Commit Graph

41066 Commits

Author SHA1 Message Date
Alexander Graf
d4574435a6 PPC: E500: Update u-boot to commit 79c884d7e4
The current U-Boot binary in QEMU has a bug where it fails to support
dynamic CCSR addressing. Without this support, u-boot can not boot the
ppce500 machine anymore. This has been fixed upstream in u-boot commit
e834975b.

Update the u-boot blob we carry in QEMU to the latest u-boot upstream,
so that we can successfully run u-boot with the ppce500 machine again.

CC: qemu-stable@nongnu.org
Signed-off-by: Alexander Graf <agraf@suse.de>
Tested-by: Thomas Huth <thuth@redhat.com>
2015-09-20 22:48:39 +02:00
Anton Blanchard
6bb9a0a9ef target-ppc: Fix SRR0 when taking unaligned exceptions
We are setting SRR0 to the instruction before the one causing the
unaligned exception. A quick testcase:

. = 0x100
.globl _start
_start:
	/* Cause a 0x600 */
	li	3,0x1
	stwcx.	3,0,3
1:	b	1b

. = 0x600
1:	b	1b

Built into something we can load as a BIOS image:

gcc -mbig -c test.S
ld -EB -Ttext 0x0 -o test test.o
objcopy -O binary test test.bin

Run with:

qemu-system-ppc64 -nographic -bios test.bin

Shows an incorrect SRR0 (points at the li):

SRR0 0000000000000100

With the patch we get the correct SRR0:

SRR0 0000000000000104

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
2015-09-20 22:48:39 +02:00
Rudolf Marek
e7f08320f0 PPC: e500 pci host: Fix ATMUs register reads
There is a bug in the register mask when reading
the ATMUs registers. As the result some registers
cannot be read, and read is aliased to the other
registers. Fix it.

Signed-off-by: Rudolf Marek <rudolf.marek@sysgo.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2015-09-20 22:48:39 +02:00
Mark Cave-Ayland
1cde732d88 mac_dbdma: always clear FLUSH bit once DBDMA channel flush is complete
The code to flush the DBDMA channel was effectively duplicated in
dbdma_control_write(), except for the fact that the copy executed outside of a
RUN bit transition was broken by not clearing the FLUSH bit once the flush was
complete.

Newer PPC Linux kernels would timeout waiting for the FLUSH bit to clear again
after submitting a FLUSH command. Fix this by always clearing the FLUSH bit
once the channel flush is complete and removing the repeated code.

Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Alexander Graf <agraf@suse.de>
2015-09-20 22:48:38 +02:00
Paolo Bonzini
116dc18db6 kvm_ppc: remove kvmppc_timer_hack
QEMU does have an I/O thread now, that can be interrupted at any time
because the VCPU thread runs outside the iothread mutex.

Therefore, the kvmppc_timer_hack is obsolete.  Remove it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2015-09-20 22:48:38 +02:00
Peter Maydell
18640989a9 QOM infrastructure fixes and device conversions
* QOM API error handling fixes
 * Performance improvements for device GPIO property creation
 * Remaining conversion of QEMUMachine to QOM
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJV/XPsAAoJEPou0S0+fgE/fo4P/0nH0RDYGW7tYPFH9m2pkada
 gXvEg/ADdwmlHZyE5jUO1AP6Im1KTdNqyGfObUQgeSDb8W0Q8FmsNiOKiZeiWaYx
 gLn6/YnbhTaTqKgyGEFcqNZuty8xFKBv9OmT80ZrKYqVq7cdnlKJKcvW+nR2sbhh
 3zastSIo6kpBgstiHnJf05z6Z1lahe8i9O7+uP2luDmtT5ORID/YeJk8P2yH/XvV
 YaYjKCM3NO307cZBE3Cv60BMaaoD1oeXzHr0+mfOwAJdtPHV5JErdeWd8kb6551/
 OO7Bm2gs3aZdt2sEvjPpj003O6QhVsZuFhUq/JgUw/OeaEmhibzMYKC+84xISxCu
 CUof26AM8fPC8q1st2ykcKMm7eE7GoSPfFP4y5Bu8iSeoQIfQ3yFkL9smEibIlk6
 0mfD2Ixy4QAsD1NQXU/G6r6qrreeEKK1IIR0Qj028AxKOjbUHpzSuwTh4Pjo/Zm6
 se6lnzrXpkn7P7MKGfwFSXit40XMbLiT5+fSYTzkl2q/JCOFo7BK5uVG7vi4EWcT
 0eUt0ILhD62f4RG05oCa2plG36+1CYhY+ISlUlozLXialrTN16/Ng1n1wScaeRkL
 bB9Iyi/cok7+jcq4tHN6l3AqaL/IRpCsfBbT5NcnJ+abM6CWtEviCwXJQiQaEPvL
 MrzeOarW5RuKaURiYa86
 =z33c
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

QOM infrastructure fixes and device conversions

* QOM API error handling fixes
* Performance improvements for device GPIO property creation
* Remaining conversion of QEMUMachine to QOM

# gpg: Signature made Sat 19 Sep 2015 15:40:44 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-devices-for-peter: (21 commits)
  machine: Eliminate QEMUMachine and qemu_register_machine()
  Revert use of DEFINE_MACHINE() for registrations of multiple machines
  Use DEFINE_MACHINE() to register all machines
  mac_world: Break long line
  machine: DEFINE_MACHINE() macro
  exynos4: Declare each QEMUMachine as a separate variable
  exynos4: Use MachineClass instead of exynos4_machines array
  exynos4: Use EXYNOS4210_NCPUS instead of max_cpus on error message
  machine: Set MachineClass::name automatically
  machine: Ensure all TYPE_MACHINE subclasses have the right suffix
  mac99: Use MACHINE_TYPE_NAME to encode class name
  s390: Rename s390-ccw-virtio-2.4 class name to use MACHINE_TYPE_NAME
  s390-virtio: Rename machine class name to use MACHINE_TYPE_NAME
  pseries: Rename machine class names to use MACHINE_TYPE_NAME
  arm: Rename virt machine class to use MACHINE_TYPE_NAME
  vexpress: Rename machine classes to use MACHINE_TYPE_NAME
  vexpress: Don't set name on abstract class
  machine: MACHINE_TYPE_NAME macro
  qdev: Do not use slow [*] expansion for GPIO creation
  qom: Fix invalid error check in property_get_str()
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-19 15:59:52 +01:00
Eduardo Habkost
3b53e45f43 machine: Eliminate QEMUMachine and qemu_register_machine()
The struct is not used anymore and can be eliminated.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:40:30 +02:00
Andreas Färber
8a661aea0e Revert use of DEFINE_MACHINE() for registrations of multiple machines
The script used for converting from QEMUMachine had used one
DEFINE_MACHINE() per machine registered. In cases where multiple
machines are registered from one source file, avoid the excessive
generation of module init functions by reverting this unrolling.

Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:40:27 +02:00
Eduardo Habkost
e264d29de2 Use DEFINE_MACHINE() to register all machines
Convert all machines to use DEFINE_MACHINE() instead of QEMUMachine
automatically using a script.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[AF: Style cleanups, convert imx25_pdk machine]
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:40:15 +02:00
Eduardo Habkost
f309ae852c mac_world: Break long line
Coding style change only.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:40:09 +02:00
Eduardo Habkost
ed0b6de343 machine: DEFINE_MACHINE() macro
The macro will allow easy registration of a TYPE_MACHINE subclass, using
only the machine name and a MachineClass initialization function as
parameter.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:40:06 +02:00
Eduardo Habkost
97c6671cf1 exynos4: Declare each QEMUMachine as a separate variable
This will make the code follow the same pattern used for other machines,
and will make it easier to automatically convert the code to be
QOM-based.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:39:55 +02:00
Eduardo Habkost
ca17776088 exynos4: Use MachineClass instead of exynos4_machines array
We don't need a QEMUMachine array to query max_cpus, if we can get the
corresponding MachineClass.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:39:44 +02:00
Eduardo Habkost
6aadcc7135 exynos4: Use EXYNOS4210_NCPUS instead of max_cpus on error message
The code is checking smp_cpus against EXYNOS4210_NCPUS, not against
max_cpus, so use EXYNOS4210_NCPUS in the error message for consistency.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:39:37 +02:00
Eduardo Habkost
98cec76a70 machine: Set MachineClass::name automatically
Now all TYPE_MACHINE subclasses use MACHINE_TYPE_NAME to generate the
class name. So instead of requiring each subclass to set
MachineClass::name manually, we can now set it automatically at the
TYPE_MACHINE class_base_init() function.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
[AF/ehabkost: Updated for s390-ccw machines]
[AF: Cleanup of intermediate virt and vexpress name handling]
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:39:28 +02:00
Eduardo Habkost
dcb3d60111 machine: Ensure all TYPE_MACHINE subclasses have the right suffix
Now that all non-abstract TYPE_MACHINE subclasses have the -machine
suffix, add an assert to ensure this will be always true.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:39:19 +02:00
Eduardo Habkost
c0f365186b mac99: Use MACHINE_TYPE_NAME to encode class name
It will result in exactly the same class name, but it will make the code
consistent with the other classes.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:39:13 +02:00
Eduardo Habkost
af62e639fc s390: Rename s390-ccw-virtio-2.4 class name to use MACHINE_TYPE_NAME
Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the
s390-ccw-virtio-2.4 machine class using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
[AF/ehabkost: Updated for 2.5 machine]
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:39:05 +02:00
Eduardo Habkost
4c264d4b3d s390-virtio: Rename machine class name to use MACHINE_TYPE_NAME
Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the s390-virtio
machine class using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:38:57 +02:00
Eduardo Habkost
b9f072d01f pseries: Rename machine class names to use MACHINE_TYPE_NAME
Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the the pseries
machine classes using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:38:53 +02:00
Eduardo Habkost
64d3459c85 arm: Rename virt machine class to use MACHINE_TYPE_NAME
Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the arm virt
machine class using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:38:49 +02:00
Eduardo Habkost
fc603d29e9 vexpress: Rename machine classes to use MACHINE_TYPE_NAME
Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the vexpress
machine classes using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
[AF: Introduce VEXPRESS_*_MACHINE_NAME]
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:38:44 +02:00
Eduardo Habkost
54477b07fb vexpress: Don't set name on abstract class
The MachineClass::name field won't be ever be used on TYPE_VEXPRESS, as
it is an abstract class and the machine class lookup code explicitly
skips abstract classes. We can remove it to make the code simpler.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:38:37 +02:00
Eduardo Habkost
c84a8f01b2 machine: MACHINE_TYPE_NAME macro
The macro will be useful to ensure the machine class names follow the
right format to make machine class lookup by class name work correctly.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 16:38:31 +02:00
Pavel Fedin
6c76b37742 qdev: Do not use slow [*] expansion for GPIO creation
Expansion of [*] suffix is very slow because index expansion is done using
trial and error strategy, starting every time from zero and retrying with
the next index until insertion succeeds. With large number of already added
properties this process takes huge amount of time (O(n^2) complexity).

Some architectures (like ARM) use very large amount of IRQ pins in interrupt
controller models. This flaw makes machine startup extremely slow
(~20 seconds for ARM64 with 32 CPUs). This patch decreases this time down to
~10 seconds.

Also in qdev_init_gpio_out_named() memset() is now called only once for the
whole array instead of per-cell cleaning

Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 08:10:12 +02:00
Markus Armbruster
e1c8237df5 qom: Fix invalid error check in property_get_str()
When a function returns a null pointer on error and only on error, you
can do

    if (!foo(foos, errp)) {
        ... handle error ...
    }

instead of the more cumbersome

    Error *err = NULL;

    if (!foo(foos, &err)) {
        error_propagate(errp, err);
        ... handle error ...
    }

A StringProperty's getter, however, may return null on success!  We
then fail to call visit_type_str().

Screwed up in 6a146eb, v1.1.

Fails tests/qom-test in my current, heavily hacked QAPI branch.  No
reproducer for master known (but I didn't look hard).

Cc: Anthony Liguori <anthony@codemonkey.ws>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 08:10:12 +02:00
Markus Armbruster
4715d42efe qom: Do not reuse errp after a possible error
The argument for an Error **errp parameter must point to a null
pointer.  If it doesn't, and an error happens, error_set() fails its
assertion.

Instead of

    foo(foos, errp);
    bar(bars, errp);

you need to do something like

    Error *err = NULL;

    foo(foos, &err);
    if (err) {
        error_propagate(errp, err);
        goto out;
    }

    bar(bars, errp);
out:

Screwed up in commit 0e55884 (v1.3.0): property_get_bool().

Screwed up in commit 1f21772 (v2.1.0): object_property_get_enum() and
object_property_get_uint16List().

Screwed up in commit a8e3fbe (v2.4.0): property_get_enum(),
property_set_enum().

Found by inspection, no actual crashes observed.

Fix them up.

Cc: Anthony Liguori <anthony@codemonkey.ws>
Cc: Hu Tao <hutao@cn.fujitsu.com>
Cc: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-09-19 08:10:11 +02:00
Rainer Müller
b12a84ce3c cocoa: Suppress Cocoa window with -display
Do not open a Cocoa window when another display is selected that will be
initialized later. The Cocoa display cannot be selected with -display,
so there is no need to check its argument.

Signed-off-by: Rainer Müller <raimue@codingfarm.de>
Reviewed-by: Andreas Färber <andreas.faerber@web.de>
Message-id: 1441807710-25431-1-git-send-email-raimue@codingfarm.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-18 18:33:02 +01:00
Peter Maydell
a53efe9c47 -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
 
 iQIcBAABAgAGBQJV/Ca2AAoJEH3vgQaq/DkOcjoP/0lTqs2rD3xjP/anxJFhLLU2
 EcJiKh7hamVM18Yufdw2FkZK5KlCLSiosGn+6nViKnNho9C0xdCBfmEDDgS+bz5P
 eIcGjPecB+7fvYAtJt4Bm60l/UZWJ8mm5BaWByVwgR2YhJByN5QT/RSqmdamT9BU
 GfiwzknI1f6ovQPkTJVnbXTRcrgiBRJQR9eSpyJKhTTbAXvMTdBSoMrSvaoLRrKs
 ih85iPvxQvqWSR4RG1IS1voHTAbq3R7BBm+rSoLgJpvTtwg7COZ73FCT88knvP1j
 0ab9zcXElk0oLHg08n6zlWTgSpJMs9UMLsrPF24R4bdxqN7JkYXnXhym3uBs2E82
 AvRYuBD4Jix9pMrWTzpwiWLxXBmq56odRNP7zW/6b88JoC+iWCZ+MA/5RTRAJQSa
 thSvZiW3V4BbktW+2AtfhJuL8rmvM5+9IHV10Ic0Ik2I97h73BeeduanAn2OpbMi
 y9o3cs4FZ3nqWPsJaiTb0Sh63+QKgGZ1get9vWoCEwXxpSReAycAwk4g9gcYwo3Y
 hiM+kE42/mBl7QcmS9aFW4DvmpTVdUQOSjguQZHSX334Bv/GYPd4XYjb+hWLJDYc
 IXibCTl8x2B5WVFzNfpY1+++QsqKAojxMXJ3ICIe0HA1CFCCNGWAEHHhdzgJdFX9
 mlPs8xueKnd3+VfBMp/e
 =y9MO
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Fri 18 Sep 2015 15:59:02 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"

* remotes/jnsnow/tags/ide-pull-request:
  ahci: clean up initial d2h semantics
  ahci: remove cmd_fis argument from write_fis_d2h
  ahci: fix signature generation
  ahci: remove dead reset code
  atapi: abort transfers with 0 byte limits
  ide: fix ATAPI command permissions
  ide-test: add cdrom dma test
  ide-test: add cdrom pio test
  qtest/ahci: export generate_pattern
  qtest/ahci: use generate_pattern everywhere
  ide: unify io_buffer_offset increments

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-18 16:57:59 +01:00
John Snow
e47f9eb148 ahci: clean up initial d2h semantics
with write_fis_d2h and signature generation tidied up,
let's adjust the initial d2h semantics to make more sense.

The initial d2h is considered delivered if there is guest
memory to save it to.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-5-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
28ee82557c ahci: remove cmd_fis argument from write_fis_d2h
It's no longer used. We used to generate a D2H FIS based
upon the command FIS that prompted the update, but in reality,
the D2H FIS is generated purely from register state.

cmd_fis is vestigial, so get rid of it.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-4-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
33a983cb28 ahci: fix signature generation
The initial register device-to-host FIS no longer needs to specially
set certain fields, as these can be handled generically by setting those
fields explicitly with the signatures we want at port reset time.

(1) Signatures are decomposed into their four component registers and
    set upon (AHCI) port reset.
(2) the signature cache register is no longer set manually per-each
    device type, but instead just once during ahci_init_d2h.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-3-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
f91a0aa374 ahci: remove dead reset code
This check is dead due to an earlier conditional.
AHCI does not currently support hotplugging, so
checks to see if devices are present or not are useless.

Remove it.

Reported-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-2-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
9ef2e93f9b atapi: abort transfers with 0 byte limits
We're supposed to abort on transfers like this, unless we fill
Word 125 of our IDENTIFY data with a default transfer size, which
we don't currently do.

This is an ATA error, not a SCSI/ATAPI one.
See ATA8-ACS3 sections 7.17.6.49 or 7.21.5.

If we don't do this, QEMU will loop forever trying to transfer
zero bytes, which isn't particularly useful.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1442253685-23349-2-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
d9033e1d3a ide: fix ATAPI command permissions
We're a little too lenient with what we'll let an ATAPI drive handle.
Clamp down on the IDE command execution table to remove CD_OK permissions
from commands that are not and have never been ATAPI commands.

For ATAPI command validity, please see:
- ATA4 Section 6.5 ("PACKET Command feature set")
- ATA8/ACS Section 4.3 ("The PACKET feature set")
- ACS3 Section 4.3 ("The PACKET feature set")

ACS3 has a historical command validity table in Table B.4
("Historical Command Assignments") that can be referenced to find when
a command was introduced, deprecated, obsoleted, etc.

The only reference for ATAPI command validity is by checking that
version's PACKET feature set section.

ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4
therefore are assumed to have never been ATAPI commands.

Mandatory commands, as listed in ATA8-ACS3, are:

- DEVICE RESET
- EXECUTE DEVICE DIAGNOSTIC
- IDENTIFY DEVICE
- IDENTIFY PACKET DEVICE
- NOP
- PACKET
- READ SECTOR(S)
- SET FEATURES

Optional commands as listed in ATA8-ACS3, are:

- FLUSH CACHE
- READ LOG DMA EXT
- READ LOG EXT
- WRITE LOG DMA EXT
- WRITE LOG EXT

All other commands are illegal to send to an ATAPI device and should
be rejected by the device.

CD_OK removal justifications:

0x06 WIN_DSM              Defined in ACS2. Not valid for ATAPI.
0x21 WIN_READ_ONCE        Retired in ATA5. Not ATAPI in ATA4.
0x94 WIN_STANDBYNOW2      Retired in ATA4. Did not coexist with ATAPI.
0x95 WIN_IDLEIMMEDIATE2   Retired in ATA4. Did not coexist with ATAPI.
0x96 WIN_STANDBY2         Retired in ATA4. Did not coexist with ATAPI.
0x97 WIN_SETIDLE2         Retired in ATA4. Did not coexist with ATAPI.
0x98 WIN_CHECKPOWERMODE2  Retired in ATA4. Did not coexist with ATAPI.
0x99 WIN_SLEEPNOW2        Retired in ATA4. Did not coexist with ATAPI.
0xE0 WIN_STANDBYNOW1      Not part of ATAPI in ATA4, ACS or ACS3.
0xE1 WIN_IDLEIMMDIATE     Not part of ATAPI in ATA4, ACS or ACS3.
0xE2 WIN_STANDBY          Not part of ATAPI in ATA4, ACS or ACS3.
0xE3 WIN_SETIDLE1         Not part of ATAPI in ATA4, ACS or ACS3.
0xE4 WIN_CHECKPOWERMODE1  Not part of ATAPI in ATA4, ACS or ACS3.
0xE5 WIN_SLEEPNOW1        Not part of ATAPI in ATA4, ACS or ACS3.
0xF8 WIN_READ_NATIVE_MAX  Obsoleted in ACS3. Not ATAPI in ATA4 or ACS.

This patch fixes a divide by zero fault that can be caused by sending
the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to
attempt to use zeroed CHS values to perform sector arithmetic.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com
CC: qemu-stable@nongnu.org
2015-09-18 10:58:56 -04:00
John Snow
00ea63fd18 ide-test: add cdrom dma test
Now, test the DMA functionality of the ATAPI drive.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-5-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
f7ba8d7fb6 ide-test: add cdrom pio test
Add a simple read test for ATAPI devices,
using the PIO mechanism.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-4-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
ab4f705751 qtest/ahci: export generate_pattern
Share the pattern function for ide and ahci test.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-3-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
John Snow
d7531638db qtest/ahci: use generate_pattern everywhere
Fix the pattern generation to actually be interesting,
and make sure all buffers in the ahci-test actually use it.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-2-git-send-email-jsnow@redhat.com
2015-09-18 10:58:56 -04:00
Peter Maydell
ffa4822c01 Error reporting patches
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJV/AbJAAoJEDhwtADrkYZTh0gQAKahvV67+cg6/8R/MesRQKu+
 NNQWPT0xXBZAVkZ8Dl/a5FuWM9qqMTFNaPgL+Vk4SMUEoi3PmTanVP1OMWq9lKtv
 mWuZTOdJeOc0M8TDuI3OKFVhwqHwugBvsf+e56ai3ofdbwT0ANMbhN/m8jpJuJ1r
 4c/sGsInBkSrh0aJwJ/LAknYkeRNwmJYh21KnDUulydhhHFRGGi5D5J9mZVk2KVJ
 icXieBhgwWU/kCecAwK/CsrZHqL4Cy2smO9ENQqdATH3or3lOl9jk3qmvK7IO47F
 bjJSIirVf8hNaBqYFA4asXfpwHNcrit91MGH20GgCZNZZj2egcerTS5er8p4dDO4
 Tmp7CFSXU68d+NOt1gSygr8lOw87RmXHMvi4p6OgA7VOy3bwYhmiGWmQ3M8zE49X
 RblTs5niWX5hDSvwr0aqDsD5c1GxIhxz+/zeW7PqrfXC3lzNzJGeWUt8TEOuWYok
 7AU4BV7/tMqmpJaB0R0JCMNRHxvF9u5j8aX7i1/nerRMAnXr8KAbTo+p/npUsOVz
 nB2Qn6W+BtOa9zCesKdu1C6x7UxVauOuyB+0u1fzEaFskNOuvfZM4IUxSQh4XsNQ
 YgmIKvtpRuGNxPmbpu/MukRQ8bjb9hF8rwKX0KbupM+KMkbfHxjByr+BtTpwMA8a
 FmzT7AP8gTLSZmaeV9Ke
 =QmVV
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-09-18' into staging

Error reporting patches

# gpg: Signature made Fri 18 Sep 2015 13:42:49 BST using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-error-2015-09-18:
  memory: Fix bad error handling in memory_region_init_ram_ptr()
  loader: Fix memory_region_init_resizeable_ram() error handling
  Fix bad error handling after memory_region_init_ram()
  error: New error_fatal
  MAINTAINERS: Add "Error reporting" entry
  error: Copy location information in error_copy()
  hmp: Allow for error message hints on HMP
  error: only prepend timestamp on stderr

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-18 14:41:53 +01:00
Markus Armbruster
0bdaa3a429 memory: Fix bad error handling in memory_region_init_ram_ptr()
Commit ef701d7 screwed up handling of out-of-memory conditions.
Before the commit, we report the error and exit(1), in one place.  The
commit lifts the error handling up the call chain some, to three
places.  Fine.  Except it uses &error_abort in these places, changing
the behavior from exit(1) to abort(), and thus undoing the work of
commit 3922825 "exec: Don't abort when we can't allocate guest
memory".

The previous two commits fixed one of the three places, another one
was fixed in commit 33e0eb5.  This commit fixes the third one.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-5-git-send-email-armbru@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-18 14:39:39 +02:00
Markus Armbruster
df8abec8cb loader: Fix memory_region_init_resizeable_ram() error handling
Commit ef701d7 screwed up handling of out-of-memory conditions.
Before the commit, we report the error and exit(1), in one place.  The
commit lifts the error handling up the call chain some, to three
places.  Fine.  Except it uses &error_abort in these places, changing
the behavior from exit(1) to abort(), and thus undoing the work of
commit 3922825 "exec: Don't abort when we can't allocate guest
memory".

The previous commit fixed up uses of memory_region_init_ram().  One of
them was replaced by memory_region_init_resizeable_ram() [sic!] in
commit a166614, so Coccinelle missed it.  Fix it up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-4-git-send-email-armbru@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-18 14:39:35 +02:00
Markus Armbruster
f8ed85ac99 Fix bad error handling after memory_region_init_ram()
Symptom:

    $ qemu-system-x86_64 -m 10000000
    Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456:
    upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory
    Aborted (core dumped)

Root cause: commit ef701d7 screwed up handling of out-of-memory
conditions.  Before the commit, we report the error and exit(1), in
one place, ram_block_add().  The commit lifts the error handling up
the call chain some, to three places.  Fine.  Except it uses
&error_abort in these places, changing the behavior from exit(1) to
abort(), and thus undoing the work of commit 3922825 "exec: Don't
abort when we can't allocate guest memory".

The three places are:

* memory_region_init_ram()

  Commit 4994653 (right after commit ef701d7) lifted the error
  handling further, through memory_region_init_ram(), multiplying the
  incorrect use of &error_abort.  Later on, imitation of existing
  (bad) code may have created more.

* memory_region_init_ram_ptr()

  The &error_abort is still there.

* memory_region_init_rom_device()

  Doesn't need fixing, because commit 33e0eb5 (soon after commit
  ef701d7) lifted the error handling further, and in the process
  changed it from &error_abort to passing it up the call chain.
  Correct, because the callers are realize() methods.

Fix the error handling after memory_region_init_ram() with a
Coccinelle semantic patch:

    @r@
    expression mr, owner, name, size, err;
    position p;
    @@
            memory_region_init_ram(mr, owner, name, size,
    (
    -                              &error_abort
    +                              &error_fatal
    |
                                   err@p
    )
                                  );
    @script:python@
        p << r.p;
    @@
    print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column)

When the last argument is &error_abort, it gets replaced by
&error_fatal.  This is the fix.

If the last argument is anything else, its position is reported.  This
lets us check the fix is complete.  Four positions get reported:

* ram_backend_memory_alloc()

  Error is passed up the call chain, ultimately through
  user_creatable_complete().  As far as I can tell, it's callers all
  handle the error sanely.

* fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize()

  DeviceClass.realize() methods, errors handled sanely further up the
  call chain.

We're good.  Test case again behaves:

    $ qemu-system-x86_64 -m 10000000
    qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory
    [Exit 1 ]

The next commits will repair the rest of commit ef701d7's damage.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-18 14:39:29 +02:00
Markus Armbruster
a29a37b994 error: New error_fatal
Similar to error_abort, but doesn't report where the error was
created, and terminates the process with exit(1) rather than abort().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-2-git-send-email-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-18 14:38:08 +02:00
Markus Armbruster
4f966768ac MAINTAINERS: Add "Error reporting" entry
Error reporting work has been flowing through my tree for a while.
Time for MAINTAINERS to catch up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1442057396-21989-1-git-send-email-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-18 14:34:39 +02:00
Eric Blake
88e2ce2915 error: Copy location information in error_copy()
Commit 1e9b65bb forgot to propagate source information to copied
errors.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1441902890-23064-1-git-send-email-eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-09-18 14:34:39 +02:00
Eric Blake
50b7b000c9 hmp: Allow for error message hints on HMP
Commits 7216ae3d and d2828429 disabled some error message hints,
all because a change to use modern error reporting meant that the
hint would be output prior to the actual error.  Fix this by making
hints a first-class member of Error.

For example, we are now back to the pleasant:

 $ qemu-system-x86_64 --nodefaults -S --vnc :0 --chardev null,id=,
 qemu-system-x86_64: --chardev null,id=,: Parameter 'id' expects an identifier
 Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1441901956-21991-1-git-send-email-eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-09-18 14:34:39 +02:00
Stefan Hajnoczi
615cf669b5 error: only prepend timestamp on stderr
The -msg timestamp=on option prepends a timestamp to error messages.
This is useful on stderr where it allows users to identify when an error
was raised.

Timestamps do not make sense on the monitor since error_report() is
called in response to a synchronous monitor command and the user already
knows "when" the command was issued.  Additionally, the rest of the
monitor conversation lacks timestamps so the error timestamp cannot be
correlated with other activity.

Only prepend timestamps on stderr.  This fixes libvirt's 'drive_del'
processing, which did not expect a timestamp.  Other QEMU monitor
clients are probably equally confused by timestamps on monitor error
messages.

Cc: Markus Armbruster <armbru@redhat.com>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Frank Schreuder <fschreuder@transip.nl>
Cc: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <1439212541-16997-1-git-send-email-stefanha@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Tested-by: Frank Schreuder <fschreuder@transip.nl>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-09-18 14:34:39 +02:00
Peter Maydell
3bf1f5ec6a MIPS patches 2015-09-18
Changes:
 * fixes for rdhwr, tlbwr, mtc0, recip.fmt, rsqrt.fmt and daui instructions
 * removal of MIPS_DEBUG code
 * use tcg_gen_extrh_i64_i32()
 * improve random tlb index generation in cpu_mips_get_random()
 * exception handling improvements to correctly restore icount
 -----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJV+/JQAAoJEFIRjjwLKdprNboH/3w5bd/PpHqG7HW8kZpf/Vhb
 DQwvbMDC20PulIieYl3+FQTu/G4X1Vio1MNmbb40g9E/ddoqnYnTfpZry8Fa6beZ
 ZgSdVZt0F0T9XS1BcAyQdpzdi9fefwWZrJUaHMvTTL68Qc8Y4R+4CAuSmsi0JsFZ
 euKQlEQCxFzB+hUSZoBYmo/gFVzJUkWXbl5qr82uWW7nlycv7uSe/bopTZvT30ad
 EbJvqs8Eok8FRIZP+Qr5wDejjOYpXTNaOocPV1rcXT9Ffb5ozeq6Qp2uXQJEjbJb
 kNX9IIEUVH4rE6w80xOVVDVXTypHYvRYWnLvsys/sF0tuVFWwDYRn2n37xU0bew=
 =VsAJ
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150918' into staging

MIPS patches 2015-09-18

Changes:
* fixes for rdhwr, tlbwr, mtc0, recip.fmt, rsqrt.fmt and daui instructions
* removal of MIPS_DEBUG code
* use tcg_gen_extrh_i64_i32()
* improve random tlb index generation in cpu_mips_get_random()
* exception handling improvements to correctly restore icount

# gpg: Signature made Fri 18 Sep 2015 12:15:28 BST using RSA key ID 0B29DA6B
# gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"

* remotes/lalrae/tags/mips-20150918:
  target-mips: improve exception handling
  target-mips: correct MTC0 instruction on MIPS64
  target-mips: add missing restriction in DAUI instruction
  target-mips: fix corner case in TLBWR causing QEMU to hang
  pic32: use LCG algorithm for generated random index of TLBWR instruction
  target-mips: get rid of MIPS_DEBUG_SIGN_EXTENSIONS
  target-mips: get rid of MIPS_DEBUG
  target-mips: Fix RDHWR on CP0.Count
  target-mips: remove wrong checks for recip.fmt and rsqrt.fmt
  target-mips: Use tcg_gen_extrh_i64_i32

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-18 12:55:27 +01:00
Pavel Dovgaluk
9c708c7f9f target-mips: improve exception handling
This patch improves exception handling in MIPS.
Instructions generate several types of exceptions.
When exception is generated, it breaks the execution of the current
translation block. Implementation of the exceptions handling does not
correctly restore icount for the instruction which caused the exception.
In most cases icount will be decreased by the value equal to the size of
TB. This patch passes pointer to the translation block internals to the
exception handler. It allows correct restoring of the icount value.

Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
[leon.alrae@imgtec.com: avoid retranslation in linux-user SC, break lines
 which are over 80 chars, remove v3 changelog from the commit message]
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-09-18 12:07:24 +01:00