aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2016-08-09atapi: fix halted DMA resetJohn Snow
Followup to 87ac25fd, this time for ATAPI DMA. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1470164128-28158-1-git-send-email-jsnow@redhat.com Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com>
2016-08-09hw/net: Fix a heap overflow in xlnx.xps-ethernetlitechaojianhu
The .receive callback of xlnx.xps-ethernetlite doesn't check the length of data before calling memcpy. As a result, the NetClientState object in heap will be overflowed. All versions of qemu with xlnx.xps-ethernetlite will be affected. Reported-by: chaojianhu <chaojianhu@hotmail.com> Signed-off-by: chaojianhu <chaojianhu@hotmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-08-09net: vmxnet3: check for device_active before writeLi Qiang
Vmxnet3 device emulator does not check if the device is active, before using it for write. It leads to a use after free issue, if the vmxnet3_io_bar0_write routine is called after the device is deactivated. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Acked-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-08-09net: check fragment length during fragmentationPrasad J Pandit
Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-08-08Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
More block layer patches for 2.7.0-rc2 # gpg: Signature made Mon 08 Aug 2016 12:51:30 BST # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: iotests: fix 109 mirror: finish earlier on error tests: Test blockjob IDs block/qdev: Let 'drive' property fall back to node name Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-08Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20160808' into stagingPeter Maydell
One more s390x fix for a bug in the pci rework. # gpg: Signature made Mon 08 Aug 2016 11:49:34 BST # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20160808: s390x/pci: fix null pointer bug Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-08hw/sparc/leon3: Don't call get_image_size() on a NULL pointerPeter Maydell
get_image_size() doesn't handle being passed a NULL pointer, so avoid doing that. Spotted by the clang ub sanitizer (which notices the attempt to pass NULL to open()). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1470391439-28427-1-git-send-email-peter.maydell@linaro.org
2016-08-08Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2016-08-08' ↵Peter Maydell
into staging Error reporting patches for 2016-08-08 # gpg: Signature made Mon 08 Aug 2016 08:14:49 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2016-08-08: error: Fix error_printf() calls lacking newlines vfio: Use error_report() instead of error_printf() for errors checkpatch: Fix newline detection in error_setg() & friends error: Strip trailing '\n' from error string arguments (again) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-08Merge remote-tracking branch ↵Peter Maydell
'remotes/elmarco/tags/leaks-for-2.7-pull-request' into staging # gpg: Signature made Sun 07 Aug 2016 21:03:14 BST # gpg: using RSA key 0xDAE8E10975969CE5 # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * remotes/elmarco/tags/leaks-for-2.7-pull-request: ahci: fix sglist leak on retry usb: free leaking path usb: free USBDevice.strings virtio-input: free config list qjson: free str ahci: free irqs array char: free MuxDriver when closing char: free the tcp connection data when closing numa: do not leak NumaOptions Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-08block/qdev: Let 'drive' property fall back to node nameKevin Wolf
If a qdev block device is created with an anonymous BlockBackend (i.e. a node name rather than a BB name was given for the drive property), qdev used to return an empty string when the property was read. This patch fixes it to return the node name instead. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-08-08s390x/pci: fix null pointer bugYi Min Zhao
We should make sure that it's not NULL firstly. Signed-off-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2016-08-08error: Fix error_printf() calls lacking newlinesMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1470224274-31522-5-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-08-08vfio: Use error_report() instead of error_printf() for errorsMarkus Armbruster
Cc: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1470224274-31522-4-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-08-08error: Strip trailing '\n' from error string arguments (again)Markus Armbruster
Commit 9af9e0f, 6daf194d, be62a2eb and 312fd5f got rid of a bunch, but they keep coming back. checkpatch.pl tries to flag them since commit 5d596c2, but it's not very good at it. Offenders tracked down with Coccinelle script scripts/coccinelle/err-bad-newline.cocci, an updated version of the script from commit 312fd5f. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1470224274-31522-2-git-send-email-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-08-08spapr: Fix undefined behaviour in spapr_tce_reset()David Gibson
When a TCE table (sPAPR IOMMU context) is in disabled state (which is true by default for the 64-bit window), it has tcet->nb_table == 0 and tcet->table == NULL. However, on system reset, spapr_tce_reset() executes, which unconditionally calls memset(tcet->table, 0, table_size); We get away with this in practice, because it's a zero length memset(), but memset() on a NULL pointer is undefined behaviour, so we should not call it in this case. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-08-08macio: set res_count value to 0 after non-block ATAPI DMA transfersMark Cave-Ayland
res_count should be set to the number of outstanding bytes after a DBDMA request. Unfortunately this wasn't being set to zero by the non-block transfer codepath meaning drivers that checked the descriptor result for such requests (e.g reading the CDROM TOC) would assume from a non-zero result that the transfer had failed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-08-08spapr: Correctly set query_hotpluggable_cpus hook based on machine versionDavid Gibson
Prior to c8721d3 "spapr: Error out when CPU hotplug is attempted on older pseries machines", attempting to use query-hotpluggable-cpus on pseries-2.6 and earlier machine types would SEGV. That change fixed that, but due to some unexpected interactions in init order and a brown-paper-bag worthy failure to test, it accidentally disabled query-hotpluggable-cpus for all pseries machine types, including the current one which should allow it. In fact, query_hotpluggable_cpus needs to be non-NULL when and only when the dr_cpu_enabled flag in sPAPRMachineClass is set, which makes dr_cpu_enabled itself redundant. This patch removes dr_cpu_enabled, instead directly setting query_hotpluggable_cpus from the machine class_init functions, and using that to determine the availability of CPU hotplug when necessary. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-08-08ahci: fix sglist leak on retryMarc-André Lureau
ahci-test /x86_64/ahci/io/dma/lba28/retry triggers the following leak: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7fc4b2a25e20 in malloc (/lib64/libasan.so.3+0xc6e20) #1 0x7fc4993bce58 in g_malloc (/lib64/libglib-2.0.so.0+0x4ee58) #2 0x556a187d4b34 in ahci_populate_sglist hw/ide/ahci.c:896 #3 0x556a187d8237 in ahci_dma_prepare_buf hw/ide/ahci.c:1367 #4 0x556a187b5a1a in ide_dma_cb hw/ide/core.c:844 #5 0x556a187d7eec in ahci_start_dma hw/ide/ahci.c:1333 #6 0x556a187b650b in ide_start_dma hw/ide/core.c:921 #7 0x556a187b61e6 in ide_sector_start_dma hw/ide/core.c:911 #8 0x556a187b9e26 in cmd_write_dma hw/ide/core.c:1486 #9 0x556a187bd519 in ide_exec_cmd hw/ide/core.c:2027 #10 0x556a187d71c5 in handle_reg_h2d_fis hw/ide/ahci.c:1204 #11 0x556a187d7681 in handle_cmd hw/ide/ahci.c:1254 #12 0x556a187d168a in check_cmd hw/ide/ahci.c:510 #13 0x556a187d0afc in ahci_port_write hw/ide/ahci.c:314 #14 0x556a187d105d in ahci_mem_write hw/ide/ahci.c:435 #15 0x556a1831d959 in memory_region_write_accessor /home/elmarco/src/qemu/memory.c:525 #16 0x556a1831dc35 in access_with_adjusted_size /home/elmarco/src/qemu/memory.c:591 #17 0x556a18323ce3 in memory_region_dispatch_write /home/elmarco/src/qemu/memory.c:1262 #18 0x556a1828cf67 in address_space_write_continue /home/elmarco/src/qemu/exec.c:2578 #19 0x556a1828d20b in address_space_write /home/elmarco/src/qemu/exec.c:2635 #20 0x556a1828d92b in address_space_rw /home/elmarco/src/qemu/exec.c:2737 #21 0x556a1828daf7 in cpu_physical_memory_rw /home/elmarco/src/qemu/exec.c:2746 #22 0x556a183068d3 in cpu_physical_memory_write /home/elmarco/src/qemu/include/exec/cpu-common.h:72 #23 0x556a18308194 in qtest_process_command /home/elmarco/src/qemu/qtest.c:382 #24 0x556a18309999 in qtest_process_inbuf /home/elmarco/src/qemu/qtest.c:573 #25 0x556a18309a4a in qtest_read /home/elmarco/src/qemu/qtest.c:585 #26 0x556a18598b85 in qemu_chr_be_write_impl /home/elmarco/src/qemu/qemu-char.c:387 #27 0x556a18598c52 in qemu_chr_be_write /home/elmarco/src/qemu/qemu-char.c:399 #28 0x556a185a2afa in tcp_chr_read /home/elmarco/src/qemu/qemu-char.c:2902 #29 0x556a18cbaf52 in qio_channel_fd_source_dispatch io/channel-watch.c:84 Follow John Snow recommendation: Everywhere else ncq_err is used, it is accompanied by a list cleanup except for ncq_cb, which is the case you are fixing here. Move the sglist destruction inside of ncq_err and then delete it from the other two locations to keep it tidy. Call dma_buf_commit in ide_dma_cb after the early return. Though, this is also a little wonky because this routine does more than clear the list, but it is at the moment the centralized "we're done with the sglist" function and none of the other side effects that occur in dma_buf_commit will interfere with the reset that occurs from ide_restart_bh, I think Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2016-08-08usb: free leaking pathMarc-André Lureau
qdev_get_dev_path() returns an allocated string, free it when no longer needed. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-08usb: free USBDevice.stringsMarc-André Lureau
The list is created during instance init and further populated with usb_desc_set_string(). Clear it when unrealizing the device. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-08virtio-input: free config listMarc-André Lureau
Clear the list when finalizing. The list is created during realize with virtio_input_idstr_config() and later by further calls to virtio_input_init_config() and virtio_input_add_config(). This leak can be reproduced with device-introspect-test -p /x86_64/device/introspect/concrete. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-08ahci: free irqs arrayMarc-André Lureau
Each irq is referenced by the IDEBus in ide_init2(), thus we can free the no longer used array. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Acked-by: John Snow <jsnow@redhat.com>
2016-08-05Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches for 2.7.0-rc2 # gpg: Signature made Fri 05 Aug 2016 10:30:12 BST # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: nvme: bump PCI revision nvme: fix identify to be NVMe 1.1 compliant block: Accept any target node for transactional blockdev-backup Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-05Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Fri 05 Aug 2016 10:24:34 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: virtio-blk: Remove stale comment about draining virtio-blk: Release s->rq queue at system_reset throttle: Test burst limits lower than the normal limits throttle: Don't allow burst limits to be lower than the normal limits block/parallels: check new image size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-05virtio-blk: Remove stale comment about drainingFam Zheng
This is stale after commit 6e40b3bf (virtio-blk: Use blk_drain() to drain IO requests), remove it. Suggested-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1470278654-13525-3-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-08-05virtio-blk: Release s->rq queue at system_resetFam Zheng
At system_reset, there is no point in retrying the queued request, because the driver that issued the request won't be around any more. Analyzed-by: Laszlo Ersek <lersek@redhat.com> Reported-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1470278654-13525-2-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-08-05nvme: bump PCI revisionChristoph Hellwig
The broken Identify implementation in earlier Qemu versions means we need to blacklist it from issueing the NVMe 1.1 Identify Namespace List command. As we want to be able to use it in newer Qemu versions we need a way to identify those. Bump the PCI revision as a guest visible indicator of this bug fix. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-08-05nvme: fix identify to be NVMe 1.1 compliantChristoph Hellwig
NVMe 1.1 requires devices to implement a Namespace List subcommand of the identify command. Qemu not only not implements this features, but also misinterprets it as an Identify Controller request. Due to this any OS trying to use the Namespace List will fail the probe. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-08-04Xen PCI passthrough: fix passthrough failure when no interrupt pinBruce Rogers
Commit 5a11d0f7 mistakenly converted a log message into an error condition when no pin interrupt is found for the pci device being passed through. Revert that part of the commit. Signed-off-by: Bruce Rogers <brogers@suse.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-08-04Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* xsetbv fix (x86 targets TCG) * remove unused functions * qht segfault and memory leak fixes * NBD fixes * Fix for non-power-of-2 discard granularity * Memory hotplug fixes * Migration regressions * IOAPIC fixes and (disabled by default) EOI register support * Various other small fixes # gpg: Signature made Wed 03 Aug 2016 18:01:05 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (25 commits) util: Fix assertion in iov_copy() upon zero 'bytes' and non-zero 'offset' qdev: Fix use after free in qdev_init_nofail error path Reorganize help output of '-display' option x86: ioapic: add support for explicit EOI x86: ioapic: ignore level irq during processing apic: fix broken migration for kvm-apic fw_cfg: Make base type "fw_cfg" abstract block: Cater to iscsi with non-power-of-2 discard osdep: Document differences in rounding macros nbd: Limit nbdflags to 16 bits nbd: Fix bad flag detection on server i2c: fix migration regression introduced by broadcast support mptsas: really fix migration compatibility qdist: return "(empty)" instead of NULL when printing an empty dist qdist: use g_renew and g_new instead of g_realloc and g_malloc. qdist: fix memory leak during binning target-i386: fix typo in xsetbv implementation qht: do not segfault when gathering stats from an uninitialized qht util: Drop inet_listen() util: drop unix_nonblocking_connect() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-03qdev: Fix use after free in qdev_init_nofail error pathFam Zheng
Since 69382d8b (qdev: Fix object reference leak in case device.realize() fails), object_property_set_bool could release the object. The error path wants the type name, so hold an reference before realizing it. Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1470109301-12966-1-git-send-email-famz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-03x86: ioapic: add support for explicit EOIPeter Xu
Some old Linux kernels (upstream before v4.0), or any released RHEL kernels has problem in sending APIC EOI when IR is enabled. Meanwhile, many of them only support explicit EOI for IOAPIC, which is only introduced in IOAPIC version 0x20. This patch provide a way to boost QEMU IOAPIC to version 0x20, in order for QEMU to correctly receive EOI messages. Without boosting IOAPIC version to 0x20, kernels before commit d32932d ("x86/irq: Convert IOAPIC to use hierarchical irqdomain interfaces") will have trouble enabling both IR and level-triggered interrupt devices (like e1000). To upgrade IOAPIC to version 0x20, we need to specify: -global ioapic.version=0x20 To be compatible with old systems, 0x11 will still be the default IOAPIC version. Here 0x11 and 0x20 are the only versions to be supported. One thing to mention: this patch only applies to emulated IOAPIC. It does not affect kernel IOAPIC behavior. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1470059959-372-1-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-03x86: ioapic: ignore level irq during processingPeter Xu
For level triggered interrupts, we will get Remote IRR bit cleared after guest kernel finished processing specific request. Before that, we should ignore the same interrupt from triggering again. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1469974685-4144-1-git-send-email-peterx@redhat.com> [Push new "if" up so that it covers KVM split irqchip as well. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-03fw_cfg: Make base type "fw_cfg" abstractMarkus Armbruster
Missed when commit 5712db6 split off "fw_cfg_io" and "fw_cfg_mem". Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1469777353-9383-1-git-send-email-armbru@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-03i2c: fix migration regression introduced by broadcast supportIgor Mammedov
QEMU fails migration with following error: qemu-system-x86_64: Missing section footer for i2c_bus qemu-system-x86_64: load of migration failed: Invalid argument when migrating from: qemu-system-x86_64-v2.6.0 -m 256M rhel72.img -M pc-i440fx-2.6 to qemu-system-x86_64-v2.7.0-rc0 -m 256M rhel72.img -M pc-i440fx-2.6 Regression is added by commit 2293c27f (i2c: implement broadcast write) Fix it by dropping 'broadcast' VMState introduced by 2293c27f and reuse broadcast 0x00 address as broadcast flag in bus->saved_address. Then if there were ongoing broadcast at migration time, set bus->saved_address to it and at i2c_slave_post_load() time check for it instead of transfering and using 'broadcast' VMState. As result of reusing existing saved_address VMState, no compat glue will be needed to keep forward/backward compatiblity. which makes fix much less intrusive. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1469623198-177227-1-git-send-email-imammedo@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-03mptsas: really fix migration compatibilityPaolo Bonzini
Commit 2e2aa316 removed internal flag msi_in_use, but it existed in vmstate. Restore it for migration to older QEMU versions. Reported-by: Amit Shah <amit.shah@redhat.com> Suggested-by: Amit Shah <amit.shah@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Marcel Apfelbaum <marcel@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Cc: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-03Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160803-1' into ↵Peter Maydell
staging usb: bugfixes for xen-usb and ehci, mingw build fix. # gpg: Signature made Wed 03 Aug 2016 14:04:26 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20160803-1: xen: use a common function for pv and hvm guest backend register calls xen: drain submit queue in xen-usb before removing device xen: when removing a backend don't remove many of them ehci: faster frame index calculation for skipped frames wxx: Fix compilation of host-libusb.c wxx: Fix compiler warning for host-libusb.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-03xen: use a common function for pv and hvm guest backend register callsJuergen Gross
Instead of calling xen_be_register() for each supported backend type for hvm and pv guests in their machine init functions use a common function in order not to have to add new backends twice. This at once fixes the error that hvm domains couldn't use the qusb backend. Signed-off-by: Juergen Gross <jgross@suse.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Message-id: 1470119552-16170-1-git-send-email-jgross@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-03xen: drain submit queue in xen-usb before removing deviceJuergen Gross
When unplugging a device in the Xen pvusb backend drain the submit queue before deallocation of the control structures. Otherwise there will be bogus memory accesses when I/O contracts are finished. Correlated to this issue is the handling of cancel requests: a packet cancelled will still lead to the call of complete, so add a flag to the request indicating it should be just dropped on complete. Signed-off-by: Juergen Gross <jgross@suse.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Message-id: 1470140044-16492-3-git-send-email-jgross@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-03xen: when removing a backend don't remove many of themJuergen Gross
When a Xenstore watch fires indicating a backend has to be removed don't remove all backends for that domain with the specified device index, but just the one which has the correct type. The easiest way to achieve this is to use the already determined xendev as parameter for xen_be_del_xendev() instead of only the domid and device index. This at once removes the open coded QTAILQ_FOREACH_SAVE() in xen_be_del_xendev() as there is no need to search for the correct xendev any longer. Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Message-id: 1470140044-16492-2-git-send-email-jgross@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-03spapr: Error out when CPU hotplug is attempted on older pseries machinesBharata B Rao
CPU hotplug and coldplug aren't supported prior to pseries-2.7. Further, earlier machine types don't use CPU core objects at all. These mean that query-hotpluggable-cpus and coldplug on older pseries machines will crash QEMU. It also means that hotpluggable_cpus flag in query-machines will be incorrectly set to true for pseries < 2.7, since it is based on the presence of the query_hotpluggable_cpus hook. - Don't assign the query_hotpluggable_cpus hook for pseries < 2.7 - query_hotpluggable_cpus should therefore never be called on pseries < 2.7, so add an assert - spapr_core_pre_plug() should fail hot/cold plug attempts for pseries < 2.7, since core objects are never used there - spapr_core_plug() should therefore never be called for pseries < 2.7, so add an assert. Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> [dwg: Change from query_hotpluggable_cpus returning NULL for pseries < 2.7 to not being called at all, reword commit message for accuracy] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-08-02ehci: faster frame index calculation for skipped framesEvgeny Yakovlev
ehci_update_frindex takes time linearly proportional to a number of uframes to calculate new frame index and raise FLR interrupts, which is a problem for large amounts of uframes. If we experience large delays between echi timer callbacks (i.e. because other periodic handlers have taken a lot of time to complete) we get a lot of skipped frames which then delay ehci timer callback more and this leads to deadlocking the system when ehci schedules next callback to be too soon. Observable behaviour is qemu consuming 100% host CPU time while guest is unresponsive. This misbehavior could happen for a while and QEMU does not get out from this state automatically without the patch. This change makes ehci_update_frindex execute in constant time. Signed-off-by: Evgeny Yakovlev <eyakovlev@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Message-id: 1469638520-32706-1-git-send-email-den@openvz.org CC: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-02wxx: Fix compilation of host-libusb.cStefan Weil
libusb.h uses the WINAPI calling convention for all function callbacks. Cross compilation with Mingw-w64 on Cygwin fails when this calling convention is missing. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-id: 1469775331-7468-1-git-send-email-sw@weilnetz.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-08-02wxx: Fix compiler warning for host-libusb.cStefan Weil
The local variable i is unsed for Windows. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-id: 1469775569-7869-1-git-send-email-sw@weilnetz.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-29Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160729' into stagingPeter Maydell
MIPS patches 2016-07-29 Changes: * bug fixes # gpg: Signature made Fri 29 Jul 2016 09:44:13 BST # gpg: using RSA key 0x52118E3C0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" # Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4 4FC0 5211 8E3C 0B29 DA6B * remotes/lalrae/tags/mips-20160729: target-mips: fix EntryHi.EHINV being cleared on TLB exception hw/mips_malta: Fix YAMON API print routine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-29Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.7-20160729' ↵Peter Maydell
into staging ppc patch queue 2016-07-29 Here are the current pending ppc and spapr related patches for qemu-2.7. Given the freeze status, these are all bugfixes, with two exceptions: * There's some final rework of the vcpu hotplug model. Specifically we add spapr specific code on the generic basis Igor established to make cpu_index stable for pseries-2.7 and later machine types. - This allows us to remove the limitation that cpu cores had to be inserted in linear order, and removed in LIFO order. - This is worth merging this late in 2.7 because it will avoid considerable future grief with management layers needing to discover whether out-of-order hotplug is possible, amongst other things. - For now we do add a constraint that the initial cpu cannot be unplugged. * We add two extra testcases to make check, for postcopy and drive_del on ppc64. - Not strictly bugfixes, but safe, because they don't affect the actual code, and increase test coverage. # gpg: Signature made Fri 29 Jul 2016 05:50:02 BST # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.7-20160729: tests: add drive_del-test to ppc/ppc64 spapr: Prevent boot CPU core removal ppc: Fix fault PC reporting for lve*/stve* VMX instructions test: port postcopy test to ppc64 Revert "spapr: Ensure CPU cores are added contiguously and removed in LIFO order" spapr: init CPUState->cpu_index with index relative to core-id Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-29Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc, pci, virtio: cleanups, fixes a bunch of bugfixes and a couple of cleanups making these easier and/or making debugging easier Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 29 Jul 2016 04:11:01 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (41 commits) mptsas: Fix a migration compatible issue vhost: do not update last avail idx on get_vring_base() failure vhost: add vhost_net_set_backend() vhost-user: add error report in vhost_user_write() tests: fix vhost-user-test leak tests: plug some leaks in virtio-net-test vhost-user: wait until backend init is completed char: add and use tcp_chr_wait_connected char: add chr_wait_connected callback vhost: add assert() to check runtime behaviour vhost-net: vhost_migration_done is vhost-user specific Revert "vhost-net: do not crash if backend is not present" vhost-user: add get_vhost_net() assertions vhost-user: keep vhost_net after a disconnection vhost-user: check vhost_user_{read,write}() return value vhost-user: check qemu_chr_fe_set_msgfds() return value vhost-user: call set_msgfds unconditionally qemu-char: fix qemu_chr_fe_set_msgfds() crash when disconnected vhost: use error_report() instead of fprintf(stderr,...) vhost: add missing VHOST_OPS_DEBUG ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-29mptsas: Fix a migration compatible issueCao jin
My previous commit 2e2aa316 removed internal flag msi_in_use, which exists in vmstate, use VMSTATE_UNUSED for migration compatibility. Reported-by: Amit Shah <amit.shah@redhat.com> Suggested-by: Amit Shah <amit.shah@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Marcel Apfelbaum <marcel@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com>
2016-07-29vhost: do not update last avail idx on get_vring_base() failureMarc-André Lureau
The state.num value will probably be 0 in this case, but that doesn't make sense to update. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-29spapr: Prevent boot CPU core removalBharata B Rao
Boot CPU is assumed to be always present in QEMU code. So until that assumptions are gone, deny removal request. In another words, QEMU won't support boot CPU core hot-unplug. Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> [dwg: Tweaked error message for clarity] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-18 08:15:26 +0000