aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2017-03-20Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170320' into stagingPeter Maydell1-0/+15
One bugfix for device plug/unplug and migration in the channel subsystem code. # gpg: Signature made Mon 20 Mar 2017 08:45:59 GMT # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170320: s390x/css: reassign subchannel if schid is changed after migration Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20Merge remote-tracking branch 'remotes/kraxel/tags/pull-fixes-20170320-1' ↵Peter Maydell1-1/+1
into staging fixes for 2.9: vnc, cirrus, tcg display updates. # gpg: Signature made Mon 20 Mar 2017 08:52:34 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-fixes-20170320-1: vnc: fix a qio-channel leak cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16 ui/console: ensure graphic updates don't race with TCG vCPUs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20s390x/css: reassign subchannel if schid is changed after migrationDong Jia Shi1-0/+15
The subchannel is a means to access a device. While the device number is assigned by the administrator, the subchannel number is assigned by the channel subsystem in an ascending order on cold and hot plug. When doing unplug and replug operations, the same device may end up on a different subchannel; for example - We start with a device fe.1.2222, which ends up at subchannel fe.1.0000. - Now we detach the device, attach a device fe.1.3333 (which would get the now-free subchannel fe.1.0000), re-attach fe.1.2222 (which ends up at subchannel fe.1.0001) and detach fe.1.3333. - We now have the same device (fe.1.2222) available to the guest; it just shows up on a different subchannel. In such a case, the subchannel numbers are different from what a QEMU would create during cold plug when parsing the command line. As this would cause a guest visible change on migration, we do restore the source system's value of the subchannel number on load. So we are now fine from the guest perspective. From the host perspective this will cause an inconsistent state in our internal data structures, though. For example, the subchannel 0 might not be at array position 0. This will lead to problems when we continue doing hot (un/re) plug operations. Let's fix this by cleaning up our internal data structures. Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-03-18nios2: iic: Convert CPU prop to qom linkMarek Vasut2-9/+7
Add a const qom link between the CPU and the IIC instead of passing the CPU link through a qom property. Signed-off-by: Marek Vasut <marex@denx.de> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20170317210627.23532-1-marex@denx.de Cc: Alexander Graf <agraf@suse.de> Cc: Chris Wulff <crwulff@gmail.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Jeff Da Silva <jdasilva@altera.com> Cc: Ley Foon Tan <lftan@altera.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Sandra Loosemore <sandra@codesourcery.com> Cc: Yves Vandervennet <yvanderv@altera.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-18Merge remote-tracking branch 'remotes/xtensa/tags/20170317-xtensa' into stagingPeter Maydell1-0/+9
target/xtensa fixes for 2.9: - fix build failure when FDT support is not enabled; - correctly pass command line arguments to semihosting guests. # gpg: Signature made Fri 17 Mar 2017 18:14:01 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170317-xtensa: target/xtensa: fix semihosting argc/argv implementation target/xtensa: xtfpga: load DTB only when FDT support is enabled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-17cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16Gerd Hoffmann1-1/+1
The switch from pointers to addresses (commit 026aeffcb4752054830ba203020ed6eb05bcaba8 and ffaf857778286ca54e3804432a2369a279e73aa7) added a off-by-one bug to 16bit backward blits. Fix. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com
2017-03-16Merge remote-tracking branch 'remotes/kraxel/tags/pull-cirrus-20170316-1' ↵Peter Maydell3-171/+251
into staging cirrus: blitter fixes. # gpg: Signature made Thu 16 Mar 2017 09:05:22 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-cirrus-20170316-1: cirrus: stop passing around src pointers in the blitter cirrus: stop passing around dst pointers in the blitter cirrus: fix cirrus_invalidate_region cirrus: add option to disable blitter cirrus: switch to 4 MB video memory by default cirrus/vnc: zap bitblit support from console code. fix :cirrus_vga fix OOB read case qemu Segmentation fault # Conflicts: # include/hw/compat.h Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-16Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell5-0/+66
virtio, pci: fixes More fixes missed in the previous pull request. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 16 Mar 2017 02:29:49 GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-serial-bus: Delete timer from list before free it hw/virtio: fix Power Management Control Register for PCI Express virtio devices hw/virtio: fix Link Control Register for PCI Express virtio devices hw/virtio: fix error enabling flags in Device Control register hw/pcie: fix Extended Configuration Space for devices with no Extended Capabilities Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-16cirrus: stop passing around src pointers in the blitterGerd Hoffmann3-54/+93
Does basically the same as "cirrus: stop passing around dst pointers in the blitter", just for the src pointer instead of the dst pointer. For the src we have to care about cputovideo blits though and fetch the data from s->cirrus_bltbuf instead of vga memory. The cirrus_src*() helper functions handle that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489584487-3489-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: stop passing around dst pointers in the blitterGerd Hoffmann3-125/+153
Instead pass around the address (aka offset into vga memory). Calculate the pointer in the rop_* functions, after applying the mask to the address, to make sure the address stays within the valid range. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489574872-8679-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: fix cirrus_invalidate_regionGerd Hoffmann1-3/+3
off_cur_end is exclusive, so off_cur_end == cirrus_addr_mask is valid. Fix calculation to make sure to allow that, otherwise the assert added by commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3 can trigger for valid blits. Test case: boot windows nt 4.0 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489579606-26020-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: add option to disable blitterGerd Hoffmann1-0/+9
Ok, we have this beast in the cirrus code which is not used at all by modern guests, except when you try to find security holes in qemu. So, add an option to disable blitter altogether. Guests released within the last ten years should not show any rendering issues if you turn off blitter support. There are no known bugs in the cirrus blitter code. But in the past we hoped a few times already that we've finally nailed the last issue. So having some easy way to mitigate in case yet another blitter issue shows up certainly makes me sleep a bit better at night. For completeness: The by far better way to mitigate is to switch away from cirrus and use stdvga instead. Or something more modern like virtio-vga in case your guest has support for it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494540-15745-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: switch to 4 MB video memory by defaultGerd Hoffmann1-2/+2
Quoting cirrus source code: Follow real hardware, cirrus card emulated has 4 MB video memory. Also accept 8 MB/16 MB for backward compatibility. So just use 4MB by default. We decided to leave that at 8MB by default a while ago, for live migration compatibility reasons. But we have compat properties to handle that, so that isn't a compeling reason. This also removes some sanity check inconsistencies in the cirrus code. Some places check against the allocated video memory, some places check against the 4MB physical hardware has. Guest code can trigger asserts because of that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494514-15606-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus/vnc: zap bitblit support from console code.Gerd Hoffmann1-9/+3
There is a special code path (dpy_gfx_copy) to allow graphic emulation notify user interface code about bitblit operations carryed out by guests. It is supported by cirrus and vnc server. The intended purpose is to optimize display scrolls and just send over the scroll op instead of a full display update. This is rarely used these days though because modern guests simply don't use the cirrus blitter any more. Any linux guest using the cirrus drm driver doesn't. Any windows guest newer than winxp doesn't ship with a cirrus driver any more and thus uses the cirrus as simple framebuffer. So this code tends to bitrot and bugs can go unnoticed for a long time. See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV" which fixes a bug lingering in the code for almost a year, added by commit "c7628bf vnc: only alloc server surface with clients connected". Also the vnc server will throttle the frame rate in case it figures the network can't keep up (send buffers are full). This doesn't work with dpy_gfx_copy, for any copy operation sent to the vnc client we have to send all outstanding updates beforehand, otherwise the vnc client might run the client side blit on outdated data and thereby corrupt the display. So this dpy_gfx_copy "optimization" might even make things worse on slow network links. Lets kill it once for all. Oh, and one more reason: Turns out (after writing the patch) we have a security bug in that code path ... Fixes: CVE-2016-9603 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494419-14340-1-git-send-email-kraxel@redhat.com
2017-03-16fix :cirrus_vga fix OOB read case qemu Segmentation faulthangaohuai1-0/+10
check the validity of parameters in cirrus_bitblt_rop_fwd_transp_xxx and cirrus_bitblt_rop_fwd_xxx to avoid the OOB read which causes qemu Segmentation fault. After the fix, we will touch the assert in cirrus_invalidate_region: assert(off_cur_end >= off_cur); Signed-off-by: fangying <fangying1@huawei.com> Signed-off-by: hangaohuai <hangaohuai@huawei.com> Message-id: 20170314063919.16200-1-hangaohuai@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-15ide: ahci: call cleanup function in ahci unitLi Qiang1-0/+12
This can avoid memory leak when hotunplug the ahci device. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1488449293-80280-4-git-send-email-liqiang6-s@360.cn Signed-off-by: John Snow <jsnow@redhat.com>
2017-03-15ide: core: add cleanup functionLi Qiang1-0/+8
As the pci ahci can be hotplug and unplug, in the ahci unrealize function it should free all the resource once allocated in the realized function. This patch add ide_exit to free the resource. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1488449293-80280-3-git-send-email-liqiang6-s@360.cn Signed-off-by: John Snow <jsnow@redhat.com>
2017-03-15ide: qdev: register ide bus unrealize functionLi Qiang1-6/+6
we have an idebus unrealize function, but it was being registered as the unrealize function for the IDE Device, so it was not getting invoked on device teardown because nothing is "unrealizing" the IDE devices themselves. Suggested-by: John Snow <jsnow@redhat.com> Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1488449293-80280-2-git-send-email-liqiang6-s@360.cn Signed-off-by: John Snow <jsnow@redhat.com>
2017-03-16virtio-serial-bus: Delete timer from list before free itzhanghailiang1-0/+1
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Amit Shah <amit@kernel.org>
2017-03-16hw/virtio: fix Power Management Control Register for PCI Express virtio devicesMarcel Apfelbaum2-0/+15
Make Power Management State flag writable to conform with the PCI Express spec. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-16hw/virtio: fix Link Control Register for PCI Express virtio devicesMarcel Apfelbaum3-0/+26
Make several Link Control Register flags writable to conform with the PCI Express spec. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-16hw/virtio: fix error enabling flags in Device Control registerMarcel Apfelbaum2-0/+16
When the virtio devices are PCI Express, make error-enabling flags writable to respect the PCIe spec. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-16hw/pcie: fix Extended Configuration Space for devices with no Extended ↵Marcel Apfelbaum2-0/+8
Capabilities Absence of any Extended Capabilities is required to be indicated by an Extended Capability header with a Capability ID of 0000h, a Capability Version of 0h, and a Next Capability Offset of 000h. Instead of inserting a 'NULL' capability is simpler to mark the start of the Extended Configuration Space as read-only to achieve the same behaviour. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell4-24/+96
virtio, pc: fixes Some fixes to fallback from using virtio caching, pls a minor vm gen id fix. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 15 Mar 2017 17:59:25 GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-pci: reset modern vq meta data Revert "virtio: unbreak virtio-pci with IOMMU after caching ring translations" pci: introduce a bus master container virtio: validate address space cache during init virtio: destroy region cache during reset virtio: guard against NULL pfn Bugfix: Handle error if VM Generation ID device not present Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-15virtio-pci: reset modern vq meta dataJason Wang1-0/+4
We don't reset proxy->vqs[].{num|desc[]|avail[]|used[]}. This means if a driver enable the vq without setting vq address after reset. The old addresses were leaked. Fixing this by resetting modern vq meta data during device reset. Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15Revert "virtio: unbreak virtio-pci with IOMMU after caching ring translations"Jason Wang1-1/+1
This reverts commit 96a8821d21411f10d77ea994af369c6e5c35a2cc. Previous patch is a better solution which does not require a strict order between virtio and IOMMU. CC: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-03-15pci: introduce a bus master containerJason Wang1-2/+7
96a8821d2141 ("virtio: unbreak virtio-pci with IOMMU after caching ring translations") tries to make IOMMU works with virtio memory region cache, but it requires IOMMU to be created before any virtio devices. This is sub optimal, fixing this by introduce a bus master container to make sure address space can be initialized during device registering, and then we can safely set alias and make bus_master_enable_region as its subregion during bus master initialization. Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15virtio: validate address space cache during initJason Wang1-6/+27
We don't check the return value of address_space_cache_init(), this may lead buggy driver use incorrect region caches. Instead of triggering an assert, catch and warn this early in virtio_init_region_cache(). Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15virtio: destroy region cache during resetJason Wang1-15/+30
We don't destroy region cache during reset which can make the maps of previous driver leaked to a buggy or malicious driver that don't set vring address before starting to use the device. Fix this by destroy the region cache during reset and validate it before trying to see them. Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15virtio: guard against NULL pfnJason Wang1-0/+26
To avoid access stale memory region cache after reset, this patch check the existence of virtqueue pfn for all exported virtqueue access helpers before trying to use them. Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-03-15Bugfix: Handle error if VM Generation ID device not presentBen Warren1-0/+1
This was crashing due to NULL-pointer dereference QMP Test case: ============== (QEMU) query-vm-generation-id {"error": {"class": "GenericError", "desc": "VM Generation ID device not found"}} HMP Test case: ============== virsh # qemu-monitor-command --hmp 3 info vm-generation-id VM Generation ID device not found Signed-off-by: Ben Warren <ben@skyportsystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2017-03-14machine: Convert abstract typename on compat_props to subclass namesEduardo Habkost1-3/+36
Original problem description by Greg Kurz: > Since commit "9a4c0e220d8a hw/virtio-pci: fix virtio > behaviour", passing -device virtio-blk-pci.disable-modern=off > has no effect on 2.6 machine types because the internal > virtio-pci.disable-modern=on compat property always prevail. The same bug also affects other abstract type names mentioned on compat_props by machine-types: apic-common, i386-cpu, pci-device, powerpc64-cpu, s390-skeys, spapr-pci-host-bridge, usb-device, virtio-pci, x86_64-cpu. The right fix for this problem is to make sure compat_props and -global options are always applied in the order they are registered, instead of reordering them based on the type hierarchy. But changing the ordering rules of -global is risky and might break existing configurations, so we shouldn't do that on a stable branch. This is a temporary hack that will work around the bug when registering compat_props properties: if we find an abstract class on compat_props, register properties for all its non-abstract subtypes instead. This will make sure -global won't be overridden by compat_props, while keeping the existing ordering rules on -global options. Note that there's one case that won't be fixed by this hack: "-global spapr-pci-vfio-host-bridge.<option>=<value>" won't be able to override compat_props, because spapr-pci-host-bridge is not an abstract class. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1481575745-26120-1-git-send-email-ehabkost@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Greg Kurz <groug@kaod.org> Tested-by: Greg Kurz <groug@kaod.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-14Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell4-3/+11
* "x" monitor command fix for KVM (Christian) * MemoryRegion name documentation (David) * mem-prealloc optimization (Jitendra) * -icount/MTTCG fixes (me) * "info mtree" niceness (Peter) * NBD drop_sync buffer overflow (Vladimir/Eric) * small cleanups and bugfixes (Li, Lin, Suramya, Thomas) * fix for "-device kvmclock" w/TCG (Eduardo) * debug output before crashing on KVM_{GET,SET}_MSRS (Eduardo) # gpg: Signature made Tue 14 Mar 2017 13:42:05 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: nbd/client: fix drop_sync [CVE-2017-2630] memory: info mtree check mr range overflow icount: process QEMU_CLOCK_VIRTUAL timers in vCPU thread main-loop: remove now unnecessary optimization cpus: define QEMUTimerListNotifyCB for QEMU system emulation qemu-timer: do not include sysemu/cpus.h from util/qemu-timer.h qemu-timer: fix off-by-one target/nios2: take BQL around interrupt check scsi: mptsas: fix the wrong reading size in fetch request util: Removed unneeded header from path.c configure: add the missing help output for optional features scripts/dump-guest-memory.py: fix int128_get64 on recent gcc kvmclock: Don't crash QEMU if KVM is disabled kvm: Print MSR information if KVM_{GET,SET}_MSRS failed exec: add cpu_synchronize_state to cpu_memory_rw_debug mem-prealloc: reduce large guest start-up and migration time. docs: Add a note about mixing bootindex with "-boot order" memory_region: Fix name comments Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-14hw/misc/imx6_src: Don't crash trying to reset missing CPUsPeter Maydell1-2/+6
Commit 4881658a4b introduced a call to arm_get_cpu_by_id(), and Coverity noticed that we weren't checking that it didn't return NULL (CID 1371652). Normally this won't happen (because all 4 CPUs are expected to exist), but it's possible the user requested fewer CPUs on the command line. Handle this possibility by silently doing nothing, which is the same behaviour as before commit 4881658a4b and also how we handle the other CPU operations (since we ignore the INVALID_PARAM returns from arm_set_cpu_on() and friends). There is a slight behavioural difference to the pre-4881658a4b situation: the "reset this core" bit will remain set rather than not being permitted to be set. The imx6 datasheet is unclear about the behaviour in this odd corner case, so we opt for the simpler code rather than complicated logic to maintain identical behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1488542374-1256-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-03-14qemu-timer: do not include sysemu/cpus.h from util/qemu-timer.hPaolo Bonzini2-0/+2
This dependency is the wrong way, and we will need util/qemu-timer.h from sysemu/cpus.h in the next patch. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-14scsi: mptsas: fix the wrong reading size in fetch requestLi Qiang1-3/+3
When fetching request, it should read sizeof(*hdr), not the pointer hdr. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-Id: <1489488980-130668-1-git-send-email-liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-14kvmclock: Don't crash QEMU if KVM is disabledEduardo Habkost1-0/+6
Most machines don't allow sysbus devices like "kvmclock" to be created from the command-line, but some of them do (the ones with has_dynamic_sysbus=true). In those cases, it's possible to manually create a kvmclock device without KVM being enabled, making QEMU crash: $ qemu-system-x86_64 -machine q35,accel=tcg -device kvmclock Segmentation fault (core dumped) This changes kvmclock's realize method to return an error if KVM is disabled, to ensure it won't crash QEMU. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309185046.17555-1-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-14Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2-1/+116
staging # gpg: Signature made Tue 14 Mar 2017 07:55:01 GMT # gpg: using RSA key 0xEF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: hw/net: implement MIB counters in mcf_fec driver COLO-compare: Fix trace_event print bug e1000e: correctly tear down MSI-X memory regions Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-14hw/net: implement MIB counters in mcf_fec driverGreg Ungerer1-0/+115
The FEC ethernet hardware module used on ColdFire SoC parts contains a block of RAM used to maintain hardware counters. This block is accessible via the usual FEC register address space. There is currently no support for this in the QEMU mcf_fec driver. Add support for storing a MIB RAM block, and provide register level access to it. Also implement a basic set of stats collection functions to populate MIB data fields. This support tested running a Linux target and using the net-tools "ethtool -S" option. As of linux-4.9 the kernels FEC driver makes accesses to the MIB counters during its initialization (which it never did before), and so this version of Linux will now fail with the QEMU error: qemu: hardware error: mcf_fec_read: Bad address 0x200 This MIB counter support fixes this problem. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-03-14e1000e: correctly tear down MSI-X memory regionsPaolo Bonzini1-1/+1
MSI-X has been disabled by the time the e1000e device is unrealized, hence msix_uninit is never called. This causes the object to be leaked, which shows up as a RAMBlock with empty name when attempting migration. Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-03-14pseries: Don't expose PCIe extended config space on older machine typesDavid Gibson2-3/+10
bb9986452 "spapr_pci: Advertise access to PCIe extended config space" allowed guests to access the extended config space of PCI Express devices via the PAPR interfaces, even though the paravirtualized bus mostly acts like plain PCI. However, that patch enabled access unconditionally, including for existing machine types, which is an unwise change in behaviour. This patch limits the change to pseries-2.9 (and later) machine types. Suggested-by: Andrea Bolognani <abologna@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-03-11target/xtensa: xtfpga: load DTB only when FDT support is enabledMax Filippov1-0/+9
xtensa linux can use DTB but does not require it, so FDT support is not a requirement for target/xtensa. Don't try to load DTB when FDT support is not configured. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2017-03-09Merge remote-tracking branch ↵Peter Maydell3-4/+15
'remotes/stsquad/tags/pull-mttcg-fixups-090317-1' into staging Fix-ups for MTTCG regressions for 2.9 This is the same as v3 posted a few days ago except with a few extra Reviewed-by tags added. # gpg: Signature made Thu 09 Mar 2017 10:45:18 GMT # gpg: using RSA key 0xFBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-mttcg-fixups-090317-1: hw/intc/arm_gic: modernise the DPRINTF target/arm/helper: make it clear the EC field is also in hex target-i386: defer VMEXIT to do_interrupt target/mips: hold BQL for timer interrupts translate-all: exit cpu_restore_state early if translating target/xtensa: hold BQL for interrupt processing s390x/misc_helper.c: wrap IO instructions in BQL sparc/sparc64: grab BQL before calling cpu_check_irqs cpus.c: add additional error_report when !TARGET_SUPPORT_MTTCG target/i386/cpu.h: declare TCG_GUEST_DEFAULT_MO vl/cpus: be smarter with icount and MTTCG Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-09hw/intc/arm_gic: modernise the DPRINTFAlex Bennée1-4/+9
While I was debugging the icount issues I realised a bunch of the messages look quite similar. I've fixed this by including __func__ in the debug print. At the same time I move the a modern if (GATE) style printf which ensures the compiler can check for format string errors even if the code gets optimised away in the non-DEBUG_GIC case. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-03-09sparc/sparc64: grab BQL before calling cpu_check_irqsAlex Bennée2-0/+6
IRQ modification is part of device emulation and should be done while the BQL is held to prevent races when MTTCG is enabled. This adds assertions in the hw emulation layer and wraps the calls from helpers in the BQL. Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2017-03-09qxl: clear guest_cursor on QXL_CURSOR_HIDEGerd Hoffmann1-0/+5
Make sure we don't leave guest_cursor pointing into nowhere. This might lead to (rare) live migration failures, due to target trying to restore the cursor from the stale pointer. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1421788 Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1488789111-27340-1-git-send-email-kraxel@redhat.com
2017-03-09ohci: relax link checkGerd Hoffmann1-1/+1
The strict td link limit added by commit "95ed569 usb: ohci: limit the number of link eds" causes problems with macos guests. Lets raise the limit. Reported-by: Programmingkid <programmingkidx@gmail.com> Reported-by: Howard Spoelstra <hsp.cat7@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: John Arbuckle <programmingkidx@gmail.com> Message-id: 1488876018-31576-1-git-send-email-kraxel@redhat.com
2017-03-07Merge remote-tracking branch 'remotes/xtensa/tags/20170306-xtensa' into stagingPeter Maydell1-9/+31
target/xtensa updates: - instantiate local memories in xtensa sim machine; - add two missing include files to xtensa core importing script. # gpg: Signature made Mon 06 Mar 2017 22:32:45 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170306-xtensa: target/xtensa: add two missing headers to core import script target/xtensa: sim: instantiate local memories Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-07Merge remote-tracking branch 'remotes/gkurz/tags/fixes-for-2.9' into stagingPeter Maydell2-4/+14
Fixes issues that got merged with the latest pull request: - missing O_NOFOLLOW flag for CVE-2016-960 - build break with older glibc that don't have O_PATH and AT_EMPTY_PATH - various bugs reported by Coverity # gpg: Signature made Mon 06 Mar 2017 17:51:29 GMT # gpg: using DSA key 0x02FC3AEB0101DBC2 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" # gpg: aka "Greg Kurz <groug@free.fr>" # gpg: aka "Greg Kurz <gkurz@linux.vnet.ibm.com>" # gpg: aka "Gregory Kurz (Groug) <groug@free.fr>" # gpg: aka "[jpeg image of size 3330]" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894 DBA2 02FC 3AEB 0101 DBC2 * remotes/gkurz/tags/fixes-for-2.9: 9pfs: fix vulnerability in openat_dir() and local_unlinkat_common() 9pfs: fix O_PATH build break with older glibc versions 9pfs: don't use AT_EMPTY_PATH in local_set_cred_passthrough() 9pfs: fail local_statfs() earlier 9pfs: fix fd leak in local_opendir() 9pfs: fix bogus fd check in local_remove() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-069pfs: fix vulnerability in openat_dir() and local_unlinkat_common()Greg Kurz2-2/+3
We should pass O_NOFOLLOW otherwise openat() will follow symlinks and make QEMU vulnerable. While here, we also fix local_unlinkat_common() to use openat_dir() for the same reasons (it was a leftover in the original patchset actually). This fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
generated by cgit v1.1 at 2024-09-18 02:42:57 +0000