aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2022-02-16target/riscv: Implement AIA xiselect and xireg CSRsAnup Patel3-0/+187
The AIA specification defines [m|s|vs]iselect and [m|s|vs]ireg CSRs which allow indirect access to interrupt priority arrays and per-HART IMSIC registers. This patch implements AIA xiselect and xireg CSRs. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-15-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Implement AIA mtopi, stopi, and vstopi CSRsAnup Patel1-0/+156
The AIA specification introduces new [m|s|vs]topi CSRs for reporting pending local IRQ number and associated IRQ priority. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-14-anup@brainfault.org [ Changed by AF: - Fixup indentation ] Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Implement AIA interrupt filtering CSRsAnup Patel1-0/+23
The AIA specificaiton adds interrupt filtering support for M-mode and HS-mode. Using AIA interrupt filtering M-mode and H-mode can take local interrupt 13 or above and selectively inject same local interrupt to lower privilege modes. At the moment, we don't have any local interrupts above 12 so we add dummy implementation (i.e. read zero and ignore write) of AIA interrupt filtering CSRs. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-13-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Implement AIA hvictl and hviprioX CSRsAnup Patel3-1/+131
The AIA hvictl and hviprioX CSRs allow hypervisor to control interrupts visible at VS-level. This patch implements AIA hvictl and hviprioX CSRs. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-12-anup@brainfault.org [ Changes by AF: - Fix possible unintilised variable error in rmw_sie() ] Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Implement AIA CSRs for 64 local interrupts on RV32Anup Patel4-120/+474
The AIA specification adds new CSRs for RV32 so that RISC-V hart can support 64 local interrupts on both RV32 and RV64. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-11-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Implement AIA local interrupt prioritiesAnup Patel4-21/+294
The AIA spec defines programmable 8-bit priority for each local interrupt at M-level, S-level and VS-level so we extend local interrupt processing to consider AIA interrupt priorities. The AIA CSRs which help software configure local interrupt priorities will be added by subsequent patches. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220204174700.534953-10-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Allow AIA device emulation to set ireg rmw callbackAnup Patel2-0/+37
The AIA device emulation (such as AIA IMSIC) should be able to set (or provide) AIA ireg read-modify-write callback for each privilege level of a RISC-V HART. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-9-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Add defines for AIA CSRsAnup Patel1-0/+119
The RISC-V AIA specification extends RISC-V local interrupts and introduces new CSRs. This patch adds defines for the new AIA CSRs. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-8-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Add AIA cpu featureAnup Patel1-1/+2
We define a CPU feature for AIA CSR support in RISC-V CPUs which can be set by machine/device emulation. The RISC-V CSR emulation will also check this feature for emulating AIA CSRs. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-7-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Allow setting CPU feature from machine/device emulationAnup Patel2-8/+8
The machine or device emulation should be able to force set certain CPU features because: 1) We can have certain CPU features which are in-general optional but implemented by RISC-V CPUs on the machine. 2) We can have devices which require a certain CPU feature. For example, AIA IMSIC devices expect AIA CSRs implemented by RISC-V CPUs. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-6-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Improve delivery of guest external interruptsAnup Patel1-0/+13
The guest external interrupts from an interrupt controller are delivered only when the Guest/VM is running (i.e. V=1). This means any guest external interrupt which is triggered while the Guest/VM is not running (i.e. V=0) will be missed on QEMU resulting in Guest with sluggish response to serial console input and other I/O events. To solve this, we check and inject interrupt after setting V=1. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-5-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Implement hgeie and hgeip CSRsAnup Patel6-38/+121
The hgeie and hgeip CSRs are required for emulating an external interrupt controller capable of injecting virtual external interrupt to Guest/VM running at VS-level. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-4-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Implement SGEIP bit in hip and hie CSRsAnup Patel3-8/+16
A hypervisor can optionally take guest external interrupts using SGEIP bit of hip and hie CSRs. Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-3-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Fix trap cause for RV32 HS-mode CSR access from RV64 HS-modeAnup Patel1-1/+1
We should be returning illegal instruction trap when RV64 HS-mode tries to access RV32 HS-mode CSR. Fixes: d6f20dacea51 ("target/riscv: Fix 32-bit HS mode access permissions") Signed-off-by: Anup Patel <anup.patel@wdc.com> Signed-off-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20220204174700.534953-2-anup@brainfault.org Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Fix vill field write in vtypeLIU Zhiwei1-0/+1
The guest should be able to set the vill bit as part of vsetvl. Currently we may set env->vill to 1 in the vsetvl helper, but there is nowhere that we set it to 0, so once it transitions to 1 it's stuck there until the system is reset. Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220201064601.41143-1-zhiwei_liu@c-sky.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: add a MAINTAINERS entry for XVentanaCondOpsPhilipp Tomsich1-0/+7
The XVentanaCondOps extension is supported by VRULL on behalf of the Ventana Micro. Add myself as a point-of-contact. Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220202005249.3566542-8-philipp.tomsich@vrull.eu> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: Add XVentanaCondOps custom extensionPhilipp Tomsich6-0/+83
This adds the decoder and translation for the XVentanaCondOps custom extension (vendor-defined by Ventana Micro Systems), which is documented at https://github.com/ventanamicro/ventana-custom-extensions/releases/download/v1.0.0/ventana-custom-extensions-v1.0.0.pdf This commit then also adds a guard-function (has_XVentanaCondOps_p) and the decoder function to the table of decoders, enabling the support for the XVentanaCondOps extension. Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220202005249.3566542-7-philipp.tomsich@vrull.eu> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: iterate over a table of decodersPhilipp Tomsich1-5/+27
To split up the decoder into multiple functions (both to support vendor-specific opcodes in separate files and to simplify maintenance of orthogonal extensions), this changes decode_op to iterate over a table of decoders predicated on guard functions. This commit only adds the new structure and the table, allowing for the easy addition of additional decoders in the future. Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220202005249.3566542-6-philipp.tomsich@vrull.eu> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: access cfg structure through DisasContextPhilipp Tomsich1-4/+4
The Zb[abcs] support code still uses the RISCV_CPU macros to access the configuration information (i.e., check whether an extension is available/enabled). Now that we provide this information directly from DisasContext, we can access this directly via the cfg_ptr field. Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220202005249.3566542-5-philipp.tomsich@vrull.eu> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: access configuration through cfg_ptr in DisasContextPhilipp Tomsich4-69/+97
The implementation in trans_{rvi,rvv,rvzfh}.c.inc accesses the shallow copies (in DisasContext) of some of the elements available in the RISCVCPUConfig structure. This commit redirects accesses to use the cfg_ptr copied into DisasContext and removes the shallow copies. Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220202005249.3566542-4-philipp.tomsich@vrull.eu> [ Changes by AF: - Fixup checkpatch failures ] Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: riscv_tr_init_disas_context: copy pointer-to-cfg into cfg_ptrPhilipp Tomsich1-0/+2
As the number of extensions is growing, copying them individiually into the DisasContext will scale less and less... instead we populate a pointer to the RISCVCPUConfig structure in the DisasContext. This adds an extra indirection when checking for the availability of an extension (compared to copying the fields into DisasContext). While not a performance problem today, we can always (shallow) copy the entire structure into the DisasContext (instead of putting a pointer to it) if this is ever deemed necessary. Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220202005249.3566542-3-philipp.tomsich@vrull.eu> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: refactor (anonymous struct) RISCVCPU.cfg into 'struct ↵Philipp Tomsich1-37/+41
RISCVCPUConfig' Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220202005249.3566542-2-philipp.tomsich@vrull.eu> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16target/riscv: correct "code should not be reached" for x-rv128Frédéric Pétrot2-2/+4
The addition of uxl support in gdbstub adds a few checks on the maximum register length, but omitted MXL_RV128, an experimental feature. This patch makes rv128 react as rv64, as previously. Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: LIU Zhiwei <zhiwei_liu@c-sky.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220124202456.420258-1-frederic.petrot@univ-grenoble-alpes.fr Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16Allow setting up to 8 bytes with the generic loaderPetr Tesarik1-1/+1
The documentation for the generic loader says that "the maximum size of the data is 8 bytes". However, attempts to set data-len=8 trigger the following assertion failure: ../hw/core/generic-loader.c:59: generic_loader_reset: Assertion `s->data_len < sizeof(s->data)' failed. The type of s->data is uint64_t (i.e. 8 bytes long), so I believe this assert should use <= instead of <. Fixes: e481a1f63c93 ("generic-loader: Add a generic loader") Signed-off-by: Petr Tesarik <ptesarik@suse.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220120092715.7805-1-ptesarik@suse.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-16include: hw: remove ibex_plic.hWilfred Mallawa1-67/+0
This patch removes the left-over/unused `ibex_plic.h` file. Previously used by opentitan, which now follows the RISC-V standard and uses the SiFivePlicState. Fixes: 434e7e021 ("hw/intc: Remove the Ibex PLIC") Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20220121055005.3159846-1-alistair.francis@opensource.wdc.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-02-15Merge remote-tracking branch ↵Peter Maydell5-4/+51
'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request This contains coroutine poll size scaling, virtiofsd rseq seccomp for new glibc versions, and the QEMU C virtiofsd deprecation notice. # gpg: Signature made Mon 14 Feb 2022 17:14:21 GMT # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: util: adjust coroutine pool size to virtio block queue Deprecate C virtiofsd tools/virtiofsd: Add rseq syscall to the seccomp allowlist Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-15Merge remote-tracking branch 'remotes/nvme/tags/nvme-next-pull-request' into ↵Peter Maydell5-35/+296
staging hw/nvme updates - fix CVE-2021-3929 - add zone random write area support - misc cleanups from Philippe # gpg: Signature made Mon 14 Feb 2022 08:01:34 GMT # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * remotes/nvme/tags/nvme-next-pull-request: hw/nvme: add support for zoned random write area hw/nvme: add ozcs enum hw/nvme: add struct for zone management send hw/nvme/ctrl: Pass buffers as 'void *' types hw/nvme/ctrl: Have nvme_addr_write() take const buffer hw/nvme: fix CVE-2021-3929 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-15Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell8-29/+78
staging # gpg: Signature made Mon 14 Feb 2022 03:51:14 GMT # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: net/eth: Don't consider ESP to be an IPv6 option header hw/net: e1000e: Clear ICR on read when using non MSI-X interrupts net/filter: Optimize filter_send to coroutine net/colo-compare.c: Update the default value comments net/colo-compare.c: Optimize compare order for performance net: Fix uninitialized data usage net/tap: Set return code on failure hw/net/vmxnet3: Log guest-triggerable errors using LOG_GUEST_ERROR Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-14Merge remote-tracking branch 'remotes/kwolf-gitlab/tags/for-upstream' into ↵Peter Maydell4-10/+52
staging Block layer patches - Fix crash in blockdev-reopen with iothreads - fdc-isa: Respect QOM properties when building AML # gpg: Signature made Fri 11 Feb 2022 17:44:52 GMT # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kwolf-gitlab/tags/for-upstream: hw/block/fdc-isa: Respect QOM properties when building AML iotests: Test blockdev-reopen with iothreads and throttling block: Lock AioContext for drain_end in blockdev-reopen Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-14util: adjust coroutine pool size to virtio block queueHiroki Narukawa3-4/+31
Coroutine pool size was 64 from long ago, and the basis was organized in the commit message in 4d68e86b. At that time, virtio-blk queue-size and num-queue were not configuable, and equivalent values were 128 and 1. Coroutine pool size 64 was fine then. Later queue-size and num-queue got configuable, and default values were increased. Coroutine pool with size 64 exhausts frequently with random disk IO in new size, and slows down. This commit adjusts coroutine pool size adaptively with new values. This commit adds 64 by default, but now coroutine is not only for block devices, and is not too much burdon comparing with new default. pool size of 128 * vCPUs. Signed-off-by: Hiroki Narukawa <hnarukaw@yahoo-corp.jp> Message-id: 20220214115302.13294-2-hnarukaw@yahoo-corp.jp Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-02-14Deprecate C virtiofsdDr. David Alan Gilbert1-0/+17
There's a nice new Rust implementation out there; recommend people do new work on that. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20220210174714.19843-1-dgilbert@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-02-14tools/virtiofsd: Add rseq syscall to the seccomp allowlistChristian Ehrhardt1-0/+3
The virtiofsd currently crashes when used with glibc 2.35. That is due to the rseq system call being added to every thread creation [1][2]. [1]: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/ [2]: https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html This happens not at daemon start, but when a guest connects /usr/lib/qemu/virtiofsd -f --socket-path=/tmp/testvfsd -o sandbox=chroot \ -o source=/var/guests/j-virtiofs --socket-group=kvm virtio_session_mount: Waiting for vhost-user socket connection... # start ok, now guest will connect virtio_session_mount: Received vhost-user socket connection virtio_loop: Entry fv_queue_set_started: qidx=0 started=1 fv_queue_set_started: qidx=1 started=1 Bad system call (core dumped) We have to put rseq on the seccomp allowlist to avoid that the daemon is crashing in this case. Reported-by: Michael Hudson-Doyle <michael.hudson@canonical.com> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20220209111456.3328420-1-christian.ehrhardt@canonical.com [Moved rseq to its alphabetically ordered position in the seccomp allowlist. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-02-14Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20220211' ↵Peter Maydell36-495/+1561
into staging Fix safe_syscall_base for sparc64. Fix host signal handling for sparc64-linux. Speedups for jump cache and work list probing. Fix for exception replays. Raise guest SIGBUS for user-only misaligned accesses. # gpg: Signature made Fri 11 Feb 2022 01:27:16 GMT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth-gitlab/tags/pull-tcg-20220211: (34 commits) tests/tcg/multiarch: Add sigbus.c tcg/sparc: Support unaligned access for user-only tcg/sparc: Add tcg_out_jmpl_const for better tail calls tcg/sparc: Use the constant pool for 64-bit constants tcg/sparc: Convert patch_reloc to return bool tcg/sparc: Improve code gen for shifted 32-bit constants tcg/sparc: Add scratch argument to tcg_out_movi_int tcg/sparc: Split out tcg_out_movi_imm32 tcg/sparc: Use tcg_out_movi_imm13 in tcg_out_addsub2_i64 tcg/mips: Support unaligned access for softmmu tcg/mips: Support unaligned access for user-only tcg/arm: Support raising sigbus for user-only tcg/arm: Reserve a register for guest_base tcg/arm: Support unaligned access for softmmu tcg/arm: Check alignment for ldrd and strd tcg/arm: Remove use_armv6_instructions tcg/arm: Remove use_armv5t_instructions tcg/arm: Drop support for armv4 and armv5 hosts tcg/loongarch64: Support raising sigbus for user-only tcg/tci: Support raising sigbus for user-only ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-14hw/nvme: add support for zoned random write areaKlaus Jensen5-20/+237
Add support for TP 4076 ("Zoned Random Write Area"), v2021.08.23 ("Ratified"). This adds three new namespace parameters: "zoned.numzrwa" (number of zrwa resources, i.e. number of zones that can have a zrwa), "zoned.zrwas" (zrwa size in LBAs), "zoned.zrwafg" (granularity in LBAs for flushes). Reviewed-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2022-02-14hw/nvme: add ozcs enumKlaus Jensen2-1/+6
Add enumeration for OZCS values. Reviewed-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2022-02-14hw/nvme: add struct for zone management sendKlaus Jensen2-6/+23
Add struct for Zone Management Send in preparation for more zone send flags. Reviewed-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2022-02-14hw/nvme/ctrl: Pass buffers as 'void *' typesPhilippe Mathieu-Daudé2-7/+7
These buffers can be anything, not an array of chars, so use the 'void *' type for them. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2022-02-14hw/nvme/ctrl: Have nvme_addr_write() take const bufferPhilippe Mathieu-Daudé1-1/+1
The 'buf' argument is not modified, so better pass it as const type. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2022-02-14hw/nvme: fix CVE-2021-3929Klaus Jensen1-0/+22
This fixes CVE-2021-3929 "locally" by denying DMA to the iomem of the device itself. This still allows DMA to MMIO regions of other devices (e.g. doing P2P DMA to the controller memory buffer of another NVMe device). Fixes: CVE-2021-3929 Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com> Reviewed-by: Keith Busch <kbusch@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2022-02-14net/eth: Don't consider ESP to be an IPv6 option headerThomas Jansen1-1/+0
The IPv6 option headers all have in common that they start with some common fields, in particular the type of the next header followed by the extention header length. This is used to traverse the list of the options. The ESP header does not follow that format, which can break the IPv6 option header traversal code in eth_parse_ipv6_hdr(). The effect of that is that network interfaces such as vmxnet3 that use the following call chain eth_is_ip6_extension_header_type eth_parse_ipv6_hdr net_tx_pkt_parse_headers net_tx_pkt_parse vmxnet3_process_tx_queue to send packets from the VM out to the host will drop packets of the following structure: Ethernet-Header(IPv6-Header(ESP(encrypted data))) Note that not all types of network interfaces use the net_tx_pkt_parse function though, leading to inconsistent behavior regarding sending those packets. The e1000 network interface for example does not suffer from this limitation. By not considering ESP to be an IPv6 header we can allow sending those packets out to the host on all types of network interfaces. Fixes: 75020a702151 ("Common definitions for VMWARE devices") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/149 Buglink: https://bugs.launchpad.net/qemu/+bug/1758091 Signed-off-by: Thomas Jansen <mithi@mithi.net> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-14hw/net: e1000e: Clear ICR on read when using non MSI-X interruptsNick Hudson2-0/+6
In section 7.4.3 of the 82574 datasheet it states that "In systems that do not support MSI-X, reading the ICR register clears it's bits..." Some OSes rely on this. Signed-off-by: Nick Hudson <skrll@netbsd.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-14net/filter: Optimize filter_send to coroutineRao Lei1-13/+53
This patch is to improve the logic of QEMU main thread sleep code in qemu_chr_write_buffer() where it can be blocked and can't run other coroutines during COLO IO stress test. Our approach is to put filter_send() in a coroutine. In this way, filter_send() will call qemu_coroutine_yield() in qemu_co_sleep_ns(), so that it can be scheduled out and QEMU main thread has opportunity to run other tasks. Signed-off-by: Lei Rao <lei.rao@intel.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Reviewed-by: Li Zhijian <lizhijian@fujitsu.com> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-14net/colo-compare.c: Update the default value commentsZhang Chen1-1/+1
Make the comments consistent with the REGULAR_PACKET_CHECK_MS. Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-14net/colo-compare.c: Optimize compare order for performanceZhang Chen1-13/+13
COLO-compare use the glib function g_queue_find_custom to dump another VM's networking packet to compare. But this function always start find from the queue->head(here is the newest packet), It will reduce the success rate of comparison. So this patch reversed the order of the queues for performance. Signed-off-by: Zhang Chen <chen.zhang@intel.com> Reported-by: leirao <lei.rao@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-14net: Fix uninitialized data usagePeter Foley1-0/+1
e.g. 1109 15:16:20.151506 Uninitialized bytes in ioctl_common_pre at offset 0 inside [0x7ffc516af9b8, 4) 1109 15:16:20.151659 ==588974==WARNING: MemorySanitizer: use-of-uninitialized-value 1109 15:16:20.312923 #0 0x5639b88acb21 in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c:183:9 1109 15:16:20.312952 #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9 1109 15:16:20.312954 #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19 1109 15:16:20.312956 #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13 1109 15:16:20.312957 #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9 1109 15:16:20.312958 #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15 1109 15:16:20.312960 #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11 1109 15:16:20.312961 #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14 1109 15:16:20.312962 #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9 1109 15:16:20.312964 #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5 1109 15:16:20.312965 #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5 1109 15:16:20.312967 #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5 1109 15:16:20.312968 #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2) 1109 15:16:20.312969 #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120 1109 15:16:20.312970 1109 15:16:20.312975 Uninitialized value was stored to memory at 1109 15:16:20.313393 #0 0x5639b88acbee in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c 1109 15:16:20.313396 #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9 1109 15:16:20.313398 #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19 1109 15:16:20.313399 #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13 1109 15:16:20.313400 #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9 1109 15:16:20.313401 #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15 1109 15:16:20.313403 #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11 1109 15:16:20.313404 #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14 1109 15:16:20.313405 #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9 1109 15:16:20.313407 #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5 1109 15:16:20.313408 #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5 1109 15:16:20.313409 #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5 1109 15:16:20.313410 #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2) 1109 15:16:20.313412 #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120 1109 15:16:20.313413 1109 15:16:20.313417 Uninitialized value was stored to memory at 1109 15:16:20.313791 #0 0x5639b88affbd in net_tap_fd_init third_party/qemu/net/tap.c:400:26 1109 15:16:20.313826 #1 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19 1109 15:16:20.313829 #2 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13 1109 15:16:20.313831 #3 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9 1109 15:16:20.313836 #4 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15 1109 15:16:20.313838 #5 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11 1109 15:16:20.313839 #6 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14 1109 15:16:20.313841 #7 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9 1109 15:16:20.313843 #8 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5 1109 15:16:20.313844 #9 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5 1109 15:16:20.313845 #10 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5 1109 15:16:20.313846 #11 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2) 1109 15:16:20.313847 #12 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120 1109 15:16:20.313849 1109 15:16:20.313851 Uninitialized value was created by an allocation of 'ifr' in the stack frame of function 'tap_probe_vnet_hdr' 1109 15:16:20.313855 #0 0x5639b88ac680 in tap_probe_vnet_hdr third_party/qemu/net/tap-linux.c:151 1109 15:16:20.313856 1109 15:16:20.313878 SUMMARY: MemorySanitizer: use-of-uninitialized-value third_party/qemu/net/tap-linux.c:183:9 in tap_probe_vnet_hdr_len Fixes: dc69004c7d8 ("net: move tap_probe_vnet_hdr() to tap-linux.c") Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Patrick Venture <venture@google.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Foley <pefoley@google.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-14net/tap: Set return code on failurePeter Foley1-0/+1
Match the other error handling in this function. Fixes: e7b347d0bf6 ("net: detect errors from probing vnet hdr flag for TAP devices") Reviewed-by: Patrick Venture <venture@google.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Foley <pefoley@google.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-14hw/net/vmxnet3: Log guest-triggerable errors using LOG_GUEST_ERRORPhilippe Mathieu-Daudé1-1/+3
The "Interrupt Cause" register (VMXNET3_REG_ICR) is read-only. Write accesses are ignored. Log them with as LOG_GUEST_ERROR instead of aborting: [R +0.239743] writeq 0xe0002031 0x46291a5a55460800 ERROR:hw/net/vmxnet3.c:1819:vmxnet3_io_bar1_write: code should not be reached Thread 1 "qemu-system-i38" received signal SIGABRT, Aborted. (gdb) bt #3 0x74c397d3 in __GI_abort () at abort.c:79 #4 0x76d3cd4c in g_assertion_message (domain=<optimized out>, file=<optimized out>, line=<optimized out>, func=<optimized out>, message=<optimized out>) at ../glib/gtestutils.c:3223 #5 0x76d9d45f in g_assertion_message_expr (domain=0x0, file=0x59fc2e53 "hw/net/vmxnet3.c", line=1819, func=0x59fc11e0 <__func__.vmxnet3_io_bar1_write> "vmxnet3_io_bar1_write", expr=<optimized out>) at ../glib/gtestutils.c:3249 #6 0x57e80a3a in vmxnet3_io_bar1_write (opaque=0x62814100, addr=56, val=70, size=4) at hw/net/vmxnet3.c:1819 #7 0x58c2d894 in memory_region_write_accessor (mr=0x62816b90, addr=56, value=0x7fff9450, size=4, shift=0, mask=4294967295, attrs=...) at softmmu/memory.c:492 #8 0x58c2d1d2 in access_with_adjusted_size (addr=56, value=0x7fff9450, size=1, access_size_min=4, access_size_max=4, access_fn= 0x58c2d290 <memory_region_write_accessor>, mr=0x62816b90, attrs=...) at softmmu/memory.c:554 #9 0x58c2bae7 in memory_region_dispatch_write (mr=0x62816b90, addr=56, data=70, op=MO_8, attrs=...) at softmmu/memory.c:1504 #10 0x58bfd034 in flatview_write_continue (fv=0x606000181700, addr=0xe0002038, attrs=..., ptr=0x7fffb9e0, len=1, addr1=56, l=1, mr=0x62816b90) at softmmu/physmem.c:2782 #11 0x58beba00 in flatview_write (fv=0x606000181700, addr=0xe0002031, attrs=..., buf=0x7fffb9e0, len=8) at softmmu/physmem.c:2822 #12 0x58beb589 in address_space_write (as=0x608000015f20, addr=0xe0002031, attrs=..., buf=0x7fffb9e0, len=8) at softmmu/physmem.c:2914 Reported-by: Dike <dike199774@qq.com> Reported-by: Duhao <504224090@qq.com> BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2032932 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-02-13Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220210' into ↵Peter Maydell32-2250/+592
staging ppc-7.0 queue * Exception model rework (Fabiano) * Unused CPU models removal (Fabiano and Cédric) * Fix for VOF installation (Alexey) * Misc fixes # gpg: Signature made Thu 10 Feb 2022 12:59:07 GMT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * remotes/legoater/tags/pull-ppc-20220210: (42 commits) spapr/vof: Install rom and nvram binaries docs: rstfy confidential guest documentation target/ppc: Change VSX instructions behavior to fill with zeros target/ppc: books: Remove excp_model argument from ppc_excp_apply_ail target/ppc: Assert if MSR bits differ from msr_mask during exceptions target/ppc: powerpc_excp: Move common code to the caller function target/ppc: Remove powerpc_excp_legacy target/ppc: 7xx: Set SRRs directly in exception code target/ppc: 7xx: Software TLB cleanup target/ppc: 7xx: System Reset cleanup target/ppc: 7xx: System Call exception cleanup target/ppc: 7xx: Program exception cleanup target/ppc: 7xx: External interrupt cleanup target/ppc: 7xx: Machine Check exception cleanup target/ppc: Simplify powerpc_excp_7xx target/ppc: Introduce powerpc_excp_7xx target/ppc: Merge 7x5 and 7x0 exception model IDs target/ppc: 6xx: Set SRRs directly in exception code target/ppc: 6xx: Software TLB exceptions cleanup target/ppc: 6xx: System Reset interrupt cleanup ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-12Merge remote-tracking branch ↵Peter Maydell4-4/+205
'remotes/vsementsov/tags/pull-nbd-2022-02-09-v2' into staging nbd: handle AioContext change correctly v2: add my s-o-b marks to each commit # gpg: Signature made Fri 11 Feb 2022 13:14:55 GMT # gpg: using RSA key 8B9C26CDB2FD147C880E86A1561F24C1F19F79FB # gpg: Good signature from "Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8B9C 26CD B2FD 147C 880E 86A1 561F 24C1 F19F 79FB * remotes/vsementsov/tags/pull-nbd-2022-02-09-v2: iotests/281: Let NBD connection yield in iothread block/nbd: Move s->ioc on AioContext change iotests/281: Test lingering timers iotests.py: Add QemuStorageDaemon class block/nbd: Assert there are no timers when closed block/nbd: Delete open timer when done block/nbd: Delete reconnect delay timer when done Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-11hw/block/fdc-isa: Respect QOM properties when building AMLBernhard Beschow1-4/+7
Other ISA devices such as serial-isa use the properties in their build_aml functions. fdc-isa not using them is probably an oversight. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20220209191558.30393-1-shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
generated by cgit v1.1 at 2025-02-08 12:16:55 +0000