aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2017-04-25xen/9pfs: send responses back to the frontendStefano Stabellini
Once a request is completed, xen_9pfs_push_and_notify gets called. In xen_9pfs_push_and_notify, update the indexes (data has already been copied to the sg by the common code) and send a notification to the frontend. Schedule the bottom-half to check if we already have any other requests pending. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> CC: anthony.perard@citrix.com CC: jgross@suse.com CC: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> CC: Greg Kurz <groug@kaod.org>
2017-04-25xen/9pfs: implement in/out_iov_from_pdu and vmarshal/vunmarshalStefano Stabellini
Implement xen_9pfs_init_in/out_iov_from_pdu and xen_9pfs_pdu_vmarshal/vunmarshall by creating new sg pointing to the data on the ring. This is safe as we only handle one request per ring at any given time. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> CC: anthony.perard@citrix.com CC: jgross@suse.com CC: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> CC: Greg Kurz <groug@kaod.org>
2017-04-25xen/9pfs: receive requests from the frontendStefano Stabellini
Upon receiving an event channel notification from the frontend, schedule the bottom half. From the bottom half, read one request from the ring, create a pdu and call pdu_submit to handle it. For now, only handle one request per ring at a time. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> CC: anthony.perard@citrix.com CC: jgross@suse.com CC: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> CC: Greg Kurz <groug@kaod.org>
2017-04-25xen/9pfs: connect to the frontendStefano Stabellini
Write the limits of the backend to xenstore. Connect to the frontend. Upon connection, allocate the rings according to the protocol specification. Initialize a QEMUBH to schedule work upon receiving an event channel notification from the frontend. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> CC: anthony.perard@citrix.com CC: jgross@suse.com CC: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> CC: Greg Kurz <groug@kaod.org>
2017-04-25xen/9pfs: introduce Xen 9pfs backendStefano Stabellini
Introduce the Xen 9pfs backend: add struct XenDevOps to register as a Xen backend and add struct V9fsTransport to register as v9fs transport. All functions are empty stubs for now. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> Reviewed-by: Greg Kurz <groug@kaod.org> CC: anthony.perard@citrix.com CC: jgross@suse.com CC: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> CC: Greg Kurz <groug@kaod.org>
2017-04-219p: introduce a type for the 9p headerStefano Stabellini
Use the new type in virtio-9p-device. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> CC: anthony.perard@citrix.com CC: jgross@suse.com CC: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> CC: Greg Kurz <groug@kaod.org>
2017-04-21xen: import ring.h from xenStefano Stabellini
Do not use the ring.h header installed on the system. Instead, import the header into the QEMU codebase. This avoids problems when QEMU is built against a Xen version too old to provide all the ring macros. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> Reviewed-by: Greg Kurz <groug@kaod.org> CC: anthony.perard@citrix.com CC: jgross@suse.com
2017-04-21xen: use libxendevice model to restrict operationsPaul Durrant
This patch adds a command-line option (-xen-domid-restrict) which will use the new libxendevicemodel API to restrict devicemodel [1] operations to the specified domid. (Such operations are not applicable to the xenpv machine type). This patch also adds a tracepoint to allow successful enabling of the restriction to be monitored. [1] I.e. operations issued by libxendevicemodel. Operation issued by other xen libraries (e.g. libxenforeignmemory) are currently still unrestricted but this will be rectified by subsequent patches. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-04-21xen: use 5 digit xen versionsJuergen Gross
Today qemu is using e.g. the value 480 for Xen version 4.8.0. As some Xen version tests are using ">" relations this scheme will lead to problems when Xen version 4.10.0 is being reached. Instead of the 3 digit schem use a 5 digit scheme (e.g. 40800 for version 4.8.0). Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-03-22xen: create wrappers for all other uses of xc_hvm_XXX() functionsPaul Durrant
This patch creates inline wrapper functions in xen_common.h for all open coded calls to xc_hvm_XXX() functions outside of xen_common.h so that use of xen_xc can be made implicit. This again is in preparation for the move to using libxendevicemodel. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Reviewed-by: Anthony Perard <anthony.perard@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-03-22xen: make use of xen_xc implicit in xen_common.h inlinesPaul Durrant
Doing this will make the transition to using the new libxendevicemodel interface less intrusive on the callers of these functions, since using the new library will require a change of handle. NOTE: The patch also moves the 'externs' for xen_xc and xen_fmem from xen_backend.h to xen_common.h, and the declarations from xen_backend.c to xen-common.c, which is where they belong. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Reviewed-by: Anthony Perard <anthony.perard@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
2017-03-21Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell
This pull request fixes a potential QEMU hang in 9pfs and two issues reported by Coverity. # gpg: Signature made Tue 21 Mar 2017 09:57:58 GMT # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9pfs: proxy: assert if unmarshal fails 9pfs: don't try to flush self and avoid QEMU hang on reset Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-21add opengl_cflags to QEMU_CFLAGSGerd Hoffmann
... and drop OPENGL_CFLAGS from Makefiles. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1490079888-29029-1-git-send-email-kraxel@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-219pfs: proxy: assert if unmarshal failsGreg Kurz
Replies from the virtfs proxy are made up of a fixed-size header (8 bytes) and a payload of variable size (maximum 64kb). When receiving a reply, the proxy backend first reads the whole header and then unmarshals it. If the header is okay, it then does the same operation with the payload. Since the proxy backend uses a pre-allocated buffer which has enough room for a header and the maximum payload size, marshalling should never fail with fixed size arguments. Any error here is likely to result from a more serious corruption in QEMU and we'd better dump core right away. This patch adds error checks where they are missing and converts the associated error paths into assertions. This should also address Coverity's complaints CID 1348519 and CID 1348520, about not always checking the return value of proxy_unmarshal(). Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-219pfs: don't try to flush self and avoid QEMU hang on resetGreg Kurz
According to the 9P spec [*], when a client wants to cancel a pending I/O request identified by a given tag (uint16), it must send a Tflush message and wait for the server to respond with a Rflush message before reusing this tag for another I/O. The server may still send a completion message for the I/O if it wasn't actually cancelled but the Rflush message must arrive after that. QEMU hence waits for the flushed PDU to complete before sending the Rflush message back to the client. If a client sends 'Tflush tag oldtag' and tag == oldtag, QEMU will then allocate a PDU identified by tag, find it in the PDU list and wait for this same PDU to complete... i.e. wait for a completion that will never happen. This causes a tag and ring slot leak in the guest, and a PDU leak in QEMU, all of them limited by the maximal number of PDUs (128). But, worse, this causes QEMU to hang on device reset since v9fs_reset() wants to drain all pending I/O. This insane behavior is likely to denote a bug in the client, and it would deserve an Rerror message to be sent back. Unfortunately, the protocol allows it and requires all flush requests to suceed (only a Tflush response is expected). The only option is to detect when we have to handle a self-referencing flush request and report success to the client right away. [*] http://man.cat-v.org/plan_9/5/flush Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Greg Kurz <groug@kaod.org>
2017-03-20Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
fixes for 2.9-rc1, plus removal of -mno-cygwin references # gpg: Signature made Mon 20 Mar 2017 11:25:07 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hax: fix breakage in locking configure: remove Cygwin xen: do not build backends for targets that do not support xen qemu-ga: obey LISTEN_PID when using systemd socket activation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170320' into stagingPeter Maydell
MIPS patches 2017-03-20 Changes: * Fix clang warnings * Fix delay slot detection in gen_msa_branch() * Fix rc4030 interval timer * Fix rc4030 to tranlate memory accesses only when they occur * Fix 4c4030 a mixed declarations and code warning * Update MAINTAINERS file # gpg: Signature made Mon 20 Mar 2017 12:46:01 GMT # gpg: using RSA key 0x2238EB86D5F797C2 # gpg: Good signature from "Yongbok Kim <yongbok.kim@imgtec.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 8600 4CF5 3415 A5D9 4CFA 2B5C 2238 EB86 D5F7 97C2 * remotes/yongbok/tags/mips-20170320: MAINTAINERS: update for MIPS devices dma/rc4030: fix a mixed declarations and code warning dma/rc4030: translate memory accesses only when they occur dma: rc4030: limit interval timer reload value target/mips: fix delay slot detection in gen_msa_branch() target-mips: replace few LOG_DISAS() with trace points target-mips: replace break by goto cp0_unimplemented target-mips: log bad coprocessor0 register accesses with LOG_UNIMP target-mips: remove old & unuseful comments target-mips: fix compiler warnings (clang 5) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20dma/rc4030: fix a mixed declarations and code warningYongbok Kim
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org>
2017-03-20dma/rc4030: translate memory accesses only when they occurHervé Poussineau
This simplifies the code a lot, and this fixes big memory leaks introduced in a3d586f704609a45b6037534cb2f34da5dfd8895 Windows NT is now able to boot without using gigabytes of ram on the host. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20dma: rc4030: limit interval timer reload valuePrasad J Pandit
The JAZZ RC4030 chipset emulator has a periodic timer and associated interval reload register. The reload value is used as divider when computing timer's next tick value. If reload value is large, it could lead to divide by zero error. Limit the interval reload value to avoid it. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Tested-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170320' into stagingPeter Maydell
One bugfix for device plug/unplug and migration in the channel subsystem code. # gpg: Signature made Mon 20 Mar 2017 08:45:59 GMT # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170320: s390x/css: reassign subchannel if schid is changed after migration Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20Merge remote-tracking branch 'remotes/kraxel/tags/pull-fixes-20170320-1' ↵Peter Maydell
into staging fixes for 2.9: vnc, cirrus, tcg display updates. # gpg: Signature made Mon 20 Mar 2017 08:52:34 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-fixes-20170320-1: vnc: fix a qio-channel leak cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16 ui/console: ensure graphic updates don't race with TCG vCPUs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20s390x/css: reassign subchannel if schid is changed after migrationDong Jia Shi
The subchannel is a means to access a device. While the device number is assigned by the administrator, the subchannel number is assigned by the channel subsystem in an ascending order on cold and hot plug. When doing unplug and replug operations, the same device may end up on a different subchannel; for example - We start with a device fe.1.2222, which ends up at subchannel fe.1.0000. - Now we detach the device, attach a device fe.1.3333 (which would get the now-free subchannel fe.1.0000), re-attach fe.1.2222 (which ends up at subchannel fe.1.0001) and detach fe.1.3333. - We now have the same device (fe.1.2222) available to the guest; it just shows up on a different subchannel. In such a case, the subchannel numbers are different from what a QEMU would create during cold plug when parsing the command line. As this would cause a guest visible change on migration, we do restore the source system's value of the subchannel number on load. So we are now fine from the guest perspective. From the host perspective this will cause an inconsistent state in our internal data structures, though. For example, the subchannel 0 might not be at array position 0. This will lead to problems when we continue doing hot (un/re) plug operations. Let's fix this by cleaning up our internal data structures. Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-03-19xen: do not build backends for targets that do not support xenStefano Stabellini
Change Makefile.objs to use CONFIG_XEN instead of CONFIG_XEN_BACKEND, so that the Xen backends are only built for targets that support Xen. Set CONFIG_XEN in the toplevel Makefile to ensure that files that are built only once pick up Xen support properly. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> Tested-by: Greg Kurz <groug@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> CC: pbonzini@redhat.com CC: peter.maydell@linaro.org CC: rth@twiddle.net CC: stefanha@redhat.com Message-Id: <1489694518-16978-1-git-send-email-sstabellini@kernel.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-18nios2: iic: Convert CPU prop to qom linkMarek Vasut
Add a const qom link between the CPU and the IIC instead of passing the CPU link through a qom property. Signed-off-by: Marek Vasut <marex@denx.de> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20170317210627.23532-1-marex@denx.de Cc: Alexander Graf <agraf@suse.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-18Merge remote-tracking branch 'remotes/xtensa/tags/20170317-xtensa' into stagingPeter Maydell
target/xtensa fixes for 2.9: - fix build failure when FDT support is not enabled; - correctly pass command line arguments to semihosting guests. # gpg: Signature made Fri 17 Mar 2017 18:14:01 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170317-xtensa: target/xtensa: fix semihosting argc/argv implementation target/xtensa: xtfpga: load DTB only when FDT support is enabled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-17cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16Gerd Hoffmann
The switch from pointers to addresses (commit 026aeffcb4752054830ba203020ed6eb05bcaba8 and ffaf857778286ca54e3804432a2369a279e73aa7) added a off-by-one bug to 16bit backward blits. Fix. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com
2017-03-16Merge remote-tracking branch 'remotes/kraxel/tags/pull-cirrus-20170316-1' ↵Peter Maydell
into staging cirrus: blitter fixes. # gpg: Signature made Thu 16 Mar 2017 09:05:22 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-cirrus-20170316-1: cirrus: stop passing around src pointers in the blitter cirrus: stop passing around dst pointers in the blitter cirrus: fix cirrus_invalidate_region cirrus: add option to disable blitter cirrus: switch to 4 MB video memory by default cirrus/vnc: zap bitblit support from console code. fix :cirrus_vga fix OOB read case qemu Segmentation fault # Conflicts: # include/hw/compat.h Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-16Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio, pci: fixes More fixes missed in the previous pull request. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 16 Mar 2017 02:29:49 GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-serial-bus: Delete timer from list before free it hw/virtio: fix Power Management Control Register for PCI Express virtio devices hw/virtio: fix Link Control Register for PCI Express virtio devices hw/virtio: fix error enabling flags in Device Control register hw/pcie: fix Extended Configuration Space for devices with no Extended Capabilities Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-16cirrus: stop passing around src pointers in the blitterGerd Hoffmann
Does basically the same as "cirrus: stop passing around dst pointers in the blitter", just for the src pointer instead of the dst pointer. For the src we have to care about cputovideo blits though and fetch the data from s->cirrus_bltbuf instead of vga memory. The cirrus_src*() helper functions handle that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489584487-3489-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: stop passing around dst pointers in the blitterGerd Hoffmann
Instead pass around the address (aka offset into vga memory). Calculate the pointer in the rop_* functions, after applying the mask to the address, to make sure the address stays within the valid range. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489574872-8679-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: fix cirrus_invalidate_regionGerd Hoffmann
off_cur_end is exclusive, so off_cur_end == cirrus_addr_mask is valid. Fix calculation to make sure to allow that, otherwise the assert added by commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3 can trigger for valid blits. Test case: boot windows nt 4.0 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489579606-26020-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: add option to disable blitterGerd Hoffmann
Ok, we have this beast in the cirrus code which is not used at all by modern guests, except when you try to find security holes in qemu. So, add an option to disable blitter altogether. Guests released within the last ten years should not show any rendering issues if you turn off blitter support. There are no known bugs in the cirrus blitter code. But in the past we hoped a few times already that we've finally nailed the last issue. So having some easy way to mitigate in case yet another blitter issue shows up certainly makes me sleep a bit better at night. For completeness: The by far better way to mitigate is to switch away from cirrus and use stdvga instead. Or something more modern like virtio-vga in case your guest has support for it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494540-15745-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: switch to 4 MB video memory by defaultGerd Hoffmann
Quoting cirrus source code: Follow real hardware, cirrus card emulated has 4 MB video memory. Also accept 8 MB/16 MB for backward compatibility. So just use 4MB by default. We decided to leave that at 8MB by default a while ago, for live migration compatibility reasons. But we have compat properties to handle that, so that isn't a compeling reason. This also removes some sanity check inconsistencies in the cirrus code. Some places check against the allocated video memory, some places check against the 4MB physical hardware has. Guest code can trigger asserts because of that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494514-15606-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus/vnc: zap bitblit support from console code.Gerd Hoffmann
There is a special code path (dpy_gfx_copy) to allow graphic emulation notify user interface code about bitblit operations carryed out by guests. It is supported by cirrus and vnc server. The intended purpose is to optimize display scrolls and just send over the scroll op instead of a full display update. This is rarely used these days though because modern guests simply don't use the cirrus blitter any more. Any linux guest using the cirrus drm driver doesn't. Any windows guest newer than winxp doesn't ship with a cirrus driver any more and thus uses the cirrus as simple framebuffer. So this code tends to bitrot and bugs can go unnoticed for a long time. See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV" which fixes a bug lingering in the code for almost a year, added by commit "c7628bf vnc: only alloc server surface with clients connected". Also the vnc server will throttle the frame rate in case it figures the network can't keep up (send buffers are full). This doesn't work with dpy_gfx_copy, for any copy operation sent to the vnc client we have to send all outstanding updates beforehand, otherwise the vnc client might run the client side blit on outdated data and thereby corrupt the display. So this dpy_gfx_copy "optimization" might even make things worse on slow network links. Lets kill it once for all. Oh, and one more reason: Turns out (after writing the patch) we have a security bug in that code path ... Fixes: CVE-2016-9603 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494419-14340-1-git-send-email-kraxel@redhat.com
2017-03-16fix :cirrus_vga fix OOB read case qemu Segmentation faulthangaohuai
check the validity of parameters in cirrus_bitblt_rop_fwd_transp_xxx and cirrus_bitblt_rop_fwd_xxx to avoid the OOB read which causes qemu Segmentation fault. After the fix, we will touch the assert in cirrus_invalidate_region: assert(off_cur_end >= off_cur); Signed-off-by: fangying <fangying1@huawei.com> Signed-off-by: hangaohuai <hangaohuai@huawei.com> Message-id: 20170314063919.16200-1-hangaohuai@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-15ide: ahci: call cleanup function in ahci unitLi Qiang
This can avoid memory leak when hotunplug the ahci device. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1488449293-80280-4-git-send-email-liqiang6-s@360.cn Signed-off-by: John Snow <jsnow@redhat.com>
2017-03-15ide: core: add cleanup functionLi Qiang
As the pci ahci can be hotplug and unplug, in the ahci unrealize function it should free all the resource once allocated in the realized function. This patch add ide_exit to free the resource. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1488449293-80280-3-git-send-email-liqiang6-s@360.cn Signed-off-by: John Snow <jsnow@redhat.com>
2017-03-15ide: qdev: register ide bus unrealize functionLi Qiang
we have an idebus unrealize function, but it was being registered as the unrealize function for the IDE Device, so it was not getting invoked on device teardown because nothing is "unrealizing" the IDE devices themselves. Suggested-by: John Snow <jsnow@redhat.com> Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1488449293-80280-2-git-send-email-liqiang6-s@360.cn Signed-off-by: John Snow <jsnow@redhat.com>
2017-03-16virtio-serial-bus: Delete timer from list before free itzhanghailiang
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Amit Shah <amit@kernel.org>
2017-03-16hw/virtio: fix Power Management Control Register for PCI Express virtio devicesMarcel Apfelbaum
Make Power Management State flag writable to conform with the PCI Express spec. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-16hw/virtio: fix Link Control Register for PCI Express virtio devicesMarcel Apfelbaum
Make several Link Control Register flags writable to conform with the PCI Express spec. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-16hw/virtio: fix error enabling flags in Device Control registerMarcel Apfelbaum
When the virtio devices are PCI Express, make error-enabling flags writable to respect the PCIe spec. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-16hw/pcie: fix Extended Configuration Space for devices with no Extended ↵Marcel Apfelbaum
Capabilities Absence of any Extended Capabilities is required to be indicated by an Extended Capability header with a Capability ID of 0000h, a Capability Version of 0h, and a Next Capability Offset of 000h. Instead of inserting a 'NULL' capability is simpler to mark the start of the Extended Configuration Space as read-only to achieve the same behaviour. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio, pc: fixes Some fixes to fallback from using virtio caching, pls a minor vm gen id fix. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 15 Mar 2017 17:59:25 GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-pci: reset modern vq meta data Revert "virtio: unbreak virtio-pci with IOMMU after caching ring translations" pci: introduce a bus master container virtio: validate address space cache during init virtio: destroy region cache during reset virtio: guard against NULL pfn Bugfix: Handle error if VM Generation ID device not present Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-15virtio-pci: reset modern vq meta dataJason Wang
We don't reset proxy->vqs[].{num|desc[]|avail[]|used[]}. This means if a driver enable the vq without setting vq address after reset. The old addresses were leaked. Fixing this by resetting modern vq meta data during device reset. Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15Revert "virtio: unbreak virtio-pci with IOMMU after caching ring translations"Jason Wang
This reverts commit 96a8821d21411f10d77ea994af369c6e5c35a2cc. Previous patch is a better solution which does not require a strict order between virtio and IOMMU. CC: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-03-15pci: introduce a bus master containerJason Wang
96a8821d2141 ("virtio: unbreak virtio-pci with IOMMU after caching ring translations") tries to make IOMMU works with virtio memory region cache, but it requires IOMMU to be created before any virtio devices. This is sub optimal, fixing this by introduce a bus master container to make sure address space can be initialized during device registering, and then we can safely set alias and make bus_master_enable_region as its subregion during bus master initialization. Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15virtio: validate address space cache during initJason Wang
We don't check the return value of address_space_cache_init(), this may lead buggy driver use incorrect region caches. Instead of triggering an assert, catch and warn this early in virtio_init_region_cache(). Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15virtio: destroy region cache during resetJason Wang
We don't destroy region cache during reset which can make the maps of previous driver leaked to a buggy or malicious driver that don't set vring address before starting to use the device. Fix this by destroy the region cache during reset and validate it before trying to see them. Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-10 19:36:29 +0000