summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'remotes/kraxel/tags/usb-20210528-pull-request' ↵Peter Maydell2021-05-305-11/+20
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging usb: bugfixes for hid and xhci. # gpg: Signature made Fri 28 May 2021 15:21:51 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20210528-pull-request: hw/usb: hcd-xhci-pci: Fix spec violation of IP flag for MSI/MSI-X hw/usb: hcd-xhci-pci: Raise MSI/MSI-X interrupts only when told to hw/input/hid: Add support for keys of jp106 keyboard. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/usb: hcd-xhci-pci: Fix spec violation of IP flag for MSI/MSI-XRuimei Yan2021-05-284-7/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per xHCI spec v1.2 chapter 4.17.5 page 296: If MSI or MSI-X interrupts are enabled, Interrupt Pending (IP) shall be cleared automatically when the PCI dword write generated by the interrupt assertion is complete. Currently QEMU does not clear the IP flag in the MSI / MSI-X mode. This causes subsequent spurious interrupt to be delivered to guests. To solve this, we change the xhci intr_raise() hook routine to have a bool return value that is passed to its caller (the xhci core), with true indicating that IP should be self-cleared. Fixes: 62c6ae04cf43 ("xhci: Initial xHCI implementation") Fixes: 4c47f800631a ("xhci: add msix support") Signed-off-by: Ruimei Yan <ruimei.yan@windriver.com> [bmeng: move IP clear codes from xhci pci to xhci core] Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20210521024224.2277634-2-bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * hw/usb: hcd-xhci-pci: Raise MSI/MSI-X interrupts only when told toRuimei Yan2021-05-281-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At present MSI / MSI-X interrupts are triggered regardless of the irq level. We should have checked the level to determine whether the interrupt needs to be delivered. The level check logic was present in early versions of the xhci model, but got dropped later by a rework of interrupt handling under commit 4c4abe7cc903 ("xhci: rework interrupt handling"). Fixes: 4c4abe7cc903 ("xhci: rework interrupt handling") Signed-off-by: Ruimei Yan <ruimei.yan@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20210521024224.2277634-1-bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * hw/input/hid: Add support for keys of jp106 keyboard.Katsuhiro Ueno2021-05-281-2/+2
| | | | | | | | | | | | | | | | | | | | Add support for the following keys: KATAKANAHIRAGANA, HENKAN, MUHENKAN, RO, and YEN. Before this commit, these keys did not work as expected when a jp106 keyboard was connected to the guest as a usb-kbd device. Signed-off-by: Katsuhiro Ueno <uenobk@gmail.com> Message-Id: <CA+pCdY3iG+pKKQqEVknnWF-W0wK36S4U1jxPvxmGAPp6FFvz1Q@mail.gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210527-pull-request' ↵Peter Maydell2021-05-3022-117/+799
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio-gpu: add blob resource support. vhost-user-gpu: security fixes. # gpg: Signature made Thu 27 May 2021 15:23:25 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20210527-pull-request: (23 commits) virtio-gpu: Update cursor data using blob virtio-gpu: Add virtio_gpu_set_scanout_blob virtio-gpu: Factor out update scanout virtio-gpu: Add helpers to create and destroy dmabuf objects ui/pixman: Add qemu_pixman_to_drm_format() virtio-gpu: Add virtio_gpu_resource_create_blob virtio-gpu: Add initial definitions for blob resources virtio-gpu: Refactor virtio_gpu_create_mapping_iov virtio-gpu: Refactor virtio_gpu_set_scanout virtio-gpu: Add virtio_gpu_find_check_resource stubs: Add stubs for udmabuf helpers virtio-gpu: Add udmabuf helpers headers: Add udmabuf.h ui: Get the fd associated with udmabuf driver hw/display/qxl: Set pci rom address aligned with page size vhost-user-gpu: abstract vg_cleanup_mapping_iov vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544) vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | virtio-gpu: Update cursor data using blobVivek Kasireddy2021-05-271-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a blob is available for the cursor, copy the data from the blob. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-15-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add virtio_gpu_set_scanout_blobVivek Kasireddy2021-05-273-7/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This API allows Qemu to set the blob allocated by the Guest as the scanout buffer. If Opengl support is available, then the scanout buffer would be submitted as a dmabuf to the UI; if not, a pixman image is created from the scanout buffer and is submitted to the UI via the display surface. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-14-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Factor out update scanoutVivek Kasireddy2021-05-271-12/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Creating a small helper function for updating the scanout will be useful in the next patch where this needs to be done early in do_set_scanout before returning. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-13-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add helpers to create and destroy dmabuf objectsVivek Kasireddy2021-05-273-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These helpers can be useful for creating dmabuf objects from blobs and submitting them to the UI. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-12-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | ui/pixman: Add qemu_pixman_to_drm_format()Vivek Kasireddy2021-05-272-11/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new function to get the drm_format associated with a pixman format will be useful while creating a dmabuf. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-11-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add virtio_gpu_resource_create_blobVivek Kasireddy2021-05-273-3/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This API allows Qemu to register the blob allocated by the Guest as a new resource and map its backing storage. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-10-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add initial definitions for blob resourcesVivek Kasireddy2021-05-273-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the property bit, configuration flag and other relevant macros and definitions associated with this feature. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-9-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Refactor virtio_gpu_create_mapping_iovVivek Kasireddy2021-05-273-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of passing the attach_backing object to extract nr_entries and offset, explicitly pass these as arguments to this function. This will be helpful when adding create_blob API. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-8-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Refactor virtio_gpu_set_scanoutVivek Kasireddy2021-05-272-64/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Store the meta-data associated with a FB in a new object (struct virtio_gpu_framebuffer) and pass the object to set_scanout. Also move code in set_scanout into a do_set_scanout function. This will be helpful when adding set_scanout_blob API. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-7-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add virtio_gpu_find_check_resourceVivek Kasireddy2021-05-271-19/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move finding the resource and validating its backing storage into one function. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-6-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | stubs: Add stubs for udmabuf helpersVivek Kasireddy2021-05-273-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is needed to ensure that virtio-gpu device works for non-linux builds. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-5-vivek.kasireddy@intel.com> [ kraxel: add virtio-gpu-udmabuf.c stubs only when building system emulation ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-gpu: Add udmabuf helpersVivek Kasireddy2021-05-273-0/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add helper functions to create a dmabuf for a resource and mmap it. Also, introduce the fields blob and blob_size so that these helpers can start to use them but the full picture will emerge only after adding create_blob API in patch 8 of this series. To be able to create a dmabuf using the udmabuf driver, Qemu needs to be lauched with the memfd memory backend like this: qemu-system-x86_64 -m 8192m -object memory-backend-memfd,id=mem1,size=8192M -machine memory-backend=mem1 Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-4-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | headers: Add udmabuf.hVivek Kasireddy2021-05-272-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds udmabuf header to standard headers so that the relevant udmabuf objects can be accessed in subsequent patches. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-3-vivek.kasireddy@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | ui: Get the fd associated with udmabuf driverVivek Kasireddy2021-05-273-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Try to open the udmabuf dev node for the first time or return the fd if the device was previously opened. Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20210526231429.1045476-2-vivek.kasireddy@intel.com> [ kraxel: fixup fcntl.h include ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | hw/display/qxl: Set pci rom address aligned with page sizemaobibo2021-05-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On some MIPS system, page size is 16K, and qxl vga device can be used for VM in kvm mode. Qxl pci rom size is set 8K fixed, smaller than 16K page size on host system, it fails to be added into memslots in kvm mode where memory_size and GPA are required to align with page size. This patch fixes this issue. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Message-Id: <1621340448-31617-1-git-send-email-maobibo@loongson.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: abstract vg_cleanup_mapping_iovLi Qiang2021-05-273-9/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently in vhost-user-gpu, we free resource directly in the cleanup case of resource. If we change the cleanup logic we need to change several places, also abstruct a 'vg_create_mapping_iov' can be symmetry with the 'vg_create_mapping_iov'. This is like what virtio-gpu does, no function changed. Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-9-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)Li Qiang2021-05-271-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If 'virgl_cmd_get_capset' set 'max_size' to 0, the 'virgl_renderer_fill_caps' will write the data after the 'resp'. This patch avoid this by checking the returned 'max_size'. virtio-gpu fix: abd7f08b23 ("display: virtio-gpu-3d: check virgl capabilities max_size") Fixes: CVE-2021-3546 Reported-by: Li Qiang <liq3ea@163.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-8-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' ↵Li Qiang2021-05-271-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2021-3544) If 'virgl_renderer_resource_attach_iov' failed, the 'res_iovs' will be leaked. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 33243031da ("virtio-gpu-3d: fix memory leak in resource attach backing") Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-7-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)Li Qiang2021-05-271-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'res->iov' will be leaked if the guest trigger following sequences: virgl_cmd_create_resource_2d virgl_resource_attach_backing virgl_cmd_resource_unref This patch fixes this. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c75 ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref" Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-6-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' ↵Li Qiang2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2021-3544) If the guest trigger following sequences, the attach_backing will be leaked: vg_resource_create_2d vg_resource_attach_backing vg_resource_unref This patch fix this by freeing 'res->iov' in vg_resource_destroy. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c75 ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref") Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-5-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544)Li Qiang2021-05-271-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check whether the 'res' has already been attach_backing to avoid memory leak. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 204f01b309 ("virtio-gpu: fix memory leak in resource attach backing") Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-4-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544)Li Qiang2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Call 'vugbm_buffer_destroy' in error path to avoid resource leak. Fixes: CVE-2021-3544 Reported-by: Li Qiang <liq3ea@163.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-3-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info ↵Li Qiang2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (CVE-2021-3545) Otherwise some of the 'resp' will be leaked to guest. Fixes: CVE-2021-3545 Reported-by: Li Qiang <liq3ea@163.com> virtio-gpu fix: 42a8dadc74 ("virtio-gpu: fix information leak in getting capset info dispatch") Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-2-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | | Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2021-05-284-13/+6Star
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging # gpg: Signature made Thu 27 May 2021 04:06:17 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap-bsd: Remove special casing for older OpenBSD releases virtio-net: failover: add missing remove_migration_state_change_notifier() hw/net/imx_fec: return 0xffff when accessing non-existing PHY Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | tap-bsd: Remove special casing for older OpenBSD releasesBrad Smith2021-05-271-8/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenBSD added support for tap(4) 10 releases ago. Remove the special casing for older releases. Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | virtio-net: failover: add missing remove_migration_state_change_notifier()Laurent Vivier2021-05-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the failover case configuration, virtio_net_device_realize() uses an add_migration_state_change_notifier() to add a state notifier, but this notifier is not removed by the unrealize function when the virtio-net card is unplugged. If the card is unplugged and a migration is started, the notifier is called and as it is not valid anymore QEMU crashes. This patch fixes the problem by adding the remove_migration_state_change_notifier() in virtio_net_device_unrealize(). The problem can be reproduced with: $ qemu-system-x86_64 -enable-kvm -m 1g -M q35 \ -device pcie-root-port,slot=4,id=root1 \ -device pcie-root-port,slot=5,id=root2 \ -device virtio-net-pci,id=net1,mac=52:54:00:6f:55:cc,failover=on,bus=root1 \ -monitor stdio disk.qcow2 (qemu) device_del net1 (qemu) migrate "exec:gzip -c > STATEFILE.gz" Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in () #1 0x0000555555d726d7 in notifier_list_notify (...) at .../util/notify.c:39 #2 0x0000555555842c1a in migrate_fd_connect (...) at .../migration/migration.c:3975 #3 0x0000555555950f7d in migration_channel_connect (...) error@entry=0x0) at .../migration/channel.c:107 #4 0x0000555555910922 in exec_start_outgoing_migration (...) at .../migration/exec.c:42 Reported-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * | | hw/net/imx_fec: return 0xffff when accessing non-existing PHYGuenter Roeck2021-05-272-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a PHY does not exist, attempts to read from it should return 0xffff. Otherwise the Linux kernel will believe that a PHY is there and select the non-existing PHY. This in turn will result in network errors later on since the real PHY is not selected or configured. Since reading from or writing to a non-existing PHY is not an emulation error, replace guest error messages with traces. Fixes: 461c51ad4275 ("Add a phy-num property to the i.MX FEC emulator") Cc: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | | | Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210526' ↵Peter Maydell2021-05-2853-404/+600
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Adjust types for some memory access functions. Reduce inclusion of tcg headers. Fix watchpoints vs replay. Fix tcg/aarch64 roli expansion. Introduce SysemuCPUOps structure. # gpg: Signature made Thu 27 May 2021 00:43:54 BST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth-gitlab/tags/pull-tcg-20210526: (31 commits) hw/core: Constify TCGCPUOps target/mips: Fold jazz behaviour into mips_cpu_do_transaction_failed cpu: Move CPUClass::get_paging_enabled to SysemuCPUOps cpu: Move CPUClass::get_memory_mapping to SysemuCPUOps cpu: Move CPUClass::get_phys_page_debug to SysemuCPUOps cpu: Move CPUClass::asidx_from_attrs to SysemuCPUOps cpu: Move CPUClass::write_elf* to SysemuCPUOps cpu: Move CPUClass::get_crash_info to SysemuCPUOps cpu: Move CPUClass::virtio_is_big_endian to SysemuCPUOps cpu: Move CPUClass::vmsd to SysemuCPUOps cpu: Introduce SysemuCPUOps structure cpu: Move AVR target vmsd field from CPUClass to DeviceClass cpu: Rename CPUClass vmsd -> legacy_vmsd cpu: Assert DeviceClass::vmsd is NULL on user emulation cpu: Directly use get_memory_mapping() fallback handlers in place cpu: Directly use get_paging_enabled() fallback handlers in place cpu: Directly use cpu_write_elf*() fallback handlers in place cpu: Introduce cpu_virtio_is_big_endian() cpu: Un-inline cpu_get_phys_page_debug and cpu_asidx_from_attrs cpu: Split as cpu-common / cpu-sysemu ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | | hw/core: Constify TCGCPUOpsRichard Henderson2021-05-2722-23/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We no longer have any runtime modifications to this struct, so declare them all const. Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20210227232519.222663-3-richard.henderson@linaro.org>
| * | | | target/mips: Fold jazz behaviour into mips_cpu_do_transaction_failedRichard Henderson2021-05-273-33/+8Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a flag to MIPSCPUClass in order to avoid needing to replace mips_tcg_ops.do_transaction_failed. Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20210227232519.222663-2-richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::get_paging_enabled to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-274-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-23-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::get_memory_mapping to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-274-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-22-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::get_phys_page_debug to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-2722-30/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-21-f4bug@amsat.org> [rth: Drop declaration movement from target/*/cpu.h] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::asidx_from_attrs to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-275-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-20-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::write_elf* to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-278-38/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The write_elf*() handlers are used to dump vmcore images. This feature is only meaningful for system emulation. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-19-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::get_crash_info to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-275-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cpu_get_crash_info() is called on GUEST_PANICKED events, which only occur in system emulation. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-18-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::virtio_is_big_endian to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-275-11/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VirtIO devices are only meaningful with system emulation. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-17-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move CPUClass::vmsd to SysemuCPUOpsPhilippe Mathieu-Daudé2021-05-2712-25/+22Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Migration is specific to system emulation. - Move the CPUClass::vmsd field to SysemuCPUOps, - restrict VMSTATE_CPU() macro to sysemu, - vmstate_dummy is now unused, remove it. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-16-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Introduce SysemuCPUOps structurePhilippe Mathieu-Daudé2021-05-2722-0/+174
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a structure to hold handler specific to sysemu. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-15-f4bug@amsat.org> [rth: Squash "restrict hw/core/sysemu-cpu-ops.h" patch] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Move AVR target vmsd field from CPUClass to DeviceClassPhilippe Mathieu-Daudé2021-05-272-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | See rationale in previous commit. Targets should use the vmsd field of DeviceClass, not CPUClass. As migration is not important on the AVR target, break the migration compatibility and set the DeviceClass vmsd field. To feel safer, increment the vmstate version. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210517105140.1062037-14-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Rename CPUClass vmsd -> legacy_vmsdPhilippe Mathieu-Daudé2021-05-2710-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting Peter Maydell [*]: There are two ways to handle migration for a CPU object: (1) like any other device, so it has a dc->vmsd that covers migration for the whole object. As usual for objects that are a subclass of a parent that has state, the first entry in the VMStateDescription field list is VMSTATE_CPU(), which migrates the cpu_common fields, followed by whatever the CPU's own migration fields are. (2) a backwards-compatible mechanism for CPUs that were originally migrated using manual "write fields to the migration stream structures". The on-the-wire migration format for those is based on the 'env' pointer (which isn't a QOM object), and the cpu_common part of the migration data is elsewhere. cpu_exec_realizefn() handles both possibilities: * for type 1, dc->vmsd is set and cc->vmsd is not, so cpu_exec_realizefn() does nothing, and the standard "register dc->vmsd for a device" code does everything needed * for type 2, dc->vmsd is NULL and so we register the vmstate_cpu_common directly to handle the cpu-common fields, and the cc->vmsd to handle the per-CPU stuff You can't change a CPU from one type to the other without breaking migration compatibility, which is why some guest architectures are stuck on the cc->vmsd form. New targets should use dc->vmsd. To avoid new targets to start using type (2), rename cc->vmsd as cc->legacy_vmsd. The correct field to implement is dc->vmsd (the DeviceClass one). See also commit b170fce3dd0 ("cpu: Register VMStateDescription through CPUState") for historic background. [*] https://www.mail-archive.com/qemu-devel@nongnu.org/msg800849.html Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210517105140.1062037-13-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Assert DeviceClass::vmsd is NULL on user emulationPhilippe Mathieu-Daudé2021-05-273-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Migration is specific to system emulation. Restrict current DeviceClass::vmsd to sysemu using #ifdef'ry, and assert in cpu_exec_realizefn() that dc->vmsd not set under user emulation. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-12-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Directly use get_memory_mapping() fallback handlers in placePhilippe Mathieu-Daudé2021-05-272-16/+13Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No code uses CPUClass::get_memory_mapping() outside of hw/core/cpu.c: $ git grep -F -- '->get_memory_mapping' hw/core/cpu.c:87: cc->get_memory_mapping(cpu, list, errp); hw/core/cpu.c:439: k->get_memory_mapping = cpu_common_get_memory_mapping; target/i386/cpu.c:7422: cc->get_memory_mapping = x86_cpu_get_memory_mapping; Check the handler presence in place and remove the common fallback code. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-11-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Directly use get_paging_enabled() fallback handlers in placePhilippe Mathieu-Daudé2021-05-272-13/+11Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No code uses CPUClass::get_paging_enabled() outside of hw/core/cpu.c: $ git grep -F -- '->get_paging_enabled' hw/core/cpu.c:74: return cc->get_paging_enabled(cpu); hw/core/cpu.c:438: k->get_paging_enabled = cpu_common_get_paging_enabled; target/i386/cpu.c:7418: cc->get_paging_enabled = x86_cpu_get_paging_enabled; Check the handler presence in place and remove the common fallback code. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-10-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | | cpu: Directly use cpu_write_elf*() fallback handlers in placePhilippe Mathieu-Daudé2021-05-272-63/+44Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No code directly accesses CPUClass::write_elf*() handlers out of hw/core/cpu.c (the rest are assignation in target/ code): $ git grep -F -- '->write_elf' hw/core/cpu.c:157: return (*cc->write_elf32_qemunote)(f, cpu, opaque); hw/core/cpu.c:171: return (*cc->write_elf32_note)(f, cpu, cpuid, opaque); hw/core/cpu.c:186: return (*cc->write_elf64_qemunote)(f, cpu, opaque); hw/core/cpu.c:200: return (*cc->write_elf64_note)(f, cpu, cpuid, opaque); hw/core/cpu.c:440: k->write_elf32_qemunote = cpu_common_write_elf32_qemunote; hw/core/cpu.c:441: k->write_elf32_note = cpu_common_write_elf32_note; hw/core/cpu.c:442: k->write_elf64_qemunote = cpu_common_write_elf64_qemunote; hw/core/cpu.c:443: k->write_elf64_note = cpu_common_write_elf64_note; target/arm/cpu.c:2304: cc->write_elf64_note = arm_cpu_write_elf64_note; target/arm/cpu.c:2305: cc->write_elf32_note = arm_cpu_write_elf32_note; target/i386/cpu.c:7425: cc->write_elf64_note = x86_cpu_write_elf64_note; target/i386/cpu.c:7426: cc->write_elf64_qemunote = x86_cpu_write_elf64_qemunote; target/i386/cpu.c:7427: cc->write_elf32_note = x86_cpu_write_elf32_note; target/i386/cpu.c:7428: cc->write_elf32_qemunote = x86_cpu_write_elf32_qemunote; target/ppc/translate_init.c.inc:10891: cc->write_elf64_note = ppc64_cpu_write_elf64_note; target/ppc/translate_init.c.inc:10892: cc->write_elf32_note = ppc32_cpu_write_elf32_note; target/s390x/cpu.c:522: cc->write_elf64_note = s390_cpu_write_elf64_note; Check the handler presence in place and remove the common fallback code. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210517105140.1062037-9-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-06-16 03:49:46 +0200