aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2017-01-20s390x/pci: change the device array to a listPierre Morel
In order to support a greater number of devices we use a QTAILQ list of devices instead of a limited array. This leads us to change: - every lookup function s390_pci_find_xxx() for QTAILQ - the FH_MASK_INDEX to index up to 65536 devices Signed-off-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-01-20s390x/pci: dynamically allocate iommuYi Min Zhao
When initializing a PCI device, an address space is required during PCI core initialization and before the call to the embedding object hotplug callback. To provide this AS, we allocate a S390PCIIOMMU object containing this AS. Initialization of S390PCIIOMMU object is done before the PCI device is completely created. So that we cannot associate the IOMMU with the device at the moment. To track the IOMMU object, we use g_hash functions with the PCI device's bus address as a key to provide an array of pointers indexed by the PCI device's devfn to the allocated IOMMU. Signed-off-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Reviewed-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-01-20s390x/pci: make S390PCIIOMMU inherit ObjectYi Min Zhao
Currently S390PCIIOMMU is a normal struct. Let's make it inherit Object in order to take advantage of QOM. In addition, we move some stuff related to IOMMU from S390PCIBusDevice to S390PCIIOMMU. Signed-off-by: Yi Min Zhao <zyimin@linux.vnet.ibm.com> Acked-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-01-20s390x/kvm: use kvm_gsi_routing_enabled in flicFei Li
Let's use kvm_gsi_routing_enabled() to check if kvm supports KVM_CAP_IRQ_ROUTING in order to avoid a needless ioctl invocation. Signed-off-by: Fei Li <sherrylf@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-01-20s390x: add compat machine for 2.9Cornelia Huck
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
2017-01-20s390x: remove double compat statementChristian Borntraeger
We chain our compat handler via the CCW_COMPAT macros and via the class_init function. (e.g. ccw_machine_2_7_class_options calls ccw_machine_2_8_class_options). As all class_init functions in that chain call SET_MACHINE_COMPAT for their compat settings, and SET_MACHINE_COMPAT will append there is no need to do that again. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-01-20hw/pci: use-after-free in pci_nic_init_nofail when nic device fails to ↵Alex Kompel
initialize object_property_set_bool(OBJECT(dev), true, "realized", &err) in pci_nic_init_nofail may release the object if device fails to initialize which leads to use-after-free in error handling block. qdev_init_nofail does the same thing while holding the reference. (gdb) run -net nic qemu-system-x86_64: failed to find romfile "efi-e1000.rom" Program received signal SIGSEGV, Segmentation fault. object_unparent (obj=0x7fffe96a0010) at qom/object.c:440 440 in qom/object.c (gdb) bt <nd_table>, rootbus=0x5555567ed990, default_model=<optimized out>, default_devaddr=<optimized out>) at hw/pci/pci.c:1812 pci_bus=0x5555567ed990) at hw/i386/pc.c:1634 pci_type=0x555555c1a523 "i440FX", host_type=0x555555ba564e "i440FX-pcihost") at hw/i386/pc_piix.c:241 out>, envp=<optimized out>) at vl.c:4481 Signed-off-by: Alex Kompel <barbos@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-01-20hw/net/dp8393x: Avoid unintentional sign extensions on addressesPeter Maydell
The dp8393x has several 32-bit values which are formed by concatenating two 16 bit device register values. Attempting to do these inline with ((s->reg[HI] << 16) | s->reg[LO]) can result in an unintended sign extension because "x << 16" is of type 'int' even though s->reg is unsigned, and so if the expression is used in a context where it is cast to uint64_t the value is incorrectly sign-extended. Fix this by using accessor functions with a uint32_t return type; this also makes the code a bit easier to read. This should fix Coverity issues 1307765, 1307766, 1307767, 1307768. (To avoid having a ctda read function only used in a DPRINTF, we move the DPRINTF down slightly so it can use the ttda function.) Reviewed-by: Laurent Vivier <laurent@vivier.eu> Tested-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-01-20m68k: QOMify the MCF Fast Ethernet Controller deviceThomas Huth
When running qemu-system-m68k with the "-net" parameter (for example simply "-net nic -net user"), there is currently a confusing warning message saying: Warning: requested NIC (anonymous, model mcf_fec) was not created (not supported by this machine?) This seems to happen because the MCF NIC has never been adapted to the currently expected QEMU device behavior. Thus let's QOMify the NIC now to get rid of the warning message. Signed-off-by: Thomas Huth <huth@tuxfamily.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-01-19Plumb the HAXM-based hardware acceleration supportVincent Palatin
Use the Intel HAX is kernel-based hardware acceleration module for Windows (similar to KVM on Linux). Based on the "target/i386: Add Intel HAX to android emulator" patch from David Chou <david.j.chou@intel.com> Signed-off-by: Vincent Palatin <vpalatin@chromium.org> Message-Id: <7b9cae28a0c379ab459c7a8545c9a39762bd394f.1484045952.git.vpalatin@chromium.org> [Drop hax_populate_ram stub. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-19kvm: move cpu synchronization codeVincent Palatin
Move the generic cpu_synchronize_ functions to the common hw_accel.h header, in order to prepare for the addition of a second hardware accelerator. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Vincent Palatin <vpalatin@chromium.org> Message-Id: <f5c3cffe8d520011df1c2e5437bb814989b48332.1484045952.git.vpalatin@chromium.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-19virtio: force VIRTIO_F_IOMMU_PLATFORMJason Wang
We allow vhost to clear VIRITO_F_IOMMU_PLATFORM which is wrong since VIRTIO_F_IOMMU_PLATFORM is mandatory for security. Fixing this by enforce it after vdc->get_features(). Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-19virtio: fix up max size checksMichael S. Tsirkin
Coverity reports that ARRAY_SIZE(elem->out_sg) (and all the others too) is wrong because elem->out_sg is a pointer. However, the check is not in the right place and the max_size argument of virtqueue_map_iovec can be removed. The check on in_num/out_num should be moved to qemu_get_virtqueue_element instead, before the call to virtqueue_alloc_element. Cc: qemu-stable@nongnu.org Reported-by: Paolo Bonzini <pbonzini@redhat.com> Fixes: 3724650db07057333879484c8bc7d900b5c1bf8e ("virtio: introduce virtqueue_alloc_element") Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-01-18target-sparc: fix up niagara machineArtyom Tarasenko
Remove the Niagara stub implementation from sun4u.c and add a machine, compatible with Legion simulator from the OpenSPARC T1 project. The machine uses the firmware supplied with the OpenSPARC T1 project, http://download.oracle.com/technetwork/systems/opensparc/OpenSPARCT1_Arch.1.5.tar.bz2 in the directory S10image/, and is able to boot the supplied Solaris 10 image. Note that for compatibility with the naming conventions for SPARC machines the new machine name is lowercase niagara. Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-01-18target-sparc: move common cpu initialisation routines to sparc64.cArtyom Tarasenko
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-01-18target-sparc: implement sun4v RTCArtyom Tarasenko
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
2017-01-18virtio-mmio: switch to linux headersMichael S. Tsirkin
Switch to virtio_mmio.h from Linux - will make it easier to implement virtio 1. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-18virtio: drop an obsolete commentMichael S. Tsirkin
virtio core has code to revert queue number to maximum on reset. Drop TODO to add that. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-01-18fw-cfg: bump "x-file-slots" to 0x20 for 2.9+ machine typesLaszlo Ersek
More precisely, the "x-file-slots" count is bumped for all machine types that: (a) use fw_cfg, and (b) are not versioned (hence migration is not expected to work for them across QEMU releases anyway), or have version 2.9. This affects machine types implemented in the following source files: - "hw/arm/virt.c". The "virt-*" machine type is versioned, and the <= 2.8 versions already depend on HW_COMPAT_2_8 (see commit e353aac51b944). Therefore adding the "x-file-slots" compat values to HW_COMPAT_2_8 suffices. - "hw/i386/pc.c". The "pc-i440fx-*" (including "pc-*") and "pc-q35-*" machine types are versioned. Modifying HW_COMPAT_2_8 is sufficient here too (see commit "pc: Add 2.9 machine-types"). The "isapc" machtype is not versioned. The "xenfv" machine type, which uses fw_cfg for direct kernel booting, is also not versioned. - "hw/ppc/mac_newworld.c". The "mac99" machine type is not versioned. - "hw/ppc/mac_oldworld.c". The "g3beige" machine type is not versioned. - "hw/sparc/sun4m.c". None of the 9 machine types defined in this file appear versioned. - "hw/sparc64/sun4u.c". None of the 3 machine types defined in this file appear versioned. Cc: "Gabriel L. Somlo" <somlo@cmu.edu> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Alexander Graf <agraf@suse.de> Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Artyom Tarasenko <atar4qemu@gmail.com> Cc: David Gibson <david@gibson.dropbear.id.au> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Acked-by: Gabriel Somlo <somlo@cmu.edu> Tested-by: Gabriel Somlo <somlo@cmu.edu> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
2017-01-18pc: Add 2.9 machine-typesEduardo Habkost
Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Gabriel Somlo <somlo@cmu.edu> Tested-by: Gabriel Somlo <somlo@cmu.edu> Cc: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
2017-01-18fw-cfg: turn FW_CFG_FILE_SLOTS into a device propertyLaszlo Ersek
We'd like to raise the value of FW_CFG_FILE_SLOTS. Doing it naively could lead to problems with backward migration: a more recent QEMU (running an older machine type) would allow the guest, in fw_cfg_select(), to select a high key value that is unavailable in the same machine type implemented by the older (target) QEMU. On the target host, fw_cfg_data_read() for example could dereference nonexistent entries. As first step, size the FWCfgState.entries[*] and FWCfgState.entry_order arrays dynamically. All three array sizes will be influenced by the new field FWCfgState.file_slots (and matching device property). Make the following changes: - Replace the FW_CFG_FILE_SLOTS macro with FW_CFG_FILE_SLOTS_MIN (minimum count of fw_cfg file slots) in the header file. The value remains 0x10. - Replace all uses of FW_CFG_FILE_SLOTS with a helper function called fw_cfg_file_slots(), returning the new property. - Eliminate the macro FW_CFG_MAX_ENTRY, and replace all its uses with a helper function called fw_cfg_max_entry(). - In the MMIO- and IO-mapped realize functions both, allocate all three arrays dynamically, based on the new property. - The new property defaults to FW_CFG_FILE_SLOTS_MIN. This is going to be customized in the following patches. Cc: "Gabriel L. Somlo" <somlo@cmu.edu> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Acked-by: Gabriel Somlo <somlo@cmu.edu> Tested-by: Gabriel Somlo <somlo@cmu.edu> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
2017-01-18fw-cfg: support writeable blobsMichael S. Tsirkin
Useful to send guest data back to QEMU. Changes from Laszlo Ersek <lersek@redhat.com>: - rebase the patch from Michael Tsirkin's original postings at [1] and [2] to the following patches: - loader: Allow a custom AddressSpace when loading ROMs - loader: Add AddressSpace loading support to uImages - loader: fix handling of custom address spaces when adding ROM blobs - reject such writes immediately that would exceed the end of the array, rather than performing a partial write before setting the error bit: see the (len != dma.length) condition - document the write interface [1] http://lists.nongnu.org/archive/html/qemu-devel/2016-02/msg04968.html [2] http://lists.nongnu.org/archive/html/qemu-devel/2016-03/msg02735.html Cc: "Gabriel L. Somlo" <somlo@cmu.edu> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Michael Walle <michael@walle.cc> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Shannon Zhao <zhaoshenglong@huawei.com> Cc: qemu-arm@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Acked-by: Gabriel Somlo <somlo@cmu.edu> Tested-by: Gabriel Somlo <somlo@cmu.edu> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
2017-01-18vhost_net: device IOTLB supportJason Wang
This patches implements Device IOTLB support for vhost kernel. This is done through: 1) switch to use dma helpers when map/unmap vrings from vhost codes 2) introduce a set of VhostOps to: - setting up device IOTLB request callback - processing device IOTLB request - processing device IOTLB invalidation 2) kernel support for Device IOTLB API: - allow vhost-net to query the IOMMU IOTLB entry through eventfd - enable the ability for qemu to update a specified mapping of vhost - through ioctl. - enable the ability to invalidate a specified range of iova for the device IOTLB of vhost through ioctl. In x86/intel_iommu case this is triggered through iommu memory region notifier from device IOTLB invalidation descriptor processing routine. With all the above, kernel vhost_net can co-operate with userspace IOMMU. For vhost-user, the support could be easily done on top by implementing the VhostOps. Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-18virtio: disable notifications again after poll succeededStefan Hajnoczi
While AioContext is in polling mode virtqueue notifications are not necessary. Some device virtqueue handlers enable notifications. Make sure they stay disabled to avoid unnecessary vmexits. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Richard Henderson <rth@twiddle.net> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-18Revert "virtio: turn vq->notification into a nested counter"Stefan Hajnoczi
This reverts commit aff8fd18f1786fc5af259a9bc0077727222f51ca. Both virtio-net and virtio-crypto do not balance virtio_queue_set_notification() enable and disable calls. This makes the notifications_disabled counter unreliable and Doug Goldstein reported the following assertion failure: #3 0x00007ffff44d1c62 in __GI___assert_fail ( assertion=assertion@entry=0x555555ae8e8a "vq->notification_disabled > 0", file=file@entry=0x555555ae89c0 "/home/doug/work/qemu/hw/virtio/virtio.c", line=line@entry=215, function=function@entry=0x555555ae9630 <__PRETTY_FUNCTION__.43707> "virtio_queue_set_notification") at assert.c:101 #4 0x00005555557f25d6 in virtio_queue_set_notification (vq=0x55555666aa90, enable=enable@entry=1) at /home/doug/work/qemu/hw/virtio/virtio.c:215 #5 0x00005555557dc311 in virtio_net_has_buffers (q=<optimized out>, q=<optimized out>, bufsize=102) at /home/doug/work/qemu/hw/net/virtio-net.c:1008 #6 virtio_net_receive (nc=<optimized out>, buf=0x555557386b88 "", size=102) at /home/doug/work/qemu/hw/net/virtio-net.c:1148 #7 0x00005555559cad33 in nc_sendv_compat (flags=<optimized out>, iovcnt=1, iov=0x7fffead746d0, nc=0x55555788b340) at net/net.c:705 #8 qemu_deliver_packet_iov (sender=<optimized out>, flags=<optimized out>, iov=0x7fffead746d0, iovcnt=1, opaque=0x55555788b340) at net/net.c:732 #9 0x00005555559cd929 in qemu_net_queue_deliver (size=<optimized out>, data=<optimized out>, flags=<optimized out>, sender=<optimized out>, queue=0x55555788b550) at net/queue.c:164 #10 qemu_net_queue_flush (queue=0x55555788b550) at net/queue.c:261 This patch is safe to revert since it's just an optimization for virtqueue polling. The next patch will improve the situation again without resorting to nesting. Reported-by: Doug Goldstein <cardoe@cardoe.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Richard Henderson <rth@twiddle.net> Tested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-18virtio-net: enable ioeventfd even if vhost=offPaolo Bonzini
virtio-net-pci does not enable ioeventfd for historical reasons (and nobody ever checked whether it should be revisited). Note that other backends do enable ioeventfd for virtio-net. However, it has a major effect on performance. On Windows, throughput is _multiplied_ by 2 or 3 on TCP_STREAM (on small packets it is "only" a 30% improvement) and a little less so on TCP_MAERTS albeit still very much statistically significant. Latency also has a single digit improvement. This is not visible when using vhost, which forces ioeventfd=on, but it is substantial without vhost. In addition, also on Windows and with the RHEL 7.3 kernel, APICv seems to slow down virtio-net performance a bit, but the penalty with this patch goes from -25% to -7%. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-16x86: ioapic: fix fail migration when irqchip=splitPeter Xu
Split irqchip works based on the fact that we kept the first 24 gsi routing entries inside KVM for userspace ioapic's use. When system boot, we'll reserve these MSI routing entries before hand. However, after migration, we forgot to re-configure it up in the destination side. The result is, we'll get invalid gsi routing entries after migration (all empty), and we get interrupts with vector=0, then strange things happen, like keyboard hang. The solution is simple - we update them after migration, which is a one line fix. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1483952153-7221-4-git-send-email-peterx@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16x86: ioapic: dump version for "info ioapic"Peter Xu
Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1483952153-7221-3-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16x86: ioapic: add traces for ioapicPeter Xu
From time to time, there are issues with ioapic, either on guest side or on hypervisor side. Good to have some persistent traces for better triaging and debugging. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1483952153-7221-2-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16serial: fix memory leak in serial exitLi Qiang
The serial_exit_core function doesn't free some resources. This can lead memory leak when hotplug and unplug. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-Id: <586cb5ab.f31d9d0a.38ac3.acf2@mx.google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16scsi-block: fix direction of BYTCHK test for VERIFY commandsPaolo Bonzini
The direction is wrong; scsi_block_is_passthrough returns false for commands that *can* use sglists. Reported-by: Zhang Qian <zhangqian@sangfor.com.cn> Fixes: 8fdc7839e40f43a426bc7e858cf1dbfe315a3804 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16pc: fix crash in rtc_set_memory() if initial cpu is marked as hotpluggedIgor Mammedov
'hotplugged' propperty is meant to be used on migration side when migrating source with hotplugged devices. However though it not exacly correct usage of 'hotplugged' property it's possible to set generic hotplugged property for CPU using -cpu foo,hotplugged=on or -global foo.hotplugged=on in this case qemu crashes with following backtrace: ... because pc_cpu_plug() assumes that hotplugged CPU could appear only after rtc/fw_cfg are initialized. Fix crash by replacing assumption with explicit checks of rtc/fw_cfg and updating them only if they were initialized. Cc: qemu-stable@nongnu.org Reported-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <1483108391-199542-1-git-send-email-imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16acpi: filter based on CONFIG_ACPI_X86 rather than TARGETPaolo Bonzini
Copy the mechanism of hw/smbios/smbios-stub.c to implement an ACPI-stub instead, so that -acpitable can be later extended to ARM. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16event_notifier: cleanups around event_notifier_set_handlerPaolo Bonzini
Remove the useless is_external argument. Since the iohandler AioContext is never used for block devices, aio_disable_external is never called on it. This lets us remove stubs/iohandler.c. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16stubs: move vhost stubs to stubs/vhost.oPaolo Bonzini
No need to include them in libqemustub.a, since only system emulators need them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16hw: move reset handlers from vl.c to hw/corePaolo Bonzini
They are small, it is not worth stubbing them. Just include them in user-mode emulators and unit tests as well. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16stubs: move acpi stubs to hw/acpiPaolo Bonzini
No need to include them in libqemustub.a, since only system emulators need them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16stubs: move smbios stubs to hw/smbiosPaolo Bonzini
No need to include them in libqemustub.a, since only system emulators need them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16smbios: filter based on CONFIG_SMBIOS rather than TARGETLeif Lindholm
-smbios command line options were accepted but silently ignored on TARGET_ARM, due to a test for TARGET_I386 in arch_init.c. Copy the mechanism of hw/pci/pci-stub.c to implement an smbios-stub instead, enabled for all targets without CONFIG_SMBIOS. Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org> Message-Id: <20161222151828.28292-1-leif.lindholm@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16megasas: fix guest-triggered memory leakPaolo Bonzini
If the guest sets the sglist size to a value >=2GB, megasas_handle_dcmd will return MFI_STAT_MEMORY_NOT_AVAILABLE without freeing the memory. Avoid this by returning only the status from map_dcmd, and loading cmd->iov_size in the caller. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16bugfix: vm halt when in reset loopinghangaohuai
reset mc146818rtc device when RESET event happens. Fix the problem: 1. Guest boot the second cpu, set CMOS_RESET_CODE 0x0a to protect selfboot; 2. VM being reset by others, hmp_system_reset; 3. seabios resume check the CMOS_RESET_CODE, if 0x0a, jump to the BDA resume execution by jump via 40h:0067h; 4. Guest halt; Signed-off-by: hangaohuai <hangaohuai@huawei.com> Message-Id: <20161219060336.10176-1-hangaohuai@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-15target/xtensa: refactor CCOUNT/CCOMPAREMax Filippov
Xtensa cores may have a register (CCOUNT) that counts core clock cycles. It may also have a number of registers (CCOMPAREx); when CCOUNT value passes the value of CCOMPAREx, timer interrupt x is raised. Currently xtensa target counts a number of completed instructions and assumes that for CCOUNT one instruction takes one cycle to complete. It calls helper function to update CCOUNT register at every TB end and raise timer interrupts. This scheme works very predictably and doesn't have noticeable performance impact, but it is hard to use with multiple synchronized processors, especially with coming MTTCG. Derive CCOUNT from the virtual simulation time, QEMU_CLOCK_VIRTUAL. Use native QEMU timers for CCOMPARE timers, one timer for each register. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2017-01-13cputlb: drop flush_global flag from tlb_flushAlex Bennée
We have never has the concept of global TLB entries which would avoid the flush so we never actually use this flag. Drop it and make clear that tlb_flush is the sledge-hammer it has always been. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> [DG: ppc portions] Acked-by: David Gibson <david@gibson.dropbear.id.au>
2017-01-12Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170111-1' into ↵Peter Maydell
staging vga: fixes for virtio-gpu and cirrus. # gpg: Signature made Wed 11 Jan 2017 10:24:24 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-vga-20170111-1: virtio-gpu: tag as not hotpluggable virtio-gpu: Fix memory leak in virtio_gpu_load() virtio-gpu: Recalculate VirtIOGPU::hostmem on VM load display: cirrus: ignore source pitch value as needed in blit_is_unsafe virtio-gpu: fix information leak in capset get dispatch Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-11virtio-gpu: tag as not hotpluggableGerd Hoffmann
qemu can't hotplug display devices. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1483970138-20360-1-git-send-email-kraxel@redhat.com
2017-01-11virtio-gpu: Fix memory leak in virtio_gpu_load()Peter Maydell
Coverity points out that if we fail in the "creating resources" loop in virtio_gpu_load() we will leak various resources (CID 1356431). Failing a VM load is going to leave the simulation in a complete mess, but we can tidy up to the point that a full system reset should get us back to sanity. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1483969123-14839-3-git-send-email-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11virtio-gpu: Recalculate VirtIOGPU::hostmem on VM loadPeter Maydell
The 'hostmem' field in VirtIOGPU is used to track the total memory used in pixmaps so that we can impose a maximum limit on it. However this field is neither migrated nor recalculated on VM load, which means that after a migration it will be incorrectly too low, which can allow the guest to use more pixmap memory than it should. The per-resource hostmem fields are not filled in either as we reallocate them in the load function. Recalculate the memory used for each pixmap and the total memory used as we reallocate the pixmaps in virtio_gpu_load(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1483969123-14839-2-git-send-email-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11display: cirrus: ignore source pitch value as needed in blit_is_unsafeBruce Rogers
Commit 4299b90 added a check which is too broad, given that the source pitch value is not required to be initialized for solid fill operations. This patch refines the blit_is_unsafe() check to ignore source pitch in that case. After applying the above commit as a security patch, we noticed the SLES 11 SP4 guest gui failed to initialize properly. Signed-off-by: Bruce Rogers <brogers@suse.com> Message-id: 20170109203520.5619-1-brogers@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11virtio-gpu: fix information leak in capset get dispatchLi Qiang
In virgl_cmd_get_capset function, it uses g_malloc to allocate a response struct to the guest. As the 'resp'struct hasn't been full initialized it will lead the 'resp->padding' field to the guest. Use g_malloc0 to avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 58188cae.4a6ec20a.3d2d1.aff2@mx.google.com [ kraxel: resolved conflict ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11es1370: wire up reset via DeviceClassGerd Hoffmann
Instead of using qemu_register_reset(). That way we get proper cleanup for free. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1484054281-26139-1-git-send-email-kraxel@redhat.com
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 01:42:15 +0000