aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2021-07-09Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell10-5/+103
pc,pci,virtio: bugfixes, improvements vhost-user-rng support. Fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 07 Jul 2021 14:29:30 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: MAINTAINERS: Add maintainer for vhost-user RNG implementation docs: add slot when adding new PCIe root port acpi/ged: fix reset cause tests: acpi: pc: update expected DSDT blobs acpi: pc: revert back to v5.2 PCI slot enumeration tests: acpi: prepare for changing DSDT tables migration: failover: reset partially_hotplugged virtio-pci: Changed return values for "notify", "device" and "isr" read. virtio-pci: Added check for virtio device in PCI config cbs. virtio-pci: Added check for virtio device presence in mm callbacks. hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field virtio: Clarify MR transaction optimization virtio: disable ioeventfd for record/replay Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-08Merge remote-tracking branch ↵Peter Maydell1-4/+38
'remotes/stefanha-gitlab/tags/block-pull-request' into staging Pull request # gpg: Signature made Thu 08 Jul 2021 14:11:37 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha-gitlab/tags/block-pull-request: block/io: Merge discard request alignments block: Add backend_defaults property block/file-posix: Optimize for macOS util/async: print leaked BH name when AioContext finalizes util/async: add a human-readable name to BHs for debugging Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-06block: Add backend_defaults propertyAkihiko Odaki1-4/+38
backend_defaults property allow users to control if default block properties should be decided with backend information. If it is off, any backend information will be discarded, which is suitable if you plan to perform live migration to a different disk backend. If it is on, a block device may utilize backend information more aggressively. By default, it is auto, which uses backend information for block sizes and ignores the others, which is consistent with the older versions. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-id: 20210705130458.97642-2-akihiko.odaki@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-06Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell2-53/+61
staging * More Meson test conversions and configure cleanups * Generalize XSAVE area offset so that it matches AMD processors on KVM * Improvements for -display and deprecation of -no-quit * Enable SMP configuration as a compound machine property ("-M smp.cpus=...") * Haiku compilation fix * Add icon on Darwin # gpg: Signature made Tue 06 Jul 2021 08:35:23 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: (40 commits) config-host.mak: remove unused compiler-related lines Set icon for QEMU binary on Mac OS qemu-option: remove now-dead code machine: add smp compound property vl: switch -M parsing to keyval keyval: introduce keyval_parse_into keyval: introduce keyval_merge qom: export more functions for use with non-UserCreatable objects configure: convert compiler tests to meson, part 6 configure: convert compiler tests to meson, part 5 configure: convert compiler tests to meson, part 4 configure: convert compiler tests to meson, part 3 configure: convert compiler tests to meson, part 2 configure: convert compiler tests to meson, part 1 configure: convert HAVE_BROKEN_SIZE_MAX to meson configure, meson: move CONFIG_IVSHMEM to meson meson: store dependency('threads') in a variable meson: sort existing compiler tests configure, meson: convert libxml2 detection to meson configure, meson: convert liburing detection to meson ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-06machine: add smp compound propertyPaolo Bonzini1-50/+58
Make -smp syntactic sugar for a compound property "-machine smp.{cores,threads,cpu,...}". machine_smp_parse is replaced by the setter for the property. numa-test will now cover the new syntax, while other tests still use -smp. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06configure, meson: convert virgl detection to mesonPaolo Bonzini1-3/+3
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20210705' ↵Peter Maydell16-48/+166
into staging 9pfs: misc patches * Add link to 9p developer docs. * Fix runtime check whether client supplied relative path is the export root. * Performance optimization of Twalk requests. * Code cleanup. # gpg: Signature made Mon 05 Jul 2021 12:13:34 BST # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * remotes/cschoenebeck/tags/pull-9p-20210705: 9pfs: reduce latency of Twalk 9pfs: drop root_qid 9pfs: replace not_same_qid() by same_stat_id() 9pfs: drop fid_to_qid() 9pfs: capture root stat 9pfs: fix not_same_qid() 9pfs: simplify v9fs_walk() 9pfs: add link to 9p developer docs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-059pfs: reduce latency of TwalkChristian Schoenebeck1-19/+70
As with previous performance optimization on Treaddir handling; reduce the overall latency, i.e. overall time spent on processing a Twalk request by reducing the amount of thread hops between the 9p server's main thread and fs worker thread(s). In fact this patch even reduces the thread hops for Twalk handling to its theoritical minimum of exactly 2 thread hops: main thread -> fs worker thread -> main thread This is achieved by doing all the required fs driver tasks altogether in a single v9fs_co_run_in_worker({ ... }); code block. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <1a6701674afc4f08d40396e3aa2631e18a4dbb33.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: drop root_qidChristian Schoenebeck2-2/+0
There is no longer a user of root_qid, so drop it. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <6896dd161d3257db6b0513842a14f87ca191fdf6.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: replace not_same_qid() by same_stat_id()Christian Schoenebeck1-3/+3
As we are actually only comparing the filesystem ID (i.e. device number and inode number pair) let's use the POSIX stat buffer instead of QIDs, because resolving QIDs requires to be done on 9p server's main thread only as it might mutate the server state if inode remapping is enabled. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <26aa465ff9cc9c07e053331554a02fdae3994417.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: drop fid_to_qid()Christian Schoenebeck1-18/+5
There is only one user of fid_to_qid() which is v9fs_walk(). Let's open-code fid_to_qid() directly within v9fs_walk(), because fid_to_qid() hides the POSIX stat buffer which we are going to need in the subsequent patch. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <e9a4c9c7a0792ed4db6578d105a0823ea05bc324.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: capture root statChristian Schoenebeck2-1/+10
We already capture the QID of the exported 9p root path, i.e. to prevent client access outside the defined, exported filesystem's tree. This is currently checked by comparing the root QID with another FID's QID. The problem with the latter is that resolving a QID of any given 9p path can only be done on 9p server's main thread, that's because it might mutate the server's state if inode remapping is enabled. For that reason also capture the POSIX stat info of the root path for being able to identify on any (e.g. worker) thread whether an arbitrary given path is identical to the export root. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <eb07d6c2e9925788454cfe33d3802e4ffb23ea9a.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: fix not_same_qid()Christian Schoenebeck1-4/+1
There is only one user of not_same_qid() which is v9fs_walk() and the latter is using it for comparing a client supplied path with the 9p export root path, for the sole purpose to prevent a Twalk request from escaping from the exported 9p tree via "..". However for that specific purpose the implementation of not_same_qid() is wrong; if mtime of the 9p export root path changed between Tattach and Twalk then not_same_qid() returns true when actually comparing against the export root path. To fix for the actual semantic being used, only compare QID path members, but do not compare version or type members. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <ca0abae4a899d81c6e87f683732d6c1f56915232.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: simplify v9fs_walk()Christian Schoenebeck1-4/+5
There is only one comparison between nwnames and P9_MAXWELEM required. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <E1liKiz-0006BC-Ja@lizzy.crudebyte.com>
2021-07-059pfs: add link to 9p developer docsChristian Schoenebeck15-0/+75
To lower the entry level for new developers, add a link to the 9p developer docs (i.e. qemu wiki) to MAINTAINERS and to the beginning of 9p source files, that is to: https://wiki.qemu.org/Documentation/9p Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Acked-by: Greg Kurz <groug@kaod.org> Message-Id: <E1leeDf-0008GZ-9q@lizzy.crudebyte.com>
2021-07-05Merge remote-tracking branch 'remotes/marcel/tags/pvrdma-04-07-2021-v2' into ↵Peter Maydell3-1/+13
staging PVRDMA queue Several CVE fixes for the PVRDMA device. # gpg: Signature made Sun 04 Jul 2021 20:56:05 BST # gpg: using RSA key 36D4C0F0CF2FE46D # gpg: Good signature from "Marcel Apfelbaum <marcel.apfelbaum@zoho.com>" [marginal] # gpg: aka "Marcel Apfelbaum <marcel@redhat.com>" [marginal] # gpg: aka "Marcel Apfelbaum <marcel.apfelbaum@gmail.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: B1C6 3A57 F92E 08F2 640F 31F5 36D4 C0F0 CF2F E46D * remotes/marcel/tags/pvrdma-04-07-2021-v2: pvrdma: Fix the ring init error flow (CVE-2021-3608) pvrdma: Ensure correct input on ring init (CVE-2021-3607) hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-04pvrdma: Fix the ring init error flow (CVE-2021-3608)Marcel Apfelbaum1-1/+1
Do not unmap uninitialized dma addresses. Fixes: CVE-2021-3608 Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210630115246.2178219-1-marcel@redhat.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04pvrdma: Ensure correct input on ring init (CVE-2021-3607)Marcel Apfelbaum1-0/+5
Check the guest passed a non zero page count for pvrdma device ring buffers. Fixes: CVE-2021-3607 Reported-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210630114634.2168872-1-marcel@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)Marcel Apfelbaum1-0/+7
Ensure mremap boundaries not trusting the guest kernel to pass the correct buffer length. Fixes: CVE-2021-3582 Reported-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210616110600.20889-1-marcel.apfelbaum@gmail.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04Merge remote-tracking branch 'remotes/philmd/tags/mips-20210702' into stagingPeter Maydell7-192/+243
MIPS patches queue - Extract nanoMIPS, microMIPS, Code Compaction from translate.c - Allow PCI config accesses smaller than 32-bit on Bonito64 device - Fix migration of g364fb device on Jazz Magnum - Fix dp8393x PROM checksum on Jazz Magnum and Quadra 800 - Map the UART devices unconditionally on Jazz Magnum - Add functional test booting Linux on the Fuloong 2E # gpg: Signature made Fri 02 Jul 2021 16:36:19 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210702: hw/mips/jazz: Map the UART devices unconditionally hw/mips/jazz: specify correct endian for dp8393x device hw/m68k/q800: fix PROM checksum and MAC address storage qemu/bitops.h: add bitrev8 implementation dp8393x: remove onboard PROM containing MAC address and checksum hw/m68k/q800: move PROM and checksum calculation from dp8393x device to board hw/mips/jazz: move PROM and checksum calculation from dp8393x device to board dp8393x: convert to trace-events dp8393x: checkpatch fixes g364fb: add VMStateDescription for G364SysBusState g364fb: use RAM memory region for framebuffer tests/acceptance: Test Linux on the Fuloong 2E machine hw/pci-host/bonito: Allow PCI config accesses smaller than 32-bit hw/pci-host/bonito: Trace PCI config accesses smaller than 32-bit target/mips: Extract nanoMIPS ISA translation routines target/mips: Extract the microMIPS ISA translation routines target/mips: Extract Code Compaction ASE translation routines target/mips: Add declarations for generic TCG helpers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-03Merge remote-tracking branch ↵Peter Maydell4-2/+174
'remotes/pmaydell/tags/pull-target-arm-20210702' into staging target-arm queue: * more MVE instructions * hw/gpio/gpio_pwr: use shutdown function for reboot * target/arm: Check NaN mode before silencing NaN * tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine * hw/arm: Add basic power management to raspi. * docs/system/arm: Add quanta-gbs-bmc, quanta-q7l1-bmc # gpg: Signature made Fri 02 Jul 2021 13:59:19 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210702: (24 commits) target/arm: Implement MVE shifts by register target/arm: Implement MVE shifts by immediate target/arm: Implement MVE long shifts by register target/arm: Implement MVE long shifts by immediate target/arm: Implement MVE VADDLV target/arm: Implement MVE VSHLC target/arm: Implement MVE saturating narrowing shifts target/arm: Implement MVE VSHRN, VRSHRN target/arm: Implement MVE VSRI, VSLI target/arm: Implement MVE VSHLL target/arm: Implement MVE vector shift right by immediate insns target/arm: Implement MVE vector shift left by immediate insns target/arm: Implement MVE logical immediate insns target/arm: Use dup_const() instead of bitfield_replicate() target/arm: Use asimd_imm_const for A64 decode target/arm: Make asimd_imm_const() public target/arm: Fix bugs in MVE VRMLALDAVH, VRMLSLDAVH target/arm: Fix MVE widening/narrowing VLDR/VSTR offset calculation hw/gpio/gpio_pwr: use shutdown function for reboot target/arm: Check NaN mode before silencing NaN ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-03acpi/ged: fix reset causeGerd Hoffmann1-1/+1
Reset requests should use SHUTDOWN_CAUSE_GUEST_RESET not SHUTDOWN_CAUSE_GUEST_SHUTDOWN. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20210624110057.2398779-1-kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03acpi: pc: revert back to v5.2 PCI slot enumerationIgor Mammedov1-2/+7
Commit [1] moved _SUN variable from only hot-pluggable to all devices. This made linux kernel enumerate extra slots that weren't present before. If extra slot happens to be be enumerated first and there is a device in th same slot but on other bridge, linux kernel will add -N suffix to slot name of the later, thus changing NIC name compared to QEMU 5.2. This in some case confuses systemd, if it is using SLOT NIC naming scheme and interface name becomes not the same as it was under QEMU-5.2. Reproducer QEMU CLI: -M pc-i440fx-5.2 -nodefaults \ -device pci-bridge,chassis_nr=1,id=pci.1,bus=pci.0,addr=0x3 \ -device virtio-net-pci,id=nic1,bus=pci.1,addr=0x1 \ -device virtio-net-pci,id=nic2,bus=pci.1,addr=0x2 \ -device virtio-net-pci,id=nic3,bus=pci.1,addr=0x3 with RHEL8 guest produces following results: v5.2: kernel: virtio_net virtio0 ens1: renamed from eth0 kernel: virtio_net virtio2 ens3: renamed from eth2 kernel: virtio_net virtio1 enp1s2: renamed from eth1 (slot 2 is assigned to empty bus 0 slot and virtio1 is assigned to 2-2 slot, and renaming falls back, for some reason, to path based naming scheme) v6.0: kernel: virtio_net virtio0 ens1: renamed from eth0 kernel: virtio_net virtio2 ens3: renamed from eth2 systemd-udevd[299]: Error changing net interface name 'eth1' to 'ens3': File exists systemd-udevd[299]: could not rename interface '3' from 'eth1' to 'ens3': File exists (with commit [1] kernel assigns virtio2 to 3-2 slot since bridge advertises _SUN=0x3 and kernel assigns slot 3 to bridge. Still it manages to rename virtio2 correctly to ens3, however systemd gets confused with virtio1 where slot allocation exactly the same (2-2) as in 5.2 case and tries to rename it to ens3 which is rightfully taken by virtio2) I'm not sure what breaks in systemd interface renaming (it probably should be investigated), but on QEMU side we can safely revert _SUN to 5.2 behavior (i.e. avoid cold-plugged bridges and non hot-pluggable device classes), without breaking acpi-index, which uses slot numbers but it doesn't have to use _SUN, it could use an arbitrary variable name that has the same slot value). It will help existing VMs to keep networking with non trivial configs in working order since systemd will do its interface renaming magic as it used to do. 1) Fixes: b7f23f62e40 (pci: acpi: add _DSM method to PCI devices) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20210624204229.998824-3-imammedo@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: John Sucaet <john.sucaet@ekinops.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03migration: failover: reset partially_hotpluggedLaurent Vivier1-0/+1
When the card is plugged back, reset the partially_hotplugged flag to false Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1787194 Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20210629152937.619193-1-lvivier@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03virtio-pci: Changed return values for "notify", "device" and "isr" read.Andrew Melnychenko1-2/+7
At some point, after unplugging virtio-pci the virtio device may be unrealised, but the memory regions may be present in flatview. So, it's a possible situation when memory region's callbacks are called for "unplugged" device. Previous two patches made sure this case does not cause QEMU to crash. This patch adds check for "notify" memory region. Now reads will return "-1" if a virtio device is not present on a virtio bus. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1938042 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1743098 Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20210609095843.141378-4-andrew@daynix.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03virtio-pci: Added check for virtio device in PCI config cbs.Andrew Melnychenko1-0/+10
Now, if virtio device is not present on virtio-bus - pci config callbacks will not lead to possible crush. The read will return "-1" which should be interpreted by a driver that pci device may be unplugged. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20210609095843.141378-3-andrew@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03virtio-pci: Added check for virtio device presence in mm callbacks.Andrew Melnychenko1-0/+8
During unplug the virtio device is unplugged from virtio-bus on pci. In some cases, requests to virtio-pci mm may acquire during/after unplug. Added check that virtio device is on the bus, for "common" memory region. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20210609095843.141378-2-andrew@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-03hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH fieldPhilippe Mathieu-Daudé1-0/+3
libFuzzer triggered the following assertion: cat << EOF | qemu-system-i386 -M pc-q35-5.0 \ -nographic -monitor none -serial none \ -qtest stdio -d guest_errors -trace pci\* outl 0xcf8 0xf2000060 outl 0xcfc 0x8400056e EOF pci_cfg_write mch 00:0 @0x60 <- 0x8400056e Aborted (core dumped) This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD (reserved value) to the PCIE XBAR register. There is no indication on the datasheet about what occurs when this value is written. Simply ignore it on QEMU (and report an guest error): pci_cfg_write mch 00:0 @0x60 <- 0x8400056e Q35: Reserved PCIEXBAR LENGTH pci_cfg_read mch 00:0 @0x0 -> 0x8086 pci_cfg_read mch 00:0 @0x0 -> 0x29c08086 ... Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> BugLink: https://bugs.launchpad.net/qemu/+bug/1878641 Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210526142438.281477-1-f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-02hw/mips/jazz: Map the UART devices unconditionallyPhilippe Mathieu-Daudé1-10/+6
When using the Magnum ARC firmware we can see accesses to the UART1 being rejected, because the device is not mapped: $ qemu-system-mips64el -M magnum -d guest_errors,unimp -bios NTPROM.RAW Invalid access at addr 0x80007004, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007001, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007002, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007003, size 1, region '(null)', reason: rejected Invalid access at addr 0x80007004, size 1, region '(null)', reason: rejected Since both UARTs are present (soldered on the board) regardless of whether there are character devices connected, map them unconditionally. (This code pre-dated commit 12051d82f004 which made it safe to pass NULL in as a chardev to serial devices.) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210629053704.2584504-1-f4bug@amsat.org>
2021-07-02hw/mips/jazz: specify correct endian for dp8393x deviceMark Cave-Ayland1-1/+8
The MIPS magnum machines are available in both big endian (mips64) and little endian (mips64el) configurations. Ensure that the dp893x big_endian property is set accordingly using logic similar to that used for the MIPS malta machines. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-11-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/m68k/q800: fix PROM checksum and MAC address storageMark Cave-Ayland1-5/+2
The checksum used by MacOS to validate the PROM content is an exclusive-OR rather than a sum over the corresponding bytes. In addition the MAC address must be stored in bit-reversed format as indicated in comments in Linux's macsonic.c. With the PROM contents fixed MacOS starts to probe the device registers when AppleTalk is enabled in the Control Panel. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-8-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: remove onboard PROM containing MAC address and checksumMark Cave-Ayland1-24/+0
According to the datasheet the dp8393x chipset does not contain any NVRAM capable of storing a MAC address or checksum. Now that both the MIPS jazz and m68k q800 boards generate the PROM region and checksum themselves, remove the generated PROM from the dp8393x device itself. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/m68k/q800: move PROM and checksum calculation from dp8393x device to boardMark Cave-Ayland1-2/+22
This is in preparation for each board to have its own separate bit storage format and checksum for storing the MAC address. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/mips/jazz: move PROM and checksum calculation from dp8393x device to boardMark Cave-Ayland1-1/+22
This is in preparation for each board to have its own separate bit storage format and checksum for storing the MAC address. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: convert to trace-eventsMark Cave-Ayland2-35/+37
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: checkpatch fixesMark Cave-Ayland1-109/+122
Also fix a simple comment typo of "constrainst" to "constraints". Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02g364fb: add VMStateDescription for G364SysBusStateMark Cave-Ayland1-1/+11
Currently when QEMU attempts to migrate the MIPS magnum machine it crashes due to a mistake in the g364fb VMStateDescription configuration which expects a G364SysBusState and not a G364State. Resolve the issue by adding a new VMStateDescription for G364SysBusState and embedding the existing vmstate_g364fb VMStateDescription inside it using VMSTATE_STRUCT. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 97a3f6ffbba ("g364fb: convert to qdev") Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625163554.14879-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02g364fb: use RAM memory region for framebufferMark Cave-Ayland1-11/+9
Since the migration stream is already broken, we can use this opportunity to change the framebuffer so that it is migrated as a RAM memory region rather than as an array of bytes. In particular this helps the output of the analyze-migration.py tool which no longer contains a huge array representing the framebuffer contents. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625163554.14879-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02hw/pci-host/bonito: Allow PCI config accesses smaller than 32-bitPhilippe Mathieu-Daudé1-2/+2
When running the official PMON firmware for the Fuloong 2E, we see 8-bit and 16-bit accesses to PCI config space: $ qemu-system-mips64el -M fuloong2e -bios pmon_2e.bin \ -trace -trace bonito\* -trace pci_cfg\* pci_cfg_write vt82c686b-pm 05:4 @0x90 <- 0xeee1 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x4d2, size: 2 pci_cfg_write vt82c686b-pm 05:4 @0xd2 <- 0x1 pci_cfg_write vt82c686b-pm 05:4 @0x4 <- 0x1 pci_cfg_write vt82c686b-isa 05:0 @0x4 <- 0x7 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x81, size: 1 pci_cfg_read vt82c686b-isa 05:0 @0x81 -> 0x0 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x81, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x81 <- 0x80 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x83, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x83 <- 0x89 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x85, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x85 <- 0x3 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x5a, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x5a <- 0x7 bonito_spciconf_small_access PCI config address is smaller then 32-bit, addr: 0x85, size: 1 pci_cfg_write vt82c686b-isa 05:0 @0x85 <- 0x1 Also this is what the Linux kernel does since it supports the Bonito north bridge: https://elixir.bootlin.com/linux/v2.6.15/source/arch/mips/pci/ops-bonito64.c#L85 So it seems safe to assume the datasheet is incomplete or outdated regarding the address constraints. This problem was exposed by commit 911629e6d3773a8adeab48b ("vt82c686: Fix SMBus IO base and configuration registers"). Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210624202747.1433023-4-f4bug@amsat.org> Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
2021-07-02virtio: Clarify MR transaction optimizationGreg Kurz3-0/+48
The device model batching its ioeventfds in a single MR transaction is an optimization. Clarify this in virtio-scsi, virtio-blk and generic virtio code. Also clarify that the transaction must commit before closing ioeventfds so that no one is tempted to merge the loops in the start functions error path and in the stop functions. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <162125799728.1394228.339855768563326832.stgit@bahia.lan> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-02virtio: disable ioeventfd for record/replayPavel Dovgalyuk3-0/+18
virtio devices support separate iothreads waiting for events from file descriptors. These are asynchronous events that can't be recorded and replayed, therefore this patch disables ioeventfd for all devices when record or replay is enabled. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> Message-Id: <162125678869.1252810.4317416444097392406.stgit@pasha-ThinkPad-X280> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-02hw/gpio/gpio_pwr: use shutdown function for rebootMaxim Uvarov1-1/+1
qemu has 2 type of functions: shutdown and reboot. Shutdown function has to be used for machine shutdown. Otherwise we cause a reset with a bogus "cause" value, when we intended a shutdown. Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210625111842.3790-3-maxim.uvarov@linaro.org [PMM: tweaked commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-02hw/arm: Add basic power management to raspi.Nolan Leake3-1/+173
This is just enough to make reboot and poweroff work. Works for linux, u-boot, and the arm trusted firmware. Not tested, but should work for plan9, and bare-metal/hobby OSes, since they seem to generally do what linux does for reset. The watchdog timer functionality is not yet implemented. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/64 Signed-off-by: Nolan Leake <nolan@sigbus.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210625210209.1870217-1-nolan@sigbus.net [PMM: tweaked commit title; fixed region size to 0x200; moved header file to include/] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-02Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell13-110/+164
Block layer patches - Supporting changing 'file' in x-blockdev-reopen - ssh: add support for sha256 host key fingerprints - vhost-user-blk: Implement reconnection during realize - introduce QEMU_AUTO_VFREE - Don't require password of encrypted backing file for image creation - Code cleanups # gpg: Signature made Wed 30 Jun 2021 17:00:55 BST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (24 commits) vhost-user-blk: Implement reconnection during realize vhost-user-blk: Factor out vhost_user_blk_realize_connect() vhost: Distinguish errors in vhost_dev_get_config() vhost-user-blk: Add Error parameter to vhost_user_blk_start() vhost: Return 0/-errno in vhost_dev_init() vhost: Distinguish errors in vhost_backend_init() vhost: Add Error parameter to vhost_dev_init() block/ssh: add support for sha256 host key fingerprints block/commit: use QEMU_AUTO_VFREE introduce QEMU_AUTO_VFREE iotests: Test replacing files with x-blockdev-reopen block: Allow changing bs->file on reopen block: BDRVReopenState: drop replace_backing_bs field block: move supports_backing check to bdrv_set_file_or_backing_noperm() block: bdrv_reopen_parse_backing(): simplify handling implicit filters block: bdrv_reopen_parse_backing(): don't check frozen child block: bdrv_reopen_parse_backing(): don't check aio context block: introduce bdrv_set_file_or_backing_noperm() block: introduce bdrv_remove_file_or_backing_child() block: comment graph-modifying function not updating permissions ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-02hw/pci-host/bonito: Trace PCI config accesses smaller than 32-bitPhilippe Mathieu-Daudé2-0/+11
Per the datasheet section "5.7.5. Accessing PCI configuration space" the address must be 32-bit aligned. Trace eventual accesses not aligned to 32-bit. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210624202747.1433023-3-f4bug@amsat.org>
2021-06-30Merge remote-tracking branch 'remotes/nvme/tags/nvme-next-pull-request' into ↵Peter Maydell6-904/+1212
staging hw/nvme patches * namespace eui64 support (Heinrich) * aiocb refactoring (Klaus) * controller parameter for auto zone transitioning (Niklas) * misc fixes and additions (Gollu, Klaus, Keith) # gpg: Signature made Tue 29 Jun 2021 19:46:55 BST # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * remotes/nvme/tags/nvme-next-pull-request: (23 commits) hw/nvme: add 'zoned.zasl' to documentation hw/nvme: fix pin-based interrupt behavior (again) hw/nvme: fix missing check for PMR capability hw/nvme: documentation fix hw/nvme: fix endianess conversion and add controller list Partially revert "hw/block/nvme: drain namespaces on sq deletion" hw/nvme: reimplement format nvm to allow cancellation hw/nvme: reimplement zone reset to allow cancellation hw/nvme: reimplement the copy command to allow aio cancellation hw/nvme: add dw0/1 to the req completion trace event hw/nvme: use prinfo directly in nvme_check_prinfo and nvme_dif_check hw/nvme: remove assert from nvme_get_zone_by_slba hw/nvme: save reftag when generating pi hw/nvme: reimplement dsm to allow cancellation hw/nvme: add nvme_block_status_all helper hw/nvme: reimplement flush to allow cancellation hw/nvme: default for namespace EUI-64 hw/nvme: namespace parameter for EUI-64 hw/nvme: fix csi field for cns 0x00 and 0x11 hw/nvme: add param to control auto zone transitioning to zone state closed ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-30vhost-user-blk: Implement reconnection during realizeKevin Wolf1-1/+15
Commit dabefdd6 removed code that was supposed to try reconnecting during .realize(), but actually just crashed and had several design problems. This adds the feature back without the crash in simple cases while also fixing some design problems: Reconnection is now only tried if there was a problem with the connection and not an error related to the content (which would fail again the same way in the next attempt). Reconnection is limited to three attempts (four with the initial attempt) so that we won't end up in an infinite loop if a problem is permanent. If the backend restarts three times in the very short time window of device initialisation, we have bigger problems and erroring out is the right course of action. In the case that a connection error occurs and we reconnect, the error message is printed using error_report_err(), but otherwise ignored. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210609154658.350308-8-kwolf@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-06-30vhost-user-blk: Factor out vhost_user_blk_realize_connect()Kevin Wolf1-16/+32
This function is the part that we will want to retry if the connection is lost during initialisation, so factor it out to keep the following patch simpler. The error path for vhost_dev_get_config() forgot disconnecting the chardev, add this while touching the code. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210609154658.350308-7-kwolf@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-06-30vhost: Distinguish errors in vhost_dev_get_config()Kevin Wolf8-29/+43
Instead of just returning 0/-1 and letting the caller make up a meaningless error message, add an Error parameter to allow reporting the real error and switch to 0/-errno so that different kind of errors can be distinguished in the caller. config_len in vhost_user_get_config() is defined by the device, so if it's larger than VHOST_USER_MAX_CONFIG_SIZE, this is a programming error. Turn the corresponding check into an assertion. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210609154658.350308-6-kwolf@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-06-30vhost-user-blk: Add Error parameter to vhost_user_blk_start()Kevin Wolf1-16/+15
Instead of letting the caller make up a meaningless error message, add an Error parameter to allow reporting the real error. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210609154658.350308-5-kwolf@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
generated by cgit v1.1 at 2025-02-19 01:25:35 +0000