summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2019-08-27xen-bus: Avoid rewriting identical values to xenstoreAnthony PERARD
When QEMU receives a xenstore watch event suggesting that the "state" of the frontend changed, it records this in its own state but it also re-write the value back into xenstore even so there were no change. This triggers an unnecessary xenstore watch event which QEMU will process again (and maybe the frontend as well). Also QEMU could potentially write an already old value. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Paul Durrant <paul.durrant@citrix.com> Message-Id: <20190823101534.465-3-anthony.perard@citrix.com>
2019-08-27xen-bus: Fix backend state transition on device resetAnthony PERARD
When a frontend wants to reset its state and the backend one, it starts with setting "Closing", then waits for the backend (QEMU) to do the same. But when QEMU is setting "Closing" to its state, it triggers an event (xenstore watch) that re-execute xen_device_backend_changed() and set the backend state to "Closed". QEMU should wait for the frontend to set "Closed" before doing the same. Before setting "Closed" to the backend_state, we are also going to check if there is a frontend. If that the case, when the backend state is set to "Closing" the frontend should react and sets its state to "Closing" then "Closed". The backend should wait for that to happen. Fixes: b6af8926fb858c4f1426e5acb2cfc1f0580ec98a Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Paul Durrant <paul.durrant@citrix.com> Message-Id: <20190823101534.465-2-anthony.perard@citrix.com>
2019-08-27xen: cleanup IOREQ server on exitIgor Druzhinin
Device model is supposed to destroy IOREQ server for itself. Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com> Acked-by: Paul Durrant <paul.durrant@citrix.com> Message-Id: <1564428563-1006-1-git-send-email-igor.druzhinin@citrix.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2019-08-23Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Pull request # gpg: Signature made Thu 22 Aug 2019 16:52:45 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: vhost-user-scsi: prevent using uninitialized vqs util/async: hold AioContext ref to prevent use-after-free Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22vhost-user-scsi: prevent using uninitialized vqsRaphael Norwitz
Of the 3 virtqueues, seabios only sets cmd, leaving ctrl and event without a physical address. This can cause vhost_verify_ring_part_mapping to return ENOMEM, causing the following logs: qemu-system-x86_64: Unable to map available ring for ring 0 qemu-system-x86_64: Verify ring failure on region 0 The qemu commit e6cc11d64fc998c11a4dfcde8fda3fc33a74d844 has already resolved the issue for vhost scsi devices but the fix was never applied to vhost-user scsi devices. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1560299717-177734-1-git-send-email-raphael.norwitz@nutanix.com Message-Id: <1560299717-177734-1-git-send-email-raphael.norwitz@nutanix.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2019-08-22Merge remote-tracking branch 'remotes/kraxel/tags/vga-20190822-pull-request' ↵Peter Maydell
into staging vga: a collection of ati fixes/improvements. # gpg: Signature made Thu 22 Aug 2019 09:04:52 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20190822-pull-request: ati-vga: Implement dummy VBlank IRQ ati-vga: Add limited support for big endian frame buffer aperture ati-vga: Attempt to handle CRTC offset not exact multiple of stride ati-vga: Fix hardware cursor image offset ati-vga: Fix cursor color with guest_hwcursor=true ati-vga: Fix GPIO_MONID register write ati-vga: Add some register definitions for debugging ati-vga: Add registers for getting apertures Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22Merge remote-tracking branch 'remotes/kraxel/tags/usb-20190822-pull-request' ↵Peter Maydell
into staging usb: bugfixes and minor improvements. # gpg: Signature made Thu 22 Aug 2019 07:52:32 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20190822-pull-request: ehci: fix queue->dev null ptr dereference usb: reword -usb command-line option and mention xHCI xhci: Add No Op Command usb-redir: merge interrupt packets usbredir: fix buffer-overflow on vmload Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2019-08-21' ↵Peter Maydell
into staging Monitor patches for 2019-08-21 # gpg: Signature made Wed 21 Aug 2019 16:35:07 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-monitor-2019-08-21: monitor/qmp: Update comment for commit 4eaca8de268 qdev: Collect HMP handlers command handlers in qdev-monitor.c qapi: Move query-target from misc.json to machine.json hw/core: Move cpu.c, cpu.h from qom/ to hw/core/ Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-22ati-vga: Implement dummy VBlank IRQBALATON Zoltan
The MacOS driver exits if the card does not have an interrupt. If we set PCI_INTERRUPT_PIN to 1 then it enables VBlank interrupts and it boots but the mouse pointer cannot be moved. This patch implements a dummy VBlank interrupt triggered by a 60 Hz timer. With this the pointer now moves but MacOS still hangs somewhere before completely finishing boot. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <89364275f2fb5f85ee73c0e76528aa91691a499a.1565907489.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-22ehci: fix queue->dev null ptr dereferenceGerd Hoffmann
In case we don't have a device for an active queue, just skip processing the queue (same we do for inactive queues) and log a guest bug. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20190821085319.13711-1-kraxel@redhat.com
2019-08-21Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/trivial-branch-pull-request' into staging Various trivial fixes # gpg: Signature made Wed 21 Aug 2019 12:19:11 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-pull-request: hw/display: Compile various display devices as common object hw/display/sm501: Remove unused include spapr_events: Rewrite a fall through comment vl: Rewrite a fall through comment target/ppc: Rewrite a fall through comment hw/ipmi: Rewrite a fall through comment hw/dma/omap_dma: Move switch 'fall through' comment to correct place json: Move switch 'fall through' comment to correct place hw/net/e1000: Fix erroneous comment .gitignore: ignore some vhost-user* related files configure: fix sdl detection using sdl2-config configure: remove obsoleted $sparc_cpu variable misc: fix naming scheme of compatiblity arrays test: Use g_strndup instead of plain strndup Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-21Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/audio-20190821-pull-request' into staging audio: second batch of -audiodev support, adding support for multiple backends. # gpg: Signature made Wed 21 Aug 2019 09:40:37 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/audio-20190821-pull-request: audio: fix memory leak reported by ASAN audio: use size_t where makes sense audio: remove read and write pcm_ops paaudio: fix playback glitches audio: do not run each backend in audio_run audio: remove audio_MIN, audio_MAX paaudio: properly disconnect streams in fini_* paaudio: do not move stream when sink/source name is specified audio: audiodev= parameters no longer optional when -audiodev present paaudio: prepare for multiple audiodev audio: add audiodev properties to frontends audio: add audiodev property to vnc and wav_capture audio: basic support for multi backend audio audio: reduce glob_audio_state usage audio: Add missing fall through comments Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-21Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-4.2-20190821' ↵Peter Maydell
into staging ppc patch queue for 2019-08-21 First ppc and spapr pull request for qemu-4.2. Includes: * Some TCG emulation fixes and performance improvements * Support for the mffsl instruction in TCG * Added missing DPDES SPR * Some enhancements to the emulation of the XIVE interrupt controller * Cleanups to spapr MSI management * Some new suspend/resume infrastructure and a draft suspend implementation for spapr * New spapr hypercall for TPM communication (will be needed for secure guests under an Ultravisor) * Fix several memory leaks And a few other assorted fixes. # gpg: Signature made Wed 21 Aug 2019 08:24:44 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-4.2-20190821: (42 commits) ppc: Fix emulated single to double denormalized conversions ppc: Fix emulated INFINITY and NAN conversions ppc: conform to processor User's Manual for xscvdpspn ppc: Add support for 'mffsl' instruction target/ppc: Add Directed Privileged Door-bell Exception State (DPDES) SPR spapr/xive: Mask the EAS when allocating an IRQ spapr: Implement better workaround in spapr-vty device spapr/irq: Drop spapr_irq_msi_reset() spapr/pci: Free MSIs during reset spapr/pci: Consolidate de-allocation of MSIs ppc: remove idle_timer logic spapr: Implement ibm,suspend-me i386: use machine class ->wakeup method machine: Add wakeup method to MachineClass ppc/xive: Improve 'info pic' support ppc/xive: Provide silent escalation support ppc/xive: Provide unconditional escalation support ppc/xive: Provide escalation support ppc/xive: Provide backlog support ppc/xive: Implement TM_PULL_OS_CTX special command ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-21qapi: Move query-target from misc.json to machine.jsonMarkus Armbruster
Move query-target and its return type TargetInfo from misc.json to machine.json, where they are covered by MAINTAINERS section "Machine core". Also move its implementation from arch_init.c to hw/core/machine-qmp-cmds, where it is likewise covered. All users of SysEmuTarget are now in machine.json. Move it there from common.json. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190709152053.16670-3-armbru@redhat.com>
2019-08-21hw/core: Move cpu.c, cpu.h from qom/ to hw/core/Markus Armbruster
Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190709152053.16670-2-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> [Rebased onto merge commit 95a9457fd44; missed instances of qom/cpu.h in comments replaced]
2019-08-21hw/display: Compile various display devices as common objectPhilippe Mathieu-Daudé
Various display devices are not target-specific and can be compiled once for all the targets. After this commit, the 'make world' target is reduced by 54 objects Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20190812113739.16587-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21hw/display/sm501: Remove unused includePhilippe Mathieu-Daudé
The "cpu.h" include makes devices target-specific. Since it is not used, remove it, so the device become generic (we can now compile it once for all targets). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20190812113739.16587-2-philmd@redhat.com> [lv: fix conflict with 650d103d3ea9 ("Include hw/hw.h exactly where needed")] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21spapr_events: Rewrite a fall through commentPhilippe Mathieu-Daudé
GCC9 is confused by this comment when building with CFLAG -Wimplicit-fallthrough=2: CC ppc64-softmmu/hw/ppc/spapr_rtc.o hw/ppc/spapr_events.c: In function ‘rtas_event_log_to_source’: hw/ppc/spapr_events.c:312:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 312 | if (spapr_ovec_test(spapr->ov5_cas, OV5_HP_EVT)) { | ^ hw/ppc/spapr_events.c:317:5: note: here 317 | case RTAS_LOG_TYPE_EPOW: | ^~~~ cc1: all warnings being treated as errors Rewrite the comment using 'fall through' which is recognized by GCC and static analyzers. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190719131425.10835-8-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21ati-vga: Add limited support for big endian frame buffer apertureBALATON Zoltan
Set frame buffer endianness according to requested endianness for frame buffer apertures. We set frame buffer to big endian if any of the two apertures are set to big endian. Using different endianness for the two apertures is not implemented. This fixes inverted colors with MacOS and Xorg frame buffer driver but some Linux drivers may have endianness issues even on real hardware so this may not fix all cases. MorphOS uses aper0 in LE, Linux uses aper0 in BE and MacOS uses aper1 in BE but not sure about others or if MacOS also may need aper0 in which case we'll need a more complex fix but MacOS has other problems yet so for now this might work. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: e2a7ec7af3fc30523213bcd27832ccad34323f2c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Attempt to handle CRTC offset not exact multiple of strideBALATON Zoltan
MacOS uses non-0 offset so it needs this and the resulting vbe_start_addr seems correct but picture is still broken with OpenBIOS after FCode runs but that maybe due to firmware problems now. After boot, picture is now correct. It also occured to me that these CRTC regs are also present in VGA so I wonder if they should be shared in case some drivers try to poke them via VGA regs or these are a separate set of regs for extended mode. Added a comment noting this but drivers I've tried so far program the card accessing ati regs so I did not attempt to change it. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 1c6fce457ef7e6f889e38dc0423791be92310a62.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix hardware cursor image offsetBALATON Zoltan
The crtc_offset is not needed, cur_offset is relative to the start of vram not the start of displayed area. This fixes broken pointer image with MacOS that uses non-0 crtc_offset. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: e6acb1fa3ca980dc948045443e5986e2aa79bf7c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix cursor color with guest_hwcursor=trueBALATON Zoltan
Fixes: a38127414bd007c5b6ae64c664d9e8839393277e Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: d99f9e07923a74932dbb15e93dd50aa8d2816b19.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix GPIO_MONID register writeBALATON Zoltan
Also update bitbang_i2c state when output bits are changed while enable bits are set. This fixes EDID access by the ATI FCode ROM. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 292e70a92b7fbfd9a4120d433dbdcfda4e5f6c3c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Add some register definitions for debuggingBALATON Zoltan
Add names for AMCGPIO regs to make it easier to identify these in trace output. This is where rage128p has the DDC from the DVI port among others but because we don't implement the flat panel controller we don't want to connect an EDID here to make sure drivers use the VGA output instead. But since these are often probed by drivers it helps to see what happens by logging these registers by name. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 31ff69ca6959d090869907774faa1af7d2c02b2b.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Add registers for getting aperturesBALATON Zoltan
Some drivers (e.g. Linux radeon drm and MacOS) access these to find apertures to access card. Try to implement these but not sure these are correct yet. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: b2df13655feecd63c0049ec45fd87d1026f67091.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21hw/ipmi: Rewrite a fall through commentPhilippe Mathieu-Daudé
GCC9 is confused by this comment when building with CFLAG -Wimplicit-fallthrough=2: hw/ipmi/ipmi_bmc_extern.c: In function ‘addchar’: hw/ipmi/ipmi_bmc_extern.c:178:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 178 | ch |= 0x10; | ~~~^~~~~~~ hw/ipmi/ipmi_bmc_extern.c:181:5: note: here 181 | default: | ^~~~~~~ cc1: all warnings being treated as errors make: *** [rules.mak:69: hw/ipmi/ipmi_bmc_extern.o] Error 1 Rewrite the comment using 'fall through' which is recognized by GCC and static analyzers. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Corey Minyard <cminyard@mvista.com> Message-Id: <20190719131425.10835-5-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21hw/dma/omap_dma: Move switch 'fall through' comment to correct placePhilippe Mathieu-Daudé
Reported by GCC9 when building with CFLAG -Wimplicit-fallthrough=2: CC hw/dma/omap_dma.o hw/dma/omap_dma.c: In function ‘omap_dma_write’: hw/dma/omap_dma.c:1532:12: error: this statement may fall through [-Werror=implicit-fallthrough=] 1532 | if (s->model <= omap_dma_3_1) | ^ hw/dma/omap_dma.c:1534:5: note: here 1534 | case 0x400: | ^~~~ cc1: all warnings being treated as errors Correctly place the 'fall through' comment. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20190719131425.10835-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21hw/net/e1000: Fix erroneous commentPhilippe Mathieu-Daudé
Missed during the QOM convertion in 9af21dbee14. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20190715102210.31365-1-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21xhci: Add No Op CommandHikaru Nishida
This commit adds No Op Command (23) to xHC for verifying the operation of the Command Ring mechanisms. No Op Command is defined in XHCI spec (4.6.2) and just reports Command Completion Event with Completion Code == Success. Before this commit, No Op Command is not implemented so xHC reports Command Completion Event with Completion Code == TRB Error. This commit fixes this behaviour to report Completion Code correctly. Signed-off-by: Hikaru Nishida <hikarupsp@gmail.com> Message-id: 20190720060427.50457-1-hikarupsp@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21usb-redir: merge interrupt packetsMartin Cerveny
Interrupt packets (limited by wMaxPacketSize) should be buffered and merged by algorithm described in USB spec. (see usb_20.pdf/5.7.3 Interrupt Transfer Packet Size Constraints). Signed-off-by: Martin Cerveny <M.Cerveny@computer.org> Message-id: 20190724125859.14624-2-M.Cerveny@computer.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21usbredir: fix buffer-overflow on vmloadMarc-André Lureau
If interface_count is NO_INTERFACE_INFO, let's not access the arrays out-of-bounds. ==994==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000243930 at pc 0x5642068086a8 bp 0x7f0b6f9ffa50 sp 0x7f0b6f9ffa40 READ of size 1 at 0x625000243930 thread T0 #0 0x5642068086a7 in usbredir_check_bulk_receiving /home/elmarco/src/qemu/hw/usb/redirect.c:1503 #1 0x56420681301c in usbredir_post_load /home/elmarco/src/qemu/hw/usb/redirect.c:2154 #2 0x5642068a56c2 in vmstate_load_state /home/elmarco/src/qemu/migration/vmstate.c:168 #3 0x56420688e2ac in vmstate_load /home/elmarco/src/qemu/migration/savevm.c:829 #4 0x5642068980cb in qemu_loadvm_section_start_full /home/elmarco/src/qemu/migration/savevm.c:2211 #5 0x564206899645 in qemu_loadvm_state_main /home/elmarco/src/qemu/migration/savevm.c:2395 #6 0x5642068998cf in qemu_loadvm_state /home/elmarco/src/qemu/migration/savevm.c:2467 #7 0x56420685f3e9 in process_incoming_migration_co /home/elmarco/src/qemu/migration/migration.c:449 #8 0x564207106c47 in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:115 #9 0x7f0c0604e37f (/lib64/libc.so.6+0x4d37f) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Liam Merwick <liam.merwick@oracle.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190807084048.4258-1-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21misc: fix naming scheme of compatiblity arraysMarc-André Lureau
Since merge 31ed41889e6e13699871040fe089a2884dca46cb ("Merge remote-tracking branch 'remotes/elmarco/tags/machine-props-pull-request' into staging"), the compat arrays are in lowercase. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20190708204909.10891-1-marcandre.lureau@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-08-21spapr/xive: Mask the EAS when allocating an IRQCédric Le Goater
If an IRQ is allocated and not configured, such as a MSI requested by a PCI driver, it can be saved in its default state and possibly later on restored using the same state. If not initially MASKED, KVM will try to find a matching priority/target tuple for the interrupt and fail to restore the VM because 0/0 is not a valid target. When allocating a IRQ number, the EAS should be set to a sane default : VALID and MASKED. Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190813164420.9829-1-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement better workaround in spapr-vty devicePaul Mackerras
Linux guest kernels have code which scans the string of characters returned from the H_GET_TERM_CHAR hypercall and removes any \0 character which comes immediately after a \r character. This is to work around a bug which was present in some ancient versions of PowerVM. In order to avoid the corruption of the console byte stream that this introduced, commit 6c3bc244d3cb ("spapr: Implement bug in spapr-vty device to be compatible with PowerVM") added a workaround which adds a \0 character after every \r character. Unfortunately, this corrupts the console byte stream for those operating systems, such as AIX, which don't remove the null bytes. We can avoid triggering the Linux kernel workaround if we avoid returning a buffer which contains a \0 after a \r. We can do that by breaking out of the loop in vty_getchars() if we are about to insert a \0 and the previous character in the buffer is a \r. That means we return the characters up to the \r for the current H_GET_TERM_CHAR, and the characters starting with the \0 for the next one. With this workaround, we don't insert any spurious characters and we avoid triggering the Linux kernel workaround, so the guest will receive an uncorrupted stream whether or not they have the workaround. Fixes: 6c3bc244d3cb ("spapr: Implement bug in spapr-vty device to be compatible with PowerVM") Signed-off-by: Paul Mackerras <paulus@ozlabs.org> Message-Id: <20190731043653.shdi5sizjp4t65op@oak.ozlabs.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr/irq: Drop spapr_irq_msi_reset()Greg Kurz
PHBs already take care of clearing the MSIs from the bitmap during reset or unplug. No need to do this globally from the machine code. Rather add an assert to ensure that PHBs have acted as expected. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156415228966.1064338.190189424190233355.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> [dwg: Fix crash in qtest case where spapr->irq_map can be NULL at the new assert()] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr/pci: Free MSIs during resetGreg Kurz
When the machine is reset, the MSI bitmap is cleared but the allocated MSIs are not freed. Some operating systems, such as AIX, can detect the previous configuration and assert. Empty the MSI cache, this performs the needed cleanup. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156415228410.1064338.4486161194061636096.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr/pci: Consolidate de-allocation of MSIsGreg Kurz
When freeing MSIs, we need to: - remove them from the machine's MSI bitmap - remove them from the IC backend - remove them from the PHB's MSI cache This is currently open coded in two places in rtas_ibm_change_msi(), and we're about to need this in spapr_phb_reset() as well. Instead of duplicating this code again, make it a destroy function for the PHB's MSI cache. Removing an MSI device from the cache will call the destroy function internally. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156415227855.1064338.5657793835271464648.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement ibm,suspend-meNicholas Piggin
This has been useful to modify and test the Linux pseries suspend code but it requires modification to the guest to call it (due to being gated by other unimplemented features). It is not otherwise used by Linux yet, but work is slowly progressing there. This allows a (lightly modified) guest kernel to suspend with `echo mem > /sys/power/state` and be resumed with system_wakeup monitor command. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190722061752.22114-2-npiggin@gmail.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21i386: use machine class ->wakeup methodNicholas Piggin
Move the i386 suspend_wakeup logic out of the fallback path, and into the new ->wakeup method. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190722061752.22114-1-npiggin@gmail.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Improve 'info pic' supportCédric Le Goater
Provide a better output of the XIVE END structures including the escalation information and extend the PowerNV machine 'info pic' command with a dump of the END EAS table used for escalations. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-9-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Provide silent escalation supportCédric Le Goater
When the 's' bit is set the escalation is said to be 'silent' or 'silent/gather'. In such configuration, the notification sequence is skipped and only the escalation sequence is performed. This is used to configure all the EQs of a vCPU to escalate on a single EQ which will then target the hypervisor. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-8-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Provide unconditional escalation supportCédric Le Goater
When the 'u' bit is set the escalation is said to be 'unconditional' which means that the ESe PQ bits are not used. Introduce a xive_router_end_es_notify() routine to share code with the ESn notification. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-7-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Provide escalation supportCédric Le Goater
If the XIVE presenter can not find the NVT dispatched on any of the HW threads, it can not deliver the interrupt. XIVE offers an escalation mechanism to handle such scenarios and inform the hypervisor that an action should be taken. Escalation is configured by setting the 'e' bit and the EAS in word 4 & 5 to let the HW look for the escalation END on which to trigger a new event. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-6-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Provide backlog supportCédric Le Goater
If backlog is activated ('b' bit) on the END, the pending priority of a missed event is recorded in the IPB field of the NVT for a later resend. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-5-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21ppc/xive: Implement TM_PULL_OS_CTX special commandCédric Le Goater
When a vCPU is not dispatched anymore on a HW thread, the Hypervisor (KVM on Linux) invalidates the OS interrupt context of a vCPU with this special command. It returns the OS CAM line value and resets the VO bit. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190718115420.19919-4-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: initial implementation for H_TPM_COMM/spapr-tpm-proxyMichael Roth
This implements the H_TPM_COMM hypercall, which is used by an Ultravisor to pass TPM commands directly to the host's TPM device, or a TPM Resource Manager associated with the device. This also introduces a new virtual device, spapr-tpm-proxy, which is used to configure the host TPM path to be used to service requests sent by H_TPM_COMM hcalls, for example: -device spapr-tpm-proxy,id=tpmp0,host-path=/dev/tpmrm0 By default, no spapr-tpm-proxy will be created, and hcalls will return H_FUNCTION. The full specification for this hypercall can be found in docs/specs/ppc-spapr-uv-hcalls.txt Since SVM-related hcalls like H_TPM_COMM use a reserved range of 0xEF00-0xEF80, we introduce a separate hcall table here to handle them. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com Message-Id: <20190717205842.17827-3-mdroth@linux.vnet.ibm.com> [dwg: Corrected #include for upstream change] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement H_JOINNicholas Piggin
This has been useful to modify and test the Linux pseries suspend code but it requires modification to the guest to call it (due to being gated by other unimplemented features). It is not otherwise used by Linux yet, but work is slowly progressing there. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190718034214.14948-5-npiggin@gmail.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement H_CONFERNicholas Piggin
This does not do directed yielding and is not quite as strict as PAPR specifies in terms of precise dispatch behaviour. This generally will mean suboptimal performance, rather than guest misbehaviour. Linux does not rely on exact dispatch behaviour. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190718034214.14948-4-npiggin@gmail.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement H_PRODNicholas Piggin
H_PROD is added, and H_CEDE is modified to test the prod bit according to PAPR. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190718034214.14948-3-npiggin@gmail.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-21spapr: Implement dispatch tracking for tcgNicholas Piggin
Implement cpu_exec_enter/exit on ppc which calls into new methods of the same name in PPCVirtualHypervisorClass. These are used by spapr to implement the splpar VPA dispatch counter initially. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20190718034214.14948-2-npiggin@gmail.com> [dwg: Removed unnecessary CONFIG_USER_ONLY checks as suggested by gkurz] Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>