1. 12 7月, 2016 5 次提交
    • A
      xen-usb: Fix 32bit build · 042ec47e
      Anthony PERARD 提交于
      Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
      Reviewed-by: NJuergen Gross <jgross@suse.com>
      Message-id: 20160623110829.22671-1-anthony.perard@citrix.com
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      042ec47e
    • G
      usb: add storage hotplug documentation · b91e0139
      Gerd Hoffmann 提交于
      Suggested-by: NPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      Message-id: 1466667901-1341-1-git-send-email-kraxel@redhat.com
      b91e0139
    • Z
      nec-usb-xhci: set the device state to USB_STATE_DEFAULT · a4055d85
      Zhang Shuaiyi 提交于
      This patch is a rough fix to "hw/usb/core.c:401: usb_handle_packet:
       Assertion `dev->state == 3' failed.". Qemu will crash when a usb3
      device redirect to Windows7 VM via nec-usb-xhci.
      
      In extensible-host-controler-interface-usb-xhci.pdf P94(4.6.5
      Address Device):
          • If the Block Set Address Request (BSR) flag = ‘1’
              • If the slot is in the Enabled state:
                  ...
                  • Set the Slot State in the Output Slot Context to Default.
      
      BSR = ‘1’: Enabled state to Default state; BSR = ‘0’: Default state
      to Addressed state. Try to call usb_device_reset to set device state
      to USB_STATE_DEFAULT in xhci_address_slot wether bsr is zero.
      Signed-off-by: NZhang Shuaiyi <zhang_syi@massclouds.com>
      Message-id: 1467258640-11921-1-git-send-email-zhang_syi@massclouds.com
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      a4055d85
    • P
      Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20160711' into staging · f1ef5578
      Peter Maydell 提交于
      Last round of s390x patches for 2.7:
      - A large update of the s390x PCI code, bringing it in line with
        the architecture
      - Fixes and improvements in the ipl (boot) code
      - Refactoring in the css code
      
      # gpg: Signature made Mon 11 Jul 2016 09:04:51 BST
      # gpg:                using RSA key 0xDECF6B93C6F02FAF
      # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
      # gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
      # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF
      
      * remotes/cohuck/tags/s390x-20160711: (25 commits)
        s390x/pci: make hot-unplug handler smoother
        s390x/pci: replace fid with idx in msg data of msix
        s390x/pci: fix stpcifc_service_call
        s390x/pci: refactor list_pci
        s390x/pci: refactor s390_pci_find_dev_by_idx
        s390x/pci: add checkings in CLP_SET_PCI_FN
        s390x/pci: enable zpci hot-plug/hot-unplug
        s390x/pci: enable uid-checking
        s390x/pci: introduce S390PCIBusDevice qdev
        s390x/pci: introduce S390PCIIOMMU
        s390x/pci: introduce S390PCIBus
        s390x/pci: enforce zPCI state checking
        s390x/pci: refactor s390_pci_find_dev_by_fh
        s390x/pci: unify FH_ macros
        s390x/pci: write fid in CLP_QUERY_PCI_FN
        s390x/pci: acceleration for getting S390pciState
        s390x/pci: fix failures of dma map/unmap
        s390x/css: Unplug handler of virtual css bridge
        s390x/css: Factor out virtual css bridge and bus
        s390x/css: use define for "virtual-css-bridge" literal
        ...
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      f1ef5578
    • P
      Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20160708' into staging · 7de2cc8f
      Peter Maydell 提交于
      two self-modifying code fixes
      
      # gpg: Signature made Fri 08 Jul 2016 21:28:50 BST
      # gpg:                using RSA key 0xAD1270CC4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"
      # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC  16A4 AD12 70CC 4DD0 279B
      
      * remotes/rth/tags/pull-tcg-20160708:
        translate-all: Fix user-mode self-modifying code in 2 page long TB
        cputlb: Fix for self-modifying writes across page boundaries
        cputlb: Add address parameter to VICTIM_TLB_HIT
        cputlb: Move VICTIM_TLB_HIT out of line
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      7de2cc8f
  2. 11 7月, 2016 29 次提交
  3. 09 7月, 2016 4 次提交
    • S
      translate-all: Fix user-mode self-modifying code in 2 page long TB · 7399a337
      Stanislav Shmarov 提交于
      In user-mode emulation Translation Block can consist of 2 guest pages.
      In that case QEMU also mprotects 2 host pages that are dedicated for
      guest memory, containing instructions. QEMU detects self-modifying code
      with SEGFAULT signal processing.
      
      In case if instruction in 1st page is modifying memory of 2nd
      page (or vice versa) QEMU will mark 2nd page with PAGE_WRITE,
      invalidate TB, generate new TB contatining 1 guest instruction and
      exit to CPU loop. QEMU won't call mprotect, and new TB will cause
      same SEGFAULT. Page will have both PAGE_WRITE_ORG and PAGE_WRITE
      flags, so QEMU will handle the signal as guest binary problem,
      and exit with guest SEGFAULT.
      
      Solution is to do following: In case if current TB was invalidated
      continue to invalidate TBs from remaining guest pages and mark pages
      as PAGE_WRITE. After that disable host page protection with mprotect.
      If current tb was invalidated longjmp to main loop. That is more
      efficient, since we won't get SEGFAULT when executing new TB.
      Reviewed-by: NSergey Fedorov <sergey.fedorov@linaro.org>
      Signed-off-by: NStanislav Shmarov <snarpix@gmail.com>
      Message-Id: <1467880392-1043630-1-git-send-email-snarpix@gmail.com>
      Signed-off-by: NRichard Henderson <rth@twiddle.net>
      7399a337
    • S
      cputlb: Fix for self-modifying writes across page boundaries · 81daabaf
      Samuel Damashek 提交于
      As it currently stands, QEMU does not properly handle self-modifying code
      when the write is unaligned and crosses a page boundary. The procedure
      for handling a write to the current translation block is to write-protect
      the current translation block, catch the write, split up the translation
      block into the current instruction (which remains write-protected so that
      the current instruction is not modified) and the remaining instructions
      in the translation block, and then restore the CPU state to before the
      write occurred so the write will be retried and successfully executed.
      However, since unaligned writes across pages are split into one-byte
      writes for simplicity, writes to the second page (which is not the
      current TB) may succeed before a write to the current TB is attempted,
      and since these writes are not invalidated before resuming state after
      splitting the TB, these writes will be performed a second time, thus
      corrupting the second page. Credit goes to Patrick Hulin for
      discovering this.
      
      In recent 64-bit versions of Windows running in emulated mode, this
      results in either being very unstable (a BSOD after a couple minutes of
      uptime), or being entirely unable to boot. Windows performs one or more
      8-byte unaligned self-modifying writes (xors) which intersect the end
      of the current TB and the beginning of the next TB, which runs into the
      aforementioned issue. This commit fixes that issue by making the
      unaligned write loop perform the writes in forwards order, instead of
      reverse order. This way, QEMU immediately tries to write to the current
      TB, and splits the TB before any write to the second page is executed.
      The write then proceeds as intended. With this patch applied, I am able
      to boot and use Windows 7 64-bit and Windows 10 64-bit in QEMU without
      KVM.
      
      Per Richard Henderson's input, this patch also ensures the second page
      is in the TLB before executing the write loop, to ensure the second
      page is mapped.
      
      The original discussion of the issue is located at
      http://lists.nongnu.org/archive/html/qemu-devel/2014-08/msg02161.html.
      Signed-off-by: NSamuel Damashek <samuel.damashek@invincea.com>
      Message-Id: <20160706182652.16190-1-samuel.damashek@invincea.com>
      Signed-off-by: NRichard Henderson <rth@twiddle.net>
      81daabaf
    • S
      cputlb: Add address parameter to VICTIM_TLB_HIT · a390284b
      Samuel Damashek 提交于
      [rth: Split out from the original patch.]
      Signed-off-by: NSamuel Damashek <samuel.damashek@invincea.com>
      Message-Id: <20160706182652.16190-1-samuel.damashek@invincea.com>
      Signed-off-by: NRichard Henderson <rth@twiddle.net>
      a390284b
    • R
      cputlb: Move VICTIM_TLB_HIT out of line · 7e9a7c50
      Richard Henderson 提交于
      There are currently 22 invocations of this function,
      and we're about to increase that number.
      Signed-off-by: NRichard Henderson <rth@twiddle.net>
      7e9a7c50
  4. 08 7月, 2016 2 次提交