aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2020-08-28armsse: Define ARMSSEClass correctlyEduardo Habkost1-0/+1
TYPE_ARM_SSE is a TYPE_SYS_BUS_DEVICE subclass, but ARMSSEClass::parent_class is declared as DeviceClass. It never caused any problems by pure luck: We were not setting class_size for TYPE_ARM_SSE, so class_size of TYPE_SYS_BUS_DEVICE was being used (sizeof(SysBusDeviceClass)). This made the system allocate enough memory for TYPE_ARM_SSE devices even though ARMSSEClass was too small for a sysbus device. Additionally, the ARMSSEClass::info field ended up at the same offset as SysBusDeviceClass::explicit_ofw_unit_address. This would make sysbus_get_fw_dev_path() crash for the device. Luckily, sysbus_get_fw_dev_path() never gets called for TYPE_ARM_SSE devices, because qdev_get_fw_dev_path() is only used by the boot device code, and TYPE_ARM_SSE devices don't appear at the fw_boot_order list. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 20200826181006.4097163-1-ehabkost@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/misc/unimp: Display the offset with width of the region sizePhilippe Mathieu-Daudé1-4/+6
To have a better idea of how big is the region where the offset belongs, display the value with the width of the region size (i.e. a region of 0x1000 bytes uses 0x000 format). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200812190206.31595-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/misc/unimp: Display the value with width of the access sizePhilippe Mathieu-Daudé1-2/+2
To quickly notice the access size, display the value with the width of the access (i.e. 16-bit access is displayed 0x0000, while 8-bit access 0x00). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200812190206.31595-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/misc/unimp: Display value after offsetPhilippe Mathieu-Daudé1-4/+4
To better align the read/write accesses, display the value after the offset (read accesses only display the offset). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200812190206.31595-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/qdev-clock: Avoid calling qdev_connect_clock_in after DeviceRealizePhilippe Mathieu-Daudé1-0/+1
Clock canonical name is set in device_set_realized (see the block added to hw/core/qdev.c in commit 0e6934f264). If we connect a clock after the device is realized, this code is not executed. This is currently not a problem as this name is only used for trace events, however this disrupt tracing. Add a comment to document qdev_connect_clock_in() must be called before the device is realized, and assert this condition. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200803105647.22223-5-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/qdev-clock: Uninline qdev_connect_clock_in()Philippe Mathieu-Daudé1-0/+5
We want to assert the device is not realized. To avoid overloading this header including "hw/qdev-core.h", uninline the function first. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200803105647.22223-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/arm/xilinx_zynq: Call qdev_connect_clock_in() before DeviceRealizePhilippe Mathieu-Daudé1-9/+9
Clock canonical name is set in device_set_realized (see the block added to hw/core/qdev.c in commit 0e6934f264). If we connect a clock after the device is realized, this code is not executed. This is currently not a problem as this name is only used for trace events, however this disrupt tracing. Fix by calling qdev_connect_clock_in() before realizing. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200803105647.22223-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/arm/xilinx_zynq: Uninline cadence_uart_create()Philippe Mathieu-Daudé1-2/+12
As we want to call qdev_connect_clock_in() before the device is realized, we need to uninline cadence_uart_create() first. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200803105647.22223-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/net/allwinner-sun8i-emac: Use AddressSpace for DMA transfersPhilippe Mathieu-Daudé2-16/+32
Allow the device to execute the DMA transfers in a different AddressSpace. The H3 SoC keeps using the system_memory address space, but via the proper dma_memory_access() API. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-id: 20200814122907.27732-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/sd/allwinner-sdhost: Use AddressSpace for DMA transfersPhilippe Mathieu-Daudé3-6/+35
Allow the device to execute the DMA transfers in a different AddressSpace. The A10 and H3 SoC keep using the system_memory address space, but via the proper dma_memory_access() API. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-id: 20200814110057.307-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/arm/musicpal: Use AddressSpace for DMA transfersPhilippe Mathieu-Daudé1-14/+31
Allow the device to execute the DMA transfers in a different AddressSpace. We keep using the system_memory address space, but via the proper dma_memory_access() API. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200814125533.4047-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/clock: Let clock_set() return boolean valuePhilippe Mathieu-Daudé1-1/+6
Let clock_set() return a boolean value whether the clock has been updated or not. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200806123858.30058-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-28hw/arm/sbsa-ref: fix typo breaking PCIe IRQsGraeme Gregory1-1/+1
Fixing a typo in a previous patch that translated an "i" to a 1 and therefore breaking the allocation of PCIe interrupts. This was discovered when virtio-net-pci devices ceased to function correctly. Cc: qemu-stable@nongnu.org Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state") Signed-off-by: Graeme Gregory <graeme@nuviainc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200821083853.356490-1-graeme@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-27Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell18-26/+164
virtio,pc,acpi: features, fixes better number of queues for vhost smbios speed options acpi fixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 27 Aug 2020 13:33:49 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: tests/bios-tables-test: add smbios cpu speed test hw/smbios: add options for type 4 max-speed and current-speed vhost-user-blk-pci: default num_queues to -smp N virtio-blk-pci: default num_queues to -smp N virtio-scsi-pci: default num_queues to -smp N virtio-scsi: introduce a constant for fixed virtqueues virtio-pci: add virtio_pci_optimal_num_queues() helper Introduce a new flag for i440fx to disable PCI hotplug on the root bus acpi: update expected DSDT files with _UID changes disassemble-aml: -o actually works arm/acpi: fix an out of spec _UID for PCI root i386/acpi: fix inconsistent QEMU/OVMF device paths acpi: allow DSDT changes Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-27hw/smbios: add options for type 4 max-speed and current-speedYing Fang1-4/+32
Common VM users sometimes care about CPU speed, so we add two new options to allow VM vendors to present CPU speed to their users. Normally these information can be fetched from host smbios. Strictly speaking, the "max speed" and "current speed" in type 4 are not really for the max speed and current speed of processor, for "max speed" identifies a capability of the system, and "current speed" identifies the processor's speed at boot (see smbios spec), but some applications do not tell the differences. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Ying Fang <fangying1@huawei.com> Signed-off-by: Heyi Guo <guoheyi@huawei.com> Message-Id: <20200806035634.376-2-fangying1@huawei.com>
2020-08-27vhost-user-blk-pci: default num_queues to -smp NStefan Hajnoczi3-1/+10
Automatically size the number of request virtqueues to match the number of vCPUs. This ensures that completion interrupts are handled on the same vCPU that submitted the request. No IPI is necessary to complete an I/O request and performance is improved. The maximum number of MSI-X vectors and virtqueues limit are respected. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <20200818143348.310613-8-stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-08-27virtio-blk-pci: default num_queues to -smp NStefan Hajnoczi3-2/+12
Automatically size the number of virtio-blk-pci request virtqueues to match the number of vCPUs. Other transports continue to default to 1 request virtqueue. A 1:1 virtqueue:vCPU mapping ensures that completion interrupts are handled on the same vCPU that submitted the request. No IPI is necessary to complete an I/O request and performance is improved. The maximum number of MSI-X vectors and virtqueues limit are respected. Performance improves from 78k to 104k IOPS on a 32 vCPU guest with 101 virtio-blk-pci devices (ioengine=libaio, iodepth=1, bs=4k, rw=randread with NVMe storage). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com> Message-Id: <20200818143348.310613-7-stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-08-27virtio-scsi-pci: default num_queues to -smp NStefan Hajnoczi7-13/+35
Automatically size the number of virtio-scsi-pci, vhost-scsi-pci, and vhost-user-scsi-pci request virtqueues to match the number of vCPUs. Other transports continue to default to 1 request virtqueue. A 1:1 virtqueue:vCPU mapping ensures that completion interrupts are handled on the same vCPU that submitted the request. No IPI is necessary to complete an I/O request and performance is improved. The maximum number of MSI-X vectors and virtqueues limit are respected. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200818143348.310613-6-stefanha@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-08-27virtio-scsi: introduce a constant for fixed virtqueuesStefan Hajnoczi5-7/+11
The event and control virtqueues are always present, regardless of the multi-queue configuration. Define a constant so that virtqueue number calculations are easier to read. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <20200818143348.310613-5-stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-08-27virtio-pci: add virtio_pci_optimal_num_queues() helperStefan Hajnoczi2-0/+41
Multi-queue devices achieve the best performance when each vCPU has a dedicated queue. This ensures that virtqueue used notifications are handled on the same vCPU that submitted virtqueue buffers. When another vCPU handles the the notification an IPI will be necessary to wake the submission vCPU and this incurs a performance overhead. Provide a helper function that virtio-pci devices will use in later patches to automatically select the optimal number of queues. The function handles guests with large numbers of CPUs by limiting the number of queues to fit within the following constraints: 1. The maximum number of MSI-X vectors. 2. The maximum number of virtqueues. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200818143348.310613-4-stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-08-27Introduce a new flag for i440fx to disable PCI hotplug on the root busAni Sinha2-2/+26
We introduce a new global flag 'acpi-root-pci-hotplug' for i440fx with which we can turn on or off PCI device hotplug on the root bus. This flag can be used to prevent all PCI devices from getting hotplugged or unplugged from the root PCI bus. This feature is targetted mostly towards Windows VMs. It is useful in cases where some hypervisor admins want to deploy guest VMs in a way so that the users of the guest OSes are not able to hot-eject certain PCI devices from the Windows system tray. Laine has explained the use case here in detail: https://www.redhat.com/archives/libvir-list/2020-February/msg00110.html Julia has resolved this issue for PCIE buses with the following commit: 530a0963184e57e71a5b538 ("pcie_root_port: Add hotplug disabling option") This commit attempts to introduce similar behavior for PCI root buses used in i440fx machine types (although in this case, we do not have a per-slot capability to turn hotplug on or off). Usage: -global PIIX4_PM.acpi-root-pci-hotplug=off By default, this option is enabled which means that hotplug is turned on for the PCI root bus. The previously existing flag 'acpi-pci-hotplug-with-bridge-support' for PCI-PCI bridges remain as is and can be used along with this new flag to control PCI hotplug on PCI bridges. This change has been tested using a Windows 2012R2 server guest image and also with a Windows 2019 server guest image on a Ubuntu 18.04 host using the latest master qemu from upstream. Signed-off-by: Ani Sinha <ani@anisinha.ca> Message-Id: <20200821165403.26589-1-ani@anisinha.ca> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2020-08-27arm/acpi: fix an out of spec _UID for PCI rootMichael S. Tsirkin1-1/+1
On ARM/virt machine type QEMU currently reports an incorrect _UID in ACPI. The particular node in question is the primary PciRoot (PCI0 in ACPI), which gets assigned PCI0 in ACPI UID and 0 in the DevicePath. This is due to the _UID assigned to it by build_dsdt in hw/arm/virt-acpi-build.c Which does not correspond to the primary PCI identifier given by pcibus_num in hw/pci/pci.c In UEFI v2.8, section "10.4.2 Rules with ACPI _HID and _UID" ends with the paragraph, Root PCI bridges will use the plug and play ID of PNP0A03, This will be stored in the ACPI Device Path _HID field, or in the Expanded ACPI Device Path _CID field to match the ACPI name space. The _UID in the ACPI Device Path structure must match the _UID in the ACPI name space. (See especially the last sentence.) A similar bug has been reported on i386, on that architecture it has been reported to confuse at least macOS which uses ACPI UIDs to build the DevicePath for NVRAM boot options, while OVMF firmware gets them via an internal channel through QEMU. When UEFI firmware and ACPI have different values, this makes the underlying operating system unable to report its boot option. Cc: qemu-stable@nongnu.org Reported-by: Vitaly Cheptsov <vit9696@protonmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2020-08-27i386/acpi: fix inconsistent QEMU/OVMF device pathsMichael S. Tsirkin1-2/+2
macOS uses ACPI UIDs to build the DevicePath for NVRAM boot options, while OVMF firmware gets them via an internal channel through QEMU. Due to a bug in QEMU ACPI currently UEFI firmware and ACPI have different values, and this makes the underlying operating system unable to report its boot option. The particular node in question is the primary PciRoot (PCI0 in ACPI), which for some reason gets assigned 1 in ACPI UID and 0 in the DevicePath. This is due to the _UID assigned to it by build_dsdt in hw/i386/acpi-build.c Which does not correspond to the primary PCI identifier given by pcibus_num in hw/pci/pci.c Reference with the device paths, OVMF startup logs, and ACPI table dumps (SysReport): https://github.com/acidanthera/bugtracker/issues/1050 In UEFI v2.8, section "10.4.2 Rules with ACPI _HID and _UID" ends with the paragraph, Root PCI bridges will use the plug and play ID of PNP0A03, This will be stored in the ACPI Device Path _HID field, or in the Expanded ACPI Device Path _CID field to match the ACPI name space. The _UID in the ACPI Device Path structure must match the _UID in the ACPI name space. (See especially the last sentence.) Considering *extra* root bridges / root buses (with bus number > 0), QEMU's ACPI generator actually does the right thing; since QEMU commit c96d9286a6d7 ("i386/acpi-build: more traditional _UID and _HID for PXB root buses", 2015-06-11). However, the _UID values for root bridge zero (on both i440fx and q35) have always been "wrong" (from UEFI perspective), going back in QEMU to commit 74523b850189 ("i386: add ACPI table files from seabios", 2013-10-14). Even in SeaBIOS, these _UID values have always been 1; see commit a4d357638c57 ("Port rombios32 code from bochs-bios.", 2008-03-08) for i440fx, and commit ecbe3fd61511 ("seabios: q35: add dsdt", 2012-12-01) for q35. Cc: qemu-stable@nongnu.org Suggested-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Vitaly Cheptsov <vit9696@protonmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2020-08-27hw/vfio/ap: Plug memleak in vfio_ap_get_group()Pan Nengyuan1-0/+1
Missing g_error_free() in vfio_ap_get_group() error path. Fix that. Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-Id: <20200814160241.7915-3-pannengyuan@huawei.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-08-27virtio-ccw-input: fix descriptionCornelia Huck1-1/+1
Fix a copy/paste error. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20200728102820.273598-1-cohuck@redhat.com>
2020-08-26Merge remote-tracking branch ↵Peter Maydell4-76/+148
'remotes/hdeller/tags/target-hppa-v3-pull-request' into staging artist out of bounds fixes # gpg: Signature made Wed 26 Aug 2020 22:09:55 BST # gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F # gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown] # gpg: aka "Helge Deller <deller@kernel.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603 # Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F * remotes/hdeller/tags/target-hppa-v3-pull-request: hw/display/artist: Fix invalidation of lines near screen border hw/display/artist: Fix invalidation of lines in artist_draw_line() hw/display/artist: Unbreak size mismatch memory accesses hw/display/artist: Prevent out of VRAM buffer accesses Revert "hw/display/artist: Avoid drawing line when nothing to display" hw/display/artist: Refactor artist_rop8() to avoid buffer over-run hw/display/artist: Check offset in draw_line to avoid buffer over-run hw/hppa/lasi: Don't abort on invalid IMR value hw/display/artist.c: fix out of bounds check hw/hppa: Implement proper SeaBIOS version check seabios-hppa: Update to SeaBIOS hppa version 1 hw/hppa: Sync hppa_hardware.h file with SeaBIOS sources Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-26hw/display/artist: Fix invalidation of lines near screen borderSven Schnelle1-1/+6
If parts of the invalidated screen lines are outside of the VRAM buffer, the code skips the whole invalidate. This is incorrect when only parts of the buffer are invisble - which is the case when the mouse cursor is located near the screen border. Signed-off-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/display/artist: Fix invalidation of lines in artist_draw_line()Sven Schnelle1-1/+4
The old code didn't invalidate correctly when vertical lines were drawn. Fix this and move the invalidation out of the loop. Signed-off-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/display/artist: Unbreak size mismatch memory accessesHelge Deller1-8/+4
Commit 5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid") broke the artist driver in a way that the dtwm window manager on HP-UX rendered wrong. Fixes: 5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid") Signed-off-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/display/artist: Prevent out of VRAM buffer accessesHelge Deller1-41/+69
Simplify various bounds checks by changing parameters like row and column numbers to become unsigned instead of signed. With that we can check if the calculated offset is bigger than the size of the VRAM region and bail out if not. Reported-by: LLVM libFuzzer Reported-by: Alexander Bulekov <alxndr@bu.edu> Buglink: https://bugs.launchpad.net/qemu/+bug/1880326 Buglink: https://bugs.launchpad.net/qemu/+bug/1890310 Buglink: https://bugs.launchpad.net/qemu/+bug/1890311 Buglink: https://bugs.launchpad.net/qemu/+bug/1890312 Buglink: https://bugs.launchpad.net/qemu/+bug/1890370 Acked-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26Revert "hw/display/artist: Avoid drawing line when nothing to display"Helge Deller1-3/+0
This reverts commit b0f6455feac97e41045ee394e11c24d92c370f6e. It's wrong. A line could even be a dot. Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/display/artist: Refactor artist_rop8() to avoid buffer over-runPhilippe Mathieu-Daudé1-15/+25
Invalid I/O writes can craft an offset out of the vram_buffer range. Instead of passing an unsafe pointer to artist_rop8(), pass the vram_buffer and the offset. We can now check if the offset is in range before accessing it. We avoid: Program terminated with signal SIGSEGV, Segmentation fault. 284 *dst &= ~plane_mask; (gdb) bt #0 0x000056367b2085c0 in artist_rop8 (s=0x56367d38b510, dst=0x7f9f972fffff <error: Cannot access memory at address 0x7f9f972fffff>, val=0 '\000') at hw/display/artist.c:284 #1 0x000056367b209325 in draw_line (s=0x56367d38b510, x1=-20480, y1=-1, x2=0, y2=17920, update_start=true, skip_pix=-1, max_pix=-1) at hw/display/artist.c:646 Reported-by: LLVM libFuzzer Buglink: https://bugs.launchpad.net/qemu/+bug/1880326 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/display/artist: Check offset in draw_line to avoid buffer over-runPhilippe Mathieu-Daudé1-2/+7
Invalid I/O writes can craft an offset out of the vram_buffer range. We avoid: Program terminated with signal SIGSEGV, Segmentation fault. 284 *dst &= ~plane_mask; (gdb) bt #0 0x000055d5dccdc5c0 in artist_rop8 (s=0x55d5defee510, dst=0x7f8e84ed8216 <error: Cannot access memory at address 0x7f8e84ed8216>, val=0 '\000') at hw/display/artist.c:284 #1 0x000055d5dccdcf83 in fill_window (s=0x55d5defee510, startx=22, starty=5674, width=65, height=5697) at hw/display/artist.c:551 #2 0x000055d5dccddfb9 in artist_reg_write (opaque=0x55d5defee510, addr=1051140, val=4265537, size=4) at hw/display/artist.c:902 #3 0x000055d5dcb42a7c in memory_region_write_accessor (mr=0x55d5defeea10, addr=1051140, value=0x7ffe57db08c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:483 Reported-by: LLVM libFuzzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/hppa/lasi: Don't abort on invalid IMR valueHelge Deller1-2/+6
NetBSD initializes the LASI IMR value with 0xffffffff to disable all LASI interrupts. This triggered an assert() and stopped the emulation. By replacing the check with a warning in the guest log we now allow NetBSD to boot again. Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-25hw/riscv: virt: Allow creating multiple NUMA socketsAnup Patel1-227/+299
We extend RISC-V virt machine to allow creating a multi-socket machine. Each RISC-V virt machine socket is a NUMA node having a set of HARTs, a memory instance, a CLINT instance, and a PLIC instance. Other devices are shared between all sockets. We also update the generated device tree accordingly. By default, NUMA multi-socket support is disabled for RISC-V virt machine. To enable it, users can use "-numa" command-line options of QEMU. Example1: For two NUMA nodes with 2 CPUs each, append following to command-line options: "-smp 4 -numa node -numa node" Example2: For two NUMA nodes with 1 and 3 CPUs, append following to command-line options: "-smp 4 -numa node -numa node -numa cpu,node-id=0,core-id=0 \ -numa cpu,node-id=1,core-id=1 -numa cpu,node-id=1,core-id=2 \ -numa cpu,node-id=1,core-id=3" The maximum number of sockets in a RISC-V virt machine is 8 but this limit can be changed in future. Signed-off-by: Anup Patel <anup.patel@wdc.com> Reviewed-by: Atish Patra <atish.patra@wdc.com> Message-Id: <20200616032229.766089-6-anup.patel@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-08-25hw/riscv: spike: Allow creating multiple NUMA socketsAnup Patel1-74/+158
We extend RISC-V spike machine to allow creating a multi-socket machine. Each RISC-V spike machine socket is a NUMA node having a set of HARTs, a memory instance, and a CLINT instance. Other devices are shared between all sockets. We also update the generated device tree accordingly. By default, NUMA multi-socket support is disabled for RISC-V spike machine. To enable it, users can use "-numa" command-line options of QEMU. Example1: For two NUMA nodes with 2 CPUs each, append following to command-line options: "-smp 4 -numa node -numa node" Example2: For two NUMA nodes with 1 and 3 CPUs, append following to command-line options: "-smp 4 -numa node -numa node -numa cpu,node-id=0,core-id=0 \ -numa cpu,node-id=1,core-id=1 -numa cpu,node-id=1,core-id=2 \ -numa cpu,node-id=1,core-id=3" The maximum number of sockets in a RISC-V spike machine is 8 but this limit can be changed in future. Signed-off-by: Anup Patel <anup.patel@wdc.com> Reviewed-by: Atish Patra <atish.patra@wdc.com> Message-Id: <20200616032229.766089-5-anup.patel@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-08-25hw/riscv: Add helpers for RISC-V multi-socket NUMA machinesAnup Patel2-0/+243
We add common helper routines which can be shared by RISC-V multi-socket NUMA machines. We have two types of helpers: 1. riscv_socket_xyz() - These helper assist managing multiple sockets irrespective whether QEMU NUMA is enabled/disabled 2. riscv_numa_xyz() - These helpers assist in providing necessary QEMU machine callbacks for QEMU NUMA emulation Signed-off-by: Anup Patel <anup.patel@wdc.com> Reviewed-by: Atish Patra <atish.patra@wdc.com> Message-Id: <20200616032229.766089-4-anup.patel@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-08-25hw/riscv: Allow creating multiple instances of PLICAnup Patel4-14/+16
We extend PLIC emulation to allow multiple instances of PLIC in a QEMU RISC-V machine. To achieve this, we remove first HART id zero assumption from PLIC emulation. Signed-off-by: Anup Patel <anup.patel@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200616032229.766089-3-anup.patel@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-08-25hw/riscv: Allow creating multiple instances of CLINTAnup Patel5-12/+16
We extend CLINT emulation to allow multiple instances of CLINT in a QEMU RISC-V machine. To achieve this, we remove first HART id zero assumption from CLINT emulation. Signed-off-by: Anup Patel <anup.patel@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Message-Id: <20200616032229.766089-2-anup.patel@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-08-24Merge remote-tracking branch 'remotes/xtensa/tags/20200821-xtensa' into stagingPeter Maydell1-1/+5
target/xtensa updates for 5.2: - add NMI support; - add DFPU option implementation; - update FPU tests to support both FPU2000 and DFPU; - add example cores with FPU2000 and DFPU. # gpg: Signature made Fri 21 Aug 2020 21:09:37 BST # gpg: using RSA key 2B67854B98E5327DCDEB17D851F9CC91F83FA044 # gpg: issuer "jcmvbkbc@gmail.com" # gpg: Good signature from "Max Filippov <filippov@cadence.com>" [unknown] # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" [full] # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" [full] # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20200821-xtensa: (24 commits) target/xtensa: import DSP3400 core target/xtensa: import de233_fpu core tests/tcg/xtensa: add DFP0 arithmetic tests tests/tcg/xtensa: test double precision load/store tests/tcg/xtensa: add fp0 div and sqrt tests tests/tcg/xtensa: update test_lsc for DFPU tests/tcg/xtensa: update test_fp1 for DFPU tests/tcg/xtensa: update test_fp0_conv for DFPU tests/tcg/xtensa: expand madd tests tests/tcg/xtensa: update test_fp0_arith for DFPU tests/tcg/xtensa: fix test execution on ISS target/xtensa: implement FPU division and square root target/xtensa: add DFPU registers and opcodes target/xtensa: add DFPU option target/xtensa: don't access BR regfile directly target/xtensa: move FSR/FCR register accessors target/xtensa: rename FPU2000 translators and helpers target/xtensa: support copying registers up to 64 bits wide target/xtensa: add geometry to xtensa_get_regfile_by_name softfloat: add xtensa specialization for pickNaNMulAdd ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20200812' ↵Peter Maydell4-94/+333
into staging 9pfs: Fix severe performance issue of Treaddir requests. # gpg: Signature made Wed 12 Aug 2020 11:06:21 BST # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * remotes/cschoenebeck/tags/pull-9p-20200812: 9pfs: clarify latency of v9fs_co_run_in_worker() 9pfs: differentiate readdir lock between 9P2000.u vs. 9P2000.L 9pfs: T_readdir latency optimization 9pfs: add new function v9fs_co_readdir_many() 9pfs: split out fs driver core of v9fs_co_readdir() 9pfs: make v9fs_readdir_response_size() public tests/virtio-9p: added split readdir tests Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24Merge remote-tracking branch ↵Peter Maydell6-147/+251
'remotes/pmaydell/tags/pull-target-arm-20200824' into staging target-arm queue: * hw/cpu/a9mpcore: Verify the machine use Cortex-A9 cores * hw/arm/smmuv3: Implement SMMUv3.2 range-invalidation * docs/system/arm: Document the Xilinx Versal Virt board * target/arm: Make M-profile NOCP take precedence over UNDEF * target/arm: Use correct FPST for VCMLA, VCADD on fp16 * target/arm: Various cleanups preparing for fp16 support # gpg: Signature made Mon 24 Aug 2020 10:47:14 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200824: (27 commits) target/arm: Use correct FPST for VCMLA, VCADD on fp16 target/arm: Implement FPST_STD_F16 fpstatus target/arm: Make A32/T32 use new fpstatus_ptr() API target/arm: Replace A64 get_fpstatus_ptr() with generic fpstatus_ptr() target/arm: Delete unused ARM_FEATURE_CRC target/arm/translate.c: Delete/amend incorrect comments target/arm: Delete unused VFP_DREG macros target/arm: Remove ARCH macro target/arm: Convert T32 coprocessor insns to decodetree target/arm: Do M-profile NOCP checks early and via decodetree target/arm: Tidy up disas_arm_insn() target/arm: Convert A32 coprocessor insns to decodetree target/arm: Separate decode from handling of coproc insns target/arm: Pull handling of XScale insns out of disas_coproc_insn() docs/system/arm: Document the Xilinx Versal Virt board hw/arm/smmuv3: Advertise SMMUv3.2 range invalidation hw/arm/smmuv3: Support HAD and advertise SMMUv3.1 support hw/arm/smmuv3: Let AIDR advertise SMMUv3.0 support hw/arm/smmuv3: Fix IIDR offset hw/arm/smmuv3: Get prepared for range invalidation ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmuv3: Advertise SMMUv3.2 range invalidationEric Auger2-0/+2
Expose the RIL bit so that the guest driver uses range invalidation. Although RIL is a 3.2 features, We let the AIDR advertise SMMUv3.1 support as v3.x implementation is allowed to implement features from v3.(x+1). Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-12-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmuv3: Support HAD and advertise SMMUv3.1 supportEric Auger4-3/+9
HAD is a mandatory features with SMMUv3.1 if S1P is set, which is our case. Other 3.1 mandatory features come with S2P which we don't have. So let's support HAD and advertise SMMUv3.1 support in AIDR. HAD support allows the CD to disable hierarchical attributes, ie. if the HAD0/1 bit is set, the APTable field of table descriptors walked through TTB0/1 is ignored. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-11-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmuv3: Let AIDR advertise SMMUv3.0 supportEric Auger2-0/+4
Add the support for AIDR register. It currently advertises SMMU V3.0 spec. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-10-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmuv3: Fix IIDR offsetEric Auger1-1/+1
The SMMU IIDR register is at 0x018 offset. Fixes: 10a83cb9887 ("hw/arm/smmuv3: Skeleton") Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-9-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmuv3: Get prepared for range invalidationEric Auger4-30/+67
Enhance the smmu_iotlb_inv_iova() helper with range invalidation. This uses the new fields passed in the NH_VA and NH_VAA commands: the size of the range, the level and the granule. As NH_VA and NH_VAA both use those fields, their decoding and handling is factorized in a new smmuv3_s1_range_inval() helper. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-8-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmuv3: Introduce smmuv3_s1_range_inval() helperEric Auger2-21/+18
Let's introduce an helper for S1 IOVA range invalidation. This will be used for NH_VA and NH_VAA commands. It decodes the same fields, trace, calls the UNMAP notifiers and invalidate the corresponding IOTLB entries. At the moment, we do not support 3.2 range invalidation yet. So it reduces to a single IOVA invalidation. Note the leaf bit now is also decoded for the CMD_TLBI_NH_VAA command. At the moment it is only used for tracing. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-7-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmu-common: Manage IOTLB block entriesEric Auger4-22/+60
At the moment each entry in the IOTLB corresponds to a page sized mapping (4K, 16K or 64K), even if the page belongs to a mapped block. In case of block mapping this unefficiently consumes IOTLB entries. Change the value of the entry so that it reflects the actual mapping it belongs to (block or page start address and size). Also the level/tg of the entry is encoded in the key. In subsequent patches we will enable range invalidation. This latter is able to provide the level/tg of the entry. Encoding the level/tg directly in the key will allow to invalidate using g_hash_table_remove() when num_pages equals to 1. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-6-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-08-24hw/arm/smmu: Introduce SMMUTLBEntry for PTW and IOTLB valueEric Auger2-20/+22
Introduce a specialized SMMUTLBEntry to store the result of the PTW and cache in the IOTLB. This structure extends the generic IOMMUTLBEntry struct with the level of the entry and the granule size. Those latter will be useful when implementing range invalidation. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200728150815.11446-5-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-01-15 06:52:07 +0000