summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* hw/isa/piix4: QOM'ify PCI device creation and wiringBernhard Beschow2022-06-111-8/+22
| | | | | | | | | | | | PCI interrupt wiring and device creation were performed in create() functions which are obsolete. Move these tasks into QOM functions to modernize the code. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220603185045.143789-5-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/isa/piix4: Move pci_map_irq_fn' near pci_set_irq_fnBernhard Beschow2022-06-111-25/+25
| | | | | | | | | | | The pci_map_irq_fn was implemented below type_init() which made it inaccessible to QOM functions. So move it up. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220603185045.143789-4-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/isa/piix4: Use object_initialize_child() for embedded structBernhard Beschow2022-06-111-1/+1
| | | | | | | | | Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220603185045.143789-3-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/southbridge/piix: Aggregate all PIIX southbridge type namesBernhard Beschow2022-06-113-5/+4Star
| | | | | | | | | | | TYPE_PIIX3_PCI_DEVICE resides there as already, so add the remaining ones, too. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220603185045.143789-2-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: remove unused piix4_pm_initfn() functionMark Cave-Ayland2022-06-112-23/+0Star
| | | | | | | | | | This function is now unused and so can be completely removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-13-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/isa/piix4.c: create PIIX4_PM device directly instead of using ↵Mark Cave-Ayland2022-06-111-4/+7
| | | | | | | | | | | | | piix4_pm_initfn() Now that all external logic has been removed from piix4_pm_initfn() the PIIX4_PM device can be instantiated directly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-12-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/i386/pc_piix: create PIIX4_PM device directly instead of using ↵Mark Cave-Ayland2022-06-111-3/+8
| | | | | | | | | | | | | piix4_pm_initfn() Now that all external logic has been removed from piix4_pm_initfn() the PIIX4_PM device can be instantiated directly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-11-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: use qdev gpio to wire up smi_irqMark Cave-Ayland2022-06-114-5/+6
| | | | | | | | | | | | | | Initialize the SMI IRQ in piix4_pm_init(). The smi_irq can now be wired up directly using a qdev gpio instead of having to set the IRQ externally in piix4_pm_initfn(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-10-mark.cave-ayland@ilande.co.uk> [PMD: Partially squash 20220528091934.15520-8-mark.cave-ayland@ilande.co.uk] Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: use qdev gpio to wire up sci_irqMark Cave-Ayland2022-06-114-10/+15
| | | | | | | | | | | | | | | Introduce piix4_pm_init() instance init function and use it to initialise the separate qdev gpio for the SCI IRQ. The sci_irq can now be wired up directly using a qdev gpio instead of having to set the IRQ externally in piix4_pm_initfn(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-9-mark.cave-ayland@ilande.co.uk> [PMD: Partially squash 20220528091934.15520-8-mark.cave-ayland@ilande.co.uk] Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: rename piix4_pm_init() to piix4_pm_initfn()Mark Cave-Ayland2022-06-114-12/+12
| | | | | | | | | | | | | | When QOMifying a device it is typical to use _init() as the suffix for an instance_init function, however this name is already in use by the legacy piix4_pm_init() wrapper function. Eventually the wrapper function will be removed, but for now rename it to piix4_pm_initfn() to avoid a naming collision. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-7-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: alter piix4_pm_init() to return PIIX4PMStateMark Cave-Ayland2022-06-114-18/+18
| | | | | | | | | | | This exposes the PIIX4_PM device to the caller to allow any qdev gpios to be mapped outside of piix4_pm_init(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-6-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: move PIIX4PMState into separate piix4.h headerMark Cave-Ayland2022-06-114-43/+78
| | | | | | | | | | | This allows the QOM types in hw/acpi/piix4.c to be used elsewhere by simply including hw/acpi/piix4.h. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220528091934.15520-5-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: convert smm_enabled bool to qdev propertyMark Cave-Ayland2022-06-111-1/+2
| | | | | | | | | | | | This allows the smm_enabled value to be set using a standard qdev property instead of being referenced directly in piix4_pm_init(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Ani Sinha <ani@anisinha.ca> Message-Id: <20220528091934.15520-4-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: change smm_enabled from int to boolMark Cave-Ayland2022-06-112-3/+3
| | | | | | | | | | | | This is in preparation for conversion to a qdev property. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Ani Sinha <ani@anisinha.ca> Message-Id: <20220528091934.15520-3-mark.cave-ayland@ilande.co.uk> [PMD: Change simm_enabled from int to bool, suggested by Ani Sinha] Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/acpi/piix4: move xen_enabled() logic from piix4_pm_init() to ↵Mark Cave-Ayland2022-06-111-3/+4
| | | | | | | | | | | | | | piix4_pm_realize() This logic can be included as part of piix4_pm_realize() and does not need to be handled externally. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Ani Sinha <ani@anisinha.ca> Message-Id: <20220528091934.15520-2-mark.cave-ayland@ilande.co.uk> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* hw/block/fdc-sysbus: Always mark sysbus floppy controllers as not having DMAPeter Maydell2022-06-113-8/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sysbus floppy controllers (devices sysbus-fdc and sun-fdtwo) don't support DMA. The core floppy controller code expects this to be indicated by setting FDCtrl::dma_chann to -1. This used to be done in the device instance_init functions sysbus_fdc_initfn() and sun4m_fdc_initfn(), but in commit 1430759ec3e we refactored this code and accidentally lost the setting of dma_chann. For sysbus-fdc this has no ill effects because we were redundantly also setting dma_chann in fdctrl_init_sysbus(), but for sun-fdtwo this means that guests which try to enable DMA on the floppy controller will cause QEMU to crash because FDCtrl::dma is NULL. Set dma_chann to -1 in the common instance init, and remove the redundant code in fdctrl_init_sysbus() that is also setting it. There is a six-year-old FIXME comment in the jazz board code to the effect that in theory it should support doing DMA via a custom DMA controller. If anybody ever chooses to fix that they can do it by adding support for setting both FDCtrl::dma_chann and FDCtrl::dma. (A QOM link property 'dma-controller' on the sysbus device which can be set to an instance of IsaDmaClass is probably the way to go.) Fixes: 1430759ec3 ("hw/block/fdc: Extract SysBus floppy controllers to fdc-sysbus.c") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/958 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220505101842.2757905-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Undeprecate nanoMIPS ISA support in QEMUStefan Pejic2022-06-112-31/+2Star
| | | | | | | | | | | | | nanoMIPS ISA support in QEMU is actively used by MediaTek and is planned to be maintained and potentially extended by MediaTek in future. Un-orphan nanoMIPS ISA support in QEMU by setting a maintainer from MediaTek and remove deprecation notes from documentation as well. Signed-off-by: Stefan Pejic <stefan.pejic@syrmia.com> Message-Id: <20220504110403.613168-8-stefan.pejic@syrmia.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Add missing default cases for some nanoMIPS poolsStefan Pejic2022-06-111-0/+19
| | | | | | | | | | | | | | | Switch statements for the code segments that handle nanoMIPS instruction pools P.LL, P.SC, P.SHIFT, P.LS.S1, P.LS.E0, PP.LSXS do not have proper default case, resulting in not generating reserved instruction exception for certain illegal opcodes. Fix this by adding default cases for these switch statements that trigger reserved instruction exception. Signed-off-by: Stefan Pejic <stefan.pejic@syrmia.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220504110403.613168-7-stefan.pejic@syrmia.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix handling of unaligned memory access for nanoMIPS ISADragan Mladjenovic2022-06-111-2/+3
| | | | | | | | | | | nanoMIPS ISA does not support unaligned memory access. Adjust DisasContext's default_tcg_memop_mask to reflect this. Signed-off-by: Dragan Mladjenovic <dragan.mladjenovic@syrmia.com> Signed-off-by: Stefan Pejic <stefan.pejic@syrmia.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220504110403.613168-6-stefan.pejic@syrmia.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix emulation of nanoMIPS BNEC[32] instructionDragan Mladjenovic2022-06-111-1/+6
| | | | | | | | | | | | | If both rs and rt are the same register, the nanoMIPS instruction BNEC[32] rs, rt, address is equivalent to NOP (branch is not taken and there is no delay slot). This commit provides such behavior. Without this commit, this scenario results in an incorrect behavior. Signed-off-by: Dragan Mladjenovic <dragan.mladjenovic@syrmia.com> Signed-off-by: Stefan Pejic <stefan.pejic@syrmia.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220504110403.613168-5-stefan.pejic@syrmia.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix emulation of nanoMIPS BPOSGE32C instructionDragan Mladjenovic2022-06-112-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are currently two problems related to the emulation of the instruction BPOSGE32C. The nanoMIPS instruction BPOSGE32C belongs to DSP R3 instructions (actually, as of now, it is the only instruction of DSP R3). The presence of DSP R3 instructions in QEMU is indicated by the flag MIPS_HFLAG_DSP_R3 (0x20000000). This flag is currently being properly set in CPUMIPSState's hflags (for example, for I7200 nanoMIPS CPU). However, it is not propagated to DisasContext's hflags, since the flag MIPS_HFLAG_DSP_R3 is not set in MIPS_HFLAG_TMASK (while similar flags MIPS_HFLAG_DSP_R2 and MIPS_HFLAG_DSP are set in this mask, and there is no problem in functioning check_dsp_r2(), check_dsp()). This means the function check_dsp_r3() currently does not work properly, and the emulation of BPOSGE32C can not work properly as well. Change MIPS_HFLAG_TMASK from 0x1F5807FF to 0x3F5807FF (logical OR with 0x20000000) to fix this. Additionally, check_cp1_enabled() is currently incorrectly called while emulating BPOSGE32C. BPOSGE32C is in the same pool (P.BR1) as FPU branch instruction BC1EQZC and BC1NEZC, but it not a part of FPU (CP1) instructions, and check_cp1_enabled() should not be involved while emulating BPOSGE32C. Rearrange invocations of check_cp1_enabled() within P.BR1 pool handling to affect only BC1EQZC and BC1NEZC emulation, and not BPOSGE32C emulation. Signed-off-by: Dragan Mladjenovic <dragan.mladjenovic@syrmia.com> Signed-off-by: Stefan Pejic <stefan.pejic@syrmia.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220504110403.613168-4-stefan.pejic@syrmia.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix emulation of nanoMIPS EXTRV_S.H instructionDragan Mladjenovic2022-06-111-1/+1
| | | | | | | | | | | | | | | | | | | The field rs in the instruction EXTRV_S.H rt, ac, rs is specified in nanoMIPS documentation as opcode[20..16]. It is, however, erroneously considered as opcode[25..21] in the current QEMU implementation. In function gen_pool32axf_2_nanomips_insn(), the variable v0_t corresponds to rt/opcode[25..21], and v1_t corresponds to rs/opcode[20..16]), and v0_t is by mistake passed to the helper gen_helper_extr_s_h(). Use v1_t rather than v0_t in the invocation of gen_helper_extr_s_h() to fix this. Signed-off-by: Dragan Mladjenovic <dragan.mladjenovic@syrmia.com> Signed-off-by: Stefan Pejic <stefan.pejic@syrmia.com> Fixes: 8b3698b294 ("target/mips: Add emulation of DSP ASE for nanoMIPS") Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220504110403.613168-3-stefan.pejic@syrmia.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix emulation of nanoMIPS MTHLIP instructionStefan Pejic2022-06-111-1/+1
| | | | | | | | | | | | | The field ac in nanoMIPS instruction MTHLIP rs, ac is specified in nanoMIPS documentation as opcode[15..14] (2 bits). However, in the current QEMU code, the corresponding argument passed to the helper gen_helper_mthlip() has the value of opcode[15..11] (5 bits). Right shift the value of this argument by three bits to fix this. Signed-off-by: Stefan Pejic <stefan.pejic@syrmia.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220504110403.613168-2-stefan.pejic@syrmia.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix FTRUNC_S and FTRUNC_U trans helperNi Hui2022-06-111-2/+2
| | | | | | | | | | | Fix the FTRUNC_S and FTRUNC_U trans helper problem. Fixes: 5c5b64000c ("target/mips: Convert MSA 2RF instruction format to decodetree") Signed-off-by: nihui <shuizhuyuanluo@126.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220503144241.289239-1-shuizhuyuanluo@126.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix store adress of high 64bit in helper_msa_st_b()Ni Hui2022-06-111-1/+1
| | | | | | | | | | | | This patch fix the issue that helper_msa_st_b() write high 64bit data to where the low 64bit resides, leaving high 64bit undefined. Fixes: 68ad9260e0 ("target/mips: Use 8-byte memory ops for msa load/store") Signed-off-by: Ni Hui <shuizhuyuanluo@126.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220504023319.12923-1-shuizhuyuanluo@126.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Do not treat msa INSERT as NOP when wd is zeroNi Hui2022-06-111-5/+10
| | | | | | | | | | | | Only for msa COPY_U/COPY_S with wd zero, we treat it as NOP. Move this special rule into COPY_U and COPY_S trans function. Fixes: 97fe675519 ("target/mips: Convert MSA COPY_S and INSERT opcodes to decodetree") Signed-off-by: Ni Hui <shuizhuyuanluo@126.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220503130708.272850-4-shuizhuyuanluo@126.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix msa checking condition in trans_msa_elm_fn()Ni Hui2022-06-111-1/+1
| | | | | | | | | | | | | Fix issue that condition of check_msa_enabled(ctx) is reversed that causes segfault when msa elm_fn op encountered. Fixes: 2f2745c81a ("target/mips: Convert MSA COPY_U opcode to decodetree") Fixes: 97fe675519 ("target/mips: Convert MSA COPY_S and INSERT opcodes to decodetree") Signed-off-by: Ni Hui <shuizhuyuanluo@126.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220503130708.272850-3-shuizhuyuanluo@126.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix df_extract_val() and df_extract_df() dfe lookupNi Hui2022-06-111-3/+3
| | | | | | | | | | | | Actually look into dfe structure data so that df_extract_val() and df_extract_df() can return immediate and datafield other than BYTE. Fixes: 4701d23aef ("target/mips: Convert MSA BIT instruction format to decodetree") Signed-off-by: Ni Hui <shuizhuyuanluo@126.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220503130708.272850-2-shuizhuyuanluo@126.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix SAT_S trans helperNi Hui2022-06-111-1/+1
| | | | | | | | | | | Fix the SAT_S and SAT_U trans helper confusion. Fixes: 4701d23aef ("target/mips: Convert MSA BIT instruction format to decodetree") Signed-off-by: Ni Hui <shuizhuyuanluo@126.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220503130708.272850-1-shuizhuyuanluo@126.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* target/mips: Fix WatchHi.M handlingMarcin Nowakowski2022-06-113-2/+4
| | | | | | | | | | | | | bit 31 (M) of WatchHiN register is a read-only register indicating whether the next WatchHi register is present. It must not be reset during user writes to the register. Signed-off-by: Marcin Nowakowski <marcin.nowakowski@fungible.com> Reviewed-by: David Daney <david.daney@fungible.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@fungible.com> Message-Id: <20220511212953.74738-1-philmd@fungible.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* Merge tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson2022-06-1188-473/+708
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pc,pci: fixes,cleanups,features more CXL patches VIOT Igor's huge AML rework fixes, cleanups all over the place Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmKj4YcPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpkNcIAKTsMfUVueTjelC2RwIdegQkypycKhCweKzc # QxddaEr0w+N2164byT3IUy9h53hV3qAAmMuGE4d8B2r5rykf+SwDfIeNmHNqntnA # oLraXIxSSAf4/1cTsRCVL/BXo2E9P+WHI3huw37HClmPLdyMjQa1AtpTpKnIsbmO # sBZf7t5yHDJ2WGZwBQ1IbAxvsdGo1fa1TCt1jZ9g1dmnQSTteQG8DHkGoRnkwTi7 # 510jb0e8uQEgKytCdLTHqESHlfgjvoI73OFOAR2dzTKy6KelFmdLYSo2FtsIdtT5 # 1fZNaDjtl6zQ4b2iLBgPpHtikKch9BzzhDMbCsq7FpvasZ8u2FE= # =LXG0 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 10 Jun 2022 05:27:51 PM PDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (53 commits) hw/vhost-user-scsi|blk: set `supports_config` flag correctly hw/virtio/vhost-user: don't use uninitialized variable tests/acpi: virt: update golden masters for VIOT hw/acpi/viot: sort VIOT ACPI table entries by PCI host bridge min_bus tests/acpi: virt: allow VIOT acpi table changes hw/acpi/viot: build array of PCI host bridges before generating VIOT ACPI table hw/acpi/viot: move the individual PCI host bridge entry generation to a new function hw/acpi/viot: rename build_pci_range_node() to enumerate_pci_host_bridges() hw/cxl: Fix missing write mask for HDM decoder target list registers pci: fix overflow in snprintf string formatting hw/machine: Drop cxl_supported flag as no longer useful hw/cxl: Move the CXLState from MachineState to machine type specific state. tests/acpi: Update q35/CEDT.cxl for new memory addresses. pci/pci_expander_bridge: For CXL HB delay the HB register memory region setup. tests/acpi: Allow modification of q35 CXL CEDT table. hw/cxl: Push linking of CXL targets into i386/pc rather than in machine.c hw/acpi/cxl: Pass in the CXLState directly rather than MachineState hw/cxl: Make the CXL fixed memory window setup a machine parameter. x86: acpi-build: do not include hw/isa/isa.h directly tests: acpi: update expected DSDT.tis.tpm2/DSDT.tis.tpm12 blobs ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/vhost-user-scsi|blk: set `supports_config` flag correctlyChangpeng Liu2022-06-102-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently vhost-user-scsi driver doesn't allow to change the configuration space of virtio_scsi, while vhost-user-blk support that, so here we set the flag in vhost-user-blk driver and unset it in vhost-user-scsi. Signed-off-by: Changpeng Liu <changpeng.liu@intel.com> Message-Id: <20220525125540.50979-2-changpeng.liu@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Changpeng Liu <changpeng.liu@intel.com> Signed-off-by: Changpeng Liu <changpeng.liu@intel.com>
| * hw/virtio/vhost-user: don't use uninitialized variableChangpeng Liu2022-06-101-5/+3Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Variable `vdev` in `struct vhost_dev` will not be ready until start the device, so let's not use it for the error output here. Fixes: 5653493 ("hw/virtio/vhost-user: don't suppress F_CONFIG when supported") Signed-off-by: Changpeng Liu <changpeng.liu@intel.com> Message-Id: <20220525125540.50979-1-changpeng.liu@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes: 5653493 ("hw/virtio/vhost-user: don't suppress F_CONFIG when supported") Signed-off-by: Changpeng Liu <changpeng.liu@intel.com> Fixes: 5653493 ("hw/virtio/vhost-user: don't suppress F_CONFIG when supported") Signed-off-by: Changpeng Liu <changpeng.liu@intel.com>
| * tests/acpi: virt: update golden masters for VIOTMark Cave-Ayland2022-06-102-1/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Differences between disassembled ASL files for VIOT: +++ /tmp/asl-V69GM1.dsl 2022-05-18 10:22:27.239796759 +0100 @@ -36,11 +36,11 @@ [041h 0065 1] Reserved : 00 [042h 0066 2] Length : 0018 -[044h 0068 4] Endpoint start : 00003000 +[044h 0068 4] Endpoint start : 00001000 [048h 0072 2] PCI Segment start : 0000 [04Ah 0074 2] PCI Segment end : 0000 -[04Ch 0076 2] PCI BDF start : 3000 -[04Eh 0078 2] PCI BDF end : 30FF +[04Ch 0076 2] PCI BDF start : 1000 +[04Eh 0078 2] PCI BDF end : 10FF [050h 0080 2] Output node : 0030 [052h 0082 6] Reserved : 000000000000 @@ -48,11 +48,11 @@ [059h 0089 1] Reserved : 00 [05Ah 0090 2] Length : 0018 -[05Ch 0092 4] Endpoint start : 00001000 +[05Ch 0092 4] Endpoint start : 00003000 [060h 0096 2] PCI Segment start : 0000 [062h 0098 2] PCI Segment end : 0000 -[064h 0100 2] PCI BDF start : 1000 -[066h 0102 2] PCI BDF end : 10FF +[064h 0100 2] PCI BDF start : 3000 +[066h 0102 2] PCI BDF end : 30FF [068h 0104 2] Output node : 0030 [06Ah 0106 6] Reserved : 000000000000 @@ -62,6 +62,6 @@ 0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43 // BXPC ....BXPC 0020: 01 00 00 00 03 00 30 00 00 00 00 00 00 00 00 00 // ......0......... 0030: 03 00 10 00 00 00 10 00 00 00 00 00 00 00 00 00 // ................ - 0040: 01 00 18 00 00 30 00 00 00 00 00 00 00 30 FF 30 // .....0.......0.0 - 0050: 30 00 00 00 00 00 00 00 01 00 18 00 00 10 00 00 // 0............... - 0060: 00 00 00 00 00 10 FF 10 30 00 00 00 00 00 00 00 // ........0....... + 0040: 01 00 18 00 00 10 00 00 00 00 00 00 00 10 FF 10 // ................ + 0050: 30 00 00 00 00 00 00 00 01 00 18 00 00 30 00 00 // 0............0.. + 0060: 00 00 00 00 00 30 FF 30 30 00 00 00 00 00 00 00 // .....0.00....... Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220525173232.31429-7-mark.cave-ayland@ilande.co.uk> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/acpi/viot: sort VIOT ACPI table entries by PCI host bridge min_busMark Cave-Ayland2022-06-101-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | This ensures that the VIOT ACPI table output is always stable for a given PCI topology by ensuring that entries are ordered according to min_bus. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Ani Sinha <ani@anisinha.ca> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220525173232.31429-6-mark.cave-ayland@ilande.co.uk> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * tests/acpi: virt: allow VIOT acpi table changesMark Cave-Ayland2022-06-101-0/+1
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: Ani Sinha <ani@anisinha.ca> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220525173232.31429-5-mark.cave-ayland@ilande.co.uk> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/acpi/viot: build array of PCI host bridges before generating VIOT ACPI tableMark Cave-Ayland2022-06-101-18/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Perform the generation of the VIOT ACPI table in 2 separate passes: the first pass enumerates all of the PCI host bridges and adds the min_bus and max_bus information to an array. Once this is done the VIOT table header is generated using the size of the array to calculate the node count, which means it is no longer necessary to use a sub-array to hold the PCI host bridge range information along with viommu_off. Finally the PCI host bridge array is iterated again to add the required entries to the final VIOT ACPI table. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Ani Sinha <ani@anisinha.ca> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220525173232.31429-4-mark.cave-ayland@ilande.co.uk> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/acpi/viot: move the individual PCI host bridge entry generation to a new ↵Mark Cave-Ayland2022-06-101-21/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | function Instead of generating each table entry inline, move the individual PCI host bridge table entry generation to a separate build_pci_host_range() function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Ani Sinha <ani@anisinha.ca> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220525173232.31429-3-mark.cave-ayland@ilande.co.uk> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/acpi/viot: rename build_pci_range_node() to enumerate_pci_host_bridges()Mark Cave-Ayland2022-06-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This is in preparation for separating out the VIOT ACPI table build from the PCI host bridge numeration. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Ani Sinha <ani@anisinha.ca> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220525173232.31429-2-mark.cave-ayland@ilande.co.uk> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/cxl: Fix missing write mask for HDM decoder target list registersJonathan Cameron2022-06-101-2/+11
| | | | | | | | | | | | | | | | | | | | | | Without being able to write these registers, no interleaving is possible. More refined checks of HDM register state on commit to follow. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608130804.25795-1-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pci: fix overflow in snprintf string formattingClaudio Fontana2022-06-101-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the code in pcibus_get_fw_dev_path contained the potential for a stack buffer overflow of 1 byte, potentially writing to the stack an extra NUL byte. This overflow could happen if the PCI slot is >= 0x10000000, and the PCI function is >= 0x10000000, due to the size parameter of snprintf being incorrectly calculated in the call: if (PCI_FUNC(d->devfn)) snprintf(path + off, sizeof(path) + off, ",%x", PCI_FUNC(d->devfn)); since the off obtained from a previous call to snprintf is added instead of subtracted from the total available size of the buffer. Without the accurate size guard from snprintf, we end up writing in the worst case: name (32) + "@" (1) + SLOT (8) + "," (1) + FUNC (8) + term NUL (1) = 51 bytes In order to provide something more robust, replace all of the code in pcibus_get_fw_dev_path with a single call to g_strdup_printf, so there is no need to rely on manual calculations. Found by compiling QEMU with FORTIFY_SOURCE=3 as the error: *** buffer overflow detected ***: terminated Thread 1 "qemu-system-x86" received signal SIGABRT, Aborted. [Switching to Thread 0x7ffff642c380 (LWP 121307)] 0x00007ffff71ff55c in __pthread_kill_implementation () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff71ff55c in __pthread_kill_implementation () at /lib64/libc.so.6 #1 0x00007ffff71ac6f6 in raise () at /lib64/libc.so.6 #2 0x00007ffff7195814 in abort () at /lib64/libc.so.6 #3 0x00007ffff71f279e in __libc_message () at /lib64/libc.so.6 #4 0x00007ffff729767a in __fortify_fail () at /lib64/libc.so.6 #5 0x00007ffff7295c36 in () at /lib64/libc.so.6 #6 0x00007ffff72957f5 in __snprintf_chk () at /lib64/libc.so.6 #7 0x0000555555b1c1fd in pcibus_get_fw_dev_path () #8 0x0000555555f2bde4 in qdev_get_fw_dev_path_helper.constprop () #9 0x0000555555f2bd86 in qdev_get_fw_dev_path_helper.constprop () #10 0x00005555559a6e5d in get_boot_device_path () #11 0x00005555559a712c in get_boot_devices_list () #12 0x0000555555b1a3d0 in fw_cfg_machine_reset () #13 0x0000555555bf4c2d in pc_machine_reset () #14 0x0000555555c66988 in qemu_system_reset () #15 0x0000555555a6dff6 in qdev_machine_creation_done () #16 0x0000555555c79186 in qmp_x_exit_preconfig.part () #17 0x0000555555c7b459 in qemu_init () #18 0x0000555555960a29 in main () Found-by: Dario Faggioli <Dario Faggioli <dfaggioli@suse.com> Found-by: Martin Liška <martin.liska@suse.com> Cc: qemu-stable@nongnu.org Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20220531114707.18830-1-cfontana@suse.de> Reviewed-by: Ani Sinha <ani@anisinha.ca>
| * hw/machine: Drop cxl_supported flag as no longer usefulJonathan Cameron2022-06-102-2/+0Star
| | | | | | | | | | | | | | | | | | | | | | As all the CXL elements have moved to boards that support CXL, there is no need to maintain a top level flag. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608145440.26106-9-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/cxl: Move the CXLState from MachineState to machine type specific state.Jonathan Cameron2022-06-105-27/+21Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This removes the last of the CXL code from the MachineState where it is visible to all Machines to only those that support CXL (currently i386/pc) As i386/pc always support CXL now, stop allocating the state independently. Note the pxb register hookup code runs even if cxl=off in order to detect pxb_cxl host bridges and fail to start if any are present as they won't have the control registers available. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608145440.26106-8-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * tests/acpi: Update q35/CEDT.cxl for new memory addresses.Jonathan Cameron2022-06-102-1/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | The CEDT table includes addreses of host bridge registers. There are allocated in a different order due to the previous patch, so update to the table is needed. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608145440.26106-7-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pci/pci_expander_bridge: For CXL HB delay the HB register memory region setup.Jonathan Cameron2022-06-108-13/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As the CXLState will no long be accessible via MachineState at time of PXB_CXL realization, come back later from the machine specific code to fill in the missing memory region setup. Only at this stage is it possible to check if cxl=on, so that check is moved to this later point. Note that for multiple host bridges, the allocation order of the register spaces is changed. This will be reflected in ACPI CEDT. Stubs are added to handle case of CONFIG_PXB=n for machines that call these functions. The bus walking logic is common to all machines so add a utility function + stub to cxl-host*. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608145440.26106-6-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * tests/acpi: Allow modification of q35 CXL CEDT table.Jonathan Cameron2022-06-101-0/+1
| | | | | | | | | | | | | | | | | | | | Needed to allow memory address changes as a result of next patch. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608145440.26106-5-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/cxl: Push linking of CXL targets into i386/pc rather than in machine.cJonathan Cameron2022-06-106-10/+10
| | | | | | | | | | | | | | | | | | | | Whilst here take the oportunity to shorten the function name. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608145440.26106-4-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/acpi/cxl: Pass in the CXLState directly rather than MachineStateJonathan Cameron2022-06-103-9/+9
| | | | | | | | | | | | | | | | | | | | | | Refactoring step on path to moving all CXL state out of MachineState. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Message-Id: <20220608145440.26106-3-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/cxl: Make the CXL fixed memory window setup a machine parameter.Jonathan Cameron2022-06-1014-126/+150
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Paolo Bonzini requested this change to simplify the ongoing effort to allow machine setup entirely via RPC. Includes shortening the command line form cxl-fixed-memory-window to cxl-fmw as the command lines are extremely long even with this change. The json change is needed to ensure that there is a CXLFixedMemoryWindowOptionsList even though the actual element in the json is never used. Similar to existing SgxEpcProperties. Update qemu-options.hx to reflect that this is now a -machine parameter. The bulk of -M / -machine parameters are documented under machine, so use that in preference to M. Update cxl-test and bios-tables-test to reflect new parameters. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Message-Id: <20220608145440.26106-2-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * x86: acpi-build: do not include hw/isa/isa.h directlyIgor Mammedov2022-06-101-1/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | the last remaining dependency on ISA in acpi-build.c is iapc_boot_arch_8042() which pulls in in isa.h in its own header hw/input/i8042.h. Clean up not longer needed direct inclusion of isa.h in acpi-build.c Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20220608135340.3304695-36-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>