aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2016-09-14scsi: pvscsi: limit process IO loop to ring sizePrasad J Pandit
Vmware Paravirtual SCSI emulator while processing IO requests could run into an infinite loop if 'pvscsi_ring_pop_req_descr' always returned positive value. Limit IO loop to the ring size. Cc: qemu-stable@nongnu.org Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473845952-30785-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi: mptsas: use g_new0 to allocate MPTSASRequest objectLi Qiang
When processing IO request in mptsas, it uses g_new to allocate a 'req' object. If an error occurs before 'req->sreq' is allocated, It could lead to an OOB write in mptsas_free_request function. Use g_new0 to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473684251-17476-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14virtio-scsi: Don't abort when media is ejectedFam Zheng
With an ejected block backend, blk_get_aio_context() would return qemu_aio_context. In this case don't assert. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-3-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi-disk: Cleaning up around tray open stateFam Zheng
Even if tray is not open, it can be empty (blk_is_inserted() == false). Handle both cases correctly by replacing the s->tray_open checks with blk_is_available(), which is an AND of the two. Also simplify successive checks of them into blk_is_available(), in a couple cases. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-2-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14usb-mtp: added object propertiesIsaac Lozano
Windows uses object properties to determine the size of a file, so to add object properties, we must also add a minimum set of new commands and object properties. Most object properties are data that we already have, except for the unique persistant object identifier. Windows doesn't use this property, it seems, so we can cheat a bit and just use the object handle for it. Signed-off-by: Isaac Lozano <109lozanoi@gmail.com> Message-id: a741d0dd380cd7eb1695e1eb34ee6f341183f20a.1470477265.git.109lozanoi@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-14usb-mtp: fix sending files larger than 4gbIsaac Lozano
MTP requires that if a file is larger than 4gb or if sending data larger than 4gb, that the length field be set to 0xFFFFFFFF. Also widened a couple variables to prevent overflow errors. Signed-off-by: Isaac Lozano <109lozanoi@gmail.com> Message-id: 01ad8ec7775f58575801ac3f13716f553a16815e.1470477265.git.109lozanoi@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-13x86/lapic: Load LAPIC state at post_loadDr. David Alan Gilbert
Load the LAPIC state during post_load (rather than when the CPU starts). This allows an interrupt to be delivered from the ioapic to the lapic prior to cpu loading, in particular the RTC that starts ticking as soon as we load it's state. Fixes a case where Windows hangs after migration due to RTC interrupts disappearing. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13i8257: Make device "i8257" unavailable with -deviceMarkus Armbruster
The ISA DMA controller needs to be wired up to the ISA bus by isa_bus_dma() to actually work. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1472660151-19517-1-git-send-email-armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13Revert "megasas: remove useless check for cmd->frame"Paolo Bonzini
This reverts commit 8cc46787b5b58f01a11c919c7ff939ed009e27fc. It turns out that cmd->frame can be NULL and thus the commit can cause a SIGSEGV Reported-by: Holger Schranz <holger@fam-schranz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13hw: replace most use of qemu_chr_fe_write with qemu_chr_fe_write_allDaniel P. Berrange
The qemu_chr_fe_write method will return -1 on EAGAIN if the chardev backend write would block. Almost no callers of the qemu_chr_fe_write() method check the return value, instead blindly assuming data was successfully sent. In most cases this will lead to silent data loss on interactive consoles, but in some cases (eg RNG EGD) it'll just cause corruption of the protocol being spoken. We unfortunately can't fix the virtio-console code, due to a bug in the Linux guest drivers, which would cause the entire Linux kernel to hang if we delay processing of the incoming data in any way. Fixing this requires first fixing the guest driver to not hold spinlocks while writing to the hvc device backend. Fixes bug: https://bugs.launchpad.net/qemu/+bug/1586756 Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-4-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13sclpconsolelm: remove bogus check for -EAGAINDaniel P. Berrange
The write_console_data() method in sclpconsole-lm.c checks whether the return value of qemu_chr_fe_write() has the value of -EAGAIN and if so then increments the buffer offset by the value of EAGAIN. Fortunately qemu_chr_fe_write() will never return EAGAIN directly, rather it returns -1 with errno set to EAGAIN, so this broken code path was not reachable. The behaviour on EAGAIN was stil bad though, causing the write_console_data() to busy_wait repeatedly calling qemu_chr_fe_write() with no sleep between iters. Just remove all this loop logic and replace with a call to qemu_chr_fe_write_all(). Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-3-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13ipmi: check return of qemu_chr_fe_write() for errorsDaniel P. Berrange
The continue_send() method in ipmi_bmc_extern.c directly assigns the return value of qemu_chr_fe_write() to the variable tracking the I/O buffer offset. This ignores the possibility that the return value could be -1 and so will cause I/O go backwards on EAGAIN. Fortunately 'outpos' is unsigned, so can't go negative - it will become MAX_INT which will cause the loop to stop, and avoid an accidental out of bounds array access. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-Id: <1473170165-540-2-git-send-email-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: pvscsi: limit loop to fetch SG listPrasad J Pandit
In PVSCSI paravirtual SCSI bus, pvscsi_convert_sglist can take a very long time or go into an infinite loop due to two different bugs: 1) the request descriptor data length is defined to be 64 bit. While building SG list from a request descriptor, it gets truncated to 32bit in routine 'pvscsi_convert_sglist'. This could lead to an infinite loop situation large 'dataLen' values when data_length is cast to uint32_t and chunk_size becomes always zero. Fix this by removing the incorrect cast. 2) pvscsi_get_next_sg_elem can be called arbitrarily many times if the element has a zero length. Get out of the loop early when this happens, by introducing an upper limit on the number of SG list elements. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473108643-12983-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACKPaolo Bonzini
These issues cause respectively a QEMU crash and a leak of 2 bytes of stack. They were discovered by VictorV of 360 Marvel Team. Reported-by: Tom Victor <i-tangtianwen@360.cm> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix an assert expressionPrasad J Pandit
When LSI SAS1068 Host Bus emulator builds configuration page headers, mptsas_config_pack() should assert that the size fits in a byte. However, the size is expressed in 32-bit units, so up to 1020 bytes fit. The assertion was only allowing replies up to 252 bytes, so fix it. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472645167-30765-2-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13vmw_pvscsi: check page count while initialising descriptor ringsPrasad J Pandit
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the page count for these rings to an arbitrary value, leading to infinite loop or OOB access. Add check to avoid it. Reported-by: Tom Victor <vv474172261@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi-disk: change disk serial length from 20 to 36Rony Weng
Openstack Cinder assigns volume a 36 characters uuid as serial. QEMU will shrinks the uuid to 20 characters, which does not match the original uuid. Note that there is no limit to the length of the serial number in the SCSI spec. 20 was copy-pasted from virtio-blk which in turn was copy-pasted from ATA; 36 is even more arbitrary. However, bumping it up too much might cause issues (e.g. 252 seems to make sense because then the maximum amount of returned data is 256; but who knows there's no off-by-one somewhere for such a nicely rounded number). Signed-off-by: Rony Weng <ronyweng@synology.com> Message-Id: <1472457138-23386-1-git-send-email-ronyweng@synology.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13lsi: never set DMA FIFO Empty (DFE) bit in DSTAT registerHervé Poussineau
53C895A datasheet says: "This bit (DFE) is a pure status bit and will not cause an interrupt" This bit is already auto-generated in lsi_read_reg when reading the DSTAT register. This fixes IBM RS/6000 7020 firmware, which is: - resetting the adapter - enabling all interrupt sources (including DIP, ie interrupts from DSTAT) - waiting for ISTAT0 to become 0 (including DIP=0, ie no interrupt coming from DSTAT) Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-5-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: implement I/O memory space for Memory Move instructionsHervé Poussineau
Memory Move instructions can read/write data either from PCI memory or from PCI I/O. Implement second case. Windows 98 now works with LSI 53C810A adapter. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-4-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: do not exit QEMU if reading invalid registerHervé Poussineau
When guest accesses invalid register, return 0xff instead of exiting. Also add a log when reading or writing invalid registers. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-3-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: print register names in debug printsHervé Poussineau
Modify lsi_reg_readb function to have a single exit point. Debug print can now contain the returned value. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-2-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2016-09-13 # gpg: Signature made Tue 13 Sep 2016 16:53:11 BST # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: hw/net/e1000e: Fix compiler warning target-m68k: fix get_mac_extf helper timer/cpus: fix some typos and update some comments timer.h: fix inconsistency between comment and function prototype timer.h: fix typo maint: Ignore generated version file Document that curses usually needs -k option too trace-event: display "%d" instead of "0x%d" linux-user, trivial: display "0x%x" instead of "0x%d" pic: fix typo in error message: KVM_GET_IRQCHIP -> KVM_SET_IRQCHIP sparc: Use g_memdup() instead of g_new0() + memcpy() vl: remove unnecessary duplicate call to tpm_cleanup arm: spelling fix: mismatch hw/dma/omap: spelling fix: endianness hw/bt/hci: spelling fix: endianness docs: Fix description of the leaky bucket algorithm in throttle.txt Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-13hw/net/e1000e: Fix compiler warningChanglong Xie
slave:~/.xie/qemu-colo # gcc --version gcc (SUSE Linux) 4.3.4 [gcc-4_3-branch revision 152973] slave:~/.xie/qemu-colo # make -j8 CC hw/net/e1000e_core.o hw/net/e1000e_core.c:56: warning: ‘e1000e_set_interrupt_cause’ declared inline after being called hw/net/e1000e_core.c:56: warning: previous declaration of ‘e1000e_set_interrupt_cause’ was here LINK x86_64-softmmu/qemu-system-x86_64 Signed-off-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13trace-event: display "%d" instead of "0x%d"Laurent Vivier
Display the slot number of mhp_pc_dimm_assigned_slot() using "%d" without the "0x". Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13pic: fix typo in error message: KVM_GET_IRQCHIP -> KVM_SET_IRQCHIPBruce Rogers
Signed-off-by: Bruce Rogers <brogers@suse.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13hw/dma/omap: spelling fix: endiannessMichael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13hw/bt/hci: spelling fix: endiannessMichael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-13Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Pull request v2: * Fixed qcow2 sanitizer warnings [Peter] * Renamed get_error test cases to get_error_all to avoid tripping "error:" grep scripts [Peter] * Added Fam's iothread stop patch # gpg: Signature made Tue 13 Sep 2016 11:02:30 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: iothread: Stop threads before main() quits tests: fix qvirtqueue_kick MAINTAINERS: add maintainer for replication support replication driver in blockdev-add tests: add unit test case for replication replication: Implement new driver for block replication replication: Introduce new APIs to do replication operation configure: support replication mirror: auto complete active commit docs: block replication's description block: Link backup into block core Backup: export interfaces for extra serialization Backup: clear all bitmap when doing block checkpoint block: unblock backup operations in backing file virtio-blk: rename virtio_device_info to virtio_blk_info linux-aio: process completions from ioq_submit() linux-aio: split processing events function linux-aio: consume events in userspace instead of calling io_getevents qcow2: avoid memcpy(dst, NULL, len) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-13usb:xhci:fix memory leak in usb_xhci_exitLi Qiang
If the xhci uses msix, it doesn't free the corresponding memory, thus leading a memory leak. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 57d7d2e0.d4301c0a.d13e9.9a55@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-13virtio-blk: rename virtio_device_info to virtio_blk_infoChanglong Xie
The old one is confusing with @virtio_device_info in virtio.c, so make it more appropriate. Signed-off-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com> Message-id: 1470214147-32560-1-git-send-email-xiecl.fnst@cn.fujitsu.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-09-13virtio-vga: adapt to page-per-vq=offGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1473319012-27560-1-git-send-email-kraxel@redhat.com
2016-09-13virtio-gpu-pci: tag as not hotpluggableGerd Hoffmann
We can't hotplug display adapters in qemu, tag virtio-gpu-pci accordingly (virtio-vga already has this). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1473319037-27645-1-git-send-email-kraxel@redhat.com
2016-09-13vmsvga: correct bitmap and pixmap size checksPrasad J Pandit
When processing svga command DEFINE_CURSOR in vmsvga_fifo_run, the computed BITMAP and PIXMAP size are checked against the 'cursor.mask[]' and 'cursor.image[]' array sizes in bytes. Correct these checks to avoid OOB memory access. Reported-by: Qinghao Tang <luodalongde@gmail.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1473338754-15430-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-13usb-host: fix streams detection in usb_host_speed_compatGerd Hoffmann
The companion descriptor is present on all usb3 devices, not only those with streams support. We need to check attributes to see whenever the device uses streams or not. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1473406890-30164-1-git-send-email-kraxel@redhat.com
2016-09-13xhci: Fix remainder field for TR_SETUP completion event.Hans Petter Selasky
Previously the code would incorrectly report the remainder as 8 bytes. A remainder of 0 bytes should be reported when the SETUP packet is successfully transferred. Found using FreeBSD's XHCI driver. Signed-off-by: Hans Petter Selasky <hps@selasky.org> [ kraxel: codestyle fixup ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-10vhost-vsock: add virtio sockets deviceStefan Hajnoczi
Implement the new virtio sockets device for host<->guest communication using the Sockets API. Most of the work is done in a vhost kernel driver so that virtio-vsock can hook into the AF_VSOCK address family. The QEMU vhost-vsock device handles configuration and live migration while the rx/tx happens in the vhost_vsock.ko Linux kernel driver. The vsock device must be given a CID (host-wide unique address): # qemu -device vhost-vsock-pci,id=vhost-vsock-pci0,guest-cid=3 ... For more information see: http://qemu-project.org/Features/VirtioVsock [Endianness fixes and virtio-ccw support by Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> [mst: rebase to master] Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio-pci: minor refactoringMichael S. Tsirkin
!legacy && !modern is shorter than !(legacy || modern). I also perfer this (less ()s) as a matter of taste. Cc: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09vhost: don't set vring call if no vectorJason Wang
We used to set vring call fd unconditionally even if guest driver does not use MSIX for this vritqueue at all. This will cause lots of unnecessary userspace access and other checks for drivers does not use interrupt at all (e.g virtio-net pmd). So check and clean vring call fd if guest does not use any vector for this virtqueue at all. Perf diffs (on rx) shows lots of cpus wasted on vhost_signal() were saved: # 28.12% -27.82% [vhost] [k] vhost_signal 14.44% -1.69% [kernel.vmlinux] [k] copy_user_generic_string 7.05% +1.53% [kernel.vmlinux] [k] __free_page_frag 6.51% +5.53% [vhost] [k] vhost_get_vq_desc ... Pktgen tests shows 15.8% improvement on rx pps and 6.5% on tx pps. Before: RX 2.08Mpps TX 1.35Mpps After: RX 2.41Mpps TX 1.44Mpps Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio-pci: error out when both legacy and modern modes are disabledGreg Kurz
Without presuming if we got there because of a user mistake or some more subtle bug in the tooling, it really does not make sense to implement a non-functional device. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio-balloon: fix stats vq migrationLadi Prosek
The statistics virtqueue is not migrated properly because virtio-balloon does not include s->stats_vq_elem in the migration stream. After migration the statistics virtqueue hangs because the host never completes the last element (s->stats_vq_elem is NULL on the destination QEMU). Therefore the guest never submits new elements and the virtqueue is hung. Instead of changing the migration stream format in an incompatible way, detect the migration case and rewind the virtqueue so the last element can be completed. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Roman Kagan <rkagan@virtuozzo.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Suggested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio: add virtqueue_rewind()Stefan Hajnoczi
virtqueue_discard() requires a VirtQueueElement but virtio-balloon does not migrate its in-use element. Introduce a new function that is similar to virtqueue_discard() but doesn't require a VirtQueueElement. This will allow virtio-balloon to access element again after migration with the usual proviso that the guest may have modified the vring since last time. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Roman Kagan <rkagan@virtuozzo.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio-balloon: discard virtqueue element on resetLadi Prosek
The one pending element is being freed but not discarded on device reset, which causes svq->inuse to creep up, eventually hitting the "Virtqueue size exceeded" error. Properly discarding the element on device reset makes sure that its buffers are unmapped and the inuse counter stays balanced. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Roman Kagan <rkagan@virtuozzo.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio: zero vq->inuse in virtio_reset()Stefan Hajnoczi
vq->inuse must be zeroed upon device reset like most other virtqueue fields. In theory, virtio_reset() just needs assert(vq->inuse == 0) since devices must clean up in-flight requests during reset (requests cannot not be leaked!). In practice, it is difficult to achieve vq->inuse == 0 across reset because balloon, blk, 9p, etc implement various different strategies for cleaning up requests. Most devices call g_free(elem) directly without telling virtio.c that the VirtQueueElement is cleaned up. Therefore vq->inuse is not decremented during reset. This patch zeroes vq->inuse and trusts that devices are not leaking VirtQueueElements across reset. I will send a follow-up series that refactors request life-cycle across all devices and converts vq->inuse = 0 into assert(vq->inuse == 0) but this more invasive approach is not appropriate for stable trees. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Cc: qemu-stable <qemu-stable@nongnu.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Ladi Prosek <lprosek@redhat.com>
2016-09-09virtio-pci: reduce modern_mem_bar sizeMarcel Apfelbaum
Currently each VQ Notification Virtio Capability is allocated on a different page. The idea is to enable split drivers within guests, however there are no known plans to do that. The allocation will result in a 8MB BAR, more than various guest firmwares pre-allocates for PCI Bridges hotplug process. Reserve 4 bytes per VQ by default and add a new parameter "page-per-vq" to be used with split drivers. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09pc: Add 2.8 machineLongpeng(Mike)
This will used by the next patch. Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio-pci: use size from correct structureMichael S. Tsirkin
PIO MR registration should use size from the correct notify struct. Doesn't affect any visible behaviour because the field values are the same (both are 4). Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-09virtio: Tell the user what went wrong when event_notifier_init failedThomas Huth
event_notifier_init() can fail in real life, for example when there are not enough open file handles available (EMFILE) when using a lot of devices. So instead of leaving the average user with a cryptic error number only, print out a proper error message with strerror() instead, so that the user has a better way to figure out what is going on and that using "ulimit -n" might help here for example. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-09-08bus: simplify name handlingMarc-André Lureau
Simplify a bit the code by using g_strdup_printf() and store it in a non-const value so casting is no longer needed, and ownership is clearer. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-09-08ipmi: free extern timerMarc-André Lureau
Free the timer allocated during instance init. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Corey Minyard <cminyard@mvista.com>
2016-09-08sd: free timerMarc-André Lureau
Free the timer allocated in instance_init. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 13:34:52 +0000