aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-03-15x86: Add AMX CPUIDs enumerationJing Liu
Add AMX primary feature bits XFD and AMX_TILE to enumerate the CPU's AMX capability. Meanwhile, add AMX TILE and TMUL CPUID leaf and subleaves which exist when AMX TILE is present to provide the maximum capability of TILE and TMUL. Signed-off-by: Jing Liu <jing2.liu@intel.com> Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20220217060434.52460-6-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15x86: Add XFD faulting bit for state componentsJing Liu
Intel introduces XFD faulting mechanism for extended XSAVE features to dynamically enable the features in runtime. If CPUID (EAX=0Dh, ECX=n, n>1).ECX[2] is set as 1, it indicates support for XFD faulting of this state component. Signed-off-by: Jing Liu <jing2.liu@intel.com> Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20220217060434.52460-5-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15x86: Grant AMX permission for guestYang Zhong
Kernel allocates 4K xstate buffer by default. For XSAVE features which require large state component (e.g. AMX), Linux kernel dynamically expands the xstate buffer only after the process has acquired the necessary permissions. Those are called dynamically- enabled XSAVE features (or dynamic xfeatures). There are separate permissions for native tasks and guests. Qemu should request the guest permissions for dynamic xfeatures which will be exposed to the guest. This only needs to be done once before the first vcpu is created. KVM implemented one new ARCH_GET_XCOMP_SUPP system attribute API to get host side supported_xcr0 and Qemu can decide if it can request dynamically enabled XSAVE features permission. https://lore.kernel.org/all/20220126152210.3044876-1-pbonzini@redhat.com/ Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Yang Zhong <yang.zhong@intel.com> Signed-off-by: Jing Liu <jing2.liu@intel.com> Message-Id: <20220217060434.52460-4-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15x86: Add AMX XTILECFG and XTILEDATA componentsJing Liu
The AMX TILECFG register and the TMMx tile data registers are saved/restored via XSAVE, respectively in state component 17 (64 bytes) and state component 18 (8192 bytes). Add AMX feature bits to x86_ext_save_areas array to set up AMX components. Add structs that define the layout of AMX XSAVE areas and use QEMU_BUILD_BUG_ON to validate the structs sizes. Signed-off-by: Jing Liu <jing2.liu@intel.com> Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20220217060434.52460-3-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15x86: Fix the 64-byte boundary enumeration for extended stateJing Liu
The extended state subleaves (EAX=0Dh, ECX=n, n>1).ECX[1] indicate whether the extended state component locates on the next 64-byte boundary following the preceding state component when the compacted format of an XSAVE area is used. Right now, they are all zero because no supported component needed the bit to be set, but the upcoming AMX feature will use it. Fix the subleaves value according to KVM's supported cpuid. Signed-off-by: Jing Liu <jing2.liu@intel.com> Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20220217060434.52460-2-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15linux-headers: include missing changes from 5.17Paolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15target/i386: Throw a #SS when loading a non-canonical ISTGareth Webb
Loading a non-canonical address into rsp when handling an interrupt or performing a far call should raise a #SS not a #GP. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/870 Signed-off-by: Gareth Webb <gareth.webb@umbralsoftware.co.uk> Message-Id: <164529651121.25406.15337137068584246397-0@git.sr.ht> [Move get_pg_mode to seg_helper.c for user-mode emulators. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15target/i386: only include bits in pg_mode if they are not ignoredPaolo Bonzini
LA57/PKE/PKS is only relevant in 64-bit mode, and NXE is only relevant if PAE is in use. Since there is code that checks PG_MODE_LA57 to determine the canonicality of addresses, make sure that the bit is not set by mistake in 32-bit mode. While it would not be a problem because 32-bit addresses by definition fit in both 48-bit and 57-bit address spaces, it is nicer if get_pg_mode() actually returns whether a feature is enabled, and it allows a few simplifications in the page table walker. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15kvm/msi: do explicit commit when adding msi routesLongpeng(Mike)
We invoke the kvm_irqchip_commit_routes() for each addition to MSI route table, which is not efficient if we are adding lots of routes in some cases. This patch lets callers invoke the kvm_irqchip_commit_routes(), so the callers can decide how to optimize. [1] https://lists.gnu.org/archive/html/qemu-devel/2021-11/msg00967.html Signed-off-by: Longpeng <longpeng2@huawei.com> Message-Id: <20220222141116.2091-3-longpeng2@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15kvm-irqchip: introduce new API to support route changeLongpeng(Mike)
Paolo suggested adding the new API to support route changes [1]. We should invoke kvm_irqchip_begin_route_changes() before changing the routes, increasing the KVMRouteChange.changes if the routes are changed, and commit the changes at last. [1] https://lists.gnu.org/archive/html/qemu-devel/2021-11/msg02898.html Signed-off-by: Longpeng <longpeng2@huawei.com> Message-Id: <20220222141116.2091-2-longpeng2@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15update meson-buildoptions.shPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15qga/vss: update informative message about MinGWMarc-André Lureau
The headers are now all available in MinGW master branch. (commit 13390dbbf885f and earlier) aiming for 10.0. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220222194008.610377-4-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15qga/vss-win32: check old VSS SDK headersMarc-André Lureau
The VssCoordinator & VssAdmin interfaces have been moved to vsadmin.h in the Windows SDK. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220222194008.610377-3-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15meson: fix generic location of vss headersMarc-André Lureau
This is a left-over, despite requesting the change before the merge. Fixes: commit 8821a389 ("configure, meson: replace VSS SDK checks and options with --enable-vss-sdk") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220222194008.610377-2-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15vmxcap: Add 5-level EPT bitVitaly Kuznetsov
5-level EPT is present in Icelake Server CPUs and is supported by QEMU ('vmx-page-walk-5'). Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20220221145316.576138-2-vkuznets@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15whpx: Fixed incorrect CR8/TPR synchronizationIvan Shcherbakov
This fixes the following error triggered when stopping and resuming a 64-bit Linux kernel via gdb: qemu-system-x86_64.exe: WHPX: Failed to set virtual processor context, hr=c0350005 The previous logic for synchronizing the values did not take into account that the lower 4 bits of the CR8 register, containing the priority level, mapped to bits 7:4 of the APIC.TPR register (see section 10.8.6.1 of Volume 3 of Intel 64 and IA-32 Architectures Software Developer's Manual). The caused WHvSetVirtualProcessorRegisters() to fail with an error, effectively preventing GDB from changing the guest context. Signed-off-by: Ivan Shcherbakov <ivan@sysprogs.com> Message-Id: <010b01d82874$bb4ef160$31ecd420$@sysprogs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15whpx: Fixed reporting of the CPU context to GDB for 64-bitIvan Shcherbakov
Make sure that pausing the VM while in 64-bit mode will set the HF_CS64_MASK flag in env->hflags (see x86_update_hflags() in target/i386/cpu.c). Without it, the code in gdbstub.c would only use the 32-bit register values when debugging 64-bit targets, making debugging effectively impossible. Signed-off-by: Ivan Shcherbakov <ivan@sysprogs.com> Message-Id: <00f701d82874$68b02000$3a106000$@sysprogs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-15Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingPeter Maydell
# gpg: Signature made Tue 15 Mar 2022 05:58:55 GMT # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: vdpa: Expose VHOST_F_LOG_ALL on SVQ vdpa: Never set log_base addr if SVQ is enabled vdpa: Adapt vhost_vdpa_get_vring_base to SVQ vdpa: Add custom IOTLB translations to SVQ vhost: Add VhostIOVATree util: add iova_tree_find_iova util: Add iova_tree_alloc_map vhost: Shadow virtqueue buffers forwarding vdpa: adapt vhost_ops callbacks to svq virtio: Add vhost_svq_get_vring_addr vhost: Add vhost_svq_valid_features to shadow vq vhost: Add Shadow VirtQueue call forwarding capabilities vhost: Add Shadow VirtQueue kick forwarding capabilities vhost: Add VhostShadowVirtqueue virtio-net: fix map leaking on error during receive Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-03-15ui/console: call gfx_switch() even if the current scanout is GLMarc-André Lureau
egl-headless depends on the backing surface to be set before texture are set and updated. Display it (update=true) iff the current scanout kind is SURFACE. Reported-by: Akihiko Odaki <akihiko.odaki@gmail.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-15ui/dbus: do not send 2d scanout until gfx_updateMarc-André Lureau
gfx_switch() is called to set the new_surface, not necessarily to display it. It should be displayed after gfx_update(). Send the whole scanout only in this case. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-15ui/dbus: fix texture sharingMarc-André Lureau
The DBus listener naively create, update and destroy textures without taking into account other listeners. The texture were shared, but texture update was unnecessarily duplicated. Teach DisplayGLCtx to do optionally shared texture handling. This is only implemented for DBus display at this point, however the same infrastructure could potentially be used for other future combinations. Reported-by: Akihiko Odaki <akihiko.odaki@gmail.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-15MAINTAINERS: take edk2Gerd Hoffmann
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-03-15edk2/docker: use ubuntu 18.04Gerd Hoffmann
Upstream CI uses ubuntu 18.04 too, so pick that version (instead of something newer). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-03-15edk2/docker: install python3Gerd Hoffmann
python2 is not supported any more, so go install python3 instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-03-15tests/acpi: disallow virt memory hotplug changesGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2022-03-15tests/acpi: update expected data filesGerd Hoffmann
The switch to edk2 RELEASE builds changes the memory layout a bit, resulting in a acpi table change. See commits ca26041500eb ("edk2: switch to release builds") and 3891a5996fee ("edk2: update binaries to stable202202") DefinitionBlock ("", "SSDT", 1, "BOCHS ", "NVDIMM", 0x00000001) { Scope (\_SB) { Device (NVDR) { Name (_HID, "ACPI0012" /* NVDIMM Root Device */) // _HID: Hardware ID Method (NCAL, 5, Serialized) { Local6 = MEMA /* \MEMA */ { Return (NCAL (Arg0, Arg1, Arg2, Arg3, 0x02)) } } Device (NV02) { Name (_ADR, 0x03) // _ADR: Address Method (_DSM, 4, NotSerialized) // _DSM: Device-Specific Method { Return (NCAL (Arg0, Arg1, Arg2, Arg3, 0x03)) } } } } - Name (MEMA, 0x43D10000) + Name (MEMA, 0x43F50000) } Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2022-03-15edk2: update binaries to stable202202Gerd Hoffmann
The switch to edk2 RELEASE builds changes the memory layout a bit, resulting in a acpi table change. DefinitionBlock ("", "SSDT", 1, "BOCHS ", "NVDIMM", 0x00000001) { Scope (\_SB) { Device (NVDR) { Name (_HID, "ACPI0012" /* NVDIMM Root Device */) // _HID: Hardware ID Method (NCAL, 5, Serialized) { Local6 = MEMA /* \MEMA */ { Return (NCAL (Arg0, Arg1, Arg2, Arg3, 0x02)) } } Device (NV02) { Name (_ADR, 0x03) // _ADR: Address Method (_DSM, 4, NotSerialized) // _DSM: Device-Specific Method { Return (NCAL (Arg0, Arg1, Arg2, Arg3, 0x03)) } } } } - Name (MEMA, 0x43D10000) + Name (MEMA, 0x43F50000) } Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-15edk2: add microvm buildGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-03-15edk2: .git can be a fileGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-03-15edk2: switch to release buildsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2022-03-15edk2: update submodule to stable202202Gerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2022-03-15tests/acpi: allow virt memory hotplug changesGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2022-03-15vdpa: Expose VHOST_F_LOG_ALL on SVQEugenio Pérez
SVQ is able to log the dirty bits by itself, so let's use it to not block migration. Also, ignore set and clear of VHOST_F_LOG_ALL on set_features if SVQ is enabled. Even if the device supports it, the reports would be nonsense because SVQ memory is in the qemu region. The log region is still allocated. Future changes might skip that, but this series is already long enough. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vdpa: Never set log_base addr if SVQ is enabledEugenio Pérez
Setting the log address would make the device start reporting invalid dirty memory because the SVQ vrings are located in qemu's memory. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vdpa: Adapt vhost_vdpa_get_vring_base to SVQEugenio Pérez
This is needed to achieve migration, so the destination can restore its index. Setting base as last used idx, so destination will see as available all the entries that the device did not use, including the in-flight processing ones. This is ok for networking, but other kinds of devices might have problems with these retransmissions. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vdpa: Add custom IOTLB translations to SVQEugenio Pérez
Use translations added in VhostIOVATree in SVQ. Only introduce usage here, not allocation and deallocation. As with previous patches, we use the dead code paths of shadow_vqs_enabled to avoid commiting too many changes at once. These are impossible to take at the moment. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vhost: Add VhostIOVATreeEugenio Pérez
This tree is able to look for a translated address from an IOVA address. At first glance it is similar to util/iova-tree. However, SVQ working on devices with limited IOVA space need more capabilities, like allocating IOVA chunks or performing reverse translations (qemu addresses to iova). The allocation capability, as "assign a free IOVA address to this chunk of memory in qemu's address space" allows shadow virtqueue to create a new address space that is not restricted by guest's addressable one, so we can allocate shadow vqs vrings outside of it. It duplicates the tree so it can search efficiently in both directions, and it will signal overlap if iova or the translated address is present in any tree. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15util: add iova_tree_find_iovaEugenio Pérez
This function does the reverse operation of iova_tree_find: To look for a mapping that match a translated address so we can do the reverse. This have linear complexity instead of logarithmic, but it supports overlapping HVA. Future developments could reduce it. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15util: Add iova_tree_alloc_mapEugenio Pérez
This iova tree function allows it to look for a hole in allocated regions and return a totally new translation for a given translated address. It's usage is mainly to allow devices to access qemu address space, remapping guest's one into a new iova space where qemu can add chunks of addresses. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vhost: Shadow virtqueue buffers forwardingEugenio Pérez
Initial version of shadow virtqueue that actually forward buffers. There is no iommu support at the moment, and that will be addressed in future patches of this series. Since all vhost-vdpa devices use forced IOMMU, this means that SVQ is not usable at this point of the series on any device. For simplicity it only supports modern devices, that expects vring in little endian, with split ring and no event idx or indirect descriptors. Support for them will not be added in this series. It reuses the VirtQueue code for the device part. The driver part is based on Linux's virtio_ring driver, but with stripped functionality and optimizations so it's easier to review. However, forwarding buffers have some particular pieces: One of the most unexpected ones is that a guest's buffer can expand through more than one descriptor in SVQ. While this is handled gracefully by qemu's emulated virtio devices, it may cause unexpected SVQ queue full. This patch also solves it by checking for this condition at both guest's kicks and device's calls. The code may be more elegant in the future if SVQ code runs in its own iocontext. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vdpa: adapt vhost_ops callbacks to svqEugenio Pérez
First half of the buffers forwarding part, preparing vhost-vdpa callbacks to SVQ to offer it. QEMU cannot enable it at this moment, so this is effectively dead code at the moment, but it helps to reduce patch size. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15virtio: Add vhost_svq_get_vring_addrEugenio Pérez
It reports the shadow virtqueue address from qemu virtual address space. Since this will be different from the guest's vaddr, but the device can access it, SVQ takes special care about its alignment & lack of garbage data. It assumes that IOMMU will work in host_page_size ranges for that. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vhost: Add vhost_svq_valid_features to shadow vqEugenio Pérez
This allows SVQ to negotiate features with the guest and the device. For the device, SVQ is a driver. While this function bypasses all non-transport features, it needs to disable the features that SVQ does not support when forwarding buffers. This includes packed vq layout, indirect descriptors or event idx. Future changes can add support to offer more features to the guest, since the use of VirtQueue gives this for free. This is left out at the moment for simplicity. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vhost: Add Shadow VirtQueue call forwarding capabilitiesEugenio Pérez
This will make qemu aware of the device used buffers, allowing it to write the guest memory with its contents if needed. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vhost: Add Shadow VirtQueue kick forwarding capabilitiesEugenio Pérez
At this mode no buffer forwarding will be performed in SVQ mode: Qemu will just forward the guest's kicks to the device. Host memory notifiers regions are left out for simplicity, and they will not be addressed in this series. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15vhost: Add VhostShadowVirtqueueEugenio Pérez
Vhost shadow virtqueue (SVQ) is an intermediate jump for virtqueue notifications and buffers, allowing qemu to track them. While qemu is forwarding the buffers and virtqueue changes, it is able to commit the memory it's being dirtied, the same way regular qemu's VirtIO devices do. This commit only exposes basic SVQ allocation and free. Next patches of the series add functionality like notifications and buffers forwarding. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-15virtio-net: fix map leaking on error during receiveJason Wang
Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg") tries to fix the use after free of the sg by caching the virtqueue elements in an array and unmap them at once after receiving the packets, But it forgot to unmap the cached elements on error which will lead to leaking of mapping and other unexpected results. Fixing this by detaching the cached elements on error. This addresses CVE-2022-26353. Reported-by: Victor Tom <vv474172261@gmail.com> Cc: qemu-stable@nongnu.org Fixes: CVE-2022-26353 Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg") Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-03-14Merge tag 'pull-tcg-20220314' of https://gitlab.com/rth7680/qemu into stagingPeter Maydell
Fixes for s390x host vectors Fix for arm ldrd unpredictable case # gpg: Signature made Mon 14 Mar 2022 17:32:44 GMT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * tag 'pull-tcg-20220314' of https://gitlab.com/rth7680/qemu: tcg/arm: Don't emit UNPREDICTABLE LDRD with Rm == Rt or Rt+1 tcg/s390x: Fix tcg_out_dup_vec vs general registers tcg/s390x: Fix INDEX_op_bitsel_vec vs VSEL tcg/s390x: Fix tcg_out_dupi_vec vs VGM Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-03-14tcg/arm: Don't emit UNPREDICTABLE LDRD with Rm == Rt or Rt+1Richard Henderson
The LDRD (register) instruction is UNPREDICTABLE if the Rm register is the same as either Rt or Rt+1 (the two registers being loaded to). We weren't making sure we avoided this, with the result that on some host CPUs like the Cortex-A7 we would get a SIGILL because the CPU chooses to UNDEF for this particular UNPREDICTABLE case. Since we've already checked that datalo is aligned, we can simplify the test vs the Rm operand by aligning it before comparison. Check for the two orderings before falling back to two ldr instructions. We don't bother to do anything similar for tcg_out_ldrd_rwb(), because it is only used in tcg_out_tlb_read() with a fixed set of registers which don't overlap. There is no equivalent UNPREDICTABLE case for STRD. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/896 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-03-14tcg/s390x: Fix tcg_out_dup_vec vs general registersRichard Henderson
We copied the data from the general register input to the vector register output, but have not yet replicated it. We intended to fall through into the vector-vector case, but failed to redirect the input register. This is caught by an assertion failure in tcg_out_insn_VRIc, which diagnosed the incorrect register class. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-15 10:25:14 +0000