summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settingsPeter Maydell2023-03-211-2/+4
| | | | | | | | | | | | | | | | | | | | | The cadence UART attempts to avoid allowing the guest to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that a malicious guest can get a bogus value into the register by setting also some high bits in the value, and cause QEMU to crash by division-by-zero. Do the mask before the bounds check instead of afterwards. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com> Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
* replace TABs with spacesYeqi Fu2023-03-2011-772/+772
| | | | | | | | | | | Bring the files in line with the QEMU coding style, with spaces for indentation. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/378 Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com> Message-Id: <20230315032649.57568-1-fufuyqqqqqq@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Merge tag 'misc-next-pull-request' of https://gitlab.com/berrange/qemu into ↵Peter Maydell2023-03-151-0/+6
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging Miscellaneous fixes * Avoid memory leak in TLS GSource usage * Avoid sending key releases for lang1/lang2 keys in ps2 keyboard * Add missing key name constants for F13-F24 keys # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE2vOm/bJrYpEtDo4/vobrtBUQT98FAmQQn/gACgkQvobrtBUQ # T9+BxRAAl1aOI2rHW27vnwX4xGJX4y4ENA4GAWrnGfya+Ewcoze544W3jwT8b94b # KDY62P+NMrlxWMjYlDb8if+TYjXc5orlJFBl94zmbaIS7vajnYmprqP3ipCHD/rw # J5sTOrE8j4+Q+SRQliSwozS+vFm74BoghSLNUBretjxoxZymkUtqKFC88eUFIXsZ # prGpBVm9g22NWQ94YwJg4iqkAGm0iDjzNsDxHkYhg4yoAsfU800aoKZuSJft6Pfc # PTQ+x2Y0rxoQ+YuFyf7/uGK7w7awguMkeIn/Nalz3LcxzB+BFPby+P8Srp6WABD5 # N8COb38L5XtN4UffiK1//lxdLFmbO6NVMOaE1yUcG6CAOZNC4eZLIIEDEbvGWOm5 # f2h/YRK59F4HEbYazimEMxqa2SKBGV7j2nvqUEERyNo++U6WLR2toZPlRYP0EWgK # YuLNGKr4XwNZXmAUO36YglMCowXHUwQdITU+gZt4QIcrjEEAeG9U3pspwyfGcYQl # 3zd/xzeHGJQHzXNBnyRX0OQamE1et+UGqGauFYAVKFcHHq5VIe5W3BDBLj57DvQn # T+tZBA92esPl9/qHx0zFfSfiSDHvs67obHPp4LcrNENUXtJOVoqOxpAUtQ9aBX8J # jhPpkqBrMHtpyjMSM9xyjstro8pD47Kt6t930Sp9fh7fOjO0awE= # =lL/5 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 14 Mar 2023 16:25:28 GMT # gpg: using RSA key DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF # gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [full] # gpg: aka "Daniel P. Berrange <berrange@redhat.com>" [full] # Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF * tag 'misc-next-pull-request' of https://gitlab.com/berrange/qemu: io/channel-tls: plug memory leakage on GSource ps2: Don't send key release event for Lang1, Lang2 keys Add qemu qcode support for keys F13 to F24 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ps2: Don't send key release event for Lang1, Lang2 keysRoss Lagerwall2023-03-141-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | The scancodes for the Lang1 and Lang2 keys (i.e. Hangeul, Hanja) are special since they already have the 0x80 bit set which is commonly used to indicate a key release in AT set 1. Reportedly, real hardware does not send a key release scancode. So, skip sending a release for these keys. This ensures that Windows behaves correctly and interprets it as a single keypress rather than two consecutive keypresses. Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
* | hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE updateDavid Woodhouse2023-03-151-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A Linux guest will perform IRQ migration after the IRQ has happened, updating the RTE to point to the new destination CPU and then unmasking the interrupt. However, when the guest updates the RTE, ioapic_mem_write() calls ioapic_service(), which redelivers the pending level interrupt via kvm_set_irq(), *before* calling ioapic_update_kvm_routes() which sets the new target CPU. Thus, the IRQ which is supposed to go to the new target CPU is instead misdelivered to the previous target. An example where the guest kernel is attempting to migrate from CPU#2 to CPU#0 shows: xenstore_read tx 0 path control/platform-feature-xs_reset_watches ioapic_set_irq vector: 11 level: 1 ioapic_set_remote_irr set remote irr for pin 11 ioapic_service: trigger KVM IRQ 11 [ 0.523627] The affinity mask was 0-3 and the handler is on 2 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x27 size 0x4 val 0x26 ioapic_update_kvm_routes: update KVM route for IRQ 11: fee02000 8021 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x26 size 0x4 val 0x18021 xenstore_reset_watches ioapic_set_irq vector: 11 level: 1 ioapic_mem_read ioapic mem read addr 0x10 regsel: 0x26 size 0x4 retval 0x1c021 [ 0.524569] ioapic_ack_level IRQ 11 moveit = 1 ioapic_eoi_broadcast EOI broadcast for vector 33 ioapic_clear_remote_irr clear remote irr for pin 11 vector 33 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x26 size 0x4 val 0x26 ioapic_mem_read ioapic mem read addr 0x10 regsel: 0x26 size 0x4 retval 0x18021 [ 0.525235] ioapic_finish_move IRQ 11 calls irq_move_masked_irq() [ 0.526147] irq_do_set_affinity for IRQ 11, 0 [ 0.526732] ioapic_set_affinity for IRQ 11, 0 [ 0.527330] ioapic_setup_msg_from_msi for IRQ11 target 0 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x26 size 0x4 val 0x27 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x27 size 0x4 val 0x0 ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x27 size 0x4 val 0x26 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x26 size 0x4 val 0x18021 [ 0.527623] ioapic_set_affinity returns 0 [ 0.527623] ioapic_finish_move IRQ 11 calls unmask_ioapic_irq() ioapic_mem_write ioapic mem write addr 0x0 regsel: 0x26 size 0x4 val 0x26 ioapic_mem_write ioapic mem write addr 0x10 regsel: 0x26 size 0x4 val 0x8021 ioapic_set_remote_irr set remote irr for pin 11 ioapic_service: trigger KVM IRQ 11 ioapic_update_kvm_routes: update KVM route for IRQ 11: fee00000 8021 [ 0.529571] The affinity mask was 0 and the handler is on 2 [ xenstore_watch path memory/target token FFFFFFFF92847D40 There are no other code paths in ioapic_mem_write() which need the KVM IRQ routing table to be updated, so just shift the call from the end of the function to happen right before the call to ioapic_service() and thus deliver the re-enabled IRQ to the right place. Alternative fixes might have been just to remove the part in ioapic_service() which delivers the IRQ via kvm_set_irq() because surely delivering as MSI ought to work just fine anyway in all cases? That code lacks a comment justifying its existence. Or maybe in the specific case shown in the above log, it would have sufficed for ioapic_update_kvm_routes() to update the route *even* when the IRQ is masked. It's not like it's actually going to get triggered unless QEMU deliberately does so, anyway? But that only works because the target CPU happens to be in the high word of the RTE; if something in the *low* word (vector, perhaps) was changed at the same time as the unmask, we'd still trigger with stale data. Fixes: 15eafc2e602f "kvm: x86: add support for KVM_CAP_SPLIT_IRQCHIP" Signed-off-by: David Woodhouse <dwmw2@infradead.org> Reviewed-by: Peter Xu <peterx@redhat.com> Message-Id: <20230308111952.2728440-2-dwmw2@infradead.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | ui: rename cursor_{put->unref}Marc-André Lureau2023-03-133-5/+5
|/ | | | | | | The naming is more conventional in QEMU. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
* win32: replace closesocket() with close() wrapperMarc-André Lureau2023-03-131-2/+2
| | | | | | | | | Use a close() wrapper instead, so that we don't need to worry about closesocket() vs close() anymore, let's hope. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-Id: <20230221124802.4103554-17-marcandre.lureau@redhat.com>
* Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingPeter Maydell2023-03-1129-1872/+8174
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # -----BEGIN PGP SIGNATURE----- # Version: GnuPG v1 # # iQEcBAABAgAGBQJkCvgFAAoJEO8Ells5jWIRHiUH/jhydpJHIqnAPxHQAwGtmyhb # 9Z52UOzW5V6KxfZJ+bQ4RPFkS2UwcxmeadPHY4zvvJTVBLAgG3QVgP4igj8CXKCI # xRnwMgTNeu655kZQ5P/elTwdBTCJFODk7Egg/bH3H1ZiUhXBhVRhK7q/wMgtlZkZ # Kexo6txCK4d941RNzEh45ZaGhdELE+B+D7cRuQgBs/DXZtJpsyEzBbP8KYSMHuER # AXfWo0YIBYj7X3ek9D6j0pbOkB61vqtYd7W6xV4iDrJCcFBIOspJbbBb1tGCHola # AXo5/OhRmiQnp/c/HTbJIDbrj0sq/r7LxYK4zY1x7UPbewHS9R+wz+FfqSmoBF0= # =056y # -----END PGP SIGNATURE----- # gpg: Signature made Fri 10 Mar 2023 09:27:33 GMT # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: (44 commits) ebpf: fix compatibility with libbpf 1.0+ docs/system/devices/igb: Add igb documentation tests/avocado: Add igb test igb: Introduce qtest for igb device tests/qtest/libqos/e1000e: Export macreg functions tests/qtest/e1000e-test: Fabricate ethernet header Intrdocue igb device emulation e1000: Split header files pcie: Introduce pcie_sriov_num_vfs net/eth: Introduce EthL4HdrProto e1000e: Implement system clock net/eth: Report if headers are actually present e1000e: Count CRC in Tx statistics e1000: Count CRC in Tx statistics e1000e: Combine rx traces MAINTAINERS: Add e1000e test files MAINTAINERS: Add Akihiko Odaki as a e1000e reviewer e1000e: Do not assert when MSI-X is disabled later hw/net/net_tx_pkt: Check the payload length hw/net/net_tx_pkt: Implement TCP segmentation ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * Intrdocue igb device emulationAkihiko Odaki2023-03-109-0/+6006
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change introduces emulation for the Intel 82576 adapter, AKA igb. The details of the device will be provided by the documentation that will follow this change. This initial implementation of igb does not cover the full feature set, but it selectively implements changes necessary to pass tests of Linut Test Project, and Windows HLK. The below is the list of the implemented changes; anything not listed here is not implemented: New features: - igb advanced descriptor handling - Support of 16 queues - SRRCTL.BSIZEPACKET register field - SRRCTL.RDMTS register field - Tx descriptor completion writeback - Extended RA registers - VMDq feature - MRQC "Multiple Receive Queues Enable" register field - DTXSWC.Loopback_en register field - VMOLR.ROMPE register field - VMOLR.AUPE register field - VLVF.VLAN_id register field - VLVF.VI_En register field - VF - Mailbox - Reset - Extended interrupt registers - Default values for IGP01E1000 PHY registers Removed features: - e1000e extended descriptor - e1000e packet split descriptor - Legacy descriptor - PHY register paging - MAC Registers - Legacy interrupt timer registers - Legacy EEPROM registers - PBA/POEM registers - RSRPD register - RFCTL.ACKDIS - RCTL.DTYPE - Copper PHY registers Misc: - VET register format - ICR register format Signed-off-by: Gal Hammer <gal.hammer@sap.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> [Jason: don't abort on msi(x)_init()] Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: Split header filesAkihiko Odaki2023-03-108-1027/+1076
| | | | | | | | | | | | | | | | | | | | | | Some definitions in the header files are invalid for igb so extract them to new header files to keep igb from referring to them. Signed-off-by: Gal Hammer <gal.hammer@sap.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * pcie: Introduce pcie_sriov_num_vfsAkihiko Odaki2023-03-101-0/+5
| | | | | | | | | | | | | | | | | | | | | | igb can use this function to change its behavior depending on the number of virtual functions currently enabled. Signed-off-by: Gal Hammer <gal.hammer@sap.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net/eth: Introduce EthL4HdrProtoAkihiko Odaki2023-03-106-86/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | igb, a new network device emulation, will need SCTP checksum offloading. Currently eth_get_protocols() has a bool parameter for each protocol currently it supports, but there will be a bit too many parameters if we add yet another protocol. Introduce an enum type, EthL4HdrProto to represent all L4 protocols eth_get_protocols() support with one parameter. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Implement system clockAkihiko Odaki2023-03-107-5/+103
| | | | | | | | | | | | | | | | | | | | The system clock is necessary to implement PTP features. While we are not implementing PTP features for e1000e yet, we do have a plan to implement them for igb, a new network device derived from e1000e, so add system clock to the common base first. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net/eth: Report if headers are actually presentAkihiko Odaki2023-03-106-115/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The values returned by eth_get_protocols() are used to perform RSS, checksumming and segmentation. Even when a packet signals the use of the protocols which these operations can be applied to, the headers for them may not be present because of too short packet or fragmentation, for example. In such a case, the operations cannot be applied safely. Report the presence of headers instead of whether the use of the protocols are indicated with eth_get_protocols(). This also makes corresponding changes to the callers of eth_get_protocols() to match with its new signature and to remove redundant checks for fragmentation. Fixes: 75020a7021 ("Common definitions for VMWARE devices") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Count CRC in Tx statisticsAkihiko Odaki2023-03-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The datasheet 8.19.29 "Good Packets Transmitted Count - GPTC (0x04080; RC)" says: > This register counts the number of good (no errors) packets > transmitted. A good transmit packet is considered one that is 64 or > more bytes in length (from <Destination Address> through <CRC>, > inclusively) in length. It also says similar for the other Tx statistics registers. Add the number of bytes for CRC to those registers. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: Count CRC in Tx statisticsAkihiko Odaki2023-03-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The Software Developer's Manual 13.7.4.5 "Packets Transmitted (64 Bytes) Count" says: > This register counts the number of packets transmitted that are > exactly 64 bytes (from <Destination Address> through <CRC>, > inclusively) in length. It also says similar for the other Tx statistics registers. Add the number of bytes for CRC to those registers. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Combine rx tracesAkihiko Odaki2023-03-102-7/+4
| | | | | | | | | | | | | | | | | | | | | | Whether a packet will be written back to the guest depends on the remaining space of the queue. Therefore, e1000e_rx_written_to_guest and e1000e_rx_not_written_to_guest should log the index of the queue instead of generated interrupts. This also removes the need of e1000e_rx_rss_dispatched_to_queue, which logs the queue index. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Do not assert when MSI-X is disabled laterAkihiko Odaki2023-03-101-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Assertions will fail if MSI-X gets disabled while a timer for MSI-X interrupts is running so remove them to avoid abortions. Fortunately, nothing bad happens even if the assertions won't trigger as msix_notify(), called by timer handlers, does nothing when MSI-X is disabled. This bug was found by Alexander Bulekov when fuzzing igb, a new device implementation derived from e1000e: https://patchew.org/QEMU/20230129053316.1071513-1-alxndr@bu.edu/ The fixed test case is: fuzz/crash_aea040166819193cf9fedb810c6d100221da721a Fixes: 6f3fbe4ed0 ("net: Introduce e1000e device emulation") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * hw/net/net_tx_pkt: Check the payload lengthAkihiko Odaki2023-03-101-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check the payload length if checksumming to ensure the payload contains the space for the resulting value. This bug was found by Alexander Bulekov with the fuzzer: https://patchew.org/QEMU/20230129053316.1071513-1-alxndr@bu.edu/ The fixed test case is: fuzz/crash_6aeaa33e7211ecd603726c53e834df4c6d1e08bc Fixes: e263cd49c7 ("Packet abstraction for VMWARE network devices") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * hw/net/net_tx_pkt: Implement TCP segmentationAkihiko Odaki2023-03-101-42/+206
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was no proper implementation of TCP segmentation before this change, and net_tx_pkt relied solely on IPv4 fragmentation. Not only this is not aligned with the specification, but it also resulted in corrupted IPv6 packets. This is particularly problematic for the igb, a new proposed device implementation; igb provides loopback feature for VMDq and the feature relies on software segmentation. Implement proper TCP segmentation in net_tx_pkt to fix such a scenario. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Perform software segmentation for loopbackAkihiko Odaki2023-03-105-51/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | e1000e didn't perform software segmentation for loopback if virtio-net header is enabled, which is wrong. To fix the problem, introduce net_tx_pkt_send_custom(), which allows the caller to specify whether offloading should be assumed or not. net_tx_pkt_send_custom() also allows the caller to provide a custom sending function. Packets with virtio-net headers and ones without virtio-net headers will be provided at the same time so the function can choose the preferred version. In case of e1000e loopback, it prefers to have virtio-net headers as they allows to skip the checksum verification if VIRTIO_NET_HDR_F_DATA_VALID is set. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * hw/net/net_rx_pkt: Remove net_rx_pkt_has_virt_hdrAkihiko Odaki2023-03-106-45/+9
| | | | | | | | | | | | | | | | | | | | | | When virtio-net header is not set, net_rx_pkt_get_vhdr() returns zero-filled virtio_net_hdr, which is actually valid. In fact, tap device uses zero-filled virtio_net_hdr when virtio-net header is not provided by the peer. Therefore, we can just remove net_rx_pkt_has_virt_hdr() and always assume NetTxPkt has a valid virtio-net header. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * hw/net/net_tx_pkt: Automatically determine if virtio-net header is usedAkihiko Odaki2023-03-104-17/+14
| | | | | | | | | | | | | | | | The new function qemu_get_using_vnet_hdr() allows to automatically determine if virtio-net header is used. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000x: Alter the signature of e1000x_is_vlan_packetAkihiko Odaki2023-03-102-2/+2
| | | | | | | | | | | | | | | | e1000x_is_vlan_packet() had a pointer to uint8_t as a parameter, but it does not have to be uint8_t. Change the type to void *. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * net: Check L4 header sizeAkihiko Odaki2023-03-104-16/+33
| | | | | | | | | | | | | | | | | | net_tx_pkt_build_vheader() inspects TCP header but had no check for the header size, resulting in an undefined behavior. Check the header size and drop the packet if the header is too small. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Remove extra pointer indirectionAkihiko Odaki2023-03-101-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | e1000e_write_packet_to_guest() passes the reference of variable ba as a pointer to an array, and that pointer indirection is just unnecessary; all functions which uses the passed reference performs no pointer operation on the pointer and they simply dereference the passed pointer. Remove the extra pointer indirection. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Set MII_ANER_NWAYAkihiko Odaki2023-03-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This keeps Windows driver 12.18.9.23 from generating an event with ID 30. The description of the event is as follows: > Intel(R) 82574L Gigabit Network Connection > PROBLEM: The network adapter is configured for auto-negotiation but > the link partner is not. This may result in a duplex mismatch. > ACTION: Configure the link partner for auto-negotiation. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Introduce e1000_rx_desc_unionAkihiko Odaki2023-03-102-59/+57
| | | | | | | | | | | | | | | | | | | | | | | | Before this change, e1000e_write_packet_to_guest() allocated the receive descriptor buffer as an array of uint8_t. This does not ensure the buffer is sufficiently aligned. Introduce e1000_rx_desc_union type, a union type of all receive descriptor types to correct this. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Configure ResettableClassAkihiko Odaki2023-03-102-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | This is part of recent efforts of refactoring e1000 and e1000e. DeviceClass's reset member is deprecated so migrate to ResettableClass. There is no behavioral difference. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: Configure ResettableClassAkihiko Odaki2023-03-101-9/+4
| | | | | | | | | | | | | | | | | | | | | | | | This is part of recent efforts of refactoring e1000 and e1000e. DeviceClass's reset member is deprecated so migrate to ResettableClass. There is no behavioral difference. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Improve software resetAkihiko Odaki2023-03-101-5/+19
| | | | | | | | | | | | | | | | | | This change makes e1000e reset more things when software reset was triggered. Some registers are exempted from software reset in the datasheet and this change also implements the behavior accordingly. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Remove pending interrupt flagsAkihiko Odaki2023-03-104-23/+5
| | | | | | | | | | | | | | | | | | They are duplicate of running throttling timer flags and incomplete as the flags are not cleared when the interrupts are fired or the device is reset. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Use memcpy to intialize registersAkihiko Odaki2023-03-101-2/+2
| | | | | | | | | | | | | | | | Use memcpy instead of memmove to initialize registers. The initial register templates and register table instances will never overlap. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: Use memcpy to intialize registersAkihiko Odaki2023-03-101-2/+2
| | | | | | | | | | | | | | | | Use memcpy instead of memmove to initialize registers. The initial register templates and register table instances will never overlap. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Use more constant definitionsAkihiko Odaki2023-03-102-22/+34
| | | | | | | | | | | | | | | | The definitions of SW Semaphore Register were copied from: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/intel/e1000e/defines.h?h=v6.0.9#n374 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: Use more constant definitionsAkihiko Odaki2023-03-104-25/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The definitions for E1000_VFTA_ENTRY_SHIFT, E1000_VFTA_ENTRY_MASK, and E1000_VFTA_ENTRY_BIT_SHIFT_MASK were copied from: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/intel/e1000/e1000_hw.h?h=v6.0.9#n306 The definitions for E1000_NUM_UNICAST, E1000_MC_TBL_SIZE, and E1000_VLAN_FILTER_TBL_SIZE were copied from: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/intel/e1000/e1000_hw.h?h=v6.0.9#n707 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Mask registers when writingAkihiko Odaki2023-03-101-44/+32
| | | | | | | | | | | | | | | | | | When a register has effective bits fewer than their width, the old code inconsistently masked when writing or reading. Make the code consistent by always masking when writing, and remove some code duplication. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Introduce E1000E_LOW_BITS_SET_FUNCAkihiko Odaki2023-03-101-10/+8
| | | | | | | | | | | | | | | | e1000e_set_16bit and e1000e_set_12bit look so similar so define a generic macro. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: Mask registers when writingAkihiko Odaki2023-03-101-53/+31
| | | | | | | | | | | | | | | | | | When a register has effective bits fewer than their width, the old code inconsistently masked when writing or reading. Make the code consistent by always masking when writing, and remove some code duplication. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000: Use hw/net/mii.hAkihiko Odaki2023-03-106-144/+101
| | | | | | | | | | | | | | | | hw/net/mii.h provides common definitions for MII. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * fsl_etsec: Use hw/net/mii.hAkihiko Odaki2023-03-103-24/+9
| | | | | | | | | | | | | | | | hw/net/mii.h provides common definitions for MII. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
| * e1000e: Fix the code styleAkihiko Odaki2023-03-105-158/+168
| | | | | | | | | | | | | | | | | | igb implementation first starts off by copying e1000e code. Correct the code style before that. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
* | Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Peter Maydell2023-03-1025-248/+912
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pc,pci: features, fixes Several features that landed at the last possible moment: Passthrough HDM decoder emulation Refactor cryptodev RAS error emulation and injection acpi-index support on non-hotpluggable slots Dynamically switch to vhost shadow virtqueues at vdpa net migration Plus a couple of bugfixes that look important to have in the release. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmQJ8TYPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp37YIAMpQA5/ddmKKz/ABtBMHB5JX/SVYcG+1xkBR # j9IFYusOfmmDfmgAhv0Qxi9+Wik95lszVZUnphvocSGd0PXH47pK7yv9RZ1ttaYX # oAbXrGqXo8rUhl1ksQsJ8Iasj2di1BLP0byPuozbRkg1Kkz5TqRd9+hBqSBGEx21 # tsP5708UVCDAriwYYO78Cx0ZasmB9bqqeom5FdEsg9sYJ5aElOOvitp9YO1p2xhU # gRvhD+k/aqNi+mfOUF7qGDBanxKgx75VV/KU1cjjS9R1vNtwRhfc/26PBrROY00a # wkZWnAxmzDFKRS6cEfeb+eDGEVjC3IqLAjcFeuAIT/78CwdvIiY= # =e1yv # -----END PGP SIGNATURE----- # gpg: Signature made Thu 09 Mar 2023 14:46:14 GMT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (72 commits) virtio: fix reachable assertion due to stale value of cached region size hw/virtio/vhost-user: avoid using unitialized errp hw/pxb-cxl: Support passthrough HDM Decoders unless overridden hw/pci: Add pcie_count_ds_port() and pcie_find_port_first() helpers hw/mem/cxl_type3: Add CXL RAS Error Injection Support. hw/pci/aer: Make PCIE AER error injection facility available for other emulation to use. hw/cxl: Fix endian issues in CXL RAS capability defaults / masks hw/mem/cxl-type3: Add AER extended capability hw/pci-bridge/cxl_root_port: Wire up MSI hw/pci-bridge/cxl_root_port: Wire up AER hw/pci/aer: Add missing routing for AER errors hw/pci/aer: Implement PCI_ERR_UNCOR_MASK register pcihp: add ACPI PCI hotplug specific is_hotpluggable_bus() callback pcihp: move fields enabling hotplug into AcpiPciHpState acpi: pci: move out ACPI PCI hotplug generator from generic slot generator build_append_pci_bus_devices() acpi: pci: move BSEL into build_append_pcihp_slots() acpi: pci: drop BSEL usage when deciding that device isn't hotpluggable pci: move acpi-index uniqueness check to generic PCI device code tests: acpi: update expected blobs tests: acpi: add non zero function device with acpi-index on non-hotpluggble bus ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * virtio: fix reachable assertion due to stale value of cached region sizeCarlos López2023-03-071-6/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In virtqueue_{split,packed}_get_avail_bytes() descriptors are read in a loop via MemoryRegionCache regions and calls to vring_{split,packed}_desc_read() - these take a region cache and the index of the descriptor to be read. For direct descriptors we use a cache provided by the caller, whose size matches that of the virtqueue vring. We limit the number of descriptors we can read by the size of that vring: max = vq->vring.num; ... MemoryRegionCache *desc_cache = &caches->desc; For indirect descriptors, we initialize a new cache and limit the number of descriptors by the size of the intermediate descriptor: len = address_space_cache_init(&indirect_desc_cache, vdev->dma_as, desc.addr, desc.len, false); desc_cache = &indirect_desc_cache; ... max = desc.len / sizeof(VRingDesc); However, the first initialization of `max` is done outside the loop where we process guest descriptors, while the second one is done inside. This means that a sequence of an indirect descriptor followed by a direct one will leave a stale value in `max`. If the second descriptor's `next` field is smaller than the stale value, but greater than the size of the virtqueue ring (and thus the cached region), a failed assertion will be triggered in address_space_read_cached() down the call chain. Fix this by initializing `max` inside the loop in both functions. Fixes: 9796d0ac8fb0 ("virtio: use address_space_map/unmap to access descriptors") Signed-off-by: Carlos López <clopez@suse.de> Message-Id: <20230302100358.3613-1-clopez@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/virtio/vhost-user: avoid using unitialized errpAlbert Esteve2023-03-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During protocol negotiation, when we the QEMU stub does not support a backend with F_CONFIG, it throws a warning and supresses the VHOST_USER_PROTOCOL_F_CONFIG bit. However, the warning uses warn_reportf_err macro and passes an unitialized errp pointer. However, the macro tries to edit the 'msg' member of the unitialized Error and segfaults. Instead, just use warn_report, which prints a warning message directly to the output. Fixes: 5653493 ("hw/virtio/vhost-user: don't suppress F_CONFIG when supported") Signed-off-by: Albert Esteve <aesteve@redhat.com> Message-Id: <20230302121719.9390-1-aesteve@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/pxb-cxl: Support passthrough HDM Decoders unless overriddenJonathan Cameron2023-03-072-17/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CXL r3.0 specification allows for there to be no HDM decoders on CXL Host Bridges if they have only a single root port. Instead, all accesses directed to the host bridge (as specified in CXL Fixed Memory Windows) are assumed to be routed to the single root port. Linux currently assumes this implementation choice. So to simplify testing, make QEMU emulation also default to no HDM decoders under these particular circumstances, but provide a hdm_for_passthrough boolean option to have HDM decoders as previously. Technically this is breaking backwards compatibility, but given the only known software stack used with the QEMU emulation is the Linux kernel and this configuration did not work before this change, there are unlikely to be any complaints that it now works. The option is retained to allow testing of software that does allow for these HDM decoders to exist, once someone writes it. Reported-by: Fan Ni <fan.ni@samsung.com> Reviewed-by: Fan Ni <fan.ni@samsung.com> Tested-by: Fan Ni <fan.ni@samsung.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> -- v2: Pick up and fix typo in tag from Fan Ni Message-Id: <20230227153128.8164-3-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/pci: Add pcie_count_ds_port() and pcie_find_port_first() helpersJonathan Cameron2023-03-071-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | These two helpers enable host bridges to operate differently depending on the number of downstream ports, in particular if there is only a single port. Useful for CXL where HDM address decoders are allowed to be implicit in the host bridge if there is only a single root port. Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20230227153128.8164-2-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/mem/cxl_type3: Add CXL RAS Error Injection Support.Jonathan Cameron2023-03-074-1/+303
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CXL uses PCI AER Internal errors to signal to the host that an error has occurred. The host can then read more detailed status from the CXL RAS capability. For uncorrectable errors: support multiple injection in one operation as this is needed to reliably test multiple header logging support in an OS. The equivalent feature doesn't exist for correctable errors, so only one error need be injected at a time. Note: - Header content needs to be manually specified in a fashion that matches the specification for what can be in the header for each error type. Injection via QMP: { "execute": "qmp_capabilities" } ... { "execute": "cxl-inject-uncorrectable-errors", "arguments": { "path": "/machine/peripheral/cxl-pmem0", "errors": [ { "type": "cache-address-parity", "header": [ 3, 4] }, { "type": "cache-data-parity", "header": [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31] }, { "type": "internal", "header": [ 1, 2, 4] } ] }} ... { "execute": "cxl-inject-correctable-error", "arguments": { "path": "/machine/peripheral/cxl-pmem0", "type": "physical" } } Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20230302133709.30373-9-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * hw/pci/aer: Make PCIE AER error injection facility available for other ↵Jonathan Cameron2023-03-071-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | emulation to use. This infrastructure will be reused for CXL RAS error injection in patches that follow. Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20230302133709.30373-8-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Fan Ni <fan.ni@samsung.com>
| * hw/cxl: Fix endian issues in CXL RAS capability defaults / masksJonathan Cameron2023-03-071-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As these are about to be modified, fix the endian handle for this set of registers rather than making it worse. Note that CXL is currently only supported in QEMU on x86 (arm64 patches out of tree) so we aren't going to yet hit an problems with big endian. However it is good to avoid making things worse for that support in the future. Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-Id: <20230302133709.30373-7-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Fan Ni <fan.ni@samsung.com>