summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* net: purge queued rx packets on queue deletionYuri Benditovich2020-11-241-4/+8
| | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=1829272 When deleting queue pair, purge pending RX packets if any. Example of problematic flow: 1. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e 2. Run ping flood to the VM NIC ( 1 ms interval) 3. Hot unplug the NIC device (device_del) During unplug process one or more packets come, the NIC can't receive, tap disables read_poll 4. Hot plug the device (device_add) with the same netdev The tap stays with read_poll disabled and does not receive any packets anymore (tap_send never triggered) Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* net: do not exit on "netdev_add help" monitor commandPaolo Bonzini2020-11-243-34/+41
| | | | | | | | | | | | | "netdev_add help" is causing QEMU to exit because the code that invokes show_netdevs is shared between CLI and HMP processing. Move the check to the callers so that exit(0) remains only in the CLI flow. "netdev_add help" is not fixed by this patch; that is left for later work. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* hw/net/e1000e: advance desc_offset in case of null descriptorPrasad J Pandit2020-11-241-4/+4
| | | | | | | | | | | | While receiving packets via e1000e_write_packet_to_guest() routine, 'desc_offset' is advanced only when RX descriptor is processed. And RX descriptor is not processed if it has NULL buffer address. This may lead to an infinite loop condition. Increament 'desc_offset' to process next descriptor in the ring to avoid infinite loop. Reported-by: Cheol-woo Myung <330cjfdn@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
* Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' ↵Peter Maydell2020-11-234-5/+15
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging VFIO update 2020-11-23 * Enable pre-copy dirty page tracking by default (Kirti Wankhede) * Mark migration as experimental (Alex Williamson) # gpg: Signature made Mon 23 Nov 2020 17:10:58 GMT # gpg: using RSA key 239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" [full] # gpg: aka "Alex Williamson <alex@shazbot.org>" [full] # gpg: aka "Alex Williamson <alwillia@redhat.com>" [full] # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" [full] # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-update-20201123.0: vfio: Change default dirty pages tracking behavior during migration vfio: Make migration support experimental Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * vfio: Change default dirty pages tracking behavior during migrationKirti Wankhede2020-11-233-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | By default dirty pages tracking is enabled during iterative phase (pre-copy phase). Added per device opt-out option 'x-pre-copy-dirty-page-tracking' to disable dirty pages tracking during iterative phase. If the option 'x-pre-copy-dirty-page-tracking=off' is set for any VFIO device, dirty pages tracking during iterative phase will be disabled. Signed-off-by: Kirti Wankhede <kwankhede@nvidia.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
| * vfio: Make migration support experimentalAlex Williamson2020-11-233-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support for migration of vfio devices is still in flux. Developers are attempting to add support for new devices and new architectures, but none are yet readily available for validation. We have concerns whether we're transferring device resources at the right point in the migration, whether we're guaranteeing that updates during pre-copy are migrated, and whether we can provide bit-stream compatibility should any of this change. Even the question of whether devices should participate in dirty page tracking during pre-copy seems contentious. In short, migration support has not had enough soak time and it feels premature to mark it as supported. Create an experimental option such that we can continue to develop. [Retaining previous acks/reviews for a previously identical code change with different specifics in the commit log.] Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2020-11-236-1/+13
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/huth-gitlab/tags/pull-request-2020-11-23' into staging * Two reboot fixes for the s390-ccw bios # gpg: Signature made Mon 23 Nov 2020 10:03:17 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2020-11-23: pc-bios/s390: Update the s390-ccw bios binaries pc-bios: s390x: Clear out leftover S390EP string pc-bios: s390x: Ensure Read IPL memory is clean Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | pc-bios/s390: Update the s390-ccw bios binariesThomas Huth2020-11-232-0/+0
| | | | | | | | | | | | | | | | | | Update the binaries with the two reboot fixes from Eric Farman. Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | pc-bios: s390x: Clear out leftover S390EP stringEric Farman2020-11-233-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A Linux binary will have the string "S390EP" at address 0x10008, which is important in getting the guest up off the ground. In the case of a reboot (specifically chreipl going to a new device), we should defer to the PSW at address zero for the new config, which will re-write "S390EP" from the new image. Let's clear it out at this point so that a reipl to, say, a DASD passthrough device drives the IPL path from scratch without disrupting disrupting the order of operations for other boots. Rather than hardcoding the address of this magic (again), let's define it somewhere so that the two users are visibly related. Signed-off-by: Eric Farman <farman@linux.ibm.com> Message-Id: <20201120160117.59366-3-farman@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | pc-bios: s390x: Ensure Read IPL memory is cleanEric Farman2020-11-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If, for example, we boot off a virtio device and chreipl to a vfio-ccw device, the space at lowcore will be non-zero. We build a Read IPL CCW at address zero, but it will have leftover PSW data that will conflict with the Format-0 CCW being generated: 0x0: 00080000 80010000 ------ Ccw0.cda -- Ccw0.chainData -- Reserved bits The data address will be overwritten with the correct value (0x0), but the apparent data chain bit will cause subsequent memory to be used as the target of the data store, which may not be where we expect (0x0). Clear out this space when we boot from DASD, so that we know it exists exactly as we expect. Signed-off-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@de.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20201120160117.59366-2-farman@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | | Merge remote-tracking branch ↵Peter Maydell2020-11-2326-147/+326
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20201123' into staging target-arm queue: * incorporate 'orphan' rST docs into manuals * linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpoints * target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0 * document raspi boards and tosa * docs/system: Deprecate raspi2/raspi3 machine aliases * docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs * MAINTAINERS: add lines for docs files for Arm boards * hw/intc: fix heap-buffer-overflow in rxicu_realize() * hw/arm: Fix bad print format specifiers * target/arm: fix stage 2 page-walks in 32-bit emulation # gpg: Signature made Mon 23 Nov 2020 11:42:02 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20201123: (24 commits) docs/system/pr-manager.rst: Fix minor docs nits docs: Split qemu-pr-helper documentation into tools manual docs: Move pr-manager.rst into the system manual docs: Move microvm.rst into the system manual docs: Split out 'pc' machine model docs into their own file docs/system/virtio-pmem.rst: Fix minor style issues docs: Move virtio-pmem.rst into the system manual docs: Move cpu-hotplug.rst into the system manual docs: Move virtio-net-failover.rst into the system manual linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpoints target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0 docs/system/arm: Document the Sharp Zaurus SL-6000 docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs docs/system/arm: Document the various raspi boards docs/system: Deprecate raspi2/raspi3 machine aliases MAINTAINERS: Cover system/arm/sx1.rst with OMAP machines MAINTAINERS: Cover system/arm/sbsa.rst with SBSA-REF machine MAINTAINERS: Fix system/arm/orangepi.rst path MAINTAINERS: Cover system/arm/nuvoton.rst with Nuvoton NPCM7xx MAINTAINERS: Cover system/arm/aspeed.rst with ASPEED BMC machines ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | docs/system/pr-manager.rst: Fix minor docs nitsPeter Maydell2020-11-231-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a couple of nits in pr-manager.rst: * the title marker for the top level heading is overlength * stray capital 'R' in the middle of a sentence Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | docs: Split qemu-pr-helper documentation into tools manualPeter Maydell2020-11-235-33/+99
| | | | | | | | | | | | | | | | | | | | | | | | Split the documentation of the qemu-pr-helper binary into the tools manual, and give it a manpage like our other standalone executables. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | docs: Move pr-manager.rst into the system manualPeter Maydell2020-11-232-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Move the pr-manager documentation into the system manual. Some of it (the documentation of the pr-manager-helper tool) should be in tools, but we will split it up after moving it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | docs: Move microvm.rst into the system manualPeter Maydell2020-11-232-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Now that target-i386.rst has a place to list documentation of machines other than the 'pc' machine, we have a place we can move the microvm documentation to. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | docs: Split out 'pc' machine model docs into their own filePeter Maydell2020-11-232-5/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently target-i386.rst includes the documentation of the 'pc' machine model inline. Split it out into its own file, in a similar way to target-i386.rst; this gives us a place to put documentation of other i386 machine models, such as 'microvm'. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | docs/system/virtio-pmem.rst: Fix minor style issuesPeter Maydell2020-11-231-30/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The virtio-pmem documentation has some minor style issues we hadn't noticed since we weren't rendering it in our docs: * Sphinx doesn't complain about overlong title-underlining the way it complains about too-short underlining, but it looks odd; make the underlines of section headers the right length * Indent of paragraphs makes them render as blockquotes; remove the indent so they just render as normal text * Leading 'o' isn't rst markup, so it just renders as a literal "o"; reformat as a subsection heading instead * "QEMU" in the document title and section headings are a bit odd and unnecessary since this is the QEMU manual; delete or rephrase them * There's no need to specify what QEMU version the device first appeared in. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Pankaj Gupta <pankaj.gupta@cloud.ionos.com>
| * | docs: Move virtio-pmem.rst into the system manualPeter Maydell2020-11-232-0/+1
| | | | | | | | | | | | | | | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | docs: Move cpu-hotplug.rst into the system manualPeter Maydell2020-11-232-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | The cpu-hotplug.rst documentation is currently orphan and not included in any manual; move it into the system manual. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | docs: Move virtio-net-failover.rst into the system manualPeter Maydell2020-11-232-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The virtio-net-failover documentation is currently orphan and not included in any manual; move it into the system manual, immediately following the general network emulation section. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
| * | linux-user/arm: Deliver SIGTRAP for UDF patterns used as breakpointsPeter Maydell2020-11-231-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Linux kernel doesn't use the official bkpt insn for breakpoints; instead it uses three instructions in the guaranteed-to-UNDEF space, and generates SIGTRAP for these rather than the SIGILL that most UNDEF insns generate: https://elixir.bootlin.com/linux/v5.9.8/source/arch/arm/kernel/ptrace.c#L197 Make QEMU treat these insns specially too. The main benefit of this is that if you're running a debugger on a guest program that runs into a GCC __builtin_trap() or LLVM "trap because execution should never reach here" then you'll get the expected signal rather than a SIGILL. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201117155634.6924-1-peter.maydell@linaro.org
| * | target/arm: Make SYS_HEAPINFO work with RAM that doesn't start at 0Peter Maydell2020-11-231-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The semihosting SYS_HEAPINFO call is supposed to return an array of four guest addresses: * base of heap memory * limit of heap memory * base of stack memory * limit of stack memory Some semihosting programs (including those compiled to use the 'newlib' embedded C library) use this call to work out where they should initialize themselves to. QEMU's implementation when in system emulation mode is very simplistic: we say that the heap starts halfway into RAM and continues to the end of RAM, and the stack starts at the top of RAM and works down to the bottom. Unfortunately the code assumes that the base address of RAM is at address 0, so on boards like 'virt' where this is not true the addresses returned will all be wrong and the guest application will usually crash. Conveniently since all Arm boards call arm_load_kernel() we have the base address of the main RAM block in the arm_boot_info struct which is accessible via the CPU object. Use this to return sensible values from SYS_HEAPINFO. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20201119092346.32356-1-peter.maydell@linaro.org
| * | docs/system/arm: Document the Sharp Zaurus SL-6000Philippe Mathieu-Daudé2020-11-231-7/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | List the 'tosa' machine with the XScale-based PDAs models. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120173953.2539469-5-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDsPhilippe Mathieu-Daudé2020-11-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Document the 3 front LEDs modeled on the OpenPOWER Witherspoon BMC (see commit 7cfbde5ea1c "hw/arm/aspeed: Add the 3 front LEDs drived by the PCA9552 #1"). Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120173953.2539469-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | docs/system/arm: Document the various raspi boardsPhilippe Mathieu-Daudé2020-11-233-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Document the following Raspberry Pi models: - raspi0 Raspberry Pi Zero (revision 1.2) - raspi1ap Raspberry Pi A+ (revision 1.1) - raspi2b Raspberry Pi 2B (revision 1.1) - raspi3ap Raspberry Pi 3A+ (revision 1.0) - raspi3b Raspberry Pi 3B (revision 1.2) Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120173953.2539469-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | docs/system: Deprecate raspi2/raspi3 machine aliasesPhilippe Mathieu-Daudé2020-11-231-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit aa35ec2213b ("hw/arm/raspi: Use more specific machine names") the raspi2/raspi3 machines have been renamed as raspi2b/raspi3b. Note, rather than the raspi3b, the raspi3ap introduced in commit 5be94252d34 ("hw/arm/raspi: Add the Raspberry Pi 3 model A+") is a closer match to what QEMU models, but only provides 512 MB of RAM. As more Raspberry Pi 2/3 models are emulated, in order to avoid confusion, deprecate the raspi2/raspi3 machine aliases. ACKed-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120173953.2539469-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | MAINTAINERS: Cover system/arm/sx1.rst with OMAP machinesPhilippe Mathieu-Daudé2020-11-231-0/+1
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120154545.2504625-7-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | MAINTAINERS: Cover system/arm/sbsa.rst with SBSA-REF machinePhilippe Mathieu-Daudé2020-11-231-0/+1
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120154545.2504625-6-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | MAINTAINERS: Fix system/arm/orangepi.rst pathPhilippe Mathieu-Daudé2020-11-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: 0553ef42571 ("docs: add Orange Pi PC document") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-id: 20201120154545.2504625-5-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | MAINTAINERS: Cover system/arm/nuvoton.rst with Nuvoton NPCM7xxPhilippe Mathieu-Daudé2020-11-231-0/+1
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120154545.2504625-4-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | MAINTAINERS: Cover system/arm/aspeed.rst with ASPEED BMC machinesPhilippe Mathieu-Daudé2020-11-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 20201120154545.2504625-3-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | MAINTAINERS: Cover system/arm/cpu-features.rst with ARM TCG CPUsPhilippe Mathieu-Daudé2020-11-231-0/+1
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201120154545.2504625-2-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/intc: fix heap-buffer-overflow in rxicu_realize()Chen Qun2020-11-231-10/+8Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When 'j = icu->nr_sense – 1', the 'j < icu->nr_sense' condition is true, then 'j = icu->nr_sense', the'icu->init_sense[j]' has out-of-bounds access. The asan showed stack: ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000004d7d at pc 0x55852cd26a76 bp 0x7ffe39f26200 sp 0x7ffe39f261f0 READ of size 1 at 0x604000004d7d thread T0 #0 0x55852cd26a75 in rxicu_realize ../hw/intc/rx_icu.c:311 #1 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886 #2 0x55852cd4a32f in property_set_bool ../qom/object.c:2251 #3 0x55852cd4f9bb in object_property_set ../qom/object.c:1398 #4 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28 #5 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465 #6 0x55852cbf0b27 in register_icu ../hw/rx/rx62n.c:156 #7 0x55852cbf12a6 in rx62n_realize ../hw/rx/rx62n.c:261 #8 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886 #9 0x55852cd4a32f in property_set_bool ../qom/object.c:2251 #10 0x55852cd4f9bb in object_property_set ../qom/object.c:1398 #11 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28 #12 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465 #13 0x55852cbf1a85 in rx_gdbsim_init ../hw/rx/rx-gdbsim.c:109 #14 0x55852cd22de0 in qemu_init ../softmmu/vl.c:4380 #15 0x55852ca57088 in main ../softmmu/main.c:49 #16 0x7feefafa5d42 in __libc_start_main (/lib64/libc.so.6+0x26d42) Add the 'ice->src[i].sense' initialize to the default value, and then process init_sense array to identify which irqs should be level-triggered. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20201111141733.2358800-1-kuhn.chenqun@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm: Fix bad print format specifiersAlexChen2020-11-233-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We should use printf format specifier "%u" instead of "%i" for argument of type "unsigned int". Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Alex Chen <alex.chen@huawei.com> Message-id: 5F9FD78B.8000300@huawei.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/arm: fix stage 2 page-walks in 32-bit emulationRémi Denis-Courmont2020-11-231-2/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | Using a target unsigned long would limit the Input Address to a LPAE page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay for stage 1 or on AArch64, but it is insufficient for stage 2 on AArch32. In that later case, the Input Address can have up to 40 bits. Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201118150414.18360-1-remi@remlab.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge remote-tracking branch ↵Peter Maydell2020-11-238-134/+195
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request for 5.2 NVMe fixes to solve IOMMU issues on non-x86 and error message/tracing improvements. Elena Afanasova's ioeventfd fixes are also included. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> # gpg: Signature made Wed 04 Nov 2020 15:18:16 GMT # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: (33 commits) util/vfio-helpers: Assert offset is aligned to page size util/vfio-helpers: Convert vfio_dump_mapping to trace events util/vfio-helpers: Improve DMA trace events util/vfio-helpers: Trace where BARs are mapped util/vfio-helpers: Trace PCI BAR region info util/vfio-helpers: Trace PCI I/O config accesses util/vfio-helpers: Improve reporting unsupported IOMMU type block/nvme: Fix nvme_submit_command() on big-endian host block/nvme: Fix use of write-only doorbells page on Aarch64 arch block/nvme: Align iov's va and size on host page size block/nvme: Change size and alignment of prp_list_pages block/nvme: Change size and alignment of queue block/nvme: Change size and alignment of IDENTIFY response buffer block/nvme: Correct minimum device page size block/nvme: Set request_alignment at initialization block/nvme: Simplify nvme_cmd_sync() block/nvme: Simplify ADMIN queue access block/nvme: Correctly initialize Admin Queue Attributes block/nvme: Use definitions instead of magic values in add_io_queue() block/nvme: Introduce Completion Queue definitions ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | util/vfio-helpers: Assert offset is aligned to page sizePhilippe Mathieu-Daudé2020-11-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mmap(2) states: 'offset' must be a multiple of the page size as returned by sysconf(_SC_PAGE_SIZE). Add an assertion to be sure we don't break this contract. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201103020733.2303148-8-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | util/vfio-helpers: Convert vfio_dump_mapping to trace eventsPhilippe Mathieu-Daudé2020-11-032-15/+5Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The QEMU_VFIO_DEBUG definition is only modifiable at build-time. Trace events can be enabled at run-time. As we prefer the latter, convert qemu_vfio_dump_mappings() to use trace events instead of fprintf(). Reviewed-by: Fam Zheng <fam@euphon.net> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201103020733.2303148-7-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | util/vfio-helpers: Improve DMA trace eventsPhilippe Mathieu-Daudé2020-11-032-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For debugging purpose, trace where DMA regions are mapped. Reviewed-by: Fam Zheng <fam@euphon.net> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201103020733.2303148-6-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | util/vfio-helpers: Trace where BARs are mappedPhilippe Mathieu-Daudé2020-11-032-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For debugging purpose, trace where a BAR is mapped. Reviewed-by: Fam Zheng <fam@euphon.net> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201103020733.2303148-5-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | util/vfio-helpers: Trace PCI BAR region infoPhilippe Mathieu-Daudé2020-11-032-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For debug purpose, trace BAR regions info. Reviewed-by: Fam Zheng <fam@euphon.net> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201103020733.2303148-4-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | util/vfio-helpers: Trace PCI I/O config accessesPhilippe Mathieu-Daudé2020-11-032-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We sometime get kernel panic with some devices on Aarch64 hosts. Alex Williamson suggests it might be broken PCIe root complex. Add trace event to record the latest I/O access before crashing. In case, assert our accesses are aligned. Reviewed-by: Fam Zheng <fam@euphon.net> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201103020733.2303148-3-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | util/vfio-helpers: Improve reporting unsupported IOMMU typePhilippe Mathieu-Daudé2020-11-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change the confuse "VFIO IOMMU check failed" error message by the explicit "VFIO IOMMU Type1 is not supported" once. Example on POWER: $ qemu-system-ppc64 -drive if=none,id=nvme0,file=nvme://0001:01:00.0/1,format=raw qemu-system-ppc64: -drive if=none,id=nvme0,file=nvme://0001:01:00.0/1,format=raw: VFIO IOMMU Type1 is not supported Suggested-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Fam Zheng <fam@euphon.net> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201103020733.2303148-2-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | block/nvme: Fix nvme_submit_command() on big-endian hostPhilippe Mathieu-Daudé2020-11-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Completion Queue Command Identifier is a 16-bit value, so nvme_submit_command() is unlikely to work on big-endian hosts, as the relevant bits are truncated. Fix by using the correct byte-swap function. Fixes: bdd6a90a9e5 ("block: Add VFIO based NVMe driver") Reported-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20201029093306.1063879-25-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | block/nvme: Fix use of write-only doorbells page on Aarch64 archPhilippe Mathieu-Daudé2020-11-031-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qemu_vfio_pci_map_bar() calls mmap(), and mmap(2) states: 'offset' must be a multiple of the page size as returned by sysconf(_SC_PAGE_SIZE). In commit f68453237b9 we started to use an offset of 4K which broke this contract on Aarch64 arch. Fix by mapping at offset 0, and and accessing doorbells at offset=4K. Fixes: f68453237b9 ("block/nvme: Map doorbells pages write-only") Reported-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201029093306.1063879-24-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | block/nvme: Align iov's va and size on host page sizeEric Auger2020-11-031-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure iov's va and size are properly aligned on the host page size. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201029093306.1063879-23-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | block/nvme: Change size and alignment of prp_list_pagesEric Auger2020-11-031-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation of 64kB host page support, let's change the size and alignment of the prp_list_pages so that the VFIO DMA MAP succeeds with 64kB host page size. We align on the host page size. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201029093306.1063879-22-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | block/nvme: Change size and alignment of queueEric Auger2020-11-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation of 64kB host page support, let's change the size and alignment of the queue so that the VFIO DMA MAP succeeds. We align on the host page size. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201029093306.1063879-21-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | block/nvme: Change size and alignment of IDENTIFY response bufferEric Auger2020-11-031-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation of 64kB host page support, let's change the size and alignment of the IDENTIFY command response buffer so that the VFIO DMA MAP succeeds. We align on the host page size. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201029093306.1063879-20-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
| * | block/nvme: Correct minimum device page sizePhilippe Mathieu-Daudé2020-11-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While trying to simplify the code using a macro, we forgot the 12-bit shift... Correct that. Fixes: fad1eb68862 ("block/nvme: Use register definitions from 'block/nvme.h'") Reported-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201029093306.1063879-19-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-09 09:36:52 +0100