aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2023-05-30hw/arm/sbsa-ref: add GIC node into DTMarcin Juszkiewicz1-1/+18
Let add GIC information into DeviceTree as part of SBSA-REF versioning. Trusted Firmware will read it and provide to next firmware level. Bumps platform version to 0.1 one so we can check is node is present. Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30arm/Kconfig: Make TCG dependence explicitFabiano Rosas1-41/+82
Replace the 'default y if TCG' pattern with 'default y; depends on TCG'. That makes explict that there is a dependence on TCG and enabling these CONFIGs via .mak files without TCG present will fail earlier. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230523180525.29994-4-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs numberClément Chigot1-1/+1
When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS, the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result in a positive number as ms->smp.cpus is a unsigned int. This will raise the following error afterwards, as Qemu will try to instantiate some additional RPUs. | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102 | ** | ERROR:../src/tcg/tcg.c:777:tcg_register_thread: | assertion failed: (n < tcg_max_ctxs) Signed-off-by: Clément Chigot <chigot@adacore.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20230524143714.565792-1-chigot@adacore.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.Tommy Wu1-3/+8
When we receive a packet from the xilinx_axienet and then try to s2mem through the xilinx_axidma, if the descriptor ring buffer is full in the xilinx axidma driver, we’ll assert the DMASR.HALTED in the function : stream_process_s2mem and return 0. In the end, we’ll be stuck in an infinite loop in axienet_eth_rx_notify. This patch checks the DMASR.HALTED state when we try to push data from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted, we will not keep pushing the data and then prevent the infinte loop. Signed-off-by: Tommy Wu <tommy.wu@sifive.com> Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2Mostafa Saleh1-10/+22
As everything is in place, we can use a new system property to advertise which stage is supported and remove bad_ste from STE stage2 config. The property added arm-smmuv3.stage can have 3 values: - "1": Stage-1 only is advertised. - "2": Stage-2 only is advertised. If not passed or an unsupported value is passed, it will default to stage-1. Advertise VMID16. Don't try to decode CD, if stage-2 is configured. Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Mostafa Saleh <smostafa@google.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-11-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Add stage-2 support in iova notifierMostafa Saleh2-14/+27
In smmuv3_notify_iova, read the granule based on translation stage and use VMID if valid value is sent. Signed-off-by: Mostafa Saleh <smostafa@google.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-10-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Add CMDs related to stage-2Mostafa Saleh3-9/+66
CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the same as CMD_TLBI_NH_VAA. CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID. For stage-1 only commands, add a check to throw CERROR_ILL if used when stage-1 is not supported. Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Mostafa Saleh <smostafa@google.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-9-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Add VMID to TLB taggingMostafa Saleh4-20/+36
Allow TLB to be tagged with VMID. If stage-1 is only supported, VMID is set to -1 and ignored from STE and CMD_TLBI_NH* cmds. Update smmu_iotlb_insert trace event to have vmid. Signed-off-by: Mostafa Saleh <smostafa@google.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-8-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Make TLB lookup work for stage-2Mostafa Saleh1-11/+33
Right now, either stage-1 or stage-2 are supported, this simplifies how we can deal with TLBs. This patch makes TLB lookup work if stage-2 is enabled instead of stage-1. TLB lookup is done before a PTW, if a valid entry is found we won't do the PTW. To be able to do TLB lookup, we need the correct tagging info, as granularity and input size, so we get this based on the supported translation stage. The TLB entries are added correctly from each stage PTW. When nested translation is supported, this would need to change, for example if we go with a combined TLB implementation, we would need to use the min of the granularities in TLB. As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P is not enabled. Signed-off-by: Mostafa Saleh <smostafa@google.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-7-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Parse STE config for stage-2Mostafa Saleh2-10/+182
Parse stage-2 configuration from STE and populate it in SMMUS2Cfg. Validity of field values are checked when possible. Only AA64 tables are supported and Small Translation Tables (STT) are not supported. According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields with an S2 prefix (with the exception of S2VMID) are IGNORED when stage-2 bypasses translation (Config[1] == 0). Which means that VMID can be used(for TLB tagging) even if stage-2 is bypassed, so we parse it unconditionally when S2P exists. Otherwise it is set to -1.(only S1P) As stall is not supported, if S2S is set the translation would abort. For S2R, we reuse the same code used for stage-1 with flag record_faults. However when nested translation is supported we would need to separate stage-1 and stage-2 faults. Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S. Signed-off-by: Mostafa Saleh <smostafa@google.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20230516203327.2051088-6-smostafa@google.com [PMM: fixed format string] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Add page table walk for stage-2Mostafa Saleh2-1/+176
In preparation for adding stage-2 support, add Stage-2 PTW code. Only Aarch64 format is supported as stage-1. Nesting stage-1 and stage-2 is not supported right now. HTTU is not supported, SW is expected to maintain the Access flag. This is described in the SMMUv3 manual(IHI 0070.E.a) "5.2. Stream Table Entry" in "[181] S2AFFD". This flag determines the behavior on access of a stage-2 page whose descriptor has AF == 0: - 0b0: An Access flag fault occurs (stall not supported). - 0b1: An Access flag fault never occurs. An Access fault takes priority over a Permission fault. There are 3 address size checks for stage-2 according to (IHI 0070.E.a) in "3.4. Address sizes". - As nesting is not supported, input address is passed directly to stage-2, and is checked against IAS. We use cfg->oas to hold the OAS when stage-1 is not used, this is set in the next patch. This check is done outside of smmu_ptw_64_s2 as it is not part of stage-2(it throws stage-1 fault), and the stage-2 function shouldn't change it's behavior when nesting is supported. When nesting is supported and we figure out how to combine TLB for stage-1 and stage-2 we can move this check into the stage-1 function as described in ARM DDI0487I.a in pseudocode aarch64/translation/vmsa_translation/AArch64.S1Translate aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput - Input to stage-2 is checked against s2t0sz, and throws stage-2 transaltion fault if exceeds it. - Output of stage-2 is checked against effective PA output range. Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Mostafa Saleh <smostafa@google.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-5-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Refactor stage-1 PTWMostafa Saleh3-18/+13
In preparation for adding stage-2 support, rename smmu_ptw_64 to smmu_ptw_64_s1 and refactor some of the code so it can be reused in stage-2 page table walk. Remove AA64 check from PTW as decode_cd already ensures that AA64 is used, otherwise it faults with C_BAD_CD. A stage member is added to SMMUPTWEventInfo to differentiate between stage-1 and stage-2 ptw faults. Add stage argument to trace_smmu_ptw_level be consistent with other trace events. Signed-off-by: Mostafa Saleh <smostafa@google.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-4-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30hw/arm/smmuv3: Add missing fields for IDR0Mostafa Saleh1-0/+2
In preparation for adding stage-2 support. Add IDR0 fields related to stage-2. VMID16: 16-bit VMID supported. S2P: Stage-2 translation supported. They are described in 6.3.1 SMMU_IDR0. No functional change intended. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Mostafa Saleh <smostafa@google.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230516203327.2051088-2-smostafa@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-30fsl-imx6: Add SNVS support for i.MX6 boardsVitaly Cheptsov1-0/+8
SNVS is supported on both i.MX6 and i.MX6UL and is needed to support shutdown on the board. Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6) Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6) Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6) Cc: qemu-devel@nongnu.org (open list:All patches CC here) Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru> Message-id: 20230515095015.66860-1-cheptsov@ispras.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-29Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into stagingRichard Henderson9-16/+68
ppc patch queue for 2023-05-28: This queue includes several assorted fixes for PowerPC SPR emulation, a change in the default Pegasos2 CPU, the addition of AIL mode 3 for spapr, a PIC->CPU interrupt fix for prep and performance enhancements in fpu_helper.c. # -----BEGIN PGP SIGNATURE----- # # iIwEABYKADQWIQQX6/+ZI9AYAK8oOBk82cqW3gMxZAUCZHOFiRYcZGFuaWVsaGI0 # MTNAZ21haWwuY29tAAoJEDzZypbeAzFkVZ0BAMV+9RlHKRlldOSPMEWCWo6hmA/U # 9SMyJsZPY3OpDbE3AP9XOQR1boqyT5MJXoeOUq1OLlFm6mY7UA300kBZ7wxVCw== # =IGNT # -----END PGP SIGNATURE----- # gpg: Signature made Sun 28 May 2023 09:47:05 AM PDT # gpg: using EDDSA key 17EBFF9923D01800AF2838193CD9CA96DE033164 # gpg: issuer "danielhb413@gmail.com" # gpg: Good signature from "Daniel Henrique Barboza <danielhb413@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 17EB FF99 23D0 1800 AF28 3819 3CD9 CA96 DE03 3164 * tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu: ppc/pegasos2: Change default CPU to 7457 target/ppc: Add POWER9 DD2.2 model target/ppc: Merge COMPUTE_CLASS and COMPUTE_FPRF pnv_lpc: disable reentrancy detection for lpc-hc target/ppc: Use SMT4 small core chip type in POWER9/10 PVRs hw/ppc/prep: Fix wiring of PIC -> CPU interrupt spapr: Add SPAPR_CAP_AIL_MODE_3 for AIL mode 3 support for H_SET_MODE hcall target/ppc: Alignment faults do not set DSISR in ISA v3.0 onward target/ppc: Fix width of some 32-bit SPRs target/ppc: Fix fallback to MFSS for MFFS* instructions on pre 3.0 ISAs Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-28ppc/pegasos2: Change default CPU to 7457BALATON Zoltan1-1/+1
Previously 7400 was selected as a safe choice as that is used by other machines so it's better tested but AmigaOS does not know this CPU and disables some features when running on it. The real hardware has 7447/7457 G4 CPU so change the default to match that now that it was confirmed to work better with AmigaOS. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Rene Engel <ReneEngel80@emailn.de> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230528152937.B8DAD74633D@zero.eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28target/ppc: Add POWER9 DD2.2 modelNicholas Piggin4-3/+4
POWER9 DD2.1 and earlier had significant limitations when running KVM, including lack of "mixed mode" MMU support (ability to run HPT and RPT mode on threads of the same core), and a translation prefetch issue which is worked around by disabling "AIL" mode for the guest. These processors are not widely available, and it's difficult to deal with all these quirks in qemu +/- KVM, so create a POWER9 DD2.2 CPU and make it the default POWER9 CPU. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Message-Id: <20230515160201.394587-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28pnv_lpc: disable reentrancy detection for lpc-hcAlexander Bulekov1-0/+3
As lpc-hc is designed for re-entrant calls from xscom, mark it re-entrancy safe. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> [clg: mark opb_master_regs as re-entrancy safe also ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com> Tested-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230526073850.2772197-1-clg@kaod.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28hw/ppc/prep: Fix wiring of PIC -> CPU interruptBernhard Beschow1-1/+3
Commit cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder") passes s->cpu_intr to i8259_init() in i82378_realize() directly. However, s- >cpu_intr isn't initialized yet since that happens after the south bridge's pci_realize_and_unref() in board code. Fix this by initializing s->cpu_intr before realizing the south bridge. Fixes: cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder") Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230304114043.121024-4-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28spapr: Add SPAPR_CAP_AIL_MODE_3 for AIL mode 3 support for H_SET_MODE hcallNicholas Piggin3-11/+57
The behaviour of the Address Translation Mode on Interrupt resource is not consistently supported by all CPU versions or all KVM versions: KVM HV does not support mode 2, and does not support mode 3 on POWER7 or early POWER9 processesors. KVM PR only supports mode 0. TCG supports all modes (0, 2, 3) on CPUs with support for the corresonding LPCR[AIL] mode. This leads to inconsistencies in guest behaviour and could cause problems migrating guests. This was not noticable for Linux guests for a long time because the kernel only uses modes 0 and 3, and it used to consider AIL-3 to be advisory in that it would always keep the AIL-0 vectors around, so it did not matter whether or not interrupts were delivered according to the AIL mode. Recent Linux guests depend on AIL mode 3 working as specified in order to support the SCV facility interrupt. If AIL-3 can not be provided, then H_SET_MODE must return an error to Linux so it can disable the SCV facility (failure to do so can lead to userspace being able to crash the guest kernel). Add the ail-mode-3 capability to specify that AIL-3 is supported. AIL-0 is implied as the baseline, and AIL-2 is no longer supported by spapr. AIL-2 is not known to be used by any software, but support in TCG could be restored with an ail-mode-2 capability quite easily if a regression is reported. Modify the H_SET_MODE Address Translation Mode on Interrupt resource handler to check capabilities and correctly return error if not supported. KVM has a cap to advertise support for AIL-3. Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20230515160216.394612-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-05-28virtio-input-pci: add virtio-multitouch-pciSergio Lopez1-4/+21
Add virtio-multitouch-pci, a Multitouch-capable input device, to the list of devices that can be provided by virtio-input-pci. Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230526112925.38794-5-slp@redhat.com>
2023-05-28virtio-input: add a virtio-mulitouch deviceSergio Lopez1-3/+115
Add a virtio-multitouch device to the family of devices emulated by virtio-input implementing the Multi-touch protocol as descripted here: https://www.kernel.org/doc/html/latest/input/multi-touch-protocol.html?highlight=multi+touch This patch just add the device itself, without connecting it to any backends. The following patches will add a PCI-based multitouch device, some helpers in "ui" and will enable the GTK3 backend to transpose multi-touch events from the host to the guest. Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230526112925.38794-4-slp@redhat.com>
2023-05-28virtio-input: generalize virtio_input_key_config()Sergio Lopez1-17/+21
As there are other bitmap-based config properties that need to be dealt in a similar fashion as VIRTIO_INPUT_CFG_EV_BITS, generalize the function to receive select and subsel as arguments, and rename it to virtio_input_extend_config() Signed-off-by: Sergio Lopez <slp@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230526112925.38794-2-slp@redhat.com>
2023-05-28virtio-gpu: add a FIXME for virtio_gpu_load()Marc-André Lureau1-0/+1
It looks like the virtio_gpu_load() does not compute and set the offset, the same way virtio_gpu_set_scanout() does. This probably results in incorrect display until the scanout/framebuffer is updated again, I guess we should fix it, although I haven't checked this yet. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230515132518.1025853-1-marcandre.lureau@redhat.com>
2023-05-26Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson1-6/+5
* build system fixes and cleanups * use subproject() for the dtc and keycodemapdb submodules * fix virtio memory leak * update slirp.wrap to latest commit in the master branch # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmRwi6cUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroO3awf9GsLa0sip+lUsV2JgzZGm2mL7Fo9A # kBbuehaT+5gI2PGY6Sp1RVdDnf/JS4HkU11TBBVYFpJdDwqerCNcprgOO3Y5Mung # Ukg93FgdvORlbTyfnMXNUe8dDaoTe6kvN1kTm+zhzMCJDTSCgZRqWc4Fh5oNg+No # pupeR7hjW6nEKSnYVhjP7LjSOteJfR9aeKT/bxRaQpmlegeGVC6RZ1naZtRHY6le # Y8KeKoelgBkEGPk5MnmFhnrITwYrfV0g2uP4Jinr5GildC8E/ZSmxo5h1TUqkQFA # /MKuIt6cRBitCHyYQLiXY+MZc6AkS3tsAhCo41Nknb4nylKeWgPHBIAWxA== # =NRBc # -----END PGP SIGNATURE----- # gpg: Signature made Fri 26 May 2023 03:36:23 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: configure: ignore --make meson: use subproject for keycodemapdb meson: use subproject for internal libfdt meson: simplify logic for -Dfdt virtio: qmp: fix memory leak slirp: update wrap to latest master meson: Add static glib dependency for initrd-stress.img meson: Remove leftover comment configure: unset harmful environment variables Makefile: remove $(TESTS_PYTHON) tests/vm: fix and simplify HOST_ARCH definition tests/docker: simplify HOST_ARCH definition Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-26virtio: qmp: fix memory leakPaolo Bonzini1-6/+5
The VirtioInfoList is already allocated by QAPI_LIST_PREPEND and need not be allocated by the caller. Fixes Coverity CID 1508724. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-26hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)Thomas Huth1-6/+17
We cannot use the generic reentrancy guard in the LSI code, so we have to manually prevent endless reentrancy here. The problematic lsi_execute_script() function has already a way to detect whether too many instructions have been executed - we just have to slightly change the logic here that it also takes into account if the function has been called too often in a reentrant way. The code in fuzz-lsi53c895a-test.c has been taken from an earlier patch by Mauro Matteo Cascella. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1563 Message-Id: <20230522091011.1082574-1-thuth@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26lsi53c895a: disable reentrancy detection for MMIO region, tooThomas Huth1-0/+1
While trying to use a SCSI disk on the LSI controller with an older version of Fedora (25), I'm getting: qemu: warning: Blocked re-entrant IO on MemoryRegion: lsi-mmio at addr: 0x34 and the SCSI controller is not usable. Seems like we have to disable the reentrancy checker for the MMIO region, too, to get this working again. The problem could be reproduced it like this: ./qemu-system-x86_64 -accel kvm -m 2G -machine q35 \ -device lsi53c810,id=lsi1 -device scsi-hd,drive=d0 \ -drive if=none,id=d0,file=.../somedisk.qcow2 \ -cdrom Fedora-Everything-netinst-i386-25-1.3.iso Where somedisk.qcow2 is an image that contains already some partitions and file systems. In the boot menu of Fedora, go to "Troubleshooting" -> "Rescue a Fedora system" -> "3) Skip to shell" Then check "dmesg | grep -i 53c" for failure messages, and try to mount a partition from somedisk.qcow2. Message-Id: <20230516090556.553813-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26machine: do not crash if default RAM backend name has been stolenIgor Mammedov1-0/+8
QEMU aborts when default RAM backend should be used (i.e. no explicit '-machine memory-backend=' specified) but user has created an object which 'id' equals to default RAM backend name used by board. $QEMU -machine pc \ -object memory-backend-ram,id=pc.ram,size=4294967296 Actual results: QEMU 7.2.0 monitor - type 'help' for more information (qemu) Unexpected error in object_property_try_add() at ../qom/object.c:1239: qemu-kvm: attempt to add duplicate property 'pc.ram' to object (type 'container') Aborted (core dumped) Instead of abort, check for the conflicting 'id' and exit with an error, suggesting how to remedy the issue. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2207886 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20230522131717.3780533-1-imammedo@redhat.com> Tested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Shaoqin Huang <shahuang@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26hw/mips: Use MachineClass->default_nic in the virt machinePhilippe Mathieu-Daudé1-1/+3
Mark the default NIC via the new MachineClass->default_nic setting so that the machine-defaults code in vl.c can decide whether the default NIC is usable or not (for example when compiling with the "--without-default-devices" configure switch). Inspired-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230524122559.28863-1-philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26hw/arm: Use MachineClass->default_nic in the sbsa-ref machineThomas Huth1-1/+3
Mark the default NIC via the new MachineClass->default_nic setting so that the machine-defaults code in vl.c can decide whether the default NIC is usable or not (for example when compiling with the "--without-default-devices" configure switch). Message-Id: <20230524082037.1620952-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26hw/xtensa: Use MachineClass->default_nic in the virt machineThomas Huth1-3/+6
Mark the default NIC via the new MachineClass->default_nic setting so that the machine-defaults code in vl.c can decide whether the default NIC is usable or not (for example when compiling with the "--without-default-devices" configure switch). Message-Id: <20230523110435.1375774-6-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26hw/loongarch64: Use MachineClass->default_nic in the virt machineThomas Huth1-1/+3
Mark the default NIC via the new MachineClass->default_nic setting so that the machine-defaults code in vl.c can decide whether the default NIC is usable or not (for example when compiling with the "--without-default-devices" configure switch). Message-Id: <20230523110435.1375774-5-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Song Gao <gaosong@loongson.cn> Tested-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26hw/arm: Use MachineClass->default_nic in the virt machineThomas Huth1-1/+3
Mark the default NIC via the new MachineClass->default_nic setting so that the machine-defaults code in vl.c can decide whether the default NIC is usable or not (for example when compiling with the "--without-default-devices" configure switch). Message-Id: <20230523110435.1375774-4-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26hw/alpha: Use MachineClass->default_nic in the alpha machineThomas Huth1-1/+3
Mark the default NIC via the new MachineClass->default_nic setting so that the machine-defaults code in vl.c can decide whether the default NIC is usable or not (for example when compiling with the "--without-default-devices" configure switch). Message-Id: <20230523110435.1375774-3-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-26hw/hppa: Use MachineClass->default_nic in the hppa machineThomas Huth1-1/+3
Mark the default NIC via the new MachineClass->default_nic setting so that the machine-defaults code in vl.c can decide whether the default NIC is usable or not (for example when compiling with the "--without-default-devices" configure switch). Message-Id: <20230523110435.1375774-2-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-05-25Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson1-0/+2
* hot-unplug fixes for ioport * purge qatomic_mb_read/set from monitor * build system fixes * OHCI fix from gitlab * provide EPYC-Rome CPU model not susceptible to XSAVES erratum # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmRvGpEUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOa/Af/WS5/tmIlEYgH7UOPERQXNqf7+Jwj # bA2wgqv3ZoQwcgp5f4EVjfA8ABfpGxLZy6xIdUSbWANb8lDJNuh/nPd/em3rWUAU # LnJGGdo1vF31gfsVQnlzb7hJi3ur+e2f8JqkRVskDCk3a7YY44OCN42JdKWLrN9u # CFf2zYqxMqXHjrYrY0Kx2oTkfGDZrfwUlx0vM4dHb8IEoxaplfDd8lJXQzjO4htr # 3nPBPjQ+h08EeC7mObH4XoJE0omzovR10GkBo8K4q952xGOQ041Y/2YY7JwLfx0D # na7IanVo+ZAmvTJZoJFSBwNnXkTMHvDH5+Hc45NSTsDBtz0YJhRxPw/z/A== # =A5Lp # -----END PGP SIGNATURE----- # gpg: Signature made Thu 25 May 2023 01:21:37 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: monitor: do not use mb_read/mb_set monitor: extract request dequeuing to a new function monitor: introduce qmp_dispatcher_co_wake monitor: cleanup fetching of QMP requests monitor: cleanup detection of qmp_dispatcher_co shutting down monitor: do not use mb_read/mb_set for suspend_cnt monitor: add more *_locked() functions monitor: allow calling monitor_resume under mon_lock monitor: use QEMU_LOCK_GUARD a bit more softmmu/ioport.c: make MemoryRegionPortioList owner of portio_list MemoryRegions softmmu/ioport.c: QOMify MemoryRegionPortioList softmmu/ioport.c: allocate MemoryRegionPortioList ports on the heap usb/ohci: Set pad to 0 after frame update meson: move -no-pie from linker to compiler meson: fix rule for qemu-ga installer meson.build: Fix glib -Wno-unused-function workaround target/i386: EPYC-Rome model without XSAVES Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-25usb/ohci: Set pad to 0 after frame updatePaolo Bonzini1-0/+2
When the OHCI controller's framenumber is incremented, HccaPad1 register should be set to zero (Ref OHCI Spec 4.4) ReactOS uses hccaPad1 to determine if the OHCI hardware is running, consequently it fails this check in current qemu master. Signed-off-by: Ryan Wendland <wendland@live.com.au> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1048 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-05-24vfio/pci: Fix a use-after-free issueZhenzhong Duan1-1/+1
vbasedev->name is freed wrongly which leads to garbage VFIO trace log. Fix it by allocating a dup of vbasedev->name and then free the dup. Fixes: 2dca1b37a760 ("vfio/pci: add support for VF token") Suggested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Acked-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2023-05-23Merge tag 'mem-2023-05-23' of https://github.com/davidhildenbrand/qemu into ↵Richard Henderson1-0/+1
staging Hi, "Host Memory Backends" and "Memory devices" queue ("mem"): - New "offset" option for memory-backend-file # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEG9nKrXNcTDpGDfzKTd4Q9wD/g1oFAmRs0h4RHGRhdmlkQHJl # ZGhhdC5jb20ACgkQTd4Q9wD/g1r+9BAAsOtioPE3y1xBNyLhO+sbBK4w0Xf5ABRF # QXfrSPfz0IaThzg33o7eCUMrbC5UmRyeq1aeGWFNo1RevgKxeFFlcVdvUFDeJL5R # vS94ZzowpJ6lJvpgP8iOMmWY2nztWpIfE92nLKIeze5nlbnMwKn8ZlVWkqFialkT # Ro1AI/ZmyvUDJj8UXQEW+p1NWE4m59TH5atQqBG3kkU7RJTU4DKVQtKbOysEwIhr # A4y0nvgMeHLlEPUSqcERe9wOqVENdlsON6vms5AILN4/TmjSe3BHINjH9NOFveiO # wgquSt0ystPAY0MXRPXgg6XwL1AAFR9cJt/rOZiBYpqeZHAmKOsi5qUXyv2dmXhw # RaPV041g2RJZiFgH1N4v4aN0j8AYbtHSYYsP1snfULa8VfePPquY/UxyPaK28WHn # on5VV5nBScYNVtKI90Gci4jxGStnM0zG503GQ26pt85+35866zertBqsTTPIO2Mm # 7+YSkedSzmIt11GH0rqdghQte6qj1ED8lGO626s5m+qbGL9WuBXYCG9yzl5yTLsz # I27si7Fh/Y0QQHs3GEAH2tsi89tphElnZksdj4P1/uPDIDnTF7d5I+tlUiQXHNaw # rXAV76q4j0GgbBm4Cp1iMTUNxALes4aOG7oRMeFxvVWy0fqmfAvKhDVILGkUlYTr # C82GUJ5x3mc= # =izHP # -----END PGP SIGNATURE----- # gpg: Signature made Tue 23 May 2023 07:47:58 AM PDT # gpg: using RSA key 1BD9CAAD735C4C3A460DFCCA4DDE10F700FF835A # gpg: issuer "david@redhat.com" # gpg: Good signature from "David Hildenbrand <david@redhat.com>" [unknown] # gpg: aka "David Hildenbrand <davidhildenbrand@gmail.com>" [undefined] # gpg: aka "David Hildenbrand <hildenbr@in.tum.de>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 1BD9 CAAD 735C 4C3A 460D FCCA 4DDE 10F7 00FF 835A * tag 'mem-2023-05-23' of https://github.com/davidhildenbrand/qemu: hostmem-file: add offset option Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-05-23hostmem-file: add offset optionAlexander Graf1-0/+1
Add an option for hostmem-file to start the memory object at an offset into the target file. This is useful if multiple memory objects reside inside the same target file, such as a device node. In particular, it's useful to map guest memory directly into /dev/mem for experimentation. To make this work consistently, also fix up all places in QEMU that expect fd offsets to be 0. Signed-off-by: Alexander Graf <graf@amazon.com> Message-Id: <20230403221421.60877-1-graf@amazon.com> Acked-by: Markus Armbruster <armbru@redhat.com> Acked-by: Peter Xu <peterx@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com>
2023-05-23rtl8139: fix large_send_mss divide-by-zeroStefan Hajnoczi1-0/+3
If the driver sets large_send_mss to 0 then a divide-by-zero occurs. Even if the division wasn't a problem, the for loop that emits MSS-sized packets would never terminate. Solve these issues by skipping offloading when large_send_mss=0. This issue was found by OSS-Fuzz as part of Alexander Bulekov's device fuzzing work. The reproducer is: $ cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ 512M,slots=1,maxmem=0xffff000000000000 -machine q35 -nodefaults -device \ rtl8139,netdev=net0 -netdev user,id=net0 -device \ pc-dimm,id=nv1,memdev=mem1,addr=0xb800a64602800000 -object \ memory-backend-ram,id=mem1,size=2M -qtest stdio outl 0xcf8 0x80000814 outl 0xcfc 0xe0000000 outl 0xcf8 0x80000804 outw 0xcfc 0x06 write 0xe0000037 0x1 0x04 write 0xe00000e0 0x2 0x01 write 0x1 0x1 0x04 write 0x3 0x1 0x98 write 0xa 0x1 0x8c write 0xb 0x1 0x02 write 0xc 0x1 0x46 write 0xd 0x1 0xa6 write 0xf 0x1 0xb8 write 0xb800a646028c000c 0x1 0x08 write 0xb800a646028c000e 0x1 0x47 write 0xb800a646028c0010 0x1 0x02 write 0xb800a646028c0017 0x1 0x06 write 0xb800a646028c0036 0x1 0x80 write 0xe00000d9 0x1 0x40 EOF Buglink: https://gitlab.com/qemu-project/qemu/-/issues/1582 Closes: https://gitlab.com/qemu-project/qemu/-/issues/1582 Cc: qemu-stable@nongnu.org Cc: Peter Maydell <peter.maydell@linaro.org> Fixes: 6d71357a3b65 ("rtl8139: honor large send MSS value") Reported-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23vmxnet3: Do not depend on PCAkihiko Odaki1-1/+1
vmxnet3 has no dependency on PC, and VMware Fusion actually makes it available on Apple Silicon according to: https://kb.vmware.com/s/article/90364 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23igb: Clear-on-read ICR when ICR.INTA is setAkihiko Odaki1-0/+2
For GPIE.NSICR, Section 7.3.2.1.2 says: > ICR bits are cleared on register read. If GPIE.NSICR = 0b, then the > clear on read occurs only if no bit is set in the IMS or at least one > bit is set in the IMS and there is a true interrupt as reflected in > ICR.INTA. e1000e does similar though it checks for CTRL_EXT.IAME, which does not exist on igb. Suggested-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23igb: Notify only new interruptsAkihiko Odaki2-126/+86
This follows the corresponding change for e1000e. This fixes: tests/avocado/netdev-ethtool.py:NetDevEthtool.test_igb Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23e1000e: Notify only new interruptsAkihiko Odaki3-88/+69
In MSI-X mode, if there are interrupts already notified but not cleared and a new interrupt arrives, e1000e incorrectly notifies the notified ones again along with the new one. To fix this issue, replace e1000e_update_interrupt_state() with two new functions: e1000e_raise_interrupts() and e1000e_lower_interrupts(). These functions don't only raise or lower interrupts, but it also performs register writes which updates the interrupt state. Before it performs a register write, these function determines the interrupts already raised, and compares with the interrupts raised after the register write to determine the interrupts to notify. The introduction of these functions made tracepoints which assumes that the caller of e1000e_update_interrupt_state() performs register writes obsolete. These tracepoints are now removed, and alternative ones are added to the new functions. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23igb: Implement Tx timestampAkihiko Odaki2-0/+10
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23igb: Implement Rx PTP2 timestampAkihiko Odaki3-41/+127
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23igb: Implement igb-specific oversize checkAkihiko Odaki1-15/+21
igb has a configurable size limit for LPE, and uses different limits depending on whether the packet is treated as a VLAN packet. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Jason Wang <jasowang@redhat.com>
2023-05-23igb: Filter with the second VLAN tag for extended VLANAkihiko Odaki1-5/+18
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
generated by cgit v1.1 at 2025-01-09 23:34:06 +0000