summaryrefslogtreecommitdiffstats
path: root/hw/block
Commit message (Collapse)AuthorAgeFilesLines
* xen/blkif: Avoid double access to src->nr_segmentsStefano Stabellini2016-03-151-4/+8
| | | | | | | | | | | | | | | src is stored in shared memory and src->nr_segments is dereferenced twice at the end of the function. If a compiler decides to compile this into two separate memory accesses then the size limitation could be bypassed. Fix it by removing the double access to src->nr_segments. This is part of XSA-155. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit f9e98e5d7a67367b862941e339a98b8322fa0cea) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* virtio-blk: Drop x-data-plane optionFam Zheng2015-12-072-14/+2
| | | | | | | | | | | | | | | | | | The official way of enabling dataplane is through the "iothread" property that references an iothread object created by "-object iothread". Since the old "x-data-plane=on" way now even crashes, it's probably easier to just drop it: $ qemu-system-x86_64 -drive file=null-co://,id=d0,if=none \ -device virtio-blk-pci,drive=d0,x-data-plane=on ERROR:/home/fam/work/qemu/qom/object.c:1515: object_get_canonical_path_component: assertion failed: (obj->parent != NULL) Aborted Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1449485967-19240-1-git-send-email-famz@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell2015-11-251-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Block layer patches # gpg: Signature made Wed 25 Nov 2015 13:33:14 GMT using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: qemu-iotests: Add -nographic when starting QEMU in 119 and 120 block/qapi: Plug memory leak on query-block error path raw-posix.c: Make GetBSDPath() handle caching options nand: fix flash erase when oob is in memory test-aio: Fix event notifier cleanup tests/Makefile: Add more dependencies for test-timed-average Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * nand: fix flash erase when oob is in memoryRicard Wanderlof2015-11-251-1/+1
| | | | | | | | | | | | | | | | For the "main area on file, oob in memory" case, fix the shifts so that we erase the correct number of pages. Signed-off-by: Ricard Wanderlöf <ricardw@axis.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | Merge remote-tracking branch 'remotes/sstabellini/tags/xen-20151125' into ↵Peter Maydell2015-11-251-8/+0
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | staging Xen 2015/11/25 # gpg: Signature made Wed 25 Nov 2015 11:19:26 GMT using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/xen-20151125: xen_disk: Remove ioreq.postsync xen: fix usage of xc_domain_create in domain builder Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * xen_disk: Remove ioreq.postsyncAlberto Garcia2015-11-251-8/+0
| | | | | | | | | | | | | | | | This code has been dead for three years (since commit 7e7b7cba1). Signed-off-by: Alberto Garcia <berto@igalia.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* | virtio-blk: Move resetting of req->mr_next to virtio_blk_handle_rw_errorFam Zheng2015-11-241-4/+3
| | | | | | | | | | | | | | | | | | | | "werror=report" would free the req in virtio_blk_handle_rw_error, we mustn't write to it in that case. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Message-id: 1448239280-15025-1-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | nand: fix address overflowRabin Vincent2015-11-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | The shifts of the address mask and value shift beyond 32 bits when there are 5 address cycles. Cc: qemu-stable@nongnu.org Signed-off-by: Rabin Vincent <rabin.vincent@axis.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | virtio-blk: Fix double completion for werror=stopFam Zheng2015-11-171-0/+4
|/ | | | | | | | | | | | | | | | | | | When a request R is absorbed by request M, it is appended to the "mr_next" queue led by M, and is completed together with the completion of M, in virtio_blk_rw_complete. During DMA restart in virtio_blk_dma_restart_bh, requests in s->rq are parsed and submitted again, possibly with a stale req->mr_next. It could be a problem if the request merging in virtio_blk_handle_request hasn't refreshed every mr_next pointer, in which case, virtio_blk_rw_complete could walk through unexpected requests following the stale pointers. Fix this by unsetting the pointer in virtio_blk_rw_complete. It is safe because this req is either completed and freed right away, or it will be restarted and parsed from scratch out of the vq later. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* xen_disk: Account for failed and invalid operationsAlberto Garcia2015-11-121-1/+22
| | | | | | | Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: e0cbb96cb0e1f86c37c7ce332efdf02b57b9d365.1446044838.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* virtio-blk: Account for failed and invalid operationsAlberto Garcia2015-11-121-1/+3
| | | | | | | Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: 4f623ce52c9d673d35a043fc2959526b41b685c6.1446044838.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* nvme: Account for failed and invalid operationsAlberto Garcia2015-11-121-3/+8
| | | | | | | Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: 678dc67da229759d404b44f7cc2bf5ed8bf8ad14.1446044838.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* xen_disk: Account for flush operationsAlberto Garcia2015-11-121-1/+3
| | | | | | | | | | | Currently both BLKIF_OP_WRITE and BLKIF_OP_FLUSH_DISKCACHE are being accounted as write operations. Signed-off-by: Alberto Garcia <berto@igalia.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 7a2a14e3ac62027aa6267a6c02abc70717be9c0a.1446044837.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* virtio: sync the dataplane vring state to the virtqueue before virtio_savePavel Butsykin2015-10-291-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When creating snapshot with the dataplane enabled, the snapshot file gets not the actual state of virtqueue, because the current state is stored in VirtIOBlockDataPlane. Therefore, before saving snapshot need to sync the dataplane vring state to the virtqueue. The dataplane will resume its work at the next notify virtqueue. When snapshot loads with loadvm we get a message: VQ 0 size 0x80 Guest index 0x15f5 inconsistent with Host index 0x0: delta 0x15f5 error while loading state for instance 0x0 of device '0000:00:08.0/virtio-blk' Error -1 while loading VM state to reproduce the error I used the following hmp commands: savevm snap1 loadvm snap1 qemu parameters: --enable-kvm -smp 4 -m 1024 -drive file=/var/lib/libvirt/images/centos6.4.qcow2,if=none,id=drive-virtio-disk0,format=qcow2,cache=none,aio=native -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x8,drive=drive-virtio-disk0,id=virtio-disk0 -set device.virtio-disk0.x-data-plane=on Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Message-id: 1445859777-2982-1-git-send-email-den@openvz.org CC: Stefan Hajnoczi <stefanha@redhat.com> CC: "Michael S. Tsirkin" <mst@redhat.com> CC: Kevin Wolf <kwolf@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* virtio-blk: switch off scsi-passthrough by defaultCornelia Huck2015-10-291-1/+1
| | | | | | | | | | | | Devices that are compliant with virtio-1 do not support scsi passthrough any more (and it has not been a recommended setup anyway for quite some time). To avoid having to switch it off explicitly in newer qemus that turn on virtio-1 by default, let's switch the default to scsi=false for 2.5. Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Message-id: 1444991154-79217-4-git-send-email-cornelia.huck@de.ibm.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* virtio-blk: convert to virtqueue_mapMichael S. Tsirkin2015-10-291-4/+1
| | | | | | | | | Drop deprecated use of virtqueue_map_sg. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
* dataplane: Mark host notifiers' client type as "external"Fam Zheng2015-10-231-3/+2
| | | | | | | | | They will be excluded by type in the nested event loops in block layer, so that unwanted events won't be processed there. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* aio: Add "is_external" flag for event handlersFam Zheng2015-10-231-2/+4
| | | | | | | | | | All callers pass in false, and the real external ones will switch to true in coming patches. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: Prepare for NULL BDSMax Reitz2015-10-231-1/+3
| | | | | | | | | | blk_bs() will not necessarily return a non-NULL value any more (unless blk_is_available() is true or it can be assumed to otherwise, e.g. because it is called immediately after a successful blk_new_with_bs() or blk_new_open()). Signed-off-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* hw/block/fdc: Implement tray statusMax Reitz2015-10-231-4/+16
| | | | | | | | | | The tray of an FDD is open iff there is no medium inserted (there are only two states for an FDD: "medium inserted" or "no medium inserted"). Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: switch from g_slice allocator to mallocPaolo Bonzini2015-10-121-2/+2
| | | | | | | | Simplify memory allocation by sticking with a single API. GSlice is not that fast anyway (tcmalloc/jemalloc are better). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* virtio-blk: use blk_io_plug/unplug for Linux AIO batchingStefan Hajnoczi2015-10-121-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The raw-posix block driver implements Linux AIO batching so multiple requests can be submitted with a single io_submit(2) system call. Batching is currently only used by virtio-scsi and virtio-blk-data-plane. Enable batching for regular virtio-blk so the number of io_submit(2) system calls is reduced for workloads with queue depth > 1. In 4KB random read performance tests with queue depth 32, the CPU utilization on the host is reduced by 9.4%. The fio job is as follows: [global] bs=4k ioengine=libaio iodepth=32 direct=1 sync=0 time_based=1 runtime=30 clocksource=gettimeofday ramp_time=5 [job1] rw=randread filename=/dev/vdb size=4096M write_bw_log=fio write_iops_log=fio write_lat_log=fio log_avg_msec=1000 This benchmark was run on an raw image on LVM. The disk was an SSD drive and -drive cache=none,aio=native was used. Tested-by: Pradeep Surisetty <psuriset@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com>
* Fix bad error handling after memory_region_init_ram()Markus Armbruster2015-09-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Symptom: $ qemu-system-x86_64 -m 10000000 Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456: upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory Aborted (core dumped) Root cause: commit ef701d7 screwed up handling of out-of-memory conditions. Before the commit, we report the error and exit(1), in one place, ram_block_add(). The commit lifts the error handling up the call chain some, to three places. Fine. Except it uses &error_abort in these places, changing the behavior from exit(1) to abort(), and thus undoing the work of commit 3922825 "exec: Don't abort when we can't allocate guest memory". The three places are: * memory_region_init_ram() Commit 4994653 (right after commit ef701d7) lifted the error handling further, through memory_region_init_ram(), multiplying the incorrect use of &error_abort. Later on, imitation of existing (bad) code may have created more. * memory_region_init_ram_ptr() The &error_abort is still there. * memory_region_init_rom_device() Doesn't need fixing, because commit 33e0eb5 (soon after commit ef701d7) lifted the error handling further, and in the process changed it from &error_abort to passing it up the call chain. Correct, because the callers are realize() methods. Fix the error handling after memory_region_init_ram() with a Coccinelle semantic patch: @r@ expression mr, owner, name, size, err; position p; @@ memory_region_init_ram(mr, owner, name, size, ( - &error_abort + &error_fatal | err@p ) ); @script:python@ p << r.p; @@ print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column) When the last argument is &error_abort, it gets replaced by &error_fatal. This is the fix. If the last argument is anything else, its position is reported. This lets us check the fix is complete. Four positions get reported: * ram_backend_memory_alloc() Error is passed up the call chain, ultimately through user_creatable_complete(). As far as I can tell, it's callers all handle the error sanely. * fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize() DeviceClass.realize() methods, errors handled sanely further up the call chain. We're good. Test case again behaves: $ qemu-system-x86_64 -m 10000000 qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory [Exit 1 ] The next commits will repair the rest of commit ef701d7's damage. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2015-09-141-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Support for jemalloc * qemu_mutex_lock_iothread "No such process" fix * cutils: qemu_strto* wrappers * iohandler.c simplification * Many other fixes and misc patches. And some MTTCG work (with Emilio's fixes squashed): * Signal-free TCG kick * Removing spinlock in favor of QemuMutex * User-mode emulation multi-threading fixes/docs # gpg: Signature made Thu 10 Sep 2015 09:03:07 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: (44 commits) cutils: work around platform differences in strto{l,ul,ll,ull} cpu-exec: fix lock hierarchy for user-mode emulation exec: make mmap_lock/mmap_unlock globally available tcg: comment on which functions have to be called with mmap_lock held tcg: add memory barriers in page_find_alloc accesses remove unused spinlock. replace spinlock by QemuMutex. cpus: remove tcg_halt_cond and tcg_cpu_thread globals cpus: protect work list with work_mutex scripts/dump-guest-memory.py: fix after RAMBlock change configure: Add support for jemalloc add macro file for coccinelle configure: factor out adding disas configure vhost-scsi: fix wrong vhost-scsi firmware path checkpatch: remove tests that are not relevant outside the kernel checkpatch: adapt some tests to QEMU CODING_STYLE: update mixed declaration rules qmp: Add example usage of strto*l() qemu wrapper cutils: Add qemu_strtoull() wrapper cutils: Add qemu_strtoll() wrapper ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * i8257: rewrite DMA_schedule to avoid hooking into the CPU loopPaolo Bonzini2015-09-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The i8257 DMA controller uses an idle bottom half, which by default does not cause the main loop to exit. Therefore, the DMA_schedule function is there to ensure that the CPU relinquishes the iothread mutex to the iothread. However, this is not enough since the iothread will call aio_compute_timeout() and go to sleep again. In the iothread world, forcing execution of the idle bottom half is much simpler, and only requires a call to qemu_notify_event(). Do it, removing the need for the "cpu_request_exit" pseudo-irq. The next patch will remove it. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | maint: remove unused include for signal.hDaniel P. Berrange2015-09-111-1/+0
| | | | | | | | | | | | | | | | | | A number of files were including signal.h but not using any of the functions it provides Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* | virtio: avoid leading underscores for helpersCornelia Huck2015-09-101-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit ef546f1275f6563e8934dd5e338d29d9f9909ca6 ("virtio: add feature checking helpers") introduced a helper __virtio_has_feature. We don't want to use reserved identifiers, though, so let's rename __virtio_has_feature to virtio_has_feature and virtio_has_feature to virtio_vdev_has_feature. Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | hw/block/nvme.c: Use pow2ceil() rather than hand-calculationPeter Maydell2015-09-071-1/+1
|/ | | | | | | | | Use pow2ceil() to round up to the next power of 2, rather than an inline calculation. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1437741192-20955-4-git-send-email-peter.maydell@linaro.org
* virtio-blk-dataplane: delete bottom half before the AioContext is freedPaolo Bonzini2015-07-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Other uses of aio_bh_new are safe as long as all scheduled bottom halves are run before an iothread is destroyed, which bdrv_drain will ensure: - archipelago_finish_aiocb: BH deletes itself - inject_error: BH deletes itself - blkverify_aio_bh: BH deletes itself - abort_aio_request: BH deletes itself - curl_aio_readv: BH deletes itself - gluster_finish_aiocb: BH deletes itself - bdrv_aio_rw_vector: BH deletes itself - bdrv_co_maybe_schedule_bh: BH deletes itself - iscsi_schedule_bh, iscsi_co_generic_cb: BH deletes itself - laio_attach_aio_context: deleted in laio_detach_aio_context, called through bdrv_detach_aio_context before deleting the iothread - nfs_co_generic_cb: BH deletes itself - null_aio_common: BH deletes itself - qed_aio_complete: BH deletes itself - rbd_finish_aiocb: BH deletes itself - dma_blk_cb: BH deletes itself - virtio_blk_dma_restart_cb: BH deletes itself - qemu_bh_new: main loop AioContext is never destroyed - test-aio.c: bh_delete_cb deletes itself, otherwise deleted in the same function that calls aio_bh_new Reported-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1438101249-25166-2-git-send-email-pbonzini@redhat.com Message-Id: <1438086628-13000-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* virtio: minor cleanupMichael S. Tsirkin2015-07-271-1/+0
| | | | | | | There's no need for blk to set ANY_LAYOUT, it's done by virtio core as necessary. Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy deviceJason Wang2015-07-271-1/+1
| | | | | | | | | | | | | | | | | | | | | Chapter 6.3 of spec said " Transitional devices MUST offer, and if offered by the device transitional drivers MUST accept the following: VIRTIO_F_ANY_LAYOUT (27) " So this patch only clear VIRTIO_F_LAYOUT for legacy device. Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: qemu-block@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-blk: fail get_features when both scsi and 1.0 were setJason Wang2015-07-271-1/+9
| | | | | | | | | | | SCSI passthrough was no longer supported in virtio 1.0, so this patch fail the get_features() when both 1.0 and scsi is set. And also only advertise VIRTIO_BLK_F_SCSI for legacy virtio-blk device. Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio: get_features() can failJason Wang2015-07-271-1/+2
| | | | | | | Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio: set any_layout in virtio coreMichael S. Tsirkin2015-07-271-0/+1
| | | | | | | | Exceptions: - virtio-blk - compat machine types Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* nvme: properly report volatile write cachesChristoph Hellwig2015-07-141-5/+14
| | | | | | | | | | Implement support in Identify and Get/Set Features to properly report and allow to change the Volatile Write Cache status reported by the virtual NVMe device. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* nvme: implement the Flush commandChristoph Hellwig2015-07-142-3/+17
| | | | | | | | | | Implement a real flush instead of faking it. This is especially important as Qemu assume Write back cashing by default and thus requires a working cache flush operation for data integrity. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* virito-blk: drop duplicate checkGonglei2015-06-241-2/+1
| | | | | | | | | | | in_num = req->elem.in_num, and req->elem.in_num is checked in line 489, so the check about in_num variable is superflous, let's drop it. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1435138164-11728-1-git-send-email-arei.gonglei@huawei.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* nvme: Fix memleak in nvme_dma_read_prpLu Lina2015-06-231-0/+1
| | | | | | | Signed-off-by: Lu Lina <lina.lulina@huawei.com> Acked-by: Keith Busch <keith.busch@intel.com> Message-id: 1434695254-69808-1-git-send-email-kathy.wangting@huawei.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* virtio-blk: Use blk_drain() to drain IO requestsAlexander Yarygin2015-06-231-5/+10
| | | | | | | | | | | | | | | | | | | | Each call of the virtio_blk_reset() function calls blk_drain_all(), which works for all existing BlockDriverStates, while draining only one is needed. This patch replaces blk_drain_all() by blk_drain() in virtio_blk_reset(). virtio_blk_data_plane_stop() should be called after draining because it restores vblk->complete_request. Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com> Message-id: 1434537440-28236-3-git-send-email-yarygin@linux.vnet.ibm.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* migration: Use normal VMStateDescriptions for SubsectionsJuan Quintela2015-06-121-26/+16
| | | | | | | | | | | | | | | | We create optional sections with this patch. But we already have optional subsections. Instead of having two mechanism that do the same, we can just generalize it. For subsections we just change: - Add a needed function to VMStateDescription - Remove VMStateSubsection (after removal of the needed function it is just a VMStateDescription) - Adjust the whole tree, moving the needed function to the corresponding VMStateDescription Signed-off-by: Juan Quintela <quintela@redhat.com>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2015-06-081-127/+77
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * KVM error improvement from Laurent * CONFIG_PARALLEL fix from Mirek * Atomic/optimized dirty bitmap access from myself and Stefan * BUILD_DIR convenience/bugfix from Peter C * Memory leak fix from Shannon * SMM improvements (though still TCG only) from myself and Gerd, acked by mst # gpg: Signature made Fri Jun 5 18:45:20 2015 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (62 commits) update Linux headers from kvm/next atomics: add explicit compiler fence in __atomic memory barriers ich9: implement SMI_LOCK q35: implement TSEG q35: add test for SMRAM.D_LCK q35: implement SMRAM.D_LCK q35: add config space wmask for SMRAM and ESMRAMC q35: fix ESMRAMC default q35: implement high SMRAM hw/i386: remove smram_update target-i386: use memory API to implement SMRAM hw/i386: add a separate region that tracks the SMRAME bit target-i386: create a separate AddressSpace for each CPU vl: run "late" notifiers immediately qom: add object_property_add_const_link vl: allow full-blown QemuOpts syntax for -global pflash_cfi01: add secure property pflash_cfi01: change to new-style MMIO accessors pflash_cfi01: change big-endian property to BIT type target-i386: wake up processors that receive an SMI ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * pflash_cfi01: add secure propertyPaolo Bonzini2015-06-051-44/+67
| | | | | | | | | | | | | | | | When this property is set, MMIO accesses are only allowed with the MEMTXATTRS_SECURE attribute. This is used for secure access to UEFI variables stored in flash. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * pflash_cfi01: change to new-style MMIO accessorsPaolo Bonzini2015-06-051-86/+10
| | | | | | | | | | | | This is a required step to implement read_with_attrs and write_with_attrs. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * pflash_cfi01: change big-endian property to BIT typePaolo Bonzini2015-06-051-4/+7
| | | | | | | | | | | | Make this consistent with the secure property, added in the next patch. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | fdc: Fix MSR.RQM flagKevin Wolf2015-06-021-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RQM bit in MSR should be set whenever the guest is supposed to access the FIFO, and it should be cleared in all other cases. This is important so the guest can't continue writing/reading the FIFO beyond the length that it's suppossed to access (see CVE-2015-3456). Commit e9077462 fixed the CVE by adding code that avoids the buffer overflow; however it doesn't correct the wrong behaviour of the floppy controller which should already have cleared RQM. Currently, RQM stays set all the time and during all phases while a command is being processed. This is error-prone because the command has to explicitly clear the flag if it doesn't need data (and indeed, the two buggy commands that are the culprits for the CVE just forgot to do that). This patch clears RQM immediately as soon as all bytes that are expected have been received. If the the FIFO is used in the next phase, the flag has to be set explicitly there. It also clear RQM after receiving all bytes even if the phase transition immediately sets it again. While it's technically not necessary at the moment because the state between clearing and setting RQM is not observable by the guest, this is more explicit and matches how real hardware works. It will actually become necessary in qemu once asynchronous code paths are introduced. This alone should have been enough to fix the CVE, but now we have two lines of defense - even better. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-8-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
* | fdc: Disentangle phases in fdctrl_read_data()Kevin Wolf2015-06-021-10/+23
| | | | | | | | | | | | | | | | | | | | | | | | This commit makes similar improvements as have already been made to the write function: Instead of relying on a flag in the MSR to distinguish controller phases, use the explicit phase that we store now. Assertions of the right MSR flags are added. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-7-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
* | fdc: Code cleanup in fdctrl_write_data()Kevin Wolf2015-06-021-24/+39
| | | | | | | | | | | | | | | | | | Factor out a few common lines of code, reformat, improve comments. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-6-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
* | fdc: Use phase in fdctrl_write_data()Kevin Wolf2015-06-021-28/+41
| | | | | | | | | | | | | | | | | | | | | | Instead of relying on a flag in the MSR to distinguish controller phases, use the explicit phase that we store now. Assertions of the right MSR flags are added. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-5-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
* | fdc: Introduce fdctrl->phaseKevin Wolf2015-06-021-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | The floppy controller spec describes three different controller phases, which are currently not explicitly modelled in our emulation. Instead, each phase is represented by a combination of flags in registers. This patch makes explicit in which phase the controller currently is. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Acked-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-4-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
* | fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase()Kevin Wolf2015-06-021-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | What callers really do with this function is to switch from execution phase (including data transfers) to result phase where the guest can read out one or more status bytes from the FIFO (the number depends on the command). Rename the function accordingly. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1432214378-31891-3-git-send-email-kwolf@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
OpenPOWER on IntegriCloud