aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2016-11-18virtio-crypto: fix virtio_queue_set_notification() raceStefan Hajnoczi
We must check for new virtqueue buffers after re-enabling notifications. This prevents the race condition where the guest added buffers just after we stopped popping the virtqueue but before we re-enabled notifications. I think the virtio-crypto code was based on virtio-net but this crucial detail was missed. virtio-net does not have the race condition because it processes the virtqueue one more time after re-enabling notifications. Cc: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2016-11-18Merge remote-tracking branch 'remotes/elmarco/tags/ivshmem-pull-request' ↵Stefan Hajnoczi
into staging * remotes/elmarco/tags/ivshmem-pull-request: ivshmem: Fix 64 bit memory bar configuration Message-id: 20161117152613.18578-1-marcandre.lureau@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-11-17ivshmem: Fix 64 bit memory bar configurationZhuang Yanying
Device ivshmem property use64=0 is designed to make the device expose a 32 bit shared memory BAR instead of 64 bit one. The default is a 64 bit BAR, except pc-1.2 and older retain a 32 bit BAR. A 32 bit BAR can support only up to 1 GiB of shared memory. This worked as designed until commit 5400c02 accidentally flipped its sense: since then, we misinterpret use64=0 as use64=1 and vice versa. Worse, the default got flipped as well. Devices ivshmem-plain and ivshmem-doorbell are not affected. Fix by restoring the test of IVShmemState member not_legacy_32bit that got messed up in commit 5400c02. Also update its initialization for devices ivhsmem-plain and ivshmem-doorbell. Without that, they'd regress to 32 bit BARs. Signed-off-by: Zhuang Yanying <ann.zhuangyanying@huawei.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <1479385863-7648-1-git-send-email-ann.zhuangyanying@huawei.com>
2016-11-16pc: fix FW_CFG_NB_CPUS to account for -device added CPUsIgor Mammedov
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1479301481-197333-1-git-send-email-imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-11-16fw_cfg: move FW_CFG_NB_CPUS out of fw_cfg_init1()Igor Mammedov
PC will use this field in other way, so move it outside the common code so PC could set a different value, i.e. all CPUs regardless of where they are coming from (-smp X | -device cpu...). It's quick and dirty hack as it could be implemented in more generic way in MashineClass. But do it in simple way since only PC is affected so far. Later we can generalize it when another affected target gets support for -device cpu. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1479212236-183810-3-git-send-email-imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-11-16Revert "pc: Add 'etc/boot-cpus' fw_cfg file for machine with more than 255 CPUs"Igor Mammedov
This reverts commit 080ac219cc7d9c55adf925c3545b7450055ad625. Legacy FW_CFG_NB_CPUS will be reused instead of 'etc/boot-cpus' fw_cfg file since it does the same and there is no point to maintaing duplicate guest ABI, if it can be helped. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1479212236-183810-2-git-send-email-imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-11-15Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingStefan Hajnoczi
virtio, vhost, pc, pci: documentation, fixes and cleanups Lots of fixes all over the place. Unfortunately, this does not yet fix a regression with vhost introduced by the last pull, the issue is typically this error: kvm_mem_ioeventfd_add: error adding ioeventfd: File exists followed by QEMU aborting. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> * remotes/mst/tags/for_upstream: (28 commits) docs: add PCIe devices placement guidelines virtio: drop virtio_queue_get_ring_{size,addr}() vhost: drop legacy vring layout bits vhost: adapt vhost_verify_ring_mappings() to virtio 1 ring layout nvdimm acpi: introduce NVDIMM_DSM_MEMORY_SIZE nvdimm acpi: use aml_name_decl to define named object nvdimm acpi: rename nvdimm_dsm_reserved_root nvdimm acpi: fix two comments nvdimm acpi: define DSM return codes nvdimm acpi: rename nvdimm_acpi_hotplug nvdimm acpi: cleanup nvdimm_build_fit nvdimm acpi: rename nvdimm_plugged_device_list docs: improve the doc of Read FIT method nvdimm acpi: clean up nvdimm_build_acpi pc: memhp: stop handling nvdimm hotplug in pc_dimm_unplug pc: memhp: move nvdimm hotplug out of memory hotplug nvdimm acpi: drop the lock of fit buffer qdev: hotplug: drop HotplugHandler.post_plug callback vhost: migration blocker only if shared log is used virtio-net: mark VIRTIO_NET_F_GSO as legacy ... Message-id: 1479237527-11846-1-git-send-email-mst@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-11-15qdev: Fix assert in PCI address property when used by vfio-pciDaniel Oram
Allow the PCIHostDeviceAddress structure to work as the host property in vfio-pci when it has it's default value of all fields set to ~0. In this form the property indicates a non-existant device but given the field bit sizes gets asserted as excess (and invalid) precision overflows the string buffer. The BDF of an invalid device "FFFF:FF:FF.F" is returned instead. Signed-off-by: Daniel Oram <daniel.oram@gmail.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Message-Id: <71f06765c4ba16dcd71cbf78e877619948f04ed9.1478777270.git.daniel.oram@gmail.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2016-11-15virtio: drop virtio_queue_get_ring_{size,addr}()Greg Kurz
These are not used anymore. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15vhost: drop legacy vring layout bitsGreg Kurz
The legacy vring layout is not used anymore as we use the separate mappings even for legacy devices. This patch simply removes it. This also fixes a bug with virtio 1 devices when the vring descriptor table is mapped at a higher address than the used vring because the following function may return an insanely great value: hwaddr virtio_queue_get_ring_size(VirtIODevice *vdev, int n) { return vdev->vq[n].vring.used - vdev->vq[n].vring.desc + virtio_queue_get_used_size(vdev, n); } and the mapping fails. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15vhost: adapt vhost_verify_ring_mappings() to virtio 1 ring layoutGreg Kurz
With virtio 1, the vring layout is split in 3 separate regions of contiguous memory for the descriptor table, the available ring and the used ring, as opposed with legacy virtio which uses a single region. In case of memory re-mapping, the code ensures it doesn't affect the vring mapping. This is done in vhost_verify_ring_mappings() which assumes the device is legacy. This patch changes vhost_verify_ring_mappings() to check the mappings of each part of the vring separately. This works for legacy mappings as well. Cc: qemu-stable@nongnu.org Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15nvdimm acpi: introduce NVDIMM_DSM_MEMORY_SIZEXiao Guangrong
and use it to replace the raw number Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: use aml_name_decl to define named objectXiao Guangrong
to make the code more clearer Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: rename nvdimm_dsm_reserved_rootXiao Guangrong
Rename it to nvdimm_dsm_handle_reserved_root_method Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: fix two commentsXiao Guangrong
fixed the English issue and code-style issue Suggested-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: define DSM return codesXiao Guangrong
and use these codes to refine the code Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: rename nvdimm_acpi_hotplugXiao Guangrong
Rename it to nvdimm_plug() Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: cleanup nvdimm_build_fitXiao Guangrong
inline buf_size to refine the code a bit Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: rename nvdimm_plugged_device_listXiao Guangrong
Its behavior has been changed as the nvdimm device which is being realized also will be handled in this function, so rename it to reflect the fact Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: clean up nvdimm_build_acpiXiao Guangrong
To make the code more clearer, we 1) check ram_slots first, and build ssdt & nfit only when it is available 2) use nvdimm_get_plugged_device_list() to check if there is nvdimm device plugged Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15pc: memhp: stop handling nvdimm hotplug in pc_dimm_unplugXiao Guangrong
as it is never called when nvdimm hotplug happens Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15pc: memhp: move nvdimm hotplug out of memory hotplugXiao Guangrong
as they use completely different way to handle hotplug event Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15nvdimm acpi: drop the lock of fit bufferXiao Guangrong
as there is a global lock to protect vm-exit handlers and QMP/monitor, this lock can be dropped Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15qdev: hotplug: drop HotplugHandler.post_plug callbackXiao Guangrong
as nvdimm acpi is okay to build fit when the nvdimm device has not been 'realized' Suggested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2016-11-15vhost: migration blocker only if shared log is usedRafael David Tinoco
Commit 31190ed7 added a migration blocker in vhost_dev_init() to check if memfd would succeed. It is better if this blocker first checks if vhost backend requires shared log. This will avoid a situation where a blocker is added inappropriately (e.g. shared log allocation fails when vhost backend doesn't support it). Signed-off-by: Rafael David Tinoco <rafael.tinoco@canonical.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15virtio-net: mark VIRTIO_NET_F_GSO as legacyMichael S. Tsirkin
virtio 1.0 spec says this is a legacy feature bit, hide it from guests in modern mode. Note: for cross-version migration compatibility, we keep the bit set in host_features. The result will be that a guest migrating cross-version will see host features change under it. As guests only seem to read it once, this should not be an issue. Meanwhile, will work to fix guests to ignore this bit in virtio1 mode, too. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2016-11-15virtio: allow per-device-class legacy featuresMichael S. Tsirkin
Legacy features are those that transitional devices only expose on the legacy interface. Allow different ones per device class. Cc: qemu-stable@nongnu.org # dependency for the next patch Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2016-11-15acpi: fix DMAR device scope for IOAPICPeter Xu
We should not use cpu_to_le16() here, instead each of device/function value is stored in a 8 byte field. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15intel_iommu: fix incorrect assertPeter Xu
Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15intel_iommu: fix several incorrect endianess and bit fieldsPeter Xu
Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15virtio-crypto: tag as not hotpluggable and migrationGonglei
Currently the virtio-crypto device hasn't supported hotpluggable and live migration well. Let's tag it as not hotpluggable and migration actively and reopen them once we support them well. Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15virtio: make virtqueue_alloc_element staticLadi Prosek
The function does not fully initialize the returned VirtQueueElement and should be used only internally from the virtio module. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15virtio: rename virtqueue_discard to virtqueue_unpopLadi Prosek
The function undoes the effect of virtqueue_pop and doesn't do anything destructive or irreversible so virtqueue_unpop is a more fitting name. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15intel_iommu: fixing source id during IOTLB hash key calculationJason Wang
Using uint8_t for source id will lose bus num and get the wrong/invalid IOTLB entry. Fixing by using uint16_t instead and enlarge level shift. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-15Merge remote-tracking branch 'jasowang/tags/net-pull-request' into stagingStefan Hajnoczi
# gpg: Signature made Tue 15 Nov 2016 07:37:27 AM GMT # gpg: using RSA key 0xEF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * jasowang/tags/net-pull-request: docs: fix COLO architecture diagram net: fix sending of data with -net socket, listen backend net: skip virtio-net config of deleted nic's peers Message-id: 1479195830-4725-1-git-send-email-jasowang@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-11-15net: skip virtio-net config of deleted nic's peersYuri Benditovich
https://bugzilla.redhat.com/show_bug.cgi?id=1373816 qemu core dump happens during repetitive unpug-plug with multiple queues and Windows RSS-capable guest. If back-end delete requested during virtio-net device initialization, driver still can try configure the device for multiple queues. The virtio-net device is expected to be removed as soon as the initialization is done. Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-11-15ppc/pnv: Fix fatal bug on 32-bit hostsDavid Gibson
If the pnv machine type is compiled on a 32-bit host, the unsigned long (host) type is 32-bit. This means that the hweight_long() used to calculate the number of allowed cores only considers the low 32 bits of the cores_mask variable, and can thus return 0 in some circumstances. This corrects the bug. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Suggested-by: Richard Henderson <rth@twiddle.net> [clg: replaced hweight_long() by ctpop64() ] Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-11-15ppc/pnv: fix xscom address translation for POWER9Cédric Le Goater
High addresses can overflow the uint32_t pcba variable after the 8byte shift. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-11-15ppc/pnv: add a 'xscom_core_base' field to PnvChipClassCédric Le Goater
The XSCOM addresses for the core registers are encoded in a slightly different way on POWER8 and POWER9. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-11-15spapr-vty: Fix bad assert() statementThomas Huth
When using the serial console in the GTK interface of QEMU (and QEMU has been compiled with CONFIG_VTE), it is possible to trigger the assert() statement in vty_receive() in spapr_vty.c by pasting a chunk of text with length > 16 into the QEMU window. Most of the other serial backends seem to simply drop characters that they can not handle, so I think we should also do the same in spapr-vty to fix this issue. Buglink: https://bugs.launchpad.net/qemu/+bug/1639322 Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-11-15spapr: Fix migration of PCI host bridges from qemu-2.7David Gibson
daa2369 "spapr_pci: Add a 64-bit MMIO window" subtly broke migration from qemu-2.7 to the current version. It split the device's MMIO window into two pieces for 32-bit and 64-bit MMIO. The patch included backwards compatibility code to convert the old property into the new format. However, the property value was also transferred in the migration stream and compared with a (probably unwise) VMSTATE_EQUAL. So, the "raw" value from 2.7 is compared to the new style converted value from (pre-)2.8 giving a mismatch and migration failure. Although it would be technically possible to fix this in a way allowing backwards migration, that would leave an ugly legacy around indefinitely. This patch takes the simpler approach of bumping the migration version, dropping the unwise VMSTATE_EQUAL (and some equally unwise ones around it) and ignoring them on an incoming migration. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2016-11-15ppc/pnv: fix compile breakage on old gccCédric Le Goater
PnvChip is defined twice and this can confuse old compilers : CC ppc64-softmmu/hw/ppc/pnv_xscom.o In file included from qemu.git/hw/ppc/pnv.c:29: qemu.git/include/hw/ppc/pnv.h:60: error: redefinition of typedef ‘PnvChip’ qemu.git/include/hw/ppc/pnv_xscom.h:24: note: previous declaration of ‘PnvChip’ was here make[1]: *** [hw/ppc/pnv.o] Error 1 make[1]: *** Waiting for unfinished jobs.... Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-11-15powernv: CPU compatibility modes don't make sense for powernvDavid Gibson
powernv has some code (derived from the spapr equivalent) used in device tree generation which depends on the CPU's compatibility mode / logical PVR. However, compatibility modes don't make sense on powernv - at least not as a property controlled by the host - because the guest in powernv has full hypervisor level access to the virtual system, and so owns the PCR (Processor Compatibility Register) which implements compatiblity modes. Note: the new logic doesn't take into account kvmppc_smt_threads() like the old version did. However, if core->nr_threads exceeds kvmppc_smt_threads() then things will already be broken and clamping the value in the device tree isn't going to save us. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
2016-11-14atapi: classify read_cd as conditionally returning dataJohn Snow
For the purposes of byte_count_limit verification, add a new flag that identifies read_cd as sometimes returning data, then check the BCL in its command handler after we know that it will indeed return data. Reported-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Message-id: 1477970211-25754-2-git-send-email-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2016-11-11Merge remote-tracking branch 'bonzini/tags/for-upstream' into stagingStefan Hajnoczi
Small fixes for hard freeze. # gpg: Signature made Thu 10 Nov 2016 03:34:24 PM GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * bonzini/tags/for-upstream: nbd: Don't inf-loop on early EOF target-i386: document how x86 gdb_num_core_regs is computed. qdev: fix use-after-free regression from becdfa00cfa target-i386/machine: fix migrate faile because of Hyper-V HV_X64_MSR_VP_RUNTIME vl.c: move pidfile creation up the line target-i386: fix typo Message-id: 1478800362-18138-1-git-send-email-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-11-10hw/input/hid: support alternative sysrq/break scancodes for gtk-vncPeter Korsgaard
The printscreen/sysrq and pause/break keys currently don't work for guests using -usbdevice keyboard when accessed through vnc with a gtk-vnc based client. The reason for this is a mismatch between gtk-vnc and qemu in how these keys should be mapped to XT keycodes. On the original IBM XT these keys behaved differently than other keys. Quoting from https://www.win.tue.nl/~aeb/linux/kbd/scancodes-1.html: The keys PrtSc/SysRq and Pause/Break are special. The former produces scancode e0 2a e0 37 when no modifier key is pressed simultaneously, e0 37 together with Shift or Ctrl, but 54 together with (left or right) Alt. (And one gets the expected sequences upon release. But see below.) The latter produces scancode sequence e1 1d 45 e1 9d c5 when pressed (without modifier) and nothing at all upon release. However, together with (left or right) Ctrl, one gets e0 46 e0 c6, and again nothing at release. It does not repeat. Gtk-vnc supports the 'QEMU Extended Key Event Message' RFB extension to send raw XT keycodes directly to qemu, but the specification doesn't explicitly specify how to map such long/complicated keycode sequences. From the spec (https://github.com/rfbproto/rfbproto/blob/master/rfbproto.rst#qemu-extended-key-event-message) The keycode is the XT keycode that produced the keysym. An XT keycode is an XT make scancode sequence encoded to fit in a single U32 quantity. Single byte XT scancodes with a byte value less than 0x7f are encoded as is. 2-byte XT scancodes whose first byte is 0xe0 and second byte is less than 0x7f are encoded with the high bit of the first byte set hid.c currently expects the keycode sequence with shift/ctl for sysrq (e0 37 -> 0xb7 in RFB), whereas gtk-vnc uses the sequence with alt (0x54). Likewise, hid.c expects the code without modifiers (e1 1d 45 -> 0xc5 in RFB), whereas gtk-vnc sends the keycode sequence with ctrl for pause (e0 46 -> 0xc6 in RFB). See keymaps.cvs in gtk-vnc for the mapping used: https://git.gnome.org/browse/gtk-vnc/tree/src/keymaps.csv#n150 Now, it isn't obvious to me which sequence is really "right", but as the 0x54/0xc6 keycodes are currently unused in hid.c, supporting both seems like the pragmatic solution to me. The USB HID keyboard boot protocol used by hid.c doesn't have any other mapping applicable to these keys. The other guest keyboard interfaces (ps/2, virtio, ..) are not affected, because they handle these keys differently. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Message-id: 20161028145132.1702-1-peter@korsgaard.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-11-10usbredir: free vm_change_state_handler in usbredir destroy dispatchLi Qiang
In usbredir destroy dispatch function, it doesn't free the vm change state handler once registered in usbredir_realize function. This will lead a memory leak issue. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 58216976.d0236b0a.77b99.bcd6@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-11-10usb: ehci: fix memory leak in ehci_init_transferLi Qiang
In ehci_init_transfer function, if the 'cpage' is bigger than 4, it doesn't free the 'p->sgl' once allocated previously thus leading a memory leak issue. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 5821c0f4.091c6b0a.e0c92.e811@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-11-10qdev: fix use-after-free regression from becdfa00cfaMarc-André Lureau
Spotted by Coverity, CID 1365383. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20161107095922.31676-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-07hw/i2c/bitbang_i2c: Handle NACKs from devicesPeter Maydell
If the guest attempts to talk to a nonexistent device over i2c, the i2c_start_transfer() function will return non-zero, indicating that the bus is signalling a NACK. Similarly, if the i2c_send() function returns nonzero then the target device returned a NACK. Handle this possibility in the bitbang_i2c code, by returning the state machine to the STOPPED state and returning the NACK bit to the guest. This bit of missing functionality was spotted by Coverity (it noticed that we weren't checking the return value from i2c_start_transfer()). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1477332749-27098-1-git-send-email-peter.maydell@linaro.org