summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* mips/malta: leave space for the bootmap after the initrdAurelien Jarno2017-08-021-1/+4
| | | | | | | | | | | | | | | | | | | Since commit 9768e2abf7 the initrd is loaded at the end of the low memory to avoid clash for the kernel relocation when kaslr is used. However this in turn conflicts with the bootmap memory that the kernel tries to place after initrd, but in low memory. The bootmap spans the whole usable physical address space. The machine can have at most 2GiB of memory, 256MiB of low memory mapped at 0x00000000, and 1792MiB of high memory mapped at 0x90000000. The biggest bootmap therefore corresponds to the adresses 0x00000000 -> 0xffffffff, which at 1 bit per 4kiB page corresponds to 128kiB in memory. Therefore reserve 128kiB after the initrd. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Tested-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
* Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2017-08-026-17/+53
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pc, acpi, virtio: fixes, test speedup for rc1 Some fixes all over the place. Notably vhost-user gained a new message to set endian-ness. Borderline for 2.10 but seems to be the only way to fix legacy guests. Also pc tests are run on kvm now. Not a fix at all but doesn't touch qemu itself, so I merged it since I had to run these a lot and I just got tired of waiting for these to finish. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 01 Aug 2017 22:36:47 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: pc: acpi: force FADT rev1 for 440fx based machine types pc: make 'pc.rom' readonly when machine has PCI enabled vhost-user: fix watcher need be removed when vhost-user hotplug tests/bios-tables-test: Compiler warning fix accel: cleanup error output intel_iommu: use access_flags for iotlb intel_iommu: fix iova for pt vhost-user: fix legacy cross-endian configurations vhost: fix a memory leak tests: switch pxe and vm gen id tests to use kvm Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * pc: acpi: force FADT rev1 for 440fx based machine typesIgor Mammedov2017-08-011-4/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | w2k used to boot on QEMU until revision of FADT has been bumped to rev3 (commit 77af8a2b hw/i386: Use Rev3 FADT (ACPI 2.0) instead of Rev1 to improve guest OS support.) Keep PC machine at rev1 to remain compatible and Q35 at rev3 where w2k isn't supported anyway so OSX could run as well. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Tested-by: John Arbuckle <programmingkidx@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * pc: make 'pc.rom' readonly when machine has PCI enabledIgor Mammedov2017-08-011-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | looking at bios ROM mapping in QEMU it seems that only isapc (i.e. not PCI enabled machine) requires ROM being mapped as RW in other cases BIOS is mapped as RO. Do the same for option ROM 'pc.rom' when machine has PCI enabled. As useful side-effect pc.rom MemoryRegion stops being put in vhost memory map (filtered out by vhost_section()), which reduces number of entries by 1. Coincidentally it fixes migration failure reported in "[PATCH V2] vhost: fix a migration failed because of vhost region merge" where following destination CLI with /sys/module/vhost/parameters/max_mem_regions = 8 export DIMMSCOUNT=6 QEMU -enable-kvm \ -netdev type=tap,id=guest0,vhost=on,script=no,vhostforce \ -device virtio-net-pci,netdev=guest0 \ -m 256,slots=256,maxmem=2G \ `i=0; while [ $i -lt $DIMMSCOUNT ]; do echo \ "-object memory-backend-ram,id=m$i,size=128M \ -device pc-dimm,id=d$i,memdev=m$i"; i=$(($i + 1)); \ done` will fail to startup with error: "-device pc-dimm,id=d5,memdev=m5: a used vhost backend has no free memory slots left" while it's possible to add the 6th DIMM during hotplug on source. Issue is caused by the fact that number of entries in vhost map is bigger on 1 entry, when -device is processed, than after guest boots up, and that offending entry belongs to 'pc.rom', it's not like vhost intends to do IO in ROM range so making it RO hides region from vhost and makes number of entries in vhost memory map at -device/machine_done time match number of entries after guest boots. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reported-by: Peng Hao <peng.hao2@zte.com.cn> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * intel_iommu: use access_flags for iotlbPeter Xu2017-08-011-8/+7Star
| | | | | | | | | | | | | | | | It was cached by read/write separately. Let's merge them. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * intel_iommu: fix iova for ptPeter Xu2017-08-012-3/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | IOMMUTLBEntry.iova is returned incorrectly on one PT path (though mostly we cannot really trigger this path, even if we do, we are mostly disgarding this value, so it didn't break anything). Fix it by converting the VTD_PAGE_MASK into the correct definition VTD_PAGE_MASK_4K, then remove VTD_PAGE_MASK. Fixes: b93130 ("intel_iommu: cleanup vtd_{do_}iommu_translate()") Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * vhost-user: fix legacy cross-endian configurationsFelipe Franciosi2017-08-011-2/+21
| | | | | | | | | | | | | | | | | | | | | | | | Currently, vhost-user does not implement any means for notifying the backend about guest endianess. This commit introduces a new message called VHOST_USER_SET_VRING_ENDIAN which is analogous to the ioctl() called VHOST_SET_VRING_ENDIAN used for kernel vhost backends. Such message is necessary for backends supporting legacy (pre-1.0) virtio devices running in big-endian guests. Signed-off-by: Felipe Franciosi <felipe@nutanix.com> Signed-off-by: Mike Cui <cui@nutanix.com>
| * vhost: fix a memory leakPeng Hao2017-08-011-0/+2
| | | | | | | | | | | | | | | | | | vhost exists a call for g_file_get_contents, but not call g_free. Signed-off-by: Peng Hao<peng.hao2@zte.com.cn> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* | mc146818rtc: implement UIP latching as intendedPaolo Bonzini2017-08-011-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases, the guest can observe the wrong ordering of UIP and interrupts. This can happen if the VCPU exit is timed like this: iothread VCPU ... wait for interrupt ... t-100ns read register A t wake up, take BQL t+100ns update_in_progress return false return UIP=0 trigger interrupt The interrupt is late; the VCPU expected the falling edge of UIP to happen after the interrupt. update_in_progress is already trying to cover this case by latching UIP if the timer is going to fire soon, and the fix is documented in the commit message for commit 56038ef623 ("RTC: Update the RTC clock only when reading it", 2012-09-10). It cannot be tested with qtest, because its timing of interrupts vs. reads is exact. However, the implementation was incorrect because UIP cmos_ioport_read cleared register A instead of leaving that to rtc_update_timer. Fixing the implementation of cmos_ioport_read to match the commit message, however, breaks the "uip-stuck" test case from the previous patch. To fix it, skip update timer optimizations if UIP has been latched. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | mc146818rtc: simplify check_update_timerPaolo Bonzini2017-08-011-13/+11Star
| | | | | | | | | | | | | | Move all the optimized cases together, since they all have UF=1 in common. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | hw/scsi/vmw_pvscsi: Convert to realizeMao Zhongyi2017-08-011-5/+3Star
| | | | | | | | | | | | | | | | | | | | | | | | Convert a device model where initialization obviously can't fail, make it implement realize() rather than init(). Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Message-Id: <20170726084153.10121-2-maozy.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | hw/scsi/vmw_pvscsi: Remove the dead error handlingMao Zhongyi2017-08-011-4/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | qemu_bh_new() is a wrapper around aio_bh_new(), which returns null only when g_new() does. It doesn't. So remove the dead error handling. Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Message-Id: <20170726084153.10121-1-maozy.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | bt: stop the sdp memory allocation crazinessPaolo Bonzini2017-08-011-4/+13
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clang static analyzer reports a memory leak. Actually, the allocated memory escapes here: record->attribute_list[record->attributes].pair = data; but clang is correct that the memory might leak if len is zero. We know it isn't; assert that it is the case. The craziness doesn't end there. The memory is freed by bt_l2cap_sdp_close_ch: g_free(sdp->service_list[i].attribute_list->pair); which actually should have been written like this: g_free(sdp->service_list[i].attribute_list[0].pair); The attribute_list is sorted with qsort; but indeed the first entry of attribute_list should point to "data" even after the qsort, because the first record has id SDP_ATTR_RECORD_HANDLE, whose numeric value is zero. But hang on. The qsort function is static int sdp_attributeid_compare( const struct sdp_service_attribute_s *a, const struct sdp_service_attribute_s *b) { return (int) b->attribute_id - a->attribute_id; } but no one ever writes attribute_id. So it only works if qsort is stable, and who knows what else is broken, but we can fix it by setting attribute_id in the while loop. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* trace-events: fix code style: print 0x before hex numbersVladimir Sementsov-Ogievskiy2017-08-0119-328/+328
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The only exception are groups of numers separated by symbols '.', ' ', ':', '/', like 'ab.09.7d'. This patch is made by the following: > find . -name trace-events | xargs python script.py where script.py is the following python script: ========================= #!/usr/bin/env python import sys import re import fileinput rhex = '%[-+ *.0-9]*(?:[hljztL]|ll|hh)?(?:x|X|"\s*PRI[xX][^"]*"?)' rgroup = re.compile('((?:' + rhex + '[.:/ ])+' + rhex + ')') rbad = re.compile('(?<!0x)' + rhex) files = sys.argv[1:] for fname in files: for line in fileinput.input(fname, inplace=True): arr = re.split(rgroup, line) for i in range(0, len(arr), 2): arr[i] = re.sub(rbad, '0x\g<0>', arr[i]) sys.stdout.write(''.join(arr)) ========================= Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20170731160135.12101-5-vsementsov@virtuozzo.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* trace-events: fix code style: %# -> 0x%Vladimir Sementsov-Ogievskiy2017-08-018-41/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In trace format '#' flag of printf is forbidden. Fix it to '0x%'. This patch is created by the following: check that we have a problem > find . -name trace-events | xargs grep '%#' | wc -l 56 check that there are no cases with additional printf flags before '#' > find . -name trace-events | xargs grep "%[-+ 0'I]+#" | wc -l 0 check that there are no wrong usage of '#' and '0x' together > find . -name trace-events | xargs grep '0x%#' | wc -l 0 fix the problem > find . -name trace-events | xargs sed -i 's/%#/0x%/g' [Eric Blake noted that xargs grep '%[-+ 0'I]+#' should be xargs grep "%[-+ 0'I]+#" instead so the shell quoting is correct. --Stefan] Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20170731160135.12101-3-vsementsov@virtuozzo.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* trace: add trace_event_get_state_backends()Stefan Hajnoczi2017-08-011-8/+5Star
| | | | | | | | | | | | | | | | | | | | | | | | Code that checks dstate is unaware of SystemTap and LTTng UST dstate, so the following trace event will not fire when solely enabled by SystemTap or LTTng UST: if (trace_event_get_state(TRACE_MY_EVENT)) { str = g_strdup_printf("Expensive string to generate ...", ...); trace_my_event(str); g_free(str); } Add trace_event_get_state_backends() to fetch backend dstate. Those backends that use QEMU dstate fetch it as part of generate_h_backend_dstate(). Update existing trace_event_get_state() callers to use trace_event_get_state_backends() instead. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170731140718.22010-3-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* hw/mps2_scc: fix incorrect propertiesPhilippe Mathieu-Daudé2017-07-311-2/+2
| | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170729234930.725-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Rename cp15.c6_rgnr to pmsav7.rnrPeter Maydell2017-07-311-7/+7
| | | | | | | | | | | | | | Almost all of the PMSAv7 state is in the pmsav7 substruct of the ARM CPU state structure. The exception is the region number register, which is in cp15.c6_rgnr. This exception is a bit odd for M profile, which otherwise generally does not store state in the cp15 substruct. Rename cp15.c6_rgnr to pmsav7.rnr accordingly. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1501153150-19984-4-git-send-email-peter.maydell@linaro.org
* docs: fix broken paths to docs/devel/tracing.txtPhilippe Mathieu-Daudé2017-07-3129-29/+29
| | | | | | | | | With the move of some docs/ to docs/devel/ on ac06724a71, no references were updated. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* ivshmem: fix incorrect error handling in ivshmem_recv_msg()Philippe Mathieu-Daudé2017-07-311-1/+4
| | | | | | | | | | | | | | | | | | Screwed up in commit 3a55fc0f, v2.6.0. If qemu_chr_fe_read_all() returns -EINTR the do {} statement continues and the n accumulator used to complete reads upto sizeof(msg) is decremented by 4 (the value of EINTR on Linux). To avoid that, use simpler if() statements and continue if EINTR occured. hw/misc/ivshmem.c:650:14: warning: Loss of sign in implicit conversion } while (n < sizeof(msg)); ^ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* loader: check get_image_size() return valuePhilippe Mathieu-Daudé2017-07-311-2/+2
| | | | | | | | | | | | | | | | | since a negative value means it errored. hw/core/loader.c:149:9: warning: Loss of sign in implicit conversion if (size > max_sz) { ^~~~ hw/core/loader.c:171:9: warning: Loss of sign in implicit conversion if (size > memory_region_size(mr)) { ^~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* fix qemu-system-unicore32 crashing when calling without -kernelEduardo Otubo2017-07-311-1/+4
| | | | | | | | | | Starting qemu-system-unicore32 without the -kernel parameter results in an assert() returns false and aborts qemu. This patch replaces it with a proper error message followed by exit(1). Signed-off-by: Eduardo Otubo <otubo@redhat.com> Tested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* Revert "spapr: populate device tree depending on XIVE_EXPLOIT option"David Gibson2017-07-291-6/+4Star
| | | | | | | | | | | | This reverts commit b87680427e8a3ff682f66514e99a8344e7437247. I thought this was a harmless preliminary for XIVE enablement patches we expect later on. However, due to some subtle interactions between qemu and SLOF (guest firmware) this breaks some things. Revert it for now, we'll work out how to fix it when the rest of the XIVE patches are ready. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* spapr_drc: fix realize and unrealizeGreg Kurz2017-07-291-9/+6Star
| | | | | | | | | | | | | | If object_property_add_alias() returns an error in realize(), we should propagate it to the caller and certainly not unref the DRC. Same thing goes for unrealize(). Since object_property_del() is the last call, we can even get rid of the intermediate Error *. And finally, unrealize() should undo all registrations performed by realize(). Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170728' into stagingPeter Maydell2017-07-285-17/+24
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches 2017-07-28 Changes: * Improve ths MIPS board kernel load error reporting * Revert unnecessary warning messages # gpg: Signature made Fri 28 Jul 2017 13:47:52 BST # gpg: using RSA key 0x2238EB86D5F797C2 # gpg: Good signature from "Yongbok Kim <yongbok.kim@imgtec.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8600 4CF5 3415 A5D9 4CFA 2B5C 2238 EB86 D5F7 97C2 * remotes/yongbok/tags/mips-20170728: Revert "elf-loader: warn about invalid endianness" hw/mips: load_elf_strerror to report kernel loading failure Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * Revert "elf-loader: warn about invalid endianness"Alexey Kardashevskiy2017-07-281-1/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | This reverts c8e1158cf611 "elf-loader: warn about invalid endianness" as it produces a useless message every time an LE kernel image is passed via -kernel on a ppc64-pseries machine. The pseries machine already checks for ELF_LOAD_WRONG_ENDIAN and tries with big_endian=0. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * hw/mips: load_elf_strerror to report kernel loading failureAurelien Jarno2017-07-284-16/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Emulated MIPS boards bail out with a simple "could not load kernel" when a kernel could not be load, without specifying the underlying reason. Fix that by calling load_elf_strerror. At the same time use error_report to report the error instead of fprintf. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/ui-20170728-pull-request' ↵Peter Maydell2017-07-281-4/+4
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ui: more keymap fixes for 2.10 # gpg: Signature made Fri 28 Jul 2017 13:59:01 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/ui-20170728-pull-request: ui: add pause key to linux_to_qcode ui: drop ac_search and ac_stop ui: correctly detect spice PAUSE scancode sequence Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ui: drop ac_search and ac_stopGerd Hoffmann2017-07-281-4/+4
| | | | | | | | | | | | | | | | | | Both keys exist already: "ac_search" is "find" and "ac_stop" is "stop". Fixes: 37810e80553c19f0dac3644924895a9bf5c70785 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170728063415.27480-1-kraxel@redhat.com
* | s390x/css: fix bits must be zero check for TICHalil Pasic2017-07-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the PoP bit positions 0-3 and 8-32 of the format-1 CCW must contain zeros. Bits 0-3 are already covered by cmd_code validity checking, and bit 32 is covered by the CCW address checking. Bits 8-31 correspond to CCW1.flags and CCW1.count. Currently we only check for the absence of certain flags. Let's fix this. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170725224442.13383-3-pasic@linux.vnet.ibm.com> Reviewed-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> [CH: tweaked comment] Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* | s390x/css: check ccw address validityHalil Pasic2017-07-281-0/+4
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the PoP channel command words (CCW) must be doubleword aligned and 31 bit addressable for format 1 and 24 bit addressable for format 0 CCWs. If the channel subsystem encounters a ccw address which does not satisfy this alignment requirement a program-check condition is recognised. The situation with 31 bit addressable is a bit more complicated: both the ORB and a format 1 CCW TIC hold the address of (the rest of) the channel program, that is the address of the next CCW in a word, and the PoP mandates that bit 0 of that word shall be zero -- or a program-check condition is to be recognized -- and does not belong to the field holding the ccw address. Since in code the corresponding fields span across the whole word (unlike in PoP where these are defined as 31 bit wide) we can check this by applying a mask. The 24 addressable case isn't affecting TIC because the address is composed of a halfword and a byte portion (no additional zero bit requirements) and just slightly complicates the ORB case where also bits 1-7 need to be zero. The same requirements (especially n-bit addressability) apply to the ccw addresses generated while chaining. Let's make our CSS implementation follow the AR more closely. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170727154842.23427-1-pasic@linux.vnet.ibm.com> Reviewed-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* Merge remote-tracking branch 'remotes/kraxel/tags/ui-20170727-pull-request' ↵Peter Maydell2017-07-273-8/+0Star
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ui: keymap fixes for 2.10 # gpg: Signature made Thu 27 Jul 2017 15:00:06 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/ui-20170727-pull-request: ps2: fix sending of PAUSE/BREAK scancodes ui: drop altgr and altgr_r QKeyCodes ps2: enable multimedia keys ui: add multimedia keys ui: update keymaps ui: move qemu_input_linux_to_qcode() ui: add next and prior keysyms Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ui: drop altgr and altgr_r QKeyCodesGerd Hoffmann2017-07-273-4/+0Star
| | | | | | | | | | | | | | | | | | The right alt key (alt_r aka KEY_RIGHTALT) is used for AltGr. The altgr and altgr_r keys simply don't exist. Drop them. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20170727104720.30061-1-kraxel@redhat.com
| * ps2: enable multimedia keysGerd Hoffmann2017-07-271-4/+0Star
| | | | | | | | | | | | | | Fixes: 8c10e0baf0260b59a4e984744462a18016662e3e Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20170726152918.11995-6-kraxel@redhat.com
* | vfio/pci: fix use of freed memoryPhilippe Mathieu-Daudé2017-07-261-4/+7
| | | | | | | | | | | | | | | | | | | | | | hw/vfio/pci.c:308:29: warning: Use of memory after it is freed qemu_set_fd_handler(*pfd, NULL, NULL, vdev); ^~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* | vfio/platform: fix use of freed memoryPhilippe Mathieu-Daudé2017-07-261-1/+1
|/ | | | | | | | | | | | | free the data _after_ using it. hw/vfio/platform.c:126:29: warning: Use of memory after it is freed qemu_set_fd_handler(*pfd, NULL, NULL, NULL); ^~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* hw/display/sm501: Don't use vmstate_register_ram_global()Peter Maydell2017-07-251-2/+1Star
| | | | | | | | | | | | | | | | | | | | | | The sm501 device uses vmstate_register_ram_global() to register its memory region for migration. This means it gets a name that is assumed to be global to the whole system, which in turn means that if you create two of the device we assert because of the duplication: qemu-system-ppc -device sm501 -device sm501 RAMBlock "sm501.local" already registered, abort! Aborted (core dumped) Changing this to just use memory_region_init_ram()'s automatic registration of the memory region with a device-local name fixes this. The downside is that it breaks migration compatibility, but luckily we only added migration support to this device in the 2.10 release cycle so we haven't released a QEMU version with the broken implementation. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1500309462-12792-1-git-send-email-peter.maydell@linaro.org
* Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170725' into stagingPeter Maydell2017-07-251-1/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Various changes for the s390x code: - updates for cpu model handling - fix compilation with --disable-tcg - fixes in vfio-ccw and I/O instruction handling # gpg: Signature made Tue 25 Jul 2017 10:15:37 BST # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170725: s390x/css: fix ilen in IO instruction handlers target/s390x: Add remaining switches to compile with --disable-tcg target/s390x: Move exception-related functions to a new excp_helper.c file target/s390x: Rework program_interrupt() and related functions target/s390x: Move diag helpers to a separate file target/s390x: Move s390_cpu_dump_state() to helper.c target/s390x: improve baselining if certain base features are missing s390x/kvm: better comment regarding zPCI feature availability target/s390x: introduce (test|set)_be_bit target/s390x: indicate query subfunction in s390_fill_feat_block target/s390x: drop BE_BIT() s390/cpumodel: remove KSS from the default model of z14 vfio/ccw: fix initialization of the Object DeviceState pointer in the common base-device vfio/ccw: allocate irq info with the right size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * vfio/ccw: fix initialization of the Object DeviceState pointer in the common ↵Dong Jia Shi2017-07-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | base-device Commit 7da624e2 ("vfio: Test realized when using VFIOGroup.device_list iterator") introduced a pointer to the Object DeviceState in the VFIO common base-device and skipped non-realized devices as we iterate VFIOGroup.device_list. While it missed to initialize the pointer for the vfio-ccw case. Let's fix it. Fixes: 7da624e2 ("vfio: Test realized when using VFIOGroup.device_list iterator") Cc: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Message-Id: <20170718014926.44781-3-bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| * vfio/ccw: allocate irq info with the right sizeJing Zhang2017-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | When allocating memory for the vfio_irq_info parameter of the VFIO_DEVICE_GET_IRQ_INFO ioctl, we used the wrong size. Let's fix it by using the right size. Reviewed-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Jing Zhang <bjzhjing@linux.vnet.ibm.com> Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Message-Id: <20170718014926.44781-2-bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* | spapr: Fix QEMU abort during memory unplugBharata B Rao2017-07-251-16/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 0cffce56 (hw/ppc/spapr.c: adding pending_dimm_unplugs to sPAPRMachineState) introduced a new way to track pending LMBs of DIMM device that is marked for removal. Since this commit we can hit the assert in spapr_pending_dimm_unplugs_add() in the following situation: - DIMM device removal fails as the guest doesn't allow the removal. - Subsequent attempt to remove the same DIMM would hit the assert as the corresponding sPAPRDIMMState is still part of the pending_dimm_unplugs list. Fix this by removing the assert and conditionally adding the sPAPRDIMMState to pending_dimm_unplugs list only when it is not already present. Fixes: 0cffce56ae3501c5783d779f97993ce478acf856 Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> [dwg: Tweaked to avoid returning NULL when spapr_pending_dimm_unplugs_add() does find an existing entry] Reviewed-by: Daniel Barboza <danielhb@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | spapr/htab: fix savevmLaurent Vivier2017-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 3a38429 ("spapr: Add a "no HPT" encoding to HTAB migration stream") allows to migrate an empty HPT, but doesn't mark correctly the end of the migration stream. The end condition (value returned by htab_save_iterate()) should be 1, whereas in 3a38429 it returns 0. The problem can be reproduced with QEMU monitor command "savevm": the command never stops and the disk image grows without limit. Fixes: 3a38429748aa4f74abaecf16c4c087e8a325e12a Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | spapr_pci: Fix obsolete comment about MSIX encoding in addr/dataAlexey Kardashevskiy2017-07-251-3/+1Star
|/ | | | | | | | f1c2dc7c866a "spapr-pci: rework MSI/MSIX" (07/2013) changed MSIX encoding but forgot to change the comment so this changes it. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* integratorcp: Don't migrate flash using vmstate_register_ram_global()Peter Maydell2017-07-241-2/+1Star
| | | | | | | | | | | | | | | Instead of migrating the flash by creating the memory region with memory_region_init_ram_nomigrate() and then calling vmstate_register_ram_global(), just use memory_region_init_ram(), which now handles migration registration automatically. This is a migration compatibility break for the integratorcp board, because the RAM region's migration name changes to include the device path. This is OK because we don't guarantee migration compatibility for this board. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1500310341-28931-1-git-send-email-peter.maydell@linaro.org
* mps2: Correctly set parent bus for SCC devicePeter Maydell2017-07-241-1/+1
| | | | | | | | | A cut-and-paste error meant that instead of setting the qdev parent bus for the SCC device we were setting it twice for the ARMv7M container device. Fix this bug. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1500634509-28011-1-git-send-email-peter.maydell@linaro.org
* fsl_imx*: Migrate ROM contentsPeter Maydell2017-07-243-6/+6
| | | | | | | | | | | | | | | | | | | | | The fsl-imx* boards accidentally forgot to register the ROM memory regions for migration. This used to require a manual step of calling vmstate_register_ram(), but following commits 1cfe48c1ce21..b08199c6fbea194 we can use memory_region_init_rom() to have it do the migration for us. This is a migration break, but the migration code currently does not handle the case of having two RAM regions which were not registered for migration, and so prior to this commit a migration load would always fail with: "qemu-system-arm: Length mismatch: 0x4000 in != 0x18000: Invalid argument" NB: migration appears at this point to be broken for this board anyway -- it succeeds but the destination hangs; probably some device in the system does not yet support migration. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1500309775-18361-1-git-send-email-peter.maydell@linaro.org
* qapi: Use QNull for a more regular visit_type_null()Markus Armbruster2017-07-241-1/+3
| | | | | | | | | Make visit_type_null() take an @obj argument like its buddies. This helps keep the next commit simple. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
* xen-mapcache: Fix the bug when overlapping emulated DMA operations may cause ↵Alexey G2017-07-221-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | inconsistency in guest memory mappings Under certain circumstances normal xen-mapcache functioning may be broken by guest's actions. This may lead to either QEMU performing exit() due to a caught bad pointer (and with QEMU process gone the guest domain simply appears hung afterwards) or actual use of the incorrect pointer inside QEMU address space -- a write to unmapped memory is possible. The bug is hard to reproduce on a i440 machine as multiple DMA sources are required (though it's possible in theory, using multiple emulated devices), but can be reproduced somewhat easily on a Q35 machine using an emulated AHCI controller -- each NCQ queue command slot may be used as an independent DMA source ex. using READ FPDMA QUEUED command, so a single storage device on the AHCI controller port will be enough to produce multiple DMAs (up to 32). The detailed description of the issue follows. Xen-mapcache provides an ability to map parts of a guest memory into QEMU's own address space to work with. There are two types of cache lookups: - translating a guest physical address into a pointer in QEMU's address space, mapping a part of guest domain memory if necessary (while trying to reduce a number of such (re)mappings to a minimum) - translating a QEMU's pointer back to its physical address in guest RAM These lookups are managed via two linked-lists of structures. MapCacheEntry is used for forward cache lookups, while MapCacheRev -- for reverse lookups. Every guest physical address is broken down into 2 parts: address_index = phys_addr >> MCACHE_BUCKET_SHIFT; address_offset = phys_addr & (MCACHE_BUCKET_SIZE - 1); MCACHE_BUCKET_SHIFT depends on a system (32/64) and is equal to 20 for a 64-bit system (which assumed for the further description). Basically, this means that we deal with 1 MB chunks and offsets within those 1 MB chunks. All mappings are created with 1MB-granularity, i.e. 1MB/2MB/3MB etc. Most DMA transfers typically are less than 1MB, however, if the transfer crosses any 1MB border(s) - than a nearest larger mapping size will be used, so ex. a 512-byte DMA transfer with the start address 700FFF80h will actually require a 2MB range. Current implementation assumes that MapCacheEntries are unique for a given address_index and size pair and that a single MapCacheEntry may be reused by multiple requests -- in this case the 'lock' field will be larger than 1. On other hand, each requested guest physical address (with 'lock' flag) is described by each own MapCacheRev. So there may be multiple MapCacheRev entries corresponding to a single MapCacheEntry. The xen-mapcache code uses MapCacheRev entries to retrieve the address_index & size pair which in turn used to find a related MapCacheEntry. The 'lock' field within a MapCacheEntry structure is actually a reference counter which shows a number of corresponding MapCacheRev entries. The bug lies in ability for the guest to indirectly manipulate with the xen-mapcache MapCacheEntries list via a special sequence of DMA operations, typically for storage devices. In order to trigger the bug, guest needs to issue DMA operations in specific order and timing. Although xen-mapcache is protected by the mutex lock -- this doesn't help in this case, as the bug is not due to a race condition. Suppose we have 3 DMA transfers, namely A, B and C, where - transfer A crosses 1MB border and thus uses a 2MB mapping - transfers B and C are normal transfers within 1MB range - and all 3 transfers belong to the same address_index In this case, if all these transfers are to be executed one-by-one (without overlaps), no special treatment necessary -- each transfer's mapping lock will be set and then cleared on unmap before starting the next transfer. The situation changes when DMA transfers overlap in time, ex. like this: |===== transfer A (2MB) =====| |===== transfer B (1MB) =====| |===== transfer C (1MB) =====| time ---> In this situation the following sequence of actions happens: 1. transfer A creates a mapping to 2MB area (lock=1) 2. transfer B (1MB) tries to find available mapping but cannot find one because transfer A is still in progress, and it has 2MB size + non-zero lock. So transfer B creates another mapping -- same address_index, but 1MB size. 3. transfer A completes, making 1st mapping entry available by setting its lock to 0 4. transfer C starts and tries to find available mapping entry and sees that 1st entry has lock=0, so it uses this entry but remaps the mapping to a 1MB size 5. transfer B completes and by this time - there are two locked entries in the MapCacheEntry list with the SAME values for both address_index and size - the entry for transfer B actually resides farther in list while transfer C's entry is first 6. xen_ram_addr_from_mapcache() for transfer B gets correct address_index and size pair from corresponding MapCacheRev entry, but then it starts looking for MapCacheEntry with these values and finds the first entry -- which belongs to transfer C. At this point there may be following possible (bad) consequences: 1. xen_ram_addr_from_mapcache() will use a wrong entry->vaddr_base value in this statement: raddr = (reventry->paddr_index << MCACHE_BUCKET_SHIFT) + ((unsigned long) ptr - (unsigned long) entry->vaddr_base); resulting in an incorrent raddr value returned from the function. The (ptr - entry->vaddr_base) expression may produce both positive and negative numbers and its actual value may differ greatly as there are many map/unmap operations take place. If the value will be beyond guest RAM limits then a "Bad RAM offset" error will be triggered and logged, followed by exit() in QEMU. 2. If raddr value won't exceed guest RAM boundaries, the same sequence of actions will be performed for xen_invalidate_map_cache_entry() on DMA unmap, resulting in a wrong MapCacheEntry being unmapped while DMA operation which uses it is still active. The above example must be extended by one more DMA transfer in order to allow unmapping as the first mapping in the list is sort of resident. The patch modifies the behavior in which MapCacheEntry's are added to the list, avoiding duplicates. Signed-off-by: Alexey Gerasimenko <x1917x@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
* xen: fix compilation on 32-bit hostsIgor Druzhinin2017-07-221-4/+5
| | | | | Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
* Use qemu_tolower() and qemu_toupper(), not tolower() and toupper()Peter Maydell2017-07-212-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | On NetBSD, where tolower() and toupper() are implemented using an array lookup, the compiler warns if you pass a plain 'char' to these functions: gdbstub.c:914:13: warning: array subscript has type 'char' This reflects the fact that toupper() and tolower() give undefined behaviour if they are passed a value that isn't a valid 'unsigned char' or EOF. We have qemu_tolower() and qemu_toupper() to avoid this problem; use them. (The use in scsi-generic.c does not trigger the warning because it passes a uint8_t; we switch it anyway, for consistency.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> for the s390 part. Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-id: 1500568290-7966-1-git-send-email-peter.maydell@linaro.org
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-09 08:05:26 +0100