aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2020-03-31hw/net/e1000e_core: Let e1000e_can_receive() return a booleanPhilippe Mathieu-Daudé
The e1000e_can_receive() function simply returns a boolean value. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-03-31Fixed integer overflow in e1000eAndrew Melnychenko
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1737400 Fixed setting max_queue_num if there are no peers in NICConf. qemu_new_nic() creates NICState with 1 NetClientState(index 0) without peers, set max_queue_num to 0 - It prevents undefined behavior and possible crashes, especially during pcie hotplug. Fixes: 6f3fbe4ed06 ("net: Introduce e1000e device emulation") Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-03-31hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()Peter Maydell
The i82596_receive() function attempts to pass the guest a buffer which is effectively the concatenation of the data it is passed and a 4 byte CRC value. However, rather than implementing this as "write the data; then write the CRC" it instead bumps the length value of the data by 4, and writes 4 extra bytes from beyond the end of the buffer, which it then overwrites with the CRC. It also assumed that we could always fit all four bytes of the CRC into the final receive buffer, which might not be true if the CRC needs to be split over two receive buffers. Calculate separately how many bytes we need to transfer into the guest's receive buffer from the source buffer, and how many we need to transfer from the CRC work. We add a count 'bufsz' of the number of bytes left in the source buffer, which we use purely to assert() that we don't overrun. Spotted by Coverity (CID 1419396) for the specific case when we end up using a local array as the source buffer. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-03-31hw/net/i82596: Correct command bitmask (CID 1419392)Philippe Mathieu-Daudé
The command is 32-bit, but we are loading the 16 upper bits with the 'get_uint16(s->scb + 2)' call. Once shifted by 16, the command bits match the status bits: - Command Bit 31 ACK-CX Acknowledges that the CU completed an Action Command. Bit 30 ACK-FR Acknowledges that the RU received a frame. Bit 29 ACK-CNA Acknowledges that the Command Unit became not active. Bit 28 ACK-RNR Acknowledges that the Receive Unit became not ready. - Status Bit 15 CX The CU finished executing a command with its I(interrupt) bit set. Bit 14 FR The RU finished receiving a frame. Bit 13 CNA The Command Unit left the Active state. Bit 12 RNR The Receive Unit left the Ready state. Add the SCB_COMMAND_ACK_MASK definition to simplify the code. This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT): /hw/net/i82596.c: 352 in examine_scb() 346 cuc = (command >> 8) & 0x7; 347 ruc = (command >> 4) & 0x7; 348 DBG(printf("MAIN COMMAND %04x cuc %02x ruc %02x\n", command, cuc, ruc)); 349 /* and clear the scb command word */ 350 set_uint16(s->scb + 2, 0); 351 >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 352 if (command & BIT(31)) /* ACK-CX */ 353 s->scb_status &= ~SCB_STATUS_CX; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 354 if (command & BIT(30)) /*ACK-FR */ 355 s->scb_status &= ~SCB_STATUS_FR; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 356 if (command & BIT(29)) /*ACK-CNA */ 357 s->scb_status &= ~SCB_STATUS_CNA; >>> CID 1419392: (CONSTANT_EXPRESSION_RESULT) >>> "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 358 if (command & BIT(28)) /*ACK-RNR */ 359 s->scb_status &= ~SCB_STATUS_RNR; Fixes: Covertiy CID 1419392 (commit 376b851909) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-03-30hw/arm/xlnx-zynqmp.c: Add missing error-propagation codePeter Maydell
In some places in xlnx_zynqmp_realize() we were putting an error into our local Error*, but forgetting to check for failure and pass it back to the caller. Add the missing code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200324134947.15384-3-peter.maydell@linaro.org
2020-03-30hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return pathPeter Maydell
In xlnx_zynqmp_realize() if the attempt to realize the SD controller object fails then the error-return path will leak the 'bus_name' string. Fix this by deferring the allocation until after the realize has succeeded. Fixes: Coverity CID 1421911 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200324134947.15384-2-peter.maydell@linaro.org
2020-03-30hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row ↵Niek Linnenbank
mirror address The allwinner_h3_dramc_map_rows function simulates row addressing behavior when bootloader software attempts to detect the amount of available SDRAM. Currently the line that calculates the 64-bit address of the mirrored row uses a signed 32-bit multiply operation that in theory could result in the upper 32-bit be all 1s. This commit ensures that the row mirror address is calculated using only 64-bit operations. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-id: 20200323192944.5967-1-nieklinnenbank@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-30hw/arm/orangepi: check for potential NULL pointer when calling blk_is_availableNiek Linnenbank
The Orange Pi PC initialization function needs to verify that the SD card block backend is usable before calling the Boot ROM setup routine. When calling blk_is_available() the input parameter should not be NULL. This commit ensures that blk_is_available is only called with non-NULL input. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-id: 20200322205439.15231-1-nieklinnenbank@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-28Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell
Pull request # gpg: Signature made Fri 27 Mar 2020 20:14:10 GMT # gpg: using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full] # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/ide-pull-request: cmd646-ide: use qdev gpio rather than qemu_allocate_irqs() via-ide: use qdev gpio rather than qemu_allocate_irqs() via-ide: don't use PCI level for legacy IRQs hw/ide/sii3112: Use qdev gpio rather than qemu_allocate_irqs() fdc/i8257: implement verify transfer mode Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-27cmd646-ide: use qdev gpio rather than qemu_allocate_irqs()Mark Cave-Ayland
This prevents the memory from qemu_allocate_irqs() from being leaked which can in some cases be spotted by Coverity (CID 1421984). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 20200324210519.2974-4-mark.cave-ayland@ilande.co.uk Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-27via-ide: use qdev gpio rather than qemu_allocate_irqs()Mark Cave-Ayland
This prevents the memory from qemu_allocate_irqs() from being leaked which can in some cases be spotted by Coverity (CID 1421984). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 20200324210519.2974-3-mark.cave-ayland@ilande.co.uk Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-27via-ide: don't use PCI level for legacy IRQsMark Cave-Ayland
The PCI level calculation was accidentally left in when rebasing from a previous patchset. Since both IRQs are driven separately, the value being passed into the IRQ handler should be used directly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 20200324210519.2974-2-mark.cave-ayland@ilande.co.uk Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-27hw/ide/sii3112: Use qdev gpio rather than qemu_allocate_irqs()Peter Maydell
Coverity points out (CID 1421984) that we are leaking the memory returned by qemu_allocate_irqs(). We can avoid this leak by switching to using qdev_init_gpio_in(); the base class finalize will free the irqs that this allocates under the hood. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20200323151715.29454-1-peter.maydell@linaro.org [Maintainer edit: replace `DEVICE(dev)` by `ds` --js] Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-27fdc/i8257: implement verify transfer modeSven Schnelle
While working on the Tulip driver i tried to write some Teledisk images to a floppy image which didn't work. Turned out that Teledisk checks the written data by issuing a READ command to the FDC but running the DMA controller in VERIFY mode. As we ignored the DMA request in that case, the DMA transfer never finished, and Teledisk reported an error. The i8257 spec says about verify transfers: 3) DMA verify, which does not actually involve the transfer of data. When an 8257 channel is in the DMA verify mode, it will respond the same as described for transfer operations, except that no memory or I/O read/write control signals will be generated. Hervé proposed to remove all the dma_mode_ok stuff from fdc to have a more clear boundary between DMA and FDC, so this patch also does that. Suggested-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Sven Schnelle <svens@stackframe.org> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
2020-03-27nvme: Print 'cqid' for nvme_del_cqMinwoo Im
The given argument for this trace should be cqid, not sqid. Signed-off-by: Minwoo Im <minwoo.im.dev@gmail.com> Message-Id: <20200324140646.8274-1-minwoo.im.dev@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-03-25hw/audio/fmopl: fix segmentation faultVolker Rümelin
Current code allocates the memory for ENV_CURVE too late. Move allocation to OPLOpenTable() and deallocation to OPLCloseTable(). To reproduce the bug start qemu with -soundhw adlib. Fixes 2eea51bd01 "hw/audio/fmopl: Move ENV_CURVE to .heap to save 32KiB of .bss" Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200324061855.5951-1-vr_qemu@t-online.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-03-24ppc/ppc405_boards: Remove unnecessary NULL checkPhilippe Mathieu-Daudé
This code is inside the "if (dinfo)" condition, so testing again here whether it is NULL is unnecessary. Fixes: dd59bcae7 (Don't size flash memory to match backing image) Reported-by: Coverity (CID 1421917) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200320155740.5342-1-philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-03-24spapr: Fix memory leak in h_client_architecture_support()Greg Kurz
This is the only error path that needs to free the previously allocated ov1. Reported-by: Coverity (CID 1421924) Fixes: cbd0d7f36322 "spapr: Fail CAS if option vector table cannot be parsed" Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <158481206205.336182.16106097429336044843.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-03-24ppc/spapr: Set the effective address provided flag in mc error log.Mahesh Salgaonkar
Per PAPR, it is expected to set effective address provided flag in sub_err_type member of mc extended error log (i.e rtas_event_log_v6_mc.sub_err_type). This somehow got missed in original fwnmi-mce patch series. The current code just updates the effective address but does not set the flag to indicate that it is available. Hence guest fails to extract effective address from mce rtas log. This patch fixes that. Without this patch guest MCE logs fails print DAR value: [ 11.933608] Disabling lock debugging due to kernel taint [ 11.933773] MCE: CPU0: machine check (Severe) Host TLB Multihit [Recovered] [ 11.933979] MCE: CPU0: NIP: [c000000000090b34] radix__flush_tlb_range_psize+0x194/0xf00 [ 11.934223] MCE: CPU0: Initiator CPU [ 11.934341] MCE: CPU0: Unknown After the change: [ 22.454149] Disabling lock debugging due to kernel taint [ 22.454316] MCE: CPU0: machine check (Severe) Host TLB Multihit DAR: deadbeefdeadbeef [Recovered] [ 22.454605] MCE: CPU0: NIP: [c0000000003e5804] kmem_cache_alloc+0x84/0x330 [ 22.454820] MCE: CPU0: Initiator CPU [ 22.454944] MCE: CPU0: Unknown Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> Message-Id: <158451653844.22972.17999316676230071087.stgit@jupiter> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-03-23aspeed/smc: Fix DMA support for AST2600Cédric Le Goater
Recent firmwares uses SPI DMA transfers in U-Boot to load the different images (kernel, initrd, dtb) in the SoC DRAM. The AST2600 FMC model is missing the masks to be applied on the DMA registers which resulted in incorrect values. Fix that and wire the SPI controllers which have DMA support on the AST2600. Fixes: bcaa8ddd081c ("aspeed/smc: Add AST2600 support") Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20200320053923.20565-1-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-23hw/arm/bcm283x: Correct the license textPhilippe Mathieu-Daudé
The license is the 'GNU General Public License v2.0 or later', not 'and': This program is free software; you can redistribute it and/ori modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. Fix the license comment. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200312213455.15854-1-philmd@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-23s390/ipl: fix off-by-one in update_machine_ipl_properties()Halil Pasic
In update_machine_ipl_properties() the array ascii_loadparm needs to hold the 8 char loadparm and a string terminating zero char. Let's increase the size of ascii_loadparm accordingly. Signed-off-by: Halil Pasic <pasic@linux.ibm.com> Fixes: 0a01e082a428 ("s390/ipl: sync back loadparm") Fixes: Coverity CID 1421966 Reported-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20200320143101.41764-1-pasic@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-03-21hw/rdma: avoid suspicious strncpy() useStefan Hajnoczi
gcc (GCC) 9.2.1 20190827 (Red Hat 9.2.1-1) with sanitizers enabled reports the following error: CC x86_64-softmmu/hw/rdma/vmw/pvrdma_dev_ring.o In file included from /usr/include/string.h:495, from include/qemu/osdep.h:101, from hw/rdma/vmw/pvrdma_dev_ring.c:16: In function ‘strncpy’, inlined from ‘pvrdma_ring_init’ at hw/rdma/vmw/pvrdma_dev_ring.c:33:5: /usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 32 equals destination size [-Werror=stringop-truncation] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Use pstrcpy() instead of strncpy(). It is guaranteed to NUL-terminate strings. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml.gmail.com> Message-Id: <20200316160702.478964-3-stefanha@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2020-03-21hw/rdma: Skip data-path mr_id translationYuval Shaia
With the change made in commit 68b89aee71 ("Utilize ibv_reg_mr_iova for memory registration") the MR emulation is no longer needed in order to translate the guest addresses into host addresses. With that, the next obvious step is to skip entirely the processing in data-path. To accomplish this, return the backend's lkey to driver so we will not need to do the emulated mr_id to backend mr_id translation in data-path. The function build_host_sge_array is still called in data-path but only for backward computability with statistics collection. While there, as a cosmetic change to make the code cleaner - make one copy of the function rdma_backend_create_mr and leave the redundant guest_start argument in the legacy code. Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Message-Id: <20200320143429.9490-3-yuval.shaia.ml@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2020-03-21hw/rdma: Cosmetic change - no need for two sge arraysYuval Shaia
The function build_host_sge_array uses two sge arrays, one for input and one for output. Since the size of the two arrays is the same, the function can write directly to the given source array (i.e. input/output argument). Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Message-Id: <20200320143429.9490-2-yuval.shaia.ml@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2020-03-21hw/rdma/vmw/pvrdma_dev_ring: Replace strncpy with pstrcpyJulia Suvorova
ring->name is defined as 'char name[MAX_RING_NAME_SZ]'. Replace untruncated strncpy with QEMU function. This case prevented QEMU from compiling with --enable-sanitizers. Signed-off-by: Julia Suvorova <jusual@redhat.com> Message-Id: <20200318134849.237011-1-jusual@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml.gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2020-03-20compat: disable edid on correct virtio-gpu deviceCornelia Huck
Commit bb15791166c1 ("compat: disable edid on virtio-gpu base device") tried to disable 'edid' on the virtio-gpu base device. However, that device is not 'virtio-gpu', but 'virtio-gpu-device'. Fix it. Fixes: bb15791166c1 ("compat: disable edid on virtio-gpu base device") Reported-by: Lukáš Doktor <ldoktor@redhat.com> Tested-by: Lukáš Doktor <ldoktor@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20200318093919.24942-1-cohuck@redhat.com Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-03-19Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/x86-and-machine-pull-request' into staging x86 and machine queue for 5.0 soft freeze Bug fixes: * memory encryption: Disable mem merge (Dr. David Alan Gilbert) Features: * New EPYC CPU definitions (Babu Moger) * Denventon-v2 CPU model (Tao Xu) * New 'note' field on versioned CPU models (Tao Xu) Cleanups: * x86 CPU topology cleanups (Babu Moger) * cpu: Use DeviceClass reset instead of a special CPUClass reset (Peter Maydell) # gpg: Signature made Wed 18 Mar 2020 01:16:43 GMT # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-and-machine-pull-request: hw/i386: Rename apicid_from_topo_ids to x86_apicid_from_topo_ids hw/i386: Update structures to save the number of nodes per package hw/i386: Remove unnecessary initialization in x86_cpu_new machine: Add SMP Sockets in CpuTopology hw/i386: Consolidate topology functions hw/i386: Introduce X86CPUTopoInfo to contain topology info cpu: Use DeviceClass reset instead of a special CPUClass reset machine/memory encryption: Disable mem merge hw/i386: Rename X86CPUTopoInfo structure to X86CPUTopoIDs i386: Add 2nd Generation AMD EPYC processors i386: Add missing cpu feature bits in EPYC model target/i386: Add new property note to versioned CPU models target/i386: Add Denverton-v2 (no MPX) CPU model Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-19Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into stagingPeter Maydell
Pull request # gpg: Signature made Tue 17 Mar 2020 23:22:33 GMT # gpg: using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E # gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full] # Primary key fingerprint: FAEB 9711 A12C F475 812F 18F2 88A9 064D 1835 61EB # Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76 CBD0 7DEF 8106 AAFC 390E * remotes/jnsnow/tags/ide-pull-request: hw/ide: Remove unneeded inclusion of hw/ide.h hw/ide: Move MAX_IDE_DEVS define to hw/ide/internal.h hw/ide: Do ide_drive_get() within pci_ide_create_devs() hw/ide/pci.c: Coding style update to fix checkpatch errors hw/ide: Remove now unneded #include "hw/pci/pci.h" from hw/ide.h hw/ide: Get rid of piix4_init function hw/isa/piix4.c: Introduce variable to store devfn hw/ide: Get rid of piix3_init functions hd-geo-test: Clean up use of buf[] in create_qcow2_with_mbr() via-ide: always use legacy IRQ 14/15 routing via-ide: allow guests to write to PCI_CLASS_PROG via-ide: initialise IDE controller in legacy mode via-ide: ensure that PCI_INTERRUPT_LINE is hard-wired to its default value pci: Honour wmask when resetting PCI_INTERRUPT_LINE ide/via: Get rid of via_ide_init() via-ide: move registration of VMStateDescription to DeviceClass cmd646: remove unused pci_cmd646_ide_init() function dp264: use pci_create_simple() to initialise the cmd646 device cmd646: register vmstate_ide_pci VMStateDescription in DeviceClass cmd646: register cmd646_reset() function in DeviceClass Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-18Merge remote-tracking branch ↵Peter Maydell
'remotes/stsquad/tags/pull-testing-and-gdbstub-170320-1' into staging Testing and gdbstub updates: - docker updates for VirGL - re-factor gdbstub for static GDBState - re-factor gdbstub for dynamic arrays - add SVE support to arm gdbstub - add some guest debug tests to check-tcg - add aarch64 userspace register tests - remove packet size limit to gdbstub - simplify gdbstub monitor code - report vContSupported in gdbstub to use proper single-step # gpg: Signature made Tue 17 Mar 2020 17:47:46 GMT # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full] # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-testing-and-gdbstub-170320-1: (28 commits) gdbstub: Fix single-step issue by confirming 'vContSupported+' feature to gdb gdbstub: do not split gdb_monitor_write payload gdbstub: change GDBState.last_packet to GByteArray tests/tcg/aarch64: add test-sve-ioctl guest-debug test tests/tcg/aarch64: add SVE iotcl test tests/tcg/aarch64: add a gdbstub testcase for SVE registers tests/guest-debug: add a simple test runner configure: allow user to specify what gdb to use tests/tcg/aarch64: userspace system register test target/arm: don't bother with id_aa64pfr0_read for USER_ONLY target/arm: generate xml description of our SVE registers target/arm: default SVE length to 64 bytes for linux-user target/arm: explicitly encode regnum in our XML target/arm: prepare for multiple dynamic XMLs gdbstub: extend GByteArray to read register helpers target/i386: use gdb_get_reg helpers target/m68k: use gdb_get_reg helpers target/arm: use gdb_get_reg helpers gdbstub: add helper for 128 bit registers gdbstub: move mem_buf to GDBState and use GByteArray ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-18Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2020-03-17' ↵Peter Maydell
into staging Error reporting patches for 2020-03-17 # gpg: Signature made Tue 17 Mar 2020 16:30:49 GMT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2020-03-17: hw/sd/ssi-sd: fix error handling in ssi_sd_realize xen-block: Use one Error * variable instead of two hw/misc/ivshmem: Use one Error * variable instead of two Use &error_abort instead of separate assert() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-18Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.0-20200317' ↵Peter Maydell
into staging ppc patch queue 2020-03-17 Here's my final pull request for the qemu-5.0 soft freeze. Sorry this is just under the wire - I hit some last minute problems that took a while to fix up and retest. Highlights are: * Numerous fixes for the FWNMI feature * A handful of cleanups to the device tree construction code * Numerous fixes for the spapr-vscsi device * A number of fixes and cleanups for real mode (MMU off) softmmu handling * Fixes for handling of the PAPR RMA * Better handling of hotplug/unplug events during boot * Assorted other fixes # gpg: Signature made Tue 17 Mar 2020 09:55:07 GMT # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-5.0-20200317: (45 commits) pseries: Update SLOF firmware image ppc/spapr: Ignore common "ibm,nmi-interlock" Linux bug ppc/spapr: Implement FWNMI System Reset delivery target/ppc: allow ppc_cpu_do_system_reset to take an alternate vector ppc/spapr: Allow FWNMI on TCG ppc/spapr: Fix FWNMI machine check interrupt delivery ppc/spapr: Add FWNMI System Reset state ppc/spapr: Change FWNMI names ppc/spapr: Fix FWNMI machine check failure handling spapr: Rename DT functions to newer naming convention spapr: Move creation of ibm,architecture-vec-5 property spapr: Move creation of ibm,dynamic-reconfiguration-memory dt node spapr/rtas: Reserve space for RTAS blob and log pseries: Update SLOF firmware image ppc/spapr: Move GPRs setup to one place target/ppc: Fix rlwinm on ppc64 spapr/xive: use SPAPR_IRQ_IPI to define IPI ranges exposed to the guest hw/scsi/spapr_vscsi: Convert debug fprintf() to trace event hw/scsi/spapr_vscsi: Prevent buffer overflow hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-17hw/i386: Rename apicid_from_topo_ids to x86_apicid_from_topo_idsBabu Moger
For consistency rename apicid_from_topo_ids to x86_apicid_from_topo_ids. No functional change. Signed-off-by: Babu Moger <babu.moger@amd.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <158396720748.58170.5335409429390890145.stgit@naples-babu.amd.com>
2020-03-17hw/i386: Update structures to save the number of nodes per packageBabu Moger
Update structures X86CPUTopoIDs and CPUX86State to hold the number of nodes per package. This is required to build EPYC mode topology. Signed-off-by: Babu Moger <babu.moger@amd.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <158396720035.58170.1973738805301006456.stgit@naples-babu.amd.com>
2020-03-17hw/i386: Remove unnecessary initialization in x86_cpu_newBabu Moger
The function pc_cpu_pre_plug takes care of initialization of CPUX86State. So, remove the initialization here. Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Babu Moger <babu.moger@amd.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <158396719336.58170.11951852360759449871.stgit@naples-babu.amd.com>
2020-03-17machine: Add SMP Sockets in CpuTopologyBabu Moger
Store the smp sockets in CpuTopology. The socket information required to build the apic id in EPYC mode. Right now socket information is not passed to down when decoding the apic id. Add the socket information here. Signed-off-by: Babu Moger <babu.moger@amd.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <158396718647.58170.2278448323151215741.stgit@naples-babu.amd.com>
2020-03-17hw/i386: Introduce X86CPUTopoInfo to contain topology infoBabu Moger
This is an effort to re-arrange few data structure for better readability. 1. Add X86CPUTopoInfo which will have all the topology informations required to build the cpu topology. There is no functional changes. 2. Introduce init_topo_info to initialize X86CPUTopoInfo members from X86MachineState. 3. Update x86 unit tests for new calling convention with parameter X86CPUTopoInfo There is no functional changes. Signed-off-by: Babu Moger <babu.moger@amd.com> Message-Id: <158396717251.58170.4499717831243474938.stgit@naples-babu.amd.com>
2020-03-17cpu: Use DeviceClass reset instead of a special CPUClass resetPeter Maydell
The CPUClass has a 'reset' method. This is a legacy from when TYPE_CPU used not to inherit from TYPE_DEVICE. We don't need it any more, as we can simply use the TYPE_DEVICE reset. The 'cpu_reset()' function is kept as the API which most places use to reset a CPU; it is now a wrapper which calls device_cold_reset() and then the tracepoint function. This change should not cause CPU objects to be reset more often than they are at the moment, because: * nobody is directly calling device_cold_reset() or qdev_reset_all() on CPU objects * no CPU object is on a qbus, so they will not be reset either by somebody calling qbus_reset_all()/bus_cold_reset(), or by the main "reset sysbus and everything in the qbus tree" reset that most devices are reset by Note that this does not change the need for each machine or whatever to use qemu_register_reset() to arrange to call cpu_reset() -- that is necessary because CPU objects are not on any qbus, so they don't get reset when the qbus tree rooted at the sysbus bus is reset, and this isn't being changed here. All the changes to the files under target/ were made using the included Coccinelle script, except: (1) the deletion of the now-inaccurate and not terribly useful "CPUClass::reset" comments was done with a perl one-liner afterwards: perl -n -i -e '/ CPUClass::reset/ or print' target/*/*.c (2) this bit of the s390 change was done by hand, because the Coccinelle script is not sophisticated enough to handle the parent_reset call being inside another function: | @@ -96,8 +96,9 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type) | S390CPU *cpu = S390_CPU(s); | S390CPUClass *scc = S390_CPU_GET_CLASS(cpu); | CPUS390XState *env = &cpu->env; |+ DeviceState *dev = DEVICE(s); | |- scc->parent_reset(s); |+ scc->parent_reset(dev); | cpu->env.sigp_order = 0; | s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu); Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20200303100511.5498-1-peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-03-17machine/memory encryption: Disable mem mergeDr. David Alan Gilbert
When a host is running with memory encryption, the memory isn't visible to the host kernel; attempts to merge that memory are futile because what it's really comparing is encrypted memory, usually encrypted with different keys. Automatically turn mem-merge off when memory encryption is specified. https://bugzilla.redhat.com/show_bug.cgi?id=1796356 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20200130175046.85850-1-dgilbert@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-03-17hw/i386: Rename X86CPUTopoInfo structure to X86CPUTopoIDsBabu Moger
Rename few data structures related to X86 topology. X86CPUTopoIDs will have individual arch ids. Next patch introduces X86CPUTopoInfo which will have all topology information(like cores, threads etc..). Signed-off-by: Babu Moger <babu.moger@amd.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <158326541877.40452.17535023236841538507.stgit@naples-babu.amd.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-03-17Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* Bugfixes all over the place * get/set_uint cleanups (Felipe) * Lock guard support (Stefan) * MemoryRegion ownership cleanup (Philippe) * AVX512 optimization for buffer_is_zero (Robert) # gpg: Signature made Tue 17 Mar 2020 15:01:54 GMT # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (62 commits) hw/arm: Let devices own the MemoryRegion they create hw/arm: Remove unnecessary memory_region_set_readonly() on ROM alias hw/ppc/ppc405: Use memory_region_init_rom() with read-only regions hw/arm/stm32: Use memory_region_init_rom() with read-only regions hw/char: Let devices own the MemoryRegion they create hw/riscv: Let devices own the MemoryRegion they create hw/dma: Let devices own the MemoryRegion they create hw/display: Let devices own the MemoryRegion they create hw/core: Let devices own the MemoryRegion they create scripts/cocci: Patch to let devices own their MemoryRegions scripts/cocci: Patch to remove unnecessary memory_region_set_readonly() scripts/cocci: Patch to detect potential use of memory_region_init_rom hw/sparc: Use memory_region_init_rom() with read-only regions hw/sh4: Use memory_region_init_rom() with read-only regions hw/riscv: Use memory_region_init_rom() with read-only regions hw/ppc: Use memory_region_init_rom() with read-only regions hw/pci-host: Use memory_region_init_rom() with read-only regions hw/net: Use memory_region_init_rom() with read-only regions hw/m68k: Use memory_region_init_rom() with read-only regions hw/display: Use memory_region_init_rom() with read-only regions ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-17gdbstub: extend GByteArray to read register helpersAlex Bennée
Instead of passing a pointer to memory now just extend the GByteArray to all the read register helpers. They can then safely append their data through the normal way. We don't bother with this abstraction for write registers as we have already ensured the buffer being copied from is the correct size. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com> Message-Id: <20200316172155.971-15-alex.bennee@linaro.org>
2020-03-17hw/sd/ssi-sd: fix error handling in ssi_sd_realizeVladimir Sementsov-Ogievskiy
It's wrong to use same err object as errp parameter for several function calls without intermediate checking for error: we'll crash if try to set err object twice. Fix that. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20200317125741.15301-1-vsementsov@virtuozzo.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-03-17xen-block: Use one Error * variable instead of twoMarkus Armbruster
While there, tidy up indentation, and add return just for consistency and robustness. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200313170517.22480-4-armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> [The "while there" cleanups squashed in]
2020-03-17hw/ide: Remove unneeded inclusion of hw/ide.hBALATON Zoltan
After previous clean ups we can drop direct inclusion of hw/ide.h from several places. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: a3f72b663e537701c63cec5fc9cb8ed4f4249f28.1584457537.git.balaton@eik.bme.hu Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-17hw/ide: Move MAX_IDE_DEVS define to hw/ide/internal.hBALATON Zoltan
We can move this define now that less files use it to internal.h to further reduce dependency on hw/ide.h. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: e68675d2f6252f229cf788b7cd163bb76fa3e26b.1584457537.git.balaton@eik.bme.hu Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-17hw/ide: Do ide_drive_get() within pci_ide_create_devs()BALATON Zoltan
The pci_ide_create_devs() function takes a hd_table parameter but all callers just pass what ide_drive_get() returns so we can do it locally simplifying callers and removing hd_table parameter. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: e9713fdded4d212fa68ed03b844e531934226a6f.1584457537.git.balaton@eik.bme.hu Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-17hw/ide/pci.c: Coding style update to fix checkpatch errorsBALATON Zoltan
Spaces are required around a + operator and if statements should have braces even for single line. Also make it simpler by reversing the condition instead of breaking the loop. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 0d50336ab26a56240c8c17ca1ec6135a4092fcc9.1584457537.git.balaton@eik.bme.hu Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-17hw/ide: Remove now unneded #include "hw/pci/pci.h" from hw/ide.hBALATON Zoltan
After previous patches we don't need hw/pci/pci.h any more in hw/ide.h. Some files depended on implicit inclusion by this header which are also fixed up here. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 444a5e34331bf1f7880541b8d46e0353f470f5a6.1584457537.git.balaton@eik.bme.hu Signed-off-by: John Snow <jsnow@redhat.com>
2020-03-17hw/ide: Get rid of piix4_init functionBALATON Zoltan
This removes pci_piix4_ide_init() function similar to clean up done to other ide devices. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: fe46b6536abbae77695f6d1c711a04a3f4b5481d.1584457537.git.balaton@eik.bme.hu Signed-off-by: John Snow <jsnow@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-23 04:47:04 +0000