Markus Armbruster [Thu, 1 Oct 2015 08:59:58 +0000 (10:59 +0200)]
qdev: Protect device-list-properties against broken devices
Several devices don't survive object_unref(object_new(T)): they crash
or hang during cleanup, or they leave dangling pointers behind.
This breaks at least device-list-properties, because
qmp_device_list_properties() needs to create a device to find its
properties. Broken in commit f4eb32b "qmp: show QOM properties in
device-list-properties", v2.1. Example reproducer:
Unfortunately, I can't fix the problems in these devices right now.
Instead, add DeviceClass member cannot_destroy_with_object_finalize_yet
to mark them:
* Hang during cleanup (didn't debug, so I can't say why):
"realview_pci", "versatile_pci".
* Dangling pointer in cpus: most CPUs, plus "allwinner-a10", "digic",
"fsl,imx25", "fsl,imx31", "xlnx,zynqmp", because they create such
CPUs
* Assert kvm_enabled(): "host-x86_64-cpu", host-i386-cpu",
"host-powerpc64-cpu", "host-embedded-powerpc-cpu",
"host-powerpc-cpu" (the powerpc ones can't currently reach the
assertion, because the CPUs are only registered when KVM is enabled,
but the assertion is arguably in the wrong place all the same)
Make qmp_device_list_properties() fail cleanly when the device is so
marked. This improves device-list-properties from "crashes, hangs or
leaves dangling pointers behind" to "fails". Not a complete fix, just
a better-than-nothing work-around. In the above reproducer,
device-list-properties now fails with "Can't list properties of device
'pxa2xx-pcmcia'".
This also protects -device FOO,help, which uses the same machinery
since commit ef52358 "qdev-monitor: include QOM properties in -device
FOO, help output", v2.2. Example reproducer:
The test doesn't check that the output makes any sense, only that QEMU
survives. Useful since we've had an astounding number of crash bugs
around there.
In fact, we have a bunch of them right now: a few devices crash or
hang, and some leave dangling pointers behind. The test skips testing
the broken parts. The next commits will fix them up, and drop the
skipping.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1443689999-12182-8-git-send-email-armbru@redhat.com>
Markus Armbruster [Thu, 1 Oct 2015 08:59:55 +0000 (10:59 +0200)]
libqtest: New hmp() & friends
New convenience function hmp() to facilitate use of
human-monitor-command in tests. Use it to simplify its existing uses.
To blend into existing libqtest code, also add qtest_hmpv() and
qtest_hmp(). That, and the egregiously verbose GTK-Doc comment format
make this patch look bigger than it is.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <1443689999-12182-7-git-send-email-armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1443689999-12182-6-git-send-email-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Markus Armbruster [Thu, 1 Oct 2015 08:59:53 +0000 (10:59 +0200)]
tests: Fix how qom-test is run
We want to run qom-test for every architecture, without having to
manually add it to every architecture's list of tests. Commit 3687d53
accomplished this by adding it to every architecture's list
automatically.
However, some architectures inherit their tests from others, like this:
For such architectures, we ended up running the (slow!) test twice.
Commit 2b8419c attempted to avoid this by adding the test only when
it's not already present. Works only as long as we consider adding
the test to the architectures on the left hand side *after* the ones
on the right hand side: x86_64 after i386, microblazeel after
microblaze, xtensaeb after xtensa.
Turns out we consider them in $(SYSEMU_TARGET_LIST) order. Defined as
On my machine, this results in the oder xtensa, x86_64, microblazeel,
microblaze, i386. Consequently, qom-test runs twice for microblazeel
and x86_64.
Replace this complex and flawed machinery with a much simpler one: add
generic tests (currently just qom-test) to check-qtest-generic-y
instead of check-qtest-$(target)-y for every target, then run
$(check-qtest-generic-y) for every target.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de>
Message-Id: <1443689999-12182-5-git-send-email-armbru@redhat.com>
Paolo Bonzini [Thu, 1 Oct 2015 08:59:52 +0000 (10:59 +0200)]
macio: move DBDMA_init from instance_init to realize
DBDMA_init is not idempotent, and calling it from instance_init
breaks a simple object_new/object_unref pair. Work around this,
pending qdev-ification of DBDMA, by moving the call to realize.
Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1443689999-12182-4-git-send-email-armbru@redhat.com>
Paolo Bonzini [Thu, 1 Oct 2015 08:59:51 +0000 (10:59 +0200)]
hw: do not pass NULL to memory_region_init from instance_init
This causes the region to outlive the object, because it attaches the
region to /machine. This is not nice for the "realize" method, but
much worse for "instance_init" because it can cause dangling pointers
after a simple object_new/object_unref pair.
Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1443689999-12182-3-git-send-email-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Paolo Bonzini [Thu, 1 Oct 2015 08:59:50 +0000 (10:59 +0200)]
memory: allow destroying a non-empty MemoryRegion
This is legal; the MemoryRegion will simply unreference all the
existing subregions and possibly bring them down with it as well.
However, it requires a bit of care to avoid an infinite loop.
Finalizing a memory region cannot trigger an address space update,
but memory_region_del_subregion errs on the side of caution and
might trigger a spurious update: avoid that by resetting mr->enabled
first.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1443689999-12182-2-git-send-email-armbru@redhat.com>
Markus Armbruster [Thu, 8 Oct 2015 16:11:40 +0000 (18:11 +0200)]
virtio-input: Fix device introspection on non-Linux hosts
When CONFIG_LINUX is off, devices "virtio-keyboard-device",
"virtio-mouse-device", "virtio-tablet-device" and
"virtio-input-host-device" aren't compiled in, yet
"virtio-keyboard-pci", "virtio-mouse-pci", "virtio-tablet-pci" and
"virtio-input-host-pci" still are. Attempts to introspect them crash,
e.g.
Fix by compiling the "virtio-FOO-pci" exactly when compiling the
"virtio-FOO-device": compile "virtio-keyboard-device",
"virtio-mouse-device", "virtio-tablet-device" regardless of
CONFIG_LINUX, and compile "virtio-input-host-pci" only for
CONFIG_LINUX.
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Message-Id: <1444320700-26260-3-git-send-email-armbru@redhat.com>
Markus Armbruster [Thu, 8 Oct 2015 16:11:39 +0000 (18:11 +0200)]
update-linux-headers: Rename SW_MAX to SW_MAX_
The next commit will compile hw/input/virtio-input.c and
hw/input/virtio-input-hid.c even when CONFIG_LINUX is off. These
files include both "include/standard-headers/linux/input.h" and
<windows.h> then. Doesn't work, because both define SW_MAX. We don't
actually use it. Patch input.h to define SW_MAX_ instead.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1444320700-26260-2-git-send-email-armbru@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Peter Maydell [Fri, 9 Oct 2015 11:18:13 +0000 (12:18 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
# gpg: Signature made Fri 09 Oct 2015 10:15:13 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>"
* remotes/stefanha/tags/tracing-pull-request:
trace: remove malloc tracing
docs: update the usage example of "dtrace" backend in tracing.txt
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 9 Oct 2015 09:45:09 +0000 (10:45 +0100)]
Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-10-08' into staging
trivial patches for 2015-10-08
# gpg: Signature made Thu 08 Oct 2015 17:51:05 BST using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg: aka "Michael Tokarev <mjt@corpit.ru>"
# gpg: aka "Michael Tokarev <mjt@debian.org>"
* remotes/mjt/tags/pull-trivial-patches-2015-10-08:
tests: Unique test path for /string-visitor/output
linux-user: Remove type casts to union type
linux-user: Use g_new() & friends where that makes obvious sense
rocker: Use g_new() & friends where that makes obvious sense
.travis.yml: Run make check for all targets, not just some
hw: char: Remove unnecessary variable
hw: timer: Remove unnecessary variable
qapi: add missing @
MAINTAINERS: Add NSIS file for W32, W64 hosts
target-ppc: Remove unnecessary variable
target-microblaze: Remove unnecessary variable
s/cpu_get_real_ticks/cpu_get_host_ticks/
pc: check for underflow in load_linux
pci-assign: do not include sys/io.h
block/ssh: remove dead code
imx_serial: Generate interrupt on tx empty if enabled
sdhci: Change debug prints to compile unconditionally
sdhci: use PRIx64 for uint64_t type
Add .dir-locals.el file to configure emacs coding style
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Paolo Bonzini [Wed, 16 Sep 2015 15:38:44 +0000 (17:38 +0200)]
trace: remove malloc tracing
The malloc vtable is not supported anymore in glib, because it broke
when constructors called g_malloc. Remove tracing of g_malloc,
g_realloc and g_free calls.
Note that, for systemtap users, glib also provides tracepoints
glib.mem_alloc, glib.mem_free, glib.mem_realloc, glib.slice_alloc
and glib.slice_free.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 1442417924-25831-1-git-send-email-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Lin Ma [Fri, 11 Sep 2015 06:58:50 +0000 (14:58 +0800)]
docs: update the usage example of "dtrace" backend in tracing.txt
The usage example of dtrace is quite ancient, We have tracetool.py with
different parameters instead of the original tracetool shell script for
a long time, So update the old information.
Signed-off-by: Lin Ma <lma@suse.com>
Message-id: 1441954730-17341-1-git-send-email-lma@suse.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Dr. David Alan Gilbert [Mon, 5 Oct 2015 11:04:20 +0000 (12:04 +0100)]
tests: Unique test path for /string-visitor/output
Newer GLib's want unique test paths, and thus moan at dupes.
(Seen on Fedora 23 which has glib 2.46)
Uniquify the paths.
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Stefan Weil [Sun, 8 Feb 2015 14:40:58 +0000 (15:40 +0100)]
linux-user: Remove type casts to union type
Casting to a union type is a gcc (and clang) extension. Other compilers
might not support it. This is not a problem today, but the type casts
can be removed easily. Smatch now no longer complains like before:
linux-user/syscall.c:3190:18: warning: cast to non-scalar
linux-user/syscall.c:7348:44: warning: cast to non-scalar
Cc: Riku Voipio <riku.voipio@iki.fi> Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Markus Armbruster [Mon, 14 Sep 2015 11:53:03 +0000 (13:53 +0200)]
linux-user: Use g_new() & friends where that makes obvious sense
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer,
for two reasons. One, it catches multiplication overflowing size_t.
Two, it returns T * rather than void *, which lets the compiler catch
more type errors.
This commit only touches allocations with size arguments of the form
sizeof(T). Same Coccinelle semantic patch as in commit b45c03f.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Markus Armbruster [Mon, 14 Sep 2015 11:52:23 +0000 (13:52 +0200)]
rocker: Use g_new() & friends where that makes obvious sense
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer,
for two reasons. One, it catches multiplication overflowing size_t.
Two, it returns T * rather than void *, which lets the compiler catch
more type errors.
This commit only touches allocations with size arguments of the form
sizeof(T). Same Coccinelle semantic patchas in commit b45c03f.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Jiri Pirko <jiri@resnulli.us> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
David Gibson [Wed, 23 Sep 2015 05:27:12 +0000 (15:27 +1000)]
.travis.yml: Run make check for all targets, not just some
ed173cb ".travis.yml: remove "make check" from main matrix" stopped running
make check for all the Travis build targets for various reasons. It
continued to run make check on one Travis build, which builds for a big
list of all (? nearly all) our supported softmmu targets.
Unfortunately, due to a spacing / quoting error it only actually builds for
the alpha, arm, aarch64 and cris targets. Specifically, the list of
targets is split over several lines. Even with YAML folding, this will
leave spaces in the list, meaning $TARGETS won't have the value we need.
I had a look at the YAML spec and I couldn't quickly see a way of splitting
the list so that it doesn't end up with spaces, so this patch fixes the
problem by putting the whole list on one huge line.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Christopher Covington [Fri, 25 Sep 2015 14:42:21 +0000 (10:42 -0400)]
s/cpu_get_real_ticks/cpu_get_host_ticks/
This should help clarify the purpose of the function that returns
the host system's CPU cycle count.
Signed-off-by: Christopher Covington <cov@codeaurora.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
ppc portion Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Paolo Bonzini [Mon, 14 Sep 2015 11:12:34 +0000 (13:12 +0200)]
block/ssh: remove dead code
The "err" label cannot be reached with qp != NULL. Remove the free-ing
of qp and avoid future regressions by removing the initializer.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> ACKed-by: Richard W.M. Jones <rjones@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Guenter Roeck [Thu, 20 Aug 2015 15:52:35 +0000 (08:52 -0700)]
imx_serial: Generate interrupt on tx empty if enabled
Generate an interrupt if the tx buffer is empty and the tx empty interrupt
is enabled. This fixes a problem seen when running a Linux image since
Linux commit 55c3cb1358e ("serial: imx: remove unneeded imx_transmit_buffer()
from imx_start_tx()"). Linux now waits for the tx empty interrupt before
starting to send data, causing transmit stalls until there is an interrupt
for another reason.
Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
sdhci: Change debug prints to compile unconditionally
Conditional compilation hides few type mismatch warnings, fix it to
compile unconditionally.
Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Suggested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Fix compile time warnings, because of type mismatch for unsigned long
long type.
Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Daniel P. Berrange [Thu, 4 Jun 2015 13:30:07 +0000 (14:30 +0100)]
Add .dir-locals.el file to configure emacs coding style
Some default emacs setups indent by 2 spaces and uses tabs
which is counter to the QEMU coding style rules. Adding a
.dir-locals.el file in the top level of the GIT repo will
inform emacs about the QEMU coding style, and so assist
contributors in avoiding common style mistakes before
they submit patches.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Peter Maydell [Thu, 8 Oct 2015 15:50:34 +0000 (16:50 +0100)]
Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20151007.0' into staging
VFIO updates 2015-10-07
- Change platform device IRQ setup sequence for compatibility
with upcoming IRQ forwarding (Eric Auger)
- Extensions to support vfio-pci devices on spapr-pci-host-bridge
(David Gibson) [clang problem patch dropped]
# gpg: Signature made Wed 07 Oct 2015 16:30:52 BST using RSA key ID 3BB08B22
# gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
# gpg: aka "Alex Williamson <alex@shazbot.org>"
# gpg: aka "Alex Williamson <alwillia@redhat.com>"
# gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>"
* remotes/awilliam/tags/vfio-update-20151007.0:
vfio: Allow hotplug of containers onto existing guest IOMMU mappings
memory: Allow replay of IOMMU mapping notifications
vfio: Record host IOMMU's available IO page sizes
vfio: Check guest IOVA ranges against host IOMMU capabilities
vfio: Generalize vfio_listener_region_add failure path
vfio: Remove unneeded union from VFIOContainer
hw/vfio/platform: do not set resamplefd for edge-sensitive IRQS
hw/vfio/platform: change interrupt/unmask fields into pointer
hw/vfio/platform: irqfd setup sequence update
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 8 Oct 2015 14:33:56 +0000 (15:33 +0100)]
Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20151007' into staging
Do away with TB retranslation
# gpg: Signature made Wed 07 Oct 2015 10:42:08 BST using RSA key ID 4DD0279B
# gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
# gpg: aka "Richard Henderson <rth@redhat.com>"
# gpg: aka "Richard Henderson <rth@twiddle.net>"
* remotes/rth/tags/pull-tcg-20151007: (26 commits)
tcg: Adjust CODE_GEN_AVG_BLOCK_SIZE
tcg: Check for overflow via highwater mark
tcg: Allocate a guard page after code_gen_buffer
tcg: Emit prologue to the beginning of code_gen_buffer
tcg: Remove tcg_gen_code_search_pc
tcg: Remove gen_intermediate_code_pc
tcg: Save insn data and use it in cpu_restore_state_from_tb
tcg: Pass data argument to restore_state_to_opc
tcg: Add TCG_MAX_INSNS
target-*: Drop cpu_gen_code define
tcg: Merge cpu_gen_code into tb_gen_code
target-sparc: Add npc state to insn_start
target-sparc: Remove gen_opc_jump_pc
target-sparc: Split out gen_branch_n
target-sparc: Tidy gen_branch_a interface
target-cris: Mirror gen_opc_pc into insn_start
target-sh4: Add flags state to insn_start
target-s390x: Add cc_op state to insn_start
target-mips: Add delayed branch state to insn_start
target-i386: Add cc_op state to insn_start
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 8 Oct 2015 12:37:04 +0000 (13:37 +0100)]
Merge remote-tracking branch 'remotes/rth/tags/pull-tile-20151007' into staging
Collected patches
# gpg: Signature made Wed 07 Oct 2015 10:30:17 BST using RSA key ID 4DD0279B
# gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
# gpg: aka "Richard Henderson <rth@redhat.com>"
# gpg: aka "Richard Henderson <rth@twiddle.net>"
* remotes/rth/tags/pull-tile-20151007:
target-tilegx: Support iret instruction and related special registers
target-tilegx: Use TILEGX_EXCP_OPCODE_UNKNOWN and TILEGX_EXCP_OPCODE_UNIMPLEMENTED correctly
target-tilegx: Implement v2mults instruction
target-tilegx: Implement v?int_* instructions.
target-tilegx: Implement v2sh* instructions
target-tilegx: Handle nofault prefetch instructions
target-tilegx: Fix a typo for mnemonic about "ld_add"
target-tilegx: Use TILEGX_EXCP_SIGNAL instead of TILEGX_EXCP_SEGV
target-tilegx: Decode ill pseudo-instructions
linux-user/tilegx: Implement tilegx signal features
linux-user/syscall_defs.h: Sync the latest si_code from Linux kernel
target-tilegx: Let x1 pipe process bpt instruction only
target-tilegx: Implement complex multiply instructions
target-tilegx: Implement table index instructions
target-tilegx: Implement crc instructions
target-tilegx: Implement v1multu instruction
target-tilegx: Implement v*add and v*sub instructions
target-tilegx: Implement v*shl, v*shru, and v*shrs instructions
target-tilegx: Tidy simd_helper.c
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Richard Henderson [Sat, 26 Sep 2015 16:23:42 +0000 (09:23 -0700)]
tcg: Adjust CODE_GEN_AVG_BLOCK_SIZE
At present, the "average" guestimate of TB size is way too small, leading
to many unused entries in the pre-allocated TB array. For a guest with 1GB
ram, we're currently allocating 256MB for the array.
Survey arm, alpha, aarch64, ppc, sparc, i686, x86_64 guests running on
x86_64 and ppc64 hosts and select a new average. The size of the array
drops to 81MB with no more flushing than before.
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Richard Henderson <rth@twiddle.net>
Richard Henderson [Tue, 22 Sep 2015 20:01:15 +0000 (13:01 -0700)]
tcg: Check for overflow via highwater mark
We currently pre-compute an worst case code size for any TB, which
works out to be 122kB. Since the average TB size is near 1kB, this
wastes quite a lot of storage.
Instead, check for overflow in between generating code for each opcode.
The overhead of the check isn't measurable and wastage is minimized.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
Richard Henderson [Sat, 19 Sep 2015 06:43:05 +0000 (23:43 -0700)]
tcg: Emit prologue to the beginning of code_gen_buffer
By putting the prologue at the end, we risk overwriting the
prologue should our estimate of maximum TB size. Given the
two different placements of the call to tcg_prologue_init,
move the high water mark computation into tcg_prologue_init.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
Richard Henderson [Wed, 2 Sep 2015 03:01:40 +0000 (20:01 -0700)]
tcg: Remove gen_intermediate_code_pc
It is no longer used, so tidy up everything reached by it.
This includes the gen_opc_* arrays, the search_pc parameter
and the inline gen_intermediate_code_internal functions.
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
Richard Henderson [Tue, 1 Sep 2015 22:51:12 +0000 (15:51 -0700)]
tcg: Pass data argument to restore_state_to_opc
The gen_opc_* arrays are already redundant with the data stored in
the insn_start arguments. Transition restore_state_to_opc to use
data from the latter.
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
Richard Henderson [Mon, 31 Aug 2015 20:24:44 +0000 (13:24 -0700)]
target-sparc: Remove gen_opc_jump_pc
Since jump_pc[1] is always npc + 4, we can infer after incrementing
that jump_pc[1] == pc + 4. Because of that, we can encode the branch
destination into a single word, and store that in npc.
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
Richard Henderson [Sun, 30 Aug 2015 16:35:14 +0000 (09:35 -0700)]
target-cris: Mirror gen_opc_pc into insn_start
This perhaps isn't ideal in terms of (ab)using the "pc" field
to encode both pc and ppc + delay branch state, as one has to
be aware of this when examining opcode dumps.
But it preserves existing logic, which will be good for bisection,
and it certainly does save storage space.
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
Richard Henderson [Sat, 29 Aug 2015 19:59:29 +0000 (12:59 -0700)]
target-*: Unconditionally emit tcg_gen_insn_start
While we're at it, emit the opcode adjacent to where we currently
record data for search_pc. This puts gen_io_start et al on the
"correct" side of the marker.
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sun, 4 Oct 2015 09:41:14 +0000 (17:41 +0800)]
target-tilegx: Support iret instruction and related special registers
EX_CONTEXT_0_0 is used for jumping address, and EX_CONTEXT_0_1 is for
INTERRUPT_CRITICAL_SECTION, which should only be 0 or 1 in user mode, or
it will cause target SIGILL (and the patch doesn't support system mode).
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sun, 4 Oct 2015 05:34:33 +0000 (13:34 +0800)]
target-tilegx: Use TILEGX_EXCP_OPCODE_UNKNOWN and TILEGX_EXCP_OPCODE_UNIMPLEMENTED correctly
For some cases, they are for TILEGX_EXCP_OPCODE_UNKNOWN, not for
TILEGX_EXCP_OPCODE_UNIMPLEMENTED.
Also for some cases, they are for TILEGX_EXCP_OPCODE_UNIMPLEMENTED, not
for TILEGX_EXCP_OPCODE_UNKNOWN.
When analyzing issues, the correct printing information is necessary,
e.g. grep UIMP in gcc testsuite output log for finding qemu tilegx
umimplementation issues, grep UNKNOWN for finding unknown instructions.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sun, 4 Oct 2015 11:01:27 +0000 (19:01 +0800)]
target-tilegx: Implement v2mults instruction
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443956491-26850-3-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sun, 4 Oct 2015 11:01:26 +0000 (19:01 +0800)]
target-tilegx: Implement v?int_* instructions.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443956491-26850-2-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sun, 4 Oct 2015 11:01:25 +0000 (19:01 +0800)]
target-tilegx: Implement v2sh* instructions
It is just according to v1sh* instructions implementation.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443956491-26850-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
These are mapped onto some of the normal load instructions, when the
destination is the zero register. Other load insns do fault even
when targeting the zero register.
Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Tue, 29 Sep 2015 21:38:40 +0000 (05:38 +0800)]
target-tilegx: Fix a typo for mnemonic about "ld_add"
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443562720-3008-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sat, 26 Sep 2015 05:00:35 +0000 (13:00 +0800)]
target-tilegx: Decode ill pseudo-instructions
Notice raise and bpt, decoding the constants embedded in the
nop addil instruction in the x0 slot.
[rth: Generalize TILEGX_EXCP_OPCODE_ILL to TILEGX_EXCP_SIGNAL.
Drop validation of signal values.]
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443243635-4886-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sun, 27 Sep 2015 00:10:18 +0000 (08:10 +0800)]
linux-user/tilegx: Implement tilegx signal features
[rth: Remove the spreg[EX1] handling, as it's irrelevant to user-mode.]
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443312618-13641-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Sat, 26 Sep 2015 04:10:05 +0000 (12:10 +0800)]
linux-user/syscall_defs.h: Sync the latest si_code from Linux kernel
They content several new macro members, also contents TARGET_N*.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443240605-2924-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Fri, 25 Sep 2015 23:42:54 +0000 (07:42 +0800)]
target-tilegx: Let x1 pipe process bpt instruction only
According to the related document, bpt can be only in x1 pipe.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1443224574-2718-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Mon, 21 Sep 2015 22:26:54 +0000 (06:26 +0800)]
target-tilegx: Implement v1multu instruction
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-Id: <1442874414-3578-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Mon, 21 Sep 2015 22:18:38 +0000 (06:18 +0800)]
target-tilegx: Implement v*add and v*sub instructions
[rth: Implement everything inline; handle v1addi and v2addi as well.]
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1442873918-3394-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
Chen Gang [Mon, 21 Sep 2015 21:47:35 +0000 (05:47 +0800)]
target-tilegx: Implement v*shl, v*shru, and v*shrs instructions
v2sh* are implemented with helper functions; v4sh* are implmeneted
with inline code.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Message-Id: <1442872055-2836-1-git-send-email-gang.chen.5i5j@gmail.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
pc-dimm: Fail realization for invalid nodes in non-NUMA config
pc_dimm_realize() validates the NUMA node to which memory hotplug is
being performed only in case of NUMA configuration. Include a check to
fail for invalid nodes in case of non-NUMA configuration too.
Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Peter Maydell [Tue, 6 Oct 2015 15:32:16 +0000 (16:32 +0100)]
Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20151006' into staging
s390: fixes
Some fixes all over the place:
- ccw bios and gcc 5.1 (avoid floating point ops)
- properly print vector registers
- sclp and sclp-event-facility no longer hang on object_unref(object_new(T))
- better name for io_subsystem_reset
One feature
- the gdb server now exposes several virtualization specific register
# gpg: Signature made Tue 06 Oct 2015 11:20:24 BST using RSA key ID B5A61C7C
# gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"
* remotes/borntraeger/tags/s390x-20151006:
s390x: rename io_subsystem_reset -> subsystem_reset
s390x/info registers: print vector registers properly
s390x: set missing parent for hotplug and quiesce events
s390x/gdb: expose virtualization specific registers
pc-bios/s390-ccw: avoid floating point operations
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 6 Oct 2015 12:42:33 +0000 (13:42 +0100)]
Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging
X86 queue, 2015-10-05
# gpg: Signature made Mon 05 Oct 2015 17:04:38 BST using RSA key ID 984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
* remotes/ehabkost/tags/x86-pull-request:
icc_bus: drop the unused files
cpu/apic: drop icc bus/bridge
x86: use new method to correct reset sequence
apic: move APIC's MMIO region mapping into APIC
Correctly re-init EFER state during INIT IPI
target-i386: add ABM to Haswell* and Broadwell* CPU models
target-i386: get/put MSR_TSC_AUX across reset and migration
target-i386: Make check_hw_breakpoints static
target-i386: Move breakpoint related functions to new file
target-i386: Convert kvm_default_*features to property/value pairs
vl: Add another sanity check to smp_parse() function
cpu: Introduce X86CPUTopoInfo structure for argument simplification
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
David Gibson [Wed, 30 Sep 2015 02:13:56 +0000 (12:13 +1000)]
vfio: Allow hotplug of containers onto existing guest IOMMU mappings
At present the memory listener used by vfio to keep host IOMMU mappings
in sync with the guest memory image assumes that if a guest IOMMU
appears, then it has no existing mappings.
This may not be true if a VFIO device is hotplugged onto a guest bus
which didn't previously include a VFIO device, and which has existing
guest IOMMU mappings.
Therefore, use the memory_region_register_iommu_notifier_replay()
function in order to fix this case, replaying existing guest IOMMU
mappings, bringing the host IOMMU into sync with the guest IOMMU.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
David Gibson [Wed, 30 Sep 2015 02:13:55 +0000 (12:13 +1000)]
memory: Allow replay of IOMMU mapping notifications
When we have guest visible IOMMUs, we allow notifiers to be registered
which will be informed of all changes to IOMMU mappings. This is used by
vfio to keep the host IOMMU mappings in sync with guest IOMMU mappings.
However, unlike with a memory region listener, an iommu notifier won't be
told about any mappings which already exist in the (guest) IOMMU at the
time it is registered. This can cause problems if hotplugging a VFIO
device onto a guest bus which had existing guest IOMMU mappings, but didn't
previously have an VFIO devices (and hence no host IOMMU mappings).
This adds a memory_region_iommu_replay() function to handle this case. It
replays any existing mappings in an IOMMU memory region to a specified
notifier. Because the IOMMU memory region doesn't internally remember the
granularity of the guest IOMMU it has a small hack where the caller must
specify a granularity at which to replay mappings.
If there are finer mappings in the guest IOMMU these will be reported in
the iotlb structures passed to the notifier which it must handle (probably
causing it to flag an error). This isn't new - the VFIO iommu notifier
must already handle notifications about guest IOMMU mappings too short
for it to represent in the host IOMMU.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
David Gibson [Wed, 30 Sep 2015 02:13:54 +0000 (12:13 +1000)]
vfio: Record host IOMMU's available IO page sizes
Depending on the host IOMMU type we determine and record the available page
sizes for IOMMU translation. We'll need this for other validation in
future patches.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
David Gibson [Wed, 30 Sep 2015 02:13:53 +0000 (12:13 +1000)]
vfio: Check guest IOVA ranges against host IOMMU capabilities
The current vfio core code assumes that the host IOMMU is capable of
mapping any IOVA the guest wants to use to where we need. However, real
IOMMUs generally only support translating a certain range of IOVAs (the
"DMA window") not a full 64-bit address space.
The common x86 IOMMUs support a wide enough range that guests are very
unlikely to go beyond it in practice, however the IOMMU used on IBM Power
machines - in the default configuration - supports only a much more limited
IOVA range, usually 0..2GiB.
If the guest attempts to set up an IOVA range that the host IOMMU can't
map, qemu won't report an error until it actually attempts to map a bad
IOVA. If guest RAM is being mapped directly into the IOMMU (i.e. no guest
visible IOMMU) then this will show up very quickly. If there is a guest
visible IOMMU, however, the problem might not show up until much later when
the guest actually attempt to DMA with an IOVA the host can't handle.
This patch adds a test so that we will detect earlier if the guest is
attempting to use IOVA ranges that the host IOMMU won't be able to deal
with.
For now, we assume that "Type1" (x86) IOMMUs can support any IOVA, this is
incorrect, but no worse than what we have already. We can't do better for
now because the Type1 kernel interface doesn't tell us what IOVA range the
IOMMU actually supports.
For the Power "sPAPR TCE" IOMMU, however, we can retrieve the supported
IOVA range and validate guest IOVA ranges against it, and this patch does
so.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
If a DMA mapping operation fails in vfio_listener_region_add() it
checks to see if we've already completed initial setup of the
container. If so it reports an error so the setup code can fail
gracefully, otherwise throws a hw_error().
There are other potential failure cases in vfio_listener_region_add()
which could benefit from the same logic, so move it to its own
fail: block. Later patches can use this to extend other failure cases
to fail as gracefully as possible under the circumstances.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
David Gibson [Wed, 30 Sep 2015 02:13:51 +0000 (12:13 +1000)]
vfio: Remove unneeded union from VFIOContainer
Currently the VFIOContainer iommu_data field contains a union with
different information for different host iommu types. However:
* It only actually contains information for the x86-like "Type1" iommu
* Because we have a common listener the Type1 fields are actually used
on all IOMMU types, including the SPAPR TCE type as well
In fact we now have a general structure for the listener which is unlikely
to ever need per-iommu-type information, so this patch removes the union.
In a similar way we can unify the setup of the vfio memory listener in
vfio_connect_container() that is currently split across a switch on iommu
type, but is effectively the same in both cases.
The iommu_data.release pointer was only needed as a cleanup function
which would handle potentially different data in the union. With the
union gone, it too can be removed.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Eric Auger [Mon, 5 Oct 2015 18:30:12 +0000 (12:30 -0600)]
hw/vfio/platform: do not set resamplefd for edge-sensitive IRQS
In irqfd mode, current code attempts to set a resamplefd whatever
the type of the IRQ. For an edge-sensitive IRQ this attempt fails
and as a consequence, the whole irqfd setup fails and we fall back
to the slow mode. This patch bypasses the resamplefd setting for
non level-sentive IRQs.
Signed-off-by: Eric Auger <eric.auger@linaro.org> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Eric Auger [Mon, 5 Oct 2015 18:30:12 +0000 (12:30 -0600)]
hw/vfio/platform: change interrupt/unmask fields into pointer
unmask EventNotifier might not be initialized in case of edge
sensitive irq. Using EventNotifier pointers make life simpler to
handle the edge-sensitive irqfd setup.
Signed-off-by: Eric Auger <eric.auger@linaro.org> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Eric Auger [Mon, 5 Oct 2015 18:30:12 +0000 (12:30 -0600)]
hw/vfio/platform: irqfd setup sequence update
With current implementation, eventfd VFIO signaling is first set up and
then irqfd is setup, if supported and allowed.
This start sequence causes several issues with IRQ forwarding setup
which, if supported, is transparently attempted on irqfd setup:
IRQ forwarding setup is likely to fail if the IRQ is detected as under
injection into the guest (active at irqchip level or VFIO masked).
This currently always happens because the current sequence explicitly
VFIO-masks the IRQ before setting irqfd.
Even if that masking were removed, we couldn't prevent the case where
the IRQ is under injection into the guest.
So the simpler solution is to remove this 2-step startup and directly
attempt irqfd setup. This is what this patch does.
Also in case the eventfd setup fails, there is no reason to go farther:
let's abort.
Signed-off-by: Eric Auger <eric.auger@linaro.org> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
projects / users / dwmw2 / qemu.git / log