aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2018-01-25hw/intc/arm_gic: Fix group priority computation for group 1 IRQsLuc MICHEL
When determining the group priority of a group 1 IRQ, if C_CTRL.CBPR is 0, the non-secure BPR value is used. However, this value must be incremented by one so that it matches the secure world number of implemented priority bits (NS world has one less priority bit compared to the Secure world). Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Message-id: 20180119145756.7629-5-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: add assert, as the gicv3 code has] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25hw/intc/arm_gic: Fix C_RPR value on idle priorityLuc MICHEL
When there is no active interrupts in the GIC, a read to the C_RPR register should return the value of the "Idle priority", which is either the maximum value an IRQ priority field can be set to, or 0xff. Since the QEMU GIC model implements all the 8 priority bits, the Idle priority is 0xff. Internally, when there is no active interrupt, the running priority value is 0x100. The gic_get_running_priority function returns an uint8_t and thus, truncate this value to 0x00 when returning it. This is wrong since a value of 0x00 correspond to the maximum possible priority. This commit fixes the returned value when the internal value is 0x100. Note that it is correct for the Non-Secure view to return 0xff even though from the NS world point of view, only 7 priority bits are implemented. The specification states that the Idle priority can be 0xff even when not all the 8 priority bits are implemented. This has been verified against a real GICv2 hardware on a Xilinx ZynqMP based board. Regarding the ARM11MPCore version of the GIC, the specification is not clear on that point, so this commit does not alter its behavior. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Message-id: 20180119145756.7629-4-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and ↵Luc MICHEL
pending" In the GIC, when an IRQ is acknowledged, its state goes from "pending" to: - "active" if the corresponding IRQ pin has been de-asserted - "active and pending" otherwise. The GICv2 manual states that when a IRQ becomes active (or active and pending), the GIC should either signal another (higher priority) IRQ to the CPU if there is one, or de-assert the CPU IRQ pin. The current implementation of the GIC in QEMU does not check if the IRQ is already active when looking for pending interrupts with sufficient priority in gic_update(). This can lead to signaling an interrupt that is already active. This usually happens when splitting priority drop and interrupt deactivation. On priority drop, the IRQ stays active until deactivation. If it becomes pending again, chances are that it will be incorrectly selected as best_irq in gic_update(). This commit fixes this by checking if the IRQ is not already active when looking for best_irq in gic_update(). Note that regarding the ARM11MPCore GIC version, the corresponding manual is not clear on that point, but it has has no priority drop/interrupt deactivation separation, so this case should not happen. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Message-id: 20180119145756.7629-3-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25i.MX: Fix FEC/ENET receive funtionsJean-Christophe Dubois
The actual imx_eth_enable_rx() function is buggy. It updates s->regs[ENET_RDAR] after calling qemu_flush_queued_packets(). qemu_flush_queued_packets() is going to call imx_XXX_receive() which itself is going to call imx_eth_enable_rx(). By updating s->regs[ENET_RDAR] after calling qemu_flush_queued_packets() we end up updating the register with an outdated value which might lead to disabling the receive function in the i.MX FEC/ENET device. This patch change the place where the register update is done so that the register value stays up to date and the receive function can keep running. Reported-by: Fyleo <fyleo45@gmail.com> Tested-by: Fyleo <fyleo45@gmail.com> Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: 20180113113445.2705-1-jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com> Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-2.12-pull-request' into staging # gpg: Signature made Tue 23 Jan 2018 14:47:41 GMT # gpg: using RSA key 0xF30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-2.12-pull-request: linux-user: implement renameat2 page_unprotect(): handle calls to pages that are PAGE_WRITE linux-user: Propagate siginfo_t through to handle_cpu_signal() linux-user: remove nmi.c and fw-path-provider.c linux-user: Add getcpu() support linux-user: Add AT_SECURE auxval linux-user: Fix sched_get/setaffinity conversion linux-user/mmap.c: Avoid choosing NULL as start address linux-user: Translate flags argument to dup3 syscall linux-user: Don't use CMSG_ALIGN(sizeof struct cmsghdr) linux-user: Fix length calculations in host_to_target_cmsg() linux-user: wrap fork() in a start/end exclusive section linux-user: Fix locking order in fork_start() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25vga: check the validation of memory addr when draw textlinzhecheng
Start a vm with qemu-kvm -enable-kvm -vnc :66 -smp 1 -m 1024 -hda redhat_5.11.qcow2 -device pcnet -vga cirrus, then use VNC client to connect to VM, and excute the code below in guest OS will lead to qemu crash: int main() { iopl(3); srand(time(NULL)); int a,b; while(1){ a = rand()%0x100; b = 0x3c0 + (rand()%0x20); outb(a,b); } return 0; } The above code is writing the registers of VGA randomly. We can write VGA CRT controller registers index 0x0C or 0x0D (which is the start address register) to modify the the display memory address of the upper left pixel or character of the screen. The address may be out of the range of vga ram. So we should check the validation of memory address when reading or writing it to avoid segfault. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20180111132724.13744-1-linzhecheng@huawei.com Fixes: CVE-2018-5683 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-24Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches # gpg: Signature made Tue 23 Jan 2018 12:38:36 GMT # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (29 commits) iotests: Disable some tests for compat=0.10 iotests: Split 177 into two parts for compat=0.10 iotests: Make 059 pass on machines with little RAM iotests: Filter compat-dependent info in 198 iotests: Make 191 work with qcow2 options iotests: Make 184 image-less iotests: Make 089 compatible with compat=0.10 iotests: Fix 067 for compat=0.10 iotests: Fix 059's reference output iotests: Fix 051 for compat=0.10 iotests: Fix 020 for vmdk iotests: Skip 103 for refcount_bits=1 iotests: Forbid 020 for non-file protocols iotests: Drop format-specific in _filter_img_info iotests: Fix _img_info for backslashes block/vmdk: Add blkdebug events block/qcow: Add blkdebug events qcow2: No persistent dirty bitmaps for compat=0.10 block/vmdk: Fix , instead of ; at end of line qemu-iotests: Fix locking issue in 102 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-24Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio: quick fix Fixes a regression in virtio that's causing issues for many people. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 24 Jan 2018 17:20:24 GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: Revert "qemu: add a cleanup callback function to EventNotifier" Revert "virtio: postpone the execution of event_notifier_cleanup function" Revert "virtio: improve virtio devices initialization time" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-24sabre: convert from SABRE_DPRINTF macro to trace-eventsMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Michael S. Tsirkin <mst@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> [for addition of trace-events to hw/pci-host] Acked-by: Michael S. Tsirkin <mst@redhat.com>
2018-01-24apb: rename apb.c to sabre.cMark Cave-Ayland
This is the final stage in correcting the naming convention with respect to sabre, APB and PBM. It is effectively a file rename from apb.c to sabre.c along with touching up a few constants to remove the remaining references to APB. Note that as part of the rename process the configuration variable CONFIG_PCI_APB is changed to CONFIG_PCI_SABRE. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24sun4u: rename apb variables and constantsMark Cave-Ayland
In order to reflect the previous change of TYPE_APB to TYPE_SABRE, update the corresponding variable names to keep the terminology consistent. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: rename QOM type from TYPE_APB to TYPE_SABREMark Cave-Ayland
Similarly rename the corresponding APBState typedef to SabreState. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: QOMify sabre PCI host bridgeMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: change pbm_pci_host prefix functions to use sabre_pci prefixMark Cave-Ayland
This is the proper name for the PBM host bridge as referenced in the Sun documentation. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: rename APB functions to use sabre prefixMark Cave-Ayland
As hinted in the comment at the top of the file, the naming convention for the APB types/QOM functions isn't correct. As a starting point we can at least rename the APB type and related functions to improve the readability of apb.c. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24simba: rename PBMPCIBridge and QOM types to reflect simba namingMark Cave-Ayland
Here we rename PBMPCIBridge to SimbaPCIBridge and the QOM type from TYPE_PBM_PCI_BRIDGE to TYPE_SIMBA_PCI_BRIDGE in improve the clarity of the device name. Also touch up the relevant spots in apb.c and various other function names as appropriate. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24apb: split simba PCI bridge into hw/pci-bridge/simba.cMark Cave-Ayland
Move the QOM type and macros into a new include/hw/pci-bridge/simba.h file, and add a new CONFIG_SIMBA Makefile.objs variable which is enabled for sparc64-softmmu builds only. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Michael S. Tsirkin <mst@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>
2018-01-24sparc/leon3 irqmp: fix IRQ software ackJean-Christophe Dubois
With the LEON3 IRQ controller IRQs can be acknowledged 2 ways: * Explicitly by software writing to the CLEAR_OFFSET register * Implicitly when the procesor is done running the trap handler attached to the IRQ. The actual IRQMP code only allows the implicit processor triggered IRQ ack. If software write explicitly to the CLEAR_OFFSET register, this will clear the pending bit in the register value but this will not lower the ongoing raised IRQ with the processor. The IRQ will be kept raised to the LEON processor until the related trap handler is run and the processor implicitly ack the interrupt. So with the actual IRQMP code trap handler have to be run even if the software has already done its job by clearing the pending bit. This feature has been tested on another LEON3 simulator (tsim_leon3 from Gaisler) and it turns out that the Qemu implementation is not equivalent to the tsim one. In tsim, if software does clear a pending interrupt before the related interrupt handler is triggered the said interrupt handler will not be called. This patch brings the Qemu IRQMP implementation in line with the tsim implementation by allowing IRQ to be acknowledged by software only. Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Fabien Chouteau <chouteau@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2018-01-24Revert "virtio: postpone the execution of event_notifier_cleanup function"Michael S. Tsirkin
This reverts commit 4fe6d78b2e241f41208dfb07605aace4becfc747 as it is reported to break cleanup and migration. Cc: Gal Hammer <ghammer@redhat.com> Cc: Sitong Liu <siliu@redhat.com> Cc: Xiaoling Gao <xiagao@redhat.com> Suggested-by: Greg Kurz <groug@kaod.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com> Reported-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
2018-01-24Revert "virtio: improve virtio devices initialization time"Michael S. Tsirkin
This reverts commit 6f0bb230722931d17fb284eee8efd40b9d653822. This reverts commit f87d72f5c5bff0837d409a56bd34f439a90119ca as that is reported to break cleanup and migration. Cc: Gal Hammer <ghammer@redhat.com> Cc: Sitong Liu <siliu@redhat.com> Cc: Xiaoling Gao <xiagao@redhat.com> Suggested-by: Greg Kurz <groug@kaod.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com> Reported-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
2018-01-24Merge remote-tracking branch 'remotes/xtensa/tags/20180122-xtensa' into stagingPeter Maydell
target/xtensa updates: - make mini-bootloader independent of the initial CPU state; - add noMMU XTFPGA variants; - add two noMMU cores: de212 and sample_controller; - fix issues reported by coverity against xtensa translator and disassembler. # gpg: Signature made Mon 22 Jan 2018 20:00:01 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20180122-xtensa: target/xtensa: disas/xtensa: fix coverity warnings target/xtensa: add sample_controller core target/xtensa: allow different default CPU for MMU/noMMU target/xtensa: add de212 core hw/xtensa/xtfpga: support noMMU cores hw/xtensa/xtfpga: extract flash configuration hw/xtensa: extract xtensa_create_memory_regions target/xtensa: fix default sysrom/sysram addresses hw/xtensa/xtfpga: clean up function/structure names hw/xtensa/xtfpga: rewrite mini bootloader Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-23linux-user: remove nmi.c and fw-path-provider.cLaurent Vivier
linux-user binaries don't need firmware and NMI, so don't add them in this case, move QDEV firmware functions to qdev-fw.c Signed-off-by: Laurent Vivier <laurent@vivier.eu> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20171103193802.11876-1-laurent@vivier.eu>
2018-01-23Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180122' into stagingPeter Maydell
Various fixes/improvements, and support for the new 81/82 facility bits. # gpg: Signature made Mon 22 Jan 2018 11:54:46 GMT # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180122: s390x/kvm: provide stfle.81 s390x/kvm: Handle bpb feature linux-headers: update s390x/tcg: fixup TEST PROTECTION s390x: fix storage attributes migration for non-small guests hw/s390x: Replace fprintf(stderr, "*\n" with qemu_log_mask() s390x/sclp: fix missing be conversion s390x/tcg: implement TEST PROTECTION s390x/sclp: fixup highest CPU address Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-23hw/block: Fix pin-based interrupt behaviour of NVMeHikaru Nishida
Pin-based interrupt of NVMe controller did not work properly because using an obsolated function pci_irq_pulse(). To fix this, change to use pci_irq_assert() / pci_irq_deassert() instead of pci_irq_pulse(). Signed-off-by: Hikaru Nishida <hikarupsp@gmail.com> Reviewed-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-01-23Merge remote-tracking branch 'remotes/huth/tags/pull-request-2018-01-22' ↵Peter Maydell
into staging Pull request for various patches that have been reviewed and laying on the mailing list for a while, but apparently no maintainer feels really responsible for picking up. # gpg: Signature made Mon 22 Jan 2018 11:10:16 GMT # gpg: using RSA key 0x2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth/tags/pull-request-2018-01-22: hw/isa: Replace fprintf(stderr, "*\n" with error_report() hw/ipmi: Replace fprintf(stderr, "*\n" with error_report() hw/bt: Replace fprintf(stderr, "*\n" with error_report() Fixes after renaming __FUNCTION__ to __func__ Replace all occurances of __FUNCTION__ with __func__ tests/cpu-plug-test: Test CPU hot-plugging on s390x tests/cpu-plug-test: Check CPU hot-plugging on ppc64, too tests/cpu-plug-test: Check the CPU hot-plugging with device_add, too tests: Rename pc-cpu-test.c to cpu-plug-test.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-22target/xtensa: allow different default CPU for MMU/noMMUMax Filippov
Define default core for noMMU configurations and use that core as machine default with noMMU XTFPGA machines. This is done to avoid offering non-working configuration (MMU core on a noMMU machine) as a default. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-01-22Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.12-20180121' ↵Peter Maydell
into staging ppc patch queue 2018-01-21 This request supersedes the one from 2018-01-19. The only difference is that the patch deprecating ppcemb-softmmu, and thereby creating many annying warnings from make check has been removed. Highlights are: * Significant TCG speedup by optimizing cmp generation * Fix a regression caused by recent change to set compat mode on hotplugged cpus * Cleanup of default configs * Some implementation of msgsnd/msgrcv instructions for server chips # gpg: Signature made Sun 21 Jan 2018 05:30:54 GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.12-20180121: target/ppc/spapr_caps: Add macro to generate spapr_caps migration vmstate target/ppc: add support for hypervisor doorbells on book3s CPUs sii3112: Add explicit type casts to avoid unintended sign extension sm501: Add missing break to case target-ppc: optimize cmp translation spapr: fix device tree properties when using compatibility mode spapr: drop duplicate variable in spapr_core_plug() target/ppc: msgsnd and msgclr instructions need hypervisor privilege target/ppc: fix doorbell and hypervisor doorbell definitions hw/ppc/Makefile: Add a way to disable the PPC4xx boards default-configs/ppc-softmmu: Restructure the switches according to the machines default-configs/ppc64-softmmu: Include 32-bit configs instead of copying them Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-22s390x: fix storage attributes migration for non-small guestsClaudio Imbrenda
Fix storage attribute migration so that it does not fail for guests with more than a few GB of RAM. With such guests, the index in the buffer would go out of bounds, usually by large amounts, thus receiving -EFAULT from the kernel. Migration itself would be successful, but storage attributes would then not be migrated completely. This patch fixes the out of bounds access, and thus migration of all storage attributes when the guest have large amounts of memory. Cc: qemu-stable@nongnu.org Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com> Fixes: 903fd80b03243476 ("s390x/migration: Storage attributes device") Message-Id: <1516297904-18188-1-git-send-email-imbrenda@linux.vnet.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-22hw/s390x: Replace fprintf(stderr, "*\n" with qemu_log_mask()Alistair Francis
One fprintf(stderr, was manually converted to a qemu_log_mask(LOG_GUEST_ERROR, Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <3f49c0ff601f27534d4536c87c00d01c233e067f.1513790495.git.alistair.francis@xilinx.com> [CH: tweaked commit message] Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-22s390x/sclp: fix missing be conversionDavid Hildenbrand
Linux crashes right now if maxmem > mem is specified on the command line. On s390x, the guest can hotplug memory itself right now - very weird - and e.g. Fedora 27 will simply add all memory it can when booting. So now, we have at least the same behavior on TCG and KVM. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20171218224616.21030-3-david@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-22s390x/sclp: fixup highest CPU addressChristian Borntraeger
The highest cpu address is not the same as max_cpus. max_cpus counts from 1 while the cpu address starts at 0. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Jason J. Herne <jjherne@linux.vnet.ibm.com> Message-Id: <20171219082807.84494-1-borntraeger@de.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-22hw/isa: Replace fprintf(stderr, "*\n" with error_report()Alistair Francis
Replace a large number of the fprintf(stderr, "*\n" calls with error_report(). The functions were renamed with these commands and then compiler issues where manually fixed. find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + Some lines where then manually tweaked to pass checkpatch. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-01-22hw/ipmi: Replace fprintf(stderr, "*\n" with error_report()Alistair Francis
Replace a large number of the fprintf(stderr, "*\n" calls with error_report(). The functions were renamed with these commands and then compiler issues where manually fixed. find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + Some lines where then manually tweaked to pass checkpatch. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-01-22hw/bt: Replace fprintf(stderr, "*\n" with error_report()Alistair Francis
Replace a large number of the fprintf(stderr, "*\n" calls with error_report(). The functions were renamed with these commands and then compiler issues where manually fixed. find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N;N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + find ./* -type f -exec sed -i \ 'N; {s|fprintf(stderr, "\(.*\)\\n"\(.*\));|error_report("\1"\2);|Ig}' \ {} + Some lines where then manually tweaked to pass checkpatch. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Thomas Huth <thuth@redhat.com> [THH: Changed one missing fprintf into an error_report, too] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-01-22Fixes after renaming __FUNCTION__ to __func__Alistair Francis
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Cc: Eric Blake <eblake@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-01-22Replace all occurances of __FUNCTION__ with __func__Alistair Francis
Replace all occurs of __FUNCTION__ except for the check in checkpatch with the non GCC specific __func__. One line in hcd-musb.c was manually tweaked to pass checkpatch. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> [THH: Removed hunks related to pxa2xx_mmci.c (fixed already)] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-01-20target/ppc/spapr_caps: Add macro to generate spapr_caps migration vmstateSuraj Jitindar Singh
The vmstate description and the contained needed function for migration of spapr_caps is the same for each cap, with the name of the cap substituted. As such introduce a macro to allow for easier generation of these. Convert the three existing spapr_caps (htm, vsx, and dfp) to use this macro. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20sii3112: Add explicit type casts to avoid unintended sign extensionBALATON Zoltan
Noticed by Coverity Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20sm501: Add missing break to caseBALATON Zoltan
Noticed by Coverity, forgotten in 5690d9ece Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20spapr: fix device tree properties when using compatibility modeGreg Kurz
Commit 51f84465dd98 changed the compatility mode setting logic: - machine reset only sets compatibility mode for the boot CPU - compatibility mode is set for other CPUs when they are put online by the guest with the "start-cpu" RTAS call This causes a regression for machines started with max-compat-cpu: the device tree nodes related to secondary CPU cores contain wrong "cpu-version" and "ibm,pa-features" values, as shown below. Guest started on a POWER8 host with: -smp cores=2 -machine pseries,max-cpu-compat=compat7 ibm,pa-features = [18 00 f6 3f c7 c0 80 f0 80 00 00 00 00 00 00 00 00 00 80 00 80 00 80 00 00 00]; cpu-version = <0x4d0200>; ^^^ second CPU core ibm,pa-features = <0x600f63f 0xc70080c0>; cpu-version = <0xf000003>; ^^^ boot CPU core The second core is advertised in raw POWER8 mode. This happens because CAS assumes all CPUs to have the same compatibility mode. Since the boot CPU already has the requested compatibility mode, the CAS code does not set it for the secondary one, and exposes the bogus device tree properties in in the CAS response to the guest. A similar situation is observed when hot-plugging a CPU core. The related device tree properties are generated and exposed to guest with the "ibm,configure-connector" RTAS before "start-cpu" is called. The CPU core is advertised to the guest in raw mode as well. It both cases, it boils down to the fact that "start-cpu" happens too late. This can be fixed globally by propagating the compatibility mode of the boot CPU to the other CPUs during reset. For this to work, the compatibility mode of the boot CPU must be set before the machine code actually resets all CPUs. It is not needed to set the compatibility mode in "start-cpu" anymore, so the code is dropped. Fixes: 51f84465dd98 Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20spapr: drop duplicate variable in spapr_core_plug()Greg Kurz
A variable is already defined at the begining of the function to hold a pointer to the CPU core object: sPAPRCPUCore *core = SPAPR_CPU_CORE(OBJECT(dev)); No need to define it again in the pre-2.10 compatibility code snipplet. Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20hw/ppc/Makefile: Add a way to disable the PPC4xx boardsThomas Huth
We've got the config switch CONFIG_PPC4XX, so we should use it in the Makefile accordingly and only include the PPC4xx boards if this switch has been enabled. (Note: Unfortunately, the files ppc4xx_devs.c and ppc405_uc.c still have to be included in the build anyway to fulfil some complicated linker dependencies ... so these are subject to a more thourough clean-up later) Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-19hw/ide: Remove duplicated definitions from ahci_internal.hJohn Snow
The same definitions can also be found in include/hw/ide/ahci.h so let's remove these #defines from ahci_internal.h. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1512457825-3847-1-git-send-email-thuth@redhat.com [Maintainer edit: publicize object names, privatize object macros.] Signed-off-by: John Snow <jsnow@redhat.com>
2018-01-19ide: abort TRIM operation for invalid rangeAnton Nefedov
ATA8-ACS3, 7.9 DATA SET MANAGEMENT - 06h, DMA 7.9.5 Error Outputs If the Trim bit is set to one and: a) the device detects an invalid LBA Range Entry; or b) count is greater than IDENTIFY DEVICE data word 105 (see 7.16.7.55), then the device shall return command aborted. A device may trim one or more LBA Range Entries before it returns command aborted. See table 209. This check is not in the common ide_dma_cb() as the range for TRIM is harder to reach: it is not in LBA/count registers and the buffer has to be parsed first. Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com> Message-id: 1512735034-35327-4-git-send-email-anton.nefedov@virtuozzo.com Signed-off-by: John Snow <jsnow@redhat.com>
2018-01-19ide: move ide_sect_range_ok() upAnton Nefedov
to use it without a forward declaration in the commit to follow Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com> Message-id: 1512735034-35327-3-git-send-email-anton.nefedov@virtuozzo.com Signed-off-by: John Snow <jsnow@redhat.com>
2018-01-19ide: pass IDEState to trim AIO callbackAnton Nefedov
It will be needed to handle invalid requests Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com> Message-id: 1512735034-35327-2-git-send-email-anton.nefedov@virtuozzo.com Signed-off-by: John Snow <jsnow@redhat.com>
2018-01-19fw_cfg: fix memory corruption when all fw_cfg slots are usedMarcel Apfelbaum
When all the fw_cfg slots are used, a write is made outside the bounds of the fw_cfg files array as part of the sort algorithm. Fix it by avoiding an unnecessary array element move. Fix also an assert while at it. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20180108215007.46471-1-marcel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-19possible_cpus: add CPUArchId::type fieldIgor Mammedov
Remove dependency of possible_cpus on 1st CPU instance, which decouples configuration data from CPU instances that are created using that data. Also later it would be used for enabling early cpu to numa node configuration at runtime qmp_query_hotpluggable_cpus() should provide a list of available cpu slots at early stage, before machine_init() is called and the 1st cpu is created, so that mgmt might be able to call it and use output to set numa mapping. Use MachineClass::possible_cpu_arch_ids() callback to set cpu type info, along with the rest of possible cpu properties, to let machine define which cpu type* will be used. * for SPAPR it will be a spapr core type and for ARM/s390x/x86 a respective descendant of CPUClass. Move parse_numa_opts() in vl.c after cpu_model is parsed into cpu_type so that possible_cpu_arch_ids() would know which cpu_type to use during layout initialization. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <1515597770-268979-1-git-send-email-imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-19nvdimm: add 'unarmed' optionHaozhong Zhang
Currently the only vNVDIMM backend can guarantee the guest write persistence is device DAX on Linux, because no host-side kernel cache is involved in the guest access to it. The approach to detect whether the backend is device DAX needs to access sysfs, which may not work with SELinux. Instead, we add the 'unarmed' option to device 'nvdimm', so that users or management utils, which have enough knowledge about the backend, can control the unarmed flag in guest ACPI NFIT via this option. The guest Linux NVDIMM driver, for example, will mark the corresponding vNVDIMM device read-only if the unarmed flag in guest NFIT is set. The default value of 'unarmed' option is 'off' in order to keep the backwards compatibility. Signed-off-by: Haozhong Zhang <haozhong.zhang@intel.com> Message-Id: <20171211072806.2812-4-haozhong.zhang@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-19nvdimm: add a macro for property "label-size"Haozhong Zhang
Signed-off-by: Haozhong Zhang <haozhong.zhang@intel.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20171211072806.2812-3-haozhong.zhang@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>