aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2021-08-26hw/arm/virt: Delete EL3 error checksnow provided in CPU realizePeter Maydell
Now that the CPU realize function will fail cleanly if we ask for EL3 when KVM is enabled, we don't need to check for errors explicitly in the virt board code. The reported message is slightly different; it is now: qemu-system-aarch64: Cannot enable KVM when guest CPU has EL3 enabled instead of: qemu-system-aarch64: mach-virt: KVM does not support Security extensions We don't delete the MTE check because there the logic is more complex; deleting the check would work but makes the error message less helpful, as it would read: qemu-system-aarch64: MTE requested, but not supported by the guest CPU instead of: qemu-system-aarch64: mach-virt: KVM does not support providing MTE to the guest CPU Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210816135842.25302-4-peter.maydell@linaro.org
2021-08-26raspi: Use error_fatal for SoC realize errors, not error_abortPeter Maydell
The SoC realize can fail for legitimate reasons, because it propagates errors up from CPU realize, which in turn can be provoked by user error in setting commandline options. Use error_fatal so we report the error message to the user and exit, rather than asserting via error_abort. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210816135842.25302-2-peter.maydell@linaro.org
2021-08-26hw/core/loader: In gunzip(), check index is in range before use, not afterPeter Maydell
The gunzip() function reads various fields from a passed in source buffer in order to skip a header before passing the actual compressed data to the zlib inflate() function. It does check whether the passed in buffer is too small, but unfortunately it checks that only after reading bytes from the src buffer, so it could read off the end of the buffer. You can see this with valgrind: $ printf "%b" '\x1f\x8b' > /tmp/image $ valgrind qemu-system-aarch64 -display none -M virt -cpu max -kernel /tmp/image [...] ==19224== Invalid read of size 1 ==19224== at 0x67302E: gunzip (loader.c:558) ==19224== by 0x673907: load_image_gzipped_buffer (loader.c:788) ==19224== by 0xA18032: load_aarch64_image (boot.c:932) ==19224== by 0xA18489: arm_setup_direct_kernel_boot (boot.c:1063) ==19224== by 0xA18D90: arm_load_kernel (boot.c:1317) ==19224== by 0x9F3651: machvirt_init (virt.c:2114) ==19224== by 0x794B7A: machine_run_board_init (machine.c:1272) ==19224== by 0xD5CAD3: qemu_init_board (vl.c:2618) ==19224== by 0xD5CCA6: qmp_x_exit_preconfig (vl.c:2692) ==19224== by 0xD5F32E: qemu_init (vl.c:3713) ==19224== by 0x5ADDB1: main (main.c:49) ==19224== Address 0x3802a873 is 0 bytes after a block of size 3 alloc'd ==19224== at 0x4C31B0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19224== by 0x61E7657: g_file_get_contents (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4) ==19224== by 0x673895: load_image_gzipped_buffer (loader.c:771) ==19224== by 0xA18032: load_aarch64_image (boot.c:932) ==19224== by 0xA18489: arm_setup_direct_kernel_boot (boot.c:1063) ==19224== by 0xA18D90: arm_load_kernel (boot.c:1317) ==19224== by 0x9F3651: machvirt_init (virt.c:2114) ==19224== by 0x794B7A: machine_run_board_init (machine.c:1272) ==19224== by 0xD5CAD3: qemu_init_board (vl.c:2618) ==19224== by 0xD5CCA6: qmp_x_exit_preconfig (vl.c:2692) ==19224== by 0xD5F32E: qemu_init (vl.c:3713) ==19224== by 0x5ADDB1: main (main.c:49) Check that we have enough bytes of data to read the header bytes that we read before we read them. Fixes: Coverity 1458997 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210812141803.20913-1-peter.maydell@linaro.org
2021-08-26arch_init.h: Don't include arch_init.h unnecessarilyPeter Maydell
arch_init.h only defines the QEMU_ARCH_* enumeration and the arch_type global. Don't include it in files that don't use those. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210730105947.28215-8-peter.maydell@linaro.org
2021-08-26hw/arm/Kconfig: no need to enable ACPI_MEMORY_HOTPLUG/ACPI_NVDIMM explicitlyAni Sinha
Since commit 36b79e3219d ("hw/acpi/Kconfig: Add missing Kconfig dependencies (build error)"), ACPI_MEMORY_HOTPLUG and ACPI_NVDIMM is implicitly turned on when ACPI_HW_REDUCED is selected. ACPI_HW_REDUCED is already enabled. No need to turn on ACPI_MEMORY_HOTPLUG or ACPI_NVDIMM explicitly. This is a minor cleanup. Signed-off-by: Ani Sinha <ani@anisinha.ca> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20210819162637.518507-1-ani@anisinha.ca Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-26hw/dma/xlnx-zdma Always expect 'dma' link property to be setPhilippe Mathieu-Daudé
Simplify by always passing a MemoryRegion property to the device. Doing so we can move the AddressSpace field to the device struct, removing need for heap allocation. Update the Xilinx ZynqMP / Versal SoC models to pass the default system memory instead of a NULL value. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210819163422.2863447-5-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-26hw/dma/xlnx_csu_dma: Always expect 'dma' link property to be setPhilippe Mathieu-Daudé
Simplify by always passing a MemoryRegion property to the device. Doing so we can move the AddressSpace field to the device struct, removing need for heap allocation. Update the Xilinx ZynqMP SoC model to pass the default system memory instead of a NULL value. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20210819163422.2863447-4-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-26hw/dma/xlnx_csu_dma: Run trivial checks early in realize()Philippe Mathieu-Daudé
If some property are not set, we'll return indicating a failure, so it is pointless to allocate / initialize some fields too early. Move the trivial checks earlier in realize(). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210819163422.2863447-3-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-26hw/arm/xlnx-zynqmp: Realize qspi controller *after* qspi_dmaPhilippe Mathieu-Daudé
If we link QOM object (a) as a property of QOM object (b), we must set the property *before* (b) is realized. Move QSPI realization *after* QSPI DMA. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210819163422.2863447-2-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-25fsl-imx7: Instantiate SAI1/2/3 as unimplemented devicesGuenter Roeck
Instantiate SAI1/2/3 as unimplemented devices to avoid Linux kernel crashes such as the following. Unhandled fault: external abort on non-linefetch (0x808) at 0xd19b0000 pgd = (ptrval) [d19b0000] *pgd=82711811, *pte=308a0653, *ppte=308a0453 Internal error: : 808 [#1] SMP ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc5 #1 ... [<c095e974>] (regmap_mmio_write32le) from [<c095eb48>] (regmap_mmio_write+0x3c/0x54) [<c095eb48>] (regmap_mmio_write) from [<c09580f4>] (_regmap_write+0x4c/0x1f0) [<c09580f4>] (_regmap_write) from [<c0959b28>] (regmap_write+0x3c/0x60) [<c0959b28>] (regmap_write) from [<c0d41130>] (fsl_sai_runtime_resume+0x9c/0x1ec) [<c0d41130>] (fsl_sai_runtime_resume) from [<c0942464>] (__rpm_callback+0x3c/0x108) [<c0942464>] (__rpm_callback) from [<c0942590>] (rpm_callback+0x60/0x64) [<c0942590>] (rpm_callback) from [<c0942b60>] (rpm_resume+0x5cc/0x808) [<c0942b60>] (rpm_resume) from [<c0942dfc>] (__pm_runtime_resume+0x60/0xa0) [<c0942dfc>] (__pm_runtime_resume) from [<c0d4231c>] (fsl_sai_probe+0x2b8/0x65c) [<c0d4231c>] (fsl_sai_probe) from [<c0935b08>] (platform_probe+0x58/0xb8) [<c0935b08>] (platform_probe) from [<c0933264>] (really_probe.part.0+0x9c/0x334) [<c0933264>] (really_probe.part.0) from [<c093359c>] (__driver_probe_device+0xa0/0x138) [<c093359c>] (__driver_probe_device) from [<c0933664>] (driver_probe_device+0x30/0xc8) [<c0933664>] (driver_probe_device) from [<c0933c88>] (__driver_attach+0x90/0x130) [<c0933c88>] (__driver_attach) from [<c0931060>] (bus_for_each_dev+0x78/0xb8) [<c0931060>] (bus_for_each_dev) from [<c093254c>] (bus_add_driver+0xf0/0x1d8) [<c093254c>] (bus_add_driver) from [<c0934a30>] (driver_register+0x88/0x118) [<c0934a30>] (driver_register) from [<c01022c0>] (do_one_initcall+0x7c/0x3a4) [<c01022c0>] (do_one_initcall) from [<c1601204>] (kernel_init_freeable+0x198/0x22c) [<c1601204>] (kernel_init_freeable) from [<c0f5ff2c>] (kernel_init+0x10/0x128) [<c0f5ff2c>] (kernel_init) from [<c010013c>] (ret_from_fork+0x14/0x38) Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20210810175607.538090-1-linux@roeck-us.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-25sbsa-ref: Rename SBSA_GWDT enum valueEduardo Habkost
The SBSA_GWDT enum value conflicts with the SBSA_GWDT() QOM type checking helper, preventing us from using a OBJECT_DEFINE* or DEFINE_INSTANCE_CHECKER macro for the SBSA_GWDT() wrapper. If I understand the SBSA 6.0 specification correctly, the signal being connected to IRQ 16 is the WS0 output signal from the Generic Watchdog. Rename the enum value to SBSA_GWDT_WS0 to be more explicit and avoid the name conflict. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 20210806023119.431680-1-ehabkost@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-25hw/dma/pl330: Add memory region to replace defaultWen, Jianxian
Add property memory region which can connect with IOMMU region to support SMMU translate. Signed-off-by: Jianxian Wen <jianxian.wen@verisilicon.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 4C23C17B8E87E74E906A25A3254A03F4FA1FEC31@SHASXM03.verisilicon.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-25fsl-imx6ul: Instantiate SAI1/2/3 and ASRC as unimplemented devicesGuenter Roeck
Instantiate SAI1/2/3 and ASRC as unimplemented devices to avoid random Linux kernel crashes, such as Unhandled fault: external abort on non-linefetch (0x808) at 0xd1580010 pgd = (ptrval) [d1580010] *pgd=8231b811, *pte=02034653, *ppte=02034453 Internal error: : 808 [#1] SMP ARM ... [<c095e974>] (regmap_mmio_write32le) from [<c095eb48>] (regmap_mmio_write+0x3c/0x54) [<c095eb48>] (regmap_mmio_write) from [<c09580f4>] (_regmap_write+0x4c/0x1f0) [<c09580f4>] (_regmap_write) from [<c095837c>] (_regmap_update_bits+0xe4/0xec) [<c095837c>] (_regmap_update_bits) from [<c09599b4>] (regmap_update_bits_base+0x50/0x74) [<c09599b4>] (regmap_update_bits_base) from [<c0d3e9e4>] (fsl_asrc_runtime_resume+0x1e4/0x21c) [<c0d3e9e4>] (fsl_asrc_runtime_resume) from [<c0942464>] (__rpm_callback+0x3c/0x108) [<c0942464>] (__rpm_callback) from [<c0942590>] (rpm_callback+0x60/0x64) [<c0942590>] (rpm_callback) from [<c0942b60>] (rpm_resume+0x5cc/0x808) [<c0942b60>] (rpm_resume) from [<c0942dfc>] (__pm_runtime_resume+0x60/0xa0) [<c0942dfc>] (__pm_runtime_resume) from [<c0d3ecc4>] (fsl_asrc_probe+0x2a8/0x708) [<c0d3ecc4>] (fsl_asrc_probe) from [<c0935b08>] (platform_probe+0x58/0xb8) [<c0935b08>] (platform_probe) from [<c0933264>] (really_probe.part.0+0x9c/0x334) [<c0933264>] (really_probe.part.0) from [<c093359c>] (__driver_probe_device+0xa0/0x138) [<c093359c>] (__driver_probe_device) from [<c0933664>] (driver_probe_device+0x30/0xc8) [<c0933664>] (driver_probe_device) from [<c0933c88>] (__driver_attach+0x90/0x130) [<c0933c88>] (__driver_attach) from [<c0931060>] (bus_for_each_dev+0x78/0xb8) [<c0931060>] (bus_for_each_dev) from [<c093254c>] (bus_add_driver+0xf0/0x1d8) [<c093254c>] (bus_add_driver) from [<c0934a30>] (driver_register+0x88/0x118) [<c0934a30>] (driver_register) from [<c01022c0>] (do_one_initcall+0x7c/0x3a4) [<c01022c0>] (do_one_initcall) from [<c1601204>] (kernel_init_freeable+0x198/0x22c) [<c1601204>] (kernel_init_freeable) from [<c0f5ff2c>] (kernel_init+0x10/0x128) [<c0f5ff2c>] (kernel_init) from [<c010013c>] (ret_from_fork+0x14/0x38) or Unhandled fault: external abort on non-linefetch (0x808) at 0xd19b0000 pgd = (ptrval) [d19b0000] *pgd=82711811, *pte=308a0653, *ppte=308a0453 Internal error: : 808 [#1] SMP ARM ... [<c095e974>] (regmap_mmio_write32le) from [<c095eb48>] (regmap_mmio_write+0x3c/0x54) [<c095eb48>] (regmap_mmio_write) from [<c09580f4>] (_regmap_write+0x4c/0x1f0) [<c09580f4>] (_regmap_write) from [<c0959b28>] (regmap_write+0x3c/0x60) [<c0959b28>] (regmap_write) from [<c0d41130>] (fsl_sai_runtime_resume+0x9c/0x1ec) [<c0d41130>] (fsl_sai_runtime_resume) from [<c0942464>] (__rpm_callback+0x3c/0x108) [<c0942464>] (__rpm_callback) from [<c0942590>] (rpm_callback+0x60/0x64) [<c0942590>] (rpm_callback) from [<c0942b60>] (rpm_resume+0x5cc/0x808) [<c0942b60>] (rpm_resume) from [<c0942dfc>] (__pm_runtime_resume+0x60/0xa0) [<c0942dfc>] (__pm_runtime_resume) from [<c0d4231c>] (fsl_sai_probe+0x2b8/0x65c) [<c0d4231c>] (fsl_sai_probe) from [<c0935b08>] (platform_probe+0x58/0xb8) [<c0935b08>] (platform_probe) from [<c0933264>] (really_probe.part.0+0x9c/0x334) [<c0933264>] (really_probe.part.0) from [<c093359c>] (__driver_probe_device+0xa0/0x138) [<c093359c>] (__driver_probe_device) from [<c0933664>] (driver_probe_device+0x30/0xc8) [<c0933664>] (driver_probe_device) from [<c0933c88>] (__driver_attach+0x90/0x130) [<c0933c88>] (__driver_attach) from [<c0931060>] (bus_for_each_dev+0x78/0xb8) [<c0931060>] (bus_for_each_dev) from [<c093254c>] (bus_add_driver+0xf0/0x1d8) [<c093254c>] (bus_add_driver) from [<c0934a30>] (driver_register+0x88/0x118) [<c0934a30>] (driver_register) from [<c01022c0>] (do_one_initcall+0x7c/0x3a4) [<c01022c0>] (do_one_initcall) from [<c1601204>] (kernel_init_freeable+0x198/0x22c) [<c1601204>] (kernel_init_freeable) from [<c0f5ff2c>] (kernel_init+0x10/0x128) [<c0f5ff2c>] (kernel_init) from [<c010013c>] (ret_from_fork+0x14/0x38) Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20210810160318.87376-1-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-25hw/char/pl011: add support for sending breakJan Luebbe
Break events are currently only handled by chardev/char-serial.c, so we just ignore errors, which results in no behaviour change for other chardevs. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Message-id: 20210806144700.3751979-1-jlu@pengutronix.de Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-13hw/core: fix error checking in smp_parseDaniel P. Berrangé
machine_set_smp() mistakenly checks 'errp' not '*errp', and so thinks there is an error every single time it runs. This causes it to jump to the end of the method, skipping the max CPUs checks. The caller meanwhile sees no error and so carries on execution. The result of all this is: $ qemu-system-x86_64 -smp -1 qemu-system-x86_64: GLib: ../glib/gmem.c:142: failed to allocate 481036337048 bytes instead of $ qemu-system-x86_64 -smp -1 qemu-system-x86_64: Invalid SMP CPUs -1. The max CPUs supported by machine 'pc-i440fx-6.1' is 255 This is a regression from commit fe68090e8fbd6e831aaf3fc3bb0459c5cccf14cf Author: Paolo Bonzini <pbonzini@redhat.com> Date: Thu May 13 09:03:48 2021 -0400 machine: add smp compound property Closes: https://gitlab.com/qemu-project/qemu/-/issues/524 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20210812175353.4128471-1-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-08-13hw/core: Add missing return on errorPhilippe Mathieu-Daudé
If dies is not supported by this machine's CPU topology, don't keep processing options and return directly. Fixes: 0aebebb561c ("machine: reject -smp dies!=1 for non-PC machines") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210813112608.1452541-2-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-08-09hw/nvme: fix missing variable initializersKlaus Jensen
Coverity found that 'uuid', 'csi' and 'eui64' are uninitialized. While we set most of the fields, we do not explicitly set the rsvd2 field in the NvmeIdNsDescr header. Fix this by explicitly zero-initializing the variables. Reported-by: Coverity (CID 1458835, 1459295 and 1459580) Fixes: 6870cfb8140d ("hw/nvme: namespace parameter for EUI-64") Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-08-05chardev: mark explicitly first argument as poisonedMarc-André Lureau
Since commit 9894dc0cdcc397ee5b26370bc53da6d360a363c2 "char: convert from GIOChannel to QIOChannel", the first argument to the watch callback can actually be a QIOChannel, which is not a GIOChannel (but a QEMU Object). Even though we never used that pointer, change the callback type to warn the users. Possibly a better fix later, we may want to store the callback and call it from intermediary functions. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-08-04Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc,pci: bugfixes Small bugfixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 03 Aug 2021 21:32:43 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: Drop _DSM 5 from expected DSDTs on ARM Revert "acpi/gpex: Inform os to keep firmware resource map" arm/acpi: allow DSDT changes acpi: x86: pcihp: add support hotplug on multifunction bridges hw/pcie-root-port: Fix hotplug for PCI devices requiring IO Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-08-03Revert "acpi/gpex: Inform os to keep firmware resource map"Michael S. Tsirkin
This reverts commit 0cf8882fd06ba0aeb1e90fa6f23fce85504d7e14. Which this commit, with aarch64 when using efi PCI devices with IO ports do not work. The reason is that EFI creates I/O port mappings below 0x1000 (in fact, at 0). However Linux, for legacy reasons, does not support I/O ports <= 0x1000 on PCI, so the I/O assignment created by EFI is rejected. EFI creates the mappings primarily for itself, and up until DSM #5 started to be enforced, all PCI resource allocations that existed at boot were ignored by Linux and recreated from scratch. Also, the commit in question looks dubious - it seems unlikely that Linux would fail to create a resource tree. What does happen is that BARs get moved around, which may cause trouble in some cases: for instance, Linux had to add special code to the EFI framebuffer driver to copy with framebuffer BARs being relocated. DSM #5 has a long history of debate and misinterpretation. Link: https://lore.kernel.org/r/20210724185234.GA2265457@roeck-us.net/ Fixes: 0cf8882fd06 ("acpi/gpex: Inform os to keep firmware resource map") Reported-by: Guenter Roeck <linux@roeck-us.net> Suggested-by: Ard Biesheuvel <ardb@kernel.org> Acked-by: Ard Biesheuvel <ardb@kernel.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03acpi: x86: pcihp: add support hotplug on multifunction bridgesIgor Mammedov
Commit [1] switched PCI hotplug from native to ACPI one by default. That however breaks hotplug on following CLI that used to work: -nodefaults -machine q35 \ -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \ -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 where PCI device is hotplugged to pcie-root-port-1 with error on guest side: ACPI BIOS Error (bug): Could not resolve symbol [^S0B.PCNT], AE_NOT_FOUND (20201113/psargs-330) ACPI Error: Aborting method \_SB.PCI0.PCNT due to previous error (AE_NOT_FOUND) (20201113/psparse-531) ACPI Error: Aborting method \_GPE._E01 due to previous error (AE_NOT_FOUND) (20201113/psparse-531) ACPI Error: AE_NOT_FOUND, while evaluating GPE method [_E01] (20201113/evgpe-515) cause is that QEMU's ACPI hotplug never supported functions other then 0 and due to bug it was generating notification entries for not described functions. Technically there is no reason not to describe cold-plugged bridges (root ports) on functions other then 0, as they similarly to bridge on function 0 are unpluggable. So since we need to describe multifunction devices iterate over fuctions as well. But describe only cold-plugged bridges[root ports] on functions other than 0 as well. 1) Fixes: 17858a169508609ca9063c544833e5a1adeb7b52 (hw/acpi/ich9: Set ACPI PCI hot-plug as default on Q35) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reported-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20210723090424.2092226-1-imammedo@redhat.com> Fixes: 17858a169508609ca9063c544833e5a1adeb7b52 (hw/acpi/ich9: Set ACPI PCI hot-plug as default on Q35)<br> Signed-off-by: Igor Mammedov &lt;<a href="mailto:imammedo@redhat.com" target="_blank">imammedo@redhat.com</a>&gt;<br> Reported-by: Laurent Vivier &lt;<a href="mailto:lvivier@redhat.com" target="_blank">lvivier@redhat.com</a>&gt;<br> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03hw/pcie-root-port: Fix hotplug for PCI devices requiring IOMarcel Apfelbaum
Q35 has now ACPI hotplug enabled by default for PCI(e) devices. As opposed to native PCIe hotplug, guests like Fedora 34 will not assign IO range to pcie-root-ports not supporting native hotplug, resulting into a regression. Reproduce by: qemu-bin -M q35 -device pcie-root-port,id=p1 -monitor stdio device_add e1000,bus=p1 In the Guest OS the respective pcie-root-port will have the IO range disabled. Fix it by setting the "reserve-io" hint capability of the pcie-root-ports so the firmware will allocate the IO range instead. Acked-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210802090057.1709775-1-marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-03hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30Philippe Mathieu-Daudé
OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers the assertion added in commit 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group"): qemu-fuzz-i386-target-generic-fuzz-sdhci-v3: ../hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. #3 0x7f62a8b22c91 in __assert_fail #4 0x5569adcec405 in sd_wpbits hw/sd/sd.c:824:9 #5 0x5569adce5f6d in sd_normal_command hw/sd/sd.c:1389:38 #6 0x5569adce3870 in sd_do_command hw/sd/sd.c:1737:17 #7 0x5569adcf1566 in sdbus_do_command hw/sd/core.c:100:16 #8 0x5569adcfc192 in sdhci_send_command hw/sd/sdhci.c:337:12 #9 0x5569adcfa3a3 in sdhci_write hw/sd/sdhci.c:1186:9 #10 0x5569adfb3447 in memory_region_write_accessor softmmu/memory.c:492:5 It is legal for the CMD30 to query for out-of-range addresses. Such invalid addresses are simply ignored in the response (write protection bits set to 0). In commit 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group") we misplaced the assertion *before* we test the address is in range. Move it *after*. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Cc: qemu-stable@nongnu.org Reported-by: OSS-Fuzz (Issue 29225) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/495 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210802235524.3417739-3-f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu>
2021-08-03hw/sd/sdcard: Document out-of-range addresses for SEND_WRITE_PROTPhilippe Mathieu-Daudé
Per the 'Physical Layer Simplified Specification Version 3.01', Table 4-22: 'Block Oriented Write Protection Commands' SEND_WRITE_PROT (CMD30) If the card provides write protection features, this command asks the card to send the status of the write protection bits [1]. [1] 32 write protection bits (representing 32 write protect groups starting at the specified address) [...] The last (least significant) bit of the protection bits corresponds to the first addressed group. If the addresses of the last groups are outside the valid range, then the corresponding write protection bits shall be set to 0. Split the if() statement (without changing the behaviour of the code) to better position the description comment. Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210802235524.3417739-2-f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu>
2021-08-02hw/arm/boot: Report error if there is no fw_cfg device in the machinePeter Maydell
If the user provides both a BIOS/firmware image and also a guest kernel filename, arm_setup_firmware_boot() will pass the kernel image to the firmware via the fw_cfg device. However we weren't checking whether there really was a fw_cfg device present, and if there wasn't we would crash. This crash can be provoked with a command line such as qemu-system-aarch64 -M raspi3 -kernel /dev/null -bios /dev/null -display none It is currently only possible on the raspi3 machine, because unless the machine sets info->firmware_loaded we won't call arm_setup_firmware_boot(), and the only machines which set that are: * virt (has a fw-cfg device) * sbsa-ref (checks itself for kernel_filename && firmware_loaded) * raspi3 (crashes) But this is an unfortunate beartrap to leave for future machine model implementors, so we should handle this situation in boot.c. Check in arm_setup_firmware_boot() whether the fw-cfg device exists before trying to load files into it, and if it doesn't exist then exit with a hopefully helpful error message. Because we now handle this check in a machine-agnostic way, we can remove the check from sbsa-ref. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/503 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210726163351.32086-1-peter.maydell@linaro.org
2021-08-02hw/net: e1000e: Don't zero out the VLAN tag in the legacy RX descriptorChristina Wang
In the legacy RX descriptor mode, VLAN tag was saved to d->special by e1000e_build_rx_metadata() in e1000e_write_lgcy_rx_descr(), but it was then zeroed out again at the end of the call, which is wrong. Fixes: c89d416a2b0f ("e1000e: Don't zero out buffer address in rx descriptor") Reported-by: Markus Carlstedt <markus.carlstedt@windriver.com> Signed-off-by: Christina Wang <christina.wang@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net: e1000e: Correct the initial value of VET registerChristina Wang
The initial value of VLAN Ether Type (VET) register is 0x8100, as per the manual and real hardware. While Linux e1000e driver always writes VET register to 0x8100, it is not always the case for everyone. Drivers relying on the reset value of VET won't be able to transmit and receive VLAN frames in QEMU. Unlike e1000 in QEMU, e1000e uses a field 'vet' in "struct E1000Core" to cache the value of VET register, but the cache only gets updated when VET register is written. To always get a consistent VET value no matter VET is written or remains its reset value, drop the 'vet' field and use 'core->mac[VET]' directly. Reported-by: Markus Carlstedt <markus.carlstedt@windriver.com> Signed-off-by: Christina Wang <christina.wang@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net: e1000: Correct the initial value of VET registerChristina Wang
The initial value of VLAN Ether Type (VET) register is 0x8100, as per the manual and real hardware. While Linux e1000 driver always writes VET register to 0x8100, it is not always the case for everyone. Drivers relying on the reset value of VET won't be able to transmit and receive VLAN frames in QEMU. Reported-by: Markus Carlstedt <markus.carlstedt@windriver.com> Signed-off-by: Christina Wang <christina.wang@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net/can: sja1000 fix buff2frame_bas and buff2frame_pel when dlc is out of ↵Pavel Pisa
std CAN 8 bytes Problem reported by openEuler fuzz-sig group. The buff2frame_bas function (hw\net\can\can_sja1000.c) infoleak(qemu5.x~qemu6.x) or stack-overflow(qemu 4.x). Reported-by: Qiang Ning <ningqiang1@huawei.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net/vmxnet3: Do not abort QEMU if guest specified bad queue numbersThomas Huth
QEMU should never terminate unexpectedly just because the guest is doing something wrong like specifying wrong queue numbers. Let's simply refuse to set the device active in this case. Buglink: https://bugs.launchpad.net/qemu/+bug/1890160 Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-07-29Merge remote-tracking branch 'remotes/kraxel/tags/usb-20210729-pull-request' ↵Peter Maydell
into staging usb: fixes for 6.1: usbredir, usb-host for windows, docs. # gpg: Signature made Thu 29 Jul 2021 13:50:32 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20210729-pull-request: docs: Fold usb2.txt passthrough information into usb.rst docs: Fold usb2.txt physical port addressing info into usb.rst docs: Fold usb2.txt USB controller information into usb.rst docs: Incorporate information in usb-storage.txt into rST manual usbredir: fix free call ci: add libusb for windows builds usb-host: wire up timer for windows Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-29usbredir: fix free callGerd Hoffmann
data might point into the middle of a larger buffer, there is a separate free_on_destroy pointer passed into bufp_alloc() to handle that. It is only used in the normal workflow though, not when dropping packets due to the queue being full. Fix that. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/491 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210722072756.647673-1-kraxel@redhat.com>
2021-07-29usb-host: wire up timer for windowsGerd Hoffmann
On windows we can't wait on file descriptors. Poll libusb using a timer instead. Fixes long-standing FIXME. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/431 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20210623085249.1151901-2-kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-07-29ppc/vof: Fix Coverity issuesAlexey Kardashevskiy
Coverity reported issues which are caused by mixing of signed return codes from DTC and unsigned return codes of the client interface. This introduces PROM_ERROR and makes distinction between the error types. This fixes NEGATIVE_RETURNS, OVERRUN issues reported by Coverity. This adds a comment about the return parameters number in the VOF hcall. The reason for such counting is to keep the numbers look the same in vof_client_handle() and the Linux (an OF client). vmc->client_architecture_support() returns target_ulong and we want to propagate this to the client (for example H_MULTI_THREADS_ACTIVE). The VOF path to do_client_architecture_support() needs chopping off the top 32bit but SLOF's H_CAS does not; and either way the return values are either 0 or 32bit negative error code. For now this chops the top 32bits. This makes "claim" fail if the allocated address is above 4GB as the client interface is 32bit. This still allows claiming memory above 4GB as potentially initrd can be put there and the client can read the address from the FDT's "available" property. Fixes: CID 1458139, 1458138, 1458137, 1458133, 1458132 Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-Id: <20210720050726.2737405-1-aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-29i2c/smbus_eeprom: Add feature bit to SPD dataBALATON Zoltan
Add the differential clock input feature bit to the generated SPD data. Most guests don't seem to care but pegasos2 firmware version 1.2 checks for this bit and stops with unsupported module type error if it's not present. Since this feature is likely present on real memory modules add it in the general code rather than patching the generated SPD data in pegasos2 board only. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <19d42ade295d5297aa624a9eb757b8df18cf64d6.1626367844.git.balaton@eik.bme.hu> Acked-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-29ppc/pegasos2: Fix spurious warning with -biosBALATON Zoltan
The -append option is currently not compatible with -bios (as we don't yet emulate nvram so we can only put it in the environment with VOF). Therefore a warning is printed if -append is used with -bios but because the default value of kernel_cmdline seems to be an empty string instead of NULL this warning was printed even without -append when -bios is used. Only print warning if -append is given. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <483ac599a1407b766179aaea2794aed60cc09f53.1626367844.git.balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-27Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210727' into staging target-arm queue: * hw/arm/smmuv3: Check 31st bit to see if CD is valid * qemu-options.hx: Fix formatting of -machine memory-backend option * hw: aspeed_gpio: Fix memory size * hw/arm/nseries: Display hexadecimal value with '0x' prefix * Add sve-default-vector-length cpu property * docs: Update path that mentions deprecated.rst * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts * target/arm: Report M-profile alignment faults correctly to the guest * target/arm: Add missing 'return's after calling v7m_exception_taken() * target/arm: Enforce that M-profile SP low 2 bits are always zero # gpg: Signature made Tue 27 Jul 2021 11:46:17 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210727: hw: aspeed_gpio: Fix memory size hw/arm/nseries: Display hexadecimal value with '0x' prefix target/arm: Add sve-default-vector-length cpu property target/arm: Export aarch64_sve_zcr_get_valid_len target/arm: Correctly bound length in sve_zcr_get_valid_len docs: Update path that mentions deprecated.rst hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts target/arm: Report M-profile alignment faults correctly to the guest target/arm: Add missing 'return's after calling v7m_exception_taken() target/arm: Enforce that M-profile SP low 2 bits are always zero qemu-options.hx: Fix formatting of -machine memory-backend option hw/arm/smmuv3: Check 31st bit to see if CD is valid Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-27Merge remote-tracking branch 'remotes/nvme/tags/nvme-next-pull-request' into ↵Peter Maydell
staging hw/nvme fixes * new PMR test (Gollu Appalanaidu) * pmr/sgl mapping fix (Padmakar Kalghatgi) * hotplug fixes (me) * mmio out-of-bound read fix (me) * big-endian host fixes (me) # gpg: Signature made Mon 26 Jul 2021 20:18:12 BST # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * remotes/nvme/tags/nvme-next-pull-request: tests/qtest/nvme-test: add mmio read test hw/nvme: fix mmio read hw/nvme: fix out-of-bounds reads hw/nvme: use symbolic names for registers hw/nvme: split pmrmsc register into upper and lower hw/nvme: fix controller hot unplugging tests/qtest/nvme-test: add persistent memory region test hw/nvme: error handling for too many mappings hw/nvme: unregister controller with subsystem at exit hw/nvme: mark nvme-subsys non-hotpluggable hw/nvme: remove NvmeCtrl parameter from ns setup/check functions Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-27hw: aspeed_gpio: Fix memory sizeJoel Stanley
The macro used to calculate the maximum memory size of the MMIO region had a mistake, causing all GPIO models to create a mapping of 0x9D8. The intent was to have it be 0x9D8 - 0x800. This extra size doesn't matter on ast2400 and ast2500, which have a 4KB region set aside for the GPIO controller. On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the regions would overlap. Worse was the 1.8V controller would map over the top of the following peripheral, which happens to be the RTC. The mmio region used by each device is a maximum of 2KB, so avoid the calculations and hard code this as the maximum. Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation") Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 20210713065854.134634-2-joel@jms.id.au [PMM: fix autocorrect error in commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-27hw/arm/nseries: Display hexadecimal value with '0x' prefixPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210726150953.1218690-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-27hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NSPeter Maydell
In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if the register is accessed NonSecure and the highest priority pending enabled exception (that would be returned in the VECTPENDING field) targets Secure, then the VECTPENDING field must read 1 rather than the exception number of the pending exception. Implement this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
2021-07-27hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDINGPeter Maydell
The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of the register. We were incorrectly masking it to 8 bits, so it would report the wrong value if the pending exception was greater than 256. Fix the bug. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
2021-07-27hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interruptsPeter Maydell
The ISCR.ISRPENDING bit is set when an external interrupt is pending. This is true whether that external interrupt is enabled or not. This means that we can't use 's->vectpending == 0' as a shortcut to "ISRPENDING is zero", because s->vectpending indicates only the highest priority pending enabled interrupt. Remove the incorrect optimization so that if there is no pending enabled interrupt we fall through to scanning through the whole interrupt array. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
2021-07-27hw/arm/smmuv3: Check 31st bit to see if CD is validJoe Komlodi
The bit to see if a CD is valid is the last bit of the first word of the CD. Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com> Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-26hw/nvme: fix mmio readKlaus Jensen
The new PMR test unearthed a long-standing issue with MMIO reads on big-endian hosts. Fix this by unconditionally storing all controller registers in little endian. Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-26hw/nvme: fix out-of-bounds readsKlaus Jensen
Peter noticed that mmio access may read into the NvmeParams member in the NvmeCtrl struct. Fix the bounds check. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-26hw/nvme: use symbolic names for registersKlaus Jensen
Add the NvmeBarRegs enum and use these instead of explicit register offsets. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-07-26hw/nvme: split pmrmsc register into upper and lowerKlaus Jensen
The specification uses a set of 32 bit PMRMSCL and PMRMSCU registers to make up the 64 bit logical PMRMSC register. Make it so. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-07-26hw/nvme: fix controller hot unpluggingKlaus Jensen
Prior to this patch the nvme-ns devices are always children of the NvmeBus owned by the NvmeCtrl. This causes the namespaces to be unrealized when the parent device is removed. However, when subsystems are involved, this is not what we want since the namespaces may be attached to other controllers as well. This patch adds an additional NvmeBus on the subsystem device. When nvme-ns devices are realized, if the parent controller device is linked to a subsystem, the parent bus is set to the subsystem one instead. This makes sure that namespaces are kept alive and not unrealized. Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2021-07-26hw/nvme: error handling for too many mappingsPadmakar Kalghatgi
If the number of PRP/SGL mappings exceed 1024, reads and writes will fail because of an internal QEMU limitation of max 1024 vectors. Signed-off-by: Padmakar Kalghatgi <p.kalghatgi@samsung.com> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> [k.jensen: changed the error message to be more generic] Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-11 21:07:32 +0000