aboutsummaryrefslogtreecommitdiff
path: root/hw/core
AgeCommit message (Collapse)Author
2016-11-30loader: fix undefined behavior in rom_order_compare()Laszlo Ersek
According to ISO C99 / N1256 (referenced in HACKING): > 6.5.8 Relational operators > > 4 For the purposes of these operators, a pointer to an object that is > not an element of an array behaves the same as a pointer to the first > element of an array of length one with the type of the object as its > element type. > > 5 When two pointers are compared, the result depends on the relative > locations in the address space of the objects pointed to. If two > pointers to object or incomplete types both point to the same object, > or both point one past the last element of the same array object, they > compare equal. If the objects pointed to are members of the same > aggregate object, pointers to structure members declared later compare > greater than pointers to members declared earlier in the structure, > and pointers to array elements with larger subscript values compare > greater than pointers to elements of the same array with lower > subscript values. All pointers to members of the same union object > compare equal. If the expression /P/ points to an element of an array > object and the expression /Q/ points to the last element of the same > array object, the pointer expression /Q+1/ compares greater than /P/. > In all other cases, the behavior is undefined. Our AddressSpace objects are allocated generally individually, and kept in the "address_spaces" linked list, so we mustn't compare their addresses with relops. Convert the pointers subjected to the relop in rom_order_compare() to "uintptr_t": > 7.18.1.4 Integer types capable of holding object pointers > > 1 [...] > > The following type designates an unsigned integer type with the > property that any valid pointer to void can be converted to this type, > then converted back to pointer to void, and the result will compare > equal to the original pointer: > > /uintptr_t/ > > These types are optional. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Alistair Francis <alistair.francis@xilinx.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-devel@nongnu.org Fixes: 3e76099aacb4dae0d37ebf95305369e03d1491e6 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-30loader: fix handling of custom address spaces when adding ROM blobsLaszlo Ersek
* Commit 3e76099aacb4 ("loader: Allow a custom AddressSpace when loading ROMs") introduced the "Rom.as" field: (1) It modified the utility callers of rom_insert() to take "as" as a new parameter from *their* callers, and set "rom->as" from that parameter. The functions covered were rom_add_file() and rom_add_elf_program(). (2) It also modified rom_insert() itself, to auto-assign "&address_space_memory", in case the external caller passed -- and the utility caller forwarded -- as=NULL. Except, commit 3e76099aacb4 forgot to update the third utility caller of rom_insert(), under point (1), namely rom_add_blob(). * Later, commit 5e774eb3bd264 ("loader: Add AddressSpace loading support to uImages") added the load_uimage_as() function, and the rom_add_blob_fixed_as() function-like macro, with the necessary changes elsewhere to propagate the new "as" parameter to rom_add_blob(): load_uimage_as() load_uboot_image() rom_add_blob_fixed_as() rom_add_blob() At this point, the signature (and workings) of rom_add_blob() had been broken already, and the rom_add_blob_fixed_as() macro passed its "_as" parameter to rom_add_blob() as "callback_opaque". Given that the "fw_callback" parameter itself was set to NULL (correctly), this did no additional damage (the opaque arg would never be used), but ultimately it broke the new functionality of load_uimage_as(). * The load_uimage_as() function would be put to use in one of the later patches, commit e481a1f63c93 ("generic-loader: Add a generic loader"). * We can fix this only in a unified patch now. Append "AddressSpace *as" to the signature of rom_add_blob(), and handle the new parameter. Pass NULL from all current callers, except from rom_add_blob_fixed_as(), where "_as" has to be bumped to the proper position. * Note that rom_add_file() rejects the case when both "mr" and "as" are passed in as non-NULL. The action that this is apparently supposed to prevent is the rom->mr = mr; assignment (that's the only place where the "mr" parameter is used in rom_add_file()). In rom_add_blob() though, we have no "mr" parameter, and the actions done on the fw_cfg branch: if (fw_file_name && fw_cfg) { if (mc->rom_file_has_mr) { data = rom_set_mr(rom, OBJECT(fw_cfg), devpath); mr = rom->mr; } else { data = rom->data; } reflect those that are performed by rom_add_file() too (with mr==NULL): if (rom->fw_file && fw_cfg) { if ((!option_rom || mc->option_rom_has_mr) && mc->rom_file_has_mr) { data = rom_set_mr(rom, OBJECT(fw_cfg), devpath); } else { data = rom->data; } Hence we need no additional restrictions in rom_add_blob(). * Stable is not affected as both problematic commits appeared first in v2.8.0-rc0. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Alistair Francis <alistair.francis@xilinx.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Michael Walle <michael@walle.cc> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Shannon Zhao <zhaoshenglong@huawei.com> Cc: qemu-arm@nongnu.org Cc: qemu-devel@nongnu.org Fixes: 3e76099aacb4dae0d37ebf95305369e03d1491e6 Fixes: 5e774eb3bd264c76484906f4bd0fb38e00b8090e Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-28generic-loader: file: Only set a PC if a CPU is specifiedAlistair Francis
This patch fixes the generic-loader file loading to only set the program counter if a CPU is specified. This follows what is written in the documentation and was always part of the original intention. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 537bf4d08be7acf7a89b590cff69e19db7f0a6cd.1478908712.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-11-15Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingStefan Hajnoczi
virtio, vhost, pc, pci: documentation, fixes and cleanups Lots of fixes all over the place. Unfortunately, this does not yet fix a regression with vhost introduced by the last pull, the issue is typically this error: kvm_mem_ioeventfd_add: error adding ioeventfd: File exists followed by QEMU aborting. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> * remotes/mst/tags/for_upstream: (28 commits) docs: add PCIe devices placement guidelines virtio: drop virtio_queue_get_ring_{size,addr}() vhost: drop legacy vring layout bits vhost: adapt vhost_verify_ring_mappings() to virtio 1 ring layout nvdimm acpi: introduce NVDIMM_DSM_MEMORY_SIZE nvdimm acpi: use aml_name_decl to define named object nvdimm acpi: rename nvdimm_dsm_reserved_root nvdimm acpi: fix two comments nvdimm acpi: define DSM return codes nvdimm acpi: rename nvdimm_acpi_hotplug nvdimm acpi: cleanup nvdimm_build_fit nvdimm acpi: rename nvdimm_plugged_device_list docs: improve the doc of Read FIT method nvdimm acpi: clean up nvdimm_build_acpi pc: memhp: stop handling nvdimm hotplug in pc_dimm_unplug pc: memhp: move nvdimm hotplug out of memory hotplug nvdimm acpi: drop the lock of fit buffer qdev: hotplug: drop HotplugHandler.post_plug callback vhost: migration blocker only if shared log is used virtio-net: mark VIRTIO_NET_F_GSO as legacy ... Message-id: 1479237527-11846-1-git-send-email-mst@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-11-15qdev: Fix assert in PCI address property when used by vfio-pciDaniel Oram
Allow the PCIHostDeviceAddress structure to work as the host property in vfio-pci when it has it's default value of all fields set to ~0. In this form the property indicates a non-existant device but given the field bit sizes gets asserted as excess (and invalid) precision overflows the string buffer. The BDF of an invalid device "FFFF:FF:FF.F" is returned instead. Signed-off-by: Daniel Oram <daniel.oram@gmail.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Message-Id: <71f06765c4ba16dcd71cbf78e877619948f04ed9.1478777270.git.daniel.oram@gmail.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-11-15qdev: hotplug: drop HotplugHandler.post_plug callbackXiao Guangrong
as nvdimm acpi is okay to build fit when the nvdimm device has not been 'realized' Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-10qdev: fix use-after-free regression from becdfa00cfaMarc-André Lureau
Spotted by Coverity, CID 1365383. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20161107095922.31676-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-01nvdimm acpi: introduce fit bufferXiao Guangrong
The buffer is used to save the FIT info for all the presented nvdimm devices which is updated after the nvdimm device is plugged or unplugged. In the later patch, it will be used to construct NVDIMM ACPI _FIT method which reflects the presented nvdimm devices after nvdimm hotplug As FIT buffer can not completely mapped into guest address space, OSPM will exit to QEMU multiple times, however, there is the race condition - FIT may be changed during these multiple exits, so that some rules are introduced: 1) the user should hold the @lock to access the buffer and 2) mark @dirty whenever the buffer is updated. @dirty is cleared for the first time OSPM gets fit buffer, if dirty is detected in the later access, OSPM will restart the access As fit should be updated after nvdimm device is successfully realized so that a new hotplug callback, post_hotplug, is introduced Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-24hw/ptimer: Add "no counter round down" policyDmitry Osipenko
For most of the timers counter starts to decrement after first period expires. Due to rounding down performed by the ptimer_get_count, it returns counter - 1 for the running timer, so that for the ptimer user it looks like counter gets decremented immediately after running the timer. Add "no counter round down" policy that provides correct behaviour for those timers. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: ef39622d0ebfdc32a0877e59ffdf6910dc3db688.1475421224.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-24hw/ptimer: Add "no immediate reload" policyDmitry Osipenko
Immediate counter re-load on setting (or on starting to run with) counter = 0 is a wrong behaviour for some of the timers. Add "no immediate reload" policy that provides correct behaviour for such timers. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: bf9385cd2550ca451d564fa46007688cee3f3d9d.1475421224.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-24hw/ptimer: Add "no immediate trigger" policyDmitry Osipenko
Performing trigger on setting (or starting to run with) counter = 0 could be a wrong behaviour for some of the timers, provide "no immediate trigger" policy to maintain correct behaviour for such timers. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 72c0319cf2ec599f22397b7da280c06c34dc40dd.1475421224.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-24hw/ptimer: Add "continuous trigger" policyDmitry Osipenko
Currently, periodic timer that has load = delta = 0 performs trigger on timer reload and stops, printing a "period zero" error message. Introduce new policy that makes periodic timer to continuously trigger with a period interval in case of load = 0. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 632b23dd11055d9bd5e338d66b38fac0bd51462e.1475421224.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-24hw/ptimer: Add "wraparound after one period" policyDmitry Osipenko
Currently, periodic counter wraps around immediately once counter reaches "0", this is wrong behaviour for some of the timers, resulting in one period being lost. Add new ptimer policy that provides correct behaviour for such timers, so that counter stays with "0" for a one period before wrapping around. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: f22a670cf1f4be298b31640cb5f4be1df0f20ab6.1475421224.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-24char: replace qemu_chr_claim/release with qemu_chr_fe_init/deinitMarc-André Lureau
Now that all front end use qemu_chr_fe_init(), we can move chardev claiming in init(), and add a function deinit() to release the chardev and cleanup handlers. The qemu_chr_fe_claim_no_fail() for property are gone, since the property will raise an error instead. In other cases, where there is already an error path, an error is raised instead. Finally, other cases are handled by &error_abort in qemu_chr_fe_init(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20161022095318.17775-19-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-10-24char: replace PROP_CHR with CharBackendMarc-André Lureau
Store the property in a CharBackend instead of CharDriverState*. This also replace systematically chr by chr.chr to access the CharDriverState*. The following patches will replace it with calls to qemu_chr_fe CharBackend functions. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20161022095318.17775-12-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-10-17machine: Register TYPE_MACHINE properties as class propertiesEduardo Habkost
When doing the conversion, the NULL errp arguments on the property registration calls were changed to &error_abort. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-10-04generic-loader: Add a generic loaderAlistair Francis
Add a generic loader to QEMU which can be used to load images or set memory values. Internally inside QEMU this is a device. It is a strange device that provides no hardware interface but allows QEMU to monkey patch memory specified when it is created. To be able to do this it has a reset callback that does the memory operations. This device allows the user to monkey patch memory. To be able to do this it needs a backend to manage the datas, the same as other memory-related devices. In this case as the backend is so trivial we have merged it with the frontend instead of creating and maintaining a seperate backend. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Markus Armbruster <armbru@redhat.com> Message-id: 10f2a9dce5e5e11b6c6d959415b0ad6ee22bcba5.1475195078.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-04irq: Add a new irq device that allows the ORing of linesAlistair Francis
Signed-off-by: Alistair Francis <alistair@alistair23.me> Message-id: 52e5d361e3b5a0ea8554aca73ee65ae2b586112e.1474742262.git.alistair@alistair23.me Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-27sysbus: Remove ignored return value of FindSysbusDeviceFuncDavid Gibson
Functions of type FindSysbusDeviceFunc currently return an integer. However, this return value is always ignored by the caller in find_sysbus_device(). This changes the function type to return void, to avoid confusion over the function semantics. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-09-22loader: Add AddressSpace loading support to targphysAlistair Francis
Add a new function load_image_targphys_as() that allows the caller to specify an AddressSpace to use when loading a targphys. The original load_image_targphys() function doesn't have any change in functionality. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 87de45de7acf02cbe6bae9d6c4d6fb8f3aba4f61.1474331683.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22loader: Add AddressSpace loading support to uImagesAlistair Francis
Add a new function load_uimage_as() that allows the caller to specify an AddressSpace to use when loading the uImage. The original load_uimage() function doesn't have any change in functionality. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1254092e6b80d3cd3cfabafe165d56a96c54c0b5.1474331683.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22loader: Add AddressSpace loading support to ELFsAlistair Francis
Add a new function load_elf_as() that allows the caller to specify an AddressSpace to use when loading the ELF. The original load_elf() function doesn't have any change in functionality. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 8b5cefecdf56fba4ccdff2db880f0b6b264cf16f.1474331683.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22loader: Allow a custom AddressSpace when loading ROMsAlistair Francis
When loading ROMs allow the caller to specify an AddressSpace to use for the load. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 85f86b94ea94879e7ce8b12e85ac8de26658f7eb.1474331683.git.alistair.francis@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22loader: Use the specified MemoryRegionAlistair Francis
Prevously the specified MemoryRegion was ignored during the rom register reset. This patch uses the rom MemoryRegion is avaliable. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: d63fef5524deeb88e0068ca9d3fd4c8344f54dd4.1474331683.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22hw/ptimer: Suppress error messages under qtestDmitry Osipenko
Under qtest ptimer emits lots of warning messages. The messages are caused by the actual checking of the ptimer error conditions. Suppress those messages, so they do not distract. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 44877fff4ff03205590698d3dc189ad6d091472f.1473252818.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22hw/ptimer: Introduce timer policy featureDmitry Osipenko
Some of the timer devices may behave differently from what ptimer provides. Introduce ptimer policy feature that allows ptimer users to change default and wrong timer behaviour, for example to continuously trigger periodic timer when load value is equal to "0". Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 994cd608ec392da6e58f0643800dda595edb9d97.1473252818.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22hw/ptimer: Actually stop the timer in case of errorDmitry Osipenko
Running with counter / period = 0 is treated as a error case, printing error message claiming that timer has been disabled. However, timer is only marked as disabled, keeping to tick till expired and triggering after being claimed as disabled. Stop the QEMU timer to avoid confusion. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 1e9bae4fae3c36430d7c28b0f486a0c71aff7eb3.1473252818.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-08bus: simplify name handlingMarc-André Lureau
Simplify a bit the code by using g_strdup_printf() and store it in a non-const value so casting is no longer needed, and ownership is clearer. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-09-08machine: use class base init generated nameMarc-André Lureau
machine_class_base_init() member name is allocated by machine_class_base_init(), but not freed by machine_class_finalize(). Simply freeing there doesn't work, because DEFINE_PC_MACHINE() overwrites it with a literal string. Fix DEFINE_PC_MACHINE() not to overwrite it, and add the missing free to machine_class_finalize(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
2016-08-08block/qdev: Let 'drive' property fall back to node nameKevin Wolf
If a qdev block device is created with an anonymous BlockBackend (i.e. a node name rather than a BB name was given for the drive property), qdev used to return an empty string when the property was read. This patch fixes it to return the node name instead. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-08-03qdev: Fix use after free in qdev_init_nofail error pathFam Zheng
Since 69382d8b (qdev: Fix object reference leak in case device.realize() fails), object_property_set_bool could release the object. The error path wants the type name, so hold an reference before realizing it. Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1470109301-12966-1-git-send-email-famz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-07-27qdev: ignore GlobalProperty.errp for hotplugged devicesGreg Kurz
This patch ensures QEMU won't terminate while hotplugging a device if the global property cannot be set and errp points to error_fatal or error_abort. While here, it also fixes indentation of the typename argument. Suggested-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-27machine: Add comment to abort path in machine_set_kernel_irqchipGreg Kurz
We're not supposed to abort when the user passes a bogus value. Since the checking is done in visit_type_OnOffSplit(), the call to abort() is legitimate. Let's add a comment to make it explicit. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-26qdev: Fix object reference leak in case device.realize() failsIgor Mammedov
If device doesn't have parent assined before its realize is called, device_set_realized() will implicitly set parent to '/machine/unattached'. However device_set_realized() may fail after that point at several other points leaving not realized object dangling in '/machine/unattached' and as result caller of obj = object_new() obj->ref == 1 object_property_set_bool(obj,..., true, "realized",...) obj->ref == 2 if (fail) object_unref(obj); obj->ref == 1 will get object leak instead of expected object destruction. Fix it by making device_set_realized() to cleanup after itself in case of failure. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-19qapi: Change Netdev into a flat unionEric Blake
This is a mostly-mechanical conversion that creates a new flat union 'Netdev' QAPI type that covers all the branches of the former 'NetClientOptions' simple union, where the branches are now listed in a new 'NetClientDriver' enum rather than generated from the simple union. The existence of a flat union has no change to the command line syntax accepted for new code, and will make it possible for a future patch to switch the QMP command to parse a boxed union for no change to valid QMP; but it does have some ripple effect on the C code when dealing with the new types. While making the conversion, note that the 'NetLegacy' type remains unchanged: it applies only to legacy command line options, and will not be ported to QMP, so it should remain a wrapper around a simple union; to avoid confusion, the type named 'NetClientOptions' is now gone, and we introduce 'NetLegacyOptions' in its place. Then, in the C code, we convert from NetLegacy to Netdev as soon as possible, so that the bulk of the net stack only has to deal with one QAPI type, not two. Note that since the old legacy code always rejected 'hubport', we can just omit that branch from the new 'NetLegacyOptions' simple union. Based on an idea originally by Zoltán Kővágó <DirtY.iCE.hu@gmail.com>: Message-Id: <01a527fbf1a5de880091f98cf011616a78adeeee.1441627176.git.DirtY.iCE.hu@gmail.com> although the sed script in that patch no longer applies due to other changes in the tree since then, and I also did some manual cleanups (such as fixing whitespace to keep checkpatch happy). Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1468468228-27827-13-git-send-email-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Fixup from Eric squashed in] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-07-14Revert "hw/ptimer: Perform counter wrap around if timer already expired"Dmitry Osipenko
Software should see timer counter wraparound only after IRQ being triggered. This fixes regression introduced by the commit 5a50307 ("hw/ptimer: Perform counter wrap around if timer already expired"), resulting in monotonic timer jumping backwards on SPARC emulated machine running NetBSD guest OS, as reported by Mark Cave-Ayland. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 20160708132206.2080-1-digetx@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-13block/qdev: Allow configuring rerror/werror with qdev propertiesKevin Wolf
The rerror/werror policies are implemented in the devices, so that's where they should be configured. In comparison to the old options in -drive, the qdev properties are only added to those devices that actually support them. If the option isn't given (or "auto" is specified), the setting of the BlockBackend is used for compatibility with the old options. For block jobs, "auto" is the same as "enospc". Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2016-07-13block/qdev: Allow node name for drive propertiesKevin Wolf
If a node name instead of a BlockBackend name is specified as the driver for a guest device, an anonymous BlockBackend is created now. The order of operations in release_drive() must be reversed in order to avoid a use-after-free bug because now blk_detach_dev() frees the last reference if an anonymous BlockBackend is used. usb-storage uses a hack where it forwards its BlockBackend as a property to another device that it internally creates. This hack must be updated so that it doesn't drop its original BB before it can be passed to the other device. This used to work because we always had the monitor reference around, but with node-names the device reference is the only one now. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2016-07-12Clean up ill-advised or unusual header guardsMarkus Armbruster
Cleaned up with scripts/clean-header-guards.pl. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
2016-07-07vl: Set errp to &error_abort on machine compat_propsEduardo Habkost
Use the new GlobalProperty.errp field to handle compat_props errors. Example output before this change: (with an intentionally broken entry added to PC_COMPAT_1_3 just for testing) $ qemu-system-x86_64 -machine pc-1.3 qemu-system-x86_64: hw/core/qdev-properties.c:1091: qdev_prop_set_globals_for_type: Assertion `prop->user_provided' failed. Aborted (core dumped) After: $ qemu-system-x86_64 -machine pc-1.3 Unexpected error in x86_cpuid_set_vendor() at /home/ehabkost/rh/proj/virt/qemu/target-i386/cpu.c:1688: qemu-system-x86_64: can't apply global cpu.vendor=x: Property '.vendor' doesn't take value 'x' Aborted (core dumped) Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-07machine: Add machine_register_compat_props() functionEduardo Habkost
Move the compat_props handling to core machine code. Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-07qdev: GlobalProperty.errp fieldEduardo Habkost
The new field will allow error handling to be configured by qdev_prop_register_global() callers: &error_fatal and &error_abort can be used to make QEMU exit or abort if any errors are reported when applying the properties. While doing it, change the error message from "global %s.%s=%s ignored" to "can't apply global %s.%s=%s". Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-07qdev: Eliminate qemu_add_globals() functionEduardo Habkost
The function is just a helper to handle the -global options, it can stay in vl.c like most qemu_opts_foreach() calls. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-07qdev: Don't stop applying globals on first errorEduardo Habkost
qdev_prop_set_globals_for_type() stops applying global properties on the first error. It is a leftover from when QEMU exited on any error when applying global property. Commit 25f8dd9 changed the fatal error to a warning, but neglected to drop the stopping. Fix that. For example, the following command-line will not set CPUID level to 3, but will warn only about "x86_64-cpu.vendor" being ignored. $ ./x86_64-softmmu/qemu-system-x86_64 \ -global x86_64-cpu.vendor=x \ -global x86_64-cpu.level=3 qemu-system-x86_64: Warning: global x86_64-cpu.vendor=x ignored: Property '.vendor' doesn't take value 'x' Fix this by not returning from qdev_prop_set_globals_for_type() on the first error. Cc: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-07-05Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches # gpg: Signature made Tue 05 Jul 2016 16:46:14 BST # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (43 commits) block/qcow2: Don't use cpu_to_*w() block: Convert bdrv_co_preadv/pwritev to BdrvChild block: Convert bdrv_prwv_co() to BdrvChild block: Convert bdrv_pwrite_zeroes() to BdrvChild block: Convert bdrv_pwrite(v/_sync) to BdrvChild block: Convert bdrv_pread(v) to BdrvChild block: Convert bdrv_write() to BdrvChild block: Convert bdrv_read() to BdrvChild block: Use BlockBackend for I/O in bdrv_commit() block: Move bdrv_commit() to block/commit.c block: Convert bdrv_co_do_readv/writev to BdrvChild block: Convert bdrv_aio_writev() to BdrvChild block: Convert bdrv_aio_readv() to BdrvChild block: Convert bdrv_co_writev() to BdrvChild block: Convert bdrv_co_readv() to BdrvChild vhdx: Some more BlockBackend use in vhdx_create() blkreplay: Convert to byte-based I/O vvfat: Use BdrvChild for s->qcow block/qdev: Fix NULL access when using BB twice block: fix return code for partial write for Linux AIO ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-05Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc, pci, virtio: new features, cleanups, fixes iommus can not be added with -device. cleanups and fixes all over the place Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 05 Jul 2016 11:18:32 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (30 commits) vmw_pvscsi: remove unnecessary internal msi state flag e1000e: remove unnecessary internal msi state flag vmxnet3: remove unnecessary internal msi state flag mptsas: remove unnecessary internal msi state flag megasas: remove unnecessary megasas_use_msi() pci: Convert msi_init() to Error and fix callers to check it pci bridge dev: change msi property type megasas: change msi/msix property type mptsas: change msi property type intel-hda: change msi property type usb xhci: change msi/msix property type change pvscsi_init_msi() type to void tests: add APIC.cphp and DSDT.cphp blobs tests: acpi: add CPU hotplug testcase log: Permit -dfilter 0..0xffffffffffffffff range: Replace internal representation of Range range: Eliminate direct Range member access log: Clean up misuse of Range for -dfilter pci_register_bar: cleanup Revert "virtio-net: unbreak self announcement and guest offloads after migration" ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-05block/qdev: Fix NULL access when using BB twiceKevin Wolf
BlockBackend has only a single pointer to its guest device, so it makes sure that only a single guest device is attached to it. device-add returns an error if you try to attach a second device to a BB. In order to make the error message nicer, -device that manually connects to a if=none block device get a different message than -drive that implicitly creates a guest device. The if=... option is stored in DriveInfo. However, since blockdev-add exists, not every BlockBackend has a DriveInfo any more. Check that it exists before we dereference it. QMP reproducer resulting in a segfault: {"execute":"blockdev-add","arguments":{"options":{"id":"disk","driver":"file","filename":"/tmp/test.img"}}} {"execute":"device_add","arguments":{"driver":"virtio-blk-pci","drive":"disk"}} {"execute":"device_add","arguments":{"driver":"virtio-blk-pci","drive":"disk"}} Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-07-04register: Add block initialise helperPeter Crosthwaite
Add a helper that will scan a static RegisterAccessInfo Array and populate a container MemoryRegion with registers as defined. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 347b810b2799e413c98d5bbeca97bcb1557946c3.1467053537.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04register: QOMifyPeter Crosthwaite
QOMify registers as a child of TYPE_DEVICE. This allows registers to define GPIOs. Define an init helper that will do QOM initialisation. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 2545f71db26bf5586ca0c08a3e3cf1b217450552.1467053537.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-04register: Add Memory API glueAlistair Francis
Add memory io handlers that glue the register API to the memory API. Just translation functions at this stage. Although it does allow for devices to be created without all-in-one mmio r/w handlers. This patch also adds the RegisterInfoArray struct, which allows all of the individual RegisterInfo structs to be grouped into a single memory region. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: f7704d8ac6ac0f469ed35401f8151a38bd01468b.1467053537.git.alistair.francis@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>