aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2019-08-16trace: Eliminate use of TARGET_FMT_plxMarkus Armbruster1-2/+2
hw/tpm/trace-events uses TARGET_FMT_plx formats with uint64_t arguments. That's wrong, TARGET_FMT_plx takes hwaddr. Since hwaddr happens to be uint64_t, it works anyway. Messed up in commit ec427498da5, v2.12.0. Clean up by replacing TARGET_FMT_plx with its macro expansion. scripts/tracetool/format/log_stap.py (commit 62dd1048c0b, v4.0.0) has a special case for TARGET_FMT_plx. Delete it. Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20190812052359.30071-7-armbru@redhat.com>
2019-08-16memory: Fix type of IOMMUMemoryRegionClass member @parent_classMarkus Armbruster2-0/+2
TYPE_IOMMU_MEMORY_REGION is a direct subtype of TYPE_MEMORY_REGION. Its instance struct is IOMMUMemoryRegion, and its first member is a MemoryRegion. Correct. Its class struct is IOMMUMemoryRegionClass, and its first member is a DeviceClass. Wrong. Messed up when commit 1221a474676 introduced the QOM type. It even included hw/qdev-core.h just for that. TYPE_MEMORY_REGION doesn't bother to define a class struct. This is fine, it simply defaults to its super-type TYPE_OBJECT's class struct ObjectClass. Changing IOMMUMemoryRegionClass's first member's type to ObjectClass would be a minimal fix, if a bit brittle: if TYPE_MEMORY_REGION ever acquired own class struct, we'd have to update IOMMUMemoryRegionClass to use it. Fix it the clean and robust way instead: give TYPE_MEMORY_REGION its own class struct MemoryRegionClass now, and use it for IOMMUMemoryRegionClass's first member. Revert the include of hw/qdev-core.h, and fix the few files that have come to rely on it. Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20190812052359.30071-5-armbru@redhat.com>
2019-08-16Include generated QAPI headers lessMarkus Armbruster3-0/+4
Some of the generated qapi-types-MODULE.h are included all over the place. Changing a QAPI type can trigger massive recompiling. Top scorers recompile more than 1000 out of some 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h): 6300 qapi/qapi-builtin-types.h 5700 qapi/qapi-types-run-state.h 3900 qapi/qapi-types-common.h 3300 qapi/qapi-types-sockets.h 3000 qapi/qapi-types-misc.h 3000 qapi/qapi-types-crypto.h 3000 qapi/qapi-types-job.h 3000 qapi/qapi-types-block-core.h 2800 qapi/qapi-types-block.h 1300 qapi/qapi-types-net.h Clean up headers to include generated QAPI headers only where needed. Impact is negligible except for hw/qdev-properties.h. This header includes qapi/qapi-types-block.h and qapi/qapi-types-misc.h. They are used only in expansions of property definition macros such as DEFINE_PROP_BLOCKDEV_ON_ERROR() and DEFINE_PROP_OFF_AUTO(). Moving their inclusion from hw/qdev-properties.h to the users of these macros avoids pointless recompiles. This is how other property definition macros, such as DEFINE_PROP_NETDEV(), already work. Improves things for some of the top scorers: 3600 qapi/qapi-types-common.h 2800 qapi/qapi-types-sockets.h 900 qapi/qapi-types-misc.h 2200 qapi/qapi-types-crypto.h 2100 qapi/qapi-types-job.h 2100 qapi/qapi-types-block-core.h 270 qapi/qapi-types-block.h Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20190812052359.30071-3-armbru@redhat.com>
2019-08-13spapr/xive: Fix migration of hot-plugged CPUsCédric Le Goater2-3/+37
The migration sequence of a guest using the XIVE exploitation mode relies on the fact that the states of all devices are restored before the machine is. This is not true for hot-plug devices such as CPUs which state come after the machine. This breaks migration because the thread interrupt context registers are not correctly set. Fix migration of hotplugged CPUs by restoring their context in the 'post_load' handler of the XiveTCTX model. Fixes: 277dd3d7712a ("spapr/xive: add migration support for KVM") Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190813064853.29310-1-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-13spapr: Reset CAS & IRQ subsystem after devicesDavid Gibson1-12/+12
This fixes a nasty regression in qemu-4.1 for the 'pseries' machine, caused by the new "dual" interrupt controller model. Specifically, qemu can crash when used with KVM if a 'system_reset' is requested while there's active I/O in the guest. The problem is that in spapr_machine_reset() we: 1. Reset the CAS vector state spapr_ovec_cleanup(spapr->ov5_cas); 2. Reset all devices qemu_devices_reset() 3. Reset the irq subsystem spapr_irq_reset(); However (1) implicitly changes the interrupt delivery mode, because whether we're using XICS or XIVE depends on the CAS state. We don't properly initialize the new irq mode until (3) though - in particular setting up the KVM devices. During (2), we can temporarily drop the BQL allowing some irqs to be delivered which will go to an irq system that's not properly set up. Specifically, if the previous guest was in (KVM) XIVE mode, the CAS reset will put us back in XICS mode. kvm_kernel_irqchip() still returns true, because XIVE was using KVM, however XICs doesn't have its KVM components intialized and kernel_xics_fd == -1. When the irq is delivered it goes via ics_kvm_set_irq() which assert()s that kernel_xics_fd != -1. This change addresses the problem by delaying the CAS reset until after the devices reset. The device reset should quiesce all the devices so we won't get irqs delivered while we mess around with the IRQ. The CAS reset and irq re-initialize should also now be under the same BQL critical section so nothing else should be able to interrupt it either. We also move the spapr_irq_msi_reset() used in one of the legacy irq modes, since it logically makes sense at the same point as the spapr_irq_reset() (it's essentially an equivalent operation for older machine types). Since we don't need to switch between different interrupt controllers for those old machine types it shouldn't actually be broken in those cases though. Cc: Cédric Le Goater <clg@kaod.org> Fixes: b2e22477 "spapr: add a 'reset' method to the sPAPR IRQ backend" Fixes: 13db0cd9 "spapr: introduce a new sPAPR IRQ backend supporting XIVE and XICS" Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-08-12display/bochs: fix pcie supportGerd Hoffmann1-1/+6
Set QEMU_PCI_CAP_EXPRESS unconditionally in init(), then clear it in realize() in case the device is not connected to a PCIe bus. This makes sure the pci config space allocation is big enough, so accessing the PCIe extended config space doesn't overflow the pci config space buffer. PCI(e) config space is guest writable. Writes are limited by write mask (which probably is also filled with random stuff), so the guest can only flip enabled bits. But I suspect it still might be exploitable, so rather serious because it might be a host escape for the guest. On the other hand the device is probably not yet in widespread use. (For a QEMU version without this commit, a mitigation for the bug is available: use "-device bochs-display" as a conventional pci device only.) Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20190812065221.20907-2-kraxel@redhat.com Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-06compat: disable edid on virtio-gpu base deviceCornelia Huck1-1/+1
'edid' is a property of the virtio-gpu base device, so turning it off on virtio-gpu-pci is not enough (it misses -ccw). Turn it off on the base device instead. Fixes: 0a71966253c8 ("edid: flip the default to enabled") Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20190806115819.16026-1-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-30Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2-1/+3
pci: bugfix A last minute fix to cross-version migration. Better late than never. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 30 Jul 2019 17:07:42 BST # gpg: using RSA key 281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: pcie_root_port: Disable ACS on older machines pcie_root_port: Allow ACS to be disabled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-30pcie_root_port: Disable ACS on older machinesDr. David Alan Gilbert1-0/+1
ACS got added in 4.0 unconditionally, that broke older<->4.0 migration where there was a PCIe root port. Fix this by turning it off for 3.1 and older machines; note this fixes compatibility for older QEMUs but breaks compatibility with 4.0 for older machine types. machine type source qemu dest qemu 3.1 3.1 4.0 broken 3.1 3.1 4.1rc2 broken 3.1 3.1 4.1+this OK ++ 3.1 4.0 4.1rc2 OK 3.1 4.0 4.1+this broken -- 4.0 4.0 4.1rc2 OK 4.0 4.0 4.1+this OK So we gain and lose; the consensus seems to be treat this as a fix for older machine types. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20190730093719.12958-3-dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-30pcie_root_port: Allow ACS to be disabledDr. David Alan Gilbert1-1/+2
ACS was added in 4.0 unconditionally, this breaks migration compatibility. Allow ACS to be disabled by adding a property that's checked by pcie_root_port. Unfortunately pcie-root-port doesn't have any instance data, so there's no where for that flag to live, so stuff it into PCIESlot. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20190730093719.12958-2-dgilbert@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-30fdc: Fix inserting read-only media in empty driveKevin Wolf1-3/+8
In order to insert a read-only medium (i.e. a read-only block node) to the BlockBackend of a floppy drive, we must not have taken write permissions on that BlockBackend, or the operation will fail with the error message "Block node is read-only". The device already takes care to remove all permissions when the medium is ejected, but the state isn't correct if the drive is initially empty: It uses blk_is_read_only() to check whether write permissions should be taken, but this function returns false for empty BlockBackends in the common case. Fix floppy_drive_realize() to avoid taking write permissions if the drive is empty. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2019-07-30scsi-cd: Fix inserting read-only media in empty driveKevin Wolf1-2/+8
scsi-disks decides whether it has a read-only device by looking at whether the BlockBackend specified as drive=... is read-only. In the case of an anonymous BlockBackend (with a node name specified in drive=...), this is the read-only flag of the attached node. In the case of an empty anonymous BlockBackend, it's always read-write because nothing prevented it from being read-write. This is a problem because scsi-cd would take write permissions on the anonymous BlockBackend of an empty drive created without a drive=... option. Using blockdev-insert-medium with a read-only node fails then with the error message "Block node is read-only". Fix scsi_realize() so that scsi-cd devices always take read-only permissions on their BlockBackend instead. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1733920 Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
2019-07-30Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell8-73/+30
virtio, pc: fixes A couple of last minute bugfixes. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 29 Jul 2019 22:13:22 BST # gpg: using RSA key 281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: pc-dimm: fix crash when invalid slot number is used Revert "hw: report invalid disable-legacy|modern usage for virtio-1-only devs" Revert "Revert "globals: Allow global properties to be optional"" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-29pc-dimm: fix crash when invalid slot number is usedIgor Mammedov1-0/+7
QEMU will crash with: Segmentation fault (core dumped) when negative slot number is used, ex: qemu-system-x86_64 -m 1G,maxmem=20G,slots=256 \ -object memory-backend-ram,id=mem1,size=1G \ -device pc-dimm,id=dimm1,memdev=mem1,slot=-2 fix it by checking that slot number is within valid range. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20190723160859.27250-1-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Igor Mammedov &lt;<a href="mailto:imammedo@redhat.com" target="_blank">imammedo@redhat.com</a>&gt;<br></blockquote><div><br></div><div>Reviewed-by: Li Qiang &lt;<a href="mailto:liq3ea@gmail.com">liq3ea@gmail.com</a>&gt;<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Reviewed-by: Pankaj Gupta <pagupta@redhat.com>
2019-07-29Revert "hw: report invalid disable-legacy|modern usage for virtio-1-only devs"Dr. David Alan Gilbert7-73/+23
This reverts commit f2784eed306449c3d04a71a05ed6463b8289aedf since that accidentally removes the PCIe capabilities from virtio devices because virtio_pci_dc_realize is called before the new 'mode' flag is set. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20190729162903.4489-3-dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2019-07-29Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell1-6/+2
staging # gpg: Signature made Mon 29 Jul 2019 09:30:48 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: net/colo-compare.c: Fix memory leak and code style issue. net: tap: replace snprintf with g_strdup_printf calls qemu-bridge-helper: move repeating code in parse_acl_file qemu-bridge-helper: restrict interface name to IFNAMSIZ e1000: don't raise interrupt in pre_save() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-29Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-4.1-20190728' ↵Peter Maydell2-11/+1
into staging ppc patch queue (for 4.1) 2019-07-28 Here's a pull request for qemu-4.1, which I hope will be the last from the ppc tree. This applies a couple of last minute fixes for the XIVE code. # gpg: Signature made Sun 28 Jul 2019 07:42:11 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-4.1-20190728: xics/kvm: Fix fallback to emulated XICS spapr/irq: Inform the user when falling back to emulated IC Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-29Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.1-rc3' ↵Peter Maydell1-4/+8
into staging RISC-V Patch for 4.1-rc3 This contains a single patch that fixes the warning introduced as part of the OpenSBI integration. # gpg: Signature made Sat 27 Jul 2019 00:04:19 BST # gpg: using RSA key 00CE76D1834960DFCE886DF8EF4CA1502CCBAB41 # gpg: issuer "palmer@dabbelt.com" # gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>" [unknown] # gpg: aka "Palmer Dabbelt <palmer@sifive.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 00CE 76D1 8349 60DF CE88 6DF8 EF4C A150 2CCB AB41 * remotes/palmer/tags/riscv-for-master-4.1-rc3: riscv/boot: Fixup the RISC-V firmware warning Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-29e1000: don't raise interrupt in pre_save()Jason Wang1-6/+2
We should not raise any interrupt after VM has been stopped but this is what e1000 currently did when mit timer is active in pre_save(). Fixing this by scheduling a timer in post_load() which can make sure the interrupt was raised when VM is running. Reported-and-tested-by: Longpeng <longpeng2@huawei.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2019-07-28xics/kvm: Fix fallback to emulated XICSGreg Kurz1-11/+0
Commit 4812f2615288 tried to fix rollback path of xics_kvm_connect() but it isn't enough. If we fail to create the KVM device, the guest fails to boot later on with: [ 0.010817] pci 0000:00:00.0: Adding to iommu group 0 [ 0.010863] irq: unknown-1 didn't like hwirq-0x1200 to VIRQ17 mapping (rc=-22) [ 0.010923] pci 0000:00:01.0: Adding to iommu group 0 [ 0.010968] irq: unknown-1 didn't like hwirq-0x1201 to VIRQ17 mapping (rc=-22) [ 0.011543] EEH: No capable adapters found [ 0.011597] irq: unknown-1 didn't like hwirq-0x1000 to VIRQ17 mapping (rc=-22) [ 0.011651] audit: type=2000 audit(1563977526.000:1): state=initialized audit_enabled=0 res=1 [ 0.011703] ------------[ cut here ]------------ [ 0.011729] event-sources: Unable to allocate interrupt number for /event-sources/epow-events [ 0.011776] WARNING: CPU: 0 PID: 1 at arch/powerpc/platforms/pseries/event_sources.c:34 request_event_sources_irqs+0xbc/0x150 [ 0.011828] Modules linked in: [ 0.011850] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.1.17-300.fc30.ppc64le #1 [ 0.011886] NIP: c0000000000d4fac LR: c0000000000d4fa8 CTR: c0000000018f0000 [ 0.011923] REGS: c00000001e4c38d0 TRAP: 0700 Not tainted (5.1.17-300.fc30.ppc64le) [ 0.011966] MSR: 8000000002029033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28000284 XER: 20040000 [ 0.012012] CFAR: c00000000011b42c IRQMASK: 0 [ 0.012012] GPR00: c0000000000d4fa8 c00000001e4c3b60 c0000000015fc400 0000000000000051 [ 0.012012] GPR04: 0000000000000001 0000000000000000 0000000000000081 772d6576656e7473 [ 0.012012] GPR08: 000000001edf0000 c0000000014d4830 c0000000014d4830 6e6576652f20726f [ 0.012012] GPR12: 0000000000000000 c0000000018f0000 c000000000010bf0 0000000000000000 [ 0.012012] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 0.012012] GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 0.012012] GPR24: 0000000000000000 0000000000000000 c000000000ebbf00 c0000000000d5570 [ 0.012012] GPR28: c000000000ebc008 c00000001fff8248 0000000000000000 0000000000000000 [ 0.012372] NIP [c0000000000d4fac] request_event_sources_irqs+0xbc/0x150 [ 0.012409] LR [c0000000000d4fa8] request_event_sources_irqs+0xb8/0x150 [ 0.012445] Call Trace: [ 0.012462] [c00000001e4c3b60] [c0000000000d4fa8] request_event_sources_irqs+0xb8/0x150 (unreliable) [ 0.012513] [c00000001e4c3bf0] [c000000001042848] __machine_initcall_pseries_init_ras_IRQ+0xc8/0xf8 [ 0.012563] [c00000001e4c3c20] [c000000000010810] do_one_initcall+0x60/0x254 [ 0.012611] [c00000001e4c3cf0] [c000000001024538] kernel_init_freeable+0x35c/0x444 [ 0.012655] [c00000001e4c3db0] [c000000000010c14] kernel_init+0x2c/0x148 [ 0.012693] [c00000001e4c3e20] [c00000000000bdc4] ret_from_kernel_thread+0x5c/0x78 [ 0.012736] Instruction dump: [ 0.012759] 38a00000 7c7f1b78 7f64db78 2c1f0000 2fbf0000 78630020 4180002c 409effa8 [ 0.012805] 7fa4eb78 7f43d378 48046421 60000000 <0fe00000> 3bde0001 2c1e0010 7fde07b4 [ 0.012851] ---[ end trace aa5785707323fad3 ]--- This happens because QEMU fell back on XICS emulation but didn't unregister the RTAS calls from KVM. The emulated RTAS calls are hence never called and the KVM ones return an error to the guest since the KVM device is absent. The sanity checks in xics_kvm_disconnect() are abusive since we're freeing the KVM device. Simply drop them. Fixes: 4812f2615288 "xics/kvm: Add proper rollback to xics_kvm_init()" Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156398744035.546975.7029414194633598474.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-07-28spapr/irq: Inform the user when falling back to emulated ICGreg Kurz1-0/+1
Just to give an indication to the user that the error condition is handled and how. Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com> Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156398743479.546975.14566809803480887488.stgit@bahia.lan> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-07-26riscv/boot: Fixup the RISC-V firmware warningAlistair Francis1-4/+8
Fix a typo in the warning message displayed to users, don't print the message when running inside qtest and don't mention a specific QEMU version for the deprecation. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
2019-07-26hw/arm/boot: Further improve initrd positioning codePeter Maydell1-2/+17
In commit e6b2b20d9735d4ef we made the boot loader code try to avoid putting the initrd on top of the kernel. However the expression used to calculate the start of the initrd: info->initrd_start = info->loader_start + MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size); incorrectly uses 'kernel_size' as the offset within RAM of the highest address to avoid. This is incorrect because the kernel doesn't start at address 0, but slightly higher than that. This means that we can still incorrectly end up overlaying the initrd on the kernel in some cases, for example: * The kernel's image_size is 0x0a7a8000 * The kernel was loaded at 0x40080000 * The end of the kernel is 0x4A828000 * The DTB was loaded at 0x4a800000 To get this right we need to track the actual highest address used by the kernel and use that rather than kernel_size. We already set image_low_addr and image_high_addr for ELF images; set them also for the various other image types we support, and then use image_high_addr as the lowest allowed address for the initrd. (We don't use image_low_addr, but we set it for consistency with the existing code path for ELF files.) Fixes: e6b2b20d9735d4ef Reported-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Mark Rutland <mark.rutland@arm.com> Message-id: 20190722151804.25467-3-peter.maydell@linaro.org
2019-07-26hw/arm/boot: Rename elf_{low, high}_addr to image_{low, high}_addrPeter Maydell1-9/+11
Rename the elf_low_addr and elf_high_addr variables to image_low_addr and image_high_addr -- in the next commit we will extend them to be set for other kinds of image file and not just ELF files. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Mark Rutland <mark.rutland@arm.com> Message-id: 20190722151804.25467-2-peter.maydell@linaro.org
2019-07-26stellaris_input: Fix vmstate description of buttons fieldPeter Maydell1-4/+6
gamepad_state::buttons is a pointer to an array of structs, not an array of structs, so should be declared in the vmstate with VMSTATE_STRUCT_VARRAY_POINTER_INT32; otherwise we corrupt memory on incoming migration. We bump the vmstate version field as the easiest way to deal with the migration break, since migration wouldn't have worked reliably before anyway. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com> Message-id: 20190725163710.11703-2-peter.maydell@linaro.org
2019-07-26pl330: fix vmstate descriptionDamien Hedde1-8/+9
Fix the pl330 main and queue vmstate description. There were missing POINTER flags causing crashes during incoming migration because: + PL330State chan field is a pointer to an array + PL330Queue queue field is a pointer to an array Also bump corresponding vmsd version numbers. Signed-off-by: Damien Hedde <damien.hedde@greensocs.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20190724143553.21557-1-damien.hedde@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-26Merge remote-tracking branch ↵Peter Maydell4-12/+69
'remotes/stefanberger/tags/pull-tpm-2019-07-25-1' into staging Merge tpm 2019/07/25 v1 # gpg: Signature made Thu 25 Jul 2019 16:40:54 BST # gpg: using RSA key 75AD65802A0B4211 # gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211 * remotes/stefanberger/tags/pull-tpm-2019-07-25-1: tpm_emulator: Translate TPM error codes to strings tpm: Exit in reset when backend indicates failure Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-25Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell3-67/+73
virtio, pc: fixes, cleanups A bunch of fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 25 Jul 2019 16:19:33 BST # gpg: using RSA key 281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-balloon: free pbp more aggressively virtio-balloon: don't track subpages for the PBP virtio-balloon: Use temporary PBP only virtio-balloon: Rework pbp tracking data virtio-balloon: Better names for offset variables in inflate/deflate code virtio-balloon: Simplify deflate with pbp virtio-balloon: Fix QEMU crashes on pagesize > BALLOON_PAGE_SIZE virtio-balloon: Fix wrong sign extension of PFNs i386/acpi: show PCI Express bus on pxb-pcie expanders ioapic: kvm: Skip route updates for masked pins i386/acpi: fix gint overflow in crs_range_compare docs: clarify multiqueue vs multiple virtqueues Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-25tpm_emulator: Translate TPM error codes to stringsStefan Berger2-10/+63
Implement a function to translate TPM error codes to strings so that at least the most common error codes can be translated to human readable strings. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2019-07-25virtio-balloon: free pbp more aggressivelyMichael S. Tsirkin1-21/+16
Previous patches switched to a temporary pbp but that does not go far enough: after device uses a buffer, guest is free to reuse it, so tracking the page and freeing it later is wrong. Free and reset the pbp after we push each element. Fixes: ed48c59875b6 ("virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size") Cc: qemu-stable@nongnu.org #v4.0.0 Cc: David Hildenbrand <david@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-25tpm: Exit in reset when backend indicates failureStefan Berger2-2/+6
Exit() in the frontend reset function when the backend indicates intialization failure. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2019-07-25virtio-balloon: don't track subpages for the PBPDavid Hildenbrand1-5/+3
As ramblocks cannot get removed/readded while we are processing a bulk of inflation requests, there is no more need to track the page size in form of the number of subpages. Suggested-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20190725113638.4702-8-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-25virtio-balloon: Use temporary PBP onlyDavid Hildenbrand1-12/+9
We still have multiple issues in the current code - The PBP is not freed during unrealize() - The PBP is not reset on device resets: After a reset, the PBP is stale. - We are not indicating VIRTIO_BALLOON_F_MUST_TELL_HOST, therefore guests (esp. legacy guests) will reuse pages without deflating, turning the PBP stale. Adding that would require compat handling. Instead, let's use the PBP only temporarily, when processing one bulk of inflation requests. This will keep guest_page_size > 4k working (with Linux guests). There is nothing to do for deflation requests anymore. The pbp is only used for a limited amount of time. Fixes: ed48c59875b6 ("virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size") Cc: qemu-stable@nongnu.org #v4.0.0 Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20190722134108.22151-7-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au>
2019-07-25virtio-balloon: Rework pbp tracking dataDavid Hildenbrand1-23/+46
Using the address of a RAMBlock to test for a matching pbp is not really safe. Instead, let's use the guest physical address of the base page along with the page size (via the number of subpages). Also, let's allocate the bitmap separately. This makes the code easier to read and maintain - we can reuse bitmap_new(). Prepare the code to move the PBP out of the device. Fixes: ed48c59875b6 ("virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size") Fixes: b27b32391404 ("virtio-balloon: Fix possible guest memory corruption with inflates & deflates") Cc: qemu-stable@nongnu.org #v4.0.0 Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20190722134108.22151-6-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-25virtio-balloon: Better names for offset variables in inflate/deflate codeDavid Hildenbrand1-13/+13
"host_page_base" is really confusing, let's make this clearer, also rename the other offsets to indicate to which base they apply. offset -> mr_offset ram_offset -> rb_offset host_page_base -> rb_aligned_offset While at it, use QEMU_ALIGN_DOWN() instead of a handcrafted computation and move the computation to the place where it is needed. Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20190722134108.22151-5-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-25virtio-balloon: Simplify deflate with pbpDavid Hildenbrand1-21/+5
Let's simplify this - the case we are optimizing for is very hard to trigger and not worth the effort. If we're switching from inflation to deflation, let's reset the pbp. Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20190722134108.22151-4-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-25virtio-balloon: Fix QEMU crashes on pagesize > BALLOON_PAGE_SIZEDavid Hildenbrand1-6/+4
We are using the wrong functions to set/clear bits, effectively touching multiple bits, writing out of range of the bitmap, resulting in memory corruptions. We have to use set_bit()/clear_bit() instead. Can easily be reproduced by starting a qemu guest on hugetlbfs memory, inflating the balloon. QEMU crashes. This never could have worked properly - especially, also pages would have been discarded when the first sub-page would be inflated (the whole bitmap would be set). While testing I realized, that on hugetlbfs it is pretty much impossible to discard a page - the guest just frees the 4k sub-pages in random order most of the time. I was only able to discard a hugepage a handful of times - so I hope that now works correctly. Fixes: ed48c59875b6 ("virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size") Fixes: b27b32391404 ("virtio-balloon: Fix possible guest memory corruption with inflates & deflates") Cc: qemu-stable@nongnu.org #v4.0.0 Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20190722134108.22151-3-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-25virtio-balloon: Fix wrong sign extension of PFNsDavid Hildenbrand1-1/+1
If we directly cast from int to uint64_t, we will first sign-extend to an int64_t, which is wrong. We actually want to treat the PFNs like unsigned values. As far as I can see, this dates back to the initial virtio-balloon commit, but wasn't triggered as fairly big guests would be required. Cc: qemu-stable@nongnu.org Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20190722134108.22151-2-david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2019-07-25Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell1-2/+5
Two more bugfix patches + 1 doc fix. # gpg: Signature made Wed 24 Jul 2019 10:22:06 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: docs: correct kconfig option i386/kvm: Do not sync nested state during runtime virtio-scsi: fixed virtio_scsi_ctx_check failed when detaching scsi disk Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-25i386/acpi: show PCI Express bus on pxb-pcie expandersEvgeny Yakovlev1-1/+4
Show PCIe host bridge PNP id with PCI host bridge as a compatible id when expanding a pcie bus. Cc: qemu-stable@nongnu.org Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru> Message-Id: <1563526469-15588-1-git-send-email-wrfsh@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2019-07-25ioapic: kvm: Skip route updates for masked pinsJan Kiszka1-3/+5
Masked entries will not generate interrupt messages, thus do no need to be routed by KVM. This is a cosmetic cleanup, just avoiding warnings of the kind qemu-system-x86_64: vtd_irte_get: detected non-present IRTE (index=0, high=0xff00, low=0x100) if the masked entry happens to reference a non-present IRTE. Cc: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Message-Id: <a84b7e03-f9a8-b577-be27-4d93d1caa1c9@siemens.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com>
2019-07-25i386/acpi: fix gint overflow in crs_range_compareEvgeny Yakovlev1-3/+9
When very large regions (32GB sized in our case, PCI pass-through of GPUs) are compared substraction result does not fit into gint. As a result crs_replace_with_free_ranges does not get sorted ranges and incorrectly computes PCI64 free space regions. Which then makes linux guest complain about device and PCI64 hole intersection and device becomes unusable. Fix that by returning exactly fitting ranges. Also fix indentation of an entire crs_replace_with_free_ranges to make checkpatch happy. Cc: qemu-stable@nongnu.org Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru> Message-Id: <1563466463-26012-1-git-send-email-wrfsh@yandex-team.ru> Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
2019-07-24virtio-scsi: fixed virtio_scsi_ctx_check failed when detaching scsi diskZhengui li1-2/+5
commit a6f230c move blockbackend back to main AioContext on unplug. It set the AioContext of SCSIDevice to the main AioContex, but s->ctx is still the iothread AioContex（if the scsi controller is configure with iothread）. So if there are having in-flight requests during unplug, a failing assertion happend. The bt is below: (gdb) bt #0 0x0000ffff86aacbd0 in raise () from /lib64/libc.so.6 #1 0x0000ffff86aadf7c in abort () from /lib64/libc.so.6 #2 0x0000ffff86aa6124 in __assert_fail_base () from /lib64/libc.so.6 #3 0x0000ffff86aa61a4 in __assert_fail () from /lib64/libc.so.6 #4 0x0000000000529118 in virtio_scsi_ctx_check (d=<optimized out>, s=<optimized out>, s=<optimized out>) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:246 #5 0x0000000000529ec4 in virtio_scsi_handle_cmd_req_prepare (s=0x2779ec00, req=0xffff740397d0) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:559 #6 0x000000000052a228 in virtio_scsi_handle_cmd_vq (s=0x2779ec00, vq=0xffff7c6d7110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:603 #7 0x000000000052afa8 in virtio_scsi_data_plane_handle_cmd (vdev=<optimized out>, vq=0xffff7c6d7110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi-dataplane.c:59 #8 0x000000000054d94c in virtio_queue_host_notifier_aio_poll (opaque=<optimized out>) at /home/qemu-4.0.0/hw/virtio/virtio.c:2452 assert(blk_get_aio_context(d->conf.blk) == s->ctx) failed. To avoid assertion failed, moving the "if" after qdev_simple_device_unplug_cb. In addition, to avoid another qemu crash below, add aio_disable_external before qdev_simple_device_unplug_cb, which disable the further processing of external clients when doing qdev_simple_device_unplug_cb. (gdb) bt #0 scsi_req_unref (req=0xffff6802c6f0) at hw/scsi/scsi-bus.c:1283 #1 0x00000000005294a4 in virtio_scsi_handle_cmd_req_submit (req=<optimized out>, s=<optimized out>) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:589 #2 0x000000000052a2a8 in virtio_scsi_handle_cmd_vq (s=s@entry=0x9c90e90, vq=vq@entry=0xffff7c05f110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi.c:625 #3 0x000000000052afd8 in virtio_scsi_data_plane_handle_cmd (vdev=<optimized out>, vq=0xffff7c05f110) at /home/qemu-4.0.0/hw/scsi/virtio-scsi-dataplane.c:60 #4 0x000000000054d97c in virtio_queue_host_notifier_aio_poll (opaque=<optimized out>) at /home/qemu-4.0.0/hw/virtio/virtio.c:2447 #5 0x00000000009b204c in run_poll_handlers_once (ctx=ctx@entry=0x6efea40, timeout=timeout@entry=0xffff7d7f7308) at util/aio-posix.c:521 #6 0x00000000009b2b64 in run_poll_handlers (ctx=ctx@entry=0x6efea40, max_ns=max_ns@entry=4000, timeout=timeout@entry=0xffff7d7f7308) at util/aio-posix.c:559 #7 0x00000000009b2ca0 in try_poll_mode (ctx=ctx@entry=0x6efea40, timeout=0xffff7d7f7308, timeout@entry=0xffff7d7f7348) at util/aio-posix.c:594 #8 0x00000000009b31b8 in aio_poll (ctx=0x6efea40, blocking=blocking@entry=true) at util/aio-posix.c:636 #9 0x00000000006973cc in iothread_run (opaque=0x6ebd800) at iothread.c:75 #10 0x00000000009b592c in qemu_thread_start (args=0x6efef60) at util/qemu-thread-posix.c:502 #11 0x0000ffff8057f8bc in start_thread () from /lib64/libpthread.so.0 #12 0x0000ffff804e5f8c in thread_start () from /lib64/libc.so.6 (gdb) p bus $1 = (SCSIBus *) 0x0 Signed-off-by: Zhengui li <lizhengui@huawei.com> Message-Id: <1563696502-7972-1-git-send-email-lizhengui@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1563829520-17525-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-07-23hw/i386: also turn off VMMOUSE is VMPORT is disabledAlex Bennée1-2/+2
Commit 97fd1ea8c1 broke the build for --without-default-devices as VMMOUSE depends on VMPORT. Fixes: 97fd1ea8c1 Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-07-23hw/block/pflash_cfi02: Rewrite a fall through commentPhilippe Mathieu-Daudé1-1/+1
GCC9 is confused by this comment when building with CFLAG -Wimplicit-fallthrough=2: hw/block/pflash_cfi02.c: In function ‘pflash_write’: hw/block/pflash_cfi02.c:574:16: error: this statement may fall through [-Werror=implicit-fallthrough=] 574 | if (boff == 0x55 && cmd == 0x98) { | ^ hw/block/pflash_cfi02.c:581:9: note: here 581 | default: | ^~~~~~~ cc1: all warnings being treated as errors Rewrite the comment using 'fall through' which is recognized by GCC and static analyzers. Reported-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20190719131425.10835-4-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-07-23hw/block/pflash_cfi01: Add missing DeviceReset() handlerPhilippe Mathieu-Daudé1-0/+19
To avoid incoherent states when the machine resets (see bug report below), add the device reset callback. A "system reset" sets the device state machine in READ_ARRAY mode and, after some delay, set the SR.7 READY bit. Since we do not model timings, we set the SR.7 bit directly. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1678713 Reported-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> [Laszlo Ersek: Regression tested EDK2 OVMF IA32X64, ArmVirtQemu Aarch64 https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg04373.html] Message-Id: <20190718104837.13905-2-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-07-22Merge remote-tracking branch ↵Peter Maydell2-46/+20
'remotes/pmaydell/tags/pull-target-arm-20190722' into staging target-arm queue: * target/arm: Add missing break statement for Hypervisor Trap Exception (fixes handling of SMC insn taken to AArch32 Hyp mode via HCR.TSC) * hw/arm/fsl-imx6ul.c: Remove dead SMP-related code * target/arm: Limit ID register assertions to TCG * configure: Clarify URL to source downloads * contrib/elf2dmp: Build download.o with CURL_CFLAGS # gpg: Signature made Mon 22 Jul 2019 14:13:31 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20190722: contrib/elf2dmp: Build download.o with CURL_CFLAGS configure: Clarify URL to source downloads target/arm: Limit ID register assertions to TCG hw/arm/fsl-imx6ul.c: Remove dead SMP-related code target/arm: Add missing break statement for Hypervisor Trap Exception Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-22hw/arm/fsl-imx6ul.c: Remove dead SMP-related codePeter Maydell2-46/+20
The i.MX6UL always has a single Cortex-A7 CPU (we set FSL_IMX6UL_NUM_CPUS to 1 in line with this). This means that all the code in fsl-imx6ul.c to handle multiple CPUs is dead code, and Coverity is now complaining that it is unreachable (CID 1403008, 1403011). Remove the unreachable code and the only-executes-once loops, and replace the single-entry cpu[] array in the FSLIMX6ULState with a simple cpu member. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190712115030.26895-1-peter.maydell@linaro.org
2019-07-19scsi-generic: Check sense key before request snooping and patchingShin'ichiro Kawasaki1-12/+16
When READ CAPACITY command completes, scsi_read_complete() function snoops the command result and updates SCSIDevice members blocksize and max_lba . However, this update is executed even when READ CAPACITY command indicates an error in sense data. This causes unexpected blocksize update with zero value for SCSI devices without READ CAPACITY(10) command support and eventually results in a divide by zero. An emulated device by TCMU-runner is an example of a device that doesn't support READ CAPACITY(10) command. To avoid the unexpected update, add sense key check in scsi_read_complete() function. The function already checks the sense key for VPD Block Limits emulation. Do the scsi_parse_sense_buf() call for all requests rather than just for VPD Block Limits emulation, so that blocksize and max_lba are only updated if READ CAPACITY returns zero sense key. Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> [Extend the check to all requests, not just READ CAPACITY] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-07-19vhost-user-scsi: Call virtio_scsi_common_unrealize() when device realize failedXie Yongji1-4/+10
This avoids memory leak when device hotplug is failed. Signed-off-by: Xie Yongji <xieyongji@baidu.com> Message-Id: <20190717004606.12444-2-xieyongji@baidu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.1 at 2024-12-25 05:08:05 +0000