aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2021-04-12hw/block/nvme: drain namespaces on sq deletionKlaus Jensen
For most commands, when issuing an AIO, the BlockAIOCB is stored in the NvmeRequest aiocb pointer when the AIO is issued. The main use of this is cancelling AIOs when deleting submission queues (it is currently not used for Abort). However, some commands like Dataset Management Zone Management Send (zone reset) may involve more than one AIO and here the AIOs are issued without saving a reference to the BlockAIOCB. This is a problem since nvme_del_sq() will attempt to cancel outstanding AIOs, potentially with an invalid BlockAIOCB since the aiocb pointer is not NULL'ed when the request structure is recycled. Fix this by 1. making sure the aiocb pointer is NULL'ed when requests are recycled 2. only attempt to cancel the AIO if the aiocb is non-NULL 3. if any AIOs could not be cancelled, drain all aio as a last resort. Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Fixes: c94973288cd9 ("hw/block/nvme: add broadcast nsid support flush command") Fixes: e4e430b3d6ba ("hw/block/nvme: add simple copy command") Fixes: 5f5dc4c6a942 ("hw/block/nvme: zero out zones on reset") Fixes: 2605257a26b8 ("hw/block/nvme: add the dataset management command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Cc: Minwoo Im <minwoo.im@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-12hw/block/nvme: store aiocb in compareKlaus Jensen
nvme_compare() fails to store the aiocb from the blk_aio_preadv() call. Fix this. Fixes: 0a384f923f51 ("hw/block/nvme: add compare command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-12hw/block/nvme: map prp fix if prp2 contains non-zero offsetPadmakar Kalghatgi
nvme_map_prp needs to calculate the number of list entries based on the offset value. For the subsequent PRP2 list, need to ensure the number of entries is within the MAX number of PRP entries for a page. Signed-off-by: Padmakar Kalghatgi <p.kalghatgi@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2021-04-10Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging x86 and CPU bug fixes for 6.0-rc3 * Add missing features to EPYC-Rome CPU model (Babu Moger) * Fix crash with "-device ...-cpu-core,help" (Greg Kurz) # gpg: Signature made Fri 09 Apr 2021 21:20:18 BST # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost-gl/tags/x86-next-pull-request: cpu/core: Fix "help" of CPU core device types i386: Add missing cpu feature bits in EPYC-Rome model Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-09cpu/core: Fix "help" of CPU core device typesGreg Kurz
Calling qdev_get_machine() from a QOM instance_init function is fragile because we can't be sure the machine object actually exists. And this happens to break when passing ",help" on the command line to get the list of properties for a CPU core device types : $ ./qemu-system-ppc64 -device power8_v2.0-spapr-cpu-core,help qemu-system-ppc64: ../../hw/core/machine.c:1290: qdev_get_machine: Assertion `machine != NULL' failed. Aborted (core dumped) This used to work before QEMU 5.0, but commit 3df261b6676b unwillingly introduced a subtle regression : the above command line needs to create an instance but the instance_init function of the base class calls qdev_get_machine() before qemu_create_machine() has been called, which is a programming bug. Use current_machine instead. It is okay to skip the setting of nr_thread in this case since only its type is displayed. Fixes: 3df261b6676b ("softmmu/vl.c: Handle '-cpu help' and '-device help' before 'no default machine'") Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Greg Kurz <groug@kaod.org> Cc: peter.maydell@linaro.org Message-Id: <20210409160339.500167-3-groug@kaod.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-04-09Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer fixes - mirror: Fix job-complete race condition causing unexpected errors - fdc: Fix 'fallback' property on sysbus floppy disk controllers - rbd: Fix memory leaks - iotest improvements # gpg: Signature made Fri 09 Apr 2021 17:13:11 BST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: test-blockjob: Test job_wait_unpaused() job: Allow complete for jobs on standby mirror: Do not enter a paused job on completion mirror: Move open_backing_file to exit_common hw/block/fdc: Fix 'fallback' property on sysbus floppy disk controllers iotests: Test mirror-top filter permissions iotests: add test for removing persistent bitmap from backing file iotests/qsd-jobs: Filter events in the first test block/rbd: fix memory leak in qemu_rbd_co_create_opts() block/rbd: fix memory leak in qemu_rbd_connect() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-09Merge remote-tracking branch 'remotes/cohuck-gitlab/tags/s390x-20210409' ↵Peter Maydell
into staging One s390x fix: - correctly handle the case where the guest ccw payload points to invalid memory areas # gpg: Signature made Fri 09 Apr 2021 15:43:45 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [unknown] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [unknown] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck-gitlab/tags/s390x-20210409: s390x: css: report errors from ccw_dstream_read/write Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-09hw/block/fdc: Fix 'fallback' property on sysbus floppy disk controllersPhilippe Mathieu-Daudé
Setting the 'fallback' property corrupts the QOM instance state (FDCtrlSysBus) because it accesses an incorrect offset (it uses the offset of the FDCtrlISABus state). Cc: qemu-stable@nongnu.org Fixes: a73275dd6fc ("fdc: Add fallback option") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407133742.1680424-1-f4bug@amsat.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09s390x: css: report errors from ccw_dstream_read/writePierre Morel
ccw_dstream_read/write functions returned values are sometime not taking into account and reported back to the upper level of interpretation of CCW instructions. It follows that accessing an invalid address does not trigger a subchannel status program check to the guest as it should. Let's test the return values of ccw_dstream_write[_buf] and ccw_dstream_read[_buf] and report it to the caller. Cc: qemu-stable@nongnu.org Signed-off-by: Pierre Morel <pmorel@linux.ibm.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <1617899529-9329-2-git-send-email-pmorel@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2021-04-08Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Thu 08 Apr 2021 10:34:24 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap-win32: correctly recycle buffers Revert "qapi: net: Add query-netdev command" Revert "tests: Add tests for query-netdev command" Revert "net: Move NetClientState.info_str to dynamic allocations" Revert "hmp: Use QAPI NetdevInfo in hmp_info_network" Revert "net: Do not fill legacy info_str for backends" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-08Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert/tags/pull-migration-20210407b' into staging V2 migration+virtiofs fixes pull 2021-04-07 A seg fix in virtiofsd, a bunch of fixes for background snapshots, and a migration test fix. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> v2 Fix for !linux build # gpg: Signature made Wed 07 Apr 2021 18:53:13 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20210407b: tests/migration: fix parameter of auto-converge migration migration: Rename 'bs' to 'block' in background snapshot code migration: Pre-fault memory before starting background snasphot migration: Inhibit virtio-balloon for the duration of background snapshot migration: Fix missing qemu_fflush() on buffer file in bg_migration_thread virtiofsd: Fix security.capability comparison Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-08Revert "net: Move NetClientState.info_str to dynamic allocations"Jason Wang
Several issues has been reported for query-netdev info series. Consider it's late in the rc, this reverts commit commit 59b5437eb732d6b103a9bc279c3482c834d1eff9. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-04-07hw/block/nvme: fix out-of-bounds read in nvme_subsys_ctrlKlaus Jensen
nvme_subsys_ctrl() is used in contexts where the given controller identifier is from an untrusted source. Like its friends nvme_ns() and nvme_subsys_ns(), nvme_subsys_ctrl() should just return NULL if an invalid identifier is given. Fixes: 645ce1a70cb6 ("hw/block/nvme: support namespace attachment command") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: fix assert crash in nvme_subsys_nsKlaus Jensen
nvme_subsys_ns() is used in contexts where the namespace identifier is taken from an untrusted source. Commit 3921756dee6d ("hw/block/nvme: assert namespaces array indices") tried to guard against this by introducing an assert on the namespace identifier. This is wrong since it is perfectly valid to call the function with an invalid namespace identifier and like nvme_ns(), nvme_subsys_ns() should simply return NULL. Fixes: 3921756dee6d ("hw/block/nvme: assert namespaces array indices") Fixes: 94d8d6d16781 ("hw/block/nvme: support allocated namespace type") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: fix ns attachment out-of-bounds readKlaus Jensen
nvme_ns_attachment() does not verify the contents of the host-supplied 16 bit "Number of Identifiers" field in the command payload. Make sure the value is capped at 2047 and fix the out-of-bounds read. Fixes: 645ce1a70cb6 ("hw/block/nvme: support namespace attachment command") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: add missing copyright headersKlaus Jensen
Add missing license/copyright headers to the nvme-dif.{c,h} files. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-07hw/block/nvme: fix handling of private namespacesKlaus Jensen
Prior to this patch, if a private nvme-ns device (that is, a namespace that is not linked to a subsystem) is wired up to an nvme-subsys linked nvme controller device, the device fails to verify that the namespace id is unique within the subsystem. NVM Express v1.4b, Section 6.1.6 ("NSID and Namespace Usage") states that because the device supports Namespace Management, "NSIDs *shall* be unique within the NVM subsystem". Additionally, prior to this patch, private namespaces are not known to the subsystem and the namespace is considered exclusive to the controller with which it is initially wired up to. However, this is not the definition of a private namespace; per Section 1.6.33 ("private namespace"), a private namespace is just a namespace that does not support multipath I/O or namespace sharing, which means "that it is only able to be attached to one controller at a time". Fix this by always allocating namespaces in the subsystem (if one is linked to the controller), regardless of the shared/private status of the namespace. Whether or not the namespace is shareable is controlled by a new `shared` nvme-ns parameter. Finally, this fix allows the nvme-ns `subsys` parameter to be removed, since the `shared` parameter now serves the purpose of attaching the namespace to all controllers in the subsystem upon device realization. It is invalid to have an nvme-ns namespace device with a linked subsystem without the parent nvme controller device also being linked to one and since the nvme-ns devices will unconditionally be "attached" (in QEMU terms that is) to an nvme controller device through an NvmeBus, the nvme-ns namespace device can always get a reference to the subsystem of the controller it is explicitly (using 'bus=' parameter) or implicitly attaching to. Fixes: e570768566b3 ("hw/block/nvme: support for shared namespace in subsystem") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: update dmsrl limit on namespace detachmentKlaus Jensen
The Non-MDTS DMSRL limit must be recomputed when namespaces are detached. Fixes: 645ce1a70cb6 ("hw/block/nvme: support namespace attachment command") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-07hw/block/nvme: fix warning about legacy namespace configurationKlaus Jensen
Remove the unused BlockConf from the controller structure and remove the noop constraint checking. Device works just fine with both legacy drive parameter namespace and nvme-ns namespace definitions. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
2021-04-06hw/block/nvme: fix the nsid 'invalid' valueKlaus Jensen
The `nvme_nsid()` function returns '-1' (FFFFFFFFh) when the given namespace is NULL. Since FFFFFFFFh is actually a valid namespace identifier (the "broadcast" value), change this to be '0' since that actually *is* the invalid value. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-06hw/block/nvme: fix missing string representation for ns attachmentKlaus Jensen
Add the missing nvme_adm_opc_str entry for the Namespace Attachment command. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-06hw/block/nvme: fix pi constraint checkKlaus Jensen
Protection Information can only be enabled if there is at least 8 bytes of metadata. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-06migration: Inhibit virtio-balloon for the duration of background snapshotAndrey Gruzdev
The same thing as for incoming postcopy - we cannot deal with concurrent RAM discards when using background snapshot feature in outgoing migration. Fixes: 8518278a6af589ccc401f06e35f171b1e6fae800 (migration: implementation of background snapshot thread) Signed-off-by: Andrey Gruzdev <andrey.gruzdev@virtuozzo.com> Reported-by: David Hildenbrand <david@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20210401092226.102804-3-andrey.gruzdev@virtuozzo.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-06Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210406' into staging target-arm queue: * ppc/e500 and arm/virt: only add valid dynamic sysbus devices to the platform bus * update i.mx31 maintainer list * Revert "target/arm: Make number of counters in PMCR follow the CPU" # gpg: Signature made Tue 06 Apr 2021 13:25:54 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210406: Remove myself as i.mx31 maintainer Revert "target/arm: Make number of counters in PMCR follow the CPU" hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform bus hw/arm/virt: Only try to add valid dynamic sysbus devices to platform bus machine: Provide a function to check the dynamic sysbus allowlist include/hw/boards.h: Document machine_class_allow_dynamic_sysbus_dev() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-06Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc,virtio: last minute bugfixes Two last minute bugfixes. They are both designed to prevent compatibility headaches down the road. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 06 Apr 2021 12:13:07 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-pci: compat page aligned ATS x86: rename oem-id and oem-table-id properties Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-06virtio-pci: compat page aligned ATSJason Wang
Commit 4c70875372b8 ("pci: advertise a page aligned ATS") advertises the page aligned via ATS capability (RO) to unbrek recent Linux IOMMU drivers since 5.2. But it forgot the compat the capability which breaks the migration from old machine type: (qemu) qemu-kvm: get_pci_config_device: Bad config data: i=0x104 read: 0 device: 20 cmask: ff wmask: 0 w1cmask:0 This patch introduces a new parameter "x-ats-page-aligned" for virtio-pci device and turns it on for machine type which is newer than 5.1. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Peter Xu <peterx@redhat.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Fixes: 4c70875372b8 ("pci: advertise a page aligned ATS") Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <20210406040330.11306-1-jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-06hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform busPeter Maydell
The e500plat machine device plug callback currently calls platform_bus_link_device() for any sysbus device. This is overly broad, because platform_bus_link_device() will unconditionally grab the IRQs and MMIOs of the device it is passed, whether it was intended for the platform bus or not. Restrict hotpluggability of sysbus devices to only those devices on the dynamic sysbus allowlist. We were mostly getting away with this because the board creates the platform bus as the last device it creates, and so the hotplug callback did not do anything for all the sysbus devices created by the board itself. However if the user plugged in a device which itself uses a sysbus device internally we would have mishandled this and probably asserted. An example of this is: qemu-system-ppc64 -M ppce500 -device macio-oldworld This isn't a sensible command because the macio-oldworld device is really specific to the 'g3beige' machine, but we now fail with a reasonable error message rather than asserting: qemu-system-ppc64: Device heathrow is not supported by this machine yet. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Eric Auger <eric.auger@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-id: 20210325153310.9131-5-peter.maydell@linaro.org
2021-04-06hw/arm/virt: Only try to add valid dynamic sysbus devices to platform busPeter Maydell
The virt machine device plug callback currently calls platform_bus_link_device() for any sysbus device. This is overly broad, because platform_bus_link_device() will unconditionally grab the IRQs and MMIOs of the device it is passed, whether it was intended for the platform bus or not. Restrict hotpluggability of sysbus devices to only those devices on the dynamic sysbus allowlist. We were mostly getting away with this because the board creates the platform bus as the last device it creates, and so the hotplug callback did not do anything for all the sysbus devices created by the board itself. However if the user plugged in a device which itself uses a sysbus device internally we would have mishandled this and probably asserted. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210325153310.9131-4-peter.maydell@linaro.org
2021-04-06machine: Provide a function to check the dynamic sysbus allowlistPeter Maydell
Provide a new function dynamic_sysbus_dev_allowed() which checks the per-machine list of permitted dynamic sysbus devices and returns a boolean result indicating whether the device is allowed. We can use this in the implementation of validate_sysbus_device(), but we will also need it so that machine hotplug callbacks can validate devices rather than assuming that any sysbus device might be hotpluggable into the platform bus. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210325153310.9131-3-peter.maydell@linaro.org
2021-04-05hw/block/nvme: expose 'bootindex' propertyJoelle van Dyne
The check for `n->namespace.blkconf.blk` always fails because this is in the initialization function. Signed-off-by: Joelle van Dyne <j@getutm.app> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2021-04-05hw/block/nvme: remove description for zoned.append_size_limitNiklas Cassel
The description was originally removed in commit 578d914b263c ("hw/block/nvme: align zoned.zasl with mdts") together with the removal of the zoned.append_size_limit parameter itself. However, it was (most likely accidentally), re-added in commit f7dcd31885cb ("hw/block/nvme: add non-mdts command size limit for verify"). Remove the description again, since the parameter it describes, zoned.append_size_limit, no longer exists. Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2021-04-04x86: rename oem-id and oem-table-id propertiesPaolo Bonzini
After introducing non-scalar machine properties, it would be preferrable to have a single acpitable property which includes both generic information (such as the OEM ids) and custom tables currently passed via -acpitable. Do not saddle ourselves with legacy oem-id and oem-table-id properties, instead mark them as experimental. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210402082128.13854-1-pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01pci: sprinkle assert in PCI pin numberIsaku Yamahata
If a device model (a) doesn't set the value to a correct interrupt number and then (b) triggers an interrupt for itself, it's device model bug. Add assert on interrupt pin number to catch this kind of bug more obviously. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> Message-Id: <9cf8ac3b17e162daac0971d7be32deb6a33ae6ec.1616532563.git.isaku.yamahata@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01isa/v582c686: Reinitialize ACPI PM device on resetIsaku Yamahata
Commit 6be8cf56bc8b made sure that SCI is enabled in PM1.CNT on reset in acpi_only mode by modifying acpi_pm1_cnt_reset() and that worked for q35 as expected. This patch adds reset ACPI PM related registers on vt82c686 reset time and de-assert sci. via_pm_realize() initializes acpi pm tmr, evt, cnt and gpe. Reset them on device reset. Cc: BALATON Zoltan <balaton@eik.bme.hu> Cc: Huacai Chen <chenhuacai@kernel.org> Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> Message-Id: <0a3fe998525552860919a690ce83dab8f663ab99.1616532563.git.isaku.yamahata@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01vt82c686.c: don't raise SCI when PCI_INTERRUPT_PIN isn't setupIsaku Yamahata
Without this patch, the following patch will triger clan runtime sanitizer warnings as follows. This patch proactively works around it. I leave a correct fix to v582c686.c maintainerfix as I'm not sure about fuloong2e device model. > MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))} > QTEST_QEMU_IMG=./qemu-img > G_TEST_DBUS_DAEMON=/home/petmay01/linaro/qemu-for-merges/tests/dbus-vmstate-daemon.sh > QTEST_QEMU_BINARY=./qemu-system-mips64el tests/qtest/qom-test --tap -k > PASS 1 qtest-mips64el/qom-test /mips64el/qom/loongson3-virt > PASS 2 qtest-mips64el/qom-test /mips64el/qom/none > PASS 3 qtest-mips64el/qom-test /mips64el/qom/magnum > PASS 4 qtest-mips64el/qom-test /mips64el/qom/mipssim > PASS 5 qtest-mips64el/qom-test /mips64el/qom/malta > ../../hw/pci/pci.c:252:30: runtime error: shift exponent -1 is negative > PASS 6 qtest-mips64el/qom-test /mips64el/qom/fuloong2e > PASS 7 qtest-mips64el/qom-test /mips64el/qom/boston > PASS 8 qtest-mips64el/qom-test /mips64el/qom/pica61 > > and similarly for eg > > MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))} > QTEST_QEMU_IMG=./qemu-img > G_TEST_DBUS_DAEMON=/home/petmay01/linaro/qemu-for-merges/tests/dbus-vmstate-daemon.sh > QTEST_QEMU_BINARY=./qemu-system-mips64el tests/qtest/endianness-test > --tap -k > ../../hw/pci/pci.c:252:30: runtime error: shift exponent -1 is negative > PASS 1 qtest-mips64el/endianness-test /mips64el/endianness/fuloong2e > ../../hw/pci/pci.c:252:30: runtime error: shift exponent -1 is negative > PASS 2 qtest-mips64el/endianness-test /mips64el/endianness/split/fuloong2e > ../../hw/pci/pci.c:252:30: runtime error: shift exponent -1 is negative > PASS 3 qtest-mips64el/endianness-test /mips64el/endianness/combine/fuloong2e Cc: BALATON Zoltan <balaton@eik.bme.hu> Cc: Huacai Chen <chenhuacai@kernel.org> Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> Message-Id: <62a5fc69e453fb848bfd4794bae1852a75af73c5.1616532563.git.isaku.yamahata@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01acpi/piix4: reinitialize acpi PM device on resetIsaku Yamahata
Commit 6be8cf56bc8b made sure that SCI is enabled in PM1.CNT on reset in acpi_only mode by modifying acpi_pm1_cnt_reset() and that worked for q35 as expected. The function was introduced by commit eaba51c573a (acpi, acpi_piix, vt82c686: factor out PM1_CNT logic) that forgot to actually call it at piix4 reset time and as result SCI_EN wasn't set as was expected by 6be8cf56bc8b in acpi_only mode. So Windows crashes when it notices that SCI_EN is not set and FADT is not providing information about how to enable it anymore. Reproducer: qemu-system-x86_64 -enable-kvm -M pc-i440fx-6.0,smm=off -cdrom any_windows_10x64.iso Fix it by calling acpi_pm1_cnt_reset() at piix4 reset time. Occasionally this patch adds reset acpi PM related registers on piix4 reset time and de-assert sci. piix4_pm_realize() initializes acpi pm tmr, evt, cnt and gpe. Reset them on device reset. pm_reset() in ich9.c correctly calls corresponding reset functions. Fixes: 6be8cf56bc8b (acpi/core: always set SCI_EN when SMM isn't supported) Reported-by: Reinoud Zandijk <reinoud@NetBSD.org> Co-developed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> Message-Id: <8a5bbd19727045ec863523830078dd4ca63f6a9a.1616532563.git.isaku.yamahata@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01virtio-pci: remove explicit initialization of valYuri Benditovich
The value is assigned later in this procedure. Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> Message-Id: <20210315115937.14286-3-yuri.benditovich@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01virtio-pci: add check for vdev in virtio_pci_isr_readYuri Benditovich
https://bugzilla.redhat.com/show_bug.cgi?id=1743098 This commit completes the solution of segfault in hot unplug flow (by commit ccec7e9603f446fe75c6c563ba335c00cfda6a06). Added missing check for vdev in virtio_pci_isr_read. Typical stack of crash: virtio_pci_isr_read ../hw/virtio/virtio-pci.c:1365 with proxy-vdev = 0 memory_region_read_accessor at ../softmmu/memory.c:442 access_with_adjusted_size at ../softmmu/memory.c:552 memory_region_dispatch_read1 at ../softmmu/memory.c:1420 memory_region_dispatch_read at ../softmmu/memory.c:1449 flatview_read_continue at ../softmmu/physmem.c:2822 flatview_read at ../softmmu/physmem.c:2862 address_space_read_full at ../softmmu/physmem.c:2875 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> Message-Id: <20210315115937.14286-2-yuri.benditovich@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01vhost-user-blk: add immediate cleanup on shutdownDenis Plotnikov
Qemu crashes on shutdown if the chardev used by vhost-user-blk has been finalized before the vhost-user-blk. This happens with char-socket chardev operating in the listening mode (server). The char-socket chardev emits "close" event at the end of finalizing when its internal data is destroyed. This calls vhost-user-blk event handler which in turn tries to manipulate with destroyed chardev by setting an empty event handler for vhost-user-blk cleanup postponing. This patch separates the shutdown case from the cleanup postponing removing the need to set an event handler. Signed-off-by: Denis Plotnikov <den-plotnikov@yandex-team.ru> Message-Id: <20210325151217.262793-4-den-plotnikov@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01vhost-user-blk: perform immediate cleanup if disconnect on initializationDenis Plotnikov
Commit 4bcad76f4c39 ("vhost-user-blk: delay vhost_user_blk_disconnect") introduced postponing vhost_dev cleanup aiming to eliminate qemu aborts because of connection problems with vhost-blk daemon. However, it introdues a new problem. Now, any communication errors during execution of vhost_dev_init() called by vhost_user_blk_device_realize() lead to qemu abort on assert in vhost_dev_get_config(). This happens because vhost_user_blk_disconnect() is postponed but it should have dropped s->connected flag by the time vhost_user_blk_device_realize() performs a new connection opening. On the connection opening, vhost_dev initialization in vhost_user_blk_connect() relies on s->connection flag and if it's not dropped, it skips vhost_dev initialization and returns with success. Then, vhost_user_blk_device_realize()'s execution flow goes to vhost_dev_get_config() where it's aborted on the assert. To fix the problem this patch adds immediate cleanup on device initialization(in vhost_user_blk_device_realize()) using different event handlers for initialization and operation introduced in the previous patch. On initialization (in vhost_user_blk_device_realize()) we fully control the initialization process. At that point, nobody can use the device since it isn't initialized and we don't need to postpone any cleanups, so we can do cleaup right away when there is a communication problem with the vhost-blk daemon. On operation we leave it as is, since the disconnect may happen when the device is in use, so the device users may want to use vhost_dev's data to do rollback before vhost_dev is re-initialized (e.g. in vhost_dev_set_log()). Signed-off-by: Denis Plotnikov <den-plotnikov@yandex-team.ru> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <20210325151217.262793-3-den-plotnikov@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-04-01vhost-user-blk: use different event handlers on initializationDenis Plotnikov
It is useful to use different connect/disconnect event handlers on device initialization and operation as seen from the further commit fixing a bug on device initialization. This patch refactors the code to make use of them: we don't rely any more on the VM state for choosing how to cleanup the device, instead we explicitly use the proper event handler depending on whether the device has been initialized. Signed-off-by: Denis Plotnikov <den-plotnikov@yandex-team.ru> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <20210325151217.262793-2-den-plotnikov@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-03-31hw/net: fsl_etsec: Tx padding length should exclude CRCBin Meng
As the comment of tx_padding_and_crc() says: "Never add CRC in QEMU", min_frame_len should excluce CRC, so it should be 60 instead of 64. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210316081505.72898-1-bmeng.cn@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-31spapr: Assert DIMM unplug state in spapr_memory_unplug()Greg Kurz
spapr_memory_unplug() is the last step of the hot unplug sequence. It is indirectly called by: spapr_lmb_release() hotplug_handler_unplug() and spapr_lmb_release() already buys us that DIMM unplug state is present : it gets restored with spapr_recover_pending_dimm_state() if missing. g_assert() that spapr_pending_dimm_unplugs_find() cannot return NULL in spapr_memory_unplug() to make this clear and silence Coverity. Fixes: Coverity CID 1450767 Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <161562021166.948373.15092876234470478331.stgit@bahia.lan> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-31hw/ppc: e500: Add missing #address-cells and #size-cells in the eTSEC nodeBin Meng
Per devicetree spec v0.3 [1] chapter 2.3.5: The #address-cells and #size-cells properties are not inherited from ancestors in the devicetree. They shall be explicitly defined. If missing, a client program should assume a default value of 2 for #address-cells, and a value of 1 for #size-cells. These properties are currently missing, causing the <reg> property of the queue-group subnode to be incorrectly parsed using default values. [1] https://github.com/devicetree-org/devicetree-specification/releases/download/v0.3/devicetree-specification-v0.3.pdf Fixes: fdfb7f2cdb2d ("e500: Add support for eTSEC in device tree") Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20210311081608.66891-1-bmeng.cn@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-30hw/timer/renesas_tmr: Add default-case asserts in read_tcnt()Peter Maydell
In commit 81b3ddaf8772ec we fixed a use of uninitialized data in read_tcnt(). However this change wasn't enough to placate Coverity, which is not smart enough to see that if we read a 2 bit field and then handle cases 0, 1, 2 and 3 then there cannot be a flow of execution through the switch default. Add explicit default cases which assert that they can't be reached, which should help silence Coverity. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210319162458.13760-1-peter.maydell@linaro.org
2021-03-30hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid()Zenghui Yu
They were introduced in commit 9bde7f0674fe ("hw/arm/smmuv3: Implement translate callback") but never actually used. Drop them. Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210325142702.790-1-yuzenghui@huawei.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize()Philippe Mathieu-Daudé
When building with --enable-sanitizers we get: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x5618479ec7cf in malloc (qemu-system-aarch64+0x233b7cf) #1 0x7f675745f958 in g_malloc (/lib64/libglib-2.0.so.0+0x58958) #2 0x561847c2dcc9 in xlnx_dp_init hw/display/xlnx_dp.c:1259:5 #3 0x56184a5bdab8 in object_init_with_type qom/object.c:375:9 #4 0x56184a5a2bda in object_initialize_with_type qom/object.c:517:5 #5 0x56184a5a24d5 in object_initialize qom/object.c:536:5 #6 0x56184a5a2f6c in object_initialize_child_with_propsv qom/object.c:566:5 #7 0x56184a5a2e60 in object_initialize_child_with_props qom/object.c:549:10 #8 0x56184a5a3a1e in object_initialize_child_internal qom/object.c:603:5 #9 0x5618495aa431 in xlnx_zynqmp_init hw/arm/xlnx-zynqmp.c:273:5 The RX/TX FIFOs are created in xlnx_dp_init(), add xlnx_dp_finalize() to destroy them. Fixes: 58ac482a66d ("introduce xlnx-dp") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210323182958.277654-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-30net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not setDoug Evans
Turning REG_MCMDR_RXON is enough to start receiving packets. Signed-off-by: Doug Evans <dje@google.com> Message-id: 20210319195044.741821-1-dje@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-29hw/block/nvme: fix ref counting in nvme_format_nsKlaus Jensen
Max noticed that since blk_aio_pwrite_zeroes() may invoke the callback before returning, the callbacks will never see *count == 0 and thus never free the count variable or decrement num_formats causing a CQE to never be posted. Coverity (CID 1451082) also picked up on the fact that count would not be free'ed if the namespace was of zero size. Fix both of these issues by explicitly checking *count and finalize for the given namespace if --(*count) is zero. Enqueing a CQE if there are no AIOs outstanding after this case is already handled by nvme_format() by inspecting *num_formats. Reported-by: Max Reitz <mreitz@redhat.com> Reported-by: Coverity (CID 1451082) Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
2021-03-29hw/block/nvme: fix resource leak in nvme_dif_rwKlaus Jensen
If nvme_map_dptr() fails, nvme_dif_rw() will leak the bounce context. Fix this by using the same error handling as everywhere else in the function. Reported-by: Coverity (CID 1451080) Fixes: 146f720c5563 ("hw/block/nvme: end-to-end data protection") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-01 13:22:43 +0000