summaryrefslogtreecommitdiffstats
path: root/hw/pci-host
Commit message (Collapse)AuthorAgeFilesLines
* uninorth: add to bridge categoryLaurent Vivier2015-10-231-0/+8
| | | | | | | | | Uninorth is the mac99 PCI host controller, so add it to the bridge category. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* grackle: add to bridge categoryLaurent Vivier2015-10-231-0/+2
| | | | | | | | | Grackle is the PCI host controller of oldworld powermac, so add it to the bridge category. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* piix: fix resource leak reported by Coverityzhanghailiang2015-10-221-4/+7
| | | | | | | | | | config_fd should be closed before return, or there will be a resource leak error. Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
* intel_iommu: Add support for translation for devices behind bridgesKnut Omang2015-10-181-22/+3
| | | | | | | | | | | | | | | | - Use a hash table indexed on bus pointers to store information about buses instead of using the bus numbers. Bus pointers are stored in a new VTDBus struct together with the vector of device address space pointers indexed by devfn. - The bus number is still used for lookup for selective SID based invalidate, in which case the bus number is lazily resolved from the bus hash table and cached in a separate index. Signed-off-by: Knut Omang <knut.omang@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* qdev: Protect device-list-properties against broken devicesMarkus Armbruster2015-10-091-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several devices don't survive object_unref(object_new(T)): they crash or hang during cleanup, or they leave dangling pointers behind. This breaks at least device-list-properties, because qmp_device_list_properties() needs to create a device to find its properties. Broken in commit f4eb32b "qmp: show QOM properties in device-list-properties", v2.1. Example reproducer: $ qemu-system-aarch64 -nodefaults -display none -machine none -S -qmp stdio {"QMP": {"version": {"qemu": {"micro": 50, "minor": 4, "major": 2}, "package": ""}, "capabilities": []}} { "execute": "qmp_capabilities" } {"return": {}} { "execute": "device-list-properties", "arguments": { "typename": "pxa2xx-pcmcia" } } qemu-system-aarch64: /home/armbru/work/qemu/memory.c:1307: memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed. Aborted (core dumped) [Exit 134 (SIGABRT)] Unfortunately, I can't fix the problems in these devices right now. Instead, add DeviceClass member cannot_destroy_with_object_finalize_yet to mark them: * Hang during cleanup (didn't debug, so I can't say why): "realview_pci", "versatile_pci". * Dangling pointer in cpus: most CPUs, plus "allwinner-a10", "digic", "fsl,imx25", "fsl,imx31", "xlnx,zynqmp", because they create such CPUs * Assert kvm_enabled(): "host-x86_64-cpu", host-i386-cpu", "host-powerpc64-cpu", "host-embedded-powerpc-cpu", "host-powerpc-cpu" (the powerpc ones can't currently reach the assertion, because the CPUs are only registered when KVM is enabled, but the assertion is arguably in the wrong place all the same) Make qmp_device_list_properties() fail cleanly when the device is so marked. This improves device-list-properties from "crashes, hangs or leaves dangling pointers behind" to "fails". Not a complete fix, just a better-than-nothing work-around. In the above reproducer, device-list-properties now fails with "Can't list properties of device 'pxa2xx-pcmcia'". This also protects -device FOO,help, which uses the same machinery since commit ef52358 "qdev-monitor: include QOM properties in -device FOO, help output", v2.2. Example reproducer: $ qemu-system-aarch64 -machine none -device pxa2xx-pcmcia,help Before: qemu-system-aarch64: .../memory.c:1307: memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed. After: Can't list properties of device 'pxa2xx-pcmcia' Cc: "Andreas Färber" <afaerber@suse.de> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Alexander Graf <agraf@suse.de> Cc: Anthony Green <green@moxielogic.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Blue Swirl <blauwirbel@gmail.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Jia Liu <proljc@gmail.com> Cc: Leon Alrae <leon.alrae@imgtec.com> Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: Max Filippov <jcmvbkbc@gmail.com> Cc: Michael Walle <michael@walle.cc> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Richard Henderson <rth@twiddle.net> Cc: qemu-ppc@nongnu.org Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1443689999-12182-10-git-send-email-armbru@redhat.com>
* PPC: e500 pci host: Fix ATMUs register readsRudolf Marek2015-09-201-2/+2
| | | | | | | | | | There is a bug in the register mask when reading the ATMUs registers. As the result some registers cannot be read, and read is aliased to the other registers. Fix it. Signed-off-by: Rudolf Marek <rudolf.marek@sysgo.com> Signed-off-by: Alexander Graf <agraf@suse.de>
* Fix bad error handling after memory_region_init_ram()Markus Armbruster2015-09-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Symptom: $ qemu-system-x86_64 -m 10000000 Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456: upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory Aborted (core dumped) Root cause: commit ef701d7 screwed up handling of out-of-memory conditions. Before the commit, we report the error and exit(1), in one place, ram_block_add(). The commit lifts the error handling up the call chain some, to three places. Fine. Except it uses &error_abort in these places, changing the behavior from exit(1) to abort(), and thus undoing the work of commit 3922825 "exec: Don't abort when we can't allocate guest memory". The three places are: * memory_region_init_ram() Commit 4994653 (right after commit ef701d7) lifted the error handling further, through memory_region_init_ram(), multiplying the incorrect use of &error_abort. Later on, imitation of existing (bad) code may have created more. * memory_region_init_ram_ptr() The &error_abort is still there. * memory_region_init_rom_device() Doesn't need fixing, because commit 33e0eb5 (soon after commit ef701d7) lifted the error handling further, and in the process changed it from &error_abort to passing it up the call chain. Correct, because the callers are realize() methods. Fix the error handling after memory_region_init_ram() with a Coccinelle semantic patch: @r@ expression mr, owner, name, size, err; position p; @@ memory_region_init_ram(mr, owner, name, size, ( - &error_abort + &error_fatal | err@p ) ); @script:python@ p << r.p; @@ print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column) When the last argument is &error_abort, it gets replaced by &error_fatal. This is the fix. If the last argument is anything else, its position is reported. This lets us check the fix is complete. Four positions get reported: * ram_backend_memory_alloc() Error is passed up the call chain, ultimately through user_creatable_complete(). As far as I can tell, it's callers all handle the error sanely. * fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize() DeviceClass.realize() methods, errors handled sanely further up the call chain. We're good. Test case again behaves: $ qemu-system-x86_64 -m 10000000 qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory [Exit 1 ] The next commits will repair the rest of commit ef701d7's damage. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
* maint: avoid useless "if (foo) free(foo)" patternDaniel P. Berrange2015-09-111-3/+1
| | | | | | | | | | | | The free() and g_free() functions both happily accept NULL on any platform QEMU builds on. As such putting a conditional 'if (foo)' check before calls to 'free(foo)' merely serves to bloat the lines of code. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* piix: create host bridge to passthroughTiejun Chen2015-09-101-0/+85
| | | | | | | | | | | | Implement a pci host bridge specific to passthrough. Actually this just inherits the standard one. And we also just expose a minimal real host bridge pci configuration subset. [Replace pread with lseek and read to fix Windows build] Signed-off-by: Tiejun Chen <tiejun.chen@intel.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>
* i440fx: make types configurable at run-timeMichael S. Tsirkin2015-09-081-5/+4
| | | | | | | | | | IGD passthrough wants to supply a different pci and host devices, inheriting i440fx devices. Make types configurable. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Tiejun Chen <tiejun.chen@intel.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150813' into stagingPeter Maydell2015-08-131-0/+16
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches 2015-08-13 Changes: * mips32r5-generic CPU updated and renamed to P5600 * improvements in LWL/LDL, logging and fulong2e # gpg: Signature made Thu 13 Aug 2015 17:10:59 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4 4FC0 5211 8E3C 0B29 DA6B * remotes/lalrae/tags/mips-20150813: target-mips: Use CPU_LOG_INT for logging related to interrupts hw/pci-host/bonito: Avoid buffer overrun for bad LDMA/COP accesses target-mips: simplify LWL/LDL mask generation target-mips: update mips32r5-generic into P5600 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/pci-host/bonito: Avoid buffer overrun for bad LDMA/COP accessesPeter Maydell2015-08-131-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | The LDMA and COP memory regions represent four 32 bit registers each, but the memory regions themselves are 0x100 bytes large. Add guards to the read and write accessors so that bogus accesses beyond the four defined registers don't just run off the end of the bonldma and boncop structs and into whatever lies beyond. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* | piix: Document coreboot-specific RAM size config registerEduardo Habkost2015-08-131-1/+6
|/ | | | | | | | | | | | | | | | | | | | | The existing i440fx initialization code sets a PCI config register that isn't documented anywhere in the Intel 440FX datasheet. Register 0x57 is DRAMC (DRAM Control) and has nothing to do with the RAM size. This was implemented in commit ec5f92ce6ac8ec09056be77e03c941be188648fa because old coreboot code tried to read registers 0x5a-0x5f,0x56,0x57 to get the RAM size from QEMU, but I couldn't find out why coreboot did that. I assume it was a mistake, and the original code was supposed to be reading the DRB[0-7] registers (offsets 0x60-0x67). Document that coreboot-specific register offset in a macro and a comment, for future reference. Cc: Ed Swierk <eswierk@skyportsystems.com> Cc: Richard Smith <smithbone@gmail.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* piix: piix3 QOMifyGonglei2015-06-231-26/+31
| | | | | Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* migration: Use normal VMStateDescriptions for SubsectionsJuan Quintela2015-06-121-6/+4
| | | | | | | | | | | | | | | | We create optional sections with this patch. But we already have optional subsections. Instead of having two mechanism that do the same, we can just generalize it. For subsections we just change: - Add a needed function to VMStateDescription - Remove VMStateSubsection (after removal of the needed function it is just a VMStateDescription) - Adjust the whole tree, moving the needed function to the corresponding VMStateDescription Signed-off-by: Juan Quintela <quintela@redhat.com>
* q35: implement TSEGGerd Hoffmann2015-06-051-0/+70
| | | | | | | | | | | | | TSEG provides larger amounts of SMRAM than the 128 KB available with legacy SMRAM and high SMRAM. Route access to tseg into nowhere when enabled, for both cpus and busmaster dma, and add tseg window to smram region, so cpus can access it in smm mode. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* q35: implement SMRAM.D_LCKGerd Hoffmann2015-06-051-1/+7
| | | | | | | | | | | | Once the SMRAM.D_LCK bit has been set by the guest several bits in SMRAM and ESMRAMC become readonly until the next machine reset. Implement this by updating the wmask accordingly when the guest sets the lock bit. As the lock it itself is locked down too we don't need to worry about the guest clearing the lock bit. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* q35: add config space wmask for SMRAM and ESMRAMCGerd Hoffmann2015-06-051-0/+2
| | | | | | | | | Not all bits in SMRAM and ESMRAMC can be changed by the guest. Add wmask defines accordingly and set them in mch_reset(). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* q35: fix ESMRAMC defaultGerd Hoffmann2015-06-051-0/+1
| | | | | | | | | | | | The cache bits in ESMRAMC are hardcoded to 1 (=disabled) according to the q35 mch specs. Add and use a define with this default. While being at it also update the SMRAM default to use the name (no code change, just makes things a bit more readable). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* q35: implement high SMRAMPaolo Bonzini2015-06-051-4/+31
| | | | | | | | | | | | When H_SMRAME is 1, low memory at 0xa0000 is left alone by SMM, and instead the chipset maps the 0xa0000-0xbffff window at 0xfeda0000-0xfedbffff. This affects both the "non-SMM" view controlled by D_OPEN and the SMM view controlled by G_SMRAME, so add two new MemoryRegions and toggle the enabled/disabled state of all four in mch_update_smram. Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/i386: remove smram_updatePaolo Bonzini2015-06-053-8/+4
| | | | | | | | It's easier to inline it now that most of its work is done by the CPU (rather than the chipset) through /machine/smram and the memory API. Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target-i386: use memory API to implement SMRAMPaolo Bonzini2015-06-053-52/+16
| | | | | | | | | Remove cpu_smm_register and cpu_smm_update. Instead, each CPU address space gets an extra region which is an alias of /machine/smram. This extra region is enabled or disabled as the CPU enters/exits SMM. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/i386: add a separate region that tracks the SMRAME bitPaolo Bonzini2015-06-052-3/+31
| | | | | | | | | | | | | | | This region is exported at /machine/smram. It is "empty" if SMRAME=0 and points to SMRAM if SMRAME=1. The CPU will enable/disable it as it enters or exits SMRAM. While touching nearby code, the existing memory region setup was slightly inconsistent. The smram_region is *disabled* in order to open SMRAM (because the smram_region shows the low VRAM instead of the RAM at 0xa0000). Because SMRAM is closed at startup, the smram_region must be enabled when creating the i440fx or q35 devices. Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Convert (ffs(val) - 1) to ctz32(val)Stefan Hajnoczi2015-04-281-1/+1
| | | | | | | | | | | | | | | | | | | This commit was generated mechanically by coccinelle from the following semantic patch: @@ expression val; @@ - (ffs(val) - 1) + ctz32(val) The call sites have been audited to ensure the ffs(0) - 1 == -1 case never occurs (due to input validation, asserts, etc). Therefore we don't need to worry about the fact that ctz32(0) == 32. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1427124571-28598-5-git-send-email-stefanha@redhat.com Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* uninorth: convert ffs(3) to ctz32()Stefan Hajnoczi2015-04-281-1/+4
| | | | | | | | | | It is not clear from the code how a 0 parameter should be handled by the hardware. Keep the same behavior as ffs(0) - 1 == -1. Cc: Alexander Graf <agraf@suse.de> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1427124571-28598-4-git-send-email-stefanha@redhat.com Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* Switch non-CPU callers from ld/st*_phys to address_space_ld/st*Peter Maydell2015-04-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch all the uses of ld/st*_phys to address_space_ld/st*, except for those cases where the address space is the CPU's (ie cs->as). This was done with the following script which generates a Coccinelle patch. A few over-80-columns lines in the result were rewrapped by hand where Coccinelle failed to do the wrapping automatically, as well as one location where it didn't put a line-continuation '\' when wrapping lines on a change made to a match inside a macro definition. ===begin=== #!/bin/sh -e # Usage: # ./ldst-phys.spatch.sh > ldst-phys.spatch # spatch -sp_file ldst-phys.spatch -dir . | sed -e '/^+/s/\t/ /g' > out.patch # patch -p1 < out.patch for FN in ub uw_le uw_be l_le l_be q_le q_be uw l q; do cat <<EOF @ cpu_matches_ld_${FN} @ expression E1,E2; identifier as; @@ ld${FN}_phys(E1->as,E2) @ other_matches_ld_${FN} depends on !cpu_matches_ld_${FN} @ expression E1,E2; @@ -ld${FN}_phys(E1,E2) +address_space_ld${FN}(E1,E2, MEMTXATTRS_UNSPECIFIED, NULL) EOF done for FN in b w_le w_be l_le l_be q_le q_be w l q; do cat <<EOF @ cpu_matches_st_${FN} @ expression E1,E2,E3; identifier as; @@ st${FN}_phys(E1->as,E2,E3) @ other_matches_st_${FN} depends on !cpu_matches_st_${FN} @ expression E1,E2,E3; @@ -st${FN}_phys(E1,E2,E3) +address_space_st${FN}(E1,E2,E3, MEMTXATTRS_UNSPECIFIED, NULL) EOF done ===endit=== Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
* exec.c: Make address_space_rw take transaction attributesPeter Maydell2015-04-261-2/+4
| | | | | | | | | | Make address_space_rw take transaction attributes, rather than always using the 'unspecified' attributes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
* mips: fix broken fulong2e machinePaolo Bonzini2015-04-171-2/+2
| | | | | | | | | | After commit 5312bd8 the bonito_readl() and bonito_writel() have been accessing incorrect addresses. Consequently QEMU is crashing when trying to boot Linux kernel on fulong2e machine. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* machine: replace qemu opts with iommu propertyMarcel Apfelbaum2015-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | Fixes a QEMU crash when passing iommu parameter in command line. Running x86_64-softmmu/qemu-system-x86_64 -machine pc,iommu=on -enable-kvm leads to crash: qemu-system-x86_64: qemu/util/qemu-option.c:387: qemu_opt_get_bool_helper: Assertion `opt->desc && opt->desc->type == QEMU_OPT_BOOL' failed. Aborted (core dumped) This happens because commit e79d5a6 ("machine: remove qemu_machine_opts global list") removed the global option descriptions and moved them to MachineState's QOM properties. Fix this by querying machine properties through designated wrappers. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
* pci: Trivial device model conversions to realizeMarkus Armbruster2015-02-269-43/+27
| | | | | | | | | | | Convert the device models where initialization obviously can't fail. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2015-02-241-0/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - vhost-scsi: add bootindex property - RCU: fix MemoryRegion lifetime issues in PCI; document the rules; convert of AddressSpaceDispatch and RAMList - KVM: add kvm_exit reasons for aarch64 # gpg: Signature made Mon Feb 16 16:32:32 2015 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (21 commits) Convert ram_list to RCU exec: convert ram_list to QLIST cosmetic changes preparing for the following patches exec: protect mru_block with RCU rcu: add g_free_rcu rcu: introduce RCU-enabled QLIST exec: RCUify AddressSpaceDispatch exec: make iotlb RCU-friendly exec: introduce cpu_reload_memory_map docs: clarify memory region lifecycle pci: split shpc_cleanup and shpc_free pcie: remove mmconfig memory leak and wrap mmconfig update with transaction memory: keep the owner of the AddressSpace alive until do_address_space_destroy rcu: run RCU callbacks under the BQL rcu: do not let RCU callbacks pile up indefinitely vhost-scsi: set the bootable value of channel/target/lun vhost-scsi: add a property for booting vhost-scsi: expose the TYPE_FW_PATH_PROVIDER interface vhost-scsi: add bootindex property qdev: support to get a device firmware path directly ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * exec: RCUify AddressSpaceDispatchPaolo Bonzini2015-02-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | Note that even after this patch, most callers of address_space_* functions must still be under the big QEMU lock, otherwise the memory region returned by address_space_translate can disappear as soon as address_space_translate returns. This will be fixed in the next part of this series. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | isa: add memory space parameter to isa_bus_newHervé Poussineau2015-02-131-1/+2
| | | | | | | | | | | | | | | | | | | | Currently, keep current behaviour by always using get_system_memory(). Also use QOM casts when possible. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* | pci: Add generic PCIe host bridgeAlexander Graf2015-02-132-0/+155
|/ | | | | | | | | | | | | | | | | With simple exposure of MMFG, ioport window, mmio window and an IRQ line we can successfully create a workable PCIe host bridge that can be mapped anywhere and only needs to get described to the OS using whatever means it likes. This patch implements such a "generic" host bridge. It handles 4 legacy IRQ lines. MSIs need to be handled external to the host bridge. This device is particularly useful for the "pci-host-ecam-generic" driver in Linux. Signed-off-by: Alexander Graf <agraf@suse.de> Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> Tested-by: Claudio Fontana <claudio.fontana@huawei.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* PPC: e500 pci host: Add support for ATMUsAlexander Graf2015-01-071-6/+107
| | | | | | | | | | | | | | | | | | | | | | | | The e500 PCI controller has configurable windows that allow a guest OS to selectively map parts of the PCI bus space to CPU address space and to selectively map parts of the CPU address space for DMA requests into PCI visible address ranges. So far, we've simply assumed that this mapping is 1:1 and ignored it. However, the PCICSRBAR (CCSR mapped in PCI bus space) always has to live inside the first 32bits of address space. This means if we always treat all mappings as 1:1, this map will collide with our RAM map from the CPU's point of view. So this patch adds proper ATMU support which allows us to keep the PCICSRBAR below 32bits local to the PCI bus and have another, different window to PCI BARs at the upper end of address space. We leverage this on e500plat though, mpc8544ds stays virtually 1:1 like it was before, but now also goes via ATMU. With this patch, I can run guests with lots of RAM and not coincidently access MSI-X mappings while I really want to access RAM. Signed-off-by: Alexander Graf <agraf@suse.de>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2014-09-122-3/+30
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Memory: improve error reporting and avoid crashes on hotplug - Build: fixing block/iscsi.so and ranlib warnings on Mac OS X - Migration fixes for x86 - The odd KVM patch. # gpg: Signature made Thu 11 Sep 2014 11:21:10 BST using RSA key ID 9B4D86F2 # gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>" # gpg: aka "Paolo Bonzini <bonzini@gnu.org>" * remotes/bonzini/tags/for-upstream: (21 commits) gdbstub: init mon_chr through qemu_chr_alloc pckbd: adding new fields to vmstate mc146818rtc: add missed field to vmstate piix: do not set irq while loading vmstate serial: fixing vmstate for save/restore parallel: adding vmstate for save/restore fdc: adding vmstate for save/restore cpu: init vmstate for ticks and clock offset apic_common: vapic_paddr synchronization fix vl: use QLIST_FOREACH_SAFE to visit change state handlers exec: add parameter errp to gethugepagesize exec: report error when memory < hpagesize hostmem-ram: don't exit qemu if size of memory-backend-ram is way too big memory: add parameter errp to memory_region_init_rom_device memory: add parameter errp to memory_region_init_ram exec: add parameter errp to qemu_ram_alloc and qemu_ram_alloc_from_ptr rules.mak: Fix DSO build by pulling in archive symbols util: Don't link host-utils.o if it's empty util: Move general qemu_getauxval to util/getauxval.c trace: Only link generated-tracers.o with "simple" backend ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * piix: do not set irq while loading vmstatePavel Dovgalyuk2014-09-111-2/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch avoids setting an irq while loading the state of the ISA bridge. Because the i8259 has not been deserialized yet, raising an interrupt could bring the system out-of-sync with the migration source. For example, the migration source could have masked the interrupt in the i8259. On the destination, the i8259 device model would not know that yet and would trigger an interrupt in the CPU. This patch eliminates setting the irq and just restores the calculated state fields in post_load function. Interrupt state will be deserialized separately through the IRR field of the i8259. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * memory: add parameter errp to memory_region_init_ramHu Tao2014-09-091-1/+2
| | | | | | | | | | | | | | | | | | Add parameter errp to memory_region_init_ram and update all call sites to pass in &error_abort. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | apb: implement PCI bus error interrupt map registersMark Cave-Ayland2014-09-091-2/+13
|/ | | | | | | Both OpenBSD and FreeBSD SPARC64 attempt to read the interrupt map from the hardware and will fail if the correct ino isn't present. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
* intel-iommu: add context-cache to cache context-entryLe Tan2014-08-281-0/+1
| | | | | | | | | | | | | | Add context-cache to cache context-entry encountered on a page-walk. Each VTDAddressSpace has a member of VTDContextCacheEntry which represents an entry in the context-cache. Since devices with different bus_num and devfn have their respective VTDAddressSpace, this will be a good way to reference the cached entries. Each VTDContextCacheEntry will have a context_cache_gen and the cached entry is valid only when context_cache_gen equals IntelIOMMUState.context_cache_gen. Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* intel-iommu: fix coding style issues around in q35.c and machine.cLe Tan2014-08-281-5/+6
| | | | | | | | Fix coding style issues around in hw/pci-host/q35.c and hw/core/machine.c. Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* intel-iommu: add Intel IOMMU emulation to q35 and add a machine option ↵Le Tan2014-08-281-0/+46
| | | | | | | | | | | | | | | | | "iommu" as a switch Add Intel IOMMU emulation to q35 chipset and expose it to the guest. 1. Add a machine option. Users can use "-machine iommu=on|off" in the command line to enable/disable Intel IOMMU. The default is off. 2. Accroding to the machine option, q35 will initialize the Intel IOMMU and use pci_setup_iommu() to setup q35_host_dma_iommu() as the IOMMU function for the pci bus. 3. q35_host_dma_iommu() will return different address space according to the bus_num and devfn of the device. Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* iommu: add is_write as a parameter to the translate function of ↵Le Tan2014-08-281-1/+2
| | | | | | | | | | | | | MemoryRegionIOMMUOps Add a bool variable is_write as a parameter to the translate function of MemoryRegionIOMMUOps to indicate the operation of the access. It can be used for correct fault reporting from within the callback. Change the interface of related functions. Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into stagingPeter Maydell2014-08-181-2/+10
|\ | | | | | | | | | | | | | | | | * remotes/mcayland/qemu-sparc: target-sparc64: implement Short Floating-Point Store Instructions apb: add IOMMU flush register implementation sun4u: switch second PCI-ebus bridge BAR over to PCI IO space Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * apb: add IOMMU flush register implementationMark Cave-Ayland2014-08-171-2/+10
| | | | | | | | | | | | | | | | | | | | The IOMMU flush register is a write-only register used to remove entries from the hardware TLB. Allow guest writes to this register as a no-op, and return a value of 0 for reads. This fixes IOMMU DMA operations under NetBSD SPARC64. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
* | pci-host: update uncorresponding descriptionGonglei2014-08-151-1/+1
| | | | | | | | | | Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* | pci-host: update obsolete reference about piix_pci.cGonglei2014-08-152-2/+2
|/ | | | | | | | | | piix_pci.c has been renamed into piix.c at commit c0907c9e6417cb959dfd9ef6873221536ec91351 update the obsolete reference. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* prep: Remove PCI memory hack related to OpenHack'WareHervé Poussineau2014-07-071-3/+1
| | | | | Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Andreas Färber <andreas.faerber@web.de>
* uninorth: Fix PCI hole sizeBALATON Zoltan2014-06-271-1/+1
| | | | | | | | Fix PCI hole size to match that what is found on real hardware. (OpenBIOS already uses the correct length.) Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Alexander Graf <agraf@suse.de>
* apb: Fix out-of-bounds array write accessStefan Weil2014-06-201-2/+2
| | | | | | | | | | | | | | The array regs is declared with IOMMU_NREGS (3) elements and accessed using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values are right shifted before being used as an index which results in indices 0 and 1. In one case, this right shift was missing for IOMMU_BASE which results in an out-of-bounds write access with index 8. The patch adds the missing shift operation also for IOMMU_CTRL where it is needed only for cosmetic reasons. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
OpenPOWER on IntegriCloud