aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2021-06-21hw/acpi: Provide function acpi_ghes_present()Peter Maydell2-0/+22
Allow code elsewhere in the system to check whether the ACPI GHES table is present, so it can determine whether it is OK to try to record an error by calling acpi_ghes_record_errors(). (We don't need to migrate the new 'present' field in AcpiGhesState, because it is set once at system initialization and doesn't change.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dongjiu Geng <gengdongjiu1@gmail.com> Message-id: 20210603171259.27962-3-peter.maydell@linaro.org
2021-06-21hw/acpi: Provide stub version of acpi_ghes_record_errors()Peter Maydell2-3/+20
Generic code in target/arm wants to call acpi_ghes_record_errors(); provide a stub version so that we don't fail to link when CONFIG_ACPI_APEI is not set. This requires us to add a new ghes-stub.c file to contain it and the meson.build mechanics to use it when appropriate. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dongjiu Geng <gengdongjiu1@gmail.com> Message-id: 20210603171259.27962-2-peter.maydell@linaro.org
2021-06-21Merge remote-tracking branch ↵Peter Maydell1-0/+24
'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging x86 queue, 2021-06-18 Features: * Add ratelimit for bus locks acquired in guest (Chenyi Qiang) Documentation: * SEV documentation updates (Tom Lendacky) * Add a table showing x86-64 ABI compatibility levels (Daniel P. Berrangé) Automated changes: * Update Linux headers to 5.13-rc4 (Eduardo Habkost) # gpg: Signature made Fri 18 Jun 2021 20:51:26 BST # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost-gl/tags/x86-next-pull-request: scripts: helper to generate x86_64 CPU ABI compat info docs: add a table showing x86-64 ABI compatibility levels docs/interop/firmware.json: Add SEV-ES support docs: Add SEV-ES documentation to amd-memory-encryption.txt doc: Fix some mistakes in the SEV documentation i386: Add ratelimit for bus locks acquired in guest Update Linux headers to 5.13-rc4 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-18vfio/migration: Correct device state from vmstate change for savevm caseKirti Wankhede1-1/+10
Set _SAVING flag for device state from vmstate change handler when it gets called from savevm. Currently State transition savevm/suspend is seen as: _RUNNING -> _STOP -> Stop-and-copy -> _STOP State transition savevm/suspend should be: _RUNNING -> Stop-and-copy -> _STOP State transition from _RUNNING to _STOP occurs from vfio_vmstate_change() where when vmstate changes from running to !running, _RUNNING flag is reset but at the same time when vfio_vmstate_change() is called for RUN_STATE_SAVE_VM, _SAVING bit should be set. Reported by: Yishai Hadas <yishaih@nvidia.com> Signed-off-by: Kirti Wankhede <kwankhede@nvidia.com> Message-Id: <1623177441-27496-1-git-send-email-kwankhede@nvidia.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2021-06-18vfio: Fix unregister SaveVMHandler in vfio_migration_finalizeKunkun Jiang1-0/+1
In the vfio_migration_init(), the SaveVMHandler is registered for VFIO device. But it lacks the operation of 'unregister'. It will lead to 'Segmentation fault (core dumped)' in qemu_savevm_state_setup(), if performing live migration after a VFIO device is hot deleted. Fixes: 7c2f5f75f94 (vfio: Register SaveVMHandlers for VFIO device) Reported-by: Qixin Gan <ganqixin@huawei.com> Signed-off-by: Kunkun Jiang <jiangkunkun@huawei.com> Message-Id: <20210527123101.289-1-jiangkunkun@huawei.com> Reviewed by: Kirti Wankhede <kwankhede@nvidia.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2021-06-18Merge remote-tracking branch ↵Peter Maydell1-0/+14
'remotes/kraxel/tags/audio-20210617-pull-request' into staging audio: bugfix collection. # gpg: Signature made Thu 17 Jun 2021 13:40:56 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/audio-20210617-pull-request: coreaudio: Fix output stream format settings audio: Fix format specifications of debug logs hw/audio/sb16: Avoid assertion by restricting I/O sampling rate range jackaudio: avoid that the client name contains the word (NULL) audio: move code to audio/audio.c paaudio: remove unused stream flags alsaaudio: remove #ifdef DEBUG to avoid bit rot Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-17i386: Add ratelimit for bus locks acquired in guestChenyi Qiang1-0/+24
A bus lock is acquired through either split locked access to writeback (WB) memory or any locked access to non-WB memory. It is typically >1000 cycles slower than an atomic operation within a cache and can also disrupts performance on other cores. Virtual Machines can exploit bus locks to degrade the performance of system. To address this kind of performance DOS attack coming from the VMs, bus lock VM exit is introduced in KVM and it can report the bus locks detected in guest. If enabled in KVM, it would exit to the userspace to let the user enforce throttling policies once bus locks acquired in VMs. The availability of bus lock VM exit can be detected through the KVM_CAP_X86_BUS_LOCK_EXIT. The returned bitmap contains the potential policies supported by KVM. The field KVM_BUS_LOCK_DETECTION_EXIT in bitmap is the only supported strategy at present. It indicates that KVM will exit to userspace to handle the bus locks. This patch adds a ratelimit on the bus locks acquired in guest as a mitigation policy. Introduce a new field "bus_lock_ratelimit" to record the limited speed of bus locks in the target VM. The user can specify it through the "bus-lock-ratelimit" as a machine property. In current implementation, the default value of the speed is 0 per second, which means no restrictions on the bus locks. As for ratelimit on detected bus locks, simply set the ratelimit interval to 1s and restrict the quota of bus lock occurence to the value of "bus_lock_ratelimit". A potential alternative is to introduce the time slice as a property which can help the user achieve more precise control. The detail of bus lock VM exit can be found in spec: https://software.intel.com/content/www/us/en/develop/download/intel-architecture-instruction-set-extensions-programming-reference.html Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com> Message-Id: <20210521043820.29678-1-chenyi.qiang@intel.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-06-17Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell7-82/+152
staging * avoid deprecation warnings for SASL on macOS 10.11 or newer * fix -readconfig when config blocks have an id (like [chardev "qmp"]) * Error* initialization fixes * Improvements to ESP emulation (Mark) * Allow creating noreserve memory backends (David) * Improvements to query-memdev (David) * Bump compiler to C11 (Richard) * First round of SVM fixes from GSoC project (Lara) # gpg: Signature made Wed 16 Jun 2021 16:37:49 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: (45 commits) configure: Remove probe for _Static_assert qemu/compiler: Remove QEMU_GENERIC include/qemu/lockable: Use _Generic instead of QEMU_GENERIC util: Use unique type for QemuRecMutex in thread-posix.h util: Pass file+line to qemu_rec_mutex_unlock_impl util: Use real functions for thread-posix QemuRecMutex softfloat: Use _Generic instead of QEMU_GENERIC configure: Use -std=gnu11 target/i386: Added Intercept CR0 writes check target/i386: Added consistency checks for CR0 target/i386: Added consistency checks for VMRUN intercept and ASID target/i386: Refactored intercept checks into cpu_svm_has_intercept configure: map x32 to cpu_family x86_64 for meson hmp: Print "reserve" property of memory backends with "info memdev" qmp: Include "reserve" property of memory backends hmp: Print "share" property of memory backends with "info memdev" qmp: Include "share" property of memory backends qmp: Clarify memory backend properties returned via query-memdev hostmem: Wire up RAM_NORESERVE via "reserve" property util/mmap-alloc: Support RAM_NORESERVE via MAP_NORESERVE under Linux ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-17hw/audio/sb16: Avoid assertion by restricting I/O sampling rate rangePhilippe Mathieu-Daudé1-0/+14
While the SB16 seems to work up to 48000 Hz, the "Sound Blaster Series Hardware Programming Guide" limit the sampling range from 4000 Hz to 44100 Hz (Section 3-9, 3-10: Digitized Sound I/O Programming, tables 3-2 and 3-3). Later, section 6-15 (DSP Commands) is more specific regarding the 41h / 42h registers (Set digitized sound output sampling rate): Valid sampling rates range from 5000 to 45000 Hz inclusive. There is no comment regarding error handling if the register is filled with an out-of-range value. (See also section 3-28 "8-bit or 16-bit Auto-initialize Transfer"). Assume limits are enforced in hardware. This fixes triggering an assertion in audio_calloc(): #1 abort #2 audio_bug audio/audio.c:119:9 #3 audio_calloc audio/audio.c:154:9 #4 audio_pcm_sw_alloc_resources_out audio/audio_template.h:116:15 #5 audio_pcm_sw_init_out audio/audio_template.h:175:11 #6 audio_pcm_create_voice_pair_out audio/audio_template.h:410:9 #7 AUD_open_out audio/audio_template.h:503:14 #8 continue_dma8 hw/audio/sb16.c:216:20 #9 dma_cmd8 hw/audio/sb16.c:276:5 #10 command hw/audio/sb16.c:0 #11 dsp_write hw/audio/sb16.c:949:13 #12 portio_write softmmu/ioport.c:205:13 #13 memory_region_write_accessor softmmu/memory.c:491:5 #14 access_with_adjusted_size softmmu/memory.c:552:18 #15 memory_region_dispatch_write softmmu/memory.c:0:13 #16 flatview_write_continue softmmu/physmem.c:2759:23 #17 flatview_write softmmu/physmem.c:2799:14 #18 address_space_write softmmu/physmem.c:2891:18 #19 cpu_outw softmmu/ioport.c:70:5 [*] http://www.baudline.com/solutions/full_duplex/sb16_pci/index.html OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29174 Fixes: 85571bc7415 ("audio merge (malc)") Buglink: https://bugs.launchpad.net/bugs/1910603 Tested-by: Qiang Liu <cyruscyliu@gmail.com> Reviewed-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210616104349.2398060-1-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-06-16Merge remote-tracking branch ↵Peter Maydell6-11/+122
'remotes/pmaydell/tags/pull-target-arm-20210616' into staging target-arm queue: * hw/intc/arm_gicv3_cpuif: Tolerate spurious EOIR writes * handle some UNALLOCATED decode cases correctly rather than asserting * hw: virt: consider hw_compat_6_0 * hw/arm: add quanta-gbs-bmc machine * hw/intc/armv7m_nvic: Remove stale comment * target/arm: Fix mte page crossing test * hw/arm: quanta-q71l add pca954x muxes * target/arm: First few parts of MVE support # gpg: Signature made Wed 16 Jun 2021 14:34:49 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210616: (25 commits) include/qemu/int128.h: Add function to create Int128 from int64_t bitops.h: Provide hswap32(), hswap64(), wswap64() swapping operations target/arm: Move expand_pred_b() data to vec_helper.c target/arm: Add framework for MVE decode target/arm: Implement MVE LETP insn target/arm: Implement MVE DLSTP target/arm: Implement MVE WLSTP insn target/arm: Implement MVE LCTP target/arm: Let vfp_access_check() handle late NOCP checks target/arm: Add handling for PSR.ECI/ICI target/arm: Handle VPR semantics in existing code target/arm: Enable FPSCR.QC bit for MVE target/arm: Provide and use H8 and H1_8 macros hw/arm: quanta-q71l add pca954x muxes hw/arm: gsj add pca9548 hw/arm: gsj add i2c comments target/arm: Fix mte page crossing test hw/intc/armv7m_nvic: Remove stale comment hw/arm: quanta-gbs-bmc add i2c comments hw/arm: add quanta-gbs-bmc machine ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-16hw/arm: quanta-q71l add pca954x muxesPatrick Venture2-3/+9
Adds the pca954x muxes expected. Tested: Booted quanta-q71l image to userspace. Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 20210608202522.2677850-4-venture@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-16hw/arm: gsj add pca9548Patrick Venture2-4/+3
Tested: Quanta-gsj firmware booted. i2c /dev entries driver I2C init bus 1 freq 100000 I2C init bus 2 freq 100000 I2C init bus 3 freq 100000 I2C init bus 4 freq 100000 I2C init bus 8 freq 100000 I2C init bus 9 freq 100000 at24 9-0055: 8192 byte 24c64 EEPROM, writable, 1 bytes/write I2C init bus 10 freq 100000 at24 10-0055: 8192 byte 24c64 EEPROM, writable, 1 bytes/write I2C init bus 12 freq 100000 I2C init bus 15 freq 100000 i2c i2c-15: Added multiplexed i2c bus 16 i2c i2c-15: Added multiplexed i2c bus 17 i2c i2c-15: Added multiplexed i2c bus 18 i2c i2c-15: Added multiplexed i2c bus 19 i2c i2c-15: Added multiplexed i2c bus 20 i2c i2c-15: Added multiplexed i2c bus 21 i2c i2c-15: Added multiplexed i2c bus 22 i2c i2c-15: Added multiplexed i2c bus 23 pca954x 15-0075: registered 8 multiplexed busses for I2C switch pca9548 Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20210608202522.2677850-3-venture@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-16hw/arm: gsj add i2c commentsPatrick Venture1-1/+15
Adds comments to the board init to identify missing i2c devices. Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20210608202522.2677850-2-venture@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-16Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210615-pull-request' ↵Peter Maydell2-7/+16
into staging vga: fixes for stdvga, vhost-user-gpu and virtio-gpu. # gpg: Signature made Tue 15 Jun 2021 18:40:11 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20210615-pull-request: virtio-gpu: move scanout_id sanity check vhost-user-gpu: reorder free calls. vga: Allow writing VBE_DISPI_ID5 to ID register Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-15hmp: Print "reserve" property of memory backends with "info memdev"David Hildenbrand1-0/+4
Let's print the new property. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> for memory backend and machine core Cc: Markus Armbruster <armbru@redhat.com> Cc: Eric Blake <eblake@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20210510114328.21835-16-david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15qmp: Include "reserve" property of memory backendsDavid Hildenbrand1-0/+7
Let's include the new property. Instead of relying on CONFIG_LINUX, let's try to unconditionally grab the property and treat errors as "does not exist". Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> for memory backend and machine core Cc: Eric Blake <eblake@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20210510114328.21835-15-david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15hmp: Print "share" property of memory backends with "info memdev"David Hildenbrand1-0/+2
Let's print the property. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> for memory backend and machine core Cc: Markus Armbruster <armbru@redhat.com> Cc: Eric Blake <eblake@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20210510114328.21835-14-david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15qmp: Include "share" property of memory backendsDavid Hildenbrand1-0/+1
Let's include the property, which can be helpful when debugging, for example, to spot misuse of MAP_PRIVATE which can result in some ugly corner cases (e.g., double-memory consumption on shmem). Use the same description we also use for describing the property. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> for memory backend and machine core Cc: Eric Blake <eblake@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20210510114328.21835-13-david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15softmmu/memory: Pass ram_flags to memory_region_init_ram_shared_nomigrate()David Hildenbrand1-2/+2
Let's forward ram_flags instead, renaming memory_region_init_ram_shared_nomigrate() into memory_region_init_ram_flags_nomigrate(). Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> for memory backend and machine core Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20210510114328.21835-6-david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15softmmu/memory: Pass ram_flags to qemu_ram_alloc_from_fd()David Hildenbrand1-3/+2
Let's pass in ram flags just like we do with qemu_ram_alloc_from_file(), to clean up and prepare for more flags. Simplify the documentation of passed ram flags: Looking at our documentation of RAM_SHARED and RAM_PMEM is sufficient, no need to be repetitive. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> for memory backend and machine core Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20210510114328.21835-5-david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15hw/intc/armv7m_nvic: Remove stale commentPeter Maydell1-6/+0
In commit da6d674e509f0939b we split the NVIC code out from the GIC. This allowed us to specify the NVIC's default value for the num-irq property (64) in the usual way in its property list, and we deleted the previous hack where we updated the value in the state struct in the instance init function. Remove a stale comment about that hack which we forgot to delete at that time. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210614161243.14211-1-peter.maydell@linaro.org
2021-06-15hw/arm: quanta-gbs-bmc add i2c commentsPatrick Venture1-0/+60
Add a comment and i2c method that describes the board layout. Tested: firmware booted to userspace. Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Brandon Kim <brandonkim@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Message-id: 20210608193605.2611114-3-venture@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-15hw/arm: add quanta-gbs-bmc machinePatrick Venture1-0/+33
Adds initial quanta-gbs-bmc machine support. Tested: Boots to userspace. Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Brandon Kim <brandonkim@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Message-id: 20210608193605.2611114-2-venture@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-15hw: virt: consider hw_compat_6_0Heinrich Schuchardt1-0/+2
virt-6.0 must consider hw_compat_6_0. Fixes: da7e13c00b59 ("hw: add compat machines for 6.1") Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20210610183500.54207-1-xypron.glpk@gmx.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-15hw/intc/arm_gicv3_cpuif: Tolerate spurious EOIR writesJean-Philippe Brucker1-1/+4
Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic") added an assert_not_reached() if the guest writes the EOIR register while no interrupt is active. It turns out some software does this: EDK2, in GicV3ExitBootServicesEvent(), unconditionally write EOIR for all interrupts that it manages. This now causes QEMU to abort when running UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2 does need fixing, the punishment seems a little harsh, especially since icc_eoir_write() already tolerates writes of nonexistent interrupt numbers. Display a guest error and tolerate spurious EOIR writes. Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic") Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20210604130352.1887560-1-jean-philippe@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-15esp: store lun coming from the MESSAGE OUT phasePaolo Bonzini2-17/+33
The LUN is selected with an IDENTIFY message, and persists until the next message out phase. Instead of passing it to do_busid_cmd, store it in ESPState. Because do_cmd can simply skip the message out phase if cmdfifo_cdb_offset is zero, it can now be used for the S without ATN cases as well. Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: fix migration version check in esp_is_version_5()Mark Cave-Ayland1-1/+1
Commit 4e78f3bf35 "esp: defer command completion interrupt on incoming data transfers" added a version check for use with VMSTATE_*_TEST macros to allow migration from older QEMU versions. Unfortunately the version check fails to work in its current form since if the VMStateDescription version_id is incremented, the test returns false and so the fields are not included in the outgoing migration stream. Change the version check to use >= rather == to ensure that migration works correctly when the ESPState VMStateDescription has version_id > 5. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 4e78f3bf35 ("esp: defer command completion interrupt on incoming data transfers") Message-Id: <20210613102614.5438-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: correctly accumulate extended messages for PDMAMark Cave-Ayland1-3/+20
Commit 799d90d818 "esp: transition to message out phase after SATN and stop command" added logic to correctly handle extended messages for DMA requests but not for PDMA requests. Apply the same logic in esp_do_dma() to do_dma_pdma_cb() so that extended messages terminated with a PDMA request are accumulated correctly. This allows the ESP device to respond correctly to the SDTR negotiation initiated by the NetBSD ESP driver without causing errors and timeouts on boot. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210519100803.10293-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: revert 75ef849696 "esp: correctly fill bus id with requested lun"Mark Cave-Ayland1-3/+0
This commit from nearly 10 years ago is now broken due to the improvements in esp emulation (or perhaps was never correct). It shows up as a bug in detecting the CDROM drive under MacOS. The error is caused by the MacOS CDROM driver sending this CDB with an "S without ATN" command and without DMA: 0x12 0x00 0x00 0x00 0x05 0x00 (INQUIRY) This is a valid INQUIRY command, however with this logic present the 3rd byte (0x0) is copied over the 1st byte (0x12) which silently converts the INQUIRY command to a TEST UNIT READY command before passing it to the QEMU SCSI layer. Since the TEST UNIT READY command has a zero length response the MacOS CDROM driver never receives a response and assumes the CDROM is not present. The logic was to ignore the IDENTIFY byte and copy the LUN over from the CDB, which did store the LUN in bits 5-7 of the second byte in olden times. This however is all obsolete, so just drop the code. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210519100803.10293-5-mark.cave-ayland@ilande.co.uk> [Tweaked commit message. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: ensure PDMA write transfers are flushed from the FIFO to the target ↵Mark Cave-Ayland1-14/+11
immediately After each PDMA write transfer the MacOS CDROM driver waits until the FIFO is empty (i.e. its contents have been written out to the SCSI bus) by polling the FIFO count register until it reads 0. This doesn't work with the current PDMA write implementation which waits until either the FIFO is full or the transfer is complete before invoking the PDMA callback to process the FIFO contents. Change the PDMA write transfer logic so that the PDMA callback is invoked after each PDMA write to transfer the FIFO contents to the target buffer immediately, and hence avoid getting stuck in the FIFO count register polling loop. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210519100803.10293-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: handle non-DMA transfers from the target one byte at a timeMark Cave-Ayland1-22/+50
The initial implementation of non-DMA transfers was based upon analysis of traces from the MacOS toolbox ROM for handling unaligned reads but missed one key aspect - during a non-DMA transfer from the target, the bus service interrupt should be raised for every single byte received from the bus and not just at either the end of the transfer or when the FIFO is full. Adjust the non-DMA code accordingly so that esp_do_nodma() is called for every byte received from the target. This also includes special handling for managing the change from DATA IN to STATUS phase as this needs to occur when the final byte is read out from the FIFO, and not at the end of the transfer of the last byte into the FIFO. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210519100803.10293-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: allow non-DMA callback in esp_transfer_data() initial transferMark Cave-Ayland1-12/+2
The current implementation only resumes DMA transfers when incoming data is received from the target device, but this is also required for non-DMA transfers with the next set of non-DMA changes. Rather than duplicate the DMA/non-DMA dispatch logic in the initial transfer section, update the code so that the initial transfer section can just fallthrough to the main DMA/non-DMA dispatch logic. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210519100803.10293-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: only set ESP_RSEQ at the start of the select sequenceMark Cave-Ayland1-2/+9
When processing a command to select a target and send a CDB, the ESP device maintains a sequence step register so that if an error occurs the host can determine which part of the selection/CDB submission sequence failed. The old Linux 2.6 driver is really pedantic here: it checks the sequence step register even if a command succeeds and complains loudly on the console if the sequence step register doesn't match the expected bus phase and interrupt flags. This reason this mismatch occurs is because the ESP emulation currently doesn't update the bus phase until the next TI (Transfer Information) command and so the cleared sequence step register is considered invalid for the stale bus phase. Normally this isn't an issue as the host only checks the sequence step register if an error occurs but the old Linux 2.6 driver does this in several places causing a large stream of "esp0: STEP_ASEL for tgt 0" messages to appear on the console during the boot process. Fix this by not clearing the sequence step register when reading the interrupt register and clearing the DMA status, so the guest sees a valid sequence step and bus phase combination at the end of the command phase. No other change is required since the sequence step register is correctly updated throughout the selection/CDB submission sequence once one of the select commands is issued. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 1b9e48a5bd ("esp: implement non-DMA transfers in PDMA mode") Message-Id: <20210518212511.21688-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: only assert INTR_DC interrupt flag if selection failsMark Cave-Ayland1-1/+1
The datasheet sequence tables confirm that when a target selection fails, only the INTR_DC interrupt flag should be asserted. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: cf47a41e05 ("esp: latch individual bits in ESP_RINTR register") Message-Id: <20210518212511.21688-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15block/scsi: correctly emulate the VPD block limits pageMaxim Levitsky1-2/+7
When the device doesn't support the VPD block limits page, we emulate it even for SCSI passthrough. As a part of the emulation we need to add it to the 'Supported VPD Pages' The code that does this adds it to the page, but it doesn't increase the length of the data to be copied to the guest, thus the guest never sees the VPD block limits page as supported. Bump the transfer size by 1 in this case. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-Id: <20201217165612.942849-6-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15acpi: Eliminate all TPM related code if CONFIG_TPM is not setStefan Berger1-0/+2
Cc: M: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210614191335.1968807-4-stefanb@linux.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-06-15arm: Eliminate all TPM related code if CONFIG_TPM is not setStefan Berger3-0/+12
Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210614191335.1968807-3-stefanb@linux.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-06-15i386: Eliminate all TPM related code if CONFIG_TPM is not setStefan Berger1-0/+20
Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210614191335.1968807-2-stefanb@linux.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-06-15virtio-gpu: move scanout_id sanity checkGerd Hoffmann1-6/+14
Checking scanout_id in virtio_gpu_do_set_scanout() is too late, for the "resource_id == 0" case (aka disable scanout) the scanout_id is used unchecked. Move the check into the callers to fix that. Fixes: e64d4b6a9bc3 ("virtio-gpu: Refactor virtio_gpu_set_scanout") Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/383 Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-Id: <20210604075029.1201478-1-kraxel@redhat.com>
2021-06-15vga: Allow writing VBE_DISPI_ID5 to ID registerDennis Wölfing1-1/+2
The highest VBE_DISPI_INDEX_ID version supported by QEMU is VBE_DISPI_ID5. But currently QEMU only allows writing values up to VBE_DISPI_ID4 to the VBE_DISPI_INDEX_ID register. As a result of this when a lower version is written to this register and later VBE_DISPI_ID5 is written back, reads from the register will continue to report the lower version. Indeed SeaBIOS is doing that during VGA initialization which causes guests to always read VBE_DISPI_ID0 instead of the correct version. Signed-off-by: Dennis Wölfing <denniswoelfing@gmx.de> Message-Id: <20210607115303.228659-1-denniswoelfing@gmx.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-06-14usb/dev-mtp: use GDateTime for formatting timestamp for objectsDaniel P. Berrangé1-6/+3
The GDateTime APIs provided by GLib avoid portability pitfalls, such as some platforms where 'struct timeval.tv_sec' field is still 'long' instead of 'time_t'. When combined with automatic cleanup, GDateTime often results in simpler code too. Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-06-11vhost-vdpa: don't initialize backend_featuresJason Wang1-3/+0
We used to initialize backend_features during vhost_vdpa_init() regardless whether or not it was supported by vhost. This will lead the unsupported features like VIRTIO_F_IN_ORDER to be included and set to the vhost-vdpa during vhost_dev_start. Because the VIRTIO_F_IN_ORDER is not supported by vhost-vdpa so it won't be advertised to guest which will break the datapath. Fix this by not initializing the backend_features, so the acked_features could be built only from guest features via vhost_net_ack_features(). Fixes: 108a64818e69b ("vhost-vdpa: introduce vhost-vdpa backend") Cc: qemu-stable@nongnu.org Cc: Gautam Dawar <gdawar@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-06-11vhost-vdpa: map virtqueue notification area if possibleJason Wang1-0/+85
This patch implements the vq notification mapping support for vhost-vDPA. This is simply done by using mmap()/munmap() for the vhost-vDPA fd during device start/stop. For the device without notification mapping support, we fall back to eventfd based notification gracefully. Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-06-11vhost-vdpa: skip ram device from the IOTLB mappingJason Wang1-10/+2
vDPA is not tie to any specific hardware, for safety and simplicity, vhost-vDPA doesn't allow MMIO area to be mapped via IOTLB. Only the doorbell could be mapped via mmap(). So this patch exclude skip the ram device from the IOTLB mapping. Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-06-08Merge remote-tracking branch ↵Peter Maydell4-25/+117
'remotes/alistair/tags/pull-riscv-to-apply-20210608-1' into staging Second RISC-V PR for QEMU 6.1 - Update the PLIC and CLINT DT bindings - Improve documentation for RISC-V machines - Support direct kernel boot for microchip_pfsoc - Fix WFI exception behaviour - Improve CSR printing - Initial support for the experimental Bit Manip extension # gpg: Signature made Tue 08 Jun 2021 01:28:27 BST # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20210608-1: (32 commits) target/riscv: rvb: add b-ext version cpu option target/riscv: rvb: support and turn on B-extension from command line target/riscv: rvb: add/shift with prefix zero-extend target/riscv: rvb: address calculation target/riscv: rvb: generalized or-combine target/riscv: rvb: generalized reverse target/riscv: rvb: rotate (left/right) target/riscv: rvb: shift ones target/riscv: rvb: single-bit instructions target/riscv: add gen_shifti() and gen_shiftiw() helper functions target/riscv: rvb: sign-extend instructions target/riscv: rvb: min/max instructions target/riscv: rvb: pack two words into one register target/riscv: rvb: logic-with-negate target/riscv: rvb: count bits set target/riscv: rvb: count leading/trailing zeros target/riscv: reformat @sh format encoding for B-extension target/riscv: Pass the same value to oprsz and maxsz. target/riscv/pmp: Add assert for ePMP operations target/riscv: Dump CSR mscratch/sscratch/satp ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-08hw/riscv: microchip_pfsoc: Support direct kernel bootBin Meng1-3/+78
At present the Microchip Icicle Kit machine only supports using '-bios' to load the HSS, and does not support '-kernel' for direct kernel booting just like other RISC-V machines do. One has to use U-Boot which is chain-loaded by HSS, to load a kernel for testing. This is not so convenient. Adding '-kernel' support together with the existing '-bios', we follow the following table to select which payload we execute: -bios | -kernel | payload ------+------------+-------- N | N | HSS Y | don't care | HSS N | Y | kernel This ensures backwards compatibility with how we used to expose '-bios' to users. When '-kernel' is used for direct boot, '-dtb' must be present to provide a valid device tree for the board, as we don't generate device tree. When direct kernel boot is used, the OpenSBI fw_dynamic BIOS image is used to boot a payload like U-Boot or OS kernel directly. Documentation is updated to describe the direct kernel boot. Note as of today there is still no PolarFire SoC support in the upstream Linux kernel hence the document does not include instructions for that. It will be updated in the future. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210430071302.1489082-8-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-06-08hw/riscv: Use macros for BIOS image namesBin Meng3-12/+6
The OpenSBI BIOS image names are used by many RISC-V machines. Let's define macros for them. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210430071302.1489082-7-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-06-08hw/riscv: Support the official PLIC DT bindingsBin Meng2-2/+10
The official DT bindings of PLIC uses "sifive,plic-1.0.0" as the compatible string in the upstream Linux kernel. "riscv,plic0" is now legacy and has to be kept for backward compatibility of legacy systems. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210430071302.1489082-4-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-06-08hw/riscv: Support the official CLINT DT bindingsBin Meng3-3/+15
Linux kernel commit a2770b57d083 ("dt-bindings: timer: Add CLINT bindings") adds the official DT bindings for CLINT, which uses "sifive,clint0" as the compatible string. "riscv,clint0" is now legacy and has to be kept for backward compatibility of legacy systems. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210430071302.1489082-3-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-06-08hw/riscv: virt: Switch to use qemu_fdt_setprop_string_array() helperBin Meng1-2/+5
Since commit 78da6a1bca22 ("device_tree: add qemu_fdt_setprop_string_array helper"), we can use the new helper to set the compatible strings for the SiFive test device node. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210430071302.1489082-2-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
generated by cgit v1.1 at 2024-10-31 11:47:06 +0000