format helper
  hw/block/pflash_cfi: fix off-by-one error
  iotests.py: support unsupported_fmts in main()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-11 09:44:32 +01:00
Pavel Dovgalyuk afd46fcad2 icount: fix cpu_restore_state_from_tb for non-tb-exit cases
In icount mode, instructions that access io memory spaces in the middle
of the translation block invoke TB recompilation.  After recompilation,
such instructions become last in the TB and are allowed to access io
memory spaces.

When the code includes instruction like i386 'xchg eax, 0xffffd080'
which accesses APIC, QEMU goes into an infinite loop of the recompilation.

This instruction includes two memory accesses - one read and one write.
After the first access, APIC calls cpu_report_tpr_access, which restores
the CPU state to get the current eip.  But cpu_restore_state_from_tb
resets the cpu->can_do_io flag which makes the second memory access invalid.
Therefore the second memory access causes a recompilation of the block.
Then these operations repeat again and again.

This patch moves resetting cpu->can_do_io flag from
cpu_restore_state_from_tb to cpu_loop_exit* functions.

It also adds a parameter for cpu_restore_state which controls restoring
icount.  There is no need to restore icount when we only query CPU state
without breaking the TB.  Restoring it in such cases leads to the
incorrect flow of the virtual time.

In most cases new parameter is true (icount should be recalculated).
But there are two cases in i386 and openrisc when the CPU state is only
queried without the need to break the TB.  This patch fixes both of
these cases.

Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Message-Id: <20180409091320.12504.35329.stgit@pasha-VirtualBox>
[rth: Make can_do_io setting unconditional; move from cpu_exec;
make cpu_loop_exit_{noexc,restore} call cpu_loop_exit.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2018-04-11 09:05:22 +10:00
Peter Maydell 69550301ec ppc patch queue 2018-04-10
Here's a rather late pull request with a handful of fixes for 2.12.
 These have been blocked for some time, because I wasn't able to
 complete my usual test set due to the SCSI problem fixed in 37c5174
 "scsi-disk: Don't enlarge min_io_size to max_io_size".
 
 Since we're in hard freeze, these are all bugfixes.  Most are also
 regressions, although in one case it's only a "regression" because a
 longstanding bug has been exposed by a new machine type (sam460ex) in
 the testcases.  There are also a couple of sam460ex fixes that aren't
 regressions since the board didn't exist before.  On the flipside
 though, they're low risk because they only touch board specific code
 for a board that doesn't exist in any released version.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEdfRlhq5hpmzETofcbDjKyiDZs5IFAlrMZDAACgkQbDjKyiDZ
 s5ITgg/9F4IXYPu7/wW+pBgnC+ZNV7s498K2FQqOVPHQEAh98SyBcxLTCWCWwQhW
 eOxHFfcKMv6HTWNVyXReFpXJJez33sZ3a0qD3u0a5w0uFSkDYVbCOM7S5qPjFU94
 r7KZWg6IAN3cMAuy0bqfl+Jo5gRolZ8pdo3dSwKLitJfLpOsUclc9DimHiVQfLmW
 ve6e8ILlZCKmY646gO4+t1EXCDAK4JthcP5FqSMOSzHnFT0hu/j+Wt3sZ2kr2EZC
 GblEG86dW2n9f1uVIjpmRDqJJNljAutWO1eLmplK1k6pRdmjjGrBSHdF3V7s9yoN
 kMllr6mthoucNHg55AbjsC6owgNJAXxJz6BnnKMycTRW/7z4exg/MaMlPhMFxZ9w
 94gr1p9EdEW0Uvxjm+bYdZVrxskogoDo7HxzBs8HoMmTmCvpXRi7i86XZA87seKz
 F/4SNHtZLlt6W20sfcCAtDwo3rw3rkiV9/WbhJSFV9u1lYUJR5x3tq4c4EyLQt66
 k3DwMxWyvcS2Uni0ni8eYoM7xtDG3xYtEmspKt7eN6OnHQcmz6FoAXcbqTtyr65D
 MmAYm/mplr0dDVvCLjUbwFqRtQSnpePY9quc4vk+dXVH8atf1OMlDS+rA/jwLIuo
 7LdfolpLiXBzgIFpBuJ8o/KW0B+zu1u3qwzzJ4OUq8nNgp53UM4=
 =VDFg
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.12-20180410' into staging

ppc patch queue 2018-04-10

Here's a rather late pull request with a handful of fixes for 2.12.
These have been blocked for some time, because I wasn't able to
complete my usual test set due to the SCSI problem fixed in 37c5174
"scsi-disk: Don't enlarge min_io_size to max_io_size".

Since we're in hard freeze, these are all bugfixes.  Most are also
regressions, although in one case it's only a "regression" because a
longstanding bug has been exposed by a new machine type (sam460ex) in
the testcases.  There are also a couple of sam460ex fixes that aren't
regressions since the board didn't exist before.  On the flipside
though, they're low risk because they only touch board specific code
for a board that doesn't exist in any released version.

# gpg: Signature made Tue 10 Apr 2018 08:13:52 BST
# gpg:                using RSA key 6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.12-20180410:
  roms/u-boot-sam460ex: Change to qemu git mirror and update
  sam460ex: Fix timer frequency and clock multipliers
  tests/boot-serial: Test the sam460ex board
  spapr: Initialize reserved areas list in FDT in H_CAS handler
  target/ppc: Fix backwards migration of msr_mask
  hw/misc/macio: Fix crash when listing device properties of macio device
  target/ppc: Initialize lazy_tlb_flush correctly

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10 16:58:19 +01:00
Philippe Mathieu-Daudé 07c13a7172 hw/block/pflash_cfi: fix off-by-one error
ASAN reported:

    hw/block/pflash_cfi02.c:245:33: runtime error: index 82 out of bounds for type 'uint8_t [82]'

Since the 'cfi_len' member is not used, remove it to keep the code safer.

Cc: qemu-stable@nongnu.org
Reported-by: AddressSanitizer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-04-10 16:33:08 +02:00
Peter Maydell f41ee66df0 target-arm queue:
* fpu: Fix rounding mode for floatN_to_uintM_round_to_zero
  * tcg: Fix guest state corruption when running 64-bit Arm
    guests on a 32-bit host (especially when using icount)
  * linux-user/signal.c: Ensure AArch64 signal frame isn't too small
  * cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
  * target/arm: Report unsupported MPU region sizes more clearly
  * hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
  * hw/arm/allwinner-a10: Do not use nd_table in instance_init function
  * hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
  * hw/sd/bcm2835_sdhost: Add tracepoints
  * target-arm: Check undefined opcodes for SWP in A32 decoder
  * hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
  * hw/arm: Allow manually specified /psci node
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJazKsMAAoJEDwlJe0UNgzevPsP/RIhj/CwydGiO1AlZmX5XwWt
 pHUgG7bJCZEoxrAJWm3jZG6Um8RFjv90FLozKqc5l8uCHPTyKmgrcfvwO2xwDQcC
 qTyGkRanRNGWqTkr0zu3iwZCM98WgTInQ3acjPikdgobsThJXZqcf6ujDl5hLQOe
 sKfpGXuGujXqC6ibjWYXLqXWgv5kVT+cCC/qcW5fchtlbqm/PNqdxJnhnwD1IwxZ
 f6oNwNQ62yDwTqXHAWsiVvop/eh1Je/2sY91ojqWEq42Gl/7veasEMr/V/dLcEZ9
 gQQamTirc2Zo4UG9F8uaigPtxYfeHqMy6izDZDC25GsTAnjClU8WJNGEjpsInZRc
 S4jahp8nhzeoYQ/sWfxq4KEoIsKxhP3H4O42Yp8vQUwwd6eRKItHOT7wdKyVNgkt
 Be9/k8yeOye8nR6J362VveVnE26oY5dVHscaTh2GVjzFakRLDq8T8pbGWPjrLlP/
 bffVbgeS3NvlYaHhPmL8oL3P+rKQGeMGX5MxtumqRgn/CorZBOiIaC/JggNFOPKp
 8qalN9GkkJ8y6xFKLGTqmR1DHCwz3TM3romjtZKlFYpYHxpGO1t63jTTdmq3fBzW
 RjTCVqd/jha48Dg6Vt2d7FIpTEJrbiwD2exKW0kyWfQf6j/A8PXDA6YAlvfcLc+S
 /pDavxEz9jO+jlpwIx7x
 =cxN4
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20180410' into staging

target-arm queue:
 * fpu: Fix rounding mode for floatN_to_uintM_round_to_zero
 * tcg: Fix guest state corruption when running 64-bit Arm
   guests on a 32-bit host (especially when using icount)
 * linux-user/signal.c: Ensure AArch64 signal frame isn't too small
 * cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
 * target/arm: Report unsupported MPU region sizes more clearly
 * hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
 * hw/arm/allwinner-a10: Do not use nd_table in instance_init function
 * hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
 * hw/sd/bcm2835_sdhost: Add tracepoints
 * target-arm: Check undefined opcodes for SWP in A32 decoder
 * hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
 * hw/arm: Allow manually specified /psci node

# gpg: Signature made Tue 10 Apr 2018 13:16:12 BST
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20180410:
  fpu: Fix rounding mode for floatN_to_uintM_round_to_zero
  tcg: Introduce tcg_set_insn_start_param
  linux-user/signal.c: Ensure AArch64 signal frame isn't too small
  cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
  target/arm: Report unsupported MPU region sizes more clearly
  hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
  hw/arm/allwinner-a10: Do not use nd_table in instance_init function
  hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
  hw/sd/bcm2835_sdhost: Add tracepoints
  target-arm: Check undefined opcodes for SWP in A32 decoder
  hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
  hw/arm: Allow manually specified /psci node

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10 15:18:58 +01:00
Thomas Huth f640a5914f hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
QEMU currently exits unexpectedly when trying to introspect the fsl-imx6
and fsl-imx7 devices on systems with many SMP CPUs:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'fsl,imx6'}}" \
       | arm-softmmu/qemu-system-arm -M virt,accel=qtest -qmp stdio -smp 8
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
fsl,imx6: Only 4 CPUs are supported (8 requested)

And:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'fsl,imx7'}}" \
       | arm-softmmu/qemu-system-arm -M raspi2,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
fsl,imx7: Only 2 CPUs are supported (4 requested)

This happens because these devices are doing an exit() from their
instance_init function - which should never be done since instance_init
can be called at any time for device introspection! Fix it by moving
the deadly check into the realize() function instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1522908551-14885-1-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10 13:02:25 +01:00
Thomas Huth 8aabc5437b hw/arm/allwinner-a10: Do not use nd_table in instance_init function
The instance_init function of a device can be called at any time, even
if the device is not going to be used (i.e. not going to be realized).
So a instance_init function must not do things that could cause QEMU
to exit, like calling qemu_check_nic_model(&nd_table[0], ...) for example.
But this is what the instance_init function of the allwinner-a10 device
is currently doing - and this causes QEMU to quit unexpectedly when
you run the 'device-list-properties' QMP command for example:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'allwinner-a10'}}" \
       | arm-softmmu/qemu-system-arm -M mps2-an505,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
Unsupported NIC model: lan9118

... and QEMU quits after printing the last line (which should not happen
just because of running 'device-list-properties' here).

And with the cubieboard, this even causes QEMU to abort():

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'allwinner-a10'}}" \
       | arm-softmmu/qemu-system-arm -M cubieboard,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
Unexpected error in error_set_from_qdev_prop_error() at hw/core/qdev-properties.c:1095:
Property 'allwinner-emac.netdev' can't take value 'hub0port0', it's in use
Aborted (core dumped)

To fix the problem we've got to move the offending code to the realize
function instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1522862420-7484-1-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10 13:02:25 +01:00
Peter Maydell f3d9fe8f95 hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
The Linux bcm2835_sdhost driver doesn't work on QEMU, because our
model raises spurious data interrupts.  Our function
bcm2835_sdhost_fifo_run() will flag an interrupt any time it is
called with s->datacnt == 0, even if the host hasn't actually issued
a data read or write command yet.  This means that the driver gets a
spurious data interrupt as soon as it enables IRQs and then does
something else that causes us to call the fifo_run routine, like
writing to SDHCFG, and before it does the write to SDCMD to issue the
read.  The driver's IRQ handler then spins forever complaining that
there's no data and the SD controller isn't in a state where there's
going to be any data:

[   41.040738] sdhost-bcm2835 3f202000.mmc: fsm 1, hsts 00000000
[   41.042059] sdhost-bcm2835 3f202000.mmc: fsm 1, hsts 00000000
(continues forever).

Move the interrupt flag setting to more plausible places:
 * for BUSY, raise this as soon as a BUSYWAIT command has executed
 * for DATA, raise this when the FIFO has any space free (for a write)
   or any data in it (for a read)
 * for BLOCK, raise this when the data count is 0 and we've
   actually done some reading or writing

This is pure guesswork since the documentation for this hardware is
not public, but it is sufficient to get the Linux bcm2835_sdhost
driver to work.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20180319161556.16446-3-peter.maydell@linaro.org
2018-04-10 13:02:25 +01:00
Peter Maydell b318f3265c hw/sd/bcm2835_sdhost: Add tracepoints
Add some tracepoints to the bcm2835_sdhost driver, to assist
debugging.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20180319161556.16446-2-peter.maydell@linaro.org
2018-04-10 13:02:25 +01:00
Thomas Huth 8720daad47 hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
An instance_init function must not fail - and might be called multiple times,
e.g. during device introspection with the 'device-list-properties' QMP
command. Since the integratorcm device ignores this rule, QEMU currently
aborts in this case (though it really should not):

echo "{'execute':'qmp_capabilities'}"\
     "{'execute':'device-list-properties',"\
     "'arguments':{'typename':'integrator_core'}}" \
     | arm-softmmu/qemu-system-arm -M integratorcp,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
RAMBlock "integrator.flash" already registered, abort!
Aborted (core dumped)

Move the problematic code to the realize() function instead to fix this
problem.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1522906473-11252-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10 13:02:24 +01:00
Andrey Smirnov c39770cd63 hw/arm: Allow manually specified /psci node
Change the code to avoid exiting QEMU if user provided DTB contains
manually specified /psci node and skip any /psci related fixups
instead.

Fixes: 4cbca7d9b4 ("hw/arm: Move virt's PSCI DT fixup code to
arm/boot.c")

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Reported-by: Marc Zyngier <marc.zyngier@arm.com>
Tested-by: Marc Zyngier <marc.zyngier@arm.com>
Message-id: 20180402205654.14572-1-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10 13:02:24 +01:00
Peter Maydell daf6b59be8 -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
 
 iQEcBAABAgAGBQJazDEhAAoJEO8Ells5jWIRwNcH/jfvFCOg5SVefHiuk4+6b3mM
 3YP9vBFGx0gJREelYBriCWuMUELem79rGWskQvhNe43/qkFktlR/bRbB+QOIcPmo
 ZoDHNj8AQXTkCbXnctsG4ygPmAuK67zft9yNMRQlOH3OUnfFfEq+aNL9tXenzgrS
 oLfVApdtBk67ZdwWOrEz+43YKB/0FyvFoHFdABvPLRFtWlKLtGMgoYLjGdjxywMK
 LpHkKm+Uw0xW+Y4PII1yEN7ke3Nx9Gw8SWWegTPZlJ+hPMvtF8nt3uibD38YqsKg
 XfuCWDSeJ8LIQNUdG4K5g5dIES2NaEIDeENatWlvELgP7HdlQSQ0HbJFoCUHmOk=
 =fuVG
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging

# gpg: Signature made Tue 10 Apr 2018 04:36:01 BST
# gpg:                using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* remotes/jasowang/tags/net-pull-request:
  e1000: Old machine types, turn new subsection off
  e1000: Choose which set of props to migrate
  e1000: Migrate props via a temporary structure
  e1000: wire new subsection to property
  e1000: Dupe offload data on reading old stream
  e1000: Convert v3 fields to subsection

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-10 12:49:07 +01:00
Dr. David Alan Gilbert ff214d427e e1000: Choose which set of props to migrate
When we're using the subsection we migrate both
the 'props' and 'tso_props' data; when we're not using
the subsection (to migrate to 2.11 or old machine types) we've
got to choose what to migrate in the main structure.

If we're using the subsection migrate 'props' in the main structure.
If we're not using the subsection then migrate the last one
that changed, which gives behaviour similar to the old behaviour.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-04-10 11:30:03 +08:00
Dr. David Alan Gilbert 5935448478 e1000: Migrate props via a temporary structure
Swing the tx.props out via a temporary structure, so in future patches
we can select what we're going to send.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-04-10 11:30:03 +08:00
Dr. David Alan Gilbert 46f2a9ec54 e1000: wire new subsection to property
Wire the new subsection from the previous commit to a property
so we can turn it off easily.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-04-10 11:30:03 +08:00
Dr. David Alan Gilbert 3c4053c52c e1000: Dupe offload data on reading old stream
Old QEMUs only had one set of offload data;  when we only receive
one lot, dupe the received data - that should give us about the
same bug level as the old version.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-04-10 11:30:03 +08:00
Dr. David Alan Gilbert 4ae4bf5bb1 e1000: Convert v3 fields to subsection
A bunch of new TSO fields were introduced by d62644b4 and this bumped
the VMState version; however it's easier for those trying to keep
backwards migration compatibility if these fields are added in a
subsection instead.

Move the new fields to a subsection.

Since this was added after 2.11, this change will only affect
compatbility with 2.12-rc0.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-04-10 11:29:35 +08:00
BALATON Zoltan f8815532dc sam460ex: Fix timer frequency and clock multipliers
We only emulate timer running at CPU frequency which is what most
guests expect so set the frequency to match real hardware. This also
allows setting clock multipliers which caused slowdown previously due
to wrong timer frequency.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-04-10 10:05:38 +10:00
Alexey Kardashevskiy 127f03e442 spapr: Initialize reserved areas list in FDT in H_CAS handler
At the moment the device tree produced by the H_CAS handler has no
reserved map initialized at all which is not correct as at least one
empty record is required to be present as a marker of the end.
This does not cause problems now as the only consumer is SLOF which
does not look at the reserved map area.

However when DTC's "Improve libfdt's memory safety" changeset hits
the QEMU upstream, there will be errors reported and crashes observed.

This fixes the problem by adding an empty entry to the reserved map,
just like create_device_tree() does already.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-04-10 10:05:38 +10:00
Thomas Huth ddd835f32a hw/misc/macio: Fix crash when listing device properties of macio device
The macio-newworld device can currently be used to abort QEMU unexpectedly:

$ ppc-softmmu/qemu-system-ppc -S -M ref405ep,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 50, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{ 'execute': 'qmp_capabilities' }
{"return": {}}
{ 'execute': 'device-list-properties',
  'arguments': {'typename': 'macio-newworld'}}
Unexpected error in qemu_chr_fe_init() at chardev/char-fe.c:222:
Device 'serial0' is in use
Aborted (core dumped)

qdev properties should be set during realize(), not during instance_init(),
so move the related code there to fix this problem.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-04-10 10:05:38 +10:00
Peter Maydell 1e7e92e2ef Fixes for s390x: kvm, vfio-ccw, ipl code, bios. Includes a rebuild
of s390-ccw.img and s390-netboot.img.
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEw9DWbcNiT/aowBjO3s9rk8bwL68FAlrLgeMSHGNvaHVja0By
 ZWRoYXQuY29tAAoJEN7Pa5PG8C+vnSMP/25JBDDWCOHbZGqtzDN4Su6rrExziRqI
 D9dqTIeplDOJhgpJ9320UjZYwFwJtgIuZelludo6J6Mi9RJiX5/FUUUn8mBkFTaL
 KX6VOZF08oM0pxkHc3cVqDAm8W58hxZZa4ndtvKi/ZBxcW5JaGxokkDP0k+7mJQx
 qydKzgaZ9RaXsewSDBEUUmEkxMFyqbaFeRLej5Ra4V75TdL7fam4N0VOBL/uFRXy
 aBYQUEL9ZkIiwYAuuQ6w/KwqY/FIRvFCZkmq+exJ94ylqwgTCJXPhS957IhDEJdt
 VQEHPKR5W0io2yYyctp/il++EjUsy5jd+1Yu7rrKpk+JqRb/eP2t8PQJjUzOS0As
 s+HCJ08jaTboAXJbJ8Ya2b3/a5lY+iVt7WTB1ykc44KGJIfjwX4C4NZ6orH4DuOd
 /zoFIxcogGnvuAJRKSmgAY2EWIw0skXe9m0KgzSm/wWVxk2MB2ORgiflm9YfT1mt
 0ZVjT8rsrbTUEP1+TqPJctP4EgcIweVXlZQ5oeESNyUkWsQSUe6EwRfCKFo8BTZY
 0zOfBZRpT5KEYEUCAUrRw44fuSIU6v7+bJ7vl49jycLRfXr2ESl1+NAKjiaeqHhO
 zzEZ8+hP99DOeP66Gkz0iqbGvY7JCR5yBIMa3ELUersBi/0odJmpBLiUF9q9gA5/
 5zBm9iBU8ZvJ
 =Hx/l
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180409' into staging

Fixes for s390x: kvm, vfio-ccw, ipl code, bios. Includes a rebuild
of s390-ccw.img and s390-netboot.img.

# gpg: Signature made Mon 09 Apr 2018 16:08:19 BST
# gpg:                using RSA key DECF6B93C6F02FAF
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>"
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>"
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>"
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20180409:
  s390x: load_psw() should only exchange the PSW for KVM
  s390x/mmu: don't overwrite pending exception in mmu translate
  vfio-ccw: fix memory leaks in vfio_ccw_realize()
  pc-bios/s390: update images
  s390: Do not pass inofficial IPL type to the guest
  s390: Ensure IPL from SCSI works as expected
  s390: Refactor IPL parameter block generation
  s390x/kvm: call cpu_synchronize_state() on every kvm_arch_handle_exit()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-04-09 18:21:23 +01:00