summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'pull-target-arm-20211115-1' of ↵Richard Henderson2021-11-166-59/+71
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * Support multiple redistributor regions for TCG GICv3 * Send RTC_CHANGE QMP event from pl031 # gpg: Signature made Mon 15 Nov 2021 07:53:40 PM CET # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] * tag 'pull-target-arm-20211115-1' of https://git.linaro.org/people/pmaydell/qemu-arm: hw/rtc/pl031: Send RTC_CHANGE QMP event hw/intc/arm_gicv3: Support multiple redistributor regions hw/intc/arm_gicv3: Set GICR_TYPER.Last correctly when nb_redist_regions > 1 hw/intc/arm_gicv3: Move checking of redist-region-count to arm_gicv3_common_realize Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/rtc/pl031: Send RTC_CHANGE QMP eventEric Auger2021-11-152-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PL031 currently is not able to report guest RTC change to the QMP monitor as opposed to mc146818 or spapr RTCs. This patch adds the call to qapi_event_send_rtc_change() when the Load Register is written. The value which is reported corresponds to the difference between the guest reference time and the reference time kept in softmmu/rtc.c. For instance adding 20s to the guest RTC value will report 20. Adding an extra 20s to the guest RTC value will report 20 + 20 = 40. The inclusion of qapi/qapi-types-misc-target.h in hw/rtl/pl031.c require to compile the PL031 with specific_ss.add() to avoid ./qapi/qapi-types-misc-target.h:18:13: error: attempt to use poisoned "TARGET_<ARCH>". Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210920122535.269988-1-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/intc/arm_gicv3: Support multiple redistributor regionsPeter Maydell2021-11-154-30/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our GICv3 QOM interface includes an array property redist-region-count which allows board models to specify that the registributor registers are not in a single contiguous range, but split into multiple pieces. We implemented this for KVM, but currently the TCG GICv3 model insists that there is only one region. You can see the limit being hit with a setup like: qemu-system-aarch64 -machine virt,gic-version=3 -smp 124 Add support for split regions to the TCG GICv3. To do this we switch from allocating a simple array of MemoryRegions to an array of GICv3RedistRegion structs so that we can use the GICv3RedistRegion as the opaque pointer in the MemoryRegion read/write callbacks. Each GICv3RedistRegion contains the MemoryRegion, a backpointer allowing the read/write callback to get hold of the GICv3State, and an index which allows us to calculate which CPU's redistributor is being accessed. Note that arm_gicv3_kvm always passes in NULL as the ops argument to gicv3_init_irqs_and_mmio(), so the only MemoryRegion read/write callbacks we need to update to handle this new scheme are the gicv3_redist_read/write functions used by the emulated GICv3. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/intc/arm_gicv3: Set GICR_TYPER.Last correctly when nb_redist_regions > 1Peter Maydell2021-11-151-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'Last' bit in the GICR_TYPER GICv3 redistributor register is supposed to be set to 1 if this is the last redistributor in a series of contiguous redistributor pages. Currently we set Last only for the redistributor for CPU (num_cpu - 1). This only works if there is a single redistributor region; if there are multiple redistributor regions then we need to set the Last bit for the last redistributor in each region. This doesn't cause any problems currently because only the KVM GICv3 supports multiple redistributor regions, and it ignores the value in GICv3State::gicr_typer. But we need to fix this before we can enable support for multiple regions in the emulated GICv3. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/intc/arm_gicv3: Move checking of redist-region-count to ↵Peter Maydell2021-11-153-23/+15Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | arm_gicv3_common_realize The GICv3 devices have an array property redist-region-count. Currently we check this for errors (bad values) in gicv3_init_irqs_and_mmio(), just before we use it. Move this error checking to the arm_gicv3_common_realize() function, where we sanity-check all of the other base-class properties. (This will always be before gicv3_init_irqs_and_mmio() is called, because that function is called in the subclass realize methods, after they have called the parent-class realize.) The motivation for this refactor is: * we would like to use the redist_region_count[] values in arm_gicv3_common_realize() in a subsequent patch, so we need to have already done the sanity-checking first * this removes the only use of the Error** argument to gicv3_init_irqs_and_mmio(), so we can remove some error-handling boilerplate Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* | Merge tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson2021-11-1512-54/+160
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging pci,pc,virtio: bugfixes pci power management fixes acpi hotplug fixes misc other fixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 15 Nov 2021 05:15:09 PM CET # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] * tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu: pcie: expire pending delete pcie: fast unplug when slot power is off pcie: factor out pcie_cap_slot_unplug() pcie: add power indicator blink check pcie: implement slot power control for pcie root ports pci: implement power state vdpa: Check for existence of opts.vhostdev vdpa: Replace qemu_open_old by qemu_open at virtio: use virtio accessor to access packed event virtio: use virtio accessor to access packed descriptor flags tests: bios-tables-test update expected blobs hw/i386/acpi-build: Deny control on PCIe Native Hot-plug in _OSC bios-tables-test: Allow changes in DSDT ACPI tables hw/acpi/ich9: Add compat prop to keep HPC bit set for 6.1 machine type pcie: rename 'native-hotplug' to 'x-native-hotplug' hw/mem/pc-dimm: Restrict NUMA-specific code to NUMA machines vhost: Fix last vq queue index of devices with no cvq vhost: Rename last_index to vq_index_end softmmu/qdev-monitor: fix use-after-free in qdev_set_id() net/vhost-vdpa: fix memory leak in vhost_vdpa_get_max_queue_pairs() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * pcie: expire pending deleteGerd Hoffmann2021-11-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Add an expire time for pending delete, once the time is over allow pressing the attention button again. This makes pcie hotplug behave more like acpi hotplug, where one can try sending an 'device_del' monitor command again in case the guest didn't respond to the first attempt. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20211111130859.1171890-7-kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie: fast unplug when slot power is offGerd Hoffmann2021-11-151-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | In case the slot is powered off (and the power indicator turned off too) we can unplug right away, without round-trip to the guest. Also clear pending attention button press, there is nothing to care about any more. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20211111130859.1171890-6-kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie: factor out pcie_cap_slot_unplug()Gerd Hoffmann2021-11-151-12/+20
| | | | | | | | | | | | | | | | | | No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20211111130859.1171890-5-kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie: add power indicator blink checkGerd Hoffmann2021-11-151-0/+7
| | | | | | | | | | | | | | | | | | | | Refuse to push the attention button in case the guest is busy with some hotplug operation (as indicated by the power indicator blinking). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20211111130859.1171890-4-kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie: implement slot power control for pcie root portsGerd Hoffmann2021-11-151-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch hot-plugged pci devices will only be visible to the guest if the guests hotplug driver has enabled slot power. This should fix the hot-plug race which one can hit when hot-plugging a pci device at boot, while the guest is in the middle of the pci bus scan. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20211111130859.1171890-3-kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pci: implement power stateGerd Hoffmann2021-11-152-4/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows to power off pci devices. In "off" state the devices will not be visible. No pci config space access, no pci bar access, no dma. Default state is "on", so this patch (alone) should not change behavior. Use case: Allows hotplug controllers implement slot power. Hotplug controllers doing so should set the inital power state for devices in the ->plug callback. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20211111130859.1171890-2-kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio: use virtio accessor to access packed eventJason Wang2021-11-151-9/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to access packed descriptor event and off_wrap via address_space_{write|read}_cached(). When we hit the cache, memcpy() is used which is not atomic which may lead a wrong value to be read or wrote. This patch fixes this by switching to use virito_{stw|lduw}_phys_cached() to make sure the access is atomic. Fixes: 683f7665679c1 ("virtio: event suppression support for packed ring") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <20211111063854.29060-2-jasowang@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio: use virtio accessor to access packed descriptor flagsJason Wang2021-11-151-7/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to access packed descriptor flags via address_space_{write|read}_cached(). When we hit the cache, memcpy() is used which is not an atomic operation which may lead a wrong value is read or wrote. So this patch switches to use virito_{stw|lduw}_phys_cached() to make sure the aceess is atomic. Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <20211111063854.29060-1-jasowang@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/i386/acpi-build: Deny control on PCIe Native Hot-plug in _OSCJulia Suvorova2021-11-151-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two ways to enable ACPI PCI Hot-plug: * Disable the Hot-plug Capable bit on PCIe slots. This was the first approach which led to regression [1-2], as I/O space for a port is allocated only when it is hot-pluggable, which is determined by HPC bit. * Leave the HPC bit on and disable PCIe Native Hot-plug in _OSC method. This removes the (future) ability of hot-plugging switches with PCIe Native hotplug since ACPI PCI Hot-plug only works with cold-plugged bridges. If the user wants to explicitely use this feature, they can disable ACPI PCI Hot-plug with: --global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=off Change the bit in _OSC method so that the OS selects ACPI PCI Hot-plug instead of PCIe Native. [1] https://gitlab.com/qemu-project/qemu/-/issues/641 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2006409 Signed-off-by: Julia Suvorova <jusual@redhat.com> Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20211112110857.3116853-5-imammedo@redhat.com> Reviewed-by: Ani Sinha <ani@anisinha.ca> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/acpi/ich9: Add compat prop to keep HPC bit set for 6.1 machine typeJulia Suvorova2021-11-153-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To solve issues [1-2] the Hot Plug Capable bit in PCIe Slots will be turned on, while the switch to ACPI Hot-plug will be done in the DSDT table. Introducing 'x-keep-native-hpc' property disables the HPC bit only in 6.1 and as a result keeps the forced 'reserve-io' on pcie-root-ports in 6.1 too. [1] https://gitlab.com/qemu-project/qemu/-/issues/641 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2006409 Signed-off-by: Julia Suvorova <jusual@redhat.com> Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20211112110857.3116853-3-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie: rename 'native-hotplug' to 'x-native-hotplug'Igor Mammedov2021-11-152-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mark property as experimental/internal adding 'x-' prefix. Property was introduced in 6.1 and it should have provided ability to turn on native PCIE hotplug on port even when ACPI PCI hotplug is in use is user explicitly sets property on CLI. However that never worked since slot is wired to ACPI hotplug controller. Another non-intended usecase: disable native hotplug on slot when APCI based hotplug is disabled, which works but slot has 'hotplug' property for this taks. It should be relatively safe to rename it to experimental as no users should exist for it and given that the property is broken we don't really want to leave it around for much longer lest users start using it. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Ani Sinha <ani@anisinha.ca> Message-Id: <20211112110857.3116853-2-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/mem/pc-dimm: Restrict NUMA-specific code to NUMA machinesPhilippe Mathieu-Daudé2021-11-111-8/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to use the pc-dimm device on a non-NUMA machine, we get: $ qemu-system-arm -M none -cpu max -S \ -object memory-backend-file,id=mem1,size=1M,mem-path=/tmp/1m \ -device pc-dimm,id=dimm1,memdev=mem1 Segmentation fault (core dumped) (gdb) bt #0 pc_dimm_realize (dev=0x555556da3e90, errp=0x7fffffffcd10) at hw/mem/pc-dimm.c:184 #1 0x0000555555fe1f8f in device_set_realized (obj=0x555556da3e90, value=true, errp=0x7fffffffce18) at hw/core/qdev.c:531 #2 0x0000555555feb4a9 in property_set_bool (obj=0x555556da3e90, v=0x555556e54420, name=0x5555563c3c41 "realized", opaque=0x555556a704f0, errp=0x7fffffffce18) at qom/object.c:2257 To avoid that crash, restrict the pc-dimm NUMA check to machines supporting NUMA, and do not allow the use of 'node' property on non-NUMA machines. Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20211106145016.611332-1-f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost: Fix last vq queue index of devices with no cvqEugenio Pérez2021-11-111-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The -1 assumes that cvq device model is accounted in data_queue_pairs, if cvq does not exists, but it's actually the opposite: Devices with !cvq are ok but devices with cvq does not add the last queue to data_queue_pairs. This is not a problem to vhost-net, but it is to vhost-vdpa: * Devices with cvq gets initialized at last data vq device model, not at cvq one. * Devices with !cvq never gets initialized, since last_index is the first queue of the last device model. Because of that, the right change in last_index is to actually add the cvq, not to remove the missing one. This is not a problem to vhost-net, but it is to vhost-vdpa, which device model trust to reach the last index to finish starting the device. Also, as the previous commit, rename it to index_end. Tested with vp_vdpa with host's vhost=on and vhost=off, with ctrl_vq=on and ctrl_vq=off. Fixes: 049eb15b5fc9 ("vhost: record the last virtqueue index for the virtio device") Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Message-Id: <20211104085625.2054959-3-eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost: Rename last_index to vq_index_endEugenio Pérez2021-11-112-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The doc of this field pointed out that last_index is the last vq index. This is misleading, since it's actually one past the end of the vqs. Renaming and modifying comment. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Message-Id: <20211104085625.2054959-2-eperezma@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | Merge tag 'pull-ppc-20211112' of https://github.com/legoater/qemu into stagingRichard Henderson2021-11-121-31/+31
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ppc 6.2 queue : * Fix of a regression in floating point load instructions (Matheus) * Associativity fix for pseries machine (Daniel) * tlbivax fix for BookE machines (Danel) # gpg: Signature made Fri 12 Nov 2021 12:11:29 PM CET # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-ppc-20211112' of https://github.com/legoater/qemu: ppc/mmu_helper.c: do not truncate 'ea' in booke206_invalidate_ea_tlb() spapr_numa.c: fix FORM1 distance-less nodes target/ppc: Fix register update on lf[sd]u[x]/stf[sd]u[x] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | spapr_numa.c: fix FORM1 distance-less nodesDaniel Henrique Barboza2021-11-101-31/+31
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 71e6fae3a99 fixed an issue with FORM2 affinity guests with NUMA nodes in which the distance info is absent in machine_state->numa_state->nodes. This happens when QEMU adds a default NUMA node and when the user adds NUMA nodes without specifying the distances. During the discussions of the forementioned patch [1] it was found that FORM1 guests were behaving in a strange way in the same scenario, with the kernel seeing the distances between the nodes as '160', as we can see in this example with 4 NUMA nodes without distance information: $ numactl -H available: 4 nodes (0-3) (...) node distances: node 0 1 2 3 0: 10 160 160 160 1: 160 10 160 160 2: 160 160 10 160 3: 160 160 160 10 Turns out that we have the same problem with FORM1 guests - we are calculating associativity domain using zeroed values. And as it also turns out, the solution from 71e6fae3a99 applies to FORM1 as well. This patch creates a wrapper called 'get_numa_distance' that contains the logic used in FORM2 to define node distances when this information is absent. This helper is then used in all places where we need to read distance information from machine_state->numa_state->nodes. That way we'll guarantee that the NUMA node distance is always being curated before being used. After this patch, the FORM1 guest mentioned above will have the following topology: $ numactl -H available: 4 nodes (0-3) (...) node distances: node 0 1 2 3 0: 10 20 20 20 1: 20 10 20 20 2: 20 20 10 20 3: 20 20 20 10 This is compatible with what FORM2 guests and other archs do in this case. [1] https://lists.gnu.org/archive/html/qemu-devel/2021-11/msg01960.html Fixes: 690fbe4295d5 ("spapr_numa: consider user input when defining associativity") CC: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> CC: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
* | Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2021-11-113-0/+58
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fixes for SGX * force_rcu notifiers # gpg: Signature made Wed 10 Nov 2021 10:57:48 PM CET # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: sgx: Reset the vEPC regions during VM reboot numa: avoid crash with SGX and "info numa" accel/tcg: Register a force_rcu notifier rcu: Introduce force_rcu notifier target/i386: sgx: mark device not user creatable Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * sgx: Reset the vEPC regions during VM rebootYang Zhong2021-11-101-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For bare-metal SGX on real hardware, the hardware provides guarantees SGX state at reboot. For instance, all pages start out uninitialized. The vepc driver provides a similar guarantee today for freshly-opened vepc instances, but guests such as Windows expect all pages to be in uninitialized state on startup, including after every guest reboot. Qemu can invoke the ioctl to bring its vEPC pages back to uninitialized state. There is a possibility that some pages fail to be removed if they are SECS pages, and the child and SECS pages could be in separate vEPC regions. Therefore, the ioctl returns the number of EREMOVE failures, telling Qemu to try the ioctl again after it's done with all vEPC regions. The related kernel patches: Link: https://lkml.kernel.org/r/20211021201155.1523989-3-pbonzini@redhat.com Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20211101162009.62161-6-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * numa: avoid crash with SGX and "info numa"Paolo Bonzini2021-11-101-0/+7
| | | | | | | | | | | | | | | | | | Add the MEMORY_DEVICE_INFO_KIND_SGX_EPC case, so that enclave memory is included in the output of "info numa" instead of crashing the monitor. Fixes: a7c565a941 ("sgx-epc: Add the fill_device_info() callback support", 2021-09-30) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: sgx: mark device not user creatablePaolo Bonzini2021-11-091-0/+1
| | | | | | | | | | | | | | | | The device is created by the machine based on the sgx-epc property. It should not be created by users. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | macfb: fix a memory leak (CID 1465231)Laurent Vivier2021-11-091-7/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rewrite the function using g_string_append_printf() rather than g_strdup_printf()/g_strconcat(). Fixes: df8abbbadf74 ("macfb: add common monitor modes supported by the MacOS toolbox ROM") Cc: mark.cave-ayland@ilande.co.uk Reported-by: Peter Maydell <peter.maydell@linaro.org> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20211105165254.3544369-1-laurent@vivier.eu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* | Merge tag 'm68k-for-6.2-pull-request' of git://github.com/vivier/qemu-m68k ↵Richard Henderson2021-11-091-1/+15
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging m68k pull request 20211109 Add virt machine types for 6.1 and 6.2 # gpg: Signature made Tue 09 Nov 2021 12:14:39 PM CET # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] * tag 'm68k-for-6.2-pull-request' of git://github.com/vivier/qemu-m68k: hw: m68k: virt: Add compat machine for 6.2 hw: m68k: virt: Add compat machine for 6.1 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | hw: m68k: virt: Add compat machine for 6.2Laurent Vivier2021-11-091-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | Add the missing machine type for m68k/virt Signed-off-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20211106194158.4068596-3-laurent@vivier.eu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
| * | hw: m68k: virt: Add compat machine for 6.1Laurent Vivier2021-11-091-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add the missing machine type for m68k/virt Cc: qemu-stable@nongnu.org Signed-off-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20211106194158.4068596-2-laurent@vivier.eu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* | | hw/m68k: Fix typo in SPDX tagPhilippe Mathieu-Daudé2021-11-095-5/+5
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix 'Identifer' -> 'Identifier' typo. Cc: Laurent Vivier <laurent@vivier.eu> Fixes: 8c6df16ff60 ("hw/char: add goldfish-tty") Fixes: 87855593903 ("hw/intc: add goldfish-pic") Fixes: 2fde99ee312 ("m68k: add an interrupt controller") Fixes: 0791bc02b8f ("m68k: add a system controller") Fixes: e1cecdca559 ("m68k: add Virtual M68k Machine") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20211103105311.3399293-1-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* | spapr_numa.c: FORM2 table handle nodes with no distance infoNicholas Piggin2021-11-091-5/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A configuration that specifies multiple nodes without distance info results in the non-local points in the FORM2 matrix having a distance of 0. This causes Linux to complain "Invalid distance value range" because a node distance is smaller than the local distance. Fix this by building a simple local / remote fallback for points where distance information is missing. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20211105135137.1584840-1-npiggin@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | ppc/pegasos2: Suppress warning when qtest enabledBALATON Zoltan2021-11-091-1/+2
| | | | | | | | | | | | | | | | Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20211101151023.F0D02748F5A@zero.eik.bme.hu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | ppc/pnv: Fix check on block device before updating drive contentsCédric Le Goater2021-11-091-1/+1
|/ | | | | | | | | | | | Test is wrong and the backend can never updated. It could have led to a QEMU crash but since the firmware deactivates flash access if a valid layout is not detected, it went unnoticed. Reported-by: Coverity CID 1465223 Fixes: 35dde5766211 ("ppc/pnv: Add a PNOR model") Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20211102162905.762078-1-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commandsMauro Matteo Cascella2021-11-081-0/+6
| | | | | | | | | | | | | | This avoids an off-by-one read of 'mode_sense_valid' buffer in hw/scsi/scsi-disk.c:mode_sense_page(). Fixes: CVE-2021-3930 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: a8f4bbe2900 ("scsi-disk: store valid mode pages in a table") Fixes: #546 Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Merge remote-tracking branch 'remotes/kraxel/tags/egl-20211105-pull-request' ↵Richard Henderson2021-11-053-11/+18
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging gtk: a collection of egl fixes. # gpg: Signature made Fri 05 Nov 2021 07:30:21 AM EDT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] * remotes/kraxel/tags/egl-20211105-pull-request: ui/gtk-egl: blitting partial guest fb to the proper scanout surface ui/gtk: gd_draw_event returns FALSE when no cairo surface is bound ui/gtk-egl: guest fb texture needs to be regenerated when reinitializing egl ui/gtk-egl: make sure the right context is set as the current ui/gtk-egl: un-tab and re-tab should destroy egl surface and context virtio-gpu: splitting one extended mode guest fb into n-scanouts Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * virtio-gpu: splitting one extended mode guest fb into n-scanoutsDongwon Kim2021-11-053-11/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When guest is running Linux/X11 with extended multiple displays mode enabled, the guest shares one scanout resource each time containing whole surface rather than sharing individual display output separately. This extended frame is properly splited and rendered on the corresponding scanout surfaces but not in case of blob-resource (zero copy). This code change lets the qemu split this one large surface data into multiple in case of blob-resource as well so that each sub frame then can be blitted properly to each scanout. v2: resizing qemu console in virtio_gpu_update_dmabuf to scanout's width and height v3: updating stub function of virtio_gpu_update_dmabuf to match the type Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20211104065153.28897-5-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Fix virtio-net-pci* "vectors" compatEduardo Habkost2021-11-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hw_compat_5_2 has an issue: it affects only "virtio-net-pci" but not "virtio-net-pci-transitional" and "virtio-net-pci-non-transitional". The solution is to use the "virtio-net-pci-base" type in compat_props. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999141 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Jean-Louis Dupond <jean-louis@dupond.be> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Jean-Louis Dupond <jean-louis@dupond.be> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | e1000: fix tx re-entrancy problemJon Maloy2021-11-051-0/+7
|/ | | | | | | | | | | | | | | | | The fact that the MMIO handler is not re-entrant causes an infinite loop under certain conditions: Guest write to TDT -> Loopback -> RX (DMA to TDT) -> TX We now eliminate the effect of this problem locally in e1000, by adding a boolean in struct E1000State indicating when the TX side is busy. This will cause any entering new call to return early instead of interfering with the ongoing work, and eliminates any risk of looping. This is intended to address CVE-2021-20257. Signed-off-by: Jon Maloy <jmaloy@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingRichard Henderson2021-11-0316-41/+46
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Build system fixes and cleanups * DMA support in the multiboot option ROM * Rename default-bus-bypass-iommu * Deprecate -watchdog and cleanup -watchdog-action * HVF fix for <PAGE_SIZE regions * Support TSC scaling for AMD nested virtualization * Fix for ESP fuzzing bug # gpg: Signature made Tue 02 Nov 2021 10:57:37 AM EDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * remotes/bonzini/tags/for-upstream: (27 commits) configure: fix --audio-drv-list help message configure: Remove the check for the __thread keyword Move the l2tpv3 test from configure to meson.build meson: remove unnecessary coreaudio test program meson: remove pointless warnings meson.build: Allow to disable OSS again meson: bump submodule to 0.59.3 qtest/am53c974-test: add test for cancelling in-flight requests esp: ensure in-flight SCSI requests are always cancelled KVM: SVM: add migration support for nested TSC scaling hw/i386: fix vmmouse registration watchdog: remove select_watchdog_action vl: deprecate -watchdog watchdog: add information from -watchdog help to -device help hw/i386: Rename default_bus_bypass_iommu hvf: Avoid mapping regions < PAGE_SIZE as ram configure: do not duplicate CPU_CFLAGS into QEMU_LDFLAGS configure: remove useless NPTL probe target/i386: use DMA-enabled multiboot ROM for new-enough QEMU machine types optionrom: add a DMA-enabled multiboot ROM ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * esp: ensure in-flight SCSI requests are always cancelledMark Cave-Ayland2021-11-021-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is currently a check in esp_select() to cancel any in-flight SCSI requests to ensure that issuing multiple select commands without continuing through the rest of the ESP state machine ignores all but the last SCSI request. This is also enforced through the addition of assert()s in esp_transfer_data() and scsi_read_data(). The get_cmd() function does not call esp_select() when TC == 0 which means it is possible for a fuzzer to trigger these assert()s by sending a select command when TC == 0 immediately after a valid SCSI CDB has been submitted. Since esp_select() is only called from get_cmd(), hoist the check to cancel in-flight SCSI requests from esp_select() into get_cmd() to ensure it is always called when executing a select command to initiate a new SCSI request. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Closes: https://gitlab.com/qemu-project/qemu/-/issues/662 Closes: https://gitlab.com/qemu-project/qemu/-/issues/663 Message-Id: <20211101183516.8455-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * hw/i386: fix vmmouse registrationPavel Dovgalyuk2021-11-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the logic of vmmouse_update_handler function, vmmouse should be registered as an event handler when it's status is zero. vmmouse_read_id resets the status but does not register the handler. This patch adds vmmouse registration and activation when status is reset. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Message-Id: <163524204515.1914131.16465061981774791228.stgit@pasha-ThinkPad-X280> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * watchdog: remove select_watchdog_actionPaolo Bonzini2021-11-021-14/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | Instead of invoking select_watchdog_action from both HMP and command line, go directly from HMP to QMP and use QemuOpts as the intermediary for the command line. This makes -watchdog-action explicitly a shortcut for "-action watchdog", so that "-watchdog-action" and "-action watchdog" override each other based on the position on the command line; previously, "-action watchdog" always won. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * watchdog: add information from -watchdog help to -device helpPaolo Bonzini2021-11-026-7/+12
| | | | | | | | | | | | | | List all watchdog devices in a separate category, and populate their descriptions. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * hw/i386: Rename default_bus_bypass_iommuJean-Philippe Brucker2021-11-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit d8fb7d0969d5 ("vl: switch -M parsing to keyval"), machine parameter definitions cannot use underscores, because keyval_dashify() transforms them to dashes and the parser doesn't find the parameter. This affects option default_bus_bypass_iommu which was introduced in the same release: $ qemu-system-x86_64 -M q35,default_bus_bypass_iommu=on qemu-system-x86_64: Property 'pc-q35-6.1-machine.default-bus-bypass-iommu' not found Rename the parameter to "default-bus-bypass-iommu". Passing "default_bus_bypass_iommu" is still valid since the underscore are transformed automatically. Fixes: c9e96b04fc19 ("hw/i386: Add a default_bus_bypass_iommu pc machine option") Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-Id: <20211025104737.1560274-1-jean-philippe@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: use DMA-enabled multiboot ROM for new-enough QEMU machine typesPaolo Bonzini2021-11-024-5/+14
| | | | | | | | | | | | | | As long as fw_cfg supports DMA, the new ROM can be used also on older machine types because it has the same size as the existing one. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: move linuxboot_dma_enabled to X86MachineStatePaolo Bonzini2021-11-025-8/+13
| | | | | | | | | | | | | | | | This removes a parameter from x86_load_linux, and will avoid code duplication between the linux and multiboot cases once multiboot starts to support DMA. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * util: Make some iova_tree parameters constEugenio Pérez2021-11-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As qemu guidelines: Unless a pointer is used to modify the pointed-to storage, give it the "const" attribute. In the particular case of iova_tree_find it allows to enforce what is requested by its comment, since the compiler would shout in case of modifying or freeing the const-qualified returned pointer. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Peter Xu <peterx@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211013182713.888753-2-eperezma@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch ↵Richard Henderson2021-11-032-4/+7
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/vivier/tags/trivial-branch-for-6.2-pull-request' into staging Trivial patches branch pull request 20211101 v2 # gpg: Signature made Tue 02 Nov 2021 07:21:44 PM EDT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] * remotes/vivier/tags/trivial-branch-for-6.2-pull-request: hw/input/lasips2: Fix typos in function names MAINTAINERS: Split HPPA TCG vs HPPA machines/hardware hw/core/machine: Add the missing delimiter in cpu_slot_to_string() monitor: Trim some trailing space from human-readable output Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | hw/input/lasips2: Fix typos in function namesPhilippe Mathieu-Daudé2021-10-311-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Artist is another device, this one is the Lasi PS/2. Rename the functions accordingly. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com> Message-Id: <20210920064048.2729397-2-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-04-27 06:28:16 +0200