Longpeng(Mike) [Tue, 22 Feb 2022 14:11:15 +0000 (22:11 +0800)]
kvm-irqchip: introduce new API to support route change
Paolo suggested adding the new API to support route changes [1]. We should invoke
kvm_irqchip_begin_route_changes() before changing the routes, increasing the
KVMRouteChange.changes if the routes are changed, and commit the changes at last.
Ivan Shcherbakov [Wed, 23 Feb 2022 05:18:00 +0000 (21:18 -0800)]
whpx: Fixed incorrect CR8/TPR synchronization
This fixes the following error triggered when stopping and resuming a 64-bit
Linux kernel via gdb:
qemu-system-x86_64.exe: WHPX: Failed to set virtual processor context, hr=c0350005
The previous logic for synchronizing the values did not take into account
that the lower 4 bits of the CR8 register, containing the priority level,
mapped to bits 7:4 of the APIC.TPR register (see section 10.8.6.1 of
Volume 3 of Intel 64 and IA-32 Architectures Software Developer's Manual).
The caused WHvSetVirtualProcessorRegisters() to fail with an error,
effectively preventing GDB from changing the guest context.
Signed-off-by: Ivan Shcherbakov <ivan@sysprogs.com>
Message-Id: <010b01d82874$bb4ef160$31ecd420$@sysprogs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Ivan Shcherbakov [Wed, 23 Feb 2022 05:15:41 +0000 (21:15 -0800)]
whpx: Fixed reporting of the CPU context to GDB for 64-bit
Make sure that pausing the VM while in 64-bit mode will set the
HF_CS64_MASK flag in env->hflags (see x86_update_hflags() in
target/i386/cpu.c).
Without it, the code in gdbstub.c would only use the 32-bit register values
when debugging 64-bit targets, making debugging effectively impossible.
Signed-off-by: Ivan Shcherbakov <ivan@sysprogs.com>
Message-Id: <00f701d82874$68b02000$3a106000$@sysprogs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Peter Maydell [Tue, 15 Mar 2022 09:53:13 +0000 (09:53 +0000)]
Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging
# gpg: Signature made Tue 15 Mar 2022 05:58:55 GMT
# gpg: using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211
* tag 'net-pull-request' of https://github.com/jasowang/qemu:
vdpa: Expose VHOST_F_LOG_ALL on SVQ
vdpa: Never set log_base addr if SVQ is enabled
vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
vdpa: Add custom IOTLB translations to SVQ
vhost: Add VhostIOVATree
util: add iova_tree_find_iova
util: Add iova_tree_alloc_map
vhost: Shadow virtqueue buffers forwarding
vdpa: adapt vhost_ops callbacks to svq
virtio: Add vhost_svq_get_vring_addr
vhost: Add vhost_svq_valid_features to shadow vq
vhost: Add Shadow VirtQueue call forwarding capabilities
vhost: Add Shadow VirtQueue kick forwarding capabilities
vhost: Add VhostShadowVirtqueue
virtio-net: fix map leaking on error during receive
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
ui/console: call gfx_switch() even if the current scanout is GL
egl-headless depends on the backing surface to be set before texture are
set and updated. Display it (update=true) iff the current scanout kind
is SURFACE.
gfx_switch() is called to set the new_surface, not necessarily to
display it. It should be displayed after gfx_update(). Send the whole
scanout only in this case.
The DBus listener naively create, update and destroy textures without
taking into account other listeners. The texture were shared, but
texture update was unnecessarily duplicated.
Teach DisplayGLCtx to do optionally shared texture handling. This is
only implemented for DBus display at this point, however the same
infrastructure could potentially be used for other future combinations.
Gerd Hoffmann [Tue, 8 Mar 2022 09:55:19 +0000 (10:55 +0100)]
tests/acpi: allow virt memory hotplug changes
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:54 +0000 (18:34 +0100)]
vdpa: Expose VHOST_F_LOG_ALL on SVQ
SVQ is able to log the dirty bits by itself, so let's use it to not
block migration.
Also, ignore set and clear of VHOST_F_LOG_ALL on set_features if SVQ is
enabled. Even if the device supports it, the reports would be nonsense
because SVQ memory is in the qemu region.
The log region is still allocated. Future changes might skip that, but
this series is already long enough.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:52 +0000 (18:34 +0100)]
vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
This is needed to achieve migration, so the destination can restore its
index.
Setting base as last used idx, so destination will see as available all
the entries that the device did not use, including the in-flight
processing ones.
This is ok for networking, but other kinds of devices might have
problems with these retransmissions.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:51 +0000 (18:34 +0100)]
vdpa: Add custom IOTLB translations to SVQ
Use translations added in VhostIOVATree in SVQ.
Only introduce usage here, not allocation and deallocation. As with
previous patches, we use the dead code paths of shadow_vqs_enabled to
avoid commiting too many changes at once. These are impossible to take
at the moment.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:50 +0000 (18:34 +0100)]
vhost: Add VhostIOVATree
This tree is able to look for a translated address from an IOVA address.
At first glance it is similar to util/iova-tree. However, SVQ working on
devices with limited IOVA space need more capabilities, like allocating
IOVA chunks or performing reverse translations (qemu addresses to iova).
The allocation capability, as "assign a free IOVA address to this chunk
of memory in qemu's address space" allows shadow virtqueue to create a
new address space that is not restricted by guest's addressable one, so
we can allocate shadow vqs vrings outside of it.
It duplicates the tree so it can search efficiently in both directions,
and it will signal overlap if iova or the translated address is present
in any tree.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:48 +0000 (18:34 +0100)]
util: Add iova_tree_alloc_map
This iova tree function allows it to look for a hole in allocated
regions and return a totally new translation for a given translated
address.
It's usage is mainly to allow devices to access qemu address space,
remapping guest's one into a new iova space where qemu can add chunks of
addresses.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:47 +0000 (18:34 +0100)]
vhost: Shadow virtqueue buffers forwarding
Initial version of shadow virtqueue that actually forward buffers. There
is no iommu support at the moment, and that will be addressed in future
patches of this series. Since all vhost-vdpa devices use forced IOMMU,
this means that SVQ is not usable at this point of the series on any
device.
For simplicity it only supports modern devices, that expects vring
in little endian, with split ring and no event idx or indirect
descriptors. Support for them will not be added in this series.
It reuses the VirtQueue code for the device part. The driver part is
based on Linux's virtio_ring driver, but with stripped functionality
and optimizations so it's easier to review.
However, forwarding buffers have some particular pieces: One of the most
unexpected ones is that a guest's buffer can expand through more than
one descriptor in SVQ. While this is handled gracefully by qemu's
emulated virtio devices, it may cause unexpected SVQ queue full. This
patch also solves it by checking for this condition at both guest's
kicks and device's calls. The code may be more elegant in the future if
SVQ code runs in its own iocontext.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:46 +0000 (18:34 +0100)]
vdpa: adapt vhost_ops callbacks to svq
First half of the buffers forwarding part, preparing vhost-vdpa
callbacks to SVQ to offer it. QEMU cannot enable it at this moment, so
this is effectively dead code at the moment, but it helps to reduce
patch size.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:45 +0000 (18:34 +0100)]
virtio: Add vhost_svq_get_vring_addr
It reports the shadow virtqueue address from qemu virtual address space.
Since this will be different from the guest's vaddr, but the device can
access it, SVQ takes special care about its alignment & lack of garbage
data. It assumes that IOMMU will work in host_page_size ranges for that.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:44 +0000 (18:34 +0100)]
vhost: Add vhost_svq_valid_features to shadow vq
This allows SVQ to negotiate features with the guest and the device. For
the device, SVQ is a driver. While this function bypasses all
non-transport features, it needs to disable the features that SVQ does
not support when forwarding buffers. This includes packed vq layout,
indirect descriptors or event idx.
Future changes can add support to offer more features to the guest,
since the use of VirtQueue gives this for free. This is left out at the
moment for simplicity.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Eugenio Pérez [Mon, 14 Mar 2022 17:34:41 +0000 (18:34 +0100)]
vhost: Add VhostShadowVirtqueue
Vhost shadow virtqueue (SVQ) is an intermediate jump for virtqueue
notifications and buffers, allowing qemu to track them. While qemu is
forwarding the buffers and virtqueue changes, it is able to commit the
memory it's being dirtied, the same way regular qemu's VirtIO devices
do.
This commit only exposes basic SVQ allocation and free. Next patches of
the series add functionality like notifications and buffers forwarding.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Jason Wang [Tue, 8 Mar 2022 02:42:51 +0000 (10:42 +0800)]
virtio-net: fix map leaking on error during receive
Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
tries to fix the use after free of the sg by caching the virtqueue
elements in an array and unmap them at once after receiving the
packets, But it forgot to unmap the cached elements on error which
will lead to leaking of mapping and other unexpected results.
Fixing this by detaching the cached elements on error. This addresses
CVE-2022-26353.
Reported-by: Victor Tom <vv474172261@gmail.com> Cc: qemu-stable@nongnu.org Fixes: CVE-2022-26353 Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg") Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Peter Maydell [Mon, 14 Mar 2022 18:11:36 +0000 (18:11 +0000)]
Merge tag 'pull-tcg-20220314' of https://gitlab.com/rth7680/qemu into staging
Fixes for s390x host vectors
Fix for arm ldrd unpredictable case
# gpg: Signature made Mon 14 Mar 2022 17:32:44 GMT
# gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg: issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F
* tag 'pull-tcg-20220314' of https://gitlab.com/rth7680/qemu:
tcg/arm: Don't emit UNPREDICTABLE LDRD with Rm == Rt or Rt+1
tcg/s390x: Fix tcg_out_dup_vec vs general registers
tcg/s390x: Fix INDEX_op_bitsel_vec vs VSEL
tcg/s390x: Fix tcg_out_dupi_vec vs VGM
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
tcg/arm: Don't emit UNPREDICTABLE LDRD with Rm == Rt or Rt+1
The LDRD (register) instruction is UNPREDICTABLE if the Rm register
is the same as either Rt or Rt+1 (the two registers being loaded to).
We weren't making sure we avoided this, with the result that on some
host CPUs like the Cortex-A7 we would get a SIGILL because the CPU
chooses to UNDEF for this particular UNPREDICTABLE case.
Since we've already checked that datalo is aligned, we can simplify
the test vs the Rm operand by aligning it before comparison. Check
for the two orderings before falling back to two ldr instructions.
We don't bother to do anything similar for tcg_out_ldrd_rwb(),
because it is only used in tcg_out_tlb_read() with a fixed set of
registers which don't overlap.
There is no equivalent UNPREDICTABLE case for STRD.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/896 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
tcg/s390x: Fix tcg_out_dup_vec vs general registers
We copied the data from the general register input to the
vector register output, but have not yet replicated it.
We intended to fall through into the vector-vector case,
but failed to redirect the input register.
This is caught by an assertion failure in tcg_out_insn_VRIc,
which diagnosed the incorrect register class.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Cédric Le Goater [Mon, 14 Mar 2022 14:57:17 +0000 (15:57 +0100)]
ppc/pnv: Remove user-created PHB{3,4,5} devices
On a real system with POWER{8,9,10} processors, PHBs are sub-units of
the processor, they can be deactivated by firmware but not plugged in
or out like a PCI adapter on a slot. Nevertheless, having user-created
PHBs in QEMU seemed to be a good idea for testing purposes :
1. having a limited set of PHBs speedups boot time.
2. it is useful to be able to mimic a partially broken topology you
some time have to deal with during bring-up.
PowerNV is also used for distro install tests and having libvirt
support eases these tasks. libvirt prefers to run the machine with
-nodefaults to be sure not to drag unexpected devices which would need
to be defined in the domain file without being specified on the QEMU
command line. For this reason :
3. -nodefaults should not include default PHBs
User-created PHB{3,4,5} devices satisfied all these needs but reality
proves to be a bit more complex, internally when modeling such
devices, and externally when dealing with the user interface.
Req 1. and 2. can be simply addressed differently with a machine option:
"phb-mask=<uint>", which QEMU would use to enable/disable PHB device
nodes when creating the device tree.
For Req 3., we need to make sure we are taking the right approach. It
seems that we should expose a new type of user-created PHB device, a
generic virtualized one, that libvirt would use and not one depending
on the processor revision. This needs more thinking.
For now, remove user-created PHB{3,4,5} devices. All the cleanups we
did are not lost and they will be useful for the next steps.
Fixes: 5bc67b052b51 ("ppc/pnv: Introduce user creatable pnv-phb4 devices") Fixes: 1f6a88fffc75 ("ppc/pnv: Introduce support for user created PHB3 devices") Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220314130514.529931-1-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Frederic Barrat [Mon, 14 Mar 2022 14:57:17 +0000 (15:57 +0100)]
ppc/pnv: Always create the PHB5 PEC devices
Always create the PECs (PCI Express Controller) for the system. The
PECs host the PHBs and we try to find the matching PEC when creating a
PHB, so it must exist. It also matches what we do on POWER9
Fixes: 623575e16cd5 ("ppc/pnv: Add model for POWER10 PHB5 PCIe Host bridge") Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: - Rewored commit log
- Removed dynamic PHB5 ]
Message-Id: <20220310155101.294568-3-fbarrat@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Frederic Barrat [Mon, 14 Mar 2022 14:57:17 +0000 (15:57 +0100)]
ppc/pnv: Introduce a pnv-phb5 device to match root port
We already have the pnv-phb3 and pnv-phb4 devices for POWER8 and
POWER9 respectively. POWER10 uses version 5 of the PHB. It is very
close to the PHB4 from POWER9, at least in our model and we could
almost keep using the PHB4 model. However the matching root port
pnv-phb5-root-port is specific to POWER10 so to avoid confusion as
well as making it easy to introduce differences later, we create a
pnv-phb5 class, which is mostly an alias for pnv-phb4 for now.
With this patch, the command line for a user-created PHB on powernv10
becomes:
-machine powernv10 -nodefaults -device pnv-phb5 -device pnv-phb5-root-port
Fixes: 623575e16cd5 ("ppc/pnv: Add model for POWER10 PHB5 PCIe Host bridge") Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220310155101.294568-2-fbarrat@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Leandro Lupori [Mon, 14 Mar 2022 14:57:17 +0000 (15:57 +0100)]
target/ppc: fix ISI fault cause for Radix MMU
Fix Instruction Storage Interrupt (ISI) fault cause for Radix MMU,
when caused by missing PAGE_EXEC permission, to be
SRR1_NOEXEC_GUARD instead of DSISR_PROTFAULT.
This matches POWER9 hardware behavior.
We don't have a way of telling which KVM module is loaded in a Power
host (kvm_hv or kvm_pr). For now let's make all the tests of this
file depend on TCG support.
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20220310183011.110391-6-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
avocado/ppc_405.py: check TCG accel in test_ppc_ref405ep()
Running this test without TCG support in an IBM POWER server results
in the following error:
Command: ./qemu-system-ppc -display none -vga none (...)
-machine ref405ep (...)
Output: qemu-system-ppc: Register sync failed... If you're using
kvm-hv.ko, only "-cpu host" is possible
qemu-system-ppc: kvm_init_vcpu: kvm_arch_init_vcpu failed (0): Invalid argument
Although the host is running kvm_hv we don't have a way of differentiate
between kvm_hv and kvm_pr, meaning that this test would've failed in the
same way if kvm_pr was the KVM module loaded in the host.
Since we don't have a way of checking which KVM module is being loaded
when using avocado, make a TCG accel check in test_ppc_ref405ep().
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20220310183011.110391-5-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
avocado/boot_linux_console.py: check TCG accel in test_ppc_mac99()
This test breaks when run in an IBM POWER host with a QEMU compiled
with --disable-tcg and the ppc-softmmu target in a similar manner as
test_ppc_g3beige did.
There's also an observation made about kvm_pr in the error message:
The host was running kvm_hv, not kvm_pr, and the machine failed to load.
Unfortunately we don't have a way to detect whether the KVM module loaded
is kvm_hv or kvm_pr - we do a check for /dev/kvm to detect KVM support but
both modules create this file so that's not helpful.
Let's skip this test for now until we have a way of detecting kvm_pr support in the host.
Reported-by: Murilo Opsfelder Araujo <muriloo@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20220310183011.110391-2-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
avocado/replay_kernel.py: make tcg-icount check in run_vm()
The icount framework relies on TCG availability. If QEMU is built with
--disable-tcg we won't have icount either, and then this test will fail
with the following message in an IBM POWER9 host:
tests/avocado/replay_kernel.py:ReplayKernelNormal.test_ppc64_pseries:
ERROR: ConnectError: Failed to establish session:
(...)
/11-tests_avocado_replay_kernel.py_ReplayKernelNormal.test_ppc64_pseries/replay.bin:
cannot configure icount, TCG support not available
Although this was revealed in a specific ppc64 scenario, the TCG check
is being done in the common code inside run_vm() because all archs need
TCG to have access to icount.
Cc: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220303153517.168943-6-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
avocado/boot_linux_console.py: check for tcg in test_ppc_powernv8/9
The PowerNV8/9 machines does not work with KVM acceleration, meaning
that boot_linux_console.py:BootLinuxConsole.test_ppc_powernv8/9 tests
will always fail when QEMU is compiled with --disable-tcg:
ERROR 1-tests/avocado/boot_linux_console.py:BootLinuxConsole.test_ppc_powernv8
-> VMLaunchFailure: ConnectError: Failed to establish session:
[Errno 104] Connection reset by peer
Exit code: 1
Command: ./qemu-system-ppc64 -display none -vga none -chardev socket,id=mon,path=/var/tmp/avo_qemu_sock_no19zg0m/qemu-1936936-7fffa77cff98-monitor.sock -mon chardev=mon,mode=control -machine powernv8 -chardev socket,id=console,path=/var/tmp/avo_qemu_sock_no19zg0m/qemu-1936936-7fffa77cff98-console.sock,server=on,wait=off -serial chardev:console -kernel /home/danielhb/avocado/data/cache/by_location/4514304e2c4ee84c5f0b5c8bacedda783891df68/zImage.epapr -append console=tty0 console=hvc0 -device pcie-pci-bridge,id=bridge1,bus=pcie.1,addr=0x0 -device nvme,bus=pcie.2,addr=0x0,serial=1234 -device e1000e,bus=bridge1,addr=0x3 -device nec-usb-xhci,bus=bridge1,addr=0x2
Output: qemu-system-ppc64: The powernv machine does not work with KVM acceleration
Let's add the TCG accel requirement in both tests to skip them if we
don't have TCG support available.
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20220303153517.168943-4-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
qtest/meson.build: check CONFIG_TCG for boot-serial-test in qtests_ppc
'boot-serial-test' does not work with a QEMU built with --disable-tcg in
a IBM POWER9 host. The reason is that without TCG QEMU will default to
KVM acceleration, but then the KVM module in IBM POWER hosts aren't able
to handle other CPUs.
The result is that the test will break with a KVM error when trying to
ruin the ppce500 test:
Fix it by checking CONFIG_TCG before compiling boot-serial-test.
Cc: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220303153517.168943-3-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Fix it by checking CONFIG_TCG before compiling prom-env-test.
Cc: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220303153517.168943-2-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Peter Maydell [Mon, 14 Mar 2022 14:39:33 +0000 (14:39 +0000)]
Merge tag 'i2c-20220314' of https://github.com/philmd/qemu into staging
I2C patch queue
- Fix AT24 EEPROM partial write (Patrick Venture)
# gpg: Signature made Mon 14 Mar 2022 13:50:01 GMT
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'i2c-20220314' of https://github.com/philmd/qemu:
hw/nvram: at24 return 0xff if 1 byte address
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Patrick Venture [Mon, 20 Dec 2021 21:21:37 +0000 (13:21 -0800)]
hw/nvram: at24 return 0xff if 1 byte address
The at24 eeproms are 2 byte devices that return 0xff when they are read
from with a partial (1-byte) address written. This distinction was
found comparing model behavior to real hardware testing.
Tested: `i2ctransfer -f -y 45 w1@85 0 r1` returns 0xff instead of next
byte
Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211220212137.1244511-1-venture@google.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
ui/console: move console compatibility check to dcl_display_console()
The current checks are done at registration time only. However, if a DCL
has no specific console specified, it may be switched dynamically with
console_select() later on.
Let's move the checks when displaychangelistener_display_console() is
called, which includes registration time and remains fatal if the
specified console is incompatible.
Note: we may want to display the compatibility error to the DCL, this is
left for a future improvement.
ui/console: move dcl compatiblity check to a callback
As expected from the "compatible_dcl" comment, a simple comparison of
ops isn't enough. The following patch will fix a regression introduced
by this limited check by extending the compatibility callback for
egl-headless.
For now, this patch simply replaces the the "compatible_dcl" ops pointer
with a "dpy_gl_ctx_is_compatible_ctx" callback.
Peter Maydell [Sun, 13 Mar 2022 17:29:18 +0000 (17:29 +0000)]
Merge remote-tracking branch 'remotes/quic/tags/pull-hex-20220312-1' into staging
Hexagon bug fixes and additional tests
Also includes a patch from Zongyuan Li <zongyuan.li@smartx.com> to remove an unused variable
******** Changes in v2 ********
Fix problems with build-user-hexagon CI job
# gpg: Signature made Sat 12 Mar 2022 20:09:29 GMT
# gpg: using RSA key 3635C788CE62B91FD4C59AB47B0244FB12DE4422
# gpg: Good signature from "Taylor Simpson (Rock on) <tsimpson@quicinc.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 3635 C788 CE62 B91F D4C5 9AB4 7B02 44FB 12DE 4422
* remotes/quic/tags/pull-hex-20220312-1:
target/hexagon: remove unused variable
Hexagon (target/hexagon) assignment to c4 should wait until packet commit
Hexagon (target/hexagon) fix bug in conv_df2uw_chop
Hexagon (tests/tcg/hexagon) fix inline asm in preg_alias.c
Hexagon (tests/tcg/hexagon) update overflow test
Hexagon (tests/tcg/hexagon) add floating point instructions to usr.c
Hexagon (tests/tcg/hexagon) test instructions that might set bits in USR
Hexagon (target/hexagon) properly handle NaN in dfmin/dfmax/sfmin/sfmax
Hexagon (target/hexagon) properly handle denorm in arch_sf_recip_common
Hexagon (target/hexagon) properly set FPINVF bit in sfcmp.uo and dfcmp.uo
Hexagon HVX (target/hexagon) fix bug in HVX saturate instructions
Hexagon (target/hexagon) fix bug in circular addressing
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Zongyuan Li [Mon, 24 Jan 2022 06:43:39 +0000 (14:43 +0800)]
target/hexagon: remove unused variable
When building with clang version 13.0.0 (eg. Fedora 13.0.0-3.fc35),
two unused variables introduced by macro GATHER_FUNCTION and
SCATTER_FUNCTION will cause building process failure due to
[-Werror -Wunused-variable].
Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/831
Message-Id: <20220124064339.56027-1-zongyuan.li@smartx.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Taylor Simpson [Thu, 10 Feb 2022 02:15:56 +0000 (18:15 -0800)]
Hexagon (target/hexagon) assignment to c4 should wait until packet commit
On Hexagon, c4 is an alias for predicate registers P3:0. If we assign to
c4 inside a packet with reads from predicate registers, the predicate
reads should get the old values.
Test case added to tests/tcg/hexagon/preg_alias.c
Co-authored-by: Michael Lambert <mlambert@cuicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-13-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:54 +0000 (18:15 -0800)]
Hexagon (target/hexagon) fix bug in conv_df2uw_chop
Fix typo that checked for 32 bit nan instead of 64 bit
Test case added in tests/tcg/hexagon/usr.c
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-11-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:53 +0000 (18:15 -0800)]
Hexagon (tests/tcg/hexagon) fix inline asm in preg_alias.c
Replace consecutive inline asm blocks with a single one with proper
outputs/inputs/clobbers rather than making assumptions about register
values being carried between separate blocks.
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-10-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:52 +0000 (18:15 -0800)]
Hexagon (tests/tcg/hexagon) update overflow test
Add a test that sets USR multiple times in a packet
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-9-tsimpson@quicinc.com> Acked-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:51 +0000 (18:15 -0800)]
Hexagon (tests/tcg/hexagon) add floating point instructions to usr.c
Tests to confirm floating point instructions are properly
setting exception bits in USR
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-8-tsimpson@quicinc.com> Acked-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:50 +0000 (18:15 -0800)]
Hexagon (tests/tcg/hexagon) test instructions that might set bits in USR
Hexagon has ~200 instructions that set the saturate bit in USR, these
were broken into groups of similar instructions and one instruction
from each group is tested with at least one input that does not
saturate and at least one input that does saturate.
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-7-tsimpson@quicinc.com> Acked-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Wed, 16 Feb 2022 04:39:39 +0000 (20:39 -0800)]
Hexagon (target/hexagon) properly handle NaN in dfmin/dfmax/sfmin/sfmax
The float??_minnum implementation differs from Hexagon for SNaN,
it returns NaN, but Hexagon returns the other input. So, we use
float??_minimum_number.
Test cases added to tests/tcg/hexagon/fpstuff.c
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220308190410.22355-1-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:49 +0000 (18:15 -0800)]
Hexagon (target/hexagon) properly handle denorm in arch_sf_recip_common
The arch_sf_recip_common function was calling float32_getexp which
adjusts for denorm, but the we actually need the raw exponent bits.
This function is called from 3 instructions
sfrecipa
sffixupn
sffixupd
Test cases added to tests/tcg/hexagon/fpstuff.c
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-6-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:47 +0000 (18:15 -0800)]
Hexagon (target/hexagon) properly set FPINVF bit in sfcmp.uo and dfcmp.uo
Instead of checking for nan arguments, use float??_unordered_quiet
test cases added in a subsequent patch to more extensively test USR bits
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-4-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Taylor Simpson [Thu, 10 Feb 2022 02:15:46 +0000 (18:15 -0800)]
Hexagon HVX (target/hexagon) fix bug in HVX saturate instructions
Two tests added to tests/tcg/hexagon/hvx_misc.c
v21.uw = vadd(v11.uw, v10.uw):sat
v25:24.uw = vsub(v17:16.uw, v27:26.uw):sat
Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-3-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Michael Lambert [Thu, 10 Feb 2022 02:15:45 +0000 (18:15 -0800)]
Hexagon (target/hexagon) fix bug in circular addressing
Versions V3 and earlier should treat the "K_const" and "length" values
as unsigned.
Modified circ_test_v3() in tests/tcg/hexagon/circ.c to reproduce the bug
Signed-off-by: Michael Lambert <mlambert@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com>
Message-Id: <20220210021556.9217-2-tsimpson@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Peter Maydell [Thu, 10 Mar 2022 13:16:37 +0000 (13:16 +0000)]
Merge remote-tracking branch 'remotes/mcayland/tags/q800-updates-for-7.0-20220309' into staging
q800-updates-for-7.0 queue
# gpg: Signature made Wed 09 Mar 2022 10:57:07 GMT
# gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F
# gpg: issuer "mark.cave-ayland@ilande.co.uk"
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full]
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F
* remotes/mcayland/tags/q800-updates-for-7.0-20220309: (22 commits)
esp: recreate ESPState current_req after migration
esp: include the current PDMA callback in the migration stream
esp: convert ESPState pdma_cb from a function pointer to an integer
esp: introduce esp_pdma_cb() function
esp: introduce esp_set_pdma_cb() function
macfb: set initial value of mode control registers in macfb_common_realize()
macfb: add VMStateDescription fields for display type and VBL timer
macfb: increase number of registers saved in MacfbState
macfb: don't use special irq_state and irq_mask variables in MacfbState
macfb: add VMStateDescription for MacfbNubusState and MacfbSysBusState
macio/pmu.c: remove redundant code
mos6522: implement edge-triggering for CA1/2 and CB1/2 control line IRQs
mac_via: make SCSI_DATA (DRQ) bit live rather than latched
mos6522: record last_irq_levels in mos6522_set_irq()
mos6522: add "info via" HMP command for debugging
mos6522: add register names to register read/write trace events
mos6522: use device_class_set_parent_reset() to propagate reset to parent
mos6522: remove update_irq() and set_sr_int() methods from MOS6522DeviceClass
mos6522: switch over to use qdev gpios for IRQs
mac_via: use IFR bit flag constants for VIA2 IRQs
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 9 Mar 2022 21:16:27 +0000 (21:16 +0000)]
Merge remote-tracking branch 'remotes/philmd/tags/pmbus-20220308' into staging
I²C / SMBus / PMBus patches
- Add some Renesas models
- Add Titus Rwantare to MAINTAINERS
# gpg: Signature made Tue 08 Mar 2022 18:11:46 GMT
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* remotes/philmd/tags/pmbus-20220308:
hw/sensor: add Renesas raa228000 device
hw/sensor: add Renesas raa229004 PMBus device
hw/sensor: add Intersil ISL69260 device model
hw/i2c: Added linear mode translation for pmbus devices
hw/i2c: pmbus: update MAINTAINERS
hw/i2c: pmbus: refactor uint handling
hw/i2c: pmbus: add PEC unsupported warning
hw/i2c: pmbus: fix error returns and guard against out of range accesses
hw/i2c: pmbus: add registers
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* remotes/lvivier-gitlab/tags/linux-user-for-7.0-pull-request:
tests/tcg/ppc64le: change signal_save_restore_xer to use SIGTRAP
linux-user/ppc: deliver SIGTRAP on POWERPC_EXCP_TRAP
linux-user: Remove stale "not threadsafe" comments
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 9 Mar 2022 18:06:40 +0000 (18:06 +0000)]
Merge remote-tracking branch 'remotes/legoater/tags/pull-aspeed-20220308' into staging
aspeed queue:
* Fix for a potential memory leak
* Aspeed SMC cleanups on the definition of the number of flash devices
* New bletchley-bmc machine, AST2600 based
# gpg: Signature made Tue 08 Mar 2022 08:19:25 GMT
# gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1
* remotes/legoater/tags/pull-aspeed-20220308:
hw: aspeed_gpio: Cleanup stray semicolon after switch
hw/arm/aspeed: add Bletchley machine type
hw/arm/aspeed: allow missing spi_model
hw/block: m25p80: Add support for w25q01jvq
aspeed/smc: Fix error log
aspeed/smc: Let the SSI core layer define the bus name
aspeed/smc: Rename 'max_peripherals' to 'cs_num_max'
aspeed/smc: Remove 'num_cs' field
aspeed: Rework aspeed_board_init_flashes() interface
aspeed/smc: Use max number of CE instead of 'num_cs'
aspeed: Fix a potential memory leak bug in write_boot_rom()
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 9 Mar 2022 11:38:29 +0000 (11:38 +0000)]
Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2022-03-07' into staging
nbd patches for 2022-03-07
- Dan Berrange: Allow qemu-nbd to support TLS over Unix sockets
- Eric Blake: Minor cleanups related to 64-bit block operations
# gpg: Signature made Tue 08 Mar 2022 01:41:35 GMT
# gpg: using RSA key 71C2CC22B1C4602927D2F3AAA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>" [full]
# gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" [full]
# gpg: aka "[jpeg image of size 6874]" [full]
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A
* remotes/ericb/tags/pull-nbd-2022-03-07:
qemu-io: Allow larger write zeroes under no fallback
qemu-io: Utilize 64-bit status during map
nbd/server: Minor cleanups
tests/qemu-iotests: validate NBD TLS with UNIX sockets and PSK
tests/qemu-iotests: validate NBD TLS with UNIX sockets
tests/qemu-iotests: validate NBD TLS with hostname mismatch
tests/qemu-iotests: convert NBD TLS test to use standard filters
tests/qemu-iotests: introduce filter for qemu-nbd export list
tests/qemu-iotests: expand _filter_nbd rules
tests/qemu-iotests: add QEMU_IOTESTS_REGEN=1 to update reference file
block/nbd: don't restrict TLS usage to IP sockets
qemu-nbd: add --tls-hostname option for TLS certificate validation
block/nbd: support override of hostname for TLS certificate validation
block: pass desired TLS hostname through from block driver client
crypto: mandate a hostname when checking x509 creds on a client
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
esp: recreate ESPState current_req after migration
Since PDMA reads/writes are driven by the guest, it is possible that migration
can occur whilst a SCSIRequest is still active. Fortunately active SCSIRequests
are already included in the migration stream and restarted post migration but
this still leaves the reference in ESPState uninitialised.
Implement the SCSIBusInfo .load_request callback to obtain a reference to the
currently active SCSIRequest and use it to recreate ESPState current_req
after migration.
Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20220305155530.9265-11-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
esp: convert ESPState pdma_cb from a function pointer to an integer
This prepares for the inclusion of the current PDMA callback in the migration
stream since the callback is referenced by an integer instead of a function
pointer.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20220305155530.9265-9-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
macfb: set initial value of mode control registers in macfb_common_realize()
If booting Linux directly in the q800 machine using -kernel rather than using a
MacOS toolbox ROM, the mode control registers are never initialised,
causing macfb_mode_write() to fail to determine the current resolution after
migration. Resolve this by always setting the initial values of the mode control
registers based upon the initial macfb properties during realize.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20220305155530.9265-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>