summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2021-05-04hw/ppc/spapr_rtas: Update hflags after setting msrRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210315184615.1985590-16-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04hw/ppc/pnv_core: Update hflags after setting msrRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210315184615.1985590-15-richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-05-04hw/ppc/mac_newworld: Restrict RAM to 2 GiBPhilippe Mathieu-Daudé
On Mac99 and newer machines, the Uninorth PCI host bridge maps the PCI hole region at 2GiB, so the RAM area beside 2GiB is not accessible by the CPU. Restrict the memory to 2GiB to avoid problems such the one reported in the buglink. Buglink: https://bugs.launchpad.net/qemu/+bug/1922391 Reported-by: Håvard Eidnes <he@NetBSD.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210406084842.2859664-1-f4bug@amsat.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-04-30Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches - Fix permission update order problems with block graph changes - qemu-img convert: Unshare write permission for source - vhost-user-blk: Fail gracefully on too large queue size # gpg: Signature made Fri 30 Apr 2021 11:27:51 BST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (39 commits) vhost-user-blk: Fail gracefully on too large queue size qemu-img convert: Unshare write permission for source block: Add BDRV_O_NO_SHARE for blk_new_open() block: refactor bdrv_node_check_perm() block: rename bdrv_replace_child_safe() to bdrv_replace_child() block: refactor bdrv_child_set_perm_safe() transaction action block: inline bdrv_replace_child() block: inline bdrv_check_perm_common() block: drop unused permission update functions block: bdrv_reopen_multiple: refresh permissions on updated graph block: bdrv_reopen_multiple(): move bdrv_flush to separate pre-prepare block: add bdrv_set_backing_noperm() transaction action block: make bdrv_refresh_limits() to be a transaction action block: make bdrv_unset_inherits_from to be a transaction action block: drop ignore_children for permission update functions block/backup-top: drop .active block: introduce bdrv_drop_filter() block: add bdrv_remove_filter_or_cow transaction action block: adapt bdrv_append() for inserting filters block: split out bdrv_replace_node_noperm() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30vhost-user-blk: Fail gracefully on too large queue sizeKevin Wolf
virtio_add_queue() aborts when queue_size > VIRTQUEUE_MAX_SIZE, so vhost_user_blk_device_realize() should check this before calling it. Simple reproducer: qemu-system-x86_64 \ -chardev null,id=foo \ -device vhost-user-blk-pci,queue-size=4096,chardev=foo Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935014 Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210413165654.50810-1-kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-30hw/pci-host/gpex: Don't fault for unmapped parts of MMIO and PIO windowsPeter Maydell
Currently the gpex PCI controller implements no special behaviour for guest accesses to areas of the PIO and MMIO where it has not mapped any PCI devices, which means that for Arm you end up with a CPU exception due to a data abort. Most host OSes expect "like an x86 PC" behaviour, where bad accesses like this return -1 for reads and ignore writes. In the interests of not being surprising, make host CPU accesses to these windows behave as -1/discard where there's no mapped PCI device. The old behaviour generally didn't cause any problems, because almost always the guest OS will map the PCI devices and then only access where it has mapped them. One corner case where you will see this kind of access is if Linux attempts to probe legacy ISA devices via a PIO window access. So far the only case where we've seen this has been via the syzkaller fuzzer. Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20210325163315.27724-1-peter.maydell@linaro.org Fixes: https://bugs.launchpad.net/qemu/+bug/1918917 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30hw: add compat machines for 6.1Cornelia Huck
Add 6.1 machine types for arm/i440fx/q35/s390x/spapr. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Acked-by: Greg Kurz <groug@kaod.org> Message-id: 20210331111900.118274-1-cohuck@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30hw/arm/smmuv3: Support 16K translation granuleKunkun Jiang
The driver can query some bits in SMMUv3 IDR5 to learn which translation granules are supported. Arm recommends that SMMUv3 implementations support at least 4K and 64K granules. But in the vSMMUv3, there seems to be no reason not to support 16K translation granule. In addition, if 16K is not supported, vSVA will failed to be enabled in the future for 16K guest kernel. So it'd better to support it. Signed-off-by: Kunkun Jiang <jiangkunkun@huawei.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-26hw/block/nvme: fix invalid msix exclusive uninitKlaus Jensen
Commit 1901b4967c3f changed the nvme device from using a bar exclusive for MSI-x to sharing it on bar0. Unfortunately, the msix_uninit_exclusive_bar() call remains in nvme_exit() which causes havoc when the device is removed with, say, device_del. Fix this. Additionally, a subregion is added but it is not removed on exit which causes a reference to linger and the drive to never be unlocked. Fixes: 1901b4967c3f ("hw/block/nvme: move msix table and pba to BAR 0") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-19mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)Michael Tokarev
While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since s->pending is actually not used, simply remove it from MPTSASState. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Message-id: 20210419134247.1467982-1-f4bug@amsat.org Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") [PMD: Reworded description, added more tags] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17hw/arm/armsse: Make SSE-300 use Cortex-M55Peter Maydell
The SSE-300 has a Cortex-M55 (which was the whole reason for us modelling it), but we forgot to actually update the code to let it have a different CPU type from the IoTKit and SSE-200. Add CPU type as a field for ARMSSEInfo instead of hardcoding it to always use a Cortex-M33. Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416104010.13228-1-peter.maydell@linaro.org
2021-04-17hw/arm/armsse: Give SSE-300 its own Property arrayPeter Maydell
SSE-300 currently shares the SSE-200 Property array. This is bad principally because the default values of the CPU0_FPU and CPU0_DSP properties disable the FPU and DSP on the CPU. That is correct for the SSE-200 but not the SSE-300. Give the SSE-300 its own Property array with the correct SSE-300 specific settings: * SSE-300 has only one CPU, so no CPU1* properties * SSE-300 CPU has FPU and DSP Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210415182353.8173-1-peter.maydell@linaro.org
2021-04-13Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413' into staging virtiofs: Fix feature negotiation (for 6.0) A 6.0 fix for feature negotiation on vhost-user. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Tue 13 Apr 2021 16:21:41 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413: vhost-user-fs: fix features handling Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210413' into staging target-arm queue: * Fix MPC setting for AN524 SRAM block * sphinx: qapidoc: Wrap "If" section body in a paragraph node # gpg: Signature made Tue 13 Apr 2021 13:07:12 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210413: sphinx: qapidoc: Wrap "If" section body in a paragraph node hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPC hw/arm/mps2-tz: Fix MPC setting for AN524 SRAM block Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13vhost-user-fs: fix features handlingAnton Kuchin
Make virtio-fs take into account server capabilities. Just returning requested features assumes they all of then are implemented by server and results in setting unsupported configuration if some of them are absent. Signed-off-by: Anton Kuchin <antonkuchin@yandex-team.ru> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> With changes suggested by Stefan Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-13Merge remote-tracking branch 'remotes/philmd/tags/mips-20210413' into stagingPeter Maydell
MIPS patches queue - Fix invalid Kconfig dependency - Fix missing migrated value - Fix TCG temporary leak # gpg: Signature made Tue 13 Apr 2021 11:10:11 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210413: target/mips: Fix TCG temporary leak in gen_cache_operation() hw/isa/piix4: Migrate Reset Control Register hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APM Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210412' ↵Peter Maydell
into staging ppc patch queue for 2021-04-21 Here's what I hope is the last ppc related pull request for qemu-6.0. The 2 patches here revert a behavioural change that after further discussion we concluded was a bad idea (adding a timeout for possibly-failed hot unplug requests). Instead it implements a different approach to the original problem: we again let unplug requests the guest doesn't respond to remain pending indefinitely, but no longer allow those to block attempts to retry the same unplug again. The change is a bit more complex than I'd like for this late in the freeze. Nonetheless, I think it's important to merge this for 6.0, so we don't allow a release which has the probably-a-bad-idea timeout behaviour. # gpg: Signature made Mon 12 Apr 2021 06:25:58 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-6.0-20210412: spapr.c: always pulse guest IRQ in spapr_core_unplug_request() spapr: rollback 'unplug timeout' for CPU hotunplugs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13hw/isa/piix4: Migrate Reset Control RegisterPhilippe Mathieu-Daudé
When adding the Reset register in commit 5790b757cfb we forgot to migrate it. While it is possible a VM using the PIIX4 is migrated just after requesting a system shutdown, it is very unlikely. However when restoring a migrated VM, we might have the RCR bit #4 set on the stack and when the VM resume it directly shutdowns. Add a post_load() migration handler and set the default RCR value to 0 for earlier versions, assuming the VM was not going to shutdown before migration. Fixes: 5790b757cfb ("piix4: Add the Reset Control Register") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210324200334.729899-1-f4bug@amsat.org>
2021-04-13hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APMPhilippe Mathieu-Daudé
TYPE_VIA_PM calls apm_init() in via_pm_realize(), so requires APM to be selected. Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Fixes: dd0ff8191ab ("isa: express SuperIO dependencies with Kconfig") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210302080531.913802-1-f4bug@amsat.org>
2021-04-12esp: ensure that do_cmd is set to zero before submitting an ESP select commandMark Cave-Ayland
When a CDB has been received and is about to be submitted to the SCSI layer via one of the ESP select commands, ensure that do_cmd is set to zero before executing the command. Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI .transfer_data callback again before do_cmd is set to zero by the callback function triggering an assert at the start of esp_transfer_data(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't reset async_len directly in esp_select() if cancelling requestMark Cave-Ayland
Instead let the SCSI layer invoke the .cancel callback itself to cancel and reset the request state. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-11-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo if TC is larger than the cmdfifo sizeMark Cave-Ayland
If a guest transfers the message out/command phase data using DMA with a TC that is larger than the cmdfifo size then the cmdfifo overflows triggering an assert. Limit the size of the transfer to the free space available in cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1919036 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-10-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo in get_cmd()Mark Cave-Ayland
If the guest tries to read a CDB using DMA and cmdfifo is not empty then it is possible to overflow cmdfifo. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of the CDB transferred to cmdfifo is limited to the available free space within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-9-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't underflow cmdfifo in do_cmd()Mark Cave-Ayland
If the guest tries to execute a CDB when cmdfifo is not empty before the start of the message out phase then clearing the message out phase data will cause cmdfifo to underflow due to cmdfifo_cdb_offset being larger than the amount of data within. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of esp_fifo_pop_buf() is limited to the size of the data within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-8-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: ensure cmdfifo is not empty and current_dev is non-NULLMark Cave-Ayland
When about to execute a SCSI command, ensure that cmdfifo is not empty and current_dev is non-NULL. This can happen if the guest tries to execute a TI (Transfer Information) command without issuing one of the select commands first. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-7-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf()Mark Cave-Ayland
The const pointer returned by fifo8_pop_buf() lies directly within the array used to model the FIFO. Building with address sanitizers enabled shows that if the caller expects a minimum number of bytes present then if the FIFO is nearly full, the caller may unexpectedly access past the end of the array. Introduce esp_fifo_pop_buf() which takes a destination buffer and performs a memcpy() in it to guarantee that the caller cannot overwrite the FIFO array and update all callers to use it. Similarly add underflow protection similar to esp_fifo_push() and esp_fifo_pop() so that instead of triggering an assert() the operation becomes a no-op. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210407195801.685-6-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop()Mark Cave-Ayland
Each FIFO currently has its own pop functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_pop() to access the FIFO capacity directly and then consolidate esp_cmdfifo_pop() into esp_fifo_pop(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-5-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: consolidate esp_cmdfifo_push() into esp_fifo_push()Mark Cave-Ayland
Each FIFO currently has its own push functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_push() to access the FIFO capacity directly and then consolidate esp_cmdfifo_push() into esp_fifo_push(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-4-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: rework write_response() to avoid using the FIFO for DMA transactionsMark Cave-Ayland
The code for write_response() has always used the FIFO to store the data for the status/message in phases, even for DMA transactions. Switch to using a separate buffer that can be used directly for DMA transactions and restrict the FIFO use to the non-DMA case. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-3-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: always check current_req is not NULL before use in DMA callbacksMark Cave-Ayland
After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel callback which resets both current_req and current_dev to NULL. If any data is left in the transfer buffer (async_len != 0) then the next TI (Transfer Information) command will attempt to reference the NULL pointer causing a segfault. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-2-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: fix setting of ESPState mig_version_id when launching QEMU with -S optionMark Cave-Ayland
If QEMU is launched with the -S option then the ESPState mig_version_id property is left unset due to the ordering of the VMState fields in the VMStateDescription for sysbusespscsi and pciespscsi. If the VM is migrated and restored in this stopped state, the version tests in the vmstate_esp VMStateDescription and esp_post_load() become confused causing the migration to fail. Fix the ordering problem by moving the setting of mig_version_id to a common esp_pre_save() function which is invoked first by both sysbusespscsi and pciespscsi rather than at the point where ESPState is itself serialised into the migration stream. Buglink: https://bugs.launchpad.net/qemu/+bug/1922611 Fixes: 0bd005be78 ("esp: add vmstate_esp version to embedded ESPState") Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210407124842.32695-1-mark.cave-ayland@ilande.co.uk>
2021-04-12hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPCPeter Maydell
Each board in mps2-tz.c specifies a RAMInfo[] array providing information about each RAM in the board. The .mpc field of the RAMInfo struct specifies which MPC, if any, the RAM is attached to. We already assert if the array doesn't have any entry for an MPC, but we don't diagnose the error of using the same MPC number twice (which is quite easy to do by accident if copy-and-pasting structure entries). Enhance find_raminfo_for_mpc() so that it detects multiple entries for the MPC as well as missing entries. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210409150527.15053-3-peter.maydell@linaro.org
2021-04-12hw/arm/mps2-tz: Fix MPC setting for AN524 SRAM blockPeter Maydell
The AN524 has three MPCs: one for the BRAM, one for the QSPI flash, and one for the DDR. We incorrectly set the .mpc field in the RAMInfo struct for the SRAM block to 1, giving it the same MPC we are using for the QSPI. The effect of this was that the QSPI didn't get mapped into the system address space at all, via an MPC or otherwise, and guest programs which tried to read from the QSPI would get a bus error. Correct the SRAM RAMInfo to indicate that it does not have an associated MPC. Fixes: 25ff112a8cc ("hw/arm/mps2-tz: Add new mps3-an524 board") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210409150527.15053-2-peter.maydell@linaro.org
2021-04-12Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210412' into staging target-arm queue: * hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interrupts * hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDs * accel/tcg: Preserve PAGE_ANON when changing page permissions * target/arm: Check PAGE_WRITE_ORG for MTE writeability * exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1 # gpg: Signature made Mon 12 Apr 2021 11:31:15 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210412: exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1 target/arm: Check PAGE_WRITE_ORG for MTE writeability accel/tcg: Preserve PAGE_ANON when changing page permissions hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDs hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interrupts Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDsZenghui Yu
In emulation of the CFGI_STE_RANGE command, we now take StreamID as the start of the invalidation range, regardless of whatever the Range is, whilst the spec clearly states that - "Invalidation is performed for an *aligned* range of 2^(Range+1) StreamIDs." - "The bottom Range+1 bits of the StreamID parameter are IGNORED, aligning the range to its size." Take CFGI_ALL (where Range == 31) as an example, if there are some random bits in the StreamID field, we'll fail to perform the full invalidation but get a strange range (e.g., SMMUSIDRange={.start=1, .end=0}) instead. Rework the emulation a bit to get rid of the discrepancy with the spec. Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210402100449.528-1-yuzenghui@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interruptsZenghui Yu
The GSIV values in SMMUv3 IORT node are not correct as they don't match the SMMUIrq enumeration, which describes the IRQ<->PIN mapping used by our emulated vSMMU. Fixes: a703b4f6c1ee ("hw/arm/virt-acpi-build: Add smmuv3 node in IORT table") Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210402084731.93-1-yuzenghui@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12hw/block/nvme: drain namespaces on sq deletionKlaus Jensen
For most commands, when issuing an AIO, the BlockAIOCB is stored in the NvmeRequest aiocb pointer when the AIO is issued. The main use of this is cancelling AIOs when deleting submission queues (it is currently not used for Abort). However, some commands like Dataset Management Zone Management Send (zone reset) may involve more than one AIO and here the AIOs are issued without saving a reference to the BlockAIOCB. This is a problem since nvme_del_sq() will attempt to cancel outstanding AIOs, potentially with an invalid BlockAIOCB since the aiocb pointer is not NULL'ed when the request structure is recycled. Fix this by 1. making sure the aiocb pointer is NULL'ed when requests are recycled 2. only attempt to cancel the AIO if the aiocb is non-NULL 3. if any AIOs could not be cancelled, drain all aio as a last resort. Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Fixes: c94973288cd9 ("hw/block/nvme: add broadcast nsid support flush command") Fixes: e4e430b3d6ba ("hw/block/nvme: add simple copy command") Fixes: 5f5dc4c6a942 ("hw/block/nvme: zero out zones on reset") Fixes: 2605257a26b8 ("hw/block/nvme: add the dataset management command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Cc: Minwoo Im <minwoo.im@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-12hw/block/nvme: store aiocb in compareKlaus Jensen
nvme_compare() fails to store the aiocb from the blk_aio_preadv() call. Fix this. Fixes: 0a384f923f51 ("hw/block/nvme: add compare command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-12hw/block/nvme: map prp fix if prp2 contains non-zero offsetPadmakar Kalghatgi
nvme_map_prp needs to calculate the number of list entries based on the offset value. For the subsequent PRP2 list, need to ensure the number of entries is within the MAX number of PRP entries for a page. Signed-off-by: Padmakar Kalghatgi <p.kalghatgi@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2021-04-12spapr.c: always pulse guest IRQ in spapr_core_unplug_request()Daniel Henrique Barboza
Commit 47c8c915b162 fixed a problem where multiple spapr_drc_detach() requests were breaking QEMU. The solution was to just spapr_drc_detach() once, and use spapr_drc_unplug_requested() to filter whether we already detached it or not. The commit also tied the hotplug request to the guest in the same condition. Turns out that there is a reliable way for a CPU hotunplug to fail. If a guest with one CPU hotplugs a CPU1, then offline CPU0s via 'echo 0 > /sys/devices/system/cpu/cpu0/online', then attempts to hotunplug CPU1, the kernel will refuse it because it's the last online CPU of the system. Given that we're pulsing the IRQ only in the first try, in a failed attempt, all other CPU1 hotunplug attempts will fail, regardless of the online state of CPU1 in the kernel, because we're simply not letting the guest know that we want to hotunplug the device. Let's move spapr_hotplug_req_remove_by_index() back out of the "if (!spapr_drc_unplug_requested(drc))" conditional, allowing for multiple 'device_del' requests to the same CPU core to reach the guest, in case the CPU core didn't fully hotunplugged previously. Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20210401000437.131140-3-danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-04-12spapr: rollback 'unplug timeout' for CPU hotunplugsDaniel Henrique Barboza
The pseries machines introduced the concept of 'unplug timeout' for CPU hotunplugs. The idea was to circunvent a deficiency in the pSeries specification (PAPR), that currently does not define a proper way for the hotunplug to fail. If the guest refuses to release the CPU (see [1] for an example) there is no way for QEMU to detect the failure. Further discussions about how to send a QAPI event to inform about the hotunplug timeout [2] exposed problems that weren't predicted back when the idea was developed. Other QEMU machines don't have any type of hotunplug timeout mechanism for any device, e.g. ACPI based machines have a way to make hotunplug errors visible to the hypervisor. This would make this timeout mechanism exclusive to pSeries, which is not ideal. The real problem is that a QAPI event that reports hotunplug timeouts puts the management layer (namely Libvirt) in a weird spot. We're not telling that the hotunplug failed, because we can't be 100% sure of that, and yet we're resetting the unplug state back, preventing any DEVICE_DEL events to reach out in case the guest decides to release the device. Libvirt would need to inspect the guest itself to see if the device was released or not, otherwise the internal domain states will be inconsistent. Moreover, Libvirt already has an 'unplug timeout' concept, and a QEMU side timeout would need to be juggled together with the existing Libvirt timeout. All this considered, this solution ended up creating more trouble than it solved. This patch reverts the 3 commits that introduced the timeout mechanism for CPU hotplugs in pSeries machines. This reverts commit 4515a5f786024fabf0bef4cf3d28adf5647e6e82 "qemu_timer.c: add timer_deadline_ms() helper" This reverts commit d1c2e3ce3d5a5424651967bce1cf1f4caa0c6d91 "spapr_drc.c: add hotunplug timeout for CPUs" This reverts commit 51254ffb320183a4636635840c23ee0e3a1efffa "spapr_drc.c: introduce unplug_timeout_timer" [1] https://bugzilla.redhat.com/show_bug.cgi?id=1911414 [2] https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg04682.html CC: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20210401000437.131140-2-danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-04-10Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging x86 and CPU bug fixes for 6.0-rc3 * Add missing features to EPYC-Rome CPU model (Babu Moger) * Fix crash with "-device ...-cpu-core,help" (Greg Kurz) # gpg: Signature made Fri 09 Apr 2021 21:20:18 BST # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost-gl/tags/x86-next-pull-request: cpu/core: Fix "help" of CPU core device types i386: Add missing cpu feature bits in EPYC-Rome model Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-09cpu/core: Fix "help" of CPU core device typesGreg Kurz
Calling qdev_get_machine() from a QOM instance_init function is fragile because we can't be sure the machine object actually exists. And this happens to break when passing ",help" on the command line to get the list of properties for a CPU core device types : $ ./qemu-system-ppc64 -device power8_v2.0-spapr-cpu-core,help qemu-system-ppc64: ../../hw/core/machine.c:1290: qdev_get_machine: Assertion `machine != NULL' failed. Aborted (core dumped) This used to work before QEMU 5.0, but commit 3df261b6676b unwillingly introduced a subtle regression : the above command line needs to create an instance but the instance_init function of the base class calls qdev_get_machine() before qemu_create_machine() has been called, which is a programming bug. Use current_machine instead. It is okay to skip the setting of nr_thread in this case since only its type is displayed. Fixes: 3df261b6676b ("softmmu/vl.c: Handle '-cpu help' and '-device help' before 'no default machine'") Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Greg Kurz <groug@kaod.org> Cc: peter.maydell@linaro.org Message-Id: <20210409160339.500167-3-groug@kaod.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-04-09Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer fixes - mirror: Fix job-complete race condition causing unexpected errors - fdc: Fix 'fallback' property on sysbus floppy disk controllers - rbd: Fix memory leaks - iotest improvements # gpg: Signature made Fri 09 Apr 2021 17:13:11 BST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: test-blockjob: Test job_wait_unpaused() job: Allow complete for jobs on standby mirror: Do not enter a paused job on completion mirror: Move open_backing_file to exit_common hw/block/fdc: Fix 'fallback' property on sysbus floppy disk controllers iotests: Test mirror-top filter permissions iotests: add test for removing persistent bitmap from backing file iotests/qsd-jobs: Filter events in the first test block/rbd: fix memory leak in qemu_rbd_co_create_opts() block/rbd: fix memory leak in qemu_rbd_connect() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-09Merge remote-tracking branch 'remotes/cohuck-gitlab/tags/s390x-20210409' ↵Peter Maydell
into staging One s390x fix: - correctly handle the case where the guest ccw payload points to invalid memory areas # gpg: Signature made Fri 09 Apr 2021 15:43:45 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [unknown] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [unknown] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck-gitlab/tags/s390x-20210409: s390x: css: report errors from ccw_dstream_read/write Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-09hw/block/fdc: Fix 'fallback' property on sysbus floppy disk controllersPhilippe Mathieu-Daudé
Setting the 'fallback' property corrupts the QOM instance state (FDCtrlSysBus) because it accesses an incorrect offset (it uses the offset of the FDCtrlISABus state). Cc: qemu-stable@nongnu.org Fixes: a73275dd6fc ("fdc: Add fallback option") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407133742.1680424-1-f4bug@amsat.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09s390x: css: report errors from ccw_dstream_read/writePierre Morel
ccw_dstream_read/write functions returned values are sometime not taking into account and reported back to the upper level of interpretation of CCW instructions. It follows that accessing an invalid address does not trigger a subchannel status program check to the guest as it should. Let's test the return values of ccw_dstream_write[_buf] and ccw_dstream_read[_buf] and report it to the caller. Cc: qemu-stable@nongnu.org Signed-off-by: Pierre Morel <pmorel@linux.ibm.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <1617899529-9329-2-git-send-email-pmorel@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2021-04-08Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Thu 08 Apr 2021 10:34:24 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap-win32: correctly recycle buffers Revert "qapi: net: Add query-netdev command" Revert "tests: Add tests for query-netdev command" Revert "net: Move NetClientState.info_str to dynamic allocations" Revert "hmp: Use QAPI NetdevInfo in hmp_info_network" Revert "net: Do not fill legacy info_str for backends" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-08Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert/tags/pull-migration-20210407b' into staging V2 migration+virtiofs fixes pull 2021-04-07 A seg fix in virtiofsd, a bunch of fixes for background snapshots, and a migration test fix. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> v2 Fix for !linux build # gpg: Signature made Wed 07 Apr 2021 18:53:13 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20210407b: tests/migration: fix parameter of auto-converge migration migration: Rename 'bs' to 'block' in background snapshot code migration: Pre-fault memory before starting background snasphot migration: Inhibit virtio-balloon for the duration of background snapshot migration: Fix missing qemu_fflush() on buffer file in bg_migration_thread virtiofsd: Fix security.capability comparison Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-08Revert "net: Move NetClientState.info_str to dynamic allocations"Jason Wang
Several issues has been reported for query-netdev info series. Consider it's late in the rc, this reverts commit commit 59b5437eb732d6b103a9bc279c3482c834d1eff9. Signed-off-by: Jason Wang <jasowang@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 14:57:49 +0000