aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2015-04-02sysbus: Make devices picking up backends unavailable with -deviceMarkus Armbruster13-0/+26
Device models aren't supposed to go on fishing expeditions for backends. They should expose suitable properties for the user to set. For onboard devices, board code sets them. A number of sysbus devices pick up block backends in their init() / instance_init() methods with drive_get_next() instead: sl-nand, milkymist-memcard, pl181, generic-sdhci. Likewise, a number of sysbus devices pick up character backends in their init() / realize() methods with qemu_char_get_next_serial(): cadence_uart, digic-uart, etraxfs,serial, lm32-juart, lm32-uart, milkymist-uart, pl011, stm32f2xx-usart, xlnx.xps-uartlite. All these mistakes are already marked FIXME. See the commit that added these FIXMEs for a more detailed explanation of what's wrong. Fortunately, only machines ppce500 and pseries-* support -device with sysbus devices, and none of the devices above is supported with these machines. Set cannot_instantiate_with_device_add_yet to preserve our luck. Cc: Andrzej Zaborowski <balrogg@gmail.com> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: Antony Pavlov <antonynpavlov@gmail.com> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02sdhci: Make device "sdhci-pci" unavailable with -deviceMarkus Armbruster1-0/+2
Device models aren't supposed to go on fishing expeditions for backends. They should expose suitable properties for the user to set. For onboard devices, board code sets them. "sdhci-pci" picks up its block backend in its realize() method with drive_get_next() instead. Already marked FIXME. See the commit that added the FIXME for a more detailed explanation of what's wrong. We can't fix this in time for the release, but since the device is new in 2.3, we can set cannot_instantiate_with_device_add_yet to disable it before this mistake becomes ABI, and we have to support command lines like $ qemu -drive if=sd -drive if=sd,file=sd.img -device sdhci-pci -device sdhci-pci forever. Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02hw: Mark device misusing nd_table[] FIXMEMarkus Armbruster1-0/+1
NICs defined with -net nic are for board initialization to wire up. Board code examines nd_table[] to find them, and creates devices with their qdev NIC properties set accordingly. Except "allwinner-a10" goes on a fishing expedition for NIC configuration instead of exposing the usual NIC properties for board code to set: it uses nd_table[0] in its instance_init() method. Picking up the first -net nic option's configuration that way works when the device is created by board code. But it's inappropriate for -device and device_add. Not only is it inconsistent with how the other block device models work (they get their configuration from properties "mac", "vlan", "netdev"), it breaks when nd_table[0] has been picked up by the board or a previous -device / device_add already. Example: $ qemu-system-arm -S -M cubieboard -device allwinner-a10 qemu-system-arm: -device allwinner-a10: Property 'allwinner-emac.netdev' can't take value 'hub0port0', it's in use Aborted (core dumped) It also breaks in other entertaining ways: $ qemu-system-arm -M highbank -device allwinner-a10 qemu-system-arm: -device allwinner-a10: Unsupported NIC model: xgmac $ qemu-system-arm -M highbank -net nic,model=allwinner-emac -device allwinner-a10 qemu-system-arm: Unsupported NIC model: allwinner-emac Mark the mistake with a FIXME comment. Cc: Li Guang <lig.fnst@cn.fujitsu.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02hw: Mark devices picking up char backends actively FIXMEMarkus Armbruster11-0/+12
Character devices defined with -serial and -parallel are for board initialization to wire up. Board code examines serial_hds[] and parallel_hds[] to find them, and creates devices with their qdev chardev properties set accordingly. Except a few devices go on a fishing expedition for a suitable backend instead of exposing a chardev property for board code to set: they use serial_hds[] (often via qemu_char_get_next_serial()) or parallel_hds[] in their realize() or init() method to connect to a backend. Picking up backends that way works when the devices are created by board code. But it's inappropriate for -device or device_add. Not only is it inconsistent with how the other characrer device models work (they connect to a backend explicitly identified by a "chardev" property), it breaks when the backend has been picked up by the board or a previous -device / device_add already. Example: $ qemu-system-ppc64 -M bamboo -S -device i82378 -device pc87312 -device pc87312 qemu-system-ppc64: -device pc87312: Property 'isa-parallel.chardev' can't take value 'parallel0', it's in use Mark them with suitable FIXME comments. Cc: Li Guang <lig.fnst@cn.fujitsu.com> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: Antony Pavlov <antonynpavlov@gmail.com> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Michael Walle <michael@walle.cc> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: "Andreas Färber" <andreas.faerber@web.de> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02hw: Mark devices picking up block backends actively FIXMEMarkus Armbruster7-0/+8
Drives defined with if!=none are for board initialization to wire up. Board code calls drive_get() or similar to find them, and creates devices with their qdev drive properties set accordingly. Except a few devices go on a fishing expedition for a suitable backend instead of exposing a drive property for board code to set: they call driver_get() or drive_get_next() in their realize() or init() method to implicitly connect to the "next" backend with a certain interface type. Picking up backends that way works when the devices are created by board code. But it's inappropriate for -device or device_add. Not only is this inconsistent with how the other block device models work (they connect to a backend explicitly identified by a "drive" property), it breaks when the "next" backend has been picked up by the board already. Example: $ qemu-system-arm -S -M connex -pflash flash.img -device ssi-sd Aborted (core dumped) Mark them with suitable FIXME comments. Cc: Andrzej Zaborowski <balrogg@gmail.com> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: "Andreas Färber" <andreas.faerber@web.de> Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-01pc: acpi: fix pvpanic regressionIgor Mammedov1-1/+1
Commit cd61cb2 pc: acpi-build: generate pvpanic device description dynamically introduced regression changing pvpanic device HID from QEMU0001 to QEMU0002. Fix AML generated code so that pvpanic device would keep its original HID. i.e. QEMU0001 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reported-by: Gal Hammer <ghammer@redhat.com> Message-Id: <1427717907-25027-1-git-send-email-imammedo@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-30s390x/ipl: avoid sign extensionCornelia Huck1-1/+1
Make s390_update_iplstate() return uint32_t to avoid sign extensions for cssids > 127. While this doesn't matter in practice yet (as nobody supports MCSS-E and thus won't see the real cssid), play safe. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Jason J. Herne <jjherne@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-03-30s390x: do not include ram_addr.hPaolo Bonzini1-1/+0
ram_addr.h is an internal interface and it is not needed anyway by hw/s390x/ipl.c. Cc: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Thomas Huth <huth@tuxfamily.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1427295389-5054-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-03-30virtio-ccw: range check in READ_VQ_CONFCornelia Huck1-0/+4
Processing for READ_VQ_CONF needs to check whether the requested queue value is actually in the supported range and post a channel program check if not. Cc: qemu-stable@nongnu.org Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-03-30virtio-ccw: fix range check for SET_VQCornelia Huck1-1/+1
VIRTIO_PCI_QUEUE_MAX is already too big; a malicious guest would be able to trigger a write beyond the VirtQueue structure. Cc: qemu-stable@nongnu.org Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2015-03-27AHCI: Protect cmd registerJohn Snow2-1/+27
Many bits in the CMD register are supposed to be strictly read-only. We should not be deleting them on every write. As a side-effect: pay explicit attention to when a guest marks off the FIS Receive or Start bits, and disable the status bits ourselves, instead of letting them implicitly fall off. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1426283454-15590-3-git-send-email-jsnow@redhat.com
2015-03-27AHCI: Do not (re)map FB/CLB buffers while not runningJohn Snow1-17/+33
The FIS Receive Buffer and Command List Buffer pointers should not be edited while the FIS receive engine or Command Receive engines are running. Currently, we attempt to re-map the buffers every time they are adjusted, but while the AHCI engines are off, these registers may contain stale values, so we should not attempt to re-map these values until the engines are reactivated. Reported-by: Jordan Hargrave <jharg93@gmail.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1426283454-15590-2-git-send-email-jsnow@redhat.com
2015-03-27Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell1-2/+2
staging # gpg: Signature made Fri Mar 27 11:59:41 2015 GMT using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: hw/net/e1000: fix integer endianness Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-27hw/net/e1000: fix integer endiannessShannon Zhao1-2/+2
It's detected by coverity.In is_vlan_packet s->mac_reg[VET] is unsigned int but is dereferenced as a narrower unsigned short. This may lead to unexpected results depending on machine endianness. Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Message-id: 1426224119-8352-1-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-03-27nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)Stefan Weil1-1/+1
The shift operation on nlb gives a 32 bit result if no type cast is applied. This bug was reported by Coverity. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-id: 1426348844-8793-1-git-send-email-sw@weilnetz.de Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-03-26Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell19-80/+76
Bugfixes and making SCSI adapters IOMMU-friendly. # gpg: Signature made Thu Mar 26 13:24:05 2015 GMT using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring misc: fix typos in copyright declaration exec: avoid possible overwriting of mmaped area in qemu_ram_remap sparc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory mips: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory m68k: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory nbd: Fix up comment after commit e140177 vmw_pvscsi: use PCI DMA APIs megasas: use PCI DMA APIs cpus: Don't kick un-realized cpus. i6300esb: Fix signed integer overflow i6300esb: Correct endiannness fw_cfg: factor out initialization of FW_CFG_ID (rev. number) rcu tests: fix compilation on 32-bit ppc Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-26Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' ↵Peter Maydell3-10/+33
into staging Patch queue for 2.3 ppc - 2015-03-25 Just a few bug fixes before 2.3 gets released: - pseries: Firmware update, bugfixes - remove POWER5+ v0.0 that we incorrectly introduced in 2.3 - Fix -machine usb=no - Fix -boot once=foo in pseries - Add NULL pointer check in pseries machine init # gpg: Signature made Wed Mar 25 21:53:20 2015 GMT using RSA key ID 03FEDC60 # gpg: Good signature from "Alexander Graf <agraf@suse.de>" # gpg: aka "Alexander Graf <alex@csgraf.de>" * remotes/agraf/tags/signed-ppc-for-upstream: powerpc: fix -machine usb=no for newworld and pseries machines PPC: pseries: Implement boot once=foo target-ppc: Remove POWER5+ v0.0 that never existed spapr: Add missing checks for NULL pointers and report failures pseries: Update SLOF firmware image to qemu-slof-20150313 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-26virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVringTing Wang1-0/+6
VirtIOSCSIVring which allocated in virtio_scsi_vring_init should be free when dataplane has been stopped or failed to start. Signed-off-by: Ting Wang <kathy.wangting@huawei.com> Message-Id: <1427355752-25844-1-git-send-email-kathy.wangting@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25powerpc: fix -machine usb=no for newworld and pseries machinesPaolo Bonzini3-2/+3
Capture the explicit setting of "usb=no" into a separate bool, and use it to skip the update of machine->usb in the board init function. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-03-25PPC: pseries: Implement boot once=fooAlexander Graf1-8/+22
On sPAPR we haven't supported boot once ever since it emerged, but recently grew need for it. This patch implements boot once logic to it. While at it, we also move to the new bootdevice handling that got introduced to the tree recently. Reported-by: Dinar Valeev <dvaleev@suse.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2015-03-25spapr: Add missing checks for NULL pointers and report failuresStefan Weil1-0/+8
This fixes potential runtime crashes and two warnings from Coverity. The new error message does not add a prefix "qemu:" because that is already done in function hw_error. It also starts with an uppercase letter because that seems to be the mostly used form. Signed-off-by: Stefan Weil <sw@weilnetz.de> [agraf: fix typo] Signed-off-by: Alexander Graf <agraf@suse.de>
2015-03-25sparc: memory: Replace memory_region_init_ram with ↵Dirk Müller2-5/+3
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Signed-off-by: Dirk Mueller <dmueller@suse.com> Message-Id: <CAL5wTH7o8uA59Ep0n41i0M19VFWa73n9m172j2W3fjz6=PSVBA@mail.gmail.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25mips: memory: Replace memory_region_init_ram with ↵Dirk Müller5-13/+8
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Signed-off-by: Dirk Mueller <dmueller@suse.com> Message-Id: <CAL5wTH4-=HJUvwBu+2o6jGanJesJOyNf3sL8-5+d_-6C3cWBfA@mail.gmail.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Acked-by: Leon Alrae <leon.alrae@imgtec.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25m68k: memory: Replace memory_region_init_ram with ↵Dirk Müller3-6/+4
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Signed-off-by: Dirk Mueller <dmueller@suse.com> Message-Id: <CAL5wTH6X-GsT1AA8kEtP_e7oZWGZgi=fCcDfSs3wLgJN30DbUw@mail.gmail.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25virtio-net: validate backend queue numbers against bus limitationJason Wang1-0/+7
We don't validate the backend queue numbers against bus limitation, this will easily crash qemu if it exceeds the limitation which will hit the abort() in virtio_del_queue(). An example is trying to starting a virtio-net device with 256 queues. E.g: ./qemu-system-x86_64 -netdev tap,id=hn0,queues=256 -device virtio-net-pci,netdev=hn0 Fixing this by doing the validation and fail early. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-03-25virtio-serial: fix virtio config sizeMichael S. Tsirkin1-1/+3
commit 9b70c1790acacae54d559d38ca69186a85040bb8 virtio-serial: switch to standard-headers changes virtio_console_config size from 8 to 12 bytes: it adds an optional 4 byte emerg_wr field. As this crosses a power of two boundary, this changes the PCI BAR size, which breaks migration compatibility with old qemu machine types. It's probably a problem for other transports as well. As a temporary fix, as we don't yet support this new field anyway, simply make the config size smaller at init time. Long terms we probably want something along the lines of virtio_net_set_config_size. Reported-by: Cole Robinson <crobinso@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Cole Robinson <crobinso@redhat.com>
2015-03-25acpi: Add missing GCC_FMT_ATTR to local functionStefan Weil1-1/+1
This fixes these gcc warnings (not enabled in default build): hw/acpi/aml-build.c:83:5: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format] hw/acpi/aml-build.c:88:5: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format] Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2015-03-25vmw_pvscsi: use PCI DMA APIsPaolo Bonzini1-21/+21
It is wrong to use address_space_memory directly, because there could be an IOMMU in the middle. Passing the entire PVSCSIRingInfo to RS_GET_FIELD and RS_SET_FIELD makes it easy to go back to the PVSCSIState. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25megasas: use PCI DMA APIsPaolo Bonzini1-27/+24
It is wrong to use address_space_memory directly, because there could be an IOMMU in the middle. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25i6300esb: Fix signed integer overflowDavid Gibson1-2/+8
If the guest programs a sufficiently large timeout value an integer overflow can occur in i6300esb_restart_timer(). e.g. if the maximum possible timer preload value of 0xfffff is programmed then we end up with the calculation: timeout = get_ticks_per_sec() * (0xfffff << 15) / 33000000; get_ticks_per_sec() returns 1000000000 (10^9) giving: 10^9 * (0xfffff * 2^15) == 0x1dcd632329b000000 (65 bits) Obviously the division by 33MHz brings it back under 64-bits, but the overflow has already occurred. Since signed integer overflow has undefined behaviour in C, in theory this could be arbitrarily bad. In practice, the overflowed value wraps around to something negative, causing the watchdog to immediately expire, killing the guest, which is still fairly bad. The bug can be triggered by running a Linux guest, loading the i6300esb driver with parameter "heartbeat=2046" and opening /dev/watchdog. The watchdog will trigger as soon as the device is opened. This patch corrects the problem by using muldiv64(), which effectively allows a 128-bit intermediate value between the multiplication and division. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <1427075508-12099-3-git-send-email-david@gibson.dropbear.id.au> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25i6300esb: Correct endiannnessDavid Gibson1-1/+1
The IO operations for the i6300esb watchdog timer are marked as DEVICE_NATIVE_ENDIAN. This is not correct, and - as a PCI device - should be DEVICE_LITTLE_ENDIAN. This allows i6300esb to work on ppc targets (yes, using an Intel ICH derived device on ppc is a bit odd, but the driver exists on the guest and there's no more obviously suitable watchdog device). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <1427075508-12099-2-git-send-email-david@gibson.dropbear.id.au> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-25fw_cfg: factor out initialization of FW_CFG_ID (rev. number)Gabriel L. Somlo6-5/+1
The fw_cfg documentation says this of the revision key (0x0001, FW_CFG_ID): > A 32-bit little-endian unsigned int, this item is used as an interface > revision number, and is currently set to 1 by all QEMU architectures > which expose a fw_cfg device. arm/virt doesn't. It could be argued that that's an error in "hw/arm/virt.c"; on the other hand, all of the other fw_cfg providing boards set the interface version to 1 manually, despite the device coming from the same, shared implementation. Therefore, instead of adding fw_cfg_add_i32(fw_cfg, FW_CFG_ID, 1); to arm/virt, consolidate all such existing calls in the fw_cfg initialization code. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Message-Id: <1426789244-26318-1-git-send-email-somlo@cmu.edu> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-23ahci: Fix sglist offset manipulation for BE machinesJohn Snow1-1/+1
This does not bother DMA, because DMA generally transfers the entire SGList in one shot if it can. PIO, on the other hand, tries to transfer just one sector at a time, and will make multiple visits to the sglist to fetch memory addresses. Fix the memory address calculaton when we have an offset by moving the offset addition OUTSIDE of the le64_to_cpu calculation. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Andreas Färber <afaerber@suse.de> Message-id: 1426811056-2202-4-git-send-email-jsnow@redhat.com
2015-03-23ide: fix cmd_read_pio when nsectors > 1John Snow1-5/+3
Similar to the cmd_write_pio fix, update the nsector count and ide sector before we invoke ide_transfer_start. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Andreas Färber <afaerber@suse.de> Message-id: 1426811056-2202-3-git-send-email-jsnow@redhat.com
2015-03-23ide: fix cmd_write_pio when nsectors > 1John Snow1-1/+1
We need to adjust the sector being written to prior to calling ide_transfer_start, otherwise we'll write to the same sector again. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Andreas Färber <afaerber@suse.de> Message-id: 1426811056-2202-2-git-send-email-jsnow@redhat.com
2015-03-20Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into ↵Peter Maydell2-8/+0
staging X86 queue 2015-03-19 # gpg: Signature made Thu Mar 19 19:40:17 2015 GMT using RSA key ID 984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-pull-request: target-i386: Haswell-noTSX and Broadwell-noTSX Revert "target-i386: Disable HLE and RTM on Haswell & Broadwell" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-20Merge remote-tracking branch ↵Peter Maydell1-0/+9
'remotes/ehabkost/tags/work/numa-verify-cpus-pull-request' into staging NUMA queue 2015-03-19 # gpg: Signature made Thu Mar 19 19:25:53 2015 GMT using RSA key ID 984DC5A6 # gpg: Can't check signature: public key not found * remotes/ehabkost/tags/work/numa-verify-cpus-pull-request: numa: Print warning if no node is assigned to a CPU pc: fix default VCPU to NUMA node mapping numa: introduce machine callback for VCPU to node mapping numa: Reject configuration if CPU appears on multiple nodes numa: Reject CPU indexes > max_cpus numa: Fix off-by-one error at MAX_CPUMASK_BITS check Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-20Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150320-1' into ↵Peter Maydell9-86/+131
staging usb: bugfix collection. # gpg: Signature made Fri Mar 20 07:51:19 2015 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-20150320-1: ehci: fix segfault when hot-unplugging ehci controller ohci: fix resource cleanup leak uhci: fix segfault when hot-unplugging uhci controller hw/usb: Include USB files only if necessary usb/dev-storage: Avoid qerror_report_err() outside QMP handlers usb/dev-storage: Fix QMP device_add missing encryption key failure monitor usb: Inline monitor_read_bdrv_key_start()'s first part monitor: Plug memory leak in monitor_read_bdrv_key_start() monitor: Drop dead QMP check from monitor_read_password() uhci: Convert to realize ohci: Complete conversion to realize usb: Improve companion configuration error messages usb: Propagate errors through usb_register_companion() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-20ehci: fix segfault when hot-unplugging ehci controllerGonglei4-2/+22
When hot-unplugging the usb controllers (ehci/uhci), we have to clean all resouce of these devices, involved registered reset handler. Otherwise, it may cause NULL pointer access and/or segmentation fault if we reboot the guest os after hot-unplugging. Let's hook up reset via DeviceClass->reset() and drop the qemu_register_reset() call. Then Qemu will register and unregister the reset handler automatically. Cc: qemu-stable <qemu-stable@nongnu.org> Reported-by: Lidonglin <lidonglin@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-20ohci: fix resource cleanup leakGonglei1-1/+19
When hot-unplugging the usb controllers (ehci/uhci), we have to clean all resouce of these devices, involved registered reset handler. Otherwise, it may cause NULL pointer access and/or segmentation fault if we reboot the guest os after hot-unplugging. Let's hook up reset via DeviceClass->reset() and drop the qemu_register_reset() call. Then Qemu will register and unregister the reset handler automatically. Ohci does't support hotplugging/hotunplugging yet, but existing resource cleanup leak logic likes ehci/uhci. Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-20uhci: fix segfault when hot-unplugging uhci controllerGonglei1-6/+6
When hot-unplugging the usb controllers (ehci/uhci), we have to clean all resouce of these devices, involved registered reset handler. Otherwise, it may cause NULL pointer access and/or segmentation fault if we reboot the guest os after hot-unplugging. Let's hook up reset via DeviceClass->reset() and drop the qemu_register_reset() call. Then Qemu will register and unregister the reset handler automatically. Cc: qemu-stable <qemu-stable@nongnu.org> Reported-by: Lidonglin <lidonglin@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-19Revert "target-i386: Disable HLE and RTM on Haswell & Broadwell"Eduardo Habkost2-8/+0
This reverts commit 13704e4c455770d500d6b87b117e32f0d01252c9. With the Intel microcode update that removed HLE and RTM, there will be different kinds of Haswell and Broadwell CPUs out there: some that still have the HLE and RTM features, and some that don't have the HLE and RTM features. On both cases people may be willing to use the pc-*-2.3 machine-types. So instead of making the CPU model results confusing by making it depend on the machine-type, keep HLE and RTM on the existing Haswell and Broadwell CPU models. The plan is to introduce "Haswell-noTSX" and "Broadwell-noTSX" CPU models later, for people who have CPUs that don't have TSX feature available. Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2015-03-19pc: fix default VCPU to NUMA node mappingIgor Mammedov1-0/+9
Since commit dd0247e0 pc: acpi: mark all possible CPUs as enabled in SRAT Linux kernel actually tries to use CPU to Node mapping from QEMU provided SRAT table instead of discarding it, and that in some cases breaks build_sched_domains() which expects sane mapping where cores/threads belonging to the same socket are on the same NUMA node. With current default round-robin mapping of VCPUs to nodes guest ends-up with cores/threads belonging to the same socket being on different NUMA nodes. For example with following CLI: qemu-system-x86_64 -m 4G \ -cpu Opteron_G3,vendor=AuthenticAMD \ -smp 5,sockets=1,cores=4,threads=1,maxcpus=8 \ -numa node,nodeid=0 -numa node,nodeid=1 2.6.32 based kernels will hang on boot due to incorrectly built sched_group-s list in update_sd_lb_stats() Replacing default mapping with a manual, where VCPUs belonging to the same socket are on the same NUMA node, fixes the issue for guests which can't handle nonsense topology i.e. changing CLI to: -numa node,nodeid=0,cpus=0-3 -numa node,nodeid=1,cpus=4-7 So instead of simply scattering VCPUs around nodes, provide callback to map the same socket VCPUs to the same NUMA node, which is what guests would expect from a sane hardware/BIOS. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2015-03-19Merge remote-tracking branch 'remotes/amit/tags/vser-for-2.3-3' into stagingPeter Maydell1-0/+31
virtio-serial api: guest_writable callback for users # gpg: Signature made Thu Mar 19 12:06:55 2015 GMT using RSA key ID 854083B6 # gpg: Good signature from "Amit Shah <amit@amitshah.net>" # gpg: aka "Amit Shah <amit@kernel.org>" # gpg: aka "Amit Shah <amitshah@gmx.net>" * remotes/amit/tags/vser-for-2.3-3: virtio: serial: expose a 'guest_writable' callback for users Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-19Merge remote-tracking branch ↵Peter Maydell32-74/+133
'remotes/mjt/tags/pull-trivial-patches-2015-03-19' into staging trivial patches for 2015-03-19 # gpg: Signature made Thu Mar 19 08:57:54 2015 GMT using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" * remotes/mjt/tags/pull-trivial-patches-2015-03-19: (24 commits) qga/commands-posix: Fix resource leak elf-loader: Add missing error handling for call of lseek elf-loader: Fix truncation warning from coverity hmp: Fix texinfo documentation Fix typos in comments qtest/ahci: Fix a bit mask expression vl: fix resource leak with monitor_fdset_add_fd smbios: add max speed comdline option for type-17 (meory device) structure pc-dimm: Add description for device list. configure: enable kvm on x32 error: Replace error_report() & error_free() with error_report_err() arm: fix memory leak qmp: Drop unused .user_print from command definitions hmp: Fix definition of command quit target-moxie: Fix warnings from Sparse (one-bit signed bitfield) block/qapi: Fix Sparse warning Fix remaining warnings from Sparse (void return) qom: Fix warning from Sparse target-mips: Fix warning from Sparse arm/nseries: Fix warnings from Sparse ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-19virtio: serial: expose a 'guest_writable' callback for usersAmit Shah1-0/+31
Users of virtio-serial may want to know when a port becomes writable. A port can stop accepting writes if the guest port is open but not being read from. In this case, data gets queued up in the virtqueue, and after the vq is full, writes to the port do not succeed. When the guest reads off a vq element, and adds a new one for the host to put data in, we can tell users the port is available for more writes, via the new ->guest_writable() callback. Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2015-03-19Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell3-8/+9
pci, virtio bugfixes for 2.3 Just a bunch of bugfixes. Should be nothing remarkable here. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed Mar 18 12:31:03 2015 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: pcie_aer: fix comment to match pcie spec pci: fix several trivial typos in comment aer: fix a wrong init PCI_ERR_COR_STATUS w1cmask type register pcie_aer: fix typos in pcie_aer_inject_error comment aer: fix wrong check on expose aer tlp prefix log pcie: correct mistaken register bit for End-End TLP Prefix Blocking virtio: Fix memory leaks reported by Coverity virtio: validate the existence of handle_output before calling it Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-19elf-loader: Fix truncation warning from coverityStefan Weil1-1/+1
Coverity reports a truncation due to cast operation on operand reltab->sh_size from 64 bits to 32 bits for calls of load_at. Fix the types of the function arguments to match their use in function load_at: the offset is used for lseek which takes an off_t parameter, the size is used for g_malloc and read. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-03-19smbios: add max speed comdline option for type-17 (meory device) structureGabriel L. Somlo1-2/+8
Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-03-19pc-dimm: Add description for device list.Paulo Vital1-0/+1
The pc-dimm option presented on device list (by argument "-device \?") is the unique option that don't have any information about it. This patch adds a description for the pc-dimm device to help users to identify it. Signed-off-by: Paulo Vital <paulo.vital@profitbricks.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
generated by cgit v1.1 at 2024-12-26 06:38:22 +0000