summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2020-06-12Lift max memory slots limit imposed by vhost-userRaphael Norwitz
Historically, sending all memory regions to vhost-user backends in a single message imposed a limitation on the number of times memory could be hot-added to a VM with a vhost-user device. Now that backends which support the VHOST_USER_PROTOCOL_F_CONFIGURE_SLOTS send memory regions individually, we no longer need to impose this limitation on devices which support this feature. With this change, VMs with a vhost-user device which supports the VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS can support a configurable number of memory slots, up to the maximum allowed by the target platform. Existing backends which do not support VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS are unaffected. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com> Suggested-by: Mike Cui <cui@nutanix.com> Message-Id: <1588533678-23450-6-git-send-email-raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-06-12Transmit vhost-user memory regions individuallyRaphael Norwitz
With this change, when the VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS protocol feature has been negotiated, Qemu no longer sends the backend all the memory regions in a single message. Rather, when the memory tables are set or updated, a series of VHOST_USER_ADD_MEM_REG and VHOST_USER_REM_MEM_REG messages are sent to transmit the regions to map and/or unmap instead of sending send all the regions in one fixed size VHOST_USER_SET_MEM_TABLE message. The vhost_user struct maintains a shadow state of the VM’s memory regions. When the memory tables are modified, the vhost_user_set_mem_table() function compares the new device memory state to the shadow state and only sends regions which need to be unmapped or mapped in. The regions which must be unmapped are sent first, followed by the new regions to be mapped in. After all the messages have been sent, the shadow state is set to the current virtual device state. Existing backends which do not support VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS are unaffected. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Swapnil Ingle <swapnil.ingle@nutanix.com> Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com> Suggested-by: Mike Cui <cui@nutanix.com> Message-Id: <1588533678-23450-5-git-send-email-raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-06-12Add VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTSRaphael Norwitz
This change introduces a new feature to the vhost-user protocol allowing a backend device to specify the maximum number of ram slots it supports. At this point, the value returned by the backend will be capped at the maximum number of ram slots which can be supported by vhost-user, which is currently set to 8 because of underlying protocol limitations. The returned value will be stored inside the VhostUserState struct so that on device reconnect we can verify that the ram slot limitation has not decreased since the last time the device connected. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com> Message-Id: <1588533678-23450-4-git-send-email-raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-06-09Add vhost-user helper to get MemoryRegion dataRaphael Norwitz
When setting the memory tables, qemu uses a memory region's userspace address to look up the region's MemoryRegion struct. Among other things, the MemoryRegion contains the region's offset and associated file descriptor, all of which need to be sent to the backend. With VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS, this logic will be needed in multiple places, so before feature support is added it should be moved to a helper function. This helper is also used to simplify the vhost_user_can_merge() function. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <1588533678-23450-3-git-send-email-raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-06-09Add helper to populate vhost-user message regionsRaphael Norwitz
When setting vhost-user memory tables, memory region descriptors must be copied from the vhost_dev struct to the vhost-user message. To avoid duplicating code in setting the memory tables, we should use a helper to populate this field. This change adds this helper. Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <1588533678-23450-2-git-send-email-raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2020-06-09vhost-user-blk: delay vhost_user_blk_disconnectDima Stepanov
A socket write during vhost-user communication may trigger a disconnect event, calling vhost_user_blk_disconnect() and clearing all the vhost_dev structures holding data that vhost-user functions expect to remain valid to roll back initialization correctly. Delay the cleanup to keep vhost_dev structure valid. There are two possible states to handle: 1. RUN_STATE_PRELAUNCH: skip bh oneshot call and perform disconnect in the caller routine. 2. RUN_STATE_RUNNING: delay by using bh BH changes are based on the similar changes for the vhost-user-net device: commit e7c83a885f865128ae3cf1946f8cb538b63cbfba "vhost-user: delay vhost_user_stop" Signed-off-by: Dima Stepanov <dimastep@yandex-team.ru> Message-Id: <69b73b94dcd066065595266c852810e0863a0895.1590396396.git.dimastep@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Li Feng <fengli@smartx.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
2020-06-09hw/pci-host: Use the IEC binary prefix definitionsPhilippe Mathieu-Daudé
IEC binary prefixes ease code review: the unit is explicit. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200601142930.29408-6-f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-09hw/pci/pci_bridge: Use the IEC binary prefix definitionsPhilippe Mathieu-Daudé
IEC binary prefixes ease code review: the unit is explicit. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200601142930.29408-5-f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-09hw/pci/pci_bridge: Correct pci_bridge_io memory region sizePhilippe Mathieu-Daudé
memory_region_set_size() handle the 16 Exabytes limit by special-casing the UINT64_MAX value. This is not a problem for the 32-bit maximum, 4 GiB. By using the UINT32_MAX value, the pci_bridge_io MemoryRegion ends up missing 1 byte: (qemu) info mtree memory-region: pci_bridge_io 0000000000000000-00000000fffffffe (prio 0, i/o): pci_bridge_io 0000000000000060-0000000000000060 (prio 0, i/o): i8042-data 0000000000000064-0000000000000064 (prio 0, i/o): i8042-cmd 00000000000001ce-00000000000001d1 (prio 0, i/o): vbe 0000000000000378-000000000000037f (prio 0, i/o): parallel 00000000000003b4-00000000000003b5 (prio 0, i/o): vga ... Fix by using the correct value. We now have: memory-region: pci_bridge_io 0000000000000000-00000000ffffffff (prio 0, i/o): pci_bridge_io 0000000000000060-0000000000000060 (prio 0, i/o): i8042-data 0000000000000064-0000000000000064 (prio 0, i/o): i8042-cmd ... Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200601142930.29408-4-f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-09hw/pci-host/prep: Correct RAVEN bus bridge memory region sizePhilippe Mathieu-Daudé
memory_region_set_size() handle the 16 Exabytes limit by special-casing the UINT64_MAX value. This is not a problem for the 32-bit maximum, 4 GiB. By using the UINT32_MAX value, the bm-raven MemoryRegion ends up missing 1 byte: $ qemu-system-ppc -M prep -S -monitor stdio -usb memory-region: bm-raven 0000000000000000-00000000fffffffe (prio 0, i/o): bm-raven 0000000000000000-000000003effffff (prio 0, i/o): alias bm-pci-memory @pci-memory 0000000000000000-000000003effffff 0000000080000000-00000000ffffffff (prio 0, i/o): alias bm-system @system 0000000000000000-000000007fffffff Fix by using the correct value. We now have: memory-region: bm-raven 0000000000000000-00000000ffffffff (prio 0, i/o): bm-raven 0000000000000000-000000003effffff (prio 0, i/o): alias bm-pci-memory @pci-memory 0000000000000000-000000003effffff 0000000080000000-00000000ffffffff (prio 0, i/o): alias bm-system @system 0000000000000000-000000007fffffff Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200601142930.29408-3-f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-09pci: assert configuration access is within boundsPrasad J Pandit
While accessing PCI configuration bytes, assert that 'address + len' is within PCI configuration space. Generally it is within bounds. This is more of a defensive assert, in case a buggy device was to send 'address' which may go out of bounds. Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <20200604113525.58898-1-ppandit@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09hw/pci/pcie: Move hot plug capability check to pre_plug callbackJulia Suvorova
Check for hot plug capability earlier to avoid removing devices attached during the initialization process. Run qemu with an unattached drive: -drive file=$FILE,if=none,id=drive0 \ -device pcie-root-port,id=rp0,slot=3,bus=pcie.0,hotplug=off Hotplug a block device: device_add virtio-blk-pci,id=blk0,drive=drive0,bus=rp0 If hotplug fails on plug_cb, drive0 will be deleted. Fixes: 0501e1aa1d32a6 ("hw/pci/pcie: Forbid hot-plug if it's disabled on the slot") Acked-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Julia Suvorova <jusual@redhat.com> Message-Id: <20200604125947.881210-1-jusual@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09virtio-balloon: Provide an interface for free page reportingAlexander Duyck
Add support for free page reporting. The idea is to function very similar to how the balloon works in that we basically end up madvising the page as not being used. However we don't really need to bother with any deflate type logic since the page will be faulted back into the guest when it is read or written to. This provides a new way of letting the guest proactively report free pages to the hypervisor, so the hypervisor can reuse them. In contrast to inflate/deflate that is triggered via the hypervisor explicitly. Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200527041407.12700.73735.stgit@localhost.localdomain>
2020-06-09virtio-balloon: Implement support for page poison reporting featureAlexander Duyck
We need to make certain to advertise support for page poison reporting if we want to actually get data on if the guest will be poisoning pages. Add a value for reporting the poison value being used if page poisoning is enabled in the guest. With this we can determine if we will need to skip free page reporting when it is enabled in the future. The value currently has no impact on existing balloon interfaces. In the case of existing balloon interfaces the onus is on the guest driver to reapply whatever poison is in place. When we add free page reporting the poison value is used to determine if we can perform in-place page reporting. The expectation is that a reported page will already contain the value specified by the poison, and the reporting of the page should not change that value. Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200527041400.12700.33251.stgit@localhost.localdomain>
2020-06-09virtio-balloon: unref the iothread when unrealizingDavid Hildenbrand
We took a reference when realizing, so let's drop that reference when unrealizing. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Cc: qemu-stable@nongnu.org Cc: Wei Wang <wei.w.wang@intel.com> Cc: Alexander Duyck <alexander.duyck@gmail.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20200520100439.19872-4-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09virtio-balloon: fix free page hinting check on unrealizeDavid Hildenbrand
Checking against guest features is wrong. We allocated data structures based on host features. We can rely on "free_page_bh" as an indicator whether to un-do stuff instead. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Cc: qemu-stable@nongnu.org Cc: Wei Wang <wei.w.wang@intel.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Alexander Duyck <alexander.duyck@gmail.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20200520100439.19872-3-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09virtio-balloon: fix free page hinting without an iothreadDavid Hildenbrand
In case we don't have an iothread, we mark the feature as abscent but still add the queue. 'free_page_bh' remains set to NULL. qemu-system-i386 \ -M microvm \ -nographic \ -device virtio-balloon-device,free-page-hint=true \ -nographic \ -display none \ -monitor none \ -serial none \ -qtest stdio Doing a "write 0xc0000e30 0x24 0x030000000300000003000000030000000300000003000000030000000300000003000000" We will trigger a SEGFAULT. Let's move the check and bail out. While at it, move the static initializations to instance_init(). free_page_report_status and block_iothread are implicitly set to the right values (0/false) already, so drop the initialization. Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Reported-by: Alexander Bulekov <alxndr@bu.edu> Cc: qemu-stable@nongnu.org Cc: Wei Wang <wei.w.wang@intel.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Alexander Duyck <alexander.duyck@gmail.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20200520100439.19872-2-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09arm/acpi: TPM2 ACPI table supportEric Auger
Add a TPM2 ACPI table if a TPM2.0 sysbus device has been dynamically instantiated. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20200601095737.32671-4-eric.auger@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09acpi: Move build_tpm2() in the generic partEric Auger
We plan to build the TPM2 table on ARM too. In order to reuse the generation code, let's move build_tpm2() to aml-build.c. No change in the implementation. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20200601095737.32671-3-eric.auger@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09acpi: Convert build_tpm2() to build_append* APIEric Auger
In preparation of its move to the generic acpi code, let's convert build_tpm2() to use build_append API. This latter now is prefered in place of direct ACPI struct field settings with manual endianness conversion. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20200601095737.32671-2-eric.auger@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09acpi: tpm: Do not build TCPA table for TPM 2Stefan Berger
Do not build a TCPA table for TPM 2 anymore but create the log area when building the TPM2 table. The TCPA table is only needed for TPM 1.2. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09acpi: move aml builder code for parallel deviceGerd Hoffmann
Also adds support for multiple LPT devices. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200515150421.25479-8-kraxel@redhat.com>
2020-06-09acpi: parallel: don't use _STA methodGerd Hoffmann
The _STA method dates back to the days where we had a static DSDT. The device is listed in the DSDT table unconditionally and the _STA method checks a bit in the isa bridge pci config space to figure whenever a given is isa device is present or not, then evaluates to 0x0f (present) or 0x00 (absent). These days the DSDT is generated by qemu anyway, so if a device is not present we can simply drop it from the DSDT instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20200515150421.25479-7-kraxel@redhat.com>
2020-06-09acpi: move aml builder code for serial deviceGerd Hoffmann
The code uses the isa_serial_io array to figure what the device uid is. Side effect is that acpi antries are not limited to port 1+2 any more, we'll also get entries for ports 3+4. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200515150421.25479-6-kraxel@redhat.com>
2020-06-09acpi: serial: don't use _STA methodGerd Hoffmann
The _STA method dates back to the days where we had a static DSDT. The device is listed in the DSDT table unconditionally and the _STA method checks a bit in the isa bridge pci config space to figure whenever a given is isa device is present or not, then evaluates to 0x0f (present) or 0x00 (absent). These days the DSDT is generated by qemu anyway, so if a device is not present we can simply drop it from the DSDT instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200515150421.25479-5-kraxel@redhat.com>
2020-06-09acpi: rtc: use a single crs rangeGerd Hoffmann
Use a single io range for _CRS instead of two, following what real hardware does. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20200515150421.25479-4-kraxel@redhat.com>
2020-06-09acpi: move aml builder code for rtc deviceGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200515150421.25479-3-kraxel@redhat.com>
2020-06-09hw/acpi/nvdimm: add a helper to augment SRAT generationVishal Verma
NVDIMMs can belong to their own proximity domains, as described by the NFIT. In such cases, the SRAT needs to have Memory Affinity structures in the SRAT for these NVDIMMs, otherwise Linux doesn't populate node data structures properly during NUMA initialization. See the following for an example failure case. https://lore.kernel.org/linux-nvdimm/20200416225438.15208-1-vishal.l.verma@intel.com/ Introduce a new helper, nvdimm_build_srat(), and call it for both the i386 and arm versions of 'build_srat()' to augment the SRAT with memory affinity information for NVDIMMs. The relevant command line options to exercise this are below. Nodes 0-1 contain CPUs and regular memory, and nodes 2-3 are the NVDIMM address space. -object memory-backend-ram,id=mem0,size=2048M -numa node,nodeid=0,memdev=mem0, -numa cpu,node-id=0,socket-id=0 -object memory-backend-ram,id=mem1,size=2048M -numa node,nodeid=1,memdev=mem1, -numa cpu,node-id=1,socket-id=1 -numa node,nodeid=2, -object memory-backend-file,id=nvmem0,share,mem-path=nvdimm-0,size=16384M,align=1G -device nvdimm,memdev=nvmem0,id=nv0,label-size=2M,node=2 -numa node,nodeid=3, -object memory-backend-file,id=nvmem1,share,mem-path=nvdimm-1,size=16384M,align=1G -device nvdimm,memdev=nvmem1,id=nv1,label-size=2M,node=3 Cc: Jingqi Liu <jingqi.liu@intel.com> Cc: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jingqi Liu <jingqi.liu@intel.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Vishal Verma <vishal.l.verma@intel.com> Message-Id: <20200606000911.9896-3-vishal.l.verma@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-06-09msix: allow qword MSI-X table accessesMichael S. Tsirkin
PCI spec says: For all accesses to MSI-X Table and MSI-X PBA fields, software must use aligned full DWORD or aligned full QWORD transactions; otherwise, the result is undefined. However, since MSI-X was converted to use memory API, QEMU started blocking qword transactions, only allowing DWORD ones. Guests do not seem to use QWORD accesses, but let's be spec compliant. Fixes: 95524ae8dc8f ("msix: convert to memory API") Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-06-08Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-5.1-pull-request' into staging linux-user pull request 20200605-v2 Implement F_OFD_ fcntl() command, /proc/cpuinfo for hppa Fix socket(), prnctl() error codes, underflow in target_mremap, epoll_create() strace, oldumount for alpha User-mode build dependencies improvement # gpg: Signature made Sat 06 Jun 2020 14:15:36 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-5.1-pull-request: stubs: Restrict ui/win32-kbd-hook to system-mode hw/core: Restrict CpuClass::get_crash_info() to system-mode target/s390x: Restrict CpuClass::get_crash_info() to system-mode target/i386: Restrict CpuClass::get_crash_info() to system-mode arch_init: Remove unused 'qapi-commands-misc.h' include exec: Assert CPU migration is not used on user-only build target/riscv/cpu: Restrict CPU migration to system-mode stubs/Makefile: Reduce the user-mode object list util/Makefile: Reduce the user-mode object list tests/Makefile: Restrict some softmmu-only tests tests/Makefile: Only display TCG-related tests when TCG is available configure: Avoid building TCG when not needed Makefile: Only build virtiofsd if system-mode is enabled linux-user: implement OFD locks linux-user/mmap.c: fix integer underflow in target_mremap linux-user/strace.list: fix epoll_create{,1} -strace output linux-user: Add support for /proc/cpuinfo on hppa platform linux-user: return target error codes for socket() and prctl() linux-user, alpha: fix oldumount syscall Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20200605' into staging target-arm queue: hw/ssi/imx_spi: Handle tx burst lengths other than 8 correctly hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask() hw/arm/pxa2xx: Replace printf() call by qemu_log_mask() target/arm: Convert crypto insns to gvec hw/adc/stm32f2xx_adc: Correct memory region size and access size tests/acceptance: Add a boot test for the xlnx-versal-virt machine docs/system: Document Aspeed boards raspi: Add model of the USB controller target/arm: Convert 2-reg-and-shift and 1-reg-imm Neon insns to decodetree # gpg: Signature made Fri 05 Jun 2020 17:48:39 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200605: (29 commits) target/arm: Convert Neon one-register-and-immediate insns to decodetree target/arm: Convert VCVT fixed-point ops to decodetree target/arm: Convert Neon VSHLL, VMOVL to decodetree target/arm: Convert Neon narrowing shifts with op==9 to decodetree target/arm: Convert Neon narrowing shifts with op==8 to decodetree target/arm: Convert VQSHLU, VQSHL 2-reg-shift insns to decodetree target/arm: Convert Neon VSRA, VSRI, VRSHR, VRSRA 2-reg-shift insns to decodetree target/arm: Convert Neon VSHR 2-reg-shift insns to decodetree target/arm: Convert Neon VSHL and VSLI 2-reg-shift insn to decodetree raspi2 acceptance test: add test for dwc-hsotg (dwc2) USB host wire in the dwc-hsotg (dwc2) USB host controller emulation usb: add short-packet handling to usb-storage driver dwc-hsotg (dwc2) USB host controller emulation dwc-hsotg (dwc2) USB host controller state definitions dwc-hsotg (dwc2) USB host controller register definitions raspi: add BCM2835 SOC MPHI emulation docs/system: Document Aspeed boards tests/acceptance: Add a boot test for the xlnx-versal-virt machine hw/adc/stm32f2xx_adc: Correct memory region size and access size target/arm: Split helper_crypto_sm3tt ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/core: Restrict CpuClass::get_crash_info() to system-modePhilippe Mathieu-Daudé
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Tested-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200522172510.25784-13-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-06-05Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200605' into stagingPeter Maydell
s390x update: - enhance s390x documentation - allow ORBs without prefetch specified for vfio-ccw - various cleanups and enhancements # gpg: Signature made Fri 05 Jun 2020 16:32:43 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [marginal] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [marginal] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20200605: target/s390x: Restrict system-mode declarations target/s390x/helper: Clean ifdef'ry target/s390x: Only compile decode_basedisp() on system-mode MAINTAINERS: add Thomas as additional s390x maintainer docs/s390x: document vfio-ccw vfio-ccw: allow non-prefetch ORBs docs/s390x: document 3270 docs/s390x: document the virtual css s390x: pv: Fix KVM_PV_PREP_RESET command wrapper name s390x/kvm: help valgrind in several places Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05wire in the dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman
Wire the dwc-hsotg (dwc2) emulation into Qemu Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Reviewed-by: Philippe Mathieu-Daude <f4bug@amsat.org> Message-id: 20200520235349.21215-7-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05usb: add short-packet handling to usb-storage driverPaul Zimmerman
The dwc-hsotg (dwc2) USB host depends on a short packet to indicate the end of an IN transfer. The usb-storage driver currently doesn't provide this, so fix it. I have tested this change rather extensively using a PC emulation with xhci, ehci, and uhci controllers, and have not observed any regressions. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-6-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman
Add the dwc-hsotg (dwc2) USB host controller emulation code. Based on hw/usb/hcd-ehci.c and hw/usb/hcd-ohci.c. Note that to use this with the dwc-otg driver in the Raspbian kernel, you must pass the option "dwc_otg.fiq_fsm_enable=0" on the kernel command line. Emulation of slave mode and of descriptor-DMA mode has not been implemented yet. These modes are seldom used. I have used some on-line sources of information while developing this emulation, including: http://www.capital-micro.com/PDF/CME-M7_Family_User_Guide_EN.pdf which has a pretty complete description of the controller starting on page 370. https://sourceforge.net/p/wive-ng/wive-ng-mt/ci/master/tree/docs/DataSheets/RT3050_5x_V2.0_081408_0902.pdf which has a description of the controller registers starting on page 130. Thanks to Felippe Mathieu-Daude for providing a cleaner method of implementing the memory regions for the controller registers. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-5-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller state definitionsPaul Zimmerman
Add the dwc-hsotg (dwc2) USB host controller state definitions. Mostly based on hw/usb/hcd-ehci.h. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-4-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05raspi: add BCM2835 SOC MPHI emulationPaul Zimmerman
Add BCM2835 SOC MPHI (Message-based Parallel Host Interface) emulation. It is very basic, only providing the FIQ interrupt needed to allow the dwc-otg USB host controller driver in the Raspbian kernel to function. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Acked-by: Philippe Mathieu-Daude <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200520235349.21215-2-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/adc/stm32f2xx_adc: Correct memory region size and access sizePhilippe Mathieu-Daudé
The ADC region size is 256B, split as: - [0x00 - 0x4f] defined - [0x50 - 0xff] reserved All registers are 32-bit (thus when the datasheet mentions the last defined register is 0x4c, it means its address range is 0x4c .. 0x4f. This model implementation is also 32-bit. Set MemoryRegionOps 'impl' fields. See: 'RM0033 Reference manual Rev 8', Table 10.13.18 "ADC register map". Reported-by: Seth Kintigh <skintigh@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200603055915.17678-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/arm/pxa2xx: Replace printf() call by qemu_log_mask()Philippe Mathieu-Daudé
Replace printf() calls by qemu_log_mask(), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200525114123.21317-3-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask() (missed in commit 5a0001ec7e). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200525114123.21317-2-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/ssi/imx_spi: Removed unnecessary cast of rx data received from slaveEden Mikitas
When inserting the value retrieved (rx) from the spi slave, rx is pushed to rx_fifo after being cast to uint8_t. rx_fifo is a fifo32, and the rx register the driver uses is also 32 bit. This zeroes the 24 most significant bits of rx. This proved problematic with devices that expect to use the whole 32 bits of the rx register. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/ssi/imx_spi: changed while statement to prevent underflowEden Mikitas
The while statement in question only checked if tx_burst is not 0. tx_burst is a signed int, which is assigned the value put by the guest driver in ECSPI_CONREG. The burst length can be anywhere between 1 and 4096, and since tx_burst is always decremented by 8 it could possibly underflow, causing an infinite loop. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05vfio-ccw: allow non-prefetch ORBsJared Rossi
Remove the explicit prefetch check when using vfio-ccw devices. This check does not trigger in practice as all Linux channel programs are intended to use prefetch. Newer Linux kernel versions do not require to force the PFCH flag with vfio-ccw devices anymore. Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Message-Id: <20200512181535.18630-2-jrossi@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05s390x: pv: Fix KVM_PV_PREP_RESET command wrapper nameJanosch Frank
s390_pv_perf_clear_reset() is not a very helpful name since that function needs to be called for a normal and a clear reset via diag308. Let's instead name it s390_pv_prep_reset() which reflects the purpose of the function a bit better. Signed-off-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20200505124159.24099-1-frankja@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-06-05Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200605-pull-request' ↵Peter Maydell
into staging vga: ati security fix, cirrus cleanup. # gpg: Signature made Fri 05 Jun 2020 12:27:13 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20200605-pull-request: hw/display/cirrus_vga: Fix code mis-indentation ati-vga: check mm_index before recursive call (CVE-2020-13800) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/block: Let the NVMe emulated device be target-agnosticPhilippe Mathieu-Daudé
Now than the non-target specific memory_region_msync() function is available, use it to make this device target-agnostic. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200508062456.23344-4-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05hw/display/cirrus_vga: Fix code mis-indentationPhilippe Mathieu-Daudé
While replacing fprintf() by qemu_log_mask() in commit 2b55f4d3504, we incorrectly used a 'tab = 4 spaces' alignment, leading to misindented new code. Fix now. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200529165436.23573-1-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-05ati-vga: check mm_index before recursive call (CVE-2020-13800)Prasad J Pandit
While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-03riscv: Initial commit of OpenTitan machineAlistair Francis
This adds a barebone OpenTitan machine to QEMU. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-14 19:42:40 +0000