aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2024-06-06tests/libqos: Add loongarch virt machine nodeBibo Mao
Add loongarch virt machine to the graph. It is a modified copy of the existing riscv virtmachine in riscv-virt-machine.c It contains a generic-pcihost controller, and an extra function loongarch_config_qpci_bus() to configure GPEX pci host controller information, such as ecam and pio_base addresses. Also hotplug handle checking about TYPE_VIRTIO_IOMMU_PCI device is added on loongarch virt machine, since virtio_mmu_pci device requires it. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Thomas Huth <thuth@redhat.com> Message-Id: <20240528082053.938564-1-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-06-05hw/dma/pl330: Use qemu_hexdump_line to avoid sprintfPhilippe Mathieu-Daudé
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240412073346.458116-11-richard.henderson@linaro.org>
2024-06-05hw/ide/atapi: Use qemu_hexdump_line to avoid sprintfPhilippe Mathieu-Daudé
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240412073346.458116-10-richard.henderson@linaro.org>
2024-06-05hw/scsi/scsi-disk: Use qemu_hexdump_line to avoid sprintfPhilippe Mathieu-Daudé
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Note that this drops the "0x" prefix to every byte, which should be of no consequence to tracing. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240412073346.458116-9-richard.henderson@linaro.org>
2024-06-05hw/mips/malta: Add re-usable rng_seed_hex_new() methodPhilippe Mathieu-Daudé
sprintf() is deprecated on Darwin since macOS 13.0 / XCode 14.1. Extract common code from reinitialize_rng_seed and load_kernel to rng_seed_hex_new. Using qemu_hexdump_line both fixes the deprecation warning and simplifies the code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> [rth: Use qemu_hexdump_line.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240412073346.458116-7-richard.henderson@linaro.org>
2024-06-05util/hexdump: Add unit_len and block_len to qemu_hexdump_lineRichard Henderson
Generalize the current 1 byte unit and 4 byte blocking within the output. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240412073346.458116-5-richard.henderson@linaro.org>
2024-06-05util/hexdump: Use a GString for qemu_hexdump_lineRichard Henderson
Allocate a new, or append to an existing GString instead of using a fixed sized buffer. Require the caller to determine the length of the line -- do not bound len here. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240412073346.458116-4-richard.henderson@linaro.org>
2024-06-05Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* virtio-blk: remove SCSI passthrough functionality * require x86-64-v2 baseline ISA * SEV-SNP host support * fix xsave.flat with TCG * fixes for CPUID checks done by TCG # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmZgKVYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPKYgf/QkWrNXdjjD3yAsv5LbJFVTVyCYW3 # b4Iax29kEDy8k9wbzfLxOfIk9jXIjmbOMO5ZN9LFiHK6VJxbXslsMh6hm50M3xKe # 49X1Rvf9YuVA7KZX+dWkEuqLYI6Tlgj3HaCilYWfXrjyo6hY3CxzkPV/ChmaeYlV # Ad4Y8biifoUuuEK8OTeTlcDWLhOHlFXylG3AXqULsUsXp0XhWJ9juXQ60eATv/W4 # eCEH7CSmRhYFu2/rV+IrWFYMnskLRTk1OC1/m6yXGPKOzgnOcthuvQfiUgPkbR/d # llY6Ni5Aaf7+XX3S7Avcyvoq8jXzaaMzOrzL98rxYGDR1sYBYO+4h4ZToA== # =qQeP # -----END PGP SIGNATURE----- # gpg: Signature made Wed 05 Jun 2024 02:01:10 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (46 commits) hw/i386: Add support for loading BIOS using guest_memfd hw/i386/sev: Use guest_memfd for legacy ROMs memory: Introduce memory_region_init_ram_guest_memfd() i386/sev: Allow measured direct kernel boot on SNP i386/sev: Reorder struct declarations i386/sev: Extract build_kernel_loader_hashes i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP guests i386/kvm: Add KVM_EXIT_HYPERCALL handling for KVM_HC_MAP_GPA_RANGE i386/sev: Invoke launch_updata_data() for SNP class i386/sev: Invoke launch_updata_data() for SEV class hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabled i386/sev: Add support for SNP CPUID validation i386/sev: Add support for populating OVMF metadata pages hw/i386/sev: Add function to get SEV metadata from OVMF header i386/sev: Set CPU state to protected once SNP guest payload is finalized i386/sev: Add handling to encrypt/finalize guest launch data i386/sev: Add the SNP launch start context i386/sev: Update query-sev QAPI format to handle SEV-SNP i386/sev: Add a class method to determine KVM VM type for SNP guests i386/sev: Don't return launch measurements for SEV-SNP guests ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-05hw/i386: Add support for loading BIOS using guest_memfdMichael Roth
When guest_memfd is enabled, the BIOS is generally part of the initial encrypted guest image and will be accessed as private guest memory. Add the necessary changes to set up the associated RAM region with a guest_memfd backend to allow for this. Current support centers around using -bios to load the BIOS data. Support for loading the BIOS via pflash requires additional enablement since those interfaces rely on the use of ROM memory regions which make use of the KVM_MEM_READONLY memslot flag, which is not supported for guest_memfd-backed memslots. Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-29-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05hw/i386/sev: Use guest_memfd for legacy ROMsMichael Roth
Current SNP guest kernels will attempt to access these regions with with C-bit set, so guest_memfd is needed to handle that. Otherwise, kvm_convert_memory() will fail when the guest kernel tries to access it and QEMU attempts to call KVM_SET_MEMORY_ATTRIBUTES to set these ranges to private. Whether guests should actually try to access ROM regions in this way (or need to deal with legacy ROM regions at all), is a separate issue to be addressed on kernel side, but current SNP guest kernels will exhibit this behavior and so this handling is needed to allow QEMU to continue running existing SNP guest kernels. Signed-off-by: Michael Roth <michael.roth@amd.com> [pankaj: Added sev_snp_enabled() check] Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-28-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05hw/i386/sev: Add support to encrypt BIOS when SEV-SNP is enabledBrijesh Singh
As with SEV, an SNP guest requires that the BIOS be part of the initial encrypted/measured guest payload. Extend sev_encrypt_flash() to handle the SNP case and plumb through the GPA of the BIOS location since this is needed for SNP. Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-25-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05hw/i386/sev: Add function to get SEV metadata from OVMF headerBrijesh Singh
A recent version of OVMF expanded the reset vector GUID list to add SEV-specific metadata GUID. The SEV metadata describes the reserved memory regions such as the secrets and CPUID page used during the SEV-SNP guest launch. The pc_system_get_ovmf_sev_metadata_ptr() is used to retieve the SEV metadata pointer from the OVMF GUID list. Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com> Message-ID: <20240530111643.1091816-19-pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05machine: allow early use of machine_require_guest_memfdPaolo Bonzini
Ask the ConfidentialGuestSupport object whether to use guest_memfd for KVM-backend private memory. This bool can be set in instance_init (or user_complete) so that it is available when the machine is created. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05update-linux-headers: move pvpanic.h to correct directoryPaolo Bonzini
Linux has <misc/pvpanic.h>, not <linux/pvpanic.h>. Use the same directory for QEMU's include/standard-headers/ copy. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-05virtio-blk: remove SCSI passthrough functionalityPaolo Bonzini
The legacy SCSI passthrough functionality has never been enabled for VIRTIO 1.0 and was deprecated more than four years ago. Get rid of it---almost, because QEMU is advertising it unconditionally for legacy virtio-blk devices. Just parse the header and return a nonzero status. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-06-04Merge tag 'hw-misc-accel-20240604' of https://github.com/philmd/qemu into ↵Richard Henderson
staging Misc HW & accelerators patch queue - Use async exit in debugexit model (Thomas) - Fixed bug reading xlnx_dpdma descriptor (Peter) - Initialise plugin state before vCPU/thread creation (Alex) - Few sprintf() calls removed (Richard & Philippe) - Few deprecated QMP events removed (Philippe) - Housekeeping in Xen (Edgar & Philippe) - Split USB HID/HUB & update MAINTAINERS (Gerd) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmZe5FMACgkQ4+MsLN6t # wN5QghAAl1j5++wKcJaWoribnhxYctcBPhg3eEAwg2qVRbx5tz7HwYw8jYp+qB47 # abAtE3WOUg+Z+NaBi0bTj8Ns0wrBTZy0toJrQb+k5M9CzJJIFSURcFV2J40ORld8 # VHNKmzNN+ZscxAW3fSFruJlGLaskwB0bk9VF0cYSip2Y+xjbPlJZ8dlffX/HAvwB # Ul4gJW04FT3k6KoeJASNiAMm7mPW9iP4kY7rKz+j+NWydAfl8yPzxFwW6J6U2npi # Hvmy1519W74cftZSqxkBETtbw1YVKyT6QEA9HjJOjc05E6UYnxoR13taEzLNaDHA # B7Xhp6IUYZGRD1bt85WZCP5t5yUINLgmzJU2OQnv9dfU1HdSkk0FQiBr0Iif3tCI # /2cQumkGI4etXX77oVIwkioo0ZTvEggDNsN1eKHIY7yIE5etqXduPwnTfwHFI3lv # Nj18MGF0cftbYDEbUwNUnN5U6+msW3Si6hQaUxpUWXy7Idkl9pBiWjv1OpBg9PqX # YIuw9/USs7i8yZkh0/q8UcZxdzB3LF+LxjVVVoTVD6t+KbRSkJSOJm7hfqCKuXbC # lEmtLt+aH/pdZ2Banug1Ayen2L7s0czRHQWC++DfNQve1xEUkSFp5VE0mxsr+6Rp # 18/dSGo++Nh52jUt2QFEv9LyAAQCKxg72I9DW9sB7uC004+ub84= # =xcID # -----END PGP SIGNATURE----- # gpg: Signature made Tue 04 Jun 2024 04:54:27 AM CDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'hw-misc-accel-20240604' of https://github.com/philmd/qemu: (32 commits) usb: add config options for the hub and hid devices qga: Remove deprecated 'blacklist' argument / config key trace: Remove deprecated 'vcpu' field from QMP trace events hw/acpi: Remove the deprecated QAPI MEM_UNPLUG_ERROR event hw/dma/xlnx_dpdma: Read descriptor into buffer, not into pointer-to-buffer hw/misc/debugexit: use runstate API instead of plain exit() hw/xen: Register framebuffer backend via xen_backend_init() hw/xen: Make XenDevOps structures const hw/xen: Constify xenstore_be::XenDevOps hw/xen: Constify XenLegacyDevice::XenDevOps physmem: Replace check for RAMBlock offset 0 with xen_mr_is_memory physmem: Always pass offset + addr to xen_map_cache xen: Add xen_mr_is_memory() core/cpu-common: initialise plugin state before thread creation plugins: remove special casing for cpu->realized cpu-target: don't set cpu->thread_id to bogus value cpu: move Qemu[Thread|Cond] setup into common code hw/core: expand on the alignment of CPUState accel/kvm: Fix two lines with hard-coded tabs accel/tcg: Move common declarations to 'internal-common.h' ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-04Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingRichard Henderson
# -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmZewo4ACgkQ7wSWWzmN # YhHhxgf/ZaECxru4fP8wi34XdSG/PR+BF+W5M9gZIRGrHg3vIf3/LRTpZTDccbRN # Qpwtypr9O6/AWG9Os80rn7alsmMDxN8PDDNLa9T3wf5pJUQSyQ87Yy0MiuTNPSKD # HKYUIfIlbFCM5WUW4huMmg98gKTgnzZMqOoRyMFZitbkR59qCm+Exws4HtXvCH68 # 3k4lgvnFccmzO9iIzaOUIPs+Yf04Kw/FrY0Q/6nypvqbF2W80Md6w02JMQuTLwdF # Guxeg/n6g0NLvCBbkjiM2VWfTaWJYbwFSwRTAMxM/geqh7qAgGsmD0N5lPlgqRDy # uAy2GvFyrwzcD0lYqf0/fRK0Go0HPA== # =J70K # -----END PGP SIGNATURE----- # gpg: Signature made Tue 04 Jun 2024 02:30:22 AM CDT # gpg: using RSA key 215D46F48246689EC77F3562EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: ebpf: Added traces back. Changed source set for eBPF to 'system'. virtio-net: drop too short packets early ebpf: Add a separate target for skeleton ebpf: Refactor tun_rss_steering_prog() ebpf: Return 0 when configuration fails ebpf: Fix RSS error handling virtio-net: Do not write hashes to peer buffer virtio-net: Always set populate_hash virtio-net: Unify the logic to update NIC state for RSS virtio-net: Disable RSS on reset virtio-net: Shrink header byte swapping buffer virtio-net: Copy header only when necessary virtio-net: Add only one queue pair when realizing virtio-net: Do not propagate ebpf-rss-fds errors tap: Shrink zeroed virtio-net header tap: Call tap_receive_iov() from tap_receive() net: Remove receive_raw() net: Move virtio-net header length assertion tap: Remove qemu_using_vnet_hdr() tap: Remove tap_probe_vnet_hdr_len() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-04usb: add config options for the hub and hid devicesGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240530112718.1752905-3-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04hw/acpi: Remove the deprecated QAPI MEM_UNPLUG_ERROR eventPhilippe Mathieu-Daudé
The MEM_UNPLUG_ERROR event is deprecated since commit d43f1670c7 ("qapi/qdev.json: add DEVICE_UNPLUG_GUEST_ERROR QAPI event"), time to remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20240530071548.20074-2-philmd@linaro.org>
2024-06-04hw/dma/xlnx_dpdma: Read descriptor into buffer, not into pointer-to-bufferPeter Maydell
In fdf029762f501 we factored out the handling of reading and writing DMA descriptors from guest memory. Unfortunately we accidentally made the descriptor-read read the descriptor into the address of the buffer rather than into the buffer, because we didn't notice we needed to update the arguments to the dma_memory_read() call. Before the refactoring, "&desc" is the address of a local struct DPDMADescriptor variable in xlnx_dpdma_start_operation(), which is the correct target for the guest-memory-read. But after the refactoring 'desc' is the "DPDMADescriptor *desc" argument to the new function, and so it is already an address. This bug is an overrun of a stack variable, since a pointer is at most 8 bytes long and we try to read 64 bytes, as well as being incorrect behaviour. Pass 'desc' rather than '&desc' as the dma_memory_read() argument to fix this. (The same bug is not present in xlnx_dpdma_write_descriptor(), because there we are writing the descriptor from a local struct variable "DPDMADescriptor tmp_desc" and so passing &tmp_desc to dma_memory_write() is correct.) Spotted by Coverity: CID 1546649 Fixes: fdf029762f50101 ("xlnx_dpdma: fix descriptor endianness bug") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240531124628.476938-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04hw/misc/debugexit: use runstate API instead of plain exit()Thomas Weißschuh
Directly calling exit() prevents any kind of management or handling. Instead use the corresponding runstate API. The default behavior of the runstate API is the same as exit(). Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240523-debugexit-v1-1-d52fcaf7bf8b@t-8ch.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04hw/xen: Register framebuffer backend via xen_backend_init()Philippe Mathieu-Daudé
Align the framebuffer backend with the other legacy ones, register it via xen_backend_init() when '-vga xenfb' is used. It is safe because MODULE_INIT_XEN_BACKEND is called in xen_bus_realize(), long after CLI processing initialized the vga_interface_type variable. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-8-philmd@linaro.org>
2024-06-04hw/xen: Make XenDevOps structures constPhilippe Mathieu-Daudé
Keep XenDevOps structures in .rodata. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-5-philmd@linaro.org>
2024-06-04hw/xen: Constify xenstore_be::XenDevOpsPhilippe Mathieu-Daudé
XenDevOps @ops is not updated, mark it const. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-4-philmd@linaro.org>
2024-06-04hw/xen: Constify XenLegacyDevice::XenDevOpsPhilippe Mathieu-Daudé
XenDevOps @ops is not updated, mark it const. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-3-philmd@linaro.org>
2024-06-04xen: Add xen_mr_is_memory()Edgar E. Iglesias
Add xen_mr_is_memory() to abstract away tests for the xen_memory MR. No functional changes. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: David Hildenbrand <david@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240529140739.1387692-4-edgar.iglesias@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04core/cpu-common: initialise plugin state before thread creationAlex Bennée
Originally I tried to move where vCPU thread initialisation to later in realize. However pulling that thread (sic) got gnarly really quickly. It turns out some steps of CPU realization need values that can only be determined from the running vCPU thread. However having moved enough out of the thread creation we can now queue work before the thread starts (at least for TCG guests) and avoid the race between vcpu_init and other vcpu states a plugin might subscribe to. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20240530194250.1801701-6-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04cpu: move Qemu[Thread|Cond] setup into common codeAlex Bennée
Aside from the round robin threads this is all common code. By moving the halt_cond setup we also no longer need hacks to work around the race between QOM object creation and thread creation. It is a little ugly to free stuff up for the round robin thread but better it deal with its own specialises than making the other accelerators jump through hoops. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20240530194250.1801701-3-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04util/hexdump: Remove ascii parameter from qemu_hexdump_lineRichard Henderson
Split out asciidump_line as a separate function, local to hexdump.c, for use by qemu_hexdump. Use "%-*s" to generate the alignment between the hex and the ascii, rather than explicit spaces. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240412073346.458116-3-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04util/hexdump: Remove b parameter from qemu_hexdump_lineRichard Henderson
Require that the caller output the offset and increment bufptr. Use QEMU_HEXDUMP_LINE_BYTES in vhost_vdpa_dump_config instead of raw integer. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240412073346.458116-2-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04virtio-net: drop too short packets earlyAlexey Dobriyan
Reproducer from https://gitlab.com/qemu-project/qemu/-/issues/1451 creates small packet (1 segment, len = 10 == n->guest_hdr_len), then destroys queue. "if (n->host_hdr_len != n->guest_hdr_len)" is triggered, if body creates zero length/zero segment packet as there is nothing after guest header. qemu_sendv_packet_async() tries to send it. slirp discards it because it is smaller than Ethernet header, but returns 0 because tx hooks are supposed to return total length of data. 0 is propagated upwards and is interpreted as "packet has been sent" which is terrible because queue is being destroyed, nobody is waiting for TX to complete and assert it triggered. Fix is discard such empty packets instead of sending them. Length 1 packets will go via different codepath: virtqueue_push(q->tx_vq, elem, 0); virtio_notify(vdev, q->tx_vq); g_free(elem); and aren't problematic. Signed-off-by: Alexey Dobriyan <adobriyan@yandex-team.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Do not write hashes to peer bufferAkihiko Odaki
The peer buffer is qualified with const and not meant to be modified. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Always set populate_hashAkihiko Odaki
The member is not cleared during reset so may have a stale value. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Unify the logic to update NIC state for RSSAkihiko Odaki
The code to attach or detach the eBPF program to RSS were duplicated so unify them into one function to save some code. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Disable RSS on resetAkihiko Odaki
RSS is disabled by default. Fixes: 590790297c ("virtio-net: implement RSS configuration command") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Shrink header byte swapping bufferAkihiko Odaki
Byte swapping is only performed for the part of header shared with the legacy standard and the buffer only needs to cover it. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Copy header only when necessaryAkihiko Odaki
The copied header is only used for byte swapping. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Add only one queue pair when realizingAkihiko Odaki
Multiqueue usage is not negotiated yet when realizing. If more than one queue is added and the guest never requests to enable multiqueue, the extra queues will not be deleted when unrealizing and leak. Fixes: f9d6dbf0bf6e ("virtio-net: remove virtio queues if the guest doesn't support multiqueue") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04virtio-net: Do not propagate ebpf-rss-fds errorsAkihiko Odaki
Propagating ebpf-rss-fds errors has several problems. First, it makes device realization fail and disables the fallback to the conventional eBPF loading. Second, it leaks memory by making device realization fail without freeing memory already allocated. Third, the convention is to set an error when a function returns false, but virtio_net_load_ebpf_fds() and virtio_net_load_ebpf() returns false without setting an error, which is confusing. Remove the propagation to fix these problems. Fixes: 0524ea0510a3 ("ebpf: Added eBPF initialization by fds.") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-04tap: Remove qemu_using_vnet_hdr()Akihiko Odaki
Since qemu_set_vnet_hdr_len() is always called when qemu_using_vnet_hdr() is called, we can merge them and save some code. For consistency, express that the virtio-net header is not in use by returning 0 with qemu_get_vnet_hdr_len() instead of having a dedicated function, qemu_get_using_vnet_hdr(). Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2024-06-03Merge tag 'pull-riscv-to-apply-20240603' of ↵Richard Henderson
https://github.com/alistair23/qemu into staging RISC-V PR for 9.1 * APLICs add child earlier than realize * Fix exposure of Zkr * Raise exceptions on wrs.nto * Implement SBI debug console (DBCN) calls for KVM * Support 64-bit addresses for initrd * Change RISCV_EXCP_SEMIHOST exception number to 63 * Tolerate KVM disable ext errors * Set tval in breakpoints * Add support for Zve32x extension * Add support for Zve64x extension * Relax vector register check in RISCV gdbstub * Fix the element agnostic Vector function problem * Fix Zvkb extension config * Implement dynamic establishment of custom decoder * Add th.sxstatus CSR emulation * Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions * Check single width operator for vector fp widen instructions * Check single width operator for vfncvt.rod.f.f.w * Remove redudant SEW checking for vector fp narrow/widen instructions * Prioritize pmp errors in raise_mmu_exception() * Do not set mtval2 for non guest-page faults * Remove experimental prefix from "B" extension * Fixup CBO extension register calculation * Fix the hart bit setting of AIA * Fix reg_width in ricsv_gen_dynamic_vector_feature() * Decode all of the pmpcfg and pmpaddr CSRs # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmZdVzcACgkQr3yVEwxT # gBPxSBAAsuzhDCbaOl9jXhIL6Q0IDHULz4U16AZypHYID7T6rDaNoRmNVdqBKZuM # IMby8qm5XFmcUGM9itcM7IKV2BNHuWSye3/Y7GOYZQyToR7U6lvLpAm4pNj4AgTC # PLV2VPt1XLZRSthkgwp6ylBXzdNSiZMWggqTb7QbyfR5hJfG+VsZjTGaIwyZbtKI # +CJG6gZSPv6JGNtwnJq+v0VBEkj1ryo/gg2EAAzA+EWU4nw5mJCLWoDLrYZalTv9 # vCTqJuMViTjeHqAm/IIMoFzYR94+ug0usqcmnx/E7ALTOsmBh5K+KWndAW4vqAlP # mZOONfr3h7zc81jThC961kjGVPiTjTGbHHlKwlB2JEggwctcVqGRyWeM9wHSUr2W # S6F56hpForzVW9IkCt/fDUxamr23303s5miIsronrwiihqkNpxKYAuqPTXFGkFKg # ilBLGcbHcWxNmjpfIEXnTjDB6qFEceWqbjJejrsKusoSPkKQm0ktIZZUwCbTsu45 # 0ScYrBieUPjDWDFYlmWrr5byekyCXCzfpBgq8qo60FA+aP29Nx+GlFR0eWTXXY4V # O5/WTKjQM4+/uNYIuFDCFPV1Ja5GERDhXoNkjkY5ErsSZL2c2UEp3UTxzbEl5dOm # NRH7C26Z/xVMDwT08kDDq0t8Rkz4836txPO7y+aPbtvGfENRI8E= # =mtVb # -----END PGP SIGNATURE----- # gpg: Signature made Mon 03 Jun 2024 12:40:07 AM CDT # gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013 * tag 'pull-riscv-to-apply-20240603' of https://github.com/alistair23/qemu: (27 commits) disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature() target/riscv/kvm.c: Fix the hart bit setting of AIA target/riscv: rvzicbo: Fixup CBO extension register calculation target/riscv: Remove experimental prefix from "B" extension target/riscv: do not set mtval2 for non guest-page faults target/riscv: prioritize pmp errors in raise_mmu_exception() target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w target/riscv: rvv: Check single width operator for vector fp widen instructions target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions riscv: thead: Add th.sxstatus CSR emulation target/riscv: Implement dynamic establishment of custom decoder target/riscv/cpu.c: fix Zvkb extension config target/riscv: Fix the element agnostic function problem target/riscv: Relax vector register check in RISCV gdbstub target/riscv: Add support for Zve64x extension target/riscv: Add support for Zve32x extension trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint target/riscv/debug: set tval=pc in breakpoint exceptions ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-06-03hw/ufs: Add support MCQ of UFSHCI 4.0Minwoo Im
This patch adds support for MCQ defined in UFSHCI 4.0. This patch utilized the legacy I/O codes as much as possible to support MCQ. MCQ operation & runtime register is placed at 0x1000 offset of UFSHCI register statically with no spare space among four registers (48B): UfsMcqSqReg, UfsMcqSqIntReg, UfsMcqCqReg, UfsMcqCqIntReg The maxinum number of queue is 32 as per spec, and the default MAC(Multiple Active Commands) are 32 in the device. Example: -device ufs,serial=foo,id=ufs0,mcq=true,mcq-maxq=8 Signed-off-by: Minwoo Im <minwoo.im@samsung.com> Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com> Message-Id: <20240528023106.856777-3-minwoo.im@samsung.com> Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
2024-06-03hw/riscv/boot.c: Support 64-bit address for initrdCheng Yang
Use qemu_fdt_setprop_u64() instead of qemu_fdt_setprop_cell() to set the address of initrd in FDT to support 64-bit address. Signed-off-by: Cheng Yang <yangcheng.work@foxmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <tencent_A4482251DD0890F312758FA6B33F60815609@qq.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-06-03hw/intc/riscv_aplic: APLICs should add child earlier than realizeyang.zhang
Since only root APLICs can have hw IRQ lines, aplic->parent should be initialized first. Fixes: e8f79343cf ("hw/intc: Add RISC-V AIA APLIC device emulation") Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Signed-off-by: yang.zhang <yang.zhang@hexintek.com> Cc: qemu-stable <qemu-stable@nongnu.org> Message-ID: <20240409014445.278-1-gaoshanliukou@163.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-05-31hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUTDavid Hubbard
This changes the ohci validation to not assert if invalid data is fed to the ohci controller. The poc in https://bugs.launchpad.net/qemu/+bug/1907042 and migrated to bug #303 does the following to feed it a SETUP pid (valid) at an EndPt of 1 (invalid - all SETUP pids must be addressed to EndPt 0): uint32_t MaxPacket = 64; uint32_t TDFormat = 0; uint32_t Skip = 0; uint32_t Speed = 0; uint32_t Direction = 0; /* #define OHCI_TD_DIR_SETUP 0 */ uint32_t EndPt = 1; uint32_t FuncAddress = 0; ed->attr = (MaxPacket << 16) | (TDFormat << 15) | (Skip << 14) | (Speed << 13) | (Direction << 11) | (EndPt << 7) | FuncAddress; ed->tailp = /*TDQTailPntr= */ 0; ed->headp = ((/*TDQHeadPntr= */ &td[0]) & 0xfffffff0) | (/* ToggleCarry= */ 0 << 1); ed->next_ed = (/* NextED= */ 0 & 0xfffffff0) qemu-fuzz also caught the same issue in #1510. They are both fixed by this patch. With a tiny OS[1] that boots and executes the poc the repro shows the issue: * OS that sends USB requests to a USB mass storage device but sends a SETUP with EndPt = 1 * qemu 6.2.0 (Debian 1:6.2+dfsg-2ubuntu6.19) * qemu HEAD (4e66a0854) * Actual OHCI controller (hardware) Command line: qemu-system-x86_64 -m 20 \ -device pci-ohci,id=ohci \ -drive if=none,format=raw,id=d,file=testmbr.raw \ -device usb-storage,bus=ohci.0,drive=d \ --trace "usb_*" --trace "ohci_*" -D qemu.log Results are: qemu 6.2.0 | qemu HEAD | actual HW ------------+-----------+---------------- assertion | assertion | sets stall bit The assertion message is: > qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. > Aborted (core dumped) Tip: if the flags "-serial pty -serial stdio" are added to the command line the poc outputs its USB requests like this: > Free mem 2M ohci port0 conn FS > setup { 80 6 0 1 0 0 8 0 } > ED info=80000 { mps=8 en=0 d=0 } tail=c20920 > td0 c20880 nxt=c20960 f2000000 setup cbp=c20900 be=c20907 cbp=0 be=c20907 > td1 c20960 nxt=c20980 f3140000 in cbp=c20908 be=c2090f cbp=0 be=c2090f > td2 c20980 nxt=c20920 f3080000 out cbp=0 be=0 cbp=0 be=0 > rx { 12 1 0 2 0 0 0 8 } > setup { 0 5 1 0 0 0 0 0 } tx {} > ED info=80000 { mps=8 en=0 d=0 } tail=c20880 > td0 c20920 nxt=c20960 f2000000 setup cbp=c20900 be=c20907 cbp=0 be=c20907 > td1 c20960 nxt=c20880 f3100000 in cbp=0 be=0 cbp=0 be=0 > setup { 80 6 0 1 0 0 12 0 } > ED info=80081 { mps=8 en=0 d=1 } tail=c20960 > td0 c20880 nxt=c209c0 f2000000 setup cbp=c20920 be=c20927 > td1 c209c0 nxt=c209e0 f3140000 in cbp=c20928 be=c20939 > td2 c209e0 nxt=c20960 f3080000 out cbp=0 be=0qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. > Aborted (core dumped) [1] The OS disk image has been emailed to philmd@linaro.org, mjt@tls.msk.ru, and kraxel@redhat.com: * testBadSetup.img.xz * sha256: 045b43f4396de02b149518358bf8025d5ba11091e86458875339fc649e6e5ac6 Signed-off-by: David Hubbard <dmamfmgm@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: authorship and signed-off-by tag names fixed up as per on-list agreement] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-30arm/sbsa-ref: move to Neoverse-N2 as defaultMarcin Juszkiewicz
Moving to Neoverse-N2 gives us several cpu features to use for expanding our platform: - branch target identification - pointer authentication - RME for confidential computing - RNG for EFI_PROTOCOL_RNG - SVE being enabled by default We do not go for "max" as default to have stable set of features enabled by default. It is still supported and can be selected with "--cpu" argument. Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com> Message-id: 20240523165353.6547-1-marcin.juszkiewicz@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-30hw/arm/xilinx_zynq: Support up to two CPU coresSebastian Huber
The Zynq 7000 SoCs contain two Arm Cortex-A9 MPCore (the Zynq 7000S have only one core). Add support for up to two simulated cores. Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de> Message-id: 20240524120837.10057-3-sebastian.huber@embedded-brains.de Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: removed unnecessary double-cast] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-30hw/arm/xilinx_zynq: Add cache controllerSebastian Huber
The Zynq 7000 SoCs contain a CoreLink L2C-310 cache controller. Add the corresponding Qemu device to the xilinx-zynq-a9 machine. Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de> Message-id: 20240524120837.10057-2-sebastian.huber@embedded-brains.de Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-30hw/intc/arm_gic: Fix writes to GICD_ITARGETSRnSebastian Huber
According to the GICv2 specification section 4.3.12, "Interrupt Processor Targets Registers, GICD_ITARGETSRn": "Any change to a CPU targets field value: [...] * Has an effect on any pending interrupts. This means: - adding a CPU interface to the target list of a pending interrupt makes that interrupt pending on that CPU interface - removing a CPU interface from the target list of a pending interrupt removes the pending state of that interrupt on that CPU interface." Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de> Message-id: 20240524113256.8102-3-sebastian.huber@embedded-brains.de Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-30hw/intc/arm_gic: Fix set pending of PPIsSebastian Huber
According to the GICv2 specification section 4.3.7, "Interrupt Set-Pending Registers, GICD_ISPENDRn": "In a multiprocessor implementation, GICD_ISPENDR0 is banked for each connected processor. This register holds the Set-pending bits for interrupts 0-31." Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de> Message-id: 20240524113256.8102-2-sebastian.huber@embedded-brains.de Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 21:18:39 +0000