aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2020-06-10hw/i386/amd_iommu: Fix the reserved bits definition of IOMMU commandsWei Huang1-9/+10
Many reserved bits of amd_iommu commands are defined incorrectly in QEMU. Because of it, QEMU incorrectly injects lots of illegal commands into guest VM's IOMMU event log. Signed-off-by: Wei Huang <wei.huang2@amd.com> Message-Id: <20200418042845.596457-1-wei.huang2@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10KVM: Kick resamplefd for split kernel irqchipPeter Xu1-0/+19
This is majorly only for X86 because that's the only one that supports split irqchip for now. When the irqchip is split, we face a dilemma that KVM irqfd will be enabled, however the slow irqchip is still running in the userspace. It means that the resamplefd in the kernel irqfds won't take any effect and it will miss to ack INTx interrupts on EOIs. One example is split irqchip with VFIO INTx, which will break if we use the VFIO INTx fast path. This patch can potentially supports the VFIO fast path again for INTx, that the IRQ delivery will still use the fast path, while we don't need to trap MMIOs in QEMU for the device to emulate the EIOs (see the callers of vfio_eoi() hook). However the EOI of the INTx will still need to be done from the userspace by caching all the resamplefds in QEMU and kick properly for IOAPIC EOI broadcast. This is tricky because in this case the userspace ioapic irr & remote-irr will be bypassed. However such a change will greatly boost performance for assigned devices using INTx irqs (TCP_RR boosts 46% after this patch applied). When the userspace is responsible for the resamplefd kickup, don't register it on the kvm_irqfd anymore, because on newer kernels (after commit 654f1f13ea56, 5.2+) the KVM_IRQFD will fail if with both split irqchip and resamplefd. This will make sure that the fast path will work for all supported kernels. https://patchwork.kernel.org/patch/10738541/#22609933 Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20200318145204.74483-5-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10vfio/pci: Use kvm_irqchip_add_irqfd_notifier_gsi() for irqfdsPeter Xu1-22/+15
VFIO is currently the only one left that is not using the generic function (kvm_irqchip_add_irqfd_notifier_gsi()) to register irqfds. Let VFIO use the common framework too. Follow up patches will introduce extra features for kvm irqfd, so that VFIO can easily leverage that after the switch. Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20200318145204.74483-3-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Allow QTest use without crashingPhilippe Mathieu-Daudé1-1/+15
Trying libFuzzer on the vmport device, we get: AddressSanitizer:DEADLYSIGNAL ================================================================= ==29476==ERROR: AddressSanitizer: SEGV on unknown address 0x000000008840 (pc 0x56448bec4d79 bp 0x7ffeec9741b0 sp 0x7ffeec9740e0 T0) ==29476==The signal is caused by a READ memory access. #0 0x56448bec4d78 in vmport_ioport_read (qemu-fuzz-i386+0x1260d78) #1 0x56448bb5f175 in memory_region_read_accessor (qemu-fuzz-i386+0xefb175) #2 0x56448bb30c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13) #3 0x56448bb2ea27 in memory_region_dispatch_read1 (qemu-fuzz-i386+0xecaa27) #4 0x56448bb2e443 in memory_region_dispatch_read (qemu-fuzz-i386+0xeca443) #5 0x56448b961ab1 in flatview_read_continue (qemu-fuzz-i386+0xcfdab1) #6 0x56448b96336d in flatview_read (qemu-fuzz-i386+0xcff36d) #7 0x56448b962ec4 in address_space_read_full (qemu-fuzz-i386+0xcfeec4) This is easily reproducible using: $ echo inb 0x5658 | qemu-system-i386 -M isapc,accel=qtest -qtest stdio [I 1589796572.009763] OPENED [R +0.008069] inb 0x5658 Segmentation fault (core dumped) $ coredumpctl gdb -q Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00005605b54d0f21 in vmport_ioport_read (opaque=0x5605b7531ce0, addr=0, size=4) at hw/i386/vmport.c:77 77 eax = env->regs[R_EAX]; (gdb) p cpu $1 = (X86CPU *) 0x0 (gdb) bt #0 0x00005605b54d0f21 in vmport_ioport_read (opaque=0x5605b7531ce0, addr=0, size=4) at hw/i386/vmport.c:77 #1 0x00005605b53db114 in memory_region_read_accessor (mr=0x5605b7531d80, addr=0, value=0x7ffc9d261a30, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:434 #2 0x00005605b53db5d4 in access_with_adjusted_size (addr=0, value=0x7ffc9d261a30, size=1, access_size_min=4, access_size_max=4, access_fn= 0x5605b53db0d2 <memory_region_read_accessor>, mr=0x5605b7531d80, attrs=...) at memory.c:544 #3 0x00005605b53de156 in memory_region_dispatch_read1 (mr=0x5605b7531d80, addr=0, pval=0x7ffc9d261a30, size=1, attrs=...) at memory.c:1396 #4 0x00005605b53de228 in memory_region_dispatch_read (mr=0x5605b7531d80, addr=0, pval=0x7ffc9d261a30, op=MO_8, attrs=...) at memory.c:1424 #5 0x00005605b537c80a in flatview_read_continue (fv=0x5605b7650290, addr=22104, attrs=..., ptr=0x7ffc9d261b4b, len=1, addr1=0, l=1, mr=0x5605b7531d80) at exec.c:3200 #6 0x00005605b537c95d in flatview_read (fv=0x5605b7650290, addr=22104, attrs=..., buf=0x7ffc9d261b4b, len=1) at exec.c:3239 #7 0x00005605b537c9e6 in address_space_read_full (as=0x5605b5f74ac0 <address_space_io>, addr=22104, attrs=..., buf=0x7ffc9d261b4b, len=1) at exec.c:3252 #8 0x00005605b53d5a5d in address_space_read (len=1, buf=0x7ffc9d261b4b, attrs=..., addr=22104, as=0x5605b5f74ac0 <address_space_io>) at include/exec/memory.h:2401 #9 0x00005605b53d5a5d in cpu_inb (addr=22104) at ioport.c:88 X86CPU is NULL because QTest accelerator does not use CPU. Fix by returning default values when QTest accelerator is used. Reported-by: Clang AddressSanitizer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10megasas: use unsigned type for positive numeric fieldsPrasad J Pandit1-19/+19
Use unsigned type for the MegasasState fields which hold positive numeric values. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20200513192540.1583887-4-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10megasas: avoid NULL pointer dereferencePrasad J Pandit1-1/+1
While in megasas_handle_frame(), megasas_enqueue_frame() may set a NULL frame into MegasasCmd object for a given 'frame_addr' address. Add check to avoid a NULL pointer dereference issue. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: https://bugs.launchpad.net/qemu/+bug/1878259 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Acked-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20200513192540.1583887-3-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10megasas: use unsigned type for reply_queue_head and check indexPrasad J Pandit1-2/+2
A guest user may set 'reply_queue_head' field of MegasasState to a negative value. Later in 'megasas_lookup_frame' it is used to index into s->frames[] array. Use unsigned type to avoid OOB access issue. Also check that 'index' value stays within s->frames[] bounds through the while() loop in 'megasas_lookup_frame' to avoid OOB access. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Acked-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200513192540.1583887-2-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10accel: Move Xen accelerator code under accel/xen/Philippe Mathieu-Daudé10-221/+9
This code is not related to hardware emulation. Move it under accel/ with the other hypervisors. Reviewed-by: Paul Durrant <paul@xen.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200508100222.7112-1-philmd@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Assert vmport initialized before registering commandsLiran Alon1-0/+2
vmport_register() is also called from other modules such as vmmouse. Therefore, these modules rely that vmport is realized before those call sites. If this is violated, vmport_register() will NULL-deref. To make such issues easier to debug, assert in vmport_register() that vmport is already realized. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-17-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Add support for CMD_GETHZLiran Alon1-0/+19
This command returns to guest information on LAPIC bus frequency and TSC frequency. One can see how this interface is used by Linux vmware_platform_setup() introduced in Linux commit 88b094fb8d4f ("x86: Hypervisor detection and get tsc_freq from hypervisor"). Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-16-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Allow x2apic without IRLiran Alon1-1/+8
Signal to guest that hypervisor supports x2apic without VT-d/IOMMU Interrupt-Remapping support. This allows guest to use x2apic in case all APIC IDs fits in 8-bit (i.e. Max APIC ID < 255). See Linux kernel commit 4cca6ea04d31 ("x86/apic: Allow x2apic without IR on VMware platform") and Linux try_to_enable_x2apic() function. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-14-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Add support for CMD_GET_VCPU_INFOLiran Alon1-0/+14
Command currently returns that it is unimplemented by setting the reserved-bit in it's return value. Following patches will return various useful vCPU information to guest. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-13-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Add support for CMD_GETBIOSUUIDLiran Alon2-0/+23
This is VMware documented functionallity that some guests rely on. Returns the BIOS UUID of the current virtual machine. Note that we also introduce a new compatability flag "x-cmds-v2" to make sure to expose new VMPort commands only to new machine-types. This flag will also be used by the following patches that will introduce additional VMPort commands. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-10-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Define enum for all commandsLiran Alon2-21/+8
No functional change. Defining an enum for all VMPort commands have the following advantages: * It gets rid of the error-prone requirement to update VMPORT_ENTRIES when new VMPort commands are added to QEMU. * It makes it clear to know by looking at one place at the source, what are all the VMPort commands supported by QEMU. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200312165431.82118-9-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Introduce vmport.hLiran Alon4-37/+3
No functional change. This is mere refactoring. Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200312165431.82118-8-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Report vmware-vmx-type in CMD_GETVERSIONLiran Alon2-0/+28
As can be seen from VmCheck_GetVersion() in open-vm-tools code, CMD_GETVERSION should return vmware-vmx-type in ECX register. Default is to fake host as VMware ESX server. But user can control this value by "-global vmport.vmware-vmx-type=X". Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-7-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Introduce vmware-vmx-version propertyLiran Alon1-1/+8
vmware-vmx-version is a number returned from CMD_GETVERSION which specifies to guest VMware Tools the the host VMX version. If the host reports a number that is different than what the guest VMware Tools expects, it may force guest to upgrade VMware Tools. (See comment above VERSION_MAGIC and VmCheck_IsVirtualWorld() function in open-vm-tools open-source code). For better readability and allow maintaining compatability for guests which may expect different vmware-vmx-version, make vmware-vmx-version a VMPort object property. This would allow user to control it's value via "-global vmport.vmware-vmx-version=X". Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200312165431.82118-6-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Set EAX to -1 on failed and unsupported commandsLiran Alon2-4/+16
This is used as a signal for VMware Tools to know if a command it attempted to invoke, failed or is unsupported. As a result, VMware Tools will either report failure to user or fallback to another backdoor command in attempt to perform some operation. A few examples: * open-vm-tools TimeSyncReadHost() function fallbacks to CMD_GETTIMEFULL command when CMD_GETTIMEFULL_WITH_LAG fails/unsupported. * open-vm-tools Hostinfo_NestingSupported() function verifies EAX != -1 to check for success. * open-vm-tools Hostinfo_VCPUInfoBackdoor() functions checks if reserved-bit is set to indicate command is unimplemented. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-5-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Propagate IOPort read to vCPU EAX registerLiran Alon2-3/+30
vmport_ioport_read() returns the value that should propagate to vCPU EAX register when guest reads VMPort IOPort (i.e. By x86 IN instruction). However, because vmport_ioport_read() calls cpu_synchronize_state(), the returned value gets overridden by the value in QEMU vCPU EAX register. i.e. cpu->env.regs[R_EAX]. To fix this issue, change vmport_ioport_read() to explicitly override cpu->env.regs[R_EAX] with the value it wish to propagate to vCPU EAX register. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-4-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Add device propertiesLiran Alon1-0/+6
No functional change. This is done as a preparation for the following patches that will introduce several device properties. Reviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com> Signed-off-by: Liran Alon <liran.alon@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200312165431.82118-3-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hw/i386/vmport: Add reference to VMware open-vm-toolsLiran Alon1-0/+7
This official VMware open-source project can be used as reference to understand how guest code interacts with VMPort virtual device. Thus, providing understanding on how device is expected to behave. Signed-off-by: Liran Alon <liran.alon@oracle.com> Message-Id: <20200312165431.82118-2-liran.alon@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10vmbus: add infrastructure to save/load vmbus requestsJon Doron1-0/+99
This can be allow to include controller-specific data while saving/loading in-flight scsi requests of the vmbus scsi controller. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Signed-off-by: Jon Doron <arilou@gmail.com> Message-Id: <20200424123444.3481728-7-arilou@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10i386: Hyper-V VMBus ACPI DSDT entryJon Doron2-0/+50
Guest OS uses ACPI to discover VMBus presence. Add a corresponding entry to DSDT in case VMBus has been enabled. Experimentally Windows guests were found to require this entry to include two IRQ resources. They seem to never be used but they still have to be there. Make IRQ numbers user-configurable via corresponding properties; use 7 and 13 by default. Signed-off-by: Evgeny Yakovlev <eyakovlev@virtuozzo.com> Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Signed-off-by: Jon Doron <arilou@gmail.com> Message-Id: <20200424123444.3481728-6-arilou@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10i386:pc: whitelist dynamic vmbus-bridgeJon Doron2-0/+4
As vmbus-bridge is derived from sysbus device, it has to be whitelisted to be allowed to be created with -device. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Signed-off-by: Jon Doron <arilou@gmail.com> Message-Id: <20200424123444.3481728-5-arilou@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10vmbus: vmbus implementationJon Doron4-0/+2696
Add the VMBus infrastructure -- bus, devices, root bridge, vmbus state machine, vmbus channel interactions, etc. VMBus is a collection of technologies. At its lowest layer, it's a message passing and signaling mechanism, allowing efficient passing of messages to and from guest VMs. A layer higher, it's a mechanism for defining channels of communication, where each channel is tagged with a type (which implies a protocol) and a instance ID. A layer higher than that, it's a bus driver, serving as the basis of device enumeration within a VM, where a channel can optionally be exposed as a paravirtual device. When a server-side (paravirtual back-end) component wishes to offer a channel to a guest VM, it does so by specifying a channel type, a mode, and an instance ID. VMBus then exposes this in the guest. More information about VMBus can be found in the file vmbuskernelmodeclientlibapi.h in Microsoft's WDK. TODO: - split into smaller palatable pieces - more comments - check and handle corner cases Kudos to Evgeny Yakovlev (formerly eyakovlev@virtuozzo.com) and Andrey Smetatin (formerly asmetanin@virtuozzo.com) for research and prototyping. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Signed-off-by: Jon Doron <arilou@gmail.com> Message-Id: <20200424123444.3481728-4-arilou@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10hyperv: expose API to determine if synic is enabledJon Doron1-0/+8
Signed-off-by: Jon Doron <arilou@gmail.com> Message-Id: <20200424123444.3481728-2-arilou@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10qom/object: Move Object typedef to 'qemu/typedefs.h'Philippe Mathieu-Daudé3-3/+0
We use the Object type all over the place. Forward declare it in "qemu/typedefs.h". Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200504115656.6045-2-f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-10numa: prevent usage of -M memory-backend and -numa memdev at the same timeIgor Mammedov1-0/+5
Options -M memory-backend and -numa memdev are mutually exclusive, and if used together, it might lead to a crash in the worst case. For example when the same backend is used with these options together: -m 4G \ -object memory-backend-ram,id=mem0,size=4G \ -M pc,memory-backend=mem0 \ -numa node,memdev=mem0 QEMU will abort with: exec.c:2006: qemu_ram_set_idstr: Assertion `!new_block->idstr[0]' failed. and following backtrace: abort () qemu_ram_set_idstr () vmstate_register_ram () vmstate_register_ram_global () machine_consume_memdev () numa_init_memdev_container () numa_complete_configuration () machine_run_board_init () add a check to error out in case the user tries to use both options at the same time. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20200511141103.43768-3-imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-09hw/timer/grlib_gptimer: Display frequency in decimalPhilippe Mathieu-Daudé1-1/+1
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-6-f4bug@amsat.org>
2020-06-09hw/misc/grlib_ahb_apb_pnp: Add trace events on read accessesPhilippe Mathieu-Daudé2-2/+15
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-5-f4bug@amsat.org>
2020-06-09hw/misc/grlib_ahb_apb_pnp: Fix AHB PnP 8-bit accessesPhilippe Mathieu-Daudé1-0/+4
The Plug & Play region of the AHB/APB bridge can be accessed by various word size, however the implementation is clearly restricted to 32-bit: static uint64_t grlib_ahb_pnp_read(void *opaque, hwaddr offset, unsigned size) { AHBPnp *ahb_pnp = GRLIB_AHB_PNP(opaque); return ahb_pnp->regs[offset >> 2]; } Similarly to commit 0fbe394a64 with the APB PnP registers, set the MemoryRegionOps::impl min/max fields to 32-bit, so memory.c::access_with_adjusted_size() can adjust when the access is not 32-bit. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-4-f4bug@amsat.org>
2020-06-09hw/misc/grlib_ahb_apb_pnp: Avoid crash when writing to AHB PnP registersPhilippe Mathieu-Daudé1-0/+7
Similarly to commit 158b659451 with the APB PnP registers, guests can crash QEMU when writting to the AHB PnP registers: $ echo 'writeb 0xfffff042 69' | qemu-system-sparc -M leon3_generic -S -bios /etc/magic -qtest stdio [I 1571938309.932255] OPENED [R +0.063474] writeb 0xfffff042 69 Segmentation fault (core dumped) (gdb) bt #0 0x0000000000000000 in () #1 0x0000562999110df4 in memory_region_write_with_attrs_accessor (mr=mr@entry=0x56299aa28ea0, addr=66, value=value@entry=0x7fff6abe13b8, size=size@entry=1, shift=<optimized out>, mask=mask@entry=255, attrs=...) at memory.c:503 #2 0x000056299911095e in access_with_adjusted_size (addr=addr@entry=66, value=value@entry=0x7fff6abe13b8, size=size@entry=1, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=access_fn@entry= 0x562999110d70 <memory_region_write_with_attrs_accessor>, mr=0x56299aa28ea0, attrs=...) at memory.c:539 #3 0x0000562999114fba in memory_region_dispatch_write (mr=mr@entry=0x56299aa28ea0, addr=66, data=<optimized out>, op=<optimized out>, attrs=attrs@entry=...) at memory.c:1482 #4 0x00005629990c0860 in flatview_write_continue (fv=fv@entry=0x56299aa7d8a0, addr=addr@entry=4294963266, attrs=..., ptr=ptr@entry=0x7fff6abe1540, len=len@entry=1, addr1=<optimized out>, l=<optimized out>, mr=0x56299aa28ea0) at include/qemu/host-utils.h:164 #5 0x00005629990c0a76 in flatview_write (fv=0x56299aa7d8a0, addr=4294963266, attrs=..., buf=0x7fff6abe1540, len=1) at exec.c:3165 #6 0x00005629990c4c1b in address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., attrs@entry=..., buf=buf@entry=0x7fff6abe1540, len=len@entry=1) at exec.c:3256 #7 0x000056299910f807 in qtest_process_command (chr=chr@entry=0x5629995ee920 <qtest_chr>, words=words@entry=0x56299acfcfa0) at qtest.c:437 Instead of crashing, log the access as unimplemented. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200331105048.27989-3-f4bug@amsat.org>
2020-06-09hw/sparc64/niagara: Remove duplicated NIAGARA_UART_BASE definitionPhilippe Mathieu-Daudé1-1/+0
NIAGARA_UART_BASE is already defined few lines earlier. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200608172144.20461-3-f4bug@amsat.org>
2020-06-09hw/sparc64/niagara: Map the UART device unconditionallyPhilippe Mathieu-Daudé1-4/+2
The UART is present on the machine regardless there is a character device connected to it. Map it unconditionally. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200608172144.20461-4-f4bug@amsat.org>
2020-06-09hw/sparc/leon3: Map the UART device unconditionallyPhilippe Mathieu-Daudé1-10/+8
The UART is present on the chipset regardless there is a character device connected to it. Map it unconditionally. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Message-Id: <20200608172144.20461-2-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Name the slots when createdPhilippe Mathieu-Daudé3-5/+9
Directly set the slot name when creating the device, to display the device name in trace events. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-8-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Move the 'hw/misc' and cover in MAINTAINERSPhilippe Mathieu-Daudé7-9/+9
Add an entry for the 'empty_slot' device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-7-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Convert debug printf() to trace eventPhilippe Mathieu-Daudé2-11/+12
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-6-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Add a 'name' qdev propertyPhilippe Mathieu-Daudé1-1/+6
Add a 'name' qdev property so when multiple slots are accessed, we can notice which one is accessed. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-5-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Convert 'size' field as qdev propertyPhilippe Mathieu-Daudé1-6/+9
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-4-f4bug@amsat.org>
2020-06-09hw/misc/empty_slot: Lower address space priorityPhilippe Mathieu-Daudé1-1/+1
Empty slots model RAZ/WI access on a bus. Since we can still (hot) plug devices on the bus, lower the slot priority, so device added later is accessed first. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-3-f4bug@amsat.org>
2020-06-09hw/sparc/sun4m: Use UnimplementedDevice for I/O devicesPhilippe Mathieu-Daudé2-4/+8
These devices are not slots on a bus, but real I/O devices that we do not implement. As the ISDN ROM would be a ROMD device, also model it as UnimplementedDevice. Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com> Message-Id: <20200510152840.13558-2-f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-06-08Merge remote-tracking branch ↵Peter Maydell1-0/+2
'remotes/vivier2/tags/linux-user-for-5.1-pull-request' into staging linux-user pull request 20200605-v2 Implement F_OFD_ fcntl() command, /proc/cpuinfo for hppa Fix socket(), prnctl() error codes, underflow in target_mremap, epoll_create() strace, oldumount for alpha User-mode build dependencies improvement # gpg: Signature made Sat 06 Jun 2020 14:15:36 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-5.1-pull-request: stubs: Restrict ui/win32-kbd-hook to system-mode hw/core: Restrict CpuClass::get_crash_info() to system-mode target/s390x: Restrict CpuClass::get_crash_info() to system-mode target/i386: Restrict CpuClass::get_crash_info() to system-mode arch_init: Remove unused 'qapi-commands-misc.h' include exec: Assert CPU migration is not used on user-only build target/riscv/cpu: Restrict CPU migration to system-mode stubs/Makefile: Reduce the user-mode object list util/Makefile: Reduce the user-mode object list tests/Makefile: Restrict some softmmu-only tests tests/Makefile: Only display TCG-related tests when TCG is available configure: Avoid building TCG when not needed Makefile: Only build virtiofsd if system-mode is enabled linux-user: implement OFD locks linux-user/mmap.c: fix integer underflow in target_mremap linux-user/strace.list: fix epoll_create{,1} -strace output linux-user: Add support for /proc/cpuinfo on hppa platform linux-user: return target error codes for socket() and prctl() linux-user, alpha: fix oldumount syscall Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05Merge remote-tracking branch ↵Peter Maydell13-25/+1967
'remotes/pmaydell/tags/pull-target-arm-20200605' into staging target-arm queue: hw/ssi/imx_spi: Handle tx burst lengths other than 8 correctly hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask() hw/arm/pxa2xx: Replace printf() call by qemu_log_mask() target/arm: Convert crypto insns to gvec hw/adc/stm32f2xx_adc: Correct memory region size and access size tests/acceptance: Add a boot test for the xlnx-versal-virt machine docs/system: Document Aspeed boards raspi: Add model of the USB controller target/arm: Convert 2-reg-and-shift and 1-reg-imm Neon insns to decodetree # gpg: Signature made Fri 05 Jun 2020 17:48:39 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200605: (29 commits) target/arm: Convert Neon one-register-and-immediate insns to decodetree target/arm: Convert VCVT fixed-point ops to decodetree target/arm: Convert Neon VSHLL, VMOVL to decodetree target/arm: Convert Neon narrowing shifts with op==9 to decodetree target/arm: Convert Neon narrowing shifts with op==8 to decodetree target/arm: Convert VQSHLU, VQSHL 2-reg-shift insns to decodetree target/arm: Convert Neon VSRA, VSRI, VRSHR, VRSRA 2-reg-shift insns to decodetree target/arm: Convert Neon VSHR 2-reg-shift insns to decodetree target/arm: Convert Neon VSHL and VSLI 2-reg-shift insn to decodetree raspi2 acceptance test: add test for dwc-hsotg (dwc2) USB host wire in the dwc-hsotg (dwc2) USB host controller emulation usb: add short-packet handling to usb-storage driver dwc-hsotg (dwc2) USB host controller emulation dwc-hsotg (dwc2) USB host controller state definitions dwc-hsotg (dwc2) USB host controller register definitions raspi: add BCM2835 SOC MPHI emulation docs/system: Document Aspeed boards tests/acceptance: Add a boot test for the xlnx-versal-virt machine hw/adc/stm32f2xx_adc: Correct memory region size and access size target/arm: Split helper_crypto_sm3tt ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/core: Restrict CpuClass::get_crash_info() to system-modePhilippe Mathieu-Daudé1-0/+2
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Tested-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200522172510.25784-13-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-06-05Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200605' into stagingPeter Maydell3-12/+5
s390x update: - enhance s390x documentation - allow ORBs without prefetch specified for vfio-ccw - various cleanups and enhancements # gpg: Signature made Fri 05 Jun 2020 16:32:43 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [marginal] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [marginal] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20200605: target/s390x: Restrict system-mode declarations target/s390x/helper: Clean ifdef'ry target/s390x: Only compile decode_basedisp() on system-mode MAINTAINERS: add Thomas as additional s390x maintainer docs/s390x: document vfio-ccw vfio-ccw: allow non-prefetch ORBs docs/s390x: document 3270 docs/s390x: document the virtual css s390x: pv: Fix KVM_PV_PREP_RESET command wrapper name s390x/kvm: help valgrind in several places Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05wire in the dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman1-1/+20
Wire the dwc-hsotg (dwc2) emulation into Qemu Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Reviewed-by: Philippe Mathieu-Daude <f4bug@amsat.org> Message-id: 20200520235349.21215-7-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05usb: add short-packet handling to usb-storage driverPaul Zimmerman1-1/+14
The dwc-hsotg (dwc2) USB host depends on a short packet to indicate the end of an IN transfer. The usb-storage driver currently doesn't provide this, so fix it. I have tested this change rather extensively using a PC emulation with xhci, ehci, and uhci controllers, and have not observed any regressions. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-6-pauldzim@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller emulationPaul Zimmerman4-0/+1473
Add the dwc-hsotg (dwc2) USB host controller emulation code. Based on hw/usb/hcd-ehci.c and hw/usb/hcd-ohci.c. Note that to use this with the dwc-otg driver in the Raspbian kernel, you must pass the option "dwc_otg.fiq_fsm_enable=0" on the kernel command line. Emulation of slave mode and of descriptor-DMA mode has not been implemented yet. These modes are seldom used. I have used some on-line sources of information while developing this emulation, including: http://www.capital-micro.com/PDF/CME-M7_Family_User_Guide_EN.pdf which has a pretty complete description of the controller starting on page 370. https://sourceforge.net/p/wive-ng/wive-ng-mt/ci/master/tree/docs/DataSheets/RT3050_5x_V2.0_081408_0902.pdf which has a description of the controller registers starting on page 130. Thanks to Felippe Mathieu-Daude for providing a cleaner method of implementing the memory regions for the controller registers. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-5-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05dwc-hsotg (dwc2) USB host controller state definitionsPaul Zimmerman1-0/+190
Add the dwc-hsotg (dwc2) USB host controller state definitions. Mostly based on hw/usb/hcd-ehci.h. Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200520235349.21215-4-pauldzim@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-01-15 14:20:53 +0000