summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
* Revert "acpi: mark PMTIMER as unlocked"Gerd Hoffmann2019-11-291-1/+0
| | | | | | | | | | | | | This reverts commit 7070e085d490c396f9237c8f10bf8b6e69cd0066. Commit message claims locking is not needed, but that appears to not be true, seabios ehci driver runs into timekeeping problems with this, see https://bugzilla.redhat.com/show_bug.cgi?id=1322713 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1460702609-25971-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).Gerd Hoffmann2019-11-291-0/+6
| | | | | | | | | | | | | | | | | | | | | | Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Reported-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: update vga register setup on vbe changesGerd Hoffmann2019-11-291-0/+1
| | | | | | | Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: factor out vga register setupGerd Hoffmann2019-11-291-34/+44
| | | | | | | | | When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: add vbe_enabled() helperGerd Hoffmann2019-11-291-4/+9
| | | | | | Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: fix banked access bounds checking (CVE-2016-3710)Gerd Hoffmann2019-11-291-6/+18
| | | | | | | | | | | | | | | | | | | | | | vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* acpi: fix bios linker loadder COMMAND_ALLOCATE on bigendian hostIgor Mammedov2019-11-291-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'make check' fails with: ERROR:tests/bios-tables-test.c:493:load_expected_aml: assertion failed: (g_file_test(aml_file, G_FILE_TEST_EXISTS)) since commit: caf50c7166a6ed96c462ab5db4b495e1234e4cc6 tests: pc: acpi: drop not needed 'expected SSDT' blobs Assert happens because qemu-system-x86_64 generates SSDT table and test looks for a corresponding expected table to compare with. However there is no expected SSDT blob anymore, since QEMU souldn't generate one. As it happens BIOS is not able to read ACPI tables from QEMU and fallbacks to embeded legacy ACPI codepath, which generates SSDT. That happens due to wrongly sized endiannes conversion which makes uint8_t BiosLinkerLoaderEntry.alloc.zone end up with 0 due to truncation of 32 bit integer which on host is 1 or 2. Fix it by dropping invalid cpu_to_le32() as uint8_t doesn't require any conversion. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1330174 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
* spapr_drc: fix aborts during DRC-count based hotplugMichael Roth2019-11-292-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | CPU/memory resources can be signalled en-masse via spapr_hotplug_req_add_by_count(), and when doing so, actually change the meaning of the 'drc' parameter passed to spapr_hotplug_req_event() to be a count rather than an index. f40eb92 added a hook in spapr_hotplug_req_event() to record when a device had been 'signalled' to the guest, but that code assumes that drc is always an index. In cases where it's a count, such as memory hotplug, the DRC lookup will fail, leading to an assert. Fix this by only explicitly setting the signalled state for cases where we are doing PCI hotplug. For other resources types, since we cannot selectively track whether a resource has been signalled in cases where we signal attach as a count, set the 'signalled' state to true immediately upon making the resource available via drck->attach(). Reported-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Cc: Bharata B Rao <bharata@linux.vnet.ibm.com> Cc: david@gibson.dropbear.id.au Cc: qemu-ppc@nongnu.org Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* usb/uhci: move pid checkGerd Hoffmann2019-11-291-13/+13
| | | | | | | | | | | | | | | | | | | | commit "5f77e06 usb: add pid check at the first of uhci_handle_td()" moved the pid verification to the start of the uhci_handle_td function, to simplify the error handling (we don't have to free stuff which we didn't allocate in the first place ...). Problem is now the check fires too often, it raises error IRQs even for TDs which we are not going to process because they are not set active. So, lets move down the check a bit, so it is done only for active TDs, but still before we are going to allocate stuff to process the requested transfer. Reported-by: Joe Clifford <joe@thunderbug.co.uk> Tested-by: Joe Clifford <joe@thunderbug.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1461321893-15811-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/ppc/spapr: Fix crash when specifying bad parameters to spapr-pci-host-bridgeThomas Huth2019-11-292-5/+7
| | | | | | | | | | | | | | | | | | QEMU currently crashes when using bad parameters for the spapr-pci-host-bridge device: $ qemu-system-ppc64 -device spapr-pci-host-bridge,buid=0x123,liobn=0x321,mem_win_addr=0x1,io_win_addr=0x10 Segmentation fault The problem is that spapr_tce_find_by_liobn() might return NULL, but the code in spapr_populate_pci_dt() does not check for this condition and then tries to dereference this NULL pointer. Apart from that, the return value of spapr_populate_pci_dt() also has to be checked for all PCI buses, not only for the last one, to make sure we catch all errors. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* virtio: Mark host notifiers as externalFam Zheng2019-11-291-2/+2
| | | | | | | | | The effect of this change is the block layer drained section can work, for example when mirror job is being completed. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* event-notifier: Add "is_external" parameterFam Zheng2019-11-292-5/+5
| | | | | | | | | | All callers pass "false" keeping the old semantics. The windows implementation doesn't distinguish the flag yet. On posix, it is passed down to the underlying aio context. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* hw/arm/boot: always clear r0 when booting kernelsSylvain Garrigues2019-11-291-1/+1
| | | | | | | | | | | | | | | | | The 32-bit ARM Linux kernel booting ABI requires that r0 is 0 when calling the kernel image. A bug in commit 10b8ec73e610e01 meant that for boards which use the write_board_setup hook (which means "highbank", "midway", "raspi2" and "xilinx-zynq-a9") we were incorrectly skipping the "clear r0" instruction in the mini-bootloader. Use the right offset in the "add lr, pc, #n" instruction so that we return from the board-setup code to the correct place. Signed-off-by: Sylvain Garrigues <sylvain@sylvaingarrigues.com> [PMM: Expanded commit message] Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* cadence_uart: bounds check write offsetMichael S. Tsirkin2019-11-291-0/+3
| | | | | | | | | | | | | | | | | | | | | cadence_uart_init() initializes an I/O memory region of size 0x1000 bytes. However in uart_write(), the 'offset' parameter (offset within region) is divided by 4 and then used to index the array 'r' of size CADENCE_UART_R_MAX which is much smaller: (0x48/4). If 'offset>>=2' exceeds CADENCE_UART_R_MAX, this will cause an out-of-bounds memory write where the offset and the value are controlled by guest. This will corrupt QEMU memory, in most situations this causes the vm to crash. Fix by checking the offset against the array size. Cc: qemu-stable@nongnu.org Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 20160418100735.GA517@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Revert "ehci: make idt processing more robust"Gerd Hoffmann2019-11-291-3/+2
| | | | | | | | This reverts commit 156a2e4dbffa85997636a7a39ef12da6f1b40254. Breaks FreeBSD. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ehci: apply limit to iTD/sidt descriptorsGerd Hoffmann2019-11-291-1/+5
| | | | | | | | | | | | | | | Commit "156a2e4 ehci: make idt processing more robust" tries to avoid a DoS by the guest (create a circular iTD queue and let qemu ehci emulation run in circles forever). Unfortunately this has two problems: First it misses the case of siTDs, and second it reportedly breaks FreeBSD. So lets go for a different approach: just count the number of iTDs and siTDs we have seen per frame and apply a limit. That should really catch all cases now. Reported-by: 杜少博 <dushaobo@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cuda: fix off-by-one error in SET_TIME commandAurelien Jarno2019-11-291-2/+2
| | | | | | | | | | | | | | | | With the new framework the cuda_cmd_set_time command directly receive the data, without the command byte. Therefore the time is stored at in_data[0], not at in_data[1]. This fixes the "hwclock --systohc" command in a guest. Cc: Hervé Poussineau <hpoussin@reactos.org> Cc: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Hervé Poussineau <hpoussin@reactos.org> [this fixes a regression introduced by e647317 "cuda: port SET_TIME command to new framework"] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* Fix pflash migrationDr. David Alan Gilbert2019-11-291-2/+16
| | | | | | | | | | | | | | | | | | | | | | | Pflash migration (e.g. q35 + EFI variable storage) fails with the assert: bdrv_co_do_pwritev: Assertion `!(bs->open_flags & 0x0800)' failed. This avoids the problem by delaying the pflash update until after the device loads complete. Tested by: Migrating Q35/EFI vm. Changing efi variable content (with efiboot in the guest) md5sum'ing the variable file before migration and after. This is a fix that Paolo posted in the message 570244B3.4070105@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* hw/virtio/balloon: Replace TARGET_PAGE_SIZE with BALLOON_PAGE_SIZEThomas Huth2019-11-291-2/+3
| | | | | | | | | | | | | | | | | The balloon code currently calls madvise() with TARGET_PAGE_SIZE as length parameter. Since the virtio-balloon protocol is always based on 4k pages, no matter what the host and guest are using as page size, this could cause problems: If TARGET_PAGE_SIZE is bigger than 4k, the madvise call also destroys the 4k areas after the current one - which might be wrong since the guest did not want free that area yet (in case the guest used as smaller MMU page size than the hard-coded TARGET_PAGE_SIZE). So to fix this issue, introduce a proper define called BALLOON_PAGE_SIZE (which is 4096) to use this as the size parameter for the madvise() call instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* tpm: Fix write to file descriptor functionStefan Berger2019-11-291-1/+1
| | | | | | | | | Fix a bug introduced in commit 46f296c while moving send_all to the tpm_passthrough code. Fix the name of the variable used in the loop. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* tpm: acpi: remove IRQ from TPM's CRS to make Windows not see conflictIgor Mammedov2019-11-291-1/+6
| | | | | | | | | | | | | | | | | | | | | | IRQ 5 used by TPM conflicts with PNP0C0F IRQs, as result Windows fails driver initialization with reason 'device cannot find enough free resources' But if TPM._CRS.IRQ entry is commented out, Windows seems to initialize driver without errors as it doesn't notice possible conflict and it seems to work probably due to a link with IRQ 5 being unused/disabled. So temporary comment out TPM._CRS.IRQ to 'fix' regression in TPM, with intent to fix it correctly later i.e.: 1. pick unused IRQ as default one for TPM 2. fetch IRQ value from device model so that user could override default one if it conflicts with some other device. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* pc: acpi: tpm: add missing MMIO resource to PCI0._CRSIgor Mammedov2019-11-291-0/+5
| | | | | | | | | | | | | | | | | | | Windows will fail initialize TMP driver with the reason: 'device cannot find enough free resources' That happens because parent BUS doesn't describe MMIO resources used by TPM child device. Fix it by describing it in top-most parent bus scope PCI0. It was 'regressed' by commit 5cb18b3d TPM2 ACPI table support with following fixup 9e472263 acpi: add missing ssdt which did the right thing by moving TPM to BUS it belongs to but lacked a proper resource declaration. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-input: support absolute axis config in pass-throughLadi Prosek2019-11-292-5/+47
| | | | | | | | | | VIRTIO_INPUT_CFG_ABS_INFO was not implemented for pass-through input devices. This patch follows the existing design and pre-fetches the config for all absolute axes using EVIOCGABS at realize time. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1460558603-18331-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: fix emulated tablet axis rangesLadi Prosek2019-11-291-2/+2
| | | | | | | | | The reported maximum was wrong. The X and Y coordinates are 0-based so if size is 8000 maximum must be 7FFF. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1460128893-10244-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: add live migration supportGerd Hoffmann2019-11-291-0/+40
| | | | | | | | | | | | | virtio-input is simple enough that it doesn't need to xfer any state. Still we have to wire up savevm manually, so the generic pci and virtio are saved correctly. Additionally we need to do some post-load processing to figure whenever the guest uses the device or not, so we can give input routing hints to the qemu input layer using qemu_input_handler_{activate,deactivate}. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1459859501-16965-1-git-send-email-kraxel@redhat.com
* virtio-input: implement pass-through evdev writesLadi Prosek2019-11-291-0/+23
| | | | | | | | | | | The write path for pass-through devices, commonly used for controlling keyboard LEDs via EV_LED, was not implemented. This commit adds the necessary plumbing to connect the status virtio queue to the host evdev file descriptor. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1459511146-12060-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: retrieve EV_LED host config bitsLadi Prosek2019-11-291-0/+1
| | | | | | | | | VIRTIO_INPUT_CFG_EV_BITS with subsel of EV_LED was always returning an empty bitmap for pass-through input devices. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1459418028-7473-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: add missing key mappingsLadi Prosek2019-11-291-0/+2
| | | | | | | | | | | | KEY_PAUSE is flat out missing. KEY_SYSRQ already has a keycode assigned but it's not what I'm seeing on my system. The mapping doesn't appear to have to be unique so both keycodes now map to KEY_SYSRQ which is what the "Keyboard PrintScreen", HID usage ID 0x46, translates to. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1459343240-19483-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ivshmem: fix ivshmem-{plain,doorbell} crash without argMarc-André Lureau2019-11-291-0/+30
| | | | | | | | | "qemu -device ivshmem-{plain,doorbell}" will crash, because the device doesn't check that the required argument is provided. (screwed up in commit 5400c02) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
* ide: really restart pending and in-flight atapi dmaPavel Butsykin2019-11-294-22/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Restart of ATAPI DMA used to be unreachable, because the request to do so wasn't indicated in bus->error_status due to the lack of spare bits, and ide_restart_bh() would return early doing nothing. This patch makes use of the observation that not all bit combinations were possible in ->error_status. In particular, IDE_RETRY_READ only made sense together with IDE_RETRY_DMA or IDE_RETRY_PIO. This allows to re-use IDE_RETRY_READ alone as an indicator of ATAPI DMA restart request. To makes things more uniform, ATAPI DMA gets its own value for ->dma_cmd. As a means against confusion, macros are added to test the state of ->error_status. The patch fixes the restart of both in-flight and pending ATAPI DMA, following the scheme similar to that of IDE DMA. [Including a fixup patch: Message-id: 1460465594-15777-1-git-send-email-pbutsykin@virtuozzo.com --js] Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1459924806-306-4-git-send-email-den@openvz.org Signed-off-by: John Snow <jsnow@redhat.com>
* ide: restart atapi dma by re-evaluating command packetPavel Butsykin2019-11-291-7/+6
| | | | | | | | | | | | | | | ide_atapi_dma_restart() used to just complete the DMA with an error, under the assumption that there isn't enough information to restart it. However, as the contents of the ->io_buffer is preserved, it looks safe to just re-evaluate it and dispatch the ATAPI command again. Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1459924806-306-3-git-send-email-den@openvz.org Signed-off-by: John Snow <jsnow@redhat.com>
* ide: don't lose pending dma statePavel Butsykin2019-11-293-8/+20
| | | | | | | | | | | | | | | | | | | | | | | | If the migration occurs after the IDE DMA has been set up but before it has been initiated, the state gets lost upon save/restore. Specifically, ->dma_cb callback gets cleared, so, when the guest eventually starts bus mastering, the DMA never completes, causing the guest to time out the operation. OTOH all the infrastructure is already in place to restart the DMA if the migration happens while the DMA is in progress. So reuse that infrastructure, by setting bus->error_status based on ->dma_cmd in pre_save if ->dma_cb callback is already set but DMAING is clear. This will indicate the need for restart and make sure ->dma_cb is restored in ide_restart_bh(); howeover since DMAING is clear the state upon restore will be exactly "ready for DMA" as before the save. Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1459924806-306-2-git-send-email-den@openvz.org Signed-off-by: John Snow <jsnow@redhat.com>
* xen: Fix IDE unplugAnthony PERARD2019-11-291-0/+1
| | | | | | | | | | | | | | After commit e5e7855 (blockdev: Separate BB name management), starting a guest with PVHVM support result in this assert: qemu-system-i386: block/block-backend.c:173: blk_delete: Assertion `!blk->name' failed. A backtrace show that a caller is pci_piix3_xen_ide_unplug(). This patch fix it. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Message-id: 1460382666-29885-1-git-send-email-anthony.perard@citrix.com Signed-off-by: John Snow <jsnow@redhat.com>
* xenfb: use the correct condition to avoid excessive loopingWei Liu2019-11-291-1/+1
| | | | | | | | | | | | In commit ac0487e1 ("xenfb.c: avoid expensive loops when prod <= out_cons"), ">=" was used. In fact, a full ring is a legit state. Correct the test to use ">". Reported-by: "Hao, Xudong" <xudong.hao@intel.com> Signed-off-by: Wei Liu <wei.liu2@citrix.com> Tested-by: "Hao, Xudong" <xudong.hao@intel.com> Acked-by: Anthony Perard <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
* net: stellaris_enet: check packet length against receive bufferPrasad J Pandit2019-11-291-1/+11
| | | | | | | | | | | | | When receiving packets over Stellaris ethernet controller, it uses receive buffer of size 2048 bytes. In case the controller accepts large(MTU) packets, it could lead to memory corruption. Add check to avoid it. Reported-by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1460095428-22698-1-git-send-email-ppandit@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* virtio-gpu: block live migrationGerd Hoffmann2019-11-291-0/+7
| | | | | | | | | | Feeling a bit nervous putting the full live migration support patch (https://patchwork.ozlabs.org/patch/606902/) in that late in the 2.6 devel cycle as it carries some non-trivial changes. So disable migration in case virtio-gpu is present for now. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ui/virtio-gpu: add and use qemu_create_displaysurface_pixmanGerd Hoffmann2019-11-291-4/+1
| | | | | | | | | | | | | | | | | | Add a the new qemu_create_displaysurface_pixman function, to create a DisplaySurface backed by an existing pixman image. In that case there is no need to create a new pixman image pointing to the same backing storage. We can just use the existing image directly. This does not only simplify things a bit, but most importantly it gets the reference counting right, so the backing storage for the pixman image wouldn't be released underneath us. Use new function in virtio-gpu, where using it actually fixes use-after-free crashes. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1459499240-742-1-git-send-email-kraxel@redhat.com
* hw/mips_itu: fix off-by-one reported by CoverityLeon Alrae2019-11-291-8/+3
| | | | | | | | | Fix off-by-one error in ITC Tag read. Remove the switch as we just want to check if index is in valid range rather than test against list of values. Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* spapr: Fix ibm,lrdr-capacityBharata B Rao2019-11-291-2/+5
| | | | | | | | | | ibm,lrdr-capacity has a field to describe the maximum address in bytes and therefore, the most memory that can be allocated to this guest. We are using maxmem for this field, but instead should use the actual RAM address corresponding to the end of hotplug region. Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* spapr: fix possible Negative array index readGonglei2019-11-291-0/+4
| | | | | | | | fix CID 1351391. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Message-Id: <1456998223-12356-6-git-send-email-arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS"Bill Paul2019-11-291-12/+2
| | | | | | | | | | | | | | | | This reverts commit 0d63b2dd31464cfccc80bbeedc24e3863fe4c895. This change was originally intended to correct the HPET behavior in conjunction with Linux, however the behavior that it actually creates is not compatible with the ioapic.c implementation; it used to be compatible with KVM's own IOAPIC but it is not anymore. Signed-off-by: Bill Paul <wpaul@windriver.com> CC: Paolo Bonzini <pbonzini@redhat.com> CC: Richard Henderson <rth@twiddle.net> CC: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <201604051558.20070.wpaul@windriver.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* ps2kbd: default to scancode_set 2, as with KBD_CMD_RESETHervé Poussineau2019-11-291-1/+1
| | | | | | | | | | | | | This line has been added in commit ef74679a810fe6858f625b9d52b68cc3fc61eb3d with other initializations. However, scancode set 0 doesn't exist (only 1, 2, 3). This works well as long as operating system is resetting keyboard, or overwriting the current scancode set with the one it wants. This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET or KBD_CMD_SCANCODE. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1458714100-28885-1-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/pci-bridge: Add missing unref in case register-bus failsWei Jiangang2019-11-291-1/+7
| | | | | | | | | | | | | The error paths after a successful qdev_create/pci_bus_new should contain a object_unref/object_unparent. pxb_dev_init_common() did not yet, so add it. Signed-off-by: Wei Jiangang <weijg.fnst@cn.fujitsu.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
* virtio: merge virtio_queue_aio_set_host_notifier_handler with ↵Paolo Bonzini2019-11-293-24/+12
| | | | | | | | | | | | | | | virtio_queue_set_aio Eliminating the reentrancy is actually a nice thing that we can do with the API that Michael proposed, so let's make it first class. This also hides the complex assign/set_handler conventions from callers of virtio_queue_aio_set_host_notifier_handler, which in fact was always called with assign=true. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-scsi: use aio handler for data planePaolo Bonzini2019-11-292-25/+83
| | | | | | | | | | | | | | In addition to handling IO in vcpu thread and in io thread, dataplane introduces yet another mode: handling it by AioContext. This reuses the same handler as previous modes, which triggers races as these were not designed to be reentrant. Use a separate handler just for aio, and disable regular handlers when dataplane is active. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-blk: use aio handler for data planeMichael S. Tsirkin2019-11-292-10/+30
| | | | | | | | | | | | | | In addition to handling IO in vcpu thread and in io thread, dataplane introduces yet another mode: handling it by AioContext. This reuses the same handler as previous modes, which triggers races as these were not designed to be reentrant. Use a separate handler just for aio, and disable regular handlers when dataplane is active. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: add aio handlerMichael S. Tsirkin2019-11-291-4/+32
| | | | | | | | | | | | | | | In addition to handling IO in vcpu thread and in io thread, blk dataplane introduces yet another mode: handling it by AioContext. Currently, this reuses the same handler as previous modes, which triggers races as these were not designed to be reentrant. Add instead a separate handler just for aio; this will make it possible to disable regular handlers when dataplane is active. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-scsi: fix disabled modePaolo Bonzini2019-11-291-2/+2
| | | | | | | | | | | | | | Add two missing checks for s->dataplane_fenced. In one case, QEMU would skip injecting an IRQ due to a write to an uninitialized EventNotifier's file descriptor. In the second case, the dataplane_disabled field was used by mistake; in fact after fixing this occurrence it is completely unused. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-blk: fix disabled modePaolo Bonzini2019-11-292-5/+4
| | | | | | | | | | | We must not call virtio_blk_data_plane_notify if dataplane is disabled: we would hit a segmentation fault in notify_guest_bh as s->guest_notifier has not been setup and is NULL. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: make virtio_queue_notify_vq staticPaolo Bonzini2019-11-291-1/+1
| | | | | | | Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
OpenPOWER on IntegriCloud