Commit Graph
11795 Commits
Author SHA1 Message Date
Peter Maydell f9dc72de91 Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210527-pull-request' into staging
virtio-gpu: add blob resource support.
vhost-user-gpu: security fixes.

# gpg: Signature made Thu 27 May 2021 15:23:25 BST
# gpg:                using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20210527-pull-request: (23 commits)
  virtio-gpu: Update cursor data using blob
  virtio-gpu: Add virtio_gpu_set_scanout_blob
  virtio-gpu: Factor out update scanout
  virtio-gpu: Add helpers to create and destroy dmabuf objects
  ui/pixman: Add qemu_pixman_to_drm_format()
  virtio-gpu: Add virtio_gpu_resource_create_blob
  virtio-gpu: Add initial definitions for blob resources
  virtio-gpu: Refactor virtio_gpu_create_mapping_iov
  virtio-gpu: Refactor virtio_gpu_set_scanout
  virtio-gpu: Add virtio_gpu_find_check_resource
  stubs: Add stubs for udmabuf helpers
  virtio-gpu: Add udmabuf helpers
  headers: Add udmabuf.h
  ui: Get the fd associated with udmabuf driver
  hw/display/qxl: Set pci rom address aligned with page size
  vhost-user-gpu: abstract vg_cleanup_mapping_iov
  vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)
  vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544)
  vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)
  vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544)
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-05-30 18:33:43 +01:00
Peter Maydell 62c0ac5041 Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210526' into staging
Adjust types for some memory access functions.
Reduce inclusion of tcg headers.
Fix watchpoints vs replay.
Fix tcg/aarch64 roli expansion.
Introduce SysemuCPUOps structure.

# gpg: Signature made Thu 27 May 2021 00:43:54 BST
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth-gitlab/tags/pull-tcg-20210526: (31 commits)
  hw/core: Constify TCGCPUOps
  target/mips: Fold jazz behaviour into mips_cpu_do_transaction_failed
  cpu: Move CPUClass::get_paging_enabled to SysemuCPUOps
  cpu: Move CPUClass::get_memory_mapping to SysemuCPUOps
  cpu: Move CPUClass::get_phys_page_debug to SysemuCPUOps
  cpu: Move CPUClass::asidx_from_attrs to SysemuCPUOps
  cpu: Move CPUClass::write_elf* to SysemuCPUOps
  cpu: Move CPUClass::get_crash_info to SysemuCPUOps
  cpu: Move CPUClass::virtio_is_big_endian to SysemuCPUOps
  cpu: Move CPUClass::vmsd to SysemuCPUOps
  cpu: Introduce SysemuCPUOps structure
  cpu: Move AVR target vmsd field from CPUClass to DeviceClass
  cpu: Rename CPUClass vmsd -> legacy_vmsd
  cpu: Assert DeviceClass::vmsd is NULL on user emulation
  cpu: Directly use get_memory_mapping() fallback handlers in place
  cpu: Directly use get_paging_enabled() fallback handlers in place
  cpu: Directly use cpu_write_elf*() fallback handlers in place
  cpu: Introduce cpu_virtio_is_big_endian()
  cpu: Un-inline cpu_get_phys_page_debug and cpu_asidx_from_attrs
  cpu: Split as cpu-common / cpu-sysemu
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-05-28 16:25:21 +01:00
Vivek KasireddyandGerd Hoffmann 32db3c63ae virtio-gpu: Add virtio_gpu_set_scanout_blob
This API allows Qemu to set the blob allocated by the Guest as
the scanout buffer. If Opengl support is available, then the
scanout buffer would be submitted as a dmabuf to the UI; if not,
a pixman image is created from the scanout buffer and is
submitted to the UI via the display surface.

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-14-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:07:37 +02:00
Vivek KasireddyandGerd Hoffmann 5752519e93 virtio-gpu: Add helpers to create and destroy dmabuf objects
These helpers can be useful for creating dmabuf objects from blobs
and submitting them to the UI.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-12-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:07:37 +02:00
Vivek KasireddyandGerd Hoffmann 8069b73bee ui/pixman: Add qemu_pixman_to_drm_format()
This new function to get the drm_format associated with a pixman
format will be useful while creating a dmabuf.

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-11-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:07:37 +02:00
Vivek KasireddyandGerd Hoffmann e0933d91b1 virtio-gpu: Add virtio_gpu_resource_create_blob
This API allows Qemu to register the blob allocated by the Guest
as a new resource and map its backing storage.

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-10-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:07:37 +02:00
Vivek KasireddyandGerd Hoffmann cce386e19e virtio-gpu: Add initial definitions for blob resources
Add the property bit, configuration flag and other relevant
macros and definitions associated with this feature.

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-9-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:07:37 +02:00
Vivek KasireddyandGerd Hoffmann 70d3766231 virtio-gpu: Refactor virtio_gpu_create_mapping_iov
Instead of passing the attach_backing object to extract nr_entries
and offset, explicitly pass these as arguments to this function.
This will be helpful when adding create_blob API.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-8-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:07:37 +02:00
Vivek KasireddyandGerd Hoffmann e64d4b6a9b virtio-gpu: Refactor virtio_gpu_set_scanout
Store the meta-data associated with a FB in a new object
(struct virtio_gpu_framebuffer) and pass the object to set_scanout.
Also move code in set_scanout into a do_set_scanout function.
This will be helpful when adding set_scanout_blob API.

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-7-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:07:37 +02:00
Vivek KasireddyandGerd Hoffmann 9b60cdf987 virtio-gpu: Add udmabuf helpers
Add helper functions to create a dmabuf for a resource and mmap it.
Also, introduce the fields blob and blob_size so that these helpers
can start to use them but the full picture will emerge only after
adding create_blob API in patch 8 of this series.

To be able to create a dmabuf using the udmabuf driver, Qemu needs
to be lauched with the memfd memory backend like this:

qemu-system-x86_64 -m 8192m -object memory-backend-memfd,id=mem1,size=8192M
-machine memory-backend=mem1

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-4-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:06:37 +02:00
Vivek KasireddyandGerd Hoffmann 4d01086161 headers: Add udmabuf.h
This adds udmabuf header to standard headers so that the
relevant udmabuf objects can be accessed in subsequent
patches.

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-3-vivek.kasireddy@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:06:37 +02:00
Vivek KasireddyandGerd Hoffmann 87f12216d9 ui: Get the fd associated with udmabuf driver
Try to open the udmabuf dev node for the first time or return the
fd if the device was previously opened.

Based-on-patch-by: Gerd Hoffmann <kraxel@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20210526231429.1045476-2-vivek.kasireddy@intel.com>

[ kraxel: fixup fcntl.h include ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-27 12:06:01 +02:00
Richard Henderson 119065574d hw/core: Constify TCGCPUOps
We no longer have any runtime modifications to this struct,
so declare them all const.

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20210227232519.222663-3-richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson 6bc0d6a047 cpu: Move CPUClass::get_paging_enabled to SysemuCPUOps
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-23-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson 2b60b62e05 cpu: Move CPUClass::get_memory_mapping to SysemuCPUOps
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-22-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson 08928c6d0d cpu: Move CPUClass::get_phys_page_debug to SysemuCPUOps
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-21-f4bug@amsat.org>
[rth: Drop declaration movement from target/*/cpu.h]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson faf39e8283 cpu: Move CPUClass::asidx_from_attrs to SysemuCPUOps
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-20-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson 715e3c1afb cpu: Move CPUClass::write_elf* to SysemuCPUOps
The write_elf*() handlers are used to dump vmcore images.
This feature is only meaningful for system emulation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-19-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson 83ec01b675 cpu: Move CPUClass::get_crash_info to SysemuCPUOps
cpu_get_crash_info() is called on GUEST_PANICKED events,
which only occur in system emulation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-18-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson da383e0263 cpu: Move CPUClass::virtio_is_big_endian to SysemuCPUOps
VirtIO devices are only meaningful with system emulation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-17-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson feece4d070 cpu: Move CPUClass::vmsd to SysemuCPUOps
Migration is specific to system emulation.

- Move the CPUClass::vmsd field to SysemuCPUOps,
- restrict VMSTATE_CPU() macro to sysemu,
- vmstate_dummy is now unused, remove it.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-16-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson 8b80bd28a5 cpu: Introduce SysemuCPUOps structure
Introduce a structure to hold handler specific to sysemu.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-15-f4bug@amsat.org>
[rth: Squash "restrict hw/core/sysemu-cpu-ops.h" patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson 744c72a837 cpu: Rename CPUClass vmsd -> legacy_vmsd
Quoting Peter Maydell [*]:

  There are two ways to handle migration for
  a CPU object:

  (1) like any other device, so it has a dc->vmsd that covers
  migration for the whole object. As usual for objects that are a
  subclass of a parent that has state, the first entry in the
  VMStateDescription field list is VMSTATE_CPU(), which migrates
  the cpu_common fields, followed by whatever the CPU's own migration
  fields are.

  (2) a backwards-compatible mechanism for CPUs that were
  originally migrated using manual "write fields to the migration
  stream structures". The on-the-wire migration format
  for those is based on the 'env' pointer (which isn't a QOM object),
  and the cpu_common part of the migration data is elsewhere.

  cpu_exec_realizefn() handles both possibilities:

  * for type 1, dc->vmsd is set and cc->vmsd is not,
    so cpu_exec_realizefn() does nothing, and the standard
    "register dc->vmsd for a device" code does everything needed

  * for type 2, dc->vmsd is NULL and so we register the
    vmstate_cpu_common directly to handle the cpu-common fields,
    and the cc->vmsd to handle the per-CPU stuff

  You can't change a CPU from one type to the other without breaking
  migration compatibility, which is why some guest architectures
  are stuck on the cc->vmsd form. New targets should use dc->vmsd.

To avoid new targets to start using type (2), rename cc->vmsd as
cc->legacy_vmsd. The correct field to implement is dc->vmsd (the
DeviceClass one).

See also commit b170fce3dd ("cpu: Register VMStateDescription
through CPUState") for historic background.

[*] https://www.mail-archive.com/qemu-devel@nongnu.org/msg800849.html

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210517105140.1062037-13-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson cdba7e2f49 cpu: Introduce cpu_virtio_is_big_endian()
Introduce the cpu_virtio_is_big_endian() generic helper to avoid
calling CPUClass internal virtio_is_big_endian() one.

Similarly to commit bf7663c4bd ("cpu: introduce
CPUClass::virtio_is_big_endian()"), we keep 'virtio' in the method
name to hint this handler shouldn't be called anywhere but from the
virtio code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-8-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00
Philippe Mathieu-DaudéandRichard Henderson a41d3aae52 cpu: Un-inline cpu_get_phys_page_debug and cpu_asidx_from_attrs
To be able to later extract the cpu_get_phys_page_debug() and
cpu_asidx_from_attrs() handlers from CPUClass, un-inline them
from "hw/core/cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210517105140.1062037-7-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-05-26 15:33:59 -07:00