aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2017-06-22Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-06-09-v2' ↵Peter Maydell
into staging QAPI patches for 2017-06-09 # gpg: Signature made Tue 20 Jun 2017 13:31:39 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2017-06-09-v2: (41 commits) tests/qdict: check more get_try_int() cases console: use get_uint() for "head" property i386/cpu: use get_uint() for "min-level"/"min-xlevel" properties numa: use get_uint() for "size" property pnv-core: use get_uint() for "core-pir" property pvpanic: use get_uint() for "ioport" property auxbus: use get_uint() for "addr" property arm: use get_uint() for "mp-affinity" property xen: use get_uint() for "max-ram-below-4g" property pc: use get_uint() for "hpet-intcap" property pc: use get_uint() for "apic-id" property pc: use get_uint() for "iobase" property acpi: use get_uint() for "pci-hole*" properties acpi: use get_uint() for various acpi properties acpi: use get_uint() for "acpi-pcihp-io*" properties platform-bus: use get_uint() for "addr" property bcm2835_fb: use {get, set}_uint() for "vcram-size" and "vcram-base" aspeed: use {set, get}_uint() for "ram-size" property pcihp: use get_uint() for "bsel" property pc-dimm: make "size" property uint64 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-20Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc: fixes, cleanups, features Some fixes and cleanups. Extended TSEG sizes. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 16 Jun 2017 16:45:07 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: hw/i386: fix nvdimm check error path intel_iommu: cleanup vtd_interrupt_remap_msi() intel_iommu: cleanup vtd_{do_}iommu_translate() intel_iommu: switching the rest DPRINTF to trace tests/q35-test: add TSEG size checks tests/q35-test: push down qtest_start / qtest_end to test case(s) q35/mch: implement extended TSEG sizes Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-20Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* nbd and qemu-nbd fixes (Eric, Max) * nbd refactoring (Vladimir) * vhost-user-scsi, take N+1 (Felipe) * replace memory_region_set_fd with memory_region_init_ram_from_fd (Marc-André) * docs/ movement (Paolo) * megasas TOCTOU fixes (Paolo) * make async_safe_run_on_cpu work on kvm/hax accelerators (Paolo) * Build system and poison.h improvements (Thomas) * -accel thread=xxx fix (Thomas) * move files to accel/ (Yang Zhong) # gpg: Signature made Thu 15 Jun 2017 10:51:55 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (41 commits) vhost-user-scsi: Introduce a vhost-user-scsi sample application vhost-user-scsi: Introduce vhost-user-scsi host device qemu-doc: include version number docs: create interop/ subdirectory include/exec/poison: Mark some CONFIG defines as poisoned, too include/exec/poison: Add missing TARGET defines nbd/server: refactor nbd_trip nbd/server: rename rc to ret nbd/server: get rid of fail: return rc nbd/server: nbd_negotiate: fix error path nbd/server: remove NBDClientNewData nbd/server: refactor nbd_co_receive_request nbd/server: get rid of EAGAIN dead code nbd/server: refactor nbd_co_send_reply nbd/server: get rid of ssize_t nbd/server: get rid of nbd_negotiate_read and friends nbd: make nbd_drop public nbd: rename read_sync and friends accel: move kvm related accelerator files into accel/ tcg: move tcg backend files into accel/tcg/ ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-20pnv-core: use get_uint() for "core-pir" propertyMarc-André Lureau
This is an alias of TYPE_PNV_CORE's property "pir", which is defined with DEFINE_PROP_UINT32() Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-38-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20pvpanic: use get_uint() for "ioport" propertyMarc-André Lureau
TYPE_ISA_PVPANIC_DEVICE's property PVPANIC_IOPORT_PROP is defined with DEFINE_PROP_UINT16(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-37-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20auxbus: use get_uint() for "addr" propertyMarc-André Lureau
This is TYPE_MEMORY_REGION's property. Its getter memory_region_get_addr() uses visit_type_uint64(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-36-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20arm: use get_uint() for "mp-affinity" propertyMarc-André Lureau
TYPE_ARM_CPU's property "mp-affinity" is defined with DEFINE_PROP_UINT64(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-35-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20xen: use get_uint() for "max-ram-below-4g" propertyMarc-André Lureau
TYPE_PC_MACHINE's property PC_MACHINE_MAX_RAM_BELOW_4G's getter and setter pc_machine_get_max_ram_below_4g() and pc_machine_set_max_ram_below_4g() use visit_type_size() Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-34-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20pc: use get_uint() for "hpet-intcap" propertyMarc-André Lureau
TYPE_HPET's property HPET_INTCAP is defined with DEFINE_PROP_UINT32(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-33-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20pc: use get_uint() for "apic-id" propertyMarc-André Lureau
TYPE_X86_CPU's property "apic-id" is defined with DEFINE_PROP_UINT32(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-32-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20pc: use get_uint() for "iobase" propertyMarc-André Lureau
TYPE_ISA_FDC's property "iobase" is defined with DEFINE_PROP_UINT32(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-31-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20acpi: use get_uint() for "pci-hole*" propertiesMarc-André Lureau
Those properties use visit_type_uint*() Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-30-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20acpi: use get_uint() for various acpi propertiesMarc-André Lureau
PIIX4: piix4_pm_add_propeties() defines these with object_property_add_uint*_ptr(). Q35: ich9_lpc_add_properties() and ich9_pm_add_properties() define them similarly, except for ACPI_PM_PROP_GPE0_BLK(). That one's getter ich9_pm_get_gpe0_blk() uses visit_type_uint32(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-29-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20acpi: use get_uint() for "acpi-pcihp-io*" propertiesMarc-André Lureau
Those are defined with object_property_add_uint16_ptr() Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-28-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20platform-bus: use get_uint() for "addr" propertyMarc-André Lureau
This is TYPE_MEMORY_REGION's property. Its getter memory_region_get_addr() uses visit_type_uint64(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-27-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20bcm2835_fb: use {get, set}_uint() for "vcram-size" and "vcram-base"Marc-André Lureau
Both properties are defined with DEFINE_PROP_UINT32(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-26-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20aspeed: use {set, get}_uint() for "ram-size" propertyMarc-André Lureau
This property is an alias for device TYPE_ASPEED_SDMC's property "ram-size", which is defined with DEFINE_PROP_UINT64(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-25-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20pcihp: use get_uint() for "bsel" propertyMarc-André Lureau
The property is defined with object_property_add_uint32_ptr() Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-24-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20pc-dimm: make "size" property uint64Marc-André Lureau
This carries the memory_region_size() value without implicit cast. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-23-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20pc-dimm: use get_uint() for dimm propertiesMarc-André Lureau
TYPE_PC_DIMM's property PC_DIMM_ADDR_PROP is defined with DEFINE_PROP_UINT64(). TYPE_PC_DIMM's property PC_DIMM_NODE_PROP is defined with DEFINE_PROP_UINT32(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-22-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20qdev: Use appropriate getter/setters typeMarc-André Lureau
Based on the underlying type of the data accessed, use the appropriate getters/setters: * AcpiPmInfo members s3_disabled, s4_disabled are bool, member s4_val is an uint8_t * Property ACPI_PCIHP_IO_PROP is defined with object_property_add_uint32_ptr() * Property PCIE_HOST_MCFG_SIZE is implemented with visit_type_uint64() * PCIDevice property "addr" is backed by PCIDevice member devfn, which is an int32_t Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-20-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [More verbose commit message] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20apic-common: make "id" property a uint32Marc-André Lureau
The getter and setter of TYPE_APIC_COMMON property "id" are apic_common_get_id() and apic_common_set_id(). apic_common_get_id() reads either APICCommonState member uint32_t initial_apic_id or uint8_t id into an int64_t local variable. It then passes this variable to visit_type_int(). apic_common_set_id() uses visit_type_int() to read the value into a local variable, which it then assigns both to initial_apic_id and id. While the state backing the property is two unsigned members, 8 and 32 bits wide, the actual visitor is 64 bits signed. Change getter and setter to use visit_type_uint32(). Then everything's uint32_t, except for @id. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-19-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20qdev: avoid type casts between signed and unsignedMarc-André Lureau
Modify the unsigned type for various properties to use QNUM_U64, to avoid type casts. There are a few empty lines added to improve code reading/style. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-18-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Change to set_default_value_enum() dropped] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20qdev: wrap default property value in an unionMarc-André Lureau
Wrap the Property default value (an int64_t) in a union, to prepare for the next patch adding a uint64_t. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-17-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20qdev: Rename DEFINE_PROP_DEFAULT() to DEFINE_PROP_SIGNED()Marc-André Lureau
The rename prepares for the patch after next's DEFINE_PROP_UNSIGNED(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-16-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20object: use more specific property type namesMarc-André Lureau
Use the actual unsigned integer type name. The type name change impacts the following externally visible area: * vl.c's machine_help_func() puts it in help for -machine NAME,help. * QMP command qom-list exposes it in ObjectPropertyInfo member @type. * QMP command device-list-properties exposes it in DevicePropertyInfo member @type. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20170607163635.17635-15-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20q35: fix get_mmcfg_size to use uint64 visitorMarc-André Lureau
e->size is hwaddr, i.e. uint64_t. We silently truncate. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Suggested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20170607163635.17635-14-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20qapi: update the qobject visitor to use QNUM_U64Marc-André Lureau
Switch to use QNum/uint where appropriate to remove i64 limitation. The input visitor will cast i64 input to u64 for compatibility reasons (existing json QMP client already use negative i64 for large u64, and expect an implicit cast in qemu). Note: before the patch, uint64_t values above INT64_MAX are sent over json QMP as negative values, e.g. UINT64_MAX is sent as -1. After the patch, they are sent unmodified. Clearly a bug fix, but we have to consider compatibility issues anyway. libvirt should cope fine, because its parsing of unsigned integers accepts negative values modulo 2^64. There's hope that other clients will, too. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20170607163635.17635-12-marcandre.lureau@redhat.com> [check_native_list() tweaked for consistency with signed case] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-20qapi: merge QInt and QFloat in QNumMarc-André Lureau
We would like to use a same QObject type to represent numbers, whether they are int, uint, or floats. Getters will allow some compatibility between the various types if the number fits other representations. Add a few more tests while at it. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170607163635.17635-7-marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [parse_stats_intervals() simplified a bit, comment in test_visitor_in_int_overflow() tidied up, suppress bogus warnings] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-19Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20170614-1' into ↵Peter Maydell
staging usb: bugfixes for ehci and xhci # gpg: Signature made Wed 14 Jun 2017 08:44:01 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20170614-1: ehci: stop recursive calls to ehci_work_bh xhci: only update dequeue ptr on completed transfers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-19qdev: remove PropertyInfo.qtype fieldMarc-André Lureau
Remove dependency on qapi qtype, replace a field by a few PropertyInfo callbacks to set the default value type (introduced in commit 4f2d3d7). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20170607163635.17635-2-marcandre.lureau@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-06-16hw/i386: fix nvdimm check error pathStefan Hajnoczi
Commit e987c37aee1752177906847630d32477da57e705 ("hw/i386: check if nvdimm is enabled before plugging") introduced a check to reject nvdimm hotplug if -machine pc,nvdimm=on was not given. This check executes after pc_dimm_memory_plug() has already completed and does not reverse the effect of this function in the case of failure. Perform the check before calling pc_dimm_memory_plug(). This fixes the following abort: $ qemu -M accel=kvm -m 1G,slots=4,maxmem=8G \ -object memory-backend-file,id=mem1,share=on,mem-path=nvdimm.dat,size=1G (qemu) device_add nvdimm,memdev=mem1 nvdimm is not enabled: missing 'nvdimm' in '-M' (qemu) device_add nvdimm,memdev=mem1 Core dumped The backtrace is: #0 0x00007fffdb5b191f in raise () at /lib64/libc.so.6 #1 0x00007fffdb5b351a in abort () at /lib64/libc.so.6 #2 0x00007fffdb5a9da7 in __assert_fail_base () at /lib64/libc.so.6 #3 0x00007fffdb5a9e52 in () at /lib64/libc.so.6 #4 0x000055555577a5fa in qemu_ram_set_idstr (new_block=0x555556747a00, name=<optimized out>, dev=dev@entry=0x555556705590) at qemu/exec.c:1709 #5 0x0000555555a0fe86 in vmstate_register_ram (mr=mr@entry=0x55555673a0e0, dev=dev@entry=0x555556705590) at migration/savevm.c:2293 #6 0x0000555555965088 in pc_dimm_memory_plug (dev=dev@entry=0x555556705590, hpms=hpms@entry=0x5555566bb0e0, mr=mr@entry=0x555556705630, align=<optimized out>, errp=errp@entry=0x7fffffffc660) at hw/mem/pc-dimm.c:110 #7 0x000055555581d89b in pc_dimm_plug (errp=0x7fffffffc6c0, dev=0x555556705590, hotplug_dev=<optimized out>) at qemu/hw/i386/pc.c:1713 #8 0x000055555581d89b in pc_machine_device_plug_cb (hotplug_dev=<optimized out>, dev=0x555556705590, errp=0x7fffffffc6c0) at qemu/hw/i386/pc.c:2004 #9 0x0000555555914da6 in device_set_realized (obj=<optimized out>, value=<optimized out>, errp=0x7fffffffc7e8) at hw/core/qdev.c:926 Cc: Haozhong Zhang <haozhong.zhang@intel.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Haozhong Zhang <haozhong.zhang@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-16intel_iommu: cleanup vtd_interrupt_remap_msi()Peter Xu
Move the memcpy upper into where needed, then share the trace so that we trace every correct remapping. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-16intel_iommu: cleanup vtd_{do_}iommu_translate()Peter Xu
First, let vtd_do_iommu_translate() return a status, so that we explicitly knows whether error occured. Meanwhile, we make sure that IOMMUTLBEntry is filled in in that. Then, cleanup vtd_iommu_translate a bit. So even with PT we'll get a log now. Also, remove useless assignments. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-16intel_iommu: switching the rest DPRINTF to tracePeter Xu
We have converted many of the DPRINTF() into traces. This patch does the last 100+ ones. To debug VT-d when error happens, let's try enable: -trace enable="vtd_err*" This should works just like the old GENERAL but of course better, since we don't need to recompile. Similar rules apply to the other modules. I was trying to make the prefix good enough for sub-module debugging. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-16q35/mch: implement extended TSEG sizesLaszlo Ersek
The q35 machine type currently lets the guest firmware select a 1MB, 2MB or 8MB TSEG (basically, SMRAM) size. In edk2/OVMF, we use 8MB, but even that is not enough when a lot of VCPUs (more than approx. 224) are configured -- SMRAM footprint scales largely proportionally with VCPU count. Introduce a new property for "mch" called "extended-tseg-mbytes", which expresses (in megabytes) the user's choice of TSEG (SMRAM) size. Invent a new, QEMU-specific register in the config space of the DRAM Controller, at offset 0x50, in order to allow guest firmware to query the TSEG (SMRAM) size. According to Intel Document Number 316966-002, Table 5-1 "DRAM Controller Register Address Map (D0:F0)": Warning: Address locations that are not listed are considered Intel Reserved registers locations. Reads to Reserved registers may return non-zero values. Writes to reserved locations may cause system failures. All registers that are defined in the PCI 2.3 specification, but are not necessary or implemented in this component are simply not included in this document. The reserved/unimplemented space in the PCI configuration header space is not documented as such in this summary. Offsets 0x50 and 0x51 are not listed in Table 5-1. They are also not part of the standard PCI config space header. And they precede the capability list as well, which starts at 0xe0 for this device. When the guest writes value 0xffff to this register, the value that can be read back is that of "mch.extended-tseg-mbytes" -- unless it remains 0xffff. The guest is required to write 0xffff first (as opposed to a read-only register) because PCI config space is generally not cleared on QEMU reset, and after S3 resume or reboot, new guest firmware running on old QEMU could read a guest OS-injected value from this register. After reading the available "extended" TSEG size, the guest firmware may actually request that TSEG size by writing pattern 11b to the ESMRAMC register's TSEG_SZ bit-field. (The Intel spec referenced above defines only patterns 00b (1MB), 01b (2MB) and 10b (8MB); 11b is reserved.) On the QEMU command line, the value can be set with -global mch.extended-tseg-mbytes=N The default value for 2.10+ q35 machine types is 16. The value is limited to 0xfff (4095) at the moment, purely so that the product (4095 MB) can be stored to the uint32_t variable "tseg_size" in mch_update_smram(). Users are responsible for choosing sensible TSEG sizes. On 2.9 and earlier q35 machine types, the default value is 0. This lets the 11b bit pattern in ESMRAMC.TSEG_SZ, and the register at offset 0x50, keep their original behavior. When "extended-tseg-mbytes" is nonzero, the new register at offset 0x50 is set to that value on reset, for completeness. PCI config space is migrated automatically, so no VMSD changes are necessary. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1447027 Ref: https://lists.01.org/pipermail/edk2-devel/2017-May/010456.html Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-15vhost-user-scsi: Introduce vhost-user-scsi host deviceFelipe Franciosi
This commit introduces a vhost-user device for SCSI. This is based on the existing vhost-scsi implementation, but done over vhost-user instead. It also uses a chardev to connect to the backend. Unlike vhost-scsi (today), VMs using vhost-user-scsi can be live migrated. To use it, start Qemu with a command line equivalent to: qemu-system-x86_64 \ -chardev socket,id=vus0,path=/tmp/vus.sock \ -device vhost-user-scsi-pci,chardev=vus0,bus=pci.0,addr=... A separate commit presents a sample application linked with libiscsi to provide a backend for vhost-user-scsi. Signed-off-by: Felipe Franciosi <felipe@nutanix.com> Message-Id: <1488479153-21203-4-git-send-email-felipe@nutanix.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: always store SCSIRequest* into MegasasCmdPaolo Bonzini
This ensures that the request is unref'ed properly, and avoids a segmentation fault in the new qtest testcase that is added. This is CVE-2017-9503. Reported-by: Zhangyanyu <zyy4013@stu.ouc.edu.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read SCSI req parameters more than once from framePaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read command more than once from framePaolo Bonzini
Avoid TOC-TOU bugs by passing the frame_cmd down, and checking cmd->dcmd_opcode instead of cmd->frame->header.frame_cmd. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read DCMD opcode more than once from framePaolo Bonzini
Avoid TOC-TOU bugs by storing the DCMD opcode in the MegasasCmd Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read iovec count more than once from framePaolo Bonzini
Avoid TOC-TOU bugs depending on how the compiler behaves. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read sense length more than once from framePaolo Bonzini
Avoid TOC-TOU bugs depending on how the compiler behaves. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15ivshmem: use ram_from_fd()Marc-André Lureau
Instead of having its own mmap handling code, reuse the code from exec.c. Note: memory_region_init_ram_from_fd() adds some restrictions (check for xen, kvm sync-mmu, etc) and changes (such as size alignment). This may actually be more correct. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20170602141229.15326-6-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-13hw/intc/arm_gicv3_its: Allow save/restoreEric Auger
We change the restoration priority of both the GICv3 and ITS. The GICv3 must be restored before the ITS and the ITS needs to be restored before PCIe devices since it translates their MSI transactions. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-id: 1497023553-18411-5-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-13hw/intc/arm_gicv3_kvm: Implement pending table saveEric Auger
This patch adds the flush of the LPI pending bits into the redistributor pending tables. This happens on VM stop. There is no explicit restore as the tables are implicitly sync'ed on ITS table restore and on LPI enable at redistributor level. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 1497023553-18411-4-git-send-email-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-13hw/intc/arm_gicv3_its: Implement state save/restoreEric Auger
We need to handle both registers and ITS tables. While register handling is standard, ITS table handling is more challenging since the kernel API is devised so that the tables are flushed into guest RAM and not in vmstate buffers. Flushing the ITS tables on device pre_save() is too late since the guest RAM is already saved at this point. Table flushing needs to happen when we are sure the vcpus are stopped and before the last dirty page saving. The right point is RUN_STATE_FINISH_MIGRATE but sometimes the VM gets stopped before migration launch so let's simply flush the tables each time the VM gets stopped. For regular ITS registers we just can use vmstate pre_save() and post_load() callbacks. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-13kvm-all: Pass an error object to kvm_device_accessEric Auger
In some circumstances, we don't want to abort if the kvm_device_access fails. This will be the case during ITS migration, in case the ITS table save/restore fails because the guest did not program the vITS correctly. So let's pass an error object to the function and return the ioctl value. New callers will be able to make a decision upon this returned value. Existing callers pass &error_abort which will cause the function to abort on failure. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Message-id: 1497023553-18411-2-git-send-email-eric.auger@redhat.com [PMM: wrapped long line] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-13timer/aspeed: fix timer enablement when a reload is not setCédric Le Goater
When a timer is enabled before a reload value is set, the controller waits for a reload value to be set before starting decrementing. This fix tries to cover that case by changing the timer expiry only when a reload value is valid. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1496739312-32304-1-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-13aspeed: add a temp sensor device on I2C bus 3Cédric Le Goater
Temperatures can be changed from the monitor with : (qemu) qom-set /machine/unattached/device[2] temperature0 12000 Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1496739230-32109-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-08 00:13:47 +0000