In the 'pseries' machine the real time clock is provided by a
paravirtualized firmware interface rather than a device per se; the RTAS
get-time-of-day and set-time-of-day calls.
Out current implementations of those work directly off host time (with
an offset), not respecting options such as clock=vm which can be
specified in the -rtc command line option.
This patch reworks the RTAS RTC code to respect those options, primarily
by basing them on the qemu_clock_get_ns(rtc_clock) function instead of
directly on qemu_get_timedate() (which essentially handles host time, not
virtual rtc time).
As a bonus, this means our get-time-of-day function now also returns
nanoseconds.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
The virtual RTC time is used in two places in the pseries machine. First
is in the RTAS get-time-of-day function which returns the RTC time to the
guest. Second is in the spapr events code which is used to timestamp
event messages from the hypervisor to the guest.
Currently both call qemu_get_timedate() directly, but we want to change
that so we can properly handle the various -rtc options. In preparation,
create a helper function to return the virtual RTC time.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
Currently, the RTAS time of day functions only partially validate the
number of parameters they receive and return. Because of how the
parameters are used, this is unlikely to lead to a crash, but it's messy.
This patch adds the missing checks.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
At the moment the RTAS (firmware/hypervisor) time of day functions are
implemented in spapr_rtas.c along with a bunch of other things. Since
we're going to be expanding these a bit, move the RTAS RTC related code
out into new file spapr_rtc.c. Also add its own initialization function,
spapr_rtc_init() called from the main machine init routine.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
Currently, vmstate.h includes helper macro variants for 8, 16 and 32-bit
unsigned integers which include a "test" function which can selectively
enable or disable the field's presence in the migration stream.
There aren't similar helpers for 64-bit unsigned integers, or any size of
signed integers. This patch remedies this.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
The mc146818rtc driver exposes the current RTC date and time via the "date"
property in QOM (which is also aliased to the machine's "rtc-time"
property). Currently it uses a custom visitor function rtc_get_date to
do this.
This patch introduces new helpers to the QOM core to expose struct tm
valued properties via a getter function, so that this functionality can be
more easily duplicated in other RTC implementations.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
At the moment sPAPR only supports 512MB window for MMIO BARs. However
modern devices might want bigger 64bit BARs.
This extends MMIO window from 512MB to 62GB (aligned to
SPAPR_PCI_WINDOW_SPACING) and advertises it in 2 records in
the PHB "ranges" property. 32bit gets the space from
SPAPR_PCI_MEM_WIN_BUS_OFFSET till the end of 4GB, 64bit gets the rest
of the space. If no space is left, 64bit range is not advertised.
The MMIO space size is set to old value of 0x20000000 by default
for pseries machines older than 2.3.
The approach changes the device tree which is a guest visible change, however
it won't break migration as:
1. we do not support migration to older QEMU versions
2. migration to newer QEMU will migrate the device tree as well and since
the new layout only extends the old one and does not change address mappigns,
no breakage is expected here too.
SLOF change is required to utilize this extension.
Suggested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
The next patch will make MMIO space bigger and keep the old value for
older pseries machines.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
pseries guests can have large numbers of PCI host bridges. To avoid the
user having to specify a number of different configuration values for every
one, the device supports an "index" property which is a shorthand setting
the various window and configuration addresses from a predefined sensible
set.
There are some problems with the details at present:
* The "index" propery is signed, but negative values will create PCI
windows below where we expect, potentially colliding with other devices
* No limit is imposed on the "index" property and large values can
translate to extremely large window addresses. With PCI passthrough in
particular this can mean we exceed various mapping and physical address
limits causing the guest host bridge to not work in strange ways.
This patch addresses this, by making "index" unsigned, and imposing a
limit. Currently the limit allows indices from 0..255 which is probably
enough host bridges for the time being. It's fairly easy to extend if
we discover we need more.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
We look at two sizes specified in ISA (4K, 64K). If not found matching,
we consider it 16MB.
Without this patch we would fail to lookup address above 16MB range.
Below 16MB happened to work before because the kernel have a liner
mapping and we always looked up hash for 0xc000000000000000. The
actual real address was computed by using the 16MB offset
with the real address found with the above hash.
Without Fix:
(gdb) x/16x 0xc000000001000000
0xc000000001000000 <list_entries+453208>: Cannot access memory at address 0xc000000001000000
(gdb)
With Fix:
(gdb) x/16x 0xc000000001000000
0xc000000001000000 <list_entries+453208>: 0x00000000 0x00000000 0x00000000 0x00000000
0xc000000001000010 <list_entries+453224>: 0x00000000 0x00000000 0x00000000 0x00000000
0xc000000001000020 <list_entries+453240>: 0x00000000 0x00000000 0x00000000 0x00000000
0xc000000001000030 <list_entries+453256>: 0x00000000 0x00000000 0x00000000 0x00000000
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
Instead of tweaking a TCE table device by adding there a bypass flag,
let's add an alias to RAM and IOMMU memory region, and enable/disable
those according to the selected bypass mode.
This way IOMMU memory region can have size of the actual window rather
than ram_size which is essential for upcoming DDW support.
This moves bypass logic to VIO layer and keeps @bypass flag in TCE table
for migration compatibility only. This replaces spapr_tce_set_bypass()
calls with explicit assignment to avoid confusion as the function could
do something more that just syncing the @bypass flag.
This adds a pointer to VIO device into the sPAPRTCETable struct to provide
the sPAPRTCETable device a way to update bypass mode for the VIO device.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
A bunch of fixes all over the place.
All of ACPI refactoring has been merged.
Legacy pci commands have been dropped.
virtio header cleanup
initial patches from virtio-1.0 branch
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJU/CoXAAoJECgfDbjSjVRpX7EH/RMmgtsDO4wvqJu++lHvkB/q
kSaXZYTpJTo0i5JE7n2brwuXA4902tTg9g5TMUpGPh9Pt2QRg7RTgGC1vqZyOBos
MPw+4BO2v66S6qgX7bOf222z7r64cHTY7pLkQlrfD4usPlu2eusZ64UTW6Ru51fW
WF9E9aunbl+HnuCGq6Iez3sCLscTBJpU/lEr6oSyHhuq3aa0CjjraEeV0E/QcwJG
HTUeFymL8NFvlXZblsLI++VOv7Mxpi6yiCQ5XoKpFgGMvidwo41Aso6gB3ySGxOd
w8O3Nbu77Iw/StDRNCg/5/GapabMKh2bE4UCsYY5OS63ZtD0fl0CCblhzm/ZFPw=
=LY/j
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
pci, pc, virtio fixes and cleanups
A bunch of fixes all over the place.
All of ACPI refactoring has been merged.
Legacy pci commands have been dropped.
virtio header cleanup
initial patches from virtio-1.0 branch
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* remotes/mst/tags/for_upstream: (130 commits)
acpi: drop unused code
aml-build: comment fix
acpi-build: fix typo in comment
acpi: update generated files
vhost user:support vhost user nic for non msi guests
aml-build: fix build for glib < 2.22
acpi: update generated files
Makefile.target: binary depends on config-devices
acpi-test-data: update after pci rewrite
acpi, mem-hotplug: use PC_DIMM_SLOT_PROP in acpi_memory_plug_cb().
pci-hotplug-old: Has been dead for five major releases, bury
pci: Give a few helpers internal linkage
acpi: make build_*() routines static to aml-build.c
pc: acpi: remove not used anymore ssdt-[misc|pcihp].hex.generated blobs
pc: acpi-build: drop template patching and create PCI bus tree dynamically
tests: ACPI: update pc/SSDT.bridge due to new alg of PCI tree creation
pc: acpi-build: simplify PCI bus tree generation
tests: add ACPI blobs for qemu with bridge cases
tests: bios-tables-test: add support for testing bridges
tests: ACPI test blobs update due to PCI0._CRS changes
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Conflicts:
hw/pci/pci-hotplug-old.c
* remotes/qmp-unstable/queue/qmp:
docs: add memory-hotplug.txt
qemu-options.hx: improve -m description
virtio-balloon: Add some trace events
virtio-balloon: Fix balloon not working correctly when hotplug memory
pc-dimm: add a function to calculate VM's current RAM size
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Recent changes left acpi_get_hex unused,
and clag is unhappy about it:
error: unused function 'acpi_get_hex'
Drop it, as well as some unused macros.
Signer-off-by: Michael S. Tsirkin <mst@redhat.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAABAgAGBQJU9w9WAAoJEEy22O7T6HE47gkQANX6U1MUuswNSzV0Bqqlbr/W
KCg7zabSZor4GZm0MhjCuskWcSiQGeEfDnd4ffdj26/yJf7syBvtXYdJkUVVw63y
rzqFOx8rAcHA+rd6dBaaCJG5Pd8aV2f+vpzBz7gD0coMn6Ge3rZIgQuk+yGwI0ao
mL1QOiBO31Hht++zU3ilyZ1l53+D0cVGL7ywCzpNLvKxXK5bWutXp52cKwFrJtHv
r5Ozrq7K9nCmQLysmOYy1I62pqzWxTLy/1zEpwHbbVordhxuquhOWmnhl6m0zZzE
WsJoVJUHmNtm/W0zvFS/rHDovl2ZHLqHPJVI9vdxKSF8ceQv9QppssVkM+8tPaNL
ijkXa73YTnSdx3YGlbfJZsbPembt3gggVoOYJTRLUTGkxKHyL8Y8x6Vt+4cHOljz
UpqBYuC5tj7NeKKHw1mG4dyh4DAWw4hkaFDalqrTDBVFn5t2efIuQTVVcEahXIB2
3eF7wJfokNe835qcLJ0KnnfebfdYlMTo7fVz04FhscPuo5zxotRTIT98BN1yq3A3
zZaPzQnZXT0tqZOjiVEhaNzCFHRnSMPFjNHbHqoAOTsIbMSgcLiKJ8TO/ekSfq56
y8M2Uds8+vF6fjpPDtIfYu782P3EeKqk+lzNbXusY69GbwBTAPxQ0LRpxL9HhhSN
d/Gkj21xqhjUu65Lb+XC
=5gJq
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150304-1' into staging
misc spice/qxl fixes.
# gpg: Signature made Wed Mar 4 13:57:42 2015 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
* remotes/spice/tags/pull-spice-20150304-1:
hmp: info spice: take out webdav
hmp: info spice: Show string channel name
qxl: drop update_displaychangelistener call for secondary qxl devices
vga: refactor vram_size clamping and rounding
qxl: refactor rounding up to a nearest power of 2
spice: fix invalid memory access to vga.vram
qxl: document minimal video memory for new modes
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAABAgAGBQJU9WUDAAoJEEy22O7T6HE4oj4QALvuVh+ZBk9WMRs+6+e/hNwl
EQwx3+yy1A4eB/XetCdBOT6Besk1t4snDXqw3GwCVXbRzCNOyNn+ptynDvIOMxqH
2juKCB91yhSrgGUqx/sU3iNe9PjUE+g5MZE3BBgmjgKSNlqULP1lSKmRNfdYGH+3
vLF2P0Qtv7AHCN+eRLZJGCD3xxaE0QAU9t77OoTyYS6KRFinAaOiU6FBTLH11xVW
LPWU3iVY7SuE7PT8EsmAwr2Gizt/pztRSOViIqba6UxUhrRM8zjMfi7bKC+NqIP6
aeCAoQExCvs7tVBQ/N4+NLmYzbhRdyCNxMVmWFOnF37FH9aRMZRypc0dxvEksW8p
HsRBNXWiuQyAtdOPiaQ/XBFKzpUjFo6s6GBtPMGkXRA/6puEvzIUQZmFbWfFpkVr
Ippj3vMTgJv9IE1wzExv9inamzko+kWPI8JQBuMN7XvNpKAMHyGmIKniNDMZaqNA
/iFMFJXLwTNTO/oYLkHCttgfty50ktZ1wvlZnbKt4zV89Qw2lOaeGiFIgJdUcMHN
54ssxDaoECMFiRlhqmraUg5HgjHTc5Bo0P/sp8G183Vp63mZS52/KRldvqmrM8jK
ZpvEmbwpGzZsHsDEszInvJTUX6QTE6rSvwMJdfoy9tVWsyIGMJDiyJXotVZZZepz
OTr6WkRo9KpYNRafuuG7
=+CKl
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150303-1' into staging
xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set
# gpg: Signature made Tue Mar 3 07:38:43 2015 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
* remotes/kraxel/tags/pull-usb-20150303-1:
xhci: generate a Transfer Event for each Transfer TRB with the IOC bit set
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQEcBAABAgAGBQJU9UQvAAoJELp6ZbDd4w+7xGIH+wWRO2PEQptPazlRE/q0A1Hw
zmAHVNq1HAjR5NmUQVmUK/Di/qShmK8Dq9/5PV2g2z//f82KnMcnpR8yX8WJjuOB
Pw1UhAyVlq6qlCn+lsRMEIs06krJNkuEvUd/aqzfi18+cAyelVVEBik7Vu/d8Pl1
xaPUe8upEJuUMz/NqFVe88wED4vDRn6qzxv9OwuMh8dXQQxFM/lLeaU4n3Vtg5Ba
BY00OBxeLP/+p1By2aZZLDx/X9wFmEaxVD1n5Qm9zdXkiACXweoAwjSWV0wTLdZN
zoq10i25/mMs/wYd++MUefvVC9GXwk4IYxXG7jMtvclwKUxmlkCcfKCWEZw3npQ=
=yBF7
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/gonglei/tags/bootdevice-next-20150303' into staging
bootdevice: bug fixes
# gpg: Signature made Tue Mar 3 05:18:39 2015 GMT using RSA key ID DDE30FBB
# gpg: Good signature from "Gonglei <arei.gonglei@huawei.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 5178 9C82 617F 2F58 8693 63B1 BA7A 65B0 DDE3 0FBB
* remotes/gonglei/tags/bootdevice-next-20150303:
bootdevice: add check in restore_boot_order()
bootdevice: check boot order argument validation before vm running
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCgAGBQJU9QpiAAoJEArSxjlracoUHg0P/297yR07ZkBM6BJRz93VhUj7
ym/XDRnKMlccjRXcWJpEHZzdb0eq4gWfmmGdUjh7dZ7JINFsKTU0ZGYEnK0D9ZLh
oYmpKG+5b7gvdjKO2OrQ8SZbJY2UfWnB3B1v1L9En13dJ6VKKjhYgjE6+0hs1JzN
aJIVOqvDkKYxBPtp1qC4bJDzV0wY1r08mZQORVTziZMRkyLdd6HxQxpE93EB6CAm
MTpXDZqcee+Ht8b3ZQc9R5v8csg2mO4O+JxvYBVOcg8b6PZNXCESEjuPaar0Jfo7
S3cubh/tam1KG77+R9t/ktd1yLzLAniTSkEaAgq3LEVvB72YaUiOqc/hcNqZBWo+
OtVgW9dG9ul5Sk68RfsNRql3PsvUQl9Do/UiB/cqOQoDZzDBtbadrl2CznJRpdFP
QMmQwWpdSbRsCMI5TLtJ6EoVJl9HcV9FpS1ojZGcRuYi0AZIBE1t+kAibylV1Ff7
oaOZLBxHlSgU58aUgcBD9T3sV1FBcKG6EaYeEzYF8oTaBtGr4w7z+XM9d1NqxROd
ztrsOwa5OgLnTeChhiAx2gZ9o75Q3aq1F1of6FC2litqDweR9rLWr1qcky+kGhwF
VCX7tc0QRG4rz8tOH6+aPBGZ9CTfvkOyokuLUrwHQSpI1xqP/hMUa6QdaHwOchgE
Nch1TIkVVcJL+ij6NGTy
=AwBl
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/bkoppelmann/tags/pull-tricore-20150303' into staging
TriCore RRR1, RRR2 instructions and bugfixes
# gpg: Signature made Tue Mar 3 01:12:02 2015 GMT using RSA key ID 6B69CA14
# gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"
* remotes/bkoppelmann/tags/pull-tricore-20150303:
target-tricore: Add instructions of RRR1 opcode format, which have 0xc3 as first opcode
target-tricore: Add instructions of RRR1 opcode format, which have 0x43 as first opcode
target-tricore: Add instructions of RRR1 opcode format, which have 0x83 as first opcode
target-tricore: Add instructions of RRR2 opcode format
target-tricore: fix msub32_suov return wrong results
target-tricore: Fix RLC_ADDI, RLC_ADDIH using wrong microcode helper
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Ignore writes to unassigned areas of system I/O regison and return 0 for
reads. This makes drivers for unimportant unimplemented hardware blocks
happy.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
This document describes how to use memory hotplug in QEMU.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>
Add memory hotplug options to the command-line format. Also,
add a complete command-line example and improve description.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Paulo Vital <paulo.vital@profitbricks.com>
When do memory balloon, it takes the 'ram_size' as the VM's current ram size,
But 'ram_size' is the startup configured ram size, it does not take into
account the hotplugged memory.
As a result, the balloon result will be confused.
Steps to reproduce:
(1)Start VM: qemu -m size=1024,slots=4,maxmem=8G
(2)In VM: #free -m : 1024M
(3)qmp balloon 512M
(4)In VM: #free -m : 512M
(5)hotplug pc-dimm 1G
(6)In VM: #free -m : 1512M
(7)qmp balloon 256M
(8)In VM: #free -m :1256M
We expect the VM's available ram size to be 256M after 'qmp balloon 256M'
command, but VM's real available ram size is 1256M.
For "qmp balloon" is not performance critical code, we use function
'get_current_ram_size' to get VM's current ram size.
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
The global parameter 'ram_size' does not take into account
the hotplugged memory.
In some codes, we use 'ram_size' as current VM's real RAM size,
which is not correct.
Add function 'get_current_ram_size' to calculate VM's current RAM size,
it will enumerate present memory devices and also plus ram_size.
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Obvious suggestion for the next spice-protocol
release: Add some way to #ifdef new stuff.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
Currently, vhost user nic doesn't support non msi guests(like pxe stage) by default.
Vhost user nic can't fall back to qemu like normal vhost net nic does. So we should
enable it for non msi guests.
Signed-off-by: Haifeng Gao <gaohaifeng.gao@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
g_ptr_array_new_with_free_func is there since glib 2.22,
use the older g_ptr_array_foreach instead.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
If the iothread lock isn't taken by the main thread, the RCU callbacks
might run concurrently with the main thread. QEMU's not ready for that.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Tested-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
- bootdevice, iscsi, virtio-scsi fixes
- build system patches for MinGW and config-devices.mak
- qemu_mutex_lock_iothread deadlock fixes
- another tiny patch from the record/replay series
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQEcBAABAgAGBQJU9DRyAAoJEL/70l94x66D5ZkH/2SPp4rrLIgotyzHTIaMvi+2
0gB7Bks9cDisFyiSgr6dqLp9CV1XMlv/NZl+z+H/7og96qhBWjAKVpG1J/En55bS
vanFeWGYjINuQLnhC3pqBi2kmEkzBQSIMJZt9WnDydfQj/6Wgcr6iabOpd8eTjTz
rqE/UcV2L1baFPLy/Wky2vg/a5Ug2rj+fqvjRdFB/Zx8yDYLcKYJlI8utSQexamE
tUcxr/AqxNOoe6WZD7CCVNmHMHvajoOhWnVY4EgHDg8L3nNSgvDF3AjYfntU6A2y
HjkS0ktvQK666oNo+ORRBzLe3s9nCfB1dMK2ZiKKyFfyuYD50d2N3oHKSAIsEJo=
=AQjO
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
- more config options
- bootdevice, iscsi, virtio-scsi fixes
- build system patches for MinGW and config-devices.mak
- qemu_mutex_lock_iothread deadlock fixes
- another tiny patch from the record/replay series
# gpg: Signature made Mon Mar 2 09:59:14 2015 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* remotes/bonzini/tags/for-upstream:
cpus: be more paranoid in avoiding deadlocks
cpus: fix deadlock and segfault in qemu_mutex_lock_iothread
virtio-scsi: Allocate op blocker reason before blocking
Makefile.target: binary depends on config-devices
Makefile: don't silence mak file test with V=1
Makefile: fix up parallel building under MSYS+MinGW
iscsi: Handle write protected case in reopen
Give ivshmem its own config option
Create specific config option for "platform-bus"
Add specific config options for PCI-E bridges
bootdevice: fix segment fault when booting guest with '-kernel' and '-initrd'
timer: replace time() with QEMU_CLOCK_HOST
virtio-scsi-dataplane: Call blk_set_aio_context within BQL
block: Forbid bdrv_set_aio_context outside BQL
scsi: give device a parent before setting properties
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
At the moment, when the XHCI driver in edk2
(MdeModulePkg/Bus/Pci/XhciDxe/XhciDxe.inf) runs on QEMU, with the options
-device nec-usb-xhci -device usb-kbd
it crashes with:
ASSERT MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c(1759):
TrsRing != ((void*) 0)
The crash hits in the following edk2 call sequence (all files under
MdeModulePkg/Bus/):
UsbEnumerateNewDev() [Usb/UsbBusDxe/UsbEnumer.c]
UsbBuildDescTable() [Usb/UsbBusDxe/UsbDesc.c]
UsbGetDevDesc() [Usb/UsbBusDxe/UsbDesc.c]
UsbCtrlGetDesc(USB_REQ_GET_DESCRIPTOR) [Usb/UsbBusDxe/UsbDesc.c]
UsbCtrlRequest() [Usb/UsbBusDxe/UsbDesc.c]
UsbHcControlTransfer() [Usb/UsbBusDxe/UsbUtility.c]
XhcControlTransfer() [Pci/XhciDxe/Xhci.c]
XhcCreateUrb() [Pci/XhciDxe/XhciSched.c]
XhcCreateTransferTrb() [Pci/XhciDxe/XhciSched.c]
XhcExecTransfer() [Pci/XhciDxe/XhciSched.c]
XhcCheckUrbResult() [Pci/XhciDxe/XhciSched.c]
//
// look for TRB_TYPE_DATA_STAGE event [1]
//
//
// Store a copy of the device descriptor, as the hub device
// needs this info to configure endpoint. [2]
//
UsbSetConfig() [Usb/UsbBusDxe/UsbDesc.c]
UsbCtrlRequest(USB_REQ_SET_CONFIG) [Usb/UsbBusDxe/UsbDesc.c]
UsbHcControlTransfer() [Usb/UsbBusDxe/UsbUtility.c]
XhcControlTransfer() [Pci/XhciDxe/Xhci.c]
XhcSetConfigCmd() [Pci/XhciDxe/XhciSched.c]
XhcInitializeEndpointContext() [Pci/XhciDxe/XhciSched.c]
//
// allocate transfer ring for the endpoint [3]
//
USBKeyboardDriverBindingStart() [Usb/UsbKbDxe/EfiKey.c]
UsbIoAsyncInterruptTransfer() [Usb/UsbBusDxe/UsbBus.c]
UsbHcAsyncInterruptTransfer() [Usb/UsbBusDxe/UsbUtility.c]
XhcAsyncInterruptTransfer() [Pci/XhciDxe/Xhci.c]
XhcCreateUrb() [Pci/XhciDxe/Xhci.c]
XhcCreateTransferTrb() [Pci/XhciDxe/XhciSched.c]
XhcSyncTrsRing() [Pci/XhciDxe/XhciSched.c]
ASSERT (TrsRing != NULL) [4]
UsbEnumerateNewDev() in the USB bus driver issues a GET_DESCRIPTOR
request, in order to determine the number of configurations that the
endpoint supports. The requests consists of three stages (three TRBs),
setup, data, and status. The length of the response is determined in [1],
namely from the transfer event that the host controller generates in
response to the request's middle stage (ie. the data stage).
If the length of the answer is correct (a full GET_DESCRIPTOR request
takes 18 bytes), then the XHCI driver that underlies the USB bus driver
"snoops" (caches) the descriptor data for later [2].
Later, the USB bus driver sends a SET_CONFIG request. The underlying XHCI
driver allocates a transfer ring for the endpoint, relying on the data
snooped and cached in step [2].
Finally, the USB keyboard driver submits an asynchronous interrupt
transfer to manage the keyboard. As part of this it asserts [4] that the
ring has been allocated in step [3].
And this ASSERT() fires. The root cause can be found in the way QEMU
handles the initial GET_DESCRIPTOR request.
Again, that request consists of three stages (TRBs, Transfer Request
Blocks), "setup", "data", and "status". The XhcCreateTransferTrb()
function sets the IOC ("Interrupt on Completion") flag in each of these
TRBs.
According to the XHCI specification, the host controller shall generate a
Transfer Event in response to *each* individual TRB of the request that
had the IOC flag set. This means that QEMU should queue three events:
setup, data, and status, for edk2's XHCI driver.
However, QEMU only generates two events:
- one for the setup (ie. 1st) stage,
- another for the status (ie. 3rd) stage.
No event is generated for the middle (ie. data) stage. The loop in QEMU's
xhci_xfer_report() function runs three times, but due to the "reported"
variable, only the first and the last TRBs elicit events, the middle (data
stage) results in no event queued.
As a consequence:
- When handling the GET_DESCRIPTOR request, XhcCheckUrbResult() in [1]
does not update the response length from zero.
- XhcControlTransfer() thinks that the response is invalid (it has zero
length payload instead of 18 bytes), hence [2] is not reached; the
device descriptor is not stashed for later, and the number of possible
configurations is left at zero.
- When handling the SET_CONFIG request, (NumConfigurations == 0) from
above prevents the allocation of the endpoint's transfer ring.
- When the keyboard driver tries to use the endpoint, the ASSERT() blows
up.
The solution is to correct the emulation in QEMU, and to generate a
transfer event whenever IOC is set in a TRB.
The patch replaces
!reported && (IOC || foo) == !reported && IOC ||
!reported && foo
with
IOC || (!reported && foo) == IOC ||
!reported && foo
which only changes how
reported && IOC
is handled. (Namely, it now generates an event.)
Tested with edk2 built for "qemu-system-aarch64 -M virt" (ie.
"ArmVirtualizationQemu.dsc", aka "AAVMF"), and guest Linux.
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Commit 3dcadce507 added three
update_displaychangelistener call sites:
Two for primary qxl cards, when entering/leaving vga mode, which are
correct.
One for secondary qxl cards, which is wrong because we don't register
a displaychangelistener in the first place for secondary cards.
Remove it.
Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Make the code a bit more obvious.
We don't have min/max, so a general helper for clamp probably isn't
acceptable either.
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
We already have pow2floor, mirror it and use instead of a function with
similar results (same in used domain), to clarify our intent.
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
vga_common_init() doesn't allow more than 256 MiB vram size and silently
shrinks any larger value. qxl_dirty_surfaces() used the unshrinked size
via qxl->shadow_rom.surface0_area_size when accessing the memory, which
resulted in segfault.
Add a workaround for this case and an assert if it happens again.
We have to bump the vga memory limit too, because 256 MiB wouldn't have
allowed 8k (it requires more than 128 MiB).
1024 MiB doesn't work, but 512 MiB seems fine.
Proposed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
qemu_boot_set() can't fail in restore_boot_order(),
then simply assert it doesn't fail, by passing
&error_abort if boot_set_handler set.
Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Either 'once' option or 'order' option can take effect for -boot at
the same time, that is say initial startup processing can check only
one. And pc.c's set_boot_dev() fails when its boot order argument
is invalid. This patch provide a solution fix this problem:
1. If "once" is given, register reset handler to restore boot order.
2. Pass the normal boot order to machine creation. Should fail when
the normal boot order is invalid.
3. If "once" is given, set it with qemu_boot_set(). Fails when the
once boot order is invalid.
4. Start the machine.
5. On reset, the reset handler calls qemu_boot_set() to restore boot
order. Should never fail.
Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJU7yYbAAoJEDhwtADrkYZTjHwP/RPQk8i+cehRVwvxgUFjNwRC
BIEt0WxKLBqKKOdnzsB3xZAg3LZ2LyL4bnUXnOtd1Qlh1HNdMhn+Dwp7eEMOsjGG
z8Kheaq8Bcf7eZXQ8KrHG2ZMWk/mXdMJ/hpUVzyOydoHreJYdmBesnZwdxSkNSCm
x2iTWfTkUP/28CoqW5JuXMNOHT3spnmGyCpeL64PbEXWilHu2NajH4xAnn8VAliC
jeIjkOBt9E+H9JZ1yuRp9KhzjczC2AXK2rCKaFKXzNXlDpJvPubUP+GA5N6t9u6T
QpmDRsai1xUGzwJ656DhpGHRnrWO4euCnck1IvMmLtMi94IdRV0P13kER0CIWz1T
K21m6R0gnW8Ko+svnmyYLAuEonLJ2JJBxHj4F5lw+EsEuIEKcDWZRYukclx6cF+1
rQMyxGyMeIV9sKxCfs+6fSe8fPhUo9rklCQwNcRZdzKlF2vw9qzqy0lowosrlTQm
dkJWJ0CMpIWP2j9alLTH1lJNHr7ADRnnBjlzYJJB0Rezgi4DvE9qUlCYwCNwWswN
4HQ6sYJxfUGbBKvifFPGIoqrUoYyoYTYnJ/R9EuRg7xVtZ0Zuzbl9Ax1qtssoUbm
6QH/5kCWy9v9WUt43WwY3yJiK3dupS35roswec2bNpCnF2QMkFOPz+VjmOAx276o
BJFeJwcRskSpx3+ZWlHT
=0lJo
-----END PGP SIGNATURE-----
Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-02-26' into staging
QemuOpts: Convert various setters to Error
# gpg: Signature made Thu Feb 26 13:56:43 2015 GMT using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>"
* remotes/armbru/tags/pull-error-2015-02-26:
qtest: Use qemu_opt_set() instead of qemu_opts_parse()
pc: Use qemu_opt_set() instead of qemu_opts_parse()
qemu-sockets: Simplify setting numeric and boolean options
block: Simplify setting numeric options
qemu-img: Suppress unhelpful extra errors in convert, amend
QemuOpts: Propagate errors through opts_parse()
QemuOpts: Propagate errors through opts_do_parse()
QemuOpts: Drop qemu_opt_set(), rename qemu_opt_set_err(), fix use
block: Suppress unhelpful extra errors in bdrv_img_create()
qemu-img: Suppress unhelpful extra errors in convert, resize
QemuOpts: Convert qemu_opts_set() to Error, fix its use
QemuOpts: Convert qemu_opt_set_number() to Error, fix its use
QemuOpts: Convert qemu_opt_set_bool() to Error, fix its use
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Add helpers helper_addsur_h/_ssov which adds one halfword and subtracts one
halfword, rounds / and saturates each half word independently.
Add microcode helper functions:
* gen_maddsu_h/sus_h: multiply two halfwords left justified and add to the
first one word and subtract from the second one word
/ and saturate each resulting word independetly.
* gen_maddsum_h/sums_h: multiply two halfwords in q-format left justified
and add to the first one word and subtract from
the second one word / and saturate each resulting
word independetly.
* gen_maddsur32_h/32s_h: multiply two halfwords in q-format left justified
and add to the first one word and subtract from
the second one word, round both results / and
saturate each resulting word independetly.
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Add helpers:
* madd64_q_ssov: multiply two 32 bit q-format number, add them with a
64 bit q-format number and saturate.
* madd32_q_add_ssov: add two 64 bit q-format numbers and return a 32 bit
result.
* maddr_q_ssov: multiplay two 32 bit q-format numbers, add a 32 bit
q-format number and saturate.
* maddr_q: multiplay two 32 bit q-format numbers and add a 32 bit
q-format number.
Note: madd instructions in the q format can behave strange, e.g.
0x1 + (0x80000000 * 0x80000000) << 1 for 32 bit signed values does not cause an
overflow on the guest, because all intermediate results should be handled as if
they are indefinitely precise. We handle this by inverting the overflow bit for
all cases: a + (0x80000000 * 0x80000000) << 1.
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Add helpers:
* add64_ssov: adds two 64 bit values and saturates the result.
* addr_h/_ssov: adds two halfwords with two words in q-format with rounding
/ and saturates each result independetly.
Add microcode generator:
* gen_add64_d: adds two 64 bit values.
* gen_addsub64_h: adds/subtracts one halfwords with a word and adds/
subtracts another halftword with another word.
* gen_madd_h/s_h: multiply four halfwords, add each result left justfied
to two word values / and saturate each result.
* gen_maddm_h/s_h: multiply four halfwords, add each result left justfied
to two words values in q-format / and saturate each
result.
* gen_maddr32/64_h/s_h: multiply four halfwords, add each result left
justfied to two halftwords/words values in q-format
/ and saturate each result.
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Richard Henderson <rth@twiddle.net>
