- 16 3月, 2017 7 次提交
-
-
由 Jason Wang 提交于
We don't reset proxy->vqs[].{num|desc[]|avail[]|used[]}. This means if a driver enable the vq without setting vq address after reset. The old addresses were leaked. Fixing this by resetting modern vq meta data during device reset. Cc: qemu-stable@nongnu.org Signed-off-by: NJason Wang <jasowang@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Jason Wang 提交于
This reverts commit 96a8821d. Previous patch is a better solution which does not require a strict order between virtio and IOMMU. CC: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Jason Wang 提交于
96a8821d ("virtio: unbreak virtio-pci with IOMMU after caching ring translations") tries to make IOMMU works with virtio memory region cache, but it requires IOMMU to be created before any virtio devices. This is sub optimal, fixing this by introduce a bus master container to make sure address space can be initialized during device registering, and then we can safely set alias and make bus_master_enable_region as its subregion during bus master initialization. Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: NJason Wang <jasowang@redhat.com> Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Jason Wang 提交于
We don't check the return value of address_space_cache_init(), this may lead buggy driver use incorrect region caches. Instead of triggering an assert, catch and warn this early in virtio_init_region_cache(). Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: NJason Wang <jasowang@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Jason Wang 提交于
We don't destroy region cache during reset which can make the maps of previous driver leaked to a buggy or malicious driver that don't set vring address before starting to use the device. Fix this by destroy the region cache during reset and validate it before trying to see them. Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: NJason Wang <jasowang@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Jason Wang 提交于
To avoid access stale memory region cache after reset, this patch check the existence of virtqueue pfn for all exported virtqueue access helpers before trying to use them. Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: NJason Wang <jasowang@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Ben Warren 提交于
This was crashing due to NULL-pointer dereference QMP Test case: ============== (QEMU) query-vm-generation-id {"error": {"class": "GenericError", "desc": "VM Generation ID device not found"}} HMP Test case: ============== virsh # qemu-monitor-command --hmp 3 info vm-generation-id VM Generation ID device not found Signed-off-by: NBen Warren <ben@skyportsystems.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com>
-
- 15 3月, 2017 2 次提交
-
-
由 Eduardo Habkost 提交于
Original problem description by Greg Kurz: > Since commit "9a4c0e22 hw/virtio-pci: fix virtio > behaviour", passing -device virtio-blk-pci.disable-modern=off > has no effect on 2.6 machine types because the internal > virtio-pci.disable-modern=on compat property always prevail. The same bug also affects other abstract type names mentioned on compat_props by machine-types: apic-common, i386-cpu, pci-device, powerpc64-cpu, s390-skeys, spapr-pci-host-bridge, usb-device, virtio-pci, x86_64-cpu. The right fix for this problem is to make sure compat_props and -global options are always applied in the order they are registered, instead of reordering them based on the type hierarchy. But changing the ordering rules of -global is risky and might break existing configurations, so we shouldn't do that on a stable branch. This is a temporary hack that will work around the bug when registering compat_props properties: if we find an abstract class on compat_props, register properties for all its non-abstract subtypes instead. This will make sure -global won't be overridden by compat_props, while keeping the existing ordering rules on -global options. Note that there's one case that won't be fixed by this hack: "-global spapr-pci-vfio-host-bridge.<option>=<value>" won't be able to override compat_props, because spapr-pci-host-bridge is not an abstract class. Signed-off-by: NEduardo Habkost <ehabkost@redhat.com> Message-Id: <1481575745-26120-1-git-send-email-ehabkost@redhat.com> Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: NHalil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: NGreg Kurz <groug@kaod.org> Tested-by: NGreg Kurz <groug@kaod.org> Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
-
由 Peter Maydell 提交于
Commit 4881658a introduced a call to arm_get_cpu_by_id(), and Coverity noticed that we weren't checking that it didn't return NULL (CID 1371652). Normally this won't happen (because all 4 CPUs are expected to exist), but it's possible the user requested fewer CPUs on the command line. Handle this possibility by silently doing nothing, which is the same behaviour as before commit 4881658a and also how we handle the other CPU operations (since we ignore the INVALID_PARAM returns from arm_set_cpu_on() and friends). There is a slight behavioural difference to the pre-4881658a situation: the "reset this core" bit will remain set rather than not being permitted to be set. The imx6 datasheet is unclear about the behaviour in this odd corner case, so we opt for the simpler code rather than complicated logic to maintain identical behaviour. Signed-off-by: NPeter Maydell <peter.maydell@linaro.org> Message-id: 1488542374-1256-1-git-send-email-peter.maydell@linaro.org Reviewed-by: NAlex Bennée <alex.bennee@linaro.org>
-
- 14 3月, 2017 6 次提交
-
-
由 Paolo Bonzini 提交于
This dependency is the wrong way, and we will need util/qemu-timer.h from sysemu/cpus.h in the next patch. Reviewed-by: NAlex Bennée <alex.bennee@linaro.org> Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
-
由 Li Qiang 提交于
When fetching request, it should read sizeof(*hdr), not the pointer hdr. Signed-off-by: NLi Qiang <liqiang6-s@360.cn> Message-Id: <1489488980-130668-1-git-send-email-liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
-
由 Eduardo Habkost 提交于
Most machines don't allow sysbus devices like "kvmclock" to be created from the command-line, but some of them do (the ones with has_dynamic_sysbus=true). In those cases, it's possible to manually create a kvmclock device without KVM being enabled, making QEMU crash: $ qemu-system-x86_64 -machine q35,accel=tcg -device kvmclock Segmentation fault (core dumped) This changes kvmclock's realize method to return an error if KVM is disabled, to ensure it won't crash QEMU. Signed-off-by: NEduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309185046.17555-1-ehabkost@redhat.com> Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
-
由 Greg Ungerer 提交于
The FEC ethernet hardware module used on ColdFire SoC parts contains a block of RAM used to maintain hardware counters. This block is accessible via the usual FEC register address space. There is currently no support for this in the QEMU mcf_fec driver. Add support for storing a MIB RAM block, and provide register level access to it. Also implement a basic set of stats collection functions to populate MIB data fields. This support tested running a Linux target and using the net-tools "ethtool -S" option. As of linux-4.9 the kernels FEC driver makes accesses to the MIB counters during its initialization (which it never did before), and so this version of Linux will now fail with the QEMU error: qemu: hardware error: mcf_fec_read: Bad address 0x200 This MIB counter support fixes this problem. Signed-off-by: NGreg Ungerer <gerg@uclinux.org> Reviewed-by: NLaurent Vivier <laurent@vivier.eu> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Paolo Bonzini 提交于
MSI-X has been disabled by the time the e1000e device is unrealized, hence msix_uninit is never called. This causes the object to be leaked, which shows up as a RAMBlock with empty name when attempting migration. Reported-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com> Tested-by: NLaurent Vivier <lvivier@redhat.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 David Gibson 提交于
bb998645 "spapr_pci: Advertise access to PCIe extended config space" allowed guests to access the extended config space of PCI Express devices via the PAPR interfaces, even though the paravirtualized bus mostly acts like plain PCI. However, that patch enabled access unconditionally, including for existing machine types, which is an unwise change in behaviour. This patch limits the change to pseries-2.9 (and later) machine types. Suggested-by: NAndrea Bolognani <abologna@redhat.com> Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-
- 09 3月, 2017 4 次提交
-
-
由 Alex Bennée 提交于
While I was debugging the icount issues I realised a bunch of the messages look quite similar. I've fixed this by including __func__ in the debug print. At the same time I move the a modern if (GATE) style printf which ensures the compiler can check for format string errors even if the code gets optimised away in the non-DEBUG_GIC case. Signed-off-by: NAlex Bennée <alex.bennee@linaro.org> Reviewed-by: NPeter Maydell <peter.maydell@linaro.org> Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
-
由 Alex Bennée 提交于
IRQ modification is part of device emulation and should be done while the BQL is held to prevent races when MTTCG is enabled. This adds assertions in the hw emulation layer and wraps the calls from helpers in the BQL. Reported-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
-
由 Gerd Hoffmann 提交于
Make sure we don't leave guest_cursor pointing into nowhere. This might lead to (rare) live migration failures, due to target trying to restore the cursor from the stale pointer. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1421788Reported-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1488789111-27340-1-git-send-email-kraxel@redhat.com
-
由 Gerd Hoffmann 提交于
The strict td link limit added by commit "95ed5693 usb: ohci: limit the number of link eds" causes problems with macos guests. Lets raise the limit. Reported-by: NProgrammingkid <programmingkidx@gmail.com> Reported-by: NHoward Spoelstra <hsp.cat7@gmail.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Reviewed-by: NBALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: NJohn Arbuckle <programmingkidx@gmail.com> Message-id: 1488876018-31576-1-git-send-email-kraxel@redhat.com
-
- 07 3月, 2017 6 次提交
-
-
由 Greg Kurz 提交于
We should pass O_NOFOLLOW otherwise openat() will follow symlinks and make QEMU vulnerable. While here, we also fix local_unlinkat_common() to use openat_dir() for the same reasons (it was a leftover in the original patchset actually). This fixes CVE-2016-9602. Signed-off-by: NGreg Kurz <groug@kaod.org> Reviewed-by: NDaniel P. Berrange <berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com>
-
由 Greg Kurz 提交于
When O_PATH is used with O_DIRECTORY, it only acts as an optimization: the openat() syscall simply finds the name in the VFS, and doesn't trigger the underlying filesystem. On systems that don't define O_PATH, because they have glibc version 2.13 or older for example, we can safely omit it. We don't want to deactivate O_PATH globally though, in case it is used without O_DIRECTORY. The is done with a dedicated macro. Systems without O_PATH may thus fail to resolve names that involve unreadable directories, compared to newer systems succeeding, but such corner case failure is our only option on those older systems to avoid the security hole of chasing symlinks inappropriately. Signed-off-by: NGreg Kurz <groug@kaod.org> Reviewed-by: NEric Blake <eblake@redhat.com> (added last paragraph to changelog as suggested by Eric Blake) Signed-off-by: NGreg Kurz <groug@kaod.org>
-
由 Greg Kurz 提交于
The name argument can never be an empty string, and dirfd always point to the containing directory of the file name. AT_EMPTY_PATH is hence useless here. Also it breaks build with glibc version 2.13 and older. It is actually an oversight of a previous tentative patch to implement this function. We can safely drop it. Reported-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: NGreg Kurz <groug@kaod.org> Tested-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: NEric Blake <eblake@redhat.com>
-
由 Greg Kurz 提交于
If we cannot open the given path, we can return right away instead of passing -1 to fstatfs() and close(). This will make Coverity happy. (Coverity issue CID1371729) Signed-off-by: NGreg Kurz <groug@kaod.org> Reviewed-by: NDaniel P. berrange <berrange@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
-
由 Greg Kurz 提交于
Coverity issue CID1371731 Signed-off-by: NGreg Kurz <groug@kaod.org> Reviewed-by: NDaniel P. Berrange <berrange@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
-
由 Greg Kurz 提交于
This was spotted by Coverity as a fd leak. This is certainly true, but also local_remove() would always return without doing anything, unless the fd is zero, which is very unlikely. (Coverity issue CID1371732) Signed-off-by: NGreg Kurz <groug@kaod.org> Reviewed-by: NEric Blake <eblake@redhat.com>
-
- 06 3月, 2017 9 次提交
-
-
由 Dr. David Alan Gilbert 提交于
Fairly simple mechanical conversion of all fields. TODO!!!! The problem is vmxnet3-ring size/cell_size/next are declared as size_t but written as 32bit. Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: NDmitry Fleytman <dmitry@daynix.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Dr. David Alan Gilbert 提交于
The index's in the Vmxnet3Ring were migrated as 32bit ints yet are declared as size_t's. They appear to be derived from 32bit values loaded from guest memory, so actually store them as that. Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: NDmitry Fleytman <dmitry@daynix.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Dmitry Fleytman 提交于
This is a refactoring commit that does not change behavior. Signed-off-by: NDmitry Fleytman <dmitry@daynix.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Dmitry Fleytman 提交于
In case of VLAN stripping ETH header is stored in a separate chunk and length of IOV should take this into account. This patch fixes checksum validation for RX packets with VLAN header. Devices affected by this problem: e1000e and vmxnet3. Cc: qemu-stable@nongnu.org Signed-off-by: NDmitry Fleytman <dmitry@daynix.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Dmitry Fleytman 提交于
In case of VLAN stripping, ETH header put into a separate buffer, therefore amont of data copied from original IOV should be smaller. Cc: qemu-stable@nongnu.org Signed-off-by: NDmitry Fleytman <dmitry@daynix.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Dmitry Fleytman 提交于
This patch fixed a problem that was introduced in commit eb700029. When net_rx_pkt_attach_iovec() calls eth_strip_vlan() this can result in pkt->ehdr_buf being overflowed, because ehdr_buf is only sizeof(struct eth_header) bytes large but eth_strip_vlan() can write sizeof(struct eth_header) + sizeof(struct vlan_header) bytes into it. Devices affected by this problem: vmxnet3. Cc: qemu-stable@nongnu.org Reported-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NDmitry Fleytman <dmitry@daynix.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Fam Zheng 提交于
This has been pointless since commit 605d52e6, which was a search-and-replace, overlooked the redundancy. Signed-off-by: NFam Zheng <famz@redhat.com> Reviewed-by: NDmitry Fleytman <dmitry@daynix.com> Signed-off-by: NJason Wang <jasowang@redhat.com>
-
由 Igor Mammedov 提交于
Threads within a core shouldn't be on different NUMA nodes, so if user has misconfgured command line, fail QEMU at start up to force user fix it. For now use the first thread on the core as source of core's node-id. Later when cpu-numa refactoring lands it will be switched to core's node-id from possible_cpus[]. This prevents the same problems as commit 20bb648d "spapr: Fix default NUMA node allocation for threads", but for the case of manually configured NUMA node mappings, instead of just the default case. Signed-off-by: NIgor Mammedov <imammedo@redhat.com> Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-
由 Cédric Le Goater 提交于
The recent changes on the XICS layer removed the XICSState object to let the sPAPR machine handle the ICP and ICS directly. The reset of these objects was previously handled by XICSState, which was a SysBus device, and to keep the same behavior, the ICP and ICS were assigned to SysbBus. But that broke the 'info qtree' command in the monitor. 'qtree' performs a loop on the children of a bus to print their properties and SysBus devices are expected to be found under SysBus, which is not the case anymore. The fix for this problem is to register reset handlers for the ICP and ICS objects and stop using SysBus for such devices. Signed-off-by: NCédric Le Goater <clg@kaod.org> Reviewed-by: NThomas Huth <thuth@redhat.com> Tested-by: NThomas Huth <thuth@redhat.com> Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-
- 05 3月, 2017 1 次提交
-
-
由 Markus Armbruster 提交于
Fix the design flaw demonstrated in the previous commit: new method check_list() lets input visitors report that unvisited input remains for a list, exactly like check_struct() lets them report that unvisited input remains for a struct or union. Implement the method for the qobject input visitor (straightforward), and the string input visitor (less so, due to the magic list syntax there). The opts visitor's list magic is even more impenetrable, and all I can do there today is a stub with a FIXME comment. No worse than before. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Message-Id: <1488544368-30622-26-git-send-email-armbru@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com>
-
- 03 3月, 2017 5 次提交
-
-
由 Sam Bobroff 提交于
The PPC MMU types are sometimes treated as if they were a bit field and sometime as if they were an enum which causes maintenance problems: flipping bits in the MMU type (which is done on both the 1TB segment and 64K segment bits) currently produces new MMU type values that are not handled in every "switch" on it, sometimes causing an abort(). This patch provides some macros that can be used to filter out the "bit field-like" bits so that the remainder of the value can be switched on, like an enum. This allows removal of all of the "degraded" types from the list and should ease maintenance. Signed-off-by: NSam Bobroff <sam.bobroff@au1.ibm.com> Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-
由 David Gibson 提交于
The (paravirtual) PCI host bridge on the 'pseries' machine in most regards acts like a regular PCI bus, rather than a PCIe bus. Despite this, though, it does allow access to the PCIe extended config space. We already implemented the RTAS methods to allow this access.. but forgot to put the markers into the device tree so that guest's know it is there. This adds them in. With this, a pseries guest is able to view extended config space on (for example an e1000e device. This should be enough to allow guests to use at least some PCIe devices. Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-
由 Suraj Jitindar Singh 提交于
Add POWER9 cpu to list of spapr core models which allows it to be specified as the cpu model for a pseries guest (e.g. -machine pseries -cpu POWER9). This now allows a POWER9 cpu to boot to userspace in tcg emulation for a pseries machine with a legacy kernel. Signed-off-by: NSuraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: NDavid Gibson <david@gibson.dropbear.id.au> Acked-by: NBalbir Singh <bsingharora@gmail.com> Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-
由 Suraj Jitindar Singh 提交于
Add a pa-features definition which includes all of the new fields which have been added, note we don't claim support for any of these new features at this stage. Signed-off-by: NSuraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: NDavid Gibson <david@gibson.dropbear.id.au> Acked-by: NBalbir Singh <bsingharora@gmail.com> Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-
由 Suraj Jitindar Singh 提交于
ISA v3.00 adds the idea of a partition table which is used to store the address translation details for all partitions on the system. The partition table consists of double word entries indexed by partition id where the second double word contains the location of the process table in guest memory. The process table is registered by the guest via a h-call. We need somewhere to store the address of the process table so we add an entry to the sPAPRMachineState struct called patb_entry to represent the second doubleword of a single partition table entry corresponding to the current guest. We need to store this value so we know if the guest is using radix or hash translation and the location of the corresponding process table in guest memory. Since we only have a single guest per qemu instance, we only need one entry. Since the partition table is technically a hypervisor resource we require that access to it is abstracted by the virtual hypervisor through the get_patbe() call. Currently the value of the entry is never set (and thus defaults to 0 indicating hash), but it will be required to both implement POWER9 kvm support and tcg radix support. We also add this field to be migrated as part of the sPAPRMachineState as we will need it on the receiving side as the guest will never tell us this information again and we need it to perform translation. Signed-off-by: NSuraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: NDavid Gibson <david@gibson.dropbear.id.au> Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
-