]> git.proxmox.com Git - qemu.git/log
qemu.git
12 years agotcg-hppa: Fix broken load/store helpers
Richard Henderson [Wed, 19 Sep 2012 02:59:48 +0000 (19:59 -0700)]
tcg-hppa: Fix broken load/store helpers

The CONFIG_TCG_PASS_AREG0 code for calling ld/st helpers
was not respecting the ABI requirement for 64-bit values
being aligned in registers.

Mirror the ARM port in use of helper functions to marshal
arguments into the correct registers.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg-hppa: Fix brcond2 and setcond2
Richard Henderson [Wed, 19 Sep 2012 02:59:47 +0000 (19:59 -0700)]
tcg-hppa: Fix brcond2 and setcond2

Neither of these functions were performing double-word
compares properly.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg: Fix !USE_DIRECT_JUMP
Richard Henderson [Mon, 17 Sep 2012 15:28:52 +0000 (08:28 -0700)]
tcg: Fix !USE_DIRECT_JUMP

Commit 6375e09e changed the type of TranslationBlock.tb_next,
but failed to change the type of TCGContext.tb_next.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agogdbstub/sh4: fix build with USE_SOFTFLOAT_STRUCT_TYPES
Aurelien Jarno [Sun, 16 Sep 2012 11:12:21 +0000 (13:12 +0200)]
gdbstub/sh4: fix build with USE_SOFTFLOAT_STRUCT_TYPES

We have to use different type to access float values when
USE_SOFTFLOAT_STRUCT_TYPES is defined.

Rework SH4 version of cpu_gdb_{read,write}_register() using
a single case, and fixing the coding style. Use ldll_p() and
stfl_p() to access float values.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg: Optimize two-address commutative operations
Richard Henderson [Fri, 21 Sep 2012 17:13:38 +0000 (10:13 -0700)]
tcg: Optimize two-address commutative operations

While swapping constants to the second operand, swap
sources matching destinations to the first operand.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg: Optimize movcond for constant comparisons
Richard Henderson [Fri, 21 Sep 2012 17:13:37 +0000 (10:13 -0700)]
tcg: Optimize movcond for constant comparisons

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg-i386: Implement movcond
Richard Henderson [Fri, 21 Sep 2012 17:13:36 +0000 (10:13 -0700)]
tcg-i386: Implement movcond

Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-alpha: Use movcond
Richard Henderson [Fri, 21 Sep 2012 17:13:35 +0000 (10:13 -0700)]
target-alpha: Use movcond

For proper cmov insns, as well as the non-goto-tb case
of conditional branch.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg: Introduce movcond
Richard Henderson [Fri, 21 Sep 2012 17:13:34 +0000 (10:13 -0700)]
tcg: Introduce movcond

Implemented with setcond if the target does not provide
the optional opcode.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-xtensa: don't emit extra tcg_gen_goto_tb
Max Filippov [Thu, 20 Sep 2012 22:59:50 +0000 (02:59 +0400)]
target-xtensa: don't emit extra tcg_gen_goto_tb

Unconditional gen_check_loop_end at the end of disas_xtensa_insn
can emit tcg_gen_goto_tb with slot id already used in the TB (e.g. when
TB ends at LEND with a branch).

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: malc <av1474@comtv.ru>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-xtensa: fix extui shift amount
Max Filippov [Thu, 20 Sep 2012 22:59:49 +0000 (02:59 +0400)]
target-xtensa: fix extui shift amount

extui opcode only uses lowermost op1 bit for sa4.

Reported-by: malc <av1474@comtv.ru>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: malc <av1474@comtv.ru>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: fix end of basic block detection
Aurelien Jarno [Wed, 19 Sep 2012 19:40:30 +0000 (21:40 +0200)]
tcg/optimize: fix end of basic block detection

Commit e31b0a7c050711884ad570fe73df806520953618 fixed copy propagation on
32-bit host by restricting the copy between different types. This was the
wrong fix.

The real problem is that the all temps states should be reset at the end
of a basic block. This was done by adding such operations in the switch,
but brcond2 was forgotten (that's why the crash was only observed on 32-bit
hosts).

Fix that by looking at the TCG_OPF_BB_END instead. We need to keep the case
for op_set_label as temps might be modified through another path.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-mips: Always evaluate debugging macro arguments
Richard Henderson [Wed, 19 Sep 2012 04:55:34 +0000 (21:55 -0700)]
target-mips: Always evaluate debugging macro arguments

this will prevent some of the compilation errors with debugging
enabled from creeping back in.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-mips: Fix MIPS_DEBUG.
Richard Henderson [Wed, 19 Sep 2012 04:55:33 +0000 (21:55 -0700)]
target-mips: Fix MIPS_DEBUG.

The macro uses the DisasContext.  Pass it around as needed.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-mips: Set opn in gen_ldst_multiple.
Richard Henderson [Wed, 19 Sep 2012 04:55:32 +0000 (21:55 -0700)]
target-mips: Set opn in gen_ldst_multiple.

Used by MIPS_DEBUG, when enabled.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agorevert "TCG: fix copy propagation"
Aurelien Jarno [Mon, 10 Sep 2012 11:14:12 +0000 (13:14 +0200)]
revert "TCG: fix copy propagation"

Given the copy propagation breakage on 32-bit hosts has been fixed
commit e31b0a7c050711884ad570fe73df806520953618 can be reverted.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg: mark set_label with TCG_OPF_BB_END flag
Aurelien Jarno [Mon, 10 Sep 2012 12:23:49 +0000 (14:23 +0200)]
tcg: mark set_label with TCG_OPF_BB_END flag

set_label is effectively the end of a basic block, as no optimization
can be made accross it. It was treated as such in the liveness analysis
code, but as a special case.

Mark it with TCG_OPF_BB_END flag so that this information can be used
by other parts of the TCG code, and remove the special case in the liveness
analysis code.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/i386: allow constants in load/store ops
Aurelien Jarno [Mon, 10 Sep 2012 11:56:24 +0000 (13:56 +0200)]
tcg/i386: allow constants in load/store ops

On x86, it is possible to move a constant value to memory. Add code to
handle a constant argument to load/store ops.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agoRemove unused CONFIG_TCG_PASS_AREG0 and dead code
Blue Swirl [Sun, 2 Sep 2012 15:28:56 +0000 (15:28 +0000)]
Remove unused CONFIG_TCG_PASS_AREG0 and dead code

Now that CONFIG_TCG_PASS_AREG0 is enabled for all targets,
remove dead code and support for !CONFIG_TCG_PASS_AREG0 case.

Remove dyngen-exec.h and all references to it. Although included by
hw/spapr_hcall.c, it does not seem to use it.

Remove unused HELPER_CFLAGS.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-mips: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 14:52:59 +0000 (14:52 +0000)]
target-mips: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-sh4: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 10:37:06 +0000 (10:37 +0000)]
target-sh4: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-cris: Switch to AREG0 free mode
Aurelien Jarno [Fri, 7 Sep 2012 14:13:27 +0000 (16:13 +0200)]
target-cris: Switch to AREG0 free mode

Add an explicit CPUCRISState parameter instead of relying on AREG0, and
use cpu_ld* in translation and interrupt handling. Remove AREG0 swapping
in tlb_fill(). Switch to AREG0 free mode

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-cris: Avoid AREG0 for helpers
Aurelien Jarno [Thu, 30 Aug 2012 14:56:39 +0000 (16:56 +0200)]
target-cris: Avoid AREG0 for helpers

Add an explicit CPUCRISState parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-microblaze: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 08:39:22 +0000 (08:39 +0000)]
target-microblaze: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-arm: final conversion to AREG0 free mode
Blue Swirl [Tue, 4 Sep 2012 20:25:59 +0000 (20:25 +0000)]
target-arm: final conversion to AREG0 free mode

Convert code load functions and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-arm: convert remaining helpers
Blue Swirl [Tue, 4 Sep 2012 20:19:15 +0000 (20:19 +0000)]
target-arm: convert remaining helpers

Convert remaining helpers to AREG0 free mode: add an explicit
CPUState parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-arm: convert void helpers
Blue Swirl [Tue, 4 Sep 2012 20:08:34 +0000 (20:08 +0000)]
target-arm: convert void helpers

Add an explicit CPUState parameter instead of relying on AREG0.

For easier review, convert only op helpers which don't return any value.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-unicore32: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 07:42:33 +0000 (07:42 +0000)]
target-unicore32: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Tested-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-m68k: avoid using cpu_single_env
Blue Swirl [Sat, 8 Sep 2012 10:48:20 +0000 (10:48 +0000)]
target-m68k: avoid using cpu_single_env

Pass around CPUState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-m68k: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 07:27:38 +0000 (07:27 +0000)]
target-m68k: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-lm32: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 06:57:17 +0000 (06:57 +0000)]
target-lm32: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: avoid cpu_single_env
Blue Swirl [Sat, 8 Sep 2012 11:15:37 +0000 (11:15 +0000)]
target-s390x: avoid cpu_single_env

Pass around CPUState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: fix if/else/break coding style
Aurelien Jarno [Fri, 7 Sep 2012 10:24:32 +0000 (12:24 +0200)]
tcg/optimize: fix if/else/break coding style

optimizer.c contains some cases were the break is appearing in both the
if and the else parts. Fix that by moving it to the outer part. Also
move some common code there.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: add constant folding for brcond
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: add constant folding for brcond

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: add constant folding for setcond
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: add constant folding for setcond

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: swap brcond/setcond arguments when possible
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: swap brcond/setcond arguments when possible

brcond and setcond ops are not commutative, but it's easy to compute the
new condition after swapping the arguments. Try to always put the constant
argument in second position like for commutative ops, to help backends to
generate better code.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: simplify shift/rot r, 0, a => movi r, 0 cases
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: simplify shift/rot r, 0, a => movi r, 0 cases

shift/rot r, 0, a is equivalent to movi r, 0.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: simplify and r, a, 0 cases
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: simplify and r, a, 0 cases

and r, a, 0 is equivalent to a movi r, 0.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: simplify or/xor r, a, 0 cases
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: simplify or/xor r, a, 0 cases

or/xor r, a, 0 is equivalent to a mov r, a.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/optimize: split expression simplification
Aurelien Jarno [Thu, 6 Sep 2012 14:47:13 +0000 (16:47 +0200)]
tcg/optimize: split expression simplification

Split expression simplification in multiple parts so that a given op
can appear multiple times. This patch should not change anything.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-arm: Fix potential buffer overflow
Stefan Weil [Tue, 4 Sep 2012 05:35:57 +0000 (07:35 +0200)]
target-arm: Fix potential buffer overflow

Report from smatch:

target-arm/helper.c:651 arm946_prbs_read(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8
target-arm/helper.c:661 arm946_prbs_write(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8

c7_region is an array with 8 elements, so the index must be less than 8.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotcg/s390: fix ld/st with CONFIG_TCG_PASS_AREG0
Aurelien Jarno [Sat, 8 Sep 2012 03:45:43 +0000 (03:45 +0000)]
tcg/s390: fix ld/st with CONFIG_TCG_PASS_AREG0

The load/store slow path has been broken in e141ab52d:
- We need to move 4 registers for store functions and 3 registers for
  load functions and not the reverse.
- According to the s390x calling convention the arguments of a function
  should be zero extended. This means that the register shift should be
  done with TCG_TYPE_I64 to ensure the higher word is correctly zero
  extended when needed.

I am aware that CONFIG_TCG_PASS_AREG0 is being removed and thus that
this patch can be improved, but doing so means it can also be applied to
the 1.1 and 1.2 stable branches.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 07:33:40 +0000 (07:33 +0000)]
target-s390x: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0.

Remove temporary wrappers and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
[agraf: fix conflicts]
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: avoid AREG0 for misc helpers
Blue Swirl [Sun, 2 Sep 2012 07:33:39 +0000 (07:33 +0000)]
target-s390x: avoid AREG0 for misc helpers

Make misc helpers take a parameter for CPUState instead
of relying on global env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
[agraf: fix conflict]
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: avoid AREG0 for condition code helpers
Blue Swirl [Sun, 2 Sep 2012 07:33:38 +0000 (07:33 +0000)]
target-s390x: avoid AREG0 for condition code helpers

Make condition code helpers take a parameter for CPUState instead
of relying on global env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: avoid AREG0 for integer helpers
Blue Swirl [Sun, 2 Sep 2012 07:33:37 +0000 (07:33 +0000)]
target-s390x: avoid AREG0 for integer helpers

Make integer helpers take a parameter for CPUState instead
of relying on global env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: avoid AREG0 for FPU helpers
Blue Swirl [Sun, 2 Sep 2012 07:33:36 +0000 (07:33 +0000)]
target-s390x: avoid AREG0 for FPU helpers

Make FPU helpers take a parameter for CPUState instead
of relying on global env.

Introduce temporary wrappers for FPU load and store ops.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: rename op_helper.c to misc_helper.c
Blue Swirl [Sun, 2 Sep 2012 07:33:35 +0000 (07:33 +0000)]
target-s390x: rename op_helper.c to misc_helper.c

Now op_helper.c contains miscellaneous helpers, rename
it to misc_helper.c.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
[agraf: fix conflict]
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: split memory access helpers
Blue Swirl [Sun, 2 Sep 2012 07:33:34 +0000 (07:33 +0000)]
target-s390x: split memory access helpers

Move memory access helpers to mem_helper.c.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
[agraf: fold softmmu include ifdefs together]
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: split integer helpers
Blue Swirl [Sun, 2 Sep 2012 07:33:33 +0000 (07:33 +0000)]
target-s390x: split integer helpers

Move integer helpers to int_helper.c.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: split condition code helpers
Blue Swirl [Sun, 2 Sep 2012 07:33:32 +0000 (07:33 +0000)]
target-s390x: split condition code helpers

Move condition code helpers to cc_helper.c.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: split FPU ops
Blue Swirl [Sun, 2 Sep 2012 07:33:31 +0000 (07:33 +0000)]
target-s390x: split FPU ops

Move floating point instructions to fpu_helper.c.

While exporting some condition code helpers,
avoid duplicate identifier conflict with translate.c.

Remove unused set_cc_nz_f64() in translate.c.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-s390x: fix style
Blue Swirl [Sun, 2 Sep 2012 07:33:30 +0000 (07:33 +0000)]
target-s390x: fix style

Before splitting op_helper.c and helper.c in the next patches,
fix style issues. No functional changes.

Replace also GCC specific __FUNCTION__ with
standard __func__.

Don't init static variable (cpu_s390x_init:inited) with 0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-sparc: fix fcmp{s,d,q} instructions wrt exception
Aurelien Jarno [Fri, 7 Sep 2012 15:13:28 +0000 (17:13 +0200)]
target-sparc: fix fcmp{s,d,q} instructions wrt exception

fcmp{s,d,q} instructions are supposed to ignore quiet NaN (contrary to
the fcmpe{s,d,q} instructions), but the current code is wrongly setting
the NV exception in that case. Moreover the current code is duplicated:
first the arguments are checked for NaN to generate an exception, and
later in case the comparison is unordered (which can only happens if one
of the argument is a NaN), the same check is done to generate an
exception.

Fix that by calling clear_float_exceptions() followed by
check_ieee_exceptions() as for the other floating point instructions.
Use the _compare_quiet functions for fcmp{s,d,q} and the _compare ones
for fcmpe{s,d,q}. Simplify the flag setting by not clearing a flag that
is set the line just below.

This fix allows the math glibc testsuite to pass.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-xtensa: fix missing errno codes for mingw32
Max Filippov [Thu, 6 Sep 2012 00:36:46 +0000 (04:36 +0400)]
target-xtensa: fix missing errno codes for mingw32

Put the following errno value mappings under #ifdef:

xtensa-semi.c: In function 'errno_h2g':
xtensa-semi.c:113: error: 'ENOTBLK' undeclared (first use in this function)
xtensa-semi.c:113: error: (Each undeclared identifier is reported only once
xtensa-semi.c:113: error: for each function it appears in.)
xtensa-semi.c:113: error: array index in initializer not of integer type
xtensa-semi.c:113: error: (near initialization for 'guest_errno')
xtensa-semi.c:124: error: 'ETXTBSY' undeclared (first use in this function)
xtensa-semi.c:124: error: array index in initializer not of integer type
xtensa-semi.c:124: error: (near initialization for 'guest_errno')
xtensa-semi.c:134: error: 'ELOOP' undeclared (first use in this function)
xtensa-semi.c:134: error: array index in initializer not of integer type
xtensa-semi.c:134: error: (near initialization for 'guest_errno')

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-cris: Fix buffer overflow
Stefan Weil [Fri, 7 Sep 2012 20:36:08 +0000 (22:36 +0200)]
target-cris: Fix buffer overflow

Report from smatch:

target-cris/translate.c:3464 cpu_dump_state(32) error:
 buffer overflow 'env->sregs' 4 <= 255

sregs is declared 'uint32_t sregs[4][16]', so the first index must be
less than 4 or ARRAY_SIZE(env->sregs).

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agotarget-xtensa: convert host errno values to guest
Max Filippov [Wed, 29 Aug 2012 19:54:25 +0000 (23:54 +0400)]
target-xtensa: convert host errno values to guest

Guest errno values are taken from the newlib. Convert only those errno
values that can be returned from used system calls.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
12 years agoUpdate version for 1.2.0 v1.2.0
Anthony Liguori [Wed, 5 Sep 2012 12:50:01 +0000 (07:50 -0500)]
Update version for 1.2.0

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoconsole: bounds check whenever changing the cursor due to an escape code
Ian Campbell [Tue, 4 Sep 2012 15:26:09 +0000 (10:26 -0500)]
console: bounds check whenever changing the cursor due to an escape code

This is XSA-17 / CVE-2012-3515

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoqemu-timer: properly arm alarm timer for timers set by device initialization
Paolo Bonzini [Mon, 3 Sep 2012 15:34:32 +0000 (17:34 +0200)]
qemu-timer: properly arm alarm timer for timers set by device initialization

QEMU will hang when fed the following command-line

  qemu-system-mips -kernel vmlinux-2.6.32-5-4kc-malta -append "console=ttyS0" -nographic -net none

The -net none is important otherwise it seems some events are generated
causing the things to work. When it doesn't work, the guest hangs when
measuring the CPU frequency, after the following line:

  [    0.000000] NR_IRQS:256

Pressing a key on the serial port unblocks it, hinting that the problem
is due to the recent elimination of the 1 second timeout in the main
loop.

The problem is that because init_timer_alarm sets the timer's pending
flag to true, the alarm timer is never armed until after the first time
through the main loop.  Thus the bug started when QEMU started testing
the pending flag in qemu_mod_timer (commit 1828be3, more alarm timer
cleanup, 2010-03-10).

But actually, it isn't true at all that a timer is pending when the
alarm timer is created, and the real bug has been latent forever: the
fix is to remove the bogus setting of pending flag.

Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Tested-by: Aurelien Jarno <aurelien@aurel32.net>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
12 years agotarget-xtensa: return ENOSYS for unimplemented simcalls
Max Filippov [Wed, 22 Aug 2012 18:03:35 +0000 (22:03 +0400)]
target-xtensa: return ENOSYS for unimplemented simcalls

This prevents guest from proceeding with uninitialised garbage returned
from unimplemented simcalls.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
12 years agoUpdate version to 1.2.0-rc3 v1.2.0-rc3
Anthony Liguori [Fri, 31 Aug 2012 15:50:46 +0000 (10:50 -0500)]
Update version to 1.2.0-rc3

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoconsole: Fix warning from clang (and potential crash)
Stefan Weil [Fri, 17 Aug 2012 13:50:44 +0000 (15:50 +0200)]
console: Fix warning from clang (and potential crash)

ccc-analyzer reports this warning:

console.c:1090:29: warning: Dereference of null pointer
        if (active_console->cursor_timer) {
                            ^

Function console_select allows active_console to be NULL,
but would crash when accessing cursor_timer. Fix this.

Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoMerge remote-tracking branch 'kraxel/usb.61' into staging
Anthony Liguori [Fri, 31 Aug 2012 15:04:54 +0000 (10:04 -0500)]
Merge remote-tracking branch 'kraxel/usb.61' into staging

* kraxel/usb.61:
  uas: move transfer kickoff
  ehci: Fix interrupt endpoints no longer working
  ehci: handle TD deactivation of inflight packets
  ehci: add ehci_cancel_queue()
  ehci: simplify ehci_state_executing
  ehci: Remove unnecessary ehci_flush_qh call
  ehci: Schedule async-bh when IAAD bit gets set
  ehci: Fix NULL ptr deref when unplugging an USB dev with an iso stream active
  usb: unique packet ids
  usb: Halt ep queue en cancel pending packets on a packet error
  fix info qtree indention

12 years agoMerge remote-tracking branch 'kwolf/for-anthony' into staging
Anthony Liguori [Fri, 31 Aug 2012 15:04:18 +0000 (10:04 -0500)]
Merge remote-tracking branch 'kwolf/for-anthony' into staging

* kwolf/for-anthony:
  qemu-iotests: add backing file smaller than image test case
  stream: complete early if end of backing file is reached
  qed: refuse unaligned zero writes with a backing file

12 years agouas: move transfer kickoff
Gerd Hoffmann [Fri, 31 Aug 2012 12:34:19 +0000 (14:34 +0200)]
uas: move transfer kickoff

Kick next scsi transfer from request release callback instead of command
completion callback, otherwise we might get stuck in case scsi_req_unref()
doesn't release the request instantly due to someone else holding a
reference too.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agoehci: Fix interrupt endpoints no longer working
Hans de Goede [Thu, 30 Aug 2012 09:20:51 +0000 (11:20 +0200)]
ehci: Fix interrupt endpoints no longer working

One of the recent changes (likely the addition of queuing support) has broken
interrupt endpoints, this patch fixes this.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
12 years agoehci: handle TD deactivation of inflight packets
Gerd Hoffmann [Tue, 21 Aug 2012 12:03:09 +0000 (14:03 +0200)]
ehci: handle TD deactivation of inflight packets

Check the TDs of inflight packets, cancel
packets in case the guest clears the active bit.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agoehci: add ehci_cancel_queue()
Gerd Hoffmann [Tue, 21 Aug 2012 11:58:40 +0000 (13:58 +0200)]
ehci: add ehci_cancel_queue()

Factor out function to cancel all packets of a queue.
No behavior change.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agoehci: simplify ehci_state_executing
Hans de Goede [Fri, 17 Aug 2012 09:39:17 +0000 (11:39 +0200)]
ehci: simplify ehci_state_executing

ehci_state_executing does not need to check for p->usb_status == USB_RET_ASYNC
or USB_RET_PROCERR, since ehci_execute_complete already does a similar check
and will trigger an assert if either value is encountered.

USB_RET_ASYNC should never be the packet status when execute_complete runs
for obvious reasons, and USB_RET_PROCERR is only used by ehci_state_execute /
ehci_execute not by ehci_state_executing / ehci_execute_complete.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agoehci: Remove unnecessary ehci_flush_qh call
Hans de Goede [Thu, 16 Aug 2012 13:47:29 +0000 (15:47 +0200)]
ehci: Remove unnecessary ehci_flush_qh call

ehci_qh_do_overlay() already calls ehci_flush_qh() before it returns, calling
it twice is useless.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agoehci: Schedule async-bh when IAAD bit gets set
Hans de Goede [Thu, 30 Aug 2012 07:55:19 +0000 (09:55 +0200)]
ehci: Schedule async-bh when IAAD bit gets set

After the "ehci: Print a warning when a queue unexpectedly contains packets
on cancel" commit. Under certain reproducable conditions I was getting the
following message: "EHCI: Warning queue not empty on queue reset".

After aprox. 8 hours of debugging I've finally found the cause. The Linux EHCI
driver has an IAAD watchdog, to work around certain EHCI hardware sometimes
not acknowledging the doorbell at all. This watchdog has a timeout of 10 ms,
which is less then the time between 2 runs through the async schedule when
async_stepdown is at its highest value.

Thus the watchdog can trigger, after which Linux clears the IAAD bit and
re-uses the QH. IOW we were not properly detecting the unlink of the qh, due
to us missing (ignoring for more then 10 ms) the IAAD command, which triggered
the warning.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
12 years agoehci: Fix NULL ptr deref when unplugging an USB dev with an iso stream active
Hans de Goede [Tue, 28 Aug 2012 09:50:26 +0000 (11:50 +0200)]
ehci: Fix NULL ptr deref when unplugging an USB dev with an iso stream active

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
12 years agousb: unique packet ids
Gerd Hoffmann [Thu, 23 Aug 2012 11:30:13 +0000 (13:30 +0200)]
usb: unique packet ids

This patch adds IDs to usb packets.  Those IDs are (a) supposed to be
unique for the lifecycle of a packet (from packet setup until the packet
is either completed or canceled) and (b) stable across migration.

uhci, ohci, ehci and xhci use the guest physical address of the transfer
descriptor for this.

musb needs a different approach because there is no transfer descriptor.
But musb also doesn't support pipelining, so we have never more than one
packet per endpoint in flight.  So we go create an ID based on endpoint
and device address.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agousb: Halt ep queue en cancel pending packets on a packet error
Hans de Goede [Fri, 17 Aug 2012 13:24:49 +0000 (15:24 +0200)]
usb: Halt ep queue en cancel pending packets on a packet error

For controllers which queue up more then 1 packet at a time, we must halt the
ep queue, and inside the controller code cancel all pending packets on an
error.

There are multiple reasons for this:
1) Guests expect the controllers to halt ep queues on error, so that they
get the opportunity to cancel transfers which the scheduled after the failing
one, before processing continues

2) Not cancelling queued up packets after a failed transfer also messes up
the controller state machine, in the case of EHCI causing the following
assert to trigger: "assert(p->qtdaddr == q->qtdaddr)" at hcd-ehci.c:2075

3) For bulk endpoints with pipelining enabled (redirection to a real USB
device), we must cancel all the transfers after this a failed one so that:
a) If they've completed already, they are not processed further causing more
   stalls to be reported, originating from the same failed transfer
b) If still in flight, they are cancelled before the guest does
   a clear stall, otherwise the guest and device can loose sync!

Note this patch only touches the ehci and uhci controller changes, since AFAIK
no other controllers actually queue up multiple transfer. If I'm wrong on this
other controllers need to be updated too!

Also note that this patch was heavily tested with the ehci code, where I had
a reproducer for a device causing a transfer to fail. The uhci code is not
tested with actually failing transfers and could do with a thorough review!

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agofix info qtree indention
Gerd Hoffmann [Wed, 11 Jul 2012 10:21:23 +0000 (12:21 +0200)]
fix info qtree indention

Without the patch bus properties are are not in line with the other
properties:

[ ... ]
  dev: fw_cfg, id ""
    ctl_iobase = 0x510
    data_iobase = 0x511
      irq 0
      mmio ffffffffffffffff/0000000000000002
      mmio ffffffffffffffff/0000000000000001
[ ... ]

With the patch applied everything is lined up properly:

[ ... ]
  dev: fw_cfg, id ""
    ctl_iobase = 0x510
    data_iobase = 0x511
    irq 0
    mmio ffffffffffffffff/0000000000000002
    mmio ffffffffffffffff/0000000000000001
[ ... ]

Needed to make the autotest qtree parser happy.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12 years agow32: Fix broken build
Stefan Weil [Thu, 30 Aug 2012 20:28:31 +0000 (22:28 +0200)]
w32: Fix broken build

Commit ef8621b1a3b199c348606c0a11a77d8e8bf135f1 added an include
file which is not available for MinGW compilations.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoUpdate version for 1.2.0-rc2 v1.2.0-rc2
Anthony Liguori [Thu, 30 Aug 2012 12:45:28 +0000 (07:45 -0500)]
Update version for 1.2.0-rc2

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoscsi-disk: Fix typo (uint32 -> uint32_t)
Stefan Weil [Wed, 29 Aug 2012 18:39:25 +0000 (20:39 +0200)]
scsi-disk: Fix typo (uint32 -> uint32_t)

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agomsix: make [un]use vectors on reset/load optional
Michael S. Tsirkin [Wed, 29 Aug 2012 16:40:56 +0000 (19:40 +0300)]
msix: make [un]use vectors on reset/load optional

The facility to use/unuse vectors dynamically is helpful
for virtio but little else: everyone just seems to use
vectors in their init function.

Avoid clearing msix vector use info on reset and load.
For virtio, clear it explicitly.
This should fix regressions reported with ivshmem - though
I didn't test this, I verified that virtio keeps
working like it did.

Tested-by: Cam Macdonell <cam@cs.ualberta.ca>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agokvm: get/set PV EOI MSR
Michael S. Tsirkin [Tue, 28 Aug 2012 17:43:56 +0000 (20:43 +0300)]
kvm: get/set PV EOI MSR

Support get/set of new PV EOI MSR, for migration.
Add an optional section for MSR value - send it
out in case MSR was changed from the default value (0).

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agolinux-headers: update to 3.6-rc3
Michael S. Tsirkin [Tue, 28 Aug 2012 17:43:42 +0000 (20:43 +0300)]
linux-headers: update to 3.6-rc3

Update linux-headers to version present in Linux 3.6-rc3.
Header asm-x96_64/kvm_para.h update is needed for the new PV EOI
feature.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agotarget-i386: disable pv eoi to fix migration across QEMU versions
Anthony Liguori [Wed, 29 Aug 2012 14:32:41 +0000 (09:32 -0500)]
target-i386: disable pv eoi to fix migration across QEMU versions

We have a problem with how we handle migration with KVM paravirt features.
We unconditionally enable paravirt features regardless of whether we know how
to migrate them.

We also don't tie paravirt features to specific machine types so an old QEMU on
a new kernel would expose features that never existed.

The 1.2 cycle is over and as things stand, migration is broken.  Michael has
another series that adds support for migrating PV EOI and attempts to make it
work correctly for different machine types.

After speaking with Michael on IRC, we agreed to take this patch plus 1 & 4
from his series.  This makes sure QEMU can migrate PV EOI if it's enabled, but
does not enable it by default.

This also means that we won't unconditionally enable new features for guests
future proofing us from this happening again in the future.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoreset PMBA and PMREGMISC PIIX4 registers.
Gleb Natapov [Tue, 7 Aug 2012 12:52:03 +0000 (15:52 +0300)]
reset PMBA and PMREGMISC PIIX4 registers.

The bug causes Windows + OVMF hang after reboot since OVMF
checks PMREGMISC to see if IO space is enabled and skip
configuration if it is.

Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoqemu-ga: Fix null pointer passed to unlink in failure branch
Stefan Weil [Fri, 24 Aug 2012 05:03:03 +0000 (07:03 +0200)]
qemu-ga: Fix null pointer passed to unlink in failure branch

Clang reports this warning:

Null pointer passed as an argument to a 'nonnull' parameter

Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agomemory: Fix copy&paste mistake in memory_region_iorange_write
Jan Kiszka [Sun, 26 Aug 2012 08:12:47 +0000 (10:12 +0200)]
memory: Fix copy&paste mistake in memory_region_iorange_write

The last argument of find_portio is "write", so this must be true here.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoivshmem: remove redundant ioeventfd configuration
Cam Macdonell [Mon, 27 Aug 2012 18:12:19 +0000 (12:12 -0600)]
ivshmem: remove redundant ioeventfd configuration

setup_ioeventfds() is unnecessary and actually causes a segfault when used
ioeventfd=on is used on the command-line.  Since ioeventfds are handled within
the memory API, it can be removed.

Signed-off-by: Cam Macdonell <cam@cs.ualberta.ca>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agohw/arm_gic.c: Define .class_size in arm_gic_info TypeInfo
Peter Maydell [Wed, 29 Aug 2012 07:52:37 +0000 (08:52 +0100)]
hw/arm_gic.c: Define .class_size in arm_gic_info TypeInfo

Add the missing .class_size definition to the arm_gic_info TypeInfo.
This fixes the memory corruption and possible segfault that otherwise
results when the class struct is allocated at too small a size and
the class init function writes off the end of it.

Reported-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
12 years agoqemu-iotests: add backing file smaller than image test case
Stefan Hajnoczi [Tue, 28 Aug 2012 14:26:49 +0000 (15:26 +0100)]
qemu-iotests: add backing file smaller than image test case

This new test case checks that streaming completes successfully when the
backing file is smaller than the image file.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
12 years agostream: complete early if end of backing file is reached
Stefan Hajnoczi [Tue, 28 Aug 2012 14:26:48 +0000 (15:26 +0100)]
stream: complete early if end of backing file is reached

It is possible to create an image that is larger than its backing file.
Reading beyond the end of the backing file produces zeroes if no writes
have been made to those sectors in the image file.

This patch finishes streaming early when the end of the backing file is
reached.  Without this patch the block job hangs and continually tries
to stream the first sectors beyond the end of the backing file.

To reproduce the hung block job bug:

  $ qemu-img create -f qcow2 backing.qcow2 128M
  $ qemu-img create -f qcow2 -o backing_file=backing.qcow2 image.qcow2 6G
  $ qemu -drive if=virtio,cache=none,file=image.qcow2
  (qemu) block_stream virtio0
  (qemu) info block-jobs

The qemu-iotests 030 streaming test still passes.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
12 years agoqed: refuse unaligned zero writes with a backing file
Stefan Hajnoczi [Tue, 28 Aug 2012 13:04:27 +0000 (14:04 +0100)]
qed: refuse unaligned zero writes with a backing file

Zero writes have cluster granularity in QED.  Therefore they can only be
used to zero entire clusters.

If the zero write request leaves sectors untouched, zeroing the entire
cluster would obscure the backing file.  Instead return -ENOTSUP, which
is handled by block.c:bdrv_co_do_write_zeroes() and falls back to a
regular write.

The qemu-iotests 034 test cases covers this scenario.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
12 years agoMerge remote-tracking branch 'bonzini/scsi-next' into staging
Anthony Liguori [Wed, 29 Aug 2012 13:23:18 +0000 (08:23 -0500)]
Merge remote-tracking branch 'bonzini/scsi-next' into staging

* bonzini/scsi-next:
  iscsi: Set number of blocks to 0 for blank CDROM devices
  scsi: more fixes to properties for passthrough devices
  esp: support 24-bit DMA
  megasas: Add 'hba_serial' property

12 years agoMerge remote-tracking branch 'riku/linux-user-for-upstream' into staging
Anthony Liguori [Wed, 29 Aug 2012 13:22:02 +0000 (08:22 -0500)]
Merge remote-tracking branch 'riku/linux-user-for-upstream' into staging

* riku/linux-user-for-upstream:
  linux-user: Clarify "Unable to reserve guest address space" error
  linux-user: fix emulation of getdents
  linux-user: arg_table need not have global scope

12 years agotcg/mips: fix broken CONFIG_TCG_PASS_AREG0 code
Aurelien Jarno [Mon, 27 Aug 2012 20:13:27 +0000 (22:13 +0200)]
tcg/mips: fix broken CONFIG_TCG_PASS_AREG0 code

The CONFIG_TCG_PASS_AREG0 code for calling ld/st helpers was
broken in that it did not respect the ABI requirement that 64
bit values were passed in even-odd register pairs. The simplest
way to fix this is to implement some new utility functions
for marshalling function arguments into the correct registers
and stack, so that the code which sets up the address and
data arguments does not need to care whether there has been
a preceding env argument.

Based on commit 9716ef3b for ARM by Peter Maydell.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
12 years agoUpdate OpenBIOS PPC image
Aurelien Jarno [Tue, 28 Aug 2012 12:47:51 +0000 (14:47 +0200)]
Update OpenBIOS PPC image

Update OpenBIOS PPC image to SVN r1063 to fix issues introduced by
commit 9e56edcf. The code change in this revision only affects PPC,
so OpenBIOS SPARC images are not updated.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
12 years agotarget-ppc: fix altivec instructions
Aurelien Jarno [Sun, 26 Aug 2012 14:12:03 +0000 (16:12 +0200)]
target-ppc: fix altivec instructions

Altivec instructions are not working anymore in PowerPC emulation,
following commit d15f74fb, which inverted two registers in the call
to helper. Fix that.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Acked-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
12 years agoaudio/winwave: previous audio buffer should be flushed
munkyu.im [Tue, 28 Aug 2012 07:42:06 +0000 (16:42 +0900)]
audio/winwave: previous audio buffer should be flushed

Winwave audio backend has problem with pausing and restart audio out.
Unlike other backends, Winwave pausing API does not flush audio buffer.
As a result, the previous audio data are played in front of
user expected sound when user restart audio.
So changes it to waveOutReset()

Signed-off-by: Munkyu Im <munkyu.im@samsung.com>
Signed-off-by: malc <av1474@comtv.ru>
12 years agoiscsi: Set number of blocks to 0 for blank CDROM devices
Ronnie Sahlberg [Fri, 17 Aug 2012 02:36:20 +0000 (12:36 +1000)]
iscsi: Set number of blocks to 0 for blank CDROM devices

The number of blocks of the device is used to compute the device size
in bdrv_getlength()/iscsi_getlength().
For MMC devices, the ReturnedLogicalBlockAddress in the READCAPACITY10
has a special meaning when it is 0.
In this case it does not mean that LBA 0 is the last accessible LBA,
and thus the device has 1 readable block, but instead it means that the
disc is blank and there are no readable blocks.

This change ensures that when the iSCSI LUN is loaded with a blank
DVD-R disk or similar that bdrv_getlength() will return the correct
size of the device as 0 bytes.

Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
12 years agoscsi: more fixes to properties for passthrough devices
Paolo Bonzini [Tue, 28 Aug 2012 10:46:18 +0000 (12:46 +0200)]
scsi: more fixes to properties for passthrough devices

Commit 0384783 (scsi-block: remove properties that are not relevant for
passthrough, 2012-07-09) removed one property that should have been
left there, "bootindex".

It also did not touch scsi-generic, while it should have.

Fix both problems.

Reported-by: Alexandre DERUMIER <aderumier@odiso.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
12 years agoesp: support 24-bit DMA
Paolo Bonzini [Thu, 2 Aug 2012 13:43:39 +0000 (15:43 +0200)]
esp: support 24-bit DMA

SeaBIOS will issue requests for more than 64k when loading a CD-ROM
image into memory.  Support the TCHI register from the AMD PCscsi
spec.

Acked-by: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>