aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2014-07-22hw/misc/imx_ccm.c: Add missing VMState list terminatorPeter Maydell
The VMStateDescription for the imx_ccm device was missing its terminator. Found by static search of the codebase using a regex based on one suggested by Ian Jackson: pcregrep -rMi '(?s)VMStateField(?:(?!END_OF_LIST).)*?;' $(git grep -l 'VMStateField\[\]') Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org
2014-07-22vmstate_xhci_event: fix unterminated field listLaszlo Ersek
"vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live migration support"), and first released in v1.6.0. The field list in this VMSD is not terminated with the VMSTATE_END_OF_LIST() macro. During normal use (ie. migration), the issue is practically invisible, because the "vmstate_xhci_event" object (with the unterminated field list) is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full() returns true, for the "ev_buffer" test. Since that field_exists() check (apparently) almost always returns false, we almost never traverse "vmstate_xhci_event" during migration, which hides the bug. However, Amit's vmstate checker forces recursion into this VMSD as well, and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator check (field->name != NULL) in dump_vmstate_vmsd(). The result is undefined behavior, which in my case translates to infinite recursion (because the loop happens to overflow into "vmstate_xhci_intr", which then links back to "vmstate_xhci_event"). Add the missing terminator. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-22Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' ↵Peter Maydell
into staging Patch queue for ppc - 2014-07-22 Only a single bug fix to make -mem-path only affect RAM regions. # gpg: Signature made Tue 22 Jul 2014 16:38:04 BST using RSA key ID 03FEDC60 # gpg: Can't check signature: public key not found * remotes/agraf/tags/signed-ppc-for-upstream: ppc: fix -mem-path failure Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-22ppc: fix -mem-path failureHu Tao
commit e938ba0c tried to enable -mem-path for ppc but breaked some ppc boards. The problems are: 1. it fails when allocating memory for rom, sram whose sizes are less than huge page size: ./ppc-softmmu/qemu-system-ppc -m 512 -mem-path /hugepages/ \ -kernel /home/hutao/Downloads/vmlinux-ppc -initrd \ /home/hutao/Downloads/initrd-ppc.gz qemu-system-ppc: /mnt/data/projects/qemu/exec.c:1184: qemu_ram_set_idstr: Assertion `new_block' failed. 2. if there is a numa node backed by memory backend object, qemu fails with message: ./ppc-softmmu/qemu-system-ppc -m 512 \ -object memory-backend-file,size=512M,mem-path=/hugepages,id=f0 \ -numa node,nodeid=0,memdev=f0 \ -kernel /home/hutao/Downloads/vmlinux-ppc \ -initrd /home/hutao/Downloads/initrd-ppc.gz qemu-system-ppc: memory backend f0 is used multiple times. Each -numa option must use a different memdev value. This patch does following: 1. replaces memory_region_allocate_system_memory() with memory_region_init_ram() for rom, sram. Then only system memory is backed by hugepages when specifying mem-path. 2. for memory banks, allocates all ram with one memory_region_allocate_system_memory(), and use memory_region_init_alias() to initialize memory banks. Tested machines: default(g3beige), mac99, taihu, bamboo, ref405ep. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-22virtio-rng: Add human-readable error message for negative max-bytes parameterJohn Snow
If a negative integer is used for the max_bytes parameter, QEMU currently calls abort() and leaves behind a core dump. This patch replaces the abort with a simple error message to make the reason for the termination clearer. This also ensures device-hotplug with invalid input doesn't cause qemu to quit. There is an underlying insufficiency in the parameter parsing code of QEMU that renders it unable to reject negative values for unsigned properties, thus the error message "a non-negative integer below 2^63" is the most user-friendly and correct message we can give until the underlying insufficiency is corrected. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2014-07-21machine: Replace underscores in machine's property namesMarcel Apfelbaum
Replaced '_' with '-' to comply with QOM guidelines. Made the conversion from command line to QMP in vl.c. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-07-18Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-07-18' ↵Peter Maydell
into staging trivial patches for 2014-07-18 # gpg: Signature made Fri 18 Jul 2014 15:04:43 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514 66A7 BEE5 9D74 A4C3 D7DB * remotes/mjt/tags/trivial-patches-2014-07-18: tests: Add missing 'static' attributes (fix warnings from smatch) migration: Add missing 'static' attribute qga: Add missing 'static' attribute hw/usb: Add missing 'static' attribute doc: slirp supports ICMP echo if enabled in Linux qemu-img: Remove redundancy "ret = -1" Fix new typos in comments (found by codespell) slirp: Give error message if hostfwd_add/remove for unrecognized vlan/stack Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-18Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
Andreas's fixes to --enable-modules, two 2.1 regression fixes, and a new qtest. Michael sent a pull request of his own, so I dropped the vhost changes. # gpg: Signature made Fri 18 Jul 2014 14:30:34 BST using RSA key ID 9B4D86F2 # gpg: Can't check signature: public key not found * remotes/bonzini/tags/for-upstream: Revert "kvmclock: Ensure time in migration never goes backward" Revert "kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec calculation" module: Don't complain when a module is absent module: Simplify module_load() qtest: new test for wdt_ib700 target-i386: Allow execute from user mode when SMEP is enabled. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-18hw/usb: Add missing 'static' attributeStefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-07-18Fix new typos in comments (found by codespell)Stefan Weil
arbitary -> arbitrary basicly -> basically Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-07-18Revert "kvmclock: Ensure time in migration never goes backward"Paolo Bonzini
This reverts commit a096b3a6732f846ec57dc28b47ee9435aa0609bf. This patch caused a hang that was fixed by commit 9b17868 (kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec calculation, 2014-06-03), and we just had to revert that commit. Drop this one too. Cc: agraf@suse.de Cc: mtosatti@redhat.com Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-18Revert "kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec ↵Paolo Bonzini
calculation" This reverts commit 9b1786829aefb83f37a8f3135e3ea91c56001b56. This patch fixed a hang introduced by commit a096b3a (kvmclock: Ensure time in migration never goes backward, 2014-05-16), but it causes a regression in migration whose cause is not quite clear. Because of this, I'm choosing to revert both patches. This trades a 2.1 regression for a bug that's been there forever. Cc: agraf@suse.de Cc: mtosatti@redhat.com Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-18Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc,vhost,test fixes Minor bugfixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 18 Jul 2014 00:43:04 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: vhost-user: minor cleanups qtest: Adapt vhost-user-test to latest vhost-user changes vhost-user: Fix VHOST_SET_MEM_TABLE processing qtest: fix vhost-user-test compilation with old GLib fix typo: apci -> acpi pc_piix: Reuse pc_compat_1_2() for pc-0.1[0123] pc: fix qemu exiting with error when -m X < 128 with old machines types Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-18vhost-user: minor cleanupsMichael S. Tsirkin
assert to verify cast does not discard information minor style fixup. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-18vhost-user: Fix VHOST_SET_MEM_TABLE processingNikolay Nikolaev
qemu_get_ram_fd doesn't accept a guest physical address. ram_addr_t are opaque values that are assigned in qemu_ram_alloc. Find the ram_addr_t corresponding to the userspace_addr using qemu_ram_addr_from_host, and then call qemu_get_ram_fd on it. Thanks to Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-17cadence_uart: check for serial backend before using it.KONRAD Frederic
This checks that s->chr is not NULL before using it. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-16virtio-serial-bus: keep port 0 reserved for virtconsole even on unplugAmit Shah
We keep port 0 reserved for compat with older guests, where only virtio-console was expected. Even if a system is started without a virtio-console port, port #0 is kept aside. However, after a virtconsole port is unplugged, port id 0 became available, and the next hotplug of a virtserialport caused failure due to it not being a console port. Steps to reproduce: $ ./x86_64-softmmu/qemu-system-x86_64 -m 512 -cpu host -enable-kvm -device virtio-serial-pci -monitor stdio -vnc :1 QEMU 2.0.91 monitor - type 'help' for more information (qemu) device_add virtconsole,id=p1 (qemu) device_del p1 (qemu) device_add virtserialport,id=p1 Port number 0 on virtio-serial devices reserved for virtconsole devices for backward compatibility. Device 'virtserialport' could not be initialized (qemu) quit Reported-by: dengmin <mdeng@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2014-07-15Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' ↵Peter Maydell
into staging Patch queue for ppc - 2014-07-15 Some more bug fixes during the RC phase: - Fix huge page mapping regressions - Fix Book3S thread number enumeration - Fix Book3S VFIO permission issue # gpg: Signature made Tue 15 Jul 2014 15:13:54 BST using RSA key ID 03FEDC60 # gpg: Can't check signature: public key not found * remotes/agraf/tags/signed-ppc-for-upstream: sPAPR/IOMMU: Fix TCE entry permission spapr: Enable use of huge pages spapr: Move RMA memory region registration code ppc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory target-ppc: Fix number of threads per core limit Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-15sPAPR/IOMMU: Fix TCE entry permissionGavin Shan
The permission of TCE entry should exclude physical base address. Otherwise, unmapping TCE entry can be interpreted to mapping TCE entry wrongly for VFIO devices. Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com> Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15spapr: Enable use of huge pagesAlexey Kardashevskiy
0b183fc87 "memory: move mem_path handling to memory_region_allocate_system_memory" disabled -mempath use for all machines that do not use memory_region_allocate_system_memory() to register RAM. Since SPAPR uses memory_region_init_ram(), the huge pages support was disabled for it. This replaces memory_region_init_ram()+vmstate_register_ram_global() with memory_region_allocate_system_memory() to get huge pages back. This changes RAM size from (ram_limit - rma_alloc_size) to ram_limit as the previous patch moved RMA memory region allocation after RAM allocation and therefore this change does not have immediate effect but simplifies the code. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15spapr: Move RMA memory region registration codeAlexey Kardashevskiy
PPC970 does not support VRMA (virtual RMA) so real memory required for SLOF to execute must be allocated by the KVM_ALLOCATE_RMA ioctl. Later this memory is used as a part of the guest RAM area. The RMA allocating code also registers a memory region for this piece of RAM. We are going to simplify memory regions layout: RMA memory region will be a subregion in the RAM memory region, both starting from zero. This way we will not have to take care of start address alignment for the piece of RAM next to the RMA. This moves memory region business closer to the RAM memory region creation/allocation code. As this is a mechanical patch, no change in behaviour is expected. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> [agraf: fix compilation on non-kvm systems] Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15ppc: memory: Replace memory_region_init_ram with ↵Shreyas B. Prabhu
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Signed-off-by: Shreyas B. Prabhu <shreyas@linux.vnet.ibm.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Block pull request # gpg: Signature made Tue 15 Jul 2014 14:49:01 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/block-pull-request: virtio-blk: dataplane: notify guest as a batch virtio-blk: data-plane: fix save/set .complete_request in start linux-aio: Fix laio resource leak Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-15virtio-blk: dataplane: notify guest as a batchMing Lei
Now requests are submitted as a batch, so it is natural to notify guest as a batch too. This may suppress interrupt notification to VM a lot: - in my test, decreased by ~13K/sec Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-15virtio-blk: data-plane: fix save/set .complete_request in startMing Lei
The callback has to be saved and reset in virtio_blk_data_plane_start(), otherwise dataplane's requests will be completed in qemu aio context. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-14Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
Misc 2.1 fixes regarding character/serial devices and SCSI. # gpg: Signature made Mon 14 Jul 2014 16:26:08 BST using RSA key ID 9B4D86F2 # gpg: Can't check signature: public key not found * remotes/bonzini/tags/for-upstream: serial-pci: remove memory regions from BAR before destroying them virtio-scsi: fix with -M pc-i440fx-2.0 serial: change retry logic to avoid concurrency qemu-char: fix deadlock with "-monitor pty" scsi: Report error when lun number is in use Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-14serial-pci: remove memory regions from BAR before destroying themPaolo Bonzini
Otherwise, hot-unplug of pci-serial-2x trips the assertion in memory_region_destroy: (qemu) device_del gg (qemu) qemu-system-x86_64: /work/armbru/tmp/qemu/memory.c:1021: memory_region_destroy: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed. Aborted (core dumped) Reported-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-14serial: change retry logic to avoid concurrencyKirill Batuzov
Whenever serial_xmit fails to transmit a byte it adds a watch that would call it again when the "line" becomes ready. This results in a retry chain: serial_xmit -> add_watch -> serial_xmit Each chain is able to transmit one character, and for every character passed to serial by the guest driver a new chain is spawned. The problem lays with the fact that a new chain is spawned even when there is one already waiting on the watch. So there can be several retry chains waiting concurrently on one "line". Every chain tries to transmit current character, so character order is not messed up. But also every chain increases retry counter (tsr_retry). If there are enough concurrent chains this counter will hit MAX_XMIT_RETRY value and the character will be dropped. To reproduce this bug you need to feed serial output to some program consuming it slowly enough. A python script from bug #1335444 description is an example of such program. This commit changes retry logic in the following way to avoid concurrency: instead of spawning a new chain for each character being transmitted spawn only one and make it transmit characters until FIFO is empty. The change consists of two parts: - add a do {} while () loop in serial_xmit (diff is a bit erratic for this part, diff -w will show actual change), - do not call serial_xmit from serial_ioport_write if there is one waiting on the watch already. This should fix another issue causing bug #1335444. Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-14Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block patches for 2.1.0-rc2 (v2) # gpg: Signature made Mon 14 Jul 2014 11:04:12 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: (22 commits) ide: Treat read/write beyond end as invalid virtio-blk: Treat read/write beyond end as invalid virtio-blk: Bypass error action and I/O accounting on invalid r/w virtio-blk: Factor common checks out of virtio_blk_handle_read/write() dma-helpers: Fix too long qiov qtest: fix vhost-user-test compilation with old GLib tests: Fix unterminated string output visitor enum human string AioContext: do not rely on aio_poll(ctx, true) result to end a loop virtio-blk: embed VirtQueueElement in VirtIOBlockReq virtio-blk: avoid g_slice_new0() for VirtIOBlockReq and VirtQueueElement dataplane: do not free VirtQueueElement in vring_push() virtio-blk: avoid dataplane VirtIOBlockReq early free block: Assert qiov length matches request length qed: Make qiov match request size until backing file EOF qcow2: Make qiov match request size until backing file EOF block: Make qiov match the request size until EOF AioContext: speed up aio_notify test-aio: fix GSource-based timer test block: drop aio functions that operate on the main AioContext block: prefer aio_poll to qemu_aio_wait ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-14ide: Treat read/write beyond end as invalidMarkus Armbruster
The block layer fails such reads and writes just fine. However, they then get treated like valid operations that fail: the error action gets executed. Unwanted; reporting the error to the guest is the only sensible action. Reject them before passing them to the block layer. This bypasses the error action and I/O accounting. Not quite correct for DMA, because DMA can fail after some success, and when that happens, the part that succeeded isn't counted. Tolerable, because I/O accounting is an inconsistent mess anyway. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14virtio-blk: Treat read/write beyond end as invalidMarkus Armbruster
The block layer fails such reads and writes just fine. However, they then get treated like valid operations that fail: the error action gets executed. Unwanted; reporting the error to the guest is the only sensible action. Reject them before passing them to the block layer. This bypasses the error action and I/O accounting. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14virtio-blk: Bypass error action and I/O accounting on invalid r/wMarkus Armbruster
When a device model's I/O operation fails, we execute the error action. This lets layers above QEMU implement thin provisioning, or attempt to correct errors before they reach the guest. But when the I/O operation fails because it's invalid, reporting the error to the guest is the only sensible action. If the guest's read or write asks for an invalid sector range, fail the request right away, without considering the error action. No change with error action BDRV_ACTION_REPORT. Furthermore, bypass I/O accounting, because we want to track only I/O that actually reaches the block layer. The next commit will extend "invalid sector range" to cover attempts to read/write beyond the end of the medium. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14virtio-blk: Factor common checks out of virtio_blk_handle_read/write()Markus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14virtio-blk: embed VirtQueueElement in VirtIOBlockReqStefan Hajnoczi
The memory allocation between hw/block/virtio-blk.c, hw/block/dataplane/virtio-blk.c, and hw/virtio/dataplane/vring.c is messy. Structs are allocated in different files than they are freed in. This is risky and makes memory leaks easier. Embed VirtQueueElement in VirtIOBlockReq to reduce the amount of memory allocation we need to juggle. This also makes vring.c and virtio.c slightly more similar. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14virtio-blk: avoid g_slice_new0() for VirtIOBlockReq and VirtQueueElementStefan Hajnoczi
In commit de6c8042ec55da18702fa51f09072fcaa315edc3 ("virtio-blk: Avoid zeroing every request structure") we avoided the 40 KB memset when allocating VirtIOBlockReq. The memset was reintroduced in commit 671ec3f056559f22a2531a91dce3a258b9b5eb8a ("virtio-blk: Convert VirtIOBlockReq.elem to pointer"). It must be fixed again to avoid a performance regression. Cc: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14dataplane: do not free VirtQueueElement in vring_push()Stefan Hajnoczi
VirtQueueElement is allocated in vring_pop() so it seems to make sense that vring_push() should free it. Alas, virtio-blk frees VirtQueueElement itself in virtio_blk_free_request(). This patch solves a double-free assertion in glib's g_slice_free(). Rename vring_free_element() to vring_unmap_element() since it no longer frees the VirtQueueElement. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14virtio-blk: avoid dataplane VirtIOBlockReq early freeStefan Hajnoczi
VirtIOBlockReq is freed later by virtio_blk_free_request() in hw/block/virtio-blk.c. Remove this extraneous g_slice_free(). This patch fixes the following segfault: 0x00005555556373af in virtio_blk_rw_complete (opaque=0x5555565ff5e0, ret=0) at hw/block/virtio-blk.c:99 99 bdrv_acct_done(req->dev->bs, &req->acct); (gdb) print req $1 = (VirtIOBlockReq *) 0x5555565ff5e0 (gdb) print req->dev $2 = (VirtIOBlock *) 0x0 (gdb) bt #0 0x00005555556373af in virtio_blk_rw_complete (opaque=0x5555565ff5e0, ret=0) at hw/block/virtio-blk.c:99 #1 0x0000555555840ebe in bdrv_co_em_bh (opaque=0x5555566152d0) at block.c:4675 #2 0x000055555583de77 in aio_bh_poll (ctx=ctx@entry=0x5555563a8150) at async.c:81 #3 0x000055555584b7a7 in aio_poll (ctx=0x5555563a8150, blocking=blocking@entry=true) at aio-posix.c:188 #4 0x00005555556e520e in iothread_run (opaque=0x5555563a7fd8) at iothread.c:41 #5 0x00007ffff42ba124 in start_thread () from /usr/lib/libpthread.so.0 #6 0x00007ffff16d14bd in clone () from /usr/lib/libc.so.6 Reported-by: Max Reitz <mreitz@redhat.com> Cc: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14scsi: Report error when lun number is in useFam Zheng
In the case that the lun number is taken by another scsi device, don't release the existing device siliently, but report an error to user. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-11fix typo: apci -> acpiHu Tao
Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> MST: rebase
2014-07-11pc_piix: Reuse pc_compat_1_2() for pc-0.1[0123]Eduardo Habkost
pc-0.13 and older were missing some compat code that was present on newer machine-types: * x86_cpu_compat_disable_kvm_features(FEAT_1_ECX, CPUID_EXT_X2APIC); (pc-i440fx-1.7 and older) (added by commit ef02ef5f4536dba090b12360a6c862ef0e57e3bc) * x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE); (pc-i440fx-1.4 and older) (added by commit 4458c23672904fa131e69897007eeb7c953be7e5 * x86_cpu_compat_set_features("Westmere", FEAT_1_ECX, 0, CPUID_EXT_PCLMULQDQ); (pc-i440fx-1.4 and older) (added by commit 56383703c060777fd01aaf8d63d5f46d660e9fb9) Instead of duplicating the code from the previous pc_compat_*() functions, we can now reuse pc_compat_1_2() and fix those issues. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-11Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20140711-1' into ↵Peter Maydell
staging vga: some cirrus fixes. # gpg: Signature made Fri 11 Jul 2014 10:38:32 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vga-20140711-1: cirrus: Fix host CPU blits cirrus: Fix build of debug code cirrus_vga: adding sanity check for vram size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-11Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20140711-1' into ↵Peter Maydell
staging mtp: linux guest detection fix # gpg: Signature made Fri 11 Jul 2014 11:32:20 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-20140711-1: mtp: linux guest detection fix. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-11mtp: linux guest detection fix.Gerd Hoffmann
Attach a name to the MTP interface (android phones have this too). With this patch recent linux guests such as fedora 20 happily detect and use the device. It shows up in nautilus file manager automatically, and simple-mtpfs can mount it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus: Fix host CPU blitsBenjamin Herrenschmidt
Commit b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef "CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke cpu to video blits. When the ROP function is called from cirrus_bitblt_cputovideo_next(), we pass 0 for the pitch but only operate on one line at a time. The added test was tripping because after the initial substraction, the pitch becomes negative. Make the test only trip when the height is larger than one (ie. the pitch is actually used). This fixes HW cursor support in Windows NT4.0 (which otherwise was a white rectangle) and general display of icons in that OS when using 8bpp mode. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus: Fix build of debug codeBenjamin Herrenschmidt
Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus_vga: adding sanity check for vram sizeGonglei
when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-10Merge remote-tracking branch 'remotes/kvm/uq/master' into stagingPeter Maydell
* remotes/kvm/uq/master: qtest: fix vhost-user-test compilation with old GLib mc146818rtc: register the clock reset notifier on the right clock oslib-posix: Fix new compiler error with -Wclobbered target-i386: Add "kvmclock-stable-bit" feature bit name Enforce stack protector usage watchdog: fix deadlock with -watchdog-action pause mips_malta: Catch kernels linked at wrong address mips_malta: Remove incorrect KVM T&E references mips/kvm: Disable FPU on reset with KVM mips/kvm: Init EBase to correct KSEG0 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-10mc146818rtc: register the clock reset notifier on the right clockPaolo Bonzini
Commit 884f17c (aio / timers: Convert rtc_clock to be a QEMUClockType, 2013-08-21) erroneously changed an occurrence of rtc_clock to QEMU_CLOCK_REALTIME, which broke the RTC reset notifier in mc146818rtc. Fix this. I redid the patch myself since the original reporter did not sign off on his. Cc: qemu-stable@nongnu.org Reported-by: Lb peace <peaceustc@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-09watchdog: fix deadlock with -watchdog-action pausePaolo Bonzini
qemu_clock_enable says: /* Disabling the clock will wait for related timerlists to stop * executing qemu_run_timers. Thus, this functions should not * be used from the callback of a timer that is based on @clock. * Doing so would cause a deadlock. */ and it indeed does: vm_stop uses qemu_clock_enable on QEMU_CLOCK_VIRTUAL and watchdogs are based on QEMU_CLOCK_VIRTUAL, and we get a deadlock. Use qemu_system_vmstop_request_prepare()/qemu_system_vmstop_request() instead; yet another alternative could be a BH. I checked other occurrences of vm_stop and they should not have this problem. RUN_STATE_IO_ERROR could in principle (it depends on the code in the drivers) but it has been fixed by commit 2bd3bce, "block: asynchronously stop the VM on I/O errors", 2014-06-05. Tested-by: Luiz Capitulino <lcapitulino@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-09mips_malta: Catch kernels linked at wrong addressJames Hogan
Add error reporting if the wrong type of kernel is provided for the current mode of acceleration. Currently a KVM kernel linked at 0x40000000 can't be used with TCG, and a normal kernel linked at 0x80000000 can't be used with KVM. Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: James Hogan <james.hogan@imgtec.com> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-30 05:44:53 +0000