aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2024-07-01virtio-pci: only reset pm state during resettingJiqian Chen
Fix bug imported by 27ce0f3afc9dd ("fix Power Management Control Register for PCI Express virtio devices" After this change, observe that QEMU may erroneously clear the power status of the device, or may erroneously clear non writable registers, such as NO_SOFT_RESET, etc. Only state of PM_CTRL is writable. Only when flag VIRTIO_PCI_FLAG_INIT_PM is set, need to reset state. Fixes: 27ce0f3afc9dd ("fix Power Management Control Register for PCI Express virtio devices" Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com> Message-Id: <20240515073526.17297-2-Jiqian.Chen@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01hw/virtio: Fix obtain the buffer id from the last descriptorWafer
The virtio-1.3 specification <https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html> writes: 2.8.6 Next Flag: Descriptor Chaining Buffer ID is included in the last descriptor in the list. If the feature (_F_INDIRECT_DESC) has been negotiated, install only one descriptor in the virtqueue. Therefor the buffer id should be obtained from the first descriptor. In descriptor chaining scenarios, the buffer id should be obtained from the last descriptor. Fixes: 86044b24e8 ("virtio: basic packed virtqueue support") Signed-off-by: Wafer <wafer@jaguarmicro.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Message-Id: <20240510072753.26158-2-wafer@jaguarmicro.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01vhost-vsock: add VIRTIO_F_RING_PACKED to feature_bitsHalil Pasic
Not having VIRTIO_F_RING_PACKED in feature_bits[] is a problem when the vhost-vsock device does not offer the feature bit VIRTIO_F_RING_PACKED but the in QEMU device is configured to try to use the packed layout (the virtio property "packed" is on). As of today, the Linux kernel vhost-vsock device does not support the packed queue layout (as vhost does not support packed), and does not offer VIRTIO_F_RING_PACKED. Thus when for example a vhost-vsock-ccw is used with packed=on, VIRTIO_F_RING_PACKED ends up being negotiated, despite the fact that the device does not actually support it, and one gets to keep the pieces. Fixes: 74b3e46630 ("virtio: add property to enable packed virtqueue") Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <20240429113334.2454197-1-pasic@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01vhost/vhost-user: Add VIRTIO_F_NOTIFICATION_DATA to vhost feature bitsJonah Palmer
Add support for the VIRTIO_F_NOTIFICATION_DATA feature across a variety of vhost devices. The inclusion of VIRTIO_F_NOTIFICATION_DATA in the feature bits arrays for these devices ensures that the backend is capable of offering and providing support for this feature, and that it can be disabled if the backend does not support it. Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <20240315165557.26942-6-jonah.palmer@oracle.com> Acked-by: Srujana Challa <schalla@marvell.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01virtio-ccw: Handle extra notification dataJonah Palmer
Add support to virtio-ccw devices for handling the extra data sent from the driver to the device when the VIRTIO_F_NOTIFICATION_DATA transport feature has been negotiated. The extra data that's passed to the virtio-ccw device when this feature is enabled varies depending on the device's virtqueue layout. That data passed to the virtio-ccw device is in the same format as the data passed to virtio-pci devices. Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <20240315165557.26942-5-jonah.palmer@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01virtio-mmio: Handle extra notification dataJonah Palmer
Add support to virtio-mmio devices for handling the extra data sent from the driver to the device when the VIRTIO_F_NOTIFICATION_DATA transport feature has been negotiated. The extra data that's passed to the virtio-mmio device when this feature is enabled varies depending on the device's virtqueue layout. The data passed to the virtio-mmio device is in the same format as the data passed to virtio-pci devices. Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <20240315165557.26942-4-jonah.palmer@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01virtio: Prevent creation of device using notification-data with ioeventfdJonah Palmer
Prevent the realization of a virtio device that attempts to use the VIRTIO_F_NOTIFICATION_DATA transport feature without disabling ioeventfd. Due to ioeventfd not being able to carry the extra data associated with this feature, having both enabled is a functional mismatch and therefore Qemu should not continue the device's realization process. Although the device does not yet know if the feature will be successfully negotiated, many devices using this feature wont actually work without this extra data and would fail FEATURES_OK anyway. If ioeventfd is able to work with the extra notification data in the future, this compatibility check can be removed. Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <20240315165557.26942-3-jonah.palmer@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01virtio/virtio-pci: Handle extra notification dataJonah Palmer
Add support to virtio-pci devices for handling the extra data sent from the driver to the device when the VIRTIO_F_NOTIFICATION_DATA transport feature has been negotiated. The extra data that's passed to the virtio-pci device when this feature is enabled varies depending on the device's virtqueue layout. In a split virtqueue layout, this data includes: - upper 16 bits: shadow_avail_idx - lower 16 bits: virtqueue index In a packed virtqueue layout, this data includes: - upper 16 bits: 1-bit wrap counter & 15-bit shadow_avail_idx - lower 16 bits: virtqueue index Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <20240315165557.26942-2-jonah.palmer@oracle.com> Reviewed-by: Eugenio Pérez <eperezma@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01vhost: Perform memory section dirty scans once per iterationSi-Wei Liu
On setups with one or more virtio-net devices with vhost on, dirty tracking iteration increases cost the bigger the number amount of queues are set up e.g. on idle guests migration the following is observed with virtio-net with vhost=on: 48 queues -> 78.11% [.] vhost_dev_sync_region.isra.13 8 queues -> 40.50% [.] vhost_dev_sync_region.isra.13 1 queue -> 6.89% [.] vhost_dev_sync_region.isra.13 2 devices, 1 queue -> 18.60% [.] vhost_dev_sync_region.isra.14 With high memory rates the symptom is lack of convergence as soon as it has a vhost device with a sufficiently high number of queues, the sufficient number of vhost devices. On every migration iteration (every 100msecs) it will redundantly query the *shared log* the number of queues configured with vhost that exist in the guest. For the virtqueue data, this is necessary, but not for the memory sections which are the same. So essentially we end up scanning the dirty log too often. To fix that, select a vhost device responsible for scanning the log with regards to memory sections dirty tracking. It is selected when we enable the logger (during migration) and cleared when we disable the logger. If the vhost logger device goes away for some reason, the logger will be re-selected from the rest of vhost devices. After making mem-section logger a singleton instance, constant cost of 7%-9% (like the 1 queue report) will be seen, no matter how many queues or how many vhost devices are configured: 48 queues -> 8.71% [.] vhost_dev_sync_region.isra.13 2 devices, 8 queues -> 7.97% [.] vhost_dev_sync_region.isra.14 Co-developed-by: Joao Martins <joao.m.martins@oracle.com> Signed-off-by: Joao Martins <joao.m.martins@oracle.com> Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com> Message-Id: <1710448055-11709-2-git-send-email-si-wei.liu@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com>
2024-07-01vhost: dirty log should be per backend typeSi-Wei Liu
There could be a mix of both vhost-user and vhost-kernel clients in the same QEMU process, where separate vhost loggers for the specific vhost type have to be used. Make the vhost logger per backend type, and have them properly reference counted. Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com> Message-Id: <1710448055-11709-1-git-send-email-si-wei.liu@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-07-01Merge tag 'pull-target-arm-20240701' of ↵Richard Henderson
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * tests/avocado: update firmware for sbsa-ref and use all cores * hw/arm/smmu-common: Replace smmu_iommu_mr with smmu_find_sdev * arm: Fix VCMLA Dd, Dn, Dm[idx] * arm: Fix SQDMULH (by element) with Q=0 * arm: Fix FJCVTZS vs flush-to-zero * arm: More conversion of A64 AdvSIMD to decodetree * arm: Enable FEAT_Debugv8p8 for -cpu max * MAINTAINERS: Update family name for Patrick Leis * hw/arm/xilinx_zynq: Add boot-mode property * docs/system/arm: Add a doc for zynq board * hw/misc: In STM32L4x5 EXTI, correct configurable interrupts * tests/qtest: fix minor issues in STM32L4x5 tests # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmaC1BMZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3nDOEACCoewjO2FJ4RFXMSmgr0Zf # jxWliu7osw7oeG4ZNq1+xMiXeW0vyS54eW41TMki1f98N/yK8v55BM8kBBvDvZaz # R5DUXpN+MtwD9A62md3B2c4mFXHqk1UOGbKi4btbtFj4lS8pV51mPmApzBUr2iTj # w6dCLciLOt87NWgtLECXsZ3evn+VlTRc+Hmfp1M/C/Rf2Qx3zis/CFHGQsZLGwzG # 2WhTpU1BKeOfsQa1VbSX6un14d72/JATFZN3rSgMbOEbvsCEeP+rnkzX57ejGyxV # 4DUx69gEAqS5bOfkQHLwy82WsunD/oIgp+GpYaYgINHzh6UkEsPoymrHAaPgV1Vh # g0TaBtbv2p89RFY1C2W2Mi4ICQ14a+oIV9FPvDsOE8Wq+wDAy/ZxZs7G6flxqods # s4JvcMqB3kUNBZaMsFVXTKdqT1PufICS+gx0VsKdKDwXcOHwMS10nTlEOPzqvoBA # phAsEbjnjWVhf03XTfCus+l5NT96lswCzPcUovb3CitSc2A1KUye3TyzHnxIqmOt # Owcl+Oiso++cgYzr/BCveTAYKYoRZzVcq5jCl4bBUH/8sLrRDbT0cpFpcMk72eE9 # VhR00kbkDfL3nKrulLsG8FeUlisX5+oGb3G5AdPtU9sqJPJMmBGaF+KniI0wi7VN # 5teHq08upLMF5JAjiKzZIA== # =faXD # -----END PGP SIGNATURE----- # gpg: Signature made Mon 01 Jul 2024 09:06:43 AM PDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] * tag 'pull-target-arm-20240701' of https://git.linaro.org/people/pmaydell/qemu-arm: (29 commits) tests/qtest: Ensure STM32L4x5 EXTI state is correct at the end of QTests hw/misc: In STM32L4x5 EXTI, correct configurable interrupts tests/qtest: Fix STM32L4x5 SYSCFG irq line 15 state assumption docs/system/arm: Add a doc for zynq board hw/arm/xilinx_zynq: Add boot-mode property hw/misc/zynq_slcr: Add boot-mode property MAINTAINERS: Update my family name target/arm: Enable FEAT_Debugv8p8 for -cpu max target/arm: Move initialization of debug ID registers target/arm: Fix indentation target/arm: Delete dead code from disas_simd_indexed target/arm: Convert FCMLA to decodetree target/arm: Convert FCADD to decodetree target/arm: Add data argument to do_fp3_vector target/arm: Convert BFMMLA, SMMLA, UMMLA, USMMLA to decodetree target/arm: Convert BFMLALB, BFMLALT to decodetree target/arm: Convert BFDOT to decodetree target/arm: Convert SUDOT, USDOT to decodetree target/arm: Convert SDOT, UDOT to decodetree target/arm: Convert SQRDMLAH, SQRDMLSH to decodetree ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-01hw/misc: In STM32L4x5 EXTI, correct configurable interruptsInès Varhol
The implementation of configurable interrupts (interrupts supporting edge selection) was incorrectly expecting alternating input levels : this commits adds a new status field `irq_levels` to actually detect edges. Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Message-id: 20240629110800.539969-2-ines.varhol@telecom-paris.fr Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-01hw/arm/xilinx_zynq: Add boot-mode propertySai Pavan Boddu
Read boot-mode value as machine property and propagate that to SLCR.BOOT_MODE register. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@amd.com> Acked-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-id: 20240621125906.1300995-3-sai.pavan.boddu@amd.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-01hw/misc/zynq_slcr: Add boot-mode propertySai Pavan Boddu
boot-mode property sets user values into BOOT_MODE register, on hardware these are derived from board switches. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@amd.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com> Message-id: 20240621125906.1300995-2-sai.pavan.boddu@amd.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-01xen-hvm: Avoid livelock while handling buffered ioreqsRoss Lagerwall
A malicious or buggy guest may generated buffered ioreqs faster than QEMU can process them in handle_buffered_iopage(). The result is a livelock - QEMU continuously processes ioreqs on the main thread without iterating through the main loop which prevents handling other events, processing timers, etc. Without QEMU handling other events, it often results in the guest becoming unsable and makes it difficult to stop the source of buffered ioreqs. To avoid this, if we process a full page of buffered ioreqs, stop and reschedule an immediate timer to continue processing them. This lets QEMU go back to the main loop and catch up. Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240404140833.1557953-1-ross.lagerwall@citrix.com> Signed-off-by: Anthony PERARD <anthony@xenproject.org>
2024-07-01xen: fix stubdom PCI addrMarek Marczykowski-Górecki
When running in a stubdomain, the config space access via sysfs needs to use BDF as seen inside stubdomain (connected via xen-pcifront), which is different from the real BDF. For other purposes (hypercall parameters etc), the real BDF needs to be used. Get the in-stubdomain BDF by looking up relevant PV PCI xenstore entries. Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <35049e99da634a74578a1ff2cb3ae4cc436ede33.1711506237.git-series.marmarek@invisiblethingslab.com> Signed-off-by: Anthony PERARD <anthony@xenproject.org>
2024-07-01hw/xen: detect when running inside stubdomainMarek Marczykowski-Górecki
Introduce global xen_is_stubdomain variable when qemu is running inside a stubdomain instead of dom0. This will be relevant for subsequent patches, as few things like accessing PCI config space need to be done differently. Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <e66aa97dca5120f22e015c19710b2ff04f525720.1711506237.git-series.marmarek@invisiblethingslab.com> Signed-off-by: Anthony PERARD <anthony@xenproject.org>
2024-07-01hw/arm/smmu-common: Replace smmu_iommu_mr with smmu_find_sdevNicolin Chen
The caller of smmu_iommu_mr wants to get sdev for smmuv3_flush_config(). Do it directly instead of bridging with an iommu mr pointer. Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Message-id: 20240619002218.926674-1-nicolinc@nvidia.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-01hw/misc: Implement mailbox properties for customer OTP and device specific ↵Rayhan Faizel
private keys Four mailbox properties are implemented as follows: 1. Customer OTP: GET_CUSTOMER_OTP and SET_CUSTOMER_OTP 2. Device-specific private key: GET_PRIVATE_KEY and SET_PRIVATE_KEY. The customer OTP is located in the rows 36-43. The device-specific private key is located in the rows 56-63. The customer OTP can be locked with the magic numbers 0xffffffff 0xaffe0000 when running the SET_CUSTOMER_OTP mailbox command. Bit 6 of row 32 indicates this lock, which is undocumented. The lock also applies to the device-specific private key. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-01hw/arm: Connect OTP device to BCM2835Rayhan Faizel
Replace stubbed OTP memory region with the new OTP device. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-01hw/nvram: Add BCM2835 OTP deviceRayhan Faizel
The OTP device registers are currently stubbed. For now, the device houses the OTP rows which will be accessed directly by other peripherals. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-06-30Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into stagingRichard Henderson
trivial patches for 2024-06-30 # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmaBjTkACgkQcBtPaxpp # PlmhAAf+PZEsiBvffwwNH5n1q39Hilih35p/GCVpNYKcLsFB6bLmt9A/x062NqTS # ob1Uj134ofHlSQtNjP1KxXdriwc40ZMahkTO+x6gYc+IpoRJGTGYEA0MWh4gPPYK # S6l/nOI9JK1x+ot+bQzGOzOjz3/S7RJteXzwOPlWQ7GChz8NIUPWV3DkcVP0AeT0 # 7Lq7GtDBSV5Jbne2IrvOGadjPOpJiiLEmLawmw1c9qapIKAu2wxNBMlO98ufsg6L # hDFEg6K0CKvM9fcdK8UXhnMa+58QwHhoJT+Q00aQcU1xzu+ifi/CrmgbRCK5ruTA # o0I8q6ONbK33cTzyZ/ZmKtoA8b/Rzw== # =N3GX # -----END PGP SIGNATURE----- # gpg: Signature made Sun 30 Jun 2024 09:52:09 AM PDT # gpg: using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [full] # gpg: aka "Michael Tokarev <mjt@debian.org>" [full] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [full] * tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu: hw/core/loader: gunzip(): fix memory leak on error path vl.c: select_machine(): add selected machine type to error message vl.c: select_machine(): use g_autoptr vl.c: select_machine(): use ERRP_GUARD instead of error propagation docs/system/devices/usb: Replace the non-existing "qemu" binary docs/cxl: fix some typos os-posix: Expand setrlimit() syscall compatibility net/can: Remove unused struct 'CanBusState' hw/arm/bcm2836: Remove unusued struct 'BCM283XClass' linux-user: sparc: Remove unused struct 'target_mc_fq' linux-user: cris: Remove unused struct 'rt_signal_frame' monitor: Remove obsolete stubs target/i386: Advertise MWAIT iff host supports vl: Allow multiple -overcommit commands cpu: fix memleak of 'halt_cond' and 'thread' hmp-commands-info.hx: Add missing info command for stats subcommand Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-30hw/core/loader: gunzip(): fix memory leak on error pathVladimir Sementsov-Ogievskiy
We should call inflateEnd() like on success path to cleanup state in s variable. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-06-30hw/arm/bcm2836: Remove unusued struct 'BCM283XClass'Dr. David Alan Gilbert
This struct has been unused since Commit f932093ae165 ("hw/arm/bcm2836: Split out common part of BCM283X classes") Signed-off-by: Dr. David Alan Gilbert <dave@treblig.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-06-30cpu: fix memleak of 'halt_cond' and 'thread'Matheus Tavares Bernardino
Since a4c2735f35 (cpu: move Qemu[Thread|Cond] setup into common code, 2024-05-30) these fields are now allocated at cpu_common_initfn(). So let's make sure we also free them at cpu_common_finalize(). Furthermore, the code also frees these on round robin, but we missed 'halt_cond'. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-06-30hw/ufs: Fix potential bugs in MMIO read|writeMinwoo Im
This patch fixes two points reported in coverity scan report [1]. Check the MMIO access address with (addr + size), not just with the start offset addr to make sure that the requested memory access not to exceed the actual register region. We also updated (uint8_t *) to (uint32_t *) to represent we are accessing the MMIO registers by dword-sized only. [1] https://lore.kernel.org/qemu-devel/CAFEAcA82L-WZnHMW0X+Dr40bHM-EVq2ZH4DG4pdqop4xxDP2Og@mail.gmail.com/ Cc: Jeuk Kim <jeuk20.kim@gmail.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Minwoo Im <minwoo.im.dev@gmail.com> Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20240623024555.78697-1-minwoo.im.dev@gmail.com> Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
2024-06-26hw/riscv/virt.c: Make block devices default to virtioSunil V L
RISC-V virt is currently missing default type for block devices. Without this being set, proper backend is not created when option like -cdrom is used. So, make the virt board's default block device type be IF_VIRTIO similar to other architectures. We also need to set no_cdrom to avoid getting a default cdrom device. Signed-off-by: Sunil V L <sunilvl@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20240620064718.275427-1-sunilvl@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: imsics DT: add '#msi-cells'Daniel Henrique Barboza
The DT docs for riscv,imsics [1] requires a 'msi-cell' property. Add one and set it zero. [1] Documentation/devicetree/bindings/interrupt-controller/riscv,imsics.yaml Reported-by: Conor Dooley <conor@kernel.org> Fixes: 28d8c281200f ("hw/riscv: virt: Add optional AIA IMSIC support to virt machine") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20240531202759.911601-9-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: imsics DT: add 'qemu, imsics' to 'compatible'Daniel Henrique Barboza
The DT docs for riscv,imsics [1] predicts a 'qemu,imsics' enum in the 'compatible' property. [1] Documentation/devicetree/bindings/interrupt-controller/riscv,imsics.yaml Reported-by: Conor Dooley <conor@kernel.org> Fixes: 28d8c281200f ("hw/riscv: virt: Add optional AIA IMSIC support to virt machine") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240531202759.911601-8-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: change imsic nodename to 'interrupt-controller'Daniel Henrique Barboza
The Linux DT docs for imsic [1] predicts an 'interrupt-controller@addr' node, not 'imsic@addr', given this node inherits the 'interrupt-controller' node. [1] Documentation/devicetree/bindings/interrupt-controller/riscv,imsics.yaml Reported-by: Conor Dooley <conor@kernel.org> Fixes: 28d8c281200f ("hw/riscv: virt: Add optional AIA IMSIC support to virt machine") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240531202759.911601-7-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: aplic DT: rename prop to 'riscv, delegation'Daniel Henrique Barboza
The DT docs for riscv,aplic [1] predicts a 'riscv,delegation' property. Not 'riscv,delegate'. [1] Documentation/devicetree/bindings/interrupt-controller/riscv,aplic.yaml Reported-by: Conor Dooley <conor@kernel.org> Fixes: e6faee65855b ("hw/riscv: virt: Add optional AIA APLIC support to virt machine") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240531202759.911601-6-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: aplic DT: add 'qemu, aplic' to 'compatible'Daniel Henrique Barboza
The DT docs for riscv,aplic [1] predicts a 'qemu,aplic' enum in the 'compatible' property. [1] Documentation/devicetree/bindings/interrupt-controller/riscv,aplic.yaml Reported-by: Conor Dooley <conor@kernel.org> Fixes: e6faee65855b ("hw/riscv: virt: Add optional AIA APLIC support to virt machine") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240531202759.911601-5-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: rename aplic nodename to 'interrupt-controller'Daniel Henrique Barboza
The correct name of the aplic controller node, as per Linux kernel DT docs [1], is 'interrupt-controller@addr'. [1] Documentation/devicetree/bindings/interrupt-controller/riscv,aplic.yaml Reported-by: Conor Dooley <conor@kernel.org> Fixes: e6faee65855b ("hw/riscv: virt: Add optional AIA APLIC support to virt machine") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240531202759.911601-4-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: add aplic nodename helperDaniel Henrique Barboza
We'll change the aplic DT nodename in the next patch and the name is hardcoded in 2 different functions. Create a helper to change a single place later. While we're at it, in create_fdt_socket_aplic(), move 'aplic_name' inside the conditional to avoid allocating a string that won't be used when socket == NULL. Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240531202759.911601-3-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-26hw/riscv/virt.c: add address-cells in create_fdt_one_aplic()Daniel Henrique Barboza
We need #address-cells properties in all interrupt controllers that are referred by an interrupt-map [1]. For the RISC-V machine, both PLIC and APLIC controllers must have this property. PLIC already sets it in create_fdt_socket_plic(). Set the property for APLIC in create_fdt_one_aplic(). [1] https://lore.kernel.org/linux-arm-kernel/CAL_JsqJE15D-xXxmELsmuD+JQHZzxGzdXvikChn6KFWqk6NzPw@mail.gmail.com/ Suggested-by: Anup Patel <apatel@ventanamicro.com> Fixes: e6faee65855b ("hw/riscv: virt: Add optional AIA APLIC support to virt machine") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240531202759.911601-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-24Merge tag 'pull-vfio-20240624' of https://github.com/legoater/qemu into stagingRichard Henderson
vfio queue: * Add a host IOMMU device abstraction * VIRTIO-IOMMU/VFIO: Fix host iommu geometry handling * QOMify VFIOContainer # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmZ541QACgkQUaNDx8/7 # 7KFdnQ/8Dih3HI2qtY93bTxg0lmJ+ZMibojTkEkTu3kSvwoI12wkiSMFKzzTWpZE # UtGyIqQQij8IfQtIz87uQskv7oFiZKG6JWMTAX4uJ8ZIgZiih29/e/38VGEbogBh # yO+1Pqr3ETlyLnQcu9ruBTJ293LXovmD4d9feoaVdURBNZ1EqIh7sv/y7YdUsR+i # tXa6kW1ZIlKBI54o/uuODHWQYyOHs39VtZ6JZvgxVVEQsNikcJsosK9ts9A1EByi # 0roQVXm2QAK/nPXlmMGLvJWzQcdeXQ6W6hzYkO2HqGnCLURnpW+y/ZVbNcxGOOiU # 2G6L0TASlqA3yqCJeLuZZqjM6S2VbnvrA8omyg4QnygIHppYjp2CdcCmUpg6wfze # rkgbVLNasX+le4ss2emuHPh55dLDP20yW83DeGeqSgE//foaJWhtOK/cnvs04zV2 # D6oSAVsOsZ6ozYlQckYnaxIBANDKLRnzCXVZLUCmHxCUhxHuiNJUsHfZYIv/Zxen # C5ZjD/JPgx3onkoKbNfTRTgwOCdXhVPjWnnp7Su49jymsekqdk1ntln4ixDT3Vol # ghQPQLjICBc8qXiOJAcFDwqLf/telPlzUUzvlDeC4BYMnpBAP6rQ3JJ8i0vCCiWv # zKCtmbcDqDRMDpWyJWM3XA/kVKP9i2tNa1R/ej2SleCFLgRapBw= # =3koe # -----END PGP SIGNATURE----- # gpg: Signature made Mon 24 Jun 2024 02:21:24 PM PDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-vfio-20240624' of https://github.com/legoater/qemu: (42 commits) vfio/container: Move vfio_container_destroy() to an instance_finalize() handler vfio/container: Introduce vfio_iommu_legacy_instance_init() vfio/container: Remove vfio_container_init() vfio/container: Remove VFIOContainerBase::ops vfio/container: Introduce an instance_init() handler vfio/container: Switch to QOM vfio/container: Change VFIOContainerBase to use QOM vfio/container: Discover IOMMU type before creating the container vfio/container: Introduce vfio_create_container() vfio/container: Introduce vfio_get_iommu_class_name() vfio/container: Modify vfio_get_iommu_type() to use a container fd vfio/container: Simplify vfio_container_init() vfio/container: Introduce vfio_address_space_insert() vfio/common: Extract vIOMMU code from vfio_sync_dirty_bitmap() vfio/common: Move dirty tracking ranges update to helper vfio: Remove unused declarations from vfio-common.h vfio: Make vfio_devices_dma_logging_start() return bool memory: Remove IOMMU MR iommu_set_iova_range API hw/vfio: Remove memory_region_iommu_set_iova_ranges() call virtio-iommu: Remove the implementation of iommu_set_iova_range ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-24Merge tag 'sdmmc-20240624' of https://github.com/philmd/qemu into stagingRichard Henderson
SD/MMC patches queue One fix and various cleanups for the SD card model. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmZ5cRUACgkQ4+MsLN6t # wN59Qw//cUdjD287pB5Ml5aQqr9sOTyVnHUceZtz7AOZ5w8RM2tlPDgOImeLOvU6 # OV7qfWvNaUxtQxhfh5jpe8Pj4eHBtRQzA6a1AWToEvnN4189QWHZpqf5TUa4AlFS # uAk7k2TkoNv9zbNKca0bP3L1x6sT9l0VPZBLaLbgdXDIX2ycD0r3NVQxXb/bJRgM # 6pFRcLCF/isKzLQDwqnTa11hB/JDTvOU7xnY0kazGRvyWjbSvE2sOJzLNJXHkW0I # /FNfRbOKJo2t+47Z5qSXUFFLeIEBTy7VqNBsOQ6sMIgrWzbOSrtBcuxKp0p9NCGH # fdZHlDVRnNGXewUya4RjbmXiCNuGL4zJ82b2BaQZVd5ZwU2opIr8xO96WCojQ4dZ # +Dq3uv7su3PUVOh95i38Eo93OG9jXFx642XD4q2uKu5j70IoGXAkIoLUcFkZZdGS # 9rCsaNUHyHJrN6nXf3Cekvkqxz36p6QXaUF9I1vB0JF6CrexMD35sBUK+RE9k4uW # LnqL7ZwQDGDGVl3kPS/VCXv1mMim4aRLSEIveq7Ui6dKzaaJMIIodZ8CFMuyTTsD # cGE+Cd053nf6SzX3+kEZftNdjtJ906O8xIAw+RNdARYx003l4kUxgsPDk7ELyzIP # Tb+VlZl2P+ROJmeWvRMTW7ZQ49M9IEMrg8zlGF4hLCxB1JndeOA= # =O5er # -----END PGP SIGNATURE----- # gpg: Signature made Mon 24 Jun 2024 06:13:57 AM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'sdmmc-20240624' of https://github.com/philmd/qemu: hw/sd/sdcard: Add comments around registers and commands hw/sd/sdcard: Inline BLK_READ_BLOCK / BLK_WRITE_BLOCK macros hw/sd/sdcard: Add sd_invalid_mode_for_cmd to report invalid mode switch hw/sd/sdcard: Only call sd_req_get_address() where address is used hw/sd/sdcard: Factor sd_req_get_address() method out hw/sd/sdcard: Only call sd_req_get_rca() where RCA is used hw/sd/sdcard: Factor sd_req_get_rca() method out hw/sd/sdcard: Have cmd_valid_while_locked() return a boolean value hw/sd/sdcard: Trace update of block count (CMD23) hw/sd/sdcard: Remove explicit entries for illegal commands hw/sd/sdcard: Remove ACMD6 handler for SPI mode hw/sd/sdcard: Use Load/Store API to fill some CID/CSD registers hw/sd/sdcard: Use registerfield CSR::CURRENT_STATE definition hw/sd/sdcard: Use HWBLOCK_SHIFT definition instead of magic values hw/sd/sdcard: Fix typo in SEND_OP_COND command name hw/sd/sdcard: Rewrite sd_cmd_ALL_SEND_CID using switch case (CMD2) hw/sd/sdcard: Correct code indentation hw/sd/sdcard: Avoid OOB in sd_read_byte() during unexpected CMD switch bswap: Add st24_be_p() to store 24 bits in big-endian order Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-24vfio/container: Move vfio_container_destroy() to an instance_finalize() handlerCédric Le Goater
vfio_container_destroy() clears the resources allocated VFIOContainerBase object. Now that VFIOContainerBase is a QOM object, add an instance_finalize() handler to do the cleanup. It will be called through object_unref(). Suggested-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Introduce vfio_iommu_legacy_instance_init()Cédric Le Goater
Just as we did for the VFIOContainerBase object, introduce an instance_init() handler for the legacy VFIOContainer object and do the specific initialization there. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Remove vfio_container_init()Cédric Le Goater
It's now empty. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Remove VFIOContainerBase::opsCédric Le Goater
Instead, use VFIO_IOMMU_GET_CLASS() to get the class pointer. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Introduce an instance_init() handlerCédric Le Goater
This allows us to move the initialization code from vfio_container_init(), which we will soon remove. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Switch to QOMCédric Le Goater
Instead of allocating the container struct, create a QOM object of the appropriate type. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Change VFIOContainerBase to use QOMCédric Le Goater
VFIOContainerBase was made a QOM interface because we believed that a QOM object would expose all the IOMMU backends to the QEMU machine and human interface. This only applies to user creatable devices or objects. Change the VFIOContainerBase nature from interface to object and make the necessary adjustments in the VFIO_IOMMU hierarchy. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Discover IOMMU type before creating the containerCédric Le Goater
Since the QEMU struct type representing the VFIO container is deduced from the IOMMU type exposed by the host, this type should be well defined *before* creating the container struct. This will be necessary to instantiate a QOM object of the correct type in future changes. Rework vfio_set_iommu() to extract the part doing the container initialization and move it under vfio_create_container(). Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Introduce vfio_create_container()Cédric Le Goater
This routine allocates the QEMU struct type representing the VFIO container. It is minimal currently and future changes will do more initialization. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Introduce vfio_get_iommu_class_name()Cédric Le Goater
Rework vfio_get_iommu_class() to return a literal class name instead of a class object. We will need this name to instantiate the object later on. Since the default case asserts, remove the error report as QEMU will simply abort before. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Modify vfio_get_iommu_type() to use a container fdCédric Le Goater
The 'container' pointer has no other use than its 'fd' attribute. Simplify the prototype to ease future changes. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Simplify vfio_container_init()Cédric Le Goater
Assign the base container VFIOAddressSpace 'space' pointer in vfio_address_space_insert(). The ultimate goal is to remove vfio_container_init() and instead rely on an .instance_init() handler to perfom the initialization of VFIOContainerBase. To be noted that vfio_connect_container() will assign the 'space' pointer later in the execution flow. This should not have any consequence. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2024-06-24vfio/container: Introduce vfio_address_space_insert()Cédric Le Goater
It prepares ground for a future change initializing the 'space' pointer of VFIOContainerBase. The goal is to replace vfio_container_init() by an .instance_init() handler when VFIOContainerBase is QOMified. Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>