Merge tag 'vfio-updates-20220927.1' of https://gitlab.com/alex.williamson/qemu into staging

VFIO updates 2022-09-27

 * Fix initial values for migration state (Kunkun Jiang)

 * Fix a use-after-free error path (Alex Williamson)

# -----BEGIN PGP SIGNATURE-----
#
# iQJPBAABCAA5FiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmMzXKwbHGFsZXgud2ls
# bGlhbXNvbkByZWRoYXQuY29tAAoJECObm247sIsiOv8QAKJstXXq92FxT+wBXt0Q
# wnMJjE1hvCHXki7FfPSRPmVgoMppWD1vhr7TajeOkidtqnX48V863/RGZfxX+oQU
# bEPPT6QaWnYhagslrRjIj4R+5O5N6rY9A2zzpG2vv1x9qv8r9WLicKvwjzinTgAp
# PyU9Ajgu2OUpD6O64iXIeD2MnfblSN3N+bBvZ7alDifFC1D8CfX9D3X76bdERC6X
# LFEenZ/3ZwZh46z1xv4v3opI2aBp9oh1gca9NKc/jUKg11AuswhmmUSmb+lVDDnt
# UBNTqgHtnGBfAMcxQ1cA6AtRvtwwneJkQC4nkUmOEWuMImUEhTQw7vcTpDFFyHzz
# dcYRjioHu15EmuHeP/W+139fnGeCDpr1/XJcJ2avUp/9oNeRDsAi4w/lEHXHv5Rm
# KHuXSIswC/6+dgvdOwRw2OlbzX5KjSVlqXJia+QexEliCxpcs8OYEJ7ZgRdFCO8t
# unWssLs7x1O40J7cngnyT8addLGwbwExrJggpG70suSQB5mMIJzNIVanUpUkzy2g
# 9kAwW3fTUXqW7O+2RYbjFUoY0yR1eHO8EExiPHyO3hxCDNjglwpM20C4M7fs3Eo6
# /1zwagtjxblsWTPK9dOsq3y4yoXlhX+0EpM9PYPV8OleayTRyhS7O/FzHmqpJNlt
# G524RusuIU+xNwUTEKgFFHgm
# =5YPM
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 27 Sep 2022 16:27:24 EDT
# gpg:                using RSA key 42F6C04E540BD1A99E7B8A90239B9B6E3BB08B22
# gpg:                issuer "alex.williamson@redhat.com"
# gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" [full]
# gpg:                 aka "Alex Williamson <alex@shazbot.org>" [full]
# gpg:                 aka "Alex Williamson <alwillia@redhat.com>" [full]
# gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>" [full]
# Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B  8A90 239B 9B6E 3BB0 8B22

* tag 'vfio-updates-20220927.1' of https://gitlab.com/alex.williamson/qemu:
  vfio/common: Fix vfio_iommu_type1_info use after free
  vfio/migration: Fix incorrect initialization value for parameters in VFIOMigration

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

2 files changed, 21 insertions, 17 deletions

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index ace9562a9b..6b5d8c0bf6 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -2111,29 +2111,31 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
     {
         struct vfio_iommu_type1_info *info;
 
-        /*
-         * FIXME: This assumes that a Type1 IOMMU can map any 64-bit
-         * IOVA whatsoever.  That's not actually true, but the current
-         * kernel interface doesn't tell us what it can map, and the
-         * existing Type1 IOMMUs generally support any IOVA we're
-         * going to actually try in practice.
-         */
         ret = vfio_get_iommu_info(container, &info);
+        if (ret) {
+            error_setg_errno(errp, -ret, "Failed to get VFIO IOMMU info");
+            goto enable_discards_exit;
+        }
 
-        if (ret || !(info->flags & VFIO_IOMMU_INFO_PGSIZES)) {
-            /* Assume 4k IOVA page size */
-            info->iova_pgsizes = 4096;
+        if (info->flags & VFIO_IOMMU_INFO_PGSIZES) {
+            container->pgsizes = info->iova_pgsizes;
+        } else {
+            container->pgsizes = qemu_real_host_page_size();
         }
-        vfio_host_win_add(container, 0, (hwaddr)-1, info->iova_pgsizes);
-        container->pgsizes = info->iova_pgsizes;
 
-        /* The default in the kernel ("dma_entry_limit") is 65535. */
-        container->dma_max_mappings = 65535;
-        if (!ret) {
-            vfio_get_info_dma_avail(info, &container->dma_max_mappings);
-            vfio_get_iommu_info_migration(container, info);
+        if (!vfio_get_info_dma_avail(info, &container->dma_max_mappings)) {
+            container->dma_max_mappings = 65535;
         }
+        vfio_get_iommu_info_migration(container, info);
         g_free(info);
+
+        /*
+         * FIXME: We should parse VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE
+         * information to get the actual window extent rather than assume
+         * a 64-bit IOVA address space.
+         */
+        vfio_host_win_add(container, 0, (hwaddr)-1, container->pgsizes);
+
         break;
     }
     case VFIO_SPAPR_TCE_v2_IOMMU:
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index a6ad1f8945..3de4252111 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -806,6 +806,8 @@ static int vfio_migration_init(VFIODevice *vbasedev,
     }
 
     vbasedev->migration = g_new0(VFIOMigration, 1);
+    vbasedev->migration->device_state = VFIO_DEVICE_STATE_RUNNING;
+    vbasedev->migration->vm_running = runstate_is_running();
 
     ret = vfio_region_setup(obj, vbasedev, &vbasedev->migration->region,
                             info->index, "migration");