aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2023-04-24hw/pci-bridge: pci_expander_bridge fix type in pxb_cxl_dev_reset()Jonathan Cameron1-1/+1
Reproduce issue with configure --enable-qom-cast-debug ... qemu-system-x86_64 -display none -machine q35,cxl=on -device pxb-cxl,bus=pcie.0 hw/pci-bridge/pci_expander_bridge.c:54:PXB_DEV: Object 0x5570e0b1ada0 is not an instance of type pxb Aborted The type conversion results in the right state structure, but PXB_DEV is not a parent of PXB_CXL_DEV hence the error. Rather than directly cleaning up the inheritance, this is the minimal fix which will be followed by the cleanup. Fixes: 154070eaf6 ("hw/pxb-cxl: Support passthrough HDM Decoders unless overridden") Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20230420142750.6950-2-Jonathan.Cameron@huawei.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-24docs/specs: Convert pci-serial.txt to rstPeter Maydell2-2/+2
Convert pci-serial.txt to reStructuredText. This includes some wordsmithing, and the correction of the docs to note that the Windows inf file includes 2x and 4x support (as it has done since commit dc9528fdf9f61 in 2014). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20230420160334.1048224-3-peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-04-24acpi: pcihp: allow repeating hot-unplug requestsIgor Mammedov1-0/+10
with Q35 using ACPI PCI hotplug by default, user's request to unplug device is ignored when it's issued before guest OS has been booted. And any additional attempt to request device hot-unplug afterwards results in following error: "Device XYZ is already in the process of unplug" arguably it can be considered as a regression introduced by [2], before which it was possible to issue unplug request multiple times. Accept new uplug requests after timeout (1ms). This brings ACPI PCI hotplug on par with native PCIe unplug behavior [1] and allows user to repeat unplug requests at propper times. Set expire timeout to arbitrary 1msec so user won't be able to flood guest with SCI interrupts by calling device_del in tight loop. PS: ACPI spec doesn't mandate what OSPM can do with GPEx.status bits set before it's booted => it's impl. depended. Status bits may be retained (I tested with one Windows version) or cleared (Linux since 2.6 kernel times) during guest's ACPI subsystem initialization. Clearing status bits (though not wrong per se) hides the unplug event from guest, and it's upto user to repeat device_del later when guest is able to handle unplug requests. 1) 18416c62e3 ("pcie: expire pending delete") 2) Fixes: cce8944cc9ef ("qdev-monitor: Forbid repeated device_del") Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> CC: mst@redhat.com CC: anisinha@redhat.com CC: jusual@redhat.com CC: kraxel@redhat.com Message-Id: <20230418090449.2155757-1-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Ani Sinha <anisinha@redhat.com>
2023-04-24virtio: i2c: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDXViresh Kumar1-0/+16
Since the driver doesn't support interrupts, we must return early when index is set to VIRTIO_CONFIG_IRQ_IDX. Fixes: 544f0278afca ("virtio: introduce macro VIRTIO_CONFIG_IRQ_IDX") Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Message-Id: <d53ec8bc002001eafac597f6bd9a8812df989257.1681790067.git.viresh.kumar@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-24intel_iommu: refine iotlb hash calculationJason Wang2-7/+8
Commit 1b2b12376c8 ("intel-iommu: PASID support") takes PASID into account when calculating iotlb hash like: static guint vtd_iotlb_hash(gconstpointer v) { const struct vtd_iotlb_key *key = v; return key->gfn | ((key->sid) << VTD_IOTLB_SID_SHIFT) | (key->level) << VTD_IOTLB_LVL_SHIFT | (key->pasid) << VTD_IOTLB_PASID_SHIFT; } This turns out to be problematic since: - the shift will lose bits if not converting to uint64_t - level should be off by one in order to fit into 2 bits - VTD_IOTLB_PASID_SHIFT is 30 but PASID is 20 bits which will waste some bits - the hash result is uint64_t so we will lose bits when converting to guint So this patch fixes them by - converting the keys into uint64_t before doing the shift - off level by one to make it fit into two bits - change the sid, lvl and pasid shift to 26, 42 and 44 in order to take the full width of uint64_t - perform an XOR to the top 32bit with the bottom 32bit for the final result to fit guint Fixes: Coverity CID 1508100 Fixes: 1b2b12376c8 ("intel-iommu: PASID support") Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <20230412073510.7158-1-jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com>
2023-04-24hw/acpi: limit warning on acpi table size to pc machines older than version 2.3Ani Sinha3-2/+6
i440fx machine versions 2.3 and newer supports dynamic ram resizing. See commit a1666142db6233 ("acpi-build: make ROMs RAM blocks resizeable") . Currently supported all q35 machine types (versions 2.4 and newer) supports resizable RAM/ROM blocks.Therefore the warning generated when the ACPI table size exceeds a pre-defined value does not apply to those machine versions. Add a check limiting the warning message to only those machines that does not support expandable ram blocks (that is, i440fx machines with version 2.2 and older). Signed-off-by: Ani Sinha <anisinha@redhat.com> Message-Id: <20230329045726.14028-1-anisinha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21pci: avoid accessing slot_reserved_mask directly outside of pci.cChuck Zmudzinski3-8/+21
This patch provides accessor functions as replacements for direct access to slot_reserved_mask according to the comment at the top of include/hw/pci/pci_bus.h which advises that data structures for PCIBus should not be directly accessed but instead be accessed using accessor functions in pci.h. Three accessor functions can conveniently replace all direct accesses of slot_reserved_mask. With this patch, the new accessor functions are used in hw/sparc64/sun4u.c and hw/xen/xen_pt.c and pci_bus.h is removed from the included header files of the same two files. No functional change intended. Signed-off-by: Chuck Zmudzinski <brchuckz@aol.com> Message-Id: <b1b7f134883cbc83e455abbe5ee225c71aa0e8d0.1678888385.git.brchuckz@aol.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> [sun4u]
2023-04-21hw: Add compat machines for 8.1Cornelia Huck8-10/+73
Add 8.1 machine types for arm/i440fx/m68k/q35/s390x/spapr. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20230314173009.152667-1-cohuck@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21hw/i386/amd_iommu: Factor amdvi_pci_realize out of amdvi_sysbus_realizePhilippe Mathieu-Daudé2-28/+39
Aside the Frankenstein model of a SysBusDevice realizing a PCIDevice, QOM parents shouldn't access children internals. In this particular case, amdvi_sysbus_realize() is just open-coding TYPE_AMD_IOMMU_PCI's DeviceRealize() handler. Factor it out. Declare QOM-cast macros with OBJECT_DECLARE_SIMPLE_TYPE() so we can cast the AMDVIPCIState in amdvi_pci_realize(). Note this commit removes the single use in the repository of pci_add_capability() and msi_init() on a *realized* QDev instance. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230313153031.86107-7-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21hw/i386/amd_iommu: Set PCI static/const fields via PCIDeviceClassPhilippe Mathieu-Daudé1-2/+4
Set PCI static/const fields once in amdvi_pci_class_init. They will be propagated via DeviceClassRealize handler via pci_qdev_realize() -> do_pci_register_device() -> pci_config_set*(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230313153031.86107-6-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21hw/i386/amd_iommu: Move capab_offset from AMDVIState to AMDVIPCIStatePhilippe Mathieu-Daudé3-9/+9
The 'PCI capability offset' is a *PCI* notion. Since AMDVIPCIState inherits PCIDevice and hold PCI-related fields, move capab_offset from AMDVIState to AMDVIPCIState. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230313153031.86107-5-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21hw/i386/amd_iommu: Remove intermediate AMDVIState::devid fieldPhilippe Mathieu-Daudé3-5/+3
AMDVIState::devid is only accessed by build_amd_iommu() which has access to the PCIDevice state. Directly get the property calling object_property_get_int() there. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230313153031.86107-4-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21hw/i386/amd_iommu: Explicit use of AMDVI_BASE_ADDR in amdvi_initPhilippe Mathieu-Daudé1-2/+2
By accessing MemoryRegion internals, amdvi_init() gives the false idea that the PCI BAR can be modified. However this isn't true (at least the model isn't ready for that): the device is explicitly maps at the BAR at the fixed AMDVI_BASE_ADDR address in amdvi_sysbus_realize(). Since the SysBus API isn't designed to remap regions, directly use the fixed address in amdvi_init(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230313153031.86107-3-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21virtio-balloon: optimize the virtio-balloon on the ARM platformYangming2-28/+12
Optimize the virtio-balloon feature on the ARM platform by adding a variable to keep track of the current hot-plugged pc-dimm size, instead of traversing the virtual machine's memory modules to count the current RAM size during the balloon inflation or deflation process. This variable can be updated only when plugging or unplugging the device, which will result in an increase of approximately 60% efficiency of balloon process on the ARM platform. We tested the total amount of time required for the balloon inflation process on ARM: inflate the balloon to 64GB of a 128GB guest under stress. Before: 102 seconds After: 42 seconds Signed-off-by: Qi Xi <xiqi2@huawei.com> Signed-off-by: Ming Yang yangming73@huawei.com Message-Id: <e13bc78f96774bfab4576814c293aa52@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: David Hildenbrand <david@redhat.com>
2023-04-21vhost: Drop unused eventfd_add|del hooksPeter Xu1-14/+0
These hooks were introduced in: 80a1ea3748 ("memory: move ioeventfd ops to MemoryListener", 2012-02-29) But they seem to be never used. Drop them. Cc: Richard Henderson <rth@twiddle.net> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20230306193209.516011-1-peterx@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-21virtio: refresh vring region cache after updating a virtqueue sizeCarlos López4-1/+4
When a virtqueue size is changed by the guest via virtio_queue_set_num(), its region cache is not automatically updated. If the size was increased, this could lead to accessing the cache out of bounds. For example, in vring_get_used_event(): static inline uint16_t vring_get_used_event(VirtQueue *vq) { return vring_avail_ring(vq, vq->vring.num); } static inline uint16_t vring_avail_ring(VirtQueue *vq, int i) { VRingMemoryRegionCaches *caches = vring_get_region_caches(vq); hwaddr pa = offsetof(VRingAvail, ring[i]); if (!caches) { return 0; } return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa); } vq->vring.num will be greater than caches->avail.len, which will trigger a failed assertion down the call path of virtio_lduw_phys_cached(). Fix this by calling virtio_init_region_cache() after virtio_queue_set_num() if we are not already calling virtio_queue_set_rings(). In the legacy path this is already done by virtio_queue_update_rings(). Signed-off-by: Carlos López <clopez@suse.de> Message-Id: <20230317002749.27379-1-clopez@suse.de> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2023-04-13Merge tag 'migration-20230412-pull-request' of ↵Peter Maydell1-0/+1
https://gitlab.com/juan.quintela/qemu into staging Migration Pull request for 8.0 Last patches found: - peter xu preempt channel fixes. needed for backward compatibility with old machine types. - lukas fix to get compress working again. - fix ram on s390x. Get back to the old code, even when it shouldn't be needed, but as it fails on s390x, just revert. Later, Juan. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEGJn/jt6/WMzuA0uC9IfvGFhy1yMFAmQ3HgQACgkQ9IfvGFhy # 1yPXGQ/+Pf6HepNUlIr7naYOcpRriXPQF+q1zqo74F9fy2vrGcwJOI6qmRTjsX4E # 9KgXipOz7+b5wSemF7PDKcnBiwyt6UHCH+XXe0h4TpyuORbtABKRgtOhA1/sa84D # HnKp0TwImpAO26tzPa7u49aau/EEVBKAzFVcyn4w56S9qiDWicOpd5kG0CJBIsMJ # Mnvy5fXaqQRewnKiwFoJGWfyhzEToDO6Z/SkT5xYON94P+eiM2xMwXOC5WcGfmY7 # wFGDB+SuyEP8TTn7mV0mmnlFjYe4G07hVARHSDFX3ho4b6q5F+WzfW095G6QKiu9 # n3Pzr7IBGX3sgetPtYwOwGsE9JrfHMFzBRxQZZwq5GSmjk7+agkbXmV7RyV82EYs # KYOhuNF91ca0qvCrGA/eGbbJqVrd7SR5FhS4SQ7oKd5n2au/ZHoKwAgm5lBdcvES # 2TB0MBN1s0JPh6KMV8tPB2miZyqPRa++oA8qIX7Asoe1X4xVT1FwiDaFL8TO8i2A # 7uBis3KLZqOHC6dAiXlCDtaADAWgQxjcdoS1l8jTF6MgBSe+zQhXG+pcIDuSiV9N # WfDiUPY97iqPTvpzdz3Is+LbBax2uY5ZR05KSdmCBpIgfvSWMqXtwRydclt6G5h7 # ZiOcTwrgMpXdbhdsFZTqVWAJG2sTkj4TA+IezVpXzPeQNLZ+T8k= # =kW3P # -----END PGP SIGNATURE----- # gpg: Signature made Wed 12 Apr 2023 22:09:24 BST # gpg: using RSA key 1899FF8EDEBF58CCEE034B82F487EF185872D723 # gpg: Good signature from "Juan Quintela <quintela@redhat.com>" [full] # gpg: aka "Juan Quintela <quintela@trasno.org>" [full] # Primary key fingerprint: 1899 FF8E DEBF 58CC EE03 4B82 F487 EF18 5872 D723 * tag 'migration-20230412-pull-request' of https://gitlab.com/juan.quintela/qemu: migration: fix ram_state_pending_exact() migration/ram.c: Fix migration with compress enabled migration: Recover behavior of preempt channel creation for pre-7.2 migration: Fix potential race on postcopy_qemufile_src io: tls: Inherit QIO_CHANNEL_FEATURE_SHUTDOWN on server side Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-13hw/xen: Fix double-free in xen_console store_con_info()David Woodhouse1-10/+3
Coverity spotted a double-free (CID 1508254); we g_string_free(path) and then for some reason immediately call free(path) too. We should just use g_autoptr() for it anyway, which simplifies the code a bit. Fixes: 7a8a749da7d3 ("hw/xen: Move xenstore_store_pv_console_info to xen_console.c") Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-12migration: Fix potential race on postcopy_qemufile_srcPeter Xu1-0/+1
postcopy_qemufile_src object should be owned by one thread, either the main thread (e.g. when at the beginning, or at the end of migration), or by the return path thread (when during a preempt enabled postcopy migration). If that's not the case the access to the object might be racy. postcopy_preempt_shutdown_file() can be potentially racy, because it's called at the end phase of migration on the main thread, however during which the return path thread hasn't yet been recycled; the recycle happens in await_return_path_close_on_source() which is after this point. It means, logically it's posslbe the main thread and the return path thread are both operating on the same qemufile. While I don't think qemufile is thread safe at all. postcopy_preempt_shutdown_file() used to be needed because that's where we send EOS to dest so that dest can safely shutdown the preempt thread. To avoid the possible race, remove this only place that a race can happen. Instead we figure out another way to safely close the preempt thread on dest. The core idea during postcopy on deciding "when to stop" is that dest will send a postcopy SHUT message to src, telling src that all data is there. Hence to shut the dest preempt thread maybe better to do it directly on dest node. This patch proposed such a way that we change postcopy_prio_thread_created into PreemptThreadStatus, so that we kick the preempt thread on dest qemu by a sequence of: mis->preempt_thread_status = PREEMPT_THREAD_QUIT; qemu_file_shutdown(mis->postcopy_qemufile_dst); While here shutdown() is probably so far the easiest way to kick preempt thread from a blocked qemu_get_be64(). Then it reads preempt_thread_status to make sure it's not a network failure but a willingness to quit the thread. We could have avoided that extra status but just rely on migration status. The problem is postcopy_ram_incoming_cleanup() is just called early enough so we're still during POSTCOPY_ACTIVE no matter what.. So just make it simple to have the status introduced. One flag x-preempt-pre-7-2 is added to keep old pre-7.2 behaviors of postcopy preempt. Fixes: 9358982744 ("migration: Send requested page directly in rp-return thread") Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2023-04-12hw/nvme: fix memory leak in nvme_dsmKlaus Jensen1-0/+3
The iocb (and the allocated memory to hold LBA ranges) leaks if reading the LBA ranges fails. Fix this by adding a free and an unref of the iocb. Reported-by: Coverity (CID 1508281) Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-04-12hw/nvme: fix memory leak in fdp ruhid parsingKlaus Jensen1-1/+2
Coverity reports a memory leak of memory when parsing ruhids at namespace initialization. Since this is just working memory, not needed beyond the scope of the functions, fix this by adding a g_autofree annotation. Reported-by: Coverity (CID 1507979) Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-04-11hw/i2c/allwinner-i2c: Fix subclassing of TYPE_AW_I2C_SUN6IPeter Maydell1-3/+1
In commit 8461bfdca9c we added the TYPE_AW_I2C_SUN6I, which is a minor variant of the TYPE_AW_I2C device. However, we didn't quite get the class hierarchy right. We made the new TYPE_AW_I2C_SUN6I a subclass of TYPE_SYS_BUS_DEVICE, which means that you can't validly use a pointer to this object via the AW_I2C() cast macro, which insists on having something that is an instance of TYPE_AW_I2C or some subclass of that type. This only causes a problem if QOM cast macro debugging is enabled; that is supposed to be on by default, but a mistake in the meson conversion in commit c55cf6ab03f4c meant that it ended up disabled by default, and we didn't catch this bug. Fix the problem by arranging the classes in the same way we do for TYPE_PL011 and TYPE_PL011_LUMINARY in hw/char/pl011.c -- make the variant class be a subclass of the "normal" version of the device. This was reported in https://gitlab.com/qemu-project/qemu/-/issues/1586 but this fix alone isn't sufficient, as there is a separate cast-related issue in the CXL code in pci_expander_bridge.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
2023-04-05Revert "memory: Optimize replay of guest mapping"Peter Maydell1-1/+1
This reverts commit 6da24341866fa940fd7d575788a2319514941c77 ("memory: Optimize replay of guest mapping"). This change breaks the mps3-an547 board under TCG (and probably other TCG boards using an IOMMU), which now assert: $ ./build/x86/qemu-system-arm --machine mps3-an547 -serial stdio -kernel /tmp/an547-mwe/build/test.elf qemu-system-arm: ../../softmmu/memory.c:1903: memory_region_register_iommu_notifier: Assertion `n->end <= memory_region_size(mr)' failed. This is because tcg_register_iommu_notifier() registers an IOMMU notifier which covers the entire address space, so the assertion added in this commit is not correct. For the 8.0 release, just revert this commit as it is only an optimization. Fixes: 6da24341866f ("memory: Optimize replay of guest mapping") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 917c1c552b2d1b732f9a86c6a90684c3a5e4cada.1680640587.git.mst@redhat.com
2023-04-04Merge tag 'pull-loongarch-20230404' of https://gitlab.com/gaosong/qemu into ↵Peter Maydell1-1/+1
staging pull-loongarch-20230404 # -----BEGIN PGP SIGNATURE----- # # iLMEAAEIAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCZCwLXQAKCRBAov/yOSY+ # 3zwUA/9d2ddHxGEBTMyF45bzc9JxRF6HoILAwMLsmPWqspPgKdGuviMVewJLt5m8 # V75/BC6Sn9rhdkXALvZMRV6WQ2A16pByUaQtMYAXVsIoV8Mrpvm4GwJD1E0/cy5Q # TwDTzpDfys9WsTVj0QlCPjp0JW+KA7Y6ArMUUCdCz41L2r7mPA== # =ovw7 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 04 Apr 2023 12:34:53 BST # gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF # gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF * tag 'pull-loongarch-20230404' of https://gitlab.com/gaosong/qemu: target/loongarch: Enables plugins to get instruction codes hw/loongarch/virt: Fix virt_to_phys_addr function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-04hw/loongarch/virt: Fix virt_to_phys_addr functionTianrui Zhao1-1/+1
The virt addr should mask TARGET_PHYS_ADDR_SPACE_BITS to get the phys addr, and this is used by loading kernel elf. Signed-off-by: Tianrui Zhao <zhaotianrui@loongson.cn> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230327112313.3042829-1-zhaotianrui@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2023-04-03hw/ssi: Fix Linux driver init issue with xilinx_spiChris Rauer1-0/+1
The problem is that the Linux driver expects the master transaction inhibit bit(R_SPICR_MTI) to be set during driver initialization so that it can detect the fifo size but QEMU defaults it to zero out of reset. The datasheet indicates this bit is active on reset. See page 25, SPI Control Register section: https://www.xilinx.com/content/dam/xilinx/support/documents/ip_documentation/axi_quad_spi/v3_2/pg153-axi-quad-spi.pdf Signed-off-by: Chris Rauer <crauer@google.com> Message-id: 20230323182811.2641044-1-crauer@google.com Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-03hw/arm: do not free machine->fdt in arm_load_dtb()Markus Armbruster1-1/+4
At this moment, arm_load_dtb() can free machine->fdt when binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to machine->fdt. And, in that case, the existing g_free(fdt) at the end of arm_load_dtb() will make machine->fdt point to an invalid memory region. Since monitor command 'dumpdtb' was introduced a couple of releases ago, running it with any ARM machine that uses arm_load_dtb() will crash QEMU. Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead of freeing 'fdt', assign it back to ms->fdt. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb") Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-id: 20230328165935.1512846-1-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-30hw/i2c: pmbus: block uninitialised string readsTitus Rwantare1-0/+7
Devices models calling pmbus_send_string can't be relied upon to send a non-zero pointer. This logs an error and doesn't segfault. Reviewed-by: Patrick Venture <venture@google.com> Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230322175513.1550412-5-titusr@google.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-03-30hw/mips/gt64xxx_pci: Don't endian-swap GT_PCI0_CFGADDRJiaxun Yang1-12/+6
145e2198d749 ("hw/mips/gt64xxx_pci: Endian-swap using PCI_HOST_BRIDGE MemoryRegionOps") converted CFGADDR/CFGDATA registers to use PCI_HOST_BRIDGE's accessor facility and enabled byte swap for both CFGADDR/CFGDATA register. However CFGADDR as a ISD internal register is not controlled by MByteSwap bit, it follows endian of all other ISD register, which means it ties to little endian. Move mapping of CFGADDR out of gt64120_update_pci_cfgdata_mapping to disable endian-swapping. Fixes: 145e2198d749 ("hw/mips/gt64xxx_pci: Endian-swap using PCI_HOST_BRIDGE MemoryRegionOps") Reported-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Message-Id: <20230223161958.48696-1-jiaxun.yang@flygoat.com> [PMD: !!! Note this only fixes little-endian hosts !!! ] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-03-28Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingPeter Maydell10-93/+253
# -----BEGIN PGP SIGNATURE----- # Version: GnuPG v1 # # iQEcBAABAgAGBQJkIncaAAoJEO8Ells5jWIR6bgH/icQAN1a0PBHh2lujmob8KvE # IZ0KYuJMDcA8HFdhnzxPPKj7/77AM1DgmrmVwqLKTr6j64CZYr2Uc0yeyPa0f/0Y # TtePW70bjoUkRm/dDdFe32xViO4O33pGQia6olR6QwmfdDbBBJjAucmlep8NClrh # EooQ2WfXPBqrC6ckKZ7vEvgKV2sDl2XxYIr3kU3MiB4j4b1lrGHE+XSv7cXOC+at # G2vYqbimipZstHZCJYeB5tRz+FXbAI3ZNCGtYpxeVyabrlHS+n+X+gttaswcvVIF # ln6yidVGg/Ot3bi0qiV1WihpqNCWO0ghhf7wIEubAIIJlnE5hXULF4uFVfz+rRE= # =HjJv # -----END PGP SIGNATURE----- # gpg: Signature made Tue 28 Mar 2023 06:11:54 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: igb: respect VMVIR and VMOLR for VLAN igb: implement VF Tx and Rx stats igb: respect E1000_VMOLR_RSSE igb: check oversized packets for VMDq igb: implement VFRE and VFTE registers igb: add ICR_RXDW igb: handle PF/VF reset properly MAINTAINERS: Add Sriram Yagnaraman as a igb reviewer hw/net/net_tx_pkt: Align l3_hdr hw/net/net_tx_pkt: Ignore ECN bit igb: Fix DMA requester specification for Tx packet igb: Save more Tx states Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-28igb: respect VMVIR and VMOLR for VLANSriram Yagnaraman1-13/+49
Add support for stripping/inserting VLAN for VFs. Had to move CSUM calculation back into the for loop, since packet data is pulled inside the loop based on strip VLAN decision for every VF. net_rx_pkt_fix_l4_csum should be extended to accept a buffer instead for igb. Work for a future patch. Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: implement VF Tx and Rx statsSriram Yagnaraman1-4/+22
Please note that loopback counters for VM to VM traffic is not implemented yet: VFGOTLBC, VFGPTLBC, VFGORLBC and VFGPRLBC. Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: respect E1000_VMOLR_RSSESriram Yagnaraman1-1/+8
RSS for VFs is only enabled if VMOLR[n].RSSE is set. Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: check oversized packets for VMDqSriram Yagnaraman1-5/+36
Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: implement VFRE and VFTE registersSriram Yagnaraman3-7/+35
Also introduce: - Checks for RXDCTL/TXDCTL queue enable bits - IGB_NUM_VM_POOLS enum (Sec 1.5: Table 1-7) Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: add ICR_RXDWSriram Yagnaraman2-1/+5
IGB uses RXDW ICR bit to indicate that rx descriptor has been written back. This is the same as RXT0 bit in older HW. Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: handle PF/VF reset properlySriram Yagnaraman3-12/+31
Use PFRSTD to reset RSTI bit for VFs, and raise VFLRE interrupt when VF is reset. Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28hw/net/net_tx_pkt: Align l3_hdrAkihiko Odaki1-10/+11
Align the l3_hdr member of NetTxPkt by defining it as a union of ip_header, ip6_header, and an array of octets. Fixes: e263cd49c7 ("Packet abstraction for VMWARE network devices") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1544 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28hw/net/net_tx_pkt: Ignore ECN bitAkihiko Odaki1-2/+4
No segmentation should be performed if gso type is VIRTIO_NET_HDR_GSO_NONE even if ECN bit is set. Fixes: e263cd49c7 ("Packet abstraction for VMWARE network devices") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1544 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: Fix DMA requester specification for Tx packetAkihiko Odaki5-12/+17
igb used to specify the PF as DMA requester when reading Tx packets. This made Tx requests from VFs to be performed on the address space of the PF, defeating the purpose of SR-IOV. Add some logic to change the requester depending on the queue, which can be assigned to a VF. Fixes: 3a977deebe ("Intrdocue igb device emulation") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-28igb: Save more Tx statesAkihiko Odaki3-32/+41
The current implementation of igb uses only part of a advanced Tx context descriptor and first data descriptor because it misses some features and sniffs the trait of the packet instead of respecting the packet type specified in the descriptor. However, we will certainly need the entire Tx context descriptor when we update igb to respect these ignored fields. Save the entire context descriptor and first data descriptor except the buffer address to prepare for such a change. This also introduces the distinction of contexts with different indexes, which was not present in e1000e but in igb. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-03-27hw/nvme: fix missing DNR on compare failureKlaus Jensen1-3/+3
Even if the host is somehow using compare to do compare-and-write, the host should be notified immediately about the compare failure and not have to wait for the driver to potentially retry the command. Fixes: 0a384f923f51 ("hw/block/nvme: add compare command") Reported-by: Jim Harris <james.r.harris@intel.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-03-27hw/nvme: Change alignment in dma functions for nvme_blk_*Mateusz Kozlowski1-10/+10
Since the nvme_blk_read/write are used by both the data and metadata portions of the IO, it can't have the 512B alignment requirement. Without this change any metadata transfer, which length isn't a multiple of 512B and which is bigger than 512B, will result in only a partial transfer. Signed-off-by: Mateusz Kozlowski <kozlowski.mateuszpl@gmail.com> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2023-03-24Merge tag 'pull-request-2023-03-24' of https://gitlab.com/thuth/qemu into ↵Peter Maydell7-481/+481
staging * Remove TABs in hw/ide and hw/block * Two fixes for GCC 13 * MSYS2 CI job improvements # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmQdwwkRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbXnWg//TcpLes6b30dTFJ3NwTYaL+ElGvcfQiXx # DNUdmCuxH+2YJGORvVutbVslxFAXgYn8z6lmjgTSx+HziwmY3WhtWSQNOAxRrpoj # Rq1r59q7FPKY/qoLjTMeQDe3O+jrGte7dX14TbKRpPDSZxxJjpswACDgCsGWqE8x # 0SGSLRlqqqnrQE0H1RfmP++0yAtHmGSN3TK0/bFmY4B+mMpj8beAq020h2iCCdbP # 7qWMI0o96lAl/D/wA55BNKuWsdXdIeQjPPoxxGEtiXN27Xk7oyQS47JkZdz6C1Lq # V8/lF2Pa/eC6uPjnxpQDGp1IkaBE7/rn4450h9EMESrjL50As2yPUkw3BecqimHA # fYMbSXrGe9urIflkZcY7Nx2PaBB5v1ZR3iiemjd8qahjgiT8DJYWtjFYKbuFsqJ+ # Ra13Ey9PEX13dROXBAFeX+rdaMiRQEkyQv8GSwPlnNW7OzFJc/qr8EIQOuu1flmm # 7KLYp6h45Os/fN90Lnn5N9LhjUET+2XDqEljAyyziTjsIuc1i3mPjR45j0KSq7tv # eBp6SXpHkXrpKDrXSsJMa4SzSfK6VOHrtseE4b2XCKQLr4oSpr8d6eembKGyvNzs # zh4TtsC+WfTu4HY5Dcbat34QAtAfGUr7ERX4/s+bnvQd944/7skOAqM7Ia9tOMKH # ABuxJ8A7PIY= # =myGG # -----END PGP SIGNATURE----- # gpg: Signature made Fri 24 Mar 2023 15:34:33 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2023-03-24' of https://gitlab.com/thuth/qemu: Revert "docs/about/deprecated: Deprecate 32-bit arm hosts for system emulation" cirrus-ci: Remove MSYS2 jobs duplicated with gitlab-ci gitlab-ci: Cover SPICE in the MSYS2 job ui/spice: fix compilation on win32 target/ppc: Fix helper_pminsn() prototype target/s390x: Fix float_comp_to_cc() prototype hw/block: replace TABs with space hw/ide: replace TABs with space Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-24hw/xenpv: Initialize Xen backend operationsDavid Woodhouse1-0/+2
As the Xen backend operations were abstracted out into a function table to allow for internally emulated Xen support, we missed the xen_init_pv() code path which also needs to install the operations for the true Xen libraries. Add the missing call to setup_xen_backend_ops(). Fixes: b6cacfea0b38 ("hw/xen: Add evtchn operations to allow redirection to internal emulation") Reported-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Paul Durrant <paul@xen.org> Tested-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <5dfb65342d4502c1ce2f890c97cff20bf25b3860.camel@infradead.org> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2023-03-24hw/block: replace TABs with spaceYeqi Fu4-245/+245
Bring the block files in line with the QEMU coding style, with spaces for indentation. This patch partially resolves the issue 371. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/371 Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com> Message-Id: <20230314095001.13801-1-fufuyqqqqqq@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-24hw/ide: replace TABs with spaceYeqi Fu3-236/+236
Bring the block files in line with the QEMU coding style, with spaces for indentation. This patch partially resolves the issue 371. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/371 Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com> Message-Id: <20230315043229.62100-1-fufuyqqqqqq@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-22*: Add missing includes of qemu/error-report.hRichard Henderson30-0/+39
This had been pulled in via qemu/plugin.h from hw/core/cpu.h, but that will be removed. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230310195252.210956-5-richard.henderson@linaro.org> [AJB: add various additional cases shown by CI] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230315174331.2959-15-alex.bennee@linaro.org> Reviewed-by: Emilio Cota <cota@braap.org>
2023-03-21hw/usb/imx: Fix out of bounds access in imx_usbphy_read()Guenter Roeck1-2/+17
The i.MX USB Phy driver does not check register ranges, resulting in out of bounds accesses if an attempt is made to access non-existing PHY registers. Add range check and conditionally report bad accesses to fix the problem. While at it, also conditionally log attempted writes to non-existing or read-only registers. Reported-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-id: 20230316234926.208874-1-linux@roeck-us.net Link: https://gitlab.com/qemu-project/qemu/-/issues/1408 Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support") Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settingsPeter Maydell1-2/+4
The cadence UART attempts to avoid allowing the guest to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that a malicious guest can get a bogus value into the register by setting also some high bits in the value, and cause QEMU to crash by division-by-zero. Do the mask before the bounds check instead of afterwards. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com> Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
generated by cgit v1.1 at 2025-01-15 15:00:59 +0000