aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2021-07-20hw/mips: Add dependency MIPS_CPS -> MIPS_ITUPhilippe Mathieu-Daudé
The Inter-Thread Communication Unit (ITU, introduced in commit 34fa7e83e11) is part of the Coherent Processing System (CPS), as describe in commit 408294352ad: Make ITU available in the system if CPU supports multithreading and is part of CPS. Have CPS select ITU in Kconfig to avoid the following build failure: /usr/bin/ld: libqemu-mips64el-softmmu.fa.p/hw_mips_cps.c.o: in function `mips_cps_realize': hw/mips/cps.c:104: undefined reference to `mips_itu_get_tag_region' Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20190311005618.19007-5-philmd@redhat.com>
2021-07-19hw/ide: Fix crash when plugging a piix3-ide device into the x-remote machineThomas Huth
QEMU currently crashes when the user tries to do something like: qemu-system-x86_64 -M x-remote -device piix3-ide This happens because the "isabus" variable is not initialized with the x-remote machine yet. Add a proper check for this condition and propagate the error to the caller, so we can fail there gracefully. Message-Id: <20210416125256.2039734-1-thuth@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-07-19hw/net/net_tx_pkt: Fix crash detected by fuzzerThomas Huth
QEMU currently crashes when it's started like this: cat << EOF | ./qemu-system-i386 -device vmxnet3 -nodefaults -qtest stdio outl 0xcf8 0x80001014 outl 0xcfc 0xe0001000 outl 0xcf8 0x80001018 outl 0xcf8 0x80001004 outw 0xcfc 0x7 outl 0xcf8 0x80001083 write 0x0 0x1 0xe1 write 0x1 0x1 0xfe write 0x2 0x1 0xbe write 0x3 0x1 0xba writeq 0xe0001020 0xefefff5ecafe0000 writeq 0xe0001020 0xffff5e5ccafe0002 EOF It hits this assertion: qemu-system-i386: ../qemu/hw/net/net_tx_pkt.c:453: net_tx_pkt_reset: Assertion `pkt->raw' failed. This happens because net_tx_pkt_init() is called with max_frags == 0 and thus the allocation p->raw = g_new(struct iovec, max_frags); results in a NULL pointer that causes the assert(pkt->raw); in net_tx_pkt_reset() to fail later. To fix this issue we can check that max_raw_frags was not zero before asserting that pkt->raw is a non-NULL pointer. Buglink: https://bugs.launchpad.net/qemu/+bug/1890157 Message-Id: <20210715193219.1132571-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Pankaj Gupta <pankaj.gupta@ionos.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-07-19hw/net/vmxnet3: Do not abort if the guest is trying to use an invalid TX queueThomas Huth
QEMU should never abort just because the guest is doing something odd. Let's simply log the error and ignore the bad transmit queue instead. Buglink: https://bugs.launchpad.net/qemu/+bug/1926111 Message-Id: <20210715103755.1035566-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-07-16Merge remote-tracking branch 'remotes/mst/tags/for_upstream3' into stagingPeter Maydell
pc,pci,virtio: lots of new features Lots of last minute stuff. vhost-user-i2c. vhost-vsock SOCK_SEQPACKET support. IOMMU bypass. ACPI based pci hotplug. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 16 Jul 2021 16:11:27 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream3: vhost-vsock: SOCK_SEQPACKET feature bit support docs: Add documentation for iommu bypass hw/i386/acpi-build: Add IVRS support to bypass iommu hw/i386/acpi-build: Add DMAR support to bypass iommu hw/arm/virt-acpi-build: Add IORT support to bypass SMMUv3 hw/pci: Add pci_bus_range() to get PCI bus number range hw/i386: Add a default_bus_bypass_iommu pc machine option hw/arm/virt: Add default_bus_bypass_iommu machine option hw/pxb: Add a bypass iommu property hw/pci/pci_host: Allow PCI host to bypass iommu docs: Add '-device intel-iommu' entry hw/virtio: add vhost-user-i2c-pci boilerplate hw/virtio: add boilerplate for vhost-user-i2c device bios-tables-test: Update golden binaries hw/acpi/ich9: Set ACPI PCI hot-plug as default on Q35 bios-tables-test: Allow changes in DSDT ACPI tables hw/pci/pcie: Do not set HPC flag if acpihp is used hw/acpi/ich9: Enable ACPI PCI hot-plug hw/i386/acpi-build: Add ACPI PCI hot-plug methods to Q35 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-16vhost-vsock: SOCK_SEQPACKET feature bit supportArseny Krasnov
This adds processing of VIRTIO_VSOCK_F_SEQPACKET features bit. Guest negotiates it with vhost, thus both will know that SOCK_SEQPACKET supported by peer. Signed-off-by: Arseny Krasnov <arseny.krasnov@kaspersky.com> Message-Id: <20210622144747.2949134-1-arseny.krasnov@kaspersky.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/i386/acpi-build: Add IVRS support to bypass iommuXingang Wang
Check bypass_iommu to exclude the devices which will bypass iommu. Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Message-Id: <1625748919-52456-9-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/i386/acpi-build: Add DMAR support to bypass iommuXingang Wang
In DMAR table, the drhd is set to cover all PCI devices when intel_iommu is on. To support bypass iommu feature, we need to walk the PCI bus with bypass_iommu disabled and add explicit scope data in DMAR drhd structure. /mnt/sdb/wxg/qemu-next/qemu/build/x86_64-softmmu/qemu-system-x86_64 \ -machine q35,accel=kvm,default_bus_bypass_iommu=true \ -cpu host \ -m 16G \ -smp 36,sockets=2,cores=18,threads=1 \ -device pxb-pcie,bus_nr=0x10,id=pci.10,bus=pcie.0,addr=0x3 \ -device pxb-pcie,bus_nr=0x20,id=pci.20,bus=pcie.0,addr=0x4,bypass_iommu=true \ -device pcie-root-port,port=0x1,chassis=1,id=pci.11,bus=pci.10,addr=0x0 \ -device pcie-root-port,port=0x2,chassis=2,id=pci.21,bus=pci.20,addr=0x0 \ -device virtio-scsi-pci,id=scsi0,bus=pci.11,addr=0x0 \ -device virtio-scsi-pci,id=scsi1,bus=pci.21,addr=0x0 \ -drive file=/mnt/sdb/wxg/fedora-48g.qcow2,format=qcow2,if=none,id=drive-scsi0-0-0-0,cache=none,aio=native \ -device scsi-hd,bus=scsi1.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1 \ -device intel-iommu \ -nographic \ And we get the guest configuration: ~ lspci -vt -+-[0000:20]---00.0-[21]----00.0 Red Hat, Inc. Virtio SCSI +-[0000:10]---00.0-[11]----00.0 Red Hat, Inc. Virtio SCSI \-[0000:00]-+-00.0 Intel Corporation 82G33/G31/P35/P31 Express DRAM Controller +-01.0 Device 1234:1111 +-02.0 Intel Corporation 82574L Gigabit Network Connection +-03.0 Red Hat, Inc. QEMU PCIe Expander bridge +-04.0 Red Hat, Inc. QEMU PCIe Expander bridge +-1f.0 Intel Corporation 82801IB (ICH9) LPC Interface Controller +-1f.2 Intel Corporation 82801IR/IO/IH (ICH9R/DO/DH) 6 port SATA Controller [AHCI mode] \-1f.3 Intel Corporation 82801I (ICH9 Family) SMBus Controller With bypass_iommu enabled on root bus, the attached devices will bypass iommu: /sys/class/iommu/dmar0 ├── devices │   ├── 0000:10:00.0 -> ../../../../pci0000:10/0000:10:00.0 │   └── 0000:11:00.0 -> ../../../../pci0000:10/0000:10:00.0/0000:11:00.0 Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Message-Id: <1625748919-52456-8-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/arm/virt-acpi-build: Add IORT support to bypass SMMUv3Xingang Wang
When we build IORT table with SMMUv3 and bypass iommu feature enabled, we can no longer setup one map from RC to SMMUv3 covering the whole RIDs. We need to walk the PCI bus and check whether the root bus will bypass iommu, setup RC -> SMMUv3 -> ITS map for RC which will not bypass iommu. When a SMMUv3 node exist, we setup the idmap from SMMUv3 to ITS covering the whole RIDs, and only modify the map from RC to SMMUv3. We build RC -> SMMUv3 -> ITS map for root bus with bypass_iommu disabled, and build idmap from RC to ITS directly for the rest of the whole RID space. For example we run qemu with command line: qemu/build/aarch64-softmmu/qemu-system-aarch64 \ -kernel arch/arm64/boot/Image \ -enable-kvm \ -cpu host \ -m 8G \ -smp 8,sockets=2,cores=4,threads=1 \ -machine virt,kernel_irqchip=on,gic-version=3,iommu=smmuv3,default_bus_bypass_iommu=true \ -drive file=./QEMU_EFI-pflash.raw,if=pflash,format=raw,unit=0,readonly=on \ -device pxb-pcie,bus_nr=0x10,id=pci.10,bus=pcie.0,addr=0x3.0x1 \ -device pxb-pcie,bus_nr=0x20,id=pci.20,bus=pcie.0,addr=0x3.0x2,bypass_iommu=true \ -device pcie-root-port,port=0x20,chassis=1,id=pci.1,bus=pcie.0,addr=0x2 \ -device pcie-root-port,port=0x20,chassis=11,id=pci.11,bus=pci.10,addr=0x1 \ -device pcie-root-port,port=0x20,chassis=21,id=pci.21,bus=pci.20,addr=0x1 \ -device virtio-scsi-pci,id=scsi0,bus=pci.1,addr=0x1 \ -device virtio-scsi-pci,id=scsi1,bus=pci.11,addr=0x1 \ -device virtio-scsi-pci,id=scsi2,bus=pci.21,addr=0x1 \ -initrd /mnt/davinci/wxg/kill-linux/rootfs/mfs.cpio.gz \ -nographic \ -append "rdinit=init console=ttyAMA0 earlycon=pl011,0x9000000 nokaslr" \ And we get guest configuration: -+-[0000:20]---01.0-[21]-- +-[0000:10]---01.0-[11]-- \-[0000:00]-+-00.0 Device 1b36:0008 +-01.0 Device 1af4:1000 \-02.0-[01]-- With bypass_iommu enabled, the attached devices will bypass iommu. /sys/class/iommu/smmu3.0x0000000009050000/ |-- device -> ../../../arm-smmu-v3.0.auto |-- devices | `-- 0000:10:01.0 -> ../../../../../pci0000:10/0000:10:01.0 Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Message-Id: <1625748919-52456-7-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/pci: Add pci_bus_range() to get PCI bus number rangeXingang Wang
This helps to get the min and max bus number of a PCI bus hierarchy. Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-Id: <1625748919-52456-6-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/i386: Add a default_bus_bypass_iommu pc machine optionXingang Wang
Add a default_bus_bypass_iommu pc machine option to enable/disable bypass_iommu for default root bus. The option is disabled by default and can be enabled with: $QEMU -machine q35,default_bus_bypass_iommu=true Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Message-Id: <1625748919-52456-5-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/arm/virt: Add default_bus_bypass_iommu machine optionXingang Wang
Add a default_bus_bypass_iommu machine option to enable/disable bypass_iommu for default root bus. The option is disabled by default and can be enabled with: $QEMU -machine virt,iommu=smmuv3,default_bus_bypass_iommu=true Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Message-Id: <1625748919-52456-4-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/pxb: Add a bypass iommu propertyXingang Wang
Add a bypass_iommu property for pci_expander_bridge, the property is used to indicate whether pxb root bus will bypass iommu. By default the bypass_iommu is disabled, and it can be enabled with: qemu -device pxb-pcie,bus_nr=0x10,addr=0x1,bypass_iommu=true Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-Id: <1625748919-52456-3-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/pci/pci_host: Allow PCI host to bypass iommuXingang Wang
Add a new bypass_iommu property for PCI host and use it to check whether devices attached to the PCI root bus will bypass iommu. In pci_device_iommu_address_space(), check the property and avoid getting iommu address space for devices bypass iommu. Signed-off-by: Xingang Wang <wangxingang5@huawei.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-Id: <1625748919-52456-2-git-send-email-wangxingang5@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/virtio: add vhost-user-i2c-pci boilerplateViresh Kumar
This allows is to instantiate a vhost-user-i2c device as part of a PCI bus. It is mostly boilerplate which looks pretty similar to the vhost-user-fs-pci device. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Message-Id: <8a083eaa57d93feaab12acd1f94b225879212f20.1625806763.git.viresh.kumar@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/virtio: add boilerplate for vhost-user-i2c deviceViresh Kumar
This creates the QEMU side of the vhost-user-i2c device which connects to the remote daemon. It is based of vhost-user-fs code. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Message-Id: <e80591b52fea4b51631818bb92a798a3daf90399.1625806763.git.viresh.kumar@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/acpi/ich9: Set ACPI PCI hot-plug as default on Q35Julia Suvorova
Q35 has three different types of PCI devices hot-plug: PCIe Native, SHPC Native and ACPI hot-plug. This patch changes the default choice for cold-plugged bridges from PCIe Native to ACPI Hot-plug with ability to use SHPC and PCIe Native for hot-plugged bridges. This is a list of the PCIe Native hot-plug issues that led to this change: * no racy behavior during boot (see 110c477c2ed) * no delay during deleting - after the actual power off software must wait at least 1 second before indicating about it. This case is quite important for users, it even has its own bug: https://bugzilla.redhat.com/show_bug.cgi?id=1594168 * no timer-based behavior - in addition to the previous example, the attention button has a 5-second waiting period, during which the operation can be canceled with a second press. While this looks fine for manual button control, automation will result in the need to queue or drop events, and the software receiving events in all sort of unspecified combinations of attention/power indicator states, which is racy and uppredictable. * fixes: * https://bugzilla.redhat.com/show_bug.cgi?id=1752465 * https://bugzilla.redhat.com/show_bug.cgi?id=1690256 To return to PCIe Native hot-plug: -global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=off Known issue: older linux guests need the following flag to allow hotplugged pci express devices to use io: -device pcie-root-port,io-reserve=4096. io is unusual for pci express so this seems minor. We'll fix this by a follow up patch. Signed-off-by: Julia Suvorova <jusual@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20210713004205.775386-6-jusual@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-16hw/pci/pcie: Do not set HPC flag if acpihp is usedJulia Suvorova
Instead of changing the hot-plug type in _OSC register, do not set the 'Hot-Plug Capable' flag. This way guest will choose ACPI hot-plug if it is preferred and leave the option to use SHPC with pcie-pci-bridge. The ability to control hot-plug for each downstream port is retained, while 'hotplug=off' on the port means all hot-plug types are disabled. Signed-off-by: Julia Suvorova <jusual@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20210713004205.775386-4-jusual@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-16hw/acpi/ich9: Enable ACPI PCI hot-plugJulia Suvorova
Add acpi_pcihp to ich9_pm as part of 'acpi-pci-hotplug-with-bridge-support' option. Set default to false. Signed-off-by: Julia Suvorova <jusual@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20210713004205.775386-3-jusual@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-16hw/i386/acpi-build: Add ACPI PCI hot-plug methods to Q35Julia Suvorova
Implement notifications and gpe to support q35 ACPI PCI hot-plug. Use 0xcc4 - 0xcd7 range for 'acpi-pci-hotplug' io ports. Signed-off-by: Julia Suvorova <jusual@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Message-Id: <20210713004205.775386-2-jusual@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-16Merge remote-tracking branch ↵Peter Maydell
'remotes/alistair/tags/pull-riscv-to-apply-20210715' into staging Fourth RISC-V PR for 6.1 release - Code cleanups - Documentation improvements - Hypervisor extension improvements with hideleg and hedeleg - sifive_u fixes - OpenTitan register layout updates - Fix coverity issue # gpg: Signature made Thu 15 Jul 2021 08:14:00 BST # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20210715: hw/riscv/boot: Check the error of fdt_pack() hw/riscv: opentitan: Add the flash alias hw/riscv: opentitan: Add the unimplement rv_core_ibex_peri char: ibex_uart: Update the register layout hw/riscv: sifive_u: Make sure firmware info is 8-byte aligned hw/riscv: sifive_u: Correct the CLINT timebase frequency docs/system: riscv: Update Microchip Icicle Kit for direct kernel boot target/riscv: hardwire bits in hideleg and hedeleg docs/system: riscv: Add documentation for virt machine docs/system: riscv: Fix CLINT name in the sifive_u doc target/riscv: csr: Remove redundant check in fp csr read/write routines target/riscv: pmp: Fix some typos Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-15Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20210714.0' ↵Peter Maydell
into staging VFIO update 2021-07-14 * Coverity fix to discard listener (David Hildenbrand) * MSI-X PBA quirk for BAIDU VFs, additional helper use cases (Cai Huoqing) # gpg: Signature made Wed 14 Jul 2021 22:31:35 BST # gpg: using RSA key 42F6C04E540BD1A99E7B8A90239B9B6E3BB08B22 # gpg: issuer "alex.williamson@redhat.com" # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" [full] # gpg: aka "Alex Williamson <alex@shazbot.org>" [full] # gpg: aka "Alex Williamson <alwillia@redhat.com>" [full] # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" [full] # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-update-20210714.0: vfio/pci: Add pba_offset PCI quirk for BAIDU KUNLUN AI processor vfio/pci: Change to use vfio_pci_is() vfio: Fix CID 1458134 in vfio_register_ram_discard_listener() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-15Merge remote-tracking branch ↵Peter Maydell
'remotes/berrange-gitlab/tags/crypto-and-more-pull-request' into staging Merge crypto updates and misc fixes * Introduce a GNUTLS backend for crypto algorithms * Change crypto library preference gnutls > gcrypt > nettle > built-in * Remove built-in DES impl * Remove XTS mode from built-in AES impl * Fix seccomp rules to allow resource info getters * Fix migration performance test * Use GDateTime in io/ and net/rocker/ code * Improve docs for -smp # gpg: Signature made Wed 14 Jul 2021 15:08:00 BST # gpg: using RSA key DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF # gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [full] # gpg: aka "Daniel P. Berrange <berrange@redhat.com>" [full] # Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF * remotes/berrange-gitlab/tags/crypto-and-more-pull-request: (26 commits) qemu-options: rewrite help for -smp options qemu-options: tweak to show that CPU count is optional qemu-options: re-arrange CPU topology options docs: fix typo s/Intel/AMD/ in CPU model notes tests/migration: fix unix socket migration seccomp: don't block getters for resource control syscalls io: use GDateTime for formatting timestamp for websock headers net/rocker: use GDateTime for formatting timestamp in debug messages crypto: prefer gnutls as the crypto backend if new enough crypto: add gnutls pbkdf provider crypto: add gnutls hmac provider crypto: add gnutls hash provider crypto: add gnutls cipher provider crypto: introduce build system for gnutls crypto backend crypto: flip priority of backends to prefer gcrypt crypto: replace 'des-rfb' cipher with 'des' crypto: delete built-in XTS cipher mode support crypto: delete built-in DES implementation crypto: add crypto tests for single block DES-ECB and DES-CBC crypto: drop custom XTS support in gcrypt driver ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-15hw/riscv/boot: Check the error of fdt_pack()Alistair Francis
Coverity reports that we don't check the error result of fdt_pack(), so let's save the result and assert that it is 0. Fixes: Coverity CID 1458136 Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-id: 07325315b49d5555269f76094e4bc5296e0643b9.1626303527.git.alistair.francis@wdc.com
2021-07-15hw/riscv: opentitan: Add the flash aliasAlistair Francis
OpenTitan has an alias of flash avaliable which is called virtual flash. Add support for that in the QEMU model. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-id: c9cfbd2dd840fd0076877b8ea4d6dcfce60db5e9.1625801868.git.alistair.francis@wdc.com
2021-07-15hw/riscv: opentitan: Add the unimplement rv_core_ibex_periAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-id: ed707782e84118e1b06a32fd79b70fecfb54ff82.1625801868.git.alistair.francis@wdc.com
2021-07-15char: ibex_uart: Update the register layoutAlistair Francis
Update the register layout to match the latest OpenTitan bitstream. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-id: 25c8377d32f3e0f0a1a862c8a5092f8a9e3f9928.1625801868.git.alistair.francis@wdc.com
2021-07-15hw/riscv: sifive_u: Make sure firmware info is 8-byte alignedBin Meng
Currently the firmware dynamic info (fw_dyn) is put right after the reset vector, which is not 8-byte aligned on RV64. OpenSBI fw_dynamic uses ld to read contents from 'struct fw_dynamic_info', which expects fw_dyn to be on the 8-byte boundary, otherwise the misaligned load exception may happen. Fortunately this does not cause any issue on QEMU, as QEMU does support misaligned load. RV32 does not have any issue as it is 4-byte aligned already. Change to make sure it is 8-byte aligned which works for both RV32 and RV64. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210708143319.10441-1-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-07-15hw/riscv: sifive_u: Correct the CLINT timebase frequencyBin Meng
At present the CLINT timebase frequency is set to 10MHz on sifive_u, but on the real hardware the timebase frequency is 1Mhz. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210706102616.1922469-1-bmeng.cn@gmail.com Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2021-07-14hw/i386: Introduce X86_FW_OVMF Kconfig symbolPhilippe Mathieu-Daudé
Introduce the X86_FW_OVMF Kconfig symbol for OVMF-specific code. Move the OVMF-specific code from pc_sysfw.c to pc_sysfw_ovmf.c, adding a pair of stubs. Update MAINTAINERS to reach OVMF maintainers when these new files are modified. This fixes when building the microvm machine standalone: /usr/bin/ld: libqemu-i386-softmmu.fa.p/target_i386_monitor.c.o: in function `qmp_sev_inject_launch_secret': target/i386/monitor.c:749: undefined reference to `pc_system_ovmf_table_find' Fixes: f522cef9b35 ("sev: update sev-inject-launch-secret to make gpa optional") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20210616204328.2611406-22-philmd@redhat.com>
2021-07-14hw/i386/pc: Document pc_system_ovmf_table_findDov Murik
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210701052749.934744-3-dovmurik@linux.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-07-14hw/i386/pc: pc_system_ovmf_table_find: Assert that flash was parsedDov Murik
Add assertion in pc_system_ovmf_table_find that verifies that the flash was indeed previously parsed (looking for the OVMF table) by pc_system_parse_ovmf_flash. Now pc_system_ovmf_table_find distinguishes between "no one called pc_system_parse_ovmf_flash" (which will abort due to assertion failure) and "the flash was parsed but no OVMF table was found, or it is invalid" (which will return false). Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210701052749.934744-2-dovmurik@linux.ibm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-07-14vfio/pci: Add pba_offset PCI quirk for BAIDU KUNLUN AI processorCai Huoqing
Fix pba_offset initialization value for BAIDU KUNLUN Virtual Function device. The KUNLUN hardware returns an incorrect value for the VF PBA offset, and add a quirk to instead return a hardcoded value of 0xb400. Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Link: https://lore.kernel.org/r/20210713093743.942-1-caihuoqing@baidu.com [aw: comment & whitespace tuning] Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2021-07-14vfio/pci: Change to use vfio_pci_is()Cai Huoqing
Make use of vfio_pci_is() helper function. Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Link: https://lore.kernel.org/r/20210713014831.742-1-caihuoqing@baidu.com [aw: commit log wording] Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2021-07-14vfio: Fix CID 1458134 in vfio_register_ram_discard_listener()David Hildenbrand
CID 1458134: Integer handling issues (BAD_SHIFT) In expression "1 << ctz64(container->pgsizes)", left shifting by more than 31 bits has undefined behavior. The shift amount, "ctz64(container->pgsizes)", is 64. Commit 5e3b981c330c ("vfio: Support for RamDiscardManager in the !vIOMMU case") added an assertion that our granularity is at least as big as the page size. Although unlikely, we could have a page size that does not fit into 32 bit. In that case, we'd try shifting by more than 31 bit. Let's use 1ULL instead and make sure we're not shifting by more than 63 bit by asserting that any bit in container->pgsizes is set. Fixes: CID 1458134 Cc: Alex Williamson <alex.williamson@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com> Cc: Peter Xu <peterx@redhat.com> Cc: Auger Eric <eric.auger@redhat.com> Cc: Wei Yang <richard.weiyang@linux.alibaba.com> Cc: teawater <teawaterz@linux.alibaba.com> Cc: Marek Kedzierski <mkedzier@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Pankaj Gupta <pankaj.gupta@ionos.com> Link: https://lore.kernel.org/r/20210712083135.15755-1-david@redhat.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2021-07-14net/rocker: use GDateTime for formatting timestamp in debug messagesDaniel P. Berrangé
The GDateTime APIs provided by GLib avoid portability pitfalls, such as some platforms where 'struct timeval.tv_sec' field is still 'long' instead of 'time_t'. When combined with automatic cleanup, GDateTime often results in simpler code too. Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-07-14Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging x86 queue, 2021-07-13 Bug fixes: * numa: Parse initiator= attribute before cpus= attribute (Michal Privoznik) * Fix CPUID level for AMD (Zhenwei Pi) * Suppress CPUID leaves not defined by the CPU vendor (Michael Roth) Cleanup: * Hyper-V feature handling cleanup (Vitaly Kuznetsov) # gpg: Signature made Tue 13 Jul 2021 17:09:01 BST # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost-gl/tags/x86-next-pull-request: numa: Parse initiator= attribute before cpus= attribute numa: Report expected initiator target/i386: Fix cpuid level for AMD target/i386: suppress CPUID leaves not defined by the CPU vendor i386: Hyper-V SynIC requires POST_MESSAGES/SIGNAL_EVENTS privileges i386: HV_HYPERCALL_AVAILABLE privilege bit is always needed i386: kill off hv_cpuid_check_and_set() i386: expand Hyper-V features during CPU feature expansion time i386: make hyperv_expand_features() return bool i386: hardcode supported eVMCS version to '1' i386: clarify 'hv-passthrough' behavior Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-13Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.1-20210713' ↵Peter Maydell
into staging ppc patch queue 2021-07-13 I thought I'd sent the last PR before the 6.1 soft freeze, but unfortunately I need one more. This last minute one puts in a SLOF update, along with a couple of bugfixes. # gpg: Signature made Tue 13 Jul 2021 03:07:20 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-6.1-20210713: mv64361: Remove extra break from a switch case pseries: Update SLOF firmware image ppc/pegasos2: Allow setprop in VOF Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-13numa: Parse initiator= attribute before cpus= attributeMichal Privoznik
When parsing cpus= attribute of -numa object couple of checks is performed, such as correct initiator setting (see the if() statement at the end of for() loop in machine_set_cpu_numa_node()). However, with the current code cpus= attribute is parsed before initiator= attribute and thus the check may fail even though it is not obvious why. But since parsing the initiator= attribute does not depend on the cpus= attribute we can swap the order of the two. It's fairly easy to reproduce with the following command line (snippet of an actual cmd line): -smp 4,sockets=4,cores=1,threads=1 \ -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":2147483648}' \ -numa node,nodeid=0,cpus=0-1,initiator=0,memdev=ram-node0 \ -object '{"qom-type":"memory-backend-ram","id":"ram-node1","size":2147483648}' \ -numa node,nodeid=1,cpus=2-3,initiator=1,memdev=ram-node1 \ -numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-latency,latency=5 \ -numa hmat-lb,initiator=0,target=0,hierarchy=first-level,data-type=access-latency,latency=10 \ -numa hmat-lb,initiator=1,target=1,hierarchy=memory,data-type=access-latency,latency=5 \ -numa hmat-lb,initiator=1,target=1,hierarchy=first-level,data-type=access-latency,latency=10 \ -numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-bandwidth,bandwidth=204800K \ -numa hmat-lb,initiator=0,target=0,hierarchy=first-level,data-type=access-bandwidth,bandwidth=208896K \ -numa hmat-lb,initiator=1,target=1,hierarchy=memory,data-type=access-bandwidth,bandwidth=204800K \ -numa hmat-lb,initiator=1,target=1,hierarchy=first-level,data-type=access-bandwidth,bandwidth=208896K \ -numa hmat-cache,node-id=0,size=10K,level=1,associativity=direct,policy=write-back,line=8 \ -numa hmat-cache,node-id=1,size=10K,level=1,associativity=direct,policy=write-back,line=8 \ Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <b27a6a88986d63e3f610a728c845e01ff8d92e2e.1625662776.git.mprivozn@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13numa: Report expected initiatorMichal Privoznik
When setting up NUMA with HMAT enabled there's a check performed in machine_set_cpu_numa_node() that reports an error when a NUMA node has a CPU but the node's initiator is not itself. The error message reported contains only the expected value and not the actual value (which is different because an error is being reported). Report both values in the error message. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Pankaj Gupta <pankaj.gupta@ionos.com> Message-Id: <ebdf871551ea995bafa7a858899a26aa9bc153d3.1625662776.git.mprivozn@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13target/i386: suppress CPUID leaves not defined by the CPU vendorMichael Roth
Currently all built-in CPUs report cache information via CPUID leaves 2 and 4, but these have never been defined for AMD. In the case of SEV-SNP this can cause issues with CPUID enforcement. Address this by allowing CPU types to suppress these via a new "x-vendor-cpuid-only" CPU property, which is true by default, but switched off for older machine types to maintain compatibility. Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Igor Mammedov <imammedo@redhat.com> Cc: zhenwei pi <pizhenwei@bytedance.com> Suggested-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Message-Id: <20210708003623.18665-1-michael.roth@amd.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13mv64361: Remove extra break from a switch caseBALATON Zoltan
The switch case of writing PCI 1 IO base address had an extra break statement that made part of the code unreachable. This did not cause a problem as guests ususally leave this register at its default value. Fixes: dcdf98a9015 ("Add emulation of Marvell MV64361 PPC system controller") Reported-by: Coverity (CID 1458135) Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210712131259.B705B7456E3@zero.eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-13ppc/pegasos2: Allow setprop in VOFBALATON Zoltan
Linux needs setprop to fix up the device tree, otherwise it's not finding devices and cannot boot. Since recent VOF change now we need to add a callback to allow this which is what this patch does. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210709132920.6544E7457EF@zero.eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-12Merge remote-tracking branch 'remotes/philmd/tags/sdmmc-20210712' into stagingPeter Maydell
SD/MMC patches queue - sdcard: Check for valid address range in SEND_WRITE_PROT (CMD30) # gpg: Signature made Mon 12 Jul 2021 11:28:13 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/sdmmc-20210712: hw/sd/sdcard: Check for valid address range in SEND_WRITE_PROT (CMD30) hw/sd/sdcard: Extract address_in_range() helper, log invalid accesses hw/sd/sdcard: When card is in wrong state, log which state it is Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-12Merge remote-tracking branch 'remotes/cohuck-gitlab/tags/s390x-20210708' ↵Peter Maydell
into staging s390x updates: - add gen16 cpumodels - refactor/cleanup some code - bugfixes # gpg: Signature made Thu 08 Jul 2021 12:26:21 BST # gpg: using EDDSA key 69A3B536F5CBFC65208026C1DE88BB5641DE66C1 # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [unknown] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [unknown] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF # Subkey fingerprint: 69A3 B536 F5CB FC65 2080 26C1 DE88 BB56 41DE 66C1 * remotes/cohuck-gitlab/tags/s390x-20210708: target/s390x: split sysemu part of cpu models target/s390x: move kvm files into kvm/ target/s390x: remove kvm-stub.c target/s390x: use kvm_enabled() to wrap call to kvm_s390_get_hpage_1m target/s390x: make helper.c sysemu-only target/s390x: split cpu-dump from helper.c target/s390x: move sysemu-only code out to cpu-sysemu.c target/s390x: start moving TCG-only code to tcg/ target/s390x: rename internal.h to s390x-internal.h target/s390x: remove tcg-stub.c hw/s390x: only build tod-tcg from the CONFIG_TCG build hw/s390x: tod: make explicit checks for accelerators when initializing hw/s390x: rename tod-qemu.c to tod-tcg.c target/s390x: meson: add target_user_arch s390x/tcg: Fix m5 vs. m4 field for VECTOR MULTIPLY SUM LOGICAL target/s390x: Fix CC set by CONVERT TO FIXED/LOGICAL s390x/cpumodel: add 3931 and 3932 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-12Merge remote-tracking branch 'remotes/philmd/tags/mips-20210711' into stagingPeter Maydell
MIPS patches queue - Rename Raven ASIC PCI bridge, add PCI_IO_BASE_ADDR definition - Various Toshiba TX79 opcodes implemented - Rewrite UHI errno_mips() using switch statement - Few fixes and improvements in the SONIC model (dp8393x) # gpg: Signature made Sun 11 Jul 2021 22:12:49 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210711: dp8393x: don't force 32-bit register access dp8393x: Rewrite dp8393x_get() / dp8393x_put() dp8393x: Store CAM registers as 16-bit dp8393x: Replace 0x40 magic value by SONIC_REG_COUNT definition dp8393x: Replace address_space_rw(is_write=1) by address_space_write() dp8393x: fix CAM descriptor entry index target/mips: Rewrite UHI errno_mips() using switch statement target/mips/tx79: Introduce SQ opcode (Store Quadword) target/mips/tx79: Introduce LQ opcode (Load Quadword) target/mips/tx79: Introduce PROT3W opcode (Parallel Rotate 3 Words) target/mips/tx79: Introduce PPACW opcode (Parallel Pack to Word) target/mips/tx79: Introduce PCGT* (Parallel Compare for Greater Than) target/mips/tx79: Introduce PCEQ* opcodes (Parallel Compare for Equal) target/mips/tx79: Introduce PEXTL[BHW] opcodes (Parallel Extend Lower) target/mips/tx79: Introduce PEXTUW (Parallel Extend Upper from Word) target/mips/tx79: Introduce PSUB* opcodes (Parallel Subtract) target/mips/tx79: Introduce PAND/POR/PXOR/PNOR opcodes (parallel logic) hw/pci-host/raven: Add PCI_IO_BASE_ADDR definition hw/pci-host: Rename Raven ASIC PCI bridge as raven.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-12hw/sd/sdcard: Check for valid address range in SEND_WRITE_PROT (CMD30)Philippe Mathieu-Daudé
OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers an assertion: qemu-fuzz-i386: hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. ==11578== ERROR: libFuzzer: deadly signal #8 0x7ffff628e091 in __assert_fail #9 0x5555588f1a3c in sd_wpbits hw/sd/sd.c:824:9 #10 0x5555588dd271 in sd_normal_command hw/sd/sd.c:1383:38 #11 0x5555588d777c in sd_do_command hw/sd/sd.c #12 0x555558cb25a0 in sdbus_do_command hw/sd/core.c:100:16 #13 0x555558e02a9a in sdhci_send_command hw/sd/sdhci.c:337:12 #14 0x555558dffa46 in sdhci_write hw/sd/sdhci.c:1187:9 #15 0x5555598b9d76 in memory_region_write_accessor softmmu/memory.c:489:5 Similarly to commit 8573378e62d ("hw/sd: fix out-of-bounds check for multi block reads"), check the address range before sending the status of the write protection bits. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Reported-by: OSS-Fuzz (Issue 29225) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/450 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210702155900.148665-4-f4bug@amsat.org>
2021-07-12hw/sd/sdcard: Extract address_in_range() helper, log invalid accessesPhilippe Mathieu-Daudé
Multiple commands have to check the address requested is valid. Extract this code pattern as a new address_in_range() helper, and log invalid accesses as guest errors. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-3-f4bug@amsat.org>
2021-07-12hw/sd/sdcard: When card is in wrong state, log which state it isPhilippe Mathieu-Daudé
We report the card is in an inconsistent state, but don't precise in which state it is. Add this information, as it is useful when debugging problems. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-2-f4bug@amsat.org> Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
2021-07-11Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell
staging * More SVM fixes (Lara) * Module annotation database (Gerd) * Memory leak fixes (myself) * Build fixes (myself) * --with-devices-* support (Alex) # gpg: Signature made Fri 09 Jul 2021 17:23:52 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: (48 commits) meson: Use input/output for entitlements target configure: allow the selection of alternate config in the build configs: rename default-configs to configs and reorganise hw/arm: move CONFIG_V7M out of default-devices hw/arm: add dependency on OR_IRQ for XLNX_VERSAL meson: Introduce target-specific Kconfig meson: switch function tests from compilation to linking vl: fix leak of qdict_crumple return value target/i386: fix exceptions for MOV to DR target/i386: Added DR6 and DR7 consistency checks target/i386: Added MSRPM and IOPM size check monitor/tcg: move tcg hmp commands to accel/tcg, register them dynamically usb: build usb-host as module monitor/usb: register 'info usbhost' dynamically usb: drop usb_host_dev_is_scsi_storage hook monitor: allow register hmp commands accel: build tcg modular accel: add tcg module annotations accel: build qtest modular accel: add qtest module annotations ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>