Commit Graph

86294 Commits

Author SHA1 Message Date
John Snow
0f231dcf29 qapi/expr.py: Check for dict instead of OrderedDict
OrderedDict is a subtype of dict, so we can check for a more general
form. These functions do not themselves depend on it being any
particular type.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Message-Id: <20210421182032.3521476-4-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-04-30 12:59:54 +02:00
John Snow
b7341b89c9 qapi/expr.py: Remove 'info' argument from nested check_if_str
The function can just use the argument from the scope above. Otherwise,
we get shadowed argument errors because the parameter name clashes with
the name of a variable already in-scope.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Message-Id: <20210421182032.3521476-3-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-04-30 12:59:54 +02:00
John Snow
d0a263cdd0 qapi/expr: Comment cleanup
The linter yaps after 0825f62c84. Fix this trivial issue to restore the
linter baseline.

(Yes, ideally -- and soon -- the linter will be part of CI so we don't
clutter up the log with fixups. For now, though, the baseline is useful
for testing intermediate commits as types are added to the QAPI
library.)

Signed-off-by: John Snow <jsnow@redhat.com>
Message-Id: <20210421182032.3521476-2-jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-04-30 12:59:54 +02:00
Peter Maydell
ccdf06c1db Open 6.1 development tree
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-30 11:15:40 +01:00
Peter Maydell
609d759652 Update version for v6.0.0 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-29 18:05:29 +01:00
Peter Maydell
0cef06d187 Update version for v6.0.0-rc5 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-26 16:24:54 +01:00
Klaus Jensen
5351fb7cb2 hw/block/nvme: fix invalid msix exclusive uninit
Commit 1901b4967c changed the nvme device from using a bar exclusive
for MSI-x to sharing it on bar0.

Unfortunately, the msix_uninit_exclusive_bar() call remains in
nvme_exit() which causes havoc when the device is removed with, say,
device_del. Fix this.

Additionally, a subregion is added but it is not removed on exit which
causes a reference to linger and the drive to never be unlocked.

Fixes: 1901b4967c ("hw/block/nvme: move msix table and pba to BAR 0")
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-26 14:55:50 +01:00
Alex Bennée
ffa090bc56 target/s390x: fix s390_probe_access to check PAGE_WRITE_ORG for writeability
We can remove PAGE_WRITE when (internally) marking a page read-only
because it contains translated code. This can get confused when we are
executing signal return code on signal stacks.

Fixes: e56552cf07 ("target/s390x: Implement the MVPG condition-code-option bit")
Found-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-id: 20210422154427.13038-1-alex.bennee@linaro.org
Cc: Cornelia Huck <cohuck@redhat.com>
Cc: Thomas Huth <thuth@redhat.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-23 14:10:56 +01:00
Jason Wang
bc38e31b4e net: check the existence of peer before trying to pad
There could be case that peer is NULL. This can happen when during
network device hot-add where net device needs to be added first. So
the patch check the existence of peer before trying to do the pad.

Fixes: 969e50b61a ("net: Pad short frames to minimum size before sending from SLiRP/TAP")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Message-id: 20210423031803.1479-1-jasowang@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-23 11:11:28 +01:00
Peter Maydell
b1cffefa1b Update version for v6.0.0-rc4 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20 16:30:01 +01:00
Marc-André Lureau
bac9b87bd2 qga: fix guest-get-disks regression
Commit 54aa3de72 ("qapi: Use QAPI_LIST_PREPEND() where possible")
inadvertently removed the has_dependencies from the partition disk
info, resulting in empty list being returned.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1950833

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20210420125831.233092-1-marcandre.lureau@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20 16:27:45 +01:00
Philippe Mathieu-Daudé
ef71c1bc81 target/mips/rel6_translate: Change license to GNU LGPL v2.1 (or later)
When adding this file and its new content in commit 3f7a927847
("target/mips: LSA/DLSA R6 decodetree helpers") I did 2 mistakes:

1: Listed authors who haven't been involved in its development,
2: Used an incorrect GNU GPLv2 license text (using 'and' instead
   of 'or').

Instead of correcting the GNU GPLv2 license text, replace the license
by the 'GNU LGPL v2.1 or later' one, to be coherent with the other
translation files in the target/mips/ folder.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210420100633.1752440-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20 12:52:04 +01:00
Markus Armbruster
e11ce6c065 migration: Deprecate redundant query-migrate result @blocked
Result @blocked is true when and only when result @blocked-reasons is
present.  It's always non-empty when present.  @blocked is redundant.
It was introduced in commit 3af8554bd0 "migration: Add blocker
information", and has not been released.  This gives us a chance to
fix the interface with minimal fuss.

Unfortunately, we're already too close to the release to risk dropping
it.  Deprecate it instead.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 20210420051907.891470-1-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-20 10:50:34 +01:00
Michael Tokarev
3791642c8d mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)
While processing SCSI i/o requests in mptsas_process_scsi_io_request(),
the Megaraid emulator appends new MPTSASRequest object 'req' to
the 's->pending' queue. In case of an error, this same object gets
dequeued in mptsas_free_request() only if SCSIRequest object
'req->sreq' is initialised. This may lead to a use-after-free issue.

Since s->pending is actually not used, simply remove it from
MPTSASState.

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Message-id: 20210419134247.1467982-1-f4bug@amsat.org
Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392)
Fixes: e351b82611 ("hw: Add support for LSI SAS1068 (mptsas) device")
[PMD: Reworded description, added more tags]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-19 15:48:12 +01:00
Peter Maydell
0c5393a134 Fixes for rc4:
* Fix compile failures of C++ files with new glib headers
  * mps3-an547: Use correct Cortex-M55 CPU and don't disable its FPU
  * accel/tcg: Fix assertion failure executing from non-RAM with -icount
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmB7OY4ZHHBldGVyLm1h
 eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3tG9EACDzCnu0pfeizTDmemgdoxR
 aWYcr/vl0sPpA1wXlGFurtRX1dTeVcX+aA0qH752jLXzfNYYR7X1QDCqOn4XTMJk
 hACCyDBc1J0lHCrvgAEkx6A8yoSn2yaT27uoMvgeU5qX88/wOBIeZbH5Gti/BrIr
 hg5yg0IiQnCqFu897WPo4+F8sjvOaJEcPy7E0LhUzES6IiKWGfonKQh+QNI/1hsz
 Q4wtSSQSsACrnWIL9kcmjtNjrO0nY4tk3v7hgeLJq7bMZ2yOQ/h6A570o//AfUti
 pr1XaviCtpJDjeP3/gmyEPtIhjGzPX1GDdaX9+Ptr0qmwDj7Ygzel9NJrQklWvHY
 EDN5JeGp9yrashCYrgQHNO236f3+8OvXhVSNEcnlViV8naSaw4XL8vAAQN6Qp8tB
 BVuV+r+i5DQxl3O2ILu5mLdhi65sAzaRdHGPhQXeUb0OWviWDBX7G4scnWik2qSy
 LwUWSAtU+G7/4nY+AvA1d2Q+/viTZ4IgpAm/AvAlcUevCOGcF2LT7hCnk1isdX2S
 nZ0UPmi3DbUG358ipi8nZKvgRCTHofsMJXxmx3p+WPy9AEnKep9SEYFeH33bfnNP
 cSlBRn9JjHvr7vO0cOmRAmvjQMK4ioxCl7LlDR1/KPEwWFzdZAD1Yx3JhqXaxpcw
 g+PADYJHQej3JDpHyRtsZA==
 =/6nB
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210417' into staging

Fixes for rc4:
 * Fix compile failures of C++ files with new glib headers
 * mps3-an547: Use correct Cortex-M55 CPU and don't disable its FPU
 * accel/tcg: Fix assertion failure executing from non-RAM with -icount

# gpg: Signature made Sat 17 Apr 2021 20:39:58 BST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20210417:
  accel/tcg: avoid re-translating one-shot instructions
  target/arm: drop CF_LAST_IO/dc->condjump check
  hw/arm/armsse: Make SSE-300 use Cortex-M55
  hw/arm/armsse: Give SSE-300 its own Property array
  include/qemu/osdep.h: Move system includes to top
  osdep: protect qemu/osdep.h with extern "C"
  osdep: include glib-compat.h before other QEMU headers

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17 20:47:32 +01:00
Alex Bennée
277aed998a accel/tcg: avoid re-translating one-shot instructions
By definition a single instruction is capable of being an IO
instruction. This avoids a problem of triggering a cpu_io_recompile on
a non-recorded translation which then fails because it expects
tcg_tb_lookup() to succeed unconditionally. The normal use case
requires a TB to be able to resolve machine state.

The other users of tcg_tb_lookup() are able to tolerate a missing TB
if the machine state has been resolved by other means - which in the
single-shot case is always true because machine state is synced at the
start of a block.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210415162454.22056-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17 18:51:14 +01:00
Alex Bennée
c57b27ea89 target/arm: drop CF_LAST_IO/dc->condjump check
This is a left over erroneous check from the days front-ends handled
io start/end themselves. Regardless just because IO could be performed
on the last instruction doesn't obligate the front end to do so.

This fixes an abort faced by the aspeed execute-in-place support which
will necessarily trigger this state (even before the one-shot
CF_LAST_IO fix). The test still seems to hang once it attempts to boot
the Linux kernel but I suspect this is an unrelated issue with icount
and the timer handling code.

The original intention of the cpu_abort (added in commit 2e70f6efa8
when the icount stuff was first added) seems to have been to act as
an assert() to catch an unhandled corner case where the generated code
would be something like:
    conditional branch to condlabel if its cc failed
    implementation of the insn (a conditional branch or trap)
    code emitted by gen_io_end()
 condlabel:
    gen_goto_tb or equivalent thing to go to next insn

At runtime the cc-failed case would skip over the code emitted by
gen_io_end(), leaving the can_do_io flag incorrectly set.

In commit ba3e792669 we switched to an implementation which
always clears can_do_io at the start of the following TB instead
of trying to clear it at the end of a TB that did IO. So the corner
case that this cpu_abort() was trying to flag is no longer possible,
because the gen_io_end() call has been deleted. We can therefore
safely remove the no-longer-valid assertion.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210416170207.12504-1-alex.bennee@linaro.org
Cc: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17 18:48:05 +01:00
Peter Maydell
330ef14e6e hw/arm/armsse: Make SSE-300 use Cortex-M55
The SSE-300 has a Cortex-M55 (which was the whole reason for us
modelling it), but we forgot to actually update the code to let it
have a different CPU type from the IoTKit and SSE-200.  Add CPU type
as a field for ARMSSEInfo instead of hardcoding it to always use a
Cortex-M33.

Buglink: https://bugs.launchpad.net/qemu/+bug/1923861
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210416104010.13228-1-peter.maydell@linaro.org
2021-04-17 18:47:11 +01:00
Peter Maydell
1df0878cff hw/arm/armsse: Give SSE-300 its own Property array
SSE-300 currently shares the SSE-200 Property array. This is
bad principally because the default values of the CPU0_FPU
and CPU0_DSP properties disable the FPU and DSP on the CPU.
That is correct for the SSE-200 but not the SSE-300.
Give the SSE-300 its own Property array with the correct
SSE-300 specific settings:
 * SSE-300 has only one CPU, so no CPU1* properties
 * SSE-300 CPU has FPU and DSP

Buglink: https://bugs.launchpad.net/qemu/+bug/1923861
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210415182353.8173-1-peter.maydell@linaro.org
2021-04-17 18:46:45 +01:00
Peter Maydell
ec63ca2d35 include/qemu/osdep.h: Move system includes to top
Mostly osdep.h puts the system includes at the top of the file; but
there are a couple of exceptions where we include a system header
halfway through the file.  Move these up to the top with the rest
so that all the system headers we include are included before
we include os-win32.h or os-posix.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210416135543.20382-4-peter.maydell@linaro.org
Message-id: 20210414184343.26235-1-peter.maydell@linaro.org
2021-04-17 18:44:30 +01:00
Paolo Bonzini
875df03b22 osdep: protect qemu/osdep.h with extern "C"
System headers may include templates if compiled with a C++ compiler,
which cause the compiler to complain if qemu/osdep.h is included
within a C++ source file's 'extern "C"' block.  Add
an 'extern "C"' block directly to qemu/osdep.h, so that
system headers can be kept out of it.

There is a stray declaration early in qemu/osdep.h, which needs
to be special cased.  Add a definition in qemu/compiler.h to
make it look nice.

config-host.h, CONFIG_TARGET, exec/poison.h and qemu/compiler.h
are included outside the 'extern "C"' block; that is not
an issue because they consist entirely of preprocessor directives.

This allows us to move the include of osdep.h in our two C++
source files outside the extern "C" block they were previously
using for it, which in turn means that they compile successfully
against newer versions of glib which insist that glib.h is
*not* inside an extern "C" block.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210416135543.20382-3-peter.maydell@linaro.org
[PMM: Moved disas/arm-a64.cc osdep.h include out of its extern "C" block;
 explained in commit message why we're doing this]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17 18:44:30 +01:00
Paolo Bonzini
af1bb59c07 osdep: include glib-compat.h before other QEMU headers
glib-compat.h is sort of like a system header, and it needs to include
system headers (glib.h) that may dislike being included under
'extern "C"'.  Move it right after all system headers and before
all other QEMU headers.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210416135543.20382-2-peter.maydell@linaro.org
[PMM: Added comment about why glib-compat.h is special]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-17 18:44:30 +01:00
Peter Maydell
8fe9f1f891 Update version for v6.0.0-rc3 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-14 22:06:18 +01:00
Thomas Huth
438c61e086 qapi/qom.json: Do not use CONFIG_VIRTIO_CRYPTO in common code
The ObjectType enum and ObjectOptions are included from qapi-types-qom.h
into common code. We should not use target-specific config switches like
CONFIG_VIRTIO_CRYPTO here, since this is not defined in common code and
thus the enum will look differently between common and target specific
code. For this case, it's hopefully enough to check for CONFIG_VHOST_CRYPTO
only (which is a host specific config switch, i.e. it's the same on all
targets).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20210412160710.639800-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-14 19:20:40 +01:00
Peter Maydell
3ddb05dbf2 virtiofs: Fix feature negotiation (for 6.0)
A 6.0 fix for feature negotiation on vhost-user.
 
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEERfXHG0oMt/uXep+pBRYzHrxb/ecFAmB1twUACgkQBRYzHrxb
 /efZuhAAnQCi57cDXg+Pnr76VtYVXslemLK32H91rcyXUTsrQPZ0/hk7qspQeCsS
 hdg7+QCoK4ufoX7qX9dbDZD9BWOr7BAvR7rOuk6tvmo2aow30sT0DxoqsK1ycbjB
 X8KDZDRpEfis0p5QhI9HwA23pDGsLovJAfOrmUBkpI2acybznzyw0D++/ctAiLqW
 TLIzIpEDPfE0xxeUb7jmWPY4zxdDSnWv+12uW1lNjSCc/PSTPYTfUgFljyxsqamj
 SP//aP672scEXJGDFVQu0rnSjqQ2uDs7r06LA6pcHMTYRiritXHH3BvHl0rp7dSO
 QE/hD9V/OF7JbsOk2myGX2nOvMyl4KV0FjsJ23ANZWKdvgxhIb1CSWRQNObqQf1q
 1lOVch+I+b1IQZdlONmBFnI1Y3/7CyuOBMg++ummHY09edZuiOJPwcnkbJVKrJxm
 GXqGJbdrfuZBdfpZgZIENZ/Z6sG4t/TeUTFOXt2pa0YFScNlFPz8jFDc0LTYOYzW
 0EuAWRu0hxf/EkEliBVB22xIL0CNVV4UD5q02BDbnHURdpuUYgRYV6WTeNmTztDI
 QzgElubiSW5cyOmIguM5tfDjrw/f45qH81xnX8nmtaX7LucmYLp9BL0psD9mqspS
 r3jJmjoCbmX7i9PPO4sWBQ9si+wOgNoxTUr5aeMSDf5hSEW2Q2Q=
 =BCa6
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413' into staging

virtiofs: Fix feature negotiation (for 6.0)

A 6.0 fix for feature negotiation on vhost-user.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

# gpg: Signature made Tue 13 Apr 2021 16:21:41 BST
# gpg:                using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert-gitlab/tags/pull-virtiofs-20210413:
  vhost-user-fs: fix features handling

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13 22:12:27 +01:00
Peter Maydell
db55d2c923 Block patches for 6.0-rc3:
- Use-after-free fix for block/nbd.c
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEkb62CjDbPohX0Rgp9AfbAGHVz0AFAmB1njQSHG1yZWl0ekBy
 ZWRoYXQuY29tAAoJEPQH2wBh1c9AMQUH/1JDtN+Sax5exC6RUbrraoo3akWHM7kj
 cU/setlBtFV7ovyhhQ74GCOy9uu23/uCluJIaCMriZgDkWo+stV6EM6KHND4hOiV
 mOW16+h5WkVOp521igMaXLrZ+MyXvTbOXtRKWEITZV49qAP0Qwyfg0T++VjMTSPB
 TYhM+tkC2wcIcE3Qwj2YFy9KCIWXOBVREvJycBHN2j7+OB+ngD5NW+qfh/bmzG8M
 0pD1qG+ye17rbXOSC60HrgPkVZr+NymROTVSjmEol59BowyIFlw3+ZChN/ti/A05
 irpogp6/nZWrceVJfbISDi7SBRZbYfCI7gNCPJRY3Hx031krkD3ox1w=
 =7zEh
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-04-13' into staging

Block patches for 6.0-rc3:
- Use-after-free fix for block/nbd.c

# gpg: Signature made Tue 13 Apr 2021 14:35:48 BST
# gpg:                using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg:                issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* remotes/maxreitz/tags/pull-block-2021-04-13:
  block/nbd: fix possible use after free of s->connect_thread

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13 21:05:17 +01:00
Peter Maydell
1b66515334 target-arm queue:
* Fix MPC setting for AN524 SRAM block
  * sphinx: qapidoc: Wrap "If" section body in a paragraph node
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmB1iXAZHHBldGVyLm1h
 eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3uofD/0UFqe/2dMyNjNMqCz2AN5q
 VFFrUXzdnpKCAbr/jZRlxe4JKmEVlrx9Az9SGjcsWFwL6KD72GK2ASsQGnijKcqp
 YpK/2qb8EZsNjo8yh4VAQw396sSrcqB8l/ebYsesClU6lJ4AfClHhNFRG2fddbe4
 NGh3ohxnHP1X7dcPsv/BMPHiyluf2JNVmlDHEf7OhQpZemgbLvz7RhCPz07cRnKw
 ghsi5LSEht9c9fRyZClWQBD3xf3Lfw7z2s2kgwIAbsi05cnjmdxcJ1WBzzMONBEj
 AkVdvZhgBXaenNPl7A5UumF4Gyh1kMjoeDJ4YkEMG73h2zx/+vsEBEa22yRJwK0g
 sHsnYzARx3KF/JtRMVQrlG5VPLYvoAm1rdm+EtfSznJ0DuyU6yrJuFBUddOwlJLS
 7lNsbd6mx5ZRokyqddJT353e/IYHQ1C198DV4i+/e1SilOdStZsHzMoi3edqrKKw
 g1/4tqaeuHgfpfhUuvUIF4JUH9AdvIeSFPqTRUIYNtLuXsrtpl4gWSPXyYHOiQmW
 f2YLO5WqOtn1g1h8CizhH2Lsc4LL9+j22xzCUhbguy5SDcuHMLfCyCRjVMwz79kB
 efnBD0KwUp7+qPbUAEcRMFQVIlZcfBx/hEuNJGIOWT1Ui9XMgmGa7S4MWSu1PL4G
 i0JbWCrf0bykN20hsH/iMw==
 =YniI
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210413' into staging

target-arm queue:
 * Fix MPC setting for AN524 SRAM block
 * sphinx: qapidoc: Wrap "If" section body in a paragraph node

# gpg: Signature made Tue 13 Apr 2021 13:07:12 BST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20210413:
  sphinx: qapidoc: Wrap "If" section body in a paragraph node
  hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPC
  hw/arm/mps2-tz: Fix MPC setting for AN524 SRAM block

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13 17:08:13 +01:00
Anton Kuchin
ace66791cd vhost-user-fs: fix features handling
Make virtio-fs take into account server capabilities.

Just returning requested features assumes they all of then are implemented
by server and results in setting unsupported configuration if some of them
are absent.

Signed-off-by: Anton Kuchin <antonkuchin@yandex-team.ru>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
  With changes suggested by Stefan
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-13 16:13:41 +01:00
Vladimir Sementsov-Ogievskiy
0267101af6 block/nbd: fix possible use after free of s->connect_thread
If on nbd_close() we detach the thread (in
nbd_co_establish_connection_cancel() thr->state becomes
CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use
s->connect_thread (which is set to NULL), as running thread may free it
at any time.

Still nbd_co_establish_connection() does exactly this: it saves
s->connect_thread to local variable (just for better code style) and
use it even after yield point, when thread may be already detached.

Fix that. Also check thr to be non-NULL on
nbd_co_establish_connection() start for safety.

After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes
impossible in the second switch in nbd_co_establish_connection().
Still, don't add extra abort() just before the release. If it somehow
possible to reach this "case:" it won't hurt. Anyway, good refactoring
of all this reconnect mess will come soon.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210406155114.1057355-1-vsementsov@virtuozzo.com>
Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2021-04-13 15:35:12 +02:00
Peter Maydell
2935f6f2c1 MIPS patches queue
- Fix invalid Kconfig dependency
 - Fix missing migrated value
 - Fix TCG temporary leak
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmB1bgMACgkQ4+MsLN6t
 wN7wlQ/9FMNjEaYnVUCsyGrxG9r2xxa9Cy55WHJly0woYs0SoqnpybbCW8LiAy5H
 HEDUItr3a4omh1ixaeqYDANYSa/u7duyyk3gxNizFTj19TUalM0bd9edNgwvZTvU
 U8I4GsD87RSuvLBzP+eg46XoMBWwuS4RF35dMN/NoK/Wrl24wwrJXhsv2ALwhS/F
 L/4e9/GO6B5Cz0eNeZPWSVFCrGupZf7dw5g6+k39a2W74G+iW1EGe4/rAhGsG2Vb
 yJOvZjuI3RGlWpdebTGBxEv4GQgvuiG5lf9Gtz/WaJbpcyOXvGY75jiQScz4hsGM
 O+avkY8Fi7ERLxt/r/prxj1bgUOym6LDPSBkHqiz30+ehNbigNRYjQaHQFEQqnUs
 37MN5XEd0j0NfBr0XVHy0oZmv/+Z9v/3BFifsKcj4fd+u6NhJIbMgIhUOgiu/xHm
 g4b4cZEGFeqAEcR6LEaOmYTGsluvf1tcqJTanvXkXRu/T5bJy+jQXlOHQnbfhvnl
 bHcZRDoDrCHbRrpPyBT3kDyoack5dH7PuV7EzSLqSANei1eHf9c2zcZDPMLVG5q5
 /7kAWz91+o38TRk+UL70rluwttABCjv3jZ+YepuXsKZieAjyEdBlW6hyopasvHWc
 SR6YXUcArS965/74ff2LDCA/3xLMR9b16NI/JS0wfu191MCgHhU=
 =YFeO
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/philmd/tags/mips-20210413' into staging

MIPS patches queue

- Fix invalid Kconfig dependency
- Fix missing migrated value
- Fix TCG temporary leak

# gpg: Signature made Tue 13 Apr 2021 11:10:11 BST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd/tags/mips-20210413:
  target/mips: Fix TCG temporary leak in gen_cache_operation()
  hw/isa/piix4: Migrate Reset Control Register
  hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APM

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13 14:32:44 +01:00
Peter Maydell
dce628a97f ppc patch queue for 2021-04-21
Here's what I hope is the last ppc related pull request for qemu-6.0.
 
 The 2 patches here revert a behavioural change that after further
 discussion we concluded was a bad idea (adding a timeout for
 possibly-failed hot unplug requests).  Instead it implements a
 different approach to the original problem: we again let unplug
 requests the guest doesn't respond to remain pending indefinitely, but
 no longer allow those to block attempts to retry the same unplug
 again.
 
 The change is a bit more complex than I'd like for this late in the
 freeze.  Nonetheless, I think it's important to merge this for 6.0, so
 we don't allow a release which has the probably-a-bad-idea timeout
 behaviour.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEdfRlhq5hpmzETofcbDjKyiDZs5IFAmBz2eYACgkQbDjKyiDZ
 s5L1bw//XYKENrHBOgP7TCU+q2895PpCn5jxarPMrpX1fee1mlu+ncskZtlMQr8b
 C8zaWiUO9V6ezknVvqTe/4Wx+DmahGyrHwJQ/Fqj6o7C+057jEumPqBTuQFrNwz+
 4noougivOn1bVR5+vwDqAvNvO2xe49RPVd3kchHUe6tYHEa/k2kwqHeSFLZtm52R
 MusDWOD8FTxfY5uIy2LH4i2/Qe4PMn7by9ZJuldDAegHP4qn+Ffv5fO3a+HlDpOC
 KLwIub/PkLl5dtP4lru+PDgIpYwzdzZBDT/wb+OCspb4/ujqufJixt9DglnWQjEW
 3MwNK8ZnaiyrC8v9mFHzmcIJaRFQE55cr8bviB1SupJYJKB5YKuWMKKA+5E3LUuV
 VEbGzdcjP8xv0F7GzARsj8tt5iH54UJYbWLVxNy33tIfLbBrdbOH28DRhnKNZ3Y8
 f8Tz4VOKrqFL2ybQXOmSpitf5/h0nUMFRt2jZdhZLhcQ09b49k9loxPGAQoqB3aW
 HuIF3JSWnyAfFRxQjTsjzBDlgGQlghUEKj0fAqIx6SBhWJq5fg+nJ5hM1BEZIKfa
 gsy/Whs458YcSS/ArPPJ3vWC/RU8JvAAQcgSQF4AAAu/3h4FVnPCJGE8d7Jdsqdr
 KK8Y4y1PsXg7Ar7L1qTGJNzM4PKaAh4m8Mm8LLp6sVr4bAOl654=
 =fIJT
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210412' into staging

ppc patch queue for 2021-04-21

Here's what I hope is the last ppc related pull request for qemu-6.0.

The 2 patches here revert a behavioural change that after further
discussion we concluded was a bad idea (adding a timeout for
possibly-failed hot unplug requests).  Instead it implements a
different approach to the original problem: we again let unplug
requests the guest doesn't respond to remain pending indefinitely, but
no longer allow those to block attempts to retry the same unplug
again.

The change is a bit more complex than I'd like for this late in the
freeze.  Nonetheless, I think it's important to merge this for 6.0, so
we don't allow a release which has the probably-a-bad-idea timeout
behaviour.

# gpg: Signature made Mon 12 Apr 2021 06:25:58 BST
# gpg:                using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full]
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full]
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full]
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown]
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dg-gitlab/tags/ppc-for-6.0-20210412:
  spapr.c: always pulse guest IRQ in spapr_core_unplug_request()
  spapr: rollback 'unplug timeout' for CPU hotunplugs

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13 13:05:07 +01:00
Philippe Mathieu-Daudé
f4349ba966 target/mips: Fix TCG temporary leak in gen_cache_operation()
Fix a TCG temporary leak when translating CACHE opcode.

Fixes: 0d74a222c2 ("make ITC Configuration Tags accessible to the CPU")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20210406202857.1440744-1-f4bug@amsat.org>
2021-04-13 12:07:00 +02:00
Philippe Mathieu-Daudé
62271205bc hw/isa/piix4: Migrate Reset Control Register
When adding the Reset register in commit 5790b757cf we
forgot to migrate it.

While it is possible a VM using the PIIX4 is migrated just
after requesting a system shutdown, it is very unlikely.
However when restoring a migrated VM, we might have the
RCR bit #4 set on the stack and when the VM resume it
directly shutdowns.

Add a post_load() migration handler and set the default
RCR value to 0 for earlier versions, assuming the VM was
not going to shutdown before migration.

Fixes: 5790b757cf ("piix4: Add the Reset Control Register")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20210324200334.729899-1-f4bug@amsat.org>
2021-04-13 12:06:59 +02:00
Philippe Mathieu-Daudé
50fab4cc67 hw/isa/Kconfig: Add missing dependency VIA VT82C686 -> APM
TYPE_VIA_PM calls apm_init() in via_pm_realize(), so
requires APM to be selected.

Reported-by: BALATON Zoltan <balaton@eik.bme.hu>
Fixes: dd0ff8191a ("isa: express SuperIO dependencies with Kconfig")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210302080531.913802-1-f4bug@amsat.org>
2021-04-13 12:06:46 +02:00
Peter Maydell
1a66dab9dd qemu-sparc queue
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEzGIauY6CIA2RXMnEW8LFb64PMh8FAmB0xfgeHG1hcmsuY2F2
 ZS1heWxhbmRAaWxhbmRlLmNvLnVrAAoJEFvCxW+uDzIfoYsH/AgSa1ReFBRqa227
 cjdD2KRhYDA4HLj2ukaLAEtgbz57RfNyrBtEDkLcgN+lFjBlWB/1QZDTWA844OZb
 CkBm83jNMIXFpXknXBcMwGDJ7Yrnr1Cjc2AZwifyKswN7ILDtg1qsxu+aEO+L8v6
 YysH8aqxxet4tjFLTS1tYFzPzb2W1dMrNR/fLYFYY5rjgW04UNZIHqw66lOkkGBH
 wyO9dHr371B6b/40a99NBPOlxO/qfQCvIwk2FagmxBBmABRbWp8SIrNSDosFJ2md
 LdeVukGaIexI5ylIn+bvTuoJcuuTIoqaiUd1KdrHptvt2sH3UUGE6hBRWso9saJL
 1wZ3SI4=
 =O+4q
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20210412' into staging

qemu-sparc queue

# gpg: Signature made Mon 12 Apr 2021 23:13:12 BST
# gpg:                using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F
# gpg:                issuer "mark.cave-ayland@ilande.co.uk"
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full]
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-sparc-20210412:
  tests/qtest: add tests for am53c974 device
  esp: ensure that do_cmd is set to zero before submitting an ESP select command
  esp: don't reset async_len directly in esp_select() if cancelling request
  esp: don't overflow cmdfifo if TC is larger than the cmdfifo size
  esp: don't overflow cmdfifo in get_cmd()
  esp: don't underflow cmdfifo in do_cmd()
  esp: ensure cmdfifo is not empty and current_dev is non-NULL
  esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf()
  esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop()
  esp: consolidate esp_cmdfifo_push() into esp_fifo_push()
  esp: rework write_response() to avoid using the FIFO for DMA transactions
  esp: always check current_req is not NULL before use in DMA callbacks
  esp: fix setting of ESPState mig_version_id when launching QEMU with -S option

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13 11:00:34 +01:00
John Snow
2d18b4ca02 sphinx: qapidoc: Wrap "If" section body in a paragraph node
These sections need to be wrapped in a block-level element, such as
Paragraph in order for them to be rendered into Texinfo correctly.

Before (e.g.):

<section ids="qapidoc-713">
  <title>If</title>
  <literal>defined(CONFIG_REPLICATION)</literal>
</section>

became:

  .SS If
  \fBdefined(CONFIG_REPLICATION)\fP.SS \fBBlockdevOptionsReplication\fP (Object)
  ...

After:

<section ids="qapidoc-713">
  <title>If</title>
  <paragraph>
    <literal>defined(CONFIG_REPLICATION)</literal>
  </paragraph>
</section>

becomes:

  .SS If
  .sp
  \fBdefined(CONFIG_REPLICATION)\fP
  .SS \fBBlockdevOptionsReplication\fP (Object)
  ...

Reported-by: Markus Armbruster <armbru@redhat.com>
Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210406141909.1992225-2-jsnow@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-13 10:14:58 +01:00
Mark Cave-Ayland
ce94fa7aa6 tests/qtest: add tests for am53c974 device
Use the autogenerated fuzzer test cases as the basis for a set of am53c974
regression tests.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-13-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:37:11 +01:00
Mark Cave-Ayland
607206948c esp: ensure that do_cmd is set to zero before submitting an ESP select command
When a CDB has been received and is about to be submitted to the SCSI layer
via one of the ESP select commands, ensure that do_cmd is set to zero before
executing the command.

Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI
.transfer_data callback again before do_cmd is set to zero by the callback
function triggering an assert at the start of esp_transfer_data().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:35:53 +01:00
Mark Cave-Ayland
324c880989 esp: don't reset async_len directly in esp_select() if cancelling request
Instead let the SCSI layer invoke the .cancel callback itself to cancel and
reset the request state.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210407195801.685-11-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:35:53 +01:00
Mark Cave-Ayland
0ebb5fd805 esp: don't overflow cmdfifo if TC is larger than the cmdfifo size
If a guest transfers the message out/command phase data using DMA with a TC
that is larger than the cmdfifo size then the cmdfifo overflows triggering
an assert. Limit the size of the transfer to the free space available in
cmdfifo.

Buglink: https://bugs.launchpad.net/qemu/+bug/1919036
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-10-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:35:53 +01:00
Mark Cave-Ayland
fbc6510e33 esp: don't overflow cmdfifo in get_cmd()
If the guest tries to read a CDB using DMA and cmdfifo is not empty then it is
possible to overflow cmdfifo.

Since this can only occur by issuing deliberately incorrect instruction
sequences, ensure that the maximum length of the CDB transferred to cmdfifo is
limited to the available free space within cmdfifo.

Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-9-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:35:53 +01:00
Mark Cave-Ayland
fa7505c154 esp: don't underflow cmdfifo in do_cmd()
If the guest tries to execute a CDB when cmdfifo is not empty before the start
of the message out phase then clearing the message out phase data will cause
cmdfifo to underflow due to cmdfifo_cdb_offset being larger than the amount of
data within.

Since this can only occur by issuing deliberately incorrect instruction
sequences, ensure that the maximum length of esp_fifo_pop_buf() is limited to
the size of the data within cmdfifo.

Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-8-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:35:53 +01:00
Mark Cave-Ayland
9954575173 esp: ensure cmdfifo is not empty and current_dev is non-NULL
When about to execute a SCSI command, ensure that cmdfifo is not empty and
current_dev is non-NULL. This can happen if the guest tries to execute a TI
(Transfer Information) command without issuing one of the select commands
first.

Buglink: https://bugs.launchpad.net/qemu/+bug/1910723
Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-7-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:35:53 +01:00
Mark Cave-Ayland
7b320a8e67 esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf()
The const pointer returned by fifo8_pop_buf() lies directly within the array used
to model the FIFO. Building with address sanitizers enabled shows that if the
caller expects a minimum number of bytes present then if the FIFO is nearly full,
the caller may unexpectedly access past the end of the array.

Introduce esp_fifo_pop_buf() which takes a destination buffer and performs a
memcpy() in it to guarantee that the caller cannot overwrite the FIFO array and
update all callers to use it. Similarly add underflow protection similar to
esp_fifo_push() and esp_fifo_pop() so that instead of triggering an assert()
the operation becomes a no-op.

Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210407195801.685-6-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:35:19 +01:00
Mark Cave-Ayland
c5fef9112b esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop()
Each FIFO currently has its own pop functions with the only difference being
the capacity check. The original reason for this was that the fifo8
implementation doesn't have a formal API for retrieving the FIFO capacity,
however there are multiple examples within QEMU where the capacity field is
accessed directly.

Change esp_fifo_pop() to access the FIFO capacity directly and then consolidate
esp_cmdfifo_pop() into esp_fifo_pop().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-5-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:34:02 +01:00
Mark Cave-Ayland
e5455b8c1c esp: consolidate esp_cmdfifo_push() into esp_fifo_push()
Each FIFO currently has its own push functions with the only difference being
the capacity check. The original reason for this was that the fifo8
implementation doesn't have a formal API for retrieving the FIFO capacity,
however there are multiple examples within QEMU where the capacity field is
accessed directly.

Change esp_fifo_push() to access the FIFO capacity directly and then consolidate
esp_cmdfifo_push() into esp_fifo_push().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-4-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:34:02 +01:00
Mark Cave-Ayland
e392255766 esp: rework write_response() to avoid using the FIFO for DMA transactions
The code for write_response() has always used the FIFO to store the data for
the status/message in phases, even for DMA transactions. Switch to using a
separate buffer that can be used directly for DMA transactions and restrict
the FIFO use to the non-DMA case.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210407195801.685-3-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:33:50 +01:00
Mark Cave-Ayland
0db895361b esp: always check current_req is not NULL before use in DMA callbacks
After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel
callback which resets both current_req and current_dev to NULL. If any data
is left in the transfer buffer (async_len != 0) then the next TI (Transfer
Information) command will attempt to reference the NULL pointer causing a
segfault.

Buglink: https://bugs.launchpad.net/qemu/+bug/1910723
Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-2-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:33:33 +01:00
Mark Cave-Ayland
ff4a1daba6 esp: fix setting of ESPState mig_version_id when launching QEMU with -S option
If QEMU is launched with the -S option then the ESPState mig_version_id property
is left unset due to the ordering of the VMState fields in the VMStateDescription
for sysbusespscsi and pciespscsi. If the VM is migrated and restored in this
stopped state, the version tests in the vmstate_esp VMStateDescription and
esp_post_load() become confused causing the migration to fail.

Fix the ordering problem by moving the setting of mig_version_id to a common
esp_pre_save() function which is invoked first by both sysbusespscsi and
pciespscsi rather than at the point where ESPState is itself serialised into the
migration stream.

Buglink: https://bugs.launchpad.net/qemu/+bug/1922611
Fixes: 0bd005be78 ("esp: add vmstate_esp version to embedded ESPState")
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20210407124842.32695-1-mark.cave-ayland@ilande.co.uk>
2021-04-12 22:31:24 +01:00
Peter Maydell
91c0a79891 hw/arm/mps2-tz: Assert if more than one RAM is attached to an MPC
Each board in mps2-tz.c specifies a RAMInfo[] array providing
information about each RAM in the board.  The .mpc field of the
RAMInfo struct specifies which MPC, if any, the RAM is attached to.
We already assert if the array doesn't have any entry for an MPC, but
we don't diagnose the error of using the same MPC number twice (which
is quite easy to do by accident if copy-and-pasting structure
entries).

Enhance find_raminfo_for_mpc() so that it detects multiple entries
for the MPC as well as missing entries.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210409150527.15053-3-peter.maydell@linaro.org
2021-04-12 15:57:38 +01:00