aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2022-09-18spapr_pci: fix leak in spapr_phb_vfio_get_loc_codePaolo Bonzini
Overwriting "path" in the second call to g_strdup_printf() causes a memory leak, even if the variable itself is g_autofree. Reported by Coverity as CID 1460454. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-09-17Merge tag 'pull-arm-20220914' of https://gitlab.com/rth7680/qemu into stagingStefan Hajnoczi
Add cortex-a35. Fix bcm2835 framebuffer for rpi firmware. Add FEAT_ETS. Add FEAT_PMUv3p5. Cleanups to armv7m_load_kernel. # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmMhwAsdHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/7Xgf9Ezg+etwsEzY0EWtH # yoQ7ymJHM1VKqtLkbk9U+Ju18YHEi3fwbYbfLgzkAMFHKDUteKJivKm2w41tsw5g # lE+5PojQT3k8PffaqeFzKG/JsDPoqKtTa23WjkafbIQAbjRT8JtmF/JmSLaaxyqW # DozPXJ9jXMS+Q2BxHnoCBuy/Kb3zsqekCr8DOgUIXY5gcAB6q1I8SMX2BrhsIyvV # vZxNm+hFDCOJtXvkAekMrwGkiIBYoBNpswnv40ldeSvRtD8tnty73JUt+AnWoCwi # zH4k+CvWICIuZT7oxVecRhlOojtaP5cUTXs0+zhk6GxEx/X6wmXd42heO9ZJL0y1 # 6FH0xw== # =ohPU # -----END PGP SIGNATURE----- # gpg: Signature made Wed 14 Sep 2022 07:50:35 EDT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * tag 'pull-arm-20220914' of https://gitlab.com/rth7680/qemu: target/arm: Make boards pass base address to armv7m_load_kernel() target/arm: Remove useless TARGET_BIG_ENDIAN check in armv7m_load_kernel() target/arm: Report FEAT_PMUv3p5 for TCG '-cpu max' target/arm: Support 64-bit event counters for FEAT_PMUv3p5 target/arm: Implement FEAT_PMUv3p5 cycle counter disable bits target/arm: Rename pmu_8_n feature test functions target/arm: Detect overflow when calculating next PMU interrupt target/arm: Honour MDCR_EL2.HPMD in Secure EL2 target/arm: Ignore PMCR.D when PMCR.LC is set target/arm: Don't mishandle count when enabling or disabling PMU counters target/arm: Correct value returned by pmu_counter_mask() target/arm: Don't corrupt high half of PMOVSR when cycle counter overflows target/arm: Add missing space in comment target/arm: Advertise FEAT_ETS for '-cpu max' target/arm: Implement ID_DFR1 target/arm: Implement ID_MMFR5 target/arm: Sort KVM reads of AArch32 ID registers into encoding order target/arm: Make cpregs 0, c0, c{3-15}, {0-7} correctly RAZ in v8 hw/arm/bcm2835_property: Add support for RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS target/arm: Add cortex-a35 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-14target/arm: Make boards pass base address to armv7m_load_kernel()Peter Maydell
Currently armv7m_load_kernel() takes the size of the block of memory where it should load the initial guest image, but assumes that it should always load it at address 0. This happens to be true of all our M-profile boards at the moment, but it isn't guaranteed to always be so: M-profile CPUs can be configured (via init-svtor and init-nsvtor, which match equivalent hardware configuration signals) to have the initial vector table at any address, not just zero. (For instance the Teeny board has the boot ROM at address 0x0200_0000.) Add a base address argument to armv7m_load_kernel(), so that callers now pass in both base address and size. All the current callers pass 0, so this is not a behaviour change. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220823160417.3858216-3-peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-09-14target/arm: Remove useless TARGET_BIG_ENDIAN check in armv7m_load_kernel()Peter Maydell
Arm system emulation targets always have TARGET_BIG_ENDIAN clear, so there is no need to have handling in armv7m_load_kernel() for the case when it is defined. Remove the unnecessary code. Side notes: * our M-profile implementation is always little-endian (that is, it makes the IMPDEF choice that the read-only AIRCR.ENDIANNESS is 0) * if we did want to handle big-endian ELF files here we should do it the way that hw/arm/boot.c:arm_load_elf() does, by looking at the ELF header to see what endianness the file itself is Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220823160417.3858216-2-peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-09-14hw/arm/bcm2835_property: Add support for ↵Enrik Berkhan
RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS In more recent Raspbian OS Linux kernels, the fb driver gives up immediately if RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS fails or no displays are reported. This change simply always reports one display. It makes bcm2835_fb work again with these more recent kernels. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Enrik Berkhan <Enrik.Berkhan@inka.de> Message-Id: <20220812143519.59134-1-Enrik.Berkhan@inka.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-09-14target/arm: Add cortex-a35Hao Wu
Add cortex A35 core and enable it for virt board. Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Joe Komlodi <komlodi@google.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20220819002015.1663247-1-wuhaotsh@google.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-09-09tpm_crb: Avoid backend startup just before shutdown under XenRoss Lagerwall
When running under Xen and the guest reboots, it boots into a new domain with a new QEMU process (and a new swtpm process if using the emulator backend). The existing reset function is triggered just before the old QEMU process exists which causes QEMU to startup the TPM backend and then immediately shut it down. This is probably harmless but when using the emulated backend, it wastes CPU and IO time reloading state, etc. Fix this by calling the reset function directly from realize() when running under Xen. During a reboot, this will be called by the QEMU process for the new domain. Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20220826143841.1515326-1-ross.lagerwall@citrix.com Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2022-09-07hw/riscv: virt: Add PMU DT node to the device treeAtish Patra
Qemu virt machine can support few cache events and cycle/instret counters. It also supports counter overflow for these events. Add a DT node so that OpenSBI/Linux kernel is aware of the virt machine capabilities. There are some dummy nodes added for testing as well. Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Atish Patra <atish.patra@wdc.com> Signed-off-by: Atish Patra <atishp@rivosinc.com> Message-Id: <20220824221701.41932-5-atishp@rivosinc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/intc: Move mtimer/mtimecmp to aclintAtish Patra
Historically, The mtime/mtimecmp has been part of the CPU because they are per hart entities. However, they actually belong to aclint which is a MMIO device. Move them to the ACLINT device. This also emulates the real hardware more closely. Reviewed-by: Anup Patel <anup@brainfault.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Signed-off-by: Atish Patra <atishp@rivosinc.com> Message-Id: <20220824221357.41070-2-atishp@rivosinc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07target/riscv: Use official extension names for AIA CSRsAnup Patel
The arch review of AIA spec is completed and we now have official extension names for AIA: Smaia (M-mode AIA CSRs) and Ssaia (S-mode AIA CSRs). Refer, section 1.6 of the latest AIA v0.3.1 stable specification at https://github.com/riscv/riscv-aia/releases/download/0.3.1-draft.32/riscv-interrupts-032.pdf) Based on above, we update QEMU RISC-V to: 1) Have separate config options for Smaia and Ssaia extensions which replace RISCV_FEATURE_AIA in CPU features 2) Not generate AIA INTC compatible string in virt machine Signed-off-by: Anup Patel <apatel@ventanamicro.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220820042958.377018-1-apatel@ventanamicro.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/core: fix platform bus node nameConor Dooley
"platform" is not a valid name for a bus node in dt-schema, so warnings can be see in dt-validate on a dump of the riscv virt dtb: /stuff/qemu/qemu.dtb: platform@4000000: $nodename:0: 'platform@4000000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$' From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml "platform-bus" is a valid name, so use that instead. CC: Rob Herring <robh@kernel.org> Fixes: 11d306b9df ("hw/arm/sysbus-fdt: helpers for platform bus nodes addition") Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Message-id: 20220810184612.157317-5-mail@conchuod.ie Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/riscv: virt: fix syscon subnode pathsConor Dooley
The reset and poweroff features of the syscon were originally added to top level, which is a valid path for a syscon subnode. Subsequently a reorganisation was carried out while implementing NUMA in which the subnodes were moved into the /soc node. As /soc is a "simple-bus", this path is invalid, and so dt-validate produces the following warnings: /stuff/qemu/qemu.dtb: soc: poweroff: {'value': [[21845]], 'offset': [[0]], 'regmap': [[4]], 'compatible': ['syscon-poweroff']} should not be valid under {'type': 'object'} From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml /stuff/qemu/qemu.dtb: soc: reboot: {'value': [[30583]], 'offset': [[0]], 'regmap': [[4]], 'compatible': ['syscon-reboot']} should not be valid under {'type': 'object'} From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml Move the syscon subnodes back to the top level and silence the warnings. Reported-by: Rob Herring <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220810184612.157317-4-mail@conchuod.ie Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/ Fixes: 18df0b4695 ("hw/riscv: virt: Allow creating multiple NUMA sockets") Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/riscv: virt: fix the plic's address cellsConor Dooley
When optional AIA PLIC support was added the to the virt machine, the address cells property was removed leading the issues with dt-validate on a dump from the virt machine: /stuff/qemu/qemu.dtb: plic@c000000: '#address-cells' is a required property From schema: /stuff/linux/Documentation/devicetree/bindings/interrupt-controller/sifive,plic-1.0.0.yaml Add back the property to suppress the warning. Reported-by: Rob Herring <robh@kernel.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Message-id: 20220810184612.157317-3-mail@conchuod.ie Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/ Fixes: e6faee6585 ("hw/riscv: virt: Add optional AIA APLIC support to virt machine") Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/riscv: virt: fix uart node nameConor Dooley
"uart" is not a node name that complies with the dt-schema. Change the node name to "serial" to ix warnings seen during dt-validate on a dtbdump of the virt machine such as: /stuff/qemu/qemu.dtb: uart@10000000: $nodename:0: 'uart@10000000' does not match '^serial(@.*)?$' From schema: /stuff/linux/Documentation/devicetree/bindings/serial/8250.yaml Reported-by: Rob Herring <robh@kernel.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Message-id: 20220810184612.157317-2-mail@conchuod.ie Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/ Fixes: 04331d0b56 ("RISC-V VirtIO Machine") Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/riscv: microchip_pfsoc: fix kernel panics due to missing peripheralsConor Dooley
Booting using "Direct Kernel Boot" for PolarFire SoC & skipping u-boot entirely is probably not advisable, but it does at least show signs of life. Recent Linux kernel versions make use of peripherals that are missing definitions in QEMU and lead to kernel panics. These issues almost certain rear their head for other methods of booting, but I was unable to figure out a suitable HSS version that is recent enough to support these peripherals & works with QEMU. With these peripherals added, booting a kernel with the following hangs hangs waiting for the system controller's hwrng, but the kernel no longer panics. With the Linux driver for hwrng disabled, it boots to console. qemu-system-riscv64 -M microchip-icicle-kit \ -m 2G -smp 5 \ -kernel $(vmlinux_bin) \ -dtb $(dtb)\ -initrd $(initramfs) \ -display none -serial null \ -serial stdio More peripherals are added than strictly required to fix the panics in the hopes of avoiding a replication of this problem in the future. Some of the peripherals which are in the device tree for recent kernels are implemented in the FPGA fabric. The eMMC/SD mux, which exists as an unimplemented device is replaced by a wider entry. This updated entry covers both the mux & the remainder of the FPGA fabric connected to the MSS using Fabric Interrconnect (FIC) 3. Link: https://github.com/polarfire-soc/icicle-kit-reference-design#fabric-memory-map Link: https://ww1.microchip.com/downloads/aemDocuments/documents/FPGA/ProductDocuments/SupportingCollateral/V1_4_Register_Map.zip Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220813135127.2971754-1-mail@conchuod.ie> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/riscv: opentitan: bump opentitan versionWilfred Mallawa
The following patch updates opentitan to match the new configuration, as per, lowRISC/opentitan@217a0168ba118503c166a9587819e3811eeb0c0c Note: with this patch we now skip the usage of the opentitan `boot_rom`. The Opentitan boot rom contains hw verification for devies which we are currently not supporting in qemu. As of now, the `boot_rom` has no major significance, however, would be good to support in the future. Tested by running utests from the latest tock [1] (that supports this version of OT). [1] https://github.com/tock/tock/pull/3056 Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220812005229.358850-1-wilfred.mallawa@opensource.wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/riscv: remove 'fdt' param from riscv_setup_rom_reset_vec()Daniel Henrique Barboza
The 'fdt' param is not being used in riscv_setup_rom_reset_vec(). Simplify the API by removing it. While we're at it, remove the redundant 'return' statement at the end of function. Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Alistair Francis <alistair.francis@wdc.com> Cc: Bin Meng <bin.meng@windriver.com> Cc: Vijai Kumar K <vijai@behindbytes.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220728181926.2123771-1-danielhb413@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-07hw/riscv: virt: pass random seed to fdtJason A. Donenfeld
If the FDT contains /chosen/rng-seed, then the Linux RNG will use it to initialize early. Set this using the usual guest random number generation function. This is confirmed to successfully initialize the RNG on Linux 5.19-rc2. Cc: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220613115810.178210-1-Jason@zx2c4.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-09-04hw/openrisc: virt: pass random seed to fdtJason A. Donenfeld
If the FDT contains /chosen/rng-seed, then the Linux RNG will use it to initialize early. Set this using the usual guest random number generation function. This is confirmed to successfully initialize the RNG on Linux 5.19-rc2. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Stafford Horne <shorne@gmail.com>
2022-09-04hw/openrisc: Initialize timer time at startupStafford Horne
The last_clk time was initialized at zero, this means when we calculate the first delta we will calculate 0 vs current time which could cause unnecessary hops. This patch moves timer initialization to the cpu reset. There are two resets registered here: 1. Per cpu timer mask (ttmr) reset. 2. Global cpu timer (last_clk and ttcr) reset, attached to the first cpu only. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Stafford Horne <shorne@gmail.com>
2022-09-04hw/openrisc: Add PCI bus support to virtStafford Horne
This is mostly borrowed from xtensa and riscv as examples. The create_pcie_irq_map swizzle function is almost and exact copy but here we use a single cell interrupt, possibly we can make this generic. Signed-off-by: Stafford Horne <shorne@gmail.com>
2022-09-04hw/openrisc: Add the OpenRISC virtual machineStafford Horne
This patch adds the OpenRISC virtual machine 'virt' for OpenRISC. This platform allows for a convenient CI platform for toolchain, software ports and the OpenRISC linux kernel port. Much of this has been sourced from the m68k and riscv virt platforms. The platform provides: - OpenRISC SMP with up to 4 cpus - A virtio bus with up to 8 devices - Standard ns16550a serial - Goldfish RTC - SiFive TEST device for poweroff and reboot - Generated Device Tree to automatically configure the guest kernel Signed-off-by: Stafford Horne <shorne@gmail.com>
2022-09-04goldfish_rtc: Add big-endian propertyStafford Horne
Add a new property "big-endian" to allow configuring the RTC as either little or big endian, the default is little endian. Currently overriding the default to big endian is only used by the m68k virt platform. New platforms should prefer to use little endian and not set this. Cc: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Anup Patel <anup@brainfault.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Stafford Horne <shorne@gmail.com>
2022-09-04hw/openrisc: Split re-usable boot time apis out to boot.cStafford Horne
These will be shared with the virt platform. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Stafford Horne <shorne@gmail.com>
2022-09-02Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingStefan Hajnoczi
* SCSI fixes for Mac OS 9 * Fix CPU reset for x86/KVM nested virtualization state * remove feature_not_found() from the configure script * Meson cleanups from muon * improved i386 TCG tests for BMI and SSE * SSE bugfixes # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmMQ+IQUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNofQgArLRlbhua699UyDkTEGGv+gBVRRKg # qJndTFJp5cvjJo3fNeE1XyZGY0PGLH09ilwHKnGqvn7Bc996ty6zi3sLDC+iT/SO # cRik6EVgZH/0QseYZijviuz7NklL8so/bgn7sORP9ibRWwiojBzm91emUt4X2l5N # WOmxLYNIPXR/G8LOSv5Dh4C4WXU3zuaLvTmg/fWPoWTF8P+9LU0gEKUzyk0jMJu4 # hb9lVLXyNbgEcdtK+VewWjsdJcdmF1tMAR94GTmbUdwxbwmATqX8w16jGUbnXPt2 # FZfmjS6CJO90uV7wBA91NnFlrJpWyDn1dKQ+ozpW0ZOAO+wfghpVq7/IRA== # =VRK4 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 01 Sep 2022 14:23:00 EDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (39 commits) target/i386: AVX+AES helpers prep target/i386: AVX pclmulqdq prep target/i386: Rewrite blendv helpers target/i386: Misc AVX helper prep target/i386: Destructive FP helpers for AVX target/i386: Dot product AVX helper prep target/i386: reimplement AVX comparison helpers target/i386: Floating point arithmetic helper AVX prep target/i386: Destructive vector helpers for AVX target/i386: Misc integer AVX helper prep target/i386: Rewrite simple integer vector helpers target/i386: Rewrite vector shift helper target/i386: rewrite destructive 3DNow operations target/i386: Add CHECK_NO_VEX target/i386: do not cast gen_helper_* function pointers target/i386: Add size suffix to vector FP helpers target/i386: isolate MMX code more target/i386: check SSE table flags instead of hardcoding opcodes target/i386: Move 3DNOW decoder target/i386: Rework sse_op_table6/7 ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-02net: tulip: Restrict DMA engine to memoriesZheyu Ma
The DMA engine is started by I/O access and then itself accesses the I/O registers, triggering a reentrancy bug. The following log can reveal it: ==5637==ERROR: AddressSanitizer: stack-overflow #0 0x5595435f6078 in tulip_xmit_list_update qemu/hw/net/tulip.c:673 #1 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13 #2 0x559544637f86 in memory_region_write_accessor qemu/softmmu/memory.c:492:5 #3 0x5595446379fa in access_with_adjusted_size qemu/softmmu/memory.c:554:18 #4 0x5595446372fa in memory_region_dispatch_write qemu/softmmu/memory.c #5 0x55954468b74c in flatview_write_continue qemu/softmmu/physmem.c:2825:23 #6 0x559544683662 in flatview_write qemu/softmmu/physmem.c:2867:12 #7 0x5595446833f3 in address_space_write qemu/softmmu/physmem.c:2963:18 #8 0x5595435fb082 in dma_memory_rw_relaxed qemu/include/sysemu/dma.h:87:12 #9 0x5595435fb082 in dma_memory_rw qemu/include/sysemu/dma.h:130:12 #10 0x5595435fb082 in dma_memory_write qemu/include/sysemu/dma.h:171:12 #11 0x5595435fb082 in stl_le_dma qemu/include/sysemu/dma.h:272:1 #12 0x5595435fb082 in stl_le_pci_dma qemu/include/hw/pci/pci.h:910:1 #13 0x5595435fb082 in tulip_desc_write qemu/hw/net/tulip.c:101:9 #14 0x5595435f7e3d in tulip_xmit_list_update qemu/hw/net/tulip.c:706:9 #15 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13 Fix this bug by restricting the DMA engine to memories regions. Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vdpa: Delete CVQ migration blockerEugenio Pérez
We can restore the device state in the destination via CVQ now. Remove the migration blocker. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost_net: add NetClientState->load() callbackEugenio Pérez
It allows per-net client operations right after device's successful start. In particular, to load the device status. Vhost-vdpa net will use it to add the CVQ buffers to restore the device status. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost_net: Add NetClientInfo stop callbackEugenio Pérez
Used by the backend to perform actions after the device is stopped. In particular, vdpa net use it to unmap CVQ buffers to the device, cleaning the actions performed in prepare(). Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost_net: Add NetClientInfo start callbackEugenio Pérez
This is used by the backend to perform actions before the device is started. In particular, vdpa net use it to map CVQ buffers to the device, so it can send control commands using them. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost: Do not depend on !NULL VirtQueueElement on vhost_svq_flushEugenio Pérez
Since QEMU will be able to inject new elements on CVQ to restore the state, we need not to depend on a VirtQueueElement to know if a new element has been used by the device or not. Instead of check that, check if there are new elements only using used idx on vhost_svq_flush. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost: Delete useless read memory barrierEugenio Pérez
As discussed in previous series [1], this memory barrier is useless with the atomic read of used idx at vhost_svq_more_used. Deleting it. [1] https://lists.nongnu.org/archive/html/qemu-devel/2022-07/msg02616.html Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost: use SVQ element ndescs instead of opaque data for desc validationEugenio Pérez
Since we're going to allow SVQ to add elements without the guest's knowledge and without its own VirtQueueElement, it's easier to check if an element is a valid head checking a different thing than the VirtQueueElement. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost: stop transfer elem ownership in vhost_handle_guest_kickEugenio Pérez
It was easier to allow vhost_svq_add to handle the memory. Now that we will allow qemu to add elements to a SVQ without the guest's knowledge, it's better to handle it in the caller. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vdpa: Use ring hwaddr at vhost_vdpa_svq_unmap_ringEugenio Pérez
Reduce code duplication. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vhost: Always store new kick fd on vhost_svq_set_svq_kick_fdEugenio Pérez
We can unbind twice a file descriptor if we call twice vhost_svq_set_svq_kick_fd because of this. Since it comes from vhost and not from SVQ, that file descriptor could be a different thing that guest's vhost notifier. Likewise, it can happens the same if a guest start and stop the device multiple times. Reported-by: Lei Yang <leiyang@redhat.com> Fixes: dff4426fa6 ("vhost: Add Shadow VirtQueue kick forwarding capabilities") Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vdpa: Make SVQ vring unmapping return voidEugenio Pérez
Nothing actually reads the return value, but an error in cleaning some entries could cause device stop to abort, making a restart impossible. Better ignore explicitely the return value. Reported-by: Lei Yang <leiyang@redhat.com> Fixes: 34e3c94eda ("vdpa: Add custom IOTLB translations to SVQ") Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vdpa: Remove SVQ vring from iova_tree at shutdownEugenio Pérez
Although the device will be reset before usage, the right thing to do is to clean it. Reported-by: Lei Yang <leiyang@redhat.com> Fixes: 34e3c94eda ("vdpa: Add custom IOTLB translations to SVQ") Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02util: accept iova_tree_remove_parameter by valueEugenio Pérez
It's convenient to call iova_tree_remove from a map returned from iova_tree_find or iova_tree_find_iova. With the current code this is not possible, since we will free it, and then we will try to search for it again. Fix it making accepting the map by value, forcing a copy of the argument. Not applying a fixes tag, since there is no use like that at the moment. Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vdpa: do not save failed dma maps in SVQ iova treeEugenio Pérez
If a map fails for whatever reason, it must not be saved in the tree. Otherwise, qemu will try to unmap it in cleanup, leaving to more errors. Fixes: 34e3c94eda ("vdpa: Add custom IOTLB translations to SVQ") Reported-by: Lei Yang <leiyang@redhat.com> Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-02vdpa: Skip the maps not in the iova treeEugenio Pérez
Next patch will skip the registering of dma maps that the vdpa device rejects in the iova tree. We need to consider that here or we cause a SIGSEGV accessing result. Reported-by: Lei Yang <leiyang@redhat.com> Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2022-09-01Merge tag 'pull-ppc-20220831' of https://gitlab.com/danielhb/qemu into stagingStefan Hajnoczi
ppc patch queue for 2022-08-31: In the first 7.2 queue we have changes in the powernv pnv-phb handling, the start of the QOMification of the ppc405 model, the removal of the taihu machine, a new SLOF image and others. # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQQX6/+ZI9AYAK8oOBk82cqW3gMxZAUCYw/AFgAKCRA82cqW3gMx # ZI6XAP0d8m6r1JqKXPSfCwVYy+AfrwY7oZWYbeTqdamK6xHcUQD+JyCcFcogY4Vz # YwvHLd9W2cqvoWiZ4tmkK4Mb0Xt0Xg4= # =0uL/ # -----END PGP SIGNATURE----- # gpg: Signature made Wed 31 Aug 2022 16:09:58 EDT # gpg: using EDDSA key 17EBFF9923D01800AF2838193CD9CA96DE033164 # gpg: Good signature from "Daniel Henrique Barboza <danielhb413@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 17EB FF99 23D0 1800 AF28 3819 3CD9 CA96 DE03 3164 * tag 'pull-ppc-20220831' of https://gitlab.com/danielhb/qemu: (60 commits) ppc4xx: Fix code style problems reported by checkpatch ppc/ppc4xx: Fix sdram trace events hw/ppc/Kconfig: Move imply before select hw/ppc/sam460ex: Remove PPC405 dependency from sam460ex ppc405: Move machine specific code to ppc405_boards.c ppc/ppc405: QOM'ify FPGA ppc/ppc405: Use an explicit I2C object hw/intc/ppc-uic: Convert ppc-uic to a PPC4xx DCR device ppc/ppc405: Use an embedded PPCUIC model in SoC state ppc4xx: Rename ppc405-ebc to ppc4xx-ebc ppc4xx: Move EBC model to ppc4xx_devs.c ppc4xx: Rename ppc405-plb to ppc4xx-plb ppc4xx: Move PLB model to ppc4xx_devs.c ppc/ppc405: QOM'ify MAL ppc/ppc405: QOM'ify PLB ppc/ppc405: QOM'ify POB ppc/ppc405: QOM'ify OPBA ppc/ppc405: QOM'ify EBC ppc/ppc405: QOM'ify DMA ppc/ppc405: QOM'ify GPIO ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-01scsi: Reject commands if the CDB length exceeds buf_lenJohn Millikin
In scsi_req_parse_cdb(), if the CDB length implied by the command type exceeds the initialized portion of the command buffer, reject the request. Rejected requests are recorded by the `scsi_req_parse_bad` trace event. On example of a bug detected by this check is SunOS's use of interleaved DMA and non-DMA commands. This guest behavior currently causes QEMU to parse uninitialized memory as a SCSI command, with unpredictable outcomes. With the new check in place: * QEMU consistently creates a trace event and rejects the request. * SunOS retries the request(s) and is able to successfully boot from disk. Signed-off-by: John Millikin <john@john-millikin.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1127 Message-Id: <20220817053458.698416-2-john@john-millikin.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-09-01scsi: Add buf_len parameter to scsi_req_new()John Millikin
When a SCSI command is received from the guest, the CDB length implied by the first byte might exceed the number of bytes the guest sent. In this case scsi_req_new() will read uninitialized data, causing unpredictable behavior. Adds the buf_len parameter to scsi_req_new() and plumbs it through the call stack. Signed-off-by: John Millikin <john@john-millikin.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1127 Message-Id: <20220817053458.698416-1-john@john-millikin.com> [Fill in correct length for adapters other than ESP. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-09-01esp: Handle CMD_BUSRESET by resetting the SCSI busJohn Millikin
Per investigation on the linked ticket, SunOS issues a SCSI bus reset to the ESP as part of its boot sequence. If this ESP command doesn't cause devices to assert sense flag UNIT ATTENTION, SunOS will consider the CD-ROM device to be non-compliant with Common Command Set (CCS). In this condition, the SunOS installer's early userspace doesn't set the installation source location to sr0 and the miniroot copy fails. Signed-off-by: John Millikin <john@john-millikin.com> Suggested-by: Bill Paul <noisetube@gmail.com> Buglink: https://gitlab.com/qemu-project/qemu/-/issues/1127 Message-Id: <20220817053846.699310-1-john@john-millikin.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-08-31ppc4xx: Fix code style problems reported by checkpatchBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <62798fbe9c200da3e0c870601ed9162b1c3a50a5.1660746880.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-08-31ppc/ppc4xx: Fix sdram trace eventsCédric Le Goater
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <0a3e454eb7fd5f2b807a9c752c28693f27829f1d.1660746880.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-08-31hw/ppc/Kconfig: Move imply before selectBALATON Zoltan
In pegasos2 section move imply before select to match other sections. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <4d46dde64c2e5df6db3f92426fb3ae885939c2b0.1660746880.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-08-31hw/ppc/sam460ex: Remove PPC405 dependency from sam460exBALATON Zoltan
Now that shared PPC4xx devices are separated from PPC405 ones we can drop this depencency. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <cf6c1d280f830beeea41128595c8c026d5126d2b.1660762465.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-08-31ppc405: Move machine specific code to ppc405_boards.cBALATON Zoltan
These are only used by the board code so move out from the shared SoC model and put it in the boards file. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <2b23bcaaf191f96b217cbd06a6038694024862c3.1660746880.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 01:48:21 +0000