aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2021-05-10virtio-gpu: move virtio-gpu-gl-device to separate moduleGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-12-kraxel@redhat.com>
2021-05-10virtio-gpu: drop VIRGL() macroGerd Hoffmann
Drops last virgl/opengl dependency from virtio-gpu-device. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-11-kraxel@redhat.com>
2021-05-10virtio-gpu: move update_cursor_dataGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-10-kraxel@redhat.com>
2021-05-10virtio-gpu: move virgl process_cmdGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-9-kraxel@redhat.com>
2021-05-10virtio-gpu: move virgl gl_flushedGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-8-kraxel@redhat.com>
2021-05-10virtio-gpu: move virgl handle_ctrlGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-7-kraxel@redhat.com>
2021-05-10virtio-gpu: use class function for ctrl queue handlersGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-6-kraxel@redhat.com>
2021-05-10virtio-gpu: move virgl resetGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-5-kraxel@redhat.com>
2021-05-10virtio-gpu: move virgl realize + propertiesGerd Hoffmann
Move device init (realize) and properties. Drop the virgl property, the virtio-gpu-gl-device has virgl enabled no matter what. Just use virtio-gpu-device instead if you don't want enable virgl and opengl. This simplifies the logic and reduces the test matrix. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-4-kraxel@redhat.com>
2021-05-10virtio-gpu: add virtio-gpu-gl-deviceGerd Hoffmann
Just a skeleton for starters, following patches will add more code. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-3-kraxel@redhat.com>
2021-05-10virtio-gpu: rename virgl source file.Gerd Hoffmann
"3d" -> "virgl" as 3d is a rather broad term. Hopefully a bit less confusing. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-2-kraxel@redhat.com>
2021-05-10virtio-gpu: handle partial maps properlyGerd Hoffmann
dma_memory_map() may map only a part of the request. Happens if the request can't be mapped in one go, for example due to a iommu creating a linear dma mapping for scattered physical pages. Should that be the case virtio-gpu must call dma_memory_map() again with the remaining range instead of simply throwing an error. Note that this change implies the number of iov entries may differ from the number of mapping entries sent by the guest. Therefore the iov_len bookkeeping needs some updates too, we have to explicitly pass around the iov length now. Reported-by: Auger Eric <eric.auger@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210506091001.1301250-1-kraxel@redhat.com Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Message-Id: <20210506091001.1301250-1-kraxel@redhat.com>
2021-05-10Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20210505' ↵Peter Maydell
into staging qemu-sparc queue # gpg: Signature made Wed 05 May 2021 08:29:13 BST # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-20210505: hw/sparc*: Move cpu_check_irqs() to target/sparc/ hw/sparc64: Fix code style for checkpatch.pl hw/sparc64: Remove unused "hw/char/serial.h" header hw/sparc: Allow building without the leon3 machine hw/sparc/sun4m: Move each sun4m_hwdef definition in its class_init hw/sparc/sun4m: Fix code style for checkpatch.pl hw/sparc/sun4m: Register machine types in sun4m_machine_types[] hw/sparc/sun4m: Factor out sun4m_machine_class_init() hw/sparc/sun4m: Introduce Sun4mMachineClass hw/sparc/sun4m: Have sun4m machines inherit new TYPE_SUN4M_MACHINE Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-05-10edid: add support for DisplayID extension (5k resolution)Konstantin Nazarov
The Detailed Timing Descriptor has only 12 bits to store the resolution. This limits the guest to 4095 pixels. This patch adds support for the DisplayID extension, that has 2 full bytes for that purpose, thus allowing 5k resolutions and above. Based-on: <20210303152948.59943-2-akihiko.odaki@gmail.com> Signed-off-by: Konstantin Nazarov <mail@knazarov.com> Message-Id: <20210315114639.91953-3-mail@knazarov.com> [ kraxel: minor workflow tweaks ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210427150824.638359-1-kraxel@redhat.com Message-Id: <20210427150824.638359-9-kraxel@redhat.com>
2021-05-10edid: allow arbitrary-length checksumsKonstantin Nazarov
Some of the EDID extensions like DisplayID do checksums of their subsections. Currently checksums can be only applied to the whole extension blocks which are 128 bytes. This patch allows to checksum arbitrary parts of EDID, and not only whole extension blocks. Based-on: <20210303152948.59943-2-akihiko.odaki@gmail.com> Signed-off-by: Konstantin Nazarov <mail@knazarov.com> Message-Id: <20210315114639.91953-2-mail@knazarov.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210427150824.638359-1-kraxel@redhat.com Message-Id: <20210427150824.638359-8-kraxel@redhat.com>
2021-05-10edid: move timing generation into a separate functionKonstantin Nazarov
The timing generation is currently performed inside the function that fills in the DTD. The DisplayID generation needs it as well, so moving it out to a separate function. Based-on: <20210303152948.59943-2-akihiko.odaki@gmail.com> Signed-off-by: Konstantin Nazarov <mail@knazarov.com> Message-Id: <20210315114639.91953-1-mail@knazarov.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210427150824.638359-1-kraxel@redhat.com Message-Id: <20210427150824.638359-7-kraxel@redhat.com>
2021-05-10edid: Make refresh rate configurableAkihiko Odaki
Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210427150824.638359-1-kraxel@redhat.com Message-Id: <20210427150824.638359-6-kraxel@redhat.com>
2021-05-10edid: use dta extension block descriptorsGerd Hoffmann
When the 4 descriptors in the base edid block are filled, jump to the dta extension block. This allows for more than four descriptors. Happens for example when generating an edid blob with a serial number (qemu-edid -s $serial). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20210427150824.638359-1-kraxel@redhat.com Message-Id: <20210427150824.638359-5-kraxel@redhat.com>
2021-05-10edid: move xtra3 descriptorGerd Hoffmann
Initialize the "Established timings III" block earlier. Also move up edid_fill_modes(). That'll make sure the offset for the additional descriptors in the dta block don't move any more, which in turn makes it easier to actually use them. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20210427150824.638359-1-kraxel@redhat.com Message-Id: <20210427150824.638359-4-kraxel@redhat.com>
2021-05-10edid: edid_desc_nextGerd Hoffmann
Add helper function to find the next free desc block. Needed when we start to use the dta descriptor entries. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20210427150824.638359-1-kraxel@redhat.com Message-Id: <20210427150824.638359-3-kraxel@redhat.com>
2021-05-05Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.1-20210504' ↵Peter Maydell
into staging ppc patch queue 2021-05-04 Here's the first ppc pull request for qemu-6.1. It has a wide variety of stuff accumulated during the 6.0 freeze. Highlights are: * Multi-phase reset cleanups for PAPR * Preliminary cleanups towards allowing !CONFIG_TCG for the ppc target * Cleanup of AIL logic and extension to POWER10 * Further improvements to handling of hot unplug failures on PAPR * Allow much larger numbers of CPU on pseries * Support for the H_SCM_HEALTH hypercall * Add support for the Pegasos II board * Substantial cleanup to hflag handling * Assorted minor fixes and cleanups # gpg: Signature made Tue 04 May 2021 06:52:39 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-6.1-20210504: (46 commits) hw/ppc/pnv_psi: Use device_cold_reset() instead of device_legacy_reset() hw/ppc/spapr_vio: Reset TCE table object with device_cold_reset() hw/intc/spapr_xive: Use device_cold_reset() instead of device_legacy_reset() target/ppc: removed VSCR from SPR registration target/ppc: Reduce the size of ppc_spr_t target/ppc: Clean up _spr_register et al target/ppc: Add POWER10 exception model target/ppc: rework AIL logic in interrupt delivery target/ppc: move opcode table logic to translate.c target/ppc: code motion from translate_init.c.inc to gdbstub.c spapr_drc.c: handle hotunplug errors in drc_unisolate_logical() spapr.h: increase FDT_MAX_SIZE spapr.c: do not use MachineClass::max_cpus to limit CPUs ppc: Rename current DAWR macros and variables target/ppc: POWER10 supports scv target/ppc: Fix POWER9 radix guest HV interrupt AIL behaviour docs/system: ppc: Add documentation for ppce500 machine roms/u-boot: Bump ppce500 u-boot to v2021.04 to fix broken pci support roms/Makefile: Update ppce500 u-boot build directory name ppc/spapr: Add support for implement support for H_SCM_HEALTH ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-05-05usb: limit combined packets to 1 MiB (CVE-2021-3527)Gerd Hoffmann
usb-host and usb-redirect try to batch bulk transfers by combining many small usb packets into a single, large transfer request, to reduce the overhead and improve performance. This patch adds a size limit of 1 MiB for those combined packets to restrict the host resources the guest can bind that way. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20210503132915.2335822-6-kraxel@redhat.com>
2021-05-05Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/trivial-branch-for-6.1-pull-request' into staging Trivial patches pull request 20210503 # gpg: Signature made Mon 03 May 2021 09:34:56 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-for-6.1-pull-request: (23 commits) hw/rx/rx-gdbsim: Do not accept invalid memory size docs: More precisely describe memory-backend-*::id's user scripts: fix generation update-binfmts templates docs/system: Document the removal of "compat" property for POWER CPUs mc146818rtc: put it into the 'misc' category Do not include exec/address-spaces.h if it's not really necessary Do not include cpu.h if it's not really necessary Do not include hw/boards.h if it's not really necessary Do not include sysemu/sysemu.h if it's not really necessary hw: Do not include qemu/log.h if it is not necessary hw: Do not include hw/irq.h if it is not necessary hw: Do not include hw/sysbus.h if it is not necessary hw: Remove superfluous includes of hw/hw.h ui: Fix memory leak in qemu_xkeymap_mapping_table() hw/usb: Constify VMStateDescription hw/display/qxl: Constify VMStateDescription hw/arm: Constify VMStateDescription vmstate: Constify some VMStateDescriptions Fix typo in CFI build documentation hw/pcmcia: Do not register PCMCIA type if not required ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-05-04hw/sparc*: Move cpu_check_irqs() to target/sparc/Philippe Mathieu-Daudé
Since cpu_check_irqs() doesn't reference to anything outside of CPUSPARCState, it better belongs to the architectural code in target/, rather than the hardware specific code in hw/. Note: while we moved the trace events, we don't rename them. Remark: this allows us to build the leon3 machine stand alone, fixing this link failure (because cpu_check_irqs is defined in hw/sparc/sun4m.c which is only built when CONFIG_SUN4M is selected): /usr/bin/ld: target_sparc_win_helper.c.o: in function `cpu_put_psr': target/sparc/win_helper.c:91: undefined reference to `cpu_check_irqs' Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210428141655.387430-5-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc64: Fix code style for checkpatch.plPhilippe Mathieu-Daudé
We are going to move this code, fix its style first. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210428141655.387430-4-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc64: Remove unused "hw/char/serial.h" headerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210428141655.387430-3-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc: Allow building without the leon3 machinePhilippe Mathieu-Daudé
When building without the leon3 machine, we get this link failure: /usr/bin/ld: target_sparc_int32_helper.c.o: in function `leon3_irq_manager': target/sparc/int32_helper.c:172: undefined reference to `leon3_irq_ack' This is because the leon3_irq_ack() is declared in hw/sparc/leon3.c, which is only build when CONFIG_LEON3 is selected. Fix by moving the leon3_cache_control_int() / leon3_irq_manager() (which are specific to the leon3 machine) to hw/sparc/leon3.c. Move the trace events along (but don't rename them). leon3_irq_ack() is now locally used, declare it static to reduce its scope. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com> Tested-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210428141655.387430-2-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc/sun4m: Move each sun4m_hwdef definition in its class_initPhilippe Mathieu-Daudé
Remove the sun4m_hwdefs[] array by moving assigning the structure fields directly in each machine class_init() function. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210503171303.822501-7-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc/sun4m: Fix code style for checkpatch.plPhilippe Mathieu-Daudé
We are going to move this code, fix its style first. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210503171303.822501-6-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc/sun4m: Register machine types in sun4m_machine_types[]Philippe Mathieu-Daudé
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210503171303.822501-5-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc/sun4m: Factor out sun4m_machine_class_init()Philippe Mathieu-Daudé
Factor out the class_init code common to all machines to sun4m_machine_class_init(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210503171303.822501-4-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc/sun4m: Introduce Sun4mMachineClassPhilippe Mathieu-Daudé
Instead of passing the sun4m_hwdef structure via machine_init(), store it into the MachineClass. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210503171303.822501-3-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04hw/sparc/sun4m: Have sun4m machines inherit new TYPE_SUN4M_MACHINEPhilippe Mathieu-Daudé
Introduce the TYPE_SUN4M_MACHINE and have all sun4m machines inherit it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210503171303.822501-2-f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-05-04Merge remote-tracking branch 'remotes/legoater/tags/pull-aspeed-20210503' ↵Peter Maydell
into staging Aspeed patches : * Fixes for the DMA space * New model for ASPEED's Hash and Crypto Engine (Joel and Klaus) * Acceptance tests (Joel) * A fix for the XDMA model * Some extra features for the SMC controller. * Two new boards : rainier-bmc and quanta-q7l1-bmc (Patrick) # gpg: Signature made Mon 03 May 2021 06:23:36 BST # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * remotes/legoater/tags/pull-aspeed-20210503: aspeed: Add support for the quanta-q7l1-bmc board hw/block: m25p80: Add support for mt25ql02g and mt25qu02g aspeed: Add support for the rainier-bmc board aspeed: Deprecate the swift-bmc machine tests/qtest: Rename m25p80 test in aspeed_smc test aspeed/smc: Add extra controls to request DMA aspeed/smc: Add a 'features' attribute to the object class hw/misc/aspeed_xdma: Add AST2600 support tests/acceptance: Test ast2600 machine tests/acceptance: Test ast2400 and ast2500 machines tests/qtest: Add test for Aspeed HACE aspeed: Integrate HACE hw: Model ASPEED's Hash and Crypto Engine hw/arm/aspeed: Do not sysbus-map mmio flash region directly, use alias aspeed/i2c: Rename DMA address space aspeed/i2c: Fix DMA address mask aspeed/smc: Remove unused "sdram-base" property aspeed/smc: Use the RAM memory region for DMAs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-05-04x86: acpi: use offset instead of pointer when using build_header()Igor Mammedov
Do the same as in commit (4d027afeb3a97 Virt: ACPI: fix qemu assert due to re-assigned table data address) for remaining tables that happen to use saved at the beginning pointer to build header to avoid assert when table_data is relocated due to implicit re-size. In this case user is trying to start Windows 10 and getting assert at hw/acpi/bios-linker-loader.c:239: bios_linker_loader_add_checksum: Assertion `start_offset < file->blob->len' failed. Fixes: https://bugs.launchpad.net/bugs/1923497 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20210414084356.3792113-1-imammedo@redhat.com> Cc: mst@redhat.com, qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-05-04amd_iommu: Fix pte_override_page_mask()Jean-Philippe Brucker
AMD IOMMU PTEs have a special mode allowing to specify an arbitrary page size. Quoting the AMD IOMMU specification: "When the Next Level bits [of a pte] are 7h, the size of the page is determined by the first zero bit in the page address, starting from bit 12." So if the lowest bits of the page address is 0, the page is 8kB. If the lowest bits are 011, the page is 32kB. Currently pte_override_page_mask() doesn't compute the right value for this page size and amdvi_translate() can return the wrong guest-physical address. With a Linux guest, DMA from SATA devices accesses the wrong memory and causes probe failure: qemu-system-x86_64 ... -device amd-iommu -drive id=hd1,file=foo.bin,if=none \ -device ahci,id=ahci -device ide-hd,drive=hd1,bus=ahci.0 [ 6.613093] ata1.00: qc timeout (cmd 0xec) [ 6.615062] ata1.00: failed to IDENTIFY (I/O error, err_mask=0x4) Fix the page mask. Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-Id: <20210421084007.1190546-1-jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-05-04usb/mtp: avoid dynamic stack allocationGerd Hoffmann
Use autofree heap allocation instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210503132915.2335822-4-kraxel@redhat.com>
2021-05-04usb/redir: avoid dynamic stack allocation (CVE-2021-3527)Gerd Hoffmann
Use autofree heap allocation instead. Fixes: 4f4321c11ff ("usb: use iovecs in USBPacket") Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210503132915.2335822-3-kraxel@redhat.com>
2021-05-04usb/hid: avoid dynamic stack allocationGerd Hoffmann
Use autofree heap allocation instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210503132915.2335822-2-kraxel@redhat.com>
2021-05-04hw/usb: Do not build USB subsystem if not requiredPhilippe Mathieu-Daudé
If the Kconfig 'USB' value is not selected, it is pointless to build the USB core components. Add a stub for the HMP commands and usbdevice_create() which is called by usb_device_add in softmmu/vl.c. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210424224110.3442424-3-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-04hw/usb/host-stub: Remove unused headerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210424224110.3442424-2-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-04hw/ppc/pnv_psi: Use device_cold_reset() instead of device_legacy_reset()Peter Maydell
The pnv_psi.c code uses device_legacy_reset() for two purposes: * to reset itself from its qemu_register_reset() handler * to reset a XiveSource object it has Neither it nor the XiveSource have any qbuses, so the new device_cold_reset() function (which resets both the device and its child buses) is equivalent here to device_legacy_reset() and we can just switch to the new API. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210503151849.8766-4-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04hw/ppc/spapr_vio: Reset TCE table object with device_cold_reset()Peter Maydell
The spapr_vio_quiesce_one() function resets the TCE table object (TYPE_SPAPR_TCE_TABLE) via device_legacy_reset(). We know that objects of that type do not have a qbus of their own, so the new device_cold_reset() function (which resets both the device and its child buses) is equivalent here to device_legacy_reset() and we can just switch to the new API. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210503151849.8766-3-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04hw/intc/spapr_xive: Use device_cold_reset() instead of device_legacy_reset()Peter Maydell
The h_int_reset() function resets the XIVE interrupt controller via device_legacy_reset(). We know that the interrupt controller does not have a qbus of its own, so the new device_cold_reset() function (which resets both the device and its child buses) is equivalent here to device_legacy_reset() and we can just switch to the new API. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210503151849.8766-2-peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04target/ppc: Add POWER10 exception modelNicholas Piggin
POWER10 adds a new bit that modifies interrupt behaviour, LPCR[HAIL], and it removes support for the LPCR[AIL]=0b10 mode. Reviewed-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20210501072436.145444-3-npiggin@gmail.com> [dwg: Corrected tab indenting] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04target/ppc: rework AIL logic in interrupt deliveryNicholas Piggin
The AIL logic is becoming unmanageable spread all over powerpc_excp(), and it is slated to get even worse with POWER10 support. Move it all to a new helper function. Reviewed-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20210501072436.145444-2-npiggin@gmail.com> [dwg: Corrected tab indenting] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04spapr_drc.c: handle hotunplug errors in drc_unisolate_logical()Daniel Henrique Barboza
At this moment, PAPR does not provide a way to report errors during a device removal operation. This led the pSeries machine to implement extra mechanisms to try to fallback and recover from an error that might have happened during the hotunplug in the guest side. This started to change a bit with commit fe1831eff8a4 ("spapr_drc.c: use DRC reconfiguration to cleanup DIMM unplug state"), where one way to fallback from a memory removal error was introduced. Around the same time, in [1], the idea of using RTAS set-indicator for this role was first introduced. The RTAS set-indicator call, when attempting to UNISOLATE a DRC that is already UNISOLATED or CONFIGURED, returns RTAS_OK and does nothing else for both QEMU and phyp. This gives us an opportunity to use this behavior to signal the hypervisor layer when a device removal errir happens, allowing QEMU/phyp to do a proper error handling. Using set-indicator to report HP errors isn't strange to PAPR, as per R1-13.5.3.4-4. of table 13.7 of current PAPR [2]: "For all DR options: If this is a DR operation that involves the user insert- ing a DR entity, then if the firmware can determine that the inserted entity would cause a system disturbance, then the set-indicator RTAS call must not unisolate the entity and must return an error status which is unique to the particular error." A change was proposed to the pSeries Linux kernel to call set-indicator to move a DRC to 'unisolate' in the case of a hotunplug error in the guest side [3]. Setting a DRC that is already unisolated or configured to 'unisolate' is a no-op (returns RTAS_OK) for QEMU and also for phyp. Being a benign change for hypervisors that doesn't care about handling such errors, we expect the kernel to accept this change at some point. This patch prepares the pSeries machine for this new kernel feature by changing drc_unisolate_logical() to handle guest side hotunplug errors. For CPUs it's a simple matter of setting drc->unplug_requested to 'false', while for LMBs the process is similar to the rollback that is done in rtas_ibm_configure_connector(). [1] https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg06395.html [2] https://openpowerfoundation.org/wp-content/uploads/2020/07/LoPAR-20200611.pdf [3] https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20210416210216.380291-3-danielhb413@gmail.com/ Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20210420165100.108368-2-danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04spapr.c: do not use MachineClass::max_cpus to limit CPUsDaniel Henrique Barboza
Up to this patch, 'max_cpus' value is hardcoded to 1024 (commit 6244bb7e5811). In theory this patch would simply bump it to 2048, since it's the default NR_CPUS kernel setting for ppc64 servers nowadays, but the whole mechanic of MachineClass:max_cpus is flawed for the pSeries machine. The two supported accelerators, KVM and TCG, can live without it. TCG guests don't have a theoretical limit. The user must be free to emulate as many CPUs as the hardware is capable of. And even if there were a limit, max_cpus is not the proper way to report it since it's a common value checked by SMP code in machine_smp_parse() for KVM as well. For KVM guests, the proper way to limit KVM CPUs is by host configuration via NR_CPUS, not a QEMU hardcoded value. There is no technical reason for a pSeries QEMU guest to forcefully stay below NR_CPUS. This hardcoded value also disregard hosts that might have a lower NR_CPUS limit, say 512. In this case, machine.c:machine_smp_parse() will allow a 1024 value to pass, but then kvm_init() will complain about it because it will exceed NR_CPUS: Number of SMP cpus requested (1024) exceeds the maximum cpus supported by KVM (512) A better 'max_cpus' value would consider host settings, but MachineClass::max_cpus is defined well before machine_init() and kvm_init(). We can't check for KVM limits because it's too soon, so we end up making a guess. This patch makes MachineClass:max_cpus settings innocuous by setting it to INT32_MAX. machine.c:machine_smp_parse() will not fail the verification based on max_cpus, letting kvm_init() do the checking with actual host settings. And TCG guests get to do whatever the hardware is capable of emulating. Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20210408204049.221802-2-danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04ppc/spapr: Add support for implement support for H_SCM_HEALTHVaibhav Jain
Add support for H_SCM_HEALTH hcall described at [1] for spapr nvdimms. This enables guest to detect the 'unarmed' status of a specific spapr nvdimm identified by its DRC and if its unarmed, mark the region backed by the nvdimm as read-only. The patch adds h_scm_health() to handle the H_SCM_HEALTH hcall which returns two 64-bit bitmaps (health bitmap, health bitmap mask) derived from 'struct nvdimm->unarmed' member. Linux kernel side changes to enable handling of 'unarmed' nvdimms for ppc64 are proposed at [2]. References: [1] "Hypercall Op-codes (hcalls)" https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/powerpc/papr_hcalls.rst#n220 [2] "powerpc/papr_scm: Mark nvdimm as unarmed if needed during probe" https://lore.kernel.org/linux-nvdimm/20210329113103.476760-1-vaibhav@linux.ibm.com/ Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com> Message-Id: <20210402102128.213943-1-vaibhav@linux.ibm.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04spapr: Rename RTAS_MAX_ADDR to FDT_MAX_ADDRAlexey Kardashevskiy
SLOF instantiates RTAS since 744a928ccee9 ("spapr: Stop providing RTAS blob") so the max address applies to the FDT only. This renames the macro and fixes up the comment. This should not cause any behavioral change. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-Id: <20210331025123.29310-1-aik@ozlabs.ru> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>