summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
...
* usb/uhci: move pid checkGerd Hoffmann2016-04-251-13/+13
| | | | | | | | | | | | | | | | | | | | commit "5f77e06 usb: add pid check at the first of uhci_handle_td()" moved the pid verification to the start of the uhci_handle_td function, to simplify the error handling (we don't have to free stuff which we didn't allocate in the first place ...). Problem is now the check fires too often, it raises error IRQs even for TDs which we are not going to process because they are not set active. So, lets move down the check a bit, so it is done only for active TDs, but still before we are going to allocate stuff to process the requested transfer. Reported-by: Joe Clifford <joe@thunderbug.co.uk> Tested-by: Joe Clifford <joe@thunderbug.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1461321893-15811-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/ppc/spapr: Fix crash when specifying bad parameters to spapr-pci-host-bridgeThomas Huth2016-04-232-5/+7
| | | | | | | | | | | | | | | | | | QEMU currently crashes when using bad parameters for the spapr-pci-host-bridge device: $ qemu-system-ppc64 -device spapr-pci-host-bridge,buid=0x123,liobn=0x321,mem_win_addr=0x1,io_win_addr=0x10 Segmentation fault The problem is that spapr_tce_find_by_liobn() might return NULL, but the code in spapr_populate_pci_dt() does not check for this condition and then tries to dereference this NULL pointer. Apart from that, the return value of spapr_populate_pci_dt() also has to be checked for all PCI buses, not only for the last one, to make sure we catch all errors. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* virtio: Mark host notifiers as externalFam Zheng2016-04-221-2/+2
| | | | | | | | | The effect of this change is the block layer drained section can work, for example when mirror job is being completed. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* event-notifier: Add "is_external" parameterFam Zheng2016-04-222-5/+5
| | | | | | | | | | All callers pass "false" keeping the old semantics. The windows implementation doesn't distinguish the flag yet. On posix, it is passed down to the underlying aio context. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* hw/arm/boot: always clear r0 when booting kernelsSylvain Garrigues2016-04-211-1/+1
| | | | | | | | | | | | | | | | | The 32-bit ARM Linux kernel booting ABI requires that r0 is 0 when calling the kernel image. A bug in commit 10b8ec73e610e01 meant that for boards which use the write_board_setup hook (which means "highbank", "midway", "raspi2" and "xilinx-zynq-a9") we were incorrectly skipping the "clear r0" instruction in the mini-bootloader. Use the right offset in the "add lr, pc, #n" instruction so that we return from the board-setup code to the correct place. Signed-off-by: Sylvain Garrigues <sylvain@sylvaingarrigues.com> [PMM: Expanded commit message] Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/sstabellini/tags/xen-2016-04-20' into ↵Peter Maydell2016-04-201-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | staging Xen 2016/04/20 # gpg: Signature made Wed 20 Apr 2016 12:08:56 BST using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/xen-2016-04-20: xenfb: use the correct condition to avoid excessive looping Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * xenfb: use the correct condition to avoid excessive loopingWei Liu2016-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | In commit ac0487e1 ("xenfb.c: avoid expensive loops when prod <= out_cons"), ">=" was used. In fact, a full ring is a legit state. Correct the test to use ">". Reported-by: "Hao, Xudong" <xudong.hao@intel.com> Signed-off-by: Wei Liu <wei.liu2@citrix.com> Tested-by: "Hao, Xudong" <xudong.hao@intel.com> Acked-by: Anthony Perard <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
* | Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160419-1' into ↵Peter Maydell2016-04-191-4/+7
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging ehci: fix (s)iTD looping issue (CVE-2015-8558) in a different way. # gpg: Signature made Tue 19 Apr 2016 07:22:22 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-20160419-1: Revert "ehci: make idt processing more robust" ehci: apply limit to iTD/sidt descriptors Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | Revert "ehci: make idt processing more robust"Gerd Hoffmann2016-04-191-3/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 156a2e4dbffa85997636a7a39ef12da6f1b40254. Breaks FreeBSD. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | ehci: apply limit to iTD/sidt descriptorsGerd Hoffmann2016-04-191-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit "156a2e4 ehci: make idt processing more robust" tries to avoid a DoS by the guest (create a circular iTD queue and let qemu ehci emulation run in circles forever). Unfortunately this has two problems: First it misses the case of siTDs, and second it reportedly breaks FreeBSD. So lets go for a different approach: just count the number of iTDs and siTDs we have seen per frame and apply a limit. That should really catch all cases now. Reported-by: 杜少博 <dushaobo@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | | Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160419' ↵Peter Maydell2016-04-191-2/+2
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ppc patch queueu for 2016-04-19 A single fix for a regression since 2.5. This should be the last ppc pull request for 2.6. # gpg: Signature made Tue 19 Apr 2016 02:48:30 BST using RSA key ID 20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.6-20160419: cuda: fix off-by-one error in SET_TIME command Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | cuda: fix off-by-one error in SET_TIME commandAurelien Jarno2016-04-191-2/+2
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the new framework the cuda_cmd_set_time command directly receive the data, without the command byte. Therefore the time is stored at in_data[0], not at in_data[1]. This fixes the "hwclock --systohc" command in a guest. Cc: Hervé Poussineau <hpoussin@reactos.org> Cc: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> [this fixes a regression introduced by e647317 "cuda: port SET_TIME command to new framework"] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* / / cadence_uart: bounds check write offsetMichael S. Tsirkin2016-04-191-0/+3
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cadence_uart_init() initializes an I/O memory region of size 0x1000 bytes. However in uart_write(), the 'offset' parameter (offset within region) is divided by 4 and then used to index the array 'r' of size CADENCE_UART_R_MAX which is much smaller: (0x48/4). If 'offset>>=2' exceeds CADENCE_UART_R_MAX, this will cause an out-of-bounds memory write where the offset and the value are controlled by guest. This will corrupt QEMU memory, in most situations this causes the vm to crash. Fix by checking the offset against the array size. Cc: qemu-stable@nongnu.org Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 20160418100735.GA517@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Fix pflash migrationDr. David Alan Gilbert2016-04-151-2/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pflash migration (e.g. q35 + EFI variable storage) fails with the assert: bdrv_co_do_pwritev: Assertion `!(bs->open_flags & 0x0800)' failed. This avoids the problem by delaying the pflash update until after the device loads complete. Tested by: Migrating Q35/EFI vm. Changing efi variable content (with efiboot in the guest) md5sum'ing the variable file before migration and after. This is a fix that Paolo posted in the message 570244B3.4070105@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2016-04-143-4/+15
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tpm, vhost, virtio: fixes for 2.6 Minor fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 14 Apr 2016 14:45:55 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: hw/virtio/balloon: Replace TARGET_PAGE_SIZE with BALLOON_PAGE_SIZE tpm: Fix write to file descriptor function tpm: acpi: remove IRQ from TPM's CRS to make Windows not see conflict pc: acpi: tpm: add missing MMIO resource to PCI0._CRS specs/vhost-user: spelling fix specs/vhost-user: improve VHOST_SET_VRING_NUM documentation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/virtio/balloon: Replace TARGET_PAGE_SIZE with BALLOON_PAGE_SIZEThomas Huth2016-04-141-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The balloon code currently calls madvise() with TARGET_PAGE_SIZE as length parameter. Since the virtio-balloon protocol is always based on 4k pages, no matter what the host and guest are using as page size, this could cause problems: If TARGET_PAGE_SIZE is bigger than 4k, the madvise call also destroys the 4k areas after the current one - which might be wrong since the guest did not want free that area yet (in case the guest used as smaller MMU page size than the hard-coded TARGET_PAGE_SIZE). So to fix this issue, introduce a proper define called BALLOON_PAGE_SIZE (which is 4096) to use this as the size parameter for the madvise() call instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | tpm: Fix write to file descriptor functionStefan Berger2016-04-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a bug introduced in commit 46f296c while moving send_all to the tpm_passthrough code. Fix the name of the variable used in the loop. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | tpm: acpi: remove IRQ from TPM's CRS to make Windows not see conflictIgor Mammedov2016-04-131-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IRQ 5 used by TPM conflicts with PNP0C0F IRQs, as result Windows fails driver initialization with reason 'device cannot find enough free resources' But if TPM._CRS.IRQ entry is commented out, Windows seems to initialize driver without errors as it doesn't notice possible conflict and it seems to work probably due to a link with IRQ 5 being unused/disabled. So temporary comment out TPM._CRS.IRQ to 'fix' regression in TPM, with intent to fix it correctly later i.e.: 1. pick unused IRQ as default one for TPM 2. fetch IRQ value from device model so that user could override default one if it conflicts with some other device. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | pc: acpi: tpm: add missing MMIO resource to PCI0._CRSIgor Mammedov2016-04-131-0/+5
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Windows will fail initialize TMP driver with the reason: 'device cannot find enough free resources' That happens because parent BUS doesn't describe MMIO resources used by TPM child device. Fix it by describing it in top-most parent bus scope PCI0. It was 'regressed' by commit 5cb18b3d TPM2 ACPI table support with following fixup 9e472263 acpi: add missing ssdt which did the right thing by moving TPM to BUS it belongs to but lacked a proper resource declaration. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20160413-1' ↵Peter Maydell2016-04-133-7/+115
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio-input; live migration support, various bugfixes. # gpg: Signature made Wed 13 Apr 2016 16:41:27 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-input-20160413-1: virtio-input: support absolute axis config in pass-through input-linux: refine mouse detection virtio-input: fix emulated tablet axis ranges virtio-input: add live migration support virtio-input: implement pass-through evdev writes virtio-input: retrieve EV_LED host config bits virtio-input: add missing key mappings move const_le{16, 23} to qemu/bswap.h, add comment virtio-input: add parenthesis to const_le{16, 32} Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | virtio-input: support absolute axis config in pass-throughLadi Prosek2016-04-132-5/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VIRTIO_INPUT_CFG_ABS_INFO was not implemented for pass-through input devices. This patch follows the existing design and pre-fetches the config for all absolute axes using EVIOCGABS at realize time. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1460558603-18331-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-input: fix emulated tablet axis rangesLadi Prosek2016-04-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | The reported maximum was wrong. The X and Y coordinates are 0-based so if size is 8000 maximum must be 7FFF. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1460128893-10244-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-input: add live migration supportGerd Hoffmann2016-04-131-0/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio-input is simple enough that it doesn't need to xfer any state. Still we have to wire up savevm manually, so the generic pci and virtio are saved correctly. Additionally we need to do some post-load processing to figure whenever the guest uses the device or not, so we can give input routing hints to the qemu input layer using qemu_input_handler_{activate,deactivate}. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1459859501-16965-1-git-send-email-kraxel@redhat.com
| * | virtio-input: implement pass-through evdev writesLadi Prosek2016-04-131-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The write path for pass-through devices, commonly used for controlling keyboard LEDs via EV_LED, was not implemented. This commit adds the necessary plumbing to connect the status virtio queue to the host evdev file descriptor. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1459511146-12060-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-input: retrieve EV_LED host config bitsLadi Prosek2016-04-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | VIRTIO_INPUT_CFG_EV_BITS with subsel of EV_LED was always returning an empty bitmap for pass-through input devices. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1459418028-7473-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * | virtio-input: add missing key mappingsLadi Prosek2016-04-131-0/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | KEY_PAUSE is flat out missing. KEY_SYSRQ already has a keycode assigned but it's not what I'm seeing on my system. The mapping doesn't appear to have to be unique so both keycodes now map to KEY_SYSRQ which is what the "Keyboard PrintScreen", HID usage ID 0x46, translates to. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1459343240-19483-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/elmarco/tags/ivshmem-fix-pull-request' ↵Peter Maydell2016-04-131-0/+30
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging # gpg: Signature made Wed 13 Apr 2016 11:04:51 BST using RSA key ID 75969CE5 # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * remotes/elmarco/tags/ivshmem-fix-pull-request: ivshmem: fix ivshmem-{plain,doorbell} crash without arg Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | ivshmem: fix ivshmem-{plain,doorbell} crash without argMarc-André Lureau2016-04-131-0/+30
| |/ | | | | | | | | | | | | | | | | "qemu -device ivshmem-{plain,doorbell}" will crash, because the device doesn't check that the required argument is provided. (screwed up in commit 5400c02) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
* | ide: really restart pending and in-flight atapi dmaPavel Butsykin2016-04-134-22/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Restart of ATAPI DMA used to be unreachable, because the request to do so wasn't indicated in bus->error_status due to the lack of spare bits, and ide_restart_bh() would return early doing nothing. This patch makes use of the observation that not all bit combinations were possible in ->error_status. In particular, IDE_RETRY_READ only made sense together with IDE_RETRY_DMA or IDE_RETRY_PIO. This allows to re-use IDE_RETRY_READ alone as an indicator of ATAPI DMA restart request. To makes things more uniform, ATAPI DMA gets its own value for ->dma_cmd. As a means against confusion, macros are added to test the state of ->error_status. The patch fixes the restart of both in-flight and pending ATAPI DMA, following the scheme similar to that of IDE DMA. [Including a fixup patch: Message-id: 1460465594-15777-1-git-send-email-pbutsykin@virtuozzo.com --js] Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1459924806-306-4-git-send-email-den@openvz.org Signed-off-by: John Snow <jsnow@redhat.com>
* | ide: restart atapi dma by re-evaluating command packetPavel Butsykin2016-04-121-7/+6Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ide_atapi_dma_restart() used to just complete the DMA with an error, under the assumption that there isn't enough information to restart it. However, as the contents of the ->io_buffer is preserved, it looks safe to just re-evaluate it and dispatch the ATAPI command again. Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1459924806-306-3-git-send-email-den@openvz.org Signed-off-by: John Snow <jsnow@redhat.com>
* | ide: don't lose pending dma statePavel Butsykin2016-04-123-8/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the migration occurs after the IDE DMA has been set up but before it has been initiated, the state gets lost upon save/restore. Specifically, ->dma_cb callback gets cleared, so, when the guest eventually starts bus mastering, the DMA never completes, causing the guest to time out the operation. OTOH all the infrastructure is already in place to restart the DMA if the migration happens while the DMA is in progress. So reuse that infrastructure, by setting bus->error_status based on ->dma_cmd in pre_save if ->dma_cb callback is already set but DMAING is clear. This will indicate the need for restart and make sure ->dma_cb is restored in ide_restart_bh(); howeover since DMAING is clear the state upon restore will be exactly "ready for DMA" as before the save. Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1459924806-306-2-git-send-email-den@openvz.org Signed-off-by: John Snow <jsnow@redhat.com>
* | xen: Fix IDE unplugAnthony PERARD2016-04-121-0/+1
|/ | | | | | | | | | | | | | After commit e5e7855 (blockdev: Separate BB name management), starting a guest with PVHVM support result in this assert: qemu-system-i386: block/block-backend.c:173: blk_delete: Assertion `!blk->name' failed. A backtrace show that a caller is pci_piix3_xen_ide_unplug(). This patch fix it. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Message-id: 1460382666-29885-1-git-send-email-anthony.perard@citrix.com Signed-off-by: John Snow <jsnow@redhat.com>
* net: stellaris_enet: check packet length against receive bufferPrasad J Pandit2016-04-111-1/+11
| | | | | | | | | | | | | When receiving packets over Stellaris ethernet controller, it uses receive buffer of size 2048 bytes. In case the controller accepts large(MTU) packets, it could lead to memory corruption. Add check to avoid it. Reported-by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1460095428-22698-1-git-send-email-ppandit@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* virtio-gpu: block live migrationGerd Hoffmann2016-04-111-0/+7
| | | | | | | | | | Feeling a bit nervous putting the full live migration support patch (https://patchwork.ozlabs.org/patch/606902/) in that late in the 2.6 devel cycle as it carries some non-trivial changes. So disable migration in case virtio-gpu is present for now. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ui/virtio-gpu: add and use qemu_create_displaysurface_pixmanGerd Hoffmann2016-04-111-4/+1Star
| | | | | | | | | | | | | | | | | | Add a the new qemu_create_displaysurface_pixman function, to create a DisplaySurface backed by an existing pixman image. In that case there is no need to create a new pixman image pointing to the same backing storage. We can just use the existing image directly. This does not only simplify things a bit, but most importantly it gets the reference counting right, so the backing storage for the pixman image wouldn't be released underneath us. Use new function in virtio-gpu, where using it actually fixes use-after-free crashes. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1459499240-742-1-git-send-email-kraxel@redhat.com
* Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160408' into stagingPeter Maydell2016-04-081-8/+3Star
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches 2016-04-08 Changes: * fix off-by-one error in ITU # gpg: Signature made Fri 08 Apr 2016 10:43:16 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" * remotes/lalrae/tags/mips-20160408: hw/mips_itu: fix off-by-one reported by Coverity Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/mips_itu: fix off-by-one reported by CoverityLeon Alrae2016-04-081-8/+3Star
| | | | | | | | | | | | | | | | | | Fix off-by-one error in ITC Tag read. Remove the switch as we just want to check if index is in valid range rather than test against list of values. Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* | Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2016-04-0815-80/+320
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pci, virtio, acpi: fixes for 2.6 Fixes all over the place. Most notably, fixes migration for systems with pci express bridges, and random crashes observed with virtio blk and scsi dataplane. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 08 Apr 2016 08:53:46 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: hw/pci-bridge: Add missing unref in case register-bus fails virtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio virtio-scsi: use aio handler for data plane virtio-blk: use aio handler for data plane virtio: add aio handler virtio-scsi: fix disabled mode virtio-blk: fix disabled mode virtio: make virtio_queue_notify_vq static tests/bios-tables-test: fix assert virtio-balloon: reset the statistic timer to load device Migration: Add i82801b11 migration data Sort the fw_cfg file list xen: piix reuse pci generic class init function pci-testdev: fast mmio support acpi: Add missing GCC_FMT_ATTR Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/pci-bridge: Add missing unref in case register-bus failsWei Jiangang2016-04-071-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The error paths after a successful qdev_create/pci_bus_new should contain a object_unref/object_unparent. pxb_dev_init_common() did not yet, so add it. Signed-off-by: Wei Jiangang <weijg.fnst@cn.fujitsu.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
| * | virtio: merge virtio_queue_aio_set_host_notifier_handler with ↵Paolo Bonzini2016-04-073-24/+12Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | virtio_queue_set_aio Eliminating the reentrancy is actually a nice thing that we can do with the API that Michael proposed, so let's make it first class. This also hides the complex assign/set_handler conventions from callers of virtio_queue_aio_set_host_notifier_handler, which in fact was always called with assign=true. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | virtio-scsi: use aio handler for data planePaolo Bonzini2016-04-072-25/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In addition to handling IO in vcpu thread and in io thread, dataplane introduces yet another mode: handling it by AioContext. This reuses the same handler as previous modes, which triggers races as these were not designed to be reentrant. Use a separate handler just for aio, and disable regular handlers when dataplane is active. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | virtio-blk: use aio handler for data planeMichael S. Tsirkin2016-04-072-10/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In addition to handling IO in vcpu thread and in io thread, dataplane introduces yet another mode: handling it by AioContext. This reuses the same handler as previous modes, which triggers races as these were not designed to be reentrant. Use a separate handler just for aio, and disable regular handlers when dataplane is active. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | virtio: add aio handlerMichael S. Tsirkin2016-04-071-4/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In addition to handling IO in vcpu thread and in io thread, blk dataplane introduces yet another mode: handling it by AioContext. Currently, this reuses the same handler as previous modes, which triggers races as these were not designed to be reentrant. Add instead a separate handler just for aio; this will make it possible to disable regular handlers when dataplane is active. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | virtio-scsi: fix disabled modePaolo Bonzini2016-04-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add two missing checks for s->dataplane_fenced. In one case, QEMU would skip injecting an IRQ due to a write to an uninitialized EventNotifier's file descriptor. In the second case, the dataplane_disabled field was used by mistake; in fact after fixing this occurrence it is completely unused. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | virtio-blk: fix disabled modePaolo Bonzini2016-04-072-5/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We must not call virtio_blk_data_plane_notify if dataplane is disabled: we would hit a segmentation fault in notify_guest_bh as s->guest_notifier has not been setup and is NULL. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | virtio: make virtio_queue_notify_vq staticPaolo Bonzini2016-04-071-1/+1
| | | | | | | | | | | | | | | | | | | | | Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | virtio-balloon: reset the statistic timer to load devicePavel Butsykin2016-04-071-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If before loading snapshot we had set the timer of statistics, then after applying snapshot the expiry time would be irrelevant for the restored state of the virtual clocks. A simple fix is just to restart the timer after loading snapshot. For the user it may look like a long delay of statistics update after switch to the snapshot. Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | Migration: Add i82801b11 migration dataDr. David Alan Gilbert2016-04-071-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The i82801b11 bridge didn't have a vmsd and thus didn't send any migration data, including that of its parent PCIBridge object. The symptom being if the guest used any devices behind the bridge the guest crashed (mostly with various interrupt related issues). Note: This will cause migration from old qemus that used this device to explicitly fail during migration as opposed to the guest crashing. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Suggested-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | Sort the fw_cfg file listGerd Hoffmann2016-04-075-8/+143
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Entries are inserted in filename order instead of being appended to the end in case sorting is enabled. This will avoid any future issues of moving the file creation around, it doesn't matter what order they are created now, the will always be in filename order. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Added machine type handling for compatibility. This was a fairly complex change, this will preserve the order of fw_cfg for older versions no matter what order the firmware files actually come in. A list is kept of the correct legacy order and the entries will be inserted based upon their order in the list. Except that some entries are ordered (in a specific area of the list) based upon what order they appear on the command line. Special handling is added for those entries. Signed-off-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| * | xen: piix reuse pci generic class init functionMichael S. Tsirkin2016-04-071-13/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | piix3_ide_xen_class_init is identical to piix3_ide_class_init except it's buggy as it does not set exit and does not disable hotplug properly. Switch to the generic one. Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-09 18:30:57 +0100