aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2024-06-17Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2-1/+24
* i386: fix issue with cache topology passthrough * scsi-disk: migrate emulated requests * i386/sev: fix Coverity issues * i386/tcg: more conversions to new decoder # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmZv6kMUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOn4Af/evnpsae1fm8may1NQmmezKiks/4X # cR0GaQ7w75Oas05jKsG7Xnrq3Vn6p5wllf3Wf00p7F1iJX18azY9rQgIsUVUgVem # /EIZk1eM6+mDxuIG0taPxc5Aw3cfIBWAjUmzsXrSr55e/wyiIxZCeUo2zk8Il+iL # Z4ceNzY5PZzc2Fl10D3cGs/+ynfiDM53ucwe3ve2T6NrxEVfKQPp5jkIUkBUba6z # zM5O4Q5KTEZYVth1gbDTB/uUJLUFjQ12kCQfRCNX+bEPDHwARr0UWr/Oxtz0jZSd # FvXohz7tI+v+ph0xHyE4tEFqryvLCII1td2ohTAYZZXNGkjK6XZildngBw== # =m4BE # -----END PGP SIGNATURE----- # gpg: Signature made Mon 17 Jun 2024 12:48:19 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (25 commits) target/i386: SEV: do not assume machine->cgs is SEV target/i386: convert CMPXCHG to new decoder target/i386: convert XADD to new decoder target/i386: convert LZCNT/TZCNT/BSF/BSR/POPCNT to new decoder target/i386: convert SHLD/SHRD to new decoder target/i386: adapt gen_shift_count for SHLD/SHRD target/i386: pull load/writeback out of gen_shiftd_rm_T1 target/i386: convert non-grouped, helper-based 2-byte opcodes target/i386: split X86_CHECK_prot into PE and VM86 checks target/i386: finish converting 0F AE to the new decoder target/i386: fix bad sorting of entries in the 0F table target/i386: replace read_crN helper with read_cr8 target/i386: convert MOV from/to CR and DR to new decoder target/i386: fix processing of intercept 0 (read CR0) target/i386: replace NoSeg special with NoLoadEA target/i386: change X86_ENTRYwr to use T0, use it for moves target/i386: change X86_ENTRYr to use T0 target/i386: put BLS* input in T1, use generic flag writeback target/i386: rewrite flags writeback for ADCX/ADOX target/i386: remove CPUX86State argument from generator functions ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-16aspeed/soc: fix incorrect dram size for AST2700Jamin Lin1-1/+86
AST2700 dram size calculation is not back compatible AST2600. According to the DDR capacity hardware behavior, if users write the data to the address which is beyond the ram size, it would write the data to the "address % ram_size". For example: a. sdram base address "0x4 00000000" b. sdram size 1 GiB The available address range is from "0x4 00000000" to "0x4 3FFFFFFF". If users write 0x12345678 to address "0x5 00000000", the value of DRAM address 0 (base address 0x4 00000000) will be 0x12345678. Add aspeed_soc_ast2700_dram_init to calculate the dram size and add memory I/O whose address range is from "max_ram_size - ram_size" to max_ram_size and its read/write handler to emulate DDR capacity hardware behavior. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-06-16aspeed: Add an AST2700 eval boardJamin Lin1-0/+32
AST2700 CPU is ARM Cortex-A35 which is 64 bits. Add TARGET_AARCH64 to build this machine. According to the design of ast2700, it has a bootmcu(riscv-32) which is used for executing SPL. Then, CPUs(cortex-a35) execute u-boot, kernel and rofs. Currently, qemu not support emulate two CPU architectures at the same machine. Therefore, qemu will only support to emulate CPU(cortex-a35) side for ast2700 Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2024-06-16aspeed/soc: Add AST2700 supportJamin Lin2-0/+564
Initial definitions for a simple machine using an AST2700 SOC (Cortex-a35 CPU). AST2700 SOC and its interrupt controller are too complex to handle in the common Aspeed SoC framework. We introduce a new ast2700 class with instance_init and realize handlers. AST2700 is a 64 bits quad core cpus and support 8 watchdog. Update maximum ASPEED_CPUS_NUM to 4 and ASPEED_WDTS_NUM to 8. In addition, update AspeedSocState to support scuio, sli, sliio and intc. Add TYPE_ASPEED27X0_SOC machine type. The SDMC controller is unlocked at SPL stage. At present, only supports to emulate booting start from u-boot stage. Set SDMC controller unlocked by default. In INTC, each interrupt of INT 128 to INT 136 combines 32 interrupts. It connect GICINT IRQ GPIO-OUTPUT pins to GIC device with irq 128 to 136. And, if a device irq is 128 to 136, its irq GPIO-OUTPUT pin is connected to GICINT or-gates instead of GIC device. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-06-16aspeed/intc: Add AST2700 supportJamin Lin3-0/+375
AST2700 interrupt controller(INTC) provides hardware interrupt interfaces to interrupt of processors PSP, SSP and TSP. In INTC, each interrupt of INT 128 to INT136 combines 32 interrupts. Introduce a new aspeed_intc class with instance_init and realize handlers. So far, this model only supports GICINT128 to GICINT136. It creates 9 GICINT or-gates to connect 32 interrupts sources from GICINT128 to GICINT136 as IRQ GPIO-OUTPUT pins. Then, this model registers IRQ handler with its IRQ GPIO-INPUT pins which connect to GICINT or-gates. And creates 9 GICINT IRQ GPIO-OUTPUT pins which connect to GIC device with GIC IRQ 128 to 136. If one interrupt source from GICINT128 to GICINT136 set irq, the OR-GATE irq callback function is called and set irq to INTC by OR-GATE GPIO-OUTPUT pins. Then, the INTC irq callback function is called and set irq to GIC by its GICINT IRQ GPIO-OUTPUT pins. Finally, the GIC irq callback function is called and set irq to CPUs and CPUs execute Interrupt Service Routine (ISR). Block diagram of GICINT132: GICINT132 ETH1 +-----------+ +-------->+0 3| ETH2 | 4| +-------->+1 5| ETH3 | 6| +-------->+2 19| INTC GIC UART0 | 20| +--------------------------+ +-------->+7 21| | | +--------------+ UART1 | 22| |orgate0 +----> output_pin0+----------->+GIC128 | +-------->+8 23| | | | | UART2 | 24| |orgate1 +----> output_pin1+----------->+GIC129 | +-------->+9 25| | | | | UART3 | 26| |orgate2 +----> output_pin2+----------->+GIC130 | +--------->10 27| | | | | UART5 | 28| |orgate3 +----> output_pin3+----------->+GIC131 | +-------->+11 29| | | | | UART6 | +----------->+orgate4 +----> output_pin4+----------->+GIC132 | +-------->+12 30| | | | | UART7 | 31| |orgate5 +----> output_pin5+----------->+GIC133 | +-------->+13 | | | | | UART8 | OR[0:31] | |orgate6 +----> output_pin6+----------->+GIC134 | ---------->14 | | | | | UART9 | | |orgate7 +----> output_pin7+----------->+GIC135 | --------->+15 | | | | | UART10 | | |orgate8 +----> output_pin8+----------->+GIC136 | --------->+16 | | | +--------------+ UART11 | | +--------------------------+ +-------->+17 | UART12 | | +--------->18 | | | | | | | +-----------+ Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> [clg: Fixed class_size in TYPE_ASPEED_INTC definition ]
2024-06-16aspeed/scu: Add AST2700 supportJamin Lin2-1/+309
AST2700 have two SCU controllers which are SCU and SCUIO. Both SCU and SCUIO registers are not compatible previous SOCs , introduces new registers and adds ast2700 scu, sucio class init handler. The pclk divider selection of SCUIO is defined in SCUIO280[20:18] and the pclk divider selection of SCU is defined in SCU280[25:23]. Both of them are not compatible AST2600 SOCs, adds a get_apb_freq function and trace-event for AST2700 SCU and SCUIO. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> [clg: Fixed spelling : Unhandeled -> Unhandled ]
2024-06-16aspeed/smc: Add AST2700 supportJamin Lin1-1/+233
AST2700 fmc/spi controller's address decoding unit is 64KB and only bits [31:16] are used for decoding. Introduce seg_to_reg and reg_to_seg handlers for ast2700 fmc/spi controller. In addition, adds ast2700 fmc, spi0, spi1, and spi2 class init handler. AST2700 is a 64 bits quad core CPUs(Cortex-a35). Introduce a new "aspeed_2700_smc_flash_ops" and set its valid "max_access_size" 8 for 64 bits data format access. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-06-16aspeed/smc: support different memory region ops for SMC flash regionJamin Lin1-1/+13
It set "aspeed_smc_flash_ops" struct which containing read and write callbacks to be used when I/O is performed on the SMC flash region. And it set the valid max_access_size 4 by default for all ASPEED SMC models. However, the valid max_access_size 4 only support 32 bits CPUs. To support all ASPEED SMC model, introduce a new "const MemoryRegionOps *" attribute in AspeedSMCClass and use it in aspeed_smc_flash_realize function. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-06-16aspeed/smc: support 64 bits dma dram addressJamin Lin2-9/+44
AST2700 support the maximum dram size is 8GiB and has a "DMA DRAM Side Address High Part(0x7C)" register to support 64 bits dma dram address. Add helper routines functions to compute the dma dram address, new features and update trace-event to support 64 bits dram address. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-06-16aspeed/smc: support dma start length and 1 byte length unitJamin Lin1-8/+35
DMA length is from 1 byte to 32MB for AST2600 and AST10x0 and DMA length is from 4 bytes to 32MB for AST2500. In other words, if "R_DMA_LEN" is 0, it should move at least 1 byte data for AST2600 and AST10x0 and 4 bytes data for AST2500. To support all ASPEED SOCs, adds dma_start_length parameter to store the start length, add helper routines function to compute the dma length and update DMA_LENGTH mask to "1FFFFFF" to support dma 1 byte length unit for AST2600 and AST1030. Currently, only supports dma length 4 bytes aligned. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
2024-06-16aspeed/smc: correct device descriptionJamin Lin1-3/+3
Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2024-06-16aspeed/sdmc: Add AST2700 supportJamin Lin1-3/+191
The SDRAM memory controller(DRAMC) controls the access to external DDR4 and DDR5 SDRAM and power up to DDR4 and DDR5 PHY. The DRAM memory controller of AST2700 is not backward compatible to previous chips such AST2600, AST2500 and AST2400. Max memory is now 8GiB on the AST2700. Introduce new aspeed_2700_sdmc and class with read/write operation and reset handlers. Define DRAMC necessary protected registers and unprotected registers for AST2700 and increase the register set to 0x1000. Add unlocked property to change controller protected status. Incrementing the version of vmstate to 2. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2024-06-16aspeed/sdmc: fix coding styleJamin Lin1-4/+7
Fix coding style issues from checkpatch.pl Test command: scripts/checkpatch.pl --no-tree -f hw/misc/aspeed_sdmc.c Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2024-06-16aspeed/sdmc: remove redundant macrosJamin Lin1-15/+0
These macros are no longer used for ASPEED SOCs, so removes them. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2024-06-16aspeed/sli: Add AST2700 supportJamin Lin3-1/+186
AST2700 SLI engine is designed to accelerate the throughput between cross-die connections. It have CPU_SLI at CPU die and IO_SLI at IO die. Introduce dummy AST2700 SLI and SLIIO models. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2024-06-16aspeed/wdt: Add AST2700 supportJamin Lin1-0/+24
AST2700 wdt controller is similiar to AST2600's wdt, but the AST2700 has 8 watchdogs, and they each have 0x80 of registers. Introduce ast2700 object class and increase the number of regs(offset) of ast2700 model. Signed-off-by: Troy Lee <troy_lee@aspeedtech.com> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2024-06-16aspeed/smc: Reintroduce "dram-base" property for AST2700Cédric Le Goater1-0/+1
The Aspeed SMC device model use to have a 'sdram_base' property. It was removed by commit d177892d4a48 ("aspeed/smc: Remove unused "sdram-base" property") because previous changes simplified the DMA transaction model to use an offset in RAM and not the physical address. The AST2700 SoC has larger address space (64-bit) and a new register DMA DRAM Side Address High Part (0x7C) is introduced to deal with the high bits of the DMA address. To be able to compute the offset of the DMA transaction, as done on the other SoCs, we will need to know where the DRAM is mapped in the address space. Re-introduce a "dram-base" property to hold this value. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-15Merge tag 'virtio-grants-v8-tag' of https://gitlab.com/sstabellini/qemu into ↵Richard Henderson3-60/+191
staging virtio-grants-v8 # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEE0E4zq6UfZ7oH0wrqiU+PSHDhrpAFAmZqEk4ACgkQiU+PSHDh # rpBaBxAA1jTfkty2RWJ0LfU5ekxnEWSx63zVzDWESFOQRjp/rOk/FhHbqbHzXISk # cbHjz2PX6mNSOiFoSOWsNP7Utg+7xPH34D+D/EH59bmrXYFHCXxYjIK/T8T2Jr2p # /qx3x/qxGRXFq38WFHvLhdK/0obdOuF3M6W/Zz82z8ruo7uHBX4XuCsF2rWV0ydb # mvfAh+iMwh1JQN/g/vHIf0h+2RQjGCfsez+xVnG4rSeE4UWn/4iaU5c6SJ80arwE # mwlnDOysEXwIZuy0fi+RX8o4tUie8rcS19+rBoMskXCAJXQblV/Aqhq4qww2DtA+ # kjL7HTHZrccZOJME9dj5gIUHvjAa9wxDZ5luelNVGY+VNO1hWXfk8Rcl9rtvOmNZ # FKwcj3HW0ggQQMlH5+QizFQhNM3iRoirzX3t9Vw3uNbmwyTjSHcN3qVBExeCLAaT # +N6t+aBfCOL5ZVskFb6YYxvWe3gLSghFH4cN/l0VLngzuGFl4BUNny5aNaENQYbX # OSwH3rsE45j6X4B0gtwBXWFC31WpA1wPBwKYwcPZNmKWl30oJsXUs9UrTMHu4H/Z # NnpFTgGYBaPCqlhkdIVQkOTpY9q85LzxQ8A+uwBUK+4uZwnw9rPXf+If8kyX/5eL # 1AlVfBAG9uSVT/+AqxW/49jQ6jHRQ9ZgL9y6H0N0Ql3nrQBMasI= # =4mj9 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 12 Jun 2024 02:25:34 PM PDT # gpg: using RSA key D04E33ABA51F67BA07D30AEA894F8F4870E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" [unknown] # gpg: aka "Stefano Stabellini <sstabellini@kernel.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: D04E 33AB A51F 67BA 07D3 0AEA 894F 8F48 70E1 AE90 * tag 'virtio-grants-v8-tag' of https://gitlab.com/sstabellini/qemu: hw/arm: xen: Enable use of grant mappings xen: mapcache: Add support for grant mappings xen: mapcache: Pass the ram_addr offset to xen_map_cache() xen: mapcache: Unmap first entries in buckets xen: mapcache: Make MCACHE_BUCKET_SHIFT runtime configurable Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-14migration/multifd: add uadk compression frameworkShameer Kolothum1-1/+1
Adds the skeleton to support uadk compression method. Complete functionality will be added in subsequent patches. Acked-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com> Reviewed-by: Zhangfei Gao <zhangfei.gao@linaro.org> Signed-off-by: Fabiano Rosas <farosas@suse.de>
2024-06-14migration/multifd: add qpl compression methodYuan Liu1-1/+1
add the Query Processing Library (QPL) compression method Introduce the qpl as a new multifd migration compression method, it can use In-Memory Analytics Accelerator(IAA) to accelerate compression and decompression, which can not only reduce network bandwidth requirement but also reduce host compression and decompression CPU overhead. How to enable qpl compression during migration: migrate_set_parameter multifd-compression qpl There is no qpl compression level parameter added since it only supports level one, users do not need to specify the qpl compression level. Signed-off-by: Yuan Liu <yuan1.liu@intel.com> Reviewed-by: Nanhai Zou <nanhai.zou@intel.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> [fixed docs spacing in migration.json] Signed-off-by: Fabiano Rosas <farosas@suse.de>
2024-06-10hw/vfio: Remove newline character in trace eventsPhilippe Mathieu-Daudé1-2/+2
Trace events aren't designed to be multi-lines. Remove the newline characters. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Mads Ynddal <mads@ynddal.dk> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20240606103943.79116-5-philmd@linaro.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-06-10hw/usb: Remove newline character in trace eventsPhilippe Mathieu-Daudé1-3/+3
Trace events aren't designed to be multi-lines. Remove the newline characters. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Mads Ynddal <mads@ynddal.dk> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20240606103943.79116-4-philmd@linaro.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-06-10hw/sh4: Remove newline character in trace eventsPhilippe Mathieu-Daudé1-2/+2
Trace events aren't designed to be multi-lines. Remove the newline character which doesn't bring much value. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Mads Ynddal <mads@ynddal.dk> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20240606103943.79116-3-philmd@linaro.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-06-10scsi-disk: Fix crash for VM configured with USB CDROM after live migrationHyman Huang2-1/+24
For VMs configured with the USB CDROM device: -drive file=/path/to/local/file,id=drive-usb-disk0,media=cdrom,readonly=on... -device usb-storage,drive=drive-usb-disk0,id=usb-disk0... QEMU process may crash after live migration, to reproduce the issue, configure VM (Guest OS ubuntu 20.04 or 21.10) with the following XML: <disk type='file' device='cdrom'> <driver name='qemu' type='raw'/> <source file='/path/to/share_fs/cdrom.iso'/> <target dev='sda' bus='usb'/> <readonly/> <address type='usb' bus='0' port='2'/> </disk> <controller type='usb' index='0' model='piix3-uhci'/> Do the live migration repeatedly, crash may happen after live migratoin, trace log at the source before live migration is as follows: 324808@1711972823.521945:usb_uhci_frame_start nr 319 324808@1711972823.521978:usb_uhci_qh_load qh 0x35cb5400 324808@1711972823.521989:usb_uhci_qh_load qh 0x35cb5480 324808@1711972823.521997:usb_uhci_td_load qh 0x35cb5480, td 0x35cbe000, ctrl 0x0, token 0xffe07f69 324808@1711972823.522010:usb_uhci_td_nextqh qh 0x35cb5480, td 0x35cbe000 324808@1711972823.522022:usb_uhci_qh_load qh 0x35cb5680 324808@1711972823.522030:usb_uhci_td_load qh 0x35cb5680, td 0x75ac5180, ctrl 0x19800000, token 0x3c903e1 324808@1711972823.522045:usb_uhci_packet_add token 0x103e1, td 0x75ac5180 324808@1711972823.522056:usb_packet_state_change bus 0, port 2, ep 2, packet 0x559f9ba14b00, state undef -> setup 324808@1711972823.522079:usb_msd_cmd_submit lun 0, tag 0x472, flags 0x00000080, len 10, data-len 8 324808@1711972823.522107:scsi_req_parsed target 0 lun 0 tag 1138 command 74 dir 1 length 8 324808@1711972823.522124:scsi_req_parsed_lba target 0 lun 0 tag 1138 command 74 lba 4096 324808@1711972823.522139:scsi_req_alloc target 0 lun 0 tag 1138 324808@1711972823.522169:scsi_req_continue target 0 lun 0 tag 1138 324808@1711972823.522181:scsi_req_data target 0 lun 0 tag 1138 len 8 324808@1711972823.522194:usb_packet_state_change bus 0, port 2, ep 2, packet 0x559f9ba14b00, state setup -> complete 324808@1711972823.522209:usb_uhci_packet_complete_success token 0x103e1, td 0x75ac5180 324808@1711972823.522219:usb_uhci_packet_del token 0x103e1, td 0x75ac5180 324808@1711972823.522232:usb_uhci_td_complete qh 0x35cb5680, td 0x75ac5180 trace log at the destination after live migration is as follows: 3286206@1711972823.951646:usb_uhci_frame_start nr 320 3286206@1711972823.951663:usb_uhci_qh_load qh 0x35cb5100 3286206@1711972823.951671:usb_uhci_qh_load qh 0x35cb5480 3286206@1711972823.951680:usb_uhci_td_load qh 0x35cb5480, td 0x35cbe000, ctrl 0x1000000, token 0xffe07f69 3286206@1711972823.951693:usb_uhci_td_nextqh qh 0x35cb5480, td 0x35cbe000 3286206@1711972823.951702:usb_uhci_qh_load qh 0x35cb5700 3286206@1711972823.951709:usb_uhci_td_load qh 0x35cb5700, td 0x75ac5240, ctrl 0x39800000, token 0xe08369 3286206@1711972823.951727:usb_uhci_queue_add token 0x8369 3286206@1711972823.951735:usb_uhci_packet_add token 0x8369, td 0x75ac5240 3286206@1711972823.951746:usb_packet_state_change bus 0, port 2, ep 1, packet 0x56066b2fb5a0, state undef -> setup 3286206@1711972823.951766:usb_msd_data_in 8/8 (scsi 8) 2024-04-01 12:00:24.665+0000: shutting down, reason=crashed The backtrace reveals the following: Program terminated with signal SIGSEGV, Segmentation fault. 0 __memmove_sse2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:312 312 movq -8(%rsi,%rdx), %rcx [Current thread is 1 (Thread 0x7f0a9025fc00 (LWP 3286206))] (gdb) bt 0 __memmove_sse2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:312 1 memcpy (__len=8, __src=<optimized out>, __dest=<optimized out>) at /usr/include/bits/string_fortified.h:34 2 iov_from_buf_full (iov=<optimized out>, iov_cnt=<optimized out>, offset=<optimized out>, buf=0x0, bytes=bytes@entry=8) at ../util/iov.c:33 3 iov_from_buf (bytes=8, buf=<optimized out>, offset=<optimized out>, iov_cnt=<optimized out>, iov=<optimized out>) at /usr/src/debug/qemu-6-6.2.0-75.7.oe1.smartx.git.40.x86_64/include/qemu/iov.h:49 4 usb_packet_copy (p=p@entry=0x56066b2fb5a0, ptr=<optimized out>, bytes=bytes@entry=8) at ../hw/usb/core.c:636 5 usb_msd_copy_data (s=s@entry=0x56066c62c770, p=p@entry=0x56066b2fb5a0) at ../hw/usb/dev-storage.c:186 6 usb_msd_handle_data (dev=0x56066c62c770, p=0x56066b2fb5a0) at ../hw/usb/dev-storage.c:496 7 usb_handle_packet (dev=0x56066c62c770, p=p@entry=0x56066b2fb5a0) at ../hw/usb/core.c:455 8 uhci_handle_td (s=s@entry=0x56066bd5f210, q=0x56066bb7fbd0, q@entry=0x0, qh_addr=qh_addr@entry=902518530, td=td@entry=0x7fffe6e788f0, td_addr=<optimized out>, int_mask=int_mask@entry=0x7fffe6e788e4) at ../hw/usb/hcd-uhci.c:885 9 uhci_process_frame (s=s@entry=0x56066bd5f210) at ../hw/usb/hcd-uhci.c:1061 10 uhci_frame_timer (opaque=opaque@entry=0x56066bd5f210) at ../hw/usb/hcd-uhci.c:1159 11 timerlist_run_timers (timer_list=0x56066af26bd0) at ../util/qemu-timer.c:642 12 qemu_clock_run_timers (type=QEMU_CLOCK_VIRTUAL) at ../util/qemu-timer.c:656 13 qemu_clock_run_all_timers () at ../util/qemu-timer.c:738 14 main_loop_wait (nonblocking=nonblocking@entry=0) at ../util/main-loop.c:542 15 qemu_main_loop () at ../softmmu/runstate.c:739 16 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at ../softmmu/main.c:52 (gdb) frame 5 (gdb) p ((SCSIDiskReq *)s->req)->iov $1 = {iov_base = 0x0, iov_len = 0} (gdb) p/x s->req->tag $2 = 0x472 When designing the USB mass storage device model, QEMU places SCSI disk device as the backend of USB mass storage device. In addition, USB mass device driver in Guest OS conforms to the "Universal Serial Bus Mass Storage Class Bulk-Only Transport" specification in order to simulate the transform behavior between a USB controller and a USB mass device. The following shows the protocol hierarchy: +----------------+ CDROM driver | scsi command | CDROM +----------------+ +-----------------------+ USB mass | USB Mass Storage Class| USB mass storage driver | Bulk-Only Transport | storage device +-----------------------+ +----------------+ USB Controller | USB Protocol | USB device +----------------+ In the USB protocol layer, between the USB controller and USB device, at least two USB packets will be transformed when guest OS send a read operation to USB mass storage device: 1. The CBW packet, which will be delivered to the USB device's Bulk-Out endpoint. In order to simulate a read operation, the USB mass storage device parses the CBW and converts it to a SCSI command, which would be executed by CDROM(represented as SCSI disk in QEMU internally), and store the result data of the SCSI command in a buffer. 2. The DATA-IN packet, which will be delivered from the USB device's Bulk-In endpoint(fetched directly from the preceding buffer) to the USB controller. We consider UHCI to be the controller. The two packets mentioned above may have been processed by UHCI in two separate frame entries of the Frame List , and also described by two different TDs. Unlike the physical environment, a virtualized environment requires the QEMU to make sure that the result data of CBW is not lost and is delivered to the UHCI controller. Currently, these types of SCSI requests are not migrated, so QEMU cannot ensure the result data of the IO operation is not lost if there are inflight emulated SCSI requests during the live migration. Assume for the moment that the USB mass storage device is processing the CBW and storing the result data of the read operation to a buffre, live migration happens and moves the VM to the destination while not migrating the result data of the read operation. After migration, when UHCI at the destination issues a DATA-IN request to the USB mass storage device, a crash happens because USB mass storage device fetches the result data and get nothing. The scenario this patch addresses is this one. Theoretically, any device that uses the SCSI disk as a back-end would be affected by this issue. In this case, it is the USB CDROM. To fix it, inflight emulated SCSI request be migrated during live migration, similar to the DMA SCSI request. Signed-off-by: Hyman Huang <yong.huang@smartx.com> Message-ID: <878c8f093f3fc2f584b5c31cb2490d9f6a12131a.1716531409.git.yong.huang@smartx.com> [Do not bump migration version, introduce compat property instead. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-09hw/arm: xen: Enable use of grant mappingsEdgar E. Iglesias1-0/+5
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-09xen: mapcache: Add support for grant mappingsEdgar E. Iglesias2-37/+140
Add a second mapcache for grant mappings. The mapcache for grants needs to work with XC_PAGE_SIZE granularity since we can't map larger ranges than what has been granted to us. Like with foreign mappings (xen_memory), machines using grants are expected to initialize the xen_grants MR and map it into their address-map accordingly. CC: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2024-06-09xen: mapcache: Pass the ram_addr offset to xen_map_cache()Edgar E. Iglesias1-5/+11
Pass the ram_addr offset to xen_map_cache. This is in preparation for adding grant mappings that need to compute the address within the RAMBlock. No functional changes. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-09xen: mapcache: Unmap first entries in bucketsEdgar E. Iglesias1-3/+8
When invalidating memory ranges, if we happen to hit the first entry in a bucket we were never unmapping it. This was harmless for foreign mappings but now that we're looking to reuse the mapcache for transient grant mappings, we must unmap entries when invalidated. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2024-06-09xen: mapcache: Make MCACHE_BUCKET_SHIFT runtime configurableEdgar E. Iglesias1-21/+33
Make MCACHE_BUCKET_SHIFT runtime configurable per cache instance. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-08Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2-4/+27
* scsi-disk: Don't silently truncate serial number * backends/hostmem: Report error on unavailable qemu_madvise() features or unaligned memory sizes * target/i386: fixes and documentation for INHIBIT_IRQ/TF/RF and debugging * i386/hvf: Adds support for INVTSC cpuid bit * i386/hvf: Fixes for dirty memory tracking * i386/hvf: Use hv_vcpu_interrupt() and hv_vcpu_run_until() * hvf: Cleanups * stubs: fixes for --disable-system build * i386/kvm: support for FRED * i386/kvm: fix MCE handling on AMD hosts # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmZkF2oUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPNlQf+N9y6Eh0nMEEQ69twtV8ytglTY+uX # FsogvnsXHNMVubOWmmeItM6kFXTAkR9cmFaL8dqI1Gs03xEQdQXbF1KejJZOAZVl # RQMOW8Fg2Afr+0lwqCXHvhsmZ4hr5yUkRndyucA/E9AO2uGrtgwsWGDBGaHJOZIA # lAsEMOZgKjXHZnefXjhMrvpk/QNovjEV6f1RHX3oKZjKSI5/G4IqGSmwNYToot8p # 2fgs4Qti4+1gNyM2oBLq7cCMjMS61tSxOMH4uqVoIisjyckPlAFRvc+DXtKsUAAs # 9AgM++pNgpB0IXv67czRUNdRoK7OI8I0ULhI4qHXi6Yg2QYAHqpQ6WL4Lg== # =RP7U # -----END PGP SIGNATURE----- # gpg: Signature made Sat 08 Jun 2024 01:33:46 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (42 commits) python: mkvenv: remove ensure command Revert "python: use vendored tomli" i386: Add support for overflow recovery i386: Add support for SUCCOR feature i386: Fix MCE support for AMD hosts docs: i386: pc: Avoid mentioning limit of maximum vCPUs target/i386: Add get/set/migrate support for FRED MSRs target/i386: enumerate VMX nested-exception support vmxcap: add support for VMX FRED controls target/i386: mark CR4.FRED not reserved target/i386: add support for FRED in CPUID enumeration hvf: Makes assert_hvf_ok report failed expression i386/hvf: Updates API usage to use modern vCPU run function i386/hvf: In kick_vcpu use hv_vcpu_interrupt to force exit i386/hvf: Fixes dirty memory tracking by page granularity RX->RWX change hvf: Consistent types for vCPU handles i386/hvf: Fixes some compilation warnings i386/hvf: Adds support for INVTSC cpuid bit stubs/meson: Fix qemuutil build when --disable-system scsi-disk: Don't silently truncate serial number ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-08scsi-disk: Don't silently truncate serial numberKevin Wolf1-3/+17
Before this commit, scsi-disk accepts a string of arbitrary length for its "serial" property. However, the value visible on the guest is actually truncated to 36 characters. This limitation doesn't come from the SCSI specification, it is an arbitrary limit that was initially picked as 20 and later bumped to 36 by commit 48b62063. Similarly, device_id was introduced as a copy of the serial number, limited to 20 characters, but commit 48b62063 forgot to actually bump it. As long as we silently truncate the given string, extending the limit is actually not a harmless change, but break the guest ABI. This is the most important reason why commit 48b62063 was really wrong (and it's also why we can't change device_id to be in sync with the serial number again and use 36 characters now, it would be another guest ABI breakage). In order to avoid future breakage, don't silently truncate the serial number string any more, but just error out if it would be truncated. Buglink: https://issues.redhat.com/browse/RHEL-3542 Suggested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20240604161755.63448-1-kwolf@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08machine, hostmem: improve error messages for unsupported featuresPaolo Bonzini1-0/+8
Detect early unsupported MADV_MERGEABLE and MADV_DONTDUMP, and print a clearer error message that points to the deficiency of the host. Cc: Michal Privoznik <mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-08machine: default -M mem-merge to off is QEMU_MADV_MERGEABLE is not availablePaolo Bonzini1-1/+2
Otherwise, starting any guest on a non-Linux guests results in qemu-system-arm: Couldn't set property 'merge' on 'memory-backend-ram': Invalid argument Cc: Michal Privoznik <mprivozn@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-06hw/loongarch/virt: Enable extioi virt extensionSong Gao1-3/+85
This patch adds a new board attribute 'v-eiointc'. A value of true enables the virt extended I/O interrupt controller. VMs working in kvm mode have 'v-eiointc' enabled by default. Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Message-Id: <20240528083855.1912757-4-gaosong@loongson.cn>
2024-06-06hw/loongarch/virt: Use MemTxAttrs interface for misc opsSong Gao1-12/+24
Use MemTxAttrs interface read_with_attrs/write_with_attrs for virt_iocsr_misc_ops. Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Message-Id: <20240528083855.1912757-3-gaosong@loongson.cn>
2024-06-06hw/intc/loongarch_extioi: Add extioi virt extension definitionSong Gao2-23/+125
On LoongArch, IRQs can be routed to four vcpus with hardware extended IRQ model. This patch adds the virt extension definition so that the IRQ can route to 256 vcpus. 1.Extended IRQ model: | +-----------+ +-------------|--------+ +-----------+ | IPI/Timer | --> | CPUINTC(0-3)|(4-255) | <-- | IPI/Timer | +-----------+ +-------------|--------+ +-----------+ ^ | | +---------+ | EIOINTC | +---------+ ^ ^ | | +---------+ +---------+ | PCH-PIC | | PCH-MSI | +---------+ +---------+ ^ ^ ^ | | | +--------+ +---------+ +---------+ | UARTs | | Devices | | Devices | +--------+ +---------+ +---------+ 2.Virt extended IRQ model: +-----+ +---------------+ +-------+ | IPI |--> | CPUINTC(0-255)| <-- | Timer | +-----+ +---------------+ +-------+ ^ | +-----------+ | V-EIOINTC | +-----------+ ^ ^ | | +---------+ +---------+ | PCH-PIC | | PCH-MSI | +---------+ +---------+ ^ ^ ^ | | | +--------+ +---------+ +---------+ | UARTs | | Devices | | Devices | +--------+ +---------+ +---------+ Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Message-Id: <20240528083855.1912757-2-gaosong@loongson.cn>
2024-06-06tests/libqos: Add loongarch virt machine nodeBibo Mao1-0/+2
Add loongarch virt machine to the graph. It is a modified copy of the existing riscv virtmachine in riscv-virt-machine.c It contains a generic-pcihost controller, and an extra function loongarch_config_qpci_bus() to configure GPEX pci host controller information, such as ecam and pio_base addresses. Also hotplug handle checking about TYPE_VIRTIO_IOMMU_PCI device is added on loongarch virt machine, since virtio_mmu_pci device requires it. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Thomas Huth <thuth@redhat.com> Message-Id: <20240528082053.938564-1-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-06-05hw/dma/pl330: Use qemu_hexdump_line to avoid sprintfPhilippe Mathieu-Daudé1-16/+9
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240412073346.458116-11-richard.henderson@linaro.org>
2024-06-05hw/ide/atapi: Use qemu_hexdump_line to avoid sprintfPhilippe Mathieu-Daudé1-8/+4
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240412073346.458116-10-richard.henderson@linaro.org>
2024-06-05hw/scsi/scsi-disk: Use qemu_hexdump_line to avoid sprintfPhilippe Mathieu-Daudé1-10/+3
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Note that this drops the "0x" prefix to every byte, which should be of no consequence to tracing. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240412073346.458116-9-richard.henderson@linaro.org>
2024-06-05hw/mips/malta: Add re-usable rng_seed_hex_new() methodPhilippe Mathieu-Daudé1-12/+13
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Extract common code from reinitialize_rng_seed and load_kernel to rng_seed_hex_new. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> [rth: Use qemu_hexdump_line.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240412073346.458116-7-richard.henderson@linaro.org>
2024-06-05util/hexdump: Add unit_len and block_len to qemu_hexdump_lineRichard Henderson1-1/+1
Generalize the current 1 byte unit and 4 byte blocking within the output. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240412073346.458116-5-richard.henderson@linaro.org>
2024-06-05util/hexdump: Use a GString for qemu_hexdump_lineRichard Henderson1-6/+8
Allocate a new, or append to an existing GString instead of using a fixed sized buffer. Require the caller to determine the length of the line -- do not bound len here. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240412073346.458116-4-richard.henderson@linaro.org>
2024-06-05Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson8-182/+62
* virtio-blk: remove SCSI passthrough functionality * require x86-64-v2 baseline ISA * SEV-SNP host support * fix xsave.flat with TCG * fixes for CPUID checks done by TCG # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmZgKVYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPKYgf/QkWrNXdjjD3yAsv5LbJFVTVyCYW3 # b4Iax29kEDy8k9wbzfLxOfIk9jXIjmbOMO5ZN9LFiHK6VJxbXslsMh6hm50M3xKe # 49X1Rvf9YuVA7KZX+dWkEuqLYI6Tlgj3HaCilYWfXrjyo6hY3CxzkPV/ChmaeYlV # Ad4Y8biifoUuuEK8OTeTlcDWLhOHlFXylG3AXqULsUsXp0XhWJ9juXQ60eATv/W4 # eCEH7CSmRhYFu2/rV+IrWFYMnskLRTk1OC1/m6yXGPKOzgnOcthuvQfiUgPkbR/d # llY6Ni5Aaf7+XX3S7Avcyvoq8jXzaaMzOrzL98rxYGDR1sYBYO+4h4ZToA== # =qQeP # -----END PGP SIGNATURE----- # gpg: Signature made Wed 05 Jun 2024 02:01:10 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (46 commits) hw/i386: Add support for loading BIOS using guest_memfd hw/i386/sev: Use guest_memfd for legacy ROMs memory: Introduce memory_region_init_ram_guest_memfd() i386/sev: Allow measured direct kernel boot on SNP i386/sev: Reorder struct declarations i386/sev: Extract build_kernel_loader_hashes i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guests i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGE i386/sev: Invoke launch_updata_data() for SNP class i386/sev: Invoke launch_updata_data() for SEV class hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled i386/sev: Add support for SNP CPUID validation i386/sev: Add support for populating OVMF metadata pages hw/i386/sev: Add function to get SEV metadata from OVMF header i386/sev: Set CPU state to protected once SNP guest payload is finalized i386/sev: Add handling to encrypt/finalize guest launch data i386/sev: Add the SNP launch start context i386/sev: Update query-sev QAPI format to handle SEV-SNP i386/sev: Add a class method to determine KVM VM type for SNP guests i386/sev: Don't return launch measurements for SEV-SNP guests ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-05hw/i386: Add support for loading BIOS using guest_memfdMichael Roth1-5/+12
When guest_memfd is enabled, the BIOS is generally part of the initial encrypted guest image and will be accessed as private guest memory. Add the necessary changes to set up the associated RAM region with a guest_memfd backend to allow for this. Current support centers around using -bios to load the BIOS data. Support for loading the BIOS via pflash requires additional enablement since those interfaces rely on the use of ROM memory regions which make use of the KVM_MEM_READONLY memslot flag, which is not supported for guest_memfd-backed memslots. Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-29-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05hw/i386/sev: Use guest_memfd for legacy ROMsMichael Roth2-10/+23
Current SNP guest kernels will attempt to access these regions with with C-bit set, so guest_memfd is needed to handle that. Otherwise, kvm_convert_memory() will fail when the guest kernel tries to access it and QEMU attempts to call KVM_SET_MEMORY_ATTRIBUTES to set these ranges to private. Whether guests should actually try to access ROM regions in this way (or need to deal with legacy ROM regions at all), is a separate issue to be addressed on kernel side, but current SNP guest kernels will exhibit this behavior and so this handling is needed to allow QEMU to continue running existing SNP guest kernels. Signed-off-by: Michael Roth <michael.roth@amd.com> [pankaj: Added sev_snp_enabled() check] Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-28-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabledBrijesh Singh2-6/+8
As with SEV, an SNP guest requires that the BIOS be part of the initial encrypted/measured guest payload. Extend sev_encrypt_flash() to handle the SNP case and plumb through the GPA of the BIOS location since this is needed for SNP. Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-25-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05hw/i386/sev: Add function to get SEV metadata from OVMF headerBrijesh Singh1-0/+4
A recent version of OVMF expanded the reset vector GUID list to add SEV-specific metadata GUID. The SEV metadata describes the reserved memory regions such as the secrets and CPUID page used during the SEV-SNP guest launch. The pc_system_get_ovmf_sev_metadata_ptr() is used to retieve the SEV metadata pointer from the OVMF GUID list. Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-19-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05machine: allow early use of machine_require_guest_memfdPaolo Bonzini1-1/+1
Ask the ConfidentialGuestSupport object whether to use guest_memfd for KVM-backend private memory. This bool can be set in instance_init (or user_complete) so that it is available when the machine is created. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05update-linux-headers: move pvpanic.h to correct directoryPaolo Bonzini3-3/+3
Linux has <misc/pvpanic.h>, not <linux/pvpanic.h>. Use the same directory for QEMU's include/standard-headers/ copy. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>