aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2017-04-21Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170421' ↵Peter Maydell3-43/+29
into staging migration/next for 20170421 # gpg: Signature made Fri 21 Apr 2017 11:28:13 BST # gpg: using RSA key 0xF487EF185872D723 # gpg: Good signature from "Juan Quintela <quintela@redhat.com>" # gpg: aka "Juan Quintela <quintela@trasno.org>" # Primary key fingerprint: 1899 FF8E DEBF 58CC EE03 4B82 F487 EF18 5872 D723 * remotes/juanquintela/tags/migration/20170421: (65 commits) hmp: info migrate_parameters format tunes hmp: info migrate_capability format tunes migration: rename max_size to threshold_size migration: set current_active_state once virtio-rng: stop virtqueue while the CPU is stopped migration: don't close a file descriptor while it can be in use ram: Remove migration_bitmap_extend() migration: Disable hotplug/unplug during migration qdev: Move qdev_unplug() to qdev-monitor.c qdev: Export qdev_hot_removed qdev: qdev_hotplug is really a bool migration: Remove MigrationState parameter from migration_is_idle() ram: Use RAMBitmap type for coherence ram: rename last_ram_offset() last_ram_pages() ram: Use ramblock and page offset instead of absolute offset ram: Change offset field in PageSearchStatus to page ram: Remember last_page instead of last_offset ram: Use page number instead of an address for the bitmap operations ram: reorganize last_sent_block ram: ram_discard_range() don't use the mis parameter ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-21Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170421' into stagingPeter Maydell10-84/+189
The first batch of s390x changes for 2.10: - the new compat machine - several cleanups and optimizations - introspection for css ids # gpg: Signature made Fri 21 Apr 2017 08:36:25 BST # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170421: s390x: Drop useless casts s390x: register I/O adapters per ISC during init s390x/flic: cache flic in s390_get_flic s390x: initialize flic before I/O subsystems s390x: use enum for adapter type and standardize its naming s390x/css: consolidate the devno property for ccw devices s390x/css: provide introspection for virtual subchannel and device busid s390x/css: introduce read-only property type for device ids s390x/pci: make printf always compile in debug output s390x/kvm: make printf always compile in debug output s390x: introduce 2.10 compat machine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-21Merge remote-tracking branch 'remotes/armbru/tags/pull-qdev-2017-04-21' into ↵Peter Maydell8-62/+12
staging qdev patches for 2017-04-21 # gpg: Signature made Fri 21 Apr 2017 06:37:19 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qdev-2017-04-21: qdev: remove cannot_destroy_with_object_finalize_yet versatile: remove cannot_destroy_with_object_finalize_yet ppc: remove cannot_destroy_with_object_finalize_yet arm: remove remaining cannot_destroy_with_object_finalize_yet Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-21virtio-rng: stop virtqueue while the CPU is stoppedLaurent Vivier2-6/+26
If we modify the virtio-rng virqueue while the vmstate is already migrated we can have some inconsistencies between the virtqueue state and the memory content. To avoid this, stop the virtqueue while the CPU is stopped. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Amit Shah <amit@kernel.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2017-04-21qdev: Move qdev_unplug() to qdev-monitor.cJuan Quintela1-34/+0
It is not used by linux-user, otherwise I need to to create one stub for migration_is_idle() on following patch. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
2017-04-21qdev: Export qdev_hot_removedJuan Quintela1-1/+1
I need to move qdev_unplug to qdev-monitor in the following patch, and it needs access to this variable. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2017-04-21qdev: qdev_hotplug is really a boolJuan Quintela1-2/+2
Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-04-21s390x: register I/O adapters per ISC during initFei Li5-45/+69
The I/O adapters should exist as soon as the bus/infrastructure exists, and not only when the guest is actually trying to do something with them. While the lazy allocation was not wrong, allocating at init time is cleaner, both for the architecture and the code. Let's adjust this by having each device type (currently for PCI and virtio-ccw) register the adapters for each ISC (as now we don't know which ISC the guest will use) as soon as it initializes. Use a two-dimensional array io_adapters[type][isc] to store adapters in ChannelSubSys, so that we can conveniently get the adapter id by the helper function css_get_adapter_id(type, isc). Signed-off-by: Fei Li <sherrylf@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x/flic: cache flic in s390_get_flicFei Li1-3/+6
s390_get_flic() is called many times to obtain the flic. This wastes a lot of time as it calls object_resolve_path() every time. Let's cache S390FLICState by defining it as static. Signed-off-by: Fei Li <sherrylf@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x: initialize flic before I/O subsystemsFei Li1-1/+2
Let's have a flic before we move on to initialize more specific subsystems that make use of it. Signed-off-by: Fei Li <sherrylf@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x: use enum for adapter type and standardize its namingFei Li3-3/+2
Let's use an enum for io adapter type, and standardize its naming to CSS_IO_ADAPTER_* by changing S390_PCIPT_ADAPTER to CSS_IO_ADAPTER_PCI. Signed-off-by: Fei Li <sherrylf@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x/css: consolidate the devno property for ccw devicesDong Jia Shi3-13/+4
'devno' should rather be a property of the ccw device, instead of a property of a specific virtio-ccw device. Let's consolidate it. While we are at here, also rename CcwDevice.bus_id to CcwDevice.devno to make things clearer. Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x/css: provide introspection for virtual subchannel and device busidDong Jia Shi3-6/+67
Expose the busids of the virtual I/O subchannel and the virtual CCW device to ease debugging. This is needed because: 1. subchannel id are assigned dynamically, and cannot be set from outside. 2. device busid could possibly be auto generated. An example of using HMP to retrieve the property values of a virtio-balloon-ccw device looks like: [root@localhost ~]# lscss -d 0.0.0004 Device Subchan. DevType CU Type Use PIM PAM POM CHPIDs ---------------------------------------------------------------------- 0.0.0004 0.0.0003 0000/00 3832/05 yes 80 80 ff 00000000 00000000 (qemu) info qtree ... ... dev: virtio-balloon-ccw, id "balloon0" devno = "<unset>" ioeventfd = true max_revision = 2 (0x2) dev_id = "fe.0.0004" subch_id = "fe.0.0003" ... ... After migration, if we have the same device that shows up on a different subchannel, we must re-fill the subch_id of the ccw device with the new schid, or the subch_id will have an old wrong schid value. So this also re-fills the subch_id after migration. While we are at it, also neaten the related error handling a bit. Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x/css: introduce read-only property type for device idsDong Jia Shi1-0/+7
Let's introduce a read-only property type that handles device ids of the CssDevId type used for channel devices for future use. e.g. exposing the busid of an I/O subchannel that is assigned to a ccw device. Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x/pci: make printf always compile in debug outputDanil Antonov2-14/+18
Wrapped printf calls inside debug macros (DPRINTF) in `if` statement. This will ensure that printf function will always compile even if debug output is turned off and, in turn, will prevent bitrot of the format strings. Signed-off-by: Danil Antonov <g.danil.anto@gmail.com> Message-Id: <CA+KKJYBi31Bs7DtVdzZdwG2t+u5+FGiAhQpd3pqJzUX1O8Cprg@mail.gmail.com> [CH: remove now misleading comments] Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x: introduce 2.10 compat machineCornelia Huck1-1/+16
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21versatile: remove cannot_destroy_with_object_finalize_yetLaurent Vivier1-23/+12
cannot_destroy_with_object_finalize_yet was added by 4c315c2 ("qdev: Protect device-list-properties against broken devices") because "realview_pci" and "versatile_pci" were hanging during "device-list-properties" cleanup (an infinite loop in bus_unparent()). We have this problem because the child is not removed from the list of the PCI bus children because it has no defined parent: qdev_set_parent_bus() set the device parent_bus pointer to bus, and adds the device in the bus children list, but doesn't update the device parent pointer. To fix the problem, move all the involved parts to the realize function. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20170414083717.13641-4-lvivier@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-04-20qdev: Constify local variable returned by blk_bsKrzysztof Kozlowski1-1/+1
Inside qdev_prop_set_drive() the value returned by blk_bs() is passed only as pointer to const to bdrv_get_node_name() and pointed values is not modified in other places so this can be made const for code safeness. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Message-Id: <20170310200550.13313-3-krzk@kernel.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20qdev: Constify value passed to qdev_prop_set_macaddrKrzysztof Kozlowski1-1/+2
The 'value' argument is not modified so this can be made const for code safeness. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Message-Id: <20170310200550.13313-2-krzk@kernel.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20hw/core/null-machine: Print error message when using the -kernel parameterThomas Huth1-0/+6
If the user currently tries to use the -kernel parameter, simply nothing happens, and the user might get confused that there is nothing loaded to memory, but also no error message has been issued. Since there is no real generic way to load a kernel on all CPU types (but on some targets, the generic loader can be used instead), issue an appropriate error message here now to avoid the possible confusion. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1488271971-12624-1-git-send-email-thuth@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20qdev: Make "hotplugged" property read-onlyEduardo Habkost1-8/+1
The "hotplugged" property is user visible, but it was never meant to be set by the user. There are probably multiple ways to break or crash device code by overriding the property. For example, we recently fixed a crash in rtc_set_memory() related to the property (commit 26ef65beab852caf2b1ef4976e3473f2d525164d). There has been some discussion about making management software use "hotplugged=on" on migration, to indicate devices that were hotplugged in the migration source. There were other suggestions to address this, like including the "hotplugged" field in the migration stream instead of requiring it to be set explicitly. Whatever solution we choose in the future, this patch disables setting "hotplugged" explicitly in the command-line by now, because the ability to set the property is unused, untested, and undocumented. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170222192647.19690-1-ehabkost@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20intel_iommu: enable remote IOTLBPeter Xu3-13/+180
This patch is based on Aviv Ben-David (<bd.aviv@gmail.com>)'s patch upstream: "IOMMU: enable intel_iommu map and unmap notifiers" https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg01453.html However I removed/fixed some content, and added my own codes. Instead of translate() every page for iotlb invalidations (which is slower), we walk the pages when needed and notify in a hook function. This patch enables vfio devices for VT-d emulation. And, since we already have vhost DMAR support via device-iotlb, a natural benefit that this patch brings is that vt-d enabled vhost can live even without ATS capability now. Though more tests are needed. Signed-off-by: Aviv Ben-David <bdaviv@cs.technion.ac.il> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: \"Michael S. Tsirkin\" <mst@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1491562755-23867-10-git-send-email-peterx@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20intel_iommu: allow dynamic switch of IOMMU regionPeter Xu2-6/+77
This is preparation work to finally enabled dynamic switching ON/OFF for VT-d protection. The old VT-d codes is using static IOMMU address space, and that won't satisfy vfio-pci device listeners. Let me explain. vfio-pci devices depend on the memory region listener and IOMMU replay mechanism to make sure the device mapping is coherent with the guest even if there are domain switches. And there are two kinds of domain switches: (1) switch from domain A -> B (2) switch from domain A -> no domain (e.g., turn DMAR off) Case (1) is handled by the context entry invalidation handling by the VT-d replay logic. What the replay function should do here is to replay the existing page mappings in domain B. However for case (2), we don't want to replay any domain mappings - we just need the default GPA->HPA mappings (the address_space_memory mapping). And this patch helps on case (2) to build up the mapping automatically by leveraging the vfio-pci memory listeners. Another important thing that this patch does is to seperate IR (Interrupt Remapping) from DMAR (DMA Remapping). IR region should not depend on the DMAR region (like before this patch). It should be a standalone region, and it should be able to be activated without DMAR (which is a common behavior of Linux kernel - by default it enables IR while disabled DMAR). Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: \"Michael S. Tsirkin\" <mst@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1491562755-23867-9-git-send-email-peterx@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20intel_iommu: provide its own replay() callbackPeter Xu2-5/+184
The default replay() don't work for VT-d since vt-d will have a huge default memory region which covers address range 0-(2^64-1). This will normally consumes a lot of time (which looks like a dead loop). The solution is simple - we don't walk over all the regions. Instead, we jump over the regions when we found that the page directories are empty. It'll greatly reduce the time to walk the whole region. To achieve this, we provided a page walk helper to do that, invoking corresponding hook function when we found an page we are interested in. vtd_page_walk_level() is the core logic for the page walking. It's interface is designed to suite further use case, e.g., to invalidate a range of addresses. Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: \"Michael S. Tsirkin\" <mst@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1491562755-23867-8-git-send-email-peterx@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20intel_iommu: use the correct memory region for device IOTLB notificationJason Wang1-1/+1
We have a specific memory region for DMAR now, so it's wrong to trigger the notifier with the root region. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: \"Michael S. Tsirkin\" <mst@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1491562755-23867-7-git-send-email-peterx@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20memory: add section range info for IOMMU notifierPeter Xu2-6/+19
In this patch, IOMMUNotifier.{start|end} are introduced to store section information for a specific notifier. When notification occurs, we not only check the notification type (MAP|UNMAP), but also check whether the notified iova range overlaps with the range of specific IOMMU notifier, and skip those notifiers if not in the listened range. When removing an region, we need to make sure we removed the correct VFIOGuestIOMMU by checking the IOMMUNotifier.start address as well. This patch is solving the problem that vfio-pci devices receive duplicated UNMAP notification on x86 platform when vIOMMU is there. The issue is that x86 IOMMU has a (0, 2^64-1) IOMMU region, which is splitted by the (0xfee00000, 0xfeefffff) IRQ region. AFAIK this (splitted IOMMU region) is only happening on x86. This patch also helps vhost to leverage the new interface as well, so that vhost won't get duplicated cache flushes. In that sense, it's an slight performance improvement. Suggested-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1491562755-23867-2-git-send-email-peterx@redhat.com> [ehabkost: included extra vhost_iommu_region_del() change from Peter Xu] Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-20xlnx-zynqmp: Set the Cadence GEM revisionAlistair Francis1-1/+5
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 026dbe01a1d42619eee30ce3f2079741bf04bc73.1491947224.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20cadence_gem: Make the revision a propertyAlistair Francis1-1/+5
Expose the Cadence GEM revision as a property. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 541324373cf87b50f8be0439a0cb89f5028b016f.1491947224.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20cadence_gem: Correct the interupt logicAlistair Francis1-5/+13
This patch fixes two mistakes in the interrupt logic. First we only trigger single-queue or multi-queue interrupts if the status register is set. This logic was already used for non multi-queue interrupts but it also applies to multi-queue interrupts. Secondly we need to lower the interrupts if the ISR isn't set. As part of this we can remove the other interrupt lowering logic and consolidate it inside gem_update_int_status(). Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 438bcc014f8f8a2f8f68f322cb6a53f4c04688c2.1491947224.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20cadence_gem: Correct the multi-queue can rx logicAlistair Francis1-7/+10
Correct the buffer descriptor busy logic to work correctly when using multiple queues. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 8a7e8059984e27d46a276a66299d035a0afd280f.1491947224.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20cadence_gem: Read the correct queue descriptorAlistair Francis1-2/+2
Read the correct descriptor instead of hardcoding the first (q=0). Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 988b183dcf951856d8b3379f7e911ec95233bbf4.1491947224.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20hw/arm: Qomify pxa2xx.cSuramya Shah1-8/+6
Signed-off-by: Suramya Shah <shah.suramya@gmail.com> Message-id: 20170415180316.2694-1-shah.suramya@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20stellaris: Don't hw_error() on bad register accessesPeter Maydell1-23/+37
Current recommended style is to log a guest error on bad register accesses, not kill the whole system with hw_error(). Change the hw_error() calls to log as LOG_GUEST_ERROR or LOG_UNIMP or use g_assert_not_reached() as appropriate. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491486314-25823-1-git-send-email-peter.maydell@linaro.org
2017-04-20hw/misc/exynos4210_pmu: Reorder local variables for readabilityKrzysztof Kozlowski1-2/+2
Short declaration of 'i' was in the middle of declarations with assignments. Make it a little bit more readable. Additionally switch from "unsigned" to "unsigned int" as this pattern is more widely used. No functional change. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170313184750.429-4-krzk@kernel.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20hw/char/exynos4210_uart: Constify static array and few argumentsKrzysztof Kozlowski1-4/+4
The static array exynos4210_uart_regs with register values is not modified so it can be made const. Few other functions accept driver or uart state as an argument but they do not change it and do not cast it so this can be made const for code safeness. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Message-id: 20170313184750.429-3-krzk@kernel.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20hw/arm/exynos: Convert fprintf to qemu_log_mask/error_reportKrzysztof Kozlowski4-20/+25
qemu_log_mask() and error_report() are preferred over fprintf() for logging errors. Also remove square brackets [] and additional new line characters in printed messages. Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170313184750.429-2-krzk@kernel.org [PMM: wrapped long line] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20hw/arm/boot: take Linux/arm64 TEXT_OFFSET header field into accountArd Biesheuvel1-11/+53
The arm64 boot protocol stipulates that the kernel must be loaded TEXT_OFFSET bytes beyond a 2 MB aligned base address, where TEXT_OFFSET could be any 4 KB multiple between 0 and 2 MB, and whose value can be found in the header of the Image file. So after attempts to load the arm64 kernel image as an ELF file or as a U-Boot image have failed (both of which have their own way of specifying the load offset), try to determine the TEXT_OFFSET from the image after loading it but before mapping it as a ROM mapping into the guest address space. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1489414630-21609-1-git-send-email-ard.biesheuvel@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20arm: remove remaining cannot_destroy_with_object_finalize_yetLaurent Vivier7-39/+0
With commit ce5b1bbf624b ("exec: move cpu_exec_init() calls to realize functions"), we can now remove all the remaining cannot_destroy_with_object_finalize_yet as unsafe references have been moved to cpu_exec_realizefn(). (tested with QOM command provided by commit 4c315c27). Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20170414083717.13641-2-lvivier@redhat.com> Acked-by: Alistair Francis <alistair.francis@xilinx.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-04-189pfs: local: set the path of the export root to "."Greg Kurz1-1/+6
The local backend was recently converted to using "at*()" syscalls in order to ensure all accesses happen below the shared directory. This requires that we only pass relative paths, otherwise the dirfd argument to the "at*()" syscalls is ignored and the path is treated as an absolute path in the host. This is actually the case for paths in all fids, with the notable exception of the root fid, whose path is "/". This causes the following backend ops to act on the "/" directory of the host instead of the virtfs shared directory when the export root is involved: - lstat - chmod - chown - utimensat ie, chmod /9p_mount_point in the guest will be converted to chmod / in the host for example. This could cause security issues with a privileged QEMU. All "*at()" syscalls are being passed an open file descriptor. In the case of the export root, this file descriptor points to the path in the host that was passed to -fsdev. The fix is thus as simple as changing the path of the export root fid to be "." instead of "/". This is CVE-2017-7471. Cc: qemu-stable@nongnu.org Reported-by: Léo Gaspard <leo@gaspard.io> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-11Merge remote-tracking branch 'remotes/kraxel/tags/pull-fixes-20170411-1' ↵Peter Maydell2-0/+33
into staging qxl: bugfixes. # gpg: Signature made Tue 11 Apr 2017 08:00:00 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-fixes-20170411-1: qxl: add migration blocker to avoid pre-save assert qxl: switch display on entering VGA Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-11qxl: add migration blocker to avoid pre-save assertGerd Hoffmann2-0/+32
Cc: 1635339@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170410113131.2585-1-kraxel@redhat.com
2017-04-109pfs: xattr: fix memory leak in v9fs_list_xattrLi Qiang1-0/+1
Free 'orig_value' in error path. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Greg Kurz <groug@kaod.org>
2017-04-07qxl: switch display on entering VGAMarc-André Lureau1-0/+1
Since commit cd958edb1fae85d, same size console resize is skipped. This change broke QXL incoming migration in VGA mode, qemu_spice_display_switch() is no longer called during qxl_post_load(), because default message surface is of the same size, and during displaychangelistener registration, PCIQXLDevice.mode is QXL_MODE_UNDEFINED. This triggers a later crash on refresh: ==2634== Invalid read of size 4 ==3516== at 0x65F3050: pixman_image_get_data (in /usr/lib64/libpixman-1.so.0.34.0) ==3516== by 0x6F0CEB: qemu_spice_create_update (spice-display.c:215) ==3516== by 0x6F1CC7: qemu_spice_display_refresh (spice-display.c:502) ==3516== by 0x58CF77: display_refresh (qxl.c:1948) ==3516== by 0x6E8084: do_safe_dpy_refresh (console.c:1591) ==3516== by 0x6E80D5: dpy_refresh (console.c:1604) ==3516== by 0x6E4508: gui_update (console.c:201) ==3516== by 0x81898E: timerlist_run_timers (qemu-timer.c:536) ==3516== by 0x8189D6: qemu_clock_run_timers (qemu-timer.c:547) ==3516== by 0x818D98: qemu_clock_run_all_timers (qemu-timer.c:662) ==3516== by 0x81952A: main_loop_wait (main-loop.c:514) ==3516== by 0x4ADD29: main_loop (vl.c:1898) One way to solve this is to explicitely call qemu_spice_display_switch() on entering VGA mode, which is called during qxl_post_load(). Fixes: "null pointer access on migration resume of systemrescuecd boot menu with qxl-vga" https://bugs.launchpad.net/qemu/+bug/1679126 https://bugzilla.redhat.com/show_bug.cgi?id=1438566 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170406120513.638-4-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-06vfio/pci-quirks: Exclude non-ioport BAR from NVIDIA quirkAlex Williamson1-1/+1
The NVIDIA BAR5 quirk is targeting an ioport BAR. Some older devices have a BAR5 which is not ioport and can induce a segfault here. Test the BAR type to skip these devices. Link: https://bugs.launchpad.net/qemu/+bug/1678466 Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2017-04-06Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2-7/+0
* TCO watchdog fix # gpg: Signature made Wed 05 Apr 2017 16:24:52 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: tco: do not generate an NMI Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-05tco: do not generate an NMIPaolo Bonzini2-7/+0
This behavior is not indicated in the datasheet and can confuse the OS. The TCO can trap NMIs from SERR# or IOCHK# and convert them to SMIs; but any other TCO event is either delivered as an SMI or completely disabled. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-04-04Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into stagingPeter Maydell1-7/+10
Some 9pfs bugs fixes: potential hang at reset, migration blocker leak. # gpg: Signature made Tue 04 Apr 2017 17:07:55 BST # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/for-upstream: 9pfs: clear migration blocker at session reset 9pfs: fix multiple flush for same request Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-049pfs: clear migration blocker at session resetGreg Kurz1-5/+6
The migration blocker survives a device reset: if the guest mounts a 9p share and then gets rebooted with system_reset, it will be unmigratable until it remounts and umounts the 9p share again. This happens because the migration blocker is supposed to be cleared when we put the last reference on the root fid, but virtfs_reset() wrongly calls free_fid() instead of put_fid(). This patch fixes virtfs_reset() so that it honor the way fids are supposed to be manipulated: first get a reference and later put it back when you're done. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Li Qiang <liqiang6-s@360.cn>
2017-04-049pfs: fix multiple flush for same requestGreg Kurz1-2/+4
If a client tries to flush the same outstanding request several times, only the first flush completes. Subsequent ones keep waiting for the request completion in v9fs_flush() and, therefore, leak a PDU. This will cause QEMU to hang when draining active PDUs the next time the device is reset. Let have each flush request wake up the next one if any. The last waiter frees the cancelled PDU. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-04-04pci: Only unmap bus_master_enabled_region if was added previouslyAlexey Kardashevskiy1-2/+4
Normally pci_init_bus_master() would be called either via bus->machine_done.notify or directly from do_pci_register_device(). However if a device's realize() failed, pci_init_bus_master() is not called, and do_pci_unregister_device() fails on memory_region_del_subregion() as it was not mapped. This adds a check that subregion was mapped before unmapping it. Fixes: c53598ed18e4 ("pci: Add missing drop of bus master AS reference") Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: John Snow <jsnow@redhat.com>
generated by cgit v1.1 at 2024-12-29 03:38:04 +0000