summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* hw/net:ftgmac100: update ring base address to 64 bitsJamin Lin2024-07-091-17/+16
| | | | | | | | | | | | | | | | | Update TX and RX ring base address data type to uint64_t for 64 bits dram address DMA support. Both "Normal Priority Transmit Ring Base Address Register(0x20)" and "Receive Ring Base Address Register (0x24)" are used for saving the low part physical address of descriptor manager. Therefore, changes to set TX and RX descriptor manager address bits [31:0] in ftgmac100_read and ftgmac100_write functions. Incrementing the version of vmstate to 2. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
* hw/net:ftgmac100: update memory region size to 64KBJamin Lin2024-07-091-3/+8
| | | | | | | | | | | | | | | | | | | According to the datasheet of ASPEED SOCs, one MAC controller owns 128KB of register space for AST2500. However, one MAC controller only owns 64KB of register space for AST2600 and AST2700. It set the memory region size 128KB and it occupied another controllers Address Spaces. Update one MAC controller memory region size to 0x1000 because AST2500 did not use register spaces over than 64KB. Introduce a new container region size to 0x1000 and its range is from 0 to 0xfff. This container is mapped a sub region for the current set of register. This sub region range is from 0 to 0xff. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
* hw/sd/sdcard: Extract TYPE_SDMMC_COMMON from TYPE_SD_CARDPhilippe Mathieu-Daudé2024-07-053-28/+51
| | | | | | | | | | | | | | In order to keep eMMC model simpler to maintain, extract common properties and the common code from class_init to the (internal) TYPE_SDMMC_COMMON. Update the corresponding QOM cast macros. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240703134356.85972-6-philmd@linaro.org>
* hw/sd/sdcard: Introduce set_csd/set_cid handlersPhilippe Mathieu-Daudé2024-07-051-2/+5
| | | | | | | | | | | | In preparation of introducing eMMC support which have different CSD/CID structures, introduce a pair of handlers in SDCardClass. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-82-philmd@linaro.org>
* hw/sd/sdcard: Cover more SDCardStatesPhilippe Mathieu-Daudé2024-07-051-0/+11
| | | | | | | | | | | So far eMMC will only use sd_sleep_state, but all all states specified for completeness. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-81-philmd@linaro.org>
* hw/sd/sdcard: Trace length of data read on DAT linesPhilippe Mathieu-Daudé2024-07-052-3/+3
| | | | | | | | | | Some commands expect less than BLOCK_LENGTH. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-80-philmd@linaro.org>
* hw/sd/sdcard: Remove default case in read/write on DAT linesPhilippe Mathieu-Daudé2024-07-051-5/+4
| | | | | | | | | | | | All read/write on DAT lines are explicitly handled. Reaching this point would be a programming error: replace by an assertion. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-79-philmd@linaro.org>
* hw/sd/sdcard: Remove noise from sd_cmd_name()Philippe Mathieu-Daudé2024-07-051-5/+0
| | | | | | | | | | These CMD names weren't really useful, "UNKNOWN_CMD" is simpler. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-78-philmd@linaro.org>
* hw/sd/sdcard: Remove noise from sd_acmd_name()Philippe Mathieu-Daudé2024-07-051-11/+1
| | | | | | | | | | These ACMD names weren't really useful, "UNKNOWN_ACMD" is simpler. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-77-philmd@linaro.org>
* hw/sd/sdcard: Remove sd_none enum from sd_cmd_type_tPhilippe Mathieu-Daudé2024-07-051-6/+1
| | | | | | | | | | | All handlers using the 'sd_none' enum got converted, remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240628070216.92609-76-philmd@linaro.org>
* hw/sd/sdcard: Add sd_cmd_GEN_CMD handler (CMD56)Philippe Mathieu-Daudé2024-07-051-34/+20
| | | | | | | | | | | | | | | | | "General command" (GEN_CMD, CMD56) is described as: GEN_CMD is the same as the single block read or write commands (CMD24 or CMD17). The difference is that [...] the data block is not a memory payload data but has a vendor specific format and meaning. Thus this block must not be stored overwriting data block on underlying storage drive. Handle as RAZ/WI. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240703134356.85972-3-philmd@linaro.org>
* hw/sd/sdcard: Rename sd_cmd_SEND_OP_COND handlerPhilippe Mathieu-Daudé2024-07-051-2/+2
| | | | | | | | | | | The correct command name is 'SD SEND_OP_COND', rename accordingly. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240703134356.85972-4-philmd@linaro.org>
* hw/sd/sdcard: Use spec v3.01 by defaultPhilippe Mathieu-Daudé2024-07-052-1/+2
| | | | | | | | | | | | | | Recent SDHCI expect cards to support the v3.01 spec to negociate lower I/O voltage. Select it by default. Versioned machine types with a version of 9.0 or earlier retain the old default (spec v2.00). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240703134356.85972-2-philmd@linaro.org>
* hw/sd/sdcard: Remove leftover comment about removed 'spi' PropertyPhilippe Mathieu-Daudé2024-07-051-4/+0
| | | | | | | | | | | Commit c3287c0f70 ("hw/sd: Introduce a "sd-card" SPI variant model") removed the 'spi' property. Remove the comment left over. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Message-Id: <20240703085907.66775-2-philmd@linaro.org>
* hw/sd/sdcard: Generate random RCA valuePhilippe Mathieu-Daudé2024-07-052-3/+9
| | | | | | | | | | | Rather than using the obscure 0x4567 magic value, use a real random one. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Message-Id: <20240702140842.54242-5-philmd@linaro.org>
* hw/sd/npcm7xx_sdhci: Use TYPE_SYSBUS_SDHCI definitionPhilippe Mathieu-Daudé2024-07-051-1/+2
| | | | | | | | Use the macro instead of two explicit string literals. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240702140842.54242-2-philmd@linaro.org>
* hw/sd/sdhci: Log non-sequencial access as GUEST_ERRORPhilippe Mathieu-Daudé2024-07-051-2/+3
| | | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Message-Id: <20240702140842.54242-3-philmd@linaro.org>
* accel/tcg: Move qemu_plugin_vcpu_init__async() to plugins/Philippe Mathieu-Daudé2024-07-051-8/+1
| | | | | | | | | | | | Calling qemu_plugin_vcpu_init__async() on the vCPU thread is a detail of plugins, not relevant to TCG vCPU management. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240606124010.2460-4-philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-30-alex.bennee@linaro.org>
* plugins: Free CPUPluginState before destroying vCPU statePhilippe Mathieu-Daudé2024-07-051-0/+5
| | | | | | | | | | | | cpu::plugin_state is allocated in cpu_common_initfn() when the vCPU state is created. Release it in cpu_common_finalize() when we are done. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240606124010.2460-3-philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-29-alex.bennee@linaro.org>
* hw/core: ensure kernel_end never gets used undefinedAlex Bennée2024-07-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Really the problem here is the return values of fit_load_[kernel|fdt]() are a little all over the place. However we don't want to somehow get through not having set kernel_end and having it just be random unused data. The compiler complained on an --enable-gcov build: In file included from ../../hw/core/loader-fit.c:20: /home/alex/lsrc/qemu.git/include/qemu/osdep.h: In function ‘load_fit’: /home/alex/lsrc/qemu.git/include/qemu/osdep.h:486:45: error: ‘kernel_end’ may be used uninitialized [-Werror=maybe-uninitialized] 486 | #define ROUND_UP(n, d) ROUND_DOWN((n) + (d) - 1, (d)) | ^ ../../hw/core/loader-fit.c:270:12: note: ‘kernel_end’ was declared here 270 | hwaddr kernel_end; | ^~~~~~~~~~ Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Aleksandar Rikalo <arikalo@gmail.com> Message-Id: <20240705084047.857176-5-alex.bennee@linaro.org>
* Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2024-07-041-0/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * meson: Pass objects and dependencies to declare_dependency(), not static_library() * meson: Drop the .fa library suffix * target/i386: drop AMD machine check bits from Intel CPUID * target/i386: add avx-vnni-int16 feature * target/i386: SEV bugfixes * target/i386: SEV-SNP -cpu host support * char: fix exit issues # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmaGceoUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNcpgf/XziKojGOTvYsE7xMijOUswYjCG5m # ZVLqxTug8Q0zO/9mGvluKBTWmh8KhRWOovX5iZL8+F0gPoYPG4ONpNhh3wpA9+S7 # H7ph4V6sDJBX4l3OrOK6htD8dO5D9kns1iKGnE0lY60PkcHl+pU8BNWfK1zYp5US # geiyzuRFRRtDmoNx5+o+w+D+W5msPZsnlj5BnPWM+O/ykeFfSrk2ztfdwHKXUhCB # 5FJcu2sWVx+wsdVzdjgT8USi5+VTK4vabq3SfccmNRxBRnJOCU5MrR63stMDceo4 # TswSB88I0WRV1848AudcGZRkjvKaXLyHJ+QTjg2dp7itEARJ3MGsvOpS5A== # =3kv7 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 04 Jul 2024 02:56:58 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: target/i386/SEV: implement mask_cpuid_features target/i386: add support for masking CPUID features in confidential guests char-stdio: Restore blocking mode of stdout on exit target/i386: add avx-vnni-int16 feature i386/sev: Fallback to the default SEV device if none provided in sev_get_capabilities() i386/sev: Fix error message in sev_get_capabilities() target/i386: do not include undefined bits in the AMD topoext leaf target/i386: SEV: fix formatting of CPUID mismatch message target/i386: drop AMD machine check bits from Intel CPUID target/i386: pass X86CPU to x86_cpu_get_supported_feature_word meson: Drop the .fa library suffix Revert "meson: Propagate gnutls dependency" meson: Pass objects and dependencies to declare_dependency() meson: merge plugin_ldflags into emulator_link_args meson: move block.syms dependency out of libblock meson: move shared_module() calls where modules are already walked Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * target/i386: do not include undefined bits in the AMD topoext leafPaolo Bonzini2024-07-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Commit d7c72735f61 ("target/i386: Add new EPYC CPU versions with updated cache_info", 2023-05-08) ensured that AMD-defined CPU models did not have the 'complex_indexing' bit set, but left it set in "-cpu host" which uses the default ("legacy") cache information. Reimplement that commit using a CPU feature, so that it can be applied to all guests using a new machine type, independent of the CPU model. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson2024-07-0340-246/+1747
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio: features,fixes A bunch of improvements: - vhost dirty log is now only scanned once, not once per device - virtio and vhost now support VIRTIO_F_NOTIFICATION_DATA - cxl gained DCD emulation support - pvpanic gained shutdown support - beginning of patchset for Generic Port Affinity Structure - s3 support - friendlier error messages when boot fails on some illegal configs - for vhost-user, VHOST_USER_SET_LOG_BASE is now only sent once - part of vhost-user support for any POSIX system - not yet enabled due to qtest failures - sr-iov VF setup code has been reworked significantly - new tests, particularly for risc-v ACPI - bugfixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmaF068PHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp+DMIAMC//mBXIZlPprfhb5cuZklxYi31Acgu5TUr # njqjCkN+mFhXXZuc3B67xmrQ066IEPtsbzCjSnzuU41YK4tjvO1g+LgYJBv41G16 # va2k8vFM5pdvRA+UC9li1CCIPxiEcszxOdzZemj3szWLVLLUmwsc5OZLWWeFA5m8 # vXrrT9miODUz3z8/Xn/TVpxnmD6glKYIRK/IJRzzC4Qqqwb5H3ji/BJV27cDUtdC # w6ns5RYIj5j4uAiG8wQNDggA1bMsTxFxThRDUwxlxaIwAcexrf1oRnxGRePA7PVG # BXrt5yodrZYR2sR6svmOOIF3wPMUDKdlAItTcEgYyxaVo5rAdpc= # =p9h4 # -----END PGP SIGNATURE----- # gpg: Signature made Wed 03 Jul 2024 03:41:51 PM PDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (85 commits) hw/pci: Replace -1 with UINT32_MAX for romsize pcie_sriov: Register VFs after migration pcie_sriov: Remove num_vfs from PCIESriovPF pcie_sriov: Release VFs failed to realize pcie_sriov: Reuse SR-IOV VF device instances pcie_sriov: Ensure VF function number does not overflow pcie_sriov: Do not manually unrealize hw/ppc/spapr_pci: Do not reject VFs created after a PF hw/ppc/spapr_pci: Do not create DT for disabled PCI device hw/pci: Rename has_power to enabled virtio-iommu: Clear IOMMUDevice when VFIO device is unplugged virtio: remove virtio_tswap16s() call in vring_packed_event_read() hw/cxl/events: Mark cxl-add-dynamic-capacity and cxl-release-dynamic-capcity unstable hw/cxl/events: Improve QMP interfaces and documentation for add/release dynamic capacity. tests/data/acpi/rebuild-expected-aml.sh: Add RISC-V pc-bios/meson.build: Add support for RISC-V in unpack_edk2_blobs meson.build: Add RISC-V to the edk2-target list tests/data/acpi/virt: Move ARM64 ACPI tables under aarch64/${machine} path tests/data/acpi: Move x86 ACPI tables under x86/${machine} path tests/qtest/bios-tables-test.c: Set "arch" for x86 tests ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/pci: Replace -1 with UINT32_MAX for romsizeAkihiko Odaki2024-07-032-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | romsize is an uint32_t variable. Specifying -1 as an uint32_t value is obscure way to denote UINT32_MAX. Worse, if int is wider than 32-bit, it will change the behavior of a construct like the following: romsize = -1; if (romsize != -1) { ... } When -1 is assigned to romsize, -1 will be implicitly casted into uint32_t, resulting in UINT32_MAX. On contrary, when evaluating romsize != -1, romsize will be casted into int, and it will be a comparison of UINT32_MAX and -1, and result in false. Replace -1 with UINT32_MAX for statements involving the variable to clarify the intent and prevent potential breakage. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20240627-reuse-v10-10-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie_sriov: Register VFs after migrationAkihiko Odaki2024-07-032-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | pcie_sriov doesn't have code to restore its state after migration, but igb, which uses pcie_sriov, naively claimed its migration capability. Add code to register VFs after migration and fix igb migration. Fixes: 3a977deebe6b ("Intrdocue igb device emulation") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-9-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie_sriov: Remove num_vfs from PCIESriovPFAkihiko Odaki2024-07-032-9/+21
| | | | | | | | | | | | | | | | | | | | num_vfs is not migrated so use PCI_SRIOV_CTRL_VFE and PCI_SRIOV_NUM_VF instead. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-8-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie_sriov: Release VFs failed to realizeAkihiko Odaki2024-07-031-0/+2
| | | | | | | | | | | | | | | | | | | | Release VFs failed to realize just as we do in unregister_vfs(). Fixes: 7c0fa8dff811 ("pcie: Add support for Single Root I/O Virtualization (SR/IOV)") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-7-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie_sriov: Reuse SR-IOV VF device instancesAkihiko Odaki2024-07-032-56/+41
| | | | | | | | | | | | | | | | | | | | | | | | Disable SR-IOV VF devices by reusing code to power down PCI devices instead of removing them when the guest requests to disable VFs. This allows to realize devices and report VF realization errors at PF realization time. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-6-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie_sriov: Ensure VF function number does not overflowAkihiko Odaki2024-07-033-13/+43
| | | | | | | | | | | | | | | | | | | | pci_new() aborts when creating a VF with a function number equals to or is greater than PCI_DEVFN_MAX. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-5-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pcie_sriov: Do not manually unrealizeAkihiko Odaki2024-07-031-4/+0
| | | | | | | | | | | | | | | | | | A device gets automatically unrealized when being unparented. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-4-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/ppc/spapr_pci: Do not reject VFs created after a PFAkihiko Odaki2024-07-031-1/+3
| | | | | | | | | | | | | | | | | | A PF may automatically create VFs and the PF may be function 0. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-3-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/ppc/spapr_pci: Do not create DT for disabled PCI deviceAkihiko Odaki2024-07-031-0/+4
| | | | | | | | | | | | | | | | | | | | Disabled means it is a disabled SR-IOV VF or it is powered off, and hidden from the guest. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-2-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/pci: Rename has_power to enabledAkihiko Odaki2024-07-032-9/+9
| | | | | | | | | | | | | | | | | | | | The renamed state will not only represent powering state of PFs, but also represent SR-IOV VF enablement in the future. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-reuse-v10-1-7ca0b8ed3d9f@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio-iommu: Clear IOMMUDevice when VFIO device is unpluggedCédric Le Goater2024-07-031-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a VFIO device is hoplugged in a VM using virtio-iommu, IOMMUPciBus and IOMMUDevice cache entries are created in the .get_address_space() handler of the machine IOMMU device. However, these entries are never destroyed, not even when the VFIO device is detached from the machine. This can lead to an assert if the device is reattached again. When reattached, the .get_address_space() handler reuses an IOMMUDevice entry allocated when the VFIO device was first attached. virtio_iommu_set_host_iova_ranges() is called later on from the .set_iommu_device() handler an fails with an assert on 'probe_done' because the device appears to have been already probed when this is not the case. The IOMMUDevice entry is allocated in pci_device_iommu_address_space() called from under vfio_realize(), the VFIO PCI realize handler. Since pci_device_unset_iommu_device() is called from vfio_exitfn(), a sub function of the PCIDevice unrealize() handler, it seems that the .unset_iommu_device() handler is the best place to release resources allocated at realize time. Clear the IOMMUDevice cache entry there to fix hotplug. Fixes: 817ef10da23c ("virtio-iommu: Implement set|unset]_iommu_device() callbacks") Signed-off-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240701101453.203985-1-clg@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio: remove virtio_tswap16s() call in vring_packed_event_read()Stefano Garzarella2024-07-031-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit d152cdd6f6 ("virtio: use virtio accessor to access packed event") switched using of address_space_read_cached() to virito_lduw_phys_cached() to access packed descriptor event. When we used address_space_read_cached(), we needed to call virtio_tswap16s() to handle the endianess of the field, but virito_lduw_phys_cached() already handles it internally, so we no longer need to call virtio_tswap16s() (as the commit had done for `off_wrap`, but forgot for `flags`). Fixes: d152cdd6f6 ("virtio: use virtio accessor to access packed event") Cc: jasowang@redhat.com Cc: qemu-stable@nongnu.org Reported-by: Xoykie <xoykie@gmail.com> Link: https://lore.kernel.org/qemu-devel/CAFU8RB_pjr77zMLsM0Unf9xPNxfr_--Tjr49F_eX32ZBc5o2zQ@mail.gmail.com Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20240701075208.19634-1-sgarzare@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eugenio Pérez <eperezma@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/cxl/events: Improve QMP interfaces and documentation for add/release ↵Jonathan Cameron2024-07-032-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dynamic capacity. New DCD command definitions updated in response to review comments from Markus. - Used CxlXXXX instead of CXLXXXXX for newly added types. - Expanded some abreviations in type names to be easier to read. - Additional documentation for some fields. - Replace slightly vague cxl r3.1 references with "Compute Express Link (CXL) Specification, Revision 3.1, XXXX" to bring them inline with what it says on the specification cover. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20240625170805.359278-2-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/arm/virt-acpi-build: Fix id_count in build_iort_id_mappingNicolin Chen2024-07-031-6/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's observed that Linux kernel booting with the VM reports a "conflicting mapping for input ID" FW_BUG. The IORT doc defines "Number of IDs" to be "the number of IDs in the range minus one", while virt-acpi-build.c simply stores the number of IDs in the id_count without the "minus one". Meanwhile, some of the callers pass in a 0xFFFF following the spec. So, this is a mismatch between the function and its callers. Fix build_iort_id_mapping() by internally subtracting one from the pass-in @id_count. Accordingly make sure that all existing callers pass in a value without the "minus one", i.e. change all 0xFFFFs to 0x10000s. Also, add a few lines of comments to highlight this change along with the referencing document for this build_iort_id_mapping(). Fixes: 42e0f050e3a5 ("hw/arm/virt-acpi-build: Add IORT support to bypass SMMUv3") Suggested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Message-Id: <20240619201243.936819-1-nicolinc@nvidia.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/i386/fw_cfg: Add etc/e820 to fw_cfg lateDavid Woodhouse2024-07-036-18/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In e820_add_entry() the e820_table is reallocated with g_renew() to make space for a new entry. However, fw_cfg_arch_create() just uses the existing e820_table pointer. This leads to a use-after-free if anything adds a new entry after fw_cfg is set up. Shift the addition of the etc/e820 file to the machine done notifier, via a new fw_cfg_add_e820() function. Also make e820_table private and use an e820_get_table() accessor function for it, which sets a flag that will trigger an assert() for any *later* attempts to add to the table. Make e820_add_entry() return void, as most callers don't check for error anyway. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Message-Id: <a2708734f004b224f33d3b4824e9a5a262431568.camel@infradead.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/arm/virt-acpi-build: Drop local iort_node_offsetNicolin Chen2024-07-031-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both the other two callers of build_iort_id_mapping() just directly pass in the IORT_NODE_OFFSET macro. Keeping a "const uint32_t" local variable storing the same value doesn't have any gain. Simplify this by replacing the only place using this local variable with the macro directly. Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Message-Id: <20240619001708.926511-1-nicolinc@nvidia.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/net/virtio-net.c: fix crash in iov_copy()Dmitry Frolov2024-07-011-0/+4
| | | | | | | | | | | | | | | | | | | | | | A crash found while fuzzing device virtio-net-socket-check-used. Assertion "offset == 0" in iov_copy() fails if less than guest_hdr_len bytes were transmited. Signed-off-by: Dmitry Frolov <frolov@swemel.ru> Message-Id: <20240613143529.602591-2-frolov@swemel.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requestsBillXiang2024-07-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | The VHOST_USER_SET_LOG_BASE requests should be categorized into non-vring specific messages, and should be sent only once. If send more than once, dpdk will munmap old log_addr which may has been used and cause segmentation fault. Signed-off-by: BillXiang <xiangwencheng@dayudpu.com> Message-Id: <20240613065150.3100-1-xiangwencheng@dayudpu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio-iommu: add error check before assertManos Pitsidianakis2024-07-011-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A fuzzer case discovered by Zheyu Ma causes an assert failure. Add a check before the assert, and respond with an error before moving on to the next queue element. To reproduce the failure: cat << EOF | \ qemu-system-x86_64 \ -display none -machine accel=qtest -m 512M -machine q35 -nodefaults \ -device virtio-iommu -qtest stdio outl 0xcf8 0x80000804 outw 0xcfc 0x06 outl 0xcf8 0x80000820 outl 0xcfc 0xe0004000 write 0x10000e 0x1 0x01 write 0xe0004020 0x4 0x00001000 write 0xe0004028 0x4 0x00101000 write 0xe000401c 0x1 0x01 write 0x106000 0x1 0x05 write 0x100001 0x1 0x60 write 0x100002 0x1 0x10 write 0x100009 0x1 0x04 write 0x10000c 0x1 0x01 write 0x100018 0x1 0x04 write 0x10001c 0x1 0x02 write 0x101003 0x1 0x01 write 0xe0007001 0x1 0x00 EOF Reported-by: Zheyu Ma <zheyuma97@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2359 Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-Id: <20240613-fuzz-2359-fix-v2-manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/virtio: Free vqs after vhost_dev_cleanup()Akihiko Odaki2024-07-011-0/+2
| | | | | | | | | | | | | | | | | | This fixes LeakSanitizer warnings. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240627-san-v2-7-750bb0946dbd@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * i386/apic: Add hint on boot failure because of disabling x2APICZhao Liu2024-07-011-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the Q35 supports up to 4096 vCPUs (since v9.0), but for TCG cases, if x2APIC is not actively enabled to boot more than 255 vCPUs ( e.g., qemu-system-i386 -M pc-q35-9.0 -smp 666), the following error is reported: Unexpected error in apic_common_set_id() at ../hw/intc/apic_common.c:449: qemu-system-i386: APIC ID 255 requires x2APIC feature in CPU Aborted (core dumped) This error can be resolved by setting x2apic=on in -cpu. In order to better help users deal with this scenario, add the error hint to instruct users on how to enable the x2apic feature. Then, the error report becomes the following: Unexpected error in apic_common_set_id() at ../hw/intc/apic_common.c:448: qemu-system-i386: APIC ID 255 requires x2APIC feature in CPU Try x2apic=on in -cpu. Aborted (core dumped) Note since @errp is &error_abort, error_append_hint() can't be applied on @errp. And in order to separate the exact error message from the (perhaps effectively) hint, adding a hint via error_append_hint() is also necessary. Therefore, introduce @local_error in apic_common_set_id() to handle both the error message and the error hint. Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-Id: <20240606140858.2157106-1-zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * virtio-pci: implement No_Soft_Reset bitJiqian Chen2024-07-012-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In current code, when guest does S3, virtio-gpu are reset due to the bit No_Soft_Reset is not set. After resetting, the display resources of virtio-gpu are destroyed, then the display can't come back and only show blank after resuming. Implement No_Soft_Reset bit of PCI_PM_CTRL register, then guest can check this bit, if this bit is set, the devices resetting will not be done, and then the display can work after resuming. No_Soft_Reset bit is implemented for all virtio devices, and was tested only on virtio-gpu device. Set it false by default for safety. Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com> Message-Id: <20240606102205.114671-3-Jiqian.Chen@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/cxl: Fix read from bogus memoryIra Weiny2024-07-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Peter and coverity report: We've passed '&data' to address_space_write(), which means "read from the address on the stack where the function argument 'data' lives", so instead of writing 64 bytes of data to the guest , we'll write 64 bytes which start with a host pointer value and then continue with whatever happens to be on the host stack after that. Indeed the intention was to write 64 bytes of data at the address given. Fix the parameter to address_space_write(). Reported-by: Peter Maydell <peter.maydell@linaro.org> Link: https://lore.kernel.org/all/CAFEAcA-u4sytGwTKsb__Y+_+0O2-WwARntm3x8WNhvL1WfHOBg@mail.gmail.com/ Fixes: 6bda41a69bdc ("hw/cxl: Add clear poison mailbox command support.") Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Ira Weiny <ira.weiny@intel.com> Message-Id: <20240531-fix-poison-set-cacheline-v1-1-e3bc7e8f1158@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
| * virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()Cindy Lu2024-07-011-16/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In function kvm_virtio_pci_vector_use_one(), the function will only use the irqfd/vector for itself. Therefore, in the undo label, the failing process is incorrect. To fix this, we can just remove this label. Fixes: f9a09ca3ea ("vhost: add support for configure interrupt") Cc: qemu-stable@nongnu.org Signed-off-by: Cindy Lu <lulu@redhat.com> Message-Id: <20240528084840.194538-1-lulu@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/misc/pvpanic: add support for normal shutdownsThomas Weißschuh2024-07-011-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Shutdown requests are normally hardware dependent. By extending pvpanic to also handle shutdown requests, guests can submit such requests with an easily implementable and cross-platform mechanism. Acked-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de> Message-Id: <20240527-pvpanic-shutdown-v8-5-5a28ec02558b@t-8ch.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/misc/pvpanic: centralize definition of supported eventsThomas Weißschuh2024-07-013-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The different components of pvpanic duplicate the list of supported events. Move it to the shared header file to minimize changes when new events are added. MST: tweak: keep header included in pvpanic.c to avoid header dependency, rebase. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de> Message-Id: <20240527-pvpanic-shutdown-v8-3-5a28ec02558b@t-8ch.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/mem/cxl_type3: Allow to release extent superset in QMP interfaceFan Ni2024-07-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before the change, the QMP interface used for add/release DC extents only allows to release an extent whose DPA range is contained by a single accepted extent in the device. With the change, we relax the constraints. As long as the DPA range of the extent is covered by accepted extents, we allow the release. Tested-by: Svetly Todorov <svetly.todorov@memverge.com> Reviewed-by: Gregory Price <gregory.price@memverge.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Fan Ni <fan.ni@samsung.com> Message-Id: <20240523174651.1089554-15-nifan.cxl@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>