David Gibson [Tue, 12 Mar 2013 00:31:28 +0000 (00:31 +0000)]
mmu-hash*: Separate PTEG searching from permissions checking
find_pte{32,64{() do several things. First they search through a PTEG
ooking for a PTE matching our virtual address. Then they do permissions
checking and other processing on that PTE.
This patch separates the search by VA out from the rest. The search is
combined with the pte{32,64}_match() functions into new
ppc_has{32,64}_pteg_search() functions.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:27 +0000 (00:31 +0000)]
mmu-hash*: Don't keep looking for PTEs after we find a match
BEHAVIOUR CHANGE
The ppc hash mmu hashes each virtual address to a primary and secondary
possible hash bucket (aka PTE group or PTEG) each with 8 PTEs. Then we
need a linear search through the PTEs to find the correct one for the
virtual address we're translating.
It is a programming error for the guest to insert multiple PTEs mapping the
same virtual address into a PTEG - in this case the ppc architecture says
the MMU can either act as if just one was present, or give a machine check.
Currently our code takes the first matching PTE in a PTEG if it finds a
successful translation. But if a matching PTE is found, but permission
bits don't allow the access, we keep looking through the PTEG, checking
that any other matching PTEs contain an identical translation.
That behaviour is perhaps not exactly wrong, but it's certainly not useful.
This patch changes it to always just find the first matching PTE in a PTEG.
In addition, if we get a permissions problem on the primary PTEG, we then
search the secondary PTEG. This is incorrect - a permission denying PTE
in the primary PTEG should not be overwritten by an access granting PTE in
the secondary (although again, it would be a programming error for the
guest to set up such a situation anyway). So additionally we update the
code to only search the secondary PTEG if no matching PTE is found in the
primary at all.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:26 +0000 (00:31 +0000)]
mmu-hash*: Cleanup segment-level NX check
On the ppc hash mmus, no-execute can be set at the segment level (on more
recent 64-bit hash mmus it can also be set at the page level). This patch
separates out this check to make it clearer what is going on, and avoiding
excessive indentation of the remaining translation code.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:25 +0000 (00:31 +0000)]
mmu-hash32: Split direct store segment handling into a helper
This further separates the unusual case handling of direct store segments
from the main translation path by moving its logic into a helper function,
with some tiny cleanups along the way.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:24 +0000 (00:31 +0000)]
mmu-hash32: Split out handling of direct store segments
At present a large chunk of ppc_hash32_translate() is taken up with an
ugly if selecting between direct store segments (hardly ever used) and
normal paged segments. This patch clarifies the flow of code by
handling direct store segments immediately then returning, leaving the
straight line code to describe the normal MMU path.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:23 +0000 (00:31 +0000)]
mmu-hash*: Combine ppc_hash{32, 64}_get_physical_address and get_segment{32, 64}()
After previous work, ppc_hash{32,64}_get_physical_address() are almost
trivial wrappers around get_segment{32,64}() which does nearly all the work of
translating an address according to the hash mmu model. Therefore combine the
two functions into one, under the better name of
ppc_hash{32,64}_translate().
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:22 +0000 (00:31 +0000)]
mmu-hash*: Remove eaddr field from mmu_ctx_hash{32, 64}
The eaddr field of mmu_ctx_hash{32,64} is effectively just used to pass the
effective address from get_segment{32,64}() to find_pte{32,64}(). Just
pass it as a normal parameter instead.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:21 +0000 (00:31 +0000)]
mmu-hash64: Remove nx from mmu_ctx_hash64
The nx field in mmu_ctx_hash64 is used in two different functions. But its
used for slightly different things in each place, and the value is never
propagated between them. In other words, it might as well be two local
variables. This patch makes it so.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:20 +0000 (00:31 +0000)]
mmu-hash*: Reduce use of access_type
In ppc env->access_type is updated by e.g. integer load/stores with
ACCESS_INT floating point load/stores with ACCESS_FLOAT and so forth. In
hash mmu fault paths it can also b set to ACCESS_CODE for instruction
fetch accesses.
But the only place which uses anything more of the access_type than
whether it is instruction fetch or data access is the direct store segment
handling. Instruction versus data access can be more simply determined
from the rw value passed down from the top.
This changes the code to use rw in preference to checking access_type.
For the 32-bit case there is a small amount of code (for direct store
segments) that still needs the full access type. Instead of passing it
all the way down the stack, we retrieve it from the env structure, which
is where it came anyway, before this patch.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:19 +0000 (00:31 +0000)]
mmu-hash*: Add hash pte load/store helpers
On real hardware the ppc hash page table is stored in memory; accordingly
our mmu emulation code can read a hash page table in guest memory. But,
when paravirtualized under PAPR, the real hash page table is in host
memory, accessible to the guest only via hypercalls. We model this by
also allowing the MMU emulation code to access a specially allocated hash
page table outside the guest's memory image. At present these two options
are implemented with some ugly conditionals at each access point in the mmu
emulation code. In the implementation of the PAPR hypercalls, we assume
the external hash table.
This patch cleans things up by adding helpers to load and store from the
hash table for both 32-bit and 64-bit hash mmus. The 64-bit versions
handle both the in-guest-memory and outside guest memory cases. The 32-bit
versions only handle the in-guest-memory case since no 32-bit systems can
have an external hash table at present.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:18 +0000 (00:31 +0000)]
mmu-hash*: Add header file for definitions
Currently cpu.h contains a number of definitions relating to the 64-bit
hash MMU. Some are used in the MMU emulation code, but some are only used
in the spapr MMU management hcall implementations.
This patch moves these definitions (except for a few that are needed
more widely) into mmu-hash64.h header, shared between the MMU emulation
code and the spapr hcall code. The MMU emulation code is also updated to
actually use a number of those definitions in place of hard coded
constants.
Similarly, we add new analogous definitions to mmu-hash32.h and use those
in place of many hard-coded constants in mmu-hash32.c
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
[agraf: fix 32-bit hosts] Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:17 +0000 (00:31 +0000)]
target-ppc: mmu_ctx_t should not be a global type
mmu_ctx_t is currently defined in cpu.h. However it is used for temporary
information relating to mmu translation, and is only used in mmu_helper.c
and (now) mmu-hash{32,64}.c. Furthermore it contains information which
should be specific to particular MMU types. Therefore, move its definition
to mmu_helper.c. mmu-hash{32,64}.c are converted to use new data types
private to the relevant MMUs (identical to mmu_ctx_t for now, but that will
change in future patches).
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:16 +0000 (00:31 +0000)]
target-ppc: Disentangle BAT code for 32-bit hash MMUs
The functions for looking up BATs (Block Address Translation - essentially
a level 0 TLB) are shared between the classic 32-bit hash MMUs and the
6xx style software loaded TLB implementations.
This patch splits out a copy for the 32-bit hash MMUs, to facilitate
cleaning it up. The remaining version is left, but cleaned up slightly
to no longer deal with PowerPC 601 peculiarities (601 has a hash MMU).
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:15 +0000 (00:31 +0000)]
target-ppc: Don't share get_pteg_offset() between 32 and 64-bit
The get_pteg_offset() helper function is currently shared between 32-bit
and 64-bit hash mmus, taking a parameter for the hash pte size. In the
64-bit paths, it's only called in one place, and it's a trivial
calculation. This patch, therefore, open codes it for 64-bit. The
remaining version, which is used in two places is made 32-bit only and
moved to mmu-hash32.c.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:14 +0000 (00:31 +0000)]
target-ppc: Disentangle hash mmu helper functions
The newly separated paths for hash mmus rely on several helper functions
which are still shared with 32-bit hash mmus: pp_check(), check_prot() and
pte_update_flags(). While these don't have ugly ifdefs on the mmu type,
they're not very well thought out, so sharing them impedes cleaning up the
hash mmu paths. For now, put near-duplicate versions into mmu-hash64.c and
mmu-hash32.c, leaving the old version in mmu_helper.c for 6xx software
loaded tlb implementations. The hash 32 and software loaded
implementations are simplfied slightly, using the fact that no 32-bit CPUs
implement the 3rd page protection bit.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:13 +0000 (00:31 +0000)]
target-ppc: Disentangle hash mmu versions of cpu_get_phys_page_debug()
cpu_get_phys_page_debug() is a trivial wrapper around
get_physical_address(). But even the signature of
get_physical_address() has some things we'd like to clean up on a
per-mmu basis, so this patch moves the test on mmu model out to
cpu_get_phys_page_debug(), moving the version for 64-bit hash MMUs out
to mmu-hash64.c and the version for 32-bit hash MMUs to mmu-hash32.c
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:12 +0000 (00:31 +0000)]
target-ppc: Disentangle hash mmu paths for cpu_ppc_handle_mmu_fault
cpu_ppc_handle_mmu_fault() calls get_physical_address() (whose behaviour
depends on MMU type) then, if that fails, issues an appropriate exception
- which again has a number of dependencies on MMU type.
This patch starts converting cpu_ppc_handle_mmu_fault() to have a
single switch on MMU type, calling MMU specific fault handler
functions which deal with both translation and exception delivery
appropriately for the MMU type. We convert 32-bit and 64-bit hash
MMUs to this new model, but the existing code is left in place for
other MMU types for now.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
Depending on the MSR state, for 64-bit hash MMUs, get_physical_address
can either call check_physical (which has further tests for mmu type)
or get_segment64. Similarly for 32-bit hash MMUs we can either call
check_physucal or get_bat() and get_segment32().
This patch splits off the whole get_physical_addresss() path for hash
MMUs into 32-bit and 64-bit versions, handling real mode correctly for
such MMUs without going to check_physical and rechecking the mmu type.
Correspondingly, the hash MMU specific paths in check_physical() are
removed.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:10 +0000 (00:31 +0000)]
target-ppc: Rework get_physical_address()
Currently get_physical_address() first checks to see if translation is
enabled in the MSR, then in the translation on case switches on the mmu
type. Except that for BookE MMUs, translation is always on, and so it
has to switch in the "translation off" case as well and do the same thing
as the translation on path for those MMUs. Plus, even translation off
doesn't behave exactly the same on the various MMU types so there are
further mmu type checks in the "translation off" path.
As a first step to cleaning this up, this patch moves the switch on mmu
type to the top level, then makes the translation on/off check just for
those mmu types where it is meaningful.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:09 +0000 (00:31 +0000)]
target-ppc: Disentangle get_segment()
The poorly named get_segment() function handles most of the address
translation logic for hash-based MMUs. It has many ugly conditionals on
whether the MMU is 32-bit or 64-bit.
This patch splits the function into 32 and 64-bit versions, using the
switch on mmu_type that's already in the caller
(get_physical_address()) to select the right one. Most of the
original function remains in mmu_helper.c to support the 6xx software
loaded TLB implementations (cleaning those up is a project for another
day).
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:08 +0000 (00:31 +0000)]
target-ppc: Disentangle find_pte()
32-bit and 64-bit hash MMU implementations currently share a find_pte
function. This results in a whole bunch of ugly conditionals in the shared
function, and not all that much actually shared code.
This patch separates out the 32-bit and 64-bit versions, putting then
in mmu-hash64.c and mmu-has32.c, and removes the conditionals from
both versions.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:07 +0000 (00:31 +0000)]
target-ppc: Disentangle pte_check()
Currently support for both 32-bit and 64-bit hash MMUs share an
implementation of pte_check. But there are enough differences that this
means the shared function has several very ugly conditionals on "is_64b".
This patch cleans things up by separating out the 64-bit version
(putting it into mmu-hash64.c) and the 32-bit hash version (putting it
in mmu-hash32.c). Another copy remains in mmu_helper.c, which is used
for the 6xx software loaded TLB paths.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:06 +0000 (00:31 +0000)]
target-ppc: Move SLB handling into a mmu-hash64.c
As a first step to disentangling the handling for 64-bit hash MMUs from
the rest, we move the code handling the Segment Lookaside Buffer (SLB)
(which only exists on 64-bit hash MMUs) into a new mmu-hash64.c file.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:05 +0000 (00:31 +0000)]
target-ppc: Remove address check for logging
One LOG_MMU statement in mmu_helper.c has an odd check on the effective
address being translated. I can see no reason for this; I suspect it was
a debugging hack from long ago. This patch removes it.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Tue, 12 Mar 2013 00:31:03 +0000 (00:31 +0000)]
target-ppc: Remove vestigial PowerPC 620 support
The PowerPC 620 was the very first 64-bit PowerPC implementation, but
hardly anyone ever actually used the chips. qemu notionally supports the
620, but since we don't actually have code to implement the segment table,
the support is broken (quite likely in other ways too).
This patch, therefore, removes all remaining pieces of 620 support, to
stop it cluttering up the platforms we actually care about. This includes
removing support for the ASR register, used only on segment table based
machines.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Wed, 13 Mar 2013 15:53:28 +0000 (15:53 +0000)]
pseries: Move XICS initialization before cpu initialization
Currently, the pseries machine initializes the cpus, then the XICS
interrupt controller. However, to support the upcoming in-kernel XICS
implementation we will need to initialize the irq controller before the
vcpus. This patch makes the necesssary rearrangement. This means the
xics init code can no longer auto-detect the number of cpus ("interrupt
servers" in XICS terminology) and so we must pass that in explicitly from
the platform code.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: Ben Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Wed, 13 Mar 2013 15:53:27 +0000 (15:53 +0000)]
target-ppc: Remove CONFIG_PSERIES dependency in kvm.c
target-ppc/kvm.c has an #ifdef on CONFIG_PSERIES, for the handling of
KVM exits due to a PAPR hypercall from the guest. However, since commit e4c8b28cde12d01ada8fe869567dc5717a2dfcb7 "ppc: express FDT dependency of
pSeries and e500 boards via default-configs/", this hasn't worked properly.
That patch altered the configuration setup so that although CONFIG_PSERIES
is visible from the Makefiles, it is not visible from C files. This broke
the pseries machine when KVM is in use.
This patch makes a quick and dirty fix, by removing the CONFIG_PSERIES
dependency, replacing it with TARGET_PPC64 (since removing it entirely
leads to type mismatch errors). Technically this breaks the build when
configured with --disable-fdt, since that disables CONFIG_PSERIES on
TARGET_PPC64. However, it turns out the build was already broken in that
case, so this fixes pseries kvm without breaking anything extra. I'm
looking into how to fix that build breakage, but I don't think that need
delay applying this patch.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Wed, 13 Mar 2013 15:53:25 +0000 (15:53 +0000)]
pseries: Remove "busname" property for PCI host bridge
Currently the "spapr-pci-host-bridge" device has a "busname" property which
can be used to override the default assignment of qbus names for the bus
subordinate to the PHB. We use that for the default primary PCI bus, to
make libvirt happy, which expects there to be a bus named simply "pci".
The default qdev core logic would name the bus "pci.0", and the pseries
code would otherwise name it "pci@800000020000000" which is the name it
is given in the device tree based on its BUID.
The "busname" property is rather clunky though, so this patch simplifies
things by just using a special case hack for the default PHB, setting
busname to "pci" when index=0.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
David Gibson [Thu, 14 Mar 2013 17:59:29 +0000 (17:59 +0000)]
pseries: Fix breakage in CPU QOM conversion
Commit 259186a7d2f7184efc96ae99bc5658e6159f53ad "cpu: Move halted and
interrupt_request fields to CPUState" broke the pseries machine. That's
because it uses CPU() instead of ENV_GET_CPU() to convert from the global
first_cpu pointer (still a CPUArchState) to a CPUState. This patch fixes
the breakage.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>
Anthony Liguori [Tue, 19 Mar 2013 13:01:07 +0000 (08:01 -0500)]
Merge remote-tracking branch 'kraxel/ipxe.2' into staging
# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/ipxe.2:
Switch to efi-enabled nic roms by default
Add efi rom binaries
Add Makefile rules to build nic rom binaries with efi support
Update ipxe submodule to latest master
Add Makefile rules to build nic rom binaries
Amos Kong [Tue, 19 Mar 2013 06:23:27 +0000 (14:23 +0800)]
add a boot option to do strict boot
Seabios already added a new device type to halt booting.
Qemu can add "HALT" at the end of bootindex string, then
seabios will halt booting after trying to boot from all
selected devices.
This patch added a new boot option to configure if boot
from un-selected devices.
This option only effects when boot priority is changed by
bootindex options, the old style(-boot order=..) will still
try to boot from un-selected devices.
v2: add HALT entry in get_boot_devices_list()
v3: rebase to latest qemu upstream
Signed-off-by: Amos Kong <akong@redhat.com>
Message-id: 1363674207-31496-1-git-send-email-akong@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Peter Maydell [Mon, 18 Mar 2013 20:28:21 +0000 (20:28 +0000)]
ui/cocoa.m: Fix compile failures introduced by recent console changes
Fix various compilation failures introduced by the recent console
changes.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363638501-29603-1-git-send-email-peter.maydell@linaro.org Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Anthony Liguori [Tue, 19 Mar 2013 12:58:44 +0000 (07:58 -0500)]
Merge remote-tracking branch 'kwolf/for-anthony' into staging
# By Stefan Hajnoczi (2) and others
# Via Kevin Wolf
* kwolf/for-anthony:
virtio-blk: Do not segfault fault if failed to initialize dataplane
qemu-iotests: add 052 BDRV_O_SNAPSHOT test
block: fix BDRV_O_SNAPSHOT protocol detection
qcow2: Fix segfault in qcow2_invalidate_cache
sheepdog: show error message for halt status
Kevin Wolf [Tue, 19 Mar 2013 12:38:09 +0000 (13:38 +0100)]
char: Fix return type of qemu_chr_fe_add_watch()
qemu_chr_fe_add_watch() can return negative errors, therefore it must
not have an unsigned return type. For consistency with other
qemu_chr_fe_* functions, this uses a standard C int instead of glib
types.
In situations where qemu_chr_fe_add_watch() is falsely assumed to have
succeeded, the serial ports would go into a state where it never becomes
ready for transmitting more data; this is fixed by this patch.
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Dunrong Huang [Tue, 19 Mar 2013 08:27:29 +0000 (16:27 +0800)]
virtio-blk: Do not segfault fault if failed to initialize dataplane
$ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -drive if=none,id=drive0,cache=none,aio=native,format=raw,file=/root/Image/centos-6.4.raw -device virtio-blk-pci,drive=drive0,scsi=off,x-data-plane=on,config-wce=on # make dataplane fail to initialize
qemu-system-x86_64: -device virtio-blk-pci,drive=drive0,scsi=off,x-data-plane=on,config-wce=on: device is incompatible with x-data-plane, use config-wce=off
*** glibc detected *** /root/usr/bin/qemu-system-x86_64: free(): invalid pointer: 0x00007f001fef12f8 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7d776)[0x7f00153a5776]
/root/usr/bin/qemu-system-x86_64(+0x2c34ec)[0x7f001cf5b4ec]
/root/usr/bin/qemu-system-x86_64(+0x342f9a)[0x7f001cfdaf9a]
/root/usr/bin/qemu-system-x86_64(+0x33694e)[0x7f001cfce94e]
....................
(gdb) bt
#0 0x00007f3bf3a12015 in raise () from /lib64/libc.so.6
#1 0x00007f3bf3a1348b in abort () from /lib64/libc.so.6
#2 0x00007f3bf3a51a4e in __libc_message () from /lib64/libc.so.6
#3 0x00007f3bf3a57776 in malloc_printerr () from /lib64/libc.so.6
#4 0x00007f3bfb60d4ec in free_and_trace (mem=0x7f3bfe0129f8) at vl.c:2786
#5 0x00007f3bfb68cf9a in virtio_cleanup (vdev=0x7f3bfe0129f8) at /root/Develop/QEMU/qemu/hw/virtio.c:900
#6 0x00007f3bfb68094e in virtio_blk_device_init (vdev=0x7f3bfe0129f8) at /root/Develop/QEMU/qemu/hw/virtio-blk.c:666
#7 0x00007f3bfb68dadf in virtio_device_init (qdev=0x7f3bfe0129f8) at /root/Develop/QEMU/qemu/hw/virtio.c:1092
#8 0x00007f3bfb50da46 in device_realize (dev=0x7f3bfe0129f8, err=0x7fff479c9258) at hw/qdev.c:176
.............................
In virtio_blk_device_init(), the memory which vdev point to is a static
member of "struct VirtIOBlkPCI", not heap memory, and it does not
get freed. So we shoule use virtio_common_cleanup() to clean this VirtIODevice
rather than virtio_cleanup(), which attempts to free the vdev.
Stefan Hajnoczi [Mon, 18 Mar 2013 16:58:53 +0000 (17:58 +0100)]
block: fix BDRV_O_SNAPSHOT protocol detection
realpath(3) is used to get an absolute path to the image file when
creating a -drive snapshot=on temporary qcow2. This does not work for
protocols since their filenames ("proto:foo:...") do not correspond to
file system paths.
Commit 7c96d46ec245d73fd76726588409f9abe4bd5dc1 ("Let snapshot work with
protocols") skipped realpath(3) for protocols. Later on the "raw"
format was introduced and broke the check.
Use path_has_protocol(filename) to decide if this image uses a protocol
or a filename.
Reported-by: Richard Jones <rjones@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Liu Yuan [Mon, 18 Mar 2013 06:27:55 +0000 (14:27 +0800)]
sheepdog: show error message for halt status
Sheepdog (neither quorum nor unsafe mode) will refuse to serve IO requests when
number of alive nodes is less than that of copies specified by users. This will
return 0x19 to QEMU client which currently doesn't recognize it.
This patch adds an error description when QEMU client receives it, other than
plainly printing 'Invalid error code'
Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Liu Yuan <tailai.ly@taobao.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:28 +0000 (17:37 +0100)]
virtio-blk: cleanup: remove qdev field.
The qdev field is no longer needed, just drop it.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-12-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:27 +0000 (17:37 +0100)]
virtio-blk: cleanup: QOM cast
Use QOM casts inside virtio-blk.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-11-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:26 +0000 (17:37 +0100)]
virtio-blk: cleanup: init and exit functions.
As all virtio-blk-* are switched to the new API, we can remove the separate
init/exit for the old API.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-10-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:25 +0000 (17:37 +0100)]
virtio-blk-ccw switch to new API.
Here the virtio-ccw-s390 is modified for the new API. The device
virtio-ccw-s390 extends virtio-ccw-device as before. It creates and
connects a virtio-ccw during the init. The properties are not modified.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-9-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:24 +0000 (17:37 +0100)]
virtio-blk-s390: switch to the new API.
Here the virtio-blk-s390 is modified for the new API. The device
virtio-blk-s390 extends virtio-s390-device as before. It creates and
connects a virtio-blk during the init. The properties are not modified.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-8-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:23 +0000 (17:37 +0100)]
virtio-blk-pci: switch to new API.
Here the virtio-blk-pci is modified for the new API. The device
virtio-blk-pci extends virtio-pci. It creates and connects a virtio-blk
during the init. The properties are not changed.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-7-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:22 +0000 (17:37 +0100)]
virtio-blk: add the virtio-blk device.
Create virtio-blk which extends virtio-device, so it can be connected on
virtio-bus.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-6-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:21 +0000 (17:37 +0100)]
virtio-blk: don't use pointer for configuration.
The configuration field must not be a pointer as it will be used for virtio-blk
properties. So *blk is replaced by blk in VirtIOBlock structure.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1363624648-16906-5-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:20 +0000 (17:37 +0100)]
virtio-pci: fix hot unplug.
Hot unplug failed because it tried to free the virtio device two times.
This fix the issue by removing the call to virtio_bus_destroy_device.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Message-id: 1363624648-16906-4-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:19 +0000 (17:37 +0100)]
virtio-x-bus: fix allow_hotplug assertion.
This set allow_hotplug for each existing virtio-x-bus, allowing the
refactored devices to be hot pluggable.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>
Message-id: 1363624648-16906-3-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
KONRAD Frederic [Mon, 18 Mar 2013 16:37:18 +0000 (17:37 +0100)]
virtio: make virtio device's structures public.
These structures must be made public to avoid two memory allocations for
refactored virtio devices.
Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andreas Färber <afaerber@suse.de>
Message-id: 1363624648-16906-2-git-send-email-fred.konrad@greensocs.com
Changes V4 <- V3:
* Rebased on current git.
Changes V3 <- V2:
* Style correction spotted by Andreas (virtio-scsi.h).
* Style correction for virtio-net.h.
Changes V2 <- V1:
* Move the dataplane include into the header (virtio-blk). Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Gerd Hoffmann [Wed, 6 Mar 2013 12:40:47 +0000 (13:40 +0100)]
console: remove ds_get_* helper functions
Switch the few remaining ds_get_* uses in console.c over to the new
surface_* accessors.
While doing so tripped over a few leftovers from commit a93a4a226a2afba147ba5df688b85d844f537c68 (code using depth == 0
as indicator for textmode rendering). Fixed them up.
Gerd Hoffmann [Thu, 28 Feb 2013 15:10:02 +0000 (16:10 +0100)]
gtk: stop using DisplayState
Rework DisplayStateListener callbacks to not use the DisplayState
any more. Factor out the window size handling to a separate function,
so the zoom callbacks can call that directly instead of abusing the
gd_switch DisplayStateListener callback for that.
Gerd Hoffmann [Thu, 28 Feb 2013 14:24:14 +0000 (15:24 +0100)]
console: add surface_*() getters
Add convinence wrappers to query DisplaySurface properties.
Simliar to ds_get_*, but operating in the DisplaySurface
not the DisplayState.
With this patch in place ui frontents can stop using DisplayState
in the rendering code paths, they can simply operate using the
DisplaySurface passed in via dpy_gfx_switch callback.
Replace the dpy_gfx_resize and dpy_gfx_setdata DisplayChangeListener
callbacks with a dpy_gfx_switch callback which notifies the ui code
when the framebuffer backing storage changes.
Gerd Hoffmann [Thu, 28 Feb 2013 11:15:00 +0000 (12:15 +0100)]
qxl: zap qxl0 global
DisplayChangeListener is passed now to all DisplayChangeListenerOps
callbacks, so we can use that to access the qxl state and kill the
qxl0 global variable.
Gerd Hoffmann [Thu, 28 Feb 2013 13:47:07 +0000 (14:47 +0100)]
spice: zap sdpy global
DisplayChangeListener is passed now to all DisplayChangeListenerOps
callbacks, so we can use that to access the spice display state and
kill the sdpy global variable.
Gerd Hoffmann [Thu, 28 Feb 2013 10:34:31 +0000 (11:34 +0100)]
console: kill DisplayState->opaque
It's broken by design. There can be multiple DisplayChangeListener
instances, so they simply can't store state in the (single) DisplayState
struct. Try 'qemu -display gtk -vnc :0', watch it crash & burn.
With DisplayChangeListenerOps having a more sane interface now we can
simply use the DisplayChangeListener pointer to get access to our
private data instead.
Gerd Hoffmann [Tue, 13 Nov 2012 13:51:41 +0000 (14:51 +0100)]
console: fix displaychangelisteners interface
Split callbacks into separate Ops struct. Pass DisplayChangeListener
pointer as first argument to all callbacks. Uninline a bunch of
display functions and move them from console.h to console.c
Gerd Hoffmann [Tue, 26 Feb 2013 16:46:11 +0000 (17:46 +0100)]
Switch to efi-enabled nic roms by default
All PCI nics are switched to EFI-enabled roms by default. They are
composed from three images (legacy, efi ia32 & efi x86), so classic
pxe booting will continue to work.
Exception: eepro100 is not switched, it uses a single rom for all
emulated eepro100 variants, then goes patch the rom header on the
fly with the correct PCI IDs. I doubt that will work as-is with
the efi roms.
Keep old roms for 1.4+older machine types via compat properties,
needed because the efi-enabled roms are larger so the pci rom bar
size would change.
Gerd Hoffmann [Tue, 26 Feb 2013 15:45:58 +0000 (16:45 +0100)]
Add Makefile rules to build nic rom binaries with efi support
"make -C roms efirom" will build rom binaries with EFI support.
They are composed from three images: legacy bios, efi ia32
and efi x64. So netbooting via SeaBIOS will continue to work
like it does today, and additionally we get network support
for EFI. This target needs the EfiRom utility (shipped with
edk2) somewhere in the $PATH.
Gerd Hoffmann [Thu, 28 Feb 2013 08:14:12 +0000 (09:14 +0100)]
Update ipxe submodule to latest master
Needed for efi support.
ipxe is grown a bit, so *not* recompiling the (non-efi) pxe roms
because that would make some pxe roms larger than 64k, which in
turn would be a guest-visible change because the rom bar size
grows from 64k to 128k.
Gerd Hoffmann [Fri, 8 Feb 2013 15:35:08 +0000 (16:35 +0100)]
Add Makefile rules to build nic rom binaries
"make -C roms pxerom" will build the ipxe roms and update
the binaries in pc-bios/, i.e. it basically documents how
the build process of our current nic roms works.
Cornelia Huck [Fri, 15 Mar 2013 09:57:40 +0000 (10:57 +0100)]
s390: Fix cpu refactoring fallout.
Commit 259186a7 "cpu: Move halted and interrupt_request fields to CPUState"
seems to have missed one instance in target-s390x/kvm.c:
/home/cohuck/git/qemu/target-s390x/kvm.c: In function ‘kvm_arch_process_async_events’:
/home/cohuck/git/qemu/target-s390x/kvm.c:319: error: ‘CPUS390XState’ has no member named ‘halted’
/home/cohuck/git/qemu/target-s390x/kvm.c:320: warning: control reaches end of non-void function
make[1]: *** [target-s390x/kvm.o] Error 1
Let's just switch to cs->halted.
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Acked-by: Alexander Graf <agraf@suse.de> Acked-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Blue Swirl [Sun, 17 Mar 2013 17:44:47 +0000 (17:44 +0000)]
Merge branch 'arm-devs.next' of git://git.linaro.org/people/pmaydell/qemu-arm
* 'arm-devs.next' of git://git.linaro.org/people/pmaydell/qemu-arm:
xilinx_spips: QOM styling fixes
xilinx_spips: Add missing dual-bus snoop commands
xilinx_spips: Fix bus setup conditional check
xilinx_spips: Set unused IRQs to NULL
xilinx_zynq: added pl330 to machine model
pl330: Initial version
iov: Factor out hexdumper
hw/vexpress: Set reset values for daughterboard oscillators
hw/arm_sysctl: Implement SYS_CFG_OSC function
hw/vexpress: Pass voltage sensor properties to sysctl device
hw/arm_sysctl: Implement SYS_CFG_VOLT
qdev: Implement (variable length) array properties
hw/arm_sysctl: Convert from qdev init to instance_init
hw/arm_sysctl: Implement SYS_CFG_DVIMODE as a no-op
hw/arm_sysctl: Implement SYS_CFG_MUXFPGA writes as a no-op
hw/arm_sysctl: Handle SYS_CFGCTRL in a more structured way
hw/vexpress: Pass proc_id via VEDBoardInfo
Petar Jovanovic [Fri, 15 Mar 2013 17:56:19 +0000 (18:56 +0100)]
target-mips: fix rndrashift_short_acc and code for EXTR_ instructions
Fix for rndrashift_short_acc to set correct value to higher 64 bits.
This change also corrects conditions when bit 23 of the DSPControl register
is set.
The existing test files have been extended with several examples that
trigger the issues. One bug/example in the test file for EXTR_RS_W has been
found and reported by Klaus Peichl.
Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: de9daeee6c142e8b57ad042fd680cedcdc94d2fc.1362373359.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Unused CS lines should init to 0 to avoid segfaulting when accessing an
unattached QSPI controller.
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: c1e45198032106e69e8fe9339fc2e6348d524fcd.1362373359.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 5bc295bd2aa50dfe573f428574dbd7d8add7b3f8.1361853677.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Factor out the hexdumper functionality from iov for all to use. Useful for
creating verbose debug printfery that dumps packet data.
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: faaac219c55ea586d3f748befaf5a2788fd271b8.1361853677.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 15 Mar 2013 16:41:57 +0000 (16:41 +0000)]
hw/arm_sysctl: Implement SYS_CFG_OSC function
Implement the SYS_CFG_OSC function. Since the idea of
programmable clock rates doesn't make much sense for QEMU,
we simply allow the clock rate to be read back as written.
The number and value of the daughterboard oscillators varies
between daughterboards, so we provide an array property to
allow their reset values to be configured.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 15 Mar 2013 16:41:57 +0000 (16:41 +0000)]
hw/arm_sysctl: Implement SYS_CFG_VOLT
Implement the SYS_CFG_VOLT registers which return the voltage
of various supplies on motherboard and daughterboard. Since
QEMU implements a perfectly stable power supply these registers
always return a constant value. The number and value of the
daughterboard voltages is dependent on the specific daughterboard,
so we use a property array to allow the board to configure them
appropriately.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Add support for declaring array properties for qdev devices.
These work by defining an initial static property 'len-arrayname'
which the user of the device should set to the desired size
of the array. When this property is set, memory is allocated
for the array elements, and dynamic properties "arrayname[0]",
"arrayname[1]"... are created so the user of the device can
then set the values of the individual array elements.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 15 Mar 2013 16:41:56 +0000 (16:41 +0000)]
hw/arm_sysctl: Implement SYS_CFG_DVIMODE as a no-op
SYS_CFG_DVIMODE allows the guest to select whether the
output DVI signal is VGA, SVGA, XGA, SGA or UXGA. Since
this makes no difference to QEMU, implement writes as a
no-op so Linux doesn't complain.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 15 Mar 2013 16:41:56 +0000 (16:41 +0000)]
hw/arm_sysctl: Implement SYS_CFG_MUXFPGA writes as a no-op
SYS_CFG_MUXFPGA allows the guest to select whether the
video output should come from the motherboard's LCD
controller or the daughterboard's one. Since QEMU doesn't
currently support selecting the video output like this,
implement as a no-op, so Linux doesn't complain about
the register not being implemented.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 15 Mar 2013 16:41:56 +0000 (16:41 +0000)]
hw/arm_sysctl: Handle SYS_CFGCTRL in a more structured way
The SYS_CFGCTRL register consists of separate fields
for DCC, function, site, position and device, as well
as a read/write bit. Refactor the code handling SYS_CFGCTRL
writes to make it easier to add support for functions
like SYS_CFG_OSC which support multiple device fields.
We also pull the handling out into its own function for
clarity, as there are potentially a lot of implementable
subfunctions.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 15 Mar 2013 16:41:56 +0000 (16:41 +0000)]
hw/vexpress: Pass proc_id via VEDBoardInfo
Pass the daughterboard-specific proc_id property to the code that
creates the sysctl device via the VEDBoardInfo struct, rather than
by having the daughterboard init function write to a uint32_t*
argument. This is a cleaner way to pass the info around, and
is in line with the way we are going to handle voltage and
oscillator initialization.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
David Gibson [Tue, 12 Mar 2013 02:57:28 +0000 (13:57 +1100)]
Fix TAGS creation
Currently the Makefile creates TAGS for emacs with the command:
find "$(SRC_PATH)" -name '*.[hc]' -print0 | xargs -0 etags
That works only if xargs ends up invoking etags just once. If xargs runs
etags several times, as it will if there are enough files, then the later
invocations will overwrite the output from the earlier invocations. This
patch uses the etags --append option to fix the bug.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Message-id: 1363057048-21534-1-git-send-email-david@gibson.dropbear.id.au Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Anthony Liguori [Fri, 15 Mar 2013 15:47:21 +0000 (10:47 -0500)]
Merge remote-tracking branch 'stefanha/block' into staging
# By Stefan Hajnoczi (14) and others
# Via Stefan Hajnoczi
* stefanha/block: (28 commits)
blockdev: Fix up copyright and permission notice
qemu-iotests: use -nographic in test case 007
qemu-iotests: add tests for rebasing zero clusters
dataplane: fix hang introduced by AioContext transition
coroutine: use AioContext for CoQueue BH
threadpool: drop global thread pool
block: add bdrv_get_aio_context()
aio: add a ThreadPool instance to AioContext
threadpool: add thread_pool_new() and thread_pool_free()
threadpool: move globals into struct ThreadPool
main-loop: add qemu_get_aio_context()
sheepdog: set io_flush handler in do_co_req
sheepdog: use non-blocking fd in coroutine context
qcow2: make is_allocated return true for zero clusters
qcow2: drop unnecessary flush in qcow2_update_snapshot_refcount()
qcow2: drop flush in update_cluster_refcount()
qcow2: flush in qcow2_update_snapshot_refcount()
qcow2: set L2 cache dependency in qcow2_alloc_bytes()
qcow2: flush refcount cache correctly in qcow2_write_snapshots()
qcow2: flush refcount cache correctly in alloc_refcount_block()
...
projects / qemu.git / log