aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2017-06-02vhost: propagate errors in vhost_device_iotlb_miss()Maxime Coquelin1-5/+10
Some backends might want to know when things went wrong. Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-02virtio-serial: fix segfault on disconnectStefan Hajnoczi1-0/+3
Since commit d4c19cdeeb2f1e474bc426a6da261f1d7346eb5b ("virtio-serial: add missing virtio_detach_element() call") the following commands may cause QEMU to segfault: $ qemu -M accel=kvm -cpu host -m 1G \ -drive if=virtio,file=test.img,format=raw \ -device virtio-serial-pci,id=virtio-serial0 \ -chardev socket,id=channel1,path=/tmp/chardev.sock,server,nowait \ -device virtserialport,chardev=channel1,bus=virtio-serial0.0,id=port1 $ nc -U /tmp/chardev.sock ^C (guest)$ cat /dev/zero >/dev/vport0p1 The segfault is non-deterministic: if the event loop notices the socket has been closed then there is no crash. The disconnect has to happen right before QEMU attempts to write data to the socket. The backtrace is as follows: Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x00005555557e0698 in do_flush_queued_data (port=0x5555582cedf0, vq=0x7fffcc854290, vdev=0x55555807b1d0) at hw/char/virtio-serial-bus.c:180 180 for (i = port->iov_idx; i < port->elem->out_num; i++) { #1 0x000055555580d363 in virtio_queue_notify_vq (vq=0x7fffcc854290) at hw/virtio/virtio.c:1524 #2 0x000055555580d363 in virtio_queue_host_notifier_read (n=0x7fffcc8542f8) at hw/virtio/virtio.c:2430 #3 0x0000555555b3482c in aio_dispatch_handlers (ctx=ctx@entry=0x5555566b8c80) at util/aio-posix.c:399 #4 0x0000555555b350d8 in aio_dispatch (ctx=0x5555566b8c80) at util/aio-posix.c:430 #5 0x0000555555b3212e in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:261 #6 0x00007fffde71de52 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0 #7 0x0000555555b34353 in glib_pollfds_poll () at util/main-loop.c:213 #8 0x0000555555b34353 in os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:261 #9 0x0000555555b34353 in main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:517 #10 0x0000555555773207 in main_loop () at vl.c:1917 #11 0x0000555555773207 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4751 The do_flush_queued_data() function does not anticipate chardev close events during vsc->have_data(). It expects port->elem to remain non-NULL for the duration its for loop. The fix is simply to return from do_flush_queued_data() if the port closes because the close event already frees port->elem and drains the virtqueue - there is nothing left for do_flush_queued_data() to do. Reported-by: Sitong Liu <siliu@redhat.com> Reported-by: Min Deng <mdeng@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-02virtio: add virtqueue_alloc_element tracepointPaolo Bonzini2-0/+2
This tracepoint can help diagnosing failures due to memory fragmentation in the guest. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-02virtio-serial-bus: Unset hotplug handler when unrealizeLadi Prosek1-0/+3
Virtio serial device controls the lifetime of virtio-serial-bus and virtio-serial-bus links back to the device via its hotplug-handler property. This extra ref-count prevents the device from getting finalized, leaving the VirtIODevice memory listener registered and leading to use-after-free later on. This patch addresses the same issue as Fam Zheng's "virtio-scsi: Unset hotplug handler when unrealize" only for a different virtio device. Cc: qemu-stable@nongnu.org Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com>
2017-06-02Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170601' ↵Peter Maydell5-4/+1
into staging migration/next for 20170601 # gpg: Signature made Thu 01 Jun 2017 17:51:04 BST # gpg: using RSA key 0xF487EF185872D723 # gpg: Good signature from "Juan Quintela <quintela@redhat.com>" # gpg: aka "Juan Quintela <quintela@trasno.org>" # Primary key fingerprint: 1899 FF8E DEBF 58CC EE03 4B82 F487 EF18 5872 D723 * remotes/juanquintela/tags/migration/20170601: migration: Move include/migration/block.h into migration/ migration: Export ram.c functions in its own file migration: Create include for migration snapshots migration: Export rdma.c functions in its own file migration: Export tls.c functions in its own file migration: Export socket.c functions in its own file migration: Export fd.c functions in its own file migration: Export exec.c functions in its own file migration: Split qemu-file.h migration: Remove unneeded includes of migration/vmstate.h migration: shut src return path unconditionally migration: fix leak of src file on dst migration: Remove section_id parameter from vmstate_load migration: loadvm handlers are not used migration: Use savevm_handlers instead of loadvm copy Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02hw/arm/virt: fdt: generate distance-map when neededAndrew Jones1-0/+21
This is based on patch Shannon Zhao originally posted. Cc: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 20170529173751.3443-3-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02hw/arm/virt-acpi-build: build SLIT when neededAndrew Jones1-0/+4
Cc: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 20170529173751.3443-2-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02aspeed: add some I2C devices to the Aspeed machinesCédric Le Goater1-0/+27
Let's add an RTC to the palmetto BMC and a LM75 temperature sensor to the AST2500 EVB to start with. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1494827476-1487-5-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02aspeed/i2c: introduce a state machineCédric Le Goater1-3/+33
The Aspeed I2C controller maintains a state machine in the command register, which is mostly used for debug. Let's start adding a few states to handle abnormal STOP commands. Today, the model uses the busy status of the bus as a condition to do so but it is not precise enough. Also remove the ABNORMAL bit for failing TX commands. This is incorrect with respect to the specs. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1494827476-1487-4-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02aspeed/i2c: handle LAST command under the RX commandCédric Le Goater1-3/+6
Today, the LAST command is handled with the STOP command but this is incorrect. Also nack the I2C bus when a LAST is issued. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1494827476-1487-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02aspeed/i2c: improve command handlingCédric Le Goater1-6/+18
Multiple I2C commands can be fired simultaneously and the controller execute the commands following these priorities: (1) Master Start Command (2) Master Transmit Command (3) Slave Transmit Command or Master Receive Command (4) Master Stop Command The current code is incorrect with respect to the above sequence and needs to be reworked to handle each individual command. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1494827476-1487-2-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02arm: add MPU support to M profile CPUsMichael Davidsaver1-0/+104
The M series MPU is almost the same as the already implemented R profile MPU (v7 PMSA). So all we need to implement here is the MPU register interface in the system register space. This implementation has the same restriction as the R profile MPU that it doesn't permit regions to be sized down smaller than 1K. We also do not yet implement support for MPU_CTRL.HFNMIENA; this bit should if zero disable use of the MPU when running HardFault, NMI or with FAULTMASK set to 1 (ie at an execution priority of less than zero) -- if the MPU is enabled we don't treat these cases any differently. Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> Message-id: 1493122030-32191-13-git-send-email-peter.maydell@linaro.org [PMM: Keep all the bits in mpu_ctrl field, rather than using SCTLR bits for them; drop broken HFNMIENA support; various cleanup] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-02hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1Peter Maydell1-4/+38
When we calculate the mask to use to get the group priority from an interrupt priority, the way that NS BPR1 is handled differs from how BPR0 and S BPR1 work -- a BPR1 value of 1 means the group priority is in bits [7:1], whereas for BPR0 and S BPR1 this is indicated by a 0 BPR value. Subtract 1 from the BPR value before creating the mask if we're using the NS BPR value, for both hardware and virtual interrupts, as the GICv3 pseudocode does, and fix the comments accordingly. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1493226792-3237-4-git-send-email-peter.maydell@linaro.org
2017-06-02hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimumPeter Maydell1-0/+6
icc_bpr_write() was not enforcing that writing a value below the minimum for the BPR should behave as if the BPR was set to the minimum value. This doesn't make a difference for the secure BPRs (since we define the minimum for the QEMU implementation as zero) but did mean we were allowing the NS BPR1 to be set to 0 when 1 should be the lowest value. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1493226792-3237-3-git-send-email-peter.maydell@linaro.org
2017-06-02hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1Peter Maydell1-1/+1
We were setting the VBPR1 field of VMCR_EL2 to icv_min_vbpr() on reset, but this is not correct. The field should reset to the minimum value of ICV_BPR0_EL1 plus one. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1493226792-3237-2-git-send-email-peter.maydell@linaro.org
2017-06-02load_uboot_image: don't assume a full header readAndrew Jones1-1/+2
Don't allow load_uboot_image() to proceed when less bytes than header-size was read. Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 20170524091315.20284-1-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-06-01migration: Split qemu-file.hJuan Quintela4-3/+1
Split the file into public and internal interfaces. I have to rename the external one because we can't have two include files with the same name in the same directory. Build system gets confused. The only exported functions are the ones that handle basic types. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-06-01migration: Remove unneeded includes of migration/vmstate.hJuan Quintela1-1/+0
Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-06-01Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell8-139/+164
Various bugfixes and code cleanups. Most notably, it fixes metadata handling in mapped-file security mode (especially for the virtfs root). # gpg: Signature made Tue 30 May 2017 14:36:22 BST # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9pfs: local: metadata file for the VirtFS root 9pfs: local: simplify file opening 9pfs: local: resolve special directories in paths 9pfs: check return value of v9fs_co_name_to_path() util: drop old utimensat() compat code 9pfs: assume utimensat() and futimens() are present fsdev: fix virtfs-proxy-helper cwd 9pfs: local: fix unlink of alien files in mapped-file mode 9pfs: drop pdu_push_and_notify() fsdev: don't allow unknown format in marshal/unmarshal virtio-9p/xen-9p: move 9p specific bits to core 9p code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-05-30Merge remote-tracking branch 'kwolf/tags/for-upstream' into stagingStefan Hajnoczi2-4/+144
Block layer patches # gpg: Signature made Mon 29 May 2017 03:34:59 PM BST # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * kwolf/tags/for-upstream: block/file-*: *_parse_filename() and colons block: Fix backing paths for filenames with colons block: Tweak error message related to qemu-img amend qemu-img: Fix leakage of options on error qemu-img: copy *key-secret opts when opening newly created files qemu-img: introduce --target-image-opts for 'convert' command qemu-img: fix --image-opts usage with dd command qemu-img: add support for --object with 'dd' command qemu-img: Fix documentation of convert qcow2: remove extra local_error variable mirror: Drop permissions on s->target on completion nvme: Add support for Controller Memory Buffers iotests: 147: Don't test inet6 if not available qemu-iotests: Test streaming with missing job ID stream: fix crash in stream_start() when block_job_create() fails Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-30Merge remote-tracking branch 'kraxel/tags/pull-usb-20170529-1' into stagingStefan Hajnoczi8-257/+330
usb: depricate legacy options and hmp commands usb: fixes for ehci and hub, split xhci variants # gpg: Signature made Mon 29 May 2017 02:07:17 PM BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * kraxel/tags/pull-usb-20170529-1: ehci: fix frame timer invocation. usb: don't wakeup during coldplug usb-hub: set PORT_STAT_C_SUSPEND on host-initiated wake-up xhci: add CONFIG_USB_XHCI_NEC option xhci: split into multiple files usb: Simplify the parameter parsing of the legacy usb serial device usb: Deprecate HMP commands usb_add and usb_del usb: Deprecate the legacy -usbdevice option ehci: fix overflow in frame timer code Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-30Merge remote-tracking branch 'mst/tags/for_upstream' into stagingStefan Hajnoczi15-144/+274
pci, virtio, vhost: fixes A bunch of fixes all over the place. Most notably this fixes the new MTU feature when using vhost. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 29 May 2017 01:10:24 AM BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * mst/tags/for_upstream: acpi-test: update expected files pc: ACPI BIOS: use highest NUMA node for hotplug mem hole SRAT entry vhost-user: pass message as a pointer to process_message_reply() virtio_net: Bypass backends for MTU feature negotiation intel_iommu: turn off pt before 2.9 intel_iommu: support passthrough (PT) intel_iommu: allow dev-iotlb context entry conditionally intel_iommu: use IOMMU_ACCESS_FLAG() intel_iommu: provide vtd_ce_get_type() intel_iommu: renaming context entry helpers x86-iommu: use DeviceClass properties memory: remove the last param in memory_region_iommu_replay() memory: tune last param of iommu_ops.translate() Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-30Merge remote-tracking branch 'dgibson/tags/ppc-for-2.10-20170525' into stagingStefan Hajnoczi9-172/+330
ppc patch queue 2017-05-25 Assorted accumulated patches. These are nearly all bugfixes at one level or another - some for longstanding problems, others for some regressions caused by more recent cleanups. This includes preliminary patches towards fixing migration for Radix Page Table guests under POWER9 and also fixing some migration regressions due to the re-organization of the interrupt controller code. Not all the pieces are there yet, so those still won't quite work, but the preliminary changes make sense on their own. # gpg: Signature made Thu 25 May 2017 04:50:00 AM BST # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * dgibson/tags/ppc-for-2.10-20170525: xics: add unrealize handler hw/ppc/spapr.c: recover pending LMB unplug info in spapr_lmb_release hw/ppc: migrating the DRC state of hotplugged devices hw/ppc: removing drc->detach_cb and drc->detach_cb_opaque hw/ppc/spapr.c: adding pending_dimm_unplugs to sPAPRMachineState spapr: add pre_plug function for memory pseries: Restore support for total vcpus not a multiple of threads-per-core for old machine types pseries: Split CAS PVR negotiation out into a separate function spapr: fix error reporting in xics_system_init() spapr_cpu_core: drop reference on ICP object during CPU realization hw/ppc/spapr_events.c: removing 'exception' from sPAPREventLogEntry spapr: ensure core_slot isn't NULL in spapr_core_unplug() xics_kvm: cache already enabled vCPU ids spapr: Consolidate HPT freeing code into a routine spapr-cpu-core: release ICP object when realization fails spapr: sanitize error handling in spapr_ics_create() ppc/xics: simplify prototype of xics_spapr_init() target/ppc: reset reservation in do_rfi() Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-30Merge remote-tracking branch 'armbru/tags/pull-qapi-2017-05-23' into stagingStefan Hajnoczi40-59/+64
QAPI patches for 2017-05-23 # gpg: Signature made Tue 23 May 2017 12:33:32 PM BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * armbru/tags/pull-qapi-2017-05-23: qapi-schema: Remove obsolete note from ObjectTypeInfo block: Use QDict helpers for --force-share shutdown: Expose bool cause in SHUTDOWN and RESET events shutdown: Add source information to SHUTDOWN and RESET shutdown: Preserve shutdown cause through replay shutdown: Prepare for use of an enum in reset/shutdown_request shutdown: Simplify shutdown_signal sockets: Plug memory leak in socket_address_flatten() scripts/qmp/qom-set: fix the value argument passed to srv.command() Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-30Merge remote-tracking branch 'ehabkost/tags/numa-pull-request' into stagingStefan Hajnoczi1-1/+2
Silence "make check" warnings on NUMA test # gpg: Signature made Tue 23 May 2017 11:44:24 AM BST # gpg: using RSA key 0x2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * ehabkost/tags/numa-pull-request: numa: Silence incomplete mapping warning under qtest Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-05-29ehci: fix frame timer invocation.Gerd Hoffmann1-3/+10
ehci registers ehci_frame_timer as both timer and bottom half, which turned out to be a bad idea as it can be called as bottom half then while it is running as timer, and it isn't prepared to handle recursive calls. Change the timer func to just schedule the bottom half to avoid this. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1449609 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170519120428.25981-1-kraxel@redhat.com
2017-05-29usb: don't wakeup during coldplugGerd Hoffmann1-0/+8
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1452512 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170523084635.20062-1-kraxel@redhat.com
2017-05-29usb-hub: set PORT_STAT_C_SUSPEND on host-initiated wake-upLadi Prosek1-1/+14
PORT_STAT_C_SUSPEND should be set even on host-initiated wake-up, i.e. on ClearPortFeature(PORT_SUSPEND). Windows is known to not work properly otherwise. Side note, since PORT_ENABLE looks similar and might appear to have the same issue: According to 11.24.2.7.2.2 C_PORT_ENABLE: "This bit is set when the PORT_ENABLE bit changes from one to zero as a result of a Port Error condition (see Section 11.8.1). This bit is not set on any other changes to PORT_ENABLE." Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 20170522123325.2199-1-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-05-29xhci: add CONFIG_USB_XHCI_NEC optionGerd Hoffmann1-1/+1
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1451189 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170517103313.8459-2-kraxel@redhat.com
2017-05-29xhci: split into multiple filesGerd Hoffmann4-236/+292
Moved structs and defines to hcd-xhci.h. Move nec controller variant to hcd-xhci-nec.c. No functional changes. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170517103313.8459-1-kraxel@redhat.com
2017-05-29usb: Simplify the parameter parsing of the legacy usb serial deviceThomas Huth1-16/+5
Coverity complains about the current code, so let's get rid of the now unneeded while loop and simply always emit "unrecognized serial USB option" for all unsupported options. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1495177204-16808-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-05-29ehci: fix overflow in frame timer codeGerd Hoffmann1-1/+1
In case the frame timer doesn't run for a while due to the host being busy skipped_uframes can become big enough that UFRAME_TIMER_NS * skipped_uframes overflows. Which in turn throws off all subsequent ehci frame timer calculations. Reported-by: 李林 <8610_28@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170515104543.32044-1-kraxel@redhat.com
2017-05-29pc: ACPI BIOS: use highest NUMA node for hotplug mem hole SRAT entryLadi Prosek1-2/+5
For reasons unknown, Windows won't online all memory, both at command line and hot-plugged later, unless the hotplug mem hole SRAT entry specifies a node greater than or equal to the ones where memory is added. Using the highest node on the machine makes recent versions of Windows happy. With this example command line: ... \ -m 1024,slots=4,maxmem=32G \ -numa node,nodeid=0 \ -numa node,nodeid=1 \ -numa node,nodeid=2 \ -numa node,nodeid=3 \ -object memory-backend-ram,size=1G,id=mem-mem1 \ -device pc-dimm,id=dimm-mem1,memdev=mem-mem1,node=1 Windows reports a total of 1G of RAM without this commit and the expected 2G with this commit. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2017-05-26nvme: Add support for Controller Memory BuffersStephen Bates2-4/+144
Implement NVMe Controller Memory Buffers (CMBs) which were added in version 1.2 of the NVMe Specification. This patch adds an optional argument (cmb_size_mb) which indicates the size of the CMB (in MB). Currently only the Submission Queue Support (SQS) is enabled which aligns with the current Linux driver for NVMe. Signed-off-by: Stephen Bates <sbates@raithlin.com> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-05-25vhost-user: pass message as a pointer to process_message_reply()Maxime Coquelin1-6/+6
process_message_reply() was recently updated to get full message content instead of only its request field. There is no need to copy all the struct content into the stack, so just pass its pointer as const. Reviewed-by: Jens Freimann <jfreiman@redhat.com> Reviewed-by: Zhiyong Yang <zhiyong.yang@intel.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2017-05-25virtio_net: Bypass backends for MTU feature negotiationMaxime Coquelin1-1/+16
This patch adds a new internal "x-mtu-bypass-backend" property to bypass backends for MTU feature negotiation. When this property is set, the MTU feature is negotiated as soon as supported by the guest and a MTU value is set via the host_mtu parameter. In case the backend advertises the feature (e.g. DPDK's vhost-user backend), the feature negotiation is propagated down to the backend. When this property is not set, the backend has to support the MTU feature for its negotiation to succeed. For compatibility purpose, this property is disabled for machine types v2.9 and older. Cc: Aaron Conole <aconole@redhat.com> Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Reviewed-by: Vlad Yasevich <vyasevic@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-05-25intel_iommu: support passthrough (PT)Peter Xu4-59/+176
Hardware support for VT-d device passthrough. Although current Linux can live with iommu=pt even without this, but this is faster than when using software passthrough. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Liu, Yi L <yi.l.liu@linux.intel.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-25intel_iommu: allow dev-iotlb context entry conditionallyPeter Xu1-13/+36
When device-iotlb is not specified, we should fail this check. A new function vtd_ce_type_check() is introduced. While I'm at it, clean up the vtd_dev_to_context_entry() a bit - replace many "else if" usage into direct if check. That'll make the logic more clear. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-25intel_iommu: use IOMMU_ACCESS_FLAG()Peter Xu1-1/+1
We have that now, so why not use it. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-25intel_iommu: provide vtd_ce_get_type()Peter Xu1-1/+6
Helper to fetch VT-d context entry type. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-25intel_iommu: renaming context entry helpersPeter Xu1-12/+12
The old names are too long and less ordered. Let's start to use vtd_ce_*() as a pattern. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-25x86-iommu: use DeviceClass propertiesPeter Xu1-40/+7
No reason to keep tens of lines if we can do it actually far shorter. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-25memory: remove the last param in memory_region_iommu_replay()Peter Xu1-1/+1
We were always passing in that one as "false" to assume that's an read operation, and we also assume that IOMMU translation would always have that read permission. A better permission would be IOMMU_NONE since the replay is after all not a real read operation, but just a page table rebuilding process. CC: David Gibson <david@gibson.dropbear.id.au> CC: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-25memory: tune last param of iommu_ops.translate()Peter Xu8-10/+10
This patch converts the old "is_write" bool into IOMMUAccessFlags. The difference is that "is_write" can only express either read/write, but sometimes what we really want is "none" here (neither read nor write). Replay is an good example - during replay, we should not check any RW permission bits since thats not an actual IO at all. CC: Paolo Bonzini <pbonzini@redhat.com> CC: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com>
2017-05-259pfs: local: metadata file for the VirtFS rootGreg Kurz1-27/+59
When using the mapped-file security, credentials are stored in a metadata directory located in the parent directory. This is okay for all paths with the notable exception of the root path, since we don't want and probably can't create a metadata directory above the virtfs directory on the host. This patch introduces a dedicated metadata file, sitting in the virtfs root for this purpose. It relies on the fact that the "." name necessarily refers to the virtfs root. As for the metadata directory, we don't want the client to see this file. The current code only cares for readdir() but there are many other places to fix actually. The filtering logic is hence put in a separate function. Before: # ls -ld drwxr-xr-x. 3 greg greg 4096 May 5 12:49 . # chown root.root . chown: changing ownership of '.': Is a directory # ls -ld drwxr-xr-x. 3 greg greg 4096 May 5 12:49 . After: # ls -ld drwxr-xr-x. 3 greg greg 4096 May 5 12:49 . # chown root.root . # ls -ld drwxr-xr-x. 3 root root 4096 May 5 12:50 . and from the host: ls -al .virtfs_metadata_root -rwx------. 1 greg greg 26 May 5 12:50 .virtfs_metadata_root $ cat .virtfs_metadata_root virtfs.uid=0 virtfs.gid=0 Reported-by: Leo Gaspard <leo@gaspard.io> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Leo Gaspard <leo@gaspard.io> [groug: work around a patchew false positive in local_set_mapped_file_attrat()]
2017-05-259pfs: local: simplify file openingGreg Kurz3-50/+29
The logic to open a path currently sits between local_open_nofollow() and the relative_openat_nofollow() helper, which has no other user. For the sake of clarity, this patch moves all the code of the helper into its unique caller. While here we also: - drop the code to skip leading "/" because the backend isn't supposed to pass anything but relative paths without consecutive slashes. The assert() is kept because we really don't want a buggy backend to pass an absolute path to openat(). - use strchrnul() to get a simpler code. This is ok since virtfs is for linux+glibc hosts only. - don't dup() the initial directory and add an assert() to ensure we don't return the global mountfd to the caller. BTW, this would mean that the caller passed an empty path, which isn't supposed to happen either. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> [groug: fixed typos in changelog]
2017-05-259pfs: local: resolve special directories in pathsGreg Kurz1-7/+25
When using the mapped-file security mode, the creds of a path /foo/bar are stored in the /foo/.virtfs_metadata/bar file. This is okay for all paths unless they end with '.' or '..', because we cannot create the corresponding file in the metadata directory. This patch ensures that '.' and '..' are resolved in all paths. The core code only passes path elements (no '/') to the backend, with the notable exception of the '/' path, which refers to the virtfs root. This patch preserves the current behavior of converting it to '.' so that it can be passed to "*at()" syscalls ('/' would mean the host root). Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-05-259pfs: check return value of v9fs_co_name_to_path()Greg Kurz1-11/+25
These v9fs_co_name_to_path() call sites have always been around. I guess no care was taken to check the return value because the name_to_path operation could never fail at the time. This is no longer true: the handle and synth backends can already fail this operation, and so will the local backend soon. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-05-259pfs: assume utimensat() and futimens() are presentGreg Kurz1-5/+0
The utimensat() and futimens() syscalls have been around for ages (ie, glibc 2.6 and linux 2.6.22), and the decision was already taken to switch to utimensat() anyway when fixing CVE-2016-9602 in 2.9. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-05-259pfs: local: fix unlink of alien files in mapped-file modeGreg Kurz1-19/+15
When trying to remove a file from a directory, both created in non-mapped mode, the file remains and EBADF is returned to the guest. This is a regression introduced by commit "df4938a6651b 9pfs: local: unlinkat: don't follow symlinks" when fixing CVE-2016-9602. It changed the way we unlink the metadata file from ret = remove("$dir/.virtfs_metadata/$name"); if (ret < 0 && errno != ENOENT) { /* Error out */ } /* Ignore absence of metadata */ to fd = openat("$dir/.virtfs_metadata") unlinkat(fd, "$name") if (ret < 0 && errno != ENOENT) { /* Error out */ } /* Ignore absence of metadata */ If $dir was created in non-mapped mode, openat() fails with ENOENT and we pass -1 to unlinkat(), which fails in turn with EBADF. We just need to check the return of openat() and ignore ENOENT, in order to restore the behaviour we had with remove(). Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> [groug: rewrote the comments as suggested by Eric]
generated by cgit v1.1 at 2025-01-06 13:40:56 +0000