summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
...
| * | block: Drop blk_new_with_bs()Max Reitz2016-05-252-24/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Its only caller is blk_new_open(), so we can just inline it there. The bdrv_new_root() call is dropped in the process because we can just let bdrv_open() create the BDS. Signed-off-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| * | tests: Drop BDS from test-throttle.cMax Reitz2016-05-251-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Now that throttling has been moved to the BlockBackend level, we do not need to create a BDS along with the BB in the I/O throttling test. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| * | block: Let bdrv_open_inherit() return the snapshotMax Reitz2016-05-251-7/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If bdrv_open_inherit() creates a snapshot BDS and *pbs is NULL, that snapshot BDS should be returned instead of the BDS under it. This has worked so far because (nearly) all users of BDRV_O_SNAPSHOT use blk_new_open() to create the BDS tree. bdrv_append() (which is called by bdrv_append_temp_snapshot()) redirects pointers from parents (i.e. the BB in this case) to the newly appended child (i.e. the overlay), therefore, while bdrv_open_inherit() did not return the root BDS, the BB still pointed to it. The only instance where BDRV_O_SNAPSHOT is used but blk_new_open() is not is in blockdev_init() if no BDS tree is created, and instead blk_new() is used and the flags are stored in the BB root state. However, qmp_blockdev_change_medium() filters the BDRV_O_SNAPSHOT flag before invoking bdrv_open(), so it will not have any effect. In any case, it would be nicer if bdrv_open_inherit() could just always return the root of the BDS tree that has been created. To this end, bdrv_append_temp_snapshot() now returns the snapshot BDS instead of just appending it on top of the snapshotted BDS. Also, it calls bdrv_ref() before bdrv_append() (which bdrv_open_inherit() has to undo if not returning the overlay). Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| * | block: Drop useless bdrv_new() callMax Reitz2016-05-251-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bdrv_append_temp_snapshot() uses bdrv_new() to create an empty BDS before invoking bdrv_open() on that BDS. This is probably a relict from when it used to do some modifications on that empty BDS, but now that is unnecessary, so we can just set bs_snapshot to NULL and let bdrv_open() do the rest. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| * | block: Fix bdrv_next() memory leakKevin Wolf2016-05-259-64/+92
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | The bdrv_next() users all leaked the BdrvNextIterator after completing the iteration. Simply changing bdrv_next() to free the iterator before returning NULL at the end of list doesn't work because some callers exit the loop before looking at all BDSes. This patch moves the BdrvNextIterator from the heap to the stack of the caller and switches to a bdrv_first()/bdrv_next() interface for initialising the iterator. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com>
* | qdev: Start disentangling bus from deviceAndreas Färber2016-05-264-222/+253
| | | | | | | | | | | | | | | | | | | | | | Move bus type and related APIs to a separate file bus.c. This is a first step in breaking up qdev.c into more manageable chunks. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [AF: Rebased onto osdep.h] Signed-off-by: Andreas Färber <afaerber@suse.de> [PMM: added bus.o to link line for test-qdev-global-props] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | cpu-exec: Fix direct jump to TB spanning pageSergey Fedorov2016-05-261-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is not safe to make a direct jump to a TB spanning two pages in system emulation because the mapping for the second page can get changed but we don't take care of direct jumps in this case. However in user mode emulation, this is not the case because there's only static address translation and TBs are always invalidated properly. Fixes: 5b053a4a2827 ("tcg: Clean up direct block chaining safety checks") Reported-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Signed-off-by: Sergey Fedorov <sergey.fedorov@linaro.org> Tested-by: Max Filippov <jcmvbkbc@gmail.com> Message-id: 1463404380-29302-1-git-send-email-sergey.fedorov@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge remote-tracking branch 'remotes/afaerber/tags/maintainers-for-peter' ↵Peter Maydell2016-05-261-5/+3
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Andreas stepping down from most maintainer positions # gpg: Signature made Wed 25 May 2016 16:53:45 BST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/maintainers-for-peter: MAINTAINERS: Drop Andreas as CPU maintainer MAINTAINERS: Drop Andreas as 0.15 maintainer MAINTAINERS: Drop Andreas as PReP maintainer MAINTAINERS: Drop Andreas as Cocoa maintainer Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * MAINTAINERS: Drop Andreas as CPU maintainerAndreas Färber2016-05-251-1/+1
| | | | | | | | Signed-off-by: Andreas Färber <afaerber@suse.de>
| * MAINTAINERS: Drop Andreas as 0.15 maintainerAndreas Färber2016-05-251-2/+1
| | | | | | | | | | | | Downgrade to orphan status, like all other remaining stable entries. Signed-off-by: Andreas Färber <afaerber@suse.de>
| * MAINTAINERS: Drop Andreas as PReP maintainerAndreas Färber2016-05-251-1/+1
| | | | | | | | Signed-off-by: Andreas Färber <andreas.faerber@web.de>
| * MAINTAINERS: Drop Andreas as Cocoa maintainerAndreas Färber2016-05-251-1/+0
|/ | | | | | Peter has taken over Cocoa maintainership. Signed-off-by: Andreas Färber <andreas.faerber@web.de>
* Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into ↵Peter Maydell2016-05-2413-300/+401
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging X86 queue, 2016-05-23 # gpg: Signature made Mon 23 May 2016 23:48:27 BST using RSA key ID 984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" * remotes/ehabkost/tags/x86-pull-request: target-i386: kvm: Eliminate kvm_msr_entry_set() target-i386: kvm: Simplify MSR setting functions target-i386: kvm: Simplify MSR array construction target-i386: kvm: Increase MSR_BUF_SIZE target-i386: kvm: Allocate kvm_msrs struct once per VCPU target-i386: Call cpu_exec_init() on realize target-i386: Move TCG initialization to realize time target-i386: Move TCG initialization check to tcg_x86_init() cpu: Eliminate cpudef_init(), cpudef_setup() target-i386: Set constant model_id for qemu64/qemu32/athlon pc: Set CPU model-id on compat_props for pc <= 2.4 osdep: Move default qemu_hw_version() value to a macro target-i386: kvm: Use X86XSaveArea struct for xsave save/load target-i386: Use xsave structs for ext_save_area target-i386: Define structs for layout of xsave area Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target-i386: kvm: Eliminate kvm_msr_entry_set()Eduardo Habkost2016-05-231-9/+3
| | | | | | | | | | | | | | Inline the function inside kvm_msr_entry_add(). Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: kvm: Simplify MSR setting functionsEduardo Habkost2016-05-231-21/+6
| | | | | | | | | | | | | | | | | | Simplify kvm_put_tscdeadline_msr() and kvm_put_msr_feature_control() using kvm_msr_buf and the kvm_msr_entry_add() helper. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: kvm: Simplify MSR array constructionEduardo Habkost2016-05-231-151/+140
| | | | | | | | | | | | | | | | Add a helper function that appends new entries to the MSR buffer and checks for the buffer size limit. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: kvm: Increase MSR_BUF_SIZEEduardo Habkost2016-05-231-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | We are dangerously close to the array limits in kvm_put_msrs() and kvm_get_msrs(): with the default mcg_cap configuration, we can set up to 148 MSRs in kvm_put_msrs(), and if we allow mcg_cap to be changed, we can write up to 236 MSRs. Use 4096 bytes for the buffer, that can hold 255 kvm_msr_entry structs. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: kvm: Allocate kvm_msrs struct once per VCPUEduardo Habkost2016-05-232-18/+23
| | | | | | | | | | | | | | | | | | Instead of using 2400 bytes in the stack for 150 MSR entries in kvm_get_msrs() and kvm_put_msrs(), allocate a buffer once for each VCPU. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: Call cpu_exec_init() on realizeEduardo Habkost2016-05-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QOM instance_init functions are not supposed to have any side-effects, as new objects may be created at any moment for querying property information (see qmp_device_list_properties()). Calling cpu_exec_init() also affects QEMU's ability to handle errors during CPU creation, as some actions done by cpu_exec_init() can't be reverted. Move cpu_exec_init() call to realize so a simple object_new() won't trigger it, and so that it is called after some basic validation of CPU parameters. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: Move TCG initialization to realize timeEduardo Habkost2016-05-231-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | QOM instance_init functions are not supposed to have any side-effects, as new objects may be created at any moment for querying property information (see qmp_device_list_properties()). Move TCG initialization to realize time so it won't be called when just doing object_new() on a X86CPU subclass. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: Move TCG initialization check to tcg_x86_init()Eduardo Habkost2016-05-232-3/+7
| | | | | | | | | | | | | | | | | | Instead of requiring cpu.c to check if TCG was already initialized, simply let the function be called multiple times. Suggested-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * cpu: Eliminate cpudef_init(), cpudef_setup()Eduardo Habkost2016-05-237-27/+0
| | | | | | | | | | | | | | x86_cpudef_init() doesn't do anything anymore, cpudef_init(), cpudef_setup(), and x86_cpudef_init() can be finally removed. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: Set constant model_id for qemu64/qemu32/athlonEduardo Habkost2016-05-231-20/+3
| | | | | | | | | | | | | | | | | | Newer PC machines don't set hw_version, and older machines set model-id on compat_props explicitly, so we don't need the x86_cpudef_setup() code that sets model_id using qemu_hw_version() anymore. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * pc: Set CPU model-id on compat_props for pc <= 2.4Eduardo Habkost2016-05-232-0/+42
| | | | | | | | | | | | | | | | | | | | Instead of relying on x86_cpudef_setup() calling qemu_hw_version(), just make old machines set model-id explicitly on compat_props for qemu64, qemu32, and athlon. This will allow us to eliminate x86_cpudef_setup() later. Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * osdep: Move default qemu_hw_version() value to a macroEduardo Habkost2016-05-232-8/+10
| | | | | | | | | | | | | | The macro will be used by code that will stop calling qemu_hw_version() at runtime and just need a constant value. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: kvm: Use X86XSaveArea struct for xsave save/loadEduardo Habkost2016-05-231-40/+38
| | | | | | | | | | | | | | | | Instead of using offset macros and bit operations in a uint32_t array, use the X86XSaveArea struct to perform the loading/saving operations in kvm_put_xsave() and kvm_get_xsave(). Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: Use xsave structs for ext_save_areaEduardo Habkost2016-05-231-7/+14
| | | | | | | | | | | | | | | | | | | | This doesn't introduce any change in the code, as the offsets and struct sizes match what was present in the table. This can be validated by the QEMU_BUILD_BUG_ON lines on target-i386/cpu.h, which ensures the struct sizes and offsets match the existing values in ext_save_area. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * target-i386: Define structs for layout of xsave areaEduardo Habkost2016-05-232-0/+118
| | | | | | | | | | | | | | | | | | Add structs that define the layout of the xsave areas used by Intel processors. Add some QEMU_BUILD_BUG_ON lines to ensure the structs match the XSAVE_* macros in target-i386/kvm.c and the offsets and sizes at target-i386/cpu.c:ext_save_areas. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
* | Merge remote-tracking branch 'remotes/amit-migration/tags/migration-2.7-1' ↵Peter Maydell2016-05-2414-134/+140
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging migration fixes: - ensure src block devices continue fine after a failed migration - fail on migration blockers; helps 9p savevm/loadvm - move autoconverge commands out of experimental state - move the migration-specific qjson in migration/ # gpg: Signature made Mon 23 May 2016 18:15:09 BST using RSA key ID 657EF670 # gpg: Good signature from "Amit Shah <amit@amitshah.net>" # gpg: aka "Amit Shah <amit@kernel.org>" # gpg: aka "Amit Shah <amitshah@gmx.net>" * remotes/amit-migration/tags/migration-2.7-1: migration: regain control of images when migration fails to complete savevm: fail if migration blockers are present migration: Promote improved autoconverge commands out of experimental state migration/qjson: Drop gratuitous use of QOM migration: Move qjson.[ch] to migration/ Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | migration: regain control of images when migration fails to completeGreg Kurz2016-05-231-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently have an error path during migration that can cause the source QEMU to abort: migration_thread() migration_completion() runstate_is_running() ----------------> true if guest is running bdrv_inactivate_all() ----------------> inactivate images qemu_savevm_state_complete_precopy() ... qemu_fflush() socket_writev_buffer() --------> error because destination fails qemu_fflush() -------------------> set error on migration stream migration_completion() -----------------> set migrate state to FAILED migration_thread() -----------------------> break migration loop vm_start() -----------------------------> restart guest with inactive images and you get: qemu-system-ppc64: socket_writev_buffer: Got err=104 for (32768/18446744073709551615) qemu-system-ppc64: /home/greg/Work/qemu/qemu-master/block/io.c:1342:bdrv_co_do_pwritev: Assertion `!(bs->open_flags & 0x0800)' failed. Aborted (core dumped) If we try postcopy with a similar scenario, we also get the writev error message but QEMU leaves the guest paused because entered_postcopy is true. We could possibly do the same with precopy and leave the guest paused. But since the historical default for migration errors is to restart the source, this patch adds a call to bdrv_invalidate_cache_all() instead. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Message-Id: <146357896785.6003.11983081732454362715.stgit@bahia.huguette.org> Signed-off-by: Amit Shah <amit.shah@redhat.com>
| * | savevm: fail if migration blockers are presentGreg Kurz2016-05-233-7/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QEMU has currently two ways to prevent migration to occur: - migration blocker when it depends on runtime state - VMStateDescription.unmigratable when migration is not supported at all This patch gathers all the logic into a single function to be called from both the savevm and the migrate paths. This fixes a bug with 9p, at least, where savevm would succeed and the following would happen in the guest after loadvm: $ ls /host ls: cannot access /host: Protocol error With this patch: (qemu) savevm foo Migration is disabled when VirtFS export path '/' is mounted in the guest using mount_tag 'host' Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <146239057139.11271.9011797645454781543.stgit@bahia.huguette.org> [Update subject according to Paolo's suggestion - Amit] Signed-off-by: Amit Shah <amit.shah@redhat.com>
| * | migration: Promote improved autoconverge commands out of experimental stateJason J. Herne2016-05-235-82/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | The new autoconverge throttling commands have been tested for a release now. It is time to move them out of the experimental state. Signed-off-by: Jason J. Herne <jjherne@linux.vnet.ibm.com> Message-Id: <1461262038-8197-1-git-send-email-jjherne@linux.vnet.ibm.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
| * | migration/qjson: Drop gratuitous use of QOMMarkus Armbruster2016-05-233-35/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All the use of QOM buys us here is the ability to destroy the thing with object_unref(OBJECT(vmdesc)). Not worth the notational overhead. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <1462380558-2030-3-git-send-email-armbru@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
| * | migration: Move qjson.[ch] to migration/Markus Armbruster2016-05-237-10/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Type QJSON lets you build JSON text. Its interface mirrors (a subset of) abstract JSON syntax. QAPI output visitors also produce JSON text. They assert their preconditions and invariants, and therefore abort on incorrect use. Contrastingly, QJSON does *not* detect incorrect use. It happily produces invalid JSON then. This is what migration wants. QJSON was designed for migration, and migration is its only user. Move it to migration/ for proper coverage by MAINTAINERS, and to deter accidental use outside migration. [Pointed out by Eric: QJSON was added in commits 0457d07..b174257 -- Amit] Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <1462380558-2030-2-git-send-email-armbru@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
* | | Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/rng-2.7-1' into ↵Peter Maydell2016-05-243-12/+12
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging rng: rename RndRandom to RndRandom # gpg: Signature made Mon 23 May 2016 16:44:58 BST using RSA key ID 657EF670 # gpg: Good signature from "Amit Shah <amit@amitshah.net>" # gpg: aka "Amit Shah <amit@kernel.org>" # gpg: aka "Amit Shah <amitshah@gmx.net>" * remotes/amit-virtio-rng/tags/rng-2.7-1: rng-random: rename RndRandom to RngRandom Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | rng-random: rename RndRandom to RngRandomWei Jiangang2016-05-233-12/+12
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usually, Random Number Generator is abbreviated to RNG/rng. so replacing RndRandom with RngRandom seems more reasonable and keep consistent with RngBackend. Signed-off-by: Wei Jiangang <weijg.fnst@cn.fujitsu.com> Reviewed-by: Pankaj Gupta <pagupta@redhat.com> Message-Id: <1460684168-5403-1-git-send-email-weijg.fnst@cn.fujitsu.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
* | | Merge remote-tracking branch 'remotes/xtensa/tags/20160523-opencores_eth' ↵Peter Maydell2016-05-241-18/+26
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging opencores_eth cleanups: - use mii.h - reduce stack usage in open_eth_start_xmit. # gpg: Signature made Mon 23 May 2016 20:14:20 BST using RSA key ID F83FA044 # gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" * remotes/xtensa/tags/20160523-opencores_eth: hw/net/opencores_eth: Allocating Large sized arrays to heap hw/net/opencores_eth: use mii.h Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/net/opencores_eth: Allocating Large sized arrays to heapZhou Jie2016-05-231-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | open_eth_start_xmit has a huge stack usage of 65536 bytes approx. Moving large arrays to heap to reduce stack usage. Reduce size of a buffer allocated on stack to 0x600 bytes, which is the maximal frame length when HUGEN bit is not set in MODER, only allocate buffer on heap when that is too small. Thus heap is not used in typical use case. Signed-off-by: Zhou Jie <zhoujie2011@cn.fujitsu.com> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
| * | hw/net/opencores_eth: use mii.hMax Filippov2016-05-231-17/+16
|/ / | | | | | | | | | | | | Drop local definitions of MII registers and use constants from mii.h for registers and register bits. No functional changes. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
* | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2016-05-2327-165/+158
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * NMI cleanups (Bandan) * RAMBlock/Memory cleanups and fixes (Dominik, Gonglei, Fam, me) * first part of linuxboot support for fw_cfg DMA (Richard) * IOAPIC fix (Peter Xu) * iSCSI SG_IO fix (Vadim) * Various infrastructure bug fixes (Zhijian, Peter M., Stefan) * CVE fixes (Prasad) # gpg: Signature made Mon 23 May 2016 16:06:18 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: (24 commits) cpus: call the core nmi injection function nmi: remove x86 specific nmi handling target-i386: add a generic x86 nmi handler coccinelle: add g_assert_cmp* to macro file iscsi: pass SCSI status back for SG_IO esp: check dma length before reading scsi command(CVE-2016-4441) esp: check command buffer length before write(CVE-2016-4439) scripts/signrom.py: Check for magic in option ROMs. scripts/signrom.py: Allow option ROM checksum script to write the size header. Remove config-devices.mak on 'make clean' cpus.c: Use pthread_sigmask() rather than sigprocmask() memory: remove unnecessary masking of MemoryRegion ram_addr memory: Drop FlatRange.romd_mode memory: Remove code for mr->may_overlap exec: adjust rcu_read_lock requirement memory: drop find_ram_block() vl: change runstate only if new state is different from current state ioapic: clear remote irr bit for edge-triggered interrupts ioapic: keep RO bits for IOAPIC entry target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2 ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | cpus: call the core nmi injection functionBandan Das2016-05-231-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can call the common function here directly since x86 specific actions will be taken care of by the arch specific nmi handler Signed-off-by: Bandan Das <bsd@redhat.com> Message-Id: <1463761717-26558-4-git-send-email-bsd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | nmi: remove x86 specific nmi handlingBandan Das2016-05-233-26/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | nmi_monitor_handle is wired to call the x86 nmi handler. So, we can directly use it at call sites. Signed-off-by: Bandan Das <bsd@redhat.com> Message-Id: <1463761717-26558-3-git-send-email-bsd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | target-i386: add a generic x86 nmi handlerBandan Das2016-05-231-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of having x86 ifdefs in core nmi code, this change adds a arch specific handler that the nmi common code can call. Signed-off-by: Bandan Das <bsd@redhat.com> Message-Id: <1463761717-26558-2-git-send-email-bsd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | coccinelle: add g_assert_cmp* to macro filePaolo Bonzini2016-05-231-0/+6
| | | | | | | | | | | | | | | | | | This helps applying semantic patches to unit tests. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | iscsi: pass SCSI status back for SG_IOVadim Rozenfeld2016-05-231-0/+1
| | | | | | | | | | | | | | | Signed-off-by: Vadim Rozenfeld <vrozenfe@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | esp: check dma length before reading scsi command(CVE-2016-4441)Prasad J Pandit2016-05-231-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() uses DMA to read scsi commands into this buffer. Add check to validate DMA length against buffer size to avoid any overrun. Fixes CVE-2016-4441. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-3-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | esp: check command buffer length before write(CVE-2016-4439)Prasad J Pandit2016-05-231-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. While writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check was missing to validate input length. Add check to avoid OOB write access. Fixes CVE-2016-4439. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | scripts/signrom.py: Check for magic in option ROMs.Richard W.M. Jones2016-05-231-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because of the risk that compilers might not emit the asm() block at the beginning of the option ROM, check that the ROM contains the required magic signature. Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Message-Id: <1463000807-18015-3-git-send-email-rjones@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | scripts/signrom.py: Allow option ROM checksum script to write the size header.Richard W.M. Jones2016-05-231-3/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Modify the signrom.py script so that if the size byte in the header is 0 (ie. not set) then the script will set the size. If the size byte is non-zero then we do the same as before, so this doesn't require changes to any existing ROM sourcecode. Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Message-Id: <1463000807-18015-2-git-send-email-rjones@redhat.com>
| * | Remove config-devices.mak on 'make clean'Peter Maydell2016-05-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our dependency mechanism works like this: * on first build there is neither a .o nor a .d * we create the .d as a side effect of creating the .o * for rebuilds we know when we need to update the .o, which also updates the .d This system requires that you're never in a situation where there is a .o file but no .d (because then we will never realise we need to build the .d, and we will not have the dependency information about when to rebuild the .o). This is working fine for our object files, but we also try to use it for $TARGET/config-devices.mak (where the dependency file is in $TARGET-config-devices.mak.d). Unfortunately "make clean" doesn't remove config-devices.mak, which means that it puts us in the forbidden situation of "object file exists but not its .d file". This in turn means that we will fail to notice when we need to rebuild: mkdir build/depbug (cd build/depbug && '../../configure') make -C build/depbug -j8 make -C build/depbug clean echo "CONFIG_CANARY = y" >> default-configs/arm-softmmu.mak make -C build/depbug grep CANARY build/depbug/aarch64-softmmu/config-devices.mak The CANARY token should show up in config-devices.mak but does not. Fix this bug by making "make clean" delete the config-devices.mak files. config-all-devices.mak doesn't have the same problem since it has no .d file, but delete it too, since it is created by "make" and logically should be removed by "make clean". (Note that it is important not to remove config-devices.mak until after we have recursively run 'make clean' in the subdirectories.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <1463484451-22979-1-git-send-email-peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>