aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-06-19hw/riscv: sifive_u: Simplify the GEM IRQ connect code a little bitBin Meng
There is no need to retrieve all PLIC IRQ information in order to just connect the GEM IRQ. Use qdev_get_gpio_in() directly like what is done for other peripherals. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-4-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-4-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19hw/riscv: opentitan: Remove the riscv_ prefix of the machine* and soc* functionsBin Meng
This was done in the virt & sifive_u codes, but opentitan codes were missed. Remove the riscv_ prefix of the machine* and soc* functions. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-3-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-3-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19hw/riscv: sifive_e: Remove the riscv_ prefix of the machine* and soc* functionsBin Meng
This was done in the virt & sifive_u codes, but sifive_e codes were missed. Remove the riscv_ prefix of the machine* and soc* functions. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591625864-31494-2-git-send-email-bmeng.cn@gmail.com Message-Id: <1591625864-31494-2-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19target/riscv: Use a smaller guess size for no-MMU PMPAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com>
2020-06-19riscv/opentitan: Connect the UART deviceAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-06-19riscv/opentitan: Connect the PLIC deviceAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-06-19hw/intc: Initial commit of lowRISC Ibex PLICAlistair Francis
The Ibex core contains a PLIC that although similar to the RISC-V spec is not RISC-V spec compliant. This patch implements a Ibex PLIC in a somewhat generic way. As the current RISC-V PLIC needs tidying up, my hope is that as the Ibex PLIC move towards spec compliance this PLIC implementation can be updated until it can replace the current PLIC. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-06-19hw/char: Initial commit of Ibex UARTAlistair Francis
This is the initial commit of the Ibex UART device. Serial TX is working, while RX has been implemeneted but untested. This is based on the documentation from: https://docs.opentitan.org/hw/ip/uart/doc/ Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: LIU Zhiwei<zhiwei_liu@c-sky.com>
2020-06-19riscv/opentitan: Fix the ROM sizeAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reported-by: Damien Hedde <damien.hedde@greensocs.com>
2020-06-19target/riscv: Implement checks for hfenceAlistair Francis
Call the helper_hyp_tlb_flush() function on hfence instructions which will generate an illegal insruction execption if we don't have permission to flush the Hypervisor level TLBs. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-19target/riscv: Move the hfence instructions to the rvh decodeAlistair Francis
Also correct the name of the VVMA instruction. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-19target/riscv: Report errors validating 2nd-stage PTEsAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-19target/riscv: Set access as data_load when validating stage-2 PTEsAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2020-06-19riscv: Keep the CPU init routine names consistentBin Meng
Adding a _ to keep some consistency among the CPU init routines. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <1591837729-27486-4-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19riscv: Generalize CPU init routine for the imacu CPUBin Meng
There is no need to have two functions that have almost the same codes for 32-bit and 64-bit imacu CPUs. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <1591837729-27486-3-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19riscv: Generalize CPU init routine for the gcsu CPUBin Meng
There is no need to have two functions that have almost the same codes for 32-bit and 64-bit gcsu CPUs. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <1591837729-27486-2-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19riscv: Generalize CPU init routine for the base CPUBin Meng
There is no need to have two functions that have exactly the same codes for 32-bit and 64-bit base CPUs. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1591837729-27486-1-git-send-email-bmeng.cn@gmail.com Message-Id: <1591837729-27486-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19sifive_e: Support the revB machineAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19riscv: Add helper to make NaN-boxing for FP registerIan Jiang
The function that makes NaN-boxing when a 32-bit value is assigned to a 64-bit FP register is split out to a helper gen_nanbox_fpr(). Then it is applied in translating of the FLW instruction. Signed-off-by: Ian Jiang <ianjiang.ict@gmail.com> Message-Id: <20200128003707.17028-1-ianjiang.ict@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-06-19tpm: Move backend code under the 'backends/' directoryPhilippe Mathieu-Daudé
TPM subsytem is split into backends (see commit f4ede81eed2) and frontends (see i.e. 3676bc69b35). Keep the emulated hardware 'frontends' under hw/tpm/, but move the backends in the backends/tpm/ directory. Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200612085444.8362-13-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Make 'tpm_util.h' publicly accessible as "sysemu/tpm_util.h"Philippe Mathieu-Daudé
We are going to split the TPM backends from the TPM emulated hardware in the next commit. Make the TPM util helpers accessible by moving local "tpm_util.h" to global "sysemu/tpm_util.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-12-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Move DEFINE_PROP_TPMBE() macro to 'tmp_prop.h' local headerPhilippe Mathieu-Daudé
We are going to make "tpm_util.h" publicly accessible by moving it to the include/ directory in the next commit. The DEFINE_PROP_TPMBE() macro is only meaningful for the TPM hardware files (in hw/tpm/), so keep this macro in a local header. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-11-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Move few declarations from 'tpm_util.h' to 'tpm_int.h'Philippe Mathieu-Daudé
We are going to make "tpm_util.h" publicly accessible by moving it to the include/ directory in a pair of commits. Keep declarations internals to hw/tpm/ in "tpm_int.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-10-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Make TRACE_TPM_UTIL_SHOW_BUFFER check local to tpm_util.cPhilippe Mathieu-Daudé
The trace_event_get_state_backends() call is useful to avoid making extensive calls (usually preparing arguments passed to the tracing framework. In this case, the extensive work is done in tpm_util_show_buffer(), and the arguments used to call it don't involve extra processing. Simplify by moving the TRACE_TPM_UTIL_SHOW_BUFFER check to tpm_util_show_buffer. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-9-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Remove unnecessary 'tpm_int.h' header inclusionPhilippe Mathieu-Daudé
Remove unnecessary 'tpm_int.h' header inclusion. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-8-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Move 'hw/acpi/tpm.h' inclusion from header to sourcesPhilippe Mathieu-Daudé
Nothing in "tpm_ppi.h" require declarations from "hw/acpi/tpm.h". Reduce dependencies and include it only in the files requiring it. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-7-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Include missing 'qemu/option.h' headerPhilippe Mathieu-Daudé
Files using the TPM_STANDARD_CMDLINE_OPTS macro declared in "tpm_int.h" will use QEMU_OPT_STRING definition declared in "qemu/option.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-6-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Do not include 'qemu/osdep.h' in headerPhilippe Mathieu-Daudé
From CODING_STYLE.rst: Do not include "qemu/osdep.h" from header files since the .c file will have already included it. Remove "qemu/osdep.h" from "tpm_tis.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-5-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19hw/tpm: Rename TPMDEV as TPM_BACKEND in KconfigPhilippe Mathieu-Daudé
The TPMDEV describe TPM backends. Use the TPM_BACKEND config name which is self-explicit. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-4-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19backends: Add TPM files into their own directoryPhilippe Mathieu-Daudé
As we will have various TPM backend files, it is cleaner to use a single directory. Suggested-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-3-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19docs/specs/tpm: Correct header path namePhilippe Mathieu-Daudé
Commit 8dc6701722 introduce the documentation but an incorrect path name was used. Fix that. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20200612085444.8362-2-philmd@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2020-06-19Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200618' into stagingPeter Maydell
s390x update: - update Linux headers to 5.8-rc1 (for vfio-ccw path handling) - vfio-ccw: add support for path handling - documentation fix # gpg: Signature made Thu 18 Jun 2020 16:36:04 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [marginal] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [marginal] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20200618: docs/s390x: fix vfio-ap device_del description vfio-ccw: Add support for the CRW region and IRQ s390x/css: Refactor the css_queue_crw() routine vfio-ccw: Refactor ccw irq handler vfio-ccw: Add support for the schib region vfio-ccw: Refactor cleanup of regions Linux headers: update Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-19hw/audio/gus: Fix registers 32-bit accessAllan Peramaki
Fix audio on software that accesses DRAM above 64k via register peek/poke and some cases when more than 16 voices are used. Cc: qemu-stable@nongnu.org Fixes: 135f5ae1974c ("audio: GUSsample is int16_t") Signed-off-by: Allan Peramaki <aperamak@pp1.inet.fi> Tested-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200618103623.6031-1-philmd@redhat.com Message-Id: <20200615201757.16868-1-aperamak@pp1.inet.fi> [PMD: Removed unrelated style changes] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-18Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Thu 18 Jun 2020 14:16:22 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: (33 commits) net: Drop the NetLegacy structure, always use Netdev instead net: Drop the legacy "name" parameter from the -net option hw/net/e1000e: Do not abort() on invalid PSRCTL register value colo-compare: Fix memory leak in packet_enqueue() net/colo-compare.c: Correct ordering in complete and finalize net/colo-compare.c: Check that colo-compare is active net/colo-compare.c: Only hexdump packets if tracing is enabled net/colo-compare.c: Fix deadlock in compare_chr_send chardev/char.c: Use qemu_co_sleep_ns if in coroutine net/colo-compare.c: Create event_bh with the right AioContext net: use peer when purging queue in qemu_flush_or_purge_queue_packets() net: cadence_gem: Fix RX address filtering net: cadence_gem: TX_LAST bit should be set by guest net: cadence_gem: Update the reset value for interrupt mask register net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg net: cadence_gem: Add support for jumbo frames net: cadence_gem: Fix up code style net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState net: cadence_gem: Set ISR according to queue in use net: cadence_gem: Define access permission for interrupt registers ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-18Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert/tags/pull-migration-20200617a' into staging Migration (and HMP and virtiofs) pull 2020-06-17 Migration: HMP/migration and test changes from Mao Zhongyi multifd fix from Laurent Vivier HMP qom-set partial reversion/change from David Hildenbrand now you need -j to pass json format, but it's regained the old 100M type format. Memory leak fix from Pan Nengyuan Virtiofs fchmod seccomp fix from Max Reitz Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Wed 17 Jun 2020 19:34:58 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20200617a: migration: fix multifd_send_pages() next channel docs/xbzrle: update 'cache miss rate' and 'encoding rate' to docs monitor/hmp-cmds: improvements for the 'info migrate' monitor/hmp-cmds: add 'goto end' to reduce duplicate code. monitor/hmp-cmds: delete redundant Error check before invoke hmp_handle_error() monitor/hmp-cmds: don't silently output when running 'migrate_set_downtime' fails monitor/hmp-cmds: add units for migrate_parameters tests/migration: fix unreachable path in stress test tests/migration: mem leak fix hmp: Make json format optional for qom-set qom-hmp-cmds: fix a memleak in hmp_qom_get virtiofsd: Whitelist fchmod Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-18net: Drop the NetLegacy structure, always use Netdev insteadThomas Huth
Now that the "name" parameter is gone, there is hardly any difference between NetLegacy and Netdev anymore, so we can drop NetLegacy and always use Netdev to simplify the code quite a bit. The only two differences that were really left between Netdev and NetLegacy: 1) NetLegacy does not allow a "hubport" type. We can continue to block this with a simple check in net_client_init1() for this type. 2) The "id" parameter was optional in NetLegacy (and an internal id was chosen via assign_name() during initialization), but it is mandatory for Netdev. To avoid that the visitor code bails out here, we have to add an internal id to the QemuOpts already earlier now. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net: Drop the legacy "name" parameter from the -net optionThomas Huth
It's been deprecated since QEMU v3.1, so it's time to finally remove it. The "id" parameter can simply be used instead. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18hw/net/e1000e: Do not abort() on invalid PSRCTL register valuePhilippe Mathieu-Daudé
libFuzzer found using 'qemu-system-i386 -M q35': qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero CPU #0: EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663 ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000 EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 00000000 0000ffff 00009300 CS =f000 ffff0000 0000ffff 00009b00 SS =0000 00000000 0000ffff 00009300 DS =0000 00000000 0000ffff 00009300 FS =0000 00000000 0000ffff 00009300 GS =0000 00000000 0000ffff 00009300 LDT=0000 00000000 0000ffff 00008200 TR =0000 00000000 0000ffff 00008b00 GDT= 00000000 0000ffff IDT= 00000000 0000ffff CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000 DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000 DR6=ffff0ff0 DR7=00000400 EFER=0000000000000000 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 ==1988== ERROR: libFuzzer: deadly signal #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894) #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d) #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2) #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f) #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46) #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7) #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13) #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4) It simply sent the following 2 I/O command to the e1000e PCI BAR #2 I/O region: writew 0x0100 0x0c00 # RCTL = E1000_RCTL_DTYP_MASK writeb 0x2170 0x00 # PSRCTL = 0 2813 static void 2814 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val) 2815 { 2816 if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) { 2817 2818 if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) { 2819 hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero"); 2820 } Instead of calling hw_error() which abort the process (it is meant for CPU fatal error condition, not for device logging), log the invalid request with qemu_log_mask(LOG_GUEST_ERROR) and return, ignoring the request. Cc: qemu-stable@nongnu.org Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18colo-compare: Fix memory leak in packet_enqueue()Derek Su
The patch is to fix the "pkt" memory leak in packet_enqueue(). The allocated "pkt" needs to be freed if the colo compare primary or secondary queue is too big. Replace the error_report of full queue with a trace event. Signed-off-by: Derek Su <dereksu@qnap.com> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net/colo-compare.c: Correct ordering in complete and finalizeLukas Straub
In colo_compare_complete, insert CompareState into net_compares only after everything has been initialized. In colo_compare_finalize, remove CompareState from net_compares before anything is deinitialized. Signed-off-by: Lukas Straub <lukasstraub2@web.de> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net/colo-compare.c: Check that colo-compare is activeLukas Straub
If the colo-compare object is removed before failover and a checkpoint happens, qemu crashes because it tries to lock the destroyed event_mtx in colo_notify_compares_event. Fix this by checking if everything is initialized by introducing a new variable colo_compare_active which is protected by a new mutex colo_compare_mutex. The new mutex also protects against concurrent access of the net_compares list and makes sure that colo_notify_compares_event isn't active while we destroy event_mtx and event_complete_cond. With this it also is again possible to use colo without colo-compare (periodic mode) and to use multiple colo-compare for multiple network interfaces. Signed-off-by: Lukas Straub <lukasstraub2@web.de> Tested-by: Lukas Straub <lukasstraub2@web.de> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net/colo-compare.c: Only hexdump packets if tracing is enabledLukas Straub
Else the log will be flooded if there is a lot of network traffic. Signed-off-by: Lukas Straub <lukasstraub2@web.de> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net/colo-compare.c: Fix deadlock in compare_chr_sendLukas Straub
The chr_out chardev is connected to a filter-redirector running in the main loop. qemu_chr_fe_write_all might block here in compare_chr_send if the (socket-)buffer is full. If another filter-redirector in the main loop want's to send data to chr_pri_in it might also block if the buffer is full. This leads to a deadlock because both event loops get blocked. Fix this by converting compare_chr_send to a coroutine and putting the packets in a send queue. Signed-off-by: Lukas Straub <lukasstraub2@web.de> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Tested-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18chardev/char.c: Use qemu_co_sleep_ns if in coroutineLukas Straub
To be able to convert compare_chr_send to a coroutine in the next commit, use qemu_co_sleep_ns if in coroutine. Signed-off-by: Lukas Straub <lukasstraub2@web.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net/colo-compare.c: Create event_bh with the right AioContextLukas Straub
qemu_bh_new will set the bh to be executed in the main loop. This causes crashes as colo_compare_handle_event assumes that it has exclusive access the queues, which are also concurrently accessed in the iothread. Create the bh with the AioContext of the iothread to fulfill these assumptions and fix the crashes. This is safe, because the bh already takes the appropriate locks. Signed-off-by: Lukas Straub <lukasstraub2@web.de> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Reviewed-by: Derek Su <dereksu@qnap.com> Tested-by: Derek Su <dereksu@qnap.com> Signed-off-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net: use peer when purging queue in qemu_flush_or_purge_queue_packets()Jason Wang
The sender of packet will be checked in the qemu_net_queue_purge() but we use NetClientState not its peer when trying to purge the incoming queue in qemu_flush_or_purge_packets(). This will trigger the assert in virtio_net_reset since we can't pass the sender check: hw/net/virtio-net.c:533: void virtio_net_reset(VirtIODevice *): Assertion `!virtio_net_get_subqueue(nc)->async_tx.elem' failed. #9 0x55a33fa31b78 in virtio_net_reset hw/net/virtio-net.c:533:13 #10 0x55a33fc88412 in virtio_reset hw/virtio/virtio.c:1919:9 #11 0x55a341d82764 in virtio_bus_reset hw/virtio/virtio-bus.c:95:9 #12 0x55a341dba2de in virtio_pci_reset hw/virtio/virtio-pci.c:1824:5 #13 0x55a341db3e02 in virtio_pci_common_write hw/virtio/virtio-pci.c:1252:13 #14 0x55a33f62117b in memory_region_write_accessor memory.c:496:5 #15 0x55a33f6205e4 in access_with_adjusted_size memory.c:557:18 #16 0x55a33f61e177 in memory_region_dispatch_write memory.c:1488:16 Reproducer: https://www.mail-archive.com/qemu-devel@nongnu.org/msg701914.html Fix by using the peer. Reported-by: "Alexander Bulekov" <alxndr@bu.edu> Acked-by: Alexander Bulekov <alxndr@bu.edu> Fixes: ca77d85e1dbf9 ("net: complete all queued packets on VM stop") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net: cadence_gem: Fix RX address filteringTong Ho
Two defects are fixed: 1/ Detection of multicast frames 2/ Treating drop of mis-addressed frames as non-error Signed-off-by: Tong Ho <tong.ho@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net: cadence_gem: TX_LAST bit should be set by guestSai Pavan Boddu
TX_LAST bit should not be set by hardware, its set by guest to inform the last bd of the frame. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net: cadence_gem: Update the reset value for interrupt mask registerSai Pavan Boddu
Mask all interrupt on reset. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 regSai Pavan Boddu
Advertise support of clear-on-read for ISR registers. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-18 08:16:32 +0000