summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* Do not include hw/boards.h if it's not really necessaryThomas Huth2021-05-0231-32/+0Star
| | | | | | | | Stop including hw/boards.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-3-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* Do not include sysemu/sysemu.h if it's not really necessaryThomas Huth2021-05-0240-40/+0Star
| | | | | | | | Stop including sysemu/sysemu.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-2-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw: Do not include qemu/log.h if it is not necessaryThomas Huth2021-05-0241-41/+0Star
| | | | | | | | | | Many files include qemu/log.h without needing it. Remove the superfluous include statements. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20210328054833.2351597-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw: Do not include hw/irq.h if it is not necessaryThomas Huth2021-05-0212-12/+0Star
| | | | | | | | | | Many files include hw/irq.h without needing it. Remove the superfluous include statements. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20210327050236.2232347-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw: Do not include hw/sysbus.h if it is not necessaryThomas Huth2021-05-0227-27/+0Star
| | | | | | | | | | Many files include hw/sysbus.h without needing it. Remove the superfluous include statements. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210327082804.2259480-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw: Remove superfluous includes of hw/hw.hThomas Huth2021-05-0219-19/+0Star
| | | | | | | | | | | The include/hw/hw.h header only has a prototype for hw_error(), so it does not make sense to include this in files that do not use this function. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210326151848.2217216-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw/usb: Constify VMStateDescriptionPhilippe Mathieu-Daudé2021-05-022-5/+5
| | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210313171150.2122409-4-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw/display/qxl: Constify VMStateDescriptionPhilippe Mathieu-Daudé2021-05-021-4/+4
| | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210313171150.2122409-3-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw/arm: Constify VMStateDescriptionPhilippe Mathieu-Daudé2021-05-027-10/+10
| | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210313171150.2122409-2-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* vmstate: Constify some VMStateDescriptionsKeqian Zhu2021-05-021-1/+1
| | | | | | | | | | Constify vmstate_ecc_state and vmstate_x86_cpu. Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210408140706.23412-1-zhukeqian1@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw/pcmcia: Do not register PCMCIA type if not requiredPhilippe Mathieu-Daudé2021-05-021-1/+1
| | | | | | | | | | | | If the Kconfig 'PCMCIA' value is not selected, it is pointless to build the PCMCIA core components. (Currently only one machine of the ARM targets requires this). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210424222057.3434459-4-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw/ide: Add Kconfig dependency MICRODRIVE -> PCMCIAPhilippe Mathieu-Daudé2021-05-021-0/+1
| | | | | | | | | | | The Microdrive Compact Flash can be plugged on a PCMCIA bus. Express the dependency using the 'depends on' Kconfig expression. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Warner Losh <imp@bsdimp.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210424222057.3434459-3-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* hw/arm/pxa2xx: Declare PCMCIA bus with KconfigPhilippe Mathieu-Daudé2021-05-021-0/+1
| | | | | | | | | | | | | The Intel XScale PXA chipsets provide a PCMCIA controller, which expose a PCMCIA bus. Express this dependency using the Kconfig 'select' expression. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Warner Losh <imp@bsdimp.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210424222057.3434459-2-f4bug@amsat.org> [lv: remove "(IDE)"] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell2021-04-301-0/+5
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Block layer patches - Fix permission update order problems with block graph changes - qemu-img convert: Unshare write permission for source - vhost-user-blk: Fail gracefully on too large queue size # gpg: Signature made Fri 30 Apr 2021 11:27:51 BST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (39 commits) vhost-user-blk: Fail gracefully on too large queue size qemu-img convert: Unshare write permission for source block: Add BDRV_O_NO_SHARE for blk_new_open() block: refactor bdrv_node_check_perm() block: rename bdrv_replace_child_safe() to bdrv_replace_child() block: refactor bdrv_child_set_perm_safe() transaction action block: inline bdrv_replace_child() block: inline bdrv_check_perm_common() block: drop unused permission update functions block: bdrv_reopen_multiple: refresh permissions on updated graph block: bdrv_reopen_multiple(): move bdrv_flush to separate pre-prepare block: add bdrv_set_backing_noperm() transaction action block: make bdrv_refresh_limits() to be a transaction action block: make bdrv_unset_inherits_from to be a transaction action block: drop ignore_children for permission update functions block/backup-top: drop .active block: introduce bdrv_drop_filter() block: add bdrv_remove_filter_or_cow transaction action block: adapt bdrv_append() for inserting filters block: split out bdrv_replace_node_noperm() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * vhost-user-blk: Fail gracefully on too large queue sizeKevin Wolf2021-04-301-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio_add_queue() aborts when queue_size > VIRTQUEUE_MAX_SIZE, so vhost_user_blk_device_realize() should check this before calling it. Simple reproducer: qemu-system-x86_64 \ -chardev null,id=foo \ -device vhost-user-blk-pci,queue-size=4096,chardev=foo Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935014 Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210413165654.50810-1-kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | hw/pci-host/gpex: Don't fault for unmapped parts of MMIO and PIO windowsPeter Maydell2021-04-302-4/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the gpex PCI controller implements no special behaviour for guest accesses to areas of the PIO and MMIO where it has not mapped any PCI devices, which means that for Arm you end up with a CPU exception due to a data abort. Most host OSes expect "like an x86 PC" behaviour, where bad accesses like this return -1 for reads and ignore writes. In the interests of not being surprising, make host CPU accesses to these windows behave as -1/discard where there's no mapped PCI device. The old behaviour generally didn't cause any problems, because almost always the guest OS will map the PCI devices and then only access where it has mapped them. One corner case where you will see this kind of access is if Linux attempts to probe legacy ISA devices via a PIO window access. So far the only case where we've seen this has been via the syzkaller fuzzer. Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20210325163315.27724-1-peter.maydell@linaro.org Fixes: https://bugs.launchpad.net/qemu/+bug/1918917 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw: add compat machines for 6.1Cornelia Huck2021-04-307-6/+63
| | | | | | | | | | | | | | | | | | | | Add 6.1 machine types for arm/i440fx/q35/s390x/spapr. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Acked-by: Greg Kurz <groug@kaod.org> Message-id: 20210331111900.118274-1-cohuck@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/arm/smmuv3: Support 16K translation granuleKunkun Jiang2021-04-301-2/+4
|/ | | | | | | | | | | | | | | The driver can query some bits in SMMUv3 IDR5 to learn which translation granules are supported. Arm recommends that SMMUv3 implementations support at least 4K and 64K granules. But in the vSMMUv3, there seems to be no reason not to support 16K translation granule. In addition, if 16K is not supported, vSVA will failed to be enabled in the future for 16K guest kernel. So it'd better to support it. Signed-off-by: Kunkun Jiang <jiangkunkun@huawei.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/block/nvme: fix invalid msix exclusive uninitKlaus Jensen2021-04-261-1/+2
| | | | | | | | | | | | | | | | | Commit 1901b4967c3f changed the nvme device from using a bar exclusive for MSI-x to sharing it on bar0. Unfortunately, the msix_uninit_exclusive_bar() call remains in nvme_exit() which causes havoc when the device is removed with, say, device_del. Fix this. Additionally, a subregion is added but it is not removed on exit which causes a reference to linger and the drive to never be unlocked. Fixes: 1901b4967c3f ("hw/block/nvme: move msix table and pba to BAR 0") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)Michael Tokarev2021-04-192-7/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since s->pending is actually not used, simply remove it from MPTSASState. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Message-id: 20210419134247.1467982-1-f4bug@amsat.org Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") [PMD: Reworded description, added more tags] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/armsse: Make SSE-300 use Cortex-M55Peter Maydell2021-04-171-2/+5
| | | | | | | | | | | | | | The SSE-300 has a Cortex-M55 (which was the whole reason for us modelling it), but we forgot to actually update the code to let it have a different CPU type from the IoTKit and SSE-200. Add CPU type as a field for ARMSSEInfo instead of hardcoding it to always use a Cortex-M33. Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210416104010.13228-1-peter.maydell@linaro.org
* hw/arm/armsse: Give SSE-300 its own Property arrayPeter Maydell2021-04-171-3/+14
| | | | | | | | | | | | | | | | | SSE-300 currently shares the SSE-200 Property array. This is bad principally because the default values of the CPU0_FPU and CPU0_DSP properties disable the FPU and DSP on the CPU. That is correct for the SSE-200 but not the SSE-300. Give the SSE-300 its own Property array with the correct SSE-300 specific settings: * SSE-300 has only one CPU, so no CPU1* properties * SSE-300 CPU has FPU and DSP Buglink: https://bugs.launchpad.net/qemu/+bug/1923861 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210415182353.8173-1-peter.maydell@linaro.org
* Merge remote-tracking branch ↵Peter Maydell2021-04-131-4/+16
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413' into staging virtiofs: Fix feature negotiation (for 6.0) A 6.0 fix for feature negotiation on vhost-user. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Tue 13 Apr 2021 16:21:41 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413: vhost-user-fs: fix features handling Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * vhost-user-fs: fix features handlingAnton Kuchin2021-04-131-4/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Make virtio-fs take into account server capabilities. Just returning requested features assumes they all of then are implemented by server and results in setting unsupported configuration if some of them are absent. Signed-off-by: Anton Kuchin <antonkuchin@yandex-team.ru> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> With changes suggested by Stefan Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2021-04-131-3/+7
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20210413' into staging target-arm queue: * Fix MPC setting for AN524 SRAM block * sphinx: qapidoc: Wrap "If" section body in a paragraph node # gpg: Signature made Tue 13 Apr 2021 13:07:12 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210413: sphinx: qapidoc: Wrap "If" section body in a paragraph node hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPC hw/arm/mps2-tz: Fix MPC setting for AN524 SRAM block Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPCPeter Maydell2021-04-121-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Each board in mps2-tz.c specifies a RAMInfo[] array providing information about each RAM in the board. The .mpc field of the RAMInfo struct specifies which MPC, if any, the RAM is attached to. We already assert if the array doesn't have any entry for an MPC, but we don't diagnose the error of using the same MPC number twice (which is quite easy to do by accident if copy-and-pasting structure entries). Enhance find_raminfo_for_mpc() so that it detects multiple entries for the MPC as well as missing entries. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210409150527.15053-3-peter.maydell@linaro.org
| * | hw/arm/mps2-tz: Fix MPC setting for AN524 SRAM blockPeter Maydell2021-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The AN524 has three MPCs: one for the BRAM, one for the QSPI flash, and one for the DDR. We incorrectly set the .mpc field in the RAMInfo struct for the SRAM block to 1, giving it the same MPC we are using for the QSPI. The effect of this was that the QSPI didn't get mapped into the system address space at all, via an MPC or otherwise, and guest programs which tried to read from the QSPI would get a bus error. Correct the SRAM RAMInfo to indicate that it does not have an associated MPC. Fixes: 25ff112a8cc ("hw/arm/mps2-tz: Add new mps3-an524 board") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210409150527.15053-2-peter.maydell@linaro.org
* | | Merge remote-tracking branch 'remotes/philmd/tags/mips-20210413' into stagingPeter Maydell2021-04-132-1/+15
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches queue - Fix invalid Kconfig dependency - Fix missing migrated value - Fix TCG temporary leak # gpg: Signature made Tue 13 Apr 2021 11:10:11 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210413: target/mips: Fix TCG temporary leak in gen_cache_operation() hw/isa/piix4: Migrate Reset Control Register hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APM Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/isa/piix4: Migrate Reset Control RegisterPhilippe Mathieu-Daudé2021-04-131-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When adding the Reset register in commit 5790b757cfb we forgot to migrate it. While it is possible a VM using the PIIX4 is migrated just after requesting a system shutdown, it is very unlikely. However when restoring a migrated VM, we might have the RCR bit #4 set on the stack and when the VM resume it directly shutdowns. Add a post_load() migration handler and set the default RCR value to 0 for earlier versions, assuming the VM was not going to shutdown before migration. Fixes: 5790b757cfb ("piix4: Add the Reset Control Register") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210324200334.729899-1-f4bug@amsat.org>
| * | hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APMPhilippe Mathieu-Daudé2021-04-131-0/+1
| |/ | | | | | | | | | | | | | | | | | | TYPE_VIA_PM calls apm_init() in via_pm_realize(), so requires APM to be selected. Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Fixes: dd0ff8191ab ("isa: express SuperIO dependencies with Kconfig") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210302080531.913802-1-f4bug@amsat.org>
* | Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210412' ↵Peter Maydell2021-04-132-57/+10Star
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ppc patch queue for 2021-04-21 Here's what I hope is the last ppc related pull request for qemu-6.0. The 2 patches here revert a behavioural change that after further discussion we concluded was a bad idea (adding a timeout for possibly-failed hot unplug requests). Instead it implements a different approach to the original problem: we again let unplug requests the guest doesn't respond to remain pending indefinitely, but no longer allow those to block attempts to retry the same unplug again. The change is a bit more complex than I'd like for this late in the freeze. Nonetheless, I think it's important to merge this for 6.0, so we don't allow a release which has the probably-a-bad-idea timeout behaviour. # gpg: Signature made Mon 12 Apr 2021 06:25:58 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-6.0-20210412: spapr.c: always pulse guest IRQ in spapr_core_unplug_request() spapr: rollback 'unplug timeout' for CPU hotunplugs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | spapr.c: always pulse guest IRQ in spapr_core_unplug_request()Daniel Henrique Barboza2021-04-121-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 47c8c915b162 fixed a problem where multiple spapr_drc_detach() requests were breaking QEMU. The solution was to just spapr_drc_detach() once, and use spapr_drc_unplug_requested() to filter whether we already detached it or not. The commit also tied the hotplug request to the guest in the same condition. Turns out that there is a reliable way for a CPU hotunplug to fail. If a guest with one CPU hotplugs a CPU1, then offline CPU0s via 'echo 0 > /sys/devices/system/cpu/cpu0/online', then attempts to hotunplug CPU1, the kernel will refuse it because it's the last online CPU of the system. Given that we're pulsing the IRQ only in the first try, in a failed attempt, all other CPU1 hotunplug attempts will fail, regardless of the online state of CPU1 in the kernel, because we're simply not letting the guest know that we want to hotunplug the device. Let's move spapr_hotplug_req_remove_by_index() back out of the "if (!spapr_drc_unplug_requested(drc))" conditional, allowing for multiple 'device_del' requests to the same CPU core to reach the guest, in case the CPU core didn't fully hotunplugged previously. Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20210401000437.131140-3-danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| * | spapr: rollback 'unplug timeout' for CPU hotunplugsDaniel Henrique Barboza2021-04-122-56/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pseries machines introduced the concept of 'unplug timeout' for CPU hotunplugs. The idea was to circunvent a deficiency in the pSeries specification (PAPR), that currently does not define a proper way for the hotunplug to fail. If the guest refuses to release the CPU (see [1] for an example) there is no way for QEMU to detect the failure. Further discussions about how to send a QAPI event to inform about the hotunplug timeout [2] exposed problems that weren't predicted back when the idea was developed. Other QEMU machines don't have any type of hotunplug timeout mechanism for any device, e.g. ACPI based machines have a way to make hotunplug errors visible to the hypervisor. This would make this timeout mechanism exclusive to pSeries, which is not ideal. The real problem is that a QAPI event that reports hotunplug timeouts puts the management layer (namely Libvirt) in a weird spot. We're not telling that the hotunplug failed, because we can't be 100% sure of that, and yet we're resetting the unplug state back, preventing any DEVICE_DEL events to reach out in case the guest decides to release the device. Libvirt would need to inspect the guest itself to see if the device was released or not, otherwise the internal domain states will be inconsistent. Moreover, Libvirt already has an 'unplug timeout' concept, and a QEMU side timeout would need to be juggled together with the existing Libvirt timeout. All this considered, this solution ended up creating more trouble than it solved. This patch reverts the 3 commits that introduced the timeout mechanism for CPU hotplugs in pSeries machines. This reverts commit 4515a5f786024fabf0bef4cf3d28adf5647e6e82 "qemu_timer.c: add timer_deadline_ms() helper" This reverts commit d1c2e3ce3d5a5424651967bce1cf1f4caa0c6d91 "spapr_drc.c: add hotunplug timeout for CPUs" This reverts commit 51254ffb320183a4636635840c23ee0e3a1efffa "spapr_drc.c: introduce unplug_timeout_timer" [1] https://bugzilla.redhat.com/show_bug.cgi?id=1911414 [2] https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg04682.html CC: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20210401000437.131140-2-danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | | esp: ensure that do_cmd is set to zero before submitting an ESP select commandMark Cave-Ayland2021-04-121-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a CDB has been received and is about to be submitted to the SCSI layer via one of the ESP select commands, ensure that do_cmd is set to zero before executing the command. Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI .transfer_data callback again before do_cmd is set to zero by the callback function triggering an assert at the start of esp_transfer_data(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
* | | esp: don't reset async_len directly in esp_select() if cancelling requestMark Cave-Ayland2021-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead let the SCSI layer invoke the .cancel callback itself to cancel and reset the request state. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-11-mark.cave-ayland@ilande.co.uk>
* | | esp: don't overflow cmdfifo if TC is larger than the cmdfifo sizeMark Cave-Ayland2021-04-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a guest transfers the message out/command phase data using DMA with a TC that is larger than the cmdfifo size then the cmdfifo overflows triggering an assert. Limit the size of the transfer to the free space available in cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1919036 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-10-mark.cave-ayland@ilande.co.uk>
* | | esp: don't overflow cmdfifo in get_cmd()Mark Cave-Ayland2021-04-121-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the guest tries to read a CDB using DMA and cmdfifo is not empty then it is possible to overflow cmdfifo. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of the CDB transferred to cmdfifo is limited to the available free space within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-9-mark.cave-ayland@ilande.co.uk>
* | | esp: don't underflow cmdfifo in do_cmd()Mark Cave-Ayland2021-04-121-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the guest tries to execute a CDB when cmdfifo is not empty before the start of the message out phase then clearing the message out phase data will cause cmdfifo to underflow due to cmdfifo_cdb_offset being larger than the amount of data within. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of esp_fifo_pop_buf() is limited to the size of the data within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-8-mark.cave-ayland@ilande.co.uk>
* | | esp: ensure cmdfifo is not empty and current_dev is non-NULLMark Cave-Ayland2021-04-121-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When about to execute a SCSI command, ensure that cmdfifo is not empty and current_dev is non-NULL. This can happen if the guest tries to execute a TI (Transfer Information) command without issuing one of the select commands first. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-7-mark.cave-ayland@ilande.co.uk>
* | | esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf()Mark Cave-Ayland2021-04-121-12/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The const pointer returned by fifo8_pop_buf() lies directly within the array used to model the FIFO. Building with address sanitizers enabled shows that if the caller expects a minimum number of bytes present then if the FIFO is nearly full, the caller may unexpectedly access past the end of the array. Introduce esp_fifo_pop_buf() which takes a destination buffer and performs a memcpy() in it to guarantee that the caller cannot overwrite the FIFO array and update all callers to use it. Similarly add underflow protection similar to esp_fifo_push() and esp_fifo_pop() so that instead of triggering an assert() the operation becomes a no-op. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210407195801.685-6-mark.cave-ayland@ilande.co.uk>
* | | esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop()Mark Cave-Ayland2021-04-121-14/+6Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Each FIFO currently has its own pop functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_pop() to access the FIFO capacity directly and then consolidate esp_cmdfifo_pop() into esp_fifo_pop(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-5-mark.cave-ayland@ilande.co.uk>
* | | esp: consolidate esp_cmdfifo_push() into esp_fifo_push()Mark Cave-Ayland2021-04-121-19/+8Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Each FIFO currently has its own push functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_push() to access the FIFO capacity directly and then consolidate esp_cmdfifo_push() into esp_fifo_push(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-4-mark.cave-ayland@ilande.co.uk>
* | | esp: rework write_response() to avoid using the FIFO for DMA transactionsMark Cave-Ayland2021-04-121-7/+6Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code for write_response() has always used the FIFO to store the data for the status/message in phases, even for DMA transactions. Switch to using a separate buffer that can be used directly for DMA transactions and restrict the FIFO use to the non-DMA case. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-3-mark.cave-ayland@ilande.co.uk>
* | | esp: always check current_req is not NULL before use in DMA callbacksMark Cave-Ayland2021-04-121-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel callback which resets both current_req and current_dev to NULL. If any data is left in the transfer buffer (async_len != 0) then the next TI (Transfer Information) command will attempt to reference the NULL pointer causing a segfault. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-2-mark.cave-ayland@ilande.co.uk>
* | | esp: fix setting of ESPState mig_version_id when launching QEMU with -S optionMark Cave-Ayland2021-04-122-3/+5
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If QEMU is launched with the -S option then the ESPState mig_version_id property is left unset due to the ordering of the VMState fields in the VMStateDescription for sysbusespscsi and pciespscsi. If the VM is migrated and restored in this stopped state, the version tests in the vmstate_esp VMStateDescription and esp_post_load() become confused causing the migration to fail. Fix the ordering problem by moving the setting of mig_version_id to a common esp_pre_save() function which is invoked first by both sysbusespscsi and pciespscsi rather than at the point where ESPState is itself serialised into the migration stream. Buglink: https://bugs.launchpad.net/qemu/+bug/1922611 Fixes: 0bd005be78 ("esp: add vmstate_esp version to embedded ESPState") Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210407124842.32695-1-mark.cave-ayland@ilande.co.uk>
* | Merge remote-tracking branch ↵Peter Maydell2021-04-122-6/+10
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20210412' into staging target-arm queue: * hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interrupts * hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDs * accel/tcg: Preserve PAGE_ANON when changing page permissions * target/arm: Check PAGE_WRITE_ORG for MTE writeability * exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1 # gpg: Signature made Mon 12 Apr 2021 11:31:15 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210412: exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1 target/arm: Check PAGE_WRITE_ORG for MTE writeability accel/tcg: Preserve PAGE_ANON when changing page permissions hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDs hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interrupts Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDsZenghui Yu2021-04-121-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In emulation of the CFGI_STE_RANGE command, we now take StreamID as the start of the invalidation range, regardless of whatever the Range is, whilst the spec clearly states that - "Invalidation is performed for an *aligned* range of 2^(Range+1) StreamIDs." - "The bottom Range+1 bits of the StreamID parameter are IGNORED, aligning the range to its size." Take CFGI_ALL (where Range == 31) as an example, if there are some random bits in the StreamID field, we'll fail to perform the full invalidation but get a strange range (e.g., SMMUSIDRange={.start=1, .end=0}) instead. Rework the emulation a bit to get rid of the discrepancy with the spec. Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210402100449.528-1-yuzenghui@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interruptsZenghui Yu2021-04-121-2/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | The GSIV values in SMMUv3 IORT node are not correct as they don't match the SMMUIrq enumeration, which describes the IRQ<->PIN mapping used by our emulated vSMMU. Fixes: a703b4f6c1ee ("hw/arm/virt-acpi-build: Add smmuv3 node in IORT table") Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210402084731.93-1-yuzenghui@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/block/nvme: drain namespaces on sq deletionKlaus Jensen2021-04-121-2/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For most commands, when issuing an AIO, the BlockAIOCB is stored in the NvmeRequest aiocb pointer when the AIO is issued. The main use of this is cancelling AIOs when deleting submission queues (it is currently not used for Abort). However, some commands like Dataset Management Zone Management Send (zone reset) may involve more than one AIO and here the AIOs are issued without saving a reference to the BlockAIOCB. This is a problem since nvme_del_sq() will attempt to cancel outstanding AIOs, potentially with an invalid BlockAIOCB since the aiocb pointer is not NULL'ed when the request structure is recycled. Fix this by 1. making sure the aiocb pointer is NULL'ed when requests are recycled 2. only attempt to cancel the AIO if the aiocb is non-NULL 3. if any AIOs could not be cancelled, drain all aio as a last resort. Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Fixes: c94973288cd9 ("hw/block/nvme: add broadcast nsid support flush command") Fixes: e4e430b3d6ba ("hw/block/nvme: add simple copy command") Fixes: 5f5dc4c6a942 ("hw/block/nvme: zero out zones on reset") Fixes: 2605257a26b8 ("hw/block/nvme: add the dataset management command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Cc: Minwoo Im <minwoo.im@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
* | hw/block/nvme: store aiocb in compareKlaus Jensen2021-04-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | nvme_compare() fails to store the aiocb from the blk_aio_preadv() call. Fix this. Fixes: 0a384f923f51 ("hw/block/nvme: add compare command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-27 10:21:05 +0100