summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2015-01-14PPC: Fix crash on spapr_tce_table_finalize()David Gibson1-3/+3
spapr_tce_table_finalize() can SEGV if the object was not previously realized. In particular this can be triggered by running qemu-system-ppc -device spapr-tce-table,? The basic problem is that we have mismatched initialization versus finalization: spapr_tce_table_finalize() is attempting to undo things that are done in spapr_tce_table_realize(), not an instance_init function. Therefore, replace spapr_tce_table_finalize() with spapr_tce_table_unrealize(). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Cc: qemu-stable@nongnu.org Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 5f9490de566c5b092a6cfedc3c7a37a9c9dee917) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-14pc: acpi: mark all possible CPUs as enabled in SRATIgor Mammedov1-8/+3
If QEMU is started with -numa ... Windows only notices that CPU has been hot-added but it will not online such CPUs. It's caused by the fact that possible CPUs are flagged as not enabled in SRAT and Windows honoring that information doesn't use corresponding CPU. ACPI 5.0 Spec regarding to flag says: " Table 5-47 Local APIC Flags ... Enabled: if zero, this processor is unusable, and the operating system support will not attempt to use it. " Fix QEMU to adhere to spec and mark possible CPUs as enabled in SRAT. With that Windows onlines hot-added CPUs as expected. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit dd0247e09a542d2a7ba6e390c70b5616edb9ec56) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-07virtio-net: fix unmap leakJason Wang1-2/+3
virtio_net_handle_ctrl() and other functions that process control vq request call iov_discard_front() which will shorten the iov. This will lead unmapping in virtqueue_push() leaks mapping. Fixes this by keeping the original iov untouched and using a temp variable in those functions. Cc: Wen Congyang <wency@cn.fujitsu.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1417082643-23907-1-git-send-email-jasowang@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 771b6ed37e3aa188a7485560b949a41c6cf174dc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-07hw/ide/core.c: Prevent SIGSEGV during migrationDon Slutz1-1/+1
The other callers to blk_set_enable_write_cache() in this file already check for s->blk == NULL. Signed-off-by: Don Slutz <dslutz@verizon.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1416259239-13281-1-git-send-email-dslutz@verizon.com Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit 6b896ab261942f441a16836e3fa3c83f3f4488b9) Conflicts: hw/ide/core.c *removed dependency on 4be746345 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-07virtio-scsi: work around bug in old BIOSesPaolo Bonzini1-0/+17
Old BIOSes left some padding by mistake after the req_size/resp_size. New QEMU does not like it, thinking it is a bidirectional command. As a workaround, we can check if the ANY_LAYOUT bit is set; if not, we always consider the first buffer as the virtio-scsi request/response, because, back when QEMU did not support ANY_LAYOUT, it expected the payload to start at the second element of the iovec. This can show up during migration. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 55783a5521a3b1f93ee6a072e414a27c6cfa15f0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-07esp-pci: fixup deadlock with linuxHannes Reinecke1-0/+2
A linux guest will be issuing messages: [ 32.124042] DC390: Deadlock in DataIn_0: DMA aborted unfinished: 000000 bytes remain!! [ 32.126348] DC390: DataIn_0: DMA State: 0 and the HBA will fail to work properly. Reason is the emulation is not setting the 'DMA transfer done' status correctly. Signed-off-by: Hannes Reinecke <hare@suse.de> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit c3543fb5fe4520f03dd4fef04fab7745eeca1c96) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-07hw/ppc/spapr_pci.c: Avoid functions not in glib 2.12 (g_hash_table_iter_*)Peter Maydell1-11/+17
The g_hash_table_iter_* functions for iterating through a hash table are not present in glib 2.12, which is our current minimum requirement. Rewrite the code to use g_hash_table_foreach() instead. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit f8833a37c0c6b22ddd57b45e48cfb0f97dbd5af4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06hw/xtensa/xtfpga: treat uImage load address as virtualMax Filippov1-1/+1
U-boot for xtensa always treats uImage load address as virtual address. This is important when booting uImage on xtensa core with MMUv2, because MMUv2 has fixed non-identity virtual-to-physical mapping after reset. Always do virtual-to-physical translation of uImage load address and load uImage at the translated address. This fixes booting uImage kernels on dc232b and other MMUv2 cores. Cc: qemu-stable@nongnu.org Reported-by: Waldemar Brodkorb <mail@waldemar-brodkorb.de> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> (cherry picked from commit 6d2e4530532ca1dbb5e68bdcca12e10931bc6503) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06hw/core/loader: implement address translation in uimage loaderMax Filippov10-13/+29
Such address translation is needed when load address recorded in uImage is a virtual address. When the actual load address is requested, return untranslated address: user that needs the translated address can always apply translation function to it and those that need it untranslated don't need to do the inverse translation. Add translation function pointer and its parameter to uimage_load prototype. Update all existing users. No user-visible functional changes. Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 25bda50a0c7241dcb247483af2b7f961632020cc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-scsi: sense in virtio_scsi_command_completeTing Wang1-1/+1
If req->resp.cmd.status is not GOOD, the address of sense for qemu_iovec_from_buf should be modified from &req->resp to sense. Cc: qemu-stable@nongnu.org Signed-off-by: Ting Wang <kathy.wangting@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit b7890c40e557f4733b6fcd1eb79af79b70dc8c05) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06vmware-vga: use vmsvga_verify_rect in vmsvga_fill_rectGerd Hoffmann1-7/+10
Add verification to vmsvga_fill_rect, re-enable HW_FILL_ACCEL. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com> (cherry picked from commit bd9ccd8517e83b7c33a9167815dbfffb30d70b13) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06vmware-vga: use vmsvga_verify_rect in vmsvga_copy_rectGerd Hoffmann1-6/+14
Add verification to vmsvga_copy_rect, re-enable HW_RECT_ACCEL. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com> (cherry picked from commit 61b41b4c20eba08d2185297767e69153d7f3e09d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06vmware-vga: use vmsvga_verify_rect in vmsvga_update_rectGerd Hoffmann1-28/+4
Switch vmsvga_update_rect over to use vmsvga_verify_rect. Slight change in behavior: We don't try to automatically fixup rectangles any more. In case we find invalid update requests we'll do a full-screen update instead. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com> (cherry picked from commit 1735fe1edba9cc86bc0f26937ed5a62d3cb47c9c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06vmware-vga: add vmsvga_verify_rectGerd Hoffmann1-1/+52
Add verification function for rectangles, returning true if verification passes and false otherwise. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com> (cherry picked from commit 07258900fd45b646f5b69048d64c4490b3243e1b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06vmware-vga: CVE-2014-3689: turn off hw accelGerd Hoffmann1-0/+2
Quick & easy stopgap for CVE-2014-3689: We just compile out the hardware acceleration functions which lack sanity checks. Thankfully we have capability bits for them (SVGA_CAP_RECT_COPY and SVGA_CAP_RECT_FILL), so guests should deal just fine, in theory. Subsequent patches will add the missing checks and re-enable the hardware acceleration emulation. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com> (cherry picked from commit 83afa38eb20ca27e30683edc7729880e091387fc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06pc: Fix disabling of vapic for compat PC modelsJan Kiszka1-1/+1
We used to be able to address both the QEMU and the KVM APIC via "apic". This doesn't work anymore. So we need to use their parent class to turn off the vapic on machines that should not expose them. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit df1fd4b541b3ae0dc44843741363d00080775294) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-9p: fix virtio-9p child refcount in transportsGonglei1-0/+1
object_initialize() leaves the object with a refcount of 1. object_property_add_child() adds its own reference which is dropped again when the property is deleted. The upshot of this is that we always have a refcount >= 1. Upon unplug the virtio-9p child is not finalized! Drop our reference after the child property has been added to the parent. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8f3d60e568f53cb3ccdedd917f8e49cdb304973b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-9p: use aliases instead of duplicate qdev propertiesGonglei1-1/+1
virtio-9p-pci all duplicate the qdev properties of their V9fsState child. This approach does not work well with string or pointer properties since we must be careful about leaking or double-freeing them. Use the QOM alias property to forward property accesses to the V9fsState child. This way no duplication is necessary. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 48833071d955406ebeddc365a8df8b5cb12b035f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-balloon: fix virtio-balloon child refcount in transportsGonglei2-2/+2
object_initialize() leaves the object with a refcount of 1. object_property_add_child() adds its own reference which is dropped again when the property is deleted. The upshot of this is that we always have a refcount >= 1. Upon hot unplug the virtio-balloon child is not finalized! Drop our reference after the child property has been added to the parent. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 91ba21208839643603e7f7fa5864723c3f371ebe) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-rng: fix virtio-rng child refcount in transportsGonglei3-0/+3
object_initialize() leaves the object with a refcount of 1. object_property_add_child() adds its own reference which is dropped again when the property is deleted. The upshot of this is that we always have a refcount >= 1. Upon hot unplug the virtio-rng child is not finalized! Drop our reference after the child property has been added to the parent. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 352fa88dfb2e9c72fa2a1506acb39f349d4befbf) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-rng: use aliases instead of duplicate qdev propertiesGonglei3-3/+3
virtio-rng-{pci, s390, ccw} all duplicate the qdev properties of their VirtIORNG child. This approach does not work well with string or pointer properties since we must be careful about leaking or double-freeing them. Use the QOM alias property to forward property accesses to the VirtIORNG child. This way no duplication is necessary. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 8ee486ae339f0e5236f4a9ab988fc963edcc73b5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-serial: fix virtio-serial child refcount in transportsGonglei3-0/+3
object_initialize() leaves the object with a refcount of 1. object_property_add_child() adds its own reference which is dropped again when the property is deleted. The upshot of this is that we always have a refcount >= 1. Upon hot unplug the virtio-serial child is not finalized! Drop our reference after the child property has been added to the parent. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit e77ca8b92af8a5213897331d676089e8919f383d) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-serial: use aliases instead of duplicate qdev propertiesGonglei3-3/+3
virtio-serial-{pci, s390, ccw} all duplicate the qdev properties of their VirtIOSerial child. This approach does not work well with string or pointer properties since we must be careful about leaking or double-freeing them. Use the QOM alias property to forward property accesses to the VirtIOSerial child. This way no duplication is necessary. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 4f456d8025c7259c66b2b2bcec99d5c6c94d99be) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio/vhost-scsi: fix virtio-scsi/vhost-scsi child refcount in transportsGonglei3-0/+6
object_initialize() leaves the object with a refcount of 1. object_property_add_child() adds its own reference which is dropped again when the property is deleted. The upshot of this is that we always have a refcount >= 1. Upon hot unplug the virtio-scsi/vhost-scsi child is not finalized! Drop our reference after the child property has been added to the parent. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 1312f12bcc8911ed99b67227fb9d1607295f71ed) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio/vhost-scsi: use aliases instead of duplicate qdev propertiesGonglei3-6/+6
{virtio, vhost}-scsi-{pci, s390, ccw} all duplicate the qdev properties of their VirtIOSCSI/VHostSCSI child. This approach does not work well with string or pointer properties since we must be careful about leaking or double-freeing them. Use the QOM alias property to forward property accesses to the VirtIOSCSI/VHostSCSI child. This way no duplication is necessary. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit c39343fd811a22c921fc08e9e6ca62c8e7539264) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-net: fix virtio-net child refcount in transportsGonglei3-0/+3
object_initialize() leaves the object with a refcount of 1. object_property_add_child() adds its own reference which is dropped again when the property is deleted. The upshot of this is that we always have a refcount >= 1. Upon hot unplug the virtio-net child is not finalized! Drop our reference after the child property has been added to the parent. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 6a0c6b59788627541faf70864464f1e155dc18d7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06virtio-net: use aliases instead of duplicate qdev propertiesGonglei3-6/+3
virtio-net-pci, virtio-net-s390, and virtio-net-ccw all duplicate the qdev properties of their VirtIONet child. This approach does not work well with string or pointer properties since we must be careful about leaking or double-freeing them. Use the QOM alias property to forward property accesses to the VirtIONet child. This way no duplication is necessary. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7779edfeb1822ff5f554a4c1f3e9798789a9352c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06vhost-scsi: use virtio_ldl_pPaolo Bonzini1-2/+3
This helps for cross-endian configurations. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7ce0425575745a40e94e75426607e0bec17899fa) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06smbios: Fix assertion on socket count calculationEduardo Habkost1-1/+1
QEMU currently allows the number of VCPUs to not be a multiple of the number of threads per socket, but the smbios socket count calculation introduced by commit c97294ec1b9e36887e119589d456557d72ab37b5 doesn't take that into account, triggering an assertion. e.g.: $ ./x86_64-softmmu/qemu-system-x86_64 -smp 4,sockets=2,cores=6,threads=1 qemu-system-x86_64: /home/ehabkost/rh/proj/virt/qemu/hw/i386/smbios.c:825: smbios_get_tables: Assertion `smbios_smp_sockets >= 1' failed. Aborted (core dumped) Socket count calculation doesn't belong to smbios.c and should eventually be moved to the main SMP topology configuration code. But while we don't move the code, at least make it correct by rounding up the division. Cc: Gabriel Somlo <somlo@cmu.edu> Cc: qemu-stable@nongnu.org Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-By: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 7dfddd7f884b6dd2abf230d8fa6c7c83aab4f5ec) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06pc-dimm: Don't check dimm->node when there is non-NUMA configzhanghailiang1-1/+1
It should not break memory hotplug feature if there is non-NUMA option. This patch would also allow to use pc-dimm as replacement for initial memory for non-NUMA configs. Note: After this patch, the memory hotplug can work normally for Linux guest OS when there is non-NUMA option and NUMA option. But not support Windows guest OS to hotplug memory with no-NUMA config, actully, it's Windows limitation. Reviewed-By: Igor Mammedov <imammedo@redhat.com> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit fc50ff0666315be5120c70ad00cd0b0097484b84) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06ivshmem: Fix fd leak on errorAndreas Färber1-0/+1
Reported-by: Stefan Hajnoczi <stefanha@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 3a31cff11203bf62ebafa6d74b1fcf2aba345eed) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06ivshmem: Fix potential OOB r/w accessSebastian Krahmer1-4/+23
Fix OOB access via malformed incoming_posn parameters and check that requested memory is actually alloc'ed. Signed-off-by: Sebastian Krahmer <krahmer@suse.de> [AF: Rebased, cleanups, avoid fd leak] Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 34bc07c5282a631c2663ae1ded0a186f46f64612) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06ivshmem: validate incoming_posn value from serverStefan Hajnoczi1-0/+8
Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem server on the host sends invalid values. Cc: Cam Macdonell <cam@cs.ualberta.ca> Reported-by: Sebastian Krahmer <krahmer@suse.de> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> [AF: Tighten upper bound check for posn in close_guest_eventfds()] Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 363ba1c72fed4425e7917afc36722584aaeaad8a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-06ivshmem: Check ivshmem_read() size argumentStefan Hajnoczi1-2/+28
The third argument to the fd_read() callback implemented by ivshmem_read() is the number of bytes, not a flags field. Fix this and check we received enough bytes before accessing the buffer pointer. Cc: Cam Macdonell <cam@cs.ualberta.ca> Reported-by: Sebastian Krahmer <krahmer@suse.de> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> [AF: Handle partial reads via FIFO] Reported-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit a2e9011b4164894594bf0b2a2a59e9c55c58c17b) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-05vhost-user: fix VIRTIO_NET_F_MRG_RXBUF negotiationDamjan Marion1-4/+4
Header length check should happen only if backend is kernel. For user backend there is no reason to reset this bit. vhost-user code does not define .has_vnet_hdr_len so VIRTIO_NET_F_MRG_RXBUF cannot be negotiated even if both sides support it. Signed-off-by: Damjan Marion <damarion@cisco.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit d8e80ae37a7acfea416ad9abbe76b453a73d9cc0) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-01-05virtio-balloon: fix integer overflow in memory stats featureLuiz Capitulino1-1/+6
When a QMP client changes the polling interval time by setting the guest-stats-polling-interval property, the interval value is stored and manipulated as an int64_t variable. However, the balloon_stats_change_timer() function, which is used to set the actual timer with the interval value, takes an int instead, causing an overflow for big interval values. This commit fix this bug by changing balloon_stats_change_timer() to take an int64_t and also it limits the polling interval value to UINT_MAX to avoid other kinds of overflow. Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 1f9296b51a26650916a2c4191268bb64057bdc5f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24hw/arm/virt: fix pl011 and pl031 irq flagsPeter Maydell1-2/+2
The pl011 and pl031 devices both use level triggered interrupts, but the device tree we construct was incorrectly telling the kernel to configure the GIC to treat them as edge triggered. This meant that output from the pl011 would hang after a while. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410274423-9461-1-git-send-email-peter.maydell@linaro.org Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Cc: qemu-stable@nongnu.org (cherry picked from commit 0be969a2d974971628fc4ed95834d22ecf0fd497) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24spapr_pci: map the MSI window in each PHBGreg Kurz2-30/+24
On sPAPR, virtio devices are connected to the PCI bus and use MSI-X. Commit cc943c36faa192cd4b32af8fe5edb31894017d35 has modified MSI-X so that writes are made using the bus master address space and follow the IOMMU path. Unfortunately, the IOMMU address space address space does not have an MSI window: the notification is silently dropped in unassigned_mem_write instead of reaching the guest... The most visible effect is that all virtio devices are non-functional on sPAPR since then. :( This patch does the following: 1) map the MSI window into the IOMMU address space for each PHB - since each PHB instantiates its own IOMMU address space, we can safely map the window at a fixed address (SPAPR_PCI_MSI_WINDOW) - no real need to keep the MSI window setup in a separate function, the spapr_pci_msi_init() code moves to spapr_phb_realize(). 2) kill the global MSI window as it is not needed in the end Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 8c46f7ec85a4dd9663489b2fa2b425cd7b3653e1) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24virtio-pci: enable bus master for old guestsMichael S. Tsirkin1-0/+10
commit cc943c36faa192cd4b32af8fe5edb31894017d35 pci: Use bus master address space for delivering MSI/MSI-X messages breaks virtio-net for rhel6.[56] x86 guests because they don't enable bus mastering for virtio PCI devices. For the same reason, rhel6.[56] ppc64 guests cannot boot on a virtio-blk disk anymore. Old guests forgot to enable bus mastering, enable it automatically on DRIVER (guests use some devices before DRIVER_OK). Reported-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Tested-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit e43c0b2ea5574efb0bedebf6a7d05916eefeba52) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24pci: Use bus master address space for delivering MSI/MSI-X messagesJan Kiszka2-2/+2
The spec says (and real HW confirms this) that, if the bus master bit is 0, the device will not generate any PCI accesses. MSI and MSI-X messages fall among these, so we should use the corresponding address space to deliver them. This will prevent delivery if bus master support is disabled. Cc: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit cc943c36faa192cd4b32af8fe5edb31894017d35) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24kvmclock: Add comment explaining why we need cpu_clean_all_dirty()Eduardo Habkost1-0/+14
Try to explain why commit 317b0a6d8ba44e9bf8f9c3dbd776c4536843d82c needed a cpu_clean_all_dirty() call just after calling cpu_synchronize_all_states(). Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Cc: Andrey Korolyov <andrey@xdel.ru> Cc: Marcin Gibuła <m.gibula@beyond.pl> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 1154d84dcc5f46e83db94281d071775819dd8884) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24kvmclock: Ensure time in migration never goes backwardAlexander Graf1-0/+49
When we migrate we ask the kernel about its current belief on what the guest time would be. However, I've seen cases where the kvmclock guest structure indicates a time more recent than the kvm returned time. To make sure we never go backwards, calculate what the guest would have seen as time at the point of migration and use that value instead of the kernel returned one when it's more recent. This bases the view of the kvmclock after migration on the same foundation in host as well as guest. Signed-off-by: Alexander Graf <agraf@suse.de> Cc: qemu-stable@nongnu.org Reviewed-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 9a48bcd1b82494671c111109b0eefdb882581499) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec calculationMarcelo Tosatti1-0/+4
Ensure proper env->tsc value for kvmclock_current_nsec calculation. Reported-by: Marcin Gibuła <m.gibula@beyond.pl> Analyzed-by: Marcin Gibuła <m.gibula@beyond.pl> Cc: qemu-stable@nongnu.org Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 317b0a6d8ba44e9bf8f9c3dbd776c4536843d82c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24xhci PCIe endpoint migration compatibility fixDr. David Alan Gilbert1-1/+5
Add back the PCIe config capabilities on XHCI cards in non-PCIe slots, but only for machine types before 2.1. This fixes a migration incompatibility in the XHCI PCI devices caused by: 058fdcf52cdbf57b67e7 - xhci: add endpoint cap on express bus only Note that in fixing it for compatibility with older QEMUs, it breaks compatibility with existing QEMU 2.1's on older machine types. The status before this patch was (if it used an XHCI adapter): machine type | source qemu any pre-2.1 - FAIL any 2.1... - PASS With this patch: machine type | source qemu any pre-2.1 - PASS pre-2.1 2.1... - FAIL 2.1 2.1... - PASS A test to trigger it is to add '-device nec-usb-xhci,id=xhci,addr=0x12' to the command line. Cc: qemu-stable@nongnu.org Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit e6043e92c2812a56b8f6cf35d5512067c746ce21) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24qdev: Add cleanup logic in device_set_realized() to avoid resource leakGonglei1-14/+38
At present, this function doesn't have partial cleanup implemented, which will cause resource leaks in some scenarios. Example: 1. Assume that "dc->realize(dev, &local_err)" executes successful and local_err == NULL; 2. device hotplug in hotplug_handler_plug() executes but fails (it is prone to occur). Then local_err != NULL; 3. error_propagate(errp, local_err) and return. But the resources which have been allocated in dc->realize() will be leaked. Simple backtrace: dc->realize() |->device_realize |->pci_qdev_init() |->do_pci_register_device() |->etc. Add fuller cleanup logic which assures that function can goto appropriate error label as local_err population is detected at each relevant point. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit 1d45a705fc007a13f20d18473290082eae6d1725) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-12-24qdev: Use NULL instead of local_err for qbus_child unrealizeGonglei1-7/+7
Forcefully unrealize all children regardless of errors in earlier iterations (if any). We should keep going with cleanup operation rather than report an error immediately. Therefore store the first child unrealization failure and propagate it at the end. We also forcefully unregister vmsd and unrealize actual object, too. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> (cherry picked from commit cd4520adcab70dbac8db3fe4d41836dca63715a4) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-09-23pc: leave more space for BIOS allocationsMichael S. Tsirkin1-2/+4
Since QEMU 2.1, we are allocating more space for ACPI tables, so no space is left after initrd for the BIOS to allocate memory. Besides ACPI tables, there are a few other uses of high memory in SeaBIOS: SMBIOS tables and USB drivers use it in particular. These uses allocate a very small amount of memory. Malloc metadata also lives there. So we need _some_ extra padding there to avoid initrd breakage, but not much. John Snow found a case where RHEL5 was broken by the recent change to ACPI_TABLE_SIZE; in his case 4KB of extra padding are fine, but just to be safe I am adding 32KB, which is roughly the same amount of padding that was left by QEMU 2.0 and earlier. Move initrd to leave some space for the BIOS. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: John Snow <jsnow@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 438f92ee9f6a4f78f8adcc399809e252b6da72a2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-09-23Revert "virtio: don't call device on !vm_running"Michael S. Tsirkin1-8/+1
This reverts commit a1bc7b827e422e1ff065640d8ec5347c4aadfcd8. virtio: don't call device on !vm_running It turns out that virtio net assumes that vm_running is updated before device status callback in many places, so this change leads to asserts. Previous commit fixes the root issue that motivated a1bc7b827e422e1ff065640d8ec5347c4aadfcd8 differently, so there's no longer a need for this change. In the future, we might be able to drop checking vm_running completely, and check vm state directly. Reported-by: Dietmar Maurer <dietmar@proxmox.com> Cc: qemu-stable@nongnu.org Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 9e8e8c48653471fa5fed447e388fdef57d4f6998) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-09-23virtio-net: drop assert on vm stopMichael S. Tsirkin1-2/+0
On vm stop, vm_running state set to stopped before device is notified, so callbacks can get envoked with vm_running = false; and this is not an error. Cc: qemu-stable@nongnu.org Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 131c5221fe25a9547c4a388a3d26ff7fd14843e5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2014-09-23hw/machine: Free old values of string propertiesEduardo Habkost1-0/+8
Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit 556068eed04b7f11187aabd89b981552d8d0c30e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-24 01:39:20 +0000