[Qemu-devel] [PULL 0/7] pci, pc, virtio: fixes, features

[Qemu-devel] [PULL 0/7] pci, pc, virtio: fixes, features

[Michael S. Tsirkin]

The following changes since commit 19b599f7664b2ebfd0f405fb79c14dd241557452:

  Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' into staging (2018-08-27 16:44:20 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream

for you to fetch changes up to d2a1b1d602986a5f02658f6d4fc9ed422f8ddebf:

  tests: update acpi expected files (2018-09-07 17:43:22 -0400)

----------------------------------------------------------------
pci, pc, virtio: fixes, features

pci resource capability + misc fixes everywhere.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

----------------------------------------------------------------
Igor Mammedov (2):
      pc: acpi: revert back to 1 SRAT entry for hotpluggable area
      pc: make sure that guest isn't able to unplug the first cpu

Jing Liu (2):
      hw/pci: factor PCI reserve resources to a separate structure
      hw/pci: add PCI resource reserve capability to legacy PCI bridge

Michael S. Tsirkin (1):
      tests: update acpi expected files

Paolo Bonzini (1):
      virtio: update MemoryRegionCaches when guest negotiates features

Yury Kotov (1):
      vhost: fix invalid downcast

 include/hw/pci/pci_bridge.h           |  18 ++++++---
 hw/acpi/cpu.c                         |  10 +++--
 hw/i386/acpi-build.c                  |  73 ++++++----------------------------
 hw/pci-bridge/gen_pcie_root_port.c    |  33 +++++++--------
 hw/pci-bridge/pci_bridge_dev.c        |  24 +++++++++++
 hw/pci/pci_bridge.c                   |  38 ++++++++----------
 hw/virtio/vhost.c                     |   4 +-
 hw/virtio/virtio.c                    |  15 ++++++-
 tests/acpi-test-data/pc/DSDT          | Bin 5144 -> 5131 bytes
 tests/acpi-test-data/pc/DSDT.bridge   | Bin 7003 -> 6990 bytes
 tests/acpi-test-data/pc/DSDT.cphp     | Bin 5607 -> 5594 bytes
 tests/acpi-test-data/pc/DSDT.dimmpxm  | Bin 6803 -> 6790 bytes
 tests/acpi-test-data/pc/DSDT.ipmikcs  | Bin 5216 -> 5203 bytes
 tests/acpi-test-data/pc/DSDT.memhp    | Bin 6509 -> 6496 bytes
 tests/acpi-test-data/pc/DSDT.numamem  | Bin 5150 -> 5137 bytes
 tests/acpi-test-data/pc/SRAT.dimmpxm  | Bin 472 -> 392 bytes
 tests/acpi-test-data/pc/SRAT.memhp    | Bin 264 -> 264 bytes
 tests/acpi-test-data/q35/DSDT         | Bin 7828 -> 7815 bytes
 tests/acpi-test-data/q35/DSDT.bridge  | Bin 7845 -> 7832 bytes
 tests/acpi-test-data/q35/DSDT.cphp    | Bin 8291 -> 8278 bytes
 tests/acpi-test-data/q35/DSDT.dimmpxm | Bin 9487 -> 9474 bytes
 tests/acpi-test-data/q35/DSDT.ipmibt  | Bin 7903 -> 7890 bytes
 tests/acpi-test-data/q35/DSDT.memhp   | Bin 9193 -> 9180 bytes
 tests/acpi-test-data/q35/DSDT.numamem | Bin 7834 -> 7821 bytes
 tests/acpi-test-data/q35/SRAT.dimmpxm | Bin 472 -> 392 bytes
 tests/acpi-test-data/q35/SRAT.memhp   | Bin 264 -> 264 bytes
 26 files changed, 103 insertions(+), 112 deletions(-)

[Qemu-devel] [PULL 1/7] pc: acpi: revert back to 1 SRAT entry for hotpluggable area

[Michael S. Tsirkin]

From: Igor Mammedov <imammedo@redhat.com>

Commit
  10efd7e108 "pc: acpi: fix memory hotplug regression by reducing stub SRAT entry size"
attemped to fix hotplug regression introduced by
  848a1cc1e "hw/acpi-build: build SRAT memory affinity structures for DIMM devices"

fixed issue for Windows/3.0+ linux kernels, however it regressed 2.6 based
kernels (RHEL6) to the point where guest might crash at boot.
Reason is that 2.6 kernel discards SRAT table due too small last entry
which down the road leads to crashes. Hack I've tried in 10efd7e108 is also
not ACPI spec compliant according to which whole possible RAM should be
described in SRAT. Revert 10efd7e108 to fix regression for 2.6 based kernels.

With 10efd7e108 reverted, I've also tried splitting SRAT table statically
in different ways %/node and %/slot but Windows still fails to online
2nd pc-dimm hot-plugged into node 0 (as described in 10efd7e108) and
sometimes even coldplugged pc-dimms where affected with static SRAT
partitioning.
The only known so far way where Windows stays happy is when we have 1
SRAT entry in the last node covering all hotplug area.

Revert 848a1cc1e until we come up with a way to avoid regression
on Windows with hotplug area split in several entries.
Tested this with 2.6/3.0 based kernels (RHEL6/7) and WS20[08/12/12R2/16]).

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/acpi-build.c | 73 ++++++++------------------------------------
 1 file changed, 12 insertions(+), 61 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index e1ee8ae9e0..1599caa7c5 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -2251,64 +2251,6 @@ build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog)
 #define HOLE_640K_START  (640 * KiB)
 #define HOLE_640K_END   (1 * MiB)
 
-static void build_srat_hotpluggable_memory(GArray *table_data, uint64_t base,
-                                           uint64_t len, int default_node)
-{
-    MemoryDeviceInfoList *info_list = qmp_memory_device_list();
-    MemoryDeviceInfoList *info;
-    MemoryDeviceInfo *mi;
-    PCDIMMDeviceInfo *di;
-    uint64_t end = base + len, cur, size;
-    bool is_nvdimm;
-    AcpiSratMemoryAffinity *numamem;
-    MemoryAffinityFlags flags;
-
-    for (cur = base, info = info_list;
-         cur < end;
-         cur += size, info = info->next) {
-        numamem = acpi_data_push(table_data, sizeof *numamem);
-
-        if (!info) {
-            /*
-             * Entry is required for Windows to enable memory hotplug in OS
-             * and for Linux to enable SWIOTLB when booted with less than
-             * 4G of RAM. Windows works better if the entry sets proximity
-             * to the highest NUMA node in the machine at the end of the
-             * reserved space.
-             * Memory devices may override proximity set by this entry,
-             * providing _PXM method if necessary.
-             */
-            build_srat_memory(numamem, end - 1, 1, default_node,
-                              MEM_AFFINITY_HOTPLUGGABLE | MEM_AFFINITY_ENABLED);
-            break;
-        }
-
-        mi = info->value;
-        is_nvdimm = (mi->type == MEMORY_DEVICE_INFO_KIND_NVDIMM);
-        di = !is_nvdimm ? mi->u.dimm.data : mi->u.nvdimm.data;
-
-        if (cur < di->addr) {
-            build_srat_memory(numamem, cur, di->addr - cur, default_node,
-                              MEM_AFFINITY_HOTPLUGGABLE | MEM_AFFINITY_ENABLED);
-            numamem = acpi_data_push(table_data, sizeof *numamem);
-        }
-
-        size = di->size;
-
-        flags = MEM_AFFINITY_ENABLED;
-        if (di->hotpluggable) {
-            flags |= MEM_AFFINITY_HOTPLUGGABLE;
-        }
-        if (is_nvdimm) {
-            flags |= MEM_AFFINITY_NON_VOLATILE;
-        }
-
-        build_srat_memory(numamem, di->addr, size, di->node, flags);
-    }
-
-    qapi_free_MemoryDeviceInfoList(info_list);
-}
-
 static void
 build_srat(GArray *table_data, BIOSLinker *linker, MachineState *machine)
 {
@@ -2414,10 +2356,19 @@ build_srat(GArray *table_data, BIOSLinker *linker, MachineState *machine)
         build_srat_memory(numamem, 0, 0, 0, MEM_AFFINITY_NOFLAGS);
     }
 
+    /*
+     * Entry is required for Windows to enable memory hotplug in OS
+     * and for Linux to enable SWIOTLB when booted with less than
+     * 4G of RAM. Windows works better if the entry sets proximity
+     * to the highest NUMA node in the machine.
+     * Memory devices may override proximity set by this entry,
+     * providing _PXM method if necessary.
+     */
     if (hotplugabble_address_space_size) {
-        build_srat_hotpluggable_memory(table_data, machine->device_memory->base,
-                                       hotplugabble_address_space_size,
-                                       pcms->numa_nodes - 1);
+        numamem = acpi_data_push(table_data, sizeof *numamem);
+        build_srat_memory(numamem, machine->device_memory->base,
+                          hotplugabble_address_space_size, pcms->numa_nodes - 1,
+                          MEM_AFFINITY_HOTPLUGGABLE | MEM_AFFINITY_ENABLED);
     }
 
     build_header(linker, table_data,
-- 
MST

[Qemu-devel] [PULL 2/7] virtio: update MemoryRegionCaches when guest negotiates features

[Michael S. Tsirkin]

From: Paolo Bonzini <pbonzini@redhat.com>

Because the cache is sized to include the rings and the event indices,
negotiating the VIRTIO_RING_F_EVENT_IDX feature will result in the size
of the cache changing.  And because MemoryRegionCache accesses are
range-checked, if we skip this we end up with an assertion failure.
This happens with OpenBSD 6.3.

Reported-by: Fam Zheng <famz@redhat.com>
Fixes: 97cd965c070152bc626c7507df9fb356bbe1cd81
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index d4e4d98b59..f6a588ab57 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2006,14 +2006,25 @@ static int virtio_set_features_nocheck(VirtIODevice *vdev, uint64_t val)
 
 int virtio_set_features(VirtIODevice *vdev, uint64_t val)
 {
-   /*
+    int ret;
+    /*
      * The driver must not attempt to set features after feature negotiation
      * has finished.
      */
     if (vdev->status & VIRTIO_CONFIG_S_FEATURES_OK) {
         return -EINVAL;
     }
-    return virtio_set_features_nocheck(vdev, val);
+    ret = virtio_set_features_nocheck(vdev, val);
+    if (!ret && virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
+        /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches.  */
+        int i;
+        for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
+            if (vdev->vq[i].vring.num != 0) {
+                virtio_init_region_cache(vdev, i);
+            }
+        }
+    }
+    return ret;
 }
 
 int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
-- 
MST

[Qemu-devel] [PULL 3/7] hw/pci: factor PCI reserve resources to a separate structure

[Michael S. Tsirkin]

From: Jing Liu <jing2.liu@linux.intel.com>

Factor "bus_reserve", "io_reserve", "mem_reserve", "pref32_reserve"
and "pref64_reserve" fields of the "GenPCIERootPort" structure out
to "PCIResReserve" structure, so that other PCI bridges can
reuse it to add resource reserve capability.

Signed-off-by: Jing Liu <jing2.liu@linux.intel.com>
Reviewed-by: Marcel Apfelbaum<marcel.apfelbaum@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/pci/pci_bridge.h        | 18 ++++++++++----
 hw/pci-bridge/gen_pcie_root_port.c | 33 +++++++++++++-------------
 hw/pci/pci_bridge.c                | 38 +++++++++++++-----------------
 3 files changed, 47 insertions(+), 42 deletions(-)

diff --git a/include/hw/pci/pci_bridge.h b/include/hw/pci/pci_bridge.h
index 0347da52d2..cdff7edfd1 100644
--- a/include/hw/pci/pci_bridge.h
+++ b/include/hw/pci/pci_bridge.h
@@ -133,11 +133,19 @@ typedef struct PCIBridgeQemuCap {
 
 #define REDHAT_PCI_CAP_RESOURCE_RESERVE 1
 
+/*
+ * PCI BUS/IO/MEM/PREFMEM additional resources recorded as a
+ * capability in PCI configuration space to reserve on firmware init.
+ */
+typedef struct PCIResReserve {
+    uint32_t bus;
+    uint64_t io;
+    uint64_t mem_non_pref;
+    uint64_t mem_pref_32;
+    uint64_t mem_pref_64;
+} PCIResReserve;
+
 int pci_bridge_qemu_reserve_cap_init(PCIDevice *dev, int cap_offset,
-                              uint32_t bus_reserve, uint64_t io_reserve,
-                              uint64_t mem_non_pref_reserve,
-                              uint64_t mem_pref_32_reserve,
-                              uint64_t mem_pref_64_reserve,
-                              Error **errp);
+                               PCIResReserve res_reserve, Error **errp);
 
 #endif /* QEMU_PCI_BRIDGE_H */
diff --git a/hw/pci-bridge/gen_pcie_root_port.c b/hw/pci-bridge/gen_pcie_root_port.c
index d117e20325..299de429ec 100644
--- a/hw/pci-bridge/gen_pcie_root_port.c
+++ b/hw/pci-bridge/gen_pcie_root_port.c
@@ -29,12 +29,8 @@ typedef struct GenPCIERootPort {
 
     bool migrate_msix;
 
-    /* additional resources to reserve on firmware init */
-    uint32_t bus_reserve;
-    uint64_t io_reserve;
-    uint64_t mem_reserve;
-    uint64_t pref32_reserve;
-    uint64_t pref64_reserve;
+    /* additional resources to reserve */
+    PCIResReserve res_reserve;
 } GenPCIERootPort;
 
 static uint8_t gen_rp_aer_vector(const PCIDevice *d)
@@ -82,16 +78,15 @@ static void gen_rp_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    int rc = pci_bridge_qemu_reserve_cap_init(d, 0, grp->bus_reserve,
-            grp->io_reserve, grp->mem_reserve, grp->pref32_reserve,
-            grp->pref64_reserve, errp);
+    int rc = pci_bridge_qemu_reserve_cap_init(d, 0,
+                                              grp->res_reserve, errp);
 
     if (rc < 0) {
         rpc->parent_class.exit(d);
         return;
     }
 
-    if (!grp->io_reserve) {
+    if (!grp->res_reserve.io) {
         pci_word_test_and_clear_mask(d->wmask + PCI_COMMAND,
                                      PCI_COMMAND_IO);
         d->wmask[PCI_IO_BASE] = 0;
@@ -117,12 +112,18 @@ static const VMStateDescription vmstate_rp_dev = {
 };
 
 static Property gen_rp_props[] = {
-    DEFINE_PROP_BOOL("x-migrate-msix", GenPCIERootPort, migrate_msix, true),
-    DEFINE_PROP_UINT32("bus-reserve", GenPCIERootPort, bus_reserve, -1),
-    DEFINE_PROP_SIZE("io-reserve", GenPCIERootPort, io_reserve, -1),
-    DEFINE_PROP_SIZE("mem-reserve", GenPCIERootPort, mem_reserve, -1),
-    DEFINE_PROP_SIZE("pref32-reserve", GenPCIERootPort, pref32_reserve, -1),
-    DEFINE_PROP_SIZE("pref64-reserve", GenPCIERootPort, pref64_reserve, -1),
+    DEFINE_PROP_BOOL("x-migrate-msix", GenPCIERootPort,
+                     migrate_msix, true),
+    DEFINE_PROP_UINT32("bus-reserve", GenPCIERootPort,
+                       res_reserve.bus, -1),
+    DEFINE_PROP_SIZE("io-reserve", GenPCIERootPort,
+                     res_reserve.io, -1),
+    DEFINE_PROP_SIZE("mem-reserve", GenPCIERootPort,
+                     res_reserve.mem_non_pref, -1),
+    DEFINE_PROP_SIZE("pref32-reserve", GenPCIERootPort,
+                     res_reserve.mem_pref_32, -1),
+    DEFINE_PROP_SIZE("pref64-reserve", GenPCIERootPort,
+                     res_reserve.mem_pref_64, -1),
     DEFINE_PROP_END_OF_LIST()
 };
 
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 40a39f57cb..08b7e44e2e 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -411,38 +411,34 @@ void pci_bridge_map_irq(PCIBridge *br, const char* bus_name,
 
 
 int pci_bridge_qemu_reserve_cap_init(PCIDevice *dev, int cap_offset,
-                                     uint32_t bus_reserve, uint64_t io_reserve,
-                                     uint64_t mem_non_pref_reserve,
-                                     uint64_t mem_pref_32_reserve,
-                                     uint64_t mem_pref_64_reserve,
-                                     Error **errp)
+                                     PCIResReserve res_reserve, Error **errp)
 {
-    if (mem_pref_32_reserve != (uint64_t)-1 &&
-        mem_pref_64_reserve != (uint64_t)-1) {
+    if (res_reserve.mem_pref_32 != (uint64_t)-1 &&
+        res_reserve.mem_pref_64 != (uint64_t)-1) {
         error_setg(errp,
                    "PCI resource reserve cap: PREF32 and PREF64 conflict");
         return -EINVAL;
     }
 
-    if (mem_non_pref_reserve != (uint64_t)-1 &&
-        mem_non_pref_reserve >= (1ULL << 32)) {
+    if (res_reserve.mem_non_pref != (uint64_t)-1 &&
+        res_reserve.mem_non_pref >= (1ULL << 32)) {
         error_setg(errp,
                    "PCI resource reserve cap: mem-reserve must be less than 4G");
         return -EINVAL;
     }
 
-    if (mem_pref_32_reserve != (uint64_t)-1 &&
-        mem_pref_32_reserve >= (1ULL << 32)) {
+    if (res_reserve.mem_pref_32 != (uint64_t)-1 &&
+        res_reserve.mem_pref_32 >= (1ULL << 32)) {
         error_setg(errp,
                    "PCI resource reserve cap: pref32-reserve  must be less than 4G");
         return -EINVAL;
     }
 
-    if (bus_reserve == (uint32_t)-1 &&
-        io_reserve == (uint64_t)-1 &&
-        mem_non_pref_reserve == (uint64_t)-1 &&
-        mem_pref_32_reserve == (uint64_t)-1 &&
-        mem_pref_64_reserve == (uint64_t)-1) {
+    if (res_reserve.bus == (uint32_t)-1 &&
+        res_reserve.io == (uint64_t)-1 &&
+        res_reserve.mem_non_pref == (uint64_t)-1 &&
+        res_reserve.mem_pref_32 == (uint64_t)-1 &&
+        res_reserve.mem_pref_64 == (uint64_t)-1) {
         return 0;
     }
 
@@ -450,11 +446,11 @@ int pci_bridge_qemu_reserve_cap_init(PCIDevice *dev, int cap_offset,
     PCIBridgeQemuCap cap = {
             .len = cap_len,
             .type = REDHAT_PCI_CAP_RESOURCE_RESERVE,
-            .bus_res = bus_reserve,
-            .io = io_reserve,
-            .mem = mem_non_pref_reserve,
-            .mem_pref_32 = mem_pref_32_reserve,
-            .mem_pref_64 = mem_pref_64_reserve
+            .bus_res = res_reserve.bus,
+            .io = res_reserve.io,
+            .mem = res_reserve.mem_non_pref,
+            .mem_pref_32 = res_reserve.mem_pref_32,
+            .mem_pref_64 = res_reserve.mem_pref_64
     };
 
     int offset = pci_add_capability(dev, PCI_CAP_ID_VNDR,
-- 
MST

[Qemu-devel] [PULL 4/7] hw/pci: add PCI resource reserve capability to legacy PCI bridge

[Michael S. Tsirkin]

From: Jing Liu <jing2.liu@linux.intel.com>

Add hint to firmware (e.g. SeaBIOS) to reserve addtional
BUS/IO/MEM/PREF resource for legacy pci-pci bridge. Add the
resource reserve capability deleting in pci_bridge_dev_exitfn.

Signed-off-by: Jing Liu <jing2.liu@linux.intel.com>
Reviewed-by: Marcel Apfelbaum<marcel.apfelbaum@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-bridge/pci_bridge_dev.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index b2d861d216..97a8e8b6a4 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -46,6 +46,9 @@ struct PCIBridgeDev {
     uint32_t flags;
 
     OnOffAuto msi;
+
+    /* additional resources to reserve */
+    PCIResReserve res_reserve;
 };
 typedef struct PCIBridgeDev PCIBridgeDev;
 
@@ -95,6 +98,12 @@ static void pci_bridge_dev_realize(PCIDevice *dev, Error **errp)
         error_free(local_err);
     }
 
+    err = pci_bridge_qemu_reserve_cap_init(dev, 0,
+                                         bridge_dev->res_reserve, errp);
+    if (err) {
+        goto cap_error;
+    }
+
     if (shpc_present(dev)) {
         /* TODO: spec recommends using 64 bit prefetcheable BAR.
          * Check whether that works well. */
@@ -103,6 +112,8 @@ static void pci_bridge_dev_realize(PCIDevice *dev, Error **errp)
     }
     return;
 
+cap_error:
+    msi_uninit(dev);
 msi_error:
     slotid_cap_cleanup(dev);
 slotid_error:
@@ -116,6 +127,8 @@ shpc_error:
 static void pci_bridge_dev_exitfn(PCIDevice *dev)
 {
     PCIBridgeDev *bridge_dev = PCI_BRIDGE_DEV(dev);
+
+    pci_del_capability(dev, PCI_CAP_ID_VNDR, sizeof(PCIBridgeQemuCap));
     if (msi_present(dev)) {
         msi_uninit(dev);
     }
@@ -162,6 +175,17 @@ static Property pci_bridge_dev_properties[] = {
                             ON_OFF_AUTO_AUTO),
     DEFINE_PROP_BIT(PCI_BRIDGE_DEV_PROP_SHPC, PCIBridgeDev, flags,
                     PCI_BRIDGE_DEV_F_SHPC_REQ, true),
+    DEFINE_PROP_UINT32("bus-reserve", PCIBridgeDev,
+                       res_reserve.bus, -1),
+    DEFINE_PROP_SIZE("io-reserve", PCIBridgeDev,
+                     res_reserve.io, -1),
+    DEFINE_PROP_SIZE("mem-reserve", PCIBridgeDev,
+                     res_reserve.mem_non_pref, -1),
+    DEFINE_PROP_SIZE("pref32-reserve", PCIBridgeDev,
+                     res_reserve.mem_pref_32, -1),
+    DEFINE_PROP_SIZE("pref64-reserve", PCIBridgeDev,
+                     res_reserve.mem_pref_64, -1),
+
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
MST

[Qemu-devel] [PULL 5/7] pc: make sure that guest isn't able to unplug the first cpu

[Michael S. Tsirkin]

From: Igor Mammedov <imammedo@redhat.com>

The first cpu unplug wasn't ever supported and corresponding
monitor/qmp commands refuse to unplug it. However guest is able
to issue eject request either using following command:
  # echo 1 >/sys/devices/system/cpu/cpu0/firmware_node/eject
or directly writing to cpu hotplug registers, which makes
qemu crash with SIGSEGV following back trace:

   kvm_flush_coalesced_mmio_buffer ()
       while (ring->first != ring->last)
   ...
   qemu_flush_coalesced_mmio_buffer
   prepare_mmio_access
   flatview_read_continue
   flatview_read
   address_space_read_full
   address_space_rw
   kvm_cpu_exec(cpu!0)
   qemu_kvm_cpu_thread_fn

the reason for which is that ring == KVMState::coalesced_mmio_ring
happens to be a part of 1st CPU that was uplugged by guest.

Fix it by forbidding 1st cpu unplug from guest side and in addition
remove CPU0._EJ0 ACPI method to make clear that unplug of the first
CPU is not supported.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/cpu.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/acpi/cpu.c b/hw/acpi/cpu.c
index 5ae595ecbe..4bb83713c5 100644
--- a/hw/acpi/cpu.c
+++ b/hw/acpi/cpu.c
@@ -117,7 +117,7 @@ static void cpu_hotplug_wr(void *opaque, hwaddr addr, uint64_t data,
             DeviceState *dev = NULL;
             HotplugHandler *hotplug_ctrl = NULL;
 
-            if (!cdev->cpu) {
+            if (!cdev->cpu || cdev->cpu == first_cpu) {
                 trace_cpuhp_acpi_ejecting_invalid_cpu(cpu_st->selector);
                 break;
             }
@@ -541,9 +541,11 @@ void build_cpus_aml(Aml *table, MachineState *machine, CPUHotplugFeatures opts,
                 aml_buffer(madt_buf->len, (uint8_t *)madt_buf->data)));
             g_array_free(madt_buf, true);
 
-            method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
-            aml_append(method, aml_call1(CPU_EJECT_METHOD, uid));
-            aml_append(dev, method);
+            if (CPU(arch_ids->cpus[i].cpu) != first_cpu) {
+                method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
+                aml_append(method, aml_call1(CPU_EJECT_METHOD, uid));
+                aml_append(dev, method);
+            }
 
             method = aml_method("_OST", 3, AML_SERIALIZED);
             aml_append(method,
-- 
MST

[Qemu-devel] [PULL 6/7] vhost: fix invalid downcast

[Michael S. Tsirkin]

From: Yury Kotov <yury-kotov@yandex-team.ru>

virtio_queue_get_desc_addr returns 64-bit hwaddr while int is usually 32-bit.
If returned hwaddr is not equal to 0 but least-significant 32 bits are
equal to 0 then this code will not actually stop running queue.

Signed-off-by: Yury Kotov <yury-kotov@yandex-team.ru>
Acked-by: Jia He <hejianet@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index d4cb5894a8..569c4053ea 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1073,10 +1073,8 @@ static void vhost_virtqueue_stop(struct vhost_dev *dev,
         .index = vhost_vq_index,
     };
     int r;
-    int a;
 
-    a = virtio_queue_get_desc_addr(vdev, idx);
-    if (a == 0) {
+    if (virtio_queue_get_desc_addr(vdev, idx) == 0) {
         /* Don't stop the virtqueue which might have not been started */
         return;
     }
-- 
MST

[Qemu-devel] [PULL 7/7] tests: update acpi expected files

[Michael S. Tsirkin]

Fixes: dbb6da8ba7e ("pc: acpi: revert back to 1 SRAT entry for hotpluggable area")
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/acpi-test-data/pc/DSDT          | Bin 5144 -> 5131 bytes
 tests/acpi-test-data/pc/DSDT.bridge   | Bin 7003 -> 6990 bytes
 tests/acpi-test-data/pc/DSDT.cphp     | Bin 5607 -> 5594 bytes
 tests/acpi-test-data/pc/DSDT.dimmpxm  | Bin 6803 -> 6790 bytes
 tests/acpi-test-data/pc/DSDT.ipmikcs  | Bin 5216 -> 5203 bytes
 tests/acpi-test-data/pc/DSDT.memhp    | Bin 6509 -> 6496 bytes
 tests/acpi-test-data/pc/DSDT.numamem  | Bin 5150 -> 5137 bytes
 tests/acpi-test-data/pc/SRAT.dimmpxm  | Bin 472 -> 392 bytes
 tests/acpi-test-data/pc/SRAT.memhp    | Bin 264 -> 264 bytes
 tests/acpi-test-data/q35/DSDT         | Bin 7828 -> 7815 bytes
 tests/acpi-test-data/q35/DSDT.bridge  | Bin 7845 -> 7832 bytes
 tests/acpi-test-data/q35/DSDT.cphp    | Bin 8291 -> 8278 bytes
 tests/acpi-test-data/q35/DSDT.dimmpxm | Bin 9487 -> 9474 bytes
 tests/acpi-test-data/q35/DSDT.ipmibt  | Bin 7903 -> 7890 bytes
 tests/acpi-test-data/q35/DSDT.memhp   | Bin 9193 -> 9180 bytes
 tests/acpi-test-data/q35/DSDT.numamem | Bin 7834 -> 7821 bytes
 tests/acpi-test-data/q35/SRAT.dimmpxm | Bin 472 -> 392 bytes
 tests/acpi-test-data/q35/SRAT.memhp   | Bin 264 -> 264 bytes
 18 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/tests/acpi-test-data/pc/DSDT b/tests/acpi-test-data/pc/DSDT
index 99f05a502752d9dbac38fdd93f1ebb79b4564fb4..c6adfe32d5ba6a5db2ca3e210766839547e122c8 100644
GIT binary patch
delta 45
zcmbQC(XGMd66_MfEyBRSxN##_B|DRk+2mIC)lB}{n~gYHnHVi5@8r_l{EkbD695z3
B42=K)

delta 57
zcmeCyn4!Vt66_KpA;Q4G7`~CKlAX!Zd~z%MY9=3@%|;xpOiZpUlXq}wa&gDIdKoY}
L1BuP|xpX)Iow5#g

diff --git a/tests/acpi-test-data/pc/DSDT.bridge b/tests/acpi-test-data/pc/DSDT.bridge
index cf23343e6402421f09da5d09f72811108fbd2661..f01fa3ad4ee6aed5262daef464a1ade41e06975d 100644
GIT binary patch
delta 45
zcmca@cFv5;CD<jzPnv;&@z+MKN_Hk6v&pUOtC{?@Hyd%ZGBH|A-pQr8`5jlT002W>
B4h#SQ

delta 57
zcmX?ScH4~0CD<h-TAG1@aluBeN_Hks^U1C3tC@UsHXCuYGBLTbOy0qz$;BP->Se&_
M3?w$+=gJoV0Nbw*^#A|>

diff --git a/tests/acpi-test-data/pc/DSDT.cphp b/tests/acpi-test-data/pc/DSDT.cphp
index c99c49f43705e99d1e0a8ba19d44145dfa63d009..3295d81c7f725472671632ac612a1c3ed81d7492 100644
GIT binary patch
delta 45
zcmaE^eM_6mCD<k8mM8-QqxMFwN_Hmi;K{A*tC{>fHXCsqWMZ_N{FO^{vljPWE&xQw
B4gvrG

delta 57
zcmcbm{al;NCD<k8xhMkz<He0!mF!F&A(LC#S2KBgZZ_gL$i(E$GWiRaCKq?StCs<z
MGmzLU&Ap!s01Y4z>i_@%

diff --git a/tests/acpi-test-data/pc/DSDT.dimmpxm b/tests/acpi-test-data/pc/DSDT.dimmpxm
index 38661cb13ee348718ab45bfc69452cd642cf9bb9..f6ec911b1180a409e61ef8d50279ab6dba7f1bdd 100644
GIT binary patch
delta 45
zcmbPi+Gfh-66_MvCdI(OXt<H9lAX!LV{$9|Y9@Ev%|;w6m>BIQ-{I2SEXdu&4*(kq
B41fRt

delta 57
zcmZoOooveG66_K(S&D&y@%l!tN_Hkk&&jRqtC?KvHXCuQU}ExSnS7f|lZ!jv)ysg<
M8Axnq;%?yw0M!W(X#fBK

diff --git a/tests/acpi-test-data/pc/DSDT.ipmikcs b/tests/acpi-test-data/pc/DSDT.ipmikcs
index 5e970fda7296f9ce44487e0a578a1dead982ba66..2633a8cecf017bfce01ba8377428b8c5433e0be2 100644
GIT binary patch
delta 45
zcmaE$aan`QCD<h-ScHLr(QG5vL3Sn|v&m=KS2Ou*Z?58KWn#3L%*d^|*^FC@696%Z
B3{(IB

delta 56
zcmcbt@j!#iCD<h-L4<*U@y<rBgX~P6=9AB|uV(Vm*<8iZ%EaW#GKpK0i#y)c%Ye}t
LNNiT;*5L#I;W7_A

diff --git a/tests/acpi-test-data/pc/DSDT.memhp b/tests/acpi-test-data/pc/DSDT.memhp
index 1fe6871aa245277e0562ff0a1e93a9bf3bcf2295..e31ef502968b14e2146cb1a1328dc0ce555b1d7f 100644
GIT binary patch
delta 44
zcmaEB^uUPACD<h-L6U)i@z6%DN_Ix4$t~<_m|S%>8*#KUG1^Vu$)&mZ9alXc05=~E
A%m4rY

delta 56
zcmaE0^wx;WCD<h-SCWB&F>)hUB|D@4<QDcdOisF+jW}AFn7mmg@8Htp;*NLqGGKHD
L5}WUHHSz%f%cl>u

diff --git a/tests/acpi-test-data/pc/DSDT.numamem b/tests/acpi-test-data/pc/DSDT.numamem
index 224cfdd9e983e02dac5f4bf7e210eaa64cb0dc78..71a975b3e25f8b5cc4491f16d5575a3a35afc777 100644
GIT binary patch
delta 44
zcmbQIF;RodCD<iIP=tYjF?u6cB|D?j<QDcdOs+bcjW}AF80{wS<kH;yj>~`(00AKk
A3jhEB

delta 56
zcmbQJF;9cbCD<iIPK1Gh@zX}GN_Iy7$t~<_n4EMs8*#KUF?q90-od5G#U1bJWx(hR
LBsSmYGU5aPu8j`#

diff --git a/tests/acpi-test-data/pc/SRAT.dimmpxm b/tests/acpi-test-data/pc/SRAT.dimmpxm
index 5aa6f693ef9819b3d30cbd76cafb0ee8b5fc5534..f5c0267ea24bb404b6b4e687390140378fbdc3f1 100644
GIT binary patch
delta 58
qcmcb?+`-Hh9OM|%!N|bC*szf+f>Di`0S16#An*f1F)$!x7#IKwZw2lE

delta 138
zcmeBRzQN2D9OM{sgOP!Oao0w!2*xrX3kskt4j7*q#sJcc8cZ-A2f8|Tm<(7QMA!fS
P|G$IOAxvjrKsFBmfb|MK

diff --git a/tests/acpi-test-data/pc/SRAT.memhp b/tests/acpi-test-data/pc/SRAT.memhp
index 5de8a100a4adf968b79a7b154a7f98123d583474..e508b4ae3cd9e3000209a4f9597913faa4206ec1 100644
GIT binary patch
delta 51
pcmeBR>R{pu4ss0PU}RumTr`pEo&p09068G=141z{FvA!?8UWLX1)2Z=

delta 51
pcmeBR>R{pu4ss0PU}RumTso2Kp2GkC|Gxt{3?K{x%rFL!1^_r@2$}!@

diff --git a/tests/acpi-test-data/q35/DSDT b/tests/acpi-test-data/q35/DSDT
index aa402cca667f82ed0a2dc4969508d8f6e38ad910..7576ffcd05991ad5a3901c0f7698a52fffc6d6e2 100644
GIT binary patch
delta 45
zcmbPY+iuI{66_MvF2}&Y*szhySdz)dY_h%NY9@c}&2J=InHVi57t3gFULo^_5dbFH
B4Y>dS

delta 57
zcmZp-onp)766_K(MUH`iQEelau_TkH`DA;^)l5D*o8L&bGBLTbOfHhq<l>HZ^)g^|
M1`?ZR%DiI)0Jy6Uq5uE@

diff --git a/tests/acpi-test-data/q35/DSDT.bridge b/tests/acpi-test-data/q35/DSDT.bridge
index fc3e79c583ababf5615e76ba2f7bc3df1483abb4..c623cc5d72a2e346793fa9128e7e88b6781241b2 100644
GIT binary patch
delta 45
zcmZ2#JHwXCCD<ioh8zO}qryfmV@W0-v&r_7tC{?@H@}f=Wn#3LTr8uxd4<ehMgSw1
B4V?f0

delta 57
zcmbPXyVRD;CD<iosT>0X<FSog#*$2)=9BFuS2OwOY<?rz%EaW#GPy`blZ!jv)ysg<
M8AxoNDf6EZ0Nzayh5!Hn

diff --git a/tests/acpi-test-data/q35/DSDT.cphp b/tests/acpi-test-data/q35/DSDT.cphp
index fd3cb3421814d0383863dc780d9a2a9077b727a3..7ac526e4669fd84048b2d8ec6af8661503e1a9fa 100644
GIT binary patch
delta 45
zcmaFtaLs|sCD<h-Oo4%c@#jV^V@W3O;K}xqtC{>fHouWP$i!$jdA*G0<|i`s%m7rz
B4=w-z

delta 57
zcmccS@YsRNCD<h-S%HCpasEawV@W2DkjeIvtC_q#H@}fQ$i(E$GI^bhCKq?StCs<z
MGmzMPRi=>{0Qw9O7XSbN

diff --git a/tests/acpi-test-data/q35/DSDT.dimmpxm b/tests/acpi-test-data/q35/DSDT.dimmpxm
index 14904e8ea2376abd989aa9e99f5bf388a3b85032..3837792dec13c4c77c66b140f68959d86a09de8e 100644
GIT binary patch
delta 45
zcmeD8YVzW833dr#Qe|LZe7KRzSdz)bW3s*EY9@Ev&2J=EFfrOqo+hKY`Lv7+2LLB$
B4UPZ+

delta 57
zcmZqj>i6Pu33dtLS7l&eY~RRbEXm~PIoV!vHIs|o<~Ncnn3%j-CQp^o<l>HZ^)g^|
M1`?b1$hdI;0KEDScK`qY

diff --git a/tests/acpi-test-data/q35/DSDT.ipmibt b/tests/acpi-test-data/q35/DSDT.ipmibt
index 332237529e114256384c051858fdac36b024c72e..c7f431f058bcb54e364be4edfd9d4609bc9bb602 100644
GIT binary patch
delta 45
zcmca_d&!o|CD<k8k{kmA<I;^>b&^azW|O-lS2Ou*Z#I`|Wn#3LyiZ1R^Jkeii~v_f
B4>te+

delta 57
zcmca)d*7DJCD<k8z8nJsqxVLxI!Pu^^T}P3tC@UsHk(VeGBLTbOx`P_$;BP->Se&_
M3?w!`k$J}m0QWEvAOHXW

diff --git a/tests/acpi-test-data/q35/DSDT.memhp b/tests/acpi-test-data/q35/DSDT.memhp
index f0a27e1a3093ff7525f62b7509ea44dfe9eb8908..8fba0baf79de0239f2630035afeee78f3e7f43c2 100644
GIT binary patch
delta 44
zcmaFqe#f25CD<k8jxqxS<HU_z#*&OqlkFteFuCe%ek0k+#Ar9USVnX63K>Us07u#l
A`2YX_

delta 56
zcmccP{?eVxCD<k8r7{BpqsB%qV@XE;$##-!n4EMszmaTZV)AC0TqL8(#U1bJWx(hR
LBsR~Kab^bq<X#Wr

diff --git a/tests/acpi-test-data/q35/DSDT.numamem b/tests/acpi-test-data/q35/DSDT.numamem
index 8c9fa445b0119b6f67533cb968855b41fb9925d9..6c0d4f2bcb384cc3f3919b7472021ed51b93cbf5 100644
GIT binary patch
delta 44
zcmbPb+iT0^66_MvE62dVsI`&HSd!6cvYq4_CRd%!ZzNlp80{t(%V=(1A@hk502A8{
AHvj+t

delta 56
zcmeCRon_1A66_K(OOAno@!&=-V@XE;$##-!n4EMszmaTZV)AC0TqL8(#U1bJWx(hR
LBsR~K`N9YQ$wLqz

diff --git a/tests/acpi-test-data/q35/SRAT.dimmpxm b/tests/acpi-test-data/q35/SRAT.dimmpxm
index 5aa6f693ef9819b3d30cbd76cafb0ee8b5fc5534..f5c0267ea24bb404b6b4e687390140378fbdc3f1 100644
GIT binary patch
delta 58
qcmcb?+`-Hh9OM|%!N|bC*szf+f>Di`0S16#An*f1F)$!x7#IKwZw2lE

delta 138
zcmeBRzQN2D9OM{sgOP!Oao0w!2*xrX3kskt4j7*q#sJcc8cZ-A2f8|Tm<(7QMA!fS
P|G$IOAxvjrKsFBmfb|MK

diff --git a/tests/acpi-test-data/q35/SRAT.memhp b/tests/acpi-test-data/q35/SRAT.memhp
index 5de8a100a4adf968b79a7b154a7f98123d583474..e508b4ae3cd9e3000209a4f9597913faa4206ec1 100644
GIT binary patch
delta 51
pcmeBR>R{pu4ss0PU}RumTr`pEo&p09068G=141z{FvA!?8UWLX1)2Z=

delta 51
pcmeBR>R{pu4ss0PU}RumTso2Kp2GkC|Gxt{3?K{x%rFL!1^_r@2$}!@

-- 
MST