]> git.proxmox.com Git - mirror_qemu.git/log
mirror_qemu.git
5 years agoppc/pnv: use IEC binary prefixes to represent sizes
Murilo Opsfelder Araujo [Mon, 25 Feb 2019 17:01:55 +0000 (14:01 -0300)]
ppc/pnv: use IEC binary prefixes to represent sizes

Using IEC binary prefixes from qemu/units.h provides a more human-friendly value
to size constants.

Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.ibm.com>
Message-Id: <20190225170155.1972-4-muriloo@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoppc/pnv: add INITRD_MAX_SIZE constant
Murilo Opsfelder Araujo [Mon, 25 Feb 2019 17:01:54 +0000 (14:01 -0300)]
ppc/pnv: add INITRD_MAX_SIZE constant

The current 0x10000000 value is actually 256MiB, not 128MB as the comment
suggests. Move it to a constant and fix the comment (no change in the size
value).

Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.ibm.com>
Message-Id: <20190225170155.1972-3-muriloo@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoppc/pnv: increase kernel size limit to 256MiB
Murilo Opsfelder Araujo [Mon, 25 Feb 2019 17:01:53 +0000 (14:01 -0300)]
ppc/pnv: increase kernel size limit to 256MiB

Building kernel with CONFIG_DEBUG_INFO_REDUCED can generate a ~90MB image and
building with CONFIG_DEBUG_INFO can generate a ~225M one, both exceeds the
current limit of 32MiB.

Increasing kernel size limit to 256MiB should fit for now.

Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.ibm.com>
Message-Id: <20190225170155.1972-2-muriloo@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agohw/ppc: Use object_initialize_child for correct reference counting
Thomas Huth [Thu, 21 Feb 2019 11:24:48 +0000 (12:24 +0100)]
hw/ppc: Use object_initialize_child for correct reference counting

Both functions, object_initialize() and object_property_add_child() increase
the reference counter of the new object, so one of the references has to be
dropped afterwards to get the reference counting right. Otherwise the child
object will not be properly cleaned up when the parent gets destroyed.
Thus let's use now object_initialize_child() instead to get the reference
counting here right.

Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <1550748288-30598-1-git-send-email-thuth@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoppc/xive: xive does not have a POWER7 interrupt model
Cédric Le Goater [Tue, 19 Feb 2019 14:25:30 +0000 (15:25 +0100)]
ppc/xive: xive does not have a POWER7 interrupt model

Patch "target/ppc: Add POWER9 external interrupt model" should have
removed the section covering PPC_FLAGS_INPUT_POWER7.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190219142530.17807-1-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotests/device-plug: Add PHB unplug request test for spapr
Greg Kurz [Tue, 19 Feb 2019 17:18:59 +0000 (18:18 +0100)]
tests/device-plug: Add PHB unplug request test for spapr

We can easily test this, just like PCI. PHB unplug is not supported
on s390x and x86 ACPI.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059673939.1466090.14354001937819612724.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: enable PHB hotplug for default pseries machine type
Michael Roth [Tue, 19 Feb 2019 17:18:54 +0000 (18:18 +0100)]
spapr: enable PHB hotplug for default pseries machine type

The 'dr_phb_enabled' field of that class can be set as part of
machine-specific init code. It will be used to conditionally
enable creation of DRC objects and device-tree description to
facilitate hotplug of PHBs.

Since we can't migrate this state to older machine types,
default the option to true and disable it for older machine
types.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <155059673433.1466090.6188091133769611501.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: add hotplug hooks for PHB hotplug
Greg Kurz [Tue, 19 Feb 2019 17:18:49 +0000 (18:18 +0100)]
spapr: add hotplug hooks for PHB hotplug

Hotplugging PHBs is a machine-level operation, but PHBs reside on the
main system bus, so we register spapr machine as the handler for the
main system bus.

Provide the usual pre-plug, plug and unplug-request handlers.

Move the checking of the PHB index to the pre-plug handler. It is okay
to do that and assert in the realize function because the pre-plug
handler is always called, even for the oldest machine types we support.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
(Fixed interrupt controller phandle in "interrupt-map" and
 TCE table size in "ibm,dma-window" FDT fragment, Greg Kurz)
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059672926.1466090.13612804072190051439.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: add ibm, my-drc-index property for PHB hotplug
Michael Roth [Tue, 19 Feb 2019 17:18:44 +0000 (18:18 +0100)]
spapr_pci: add ibm, my-drc-index property for PHB hotplug

This is needed to denote a boot-time PHB as being hot-pluggable.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059672420.1466090.15147504040270659866.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: provide node start offset via spapr_populate_pci_dt()
Michael Roth [Tue, 19 Feb 2019 17:18:39 +0000 (18:18 +0100)]
spapr_pci: provide node start offset via spapr_populate_pci_dt()

PHB hotplug re-uses PHB device tree generation code and passes
it to a guest via RTAS. Doing this requires knowledge of where
exactly in the device tree the node describing the PHB begins.

Provide this via a new optional pointer that can be used to
store the PHB node's start offset.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059671912.1466090.10891589403973703473.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_events: add support for phb hotplug events
Michael Roth [Tue, 19 Feb 2019 17:18:34 +0000 (18:18 +0100)]
spapr_events: add support for phb hotplug events

Extend the existing EPOW event format we use for PCI
devices to emit PHB plug/unplug events.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059671405.1466090.535964535260503283.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: populate PHB DRC entries for root DT node
Nathan Fontenot [Tue, 19 Feb 2019 17:18:29 +0000 (18:18 +0100)]
spapr: populate PHB DRC entries for root DT node

This add entries to the root OF node to advertise our PHBs as being
DR-capable in accordance with PAPR specification.

Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059670897.1466090.10843921337591637414.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: create DR connectors for PHBs
Michael Roth [Tue, 19 Feb 2019 17:18:23 +0000 (18:18 +0100)]
spapr: create DR connectors for PHBs

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059670389.1466090.10015601248906623076.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_pci: add PHB unrealize
Greg Kurz [Tue, 19 Feb 2019 17:18:18 +0000 (18:18 +0100)]
spapr_pci: add PHB unrealize

To support PHB hotplug we need to clean up lingering references,
memory, child properties, etc. prior to the PHB object being
finalized. Generally this will be called as a result of calling
object_unparent() on the PHB object, which in turn would normally
be called as the result of an unplug() operation.

When the PHB is finalized, child objects will be unparented in
turn, and finalized if the PHB was the only reference holder. so
we don't bother to explicitly unparent child objects of the PHB,
with the notable exception of DRCs. This is needed to avoid a QEMU
crash when unplugging a PHB and resetting the machine before the
guest could handle the event. The DRCs are removed from the QOM tree
by  pci_unregister_root_bus() and we must make sure we're not leaving
stale aliases under the global /dr-connector path.

The formula that gives the number of DMA windows is moved to an
inline function in the hw/pci-host/spapr.h header because it
will have other users.

The unrealize function is able to cope with partially realized PHBs.
It is hence used to implement proper rollback on the realize error
path.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <155059669881.1466090.13515030705986041517.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_irq: Expose the phandle of the interrupt controller
Greg Kurz [Tue, 19 Feb 2019 17:18:13 +0000 (18:18 +0100)]
spapr_irq: Expose the phandle of the interrupt controller

This will be used by PHB hotplug in order to create the "interrupt-map"
property of the PHB node.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059669374.1466090.12943228478046223856.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: Expose the name of the interrupt controller node
Greg Kurz [Tue, 19 Feb 2019 17:18:08 +0000 (18:18 +0100)]
spapr: Expose the name of the interrupt controller node

This will be needed by PHB hotplug in order to access the "phandle"
property of the interrupt controller node.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <155059668867.1466090.6339199751719123386.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoxics: Write source state to KVM at claim time
Greg Kurz [Tue, 19 Feb 2019 17:18:03 +0000 (18:18 +0100)]
xics: Write source state to KVM at claim time

The pseries machine only uses LSIs to support legacy PCI devices. Every
PHB claims 4 LSIs at realize time. When using in-kernel XICS (or upcoming
in-kernel XIVE), QEMU synchronizes the state of all irqs, including these
LSIs, later on at machine reset.

In order to support PHB hotplug, we need a way to tell KVM about the LSIs
that doesn't require a machine reset. An easy way to do that is to always
inform KVM when an interrupt is claimed, which really isn't a performance
path.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059668360.1466090.5969630516627776426.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr/drc: Drop spapr_drc_attach() fdt argument
Greg Kurz [Tue, 19 Feb 2019 17:17:58 +0000 (18:17 +0100)]
spapr/drc: Drop spapr_drc_attach() fdt argument

All DRC subtypes have been converted to generate the FDT fragment at
configure connector time instead of attach time. The fdt and fdt_offset
arguments of spapr_drc_attach() aren't needed anymore. Drop them and
make the implementation of the dt_populate() method mandatory.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059667853.1466090.16527852453054217565.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr/pci: Generate FDT fragment at configure connector time
Greg Kurz [Tue, 19 Feb 2019 17:17:53 +0000 (18:17 +0100)]
spapr/pci: Generate FDT fragment at configure connector time

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059667346.1466090.326696113231137772.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: Generate FDT fragment for CPUs at configure connector time
Greg Kurz [Tue, 19 Feb 2019 17:17:48 +0000 (18:17 +0100)]
spapr: Generate FDT fragment for CPUs at configure connector time

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059666839.1466090.3833376527523126752.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: Generate FDT fragment for LMBs at configure connector time
Greg Kurz [Tue, 19 Feb 2019 17:17:43 +0000 (18:17 +0100)]
spapr: Generate FDT fragment for LMBs at configure connector time

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059666331.1466090.6766540766297333313.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_drc: Allow FDT fragment to be added later
Greg Kurz [Tue, 19 Feb 2019 17:17:38 +0000 (18:17 +0100)]
spapr_drc: Allow FDT fragment to be added later

The current logic is to provide the FDT fragment when attaching a device
to a DRC. This works perfectly fine for our current hotplug support, but
soon we will add support for PHB hotplug which has some constraints, that
CPU, PCI and LMB devices don't seem to have.

The first constraint is that the "ibm,dma-window" property of the PHB
node requires the IOMMU to be configured, ie, spapr_tce_table_enable()
has been called, which happens during PHB reset. It is okay in the case
of hotplug since the device is reset before the hotplug handler is
called. On the contrary with coldplug, the hotplug handler is called
first and device is only reset during the initial system reset. Trying
to create the FDT fragment on the hotplug path in this case, would
result in somthing like this:

ibm,dma-window = < 0x80000000 0x00 0x00 0x00 0x00 >;

This will cause linux in the guest to panic, by simply removing and
re-adding the PHB using the drmgr command:

page = alloc_pages_node(nid, GFP_KERNEL, get_order(sz));
if (!page)
panic("iommu_init_table: Can't allocate %ld bytes\n", sz);

The second and maybe more problematic constraint is that the
"interrupt-map" property needs to reference the interrupt controller
node using the very same phandle that SLOF has already exposed to the
guest. QEMU requires SLOF to call the private KVMPPC_H_UPDATE_DT hcall
at some point to know about this phandle. With the latest QEMU and SLOF,
this happens when SLOF gets quiesced. This means that if the PHB gets
hotplugged after CAS but before SLOF quiesce, then we're sure that the
phandle is not known when the hotplug handler is called.

The FDT is only needed when the guest first invokes RTAS to configure
the connector actually, long after SLOF quiesce. Let's postpone the
creation of FDT fragments for PHBs to rtas_ibm_configure_connector().

Since we only need this for PHBs, introduce a new method in the base
DRC class for that. DRC subtypes will be converted to use it in
subsequent patches.

Allow spapr_drc_attach() to be passed a NULL fdt argument if the method
is available. When all DRC subtypes have been converted, the fdt argument
will eventually disappear.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155059665823.1466090.18358845122627355537.stgit@bahia.lab.toulouse-stg.fr.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Basic POWER9 bare-metal radix MMU support
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:29 +0000 (18:00 +0100)]
target/ppc: Basic POWER9 bare-metal radix MMU support

No guest support yet

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-13-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Support for POWER9 native hash
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:28 +0000 (18:00 +0100)]
target/ppc: Support for POWER9 native hash

(Might need more patch splitting)

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-12-clg@kaod.org>
[dwg: Hack to fix compile with some earlier include tweaks of mine]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Rename PATB/PATBE -> PATE
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:27 +0000 (18:00 +0100)]
target/ppc: Rename PATB/PATBE -> PATE

That "b" means "base address" and thus shouldn't be in the name
of actual entries and related constants.

This patch keeps the synthetic patb_entry field of the spapr
virtual hypervisor unchanged until I figure out if that has
an impact on the migration stream.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-11-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Flush the TLB locally when the LPIDR is written
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:26 +0000 (18:00 +0100)]
target/ppc: Flush the TLB locally when the LPIDR is written

Our TCG TLB only tags whether it's a HV vs a guest access, so it must
be flushed when the LPIDR is changed.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-10-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Fix synchronization of mttcg with broadcast TLB flushes
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:25 +0000 (18:00 +0100)]
target/ppc: Fix synchronization of mttcg with broadcast TLB flushes

Let's use the generic helper tlb_flush_all_cpus_synced() instead
of iterating the CPUs ourselves.

We do lose the optimization of clearing the "other" CPUs "need flush"
flags but this shouldn't be a problem in practice.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-9-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Add basic support for "new format" HPTE as found on POWER9
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:24 +0000 (18:00 +0100)]
target/ppc: Add basic support for "new format" HPTE as found on POWER9

POWER9 (arch v3) slightly changes the HPTE format. The B bits move
from the first to the second half of the HPTE, and the AVPN/ARPN
are slightly shorter.

However, under SPAPR, the hypercalls still take the old format
(and probably will for the foreseable future).

The simplest way to support this is thus to convert the HPTEs from
new to old format when reading them if the MMU model is v3 and there
is no virtual hypervisor, leaving the rest of the code unchanged.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-8-clg@kaod.org>
[dwg: Moved function to .c since there was no real need for it in the .h]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Fix ordering of hash MMU accesses
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:23 +0000 (18:00 +0100)]
target/ppc: Fix ordering of hash MMU accesses

With mttcg, we can have MMU lookups happening at the same time
as the guest modifying the page tables.

Since the HPTEs of the hash table MMU contains two words (or
double worlds on 64-bit), we need to make sure we read them
in the right order, with the correct memory barrier.

Additionally, when using emulated SPAPR mode, the hypercalls
writing to the hash table must also perform the udpates in
the right order.

Note: This part is still not entirely correct

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-7-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Fix #include guard in mmu-book3s-v3.h
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:21 +0000 (18:00 +0100)]
target/ppc: Fix #include guard in mmu-book3s-v3.h

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-5-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Re-enable RMLS on POWER9 for virtual hypervisors
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:20 +0000 (18:00 +0100)]
target/ppc: Re-enable RMLS on POWER9 for virtual hypervisors

Historically the 64-bit server MMU supports two way of configuring the
guest "real mode" mapping:

 - The "RMA" with is a single chunk of physically contiguous
memory remapped as guest real, and controlled by the RMLS
field in the LPCR register and the RMOR register.

 - The "VRMA" which uses special PTEs inserted in the partition
hash table by the hypervisor.

POWER9 deprecates the former, which is reflected by the filtering
done in ppc_store_lpcr() which effectively prevents setting of
the RMLS field.

However, when using fully emulated SPAPR machines, our qemu code
currently only knows how to define the guest real mode memory using
RMLS.

Thus you cannot run a SPAPR machine anymore with a POWER9 CPU
model today.

This works around it with a quirk in ppc_store_lpcr() to continue
allowing the RMLS field to be set when using a virtual hypervisor.

Ultimately we will want to implement configuring a VRMA instead
which will also be necessary if we want to migrate a SPAPR guest
between TCG and KVM but this is a lot more work.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-4-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc/mmu: Use LPCR:HR to chose radix vs. hash translation
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:19 +0000 (18:00 +0100)]
target/ppc/mmu: Use LPCR:HR to chose radix vs. hash translation

Now that LPCR:HR is set properly for SPAPR, use it for deciding
the translation type, which also works for bare metal

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-3-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc/spapr: Set LPCR:HR when using Radix mode
Benjamin Herrenschmidt [Fri, 15 Feb 2019 17:00:18 +0000 (18:00 +0100)]
target/ppc/spapr: Set LPCR:HR when using Radix mode

The HW relies on LPCR:HR along with the PATE to determine whether
to use Radix or Hash mode. In fact it uses LPCR:HR more commonly
than the PATE.

For us, it's also more efficient to do so, especially since unlike
the HW we do not maintain a cache of the current PATE and HV PATE
in a generic place.

Prepare the grounds for that by ensuring that LPCR:HR is set
properly on SPAPR machines.

Another option would have been to use a callback to get the PATE
but this gets messy when implementing bare metal support, it's
much simpler (and faster) to use LPCR.

Since existing migration streams may not have it, fix it up in
spapr_post_load() as well based on the pseudo-PATE entry that
we keep.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215170029.15641-2-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotests/device-plug: Add memory unplug request test for spapr
David Hildenbrand [Mon, 18 Feb 2019 09:22:02 +0000 (10:22 +0100)]
tests/device-plug: Add memory unplug request test for spapr

We can easily test this, just like PCI. On x86 ACPI, we need guest
interaction to make it work, so it is not that easy to test. We might
add tests for that later on.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190218092202.26683-7-david@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotests/device-plug: Add CPU core unplug request test for spapr
David Hildenbrand [Mon, 18 Feb 2019 09:22:01 +0000 (10:22 +0100)]
tests/device-plug: Add CPU core unplug request test for spapr

We can easily test this, just like PCI. On s390x, cpu unplug is not
supported. On x86 ACPI, cpu unplug requires guest interaction to work, so
it can't be tested that easily. We might add tests for ACPI later.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190218092202.26683-6-david@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotests/device-plug: Add CCW unplug test for s390x
David Hildenbrand [Mon, 18 Feb 2019 09:22:00 +0000 (10:22 +0100)]
tests/device-plug: Add CCW unplug test for s390x

As CCW unplugs are surprise removals without asking the guest first,
we can test this without any guest interaction.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190218092202.26683-5-david@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotests/device-plug: Add a simple PCI unplug request test
David Hildenbrand [Mon, 18 Feb 2019 09:21:59 +0000 (10:21 +0100)]
tests/device-plug: Add a simple PCI unplug request test

The issue with testing asynchronous unplug requests it that they usually
require a running guest to handle the request. However, to test if
unplug of PCI devices works, we can apply a nice little trick on some
architectures:

On system reset, x86 ACPI, s390x and spapr will perform the unplug,
resulting in the device of interest to get deleted and a DEVICE_DELETED
event getting sent.

On s390x, we still get a warning
    qemu-system-s390x: -device virtio-mouse-pci,id=dev0:
    warning: Plugging a PCI/zPCI device without the 'zpci' CPU feature
    enabled; the guest will not be able to see/use this device

This will be fixed soon, when we enable the zpci CPU feature always
(Conny already has a patch for this queued).

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Collin Walling <walling@linux.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190218092202.26683-4-david@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr: support memory unplug for qtest
David Hildenbrand [Mon, 18 Feb 2019 09:21:58 +0000 (10:21 +0100)]
spapr: support memory unplug for qtest

Fake availability of OV5_HP_EVT, so we can test memory unplug in qtest.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190218092202.26683-3-david@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agocpus: Properly release the iothread lock when killing a dummy VCPU
David Hildenbrand [Mon, 18 Feb 2019 09:21:57 +0000 (10:21 +0100)]
cpus: Properly release the iothread lock when killing a dummy VCPU

This enables CPU unplug under qtest.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190218092202.26683-2-david@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoppc: add host-serial and host-model machine attributes (CVE-2019-8934)
Prasad J Pandit [Mon, 18 Feb 2019 18:13:49 +0000 (23:43 +0530)]
ppc: add host-serial and host-model machine attributes (CVE-2019-8934)

On ppc hosts, hypervisor shares following system attributes

  - /proc/device-tree/system-id
  - /proc/device-tree/model

with a guest. This could lead to information leakage and misuse.[*]
Add machine attributes to control such system information exposure
to a guest.

[*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Fix-suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20190218181349.23885-1-ppandit@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Add support for LPCR:HEIC on POWER9
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:48 +0000 (17:16 +0100)]
target/ppc: Add support for LPCR:HEIC on POWER9

This controls whether the External Interrupt (0x500) can be
delivered to the hypervisor or not.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-11-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Add POWER9 external interrupt model
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:47 +0000 (17:16 +0100)]
target/ppc: Add POWER9 external interrupt model

Adds support for the Hypervisor directed interrupts in addition to the
OS ones.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
[clg: - modified the icp_realize() and xive_tctx_realize() to take
        into account explicitely the POWER9 interrupt model
      - introduced a specific power9_set_irq for POWER9 ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215161648.9600-10-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Add Hypervisor Virtualization Interrupt on POWER9
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:46 +0000 (17:16 +0100)]
target/ppc: Add Hypervisor Virtualization Interrupt on POWER9

This adds support for delivering that exception

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-9-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Detect erroneous condition in interrupt delivery
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:45 +0000 (17:16 +0100)]
target/ppc: Detect erroneous condition in interrupt delivery

It's very easy for the CPU specific has_work() implementation
and the logic in ppc_hw_interrupt() to be subtly out of sync.

This can occasionally allow a CPU to wakeup from a PM state
and resume executing past the PM instruction when it should
resume at the 0x100 vector.

This detects if it happens and aborts, making it a lot easier
to catch such bugs when testing rather than chasing obscure
guest misbehaviour.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-8-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Add POWER9 exception model
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:44 +0000 (17:16 +0100)]
target/ppc: Add POWER9 exception model

And use it to get the correct HILE bit in HID0

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-7-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Rename "in_pm_state" to "resume_as_sreset"
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:43 +0000 (17:16 +0100)]
target/ppc: Rename "in_pm_state" to "resume_as_sreset"

To better reflect what this does, as it's specific to some of the
P7/P8/P9 PM states, not generic.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-6-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Move "wakeup reset" code to a separate function
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:42 +0000 (17:16 +0100)]
target/ppc: Move "wakeup reset" code to a separate function

This moves the code to handle waking up from the 0x100 vector
from powerpc_excp() to a separate function, as the former is
already way too big as it is.

No functional change.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-5-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Fix support for "STOP light" states on POWER9
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:41 +0000 (17:16 +0100)]
target/ppc: Fix support for "STOP light" states on POWER9

STOP must act differently based on PSSCR:EC on POWER9. When set, it
acts like the P7/P8 power management instructions and wake up at 0x100
based on the wakeup conditions in LPCR.

When PSSCR:EC is clear however it will wakeup at the next instruction
after STOP (if EE is clear) or take the corresponding interrupts (if
EE is set).

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-4-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Don't clobber MSR:EE on PM instructions
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:40 +0000 (17:16 +0100)]
target/ppc: Don't clobber MSR:EE on PM instructions

When issuing a power management instruction, we set MSR:EE
to force ppc_hw_interrupt() into calling powerpc_excp()
to deal with the fact that on P7 and P8, the system reset
caused by the wakeup needs to be generated regardless of
the MSR:EE value (using LPCR only).

This however means that the OS will see a bogus SRR1:EE
value which is a problem. It also prevents properly
implementing P9 STOP "light".

So fix this by instead putting some logic in ppc_hw_interrupt()
to decide whether to deliver or not by taking into account the
fact that we are waking up from sleep.

The LPCR isn't checked as this is done in the has_work() test.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190215161648.9600-3-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agotarget/ppc: Fix nip on power management instructions
Benjamin Herrenschmidt [Fri, 15 Feb 2019 16:16:39 +0000 (17:16 +0100)]
target/ppc: Fix nip on power management instructions

Those instructions currently raise an exception from within
the helper. This tends to result in a bogus nip value in
the env context (typically the beginning of the TB). Such
a helper needs a gen_update_nip() first.

This fixes it with a different approach which is to throw the
exception from translate.c instead of the helper using
gen_exception_nip() which does the right thing. Exception
EXCP_HLT is also used instead of POWERPC_EXCP_STOP to effectively
exit from the CPU execution loop.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
[clg : modified the commit log to comment the use of EXCP_HLT instead
       of POWERPC_EXCP_STOP]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20190215161648.9600-2-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoMerge remote-tracking branch 'remotes/stsquad/tags/pull-testing-next-220219-1' into...
Peter Maydell [Mon, 25 Feb 2019 14:04:20 +0000 (14:04 +0000)]
Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-next-220219-1' into staging

Various testing fixes:

  - Travis updates (inc disable isapc cdrom test)
  - Add gitlab control
  - Fix docker image
  - keep softloat tests short

# gpg: Signature made Fri 22 Feb 2019 09:51:36 GMT
# gpg:                using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full]
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* remotes/stsquad/tags/pull-testing-next-220219-1:
  tests/cdrom-test: only include isapc cdrom test when g_test_slow()
  tests/softfloat: always do quick softfloat tests
  Add a gitlab-ci file for Continuous Integration testing on Gitlab
  tests/docker: peg netmap code to a specific version
  tests/docker: squash initial update and install step for debian9
  .travis.yml: Remove disable-uuid
  .travis.yml: Test with disable-replication
  .travis.yml: split debug builds
  .travis.yml: the xcode10 image seems to be hosed

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/kraxel/tags/vga-20190222-pull-request' into...
Peter Maydell [Mon, 25 Feb 2019 12:49:07 +0000 (12:49 +0000)]
Merge remote-tracking branch 'remotes/kraxel/tags/vga-20190222-pull-request' into staging

vga: bugfixes and edid support for virtio-vga

# gpg: Signature made Fri 22 Feb 2019 08:24:25 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20190222-pull-request:
  display/virtio: add edid support.
  virtio-gpu: remove useless 'waiting' field
  virtio-gpu: block both 2d and 3d rendering
  virtio-gpu: remove unused config_size
  virtio-gpu: remove unused qdev

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/kraxel/tags/ui-20190222-pull-request' into...
Peter Maydell [Mon, 25 Feb 2019 09:05:41 +0000 (09:05 +0000)]
Merge remote-tracking branch 'remotes/kraxel/tags/ui-20190222-pull-request' into staging

ui: add support for -display spice-app
ui: gtk+sdl bugfixes.

# gpg: Signature made Fri 22 Feb 2019 07:53:13 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20190222-pull-request:
  display: add -display spice-app launching a Spice client
  spice: use a default name for the server
  qapi: document DisplayType enum
  build-sys: add gio-2.0 check
  char: register spice ports after spice started
  char: move SpiceChardev and open_spice_port() to spice.h header
  spice: do not stop spice if VM is paused
  spice: merge options lists
  spice: avoid spice runtime assert
  char/spice: discard write() if backend is disconnected
  char/spice: trigger HUP event
  ui/gtk: Fix the license information
  sdl2: drop qemu_input_event_send_key_qcode call
  spice: set device address and device display ID in QXL interface
  kbd-state: don't block auto-repeat events

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20190221.0' into...
Peter Maydell [Fri, 22 Feb 2019 15:48:04 +0000 (15:48 +0000)]
Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20190221.0' into staging

VFIO updates 2019-02-21

 - Workaround kernel overflow bug in vfio type1 DMA unmap
   (Alex Williamson)

 - Refactor vfio container initialization (Eric Auger)

# gpg: Signature made Fri 22 Feb 2019 05:21:07 GMT
# gpg:                using RSA key 239B9B6E3BB08B22
# gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" [full]
# gpg:                 aka "Alex Williamson <alex@shazbot.org>" [full]
# gpg:                 aka "Alex Williamson <alwillia@redhat.com>" [full]
# gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>" [full]
# Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B  8A90 239B 9B6E 3BB0 8B22

* remotes/awilliam/tags/vfio-updates-20190221.0:
  hw/vfio/common: Refactor container initialization
  vfio/common: Work around kernel overflow bug in DMA unmap

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-hppa-20190221' into staging
Peter Maydell [Fri, 22 Feb 2019 13:53:12 +0000 (13:53 +0000)]
Merge remote-tracking branch 'remotes/rth/tags/pull-hppa-20190221' into staging

Fix dino pci config access.

# gpg: Signature made Thu 21 Feb 2019 19:03:26 GMT
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-hppa-20190221:
  hw/hppa/dino: mask out lower 2 bits of PCI config addr

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190221' into staging
Peter Maydell [Fri, 22 Feb 2019 13:04:42 +0000 (13:04 +0000)]
Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190221' into staging

Allow const void * as argument to helpers.
Remove obsolete TODO file.

# gpg: Signature made Thu 21 Feb 2019 18:59:11 GMT
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20190221:
  include/exec/helper-head.h: support "const void *" in helper calls
  tcg: Remove TODO file

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-feb-21-2019-v2' into...
Peter Maydell [Fri, 22 Feb 2019 11:26:17 +0000 (11:26 +0000)]
Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-feb-21-2019-v2' into staging

MIPS queue for February 21st, 2019, v2

# gpg: Signature made Thu 21 Feb 2019 18:37:04 GMT
# gpg:                using RSA key D4972A8967F75A65
# gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01  DD75 D497 2A89 67F7 5A65

* remotes/amarkovic/tags/mips-queue-feb-21-2019-v2:
  target/mips: fulong2e: Dynamically generate SPD EEPROM data
  target/mips: fulong2e: Fix bios flash size
  hw/pci-host/bonito.c: Add PCI mem region mapped at the correct address
  target/mips: implement QMP query-cpu-definitions command
  tests/tcg: target/mips: Add wrappers for MSA integer compare instructions
  tests/tcg: target/mips: Change directory name 'bit-counting' to 'bit-count'
  tests/tcg: target/mips: Correct path to headers in some test source files
  hw/misc: mips_itu: Fix 32/64 bit issue in a line involving shift operator

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotests/cdrom-test: only include isapc cdrom test when g_test_slow()
Alex Bennée [Thu, 21 Feb 2019 13:26:28 +0000 (13:26 +0000)]
tests/cdrom-test: only include isapc cdrom test when g_test_slow()

We are seeing instability on our CI runs which has been there since
the test was introduced. I suspect it triggers more on Travis due to
their heavy load.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Thomas Huth <thuth@redhat.com>
5 years agotests/softfloat: always do quick softfloat tests
Alex Bennée [Wed, 20 Feb 2019 15:03:29 +0000 (15:03 +0000)]
tests/softfloat: always do quick softfloat tests

Some operations take a long time and enabling "-l 2 -r all" can take
more than a day which is stretching the definition of a "slow" test.
Lets default to the quick test and leave a note for those who wish to
run by hand.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoAdd a gitlab-ci file for Continuous Integration testing on Gitlab
Thomas Huth [Wed, 13 Feb 2019 11:54:41 +0000 (12:54 +0100)]
Add a gitlab-ci file for Continuous Integration testing on Gitlab

This is very convenient for people like me who store their QEMU git trees
on gitlab.com: Automatic CI pipelines are now run for each branch that is
pushed to the server - useful for some extra-testing before sending PULL-
requests for example. Since the runtime of the jobs is limited to 1h, the
jobs are distributed into multiple pipelines - this way everything finishs
fine within time (ca. 30 minutes currently).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <1550058881-16351-1-git-send-email-thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
5 years agotests/docker: peg netmap code to a specific version
Alex Bennée [Wed, 20 Feb 2019 11:29:48 +0000 (11:29 +0000)]
tests/docker: peg netmap code to a specific version

Tracking head is always going to be at the whims of the upstream.
Let's use a defined release so things don't magically change under us.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotests/docker: squash initial update and install step for debian9
Alex Bennée [Wed, 20 Feb 2019 11:18:36 +0000 (11:18 +0000)]
tests/docker: squash initial update and install step for debian9

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
5 years ago.travis.yml: Remove disable-uuid
Dr. David Alan Gilbert [Fri, 15 Feb 2019 09:45:02 +0000 (09:45 +0000)]
.travis.yml: Remove disable-uuid

Commit 315d3184525 turned --disable-uuid into a warning only; remove
the check from Travis.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20190215094502.32149-2-dgilbert@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
5 years ago.travis.yml: Test with disable-replication
Dr. David Alan Gilbert [Fri, 15 Feb 2019 09:45:01 +0000 (09:45 +0000)]
.travis.yml: Test with disable-replication

We've had the build break with replication disabled, so lets
test that case in travis.

Suggsted-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20190215094502.32149-1-dgilbert@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
5 years ago.travis.yml: split debug builds
Alex Bennée [Wed, 20 Feb 2019 11:28:25 +0000 (11:28 +0000)]
.travis.yml: split debug builds

The builds are reaching the magic 50 minute limit with regularity so
lets split them up. Rather than doing a full debug build on both just
enable debug tcg for linux-user.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years ago.travis.yml: the xcode10 image seems to be hosed
Paolo Bonzini [Wed, 20 Feb 2019 10:45:23 +0000 (11:45 +0100)]
.travis.yml: the xcode10 image seems to be hosed

It fails to install homebrew.  Unfortunately we cannot mark
it as an expected failure because Travis does not match
allow_failures rows against include rows (only against the
main test matrix, which we do not use at all), so just disable
it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20190220105131.23479-1-pbonzini@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
5 years agodisplay: add -display spice-app launching a Spice client
Marc-André Lureau [Thu, 21 Feb 2019 11:07:03 +0000 (12:07 +0100)]
display: add -display spice-app launching a Spice client

Add a new display backend that will configure Spice to allow a remote
client to control QEMU in a similar fashion as other QEMU display
backend/UI like GTK.

For this to work, it will set up Spice server with a unix socket, and
register a VC chardev that will be exposed as Spice ports. A QMP
monitor is also exposed as a Spice port, this allows the remote client
fuller qemu control and state handling.

- doesn't handle VC set_echo() - this doesn't seem a strong
  requirement, very few front-end use it
- spice options can be tweaked with other -spice arguments
- Windows support shouldn't be hard to do, but will probably use a TCP
  port instead
- we may want to watch the child process to quit automatically if it
  crashed

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Victor Toso <victortoso@redhat.com>
Message-id: 20190221110703.5775-12-marcandre.lureau@redhat.com

[ kraxel: squash incremental fix ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agodisplay/virtio: add edid support.
Gerd Hoffmann [Thu, 21 Feb 2019 08:10:54 +0000 (09:10 +0100)]
display/virtio: add edid support.

This patch adds EDID support to the family of virtio-gpu devices.  It is
turned off by default, use the new edid property to enable it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20190221081054.13853-1-kraxel@redhat.com

5 years agovirtio-gpu: remove useless 'waiting' field
Marc-André Lureau [Thu, 21 Feb 2019 11:43:30 +0000 (12:43 +0100)]
virtio-gpu: remove useless 'waiting' field

Let's check renderer_blocked instead directly.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Christophe Fergeau <cfergeau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190221114330.17968-5-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agovirtio-gpu: block both 2d and 3d rendering
Marc-André Lureau [Thu, 21 Feb 2019 11:43:29 +0000 (12:43 +0100)]
virtio-gpu: block both 2d and 3d rendering

Now that 2d commands are translated to 3d rendering, qemu must stop
sending 3d updates (from 2d) to Spice as well.

Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=1674324

Cc: cfergeau@redhat.com
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Christophe Fergeau <cfergeau@redhat.com>
Tested-by: Christophe Fergeau <cfergeau@redhat.com>
Message-id: 20190221114330.17968-4-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agovirtio-gpu: remove unused config_size
Marc-André Lureau [Thu, 21 Feb 2019 11:43:28 +0000 (12:43 +0100)]
virtio-gpu: remove unused config_size

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Christophe Fergeau <cfergeau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190221114330.17968-3-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agovirtio-gpu: remove unused qdev
Marc-André Lureau [Thu, 21 Feb 2019 11:43:27 +0000 (12:43 +0100)]
virtio-gpu: remove unused qdev

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Christophe Fergeau <cfergeau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190221114330.17968-2-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agohw/vfio/common: Refactor container initialization
Eric Auger [Fri, 22 Feb 2019 04:07:03 +0000 (21:07 -0700)]
hw/vfio/common: Refactor container initialization

We introduce the vfio_init_container_type() helper.
It computes the highest usable iommu type and then
set the container and the iommu type.

Its usage in vfio_connect_container() makes the code
ready for addition of new iommu types.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
5 years agovfio/common: Work around kernel overflow bug in DMA unmap
Alex Williamson [Fri, 22 Feb 2019 04:07:03 +0000 (21:07 -0700)]
vfio/common: Work around kernel overflow bug in DMA unmap

A kernel bug was introduced in v4.15 via commit 71a7d3d78e3c which
adds a test for address space wrap-around in the vfio DMA unmap path.
Unfortunately due to overflow, the kernel detects an unmap of the last
page in the 64-bit address space as a wrap-around.  In QEMU, a Q35
guest with VT-d emulation and guest IOMMU enabled will attempt to make
such an unmap request during VM system reset, triggering an error:

  qemu-kvm: VFIO_UNMAP_DMA: -22
  qemu-kvm: vfio_dma_unmap(0x561f059948f0, 0xfef00000, 0xffffffff01100000) = -22 (Invalid argument)

Here the IOVA start address (0xfef00000) and the size parameter
(0xffffffff01100000) add to exactly 2^64, triggering the bug.  A
kernel fix is queued for the Linux v5.0 release to address this.

This patch implements a workaround to retry the unmap, excluding the
final page of the range when we detect an unmap failing which matches
the requirements for this issue.  This is expected to be a safe and
complete workaround as the VT-d address space does not extend to the
full 64-bit space and therefore the last page should never be mapped.

This workaround can be removed once all kernels with this bug are
sufficiently deprecated.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291
Reported-by: Pei Zhang <pezhang@redhat.com>
Debugged-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20190221' into...
Peter Maydell [Thu, 21 Feb 2019 18:58:35 +0000 (18:58 +0000)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20190221' into staging

target-arm queue:
 * Model the Arm "Musca" development boards: "musca-a" and "musca-b1"
 * Implement the ARMv8.3-JSConv extension
 * v8M MPU should use background region as default, not always
 * Stop unintentional sign extension in pmu_init

# gpg: Signature made Thu 21 Feb 2019 18:56:32 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20190221: (21 commits)
  hw/arm/armsse: Make 0x5... alias region work for per-CPU devices
  hw/arm/musca: Wire up PL011 UARTs
  hw/arm/musca: Wire up PL031 RTC
  hw/arm/musca: Add MPCs
  hw/arm/musca: Add PPCs
  hw/arm/musca.c: Implement models of the Musca-A and -B1 boards
  hw/arm/armsse: Allow boards to specify init-svtor
  hw/arm/armsse: Document SRAM_ADDR_WIDTH property in header comment
  hw/char/pl011: Use '0x' prefix when logging hex numbers
  hw/char/pl011: Support all interrupt lines
  hw/char/pl011: Allow use as an embedded-struct device
  hw/timer/pl031: Convert to using trace events
  hw/timer/pl031: Allow use as an embedded-struct device
  hw/misc/tz-ppc: Support having unused ports in the middle of the range
  target/arm: Implement ARMv8.3-JSConv
  target/arm: Rearrange Floating-point data-processing (2 regs)
  target/arm: Split out vfp_helper.c
  target/arm: Restructure disas_fp_int_conv
  target/arm: Stop unintentional sign extension in pmu_init
  target/arm: v8M MPU should use background region as default, not always
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotarget/mips: fulong2e: Dynamically generate SPD EEPROM data
BALATON Zoltan [Thu, 21 Feb 2019 12:34:07 +0000 (13:34 +0100)]
target/mips: fulong2e: Dynamically generate SPD EEPROM data

The machine comes with 256M memory module by default but it's
upgradable so it could have different memory size. There was a TODO
comment to replace static SPD EEPROM data with dynamically generated
one to support this. Now that we have a function for that, it's easy
to do. Although this would allow larger RAM sizes, the peculiar memory
map of the machine may need some special handling to map it as low and
high memory. Because I don't know what the correct place would be for
highmem, I've left memory size fixed at 256M for now and TODO is moved
there instead.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
5 years agotarget/mips: fulong2e: Fix bios flash size
BALATON Zoltan [Thu, 21 Feb 2019 12:29:15 +0000 (13:29 +0100)]
target/mips: fulong2e: Fix bios flash size

According to both the specifications on linux-mips.org referenced in a
comment at the beginning of the file and the flash chip part number
the bios size should be 512k not 1M.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
5 years agohw/pci-host/bonito.c: Add PCI mem region mapped at the correct address
BALATON Zoltan [Thu, 21 Feb 2019 12:25:00 +0000 (13:25 +0100)]
hw/pci-host/bonito.c: Add PCI mem region mapped at the correct address

Stop using system memory as PCI memory otherwise devices such as VGA
that have regions mapped to PCI memory clash with RAM. Use a separate
memory region for PCI memory and map it to the correct address in
system memory which allows PCI mem regions to show at the correct
address where clients expect them.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
5 years agotarget/mips: implement QMP query-cpu-definitions command
Pavel Dovgalyuk [Tue, 19 Feb 2019 17:02:55 +0000 (18:02 +0100)]
target/mips: implement QMP query-cpu-definitions command

This patch enables QMP-based querying of the available CPU types for
MIPS and MIPS64 platforms.

Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
5 years agotests/tcg: target/mips: Add wrappers for MSA integer compare instructions
Aleksandar Markovic [Wed, 13 Feb 2019 17:04:12 +0000 (18:04 +0100)]
tests/tcg: target/mips: Add wrappers for MSA integer compare instructions

Add wrappers for MSA integer compare instructions.

Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com>
5 years agotests/tcg: target/mips: Change directory name 'bit-counting' to 'bit-count'
Aleksandar Markovic [Mon, 18 Feb 2019 06:57:47 +0000 (07:57 +0100)]
tests/tcg: target/mips: Change directory name 'bit-counting' to 'bit-count'

Change directory name 'bit-counting' to 'bit-count'. This is just for
cosmetic and consistency sake. This was the only subdirectory in MSA
test directory that uses ending 'ing'.

Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
5 years agotests/tcg: target/mips: Correct path to headers in some test source files
Aleksandar Markovic [Mon, 18 Feb 2019 06:55:56 +0000 (07:55 +0100)]
tests/tcg: target/mips: Correct path to headers in some test source files

Correct path to headers in tests/tcg/mips/user/ase/msa/bit-counting/*
source files.

Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com>
5 years agohw/misc: mips_itu: Fix 32/64 bit issue in a line involving shift operator
Aleksandar Markovic [Mon, 18 Feb 2019 07:32:48 +0000 (08:32 +0100)]
hw/misc: mips_itu: Fix 32/64 bit issue in a line involving shift operator

Fix 32/64 bit issue in a line involving shift operator. "1 << ..."
calculation of size is done as a 32-bit signed integer which may
then be unintentionally sign-extended into the 64-bit result. The
problem was discovered by Coverity (CID 1398648). Using "1ULL"
instead of "1" on the LHS of the shift fixes this problem.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
5 years agoinclude/exec/helper-head.h: support "const void *" in helper calls
David Hildenbrand [Thu, 21 Feb 2019 09:34:59 +0000 (10:34 +0100)]
include/exec/helper-head.h: support "const void *" in helper calls

Especially when dealing with out-of-line gvec helpers, it is often
helpful to specify some vector pointers as constant. E.g. when
we have two inputs and one output, marking the two inputs as consts
pointers helps to avoid bugs.

Const pointers can be specified via "cptr", however behave in TCG just
like ordinary pointers. We can specify helpers like:

DEF_HELPER_FLAGS_4(gvec_vbperm, TCG_CALL_NO_RWG, void, ptr, cptr, cptr, i32)

void HELPER(gvec_vbperm)(void *v1, const void *v2, const void *v3,
                         uint32_t desc)

And make sure that here, only v1 will be written (as long as const is
not casted away, of course).

Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20190221093459.22547-1-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotcg: Remove TODO file
Richard Henderson [Wed, 20 Feb 2019 17:29:06 +0000 (09:29 -0800)]
tcg: Remove TODO file

The last update to this file was 9 years ago.  In the meantime,
4 of the 6 ideas have actually been completed.  The lat two do
not actually make sense anymore.

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/arm/armsse: Make 0x5... alias region work for per-CPU devices
Peter Maydell [Thu, 21 Feb 2019 18:17:48 +0000 (18:17 +0000)]
hw/arm/armsse: Make 0x5... alias region work for per-CPU devices

The region 0x40010000 .. 0x4001ffff and its secure-only alias
at 0x50010000... are for per-CPU devices. We implement this by
giving each CPU its own container memory region, where the
per-CPU devices live. Unfortunately, the alias region which
makes devices mapped at 0x4... addresses also appear at 0x5...
is only implemented in the overall "all CPUs" container. The
effect of this bug is that the CPU_IDENTITY register block appears
only at 0x4001f000, but not at the 0x5001f000 alias where it should
also appear. Guests (like very recent Arm Trusted Firmware-M)
which try to access it at 0x5001f000 will crash.

Fix this by moving the handling for this alias from the "all CPUs"
container to the per-CPU container. (We leave the aliases for
0x1... and 0x3... in the overall container, because there are
no per-CPU devices there.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190215180500.6906-1-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
5 years agohw/arm/musca: Wire up PL011 UARTs
Peter Maydell [Thu, 21 Feb 2019 18:17:47 +0000 (18:17 +0000)]
hw/arm/musca: Wire up PL011 UARTs

Wire up the two PL011 UARTs in the Musca board.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/arm/musca: Wire up PL031 RTC
Peter Maydell [Thu, 21 Feb 2019 18:17:47 +0000 (18:17 +0000)]
hw/arm/musca: Wire up PL031 RTC

Wire up the PL031 RTC for the Musca board.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/arm/musca: Add MPCs
Peter Maydell [Thu, 21 Feb 2019 18:17:47 +0000 (18:17 +0000)]
hw/arm/musca: Add MPCs

The Musca board puts its SRAM and flash behind TrustZone
Memory Protection Controllers (MPCs). Each MPC sits between
the CPU and the RAM/flash, and also has a set of memory mapped
control registers. Wire up the MPCs, and the memory behind them.
For the moment we implement the flash as simple ROM, which
cannot be reprogrammed by the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/arm/musca: Add PPCs
Peter Maydell [Thu, 21 Feb 2019 18:17:47 +0000 (18:17 +0000)]
hw/arm/musca: Add PPCs

Many of the devices on the Musca board live behind TrustZone
Peripheral Protection Controllers (PPCs); add models of the
PPCs, using a similar scheme to the MPS2 board models.
This commit wires up the PPCs with "unimplemented device"
stubs behind them in the correct places in the address map.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/arm/musca.c: Implement models of the Musca-A and -B1 boards
Peter Maydell [Thu, 21 Feb 2019 18:17:47 +0000 (18:17 +0000)]
hw/arm/musca.c: Implement models of the Musca-A and -B1 boards

The Musca-A and Musca-B1 development boards are based on the
SSE-200 subsystem for embedded. Implement an initial skeleton
model of these boards, which are similar but not identical.

This commit creates the board model with the SSE and the IRQ
splitters to wire IRQs up to its two CPUs. As yet there
are no devices and no memory: these will be added later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/arm/armsse: Allow boards to specify init-svtor
Peter Maydell [Thu, 21 Feb 2019 18:17:47 +0000 (18:17 +0000)]
hw/arm/armsse: Allow boards to specify init-svtor

The Musca boards have DAPLink firmware that sets the initial
secure VTOR value (the location of the vector table) differently
depending on the boot mode (from flash, from RAM, etc). Export
the init-svtor as a QOM property of the ARMSSE object so that
the board can change it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/arm/armsse: Document SRAM_ADDR_WIDTH property in header comment
Peter Maydell [Thu, 21 Feb 2019 18:17:47 +0000 (18:17 +0000)]
hw/arm/armsse: Document SRAM_ADDR_WIDTH property in header comment

In commit 4b635cf7a95e501211 we added a QOM property to the ARMSSE
object, but forgot to add it to the documentation comment in the
header. Correct the omission.

Fixes: 4b635cf7a95e501211 ("hw/arm/armsse: Make SRAM bank size configurable")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/char/pl011: Use '0x' prefix when logging hex numbers
Peter Maydell [Thu, 21 Feb 2019 18:17:46 +0000 (18:17 +0000)]
hw/char/pl011: Use '0x' prefix when logging hex numbers

The pl011 logs when the guest makes a bad access. It prints
the address offset in hex but confusingly omits the '0x'
prefix; add it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/char/pl011: Support all interrupt lines
Peter Maydell [Thu, 21 Feb 2019 18:17:46 +0000 (18:17 +0000)]
hw/char/pl011: Support all interrupt lines

The PL011 UART has six interrupt lines:
 * RX (receive data)
 * TX (transmit data)
 * RT (receive timeout)
 * MS (modem status)
 * E (errors)
 * combined (logical OR of all the above)

So far we have only emulated the combined interrupt line;
add support for the others, so that boards that wire them
up to different interrupt controller inputs can do so.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/char/pl011: Allow use as an embedded-struct device
Peter Maydell [Thu, 21 Feb 2019 18:17:46 +0000 (18:17 +0000)]
hw/char/pl011: Allow use as an embedded-struct device

Create a new include file for the pl011's device struct,
type macros, etc, so that it can be instantiated using
the "embedded struct" coding style.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/timer/pl031: Convert to using trace events
Peter Maydell [Thu, 21 Feb 2019 18:17:46 +0000 (18:17 +0000)]
hw/timer/pl031: Convert to using trace events

Convert the debug printing in the PL031 device to use trace events,
and augment it to cover the interesting parts of device operation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/timer/pl031: Allow use as an embedded-struct device
Peter Maydell [Thu, 21 Feb 2019 18:17:46 +0000 (18:17 +0000)]
hw/timer/pl031: Allow use as an embedded-struct device

Create a new include file for the pl031's device struct,
type macros, etc, so that it can be instantiated using
the "embedded struct" coding style.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agohw/misc/tz-ppc: Support having unused ports in the middle of the range
Peter Maydell [Thu, 21 Feb 2019 18:17:46 +0000 (18:17 +0000)]
hw/misc/tz-ppc: Support having unused ports in the middle of the range

The Peripheral Protection Controller's handling of unused ports
is that if there is nothing connected to the port's downstream
then it does not create the sysbus MMIO region for the upstream
end of the port. This results in odd behaviour when there is
an unused port in the middle of the range: since sysbus MMIO
regions are implicitly consecutively allocated, any used ports
above the unused ones end up with sysbus MMIO region numbers
that don't match the port number.

Avoid this numbering mismatch by creating dummy MMIO regions
for the unused ports. This doesn't change anything for our
existing boards, which don't have any gaps in the middle of
the port ranges they use; but it will be needed for the Musca
board.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotarget/arm: Implement ARMv8.3-JSConv
Richard Henderson [Thu, 21 Feb 2019 18:17:46 +0000 (18:17 +0000)]
target/arm: Implement ARMv8.3-JSConv

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190215192302.27855-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: fixed a couple of comment typos]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>